Update tasks

Author: AJenbo

docs/todo.md

@@ -37,11 +37,14 @@ contributor even though it's short.
 | B80  | [`max()`/`min()` argument-dependent return type is a malformed union](todo/bugs.md#b80-maxmin-argument-dependent-return-type-is-a-malformed-union)          | Medium      | Medium      |
 | B78  | [A standalone `@var` cast above `return` is ignored](todo/bugs.md#b78-a-standalone-var-cast-above-return-is-ignored)                                        | Medium      | Medium      |
 | B82  | [A nullsafe chain compared `===` to a non-nullable value does not narrow the receiver](todo/bugs.md#b82-a-nullsafe-chain-compared--to-a-non-nullable-value-does-not-narrow-the-receiver) | Medium      | Medium      |
+| B83  | [A `match (true)` arm's condition does not narrow inside the arm's result](todo/bugs.md#b83-a-match-true-arms-condition-does-not-narrow-inside-the-arms-result) | Medium      | Medium      |
+| B84  | [Return-position compatibility ignores an array shape's value types](todo/bugs.md#b84-return-position-compatibility-ignores-an-array-shapes-value-types)      | Medium      | Medium      |
 | B79  | [`array_filter()` without a callback keeps `null` on values that share the array with a `?bool`](todo/bugs.md#b79-array_filter-without-a-callback-keeps-null-on-values-that-share-the-array-with-a-bool) | Low-Medium  | Medium      |
 | B81  | [Foreach element extraction widens `false` to `bool`](todo/bugs.md#b81-foreach-element-extraction-widens-false-to-bool)                                     | Low-Medium  | Medium      |
 | B76  | [Blade variables typed from a component class are immune to condition narrowing](todo/bugs.md#b76-blade-variables-typed-from-a-component-class-are-immune-to-condition-narrowing) | Medium      | Medium-High |
 | B77  | [A foreach over a proven non-empty array still merges the zero-iteration path](todo/bugs.md#b77-a-foreach-over-a-proven-non-empty-array-still-merges-the-zero-iteration-path) | Medium      | Medium-High |
 | B75  | [A dim-write to the foreach value variable leaks through the loop back-edge](todo/bugs.md#b75-a-dim-write-to-the-foreach-value-variable-leaks-through-the-loop-back-edge) | Medium      | High        |
+| T32  | [Audit `is_type_compatible`'s MAYBE escape hatches for core-engine gaps](todo/type-inference.md#t32-audit-is_type_compatibles-maybe-escape-hatches-for-core-engine-gaps)    | Medium      | High        |
 |      | **Release 0.10.0**                                                                                                                                        |             |             |
 
 ## Sprint 7 — 1.0 release & IDE extensions
@@ -95,7 +98,6 @@ unlikely to move the needle for most users.
 | T3  | [Property hooks (PHP 8.4)](todo/type-inference.md#t3-property-hooks-php-84)                                                                                                 | Medium      | Medium-High |
 | T34 | [`static::CONST` over-narrows to the declaring class's value](todo/type-inference.md#t34-staticconst-over-narrows-to-the-declaring-classs-value)                            | Medium      | Medium-High |
 | T29 | [Definite vs possible variable existence tracking](todo/type-inference.md#t29-definite-vs-possible-variable-existence-tracking)                                             | Medium      | High        |
-| T32 | [Audit `is_type_compatible`'s MAYBE escape hatches for core-engine gaps](todo/type-inference.md#t32-audit-is_type_compatibles-maybe-escape-hatches-for-core-engine-gaps)    | Medium      | High        |
 | T30 | [Literal type collapse limit](todo/type-inference.md#t30-literal-type-collapse-limit)                                                                                       | Low-Medium  | Medium      |
 | T40 | [`pathinfo()` returns a shape or a string depending on the flags argument](todo/type-inference.md#t40-pathinfo-returns-a-shape-or-a-string-depending-on-the-flags-argument) | Low-Medium  | Medium      |
 | T26 | [Globbed constant unions (`Foo::BAR_*`)](todo/type-inference.md#t26-globbed-constant-unions-foobar_)                                                                        | Low-Medium  | Medium      |

