rigortype 0.4.7 → 0.4.8

data/lib/rigor/inference/mutation_widening.rb

@@ -226,6 +226,8 @@ module Rigor
       # arguments nothing will read.
       # A precise `Hash` counts too when its binding carries the `:synthesised` construction fact (issue #2555): the
       # re-join grows it from these arguments.
+      # An intersection counts when a member does: `non-empty-lowercase-string`'s witness half reads `tr!`'s
+      # replacement ({#widen_string_intersection}).
       def shape_carrier?(type, synthesised: false)
         case type
         when Type::Tuple, Type::HashShape then true
@@ -237,7 +239,7 @@ module Rigor
           MutationRejoin.regrowable_carrier?(type) || MutationRejoin.precise_array?(type) ||
             SetMutation.regrowable?(type) || (synthesised && MutationRejoin.synthesised_carrier?(type))
         when Type::Difference then type.removes_empty_witness?
-        when Type::Union then type.members.any? { |m| shape_carrier?(m, synthesised:) }
+        when Type::Union, Type::Intersection then type.members.any? { |m| shape_carrier?(m, synthesised:) }
         else false
         end
       end
@@ -304,6 +306,10 @@ module Rigor
         receiver = call_node.receiver
         return scope if receiver.nil?
 
+        # Issue #2335 — a block parameter, an element read or any other receiver that may be an outer local's object.
+        if AliasMutationFloor.candidate?(call_node)
+          scope = AliasMutationFloor.floor_after_call(call_node, scope) { captured_element_root(receiver) }
+        end
         widened = widen_outer_element_read(call_node, scope)
         return widened if widened
 
@@ -321,6 +327,14 @@ module Rigor
         end
       end
 
+      # The outer root of an element read in a block body, whose element {#widen_outer_element_read} widens. (A captured
+      # local the receiver names takes the capture path's widening and the block content join after it, which a floor
+      # here would not change.)
+      def captured_element_root(receiver)
+        root = ElementReadWidening.element_read_path(receiver)&.first
+        root && !ReceiverAlias.block_local?(root) ? [root.name] : nil
+      end
+
       # Issue #2287 — a mutator on an element read rooted at a captured local (`[0].each { |i| a[i] << 2 }`,
       # `loop { a[0] << 2; break }`) mutates an element the outer binding still carries, and names no variable
       # {ReceiverAlias.candidates} could widen. The element at that path widens in the outer scope as the
@@ -431,8 +445,7 @@ module Rigor
           join_added_pairs(widen_hash_shape(type, values: values), method_name, arg_types,
                            ContentJoin.hash_shape_key_values(type))
         when Type::Constant then StringMutation.widen_constant(type, method_name)
-        when Type::Difference
-          widen_difference(type, method_name, arg_types: arg_types)
+        when Type::Difference, Type::Refined, Type::Intersection then widen_refinement(type, method_name, arg_types)
         when Type::Union
           widen_union(type, method_name, values:, arg_types:, unread_arguments:, rewritten_element:, synthesised:)
         end
@@ -477,7 +490,8 @@ module Rigor
         (ARRAY_MUTATORS.include?(method_name) && ContentJoin.array_residue(member).empty?) ||
           ((HASH_MUTATORS.include?(method_name) || HashLookupMutation::MUTATORS.include?(method_name)) &&
             ContentJoin.hash_residue(member).empty?) ||
-          (StringMutation::MUTATORS.include?(method_name) && StringMutation.constant?(member)) ||
+          (StringMutation::MUTATORS.include?(method_name) &&
+            (StringMutation.constant?(member) || StringMutation.refined?(member))) ||
           (SetMutation::MUTATORS.include?(method_name) && SetMutation.carrier?(member))
       end
 
@@ -660,6 +674,32 @@ module Rigor
         end
       end
 
+      # An intersection of String refinements carrying a predicate one (`non-empty-lowercase-string`) widens member
+      # by member: the `Refined` member to `String` ({StringMutation.widen_refined}), a `non-empty-string` member on
+      # {#widen_difference}'s witness terms. A member that widened to the bare `String` is implied by the others and
+      # drops out, so `s.upcase!` reads `non-empty-string` rather than `non-empty-string & String`. `nil` when the
+      # intersection carries no String predicate refinement, or nothing widened.
+      def widen_string_intersection(intersection, method_name, arg_types)
+        return nil unless intersection.members.any? { |m| StringMutation.refined?(m) }
+
+        members = intersection.members.map { |m| widen_refinement(m, method_name, arg_types) || m }
+        base = Type::Combinator.nominal_of("String")
+        kept = members.reject { |m| m == base }
+        widened = kept.empty? ? base : Type::Combinator.intersection(*kept)
+        widened == intersection ? nil : widened
+      end
+
+      # The refinement carriers {#widen_carrier} hands on: the empty witness ({#widen_difference}), a String predicate
+      # ({StringMutation.widen_refined}) and an intersection of them ({#widen_string_intersection}). `nil` when nothing
+      # widened.
+      def widen_refinement(type, method_name, arg_types)
+        case type
+        when Type::Difference then widen_difference(type, method_name, arg_types:)
+        when Type::Refined then StringMutation.widen_refined(type, method_name)
+        when Type::Intersection then widen_string_intersection(type, method_name, arg_types)
+        end
+      end
+
       # `Tuple[A, B, C]` → `Nominal[Array, [union(A, B, C)]]`; under `values: :widen`, each element's
       # VALUE pinning widens to its class nominal (`1 | 2` → `Integer`): a slot-rewriting mutator
       # falsifies values along with the shape — `t = [1, 2]; t[0] += 5` holds `6` at slot 0, so a

