rigortype 0.4.5 → 0.4.7

data/lib/rigor/inference/mutation_rejoin.rb

@@ -31,7 +31,12 @@ module Rigor
       # `nil` when the re-join changed nothing, so a non-adder (`pop`, `sort!`) on an already-widened
       # carrier does not rebind the binding at all: a rebind drops the per-slot narrowings `with_local`
       # keys to the old value, and paying that for an identical type is a straight loss.
-      def widen_nominal(nominal, method_name, values: :widen, arg_types: MutationWidening::NO_ARG_TYPES)
+      def widen_nominal(nominal, method_name, values: :widen, arg_types: MutationWidening::NO_ARG_TYPES,
+                        synthesised: false)
+        if synthesised && (synthesised_carrier?(nominal) || partially_gradual_hash?(nominal))
+          return widen_synthesised(nominal, method_name, values:, arg_types:)
+        end
+        return widen_precise_array(nominal, method_name, values:, arg_types:) if precise_array?(nominal)
         return nil unless regrowable_carrier?(nominal)
 
         pre_state = values == :widen ? value_pin_widened_args(nominal) : nominal
@@ -115,19 +120,250 @@ module Rigor
       # This is a superset of "mutation-widened": a DECLARED `Array[untyped]` or
       # `Array[Integer | untyped]` matches too. Deliberate — the soundness argument above is about
       # the carrier being open, not about who opened it, and a declared gradual arm is the author
-      # saying the collection may hold anything. Distinguishing the two needs provenance travelling
-      # WITH the value (a field on `Type::Nominal`, reopening structural equality, `Marshal`, and the
-      # cache schema); nothing on this axis needs it yet.
+      # saying the collection may hold anything.
+      #
+      # Issue #2555 L3 — the provenance this boundary turns on travels beside the binding, not with the value: a
+      # local whose object the engine built carries the `:synthesised` construction fact ({Scope#construction_fact?}),
+      # and {#widen_synthesised} answers for it before this predicate is asked. A field on `Type::Nominal` was the
+      # other route; `Combinator.union`'s structural dedupe would keep whichever tagged twin it met first.
       def regrowable_carrier?(nominal)
         return false unless %w[Array Hash].include?(nominal.class_name)
 
