rigortype 0.3.8 → 0.3.9

data/lib/rigor/inference/expression_typer.rb

@@ -109,23 +109,23 @@ module Rigor
         Prism::SelfNode => :type_of_self_node,
         Prism::InstanceVariableReadNode => :type_of_instance_variable_read,
         Prism::InstanceVariableWriteNode => :type_of_assignment_write,
-        Prism::InstanceVariableOperatorWriteNode => :type_of_assignment_write,
-        Prism::InstanceVariableOrWriteNode => :type_of_assignment_write,
-        Prism::InstanceVariableAndWriteNode => :type_of_assignment_write,
+        Prism::InstanceVariableOperatorWriteNode => :type_of_compound_variable_write,
+        Prism::InstanceVariableOrWriteNode => :type_of_compound_variable_write,
+        Prism::InstanceVariableAndWriteNode => :type_of_compound_variable_write,
         Prism::ClassVariableReadNode => :type_of_class_variable_read,
         Prism::ClassVariableWriteNode => :type_of_assignment_write,
-        Prism::ClassVariableOperatorWriteNode => :type_of_assignment_write,
-        Prism::ClassVariableOrWriteNode => :type_of_assignment_write,
-        Prism::ClassVariableAndWriteNode => :type_of_assignment_write,
+        Prism::ClassVariableOperatorWriteNode => :type_of_compound_variable_write,
+        Prism::ClassVariableOrWriteNode => :type_of_compound_variable_write,
+        Prism::ClassVariableAndWriteNode => :type_of_compound_variable_write,
         Prism::GlobalVariableReadNode => :type_of_global_variable_read,
         Prism::GlobalVariableWriteNode => :type_of_assignment_write,
-        Prism::GlobalVariableOperatorWriteNode => :type_of_assignment_write,
-        Prism::GlobalVariableOrWriteNode => :type_of_assignment_write,
-        Prism::GlobalVariableAndWriteNode => :type_of_assignment_write,
+        Prism::GlobalVariableOperatorWriteNode => :type_of_compound_variable_write,
+        Prism::GlobalVariableOrWriteNode => :type_of_compound_variable_write,
+        Prism::GlobalVariableAndWriteNode => :type_of_compound_variable_write,
         # Compound writes that share the `.value` rvalue accessor
-        Prism::LocalVariableOperatorWriteNode => :type_of_assignment_write,
-        Prism::LocalVariableOrWriteNode => :type_of_assignment_write,
-        Prism::LocalVariableAndWriteNode => :type_of_assignment_write,
+        Prism::LocalVariableOperatorWriteNode => :type_of_compound_variable_write,
+        Prism::LocalVariableOrWriteNode => :type_of_compound_variable_write,
+        Prism::LocalVariableAndWriteNode => :type_of_compound_variable_write,
         Prism::IndexOperatorWriteNode => :type_of_assignment_write,
         Prism::IndexOrWriteNode => :type_of_assignment_write,
         Prism::IndexAndWriteNode => :type_of_assignment_write,
@@ -201,7 +201,7 @@ module Rigor
         Prism::NextNode => :type_of_jump,
         Prism::RetryNode => :type_of_jump,
         Prism::RedoNode => :type_of_jump,
-        Prism::YieldNode => :type_of_dynamic_top,
+        Prism::YieldNode => :type_of_yield,
         Prism::SuperNode => :type_of_dynamic_top,
         Prism::ForwardingArgumentsNode => :type_of_non_value,
         Prism::WhileNode => :type_of_loop,
@@ -287,6 +287,32 @@ module Rigor
         slot[1].transform_values(&:values)
       end
 
+      # Issue #720 — the value the block passed by the call site currently being re-typed evaluates to, or
+      # `nil` outside such a frame. Read by {#type_of_yield}.
+      #
+      # A thread-local rather than a `Scope` field for the same reason the `return` / `next` / `break` sinks
+      # are: `yield` names the frame's caller, not a binding, and the body is walked through scopes the
+      # inference rebuilds freely. It is installed unconditionally — with `nil` — at every user-method
+      # inference frame, so a callee reached WITHOUT a block from inside a yielding body cannot read its
+      # caller's block.
+      YIELD_VALUE_KEY = :__rigor_yield_value_type__
+      private_constant :YIELD_VALUE_KEY
+
+      def self.current_yield_value_type
+        Thread.current[YIELD_VALUE_KEY]
+      end
+
+      # Runs `block` with `type` installed as the frame's yield value, restoring the previous frame on exit.
+      def self.with_yield_value_type(type)
+        previous = Thread.current[YIELD_VALUE_KEY]
+        Thread.current[YIELD_VALUE_KEY] = type
+        begin
+          yield
+        ensure
+          Thread.current[YIELD_VALUE_KEY] = previous
+        end
+      end
+
       private
 
       attr_reader :scope, :tracer
@@ -318,6 +344,71 @@ module Rigor
         type_of(node.value)
       end
 
+      # `v += 1` / `@v ||= x` / `$v &&= x` as an EXPRESSION. The value of a compound write is the value it
+      # stores, which is a function of the variable's CURRENT binding — not of the rvalue alone. Typing it as
+      # `type_of(node.value)` answered `1` for `total += 1` whatever `total` held.
+      #
+      # `StatementEvaluator#compound_eval` already computes the right answer on the straight-line path, so the
+      # gap only showed where a body is typed WITHOUT that evaluator: the block-return pass types a
+      # single-statement body by expression alone, and issue #617 residue (3) is the live consequence —
+      # `total = 0; r = [1, 2].map { total += 1 }` folded to `[1, 1]`, and `r.last == 1` fired a false
+      # `flow.always-truthy-condition` on a program where it is `2`. Under the per-element fold the captured
+      # local is already bound to its converged `Integer` (issue #587 (b)); reading that binding here is what
+      # turns the stale pin into the honest `Integer`.
+      #
+      # The algebra is `StatementEvaluator#compound_result_type`'s, deliberately: the two must not disagree
+      # about what a compound write evaluates to. An unbound target is `Dynamic[top]` — the same fallback the
+      # evaluator takes — and an operator the receiver does not answer widens to `Dynamic[top]` rather than
+      # inventing the rvalue.
+      #
+      # Constant and index targets keep {#type_of_assignment_write}: a constant is not rebound in a loop body,
+      # and `IndexOperatorWriteNode` is typed through `Scope#type_of`'s own indexed path by
+      # `StatementEvaluator#eval_index_write`.
+      def type_of_compound_variable_write(node)
+        current = compound_write_current_binding(node)
+        rhs = type_of(node.value)
+
+        case node
+        when Prism::LocalVariableOrWriteNode, Prism::InstanceVariableOrWriteNode,
+             Prism::ClassVariableOrWriteNode, Prism::GlobalVariableOrWriteNode
+          # An UNBOUND target is the memoization idiom (`def self.default = @default ||= new`): nothing
+          # has written the variable on any path the analyzer saw, so the stored value is the rvalue.
+          # Reading it as `Dynamic[top] | rhs` would skip every memoized singleton in `sig-gen`
+          # (ADR-5 optimism; three `.default` readers went `sig.skipped.untyped-return` without this).
+          return rhs if current.nil?
+
+          Type::Combinator.union(Narrowing.narrow_truthy(current), rhs)
+        when Prism::LocalVariableAndWriteNode, Prism::InstanceVariableAndWriteNode,
+             Prism::ClassVariableAndWriteNode, Prism::GlobalVariableAndWriteNode
+          return rhs if current.nil?
+
+          Type::Combinator.union(Narrowing.narrow_falsey(current), rhs)
+        else
+          compound_operator_result(current || dynamic_top, rhs, node.binary_operator)
+        end
+      end
+
+      def compound_write_current_binding(node)
+        case node
+        when Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+             Prism::LocalVariableAndWriteNode then scope.local(node.name)
+        when Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableOrWriteNode,
+             Prism::InstanceVariableAndWriteNode then scope.ivar(node.name)
+        when Prism::ClassVariableOperatorWriteNode, Prism::ClassVariableOrWriteNode,
+             Prism::ClassVariableAndWriteNode then scope.cvar(node.name)
+        else scope.global(node.name)
+        end
+      end
+
+      def compound_operator_result(current, rhs, operator)
+        MethodDispatcher.dispatch(
+          receiver_type: current,
+          method_name: operator.to_sym,
+          arg_types: [rhs],
+          environment: scope.environment
+        ) || dynamic_top
+      end
+
       # Slice 7 phase 1 — instance/class/global variable reads. Each lookup returns the type currently bound
       # in the surrounding scope's per-kind binding map (populated by `StatementEvaluator` write handlers
       # within the same method body), falling through to `Dynamic[Top]` when no binding is recorded.
@@ -372,6 +463,19 @@ module Rigor
         dynamic_top
       end
 
