rigortype 0.3.8 → 0.4.0

data/lib/rigor/inference/narrowing.rb

@@ -9,6 +9,12 @@ require_relative "../environment"
 require_relative "../rbs_extended"
 require_relative "../analysis/fact_store"
 require_relative "../builtins/regex_refinement"
+require_relative "guard_rebinding"
+require_relative "last_line"
+require_relative "operand_effects"
+require_relative "optimistic_origin"
+require_relative "project_method_ownership"
+require_relative "receiver_alias"
 
 module Rigor
   module Inference
@@ -41,14 +47,36 @@ module Rigor
     module Narrowing
       TRUSTED_EQUALITY_LITERAL_CLASSES = [String, Symbol, Integer, TrueClass, FalseClass, NilClass].freeze
       SINGLETON_LITERAL_CLASSES = [TrueClass, FalseClass, NilClass].freeze
-      ClassNarrowingContext = Data.define(:exact, :polarity, :environment)
+      # `scope` is the analysed file's seeded scope where the caller has one, and nil otherwise (the
+      # Fact-shaped and RSpec-matcher entries hold an environment but no scope). Only the #898 singleton
+      # path reads it, and only to withhold a `Bot`, so a nil scope is the pre-#898 answer exactly.
+      ClassNarrowingContext = Data.define(:exact, :polarity, :environment, :scope)
       # A recognised `=~` regex pattern operand: the pattern `source` string and whether it was
       # compiled in extended (`//x`) mode. Extraction from a literal `RegularExpressionNode` and from
       # a value-pinned `Constant[Regexp]` share this carrier so the participation walk and the
       # extended-mode bail read one shape.
       RegexMatchPattern = Data.define(:source, :extended)
+      # Issue #1429 — a predicate receiver whose binding an edge can narrow ({.receiver_slot}): a local, an instance
+      # variable or a global (`name` its Symbol), or a constant reference (`name` its {.constant_key}). `current` is
+      # the type the receiver reads before the predicate, a global's read type when the scope does not bind it.
+      ReceiverSlot = Data.define(:kind, :name, :current)
+      # The globals a guard narrows without a record ({Scope#with_guarded_global}): `$_` and `$~` live in the frame's
+      # special-variable slot, which a called method does not reach and their own machinery forgets
+      # (`Scope#forget_last_line`, `Scope#forget_match_globals`), and `$!` / `$@` read the rescue clause that is
+      # running, which a call that returns leaves as it was.
+      UNRECORDED_GUARD_GLOBALS = %i[$_ $~ $! $@].freeze
+      # Issue #1429 — the value-pinned classes: a `Nominal` of one of them is the single value itself, which no
+      # program replaces with another class's instance, so it counts with the literal carriers
+      # ({.disjoint_nominal_guard?}, `respond_to?`'s edge).
+      VALUE_PINNED_CLASSES = %w[NilClass TrueClass FalseClass].freeze
       private_constant :TRUSTED_EQUALITY_LITERAL_CLASSES, :SINGLETON_LITERAL_CLASSES, :ClassNarrowingContext,
-                       :RegexMatchPattern
+                       :RegexMatchPattern, :ReceiverSlot, :UNRECORDED_GUARD_GLOBALS, :VALUE_PINNED_CLASSES
+
+      # Issue #1017 — the tallest stack of conditionals a condition may carry and still contribute facts. A
+      # conditional guard analyses its predicate and both arms, so each level can triple the analysis; past this
+      # height the guard declines to "no narrowing". Height counts conditionals reached through the shapes the
+      # analyser walks (parentheses, a body's last statement, `&&` / `||`, `!`, a predicate, an arm).
+      CONDITIONAL_GUARD_DEPTH = 2
 
       module_function
 
@@ -117,10 +145,9 @@ module Rigor
       # falsey fragments above: `:truthy` when no inhabitant is falsey (the falsey fragment is
       # `Bot`), `:falsey` when no inhabitant is truthy, nil when both fragments are inhabited —
       # or when the type itself is nil / `Bot` (dead code is not a certainty claim). This is the
-      # single owner of the judgment both branch-elision consumers read
-      # (`ExpressionTyper#elide_or_union` on the value side, `StatementEvaluator#live_branch_for_if`
-      # on the scope side), so the type a dead branch is elided from and the scope that stops
-      # flowing through it can never disagree.
+      # single owner of the judgment branch elision reads (`StatementEvaluator#live_branch_for_if`,
+      # which a value-position conditional reaches too since issue #1003), so the type a dead
+      # branch is elided from and the scope that stops flowing through it can never disagree.
       def predicate_certainty(type)
         return nil if type.nil? || type.is_a?(Type::Bot)
 
@@ -139,9 +166,11 @@ module Rigor
       # counterpart of the scope narrowing {.case_when_scopes} performs for the same condition
       # shape, kept here so the branch a `case` expression's type drops and the clause whose
       # body scope goes dead derive from one judgment.
-      def class_pattern_certainty(subject_type, class_name, environment:)
-        truthy_bot = narrow_class(subject_type, class_name, environment: environment).is_a?(Type::Bot)
-        falsey_bot = narrow_not_class(subject_type, class_name, environment: environment).is_a?(Type::Bot)
+      def class_pattern_certainty(subject_type, class_name, environment:, scope: nil)
+        truthy_bot = narrow_class(subject_type, class_name, environment: environment,
+                                                            scope: scope).is_a?(Type::Bot)
+        falsey_bot = narrow_not_class(subject_type, class_name, environment: environment,
+                                                                scope: scope).is_a?(Type::Bot)
 
         return :no if truthy_bot && !falsey_bot
         return :yes if !truthy_bot && falsey_bot
@@ -219,6 +248,54 @@ module Rigor
         narrow_integer_comparison_dispatch(type, comparator, bound)
       end
 
+      # Float-comparison fragment of `type` against a numeric literal `bound` (ADR-109 WD5). This
+      # is a TRUTHY-EDGE rule only: `x > c` is false for NaN, so the set that satisfies it is the
+      # range `Float[c..]`, but the set that fails it is that range's complement PLUS NaN, which no
+      # range spells. Callers apply it to the truthy edge and keep the entry type on the falsy edge.
+      # `x > c` narrows to the closed envelope `Float[c..]` rather than the exact `(c, ∞]` (one
+      # double wider; the exact form is deferred until a rule demands the removed point), `x < c`
+      # to the exact `Float[...c]`. Hooks in:
+      # - `Constant<Float>` is preserved when it satisfies the comparison, otherwise collapsed to
+      #   `Bot` (a NaN constant satisfies nothing);
+      # - `FloatRange` becomes its intersection with the half-line, `Bot` when empty;
+      # - `Nominal[Float]` becomes the half-line itself;
+      # - `Union` narrows each member independently; Integer-rooted and other carriers flow
+      #   through unchanged (the Integer rule above owns them).
+      def narrow_float_comparison(type, comparator, bound)
+        return type unless (bound.is_a?(Integer) || bound.is_a?(Float)) && %i[< <= > >=].include?(comparator)
+
+        bound = bound.to_f
+        return type if bound.nan? || bound.infinite?
+
+        narrow_float_comparison_dispatch(type, comparator, bound)
+      end
+
+      # The truthy edge of a numeric comparison: the Integer rule for Integer-rooted members, then
+      # the Float rule for Float-rooted ones. Never apply this to a falsy edge (see
+      # {.narrow_float_comparison}).
+      def narrow_numeric_comparison_truthy(type, comparator, bound)
+        narrow_float_comparison(narrow_integer_comparison(type, comparator, bound), comparator, bound)
+      end
+
+      # Intersects the Float-rooted members of `type` with `range` (a `FloatRange`), leaving every
+      # other member unchanged. `x.nan?` narrows its FALSY edge with `non_nan_float`; `x.finite?`
+      # narrows its TRUTHY edge with `finite_float`; the other edge of each keeps the entry type
+      # (NaN is truthy for `nan?` and nothing else is known there; `!finite?` admits NaN and ±∞).
+      def narrow_float_to_range(type, range)
+        case type
+        when Type::Constant
+          type.value.is_a?(Float) && !range.covers?(type.value) ? Type::Combinator.bot : type
+        when Type::FloatRange
+          intersect_float_bounds(type, range.min, range.max, range.exclude_end?)
+        when Type::Nominal
+          float_nominal?(type) ? range : type
+        when Type::Union
+          Type::Combinator.union(*type.members.map { |m| narrow_float_to_range(m, range) })
+        else
+          type
+        end
+      end
+
       # Equality fragment of `type` against an Integer `value`. `Constant<Integer>` is preserved
       # when it equals `value`, otherwise collapses to `Bot`. `IntegerRange` covers? `value`
       # narrows to `Constant[value]`; an out-of-range comparison collapses to `Bot`.
@@ -261,17 +338,35 @@ module Rigor
       # preserved; disjoint hierarchies collapse to `Bot`. Classes the environment cannot
       # resolve fall back to the conservative answer (the type unchanged) so the analyzer never
       # asserts narrowing it cannot prove.
-      def narrow_class(type, class_name, exact: false, environment: Environment.default)
-        context = ClassNarrowingContext.new(exact: exact, polarity: :positive, environment: environment)
+      def narrow_class(type, class_name, exact: false, environment: Environment.default, scope: nil)
+        context = ClassNarrowingContext.new(exact: exact, polarity: :positive, environment: environment,
+                                            scope: scope)
         narrow_class_dispatch(type, class_name, context)
       end
 