data/lib/rigor/inference/narrowing.rb

@@ -13,6 +13,7 @@ require_relative "guard_rebinding"
 require_relative "intervening_ivar_reset"
 require_relative "key_presence_guard"
 require_relative "last_line"
+require_relative "match_rebinding"
 require_relative "operand_effects"
 require_relative "optimistic_origin"
 require_relative "project_method_ownership"
@@ -532,7 +533,17 @@ module Rigor
           lexical_class_name(condition, scope) || case_equality_target_class(condition)
         end
         body_scope = record_bot_guard(narrow_guarded_slot(body_scope, slot, truthy_type), slot, truthy_type, classes)
-        [body_scope, narrow_guarded_slot(scope, slot, falsey_type)]
+        marked = unwrap_case_subject(subject).is_a?(Prism::LocalVariableReadNode) && scope.gradual_narrowing?(slot.name)
+        # A marked subject keeps its mark under any `when` (`when "r"` narrows it without writing it); an unmarked one
+        # is stamped only under class conditions.
+        if marked || classes.none?(&:nil?)
+          static = gradual_union_slot?(slot) ? gradual_static_part(slot.current) : nil
+          static &&= case_when_types(scope, static, conditions).first
+          body_scope = mark_gradual_narrowing(body_scope, slot, truthy_type, marked: marked, narrowed_static: static)
+        end
+        falsey_scope = narrow_guarded_slot(scope, slot, falsey_type)
+        falsey_scope = falsey_scope.with_gradual_narrowing_mark(slot.name) if marked
+        [body_scope, falsey_scope]
       end
 
       CASE_SUBJECT_KINDS = %i[local ivar global constant].freeze
@@ -588,12 +599,21 @@ module Rigor
         end
       end
 
