steins-infer: the value relation judges null, arrays, closures and native tops as PHP does (#951, #941, #952, #1051 S1) by zonuexe · Pull Request #1060 · rigortype/steins

zonuexe · 2026-10-11T08:30:44Z

Slice S1 of the type/arity reproduction run (#1051). It opens the native value relation's deliberate silences for #951 a–f, #941 a/b and #952 l1, following the PHP 8.5.11 table in #1051 §C5.

What changed

steins-syntax: a parameter now records a native top (array, object, iterable or callable, optionally nullable) as Param.top. Before, lower_hint dropped it.
crates/steins-infer/src/value_tops.rs (new): top_is_type_error, the closure certainty check, and the builtin null rejection.
- It is wired at the direct pass, propagation, method and constructor calls, closure calls, the builtin arm, return, and the typed-property seam.
is_type_error:
- Null is rejected by every non-nullable native type, class, intersection and DNF types included. The = null default and the builtin scalar coercive carve-out still accept it.
- An array is rejected by every native type.
- A closure is judged as the final Closure class.
- A written new or enum case reaches the typed-property seam.
A callable string or array literal is convicted only through the existing absence ladders: sidecar available, dam clear, and the boot surface answering absent. New legs in absence.rs handle this.

Validation

A generated PHP 8.5.11 grid, 24 values × 23 types × the argument, return and property seams × both modes, gives 0 false positives. True positives in strict rise from 445 to 1097 cells.
The coercion-grid harness now asserts zero divergences for userland and internal functions. Its array and class/null exceptions are gone.
value_relation_openings.rs has 69 tests. 36 fail on base; the controls and declines pass on both.
Two old pins were updated for the opened rows.
The syntax, infer, xtask and cli suites pass, as do workspace clippy and rustdoc with -D warnings.

Declined (pinned)

Callables:
- ["stdClass","nope"] and new stdClass to callable. Under the ADR rules a reflected class never convicts.
- An instance method named statically, an enum case, and self:: or parent:: strings.
- Names reaching the argument through a variable or a class constant.
- A first-class callable of an unresolved name.
Tops:
- Tops inside a binding descent.
- By-ref and variadic parameters.
- Unions of a top with anything but null.
A closure into string in coercive mode.
Tops at the return and property seams. This is type.return-mismatch does not read the enforced top: function f(): array { return 'x'; } reports nothing while A2 silently drops the exit #727; about 100 grid cells per mode stay silent.

Measurement (ten public packages)

Strict: 17206 → 17207. Default: 33 → 34. The one added finding is in phpunit's tests/end-to-end/logging/_files/TypeErrorTest.php:22, a type.property-mismatch for new DateTime into a DateTimeImmutable property. It is a deliberate TypeError fixture, a true positive, and is pinned in expected_proof_findings.toml.
effect-diff: identical.
Perf on composer is within noise (median 2.85 s base, 2.73 s head).

Not measured

The private half of the local fp-gate. The orchestrator runs it before merge.

Review outcome

Adversarial review: four rounds, now approved.

Round 1: five false-positive shapes.
- A literal is_callable guard did not vouch for the name it tests.
- isset, is_countable and is_a over a proven null went unmodelled.
- A write to a parent's private property.
- A write that reaches __set.
- An alias of a builtin class. The alias resolution itself is A class_alias of a builtin class is dropped, so the alias reads as undefined and mismatches the original #1061.
Round 2: the first fix forgot tested values after the join, which lost master true positives. Spelled-out forms of is_callable did not vouch, and the trait decline was too broad. Fixes:
- Forgetting is now branch-scoped.
- The syntax_only argument binds by position or by name.
- __set is looked up through trait use chains.
Round 3: is_numeric was decided with PHP 8 rules under a PHP 7.4 pin. A type test is now decided on a proven value only where every PHP from 7.4 up agrees. That was checked on 18 predicates × 24 values on 7.4.33, 8.0.28 and 8.5.11. The only version-dependent cells are is_numeric on a numeric string with trailing whitespace, which stays undecided.
Accepted trade-off: after if (T) { return; }, where T is a test the walk cannot decide (for example ctype_* or method_exists), the tested value stays forgotten, because the surviving side may be the only live one. This loses 4 witness reports that master made. It is the sound direction.
Guard grid: 0 FP cells out of 27 predicates × 6 values. The value grid has 0 FPs and 1097 TPs in strict.
Public corpus: with and without the sidecar, nothing removed. The only addition is the pinned phpunit true positive.

…bles it reads, so a test of get_debug_type($x), $x ?? d or $x?->p names $x (#1051, #1060)

…ose type test the walk cannot decide over a proven value forgets that value on both sides (#1051, #1060)

…hod it names, and a callable name or object is judged where the branch's vouches are, so a guarded name and a guarded undefined-function call stay silent (#941, #1060)

…class's private, an unrelated scope's protected or readonly, a chain with __set, a trait or an unseen ancestor) is not judged, and a class an unminted class_alias names rejects no object (#952, #1060)

…uard table, private, protected and __set writes, and an alias of an engine class (#1060)

…take the review's rows: is_callable vouches, undecided type tests over proven values, writes that miss the typed slot, and unminted aliases (#951, #1060)

…bles it reads, so a test of get_debug_type($x), $x ?? d or $x?->p names $x (#1051, #1060)

…ose type test the walk cannot decide over a proven value forgets that value inside the guarded sides (#1051, #1060)

…hod it names, and a callable name or object is judged where the branch's vouches are, so a guarded name and a guarded undefined-function call stay silent (#941, #1060)

…class's private, an unrelated scope's protected or readonly, a chain with __set or an unseen ancestor) is not judged, and a class an unminted class_alias names rejects no object (#952, #1060)

…uard table, private, protected and __set writes, and an alias of an engine class (#1060)

…take the review's rows: is_callable vouches, undecided type tests over proven values, writes that miss the typed slot, and unminted aliases (#951, #1060)

…set, read by name so a trait's counts (#1060)

… declares or an unresolvable trait, not on every trait use (#952, #1060)

…eral false, by position or by name, and never when it is true or unproven (#941, #1060)

…the guarded sides only and hands it back when every side falls through, and the is_* family, is_countable, is_a and is_subclass_of are decided on a proven value (#1051, #1060)

…ested value, is_callable's syntax_only binding, and traits without __set (#1060)

…view's rules: decided type tests, branch-scoped forgetting, is_callable's syntax_only, and __set through traits (#951, #1060)

…stays undecided, since PHP 7.4 and 8.0+ answer it differently, and every other predicate decided on a proven value is pinned as answering alike from 7.4 up (#1060)

…lue only where PHP 7.4 through 8.5 agree, naming is_numeric's trailing whitespace (#1060)

…inst class and scalar types, a written new against a typed property, and values against a native array, object, iterable or callable parameter (#951, #941, #952, #1051)

…nd the coercion grids assert no cell diverges from PHP (#951, #941, #952, #1051)

…the fp-gate pin for PHPUnit's TypeError fixture the property seam now reports (#951, #941, #952, #1051)

…teral, not a class constant resolving to one, and the descent decline is pinned (#941, #1051)