rigortype 0.3.8 → 0.4.0

data/lib/rigor/inference/expression_typer.rb

@@ -9,26 +9,40 @@ require_relative "../source/constant_path"
 require_relative "../source/node_children"
 require_relative "../source/node_walker"
 require_relative "../analysis/self_call_resolution_recorder"
+require_relative "block_call_timing"
+require_relative "block_repetition"
 require_relative "block_parameter_binder"
 require_relative "method_parameter_binder"
 require_relative "body_fixpoint"
 require_relative "budget_trace"
 require_relative "captured_locals"
+require_relative "closure_escape_analyzer"
+require_relative "receiver_blind_block"
 require_relative "def_node_resolver"
 require_relative "dynamic_origin"
+require_relative "error_info"
+require_relative "external_ancestor_resolution"
 require_relative "origin_lookup"
 require_relative "../effects/collector"
 require_relative "fallback"
 require_relative "flow_tracer"
+require_relative "index_write_widening"
 require_relative "indexed_narrowing"
+require_relative "jump_targets"
+require_relative "define_method_block_self"
 require_relative "macro_block_self_type"
+require_relative "match_rebinding"
 require_relative "method_dispatcher"
 require_relative "mutation_widening"
 require_relative "narrowing"
+require_relative "optimistic_origin"
 require_relative "receiver_alias"
+require_relative "repeated_or_writes"
 require_relative "singleton_object_constant"
-require_relative "optimistic_origin"
+require_relative "stored_block_call"
 require_relative "struct_fold_safety"
+require_relative "unknown_store_widening"
+require_relative "unthreaded_rebinds"
 require_relative "version_guard"
 
 module Rigor
@@ -99,36 +113,36 @@ module Rigor
         Prism::ConstantPathNode => :type_of_constant_path,
         Prism::ConstantWriteNode => :type_of_assignment_write,
         Prism::ConstantPathWriteNode => :type_of_assignment_write,
-        Prism::ConstantOperatorWriteNode => :type_of_assignment_write,
-        Prism::ConstantOrWriteNode => :type_of_assignment_write,
-        Prism::ConstantAndWriteNode => :type_of_assignment_write,
-        Prism::ConstantPathOperatorWriteNode => :type_of_assignment_write,
-        Prism::ConstantPathOrWriteNode => :type_of_assignment_write,
-        Prism::ConstantPathAndWriteNode => :type_of_assignment_write,
+        Prism::ConstantOperatorWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantOrWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantAndWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantPathOperatorWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantPathOrWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantPathAndWriteNode => :type_of_compound_constant_write,
         # Self and instance/class/global variables
         Prism::SelfNode => :type_of_self_node,
         Prism::InstanceVariableReadNode => :type_of_instance_variable_read,
         Prism::InstanceVariableWriteNode => :type_of_assignment_write,
-        Prism::InstanceVariableOperatorWriteNode => :type_of_assignment_write,
-        Prism::InstanceVariableOrWriteNode => :type_of_assignment_write,
-        Prism::InstanceVariableAndWriteNode => :type_of_assignment_write,
+        Prism::InstanceVariableOperatorWriteNode => :type_of_compound_variable_write,
+        Prism::InstanceVariableOrWriteNode => :type_of_compound_variable_write,
+        Prism::InstanceVariableAndWriteNode => :type_of_compound_variable_write,
         Prism::ClassVariableReadNode => :type_of_class_variable_read,
         Prism::ClassVariableWriteNode => :type_of_assignment_write,
-        Prism::ClassVariableOperatorWriteNode => :type_of_assignment_write,
-        Prism::ClassVariableOrWriteNode => :type_of_assignment_write,
-        Prism::ClassVariableAndWriteNode => :type_of_assignment_write,
+        Prism::ClassVariableOperatorWriteNode => :type_of_compound_variable_write,
+        Prism::ClassVariableOrWriteNode => :type_of_compound_variable_write,
+        Prism::ClassVariableAndWriteNode => :type_of_compound_variable_write,
         Prism::GlobalVariableReadNode => :type_of_global_variable_read,
         Prism::GlobalVariableWriteNode => :type_of_assignment_write,
-        Prism::GlobalVariableOperatorWriteNode => :type_of_assignment_write,
-        Prism::GlobalVariableOrWriteNode => :type_of_assignment_write,
-        Prism::GlobalVariableAndWriteNode => :type_of_assignment_write,
+        Prism::GlobalVariableOperatorWriteNode => :type_of_compound_variable_write,
+        Prism::GlobalVariableOrWriteNode => :type_of_compound_variable_write,
+        Prism::GlobalVariableAndWriteNode => :type_of_compound_variable_write,
         # Compound writes that share the `.value` rvalue accessor
-        Prism::LocalVariableOperatorWriteNode => :type_of_assignment_write,
-        Prism::LocalVariableOrWriteNode => :type_of_assignment_write,
-        Prism::LocalVariableAndWriteNode => :type_of_assignment_write,
-        Prism::IndexOperatorWriteNode => :type_of_assignment_write,
-        Prism::IndexOrWriteNode => :type_of_assignment_write,
-        Prism::IndexAndWriteNode => :type_of_assignment_write,
+        Prism::LocalVariableOperatorWriteNode => :type_of_compound_variable_write,
+        Prism::LocalVariableOrWriteNode => :type_of_compound_variable_write,
+        Prism::LocalVariableAndWriteNode => :type_of_compound_variable_write,
+        Prism::IndexOperatorWriteNode => :type_of_index_compound_write,
+        Prism::IndexOrWriteNode => :type_of_index_compound_write,
+        Prism::IndexAndWriteNode => :type_of_index_compound_write,
         Prism::MultiWriteNode => :type_of_assignment_write,
         # LHS-only target nodes (destructuring assignment, pattern matching, `for x in xs`, block parameter
         # `|a, (b, c)|`). They have no value to extract — the type-of pass acknowledges the node class so the
@@ -183,8 +197,8 @@ module Rigor
         Prism::SplatNode => :type_of_non_value,
         # Control flow (Slice 3 phase 1): branch types are unioned, jumps
         # type as Bot, loops type as Constant[nil].
-        Prism::IfNode => :type_of_if,
-        Prism::UnlessNode => :type_of_unless,
+        Prism::IfNode => :type_of_conditional,
+        Prism::UnlessNode => :type_of_conditional,
         Prism::ElseNode => :type_of_else,
         Prism::AndNode => :type_of_and_or,
         Prism::OrNode => :type_of_and_or,
@@ -201,7 +215,7 @@ module Rigor
         Prism::NextNode => :type_of_jump,
         Prism::RetryNode => :type_of_jump,
         Prism::RedoNode => :type_of_jump,
-        Prism::YieldNode => :type_of_dynamic_top,
+        Prism::YieldNode => :type_of_yield,
         Prism::SuperNode => :type_of_dynamic_top,
         Prism::ForwardingArgumentsNode => :type_of_non_value,
         Prism::WhileNode => :type_of_loop,
@@ -229,10 +243,15 @@ module Rigor
       NO_STATIC_HASH_KEY = Object.new.freeze
       private_constant :NO_STATIC_HASH_KEY
 
-      def initialize(scope:, tracer: nil)
+      # `operand_types` is the identity-comparing `Prism::Node => Rigor::Type` table of the later operands a
+      # threading `StatementEvaluator` root typed from the scope the earlier operands left (issue #1256), or nil.
+      # It is consulted only by this typer's own descent: a node it holds is the same node typed from its own
+      # entry scope, so answering it here is what typing it there would answer.
+      def initialize(scope:, tracer: nil, operand_types: nil, typing_node: nil)
         @scope = scope
         @tracer = tracer
-        @typing_node = nil
+        @operand_types = operand_types
+        @typing_node = typing_node
       end
 
       def type_of(node)
@@ -256,6 +275,9 @@ module Rigor
         declared = scope.declared_types[node]
         return declared if declared
 
+        threaded = @operand_types&.[](node)
+        return threaded if threaded
+
         return type_of_virtual(node) if node.is_a?(AST::Node)
 
         handler = PRISM_DISPATCH[node.class]
@@ -275,6 +297,28 @@ module Rigor
         infer_user_method_return(def_node, receiver, arg_types)
       end
 
+      # The `receiver[args]` read a compound index write performs before it stores (`c[k] += v` reads `c[k]`),
+      # or nil when no tier answers. No `Prism::CallNode` for that read exists in the tree, so the write node
+      # itself stands in as the call context: it carries the same `receiver` / `arguments` / `block` a
+      # plain `c[k]` call does, which is what the context-reading tiers consult. With it, the read reaches
+      # the tiers a plain `c[k]` takes, in the same order — the own-`def` override check, the dispatcher's
+      # node- and scope-gated tiers, then the project `def` inference a dispatch miss falls to — so a project
+      # `[]` with no signature answers from its body instead of the whole write degrading to `Dynamic[top]`.
+      #
+      # A plugin `dynamic_return` rule written for `[]` still does not answer this read. Its `methods:` gate
+      # matches `call_node.name`, which an index write does not have, and the shipped rules decline any node
+      # that is not a `Prism::CallNode`, by an explicit check or through the rescue around a rule that reads
+      # `name` anyway. Minting a `Prism::CallNode` for the read would hand plugins a node that is not in the
+      # tree, through a constructor whose field list changed inside the `prism` range the gemspec accepts.
+      def implicit_index_read_type(node, receiver, arg_types)
+        return splat_index_read_type(node, receiver, arg_types) if node.arguments&.arguments&.any?(Prism::SplatNode)
+
+        try_overriding_def_dispatch(node, receiver, arg_types, method_name: :[]) ||
+          index_read_dispatch(node, receiver, arg_types) ||
+          try_user_method_inference(receiver, node, arg_types, method_name: :[]) ||
+          try_project_singleton_inference(receiver, node, arg_types, method_name: :[])
+      end
+
       # ADR-89 WD2 — the current run's return memo bucket as `{ def_node => [MemoEntry, …] }` (only entries
       # that carry a call descriptor, i.e. every stored entry). Read by the incremental session right after a
       # recording run to harvest each analyzed callee's observed call keys → return descriptors. Returns an
@@ -287,6 +331,70 @@ module Rigor
         slot[1].transform_values(&:values)
       end
 
+      # Issue #720 — the value the block passed by the call site currently being re-typed evaluates to, or
+      # `nil` outside such a frame. Read by {#type_of_yield}.
+      #
+      # A thread-local rather than a `Scope` field for the same reason the `return` / `next` / `break` sinks
+      # are: `yield` names the frame's caller, not a binding, and the body is walked through scopes the
+      # inference rebuilds freely. It is installed unconditionally — with `nil` — at every user-method
+      # inference frame, so a callee reached WITHOUT a block from inside a yielding body cannot read its
+      # caller's block.
+      YIELD_VALUE_KEY = :__rigor_yield_value_type__
+      private_constant :YIELD_VALUE_KEY
+
+      def self.current_yield_value_type
+        Thread.current[YIELD_VALUE_KEY]
+      end
+
+      # Runs `block` with `type` installed as the frame's yield value, restoring the previous frame on exit.
+      def self.with_yield_value_type(type)
+        previous = Thread.current[YIELD_VALUE_KEY]
+        Thread.current[YIELD_VALUE_KEY] = type
+        begin
+          yield
+        ensure
+          Thread.current[YIELD_VALUE_KEY] = previous
+        end
+      end
+
+      # Issue #1125 — the argument types of the call currently being re-typed into the body being walked,
+      # or nil outside such a frame. A `f(...)` call inside `def m(...)` re-supplies exactly the arguments
+      # `m` itself was called with, so {#call_arg_types} expands the forwarding node to THIS list instead of
+      # the `Dynamic[top]` a bare `Prism::ForwardingArgumentsNode` types as.
+      #
+      # A thread-local for the same reason the yield value is (see {YIELD_VALUE_KEY}): `...` names the
+      # frame's caller, not a binding, and the body is walked through scopes the inference rebuilds freely.
+      # It is installed unconditionally — with nil — at every user-method inference frame, so a body reached
+      # without `...` cannot read its caller's argument list. Because each frame installs its OWN list, a
+      # chain `a(...) -> b(...) -> c(...)` threads through: `b`'s frame holds the types `a` expanded and
+      # `c`'s holds `b`'s. The list is the callee's call-site `arg_types`, which is what keeps the ADR-84
+      # return memo's `(def_node, receiver, arg_types)` key complete for a forwarding def.
+      FORWARDED_ARGS_KEY = :__rigor_forwarded_call_arg_types__
+      private_constant :FORWARDED_ARGS_KEY
+
+      def self.current_forwarded_arg_types
+        Thread.current[FORWARDED_ARGS_KEY]
+      end
+
+      # Runs `block` with `types` installed as the frame's forwarded argument list, restoring the previous
+      # frame on exit.
+      def self.with_forwarded_arg_types(types, &block)
+        previous = Thread.current[FORWARDED_ARGS_KEY]
+        Thread.current[FORWARDED_ARGS_KEY] = types
+        begin
+          block.call
+        ensure
+          Thread.current[FORWARDED_ARGS_KEY] = previous
+        end
+      end
+
+      # The two call-site channels a user-method body may read from its caller — the block a `yield`
+      # reaches ({#with_yield_value_type}) and the argument list `...` re-supplies
+      # ({#with_forwarded_arg_types}) — installed together, both even when nil, for exactly one frame.
+      def self.with_call_site_frame(yield_type, forwarded_arg_types, &)
+        with_yield_value_type(yield_type) { with_forwarded_arg_types(forwarded_arg_types, &) }
+      end
+
       private
 
       attr_reader :scope, :tracer
@@ -318,6 +426,182 @@ module Rigor
         type_of(node.value)
       end
 
+      # `v += 1` / `@v ||= x` / `$v &&= x` as an EXPRESSION. The value of a compound write is the value it
+      # stores, which is a function of the variable's CURRENT binding — not of the rvalue alone. Typing it as
+      # `type_of(node.value)` answered `1` for `total += 1` whatever `total` held.
+      #
+      # `StatementEvaluator#compound_eval` already computes the right answer on the straight-line path, so the
+      # gap only showed where a body is typed WITHOUT that evaluator: the block-return pass types a
+      # single-statement body by expression alone, and issue #617 residue (3) is the live consequence —
+      # `total = 0; r = [1, 2].map { total += 1 }` folded to `[1, 1]`, and `r.last == 1` fired a false
+      # `flow.always-truthy-condition` on a program where it is `2`. Under the per-element fold the captured
+      # local is already bound to its converged `Integer` (issue #587 (b)); reading that binding here is what
+      # turns the stale pin into the honest `Integer`.
+      #
+      # The algebra is `StatementEvaluator#compound_result_type`'s, deliberately: the two must not disagree
+      # about what a compound write evaluates to. An unbound target is `Dynamic[top]` — the same fallback the
+      # evaluator takes — and an operator the receiver does not answer widens to `Dynamic[top]` rather than
+      # inventing the rvalue.
+      #
+      # Constant targets have {#type_of_compound_constant_write}, over the same algebra. Index targets have their
+      # own handler, {#type_of_index_compound_write}.
+      def type_of_compound_variable_write(node)
+        compound_write_value(node, compound_write_current_binding(node), type_of(node.value))
+      end
+
+      # `H ||= 0` / `Conf::LIMIT += 1` as an EXPRESSION: the value it stores, by
+      # {#type_of_compound_variable_write}'s algebra. Typed as the rvalue alone, `H = { x: 1 }; v = (H ||= 0);
+      # v[:x]` reported `Integer#[]` on a program whose `v` is `H`, and `F.transform_values { |e| F ||= 0 }`
+      # folded every value to `0`.
+      #
+      # A constant has no scope binding, so its current binding is what a plain read of the same spelling
+      # resolves to at the write site — the lexical ladder, the in-source table of plain writes, then RBS —
+      # less the caller-derived rungs a top-level body keeps for reads Ruby raises on. The memoization idiom
+      # (`def registry = REGISTRY ||= {}`, legal where a plain `REGISTRY = {}` is a dynamic constant
+      # assignment) writes a constant nothing else binds, so an unresolved target keeps the rvalue reading
+      # exactly as an unbound variable does — unless a write other than a memo binds it
+      # ({#written_constant_binding}). A path whose base renders no static name (`klass::X`, `self::X`) names
+      # no binding the resolver can look up, and reads as unbound too, on the same condition.
+      def type_of_compound_constant_write(node)
+        rhs = type_of(node.value)
+        compound_write_value(node, compound_write_constant_binding(node), rhs)
+      end
+
+      def compound_write_value(node, current, rhs)
+        case node
+        when Prism::LocalVariableOrWriteNode, Prism::InstanceVariableOrWriteNode,
+             Prism::ClassVariableOrWriteNode, Prism::GlobalVariableOrWriteNode,
+             Prism::ConstantOrWriteNode, Prism::ConstantPathOrWriteNode
+          # An UNBOUND target is the memoization idiom (`def self.default = @default ||= new`): nothing
+          # has written the variable on any path the analyzer saw, so the stored value is the rvalue.
+          # Reading it as `Dynamic[top] | rhs` would skip every memoized singleton in `sig-gen`
+          # (ADR-5 optimism; three `.default` readers went `sig.skipped.untyped-return` without this).
+          #
+          # The index rule's exception applies: an rvalue with no truthy part makes the write a guard, not a
+          # memo. `@settings ||= raise "boot first"` returns only when something the analyzer did not see set
+          # `@settings`, and `@verbose ||= false` answers `true` once one did, so the value is that unseen
+          # binding — `Dynamic[top]`, the statement evaluator's reading of an unbound target — never the
+          # rvalue's `bot` or `false` alone. A local is no exception: the scope a loop body is typed from does
+          # not carry what the previous iteration stored.
+          if current.nil?
+            return rhs unless Narrowing.narrow_truthy(rhs).is_a?(Type::Bot)
+
+            current = dynamic_top
+          end
+
+          Type::Combinator.union(Narrowing.narrow_truthy(current), rhs)
+        when Prism::LocalVariableAndWriteNode, Prism::InstanceVariableAndWriteNode,
+             Prism::ClassVariableAndWriteNode, Prism::GlobalVariableAndWriteNode,
+             Prism::ConstantAndWriteNode, Prism::ConstantPathAndWriteNode
+          # `&&=` is no memo: an unset target returns its own `nil` without evaluating the rvalue (a constant or
+          # class variable raises instead). Beside the rvalue, an UNBOUND target's value is its own falsey value —
+          # `nil` when unset, or a falsey value a write the analyzer did not see stored — which
+          # `narrow_falsey(Dynamic[top])` carries as `Dynamic[top]`, the statement evaluator's reading. The index
+          # rule says the same of `h[k] &&= v`. Read as the rvalue, `if (@x &&= 1)` folded always-truthy on a
+          # program that takes the else arm.
+          Type::Combinator.union(Narrowing.narrow_falsey(current || dynamic_top), rhs)
+        else
+          compound_operator_result(current || dynamic_top, rhs, node.binary_operator)
+        end
+      end
+
+      # `h[k] += v` / `h[k] ||= v` / `h[k] &&= v` as an EXPRESSION. Like a variable compound write, its value is
+      # what it stores through `[]=` — the dispatched `h[k] + v`, `truthy(h[k]) | v`, `falsey(h[k]) | v` — which
+      # reads the slot's current type, recorded indexed narrowing included. Typed as the rvalue alone it answered
+      # `1` for `counts[w] += 1`, so `r = words.map { |w| counts[w] += 1 }` pinned every position to `1` and
+      # `r.last == 1` drew a false `flow.always-truthy-condition`.
+      #
+      # The statement evaluator already owned that algebra for the straight-line write and the `[]=` widening
+      # join, so this reads its answer rather than keeping a second copy. It asks for the value alone, not a
+      # whole `evaluate`: the widening and the narrowing record are scope effects a value position discards,
+      # and the memoizing `@cache[k] ||= build(k)` tail is common enough not to pay for them.
+      #
+      # One exception carries over, narrowed, from {#type_of_compound_variable_write}: a memoizing `||=` whose
+      # slot the analyzer has no evidence about reads as the rvalue. The evaluator's value method owns it,
+      # because it is decided on the `[]` read the evaluator performs.
+      def type_of_index_compound_write(node)
+        StatementEvaluator.new(scope: scope, tracer: tracer).index_compound_write_value(node)
+      end
+
+      def compound_write_current_binding(node)
+        case node
+        when Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+             Prism::LocalVariableAndWriteNode then scope.local(node.name)
+        when Prism::InstanceVariableOperatorWriteNode, Prism::InstanceVariableOrWriteNode,
+             Prism::InstanceVariableAndWriteNode then scope.ivar(node.name)
+        when Prism::ClassVariableOperatorWriteNode, Prism::ClassVariableOrWriteNode,
+             Prism::ClassVariableAndWriteNode then scope.cvar(node.name)
+        else scope.global(node.name)
+        end
+      end
+
+      def compound_write_constant_binding(node)
+        case node
+        when Prism::ConstantOperatorWriteNode, Prism::ConstantOrWriteNode, Prism::ConstantAndWriteNode
+          full_name = node.name.to_s
+          rooted = false
+        else
+          full_name = Source::ConstantPath.qualified_name_or_nil(node.target)
+          return unnamed_path_binding(node.target) if full_name.nil?
+
+          rooted = Source::ConstantPath.rooted?(node.target)
+        end
+        resolve_constant_name(full_name, rooted: rooted, caller_derived: false) ||
+          written_constant_binding(full_name, rooted)
+      end
+
+      # A constant the plain read cannot resolve may still be bound: another file writes a value that never
+      # published (`H = { x: 1 }`), the compound write withdrew one by being the second writer the census
+      # counts, or this file writes it in a form its own table does not carry (`A, B = …`, `A = B = …`). The
+      # value is one the analyzer does not have, so the binding is `Dynamic[top]` rather than the memo's
+      # unbound reading. The one write that does not bind is a memo `||=` no other file shares, so the
+      # memoization idiom keeps that reading however often its file repeats it; memos of the name in two files
+      # bind, since either may load first and set what the other reads.
+      #
+      # Which name the write reads is the ladder's to decide, not the spelling's: the same resolution runs
+      # again with only the census's binding names in the in-source table, so `Other::REGISTRY` elsewhere
+      # leaves a top-level `REGISTRY ||= {}` its memo reading. Two census spellings the ladder cannot reach
+      # still bind: a write through a base nothing names (`k::X = 1`), which may have written any of them,
+      # and a path the census keeps as written ([#690](https://github.com/rigortype/rigor/issues/690)), so
+      # `Foo::BAR = …` inside `module M` binds `M::Foo::BAR ||= 0`.
+      def written_constant_binding(full_name, rooted)
+        names = scope.bound_constant_names(full_name)
+        return nil if names.empty?
+        return dynamic_top if names.any? { |name| unladdered_census_name?(name, full_name) }
+
+        written = names.to_h { |name| [name, dynamic_top] }
+        probe = scope.with_discovery(scope.discovery.with(in_source_constants: written))
+        Reflection.resolve_constant_type(full_name, scope: probe, rooted: rooted, caller_derived: false)
+      end
+
+      def unladdered_census_name?(name, full_name)
+        return true if name.start_with?(ScopeIndexer::DYNAMIC_TARGET_PREFIX)
+
+        name.include?("::") && full_name.end_with?("::#{name}")
+      end
+
+      # `self::X ||= v` / `klass::X ||= v` name no constant the resolver can look up, so any binding write
+      # that shares the last segment may be the one the base reaches. The answer now depends on other files'
+      # writes, and this path never reaches `Reflection.resolve_constant_type`, which records the
+      # `constant:<segment>` edge for every other form — so it records the edge itself, or an incremental
+      # run keeps serving the reading from before another file's write of the segment appeared.
+      def unnamed_path_binding(target)
+        segment = target.name&.to_s
+        return nil if segment.nil?
+
+        Analysis::DependencyRecorder.read_name(:constant, segment) if Analysis::DependencyRecorder.active?
+        dynamic_top unless scope.bound_constant_names(segment).empty?
+      end
+
+      def compound_operator_result(current, rhs, operator)
+        MethodDispatcher.dispatch(
+          receiver_type: current,
+          method_name: operator.to_sym,
+          arg_types: [rhs],
+          environment: scope.environment
+        ) || dynamic_top
+      end
+
       # Slice 7 phase 1 — instance/class/global variable reads. Each lookup returns the type currently bound
       # in the surrounding scope's per-kind binding map (populated by `StatementEvaluator` write handlers
       # within the same method body), falling through to `Dynamic[Top]` when no binding is recorded.
@@ -372,6 +656,19 @@ module Rigor
         dynamic_top
       end
 
+      # Issue #720 — `yield` evaluates the block the CALLER passed, so its value is that block's value. The
+      # caller is only known when this body is being re-typed on behalf of one call site
+      # ({#infer_user_method_return} installs the frame); on the main walk over a `def` no caller exists and
+      # the answer stays `Dynamic[top]`.
+      #
+      # Nothing about the yield's arguments is checked here. The block's return type was computed at the call
+      # site under the parameter bindings the call implies, so it already answers "what does this block
+      # evaluate to for this caller"; a `yield` that passes different arguments than the block's parameters
+      # accept is a separate (arity) question this frame does not decide.
+      def type_of_yield(_node)
+        ExpressionTyper.current_yield_value_type || dynamic_top
+      end
+
       # `defined?(expr)` returns `String | nil` per Ruby semantics — a description of the expression's
       # category (`"local-variable"`, `"method"`, ...) when defined, or `nil` when not. The argument is not
       # evaluated (it is statically inspected by the runtime), so the typer does not recurse into it.
@@ -428,7 +725,17 @@ module Rigor
       # `Inference::FallbackTracer` from inside `Rigor::CLI::Foo` resolves to
       # `Rigor::Inference::FallbackTracer`.
       def type_of_constant_read(node)
-        resolve_constant_name(node.name.to_s) || unresolved_constant_fallback(node, node.name.to_s)
+        guard_narrowed_constant(node) ||
+          resolve_constant_name(node.name.to_s) || unresolved_constant_fallback(node, node.name.to_s)
+      end
+
+      # Issue #1429 — the type a guard narrowed this constant reference to on the edge being typed
+      # (`STDOUT.is_a?(StringIO) ? STDOUT.string : nil`), or nil. Keyed by spelling ({Narrowing.constant_key}).
+      def guard_narrowed_constant(node)
+        return nil if scope.constant_narrowings.empty?
+
+        key = Narrowing.constant_key(node)
+        key && scope.constant_narrowing(key)
       end
 
       # A leading `::` (`::Rails`, `::Rails::Application`) is Ruby's escape hatch out of the lexical ladder:
@@ -436,6 +743,9 @@ module Rigor
       # deliberately un-rooted (the discovery tables are keyed that way), so the marker rides alongside it
       # into the resolver (#614).
       def type_of_constant_path(node)
+        narrowed = guard_narrowed_constant(node)
+        return narrowed if narrowed
+
         full_name = Source::ConstantPath.qualified_name_or_nil(node)
         return fallback_for(node, family: :prism) if full_name.nil?
 
