rigortype 0.4.3 → 0.4.5

data/lib/rigor/inference/expression_typer.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../type"
 require_relative "../reflection"
 require_relative "../ast"
+require_relative "clause_widening"
 require_relative "../source/constant_path"
 require_relative "../source/node_children"
 require_relative "../source/node_walker"
@@ -41,6 +42,7 @@ require_relative "receiver_alias"
 require_relative "repeated_or_writes"
 require_relative "singleton_object_constant"
 require_relative "refined_dispatch"
+require_relative "singleton_external_ahead"
 require_relative "stored_block_call"
 require_relative "struct_fold_safety"
 require_relative "unknown_store_widening"
@@ -321,6 +323,37 @@ module Rigor
           try_project_singleton_inference(receiver, node, arg_types, method_name: :[])
       end
 
+      # Issue #1889 — the type a block-form `inject` / `reduce` accumulator parameter holds across the block's runs,
+      # or nil when the call is not one {#try_block_inject_fold} folds. The RBS tier binds the parameter to the seed
+      # alone, so the statement pass and the ADR-56 write-back typed every run's accumulator as `0` for `inject(0)`,
+      # and a capture assigned from it (`m = a`) was written back as `0`.
+      #
+      # The fold records the answer as it types the call ({#record_inject_accumulator}): the constant arm the
+      # accumulator values the block receives (`0 | 1` for `[1, 2].inject(0) { |a, e| a + e }`), the nominal
+      # arm its seed joined with the converged accumulator. The statement pass types the call from the same scope
+      # just before it enters the block, so the recorded answer is read back rather than computed again — each
+      # computation types the body, and a nested `inject` multiplied that by its depth.
+      def inject_accumulator_type(call_node, receiver, arg_types)
+        block = call_node.block
+        return nil unless INJECT_METHODS.include?(call_node.name) && block.is_a?(Prism::BlockNode)
+
+        recorded = self.class.recorded_inject_accumulator(block, scope)
+        return recorded if recorded
+
+        try_block_inject_fold(call_node, receiver, arg_types)
+        self.class.recorded_inject_accumulator(block, scope)
+      end
+
+      INJECT_ACCUMULATOR_KEY = :__rigor_inject_accumulator__
+      private_constant :INJECT_ACCUMULATOR_KEY
+
+      # The accumulator type {#record_inject_accumulator} stored for `block` when the call was typed from `scope`
+      # itself (by identity), else nil.
+      def self.recorded_inject_accumulator(block, scope)
+        slot = Thread.current[INJECT_ACCUMULATOR_KEY]&.[](block)
+        slot && slot[0].equal?(scope) ? slot[1] : nil
+      end
+
       # ADR-89 WD2 — the current run's return memo bucket as `{ def_node => [MemoEntry, …] }` (only entries
       # that carry a call descriptor, i.e. every stored entry). Read by the incremental session right after a
       # recording run to harvest each analyzed callee's observed call keys → return descriptors. Returns an
@@ -1047,12 +1080,15 @@ module Rigor
       #
       # The `case ... in` pattern-matching form (`CaseMatchNode`) and the predicate-less form (`case; when
       # c1; ...`) bypass the `===` analysis: pattern matching has richer semantics, and a predicate-less
-      # `case` reduces to a `if c1; ...; elsif c2` chain that statement-level narrowing already handles.
+      # `case` reduces to a `if c1; ...; elsif c2` chain. Issue #1495 — like {#type_of_conditional}, that
+      # chain delegates to the statement evaluator, which narrows each arm by its conditions' edges, so
+      # `[case; when x.nil? then "n"; else x end]` reads `"n" | String` as the statement form does.
       # Issue #1429 — each arm is typed under the subject's clause narrowing (`Narrowing.case_when_scopes`), the
       # scope the statement evaluator runs the arm in: `when Symbol then n` on `n: Integer | Symbol` answers
       # `Symbol`, and the `else` arm reads the subject every earlier clause has ruled out.
       def type_of_case(node)
-        return type_of_case_simple_union(node) if node.is_a?(Prism::CaseMatchNode) || node.predicate.nil?
+        return type_of_case_simple_union(node) if node.is_a?(Prism::CaseMatchNode)
+        return scope.evaluate(node, tracer: tracer).first if node.predicate.nil?
 
