rigortype 0.3.9 → 0.4.0

data/lib/rigor/inference/expression_typer.rb

@@ -9,26 +9,40 @@ require_relative "../source/constant_path"
 require_relative "../source/node_children"
 require_relative "../source/node_walker"
 require_relative "../analysis/self_call_resolution_recorder"
+require_relative "block_call_timing"
+require_relative "block_repetition"
 require_relative "block_parameter_binder"
 require_relative "method_parameter_binder"
 require_relative "body_fixpoint"
 require_relative "budget_trace"
 require_relative "captured_locals"
+require_relative "closure_escape_analyzer"
+require_relative "receiver_blind_block"
 require_relative "def_node_resolver"
 require_relative "dynamic_origin"
+require_relative "error_info"
+require_relative "external_ancestor_resolution"
 require_relative "origin_lookup"
 require_relative "../effects/collector"
 require_relative "fallback"
 require_relative "flow_tracer"
+require_relative "index_write_widening"
 require_relative "indexed_narrowing"
+require_relative "jump_targets"
+require_relative "define_method_block_self"
 require_relative "macro_block_self_type"
+require_relative "match_rebinding"
 require_relative "method_dispatcher"
 require_relative "mutation_widening"
 require_relative "narrowing"
+require_relative "optimistic_origin"
 require_relative "receiver_alias"
+require_relative "repeated_or_writes"
 require_relative "singleton_object_constant"
-require_relative "optimistic_origin"
+require_relative "stored_block_call"
 require_relative "struct_fold_safety"
+require_relative "unknown_store_widening"
+require_relative "unthreaded_rebinds"
 require_relative "version_guard"
 
 module Rigor
@@ -99,12 +113,12 @@ module Rigor
         Prism::ConstantPathNode => :type_of_constant_path,
         Prism::ConstantWriteNode => :type_of_assignment_write,
         Prism::ConstantPathWriteNode => :type_of_assignment_write,
-        Prism::ConstantOperatorWriteNode => :type_of_assignment_write,
-        Prism::ConstantOrWriteNode => :type_of_assignment_write,
-        Prism::ConstantAndWriteNode => :type_of_assignment_write,
-        Prism::ConstantPathOperatorWriteNode => :type_of_assignment_write,
-        Prism::ConstantPathOrWriteNode => :type_of_assignment_write,
-        Prism::ConstantPathAndWriteNode => :type_of_assignment_write,
+        Prism::ConstantOperatorWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantOrWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantAndWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantPathOperatorWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantPathOrWriteNode => :type_of_compound_constant_write,
+        Prism::ConstantPathAndWriteNode => :type_of_compound_constant_write,
         # Self and instance/class/global variables
         Prism::SelfNode => :type_of_self_node,
         Prism::InstanceVariableReadNode => :type_of_instance_variable_read,
@@ -126,9 +140,9 @@ module Rigor
         Prism::LocalVariableOperatorWriteNode => :type_of_compound_variable_write,
         Prism::LocalVariableOrWriteNode => :type_of_compound_variable_write,
         Prism::LocalVariableAndWriteNode => :type_of_compound_variable_write,
-        Prism::IndexOperatorWriteNode => :type_of_assignment_write,
-        Prism::IndexOrWriteNode => :type_of_assignment_write,
-        Prism::IndexAndWriteNode => :type_of_assignment_write,
+        Prism::IndexOperatorWriteNode => :type_of_index_compound_write,
+        Prism::IndexOrWriteNode => :type_of_index_compound_write,
+        Prism::IndexAndWriteNode => :type_of_index_compound_write,
         Prism::MultiWriteNode => :type_of_assignment_write,
         # LHS-only target nodes (destructuring assignment, pattern matching, `for x in xs`, block parameter
         # `|a, (b, c)|`). They have no value to extract — the type-of pass acknowledges the node class so the
@@ -183,8 +197,8 @@ module Rigor
         Prism::SplatNode => :type_of_non_value,
         # Control flow (Slice 3 phase 1): branch types are unioned, jumps
         # type as Bot, loops type as Constant[nil].
-        Prism::IfNode => :type_of_if,
-        Prism::UnlessNode => :type_of_unless,
+        Prism::IfNode => :type_of_conditional,
+        Prism::UnlessNode => :type_of_conditional,
         Prism::ElseNode => :type_of_else,
         Prism::AndNode => :type_of_and_or,
         Prism::OrNode => :type_of_and_or,
@@ -229,10 +243,15 @@ module Rigor
       NO_STATIC_HASH_KEY = Object.new.freeze
       private_constant :NO_STATIC_HASH_KEY
 
-      def initialize(scope:, tracer: nil)
+      # `operand_types` is the identity-comparing `Prism::Node => Rigor::Type` table of the later operands a
+      # threading `StatementEvaluator` root typed from the scope the earlier operands left (issue #1256), or nil.
+      # It is consulted only by this typer's own descent: a node it holds is the same node typed from its own
+      # entry scope, so answering it here is what typing it there would answer.
+      def initialize(scope:, tracer: nil, operand_types: nil, typing_node: nil)
         @scope = scope
         @tracer = tracer
-        @typing_node = nil
+        @operand_types = operand_types
+        @typing_node = typing_node
       end
 
       def type_of(node)
@@ -256,6 +275,9 @@ module Rigor
         declared = scope.declared_types[node]
         return declared if declared
 
+        threaded = @operand_types&.[](node)
+        return threaded if threaded
+
         return type_of_virtual(node) if node.is_a?(AST::Node)
 
         handler = PRISM_DISPATCH[node.class]
@@ -275,6 +297,28 @@ module Rigor
         infer_user_method_return(def_node, receiver, arg_types)
       end
 
+      # The `receiver[args]` read a compound index write performs before it stores (`c[k] += v` reads `c[k]`),
+      # or nil when no tier answers. No `Prism::CallNode` for that read exists in the tree, so the write node
+      # itself stands in as the call context: it carries the same `receiver` / `arguments` / `block` a
+      # plain `c[k]` call does, which is what the context-reading tiers consult. With it, the read reaches
+      # the tiers a plain `c[k]` takes, in the same order — the own-`def` override check, the dispatcher's
+      # node- and scope-gated tiers, then the project `def` inference a dispatch miss falls to — so a project
+      # `[]` with no signature answers from its body instead of the whole write degrading to `Dynamic[top]`.
+      #
+      # A plugin `dynamic_return` rule written for `[]` still does not answer this read. Its `methods:` gate
+      # matches `call_node.name`, which an index write does not have, and the shipped rules decline any node
+      # that is not a `Prism::CallNode`, by an explicit check or through the rescue around a rule that reads
+      # `name` anyway. Minting a `Prism::CallNode` for the read would hand plugins a node that is not in the
+      # tree, through a constructor whose field list changed inside the `prism` range the gemspec accepts.
+      def implicit_index_read_type(node, receiver, arg_types)
+        return splat_index_read_type(node, receiver, arg_types) if node.arguments&.arguments&.any?(Prism::SplatNode)
+
+        try_overriding_def_dispatch(node, receiver, arg_types, method_name: :[]) ||
+          index_read_dispatch(node, receiver, arg_types) ||
+          try_user_method_inference(receiver, node, arg_types, method_name: :[]) ||
+          try_project_singleton_inference(receiver, node, arg_types, method_name: :[])
+      end
+
       # ADR-89 WD2 — the current run's return memo bucket as `{ def_node => [MemoEntry, …] }` (only entries
       # that carry a call descriptor, i.e. every stored entry). Read by the incremental session right after a
       # recording run to harvest each analyzed callee's observed call keys → return descriptors. Returns an
@@ -313,6 +357,44 @@ module Rigor
         end
       end
 
