rigortype 0.4.6 → 0.4.7

data/lib/rigor/environment/reflection.rb

@@ -2,21 +2,21 @@
 
 module Rigor
   class Environment
-    # Frozen, `Ractor.shareable?` read-only RBS query facade.
+    # Frozen read-only RBS query facade.
     # [ADR-15](../../../docs/adr/15-ractor-concurrency.md) Phase 2b extracts the read-only surface of
     # {RbsLoader} into this carrier so future Ractor-isolated workers can share one Reflection across the
     # pool while keeping the per-Ractor mutable accelerator state (per-process memo Hashes) where it belongs.
     #
     # Backing tables (all frozen at construction):
     #
-    # - `known_class_names` — `Set<String>` of every class / module / alias name in the loaded RBS
-    #   environment. Top-level prefixed (`"::Hash"`); plain queries normalise via {#normalise}.
-    # - `instance_definitions` — `Hash<String, RBS::Definition>` keyed on `RBS::TypeName#to_s` (top-level
+    # - `known_class_names` — every class / module / alias name in the loaded RBS environment.
+    #   Top-level prefixed (`"::Hash"`); the query methods accept either form.
+    # - `instance_definitions` — `RBS::Definition` per class, keyed on `RBS::TypeName#to_s` (top-level
     #   prefixed).
     # - `singleton_definitions` — same shape, singleton side.
-    # - `type_param_names` — `Hash<String, Array<Symbol>>` of declared type parameters per class.
-    # - `constant_types` — `Hash<String, Rigor::Type>` of translated constant declarations.
-    # - `ancestor_names` — `Hash<String, Array<String>>` of normalised ancestor chains per class.
+    # - `type_param_names` — declared type parameters per class.
+    # - `constant_types` — translated constant declarations.
+    # - `ancestor_names` — normalised ancestor chains per class.
     #
     # Each `Reflection` instance is `frozen?` at construction — every cached table is frozen, `self` is
     # frozen. **NOT** `Ractor.shareable?`: the `instance_definitions` / `singleton_definitions` tables hold

data/lib/rigor/environment/required_features.rb

@@ -296,17 +296,14 @@ module Rigor
         name.start_with?(TOKEN_PREFIX) ? name.delete_prefix(TOKEN_PREFIX) : nil
       end
 
-      # The vendored directory basenames a library list activates.
       def active_dirs(library_names)
         library_names.filter_map { |name| VENDORED_DIRS[feature_of_token(name)] }
       end
 
-      # Whether `dir_basename` is one of the gated directories.
       def gated_dir?(dir_basename)
         VENDORED_DIRS.value?(dir_basename)
       end
 
-      # The feature a gated directory loads for.
       def feature_for_dir(dir_basename)
         VENDORED_DIRS.key(dir_basename)
       end

data/lib/rigor/environment/ruby_library_roots.rb

@@ -28,7 +28,7 @@ module Rigor
     #
     # The directories are resolved at load time, on the main Ractor: `RbConfig::CONFIG` and `Gem.default_dir`
     # read non-shareable constants and raise `Ractor::IsolationError` inside a pool worker. The scan itself runs
-    # lazily (about 0.1 s), memoised per loader, and only for a class about to be reported.
+    # lazily (about 0.1 s), memoised per process, and only for a class about to be reported.
     module RubyLibraryRoots
       STDLIB_ROOT = begin
         ::RBS::Repository::DEFAULT_STDLIB_ROOT.to_s.dup.freeze

