rigortype 0.3.9 → 0.4.0

data/lib/rigor/inference/narrowing.rb

@@ -9,6 +9,12 @@ require_relative "../environment"
 require_relative "../rbs_extended"
 require_relative "../analysis/fact_store"
 require_relative "../builtins/regex_refinement"
+require_relative "guard_rebinding"
+require_relative "last_line"
+require_relative "operand_effects"
+require_relative "optimistic_origin"
+require_relative "project_method_ownership"
+require_relative "receiver_alias"
 
 module Rigor
   module Inference
@@ -50,8 +56,27 @@ module Rigor
       # a value-pinned `Constant[Regexp]` share this carrier so the participation walk and the
       # extended-mode bail read one shape.
       RegexMatchPattern = Data.define(:source, :extended)
+      # Issue #1429 — a predicate receiver whose binding an edge can narrow ({.receiver_slot}): a local, an instance
+      # variable or a global (`name` its Symbol), or a constant reference (`name` its {.constant_key}). `current` is
+      # the type the receiver reads before the predicate, a global's read type when the scope does not bind it.
+      ReceiverSlot = Data.define(:kind, :name, :current)
+      # The globals a guard narrows without a record ({Scope#with_guarded_global}): `$_` and `$~` live in the frame's
+      # special-variable slot, which a called method does not reach and their own machinery forgets
+      # (`Scope#forget_last_line`, `Scope#forget_match_globals`), and `$!` / `$@` read the rescue clause that is
+      # running, which a call that returns leaves as it was.
+      UNRECORDED_GUARD_GLOBALS = %i[$_ $~ $! $@].freeze
+      # Issue #1429 — the value-pinned classes: a `Nominal` of one of them is the single value itself, which no
+      # program replaces with another class's instance, so it counts with the literal carriers
+      # ({.disjoint_nominal_guard?}, `respond_to?`'s edge).
+      VALUE_PINNED_CLASSES = %w[NilClass TrueClass FalseClass].freeze
       private_constant :TRUSTED_EQUALITY_LITERAL_CLASSES, :SINGLETON_LITERAL_CLASSES, :ClassNarrowingContext,
-                       :RegexMatchPattern
+                       :RegexMatchPattern, :ReceiverSlot, :UNRECORDED_GUARD_GLOBALS, :VALUE_PINNED_CLASSES
+
+      # Issue #1017 — the tallest stack of conditionals a condition may carry and still contribute facts. A
+      # conditional guard analyses its predicate and both arms, so each level can triple the analysis; past this
+      # height the guard declines to "no narrowing". Height counts conditionals reached through the shapes the
+      # analyser walks (parentheses, a body's last statement, `&&` / `||`, `!`, a predicate, an arm).
+      CONDITIONAL_GUARD_DEPTH = 2
 
       module_function
 
@@ -120,10 +145,9 @@ module Rigor
       # falsey fragments above: `:truthy` when no inhabitant is falsey (the falsey fragment is
       # `Bot`), `:falsey` when no inhabitant is truthy, nil when both fragments are inhabited —
       # or when the type itself is nil / `Bot` (dead code is not a certainty claim). This is the
-      # single owner of the judgment both branch-elision consumers read
-      # (`ExpressionTyper#elide_or_union` on the value side, `StatementEvaluator#live_branch_for_if`
-      # on the scope side), so the type a dead branch is elided from and the scope that stops
-      # flowing through it can never disagree.
+      # single owner of the judgment branch elision reads (`StatementEvaluator#live_branch_for_if`,
+      # which a value-position conditional reaches too since issue #1003), so the type a dead
+      # branch is elided from and the scope that stops flowing through it can never disagree.
       def predicate_certainty(type)
         return nil if type.nil? || type.is_a?(Type::Bot)
 
@@ -320,6 +344,22 @@ module Rigor
         narrow_class_dispatch(type, class_name, context)
       end
 
+      # Issue #1429 — true when `type` holds a member whose `Bot` under `is_a?(class_name)` rests only on Rigor's
+      # reading of its type: a `Nominal`, other than the value-pinned `nil` / `true` / `false` classes, whose class
+      # the environment orders `:disjoint` from `class_name`. A `Nominal` is a type Rigor inferred or read from a
+      # signature, and a program can hold another object there: `$stdout` is typed `IO`, and a test runs it with a
+      # `StringIO`, which is not an `IO` subclass. The narrowing still reads such a guard's edge as `Bot`, so the
+      # arm is not checked; what this answers is whether the `Bot` may stand as a verdict that the code is dead
+      # (`flow.unreachable-clause`). The carriers that record what the file literally shows (`Constant`, `Tuple`,
+      # `HashShape`, `Singleton`) and the value-pinned classes do not count, so their verdicts stand.
+      def disjoint_nominal_guard?(type, class_name, environment: Environment.default)
+        members = type.is_a?(Type::Union) ? type.members : [type]
+        members.any? do |member|
+          member.is_a?(Type::Nominal) && !VALUE_PINNED_CLASSES.include?(member.class_name) &&
+            member.class_name != class_name && environment.class_ordering(member.class_name, class_name) == :disjoint
+        end
+      end
+
       # Mirror of {.narrow_class} for the falsey edge of `is_a?`/`kind_of?`/`instance_of?`.
       # Inhabitants that DO satisfy the predicate are removed; inhabitants that do not are
       # preserved. Conservative on Top/Dynamic/Bot (preserved unchanged) because the analyzer
@@ -390,6 +430,16 @@ module Rigor
         fact.type
       end
 
+      # Issue #1429 — the key a constant reference's guard narrowing is recorded under ({Scope#constant_narrowing}):
+      # its spelling, with a leading `::` kept, since `::Foo` and `Foo` may name two constants. nil for a path on a
+      # dynamic base (`expr::Foo`) and for any other node.
+      def constant_key(node)
+        name = Source::ConstantPath.qualified_name_or_nil(node)
+        return nil if name.nil?
+
+        Source::ConstantPath.rooted?(node) ? "::#{name}" : name
+      end
+
       # Public predicate analyser. Returns `[truthy_scope, falsey_scope]`, always; when no
       # narrowing rule matches the predicate node both entries are the receiver scope unchanged.
       def predicate_scopes(node, scope)
@@ -399,6 +449,37 @@ module Rigor
         result || [scope, scope]
       end
 
