rigortype 0.4.1 → 0.4.3

data/lib/rigor/inference/statement_evaluator.rb

@@ -31,6 +31,7 @@ require_relative "match_rebinding"
 require_relative "element_read_widening"
 require_relative "hash_lookup_mutation"
 require_relative "indexed_narrowing"
+require_relative "key_presence_guard"
 require_relative "index_write_widening"
 require_relative "method_dispatcher"
 require_relative "method_parameter_binder"
@@ -41,8 +42,10 @@ require_relative "operand_effects"
 require_relative "operand_walk"
 require_relative "optimistic_origin"
 require_relative "return_barrier"
+require_relative "repeated_or_writes"
 require_relative "rewrite_mutation"
 require_relative "unknown_store_widening"
+require_relative "untyped_rejoin"
 require_relative "version_guard"
 
 module Rigor
@@ -277,11 +280,15 @@ module Rigor
       #   a declined `class self::X`, a parse-error header), where `class_context` is empty without the code
       #   being at the top level. A `def` (or `class << self`) there runs under an untyped `self` instead of
       #   the top level's nil one, so its implicit-self calls answer `Dynamic` and no top-level rule fires.
+      # @param widen_clauses — issue #1231: when true (and a recorder is installed), a rescue or `ensure` clause
+      #   records its per-node entry scopes under {#widen_clause_entry}'s widening. The check path sets it; every
+      #   other reader of the index (parameter inference, sig-gen, the scanners) keeps the clause's plain entry.
       def initialize(scope:, tracer: nil, on_enter: nil, class_context: [].freeze, # rubocop:disable Metrics/ParameterLists
                      lexical_nesting: EMPTY_NESTING, converged_loop_recording: false, next_scope_sink: nil,
                      operand_scope: nil, in_operand: false, operand_recorder: nil, operand_types: nil,
-                     opaque_class: false)
+                     opaque_class: false, widen_clauses: false)
         @scope = scope
+        @widen_clauses = widen_clauses
         @opaque_class = opaque_class
         @tracer = tracer
         @on_enter = on_enter
@@ -352,7 +359,7 @@ module Rigor
         @on_enter&.call(node, @scope)
 
         handler = HANDLERS[node.class]
-        return forget_implicit_call_guards(node, send(handler, node)) if handler
+        return forget_aliased_key_guards(node, forget_implicit_call_guards(node, send(handler, node))) if handler
 
         # Default: the node is treated as a pure expression. Type it through the existing expression typer (which
         # observes the current scope's locals) and leave the scope unchanged, but for the match globals a call in it
@@ -373,6 +380,16 @@ module Rigor
         [type, after.forget_guard_narrowings]
       end
 
+      # Issue #1703 — a write that stores a `key?` guard's receiver or key root elsewhere (`g = h`) aliases it, so
+      # the guard ends ({KeyPresenceGuard.invalidate_after_write}).
+      def forget_aliased_key_guards(node, result)
+        type, after = result
+        return result unless after.is_a?(Scope)
+
+        guarded = KeyPresenceGuard.invalidate_after_write(node, after)
+        guarded.equal?(after) ? result : [type, guarded]
+      end
+
       # Issue #1359 — the nodes whose handler runs their parts in order, each from the scope the parts before it
       # left, so a `$_` reader among them forgets it where it runs ({LastLine}) and a read before it keeps the
       # narrowing.
@@ -473,9 +490,10 @@ module Rigor
       # `opts[k] ||= raise KeyError` is a guard, never `bot`, and `@flags[n] ||= false` is `true` after an
       # `@flags[n] = true` elsewhere, never provably `false`.
       #
-      # Nor is a site a block-return pass marked (`Scope#repeated_or_write?`, {RepeatedOrWrites}): the pass types
-      # every run of a repeating body from one entry scope, so its slot's gradual type may be what an EARLIER run
-      # stored rather than an absence of evidence.
+      # Nor is a marked site (`Scope#repeated_or_write?`, {RepeatedOrWrites}): a block-return pass, and this
+      # evaluator's statement and write-back passes ({#with_repeated_or_write_marks}), type every run of a repeating
+      # body from one entry scope, so its slot's gradual type may be what an EARLIER run stored rather than an
+      # absence of evidence.
       def index_compound_write_value(node)
         return index_write_stored_type(node, scope) unless node.is_a?(Prism::IndexOrWriteNode)
 
@@ -1169,7 +1187,8 @@ module Rigor
 
         [
           Type::Combinator.union(then_type, else_type),
-          join_with_nil_injection(then_scope, else_scope)
+          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
+                              [node.statements, node.subsequent])
         ]
       end
 
@@ -1204,7 +1223,8 @@ module Rigor
 
         [
           Type::Combinator.union(then_type, else_type),
-          join_with_nil_injection(then_scope, else_scope)
+          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
+                              [node.statements, node.else_clause])
         ]
       end
 
