rigortype 0.4.7 → 0.4.8

data/lib/rigor/environment.rb

@@ -16,6 +16,7 @@ require_relative "environment/bundle_sig_discovery"
 require_relative "environment/lockfile_resolver"
 require_relative "environment/installed_gem_set"
 require_relative "environment/rbs_collection_discovery"
+require_relative "library_probe"
 require_relative "environment/project_path_gems"
 require_relative "environment/source_rbs_synthesis"
 require_relative "plugin/isolation"
@@ -49,6 +50,19 @@ module Rigor
     # `RbsCoverageReport` reports.
     GEM_OVERLAY_PLUGIN_IDS = { "activesupport" => "activesupport-core-ext" }.freeze
 
+    # Issue #2857 — the `RbsCoverageReport` sources each gem's bundled overlay may load under, when they
+    # differ from the ADR-72 `:missing` default every unlisted overlay keeps. `addressable` is the first
+    # exception: its overlay exists to CORRECT the `Addressable::URI.parse` signature `rbs collection`
+    # ships (`parse(nil)` returns nil; the collection declares `(String | URI) -> URI`), so it loads only
+    # under `:rbs_collection` coverage, where the deferred-signature plan composes it over the collection
+    # copy as an overload continuation. Under `:missing` coverage — no sigs at all — it stays unloaded:
+    # the overlay's partial `Addressable::URI` declaration would make every member it omits a false
+    # `call.undefined-method`, a worse answer than the `Dynamic` silence a sig-less gem already has.
+    # Frozen arrays, not Sets: `Ractor.shareable?` rejects a Set even frozen (ractor_readiness_spec).
+    GEM_OVERLAY_COVERAGE_SOURCES = { "addressable" => [:rbs_collection].freeze }.freeze
+    GEM_OVERLAY_DEFAULT_COVERAGE_SOURCES = [:missing].freeze
+    private_constant :GEM_OVERLAY_DEFAULT_COVERAGE_SOURCES
+
     attr_reader :class_registry, :rbs_loader, :plugin_registry, :dependency_source_index,
                 :reporters, :name_scope,
                 :synthetic_method_index, :project_patched_methods
@@ -118,6 +132,13 @@ module Rigor
     # stage that failed and the other stage still runs, so this getter never raises into its callers —
     # neither into a file's `analyze_body` rescue nor out of the run-owned demands, which have no rescue
     # above them at all.
+    # Issue #2883 — builds the RBS environment now, if it is not built yet, so typing never builds it. A no-op for an
+    # environment with no loader. Answers the environment.
+    def prepare_for_typing!
+      rbs_loader&.prepare_for_typing!
+      self
+    end
+
     def hkt_registry
       @hkt_registry_holder.fetch do
         pre_scan = pre_scan_hkt_registry
@@ -247,11 +268,14 @@ module Rigor
     end
 
     class << self
+      # Issue #2883 — the shared default environment is built here too, not on the first `type_of` that needs it, so
+      # code that types against it (`Scope.empty`, the narrowing defaults, the incremental session's summary
+      # evaluator) never builds it from inside typing. A non-main Ractor keeps the lazy build.
       def default
         @default ||= new(
           rbs_loader: RbsLoader.default,
           hkt_registry: Builtins::HktBuiltins.registry
-        ).freeze
+        ).freeze.tap { |environment| environment.prepare_for_typing! if Ractor.main? }
       end
 
