rigortype 0.4.5 → 0.4.7

data/lib/rigor/inference/remover_holder_scan.rb

@@ -0,0 +1,233 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../run_scoped_slots"
+require_relative "closure_escape_analyzer"
+require_relative "construction_escape"
+
+module Rigor
+  module Inference
+    # Issue #2608, review rounds 1 and 2 of #2621 — which locals of a body another holder may write, so a remover on
+    # them is not narrowed ({RemoverNarrowing}): a narrowing is a fact about the object, and a write through any other
+    # holder after the call would outlive it. One flow-insensitive scan per frame body; a local is a holder's when:
+    #
+    # - a closure that may run later references it: a lambda, or a block passed to a call that is not a catalogued
+    #   iterator or `tap` / `then` / `yield_self` (`proc { l << 1 }`), created before or after the remover;
+    # - it is read anywhere inside the value of any write (local, instance, class, global or constant variable, an
+    #   index or attribute write, an operator or `||=` / `&&=` write, a multiple assignment) or inside the subject of a
+    #   `case`/`in`, `=>` or `in` pattern: `al = c ? l : []`, `al = l.push(1)`, `@k = l`, `case l; in al`. The local
+    #   such a write or pattern binds is a holder too (both names of a copy), unless the write's value is a fresh
+    #   object: an Array or Hash literal, or `new` / `[]` on a bare or top-level `Array`, `Hash` or `Set`
+    #   (`a = Array.new(n, "a")`);
+    # - a method's parameter, when its body has a zero-argument `super`, which passes every parameter on;
+    # - it is read inside an Array element, a Hash key or value, a splat, or an argument of any call, `yield` or
+    #   `super` (positional, keyword, splat or block-pass), unless the read is the receiver of a call that answers
+    #   a value other than the receiver and keeps no reference to it ({PURE_READERS}: #2555's per-class
+    #   `ConstructionEscape::READERS`, less the conversions that return self on another class): `puts(l.size)`,
+    #   `dump_type(l.dup)` and `dump_type(l.first)` hold nothing, `Keep.new(l)` and `foo(l.push(1))` do;
+    # - it receives a reflective call (`l.send(...)`, `l.instance_eval { }`, `l.tap { }`);
+    # - and every local, when the body calls `binding`, `eval`, `local_variable_get` or `local_variable_set` on any
+    #   receiver (`-> {}.binding`), or a receiverless `instance_variable_set`.
+    #
+    # A receiver position, a `return` and a body's last expression hand nothing on.
+    module RemoverHolderScan
+      REFLECTIVE_CALLS = %i[
+        send public_send __send__ instance_eval instance_exec tap then yield_self itself method
+        define_singleton_method
+      ].to_set.freeze
+      # A conversion one class lists as a reader returns the receiver itself on another (`Array#to_a`, `Hash#to_h`,
+      # `Set#to_set`), so the union of the per-class lists leaves them out.
+      SELF_CONVERSIONS = %i[to_a to_h to_set].freeze
+      PURE_READERS = (ConstructionEscape::READERS.values.reduce(:|) - SELF_CONVERSIONS).freeze
+      IMMEDIATE_BLOCK_CALLS = %i[tap then yield_self].to_set.freeze
+      FRAME_CALLS = %i[binding eval local_variable_get local_variable_set instance_variable_set].to_set.freeze
+      # Frame calls that reach the locals whatever their receiver (`pr.binding`, `Kernel.eval`).
+      ANY_RECEIVER_FRAME_CALLS = %i[binding eval local_variable_get local_variable_set].to_set.freeze
+      NON_WRITER_OPERATORS = %i[== != <= >= ===].to_set.freeze
+      CORE_COLLECTIONS = %i[Array Hash Set].to_set.freeze
+      LOCAL_REFERENCES = [
+        Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode,
+        Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode, Prism::LocalVariableTargetNode
+      ].freeze
+      LOCAL_WRITES = [
+        Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+        Prism::LocalVariableAndWriteNode
+      ].freeze
+      ALL = :all
+      # A run-scoped slot ({RunScopedSlots}): emptied when a run ends, so no verdict outlives the body it read.
