rigortype 0.4.2 → 0.4.3

data/lib/rigor/inference/statement_evaluator.rb

@@ -42,8 +42,10 @@ require_relative "operand_effects"
 require_relative "operand_walk"
 require_relative "optimistic_origin"
 require_relative "return_barrier"
+require_relative "repeated_or_writes"
 require_relative "rewrite_mutation"
 require_relative "unknown_store_widening"
+require_relative "untyped_rejoin"
 require_relative "version_guard"
 
 module Rigor
@@ -278,11 +280,15 @@ module Rigor
       #   a declined `class self::X`, a parse-error header), where `class_context` is empty without the code
       #   being at the top level. A `def` (or `class << self`) there runs under an untyped `self` instead of
       #   the top level's nil one, so its implicit-self calls answer `Dynamic` and no top-level rule fires.
+      # @param widen_clauses — issue #1231: when true (and a recorder is installed), a rescue or `ensure` clause
+      #   records its per-node entry scopes under {#widen_clause_entry}'s widening. The check path sets it; every
+      #   other reader of the index (parameter inference, sig-gen, the scanners) keeps the clause's plain entry.
       def initialize(scope:, tracer: nil, on_enter: nil, class_context: [].freeze, # rubocop:disable Metrics/ParameterLists
                      lexical_nesting: EMPTY_NESTING, converged_loop_recording: false, next_scope_sink: nil,
                      operand_scope: nil, in_operand: false, operand_recorder: nil, operand_types: nil,
-                     opaque_class: false)
+                     opaque_class: false, widen_clauses: false)
         @scope = scope
+        @widen_clauses = widen_clauses
         @opaque_class = opaque_class
         @tracer = tracer
         @on_enter = on_enter
@@ -484,9 +490,10 @@ module Rigor
       # `opts[k] ||= raise KeyError` is a guard, never `bot`, and `@flags[n] ||= false` is `true` after an
       # `@flags[n] = true` elsewhere, never provably `false`.
       #
-      # Nor is a site a block-return pass marked (`Scope#repeated_or_write?`, {RepeatedOrWrites}): the pass types
-      # every run of a repeating body from one entry scope, so its slot's gradual type may be what an EARLIER run
-      # stored rather than an absence of evidence.
+      # Nor is a marked site (`Scope#repeated_or_write?`, {RepeatedOrWrites}): a block-return pass, and this
+      # evaluator's statement and write-back passes ({#with_repeated_or_write_marks}), type every run of a repeating
+      # body from one entry scope, so its slot's gradual type may be what an EARLIER run stored rather than an
+      # absence of evidence.
       def index_compound_write_value(node)
         return index_write_stored_type(node, scope) unless node.is_a?(Prism::IndexOrWriteNode)
 
@@ -1180,7 +1187,8 @@ module Rigor
 
         [
           Type::Combinator.union(then_type, else_type),
-          join_with_nil_injection(then_scope, else_scope)
+          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
+                              [node.statements, node.subsequent])
         ]
       end
 
@@ -1215,7 +1223,8 @@ module Rigor
 
         [
           Type::Combinator.union(then_type, else_type),
-          join_with_nil_injection(then_scope, else_scope)
+          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
+                              [node.statements, node.else_clause])
         ]
       end
 
@@ -1286,7 +1295,7 @@ module Rigor
         subject_type, post_pred = node.predicate ? sub_eval(node.predicate, scope) : [nil, scope]
         branch_results, falsey_scope = eval_case_when_branches(subject_type, node.predicate, node.conditions, post_pred)
         if pattern_case_matches_every_path?(node, branch_results)
-          return unmatched_pattern_result(branch_results, node.conditions)
+          return unmatched_pattern_result(branch_results, node.conditions, post_pred)
         end
 
         else_result = eval_case_else(node.else_clause, falsey_scope)
@@ -1295,7 +1304,7 @@ module Rigor
         branch_nodes = [*node.conditions, node.else_clause]
         [
           Type::Combinator.union(*all_results.map(&:first)),
-          join_case_branch_scopes(all_results, branch_nodes)
+          join_case_branch_scopes(all_results, branch_nodes, post_pred)
         ]
       end
 
@@ -1310,8 +1319,9 @@ module Rigor
         node.is_a?(Prism::CaseMatchNode) && node.else_clause.nil? && !branch_results.empty?
       end
 