@@ -1275,7 +1295,7 @@ module Rigor
         subject_type, post_pred = node.predicate ? sub_eval(node.predicate, scope) : [nil, scope]
         branch_results, falsey_scope = eval_case_when_branches(subject_type, node.predicate, node.conditions, post_pred)
         if pattern_case_matches_every_path?(node, branch_results)
-          return unmatched_pattern_result(branch_results, node.conditions)
+          return unmatched_pattern_result(branch_results, node.conditions, post_pred)
         end
 
         else_result = eval_case_else(node.else_clause, falsey_scope)
@@ -1284,7 +1304,7 @@ module Rigor
         branch_nodes = [*node.conditions, node.else_clause]
         [
           Type::Combinator.union(*all_results.map(&:first)),
-          join_case_branch_scopes(all_results, branch_nodes)
+          join_case_branch_scopes(all_results, branch_nodes, post_pred)
         ]
       end
 
@@ -1299,8 +1319,9 @@ module Rigor
         node.is_a?(Prism::CaseMatchNode) && node.else_clause.nil? && !branch_results.empty?
       end
 
-      def unmatched_pattern_result(branch_results, branch_nodes)
-        [Type::Combinator.union(*branch_results.map(&:first)), join_case_branch_scopes(branch_results, branch_nodes)]
+      def unmatched_pattern_result(branch_results, branch_nodes, entry)
+        [Type::Combinator.union(*branch_results.map(&:first)),
+         join_case_branch_scopes(branch_results, branch_nodes, entry)]
       end
 
       # Joins the post-scopes of every `when`/`in`/`else` branch, dropping the scope of any branch that terminates
@@ -1309,15 +1330,16 @@ module Rigor
       # `branch_terminates?` rule `eval_if`/`eval_unless` already apply to the if/else merge: e.g. `case x; when 1 then
       # v="a"; when 2 then v="b"; else raise; end` keeps `v: "a" | "b"` instead of `... | nil`. When every branch
       # terminates the merge is itself unreachable; fall back to the full join so the continuation scope stays
-      # well-formed.
-      def join_case_branch_scopes(results, nodes)
+      # well-formed. A local the clauses only narrowed from `Dynamic[top]` re-joins to it ({UntypedRejoin}, issue
+      # #1840), read against the post-predicate `entry`.
+      def join_case_branch_scopes(results, nodes, entry)
         live = []
         results.each_with_index do |(type, branch_scope), i|
           live << branch_scope unless branch_terminates?(nodes[i], type)
         end
 
         live = results.map(&:last) if live.empty?
-        reduce_scopes_with_nil_injection(live)
+        UntypedRejoin.apply(reduce_scopes_with_nil_injection(live), entry, nodes)
       end
 
       def eval_case_when_branches(subject_type, subject, conditions, entry_scope)
@@ -1466,7 +1488,8 @@ module Rigor
         # prefix of the body, and so reads it forgotten whenever the body may set it.
         entry = edge ? forget_guard_if_rebinds(LastLine.forget_if_set(scope, node), node) : scope
         primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge)
-        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry_scope(node, entry), edge: edge)
+        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry_scope(node, entry),
+                                                    edge: edge, writes: rescue_writes(node, edge))
 
         # B2.1 — retry-edge widening. When a `retry` in the rescue chain targets this `begin`, control re-enters the
         # primary body carrying every rebind made before the retry: the arm's (`rescue; tries += 1; retry; end`), and
@@ -1485,13 +1508,132 @@ module Rigor
           exit_scope = reduce_scopes_with_nil_injection([primary_scope, *live_rescues.map(&:last)])
         end
 
