rigortype 0.4.6 → 0.4.7

data/lib/rigor/inference/global_writer_reach.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../analysis/dependency_recorder"
+require_relative "../source/node_children"
+require_relative "../type"
+require_relative "guard_rebinding"
+require_relative "project_method_ownership"
+
+module Rigor
+  module Inference
+    # Issue #2314 — whether running a node may reach a project method that writes a given global. Both places that
+    # end a global's binding at a call ask it: the statement walk past a statement call
+    # (`StatementEvaluator#forget_reached_globals`), and a `case` whose global subject a `when` test may rebind
+    # (`StatementEvaluator#when_test_rebinds_subject?`, issue #2211), so the two read a global alike.
+    #
+    # The writers come from {GlobalWriteCensus}: a `[:global_writer, name, method]` entry for each write of `name`
+    # inside a method body (`method` is the `def`'s name, or the literal name a `define_method` block defines), and
+    # `[:global_writer, name, nil]` for one inside a lambda or a block a call keeps to run later
+    # ({StoredBlockCall}), which any call may run. A write at the top level or in a class body runs where it is
+    # written, so no call reaches it.
+    #
+    # {.may_write?} answers true when the global has a writer and:
+    #
+    # - the node may run code other than Ruby core and the standard library ({GuardRebinding.may_rebind?}, the
+    #   question #2260 asked of a `when` test), and
+    # - some writer is anonymous, or the node's own call has a receiver no target resolves (a `Dynamic` value), or a
+    #   search by method name reaches a writer ({Search}).
+    #
+    # The search reads method names, not receivers: from the node it follows every call, by name, into every project
+    # `def` of that name on any class, transitively, and reaches a writer when it meets a call named after one. A
+    # call naming its method by a computed value (`send(name)`, `eval(code)`) reaches. A name no project `def` defines
+    # follows `method_missing`, `new` follows `initialize`, and an alias name (`alias`, `alias_method`, a
+    # `def_delegator` alias) follows the name it stands for. A nested `def` is not read, since defining a method runs
+    # nothing. Past {Search::DEF_BUDGET} bodies the search answers that it reaches. A `define_method` method that calls
+    # a writer is not followed (only its own writes count), and a method core code calls back without the program
+    # spelling it (`puts obj` runs `obj.to_s`) is read as the core method alone, as {GuardRebinding} reads it.
+    module GlobalWriterReach
+      EMPTY = Set.new.freeze
+
+      module_function
+
+      # The globals `scope` binds that some project method may write, other than one already `Dynamic[top]`. Each
+      # bound global's census key is recorded whatever the answer, so a file that starts writing one re-checks.
+      def candidates(scope)
+        table = writer_table(scope)
+        globals = scope.globals
+        globals.each_key { |name| record_writers(name) } if Analysis::DependencyRecorder.active?
+        return EMPTY if table.empty? || globals.empty?
+
+        table.each_key.select do |name|
+          type = globals[name]
+          !type.nil? && !type.is_a?(Type::Dynamic)
+        end
+      end
+
+      # True when running `node`, typed in `scope`, may reach a project method that writes `name` (see the module
+      # comment).
+      def may_write?(node, name, scope)
+        writers = writers(scope, name)
+        return false if writers.empty?
+        return false unless GuardRebinding.may_rebind?(node, scope)
+        return true if writers.include?(nil) || unresolved_call?(node, scope)