-      def unmatched_pattern_result(branch_results, branch_nodes)
-        [Type::Combinator.union(*branch_results.map(&:first)), join_case_branch_scopes(branch_results, branch_nodes)]
+      def unmatched_pattern_result(branch_results, branch_nodes, entry)
+        [Type::Combinator.union(*branch_results.map(&:first)),
+         join_case_branch_scopes(branch_results, branch_nodes, entry)]
       end
 
       # Joins the post-scopes of every `when`/`in`/`else` branch, dropping the scope of any branch that terminates
@@ -1320,15 +1330,16 @@ module Rigor
       # `branch_terminates?` rule `eval_if`/`eval_unless` already apply to the if/else merge: e.g. `case x; when 1 then
       # v="a"; when 2 then v="b"; else raise; end` keeps `v: "a" | "b"` instead of `... | nil`. When every branch
       # terminates the merge is itself unreachable; fall back to the full join so the continuation scope stays
-      # well-formed.
-      def join_case_branch_scopes(results, nodes)
+      # well-formed. A local the clauses only narrowed from `Dynamic[top]` re-joins to it ({UntypedRejoin}, issue
+      # #1840), read against the post-predicate `entry`.
+      def join_case_branch_scopes(results, nodes, entry)
         live = []
         results.each_with_index do |(type, branch_scope), i|
           live << branch_scope unless branch_terminates?(nodes[i], type)
         end
 
         live = results.map(&:last) if live.empty?
-        reduce_scopes_with_nil_injection(live)
+        UntypedRejoin.apply(reduce_scopes_with_nil_injection(live), entry, nodes)
       end
 
       def eval_case_when_branches(subject_type, subject, conditions, entry_scope)
@@ -1477,7 +1488,8 @@ module Rigor
         # prefix of the body, and so reads it forgotten whenever the body may set it.
         entry = edge ? forget_guard_if_rebinds(LastLine.forget_if_set(scope, node), node) : scope
         primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge)
-        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry_scope(node, entry), edge: edge)
+        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry_scope(node, entry),
+                                                    edge: edge, writes: rescue_writes(node, edge))
 
         # B2.1 — retry-edge widening. When a `retry` in the rescue chain targets this `begin`, control re-enters the
         # primary body carrying every rebind made before the retry: the arm's (`rescue; tries += 1; retry; end`), and
@@ -1496,13 +1508,132 @@ module Rigor
           exit_scope = reduce_scopes_with_nil_injection([primary_scope, *live_rescues.map(&:last)])
         end
 
