rigortype 0.4.2 → 0.4.4

data/lib/rigor/inference/statement_evaluator.rb

@@ -27,6 +27,7 @@ require_relative "content_join"
 require_relative "define_method_block_self"
 require_relative "macro_block_self_type"
 require_relative "guard_rebinding"
+require_relative "self_call_ivar_writes"
 require_relative "match_rebinding"
 require_relative "element_read_widening"
 require_relative "hash_lookup_mutation"
@@ -42,8 +43,10 @@ require_relative "operand_effects"
 require_relative "operand_walk"
 require_relative "optimistic_origin"
 require_relative "return_barrier"
+require_relative "repeated_or_writes"
 require_relative "rewrite_mutation"
 require_relative "unknown_store_widening"
+require_relative "untyped_rejoin"
 require_relative "version_guard"
 
 module Rigor
@@ -121,9 +124,9 @@ module Rigor
         Prism::BeginNode => :eval_begin_node,
         Prism::RescueNode => :eval_rescue,
         Prism::EnsureNode => :eval_ensure,
-        Prism::WhileNode => :eval_loop,
-        Prism::UntilNode => :eval_loop,
-        Prism::ForNode => :eval_for,
+        Prism::WhileNode => :eval_repeating_loop,
+        Prism::UntilNode => :eval_repeating_loop,
+        Prism::ForNode => :eval_repeating_for,
         Prism::AndNode => :eval_and_or,
         Prism::OrNode => :eval_and_or,
         Prism::ParenthesesNode => :eval_parentheses,
@@ -278,11 +281,15 @@ module Rigor
       #   a declined `class self::X`, a parse-error header), where `class_context` is empty without the code
       #   being at the top level. A `def` (or `class << self`) there runs under an untyped `self` instead of
       #   the top level's nil one, so its implicit-self calls answer `Dynamic` and no top-level rule fires.
+      # @param widen_clauses — issue #1231: when true (and a recorder is installed), a rescue or `ensure` clause
+      #   records its per-node entry scopes under {#widen_clause_entry}'s widening. The check path sets it; every
+      #   other reader of the index (parameter inference, sig-gen, the scanners) keeps the clause's plain entry.
       def initialize(scope:, tracer: nil, on_enter: nil, class_context: [].freeze, # rubocop:disable Metrics/ParameterLists
                      lexical_nesting: EMPTY_NESTING, converged_loop_recording: false, next_scope_sink: nil,
                      operand_scope: nil, in_operand: false, operand_recorder: nil, operand_types: nil,
-                     opaque_class: false)
+                     opaque_class: false, widen_clauses: false)
         @scope = scope
+        @widen_clauses = widen_clauses
         @opaque_class = opaque_class
         @tracer = tracer
         @on_enter = on_enter
@@ -484,9 +491,10 @@ module Rigor
       # `opts[k] ||= raise KeyError` is a guard, never `bot`, and `@flags[n] ||= false` is `true` after an
       # `@flags[n] = true` elsewhere, never provably `false`.
       #
-      # Nor is a site a block-return pass marked (`Scope#repeated_or_write?`, {RepeatedOrWrites}): the pass types
-      # every run of a repeating body from one entry scope, so its slot's gradual type may be what an EARLIER run
-      # stored rather than an absence of evidence.
+      # Nor is a marked site (`Scope#repeated_or_write?`, {RepeatedOrWrites}): a block-return pass, and this
+      # evaluator's statement and write-back passes ({#with_repeated_or_write_marks}), type every run of a repeating
+      # body from one entry scope, so its slot's gradual type may be what an EARLIER run stored rather than an
+      # absence of evidence.
       def index_compound_write_value(node)
         return index_write_stored_type(node, scope) unless node.is_a?(Prism::IndexOrWriteNode)
 
@@ -518,10 +526,13 @@ module Rigor
         [result_type, current]
       end
 
+      # The top level is a straight-line body: an index `||=` there whose slot an earlier store may have filled is
+      # marked ({RepeatedOrWrites.straight_line_sites}).
       def eval_program(node)
         return [Type::Combinator.constant_of(nil), scope] if node.statements.nil?
 
