rigortype 0.4.3 → 0.4.4

data/lib/rigor/inference/self_call_ivar_writes.rb

@@ -0,0 +1,341 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../source/node_children"
+require_relative "../source/parameter_envelope"
+require_relative "../type"
+require_relative "guard_rebinding"
+require_relative "project_method_ownership"
+require_relative "refined_dispatch/own_method"
+
+module Rigor
+  module Inference
+    # Issue #1596 — the instance variables an implicit-self or `self.` statement call may write, when the analysis
+    # can prove that set. The intervening-call reset (`StatementEvaluator#invalidate_ivars_for_intervening_call`)
+    # and the class-guard restore ({GuardRebinding}) both assume such a call may write any instance variable and
+    # run any code; with a proven set they widen only the instance variables in it, so `return unless
+    # @io.is_a?(StringIO); log("dumping"); @io.string` keeps `@io` a `StringIO` when `log` writes no instance
+    # variable.
+    #
+    # {.of} answers a frozen `Set` of names, or nil when it cannot prove one. It proves one only for an instance
+    # method's `self` (a project class, not a module, whose instance chain the resolution chain settles) and a call
+    # with no block argument (`&blk`, `...`), and only when every method the call can reach is proven:
+    #
+    # - A method the project defines on the class's chain must resolve to one `def` (not `define_method`, an
+    #   `attr_*` writer or an alias), found ahead of every external ancestor, with every project subclass resolving
+    #   the name to the same definer, and no `refine` block defining the name. Its parameters' default values and
+    #   its body are read. A recursive or mutually recursive call adds nothing the first read did not.
+    # - Any other method on `self` must be one {GuardRebinding} counts as running no foreign code (`warn`, `puts`,
+    #   `format`), and not a code-running name (`send`, `instance_variable_set`, `instance_eval`, …).
+    # - A call on another receiver counts only on a literal, a global, a constant naming a core or standard-library
+    #   class, or an instance variable read as its class-ivar seed, and only when {GuardRebinding} counts its method
+    #   as running no foreign code there. A local, a parameter or a call result is a receiver the read cannot type.
+    #
+    # Read code that writes an instance variable adds its name (an `instance_variable_set` call is a code-running
+    # name, so it proves nothing). Code that writes a global or a constant, yields, calls `super`, defines a method
+    # or opens a singleton class, an operator write on a local, and a `for` loop prove nothing. A literal block at
+    # the call site or in a read body is read with the code around it. The accepted gap is {GuardRebinding}'s:
+    # an implicit conversion a core method runs (`warn obj` runs `obj.to_s`) is read as the core method alone, and
+    # so is a singleton method an `extend` or `def obj.m` gives one object at run time.
+    module SelfCallIvarWrites
+      # The most `def` bodies one proof reads before it gives up.
+      DEF_BUDGET = 32
+      # Code the proof does not read past: it rebinds a global or constant, runs code the body does not show, or
+      # changes which method a later call dispatches to.
+      UNPROVABLE_NODES = Set[
+        Prism::GlobalVariableWriteNode, Prism::GlobalVariableOrWriteNode, Prism::GlobalVariableAndWriteNode,
+        Prism::GlobalVariableOperatorWriteNode, Prism::GlobalVariableTargetNode,
+        Prism::ConstantWriteNode, Prism::ConstantOrWriteNode, Prism::ConstantAndWriteNode,
+        Prism::ConstantOperatorWriteNode, Prism::ConstantTargetNode, Prism::ConstantPathWriteNode,
+        Prism::ConstantPathOrWriteNode, Prism::ConstantPathAndWriteNode, Prism::ConstantPathOperatorWriteNode,
+        Prism::ConstantPathTargetNode,
+        Prism::YieldNode, Prism::SuperNode, Prism::ForwardingSuperNode, Prism::ForwardingArgumentsNode,
+        Prism::BlockArgumentNode, Prism::DefNode, Prism::SingletonClassNode, Prism::ForNode,
+        Prism::LocalVariableOperatorWriteNode, Prism::ClassVariableOperatorWriteNode, Prism::CallOperatorWriteNode,
+        Prism::CallOrWriteNode, Prism::CallAndWriteNode, Prism::IndexOperatorWriteNode, Prism::IndexOrWriteNode,
+        Prism::IndexAndWriteNode
+      ].freeze
+      # Literal receivers, by the core class their value is an instance of.
+      LITERAL_CLASSES = {
+        Prism::StringNode => "String", Prism::InterpolatedStringNode => "String", Prism::XStringNode => "String",
+        Prism::SymbolNode => "Symbol", Prism::InterpolatedSymbolNode => "Symbol", Prism::IntegerNode => "Integer",