-      # When the clause has exactly one `RegularExpressionNode` literal condition, narrow the
-      # match-data globals on the body edge (same rule as `analyse_regex_match_predicate`'s
-      # truthy edge). With multiple regex conditions (`when /a/, /b/`) the body is reachable
-      # through any of them, so only `$~`/`$&` are safely non-nil; numbered groups whose
-      # presence differs per alternative stay `String | nil`. With no regex condition the entry
-      # scope passes through unchanged.
+      # When every condition is a `RegularExpressionNode` literal, the body edge narrows the
+      # match-data globals as `analyse_regex_match_predicate`'s truthy edge does. With multiple
+      # regex conditions (`when /a/, /b/`) the body is reachable through any of them, so only
+      # `$~`/`$&` are safely non-nil; numbered groups whose presence differs per alternative stay
+      # `String | nil`. With no regex condition the entry scope passes through unchanged.
+      #
+      # Issue #1474 — a clause that mixes a regex literal with another condition (`when /(a)/,
+      # "lit"`) is also entered through the other conditions: each regex literal before them ran
+      # its `===` and failed, leaving the globals nil, and a condition before any regex leaves
+      # them as they were. The body scope then joins the match globals of every way in rather
+      # than claiming the regex matched: each condition contributes the scope its own `===`
+      # leaves — a regex literal's truthy edge, the falsey edge of the regex literals that
+      # failed before it, the entry state where none ran, and the unknown-match edges for a
+      # condition that may itself be or run a Regexp ({MatchRebinding::Operands.pattern_value?},
+      # {MatchRebinding.may_match?}).
       def apply_when_regex_globals(conditions, scope)
         regexes = conditions.grep(Prism::RegularExpressionNode)
         return scope if regexes.empty?
@@ -604,22 +624,96 @@ module Rigor
           else
             Set.new
           end
-        truthy, = regex_match_predicate_scopes(scope, unconditional)
-        truthy
+        truthy, falsey = regex_match_predicate_scopes(scope, unconditional)
+        return truthy if regexes.size == conditions.size
+
+        empty_truthy, empty_falsey = regex_match_predicate_scopes(scope, Set.new)
+        failed = scope
+        paths = conditions.map do |condition|
+          kind = when_regex_condition_kind(condition, scope)
+          path, failed = when_regex_condition_scopes(kind, failed, truthy, falsey, empty_truthy, empty_falsey)
+          path
+        end
+        paths.reduce(:join)
+      end
+
+      # How a `when` condition's `===` can touch the match globals, for {#apply_when_regex_globals}:
+      # `:literal` a `RegularExpressionNode`, whose match the clause's shared unconditional groups
+      # describe; `:interpolated` an interpolated regex literal, a definite match whose groups are
+      # unknown; `:may_match` any other condition that may be a Regexp or run one, whose `===`
+      # outcome for the globals is unknown; `:neutral` a condition whose `===` and evaluation run
+      # no match, leaving the globals as the earlier conditions left them.
+      def when_regex_condition_kind(condition, scope)
+        return :literal if condition.is_a?(Prism::RegularExpressionNode)
+        return :interpolated if condition.is_a?(Prism::InterpolatedRegularExpressionNode)
+        if MatchRebinding::Operands.pattern_value?(condition, scope) ||
+           MatchRebinding.may_match?(condition, scope)
+          return :may_match
+        end
+
+        :neutral
+      end
+
+      # `[body_path_scope, failed_scope]` for one `when` condition of a mixed clause, `failed`
+      # being the globals state the conditions before it left. On the path where this condition's
+      # `===` matched the body reads the truthy edge (`:literal`), the ungrouped truthy edge
+      # (`:interpolated`), the join of that edge with `failed` (`:may_match` — it may not have
+      # been a match at all), or `failed` itself (`:neutral`). On the path where it failed the
+      # next conditions read the matching falsey edge, the ungrouped one, the join of it with
+      # `failed`, or `failed`.
+      def when_regex_condition_scopes(kind, failed, truthy, falsey, empty_truthy, empty_falsey)
+        case kind
+        when :literal then [truthy, falsey]
+        when :interpolated then [empty_truthy, empty_falsey]
+        when :may_match then [empty_truthy.join(failed), failed.join(empty_falsey)]
+        else [failed, failed]
+        end
+      end
+
+      # Issue #2443, #1371 — the scope the block of a call that yields only after it has matched in the caller's frame
+      # enters with ({MatchRebinding::YieldingMatch}): the match edge of `pattern`, the call's pattern argument, over
+      # `scope` with the match globals forgotten. `$~` is a `MatchData`, `$&` and the pre- and post-match a `String`,
+      # and so is each numbered group {#yielded_capture_groups} vouches for; every other group is unbound, so it
+      # reads the RBS `String?` whatever an earlier match in the method bound it to.
+      def yielded_match_scope(scope, pattern)
+        regex_match_predicate_scopes(scope, yielded_capture_groups(pattern)).first
       end
 
-      # Issue #2443 — `scope` with what every match binds, laid over the bindings it holds, for the block of a call
-      # that yields only after it has matched in the caller's frame ({MatchRebinding::YieldingMatch}): `$~` a
-      # `MatchData`, and `$&` and the pre- and post-match a `String`. The numbered groups and `$+` keep the bindings
-      # `scope` gives them. Typing them from the call's own pattern needs the group walk
-      # ({#unconditional_capture_groups}) to read every source right, which it does not yet (#2472), and forgetting
-      # them would report a group an earlier match in the method narrowed.
-      def yielded_match_scope(scope)
-        string_t = Type::Combinator.nominal_of("String")
-        scope.with_global(:$~, Type::Combinator.nominal_of("MatchData"))
-             .with_global(:$&, string_t).with_global(:$`, string_t).with_global(:$', string_t)
+      # The pattern sources {#yielded_capture_groups} reads groups from: literal characters, `.`, the anchors, the
+      # quantifiers, `|`, plain and `(?:…)` groups, the class escapes, `\n`, `\r` and `\t`, an escaped punctuation
+      # character, and a bracket class holding only those with no bracket inside it. The group walk
+      # ({#unconditional_capture_groups}) reads these right; it misreads sources outside them (#2472, #1476).
+      PLAIN_PATTERN_ATOM = %r{[A-Za-z0-9 _\-.,:;=<>!@%&~'"`/^$+*?|(){}#]|\\[wWdDsShHnrt]|\\[^A-Za-z0-9\s]}
+      PLAIN_PATTERN_CLASS =
+        %r{\[\^?(?:[A-Za-z0-9 _\-.,:;=<>!@%~'"`/^$+*?|(){}#]|\\[wWdDsShHnrt]|\\[^A-Za-z0-9\s])+\]}
+      PLAIN_PATTERN = /\A(?:#{PLAIN_PATTERN_CLASS}|#{PLAIN_PATTERN_ATOM}|\\[bBAzZG])*\z/
+      OTHER_GROUP_FORM = /\(\?(?!:)/
+      # A quantifier on a quantifier repeats the quantified atom, so `(a)+{0}` and `(a){2}?` may match without the
+      # group. `+?` and `++` are one quantifier.
+      STACKED_QUANTIFIER = /\+[?+]?[*{]|\+[?+][?+]|\}[*+?{]/
+      NO_GROUPS = Set.new.freeze
+      private_constant :PLAIN_PATTERN_ATOM, :PLAIN_PATTERN_CLASS, :PLAIN_PATTERN, :OTHER_GROUP_FORM,
+                       :STACKED_QUANTIFIER, :NO_GROUPS
+
+      # Issue #1371 — the 1-based indices of the groups every match of `pattern` sets, read only from a regex
+      # literal written between slashes, without interpolation or the `x` flag, whose source is a {PLAIN_PATTERN}
+      # with no `(?` form but `(?:` and no {STACKED_QUANTIFIER}. Any other pattern, a String one included, vouches
+      # for no group: declining costs precision, while a misread group would read `String` where Ruby has nil. A
+      # `%r` literal is declined because its source escapes the delimiter, which hides a quantifier from the walk:
+      # `%r,(a){\,1}b,` is `/(a){,1}b/`.
+      def yielded_capture_groups(pattern)
+        return NO_GROUPS unless pattern.is_a?(Prism::RegularExpressionNode) && !pattern.extended?
+        return NO_GROUPS unless pattern.opening == "/"
+
+        plain_pattern_source?(pattern.content) ? unconditional_capture_groups(pattern.content) : NO_GROUPS
       end
 