+      # Issue #1468 — the scope the arguments and block of a safe-navigation call `recv&.m(…)` run under. Ruby
+      # evaluates them only once `recv` is known non-nil, so `klass&.new(klass.flag?)` reads `klass` without its
+      # `nil`, as `if klass then klass.new(klass.flag?) end` does. Only `nil` is removed: `false&.m(x)` still calls
+      # `m`. The call's own value keeps its skipped-call `nil` (`ExpressionTyper#safe_navigation_call_type`).
+      #
+      # The receiver is one a guard narrows ({.receiver_slot}: a local, instance variable, global or constant), or a
+      # safe-navigation call on such a receiver whose own arguments and block hold no write or jump
+      # ({OperandEffects}): `a&.b(a.c)&.d(a.e)` runs `d` only when `a&.b(…)` answered non-nil, which it cannot on a
+      # nil `a`, and nothing between the two reads rebinds `a`. `scope` itself when nothing narrows, and for a call
+      # that is not `&.`.
+      def safe_navigation_scope(call_node, scope)
+        return scope unless call_node.safe_navigation?
+
+        non_nil_receiver_scope(call_node.receiver, scope) || scope
+      end
+
+      # The scope the block of a safe-navigation call is entered from: {.safe_navigation_scope}, unless the narrowing
+      # may not hold for the whole body. An argument that writes may rebind the receiver before the block runs
+      # (`f&.two(f = nil) { f.run }`), and a block that writes the receiver hands the next iteration what it wrote
+      # (`a&.each { a.size; a = nil }`); either keeps `scope`.
+      def safe_navigation_block_scope(call_node, scope)
+        return scope unless call_node.safe_navigation?
+        return scope if OperandEffects.any?(call_node.arguments)
+
+        root = call_node.receiver
+        root = root.receiver while root.is_a?(Prism::CallNode) && root.safe_navigation?
+        return scope if root.respond_to?(:name) && OperandEffects.written_variables(call_node.block).include?(root.name)
+
+        safe_navigation_scope(call_node, scope)
+      end
+
       # Slice 7 phase 5 — `case`/`when` narrowing.
       #
       # Given the subject of a `case` (the expression after the `case` keyword) and an array of
@@ -416,10 +497,6 @@ module Rigor
       # scope. The catalogue mirrors {.case_equality_target_class}: static class/module
       # constants narrow as `is_a?`; integer/float-endpoint ranges narrow to `Numeric`;
       # string-endpoint ranges and regexp literals narrow to `String`.
-      #
-      # @param subject — the `case` subject.
-      # @param conditions — the `when`
-      #   clause's `conditions` array.
       def case_when_scopes(subject, conditions, scope)
         # C1 — `case x when /re/` runs `/re/ === x`, which sets the regex match-data globals
         # exactly as a successful `=~` does. Narrow `$~`/`$&`/`$1..$N` on the clause body (the
@@ -427,17 +504,17 @@ module Rigor
         # a different regex. Applied even when the subject is not a narrowable local read.
         body_scope = apply_when_regex_globals(conditions, scope)
 
-        return [body_scope, scope] unless subject.is_a?(Prism::LocalVariableReadNode)
+        # Issue #1429 — a global or constant subject (`case $stdout when StringIO`) narrows as a local does.
+        slot = receiver_slot(subject, scope, kinds: CASE_SUBJECT_KINDS)
+        return [body_scope, scope] if slot.nil?
 
-        local_name = subject.name
-        current = scope.local(local_name)
-        return [body_scope, scope] if current.nil?
-
-        truthy, = accumulate_case_when_scopes(body_scope, local_name, current, conditions)
-        _, falsey = accumulate_case_when_scopes(scope, local_name, current, conditions)
-        [truthy, falsey]
+        truthy_type, falsey_type = case_when_types(scope, slot.current, conditions)
+        [narrow_slot(body_scope, slot, truthy_type), narrow_slot(scope, slot, falsey_type)]
       end
 
+      CASE_SUBJECT_KINDS = %i[local global constant].freeze
+      private_constant :CASE_SUBJECT_KINDS
+
       # When the clause has exactly one `RegularExpressionNode` literal condition, narrow the
       # match-data globals on the body edge (same rule as `analyse_regex_match_predicate`'s
       # truthy edge). With multiple regex conditions (`when /a/, /b/`) the body is reachable
@@ -460,8 +537,29 @@ module Rigor
 
       # Internal analyser. Returns `[truthy_scope, falsey_scope]` when the predicate shape is
       # recognised, or `nil` to signal "no narrowing" so the public surface can fall back to the
-      # entry scope.
+      # entry scope. Issue #1359 — a condition whose value is a `gets`-family reader's, the bare call
+      # or a variable written with it (`while gets`, `if (line = gets)`), also binds `$_` on each edge
+      # to the line the reader returned ({LastLine.predicate_scopes}).
       def analyse(node, scope)
+        edges = analyse_shape(node, scope)
+        reader = last_line_condition(node)
+        reader ? LastLine.predicate_scopes(reader, scope, edges) : edges
+      end
+
+      # The reader call a condition's value is, or nil.
+      def last_line_condition(node)
+        call =
+          case node
+          when Prism::CallNode then node
+          when Prism::LocalVariableWriteNode, Prism::InstanceVariableWriteNode, Prism::ClassVariableWriteNode,
+               Prism::GlobalVariableWriteNode
+            node.value
+          end
+        call if call.is_a?(Prism::CallNode) && LastLine::READERS.include?(call.name)
+      end
+      private_class_method :last_line_condition
+
+      def analyse_shape(node, scope)
         case node
         when Prism::ParenthesesNode
           analyse_parentheses(node, scope)
@@ -473,20 +571,19 @@ module Rigor
           analyse_local_write(node, scope)
         when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode
           analyse_ivar(node, scope)
-        when Prism::ClassVariableWriteNode
-          analyse_cvar_write(node, scope)
-        when Prism::GlobalVariableWriteNode
-          analyse_global_write(node, scope)
+        when Prism::ClassVariableWriteNode, Prism::GlobalVariableWriteNode
+          analyse_cvar_or_global_write(node, scope)
+        when Prism::GlobalVariableReadNode, Prism::ConstantReadNode, Prism::ConstantPathNode
+          analyse_slot_read(node, scope)
         when Prism::CallNode
-          analyse_call(node, scope)
-        when Prism::AndNode
-          analyse_and(node, scope)
-        when Prism::OrNode
-          analyse_or(node, scope)
+          analyse_call(write_receiver_as_read(node) || node, scope)
+        when Prism::AndNode, Prism::OrNode, Prism::IfNode, Prism::UnlessNode
+          analyse_composition(node, scope)
         when Prism::MatchWriteNode
           analyse_match_write(node, scope)
         end
       end
+      private_class_method :analyse_shape
 
