rigortype 0.3.2 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 53ce9543e32229f3a80491f33886ac27cc0e1d3c0bb834536c703ab669188dd2
-  data.tar.gz: f9bb40e6e3a44a8bd362cee2b5f46a406d36391c5cf3053982950f4acae574df
+  metadata.gz: ddd6ef9252340b3eb225c6f897e877b77805c4debc2444af0a6fa32db9aebea7
+  data.tar.gz: 8cb4ddc14efbf6aa1c6bc685e0135b3ce031f56cedb31429e1625272c23b38ac
 SHA512:
-  metadata.gz: f233af3b211b096772e29ee29eda2ef7a7bca353e02f300c0f6ed36cbfb66deb73df709486896207f9459a0fbb5203c155ed257790c7d8122562780b1a532391
-  data.tar.gz: 21ed0e73b967f692d6df3a65a9cd6444b5b801b545cb82cb59e4cec8d0effdcec4e8f9b97ebd7a811a0ebe8a08366bdaabbb07df1338a59a939e5d855281b2be
+  metadata.gz: 7be72cdb0e5c5a7e5a417291d44fdbfef44628dda68597b2610c1865efb95adf37d492f7fce505965b5e394e9a685504917bcb7aaaa756091086d9217676dbba
+  data.tar.gz: 53e6b313960d0a3606be6925dafe0b71850850fcaff78b2f1015d3c4bd2ff97af452e0eaef70da9d4e14f9094e890d72fbc4da77e5508cf4c51ad6650fb680ea

data/README.md

@@ -231,7 +231,7 @@ rigor docs --list                 # list every bundled page
 
 ## Status
 
-Current release: **`v0.3.2`** (2026-08-08) — on the
+Current release: **`v0.3.3`** (2026-08-09) — on the
 `0.3.x` line, continuing the evaluation era opened by `v0.2.0`, the first
 publicly-announced (general / evaluation) release. The line publishes
 an enumerated [compatibility surface](docs/compatibility.md) as a

data/docs/manual/04-diagnostics.md

@@ -225,6 +225,14 @@ on the line the diagnostic points at; there is no
 `disable-block` form, so an expression spread over several
 lines needs the comment on each line that fires.
 
+The marker has to be the **first thing in the comment** — a
+whole-line `# rigor:disable …` or a trailing
+`expr  # rigor:disable …`. A comment that merely quotes the
+syntax, as this manual does throughout, is ordinary prose: it
+suppresses nothing and warns about nothing. The same goes for a
+doubled `## rigor:disable …` and for a marker written inside an
+`=begin` / `=end` block — neither activates.
+
 A marker that cannot work is flagged rather than silently
 ignored: a token that names no known rule (a typo like
 `call.undefined-metod`) fires

data/lib/rigor/analysis/check_rules/always_truthy_condition_collector.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "../../source/node_children"
+require_relative "../../inference/optimistic_origin"
 require_relative "inferred_param_guard"
 
 module Rigor
@@ -108,6 +109,13 @@ module Rigor
           # the precision-additive contract.
           return if InferredParamGuard.rooted?(predicate, scope)
 
+          # Issue #313 — a predicate whose constancy rests on an optimistically nil-free carrier is a bet, not
+          # proof: `MAP[key]` omits `nil` because pessimising the defaulted-Hash idiom costs more false
+          # positives than the miss it would model, so `MAP[key].nil?` folding to `false` says nothing about
+          # whether the key was there. The spec forbids this rule concluding from such a value; the derivation
+          # is what carries the mark across `.nil?`, `!` and `&&` / `||` to the predicate the rule reads.
+          return unless Inference::OptimisticOrigin.resolve(predicate, scope).nil?
+
           predicate_type = scope.type_of(predicate)
           return unless predicate_type.is_a?(Type::Constant)
 

