rigortype 0.4.3 → 0.4.5

data/lib/rigor/inference/statement_evaluator.rb

@@ -10,6 +10,7 @@ require_relative "../source/node_children"
 require_relative "../source/constant_path"
 require_relative "anonymous_meta_class"
 require_relative "definer_resolution"
+require_relative "block_call_timing"
 require_relative "block_repetition"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
@@ -27,7 +28,10 @@ require_relative "content_join"
 require_relative "define_method_block_self"
 require_relative "macro_block_self_type"
 require_relative "guard_rebinding"
+require_relative "self_call_ivar_writes"
+require_relative "intervening_ivar_reset"
 require_relative "match_rebinding"
+require_relative "clause_widening"
 require_relative "element_read_widening"
 require_relative "hash_lookup_mutation"
 require_relative "indexed_narrowing"
@@ -125,7 +129,7 @@ module Rigor
         Prism::EnsureNode => :eval_ensure,
         Prism::WhileNode => :eval_loop,
         Prism::UntilNode => :eval_loop,
-        Prism::ForNode => :eval_for,
+        Prism::ForNode => :eval_repeating_for,
         Prism::AndNode => :eval_and_or,
         Prism::OrNode => :eval_and_or,
         Prism::ParenthesesNode => :eval_parentheses,
@@ -364,7 +368,18 @@ module Rigor
         # Default: the node is treated as a pure expression. Type it through the existing expression typer (which
         # observes the current scope's locals) and leave the scope unchanged, but for the match globals a call in it
         # may rebind (`super(line.sub(re, ""))`, issue #1365).
-        [@scope.type_of(node, tracer: @tracer), forget_rebound_specials(@scope, node)]
+        after = reset_ivars_past_unknown_code(node, forget_rebound_specials(@scope, node))
+        [@scope.type_of(node, tracer: @tracer), after]
+      end
+
+      # Issue #1402 — `after`, past a statement `yield` or `super`, with each narrowed instance variable widened over
+      # its class-ivar seed ({InterveningIvarReset.after_operand}): the block `yield` runs, and the superclass method
+      # `super` runs on `self`, may write any of them, as an implicit-self call may. Inside an operand the statement
+      # that holds it answers instead.
+      def reset_ivars_past_unknown_code(node, after)
+        return after if @in_operand || !InterveningIvarReset.candidate?(node)
+
+        InterveningIvarReset.after_operand(node, after)
       end
 
       # Issue #1429 — a compound write or a `for` loop calls a method its syntax does not spell (`r += r` calls `r.+`,
@@ -525,10 +540,13 @@ module Rigor
         [result_type, current]
       end
 
+      # The top level is a straight-line body: an index `||=` there whose slot an earlier store may have filled is
+      # marked ({RepeatedOrWrites.straight_line_sites}).
       def eval_program(node)
         return [Type::Combinator.constant_of(nil), scope] if node.statements.nil?
 
-        sub_eval(node.statements, scope)
+        marks = RepeatedOrWrites.straight_line_sites(node.statements, scope)
+        sub_eval(node.statements, scope.with_repeated_or_writes(marks))
       end
 
       # `name = rvalue` evaluates the rvalue under the entry scope (so earlier assignments in a chained `a = b = expr`
@@ -1345,6 +1363,9 @@ module Rigor
       def eval_case_when_branches(subject_type, subject, conditions, entry_scope)
         results = []
         falsey_scope = entry_scope
+        # Issue #1963 — set once a `when` test may have rebound the subject variable, which from there on no longer
+        # holds the value the later tests match ({#subject_when_scopes}).
+        rebound = false
         conditions.each do |branch|
           # Issue #1359 — a clause's conditions, or its pattern's pins and guard, run before its body and before
           # every later clause, and the walk types them without evaluating them, so a reader there forgets `$_` here.
@@ -1355,7 +1376,11 @@ module Rigor
           # recursion) so no condition sub-expression is newly typed; `propagate` preserves the entry because it already
           # keys the node.
           record_clause_entry_scope(branch, falsey_scope)
-          body_scope, falsey_scope = branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
+          if subject && branch.is_a?(Prism::WhenNode)
+            body_scope, falsey_scope, rebound = subject_when_scopes(subject, branch.conditions, falsey_scope, rebound)
+          else
+            body_scope, falsey_scope = branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
+          end
           results << sub_eval(branch, body_scope)
         end
         [results, falsey_scope]
@@ -1380,46 +1405,154 @@ module Rigor
       end
 
       # Returns `[body_scope, updated_falsey_scope]` for a single branch. `WhenNode` branches narrow through
-      # `Narrowing.case_when_scopes`. `InNode` branches narrow soundly only for a bare class pattern (`in C` / `in C =>
-      # x`, pure `is_a?`); every other pattern keeps the conservative "body = entry + bindings, falsey unchanged" shape.
-      # `subject_type` is the predicate's type, which an `in` branch's pattern decomposes to type the names it binds.
+      # `Narrowing.case_when_scopes`, or through {#subjectless_when_scopes} in a `case` without a subject. `InNode`
+      # branches narrow soundly only for a bare class pattern (`in C` / `in C => x`, pure `is_a?`); every other pattern
+      # keeps the conservative "body = entry + bindings, falsey unchanged" shape. `subject_type` is the predicate's
+      # type, which an `in` branch's pattern decomposes to type the names it binds.
       def branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
         if branch.is_a?(Prism::InNode)
           in_branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
+        elsif subject.nil?
+          subjectless_when_scopes(branch.conditions, falsey_scope)
         else
           when_conditions = branch.respond_to?(:conditions) ? branch.conditions : []
           Narrowing.case_when_scopes(subject, when_conditions, falsey_scope)
         end
       end
 