data/lib/rigor/environment/vendored_signature_plan.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+require "rbs"
+require_relative "../rooted_glob"
+require_relative "gated_signature_plan"
+
+module Rigor
+  class Environment
+    # Issue #2470 — a `data/vendored_gem_sigs/<gem>/` member another signature source also declares stands down,
+    # so the other source's declaration binds instead of the two failing the class's definition build.
+    #
+    # The vendored directories load on `RBS::EnvironmentLoader`'s batch path, ahead of the project's
+    # `signature_paths:` (its own `sig/`, an `rbs collection install`, a gem's `sig/`). A file there that reopens
+    # a vendored class and declares one of its methods again — the activerecord 8.1 collection's `patch.rbs`
+    # writes `def async_exec` on `PG::Connection`, where the vendored `pg.rbs` has `alias async_exec exec` — made
+    # `RBS::DefinitionBuilder` raise `DuplicatedMethodDefinitionError` for the class, which Rigor keeps known, so
+    # every call into it read `Dynamic[top]`.
+    #
+    # {.build} is the #1713 member rule ({GatedSignaturePlan}) applied to the ungated directories, planned from
+    # the signature files themselves rather than from a trial build: the vendored copy is Rigor's guess at a gem's
+    # surface, and the project chose the other source, so the other source wins (`RbsLoader.build_env_for`'s
+    # stated precedence). Only a directory with a member to leave out is planned; the rest stay on the batch path.
+    # An overload continuation (`def m: ... | ...`) declares nothing of its own and keeps the vendored base.
+    #
+    # The plan is a pure function of the vendored files and the signature files, both of which the env-cache key
+    # digests, so a cold and a warm run build the same environment.
+    module VendoredSignaturePlan
+      # `dirs` — the vendored directories (Pathnames) to keep off the batch path; `sources` — their files as
+      # `[buffer, directives, decls]`, the taken members left out, to add right after the batch; `takers` — the
+      # signature files a member stood down to. A member stands down only to a file that stays in the env: the
+      # caller re-plans without each taker the build quarantined (`RbsLoader.build_env_attempt`), or the method
+      # would have no declaration at all.
+      Plan = Data.define(:dirs, :sources, :takers)
+      EMPTY = Plan.new(dirs: [].freeze, sources: [].freeze, takers: Set.new.freeze)
+
+      # A `class` / `module` header, after any `%a{...}` / `%a(...)` / `%a[...]` annotations on the same line.
+      ANNOTATED_HEADER = /^\s*(?:%a(?:\{[^}]*\}|\([^)]*\)|\[[^\]]*\])\s*)*(?:class|module)\s+(?:::)?/
+
+      module_function
+
+      # @param roots — the ungated vendored directories this build loads.
+      # @param signature_files — the absolute paths of the signature files that outrank them.
+      # @param excluded — signature files to plan without: takers a previous build of this env quarantined.
+      def build(roots, signature_files, excluded = Set.new)
+        files = signature_files.reject { |file| excluded.include?(file) }
+        return EMPTY if roots.empty? || files.empty?
+
+        parsed = roots.to_h { |root| [root, parsed_sources(root)] }
+        taken = taken_keys(files, header_pattern(parsed.values.flatten(1)))
+        return EMPTY if taken.empty?
+
+        takers = Set.new
+        planned = parsed.filter_map do |root, sources|
+          kept = plan_sources(sources, taken, takers)
+          [root, kept] if kept
+        end
+        return EMPTY if planned.empty?
+
+        Plan.new(dirs: planned.map(&:first), sources: planned.flat_map(&:last), takers: takers.freeze)
+      end
+
+      # A vendored directory's files, parsed, under the Pathname buffer names the loader's batch path gives them,