+        Prism::FloatNode => "Float", Prism::ArrayNode => "Array", Prism::HashNode => "Hash",
+        Prism::RangeNode => "Range", Prism::RegularExpressionNode => "Regexp",
+        Prism::InterpolatedRegularExpressionNode => "Regexp", Prism::NilNode => "NilClass",
+        Prism::TrueNode => "TrueClass", Prism::FalseNode => "FalseClass"
+      }.freeze
+      # The methods `Kernel` or `Object` own that a read accepts on `self` when the project does not define them. Any
+      # other (`display`, `inspect`, `==`, `hash`, `extend`, `method`, `binding`, `instance_variables`) proves nothing.
+      # These may still convert a value they are given, which runs that value's methods: {PROTOCOL_NAMES} answers for
+      # a value that is `self`.
+      SELF_SAFE_NAMES = Set[
+        :warn, :puts, :print, :p, :pp, :format, :sprintf, :printf, :raise, :fail, :loop, :catch, :throw, :rand,
+        :sleep, :Integer, :Float, :String, :Array, :Hash, :Rational, :Complex, :block_given?, :frozen?, :nil?,
+        :is_a?, :kind_of?, :instance_of?, :object_id, :class, :__method__, :caller, :abort, :exit
+      ].freeze
+      # Issue #1596 — the methods core code calls on a value without the program spelling them: conversions,
+      # comparisons, hashing, iteration, `respond_to?` and its hook, `exception` for `raise`, `divmod` for `sleep`.
+      # A value aliasing `self` (`@me = self`, `me = self`, a constant holding the instance) handed to a core
+      # method runs `self`'s own definition of one of these, which the read never sees, so a class defining any
+      # proves nothing.
+      PROTOCOL_NAMES = Set[
+        :to_s, :inspect, :hash, :eql?, :==, :===, :<=>, :to_a, :to_ary, :to_str, :to_hash, :to_int, :to_i, :to_f,
+        :to_r, :to_c, :to_proc, :to_path, :to_sym, :to_io, :coerce, :exception, :divmod, :each, :respond_to?,
+        :respond_to_missing?, :method_missing, :initialize_copy, :marshal_dump, :pretty_print
+      ].freeze
+      private_constant :UNPROVABLE_NODES, :LITERAL_CLASSES, :SELF_SAFE_NAMES, :PROTOCOL_NAMES
+
+      # Raised inside a proof to abandon it.
+      class Unprovable < StandardError
+      end
+      private_constant :Unprovable
+
+      module_function
+
+      # The names of the instance variables `call_node`, an implicit-self or `self.` call, may write, as a frozen
+      # `Set`, or nil when the analysis cannot prove the set. `scope` is the scope the call's operands were typed in.
+      def of(call_node, scope)
+        return nil unless call_node.is_a?(Prism::CallNode)
+        return nil unless call_node.receiver.nil? || call_node.receiver.is_a?(Prism::SelfNode)
+
+        self_type = scope.self_type
+        return nil unless self_type.is_a?(Type::Nominal)
+
+        proof = Proof.new(self_type, scope)
+        proof.no_self_value(call_node.arguments)
+        proof.no_protocol_override
+        proof.self_call(call_node)
+        proof.read(call_node.block)
+        proof.written.freeze
+      rescue StandardError # an `Unprovable`, or a lookup that raised: either proves nothing
+        nil
+      end
+
+      # One proof's state: the instance variables read code writes, and the `def` bodies already read.
+      class Proof
+        attr_reader :written
+
+        def initialize(self_type, scope)
+          @self_type = self_type
+          @class_name = self_type.class_name
+          @scope = scope
+          @written = Set.new
+          @visited = {}.compare_by_identity
+        end
+
+        # Reads the method an implicit-self or `self.` call to `call_node`'s name runs.
+        def self_call(call_node)
+          name = call_node.name
+          unprovable! if GuardRebinding.code_running_name?(name) || refined?(name)
+
+          if ProjectMethodOwnership.defines?(@class_name, name, :instance, @scope)
+            read_def(proven_def(name))
+          elsif !SELF_SAFE_NAMES.include?(name) || GuardRebinding.type_method_foreign?(@self_type, name, @scope)
+            unprovable!
+          end
+        end
+
+        # Issue #1596 — gives up when `self`'s class, a project subclass, or a project ancestor or module on either's
+        # chain defines a {PROTOCOL_NAMES} method (a `def`, `define_method`, `attr_*` or alias), rewrites its methods
+        # beyond the names it spells, or is refined on one; or when either chain holds an external ancestor, whose
+        # own definitions the read cannot see.
+        def no_protocol_override
+          classes = [@class_name]
+          RefinedDispatch::OwnMethod.each_subclass(@scope, @class_name) { |subclass| classes << subclass }
+          classes.each do |class_name|
+            chain = Scope::ResolutionChain.for(@scope, class_name.to_s, :instance, :methods)