data/lib/rigor/analysis/check_rules/declaration_sourced_guard.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # ADR-58 WD1 — the shared "is this value's optionality declaration-sourced?" predicate.
+      #
+      # A `nil` whose only provenance is a declaration (the class-ivar index seed of a ctor `@x = nil`, a
+      # non-definitely-assigned ivar read) is real type information but not diagnostic fuel: the working
+      # program's cross-method invariant is assumed per the robustness principle ([ADR-5]). Every negative rule
+      # that would fire *because of* such a nil must therefore consult the same provenance question, and get the
+      # same answer.
+      #
+      # Before issue #324 each rule spelled the lookup itself, and they drifted: `call.possible-nil-receiver`
+      # read the `:local` mark (so `r = @right; r.key` was excused — ADR-58's own motivating shape), while both
+      # `call.argument-type-mismatch` gates opened by requiring a literal `Prism::InstanceVariableReadNode`, so
+      # `c = @count; sink.take_int(c)` fired on the same value with the same provenance. This module is that one
+      # question, asked in one place.
+      #
+      # **The mark is deliberately NOT transitive.** `Scope#with_declaration_sourced_local`
+      # ({Inference::StatementEvaluator#eval_local_write}) stamps `:local` only when the RHS is a *pure read of a
+      # currently declaration-sourced ivar*, so a second hop (`c = @count; d = c`) and an `||=` rewrite land on
+      # the plain `with_local` path and carry no mark.
+      #
+      # A branch join is NOT one of those cases, contrary to what this comment claimed when it landed: both
+      # arms of `if c then r = @count else r = @count end` stamp `(:local, :r)`, and `join_declaration_sourced`
+      # INTERSECTS, so the mark survives. Only an *asymmetric* join drops it, and by that intersection rather
+      # than by reaching `with_local`. The normative statement — establishment, drop, join and the full list of
+      # unmarked shapes, each verified against the implementation — is
+      # `docs/internal-spec/inference-engine.md` § "Declaration-sourced provenance mark (ADR-58)"; keep this
+      # comment subordinate to it.
+      #
+      # So `marked?` matches exactly the two node shapes the scope actually models and invents no propagation
+      # of its own; anything flow-live keeps firing.
+      module DeclarationSourcedGuard
+        module_function
+
+        # True when `node` is a direct read of a binding whose optionality is purely declaration-sourced. Any
+        # flow-live touch (a method-local `@x = nil` write, a failed-guard narrowing, a rebinding local write)
+        # drops the mark upstream, so this returns false there and the caller fires exactly as before.
+        def marked?(node, scope)
+          case node
+          when Prism::InstanceVariableReadNode then scope.declaration_sourced?(:ivar, node.name)
+          when Prism::LocalVariableReadNode then scope.declaration_sourced?(:local, node.name)
+          else false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/rule_walk.rb

@@ -145,6 +145,13 @@ module Rigor
             return unless node.is_a?(Prism::Node)
 
             dispatch(node, hooks, context)
+            # Issue #318 — `defined?`'s operand is never evaluated (the runtime inspects it statically), so
+            # nothing under a `DefinedNode` is reachable, evaluated code. Dispatching the DefinedNode itself
+            # is fine (a collector may care that it exists); descending into `#value` would feed collectors
+            # source that can never execute, e.g. `undefined_method_diagnostic` flagging a call inside
+            # `defined? @x && @x.method_call`.
+            return if node.is_a?(Prism::DefinedNode)
+
             child_context = descend(node, context)
             node.rigor_each_child { |child| walk(child, hooks, child_context) }
           end

data/lib/rigor/analysis/check_rules.rb

@@ -5,11 +5,13 @@ require "prism"
 require_relative "../reflection"
 require_relative "../source/node_walker"
 require_relative "../source/constant_path"
+require_relative "../inference/singleton_object_constant"
 require_relative "../type"
 require_relative "diagnostic"
 require_relative "dependency_recorder"
 require_relative "check_rules/rule_ids"
 require_relative "check_rules/inferred_param_guard"
+require_relative "check_rules/declaration_sourced_guard"
 require_relative "check_rules/rule_walk"
 require_relative "check_rules/always_truthy_condition_collector"
 require_relative "check_rules/unreachable_clause_collector"
@@ -424,6 +426,12 @@ module Rigor
       #   only. `# rigor:disable all` on a line suppresses
       #   every rule on that line.
       #
+      # Both in-source forms are recognised only when the
+      # marker is the FIRST thing in the comment, so a
+      # directive quoted inside ordinary prose — as the bullets
+      # above quote it — is not a directive. See the pattern
+      # constants below.
+      #
       # Diagnostics with `rule == nil` (parse errors, path
       # errors, internal analyzer errors) are NEVER
       # suppressed — they represent failures the user cannot
@@ -443,17 +451,26 @@ module Rigor
         end
       end
 