+      # Issue #1963 — a `when` clause of a `case` with a subject. Ruby runs each test in order (`test === subject`)
+      # until one matches, so a test that runs code — a call, a write, a lambda literal, whose `===` runs its body —
+      # runs before the clause's body and every later clause. Such a test is evaluated ({#run_when_test}), so a call
+      # in it resets the instance variables and the guard narrowings it may rebind, as a statement call does, and a
+      # write in it binds. The body is reached after any prefix of the tests ran, so it enters from the join of the
+      # scopes each test leaves, the next clause from the scope the last one leaves.
+      #
+      # The subject is evaluated once, before every test, so a test that may rebind the subject variable
+      # ({#when_test_rebinds_subject?}) leaves the variable holding something other than the value the later tests
+      # match: from that test on, no clause narrows it (`case @x when String then 1 when reset! then @x.upcase`, with
+      # `reset!` assigning `@x`, reads `@x` as `reset!` may leave it, not as `nil`). `rebound` carries that across
+      # the clauses; the answer is `[body_scope, falsey_scope, rebound]`. A clause whose tests run no code, before
+      # any test rebound the subject, keeps {Narrowing.case_when_scopes}' narrowing unchanged.
+      def subject_when_scopes(subject, conditions, entry, rebound)
+        unless rebound || conditions.any? { |condition| when_test_runs_code?(condition) }
+          return [*Narrowing.case_when_scopes(subject, conditions, entry), false]
+        end
+
+        after = entry
+        test_exits = conditions.map do |condition|
+          before = after
+          after = run_when_test(condition, before)
+          rebound ||= when_test_rebinds_subject?(subject, condition, before, after)
+          after
+        end
+        body_entry = reduce_scopes_with_nil_injection(test_exits)
+        return [Narrowing.apply_when_regex_globals(conditions, body_entry), after, true] if rebound
+
+        [Narrowing.case_when_scopes(subject, conditions, body_entry).first,
+         Narrowing.case_when_scopes(subject, conditions, after).last, false]
+      end
+
+      # Whether a `when` test runs code beyond reading a value: a call, `super`, `yield`, a lambda literal or a write.
+      WHEN_TEST_CODE_NODES = [
+        Prism::CallNode, Prism::SuperNode, Prism::ForwardingSuperNode, Prism::YieldNode, Prism::LambdaNode
+      ].freeze
+      private_constant :WHEN_TEST_CODE_NODES
+
+      def when_test_runs_code?(condition)
+        return true if OperandEffects.any?(condition)
+
+        found = false
+        Source::NodeWalker.each(condition) do |descendant|
+          found ||= WHEN_TEST_CODE_NODES.any? { |klass| descendant.is_a?(klass) }
+        end
+        found
+      end
+
+      # The scope a `when` test leaves. The instance variables its implicit-self calls may write are widened first,
+      # a lambda literal's body included, since its `===` runs it ({InterveningIvarReset.after_operand}, which
+      # marks a binding whose narrowing had ruled `nil` out). The test is then evaluated, which binds its writes
+      # and drops the narrowing of a variable a lambda literal captures and writes ({#eval_lambda}). A guard's
+      # narrowing that a lambda body may rebind is restored as a call's would be, since its `===` runs the body.
+      def run_when_test(condition, before)
+        before = InterveningIvarReset.after_operand(condition, before, run_lambdas: true)
+        _type, after = sub_eval(condition, before)
+        body = when_lambda_body(condition)
+        return after unless body && after.guard_narrowed? && GuardRebinding.may_rebind?(body, after)
+
+        after.forget_guard_narrowings
+      end
+
+      def when_lambda_body(condition)
+        condition = condition.body.body.first while condition.is_a?(Prism::ParenthesesNode) &&
+                                                    condition.body.is_a?(Prism::StatementsNode) &&
+                                                    condition.body.body.size == 1
+        condition.body if condition.is_a?(Prism::LambdaNode)
+      end
+
+      # Whether the `when` test `condition`, which took `before` to `after`, may have rebound the variable `subject`
+      # reads: its binding moved, the test writes it, or — for an instance variable — a call in the test may write
+      # it ({InterveningIvarReset.may_write?}), or — for a global or constant — the test may run code that rebinds
+      # one ({GuardRebinding.may_rebind?}).
+      def when_test_rebinds_subject?(subject, condition, before, after)
+        name = case_subject_name(subject)
+        return false if name.nil?
+        return true unless case_subject_binding(subject, before) == case_subject_binding(subject, after)
+        return true if OperandEffects.written_variables(condition).include?(name)
+
+        case subject
+        when Prism::InstanceVariableReadNode
+          InterveningIvarReset.may_write?(condition, name, before, run_lambdas: true)
+        when Prism::LocalVariableReadNode
+          false
+        else
+          body = when_lambda_body(condition)
+          GuardRebinding.may_rebind?(condition, before) || (!body.nil? && GuardRebinding.may_rebind?(body, before))
+        end
+      end
+
+      def case_subject_name(subject)
+        case subject
+        when Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, Prism::GlobalVariableReadNode
+          subject.name
+        when Prism::ConstantReadNode, Prism::ConstantPathNode
+          Narrowing.constant_key(subject)
+        end
+      end
+
+      def case_subject_binding(subject, scope)
+        case subject
+        when Prism::LocalVariableReadNode then scope.local(subject.name)
+        when Prism::InstanceVariableReadNode then scope.ivar(subject.name)
+        when Prism::GlobalVariableReadNode then scope.global(subject.name)
+        else scope.constant_narrowing(Narrowing.constant_key(subject))
+        end
+      end
+
+      # Issue #1495 — a `case` without a subject tests each `when` condition for truthiness, in order, and stops at the
+      # first truthy one, so a clause is the `||` of its conditions in an `if` / `elsif` chain. Each condition is
+      # evaluated under the falsey edges of the conditions before it, in this clause and every earlier one; the body
+      # joins the conditions' truthy edges, and the next clause starts from the last falsey edge. A condition
+      # `Narrowing.predicate_scopes` does not recognise narrows nothing: a splat (`when *conds`), and a regexp literal,
+      # which is tested for its truthiness and matches nothing, so it binds no match global (#1486).
+      def subjectless_when_scopes(conditions, entry)
+        falsey = entry
+        truthy_edges = conditions.map do |condition|
+          _type, _post, truthy, falsey = eval_with_edges(condition, falsey)
+          truthy
+        end
+        [reduce_scopes_with_nil_injection(truthy_edges), falsey]
+      end
+
       # ADR-47 WD3a — a bare class pattern matches on `C === subject`, i.e. exactly `subject.is_a?(C)` with no
       # deconstruction, so it narrows like `when C`: the body sees the subject narrowed to `C` and the next clause's
       # falsey scope has `C` removed. Other patterns can fail to match even when a class test would pass (deconstruction
       # arity, hash keys, ...), so removing anything from the falsey scope would be unsound — they keep the conservative
       # shape.
       def in_branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
-        class_node = bare_class_pattern_node(branch.pattern)
-        unless class_node
-          bound = apply_in_pattern_bindings(subject_type, subject, branch.pattern, falsey_scope)
-          return [bound, falsey_scope]
-        end
-
-        truthy_scope, narrowed_falsey = Narrowing.case_when_scopes(subject, [class_node], falsey_scope)
+        truthy_scope, narrowed_falsey = Narrowing.case_clause_scopes(subject, branch, falsey_scope)
         [apply_in_pattern_bindings(subject_type, subject, branch.pattern, truthy_scope), narrowed_falsey]
       end
 
-      # The class-constant node of a `in C` / `in C => x` pattern (the only `in` shapes whose match is pure `is_a?`), or
-      # nil for any pattern that deconstructs, binds, or matches a value.
-      def bare_class_pattern_node(pattern)
-        case pattern
-        when Prism::ConstantReadNode, Prism::ConstantPathNode
-          pattern
-        when Prism::CapturePatternNode
-          value = pattern.value
-          value if value.is_a?(Prism::ConstantReadNode) || value.is_a?(Prism::ConstantPathNode)
-        end
-      end
-
       def eval_case_else(else_clause, falsey_scope)
         return sub_eval(else_clause, falsey_scope) if else_clause
 
@@ -1513,9 +1646,32 @@ module Rigor
 
       # The scope past `node`'s `ensure` clause, entered with `exit_scope`, the `next` and `break` scopes recorded past
       # `jump_marks` carried through it.
+      #
+      # Issue #1839 — the code after the `begin` runs only when the clause finished from a `begin` that did, so the
+      # scope it continues from is the clause's under `exit_scope`. A `return`, `next` or `break` in the clause can
+      # also leave from one that raised, after any prefix of the body: those jumps are taken from the pass under the
+      # widened entry ({#widen_clause_entry}), when a jump sink is installed to collect them ({#jump_sinks_installed?}).
       def eval_begin_ensure(node, exit_scope, jump_marks)
-        carry_jumps_through_ensure(node.ensure_clause, jump_marks)
-        eval_widened_clause(node.ensure_clause, node.ensure_clause.statements, exit_scope, ensure_writes(node)).last
+        clause = node.ensure_clause
+        carry_jumps_through_ensure(clause, jump_marks)
+        jumps = jump_sinks_installed? && clause_jumps?(clause.statements)
+        record_widened = widening_recorded?
+        widened = clause.statements && (jumps || record_widened) &&
+                  widen_clause_entry(exit_scope, ensure_writes(node), clause.statements)
+        return sub_eval(clause, exit_scope).last unless widened
+
+        record_operand_clause(clause.statements, widened) if record_widened
+
+        widened_options = record_widened ? {} : UNRECORDED
+        if jumps
+          sub_eval(clause, widened, **widened_options)
+        else
+          without_jump_sinks { sub_eval(clause, widened, next_scope_sink: nil, **widened_options) }
+        end
+        plain_options = record_widened ? UNRECORDED : {}
+        return sub_eval(clause, exit_scope, **plain_options).last unless jumps
+
+        without_jump_sinks { sub_eval(clause, exit_scope, next_scope_sink: nil, **plain_options) }.last
       end
 