       # rubocop:disable-next Metrics/ClassLength
       class << self
@@ -843,6 +940,12 @@ module Rigor
           ]
         end
 
+        def analyse_cvar_or_global_write(node, scope)
+          return analyse_cvar_write(node, scope) if node.is_a?(Prism::ClassVariableWriteNode)
+
+          analyse_global_write(node, scope)
+        end
+
         def analyse_cvar_write(node, scope)
           current = scope.cvar(node.name)
           return nil if current.nil?
@@ -863,6 +966,76 @@ module Rigor
           ]
         end
 
+        # Issue #1429 — `if $g`, `return unless $g`, `if CONFIG`: the truthiness guard on a global or constant
+        # read, the counterpart of {#analyse_local_read} ({#narrow_slot}).
+        def analyse_slot_read(node, scope)
+          slot = receiver_slot(node, scope, kinds: GLOBAL_AND_CONSTANT)
+          return nil if slot.nil?
+
+          [
+            narrow_slot(scope, slot, narrow_truthy(slot.current)),
+            narrow_slot(scope, slot, narrow_falsey(slot.current))
+          ]
+        end
+
+        GLOBAL_AND_CONSTANT = %i[global constant].freeze
+        ALL_SLOT_KINDS = %i[local ivar global constant].freeze
+        private_constant :GLOBAL_AND_CONSTANT, :ALL_SLOT_KINDS
+
+        # The {ReceiverSlot} `node` reads, among `kinds`, or nil. A local or instance variable needs a binding. A
+        # global the scope does not bind is read as it reads unbound, and a constant reference as it resolves
+        # (through any narrowing already on it), so a guard narrows it from that type.
+        def receiver_slot(node, scope, kinds: ALL_SLOT_KINDS)
+          case node
+          when Prism::LocalVariableReadNode then variable_slot(:local, node.name, scope.local(node.name), kinds)
+          when Prism::InstanceVariableReadNode then variable_slot(:ivar, node.name, scope.ivar(node.name), kinds)
+          when Prism::GlobalVariableReadNode then global_slot(node, scope, kinds)
+          when Prism::ConstantReadNode, Prism::ConstantPathNode then constant_slot(node, scope, kinds)
+          end
+        end
+
+        def variable_slot(kind, name, current, kinds)
+          return nil if current.nil? || !kinds.include?(kind)
+
+          ReceiverSlot.new(kind: kind, name: name, current: current)
+        end
+
+        def global_slot(node, scope, kinds)
+          return nil unless kinds.include?(:global)
+
+          ReceiverSlot.new(kind: :global, name: node.name, current: scope.global(node.name) || scope.type_of(node))
+        end
+
+        def constant_slot(node, scope, kinds)
+          return nil unless kinds.include?(:constant)
+
+          key = constant_key(node)
+          return nil if key.nil?
+
+          ReceiverSlot.new(kind: :constant, name: key, current: scope.type_of(node))
+        end
+
+        # `scope` with `slot`'s receiver read as `type` on one edge. A local or instance variable rebinds as its
+        # analysers always did. A global or constant is left alone when the edge learns nothing (`type` is what
+        # it read), and otherwise narrows with its pre-guard type recorded, so code that may rebind it restores
+        # the binding ({Scope#forget_guard_narrowings}); the frame-local specials skip the record.
+        def narrow_slot(scope, slot, type)
+          case slot.kind
+          when :local then scope.with_local(slot.name, type)
+          when :ivar then scope.with_ivar(slot.name, type)
+          when :global then narrow_global_slot(scope, slot, type)
+          else
+            type == slot.current ? scope : scope.with_constant_narrowing(slot.name, type, slot.current)
+          end
+        end
+
+        def narrow_global_slot(scope, slot, type)
+          return scope if type == slot.current
+
+          record = !UNRECORDED_GUARD_GLOBALS.include?(slot.name)
+          scope.with_guarded_global(slot.name, type, slot.current, record: record)
+        end
+
         # `if /(?<x>...)/ =~ str` — Prism wraps the `=~` call in a `MatchWriteNode` listing the
         # named-capture targets. The parent `eval_match_write` has already bound each target to
         # `String | nil`; in the truthy branch (the regex matched) every named capture is
@@ -918,6 +1091,25 @@ module Rigor
         #   literals (Slice 6 phase 2 sub-phase 2).
         # Anything else returns nil so the surrounding analyser falls through to the
         # no-narrowing fallback.
+        # Issue #1223 — `(x = e).nil?`, `(x ||= e).empty?`, `(@x = e).is_a?(C)`. A write's value is the binding
+        # it leaves, and a predicate is narrowed in the scope after its receiver ran, so the call narrows the
+        # variable exactly as the same call on a read of it would. Every analyser keys its receiver on a read
+        # node, so the call is analysed with its receiver replaced by one ({ReceiverAlias.read_of}). Before #1223
+        # the statement evaluator did not thread a receiver's write at all, so the local was unbound and there
+        # was nothing to narrow; nil when the receiver is not such a write, bare or parenthesised on its own.
+        def write_receiver_as_read(node)
+          write = written_receiver(node.receiver)
+          write && node.copy(receiver: ReceiverAlias.read_of(write))
+        end
+
+        def written_receiver(receiver)
+          while receiver.is_a?(Prism::ParenthesesNode) && receiver.body.is_a?(Prism::StatementsNode) &&
+                receiver.body.body.size == 1
+            receiver = receiver.body.body.first
+          end
+          receiver if ReceiverAlias.variable_write?(receiver)
+        end
+
         def analyse_call(node, scope)
           return nil if node.block
 