       # Builds an Environment that consults the project's local signatures and any opt-in stdlib libraries on
@@ -270,6 +294,10 @@ module Rigor
       #   caching for this environment.
       # @param core_root — issue #2517 — a core signature directory loaded in place of the `rbs` gem's `core/`
       #   ({Configuration#core_root}); nil (the default) loads the gem's core.
+      # @param eager — issue #2883 — whether the RBS environment is built here, before anything types. Typing then
+      #   never builds it, so the core-root Frame the build reads (ADR-129 G1') is never read inside a `type_of`. The
+      #   one caller that passes `false` is the runner's pre-cache build, which a warm result-cache hit must not pay
+      #   for; it calls {#prepare_for_typing!} on the analysis path.
       # rubocop:disable-next Metrics/MethodLength, Metrics/ParameterLists
       def for_project(root: Dir.pwd, libraries: [], signature_paths: nil, cache_store: nil, # rubocop:disable Metrics/AbcSize
                       plugin_registry: nil, dependency_source_index: nil,
@@ -280,7 +308,7 @@ module Rigor
                       rbs_collection_lockfile: nil, rbs_collection_auto_detect: false,
                       synthetic_method_index: nil, project_patched_methods: nil,
                       source_files: [], locked_gems: nil, required_features: nil, core_root: nil,
-                      paths: nil, exclude_patterns: nil, exclude_base: nil)
+                      paths: nil, exclude_patterns: nil, exclude_base: nil, eager: true)
         resolved_paths = project_signature_roots(signature_paths, root: root)
         # O4 MVP — append per-gem `sig/` directories discovered under the target project's bundler install
         # root. Empty array when neither an explicit path nor auto-detection finds a bundle. Order: user
@@ -313,14 +341,17 @@ module Rigor
         )
         # O4 Layer 3 slice 2 — when `rbs collection install` has been run for the target project, parse the
         # resulting `rbs_collection.lock.yaml` and feed each gem's `<collection_path>/<name>/<version>/`
-        # directory into `signature_paths:`. Stdlib-typed entries are skipped (already covered by
-        # `DEFAULT_LIBRARIES`), as are gems whose RBS rigor already loads from another source —
+        # directory into `signature_paths:`. Stdlib-typed entries have no such directory; they load as libraries
+        # (issue #2946, below). Skipped too are gems whose RBS rigor already loads from another source —
         # stdlib-extracted default gems (`cgi`, `logger`, …, shipped by the collection under a `git` source)
         # and the `data/vendored_gem_sigs/` bundle (`redis`, `nokogiri`, `pg`, …). `skip_gem_names:` passes
         # both sets so the collection copy doesn't double-declare against rigor's bundled RBS (the
         # `RBS::DuplicatedDeclarationError` hazard).
         # Issue #1700 — plus the gated vendored directories this run's source activates ({#feature_tokens}).
-        merged_libraries = (DEFAULT_LIBRARIES + libraries.map(&:to_s) +
+        # Issue #2946 — plus the lockfile's `source: { type: stdlib }` entries, as libraries ({BaseLibraries.resolve}).
+        merged_libraries = (BaseLibraries.resolve(libraries, rbs_collection_lockfile: rbs_collection_lockfile,
+                                                             rbs_collection_auto_detect: rbs_collection_auto_detect,
+                                                             root: root) +
                             feature_tokens(required_features, source_files, libraries)).uniq
         # Issue #2441 — plus the project's own path gems ({ProjectPathGems}), whose collection copy would
         # double-declare the project's `sig/`.
@@ -333,24 +364,32 @@ module Rigor
           auto_detect: rbs_collection_auto_detect,
           skip_gem_names: skip_gem_names
         ).map(&:to_s)
+        # Issue #3030 — a gem the project's `signature_paths:` already loads a copy of (a gem_rbs_collection working
+        # tree next to its `_test/` lockfile) loads from there alone. The coverage classification below still sees
+        # the whole list: the gem has RBS either way.
+        covered_collection_paths = collection_paths
+        collection_paths = RbsCollectionDiscovery.without_signature_path_copies(collection_paths, resolved_paths)
+        # Issue #2978 — the collection copies of the locked gems whose own `sig/` the bundle discovery loaded.
+        behind_gem_sig_paths = collection_paths_behind_gem_sigs(collection_paths, gem_sig_paths, locked)
         # ADR-25 — RBS signature directories contributed by loaded plugins via their manifest
         # `signature_paths:`. Resolved to absolute dirs by `Plugin::Base#signature_paths`; additive, ranked
         # below the user's explicit `signature_paths:` and above the opportunistic bundle / collection
         # discovery. A duplicate-declaration conflict degrades through the same O7 failure-memo path.
         plugin_sig_paths = plugin_registry ? plugin_registry.signature_paths.map(&:to_s) : []
-        # ADR-72 — Gemfile.lock-gated bundled RBS overlays. For each locked gem that ships no RBS through any
-        # resolution path (`:missing`) and has a Rigor-bundled overlay, load that overlay so its core-class
-        # extensions resolve (e.g. `Integer#minutes` on a Rails project) — turning a systematic false