+      # Issue #1125 — the argument types of the call currently being re-typed into the body being walked,
+      # or nil outside such a frame. A `f(...)` call inside `def m(...)` re-supplies exactly the arguments
+      # `m` itself was called with, so {#call_arg_types} expands the forwarding node to THIS list instead of
+      # the `Dynamic[top]` a bare `Prism::ForwardingArgumentsNode` types as.
+      #
+      # A thread-local for the same reason the yield value is (see {YIELD_VALUE_KEY}): `...` names the
+      # frame's caller, not a binding, and the body is walked through scopes the inference rebuilds freely.
+      # It is installed unconditionally — with nil — at every user-method inference frame, so a body reached
+      # without `...` cannot read its caller's argument list. Because each frame installs its OWN list, a
+      # chain `a(...) -> b(...) -> c(...)` threads through: `b`'s frame holds the types `a` expanded and
+      # `c`'s holds `b`'s. The list is the callee's call-site `arg_types`, which is what keeps the ADR-84
+      # return memo's `(def_node, receiver, arg_types)` key complete for a forwarding def.
+      FORWARDED_ARGS_KEY = :__rigor_forwarded_call_arg_types__
+      private_constant :FORWARDED_ARGS_KEY
+
+      def self.current_forwarded_arg_types
+        Thread.current[FORWARDED_ARGS_KEY]
+      end
+
+      # Runs `block` with `types` installed as the frame's forwarded argument list, restoring the previous
+      # frame on exit.
+      def self.with_forwarded_arg_types(types, &block)
+        previous = Thread.current[FORWARDED_ARGS_KEY]
+        Thread.current[FORWARDED_ARGS_KEY] = types
+        begin
+          block.call
+        ensure
+          Thread.current[FORWARDED_ARGS_KEY] = previous
+        end
+      end
+
+      # The two call-site channels a user-method body may read from its caller — the block a `yield`
+      # reaches ({#with_yield_value_type}) and the argument list `...` re-supplies
+      # ({#with_forwarded_arg_types}) — installed together, both even when nil, for exactly one frame.
+      def self.with_call_site_frame(yield_type, forwarded_arg_types, &)
+        with_yield_value_type(yield_type) { with_forwarded_arg_types(forwarded_arg_types, &) }
+      end
+
       private
 
       attr_reader :scope, :tracer
@@ -361,33 +443,86 @@ module Rigor
       # evaluator takes — and an operator the receiver does not answer widens to `Dynamic[top]` rather than
       # inventing the rvalue.
       #
-      # Constant and index targets keep {#type_of_assignment_write}: a constant is not rebound in a loop body,
-      # and `IndexOperatorWriteNode` is typed through `Scope#type_of`'s own indexed path by
-      # `StatementEvaluator#eval_index_write`.
+      # Constant targets have {#type_of_compound_constant_write}, over the same algebra. Index targets have their
+      # own handler, {#type_of_index_compound_write}.
       def type_of_compound_variable_write(node)
-        current = compound_write_current_binding(node)
+        compound_write_value(node, compound_write_current_binding(node), type_of(node.value))
+      end
+
+      # `H ||= 0` / `Conf::LIMIT += 1` as an EXPRESSION: the value it stores, by
+      # {#type_of_compound_variable_write}'s algebra. Typed as the rvalue alone, `H = { x: 1 }; v = (H ||= 0);
+      # v[:x]` reported `Integer#[]` on a program whose `v` is `H`, and `F.transform_values { |e| F ||= 0 }`
+      # folded every value to `0`.
+      #
+      # A constant has no scope binding, so its current binding is what a plain read of the same spelling
+      # resolves to at the write site — the lexical ladder, the in-source table of plain writes, then RBS —
+      # less the caller-derived rungs a top-level body keeps for reads Ruby raises on. The memoization idiom
+      # (`def registry = REGISTRY ||= {}`, legal where a plain `REGISTRY = {}` is a dynamic constant
+      # assignment) writes a constant nothing else binds, so an unresolved target keeps the rvalue reading
+      # exactly as an unbound variable does — unless a write other than a memo binds it
+      # ({#written_constant_binding}). A path whose base renders no static name (`klass::X`, `self::X`) names
+      # no binding the resolver can look up, and reads as unbound too, on the same condition.
+      def type_of_compound_constant_write(node)
         rhs = type_of(node.value)
+        compound_write_value(node, compound_write_constant_binding(node), rhs)
+      end
 
+      def compound_write_value(node, current, rhs)
         case node
         when Prism::LocalVariableOrWriteNode, Prism::InstanceVariableOrWriteNode,
-             Prism::ClassVariableOrWriteNode, Prism::GlobalVariableOrWriteNode
+             Prism::ClassVariableOrWriteNode, Prism::GlobalVariableOrWriteNode,
+             Prism::ConstantOrWriteNode, Prism::ConstantPathOrWriteNode
           # An UNBOUND target is the memoization idiom (`def self.default = @default ||= new`): nothing
           # has written the variable on any path the analyzer saw, so the stored value is the rvalue.
           # Reading it as `Dynamic[top] | rhs` would skip every memoized singleton in `sig-gen`
           # (ADR-5 optimism; three `.default` readers went `sig.skipped.untyped-return` without this).
-          return rhs if current.nil?
+          #
+          # The index rule's exception applies: an rvalue with no truthy part makes the write a guard, not a
+          # memo. `@settings ||= raise "boot first"` returns only when something the analyzer did not see set
+          # `@settings`, and `@verbose ||= false` answers `true` once one did, so the value is that unseen
+          # binding — `Dynamic[top]`, the statement evaluator's reading of an unbound target — never the
+          # rvalue's `bot` or `false` alone. A local is no exception: the scope a loop body is typed from does
+          # not carry what the previous iteration stored.
+          if current.nil?
+            return rhs unless Narrowing.narrow_truthy(rhs).is_a?(Type::Bot)
+
+            current = dynamic_top
+          end
 
           Type::Combinator.union(Narrowing.narrow_truthy(current), rhs)
         when Prism::LocalVariableAndWriteNode, Prism::InstanceVariableAndWriteNode,
-             Prism::ClassVariableAndWriteNode, Prism::GlobalVariableAndWriteNode
-          return rhs if current.nil?
-
-          Type::Combinator.union(Narrowing.narrow_falsey(current), rhs)
+             Prism::ClassVariableAndWriteNode, Prism::GlobalVariableAndWriteNode,
+             Prism::ConstantAndWriteNode, Prism::ConstantPathAndWriteNode
+          # `&&=` is no memo: an unset target returns its own `nil` without evaluating the rvalue (a constant or
+          # class variable raises instead). Beside the rvalue, an UNBOUND target's value is its own falsey value —
+          # `nil` when unset, or a falsey value a write the analyzer did not see stored — which
+          # `narrow_falsey(Dynamic[top])` carries as `Dynamic[top]`, the statement evaluator's reading. The index
+          # rule says the same of `h[k] &&= v`. Read as the rvalue, `if (@x &&= 1)` folded always-truthy on a
+          # program that takes the else arm.
+          Type::Combinator.union(Narrowing.narrow_falsey(current || dynamic_top), rhs)
         else
           compound_operator_result(current || dynamic_top, rhs, node.binary_operator)
         end
       end
 
+      # `h[k] += v` / `h[k] ||= v` / `h[k] &&= v` as an EXPRESSION. Like a variable compound write, its value is
+      # what it stores through `[]=` — the dispatched `h[k] + v`, `truthy(h[k]) | v`, `falsey(h[k]) | v` — which
+      # reads the slot's current type, recorded indexed narrowing included. Typed as the rvalue alone it answered
+      # `1` for `counts[w] += 1`, so `r = words.map { |w| counts[w] += 1 }` pinned every position to `1` and
+      # `r.last == 1` drew a false `flow.always-truthy-condition`.
+      #
+      # The statement evaluator already owned that algebra for the straight-line write and the `[]=` widening
+      # join, so this reads its answer rather than keeping a second copy. It asks for the value alone, not a
+      # whole `evaluate`: the widening and the narrowing record are scope effects a value position discards,
+      # and the memoizing `@cache[k] ||= build(k)` tail is common enough not to pay for them.
+      #
+      # One exception carries over, narrowed, from {#type_of_compound_variable_write}: a memoizing `||=` whose
+      # slot the analyzer has no evidence about reads as the rvalue. The evaluator's value method owns it,
+      # because it is decided on the `[]` read the evaluator performs.
+      def type_of_index_compound_write(node)
+        StatementEvaluator.new(scope: scope, tracer: tracer).index_compound_write_value(node)
+      end
+
       def compound_write_current_binding(node)
         case node
         when Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
@@ -400,6 +535,64 @@ module Rigor
         end
       end
 