-        if node.ensure_clause
-          carry_jumps_through_ensure(node.ensure_clause, jump_marks)
-          _ensure_type, ensure_scope = sub_eval(node.ensure_clause, exit_scope)
-          exit_scope = ensure_scope
+        [exit_type, node.ensure_clause ? eval_begin_ensure(node, exit_scope, jump_marks) : exit_scope]
+      end
+
+      # The scope past `node`'s `ensure` clause, entered with `exit_scope`, the `next` and `break` scopes recorded past
+      # `jump_marks` carried through it.
+      def eval_begin_ensure(node, exit_scope, jump_marks)
+        carry_jumps_through_ensure(node.ensure_clause, jump_marks)
+        eval_widened_clause(node.ensure_clause, node.ensure_clause.statements, exit_scope, ensure_writes(node)).last
+      end
+
+      # Issue #1231 — a rescue clause runs after the body raised from any point in it, and an `ensure` clause after the
+      # body, its `else` or a rescue clause raised as well as after they finished, so a clause reads each local or
+      # instance variable those wrote at a value the scope it enters with does not hold: `conn = nil; begin; conn =
+      # open_conn; Integer(s); rescue; conn.size; end` reads the connection. The engine does not track where the body
+      # raises (the precise recorder of #1397 put new false positives on correct code); it widens instead, and
+      # deliberately imprecisely. Each name the clause mentions ({#clause_mentions}) that its entry binds and those
+      # clauses write, outside a nested `def` or class body, reads as `Dynamic[top]`, which reports nothing. A plain
+      # join would read `x` as `1?` in `x = 1; begin; foo; x = nil; rescue; x.succ; end`, where it cannot be nil, and a
+      # `Dynamic` that keeps the join as its facet still narrows: `x.nil?` on `Dynamic[1 | 2]` leaves a `nil` member
+      # for the next call to report. A name written inside a nested `ensure` clause, which also runs on the way out of
+      # a raise, is covered by the same floor.
+      #
+      # The names the clauses of `node` read from: the primary body's for a rescue clause, none under a retry `edge`.
+      def rescue_writes(node, edge)
+        clause_writes([node.statements]) if node.rescue_clause && edge.nil? && widening_recorded?
+      end
+
+      # For the `ensure` clause: the writes of the body, its `else` and every rescue clause.
+      def ensure_writes(node)
+        return nil unless widening_recorded?
+
+        sources = [node.statements, node.else_clause]
+        current = node.rescue_clause
+        while current
+          sources << current
+          current = current.subsequent
         end
+        clause_writes(sources)
+      end
 
-        [exit_type, exit_scope]
+      # The local and instance variable names `sources` write, a nested block's included (it may write an outer local),
+      # or nil for none. A `def` or class body writes nothing here.
+      def clause_writes(sources)
+        writes = nil
+        sources.each { |source| writes = collect_clause_names(source, CLAUSE_WRITE_NODES, nil, writes) if source }
+        writes
+      end
+
+      CLAUSE_WRITE_NODES = Set[
+        *CapturedLocals::LOCAL_WRITE_NODES,
+        Prism::InstanceVariableWriteNode,
+        Prism::InstanceVariableOperatorWriteNode,
+        Prism::InstanceVariableOrWriteNode,
+        Prism::InstanceVariableAndWriteNode,
+        Prism::InstanceVariableTargetNode
+      ].freeze
+      private_constant :CLAUSE_WRITE_NODES
+
+      CLAUSE_MENTION_NODES = Set[
+        Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, *CLAUSE_WRITE_NODES
+      ].freeze
+      private_constant :CLAUSE_MENTION_NODES
+
+      # The names of the `node_classes` nodes under `node` (restricted to `among` when given) added to `found`, outside
+      # a nested `def` or class body.
+      def collect_clause_names(node, node_classes, among, found)
+        return found if SCOPE_BODY_NODES.any? { |klass| node.is_a?(klass) }
+
+        if node_classes.include?(node.class) && (among.nil? || among.include?(node.name))
+          (found ||= Set.new) << node.name
+        end
+        node.rigor_each_child { |child| found = collect_clause_names(child, node_classes, among, found) }
+        found
+      end
+
+      # `clause_scope` with each name of `writes` that `statements` mentions, and `clause_scope` binds, rebound to
+      # `Dynamic[top]`, or nil when none changes.
+      def widen_clause_entry(clause_scope, statements, writes)
+        return nil if writes.nil? || statements.nil? || !widening_recorded?
+
+        names = collect_clause_names(statements, CLAUSE_MENTION_NODES, writes, nil)
+        return nil if names.nil?
+
+        untyped = Type::Combinator.untyped
+        widened = names.reduce(clause_scope) do |acc, name|
+          kind = name.start_with?("@") ? :ivar : :local
+          current = clause_scope.public_send(VAR_KIND_GETTERS.fetch(kind), name)
+          current.nil? || current == untyped ? acc : rebind_variable(acc, kind, name, untyped)
+        end
+        widened.equal?(clause_scope) ? nil : widened
+      end
+
+      # Whether a widened pass would record anything: only the check path asks for one ({#initialize}'s
+      # `widen_clauses`), and a pass nothing records is skipped, so a nested clause inside an unrecorded pass is
+      # evaluated once.
+      def widening_recorded?
+        @widen_clauses && !(@on_enter.nil? && @operand_recorder.nil?)
+      end
+
+      # `[type, scope]` of a rescue or `ensure` clause entered with `clause_scope`. When {#widen_clause_entry} widens
+      # it, the clause is evaluated twice: under the widened entry for the per-node index, which is what the check
+      # rules read, and under `clause_scope` without recording, for the value and the scope the code after the
+      # `begin` continues from. The widened pass collects no `return`, `next`, `break` or retry-edge scope, so the
+      # widening reaches neither an inferred return nor a loop: it can only take diagnostics away inside the clause.
+      def eval_widened_clause(node, statements, clause_scope, writes)
+        widened = widen_clause_entry(clause_scope, statements, writes)
+        return sub_eval(node, clause_scope) unless widened
+
+        eval_widened_pass(node, widened)
+        sub_eval(node, clause_scope, **UNRECORDED)
+      end
+
+      # The recorded pass over a widened clause: it reaches no `return`, `next`, `break` or retry-frame sink.
+      def eval_widened_pass(node, widened)
+        return if node.nil?
+
+        without_jump_sinks { sub_eval(node, widened, next_scope_sink: nil) }
+      end
+
+      # Runs `block` with no `return`, `next`, `break` or retry-frame sink installed.
+      def without_jump_sinks
+        previous = CLAUSE_SINK_KEYS.map { |key| Thread.current[key] }
+        CLAUSE_SINK_KEYS.each { |key| Thread.current[key] = nil }
+        yield
+      ensure
+        CLAUSE_SINK_KEYS.zip(previous).each { |key, value| Thread.current[key] = value } if previous
       end
 