+            unprovable! if chain.truncated? || chain.wildcard_mixin? || !settled?(chain)
+            chain.search(@scope) do |entry|
+              unprovable! if entry.external? || rewritten?(entry.name) || protocol_defined?(entry.name)
+              nil
+            end
+          end
+        end
+
+        # Issue #1596 — `self` handed on as a value (an argument, an interpolation, a splat, a `when` value, a literal
+        # element or key) lets the code it reaches run `self`'s methods by protocol (`to_s`, `hash`, `==`, `to_a`),
+        # which the read does not follow, so it proves nothing. Reads `node` for one, without reading anything else.
+        def no_self_value(node)
+          return unless node.is_a?(Prism::Node)
+
+          unprovable! if node.is_a?(Prism::SelfNode)
+          node.rigor_each_child { |child| no_self_value(child) }
+        end
+
+        # Reads `node`, adding each instance variable it writes.
+        def read(node)
+          return unless node.is_a?(Prism::Node)
+
+          unprovable! if UNPROVABLE_NODES.include?(node.class) || node.is_a?(Prism::SelfNode)
+          written = ivar_write_name(node)
+          @written << written if written
+          if node.is_a?(Prism::InstanceVariableOperatorWriteNode) && GuardRebinding.type_method_foreign?(
+            ivar_seed(node.name), node.binary_operator, @scope
+          )
+            unprovable!
+          end
+          read_call(node) if node.is_a?(Prism::CallNode)
+          # `self.m` is the one place `self` may stand: a call on it, which {#read_call} read.
+          receiver = call_receiver(node)
+          node.rigor_each_child { |child| read(child) unless child.is_a?(Prism::SelfNode) && child.equal?(receiver) }
+        end
+
+        private
+
+        # Whether a `refine` block anywhere in the project defines `name`, on any class: a `using` in effect where the
+        # read code sits may route the call to it (`refine Kernel do def warn …`), whatever the receiver.
+        def refined?(name)
+          @scope.discovered_refinements.any? { |_refined, methods| methods.key?(name) }
+        end
+
+        def call_receiver(node) = node.is_a?(Prism::CallNode) ? node.receiver : nil
+
+        def ivar_write_name(node)
+          case node
+          when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode, Prism::InstanceVariableAndWriteNode,
+               Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableTargetNode
+            node.name
+          end
+        end
+
+        def read_call(node)
+          receiver = node.receiver
+          return self_call(node) if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+          unprovable! if GuardRebinding.code_running_name?(node.name) || refined?(node.name)
+          type = receiver_type(receiver)
+          unprovable! if type.nil? || GuardRebinding.type_method_foreign?(type, node.name, @scope)
+        end
+
+        def read_def(def_node)
+          return if @visited.key?(def_node)
+
+          @visited[def_node] = true
+          unprovable! if @visited.size > DEF_BUDGET
+          read(def_node.parameters)
+          read(def_node.body)
+        end
+
+        # The `def` the name resolves to on the class and on every project subclass, or unprovable.
+        def proven_def(name)
+          unprovable! if RefinedDispatch::OwnMethod.module_name?(@scope, @class_name)
+
+          owner = definer_ahead(@class_name, name, nil)
+          unprovable! if owner.nil?
+          def_node = @scope.user_def_for(owner, name)
+          unprovable! unless def_node.is_a?(Prism::DefNode) && def_node.receiver.nil?
+          single_definition(owner, name)
+
+          # A subclass whose superclass the tables do not know is enumerated too, and its chain ends short of the
+          # owner; one that reaches no definer of its own leaves the call to its superclass.
+          RefinedDispatch::OwnMethod.each_subclass(@scope, @class_name) do |subclass|
+            unprovable! unless [owner, nil].include?(definer_ahead(subclass, name, owner))
+          end
+          def_node
+        end
+
+        # Issue #1596 — the `def` the table holds must be the owner's only definition of `name`: the owner declared in
+        # one file, with one `def` of the name there (a reopening or a `class_eval` body in the same file is a second
+        # one), and no `define_method`, `attr_*` or alias of it, nor a rewrite no literal names (`T.define_method`,
+        # `T.send(:define_method, …)`, `T.class_eval` with a computed name), nor a definition the walk could not prove