+      UNSAFE_CACHE_KEY = RunScopedSlots.register(:__rigor_remover_narrowing_unsafe)
+      private_constant :REFLECTIVE_CALLS, :SELF_CONVERSIONS, :PURE_READERS, :IMMEDIATE_BLOCK_CALLS, :FRAME_CALLS,
+                       :ANY_RECEIVER_FRAME_CALLS, :NON_WRITER_OPERATORS, :CORE_COLLECTIONS,
+                       :LOCAL_REFERENCES, :LOCAL_WRITES, :ALL, :UNSAFE_CACHE_KEY
+
+      module_function
+
+      # Whether the local `name` may be written through another holder somewhere in the body `scope` runs. A scope
+      # with no known body answers true.
+      def unsafe_receiver?(scope, name)
+        frame = scope.match_frame
+        body = frame&.body
+        return true if body.nil?
+
+        table = (Thread.current[UNSAFE_CACHE_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        names = table[body] ||= unsafe_names(body, frame.parameters)
+        names.equal?(ALL) || names.include?(name.to_sym)
+      end
+
+      def unsafe_names(body, parameters = nil)
+        names = Set.new
+        catch(ALL) do
+          collect_unsafe(body, false, names)
+          parameter_names(parameters, names) if forwards_parameters?(body)
+          return names.freeze
+        end
+        ALL
+      end
+
+      def collect_unsafe(node, in_closure, names)
+        in_closure ||= node.is_a?(Prism::LambdaNode)
+        names << node.name if in_closure && LOCAL_REFERENCES.any? { |k| node.is_a?(k) }
+        record_node(node, names)
+
+        node.compact_child_nodes.each do |child|
+          child_in_closure = in_closure || (child.is_a?(Prism::BlockNode) && deferred_block?(node))
+          collect_unsafe(child, child_in_closure, names)
+        end
+      end
+
+      def record_node(node, names) # rubocop:disable Metrics/CyclomaticComplexity
+        case node
+        when Prism::CallNode then record_call(node, names)
+        when Prism::YieldNode, Prism::SuperNode then node.arguments&.arguments&.each { |a| record_held(a, names) }
+        when Prism::ArrayNode then node.elements.each { |element| record_held(element, names) }
+        when Prism::AssocNode then [node.key, node.value].each { |part| record_held(part, names) }
+        when Prism::SplatNode, Prism::BlockArgumentNode then record_held(node.expression, names)
+        when Prism::CaseMatchNode then record_pattern(node.predicate, node.conditions, names)
+        when Prism::MatchRequiredNode, Prism::MatchPredicateNode then record_pattern(node.value, [node.pattern], names)
+        when Prism::MultiWriteNode then record_multi_write(node, names)
+        else record_write(node, names)
+        end
+      end
+
+      def record_call(node, names)
+        throw ALL if frame_call?(node)
+
+        receiver = unparenthesised(node.receiver)
+        names << receiver.name if receiver.is_a?(Prism::LocalVariableReadNode) && REFLECTIVE_CALLS.include?(node.name)
+        arguments = node.arguments&.arguments || []
+        if writer_call?(node) && !arguments.empty?
+          *keys, value = arguments
+          keys.each { |key| record_held(key, names) }
+          every_read(value, names)
+        else
+          arguments.each { |argument| record_held(argument, names) }
+        end
+      end
+
+      # A zero-argument `super` passes every parameter of the method on, implicitly. (A `...` forward passes only the
+      # anonymous parameters, which name no local.)
+      def forwards_parameters?(node)
+        node.is_a?(Prism::ForwardingSuperNode) || node.compact_child_nodes.any? { |child| forwards_parameters?(child) }
+      end
+
+      def parameter_names(node, names)
+        return if node.nil?