       # The scope a rescue clause of `node` enters with: it runs after any prefix of the body, so neither a `$_`
@@ -1589,6 +1731,10 @@ module Rigor
       RETRY_FRAMES_KEY = :rigor_retry_frames
       private_constant :RETRY_FRAMES_KEY
 
+      # The thread-local sinks a widened clause pass ({#without_jump_sinks}) leaves uninstalled.
+      CLAUSE_SINK_KEYS = [RETURN_SINK_KEY, NEXT_SINK_KEY, BREAK_SINK_KEY, BREAK_VALUE_SINK_KEY, RETRY_FRAMES_KEY].freeze
+      private_constant :CLAUSE_SINK_KEYS
+
       # The retry edge of `node`, or nil when no `retry` in its rescue chain targets it. Allocation-free for a `begin`
       # no `retry` targets.
       def retry_edge_for(node)
@@ -1865,13 +2011,23 @@ module Rigor
       # each arm holding one. The latter still carries a rebind the `retry` itself does not see: a write an `ensure`
       # runs on the way out (`begin; retry; ensure; tries += 1; end`), or one made before a `retry` the evaluator only
       # types (`log(tries < 5 ? retry : :gave_up)`).
-      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil)
+      #
+      # Issue #1231 — `writes` widens the scope each clause enters with, as {#eval_widened_clause} does, before its
+      # reference is bound, so `rescue => e` still binds `e` to the exception. It is nil under a retry edge, which
+      # already carries every scope the primary body raises from ({#widen_entry_for_retry}).
+      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil, writes: nil)
         on_enter = edge ? retry_scope_recorder(edge) : @on_enter
         results = []
         current = rescue_node
         while current
+          widened = widen_clause_entry(entry_scope, current.statements, writes)
+          eval_widened_pass(current.statements, bind_rescue_reference(current, widened)) if widened
           rescue_scope = bind_rescue_reference(current, entry_scope)
-          arm = eval_branch_or_nil(current.statements, rescue_scope, on_enter: on_enter)
+          arm = if widened
+                  sub_eval(current.statements, rescue_scope, **UNRECORDED)
+                else
+                  eval_branch_or_nil(current.statements, rescue_scope, on_enter: on_enter)
+                end
           edge.retry_scopes << arm.last if edge&.retrying_arms&.include?(current)
           results << [arm, current]
           current = current.subsequent
@@ -1941,7 +2097,7 @@ module Rigor
         # the single-pass join before returning.
         if names.empty?
           fast = loop_content_writeback(node.statements, base_scope, pre_body: post_pred)
-          return [Type::Combinator.constant_of(nil), narrow_loop_exit_edge(node, fast)]
+          return [Type::Combinator.constant_of(nil), loop_exit(node, post_pred, fast)]
         end
 
         post_loop = converged_loop_scope(node, post_pred, base_scope, names, body_first, jumps)
@@ -1950,7 +2106,7 @@ module Rigor
         # :idle` under `end while state != :idle`) is dead in every converged pass. The single pass runs from the
         # un-narrowed post-predicate scope, so its arms stand in for that first iteration.
         post_loop = join_break_scopes(post_loop, first_breaks, names) if node.begin_modifier?
-        post_loop = narrow_loop_exit_edge(node, post_loop)
+        post_loop = loop_exit(node, post_pred, post_loop)
         [Type::Combinator.constant_of(nil), post_loop]
       end
 
@@ -2037,6 +2193,12 @@ module Rigor
         join_break_scopes(post_loop, arms, names)
       end
 
+      # A loop's continuation: a local its body and predicate only narrowed from `Dynamic[top]` re-joins to it
+      # ({UntypedRejoin}, issue #1840), then the exit edge narrows.
+      def loop_exit(node, post_pred, post_loop)
+        narrow_loop_exit_edge(node, UntypedRejoin.apply(post_loop, post_pred, [node.predicate, node.statements]))
+      end
+
       # Item 4 — loop-exit predicate narrowing. A `while pred` / `until pred` loop exits PRECISELY on the predicate's
       # exit edge: `while` exits when `pred` is falsey, `until` when `pred` is truthy. So after the loop the
       # predicate-assignment target carries the exit polarity — `until line = io.gets; …; end; line.foo` reads `line`
@@ -2368,6 +2530,12 @@ module Rigor
         stores
       end
 