+      def compound_write_constant_binding(node)
+        case node
+        when Prism::ConstantOperatorWriteNode, Prism::ConstantOrWriteNode, Prism::ConstantAndWriteNode
+          full_name = node.name.to_s
+          rooted = false
+        else
+          full_name = Source::ConstantPath.qualified_name_or_nil(node.target)
+          return unnamed_path_binding(node.target) if full_name.nil?
+
+          rooted = Source::ConstantPath.rooted?(node.target)
+        end
+        resolve_constant_name(full_name, rooted: rooted, caller_derived: false) ||
+          written_constant_binding(full_name, rooted)
+      end
+
+      # A constant the plain read cannot resolve may still be bound: another file writes a value that never
+      # published (`H = { x: 1 }`), the compound write withdrew one by being the second writer the census
+      # counts, or this file writes it in a form its own table does not carry (`A, B = …`, `A = B = …`). The
+      # value is one the analyzer does not have, so the binding is `Dynamic[top]` rather than the memo's
+      # unbound reading. The one write that does not bind is a memo `||=` no other file shares, so the
+      # memoization idiom keeps that reading however often its file repeats it; memos of the name in two files
+      # bind, since either may load first and set what the other reads.
+      #
+      # Which name the write reads is the ladder's to decide, not the spelling's: the same resolution runs
+      # again with only the census's binding names in the in-source table, so `Other::REGISTRY` elsewhere
+      # leaves a top-level `REGISTRY ||= {}` its memo reading. Two census spellings the ladder cannot reach
+      # still bind: a write through a base nothing names (`k::X = 1`), which may have written any of them,
+      # and a path the census keeps as written ([#690](https://github.com/rigortype/rigor/issues/690)), so
+      # `Foo::BAR = …` inside `module M` binds `M::Foo::BAR ||= 0`.
+      def written_constant_binding(full_name, rooted)
+        names = scope.bound_constant_names(full_name)
+        return nil if names.empty?
+        return dynamic_top if names.any? { |name| unladdered_census_name?(name, full_name) }
+
+        written = names.to_h { |name| [name, dynamic_top] }
+        probe = scope.with_discovery(scope.discovery.with(in_source_constants: written))
+        Reflection.resolve_constant_type(full_name, scope: probe, rooted: rooted, caller_derived: false)
+      end
+
+      def unladdered_census_name?(name, full_name)
+        return true if name.start_with?(ScopeIndexer::DYNAMIC_TARGET_PREFIX)
+
+        name.include?("::") && full_name.end_with?("::#{name}")
+      end
+
+      # `self::X ||= v` / `klass::X ||= v` name no constant the resolver can look up, so any binding write
+      # that shares the last segment may be the one the base reaches. The answer now depends on other files'
+      # writes, and this path never reaches `Reflection.resolve_constant_type`, which records the
+      # `constant:<segment>` edge for every other form — so it records the edge itself, or an incremental
+      # run keeps serving the reading from before another file's write of the segment appeared.
+      def unnamed_path_binding(target)
+        segment = target.name&.to_s
+        return nil if segment.nil?
+
+        Analysis::DependencyRecorder.read_name(:constant, segment) if Analysis::DependencyRecorder.active?
+        dynamic_top unless scope.bound_constant_names(segment).empty?
+      end
+
       def compound_operator_result(current, rhs, operator)
         MethodDispatcher.dispatch(
           receiver_type: current,
@@ -532,7 +725,17 @@ module Rigor
       # `Inference::FallbackTracer` from inside `Rigor::CLI::Foo` resolves to
       # `Rigor::Inference::FallbackTracer`.
       def type_of_constant_read(node)
-        resolve_constant_name(node.name.to_s) || unresolved_constant_fallback(node, node.name.to_s)
+        guard_narrowed_constant(node) ||
+          resolve_constant_name(node.name.to_s) || unresolved_constant_fallback(node, node.name.to_s)
+      end
+
+      # Issue #1429 — the type a guard narrowed this constant reference to on the edge being typed
+      # (`STDOUT.is_a?(StringIO) ? STDOUT.string : nil`), or nil. Keyed by spelling ({Narrowing.constant_key}).
+      def guard_narrowed_constant(node)
+        return nil if scope.constant_narrowings.empty?
+
+        key = Narrowing.constant_key(node)
+        key && scope.constant_narrowing(key)
       end
 
       # A leading `::` (`::Rails`, `::Rails::Application`) is Ruby's escape hatch out of the lexical ladder:
@@ -540,6 +743,9 @@ module Rigor
       # deliberately un-rooted (the discovery tables are keyed that way), so the marker rides alongside it
       # into the resolver (#614).
       def type_of_constant_path(node)
+        narrowed = guard_narrowed_constant(node)
+        return narrowed if narrowed
+
         full_name = Source::ConstantPath.qualified_name_or_nil(node)
         return fallback_for(node, family: :prism) if full_name.nil?
 
@@ -608,16 +814,17 @@ module Rigor
       # in-source value, RBS constant, across the peeled `::` prefix candidates) is reused by
       # `Inference::Narrowing`'s `Constant[Regexp]` match-operand recognition. Returns the matched
       # `Rigor::Type` or nil; the caller decides whether to fall back.
-      def resolve_constant_name(name, rooted: false)
-        Reflection.resolve_constant_type(name, scope: scope, rooted: rooted)
+      def resolve_constant_name(name, rooted: false, caller_derived: true)
+        Reflection.resolve_constant_type(name, scope: scope, rooted: rooted, caller_derived: caller_derived)
       end
 
       # Slice 5 phase 1 upgrades hash literals to `HashShape{...}` when every entry is a static `AssocNode`
       # whose key is a value-pinned scalar literal — Symbol, plain String, Integer, Float, `true`, `false`,
       # or `nil` (covering `{ a: 1, "b" => 2 }` and `{ 1 => 2, 1.0 => 4 }` alike) — falling back to the
       # generic `Hash[K, V]` form otherwise. Splatted entries (`{ **other }`) and dynamic keys widen to the
-      # underlying `Hash[K, V]` form by unioning the types each entry exposes; when no concrete pair
-      # survives we fall back to the raw `Hash` so callers stay backward compatible.
+      # underlying `Hash[K, V]` form by unioning the types each entry exposes — a splat exposes the `[K, V]`
+      # of the hash it copies plus a `Dynamic[top]` arm (see {#hash_splat_pair}), so every entry contributes a
+      # pair. A splat never keeps a shape, even over an exact closed one.
       def type_of_hash(node)
         elements = node.respond_to?(:elements) ? node.elements : []
         # v0.0.7 — `{}` resolves to the empty `HashShape{}` carrier rather than `Nominal[Hash]`, mirroring the
@@ -629,8 +836,6 @@ module Rigor
         return shape if shape
 
         keys, values = generic_hash_pairs_for(elements)
-        return Type::Combinator.nominal_of(Hash) if keys.empty? || values.empty?
-
         Type::Combinator.nominal_of(
           Hash,
           type_args: [Type::Combinator.union(*keys), Type::Combinator.union(*values)]
@@ -684,14 +889,64 @@ module Rigor
         keys = []
         values = []
         elements.each do |entry|
-          next unless entry.is_a?(Prism::AssocNode)
-
-          keys << type_of(entry.key)
-          values << type_of(entry.value)
+          if entry.is_a?(Prism::AssocNode)
+            keys << type_of(entry.key)
+            values << type_of(entry.value)
+          else
+            key, value = hash_splat_pair(entry)
+            keys << key
+            values << value
+          end
         end
         [keys, values]
       end
 
+      # The `[K, V]` a `**splat` entry adds to the literal: what the analysis can read of the hash it copies, each
+      # side joined with `Dynamic[top]`. Ruby inserts every pair of that hash, so leaving the entry out typed
+      # `o = { a: :z }; { **o, b: :y }` as `Hash[:b, :y]` and folded `h[:a] == :z` on correct code.
+      #
+      # The `Dynamic[top]` arm is there even when the copy is read exactly. The literal builds a new hash that no
+      # declaration describes, while `MutationRejoin` regrows a `Hash[K, V]` after `[]=` / `merge!` only when it
+      # already carries a gradual arm, because it reads a precise one as a declared claim. Without the arm
+      # `h = { **o }; h[:b] = 2; h[:b] == 2` would fold always-falsey and `h[:e] = "s"; h[:e].upcase` would fire
+      # `call.undefined-method`, where the `Hash` a splat-only literal used to type as had stayed quiet. The same
+      # arm stands in for what the analysis cannot read: an anonymous `**`, an untyped value, a nominal other than
+      # `Hash`, an open shape's unlisted entries, and a hash filled through an alias the engine does not track,
+      # which still reads `{}`.
+      def hash_splat_pair(entry)
+        untyped = Type::Combinator.untyped
+        copied = entry.value && splatted_hash_pair(type_of(entry.value))
+        return [untyped, untyped] if copied.nil?
+
+        copied.map { |side| Type::Combinator.union(side, untyped) }
+      end
+
+      # The `[K, V]` the analysis can read of a splatted value, or nil when it reads nothing: a shape's keys and
+      # values, a `Hash[K, V]`'s type arguments (through a difference over one, `non-empty-hash[K, V]`), and the
+      # join over a union's members. `nil` reads as nothing because `**nil` splats nothing (Ruby 3.4+; earlier
+      # Rubies raise). A `Hash` subclass is not read: its own type arguments, if any, are not `Hash`'s `K` and `V`.
+      def splatted_hash_pair(type)
+        case type
+        when Type::HashShape then splatted_shape_pair(type)
+        when Type::Nominal then type.class_name == "Hash" && type.type_args.size == 2 ? type.type_args : nil
+        when Type::Difference then splatted_hash_pair(type.base)
+        when Type::Union then joined_hash_pair(type.members.filter_map { |member| splatted_hash_pair(member) })
+        end
+      end
+
+      def splatted_shape_pair(shape)
+        return nil if shape.pairs.empty?
+
+        [Type::Combinator.union(*shape.pairs.keys.map { |k| Type::Combinator.constant_of(k) }),
+         Type::Combinator.union(*shape.pairs.values)]
+      end
+
+      def joined_hash_pair(pairs)
+        return nil if pairs.empty?
+
+        [Type::Combinator.union(*pairs.map(&:first)), Type::Combinator.union(*pairs.map(&:last))]
+      end
+
       # An interpolated string `"#{a}b#{c}"` is `literal-string` when every part contributes literal-bearing
       # material: plain text segments are literal by construction, embedded expressions count when their type
       # is itself literal-string-compatible (a `Constant<String>`, the `literal-string` carrier, an
@@ -746,132 +1001,29 @@ module Rigor
         Type::Combinator.constant_of(nil)
       end
 