+      # Issue #720 — `yield` evaluates the block the CALLER passed, so its value is that block's value. The
+      # caller is only known when this body is being re-typed on behalf of one call site
+      # ({#infer_user_method_return} installs the frame); on the main walk over a `def` no caller exists and
+      # the answer stays `Dynamic[top]`.
+      #
+      # Nothing about the yield's arguments is checked here. The block's return type was computed at the call
+      # site under the parameter bindings the call implies, so it already answers "what does this block
+      # evaluate to for this caller"; a `yield` that passes different arguments than the block's parameters
+      # accept is a separate (arity) question this frame does not decide.
+      def type_of_yield(_node)
+        ExpressionTyper.current_yield_value_type || dynamic_top
+      end
+
       # `defined?(expr)` returns `String | nil` per Ruby semantics — a description of the expression's
       # category (`"local-variable"`, `"method"`, ...) when defined, or `nil` when not. The argument is not
       # evaluated (it is statically inspected by the runtime), so the typer does not recurse into it.
@@ -843,9 +947,21 @@ module Rigor
       #
       # Other pattern shapes (Range, Regexp, custom `===`) stay `:maybe` — the existing union fallback
       # handles them.
+      #
+      # The class reference is resolved through {Narrowing.lexical_class_name}, the walk the narrowing
+      # side of the same `case` already uses (#655). Matching on the as-written spelling instead made a
+      # SHADOWED name confidently wrong rather than merely unresolved: `when Random` inside
+      # `Bar::Nested` names `Bar::Nested::Random`, the environment answered the core `::Random` the
+      # spelling matches at top level, and a subject that is a core `Random` then made the arm certain
+      # — dropping the `else` Ruby actually takes and typing the expression as a branch that never
+      # runs. The documented argument that an unresolvable pattern can only lose certainty holds for an
+      # unresolvable name and not for a shadowed one.
       def case_when_pattern_certainty(subject_type, pattern_node)
-        class_name = Source::ConstantPath.qualified_name_or_nil(pattern_node)
-        return Narrowing.class_pattern_certainty(subject_type, class_name, environment: scope.environment) if class_name
+        class_name = Narrowing.lexical_class_name(pattern_node, scope)
+        if class_name
+          return Narrowing.class_pattern_certainty(subject_type, class_name, environment: scope.environment,
+                                                                             scope: scope)
+        end
 
         literal = literal_pattern_value(pattern_node)
         return Narrowing.value_pattern_certainty(subject_type, literal[:value]) if literal
@@ -963,6 +1079,8 @@ module Rigor
           Type::Combinator.nominal_of(value.class.name)
         when Type::IntegerRange
           Type::Combinator.nominal_of("Integer")
+        when Type::FloatRange
+          Type::Combinator.nominal_of("Float")
         else
           type
         end
@@ -1177,12 +1295,12 @@ module Rigor
       # and fired `undefined method 'upcase' for nil` on correct code. The candidate is still looked up
       # first — that lookup is a hash probe and owns the ADR-46 cross-file dependency edge — and
       # {#self_type_answers?} then vetoes the bind for a name the enclosing class answers itself.
-      def try_local_def_dispatch(node, receiver, arg_types)
+      def try_local_def_dispatch(node, receiver, arg_types, block_type = nil)
         local_def = node.receiver.nil? ? scope.bindable_top_level_def_for(node.name) : nil
         return nil unless local_def
         return nil if self_type_answers?(node.name)
 
-        local_inference = infer_top_level_user_method(local_def, receiver, arg_types)
+        local_inference = infer_top_level_user_method(local_def, receiver, arg_types, block_type)
         return local_inference if local_inference
 
         # The local def matches by name but the inference was disqualified — the parameter shape is too
@@ -1194,6 +1312,55 @@ module Rigor
         dynamic_top
       end
 
+      # ADR-110 WD1 / #856 — the receiver's own `def` outranks a declaration that only an ANCESTOR carries.
+      #
+      # RBS resolves through the fully built method table, so `RbsDispatch` answers a subclass call with a
+      # signature written about the base. redmine's `FieldFormat::Base#target_class` honestly declares
+      # `-> nil`; `RecordList` overrides it with a real lookup, and every call on a `RecordList` receiver
+      # typed as `nil` and fired `undefined method ... for nil` on the subclass's own working code (#744).
+      # A signature is authoritative for a receiver only where someone wrote it about that receiver;
+      # reaching it through an ancestor is a lookup convenience, not an act of authorship.
+      #
+      # This is {#try_local_def_dispatch}'s shape one level up — there the enclosing class shadows a
+      # top-level `def`, here the receiver's class shadows an ancestor's declaration — and it answers the
+      # same way: re-type the override's body, and when that is not possible answer `Dynamic[Top]` rather
+      # than let the inherited declaration speak for a method it does not describe.
+      #
+      # Three conditions, and the third is the blast radius. Clause A of the ADR (an own source `def`, no
+      # own declaration) does NOT by itself stay clear of [ADR-43]: `class Foo; def each; end` inheriting
+      # `Enumerable#each` satisfies it, and disqualifying bundled declarations that way is the blanket fix
+      # ADR-43 rejected — the same reason {#instance_self_answers?}'s RBS arm is own-class only. So the
+      # ancestor whose declaration is being disqualified must itself be PROJECT-declared: a project sidecar
+      # describes the source under analysis, while a bundled signature describes a class the project does
+      # not own, where a project `def` is a monkey-patch and [ADR-17] owns the question.
+      # `project_declared_class?` fail-softs to false, so an unattributable environment changes nothing.
+      def try_overriding_def_dispatch(node, receiver, arg_types)
+        return nil unless user_inference_receiver?(receiver)
+
+        class_name = receiver.class_name
+        return nil if class_name.nil?
+        # `Scope#user_def_for`, not `discovered_method?`: the cross-file table deliberately withholds a
+        # plain instance `def` under the ADR-17 monkey-patch contract, and this gate must see one.
+        return nil if scope.user_def_for(class_name, node.name).nil?
+
+        definition = safe_rbs_method_definition(class_name, node.name, :instance)
+        return nil if definition.nil?
+        return nil if rbs_declared_on_class?(definition, class_name)
+        return nil unless project_declared_owner?(definition)
+
+        try_user_method_inference(receiver, node, arg_types) || dynamic_top
+      end
+
+      # Whether the class an inherited declaration was written about is one the project declares itself.
+      def project_declared_owner?(definition)
+        defined_in = definition.defined_in
+        return false if defined_in.nil?
+
+        Rigor::Reflection.project_declared_class?(defined_in.to_s, scope: scope)
+      rescue StandardError
+        false
+      end
+
       # Issue #618 — whether the call's enclosing `self` already answers `method_name`. Only a `self` whose
       # class is KNOWN participates: at genuine top level, and inside a block whose `self` is unmodelled,
       # `scope.self_type` is nil, the predicate is false, and the historical top-level binding stands — that
@@ -1212,30 +1379,65 @@ module Rigor
         end
       end
 
-      # The instance side of {#self_type_answers?}: the class's own discovered methods (`def`, `attr_*`,
-      # `define_method`, `alias`), its `Struct.new` / `Data.define` member accessors, a `def` reached through
-      # its project ancestors (superclass chain and included modules), and an RBS method declared on the
-      # class ITSELF.
+      # The instance side of {#self_type_answers?}: the discovered methods (`def`, `attr_*`,
+      # `define_method`, `alias`) of the class or any project ancestor, its `Struct.new` / `Data.define`
+      # member accessors, a `def` reached through its project ancestors (superclass chain and included
+      # modules), and an RBS method declared on an owner that PRECEDES `::Object` in the MRO.
       #
-      # The RBS arm is own-class only, deliberately. An inherited-declaration test would match every
-      # `Object` / `Kernel` / `Enumerable` name and retract the binding v0.0.3 A exists for — a `def
-      # select(...)` collocated with its DSL-block call site would route straight back through
-      # `Enumerable#select`.
+      # Issue #633 — the discovery arm walks ancestors because inheritance does not distinguish how a
+      # method got there: a superclass `attr_accessor :stext` and an included module's `attr_reader` bind
+      # ahead of a top-level `def stext` exactly as an inherited `def` does, and only the latter had a walk.
+      #
+      # The RBS arm's cut-off is `::Object`, not the own class. A top-level `def` IS a private `Object`
+      # instance method, the last link of every MRO, so any declared owner that comes before `::Object`
+      # wins at runtime — `Exception#message` for a `StandardError` subclass, `Array#first`,
+      # `Comparable#clamp`. What the cut-off keeps out is the tier v0.0.3 A exists for and #316 / #319
+      # refined: a name owned by `Object` or `Kernel` themselves (`inspect`, `format`) is at or after the
+      # top-level `def`'s own rung, so the historical binding still stands there.
       def instance_self_answers?(class_name, method_name)
         return false if class_name.nil?
-        return true if scope.discovered_method?(class_name, method_name, :instance)
+        return true if scope.discovered_method_through_ancestors?(class_name, method_name, :instance)
         return true if meta_member?(class_name, method_name)
         return true if resolve_user_def_through_ancestors(class_name, method_name)
 
-        rbs_declared_on_class?(safe_rbs_method_definition(class_name, method_name, :instance), class_name)
+        rbs_ancestor_answers?(class_name, method_name)
+      end
+
+      # The RBS arm of {#instance_self_answers?}. A project class is usually absent from the RBS
+      # environment, so the declaration that decides the question is written about an ancestor the project
+      # does not declare (`StandardError`, `Array`, `Comparable`) — each is asked on its own terms, and
+      # each of them is itself before `::Object` in the reader's MRO by construction.
+      def rbs_ancestor_answers?(class_name, method_name)
+        definition = safe_rbs_method_definition(class_name, method_name, :instance)
+        return true if rbs_declared_before_object?(definition, class_name)
+
+        scope.external_ancestor_name_candidates(class_name, name_memo: class_graph_buckets[:name])
+             .any? { |candidates| external_ancestor_answers?(candidates, method_name) }
+      end
+
+      # The first candidate spelling the RBS environment knows is the ancestor Ruby resolves; a name it
+      # knows nothing about contributes no evidence either way.
+      def external_ancestor_answers?(candidates, method_name)
+        candidates.each do |candidate|
+          next if instance_ancestor_names(candidate).empty?
+
+          return rbs_declared_before_object?(
+            safe_rbs_method_definition(candidate, method_name, :instance), candidate
+          )
+        end
+        false
       end
 