       # Issue #1231 — a rescue clause runs after the body raised from any point in it, and an `ensure` clause after the
@@ -1523,22 +1679,27 @@ module Rigor
       # instance variable those wrote at a value the scope it enters with does not hold: `conn = nil; begin; conn =
       # open_conn; Integer(s); rescue; conn.size; end` reads the connection. The engine does not track where the body
       # raises (the precise recorder of #1397 put new false positives on correct code); it widens instead, and
-      # deliberately imprecisely. Each name the clause mentions ({#clause_mentions}) that its entry binds and those
-      # clauses write, outside a nested `def` or class body, reads as `Dynamic[top]`, which reports nothing. A plain
-      # join would read `x` as `1?` in `x = 1; begin; foo; x = nil; rescue; x.succ; end`, where it cannot be nil, and a
-      # `Dynamic` that keeps the join as its facet still narrows: `x.nil?` on `Dynamic[1 | 2]` leaves a `nil` member
-      # for the next call to report. A name written inside a nested `ensure` clause, which also runs on the way out of
-      # a raise, is covered by the same floor.
+      # deliberately imprecisely. Each name that the clause's entry binds and those clauses write, outside a nested
+      # `def` or class body, and that the clause mentions or they write more than once ({ClauseWidening}),
+      # reads as `Dynamic[top]`, which reports nothing. A plain join would read `x` as `1?` in `x
+      # = 1; begin; foo; x = nil; rescue; x.succ; end`, where it cannot be nil, and a `Dynamic` that keeps the join as
+      # its facet still narrows: `x.nil?` on `Dynamic[1 | 2]` leaves a `nil` member for the next call to report. A name
+      # written inside a nested `ensure` clause, which also runs on the way out of a raise, is covered by the same
+      # floor.
+      #
+      # Issue #1839 — the widening is not for the clause's own reads only: a rescue clause's value, the scope it falls
+      # through with and a `return`, `next` or `break` it takes all come from its widened entry, on every path (an
+      # inferred return included), so `got = begin; conn = make; work; rescue; conn; end` leaves `got` untyped rather
+      # than the entry's `nil`, and a name the clause never mentions but the body writes twice joins the code after the
+      # `begin` untyped rather than at the entry's binding, which misses every write the body made before the last.
       #
       # The names the clauses of `node` read from: the primary body's for a rescue clause, none under a retry `edge`.
       def rescue_writes(node, edge)
-        clause_writes([node.statements]) if node.rescue_clause && edge.nil? && widening_recorded?
+        clause_writes([node.statements]) if node.rescue_clause && edge.nil?
       end
 
       # For the `ensure` clause: the writes of the body, its `else` and every rescue clause.
       def ensure_writes(node)
-        return nil unless widening_recorded?
-
         sources = [node.statements, node.else_clause]
         current = node.rescue_clause
         while current
@@ -1548,83 +1709,68 @@ module Rigor
         clause_writes(sources)
       end
 
-      # The local and instance variable names `sources` write, a nested block's included (it may write an outer local),
-      # or nil for none. A `def` or class body writes nothing here.
-      def clause_writes(sources)
-        writes = nil
-        sources.each { |source| writes = collect_clause_names(source, CLAUSE_WRITE_NODES, nil, writes) if source }
-        writes
-      end
+      def clause_writes(sources) = ClauseWidening.writes(sources)
 
-      CLAUSE_WRITE_NODES = Set[
-        *CapturedLocals::LOCAL_WRITE_NODES,
-        Prism::InstanceVariableWriteNode,
-        Prism::InstanceVariableOperatorWriteNode,
-        Prism::InstanceVariableOrWriteNode,
-        Prism::InstanceVariableAndWriteNode,
-        Prism::InstanceVariableTargetNode
-      ].freeze
-      private_constant :CLAUSE_WRITE_NODES
+      CLAUSE_JUMP_NODES = Set[Prism::ReturnNode, Prism::NextNode, Prism::BreakNode].freeze
+      private_constant :CLAUSE_JUMP_NODES
 
-      CLAUSE_MENTION_NODES = Set[
-        Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, *CLAUSE_WRITE_NODES
-      ].freeze
-      private_constant :CLAUSE_MENTION_NODES
+      # Whether a `return`, `next` or `break` reached here is collected: a pass {#without_jump_sinks} runs collects
+      # none, so an `ensure` clause inside it, nested at any depth, is evaluated once rather than once per pass of
+      # every enclosing clause holding a jump.
+      def jump_sinks_installed?
+        !@next_scope_sink.nil? || JUMP_SINK_KEYS.any? { |key| Thread.current[key] }
+      end
 
-      # The names of the `node_classes` nodes under `node` (restricted to `among` when given) added to `found`, outside
-      # a nested `def` or class body.
-      def collect_clause_names(node, node_classes, among, found)
-        return found if SCOPE_BODY_NODES.any? { |klass| node.is_a?(klass) }
+      # Whether `node` holds a `return`, `next` or `break` outside a nested `def`.
+      def clause_jumps?(node)
+        return false if node.nil? || node.is_a?(Prism::DefNode)
+        return true if CLAUSE_JUMP_NODES.include?(node.class)
 
-        if node_classes.include?(node.class) && (among.nil? || among.include?(node.name))
-          (found ||= Set.new) << node.name
-        end
-        node.rigor_each_child { |child| found = collect_clause_names(child, node_classes, among, found) }
-        found
+        node.rigor_each_child { |child| return true if clause_jumps?(child) }
+        false
       end
 
-      # `clause_scope` with each name of `writes` that `statements` mentions, and `clause_scope` binds, rebound to
-      # `Dynamic[top]`, or nil when none changes.
-      def widen_clause_entry(clause_scope, statements, writes)
-        return nil if writes.nil? || statements.nil? || !widening_recorded?
+      # `clause_scope` entering `clause` with the names of `writes` {ClauseWidening.widen} picks rebound to
+      # `Dynamic[top]`, or nil when none changes. An empty rescue clause is widened too: the scope it falls through
+      # with is its entry.
+      def widen_clause_entry(clause_scope, writes, clause) = ClauseWidening.widen(clause_scope, writes, clause)
 
-        names = collect_clause_names(statements, CLAUSE_MENTION_NODES, writes, nil)
-        return nil if names.nil?
+      # Issue #1839 — an operand evaluator ({#thread_operand}) records only the later operands its walk takes, so the
+      # index's walk hands a clause it evaluated the scope of the `begin`'s nearest recorded ancestor, which binds
+      # each name the body writes as the `begin` found it: `puts(begin; conn = make; work; rescue; conn.size; end)`
+      # read `conn` as `nil`. On the check path it records the clause's `statements` under the `widened` entry, with
+      # `$!`, `$@` and `$?` unbound as the walk leaves them for a clause the evaluator did not enter; the
+      # walk fills the clause's nodes from there. The clause's later operands are recorded by its own pass. An
+      # evaluator that records its nodes itself skips this: its pass over the clause records `statements` right
+      # after, and the index keeps the last visit, so the `@on_enter` test is a guard no example can fail.
+      def record_operand_clause(statements, widened)
+        return unless statements && widened && @on_enter.nil? && @operand_recorder && widening_recorded?
 