+      # in the set `RBS::EnvironmentLoader#add(path:)` reads: every `.rbs` under it.
+      def parsed_sources(root)
+        RootedGlob.glob(root, "**/*.rbs").sort.filter_map { |file| RbsLoader.parse_signature_file(Pathname(file)) }
+      end
+
+      # `sources` with the taken members left out, or nil when nothing is taken from any of them.
+      def plan_sources(sources, taken, takers)
+        kept = sources.map do |buffer, directives, decls|
+          [buffer, directives, plan_decls(decls, nil, taken, takers)]
+        end
+        kept unless kept.zip(sources).all? { |(_, _, after), (_, _, before)| unchanged?(after, before) }
+      end
+
+      # A header naming one of the vendored top-level types, which every declaration of a vendored type (nested or
+      # `A::B`-qualified) starts from. A pre-filter only: the matches are parsed.
+      def header_pattern(parsed)
+        heads = parsed.flat_map do |_buffer, _directives, decls|
+          decls.filter_map { |decl| GatedSignaturePlan.type_declaration?(decl) && decl.name.to_s.delete_prefix("::") }
+        end
+        segments = heads.map { |name| Regexp.escape(name.split("::").first) }.uniq
+        return nil if segments.empty?
+
+        /#{ANNOTATED_HEADER}(?:#{segments.join('|')})\b/
+      end
+
+      # `{type name => {[method, kind] => Set[file]}}` over the signature files that declare a vendored top-level
+      # type.
+      def taken_keys(signature_files, pattern)
+        taken = Hash.new { |hash, name| hash[name] = Hash.new { |keys, key| keys[key] = Set.new } }
+        return taken if pattern.nil?
+
+        signature_files.sort.each do |file|
+          text = RbsLoader.read_signature_text(file)
+          next if text.nil? || !text.match?(pattern)
+
+          decls = RbsLoader.parse_signature_source(file, text)
+          collect_keys(decls, nil, taken, file) if decls
+        end
+        taken
+      end
+
+      def collect_keys(decls, namespace, taken, file)
+        decls.each do |decl|
+          next unless GatedSignaturePlan.type_declaration?(decl)
+
+          name = GatedSignaturePlan.qualify(namespace, decl.name)
+          decl.members.each do |member|
+            RbsLoader.member_method_keys(member).each { |key| taken[name][key] << file }
+          end
+          collect_keys(decl.members, name, taken, file)
+        end
+      end
+
+      # `decls` with every member `taken` declares for its type left out, nested types planned the same way, and
+      # the files each left-out member stood down to added to `takers`. A declaration nothing is taken from is
+      # returned as itself, which is how {.build} tells a directory unchanged.
+      def plan_decls(decls, namespace, taken, takers)
+        decls.map do |decl|
+          next decl unless GatedSignaturePlan.type_declaration?(decl)
+
+          plan_type(decl, GatedSignaturePlan.qualify(namespace, decl.name), taken, takers)
+        end
+      end
+
+      def unchanged?(after, before)
+        after.size == before.size && after.zip(before).all? { |a, b| a.equal?(b) }
+      end
+
+      def plan_type(decl, name, taken, takers)
+        keys = taken.fetch(name, nil)
+        members = decl.members.filter_map do |member|
+          if GatedSignaturePlan.type_declaration?(member)
+            plan_type(member, GatedSignaturePlan.qualify(name, member.name), taken, takers)
+          elsif keys
+            plan_member(member, keys, takers)
+          else
+            member
+          end
+        end
+        return decl if unchanged?(members, decl.members)
+
+        GatedSignaturePlan.rebuild(decl, members: members)
+      end
+
+      def plan_member(member, keys, takers)
+        RbsLoader.member_method_keys(member).each { |key| takers.merge(keys[key]) if keys.key?(key) }
+        GatedSignaturePlan.untaken(member, keys)
+      end
+    end
+  end
+end