-        sub_eval(node.statements, scope)
+        marks = RepeatedOrWrites.straight_line_sites(node.statements, scope)
+        sub_eval(node.statements, scope.with_repeated_or_writes(marks))
       end
 
       # `name = rvalue` evaluates the rvalue under the entry scope (so earlier assignments in a chained `a = b = expr`
@@ -1180,7 +1191,8 @@ module Rigor
 
         [
           Type::Combinator.union(then_type, else_type),
-          join_with_nil_injection(then_scope, else_scope)
+          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
+                              [node.statements, node.subsequent])
         ]
       end
 
@@ -1215,7 +1227,8 @@ module Rigor
 
         [
           Type::Combinator.union(then_type, else_type),
-          join_with_nil_injection(then_scope, else_scope)
+          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
+                              [node.statements, node.else_clause])
         ]
       end
 
@@ -1286,7 +1299,7 @@ module Rigor
         subject_type, post_pred = node.predicate ? sub_eval(node.predicate, scope) : [nil, scope]
         branch_results, falsey_scope = eval_case_when_branches(subject_type, node.predicate, node.conditions, post_pred)
         if pattern_case_matches_every_path?(node, branch_results)
-          return unmatched_pattern_result(branch_results, node.conditions)
+          return unmatched_pattern_result(branch_results, node.conditions, post_pred)
         end
 
         else_result = eval_case_else(node.else_clause, falsey_scope)
@@ -1295,7 +1308,7 @@ module Rigor
         branch_nodes = [*node.conditions, node.else_clause]
         [
           Type::Combinator.union(*all_results.map(&:first)),
-          join_case_branch_scopes(all_results, branch_nodes)
+          join_case_branch_scopes(all_results, branch_nodes, post_pred)
         ]
       end
 
@@ -1310,8 +1323,9 @@ module Rigor
         node.is_a?(Prism::CaseMatchNode) && node.else_clause.nil? && !branch_results.empty?
       end
 
-      def unmatched_pattern_result(branch_results, branch_nodes)
-        [Type::Combinator.union(*branch_results.map(&:first)), join_case_branch_scopes(branch_results, branch_nodes)]
+      def unmatched_pattern_result(branch_results, branch_nodes, entry)
+        [Type::Combinator.union(*branch_results.map(&:first)),
+         join_case_branch_scopes(branch_results, branch_nodes, entry)]
       end
 
       # Joins the post-scopes of every `when`/`in`/`else` branch, dropping the scope of any branch that terminates
@@ -1320,15 +1334,16 @@ module Rigor
       # `branch_terminates?` rule `eval_if`/`eval_unless` already apply to the if/else merge: e.g. `case x; when 1 then
       # v="a"; when 2 then v="b"; else raise; end` keeps `v: "a" | "b"` instead of `... | nil`. When every branch
       # terminates the merge is itself unreachable; fall back to the full join so the continuation scope stays
-      # well-formed.
-      def join_case_branch_scopes(results, nodes)
+      # well-formed. A local the clauses only narrowed from `Dynamic[top]` re-joins to it ({UntypedRejoin}, issue
+      # #1840), read against the post-predicate `entry`.
+      def join_case_branch_scopes(results, nodes, entry)
         live = []
         results.each_with_index do |(type, branch_scope), i|
           live << branch_scope unless branch_terminates?(nodes[i], type)
         end
 
         live = results.map(&:last) if live.empty?
-        reduce_scopes_with_nil_injection(live)
+        UntypedRejoin.apply(reduce_scopes_with_nil_injection(live), entry, nodes)
       end
 
       def eval_case_when_branches(subject_type, subject, conditions, entry_scope)
@@ -1369,46 +1384,46 @@ module Rigor
       end
 
       # Returns `[body_scope, updated_falsey_scope]` for a single branch. `WhenNode` branches narrow through
-      # `Narrowing.case_when_scopes`. `InNode` branches narrow soundly only for a bare class pattern (`in C` / `in C =>
-      # x`, pure `is_a?`); every other pattern keeps the conservative "body = entry + bindings, falsey unchanged" shape.
-      # `subject_type` is the predicate's type, which an `in` branch's pattern decomposes to type the names it binds.
+      # `Narrowing.case_when_scopes`, or through {#subjectless_when_scopes} in a `case` without a subject. `InNode`
+      # branches narrow soundly only for a bare class pattern (`in C` / `in C => x`, pure `is_a?`); every other pattern
+      # keeps the conservative "body = entry + bindings, falsey unchanged" shape. `subject_type` is the predicate's
+      # type, which an `in` branch's pattern decomposes to type the names it binds.
       def branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
         if branch.is_a?(Prism::InNode)
           in_branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
+        elsif subject.nil?
+          subjectless_when_scopes(branch.conditions, falsey_scope)
         else
           when_conditions = branch.respond_to?(:conditions) ? branch.conditions : []
           Narrowing.case_when_scopes(subject, when_conditions, falsey_scope)
         end
       end
 