+      def plain_pattern_source?(source)
+        source.ascii_only? && PLAIN_PATTERN.match?(source) && !OTHER_GROUP_FORM.match?(source) &&
+          !STACKED_QUANTIFIER.match?(source)
+      end
+      private_class_method :yielded_capture_groups, :plain_pattern_source?
+
       # Issue #2443 — true when every member of `type` is a String (a project subclass included) or a `Dynamic` that
       # is untyped or may hold only Strings, Symbols and nil ({#match_member_kind}). A `nil` member never runs the
       # block, so it counts neither way.
@@ -636,7 +730,30 @@ module Rigor
       def analyse(node, scope)
         edges = analyse_shape(node, scope)
         reader = last_line_condition(node)
-        reader ? LastLine.predicate_scopes(reader, scope, edges) : edges
+        edges = LastLine.predicate_scopes(reader, scope, edges) if reader
+        keep_gradual_marks(node, scope, edges)
+      end
+
+      # Issue #2656 — a guard edge narrows a local; it does not write it. So a local a class guard marked as a gradual
+      # narrowing ({Scope#with_gradual_narrowing_mark}) keeps the mark on both edges of every later predicate
+      # (`return if x.nil?`, `x != ""`, a second class guard), which bind the narrowed type through `with_local` and
+      # drop it. A local the predicate itself writes (`if (x = v)`) loses it, as any write does.
+      def keep_gradual_marks(node, scope, edges)
+        return edges if edges.nil? || (edges[0].equal?(scope) && edges[1].equal?(scope))
+
+        names = scope.gradual_narrowing_names
+        return edges if names.empty?
+
+        # Defensive: the statement walk binds a predicate's own write (`if (x = v)`) before its edges are read, so the
+        # mark is already gone there; the exclusion keeps a write that reached here from carrying it.
+        names -= OperandEffects.written_variables(node).map(&:to_sym)
+        return edges if names.empty?
+
+        edges.map do |edge|
+          names.reduce(edge) do |acc, name|
+            acc.gradual_narrowing?(name) || acc.local(name).nil? ? acc : acc.with_gradual_narrowing_mark(name)
+          end
+        end
       end
 
       # The reader call a condition's value is, or nil.
@@ -1815,7 +1932,7 @@ module Rigor
 
         def match_dynamic_kind(member, scope)
           facet = member.static_facet
-          return :dynamic if facet.is_a?(Type::Top)
+          return :dynamic if Type::Combinator.untyped?(member)
 
           facet_kinds = match_member_kinds(facet, scope)
           :dynamic if facet_kinds.all? { |kind| (STRING_MATCH_KINDS + [:nil]).include?(kind) }
@@ -1977,7 +2094,7 @@ module Rigor
 
         # Returns the Set of 1-based numbered-capture indices that are UNCONDITIONAL in
         # `source`: present on every successful match because no optional quantifier (`?`,
-        # `*`, `{0,…}`) applies to the group or any ancestor group, and the pattern contains no
+        # `*`, `{0,…}`, `{,…}`) applies to the group or any ancestor group, and the pattern contains no
         # alternation (`|`). Optional and alternation-reachable groups are excluded — at
         # runtime `$N` is `nil` for them even when the overall match succeeds, so narrowing
         # them to non-nil `String` would be unsound. The walker is intentionally light (char
@@ -2061,13 +2178,15 @@ module Rigor
         end
 