+
+        names << node.name if node.class.name.end_with?("ParameterNode") && node.respond_to?(:name) && node.name
+        node.compact_child_nodes.each { |child| parameter_names(child, names) }
+      end
+
+      def frame_call?(node)
+        ANY_RECEIVER_FRAME_CALLS.include?(node.name) || (node.receiver.nil? && FRAME_CALLS.include?(node.name))
+      end
+
+      def unparenthesised(node)
+        node = node.body.body.first while node.is_a?(Prism::ParenthesesNode) && node.body&.body&.size == 1
+        node
+      end
+
+      # An index or attribute write (`h[k] = v`, `o.x = v`, `o&.x = v`): its value is a write's value.
+      def writer_call?(node)
+        name = node.name
+        name.end_with?("=") && !NON_WRITER_OPERATORS.include?(name)
+      end
+
+      # A write's value hands on every local read anywhere inside it, and the local it binds holds what it read.
+      def record_write(node, names)
+        return unless node.class.name.end_with?("WriteNode") && node.respond_to?(:value)
+        return unless every_read(node.value, names)
+
+        names << node.name if LOCAL_WRITES.any? { |k| node.is_a?(k) } && !fresh_value?(node.value)
+      end
+
+      # `Array`, `Hash` or `Set`, bare or as a top-level path (`::Set`): a project class may define its own `self.[]` or
+      # `self.new` that returns its argument.
+      def core_collection_constant?(node)
+        top_level = node.is_a?(Prism::ConstantReadNode) || (node.is_a?(Prism::ConstantPathNode) && node.parent.nil?)
+        top_level && CORE_COLLECTIONS.include?(node.name)
+      end
+
+      # A value that is a new object whatever it reads, so the local it binds aliases nothing.
+      def fresh_value?(value)
+        case value
+        when Prism::ArrayNode, Prism::HashNode then true
+        when Prism::CallNode then %i[new []].include?(value.name) && core_collection_constant?(value.receiver)
+        else false
+        end
+      end
+
+      def record_multi_write(node, names)
+        return unless every_read(node.value, names)
+
+        local_targets([*node.lefts, node.rest, *node.rights], names)
+      end
+
+      def record_pattern(subject, patterns, names)
+        return unless every_read(subject, names)
+
+        local_targets(patterns, names)
+      end
+
+      # Adds every local `node` reads, at any depth; answers whether it read any.
+      def every_read(node, names)
+        return false if node.nil?
+
+        found = node.is_a?(Prism::LocalVariableReadNode)
+        names << node.name if found
+        node.compact_child_nodes.reduce(found) { |acc, child| every_read(child, names) || acc }
+      end
+
+      def local_targets(nodes, names)
+        nodes.compact.each do |node|
+          names << node.name if node.is_a?(Prism::LocalVariableTargetNode)
+          local_targets(node.compact_child_nodes, names)
+        end
+      end
+
+      # A held position: every local read inside it but the receiver of a {PURE_READERS} call.
+      def record_held(node, names)
+        return if node.nil?
+        return if pure_read?(node)
+
+        names << node.name if node.is_a?(Prism::LocalVariableReadNode)
+        node.compact_child_nodes.each { |child| record_held(child, names) }
+      end
+
+      # A {PURE_READERS} call on a local hands the local on to nothing. Its own arguments are held positions of the
+      # call itself, which the body walk records when it reaches that call.
+      def pure_read?(node)
+        node.is_a?(Prism::CallNode) && PURE_READERS.include?(node.name) &&
+          node.receiver.is_a?(Prism::LocalVariableReadNode)
+      end
+
+      # A block that may run after its call returns: any but a catalogued iterator's, or `tap` / `then` /
+      # `yield_self`'s.
+      def deferred_block?(call_node)
+        return true unless call_node.is_a?(Prism::CallNode)
+
+        !(ClosureEscapeAnalyzer.iterator_name?(call_node.name) || IMMEDIATE_BLOCK_CALLS.include?(call_node.name))
+      end
+    end
+  end
+end

data/lib/rigor/inference/remover_narrowing.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+require_relative "remover_holder_scan"
+# `Narrowing` is resolved at call time: requiring it here closes a load cycle through `KeyPresenceGuard`.