-        if node.ensure_clause
-          carry_jumps_through_ensure(node.ensure_clause, jump_marks)
-          _ensure_type, ensure_scope = sub_eval(node.ensure_clause, exit_scope)
-          exit_scope = ensure_scope
+        [exit_type, node.ensure_clause ? eval_begin_ensure(node, exit_scope, jump_marks) : exit_scope]
+      end
+
+      # The scope past `node`'s `ensure` clause, entered with `exit_scope`, the `next` and `break` scopes recorded past
+      # `jump_marks` carried through it.
+      def eval_begin_ensure(node, exit_scope, jump_marks)
+        carry_jumps_through_ensure(node.ensure_clause, jump_marks)
+        eval_widened_clause(node.ensure_clause, node.ensure_clause.statements, exit_scope, ensure_writes(node)).last
+      end
+
+      # Issue #1231 — a rescue clause runs after the body raised from any point in it, and an `ensure` clause after the
+      # body, its `else` or a rescue clause raised as well as after they finished, so a clause reads each local or
+      # instance variable those wrote at a value the scope it enters with does not hold: `conn = nil; begin; conn =
+      # open_conn; Integer(s); rescue; conn.size; end` reads the connection. The engine does not track where the body
+      # raises (the precise recorder of #1397 put new false positives on correct code); it widens instead, and
+      # deliberately imprecisely. Each name the clause mentions ({#clause_mentions}) that its entry binds and those
+      # clauses write, outside a nested `def` or class body, reads as `Dynamic[top]`, which reports nothing. A plain
+      # join would read `x` as `1?` in `x = 1; begin; foo; x = nil; rescue; x.succ; end`, where it cannot be nil, and a
+      # `Dynamic` that keeps the join as its facet still narrows: `x.nil?` on `Dynamic[1 | 2]` leaves a `nil` member
+      # for the next call to report. A name written inside a nested `ensure` clause, which also runs on the way out of
+      # a raise, is covered by the same floor.
+      #
+      # The names the clauses of `node` read from: the primary body's for a rescue clause, none under a retry `edge`.
+      def rescue_writes(node, edge)
+        clause_writes([node.statements]) if node.rescue_clause && edge.nil? && widening_recorded?
+      end
+
+      # For the `ensure` clause: the writes of the body, its `else` and every rescue clause.
+      def ensure_writes(node)
+        return nil unless widening_recorded?
+
+        sources = [node.statements, node.else_clause]
+        current = node.rescue_clause
+        while current
+          sources << current
+          current = current.subsequent
         end
+        clause_writes(sources)
+      end
+
+      # The local and instance variable names `sources` write, a nested block's included (it may write an outer local),
+      # or nil for none. A `def` or class body writes nothing here.
+      def clause_writes(sources)
+        writes = nil
+        sources.each { |source| writes = collect_clause_names(source, CLAUSE_WRITE_NODES, nil, writes) if source }
+        writes
+      end
+
+      CLAUSE_WRITE_NODES = Set[
+        *CapturedLocals::LOCAL_WRITE_NODES,
+        Prism::InstanceVariableWriteNode,
+        Prism::InstanceVariableOperatorWriteNode,
+        Prism::InstanceVariableOrWriteNode,
+        Prism::InstanceVariableAndWriteNode,
+        Prism::InstanceVariableTargetNode
+      ].freeze
+      private_constant :CLAUSE_WRITE_NODES
+
+      CLAUSE_MENTION_NODES = Set[
+        Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, *CLAUSE_WRITE_NODES
+      ].freeze
+      private_constant :CLAUSE_MENTION_NODES
+
+      # The names of the `node_classes` nodes under `node` (restricted to `among` when given) added to `found`, outside
+      # a nested `def` or class body.
+      def collect_clause_names(node, node_classes, among, found)
+        return found if SCOPE_BODY_NODES.any? { |klass| node.is_a?(klass) }
+
+        if node_classes.include?(node.class) && (among.nil? || among.include?(node.name))
+          (found ||= Set.new) << node.name
+        end
+        node.rigor_each_child { |child| found = collect_clause_names(child, node_classes, among, found) }
+        found
+      end
+
+      # `clause_scope` with each name of `writes` that `statements` mentions, and `clause_scope` binds, rebound to
+      # `Dynamic[top]`, or nil when none changes.
+      def widen_clause_entry(clause_scope, statements, writes)
+        return nil if writes.nil? || statements.nil? || !widening_recorded?
+
+        names = collect_clause_names(statements, CLAUSE_MENTION_NODES, writes, nil)
+        return nil if names.nil?
+
+        untyped = Type::Combinator.untyped
+        widened = names.reduce(clause_scope) do |acc, name|
+          kind = name.start_with?("@") ? :ivar : :local
+          current = clause_scope.public_send(VAR_KIND_GETTERS.fetch(kind), name)
+          current.nil? || current == untyped ? acc : rebind_variable(acc, kind, name, untyped)
+        end
+        widened.equal?(clause_scope) ? nil : widened
+      end
 
-        [exit_type, exit_scope]
+      # Whether a widened pass would record anything: only the check path asks for one ({#initialize}'s
+      # `widen_clauses`), and a pass nothing records is skipped, so a nested clause inside an unrecorded pass is
+      # evaluated once.
+      def widening_recorded?
+        @widen_clauses && !(@on_enter.nil? && @operand_recorder.nil?)
+      end
+
+      # `[type, scope]` of a rescue or `ensure` clause entered with `clause_scope`. When {#widen_clause_entry} widens
+      # it, the clause is evaluated twice: under the widened entry for the per-node index, which is what the check
+      # rules read, and under `clause_scope` without recording, for the value and the scope the code after the
+      # `begin` continues from. The widened pass collects no `return`, `next`, `break` or retry-edge scope, so the
+      # widening reaches neither an inferred return nor a loop: it can only take diagnostics away inside the clause.
+      def eval_widened_clause(node, statements, clause_scope, writes)
+        widened = widen_clause_entry(clause_scope, statements, writes)
+        return sub_eval(node, clause_scope) unless widened
+
+        eval_widened_pass(node, widened)
+        sub_eval(node, clause_scope, **UNRECORDED)
+      end
+
+      # The recorded pass over a widened clause: it reaches no `return`, `next`, `break` or retry-frame sink.
+      def eval_widened_pass(node, widened)
+        return if node.nil?
+
+        without_jump_sinks { sub_eval(node, widened, next_scope_sink: nil) }
+      end
+
+      # Runs `block` with no `return`, `next`, `break` or retry-frame sink installed.
+      def without_jump_sinks
+        previous = CLAUSE_SINK_KEYS.map { |key| Thread.current[key] }
+        CLAUSE_SINK_KEYS.each { |key| Thread.current[key] = nil }
+        yield
+      ensure
+        CLAUSE_SINK_KEYS.zip(previous).each { |key, value| Thread.current[key] = value } if previous
       end
 