@@ -1068,11 +1260,19 @@ module Rigor
         # symbol is one of `NilClass`'s own methods (`:to_s`, `:inspect`, `:nil?`, …) — `nil`
         # DOES respond to those, so the truthy edge admits a nil receiver and we narrow nothing.
         #
+        # Issue #1429 — the truthy edge also admits `m` itself. `respond_to?` is a guard written in the code
+        # (ADR-117 Decision point 3), so a member of the receiver's type whose class Rigor knows to lack `m`
+        # is not what the edge holds: members that may respond keep their type, and when no member may, the
+        # receiver reads `Dynamic[top]` ({#respond_to_admitted}). `$stdout.respond_to?(:string) ?
+        # $stdout.string : ""` on an `IO`-typed `$stdout` therefore does not report `undefined method`.
+        # `Dynamic[top]` rather than `Dynamic[IO]`: method availability on a `Dynamic[T]` is checked against
+        # `T` (special-types.md), so only the untyped carrier is sure to keep the guarded call quiet.
+        #
         # Conservative floor: narrow only on a literal `Symbol`/`String` argument resolved
         # against the RBS environment; a non-literal symbol, a missing argument, or a symbol
         # that IS in `NilClass`'s method set declines. The falsey edge is always the no-op
-        # ("does not respond" proves little about the receiver's type). Narrowing-only: it
-        # removes the `nil` constituent and never promotes a non-nil type.
+        # ("does not respond" proves little about the receiver's type). A local, instance variable,
+        # global or constant receiver narrows ({#receiver_slot}).
         def analyse_respond_to_predicate(node, scope)
           return nil if node.block
           return nil if node.arguments.nil? || node.arguments.arguments.size != 1
@@ -1081,16 +1281,63 @@ module Rigor
           return nil if sym.nil?
           return nil if nilclass_method?(sym, scope)
 
-          reader, writer = emptiness_receiver_accessors(node.receiver)
-          return nil if reader.nil?
+          slot = receiver_slot(node.receiver, scope)
+          return nil if slot.nil?
 
-          current = scope.public_send(reader, node.receiver.name)
-          return nil if current.nil?
+          admitted = respond_to_admitted(narrow_non_nil(slot.current), sym.to_sym, scope)
+          return nil if admitted.equal?(slot.current) || admitted == slot.current
 
-          non_nil = narrow_non_nil(current)
-          return nil if non_nil.equal?(current)
+          [narrow_slot(scope, slot, admitted), scope]
+        end
+
+        # The members of `type` that may respond to `method_name`, or, when Rigor knows every member lacks it
+        # ({#lacks_method?}), `Dynamic[top]`: the members Rigor read the edge from are wrong about the object there,
+        # and no class is named to read it as instead. A member Rigor cannot judge (`Dynamic`, `Bot`, a class no
+        # signature declares) may respond.
+        #
+        # When every member lacking `m` records what the file literally shows (a literal, a `Tuple`, a `HashShape`, a
+        # class object, `nil` / `true` / `false`), the edge is `Bot`. For a literal value that is exact
+        # (`1.respond_to?(:string)` is false in every run); a class object's arm goes unchecked when a gem without a
+        # signature adds the method (`Time.respond_to?(:zone)` under ActiveSupport).
+        def respond_to_admitted(type, method_name, scope)
+          members = type.is_a?(Type::Union) ? type.members : [type]
+          kept = members.reject { |member| lacks_method?(member, method_name, scope) }
+          return type if kept.size == members.size
+          return Type::Combinator.union(*kept) unless kept.empty?
+          return Type::Combinator.bot if members.all? { |member| literal_carrier?(member) }
 
-          [scope.public_send(writer, node.receiver.name, non_nil), scope]
+          Type::Combinator.untyped
+        end
+
+        LITERAL_CARRIERS = [Type::Constant, Type::Tuple, Type::HashShape, Type::Singleton].freeze
+        private_constant :LITERAL_CARRIERS
+
+        def literal_carrier?(member)
+          LITERAL_CARRIERS.any? { |carrier| member.is_a?(carrier) } ||
+            (member.is_a?(Type::Nominal) && VALUE_PINNED_CLASSES.include?(member.class_name))
+        end
+
+        # True only when every class `member` dispatches through is declared in RBS, is not a mixin module or
+        # `Object` / `BasicObject` (whose instances may be of any class), is not a plugin's open receiver, and
+        # neither its signature nor the project defines `method_name` on it.
+        def lacks_method?(member, method_name, scope)
+          targets = ProjectMethodOwnership.targets(member)
+          return false if targets.nil? || targets.empty?
+
+          targets.all? { |class_name, kind| class_lacks_method?(class_name, method_name, kind, scope) }
+        end
+
+        OPEN_SURFACE_CLASSES = %w[Object BasicObject].freeze
+        private_constant :OPEN_SURFACE_CLASSES
+
+        def class_lacks_method?(class_name, method_name, kind, scope)
+          return false if kind == :instance && OPEN_SURFACE_CLASSES.include?(class_name)
+          return false unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
+          return false if kind == :instance && scope.environment.rbs_module?(class_name)
+          return false if scope.environment.plugin_registry&.open_receiver?(class_name)
+          return false if ProjectMethodOwnership.defines?(class_name, method_name, kind, scope)
+
+          ExternalAncestorResolution.method_definition(class_name, method_name, kind, scope: scope).nil?
         end
 