data/lib/rigor/environment.rb

@@ -16,6 +16,7 @@ require_relative "environment/bundle_sig_discovery"
 require_relative "environment/lockfile_resolver"
 require_relative "environment/installed_gem_set"
 require_relative "environment/rbs_collection_discovery"
+require_relative "environment/project_path_gems"
 require_relative "environment/source_rbs_synthesis"
 require_relative "plugin/isolation"
 require_relative "cache/engine_source"
@@ -39,7 +40,7 @@ module Rigor
     DEFAULT_PROJECT_SIG_DIR = "sig"
     private_constant :DEFAULT_PROJECT_SIG_DIR
 
-    # `DEFAULT_LIBRARIES` is defined in the light `environment/default_libraries.rb` (required below) so the
+    # `DEFAULT_LIBRARIES` is defined in the light `environment/default_libraries.rb` (required above) so the
     # ADR-87 WD4 boot-slimming probe can read it without loading the inference engine.
 
     # ADR-72 — a Gemfile.lock gem name mapped to the opt-in plugin id that ships the SAME core-ext RBS. When
@@ -146,7 +147,7 @@ module Rigor
     # code (`Plugin::Registry#hkt_overlay_registry` reads each manifest); before this it sat one line ABOVE
     # the #784 rescue, so a raise there escaped {#hkt_registry} entirely. Post-#788 that is not a per-file
     # crash storm but an uncaught abort: {HktRegistryHolder#fetch} memoises only on success, so the raise
-    # is re-attempted at every demand, and the run-owned demands (`Runner::PoolCoordinator#hkt_scan_outcome`
+    # is re-attempted at every demand, and the run-owned demands (`Runner::RunLevelFacts::Collect.hkt_scan_failure`
     # after the file loop, `Analysis::WorkerSession#drain_reporters`) sit outside any rescue.
     #
     # The degradation is narrower than the scan's: only the plugin overlay is dropped, and the RBS scan
@@ -265,8 +266,10 @@ module Rigor
       #   `nil` (the default), the canonical project layout `<root>/sig` is used if it exists, otherwise no
       #   signature path is loaded.
       # @param cache_store — persistent cache threaded into the underlying
-      #   {Environment::RbsLoader} so constant lookups (and, in later v0.0.9 slices, other reflection
-      #   artefacts) consult the cache. Pass `nil` (the default) to skip caching for this environment.
+      #   {Environment::RbsLoader} so constant lookups consult the cache. Pass `nil` (the default) to skip
+      #   caching for this environment.
+      # @param core_root — issue #2517 — a core signature directory loaded in place of the `rbs` gem's `core/`
+      #   ({Configuration#core_root}); nil (the default) loads the gem's core.
       # rubocop:disable-next Metrics/MethodLength, Metrics/ParameterLists
       def for_project(root: Dir.pwd, libraries: [], signature_paths: nil, cache_store: nil, # rubocop:disable Metrics/AbcSize
                       plugin_registry: nil, dependency_source_index: nil,
@@ -276,7 +279,8 @@ module Rigor
                       bundler_lockfile: nil,
                       rbs_collection_lockfile: nil, rbs_collection_auto_detect: false,
                       synthetic_method_index: nil, project_patched_methods: nil,
-                      source_files: [], locked_gems: nil, required_features: nil)
+                      source_files: [], locked_gems: nil, required_features: nil, core_root: nil,
+                      paths: nil, exclude_patterns: nil, exclude_base: nil)
         resolved_paths = project_signature_roots(signature_paths, root: root)
         # O4 MVP — append per-gem `sig/` directories discovered under the target project's bundler install
         # root. Empty array when neither an explicit path nor auto-detection finds a bundle. Order: user
@@ -318,7 +322,11 @@ module Rigor
         # Issue #1700 — plus the gated vendored directories this run's source activates ({#feature_tokens}).
         merged_libraries = (DEFAULT_LIBRARIES + libraries.map(&:to_s) +
                             feature_tokens(required_features, source_files, libraries)).uniq
-        skip_gem_names = collection_skip_gem_names(merged_libraries)
+        # Issue #2441 — plus the project's own path gems ({ProjectPathGems}), whose collection copy would
+        # double-declare the project's `sig/`.
+        project_gems = ProjectPathGems.names(locked, paths: paths, root: root, exclude_patterns: exclude_patterns,
+                                                     exclude_base: exclude_base || root)
+        skip_gem_names = collection_skip_gem_names(merged_libraries) + project_gems.to_a
         collection_paths = RbsCollectionDiscovery.discover(
           lockfile_path: rbs_collection_lockfile,
           project_root: root,
@@ -338,8 +346,10 @@ module Rigor
         # opt-in plugin twin is REACHABLE — loaded as a plugin, or wired in by `signature_paths:` (#672) —
         # so the two never both declare the methods. The paths ride in `loader_signature_paths`, so the env
         # cache descriptor digests them for free.
+        # Issue #2441 — the project's own path gems are neither missing RBS nor overlay-eligible: the project's
+        # `sig/` declares them, and an overlay (`data/gem_overlay/activesupport`) would collide with it.
         missing_gems, overlay_paths = missing_gems_and_overlay_paths(
-          locked: locked, default_libraries: merged_libraries, bundle_sig_paths: gem_sig_paths,
+          locked: locked.except(*project_gems), default_libraries: merged_libraries, bundle_sig_paths: gem_sig_paths,
           rbs_collection_paths: collection_paths, plugin_registry: plugin_registry,
           signature_paths: resolved_paths, bundle_root: bundle_root
         )
@@ -366,7 +376,8 @@ module Rigor
           # the bundle walk and `rbs collection install` all stay authoritative.
           deferred_signature_paths: plugin_sig_paths,
           project_signature_paths: resolved_paths,
-          required_features: required_features || RequiredFeatures.scan(source_files, sig_paths: resolved_paths)
+          required_features: required_features || RequiredFeatures.scan(source_files, sig_paths: resolved_paths),
+          core_root: core_root
         )
         # Issues #824 / #1075 — the rows ADR-112 WD5's consistency rule reports for members the project's
         # own `sig/` and an inline source both declare: an error per contradiction (or per refinement that
@@ -376,6 +387,10 @@ module Rigor
         # on every run, so the member-level outcome needs no plumbing of its own. Costs nothing for a project
         # with no inline RBS: the loader's reader short-circuits on an empty `virtual_rbs`.
         record_member_consistency(loader, source_rbs_synthesis_reporter, root)
+        # Issue #2517 — a selected core is built here, not lazily. The env is first demanded from inside a file's
+        # analysis, under rescues that turn any raise into one `internal analyzer error` row per file; building it
+        # now raises the {CoreRootError} once, before analysis, where the CLI reports it as a configuration error.
+        loader.verify_core_root!
         # ADR-20 slice 2c + 2e — seed hkt_registry with the bundled builtins. The Environment's
         # `#hkt_registry` getter then LAZILY merges in the RBS env scan on first call so fast paths that
         # don't consult HKT (e.g. `rigor check --cache-stats --no-stats`) don't pay the eager env-build cost
@@ -492,7 +507,7 @@ module Rigor
       end
 