+
+        Search.new(scope, writers).reaches?(node)
+      end
+
+      # The method names that write `name` (nil for an anonymous writer). Records the census key, so a file that
+      # starts or stops writing the global re-checks the reader. A guard on the `case` site: every `when` test built so
+      # far also records the key through a statement call's {.candidates} or a callee's method edge.
+      def writers(scope, name)
+        record_writers(name) if Analysis::DependencyRecorder.active?
+        writer_table(scope)[name] || EMPTY
+      end
+
+      def record_writers(name)
+        Analysis::DependencyRecorder.read_name(:global_census, "global_writer:#{name}")
+      end
+
+      # `{ global => Set[method name or nil] }` over the project's census and the `pre_eval:` files' own.
+      def writer_table(scope) = census_tables(scope).first
+
+      # `{ alias name => Set[the method names it stands for] }`: an `alias`, an `alias_method` or a `def_delegator`
+      # with a literal alias name, from the same census.
+      def alias_table(scope) = census_tables(scope).last
+
+      # The two tables above, kept for the census objects they were built from.
+      def census_tables(scope)
+        census = scope.discovered_global_write_census
+        pre_eval = scope.environment&.project_patched_methods&.write_census
+        cached = @census_tables
+        return cached[2] if cached && cached[0].equal?(census) && cached[1].equal?(pre_eval)
+
+        tables = build_tables([census, pre_eval])
+        @census_tables = [census, pre_eval, tables.freeze]
+        tables
+      end
+
+      TABLE_KINDS = { global_writer: 0, method_alias: 1 }.freeze
+      private_constant :TABLE_KINDS
+
+      def build_tables(censuses)
+        tables = [{}, {}]
+        censuses.each do |entries|
+          entries&.each do |kind, key, value|
+            index = TABLE_KINDS[kind]
+            (tables[index][key] ||= Set.new) << value if index
+          end
+        end
+        tables.each { |table| table.each_value(&:freeze).freeze }
+      end
+
+      # True when `node` is a call whose receiver no target resolves: the method it runs may be any.
+      def unresolved_call?(node, scope)
+        return false unless node.is_a?(Prism::CallNode)
+
+        receiver = node.receiver
+        return false if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+        targets = ProjectMethodOwnership.targets(GuardRebinding::ScanScope.dispatch_type(receiver, scope))
+        targets.nil? || targets.empty?
+      rescue StandardError
+        true
+      end
+
+      # `{ method name => [[class name, kind], …] }` over the project's `def` tables, kept for the tables it was
+      # built from.
+      def def_index(scope)
+        instance = scope.discovered_def_nodes
+        singleton = scope.discovered_singleton_def_nodes
+        cached = @def_index
+        return cached[2] if cached && cached[0].equal?(instance) && cached[1].equal?(singleton)
+
+        index = {}
+        { instance: instance, singleton: singleton }.each do |kind, table|
+          table.each do |class_name, methods|
+            methods.each_key { |method_name| (index[method_name] ||= []) << [class_name, kind] }
+          end
+        end
+        @def_index = [instance, singleton, index.freeze]
+        index
+      end
+
+      # A breadth-first search by method name from a node to a writer's name.
+      class Search
+        # The most `def` bodies one search reads before it answers that it reaches.
+        DEF_BUDGET = 64
+        SEND_CALLS = %i[send __send__ public_send method public_method instance_method].to_set.freeze
+        CODE_CALLS = %i[eval instance_eval instance_exec class_eval class_exec module_eval module_exec].to_set.freeze