+
+module Rigor
+  module Inference
+    # Issue #2608 — a collection remover or filter narrows its receiver's element (or Hash key / value) type by what
+    # Ruby guarantees it removed, where that is provable from the call alone:
+    #
+    # - `Array#compact!` / `Hash#compact!` drop `nil` from the element / value;
+    # - `Array#delete(nil)` / `Set#delete(nil)` / `Set#delete?(nil)` drop `nil` from the element, and `Hash#delete(nil)`
+    #   drops it from the key, given a literal `nil`;
+    # - `reject!` / `delete_if` keep the elements the block answers falsey for, and `select!` / `filter!` / `keep_if`
+    #   the ones it answers truthy for. The block's one expression is read by the engine's own predicate narrowing
+    #   ({Narrowing.predicate_scopes}) with its parameter bound to the element (the Hash `|k, v|` form binds both), and
+    #   the surviving element is that parameter's binding on the matching edge. `&:nil?` reads as `{ |x| x.nil? }`;
+    # - a closed `HashShape` loses the key a literal `delete(:k)` names.
+    #
+    # Everything else (`pop`, `shift`, `slice!`, `subtract`, `delete` of a non-literal, a block whose predicate the
+    # narrowing does not read) answers `nil`: which members remain is not provable, and the caller keeps its reading.
+    #
+    # Only a receiver that is itself a local read narrows, and only when no other holder in its body may write the
+    # object ({RemoverHolderScan}): the narrowing is a fact about the object. A receiver selecting among bindings
+    # (`(f ? a : b).compact!`) mutates one of them, and narrowing every candidate would drop a member from the one the
+    # call never touched. An instance variable never narrows: any method, or any object that holds it, can write it.
+    module RemoverNarrowing
+      NIL_REJECTORS = %i[compact!].to_set.freeze
+      NIL_LITERAL_DELETERS = %i[delete delete?].to_set.freeze
+      FALSEY_KEEPERS = %i[reject! delete_if].to_set.freeze
+      TRUTHY_KEEPERS = %i[select! filter! keep_if].to_set.freeze
+      CANDIDATES = (NIL_REJECTORS | NIL_LITERAL_DELETERS | FALSEY_KEEPERS | TRUTHY_KEEPERS).freeze
+      NARROWING_RECEIVERS = [Prism::LocalVariableReadNode].freeze
+      CARRIERS = %w[Array Hash Set].freeze
+      # Nodes that make a one-expression block's value something other than its predicate, or rebind a parameter.
+      OPAQUE_BLOCK_NODES = [
+        Prism::NextNode, Prism::BreakNode, Prism::ReturnNode, Prism::RedoNode, Prism::RetryNode, Prism::YieldNode,
+        Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+        Prism::LocalVariableAndWriteNode, Prism::LocalVariableTargetNode
+      ].freeze
+      private_constant :NIL_REJECTORS, :NIL_LITERAL_DELETERS, :FALSEY_KEEPERS, :TRUTHY_KEEPERS, :NARROWING_RECEIVERS,
+                       :CARRIERS, :OPAQUE_BLOCK_NODES
+
+      module_function
+
+      # Whether `call_node` may narrow its receiver at all: a cheap syntactic gate for {.narrow}.
+      def candidate?(call_node)
+        CANDIDATES.include?(call_node.name) && NARROWING_RECEIVERS.any? { |klass| call_node.receiver.is_a?(klass) }
+      end
+
+      # The closed `HashShape` `shape` without the key a literal `delete(:k)` names, or `nil` when the call is no such
+      # delete or the shape is open (an unseen key may be the one deleted, and the opened default reads it back).