-        untyped = Type::Combinator.untyped
-        widened = names.reduce(clause_scope) do |acc, name|
-          kind = name.start_with?("@") ? :ivar : :local
-          current = clause_scope.public_send(VAR_KIND_GETTERS.fetch(kind), name)
-          current.nil? || current == untyped ? acc : rebind_variable(acc, kind, name, untyped)
-        end
-        widened.equal?(clause_scope) ? nil : widened
+        @operand_recorder.call(statements, widened.forget_error_info.forget_last_status)
       end
 
-      # Whether a widened pass would record anything: only the check path asks for one ({#initialize}'s
-      # `widen_clauses`), and a pass nothing records is skipped, so a nested clause inside an unrecorded pass is
-      # evaluated once.
+      # Whether this pass records the per-node index under a clause's widened entry: only the check path asks for that
+      # ({#initialize}'s `widen_clauses`). Every other recorder keeps the clause's plain entry ({#recording?}).
       def widening_recorded?
-        @widen_clauses && !(@on_enter.nil? && @operand_recorder.nil?)
+        @widen_clauses && recording?
       end
 
-      # `[type, scope]` of a rescue or `ensure` clause entered with `clause_scope`. When {#widen_clause_entry} widens
-      # it, the clause is evaluated twice: under the widened entry for the per-node index, which is what the check
-      # rules read, and under `clause_scope` without recording, for the value and the scope the code after the
-      # `begin` continues from. The widened pass collects no `return`, `next`, `break` or retry-edge scope, so the
-      # widening reaches neither an inferred return nor a loop: it can only take diagnostics away inside the clause.
-      def eval_widened_clause(node, statements, clause_scope, writes)
-        widened = widen_clause_entry(clause_scope, statements, writes)
-        return sub_eval(node, clause_scope) unless widened
-
-        eval_widened_pass(node, widened)
-        sub_eval(node, clause_scope, **UNRECORDED)
+      # Whether this pass records the per-node index at all.
+      def recording?
+        !(@on_enter.nil? && @operand_recorder.nil?)
       end
 
-      # The recorded pass over a widened clause: it reaches no `return`, `next`, `break` or retry-frame sink.
-      def eval_widened_pass(node, widened)
-        return if node.nil?
+      # `[type, scope]` of a rescue clause's `statements` entered with `widened` ({#widen_clause_entry}), the value,
+      # the scope and the jumps the code after the `begin` sees. A recorder that keeps the clause's plain entry
+      # ({#widening_recorded?}) records a second pass under `plain` that reaches no jump sink, so nothing records twice.
+      # The widened pass then records nothing, and a clause nested inside it is evaluated once, so `d` nested clauses
+      # cost `d * (d + 1) / 2` evaluations; every other pass evaluates the clause once.
+      def eval_widened_clause(statements, plain, widened, on_enter:)
+        return [Type::Combinator.constant_of(nil), widened] if statements.nil?
+        return sub_eval(statements, widened, on_enter: on_enter) if widening_recorded? || !recording?
 
-        without_jump_sinks { sub_eval(node, widened, next_scope_sink: nil) }
+        without_jump_sinks { sub_eval(statements, plain, next_scope_sink: nil, on_enter: on_enter) }
+        sub_eval(statements, widened, **UNRECORDED)
       end
 
       # Runs `block` with no `return`, `next`, `break` or retry-frame sink installed.
@@ -1735,6 +1881,10 @@ module Rigor
       CLAUSE_SINK_KEYS = [RETURN_SINK_KEY, NEXT_SINK_KEY, BREAK_SINK_KEY, BREAK_VALUE_SINK_KEY, RETRY_FRAMES_KEY].freeze
       private_constant :CLAUSE_SINK_KEYS
 
+      # The thread-local sinks a `return`, `next` or `break` is collected into.
+      JUMP_SINK_KEYS = (CLAUSE_SINK_KEYS - [RETRY_FRAMES_KEY]).freeze
+      private_constant :JUMP_SINK_KEYS
+
       # The retry edge of `node`, or nil when no `retry` in its rescue chain targets it. Allocation-free for a `begin`
       # no `retry` targets.
       def retry_edge_for(node)
@@ -2012,7 +2162,7 @@ module Rigor
       # runs on the way out (`begin; retry; ensure; tries += 1; end`), or one made before a `retry` the evaluator only
       # types (`log(tries < 5 ? retry : :gave_up)`).
       #
-      # Issue #1231 — `writes` widens the scope each clause enters with, as {#eval_widened_clause} does, before its
+      # Issue #1231 — `writes` widens the scope each clause enters with ({#widen_clause_entry}) before its
       # reference is bound, so `rescue => e` still binds `e` to the exception. It is nil under a retry edge, which
       # already carries every scope the primary body raises from ({#widen_entry_for_retry}).
       def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil, writes: nil)
@@ -2020,11 +2170,12 @@ module Rigor
         results = []
         current = rescue_node
         while current
-          widened = widen_clause_entry(entry_scope, current.statements, writes)
-          eval_widened_pass(current.statements, bind_rescue_reference(current, widened)) if widened
+          widened = widen_clause_entry(entry_scope, writes, current.statements)
+          record_operand_clause(current.statements, widened)
           rescue_scope = bind_rescue_reference(current, entry_scope)
           arm = if widened
-                  sub_eval(current.statements, rescue_scope, **UNRECORDED)
+                  eval_widened_clause(current.statements, rescue_scope, bind_rescue_reference(current, widened),
+                                      on_enter: on_enter)
                 else
                   eval_branch_or_nil(current.statements, rescue_scope, on_enter: on_enter)
                 end
@@ -2065,18 +2216,29 @@ module Rigor
         after.global(:$_) == Type::Combinator.untyped && !LastLine.may_set?(node.statements, scope)
       end
 
+      # Issue #1889 — {#eval_for} with a literal-name `instance_variable_set` in the body joining its value into the
+      # ivar's binding rather than replacing it ({ReflectiveIvarWrite.in_repeating_body}): a `for` body has no rebind
+      # fixpoint. A `while` / `until` body needs no such join since issue #1930: its fixpoint widens the ivar
+      # ({#loop_body_ivar_writes}).
+      def eval_repeating_for(node) = ReflectiveIvarWrite.in_repeating_body { eval_for(node) }
+
       # `while pred; body; end` / `until pred; body; end`. The body might run zero or more times, so half-bound names
       # degrade to `T | nil` in the post-loop scope. The loop expression itself types as `Constant[nil]` (Slice 3 phase
       # 1), reflecting the common case where no `break VALUE` is observed.
       def eval_loop(node)
-        _pred_type, post_pred = sub_eval(node.predicate, loop_entry_scope(node))
+        # Issue #1930 — the predicate runs before every iteration but is walked once, so a literal-name
+        # `instance_variable_set` in it joins its value and `Dynamic[top]` ({ReflectiveIvarWrite.in_repeating_body}):
+        # the rebind fixpoint tracks the body's writes only.
+        entry = loop_entry_scope(node)
+        _pred_type, post_pred = ReflectiveIvarWrite.in_repeating_body { sub_eval(node.predicate, entry) }
         post_pred = widen_predicate_pins(node, post_pred)
         return [Type::Combinator.constant_of(nil), narrow_loop_exit_edge(node, post_pred)] if node.statements.nil?
 