         nominal.type_args.any? { |arg| gradual_parameter?(arg) }
       end
 
+      # Issue #2555 L3 — a PRECISE `Array` / `Hash` nominal (no parameter carries a `Dynamic` arm), the carrier
+      # {#widen_synthesised} re-grows when its binding carries the `:synthesised` fact. A carrier that already carries
+      # a gradual arm keeps the ordinary re-join, whose floor it holds already.
+      def synthesised_carrier?(nominal)
+        %w[Array Hash].include?(nominal.class_name) && !nominal.type_args.empty? &&
+          nominal.type_args.none? { |arg| gradual_parameter?(arg) }
+      end
+
+      # Issue #2555 L3 — a `Hash` with one gradual parameter and one precise one: `Hash.new(0)` is
+      # `Hash[Dynamic[top], Integer]`. On a synthesised binding the precise side is this engine's own fold of the
+      # default, not a declaration, so {#keep_precise_parameters} must not restore it over a store:
+      # `h = Hash.new(0); h[:y] = "s"` reads `Hash[Dynamic[top] | Symbol, Integer | String]`, not
+      # `Hash[Dynamic[top] | Symbol, Integer]` (which made `h[:y].upcase` an `undefined method` on Integer). The
+      # counter idiom keeps its `Integer`: `h[:x] += 1` stores an `Integer`.
+      def partially_gradual_hash?(nominal)
+        nominal.class_name == "Hash" && nominal.type_args.size == 2 &&
+          nominal.type_args.any? { |arg| gradual_parameter?(arg) } &&
+          nominal.type_args.any? { |arg| !gradual_parameter?(arg) }
+      end
+
+      # Issue #2555 L3 — the re-join for a precise carrier the engine built itself: a collection literal closed by a
+      # value-preserving mutator (`a = [1, 2]; a.sort!` is `Array[1 | 2]`, `g = { a: 1 }; g.delete(:b)` is
+      # `Hash[Symbol, 1]`), a constructor fold (`Array.new(n, 0)` is `Array[Integer]`), or a literal built as a
+      # nominal outright (`{ ENV["A"].to_s => 1 }`). Its element types are this engine's inference, not a claim a
+      # declaration made, so the #561 boundary ({#regrowable_carrier?}, {#precise_admitted}) does not apply:
+      #
+      # - an added member joins as itself (value pin and literal shape dropped, {MutationWidening.value_pin_widened}),
+      #   with no seed-admissibility gate and no `Dynamic[top]` floor — `Array.new(n, 0) << "s"` reads
+      #   `Array[Integer | String]`;
+      # - a rewriter takes {RewriteMutation.arm}'s gradual position, as a gradual carrier does —
+      #   `g.transform_values!(&:to_s)` reads `Hash[Symbol, Dynamic[top]]`;
+      # - an adder whose arguments yield no evidence is one unknown store and joins `Dynamic[top]`; one called with no
+      #   argument types at all (the block-capture seam, whose content join adds the stores afterwards) changes
+      #   nothing.
+      #
+      # The floor the ordinary re-join adds exists because a carrier it closed could not re-grow; this one stays
+      # re-growable while the binding keeps the fact, so every later store made THROUGH THE BINDING is seen. A store
+      # through another holder is not, which is why a local that may escape anywhere in its body never carries the
+      # fact ({ConstructionEscape}). Nor is a remover taking a store out again, which is why a remover on a carrier a
+      # store has grown restores the floor ({MutationWidening.floor_grown_carrier}).
+      def widen_synthesised(nominal, method_name, values:, arg_types:)
+        pre_state = values == :widen ? value_pin_widened_args(nominal) : nominal
+        rejoined =
+          case nominal.class_name
+          when "Array"
+            return nil unless MutationWidening::ARRAY_MUTATORS.include?(method_name)
+
+            synthesised_array_join(RewriteMutation.arm(pre_state, method_name), method_name, arg_types)
+          when "Hash"
+            return nil unless MutationWidening::HASH_MUTATORS.include?(method_name)
+
+            synthesised_hash_join(RewriteMutation.arm(pre_state, method_name), method_name, arg_types)
+          end
+        rejoined == nominal ? nil : rejoined
+      end
+
+      # Issue #2555 — the removers and filters of an Array, a Hash or a Set: each can take a stored member out again,
+      # which nothing narrows the carrier back from.
+      SYNTHESISED_REMOVERS = %i[
+        pop shift slice! delete delete? delete_at delete_if reject! select! filter! keep_if compact! clear subtract