       # ADR-72 — resolve the bundled RBS overlay directories to load for this project. A gem is eligible when
-      # it is classified `:missing` (see {missing_rbs_gem_rows}) and its conflicting opt-in plugin twin (if
+      # it is classified `:missing` (see {missing_rows}) and its conflicting opt-in plugin twin (if
       # any) is NOT already reachable. Returns `[Pathname]`, deterministically ordered, or `[]` when no
       # eligible gem.
       #
@@ -644,6 +659,8 @@ module Rigor
       def record_member_undecided(reporter, record, root)
         plugin_id, path = split_virtual_source_name(record.virtual_name)
         return if path.nil?
+        return record_variable_undecided(reporter, record, root, plugin_id, path) if
+          MemberConsistency.variable_kind?(record.kind)
 
         reporter.record(
           plugin_id: plugin_id, path: path, kind: :not_honoured,
@@ -656,8 +673,22 @@ module Rigor
         )
       end
 
+      # Issue #2440 — an instance variable declared by both sides with different types. `sig/` binds
+      # (the coordinator's ruling on #2440, ADR-5): the row is `:info`, never `rbs.contradicting-signature`.
+      def record_variable_undecided(reporter, record, root, plugin_id, path)
+        reporter.record(
+          plugin_id: plugin_id, path: path, kind: :not_honoured,
+          message: "`#{member_label(record)}` is also declared in " \
+                   "`#{path_relative_to(record.signature_path, root)}` with a different type " \
+                   "(#{record.detail}), so the `.rbs` declaration binds and the inline one was dropped. " \
+                   "RBS rejects two declarations of one instance variable, so only one can stay; " \
+                   "regenerate the committed `.rbs` (`rbs-inline --output`) or align the two types."
+        )
+      end
+
+      # `Demo#m` / `Demo.m` for a method, `Demo#@x` / `Demo.@x` for an instance / class instance variable.
       def member_label(record)
-        separator = record.kind == :singleton ? "." : "#"
+        separator = %i[singleton class_instance_variable].include?(record.kind) ? "." : "#"
         "#{record.class_name}#{separator}#{record.method_name}"
       end
 