         # The historical single body pass joined with the pre-loop scope. This continues to carry everything the
         # fixpoint does NOT track: receiver-mutation widening of non-rebound locals (`buf.push(i)` widens `buf`'s
-        # Tuple), body-introduced locals' nil-injection, an instance variable's rebind, and the loop value itself. The
-        # fixpoint then OVERLAYS only the rebound-local bindings it corrects.
+        # Tuple), body-introduced locals' nil-injection, a rebind of an instance variable the fixpoint does not track
+        # ({#loop_body_ivar_writes}), and the loop value itself. The fixpoint then OVERLAYS only the rebound bindings it
+        # corrects.
         #
         # Like every fixpoint pass, it enters the body on the predicate's loop-entry edge ({#loop_pass_entry}): the
         # body of `while (line = gets)` reads `line` as `String`, and the body of `while gets` reads `$_` as one
@@ -2089,8 +2251,7 @@ module Rigor
         body_scope, first_breaks = single_pass(node, post_pred, jumps)
         base_scope = join_with_nil_injection(post_pred, body_scope)
 
-        rebound, body_first = loop_body_local_writes(node.statements, post_pred)
-        names = rebound + body_first
+        names, body_first = loop_rebound_names(node.statements, post_pred)
 
         # Fast path: a loop whose body rebinds no local skips the rebind fixpoint, but still needs the slice-C content
         # writeback (a loop may content-mutate a collection without rebinding any local — `acc << x`), so apply it to
@@ -2183,7 +2344,7 @@ module Rigor
         # assumptions, so the last-visit-wins scope index would annotate loop-body lines with stale pre-convergence
         # constants. One extra pass from the converged bindings (result discarded) re-records the body's entry scopes.
         record_converged_loop_body(node, post_pred, result, names, body_first, jumps, break_pass)
-        post_loop = result.reduce(base_scope) { |acc, (name, type)| acc.with_local(name, type) }
+        post_loop = result.reduce(base_scope) { |acc, (name, type)| bind_capture(acc, name, type) }
         # ADR-56 slice C — loop-body receiver-content element-type join. A loop that content-mutates a collection (`acc
         # << n`) keeps only the seed's element types after the single-pass widen; join the appended/stored types into
         # the continuation collection. Pre-state comes from `post_pred` for a name the loop only content-mutates and
@@ -2251,6 +2412,13 @@ module Rigor
       NO_LOOP_NAMES = [].freeze
       private_constant :NO_LOOP_BINDINGS, :NO_LOOP_NAMES
 
+      # The instance-variable write forms {#loop_body_ivar_writes} counts.
+      IVAR_WRITE_NODES = Set[
+        Prism::InstanceVariableWriteNode, Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableOrWriteNode,
+        Prism::InstanceVariableAndWriteNode, Prism::InstanceVariableTargetNode
+      ].freeze
+      private_constant :IVAR_WRITE_NODES
+
       # A body with no targeting jump pays two allocation-free scans.
       def loop_jumps(statements)
         kinds = JumpTargets.kinds(statements, LOOP_JUMP_CLASSES)
@@ -2346,11 +2514,11 @@ module Rigor
         floor = Type::Combinator.untyped
         breaks.reduce(continuation) do |cont, break_scope|
           names.reduce(cont) do |acc, name|
-            break_value = break_scope.local(name)
-            current = acc.local(name)
+            break_value = CapturedLocals.bound_type(break_scope, name)
+            current = CapturedLocals.bound_type(acc, name)
             next acc if break_value.nil? || current == floor
 
-            acc.with_local(name, current ? Type::Combinator.union(current, break_value) : break_value)
+            bind_capture(acc, name, current ? Type::Combinator.union(current, break_value) : break_value)
           end
         end
       end
@@ -2423,7 +2591,7 @@ module Rigor
       # treatment. `break_pass` rides along so every pass leaves its `break` arms for {#loop_break_arms}.
       def loop_rebind_fixpoint(node, post_pred, names, body_first, jumps, break_pass)
         nil_const = Type::Combinator.constant_of(nil)
-        seed = names.to_h { |name| [name, post_pred.local(name) || nil_const] }
+        seed = names.to_h { |name| [name, CapturedLocals.bound_type(post_pred, name) || nil_const] }
         evaluate_body = lambda do |bindings|
           loop_body_exit_bindings(node, post_pred, bindings, names, body_first, jumps, break_pass)
         end
@@ -2455,6 +2623,34 @@ module Rigor
         [pre_existing.uniq, body_first.uniq - pre_existing.uniq]
       end
 
+      # Every name {#eval_loop}'s rebind fixpoint tracks, and the body-first locals among them: the locals the body
+      # rebinds ({#loop_body_local_writes}) and the instance variables ({#loop_body_ivar_writes}).
+      def loop_rebound_names(statements, base_scope)
+        rebound, body_first = loop_body_local_writes(statements, base_scope)
+        [rebound + loop_body_ivar_writes(statements, base_scope) + body_first, body_first]
+      end
+
+      # Issue #1930 — the instance variables the loop body can rebind, which the rebind fixpoint widens as it widens a
+      # local: a write node (`@n = i + 1`, any depth, a nested block's included) or a literal-name
+      # `instance_variable_set` on `self` ({ReflectiveIvarWrite.literal_name}). Only an ivar `base_scope` binds off its
+      # ADR-58 declaration seed counts ({CapturedLocals.rebindable_ivar?}), as for a block's write-back: one the method
+      # has not bound reads `Dynamic[top]` before the loop, and the join drops it after; one on its declaration seed
+      # already holds the union of every write in the class. A call that writes the ivar inside the callee
+      # (`self.bump`) is not a write here; the intervening-call reset handles it.
+      def loop_body_ivar_writes(statements, base_scope)
+        return NO_LOOP_NAMES if base_scope.ivars.empty?
+
+        names = nil
+        Source::NodeWalker.each(statements) do |descendant|
+          name = ReflectiveIvarWrite.literal_name(descendant) ||
+                 (descendant.name if IVAR_WRITE_NODES.include?(descendant.class))
+          next if name.nil? || names&.include?(name) || !CapturedLocals.rebindable_ivar?(base_scope, name)
+
+          (names ||= []) << name
+        end
+        names || NO_LOOP_NAMES
+      end
+
       # Evaluates the loop body once with each fixpoint-tracked local bound to the supplied running assumption and
       # returns the per-name exit binding. Used as the {BodyFixpoint} body-evaluator for `eval_loop`.
       #
@@ -2483,14 +2679,14 @@ module Rigor
           break_pass[:entry] = bindings.except(*body_first)
           break_pass[:arms] = breaks
         end
-        names.to_h { |name| [name, exit_scope.local(name)] }
+        names.to_h { |name| [name, CapturedLocals.bound_type(exit_scope, name)] }
       end
 