         # True when the group whose closing paren is at `source[pos]` is followed by a
-        # quantifier that permits zero repetitions (`?`, `*`, `{0…}`). `+` and `{1,…}` do NOT
-        # make a group optional. A lazy/possessive suffix (`*?`, `*+`) is still zero-permitting
-        # on the base quantifier.
+        # quantifier that permits zero repetitions (`?`, `*`, `{0…}`, `{,…}`). `+` and `{1,…}`
+        # do NOT make a group optional. A lazy/possessive suffix (`*?`, `*+`) is still
+        # zero-permitting on the base quantifier. `{,…}` counts only with a digit after the
+        # comma — `{,}`, `{,x}` and `{, }` are literal braces, not quantifiers.
         def next_quantifier_optional?(source, pos)
           case source[pos]
           when "?", "*" then true
-          when "{" then source[pos + 1] == "0"
+          when "{" then source[pos + 1] == "0" ||
+            (source[pos + 1] == "," && source[pos + 2].to_s.match?(/\d/))
           else false
           end
         end
@@ -2536,7 +2655,62 @@ module Rigor
           truthy = narrow_class(slot.current, class_name, exact: exact, environment: environment, scope: scope)
           falsey = narrow_not_class(slot.current, class_name, exact: exact, environment: environment, scope: scope)
           truthy_scope = record_bot_guard(narrow_guarded_slot(scope, slot, truthy), slot, truthy, [class_name])
-          [truthy_scope, narrow_guarded_slot(scope, slot, falsey)]
+          static = gradual_union_slot?(slot) ? gradual_static_part(slot.current) : nil
+          static &&= narrow_class(static, class_name, exact: exact, environment: environment, scope: scope)
+          [mark_gradual_narrowing(truthy_scope, slot, truthy, narrowed_static: static),
+           narrow_guarded_slot(scope, slot, falsey)]
+        end
+
+        # Issue #2656 — a class guard's truthy edge over a local that held a `Dynamic` value marks the narrowed binding
+        # ({Scope#with_gradual_narrowing_mark}): the binding keeps the asked class's `Nominal`, which dispatch and the
+        # method rules read, while `call.argument-type-mismatch` judges it as the gradual value it came from, which a
+        # literal-typed parameter (`("r" | "w")`) accepts. Only a local is marked, and only when the edge left it
+        # something other than `Dynamic` or `bot`.
+        def mark_gradual_narrowing(scope, slot, narrowed, marked: false, narrowed_static: nil)
+          return scope unless slot.kind == :local
+
+          mark_gradual_local(scope, slot.name, slot.current, narrowed, marked: marked, narrowed_static: narrowed_static)
+        end
+
+        # {#mark_gradual_narrowing} for the local `name`, which held `current` before the guard and `narrowed` after.
+        # `current` is gradual when it is `Dynamic` or a union with a `Dynamic` member (`h[:m] || "r"`, `c ? h[:m] :
+        # nil`); `marked` says the local already carried the mark, so a `case` or a capture over it keeps it (a
+        # predicate keeps it through {.keep_gradual_marks}).
+        def mark_gradual_local(scope, name, current, narrowed, marked: false, narrowed_static: nil)
+          return scope unless marked || gradual_bearing?(current)
+          return scope if narrowed.nil? || narrowed.is_a?(Type::Dynamic) || narrowed.is_a?(Type::Bot)
+          return scope unless marked || literal_or_empty?(narrowed_static || gradual_static_part(current))
+
+          scope.with_gradual_narrowing_mark(name)
+        end
+        public :mark_gradual_local
+
+        def gradual_bearing?(type)
+          type.is_a?(Type::Dynamic) || (type.is_a?(Type::Union) && type.members.any?(Type::Dynamic))
+        end
+
+        # Issue #2656 — the non-`Dynamic` members of a union `current` (nil for any other type). A union is stamped
+        # only when that part, narrowed by the guard (`narrowed_static`, or the part itself where the caller cannot
+        # narrow it), is literals or nothing: the rule judges a literal member as written, so the mark then withholds
+        # only for what came from the gradual member. A static member that narrows to a class (`d = "a" + s.to_s;
+        # x = h[:m] || d`) would be read past as if it were gradual, so such a union is not stamped.
+        def gradual_static_part(current)
+          return nil unless current.is_a?(Type::Union)
+
+          Type::Combinator.union(*current.members.grep_v(Type::Dynamic))
+        end
+
+        # Whether `slot` is a local holding a union with a `Dynamic` member, the one case {.gradual_static_part}
+        # answers for; checked first so a class guard on any other slot builds nothing.
+        def gradual_union_slot?(slot)
+          slot.kind == :local && slot.current.is_a?(Type::Union) && slot.current.members.any?(Type::Dynamic)
+        end
+
+        def literal_or_empty?(type)
+          return true if type.nil?
+
+          members = type.is_a?(Type::Union) ? type.members : [type]
+          members.all? { |member| member.is_a?(Type::Bot) || member.is_a?(Type::Constant) }
         end
 
