rigortype 0.4.4 → 0.4.6

data/lib/rigor/inference/expression_typer.rb

@@ -5,12 +5,14 @@ require "prism"
 require_relative "../type"
 require_relative "../reflection"
 require_relative "../ast"
+require_relative "clause_widening"
 require_relative "../source/constant_path"
 require_relative "../source/node_children"
 require_relative "../source/node_walker"
 require_relative "../analysis/self_call_resolution_recorder"
 require_relative "block_call_timing"
 require_relative "block_repetition"
+require_relative "project_yielder"
 require_relative "block_parameter_binder"
 require_relative "method_parameter_binder"
 require_relative "body_fixpoint"
@@ -41,6 +43,7 @@ require_relative "receiver_alias"
 require_relative "repeated_or_writes"
 require_relative "singleton_object_constant"
 require_relative "refined_dispatch"
+require_relative "singleton_external_ahead"
 require_relative "stored_block_call"
 require_relative "struct_fold_safety"
 require_relative "unknown_store_widening"
@@ -1049,7 +1052,7 @@ module Rigor
       # optimistic-carrier decline) and one terminating-arm rule, and cannot drift apart again. Only the
       # value is read; the post-scope belongs to whichever walk owns the statement.
       def type_of_conditional(node)
-        scope.evaluate(node, tracer: tracer).first
+        LoopValueRecord.fetch(node, scope) || scope.evaluate(node, tracer: tracer).first
       end
 
       def type_of_else(node)
@@ -1208,17 +1211,22 @@ module Rigor
             Type::Combinator.constant_of(nil)
           end
 
-        rescue_types = rescue_chain_types(rescue_clause)
+        rescue_types = rescue_chain_types(rescue_clause, node.statements)
         Type::Combinator.union(primary_type, *rescue_types)
       end
 
       # Issue #1360 — the evaluator binds `$!` in a rescue clause it enters; a clause typed here, such as one in a
       # `begin` passed as an argument, reads `$!`, `$@` and `$?` unbound rather than an enclosing clause's.
-      def rescue_chain_types(rescue_node)
-        arm_typer = typer_under(rescue_arm_scope)
+      #
+      # Issue #1839 — it also reads each name the `body` writes as `Dynamic[top]` ({ClauseWidening}), as the evaluator's
+      # rescue clause does: `[begin; conn = make; work; rescue; conn; end]` holds the connection, not the entry's `nil`.
+      def rescue_chain_types(rescue_node, body)
+        arm_scope = rescue_arm_scope
+        writes = ClauseWidening.writes([body])
         types = []
         current = rescue_node
         while current
+          arm_typer = typer_under(ClauseWidening.widen(arm_scope, writes, current.statements) || arm_scope)
           types << arm_typer.send(:statements_or_nil, current.statements)
           current = current.subsequent
         end
@@ -1265,11 +1273,22 @@ module Rigor
         Type::Combinator.bot
       end
 
-      # `while` and `until` loops produce nil unless interrupted by `break VALUE`; the expression value of
-      # `break VALUE` is not yet modeled (scope break-path propagation landed in `eval_loop`). Returning
-      # Constant[nil] is safe and matches Ruby semantics for the common case.
-      def type_of_loop(_node)
-        Type::Combinator.constant_of(nil)
+      # A `while` / `until` / `for` loop in value position. Like {#type_of_conditional}, it delegates to the
+      # statement evaluator, which owns the loop's value: `nil` or a `while` / `until` loop's `break` values
+      # (issue #2031), and a `for` loop's collection or its `break` values (issue #1216).
+      #
+      # A `while` / `until` loop no `break` leaves is `nil` without evaluating its body, as
+      # {StatementEvaluator#loop_value} answers it: a loop that is a call's receiver or argument is typed again by
+      # every narrowing and rule that types that operand, and evaluating it each time re-ran the passes of every loop
+      # nested in it.
+      def type_of_loop(node)
+        return Type::Combinator.constant_of(nil) if break_free_condition_loop?(node)
+
+        LoopValueRecord.fetch(node, scope) || scope.evaluate(node, tracer: tracer).first
+      end
+
+      def break_free_condition_loop?(node)
+        !node.is_a?(Prism::ForNode) && !block_level_jump?(node.statements, Prism::BreakNode)
       end
 