@@ -504,16 +814,17 @@ module Rigor
       # in-source value, RBS constant, across the peeled `::` prefix candidates) is reused by
       # `Inference::Narrowing`'s `Constant[Regexp]` match-operand recognition. Returns the matched
       # `Rigor::Type` or nil; the caller decides whether to fall back.
-      def resolve_constant_name(name, rooted: false)
-        Reflection.resolve_constant_type(name, scope: scope, rooted: rooted)
+      def resolve_constant_name(name, rooted: false, caller_derived: true)
+        Reflection.resolve_constant_type(name, scope: scope, rooted: rooted, caller_derived: caller_derived)
       end
 
       # Slice 5 phase 1 upgrades hash literals to `HashShape{...}` when every entry is a static `AssocNode`
       # whose key is a value-pinned scalar literal — Symbol, plain String, Integer, Float, `true`, `false`,
       # or `nil` (covering `{ a: 1, "b" => 2 }` and `{ 1 => 2, 1.0 => 4 }` alike) — falling back to the
       # generic `Hash[K, V]` form otherwise. Splatted entries (`{ **other }`) and dynamic keys widen to the
-      # underlying `Hash[K, V]` form by unioning the types each entry exposes; when no concrete pair
-      # survives we fall back to the raw `Hash` so callers stay backward compatible.
+      # underlying `Hash[K, V]` form by unioning the types each entry exposes — a splat exposes the `[K, V]`
+      # of the hash it copies plus a `Dynamic[top]` arm (see {#hash_splat_pair}), so every entry contributes a
+      # pair. A splat never keeps a shape, even over an exact closed one.
       def type_of_hash(node)
         elements = node.respond_to?(:elements) ? node.elements : []
         # v0.0.7 — `{}` resolves to the empty `HashShape{}` carrier rather than `Nominal[Hash]`, mirroring the
@@ -525,8 +836,6 @@ module Rigor
         return shape if shape
 
         keys, values = generic_hash_pairs_for(elements)
-        return Type::Combinator.nominal_of(Hash) if keys.empty? || values.empty?
-
         Type::Combinator.nominal_of(
           Hash,
           type_args: [Type::Combinator.union(*keys), Type::Combinator.union(*values)]
@@ -580,14 +889,64 @@ module Rigor
         keys = []
         values = []
         elements.each do |entry|
-          next unless entry.is_a?(Prism::AssocNode)
-
-          keys << type_of(entry.key)
-          values << type_of(entry.value)
+          if entry.is_a?(Prism::AssocNode)
+            keys << type_of(entry.key)
+            values << type_of(entry.value)
+          else
+            key, value = hash_splat_pair(entry)
+            keys << key
+            values << value
+          end
         end
         [keys, values]
       end
 
+      # The `[K, V]` a `**splat` entry adds to the literal: what the analysis can read of the hash it copies, each
+      # side joined with `Dynamic[top]`. Ruby inserts every pair of that hash, so leaving the entry out typed
+      # `o = { a: :z }; { **o, b: :y }` as `Hash[:b, :y]` and folded `h[:a] == :z` on correct code.
+      #
+      # The `Dynamic[top]` arm is there even when the copy is read exactly. The literal builds a new hash that no
+      # declaration describes, while `MutationRejoin` regrows a `Hash[K, V]` after `[]=` / `merge!` only when it
+      # already carries a gradual arm, because it reads a precise one as a declared claim. Without the arm
+      # `h = { **o }; h[:b] = 2; h[:b] == 2` would fold always-falsey and `h[:e] = "s"; h[:e].upcase` would fire
+      # `call.undefined-method`, where the `Hash` a splat-only literal used to type as had stayed quiet. The same
+      # arm stands in for what the analysis cannot read: an anonymous `**`, an untyped value, a nominal other than
+      # `Hash`, an open shape's unlisted entries, and a hash filled through an alias the engine does not track,
+      # which still reads `{}`.
+      def hash_splat_pair(entry)
+        untyped = Type::Combinator.untyped
+        copied = entry.value && splatted_hash_pair(type_of(entry.value))
+        return [untyped, untyped] if copied.nil?
+
+        copied.map { |side| Type::Combinator.union(side, untyped) }
+      end
+
+      # The `[K, V]` the analysis can read of a splatted value, or nil when it reads nothing: a shape's keys and
+      # values, a `Hash[K, V]`'s type arguments (through a difference over one, `non-empty-hash[K, V]`), and the
+      # join over a union's members. `nil` reads as nothing because `**nil` splats nothing (Ruby 3.4+; earlier
+      # Rubies raise). A `Hash` subclass is not read: its own type arguments, if any, are not `Hash`'s `K` and `V`.
+      def splatted_hash_pair(type)
+        case type
+        when Type::HashShape then splatted_shape_pair(type)
+        when Type::Nominal then type.class_name == "Hash" && type.type_args.size == 2 ? type.type_args : nil
+        when Type::Difference then splatted_hash_pair(type.base)
+        when Type::Union then joined_hash_pair(type.members.filter_map { |member| splatted_hash_pair(member) })
+        end
+      end
+
+      def splatted_shape_pair(shape)
+        return nil if shape.pairs.empty?
+
+        [Type::Combinator.union(*shape.pairs.keys.map { |k| Type::Combinator.constant_of(k) }),
+         Type::Combinator.union(*shape.pairs.values)]
+      end
+
+      def joined_hash_pair(pairs)
+        return nil if pairs.empty?
+
+        [Type::Combinator.union(*pairs.map(&:first)), Type::Combinator.union(*pairs.map(&:last))]
+      end
+
       # An interpolated string `"#{a}b#{c}"` is `literal-string` when every part contributes literal-bearing
       # material: plain text segments are literal by construction, embedded expressions count when their type
       # is itself literal-string-compatible (a `Constant<String>`, the `literal-string` carrier, an
@@ -642,132 +1001,29 @@ module Rigor
         Type::Combinator.constant_of(nil)
       end
 
-      # `if c; t; (elsif c2; ...; )* else; e; end`. Prism nests `elsif` branches as `IfNode#subsequent`. Slice
-      # 3 phase 1 types both branches in the receiver scope and returns their union; scope rebinding is the
-      # StatementEvaluator's job (Slice 3 phase 2). Without an else clause the branch's implicit value is nil,
-      # which is included in the union.
-      #
-      # v0.0.6 — when the predicate folds to a `Type::Constant` whose value is Ruby-truthy (resp.
-      # Ruby-falsey), the unreachable branch is elided so the if-expression's type is the live branch alone.
-      # Statement-level branch elision lives in `StatementEvaluator#eval_if`; this handler covers the
-      # expression-position ternary form (`a ? b : c`) and any `if`/`unless` reached through `type_of`.
-      def type_of_if(node)
-        then_type = statements_or_nil(node.statements)
-        else_type = if_else_type(node.subsequent)
-        elide_or_union(node.predicate, then_type, else_type)
-      end
-
-      # `unless c; t; else; e; end`. Prism uses `else_clause` here (no `elsif` chain). Branch-elision logic
-      # mirrors `type_of_if`, inverted: a truthy predicate selects the else branch.
-      def type_of_unless(node)
-        then_type = statements_or_nil(node.statements)
-        else_type = if_else_type(node.else_clause)
-        elide_or_union(node.predicate, else_type, then_type)
-      end
-
-      # Issue #286 — the effective optimistic-nil-free cause of an expression. {OptimisticOrigin.resolve} owns
-      # the judgment, shared verbatim with `StatementEvaluator#optimistic_origin_for` and the
-      # `flow.always-truthy-condition` collector.
-      def optimistic_origin_for(node)
-        OptimisticOrigin.resolve(node, scope)
-      end
-
-      def if_else_type(subsequent)
-        return Type::Combinator.constant_of(nil) if subsequent.nil?
-
-        type_of(subsequent)
-      end
-
-      # Routes the predicate's typed value through branch elision. `live_when_truthy` and `live_when_falsey`
-      # are the branch types selected by the predicate's polarity; the names match `IfNode` semantics
-      # directly and invert at the `type_of_unless` call site.
-      def elide_or_union(predicate, live_when_truthy, live_when_falsey)
-        case constant_predicate_polarity(predicate)
-        when :truthy then live_when_truthy
-        when :falsey then live_when_falsey
-        else Type::Combinator.union(live_when_truthy, live_when_falsey)
-        end
-      end
-
-      # Returns `:truthy`, `:falsey`, or `nil` for an arbitrary predicate expression under three-valued logic.
-      # {Narrowing.predicate_certainty} owns the judgment (the same one `StatementEvaluator#live_branch_for_if`
-      # reads on the scope side): `Nominal[Integer]` (always truthy in Ruby), `Constant[nil]`, and
-      # `Constant[false]` fold one branch; `Union[true, false]`, `Dynamic[T]`, and `Top` keep both branches live.
-      def constant_predicate_polarity(predicate)
-        return nil if predicate.nil?
-
-        # ADR-47 WD5 — a decidable version guard (#627) answers first, exactly as it does on the scope side
-        # in `StatementEvaluator#branch_certainty`. Both readers ask the same pure function of the AST, so
-        # the expression form (`RUBY_VERSION >= "3.1" ? a : b`) and the statement form cannot disagree about
-        # which arm survives. The verdict rests on literals, so the ADR-101 optimistic-carrier decline below
-        # — which guards an RBS-derived judgment — does not apply to it.
-        guard = VersionGuard.verdict(predicate)
-        return guard if guard
-        # ADR-101 — decline on an optimistically nil-free carrier; see
-        # `StatementEvaluator#optimistic_carrier?` for why the gate is here and not in `Narrowing`.
-        return nil unless optimistic_origin_for(predicate).nil?
-
-        Narrowing.predicate_certainty(type_of(predicate))
+      # `if` / `unless` in value position — the ternary `c ? a : b`, a modifier `(a unless c)`, or a
+      # conditional written as an argument, a receiver, or a literal element. Issue #1003: this handler used
+      # to type both arms in the receiver scope and union them, so the predicate's narrowing reached a
+      # statement-position conditional (through `StatementEvaluator#eval_if`) and never a value-position
+      # one: `f.finite? ? f : 0.0` read `0.0 | Float` while the `if` statement bound `0.0 | finite-float`.
+      # It delegates to the statement evaluator instead of re-deriving the edges, so the two positions share
+      # one narrowing application, one branch elision (ADR-47 WD5 version guards, the ADR-101
+      # optimistic-carrier decline) and one terminating-arm rule, and cannot drift apart again. Only the
+      # value is read; the post-scope belongs to whichever walk owns the statement.
+      def type_of_conditional(node)
+        scope.evaluate(node, tracer: tracer).first
       end
 
       def type_of_else(node)
         statements_or_nil(node.statements)
       end
 
-      # `a && b` and `a || b` short-circuit at the value level: `a && b` returns `a` when `a` is falsey, else
-      # `b`. `a || b` returns `a` when `a` is truthy, else `b`.
-      #
-      # v0.0.6 — when the left operand folds to a `Type::Constant`, we know which side actually flows
-      # through, so the result is one operand's type instead of a union. Otherwise the union-of-both-operands
-      # fallback is preserved.
+      # `a && b` / `a || b` in value position. Issue #1016: this handler used to type both operands in the
+      # receiver scope, so `x.finite? && x` read `Float | false` while the statement form bound
+      # `false | finite-float`. Like `type_of_conditional`, it delegates to the statement evaluator, which owns
+      # the RHS narrowing, the constant short-circuit and its issue #313 optimistic-carrier decline.
       def type_of_and_or(node)
-        left_type = type_of(node.left)
-        polarity = left_operand_polarity(node.left, left_type)
-        return short_circuit_for(node, left_type, polarity) if polarity
-
-        # The left operand only flows through on the edge that short-circuits: `a || b` yields `a` solely
-        # when `a` is truthy, so its falsey constituents (`nil` / `false`) can never be the value of the
-        # OrNode (they hand off to `b`); `a && b` yields `a` solely when `a` is falsey. Narrow the surviving
-        # left edge before the union so `s || full` (with `s : String?`) types `String | <full>` rather than
-        # re-admitting the stripped `nil`. Mirrors `StatementEvaluator#eval_and_or`'s `skipped_type`.
-        surviving_left =
-          if node.is_a?(Prism::AndNode)
-            Narrowing.narrow_falsey(left_type)
-          else
-            Narrowing.narrow_truthy(left_type)
-          end
-        Type::Combinator.union(surviving_left, type_of(node.right))
-      end
-
-      def short_circuit_for(node, left_type, polarity)
-        and_node = node.is_a?(Prism::AndNode)
-        if polarity == :truthy
-          and_node ? type_of(node.right) : left_type
-        else
-          and_node ? left_type : type_of(node.right)
-        end
-      end
-
-      # Issue #313 — the node-aware wrapper the `&&` / `||` short-circuit reads. The spec's exclusion binds
-      # this gate as much as it binds `flow.always-truthy-condition`, and a `Constant`-only gate is not by
-      # itself enough to honour it: a literal hash whose values share one type reads as a lone `Constant`
-      # (`UNIFORM[key]` → `Constant[1]`), so the gate would judge the left operand of `UNIFORM[key] || key`
-      # provably truthy and discard the author's fallback — the counter-example the spec names verbatim.
-      # Declining returns the union of both operands, which is what `StatementEvaluator#eval_and_or` produces
-      # anyway, so the two `&&` / `||` typers stay in agreement.
-      def left_operand_polarity(left_node, left_type)
-        return nil unless optimistic_origin_for(left_node).nil?
-
-        constant_value_polarity(left_type)
-      end
-
-      # Returns `:truthy` / `:falsey` for a `Type::Constant`, nil otherwise. Mirrors
-      # `constant_predicate_polarity` but operates on a typed value (already-type-of'd) rather than a Prism
-      # node, so the same predicate analysis can be reused in both contexts.
-      def constant_value_polarity(type)
-        return nil unless type.is_a?(Type::Constant)
-
-        type.value ? :truthy : :falsey
+        scope.evaluate(node, tracer: tracer).first
       end
 
       # Three-valued evaluation of `case predicate when pattern` dispatch. For each `when` clause we ask:
@@ -785,29 +1041,41 @@ module Rigor
       # The `case ... in` pattern-matching form (`CaseMatchNode`) and the predicate-less form (`case; when
       # c1; ...`) bypass the `===` analysis: pattern matching has richer semantics, and a predicate-less
       # `case` reduces to a `if c1; ...; elsif c2` chain that statement-level narrowing already handles.
+      # Issue #1429 — each arm is typed under the subject's clause narrowing (`Narrowing.case_when_scopes`), the
+      # scope the statement evaluator runs the arm in: `when Symbol then n` on `n: Integer | Symbol` answers
+      # `Symbol`, and the `else` arm reads the subject every earlier clause has ruled out.
       def type_of_case(node)
         return type_of_case_simple_union(node) if node.is_a?(Prism::CaseMatchNode) || node.predicate.nil?
 
         subject_type = type_of(node.predicate)
         candidates = []
         reached_yes = false
+        clause_scope = scope
 
         node.conditions.each do |when_node|
-          case case_when_branch_certainty(subject_type, when_node)
-          when :yes
-            candidates << type_of(when_node)
+          conditions = when_node.respond_to?(:conditions) ? when_node.conditions : []
+          body_scope, next_scope = Narrowing.case_when_scopes(node.predicate, conditions, clause_scope)
+          certainty = case_when_branch_certainty(subject_type, when_node)
+          # :no — drop the branch
+          candidates << case_arm_type(when_node, body_scope) unless certainty == :no
+          if certainty == :yes
             reached_yes = true
             break
-          when :maybe
-            candidates << type_of(when_node)
-            # :no — drop the branch
           end
+          clause_scope = next_scope
         end
 
-        candidates << type_of_case_else(node) unless reached_yes
+        candidates << case_arm_type(node.else_clause, clause_scope) unless reached_yes
         Type::Combinator.union(*candidates)
       end
 
+      # The value of one `case` arm (`nil` for an absent `else`), typed under `arm_scope`.
+      def case_arm_type(arm, arm_scope)
+        return Type::Combinator.constant_of(nil) if arm.nil?
+
+        arm_scope.equal?(scope) ? type_of(arm) : arm_scope.type_of(arm, tracer: tracer)
+      end
+
       def type_of_case_simple_union(node)
         branch_types = node.conditions.map { |branch| type_of(branch) }
         Type::Combinator.union(*branch_types, type_of_case_else(node))
@@ -843,9 +1111,21 @@ module Rigor
       #
       # Other pattern shapes (Range, Regexp, custom `===`) stay `:maybe` — the existing union fallback
       # handles them.
+      #
+      # The class reference is resolved through {Narrowing.lexical_class_name}, the walk the narrowing
+      # side of the same `case` already uses (#655). Matching on the as-written spelling instead made a
+      # SHADOWED name confidently wrong rather than merely unresolved: `when Random` inside
+      # `Bar::Nested` names `Bar::Nested::Random`, the environment answered the core `::Random` the
+      # spelling matches at top level, and a subject that is a core `Random` then made the arm certain
+      # — dropping the `else` Ruby actually takes and typing the expression as a branch that never
+      # runs. The documented argument that an unresolvable pattern can only lose certainty holds for an
+      # unresolvable name and not for a shadowed one.
       def case_when_pattern_certainty(subject_type, pattern_node)
-        class_name = Source::ConstantPath.qualified_name_or_nil(pattern_node)
-        return Narrowing.class_pattern_certainty(subject_type, class_name, environment: scope.environment) if class_name
+        class_name = Narrowing.lexical_class_name(pattern_node, scope)
+        if class_name
+          return Narrowing.class_pattern_certainty(subject_type, class_name, environment: scope.environment,
+                                                                             scope: scope)
+        end
 
         literal = literal_pattern_value(pattern_node)
         return Narrowing.value_pattern_certainty(subject_type, literal[:value]) if literal
@@ -891,24 +1171,46 @@ module Rigor
         Type::Combinator.union(primary_type, *rescue_types)
       end
 
+      # Issue #1360 — the evaluator binds `$!` in a rescue clause it enters; a clause typed here, such as one in a
+      # `begin` passed as an argument, reads `$!`, `$@` and `$?` unbound rather than an enclosing clause's.
       def rescue_chain_types(rescue_node)
+        arm_typer = typer_under(rescue_arm_scope)
         types = []
         current = rescue_node
         while current
-          types << statements_or_nil(current.statements)
+          types << arm_typer.send(:statements_or_nil, current.statements)
           current = current.subsequent
         end
         types
       end
 
       def type_of_rescue(node)
-        statements_or_nil(node.statements)
+        typer_under(rescue_arm_scope).send(:statements_or_nil, node.statements)
       end
 
+      def rescue_arm_scope = scope.forget_error_info.forget_last_status
+
       # `expr rescue fallback` is RescueModifierNode in Prism. The result is `expr`'s type when no exception
-      # is raised and `fallback`'s type otherwise; both paths are reachable, so the result is their union.
+      # is raised and `fallback`'s type otherwise; both paths are reachable, so the result is their union. Issue #1360
+      # — `fallback` runs with `$!` and `$@` bound to the `StandardError` it rescued ({ErrorInfo.modifier_entry}).
       def type_of_rescue_modifier(node)
-        Type::Combinator.union(type_of(node.expression), type_of(node.rescue_expression))
+        fallback = node.rescue_expression
+        fallback_type =
+          if ErrorInfo.read_in?(fallback)
+            typer_under(ErrorInfo.modifier_entry(scope, fallback)).type_of(fallback)
+          else
+            type_of(fallback)
+          end
+        Type::Combinator.union(type_of(node.expression), fallback_type)
+      end
+
+      # A typer that shares this one's tracer and operand types but reads `other_scope`.
+      def typer_under(other_scope)
+        return self if other_scope.equal?(scope)
+
+        ExpressionTyper.new(
+          scope: other_scope, tracer: tracer, operand_types: @operand_types, typing_node: @typing_node
+        )
       end
 
       def type_of_ensure(node)
@@ -963,6 +1265,8 @@ module Rigor
           Type::Combinator.nominal_of(value.class.name)
         when Type::IntegerRange
           Type::Combinator.nominal_of("Integer")
+        when Type::FloatRange
+          Type::Combinator.nominal_of("Float")
         else
           type
         end
@@ -1177,12 +1481,18 @@ module Rigor
       # and fired `undefined method 'upcase' for nil` on correct code. The candidate is still looked up
       # first — that lookup is a hash probe and owns the ADR-46 cross-file dependency edge — and
       # {#self_type_answers?} then vetoes the bind for a name the enclosing class answers itself.
-      def try_local_def_dispatch(node, receiver, arg_types)
+      #
+      # Issue #963 item 2 — {#plugin_member_answers?} is the second veto, for the members no source the
+      # engine walks can enumerate: a plugin's `dynamic_return` answer and the ADR-16 synthetic-method
+      # index. They are members of `self` exactly as an `attr_reader` is, so a top-level `def` must not
+      # bind ahead of them either.
+      def try_local_def_dispatch(node, receiver, arg_types, block_type = nil)
         local_def = node.receiver.nil? ? scope.bindable_top_level_def_for(node.name) : nil
         return nil unless local_def
         return nil if self_type_answers?(node.name)
+        return nil if plugin_member_answers?(node, receiver)
 
-        local_inference = infer_top_level_user_method(local_def, receiver, arg_types)
+        local_inference = infer_top_level_user_method(local_def, receiver, arg_types, block_type)
         return local_inference if local_inference
 
         # The local def matches by name but the inference was disqualified — the parameter shape is too
@@ -1194,6 +1504,82 @@ module Rigor
         dynamic_top
       end
 