-        # `call.undefined-method` into a no-op while a project WITHOUT the gem still sees the genuine
-        # diagnostic. Appended last so any RBS the project already supplies wins, and skipped for a gem whose
-        # opt-in plugin twin is REACHABLE — loaded as a plugin, or wired in by `signature_paths:` (#672) —
-        # so the two never both declare the methods. The paths ride in `loader_signature_paths`, so the env
-        # cache descriptor digests them for free.
+        # ADR-72 — Gemfile.lock-gated bundled RBS overlays. For each locked gem whose coverage source its
+        # overlay may load under ({GEM_OVERLAY_COVERAGE_SOURCES} — `:missing` for every overlay but
+        # addressable's `:rbs_collection` correction, #2857) and that has a Rigor-bundled overlay, load that
+        # overlay so its core-class extensions resolve (e.g. `Integer#minutes` on a Rails project) —
+        # turning a systematic false `call.undefined-method` into a no-op while a project WITHOUT the gem
+        # still sees the genuine diagnostic. Appended last so any RBS the project already supplies wins,
+        # and skipped for a gem whose opt-in plugin twin is REACHABLE — loaded as a plugin, or wired in by
+        # `signature_paths:` (#672) — so the two never both declare the methods. The paths ride in
+        # `loader_signature_paths`, so the env cache descriptor digests them for free.
         # Issue #2441 — the project's own path gems are neither missing RBS nor overlay-eligible: the project's
         # `sig/` declares them, and an overlay (`data/gem_overlay/activesupport`) would collide with it.
         missing_gems, overlay_paths = missing_gems_and_overlay_paths(
           locked: locked.except(*project_gems), default_libraries: merged_libraries, bundle_sig_paths: gem_sig_paths,
-          rbs_collection_paths: collection_paths, plugin_registry: plugin_registry,
+          rbs_collection_paths: covered_collection_paths, plugin_registry: plugin_registry,
           signature_paths: resolved_paths, bundle_root: bundle_root
         )
         loader_signature_paths = resolved_paths + plugin_sig_paths + gem_sig_paths +
@@ -374,8 +413,17 @@ module Rigor
           # Issue #610 — the plugin-contributed subset is loaded LAST and may stand down against a colliding
           # generic arity. Only the bundled plugins' own `sig/` is deferred: the user's `signature_paths:`,
           # the bundle walk and `rbs collection install` all stay authoritative.
-          deferred_signature_paths: plugin_sig_paths,
+          # Issue #2974 — the ADR-72 gem overlays are Rigor-shipped too, and deferred with them: an overlay member
+          # the project's `sig/` also declares (`Integer#ordinalize`, `ActiveSupport::NumericWithFormat#to_fs`)
+          # stands down member by member (#2422) instead of failing the class's definition build.
+          deferred_signature_paths: plugin_sig_paths + overlay_paths,
           project_signature_paths: resolved_paths,
+          # Issue #2978 — a gem's collection copy loads behind the gem's own `sig/`: each member that `sig/` (or any
+          # other eagerly loaded signature file) declares stands down from the copy (#2422), and the rest loads.
+          subordinate_signature_paths: behind_gem_sig_paths,
+          # Issue #3030 — the collection gem directories, loaded as rbs loads a library: without the files below a
+          # `_`-prefixed directory (each gem's `_test/` fixtures).
+          collection_signature_paths: collection_paths,
           required_features: required_features || RequiredFeatures.scan(source_files, sig_paths: resolved_paths),
           core_root: core_root
         )
@@ -390,7 +438,9 @@ module Rigor
         # Issue #2517 — a selected core is built here, not lazily. The env is first demanded from inside a file's
         # analysis, under rescues that turn any raise into one `internal analyzer error` row per file; building it
         # now raises the {CoreRootError} once, before analysis, where the CLI reports it as a configuration error.
-        loader.verify_core_root!
+        # Issue #2883 — the default core is built here too (`eager:`), so no `type_of` builds the environment.
+        # A non-main Ractor worker keeps the lazy build: the `rbs` gem's unshareable constants are unreadable there.
+        eager && Ractor.main? ? loader.prepare_for_typing! : loader.verify_core_root!
         # ADR-20 slice 2c + 2e — seed hkt_registry with the bundled builtins. The Environment's
         # `#hkt_registry` getter then LAZILY merges in the RBS env scan on first call so fast paths that
         # don't consult HKT (e.g. `rigor check --cache-stats --no-stats`) don't pay the eager env-build cost
@@ -414,10 +464,20 @@ module Rigor
       # The project-owned `sig/` roots a run reads: the explicit `signature_paths:` when given, else the
       # auto-detected `<root>/sig` (or none). Public so {Cache::IncrementalSnapshot} digests exactly the
       # directories the environment loads, including the auto-detected one a `nil` `signature_paths:` hides.
+      # The default branch is {project_signature_root_candidates} narrowed to the directories that exist.
       def project_signature_roots(signature_paths, root: Dir.pwd)
         signature_paths || default_signature_paths(root)
       end
 