data/lib/rigor/flow_contribution/merger.rb

@@ -26,13 +26,13 @@ module Rigor
     #
     # ## Composition rules (ADR-2)
     #
-    # - `:return_type` — Intersect via `Type::Combinator.intersection`; collapse to bot raises
-    #   `:return_type_collapse`.
+    # - `:return_type` — Intersect via `Type::Combinator.intersection`; collapse to bot records a
+    #   `:return_type_collapse` conflict.
     # - `:truthy_fact` / `:falsey_fact` / `:post_return_fact` — Edge-local; accumulate while deduping by
     #   payload equality.
     # - `:mutation` / `:invalidation` / `:role` — Union; dedupe by equality.
-    # - `:exception` — Single-valued. Two non-`nil` non-equal exceptional effects raise
-    #   `:exceptional_disagreement`.
+    # - `:exception` — Single-valued. Two non-`nil` non-equal exceptional effects record an
+    #   `:exceptional_disagreement` conflict.
     #
     # ## Cross-tier contradictions
     #

data/lib/rigor/inference/acceptance.rb

@@ -75,41 +75,66 @@ module Rigor
       }.freeze
       private_constant :TYPE_HANDLERS
 
-      UNREAD_HASH_REFUSED_KEY = :__rigor_acceptance_unread_hash_refused__
-      private_constant :UNREAD_HASH_REFUSED_KEY
-
-      # Whether a `maybe` for `param` against `arg` rests on a record that could not read a hash's entries: a
-      # `Hash` with a gradual arm ({#gradual_hash?}) or an open `HashShape`. The record cannot prove the key set
-      # of either, and its `maybe` climbs through whatever holds the record. `OverloadSelector`'s strict pass
-      # reads that `maybe` as no evidence for the overload, so this re-asks with each such record answering
-      # `no` and reports whether the pair then fails. A `maybe` from anywhere else (a subclass only the Ruby
-      # source declares, a splat under a parameter that is no record) survives the re-ask and still counts.
-      def maybe_rests_on_unread_hash?(param, arg)
-        return false unless contains_type?(param) { |type| type.is_a?(Type::HashShape) }
-        return false unless contains_type?(arg) { |type| unread_hash?(type) }
-
-        refusing_unread_hashes { accepts(param, arg, mode: :gradual).no? }
+      UNREAD_SHAPE_REFUSED_KEY = :__rigor_acceptance_unread_shape_refused__
+      private_constant :UNREAD_SHAPE_REFUSED_KEY
+
+      # Whether a `maybe` for `param` against `arg` rests on a shape that could not read its argument: a record
+      # against a `Hash` with a gradual arm ({#gradual_hash?}) or an open `HashShape`, or a tuple against an
+      # `Array` of unknown arity ({#array_carrier?}). The shape cannot prove the key set or the length, and its
+      # `maybe` climbs through whatever holds it. `OverloadSelector`'s strict pass reads that `maybe` as no
+      # evidence for the overload, so this re-asks with each such shape answering `no` and reports whether the
+      # pair then fails. A `maybe` from anywhere else (a subclass only the Ruby source declares, a splat under a
+      # parameter that is no shape) survives the re-ask and still counts.
+      def maybe_rests_on_unread_shape?(param, arg)
+        return false unless rests_on_unread_hash?(param, arg) || rests_on_unread_array?(param, arg)
+
+        refusing_unread(:all) { accepts(param, arg, mode: :gradual).no? }
       end
 
+      # Whether any of `types` holds an `Array` a tuple cannot read ({#array_carrier?}), so a match may rest on
+      # the tuple's `maybe`. `OverloadSelector`'s gradual pass asks before re-matching under
+      # {#refusing_unread_arrays}.
+      def unread_array_in?(types)
+        types.any? { |type| contains_type?(type) { |inner| array_carrier?(inner) } }
+      end
+
+      # Runs the block with each tuple answering `no`, not `maybe`, for an `Array` of unknown arity. A record's
+      # `maybe` for an unread hash is untouched.
+      def refusing_unread_arrays(&) = refusing_unread(:array, &)
+
       # rubocop:disable-next Metrics/ClassLength
       class << self
         private
 