+        # runs (a possible or contested one, as `DefinerResolution` reads them). The class edge files every declaring
+        # file.
+        def single_definition(owner, name)
+          Scope::ResolutionChain.record_class(@scope, owner) if Analysis::DependencyRecorder.active?
+          unprovable! if possible_definition?(owner, name)
+          bucket = @scope.discovered_parameter_envelopes[owner] || {}
+          unprovable! if bucket[[:instance, name]] == Source::ParameterEnvelope::OPAQUE
+          unprovable! if (@scope.discovered_class_sources[owner]&.size || 0) > 1
+          unprovable! if definition_count(owner, name) > 1
+        end
+
+        def possible_definition?(owner, name)
+          discovery = @scope.discovery
+          discovery.possible_method?(owner, name, :instance) ||
+            discovery.contested?(:discovered_def_nodes, [owner, name]) ||
+            discovery.contested?(:discovered_parameter_envelopes, [owner, [:instance, name]])
+        end
+
+        def definition_count(owner, name)
+          @scope.discovered_deferred_ranges.sum do |_path, rows|
+            rows.count { |row| row[2] == name && row[3] == :instance && row[4] == owner }
+          end
+        end
+
+        # Whether `chain`'s own order stands with no second world: no order mark and no fork. `ResolutionChain#settle`
+        # answers `:chain` for an answer no world can match only then; a fork sends it to the retro world, which the
+        # block answers otherwise, or to master's order.
+        def settled?(chain)
+          chain.settle(@scope, :chain_order) { :other_world } == :chain
+        end
+
+        def protocol_defined?(class_name)
+          refined = @scope.discovered_refinements[class_name] || {}
+          PROTOCOL_NAMES.any? { |name| defines_here?(class_name, name) || refined.key?(name) }
+        end
+
+        # Whether the project rewrites `class_name`'s method table beyond the names it spells, or refines it.
+        def rewritten?(class_name)
+          bucket = @scope.discovered_parameter_envelopes[class_name]
+          !bucket.nil? && Scope::DiscoveryIndex.rewritten_surface?(bucket)
+        end
+
+        # The first project class or module on `class_name`'s settled instance chain that defines `name`, stopping
+        # at `owner`; nil when the chain ends without one. An external ancestor reached first is unprovable: its
+        # signature, or a gem without one, may define the name.
+        def definer_ahead(class_name, name, owner)
+          chain = Scope::ResolutionChain.for(@scope, class_name.to_s, :instance, :methods)
+          unprovable! if chain.truncated? || chain.wildcard_mixin? || !settled?(chain)
+
+          chain.search(@scope) do |entry|
+            unprovable! if entry.external? || rewritten?(entry.name)
+
+            entry.name if entry.name == owner || defines_here?(entry.name, name)
+          end
+        end
+
+        # A `def`, `define_method`, `attr_*` or alias of `name` in `class_name`'s own body: the discovery table holds
+        # the last three project-wide, and the `def` table the first.
+        def defines_here?(class_name, name)
+          @scope.discovered_method?(class_name, name, :instance) || !@scope.def_node_slot(class_name, name).nil?
+        end
+
+        def receiver_type(node)
+          literal = LITERAL_CLASSES[node.class]
+          return Type::Combinator.nominal_of(literal) if literal
+
+          case node
+          when Prism::GlobalVariableReadNode then @scope.type_of(node)
+          when Prism::InstanceVariableReadNode then ivar_seed(node.name)
+          when Prism::ConstantReadNode, Prism::ConstantPathNode then core_constant_type(node)
+          end
+        end
+
+        def ivar_seed(name)
+          @scope.class_ivars_for(@class_name)[name] || unprovable!
+        end
+
+        # A constant receiver read in the caller's scope, which the callee's lexical scope may resolve otherwise: only
+        # a core or standard-library class object or instance, under a name no project class or constant ends with.
+        def core_constant_type(node)
+          type = @scope.type_of(node)
+          return nil unless type.is_a?(Type::Singleton) || type.is_a?(Type::Nominal)
+
+          loader = @scope.environment.rbs_loader
+          return nil if loader.nil? || !loader.core_or_stdlib_class?(type.class_name)
+
+          segment = node.name.to_s
+          project = [@scope.discovered_classes, @scope.in_source_constants]
+          return nil if project.any? { |table| table.each_key.any? { |name| name.to_s.split("::").last == segment } }
+
+          type
+        end
+
+        def unprovable!
+          raise Unprovable
+        end
+      end
+    end
+  end
+end