docs/todo/bugs.md

@@ -20,15 +20,56 @@ was patched in the sample sources. Every entry was isolated in a
 scratch repro and bisected to the minimal trigger shown in its code
 block; several sit at the same source sites as fixed bugs from the
 previous sweep (B50, B54, B59, B62), where the coarse defect was fixed
-and a finer one behind it became visible.
+and a finer one behind it became visible. **B83** was filed the same
+day from the follow-up re-run at `c618c8aa`, whose compatibility
+tightening surfaced one previously-swallowed site, and **B84** from a
+probe at `66a524bc` showing the return-position side of that
+tightening is still missing.
 
 ## Crashes
 
 No outstanding items.
 
 ## Type comparison
 
-No outstanding items.
+### B84. Return-position compatibility ignores an array shape's value types
+
+**Impact: Medium · Complexity: Medium**
+
+```php
+/** @return array<string, int> */
+function bad(): array {
+    return ['a' => 'x'];   // not reported
+}
+
+/** @param array<string, int> $m */
+function takesIntMap(array $m): void {}
+
+function alsoBad(): void {
+    takesIntMap(['a' => 'x']);   // reported, as expected
+}
+```
+
+Needs investigation: `type_mismatch_argument` correctly reports an
+array shape whose values do not satisfy the declared map or list value
+type (`array{a: 'x'}` vs `array<string, int>`, `array{'x', 'y'}` vs
+`list<int>`), but `type_mismatch_return` accepts the identical
+mismatch silently. The return side is not skipping shapes entirely —
+a nullability mismatch in a shape value (`array{a: ?bool}` vs
+`array<string, int>`) is reported in return position — so the two
+diagnostics are reaching different verdicts for the same shape-vs-map
+comparison somewhere below the nullability check. `array<string,
+never>` as the declared type is the extreme case: any all-optional-keys
+shape (e.g. an `array_filter()` result) passes against it, which is
+what kept masking scratch probes during the 2026-08-15 sweeps.
+
+Found by probe at `66a524bc`, after the argument-side tightening
+landed; no sample-project site currently hits it.
+
+**Fix:** find where the return-position compatibility path diverges
+from the argument-position path for shape-to-map value checks and
+unify them; the recently tightened argument behaviour is the correct
+one.
 
 ## Standard-library return types
 
@@ -264,6 +305,43 @@ half was B54 in the previous sweep.
 type excludes `null`, narrow `$x` to non-null (and mirror for `!==` in
 the false branch).
 
+### B83. A `match (true)` arm's condition does not narrow inside the arm's result
+
+**Impact: Medium · Complexity: Medium**
+
+```php
+/** @param list<int|string> $args */
+function takesList(array $args): void {}
+
+function label(?int $buy, ?int $pay, string $kind): void {
+    $textArgs = match (true) {
+        $kind === 'xy' && $buy !== null && $pay !== null => [$buy, $pay],
+        default => [],
+    };
+    takesList($textArgs);   // reported: array{?int, ?int} does not satisfy list<int|string>
+}
+```
+
+The `!== null` conjuncts of a `match (true)` arm's condition prove the
+values non-null within that arm's result expression, exactly as the
+equivalent `if` statement does — and the `if` form narrows correctly.
+Inside a match arm nothing narrows: plain variables and property reads
+both keep their `null` arms.
+
+Filed 2026-08-15, after the evening sweep: the argument-compatibility
+tightening in `c618c8aa` surfaced it — the resulting shape mismatch
+was previously swallowed by the compatibility leniency that T32 tracks
+(the argument side has since been tightened further; the return-side
+remainder is B84).
+
+Sample site: `luxplus-website app/Contexts/Api/Resources/ProductResource.php:210`
+(discount label `$textArgs` built from `?int` properties the arm
+condition null-checks).
+
+**Fix:** evaluate each `match (true)` arm's result expression under
+the same condition-derived scope state the `if` evaluator would build
+from that arm's condition.
+
 ## Symbol resolution
 
 No outstanding items.