-        # The flag lives on the thread, not on a parameter, because the record may sit any number of `accepts`
+        def rests_on_unread_hash?(param, arg)
+          contains_type?(param) { |type| type.is_a?(Type::HashShape) } &&
+            contains_type?(arg) { |type| unread_hash?(type) }
+        end
+
+        def rests_on_unread_array?(param, arg)
+          contains_type?(param) { |type| type.is_a?(Type::Tuple) } &&
+            contains_type?(arg) { |type| array_carrier?(type) }
+        end
+
+        # The flag lives on the thread, not on a parameter, because the shape may sit any number of `accepts`
         # calls below the one asked (a tuple element, a `Hash` value, a union member), and those calls go
-        # through each carrier's `Type#accepts`. It is set only for the duration of the block.
-        def refusing_unread_hashes
-          previous = Thread.current[UNREAD_HASH_REFUSED_KEY]
-          Thread.current[UNREAD_HASH_REFUSED_KEY] = true
+        # through each carrier's `Type#accepts`. It is set only for the duration of the block. `kind` is `:all`
+        # (records and tuples) or `:array` (tuples only).
+        def refusing_unread(kind)
+          previous = Thread.current[UNREAD_SHAPE_REFUSED_KEY]
+          Thread.current[UNREAD_SHAPE_REFUSED_KEY] = kind
           yield
         ensure
-          Thread.current[UNREAD_HASH_REFUSED_KEY] = previous
+          Thread.current[UNREAD_SHAPE_REFUSED_KEY] = previous
         end
 
-        # The `maybe` a record answers for a hash whose entries it cannot read, or `no` inside
-        # {#refusing_unread_hashes}.
-        def unread_hash_maybe(mode, reason)
-          return hash_shape_no(mode, "#{reason} (refused as evidence)") if Thread.current[UNREAD_HASH_REFUSED_KEY]
+        # The `maybe` a shape of `kind` (`:hash` or `:array`) answers for an argument it cannot read, or `no`
+        # inside {#refusing_unread} for that kind.
+        def unread_shape_maybe(mode, reason, kind)
+          refused = Thread.current[UNREAD_SHAPE_REFUSED_KEY]
+          if refused == :all || refused == kind
+            return Type::AcceptsResult.no(mode: mode, reasons: "#{reason} (refused as evidence)")
+          end
 
           Type::AcceptsResult.maybe(mode: mode, reasons: reason)
         end
@@ -469,9 +494,10 @@ module Rigor
         end
 
         # Returns `other_type` rewritten so its type_args have the same arity as `self_type.type_args`, or
-        # `nil` if no projection is known. Today only the Hash → Enumerable projection is hand-rolled; a
-        # general RBS-driven implementation that consults `definition.ancestors[i].args` for arbitrary
-        # subclass / module-include relations is the principled follow-up.
+        # `nil` if no projection is known. Today the Hash → Enumerable and ArithmeticSequence → Enumerator
+        # projections are hand-rolled; a general RBS-driven implementation that consults
+        # `definition.ancestors[i].args` for arbitrary subclass / module-include relations is the principled
+        # follow-up.
         def project_to_target_arity(self_type, other_type)
           return nil if self_type.type_args.size == other_type.type_args.size
           return nil if self_type.type_args.empty? || other_type.type_args.empty?
@@ -881,8 +907,8 @@ module Rigor
         # `Refined[base, predicate]` accepts another type X when the base accepts the *base* of X *and* X is
         # provably contained in the predicate's value set. The base check is delegated to
         # `accepts(self.base, X.base)` so handlers like `accepts_nominal` see Nominal-vs-Nominal and return
-        # their normal answer (the inner `accepts_nominal` does not register `Refined` / `Difference` as
-        # direct other-shapes — projecting to the base is what makes the comparison meaningful).
+        # their normal answer (`accepts_nominal` projects a `Refined` / `Difference` other onto its base,
+        # which is what makes the comparison meaningful).
         #
         # Provability rules in gradual mode (the conservative analogue of `accepts_difference`):
         #
@@ -1003,9 +1029,12 @@ module Rigor
 
         # Tuple[A1..An] accepts:
         # - Tuple[B1..Bn] when arities match and each Ai accepts Bi (covariant per-position).
-        # - Anything else: no (we cannot prove the arity from a generic nominal alone).
+        # - An `Array[E]` (see {#array_element_verdict}): maybe, or no on an element contradiction.
+        # - Anything else: no.
         def accepts_tuple(self_type, other_type, mode)
           unless other_type.is_a?(Type::Tuple)
+            return array_element_verdict(self_type, other_type, mode) if array_carrier?(other_type)
+
             return Type::AcceptsResult.no(
               mode: mode,
               reasons: "Tuple does not accept #{other_type.class}"
@@ -1025,6 +1054,38 @@ module Rigor
           combine_arg_results(per_element, mode)
         end
 