+
+        class Reached < StandardError
+        end
+
+        def initialize(scope, writers)
+          @scope = scope
+          @writers = writers
+          @aliases = GlobalWriterReach.alias_table(scope)
+          @recording = Analysis::DependencyRecorder.active?
+          @seen = Set.new
+          @queue = []
+          @read = 0
+        end
+
+        def reaches?(node)
+          scan(node)
+          until @queue.empty?
+            name = @queue.shift
+            definitions = definitions_of(name)
+            enqueue(:method_missing) if definitions.empty?
+            definitions.each { |definition| read_def(definition) }
+          end
+          false
+        rescue Reached
+          true
+        end
+
+        private
+
+        def read_def(definition)
+          @read += 1
+          reached! if @read > DEF_BUDGET
+          scan(definition.parameters)
+          scan(definition.body)
+        end
+
+        def definitions_of(name)
+          Analysis::DependencyRecorder.read_name(:defines, name) if Analysis::DependencyRecorder.active?
+          targets = GlobalWriterReach.def_index(@scope)[name] || []
+          targets.filter_map do |class_name, kind|
+            kind == :singleton ? @scope.singleton_def_for(class_name, name) : @scope.user_def_for(class_name, name)
+          end
+        end
+
+        def scan(node)
+          return unless node.is_a?(Prism::Node)
+          # A nested `def` defines a method; it runs nothing here, and its name is followed where it is called.
+          return if node.is_a?(Prism::DefNode)
+
+          case node
+          when Prism::CallNode then scan_call(node)
+          when Prism::BlockArgumentNode then scan_block_argument(node)
+          when Prism::ForNode then enqueue(:each)
+          end
+          implicit_names(node).each { |name| enqueue(name) }
+          node.rigor_each_child { |child| scan(child) }
+        end
+
+        def scan_call(node)
+          enqueue(node.name)
+          # `new` runs the class's `initialize`.
+          enqueue(:initialize) if node.name == :new
+          arguments = node.arguments&.arguments || []
+          if SEND_CALLS.include?(node.name)
+            name = literal_name(arguments.first)
+            name ? enqueue(name) : reached!
+          elsif CODE_CALLS.include?(node.name) && !(arguments.empty? && node.block.is_a?(Prism::BlockNode))
+            reached!
+          end
+        end
+
+        def scan_block_argument(node)
+          name = literal_name(node.expression)
+          enqueue(name) if name
+        end
+
+        # The methods an operator or compound write calls without spelling them.
+        def implicit_names(node)
+          names = []
+          names << node.binary_operator if node.respond_to?(:binary_operator)
+          names.push(node.read_name, node.write_name) if node.respond_to?(:read_name) && node.respond_to?(:write_name)
+          names
+        end
+
+        def enqueue(name)
+          return if name.nil? || @seen.include?(name)
+
+          reached! if @writers.include?(name)
+          @seen << name
+          @queue << name
+          # An alias runs the method it names.
+          Analysis::DependencyRecorder.read_name(:global_census, "method_alias:#{name}") if @recording
+          @aliases[name]&.each { |original| enqueue(original) }
+        end
+
+        def literal_name(node)
+          return unless node.is_a?(Prism::SymbolNode) || node.is_a?(Prism::StringNode)
+
+          text = node.unescaped
+          text.to_sym if text.valid_encoding?
+        end
+
+        def reached!
+          raise Reached
+        end
+      end
+      private_constant :Search
+    end
+  end
+end