       # The scope a rescue clause of `node` enters with: it runs after any prefix of the body, so neither a `$_`
@@ -1600,6 +1731,10 @@ module Rigor
       RETRY_FRAMES_KEY = :rigor_retry_frames
       private_constant :RETRY_FRAMES_KEY
 
+      # The thread-local sinks a widened clause pass ({#without_jump_sinks}) leaves uninstalled.
+      CLAUSE_SINK_KEYS = [RETURN_SINK_KEY, NEXT_SINK_KEY, BREAK_SINK_KEY, BREAK_VALUE_SINK_KEY, RETRY_FRAMES_KEY].freeze
+      private_constant :CLAUSE_SINK_KEYS
+
       # The retry edge of `node`, or nil when no `retry` in its rescue chain targets it. Allocation-free for a `begin`
       # no `retry` targets.
       def retry_edge_for(node)
@@ -1876,13 +2011,23 @@ module Rigor
       # each arm holding one. The latter still carries a rebind the `retry` itself does not see: a write an `ensure`
       # runs on the way out (`begin; retry; ensure; tries += 1; end`), or one made before a `retry` the evaluator only
       # types (`log(tries < 5 ? retry : :gave_up)`).
-      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil)
+      #
+      # Issue #1231 — `writes` widens the scope each clause enters with, as {#eval_widened_clause} does, before its
+      # reference is bound, so `rescue => e` still binds `e` to the exception. It is nil under a retry edge, which
+      # already carries every scope the primary body raises from ({#widen_entry_for_retry}).
+      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil, writes: nil)
         on_enter = edge ? retry_scope_recorder(edge) : @on_enter
         results = []
         current = rescue_node
         while current
+          widened = widen_clause_entry(entry_scope, current.statements, writes)
+          eval_widened_pass(current.statements, bind_rescue_reference(current, widened)) if widened
           rescue_scope = bind_rescue_reference(current, entry_scope)
-          arm = eval_branch_or_nil(current.statements, rescue_scope, on_enter: on_enter)
+          arm = if widened
+                  sub_eval(current.statements, rescue_scope, **UNRECORDED)
+                else
+                  eval_branch_or_nil(current.statements, rescue_scope, on_enter: on_enter)
+                end
           edge.retry_scopes << arm.last if edge&.retrying_arms&.include?(current)
           results << [arm, current]
           current = current.subsequent
@@ -1952,7 +2097,7 @@ module Rigor
         # the single-pass join before returning.
         if names.empty?
           fast = loop_content_writeback(node.statements, base_scope, pre_body: post_pred)
-          return [Type::Combinator.constant_of(nil), narrow_loop_exit_edge(node, fast)]
+          return [Type::Combinator.constant_of(nil), loop_exit(node, post_pred, fast)]
         end
 
         post_loop = converged_loop_scope(node, post_pred, base_scope, names, body_first, jumps)
@@ -1961,7 +2106,7 @@ module Rigor
         # :idle` under `end while state != :idle`) is dead in every converged pass. The single pass runs from the
         # un-narrowed post-predicate scope, so its arms stand in for that first iteration.
         post_loop = join_break_scopes(post_loop, first_breaks, names) if node.begin_modifier?
-        post_loop = narrow_loop_exit_edge(node, post_loop)
+        post_loop = loop_exit(node, post_pred, post_loop)
         [Type::Combinator.constant_of(nil), post_loop]
       end
 
@@ -2048,6 +2193,12 @@ module Rigor
         join_break_scopes(post_loop, arms, names)
       end
 