         subject_type = type_of(node.predicate)
         candidates = []
@@ -1174,17 +1210,22 @@ module Rigor
             Type::Combinator.constant_of(nil)
           end
 
-        rescue_types = rescue_chain_types(rescue_clause)
+        rescue_types = rescue_chain_types(rescue_clause, node.statements)
         Type::Combinator.union(primary_type, *rescue_types)
       end
 
       # Issue #1360 — the evaluator binds `$!` in a rescue clause it enters; a clause typed here, such as one in a
       # `begin` passed as an argument, reads `$!`, `$@` and `$?` unbound rather than an enclosing clause's.
-      def rescue_chain_types(rescue_node)
-        arm_typer = typer_under(rescue_arm_scope)
+      #
+      # Issue #1839 — it also reads each name the `body` writes as `Dynamic[top]` ({ClauseWidening}), as the evaluator's
+      # rescue clause does: `[begin; conn = make; work; rescue; conn; end]` holds the connection, not the entry's `nil`.
+      def rescue_chain_types(rescue_node, body)
+        arm_scope = rescue_arm_scope
+        writes = ClauseWidening.writes([body])
         types = []
         current = rescue_node
         while current
+          arm_typer = typer_under(ClauseWidening.widen(arm_scope, writes, current.statements) || arm_scope)
           types << arm_typer.send(:statements_or_nil, current.statements)
           current = current.subsequent
         end
@@ -1245,11 +1286,23 @@ module Rigor
       def type_of_range(node)
         left_static, left = static_range_endpoint(node.left)
         right_static, right = static_range_endpoint(node.right)
-        return Type::Combinator.constant_of(Range.new(left, right, node.exclude_end?)) if left_static && right_static
+        if left_static && right_static
+          range = static_range_value(left, right, node.exclude_end?)
+          return Type::Combinator.constant_of(range) if range
+        end
 
         nominal_range_for_endpoints(node.left, node.right)
       end
 
+      # The `Range` the static endpoints denote, or nil when Ruby would refuse to build it (`1.."a"`,
+      # `"a"..1` raise `ArgumentError: bad value for range`). The literal is a runtime error,
+      # not a constant, so the fold declines and the caller types it as a plain Range.
+      def static_range_value(left, right, exclude_end)
+        Range.new(left, right, exclude_end)
+      rescue ArgumentError
+        nil
+      end
+
       # Derives `Nominal[Range, [T]]` from the endpoint expression types when at least one endpoint is
       # statically typeable. The element parameter is the union of the endpoint types (lifted from
       # `Constant<v>` to `Nominal<v.class>` so the carrier matches what `Range#each` would yield). Falls back
@@ -2549,6 +2602,10 @@ module Rigor
 
         def_node, owner = resolve_singleton_def_with_owner(receiver.class_name, method_name)
         return nil if def_node.nil?
+        # Issue #1936 — a contested slot holds a `def` a later definer may have replaced
+        # (`singleton_class.alias_method :x, :y` after `def self.x`), or one that may not have run: its body is not
+        # proven to be the method Ruby calls, so the call falls through to `Dynamic`.
+        return nil if scope.discovery.contested?(:discovered_singleton_def_nodes, [owner, method_name.to_sym])
 
         result = infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
         return result if result.nil?
@@ -2563,6 +2620,10 @@ module Rigor
       # `discovered_def_nodes` / `discovered_superclasses` / `discovered_includes`, and this walk reads a
       # fourth table those three do not imply. Keying on what the answer actually depends on is the #682
       # lesson — a memo that outlives its inputs serves one scope's answer to another.
+      #
+      # It is the TYPING read only, so it also withholds (`[nil, nil]`, the call types `Dynamic`) where an external
+      # ancestor may answer ahead of the definer found (#1572: `extend M; extend Enumerable` makes `C.to_a`
+      # `Enumerable#to_a`, which the reader passes over). The existence reads keep the reader's own answer.
       def resolve_singleton_def_with_owner(class_name, method_name)
         by_singleton = (class_graph_buckets[:singleton_def] ||= {}.compare_by_identity)
         cache = (by_singleton[scope.discovered_singleton_def_nodes] ||= {})
@@ -2570,7 +2631,10 @@ module Rigor
         key = method_name.to_sym
         return table[key] if table.key?(key)
 