-      LINE_SUPPRESSION_PATTERN = /#\s*rigor:disable(?!-file)\s+(?<rules>[\w.,\s-]+)/
+      # Every suppression-recognition pattern below is anchored with `\A` against the COMMENT SLICE —
+      # Prism hands us a slice that starts at the `#`, so `\A#` means "the marker is the first thing in
+      # the comment". A real directive always has that shape, in both the whole-line form and the
+      # trailing `code # rigor:disable <rule>` form; prose that merely quotes a directive
+      # (`... like `# rigor:disable-file all` ...`) has text before the inner `#` and no longer
+      # activates anything. Two consequences worth naming: a doc-tool `##` comment never activates (the
+      # second `#` is neither whitespace nor the marker word), and an `=begin`/`=end` block comment
+      # never activates either (its slice starts at `=begin`). Unanchored, these patterns silently
+      # file-suppressed this very file — see issue #306.
+      LINE_SUPPRESSION_PATTERN = /\A#\s*rigor:disable(?!-file)\s+(?<rules>[\w.,\s-]+)/
       private_constant :LINE_SUPPRESSION_PATTERN
 
-      FILE_SUPPRESSION_PATTERN = /#\s*rigor:disable-file\s+(?<rules>[\w.,\s-]+)/
+      FILE_SUPPRESSION_PATTERN = /\A#\s*rigor:disable-file\s+(?<rules>[\w.,\s-]+)/
       private_constant :FILE_SUPPRESSION_PATTERN
 
       # A `rigor:disable[-file]` marker word regardless of whether any rule tokens follow. Used only by the
       # `suppression.empty` detection — the two suppression patterns above require at least one token
       # character, so a bare `# rigor:disable` never reaches them. The lookahead keeps
       # `rigor:disable-something-else` from counting as a marker.
-      BARE_SUPPRESSION_MARKER = /#\s*rigor:disable(?<file>-file)?(?![\w-])(?<rest>.*)/
+      BARE_SUPPRESSION_MARKER = /\A#\s*rigor:disable(?<file>-file)?(?![\w-])(?<rest>.*)/
       private_constant :BARE_SUPPRESSION_MARKER
 
       # A `rigor:` marker word that is NOT part of Rigor's suppression grammar but reads like an attempted
@@ -463,7 +480,7 @@ module Rigor
       # surveillance they silently suppress nothing. Matches `disable-<suffix>` for any suffix other than
       # `file`, and `enable` with or without a suffix.
       UNKNOWN_SUPPRESSION_MARKER =
-        /#\s*rigor:(?<marker>disable-(?!file(?![\w-]))[\w-]+|enable(?:-[\w-]+)?)(?![\w-])(?<rest>.*)/
+        /\A#\s*rigor:(?<marker>disable-(?!file(?![\w-]))[\w-]+|enable(?:-[\w-]+)?)(?![\w-])(?<rest>.*)/
       private_constant :UNKNOWN_SUPPRESSION_MARKER
 
       # @return [Array<(Hash{Integer => Set}, Set)>] pair of
@@ -527,9 +544,10 @@ module Rigor
       end
 
       # A comment carrying the marker word but not the token-bearing suppression grammar. A remainder of
-      # nothing but whitespace / commas is a genuinely empty marker (`# rigor:disable`); anything else
-      # (documentation prose like "`# rigor:disable <rule>` comments") is left alone as an ordinary
-      # comment, matching the parse path, which never treats it as a suppression either.
+      # nothing but whitespace / commas is a genuinely empty marker (`# rigor:disable`); anything else is
+      # left alone as an ordinary comment, matching the parse path, which never treats it as a
+      # suppression either. Prose that merely quotes a marker is already excluded a step earlier by the
+      # `\A` anchor, since the quotation is not at the start of the comment.
       def diagnose_bare_suppression_marker(path, comment, source, diagnostics)
         bare = BARE_SUPPRESSION_MARKER.match(source)
         if bare
@@ -545,8 +563,9 @@ module Rigor
 