+      # A `for` loop's continuation, with a local the body only narrowed from `Dynamic[top]` re-joined to it
+      # ({UntypedRejoin}, issue #1840). The index is written on every iteration.
+      def for_exit(node, post_coll, continuation)
+        UntypedRejoin.apply(continuation, post_coll, [node.index, node.statements])
+      end
+
       # `for index in collection; body; end`. Unlike `each {}` blocks, `for` does NOT create a new variable scope: the
       # index variable AND every local written in the body leak to the surrounding scope. The collection is evaluated
       # once; the body runs zero or more times, so the post-loop scope is the join of the no-iteration scope (just
@@ -2394,7 +2562,7 @@ module Rigor
         continuation = join_with_nil_injection(post_coll, body_scope)
         pre_existing, body_first = loop_body_local_writes(node.statements, post_coll)
         continuation = join_break_scopes(continuation, breaks, pre_existing + body_first)
-        [Type::Combinator.constant_of(nil), continuation]
+        [Type::Combinator.constant_of(nil), for_exit(node, post_coll, continuation)]
       end
 
       # Issue #1429 — a `for` body runs after the collection's `each`, which may be a project method, and after itself.
@@ -2554,7 +2722,7 @@ module Rigor
 
         # A dead RHS is still evaluated and its scope still joins, so a write inside it nil-injects exactly as
         # before; only its value is dropped, because it cannot be the value of the expression.
-        joined_scope = join_with_nil_injection(left_scope, right_scope)
+        joined_scope = UntypedRejoin.apply(join_with_nil_injection(left_scope, right_scope), left_scope, [node.right])
         type = skipped_type
         type = Type::Combinator.union(skipped_type, right_type) unless right_operand_dead?(node, left_type, left_scope)
         return [type, joined_scope] unless edges
@@ -2994,13 +3162,15 @@ module Rigor
         # outer receiver is itself a chain node (e.g. `x.last << y`) do NOT drop narrowings keyed on `x` — only direct
         # calls against the root variable invalidate the chain.
         post_scope = IndexedNarrowing.invalidate_chain_after_call(call_node: node, current_scope: post_scope)
+        # Issue #1703 — a non-literal-key `key?` guard the call may break ({KeyPresenceGuard.breaks?}).
+        post_scope = KeyPresenceGuard.invalidate_after_call(node, post_scope)
         # B2.2 — intervening method call ivar invalidation. An implicit-self / self-receiver call could mutate any ivar
         # of the enclosing class (we cannot prove purity without an effect system). Reset each ivar whose current local
         # binding has narrowed below the class-ivar seed back to the seed itself, so a subsequent `if @flag` predicate
         # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts). See
         # [`docs/CURRENT_WORK.md`](../../../docs/CURRENT_WORK.md) § "Flow-folding" — G2 intervening-call case.
         post_scope = invalidate_ivars_for_intervening_call(node, post_scope) if statement_call
-        # C1 — regex match-data globals (`$~`, `$1..$9`, `$&`, …) are narrowed to non-nil on a successful-match edge; a
+        # C1 — regex match-data globals (`$~`, `$1..$N`, `$&`, …) are narrowed to non-nil on a successful-match edge; a
         # later call that itself runs a regex match rebinds them, so the narrowed facts must be dropped. We forget them
         # only when the call may run a match in this frame ({#rebinds_match_globals?}). A call provably match-free on a
         # known receiver — `$3.to_i`, `year < 50` — does NOT clobber, so the multi-statement `m = /…/ =~ s; …; use($2)`
@@ -3529,7 +3699,9 @@ module Rigor
       end
 
       def enter_call_block(node, block)
-        block_entry = narrow_define_method_block_self(node, repeating_block_entry(node, block))
+        block_entry = narrow_define_method_block_self(
+          node, with_repeated_or_write_marks(node, block, repeating_block_entry(node, block))
+        )
         # #319 — `Class.new do ... end` and friends evaluate their block as a CLASS BODY (`class_eval`
         # semantics): `self` is the freshly created class, so a `def` inside defines an instance method on it
         # and `attr_reader` runs as a class-level macro. Enter the block under the same `self_type` /
@@ -3559,15 +3731,19 @@ module Rigor
       # does not type as a class object (a gem class with no RBS) keeps the name as written: the body is still some
       # class's body, and leaving it on the enclosing `self` made a `refine` at the file's top level report every
       # implicit-self call in it as `call.unresolved-toplevel`.
+      #
+      # Issue #1689 — a `refine` call the file's {InEffectRefinements} places in a class body is the class's own
+      # method, not `Module#refine`, so its block is entered as any other block.
       def refined_class_context(node)
         target = ScopeIndexer.refine_target(node)
         return nil if target.nil?
 