       # The singleton side: a class-body `self` is `Singleton[Foo]`, where an implicit-self call reaches
       # `Foo`'s own class methods before `Object`'s private top-level `def`.
+      #
+      # Issue #633 — both discovery arms follow the superclass chain, because a subclass inherits its
+      # parent's class methods; `Scope` narrows the singleton walk to superclasses for the same reason
+      # (an `include`d module's `def self.x` is not callable on the includer).
       def singleton_self_answers?(class_name, method_name)
         return false if class_name.nil?
-        return true if scope.discovered_method?(class_name, method_name, :singleton)
-        return true unless scope.singleton_def_for(class_name, method_name).nil?
+        return true if scope.discovered_method_through_ancestors?(class_name, method_name, :singleton)
+        return true unless scope.singleton_def_through_ancestors(class_name, method_name).first.nil?
 
         rbs_declared_on_class?(safe_rbs_method_definition(class_name, method_name, :singleton), class_name)
       end
@@ -1272,6 +1474,36 @@ module Rigor
         defined_in.to_s.delete_prefix("::") == class_name.to_s.delete_prefix("::")
       end
 
+      # Issue #633 — true when the declaration's owner sits strictly before `::Object` in `class_name`'s
+      # instance MRO, i.e. Ruby dispatches to it ahead of a top-level `def` (which is `Object`'s own
+      # private instance method). The own class trivially qualifies. An owner absent from the ancestor
+      # list, an unbuildable class, and an ancestry that does not reach `Object` (a `BasicObject`
+      # descendant) all answer false, leaving the historical top-level binding untouched.
+      def rbs_declared_before_object?(definition, class_name)
+        return true if rbs_declared_on_class?(definition, class_name)
+        return false if definition.nil? || !definition.respond_to?(:defined_in)
+
+        owner = definition.defined_in
+        return false if owner.nil?
+
+        ancestors = instance_ancestor_names(class_name)
+        object_index = ancestors.index("Object")
+        owner_index = ancestors.index(owner.to_s.delete_prefix("::"))
+        !object_index.nil? && !owner_index.nil? && owner_index < object_index
+      end
+
+      # The class's instance-side ancestors in MRO order, `::`-stripped, or `[]` for a class the RBS
+      # environment does not know or cannot build. Read through the loader's accessor rather than
+      # `instance_definition(...).ancestors` because that is the one wired to the ancestor-name cache and
+      # marked as RIGOR'S OWN demand — ordering two ancestors is not the analysis asking whether either
+      # one's methods resolve, and the `rbs.coverage` bookkeeping must not record it as such.
+      def instance_ancestor_names(class_name)
+        loader = scope.environment&.rbs_loader
+        loader ? loader.ancestor_names_for(class_name.to_s) : []
+      rescue StandardError
+        []
+      end
+
       # Issue #520 — Ruby defines the value of an attribute / index assignment (`x.attr = v`, `h[k] = v`)
       # as the RHS object itself, whatever the writer method returns. The dispatch pipeline still runs
       # first for everything it observes on the side (effect collection, provenance, recorders, and the
@@ -1376,7 +1608,22 @@ module Rigor
       # `receiver_override` substitutes the receiver type for the whole pipeline (folds, dispatch, the
       # inference tiers) without re-reading the receiver node — the safe-navigation path (#518) dispatches
       # on the nil-stripped fragment, and the optional-receiver retry (#519) re-runs the pipeline on it.
+      # Issue #853: `break value` terminates the yielding CALL and is that call's value, so the answer every
+      # tier below produces — an RBS return, a precision fold, an inter-procedural inference — describes only
+      # the path where the block never breaks. The call's value is that result unioned with every `break` arm
+      # the block can reach. Modelling it here rather than inside each fold is what keeps the folds honest:
+      # `ops.all? { |o| break false unless o; true }` still folds the no-break path to `Constant[true]`, and
+      # the union with the `false` arm makes the call `bool` — no `flow.always-truthy-condition` on a program
+      # that really can answer false.
       def call_dispatch_type_for(node, receiver_override: nil)
+        result = call_result_type_for(node, receiver_override: receiver_override)
+        arms = call_break_arm_types(node, receiver_override: receiver_override)
+        return result if arms.empty?
+
+        Type::Combinator.union(result, *arms)
+      end
+
+      def call_result_type_for(node, receiver_override: nil)
         narrowed = indexed_narrowing_for(node)
         return narrowed if narrowed
 
@@ -1392,7 +1639,7 @@ module Rigor
         literal_send = try_literal_send(node, receiver)
         return literal_send if literal_send
 
-        local_def_result = try_local_def_dispatch(node, receiver, arg_types)
+        local_def_result = try_local_def_dispatch(node, receiver, arg_types, block_type)
         return local_def_result if local_def_result
 
         # v0.0.6 phase 2 — per-element block fold for Tuple receivers. When `[a, b, c].map { |x| f(x) }` and
@@ -1403,6 +1650,9 @@ module Rigor
         block_fold = try_receiver_block_folds(node, receiver, arg_types)
         return block_fold if block_fold
 
+        overriding_def = try_overriding_def_dispatch(node, receiver, arg_types)
+        return overriding_def if overriding_def
+
         result = MethodDispatcher.dispatch(
           receiver_type: receiver,
           method_name: node.name,
@@ -1414,16 +1664,16 @@ module Rigor
         )
         return result if result
 
-        dispatch_miss_result(node, receiver, arg_types)
+        dispatch_miss_result(node, receiver, arg_types, block_type)
       end
 
       # The post-dispatch tiers for a call `MethodDispatcher` could not answer, in their historical
       # order; extracted from {#call_dispatch_type_for} whole.
-      def dispatch_miss_result(node, receiver, arg_types)
+      def dispatch_miss_result(node, receiver, arg_types, block_type = nil)
         # v0.0.2 #5 — inter-procedural inference for user-defined methods. When dispatch misses but the
         # receiver is a user class with a `def` body, re-type the body with the call's argument types bound
         # and return the body's last-expression type.
-        user_inference = try_user_method_inference(receiver, node, arg_types)
+        user_inference = try_user_method_inference(receiver, node, arg_types, block_type: block_type)
         return user_inference if user_inference
 
         # Module-singleton call resolution (ADR-57 follow-up) — when the receiver is `Singleton[Foo]` (a
@@ -1431,7 +1681,7 @@ module Rigor
         # `module_function` body, re-type that body with the call args bound. Sits after the RBS dispatch
         # tier, so foreign / RBS-known singletons (`Math.sqrt`) keep their catalog answer; only
         # project-defined singleton methods reach here.
-        singleton_inference = try_project_singleton_inference(receiver, node, arg_types)
+        singleton_inference = try_project_singleton_inference(receiver, node, arg_types, block_type: block_type)
         return singleton_inference if singleton_inference
 
         # Dynamic-origin propagation: when the receiver is Dynamic[T] and no positive rule resolves the call,
@@ -1634,8 +1884,8 @@ module Rigor
       # `scope.self_type` (or implicit `Object`) as the receiver carrier so the body's own self is
       # consistent with the call site's. Returns nil when the parameter shape disqualifies the def, when the
       # body is empty, or when a recursion cycle is detected.
-      def infer_top_level_user_method(def_node, receiver, arg_types)
-        infer_user_method_return(def_node, receiver, arg_types)
+      def infer_top_level_user_method(def_node, receiver, arg_types, block_type = nil)
+        infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
       rescue StandardError
         nil
       end
@@ -1745,14 +1995,15 @@ module Rigor
           try_project_singleton_inference(receiver, node, inner_args, method_name: inner_name)
       end
 
-      def try_user_method_inference(receiver, call_node, arg_types, method_name: call_node.name)
+      def try_user_method_inference(receiver, call_node, arg_types, method_name: call_node.name, block_type: nil)
         return nil unless user_inference_receiver?(receiver)
 
         def_node, owner = resolve_user_def_with_owner(receiver.class_name, method_name)
         return nil if def_node.nil?
 
         result = infer_user_method_return(def_node, receiver, arg_types,
-                                          self_fold_safe: fold_safe_call_receiver?(call_node, receiver))
+                                          self_fold_safe: fold_safe_call_receiver?(call_node, receiver),
+                                          yield_type: block_type)
         return result if result.nil?
 
         degrade_if_overridable(result, owner, method_name, :instance)
@@ -1823,13 +2074,14 @@ module Rigor
       # The OWNER — not the receiver class — is what the overridable gate keys on, exactly as the instance
       # side does: adopting `Base`'s literal return is unsound when a subclass redefines the method, and
       # after this change the resolved body is routinely not the receiver's own.
-      def try_singleton_method_inference(receiver, call_node, arg_types, method_name: call_node.name)
+      def try_singleton_method_inference(receiver, call_node, arg_types, method_name: call_node.name,
+                                         block_type: nil)
         return nil unless receiver.is_a?(Type::Singleton)
 
         def_node, owner = resolve_singleton_def_with_owner(receiver.class_name, method_name)
         return nil if def_node.nil?
 