       # The scope one fixpoint pass enters the body with: `post_pred` overlaid with the pre-existing names' running
       # assumption, then narrowed by the predicate's loop-entry edge ({#loop_body_exit_bindings} carries the why).
       def loop_pass_entry(node, post_pred, bindings, body_first, jumps)
         overlaid = bindings.except(*body_first)
-        entry = overlaid.reduce(post_pred) { |acc, (name, type)| acc.with_local(name, type) }
+        entry = overlaid.reduce(post_pred) { |acc, (name, type)| bind_capture(acc, name, type) }
         entry = loop_content_entry(node.statements, post_pred, entry)
         truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, entry)
         edge = node.is_a?(Prism::UntilNode) ? falsey_scope : truthy_scope
@@ -2856,15 +3052,47 @@ module Rigor
         # u.strip`, where the raise almost always comes from `Float` after it. Neither the arm nor anything in it
         # is recorded or typed from there, which keeps it where it was before #1256: an ADR-5 trade of the rare
         # raise-before-write path for no false positive on the common one.
-        arm_entry = ErrorInfo.modifier_entry(join_with_nil_injection(scope, after_expression), node.rescue_expression)
-        after_rescue = thread_operand(node.rescue_expression, arm_entry, OperandWalk.new(nil), arm_entry)
-        type = OperandWalk.type_of(scope, node, tracer, walk.types(tracer))
+        #
+        # Issue #1839 — the arm enters with each name `expr` writes that it mentions, or that `expr` writes more
+        # than once, read as `Dynamic[top]` ({#widen_clause_entry}), as a `begin`'s rescue clause does: the raise
+        # may come after any of those writes. The scope past the modifier joins that entry through the arm.
+        fallback = node.rescue_expression
+        writes = clause_writes([node.expression])
+        record_modifier_fallback(fallback, writes, walk)
+        joined = join_with_nil_injection(scope, after_expression)
+        widened = widen_clause_entry(joined, writes, fallback)
+        arm_entry = ErrorInfo.modifier_entry(widened || joined, fallback)
+        after_rescue = thread_operand(fallback, arm_entry, OperandWalk.new(nil), arm_entry)
         after = if branch_unconditionally_exits?(node.rescue_expression)
                   after_expression
                 else
                   join_with_nil_injection(after_expression, after_rescue)
                 end
-        [type, after]
+        [rescue_modifier_type(node, walk, widened && arm_entry), after]
+      end
+
+      # Issue #1839 — the walk records nothing in the fallback, so the index's walk hands it the modifier's own entry,
+      # which binds each name `expr` writes as the modifier found it: `conn = nil; (conn = make; work) rescue
+      # conn.size` read `conn` as `nil`. The fallback is recorded under that entry with the names `writes`
+      # {ClauseWidening.widen} picks read as `Dynamic[top]`, and `$!`, `$@` and `$?` unbound as the walk leaves them,
+      # when the widening changes it and the check path asks for it ({#widening_recorded?}). A name `expr` first
+      # binds keeps the entry's reading, for the trade above.
+      def record_modifier_fallback(fallback, writes, walk)
+        return unless walk.recorder && @widen_clauses
+
+        widened = widen_clause_entry(scope, writes, fallback)
+        walk.recorder.call(fallback, widened.forget_error_info.forget_last_status) if widened
+      end
+
+      # Issue #1839 — the value of `expr rescue alt`: the fallback is typed from `widened_entry`, its entry with each
+      # name `expr` writes read as `Dynamic[top]` ({#widen_clause_entry}), as a `begin`'s rescue clause reads it, not
+      # at the entry's binding: `got = (conn = make; work) rescue conn` leaves `got` untyped, not `nil`. Nil when the
+      # widening changes nothing, and the modifier is typed whole.
+      def rescue_modifier_type(node, walk, widened_entry)
+        return OperandWalk.type_of(scope, node, tracer, walk.types(tracer)) unless widened_entry
+
+        Type::Combinator.union(OperandWalk.type_of(scope, node.expression, tracer, walk.types(tracer)),
+                               widened_entry.type_of(node.rescue_expression, tracer: tracer))
       end
 
       # `class Foo; body; end` and `module Foo; body; end`. The class body runs in a fresh scope (Ruby's class scope
@@ -2929,6 +3157,7 @@ module Rigor
       # evaluates `def` to the method's name as a Symbol, so the produced type is `Constant[:name]`.
       def eval_def(node)
         body_scope = build_method_entry_scope(node)
+        body_scope = body_scope.with_repeated_or_writes(RepeatedOrWrites.straight_line_sites(node.body, body_scope))
         # Parameter default value expressions (e.g. `self.x` in `def copy(x: self.x)`) execute when the method is
         # *invoked*, not when the `def` is read; their `self` is the instance receiver, not the surrounding class body.
         # Walk the parameters subtree under `body_scope` so the scope-index records the instance `self_type` for every
@@ -3119,7 +3348,7 @@ module Rigor
         # map …) that rebinds an outer local must not leave that local's pre-call binding unmodified in the continuation
         # scope; the spec MUST in § "Fact stability and mutation" names captured locals a first-class invalidation
         # category. (The escaping / unknown path already widened to Dynamic[top] via `record_closure_escape_if_any`.)
-        post_scope = write_back_block_captures(node, post_scope)
+        post_scope = block_capture_continuation(node, post_scope)
         statement_call = !call_type.nil? && !@in_operand
         post_scope = apply_post_return_narrowing(node, post_scope) if statement_call
         # Flow-folding G1 / G2 — widen a local- or instance-variable binding when the call is an in-place mutator on it
@@ -3170,6 +3399,9 @@ module Rigor
         # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts). See
         # [`docs/CURRENT_WORK.md`](../../../docs/CURRENT_WORK.md) § "Flow-folding" — G2 intervening-call case.
         post_scope = invalidate_ivars_for_intervening_call(node, post_scope) if statement_call
+        # Issue #1889 — `instance_variable_set` on `self` writes an ivar no write node shows. It runs after the reset
+        # above, which would join a literal-name write back into the class seed.
+        post_scope = ReflectiveIvarWrite.apply(node, post_scope) { type_operand(ReflectiveIvarWrite.value_node(node)) }
         # C1 — regex match-data globals (`$~`, `$1..$N`, `$&`, …) are narrowed to non-nil on a successful-match edge; a
         # later call that itself runs a regex match rebinds them, so the narrowed facts must be dropped. We forget them
         # only when the call may run a match in this frame ({#rebinds_match_globals?}). A call provably match-free on a
@@ -3191,7 +3423,13 @@ module Rigor
         post_scope = post_scope.forget_match_globals if rebinds_match_globals?(node, post_scope)
         post_scope = post_scope.forget_last_line if rebinds_last_line?(node, post_scope)
         if post_scope.guard_narrowed? && GuardRebinding.call_may_rebind?(node, operand_scope)
-          post_scope = post_scope.forget_guard_narrowings
+          # Issue #1596 — a self-call proven to write only some instance variables restores only theirs.
+          writes = intervening_call_candidate?(node) ? self_call_ivar_writes(node) : nil
+          post_scope = if writes
+                         writes.reduce(post_scope) { |acc, name| acc.forget_guard_narrowing_of(:ivar, name) }
+                       else
+                         post_scope.forget_guard_narrowings
+                       end
         end
         forget_rescued_status(LastStatus.after(node, post_scope, scope), node)
       end
@@ -3316,30 +3554,35 @@ module Rigor
       # Returns a scope with each ivar's narrowed local binding widened back to its class-ivar seed value when the call
       # is one that could plausibly mutate ivars on the enclosing class (implicit-self or explicit `self.foo`).
       # External- receiver calls (`obj.method`) cannot reach the caller's ivars; they pass through unchanged.
+      # Issue #1596 — where the call is proven to write only some ivars ({#self_call_ivar_writes}), only those widen.
+      #
+      # Issue #1402 — a proc's call (`blk.call`) is a candidate too, and so is a call on another receiver whose literal
+      # block makes one ({InterveningIvarReset.after_block}: `[1].each { reset }`). Both widen as a condition's
+      # calls do, marking a binding whose narrowing had ruled `nil` out, since the code they run is far more often
+      # code that leaves the variable alone. A `yield` or proc call in the call's receiver or arguments
+      # (`@items << yield`, `puts(yield)`) widens every narrowed ivar ({InterveningIvarReset.after_operands}).
       def invalidate_ivars_for_intervening_call(call_node, current_scope)
-        return current_scope unless intervening_call_candidate?(call_node)
-
-        class_name = enclosing_class_name_for(current_scope.self_type)
-        return current_scope if class_name.nil?
-
-        seed = current_scope.class_ivars_for(class_name)
-        return current_scope if seed.empty?
+        widened =
+          if intervening_call_candidate?(call_node)
+            mark = !InterveningIvarReset.self_call?(call_node)
+            InterveningIvarReset.widen(current_scope, mark: mark) { self_call_ivar_writes(call_node) }
+          else
+            InterveningIvarReset.after_block(call_node, current_scope)
+          end
+        InterveningIvarReset.after_operands(call_node, widened)
+      end
 