+      # Issue #1429 — true when `type` holds a member whose `Bot` under `is_a?(class_name)` rests only on Rigor's
+      # reading of its type: a `Nominal`, other than the value-pinned `nil` / `true` / `false` classes, whose class
+      # the environment orders `:disjoint` from `class_name`. A `Nominal` is a type Rigor inferred or read from a
+      # signature, and a program can hold another object there: `$stdout` is typed `IO`, and a test runs it with a
+      # `StringIO`, which is not an `IO` subclass. The narrowing still reads such a guard's edge as `Bot`, so the
+      # arm is not checked; what this answers is whether the `Bot` may stand as a verdict that the code is dead
+      # (`flow.unreachable-clause`). The carriers that record what the file literally shows (`Constant`, `Tuple`,
+      # `HashShape`, `Singleton`) and the value-pinned classes do not count, so their verdicts stand.
+      def disjoint_nominal_guard?(type, class_name, environment: Environment.default)
+        members = type.is_a?(Type::Union) ? type.members : [type]
+        members.any? do |member|
+          member.is_a?(Type::Nominal) && !VALUE_PINNED_CLASSES.include?(member.class_name) &&
+            member.class_name != class_name && environment.class_ordering(member.class_name, class_name) == :disjoint
+        end
+      end
+
       # Mirror of {.narrow_class} for the falsey edge of `is_a?`/`kind_of?`/`instance_of?`.
       # Inhabitants that DO satisfy the predicate are removed; inhabitants that do not are
       # preserved. Conservative on Top/Dynamic/Bot (preserved unchanged) because the analyzer
       # cannot prove the negative without a richer carrier.
-      def narrow_not_class(type, class_name, exact: false, environment: Environment.default)
-        context = ClassNarrowingContext.new(exact: exact, polarity: :negative, environment: environment)
+      def narrow_not_class(type, class_name, exact: false, environment: Environment.default, scope: nil)
+        context = ClassNarrowingContext.new(exact: exact, polarity: :negative, environment: environment,
+                                            scope: scope)
         narrow_class_dispatch(type, class_name, context)
       end
 
@@ -285,11 +380,11 @@ module Rigor
       #   Walk the current type's union members, keep each part disjoint from `base`, and add
       #   the removed-value Constant once when any current member covers it. `assert s is
       #   ~non-empty-string` over `s: String | nil` narrows to `Constant[""] | NilClass`.
-      # - `IntegerRange[a, b]` (v0.0.5+ slice). Complement is the two open halves `int<min,
-      #   a-1>` and `int<b+1, max>`, each intersected with the integer-domain parts of
+      # - `IntegerRange[a, b]` (v0.0.5+ slice). Complement is the two open halves
+      #   `Integer[..a-1]` and `Integer[b+1..]`, each intersected with the integer-domain parts of
       #   `current_type`. Non-integer parts (nil, String, …) of a Union receiver survive
-      #   unchanged. `assert n is ~int<5, 10>` over `n: Integer | nil` narrows to `int<min, 4> |
-      #   int<11, max> | NilClass`.
+      #   unchanged. `assert n is ~Integer[5..10]` over `n: Integer | nil` narrows to `Integer[..4] |
+      #   Integer[11..] | NilClass`.
       # - `Type::Intersection[M1, M2, …]` (v0.0.5+ slice). De Morgan: `D \ (M1 ∩ M2) = (D \ M1)
       #   ∪ (D \ M2)`. Each member's complement is computed independently within
       #   `current_type` and the results are unioned. Members the algebra cannot complement
@@ -335,12 +430,18 @@ module Rigor
         fact.type
       end
 
+      # Issue #1429 — the key a constant reference's guard narrowing is recorded under ({Scope#constant_narrowing}):
+      # its spelling, with a leading `::` kept, since `::Foo` and `Foo` may name two constants. nil for a path on a
+      # dynamic base (`expr::Foo`) and for any other node.
+      def constant_key(node)
+        name = Source::ConstantPath.qualified_name_or_nil(node)
+        return nil if name.nil?
+
+        Source::ConstantPath.rooted?(node) ? "::#{name}" : name
+      end
+
       # Public predicate analyser. Returns `[truthy_scope, falsey_scope]`, always; when no
       # narrowing rule matches the predicate node both entries are the receiver scope unchanged.
-      #
-      # @param node [Prism::Node, nil]
-      # @param scope [Rigor::Scope]
-      # @return [Array(Rigor::Scope, Rigor::Scope)]
       def predicate_scopes(node, scope)
         return [scope, scope] if node.nil?
 
@@ -348,6 +449,37 @@ module Rigor
         result || [scope, scope]
       end
 
+      # Issue #1468 — the scope the arguments and block of a safe-navigation call `recv&.m(…)` run under. Ruby
+      # evaluates them only once `recv` is known non-nil, so `klass&.new(klass.flag?)` reads `klass` without its
+      # `nil`, as `if klass then klass.new(klass.flag?) end` does. Only `nil` is removed: `false&.m(x)` still calls
+      # `m`. The call's own value keeps its skipped-call `nil` (`ExpressionTyper#safe_navigation_call_type`).
+      #
+      # The receiver is one a guard narrows ({.receiver_slot}: a local, instance variable, global or constant), or a
+      # safe-navigation call on such a receiver whose own arguments and block hold no write or jump
+      # ({OperandEffects}): `a&.b(a.c)&.d(a.e)` runs `d` only when `a&.b(…)` answered non-nil, which it cannot on a
+      # nil `a`, and nothing between the two reads rebinds `a`. `scope` itself when nothing narrows, and for a call
+      # that is not `&.`.
+      def safe_navigation_scope(call_node, scope)
+        return scope unless call_node.safe_navigation?
+
+        non_nil_receiver_scope(call_node.receiver, scope) || scope
+      end
+
+      # The scope the block of a safe-navigation call is entered from: {.safe_navigation_scope}, unless the narrowing
+      # may not hold for the whole body. An argument that writes may rebind the receiver before the block runs
+      # (`f&.two(f = nil) { f.run }`), and a block that writes the receiver hands the next iteration what it wrote
+      # (`a&.each { a.size; a = nil }`); either keeps `scope`.
+      def safe_navigation_block_scope(call_node, scope)
+        return scope unless call_node.safe_navigation?
+        return scope if OperandEffects.any?(call_node.arguments)
+
+        root = call_node.receiver
+        root = root.receiver while root.is_a?(Prism::CallNode) && root.safe_navigation?
+        return scope if root.respond_to?(:name) && OperandEffects.written_variables(call_node.block).include?(root.name)
+
+        safe_navigation_scope(call_node, scope)
+      end
+
       # Slice 7 phase 5 — `case`/`when` narrowing.
       #
       # Given the subject of a `case` (the expression after the `case` keyword) and an array of
@@ -365,12 +497,6 @@ module Rigor
       # scope. The catalogue mirrors {.case_equality_target_class}: static class/module
       # constants narrow as `is_a?`; integer/float-endpoint ranges narrow to `Numeric`;
       # string-endpoint ranges and regexp literals narrow to `String`.
-      #
-      # @param subject [Prism::Node, nil] the `case` subject.
-      # @param conditions [Array<Prism::Node>] the `when`
-      #   clause's `conditions` array.
-      # @param scope [Rigor::Scope]
-      # @return [Array(Rigor::Scope, Rigor::Scope)]
       def case_when_scopes(subject, conditions, scope)
         # C1 — `case x when /re/` runs `/re/ === x`, which sets the regex match-data globals
         # exactly as a successful `=~` does. Narrow `$~`/`$&`/`$1..$N` on the clause body (the
@@ -378,17 +504,17 @@ module Rigor
         # a different regex. Applied even when the subject is not a narrowable local read.
         body_scope = apply_when_regex_globals(conditions, scope)
 
-        return [body_scope, scope] unless subject.is_a?(Prism::LocalVariableReadNode)
-
-        local_name = subject.name
-        current = scope.local(local_name)
-        return [body_scope, scope] if current.nil?
+        # Issue #1429 — a global or constant subject (`case $stdout when StringIO`) narrows as a local does.
+        slot = receiver_slot(subject, scope, kinds: CASE_SUBJECT_KINDS)
+        return [body_scope, scope] if slot.nil?
 
-        truthy, = accumulate_case_when_scopes(body_scope, local_name, current, conditions)
-        _, falsey = accumulate_case_when_scopes(scope, local_name, current, conditions)
-        [truthy, falsey]
+        truthy_type, falsey_type = case_when_types(scope, slot.current, conditions)
+        [narrow_slot(body_scope, slot, truthy_type), narrow_slot(scope, slot, falsey_type)]
       end
 
+      CASE_SUBJECT_KINDS = %i[local global constant].freeze
+      private_constant :CASE_SUBJECT_KINDS
+
       # When the clause has exactly one `RegularExpressionNode` literal condition, narrow the
       # match-data globals on the body edge (same rule as `analyse_regex_match_predicate`'s
       # truthy edge). With multiple regex conditions (`when /a/, /b/`) the body is reachable
@@ -411,8 +537,29 @@ module Rigor
 