+      # Issue #1619 — the single spelling of "the configured `signature_paths:`, else the conventional `sig`
+      # directory", as the CANDIDATES a run watches whether or not they exist yet. {project_signature_roots}
+      # narrows this to what the loader reads (a default only once it is a directory); the run slot's presence
+      # rows and the incremental write guard take it whole, because a `sig/` appearing mid-run must move the
+      # fingerprint and refuse the slot write — a question only a row for a path that need not exist can ask.
+      def project_signature_root_candidates(signature_paths)
+        signature_paths || [DEFAULT_PROJECT_SIG_DIR]
+      end
+
       private
 
       # Issue #1700 — the `RequiredFeatures` library tokens for the gated vendored directories this run asks for:
@@ -431,13 +491,31 @@ module Rigor
       # The gem names an `rbs collection` copy must not double-declare against: the library list and every
       # vendored directory except a `RequiredFeatures`-gated one. A gated directory stands down for any other
       # copy of its declarations (`GatedSignatureGuard`), so the collection's copy is kept and wins.
+      #
+      # Issue #2971 — a `libraries:` name that is not an RBS library (`foogem`, collection-installed) is dropped by
+      # the loader's `has_library?` filter, so it declares nothing to double-declare against; it stays out of the
+      # skip set so the collection's copy still loads. Issue #2978 — that holds for a gem whose own `sig/` the bundle
+      # loaded too: its collection copy loads behind that `sig/` ({.collection_paths_behind_gem_sigs}).
       def collection_skip_gem_names(library_names)
-        library_names + RbsLoader.vendored_gem_names.reject { |name| RequiredFeatures.gated_dir?(name) }
+        LibraryProbe.loadable(library_names) + RbsLoader.vendored_gem_names.reject do |name|
+          RequiredFeatures.gated_dir?(name)
+        end
+      end
+
+      # Issue #2978 — the `collection_paths` (`<collection>/<name>/<version>/`) of the locked gems whose own `sig/` is
+      # among `gem_sig_paths` ({BundleSigDiscovery.locked_names_of}, keyed by name and version).
+      def collection_paths_behind_gem_sigs(collection_paths, gem_sig_paths, locked)
+        return [] if collection_paths.empty? || gem_sig_paths.empty?
+
+        names = BundleSigDiscovery.locked_names_of(gem_sig_paths.map { |dir| Pathname.new(dir) }, locked).to_set
+        collection_paths.select { |path| names.include?(Pathname.new(path).parent.basename.to_s) }
       end
 
       def default_signature_paths(root)
-        sig = Pathname(root) / DEFAULT_PROJECT_SIG_DIR
-        sig.directory? ? [sig] : []
+        project_signature_root_candidates(nil).filter_map do |candidate|
+          path = Pathname(root) / candidate.to_s
+          path if path.directory?
+        end
       end
 
       # ADR-82 WD9 — the resolved bundle root for the missing-gem constant index, doubling (ADR-90) as the
@@ -460,9 +538,12 @@ module Rigor
         bundle_root
       end
 
-      # The `:missing` classification (locked gems with no RBS through any resolution path), computed once
-      # and consumed twice: as `[gem_name, version, variants]` entries for the ADR-82 WD9 constant-ownership
-      # index, and as the eligible-gem set for the ADR-72 overlay resolution. Returns `[entries, overlay_paths]`.
+      # The per-gem RBS coverage classification (locked gems against every resolution path), computed
+      # once and consumed twice: its `:missing` rows become `[gem_name, version, variants]` entries for
+      # the ADR-82 WD9 constant-ownership index, and the full row set feeds the ADR-72 overlay resolution,
+      # which admits a gem when its row's source is one the gem's overlay may load under
+      # ({GEM_OVERLAY_COVERAGE_SOURCES} — `:missing` by default, `:rbs_collection` for addressable).
+      # Returns `[entries, overlay_paths]`.
       def missing_gems_and_overlay_paths(locked:, default_libraries:, bundle_sig_paths:,
                                          rbs_collection_paths:, plugin_registry:, signature_paths: [],
                                          bundle_root: nil)
@@ -470,10 +551,10 @@ module Rigor
           return unlocked_missing_gems(default_libraries, bundle_sig_paths, rbs_collection_paths, bundle_root)
         end
 
-        rows = missing_rows(locked, default_libraries, bundle_sig_paths, rbs_collection_paths)
+        coverage = coverage_rows(locked, default_libraries, bundle_sig_paths, rbs_collection_paths)
+        rows = coverage.select { |row| row.source == :missing }
         overlays = gem_overlay_paths(
-          missing_gem_names: rows.map(&:gem_name), plugin_registry: plugin_registry,
-          signature_paths: signature_paths
+          coverage: coverage, plugin_registry: plugin_registry, signature_paths: signature_paths
         )
         [index_entries(rows, locked), overlays]
       end
@@ -500,14 +581,20 @@ module Rigor
       end
 
       def missing_rows(gems, default_libraries, bundle_sig_paths, rbs_collection_paths)
+        coverage_rows(gems, default_libraries, bundle_sig_paths, rbs_collection_paths)
+          .select { |row| row.source == :missing }
+      end
+
+      def coverage_rows(gems, default_libraries, bundle_sig_paths, rbs_collection_paths)
         RbsCoverageReport.classify(
           locked_gems: gems, default_libraries: default_libraries,
           bundle_sig_paths: bundle_sig_paths, rbs_collection_paths: rbs_collection_paths
-        ).select { |row| row.source == :missing }
+        )
       end
 