-        widened = current_scope
-        seed.each do |ivar_name, seed_type|
-          local_type = current_scope.ivar(ivar_name)
-          next if local_type.nil? || local_type == seed_type
+      # Issue #1596 — the ivars the implicit-self / `self.` call `call_node` may write, or nil when that is not proven
+      # ({SelfCallIvarWrites.of}). Memoised per call node: the reset and the guard restore ask it of the same call.
+      def self_call_ivar_writes(call_node)
+        memo = (@self_call_ivar_writes ||= {}.compare_by_identity)
+        return memo[call_node] if memo.key?(call_node)
 
-          widened = widened.with_ivar(ivar_name, Type::Combinator.union(local_type, seed_type))
-        end
-        widened
+        memo[call_node] = SelfCallIvarWrites.of(call_node, operand_scope)
       end
 
       def intervening_call_candidate?(call_node)
-        return false unless call_node.is_a?(Prism::CallNode)
-
-        receiver = call_node.receiver
-        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+        InterveningIvarReset.candidate?(call_node)
       end
 
       def enclosing_class_name_for(self_type)
@@ -3839,7 +4082,7 @@ module Rigor
         classification = classify_closure_escape(node)
         return post_scope if classification == :non_escaping
 
-        post_scope = escaping_closure_captures(node.block, post_scope)
+        post_scope = escaping_closure_captures(node.block, post_scope, foreign_self: foreign_self_block?(node))
         post_scope.with_fact(
           Analysis::FactStore::Fact.new(
             bucket: :dynamic_origin,
@@ -4143,13 +4386,72 @@ module Rigor
       # callback that runs later writes the very ivar the continuation reads (`@clicked = false; button.on_click {
       # @clicked = true }` left `if @clicked` folding always-falsey). One still on its ADR-58 declaration seed is
       # left alone ({CapturedLocals.writes}): that seed already holds whatever the callback stores.
-      def drop_captured_narrowing(block_node, base_scope)
-        names = CapturedLocals.writes(block_node, base_scope, ivars: true)
+      def drop_captured_narrowing(block_node, base_scope, foreign_self: false)
+        names = CapturedLocals.writes(block_node, base_scope, ivars: true, foreign_self: foreign_self)
         return base_scope if names.empty?
 
         names.reduce(base_scope) { |acc, name| bind_capture(acc, name, Type::Combinator.untyped) }
       end
 
+      # The continuation {#write_back_block_captures} binds, after which the block's later-run `return`s are collected
+      # ({#collect_repeated_block_returns}).
+      def block_capture_continuation(call_node, post_scope)
+        post_scope = write_back_block_captures(call_node, post_scope)
+        collect_repeated_block_returns(call_node, post_scope)
+        post_scope
+      end
+
+      # Issue #2123 — the `return`s a repeating block reaches only on a later run. Every statement pass over a block
+      # enters with a captured local or ivar the body rebinds at a binding some run can hold, but not at every such
+      # binding: the statement pass enters at the call-site binding, and the ADR-56 write-back's capped fixpoint widens
+      # its last assumption without running a pass from it. So
+      # `seen = 0; items.each { return false if (seen += 1) > 3 }; true` read `seen` as at most `3` on every pass, the
+      # `return` was never reached, the method inferred `true`, and a caller's `if` on it folded always-falsey on
+      # correct code.
+      #
+      # While a method's return sink is active, a block that may repeat ({#repeating_block_class}), rebinds a capture,
+      # and holds a `return` that exits the method ({ReturnBarrier.exits_method?}) gets one more unrecorded pass, with
+      # each rebound name bound to its pre-call binding joined with its continuation `post_scope` holds. The
+      # continuation covers every run count, so it covers the binding any run enters with. The pass records no
+      # scope, and the method's fall-through and earlier `return`s are kept, so the inferred return type only widens.
+      # The fresh `next`, `break`-value and `break`-scope sinks are defensive: every consumer of those sinks filters by
+      # jump-node identity, so no example tells them apart from the outer sinks today. So is the `rescue`: a raise here
+      # keeps the arms the earlier passes collected rather than taking out the method.
+      def collect_repeated_block_returns(call_node, post_scope)
+        return if Thread.current[RETURN_SINK_KEY].nil?
+
+        block = call_node.block
+        return unless repeated_block_return_candidate?(call_node, block)
+
+        names = CapturedLocals.writes(block, scope, ivars: true, foreign_self: foreign_self_block?(call_node))
+        return if names.empty?
+
+        bindings = names.to_h do |name|
+          [name, Type::Combinator.union(*[scope, post_scope].filter_map { |s| CapturedLocals.bound_type(s, name) })]
+        end
+        entry = with_repeated_or_write_marks(call_node, block, block_pass_entry(call_node, block, bindings))
+        StatementEvaluator.with_next_sink do
+          StatementEvaluator.with_break_value_sink do
+            collect_break_scopes { sub_eval(block, entry, **UNRECORDED, next_scope_sink: nil) }
+          end
+        end
+      rescue StandardError
+        nil
+      end
+
+      # Whether `block` is an ordinary block (not a return barrier or a class-body block) whose body may `return` from
+      # the method and which `call_node` may run more than once: {#repeating_block_class}'s rule, or `Kernel#loop`,
+      # which that rule leaves out and which runs its block until it breaks or raises. The barrier, refinement and
+      # anonymous-class checks are defensive guards: no such call repeats under that rule today.
+      def repeated_block_return_candidate?(call_node, block)
+        return false unless block.is_a?(Prism::BlockNode)
+        return false unless ReturnBarrier.exits_method?(block.body)
+        return false if return_barrier_block?(call_node) || refined_class_context(call_node)
+        return false if AnonymousMetaClass.name_for(call_node, scope.source_path)
+
+        BlockCallTiming.kernel_loop?(call_node) || !repeating_block_class(call_node).nil?
+      end
+
       # ADR-56 slice A. For a `:non_escaping` block, fold the continuation binding of every outer local the body can
       # rebind back into `post_scope`. The binding is a capped fixpoint (cap 3) over the block body re-evaluated under
       # the running per-name assumption, joined with the pre-call binding (kept as a constituent so the 0-iteration path
@@ -4174,13 +4476,27 @@ module Rigor
         return post_scope unless block.is_a?(Prism::BlockNode)
         return post_scope unless classify_closure_escape(call_node) == :non_escaping
 