+      def narrow_shape(shape, call_node)
+        return nil unless shape.is_a?(Type::HashShape) && shape.closed? && call_node.name == :delete
+
+        key = literal_key(single_argument(call_node))
+        return nil if key.equal?(NO_KEY)
+        return shape unless shape.pairs.key?(key)
+        return nil if shape.read_only_key?(key)
+
+        Type::Combinator.hash_shape_of(
+          shape.pairs.except(key),
+          required_keys: shape.required_keys - [key], optional_keys: shape.optional_keys - [key],
+          read_only_keys: shape.read_only_keys, extra_keys: :closed
+        )
+      end
+
+      # `type` with each Array / Hash / Set member narrowed by what `call_node` removes, member-wise through a union.
+      # `nil` when the call narrows no member (it is no exact remover for the member's class, or its block predicate
+      # says nothing about the element). A member the call answers for without change (`compact!` on `Array[Integer]`)
+      # still counts as answered: the caller then keeps the precise reading rather than a floored one.
+      def narrow(type, call_node, scope)
+        answered = false
+        members = members_of(type).map do |member|
+          narrowed = narrow_member(member, call_node, scope)
+          next member if narrowed.nil?
+
+          answered = true
+          narrowed
+        end
+        answered ? Type::Combinator.union(*members) : nil
+      end
+
+      def members_of(type)
+        type.is_a?(Type::Union) ? type.members : [type]
+      end
+
+      def narrow_member(member, call_node, scope)
+        return nil unless member.is_a?(Type::Nominal) && CARRIERS.include?(member.class_name)
+
+        args = member.type_args
+        case member.class_name
+        when "Hash" then args.size == 2 ? narrow_hash(member, call_node, scope) : nil
+        else args.size == 1 ? narrow_elements(member, call_node, scope) : nil
+        end
+      end
+
+      def narrow_elements(member, call_node, scope)
+        element = member.type_args.first
+        narrowed =
+          case call_node.name
+          when :compact! then Narrowing.narrow_non_nil(element)
+          when :delete, :delete? then nil_argument?(call_node) ? Narrowing.narrow_non_nil(element) : nil
+          else block_narrowed(call_node, scope, [element])&.first
+          end
+        usable?(narrowed) ? Type::Combinator.nominal_of(member.class_name, type_args: [narrowed]) : nil
+      end
+
+      def narrow_hash(member, call_node, scope)
+        key, value = member.type_args
+        narrowed =
+          case call_node.name
+          when :compact! then [key, Narrowing.narrow_non_nil(value)]
+          when :delete then nil_argument?(call_node) ? [Narrowing.narrow_non_nil(key), value] : nil
+          when :delete? then nil
+          else block_narrowed(call_node, scope, [key, value])
+          end
+        narrowed&.all? { |arg| usable?(arg) } ? Type::Combinator.nominal_of("Hash", type_args: narrowed) : nil
+      end
+
+      # A parameter narrowed to `bot` (`select! { |x| x.nil? }` on `Array[Integer]`) says the carrier is empty; that
+      # is left to the caller's reading rather than spelled as `Array[bot]`.
+      def usable?(type)
+        !type.nil? && !type.is_a?(Type::Bot)
+      end
+
+      def nil_argument?(call_node)
+        single_argument(call_node).is_a?(Prism::NilNode)
+      end
+
+      def single_argument(call_node)
+        arguments = call_node.arguments&.arguments
+        arguments&.size == 1 ? arguments.first : nil
+      end
+
+      NO_KEY = Object.new.freeze
+      private_constant :NO_KEY
+
+      def literal_key(node)
+        case node
+        when Prism::SymbolNode then node.unescaped.to_sym
+        else NO_KEY
+        end
+      end
+
+      # The block parameters' types on the edge that keeps an element, or `nil` when the call has no block the
+      # narrowing reads: one expression, no jump or local write, explicit required parameters matching the carrier
+      # (`|x|` for an element, `|k, v|` for a Hash pair), and a predicate that narrows one of them on some edge.
+      def block_narrowed(call_node, scope, types)
+        keep = keep_edge(call_node.name)
+        return nil if keep.nil?
+
+        block = call_node.block
+        return symbol_nil_narrowed(block, keep, types) if block.is_a?(Prism::BlockArgumentNode)
+
+        names = block_parameter_names(block, types.size)
+        predicate = names && block_predicate(block)
+        return nil if predicate.nil?