         # The class name a `is_a?` / `kind_of?` / `instance_of?` argument denotes: the top-level

data/lib/rigor/inference/operand_effects.rb

@@ -31,6 +31,12 @@ module Rigor
     # pure-value operand never reached, so a chained `b.push(2).size`, an argument `puts(b.push(2))` or
     # `d.map!.with_index { … }` left `b` / `d` on the literal their assignment wrote.
     #
+    # Issue #3163 — a `def` inside a block or lambda of the expression is looked into for one thing: an in-place
+    # mutation of an instance variable, class variable or global ({.method_mutation?}). The block may call the
+    # method it defines, and the evaluator floors such a variable after the block
+    # (`StatementEvaluator#floor_block_defined_method_mutations`), which it reaches only for an operand this module
+    # answers for: `puts([1].each { def h; $buf << 1; end; h })`.
+    #
     # Short-circuiting and allocation-free outside a mutator-named call: the evaluator asks it of every call's
     # operands, and asks it again of each operand it threads. A found effect stops the recursion without a
     # `return` out of the child block, which would allocate once per frame it unwinds and make a deep literal
@@ -58,12 +64,15 @@ module Rigor
       ].freeze
       JUMP_NODES = Set[Prism::NextNode, Prism::BreakNode].freeze
       SCOPE_NODES = Set[Prism::BlockNode, Prism::LambdaNode].freeze
+      NON_LOCAL_READ_NODES = Set[
+        Prism::InstanceVariableReadNode, Prism::ClassVariableReadNode, Prism::GlobalVariableReadNode
+      ].freeze
       OPAQUE_NODES = Set[
         Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode, Prism::DefinedNode
       ].freeze
       private_constant :LOCAL_WRITE_NODES, :OUTLIVING_WRITE_NODES, :INSTANCE_WRITE_NODES, :GLOBAL_WRITE_NODES,
                        :COMPOUND_LOCAL_WRITES,
-                       :COMPOUND_INSTANCE_WRITES, :JUMP_NODES, :SCOPE_NODES, :OPAQUE_NODES
+                       :COMPOUND_INSTANCE_WRITES, :JUMP_NODES, :SCOPE_NODES, :NON_LOCAL_READ_NODES, :OPAQUE_NODES
 
       module_function
 
@@ -79,7 +88,7 @@ module Rigor
         return true if OUTLIVING_WRITE_NODES.include?(klass)
         return true if jumps && JUMP_NODES.include?(klass)
         return true if klass == Prism::CallNode && outliving_mutation?(node, nesting)
-        return false if OPAQUE_NODES.include?(klass)
+        return block_defined_method_mutation?(node, nesting) if OPAQUE_NODES.include?(klass)
 
         nesting += 1 if SCOPE_NODES.include?(klass)
         jumps &&= !JumpTargets.boundary?(node)
@@ -89,6 +98,38 @@ module Rigor
       end
       private_class_method :effect?
 
+      # Issue #3163 — the one effect an opaque node has: a `def` under a block or lambda whose body mutates a
+      # non-local in place ({.method_mutation?}).
+      def block_defined_method_mutation?(node, nesting)
+        node.instance_of?(Prism::DefNode) && nesting.positive? && method_mutation?(node)
+      end
+      private_class_method :block_defined_method_mutation?
+
+      # True when `node`, a `def` or anything in its body, holds a call or index write
+      # that mutates an instance variable, class variable or global in place: a {MutationWidening::SHAPE_MUTATORS}
+      # name, or an index `||=` / `&&=` / `op=`, on a read of one. A class or module body inside the method is not
+      # looked into; a `def` nested in it is.
+      def method_mutation?(node)
+        klass = node.class
+        if klass == Prism::CallNode
+          return true if MutationWidening::SHAPE_MUTATORS.include?(node.name) && non_local_read?(node.receiver)
+        elsif OUTLIVING_WRITE_NODES.include?(klass)
+          return true if node.respond_to?(:receiver) && non_local_read?(node.receiver)
+        elsif klass != Prism::DefNode && OPAQUE_NODES.include?(klass)
+          return false
+        end
+
+        found = false
+        node.rigor_each_child { |child| found ||= method_mutation?(child) }
+        found
+      end
+      private_class_method :method_mutation?
+
+      def non_local_read?(node)
+        NON_LOCAL_READ_NODES.include?(node.class)
+      end
+      private_class_method :non_local_read?
+
       # True when `node` is a call the straight-line widening would answer for a variable that outlives the
       # expression: a {MutationWidening::SHAPE_MUTATORS} name on a receiver whose {ReceiverAlias.mutated_reads},
       # or the local an element read is rooted at ({ElementReadWidening.element_read_path}, `a[0] << e`), reach

data/lib/rigor/inference/optimistic_origin.rb

@@ -2,6 +2,8 @@
 
 require "prism"
 