data/lib/rigor/inference/hkt_body.rb

@@ -41,8 +41,7 @@ module Rigor
 
       # Reference to a formal parameter the enclosing `Definition#params` declared. The reducer
       # substitutes this node with the matching positional arg from the `App` being reduced; an
-      # unknown name raises during reduction (the parser, when it ships, MUST reject unknown names
-      # earlier).
+      # unknown name raises during reduction.
       Param = Data.define(:name) do
         def initialize(name:)
           raise ArgumentError, "name must be a Symbol, got #{name.class}" unless name.is_a?(Symbol)

data/lib/rigor/inference/hkt_body_parser.rb

@@ -43,7 +43,7 @@ module Rigor
     # `Rigor::Type::*` carrier: `nil` / `true` / `false` produce `Constant` carriers; `bool`
     # produces the `Constant<true> | Constant<false>` union; `untyped` produces
     # `Combinator.untyped` (i.e. `Dynamic[Top]`). Nominal class names produce raw `Type::Nominal`
-    # carriers (no `name_scope` resolution at this slice — the reducer trusts the name verbatim).
+    # carriers (no `name_scope` resolution; the reducer trusts the name verbatim).
     module HktBodyParser
       class ParseError < StandardError; end
 
@@ -151,10 +151,8 @@ module Rigor
         #     test        := type_expr ("<:" | "==") type_expr
         #
         # Parens delimit a conditional unambiguously — bare `(type_expr)` grouping is not
-        # supported at this slice (no use case yet). Branches can be unions; test sides are
-        # single arms (wrap in `App[my_union, ...]` if you need a union there). `in [opt1, opt2]`
-        # membership tests are programmatically supported via `HktBody::TestMembership` but the
-        # parser does not yet recognise the `in` keyword (no concrete demand yet).
+        # supported (no use case yet). Branches can be unions; test sides are single arms (wrap
+        # in `App[my_union, ...]` if you need a union there).
         def parse_conditional
           expect!(:lparen)
           test = parse_test

data/lib/rigor/inference/hkt_reducer.rb

@@ -152,8 +152,8 @@ module Rigor
       def subtype_verdict(left, right)
         return :yes if left == right
 
-        # Both Nominals with different class names AND neither carries Dynamic — `:no`
-        # (statically disjoint). For any other shape pair, `:maybe`.
+        # Two Nominals of different class names are statically disjoint (`:no`); any other shape
+        # pair is `:maybe`.
         return :no if disjoint_nominals?(left, right)
         return :no if disjoint_constants?(left, right)
 

data/lib/rigor/inference/hkt_registry.rb

@@ -9,11 +9,9 @@ module Rigor
     # annotations in shipped `.rbs` files.
     #
     # The registry stores registration metadata (arity, variance, bound) and the definition body
-    # as both a raw String and an evaluable `HktBody` node tree. `HktReducer` (Slice 2a) and
-    # `HktBodyParser` (Slice 2b) are both shipped and reduce `Type::App` instances against the
-    # definition. The carrier never needs to read from the registry because Slice 1's `Type::App`
-    # carries its `bound` directly; the registry exists at this slice solely so the parser
-    # round-trip and downstream slices have a stable target API.
+    # as both a raw String and an evaluable `HktBody` node tree. `HktReducer` and `HktBodyParser`
+    # reduce `Type::App` instances against the definition. The carrier never needs to read from the
+    # registry because `Type::App` carries its `bound` directly.
     #
     # The registry is immutable after construction. Callers that need to extend it (e.g. plugin
     # registrations layered on top of stdlib registrations) MUST build a new registry via `merge`

data/lib/rigor/inference/indexed_narrowing.rb

@@ -9,8 +9,7 @@ require_relative "unknown_store_widening"
 module Rigor
   module Inference
     # Closes the "`params[:f] ||= []; params[:f] << x`" precision gap surfaced by the Redmine
-    # 6.1.2 `Query#as_params` survey (ROADMAP § Future cycles / Type-language / engine —
-    # "Indexed-collection narrowing through `Hash[k] ||= default`").
+    # 6.1.2 `Query#as_params` survey.
     #
     # After `receiver[key] ||= default` the next read at `receiver[key]` is known non-nil, but
     # Rigor types each `Hash#[]` independently and the subsequent `<<` / `[]=` / other mutator
@@ -206,11 +205,9 @@ module Rigor
         args&.size == 1 ? stable_address(node.receiver, args.first) : nil
       end
 
-      # Companion invalidator for single-hop method-chain narrowings (ROADMAP § Future cycles —
-      # "Method-call receiver narrowing across stable receivers", B2 from the slice's design
-      # notes). Drops every `(receiver, *)` chain narrowing rooted at the call's OUTER stable
-      # receiver — matching the ROADMAP's "any intervening method call against the same
-      # receiver" criterion. A call against `x.last` (the OUTER receiver is a `CallNode`, not a
+      # Companion invalidator for single-hop method-chain narrowings. Drops every `(receiver, *)`
+      # chain narrowing rooted at the call's OUTER stable receiver, for any intervening method call
+      # against the same receiver. A call against `x.last` (the OUTER receiver is a `CallNode`, not a
       # stable root) does NOT drop narrowings keyed on `x`, so the worked-site `x.last << y`
       # pattern correctly preserves the chain narrowing for any further `x.last` read in the same
       # body. Always-safe (only forgets; never invents).