-        table[key] = scope.singleton_def_through_ancestors(class_name, method_name)
+        found = scope.singleton_def_through_ancestors(class_name, method_name)
+        owner = found.last
+        found = [nil, nil] if owner && SingletonExternalAhead.withhold?(scope, class_name, method_name, owner)
+        table[key] = found
       end
 
       # The project-side singleton-method band: a `Foo.bar` call resolved against a `class << …` / `def self.…`
@@ -3883,6 +3947,12 @@ module Rigor
       # default — or `Dynamic` when the shape is open or absent; `**kwrest`, `&block`, and destructured
       # positionals bind `Dynamic`. Binding `Dynamic` is monotone-safe (wider in → wider out), so the only
       # declines left are the shapes where positional CORRESPONDENCE itself is unknowable.
+      #
+      # The scope carries no `source_path:`: the body is re-typed for call sites in any file, so a rule that
+      # asks "did this file write it?" by comparing `scope.source_path` with census paths answers wrongly
+      # through it. Record a per-file write kind in the census instead, as {ScopeIndexer::CONSTANT_MEMO} does
+      # (#1276). Setting `source_path` here was rejected: plugins read it, and the return memo would become
+      # caller-dependent.
       def build_user_method_body_scope(def_node, receiver, arg_types, self_fold_safe: false)
         params = def_node.parameters
         locals = bind_params_from_call_types(params, arg_types)
@@ -3893,7 +3963,7 @@ module Rigor
         # allocated a fresh frozen Scope per field, run per user-method-call inference (ADR-44). The
         # discovery index is inherited whole by reference (ADR-53 Track A); the hand-copied per-field list
         # this replaces had silently dropped `data_member_layouts` and `discovered_method_visibilities`.
-        Scope.new(
+        body_scope = Scope.new(
           environment: scope.environment,
           locals: locals.freeze,
           self_type: receiver,
@@ -3911,6 +3981,7 @@ module Rigor
           # Issue #1358 — the callee runs in a frame of its own ({Scope#with_match_frame}).
           match_frame: MatchRebinding::Frame.new(def_node.body, def_node.parameters)
         )
+        body_scope.with_repeated_or_writes(RepeatedOrWrites.straight_line_sites(def_node.body, body_scope))
       end
 
       # Issue #681 / #707 — the ONE place in `lib/` that answers "what `Module.nesting` was recorded for this
@@ -5436,13 +5507,25 @@ module Rigor
         return nil if acc.nil?
 
         captured = inject_captured_bindings(block, rest.map { |value| Type::Combinator.constant_of(value) })
+        received = [acc]
         rest.each_with_index do |element_value, position|
           acc = inject_constant_step(block, acc, element_value, captured, position)
           return nil if acc.nil?
+
+          received << acc
         end
+        received.pop if received.size > 1
+        record_inject_accumulator(block, Type::Combinator.union(*received))
         acc
       end
 
+      # Records `type` as the accumulator `block` receives when typed from this typer's scope
+      # ({.recorded_inject_accumulator}). The keys are weak, so a finished file's nodes do not stay reachable, and
+      # the values strong, so a record outlives a collection while its node does. Prism nodes compare by identity.
+      def record_inject_accumulator(block, type)
+        (Thread.current[INJECT_ACCUMULATOR_KEY] ||= ObjectSpace::WeakKeyMap.new)[block] = [scope, type].freeze
+      end
+
       # Issue #1332 — the #587 (b) captured-block binding ({#captured_block_bindings}) both inject arms lay under
       # every step, as the Tuple / Range per-element folds and the per-pair `HashShape` fold do. Without it each
       # step reads a captured variable at its entry binding, so a body that rebinds or mutates one (`n += 1`,
@@ -5550,7 +5633,9 @@ module Rigor
             result.nil? ? {} : { __inject_acc__: result }
           end
         )
-        converged[:__inject_acc__] || seed_acc
+        result = converged[:__inject_acc__] || seed_acc
+        record_inject_accumulator(block, Type::Combinator.union(seed_acc, result))
+        result
       end
 
       def assemble_per_element_result(method_name, per_position, element_types)

data/lib/rigor/inference/guard_rebinding.rb

@@ -223,6 +223,12 @@ module Rigor
         end || Type::Combinator.untyped
       end
 