+      ].to_set.freeze
+
+      # The adders whose store marks a synthesised binding `:grown`.
+      def content_adder?(method_name)
+        ContentJoin::CONTENT_ADDERS.include?(method_name) || SetMutation::CONTENT_ADDERS.include?(method_name)
+      end
+
+      # Whether a store turned `current` into `widened` by changing an Array / Hash / Set parameter that carried no
+      # `Dynamic` arm before it: a member joined where no floor covered it, which a later remover could leave stale.
+      # A store the parameter already held, or one that joined beside an earlier floor (`Hash.new(0)`'s key side),
+      # grows nothing.
+      def grew_unfloored?(current, widened)
+        return false if widened.nil?
+
+        before = ContentJoin.union_members(current)
+        ContentJoin.union_members(widened).any? do |member|
+          next false unless member.is_a?(Type::Nominal) && %w[Array Hash Set].include?(member.class_name)
+
+          prior = before.find { |b| same_carrier?(b, member) }
+          member.type_args.each_with_index.any? do |arg, i|
+            prior.nil? || (!gradual_parameter?(prior.type_args[i]) && prior.type_args[i] != arg)
+          end
+        end
+      end
+
+      def same_carrier?(type, nominal)
+        type.is_a?(Type::Nominal) && type.class_name == nominal.class_name &&
+          type.type_args.size == nominal.type_args.size
+      end
+
+      # Whether `method_name` on the synthesised local `name` takes the floor: a remover on a carrier a store grew.
+      def floors_grown_carrier?(scope, name, method_name)
+        SYNTHESISED_REMOVERS.include?(method_name) && scope.construction_fact?(name, :grown)
+      end
+
+      # `type` with every Array / Hash / Set parameter joined with `Dynamic[top]`, member-wise through a union: the
+      # reading the carrier would have had without the fact. With `drop_nil` (a remover that can take a `nil` out,
+      # {MutationWidening.removes_nil?}) the parameter's `nil` member goes too: on the path without the fact a stored
+      # `nil` the seed did not accept joined as the floor alone ({#precise_admitted}), and a `nil` kept beside the floor
+      # would still draw `call.possible-nil-receiver` after `parts << nil; parts.compact!`. Any other remover keeps the
+      # `nil`, which it may leave behind (`s << nil; s.delete(1)`).
+      def floor_parameters(type, drop_nil: false)
+        case type
+        when Type::Union then Type::Combinator.union(*type.members.map { |member| floor_parameters(member, drop_nil:) })
+        when Type::Nominal
+          return type unless %w[Array Hash Set].include?(type.class_name) && !type.type_args.empty?
+
+          Type::Combinator.nominal_of(type.class_name,
+                                      type_args: type.type_args.map { |arg| floored_parameter(arg, drop_nil) })
+        else type
+        end
+      end
+
+      def hash_carrier?(type)
+        ContentJoin.union_members(type).any? { |member| member.is_a?(Type::Nominal) && member.class_name == "Hash" }
+      end
+
+      def floored_parameter(arg, drop_nil)
+        kept = ContentJoin.union_members(arg)
+        kept = kept.reject { |member| member.is_a?(Type::Constant) && member.value.nil? } if drop_nil
+        Type::Combinator.union(*kept, Type::Combinator.untyped)
+      end
+
+      def synthesised_array_join(carrier, method_name, arg_types)
+        return carrier unless ContentJoin::ARRAY_CONTENT_ADDERS.include?(method_name) && !arg_types.empty?
+
+        added = MutationWidening.value_pin_widened(ContentJoin.array_added_elements(method_name, arg_types))
+        ContentJoin.join_array_content(carrier, added.empty? ? [Type::Combinator.untyped] : added)
+      end
+
+      def synthesised_hash_join(carrier, method_name, arg_types)
+        return carrier unless ContentJoin::HASH_CONTENT_ADDERS.include?(method_name) && !arg_types.empty?
+
+        # A `nil` key marks a splat, an unknown key ({MutationWidening.join_added_pairs}).
+        key, value = MutationWidening.value_pin_widened([arg_types.first || Type::Combinator.untyped, arg_types.last])
+        value ||= Type::Combinator.untyped
+        ContentJoin.join_hash_content(carrier, [[key, value]])
+      end
+
       def gradual_parameter?(type)
         ContentJoin.union_members(type).any?(Type::Dynamic)
       end
 
