steins-infer: a returned call is judged like an assigned one, and a finite set of values is judged per member (#950, #1051 S2)

[zonuexe]

Slice S2 of the type/arity reproduction run (#1051). Part of #950: return f(args) is now judged the way $x = f(args); return $x; is, and a finite set of candidate values (OneOf) is judged per member (decision D6).

What changed

• return_call.rs (new), for R6: a returned call is bound into a copy of the env and store by apply_assign, gets the statement's own summary and arms, and the return seam judges that slot. The value as written is still tried first, so no base finding is lost.

• finite_verdict.rs (new), for R5: a OneOf is judged member by member through is_type_error, in the file's own mode. A null member is admitted for ?T, for an implicit-null default, and under the coercive internal-null carve-out.

  members rejected	verdict
  all	definite type.argument-mismatch / type.return-mismatch
  some	possibly grade, Floor::Strict
  none	silent

• return_maybe.rs / arg_check.rs: a OneOf is no longer declined on a variable or a summary carrier.

• builtin_returns.rs: a literal true as $return narrows the floor to string for print_r, var_export, highlight_string and highlight_file, at the return, assign and argument seams. Without this, the A/B showed return var_export($x, true) as a false positive.

Tests

• return_call_oneof.rs has 26 tests, one per table row. 14 fail on base.
• Five fixtures that pinned "a OneOf of two bad literals is silent" now report a definite finding (D6).
• this_exactness now reports the possibly grade. One maybe-return test is rewritten as a parity test.

Measurement (ten public packages)

• Strict with vendor diagnostics: 17207 → 17221. That is 14 added and 0 removed, all possibly-grade return findings from return builtin() or return $this->m(). Each has a PHP strict witness:
  • preg_replace returns null on a backtrack-limit error (5 findings).
  • realpath, array_search, key, abs, array_sum and octdec return types that the declared return does not admit (7 findings).
  • A native ?int or ?string callee returns null into a non-null return (2 findings).
• Default and --no-php: identical.
• composer perf is within noise.

ADR

ADR-0043 has a 2026-10-11 amendment (PENDING).

Not covered

• An Asserted OneOf on the value lane has no source today. Its row is coded but not tested.
• The $return narrowing covers four builtins only.
• The private half of the local fp-gate. The orchestrator runs it before merge.