       # ADR-72 — resolve the bundled RBS overlay directories to load for this project. A gem is eligible when
-      # it is classified `:missing` (see {missing_rows}) and its conflicting opt-in plugin twin (if
+      # its coverage row's source is one the gem's overlay may load under ({GEM_OVERLAY_COVERAGE_SOURCES};
+      # `:missing` for every overlay the map does not name) and its conflicting opt-in plugin twin (if
       # any) is NOT already reachable. Returns `[Pathname]`, deterministically ordered, or `[]` when no
       # eligible gem.
       #
@@ -521,20 +608,29 @@ module Rigor
       # all); `RbsLoader.bundled_overlay_twin_signatures_loaded?` answers the filesystem half, beside the
       # overlay-side answer to the same question, and carries the reasoning for why it asks what an entry
       # LOADS rather than what it looks like.
-      def gem_overlay_paths(missing_gem_names:, plugin_registry:, signature_paths: [])
-        return [] if missing_gem_names.empty?
+      def gem_overlay_paths(coverage:, plugin_registry:, signature_paths: [])
+        return [] if coverage.empty?
 
         loaded_ids = plugin_registry ? plugin_registry.ids.to_set : Set.new
-        eligible = missing_gem_names.reject do |gem_name|
-          plugin_id = GEM_OVERLAY_PLUGIN_IDS[gem_name]
-          next false unless plugin_id
+        eligible = coverage.filter_map do |row|
+          next unless overlay_coverage_source?(row.gem_name, row.source)
+
+          plugin_id = GEM_OVERLAY_PLUGIN_IDS[row.gem_name]
+          next if plugin_id &&
+                  (loaded_ids.include?(plugin_id) ||
+                   RbsLoader.bundled_overlay_twin_signatures_loaded?(plugin_id, signature_paths))
 
-          loaded_ids.include?(plugin_id) ||
-            RbsLoader.bundled_overlay_twin_signatures_loaded?(plugin_id, signature_paths)
-        end.sort
+          row.gem_name
+        end.uniq.sort
         RbsLoader.gem_overlay_sig_paths(eligible)
       end
 
+      # Whether `source` — a `RbsCoverageReport` source — is one `gem_name`'s bundled overlay may load
+      # under: the gem's {GEM_OVERLAY_COVERAGE_SOURCES} entry when it has one, else ADR-72's `:missing`.
+      def overlay_coverage_source?(gem_name, source)
+        (GEM_OVERLAY_COVERAGE_SOURCES[gem_name] || GEM_OVERLAY_DEFAULT_COVERAGE_SOURCES).include?(source)
+      end
+
       # ADR-32 WD4 + WD5 — for each project source file, invoke every plugin-registered synthesizer once and
       # collect non-nil returns. The returned array is `[[virtual_filename, rbs_source], ...]`; the loader
       # threads it through to `RbsLoader.new(virtual_rbs: ...)`.

data/lib/rigor/inference/acceptance.rb

@@ -3,6 +3,7 @@
 require_relative "../type"
 require_relative "range_constant"
 require_relative "content_join"
+require_relative "../typing_state"
 
 module Rigor
   module Inference
@@ -75,8 +76,16 @@ module Rigor
       }.freeze
       private_constant :TYPE_HANDLERS
 
-      UNREAD_SHAPE_REFUSED_KEY = :__rigor_acceptance_unread_shape_refused__
-      private_constant :UNREAD_SHAPE_REFUSED_KEY
+      # ADR-129 WD1 — a Frame: {#refusing_unread} installs the kind of unread shape that answers `no` for one block
+      # and restores the previous one on the way out. It changes answers (`unread_shape_maybe` reads it), and the
+      # installed value is a Symbol (`:all`, `:array`) or nil.
+      UNREAD_SHAPE_REFUSED = TypingState.frame(
+        :acceptance_unread_shape_refused,
+        reason: "installed around a block by refusing_unread; read by unread_shape_maybe, which answers no for " \
+                "the refused kind of unread shape instead of maybe",
+        witness: "spec/fixtures/typing_state_witnesses/acceptance_unread_shape_refused.rb"
+      )
+      private_constant :UNREAD_SHAPE_REFUSED
 
       # Whether a `maybe` for `param` against `arg` rests on a shape that could not read its argument: a record
       # against a `Hash` with a gradual arm ({#gradual_hash?}) or an open `HashShape`, or a tuple against an
@@ -120,18 +129,14 @@ module Rigor
         # calls below the one asked (a tuple element, a `Hash` value, a union member), and those calls go
         # through each carrier's `Type#accepts`. It is set only for the duration of the block. `kind` is `:all`
         # (records and tuples) or `:array` (tuples only).
-        def refusing_unread(kind)
-          previous = Thread.current[UNREAD_SHAPE_REFUSED_KEY]
-          Thread.current[UNREAD_SHAPE_REFUSED_KEY] = kind
-          yield
-        ensure
-          Thread.current[UNREAD_SHAPE_REFUSED_KEY] = previous
+        def refusing_unread(kind, &)
+          TypingState.current.with(UNREAD_SHAPE_REFUSED, kind, &)
         end
 
