rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/remover_holder_scan.rb

@@ -0,0 +1,287 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../typing_state"
+require_relative "../source/node_children"
+require_relative "closure_escape_analyzer"
+require_relative "construction_escape"
+require_relative "../memo_audit"
+
+module Rigor
+  module Inference
+    # Issue #2608, review rounds 1 and 2 of #2621 — which locals of a body another holder may write, so a remover on
+    # them is not narrowed ({RemoverNarrowing}): a narrowing is a fact about the object, and a write through any other
+    # holder after the call would outlive it. One flow-insensitive scan per frame body; a local is a holder's when:
+    #
+    # - a closure that may run later references it: a lambda, or a block passed to a call that is not a catalogued
+    #   iterator or `tap` / `then` / `yield_self` (`proc { l << 1 }`), created before or after the remover;
+    # - it is read anywhere inside the value of any write (local, instance, class, global or constant variable, an
+    #   index or attribute write, an operator or `||=` / `&&=` write, a multiple assignment) or inside the subject of a
+    #   `case`/`in`, `=>` or `in` pattern: `al = c ? l : []`, `al = l.push(1)`, `@k = l`, `case l; in al`. The local
+    #   such a write or pattern binds is a holder too (both names of a copy), unless the write's value is a fresh
+    #   object: an Array or Hash literal, or `new` / `[]` on a bare or top-level `Array`, `Hash` or `Set`
+    #   (`a = Array.new(n, "a")`);
+    # - a method's parameter, when its body has a zero-argument `super`, which passes every parameter on;
+    # - it is read inside an Array element, a Hash key or value, a splat, or an argument of any call, `yield` or
+    #   `super` (positional, keyword, splat or block-pass), unless the read is the receiver of a call that answers
+    #   a value other than the receiver and keeps no reference to it ({PURE_READERS}: #2555's per-class
+    #   `ConstructionEscape::READERS`, less the conversions that return self on another class): `puts(l.size)`,
+    #   `dump_type(l.dup)` and `dump_type(l.first)` hold nothing, `Keep.new(l)` and `foo(l.push(1))` do;
+    # - it receives a reflective call (`l.send(...)`, `l.instance_eval { }`, `l.tap { }`);
+    # - and every local, when the body calls `binding`, `eval`, `local_variable_get` or `local_variable_set` on any
+    #   receiver (`-> {}.binding`), or a receiverless `instance_variable_set`.
+    #
+    # A receiver position, a `return` and a body's last expression hand nothing on.
+    module RemoverHolderScan
+      REFLECTIVE_CALLS = %i[
+        send public_send __send__ instance_eval instance_exec tap then yield_self itself method
+        define_singleton_method
+      ].to_set.freeze
+      # A conversion one class lists as a reader returns the receiver itself on another (`Array#to_a`, `Hash#to_h`,
+      # `Set#to_set`), so the union of the per-class lists leaves them out.
+      SELF_CONVERSIONS = %i[to_a to_h to_set].freeze
+      PURE_READERS = (ConstructionEscape::READERS.values.reduce(:|) - SELF_CONVERSIONS).freeze
+      IMMEDIATE_BLOCK_CALLS = %i[tap then yield_self].to_set.freeze
+      FRAME_CALLS = %i[binding eval local_variable_get local_variable_set instance_variable_set].to_set.freeze
+      # Frame calls that reach the locals whatever their receiver (`pr.binding`, `Kernel.eval`).
+      ANY_RECEIVER_FRAME_CALLS = %i[binding eval local_variable_get local_variable_set].to_set.freeze
+      NON_WRITER_OPERATORS = %i[== != <= >= ===].to_set.freeze
+      CORE_COLLECTIONS = %i[Array Hash Set].to_set.freeze
+      LOCAL_REFERENCES = [
+        Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode,
+        Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode, Prism::LocalVariableTargetNode
+      ].freeze
+      LOCAL_WRITES = [
+        Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+        Prism::LocalVariableAndWriteNode
+      ].freeze
+      ALL = :all
+      NO_ARGUMENTS = [].freeze
+      # ADR-129 WD1 — a run-scoped Memo, emptied when a run ends so no verdict outlives the body it read: keyed by
+      # body node, and the unsafe names are a pure function of the body and its frame's parameters.