+      # Issue #1495 — a `case` without a subject tests each `when` condition for truthiness, in order, and stops at the
+      # first truthy one, so a clause is the `||` of its conditions in an `if` / `elsif` chain. Each condition is
+      # evaluated under the falsey edges of the conditions before it, in this clause and every earlier one; the body
+      # joins the conditions' truthy edges, and the next clause starts from the last falsey edge. A condition
+      # `Narrowing.predicate_scopes` does not recognise narrows nothing: a splat (`when *conds`), and a regexp literal,
+      # which is tested for its truthiness and matches nothing, so it binds no match global (#1486).
+      def subjectless_when_scopes(conditions, entry)
+        falsey = entry
+        truthy_edges = conditions.map do |condition|
+          _type, _post, truthy, falsey = eval_with_edges(condition, falsey)
+          truthy
+        end
+        [reduce_scopes_with_nil_injection(truthy_edges), falsey]
+      end
+
       # ADR-47 WD3a — a bare class pattern matches on `C === subject`, i.e. exactly `subject.is_a?(C)` with no
       # deconstruction, so it narrows like `when C`: the body sees the subject narrowed to `C` and the next clause's
       # falsey scope has `C` removed. Other patterns can fail to match even when a class test would pass (deconstruction
       # arity, hash keys, ...), so removing anything from the falsey scope would be unsound — they keep the conservative
       # shape.
       def in_branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
-        class_node = bare_class_pattern_node(branch.pattern)
-        unless class_node
-          bound = apply_in_pattern_bindings(subject_type, subject, branch.pattern, falsey_scope)
-          return [bound, falsey_scope]
-        end
-
-        truthy_scope, narrowed_falsey = Narrowing.case_when_scopes(subject, [class_node], falsey_scope)
+        truthy_scope, narrowed_falsey = Narrowing.case_clause_scopes(subject, branch, falsey_scope)
         [apply_in_pattern_bindings(subject_type, subject, branch.pattern, truthy_scope), narrowed_falsey]
       end
 
-      # The class-constant node of a `in C` / `in C => x` pattern (the only `in` shapes whose match is pure `is_a?`), or
-      # nil for any pattern that deconstructs, binds, or matches a value.
-      def bare_class_pattern_node(pattern)
-        case pattern
-        when Prism::ConstantReadNode, Prism::ConstantPathNode
-          pattern
-        when Prism::CapturePatternNode
-          value = pattern.value
-          value if value.is_a?(Prism::ConstantReadNode) || value.is_a?(Prism::ConstantPathNode)
-        end
-      end
-
       def eval_case_else(else_clause, falsey_scope)
         return sub_eval(else_clause, falsey_scope) if else_clause
 
@@ -1477,7 +1492,8 @@ module Rigor
         # prefix of the body, and so reads it forgotten whenever the body may set it.
         entry = edge ? forget_guard_if_rebinds(LastLine.forget_if_set(scope, node), node) : scope
         primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge)
-        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry_scope(node, entry), edge: edge)
+        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry_scope(node, entry),
+                                                    edge: edge, writes: rescue_writes(node, edge))
 
         # B2.1 — retry-edge widening. When a `retry` in the rescue chain targets this `begin`, control re-enters the
         # primary body carrying every rebind made before the retry: the arm's (`rescue; tries += 1; retry; end`), and
@@ -1496,13 +1512,132 @@ module Rigor
           exit_scope = reduce_scopes_with_nil_injection([primary_scope, *live_rescues.map(&:last)])
         end
 