+      # ADR-110 WD1 / #856 — the receiver's own `def` outranks a declaration that only an ANCESTOR carries.
+      #
+      # RBS resolves through the fully built method table, so `RbsDispatch` answers a subclass call with a
+      # signature written about the base. redmine's `FieldFormat::Base#target_class` honestly declares
+      # `-> nil`; `RecordList` overrides it with a real lookup, and every call on a `RecordList` receiver
+      # typed as `nil` and fired `undefined method ... for nil` on the subclass's own working code (#744).
+      # A signature is authoritative for a receiver only where someone wrote it about that receiver;
+      # reaching it through an ancestor is a lookup convenience, not an act of authorship.
+      #
+      # This is {#try_local_def_dispatch}'s shape one level up — there the enclosing class shadows a
+      # top-level `def`, here the receiver's class shadows an ancestor's declaration — and it answers the
+      # same way: re-type the override's body, and when that is not possible answer `Dynamic[Top]` rather
+      # than let the inherited declaration speak for a method it does not describe.
+      #
+      # Three conditions, and the third is the blast radius. Clause A of the ADR (an own source `def`, no
+      # own declaration) does NOT by itself stay clear of [ADR-43]: `class Foo; def each; end` inheriting
+      # `Enumerable#each` satisfies it, and disqualifying bundled declarations that way is the blanket fix
+      # ADR-43 rejected — the same reason {#instance_self_answers?}'s RBS arm is own-class only. So the
+      # ancestor whose declaration is being disqualified must itself be PROJECT-declared: a project sidecar
+      # describes the source under analysis, while a bundled signature describes a class the project does
+      # not own, where a project `def` is a monkey-patch and [ADR-17] owns the question.
+      # `project_declared_class?` fail-softs to false, so an unattributable environment changes nothing.
+      def try_overriding_def_dispatch(node, receiver, arg_types, method_name: node.name)
+        return nil unless overriding_own_def?(receiver, method_name)
+
+        try_user_method_inference(receiver, node, arg_types, method_name: method_name) || dynamic_top
+      end
+
+      # The three conditions above: an own source `def` of `method_name` on the receiver's class, which has no
+      # declaration of its own but inherits one a project-declared ancestor wrote.
+      def overriding_own_def?(receiver, method_name)
+        return false unless user_inference_receiver?(receiver)
+
+        class_name = receiver.class_name
+        return false if class_name.nil?
+        # `Scope#user_def_for`, not `discovered_method?`: the cross-file table deliberately withholds a
+        # plain instance `def` under the ADR-17 monkey-patch contract, and this gate must see one.
+        return false if scope.user_def_for(class_name, method_name).nil?
+
+        definition = safe_rbs_method_definition(class_name, method_name, :instance)
+        return false if definition.nil?
+        return false if rbs_declared_on_class?(definition, class_name)
+
+        project_declared_owner?(definition)
+      end
+
+      # {#implicit_index_read_type}'s dispatcher tier, with the write node as the call context.
+      def index_read_dispatch(node, receiver, arg_types)
+        MethodDispatcher.dispatch(
+          receiver_type: receiver, method_name: :[], arg_types: arg_types,
+          environment: scope.environment, call_node: node, scope: scope
+        )
+      end
+
+      # A splat index (`c[*keys] += v`) leaves the read's arity to the splat's expansion, and the one untyped
+      # argument standing in for it would bind positionally to a body written for several: `def [](*keys) =
+      # keys.size` folded the read of `r[*[0, 1]] += 1` to `1` and drew an always-falsey `n == 3` on a program
+      # that takes that branch. So the body tiers decline under a splat, as `try_literal_send` does, and only
+      # the signature-driven dispatch answers. An own `def` overriding an inherited declaration still outranks
+      # that declaration; with its body unreadable, it answers `Dynamic[top]`.
+      def splat_index_read_type(node, receiver, arg_types)
+        return dynamic_top if overriding_own_def?(receiver, :[])
+
+        index_read_dispatch(node, receiver, arg_types)
+      end
+
+      # Whether the class an inherited declaration was written about is one the project declares itself.
+      def project_declared_owner?(definition)
+        defined_in = definition.defined_in
+        return false if defined_in.nil?
+
+        Rigor::Reflection.project_declared_class?(defined_in.to_s, scope: scope)
+      rescue StandardError
+        false
+      end
+
       # Issue #618 — whether the call's enclosing `self` already answers `method_name`. Only a `self` whose
       # class is KNOWN participates: at genuine top level, and inside a block whose `self` is unmodelled,
       # `scope.self_type` is nil, the predicate is false, and the historical top-level binding stands — that
@@ -1212,30 +1598,71 @@ module Rigor
         end
       end
 
-      # The instance side of {#self_type_answers?}: the class's own discovered methods (`def`, `attr_*`,
-      # `define_method`, `alias`), its `Struct.new` / `Data.define` member accessors, a `def` reached through
-      # its project ancestors (superclass chain and included modules), and an RBS method declared on the
-      # class ITSELF.
+      # Issue #963 item 2 — the plugin arm of the veto: whether a plugin answers `node.name` on the call's
+      # own `self`. Asked of `MethodDispatcher.plugin_member_answers?`, which puts the question to the same
+      # two tiers dispatch would consult (the gated `dynamic_return` walk and the ADR-16 synthetic-method
+      # index), so the veto carries no plugin knowledge of its own.
+      #
+      # The confidence gate is #618's, unchanged and re-stated here rather than inherited: only a `self`
+      # whose class is KNOWN participates. At genuine top level, and inside a block whose `self` is
+      # unmodelled, `scope.self_type` is nil, `receiver` is the synthetic `Object` / `Dynamic[Top]` stand-in
+      # that {#call_receiver_type_for} substitutes, and asking a plugin about THAT receiver would be asking
+      # about a `self` the engine has not modelled — #316's / #319's territory, which this stays out of.
+      def plugin_member_answers?(node, receiver)
+        return false if scope.self_type.nil?
+
+        MethodDispatcher.plugin_member_answers?(
+          call_node: node, scope: scope, receiver_type: receiver, method_name: node.name
+        )
+      end
+
+      # The instance side of {#self_type_answers?}: the discovered methods (`def`, `attr_*`,
+      # `define_method`, `alias`) of the class or any project ancestor, its `Struct.new` / `Data.define`
+      # member accessors, a `def` reached through its project ancestors (superclass chain and included
+      # modules), and an RBS method declared on an owner that PRECEDES `::Object` in the MRO.
       #
-      # The RBS arm is own-class only, deliberately. An inherited-declaration test would match every
-      # `Object` / `Kernel` / `Enumerable` name and retract the binding v0.0.3 A exists for — a `def
-      # select(...)` collocated with its DSL-block call site would route straight back through
-      # `Enumerable#select`.
+      # Issue #633 — the discovery arm walks ancestors because inheritance does not distinguish how a
+      # method got there: a superclass `attr_accessor :stext` and an included module's `attr_reader` bind
+      # ahead of a top-level `def stext` exactly as an inherited `def` does, and only the latter had a walk.
+      #
+      # The RBS arm's cut-off is `::Object`, not the own class. A top-level `def` IS a private `Object`
+      # instance method, the last link of every MRO, so any declared owner that comes before `::Object`
+      # wins at runtime — `Exception#message` for a `StandardError` subclass, `Array#first`,
+      # `Comparable#clamp`. What the cut-off keeps out is the tier v0.0.3 A exists for and #316 / #319
+      # refined: a name owned by `Object` or `Kernel` themselves (`inspect`, `format`) is at or after the
+      # top-level `def`'s own rung, so the historical binding still stands there.
       def instance_self_answers?(class_name, method_name)
         return false if class_name.nil?
-        return true if scope.discovered_method?(class_name, method_name, :instance)
+        return true if scope.discovered_method_through_ancestors?(class_name, method_name, :instance)
         return true if meta_member?(class_name, method_name)
         return true if resolve_user_def_through_ancestors(class_name, method_name)
 
-        rbs_declared_on_class?(safe_rbs_method_definition(class_name, method_name, :instance), class_name)
+        rbs_ancestor_answers?(class_name, method_name)
+      end
+
+      # The RBS arm of {#instance_self_answers?}. A project class is usually absent from the RBS
+      # environment, so the declaration that decides the question is written about an ancestor the project
+      # does not declare (`StandardError`, `Array`, `Comparable`) — each is asked on its own terms, and
+      # each of them is itself before `::Object` in the reader's MRO by construction.
+      #
+      # Issue #527 slice 0 — the walk itself lives in {ExternalAncestorResolution}, which reports WHICH
+      # declaration answered because the dispatch side needs to dispatch there. This tier only needs to
+      # know that one did, so it reads the presence of an answer. Dependency recording stays ON: this
+      # arm genuinely read the ancestor's declaration to decide the binding.
+      def rbs_ancestor_answers?(class_name, method_name)
+        !ExternalAncestorResolution.resolve(class_name, method_name, :instance, scope: scope).nil?
       end
 
       # The singleton side: a class-body `self` is `Singleton[Foo]`, where an implicit-self call reaches
       # `Foo`'s own class methods before `Object`'s private top-level `def`.
+      #
+      # Issue #633 — both discovery arms follow the superclass chain, because a subclass inherits its
+      # parent's class methods; `Scope` narrows the singleton walk to superclasses for the same reason
+      # (an `include`d module's `def self.x` is not callable on the includer).
       def singleton_self_answers?(class_name, method_name)
         return false if class_name.nil?
-        return true if scope.discovered_method?(class_name, method_name, :singleton)
-        return true unless scope.singleton_def_for(class_name, method_name).nil?
+        return true if scope.discovered_method_through_ancestors?(class_name, method_name, :singleton)
+        return true unless scope.singleton_def_through_ancestors(class_name, method_name).first.nil?
 
         rbs_declared_on_class?(safe_rbs_method_definition(class_name, method_name, :singleton), class_name)
       end
@@ -1250,26 +1677,16 @@ module Rigor
         !members.nil? && members.include?(method_name.to_sym)
       end
 
+      # Issue #527 slice 0 — the RBS lookup, its `rescue`, and the `::Object` MRO cut-off moved to
+      # {ExternalAncestorResolution}, which the dispatch side reads too. These stay as this class's
+      # spelling of them, because three other tiers here (`try_overriding_def_dispatch`,
+      # {#singleton_self_answers?}) ask the own-class question without the ancestor walk.
       def safe_rbs_method_definition(class_name, method_name, kind)
-        if kind == :singleton
-          Rigor::Reflection.singleton_method_definition(class_name, method_name, scope: scope)
-        else
-          Rigor::Reflection.instance_method_definition(class_name, method_name, scope: scope)
-        end
-      rescue StandardError
-        nil
+        ExternalAncestorResolution.method_definition(class_name, method_name, kind, scope: scope)
       end
 
-      # True when the RBS declaration found for the name sits on `class_name` itself rather than on an
-      # ancestor; mirrors `CheckRules#defined_on?` and `SigGen::Generator#declared_on_class_itself?`.
       def rbs_declared_on_class?(definition, class_name)
-        return false if definition.nil?
-        return false unless definition.respond_to?(:defined_in)
-
-        defined_in = definition.defined_in
-        return false if defined_in.nil?
-
-        defined_in.to_s.delete_prefix("::") == class_name.to_s.delete_prefix("::")
+        ExternalAncestorResolution.declared_on_class?(definition, class_name)
       end
 
       # Issue #520 — Ruby defines the value of an attribute / index assignment (`x.attr = v`, `h[k] = v`)
@@ -1376,7 +1793,97 @@ module Rigor
       # `receiver_override` substitutes the receiver type for the whole pipeline (folds, dispatch, the
       # inference tiers) without re-reading the receiver node — the safe-navigation path (#518) dispatches
       # on the nil-stripped fragment, and the optional-receiver retry (#519) re-runs the pipeline on it.
+      # Issue #853: `break value` terminates the yielding CALL and is that call's value, so the answer every
+      # tier below produces — an RBS return, a precision fold, an inter-procedural inference — describes only
+      # the path where the block never breaks. The call's value is that result unioned with every `break` arm
+      # the block can reach. Modelling it here rather than inside each fold is what keeps the folds honest:
+      # `ops.all? { |o| break false unless o; true }` still folds the no-break path to `Constant[true]`, and
+      # the union with the `false` arm makes the call `bool` — no `flow.always-truthy-condition` on a program
+      # that really can answer false.
+      #
+      # Issue #1095: the callee's result is kept because an arbitrary callee may return without ever running
+      # the block. A catalogued exactly-once yielder ({BlockCallTiming}) cannot, so when its block's normal
+      # completion is unreachable the callee's result is too, and the call is its `break` arms alone — `bot`
+      # when every path raises or returns instead.
+      #
+      # Issue #1107: `Kernel#loop` declares `-> bot` but returns normally, with `StopIteration#result`, when its
+      # block raises `StopIteration`. Unless the body provably cannot ({BlockCallTiming.loop_may_complete?}),
+      # that normal return is `untyped` — the result's declared type — so `loop { e.next }` is not `bot` and
+      # `loop { x = e.next; break x if x }` keeps its arm beside it.
       def call_dispatch_type_for(node, receiver_override: nil)
+        result = loop_completion_type(node, call_result_type_for(node, receiver_override: receiver_override))
+        arms = call_break_arm_types(node, receiver_override: receiver_override)
+        if exactly_once_block_never_completes?(node, receiver_override)
+          return arms.empty? ? Type::Combinator.bot : Type::Combinator.union(*arms)
+        end
+
+        combined = arms.empty? ? result : Type::Combinator.union(result, *arms)
+        widen_optimistic_predicate_constant(node, combined)
+      end
+
+      # Issue #1172 — the nil-collapsing predicates (`nil?`, `!`, `x == nil`, …) answer a `Constant` that
+      # encodes the receiver's nil-freeness. When that nil-freeness is only *optimistic* — an
+      # `%a{implicitly-returns-nil}` read `RbsDispatch` deliberately reads past — the constant is a bet,
+      # not a fact, and unlike the in-scope `OptimisticOrigin` mark a folded `Constant[false]` survives
+      # into the enclosing method's return summary. A caller's `helper(...) ? a : b` then sees a
+      # proof-shaped constant and reports `flow.always-truthy-condition` on a live guard (the mark cannot
+      # follow a value across the method boundary, so {OptimisticOrigin.resolve} at the call site finds
+      # nothing). Widen the predicate's constant answer to `bool` when the call derives a mark: the three
+      # certainty consumers already decline on the mark inside this scope, and the widened return keeps
+      # the same judgment from leaking out as a folded return type. The carrier's own type is unchanged —
+      # `h[k]` still reads nil-free, per the spec's MUST NOT.
+      def widen_optimistic_predicate_constant(node, type)
+        return type unless type.is_a?(Type::Constant) && [true, false].include?(type.value)
+        # The carrier read itself keeps its declared answer even when that is a literal `true` /
+        # `false` — the mark says its nil-freeness is a bet, not that the value's class widened.
+        return type if scope.optimistic_origins[node]
+        return type if OptimisticOrigin.resolve(node, scope).nil?
+
+        # Widen only toward what a miss really answers: a safe-navigation call answers `nil`, and
+        # `!recv&.empty?` answers `true` either way, so widening either would invent the other boolean.
+        miss = OptimisticOrigin.miss_answer(node, scope)
+        return type unless miss.equal?(OptimisticOrigin::UNKNOWN_MISS) || miss == !type.value
+
+        Type::Combinator.union(Type::Combinator.constant_of(true), Type::Combinator.constant_of(false))
+      end
+
+      def loop_completion_type(node, result)
+        return result unless result.is_a?(Type::Bot) && BlockCallTiming.loop_may_complete?(node)
+
+        scope.record_dynamic_origin(node, DynamicOrigin::EXPLICIT_UNTYPED)
+        Type::Combinator.untyped
+      end
+
+      # Whether `node` calls a catalogued exactly-once yielder ({BlockCallTiming}) with a literal block that can
+      # never complete normally. Two proofs must BOTH hold. The syntactic one
+      # ({BlockCallTiming.never_completes_normally?}) says every path ends in a jump or a non-returning Kernel
+      # call. The block-return pass must also answer exactly `bot`: a reachable `next` joins its value instead
+      # (#841), so `tap { next "s" }` completes and keeps the receiver, and a nil-bearing or `Dynamic` value or a
+      # failed pass (`nil`) keeps the #853 union. The pass alone is not enough, because it also answers `bot`
+      # for a body whose last call merely DECLARES `-> bot` — a project method's signature, or `loop` before
+      # #1107 widened it ({#loop_completion_type}); `loop { e.next }` returns normally once `e` is drained, and
+      # trusting it made correct code report an always-falsey condition.
+      #
+      # The pre-gates run cheapest-first because the block is re-typed here: the name, a `Prism::BlockNode` (a
+      # `&blk` / `&:sym` block-pass carries no body to prove anything about), no arguments (none of the three
+      # takes one), the syntactic walk, then the resolved-owner check.
+      def exactly_once_block_never_completes?(node, receiver_override)
+        return false unless BlockCallTiming.candidate_name?(node.name)
+
+        block_node = node.block
+        return false unless block_node.is_a?(Prism::BlockNode) && block_node.body
+        return false if node.arguments
+        return false unless BlockCallTiming.never_completes_normally?(block_node.body, scope)
+
+        receiver = receiver_override || call_receiver_type_for(node)
+        return false unless BlockCallTiming.exactly_once_call?(
+          receiver_type: receiver, method_name: node.name, scope: scope
+        )
+
+        block_return_type_for(node, receiver, []).is_a?(Type::Bot)
+      end
+
+      def call_result_type_for(node, receiver_override: nil)
         narrowed = indexed_narrowing_for(node)
         return narrowed if narrowed
 
@@ -1392,7 +1899,7 @@ module Rigor
         literal_send = try_literal_send(node, receiver)
         return literal_send if literal_send
 
-        local_def_result = try_local_def_dispatch(node, receiver, arg_types)
+        local_def_result = try_local_def_dispatch(node, receiver, arg_types, block_type)
         return local_def_result if local_def_result
 
         # v0.0.6 phase 2 — per-element block fold for Tuple receivers. When `[a, b, c].map { |x| f(x) }` and
@@ -1403,6 +1910,9 @@ module Rigor
         block_fold = try_receiver_block_folds(node, receiver, arg_types)
         return block_fold if block_fold
 
+        overriding_def = try_overriding_def_dispatch(node, receiver, arg_types)
+        return overriding_def if overriding_def
+
         result = MethodDispatcher.dispatch(
           receiver_type: receiver,
           method_name: node.name,
@@ -1414,16 +1924,16 @@ module Rigor
         )
         return result if result
 
-        dispatch_miss_result(node, receiver, arg_types)
+        dispatch_miss_result(node, receiver, arg_types, block_type)
       end
 
       # The post-dispatch tiers for a call `MethodDispatcher` could not answer, in their historical
       # order; extracted from {#call_dispatch_type_for} whole.
-      def dispatch_miss_result(node, receiver, arg_types)
+      def dispatch_miss_result(node, receiver, arg_types, block_type = nil)
         # v0.0.2 #5 — inter-procedural inference for user-defined methods. When dispatch misses but the
         # receiver is a user class with a `def` body, re-type the body with the call's argument types bound
         # and return the body's last-expression type.
-        user_inference = try_user_method_inference(receiver, node, arg_types)
+        user_inference = try_user_method_inference(receiver, node, arg_types, block_type: block_type)
         return user_inference if user_inference
 
         # Module-singleton call resolution (ADR-57 follow-up) — when the receiver is `Singleton[Foo]` (a
@@ -1431,7 +1941,7 @@ module Rigor
         # `module_function` body, re-type that body with the call args bound. Sits after the RBS dispatch
         # tier, so foreign / RBS-known singletons (`Math.sqrt`) keep their catalog answer; only
         # project-defined singleton methods reach here.
-        singleton_inference = try_project_singleton_inference(receiver, node, arg_types)
+        singleton_inference = try_project_singleton_inference(receiver, node, arg_types, block_type: block_type)
         return singleton_inference if singleton_inference
 
         # Dynamic-origin propagation: when the receiver is Dynamic[T] and no positive rule resolves the call,
@@ -1634,8 +2144,8 @@ module Rigor
       # `scope.self_type` (or implicit `Object`) as the receiver carrier so the body's own self is
       # consistent with the call site's. Returns nil when the parameter shape disqualifies the def, when the
       # body is empty, or when a recursion cycle is detected.
-      def infer_top_level_user_method(def_node, receiver, arg_types)
-        infer_user_method_return(def_node, receiver, arg_types)
+      def infer_top_level_user_method(def_node, receiver, arg_types, block_type = nil)
+        infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
       rescue StandardError
         nil
       end
@@ -1706,6 +2216,9 @@ module Rigor
       # The three receiver-shaped block folds, in their historical order (extracted whole from
       # `call_dispatch_type_for` for method-length budget).
       def try_receiver_block_folds(node, receiver, arg_types)
+        rebound = rebound_operand_typer(node)
+        return rebound.send(:try_receiver_block_folds, node, receiver, arg_types) if rebound
+
         per_element = try_per_element_block_fold(node, receiver)
         return per_element if per_element
 
@@ -1715,6 +2228,25 @@ module Rigor
         try_hash_shape_block_fold(node, receiver)
       end
 
+      # Issue #1365 — Ruby runs a call's receiver chain and arguments before the method yields, so when they may
+      # rebind the match globals ({MatchRebinding.operands_may_rebind?}: `[u.index(/(q)/)].map { $1 }`) every
+      # pass that types the call's block — the block-return pass, its captured-local fixpoint and the receiver
+      # folds — types it under a typer whose scope has forgotten them, as {MatchRebinding.block_entry} does for
+      # the call's block and `StatementEvaluator#forget_operand_specials` for the statement. `$_` is forgotten on
+      # the same terms when they may set it ({LastLine.operands_may_set?}, issue #1359). nil otherwise.
+      def rebound_operand_typer(call_node)
+        return nil if call_node.block.nil?
+
+        rebound = scope
+        if rebound.match_globals_bound? && MatchRebinding.operands_may_rebind?(call_node, scope)
+          rebound = rebound.forget_match_globals
+        end
+        rebound = rebound.forget_last_line if rebound.last_line_bound? && LastLine.operands_may_set?(call_node, scope)
+        return nil if rebound.equal?(scope)
+
+        ExpressionTyper.new(scope: rebound, tracer: tracer, operand_types: @operand_types, typing_node: @typing_node)
+      end
+
       # Issue #533 — `x.send(:selector, args)` with a LITERAL symbol is statically `x.selector(args)`:
       # the private-boundary idiom (protobuf's `send(:get_file_descriptor)` at 84 sites) resolves through
       # the same dispatch + project-inference tiers as the direct call would. `send` legitimately crosses
@@ -1745,14 +2277,15 @@ module Rigor
           try_project_singleton_inference(receiver, node, inner_args, method_name: inner_name)
       end
 
-      def try_user_method_inference(receiver, call_node, arg_types, method_name: call_node.name)
+      def try_user_method_inference(receiver, call_node, arg_types, method_name: call_node.name, block_type: nil)
         return nil unless user_inference_receiver?(receiver)
 
         def_node, owner = resolve_user_def_with_owner(receiver.class_name, method_name)
         return nil if def_node.nil?
 
         result = infer_user_method_return(def_node, receiver, arg_types,
-                                          self_fold_safe: fold_safe_call_receiver?(call_node, receiver))
+                                          self_fold_safe: fold_safe_call_receiver?(call_node, receiver),
+                                          yield_type: block_type)
         return result if result.nil?
 
         degrade_if_overridable(result, owner, method_name, :instance)
@@ -1823,13 +2356,14 @@ module Rigor
       # The OWNER — not the receiver class — is what the overridable gate keys on, exactly as the instance
       # side does: adopting `Base`'s literal return is unsound when a subclass redefines the method, and
       # after this change the resolved body is routinely not the receiver's own.
-      def try_singleton_method_inference(receiver, call_node, arg_types, method_name: call_node.name)
+      def try_singleton_method_inference(receiver, call_node, arg_types, method_name: call_node.name,
+                                         block_type: nil)
         return nil unless receiver.is_a?(Type::Singleton)
 
         def_node, owner = resolve_singleton_def_with_owner(receiver.class_name, method_name)
         return nil if def_node.nil?
 
-        result = infer_user_method_return(def_node, receiver, arg_types)
+        result = infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
         return result if result.nil?
 
         degrade_if_overridable(result, owner, method_name, :singleton)
@@ -1857,9 +2391,11 @@ module Rigor
       # body the project itself wrote. Which of the two tiers applies is decided by the receiver carrier —
       # `Singleton[Foo]` when the constant names a class or module, `Nominal[…]` when it holds an ordinary
       # object (#320) — so the two are mutually exclusive and consulting both is one resolution attempt.
-      def try_project_singleton_inference(receiver, call_node, arg_types, method_name: call_node.name)
-        try_singleton_method_inference(receiver, call_node, arg_types, method_name: method_name) ||
-          try_singleton_object_constant_inference(receiver, call_node, arg_types, method_name: method_name)
+      def try_project_singleton_inference(receiver, call_node, arg_types, method_name: call_node.name,
+                                          block_type: nil)
+        kwargs = { method_name: method_name, block_type: block_type }
+        try_singleton_method_inference(receiver, call_node, arg_types, **kwargs) ||
+          try_singleton_object_constant_inference(receiver, call_node, arg_types, **kwargs)
       end
 
       # #320 — resolves a call whose receiver is a constant holding an ordinary object with a `class << Const`
@@ -1867,13 +2403,14 @@ module Rigor
       # that object, so the receiver carrier is passed through unchanged. Own-constant only, and only for a
       # name the project actually recorded — a miss degrades to today's `Dynamic[top]`, never a false
       # resolution. `Singleton` receivers never reach here: {#try_singleton_method_inference} owns them.
-      def try_singleton_object_constant_inference(receiver, call_node, arg_types, method_name: call_node.name)
+      def try_singleton_object_constant_inference(receiver, call_node, arg_types, method_name: call_node.name,
+                                                  block_type: nil)
         return nil unless receiver.is_a?(Type::Nominal)
 
         def_node = SingletonObjectConstant.def_node_for(call_node, receiver, method_name, scope)
         return nil if def_node.nil?
 