+      UNSAFE_CACHE = TypingState.memo(
+        :remover_narrowing_unsafe,
+        run_scoped: true, audit: "remover narrowing unsafe",
+        reason: "keyed by the body node; the unsafe local names are a pure function of the body"
+      )
+      private_constant :REFLECTIVE_CALLS, :SELF_CONVERSIONS, :PURE_READERS, :IMMEDIATE_BLOCK_CALLS, :FRAME_CALLS,
+                       :ANY_RECEIVER_FRAME_CALLS, :NON_WRITER_OPERATORS, :CORE_COLLECTIONS,
+                       :LOCAL_REFERENCES, :LOCAL_WRITES, :ALL, :NO_ARGUMENTS, :UNSAFE_CACHE
+
+      module_function
+
+      # Whether the local `name` may be written through another holder somewhere in the body `scope` runs. A scope
+      # with no known body answers true.
+      def unsafe_receiver?(scope, name)
+        frame = scope.match_frame
+        body = frame&.body
+        return true if body.nil?
+
+        names = memoised_unsafe_names(body, frame.parameters)
+        names.equal?(ALL) || names.include?(name.to_sym)
+      end
+
+      # {.unsafe_names} of `body`, memoised for the run.
+      def memoised_unsafe_names(body, parameters)
+        return unsafe_names(body, parameters) if MemoAudit.enabled? && MemoAudit.suspended?
+
+        table = TypingState.current.weak_key_map(UNSAFE_CACHE)
+        stored = table[body]
+        if stored.nil?
+          return table[body] = MemoAudit.key_audit("remover narrowing unsafe") { unsafe_names(body, parameters) }
+        end
+
+        MemoAudit.check("remover narrowing unsafe", stored, body) { unsafe_names(body, parameters) }
+      end
+
+      # `names` collects the locals; a collector that answers `site=` ({AliasMutationFloor}) is told, before each name
+      # it is given, the node that hands the local on, or nil when no single node does (a capture by a closure that may
+      # run later, a zero-argument `super`), reads value positions itself when it answers `value_held` ({.precise?}),
+      # and is told when the walk enters (`enter(node, parent)`) and leaves
+      # (`leave(node)`) each node. One that answers `keeps_arguments?` says which calls' plain arguments it counts as
+      # held.
+      def unsafe_names(body, parameters = nil, names = Set.new)
+        sited = names.respond_to?(:site=)
+        catch(ALL) do
+          collect_unsafe(body, false, names, sited:)
+          names.site = nil if sited
+          parameter_names(parameters, names) if forwards_parameters?(body)
+          return names.freeze
+        end
+        ALL
+      end
+
+      def collect_unsafe(node, in_closure, names, sited: false, parent: nil)
+        in_closure ||= node.is_a?(Prism::LambdaNode)
+        if sited
+          names.enter(node, parent)
+          names.site = in_closure ? nil : node
+        end
+        names << node.name if in_closure && LOCAL_REFERENCES.any? { |k| node.is_a?(k) }
+        record_node(node, names)
+
+        node.rigor_each_child do |child|
+          child_in_closure = in_closure || (child.is_a?(Prism::BlockNode) && deferred_block?(node))
+          collect_unsafe(child, child_in_closure, names, sited:, parent: node)
+        end
+        names.leave(node) if sited
+      end
+
+      def record_node(node, names) # rubocop:disable Metrics/CyclomaticComplexity
+        case node
+        when Prism::CallNode then record_call(node, names)
+        when Prism::YieldNode, Prism::SuperNode then node.arguments&.arguments&.each { |a| record_held(a, names) }
+        when Prism::ArrayNode then node.elements.each { |element| record_held(element, names) }
+        when Prism::AssocNode
+          record_held(node.key, names)
+          record_held(node.value, names)
+        when Prism::SplatNode, Prism::BlockArgumentNode then record_held(node.expression, names)
+        when Prism::CaseMatchNode then record_pattern(node.predicate, node.conditions, names)
+        when Prism::MatchRequiredNode, Prism::MatchPredicateNode then record_pattern(node.value, [node.pattern], names)
+        when Prism::MultiWriteNode then record_multi_write(node, names)
+        else record_write(node, names)
+        end
+      end
+
+      def record_call(node, names)
+        throw ALL if frame_call?(node)
+
+        receiver = unparenthesised(node.receiver)
+        names << receiver.name if receiver.is_a?(Prism::LocalVariableReadNode) && REFLECTIVE_CALLS.include?(node.name)
+        arguments = node.arguments&.arguments || NO_ARGUMENTS
+        if writer_call?(node) && !arguments.empty?