-      # `if c; t; (elsif c2; ...; )* else; e; end`. Prism nests `elsif` branches as `IfNode#subsequent`. Slice
-      # 3 phase 1 types both branches in the receiver scope and returns their union; scope rebinding is the
-      # StatementEvaluator's job (Slice 3 phase 2). Without an else clause the branch's implicit value is nil,
-      # which is included in the union.
-      #
-      # v0.0.6 — when the predicate folds to a `Type::Constant` whose value is Ruby-truthy (resp.
-      # Ruby-falsey), the unreachable branch is elided so the if-expression's type is the live branch alone.
-      # Statement-level branch elision lives in `StatementEvaluator#eval_if`; this handler covers the
-      # expression-position ternary form (`a ? b : c`) and any `if`/`unless` reached through `type_of`.
-      def type_of_if(node)
-        then_type = statements_or_nil(node.statements)
-        else_type = if_else_type(node.subsequent)
-        elide_or_union(node.predicate, then_type, else_type)
-      end
-
-      # `unless c; t; else; e; end`. Prism uses `else_clause` here (no `elsif` chain). Branch-elision logic
-      # mirrors `type_of_if`, inverted: a truthy predicate selects the else branch.
-      def type_of_unless(node)
-        then_type = statements_or_nil(node.statements)
-        else_type = if_else_type(node.else_clause)
-        elide_or_union(node.predicate, else_type, then_type)
-      end
-
-      # Issue #286 — the effective optimistic-nil-free cause of an expression. {OptimisticOrigin.resolve} owns
-      # the judgment, shared verbatim with `StatementEvaluator#optimistic_origin_for` and the
-      # `flow.always-truthy-condition` collector.
-      def optimistic_origin_for(node)
-        OptimisticOrigin.resolve(node, scope)
-      end
-
-      def if_else_type(subsequent)
-        return Type::Combinator.constant_of(nil) if subsequent.nil?
-
-        type_of(subsequent)
-      end
-
-      # Routes the predicate's typed value through branch elision. `live_when_truthy` and `live_when_falsey`
-      # are the branch types selected by the predicate's polarity; the names match `IfNode` semantics
-      # directly and invert at the `type_of_unless` call site.
-      def elide_or_union(predicate, live_when_truthy, live_when_falsey)
-        case constant_predicate_polarity(predicate)
-        when :truthy then live_when_truthy
-        when :falsey then live_when_falsey
-        else Type::Combinator.union(live_when_truthy, live_when_falsey)
-        end
-      end
-
-      # Returns `:truthy`, `:falsey`, or `nil` for an arbitrary predicate expression under three-valued logic.
-      # {Narrowing.predicate_certainty} owns the judgment (the same one `StatementEvaluator#live_branch_for_if`
-      # reads on the scope side): `Nominal[Integer]` (always truthy in Ruby), `Constant[nil]`, and
-      # `Constant[false]` fold one branch; `Union[true, false]`, `Dynamic[T]`, and `Top` keep both branches live.
-      def constant_predicate_polarity(predicate)
-        return nil if predicate.nil?
-
-        # ADR-47 WD5 — a decidable version guard (#627) answers first, exactly as it does on the scope side
-        # in `StatementEvaluator#branch_certainty`. Both readers ask the same pure function of the AST, so
-        # the expression form (`RUBY_VERSION >= "3.1" ? a : b`) and the statement form cannot disagree about
-        # which arm survives. The verdict rests on literals, so the ADR-101 optimistic-carrier decline below
-        # — which guards an RBS-derived judgment — does not apply to it.
-        guard = VersionGuard.verdict(predicate)
-        return guard if guard
-        # ADR-101 — decline on an optimistically nil-free carrier; see
-        # `StatementEvaluator#optimistic_carrier?` for why the gate is here and not in `Narrowing`.
-        return nil unless optimistic_origin_for(predicate).nil?
-
-        Narrowing.predicate_certainty(type_of(predicate))
+      # `if` / `unless` in value position — the ternary `c ? a : b`, a modifier `(a unless c)`, or a
+      # conditional written as an argument, a receiver, or a literal element. Issue #1003: this handler used
+      # to type both arms in the receiver scope and union them, so the predicate's narrowing reached a
+      # statement-position conditional (through `StatementEvaluator#eval_if`) and never a value-position
+      # one: `f.finite? ? f : 0.0` read `0.0 | Float` while the `if` statement bound `0.0 | finite-float`.
+      # It delegates to the statement evaluator instead of re-deriving the edges, so the two positions share
+      # one narrowing application, one branch elision (ADR-47 WD5 version guards, the ADR-101
+      # optimistic-carrier decline) and one terminating-arm rule, and cannot drift apart again. Only the
+      # value is read; the post-scope belongs to whichever walk owns the statement.
+      def type_of_conditional(node)
+        scope.evaluate(node, tracer: tracer).first
       end
 
       def type_of_else(node)
         statements_or_nil(node.statements)
       end
 
-      # `a && b` and `a || b` short-circuit at the value level: `a && b` returns `a` when `a` is falsey, else
-      # `b`. `a || b` returns `a` when `a` is truthy, else `b`.
-      #
-      # v0.0.6 — when the left operand folds to a `Type::Constant`, we know which side actually flows
-      # through, so the result is one operand's type instead of a union. Otherwise the union-of-both-operands
-      # fallback is preserved.
+      # `a && b` / `a || b` in value position. Issue #1016: this handler used to type both operands in the
+      # receiver scope, so `x.finite? && x` read `Float | false` while the statement form bound
+      # `false | finite-float`. Like `type_of_conditional`, it delegates to the statement evaluator, which owns
+      # the RHS narrowing, the constant short-circuit and its issue #313 optimistic-carrier decline.
       def type_of_and_or(node)
-        left_type = type_of(node.left)
-        polarity = left_operand_polarity(node.left, left_type)
-        return short_circuit_for(node, left_type, polarity) if polarity
-
-        # The left operand only flows through on the edge that short-circuits: `a || b` yields `a` solely
-        # when `a` is truthy, so its falsey constituents (`nil` / `false`) can never be the value of the
-        # OrNode (they hand off to `b`); `a && b` yields `a` solely when `a` is falsey. Narrow the surviving
-        # left edge before the union so `s || full` (with `s : String?`) types `String | <full>` rather than
-        # re-admitting the stripped `nil`. Mirrors `StatementEvaluator#eval_and_or`'s `skipped_type`.
-        surviving_left =
-          if node.is_a?(Prism::AndNode)
-            Narrowing.narrow_falsey(left_type)
-          else
-            Narrowing.narrow_truthy(left_type)
-          end
-        Type::Combinator.union(surviving_left, type_of(node.right))
-      end
-
-      def short_circuit_for(node, left_type, polarity)
-        and_node = node.is_a?(Prism::AndNode)
-        if polarity == :truthy
-          and_node ? type_of(node.right) : left_type
-        else
-          and_node ? left_type : type_of(node.right)
-        end
-      end
-
-      # Issue #313 — the node-aware wrapper the `&&` / `||` short-circuit reads. The spec's exclusion binds
-      # this gate as much as it binds `flow.always-truthy-condition`, and a `Constant`-only gate is not by
-      # itself enough to honour it: a literal hash whose values share one type reads as a lone `Constant`
-      # (`UNIFORM[key]` → `Constant[1]`), so the gate would judge the left operand of `UNIFORM[key] || key`
-      # provably truthy and discard the author's fallback — the counter-example the spec names verbatim.
-      # Declining returns the union of both operands, which is what `StatementEvaluator#eval_and_or` produces
-      # anyway, so the two `&&` / `||` typers stay in agreement.
-      def left_operand_polarity(left_node, left_type)
-        return nil unless optimistic_origin_for(left_node).nil?
-
-        constant_value_polarity(left_type)
-      end
-
-      # Returns `:truthy` / `:falsey` for a `Type::Constant`, nil otherwise. Mirrors
-      # `constant_predicate_polarity` but operates on a typed value (already-type-of'd) rather than a Prism
-      # node, so the same predicate analysis can be reused in both contexts.
-      def constant_value_polarity(type)
-        return nil unless type.is_a?(Type::Constant)
-
-        type.value ? :truthy : :falsey
+        scope.evaluate(node, tracer: tracer).first
       end
 