       # `# rigor:disable-next-line <rule>` / `# rigor:enable <rule>` — a marker word Rigor's grammar does
       # not recognise but that reads as an attempted suppression (the RuboCop reflex). Fires only when the
-      # remainder is empty or looks like a rule list, so prose mentioning the spelling in backticks stays
-      # an ordinary comment — the same escape the empty-marker detection observes.
+      # marker opens the comment and the remainder is empty or looks like a rule list, so prose mentioning
+      # the spelling in backticks stays an ordinary comment — the same escape the empty-marker detection
+      # observes.
       def diagnose_unknown_suppression_marker(path, comment, source, diagnostics)
         unknown = UNKNOWN_SUPPRESSION_MARKER.match(source)
         return if unknown.nil?
@@ -656,6 +675,13 @@ module Rigor
           # non-nil constituent (which, for a cross-file project def, would
           # be a working-code false positive).
           receiver_type = safe_navigation_receiver(call_node, scope)
+
+          # #320 — the private-singleton-object idiom (`class << Merger = Object.new`). The body's methods
+          # are recorded on the constant's own name, but the receiver reads back as `Object`, so the
+          # class-keyed probes below cannot see them. Recover the name from the receiver syntax. Scoped to
+          # the recorded name only: `Merger.nope` still fires.
+          return nil if Inference::SingletonObjectConstant.recorded?(call_node, receiver_type, call_node.name, scope)
+
           class_name = concrete_class_name(receiver_type)
           # A union receiver has no single concrete class. The scalar path
           # below cannot reason about it, but the call is still definitely
@@ -1255,8 +1281,12 @@ module Rigor
           # principle. The nil stays in the displayed type; only its use as
           # diagnostic fuel is withheld. Any flow-live touch (method-local
           # nil write, failed-guard narrowing) drops the mark upstream, so
-          # flow-observed nil keeps firing exactly as before.
-          return nil if scope.declaration_sourced?(:local, call_node.receiver.name)
+          # flow-observed nil keeps firing exactly as before. The receiver
+          # is already narrowed to a local read above, so this asks
+          # {DeclarationSourcedGuard} exactly what it asked before — but it
+          # now asks it through the predicate the argument-type gates share
+          # (issue #324), which is what keeps the two rules from drifting.
+          return nil if DeclarationSourcedGuard.marked?(call_node.receiver, scope)
 
           # ADR-67 WD6b — an inferred-parameter receiver's type (incl. any nil constituent unioned in from a
           # nil call site) is an open-call-site lower bound; a possible-nil firing against it is an FP by
@@ -2383,13 +2413,16 @@ module Rigor
           params.map { |param| param.type.to_s.delete_prefix("::") }.uniq.join(" | ")
         end
 
-        # ADR-58 parity for the nil channel: a declaration-sourced ivar read
-        # that types as nil is the same not-diagnostic-fuel case the union
-        # path gates in {#declaration_sourced_nil_only_mismatch?}; suppress it
-        # here too so a ctor-seeded `@x = nil` read passed as an argument does
-        # not fire on a working program's cross-method invariant.
+        # ADR-58 parity for the nil channel: a declaration-sourced read that
+        # types as nil is the same not-diagnostic-fuel case the union path
+        # gates in {#declaration_sourced_nil_only_mismatch?}; suppress it here
+        # too so a ctor-seeded `@x = nil` read passed as an argument does not
+        # fire on a working program's cross-method invariant. Issue #324 —
+        # delegates to {DeclarationSourcedGuard}, so a local copy of the ivar
+        # (`c = @count`) is excused on the same terms `possible-nil-receiver`
+        # already excused it.
         def declaration_sourced_nil_argument?(arg, scope)
-          arg.is_a?(Prism::InstanceVariableReadNode) && scope.declaration_sourced?(:ivar, arg.name)
+          DeclarationSourcedGuard.marked?(arg, scope)
         end
 
         def first_argument_mismatch(method_type, call_node, scope, param_overrides)
@@ -2452,14 +2485,15 @@ module Rigor
           !declaration_sourced_nil_only_mismatch?(arg, arg_type, param_type, scope)
         end
 
-        # True when `arg` is a declaration-sourced ivar read whose rejection is
+        # True when `arg` is a declaration-sourced read whose rejection is
         # caused solely by its nil constituent: stripping nil from the argument
         # type yields a type the parameter accepts (gradual mode). Mirrors the
-        # `possible-nil-receiver` WD1 gate, keyed on the ivar provenance mark
-        # rather than a local copy.
+        # `possible-nil-receiver` WD1 gate — since issue #324 through the very
+        # same {DeclarationSourcedGuard} predicate, so the ivar read and its
+        # local copy (`c = @count`) are one case rather than two spellings that
+        # can drift apart again.
         def declaration_sourced_nil_only_mismatch?(arg, arg_type, param_type, scope)
-          return false unless arg.is_a?(Prism::InstanceVariableReadNode)
-          return false unless scope.declaration_sourced?(:ivar, arg.name)
+          return false unless DeclarationSourcedGuard.marked?(arg, scope)
           return false unless arg_type.is_a?(Type::Union)
           return false unless union_contains_nil?(arg_type)
 