-        infer_user_method_return(def_node, receiver, arg_types)
+        infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
       rescue StandardError
         nil
       end
@@ -1889,25 +2426,49 @@ module Rigor
       CLASS_GRAPH_CACHE_KEY = :__rigor_class_graph_cache__
       private_constant :CLASS_GRAPH_CACHE_KEY
 
-      # Run-scoped memo for the static class-graph resolvers below. They are pure functions of the *frozen*
-      # project index trio (`discovered_def_nodes` / `discovered_superclasses` / `discovered_includes`) —
-      # `user_def_for` / `superclass_of` / `includes_of` read nothing else, and never touch the current
-      # scope's locals or narrowings — so a result computed for one `(class, method)` is valid for every
-      # `Scope` that shares those tables. `ExpressionTyper` is rebuilt per `Scope#type_of`, so the memo lives
-      # on `Thread.current` rather than on `self`. It is keyed by the *identity* of the three frozen tables
-      # (nested `compare_by_identity` stores): a new analysis generation, or any `Scope` that swaps an index
-      # via `with_discovered_*`, transparently lands in a fresh bucket while everything sharing the tables
-      # shares the memo. Steady-state cost is three identity-keyed hash reads and zero allocation — the `||=`
-      # chains only allocate on the first miss of a generation. (Pool mode forks per worker, so the
-      # `Thread.current` store is process-local and never crosses a project boundary.)
+      # Memo for the static class-graph resolvers below. They are pure functions of the scope's *frozen*
+      # discovery tables — `user_def_for` / `superclass_of` / `includes_of` and the ancestor-name resolver
+      # read nothing else, and never touch the current scope's locals or narrowings — so a result computed
+      # for one `(class, method)` is valid for every `Scope` carrying the same {DiscoveryIndex}.
+      #
+      # The key is that index's identity, NOT the three tables the walk is usually described by. Five
+      # tables are in play: `discovered_def_nodes` / `discovered_superclasses` / `discovered_includes`,
+      # plus `discovered_header_nestings` and `discovered_methods`, which {Scope#ancestor_name_candidates}
+      # and {Scope#known_user_class?} read when resolving an ancestor name to a project class. Keying on
+      # the trio alone would let a `discovery.with(discovered_methods: …)` that happens to share the trio
+      # serve a name resolution computed against the OLD table. The index that owns all five is one
+      # object, so keying on it is both cheaper to check and correct by construction — and stays correct
+      # when a sixth table joins the walk.
+      #
+      # ONE slot, replaced rather than accumulated — the same shape, and now the same key, as
+      # {MethodDispatcher::RbsDispatch}'s `core_stdlib_memo`. `ExpressionTyper` is rebuilt per
+      # `Scope#type_of`, so the slot lives on `Thread.current` rather than on `self`. A `Scope` merges its
+      # file's discovery with the project pre-pass, so every analysed file arrives with a fresh index: an
+      # identity-keyed *store* grew one bucket per file and, because the keys ARE the tables, pinned every
+      # file's whole discovery index for the length of the run. What that bought, measured over
+      # `lib`+`plugins`: 552 buckets holding 1,834 entries between them, and 58 of 80,106 calls answered
+      # across files — 149 of the 701 slot switches returned to a bucket seen before, all of them in the
+      # seed phases that revisit the project index. One slot gives those 58 answers up and allocates 706
+      # buckets instead of 552, and still allocates FEWER objects over `lib` than the store did (−368),
+      # because one `equal?` is cheaper than three identity-hash lookups.
+      #
+      # Steady-state cost is one `equal?` check and zero allocation; the array and the buckets are
+      # allocated once per index. (Pool mode forks per worker, so the `Thread.current` slot is
+      # process-local and never crosses a project boundary — and note that the parent's reported
+      # `Memory peak` therefore does not see a worker's share of this at all.)
       def class_graph_buckets
-        store = (Thread.current[CLASS_GRAPH_CACHE_KEY] ||= {}.compare_by_identity)
-        by_def = (store[scope.discovered_def_nodes] ||= {}.compare_by_identity)
-        by_super = (by_def[scope.discovered_superclasses] ||= {}.compare_by_identity)
-        # `self_pure` is issue #525's grant scan (identity-keyed by def node); it belongs here because it
-        # is a pure function of the same frozen index trio — the sibling resolver it walks reads nothing
-        # else.
-        by_super[scope.discovered_includes] ||= { name: {}, user_def: {}, self_pure: {}.compare_by_identity }
+        discovery = scope.discovery
+        slot = Thread.current[CLASS_GRAPH_CACHE_KEY]
+        unless slot && slot[0].equal?(discovery)
+          # `self_pure` is issue #525's grant scan (identity-keyed by def node); it belongs here because it
+          # is a pure function of the same frozen index — the sibling resolver it walks reads nothing else.
+          # `singleton_def` is added lazily by {#singleton_def_through_ancestors}'s caller.
+          slot = [discovery,
+                  { name: {}, user_def: {}, self_pure: {}.compare_by_identity,
+                    yields: {}.compare_by_identity }]
+          Thread.current[CLASS_GRAPH_CACHE_KEY] = slot
+        end
+        slot[1]
       end
 
       def resolve_user_def_through_ancestors(class_name, method_name)
@@ -1966,16 +2527,40 @@ module Rigor
       OVERRIDE_GATE_CACHE_KEY = :__rigor_overridable_method_gate__
       private_constant :OVERRIDE_GATE_CACHE_KEY
 
-      # Run-scoped memo for {#overridden_in_project?}, keyed (like `class_graph_buckets`) by the identity of
-      # the frozen discovery trio so a new analysis generation lands in a fresh bucket, then nested `kind →
-      # owner → method_name`. The predicate is a pure function of those tables. Nesting avoids allocating a
-      # composite cache key on the hot path (the gate runs on every adopted self-call return), so a
-      # steady-state hit is three identity hash reads + two string/symbol hash reads with zero allocation.
+      # Memo for {#overridden_in_project?}, nested `kind → owner → method_name`. The predicate is a pure
+      # function of the scope's frozen discovery tables, so that index's *identity* is what says whether a
+      # bucket still applies. Nesting under `kind` and `owner` avoids allocating a composite cache key on
+      # the hot path (the gate runs on every adopted self-call return), so a steady-state hit is one
+      # `equal?` check and three keyed hash reads with zero allocation.
+      #
+      # The key is the whole {Scope::DiscoveryIndex}, NOT the `discovered_def_nodes` /
+      # `discovered_superclasses` / `discovered_includes` trio the walk is usually described by — the same
+      # key, for the same reason, as {#class_graph_buckets}. {#related_to_owner?} reaches
+      # {Scope#ancestor_name_candidates} and {Scope#known_user_class?}, which read
+      # `discovered_header_nestings` and `discovered_methods` as well, so a trio key would let an index
+      # that swapped only one of those serve an answer computed against the old table. Over `lib`+`plugins`
+      # the two keys switch the same 113 times, so correctness here is free.
+      #
+      # ONE slot, replaced rather than accumulated — the same shape as
+      # {MethodDispatcher::RbsDispatch}'s `core_stdlib_memo`. A `Scope` merges its file's discovery with the
+      # project pre-pass, so every analysed file gets a fresh index: an identity-keyed *store* grew one
+      # bucket per file and, because the key IS the index, pinned every file's whole discovery index for the
+      # length of the run — 109 live buckets over `lib`+`plugins`, one per distinct trio at every key level,
+      # holding 418 answers between them (211 instance, 207 singleton).
+      #
+      # What the store bought for that was one bucket's worth of cross-file reuse, not 109: only the
+      # project-seed scope recurs, because {Analysis::Runner} types each file's pre-passes under it before
+      # {ScopeIndexer} merges the file's own discovery in. A bucket is two small hashes, so giving that up
+      # is free — unlike {#method_definers_index} below, whose bucket costs a full table scan and which is
+      # keyed and bounded differently for exactly that reason.
       def override_gate_buckets
-        store = (Thread.current[OVERRIDE_GATE_CACHE_KEY] ||= {}.compare_by_identity)
-        by_def = (store[scope.discovered_def_nodes] ||= {}.compare_by_identity)
-        by_super = (by_def[scope.discovered_superclasses] ||= {}.compare_by_identity)
-        by_super[scope.discovered_includes] ||= { instance: {}, singleton: {} }
+        discovery = scope.discovery
+        slot = Thread.current[OVERRIDE_GATE_CACHE_KEY]
+        unless slot && slot[0].equal?(discovery)
+          slot = [discovery, { instance: {}, singleton: {} }]
+          Thread.current[OVERRIDE_GATE_CACHE_KEY] = slot
+        end
+        slot[1]
       end
 
       # True when some discovered project class/module — distinct from `owner` — redefines `(method_name,
@@ -2015,14 +2600,65 @@ module Rigor
       METHOD_DEFINERS_INDEX_KEY = :__rigor_method_definers_index__
       private_constant :METHOD_DEFINERS_INDEX_KEY
 
-      # Per-generation `method_name (Symbol) → [owner names]` inverted index over the instance / singleton
-      # def tables, memoised by the identity of the def table it inverts (a new analysis generation lands in
-      # a fresh bucket). The toplevel sentinel is excluded — a toplevel `def` has no class ancestry and so
-      # can never be an override.
+      # The second way. Two flat thread slots rather than one slot holding an array of ways: a
+      # `Thread.current[KEY] ||= […]` seeds the store with an array LITERAL, which folds to a tuple whose
+      # elements are pinned, and the engine then reads the `way[0].equal?(…)` guards below as always-falsey
+      # (`make check` fires `flow.always-truthy-condition` on this very file). Two keys read as two plain
+      # `Thread.current` reads and keep the guards analysable.
+      METHOD_DEFINERS_INDEX_ALT_KEY = :__rigor_method_definers_index_alt__
+      private_constant :METHOD_DEFINERS_INDEX_ALT_KEY
+
+      # `method_name (Symbol) → [owner names]` inverted index over the instance / singleton def tables,
+      # valid for exactly as long as the table it inverts: a new analysis generation, or a `Scope` that swaps
+      # its index through {Scope#with_discovery}, needs a fresh one. The toplevel sentinel is excluded — a
+      # toplevel `def` has no class ancestry and so can never be an override.
+      #
+      # Bounded to TWO slots, replaced rather than accumulated. This memo is the costliest member of the
+      # per-file-store family, because it does not hold a handful of resolved answers but a whole inverted
+      # index built over a file's merged def table: an identity-keyed *store* held 135 of them over
+      # `lib`+`plugins` — 744,431 index rows, 50.0 MB in the index hashes and their owner-name arrays alone,
+      # on top of the def tables the keys pinned.
+      #
+      # Two, and not the one slot the cheaper memos in this family use, because the tables ALTERNATE.
+      # {Analysis::Runner} types each file's pre-passes under the project-seed scope and its main pass under
+      # the file's merged tables. Where a file reaches this gate from BOTH phases the request sequence is
+      # `seed, file_1, seed, file_2, …`, and a single slot evicts the seed's index once per file and
+      # rebuilds it on the next — a full scan of the seed's whole def table, every file. 200 synthetic
+      # files shaped that way measured +22.6 % allocations against the store, which a bounded slot must not
+      # cost. Two ways — a most-recently-used slot and one alternate, swapped on a hit in the alternate —
+      # cover that period-2 shape exactly: the same 200 files rebuild 201 times, matching the store.
+      #
+      # Wider rotations are not covered, and do not need to be. On `lib`+`plugins` only 6 of the 109 gating
+      # files consult the seed's table, so its uses are separated by many other files' tables and fall out
+      # of both ways: five rebuilds of a 700-entry table remain, about 4 ms. Retention is bounded at two
+      # generations either way, which is what the store failed to do.
+      #
+      # A way is `[def_nodes, singleton_def_nodes, instance_index, singleton_index]`, so it keys on BOTH def
+      # tables and a gate call that alternates instance and singleton kinds within one file does not rebuild
+      # either. Each index is still built lazily: a run that never asks a singleton question never pays for
+      # the singleton index.
+      #
+      # DELIBERATELY not keyed on the whole {Scope::DiscoveryIndex}, unlike {#class_graph_buckets} and
+      # {#override_gate_buckets} above. {#build_method_definers_index} reads the ONE table it is handed and
+      # nothing else, so the def tables are already the complete key, and the index object is a strictly
+      # narrower one: the project-seed scope carries a fresh index per file while its def tables stay the
+      # same object. Over the 200 synthetic files above, an index-keyed memo misses all 400 times where a
+      # def-table-keyed one misses 201 — it would rebuild the seed's 934-entry table once per file and hand
+      # back the +22.6 % this bound exists to avoid. Check that number before widening this key to match
+      # its siblings.
       def method_definers_index(kind)
-        table = kind == :singleton ? scope.discovered_singleton_def_nodes : scope.discovered_def_nodes
-        store = (Thread.current[METHOD_DEFINERS_INDEX_KEY] ||= {}.compare_by_identity)
-        store[table] ||= build_method_definers_index(table)
+        def_nodes = scope.discovered_def_nodes
+        singleton_def_nodes = scope.discovered_singleton_def_nodes
+        way = Thread.current[METHOD_DEFINERS_INDEX_KEY]
+        unless way && way[0].equal?(def_nodes) && way[1].equal?(singleton_def_nodes)
+          alt = Thread.current[METHOD_DEFINERS_INDEX_ALT_KEY]
+          alt = nil unless alt && alt[0].equal?(def_nodes) && alt[1].equal?(singleton_def_nodes)
+          Thread.current[METHOD_DEFINERS_INDEX_ALT_KEY] = way
+          way = alt || [def_nodes, singleton_def_nodes, nil, nil]
+          Thread.current[METHOD_DEFINERS_INDEX_KEY] = way
+        end
+        singleton = kind == :singleton
+        way[singleton ? 3 : 2] ||= build_method_definers_index(singleton ? singleton_def_nodes : def_nodes)
       end
 
       def build_method_definers_index(table)
@@ -2078,14 +2714,6 @@ module Rigor
       INFERENCE_SUMMARY_KEY = :__rigor_user_method_return_summary__
       private_constant :INFERENCE_SUMMARY_KEY
 
-      # Monotonic per-thread counter, bumped once each time `consult_summary` actually reads an in-flight
-      # fixpoint assumption (ADR-55 slice 2). A method return computed across an interval in which this
-      # counter does NOT move depended on no transient Kleene iterate, so it is FINAL and safe to memoise —
-      # even when the `summaries` table is non-empty because some unrelated outermost frame merely *seeded*
-      # (but never consulted) its own entry. See `infer_user_method_return`'s post-hoc memo gate.
-      SUMMARY_CONSULT_COUNTER_KEY = :__rigor_user_method_summary_consults__
-      private_constant :SUMMARY_CONSULT_COUNTER_KEY
-
       # Per-thread append-only log of the seed depths of every in-flight summary `consult_summary` read
       # (ADR-55 slice 2 mutual-recursion soundness fix, 2026-06-12). Each fixpoint owner records the guard
       # stack size at seed time on its entry (`depth:`); a consult appends the consulted entry's depth here.
@@ -2248,9 +2876,15 @@ module Rigor
       # the body both qualify. It does NOT need its own memo-key slot here — the bit is observable on the
       # built `body_scope`, which is where every downstream consumer (the memo key, the recursion context)
       # reads it from, so the two can never disagree.
-      def infer_user_method_return(def_node, receiver, arg_types, self_fold_safe: false)
+      #
+      # `yield_type` (issue #720) is the OTHER call-site-varying input, and unlike `self_fold_safe` it is
+      # not observable on the body scope, so it does need its own memo-key slot. It is dropped for a def
+      # that cannot reach a `yield` — nearly all of them — which keeps the key shape constant for the
+      # methods the memo actually carries and confines the extra dimension to yielding callees.
+      def infer_user_method_return(def_node, receiver, arg_types, self_fold_safe: false, yield_type: nil)
         return nil if def_node.body.nil?
 
+        yield_type = nil unless yield_type && body_yields?(def_node)
         body_scope = build_user_method_body_scope(def_node, receiver, arg_types,
                                                   self_fold_safe: self_fold_safe)
         return nil if body_scope.nil?
@@ -2283,42 +2917,87 @@ module Rigor
         # outermost method and thereafter the old `summaries.empty?` gate disabled the memo for every nested
         # call, re-walking the shared sub-readers combinatorially (~932k body evaluations for ~20 tiny
         # methods). The computation itself lives in `compute_user_method_return`.
-        unless memo_candidate?(stack, plain_signature)
-          trace_memo_refusal(stack, plain_signature)
-          return compute_user_method_return(def_node, body_scope, stack, summaries,
+        # Issue #720 — the frame the body's `yield`s read, installed for the whole inference (the memo key
+        # below reads it back from here rather than taking a second parameter, so key and frame cannot
+        # disagree). It is installed even when nil, which is what stops a blockless callee reached from
+        # inside a yielding body from inheriting the outer caller's block.
+        ExpressionTyper.with_call_site_frame(yield_type, forwarded_frame_types(def_node, arg_types)) do
+          unless memo_candidate?(stack, plain_signature)
+            trace_memo_refusal(stack, plain_signature)
+            next compute_user_method_return(def_node, body_scope, stack, summaries,
                                             receiver, arg_types, plain_signature)
+          end
+
+          # INVARIANT (ADR-46 recording soundness, ADR-84 WD2) — the deep cross-file dependency edges (the
+          # reads a callee body's dispatches perform through the instrumented `Scope` accessors) are recorded,
+          # per consumer, only as a side effect of evaluating that body, and a memo hit serves the return
+          # WITHOUT re-evaluating it. Since the bucket is run-scoped, hits CROSS consumer-file boundaries, so
+          # every cross-file hit is PAIRED WITH CACHE-AND-REPLAY of the callee's read-set: under recording,
+          # the first evaluation of a key captures the recorder events of its body walk
+          # (`DependencyRecorder.capture` — observe-and-forward, so the first consumer's own record is
+          # untouched) onto the entry, and a hit replays that set into the current consumer's accumulator
+          # (`DependencyRecorder.replay`, which re-applies the per-consumer self-read filter). A memo hit is
+          # thereby edge-equivalent to a fresh body evaluation for EVERY consumer. The naive alternative —
+          # bypassing the memo while the recorder is active — measured >200x wall on analyzer-shaped files
+          # (ActiveStorage video_analyzer.rb's subtree, 0.43s -> >90s; PR #79) and stays rejected. Pinned by
+          # spec/rigor/inference/return_memo_recording_spec.rb (cross-file replay completeness) and
+          # dependency_recorder_spec.rb's transitive deep-edge example.
+          consult_and_store_return_memo(def_node, body_scope, stack, summaries,
+                                        receiver, arg_types, plain_signature)
         end
+      end
+
+      # Issue #720 — the constructs that own a `yield` written inside them, so a scan for "can this def's
+      # body reach a `yield` that names THIS def's block?" must stop at them. A nested `def` / `class` /
+      # `module` / `class << self` starts a new method-block binding; a block or a lambda does NOT — `yield`
+      # inside `[1, 2].each { yield }` still calls the enclosing method's block, which is precisely the
+      # `each`-wrapper idiom this fix has to keep seeing.
+      YIELD_BOUNDARY_NODES = Set[
+        Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode
+      ].freeze
+      private_constant :YIELD_BOUNDARY_NODES
+
+      # Whether `def_node`'s body can reach a `yield`, memoised by def-node identity: it gates the
+      # per-call-site memo dimension above and would otherwise be re-walked once per call site of every
+      # user method. It rides in {#class_graph_buckets} for LIFETIME, not for correctness — a pure
+      # function of the AST depends on none of the tables that bucket keys on, but a store that is
+      # replaced with the analysis generation cannot outlive the nodes it holds.
+      def body_yields?(def_node)
+        cache = class_graph_buckets[:yields]
+        return cache[def_node] if cache.key?(def_node)
+
+        cache[def_node] = yield_reachable?(def_node.body)
+      end
 
-        # INVARIANT (ADR-46 recording soundness, ADR-84 WD2) — the deep cross-file dependency edges (the
-        # reads a callee body's dispatches perform through the instrumented `Scope` accessors) are recorded,
-        # per consumer, only as a side effect of evaluating that body, and a memo hit serves the return
-        # WITHOUT re-evaluating it. Since the bucket is run-scoped, hits CROSS consumer-file boundaries, so
-        # every cross-file hit is PAIRED WITH CACHE-AND-REPLAY of the callee's read-set: under recording,
-        # the first evaluation of a key captures the recorder events of its body walk
-        # (`DependencyRecorder.capture` — observe-and-forward, so the first consumer's own record is
-        # untouched) onto the entry, and a hit replays that set into the current consumer's accumulator
-        # (`DependencyRecorder.replay`, which re-applies the per-consumer self-read filter). A memo hit is
-        # thereby edge-equivalent to a fresh body evaluation for EVERY consumer. The naive alternative —
-        # bypassing the memo while the recorder is active — measured >200x wall on analyzer-shaped files
-        # (ActiveStorage video_analyzer.rb's subtree, 0.43s -> >90s; PR #79) and stays rejected. Pinned by
-        # spec/rigor/inference/return_memo_recording_spec.rb (cross-file replay completeness) and
-        # dependency_recorder_spec.rb's transitive deep-edge example.
-        consult_and_store_return_memo(def_node, body_scope, stack, summaries,
-                                      receiver, arg_types, plain_signature)
+      def yield_reachable?(node)
+        return false if node.nil?
+        return true if node.is_a?(Prism::YieldNode)
+
+        node.rigor_each_child do |child|
+          next if YIELD_BOUNDARY_NODES.include?(child.class)
+
+          return true if yield_reachable?(child)
+        end
+        false
       end
 
       # The candidate-frame memo path: consult the current run generation's bucket, and on a miss compute
       # and store a FINAL result. Reached only when `memo_candidate?` held (see `infer_user_method_return`).
-      # The store gate (ADR-84 WD3): a result is stored when the ADR-55 fixpoint consult counter did not
-      # move across the compute (the WD0 `MEMO_REFUSE_CONSULT_TAINTED` non-store) AND no transient-machinery
-      # event during the bracket referenced a stack frame BELOW the bracket's entry depth (see
-      # TRANSIENT_EVENT_DEPTHS_KEY). Below-entry events — an ancestor's in-flight Kleene iterate read by a
-      # guard hit, a shared-fuel exhaustion, a possibly-ancestor-caused WD1 clamp — mean the ancestor
-      # context influenced `result`, which a standalone recompute would not reproduce; at-or-above-entry
-      # events are the compute's own deterministic machinery (its own converged fixpoint, sub-cycles that
-      # opened and closed inside the bracket) and do not block the store. A top-of-stack compute (entry
-      # depth 0) is standalone by construction. A hit under ADR-46 recording replays the entry's captured
-      # read-set into the current consumer (see the INVARIANT comment at the call site).
+      # The store gate (ADR-84 WD3): a result is stored when no transient-machinery event during the
+      # bracket referenced a stack frame BELOW the bracket's entry depth (see TRANSIENT_EVENT_DEPTHS_KEY).
+      # A separate ADR-55 fixpoint-consult bracket counter used to sit in front of this test; it is gone
+      # (issue #875) because the event log already subsumes it — the sole `consult_summary` call site is
+      # the in-cycle guard hit, which logs its event at the consulted owner's position first, so a consult
+      # that could taint a bracket is a below-entry event by construction. Below-entry events — an
+      # ancestor's in-flight Kleene iterate read by a guard hit, a shared-fuel exhaustion, a
+      # possibly-ancestor-caused WD1 clamp — mean the ancestor context influenced `result`, which a
+      # standalone recompute would not reproduce; at-or-above-entry events are the compute's own
+      # deterministic machinery (its own converged fixpoint, sub-cycles that opened and closed inside the
+      # bracket) and do not block the store. A top-of-stack compute (entry depth 0) is standalone by
+      # construction. ADR-84 WD6 adds one exemption on top: a tainted result that
+      # is already `Dynamic[top]` is stored anyway — see `top_result?`. A hit under ADR-46 recording
+      # replays the entry's captured read-set into the current consumer (see the INVARIANT comment at the
+      # call site).
       def consult_and_store_return_memo(def_node, body_scope, stack, summaries,
                                         receiver, arg_types, plain_signature)
         per_def = (return_memo_bucket[def_node] ||= {})
@@ -2327,9 +3006,14 @@ module Rigor
         # was foldable and `Dynamic[top]` when it was not. Without it in the key the first call site to
         # reach a def would poison every later one with the other polarity. It is read off the body scope
         # rather than passed in, so the key cannot drift from the scope that produced the result.
+        # Issue #720 — the FOURTH such dimension, and it is read off the installed frame rather than
+        # passed in for the same reason: a yielding callee's return depends on the block THIS call site
+        # hands it, so two call sites passing differently-typed blocks must not share an entry. It is nil
+        # for every def that cannot reach a `yield`, which is where the memo's mass is.
         memo_key = [receiver.describe(:short),
                     arg_types.map { |type| type.describe(:short) },
-                    body_scope.struct_fold_safe?(:self)]
+                    body_scope.struct_fold_safe?(:self),
+                    ExpressionTyper.current_yield_value_type&.describe(:short)]
         if (entry = per_def[memo_key])
           BudgetTrace.hit(BudgetTrace::MEMO_HITS)
           Analysis::DependencyRecorder.replay(entry.read_set) if Analysis::DependencyRecorder.active?
@@ -2340,13 +3024,10 @@ module Rigor
 
         entry_depth = stack.size
         event_mark = transient_event_mark
-        consults_before = summary_consult_count
         result, read_set = compute_with_read_capture(def_node, body_scope, stack, summaries,
                                                      receiver, arg_types, plain_signature)
 