-        result = infer_user_method_return(def_node, receiver, arg_types)
+        result = infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
         return result if result.nil?
 
         degrade_if_overridable(result, owner, method_name, :singleton)
@@ -1857,9 +2109,11 @@ module Rigor
       # body the project itself wrote. Which of the two tiers applies is decided by the receiver carrier —
       # `Singleton[Foo]` when the constant names a class or module, `Nominal[…]` when it holds an ordinary
       # object (#320) — so the two are mutually exclusive and consulting both is one resolution attempt.
-      def try_project_singleton_inference(receiver, call_node, arg_types, method_name: call_node.name)
-        try_singleton_method_inference(receiver, call_node, arg_types, method_name: method_name) ||
-          try_singleton_object_constant_inference(receiver, call_node, arg_types, method_name: method_name)
+      def try_project_singleton_inference(receiver, call_node, arg_types, method_name: call_node.name,
+                                          block_type: nil)
+        kwargs = { method_name: method_name, block_type: block_type }
+        try_singleton_method_inference(receiver, call_node, arg_types, **kwargs) ||
+          try_singleton_object_constant_inference(receiver, call_node, arg_types, **kwargs)
       end
 
       # #320 — resolves a call whose receiver is a constant holding an ordinary object with a `class << Const`
@@ -1867,13 +2121,14 @@ module Rigor
       # that object, so the receiver carrier is passed through unchanged. Own-constant only, and only for a
       # name the project actually recorded — a miss degrades to today's `Dynamic[top]`, never a false
       # resolution. `Singleton` receivers never reach here: {#try_singleton_method_inference} owns them.
-      def try_singleton_object_constant_inference(receiver, call_node, arg_types, method_name: call_node.name)
+      def try_singleton_object_constant_inference(receiver, call_node, arg_types, method_name: call_node.name,
+                                                  block_type: nil)
         return nil unless receiver.is_a?(Type::Nominal)
 
         def_node = SingletonObjectConstant.def_node_for(call_node, receiver, method_name, scope)
         return nil if def_node.nil?
 
-        infer_user_method_return(def_node, receiver, arg_types)
+        infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
       rescue StandardError
         nil
       end
@@ -1907,7 +2162,8 @@ module Rigor
         # `self_pure` is issue #525's grant scan (identity-keyed by def node); it belongs here because it
         # is a pure function of the same frozen index trio — the sibling resolver it walks reads nothing
         # else.
-        by_super[scope.discovered_includes] ||= { name: {}, user_def: {}, self_pure: {}.compare_by_identity }
+        by_super[scope.discovered_includes] ||=
+          { name: {}, user_def: {}, self_pure: {}.compare_by_identity, yields: {}.compare_by_identity }
       end
 
       def resolve_user_def_through_ancestors(class_name, method_name)
@@ -2078,14 +2334,6 @@ module Rigor
       INFERENCE_SUMMARY_KEY = :__rigor_user_method_return_summary__
       private_constant :INFERENCE_SUMMARY_KEY
 
-      # Monotonic per-thread counter, bumped once each time `consult_summary` actually reads an in-flight
-      # fixpoint assumption (ADR-55 slice 2). A method return computed across an interval in which this
-      # counter does NOT move depended on no transient Kleene iterate, so it is FINAL and safe to memoise —
-      # even when the `summaries` table is non-empty because some unrelated outermost frame merely *seeded*
-      # (but never consulted) its own entry. See `infer_user_method_return`'s post-hoc memo gate.
-      SUMMARY_CONSULT_COUNTER_KEY = :__rigor_user_method_summary_consults__
-      private_constant :SUMMARY_CONSULT_COUNTER_KEY
-
       # Per-thread append-only log of the seed depths of every in-flight summary `consult_summary` read
       # (ADR-55 slice 2 mutual-recursion soundness fix, 2026-06-12). Each fixpoint owner records the guard
       # stack size at seed time on its entry (`depth:`); a consult appends the consulted entry's depth here.
@@ -2248,9 +2496,15 @@ module Rigor
       # the body both qualify. It does NOT need its own memo-key slot here — the bit is observable on the
       # built `body_scope`, which is where every downstream consumer (the memo key, the recursion context)
       # reads it from, so the two can never disagree.
-      def infer_user_method_return(def_node, receiver, arg_types, self_fold_safe: false)
+      #
+      # `yield_type` (issue #720) is the OTHER call-site-varying input, and unlike `self_fold_safe` it is
+      # not observable on the body scope, so it does need its own memo-key slot. It is dropped for a def
+      # that cannot reach a `yield` — nearly all of them — which keeps the key shape constant for the
+      # methods the memo actually carries and confines the extra dimension to yielding callees.
+      def infer_user_method_return(def_node, receiver, arg_types, self_fold_safe: false, yield_type: nil)
         return nil if def_node.body.nil?
 
+        yield_type = nil unless yield_type && body_yields?(def_node)
         body_scope = build_user_method_body_scope(def_node, receiver, arg_types,
                                                   self_fold_safe: self_fold_safe)
         return nil if body_scope.nil?
@@ -2283,42 +2537,87 @@ module Rigor
         # outermost method and thereafter the old `summaries.empty?` gate disabled the memo for every nested
         # call, re-walking the shared sub-readers combinatorially (~932k body evaluations for ~20 tiny
         # methods). The computation itself lives in `compute_user_method_return`.
-        unless memo_candidate?(stack, plain_signature)
-          trace_memo_refusal(stack, plain_signature)
-          return compute_user_method_return(def_node, body_scope, stack, summaries,
+        # Issue #720 — the frame the body's `yield`s read, installed for the whole inference (the memo key
+        # below reads it back from here rather than taking a second parameter, so key and frame cannot
+        # disagree). It is installed even when nil, which is what stops a blockless callee reached from
+        # inside a yielding body from inheriting the outer caller's block.
+        ExpressionTyper.with_yield_value_type(yield_type) do
+          unless memo_candidate?(stack, plain_signature)
+            trace_memo_refusal(stack, plain_signature)
+            next compute_user_method_return(def_node, body_scope, stack, summaries,
                                             receiver, arg_types, plain_signature)
+          end
+
+          # INVARIANT (ADR-46 recording soundness, ADR-84 WD2) — the deep cross-file dependency edges (the
+          # reads a callee body's dispatches perform through the instrumented `Scope` accessors) are recorded,
+          # per consumer, only as a side effect of evaluating that body, and a memo hit serves the return
+          # WITHOUT re-evaluating it. Since the bucket is run-scoped, hits CROSS consumer-file boundaries, so
+          # every cross-file hit is PAIRED WITH CACHE-AND-REPLAY of the callee's read-set: under recording,
+          # the first evaluation of a key captures the recorder events of its body walk
+          # (`DependencyRecorder.capture` — observe-and-forward, so the first consumer's own record is
+          # untouched) onto the entry, and a hit replays that set into the current consumer's accumulator
+          # (`DependencyRecorder.replay`, which re-applies the per-consumer self-read filter). A memo hit is
+          # thereby edge-equivalent to a fresh body evaluation for EVERY consumer. The naive alternative —
+          # bypassing the memo while the recorder is active — measured >200x wall on analyzer-shaped files
+          # (ActiveStorage video_analyzer.rb's subtree, 0.43s -> >90s; PR #79) and stays rejected. Pinned by
+          # spec/rigor/inference/return_memo_recording_spec.rb (cross-file replay completeness) and
+          # dependency_recorder_spec.rb's transitive deep-edge example.
+          consult_and_store_return_memo(def_node, body_scope, stack, summaries,
+                                        receiver, arg_types, plain_signature)
         end
+      end
+
+      # Issue #720 — the constructs that own a `yield` written inside them, so a scan for "can this def's
+      # body reach a `yield` that names THIS def's block?" must stop at them. A nested `def` / `class` /
+      # `module` / `class << self` starts a new method-block binding; a block or a lambda does NOT — `yield`
+      # inside `[1, 2].each { yield }` still calls the enclosing method's block, which is precisely the
+      # `each`-wrapper idiom this fix has to keep seeing.
+      YIELD_BOUNDARY_NODES = Set[
+        Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode
+      ].freeze
+      private_constant :YIELD_BOUNDARY_NODES
 
-        # INVARIANT (ADR-46 recording soundness, ADR-84 WD2) — the deep cross-file dependency edges (the
-        # reads a callee body's dispatches perform through the instrumented `Scope` accessors) are recorded,
-        # per consumer, only as a side effect of evaluating that body, and a memo hit serves the return
-        # WITHOUT re-evaluating it. Since the bucket is run-scoped, hits CROSS consumer-file boundaries, so
-        # every cross-file hit is PAIRED WITH CACHE-AND-REPLAY of the callee's read-set: under recording,
-        # the first evaluation of a key captures the recorder events of its body walk
-        # (`DependencyRecorder.capture` — observe-and-forward, so the first consumer's own record is
-        # untouched) onto the entry, and a hit replays that set into the current consumer's accumulator
-        # (`DependencyRecorder.replay`, which re-applies the per-consumer self-read filter). A memo hit is
-        # thereby edge-equivalent to a fresh body evaluation for EVERY consumer. The naive alternative —
-        # bypassing the memo while the recorder is active — measured >200x wall on analyzer-shaped files
-        # (ActiveStorage video_analyzer.rb's subtree, 0.43s -> >90s; PR #79) and stays rejected. Pinned by
-        # spec/rigor/inference/return_memo_recording_spec.rb (cross-file replay completeness) and
-        # dependency_recorder_spec.rb's transitive deep-edge example.
-        consult_and_store_return_memo(def_node, body_scope, stack, summaries,
-                                      receiver, arg_types, plain_signature)
+      # Whether `def_node`'s body can reach a `yield`, memoised by def-node identity: it gates the
+      # per-call-site memo dimension above and would otherwise be re-walked once per call site of every
+      # user method. It rides in {#class_graph_buckets} for LIFETIME, not for correctness — a pure
+      # function of the AST depends on none of the tables that bucket keys on, but a store that is
+      # replaced with the analysis generation cannot outlive the nodes it holds.
+      def body_yields?(def_node)
+        cache = class_graph_buckets[:yields]
+        return cache[def_node] if cache.key?(def_node)
+
+        cache[def_node] = yield_reachable?(def_node.body)
+      end
+
+      def yield_reachable?(node)
+        return false if node.nil?
+        return true if node.is_a?(Prism::YieldNode)
+
+        node.rigor_each_child do |child|
+          next if YIELD_BOUNDARY_NODES.include?(child.class)
+
+          return true if yield_reachable?(child)
+        end
+        false
       end
 