+          record_writer_call(arguments, names)
+        elsif keeps_arguments?(node, names)
+          arguments.each { |argument| record_held(argument, names) }
+        end
+      end
+
+      def record_writer_call(arguments, names)
+        *keys, value = arguments
+        keys.each { |key| record_held(key, names) }
+        precise?(names) ? names.value_held(value) : every_read(value, names)
+      end
+
+      def keeps_arguments?(node, names) = !names.respond_to?(:keeps_arguments?) || names.keeps_arguments?(node)
+
+      # A collector that reads a value position itself ({AliasMutationFloor}): `value_held(node)` for a value handed
+      # to another holder (an element, an argument, an index or attribute write's value), `value_written(node)` for a
+      # write node, and `value_bound(value, targets)` for a multiple assignment or a pattern. The default collector
+      # reads every local inside the value instead.
+      def precise?(names) = names.respond_to?(:value_held)
+
+      # A zero-argument `super` passes every parameter of the method on, implicitly. (A `...` forward passes only the
+      # anonymous parameters, which name no local.)
+      def forwards_parameters?(node)
+        return true if node.is_a?(Prism::ForwardingSuperNode)
+
+        node.rigor_each_child { |child| return true if forwards_parameters?(child) }
+        false
+      end
+
+      def parameter_names(node, names)
+        return if node.nil?
+
+        names << node.name if node.class.name.end_with?("ParameterNode") && node.respond_to?(:name) && node.name
+        node.rigor_each_child { |child| parameter_names(child, names) }
+      end
+
+      def frame_call?(node)
+        ANY_RECEIVER_FRAME_CALLS.include?(node.name) || (node.receiver.nil? && FRAME_CALLS.include?(node.name))
+      end
+
+      def unparenthesised(node)
+        node = node.body.body.first while node.is_a?(Prism::ParenthesesNode) && node.body&.body&.size == 1
+        node
+      end
+
+      # An index or attribute write (`h[k] = v`, `o.x = v`, `o&.x = v`): its value is a write's value.
+      def writer_call?(node)
+        name = node.name
+        name.end_with?("=") && !NON_WRITER_OPERATORS.include?(name)
+      end
+
+      # A write's value hands on every local read anywhere inside it, and the local it binds holds what it read.
+      def record_write(node, names)
+        return unless node.class.name.end_with?("WriteNode") && node.respond_to?(:value)
+        return names.value_written(node) if precise?(names)
+        return unless every_read(node.value, names)
+
+        names << node.name if LOCAL_WRITES.any? { |k| node.is_a?(k) } && !fresh_value?(node.value)
+      end
+
+      # `Array`, `Hash` or `Set`, bare or as a top-level path (`::Set`): a project class may define its own `self.[]` or
+      # `self.new` that returns its argument.
+      def core_collection_constant?(node)
+        top_level = node.is_a?(Prism::ConstantReadNode) || (node.is_a?(Prism::ConstantPathNode) && node.parent.nil?)
+        top_level && CORE_COLLECTIONS.include?(node.name)
+      end
+
+      # A value that is a new object whatever it reads, so the local it binds aliases nothing.