+      # A loop's continuation: a local its body and predicate only narrowed from `Dynamic[top]` re-joins to it
+      # ({UntypedRejoin}, issue #1840), then the exit edge narrows.
+      def loop_exit(node, post_pred, post_loop)
+        narrow_loop_exit_edge(node, UntypedRejoin.apply(post_loop, post_pred, [node.predicate, node.statements]))
+      end
+
       # Item 4 — loop-exit predicate narrowing. A `while pred` / `until pred` loop exits PRECISELY on the predicate's
       # exit edge: `while` exits when `pred` is falsey, `until` when `pred` is truthy. So after the loop the
       # predicate-assignment target carries the exit polarity — `until line = io.gets; …; end; line.foo` reads `line`
@@ -2379,6 +2530,12 @@ module Rigor
         stores
       end
 
+      # A `for` loop's continuation, with a local the body only narrowed from `Dynamic[top]` re-joined to it
+      # ({UntypedRejoin}, issue #1840). The index is written on every iteration.
+      def for_exit(node, post_coll, continuation)
+        UntypedRejoin.apply(continuation, post_coll, [node.index, node.statements])
+      end
+
       # `for index in collection; body; end`. Unlike `each {}` blocks, `for` does NOT create a new variable scope: the
       # index variable AND every local written in the body leak to the surrounding scope. The collection is evaluated
       # once; the body runs zero or more times, so the post-loop scope is the join of the no-iteration scope (just
@@ -2405,7 +2562,7 @@ module Rigor
         continuation = join_with_nil_injection(post_coll, body_scope)
         pre_existing, body_first = loop_body_local_writes(node.statements, post_coll)
         continuation = join_break_scopes(continuation, breaks, pre_existing + body_first)
-        [Type::Combinator.constant_of(nil), continuation]
+        [Type::Combinator.constant_of(nil), for_exit(node, post_coll, continuation)]
       end
 
       # Issue #1429 — a `for` body runs after the collection's `each`, which may be a project method, and after itself.
@@ -2565,7 +2722,7 @@ module Rigor
 
         # A dead RHS is still evaluated and its scope still joins, so a write inside it nil-injects exactly as
         # before; only its value is dropped, because it cannot be the value of the expression.
-        joined_scope = join_with_nil_injection(left_scope, right_scope)
+        joined_scope = UntypedRejoin.apply(join_with_nil_injection(left_scope, right_scope), left_scope, [node.right])
         type = skipped_type
         type = Type::Combinator.union(skipped_type, right_type) unless right_operand_dead?(node, left_type, left_scope)
         return [type, joined_scope] unless edges
@@ -3013,7 +3170,7 @@ module Rigor
         # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts). See
         # [`docs/CURRENT_WORK.md`](../../../docs/CURRENT_WORK.md) § "Flow-folding" — G2 intervening-call case.
         post_scope = invalidate_ivars_for_intervening_call(node, post_scope) if statement_call
-        # C1 — regex match-data globals (`$~`, `$1..$9`, `$&`, …) are narrowed to non-nil on a successful-match edge; a
+        # C1 — regex match-data globals (`$~`, `$1..$N`, `$&`, …) are narrowed to non-nil on a successful-match edge; a
         # later call that itself runs a regex match rebinds them, so the narrowed facts must be dropped. We forget them
         # only when the call may run a match in this frame ({#rebinds_match_globals?}). A call provably match-free on a
         # known receiver — `$3.to_i`, `year < 50` — does NOT clobber, so the multi-statement `m = /…/ =~ s; …; use($2)`
@@ -3542,7 +3699,9 @@ module Rigor
       end
 
       def enter_call_block(node, block)
-        block_entry = narrow_define_method_block_self(node, repeating_block_entry(node, block))
+        block_entry = narrow_define_method_block_self(
+          node, with_repeated_or_write_marks(node, block, repeating_block_entry(node, block))
+        )
         # #319 — `Class.new do ... end` and friends evaluate their block as a CLASS BODY (`class_eval`
         # semantics): `self` is the freshly created class, so a `def` inside defines an instance method on it
         # and `attr_reader` runs as a class-level macro. Enter the block under the same `self_type` /
@@ -4142,7 +4301,7 @@ module Rigor
       # The `break` scopes of one unrecorded pass from `converged` — for a capped fixpoint, whose widened binding no
       # pass has run from.
       def converged_break_arms(call_node, block, converged, targets)
-        entry = block_pass_entry(call_node, block, converged)
+        entry = with_repeated_or_write_marks(call_node, block, block_pass_entry(call_node, block, converged))
         sink, = collect_break_scopes { sub_eval(block, entry, **UNRECORDED) }
         targeted_scopes(sink, targets)
       end
@@ -4942,7 +5101,8 @@ module Rigor
       # params / `;`-locals re-bound as usual) and returns the per-name exit binding for `names`. Used as the
       # `BodyFixpoint` body-evaluator.
       def block_exit_bindings(call_node, block, bindings, names)
-        _type, exit_scope = sub_eval(block, block_pass_entry(call_node, block, bindings))
+        entry = with_repeated_or_write_marks(call_node, block, block_pass_entry(call_node, block, bindings))
+        _type, exit_scope = sub_eval(block, entry)
         names.to_h { |name| [name, CapturedLocals.bound_type(exit_scope, name)] }
       end
 