       # Internal analyser. Returns `[truthy_scope, falsey_scope]` when the predicate shape is
       # recognised, or `nil` to signal "no narrowing" so the public surface can fall back to the
-      # entry scope.
+      # entry scope. Issue #1359 — a condition whose value is a `gets`-family reader's, the bare call
+      # or a variable written with it (`while gets`, `if (line = gets)`), also binds `$_` on each edge
+      # to the line the reader returned ({LastLine.predicate_scopes}).
       def analyse(node, scope)
+        edges = analyse_shape(node, scope)
+        reader = last_line_condition(node)
+        reader ? LastLine.predicate_scopes(reader, scope, edges) : edges
+      end
+
+      # The reader call a condition's value is, or nil.
+      def last_line_condition(node)
+        call =
+          case node
+          when Prism::CallNode then node
+          when Prism::LocalVariableWriteNode, Prism::InstanceVariableWriteNode, Prism::ClassVariableWriteNode,
+               Prism::GlobalVariableWriteNode
+            node.value
+          end
+        call if call.is_a?(Prism::CallNode) && LastLine::READERS.include?(call.name)
+      end
+      private_class_method :last_line_condition
+
+      def analyse_shape(node, scope)
         case node
         when Prism::ParenthesesNode
           analyse_parentheses(node, scope)
@@ -424,20 +571,19 @@ module Rigor
           analyse_local_write(node, scope)
         when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode
           analyse_ivar(node, scope)
-        when Prism::ClassVariableWriteNode
-          analyse_cvar_write(node, scope)
-        when Prism::GlobalVariableWriteNode
-          analyse_global_write(node, scope)
+        when Prism::ClassVariableWriteNode, Prism::GlobalVariableWriteNode
+          analyse_cvar_or_global_write(node, scope)
+        when Prism::GlobalVariableReadNode, Prism::ConstantReadNode, Prism::ConstantPathNode
+          analyse_slot_read(node, scope)
         when Prism::CallNode
-          analyse_call(node, scope)
-        when Prism::AndNode
-          analyse_and(node, scope)
-        when Prism::OrNode
-          analyse_or(node, scope)
+          analyse_call(write_receiver_as_read(node) || node, scope)
+        when Prism::AndNode, Prism::OrNode, Prism::IfNode, Prism::UnlessNode
+          analyse_composition(node, scope)
         when Prism::MatchWriteNode
           analyse_match_write(node, scope)
         end
       end
+      private_class_method :analyse_shape
 
       # rubocop:disable-next Metrics/ClassLength
       class << self
@@ -480,7 +626,7 @@ module Rigor
         end
 
         # Complement of an `IntegerRange[a, b]` within `current_type`. Splits the range
-        # complement into the two open halves `int<min, a-1>` and `int<b+1, max>` (skipping a
+        # complement into the two open halves `Integer[..a-1]` and `Integer[b+1..]` (skipping a
         # half when its bound is infinity), then intersects each half with the integer-domain
         # parts of `current_type`. Non-integer parts of a Union receiver (nil, String, …)
         # survive unchanged.
@@ -505,8 +651,8 @@ module Rigor
           Type::Combinator.union(*survivors)
         end
 
-        # Returns the two open halves of an IntegerRange's complement: the left half `int<-∞,
-        # a-1>` (when `a` is finite) and the right half `int<b+1, ∞>` (when `b` is finite).
+        # Returns the two open halves of an IntegerRange's complement: the left half
+        # `Integer[..a-1]` (when `a` is finite) and the right half `Integer[b+1..]` (when `b` is finite).
         # Universal ranges (both bounds infinite) yield an empty array — the complement is
         # empty.
         def integer_range_complement_halves(range)
@@ -794,6 +940,12 @@ module Rigor
           ]
         end
 
+        def analyse_cvar_or_global_write(node, scope)
+          return analyse_cvar_write(node, scope) if node.is_a?(Prism::ClassVariableWriteNode)
+
+          analyse_global_write(node, scope)
+        end
+
         def analyse_cvar_write(node, scope)
           current = scope.cvar(node.name)
           return nil if current.nil?
@@ -814,6 +966,76 @@ module Rigor
           ]
         end
 
+        # Issue #1429 — `if $g`, `return unless $g`, `if CONFIG`: the truthiness guard on a global or constant
+        # read, the counterpart of {#analyse_local_read} ({#narrow_slot}).
+        def analyse_slot_read(node, scope)
+          slot = receiver_slot(node, scope, kinds: GLOBAL_AND_CONSTANT)
+          return nil if slot.nil?
+
+          [
+            narrow_slot(scope, slot, narrow_truthy(slot.current)),
+            narrow_slot(scope, slot, narrow_falsey(slot.current))
+          ]
+        end
+
+        GLOBAL_AND_CONSTANT = %i[global constant].freeze
+        ALL_SLOT_KINDS = %i[local ivar global constant].freeze
+        private_constant :GLOBAL_AND_CONSTANT, :ALL_SLOT_KINDS
+
+        # The {ReceiverSlot} `node` reads, among `kinds`, or nil. A local or instance variable needs a binding. A
+        # global the scope does not bind is read as it reads unbound, and a constant reference as it resolves
+        # (through any narrowing already on it), so a guard narrows it from that type.
+        def receiver_slot(node, scope, kinds: ALL_SLOT_KINDS)
+          case node
+          when Prism::LocalVariableReadNode then variable_slot(:local, node.name, scope.local(node.name), kinds)
+          when Prism::InstanceVariableReadNode then variable_slot(:ivar, node.name, scope.ivar(node.name), kinds)
+          when Prism::GlobalVariableReadNode then global_slot(node, scope, kinds)
+          when Prism::ConstantReadNode, Prism::ConstantPathNode then constant_slot(node, scope, kinds)
+          end
+        end
+
+        def variable_slot(kind, name, current, kinds)
+          return nil if current.nil? || !kinds.include?(kind)
+
+          ReceiverSlot.new(kind: kind, name: name, current: current)
+        end
+
+        def global_slot(node, scope, kinds)
+          return nil unless kinds.include?(:global)
+
+          ReceiverSlot.new(kind: :global, name: node.name, current: scope.global(node.name) || scope.type_of(node))
+        end
+
+        def constant_slot(node, scope, kinds)
+          return nil unless kinds.include?(:constant)
+
+          key = constant_key(node)
+          return nil if key.nil?
+
+          ReceiverSlot.new(kind: :constant, name: key, current: scope.type_of(node))
+        end
+
+        # `scope` with `slot`'s receiver read as `type` on one edge. A local or instance variable rebinds as its
+        # analysers always did. A global or constant is left alone when the edge learns nothing (`type` is what
+        # it read), and otherwise narrows with its pre-guard type recorded, so code that may rebind it restores
+        # the binding ({Scope#forget_guard_narrowings}); the frame-local specials skip the record.
+        def narrow_slot(scope, slot, type)
+          case slot.kind
+          when :local then scope.with_local(slot.name, type)
+          when :ivar then scope.with_ivar(slot.name, type)
+          when :global then narrow_global_slot(scope, slot, type)
+          else
+            type == slot.current ? scope : scope.with_constant_narrowing(slot.name, type, slot.current)
+          end
+        end
+
+        def narrow_global_slot(scope, slot, type)
+          return scope if type == slot.current
+
+          record = !UNRECORDED_GUARD_GLOBALS.include?(slot.name)
+          scope.with_guarded_global(slot.name, type, slot.current, record: record)
+        end
+
         # `if /(?<x>...)/ =~ str` — Prism wraps the `=~` call in a `MatchWriteNode` listing the
         # named-capture targets. The parent `eval_match_write` has already bound each target to
         # `String | nil`; in the truthy branch (the regex matched) every named capture is
@@ -869,6 +1091,25 @@ module Rigor
         #   literals (Slice 6 phase 2 sub-phase 2).
         # Anything else returns nil so the surrounding analyser falls through to the
         # no-narrowing fallback.
+        # Issue #1223 — `(x = e).nil?`, `(x ||= e).empty?`, `(@x = e).is_a?(C)`. A write's value is the binding
+        # it leaves, and a predicate is narrowed in the scope after its receiver ran, so the call narrows the
+        # variable exactly as the same call on a read of it would. Every analyser keys its receiver on a read
+        # node, so the call is analysed with its receiver replaced by one ({ReceiverAlias.read_of}). Before #1223
+        # the statement evaluator did not thread a receiver's write at all, so the local was unbound and there
+        # was nothing to narrow; nil when the receiver is not such a write, bare or parenthesised on its own.
+        def write_receiver_as_read(node)
+          write = written_receiver(node.receiver)
+          write && node.copy(receiver: ReceiverAlias.read_of(write))
+        end
+
+        def written_receiver(receiver)
+          while receiver.is_a?(Prism::ParenthesesNode) && receiver.body.is_a?(Prism::StatementsNode) &&
+                receiver.body.body.size == 1
+            receiver = receiver.body.body.first
+          end
+          receiver if ReceiverAlias.variable_write?(receiver)
+        end
+
         def analyse_call(node, scope)
           return nil if node.block
 
@@ -994,7 +1235,7 @@ module Rigor
 
         def simple_dispatch_name?(name)
           %i[nil? ! is_a? kind_of? instance_of? == != === =~ match? key? has_key? empty? any?
-             none? respond_to?].include?(name)
+             none? respond_to? nan? finite?].include?(name)
         end
 
         def dispatch_call_simple(node, scope, name)
@@ -1009,6 +1250,7 @@ module Rigor
           when :key?, :has_key? then analyse_key_presence_predicate(node, scope)
           when :empty?, :any?, :none? then analyse_array_emptiness_predicate(node, scope, name)
           when :respond_to? then analyse_respond_to_predicate(node, scope)
+          when :nan?, :finite? then analyse_float_class_predicate(node, scope, name)
           end
         end
 
@@ -1018,11 +1260,19 @@ module Rigor
         # symbol is one of `NilClass`'s own methods (`:to_s`, `:inspect`, `:nil?`, …) — `nil`
         # DOES respond to those, so the truthy edge admits a nil receiver and we narrow nothing.
         #
+        # Issue #1429 — the truthy edge also admits `m` itself. `respond_to?` is a guard written in the code
+        # (ADR-117 Decision point 3), so a member of the receiver's type whose class Rigor knows to lack `m`
+        # is not what the edge holds: members that may respond keep their type, and when no member may, the
+        # receiver reads `Dynamic[top]` ({#respond_to_admitted}). `$stdout.respond_to?(:string) ?
+        # $stdout.string : ""` on an `IO`-typed `$stdout` therefore does not report `undefined method`.
+        # `Dynamic[top]` rather than `Dynamic[IO]`: method availability on a `Dynamic[T]` is checked against
+        # `T` (special-types.md), so only the untyped carrier is sure to keep the guarded call quiet.
+        #
         # Conservative floor: narrow only on a literal `Symbol`/`String` argument resolved
         # against the RBS environment; a non-literal symbol, a missing argument, or a symbol
         # that IS in `NilClass`'s method set declines. The falsey edge is always the no-op
-        # ("does not respond" proves little about the receiver's type). Narrowing-only: it
-        # removes the `nil` constituent and never promotes a non-nil type.
+        # ("does not respond" proves little about the receiver's type). A local, instance variable,
+        # global or constant receiver narrows ({#receiver_slot}).
         def analyse_respond_to_predicate(node, scope)
           return nil if node.block
           return nil if node.arguments.nil? || node.arguments.arguments.size != 1
@@ -1031,16 +1281,63 @@ module Rigor
           return nil if sym.nil?
           return nil if nilclass_method?(sym, scope)
 
-          reader, writer = emptiness_receiver_accessors(node.receiver)
-          return nil if reader.nil?
+          slot = receiver_slot(node.receiver, scope)
+          return nil if slot.nil?
 