+      def fresh_value?(value)
+        case value
+        when Prism::ArrayNode, Prism::HashNode then true
+        when Prism::CallNode then %i[new []].include?(value.name) && core_collection_constant?(value.receiver)
+        else false
+        end
+      end
+
+      def record_multi_write(node, names)
+        return names.value_bound(node.value, [*node.lefts, node.rest, *node.rights]) if precise?(names)
+        return unless every_read(node.value, names)
+
+        local_targets([*node.lefts, node.rest, *node.rights], names)
+      end
+
+      def record_pattern(subject, patterns, names)
+        return names.value_bound(subject, patterns) if precise?(names)
+        return unless every_read(subject, names)
+
+        local_targets(patterns, names)
+      end
+
+      # Adds every local `node` reads, at any depth; answers whether it read any.
+      def every_read(node, names)
+        return false if node.nil?
+
+        found = node.is_a?(Prism::LocalVariableReadNode)
+        names << node.name if found
+        node.rigor_each_child { |child| found = true if every_read(child, names) }
+        found
+      end
+
+      def local_targets(nodes, names)
+        nodes.compact.each do |node|
+          names << node.name if node.is_a?(Prism::LocalVariableTargetNode)
+          local_targets(node.compact_child_nodes, names)
+        end
+      end
+
+      # A held position: every local read inside it but the receiver of a {PURE_READERS} call.
+      def record_held(node, names)
+        return if node.nil?
+        return names.value_held(node) if precise?(names)
+        return if pure_read?(node)
+
+        names << node.name if node.is_a?(Prism::LocalVariableReadNode)
+        node.rigor_each_child { |child| record_held(child, names) }
+      end
+
+      # A {PURE_READERS} call on a local hands the local on to nothing. Its own arguments are held positions of the
+      # call itself, which the body walk records when it reaches that call.
+      def pure_read?(node)
+        node.is_a?(Prism::CallNode) && PURE_READERS.include?(node.name) &&
+          node.receiver.is_a?(Prism::LocalVariableReadNode)
+      end
+
+      # A block that may run after its call returns: any but a catalogued iterator's, or `tap` / `then` /
+      # `yield_self`'s.
+      def deferred_block?(call_node)
+        return true unless call_node.is_a?(Prism::CallNode)
+
+        !(ClosureEscapeAnalyzer.iterator_name?(call_node.name) || IMMEDIATE_BLOCK_CALLS.include?(call_node.name))
+      end
+    end
+  end
+end

data/lib/rigor/inference/remover_narrowing.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../type"
+require_relative "remover_holder_scan"
+# `Narrowing` is resolved at call time: requiring it here closes a load cycle through `KeyPresenceGuard`.
+
+module Rigor
+  module Inference
+    # Issue #2608 — a collection remover or filter narrows its receiver's element (or Hash key / value) type by what
+    # Ruby guarantees it removed, where that is provable from the call alone:
+    #
+    # - `Array#compact!` / `Hash#compact!` drop `nil` from the element / value;
+    # - `Array#delete(nil)` / `Set#delete(nil)` / `Set#delete?(nil)` drop `nil` from the element, and `Hash#delete(nil)`
+    #   drops it from the key, given a literal `nil`;
+    # - `reject!` / `delete_if` keep the elements the block answers falsey for, and `select!` / `filter!` / `keep_if`
+    #   the ones it answers truthy for. The block's one expression is read by the engine's own predicate narrowing
+    #   ({Narrowing.predicate_scopes}) with its parameter bound to the element (the Hash `|k, v|` form binds both), and
+    #   the surviving element is that parameter's binding on the matching edge. `&:nil?` reads as `{ |x| x.nil? }`;
+    # - a closed `HashShape` loses the key a literal `delete(:k)` names.
+    #
+    # Everything else (`pop`, `shift`, `slice!`, `subtract`, `delete` of a non-literal, a block whose predicate the
+    # narrowing does not read) answers `nil`: which members remain is not provable, and the caller keeps its reading.