-        if summary_consult_count != consults_before
-          BudgetTrace.hit(BudgetTrace::MEMO_REFUSE_CONSULT_TAINTED)
-        elsif context_tainted?(event_mark, entry_depth)
+        if context_tainted?(event_mark, entry_depth) && !top_result?(result)
           BudgetTrace.hit(BudgetTrace::MEMO_REFUSE_TRANSIENT)
         else
           per_def[memo_key] = MemoEntry.new(result: result, read_set: read_set,
@@ -2359,19 +3040,48 @@ module Rigor
         Thread.current[TRANSIENT_EVENT_DEPTHS_KEY]&.size || 0
       end
 
-      def summary_consult_count
-        Thread.current[SUMMARY_CONSULT_COUNTER_KEY] || 0
-      end
-
       # ADR-84 WD3 — true when a transient-machinery event logged during the bracket (entries past
       # `event_mark`) referenced a frame below `entry_depth`. The log is cleared when the guard stack drains
       # (only possible mid-bracket for a top-of-stack compute, whose events are deterministic anyway), so a
       # missing / shorter log reads as untainted.
+      #
+      # Scanned by index rather than over `log[event_mark..]`: the log is append-only for the whole
+      # outermost entry, so the suffix slice allocated an array per candidate compute — a term quadratic in
+      # the event count, and the `ary_ensure_room_for_push` / GC-sweep profile issue #870 sampled.
       def context_tainted?(event_mark, entry_depth)
         log = Thread.current[TRANSIENT_EVENT_DEPTHS_KEY]
         return false if log.nil? || log.size <= event_mark
 
-        log[event_mark..].any? { |depth| depth < entry_depth }
+        index = event_mark
+        size = log.size
+        while index < size
+          return true if log[index] < entry_depth
+
+          index += 1
+        end
+        false
+      end
+
+      # ADR-84 WD6 (issue #872) — the top-result exemption to the WD3 store gate.
+      #
+      # WD3 refuses a store whenever the bracket saw a below-entry transient event, because such a result
+      # embeds an ancestor's in-flight state and a standalone recompute need not reproduce it. Inside a
+      # strongly connected component of mutually recursive methods that holds for nearly every frame — each
+      # nested compute re-enters a signature already on the guard stack and the guard site logs at the
+      # ancestor's shallower position — so nothing in the component is ever memoised and every call edge
+      # re-walks its whole callee subtree. Issue #870's fixture measured 18,412 of 18,436 memo misses
+      # computing a result and discarding it, and rufo 0.18.2's `formatter.rb` did not finish in 25 minutes.
+      #
+      # The exemption: when the computed result is `Dynamic[top]` the entry carries no context-dependent
+      # information to serve. `untyped` is the lattice top and the ADR-5 degradation floor — the only way a
+      # standalone recompute can differ is by being MORE precise, so serving the stored top can never
+      # surface a type the ancestor context invented, and can never raise a diagnostic that a fresh
+      # evaluation would not (nothing is reported off `untyped`). The cost is a possible missed diagnostic
+      # where the untainted recompute would have been precise; the corpus evidence that this does not
+      # happen in practice is the byte-identical `--format json` runs over `lib`, `plugins/*/lib`,
+      # `examples/*/lib` and the survey projects recorded on issue #872.
+      def top_result?(result)
+        result.equal?(Type::Combinator.untyped)
       end
 
       # ADR-84 WD2 — the memo-miss compute, wrapped in a `DependencyRecorder.capture` window when ADR-46
@@ -2440,14 +3150,36 @@ module Rigor
         evaluate_guarded_user_method_body(def_node, body_scope, stack, signature, context)
       end
 
+      # Issue #1125 — the argument list a `def m(...)` body's `...` re-supplies, or nil for a def without the
+      # forwarding parameter (whose body cannot contain a `...` call at all) and for a call that does not even
+      # satisfy `m`'s own required positionals (that call raises at runtime; the body is not worth re-typing).
+      #
+      # Ruby allows `...` only beside leading positional parameters (`def m(a, ...)`, `def m(a = 1, ...)`) — a
+      # keyword / rest / block parameter next to it is a syntax error — so the tail is the call's own argument
+      # list MINUS the leading positionals those named parameters consume, keeping a trailing keyword shape
+      # (which `takes_keywords?` reads as the keyword tail rather than as a positional). The callee's own
+      # call-site `arg_types` are what remains.
+      def forwarded_frame_types(def_node, arg_types)
+        params = def_node.parameters
+        return nil unless params.is_a?(Prism::ParametersNode)
+        return nil unless params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+
+        positional = arg_types.dup
+        kw_shape = positional.pop if takes_keywords?(params) && positional.last.is_a?(Type::HashShape)
+        return nil if positional.size < params.requireds.size
+
+        tail = positional[(params.requireds.size + params.optionals.size)..] || []
+        kw_shape ? tail + [kw_shape] : tail
+      end
+
       # True when this frame's result is a candidate for the return memo: the one structural precondition,
       # stable across the body walk, that is necessary (but not sufficient) for a FINAL result — this plain
       # signature must not itself be on the recursion guard stack (else we are inside its own cycle,
       # returning a Kleene iterate by construction). Sufficiency is decided post-hoc in
-      # `consult_and_store_return_memo` by the two bracket counters (fixpoint consults + ADR-84 WD3
-      # transient-machinery events) — so unlike the prior form this deliberately does NOT refuse while a
-      # constant-arg unroll is in flight: a nested frame whose compute finishes without a single transient
-      # event ran exactly as it would standalone (fuel consumption without exhaustion is invisible), and
+      # `consult_and_store_return_memo` by the ADR-84 WD3 transient-machinery event bracket — so unlike
+      # the prior form this deliberately does NOT refuse while a constant-arg unroll is in flight: a
+      # nested frame whose compute finishes without a single transient event ran exactly as it would
+      # standalone (fuel consumption without exhaustion is invisible), and
       # the blanket exclusion refused 82% of mail's body evaluations for such final results (ADR-84).
       def memo_candidate?(stack, plain_signature)
         stack.none? { |frame| plain_part(frame) == plain_signature }
@@ -2578,7 +3310,6 @@ module Rigor
         summaries = context.summaries
         depth = seed_fixpoint_summary(summaries, plain_signature)
         consult_depths = (Thread.current[SUMMARY_CONSULT_DEPTHS_KEY] ||= [])
-        computed = nil
 
         RECURSION_FIXPOINT_CAP.times do |iteration|
           summaries[plain_signature][:consulted] = false
@@ -2612,9 +3343,15 @@ module Rigor
             return resolved unless resolved.nil?
           end
 
-          step = fixpoint_step(summaries, plain_signature, computed, iteration)
-          return step unless step == :continue
+          converged = fixpoint_step(summaries, plain_signature, computed, iteration)
+          return converged if converged
         end
+
+        # Out of iterations and still unstable. The collapse is the loop's own tail rather than a branch
+        # inside `fixpoint_step`: `Integer#times` yields its receiver when no iteration returns, so a
+        # tail-less loop reads as a path that returns an Integer summary (the `def.return-type-mismatch`
+        # on `return_type_for` this shape retired), and the loop, not the step, owns its cap.
+        collapse_fixpoint_cap(summaries, plain_signature)
       end
 
       # Seeds the thread-local summary entry for a fixpoint owner: the `bot` Kleene seed plus the
@@ -2650,8 +3387,10 @@ module Rigor
 
       # One Kleene-iteration step of the fixpoint loop. Joins `computed` into the running assumption
       # (widening value-pinned constituents on the final permitted iteration to force convergence) and
-      # either returns a final type — convergence, or the capped `untyped` collapse — or `:continue` to
-      # request another body evaluation, having advanced the stored assumption. ADR-55 WD2.
+      # returns the converged type, or `nil` — no final type yet — having advanced the stored assumption
+      # so the caller's next body evaluation reads the wider iterate. The step never decides that the
+      # loop is over: whether another evaluation follows is the caller's cap, and a `nil` on the final
+      # iteration lands in `collapse_fixpoint_cap`. ADR-55 WD2.
       def fixpoint_step(summaries, plain_signature, computed, iteration)
         assumption = summaries[plain_signature][:assumption]
         last_iteration = iteration == RECURSION_FIXPOINT_CAP - 1
@@ -2662,17 +3401,19 @@ module Rigor
         # (joining it back changes nothing).
         return candidate if joined == assumption
 
-        if last_iteration
-          # Out of iterations and still unstable — collapse to today's widening behaviour. ADR-84 WD3: the
-          # cap is a per-owner constant, so the event references the owner's own frame.
-          note_transient_fallback(BudgetTrace::RECURSION_FIXPOINT_CAP, own_guard_frame_position)
-          scope.record_dynamic_origin(@typing_node, DynamicOrigin::ANALYZER_BUDGET_CUTOFF) if @typing_node
-          summaries[plain_signature][:assumption] = Type::Combinator.untyped
-          return Type::Combinator.untyped
-        end
-
         summaries[plain_signature][:assumption] = joined
-        :continue
+        nil
+      end
+
+      # The capped collapse: `RECURSION_FIXPOINT_CAP` evaluations advanced the assumption without
+      # converging, so the summary degrades to today's widening behaviour, `untyped`, parked in the
+      # assumption for any consumer that still reads it. ADR-84 WD3: the cap is a per-owner constant, so
+      # the event references the owner's own frame.
+      def collapse_fixpoint_cap(summaries, plain_signature)
+        note_transient_fallback(BudgetTrace::RECURSION_FIXPOINT_CAP, own_guard_frame_position)
+        scope.record_dynamic_origin(@typing_node, DynamicOrigin::ANALYZER_BUDGET_CUTOFF) if @typing_node
+        summaries[plain_signature][:assumption] = Type::Combinator.untyped
+        Type::Combinator.untyped
       end
 
       # Rebuilds the user-method body scope with every bound positional parameter widened to its nominal
@@ -2859,7 +3600,8 @@ module Rigor
         locals = bind_params_from_call_types(params, arg_types)
         return nil if locals.nil?
 
-        # Construct the body scope in a SINGLE allocation — the previous `Scope.empty.with_*.with_*…` chain
+        # Construct the body scope in a SINGLE Scope allocation (plus the issue #1358 frame it carries, whose
+        # scans run only on demand) — the previous `Scope.empty.with_*.with_*…` chain
         # allocated a fresh frozen Scope per field, run per user-method-call inference (ADR-44). The
         # discovery index is inherited whole by reference (ADR-53 Track A); the hand-copied per-field list
         # this replaces had silently dropped `data_member_layouts` and `discovered_method_visibilities`.
@@ -2877,7 +3619,9 @@ module Rigor
           lexical_nesting: recorded_def_nesting(def_node),
           discovery: scope.discovery,
           struct_fold_safe_locals: body_fold_safe_locals(def_node, receiver, self_fold_safe),
-          dynamic_origins: scope.dynamic_origins
+          dynamic_origins: scope.dynamic_origins,
+          # Issue #1358 — the callee runs in a frame of its own ({Scope#with_match_frame}).
+          match_frame: MatchRebinding::Frame.new(def_node.body, def_node.parameters)
         )
       end
 
@@ -2957,17 +3701,35 @@ module Rigor
         return nil if locals.nil?
 
         bind_keyword_params(params, kw_shape, locals)
-        locals[params.keyword_rest.name.to_sym] = dynamic_top if params.keyword_rest&.name
+        rest_name = keyword_rest_name(params)
+        locals[rest_name.to_sym] = keyword_rest_type(params, kw_shape) if rest_name
         locals[params.block.name.to_sym] = dynamic_top if params.block&.name
         locals
       end
 
-      # Trailing required positionals after a rest (`def f(a, *m, z)`) shift the correspondence; `...`
-      # arrives as the keyword_rest slot. Both stay declined — correspondence, not width, is the issue.
+      # Trailing required positionals after a rest (`def f(a, *m, z)`) shift the correspondence and stay
+      # declined — correspondence, not width, is the issue. Issue #1125: `def m(...)`'s forwarding slot is no
+      # longer a decline. Its NAMED parameters (a leading `def m(a, ...)` required) bind exactly as before;
+      # the forwarded tail is not a binding, so nothing is bound for it — the body's own `f(...)` reads the
+      # frame's argument list instead ({#forwarded_argument_types}).
       def bindable_param_shape?(params)
-        params.is_a?(Prism::ParametersNode) &&
-          params.posts.empty? &&
-          !params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+        params.is_a?(Prism::ParametersNode) && params.posts.empty?
+      end
+
+      # Whether the def's trailing slot is `...` rather than a named `*rest` / `**rest`. Such a def accepts
+      # an unbounded positional tail it does not name, so it behaves as a rest for the positional
+      # correspondence and binds no local.
+      def forwarding_params?(params)
+        params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+      end
+
+      # A `**rest` parameter's name, or nil when the slot is `def m(...)`'s forwarding parameter —
+      # `Prism::ForwardingParameterNode` carries no name at all.
+      def keyword_rest_name(params)
+        rest = params.keyword_rest
+        return nil unless rest.respond_to?(:name)
+
+        rest.name
       end
 
       def takes_keywords?(params)
@@ -2978,7 +3740,9 @@ module Rigor
         requireds = params.requireds
         optionals = params.optionals
         return nil if positional.size < requireds.size
-        return nil if params.rest.nil? && positional.size > requireds.size + optionals.size
+
+        extra = positional.size - requireds.size - optionals.size
+        return nil if extra.positive? && params.rest.nil? && !forwarding_params?(params)
 
         locals = {}
         requireds.each_with_index { |param, index| bind_positional_param(locals, param, positional[index]) }
@@ -3022,6 +3786,23 @@ module Rigor
         param.respond_to?(:value) && param.value ? literal_default_type(param.value) : dynamic_top
       end
 
+      # Issue #1125 — `**rest` collects the keyword-shape entries no named keyword parameter consumed, as a
+      # closed `HashShape` of their value types. The pre-#1125 `Dynamic[top]` is kept whenever there is
+      # nothing left to collect: no keyword shape at all, an open shape (unknown extras — every remaining-key
+      # answer would be a guess), or a shape whose every pair a named parameter consumed. That last case is
+      # what leaves the literal form's existing binding untouched (`target(a: 1, b: 2)` against
+      # `def target(a:, b:, **rest)` still binds `rest` to `Dynamic[top]`), while a caller that DOES leave
+      # keys over — the only shape where the parameter holds something to report — gets them typed.
+      def keyword_rest_type(params, kw_shape)
+        return dynamic_top if kw_shape.nil? || kw_shape.open?
+
+        consumed = params.keywords.map { |param| param.name.to_s.delete_suffix(":").to_sym }
+        leftovers = kw_shape.pairs.except(*consumed)
+        return dynamic_top if leftovers.empty?
+
+        Type::Combinator.hash_shape_of(leftovers)
+      end
+
       # A default expression contributes its type only when it is lexically scope-free — a scalar literal
       # or an EMPTY collection literal (`options = {}` is the dominant Rails idiom). Anything that could
       # read the def's own lexical scope binds `Dynamic` instead of being mis-typed in the caller's scope.
@@ -3066,11 +3847,60 @@ module Rigor
         scope.environment.nominal_for_name("Object") || dynamic_top
       end
 
+      # Issue #1125 — two call-site argument shapes that used to reach every consumer (the parameter
+      # binder, RBS dispatch, the block-parameter reader) as an opaque `Dynamic[top]` / bare `Nominal[Hash]`
+      # now carry what the callee needs:
+      #
+      # - `f(...)` inside `def m(...)` re-supplies the arguments `m` was called with, read from the frame
+      #   {#infer_user_method_return} installed ({FORWARDED_ARGS_KEY}) — so it expands to a whole LIST, not
+      #   one type, which is why the map became a flat_map.
+      # - a keyword hash built ENTIRELY from a double splat (`f(**h)`) is the shape of `h`, so `f(**h)`
+      #   binds the same parameters the literal form `f(a: 1, b: 2)` does.
+      #
+      # Both are precision-only. A `...` outside a forwarding frame (unreachable in valid Ruby) and a double
+      # splat of anything but a Symbol-keyed closed `HashShape` — a shapeless `Hash[Symbol, V]`, an opaque
+      # value, a mixed hash — fall back to exactly the pre-#1125 answer.
       def call_arg_types(node)
         arguments_node = node.arguments
         return [] if arguments_node.nil?
 
-        arguments_node.arguments.map { |argument| type_of(argument) }
+        arguments_node.arguments.flat_map do |argument|
+          forwarded_argument_types(argument) || [call_arg_type(argument)]
+        end
+      end
+
+      # The frame's argument list when `argument` is `...`, else nil so the caller types it normally.
+      def forwarded_argument_types(argument)
+        return nil unless argument.is_a?(Prism::ForwardingArgumentsNode)
+
+        ExpressionTyper.current_forwarded_arg_types
+      end
+
+      # The type a single call argument contributes; a keyword-hash argument first offers the `HashShape` it
+      # stands for, and otherwise keeps its own type.
+      def call_arg_type(argument)
+        return type_of(argument) unless argument.is_a?(Prism::KeywordHashNode)
+
+        double_splat_hash_shape(argument) || type_of(argument)
+      end
+
+      # The `HashShape` a `f(**h)` keyword-hash argument stands for, or nil to keep the argument's own type.
+      # Declines a MIXED hash (`f(a: 1, **h)` — merging the literal pairs with the splatted shape is a second
+      # shape algebra this slice does not need), an OPEN shape (unknown extras make every missing-keyword
+      # answer a guess rather than a read), a shape with a non-Symbol key (Ruby itself rejects those as
+      # keywords), and a splat of anything that is not a shape at all.
+      def double_splat_hash_shape(node)
+        elements = node.elements
+        return nil unless elements.size == 1
+
+        splat = elements.first
+        return nil unless splat.is_a?(Prism::AssocSplatNode) && splat.value
+
+        type = type_of(splat.value)
+        return nil unless type.is_a?(Type::HashShape)
+        return nil unless type.closed? && type.pairs.each_key.all?(Symbol)
+
+        type
       end
 
       # When the call carries a `Prism::BlockNode`, build the block's entry scope (outer locals plus
@@ -3092,39 +3922,167 @@ module Rigor
         return nil if block_arg.nil?
         return nil if receiver_type.nil?
 
+        rebound = rebound_operand_typer(call_node)
+        return rebound.send(:block_return_type_for, call_node, receiver_type, arg_types) if rebound
+
         expected = MethodDispatcher.expected_block_param_types(
           receiver_type: receiver_type,
           method_name: call_node.name,
           arg_types: arg_types,
-          environment: scope.environment
+          environment: scope.environment,
+          scope: scope
         )
-        # ADR-16 Tier A: when a registered plugin's `block_as_methods` entry matches `(receiver_type,
-        # call_node.name)`, narrow the block body's `self_type` to the receiver class's instance type. The
-        # narrowing is `nil` for unmatched calls, leaving the existing scope contract unchanged.
-        narrowed_self = MacroBlockSelfType.narrow_self_type_for(
-          scope: scope, call_node: call_node, receiver_type: receiver_type
+        block_return_for(
+          block_arg, expected,
+          call_node: call_node,
+          narrowed_self_type: block_body_self_narrowing(call_node, receiver_type),
+          repeats: !BLOCK_VALUE_DISCARDING.include?(call_node.name) && block_may_repeat?(call_node, receiver_type)
         )
-        block_return_for(block_arg, expected, narrowed_self_type: narrowed_self)
       rescue StandardError
         nil
       end
 
-      def block_return_for(block_arg, expected, narrowed_self_type: nil)
+      # The catalogued iterators that discard their block's value — it selects the block-bearing overload and
+      # nothing more — so the value pass lays no captured binding under their block: the fixpoint would buy a
+      # type nothing reads, and `sum = 0; xs.each { |x| sum += x }` would pay it on top of the ADR-56
+      # write-back's own. The #853 break-arm scan still lays it, since a `break` value is the call's.
+      BLOCK_VALUE_DISCARDING = Set[
+        :each, :each_with_index, :each_with_object, :each_pair, :each_key, :each_value, :each_index,
+        :reverse_each, :each_entry, :each_slice, :each_cons, :each_char, :each_byte, :each_line,
+        :each_codepoint, :times, :upto, :downto, :step
+      ].freeze
+      private_constant :BLOCK_VALUE_DISCARDING
+
+      # Whether the call may run its block more than once, so a later run reads a captured binding an earlier
+      # run rebound — the premise of laying the #587 (b) binding ({#captured_block_bindings}) under the block.
+      # {BlockRepetition.may_repeat?} holds the rule, which the statement pass shares (issue #1412).
+      def block_may_repeat?(call_node, receiver_type)
+        BlockRepetition.may_repeat?(method_name: call_node.name, receiver_type: receiver_type, scope: scope)
+      end
+
+      EMPTY_BREAK_ARMS = [].freeze
+      private_constant :EMPTY_BREAK_ARMS
+
+      # The types the `break`s that terminate THIS call carry out of it, for {#call_dispatch_type_for} to union
+      # with the result the dispatch tiers computed (issue #853).
+      #
+      # The syntactic scan runs first and answers "none" for every call whose block cannot reach a block-level
+      # `break` — nearly all of them — so only that small minority pays the body evaluation. A `break` under a
+      # nested block, lambda, `def`, or loop targets THAT construct instead; {JUMP_BOUNDARY_NODES} stops the
+      # scan there, and the identity filter drops the ones the sink still collects because the nested
+      # construct is walked under the same installation. `break` with no argument carries nil, so the call
+      # becomes optional — which is what Ruby does. A call that only stores its block ({StoredBlockCall}: `lambda`,
+      # `define_method`, `Thread.new`, …) never runs it, so no arm of that block is the call's value.
+      #
+      # A failure yields no arms rather than propagating, matching {#block_return_type_for}: a call typed
+      # without its break arms is the pre-#853 answer, while a raise here would take out the whole call.
+      def call_break_arm_types(node, receiver_override: nil)
+        block_node = node.block
+        return EMPTY_BREAK_ARMS unless block_node.is_a?(Prism::BlockNode)
+        return EMPTY_BREAK_ARMS if StoredBlockCall.stores_block?(node)
+
+        body = block_node.body
+        return EMPTY_BREAK_ARMS if body.nil? || !block_level_jump?(body, Prism::BreakNode)
+
+        collect_break_arm_types(node, block_node, body, receiver_override)
+      rescue StandardError
+        EMPTY_BREAK_ARMS
+      end
+
+      # Evaluates the block body once under a `break`-value sink, in the same entry scope the block-return pass
+      # uses, so each arm is typed in the scope that actually reaches it — a `break v` after `v = "s"`
+      # contributes `"s"`, not the entry binding — and an arm on a branch the analysis proved dead is never
+      # reached at all.
+      def collect_break_arm_types(call_node, block_node, body, receiver_override)
+        targets = block_level_jump_nodes(body, Prism::BreakNode)
+        receiver = receiver_override || call_receiver_type_for(call_node)
+        return EMPTY_BREAK_ARMS if receiver.nil?
+
+        param_types = break_arm_param_types(call_node, receiver)
+        block_scope = block_entry_scope(
+          block_node, param_types,
+          call_node: call_node,
+          narrowed_self_type: block_body_self_narrowing(call_node, receiver),
+          captured: repeating_captured_bindings(block_node, param_types, block_may_repeat?(call_node, receiver))
+        )
+        _result, collected = StatementEvaluator.with_break_value_sink do
+          without_block_body_threading { block_scope.evaluate(body) }
+        end
+        collected.filter_map { |jump, type| type if targets.key?(jump) }
+      end
+
+      # The block body's narrowed `self_type`, or `nil` to leave the scope contract unchanged.
+      #
+      # ADR-16 Tier A: a registered plugin's `block_as_methods` entry matching `(receiver_type,
+      # call_node.name)` narrows to the receiver class's instance type.
+      #
+      # Issue #963: `define_method(:name) { ... }` installs its block as an instance method and runs it with
+      # `self` bound to the receiving instance, so the block body's `self` is the INSTANCE side of a class body's
+      # `Singleton[X]`. Both block-entry paths narrow it, and both decline on the same `class << ...` bodies,
+      # because the whole distinction rides on `Scope#singleton_class_body?` rather than on the statement
+      # evaluator's frame stack. This pass therefore cannot compute a carrier the evaluator disagrees with — it
+      # matters wherever the block's value is observable, e.g. a project-declared generic `define_method`
+      # signature that returns the block's own type.
+      def block_body_self_narrowing(call_node, receiver_type)
+        MacroBlockSelfType.narrow_self_type_for(
+          scope: scope, call_node: call_node, receiver_type: receiver_type
+        ) || DefineMethodBlockSelf.narrow_self_type_for(scope: scope, call_node: call_node)
+      end
+
+      def break_arm_param_types(call_node, receiver)
+        MethodDispatcher.expected_block_param_types(
+          receiver_type: receiver,
+          method_name: call_node.name,
+          arg_types: call_arg_types(call_node),
+          environment: scope.environment,
+          scope: scope
+        )
+      end
+
+      def block_return_for(block_arg, expected, call_node: nil, narrowed_self_type: nil, repeats: false)
         case block_arg
         when Prism::BlockNode
-          bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_arg)
-          # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
-          # yielding method's business, so the return-typing pass must see the same unmodelled-self mark.
-          block_scope = bindings.reduce(scope.entering_opaque_block) do |acc, (name, type)|
-            acc.with_local(name, type)
-          end
-          block_scope = block_scope.with_self_type(narrowed_self_type) if narrowed_self_type
-          type_block_body(block_arg, block_scope)
+          captured = repeating_captured_bindings(block_arg, expected, repeats)
+          entry = block_entry_scope(
+            block_arg, expected, call_node: call_node, narrowed_self_type: narrowed_self_type, captured: captured
+          )
+          type_block_body(block_arg, entry, captured: captured)
         when Prism::BlockArgumentNode
           symbol_block_return_type(block_arg, expected)
         end
       end
 