+      # Issue #1596 — true when `name` runs code chosen by name or by a String, or a block or String it is given
+      # ({CODE_RUNNING_NAMES}, {BLOCK_OR_CODE_NAMES}), whatever its receiver.
+      def code_running_name?(name)
+        CODE_RUNNING_NAMES.include?(name) || BLOCK_OR_CODE_NAMES.include?(name)
+      end
+
       # True when `method_name` on a value of `type` may run foreign code ({.foreign_target?}).
       def type_method_foreign?(type, method_name, scope)
         targets = ProjectMethodOwnership.targets(type)
@@ -326,8 +332,7 @@ module Rigor
       private_class_method :scan, :guarded_ivar_write?, :scan_call, :receiver_targets, :foreign_target?,
                            :universal_delegate_foreign?, :method_owner, :deferred_block_call?,
                            :compound_write_foreign?,
-                           :compound_receiver_type, :compound_accessors, :compound_read_type, :variable_type,
-                           :type_method_foreign?
+                           :compound_receiver_type, :compound_accessors, :compound_read_type, :variable_type
     end
 
     module GuardRebinding

data/lib/rigor/inference/intervening_ivar_reset.rb

@@ -0,0 +1,303 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+require_relative "reflective_ivar_write"
+require_relative "refined_dispatch/own_method"
+require_relative "self_call_ivar_writes"
+
+module Rigor
+  module Inference
+    # The intervening-call reset of instance variables. An implicit-self or `self.` call may write any instance
+    # variable of `self`, so past one each instance variable whose binding is narrower than its class-ivar seed reads
+    # the union of the two again; a call proven to write only some ({SelfCallIvarWrites.of}, issue #1596) widens only
+    # those. A call on another receiver cannot reach `self`'s instance variables and widens nothing.
+    #
+    # {.widen} is the reset itself, which the statement evaluator applies past a statement call
+    # (`StatementEvaluator#invalidate_ivars_for_intervening_call`). Issue #1963 — {.after_operand} applies it past
+    # the calls in a condition operand, where a narrowing an earlier operand or clause made would otherwise survive
+    # them: `if @x.nil? && reset!` read `@x` as `nil` in the body although `reset!` assigns it.
+    module InterveningIvarReset
+      # Nodes whose body does not run where it is written, or runs on another `self`: a `def`, and a class or
+      # module body, where `@x` is the class's own instance variable.
+      NON_RUNNING_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      # Issue #1402 — the nodes that run code the program does not show on `self`'s behalf: `yield` runs the
+      # method's block, and `super` the superclass's method on `self`.
+      UNKNOWN_CODE_NODES = [Prism::YieldNode, Prism::SuperNode, Prism::ForwardingSuperNode].freeze
+      # Issue #1402 — the names of a proc's call (`blk.call`, `blk.()`, `blk.yield`), which runs the block the method
+      # was given as `yield` does.
+      PROC_CALL_NAMES = Set[:call, :yield].freeze
+      # Issue #1402 — the calls whose block runs with `self` bound to the receiver: on a receiver that is provably
+      # another object ({.foreign_self_block?}), an instance variable the block writes, and a method it calls
+      # without a receiver, are that object's.
+      SELF_REBINDING_BLOCK_CALLS = Set[
+        :instance_eval, :instance_exec, :class_eval, :class_exec, :module_eval, :module_exec, :define_method,
+        :define_singleton_method
+      ].freeze
+      # The classes whose instances may be a class or module object: a `self` of one of them may be the receiver of
+      # `Foo.class_eval`, and an instance of one of them may be a `self` that is a class object.
+      CLASS_OBJECT_CLASSES = Set["Class", "Module", "Object", "BasicObject"].freeze
+      private_constant :NON_RUNNING_NODES, :UNKNOWN_CODE_NODES, :PROC_CALL_NAMES, :SELF_REBINDING_BLOCK_CALLS,
+                       :CLASS_OBJECT_CLASSES
+
+      module_function
+
+      # True when `node` is a call that may write `self`'s instance variables: an implicit-self or `self.` call
+      # ({.self_call?}). Issue #1402 — and a `yield`, a `super`, or a proc's call on a local ({.proc_call?}), which
+      # run code the program does not show; {SelfCallIvarWrites.of} proves no write set for any of them.