-        refined = scope.type_of(target)
-        name = refined.is_a?(Type::Singleton) ? refined.class_name : Source::ConstantPath.qualified_name(target)
+        return nil if InEffectRefinements.class_body_refine?(scope, node)
+
+        name = ScopeIndexer.refined_class_name(target, scope)
         return nil if name.nil?
 
-        [ClassFrame.new(name: name.delete_prefix("::"), singleton: false, refinement: true)]
+        [ClassFrame.new(name: name, singleton: false, refinement: true)]
       end
 
       # The block calls whose body `return` leaves only the block ({ReturnBarrier.block_call?}). Like a `->` body
@@ -3601,7 +3777,9 @@ module Rigor
         narrowed = DefineMethodBlockSelf.narrow_self_type_for(
           scope: scope, call_node: call_node
         )
-        narrowed ? block_entry.with_self_type(narrowed) : block_entry
+        return block_entry unless narrowed
+
+        block_entry.with_block_self_type(narrowed, keeps_unknown: scope.block_self_narrowing_unknown?(call_node))
       end
 
       # Enters a meta-new `block` as the body of the class `class_context` names: `self_type` is that class's
@@ -3616,8 +3794,17 @@ module Rigor
       # record a `Outer::K` entry: that is a rung Ruby's constant lookup does not have. The `class_context`
       # frame is still pushed — it is what a nested `def` registers its method under — which is exactly the
       # divergence that makes the chain a separate record rather than a view of the frame stack.
+      #
+      # Issue #1759 — a `refine X do … end` block runs on the refinement module, not on X, which Rigor does not
+      # model: the body keeps X's frame and singleton so its `def`s and implicit-self calls resolve as before, but
+      # carries the unknown-`self` mark ({Scope#block_self_unknown?}), so an explicit `self.import_methods(M)` is
+      # not checked against `singleton(X)`. The indexer leaves a value-position refine block unknown the same way.
       def enter_meta_class_body(block, block_entry, class_context)
-        entry = block_entry.with_self_type(self_type_for_class_body(class_context)).with_singleton_class_body(false)
+        # Issue #1717 — the body runs on the new class whatever encloses it, so its `self` is known.
+        entry = block_entry.with_block_self_type(self_type_for_class_body(class_context),
+                                                 keeps_unknown: class_context.last.refinement &&
+                                                                Scope::REFINEMENT_BLOCK_SELF)
+                           .with_singleton_class_body(false)
         sub_eval(block, stamp_nesting(entry, @lexical_nesting), class_context: class_context)
       end
 
@@ -4114,7 +4301,7 @@ module Rigor
       # The `break` scopes of one unrecorded pass from `converged` — for a capped fixpoint, whose widened binding no
       # pass has run from.
       def converged_break_arms(call_node, block, converged, targets)
-        entry = block_pass_entry(call_node, block, converged)
+        entry = with_repeated_or_write_marks(call_node, block, block_pass_entry(call_node, block, converged))
         sink, = collect_break_scopes { sub_eval(block, entry, **UNRECORDED) }
         targeted_scopes(sink, targets)
       end
@@ -4914,7 +5101,8 @@ module Rigor
       # params / `;`-locals re-bound as usual) and returns the per-name exit binding for `names`. Used as the
       # `BodyFixpoint` body-evaluator.
       def block_exit_bindings(call_node, block, bindings, names)
-        _type, exit_scope = sub_eval(block, block_pass_entry(call_node, block, bindings))
+        entry = with_repeated_or_write_marks(call_node, block, block_pass_entry(call_node, block, bindings))
+        _type, exit_scope = sub_eval(block, entry)
         names.to_h { |name| [name, CapturedLocals.bound_type(exit_scope, name)] }
       end
 