       # Three-valued evaluation of `case predicate when pattern` dispatch. For each `when` clause we ask:
@@ -889,29 +1041,41 @@ module Rigor
       # The `case ... in` pattern-matching form (`CaseMatchNode`) and the predicate-less form (`case; when
       # c1; ...`) bypass the `===` analysis: pattern matching has richer semantics, and a predicate-less
       # `case` reduces to a `if c1; ...; elsif c2` chain that statement-level narrowing already handles.
+      # Issue #1429 — each arm is typed under the subject's clause narrowing (`Narrowing.case_when_scopes`), the
+      # scope the statement evaluator runs the arm in: `when Symbol then n` on `n: Integer | Symbol` answers
+      # `Symbol`, and the `else` arm reads the subject every earlier clause has ruled out.
       def type_of_case(node)
         return type_of_case_simple_union(node) if node.is_a?(Prism::CaseMatchNode) || node.predicate.nil?
 
         subject_type = type_of(node.predicate)
         candidates = []
         reached_yes = false
+        clause_scope = scope
 
         node.conditions.each do |when_node|
-          case case_when_branch_certainty(subject_type, when_node)
-          when :yes
-            candidates << type_of(when_node)
+          conditions = when_node.respond_to?(:conditions) ? when_node.conditions : []
+          body_scope, next_scope = Narrowing.case_when_scopes(node.predicate, conditions, clause_scope)
+          certainty = case_when_branch_certainty(subject_type, when_node)
+          # :no — drop the branch
+          candidates << case_arm_type(when_node, body_scope) unless certainty == :no
+          if certainty == :yes
             reached_yes = true
             break
-          when :maybe
-            candidates << type_of(when_node)
-            # :no — drop the branch
           end
+          clause_scope = next_scope
         end
 
-        candidates << type_of_case_else(node) unless reached_yes
+        candidates << case_arm_type(node.else_clause, clause_scope) unless reached_yes
         Type::Combinator.union(*candidates)
       end
 
+      # The value of one `case` arm (`nil` for an absent `else`), typed under `arm_scope`.
+      def case_arm_type(arm, arm_scope)
+        return Type::Combinator.constant_of(nil) if arm.nil?
+
+        arm_scope.equal?(scope) ? type_of(arm) : arm_scope.type_of(arm, tracer: tracer)
+      end
+
       def type_of_case_simple_union(node)
         branch_types = node.conditions.map { |branch| type_of(branch) }
         Type::Combinator.union(*branch_types, type_of_case_else(node))
@@ -1007,24 +1171,46 @@ module Rigor
         Type::Combinator.union(primary_type, *rescue_types)
       end
 
+      # Issue #1360 — the evaluator binds `$!` in a rescue clause it enters; a clause typed here, such as one in a
+      # `begin` passed as an argument, reads `$!`, `$@` and `$?` unbound rather than an enclosing clause's.
       def rescue_chain_types(rescue_node)
+        arm_typer = typer_under(rescue_arm_scope)
         types = []
         current = rescue_node
         while current
-          types << statements_or_nil(current.statements)
+          types << arm_typer.send(:statements_or_nil, current.statements)
           current = current.subsequent
         end
         types
       end
 
       def type_of_rescue(node)
-        statements_or_nil(node.statements)
+        typer_under(rescue_arm_scope).send(:statements_or_nil, node.statements)
       end
 
+      def rescue_arm_scope = scope.forget_error_info.forget_last_status
+
       # `expr rescue fallback` is RescueModifierNode in Prism. The result is `expr`'s type when no exception
-      # is raised and `fallback`'s type otherwise; both paths are reachable, so the result is their union.
+      # is raised and `fallback`'s type otherwise; both paths are reachable, so the result is their union. Issue #1360
+      # — `fallback` runs with `$!` and `$@` bound to the `StandardError` it rescued ({ErrorInfo.modifier_entry}).
       def type_of_rescue_modifier(node)
-        Type::Combinator.union(type_of(node.expression), type_of(node.rescue_expression))
+        fallback = node.rescue_expression
+        fallback_type =
+          if ErrorInfo.read_in?(fallback)
+            typer_under(ErrorInfo.modifier_entry(scope, fallback)).type_of(fallback)
+          else
+            type_of(fallback)
+          end
+        Type::Combinator.union(type_of(node.expression), fallback_type)
+      end
+
+      # A typer that shares this one's tracer and operand types but reads `other_scope`.
+      def typer_under(other_scope)
+        return self if other_scope.equal?(scope)
+
+        ExpressionTyper.new(
+          scope: other_scope, tracer: tracer, operand_types: @operand_types, typing_node: @typing_node
+        )
       end
 
       def type_of_ensure(node)
@@ -1295,10 +1481,16 @@ module Rigor
       # and fired `undefined method 'upcase' for nil` on correct code. The candidate is still looked up
       # first — that lookup is a hash probe and owns the ADR-46 cross-file dependency edge — and
       # {#self_type_answers?} then vetoes the bind for a name the enclosing class answers itself.
+      #
+      # Issue #963 item 2 — {#plugin_member_answers?} is the second veto, for the members no source the
+      # engine walks can enumerate: a plugin's `dynamic_return` answer and the ADR-16 synthetic-method
+      # index. They are members of `self` exactly as an `attr_reader` is, so a top-level `def` must not
+      # bind ahead of them either.
       def try_local_def_dispatch(node, receiver, arg_types, block_type = nil)
         local_def = node.receiver.nil? ? scope.bindable_top_level_def_for(node.name) : nil
         return nil unless local_def
         return nil if self_type_answers?(node.name)
+        return nil if plugin_member_answers?(node, receiver)
 
         local_inference = infer_top_level_user_method(local_def, receiver, arg_types, block_type)
         return local_inference if local_inference
@@ -1334,21 +1526,48 @@ module Rigor
       # describes the source under analysis, while a bundled signature describes a class the project does
       # not own, where a project `def` is a monkey-patch and [ADR-17] owns the question.
       # `project_declared_class?` fail-softs to false, so an unattributable environment changes nothing.
-      def try_overriding_def_dispatch(node, receiver, arg_types)
-        return nil unless user_inference_receiver?(receiver)
+      def try_overriding_def_dispatch(node, receiver, arg_types, method_name: node.name)
+        return nil unless overriding_own_def?(receiver, method_name)
+
+        try_user_method_inference(receiver, node, arg_types, method_name: method_name) || dynamic_top
+      end
+
+      # The three conditions above: an own source `def` of `method_name` on the receiver's class, which has no
+      # declaration of its own but inherits one a project-declared ancestor wrote.
+      def overriding_own_def?(receiver, method_name)
+        return false unless user_inference_receiver?(receiver)
 
         class_name = receiver.class_name
-        return nil if class_name.nil?
+        return false if class_name.nil?
         # `Scope#user_def_for`, not `discovered_method?`: the cross-file table deliberately withholds a
         # plain instance `def` under the ADR-17 monkey-patch contract, and this gate must see one.
-        return nil if scope.user_def_for(class_name, node.name).nil?
+        return false if scope.user_def_for(class_name, method_name).nil?
 
-        definition = safe_rbs_method_definition(class_name, node.name, :instance)
-        return nil if definition.nil?
-        return nil if rbs_declared_on_class?(definition, class_name)
-        return nil unless project_declared_owner?(definition)
+        definition = safe_rbs_method_definition(class_name, method_name, :instance)
+        return false if definition.nil?
+        return false if rbs_declared_on_class?(definition, class_name)
 
-        try_user_method_inference(receiver, node, arg_types) || dynamic_top
+        project_declared_owner?(definition)
+      end
+
+      # {#implicit_index_read_type}'s dispatcher tier, with the write node as the call context.
+      def index_read_dispatch(node, receiver, arg_types)
+        MethodDispatcher.dispatch(
+          receiver_type: receiver, method_name: :[], arg_types: arg_types,
+          environment: scope.environment, call_node: node, scope: scope
+        )
+      end
+
+      # A splat index (`c[*keys] += v`) leaves the read's arity to the splat's expansion, and the one untyped
+      # argument standing in for it would bind positionally to a body written for several: `def [](*keys) =
+      # keys.size` folded the read of `r[*[0, 1]] += 1` to `1` and drew an always-falsey `n == 3` on a program
+      # that takes that branch. So the body tiers decline under a splat, as `try_literal_send` does, and only
+      # the signature-driven dispatch answers. An own `def` overriding an inherited declaration still outranks
+      # that declaration; with its body unreadable, it answers `Dynamic[top]`.
+      def splat_index_read_type(node, receiver, arg_types)
+        return dynamic_top if overriding_own_def?(receiver, :[])
+
+        index_read_dispatch(node, receiver, arg_types)
       end
 
       # Whether the class an inherited declaration was written about is one the project declares itself.
@@ -1379,6 +1598,24 @@ module Rigor
         end
       end
 