+      # A typed `Array[E]` whose `E` has no `Dynamic` arm — the carrier {#regrowable_carrier?} refuses.
+      def precise_array?(nominal)
+        nominal.class_name == "Array" && nominal.type_args.size == 1 && !gradual_parameter?(nominal.type_args.first)
+      end
+
+      # Issue #2361 — a PRECISE `Array[E]` re-grows under a store, on the literal arms' terms: `a = ARGV.dup;
+      # a.clear; a << 1; a.each { |v| v.fdiv(2) }` read `Array[String]` and reported `undefined method 'fdiv' for
+      # String` on code that prints `[0.5]`.
+      #
+      # Only a content adder ({ContentJoin::ARRAY_CONTENT_ADDERS}) re-grows it, and the join keeps the seed: `clear`
+      # empties the array but leaves `E` standing, a superset of what it holds. A remover leaves the carrier as it
+      # found it. An element rewriter (`map!`, `collect!`, `flatten!`) replaces `E` (issue #2427): with the element
+      # the non-bang counterpart answers when the call site could type it ({RewriteMutation.typed}, answered before
+      # this method), and otherwise with {RewriteMutation.arm}'s gradual element — `a.map!.with_index { … }` holds
+      # whatever the block returns, and keeping the stale `E` reported a missing method on correct code.
+      #
+      # Each added member the element accepts joins as itself; any other takes the `Dynamic[top]` floor
+      # ({#precise_admitted}), and the floor joins every re-grow as it does on the literal arms. `a << 1` therefore
+      # reads `Array[Dynamic[top] | String]` and `s = ints.map { "x" }; s << "y"` reads `Array["x" | Dynamic[top]]`.
+      # Nothing narrows a carrier back when a remover or rewriter takes the store out again (`a << 1; a.pop`,
+      # `a << nil; a.compact!`, `a.map!(&:to_s)`), so a joined `Integer` or `nil` made `t.take(a)` against a declared
+      # `Array[String]` report `call.argument-type-mismatch`, and a parameter returned as its declared
+      # `-> Array[String]` report `def.return-type-mismatch`, on correct Ruby. A union carrying the floor neither folds
+      # nor dispatches loudly, so the read stays silent. Once floored, the carrier is gradual and later stores re-join
+      # through {#widen_nominal}'s ordinary arm.
+      #
+      # A store the element already accepts changes nothing ({#already_held?}). An adder with no argument types at
+      # all is left alone, as {MutationWidening.join_added_elements} leaves it: the block-capture seams pass none,
+      # and their own content join adds the stores.
+      def widen_precise_array(nominal, method_name, values:, arg_types:)
+        return RewriteMutation.arm(nominal, method_name) if RewriteMutation::TYPED_COUNTERPARTS.key?(method_name)
+        return nil unless ContentJoin::ARRAY_CONTENT_ADDERS.include?(method_name) && !arg_types.empty?
+
+        stored = ContentJoin.array_added_elements(method_name, arg_types)
+        return nil if already_held?(nominal.type_args.first, stored)
+
+        added = MutationWidening.value_pin_widened(stored)
+        admitted = precise_admitted(nominal.type_args.first, added)
+        pre_state = values == :widen ? value_pin_widened_args(nominal) : nominal
+        rejoined = ContentJoin.join_array_content(pre_state, MutationWidening.gradual_floor(admitted))
+        rejoined == nominal ? nil : rejoined
+      end
+
+      # The seed-admissibility gate for a precise element: an added member joins as itself only when `element`
+      # already accepts it, and takes the `Dynamic[top]` floor otherwise. A precise element therefore never gains a
+      # member it rejects, which is what a declared boundary checks: nothing narrows the carrier back when a remover
+      # or rewriter takes the store out again, and a joined foreign arm stays rejected beside the floor — `Integer`
+      # under a declared `Array[String]`, `String` under `-> Array["x"]`, `Array[Integer]` under
+      # `Array[Array[String]]` each reported on correct Ruby. A class set ({ContentJoin.admissible_evidence}) is too
+      # coarse for that: it admits `Array[Integer]` beside `[String]` and `"y"` beside `"x"`.
+      def precise_admitted(element, added)
+        added.flat_map do |type|
+          ContentJoin.union_members(type).map do |member|
+            Acceptance.accepts(element, member).yes? ? member : Type::Combinator.untyped
+          end
+        end
+      end
+
+      # True when the precise element `element` already covers every type `stored` puts in, so the store changes
+      # nothing: `s = ints.map { "x" }; s << "x"` keeps `Array["x"]` and its `s.last == "x"` fold, which is correct,
+      # and a `[Integer, Integer]` pushed onto an `Array[[0 | Integer, Integer]]` keeps the Tuple element. Joining
+      # the value-pin-widened, shape-erased store instead would only lose precision.
+      #
+      # A stored type carrying `Dynamic` anywhere is never covered, though `Acceptance` passes it gradually: keeping
+      # the element would claim the unknown part is what the element says (`retry_binding_accepted?`'s rule).
+      def already_held?(element, stored)
+        return false if stored.empty?
+
+        held = ContentJoin.union_members(element)
+        stored.all? do |type|
+          next false if type.nil? || carries_dynamic?(type)
+
+          ContentJoin.union_members(type).all? { |member| held.include?(member) } ||
+            Acceptance.accepts(element, type).yes?
+        end
+      end
+
+      def carries_dynamic?(type)
+        case type
+        when Type::Dynamic then true
+        when Type::Union, Type::Intersection then type.members.any? { |member| carries_dynamic?(member) }
+        when Type::Nominal then type.type_args.any? { |arg| carries_dynamic?(arg) }
+        when Type::Tuple then type.elements.any? { |element| carries_dynamic?(element) }
+        when Type::HashShape then type.pairs.each_value.any? { |value| carries_dynamic?(value) }
+        when Type::Difference, Type::Refined then carries_dynamic?(type.base)
+        else false
+        end
+      end
+
       # The value-rewriting counterpart of {MutationWidening.widen_tuple}'s `values: :widen`. A mutator that lands a
       # new value in an EXISTING slot falsifies that slot's pinning on a re-opened carrier exactly as
       # it does on a literal one, so `d = [:multi]; d << x; d[0] = "s"` must not keep reading `:multi`