         # True when `nil` responds to `sym` — i.e. `NilClass` (own, inherited
@@ -1409,13 +1656,17 @@ module Rigor
         # `String`; every other numbered group present in the pattern stays `String | nil` on
         # both edges (a truthy match leaves an optional group nil at runtime), so we do not
         # narrow it on the truthy edge.
+        #
+        # Both edges start from `scope` with the match globals forgotten (#1385): the match rebinds every one of them,
+        # so a `$N` an earlier match narrowed says nothing here. Without that, a `when /(x)/` arm, or the right operand
+        # of `s =~ /(a)(b)(c)/ && t =~ /(x)/`, kept `$2` and `$3` narrowed to `String` where Ruby reads nil.
         def regex_match_predicate_scopes(scope, unconditional)
           string_t = Type::Combinator.nominal_of("String")
           match_data_t = Type::Combinator.nominal_of("MatchData")
           nil_t = Type::Combinator.constant_of(nil)
 
-          truthy = scope
-          falsey = scope
+          truthy = scope.forget_match_globals
+          falsey = truthy
           truthy = truthy.with_global(:$~, match_data_t)
           falsey = falsey.with_global(:$~, nil_t)
           REGEX_MATCH_GLOBALS.each do |name|
@@ -1449,8 +1700,10 @@ module Rigor
         # them to non-nil `String` would be unsound. The walker is intentionally light (char
         # scan, not a regex-AST parse): backslash escapes are skipped; `(?:…)`, lookahead
         # `(?=…)`/`(?!…)`, and lookbehind `(?<=…)`/`(?<!…)` do not capture; named groups
-        # `(?<name>…)` do. Conservatism is one-directional — when in doubt a group is treated
-        # as conditional (dropped from the Set), never the reverse.
+        # `(?<name>…)` / `(?'name'…)` do. Once the pattern has a named group, Ruby numbers only
+        # the named groups and a plain `(…)` does not capture (#1471): `/(?<x>a)(b)/` has one
+        # group, so `$2` is nil. Conservatism is one-directional — when in doubt a group is
+        # treated as conditional (dropped from the Set), never the reverse.
         def unconditional_capture_groups(source)
           # `unconditional` collects every capturing index; a group is later removed (with its
           # whole subtree) when it is optionally quantified, nested under an optional ancestor,
@@ -1460,7 +1713,15 @@ module Rigor
           # mutually exclusive, so its descendant captures may be absent on a successful match;
           # the group itself still participates. Closing a frame rolls its subtree up to the
           # parent so an optional / alternated ancestor disqualifies it.
-          state = { unconditional: Set.new, stack: [[nil, [], false]], group_index: 0 }
+          state = { unconditional: Set.new, stack: [[nil, [], false]], group_index: 0, named: named_groups?(source) }
+          each_structural_char(source) { |pos, chr| scan_group_char(source, pos, chr, state) }
+          # Drain the virtual root: a top-level `|` disqualifies all.
+          finalize_frame(state, state[:stack].pop, optional: false)
+          state[:unconditional]
+        end
+
+        # Yields each position of `source` outside a backslash escape and a character class, with its char.
+        def each_structural_char(source)
           pos = 0
           length = source.length
           while pos < length
@@ -1473,12 +1734,13 @@ module Rigor
               pos = skip_char_class(source, pos) + 1
               next
             end
-            scan_group_char(source, pos, chr, state)
+            yield pos, chr
             pos += 1
           end
-          # Drain the virtual root: a top-level `|` disqualifies all.
-          finalize_frame(state, state[:stack].pop, optional: false)
-          state[:unconditional]
+        end
+
+        def named_groups?(source)
+          each_structural_char(source) { |pos, chr| break true if chr == "(" && named_group?(source, pos) } == true
         end
 
         # Updates the walk `state` at a group-relevant char during
@@ -1488,7 +1750,7 @@ module Rigor
           case chr
           when "("
             idx = nil
-            if capturing_group?(source, pos)
+            if capturing_group?(source, pos, named: state[:named])
               idx = (state[:group_index] += 1)
               state[:unconditional] << idx
             end
@@ -1527,11 +1789,20 @@ module Rigor
           end
         end
 
-        def capturing_group?(source, pos)
-          return true unless source[pos + 1] == "?"
+        # A plain `(…)` captures unless the pattern has a named group (`named:`); of the `(?…)` forms only a named
+        # group does.
+        def capturing_group?(source, pos, named:)
+          return !named unless source[pos + 1] == "?"
+
+          named_group?(source, pos)
+        end
+
+        # `(?<name>…)` and `(?'name'…)` are named groups; `(?<=…)`/`(?<!…)` (lookbehind) and
+        # `(?:…)`/`(?=…)`/`(?!…)` are not.
+        def named_group?(source, pos)
+          return false unless source[pos + 1] == "?"
+          return true if source[pos + 2] == "'"
 
-          # `(?<name>…)` captures; `(?<=…)`/`(?<!…)` (lookbehind) and
-          # `(?:…)`/`(?=…)`/`(?!…)` do not.
           source[pos + 2] == "<" && source[pos + 3] != "=" && source[pos + 3] != "!"
         end
 
@@ -1962,9 +2233,30 @@ module Rigor
             analyse_class_predicate_on_local(node, scope, class_name, exact)
           when Prism::CallNode
             analyse_class_predicate_on_chain(node, scope, class_name, exact)
+          else
+            analyse_class_predicate_on_slot(node.receiver, scope, class_name, exact)
           end
         end
 
+        # Issue #1429 — `$stdout.is_a?(StringIO)`, `STDOUT.kind_of?(StringIO)`: a global or constant receiver
+        # narrows as a local does ({#class_predicate_scopes}), with the pre-guard type recorded ({#narrow_slot}).
+        def analyse_class_predicate_on_slot(receiver, scope, class_name, exact)
+          slot = receiver_slot(receiver, scope, kinds: GLOBAL_AND_CONSTANT)
+          return nil if slot.nil?
+
+          class_slot_scopes(scope, slot, class_name, exact: exact)
+        end
+
+        def class_slot_scopes(scope, slot, class_name, exact:)
+          environment = scope.environment
+          truthy = narrow_class(slot.current, class_name, exact: exact, environment: environment, scope: scope)
+          [
+            narrow_slot(scope, slot, truthy),
+            narrow_slot(scope, slot, narrow_not_class(slot.current, class_name, exact: exact,
+                                                                                environment: environment, scope: scope))
+          ]
+        end
+
         # The class name a `is_a?` / `kind_of?` / `instance_of?` argument denotes: the top-level
         # `bare_name` when the reference is written `::Foo` (nil when nothing declares it there),
         # the lexical resolution otherwise.
@@ -2096,16 +2388,8 @@ module Rigor
         end
 
         def class_predicate_scopes(scope, name, current, class_name, exact:)
-          [
-            scope.with_local(
-              name,
-              narrow_class(current, class_name, exact: exact, environment: scope.environment, scope: scope)
-            ),
-            scope.with_local(
-              name,
-              narrow_not_class(current, class_name, exact: exact, environment: scope.environment, scope: scope)
-            )
-          ]
+          slot = ReceiverSlot.new(kind: :local, name: name, current: current)
+          class_slot_scopes(scope, slot, class_name, exact: exact)
         end
 