@@ -4930,6 +5118,38 @@ module Rigor
         end
       end
 
+      # Issue #1336 — `entry` with the index `||=` sites of a repeating block marked as the generic block-return pass
+      # marks them ({RepeatedOrWrites}, `Scope#with_repeated_or_writes`). The statement pass and every ADR-56
+      # write-back pass type the body from one entry scope just as that pass does, so a slot an earlier run stored
+      # into reads as a lone `Dynamic` there too, and the memoizing reading ({#index_compound_write_value}) answered
+      # one site's rvalue: `last = (cache[:k] ||= :f).itself` beside a `cache[:k] ||= :e` wrote `:f` alone back
+      # into `last`, and `last == :e` folded always-falsey. A call that runs its block at most once marks nothing.
+      def with_repeated_or_write_marks(call_node, block, entry)
+        sites = repeated_or_write_sites(call_node, block)
+        sites.empty? ? entry : entry.with_repeated_or_writes(sites)
+      end
+
+      # The sites {#with_repeated_or_write_marks} lays, once per block: a body that spells no `||=` — nearly every
+      # one — answers none without the repetition question.
+      def repeated_or_write_sites(call_node, block)
+        memo = (@repeated_or_write_sites ||= {}.compare_by_identity)
+        return memo[block] if memo.key?(block)
+
+        memo[block] = compute_repeated_or_write_sites(call_node, block)
+      end
+
+      def compute_repeated_or_write_sites(call_node, block)
+        body = block.body
+        return NO_REPEATED_OR_WRITES if body.nil? || !RepeatedOrWrites.may_hold_or_write?(body)
+        return NO_REPEATED_OR_WRITES if repeating_block_class(call_node).nil?
+
+        stores = CapturedLocals.content_mutations(block, scope, non_locals: true)
+        RepeatedOrWrites.sites(block, stores, scope).at(nil)
+      end
+
+      NO_REPEATED_OR_WRITES = [].freeze
+      private_constant :NO_REPEATED_OR_WRITES
+
       NO_CAPTURE_BINDINGS = {}.freeze
       private_constant :NO_CAPTURE_BINDINGS
 
@@ -5140,27 +5360,31 @@ module Rigor
         # ({ExpressionTyper#block_body_self_narrowing}) already applies the same contract to block-return
         # typing; without it here the recorded per-node scopes — what `dump_type`/`assert_type` and the
         # survey read — keep the enclosing `self_type` and every DSL call inside stays `Dynamic[top]`.
-        narrowed = call_node && narrow_macro_block_self(call_node)
-        scope_with_params = scope_with_params.with_self_type(narrowed) if narrowed
+        # Issue #1667 — the entry's `refinements:` are put in effect in the body alongside.
+        match = call_node && macro_block_match(call_node)
+        if match
+          keeps_unknown = scope.block_self_narrowing_unknown?(call_node)
+          scope_with_params = MacroBlockSelfType.apply(scope_with_params, match, keeps_unknown: keeps_unknown)
+        end
         block_local_names(block_node).reduce(scope_with_params) do |acc, name|
           acc.with_local(name, Type::Combinator.constant_of(nil))
         end
       end
 
-      # The receiver an ADR-16 `block_as_methods:` match is keyed on: the explicit receiver's type, or the
+      # The ADR-16 `block_as_methods:` match for `call_node`, keyed on the explicit receiver's type, or on the
       # current `self_type` for an implicit-self DSL call (the `params do` / `namespace do` shapes, whose
       # receiver is the enclosing `Singleton[X]`). A miss leaves the entry scope as built — the false-
       # positive-safe direction.
-      def narrow_macro_block_self(call_node)
+      def macro_block_match(call_node)
         receiver_type =
           if call_node.receiver
             explicit_receiver_type(call_node)
           else
-            scope.self_type
+            MacroBlockSelfType.implicit_receiver_type(scope)
           end
         return nil if receiver_type.nil?
 