data/lib/rigor/inference/statement_evaluator.rb

@@ -27,6 +27,7 @@ require_relative "content_join"
 require_relative "define_method_block_self"
 require_relative "macro_block_self_type"
 require_relative "guard_rebinding"
+require_relative "self_call_ivar_writes"
 require_relative "match_rebinding"
 require_relative "element_read_widening"
 require_relative "hash_lookup_mutation"
@@ -123,9 +124,9 @@ module Rigor
         Prism::BeginNode => :eval_begin_node,
         Prism::RescueNode => :eval_rescue,
         Prism::EnsureNode => :eval_ensure,
-        Prism::WhileNode => :eval_loop,
-        Prism::UntilNode => :eval_loop,
-        Prism::ForNode => :eval_for,
+        Prism::WhileNode => :eval_repeating_loop,
+        Prism::UntilNode => :eval_repeating_loop,
+        Prism::ForNode => :eval_repeating_for,
         Prism::AndNode => :eval_and_or,
         Prism::OrNode => :eval_and_or,
         Prism::ParenthesesNode => :eval_parentheses,
@@ -525,10 +526,13 @@ module Rigor
         [result_type, current]
       end
 
+      # The top level is a straight-line body: an index `||=` there whose slot an earlier store may have filled is
+      # marked ({RepeatedOrWrites.straight_line_sites}).
       def eval_program(node)
         return [Type::Combinator.constant_of(nil), scope] if node.statements.nil?
 
-        sub_eval(node.statements, scope)
+        marks = RepeatedOrWrites.straight_line_sites(node.statements, scope)
+        sub_eval(node.statements, scope.with_repeated_or_writes(marks))
       end
 
       # `name = rvalue` evaluates the rvalue under the entry scope (so earlier assignments in a chained `a = b = expr`
@@ -1380,46 +1384,46 @@ module Rigor
       end
 
       # Returns `[body_scope, updated_falsey_scope]` for a single branch. `WhenNode` branches narrow through
-      # `Narrowing.case_when_scopes`. `InNode` branches narrow soundly only for a bare class pattern (`in C` / `in C =>
-      # x`, pure `is_a?`); every other pattern keeps the conservative "body = entry + bindings, falsey unchanged" shape.
-      # `subject_type` is the predicate's type, which an `in` branch's pattern decomposes to type the names it binds.
+      # `Narrowing.case_when_scopes`, or through {#subjectless_when_scopes} in a `case` without a subject. `InNode`
+      # branches narrow soundly only for a bare class pattern (`in C` / `in C => x`, pure `is_a?`); every other pattern
+      # keeps the conservative "body = entry + bindings, falsey unchanged" shape. `subject_type` is the predicate's
+      # type, which an `in` branch's pattern decomposes to type the names it binds.
       def branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
         if branch.is_a?(Prism::InNode)
           in_branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
+        elsif subject.nil?
+          subjectless_when_scopes(branch.conditions, falsey_scope)
         else
           when_conditions = branch.respond_to?(:conditions) ? branch.conditions : []
           Narrowing.case_when_scopes(subject, when_conditions, falsey_scope)
         end
       end
 