         # Slice 7 phase 4 — `===`-narrowing. The case-equality predicate `<receiver> === local`
@@ -2139,9 +2423,23 @@ module Rigor
             analyse_case_equality_receiver(node.receiver, scope, arg.name, current)
           when Prism::CallNode
             analyse_case_equality_on_chain(node.receiver, arg, scope)
+          else
+            analyse_case_equality_on_slot(node.receiver, arg, scope)
           end
         end
 
+        # Issue #1429 — `StringIO === $stdout`, `StringIO === STDOUT`: the class-constant receiver form on a global or
+        # constant argument. The Range / Regexp receivers stay local-only.
+        def analyse_case_equality_on_slot(receiver, arg, scope)
+          class_name = lexical_class_name(receiver, scope)
+          return nil if class_name.nil?
+
+          slot = receiver_slot(arg, scope, kinds: GLOBAL_AND_CONSTANT)
+          return nil if slot.nil?
+
+          class_slot_scopes(scope, slot, class_name, exact: false)
+        end
+
         # `Class === <local/ivar>.<method>` — the case-equality counterpart of
         # {.analyse_class_predicate_on_chain}. The `open3` idiom `if Hash === cmd.last` narrows
         # `cmd.last` to the class inside the branch, recorded as a single-hop method-chain
@@ -2360,6 +2658,10 @@ module Rigor
         # that position, or nil when the overload shape does not allow a precise match.
         def lookup_positional_arg(call_node, method_def, target_name)
           arguments = call_node.arguments&.arguments || []
+          # A `(?)` overload (`RBS::Types::UntypedFunction`, #1430) names no parameter and accepts any argument list,
+          # so a call may reach it with the target's position holding anything: no overload proves the target.
+          return nil unless method_def.method_types.all? { |mt| mt.type.respond_to?(:required_positionals) }
+
           method_def.method_types.each do |mt|
             params = mt.type.required_positionals + mt.type.optional_positionals
             index = params.find_index { |param| param.name == target_name }
@@ -2375,7 +2677,9 @@ module Rigor
         # cannot statically classify are treated as "no narrowing": the body falls back to the
         # union of what we did learn (or the entry type when nothing learned), and the falsey
         # edge is the entry type (because we cannot prove the unknown condition didn't match).
-        def accumulate_case_when_scopes(scope, local_name, current, conditions)
+        #
+        # `[body type, next-clause type]` of a `when` clause's conditions over the subject type `current`.
+        def case_when_types(scope, current, conditions)
           truthy_members = []
           falsey_type = current
           fully_narrowable = true
@@ -2392,10 +2696,7 @@ module Rigor
           end
 
           truthy = truthy_members.empty? ? current : Type::Combinator.union(*truthy_members)
-          [
-            scope.with_local(local_name, truthy),
-            scope.with_local(local_name, fully_narrowable ? falsey_type : current)
-          ]
+          [truthy, fully_narrowable ? falsey_type : current]
         end
 
         # Per-condition rule. Returns `nil` when the condition shape is not recognised (caller
@@ -2647,9 +2948,12 @@ module Rigor
         # `is_a?(Integer)`) narrow DOWN to `Nominal[class_name]`; otherwise (disjoint
         # hierarchies under `is_a?`, mismatch under `instance_of?`) collapse to `Bot`.
         # Conservative when the analyzer environment cannot resolve either class.
+        #
+        # A disjoint `Bot` narrows the edge but is not always a verdict that the code is dead: see
+        # {.disjoint_nominal_guard?} (issue #1429).
         def narrow_nominal_to_class(nominal, class_name, context)
           return nominal if nominal.class_name == class_name
-          return Type::Combinator.bot if context.exact
+          return exact_nominal_to_class(nominal, class_name, context) if context.exact
 
           case class_ordering(nominal.class_name, class_name, context)
           when :superclass then Type::Combinator.nominal_of(class_name)
@@ -2664,6 +2968,17 @@ module Rigor
           end
         end
 
+        # `instance_of?(class_name)` compares the exact class, so its truthy edge holds `class_name` itself. Issue
+        # #1429: when `class_name` is a class below the nominal's (`Numeric` under `instance_of?(Integer)`), that is
+        # the edge's type; the edge was `Bot` before, for every class but the nominal's own. A module is never an
+        # object's class, and any other ordering leaves no class the object can have, so those stay `Bot`.
+        def exact_nominal_to_class(nominal, class_name, context)
+          return Type::Combinator.bot if context.environment.rbs_module?(class_name)
+          return Type::Combinator.bot unless class_ordering(nominal.class_name, class_name, context) == :superclass
+
+          Type::Combinator.nominal_of(class_name)
+        end
+
         def narrow_nominal_not_class(nominal, class_name, context)
           return Type::Combinator.bot if nominal.class_name == class_name
           return nominal if context.exact
@@ -2808,25 +3123,15 @@ module Rigor
           context.environment.class_ordering(lhs, rhs)
         end
 
+        # `x.nil?` on a local, instance variable, global or constant (#1429) read.
         def analyse_nil_predicate(receiver, scope)
-          case receiver
-          when Prism::LocalVariableReadNode
-            current = scope.local(receiver.name)
-            return nil if current.nil?
-
-            [
-              scope.with_local(receiver.name, narrow_nil(current)),
-              scope.with_local(receiver.name, narrow_non_nil(current))
-            ]
-          when Prism::InstanceVariableReadNode
-            current = scope.ivar(receiver.name)
-            return nil if current.nil?
+          slot = receiver_slot(receiver, scope)
+          return nil if slot.nil?
 