       def type_of_lambda(_node)
@@ -1279,11 +1298,23 @@ module Rigor
       def type_of_range(node)
         left_static, left = static_range_endpoint(node.left)
         right_static, right = static_range_endpoint(node.right)
-        return Type::Combinator.constant_of(Range.new(left, right, node.exclude_end?)) if left_static && right_static
+        if left_static && right_static
+          range = static_range_value(left, right, node.exclude_end?)
+          return Type::Combinator.constant_of(range) if range
+        end
 
         nominal_range_for_endpoints(node.left, node.right)
       end
 
+      # The `Range` the static endpoints denote, or nil when Ruby would refuse to build it (`1.."a"`,
+      # `"a"..1` raise `ArgumentError: bad value for range`). The literal is a runtime error,
+      # not a constant, so the fold declines and the caller types it as a plain Range.
+      def static_range_value(left, right, exclude_end)
+        Range.new(left, right, exclude_end)
+      rescue ArgumentError
+        nil
+      end
+
       # Derives `Nominal[Range, [T]]` from the endpoint expression types when at least one endpoint is
       # statically typeable. The element parameter is the union of the endpoint types (lifted from
       # `Constant<v>` to `Nominal<v.class>` so the carrier matches what `Range#each` would yield). Falls back
@@ -2583,6 +2614,10 @@ module Rigor
 
         def_node, owner = resolve_singleton_def_with_owner(receiver.class_name, method_name)
         return nil if def_node.nil?
+        # Issue #1936 — a contested slot holds a `def` a later definer may have replaced
+        # (`singleton_class.alias_method :x, :y` after `def self.x`), or one that may not have run: its body is not
+        # proven to be the method Ruby calls, so the call falls through to `Dynamic`.
+        return nil if scope.discovery.contested?(:discovered_singleton_def_nodes, [owner, method_name.to_sym])
 
         result = infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
         return result if result.nil?
@@ -2597,6 +2632,10 @@ module Rigor
       # `discovered_def_nodes` / `discovered_superclasses` / `discovered_includes`, and this walk reads a
       # fourth table those three do not imply. Keying on what the answer actually depends on is the #682
       # lesson — a memo that outlives its inputs serves one scope's answer to another.
+      #
+      # It is the TYPING read only, so it also withholds (`[nil, nil]`, the call types `Dynamic`) where an external
+      # ancestor may answer ahead of the definer found (#1572: `extend M; extend Enumerable` makes `C.to_a`
+      # `Enumerable#to_a`, which the reader passes over). The existence reads keep the reader's own answer.
       def resolve_singleton_def_with_owner(class_name, method_name)
         by_singleton = (class_graph_buckets[:singleton_def] ||= {}.compare_by_identity)
         cache = (by_singleton[scope.discovered_singleton_def_nodes] ||= {})
@@ -2604,7 +2643,10 @@ module Rigor
         key = method_name.to_sym
         return table[key] if table.key?(key)
 
-        table[key] = scope.singleton_def_through_ancestors(class_name, method_name)
+        found = scope.singleton_def_through_ancestors(class_name, method_name)
+        owner = found.last
+        found = [nil, nil] if owner && SingletonExternalAhead.withhold?(scope, class_name, method_name, owner)
+        table[key] = found
       end
 
       # The project-side singleton-method band: a `Foo.bar` call resolved against a `class << …` / `def self.…`
@@ -3288,21 +3330,34 @@ module Rigor
         cache = class_graph_buckets[:yields]
         return cache[def_node] if cache.key?(def_node)
 
-        cache[def_node] = yield_reachable?(def_node.body)
+        cache[def_node] = yield_reachable?(def_node.body, def_node.parameters&.block&.name)
       end
 