@@ -2720,6 +2754,12 @@ module Rigor
 
         # Returns true when `override_visibility` is strictly more restrictive than `parent_visibility`
         # under the public > protected > private ordering.
+        #
+        # The nil guard below is defence, not dead code. `VISIBILITY_RANK` is a closed literal hash read
+        # with a dynamic key, so a symbol outside the table reads as nil at runtime. The engine folds that
+        # read to the nil-free value union `0 | 1 | 2`, which `internal-spec/inference-engine.md` declares
+        # OPTIMISTIC rather than proof — and since issue #313 that mark survives the `.nil?` fold and the
+        # `||` composition, so no suppression directive is needed here.
         def visibility_reduced?(parent_visibility, override_visibility)
           parent_rank = VISIBILITY_RANK[parent_visibility]
           override_rank = VISIBILITY_RANK[override_visibility]

data/lib/rigor/analysis/rule_catalog.rb

@@ -660,6 +660,8 @@ module Rigor
             "The token resolves (canonical id, legacy alias, `all`, family wildcard, known engine id).",
             "The token starts with `plugin.` — plugins load dynamically, so their rule vocabulary cannot " \
             "be enumerated statically and under-warning is the FP-safe direction.",
+            "The marker does not open the comment (documentation prose quoting the syntax, a doubled " \
+            "`##` comment, or an `=begin` block) — that is not parsed as a suppression either.",
             "The comment merely mentions the marker followed by non-token text (documentation prose " \
             "like \"`# rigor:disable <rule>` comments\") — that is not parsed as a suppression either."
           ],
@@ -684,6 +686,7 @@ module Rigor
           does_not_fire_when: [
             "At least one token follows the marker (each token is then checked by " \
             "`suppression.unknown-rule` instead).",
+            "The marker does not open the comment (documentation prose quoting the syntax).",
             "Non-token text follows the marker (documentation prose mentioning the syntax)."
           ],
           suppression: "Complete the marker (`# rigor:disable <rule>` / `all`) or delete it; " \
@@ -730,7 +733,7 @@ module Rigor
           summary: "A comment uses a suppression marker Rigor does not recognise " \
                    "(`rigor:disable-next-line`, `rigor:enable`, ...).",
           fires_when: [
-            "A comment carries `rigor:disable-<suffix>` with a suffix other than `file`, or " \
+            "A comment OPENS with `rigor:disable-<suffix>` for a suffix other than `file`, or with " \
             "`rigor:enable[-<suffix>]` — typically the RuboCop reflex `# rigor:disable-next-line " \
             "<rule>` — followed by nothing or a rule-list-shaped remainder.",
             "Such a marker is invisible to the whole suppression grammar, so it silently suppresses " \
@@ -740,6 +743,7 @@ module Rigor
           does_not_fire_when: [
             "The marker is one of the two recognised forms (their tokens are then checked by " \
             "`suppression.unknown-rule` / `suppression.empty` instead).",
+            "The marker does not open the comment (documentation prose quoting the spelling).",
             "Non-token text follows the marker (documentation prose mentioning the spelling)."
           ],
           suppression: "Rewrite as `# rigor:disable <rules>` on the offending line (Rigor has no " \

data/lib/rigor/analysis/severity_stamp.rb

@@ -35,7 +35,8 @@ module Rigor
         Diagnostic.new(
           path: diagnostic.path, line: diagnostic.line, column: diagnostic.column,
           message: diagnostic.message, severity: resolved, rule: diagnostic.rule,
-          source_family: diagnostic.source_family
+          source_family: diagnostic.source_family, receiver_type: diagnostic.receiver_type,
+          method_name: diagnostic.method_name, project_definition_site: diagnostic.project_definition_site
         )
       end
     end