data/lib/rigor/inference/mutation_widening.rb

@@ -7,9 +7,13 @@ require_relative "../source/node_children"
 require_relative "content_join"
 require_relative "hash_lookup_mutation"
 require_relative "mutation_rejoin"
+require_relative "deep_erasure"
 require_relative "receiver_alias"
 require_relative "refinement_mutation"
+# `RemoverNarrowing` is loaded with the engine (`scope.rb`), not here: the engine-free value layer requires this file
+# and must not pull in the remover narrowing and its holder scan (`spec/rigor/cli/effects_cache_probe_spec.rb`).
 require_relative "rewrite_mutation"
+require_relative "set_mutation"
 require_relative "string_mutation"
 
 module Rigor
@@ -18,8 +22,7 @@ module Rigor
     # AND whose method is a known in-place mutator.
     #
     # Closes the **G1 / G2** flow-folding gaps documented at
-    # `docs/notes/20260521-mastodon-cluster4-flow-folding-triage.md` and queued in
-    # [`docs/CURRENT_WORK.md`](../../../docs/CURRENT_WORK.md) § "Flow-folding". The user-visible
+    # `docs/notes/20260521-mastodon-cluster4-flow-folding-triage.md`. The user-visible
     # symptom they shared was a spurious `flow.always-truthy-condition` on a `arr.size == N` /
     # `arr.empty?` / `@arr.empty?` check that follows a loop body or sibling method that mutates
     # `arr` / `@arr` in place.
@@ -75,6 +78,7 @@ module Rigor
     #   ARE also handled** (ivars live in the method-body scope, not the block-local scope).
     #
     # The remaining three items above are demand-gated; see ADR-56.
+    # rubocop:disable-next Metrics/ModuleLength
     module MutationWidening
       # Array mutators that change either the size or the element set of a literal-shape carrier
       # (Tuple). Receiver-mutating methods only — non-mutating siblings (`map` vs `map!`,
@@ -106,7 +110,8 @@ module Rigor
       # Every method name {#widen_for_mutator} responds to — the one set a body scan asks "could an
       # in-place call on this name change its binding?" against (issue #587: the block-return
       # threading gate). Derived from the tables rather than spelled out, so the scan and the
-      # widening it predicts cannot drift apart.
+      # widening it predicts cannot drift apart. The Set-only names ({SetMutation::MUTATORS}) stay out: the scans read
+      # a name without its receiver, and `merge` on a Hash returns a new Hash (issue #2294).
       SHAPE_MUTATORS = (ARRAY_MUTATORS | HASH_MUTATORS | HashLookupMutation::MUTATORS | StringMutation::MUTATORS).freeze
 
       # Methods that return the receiver (or a shallow copy) and cannot mutate it. They must not
@@ -133,10 +138,61 @@ module Rigor
       # pre-join behaviour exactly.
       NO_ARG_TYPES = [].freeze
 
-      def widen_after_call(call_node:, current_scope:, arg_types: NO_ARG_TYPES)
+      # `rewritten_element` is the element a typed element rewriter stores ({RewriteMutation.typed}), or `nil`.
+      def widen_after_call(call_node:, current_scope:, arg_types: NO_ARG_TYPES, rewritten_element: nil)
         return current_scope if pure_self_returner?(call_node.name)
 
-        widen_receiver_aliases(call_node.receiver, call_node.name, current_scope, arg_types: arg_types)
+        if RemoverNarrowing.candidate?(call_node)
+          narrowed = narrow_remover_receiver(call_node, current_scope, arg_types)
+          return narrowed if narrowed
+        end
+
+        widen_receiver_aliases(call_node.receiver, call_node.name, current_scope, arg_types:, rewritten_element:,
+                                                                                  removes_nil: removes_nil?(call_node))
+      end
+
+      # Issue #2608 — a remover that narrows its receiver by what it removes ({RemoverNarrowing}): the receiver's
+      # binding widens as any mutator's does, then loses what the call provably took out. This answers before the
+      # #2555 remover floor, so a synthesised carrier a store grew keeps its precise reading (`parts << maybe_nil;
+      # parts.compact!` reads `Array[String]`). `nil` when the call narrows nothing; the caller then takes the
+      # ordinary path, the floor included.
+      def narrow_remover_receiver(call_node, scope, arg_types)
+        read = call_node.receiver
+        getter, builder = ALIAS_ACCESSORS[read.class]
+        name = ReceiverAlias.read_name(read)
+        current = scope.public_send(getter, name)
+        return nil if current.nil? || RemoverHolderScan.unsafe_receiver?(scope, name)
+
+        narrowed = RemoverNarrowing.narrow_shape(current, call_node)
+        if narrowed.nil?
+          synthesised = synthesised_binding?(scope, getter, name)
+          base = widen_for_mutator(current, call_node.name, arg_types:, synthesised:)
+          narrowed = RemoverNarrowing.narrow(base || current, call_node, scope)
+        end
+        return nil if narrowed.nil?
+        return scope if narrowed == current
+
+        MutationRejoin.rebind(scope, builder, name, narrowed, pre_state: current, kind: getter)
+      end
+
+      # Issue #2555 — the removers that may take a `nil` out, which is every one but a `delete` / `delete?` given a
+      # non-nil literal: false positives outrank, so a positional remover (`pop`, `shift`, `slice!`), `subtract`
+      # (whose argument may hold `nil`) and a `delete` of an unknown value count. `Hash#delete` removes by key, so
+      # whatever value the key held may go ({.floor_grown_carrier} reads the receiver for it).
+      NIL_REMOVERS = %i[compact! reject! select! filter! delete_if keep_if clear pop shift slice!
+                        subtract].to_set.freeze
+      NON_NIL_LITERALS = [
+        Prism::IntegerNode, Prism::FloatNode, Prism::RationalNode, Prism::ImaginaryNode, Prism::StringNode,
+        Prism::SymbolNode, Prism::TrueNode, Prism::FalseNode
+      ].freeze
+      private_constant :NON_NIL_LITERALS
+
+      def removes_nil?(call_node)
+        return true if NIL_REMOVERS.include?(call_node.name)
+        return false unless %i[delete delete?].include?(call_node.name)
+
+        argument = call_node.arguments&.arguments&.first
+        NON_NIL_LITERALS.none? { |klass| argument.is_a?(klass) }
       end
 