-      def yield_reachable?(node)
+      def yield_reachable?(node, block_name)
         return false if node.nil?
-        return true if node.is_a?(Prism::YieldNode)
+        return true if node.is_a?(Prism::YieldNode) || forwards_block_argument?(node, block_name)
 
         node.rigor_each_child do |child|
           next if YIELD_BOUNDARY_NODES.include?(child.class)
 
-          return true if yield_reachable?(child)
+          return true if yield_reachable?(child, block_name)
         end
         false
       end
 
+      # Issue #1157 — a call that hands on its method's block (`&`, or `&blk` naming the block parameter) reaches the
+      # caller's block as a `yield` does. Whether `blk` is still the method's own block (not rebound or shadowed) is
+      # decided where it is typed ({#forwarded_block_return_type}); this only keeps the call-site dimension for a def
+      # that might.
+      def forwards_block_argument?(node, block_name)
+        block = node.respond_to?(:block) ? node.block : nil
+        return false unless block.is_a?(Prism::BlockArgumentNode)
+
+        expression = block.expression
+        expression.nil? || (!block_name.nil? && expression.is_a?(Prism::LocalVariableReadNode) &&
+                            expression.name == block_name)
+      end
+
       # The candidate-frame memo path: consult the current run generation's bucket, and on a miss compute
       # and store a FINAL result. Reached only when `memo_candidate?` held (see `infer_user_method_return`).
       # The store gate (ADR-84 WD3): a result is stored when no transient-machinery event during the
@@ -4298,9 +4353,13 @@ module Rigor
 
       # Whether the call may run its block more than once, so a later run reads a captured binding an earlier
       # run rebound — the premise of laying the #587 (b) binding ({#captured_block_bindings}) under the block.
-      # {BlockRepetition.may_repeat?} holds the rule, which the statement pass shares (issue #1412).
+      # {BlockRepetition.may_repeat?} holds the rule, which the statement pass shares (issue #1412). Issue #2301 — a
+      # project callee that hands the block on ({ProjectYielder.hands_block_on?}) also counts: the block's value is what
+      # the forward's target `yield`s, and that target may run it many times, so a captured local the block rebinds must
+      # not read its entry binding.
       def block_may_repeat?(call_node, receiver_type)
-        BlockRepetition.may_repeat?(method_name: call_node.name, receiver_type: receiver_type, scope: scope)
+        BlockRepetition.may_repeat?(method_name: call_node.name, receiver_type: receiver_type, scope: scope) ||
+          ProjectYielder.hands_block_on?(call_node, receiver_type, scope)
       end
 
       EMPTY_BREAK_ARMS = [].freeze
@@ -4396,10 +4455,22 @@ module Rigor
           )
           type_block_body(block_arg, entry, captured: captured)
         when Prism::BlockArgumentNode
-          symbol_block_return_type(block_arg, expected)
+          forwarded_block_return_type(block_arg) || symbol_block_return_type(block_arg, expected)
         end
       end
 
+      # Issue #1157 — `&` / `&blk` hands the callee the block this method was itself called with, so the callee's
+      # `yield` is worth what the CALLER's block returns: the value {.current_yield_value_type} already holds for
+      # this frame (the one a `yield` written here reads). Without it a name resolver that passes its block on
+      # (`def walk(x, &) = first_hit(x, &)`) read as `Dynamic[top]` through the forward and was skipped by
+      # `sig-gen`. Nil when the argument is not a forwarded block or the call site passed no block.
+      def forwarded_block_return_type(block_arg)
+        frame = scope.match_frame
+        return nil unless frame&.forwards_block?(block_arg)
+
+        ExpressionTyper.current_yield_value_type
+      end
+
       # The scope a block body is typed under: the surrounding scope plus the parameter bindings the receiving
       # method's signature implies, with the #587 (b) `captured` binding ({#repeating_captured_bindings}) laid
       # between the two, so the body reads what a captured local, instance variable, class variable or global
@@ -4494,6 +4565,14 @@ module Rigor
       # A failure in the re-answer falls back to the plain tail-only answer, for the reason
       # {#threaded_block_body_type} gives: a raise reaching `block_return_type_for` would report "no block".
       def tail_only_block_body_type(body, block_scope, captured)
+        StatementEvaluator.provisional_returns { tail_only_block_body_type_unrecorded(body, block_scope, captured) }
+      end
+
+      # Issue #2299 — the tail alone, typed from `block_scope`, is not the walk the method's returns are collected
+      # from: a `return` in it reads a name the skipped prefix binds as unbound. Its records are provisional
+      # ({StatementEvaluator.provisional_returns}): the statement walk's record of the same `return` replaces one,
+      # and one stands only for a block the walk never enters (a block in expression position).
+      def tail_only_block_body_type_unrecorded(body, block_scope, captured)
         return block_scope.type_of(body) unless block_body_threading_suppressed? && body.is_a?(Prism::StatementsNode)
 