+      # Issue #963 item 2 — the plugin arm of the veto: whether a plugin answers `node.name` on the call's
+      # own `self`. Asked of `MethodDispatcher.plugin_member_answers?`, which puts the question to the same
+      # two tiers dispatch would consult (the gated `dynamic_return` walk and the ADR-16 synthetic-method
+      # index), so the veto carries no plugin knowledge of its own.
+      #
+      # The confidence gate is #618's, unchanged and re-stated here rather than inherited: only a `self`
+      # whose class is KNOWN participates. At genuine top level, and inside a block whose `self` is
+      # unmodelled, `scope.self_type` is nil, `receiver` is the synthetic `Object` / `Dynamic[Top]` stand-in
+      # that {#call_receiver_type_for} substitutes, and asking a plugin about THAT receiver would be asking
+      # about a `self` the engine has not modelled — #316's / #319's territory, which this stays out of.
+      def plugin_member_answers?(node, receiver)
+        return false if scope.self_type.nil?
+
+        MethodDispatcher.plugin_member_answers?(
+          call_node: node, scope: scope, receiver_type: receiver, method_name: node.name
+        )
+      end
+
       # The instance side of {#self_type_answers?}: the discovered methods (`def`, `attr_*`,
       # `define_method`, `alias`) of the class or any project ancestor, its `Struct.new` / `Data.define`
       # member accessors, a `def` reached through its project ancestors (superclass chain and included
@@ -1407,25 +1644,13 @@ module Rigor
       # environment, so the declaration that decides the question is written about an ancestor the project
       # does not declare (`StandardError`, `Array`, `Comparable`) — each is asked on its own terms, and
       # each of them is itself before `::Object` in the reader's MRO by construction.
+      #
+      # Issue #527 slice 0 — the walk itself lives in {ExternalAncestorResolution}, which reports WHICH
+      # declaration answered because the dispatch side needs to dispatch there. This tier only needs to
+      # know that one did, so it reads the presence of an answer. Dependency recording stays ON: this
+      # arm genuinely read the ancestor's declaration to decide the binding.
       def rbs_ancestor_answers?(class_name, method_name)
-        definition = safe_rbs_method_definition(class_name, method_name, :instance)
-        return true if rbs_declared_before_object?(definition, class_name)
-
-        scope.external_ancestor_name_candidates(class_name, name_memo: class_graph_buckets[:name])
-             .any? { |candidates| external_ancestor_answers?(candidates, method_name) }
-      end
-
-      # The first candidate spelling the RBS environment knows is the ancestor Ruby resolves; a name it
-      # knows nothing about contributes no evidence either way.
-      def external_ancestor_answers?(candidates, method_name)
-        candidates.each do |candidate|
-          next if instance_ancestor_names(candidate).empty?
-
-          return rbs_declared_before_object?(
-            safe_rbs_method_definition(candidate, method_name, :instance), candidate
-          )
-        end
-        false
+        !ExternalAncestorResolution.resolve(class_name, method_name, :instance, scope: scope).nil?
       end
 
       # The singleton side: a class-body `self` is `Singleton[Foo]`, where an implicit-self call reaches
@@ -1452,56 +1677,16 @@ module Rigor
         !members.nil? && members.include?(method_name.to_sym)
       end
 
+      # Issue #527 slice 0 — the RBS lookup, its `rescue`, and the `::Object` MRO cut-off moved to
+      # {ExternalAncestorResolution}, which the dispatch side reads too. These stay as this class's
+      # spelling of them, because three other tiers here (`try_overriding_def_dispatch`,
+      # {#singleton_self_answers?}) ask the own-class question without the ancestor walk.
       def safe_rbs_method_definition(class_name, method_name, kind)
-        if kind == :singleton
-          Rigor::Reflection.singleton_method_definition(class_name, method_name, scope: scope)
-        else
-          Rigor::Reflection.instance_method_definition(class_name, method_name, scope: scope)
-        end
-      rescue StandardError
-        nil
+        ExternalAncestorResolution.method_definition(class_name, method_name, kind, scope: scope)
       end
 
-      # True when the RBS declaration found for the name sits on `class_name` itself rather than on an
-      # ancestor; mirrors `CheckRules#defined_on?` and `SigGen::Generator#declared_on_class_itself?`.
       def rbs_declared_on_class?(definition, class_name)
-        return false if definition.nil?
-        return false unless definition.respond_to?(:defined_in)
-
-        defined_in = definition.defined_in
-        return false if defined_in.nil?
-
-        defined_in.to_s.delete_prefix("::") == class_name.to_s.delete_prefix("::")
-      end
-
-      # Issue #633 — true when the declaration's owner sits strictly before `::Object` in `class_name`'s
-      # instance MRO, i.e. Ruby dispatches to it ahead of a top-level `def` (which is `Object`'s own
-      # private instance method). The own class trivially qualifies. An owner absent from the ancestor
-      # list, an unbuildable class, and an ancestry that does not reach `Object` (a `BasicObject`
-      # descendant) all answer false, leaving the historical top-level binding untouched.
-      def rbs_declared_before_object?(definition, class_name)
-        return true if rbs_declared_on_class?(definition, class_name)
-        return false if definition.nil? || !definition.respond_to?(:defined_in)
-
-        owner = definition.defined_in
-        return false if owner.nil?
-
-        ancestors = instance_ancestor_names(class_name)
-        object_index = ancestors.index("Object")
-        owner_index = ancestors.index(owner.to_s.delete_prefix("::"))
-        !object_index.nil? && !owner_index.nil? && owner_index < object_index
-      end
-
-      # The class's instance-side ancestors in MRO order, `::`-stripped, or `[]` for a class the RBS
-      # environment does not know or cannot build. Read through the loader's accessor rather than
-      # `instance_definition(...).ancestors` because that is the one wired to the ancestor-name cache and
-      # marked as RIGOR'S OWN demand — ordering two ancestors is not the analysis asking whether either
-      # one's methods resolve, and the `rbs.coverage` bookkeeping must not record it as such.
-      def instance_ancestor_names(class_name)
-        loader = scope.environment&.rbs_loader
-        loader ? loader.ancestor_names_for(class_name.to_s) : []
-      rescue StandardError
-        []
+        ExternalAncestorResolution.declared_on_class?(definition, class_name)
       end
 
       # Issue #520 — Ruby defines the value of an attribute / index assignment (`x.attr = v`, `h[k] = v`)
@@ -1615,12 +1800,87 @@ module Rigor
       # `ops.all? { |o| break false unless o; true }` still folds the no-break path to `Constant[true]`, and
       # the union with the `false` arm makes the call `bool` — no `flow.always-truthy-condition` on a program
       # that really can answer false.
+      #
+      # Issue #1095: the callee's result is kept because an arbitrary callee may return without ever running
+      # the block. A catalogued exactly-once yielder ({BlockCallTiming}) cannot, so when its block's normal
+      # completion is unreachable the callee's result is too, and the call is its `break` arms alone — `bot`
+      # when every path raises or returns instead.
+      #
+      # Issue #1107: `Kernel#loop` declares `-> bot` but returns normally, with `StopIteration#result`, when its
+      # block raises `StopIteration`. Unless the body provably cannot ({BlockCallTiming.loop_may_complete?}),
+      # that normal return is `untyped` — the result's declared type — so `loop { e.next }` is not `bot` and
+      # `loop { x = e.next; break x if x }` keeps its arm beside it.
       def call_dispatch_type_for(node, receiver_override: nil)
-        result = call_result_type_for(node, receiver_override: receiver_override)
+        result = loop_completion_type(node, call_result_type_for(node, receiver_override: receiver_override))
         arms = call_break_arm_types(node, receiver_override: receiver_override)
-        return result if arms.empty?
+        if exactly_once_block_never_completes?(node, receiver_override)
+          return arms.empty? ? Type::Combinator.bot : Type::Combinator.union(*arms)
+        end
+
+        combined = arms.empty? ? result : Type::Combinator.union(result, *arms)
+        widen_optimistic_predicate_constant(node, combined)
+      end
+
+      # Issue #1172 — the nil-collapsing predicates (`nil?`, `!`, `x == nil`, …) answer a `Constant` that
+      # encodes the receiver's nil-freeness. When that nil-freeness is only *optimistic* — an
+      # `%a{implicitly-returns-nil}` read `RbsDispatch` deliberately reads past — the constant is a bet,
+      # not a fact, and unlike the in-scope `OptimisticOrigin` mark a folded `Constant[false]` survives
+      # into the enclosing method's return summary. A caller's `helper(...) ? a : b` then sees a
+      # proof-shaped constant and reports `flow.always-truthy-condition` on a live guard (the mark cannot
+      # follow a value across the method boundary, so {OptimisticOrigin.resolve} at the call site finds
+      # nothing). Widen the predicate's constant answer to `bool` when the call derives a mark: the three
+      # certainty consumers already decline on the mark inside this scope, and the widened return keeps
+      # the same judgment from leaking out as a folded return type. The carrier's own type is unchanged —
+      # `h[k]` still reads nil-free, per the spec's MUST NOT.
+      def widen_optimistic_predicate_constant(node, type)
+        return type unless type.is_a?(Type::Constant) && [true, false].include?(type.value)
+        # The carrier read itself keeps its declared answer even when that is a literal `true` /
+        # `false` — the mark says its nil-freeness is a bet, not that the value's class widened.
+        return type if scope.optimistic_origins[node]
+        return type if OptimisticOrigin.resolve(node, scope).nil?
+
+        # Widen only toward what a miss really answers: a safe-navigation call answers `nil`, and
+        # `!recv&.empty?` answers `true` either way, so widening either would invent the other boolean.
+        miss = OptimisticOrigin.miss_answer(node, scope)
+        return type unless miss.equal?(OptimisticOrigin::UNKNOWN_MISS) || miss == !type.value
+
+        Type::Combinator.union(Type::Combinator.constant_of(true), Type::Combinator.constant_of(false))
+      end
+
+      def loop_completion_type(node, result)
+        return result unless result.is_a?(Type::Bot) && BlockCallTiming.loop_may_complete?(node)
+
+        scope.record_dynamic_origin(node, DynamicOrigin::EXPLICIT_UNTYPED)
+        Type::Combinator.untyped
+      end
+
+      # Whether `node` calls a catalogued exactly-once yielder ({BlockCallTiming}) with a literal block that can
+      # never complete normally. Two proofs must BOTH hold. The syntactic one
+      # ({BlockCallTiming.never_completes_normally?}) says every path ends in a jump or a non-returning Kernel
+      # call. The block-return pass must also answer exactly `bot`: a reachable `next` joins its value instead
+      # (#841), so `tap { next "s" }` completes and keeps the receiver, and a nil-bearing or `Dynamic` value or a
+      # failed pass (`nil`) keeps the #853 union. The pass alone is not enough, because it also answers `bot`
+      # for a body whose last call merely DECLARES `-> bot` — a project method's signature, or `loop` before
+      # #1107 widened it ({#loop_completion_type}); `loop { e.next }` returns normally once `e` is drained, and
+      # trusting it made correct code report an always-falsey condition.
+      #
+      # The pre-gates run cheapest-first because the block is re-typed here: the name, a `Prism::BlockNode` (a
+      # `&blk` / `&:sym` block-pass carries no body to prove anything about), no arguments (none of the three
+      # takes one), the syntactic walk, then the resolved-owner check.
+      def exactly_once_block_never_completes?(node, receiver_override)
+        return false unless BlockCallTiming.candidate_name?(node.name)
+
+        block_node = node.block
+        return false unless block_node.is_a?(Prism::BlockNode) && block_node.body
+        return false if node.arguments
+        return false unless BlockCallTiming.never_completes_normally?(block_node.body, scope)
 