         # The `maybe` a shape of `kind` (`:hash` or `:array`) answers for an argument it cannot read, or `no`
         # inside {#refusing_unread} for that kind.
         def unread_shape_maybe(mode, reason, kind)
-          refused = Thread.current[UNREAD_SHAPE_REFUSED_KEY]
+          refused = TypingState.current[UNREAD_SHAPE_REFUSED]
           if refused == :all || refused == kind
             return Type::AcceptsResult.no(mode: mode, reasons: "#{reason} (refused as evidence)")
           end
@@ -427,6 +432,19 @@ module Rigor
         CLASS_OBJECT_NOMINALS = %w[Module Class Object Kernel BasicObject].freeze
         private_constant :CLASS_OBJECT_NOMINALS
 
+        # Issue #2855 — whether `type` is an unparameterised `Class` or `Module` nominal: a class object whose
+        # identity inference lost (`const_get` kept by `is_a?(Class)`, an `is_a?(Module)` guard). `Acceptance` still
+        # answers `no` for it against a `Singleton` (it is a supertype, not a subtype); `call.argument-type-mismatch`
+        # reads it to withhold that verdict. `Object`, `BasicObject` and `Kernel` are left out: they mean "any value",
+        # and `Object.new` against `singleton(X)` is a real mismatch.
+        CLASS_OR_MODULE_NOMINALS = %w[Class Module].freeze
+        private_constant :CLASS_OR_MODULE_NOMINALS
+
+        def class_or_module_nominal?(type)
+          type.is_a?(Type::Nominal) && type.type_args.empty? && CLASS_OR_MODULE_NOMINALS.include?(type.class_name)
+        end
+        public :class_or_module_nominal?
+
         def accepts_nominal_from_singleton(self_type, other_type, mode)
           if CLASS_OBJECT_NOMINALS.include?(self_type.class_name)
             return Type::AcceptsResult.yes(
@@ -850,11 +868,14 @@ module Rigor
         # carrier whose value set is visibly apart from `removed` — a `Constant` (compare values directly),
         # another `Difference` with the same removed value (already exhibits the disjointness), an
         # `IntegerRange` that skips an Integer removed value, a `Tuple` whose fixed arity differs from a
-        # removed `Tuple`, or a `HashShape` with a required key a closed removed `HashShape` cannot hold. The
-        # last three cover the empty witnesses of `non-zero-int`, `non-empty-array[T]` and
-        # `non-empty-hash[K, V]`. Any other carrier — a Nominal above all — is no proof and the difference
-        # rejects it under gradual mode, even where its values happen to exclude `removed`. A Union or
-        # Intersection argument never reaches this rule whole: `accepts` splits it into members first.
+        # removed `Tuple`, a `HashShape` with a required key a closed removed `HashShape` cannot hold, or a
+        # `Refined` whose predicate recogniser rejects the removed `Constant`. The range, tuple and shape
+        # arms cover the empty witnesses of `non-zero-int`, `non-empty-array[T]` and
+        # `non-empty-hash[K, V]`; the `Refined` arm is what lets `non-empty-string` accept
+        # `decimal-int-string`, which can never hold `""`. Any other carrier — a Nominal above all — is no
+        # proof and the difference rejects it under gradual mode, even where its values happen to exclude
+        # `removed`. A Union or Intersection argument never reaches this rule whole: `accepts` splits it
+        # into members first.
         def accepts_difference(self_type, other_type, mode)
           base_result = accepts(self_type.base, other_type, mode: mode)
           return base_result if base_result.no?
@@ -884,16 +905,30 @@ module Rigor
             # `removed`, the meet is too.
             other_type.members.any? { |m| provably_disjoint_from_removed?(m, removed) }
           when Type::IntegerRange
-            removed.is_a?(Type::Constant) && removed.value.is_a?(Integer) && !other_type.covers?(removed.value)
+            integer_range_excludes_removed?(other_type, removed)
           when Type::Tuple
             # A Tuple's arity is fixed, so it shares no inhabitant with a Tuple of another arity — the
             # zero-arity witness `non-empty-array[T]` removes included.
             removed.is_a?(Type::Tuple) && removed.elements.size != other_type.elements.size
           when Type::HashShape
             hash_shape_excludes_removed?(other_type, removed)
+          when Type::Refined
+            refined_excludes_removed?(other_type, removed)
           end
         end
 