+      def candidate?(node)
+        return true if UNKNOWN_CODE_NODES.any? { |klass| node.is_a?(klass) }
+        return false unless node.is_a?(Prism::CallNode)
+
+        self_call?(node) || proc_call?(node)
+      end
+
+      # Whether `node`, a call, has no receiver or `self` as its receiver.
+      def self_call?(node)
+        receiver = node.receiver
+        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+      end
+
+      # Issue #1402 — `blk.call` / `blk.()` / `blk.yield` on a local: the method's own `&blk`, or a proc it was
+      # handed, runs code that may call back into `self`, as `yield` does. Read by name, since an unannotated
+      # `&blk` binds `Dynamic`.
+      def proc_call?(node)
+        PROC_CALL_NAMES.include?(node.name) && node.receiver.is_a?(Prism::LocalVariableReadNode)
+      end
+
+      # Issue #1402 — whether `call_node`'s block runs on an object that is provably not `self`: a
+      # {SELF_REBINDING_BLOCK_CALLS} call whose receiver, typed in `scope`, cannot be `self` ({.other_object?}).
+      # A receiver that may be `self` at run time (`obj = self; obj.instance_eval { … }`, a block parameter, an
+      # `Object` or `Dynamic` value, a class the analysis cannot order against `self`'s) is not foreign.
+      def foreign_self_block?(call_node, scope)
+        return false unless call_node.is_a?(Prism::CallNode) && SELF_REBINDING_BLOCK_CALLS.include?(call_node.name)
+        return false if self_call?(call_node)
+
+        other_object?(scope.type_of(call_node.receiver), scope)
+      rescue StandardError
+        false
+      end
+
+      # Whether a value of `type` cannot be `scope`'s `self`. Only an instance method of a class answers: `self` is
+      # then an instance of that class (one other than `Class`, `Module`, `Object` and `BasicObject`, and no module,
+      # declared in source or RBS), and a class object (`Singleton[X]`: `self.class`, a constant naming a class or
+      # module) is not one. Where `self` is a class object, or a module's instance (`module_function`, `extend
+      # self`), any receiver may be `self` — a subclass, the module itself — and none is foreign. An instance
+      # receiver is never foreign: its class may be a subclass of `self`'s that the environment cannot order.
+      def other_object?(type, scope)
+        self_type = scope.self_type
+        return false unless self_type.is_a?(Type::Nominal) && plain_class?(self_type.class_name, scope)
+
+        type.is_a?(Type::Singleton)
+      end
+
+      # Whether `class_name` names a class whose instances are no class or module object, and not a module.
+      def plain_class?(class_name, scope)
+        name = class_name.to_s.delete_prefix("::")
+        !CLASS_OBJECT_CLASSES.include?(name) && !RefinedDispatch::OwnMethod.module_name?(scope, name) &&
+          !module_subclass?(name, scope)
+      end
+
+      # Whether `name` may be a subclass of `Module` (`class Meta < Module`), whose instance is a module object.
+      # Read off the class's instance `Scope::ResolutionChain`, which resolves a superclass written relative to the
+      # subclass's namespace (`class Meta < Base` in `module NS`) as Ruby does: true when an entry is one the
+      # environment orders `:subclass` or `:equal` to `Module` (`Module` itself, `Class`, a project class whose
+      # signature declares it, an external superclass), when an external superclass names no class the
+      # environment knows (it may be `Module`), or when the chain is truncated or unsettled.
+      def module_subclass?(name, scope)
+        chain = Scope::ResolutionChain.for(scope, name, :instance, :methods)
+        return true if chain.truncated? || chain.unsettled?
+
+        environment = scope.environment
+        chain.search(scope) { |entry| module_entry?(entry, environment) || nil } ? true : false
+      end
+      private_class_method :module_subclass?
+
+      # Whether a chain entry makes the class a possible `Module` subclass: a project entry {.module_like?}, or an
+      # external superclass that names no class the environment knows, or one {.module_like?}. An external mixin
+      # (`include Enumerable`) does not.
+      def module_entry?(entry, environment)
+        return module_like?(entry.name.to_s, environment) unless entry.external?
+        return false unless entry.superclass_edge
+