       # True when `receiver` names at least one variable whose CURRENT binding is a literal-shape
@@ -147,10 +203,19 @@ module Rigor
 
         ReceiverAlias.mutated_reads(receiver).any? do |read|
           getter, = ALIAS_ACCESSORS[read.class]
-          getter && shape_carrier?(scope.public_send(getter, ReceiverAlias.read_name(read)))
+          next false if getter.nil?
+
+          name = ReceiverAlias.read_name(read)
+          shape_carrier?(scope.public_send(getter, name), synthesised: synthesised_binding?(scope, getter, name))
         end
       end
 
+      # Issue #2555 L3 — whether the binding `getter` / `name` reads carries the `:synthesised` construction fact
+      # ({Scope#construction_fact?}). Only a local can: an instance, class or global variable never carries one.
+      def synthesised_binding?(scope, getter, name)
+        getter == :local && scope.construction_fact?(name)
+      end
+
       # A union carrying a shape member is joinable too (issue #645): {#widen_union} widens that
       # member through the same join, so the arguments the caller would skip are the evidence it
       # needs.
@@ -159,26 +224,32 @@ module Rigor
       # An empty-witness `Difference` counts too (issue #936): the `non-empty-array[T]` arm joins the
       # mutator's added element now, so its arguments are evidence this seam consumes rather than
       # arguments nothing will read.
-      def shape_carrier?(type)
+      # A precise `Hash` counts too when its binding carries the `:synthesised` construction fact (issue #2555): the
+      # re-join grows it from these arguments.
+      def shape_carrier?(type, synthesised: false)
         case type
         when Type::Tuple, Type::HashShape then true
-        when Type::Constant then StringMutation.constant?(type)
+        when Type::Constant then StringMutation.constant?(type) || SetMutation.constant?(type)
         # A re-openable nominal counts since issue #580: skipping it made the one-way door
         # self-fulfilling, since the arm never saw the arg types it grows from.
-        when Type::Nominal then MutationRejoin.regrowable_carrier?(type)
+        # A precise `Array[E]` / `Set[E]` counts since issue #2361, which re-grows it from these arguments.
+        when Type::Nominal
+          MutationRejoin.regrowable_carrier?(type) || MutationRejoin.precise_array?(type) ||
+            SetMutation.regrowable?(type) || (synthesised && MutationRejoin.synthesised_carrier?(type))
         when Type::Difference then type.removes_empty_witness?
-        when Type::Union then type.members.any? { |m| shape_carrier?(m) }
+        when Type::Union then type.members.any? { |m| shape_carrier?(m, synthesised:) }
         else false
         end
       end
 
       # Widens every variable `receiver` can evaluate to ({ReceiverAlias.mutated_reads}), against `method_name`'s
       # mutator table.
-      def widen_receiver_aliases(receiver, method_name, current_scope, arg_types: NO_ARG_TYPES)
+      def widen_receiver_aliases(receiver, method_name, current_scope, arg_types: NO_ARG_TYPES, rewritten_element: nil,
+                                 removes_nil: false)
         return current_scope if receiver.nil?
 
         ReceiverAlias.mutated_reads(receiver).reduce(current_scope) do |acc, read|
-          widen_alias_read(method_name, read, acc, arg_types: arg_types)
+          widen_alias_read(method_name, read, acc, arg_types:, rewritten_element:, removes_nil:)
         end
       end
 
@@ -195,17 +266,19 @@ module Rigor
       # always safe — it can only LOSE precision — so blindly propagating is sound regardless of
       # whether the block actually runs.
       #
-      # Recurses into nested expression nodes so chained / nested forms (`arr << f(x); arr <<
-      # g(y)`, `arr.push(x) if cond`) are all caught. Does NOT recurse into nested
-      # `Prism::BlockNode`s — each block is processed by its own `eval_call`.
+      # Recurses into every nested node, blocks included, so chained / nested forms (`arr << f(x); arr <<
+      # g(y)`, `arr.push(x) if cond`) are all caught.
       def widen_after_block(call_node:, outer_scope:)
         block = call_node.block
+        return DeepErasure.widen_symbol_proc(call_node, outer_scope) if DeepErasure.symbol_proc_mutation?(block)
         return outer_scope unless block.is_a?(Prism::BlockNode)
 
         body = block.body
         return outer_scope if body.nil?
 
-        walk_for_outer_mutations(body, outer_scope)
+        scope = walk_for_outer_mutations(body, outer_scope)
+        names = DeepErasure.parameter_names(block.parameters)
+        DeepErasure.widen_element_aliases(call_node.receiver, block.body, names, scope)
       end
 
       def walk_for_outer_mutations(node, scope)
@@ -231,6 +304,9 @@ module Rigor
         receiver = call_node.receiver
         return scope if receiver.nil?
 