+      # The scope a block body is typed under: the surrounding scope plus the parameter bindings the receiving
+      # method's signature implies, with the #587 (b) `captured` binding ({#repeating_captured_bindings}) laid
+      # between the two, so the body reads what a captured local, instance variable, class variable or global
+      # holds on ANY run rather than the first.
+      #
+      # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
+      # yielding method's business, so the return-typing pass must see the same unmodelled-self mark. Issue #1358
+      # — and the same match-global view ({MatchRebinding.block_entry}), which reads the owning `call_node`.
+      def block_entry_scope(block_node, expected, call_node: nil, narrowed_self_type: nil, captured: nil)
+        entry = MatchRebinding.block_entry(scope.entering_opaque_block, block_node, call_node)
+        entry = captured.lay(entry) if captured
+        block_scope = BlockParameterBinder.new(expected_param_types: expected).bind_onto(block_node, entry)
+        return block_scope unless narrowed_self_type
+
+        block_scope.with_self_type(narrowed_self_type)
+      end
+
+      # The #587 (b) captured binding when the call may run the block more than once ({#block_may_repeat?}), and
+      # nil — no binding — for a block it runs at most once, whose captures no earlier run can have moved.
+      def repeating_captured_bindings(block_node, expected, repeats)
+        repeats ? generic_captured_bindings(block_node, expected) : nil
+      end
+
+      # The #587 (b) captured binding for the generic pass — or nil, which keeps the entry scope, when computing
+      # it fails: a raise here would otherwise take out the whole block-return pass.
+      def generic_captured_bindings(block_node, expected)
+        captured_block_bindings(block_node, expected)
+      rescue StandardError
+        nil
+      end
+
       # `&:symbol` desugars to a one-arg Proc that dispatches `symbol` against its argument. When the param
       # type is known and the resulting inner dispatch is precise, this returns the precise carrier;
       # otherwise it returns `Dynamic[Top]` (still non-nil) so the outer dispatcher selects the
@@ -3157,13 +4115,170 @@ module Rigor
       # — which threads scope statement by statement through `StatementEvaluator` — held `42` for the very
       # same node. {#threaded_block_body_type} closes that gap by reusing the main pass's evaluator; a decline
       # keeps the tail-only answer verbatim.
-      def type_block_body(block_node, block_scope)
+      #
+      # Issue #841: the fall-through tail is only ONE of the block's exits. Every `next value` that leaves this
+      # block makes `value` the block's result for that invocation, so the arms join into the value type the
+      # same way {#evaluate_body_with_returns} joins a method's early `return`s with its tail. Without the
+      # join, `ops.all? { |o| next false unless o; true }` read as `Constant[true]` and
+      # {MethodDispatcher::BlockFolding} folded the call to always-truthy on a program that really can answer
+      # false — a warning on correct code.
+      #
+      # `captured` is the #587 (b) binding `block_scope` was laid over, if any; the names it answers are left to it
+      # ({#tail_only_block_body_type}).
+      def type_block_body(block_node, block_scope, captured: nil)
         body = block_node.body
         return Type::Combinator.constant_of(nil) if body.nil?
 
-        threaded_block_body_type(body, block_scope) || block_scope.type_of(body)
+        arms = block_level_next_arms(body)
+        return block_body_type_joining_nexts(body, block_scope, arms) if arms
+
+        threaded_block_body_type(body, block_scope) || tail_only_block_body_type(body, block_scope, captured)
+      end
+
+      # The tail typed in the entry scope — except under {#block_body_threading_suppressed?}, where a tail that
+      # reads what its own prefix changed would get the ENTRY binding back, a stale answer rather than a wider
+      # one. There the tail is typed over {#prefix_answered_scope}, which re-answers exactly those names without
+      # evaluating the prefix. The threading's other declines keep the plain tail-only answer: a body with no
+      # prefix, or whose tail ignores it, is not stale, while a `rescue` body and a prefix that can `break`
+      # ({JUMP_NODES}) are typed tail-only with or without the suppression, and neither path re-answers them.
+      #
+      # A failure in the re-answer falls back to the plain tail-only answer, for the reason
+      # {#threaded_block_body_type} gives: a raise reaching `block_return_type_for` would report "no block".
+      def tail_only_block_body_type(body, block_scope, captured)
+        return block_scope.type_of(body) unless block_body_threading_suppressed? && body.is_a?(Prism::StatementsNode)
+
+        answered =
+          begin
+            prefix_answered_scope(body.body, block_scope, captured)
+          rescue StandardError
+            block_scope
+          end
+        answered.type_of(body)
+      end
+
+      # `block_scope` with every name the tail reads and the prefix changed ({#tail_dependent_body_names}) bound to
+      # what the prefix can have left in it, answered without evaluating the prefix — which is the cost the
+      # suppression refuses — on the terms the per-element fold's captured binding answers a capture under the same
+      # suppression:
+      #
+      # - a name the prefix REBINDS reads `Dynamic[top]` ({#captured_floor}'s answer). `i += w; i` inside a block
+      #   the call runs once read `i` at its entry `0`, and `k == 0` then fired always-truthy on a `k` Ruby holds
+      #   as `1`.
+      # - a name the prefix only MUTATES IN PLACE reads its unknown-store widening ({UnknownStoreWidening.widen}),
+      #   the binding {#stored_capture_bindings} lays: `|_k, a| a << w; a` over `{ x: [], y: [] }` read `a` as its
+      #   entry `[]` and the call as `Array[[]]`; it now reads `Array[Array[Dynamic[top]]]`.
+      #
+      # That is a floor per NAME, not per block, so the structure around a floored name survives (`e = e.to_s; [e, w]`
+      # keeps its Tuple), and it is limited to the names tail-only answers stale. A name the entry scope does not bind —
+      # a body-local, or an instance variable, class variable or global nothing bound yet — already reads
+      # `Dynamic[top]`. An instance variable on its ADR-58 class-wide seed takes no floor for a rebind, since the seed
+      # is the union of every write in the class, this prefix's included, though its mutation sites still widen it
+      # ({#class_seeded_ivar?}). A name whose widening declines keeps its entry binding, because the threaded body
+      # would have kept it as well: `s = String.new; … { s << "x"; s }` is `String` either way, and a precise nominal
+      # `Array[String]` is a claim the widening may not grow on either path. And a name the #587 (b) `captured` binding
+      # answers is left to it, as {#unanswered_tail_dependency?} leaves it: the per-element fold computes that binding
+      # before it suppresses the threading above its cap, so it can hold the fixpoint's converged `Integer` for
+      # `total += e; total`, which a floor here would throw away.
+      def prefix_answered_scope(statements, block_scope, captured)
+        return block_scope if statements.size < 2
+
+        names = tail_dependent_body_names(statements) - (captured&.names || EMPTY_NAME_SET)
+        return block_scope if names.empty?
+
+        rebound, sites = prefix_changes(statements)
+        names.reduce(block_scope) do |acc, name|
+          answer = prefix_left_binding(block_scope, name, rebound, sites)
+          answer ? CapturedLocals.bind(acc, name, answer) : acc
+        end
+      end
+
+      def prefix_left_binding(block_scope, name, rebound, sites)
+        entry = CapturedLocals.bound_type(block_scope, name)
+        return nil if entry.nil?
+
+        return Type::Combinator.untyped if rebound.include?(name) && !class_seeded_ivar?(block_scope, name)
+
+        widened = UnknownStoreWidening.widen(entry, sites.fetch(name, NO_MUTATION_SITES))
+        widened == entry ? nil : widened
+      end
+
+      # An instance variable still on its ADR-58 class-wide seed: the union of every WRITE in the class, so a rebind
+      # in the prefix is already in it and needs no floor. An in-place mutation is no write — `@out << w.to_s` leaves
+      # the seed `"k"` while the object holds `"k1"` — so the mutation sites still widen the seed, as they widen any
+      # other entry binding.
+      def class_seeded_ivar?(block_scope, name)
+        CapturedLocals.ivar_name?(name) && block_scope.declaration_sourced?(:ivar, name)
+      end
+
+      NO_MUTATION_SITES = [].freeze
+      private_constant :NO_MUTATION_SITES
+
+      # The prefix's changes split the way {#prefix_left_binding} answers them: the names a write node rebinds,
+      # and each in-place mutation site filed under every variable its receiver can evaluate to. The walk and both
+      # predicates are {#prefix_statement_jump_free?}'s, so a name {#tail_dependent_body_names} reports is always
+      # filed here under one of the two. Only a suppressed tail-only body with a dependent tail pays it.
+      def prefix_changes(statements)
+        rebound = Set.new
+        sites = {}
+        statements[0...-1].each do |statement|
+          Source::NodeWalker.each_with_ancestors(statement) do |node, ancestors|
+            rebound << node.name if VARIABLE_WRITE_NODES.include?(node.class)
+            next unless in_place_mutation?(node)
+
+            nested = ancestors.any? { |ancestor| CLOSURE_NODES.include?(ancestor.class) }
+            each_mutated_name(node, nested) { |name| (sites[name] ||= []) << node }
+          end
+        end
+        [rebound, sites]
+      end
+
+      # Evaluates the body once under a `next` sink and joins the arms that leave THIS block with the
+      # fall-through tail the same evaluation produced. Both halves come from one `StatementEvaluator` run, so
+      # each arm is typed in the scope that actually reaches it — a `next y` after `y = "s"` contributes
+      # `"s"`, not the entry scope's stale binding.
+      #
+      # This run ignores the {#block_body_threading_suppressed?} flag that gates the precision fold: that flag
+      # bounds the cost of an OPTIONAL widening, while skipping the join re-opens a false-positive class. It
+      # still SETS the flag for the duration, so nothing folds below it and the cost stays one evaluation per
+      # block-level `next` — a shape that is a small minority of blocks.
+      #
+      # A failure falls back to the tail-only answer rather than propagating, for the same reason
+      # {#threaded_block_body_type} does: the enclosing `block_return_type_for` rescue would otherwise report
+      # "no block" to the dispatcher, a far larger regression than a wide block return.
+      def block_body_type_joining_nexts(body, block_scope, arms)
+        (fall_through, _exit_scope), collected = StatementEvaluator.with_next_sink do
+          without_block_body_threading { block_scope.evaluate(body) }
+        end
+        joined = collected.filter_map { |node, type| type if arms.key?(node) }
+        joined.empty? ? fall_through : Type::Combinator.union(fall_through, *joined)
+      rescue StandardError
+        block_scope.type_of(body)
+      end
+
+      # The identity-keyed set of `next` nodes whose value is THIS block's value — reachable from the body
+      # without crossing a {JUMP_BOUNDARY_NODES} construct that retargets them — or nil for "do not join".
+      #
+      # nil means "do not join": a body with no block-level `next` keeps today's path exactly, and pays only
+      # the allocation-free scan that answers so. A co-resident block-level `break` used to decline here as
+      # well, because its value was dropped and joining the `next` arms would have dressed a still-incomplete
+      # answer as a complete one; since issue #853 the `break` arms are unioned into the yielding call
+      # ({#call_break_arm_types}), so the two exits are modelled at their own levels and neither blocks the
+      # other.
+      def block_level_next_arms(body)
+        return nil unless block_level_jump?(body, Prism::NextNode)
+
+        block_level_jump_nodes(body, Prism::NextNode)
       end
 
+      # True when a `klass` jump is reachable from `node` without crossing a construct that retargets it
+      # ({JumpTargets.any?}, allocation-free and early-exiting: this is the scan every block body pays).
+      def block_level_jump?(node, klass) = JumpTargets.any?(node, klass)
+
+      # The identity-keyed set of `klass` jumps that target THIS block ({JumpTargets.of}). The sinks in
+      # `StatementEvaluator` also collect jumps from nested blocks / loops / defs evaluated under the same
+      # installation, so the consumer filters against this set by node identity.
+      def block_level_jump_nodes(body, klass) = JumpTargets.of(body, klass)
+
       # Re-typing the whole body would be wrong to do unconditionally: this path runs for EVERY block-bearing
       # call, and the statements ahead of the tail are pure cost whenever the tail does not depend on them.
       # Three declines keep that cost where the defect actually is, each falling back to the tail-only path:
@@ -3177,8 +4292,11 @@ module Rigor
       # - the fold is not re-entrant. `StatementEvaluator#eval_call` already evaluates each nested block body
       #   once, plus up to three more times under the ADR-56 `BodyFixpoint` when the block rebinds a captured
       #   local, so a fold nested inside a fold would multiply that work per block-nesting level. Inside a
-      #   threaded body a nested block-bearing call reverts to the tail-only path — a wider answer in a rare
-      #   shape, never a new false positive.
+      #   threaded body a nested block-bearing call reverts to the tail-only path. That is a wider answer only
+      #   while the nested tail ignores its own prefix: a tail reading a parameter or captured local the prefix
+      #   mutated gets the ENTRY binding back, so the per-element and per-pair folds floor that shape
+      #   ({#tail_only_body_floor}), and the generic block-return pass re-answers each stale name on its own
+      #   ({#prefix_answered_scope}).
       #
       # ADR-56 interaction: the fold cannot double-apply or fight the captured-local write-back. That
       # write-back is `StatementEvaluator#write_back_block_captures`, computed from the CALLER's scope into
@@ -3242,32 +4360,40 @@ module Rigor
       private_constant :VARIABLE_WRITE_NODES
 
       # Every node that OBSERVES a variable binding: the plain reads plus the compound writes, which read
-      # their target before rebinding it (`v += 1` in the tail depends on an earlier `v = 0`).
+      # their target before rebinding it (`v += 1` in the tail depends on an earlier `v = 0`). An `it` read
+      # observes the local `:it` ({ReceiverAlias.read_name}); it has no `name` of its own.
       VARIABLE_READ_NODES = (
         VARIABLE_WRITE_NODES | [
-          Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode,
+          Prism::LocalVariableReadNode, Prism::ItLocalVariableReadNode, Prism::InstanceVariableReadNode,
           Prism::ClassVariableReadNode, Prism::GlobalVariableReadNode
         ]
       ).freeze
       private_constant :VARIABLE_READ_NODES
 
       # A `next` / `break` that leaves THIS block carries a value the fold cannot see: `evaluate(body).first`
-      # is the fall-through value only, and no next-value join into the block return exists (`type_of_jump`
-      # types both as `Bot`). So `m.synchronize do next 5 if flag; v = 42; v end` really can answer 5 at
-      # runtime, and threading would type it `42`. Both forms escape with a value — `next v` is the block's
-      # value for that yield, `break v` is the yielding CALL's value — so both must decline.
+      # is the fall-through value only.
+      #
+      # The `next` entry no longer fires: {#type_block_body} routes such a body past this scan entirely, since
+      # issue #841 joins those arms into the block's value. It is kept because the question this predicate
+      # answers ("can this prefix escape with a value the fall-through misses?") is the caller's premise
+      # rather than the caller's filter restated.
+      #
+      # The `break` entry still fires, and since issue #853 it is conservative rather than load-bearing: the
+      # arms are unioned into the CALL ({#call_break_arm_types}), so the missing value is no longer missing.
+      # What the decline still costs is the threaded tail — `m.synchronize do break 5 if flag; v = 42; v end`
+      # answers `5 | Dynamic[top]` where threading would reach `5 | 42`. Lifting it widens no answer and
+      # invents no fact, but it moves the type of every block that carries a `break`, so it is left to a
+      # change that can measure that.
       JUMP_NODES = Set[Prism::NextNode, Prism::BreakNode].freeze
       private_constant :JUMP_NODES
 
       # Constructs that RETARGET a `next` / `break` nested inside them, so a jump below one of these says
-      # nothing about our block's value and must not trigger the decline. A nested `BlockNode` / `LambdaNode`
-      # is the jump's own block (`do xs.each { next 1 }; v = 42; v end` threads soundly — the inner `next`
-      # ends the inner iteration); a loop consumes both forms (`while … next 5 … end` continues the loop);
-      # a `DefNode` body is a different method entirely.
-      JUMP_BOUNDARY_NODES = Set[
-        Prism::BlockNode, Prism::LambdaNode, Prism::DefNode,
-        Prism::WhileNode, Prism::UntilNode, Prism::ForNode
-      ].freeze
+      # nothing about our block's value — it neither triggers the decline nor joins as an arm. A nested
+      # `BlockNode` / `LambdaNode` is the jump's own block (`do xs.each { next 1 }; v = 42; v end` threads
+      # soundly — the inner `next` ends the inner iteration); a loop consumes both forms (`while … next 5 …
+      # end` continues the loop); a `DefNode` body is a different method entirely. The set is
+      # {JumpTargets::BOUNDARY_NODES}, shared with `StatementEvaluator`'s loop and block joins.
+      JUMP_BOUNDARY_NODES = JumpTargets::BOUNDARY_NODES
       private_constant :JUMP_BOUNDARY_NODES
 
       # True when the tail statement observes a variable name one of the earlier statements binds OR mutates
@@ -3282,9 +4408,13 @@ module Rigor
       # hands downstream rules a provably-empty array. Threading is the fix, not a cost: `StatementEvaluator`
       # runs `MutationWidening.widen_after_call` on the `push`, so the threaded tail reads the widened
       # `Array[…]`. A call therefore contributes every variable its receiver can evaluate to
-      # ({ReceiverAlias.candidates} — the ternary-selected receiver of issue #277 included) whenever its name
-      # is one the widening responds to ({MutationWidening::SHAPE_MUTATORS}); keying on the widening's own
-      # tables is what keeps "the scan says thread" and "threading changes something" the same predicate.
+      # ({ReceiverAlias.mutated_reads} — the ternary-selected receiver of issue #277 included) whenever its
+      # name is one the widening responds to ({MutationWidening::SHAPE_MUTATORS}); keying on the widening's own
+      # tables and receiver answer is what keeps "the scan says thread" and "threading changes something" the
+      # same predicate. The index-write nodes ({INDEX_WRITE_NODES}) store through `[]=` without being a call,
+      # so a name-keyed scan missed them and `h[:a] += 1; h[:a]` kept the literal's `0`; they contribute their
+      # receiver the same way. A scan that read only local and instance-variable receivers missed `$g << w; $g`
+      # and `it << w; it` the same way, while the tail kept the entry `"k"` / `[]`.
       #
       # Cost is two walks of the body, the second only when the first found a write and no jump — the same
       # order of cost `StatementEvaluator`'s own per-call captured-write scan already pays, and far below
@@ -3293,53 +4423,115 @@ module Rigor
       # so `[1].each { v = 5 }` really does bind the outer `v`, and `[1].each { outer << 1 }` really does
       # mutate the outer `outer`), while a jump counts only above the nearest {JUMP_BOUNDARY_NODES} boundary.
       def tail_depends_on_body_binding?(statements)
-        written = Set.new
-        statements[0...-1].each do |statement|
-          return false unless prefix_statement_jump_free?(statement, written, false)
-        end
-        return false if written.empty?
+        written = prefix_written_names(statements)
+        return false if written.nil?
 
         Source::NodeWalker.each(statements.last) do |node|
-          return true if VARIABLE_READ_NODES.include?(node.class) && written.include?(node.name)
+          return true if VARIABLE_READ_NODES.include?(node.class) && written.include?(ReceiverAlias.read_name(node))
         end
         false
       end
 
+      # WHICH names the predicate above answers YES on — every name the tail observes that the prefix binds
+      # or mutates in place. Only the tail-only floor ({#unanswered_tail_dependency?}) needs them, which is
+      # why the predicate is not written over this method: the predicate runs for every multi-statement block
+      # body and short-circuits on the first hit, the floor runs only for a walk typed tail-only. Sharing
+      # {#prefix_written_names} is what keeps the two from drifting about what the prefix binds.
+      def tail_dependent_body_names(statements)
+        written = prefix_written_names(statements)
+        return EMPTY_NAME_SET if written.nil?
+
+        Source::NodeWalker.each(statements.last).filter_map do |node|
+          next unless VARIABLE_READ_NODES.include?(node.class)
+
+          name = ReceiverAlias.read_name(node)
+          name if written.include?(name)
+        end.to_set
+      end
+
+      # The names the prefix binds or mutates in place, or `nil` when the scan declines — a prefix that can
+      # jump out of the block with a value the fall-through misses, or one that binds nothing at all.
+      def prefix_written_names(statements)
+        written = Set.new
+        statements[0...-1].each do |statement|
+          return nil unless prefix_statement_jump_free?(statement, written, false, false)
+        end
+        return nil if written.empty?
+
+        written
+      end
+
+      EMPTY_NAME_SET = Set.new.freeze
+      private_constant :EMPTY_NAME_SET
+
       # True when `node` cannot jump out of the block with a value, collecting into `written` the names it
-      # binds (a variable-write node) or mutates in place (a {MutationWidening::SHAPE_MUTATORS} call, through
-      # every variable its receiver can evaluate to) on the way down. `retargeted` is true once the descent
-      # has passed a boundary.
+      # binds (a variable-write node) or mutates in place (a {MutationWidening::SHAPE_MUTATORS} call or an
+      # {INDEX_WRITE_NODES} store, through every variable its receiver can evaluate to) on the way down.
+      # `retargeted` is true once the descent has passed a boundary, and `nested` once it has passed a block or
+      # lambda ({CLOSURE_NODES}), whose `it` is not the body's.
       #
       # A `Prism::DefinedNode`'s operand is never evaluated, so it is not descended into — the same rule
       # {Source::NodeWalker} applies, for the same reason: neither a write nor a jump under `defined?` runs.
-      def prefix_statement_jump_free?(node, written, retargeted)
+      def prefix_statement_jump_free?(node, written, retargeted, nested)
         return false if !retargeted && JUMP_NODES.include?(node.class)
 
         written << node.name if VARIABLE_WRITE_NODES.include?(node.class)
-        collect_mutated_receivers(node, written) if node.is_a?(Prism::CallNode)
+        each_mutated_name(node, nested) { |name| written << name } if in_place_mutation?(node)
         return true if node.is_a?(Prism::DefinedNode)
 
         child_retargeted = retargeted || JUMP_BOUNDARY_NODES.include?(node.class)
+        child_nested = nested || CLOSURE_NODES.include?(node.class)
         node.rigor_each_child do |child|
-          return false unless prefix_statement_jump_free?(child, written, child_retargeted)
+          return false unless prefix_statement_jump_free?(child, written, child_retargeted, child_nested)
         end
         true
       end
 
-      def collect_mutated_receivers(call_node, written)
-        return unless MutationWidening::SHAPE_MUTATORS.include?(call_node.name)
+      # The forms that store through `[]=` without being a `[]=` call ({IndexWriteWidening::CONTENT_WRITE_NODE_CLASSES}).
+      # `StatementEvaluator` widens the three compound writes in straight-line code, and its captured-local
+      # write-back widens all four when a nested block stores through one. A straight-line index TARGET widens
+      # too, at the multi-assign, `for` index or `rescue =>` reference that owns it (`eval_multi_write`,
+      # `bind_for_index`, `bind_rescue_reference`).
+      INDEX_WRITE_NODES = Set.new(IndexWriteWidening::CONTENT_WRITE_NODE_CLASSES).freeze
+      private_constant :INDEX_WRITE_NODES
+
+      def in_place_mutation?(node)
+        return MutationWidening::SHAPE_MUTATORS.include?(node.name) if node.is_a?(Prism::CallNode)
+
+        INDEX_WRITE_NODES.include?(node.class)
+      end
+
+      # Yields the name of every variable the in-place mutation `node` changes: its receiver's
+      # {ReceiverAlias.mutated_reads}, the answer the straight-line widening the threaded body runs reads too, so a
+      # global or class variable counts (`$g << w; $g`) as well as a local, an instance variable and the `it`
+      # parameter. An `it` read `nested` under a block or lambda inside the prefix is that closure's own parameter,
+      # never the body's `it`, so it names nothing here: `[[]].each { it << w }; it` leaves the body's `it` as it was.
+      def each_mutated_name(node, nested)
+        ReceiverAlias.mutated_reads(node.receiver).each do |read|
+          next if nested && read.is_a?(Prism::ItLocalVariableReadNode)
 
-        ReceiverAlias.candidates(call_node.receiver).each { |read| written << read.name }
+          yield ReceiverAlias.read_name(read)
+        end
       end
 
+      # The closures whose `it` is their own: a nested block or lambda always binds `it` to its own parameter.
+      CLOSURE_NODES = Set[Prism::BlockNode, Prism::LambdaNode].freeze
+      private_constant :CLOSURE_NODES
+
       # v0.0.6 phase 2 — per-element block fold for Tuple receivers under `:map` / `:collect`. Walks every
       # Tuple position, binds the block parameter to that element's type, and re-types the block body. The
       # per-position results are assembled into `Tuple[U_1..U_n]`, strictly tighter than the RBS-projected
       # `Array[union]`.
       #
       # Declines (returns nil) when the receiver is not a `Tuple` with at least one element, when the call
-      # has no `Prism::BlockNode`, when the method is outside the supported set, when block typing raises
-      # mid-loop, or when the block has no body. The decline path leaves the dispatch chain untouched.
+      # has no `Prism::BlockNode`, when the method is outside the supported set, when the call carries an
+      # argument, when block typing raises mid-loop, or when the block has no body. The decline path leaves the
+      # dispatch chain untouched.
+      #
+      # The walk reads only the block, so an argument declines: `index(value)` / `find_index(value)` search by
+      # `==` without running the block, and `find(ifnone)` / `detect(ifnone)` answer `ifnone.call` when no
+      # position matches. `r = [1, 2].find(-> { 0 }) { |e| e > 5 }` is `0` at runtime; the walk answered `nil`,
+      # and `r + 1` then reported a nil receiver on correct code. The other supported methods take no argument.
       PER_ELEMENT_TUPLE_METHODS = Set[
         :map, :collect, :filter_map, :flat_map,
         :select, :filter, :reject,
@@ -3353,6 +4545,9 @@ module Rigor
       ].freeze
       private_constant :HASH_SHAPE_TRANSFORM_METHODS
 
+      IN_PLACE_HASH_SHAPE_TRANSFORMS = Set[:transform_keys!, :transform_values!].freeze
+      private_constant :IN_PLACE_HASH_SHAPE_TRANSFORMS
+
       # Cardinality cap for per-element block fold over finite-bound `Constant<Range>` receivers. Walking
       # `(1..1_000_000).map { … }` element-wise would balloon block-typing cost and explode the resulting
       # Tuple, so only short ranges expand into per-position folds. Larger ranges decline so the RBS tier
@@ -3362,7 +4557,7 @@ module Rigor
 
       def try_per_element_block_fold(call_node, receiver_type)
         return nil unless PER_ELEMENT_TUPLE_METHODS.include?(call_node.name)
-        return nil if find_family_with_args?(call_node)
+        return nil unless call_node.arguments.nil?
 
         element_types = per_element_elements_of(receiver_type)
         return nil if element_types.nil? || element_types.empty?
@@ -3370,7 +4565,59 @@ module Rigor
         per_position = per_element_block_results(call_node.block, element_types)
         return nil if per_position.nil? || per_position.any?(&:nil?)
 