-          current = scope.public_send(reader, node.receiver.name)
-          return nil if current.nil?
+          admitted = respond_to_admitted(narrow_non_nil(slot.current), sym.to_sym, scope)
+          return nil if admitted.equal?(slot.current) || admitted == slot.current
 
-          non_nil = narrow_non_nil(current)
-          return nil if non_nil.equal?(current)
+          [narrow_slot(scope, slot, admitted), scope]
+        end
+
+        # The members of `type` that may respond to `method_name`, or, when Rigor knows every member lacks it
+        # ({#lacks_method?}), `Dynamic[top]`: the members Rigor read the edge from are wrong about the object there,
+        # and no class is named to read it as instead. A member Rigor cannot judge (`Dynamic`, `Bot`, a class no
+        # signature declares) may respond.
+        #
+        # When every member lacking `m` records what the file literally shows (a literal, a `Tuple`, a `HashShape`, a
+        # class object, `nil` / `true` / `false`), the edge is `Bot`. For a literal value that is exact
+        # (`1.respond_to?(:string)` is false in every run); a class object's arm goes unchecked when a gem without a
+        # signature adds the method (`Time.respond_to?(:zone)` under ActiveSupport).
+        def respond_to_admitted(type, method_name, scope)
+          members = type.is_a?(Type::Union) ? type.members : [type]
+          kept = members.reject { |member| lacks_method?(member, method_name, scope) }
+          return type if kept.size == members.size
+          return Type::Combinator.union(*kept) unless kept.empty?
+          return Type::Combinator.bot if members.all? { |member| literal_carrier?(member) }
 
-          [scope.public_send(writer, node.receiver.name, non_nil), scope]
+          Type::Combinator.untyped
+        end
+
+        LITERAL_CARRIERS = [Type::Constant, Type::Tuple, Type::HashShape, Type::Singleton].freeze
+        private_constant :LITERAL_CARRIERS
+
+        def literal_carrier?(member)
+          LITERAL_CARRIERS.any? { |carrier| member.is_a?(carrier) } ||
+            (member.is_a?(Type::Nominal) && VALUE_PINNED_CLASSES.include?(member.class_name))
+        end
+
+        # True only when every class `member` dispatches through is declared in RBS, is not a mixin module or
+        # `Object` / `BasicObject` (whose instances may be of any class), is not a plugin's open receiver, and
+        # neither its signature nor the project defines `method_name` on it.
+        def lacks_method?(member, method_name, scope)
+          targets = ProjectMethodOwnership.targets(member)
+          return false if targets.nil? || targets.empty?
+
+          targets.all? { |class_name, kind| class_lacks_method?(class_name, method_name, kind, scope) }
+        end
+
+        OPEN_SURFACE_CLASSES = %w[Object BasicObject].freeze
+        private_constant :OPEN_SURFACE_CLASSES
+
+        def class_lacks_method?(class_name, method_name, kind, scope)
+          return false if kind == :instance && OPEN_SURFACE_CLASSES.include?(class_name)
+          return false unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
+          return false if kind == :instance && scope.environment.rbs_module?(class_name)
+          return false if scope.environment.plugin_registry&.open_receiver?(class_name)
+          return false if ProjectMethodOwnership.defines?(class_name, method_name, kind, scope)
+
+          ExternalAncestorResolution.method_definition(class_name, method_name, kind, scope: scope).nil?
         end
 
         # True when `nil` responds to `sym` — i.e. `NilClass` (own, inherited
@@ -1359,13 +1656,17 @@ module Rigor
         # `String`; every other numbered group present in the pattern stays `String | nil` on
         # both edges (a truthy match leaves an optional group nil at runtime), so we do not
         # narrow it on the truthy edge.
+        #
+        # Both edges start from `scope` with the match globals forgotten (#1385): the match rebinds every one of them,
+        # so a `$N` an earlier match narrowed says nothing here. Without that, a `when /(x)/` arm, or the right operand
+        # of `s =~ /(a)(b)(c)/ && t =~ /(x)/`, kept `$2` and `$3` narrowed to `String` where Ruby reads nil.
         def regex_match_predicate_scopes(scope, unconditional)
           string_t = Type::Combinator.nominal_of("String")
           match_data_t = Type::Combinator.nominal_of("MatchData")
           nil_t = Type::Combinator.constant_of(nil)
 
-          truthy = scope
-          falsey = scope
+          truthy = scope.forget_match_globals
+          falsey = truthy
           truthy = truthy.with_global(:$~, match_data_t)
           falsey = falsey.with_global(:$~, nil_t)
           REGEX_MATCH_GLOBALS.each do |name|
@@ -1399,8 +1700,10 @@ module Rigor
         # them to non-nil `String` would be unsound. The walker is intentionally light (char
         # scan, not a regex-AST parse): backslash escapes are skipped; `(?:…)`, lookahead
         # `(?=…)`/`(?!…)`, and lookbehind `(?<=…)`/`(?<!…)` do not capture; named groups
-        # `(?<name>…)` do. Conservatism is one-directional — when in doubt a group is treated
-        # as conditional (dropped from the Set), never the reverse.
+        # `(?<name>…)` / `(?'name'…)` do. Once the pattern has a named group, Ruby numbers only
+        # the named groups and a plain `(…)` does not capture (#1471): `/(?<x>a)(b)/` has one
+        # group, so `$2` is nil. Conservatism is one-directional — when in doubt a group is
+        # treated as conditional (dropped from the Set), never the reverse.
         def unconditional_capture_groups(source)
           # `unconditional` collects every capturing index; a group is later removed (with its
           # whole subtree) when it is optionally quantified, nested under an optional ancestor,
@@ -1410,7 +1713,15 @@ module Rigor
           # mutually exclusive, so its descendant captures may be absent on a successful match;
           # the group itself still participates. Closing a frame rolls its subtree up to the
           # parent so an optional / alternated ancestor disqualifies it.
-          state = { unconditional: Set.new, stack: [[nil, [], false]], group_index: 0 }
+          state = { unconditional: Set.new, stack: [[nil, [], false]], group_index: 0, named: named_groups?(source) }
+          each_structural_char(source) { |pos, chr| scan_group_char(source, pos, chr, state) }
+          # Drain the virtual root: a top-level `|` disqualifies all.
+          finalize_frame(state, state[:stack].pop, optional: false)
+          state[:unconditional]
+        end
+
+        # Yields each position of `source` outside a backslash escape and a character class, with its char.
+        def each_structural_char(source)
           pos = 0
           length = source.length
           while pos < length
@@ -1423,12 +1734,13 @@ module Rigor
               pos = skip_char_class(source, pos) + 1
               next
             end
-            scan_group_char(source, pos, chr, state)
+            yield pos, chr
             pos += 1
           end
-          # Drain the virtual root: a top-level `|` disqualifies all.
-          finalize_frame(state, state[:stack].pop, optional: false)
-          state[:unconditional]
+        end
+
+        def named_groups?(source)
+          each_structural_char(source) { |pos, chr| break true if chr == "(" && named_group?(source, pos) } == true
         end
 
         # Updates the walk `state` at a group-relevant char during
@@ -1438,7 +1750,7 @@ module Rigor
           case chr
           when "("
             idx = nil
-            if capturing_group?(source, pos)
+            if capturing_group?(source, pos, named: state[:named])
               idx = (state[:group_index] += 1)
               state[:unconditional] << idx
             end
@@ -1477,11 +1789,20 @@ module Rigor
           end
         end
 
-        def capturing_group?(source, pos)
-          return true unless source[pos + 1] == "?"
+        # A plain `(…)` captures unless the pattern has a named group (`named:`); of the `(?…)` forms only a named
+        # group does.
+        def capturing_group?(source, pos, named:)
+          return !named unless source[pos + 1] == "?"
+
+          named_group?(source, pos)
+        end
+
+        # `(?<name>…)` and `(?'name'…)` are named groups; `(?<=…)`/`(?<!…)` (lookbehind) and
+        # `(?:…)`/`(?=…)`/`(?!…)` are not.
+        def named_group?(source, pos)
+          return false unless source[pos + 1] == "?"
+          return true if source[pos + 2] == "'"
 
-          # `(?<name>…)` captures; `(?<=…)`/`(?<!…)` (lookbehind) and
-          # `(?:…)`/`(?=…)`/`(?!…)` do not.
           source[pos + 2] == "<" && source[pos + 3] != "=" && source[pos + 3] != "!"
         end
 
@@ -1551,19 +1872,41 @@ module Rigor
           return nil unless node.arguments.arguments.size == 2
 
           low, high = node.arguments.arguments
-          return nil unless low.is_a?(Prism::IntegerNode) && high.is_a?(Prism::IntegerNode)
+          return nil unless numeric_literal_node?(low) && numeric_literal_node?(high)
 
           local_name = node.receiver.name
           current = scope.local(local_name)
           return nil if current.nil?
 