-        names = CapturedLocals.writes(block, scope, ivars: true)
+        names = CapturedLocals.writes(block, scope, ivars: true, foreign_self: foreign_self_block?(call_node))
         return post_scope if names.empty?
 
         break_pass = block_break_pass(block)
-        result = converge_captures_by_kind(call_node, block, names, break_pass)
+        marks = {}
+        result = with_capture_exit_marks(marks) { converge_captures_by_kind(call_node, block, names, break_pass) }
         result = join_block_break_bindings(call_node, block, result, break_pass)
-        result.reduce(post_scope) { |acc, (name, type)| bind_capture(acc, name, type) }
+        result.reduce(post_scope) { |acc, (name, type)| bind_capture(acc, name, type, optimistic: marks[name]) }
+      end
+
+      # Issue #1402 — runs the write-back's passes with `marks` collecting the ADR-101 optimistic mark a pass's exit
+      # holds for each rebound name ({#block_exit_bindings}), as the per-element fold collects them
+      # (`ExpressionTyper#captured_exit_bindings`). A later pass enters on that mark, and the continuation binds it:
+      # `x = false; pairs.each { x = pairs.first&.empty? }` stored the miss's `nil` at run time, and without the mark
+      # `x.nil?` folded to `false` where the inline `pairs.first&.empty?.nil?` answers `bool`.
+      def with_capture_exit_marks(marks)
+        outer = @capture_exit_marks
+        @capture_exit_marks = marks
+        yield
+      ensure
+        @capture_exit_marks = outer
       end
 
       # The {BodyFixpoint} continuation of `names`, seeded from their pre-call bindings.
@@ -4239,7 +4555,12 @@ module Rigor
       # Binds a name from `CapturedLocals.writes`. An ivar goes through {CapturedLocals.bind}, which keeps its issue
       # #286 optimistic mark. A local keeps the plain `with_local` these seams have always used, so a block that
       # rebinds no ivar leaves the locals exactly as before.
-      def bind_capture(scope, name, type)
+      #
+      # Issue #1402 — `optimistic` is a mark a write-back pass's exit held ({#with_capture_exit_marks}); a name that has
+      # one binds through {CapturedLocals.bind} whatever its kind, which adds it.
+      def bind_capture(scope, name, type, optimistic: nil)
+        return CapturedLocals.bind(scope, name, type, optimistic: optimistic) if optimistic
+
         CapturedLocals.ivar_name?(name) ? CapturedLocals.bind(scope, name, type) : scope.with_local(name, type)
       end
 
@@ -5103,9 +5424,22 @@ module Rigor
       def block_exit_bindings(call_node, block, bindings, names)
         entry = with_repeated_or_write_marks(call_node, block, block_pass_entry(call_node, block, bindings))
         _type, exit_scope = sub_eval(block, entry)
+        record_capture_exit_marks(exit_scope, names)
         names.to_h { |name| [name, CapturedLocals.bound_type(exit_scope, name)] }
       end
 
+      # Issue #1402 — records into {#with_capture_exit_marks}' table the mark `exit_scope` holds for each of `names`;
+      # the first mark a name takes stays.
+      def record_capture_exit_marks(exit_scope, names)
+        marks = @capture_exit_marks
+        return if marks.nil?
+
+        names.each do |name|
+          mark = CapturedLocals.optimistic_mark(exit_scope, name)
+          marks[name] ||= mark if mark
+        end
+      end
+
       # The entry scope of one write-back pass: the block's entry with each written outer local or ivar bound to
       # `bindings`, and each captured local the body only mutates in place at its widening ({#capture_pass_bindings}).
       # That widening describes the same object, so it keeps the marks a source-level write drops (issue #1287,
@@ -5114,7 +5448,9 @@ module Rigor
       def block_pass_entry(call_node, block, bindings)
         entry = build_block_entry_scope(call_node, block)
         capture_pass_bindings(block, bindings).reduce(entry) do |acc, (name, type)|
-          bindings.key?(name) ? bind_capture(acc, name, type) : acc.with_mutated_local(name, type)
+          next acc.with_mutated_local(name, type) unless bindings.key?(name)
+
+          bind_capture(acc, name, type, optimistic: @capture_exit_marks&.[](name))
         end
       end
 
@@ -5218,7 +5554,7 @@ module Rigor
       def unproven_rebind_bindings(call_node, block, classification)
         return NO_CAPTURE_BINDINGS if call_node.receiver && classification == :non_escaping
 
-        names = CapturedLocals.writes(block, scope, ivars: true)
+        names = CapturedLocals.writes(block, scope, ivars: true, foreign_self: foreign_self_block?(call_node))
         return NO_CAPTURE_BINDINGS if names.empty?
 
         untyped = Type::Combinator.untyped
@@ -5333,8 +5669,16 @@ module Rigor
       # The continuation effects of an escaping closure body: the outer locals it can rebind drop their narrowing, and
       # the ones it content-mutates are floored. Shared by the two spellings — a block on an escaping call
       # ({#record_closure_escape_if_any}) and a lambda literal ({#eval_lambda}) — so they cannot drift.
-      def escaping_closure_captures(closure_node, post_scope)
-        widen_escaping_content_captures(closure_node, drop_captured_narrowing(closure_node, post_scope))
+      def escaping_closure_captures(closure_node, post_scope, foreign_self: false)
+        widen_escaping_content_captures(closure_node,
+                                        drop_captured_narrowing(closure_node, post_scope, foreign_self: foreign_self))
+      end
+
+      # Issue #1402 — whether `call_node`'s block runs on an object that is provably not `self`
+      # ({InterveningIvarReset.foreign_self_block?}, its receiver typed where the operands were), so that no instance
+      # variable it writes is this scope's ({CapturedLocals.writes}' `foreign_self:`).
+      def foreign_self_block?(call_node)
+        InterveningIvarReset.foreign_self_block?(call_node, operand_scope)
       end
 
       # Builds the entry scope for a block body. The block sees the outer scope's locals (Ruby's lexical scoping rule)
@@ -5412,7 +5756,7 @@ module Rigor
         return [] if receiver_type.nil?
 
         arg_types = call_arg_types_for(call_node)
-        MethodDispatcher.expected_block_param_types(
+        expected = MethodDispatcher.expected_block_param_types(
           receiver_type: receiver_type,
           method_name: call_node.name,
           arg_types: arg_types,
@@ -5420,10 +5764,28 @@ module Rigor
           scope: scope,
           call_node: call_node
         )
+        with_inject_accumulator(call_node, receiver_type, arg_types, expected)
       rescue StandardError
         []
       end
 
+      # Issue #1889 — a block-form `inject` / `reduce` call's accumulator parameter at the type it holds across
+      # every run ({ExpressionTyper#inject_accumulator_type}) rather than the seed the signature binds it to, once
+      # per call: every write-back pass builds the entry again.
+      def with_inject_accumulator(call_node, receiver_type, arg_types, expected)
+        memo = @inject_accumulator
+        accumulator =
+          if memo && memo[0].equal?(call_node)
+            memo[1]
+          else
+            typed = ExpressionTyper.new(scope: scope, tracer: tracer)
+                                   .inject_accumulator_type(call_node, receiver_type, arg_types)
+            @inject_accumulator = [call_node, typed]
+            typed
+          end
+        accumulator ? [accumulator, *expected.drop(1)] : expected
+      end
+
       def call_arg_types_for(call_node)
         arguments = call_node.arguments
         return [] if arguments.nil?