+        widened = widen_outer_element_read(call_node, scope)
+        return widened if widened
+
         ReceiverAlias.candidates(receiver).reduce(scope) do |acc, read|
           # A block-local read ({ReceiverAlias.block_local?}: a `depth == 0` local, or `it`) is not a
           # capture of the outer scope, so widening its name against the OUTER scope would hit an
@@ -241,10 +317,27 @@ module Rigor
           # after it re-adds the appended values' types onto the widened seed, so the seed's own value
           # pinning is still justified (`out = [0]; arr.each { out << x }` never rewrites slot 0). The
           # straight-line paths have no such join, which is why their default is `:widen` (issue #560).
-          widen_alias_read(call_node.name, read, acc, values: :keep)
+          widen_alias_read(call_node.name, read, acc, values: :keep, unread_arguments: !call_node.arguments.nil?)
         end
       end
 
+      # Issue #2287 — a mutator on an element read rooted at a captured local (`[0].each { |i| a[i] << 2 }`,
+      # `loop { a[0] << 2; break }`) mutates an element the outer binding still carries, and names no variable
+      # {ReceiverAlias.candidates} could widen. The element at that path widens in the outer scope as the
+      # straight-line {ElementReadWidening.widen_element_read} widens it; a block-local root is skipped as a
+      # block-local read is. Answers the widened scope, or `nil` when the receiver is no such read or nothing widened.
+      def widen_outer_element_read(call_node, scope)
+        path = ElementReadWidening.element_read_path(call_node.receiver)
+        return nil if path.nil?
+
+        read, steps = path
+        return nil if ReceiverAlias.block_local?(read)
+
+        current = scope.local(read.name)
+        widened = current && ElementReadWidening.widen_through_path(current, steps, call_node.name, NO_ARG_TYPES)
+        widened && scope.with_mutated_local(read.name, widened)
+      end
+
       # The arms per kind of binding differ only in which pair of `Scope` accessors they use, so they are read out
       # of one table rather than written once per kind: a carrier the widening responds to must not be widened on
       # one kind of binding and left on another. `$g << x; $g == "k"` folded always-truthy on a `$g` Ruby holds
@@ -257,18 +350,38 @@ module Rigor
                                                 Prism::ClassVariableReadNode => %i[cvar with_cvar],
                                                 Prism::GlobalVariableReadNode => %i[global with_global]
                                               })
-      private_constant :ALIAS_ACCESSORS
 
-      def widen_alias_read(method_name, read, scope, values: :widen, arg_types: NO_ARG_TYPES)
+      # `unread_arguments` says the call passes arguments this seam did not type (the block-capture path): a Set,
+      # which has no block content join, takes one unknown store for it ({SetMutation.widen}).
+      def widen_alias_read(method_name, read, scope, values: :widen, arg_types: NO_ARG_TYPES, unread_arguments: false, # rubocop:disable Metrics/ParameterLists
+                           rewritten_element: nil, removes_nil: false)
         getter, builder = ALIAS_ACCESSORS[read.class]
         return scope if getter.nil?
 
         name = ReceiverAlias.read_name(read)
         current = scope.public_send(getter, name)
-        widened = widen_for_mutator(current, method_name, values: values, arg_types: arg_types)
-        return scope if widened.nil?
+        synthesised = synthesised_binding?(scope, getter, name)
+        if synthesised && MutationRejoin.floors_grown_carrier?(scope, name, method_name)
+          return floor_grown_carrier(scope, builder, name, current, method_name, getter, removes_nil)
+        end
 
-        MutationRejoin.rebind(scope, builder, name, widened, pre_state: current, kind: getter)
+        widened = widen_for_mutator(current, method_name, values:, arg_types:, unread_arguments:, rewritten_element:,
+                                                          synthesised:)
+        scope = MutationRejoin.rebind(scope, builder, name, widened, pre_state: current, kind: getter) if widened
+        return scope unless synthesised && MutationRejoin.content_adder?(method_name)
+
+        MutationRejoin.grew_unfloored?(current, widened) ? scope.with_construction_fact(name, :grown) : scope
+      end
+
+      # Issue #2555 — a remover or filter on a synthesised carrier a store has grown. Nothing narrows the carrier back,
+      # so the stored arm would outlive the values the call removes (`parts << nil; parts.compact!`); the carrier takes
+      # the `Dynamic[top]` floor it would have carried without the fact. The binding keeps its facts: the floored
+      # carrier is gradual, so the synthesised re-join no longer applies to it, and a later remover floors it again.
+      def floor_grown_carrier(scope, builder, name, current, method_name, getter, removes_nil)
+        drop_nil = removes_nil || (method_name == :delete && MutationRejoin.hash_carrier?(current))
+        floored = MutationRejoin.floor_parameters(current, drop_nil:)
+        floored = widen_for_mutator(floored, method_name) || floored
+        MutationRejoin.rebind(scope, builder, name, floored, pre_state: current, kind: getter)
       end
 