-          truthy = narrow_integer_comparison(
-            narrow_integer_comparison(current, :>=, low.value),
+          # Truthy edge only, for Integer and Float members alike (ADR-109 WD5): a Float literal
+          # bound leaves the Integer members untouched, and vice versa.
+          truthy = narrow_numeric_comparison_truthy(
+            narrow_numeric_comparison_truthy(current, :>=, low.value),
             :<=, high.value
           )
           [scope.with_local(local_name, truthy), scope]
         end
 
+        # `x.nan?` / `x.finite?` (ADR-109 WD5). `nan?` narrows the FALSY edge to the non-NaN Floats
+        # and leaves the truthy edge alone (NaN is not a carrier); `finite?` narrows the TRUTHY
+        # edge to the finite Floats and leaves the falsy edge alone (it admits NaN and ±∞). A
+        # non-Float member is untouched on both edges.
+        def analyse_float_class_predicate(node, scope, predicate)
+          return nil unless argument_free?(node)
+          return nil unless node.receiver.is_a?(Prism::LocalVariableReadNode)
+
+          local_name = node.receiver.name
+          current = scope.local(local_name)
+          return nil if current.nil?
+
+          case predicate
+          when :nan?
+            [scope, scope.with_local(local_name, narrow_float_to_range(current, Type::Combinator.non_nan_float))]
+          when :finite?
+            [scope.with_local(local_name, narrow_float_to_range(current, Type::Combinator.finite_float)), scope]
+          end
+        end
+
         # Helper for {.narrow_integer_not_equal}. Only adjusts when the value sits exactly on
         # one endpoint, so the result stays contiguous; otherwise the input range is preserved.
         def narrow_integer_range_not_equal(range, value)
@@ -1628,20 +1971,96 @@ module Rigor
           current = scope.local(local_name)
           return nil if current.nil?
 
-          truthy = narrow_integer_comparison(current, normalised_op, bound)
+          # ADR-109 WD5 — the Float rule runs on the truthy edge only: the falsy edge of `x > c`
+          # admits NaN, so its Float-rooted members keep the entry type (the Integer rule below
+          # leaves them untouched by construction).
+          truthy = narrow_numeric_comparison_truthy(current, normalised_op, bound)
           falsey = narrow_integer_comparison(current, INVERT_COMPARISON_OP[normalised_op], bound)
           [scope.with_local(local_name, truthy), scope.with_local(local_name, falsey)]
         end
 
+        # An Integer or Float literal. Prism folds a leading minus into the literal, so `-1.5` is one
+        # `FloatNode`.
+        def numeric_literal_node?(node)
+          node.is_a?(Prism::IntegerNode) || node.is_a?(Prism::FloatNode)
+        end
+
         def comparison_local_literal(left, right, comparator)
-          if left.is_a?(Prism::LocalVariableReadNode) && right.is_a?(Prism::IntegerNode)
+          if left.is_a?(Prism::LocalVariableReadNode) && numeric_literal_node?(right)
             return [left.name, comparator, right.value]
           end
-          return nil unless right.is_a?(Prism::LocalVariableReadNode) && left.is_a?(Prism::IntegerNode)
+          return nil unless right.is_a?(Prism::LocalVariableReadNode) && numeric_literal_node?(left)
 
           [right.name, REVERSE_COMPARISON_OP[comparator], left.value]
         end
 
+        def narrow_float_comparison_dispatch(type, comparator, bound)
+          case type
+          when Type::Constant
+            # A non-Float constant belongs to another rule and is never dropped here. The test is
+            # the positive comparison, negated once: NaN fails every comparison, which is Ruby's
+            # answer too, and rewriting `!(v < c)` as `v >= c` would silently let NaN through.
+            return type unless type.value.is_a?(Float)
+
+            float_constant_satisfies?(type.value, comparator, bound) ? type : Type::Combinator.bot
+          when Type::FloatRange
+            lo, hi, hi_exclusive = float_comparison_half_line(comparator, bound)
+            intersect_float_bounds(type, lo, hi, hi_exclusive)
+          when Type::Nominal
+            return type unless float_nominal?(type)
+
+            lo, hi, hi_exclusive = float_comparison_half_line(comparator, bound)
+            intersect_float_bounds(Type::Combinator.non_nan_float, lo, hi, hi_exclusive)
+          when Type::Union
+            Type::Combinator.union(
+              *type.members.map { |m| narrow_float_comparison_dispatch(m, comparator, bound) }
+            )
+          else
+            type
+          end
+        end
+
+        def float_nominal?(nominal)
+          nominal.class_name == "Float" && nominal.type_args.empty?
+        end
+
+        def float_constant_satisfies?(value, comparator, bound)
+          case comparator
+          when :<  then value < bound
+          when :<= then value <= bound
+          when :>  then value > bound
+          when :>= then value >= bound
+          end
+        end
+
+        # `[lo, hi]` with `hi` exclusive or not: `x < c` is `[-∞, c)`, `x <= c` is `[-∞, c]`, and both
+        # `x > c` and `x >= c` are the closed envelope `[c, ∞]` (WD5).
+        def float_comparison_half_line(comparator, bound)
+          case comparator
+          when :<  then [-Float::INFINITY, bound, true]
+          when :<= then [-Float::INFINITY, bound, false]
+          else          [bound, Float::INFINITY, false]
+          end
+        end
+
+        # Intersects `range` with `[lo, hi]` (`hi` exclusive when `hi_exclusive`), keeping whichever
+        # upper bound is tighter on the canonical closed form together with its own exclusivity, so
+        # `Float[0.0...1.0] ∩ [-∞, 2.0]` still displays `Float[0.0...1.0]`. Empty is `Bot`.
+        def intersect_float_bounds(range, lower, upper, upper_exclusive)
+          new_min = [range.min, lower].max
+          half_canonical_max = upper_exclusive ? upper.prev_float : upper
+          if half_canonical_max < range.canonical_max
+            new_max = upper
+            exclusive = upper_exclusive
+          else
+            new_max = range.max
+            exclusive = range.exclude_end?
+          end
+          return Type::Combinator.bot if new_min > (exclusive ? new_max.prev_float : new_max)
+
+          Type::Combinator.float_range(new_min, new_max, exclude_end: exclusive)
+        end
+
         def narrow_integer_equal_dispatch(type, value)
           case type
           when Type::Constant then narrow_integer_equal_constant(type, value)
@@ -1814,9 +2233,30 @@ module Rigor
             analyse_class_predicate_on_local(node, scope, class_name, exact)
           when Prism::CallNode
             analyse_class_predicate_on_chain(node, scope, class_name, exact)
+          else
+            analyse_class_predicate_on_slot(node.receiver, scope, class_name, exact)
           end
         end
 
+        # Issue #1429 — `$stdout.is_a?(StringIO)`, `STDOUT.kind_of?(StringIO)`: a global or constant receiver
+        # narrows as a local does ({#class_predicate_scopes}), with the pre-guard type recorded ({#narrow_slot}).
+        def analyse_class_predicate_on_slot(receiver, scope, class_name, exact)
+          slot = receiver_slot(receiver, scope, kinds: GLOBAL_AND_CONSTANT)
+          return nil if slot.nil?
+
+          class_slot_scopes(scope, slot, class_name, exact: exact)
+        end
+
+        def class_slot_scopes(scope, slot, class_name, exact:)
+          environment = scope.environment
+          truthy = narrow_class(slot.current, class_name, exact: exact, environment: environment, scope: scope)
+          [
+            narrow_slot(scope, slot, truthy),
+            narrow_slot(scope, slot, narrow_not_class(slot.current, class_name, exact: exact,
+                                                                                environment: environment, scope: scope))
+          ]
+        end
+
         # The class name a `is_a?` / `kind_of?` / `instance_of?` argument denotes: the top-level
         # `bare_name` when the reference is written `::Foo` (nil when nothing declares it there),
         # the lexical resolution otherwise.
@@ -1854,8 +2294,10 @@ module Rigor
           current = scope.type_of(node.receiver)
           return nil if current.nil?
 