@@ -4958,6 +5118,38 @@ module Rigor
         end
       end
 
+      # Issue #1336 — `entry` with the index `||=` sites of a repeating block marked as the generic block-return pass
+      # marks them ({RepeatedOrWrites}, `Scope#with_repeated_or_writes`). The statement pass and every ADR-56
+      # write-back pass type the body from one entry scope just as that pass does, so a slot an earlier run stored
+      # into reads as a lone `Dynamic` there too, and the memoizing reading ({#index_compound_write_value}) answered
+      # one site's rvalue: `last = (cache[:k] ||= :f).itself` beside a `cache[:k] ||= :e` wrote `:f` alone back
+      # into `last`, and `last == :e` folded always-falsey. A call that runs its block at most once marks nothing.
+      def with_repeated_or_write_marks(call_node, block, entry)
+        sites = repeated_or_write_sites(call_node, block)
+        sites.empty? ? entry : entry.with_repeated_or_writes(sites)
+      end
+
+      # The sites {#with_repeated_or_write_marks} lays, once per block: a body that spells no `||=` — nearly every
+      # one — answers none without the repetition question.
+      def repeated_or_write_sites(call_node, block)
+        memo = (@repeated_or_write_sites ||= {}.compare_by_identity)
+        return memo[block] if memo.key?(block)
+
+        memo[block] = compute_repeated_or_write_sites(call_node, block)
+      end
+
+      def compute_repeated_or_write_sites(call_node, block)
+        body = block.body
+        return NO_REPEATED_OR_WRITES if body.nil? || !RepeatedOrWrites.may_hold_or_write?(body)
+        return NO_REPEATED_OR_WRITES if repeating_block_class(call_node).nil?
+
+        stores = CapturedLocals.content_mutations(block, scope, non_locals: true)
+        RepeatedOrWrites.sites(block, stores, scope).at(nil)
+      end
+
+      NO_REPEATED_OR_WRITES = [].freeze
+      private_constant :NO_REPEATED_OR_WRITES
+
       NO_CAPTURE_BINDINGS = {}.freeze
       private_constant :NO_CAPTURE_BINDINGS
 
@@ -5662,6 +5854,7 @@ module Rigor
           class_context: class_context,
           lexical_nesting: lexical_nesting,
           converged_loop_recording: @converged_loop_recording,
+          widen_clauses: @widen_clauses,
           next_scope_sink: next_scope_sink,
           operand_scope: operand_scope,
           in_operand: in_operand,
@@ -5956,8 +6149,7 @@ module Rigor
       # it is frozen, and the dispatcher already projects it (see `DataFolding`).
       def struct_instance_projection(subject_type, method_name, scope, subject_node)
         return nil unless subject_type.is_a?(Type::StructInstance)
-        return nil unless MethodDispatcher::StructMaterialization.materialization_call?(subject_node, subject_type,
-                                                                                        scope)
+        return nil unless MethodDispatcher::StructMaterialization.materialization_call?(subject_node, scope)
 
         case method_name
         when :deconstruct then Type::Combinator.tuple_of(*subject_type.members.values)