       # The candidate-frame memo path: consult the current run generation's bucket, and on a miss compute
       # and store a FINAL result. Reached only when `memo_candidate?` held (see `infer_user_method_return`).
-      # The store gate (ADR-84 WD3): a result is stored when the ADR-55 fixpoint consult counter did not
-      # move across the compute (the WD0 `MEMO_REFUSE_CONSULT_TAINTED` non-store) AND no transient-machinery
-      # event during the bracket referenced a stack frame BELOW the bracket's entry depth (see
-      # TRANSIENT_EVENT_DEPTHS_KEY). Below-entry events — an ancestor's in-flight Kleene iterate read by a
-      # guard hit, a shared-fuel exhaustion, a possibly-ancestor-caused WD1 clamp — mean the ancestor
-      # context influenced `result`, which a standalone recompute would not reproduce; at-or-above-entry
-      # events are the compute's own deterministic machinery (its own converged fixpoint, sub-cycles that
-      # opened and closed inside the bracket) and do not block the store. A top-of-stack compute (entry
-      # depth 0) is standalone by construction. A hit under ADR-46 recording replays the entry's captured
-      # read-set into the current consumer (see the INVARIANT comment at the call site).
+      # The store gate (ADR-84 WD3): a result is stored when no transient-machinery event during the
+      # bracket referenced a stack frame BELOW the bracket's entry depth (see TRANSIENT_EVENT_DEPTHS_KEY).
+      # A separate ADR-55 fixpoint-consult bracket counter used to sit in front of this test; it is gone
+      # (issue #875) because the event log already subsumes it — the sole `consult_summary` call site is
+      # the in-cycle guard hit, which logs its event at the consulted owner's position first, so a consult
+      # that could taint a bracket is a below-entry event by construction. Below-entry events — an
+      # ancestor's in-flight Kleene iterate read by a guard hit, a shared-fuel exhaustion, a
+      # possibly-ancestor-caused WD1 clamp — mean the ancestor context influenced `result`, which a
+      # standalone recompute would not reproduce; at-or-above-entry events are the compute's own
+      # deterministic machinery (its own converged fixpoint, sub-cycles that opened and closed inside the
+      # bracket) and do not block the store. A top-of-stack compute (entry depth 0) is standalone by
+      # construction. ADR-84 WD6 adds one exemption on top: a tainted result that
+      # is already `Dynamic[top]` is stored anyway — see `top_result?`. A hit under ADR-46 recording
+      # replays the entry's captured read-set into the current consumer (see the INVARIANT comment at the
+      # call site).
       def consult_and_store_return_memo(def_node, body_scope, stack, summaries,
                                         receiver, arg_types, plain_signature)
         per_def = (return_memo_bucket[def_node] ||= {})
@@ -2327,9 +2626,14 @@ module Rigor
         # was foldable and `Dynamic[top]` when it was not. Without it in the key the first call site to
         # reach a def would poison every later one with the other polarity. It is read off the body scope
         # rather than passed in, so the key cannot drift from the scope that produced the result.
+        # Issue #720 — the FOURTH such dimension, and it is read off the installed frame rather than
+        # passed in for the same reason: a yielding callee's return depends on the block THIS call site
+        # hands it, so two call sites passing differently-typed blocks must not share an entry. It is nil
+        # for every def that cannot reach a `yield`, which is where the memo's mass is.
         memo_key = [receiver.describe(:short),
                     arg_types.map { |type| type.describe(:short) },
-                    body_scope.struct_fold_safe?(:self)]
+                    body_scope.struct_fold_safe?(:self),
+                    ExpressionTyper.current_yield_value_type&.describe(:short)]
         if (entry = per_def[memo_key])
           BudgetTrace.hit(BudgetTrace::MEMO_HITS)
           Analysis::DependencyRecorder.replay(entry.read_set) if Analysis::DependencyRecorder.active?
@@ -2340,13 +2644,10 @@ module Rigor
 
         entry_depth = stack.size
         event_mark = transient_event_mark
-        consults_before = summary_consult_count
         result, read_set = compute_with_read_capture(def_node, body_scope, stack, summaries,
                                                      receiver, arg_types, plain_signature)
 
-        if summary_consult_count != consults_before
-          BudgetTrace.hit(BudgetTrace::MEMO_REFUSE_CONSULT_TAINTED)
-        elsif context_tainted?(event_mark, entry_depth)
+        if context_tainted?(event_mark, entry_depth) && !top_result?(result)
           BudgetTrace.hit(BudgetTrace::MEMO_REFUSE_TRANSIENT)
         else
           per_def[memo_key] = MemoEntry.new(result: result, read_set: read_set,
@@ -2359,19 +2660,48 @@ module Rigor
         Thread.current[TRANSIENT_EVENT_DEPTHS_KEY]&.size || 0
       end
 
-      def summary_consult_count
-        Thread.current[SUMMARY_CONSULT_COUNTER_KEY] || 0
-      end
-
       # ADR-84 WD3 — true when a transient-machinery event logged during the bracket (entries past
       # `event_mark`) referenced a frame below `entry_depth`. The log is cleared when the guard stack drains
       # (only possible mid-bracket for a top-of-stack compute, whose events are deterministic anyway), so a
       # missing / shorter log reads as untainted.
+      #
+      # Scanned by index rather than over `log[event_mark..]`: the log is append-only for the whole
+      # outermost entry, so the suffix slice allocated an array per candidate compute — a term quadratic in
+      # the event count, and the `ary_ensure_room_for_push` / GC-sweep profile issue #870 sampled.
       def context_tainted?(event_mark, entry_depth)
         log = Thread.current[TRANSIENT_EVENT_DEPTHS_KEY]
         return false if log.nil? || log.size <= event_mark
 
-        log[event_mark..].any? { |depth| depth < entry_depth }
+        index = event_mark
+        size = log.size
+        while index < size
+          return true if log[index] < entry_depth
+
+          index += 1
+        end
+        false
+      end
+
+      # ADR-84 WD6 (issue #872) — the top-result exemption to the WD3 store gate.
+      #
+      # WD3 refuses a store whenever the bracket saw a below-entry transient event, because such a result
+      # embeds an ancestor's in-flight state and a standalone recompute need not reproduce it. Inside a
+      # strongly connected component of mutually recursive methods that holds for nearly every frame — each
+      # nested compute re-enters a signature already on the guard stack and the guard site logs at the
+      # ancestor's shallower position — so nothing in the component is ever memoised and every call edge
+      # re-walks its whole callee subtree. Issue #870's fixture measured 18,412 of 18,436 memo misses
+      # computing a result and discarding it, and rufo 0.18.2's `formatter.rb` did not finish in 25 minutes.
+      #
+      # The exemption: when the computed result is `Dynamic[top]` the entry carries no context-dependent
+      # information to serve. `untyped` is the lattice top and the ADR-5 degradation floor — the only way a
+      # standalone recompute can differ is by being MORE precise, so serving the stored top can never
+      # surface a type the ancestor context invented, and can never raise a diagnostic that a fresh
+      # evaluation would not (nothing is reported off `untyped`). The cost is a possible missed diagnostic
+      # where the untainted recompute would have been precise; the corpus evidence that this does not
+      # happen in practice is the byte-identical `--format json` runs over `lib`, `plugins/*/lib`,
+      # `examples/*/lib` and the survey projects recorded on issue #872.
+      def top_result?(result)
+        result.equal?(Type::Combinator.untyped)
       end
 
       # ADR-84 WD2 — the memo-miss compute, wrapped in a `DependencyRecorder.capture` window when ADR-46
@@ -2444,10 +2774,10 @@ module Rigor
       # stable across the body walk, that is necessary (but not sufficient) for a FINAL result — this plain
       # signature must not itself be on the recursion guard stack (else we are inside its own cycle,
       # returning a Kleene iterate by construction). Sufficiency is decided post-hoc in
-      # `consult_and_store_return_memo` by the two bracket counters (fixpoint consults + ADR-84 WD3
-      # transient-machinery events) — so unlike the prior form this deliberately does NOT refuse while a
-      # constant-arg unroll is in flight: a nested frame whose compute finishes without a single transient
-      # event ran exactly as it would standalone (fuel consumption without exhaustion is invisible), and
+      # `consult_and_store_return_memo` by the ADR-84 WD3 transient-machinery event bracket — so unlike
+      # the prior form this deliberately does NOT refuse while a constant-arg unroll is in flight: a
+      # nested frame whose compute finishes without a single transient event ran exactly as it would
+      # standalone (fuel consumption without exhaustion is invisible), and
       # the blanket exclusion refused 82% of mail's body evaluations for such final results (ADR-84).
       def memo_candidate?(stack, plain_signature)
         stack.none? { |frame| plain_part(frame) == plain_signature }
@@ -2578,7 +2908,6 @@ module Rigor
         summaries = context.summaries
         depth = seed_fixpoint_summary(summaries, plain_signature)
         consult_depths = (Thread.current[SUMMARY_CONSULT_DEPTHS_KEY] ||= [])
-        computed = nil
 