+require_relative "../type"
+
 module Rigor
   module Inference
     # Marks a value whose *nil-freeness* rests on Rigor's deliberate choice to ignore core RBS's
@@ -102,24 +104,147 @@ module Rigor
       # `StatementEvaluator` and `AlwaysTruthyConditionCollector` all route here, so the three consumers the
       # spec binds cannot drift apart.
       #
-      # Resolution order — the mark recorded on the node itself, then the binding a bare local / ivar read (or
-      # a write in value position, `if (x = MAP[k])`) resolves through, then a safe-navigation call and the
-      # predicate-fold derivation issue #313 added.
+      # Resolution order — the mark recorded on the node itself, then the binding a bare local / ivar read resolves
+      # through, then a write in value position and a safe-navigation call and the predicate-fold derivation issue
+      # #313 added.
       def resolve(node, scope)
         return nil if node.nil? || scope.nil?
 
-        recorded = scope.optimistic_origins[node]
+        recorded = scope.optimistic_origin(node)
         return recorded if recorded
 
+        resolve_node(node, scope)
+      end
+
+      # The shape dispatch {.resolve} applies once the node-level mark is ruled out.
+      def resolve_node(node, scope)
         case node
-        when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
-        when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
+        when Prism::LocalVariableReadNode then scope.optimistic_local(node.name)
+        when Prism::InstanceVariableReadNode then scope.optimistic_ivar(node.name)
+        when Prism::LocalVariableWriteNode, Prism::InstanceVariableWriteNode,
+             Prism::GlobalVariableWriteNode, Prism::ClassVariableWriteNode,
+             Prism::MultiWriteNode, Prism::LocalVariableOrWriteNode,
+             Prism::InstanceVariableOrWriteNode, Prism::ClassVariableOrWriteNode,
+             Prism::GlobalVariableOrWriteNode, Prism::LocalVariableAndWriteNode,
+             Prism::InstanceVariableAndWriteNode, Prism::ClassVariableAndWriteNode,
+             Prism::GlobalVariableAndWriteNode
+          resolve_write_form(node, scope)
         when Prism::AndNode, Prism::OrNode then resolve(node.left, scope) || resolve(node.right, scope)
-        when Prism::CallNode then resolve_through_safe_navigation(node, scope) || resolve_through_predicate(node, scope)
+        when Prism::CallNode
+          resolve_attribute_write(node, scope) || resolve_through_safe_navigation(node, scope) ||
+            resolve_through_predicate(node, scope)
         when Prism::ParenthesesNode then resolve_through_parentheses(node, scope)
         end
       end
 