         answered =

data/lib/rigor/inference/global_write_census.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../source/constant_path"
 require_relative "../source/node_children"
+require_relative "ivar_writer_census"
 
 module Rigor
   module Inference
@@ -26,6 +27,8 @@ module Rigor
     #   kept apart from `[:defines, …]`.
     # - `[:main_mixin, name]` — a module a top-level `include`, `prepend` or `extend` mixes into `Object` (or
     #   `main`), as written. A module RBS does not know may carry any method, so it reaches every class.
+    # - the instance-variable writer entries of {IvarWriterCensus} (issue #1154): `[:ivar_set, name]`,
+    #   `[:ivar_set_class, class_name]` and `[:own_write, class_name, name, path]`.
     #
     # The census is a `Set` of those frozen entries, merged by union across files, the project pre-pass and the
     # `pre_eval:` files. It is recorded inside descents that already visit every node ({Collector#visit}), never
@@ -74,12 +77,40 @@ module Rigor
         census.include?(DEFINES_ANY) || names.any? { |name| census.include?([:defines, name]) }
       end
 
+      # #1154 — the {IvarWriterCensus} entries of `census`, for the incremental diff and its readers.
+      IVAR_KINDS = %i[ivar_set ivar_set_class own_write].to_set.freeze
+
+      def ivar_set_entries(census) = census.select { |entry| IVAR_KINDS.include?(entry.first) }.to_set
+
+      # The negative-dependency key an {IvarWriterCensus} entry fires, the one `UnseenIvarWriters` records.
+      def ivar_key(entry)
+        case entry.first
+        when :ivar_set then "ivar_set:#{entry[1]}"
+        when :ivar_set_class then "ivar_set_class:#{entry[1]}"
+        else "own_write:#{entry[1]}##{entry[2]}"
+        end
+      end
+
       # Whether some refinement may add `write`.
       def refines_write?(census) = census.include?(REFINES_ANY) || census.include?(%i[refines write])
 
       # The module names the top-level mixins spell.
       def main_mixins(census) = census.filter_map { |entry| entry[1] if entry[0] == :main_mixin }
 
+      # Issue #2158 — the `global_census:` dependency key a census entry moves, without the kind prefix: `alias:$x`,
+      # `defines:write`, `refines:write`, `defines_any`, `refines_any`, and `main_mixin` for every top-level mixin: its
+      # reader asks about each, and one shared key is a deliberate precision trade-off (a mixin moving anywhere
+      # re-checks every write that read them). The rules that read the census record these keys
+      # (`CheckRules#record_global_census`), and `Analysis::Incremental.changed_global_census_keys` fires them for
+      # every entry that appeared in or vanished from a file's census.
+      def dependency_key(entry)
+        case entry
+        when DEFINES_ANY then "defines_any"
+        when REFINES_ANY then "refines_any"
+        else entry[0] == :main_mixin ? "main_mixin" : "#{entry[0]}:#{entry[1]}"
+        end
+      end
+
       # A standalone walk, for a file no existing descent visits (a `pre_eval:` entry).
       def scan(root)
         collector = Collector.new(InEffectRefinements.new(root))
@@ -107,12 +138,16 @@ module Rigor
         def initialize(in_effect)
           @census = Set.new
           @refine_ranges = []
+          @ivar_writers = IvarWriterCensus.new(@census)
           @in_effect = in_effect
         end
 