-        if node.ensure_clause
-          carry_jumps_through_ensure(node.ensure_clause, jump_marks)
-          _ensure_type, ensure_scope = sub_eval(node.ensure_clause, exit_scope)
-          exit_scope = ensure_scope
+        [exit_type, node.ensure_clause ? eval_begin_ensure(node, exit_scope, jump_marks) : exit_scope]
+      end
+
+      # The scope past `node`'s `ensure` clause, entered with `exit_scope`, the `next` and `break` scopes recorded past
+      # `jump_marks` carried through it.
+      def eval_begin_ensure(node, exit_scope, jump_marks)
+        carry_jumps_through_ensure(node.ensure_clause, jump_marks)
+        eval_widened_clause(node.ensure_clause, node.ensure_clause.statements, exit_scope, ensure_writes(node)).last
+      end
+
+      # Issue #1231 — a rescue clause runs after the body raised from any point in it, and an `ensure` clause after the
+      # body, its `else` or a rescue clause raised as well as after they finished, so a clause reads each local or
+      # instance variable those wrote at a value the scope it enters with does not hold: `conn = nil; begin; conn =
+      # open_conn; Integer(s); rescue; conn.size; end` reads the connection. The engine does not track where the body
+      # raises (the precise recorder of #1397 put new false positives on correct code); it widens instead, and
+      # deliberately imprecisely. Each name the clause mentions ({#clause_mentions}) that its entry binds and those
+      # clauses write, outside a nested `def` or class body, reads as `Dynamic[top]`, which reports nothing. A plain
+      # join would read `x` as `1?` in `x = 1; begin; foo; x = nil; rescue; x.succ; end`, where it cannot be nil, and a
+      # `Dynamic` that keeps the join as its facet still narrows: `x.nil?` on `Dynamic[1 | 2]` leaves a `nil` member
+      # for the next call to report. A name written inside a nested `ensure` clause, which also runs on the way out of
+      # a raise, is covered by the same floor.
+      #
+      # The names the clauses of `node` read from: the primary body's for a rescue clause, none under a retry `edge`.
+      def rescue_writes(node, edge)
+        clause_writes([node.statements]) if node.rescue_clause && edge.nil? && widening_recorded?
+      end
+
+      # For the `ensure` clause: the writes of the body, its `else` and every rescue clause.
+      def ensure_writes(node)
+        return nil unless widening_recorded?
+
+        sources = [node.statements, node.else_clause]
+        current = node.rescue_clause
+        while current
+          sources << current
+          current = current.subsequent
+        end
+        clause_writes(sources)
+      end
+
+      # The local and instance variable names `sources` write, a nested block's included (it may write an outer local),
+      # or nil for none. A `def` or class body writes nothing here.
+      def clause_writes(sources)
+        writes = nil
+        sources.each { |source| writes = collect_clause_names(source, CLAUSE_WRITE_NODES, nil, writes) if source }
+        writes
+      end
+
+      CLAUSE_WRITE_NODES = Set[
+        *CapturedLocals::LOCAL_WRITE_NODES,
+        Prism::InstanceVariableWriteNode,
+        Prism::InstanceVariableOperatorWriteNode,
+        Prism::InstanceVariableOrWriteNode,
+        Prism::InstanceVariableAndWriteNode,
+        Prism::InstanceVariableTargetNode
+      ].freeze
+      private_constant :CLAUSE_WRITE_NODES
+
+      CLAUSE_MENTION_NODES = Set[
+        Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, *CLAUSE_WRITE_NODES
+      ].freeze
+      private_constant :CLAUSE_MENTION_NODES
+
+      # The names of the `node_classes` nodes under `node` (restricted to `among` when given) added to `found`, outside
+      # a nested `def` or class body.
+      def collect_clause_names(node, node_classes, among, found)
+        return found if SCOPE_BODY_NODES.any? { |klass| node.is_a?(klass) }
+
+        if node_classes.include?(node.class) && (among.nil? || among.include?(node.name))
+          (found ||= Set.new) << node.name
         end
+        node.rigor_each_child { |child| found = collect_clause_names(child, node_classes, among, found) }
+        found
+      end
 
-        [exit_type, exit_scope]
+      # `clause_scope` with each name of `writes` that `statements` mentions, and `clause_scope` binds, rebound to
+      # `Dynamic[top]`, or nil when none changes.
+      def widen_clause_entry(clause_scope, statements, writes)
+        return nil if writes.nil? || statements.nil? || !widening_recorded?
+
+        names = collect_clause_names(statements, CLAUSE_MENTION_NODES, writes, nil)
+        return nil if names.nil?
+
+        untyped = Type::Combinator.untyped
+        widened = names.reduce(clause_scope) do |acc, name|
+          kind = name.start_with?("@") ? :ivar : :local
+          current = clause_scope.public_send(VAR_KIND_GETTERS.fetch(kind), name)
+          current.nil? || current == untyped ? acc : rebind_variable(acc, kind, name, untyped)
+        end
+        widened.equal?(clause_scope) ? nil : widened
+      end
+
+      # Whether a widened pass would record anything: only the check path asks for one ({#initialize}'s
+      # `widen_clauses`), and a pass nothing records is skipped, so a nested clause inside an unrecorded pass is
+      # evaluated once.
+      def widening_recorded?
+        @widen_clauses && !(@on_enter.nil? && @operand_recorder.nil?)
+      end
+
+      # `[type, scope]` of a rescue or `ensure` clause entered with `clause_scope`. When {#widen_clause_entry} widens
+      # it, the clause is evaluated twice: under the widened entry for the per-node index, which is what the check
+      # rules read, and under `clause_scope` without recording, for the value and the scope the code after the
+      # `begin` continues from. The widened pass collects no `return`, `next`, `break` or retry-edge scope, so the
+      # widening reaches neither an inferred return nor a loop: it can only take diagnostics away inside the clause.
+      def eval_widened_clause(node, statements, clause_scope, writes)
+        widened = widen_clause_entry(clause_scope, statements, writes)
+        return sub_eval(node, clause_scope) unless widened
+
+        eval_widened_pass(node, widened)
+        sub_eval(node, clause_scope, **UNRECORDED)
+      end
+
+      # The recorded pass over a widened clause: it reaches no `return`, `next`, `break` or retry-frame sink.
+      def eval_widened_pass(node, widened)
+        return if node.nil?
+
+        without_jump_sinks { sub_eval(node, widened, next_scope_sink: nil) }
+      end
+
+      # Runs `block` with no `return`, `next`, `break` or retry-frame sink installed.
+      def without_jump_sinks
+        previous = CLAUSE_SINK_KEYS.map { |key| Thread.current[key] }
+        CLAUSE_SINK_KEYS.each { |key| Thread.current[key] = nil }
+        yield
+      ensure
+        CLAUSE_SINK_KEYS.zip(previous).each { |key, value| Thread.current[key] = value } if previous
       end
 