+    #
+    # Only a receiver that is itself a local read narrows, and only when no other holder in its body may write the
+    # object ({RemoverHolderScan}): the narrowing is a fact about the object. A receiver selecting among bindings
+    # (`(f ? a : b).compact!`) mutates one of them, and narrowing every candidate would drop a member from the one the
+    # call never touched. An instance variable never narrows: any method, or any object that holds it, can write it.
+    module RemoverNarrowing
+      NIL_REJECTORS = %i[compact!].to_set.freeze
+      NIL_LITERAL_DELETERS = %i[delete delete?].to_set.freeze
+      FALSEY_KEEPERS = %i[reject! delete_if].to_set.freeze
+      TRUTHY_KEEPERS = %i[select! filter! keep_if].to_set.freeze
+      CANDIDATES = (NIL_REJECTORS | NIL_LITERAL_DELETERS | FALSEY_KEEPERS | TRUTHY_KEEPERS).freeze
+      NARROWING_RECEIVERS = [Prism::LocalVariableReadNode].freeze
+      CARRIERS = %w[Array Hash Set].freeze
+      # Nodes that make a one-expression block's value something other than its predicate, or rebind a parameter.
+      OPAQUE_BLOCK_NODES = [
+        Prism::NextNode, Prism::BreakNode, Prism::ReturnNode, Prism::RedoNode, Prism::RetryNode, Prism::YieldNode,
+        Prism::LocalVariableWriteNode, Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+        Prism::LocalVariableAndWriteNode, Prism::LocalVariableTargetNode
+      ].freeze
+      private_constant :NIL_REJECTORS, :NIL_LITERAL_DELETERS, :FALSEY_KEEPERS, :TRUTHY_KEEPERS, :NARROWING_RECEIVERS,
+                       :CARRIERS, :OPAQUE_BLOCK_NODES
+
+      module_function
+
+      # Whether `call_node` may narrow its receiver at all: a cheap syntactic gate for {.narrow}.
+      def candidate?(call_node)
+        CANDIDATES.include?(call_node.name) && NARROWING_RECEIVERS.any? { |klass| call_node.receiver.is_a?(klass) }
+      end
+
+      # The closed `HashShape` `shape` without the key a literal `delete(:k)` names, or `nil` when the call is no such
+      # delete or the shape is open (an unseen key may be the one deleted, and the opened default reads it back).
+      def narrow_shape(shape, call_node)
+        return nil unless shape.is_a?(Type::HashShape) && shape.closed? && call_node.name == :delete
+
+        key = literal_key(single_argument(call_node))
+        return nil if key.equal?(NO_KEY)
+        return shape unless shape.pairs.key?(key)
+        return nil if shape.read_only_key?(key)
+
+        Type::Combinator.hash_shape_of(
+          shape.pairs.except(key),
+          required_keys: shape.required_keys - [key], optional_keys: shape.optional_keys - [key],
+          read_only_keys: shape.read_only_keys, extra_keys: :closed
+        )
+      end
+
+      # `type` with each Array / Hash / Set member narrowed by what `call_node` removes, member-wise through a union.
+      # `nil` when the call narrows no member (it is no exact remover for the member's class, or its block predicate
+      # says nothing about the element). A member the call answers for without change (`compact!` on `Array[Integer]`)
+      # still counts as answered: the caller then keeps the precise reading rather than a floored one.
+      def narrow(type, call_node, scope)
+        answered = false
+        members = members_of(type).map do |member|
+          narrowed = narrow_member(member, call_node, scope)
+          next member if narrowed.nil?