+
+        predicate_narrowed(predicate, scope, names, types, keep)
+      end
+
+      def keep_edge(method_name)
+        if FALSEY_KEEPERS.include?(method_name) then :falsey
+        elsif TRUTHY_KEEPERS.include?(method_name) then :truthy
+        end
+      end
+
+      def symbol_nil_narrowed(block, keep, types)
+        symbol = block.expression
+        return nil unless types.size == 1 && symbol.is_a?(Prism::SymbolNode) && symbol.unescaped == "nil?"
+
+        [keep == :falsey ? Narrowing.narrow_non_nil(types.first) : Narrowing.narrow_nil(types.first)]
+      end
+
+      def block_parameter_names(block, arity)
+        return nil unless block.is_a?(Prism::BlockNode)
+
+        parameters = block.parameters
+        return nil unless parameters.is_a?(Prism::BlockParametersNode)
+
+        list = parameters.parameters
+        return nil if list.nil? || !simple_parameters?(list) || list.requireds.size != arity
+        return nil unless list.requireds.all?(Prism::RequiredParameterNode)
+
+        list.requireds.map(&:name)
+      end
+
+      def simple_parameters?(list)
+        list.optionals.empty? && list.rest.nil? && list.posts.empty? && list.keywords.empty? &&
+          list.keyword_rest.nil? && list.block.nil?
+      end
+
+      def block_predicate(block)
+        body = block.body
+        return nil unless body.is_a?(Prism::StatementsNode) && body.body.size == 1
+
+        statement = body.body.first
+        opaque?(statement) ? nil : statement
+      end
+
+      def opaque?(node)
+        return true if OPAQUE_BLOCK_NODES.any? { |klass| node.is_a?(klass) }
+
+        node.compact_child_nodes.any? { |child| opaque?(child) }
+      end
+
+      def predicate_narrowed(predicate, scope, names, types, keep)
+        bound = names.zip(types).reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
+        truthy, falsey = Narrowing.predicate_scopes(predicate, bound)
+        read = ->(edge) { names.map { |name| edge.local(name) || bound.local(name) } }
+        entry_types = read.call(bound)
+        truthy_types = read.call(truthy)
+        falsey_types = read.call(falsey)
+        return nil if truthy_types == entry_types && falsey_types == entry_types
+
+        keep == :truthy ? truthy_types : falsey_types
+      end
+    end
+  end
+end

data/lib/rigor/inference/rewrite_mutation.rb

@@ -24,7 +24,8 @@ module Rigor
       # replacement, and the seed it would otherwise keep beside it is gone.
       REPLACED = Ractor.make_shareable({
                                          "Array" => { map!: [0], collect!: [0], flatten!: [0], replace: [0] },
-                                         "Hash" => { transform_keys!: [0], transform_values!: [1], replace: [0, 1] }
+                                         "Hash" => { transform_keys!: [0], transform_values!: [1], replace: [0, 1] },
+                                         "Set" => { map!: [0], collect!: [0], flatten!: [0], replace: [0] }
                                        })
 
       # Mutators that store values nothing describes BESIDE values they may keep: `fill(x, start)` leaves the slots
@@ -66,6 +67,56 @@ module Rigor
         Type::Combinator.nominal_of(carrier.class_name, type_args: args)
       end
 
+      # The element rewriters {.typed} answers for, keyed to the non-bang call whose result is the rewritten
+      # receiver: `a.map!(&:to_i)` holds what `a.map(&:to_i)` returns, and `a.flatten!` what `a.flatten` does.
+      TYPED_COUNTERPARTS = Ractor.make_shareable({ map!: :map, collect!: :collect, flatten!: :flatten })
+
+      # The carrier classes {.typed} rewrites, with the rewriters each takes. `Set#flatten!` is absent: it flattens
+      # only nested Sets, so `ARGV.map { |x| [x] }.to_set.flatten!` still holds `[String]` Arrays, while `Set#flatten`
+      # answers an element its RBS does not narrow.