+        known = entry.candidates.map { |candidate| candidate.to_s.delete_prefix("::") }
+                     .select { |candidate| environment.class_known?(candidate) }
+        known.empty? || known.any? { |candidate| module_like?(candidate, environment) }
+      end
+      private_class_method :module_entry?
+
+      def module_like?(name, environment)
+        %i[subclass equal].include?(environment.class_ordering(name, "Module"))
+      end
+      private_class_method :module_like?
+      private_class_method :plain_class?
+
+      # Issue #1402 — `scope` past a statement call whose receiver or arguments run code the program does not
+      # show (`@items << yield`, `puts(yield)`, `log(blk.call)`, `items.each(&blk)`): {.widen} over every narrowed
+      # name, as past a statement `yield`. Every other call in them is the operand walk's.
+      def after_operands(call_node, scope)
+        return scope unless narrowed_ivars?(scope)
+
+        found = []
+        collect_calls(call_node.receiver, false, found, scope, unknown_only: true)
+        collect_calls(call_node.arguments, false, found, scope, unknown_only: true)
+        block = call_node.block
+        found << block if block.is_a?(Prism::BlockArgumentNode) && block.expression.is_a?(Prism::LocalVariableReadNode)
+        return scope if found.empty?
+
+        widen(scope, mark: true) { nil }
+      end
+
+      # Issue #1402 — `scope` past a call on another receiver whose literal block may make a {.candidate?} call
+      # (`[1].each { reset }`, `items.each { yield }`): {.widen} over the names those calls may write, as
+      # {.after_operand} widens past the calls in a condition. In a block that runs on another object
+      # ({.foreign_self_block?}) only a `yield`, a `super` or a proc's call counts: its implicit-self calls are that
+      # object's, while the method's block runs as it always does. A literal-name
+      # `instance_variable_set` on `self` ({ReflectiveIvarWrite.literal_name}) writes the one ivar it names, which
+      # the block's captured-binding write-back already joins, so it is not counted.
+      def after_block(call_node, scope)
+        block = call_node.block
+        return scope unless block.is_a?(Prism::BlockNode)
+        return scope unless narrowed_ivars?(scope)
+
+        calls = []
+        if foreign_self_block?(call_node, scope)
+          collect_calls(block, false, calls, scope, unknown_only: true)
+        else
+          collect_calls(block, false, calls, scope)
+          calls.reject! { |call| ReflectiveIvarWrite.literal_name(call) }
+        end
+        return scope if calls.empty?
+
+        widen(scope, mark: true) { proven_writes(calls, scope) }
+      end
+
+      # `scope` with each instance variable narrowed below its class-ivar seed widened back over the seed. The block
+      # answers the names the call may write, or nil for any; it runs at most once, and only when an instance
+      # variable is narrowed, since a proof costs a read of the callee. An instance variable whose binding carries
+      # the declaration mark keeps it (issue #1889). With `mark: true` a binding whose narrowing had ruled `nil` out
+      # takes the mark when widened, so a `nil` only the seed brings back is not fuel for
+      # `call.possible-nil-receiver` (ADR-58), as a declared one is not. A narrowing that kept `nil`
+      # (`return if @tag`, `@tag.nil?`) widens unmarked, so a read the program really makes on `nil` still reports.
+      def widen(scope, mark: false)
+        seed = class_ivar_seed(scope)
+        return scope if seed.nil? || seed.empty?
+
+        computed = false
+        writes = nil
+        seed.reduce(scope) do |widened, (name, seed_type)|
+          local_type = scope.ivar(name)
+          next widened if local_type.nil? || local_type == seed_type
+
+          unless computed
+            writes = yield
+            computed = true
+          end
+          next widened if writes && !writes.include?(name)
+
+          joined = Type::Combinator.union(local_type, seed_type)
+          widened = widened.with_ivar(name, joined)
+          marked = (mark && nil_free?(local_type)) || scope.declaration_sourced?(:ivar, name)
+          marked ? widened.seed_declaration_sourced_ivar(name, joined) : widened
+        end
+      end
+