         # A node the collector cannot read must not fail the analysis of its file, nor of every file the pre-pass
         # feeds: the census then counts it as a definition of every name, which only declines a report.
-        def visit(node, top_level:)
+        # `owner` is the qualified name of the class whose body the node sits in, for {IvarWriterCensus} (nil where
+        # the host walk does not track it, or no class owns an instance there).
+        def visit(node, top_level:, owner: nil)
+          @ivar_writers.visit(node, owner)
           case node
           when Prism::AliasGlobalVariableNode then visit_global_alias(node)
           when Prism::DefNode then record(node, node.name)

data/lib/rigor/inference/intervening_ivar_reset.rb

@@ -0,0 +1,303 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+require_relative "reflective_ivar_write"
+require_relative "refined_dispatch/own_method"
+require_relative "self_call_ivar_writes"
+
+module Rigor
+  module Inference
+    # The intervening-call reset of instance variables. An implicit-self or `self.` call may write any instance
+    # variable of `self`, so past one each instance variable whose binding is narrower than its class-ivar seed reads
+    # the union of the two again; a call proven to write only some ({SelfCallIvarWrites.of}, issue #1596) widens only
+    # those. A call on another receiver cannot reach `self`'s instance variables and widens nothing.
+    #
+    # {.widen} is the reset itself, which the statement evaluator applies past a statement call
+    # (`StatementEvaluator#invalidate_ivars_for_intervening_call`). Issue #1963 — {.after_operand} applies it past
+    # the calls in a condition operand, where a narrowing an earlier operand or clause made would otherwise survive
+    # them: `if @x.nil? && reset!` read `@x` as `nil` in the body although `reset!` assigns it.
+    module InterveningIvarReset
+      # Nodes whose body does not run where it is written, or runs on another `self`: a `def`, and a class or
+      # module body, where `@x` is the class's own instance variable.
+      NON_RUNNING_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      # Issue #1402 — the nodes that run code the program does not show on `self`'s behalf: `yield` runs the
+      # method's block, and `super` the superclass's method on `self`.
+      UNKNOWN_CODE_NODES = [Prism::YieldNode, Prism::SuperNode, Prism::ForwardingSuperNode].freeze
+      # Issue #1402 — the names of a proc's call (`blk.call`, `blk.()`, `blk.yield`), which runs the block the method
+      # was given as `yield` does.
+      PROC_CALL_NAMES = Set[:call, :yield].freeze
+      # Issue #1402 — the calls whose block runs with `self` bound to the receiver: on a receiver that is provably
+      # another object ({.foreign_self_block?}), an instance variable the block writes, and a method it calls
+      # without a receiver, are that object's.
+      SELF_REBINDING_BLOCK_CALLS = Set[
+        :instance_eval, :instance_exec, :class_eval, :class_exec, :module_eval, :module_exec, :define_method,
+        :define_singleton_method
+      ].freeze
+      # The classes whose instances may be a class or module object: a `self` of one of them may be the receiver of
+      # `Foo.class_eval`, and an instance of one of them may be a `self` that is a class object.
+      CLASS_OBJECT_CLASSES = Set["Class", "Module", "Object", "BasicObject"].freeze
+      private_constant :NON_RUNNING_NODES, :UNKNOWN_CODE_NODES, :PROC_CALL_NAMES, :SELF_REBINDING_BLOCK_CALLS,
+                       :CLASS_OBJECT_CLASSES
+
+      module_function
+
+      # True when `node` is a call that may write `self`'s instance variables: an implicit-self or `self.` call
+      # ({.self_call?}). Issue #1402 — and a `yield`, a `super`, or a proc's call on a local ({.proc_call?}), which
+      # run code the program does not show; {SelfCallIvarWrites.of} proves no write set for any of them.
+      def candidate?(node)
+        return true if UNKNOWN_CODE_NODES.any? { |klass| node.is_a?(klass) }
+        return false unless node.is_a?(Prism::CallNode)
+
+        self_call?(node) || proc_call?(node)
+      end
+
+      # Whether `node`, a call, has no receiver or `self` as its receiver.