       # The scope a rescue clause of `node` enters with: it runs after any prefix of the body, so neither a `$_`
@@ -1600,6 +1735,10 @@ module Rigor
       RETRY_FRAMES_KEY = :rigor_retry_frames
       private_constant :RETRY_FRAMES_KEY
 
+      # The thread-local sinks a widened clause pass ({#without_jump_sinks}) leaves uninstalled.
+      CLAUSE_SINK_KEYS = [RETURN_SINK_KEY, NEXT_SINK_KEY, BREAK_SINK_KEY, BREAK_VALUE_SINK_KEY, RETRY_FRAMES_KEY].freeze
+      private_constant :CLAUSE_SINK_KEYS
+
       # The retry edge of `node`, or nil when no `retry` in its rescue chain targets it. Allocation-free for a `begin`
       # no `retry` targets.
       def retry_edge_for(node)
@@ -1876,13 +2015,23 @@ module Rigor
       # each arm holding one. The latter still carries a rebind the `retry` itself does not see: a write an `ensure`
       # runs on the way out (`begin; retry; ensure; tries += 1; end`), or one made before a `retry` the evaluator only
       # types (`log(tries < 5 ? retry : :gave_up)`).
-      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil)
+      #
+      # Issue #1231 — `writes` widens the scope each clause enters with, as {#eval_widened_clause} does, before its
+      # reference is bound, so `rescue => e` still binds `e` to the exception. It is nil under a retry edge, which
+      # already carries every scope the primary body raises from ({#widen_entry_for_retry}).
+      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil, writes: nil)
         on_enter = edge ? retry_scope_recorder(edge) : @on_enter
         results = []
         current = rescue_node
         while current
+          widened = widen_clause_entry(entry_scope, current.statements, writes)
+          eval_widened_pass(current.statements, bind_rescue_reference(current, widened)) if widened
           rescue_scope = bind_rescue_reference(current, entry_scope)
-          arm = eval_branch_or_nil(current.statements, rescue_scope, on_enter: on_enter)
+          arm = if widened
+                  sub_eval(current.statements, rescue_scope, **UNRECORDED)
+                else
+                  eval_branch_or_nil(current.statements, rescue_scope, on_enter: on_enter)
+                end
           edge.retry_scopes << arm.last if edge&.retrying_arms&.include?(current)
           results << [arm, current]
           current = current.subsequent
@@ -1920,6 +2069,12 @@ module Rigor
         after.global(:$_) == Type::Combinator.untyped && !LastLine.may_set?(node.statements, scope)
       end
 
+      # Issue #1889 — {#eval_loop} / {#eval_for} with a literal-name `instance_variable_set` in the body joining its
+      # value into the ivar's binding rather than replacing it ({ReflectiveIvarWrite.in_repeating_body}).
+      def eval_repeating_loop(node) = ReflectiveIvarWrite.in_repeating_body { eval_loop(node) }
+
+      def eval_repeating_for(node) = ReflectiveIvarWrite.in_repeating_body { eval_for(node) }
+
       # `while pred; body; end` / `until pred; body; end`. The body might run zero or more times, so half-bound names
       # degrade to `T | nil` in the post-loop scope. The loop expression itself types as `Constant[nil]` (Slice 3 phase
       # 1), reflecting the common case where no `break VALUE` is observed.
@@ -1952,7 +2107,7 @@ module Rigor
         # the single-pass join before returning.
         if names.empty?
           fast = loop_content_writeback(node.statements, base_scope, pre_body: post_pred)
-          return [Type::Combinator.constant_of(nil), narrow_loop_exit_edge(node, fast)]
+          return [Type::Combinator.constant_of(nil), loop_exit(node, post_pred, fast)]
         end
 
         post_loop = converged_loop_scope(node, post_pred, base_scope, names, body_first, jumps)
@@ -1961,7 +2116,7 @@ module Rigor
         # :idle` under `end while state != :idle`) is dead in every converged pass. The single pass runs from the
         # un-narrowed post-predicate scope, so its arms stand in for that first iteration.
         post_loop = join_break_scopes(post_loop, first_breaks, names) if node.begin_modifier?
-        post_loop = narrow_loop_exit_edge(node, post_loop)
+        post_loop = loop_exit(node, post_pred, post_loop)
         [Type::Combinator.constant_of(nil), post_loop]
       end
 