         RECURSION_FIXPOINT_CAP.times do |iteration|
           summaries[plain_signature][:consulted] = false
@@ -2612,9 +2941,15 @@ module Rigor
             return resolved unless resolved.nil?
           end
 
-          step = fixpoint_step(summaries, plain_signature, computed, iteration)
-          return step unless step == :continue
+          converged = fixpoint_step(summaries, plain_signature, computed, iteration)
+          return converged if converged
         end
+
+        # Out of iterations and still unstable. The collapse is the loop's own tail rather than a branch
+        # inside `fixpoint_step`: `Integer#times` yields its receiver when no iteration returns, so a
+        # tail-less loop reads as a path that returns an Integer summary (the `def.return-type-mismatch`
+        # on `return_type_for` this shape retired), and the loop, not the step, owns its cap.
+        collapse_fixpoint_cap(summaries, plain_signature)
       end
 
       # Seeds the thread-local summary entry for a fixpoint owner: the `bot` Kleene seed plus the
@@ -2650,8 +2985,10 @@ module Rigor
 
       # One Kleene-iteration step of the fixpoint loop. Joins `computed` into the running assumption
       # (widening value-pinned constituents on the final permitted iteration to force convergence) and
-      # either returns a final type — convergence, or the capped `untyped` collapse — or `:continue` to
-      # request another body evaluation, having advanced the stored assumption. ADR-55 WD2.
+      # returns the converged type, or `nil` — no final type yet — having advanced the stored assumption
+      # so the caller's next body evaluation reads the wider iterate. The step never decides that the
+      # loop is over: whether another evaluation follows is the caller's cap, and a `nil` on the final
+      # iteration lands in `collapse_fixpoint_cap`. ADR-55 WD2.
       def fixpoint_step(summaries, plain_signature, computed, iteration)
         assumption = summaries[plain_signature][:assumption]
         last_iteration = iteration == RECURSION_FIXPOINT_CAP - 1
@@ -2662,17 +2999,19 @@ module Rigor
         # (joining it back changes nothing).
         return candidate if joined == assumption
 
-        if last_iteration
-          # Out of iterations and still unstable — collapse to today's widening behaviour. ADR-84 WD3: the
-          # cap is a per-owner constant, so the event references the owner's own frame.
-          note_transient_fallback(BudgetTrace::RECURSION_FIXPOINT_CAP, own_guard_frame_position)
-          scope.record_dynamic_origin(@typing_node, DynamicOrigin::ANALYZER_BUDGET_CUTOFF) if @typing_node
-          summaries[plain_signature][:assumption] = Type::Combinator.untyped
-          return Type::Combinator.untyped
-        end
-
         summaries[plain_signature][:assumption] = joined
-        :continue
+        nil
+      end
+
+      # The capped collapse: `RECURSION_FIXPOINT_CAP` evaluations advanced the assumption without
+      # converging, so the summary degrades to today's widening behaviour, `untyped`, parked in the
+      # assumption for any consumer that still reads it. ADR-84 WD3: the cap is a per-owner constant, so
+      # the event references the owner's own frame.
+      def collapse_fixpoint_cap(summaries, plain_signature)
+        note_transient_fallback(BudgetTrace::RECURSION_FIXPOINT_CAP, own_guard_frame_position)
+        scope.record_dynamic_origin(@typing_node, DynamicOrigin::ANALYZER_BUDGET_CUTOFF) if @typing_node
+        summaries[plain_signature][:assumption] = Type::Combinator.untyped
+        Type::Combinator.untyped
       end
 
       # Rebuilds the user-method body scope with every bound positional parameter widened to its nominal
@@ -3109,22 +3448,87 @@ module Rigor
         nil
       end
 
+      EMPTY_BREAK_ARMS = [].freeze
+      private_constant :EMPTY_BREAK_ARMS
+
+      # The types the `break`s that terminate THIS call carry out of it, for {#call_dispatch_type_for} to union
+      # with the result the dispatch tiers computed (issue #853).
+      #
+      # The syntactic scan runs first and answers "none" for every call whose block cannot reach a block-level
+      # `break` — nearly all of them — so only that small minority pays the body evaluation. A `break` under a
+      # nested block, lambda, `def`, or loop targets THAT construct instead; {JUMP_BOUNDARY_NODES} stops the
+      # scan there, and the identity filter drops the ones the sink still collects because the nested
+      # construct is walked under the same installation. `break` with no argument carries nil, so the call
+      # becomes optional — which is what Ruby does.
+      #
+      # A failure yields no arms rather than propagating, matching {#block_return_type_for}: a call typed
+      # without its break arms is the pre-#853 answer, while a raise here would take out the whole call.
+      def call_break_arm_types(node, receiver_override: nil)
+        block_node = node.block
+        return EMPTY_BREAK_ARMS unless block_node.is_a?(Prism::BlockNode)
+
+        body = block_node.body
+        return EMPTY_BREAK_ARMS if body.nil? || !block_level_jump?(body, Prism::BreakNode)
+
+        collect_break_arm_types(node, block_node, body, receiver_override)
+      rescue StandardError
+        EMPTY_BREAK_ARMS
+      end
+
+      # Evaluates the block body once under a `break`-value sink, in the same entry scope the block-return pass
+      # uses, so each arm is typed in the scope that actually reaches it — a `break v` after `v = "s"`
+      # contributes `"s"`, not the entry binding — and an arm on a branch the analysis proved dead is never
+      # reached at all.
+      def collect_break_arm_types(call_node, block_node, body, receiver_override)
+        targets = block_level_jump_nodes(body, Prism::BreakNode)
+        receiver = receiver_override || call_receiver_type_for(call_node)
+        return EMPTY_BREAK_ARMS if receiver.nil?
+
+        narrowed_self = MacroBlockSelfType.narrow_self_type_for(
+          scope: scope, call_node: call_node, receiver_type: receiver
+        )
+        block_scope = block_entry_scope(
+          block_node, break_arm_param_types(call_node, receiver), narrowed_self_type: narrowed_self
+        )
+        _result, collected = StatementEvaluator.with_break_value_sink do
+          without_block_body_threading { block_scope.evaluate(body) }
+        end
+        collected.filter_map { |jump, type| type if targets.key?(jump) }
+      end
+
+      def break_arm_param_types(call_node, receiver)
+        MethodDispatcher.expected_block_param_types(
+          receiver_type: receiver,
+          method_name: call_node.name,
+          arg_types: call_arg_types(call_node),
+          environment: scope.environment
+        )
+      end
+
       def block_return_for(block_arg, expected, narrowed_self_type: nil)
         case block_arg
         when Prism::BlockNode
-          bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_arg)
-          # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
-          # yielding method's business, so the return-typing pass must see the same unmodelled-self mark.
-          block_scope = bindings.reduce(scope.entering_opaque_block) do |acc, (name, type)|
-            acc.with_local(name, type)
-          end
-          block_scope = block_scope.with_self_type(narrowed_self_type) if narrowed_self_type
-          type_block_body(block_arg, block_scope)
+          type_block_body(block_arg, block_entry_scope(block_arg, expected, narrowed_self_type: narrowed_self_type))
         when Prism::BlockArgumentNode
           symbol_block_return_type(block_arg, expected)
         end
       end
 
+      # The scope a block body is typed under: the surrounding scope plus the parameter bindings the receiving
+      # method's signature implies.
+      #
+      # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
+      # yielding method's business, so the return-typing pass must see the same unmodelled-self mark.
+      def block_entry_scope(block_node, expected, narrowed_self_type: nil)
+        bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_node)
+        block_scope = bindings.reduce(scope.entering_opaque_block) do |acc, (name, type)|
+          acc.with_local(name, type)
+        end
+        return block_scope unless narrowed_self_type
+
+        block_scope.with_self_type(narrowed_self_type)
+      end
+
       # `&:symbol` desugars to a one-arg Proc that dispatches `symbol` against its argument. When the param
       # type is known and the resulting inner dispatch is precise, this returns the precise carrier;
       # otherwise it returns `Dynamic[Top]` (still non-nil) so the outer dispatcher selects the
@@ -3157,13 +3561,95 @@ module Rigor
       # — which threads scope statement by statement through `StatementEvaluator` — held `42` for the very
       # same node. {#threaded_block_body_type} closes that gap by reusing the main pass's evaluator; a decline
       # keeps the tail-only answer verbatim.
+      #
+      # Issue #841: the fall-through tail is only ONE of the block's exits. Every `next value` that leaves this
+      # block makes `value` the block's result for that invocation, so the arms join into the value type the
+      # same way {#evaluate_body_with_returns} joins a method's early `return`s with its tail. Without the
+      # join, `ops.all? { |o| next false unless o; true }` read as `Constant[true]` and
+      # {MethodDispatcher::BlockFolding} folded the call to always-truthy on a program that really can answer
+      # false — a warning on correct code.
       def type_block_body(block_node, block_scope)
         body = block_node.body
         return Type::Combinator.constant_of(nil) if body.nil?
 