+      TYPED_CARRIERS = Ractor.make_shareable({ "Array" => %i[map! collect! flatten!], "Set" => %i[map! collect!] })
+
+      # Issue #2427 — `carrier` with its element replaced by `element`, the element of what the non-bang counterpart
+      # ({TYPED_COUNTERPARTS}) answers for the same call: `a = ARGV.dup; a.map!(&:to_i)` reads `Array[Integer]` and
+      # `a.map!(&:strip)` keeps `Array[String]`. It is the typed form of {.arm}'s {REPLACED} answer, and it replaces
+      # the gradual and the precise element alike, since nothing the seed held survives the rewrite.
+      #
+      # Answers for an `Array` / `Set` nominal and an empty-witness refinement of one (keeping the witness only where
+      # {RefinementMutation.preserves_witness?} does: `map!` keeps it, `flatten!` can empty `[[]]`). `nil` for any
+      # other carrier or name, so the caller takes the gradual arm instead.
+      def typed(carrier, method_name, element)
+        return nil unless TYPED_COUNTERPARTS.key?(method_name)
+
+        case carrier
+        when Type::Nominal
+          return nil unless carrier.type_args.size == 1 && TYPED_CARRIERS[carrier.class_name]&.include?(method_name)
+
+          Type::Combinator.nominal_of(carrier.class_name, type_args: [element])
+        when Type::Difference
+          typed_refinement(carrier, method_name, element)
+        end
+      end
+
+      def typed_refinement(difference, method_name, element)
+        base = difference.base
+        return nil unless difference.removes_empty_witness? && base.is_a?(Type::Nominal)
+
+        rewritten = typed(base, method_name, element)
+        return nil if rewritten.nil?
+
+        kept = RefinementMutation.preserves_witness?(base.class_name, method_name)
+        kept ? Type::Combinator.difference(rewritten, difference.removed) : rewritten
+      end
+
+      # The element of `result`, the non-bang counterpart's answer: an `Array[R]` / `Set[R]` nominal, or an
+      # empty-witness refinement of one. `nil` when the answer has no single element to read.
+      def counterpart_element(result)
+        result = result.base if result.is_a?(Type::Difference) && result.removes_empty_witness?
+        return nil unless result.is_a?(Type::Nominal) && %w[Array Set].include?(result.class_name)
+
+        result.type_args.size == 1 ? result.type_args.first : nil
+      end
+
       # {.arm} through a `Union` (member by member) and an empty-witness refinement (its base, keeping the witness
       # only when the mutator cannot empty the receiver — {RefinementMutation.preserves_witness?}). For a carrier
       # the ADR-56 slice-C join rebuilt from its seed, which knows the adders' content but not the rewrite.
@@ -114,7 +165,7 @@ module Rigor
         when Type::Nominal then type.class_name
         end
       end
-      private_class_method :value_carrier_class, :arm_refinement
+      private_class_method :value_carrier_class, :arm_refinement, :typed_refinement
     end
   end
 end

data/lib/rigor/inference/scope_indexer/certainty.rb

@@ -66,6 +66,15 @@ module Rigor
           classifier.result
         end
 
+        # Issue #2021 — every contribution of the tree under `root`, for a file discovery reached only through a
+        # `require_relative` walk: another file the walk does not see may redefine what it defines, so none of its
+        # contributions is certain.
+        def every_contribution(root)
+          classifier = Classifier.new
+          classifier.possible(root)
+          classifier.result
+        end
+
         # Whether `node` was classified possible in `possible` (a {possible_nodes} answer).
         def possible?(possible, node)
           !possible.empty? && possible.include?(node)
@@ -102,7 +111,6 @@ module Rigor
             node.rigor_each_child { |child| certain(child) }
           end
 
-          # Marks every contribution of the subtree.
           def possible(node)
             return unless node.is_a?(Prism::Node)
 

data/lib/rigor/inference/scope_indexer/constant_ivar_value.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../source/node_walker"
+
+module Rigor
+  module Inference
+    module ScopeIndexer
+      # Issue #2291 — the class-ivar census types an `@x = LIT` write from the type the constant's own write binds, the
+      # same way a method body reads `LIT`. The census runs before the file's in-source constant table is seeded, so
+      # without it the write typed under no constant table and a reader over the ivar (`def q = @q`) read `Dynamic[top]`
+      # where `def g = LIT` read the constant's type.