+      # Issue #1495 — a `case` without a subject tests each `when` condition for truthiness, in order, and stops at the
+      # first truthy one, so a clause is the `||` of its conditions in an `if` / `elsif` chain. Each condition is
+      # evaluated under the falsey edges of the conditions before it, in this clause and every earlier one; the body
+      # joins the conditions' truthy edges, and the next clause starts from the last falsey edge. A condition
+      # `Narrowing.predicate_scopes` does not recognise narrows nothing: a splat (`when *conds`), and a regexp literal,
+      # which is tested for its truthiness and matches nothing, so it binds no match global (#1486).
+      def subjectless_when_scopes(conditions, entry)
+        falsey = entry
+        truthy_edges = conditions.map do |condition|
+          _type, _post, truthy, falsey = eval_with_edges(condition, falsey)
+          truthy
+        end
+        [reduce_scopes_with_nil_injection(truthy_edges), falsey]
+      end
+
       # ADR-47 WD3a — a bare class pattern matches on `C === subject`, i.e. exactly `subject.is_a?(C)` with no
       # deconstruction, so it narrows like `when C`: the body sees the subject narrowed to `C` and the next clause's
       # falsey scope has `C` removed. Other patterns can fail to match even when a class test would pass (deconstruction
       # arity, hash keys, ...), so removing anything from the falsey scope would be unsound — they keep the conservative
       # shape.
       def in_branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
-        class_node = bare_class_pattern_node(branch.pattern)
-        unless class_node
-          bound = apply_in_pattern_bindings(subject_type, subject, branch.pattern, falsey_scope)
-          return [bound, falsey_scope]
-        end
-
-        truthy_scope, narrowed_falsey = Narrowing.case_when_scopes(subject, [class_node], falsey_scope)
+        truthy_scope, narrowed_falsey = Narrowing.case_clause_scopes(subject, branch, falsey_scope)
         [apply_in_pattern_bindings(subject_type, subject, branch.pattern, truthy_scope), narrowed_falsey]
       end
 
-      # The class-constant node of a `in C` / `in C => x` pattern (the only `in` shapes whose match is pure `is_a?`), or
-      # nil for any pattern that deconstructs, binds, or matches a value.
-      def bare_class_pattern_node(pattern)
-        case pattern
-        when Prism::ConstantReadNode, Prism::ConstantPathNode
-          pattern
-        when Prism::CapturePatternNode
-          value = pattern.value
-          value if value.is_a?(Prism::ConstantReadNode) || value.is_a?(Prism::ConstantPathNode)
-        end
-      end
-
       def eval_case_else(else_clause, falsey_scope)
         return sub_eval(else_clause, falsey_scope) if else_clause
 
@@ -2065,6 +2069,12 @@ module Rigor
         after.global(:$_) == Type::Combinator.untyped && !LastLine.may_set?(node.statements, scope)
       end
 