-        Type::Combinator.union(result, *arms)
+        receiver = receiver_override || call_receiver_type_for(node)
+        return false unless BlockCallTiming.exactly_once_call?(
+          receiver_type: receiver, method_name: node.name, scope: scope
+        )
+
+        block_return_type_for(node, receiver, []).is_a?(Type::Bot)
       end
 
       def call_result_type_for(node, receiver_override: nil)
@@ -1956,6 +2216,9 @@ module Rigor
       # The three receiver-shaped block folds, in their historical order (extracted whole from
       # `call_dispatch_type_for` for method-length budget).
       def try_receiver_block_folds(node, receiver, arg_types)
+        rebound = rebound_operand_typer(node)
+        return rebound.send(:try_receiver_block_folds, node, receiver, arg_types) if rebound
+
         per_element = try_per_element_block_fold(node, receiver)
         return per_element if per_element
 
@@ -1965,6 +2228,25 @@ module Rigor
         try_hash_shape_block_fold(node, receiver)
       end
 
+      # Issue #1365 — Ruby runs a call's receiver chain and arguments before the method yields, so when they may
+      # rebind the match globals ({MatchRebinding.operands_may_rebind?}: `[u.index(/(q)/)].map { $1 }`) every
+      # pass that types the call's block — the block-return pass, its captured-local fixpoint and the receiver
+      # folds — types it under a typer whose scope has forgotten them, as {MatchRebinding.block_entry} does for
+      # the call's block and `StatementEvaluator#forget_operand_specials` for the statement. `$_` is forgotten on
+      # the same terms when they may set it ({LastLine.operands_may_set?}, issue #1359). nil otherwise.
+      def rebound_operand_typer(call_node)
+        return nil if call_node.block.nil?
+
+        rebound = scope
+        if rebound.match_globals_bound? && MatchRebinding.operands_may_rebind?(call_node, scope)
+          rebound = rebound.forget_match_globals
+        end
+        rebound = rebound.forget_last_line if rebound.last_line_bound? && LastLine.operands_may_set?(call_node, scope)
+        return nil if rebound.equal?(scope)
+
+        ExpressionTyper.new(scope: rebound, tracer: tracer, operand_types: @operand_types, typing_node: @typing_node)
+      end
+
       # Issue #533 — `x.send(:selector, args)` with a LITERAL symbol is statically `x.selector(args)`:
       # the private-boundary idiom (protobuf's `send(:get_file_descriptor)` at 84 sites) resolves through
       # the same dispatch + project-inference tiers as the direct call would. `send` legitimately crosses
@@ -2144,26 +2426,49 @@ module Rigor
       CLASS_GRAPH_CACHE_KEY = :__rigor_class_graph_cache__
       private_constant :CLASS_GRAPH_CACHE_KEY
 
-      # Run-scoped memo for the static class-graph resolvers below. They are pure functions of the *frozen*
-      # project index trio (`discovered_def_nodes` / `discovered_superclasses` / `discovered_includes`) —
-      # `user_def_for` / `superclass_of` / `includes_of` read nothing else, and never touch the current
-      # scope's locals or narrowings — so a result computed for one `(class, method)` is valid for every
-      # `Scope` that shares those tables. `ExpressionTyper` is rebuilt per `Scope#type_of`, so the memo lives
-      # on `Thread.current` rather than on `self`. It is keyed by the *identity* of the three frozen tables
-      # (nested `compare_by_identity` stores): a new analysis generation, or any `Scope` that swaps an index
-      # via `with_discovered_*`, transparently lands in a fresh bucket while everything sharing the tables
-      # shares the memo. Steady-state cost is three identity-keyed hash reads and zero allocation — the `||=`
-      # chains only allocate on the first miss of a generation. (Pool mode forks per worker, so the
-      # `Thread.current` store is process-local and never crosses a project boundary.)
+      # Memo for the static class-graph resolvers below. They are pure functions of the scope's *frozen*
+      # discovery tables — `user_def_for` / `superclass_of` / `includes_of` and the ancestor-name resolver
+      # read nothing else, and never touch the current scope's locals or narrowings — so a result computed
+      # for one `(class, method)` is valid for every `Scope` carrying the same {DiscoveryIndex}.
+      #
+      # The key is that index's identity, NOT the three tables the walk is usually described by. Five
+      # tables are in play: `discovered_def_nodes` / `discovered_superclasses` / `discovered_includes`,
+      # plus `discovered_header_nestings` and `discovered_methods`, which {Scope#ancestor_name_candidates}
+      # and {Scope#known_user_class?} read when resolving an ancestor name to a project class. Keying on
+      # the trio alone would let a `discovery.with(discovered_methods: …)` that happens to share the trio
+      # serve a name resolution computed against the OLD table. The index that owns all five is one
+      # object, so keying on it is both cheaper to check and correct by construction — and stays correct
+      # when a sixth table joins the walk.
+      #
+      # ONE slot, replaced rather than accumulated — the same shape, and now the same key, as
+      # {MethodDispatcher::RbsDispatch}'s `core_stdlib_memo`. `ExpressionTyper` is rebuilt per
+      # `Scope#type_of`, so the slot lives on `Thread.current` rather than on `self`. A `Scope` merges its
+      # file's discovery with the project pre-pass, so every analysed file arrives with a fresh index: an
+      # identity-keyed *store* grew one bucket per file and, because the keys ARE the tables, pinned every
+      # file's whole discovery index for the length of the run. What that bought, measured over
+      # `lib`+`plugins`: 552 buckets holding 1,834 entries between them, and 58 of 80,106 calls answered
+      # across files — 149 of the 701 slot switches returned to a bucket seen before, all of them in the
+      # seed phases that revisit the project index. One slot gives those 58 answers up and allocates 706
+      # buckets instead of 552, and still allocates FEWER objects over `lib` than the store did (−368),
+      # because one `equal?` is cheaper than three identity-hash lookups.
+      #
+      # Steady-state cost is one `equal?` check and zero allocation; the array and the buckets are
+      # allocated once per index. (Pool mode forks per worker, so the `Thread.current` slot is
+      # process-local and never crosses a project boundary — and note that the parent's reported
+      # `Memory peak` therefore does not see a worker's share of this at all.)
       def class_graph_buckets
-        store = (Thread.current[CLASS_GRAPH_CACHE_KEY] ||= {}.compare_by_identity)
-        by_def = (store[scope.discovered_def_nodes] ||= {}.compare_by_identity)
-        by_super = (by_def[scope.discovered_superclasses] ||= {}.compare_by_identity)
-        # `self_pure` is issue #525's grant scan (identity-keyed by def node); it belongs here because it
-        # is a pure function of the same frozen index trio — the sibling resolver it walks reads nothing
-        # else.
-        by_super[scope.discovered_includes] ||=
-          { name: {}, user_def: {}, self_pure: {}.compare_by_identity, yields: {}.compare_by_identity }
+        discovery = scope.discovery
+        slot = Thread.current[CLASS_GRAPH_CACHE_KEY]
+        unless slot && slot[0].equal?(discovery)
+          # `self_pure` is issue #525's grant scan (identity-keyed by def node); it belongs here because it
+          # is a pure function of the same frozen index — the sibling resolver it walks reads nothing else.
+          # `singleton_def` is added lazily by {#singleton_def_through_ancestors}'s caller.
+          slot = [discovery,
+                  { name: {}, user_def: {}, self_pure: {}.compare_by_identity,
+                    yields: {}.compare_by_identity }]
+          Thread.current[CLASS_GRAPH_CACHE_KEY] = slot
+        end
+        slot[1]
       end
 
       def resolve_user_def_through_ancestors(class_name, method_name)
@@ -2222,16 +2527,40 @@ module Rigor
       OVERRIDE_GATE_CACHE_KEY = :__rigor_overridable_method_gate__
       private_constant :OVERRIDE_GATE_CACHE_KEY
 