+      #
+      # One instance serves one census walk. The file's constant table is built on the first constant-valued write, so
+      # a file with none pays nothing; it is built as {ScopeIndexer#index} builds it later (typed under the census's
+      # scope, merged over the scope's project seed, a mutated literal widened), and resolved through the ordinary
+      # constant lookup. {#type_of} answers nil, leaving the write's ordinary typing, when:
+      #
+      # - the value is not a constant read (`LIT`, `A::LIT`, `::LIT`); a path over anything else (`self.class::LIT`)
+      #   resolves to nothing, as it does in a method body;
+      # - the file may rebind a constant of that last segment: a second write in any form, an operator, `||=` or `&&=`
+      #   write, a multiple-assignment target, or a `const_set` / `remove_const` naming it — or naming anything but a
+      #   literal, which may be it.
+      #
+      # A constant another file assigns resolves only through the scope's own project seed, as it did before.
+      class ConstantIvarValue
+        WRITE_NODES = [Prism::ConstantWriteNode, Prism::ConstantPathWriteNode].freeze
+        REBIND_NODES = [Prism::ConstantOperatorWriteNode, Prism::ConstantOrWriteNode, Prism::ConstantAndWriteNode,
+                        Prism::ConstantPathOperatorWriteNode, Prism::ConstantPathOrWriteNode,
+                        Prism::ConstantPathAndWriteNode, Prism::ConstantTargetNode,
+                        Prism::ConstantPathTargetNode].freeze
+        REBIND_CALLS = %i[const_set remove_const].freeze
+        ANY_NAME = :any
+        private_constant :WRITE_NODES, :REBIND_NODES, :REBIND_CALLS, :ANY_NAME
+
+        def initialize(root, scope)
+          @root = root
+          @scope = scope
+        end
+
+        # The type `value` reads under the file's constant table, or nil when the write keeps its ordinary typing.
+        def type_of(value, scope)
+          return nil unless value.is_a?(Prism::ConstantReadNode) || value.is_a?(Prism::ConstantPathNode)
+          return nil if rebound?(value.name)
+
+          scope.with_discovery(scope.discovery.with(in_source_constants: constants)).type_of(value)
+        end
+
+        private
+
+        def constants
+          @constants ||= begin
+            literal_mutations = ScopeIndexer.collect_literal_receiver_mutations(@root)
+            per_file = ScopeIndexer.widen_mutated_constants(
+              ScopeIndexer.build_in_source_constants(@root, @scope), literal_mutations[:constants]
+            )
+            ScopeIndexer.merge_seeded_constants(@scope.in_source_constants, per_file)
+          end
+        end
+
+        def rebound?(name)
+          @rebound ||= rebound_names
+          @rebound.include?(ANY_NAME) || @rebound.include?(name)
+        end
+
+        def rebound_names
+          written = Set.new
+          rebound = Set.new
+          Source::NodeWalker.each(@root) do |node|
+            case node
+            when *WRITE_NODES
+              name = write_name(node)
+              rebound << name unless written.add?(name)
+            when *REBIND_NODES then rebound << write_name(node)
+            when Prism::CallNode then rebound << call_name(node) if REBIND_CALLS.include?(node.name)
+            end
+          end
+          rebound
+        end
+
+        def write_name(node) = node.respond_to?(:target) ? node.target.name : node.name
+
+        def call_name(node)
+          argument = node.arguments&.arguments&.first
+          return argument.unescaped.to_sym if argument.is_a?(Prism::SymbolNode) || argument.is_a?(Prism::StringNode)
+
+          ANY_NAME
+        end
+      end
+    end
+  end
+end