+        def integer_range_excludes_removed?(range, removed)
+          removed.is_a?(Type::Constant) && removed.value.is_a?(Integer) && !range.covers?(removed.value)
+        end
+
+        # A predicate refinement excludes the removed value when its recogniser rejects the removed
+        # constant outright — `decimal-int-string` can never hold `""`. `matches?` answers nil for a
+        # predicate the registry does not know, and nil is no proof, so the comparison is `== false`
+        # rather than `!`.
+        def refined_excludes_removed?(refined, removed)
+          removed.is_a?(Type::Constant) && refined.matches?(removed.value) == false
+        end
+
         # Every inhabitant of `shape` holds each of its required keys, and a closed `removed` shape holds no
         # key outside its pairs, so one required key `removed` does not list makes the two disjoint. Against
         # the closed `{}` witness `non-empty-hash[K, V]` removes, that is any required key; an optional key

data/lib/rigor/inference/alias_mutation_floor/foreign_locals.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../source/node_children"
+require_relative "../closure_escape_analyzer"
+require_relative "../remover_holder_scan"
+
+module Rigor
+  module Inference
+    module AliasMutationFloor
+      # Issue #2335 — the *foreign* locals of a frame body ({AliasMutationFloor}): those whose object may have come
+      # from elsewhere, so they may be another local's object. A method parameter, a block or lambda parameter (but one
+      # of a catalogued iterator over literals that read nothing, whose parameters are those literals' own objects), a
+      # local any target node binds, and a local written anything but a new object.
+      module ForeignLocals
+        FRESH_VALUES = [
+          Prism::ArrayNode, Prism::HashNode, Prism::StringNode, Prism::InterpolatedStringNode, Prism::XStringNode,
+          Prism::InterpolatedXStringNode, Prism::IntegerNode, Prism::FloatNode, Prism::RationalNode, Prism::ImaginaryNode,
+          Prism::SymbolNode, Prism::InterpolatedSymbolNode, Prism::NilNode, Prism::TrueNode, Prism::FalseNode,
+          Prism::RangeNode, Prism::RegularExpressionNode, Prism::InterpolatedRegularExpressionNode
+        ].freeze
+        # `+"x"`, `"x".dup`, `String.new`: a new String.
+        FRESH_STRING_CALLS = %i[+@ dup clone].to_set.freeze
+        LITERAL_PARTS = [Prism::ArrayNode, Prism::HashNode, Prism::KeywordHashNode, Prism::AssocNode,
+                         *FRESH_VALUES].freeze
+        private_constant :FRESH_VALUES, :FRESH_STRING_CALLS, :LITERAL_PARTS
+
+        module_function
+
+        # `[foreign, entry]`: the foreign locals, and the method parameters the body never rebinds, each frozen.
+        def collect(body, parameters)
+          foreign = Set.new
+          written = Set.new
+          collect_foreign(body, foreign, written)
+          finish(parameters, foreign, written)
+        end
+
+        # `[foreign, entry]` from the body's own `foreign` and `written` sets and the method's `parameters`.
+        def finish(parameters, foreign, written)
+          entry = Set.new
+          collect_parameters(parameters, entry)
+          [foreign.merge(entry).freeze, (entry - written).freeze]
+        end
+
+        def collect_parameters(node, names)
+          return if node.nil?
+
+          names << node.name if node.class.name.end_with?("ParameterNode") && node.respond_to?(:name) && node.name
+          node.rigor_each_child { |child| collect_parameters(child, names) }
+        end
+
+        # `foreign` gains every block or lambda parameter and every local a write binds to an object from elsewhere (an
+        # operator write's value is a call result); `written` every local any write or target binds. A nested def is
+        # not entered.
+        def collect_foreign(node, foreign, written, literal_blocks = Set.new.compare_by_identity)
+          return if node.is_a?(Prism::DefNode)
+
+          visit(node, foreign, written, literal_blocks)
+          node.rigor_each_child { |child| collect_foreign(child, foreign, written, literal_blocks) }
+        end
+
+        # {.collect_foreign}'s step for one node, which the site collector's walk also takes
+        # ({AliasMutationFloor::SiteCollector}).
+        def visit(node, foreign, written, literal_blocks)
+          case node
+          when Prism::CallNode then literal_blocks << node.block if literal_iterator_block?(node)
+          when Prism::BlockNode, Prism::LambdaNode
+            collect_parameters(node.parameters, foreign) unless literal_blocks.include?(node)
+          when Prism::LocalVariableTargetNode, Prism::LocalVariableOperatorWriteNode
+            foreign << written_name(node, written)
+          when Prism::LocalVariableWriteNode, Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode
+            name = written_name(node, written)
+            foreign << name unless fresh_value?(node.value)
+          end
+        end
+
+        # A catalogued iterator over literals that read nothing (`[[1], [2]].each { |x| }`,
+        # `[1].each_with_object({}) { |x, h| }`): its block's parameters are those literals' own new objects. Any other