+      def self_call?(node)
+        receiver = node.receiver
+        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+      end
+
+      # Issue #1402 — `blk.call` / `blk.()` / `blk.yield` on a local: the method's own `&blk`, or a proc it was
+      # handed, runs code that may call back into `self`, as `yield` does. Read by name, since an unannotated
+      # `&blk` binds `Dynamic`.
+      def proc_call?(node)
+        PROC_CALL_NAMES.include?(node.name) && node.receiver.is_a?(Prism::LocalVariableReadNode)
+      end
+
+      # Issue #1402 — whether `call_node`'s block runs on an object that is provably not `self`: a
+      # {SELF_REBINDING_BLOCK_CALLS} call whose receiver, typed in `scope`, cannot be `self` ({.other_object?}).
+      # A receiver that may be `self` at run time (`obj = self; obj.instance_eval { … }`, a block parameter, an
+      # `Object` or `Dynamic` value, a class the analysis cannot order against `self`'s) is not foreign.
+      def foreign_self_block?(call_node, scope)
+        return false unless call_node.is_a?(Prism::CallNode) && SELF_REBINDING_BLOCK_CALLS.include?(call_node.name)
+        return false if self_call?(call_node)
+
+        other_object?(scope.type_of(call_node.receiver), scope)
+      rescue StandardError
+        false
+      end
+
+      # Whether a value of `type` cannot be `scope`'s `self`. Only an instance method of a class answers: `self` is
+      # then an instance of that class (one other than `Class`, `Module`, `Object` and `BasicObject`, and no module,
+      # declared in source or RBS), and a class object (`Singleton[X]`: `self.class`, a constant naming a class or
+      # module) is not one. Where `self` is a class object, or a module's instance (`module_function`, `extend
+      # self`), any receiver may be `self` — a subclass, the module itself — and none is foreign. An instance
+      # receiver is never foreign: its class may be a subclass of `self`'s that the environment cannot order.
+      def other_object?(type, scope)
+        self_type = scope.self_type
+        return false unless self_type.is_a?(Type::Nominal) && plain_class?(self_type.class_name, scope)
+
+        type.is_a?(Type::Singleton)
+      end
+
+      # Whether `class_name` names a class whose instances are no class or module object, and not a module.
+      def plain_class?(class_name, scope)
+        name = class_name.to_s.delete_prefix("::")
+        !CLASS_OBJECT_CLASSES.include?(name) && !RefinedDispatch::OwnMethod.module_name?(scope, name) &&
+          !module_subclass?(name, scope)
+      end
+
+      # Whether `name` may be a subclass of `Module` (`class Meta < Module`), whose instance is a module object.
+      # Read off the class's instance `Scope::ResolutionChain`, which resolves a superclass written relative to the
+      # subclass's namespace (`class Meta < Base` in `module NS`) as Ruby does: true when an entry is one the
+      # environment orders `:subclass` or `:equal` to `Module` (`Module` itself, `Class`, a project class whose
+      # signature declares it, an external superclass), when an external superclass names no class the
+      # environment knows (it may be `Module`), or when the chain is truncated or unsettled.
+      def module_subclass?(name, scope)
+        chain = Scope::ResolutionChain.for(scope, name, :instance, :methods)
+        return true if chain.truncated? || chain.unsettled?
+
+        environment = scope.environment
+        chain.search(scope) { |entry| module_entry?(entry, environment) || nil } ? true : false
+      end
+      private_class_method :module_subclass?
+
+      # Whether a chain entry makes the class a possible `Module` subclass: a project entry {.module_like?}, or an
+      # external superclass that names no class the environment knows, or one {.module_like?}. An external mixin
+      # (`include Enumerable`) does not.
+      def module_entry?(entry, environment)
+        return module_like?(entry.name.to_s, environment) unless entry.external?
+        return false unless entry.superclass_edge
+
+        known = entry.candidates.map { |candidate| candidate.to_s.delete_prefix("::") }
+                     .select { |candidate| environment.class_known?(candidate) }