-          truthy_type = narrow_class(current, class_name, exact: exact, environment: scope.environment)
-          falsey_type = narrow_not_class(current, class_name, exact: exact, environment: scope.environment)
+          truthy_type = narrow_class(current, class_name, exact: exact, environment: scope.environment,
+                                                          scope: scope)
+          falsey_type = narrow_not_class(current, class_name, exact: exact, environment: scope.environment,
+                                                              scope: scope)
 
           [
             scope.with_method_chain_narrowing(*address, truthy_type),
@@ -1907,13 +2349,25 @@ module Rigor
         # shapes at once. Because the repair lives in the shared derivation, `is_a?`, `case`/`when`, `===`
         # and the constant typer were fixed together rather than one guard shape at a time. A scope no
         # declaration walk built still falls back to the peel; see {Reflection.lexical_nesting_chain}.
+        #
+        # A path whose head and tail have DIFFERENT owners is the one shape no `<prefix>::<full path>`
+        # candidate can name (#656), so the whole-path loop falls through to the segment-wise walk
+        # before it gives up: `A::B` guarded inside `P::Guard` with `P::A < P::Base` is `P::Base::B`,
+        # which the loop above only ever reached as the top-level `A::B` — a real but different class,
+        # and every reader call on the narrowed receiver was then checked against it. The walk is
+        # {Reflection.resolve_constant_path_name}, shared with the constant typer so the guard and the
+        # value it guards cannot name two classes, and it takes this scope's acceptance test so a
+        # candidate is still adopted only when the environment or discovery knows it as a class.
         def resolve_class_name_lexically(bare_name, scope)
           chain = lexical_nesting_for(scope)
           chain.each do |prefix|
             candidate = "#{prefix}::#{bare_name}"
             return candidate if class_known_to_scope?(scope, candidate)
           end
-          bare_name
+          walked = Reflection.resolve_constant_path_name(bare_name, scope) do |candidate|
+            class_known_to_scope?(scope, candidate)
+          end
+          walked || bare_name
         end
 
         # Combines the environment's RBS-known set with the scope's in-source
@@ -1934,16 +2388,8 @@ module Rigor
         end
 
         def class_predicate_scopes(scope, name, current, class_name, exact:)
-          [
-            scope.with_local(
-              name,
-              narrow_class(current, class_name, exact: exact, environment: scope.environment)
-            ),
-            scope.with_local(
-              name,
-              narrow_not_class(current, class_name, exact: exact, environment: scope.environment)
-            )
-          ]
+          slot = ReceiverSlot.new(kind: :local, name: name, current: current)
+          class_slot_scopes(scope, slot, class_name, exact: exact)
         end
 
         # Slice 7 phase 4 — `===`-narrowing. The case-equality predicate `<receiver> === local`
@@ -1977,9 +2423,23 @@ module Rigor
             analyse_case_equality_receiver(node.receiver, scope, arg.name, current)
           when Prism::CallNode
             analyse_case_equality_on_chain(node.receiver, arg, scope)
+          else
+            analyse_case_equality_on_slot(node.receiver, arg, scope)
           end
         end
 
+        # Issue #1429 — `StringIO === $stdout`, `StringIO === STDOUT`: the class-constant receiver form on a global or
+        # constant argument. The Range / Regexp receivers stay local-only.
+        def analyse_case_equality_on_slot(receiver, arg, scope)
+          class_name = lexical_class_name(receiver, scope)
+          return nil if class_name.nil?
+
+          slot = receiver_slot(arg, scope, kinds: GLOBAL_AND_CONSTANT)
+          return nil if slot.nil?
+
+          class_slot_scopes(scope, slot, class_name, exact: false)
+        end
+
         # `Class === <local/ivar>.<method>` — the case-equality counterpart of
         # {.analyse_class_predicate_on_chain}. The `open3` idiom `if Hash === cmd.last` narrows
         # `cmd.last` to the class inside the branch, recorded as a single-hop method-chain
@@ -1996,8 +2456,10 @@ module Rigor
           current = scope.type_of(chain_arg)
           return nil if current.nil?
 
-          truthy_type = narrow_class(current, class_name, exact: false, environment: scope.environment)
-          falsey_type = narrow_not_class(current, class_name, exact: false, environment: scope.environment)
+          truthy_type = narrow_class(current, class_name, exact: false, environment: scope.environment,
+                                                          scope: scope)
+          falsey_type = narrow_not_class(current, class_name, exact: false, environment: scope.environment,
+                                                              scope: scope)
           [
             scope.with_method_chain_narrowing(*address, truthy_type),
             scope.with_method_chain_narrowing(*address, falsey_type)
@@ -2012,7 +2474,8 @@ module Rigor
           target_class = case_equality_target_class(receiver)
           return nil if target_class.nil?
 
-          narrowed = narrow_class(current, target_class, exact: false, environment: scope.environment)
+          narrowed = narrow_class(current, target_class, exact: false, environment: scope.environment,
+                                                         scope: scope)
           [
             scope.with_local(local_name, narrowed),
             scope.with_local(local_name, current)
@@ -2195,6 +2658,10 @@ module Rigor
         # that position, or nil when the overload shape does not allow a precise match.
         def lookup_positional_arg(call_node, method_def, target_name)
           arguments = call_node.arguments&.arguments || []
+          # A `(?)` overload (`RBS::Types::UntypedFunction`, #1430) names no parameter and accepts any argument list,
+          # so a call may reach it with the target's position holding anything: no overload proves the target.
+          return nil unless method_def.method_types.all? { |mt| mt.type.respond_to?(:required_positionals) }
+
           method_def.method_types.each do |mt|
             params = mt.type.required_positionals + mt.type.optional_positionals
             index = params.find_index { |param| param.name == target_name }
@@ -2210,7 +2677,9 @@ module Rigor
         # cannot statically classify are treated as "no narrowing": the body falls back to the
         # union of what we did learn (or the entry type when nothing learned), and the falsey
         # edge is the entry type (because we cannot prove the unknown condition didn't match).
-        def accumulate_case_when_scopes(scope, local_name, current, conditions)
+        #
+        # `[body type, next-clause type]` of a `when` clause's conditions over the subject type `current`.
+        def case_when_types(scope, current, conditions)
           truthy_members = []
           falsey_type = current
           fully_narrowable = true
@@ -2227,10 +2696,7 @@ module Rigor
           end
 
           truthy = truthy_members.empty? ? current : Type::Combinator.union(*truthy_members)
-          [
-            scope.with_local(local_name, truthy),
-            scope.with_local(local_name, fully_narrowable ? falsey_type : current)
-          ]
+          [truthy, fully_narrowable ? falsey_type : current]
         end
 
         # Per-condition rule. Returns `nil` when the condition shape is not recognised (caller
@@ -2283,8 +2749,9 @@ module Rigor
 
         def class_when_result(scope, current, target, falsey_acc)
           {
-            truthy: narrow_class(current, target, exact: false, environment: scope.environment),
-            falsey: narrow_not_class(falsey_acc, target, exact: false, environment: scope.environment),
+            truthy: narrow_class(current, target, exact: false, environment: scope.environment, scope: scope),
+            falsey: narrow_not_class(falsey_acc, target, exact: false, environment: scope.environment,
+                                                         scope: scope),
             fully_narrowable: true
           }
         end
@@ -2368,6 +2835,11 @@ module Rigor
         # through {#rooted_class_predicate_name}, which layers #614's extra decline on top of the
         # same walk. A rooted `::Foo` names the top level and never a lexically nearer shadow, so
         # it keeps the un-walked spelling. nil for any non-constant shape, as before.
+        #
+        # PUBLIC, alone among the helpers in this block (#655): `case`/`when`'s VALUE side lives in
+        # `ExpressionTyper` and matched on the as-written spelling, so the two halves of one `case`
+        # disagreed — the flow side narrowed through this walk while the value side resolved the
+        # pattern against whatever the environment knew under that literal name.
         def lexical_class_name(node, scope)
           bare_name = static_class_name(node)
           return nil if bare_name.nil?
@@ -2375,6 +2847,7 @@ module Rigor
 
           resolve_class_name_lexically(bare_name, scope)
         end
+        public :lexical_class_name
 
         # ----- narrow_class / narrow_not_class helpers -----
 
@@ -2437,8 +2910,7 @@ module Rigor
         end
 
         # Issue #657 — `Bot` is the assertion "this can never match", and only a KNOWN-disjoint ordering
-        # supports it. `subclass_of?` folds `:disjoint` and `:unknown` into one `false`, which is safe on
-        # the negative edge (where the pre-state survives) and an over-claim on the positive one:
+        # supports it (the reason {#declines_bot?} exists, and the repro it was written against):
         #
         #   module Taggable; def tag = "t"; end
         #   class Integer; include Taggable; end
@@ -2460,8 +2932,7 @@ module Rigor
         def narrow_constant_to_class(constant, class_name, context)
           rigor_class = constant.value.class.name
           return constant if subclass_of?(rigor_class, class_name, context)
-          return Type::Combinator.untyped if !context.exact &&
-                                             class_ordering(rigor_class, class_name, context) == :unknown
+          return Type::Combinator.untyped if declines_bot?(rigor_class, class_name, context)
 
           Type::Combinator.bot
         end
@@ -2477,9 +2948,12 @@ module Rigor
         # `is_a?(Integer)`) narrow DOWN to `Nominal[class_name]`; otherwise (disjoint
         # hierarchies under `is_a?`, mismatch under `instance_of?`) collapse to `Bot`.
         # Conservative when the analyzer environment cannot resolve either class.
+        #
+        # A disjoint `Bot` narrows the edge but is not always a verdict that the code is dead: see
+        # {.disjoint_nominal_guard?} (issue #1429).
         def narrow_nominal_to_class(nominal, class_name, context)
           return nominal if nominal.class_name == class_name
-          return Type::Combinator.bot if context.exact
+          return exact_nominal_to_class(nominal, class_name, context) if context.exact
 
           case class_ordering(nominal.class_name, class_name, context)
           when :superclass then Type::Combinator.nominal_of(class_name)
@@ -2494,6 +2968,17 @@ module Rigor
           end
         end
 
+        # `instance_of?(class_name)` compares the exact class, so its truthy edge holds `class_name` itself. Issue
+        # #1429: when `class_name` is a class below the nominal's (`Numeric` under `instance_of?(Integer)`), that is
+        # the edge's type; the edge was `Bot` before, for every class but the nominal's own. A module is never an
+        # object's class, and any other ordering leaves no class the object can have, so those stay `Bot`.
+        def exact_nominal_to_class(nominal, class_name, context)
+          return Type::Combinator.bot if context.environment.rbs_module?(class_name)
+          return Type::Combinator.bot unless class_ordering(nominal.class_name, class_name, context) == :superclass
+
+          Type::Combinator.nominal_of(class_name)
+        end
+
         def narrow_nominal_not_class(nominal, class_name, context)
           return Type::Combinator.bot if nominal.class_name == class_name
           return nominal if context.exact
@@ -2505,8 +2990,14 @@ module Rigor
           end
         end
 