data/lib/rigor/inference/intervening_ivar_reset.rb

@@ -19,8 +19,8 @@ module Rigor
     # the calls in a condition operand, where a narrowing an earlier operand or clause made would otherwise survive
     # them: `if @x.nil? && reset!` read `@x` as `nil` in the body although `reset!` assigns it.
     module InterveningIvarReset
-      # Nodes whose body does not run where it is written, or runs on another `self`: a `def`, and a class or
-      # module body, where `@x` is the class's own instance variable.
+      # Nodes whose body does not run where it is written, or runs on another `self`: a `def`, and a class,
+      # module or `class << …` body, where `@x` is the class's own instance variable.
       NON_RUNNING_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
       # Issue #1402 — the nodes that run code the program does not show on `self`'s behalf: `yield` runs the
       # method's block, and `super` the superclass's method on `self`.
@@ -180,12 +180,17 @@ module Rigor
       # takes the mark when widened, so a `nil` only the seed brings back is not fuel for
       # `call.possible-nil-receiver` (ADR-58), as a declared one is not. A narrowing that kept `nil`
       # (`return if @tag`, `@tag.nil?`) widens unmarked, so a read the program really makes on `nil` still reports.
-      def widen(scope, mark: false)
+      # Issue #2039 — `mark: :unproven` marks as `mark: true` does only when the block answers nil (no write set is
+      # proven) and `direct_writes` (called at most once, answering a `Set`) does not name the variable: a call
+      # proven to write it, or whose callee visibly assigns it a possibly-nil value ({DirectIvarWrites}), widens it
+      # unmarked.
+      def widen(scope, mark: false, direct_writes: nil)
         seed = class_ivar_seed(scope)
         return scope if seed.nil? || seed.empty?
 
         computed = false
         writes = nil
+        direct = lazy_set(direct_writes)
         seed.reduce(scope) do |widened, (name, seed_type)|
           local_type = scope.ivar(name)
           next widened if local_type.nil? || local_type == seed_type
@@ -198,11 +203,28 @@ module Rigor
 
           joined = Type::Combinator.union(local_type, seed_type)
           widened = widened.with_ivar(name, joined)
-          marked = (mark && nil_free?(local_type)) || scope.declaration_sourced?(:ivar, name)
+          marked = widen_marks?(mark, writes, direct, name, local_type) || scope.declaration_sourced?(:ivar, name)
           marked ? widened.seed_declaration_sourced_ivar(name, joined) : widened
         end
       end
 
+      # Whether {.widen} stamps the declaration mark on `name`'s binding, narrowed to `local_type`: one whose
+      # narrowing ruled `nil` out, under `mark: true`, or under `mark: :unproven` when no write set is proven
+      # (`writes` nil) and the callee does not visibly write it (`direct`).
+      def widen_marks?(mark, writes, direct, name, local_type)
+        return false unless mark && nil_free?(local_type)
+
+        mark != :unproven || (writes.nil? && !direct.call.include?(name))
+      end
+      private_class_method :widen_marks?
+
+      # A callable answering `callable`'s `Set`, computed on the first call; an empty one when `callable` is nil.
+      def lazy_set(callable)
+        value = nil
+        -> { value ||= callable ? callable.call : Set.new }
+      end
+      private_class_method :lazy_set
+
       # Issue #1963 — `scope` past the calls `node`, a condition operand, makes: {.widen} over the names every
       # candidate call in it may write, or every name when one of them is not proven. A call's literal block may run,
       # so its calls count; a `def`, a class or module body and (unless `run_lambdas`) a lambda literal run nothing