+
+          answered = true
+          narrowed
+        end
+        answered ? Type::Combinator.union(*members) : nil
+      end
+
+      def members_of(type)
+        type.is_a?(Type::Union) ? type.members : [type]
+      end
+
+      def narrow_member(member, call_node, scope)
+        return nil unless member.is_a?(Type::Nominal) && CARRIERS.include?(member.class_name)
+
+        args = member.type_args
+        case member.class_name
+        when "Hash" then args.size == 2 ? narrow_hash(member, call_node, scope) : nil
+        else args.size == 1 ? narrow_elements(member, call_node, scope) : nil
+        end
+      end
+
+      def narrow_elements(member, call_node, scope)
+        element = member.type_args.first
+        narrowed =
+          case call_node.name
+          when :compact! then Narrowing.narrow_non_nil(element)
+          when :delete, :delete? then nil_argument?(call_node) ? Narrowing.narrow_non_nil(element) : nil
+          else block_narrowed(call_node, scope, [element])&.first
+          end
+        usable?(narrowed) ? Type::Combinator.nominal_of(member.class_name, type_args: [narrowed]) : nil
+      end
+
+      def narrow_hash(member, call_node, scope)
+        key, value = member.type_args
+        narrowed =
+          case call_node.name
+          when :compact! then [key, Narrowing.narrow_non_nil(value)]
+          when :delete then nil_argument?(call_node) ? [Narrowing.narrow_non_nil(key), value] : nil
+          when :delete? then nil
+          else block_narrowed(call_node, scope, [key, value])
+          end
+        narrowed&.all? { |arg| usable?(arg) } ? Type::Combinator.nominal_of("Hash", type_args: narrowed) : nil
+      end
+
+      # A parameter narrowed to `bot` (`select! { |x| x.nil? }` on `Array[Integer]`) says the carrier is empty; that
+      # is left to the caller's reading rather than spelled as `Array[bot]`.
+      def usable?(type)
+        !type.nil? && !type.is_a?(Type::Bot)
+      end
+
+      def nil_argument?(call_node)
+        single_argument(call_node).is_a?(Prism::NilNode)
+      end
+
+      def single_argument(call_node)
+        arguments = call_node.arguments&.arguments
+        arguments&.size == 1 ? arguments.first : nil
+      end
+
+      NO_KEY = Object.new.freeze
+      private_constant :NO_KEY
+
+      def literal_key(node)
+        case node
+        when Prism::SymbolNode then node.unescaped.to_sym
+        else NO_KEY
+        end
+      end
+
+      # The block parameters' types on the edge that keeps an element, or `nil` when the call has no block the
+      # narrowing reads: one expression, no jump or local write, explicit required parameters matching the carrier
+      # (`|x|` for an element, `|k, v|` for a Hash pair), and a predicate that narrows one of them on some edge.
+      def block_narrowed(call_node, scope, types)
+        keep = keep_edge(call_node.name)
+        return nil if keep.nil?
+
+        block = call_node.block
+        return symbol_nil_narrowed(block, keep, types) if block.is_a?(Prism::BlockArgumentNode)
+
+        names = block_parameter_names(block, types.size)
+        predicate = names && block_predicate(block)
+        return nil if predicate.nil?
+
+        predicate_narrowed(predicate, scope, names, types, keep)
+      end
+
+      def keep_edge(method_name)
+        if FALSEY_KEEPERS.include?(method_name) then :falsey
+        elsif TRUTHY_KEEPERS.include?(method_name) then :truthy
+        end
+      end
+
+      def symbol_nil_narrowed(block, keep, types)
+        symbol = block.expression
+        return nil unless types.size == 1 && symbol.is_a?(Prism::SymbolNode) && symbol.unescaped == "nil?"
+
+        [keep == :falsey ? Narrowing.narrow_non_nil(types.first) : Narrowing.narrow_nil(types.first)]
+      end
+
+      def block_parameter_names(block, arity)
+        return nil unless block.is_a?(Prism::BlockNode)
+
+        parameters = block.parameters
+        return nil unless parameters.is_a?(Prism::BlockParametersNode)
+
+        list = parameters.parameters
+        return nil if list.nil? || !simple_parameters?(list) || list.requireds.size != arity
+        return nil unless list.requireds.all?(Prism::RequiredParameterNode)
+
+        list.requireds.map(&:name)
+      end
+
+      def simple_parameters?(list)
+        list.optionals.empty? && list.rest.nil? && list.posts.empty? && list.keywords.empty? &&
+          list.keyword_rest.nil? && list.block.nil?