+        # An `Array` nominal, directly or as the base of a `Difference` (`non-empty-array[E]`). Its arity is
+        # unknown, so a tuple cannot reject it on length: `URI.encode_www_form` takes
+        # `Enumerable[[_ToS, _ToS]]` and is handed the `Array[Array[String]]` that `URI.decode_www_form`
+        # answers. An `Array` subclass is not read, as {#gradual_hash?} does not read a `Hash` subclass.
+        def array_carrier?(type)
+          nominal = type.is_a?(Type::Difference) ? type.base : type
+          nominal.is_a?(Type::Nominal) && nominal.class_name == "Array"
+        end
+
+        # `maybe`, unless the element type rules the tuple out at any length: some position accepts no member
+        # of `E` (`[Integer, Integer]` never takes an `Array[String]`). A raw `Array` stays `maybe`, and so does
+        # an element with a gradual arm, since no position rejects a `Dynamic` member. The accepted cost (ADR-5)
+        # is that a wrong-length `Array[E]` passed or returned where a tuple is declared goes unreported.
+        def array_element_verdict(self_type, other_type, mode)
+          nominal = other_type.is_a?(Type::Difference) ? other_type.base : other_type
+          element = nominal.type_args.first
+          unless element.nil?
+            members = ContentJoin.union_members(element)
+            refused = self_type.elements.find do |formal|
+              members.all? { |member| accepts(formal, member, mode: mode).no? }
+            end
+            if refused
+              return Type::AcceptsResult.no(
+                mode: mode,
+                reasons: "tuple member #{refused.describe(:short)} rejects #{element.describe(:short)}"
+              )
+            end
+          end
+
+          unread_shape_maybe(mode, "tuple arity unknown for #{other_type.describe(:short)}", :array)
+        end
+
         # HashShape{k1: T1, ...} accepts another HashShape when every required key of self is required on
         # the other side and Ti accepts Ui (depth covariant). Optional keys may be absent on the other side;
         # when present, their values are checked. A closed self rejects known extra keys, and answers at most
@@ -1056,7 +1117,7 @@ module Rigor
           result = combine_arg_results(per_entry, mode)
           return result unless result.yes? && self_type.closed? && other_type.open?
 
-          unread_hash_maybe(mode, "HashShape closed target cannot check open source")
+          unread_shape_maybe(mode, "HashShape closed target cannot check open source", :hash)
         end
 
         # A `Hash` nominal — directly or as the base of a `Difference` (`non-empty-hash[K, V]`) — that is raw or
@@ -1085,7 +1146,7 @@ module Rigor
           refused = refused_value_keys(self_type, value_type, mode)
           return hash_shape_no(mode, "Hash value type refused for required keys: #{refused.inspect}") if refused.any?
 
-          unread_hash_maybe(mode, "HashShape cannot check #{other_type.describe(:short)}")
+          unread_shape_maybe(mode, "HashShape cannot check #{other_type.describe(:short)}", :hash)
         end
 
         def unholdable_keys(self_type, key_type, mode)

data/lib/rigor/inference/block_parameter_binder.rb

@@ -211,9 +211,8 @@ module Rigor
         cursor
       end
 
-      # `|*rest|` binds an Array of the leftover positional arguments. The expected-types array is
-      # per-position, not per-rest; we cannot reliably pick a single element type for rest, so we default to
-      # `Array[Dynamic[Top]]`. Element-type precision for rest parameters is deferred (demand-gated).
+      # `|*rest|` binds an Array of the leftover positional arguments: `Array[Dynamic[Top]]`, unless an
+      # auto-splat answered a rest type ({BlockAutoSplat}). The expected types are per-position, not per-rest.
       def bind_rest(params_node, bindings)
         rest = params_node.rest
         return unless rest.respond_to?(:name) && rest&.name