+        known.empty? || known.any? { |candidate| module_like?(candidate, environment) }
+      end
+      private_class_method :module_entry?
+
+      def module_like?(name, environment)
+        %i[subclass equal].include?(environment.class_ordering(name, "Module"))
+      end
+      private_class_method :module_like?
+      private_class_method :plain_class?
+
+      # Issue #1402 — `scope` past a statement call whose receiver or arguments run code the program does not
+      # show (`@items << yield`, `puts(yield)`, `log(blk.call)`, `items.each(&blk)`): {.widen} over every narrowed
+      # name, as past a statement `yield`. Every other call in them is the operand walk's.
+      def after_operands(call_node, scope)
+        return scope unless narrowed_ivars?(scope)
+
+        found = []
+        collect_calls(call_node.receiver, false, found, scope, unknown_only: true)
+        collect_calls(call_node.arguments, false, found, scope, unknown_only: true)
+        block = call_node.block
+        found << block if block.is_a?(Prism::BlockArgumentNode) && block.expression.is_a?(Prism::LocalVariableReadNode)
+        return scope if found.empty?
+
+        widen(scope, mark: true) { nil }
+      end
+
+      # Issue #1402 — `scope` past a call on another receiver whose literal block may make a {.candidate?} call
+      # (`[1].each { reset }`, `items.each { yield }`): {.widen} over the names those calls may write, as
+      # {.after_operand} widens past the calls in a condition. In a block that runs on another object
+      # ({.foreign_self_block?}) only a `yield`, a `super` or a proc's call counts: its implicit-self calls are that
+      # object's, while the method's block runs as it always does. A literal-name
+      # `instance_variable_set` on `self` ({ReflectiveIvarWrite.literal_name}) writes the one ivar it names, which
+      # the block's captured-binding write-back already joins, so it is not counted.
+      def after_block(call_node, scope)
+        block = call_node.block
+        return scope unless block.is_a?(Prism::BlockNode)
+        return scope unless narrowed_ivars?(scope)
+
+        calls = []
+        if foreign_self_block?(call_node, scope)
+          collect_calls(block, false, calls, scope, unknown_only: true)
+        else
+          collect_calls(block, false, calls, scope)
+          calls.reject! { |call| ReflectiveIvarWrite.literal_name(call) }
+        end
+        return scope if calls.empty?
+
+        widen(scope, mark: true) { proven_writes(calls, scope) }
+      end
+
+      # `scope` with each instance variable narrowed below its class-ivar seed widened back over the seed. The block
+      # answers the names the call may write, or nil for any; it runs at most once, and only when an instance
+      # variable is narrowed, since a proof costs a read of the callee. An instance variable whose binding carries
+      # the declaration mark keeps it (issue #1889). With `mark: true` a binding whose narrowing had ruled `nil` out
+      # takes the mark when widened, so a `nil` only the seed brings back is not fuel for
+      # `call.possible-nil-receiver` (ADR-58), as a declared one is not. A narrowing that kept `nil`
+      # (`return if @tag`, `@tag.nil?`) widens unmarked, so a read the program really makes on `nil` still reports.
+      def widen(scope, mark: false)
+        seed = class_ivar_seed(scope)
+        return scope if seed.nil? || seed.empty?
+
+        computed = false
+        writes = nil
+        seed.reduce(scope) do |widened, (name, seed_type)|
+          local_type = scope.ivar(name)
+          next widened if local_type.nil? || local_type == seed_type
+
+          unless computed
+            writes = yield
+            computed = true
+          end
+          next widened if writes && !writes.include?(name)
+
+          joined = Type::Combinator.union(local_type, seed_type)
+          widened = widened.with_ivar(name, joined)
+          marked = (mark && nil_free?(local_type)) || scope.declaration_sourced?(:ivar, name)
+          marked ? widened.seed_declaration_sourced_ivar(name, joined) : widened
+        end
+      end
+
+      # Issue #1963 — `scope` past the calls `node`, a condition operand, makes: {.widen} over the names every