+        # A shape projects to `Array` / `Hash`, and reopening either of those to include a project module
+        # leaves the ordering `:unknown` for the same reason #657's `Integer` does — so `[1, 2]` under `when
+        # Taggable` reached the same unsupported `Bot`. The carrier differs; the missing evidence does not.
         def narrow_shape_to_class(shape, projected_class, class_name, context)
-          subclass_of?(projected_class, class_name, context) ? shape : Type::Combinator.bot
+          return shape if subclass_of?(projected_class, class_name, context)
+          return Type::Combinator.untyped if declines_bot?(projected_class, class_name, context)
+
+          Type::Combinator.bot
         end
 
         def narrow_shape_not_class(shape, projected_class, class_name, context)
@@ -2517,8 +3008,69 @@ module Rigor
         # subclass of `Module`). Asking `Foo.is_a?(Class)` returns true; `Foo.is_a?(Foo)`
         # returns false unless `Foo` is `Class` itself. We approximate this by treating
         # singletons uniformly as `Class` instances.
+        #
+        # The approximation answers through `Class`, so a target `Class` cannot be ordered against — a
+        # project module, typically — lands on the same `:unknown` #657 collapsed to `Bot`, and `case Widget
+        # when Meta` was reported unreachable where `Widget` had `extend Meta`.
+        #
+        # Issue #898 — that decline is silent about a target the environment DOES order against `Class`, and
+        # `extend Comparable` is one: both names are in RBS, neither includes the other, so the ordering says
+        # `:disjoint` and the collapse fired on an arm MRI takes (`Widget.is_a?(Comparable)` is true — the
+        # `extend` put `Comparable` in `Widget`'s SINGLETON ancestry, which asking about `Class` cannot see).
+        # {#singleton_extend_declines_bot?} supplies the missing half from the project's own `extend` record.
         def narrow_singleton_to_class(singleton, class_name, context)
-          subclass_of?("Class", class_name, context) ? singleton : Type::Combinator.bot
+          return singleton if subclass_of?("Class", class_name, context)
+          return Type::Combinator.untyped if declines_bot?("Class", class_name, context)
+          return Type::Combinator.untyped if singleton_extend_declines_bot?(singleton, class_name, context)
+
+          Type::Combinator.bot
+        end
+
+        # Whether the class object's own `extend` record forbids the `Bot` the `Class` approximation would
+        # otherwise authorise (#898). An extended `M` puts every ancestor of `M` in the singleton's
+        # ancestry, so the question per extended module is `M <= target`: `:equal` (`extend Comparable`
+        # under `when Comparable`) and `:subclass` support the arm, and `:unknown` (`extend Meta` under
+        # `when Comparable`, `Meta` being project source the environment never joined to RBS) cannot rule
+        # it out. `:superclass` and `:disjoint` support NOTHING and must keep the collapse — `Integer`
+        # under `when Integer` orders `:superclass` against an extended `Comparable`, and reading that as
+        # support would retract `case Widget when Integer` from every class that extends a core module.
+        #
+        # The answer is `Dynamic[top]`, never the preserved `Singleton[C]`, and the negative edge
+        # ({#narrow_singleton_not_class}) is untouched — so this record is read ONLY to withhold a claim,
+        # never to make one. That asymmetry is deliberate, and it is what keeps the fix honest against an
+        # extend record that is structurally incomplete: `Widget.extend(m)` at a call site and an `extend`
+        # written in a file outside the analysed set are both invisible to the walk behind
+        # {Scope#singleton_extends_of}, and the declaration-side record joined to it below is no more
+        # complete — RBS says nothing about a class it does not declare. A shape that turned this table into a positive
+        # `:subclass` verdict would have to be right about ABSENCE too, and it cannot be. Preserving
+        # `Singleton[C]` would also hand the arm a receiver whose singleton method table has no `clamp` on
+        # it, trading the unreachable-clause false positive for an undefined-method one — the same trap
+        # #657 recorded on the `Constant` carrier.
+        #
+        # Issue #915 — two sources, read as one. The source record above sees only what Ruby source spells;
+        # a project that declares `extend M` in its own `sig/` puts the same module in the same singleton
+        # ancestry, and the environment's declaration-side answer
+        # ({Environment#singleton_extended_modules}) is consulted alongside it. Neither is asked to be
+        # complete; each can only add a module that IS there, which is all the one-directional read needs.
+        def singleton_extend_declines_bot?(singleton, class_name, context)
+          return false if context.exact
+
+          extended = singleton_ancestor_modules(singleton, context)
+          return false if extended.empty?
+
+          extended.any? do |module_name|
+            %i[equal subclass unknown].include?(class_ordering(module_name, class_name, context))
+          end
+        end
+
+        def singleton_ancestor_modules(singleton, context)
+          scope = context.scope
+          from_source = scope.nil? ? [] : scope.singleton_extends_of(singleton.class_name)
+          from_rbs = context.environment&.singleton_extended_modules(singleton.class_name) || []
+          return from_source if from_rbs.empty?
+          return from_rbs if from_source.empty?
+
+          from_source | from_rbs
         end
 
         def narrow_singleton_not_class(singleton, class_name, context)
@@ -2534,6 +3086,22 @@ module Rigor
           end
         end
 
+        # Whether the positive edge must decline the `Bot` that `subclass_of?` returning false would
+        # otherwise authorise (#657). `subclass_of?` folds `:disjoint` and `:unknown` into one `false`, and
+        # only the first is evidence that the guard can never match; the second is the environment saying it
+        # cannot tell, which any file reopening either side can make true.
+        #
+        # This only ever ADDS a decline: every caller keeps its own `subclass_of?` test first, so the
+        # preserving edge is untouched, and a `:disjoint`, `:equal`, `:subclass` or `:superclass` verdict
+        # never reaches here. There is no ordering it turns INTO a match — the honest answer for
+        # "cannot tell" is Dynamic, never the asked class.
+        #
+        # `instance_of?` is exempt because it compares the exact class: a module is never an object's class,
+        # so that edge's `Bot` rests on the guard's own semantics rather than on the ordering.
+        def declines_bot?(rigor_class_name, target_class_name, context)
+          !context.exact && class_ordering(rigor_class_name, target_class_name, context) == :unknown
+        end
+
         # Returns `true` when an instance of `rigor_class_name` satisfies
         # `is_a?(target_class_name)` (or `instance_of?(target_class_name)` when `exact: true`).
         # Falls back to the safe `false` when either name does not resolve through the analyzer
@@ -2555,25 +3123,15 @@ module Rigor
           context.environment.class_ordering(lhs, rhs)
         end
 
+        # `x.nil?` on a local, instance variable, global or constant (#1429) read.
         def analyse_nil_predicate(receiver, scope)
-          case receiver
-          when Prism::LocalVariableReadNode
-            current = scope.local(receiver.name)
-            return nil if current.nil?
-
-            [
-              scope.with_local(receiver.name, narrow_nil(current)),
-              scope.with_local(receiver.name, narrow_non_nil(current))
-            ]
-          when Prism::InstanceVariableReadNode
-            current = scope.ivar(receiver.name)
-            return nil if current.nil?
+          slot = receiver_slot(receiver, scope)
+          return nil if slot.nil?
 
-            [
-              scope.with_ivar(receiver.name, narrow_nil(current)),
-              scope.with_ivar(receiver.name, narrow_non_nil(current))
-            ]
-          end
+          [
+            narrow_slot(scope, slot, narrow_nil(slot.current)),
+            narrow_slot(scope, slot, narrow_non_nil(slot.current))
+          ]
         end
 
         # The three value-pinned classes a union arm can name whose instances are the single
@@ -2692,21 +3250,39 @@ module Rigor
         def analyse_safe_nav_receiver(node, scope)
           return nil unless node.safe_navigation?
 
-          receiver = node.receiver
-          reader, writer =
-            case receiver
-            when Prism::LocalVariableReadNode then %i[local with_local]
-            when Prism::InstanceVariableReadNode then %i[ivar with_ivar]
-            else return nil
-            end
+          narrowed = non_nil_slot_scope(node.receiver, scope)
+          narrowed && [narrowed, scope]
+        end
 
-          current = scope.public_send(reader, receiver.name)
-          return nil if current.nil?
+        # `scope` with the receiver `node` reads (a local, instance variable, global or constant, #1429) narrowed to
+        # its non-nil fragment, or nil when there is no such receiver or it holds no `nil` to remove.
+        def non_nil_slot_scope(node, scope)
+          slot = receiver_slot(node, scope)
+          return nil if slot.nil?
 