-            [
-              scope.with_ivar(receiver.name, narrow_nil(current)),
-              scope.with_ivar(receiver.name, narrow_non_nil(current))
-            ]
-          end
+          [
+            narrow_slot(scope, slot, narrow_nil(slot.current)),
+            narrow_slot(scope, slot, narrow_non_nil(slot.current))
+          ]
         end
 
         # The three value-pinned classes a union arm can name whose instances are the single
@@ -2945,21 +3250,39 @@ module Rigor
         def analyse_safe_nav_receiver(node, scope)
           return nil unless node.safe_navigation?
 
-          receiver = node.receiver
-          reader, writer =
-            case receiver
-            when Prism::LocalVariableReadNode then %i[local with_local]
-            when Prism::InstanceVariableReadNode then %i[ivar with_ivar]
-            else return nil
-            end
+          narrowed = non_nil_slot_scope(node.receiver, scope)
+          narrowed && [narrowed, scope]
+        end
 
-          current = scope.public_send(reader, receiver.name)
-          return nil if current.nil?
+        # `scope` with the receiver `node` reads (a local, instance variable, global or constant, #1429) narrowed to
+        # its non-nil fragment, or nil when there is no such receiver or it holds no `nil` to remove.
+        def non_nil_slot_scope(node, scope)
+          slot = receiver_slot(node, scope)
+          return nil if slot.nil?
 
-          non_nil = narrow_non_nil(current)
-          return nil if non_nil.equal?(current)
+          non_nil = narrow_non_nil(slot.current)
+          return nil if non_nil.equal?(slot.current)
 
-          [scope.public_send(writer, receiver.name, non_nil), scope]
+          narrow_slot(scope, slot, non_nil)
+        end
+
+        # The scope {.safe_navigation_scope} answers for a receiver, seen through the `&.` links of a chain whose
+        # operands leave the root's binding alone, or nil. Unlike {.non_nil_slot_scope} it compares the fragment
+        # structurally: `narrow_non_nil` rebuilds a union it removed nothing from, and a receiver that cannot be nil
+        # must leave the call's operands on the scope they are typed from.
+        def non_nil_receiver_scope(node, scope)
+          if node.is_a?(Prism::CallNode)
+            return nil unless node.safe_navigation?
+            return nil if OperandEffects.any?(node.arguments) || OperandEffects.any?(node.block)
+
+            return non_nil_receiver_scope(node.receiver, scope)
+          end
+
+          slot = receiver_slot(node, scope)
+          return nil if slot.nil?
+
+          non_nil = narrow_non_nil(slot.current)
+          non_nil == slot.current ? nil : narrow_slot(scope, slot, non_nil)
         end
 
         # Issue #606 slice 1 — the SAFE-NAV CHAIN forms. {.analyse_safe_nav_receiver} above proves
@@ -3031,12 +3354,17 @@ module Rigor
           return nil if suffixes.empty? && !allow_bare
 
           receiver = current.receiver
-          return nil unless receiver.is_a?(Prism::LocalVariableReadNode) ||
-                            receiver.is_a?(Prism::InstanceVariableReadNode)
+          return nil unless SLOT_READ_NODES.any? { |klass| receiver.is_a?(klass) }
 
           [receiver, suffixes]
         end
 
+        SLOT_READ_NODES = [
+          Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, Prism::GlobalVariableReadNode,
+          Prism::ConstantReadNode, Prism::ConstantPathNode
+        ].freeze
+        private_constant :SLOT_READ_NODES
+
         # Which edge — if either — a chain's outcome narrows on. The inner suffixes (everything
         # below the outermost) only ever have to NOT return, so they are held to the raise test
         # alone; the outermost decides the edge per the table in {NIL_FALSEY_SUFFIXES}'s comment.
@@ -3051,20 +3379,7 @@ module Rigor
         end
 
         def safe_nav_chain_narrowed_scope(receiver, scope)
-          reader, writer =
-            case receiver
-            when Prism::LocalVariableReadNode then %i[local with_local]
-            when Prism::InstanceVariableReadNode then %i[ivar with_ivar]
-            else return nil
-            end
-
-          current = scope.public_send(reader, receiver.name)
-          return nil if current.nil?
-
-          non_nil = narrow_non_nil(current)
-          return nil if non_nil.equal?(current)
-
-          scope.public_send(writer, receiver.name, non_nil)
+          non_nil_slot_scope(receiver, scope)
         end
 
         # Issue #606 slice 1, second form — a safe-nav chain COMPARED to a value that cannot be
@@ -3174,14 +3489,23 @@ module Rigor
           return edges unless node.safe_navigation? && edges
 
           truthy, falsey = edges
-          safe = analyse_safe_nav_receiver(node, scope)
-          return edges unless safe
+          slot = receiver_slot(node.receiver, scope)
+          return edges if slot.nil?
 
-          receiver = node.receiver
-          reader = receiver.is_a?(Prism::InstanceVariableReadNode) ? :ivar : :local
-          non_nil = safe.first.public_send(reader, receiver.name)
-          writer = receiver.is_a?(Prism::InstanceVariableReadNode) ? :with_ivar : :with_local
-          [truthy.public_send(writer, receiver.name, non_nil), falsey]
+          non_nil = narrow_non_nil(slot.current)
+          return edges if non_nil.equal?(slot.current)
+
+          [narrow_slot(truthy, slot, non_nil), falsey]
+        end
+
+        # The predicates composed from other predicates, whose edges are built from their
+        # operands' edges.
+        def analyse_composition(node, scope)
+          case node
+          when Prism::AndNode then analyse_and(node, scope)
+          when Prism::OrNode then analyse_or(node, scope)
+          else analyse_conditional(node, scope)
+          end
         end
 