data/lib/rigor/inference/anonymous_meta_class.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type/anonymous_class_name"
+
+module Rigor
+  module Inference
+    # #319 — identity for the class a `Class.new do ... end` / `Module.new do ... end` creates away from
+    # constant-write position.
+    #
+    # Ruby evaluates such a block with `self` bound to the freshly created class (`class_eval` semantics): a
+    # `def` inside it defines an instance method on that class and `attr_reader` runs as a class-level macro.
+    # `ScopeIndexer` has always walked that body as a class body — but only through its
+    # `Prism::ConstantWriteNode` branch, because the constant supplied the name the discovered-method tables
+    # are keyed by. At every other position (`klass = Class.new do ... end`, a bare expression, a method
+    # return) there was no name, so the body fell through to the enclosing — usually top-level — scope. Two
+    # false positives followed on correct code: `attr_reader` became a `call.unresolved-toplevel` warning
+    # (`Scope#toplevel?` is `self_type.nil?`), and the class itself typed as the bare `Singleton[Object]`
+    # `MethodDispatcher#class_new_lift` hands back, taking `Object`'s zero-arity `new` with it.
+    #
+    # This module supplies the missing name: a per-call-site synthetic one, spelled so that no Ruby constant
+    # path can collide with it in the discovery tables, and stable across the index pass and the dispatch
+    # pass because both derive it from the same `(call node, source path)` pair.
+    module AnonymousMetaClass
+      module_function
+
+      # The class-creating meta calls whose block body is a class body. `Struct.new` / `Data.define` are here
+      # because the body semantics are identical — the block is `class_eval`'d on the generated subclass — not
+      # because their anonymous *value* is modelled: those keep the `StructClass` / `DataClass` carriers
+      # {MethodDispatcher::StructFolding} / {MethodDispatcher::DataFolding} build for them.
+      META_NEW_SELECTORS = { Class: :new, Module: :new, Struct: :new, Data: :define }.freeze
+
+      # The receiver constant name (`:Class`, `:Module`, `:Struct`, `:Data`) of a class-creating meta call that
+      # carries a literal block, or nil for anything else. The receiver MUST be the bare constant (or its
+      # `::`-rooted spelling) — a call through a variable or another call's return has no statically known
+      # identity, exactly as `ScopeIndexer#meta_constant_receiver?` requires.
+      #
+      # Argument shapes are deliberately NOT inspected: `Class.new(Base) { ... }` and
+      # `Data.define(*members) { ... }` evaluate their block as a class body whatever the arguments are, and a
+      # narrower gate here would leave the body in top-level scope again.
+      def block_form_receiver(node)
+        return nil unless node.is_a?(Prism::CallNode)
+        return nil unless node.block.is_a?(Prism::BlockNode)
+
+        receiver_name = literal_constant_name(node.receiver)
+        return nil if receiver_name.nil?
+        return nil unless META_NEW_SELECTORS[receiver_name] == node.name
+
+        receiver_name
+      end
+
+      # The synthetic class name for `node`'s block body, or nil when `node` is not a recognised block form.
+      # {Type::AnonymousClassName} owns the spelling; this decides which call sites earn one and what the key
+      # holds.
+      #
+      # `source_path` is part of the key so two files whose anonymous classes happen to share a line and column
+      # do not merge their method sets when the per-file tables are folded into the cross-file seed. It is
+      # omitted when the caller has no path (unit-level probes over a bare `Prism` program) — passed through
+      # verbatim rather than defaulted, so every pass over the same file derives the same name.
+      def name_for(node, source_path = nil)
+        receiver_name = block_form_receiver(node)
+        return nil if receiver_name.nil?
+
+        location = node.location
+        key = [source_path, location.start_line, location.start_column].compact.join(":")
+        Type::AnonymousClassName.build(receiver_name, key)
+      end
+
+      # The bare-constant receiver's name (`Class`, `::Class`), or nil for every other receiver shape.
+      def literal_constant_name(node)
+        case node
+        when Prism::ConstantReadNode
+          node.name
+        when Prism::ConstantPathNode
+          node.name if node.parent.nil?
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/expression_typer.rb

@@ -19,6 +19,8 @@ require_relative "indexed_narrowing"
 require_relative "macro_block_self_type"
 require_relative "method_dispatcher"
 require_relative "narrowing"
+require_relative "singleton_object_constant"
+require_relative "optimistic_origin"
 require_relative "struct_fold_safety"
 
 module Rigor
@@ -609,16 +611,11 @@ module Rigor
         elide_or_union(node.predicate, else_type, then_type)
       end
 
-      # Issue #286 — the effective optimistic-nil-free cause of an expression, resolving a bare local read (or
-      # a local write in value position) through its binding. Mirrors `StatementEvaluator#optimistic_origin_for`.
+      # Issue #286 — the effective optimistic-nil-free cause of an expression. {OptimisticOrigin.resolve} owns
+      # the judgment, shared verbatim with `StatementEvaluator#optimistic_origin_for` and the
+      # `flow.always-truthy-condition` collector.
       def optimistic_origin_for(node)
-        recorded = scope.optimistic_origins[node]
-        return recorded if recorded
-
-        case node
-        when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
-        when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
-        end
+        OptimisticOrigin.resolve(node, scope)
       end
 
       def if_else_type(subsequent)
@@ -663,7 +660,7 @@ module Rigor
       # fallback is preserved.
       def type_of_and_or(node)
         left_type = type_of(node.left)
-        polarity = constant_value_polarity(left_type)
+        polarity = left_operand_polarity(node.left, left_type)
         return short_circuit_for(node, left_type, polarity) if polarity
 
         # The left operand only flows through on the edge that short-circuits: `a || b` yields `a` solely
@@ -689,6 +686,19 @@ module Rigor
         end
       end
 