@@ -2048,6 +2203,12 @@ module Rigor
         join_break_scopes(post_loop, arms, names)
       end
 
+      # A loop's continuation: a local its body and predicate only narrowed from `Dynamic[top]` re-joins to it
+      # ({UntypedRejoin}, issue #1840), then the exit edge narrows.
+      def loop_exit(node, post_pred, post_loop)
+        narrow_loop_exit_edge(node, UntypedRejoin.apply(post_loop, post_pred, [node.predicate, node.statements]))
+      end
+
       # Item 4 — loop-exit predicate narrowing. A `while pred` / `until pred` loop exits PRECISELY on the predicate's
       # exit edge: `while` exits when `pred` is falsey, `until` when `pred` is truthy. So after the loop the
       # predicate-assignment target carries the exit polarity — `until line = io.gets; …; end; line.foo` reads `line`
@@ -2379,6 +2540,12 @@ module Rigor
         stores
       end
 
+      # A `for` loop's continuation, with a local the body only narrowed from `Dynamic[top]` re-joined to it
+      # ({UntypedRejoin}, issue #1840). The index is written on every iteration.
+      def for_exit(node, post_coll, continuation)
+        UntypedRejoin.apply(continuation, post_coll, [node.index, node.statements])
+      end
+
       # `for index in collection; body; end`. Unlike `each {}` blocks, `for` does NOT create a new variable scope: the
       # index variable AND every local written in the body leak to the surrounding scope. The collection is evaluated
       # once; the body runs zero or more times, so the post-loop scope is the join of the no-iteration scope (just
@@ -2405,7 +2572,7 @@ module Rigor
         continuation = join_with_nil_injection(post_coll, body_scope)
         pre_existing, body_first = loop_body_local_writes(node.statements, post_coll)
         continuation = join_break_scopes(continuation, breaks, pre_existing + body_first)
-        [Type::Combinator.constant_of(nil), continuation]
+        [Type::Combinator.constant_of(nil), for_exit(node, post_coll, continuation)]
       end
 
       # Issue #1429 — a `for` body runs after the collection's `each`, which may be a project method, and after itself.
@@ -2565,7 +2732,7 @@ module Rigor
 
         # A dead RHS is still evaluated and its scope still joins, so a write inside it nil-injects exactly as
         # before; only its value is dropped, because it cannot be the value of the expression.
-        joined_scope = join_with_nil_injection(left_scope, right_scope)
+        joined_scope = UntypedRejoin.apply(join_with_nil_injection(left_scope, right_scope), left_scope, [node.right])
         type = skipped_type
         type = Type::Combinator.union(skipped_type, right_type) unless right_operand_dead?(node, left_type, left_scope)
         return [type, joined_scope] unless edges
@@ -2772,6 +2939,7 @@ module Rigor
       # evaluates `def` to the method's name as a Symbol, so the produced type is `Constant[:name]`.
       def eval_def(node)
         body_scope = build_method_entry_scope(node)
+        body_scope = body_scope.with_repeated_or_writes(RepeatedOrWrites.straight_line_sites(node.body, body_scope))
         # Parameter default value expressions (e.g. `self.x` in `def copy(x: self.x)`) execute when the method is
         # *invoked*, not when the `def` is read; their `self` is the instance receiver, not the surrounding class body.
         # Walk the parameters subtree under `body_scope` so the scope-index records the instance `self_type` for every
@@ -3013,7 +3181,10 @@ module Rigor
         # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts). See
         # [`docs/CURRENT_WORK.md`](../../../docs/CURRENT_WORK.md) § "Flow-folding" — G2 intervening-call case.
         post_scope = invalidate_ivars_for_intervening_call(node, post_scope) if statement_call
-        # C1 — regex match-data globals (`$~`, `$1..$9`, `$&`, …) are narrowed to non-nil on a successful-match edge; a
+        # Issue #1889 — `instance_variable_set` on `self` writes an ivar no write node shows. It runs after the reset
+        # above, which would join a literal-name write back into the class seed.
+        post_scope = ReflectiveIvarWrite.apply(node, post_scope) { type_operand(ReflectiveIvarWrite.value_node(node)) }
+        # C1 — regex match-data globals (`$~`, `$1..$N`, `$&`, …) are narrowed to non-nil on a successful-match edge; a
         # later call that itself runs a regex match rebinds them, so the narrowed facts must be dropped. We forget them
         # only when the call may run a match in this frame ({#rebinds_match_globals?}). A call provably match-free on a
         # known receiver — `$3.to_i`, `year < 50` — does NOT clobber, so the multi-statement `m = /…/ =~ s; …; use($2)`
@@ -3034,7 +3205,13 @@ module Rigor
         post_scope = post_scope.forget_match_globals if rebinds_match_globals?(node, post_scope)
         post_scope = post_scope.forget_last_line if rebinds_last_line?(node, post_scope)
         if post_scope.guard_narrowed? && GuardRebinding.call_may_rebind?(node, operand_scope)
-          post_scope = post_scope.forget_guard_narrowings
+          # Issue #1596 — a self-call proven to write only some instance variables restores only theirs.
+          writes = intervening_call_candidate?(node) ? self_call_ivar_writes(node) : nil
+          post_scope = if writes
+                         writes.reduce(post_scope) { |acc, name| acc.forget_guard_narrowing_of(:ivar, name) }
+                       else
+                         post_scope.forget_guard_narrowings
+                       end
         end
         forget_rescued_status(LastStatus.after(node, post_scope, scope), node)
       end
@@ -3159,6 +3336,7 @@ module Rigor
       # Returns a scope with each ivar's narrowed local binding widened back to its class-ivar seed value when the call
       # is one that could plausibly mutate ivars on the enclosing class (implicit-self or explicit `self.foo`).
       # External- receiver calls (`obj.method`) cannot reach the caller's ivars; they pass through unchanged.
+      # Issue #1596 — where the call is proven to write only some ivars ({#self_call_ivar_writes}), only those widen.
       def invalidate_ivars_for_intervening_call(call_node, current_scope)
         return current_scope unless intervening_call_candidate?(call_node)
 