         # `a && b` short-circuits: the truthy edge is the truthy edge of `b` evaluated under
@@ -3191,7 +3515,7 @@ module Rigor
         # output scopes.
         def analyse_and(node, scope)
           truthy_a, falsey_a = analyse(node.left, scope) || [scope, scope]
-          truthy_b, falsey_b = analyse(node.right, truthy_a) || [truthy_a, truthy_a]
+          truthy_b, falsey_b = operand_edges(node.right, truthy_a)
           [truthy_b, falsey_a.join(falsey_b)]
         end
 
@@ -3200,9 +3524,105 @@ module Rigor
         # falsey scope evaluated under `a`'s falsey scope.
         def analyse_or(node, scope)
           truthy_a, falsey_a = analyse(node.left, scope) || [scope, scope]
-          truthy_b, falsey_b = analyse(node.right, falsey_a) || [falsey_a, falsey_a]
+          truthy_b, falsey_b = operand_edges(node.right, falsey_a)
           [truthy_a.join(truthy_b), falsey_b]
         end
+
+        # The edges of an operand that runs only on one edge of an earlier operand, which is the
+        # step `&&` and `||` both take for their right operand. Issue #1359 — the operand runs after
+        # that edge, so a `$_` the earlier operand narrowed is forgotten when the operand may set it
+        # (`gets && log(items.each { gets })`), before the operand's own edges narrow it again.
+        # Issue #1429 — likewise a guard's narrowing of a global or constant the operand may rebind
+        # (`$sep && reset_sep && $sep.length`).
+        def operand_edges(node, edge_scope)
+          edge_scope = LastLine.forget_if_set(edge_scope, node)
+          if edge_scope.guard_narrowed? && GuardRebinding.may_rebind?(node, edge_scope)
+            edge_scope = edge_scope.forget_guard_narrowings
+          end
+          analyse(node, edge_scope) || [edge_scope, edge_scope]
+        end
+
+        # Issue #1017 — `p ? q : r` (and `if` / `unless` in condition position) is truthy through
+        # `p ∧ q` or `¬p ∧ r` and falsey through `p ∧ ¬q` or `¬p ∧ ¬r`. Each conjunction is the
+        # `&&` step — the arm's edges under the predicate's edge ({#operand_edges}) — and each
+        # disjunction is the `||` merge (`Scope#join`), so `p ? false : q` narrows as `!p && q`
+        # does without a literal-arm rule: an arm whose value is settled contributes only its
+        # live edge ({#settled_edges}). Beyond {CONDITIONAL_GUARD_DEPTH} the guard declines.
+        #
+        # The predicate's own edges are never dropped as settled. `scope` is the scope after the
+        # whole conditional ran, so it has already joined the arms, and a carrier every arm
+        # narrowed has lost its optimistic mark there (`Scope#with_local` drops it): a
+        # `missable.nil?` predicate reads as a proof-looking `false` it is not. An arm is judged
+        # under the predicate's edge instead, where a settled value follows from that edge.
+        def analyse_conditional(node, scope)
+          return nil if conditional_guard_height(node) > CONDITIONAL_GUARD_DEPTH
+
+          predicate, then_arm, else_arm = conditional_parts(node)
+          truthy_p, falsey_p = operand_edges(predicate, scope)
+          truthy_q, falsey_q = settled_edges(then_arm, truthy_p)
+          truthy_r, falsey_r = settled_edges(else_arm, falsey_p)
+          truthy = join_live_edges(truthy_q, truthy_r)
+          falsey = join_live_edges(falsey_q, falsey_r)
+          return nil if truthy.nil? && falsey.nil?
+
+          [truthy || scope, falsey || scope]
+        end
+
+        # `[predicate, arm run when it is truthy, arm run when it is falsey]`. An arm is a body or
+        # `nil` for an absent / empty one; an `elsif` is the nested conditional itself.
+        def conditional_parts(node)
+          if node.is_a?(Prism::UnlessNode)
+            [node.predicate, else_body(node.else_clause), node.statements]
+          else
+            subsequent = node.subsequent
+            [node.predicate, node.statements, subsequent.is_a?(Prism::ElseNode) ? else_body(subsequent) : subsequent]
+          end
+        end
+
+        def else_body(else_node)
+          else_node&.statements
+        end
+
+        # An operand's `[truthy, falsey]` edges with a dead edge as `nil`. An absent arm evaluates
+        # to `nil`, so only its falsey edge is live. Otherwise the edge the operand's type proves
+        # unreachable is dropped — unless that proof rests on an optimistically nil-free lookup
+        # (ADR-101, issue #313), which `branch_certainty` refuses to elide an arm on as well.
+        def settled_edges(node, scope)
+          return [nil, scope] if node.nil?
+
+          truthy, falsey = operand_edges(node, scope)
+          case predicate_certainty(scope.type_of(node))
+          when :truthy then optimistic_operand?(node, scope) ? [truthy, falsey] : [truthy, nil]
+          when :falsey then optimistic_operand?(node, scope) ? [truthy, falsey] : [nil, falsey]
+          else [truthy, falsey]
+          end
+        end
+
+        def optimistic_operand?(node, scope)
+          node = node.body.last while node.is_a?(Prism::StatementsNode) && !node.body.empty?
+          !OptimisticOrigin.resolve(node, scope).nil?
+        end
+
+        def join_live_edges(left, right)
+          return right if left.nil?
+          return left if right.nil?
+
+          left.join(right)
+        end
+
+        # The number of conditionals stacked in `node` along the shapes {.analyse} walks.
+        def conditional_guard_height(node)
+          case node
+          when Prism::IfNode, Prism::UnlessNode
+            1 + conditional_parts(node).map { |part| conditional_guard_height(part) }.max
+          when Prism::ParenthesesNode then conditional_guard_height(node.body)
+          when Prism::StatementsNode then conditional_guard_height(node.body.last)
+          when Prism::AndNode, Prism::OrNode
+            [conditional_guard_height(node.left), conditional_guard_height(node.right)].max
+          when Prism::CallNode then node.name == :! ? conditional_guard_height(node.receiver) : 0
+          else 0
+          end
+        end
       end
     end
   end