+      # Issue #1963 — `scope` past the calls `node`, a condition operand, makes: {.widen} over the names every
+      # candidate call in it may write, or every name when one of them is not proven. A call's literal block may run,
+      # so its calls count; a `def`, a class or module body and (unless `run_lambdas`) a lambda literal run nothing
+      # on this `self` there.
+      #
+      # A binding whose narrowing ruled `nil` out takes the declaration mark when widened ({.widen}'s `mark:`): the
+      # reset forgets the narrowing without making the variable newly nil-reportable, since a call the proof cannot
+      # clear is far more often one that leaves the variable alone (`if @tag && items.any?` then `t = @tag;
+      # t.upcase`) than one that assigns `nil`. A `when` test passes `run_lambdas: true`, since its `===` runs a
+      # lambda literal's body.
+      def after_operand(node, scope, run_lambdas: false)
+        return scope unless narrowed_ivars?(scope)
+
+        calls = candidate_calls(node, run_lambdas, scope)
+        return scope if calls.empty?
+
+        widen(scope, mark: true) { proven_writes(calls, scope) }
+      end
+
+      # Whether a candidate call in `node` may write the instance variable `name`. A `when` test passes
+      # `run_lambdas: true`, since its `===` runs a lambda literal's body. A write to it in `node` is the caller's
+      # to check.
+      def may_write?(node, name, scope, run_lambdas: false)
+        calls = candidate_calls(node, run_lambdas, scope)
+        return false if calls.empty?
+
+        proven = proven_writes(calls, scope)
+        proven.nil? || proven.include?(name)
+      end
+
+      # The union of the names each call may write ({SelfCallIvarWrites.of}), or nil when one is not proven.
+      def proven_writes(calls, scope)
+        calls.reduce(Set.new) do |acc, call|
+          writes = SelfCallIvarWrites.of(call, scope)
+          break nil if writes.nil?
+
+          acc.merge(writes)
+        end
+      end
+
+      # The candidate calls under `node`, in source order.
+      def candidate_calls(node, run_lambdas, scope)
+        found = []
+        collect_calls(node, run_lambdas, found, scope)
+        found
+      end
+
+      # Issue #1402 — with `unknown_only: true` only the `yield`s, `super`s and proc calls ({.unknown_code?}) count,
+      # wherever they sit. A block that runs on another object ({.foreign_self_block?}) is read that way: its
+      # implicit-self calls are that object's, while the method's block runs as anywhere else.
+      def collect_calls(node, run_lambdas, found, scope, unknown_only: false)
+        return unless node.is_a?(Prism::Node)
+        return if NON_RUNNING_NODES.any? { |klass| node.is_a?(klass) }
+        return if !run_lambdas && node.is_a?(Prism::LambdaNode)
+
+        found << node if unknown_only ? unknown_code?(node) : candidate?(node)
+        node.compact_child_nodes.each do |child|
+          foreign = !unknown_only && child.is_a?(Prism::BlockNode) && foreign_self_block?(node, scope)
+          collect_calls(child, run_lambdas, found, scope, unknown_only: unknown_only || foreign)
+        end
+      end
+      private_class_method :collect_calls
+
+      # Issue #1402 — a `yield`, a `super` or a proc's call ({.proc_call?}).
+      def unknown_code?(node)
+        UNKNOWN_CODE_NODES.any? { |klass| node.is_a?(klass) } || (node.is_a?(Prism::CallNode) && proc_call?(node))
+      end
+      private_class_method :unknown_code?
+
+      def nil_free?(type)
+        Narrowing.narrow_non_nil(type) == type
+      end
+      private_class_method :nil_free?
+
+      # Whether any instance variable is bound narrower than its class-ivar seed: the only state {.widen} changes.
+      def narrowed_ivars?(scope)
+        seed = class_ivar_seed(scope)
+        return false if seed.nil? || seed.empty?
+
+        seed.any? do |name, seed_type|
+          local_type = scope.ivar(name)
+          !local_type.nil? && local_type != seed_type
+        end
+      end
+      private_class_method :narrowed_ivars?
+
+      def class_ivar_seed(scope)
+        self_type = scope.self_type
+        class_name =
+          case self_type
+          when Type::Nominal, Type::Singleton then self_type.class_name
+          end
+        class_name && scope.class_ivars_for(class_name)
+      end
+      private_class_method :class_ivar_seed
+    end
+  end
+end