+        # block's parameters may be any object.
+        def literal_iterator_block?(call_node)
+          return false unless call_node.block.is_a?(Prism::BlockNode)
+          return false unless ClosureEscapeAnalyzer.iterator_name?(call_node.name)
+
+          [call_node.receiver, *call_node.arguments&.arguments].all? do |operand|
+            !operand.nil? && literal_only?(operand)
+          end
+        end
+
+        def literal_only?(node)
+          return false unless LITERAL_PARTS.any? { |klass| node.is_a?(klass) }
+
+          node.rigor_each_child { |child| return false unless literal_only?(child) }
+          true
+        end
+
+        def written_name(node, written)
+          written << node.name
+          node.name
+        end
+
+        # A value that is a new object, so the local it binds holds no other holder's object.
+        def fresh_value?(value)
+          value = RemoverHolderScan.unparenthesised(value)
+          return true if FRESH_VALUES.any? { |klass| value.is_a?(klass) }
+          return false unless value.is_a?(Prism::CallNode)
+          return true if RemoverHolderScan.fresh_value?(value)
+
+          receiver = value.receiver
+          (FRESH_STRING_CALLS.include?(value.name) &&
+            (receiver.is_a?(Prism::StringNode) || receiver.is_a?(Prism::InterpolatedStringNode))) ||
+            (value.name == :new && receiver.is_a?(Prism::ConstantReadNode) && receiver.name == :String)
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/alias_mutation_floor/memos.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require_relative "../../typing_state"
+require_relative "../../memo_audit"
+
+module Rigor
+  module Inference
+    module AliasMutationFloor
+      # ADR-129 WD1 — the floor's four run-scoped Memos, each a pure function of the key it holds, and their accessors.
+      # Each accessor's block computes the value: on a miss it is stored, on a hit {MemoAudit.check} compares it with
+      # the stored one under `RIGOR_MEMO_AUDIT=1`, and while an audit recomputation runs ({MemoAudit.suspended?}) it
+      # answers without reading or writing the memo.
+      module Memos
+        FACTS = TypingState.memo(
+          :alias_mutation_floor_facts,
+          run_scoped: true, audit: "alias floor facts",
+          reason: "keyed by the body node; the facts are a pure function of the body and its parameters"
+        )
+        IVAR = TypingState.memo(
+          :alias_mutation_floor_ivar_mutators,
+          run_scoped: true, audit: "alias floor ivar mutator",
+          reason: "keyed by def node; whether its body mutates an ivar is a pure function of the body"
+        )
+        FLOOR = TypingState.memo(
+          :alias_mutation_floor_callee_floors,
+          run_scoped: true, audit: "alias floor callee floor",
+          reason: "keyed by the literal shape; the callee block floor is a pure function of it"
+        )
+        STORE = TypingState.memo(
+          :alias_mutation_floor_unknown_stores,
+          run_scoped: true, audit: "alias floor unknown store",
+          reason: "keyed by call node, removed-keys mode and type, every input of the widened store"
+        )
+        private_constant :FACTS, :IVAR, :FLOOR, :STORE
+
+        module_function
+
+        # The facts of `body`. A hit is audited without the facts' per-read memos, which fill as reads are answered.
+        def facts(body, &)
+          return yield if MemoAudit.enabled? && MemoAudit.suspended?
+
+          table = TypingState.current.weak_key_map(FACTS)
+          facts = table[body]
+          return table[body] = MemoAudit.key_audit("alias floor facts", &) if facts.nil?
+
+          MemoAudit.check("alias floor facts", audited(facts), body) { audited(yield) } if MemoAudit.enabled?
+          facts
+        end
+
+        def ivar_mutator(def_node, &)
+          return yield if MemoAudit.enabled? && MemoAudit.suspended?
+
+          table = TypingState.current.weak_key_map(IVAR)
+          cached = table[def_node]
+          return table[def_node] = MemoAudit.key_audit("alias floor ivar mutator", &) if cached.nil?
+
+          MemoAudit.check("alias floor ivar mutator", cached, def_node, &)
+        end
+
+        def callee_floor(type, &)
+          return yield if MemoAudit.enabled? && MemoAudit.suspended?
+
+          state = TypingState.current
+          table = (state[FLOOR] ||= {})
+          return table[type] = MemoAudit.key_audit("alias floor callee floor", &) unless table.key?(type)
+
+          MemoAudit.check("alias floor callee floor", table[type], type, &)
+        end
+
+        def unknown_store(call_node, removed_keys, type, &)
+          return yield if MemoAudit.enabled? && MemoAudit.suspended?
+
+          state = TypingState.current
+          table = (state[STORE] ||= {}.compare_by_identity)
+          per_mode = ((table[call_node] ||= {})[removed_keys] ||= {})
+          return per_mode[type] = MemoAudit.key_audit("alias floor unknown store", &) unless per_mode.key?(type)
+
+          MemoAudit.check("alias floor unknown store", per_mode[type], call_node, type, &)
+        end
+
+        def audited(facts) = facts.with(memo: nil, named_memo: nil)
+      end
+    end
+  end
+end