+        arms = block_level_next_arms(body)
+        return block_body_type_joining_nexts(body, block_scope, arms) if arms
+
         threaded_block_body_type(body, block_scope) || block_scope.type_of(body)
       end
 
+      # Evaluates the body once under a `next` sink and joins the arms that leave THIS block with the
+      # fall-through tail the same evaluation produced. Both halves come from one `StatementEvaluator` run, so
+      # each arm is typed in the scope that actually reaches it — a `next y` after `y = "s"` contributes
+      # `"s"`, not the entry scope's stale binding.
+      #
+      # This run ignores the {#block_body_threading_suppressed?} flag that gates the precision fold: that flag
+      # bounds the cost of an OPTIONAL widening, while skipping the join re-opens a false-positive class. It
+      # still SETS the flag for the duration, so nothing folds below it and the cost stays one evaluation per
+      # block-level `next` — a shape that is a small minority of blocks.
+      #
+      # A failure falls back to the tail-only answer rather than propagating, for the same reason
+      # {#threaded_block_body_type} does: the enclosing `block_return_type_for` rescue would otherwise report
+      # "no block" to the dispatcher, a far larger regression than a wide block return.
+      def block_body_type_joining_nexts(body, block_scope, arms)
+        (fall_through, _exit_scope), collected = StatementEvaluator.with_next_sink do
+          without_block_body_threading { block_scope.evaluate(body) }
+        end
+        joined = collected.filter_map { |node, type| type if arms.key?(node) }
+        joined.empty? ? fall_through : Type::Combinator.union(fall_through, *joined)
+      rescue StandardError
+        block_scope.type_of(body)
+      end
+
+      # The identity-keyed set of `next` nodes whose value is THIS block's value — reachable from the body
+      # without crossing a {JUMP_BOUNDARY_NODES} construct that retargets them — or nil for "do not join".
+      #
+      # nil means "do not join": a body with no block-level `next` keeps today's path exactly, and pays only
+      # the allocation-free scan that answers so. A co-resident block-level `break` used to decline here as
+      # well, because its value was dropped and joining the `next` arms would have dressed a still-incomplete
+      # answer as a complete one; since issue #853 the `break` arms are unioned into the yielding call
+      # ({#call_break_arm_types}), so the two exits are modelled at their own levels and neither blocks the
+      # other.
+      def block_level_next_arms(body)
+        return nil unless block_level_jump?(body, Prism::NextNode)
+
+        block_level_jump_nodes(body, Prism::NextNode)
+      end
+
+      # True when a `klass` jump is reachable from `node` without crossing a construct that retargets it.
+      # Allocation-free and early-exiting: this is the scan every block body pays, and the overwhelming
+      # majority of them answer false on it.
+      def block_level_jump?(node, klass)
+        return false if node.nil?
+        return true if node.is_a?(klass)
+
+        node.rigor_each_child do |child|
+          next if JUMP_BOUNDARY_NODES.include?(child.class)
+
+          return true if block_level_jump?(child, klass)
+        end
+        false
+      end
+
+      # The identity-keyed set of `klass` jumps that target THIS block — every one {#block_level_jump?} would
+      # answer true for, rather than the first. The sinks in `StatementEvaluator` also collect jumps from
+      # nested blocks / loops / defs evaluated under the same installation, so the consumer filters against
+      # this set by node identity.
+      def block_level_jump_nodes(body, klass)
+        found = {}.compare_by_identity
+        collect_block_level_jumps(body, klass, found)
+        found
+      end
+
+      def collect_block_level_jumps(node, klass, found)
+        found[node] = true if node.is_a?(klass)
+        node.rigor_each_child do |child|
+          next if JUMP_BOUNDARY_NODES.include?(child.class)
+
+          collect_block_level_jumps(child, klass, found)
+        end
+      end
+
       # Re-typing the whole body would be wrong to do unconditionally: this path runs for EVERY block-bearing
       # call, and the statements ahead of the tail are pure cost whenever the tail does not depend on them.
       # Three declines keep that cost where the defect actually is, each falling back to the tail-only path:
@@ -3252,18 +3738,27 @@ module Rigor
       private_constant :VARIABLE_READ_NODES
 
       # A `next` / `break` that leaves THIS block carries a value the fold cannot see: `evaluate(body).first`
-      # is the fall-through value only, and no next-value join into the block return exists (`type_of_jump`
-      # types both as `Bot`). So `m.synchronize do next 5 if flag; v = 42; v end` really can answer 5 at
-      # runtime, and threading would type it `42`. Both forms escape with a value — `next v` is the block's
-      # value for that yield, `break v` is the yielding CALL's value — so both must decline.
+      # is the fall-through value only.
+      #
+      # The `next` entry no longer fires: {#type_block_body} routes such a body past this scan entirely, since
+      # issue #841 joins those arms into the block's value. It is kept because the question this predicate
+      # answers ("can this prefix escape with a value the fall-through misses?") is the caller's premise
+      # rather than the caller's filter restated.
+      #
+      # The `break` entry still fires, and since issue #853 it is conservative rather than load-bearing: the
+      # arms are unioned into the CALL ({#call_break_arm_types}), so the missing value is no longer missing.
+      # What the decline still costs is the threaded tail — `m.synchronize do break 5 if flag; v = 42; v end`
+      # answers `5 | Dynamic[top]` where threading would reach `5 | 42`. Lifting it widens no answer and
+      # invents no fact, but it moves the type of every block that carries a `break`, so it is left to a
+      # change that can measure that.
       JUMP_NODES = Set[Prism::NextNode, Prism::BreakNode].freeze
       private_constant :JUMP_NODES
 
       # Constructs that RETARGET a `next` / `break` nested inside them, so a jump below one of these says
-      # nothing about our block's value and must not trigger the decline. A nested `BlockNode` / `LambdaNode`
-      # is the jump's own block (`do xs.each { next 1 }; v = 42; v end` threads soundly — the inner `next`
-      # ends the inner iteration); a loop consumes both forms (`while … next 5 … end` continues the loop);
-      # a `DefNode` body is a different method entirely.
+      # nothing about our block's value — it neither triggers the decline nor joins as an arm. A nested
+      # `BlockNode` / `LambdaNode` is the jump's own block (`do xs.each { next 1 }; v = 42; v end` threads
+      # soundly — the inner `next` ends the inner iteration); a loop consumes both forms (`while … next 5 …
+      # end` continues the loop); a `DefNode` body is a different method entirely.
       JUMP_BOUNDARY_NODES = Set[
         Prism::BlockNode, Prism::LambdaNode, Prism::DefNode,
         Prism::WhileNode, Prism::UntilNode, Prism::ForNode
@@ -3293,11 +3788,8 @@ module Rigor
       # so `[1].each { v = 5 }` really does bind the outer `v`, and `[1].each { outer << 1 }` really does
       # mutate the outer `outer`), while a jump counts only above the nearest {JUMP_BOUNDARY_NODES} boundary.
       def tail_depends_on_body_binding?(statements)
-        written = Set.new
-        statements[0...-1].each do |statement|
-          return false unless prefix_statement_jump_free?(statement, written, false)
-        end
-        return false if written.empty?
+        written = prefix_written_names(statements)
+        return false if written.nil?
 
         Source::NodeWalker.each(statements.last) do |node|
           return true if VARIABLE_READ_NODES.include?(node.class) && written.include?(node.name)
@@ -3305,6 +3797,35 @@ module Rigor
         false
       end
 
+      # WHICH names the predicate above answers YES on — every name the tail observes that the prefix binds
+      # or mutates in place. Only the arity-cap floor ({#unanswered_tail_dependency?}) needs them, which is
+      # why the predicate is not written over this method: the predicate runs for every multi-statement block
+      # body and short-circuits on the first hit, the floor runs for a handful of calls. Sharing
+      # {#prefix_written_names} is what keeps the two from drifting about what the prefix binds.
+      def tail_dependent_body_names(statements)
+        written = prefix_written_names(statements)
+        return EMPTY_NAME_SET if written.nil?
+
+        Source::NodeWalker.each(statements.last).filter_map do |node|
+          node.name if VARIABLE_READ_NODES.include?(node.class) && written.include?(node.name)
+        end.to_set
+      end
+
+      # The names the prefix binds or mutates in place, or `nil` when the scan declines — a prefix that can
+      # jump out of the block with a value the fall-through misses, or one that binds nothing at all.
+      def prefix_written_names(statements)
+        written = Set.new
+        statements[0...-1].each do |statement|
+          return nil unless prefix_statement_jump_free?(statement, written, false)
+        end
+        return nil if written.empty?
+
+        written
+      end
+
+      EMPTY_NAME_SET = Set.new.freeze
+      private_constant :EMPTY_NAME_SET
+
       # True when `node` cannot jump out of the block with a value, collecting into `written` the names it
       # binds (a variable-write node) or mutates in place (a {MutationWidening::SHAPE_MUTATORS} call, through
       # every variable its receiver can evaluate to) on the way down. `retargeted` is true once the descent
@@ -3370,7 +3891,38 @@ module Rigor
         per_position = per_element_block_results(call_node.block, element_types)
         return nil if per_position.nil? || per_position.any?(&:nil?)
 