-        MacroBlockSelfType.narrow_self_type_for(
+        MacroBlockSelfType.match_for(
           scope: scope, call_node: call_node, receiver_type: receiver_type
         )
       rescue StandardError
@@ -5193,7 +5417,8 @@ module Rigor
           method_name: call_node.name,
           arg_types: arg_types,
           environment: scope.environment,
-          scope: scope
+          scope: scope,
+          call_node: call_node
         )
       rescue StandardError
         []
@@ -5218,13 +5443,19 @@ module Rigor
         fresh = build_fresh_body_scope
         # Issue #1518 — `class << self` inside an unnameable class body keeps that body's opacity: it opens the
         # singleton of a class nothing names, and its empty frame stack is not the top level.
-        opaque_self ||= node.is_a?(Prism::SingletonClassNode) && @opaque_class && new_context.empty?
-        body_self = opaque_self ? Type::Combinator.untyped : self_type_for_class_body(new_context)
+        singleton_body = node.is_a?(Prism::SingletonClassNode)
+        opaque_self ||= singleton_body && @opaque_class && new_context.empty?
+        # Issue #1763 — a `class << self` in a `refine X` block (the refinement frame {#singleton_context_for} built)
+        # opens the refinement module's singleton class, which Rigor does not model, as the `def`s in it already read
+        # ({#self_type_for_method_body}); `Singleton[X]` there checked `self.m` and a local holding `self` against X's
+        # class methods. A `class << X` names X's real singleton class and takes a frame without the flag.
+        untyped_self = opaque_self || (singleton_body && new_context.last&.refinement)
+        body_self = untyped_self ? Type::Combinator.untyped : self_type_for_class_body(new_context)
         fresh = fresh.with_self_type(body_self) if body_self
         # Issue #963 — `self` in a `class << ...` body is the SINGLETON class, which shares the `Singleton[X]`
         # carrier a `class X` body gets. The mark is the only thing that tells the two apart downstream, and a
         # `def` reached from this body clears it by starting from a fresh scope.
-        fresh = fresh.with_singleton_class_body(node.is_a?(Prism::SingletonClassNode))
+        fresh = fresh.with_singleton_class_body(singleton_body)
         fresh = fresh.with_match_frame(node.body)
         fresh = stamp_nesting(fresh, new_nesting)
         sub_eval(node.body, fresh, class_context: new_context, lexical_nesting: new_nesting, opaque_class: opaque_self)
@@ -5254,7 +5485,7 @@ module Rigor
         # then receive the parameter bindings. Slice 7 phase 2: instance defs ALSO seed their `ivars` map from the
         # class-level accumulator so `def get; @x; end` reads the type that a sibling `def init; @x = 1; end` wrote.
         fresh = build_fresh_body_scope
-        body_self = self_type_for_method_body(singleton: singleton)
+        body_self = self_type_for_method_body(singleton: singleton, receiver: def_node.receiver)
         fresh = fresh.with_self_type(body_self) if body_self
         # A `def` opens no new `Module.nesting` entry — the body resolves constants against the chain of the
         # declaration that encloses it, which is what the evaluator is already carrying (#652).
@@ -5389,12 +5620,16 @@ module Rigor
         # chain's throwaway intermediate Scopes were a top `Scope#rebuild` source (ADR-44). Local-empty by design; the
         # discovery index is inherited whole by reference (ADR-53 Track A), so a table added to the index can no longer
         # be dropped here by a missed per-field copy.
+        #
+        # Issue #1667 — a plugin-declared refined block's modules carry into a `def` or class body written in it: CRuby
+        # defines the method with the block's cref, and a class body's cref inherits the outer one's refinements.
         Scope.new(
           environment: scope.environment,
           locals: {}.freeze,
           source_path: scope.source_path,
           discovery: scope.discovery,
-          dynamic_origins: scope.dynamic_origins
+          dynamic_origins: scope.dynamic_origins,
+          declared_refinements: scope.declared_refinements
         )
       end
 
@@ -5444,11 +5679,15 @@ module Rigor
       #   `Nominal[Foo]`.
       #
       # Returns nil for top-level defs that have no enclosing class.
-      def self_type_for_method_body(singleton:)
+      def self_type_for_method_body(singleton:, receiver: nil)
         path = current_class_path
         # Issue #1518 — a `def` in a class nothing names has a receiver, just not one Rigor can type; nil would
         # read its body as the top level and its implicit-self calls as unresolved top-level calls.
         return (Type::Combinator.untyped if @opaque_class) if path.nil?
+        # Issue #1759 — a `def self.m` in a `refine X` block (or a `def m` in a `class << self` there) is a method
+        # of the refinement module, which Rigor does not model; reading it as `Singleton[X]` checked its
+        # explicit-self calls against X's class methods. A `def X.m` there does define X's class method.
+        return Type::Combinator.untyped if singleton && @class_context.last.refinement && refinement_self_def?(receiver)
 
         if singleton
           Type::Combinator.singleton_of(path)
@@ -5457,6 +5696,10 @@ module Rigor
         end
       end
 
+      # Issue #1759 — whether a singleton `def` under a refinement frame defines a method on the refinement module
+      # (`def self.m`, or `def m` in a `class << self`) rather than on an explicitly named receiver (`def X.m`).
+      def refinement_self_def?(receiver) = receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
       def singleton_context_for(node)
         case node.expression
         when Prism::SelfNode
@@ -5464,7 +5707,7 @@ module Rigor
 
           outer = @class_context[0..-2]
           last = @class_context.last
-          outer + [ClassFrame.new(name: last.name, singleton: true)]
+          outer + [ClassFrame.new(name: last.name, singleton: true, refinement: last.refinement)]
         when Prism::ConstantReadNode, Prism::ConstantPathNode
           target = singleton_constant_target(node.expression)
           return @class_context unless target
@@ -5611,6 +5854,7 @@ module Rigor
           class_context: class_context,
           lexical_nesting: lexical_nesting,
           converged_loop_recording: @converged_loop_recording,
+          widen_clauses: @widen_clauses,
           next_scope_sink: next_scope_sink,
           operand_scope: operand_scope,
           in_operand: in_operand,
@@ -5905,8 +6149,7 @@ module Rigor
       # it is frozen, and the dispatcher already projects it (see `DataFolding`).
       def struct_instance_projection(subject_type, method_name, scope, subject_node)
         return nil unless subject_type.is_a?(Type::StructInstance)
-        return nil unless MethodDispatcher::StructMaterialization.materialization_call?(subject_node, subject_type,
-                                                                                        scope)
+        return nil unless MethodDispatcher::StructMaterialization.materialization_call?(subject_node, scope)
 
         case method_name
         when :deconstruct then Type::Combinator.tuple_of(*subject_type.members.values)