data/lib/rigor/inference/untyped_rejoin.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require_relative "../type"
+require_relative "../source/node_walker"
+require_relative "captured_locals"
+
+module Rigor
+  module Inference
+    # Issue #1840 — a branch merge that re-joins the narrowed edges of an untyped local gives it back its
+    # untyped binding.
+    #
+    # Flow narrowing concretizes a `Dynamic[top]` receiver (ADR-83): `x.nil?` splits it into `nil` and
+    # `Dynamic[top]`, and `when String` into `String` and `Dynamic[top]`. `Scope#join` unions the edges, so
+    # after both merges the local reads `Dynamic[top] | String | nil`. That union is not wrong as a set, but
+    # every member is a narrowing of the one untyped value, so it says nothing the pre-branch binding did
+    # not. It does, however, hold `nil` beside a nameable class, and `call.possible-nil-receiver` reports
+    # `x + "a"` on correct code although neither narrowing alone did.
+    #
+    # The rule: at a merge, a local whose pre-branch binding is exactly `Dynamic[top]`, that no merged arm
+    # writes, and whose joined binding is a union still carrying a `Dynamic` member, is bound to
+    # `Dynamic[top]` again.
+    #
+    # - The write test keeps a nil the program puts there: `x = nil if c` writes `x`, so the join stays
+    #   `Dynamic[top] | nil` and still reports. It is syntactic, over every local-write form under the arms
+    #   (a pattern capture and a block's write to the outer local included), so a doubtful arm keeps today's
+    #   join. It does not see a written nil that a `nil?` edge stripped before the merge (`x = nil if c; if
+    #   x.nil? … elsif x.is_a?(String) … end`): that merge's entry is exactly `Dynamic[top]`, and the outer
+    #   join's `Dynamic[top] | nil` is one the possible-nil gate declines anyway (#1876).
+    # - The `Dynamic`-member test keeps a narrowing whose surviving arms no longer cover the untyped value:
+    #   `case x when String then … when Integer then … else raise end` leaves `Integer | String`, which is
+    #   what `x` is past it.
+    # - Only the `Dynamic[top]` facet: a faceted `Dynamic[T]` carries static knowledge of its own (a
+    #   plugin's or a signature's `T`), so a `nil` its narrowing leaves may be one the facet promised. Those
+    #   keep today's join.
+    #
+    # Restoring `Dynamic[top]` is always sound, since every narrowed edge is a subset of it; what it drops
+    # is only the nameable arms, which an untyped union never needed to dispatch.
+    module UntypedRejoin
+      module_function
+
+      # `joined` with each qualifying local rebound to its `entry` binding. `arms` are the nodes whose
+      # evaluation produced the merged scopes (`nil` entries are skipped).
+      def apply(joined, entry, arms)
+        candidates = nil
+        joined.locals.each do |name, type|
+          next unless candidate?(entry.locals[name], type)
+
+          (candidates ||= []) << name
+        end
+        return joined if candidates.nil?
+
+        written = written_locals(arms)
+        kept = candidates.reject { |name| written.include?(name) }
+        return joined if kept.empty?
+
+        joined.with_rejoined_locals(kept.to_h { |name| [name, entry.locals[name]] })
+      end
+
+      def candidate?(entry_type, joined_type)
+        entry_type.is_a?(Type::Dynamic) && entry_type.static_facet.is_a?(Type::Top) &&
+          joined_type.is_a?(Type::Union) && joined_type.members.any?(Type::Dynamic)
+      end
+
+      def written_locals(arms)
+        names = Set.new
+        arms.each do |arm|
+          Source::NodeWalker.each(arm) do |node|
+            names << node.name if CapturedLocals::LOCAL_WRITE_NODES.include?(node.class)
+          end
+        end
+        names
+      end
+    end
+  end
+end

data/lib/rigor/language_server/project_context.rb

@@ -6,6 +6,7 @@ require_relative "../cache/store"
 require_relative "../analysis/runner"
 require_relative "../analysis/incremental_session"
 require_relative "../cache/incremental_snapshot"
+require_relative "../effects/identity"
 
 module Rigor
   module LanguageServer
@@ -24,6 +25,10 @@ module Rigor
     # are small (the per-publish path is already ≈2ms once Environment is warm).
     #
     # Invalidation:
+    # - Every whole-project round (`#project_diagnostics`) re-reads the configuration and compares the
+    #   incremental snapshot fingerprint and the `effects:` identity with the ones its session was primed with,
+    #   re-baselining on any change — so no file watcher or `didChangeConfiguration` is needed for
+    #   `.rigor.yml`, `sig/`, `pre_eval:` or lockfile edits (#1613).
     # - `#invalidate!` drops the cached environment AND project scan + bumps the generation counter; the next
     #   reader rebuilds. Watched-file changes (`workspace/didChangeWatchedFiles`) and configuration refreshes
     #   (`workspace/didChangeConfiguration`) both trigger this — the next publish observes the new project
@@ -44,8 +49,13 @@ module Rigor
       # invalidated never reach the editor.
       attr_reader :configuration, :generation
 