data/lib/rigor/inference/last_line/self_evidence.rb

@@ -45,7 +45,7 @@ module Rigor
       #   `X.send(:define_method, :m, blk)`), whose body may be a block the file wrote anywhere, an eval of a
       #   String, whose code may do any of these, and a `const_set`, which may make a class a `class` body reopens;
       # - one name: a `def` of it anywhere (`def self.gets` at the top level defines it on `main`, which
-      #   {BlockCallTiming.project_defines_anywhere?} does not record), and a Symbol or String literal naming it,
+      #   {BlockCallTiming.project_defines_anywhere?} does not count), and a Symbol or String literal naming it,
       #   which a macro may define it through (`def_delegators :@io, :gets`, `attr_reader :gets`,
       #   `undef_method :gets`), other than `&:gets` and the first argument of a call that only names a method
       #   (`respond_to?(:gets)`, `send(:gets)`).

data/lib/rigor/inference/macro_block_self_type.rb

@@ -47,6 +47,25 @@ module Rigor
       # same call, another plugin's included, is not consulted. A `:lexical` entry (issue #1667) keeps the caller's
       # `self`, so its `self_type` is the calling scope's.
       def match_for(scope:, call_node:, receiver_type:)
+        entry = first_matching_entry(scope, call_node, receiver_type)
+        return nil if entry.nil?
+
+        receiver_name = singleton_receiver_class_name(receiver_type) || nominal_receiver_class_name(receiver_type)
+        entry_match(entry, receiver_name, scope, scope.environment)
+      end
+
+      # Whether `call_node`'s block runs as an instance method of the receiver class (issue #1768): its first matching
+      # entry binds `:receiver_instance`, so the block body's `self` is the instance {#match_for} narrows to and its
+      # `@x` writes are that instance's ivars, as a `def` body's are. A `:lexical` or named-`self_type` entry runs the
+      # block on another object, and no entry means no narrowing.
+      def runs_as_receiver_instance_method?(scope:, call_node:, receiver_type:)
+        entry = first_matching_entry(scope, call_node, receiver_type)
+        !entry.nil? && entry.self_type == Plugin::Macro::BlockAsMethod::SELF_TYPE_RECEIVER_INSTANCE
+      end
+
+      # The first registered entry that matches `call_node` on `receiver_type`, in (plugin registration, declaration)
+      # order, or nil.
+      def first_matching_entry(scope, call_node, receiver_type)
         return nil if receiver_type.nil?
 
         environment = scope&.environment
@@ -61,12 +80,7 @@ module Rigor
         # (plugin registration, declaration) order; the method-name membership is guaranteed
         # by the table key.
         entries = registry.contribution_index.block_entries_for(call_node.name)
-        entries.each do |entry|
-          next unless entry_matches?(entry, singleton_name, nominal_name, call_node, scope, environment)
-
-          return entry_match(entry, singleton_name || nominal_name, scope, environment)
-        end
-        nil
+        entries.find { |entry| entry_matches?(entry, singleton_name, nominal_name, call_node, scope, environment) }
       end
 
       # The {Match} a matching entry contributes: a `:lexical` one keeps the calling scope's `self`, unknown where the