+      # The write forms in value position: the plain and multiple writes whose value is the
+      # right-hand side, and the `||=` / `&&=` spellings whose old binding participates.
+      def resolve_write_form(node, scope)
+        case node
+        when Prism::LocalVariableOrWriteNode, Prism::InstanceVariableOrWriteNode,
+             Prism::ClassVariableOrWriteNode, Prism::GlobalVariableOrWriteNode
+          resolve_or_write(node, scope)
+        when Prism::LocalVariableAndWriteNode, Prism::InstanceVariableAndWriteNode,
+             Prism::ClassVariableAndWriteNode, Prism::GlobalVariableAndWriteNode
+          resolve_and_write(node, scope)
+        else
+          resolve_write(node, scope)
+        end
+      end
+
+      # Issue #2617 — a write in value position (`if (v = h[k])`) yields its right-hand side, so the write's own
+      # optimism is the RHS's. The binding lookup alone could not see it from the scope a certainty consumer
+      # reads: the `if`'s entry scope predates the predicate's evaluation, so `if (v = h[k])` found no mark for
+      # `v` there and `flow.always-truthy-condition` fired on the optimistic read. Resolving `node.value` reaches
+      # the mark recorded on the read itself, which lives in the side table every scope shares; the binding lookup
+      # stays as the fallback for the post-write scope `branch_certainty` passes.
+      def resolve_write(node, scope)
+        resolve(node.value, scope) || optimistic_write_binding(node, scope)
+      end
+
+      # Only locals and ivars carry a binding mark; a global or class-variable write, and a
+      # multiple assignment's slots (marked through {.destructuring_marks} instead), have no
+      # `optimistic_*` table entry to fall back to, so they answer nil here.
+      def optimistic_write_binding(node, scope)
+        case node
+        when Prism::LocalVariableWriteNode then scope.optimistic_local(node.name)
+        when Prism::InstanceVariableWriteNode then scope.optimistic_ivar(node.name)
+        end
+      end
+
+      # Issue #3054 — `v ||= rhs` yields the OLD binding whenever it is truthy, so the write's
+      # value is the right-hand side's only on the paths where the old value is falsey. When the
+      # old binding is provably always truthy — its type has no falsey inhabitant and it carries
+      # no optimistic mark — the right-hand side is never reached and the expression's verdict is
+      # the old value's own proof, so resolving through `node.value` would silence a correct
+      # always-truthy verdict (`v = "x"; if (v ||= h[k])` still folds to `"x"`). Otherwise the
+      # verdict, when one folds, rests on the right-hand side's bet.
+      def resolve_or_write(node, scope)
+        binding_type, binding_mark = or_write_binding(node, scope)
+        return nil if always_truthy_type?(binding_type) && binding_mark.nil?
+
+        resolve(node.value, scope)
+      end
+
+      # Issue #3054 — `v &&= rhs` yields the right-hand side whenever the old binding is truthy;
+      # the old value itself wins only on its falsey edge, a result no always-truthy verdict can
+      # rest on. So the right-hand side's mark covers every constant verdict the expression folds
+      # to, joined by the old binding's own mark for the case where the miss — not the rvalue — is
+      # what makes the condition live (`v = h[k]; if (v &&= "lit")`).
+      def resolve_and_write(node, scope)
+        resolve(node.value, scope) || and_write_binding_mark(node, scope)
+      end
+
+      # The `[type, mark]` pair an `||=` reads its old value through: the scope binding and the
+      # optimistic mark it carries. Class- and global-variable or-writes have no mark table — the
+      # mark channel covers locals and ivars only — so their mark is always nil.
+      def or_write_binding(node, scope)
+        case node
+        when Prism::LocalVariableOrWriteNode
+          [scope.local(node.name), scope.optimistic_local(node.name)]
+        when Prism::InstanceVariableOrWriteNode
+          [scope.ivar(node.name), scope.optimistic_ivar(node.name)]
+        when Prism::ClassVariableOrWriteNode
+          [scope.cvar(node.name), nil]
+        when Prism::GlobalVariableOrWriteNode
+          [scope.global(node.name), nil]
+        end
+      end
+
+      # The old binding's optimistic mark for an `&&=` — the same two tables {.or_write_binding}
+      # reads, with no type: `&&=` needs the mark alone.
+      def and_write_binding_mark(node, scope)
+        case node
+        when Prism::LocalVariableAndWriteNode then scope.optimistic_local(node.name)
+        when Prism::InstanceVariableAndWriteNode then scope.optimistic_ivar(node.name)
+        end
+      end
+
+      # Issue #3054 — `recv.x = rhs` and `recv[i] = rhs` yield the assigned value, which Prism
+      # spells as the call's last argument (`x=` takes it alone, `[]=` trails the indices). The
+      # compound spellings never reach here: `+=` / `[]=` operators and `||=` / `&&=` on an
+      # attribute or index are `CallOperatorWriteNode` / `IndexOperatorWriteNode` /
+      # `CallOrWriteNode` / `CallAndWriteNode` / `IndexOrWriteNode` / `IndexAndWriteNode`, not
+      # `CallNode`, and their value is the old slot's, not the right-hand side's.
+      def resolve_attribute_write(node, scope)
+        resolve(node.arguments&.arguments&.last, scope) if node.attribute_write?
+      end
+
+      # Whether `type` proves every inhabitant truthy — the empty falsey fragment of
+      # `Narrowing.narrow_falsey`, mirrored carrier for carrier so this leaf module need not
+      # require `Narrowing` (which already requires this file). A `nil` binding (unbound) and
+      # every carrier the falsey fragment cannot empty (`Top`, `Dynamic`, ranges, refinements,
+      # differences) answer false: only a proof counts.
+      def always_truthy_type?(type)
+        case type
+        when Type::Constant then !(type.value.nil? || type.value == false)
+        when Type::Nominal then !%w[NilClass FalseClass].include?(type.class_name)
+        when Type::Union then type.members.all? { |member| always_truthy_type?(member) }
+        when Type::Singleton, Type::Tuple, Type::HashShape then true
+        else type.is_a?(Type::Bot)
+        end
+      end
+
       # `recv&.m` is `nil` exactly when `recv` is (or when `m` answers `nil`), so it restates `recv`'s presence
       # and is as optimistic as `recv`. Only the call carrying the `&.` is derived: Ruby skips that one call and
       # no more, so `recv&.m.n` sends `n` to the `nil` and raises (or answers `NilClass#n`), and neither it nor
@@ -169,7 +294,7 @@ module Rigor
       # predicate's folded boolean only when the miss answers the other boolean (or cannot be told), so
       # `!recv&.empty?` — `!false` on a hit, `!nil` on a miss — stays `true`, and so does `x = recv&.empty?; !x`.
       def miss_answer(node, scope)
-        return nil if scope.optimistic_origins[node]
+        return nil if scope.optimistic_origin(node)
 
         case node
         when Prism::LocalVariableReadNode then scope.optimistic_local_miss(node.name)

data/lib/rigor/inference/origin_lookup.rb

@@ -23,7 +23,7 @@ module Rigor
       def origin_for(scope, node)
         return nil if node.nil?
 
-        scope.dynamic_origins[node] || propagated(scope, node)
+        scope.dynamic_origin(node) || propagated(scope, node)
       end
 
       def propagated(scope, node)