-        assemble_per_element_result(call_node.name, per_position, element_types)
+        assemble_per_element_result(call_node.name, per_position, element_types) ||
+          undecided_fold_floor(call_node.name, element_types, receiver_type)
+      end
+
+      # The honest answer for the find family (`find` / `detect` / `find_index` / `index`) and the filter family
+      # (`select` / `filter` / `reject`) when this fold walked every position and the assembler still could not
+      # decide — which happens for exactly one reason: some position's predicate is not a `Constant`, so "the
+      # first matching one" or "the ones kept" is not a static fact.
+      #
+      # Falling through to the dispatcher was WRONG for this family, and issue #617 residue (1) is the bill:
+      # `seen = 0; [1, 2].find do |e| seen += 1; seen == 2 end` answered `nil` where the runtime answers `2`.
+      # The dispatcher's `BlockFolding` reads ONE block-return type, typed from the call's ENTRY scope, so a
+      # predicate over a rebound capture pins the first iteration (`Constant[false]`) and
+      # `FALSEY_BLOCK_NIL_METHODS` short-circuits the whole call to `nil`. This walk already knows better: it
+      # typed the predicate per position and saw that it does not fold. Answering here is what keeps that
+      # knowledge from being thrown away in favour of a worse-informed tier.
+      #
+      # The floor is what `find` can return and no tighter: one of the receiver's own elements, or `nil` when
+      # no element matches. Value pinning survives because it is still true of every candidate — `find` hands
+      # back an element, it does not compute one. `find_index` / `index` answer a position in the receiver, so
+      # `Integer?` is their floor.
+      #
+      # `select` / `filter` / `reject` take a floor for the same reason. Their fall-through is not merely
+      # wider: `BlockFolding`'s filter folds DO answer on a `Constant` block, and the entry-scope pin hands
+      # them one, so `seen = 0; [1, 2].select do |e| seen += 1; seen == 2 end` answered a provably-empty `[]`
+      # where Ruby answers `[2]`. Nested inside a threaded body, where a position can be typed tail-only
+      # ({#tail_only_body_floor}), `[[], []].select do |a| a << w; a.any? end` did the same. Their floor is an
+      # Array of the receiver's own elements: which of them survive is undecided, and what they are is not.
+      # A range receiver's elements are widened first ({#filter_family_floor}).
+      #
+      # Nothing else in {PER_ELEMENT_TUPLE_METHODS} takes a floor. `map`'s assembler cannot decline, and
+      # `BlockFolding` never folds `filter_map` / `flat_map`, so their fall-through is the RBS `Array[U]`
+      # projection.
+      def undecided_fold_floor(method_name, element_types, receiver_type)
+        case method_name
+        when :find, :detect
+          Type::Combinator.union(*element_types, Type::Combinator.constant_of(nil))
+        when :select, :filter, :reject
+          filter_family_floor(element_types, receiver_type)
+        when :find_index, :index
+          Type::Combinator.union(Type::Combinator.nominal_of("Integer"), Type::Combinator.constant_of(nil))
+        end
+      end
+
+      # A `Constant<Range>` receiver's elements are values this walk enumerated, not ones the program wrote, and
+      # the RBS answer the floor replaces carried no pin. Kept, the pins would make `(1..4).filter { … }` an
+      # `Array[1 | 2 | 3 | 4]` that a later `q << 9` cannot widen (#580 leaves a precise Array without a
+      # gradual arm alone), so `q.last == 9` would fold always-falsey on correct code. A Tuple receiver's pins
+      # are the literal's own and stay, as the RBS projection kept them.
+      def filter_family_floor(element_types, receiver_type)
+        element = Type::Combinator.union(*element_types)
+        element = Type::Combinator.widen_value_pinned(element) if receiver_type.is_a?(Type::Constant)
+        Type::Combinator.nominal_of("Array", type_args: [element])
       end
 
       # Evaluates the call's block once per receiver element. Two block shapes are supported:
@@ -3405,13 +4652,86 @@ module Rigor
       def per_element_body_results(block, element_types)
         captured = per_element_captured_bindings(block, element_types)
         results = lambda do
-          element_types.map { |element_type| type_block_body_with_param(block, [element_type], captured: captured) }
+          element_types.each_with_index.map do |element_type, position|
+            type_block_body_with_param(block, [element_type], captured: captured, position: position)
+          end
         end
-        return results.call if element_types.size <= PER_ELEMENT_THREADING_LIMIT
+        return results.call unless tail_only_walk?(element_types)
+        return tail_only_body_floor(element_types) if unanswered_tail_dependency?(block, captured)
 
         without_block_body_threading(&results)
       end
 
+      # A position is typed tail-only in two cases: above {PER_ELEMENT_THREADING_LIMIT}, where this walk
+      # suppresses the threading itself, and anywhere the walk runs nested inside a body some other pass is
+      # already evaluating whole. {#threaded_block_body_type}, the `next` join
+      # ({#block_body_type_joining_nexts}), the break-arm collection ({#collect_break_arm_types}), the
+      # captured-local fixpoint ({#captured_exit_bindings}) and an enclosing walk of this fold above the cap
+      # all suppress the threading while they run, so a fold never re-enters. The second case has no arity in
+      # it: `[[], []].map do |a| a << w; a end` inside a threaded `m.synchronize do w = v; … end` is typed
+      # tail-only at two positions.
+      def tail_only_walk?(element_types)
+        element_types.size > PER_ELEMENT_THREADING_LIMIT || block_body_threading_suppressed?
+      end
+
+      # Wherever a position is typed tail-only ({#tail_only_walk?}), a tail that reads what the body's own
+      # prefix wrote or mutated does not get a wider answer. It gets the ENTRY binding, which the prefix has
+      # already falsified.
+      #
+      # #584's cliff comment promised `Dynamic[top]` above the cap, and that held for a body-LOCAL: `[1, …,
+      # 9].map do v = e; v end` has no entry binding for `v`, so tail-only lands on `Dynamic[top]` by itself,
+      # which is why a body-local alone does not call for the floor. A mutated PARAMETER has one, and issue
+      # #617 residue (2) is what it buys: `([[]] * 9).map do |a| a << 1; a end` answered nine stale `[]`, a
+      # provably-empty array at every position of a result whose slots all hold the one array the nine `<<`
+      # filled. Nested under the suppression the same body did it at two positions, and a `transform_values`
+      # over `{ x: [], y: [] }` did it at every pair ({#tail_only_pairs_floored?}). Flooring every position
+      # restores the promise for the positions; the assembler still decides the call from them, and a method
+      # whose fall-through could read a pin again takes its own floor ({#undecided_fold_floor}). What the cap
+      # and the suppression refuse to pay is the per-position body evaluation, and refusing to pay it means
+      # declining to know, not answering the pre-state.
+      #
+      # The names come from the scan the threading gate uses ({#tail_depends_on_body_binding?}), so "would
+      # threading have changed this tail" and "is tail-only untrustworthy here" stay one question. A body
+      # {#unanswered_tail_dependency?} answers false for keeps its exact fold: every single-statement block,
+      # and every multi-statement block whose tail ignores its prefix, reads only its own body-locals, or
+      # leaves through a `next` (the last is evaluated whole, never tail-only).
+      def tail_only_body_floor(element_types)
+        Array.new(element_types.size) { Type::Combinator.untyped }
+      end
+
+      # True when the tail reads something the prefix changed that NOTHING has re-answered for this walk.
+      #
+      # `captured` is the #587 (b) any-iteration binding of every outer local and instance variable the block
+      # rebinds or mutates in place ({#per_element_captured_bindings}), and its cost is independent of the
+      # arity, so it keeps working above the cap: `total = 0; [1, …, 9].map do total += e; total end` reads
+      # `total` as the fixpoint's `Integer` at every position and needs no floor, and `out = []; … do out << e;
+      # out.size end` reads `out` as the widened `Array[Dynamic[top]]`, whose content carries a gradual arm and
+      # whose arity is open. Under the nesting suppression a rebound name takes the escaping-block floor name by
+      # name, so `[total, e]` keeps its `Tuple` rather than collapsing whole, and the in-place widening, which
+      # evaluates no body, applies as it does anywhere. What a tail-only walk withholds is the per-position body
+      # evaluation, so the names left unanswered are the ones neither binding covers — a mutated block
+      # PARAMETER (issue #617 residue (2)'s `|a| a << 1; a`), and a captured local whose in-place widening
+      # declined, which is left out of `captured` for exactly this reason.
+      #
+      # Two tails are answered without it. A name with no ENTRY binding — a body-local such as `key = k.to_s;
+      # [key, n + w]` — reads as `Dynamic[top]` under tail-only by itself, which is sound, so flooring the
+      # whole position would only erase the structure around it. Instance and global variables always count,
+      # since the scope may still hold a pre-state for them. And a body with a block-level `next` is never
+      # typed tail-only at all: {#block_body_type_joining_nexts} evaluates the whole body whatever the
+      # suppression says.
+      def unanswered_tail_dependency?(block, captured)
+        body = block.body
+        return false unless body.is_a?(Prism::StatementsNode)
+        return false if body.body.size < 2
+        return false if block_level_jump?(body, Prism::NextNode)
+
+        names = tail_dependent_body_names(body.body) - (captured&.names || EMPTY_NAME_SET)
+        return false if names.empty?
+
+        entry = BlockParameterBinder.new.bind_onto(block, scope)
+        names.any? { |name| name.start_with?("@", "$") || !entry.local(name).nil? }
+      end
+
       # Issue #587 (b) — first-iteration pinning. Every position of this fold is typed from the SAME entry
       # scope, so a body that rebinds a captured outer local answers the FIRST iteration's value at every
       # position: `total = 0; [1, 2].map do total += 1; total end` folded to `[1, 1]` (runtime `[1, 2]`), and
@@ -3424,12 +4744,12 @@ module Rigor
       # position's entry scope, so a position answers what the local can be in ANY iteration
       # (`[Integer, Integer]`), never what it was in the first.
       #
-      # Only the rebound names move. A position whose tail reads an untouched captured local or a block-local
-      # keeps its exact fold (`[5, 5]`, `[42, 42]`), and a predicate that ignores the rebound counter still
-      # decides (`select do seen += 1; e > 1 end` still folds to `[2]`); a blanket decline would have lost all
-      # three for nothing. The fixpoint binds the block parameter to the union of the elements, so its cost
-      # is independent of the arity — which is why the per-element threading cap is NOT a reason to floor: a
-      # ninth element keeps `Integer` where it would otherwise keep the stale `0`.
+      # Only the names the body changes move. A position whose tail reads an untouched captured local or a
+      # block-local keeps its exact fold (`[5, 5]`, `[42, 42]`), and a predicate that ignores the rebound
+      # counter still decides (`select do seen += 1; e > 1 end` still folds to `[2]`); a blanket decline would
+      # have lost all three for nothing. The fixpoint binds the block parameter to the union of the elements,
+      # so its cost is independent of the arity — which is why the per-element threading cap is NOT a reason to
+      # floor: a ninth element keeps `Integer` where it would otherwise keep the stale `0`.
       #
       # Under threading suppression — this fold nested inside another threaded body — the fixpoint's body
       # evaluations are exactly the re-entrant cost the suppression exists to refuse, so the names take the
@@ -3437,42 +4757,256 @@ module Rigor
       # fixpoint takes the same floor rather than the seed — a seed that reaches a position is the pin this
       # exists to remove.
       #
-      # Returns `nil` (no binding to apply) for the overwhelmingly common body that rebinds nothing captured.
+      # An instance variable pins the same way — the block shares the caller's `self`, so `@t = 0; [1,
+      # 2].map { @t += 1 }` folded to `[1, 1]` too — and so do a class variable and a global. Each takes the
+      # same treatment under every rule above: the ones the body rebinds ({CapturedLocals.writes} with
+      # `non_locals: true`, which also counts `self.w = …` as a rebind of `@w`) join the name set. They keep
+      # their sigil, so the one map cannot confuse `@t` with a local `t`, and the arity-cap floor
+      # ({#unanswered_tail_dependency?}), which compares names sigil-and-all, counts a rebound ivar as answered.
+      #
+      # A name the body rebinds where the fixpoint's pass cannot see it ({UnthreadedRebinds}) takes the floor
+      # outright; see {#converged_captured_bindings}. The optimistic nil-freeness mark a pass's exit binding
+      # carries is kept with the converged type ({CapturedLocals::Bindings}).
+      #
+      # The same pin has a CONTENT half the rebind set cannot see: a captured receiver the body mutates in place
+      # is never rebound, so `h = { a: 0 }; [:a, :a].map { |k| h[k] = h[k] + 1 }` read `h` at its entry
+      # contents at every position and folded to `[1, 1]` (runtime `[1, 2]`). Each such local
+      # ({CapturedLocals.content_mutations}) is bound as if every mutation site in the body had already stored
+      # an unknown value ({UnknownStoreWidening.widen}): `Hash[Dynamic[top] | Symbol, Dynamic[top] |
+      # Integer]`, an open arity with a gradual arm on every content parameter a storing site touches. A local
+      # whose widening declines (a precise nominal) gets no binding at all, so it keeps today's answer. The
+      # binding evaluates no body, so it applies under threading suppression too; the rebind fixpoint runs
+      # over it, and a local the body both rebinds and mutates takes the same widening over its converged
+      # type — the rebind can bring a fresh literal back, which the next iteration then mutates. A local mutated
+      # through an element read (`a[0] << e`) or passed to a self-call whose callee content-mutates that
+      # parameter (`add_to(a, e)`) takes it too, widened as straight-line code widens it after such a site. An
+      # unmutated captured local keeps its exact binding (`h = { a: 0 }; [:a, :a].map { |k| h[k] }` still folds
+      # to `[0, 0]`). An instance variable the body mutates in place takes the same binding
+      # ({CapturedLocals.content_mutations} with `non_locals: true`, on the rebind set's terms): once the #587
+      # (a) gate threads an index write, `@cache[:first] ||= e` pins the same way. So do a class variable and a
+      # global.
+      #
+      # The generic block-return pass lays the same binding ({#block_entry_scope}), with the fixpoint's block
+      # parameters bound to the signature's instead of to the elements' union.
+      #
+      # The binding also marks the index `||=` sites whose slot an earlier position may have filled
+      # ({RepeatedOrWrites}), so the memoizing `||=` reading (`StatementEvaluator#index_compound_write_value`)
+      # does not take such a slot's lone `Dynamic` for "no evidence about the slot" and answer one position's
+      # rvalue: `cache = {}; [1, 2].find { |e| (cache[:first] ||= e) == 2 }` answered `2 == 2` at the second
+      # position and folded `find` to `2` where Ruby, keeping the first iteration's `1`, answers `nil`.
+      #
+      # Returns `nil` (no binding to apply) for the overwhelmingly common body that rebinds and mutates nothing
+      # captured and holds no such site.
       def per_element_captured_bindings(block, element_types)
-        names = CapturedLocals.writes(block, scope)
-        return nil if names.empty?
-        return captured_floor(names) if block_body_threading_suppressed?
+        captured_block_bindings(block, [Type::Combinator.union(*element_types)], element_types: element_types)
+      end
+
+      # The #587 (b) binding for `block`, with the fixpoint's block parameters bound to `param_types`.
+      # `element_types` is the per-element fold's positions, which {RepeatedOrWrites} reads; nil for the generic
+      # block-return pass.
+      def captured_block_bindings(block, param_types, element_types: nil)
+        stores = CapturedLocals.content_mutations(block, scope, non_locals: true)
+        names = CapturedLocals.writes(block, scope, non_locals: true)
+        repeated = RepeatedOrWrites.sites(block, stores, scope, element_types: element_types)
+        return nil if stores.empty? && names.empty? && repeated.empty?
+
+        stored = stored_capture_bindings(stores)
+        types = stored.dup
+        marks = {}
+        unless names.empty?
+          rebound_capture_bindings(block, names, param_types, stored, marks).each do |name, converged|
+            types[name] = stores.key?(name) ? UnknownStoreWidening.widen(converged, stores[name]) : converged
+          end
+        end
+        return nil if types.empty? && repeated.empty?
 
-        begin
-          converged_captured_bindings(block, names, element_types)
-        rescue StandardError
-          captured_floor(names)
+        CapturedLocals::Bindings.new(types: types, marks: marks, repeated: repeated)
+      end
+
+      # Only a binding the widening MOVED is recorded. One it declined (a precise nominal, a refinement under
+      # `sort!`) is still the entry binding, which says nothing about later iterations; recording it would make the
+      # arity-cap floor ({#unanswered_tail_dependency?}) treat the name as answered and type the tail from that
+      # stale binding. Left out, the name keeps the entry binding below the cap and
+      # the floor above it, which is the fold's answer without this pass.
+      def stored_capture_bindings(stores)
+        stores.each_with_object({}) do |(name, sites), bindings|
+          seed = CapturedLocals.bound_type(scope, name)
+          next if seed.nil?
+
+          widened = UnknownStoreWidening.widen(seed, sites)
+          bindings[name] = widened unless widened == seed
         end
       end
 
+      # `stored` is laid under every fixpoint pass, so the rebind converges over the widened contents rather
+      # than the entry ones. `marks` collects the optimistic nil-freeness mark a pass's exit binding carries.
+      def rebound_capture_bindings(block, names, param_types, stored, marks)
+        return captured_floor(names) if block_body_threading_suppressed?
+
+        converged_captured_bindings(block, names, param_types, stored, marks)
+      rescue StandardError
+        captured_floor(names)
+      end
+
       def captured_floor(names)
         names.to_h { |name| [name, Type::Combinator.untyped] }
       end
 
-      def converged_captured_bindings(block, names, element_types)
-        param_types = [Type::Combinator.union(*element_types)]
-        BodyFixpoint.converge(
-          names: names,
-          seed_bindings: names.to_h { |name| [name, scope.local(name)] },
+      # A name the body rebinds somewhere the pass's exit scope never sees ({UnthreadedRebinds}) takes the floor
+      # without running the fixpoint, and is bound to it under every pass, so a name that reads it converges over
+      # the floor rather than over the pin: `t = s` after an unthreaded `s` rebind would otherwise converge on
+      # the first iteration's `s`. The unmoved-pin test below still runs over every other name.
+      def converged_captured_bindings(block, names, param_types, stored, marks)
+        floored = UnthreadedRebinds.names(block, names)
+        moving = names.reject { |name| floored.include?(name) }
+        # Issue #1358 — each pass is an iteration, so it reads the match globals the block entry does.
+        base = stored.reduce(MatchRebinding.block_entry(scope, block)) do |acc, (name, type)|
+          CapturedLocals.bind(acc, name, type)
+        end
+        base = floored.reduce(base) { |acc, name| CapturedLocals.bind(acc, name, Type::Combinator.untyped) }
+        seeds = moving.to_h { |name| [name, CapturedLocals.bound_type(base, name)] }
+        moved = {}
+        converged = BodyFixpoint.converge(
+          names: moving,
+          seed_bindings: seeds,
           widen: Type::Combinator.method(:widen_value_pinned),
-          evaluate_body: ->(bindings) { captured_exit_bindings(block, param_types, bindings, names) }
+          evaluate_body: lambda do |bindings|
+            captured_exit_bindings(block, param_types, base, bindings, moved, marks)
+          end
         )
+        unmoved_pins_floored(converged, seeds, moved).merge(captured_floor(floored))
+      end
+
+      # A name the write scan says this block REBINDS, whose fixpoint came back on exactly its value-pinned
+      # seed, is floored rather than believed.
+      #
+      # The fixpoint reads each pass's exit binding out of `StatementEvaluator`, and that evaluator does not
+      # thread a write from every position: a rebind nested where it types a pure value leaves the exit scope
+      # holding the entry binding, so the fixpoint converges on the seed and every position of the fold answers
+      # the first iteration again. That is issue #617 residue (1)'s one-liner, `seen = 0; [1, 2].find { |e|
+      # (seen += 1) == 2 }` answering `nil` where Ruby answers `2`: the pinned `Constant[0]` made both
+      # predicates `Constant[false]`, and `find` short-circuits on a provably-falsey block. The evaluator has
+      # threaded a call's receiver since #1223, but a `when` condition or a `yield` argument is still such a
+      # position.
+      #
+      # An unmoved pin cannot be distinguished from a write that genuinely restores its own entry value
+      # (`x = 5; xs.each { x = 5 }`), so the floor gives that shape up too. It is the far cheaper side: a
+      # value-pinned seed the block rebinds is the exact pre-state this fold exists to stop trusting, and
+      # `Dynamic[top]` is the same escaping-block floor {#captured_floor} already uses. Seeds that carry no
+      # pinning are left alone — there is no first-iteration value or shape in them to remove, and widening a
+      # `Nominal` here would only lose a class for nothing.
+      #
+      # A second route reaches this test with nothing hidden from the evaluator. The fixpoint stops after
+      # {BodyFixpoint::CAP} passes, so a rebind a counter guards past the third iteration (`row = [v, v] if
+      # count > 3`) runs in none of them, and the widen on the capped pass erases a `Constant`'s value but leaves
+      # a `Tuple` / `HashShape` as it is. `row = []` therefore came back on its seed, and `sizes.last == 2`
+      # folded always-falsey on a runtime `2`, so a shape carrier counts as pinned ({#value_pinned?}). For a
+      # shape the unmoved test only asks whether the seed already covers the converged type, so any rebind the
+      # seed covers is floored with it, not only one restoring the entry value: `qr = n.divmod(3)` rebound to
+      # another `divmod` reads `Dynamic[top]` too.
+      #
+      # The pin test reads a binding as a whole and nothing else. A `0 | Integer` seed is floored too, although a
+      # threaded `x += 1` only joins back into it: an unthreaded write storing another class (`log(x = nil)`)
+      # converges on the same seed, and only the floor keeps `x.nil?` from folding to `false`. Nor does a pass
+      # whose exit binding moved prove the rebind was threaded — a narrowing (`next false unless x`) or a
+      # threaded prefix (`x ||= 0`) moves it while `(x += 1) == 2` stays unthreaded.
+      #
+      # "Unmoved" compares against the fixpoint's own seed, but "pinned" is asked of the CALL-SITE binding. For a
+      # name the body also mutates in place the seed is already the in-place widening of that binding
+      # ({#stored_capture_bindings}), and the widening erases exactly the pin this test looks for: `s = +"ab"`
+      # seeds `String`, not `"ab"`. Asking the seed would let a nested rebind the evaluator cannot see (`(s &&=
+      # s.to_sym)` inside an expression) converge on `String` and be believed, where the local really holds a
+      # Symbol from the second iteration on. For every other name the two bindings are the same. The price is
+      # the trade the paragraph above already makes: a name the body mutates and VISIBLY rebinds to the widened
+      # class (`t << "c"; t = t.strip`) converges on that seed as well, and is floored with the hidden case.
+      #
+      # A statement rebind does not buy that case back, because converging on the widened seed is not evidence
+      # that the rebind was all there was. The capped pass above runs no rebind a counter guards past the third
+      # iteration (`s = s.dup; n += 1; s = [e] if n > 3`), and the scans see only write nodes in the body, so a
+      # lambda defined outside it (`close = -> { cur = nil }; … close.call`) or `binding.local_variable_set`
+      # rebinds the local where no pass looks. Both converge on the seed next to a statement rebind, and
+      # believing `String` there reports `undefined method` or an always-falsey `cur.nil?` on correct code.
+      #
+      # A pass's exit binding also joins every block-level `next` ({StatementEvaluator#evaluate_invocation}), and
+      # a rebind on a `next` arm moves the converged binding off its seed while an unthreaded write on the
+      # fall-through stays invisible: `if c; seen = 100; next false; end; (seen += 1) == 2` converged on `0 |
+      # 100` and folded `find` to `nil`. So `moved` ({#captured_exit_bindings}) records which path moved each
+      # name. One the FALL-THROUGH moved is believed; one only a `next` arm moved is unmoved for this test, and
+      # floored with the hidden case; one neither moved is judged against its seed as before, so a block without
+      # a block-level `next` is judged exactly as it always was.
+      #
+      # {UnthreadedRebinds} floors every name it can show is rebound out of the pass's sight before this test
+      # runs, whatever the fixpoint converged to — the threaded `||=` that moves the fall-through beside an
+      # unthreaded `(seen += 1) == 2` included — so this test only ever sees a name whose rebinds the scan found
+      # threaded. It stays as the backstop for what the scan cannot see, and so the `0 | Integer` seed above
+      # keeps its floor: skipping it for a scan-clean name would trade that backstop for precision.
+      def unmoved_pins_floored(converged, seeds, moved)
+        converged.to_h do |name, type|
+          unmoved =
+            case moved[name]
+            when :fall_through then false
+            when :jump then true
+            else type == seeds[name]
+            end
+          next [name, type] unless unmoved && value_pinned?(CapturedLocals.bound_type(scope, name))
+
+          [name, Type::Combinator.untyped]
+        end
+      end
+
+      # A binding carries a pin when widening its values changes it, or when it is a `Tuple` / `HashShape` —
+      # alone or as one member of a union. A shape carrier is pinned whatever its elements are: its arity and
+      # key set are one assignment's, and the fixpoint's final widen erases a value but never a shape.
+      def value_pinned?(type)
+        case type
+        when nil then false
+        when Type::Tuple, Type::HashShape then true
+        when Type::Union then type.members.any? { |member| value_pinned?(member) }
+        else Type::Combinator.widen_value_pinned(type) != type
+        end
       end
 