+      # Issue #313 — the node-aware wrapper the `&&` / `||` short-circuit reads. The spec's exclusion binds
+      # this gate as much as it binds `flow.always-truthy-condition`, and a `Constant`-only gate is not by
+      # itself enough to honour it: a literal hash whose values share one type reads as a lone `Constant`
+      # (`UNIFORM[key]` → `Constant[1]`), so the gate would judge the left operand of `UNIFORM[key] || key`
+      # provably truthy and discard the author's fallback — the counter-example the spec names verbatim.
+      # Declining returns the union of both operands, which is what `StatementEvaluator#eval_and_or` produces
+      # anyway, so the two `&&` / `||` typers stay in agreement.
+      def left_operand_polarity(left_node, left_type)
+        return nil unless optimistic_origin_for(left_node).nil?
+
+        constant_value_polarity(left_type)
+      end
+
       # Returns `:truthy` / `:falsey` for a `Type::Constant`, nil otherwise. Mirrors
       # `constant_predicate_polarity` but operates on a typed value (already-type-of'd) rather than a Prism
       # node, so the same predicate analysis can be reused in both contexts.
@@ -1092,8 +1102,12 @@ module Rigor
       # through `Enumerable#select` / `Object#select` and the caller observes `Array[Elem]` instead of the
       # helper's actual return type. The check fires only for `node.receiver.nil?` (true implicit self), so
       # explicit-receiver dispatch is unaffected.
+      #
+      # Issue #316 — the lookup goes through the confidence-gated `Scope#bindable_top_level_def_for`, not the
+      # raw table: inside a block whose `self` is unmodelled, a top-level `def` from ANOTHER file is not
+      # evidence about which method the call reaches, so the bind is declined and the call widens.
       def try_local_def_dispatch(node, receiver, arg_types)
-        local_def = node.receiver.nil? ? scope.top_level_def_for(node.name) : nil
+        local_def = node.receiver.nil? ? scope.bindable_top_level_def_for(node.name) : nil
         return nil unless local_def
 
         local_inference = infer_top_level_user_method(local_def, receiver, arg_types)
@@ -1159,7 +1173,7 @@ module Rigor
         # `module_function` body, re-type that body with the call args bound. Sits after the RBS dispatch
         # tier, so foreign / RBS-known singletons (`Math.sqrt`) keep their catalog answer; only
         # project-defined singleton methods reach here.
-        singleton_inference = try_singleton_method_inference(receiver, node, arg_types)
+        singleton_inference = try_project_singleton_inference(receiver, node, arg_types)
         return singleton_inference if singleton_inference
 
         # Dynamic-origin propagation: when the receiver is Dynamic[T] and no positive rule resolves the call,
@@ -1336,6 +1350,31 @@ module Rigor
         nil
       end
 
+      # The project-side singleton-method band: a `Foo.bar` call resolved against a `class << …` / `def self.…`
+      # body the project itself wrote. Which of the two tiers applies is decided by the receiver carrier —
+      # `Singleton[Foo]` when the constant names a class or module, `Nominal[…]` when it holds an ordinary
+      # object (#320) — so the two are mutually exclusive and consulting both is one resolution attempt.
+      def try_project_singleton_inference(receiver, call_node, arg_types)
+        try_singleton_method_inference(receiver, call_node, arg_types) ||
+          try_singleton_object_constant_inference(receiver, call_node, arg_types)
+      end
+
+      # #320 — resolves a call whose receiver is a constant holding an ordinary object with a `class << Const`
+      # singleton body, re-typing that body with the call's argument types bound. `self` inside the body IS
+      # that object, so the receiver carrier is passed through unchanged. Own-constant only, and only for a
+      # name the project actually recorded — a miss degrades to today's `Dynamic[top]`, never a false
+      # resolution. `Singleton` receivers never reach here: {#try_singleton_method_inference} owns them.
+      def try_singleton_object_constant_inference(receiver, call_node, arg_types)
+        return nil unless receiver.is_a?(Type::Nominal)
+
+        def_node = SingletonObjectConstant.def_node_for(call_node, receiver, call_node.name, scope)
+        return nil if def_node.nil?
+
+        infer_user_method_return(def_node, receiver, arg_types)
+      rescue StandardError
+        nil
+      end
+
       # ADR-24 slice 2 — resolves `method_name` against `class_name`'s own `def`s, then walks the user-class
       # ancestor chain: included / prepended modules (transitive) and the superclass chain. RBS-known
       # ancestors are NOT walked here — the `MethodDispatcher` RBS tier runs before
@@ -2444,7 +2483,11 @@ module Rigor
         case block_arg
         when Prism::BlockNode
           bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_arg)
-          block_scope = bindings.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
+          # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
+          # yielding method's business, so the return-typing pass must see the same unmodelled-self mark.
+          block_scope = bindings.reduce(scope.entering_opaque_block) do |acc, (name, type)|
+            acc.with_local(name, type)
+          end
           block_scope = block_scope.with_self_type(narrowed_self_type) if narrowed_self_type
           type_block_body(block_arg, block_scope)
         when Prism::BlockArgumentNode

data/lib/rigor/inference/fork_map.rb

@@ -37,6 +37,27 @@ module Rigor
         worker_count > 1 && Process.respond_to?(:fork)
       end
 