data/lib/rigor/inference/ivar_writer_census.rb

@@ -22,6 +22,11 @@ module Rigor
     # - `[:own_write, class_name, name]` — an `@x` write inside an instance body of the class.
     #   {ScopeIndexer#merge_constant_literal_tables} appends the file's path, so a reader can tell whether a second
     #   file writes the same ivar of the same class.
+    # - `[:own_write_type, class_name, name, value]` — issues #2079 / #2170: the same write with its coarse value, a
+    #   literal's as `[:lit, value]` and anything else as {DYNAMIC}, and a class-body `attr_writer` /
+    #   `attr_accessor` of the name as {DYNAMIC}. The path is appended as for `:own_write`. The class-ivar census
+    #   of a file joins another file's entries, and those of the modules and superclasses on the class's chain,
+    #   into the ivars it already holds ({ScopeIndexer::IvarContributions}).
     class IvarWriterCensus
       SEND_CALLS = %i[send __send__ public_send].to_set.freeze
       # The methods a `send` reaching which is an open-world writer.
@@ -34,6 +39,10 @@ module Rigor
         attr_writer attr_accessor send public_send __send__
       ].to_set.freeze
       NO_ARGUMENTS = [].freeze
+      # Issue #2079 — the coarse value of a write that is not a literal.
+      DYNAMIC = :dynamic
+      # The writer declarations a class body records as a {DYNAMIC} write of each name it spells.
+      WRITER_DECLARATIONS = %i[attr_writer attr_accessor].to_set.freeze
 
       # The call names any rule here reads, so every other call returns at one Set probe.
       # (`define_method` is in {SINGLETON_CLASS_CALLS}.)
@@ -44,6 +53,7 @@ module Rigor
         @instance_ranges = []
         @owner_names = {}.compare_by_identity
         @own_writes = {}
+        @typed_writes = Set.new
       end
 
       # Fed each node of a pre-order descent. `owner` is the class whose body the node sits in, as its qualified name
@@ -67,6 +77,7 @@ module Rigor
         owner = instance_owner(node)
         return if owner.nil?
 
+        record_typed_write(owner, node.name, coarse_value(node))
         seen = (@own_writes[owner] ||= {})
         return if seen[node.name]
 
@@ -74,9 +85,49 @@ module Rigor
         @census << [:own_write, owner_name(owner), node.name].freeze
       end
 
+      def record_typed_write(owner, name, value)
+        entry = [:own_write_type, owner_name(owner), name, value].freeze
+        @census << entry if @typed_writes.add?(entry)
+      end
+
+      # Issue #2079 — a literal's value as `[:lit, value]`; any other value, an operator write and a multiple
+      # assignment target as {DYNAMIC}.
+      def coarse_value(node)
+        value = node.value if node.respond_to?(:value) && !node.is_a?(Prism::InstanceVariableOperatorWriteNode)
+        case value
+        when Prism::NilNode then [:lit, nil].freeze
+        when Prism::TrueNode then [:lit, true].freeze
+        when Prism::FalseNode then [:lit, false].freeze
+        when Prism::IntegerNode, Prism::FloatNode then [:lit, value.value].freeze
+        when Prism::SymbolNode, Prism::StringNode then literal_text(value)
+        else DYNAMIC
+        end
+      end
+
+      def literal_text(node)
+        text = node.unescaped
+        return DYNAMIC unless text.valid_encoding?
+
+        [:lit, node.is_a?(Prism::SymbolNode) ? text.to_sym : text.dup.freeze].freeze
+      end
+
+      # Issue #2079 — `attr_writer :x` / `attr_accessor :x` in a class body writes `@x` with whatever the caller hands.
+      def record_writer_declaration(node, owner)
+        return unless owner && WRITER_DECLARATIONS.include?(node.name) && self_receiver?(node)
+        # A guard: an instance body's own `attr_writer` call raises (the method is `Module`'s), so only the class
+        # body's declares a writer.
+        return unless instance_owner(node).nil?
+
+        (node.arguments&.arguments || NO_ARGUMENTS).each do |argument|
+          name = literal_name(argument)
+          record_typed_write(owner, :"@#{name}", DYNAMIC) if name
+        end
+      end
+
       def owner_name(owner) = owner.is_a?(Array) ? (@owner_names[owner] ||= owner.join("::")) : owner
 
       def visit_call(node, owner)
+        record_writer_declaration(node, owner)
         remember(node.block.location, owner) if owner && define_method_block?(node)
         if self_receiver?(node) || own_singleton_class_call?(node)
           return if @instance_ranges.empty? || !(own_singleton_class_call?(node) || open_world?(node))

data/lib/rigor/inference/key_presence_guard.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../type"
 require_relative "mutation_widening"
 require_relative "key_presence_guard/scan"
+require_relative "../run_scoped_slots"
 
 module Rigor
   module Inference
@@ -58,7 +59,7 @@ module Rigor
       ).to_set.freeze
 