+      # Issue #1889 — {#eval_loop} / {#eval_for} with a literal-name `instance_variable_set` in the body joining its
+      # value into the ivar's binding rather than replacing it ({ReflectiveIvarWrite.in_repeating_body}).
+      def eval_repeating_loop(node) = ReflectiveIvarWrite.in_repeating_body { eval_loop(node) }
+
+      def eval_repeating_for(node) = ReflectiveIvarWrite.in_repeating_body { eval_for(node) }
+
       # `while pred; body; end` / `until pred; body; end`. The body might run zero or more times, so half-bound names
       # degrade to `T | nil` in the post-loop scope. The loop expression itself types as `Constant[nil]` (Slice 3 phase
       # 1), reflecting the common case where no `break VALUE` is observed.
@@ -2929,6 +2939,7 @@ module Rigor
       # evaluates `def` to the method's name as a Symbol, so the produced type is `Constant[:name]`.
       def eval_def(node)
         body_scope = build_method_entry_scope(node)
+        body_scope = body_scope.with_repeated_or_writes(RepeatedOrWrites.straight_line_sites(node.body, body_scope))
         # Parameter default value expressions (e.g. `self.x` in `def copy(x: self.x)`) execute when the method is
         # *invoked*, not when the `def` is read; their `self` is the instance receiver, not the surrounding class body.
         # Walk the parameters subtree under `body_scope` so the scope-index records the instance `self_type` for every
@@ -3170,6 +3181,9 @@ module Rigor
         # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts). See
         # [`docs/CURRENT_WORK.md`](../../../docs/CURRENT_WORK.md) § "Flow-folding" — G2 intervening-call case.
         post_scope = invalidate_ivars_for_intervening_call(node, post_scope) if statement_call
+        # Issue #1889 — `instance_variable_set` on `self` writes an ivar no write node shows. It runs after the reset
+        # above, which would join a literal-name write back into the class seed.
+        post_scope = ReflectiveIvarWrite.apply(node, post_scope) { type_operand(ReflectiveIvarWrite.value_node(node)) }
         # C1 — regex match-data globals (`$~`, `$1..$N`, `$&`, …) are narrowed to non-nil on a successful-match edge; a
         # later call that itself runs a regex match rebinds them, so the narrowed facts must be dropped. We forget them
         # only when the call may run a match in this frame ({#rebinds_match_globals?}). A call provably match-free on a
@@ -3191,7 +3205,13 @@ module Rigor
         post_scope = post_scope.forget_match_globals if rebinds_match_globals?(node, post_scope)
         post_scope = post_scope.forget_last_line if rebinds_last_line?(node, post_scope)
         if post_scope.guard_narrowed? && GuardRebinding.call_may_rebind?(node, operand_scope)
-          post_scope = post_scope.forget_guard_narrowings
+          # Issue #1596 — a self-call proven to write only some instance variables restores only theirs.
+          writes = intervening_call_candidate?(node) ? self_call_ivar_writes(node) : nil
+          post_scope = if writes
+                         writes.reduce(post_scope) { |acc, name| acc.forget_guard_narrowing_of(:ivar, name) }
+                       else
+                         post_scope.forget_guard_narrowings
+                       end
         end
         forget_rescued_status(LastStatus.after(node, post_scope, scope), node)
       end
@@ -3316,6 +3336,7 @@ module Rigor
       # Returns a scope with each ivar's narrowed local binding widened back to its class-ivar seed value when the call
       # is one that could plausibly mutate ivars on the enclosing class (implicit-self or explicit `self.foo`).
       # External- receiver calls (`obj.method`) cannot reach the caller's ivars; they pass through unchanged.
+      # Issue #1596 — where the call is proven to write only some ivars ({#self_call_ivar_writes}), only those widen.
       def invalidate_ivars_for_intervening_call(call_node, current_scope)
         return current_scope unless intervening_call_candidate?(call_node)
 
@@ -3330,11 +3351,27 @@ module Rigor
           local_type = current_scope.ivar(ivar_name)
           next if local_type.nil? || local_type == seed_type
 
-          widened = widened.with_ivar(ivar_name, Type::Combinator.union(local_type, seed_type))
+          writes = self_call_ivar_writes(call_node)
+          next if writes && !writes.include?(ivar_name)
+
+          joined = Type::Combinator.union(local_type, seed_type)
+          widened = widened.with_ivar(ivar_name, joined)
+          # Issue #1889 — an ivar a reflective write widened keeps its declaration mark, so the reset must too.
+          widened = widened.seed_declaration_sourced_ivar(ivar_name, joined) if
+            current_scope.declaration_sourced?(:ivar, ivar_name)
         end
         widened
       end
 