+      # Where a forked child may put process-private scratch files. `nil` on the parent and on the sequential
+      # path, meaning "you are not in a child — use `Dir.tmpdir`".
+      #
+      # A child ends at {.run_worker}'s `exit!`, which skips `at_exit` AND object finalizers, so a `Tempfile`
+      # a child creates is never reclaimed by the mechanism that reclaims the parent's (issue #330 —
+      # `Protection::ClosureKillOracle`'s per-process mutant file leaked one file per worker per
+      # `rigor coverage --protection --mutation` run). Answering with the directory the parent already removes
+      # once every child has been collected makes the child's scratch state the parent's problem, which is the
+      # only place it can be solved: the names are random, so nothing outside the child could find them.
+      #
+      # The directory check is the belt to {.run_worker}'s braces: the offer is only worth taking while the
+      # parent still has the directory open, and answering `nil` once it is gone degrades to `Dir.tmpdir`
+      # instead of raising `Errno::ENOENT` somewhere far from here.
+      #
+      # @return [String, nil]
+      def child_scratch_dir
+        return nil unless @child_scratch_dir && File.directory?(@child_scratch_dir)
+
+        @child_scratch_dir
+      end
+
       # Forks `worker_count` children over contiguous slices, waits for each, and returns the Marshal'd
       # per-slice payloads in slice order. A child that exits abnormally has its slice re-run in-process.
       def fork_map(items, worker_count, block)
@@ -57,18 +78,31 @@ module Rigor
       # Child-process body: run the block over the slice, Marshal the result to `out_path`, and `exit!`
       # (skipping `at_exit` / stdio flush — the payload is durable on disk). Any failure exits non-zero so
       # the parent re-runs the slice in-process.
+      # The `ensure` is not dead code even though `exit!` never unwinds: {.child_scratch_dir} is module state,
+      # and a caller that drives this body in-process with `exit!` stubbed (the deferred-YJIT spec does exactly
+      # that — a spy in the parent cannot observe a real child) would otherwise leave the offer standing for
+      # the rest of the process, pointing at a directory its `Dir.mktmpdir` block has since removed.
       def run_worker(slice, block, out_path)
-        # Re-arm deferred YJIT in the child, exactly as the check fork pool does
-        # ({Analysis::Runner::PoolCoordinator#run_fork_worker}). The parent's deadline thread does not survive
-        # `fork`, so without this a worker runs its whole slice un-JITted while the parent JITs the tail it no
-        # longer runs — the pool was a *pessimization* on long runs (`coverage --protection --mutation
-        # lib/rigor/analysis`: 37s sequential against 67s at eight workers). The child picks up what is left of
-        # the parent's window rather than a fresh one; {Runtime::Jit.rearm_after_fork} carries the mechanism.
-        Runtime::Jit.rearm_after_fork
-        File.binwrite(out_path, Marshal.dump(block.call(slice)))
-        exit!(0)
-      rescue StandardError
-        exit!(1)
+        status = begin
+          # Re-arm deferred YJIT in the child, exactly as the check fork pool does
+          # ({Analysis::Runner::PoolCoordinator#run_fork_worker}). The parent's deadline thread does not
+          # survive `fork`, so without this a worker runs its whole slice un-JITted while the parent JITs the
+          # tail it no longer runs — the pool was a *pessimization* on long runs (`coverage --protection
+          # --mutation lib/rigor/analysis`: 37s sequential against 67s at eight workers). The child picks up
+          # what is left of the parent's window rather than a fresh one; {Runtime::Jit.rearm_after_fork}
+          # carries the mechanism.
+          Runtime::Jit.rearm_after_fork
+          # Published before the block runs, so anything it lazily creates for this process alone lands in the
+          # parent's tmpdir and dies with it. See {.child_scratch_dir}.
+          @child_scratch_dir = File.dirname(out_path)
+          File.binwrite(out_path, Marshal.dump(block.call(slice)))
+          0
+        rescue StandardError
+          1
+        ensure
+          @child_scratch_dir = nil
+        end
+        exit!(status)
       end
 
       # Waits for every child, placing each successful payload at its slice index; a child that exited