       STATE_KEY = :__rigor_key_presence_guard
-      CACHE_KEY = :__rigor_key_presence_guard_rewalk
+      CACHE_KEY = RunScopedSlots.register(:__rigor_key_presence_guard_rewalk)
       private_constant :STATE_KEY, :CACHE_KEY
 
       # The re-walk's state: the file's root, the end offset of each recorded guard, and the per-file scans.

data/lib/rigor/inference/loop_value_record.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../run_scoped_slots"
+
 module Rigor
   module Inference
     # The value the statement evaluator last gave a loop node, and the scope it evaluated the loop from, so
@@ -13,15 +15,17 @@ module Rigor
     # evaluation would. It is not compared with `Scope#==`, which ignores several fields (`match_frame`,
     # `declared_refinements`, `struct_fold_safe_locals`, the opaque-block flags, `lexical_nesting`, the origins tables,
     # `discovery`): across the cost spec's 10933 reads every match was an identity match, and `lib/` read no record at
-    # all (issue #2262). It lives in a per-thread map whose keys are held weakly, so a record goes when its parse tree
-    # does.
+    # all (issue #2262). It lives in a per-thread map keyed by the loop node. The map's keys are weak but its values
+    # are strong, and a recorded scope reaches its discovery, its environment and the parse tree that holds the key,
+    # so a record never goes on its own (issue #2412): the map is a run-scoped slot ({RunScopedSlots}), emptied when
+    # the run that filled it ends.
     module LoopValueRecord
-      KEY = :rigor_loop_value_record
+      KEY = RunScopedSlots.register(:rigor_loop_value_record)
       private_constant :KEY
 
       module_function
 
-      COUNT_KEY = :rigor_loop_value_count
+      COUNT_KEY = RunScopedSlots.register(:rigor_loop_value_count)
       private_constant :COUNT_KEY
 
       def record(node, scope, type)

data/lib/rigor/inference/match_rebinding/frame.rb

@@ -15,6 +15,12 @@ module Rigor
       # `$_` (issue #1359), whose frame-wide answers ({#last_line_closure?}, {#last_line_fallback?}) are kept here
       # too, asked only while `$_` is narrowed.
       class Frame
+        # The body the frame runs, which issue #2555's escape scan reads ({ConstructionEscape.escaped?}).
+        attr_reader :body
+        # The method's parameters (nil for a class, module or file body), which issue #2608's holder scan reads for a
+        # zero-argument `super` ({RemoverHolderScan}).
+        attr_reader :parameters
+
         # The nodes that bind a local in a body: the writes, and a block's, lambda's, `rescue`'s or pattern's own
         # parameters and targets.
         LOCAL_BINDINGS = Set[
@@ -37,6 +43,8 @@ module Rigor
           @scans = nil
           @last_line_closure = nil
           @last_line_fallback = nil
+          @body_locals = nil
+          @parameter_names = nil
         end
 
         def matching_closure?(scope = nil)
@@ -88,6 +96,17 @@ module Rigor
           @forwarded_block == name
         end
 