+      # Issue #1596 — the ivars the implicit-self / `self.` call `call_node` may write, or nil when that is not proven
+      # ({SelfCallIvarWrites.of}). Memoised per call node: the reset and the guard restore ask it of the same call.
+      def self_call_ivar_writes(call_node)
+        memo = (@self_call_ivar_writes ||= {}.compare_by_identity)
+        return memo[call_node] if memo.key?(call_node)
+
+        memo[call_node] = SelfCallIvarWrites.of(call_node, operand_scope)
+      end
+
       def intervening_call_candidate?(call_node)
         return false unless call_node.is_a?(Prism::CallNode)
 
@@ -5412,7 +5449,7 @@ module Rigor
         return [] if receiver_type.nil?
 
         arg_types = call_arg_types_for(call_node)
-        MethodDispatcher.expected_block_param_types(
+        expected = MethodDispatcher.expected_block_param_types(
           receiver_type: receiver_type,
           method_name: call_node.name,
           arg_types: arg_types,
@@ -5420,10 +5457,28 @@ module Rigor
           scope: scope,
           call_node: call_node
         )
+        with_inject_accumulator(call_node, receiver_type, arg_types, expected)
       rescue StandardError
         []
       end
 
+      # Issue #1889 — a block-form `inject` / `reduce` call's accumulator parameter at the type it holds across
+      # every run ({ExpressionTyper#inject_accumulator_type}) rather than the seed the signature binds it to, once
+      # per call: every write-back pass builds the entry again.
+      def with_inject_accumulator(call_node, receiver_type, arg_types, expected)
+        memo = @inject_accumulator
+        accumulator =
+          if memo && memo[0].equal?(call_node)
+            memo[1]
+          else
+            typed = ExpressionTyper.new(scope: scope, tracer: tracer)
+                                   .inject_accumulator_type(call_node, receiver_type, arg_types)
+            @inject_accumulator = [call_node, typed]
+            typed
+          end
+        accumulator ? [accumulator, *expected.drop(1)] : expected
+      end
+
       def call_arg_types_for(call_node)
         arguments = call_node.arguments
         return [] if arguments.nil?

data/lib/rigor/lens/anchor.rb

@@ -32,9 +32,9 @@ module Rigor
       end
 
       # The anchor of the declaration spanning bytes `start_offset...end_offset` and lines `start_line..end_line`.
-      def for_span(start_offset, end_offset, start_line, end_line)
-        leading = leading_contract_comments(start_line)
-        trailing = trailing_contract_comment(end_line, end_offset)
+      def for_span(start_offset, end_offset, start_line, end_line, leading: true, trailing: true)
+        leading = leading ? leading_contract_comments(start_line) : []
+        trailing = trailing ? trailing_contract_comment(end_line, end_offset) : nil
         material = +"".b
         leading.each { |comment| material << line_text_from(comment.location.start_offset) << "\n" }
         material << @source.byteslice(start_offset, end_offset - start_offset)

data/lib/rigor/lens/contract_reader.rb

@@ -34,6 +34,21 @@ module Rigor
         unreadable("definition_build_failed", [])
       end
 
+      # The declared type of the constant `name` (qualified), as a slot with its declaration's provenance, or nil
+      # when no RBS or inline declaration names it.
+      def read_constant(name, environment)
+        declaration = environment&.rbs_loader&.constant_declaration(name)
+        return nil if declaration.nil?
+
+        type, buffer = declaration
+        provenance, path = @provenance.classify(buffer)
+        return Slot.unavailable("not_computed") if provenance.nil?
+
+        Slot.from_rbs(type, provenance, path)
+      rescue StandardError
+        Slot.unavailable("not_computed")
+      end
+
       private
 
       def contract(defs, annotations)

data/lib/rigor/lens/document.rb

@@ -10,8 +10,8 @@ module Rigor
   module Lens
     # Assembles the `lens/v0` document (docs/internal-spec/lens.md § Document) from a {Run::Outcome}.
     class Document
-      SITE_FIELDS = %w[key kind name owner scope attribute members ordinal span contract_span anchor visibility
-                       contract params block body_return].freeze
+      SITE_FIELDS = %w[key kind name owner scope attribute members module_function builder ordinal span contract_span
+                       anchor visibility contract params block body_return value alias_of].freeze
 
       def initialize(outcome:, configuration:, root:, config_path:)
         @outcome = outcome