@@ -3173,11 +3351,27 @@ module Rigor
           local_type = current_scope.ivar(ivar_name)
           next if local_type.nil? || local_type == seed_type
 
-          widened = widened.with_ivar(ivar_name, Type::Combinator.union(local_type, seed_type))
+          writes = self_call_ivar_writes(call_node)
+          next if writes && !writes.include?(ivar_name)
+
+          joined = Type::Combinator.union(local_type, seed_type)
+          widened = widened.with_ivar(ivar_name, joined)
+          # Issue #1889 — an ivar a reflective write widened keeps its declaration mark, so the reset must too.
+          widened = widened.seed_declaration_sourced_ivar(ivar_name, joined) if
+            current_scope.declaration_sourced?(:ivar, ivar_name)
         end
         widened
       end
 
+      # Issue #1596 — the ivars the implicit-self / `self.` call `call_node` may write, or nil when that is not proven
+      # ({SelfCallIvarWrites.of}). Memoised per call node: the reset and the guard restore ask it of the same call.
+      def self_call_ivar_writes(call_node)
+        memo = (@self_call_ivar_writes ||= {}.compare_by_identity)
+        return memo[call_node] if memo.key?(call_node)
+
+        memo[call_node] = SelfCallIvarWrites.of(call_node, operand_scope)
+      end
+
       def intervening_call_candidate?(call_node)
         return false unless call_node.is_a?(Prism::CallNode)
 
@@ -3542,7 +3736,9 @@ module Rigor
       end
 
       def enter_call_block(node, block)
-        block_entry = narrow_define_method_block_self(node, repeating_block_entry(node, block))
+        block_entry = narrow_define_method_block_self(
+          node, with_repeated_or_write_marks(node, block, repeating_block_entry(node, block))
+        )
         # #319 — `Class.new do ... end` and friends evaluate their block as a CLASS BODY (`class_eval`
         # semantics): `self` is the freshly created class, so a `def` inside defines an instance method on it
         # and `attr_reader` runs as a class-level macro. Enter the block under the same `self_type` /
@@ -4142,7 +4338,7 @@ module Rigor
       # The `break` scopes of one unrecorded pass from `converged` — for a capped fixpoint, whose widened binding no
       # pass has run from.
       def converged_break_arms(call_node, block, converged, targets)
-        entry = block_pass_entry(call_node, block, converged)
+        entry = with_repeated_or_write_marks(call_node, block, block_pass_entry(call_node, block, converged))
         sink, = collect_break_scopes { sub_eval(block, entry, **UNRECORDED) }
         targeted_scopes(sink, targets)
       end
@@ -4942,7 +5138,8 @@ module Rigor
       # params / `;`-locals re-bound as usual) and returns the per-name exit binding for `names`. Used as the
       # `BodyFixpoint` body-evaluator.
       def block_exit_bindings(call_node, block, bindings, names)
-        _type, exit_scope = sub_eval(block, block_pass_entry(call_node, block, bindings))
+        entry = with_repeated_or_write_marks(call_node, block, block_pass_entry(call_node, block, bindings))
+        _type, exit_scope = sub_eval(block, entry)
         names.to_h { |name| [name, CapturedLocals.bound_type(exit_scope, name)] }
       end
 