+      end
+
+      def block_predicate(block)
+        body = block.body
+        return nil unless body.is_a?(Prism::StatementsNode) && body.body.size == 1
+
+        statement = body.body.first
+        opaque?(statement) ? nil : statement
+      end
+
+      def opaque?(node)
+        return true if OPAQUE_BLOCK_NODES.any? { |klass| node.is_a?(klass) }
+
+        node.compact_child_nodes.any? { |child| opaque?(child) }
+      end
+
+      def predicate_narrowed(predicate, scope, names, types, keep)
+        bound = names.zip(types).reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
+        truthy, falsey = Narrowing.predicate_scopes(predicate, bound)
+        read = ->(edge) { names.map { |name| edge.local(name) || bound.local(name) } }
+        entry_types = read.call(bound)
+        truthy_types = read.call(truthy)
+        falsey_types = read.call(falsey)
+        return nil if truthy_types == entry_types && falsey_types == entry_types
+
+        keep == :truthy ? truthy_types : falsey_types
+      end
+    end
+  end
+end

data/lib/rigor/inference/rewrite_mutation.rb

@@ -24,7 +24,8 @@ module Rigor
       # replacement, and the seed it would otherwise keep beside it is gone.
       REPLACED = Ractor.make_shareable({
                                          "Array" => { map!: [0], collect!: [0], flatten!: [0], replace: [0] },
-                                         "Hash" => { transform_keys!: [0], transform_values!: [1], replace: [0, 1] }
+                                         "Hash" => { transform_keys!: [0], transform_values!: [1], replace: [0, 1] },
+                                         "Set" => { map!: [0], collect!: [0], flatten!: [0], replace: [0] }
                                        })
 
       # Mutators that store values nothing describes BESIDE values they may keep: `fill(x, start)` leaves the slots
@@ -66,6 +67,56 @@ module Rigor
         Type::Combinator.nominal_of(carrier.class_name, type_args: args)
       end
 
+      # The element rewriters {.typed} answers for, keyed to the non-bang call whose result is the rewritten
+      # receiver: `a.map!(&:to_i)` holds what `a.map(&:to_i)` returns, and `a.flatten!` what `a.flatten` does.
+      TYPED_COUNTERPARTS = Ractor.make_shareable({ map!: :map, collect!: :collect, flatten!: :flatten })
+
+      # The carrier classes {.typed} rewrites, with the rewriters each takes. `Set#flatten!` is absent: it flattens
+      # only nested Sets, so `ARGV.map { |x| [x] }.to_set.flatten!` still holds `[String]` Arrays, while `Set#flatten`
+      # answers an element its RBS does not narrow.
+      TYPED_CARRIERS = Ractor.make_shareable({ "Array" => %i[map! collect! flatten!], "Set" => %i[map! collect!] })
+
+      # Issue #2427 — `carrier` with its element replaced by `element`, the element of what the non-bang counterpart
+      # ({TYPED_COUNTERPARTS}) answers for the same call: `a = ARGV.dup; a.map!(&:to_i)` reads `Array[Integer]` and
+      # `a.map!(&:strip)` keeps `Array[String]`. It is the typed form of {.arm}'s {REPLACED} answer, and it replaces
+      # the gradual and the precise element alike, since nothing the seed held survives the rewrite.
+      #
+      # Answers for an `Array` / `Set` nominal and an empty-witness refinement of one (keeping the witness only where
+      # {RefinementMutation.preserves_witness?} does: `map!` keeps it, `flatten!` can empty `[[]]`). `nil` for any
+      # other carrier or name, so the caller takes the gradual arm instead.
+      def typed(carrier, method_name, element)
+        return nil unless TYPED_COUNTERPARTS.key?(method_name)
+
+        case carrier
+        when Type::Nominal
+          return nil unless carrier.type_args.size == 1 && TYPED_CARRIERS[carrier.class_name]&.include?(method_name)
+
+          Type::Combinator.nominal_of(carrier.class_name, type_args: [element])
+        when Type::Difference
+          typed_refinement(carrier, method_name, element)
+        end
+      end
+
+      def typed_refinement(difference, method_name, element)
+        base = difference.base
+        return nil unless difference.removes_empty_witness? && base.is_a?(Type::Nominal)
+
+        rewritten = typed(base, method_name, element)
+        return nil if rewritten.nil?