+      # candidate call in it may write, or every name when one of them is not proven. A call's literal block may run,
+      # so its calls count; a `def`, a class or module body and (unless `run_lambdas`) a lambda literal run nothing
+      # on this `self` there.
+      #
+      # A binding whose narrowing ruled `nil` out takes the declaration mark when widened ({.widen}'s `mark:`): the
+      # reset forgets the narrowing without making the variable newly nil-reportable, since a call the proof cannot
+      # clear is far more often one that leaves the variable alone (`if @tag && items.any?` then `t = @tag;
+      # t.upcase`) than one that assigns `nil`. A `when` test passes `run_lambdas: true`, since its `===` runs a
+      # lambda literal's body.
+      def after_operand(node, scope, run_lambdas: false)
+        return scope unless narrowed_ivars?(scope)
+
+        calls = candidate_calls(node, run_lambdas, scope)
+        return scope if calls.empty?
+
+        widen(scope, mark: true) { proven_writes(calls, scope) }
+      end
+
+      # Whether a candidate call in `node` may write the instance variable `name`. A `when` test passes
+      # `run_lambdas: true`, since its `===` runs a lambda literal's body. A write to it in `node` is the caller's
+      # to check.
+      def may_write?(node, name, scope, run_lambdas: false)
+        calls = candidate_calls(node, run_lambdas, scope)
+        return false if calls.empty?
+
+        proven = proven_writes(calls, scope)
+        proven.nil? || proven.include?(name)
+      end
+
+      # The union of the names each call may write ({SelfCallIvarWrites.of}), or nil when one is not proven.
+      def proven_writes(calls, scope)
+        calls.reduce(Set.new) do |acc, call|
+          writes = SelfCallIvarWrites.of(call, scope)
+          break nil if writes.nil?
+
+          acc.merge(writes)
+        end
+      end
+
+      # The candidate calls under `node`, in source order.
+      def candidate_calls(node, run_lambdas, scope)
+        found = []
+        collect_calls(node, run_lambdas, found, scope)
+        found
+      end
+
+      # Issue #1402 — with `unknown_only: true` only the `yield`s, `super`s and proc calls ({.unknown_code?}) count,
+      # wherever they sit. A block that runs on another object ({.foreign_self_block?}) is read that way: its
+      # implicit-self calls are that object's, while the method's block runs as anywhere else.
+      def collect_calls(node, run_lambdas, found, scope, unknown_only: false)
+        return unless node.is_a?(Prism::Node)
+        return if NON_RUNNING_NODES.any? { |klass| node.is_a?(klass) }
+        return if !run_lambdas && node.is_a?(Prism::LambdaNode)
+
+        found << node if unknown_only ? unknown_code?(node) : candidate?(node)
+        node.compact_child_nodes.each do |child|
+          foreign = !unknown_only && child.is_a?(Prism::BlockNode) && foreign_self_block?(node, scope)
+          collect_calls(child, run_lambdas, found, scope, unknown_only: unknown_only || foreign)
+        end
+      end
+      private_class_method :collect_calls
+
+      # Issue #1402 — a `yield`, a `super` or a proc's call ({.proc_call?}).
+      def unknown_code?(node)
+        UNKNOWN_CODE_NODES.any? { |klass| node.is_a?(klass) } || (node.is_a?(Prism::CallNode) && proc_call?(node))
+      end
+      private_class_method :unknown_code?
+
+      def nil_free?(type)
+        Narrowing.narrow_non_nil(type) == type
+      end
+      private_class_method :nil_free?
+
+      # Whether any instance variable is bound narrower than its class-ivar seed: the only state {.widen} changes.
+      def narrowed_ivars?(scope)
+        seed = class_ivar_seed(scope)
+        return false if seed.nil? || seed.empty?
+
+        seed.any? do |name, seed_type|
+          local_type = scope.ivar(name)
+          !local_type.nil? && local_type != seed_type
+        end
+      end
+      private_class_method :narrowed_ivars?
+
+      def class_ivar_seed(scope)
+        self_type = scope.self_type
+        class_name =
+          case self_type
+          when Type::Nominal, Type::Singleton then self_type.class_name
+          end
+        class_name && scope.class_ivars_for(class_name)
+      end
+      private_class_method :class_ivar_seed
+    end
+  end
+end