       # Mutators that can land a NEW value in an EXISTING slot, falsifying that slot's value pinning
@@ -282,15 +395,32 @@ module Rigor
       # Returns the widened type for a binding whose receiver is about to be mutated by
       # `method_name`, or `nil` when no widening applies (binding is not a carrier the mutation
       # stands for, OR the method is not a mutator for that shape, OR the carrier is a PRECISE
-      # nominal, whose element set is a claim this seam may not grow — see {MutationRejoin.regrowable_carrier?}).
-      def widen_for_mutator(type, method_name, values: :widen, arg_types: NO_ARG_TYPES)
+      # nominal the call stores nothing into — see {MutationRejoin.widen_precise_array}).
+      # A `rewritten_element` answers first for the carriers {RewriteMutation.typed} types (issue #2427).
+      # `synthesised` says the binding carries the `:synthesised` construction fact (issue #2555,
+      # {Scope#construction_fact?}): a precise nominal or Set it holds re-grows without the `Dynamic[top]` floor
+      # ({MutationRejoin.widen_synthesised}, {SetMutation.widen}).
+      def widen_for_mutator(type, method_name, values: :widen, arg_types: NO_ARG_TYPES, unread_arguments: false,
+                            rewritten_element: nil, synthesised: false)
+        typed = rewritten_element && type && RewriteMutation.typed(type, method_name, rewritten_element)
+        return typed == type ? nil : typed if typed
+
+        widen_carrier(type, method_name, values:, arg_types:, unread_arguments:, rewritten_element:, synthesised:)
+      end
+
+      # {#widen_for_mutator} for a carrier no typed element rewrite answered.
+      def widen_carrier(type, method_name, values:, arg_types:, unread_arguments:, rewritten_element:,
+                        synthesised: false)
         values = :keep unless VALUE_REWRITING_MUTATORS.include?(method_name)
         values = RewriteMutation.values_mode(type, method_name, values)
 
         return nil if type.nil?
+        if SetMutation.set?(type)
+          return SetMutation.widen(type, method_name, arg_types, unread_arguments:, synthesised:)
+        end
 
         case type
-        when Type::Nominal then MutationRejoin.widen_nominal(type, method_name, values:, arg_types:)
+        when Type::Nominal then MutationRejoin.widen_nominal(type, method_name, values:, arg_types:, synthesised:)
         when Type::Tuple
           return nil unless ARRAY_MUTATORS.include?(method_name)
 
@@ -304,7 +434,7 @@ module Rigor
         when Type::Difference
           widen_difference(type, method_name, arg_types: arg_types)
         when Type::Union
-          widen_union(type, method_name, values: values, arg_types: arg_types)
+          widen_union(type, method_name, values:, arg_types:, unread_arguments:, rewritten_element:, synthesised:)
         end
       end
 
@@ -322,12 +452,14 @@ module Rigor
       #
       # `nil` when no member widened — a union with no carrier member, or one whose carriers are
       # already nominal, is untouched exactly as the scalar path leaves them.
-      def widen_union(union, method_name, values: :widen, arg_types: NO_ARG_TYPES)
+      def widen_union(union, method_name, values: :widen, arg_types: NO_ARG_TYPES, unread_arguments: false,
+                      rewritten_element: nil, synthesised: false)
         widened_any = false
         members = union.members.map do |member|
           next member unless mutation_carrier?(member, method_name)
 
-          widened = widen_for_mutator(member, method_name, values: values, arg_types: arg_types)
+          widened = widen_for_mutator(member, method_name, values:, arg_types:, unread_arguments:, rewritten_element:,
+                                                           synthesised:)
           next member if widened.nil?
 
           widened_any = true
@@ -345,7 +477,8 @@ module Rigor
         (ARRAY_MUTATORS.include?(method_name) && ContentJoin.array_residue(member).empty?) ||
           ((HASH_MUTATORS.include?(method_name) || HashLookupMutation::MUTATORS.include?(method_name)) &&
             ContentJoin.hash_residue(member).empty?) ||
-          (StringMutation::MUTATORS.include?(method_name) && StringMutation.constant?(member))
+          (StringMutation::MUTATORS.include?(method_name) && StringMutation.constant?(member)) ||
+          (SetMutation::MUTATORS.include?(method_name) && SetMutation.carrier?(member))
       end
 
       # Joins the element evidence the mutator's own ARGUMENTS introduce into the already-widened