-          non_nil = narrow_non_nil(current)
-          return nil if non_nil.equal?(current)
+          non_nil = narrow_non_nil(slot.current)
+          return nil if non_nil.equal?(slot.current)
 
-          [scope.public_send(writer, receiver.name, non_nil), scope]
+          narrow_slot(scope, slot, non_nil)
+        end
+
+        # The scope {.safe_navigation_scope} answers for a receiver, seen through the `&.` links of a chain whose
+        # operands leave the root's binding alone, or nil. Unlike {.non_nil_slot_scope} it compares the fragment
+        # structurally: `narrow_non_nil` rebuilds a union it removed nothing from, and a receiver that cannot be nil
+        # must leave the call's operands on the scope they are typed from.
+        def non_nil_receiver_scope(node, scope)
+          if node.is_a?(Prism::CallNode)
+            return nil unless node.safe_navigation?
+            return nil if OperandEffects.any?(node.arguments) || OperandEffects.any?(node.block)
+
+            return non_nil_receiver_scope(node.receiver, scope)
+          end
+
+          slot = receiver_slot(node, scope)
+          return nil if slot.nil?
+
+          non_nil = narrow_non_nil(slot.current)
+          non_nil == slot.current ? nil : narrow_slot(scope, slot, non_nil)
         end
 
         # Issue #606 slice 1 — the SAFE-NAV CHAIN forms. {.analyse_safe_nav_receiver} above proves
@@ -2778,12 +3354,17 @@ module Rigor
           return nil if suffixes.empty? && !allow_bare
 
           receiver = current.receiver
-          return nil unless receiver.is_a?(Prism::LocalVariableReadNode) ||
-                            receiver.is_a?(Prism::InstanceVariableReadNode)
+          return nil unless SLOT_READ_NODES.any? { |klass| receiver.is_a?(klass) }
 
           [receiver, suffixes]
         end
 
+        SLOT_READ_NODES = [
+          Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, Prism::GlobalVariableReadNode,
+          Prism::ConstantReadNode, Prism::ConstantPathNode
+        ].freeze
+        private_constant :SLOT_READ_NODES
+
         # Which edge — if either — a chain's outcome narrows on. The inner suffixes (everything
         # below the outermost) only ever have to NOT return, so they are held to the raise test
         # alone; the outermost decides the edge per the table in {NIL_FALSEY_SUFFIXES}'s comment.
@@ -2798,20 +3379,7 @@ module Rigor
         end
 
         def safe_nav_chain_narrowed_scope(receiver, scope)
-          reader, writer =
-            case receiver
-            when Prism::LocalVariableReadNode then %i[local with_local]
-            when Prism::InstanceVariableReadNode then %i[ivar with_ivar]
-            else return nil
-            end
-
-          current = scope.public_send(reader, receiver.name)
-          return nil if current.nil?
-
-          non_nil = narrow_non_nil(current)
-          return nil if non_nil.equal?(current)
-
-          scope.public_send(writer, receiver.name, non_nil)
+          non_nil_slot_scope(receiver, scope)
         end
 
         # Issue #606 slice 1, second form — a safe-nav chain COMPARED to a value that cannot be
@@ -2921,14 +3489,23 @@ module Rigor
           return edges unless node.safe_navigation? && edges
 
           truthy, falsey = edges
-          safe = analyse_safe_nav_receiver(node, scope)
-          return edges unless safe
+          slot = receiver_slot(node.receiver, scope)
+          return edges if slot.nil?
 
-          receiver = node.receiver
-          reader = receiver.is_a?(Prism::InstanceVariableReadNode) ? :ivar : :local
-          non_nil = safe.first.public_send(reader, receiver.name)
-          writer = receiver.is_a?(Prism::InstanceVariableReadNode) ? :with_ivar : :with_local
-          [truthy.public_send(writer, receiver.name, non_nil), falsey]
+          non_nil = narrow_non_nil(slot.current)
+          return edges if non_nil.equal?(slot.current)
+
+          [narrow_slot(truthy, slot, non_nil), falsey]
+        end
+
+        # The predicates composed from other predicates, whose edges are built from their
+        # operands' edges.
+        def analyse_composition(node, scope)
+          case node
+          when Prism::AndNode then analyse_and(node, scope)
+          when Prism::OrNode then analyse_or(node, scope)
+          else analyse_conditional(node, scope)
+          end
         end
 
         # `a && b` short-circuits: the truthy edge is the truthy edge of `b` evaluated under
@@ -2938,7 +3515,7 @@ module Rigor
         # output scopes.
         def analyse_and(node, scope)
           truthy_a, falsey_a = analyse(node.left, scope) || [scope, scope]
-          truthy_b, falsey_b = analyse(node.right, truthy_a) || [truthy_a, truthy_a]
+          truthy_b, falsey_b = operand_edges(node.right, truthy_a)
           [truthy_b, falsey_a.join(falsey_b)]
         end
 
@@ -2947,9 +3524,105 @@ module Rigor
         # falsey scope evaluated under `a`'s falsey scope.
         def analyse_or(node, scope)
           truthy_a, falsey_a = analyse(node.left, scope) || [scope, scope]
-          truthy_b, falsey_b = analyse(node.right, falsey_a) || [falsey_a, falsey_a]
+          truthy_b, falsey_b = operand_edges(node.right, falsey_a)
           [truthy_a.join(truthy_b), falsey_b]
         end
+
+        # The edges of an operand that runs only on one edge of an earlier operand, which is the
+        # step `&&` and `||` both take for their right operand. Issue #1359 — the operand runs after
+        # that edge, so a `$_` the earlier operand narrowed is forgotten when the operand may set it
+        # (`gets && log(items.each { gets })`), before the operand's own edges narrow it again.
+        # Issue #1429 — likewise a guard's narrowing of a global or constant the operand may rebind
+        # (`$sep && reset_sep && $sep.length`).
+        def operand_edges(node, edge_scope)
+          edge_scope = LastLine.forget_if_set(edge_scope, node)
+          if edge_scope.guard_narrowed? && GuardRebinding.may_rebind?(node, edge_scope)
+            edge_scope = edge_scope.forget_guard_narrowings
+          end
+          analyse(node, edge_scope) || [edge_scope, edge_scope]
+        end
+
+        # Issue #1017 — `p ? q : r` (and `if` / `unless` in condition position) is truthy through
+        # `p ∧ q` or `¬p ∧ r` and falsey through `p ∧ ¬q` or `¬p ∧ ¬r`. Each conjunction is the
+        # `&&` step — the arm's edges under the predicate's edge ({#operand_edges}) — and each
+        # disjunction is the `||` merge (`Scope#join`), so `p ? false : q` narrows as `!p && q`
+        # does without a literal-arm rule: an arm whose value is settled contributes only its
+        # live edge ({#settled_edges}). Beyond {CONDITIONAL_GUARD_DEPTH} the guard declines.
+        #
+        # The predicate's own edges are never dropped as settled. `scope` is the scope after the
+        # whole conditional ran, so it has already joined the arms, and a carrier every arm
+        # narrowed has lost its optimistic mark there (`Scope#with_local` drops it): a
+        # `missable.nil?` predicate reads as a proof-looking `false` it is not. An arm is judged
+        # under the predicate's edge instead, where a settled value follows from that edge.
+        def analyse_conditional(node, scope)
+          return nil if conditional_guard_height(node) > CONDITIONAL_GUARD_DEPTH
+
+          predicate, then_arm, else_arm = conditional_parts(node)
+          truthy_p, falsey_p = operand_edges(predicate, scope)
+          truthy_q, falsey_q = settled_edges(then_arm, truthy_p)
+          truthy_r, falsey_r = settled_edges(else_arm, falsey_p)
+          truthy = join_live_edges(truthy_q, truthy_r)
+          falsey = join_live_edges(falsey_q, falsey_r)
+          return nil if truthy.nil? && falsey.nil?
+
+          [truthy || scope, falsey || scope]
+        end
+
+        # `[predicate, arm run when it is truthy, arm run when it is falsey]`. An arm is a body or
+        # `nil` for an absent / empty one; an `elsif` is the nested conditional itself.
+        def conditional_parts(node)
+          if node.is_a?(Prism::UnlessNode)
+            [node.predicate, else_body(node.else_clause), node.statements]
+          else
+            subsequent = node.subsequent
+            [node.predicate, node.statements, subsequent.is_a?(Prism::ElseNode) ? else_body(subsequent) : subsequent]
+          end
+        end
+
+        def else_body(else_node)
+          else_node&.statements
+        end
+
+        # An operand's `[truthy, falsey]` edges with a dead edge as `nil`. An absent arm evaluates
+        # to `nil`, so only its falsey edge is live. Otherwise the edge the operand's type proves
+        # unreachable is dropped — unless that proof rests on an optimistically nil-free lookup
+        # (ADR-101, issue #313), which `branch_certainty` refuses to elide an arm on as well.
+        def settled_edges(node, scope)
+          return [nil, scope] if node.nil?
+
+          truthy, falsey = operand_edges(node, scope)
+          case predicate_certainty(scope.type_of(node))
+          when :truthy then optimistic_operand?(node, scope) ? [truthy, falsey] : [truthy, nil]
+          when :falsey then optimistic_operand?(node, scope) ? [truthy, falsey] : [nil, falsey]
+          else [truthy, falsey]
+          end
+        end
+
+        def optimistic_operand?(node, scope)
+          node = node.body.last while node.is_a?(Prism::StatementsNode) && !node.body.empty?
+          !OptimisticOrigin.resolve(node, scope).nil?
+        end
+
+        def join_live_edges(left, right)
+          return right if left.nil?
+          return left if right.nil?
+
+          left.join(right)
+        end
+
+        # The number of conditionals stacked in `node` along the shapes {.analyse} walks.
+        def conditional_guard_height(node)
+          case node
+          when Prism::IfNode, Prism::UnlessNode
+            1 + conditional_parts(node).map { |part| conditional_guard_height(part) }.max
+          when Prism::ParenthesesNode then conditional_guard_height(node.body)
+          when Prism::StatementsNode then conditional_guard_height(node.body.last)
+          when Prism::AndNode, Prism::OrNode
+            [conditional_guard_height(node.left), conditional_guard_height(node.right)].max
+          when Prism::CallNode then node.name == :! ? conditional_guard_height(node.receiver) : 0
+          else 0
+          end
+        end
       end
     end
   end