+
+        kept = RefinementMutation.preserves_witness?(base.class_name, method_name)
+        kept ? Type::Combinator.difference(rewritten, difference.removed) : rewritten
+      end
+
+      # The element of `result`, the non-bang counterpart's answer: an `Array[R]` / `Set[R]` nominal, or an
+      # empty-witness refinement of one. `nil` when the answer has no single element to read.
+      def counterpart_element(result)
+        result = result.base if result.is_a?(Type::Difference) && result.removes_empty_witness?
+        return nil unless result.is_a?(Type::Nominal) && %w[Array Set].include?(result.class_name)
+
+        result.type_args.size == 1 ? result.type_args.first : nil
+      end
+
       # {.arm} through a `Union` (member by member) and an empty-witness refinement (its base, keeping the witness
       # only when the mutator cannot empty the receiver — {RefinementMutation.preserves_witness?}). For a carrier
       # the ADR-56 slice-C join rebuilt from its seed, which knows the adders' content but not the rewrite.
@@ -114,7 +165,7 @@ module Rigor
         when Type::Nominal then type.class_name
         end
       end
-      private_class_method :value_carrier_class, :arm_refinement
+      private_class_method :value_carrier_class, :arm_refinement, :typed_refinement
     end
   end
 end

data/lib/rigor/inference/scope_indexer/certainty.rb

@@ -111,7 +111,6 @@ module Rigor
             node.rigor_each_child { |child| certain(child) }
           end
 
-          # Marks every contribution of the subtree.
           def possible(node)
             return unless node.is_a?(Prism::Node)
 

data/lib/rigor/inference/scope_indexer/class_cvars_collector.rb

@@ -6,8 +6,9 @@ module Rigor
   module Inference
     module ScopeIndexer
       # The `class_cvars` discovery table (slice 7 phase 6) as a {DeclarationWalk} collector: every
-      # `@@x = …` a `def` body writes, typed under the census scope and unioned per class. Ruby cvars are
-      # shared by the instance and singleton facets, so every `def` counts, `def self.x` included.
+      # `@@x = …` a `def` body writes, typed under the census scope and unioned per class, joined by what a
+      # `class` / `module` body writes to the same cvar. Ruby cvars are shared by the instance and singleton
+      # facets, so every `def` counts, `def self.x` included.
       class ClassCvarsCollector
         include DeclarationWalk::Collector
 
@@ -15,6 +16,14 @@ module Rigor
           @table = {}
         end
 
+        # Issue #3204 — a `class` / `module` body's own writes, outside its `def`s, under the body's context;
+        # each only joins an entry a `def` body's write creates. An unnameable cref (a header below
+        # `class << expr`) leaves the prefix empty, and the gather skips it.
+        def on_declaration(node, _context, body)
+          ScopeIndexer.collect_body_cvar_writes(node.body, body.prefix, body.scope, @table)
+          DeclarationWalk::DESCEND
+        end
+
         # `@@x` in a `def` resolves through the LEXICAL cref: `Module.nesting` is the same inside a meta-new or
         # eval block, so the context's `prefix` keys the write and its rebound `self` never does —
         # `K = Class.new { def m = @@x }` inside `class C` writes `C::@@x`. The walk goes no further in: the
@@ -25,10 +34,8 @@ module Rigor
           DeclarationWalk::DECLINE
         end
 
-        # The table as the discovery index holds it: each class's entry frozen, then the whole.
-        def table
-          @table.transform_values(&:freeze).freeze
-        end
+        # The table as the discovery index holds it ({ScopeIndexer#finished_cvar_census}).
+        def table = ScopeIndexer.finished_cvar_census(@table)
       end
     end
   end