+        # Issue #2354 — whether `name` is a local of the frame's own body: the body binds it (a write, or a block's,
+        # lambda's, `rescue`'s or pattern's own parameter or target) and no parameter of the method names it. A
+        # method parameter is the caller's object wherever the body also writes the name (`h = h.dup if f`, a
+        # later `h = {}`), so it never counts. Kept per name for the rest of the body.
+        def body_local?(name)
+          bound = (@body_locals ||= {})
+          return bound[name] if bound.key?(name)
+
+          bound[name] = !parameter_names.include?(name) && binds_local?(@body, name)
+        end
+
         # Issue #1157 — whether a call's `&expr` block argument hands on the block THIS method was called with: the
         # anonymous `&` of a method that declares an anonymous `&` parameter, or {#forwarded_block?} for `&name`.
         # Anything else (`&:sym`, a proc made here, a rebound name) is a block of this frame's own making.
@@ -144,6 +163,33 @@ module Rigor
           !block.nil? && block.name.nil?
         end
 
+        # The names the method's own parameters bind: positional (destructured ones included), optional, rest,
+        # keyword, keyword-rest and block. Empty for a class, module or file body.
+        def parameter_names
+          @parameter_names ||= begin
+            parameters = @parameters
+            names = Set.new
+            if parameters.is_a?(Prism::ParametersNode)
+              [*parameters.requireds, *parameters.optionals, parameters.rest, *parameters.posts,
+               *parameters.keywords, parameters.keyword_rest, parameters.block].each do |parameter|
+                collect_parameter_names(parameter, names)
+              end
+            end
+            names.freeze
+          end
+        end
+
+        def collect_parameter_names(node, names)
+          case node
+          when Prism::MultiTargetNode
+            [*node.lefts, node.rest, *node.rights].each { |target| collect_parameter_names(target, names) }
+          when Prism::SplatNode then collect_parameter_names(node.expression, names)
+          else
+            name = node.respond_to?(:name) ? node.name : nil
+            names << name if name
+          end
+        end
+
         # The method's own `&block` parameter's name, or nil.
         def block_parameter_name
           parameters = @parameters

data/lib/rigor/inference/match_rebinding/yielding_match.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Inference
+    module MatchRebinding
+      # Issue #2443 — the match globals a block enters with when the call that owns it matches before every yield.
+      # `String#scan`, `#gsub`, `#gsub!`, `#sub` and `#sub!` set the caller's `$~` to the current match before each
+      # run of their block, with a Regexp pattern or a String one, so the block reads that match on every run
+      # whatever the enclosing frame held; the frame-wide entry ({MatchRebinding.block_entry}) would otherwise leave
+      # it the narrowing at the call site (issue #1371) or nothing at all, and `Regexp.last_match.begin(0)` in the
+      # block read `MatchData?`.
+      #
+      # A receiver that is a String, or a `Dynamic` the analyzer cannot type ({Narrowing.string_match_receiver?}),
+      # enters with the call's own match edge ({Narrowing.yielded_match_scope}). A `Dynamic` receiver may be another
+      # object whose block-taking `scan` runs no match, and then the block reads the caller's `$~`; narrowing it
+      # anyway can only drop a diagnostic, never add one (ADR-5). A receiver known to be anything else — a project
+      # class, `Pathname`, a union with either — keeps the frame-wide entry: a method defined in Ruby runs its
+      # matches in a frame of its own, so its block reads the caller's `$~` as the frame rules leave it. So does an
+      # implicit-self call.
+      module YieldingMatch
+        NAMES = Set[:scan, :gsub, :gsub!, :sub, :sub!].freeze
+        private_constant :NAMES
+
+        module_function
+
+        # `scope` with the match globals `call_node`'s block enters with; `scope` itself for any other block.
+        # `operand_scope` types the receiver.
+        def entry(scope, block_node, call_node, operand_scope)
+          return scope unless yielding_call?(block_node, call_node) &&
+                              Narrowing.string_match_receiver?(operand_scope.type_of(call_node.receiver), operand_scope)
+
+          Narrowing.yielded_match_scope(scope)
+        end
+
+        def yielding_call?(block_node, call_node)
+          call_node.is_a?(Prism::CallNode) && NAMES.include?(call_node.name) && !call_node.receiver.nil? &&
+            block_node.is_a?(Prism::BlockNode) && call_node.block.equal?(block_node)
+        end
+        private_class_method :yielding_call?
+      end
+    end
+  end
+end