       # One fixpoint pass: the body evaluated from `bindings` with the block parameters bound over them (the
-      # same layering as {#type_block_body_with_param}), returning the per-name exit binding. Threading is
-      # suppressed for the pass, as it is for every full body evaluation the block-return pass runs.
-      def captured_exit_bindings(block, param_types, bindings, names)
-        params = BlockParameterBinder.new(expected_param_types: param_types).bind(block)
-        entry = bindings.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
-        entry = params.reduce(entry) { |acc, (name, type)| acc.with_local(name, type) }
-        _type, exit_scope = without_block_body_threading { entry.evaluate(block.body) }
-        names.to_h { |name| [name, exit_scope.local(name)] }
+      # same layering as {#type_block_body_with_param}), returning the per-name exit binding — the invocation's
+      # exit, which joins every block-level `next` ({StatementEvaluator#evaluate_invocation}), so a rebind on a
+      # jumping path reaches the fixpoint. `moved` records, per name, whether this pass's FALL-THROUGH moved it
+      # off its entry (`:fall_through`) or only the joined `next` arms did (`:jump`), for {#unmoved_pins_floored}.
+      # An exit mark is recorded into `marks` and carried into later passes, since the next iteration enters on
+      # that binding. Threading is suppressed for the pass, as it is for every full body evaluation the
+      # block-return pass runs.
+      def captured_exit_bindings(block, param_types, base, bindings, moved, marks)
+        entry = bindings.reduce(base) do |acc, (name, type)|
+          CapturedLocals.bind(acc, name, type, optimistic: marks[name])
+        end
+        entry = BlockParameterBinder.new(expected_param_types: param_types).bind_onto(block, entry)
+        _type, fall_through, exit_scope = without_block_body_threading do
+          StatementEvaluator.new(scope: entry).evaluate_invocation(block)
+        end
+        bindings.to_h do |name, entry_type|
+          exit_type = CapturedLocals.bound_type(exit_scope, name)
+          record_capture_move(moved, name, entry_type, fall_through, exit_type)
+          mark = CapturedLocals.optimistic_mark(exit_scope, name)
+          marks[name] ||= mark if mark
+          [name, exit_type]
+        end
+      end
+
+      # Which path of one pass moved `name` off its `entry_type`: the fall-through outranks a `next` arm, and a
+      # name the fall-through moved in any pass stays moved.
+      def record_capture_move(moved, name, entry_type, fall_through, exit_type)
+        if moved_off?(entry_type, CapturedLocals.bound_type(fall_through, name))
+          moved[name] = :fall_through
+        elsif moved_off?(entry_type, exit_type)
+          moved[name] ||= :jump
+        end
+      end
+
+      # True when `after` is not already contained in `before` — the same stability test `BodyFixpoint` applies.
+      def moved_off?(before, after)
+        return false if after.nil?
+        return true if before.nil?
+
+        Type::Combinator.union(before, after) != before
       end
 
       def per_element_symbol_results(block_arg, element_types)
@@ -3501,7 +5035,7 @@ module Rigor
       # `Constant<a..b>`        → [Constant[a], …, Constant[b]]
       # everything else         → nil
       #
-      # Note: `Type::IntegerRange` is the bounded-Integer carrier (`int<a, b>` represents "an Integer between
+      # Note: `Type::IntegerRange` is the bounded-Integer carrier (`Integer[a..b]` represents "an Integer between
       # a and b"), not a Range value. Calls like `.map` / `.find` on an `IntegerRange` receiver would resolve
       # to `Integer#map` / `Integer#find` — neither exists — so IntegerRange does NOT participate in this
       # fold.
@@ -3541,7 +5075,7 @@ module Rigor
       #
       # Part 1 (soundness): the accumulator of a block-form fold must reach a fixpoint over an unknown
       # number of iterations — the RBS tier's generic `(S) { (S, E) -> S } -> S` binds `S` from a SINGLE
-      # block pass (acc=seed, elem=element-join), so `(1..5).inject(1) { |a, i| a * i }` types `int<1, 5>`
+      # block pass (acc=seed, elem=element-join), so `(1..5).inject(1) { |a, i| a * i }` types `Integer[1..5]`
       # while the runtime is 120 (out of range — unsound). We iterate the accumulator type to a capped
       # fixpoint (ADR-55/56 `BodyFixpoint`) so the multiply converges to `Integer`, never a value-bounded
       # interval the runtime escapes.
@@ -3557,8 +5091,6 @@ module Rigor
       # tier. Captured-local write-back (ADR-56) runs at the statement level independent of this return-type
       # computation, so a block that both accumulates and mutates captured state keeps its write-back
       # regardless of which arm answers here.
-      #
-      # @return [Rigor::Type, nil]
       def try_block_inject_fold(call_node, receiver, arg_types)
         return nil unless INJECT_METHODS.include?(call_node.name)
 
@@ -3577,7 +5109,7 @@ module Rigor
       # Splits the positional args into the optional seed. A Symbol final arg (`inject(seed, :*)`) is the
       # no-block Symbol form and never reaches here (the block guard already failed for it).
       #
-      # @return [Array(Rigor::Type, nil), Boolean] `[seed, has_seed]`
+      # @return `[seed, has_seed]`
       def inject_seed(arg_types)
         case arg_types.size
         when 0 then [nil, false]
@@ -3637,7 +5169,7 @@ module Rigor
       # member is folded; without a seed the first member seeds the memo and the rest are folded. The
       # accumulator is carried as a `Constant` type (so the block body sees a value-pinned param).
       #
-      # @return [Array(Rigor::Type::Constant, nil), Array] `[acc, rest]`
+      # @return `[acc, rest]`
       def inject_constant_start(members, seed, has_seed)
         if has_seed
           return [nil, []] unless seed.is_a?(Type::Constant) && inject_foldable?(seed.value)
@@ -3698,15 +5230,6 @@ module Rigor
         converged[:__inject_acc__] || seed_acc
       end
 
-      # `index(value)` and `find_index(value)` carry a positional argument and search by `==` rather than
-      # running the block. Decline so the RBS tier owns those forms.
-      def find_family_with_args?(call_node)
-        return false unless %i[find_index index].include?(call_node.name)
-
-        args = call_node.arguments
-        !args.nil? && !args.arguments.empty?
-      end
-
       def assemble_per_element_result(method_name, per_position, element_types)
         case method_name
         when :map, :collect then Type::Combinator.tuple_of(*per_position)
@@ -3774,28 +5297,40 @@ module Rigor
       # `find` / `detect`: returns the first receiver element whose block result is Ruby-truthy, or `nil`
       # when no position folds to truthy.
       #
-      # Folds tightly only when every per-position block result is a `Type::Constant` — otherwise we cannot
-      # decide which position (if any) is "the first matching one". When the first decisive truthy position
-      # is found, the answer is the corresponding receiver element. When every position folds to falsey,
-      # the answer is `Constant[nil]`.
+      # When the first decisive truthy position is found, the answer is the corresponding receiver element,
+      # joined with the element of every earlier position whose result is not a `Type::Constant`: such a
+      # position may match first, but the search ends at the truthy one whatever it answers, so the call
+      # never returns `nil`. When every position folds to falsey, the answer is `Constant[nil]`. With no
+      # decisive truthy position and some undecided one, it declines ({#undecided_fold_floor}).
       def assemble_find_result(per_position, element_types)
-        return nil unless per_position.all?(Type::Constant)
-
-        first_truthy_index = per_position.index { |type| truthy_constant?(type) }
-        return Type::Combinator.constant_of(nil) if first_truthy_index.nil?
+        candidates = first_match_candidates(per_position)
+        return candidates if candidates.nil? || candidates.equal?(NO_MATCH)
 
-        element_types[first_truthy_index]
+        Type::Combinator.union(*candidates.map { |index| element_types[index] })
       end
 
       # `find_index` / `index`: returns the index of the first truthy position, or `Constant[nil]` when
-      # nothing matches.
+      # nothing matches, on {#assemble_find_result}'s terms.
       def assemble_find_index_result(per_position)
-        return nil unless per_position.all?(Type::Constant)
+        candidates = first_match_candidates(per_position)
+        return candidates if candidates.nil? || candidates.equal?(NO_MATCH)
 
+        Type::Combinator.union(*candidates.map { |index| Type::Combinator.constant_of(index) })
+      end
+
+      NO_MATCH = Type::Combinator.constant_of(nil)
+      private_constant :NO_MATCH
+
+      # The positions `find` may stop at — the first decisive truthy one and every undecided one before it —
+      # `NO_MATCH` when every position folds falsey, or nil when an undecided position has no truthy one after it.
+      def first_match_candidates(per_position)
         first_truthy_index = per_position.index { |type| truthy_constant?(type) }
-        return Type::Combinator.constant_of(nil) if first_truthy_index.nil?
+        if first_truthy_index.nil?
+          return per_position.all?(Type::Constant) ? NO_MATCH : nil
+        end
 
-        Type::Combinator.constant_of(first_truthy_index)
+        undecided = (0...first_truthy_index).reject { |index| per_position[index].is_a?(Type::Constant) }
+        undecided + [first_truthy_index]
       end
 
       def truthy_constant?(type)
@@ -3816,28 +5351,47 @@ module Rigor
       #   `Constant[Symbol | String]` — otherwise the tier declines (the new key cannot be used as a static
       #   HashShape index). Collisions (two old keys mapping to the same new key) also decline.
       #
+      # Two runtime behaviours fall outside this model, and both decline:
+      #
+      # - A call with arguments. `transform_keys(mapping)` renames the keys `mapping` names and yields only
+      #   the rest to the block, and the fold never reads the mapping. `transform_values` takes none.
+      # - An in-place form whose block could see the receiver ({ReceiverBlindBlock}). The bang forms rewrite
+      #   the receiver pair by pair, so the block can see pairs it has already rewritten, while the fold types
+      #   every pair against the pre-call shape. The non-bang forms build a new hash and keep the exact fold.
+      #
       # Returns `nil` on any decline so the dispatcher falls through to `RbsDispatch` and gets the widened
       # `Hash[K, V]` answer.
       def try_hash_shape_block_fold(call_node, receiver_type)
-        return nil unless HASH_SHAPE_TRANSFORM_METHODS.include?(call_node.name)
-        return nil unless receiver_type.is_a?(Type::HashShape)
-        return nil unless receiver_type.closed?
-        return nil unless receiver_type.optional_keys.empty?
+        return nil unless hash_shape_fold_applicable?(call_node, receiver_type)
 
         block_arg = call_node.block
-        return nil if block_arg.nil?
+        return nil if in_place_block_sees_receiver?(call_node.name, block_arg)
 
         if %i[transform_values transform_values!].include?(call_node.name)
           fold_hash_shape_transform_values(receiver_type, block_arg)
         else
-          fold_hash_shape_transform_keys(receiver_type, block_arg)
+          fold_hash_shape_transform_keys(receiver_type, block_arg, in_place: call_node.name == :transform_keys!)
         end
       end
 
+      def hash_shape_fold_applicable?(call_node, receiver_type)
+        HASH_SHAPE_TRANSFORM_METHODS.include?(call_node.name) &&
+          receiver_type.is_a?(Type::HashShape) && receiver_type.closed? && receiver_type.optional_keys.empty? &&
+          call_node.arguments.nil? && !call_node.block.nil?
+      end
+
+      def in_place_block_sees_receiver?(method_name, block_arg)
+        IN_PLACE_HASH_SHAPE_TRANSFORMS.include?(method_name) &&
+          block_arg.is_a?(Prism::BlockNode) && !ReceiverBlindBlock.blind?(block_arg, scope)
+      end
+
       def fold_hash_shape_transform_values(shape, block_arg)
+        captured = hash_block_captured_bindings(block_arg, shape.pairs.values)
+        return hash_shape_values_floor(shape) if tail_only_pairs_floored?(shape, block_arg, captured)
+
         new_pairs = {}
-        shape.pairs.each do |key, value|
-          new_value = apply_hash_block(block_arg, value)
+        shape.pairs.each_with_index do |(key, value), position|
+          new_value = apply_hash_block(block_arg, value, captured: captured, position: position)
           return nil if new_value.nil?
 
           new_pairs[key] = new_value
@@ -3845,28 +5399,125 @@ module Rigor
         Type::Combinator.hash_shape_of(new_pairs)
       end
 
-      def fold_hash_shape_transform_keys(shape, block_arg)
-        new_pairs = {}
-        shape.pairs.each do |key, value|
-          key_type = Type::Combinator.constant_of(key)
-          new_key_type = apply_hash_block(block_arg, key_type)
-          return nil unless new_key_type.is_a?(Type::Constant)
+      def fold_hash_shape_transform_keys(shape, block_arg, in_place: false)
+        key_types = shape.pairs.keys.map { |key| Type::Combinator.constant_of(key) }
+        captured = hash_block_captured_bindings(block_arg, key_types)
+        return hash_keys_floor(shape) if tail_only_pairs_floored?(shape, block_arg, captured)
 
-          new_key = new_key_type.value
-          return nil unless new_key.is_a?(Symbol) || new_key.is_a?(String)
-          return nil if new_pairs.key?(new_key)
+        new_pairs = {}
+        key_types.zip(shape.pairs.values).each_with_index do |(key_type, value), position|
+          typed_key = apply_hash_block(block_arg, key_type, captured: captured, position: position)
+          new_key = new_shape_key(typed_key, new_pairs)
+          return undecided_keys_floor(shape, block_arg, key_types, captured) if new_key.nil?
 
           new_pairs[new_key] = value
         end
-        Type::Combinator.hash_shape_of(new_pairs)
+        Type::Combinator.hash_shape_of(in_place ? in_place_key_order(shape.pairs, new_pairs) : new_pairs)
+      end
+
+      # `transform_keys!` rewrites the receiver in place, pair by pair, so its pairs end in a different order from
+      # the new hash `transform_keys` builds. For each old pair, CRuby's `rb_hash_transform_keys_bang` deletes the
+      # old key unless an earlier pair already produced it as a new key, then stores the new key: in place when the
+      # new key is an old key not yet reached, appended otherwise. `{ a: 1, b: 2, c: 3 }.transform_keys! { |k| k ==
+      # :b ? :c : (k == :c ? :b : k) }` is `{ c: 2, a: 1, b: 3 }`, not `{ a: 1, c: 2, b: 3 }`, and `r.keys.first ==
+      # :a` folded always-truthy on the wrong order. Replaying those steps over a Ruby `Hash`, which orders its keys
+      # the same way, gives the same order. `new_pairs` is collision-free and in the old pairs' order, so every
+      # old key is either deleted or overwritten, and no old value survives.
+      def in_place_key_order(old_pairs, new_pairs)
+        produced = {}
+        old_pairs.keys.zip(new_pairs).each_with_object(old_pairs.dup) do |(old_key, (new_key, value)), result|
+          result.delete(old_key) unless produced.key?(old_key)
+          result[new_key] = value
+          produced[new_key] = true
+        end
+      end
+
+      # The key a pair's block result can index the new `HashShape` with — a `Constant` Symbol or String that no
+      # earlier pair already took — or nil.
+      def new_shape_key(new_key_type, new_pairs)
+        return nil unless new_key_type.is_a?(Type::Constant)
+
+        new_key = new_key_type.value
+        return nil unless new_key.is_a?(Symbol) || new_key.is_a?(String)
+
+        new_pairs.key?(new_key) ? nil : new_key
+      end
+
+      # A key fold that cannot build a `HashShape` declines to the dispatcher — except under the suppression, where
+      # the dispatcher's block-return pass is typed tail-only too and read a captured value the body mutates in
+      # place at its entry contents: `buf = +"k"; … { a: 1 }.transform_keys { |k| buf << w.to_s; buf }` answered
+      # `Hash["k", 1]` for `{ "k1" => 1 }`, though the pairs themselves were typed over the #587 (b) binding that
+      # answers `buf`. There the fold answers from the keys it typed, `Hash[union(<new keys>), union(<values>)]`,
+      # and takes the plain floor ({#hash_keys_floor}) when a pair could not be typed at all. The pairs are
+      # re-typed for it, which only a suppressed, undecided key fold pays. That pass now re-answers such a name
+      # itself ({#prefix_answered_scope}), so a decline would no longer read `"k"`; the fold still answers from
+      # the pairs it has typed.
+      def undecided_keys_floor(shape, block_arg, key_types, captured)
+        return nil unless block_body_threading_suppressed?
+
+        new_key_types = key_types.each_with_index.map do |key_type, position|
+          apply_hash_block(block_arg, key_type, captured: captured, position: position)
+        end
+        return hash_keys_floor(shape) if new_key_types.any?(&:nil?)
+
+        Type::Combinator.nominal_of(
+          "Hash", type_args: [Type::Combinator.union(*new_key_types), Type::Combinator.union(*shape.pairs.values)]
+        )
+      end
+
+      # The per-pair twin of issue #587 (b)'s first-iteration pin. Every pair is typed from the SAME entry scope,
+      # so a body that rebinds a captured outer local answered the first pair's value at every pair: `total = 0;
+      # { x: 1, y: 2 }.transform_values { total += 1 }` folded to `{ x: 1, y: 1 }` (runtime `{ x: 1, y: 2 }`),
+      # and `r[:y] == 1` then fired always-truthy on correct code. The pairs take the per-element fold's
+      # captured-local entry binding ({#per_element_captured_bindings}) — the fixpoint's block parameter bound
+      # to the union of the values, or of the `Constant` keys — rather than a copy of it: issue #1198 is where
+      # the block-entry models consolidate. A captured local the body does not change keeps its exact per-pair
+      # fold, and a `&:symbol` block captures nothing.
+      #
+      # An empty shape has no pair to type, so it does not pay for the fixpoint.
+      def hash_block_captured_bindings(block_arg, param_types)
+        return nil unless block_arg.is_a?(Prism::BlockNode)
+        return nil if param_types.empty?
+
+        per_element_captured_bindings(block_arg, param_types)
+      end
+
+      # The per-pair fold has no arity cap, so running nested inside a body another pass is evaluating whole
+      # ({#tail_only_walk?}'s second case) is the one way it reaches a tail-only pair the dependency predicate
+      # can flag, and that pair holds the same pre-state {#tail_only_body_floor} describes:
+      # `{ x: [], y: [] }.transform_values do |a| a << w; a end` inside a threaded `m.synchronize do w = v; …
+      # end` answered `{ x: [], y: [] }` for a hash whose values each hold `[1]`, and `r[:x].first + 1` was
+      # then reported on correct code. The floor is the Tuple fold's, applied per pair and over the same
+      # `captured` names, with the fold answering it rather than declining: a decline reached the dispatcher,
+      # whose block-return pass the same suppression typed tail-only, so `k = "#{k}#{w}"; k` read its keys
+      # as the entry `:a | :b` until that pass re-answered the stale name itself ({#prefix_answered_scope}).
+      # An empty shape types no pair, so it keeps its exact `{}`.
+      def tail_only_pairs_floored?(shape, block_arg, captured)
+        !shape.pairs.empty? && block_arg.is_a?(Prism::BlockNode) && block_body_threading_suppressed? &&
+          unanswered_tail_dependency?(block_arg, captured)
+      end
+
+      # `transform_values` keeps the keys and answers every value `Dynamic[top]`.
+      def hash_shape_values_floor(shape)
+        Type::Combinator.hash_shape_of(shape.pairs.transform_values { Type::Combinator.untyped })
+      end
+
+      # `transform_keys` keeps the values, but a `Dynamic[top]` key cannot index a `HashShape`, and two keys may
+      # collide, so the floor is the plain `Hash` over them.
+      def hash_keys_floor(shape)
+        Type::Combinator.nominal_of(
+          "Hash", type_args: [Type::Combinator.untyped, Type::Combinator.union(*shape.pairs.values)]
+        )
       end
 
       # Applies a single-argument block (either a full BlockNode or a `&:symbol` BlockArgumentNode) to
-      # `param_type` and returns the resulting type, or `nil` on failure.
-      def apply_hash_block(block_arg, param_type)
+      # `param_type` and returns the resulting type, or `nil` on failure. `captured:` is the pair-independent
+      # entry binding from {#hash_block_captured_bindings}, and `position:` the pair's index, which picks the
+      # index `||=` sites that binding marks there.
+      def apply_hash_block(block_arg, param_type, captured: nil, position: nil)
         case block_arg
         when Prism::BlockNode
-          type_block_body_with_param(block_arg, [param_type])
+          type_block_body_with_param(block_arg, [param_type], captured: captured, position: position)
         when Prism::BlockArgumentNode
           expression = block_arg.expression
           return nil unless expression.is_a?(Prism::SymbolNode)
@@ -3883,13 +5534,18 @@ module Rigor
         end
       end
 
-      # `captured:` — issue #587 (b): the per-name entry binding of every captured outer local the body rebinds
+      # `captured:` — issue #587 (b): the per-name entry binding of every captured outer local and instance
+      # variable the body rebinds, and of every captured local it mutates in place
       # ({#per_element_captured_bindings}), laid under the parameter bindings so a parameter still shadows.
-      def type_block_body_with_param(block_node, expected_param_types, captured: nil)
-        bindings = BlockParameterBinder.new(expected_param_types: expected_param_types).bind(block_node)
-        block_scope = (captured || {}).reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
-        block_scope = bindings.reduce(block_scope) { |acc, (name, type)| acc.with_local(name, type) }
-        type_block_body(block_node, block_scope)
+      # `position:` is the element's index in the fold; the binding marks the index `||=` sites an earlier
+      # position may have filled there ({RepeatedOrWrites::Marks}).
+      def type_block_body_with_param(block_node, expected_param_types, captured: nil, position: nil)
+        # Issue #1358 — a position past the first runs after an earlier one may have rebound the match globals.
+        entry = MatchRebinding.block_entry(scope, block_node)
+        block_scope = captured ? captured.lay(entry, position: position) : entry
+        block_scope = BlockParameterBinder.new(expected_param_types: expected_param_types)
+                                          .bind_onto(block_node, block_scope)
+        type_block_body(block_node, block_scope, captured: captured)
       rescue StandardError
         nil
       end