@@ -4958,6 +5155,38 @@ module Rigor
         end
       end
 
+      # Issue #1336 — `entry` with the index `||=` sites of a repeating block marked as the generic block-return pass
+      # marks them ({RepeatedOrWrites}, `Scope#with_repeated_or_writes`). The statement pass and every ADR-56
+      # write-back pass type the body from one entry scope just as that pass does, so a slot an earlier run stored
+      # into reads as a lone `Dynamic` there too, and the memoizing reading ({#index_compound_write_value}) answered
+      # one site's rvalue: `last = (cache[:k] ||= :f).itself` beside a `cache[:k] ||= :e` wrote `:f` alone back
+      # into `last`, and `last == :e` folded always-falsey. A call that runs its block at most once marks nothing.
+      def with_repeated_or_write_marks(call_node, block, entry)
+        sites = repeated_or_write_sites(call_node, block)
+        sites.empty? ? entry : entry.with_repeated_or_writes(sites)
+      end
+
+      # The sites {#with_repeated_or_write_marks} lays, once per block: a body that spells no `||=` — nearly every
+      # one — answers none without the repetition question.
+      def repeated_or_write_sites(call_node, block)
+        memo = (@repeated_or_write_sites ||= {}.compare_by_identity)
+        return memo[block] if memo.key?(block)
+
+        memo[block] = compute_repeated_or_write_sites(call_node, block)
+      end
+
+      def compute_repeated_or_write_sites(call_node, block)
+        body = block.body
+        return NO_REPEATED_OR_WRITES if body.nil? || !RepeatedOrWrites.may_hold_or_write?(body)
+        return NO_REPEATED_OR_WRITES if repeating_block_class(call_node).nil?
+
+        stores = CapturedLocals.content_mutations(block, scope, non_locals: true)
+        RepeatedOrWrites.sites(block, stores, scope).at(nil)
+      end
+
+      NO_REPEATED_OR_WRITES = [].freeze
+      private_constant :NO_REPEATED_OR_WRITES
+
       NO_CAPTURE_BINDINGS = {}.freeze
       private_constant :NO_CAPTURE_BINDINGS
 
@@ -5220,7 +5449,7 @@ module Rigor
         return [] if receiver_type.nil?
 
         arg_types = call_arg_types_for(call_node)
-        MethodDispatcher.expected_block_param_types(
+        expected = MethodDispatcher.expected_block_param_types(
           receiver_type: receiver_type,
           method_name: call_node.name,
           arg_types: arg_types,
@@ -5228,10 +5457,28 @@ module Rigor
           scope: scope,
           call_node: call_node
         )
+        with_inject_accumulator(call_node, receiver_type, arg_types, expected)
       rescue StandardError
         []
       end
 
+      # Issue #1889 — a block-form `inject` / `reduce` call's accumulator parameter at the type it holds across
+      # every run ({ExpressionTyper#inject_accumulator_type}) rather than the seed the signature binds it to, once
+      # per call: every write-back pass builds the entry again.
+      def with_inject_accumulator(call_node, receiver_type, arg_types, expected)
+        memo = @inject_accumulator
+        accumulator =
+          if memo && memo[0].equal?(call_node)
+            memo[1]
+          else
+            typed = ExpressionTyper.new(scope: scope, tracer: tracer)
+                                   .inject_accumulator_type(call_node, receiver_type, arg_types)
+            @inject_accumulator = [call_node, typed]
+            typed
+          end
+        accumulator ? [accumulator, *expected.drop(1)] : expected
+      end
+
       def call_arg_types_for(call_node)
         arguments = call_node.arguments
         return [] if arguments.nil?
@@ -5662,6 +5909,7 @@ module Rigor
           class_context: class_context,
           lexical_nesting: lexical_nesting,
           converged_loop_recording: @converged_loop_recording,
+          widen_clauses: @widen_clauses,
           next_scope_sink: next_scope_sink,
           operand_scope: operand_scope,
           in_operand: in_operand,
@@ -5956,8 +6204,7 @@ module Rigor
       # it is frozen, and the dispatcher already projects it (see `DataFolding`).
       def struct_instance_projection(subject_type, method_name, scope, subject_node)
         return nil unless subject_type.is_a?(Type::StructInstance)
-        return nil unless MethodDispatcher::StructMaterialization.materialization_call?(subject_node, subject_type,
-                                                                                        scope)
+        return nil unless MethodDispatcher::StructMaterialization.materialization_call?(subject_node, scope)
 
         case method_name
         when :deconstruct then Type::Combinator.tuple_of(*subject_type.members.values)