-      def initialize(configuration:)
+      # `configuration_loader` re-reads the configuration (e.g. `-> { Configuration.load(path) }`); a save round
+      # calls it so an edit to `.rigor.yml` (or a file it `includes:`) reaches the server without a restart. Nil
+      # keeps the configuration the context was built with.
+      def initialize(configuration:, configuration_loader: nil)
         @configuration = configuration
+        @configuration_loader = configuration_loader
+        @primed_key = nil
         @buffer_sources = {}
         @disk_feature_files = nil
         @environment_features = nil
@@ -110,16 +120,31 @@ module Rigor
       # The session is never persisted. Its state lives as long as this context, which is what a long-running
       # server needs, and writing it would race exactly the way the read-only {#cache_store} exists to avoid.
       # Seeding is therefore one-directional: the terminal warms the server, not the reverse.
+      #
+      # Every round recomputes {Cache::IncrementalSnapshot.fingerprint} (the function the CLI's `--incremental`
+      # keys its snapshot on — one input list) and compares it with the one the session was primed with. A
+      # session's recheck only sees source-file digests, so an edit to a `pre_eval:` file, an auto-detected
+      # `sig/*.rbs`, a lockfile or `.rigor.yml` would otherwise keep serving answers computed from the old
+      # inputs until the server restarts (#1613). A change — including a fingerprint that newly cannot be
+      # computed — drops the session and the world built from the old inputs and re-baselines, so the round equals
+      # a cold run. The `effects:` identity rides along because `Configuration#to_h` omits `effects:`, so the
+      # fingerprint alone does not move on an `effects:` edit. A fingerprint that was ALREADY uncomputable at
+      # priming is not a change: that session keeps rechecking.
+      # {#generation} is deliberately NOT bumped: the round that notices the change is itself computed from the
+      # new inputs, and the publisher discards a round whose generation moved.
       def project_diagnostics
+        reload_configuration
+        fingerprint = current_fingerprint
+        key = [fingerprint, Effects::Identity.digest(configuration: @configuration)]
+        rebaseline if @session_primed && key != @primed_key
         session = (@incremental_session ||= build_incremental_session)
         return session.recheck.diagnostics if @session_primed
 
         @session_primed = true
+        @primed_key = key
         diagnostics, = session.run_incremental(
           snapshot: Cache::IncrementalSnapshot.new(root: @configuration.cache_path),
-          fingerprint: Cache::IncrementalSnapshot.fingerprint(
-            configuration: @configuration, roots: @configuration.paths
-          ),
+          fingerprint: fingerprint,
           persist: false
         )
         diagnostics
@@ -153,6 +178,13 @@ module Rigor
       # `workspace/didChangeConfiguration`.
       def invalidate!
         @generation += 1
+        reset_world
+      end
+
+      private
+
+      # Drops what was built from the previous inputs, without touching {#generation}.
+      def reset_world
         @environment = nil
         @environment_features = nil
         @disk_feature_files = nil
@@ -161,12 +193,31 @@ module Rigor
         # outlive them. The next save round primes a fresh one.
         @incremental_session = nil
         @session_primed = false
+        @primed_key = nil
         # Cache store stays — it's content-addressed; a stale env build won't be served because the file
         # digest mixed into the cache key has changed.
         nil
       end
 
-      private
+      # A changed configuration may also move `cache_path`, so the store goes too (unlike {#invalidate!}).
+      def rebaseline
+        reset_world
+        @cache_store = nil
+      end
+
+      def current_fingerprint
+        Cache::IncrementalSnapshot.fingerprint(configuration: @configuration, roots: @configuration.paths)
+      end
+
+      # A load that raises (a half-typed `.rigor.yml`) keeps the previous configuration: the editor must not
+      # lose its diagnostics to a transient parse error, and the next round retries.
+      def reload_configuration
+        return unless @configuration_loader
+
+        @configuration = @configuration_loader.call
+      rescue StandardError
+        nil
+      end
 
       # The session shares this context's warm Environment, so a round does not rebuild the RBS universe. It
       # deliberately does NOT share the prebuilt ProjectScan: a round runs after a save, i.e. after the file