-        assemble_per_element_result(call_node.name, per_position, element_types)
+        assemble_per_element_result(call_node.name, per_position, element_types) ||
+          find_family_floor(call_node.name, element_types)
+      end
+
+      # The honest answer for `find` / `detect` / `find_index` / `index` when this fold walked every position
+      # and the assembler still could not decide — which happens for exactly one reason: some position's
+      # predicate is not a `Constant`, so "the first matching one" is not a static fact.
+      #
+      # Falling through to the dispatcher was WRONG for this family, and issue #617 residue (1) is the bill:
+      # `seen = 0; [1, 2].find do |e| seen += 1; seen == 2 end` answered `nil` where the runtime answers `2`.
+      # The dispatcher's `BlockFolding` reads ONE block-return type, typed from the call's ENTRY scope, so a
+      # predicate over a rebound capture pins the first iteration (`Constant[false]`) and
+      # `FALSEY_BLOCK_NIL_METHODS` short-circuits the whole call to `nil`. This walk already knows better: it
+      # typed the predicate per position and saw that it does not fold. Answering here is what keeps that
+      # knowledge from being thrown away in favour of a worse-informed tier.
+      #
+      # The floor is what `find` can return and no tighter: one of the receiver's own elements, or `nil` when
+      # no element matches. Value pinning survives because it is still true of every candidate — `find` hands
+      # back an element, it does not compute one. `find_index` / `index` answer a position in the receiver, so
+      # `Integer?` is their floor.
+      #
+      # Nothing else in {PER_ELEMENT_TUPLE_METHODS} takes a floor: `map`'s assembler cannot decline,
+      # and `select` / `reject` / `filter_map` / `flat_map` fall through to an RBS projection that is merely
+      # wider, never wrong — `BlockFolding`'s filter folds decline on a non-Constant block instead of
+      # answering.
+      def find_family_floor(method_name, element_types)
+        case method_name
+        when :find, :detect
+          Type::Combinator.union(*element_types, Type::Combinator.constant_of(nil))
+        when :find_index, :index
+          Type::Combinator.union(Type::Combinator.nominal_of("Integer"), Type::Combinator.constant_of(nil))
+        end
       end
 
       # Evaluates the call's block once per receiver element. Two block shapes are supported:
@@ -3408,10 +3960,48 @@ module Rigor
           element_types.map { |element_type| type_block_body_with_param(block, [element_type], captured: captured) }
         end
         return results.call if element_types.size <= PER_ELEMENT_THREADING_LIMIT
+        return uncapped_body_floor(element_types) if unanswered_tail_dependency?(block, captured)
 
         without_block_body_threading(&results)
       end
 
+      # Above {PER_ELEMENT_THREADING_LIMIT} the threading is suppressed, and a position is typed tail-only.
+      # For a tail that reads what the body's own prefix wrote or mutated, tail-only is not a wider answer —
+      # it is the ENTRY binding, which the prefix has already falsified.
+      #
+      # #584's cliff comment promised `Dynamic[top]` above the cap, and that held for a body-LOCAL: `[1, …,
+      # 9].map do v = e; v end` has no entry binding for `v`, so tail-only lands on `Dynamic[top]` by itself.
+      # A mutated PARAMETER has one, and issue #617 residue (2) is what it buys: `([[]] * 9).map do |a| a <<
+      # 1; a end` answered nine stale `[]`, a provably-empty array at every position of a result whose slots
+      # each hold `[1]`. Flooring the whole walk restores the promise for both shapes — the cost the cap
+      # refuses to pay is the per-position body evaluation, and declining to pay it means declining to know,
+      # not answering the pre-state.
+      #
+      # {#tail_depends_on_body_binding?} is the same predicate the threading gate uses, so "would threading
+      # have changed this tail" and "is tail-only untrustworthy here" stay one question. A body it answers
+      # false for keeps its exact tail-only fold above the cap, which is every single-statement block and
+      # every multi-statement block whose tail ignores its prefix.
+      def uncapped_body_floor(element_types)
+        Array.new(element_types.size) { Type::Combinator.untyped }
+      end
+
+      # True when the tail reads something the prefix changed that NOTHING has re-answered for this walk.
+      #
+      # `captured` is the converged binding of every outer local the block rebinds ({#per_element_captured_bindings}),
+      # and its cost is independent of the arity, so it keeps working above the cap: `total = 0; [1, …,
+      # 9].map do total += e; total end` reads `total` as the fixpoint's `Integer` at every position and needs
+      # no floor. What the cap actually withholds is the per-position body evaluation, so the names it leaves
+      # unanswered are the ones the fixpoint does not cover — a mutated block PARAMETER (issue #617 residue
+      # (2)'s `|a| a << 1; a`) or a mutated outer local the block never rebinds.
+      def unanswered_tail_dependency?(block, captured)
+        body = block.body
+        return false unless body.is_a?(Prism::StatementsNode)
+        return false if body.body.size < 2
+
+        answered = captured&.keys || []
+        tail_dependent_body_names(body.body).any? { |name| !answered.include?(name) }
+      end
+
       # Issue #587 (b) — first-iteration pinning. Every position of this fold is typed from the SAME entry
       # scope, so a body that rebinds a captured outer local answers the FIRST iteration's value at every
       # position: `total = 0; [1, 2].map do total += 1; total end` folded to `[1, 1]` (runtime `[1, 2]`), and
@@ -3456,12 +4046,44 @@ module Rigor
 
       def converged_captured_bindings(block, names, element_types)
         param_types = [Type::Combinator.union(*element_types)]
-        BodyFixpoint.converge(
+        seeds = names.to_h { |name| [name, scope.local(name)] }
+        converged = BodyFixpoint.converge(
           names: names,
-          seed_bindings: names.to_h { |name| [name, scope.local(name)] },
+          seed_bindings: seeds,
           widen: Type::Combinator.method(:widen_value_pinned),
           evaluate_body: ->(bindings) { captured_exit_bindings(block, param_types, bindings, names) }
         )
+        unmoved_pins_floored(converged, seeds)
+      end
+
+      # A name the write scan says this block REBINDS, whose fixpoint came back on exactly its value-pinned
+      # seed, is floored rather than believed.
+      #
+      # The fixpoint reads each pass's exit binding out of `StatementEvaluator`, and that evaluator only
+      # threads a write it sees as a STATEMENT: a rebind nested inside an expression — `(seen += 1) == 2` as
+      # the block's whole body — leaves the exit scope holding the entry binding, so the fixpoint converges on
+      # the seed and every position of the fold answers the first iteration again. That is issue #617 residue
+      # (1)'s one-liner, `seen = 0; [1, 2].find { |e| (seen += 1) == 2 }` answering `nil` where Ruby answers
+      # `2`: the pinned `Constant[0]` made both predicates `Constant[false]`, and `find` short-circuits on a
+      # provably-falsey block.
+      #
+      # An unmoved pin cannot be distinguished from a write that genuinely restores its own entry value
+      # (`x = 5; xs.each { x = 5 }`), so the floor gives that shape up too. It is the far cheaper side: a
+      # value-pinned seed the block rebinds is the exact pre-state this fold exists to stop trusting, and
+      # `Dynamic[top]` is the same escaping-block floor {#captured_floor} already uses. Seeds that carry no
+      # value pinning are left alone — there is no first-iteration constant in them to remove, and widening a
+      # `Nominal` here would only lose a class for nothing.
+      def unmoved_pins_floored(converged, seeds)
+        converged.to_h do |name, type|
+          seed = seeds[name]
+          next [name, type] unless type == seed && value_pinned?(seed)
+
+          [name, Type::Combinator.untyped]
+        end
+      end
+
+      def value_pinned?(type)
+        !type.nil? && Type::Combinator.widen_value_pinned(type) != type
       end
 
       # One fixpoint pass: the body evaluated from `bindings` with the block parameters bound over them (the
@@ -3501,7 +4123,7 @@ module Rigor
       # `Constant<a..b>`        → [Constant[a], …, Constant[b]]
       # everything else         → nil
       #
-      # Note: `Type::IntegerRange` is the bounded-Integer carrier (`int<a, b>` represents "an Integer between
+      # Note: `Type::IntegerRange` is the bounded-Integer carrier (`Integer[a..b]` represents "an Integer between
       # a and b"), not a Range value. Calls like `.map` / `.find` on an `IntegerRange` receiver would resolve
       # to `Integer#map` / `Integer#find` — neither exists — so IntegerRange does NOT participate in this
       # fold.
@@ -3541,7 +4163,7 @@ module Rigor
       #
       # Part 1 (soundness): the accumulator of a block-form fold must reach a fixpoint over an unknown
       # number of iterations — the RBS tier's generic `(S) { (S, E) -> S } -> S` binds `S` from a SINGLE
-      # block pass (acc=seed, elem=element-join), so `(1..5).inject(1) { |a, i| a * i }` types `int<1, 5>`
+      # block pass (acc=seed, elem=element-join), so `(1..5).inject(1) { |a, i| a * i }` types `Integer[1..5]`
       # while the runtime is 120 (out of range — unsound). We iterate the accumulator type to a capped
       # fixpoint (ADR-55/56 `BodyFixpoint`) so the multiply converges to `Integer`, never a value-bounded
       # interval the runtime escapes.
@@ -3557,8 +4179,6 @@ module Rigor
       # tier. Captured-local write-back (ADR-56) runs at the statement level independent of this return-type
       # computation, so a block that both accumulates and mutates captured state keeps its write-back
       # regardless of which arm answers here.
-      #
-      # @return [Rigor::Type, nil]
       def try_block_inject_fold(call_node, receiver, arg_types)
         return nil unless INJECT_METHODS.include?(call_node.name)
 
@@ -3577,7 +4197,7 @@ module Rigor
       # Splits the positional args into the optional seed. A Symbol final arg (`inject(seed, :*)`) is the
       # no-block Symbol form and never reaches here (the block guard already failed for it).
       #
-      # @return [Array(Rigor::Type, nil), Boolean] `[seed, has_seed]`
+      # @return `[seed, has_seed]`
       def inject_seed(arg_types)
         case arg_types.size
         when 0 then [nil, false]
@@ -3637,7 +4257,7 @@ module Rigor
       # member is folded; without a seed the first member seeds the memo and the rest are folded. The
       # accumulator is carried as a `Constant` type (so the block body sees a value-pinned param).
       #
-      # @return [Array(Rigor::Type::Constant, nil), Array] `[acc, rest]`
+      # @return `[acc, rest]`
       def inject_constant_start(members, seed, has_seed)
         if has_seed
           return [nil, []] unless seed.is_a?(Type::Constant) && inject_foldable?(seed.value)