-      # Run-scoped memo for {#overridden_in_project?}, keyed (like `class_graph_buckets`) by the identity of
-      # the frozen discovery trio so a new analysis generation lands in a fresh bucket, then nested `kind →
-      # owner → method_name`. The predicate is a pure function of those tables. Nesting avoids allocating a
-      # composite cache key on the hot path (the gate runs on every adopted self-call return), so a
-      # steady-state hit is three identity hash reads + two string/symbol hash reads with zero allocation.
+      # Memo for {#overridden_in_project?}, nested `kind → owner → method_name`. The predicate is a pure
+      # function of the scope's frozen discovery tables, so that index's *identity* is what says whether a
+      # bucket still applies. Nesting under `kind` and `owner` avoids allocating a composite cache key on
+      # the hot path (the gate runs on every adopted self-call return), so a steady-state hit is one
+      # `equal?` check and three keyed hash reads with zero allocation.
+      #
+      # The key is the whole {Scope::DiscoveryIndex}, NOT the `discovered_def_nodes` /
+      # `discovered_superclasses` / `discovered_includes` trio the walk is usually described by — the same
+      # key, for the same reason, as {#class_graph_buckets}. {#related_to_owner?} reaches
+      # {Scope#ancestor_name_candidates} and {Scope#known_user_class?}, which read
+      # `discovered_header_nestings` and `discovered_methods` as well, so a trio key would let an index
+      # that swapped only one of those serve an answer computed against the old table. Over `lib`+`plugins`
+      # the two keys switch the same 113 times, so correctness here is free.
+      #
+      # ONE slot, replaced rather than accumulated — the same shape as
+      # {MethodDispatcher::RbsDispatch}'s `core_stdlib_memo`. A `Scope` merges its file's discovery with the
+      # project pre-pass, so every analysed file gets a fresh index: an identity-keyed *store* grew one
+      # bucket per file and, because the key IS the index, pinned every file's whole discovery index for the
+      # length of the run — 109 live buckets over `lib`+`plugins`, one per distinct trio at every key level,
+      # holding 418 answers between them (211 instance, 207 singleton).
+      #
+      # What the store bought for that was one bucket's worth of cross-file reuse, not 109: only the
+      # project-seed scope recurs, because {Analysis::Runner} types each file's pre-passes under it before
+      # {ScopeIndexer} merges the file's own discovery in. A bucket is two small hashes, so giving that up
+      # is free — unlike {#method_definers_index} below, whose bucket costs a full table scan and which is
+      # keyed and bounded differently for exactly that reason.
       def override_gate_buckets
-        store = (Thread.current[OVERRIDE_GATE_CACHE_KEY] ||= {}.compare_by_identity)
-        by_def = (store[scope.discovered_def_nodes] ||= {}.compare_by_identity)
-        by_super = (by_def[scope.discovered_superclasses] ||= {}.compare_by_identity)
-        by_super[scope.discovered_includes] ||= { instance: {}, singleton: {} }
+        discovery = scope.discovery
+        slot = Thread.current[OVERRIDE_GATE_CACHE_KEY]
+        unless slot && slot[0].equal?(discovery)
+          slot = [discovery, { instance: {}, singleton: {} }]
+          Thread.current[OVERRIDE_GATE_CACHE_KEY] = slot
+        end
+        slot[1]
       end
 
       # True when some discovered project class/module — distinct from `owner` — redefines `(method_name,
@@ -2271,14 +2600,65 @@ module Rigor
       METHOD_DEFINERS_INDEX_KEY = :__rigor_method_definers_index__
       private_constant :METHOD_DEFINERS_INDEX_KEY
 
-      # Per-generation `method_name (Symbol) → [owner names]` inverted index over the instance / singleton
-      # def tables, memoised by the identity of the def table it inverts (a new analysis generation lands in
-      # a fresh bucket). The toplevel sentinel is excluded — a toplevel `def` has no class ancestry and so
-      # can never be an override.
+      # The second way. Two flat thread slots rather than one slot holding an array of ways: a
+      # `Thread.current[KEY] ||= […]` seeds the store with an array LITERAL, which folds to a tuple whose
+      # elements are pinned, and the engine then reads the `way[0].equal?(…)` guards below as always-falsey
+      # (`make check` fires `flow.always-truthy-condition` on this very file). Two keys read as two plain
+      # `Thread.current` reads and keep the guards analysable.
+      METHOD_DEFINERS_INDEX_ALT_KEY = :__rigor_method_definers_index_alt__
+      private_constant :METHOD_DEFINERS_INDEX_ALT_KEY
+
+      # `method_name (Symbol) → [owner names]` inverted index over the instance / singleton def tables,
+      # valid for exactly as long as the table it inverts: a new analysis generation, or a `Scope` that swaps
+      # its index through {Scope#with_discovery}, needs a fresh one. The toplevel sentinel is excluded — a
+      # toplevel `def` has no class ancestry and so can never be an override.
+      #
+      # Bounded to TWO slots, replaced rather than accumulated. This memo is the costliest member of the
+      # per-file-store family, because it does not hold a handful of resolved answers but a whole inverted
+      # index built over a file's merged def table: an identity-keyed *store* held 135 of them over
+      # `lib`+`plugins` — 744,431 index rows, 50.0 MB in the index hashes and their owner-name arrays alone,
+      # on top of the def tables the keys pinned.
+      #
+      # Two, and not the one slot the cheaper memos in this family use, because the tables ALTERNATE.
+      # {Analysis::Runner} types each file's pre-passes under the project-seed scope and its main pass under
+      # the file's merged tables. Where a file reaches this gate from BOTH phases the request sequence is
+      # `seed, file_1, seed, file_2, …`, and a single slot evicts the seed's index once per file and
+      # rebuilds it on the next — a full scan of the seed's whole def table, every file. 200 synthetic
+      # files shaped that way measured +22.6 % allocations against the store, which a bounded slot must not
+      # cost. Two ways — a most-recently-used slot and one alternate, swapped on a hit in the alternate —
+      # cover that period-2 shape exactly: the same 200 files rebuild 201 times, matching the store.
+      #
+      # Wider rotations are not covered, and do not need to be. On `lib`+`plugins` only 6 of the 109 gating
+      # files consult the seed's table, so its uses are separated by many other files' tables and fall out
+      # of both ways: five rebuilds of a 700-entry table remain, about 4 ms. Retention is bounded at two
+      # generations either way, which is what the store failed to do.
+      #
+      # A way is `[def_nodes, singleton_def_nodes, instance_index, singleton_index]`, so it keys on BOTH def
+      # tables and a gate call that alternates instance and singleton kinds within one file does not rebuild
+      # either. Each index is still built lazily: a run that never asks a singleton question never pays for
+      # the singleton index.
+      #
+      # DELIBERATELY not keyed on the whole {Scope::DiscoveryIndex}, unlike {#class_graph_buckets} and
+      # {#override_gate_buckets} above. {#build_method_definers_index} reads the ONE table it is handed and
+      # nothing else, so the def tables are already the complete key, and the index object is a strictly
+      # narrower one: the project-seed scope carries a fresh index per file while its def tables stay the
+      # same object. Over the 200 synthetic files above, an index-keyed memo misses all 400 times where a
+      # def-table-keyed one misses 201 — it would rebuild the seed's 934-entry table once per file and hand
+      # back the +22.6 % this bound exists to avoid. Check that number before widening this key to match
+      # its siblings.
       def method_definers_index(kind)
-        table = kind == :singleton ? scope.discovered_singleton_def_nodes : scope.discovered_def_nodes
-        store = (Thread.current[METHOD_DEFINERS_INDEX_KEY] ||= {}.compare_by_identity)
-        store[table] ||= build_method_definers_index(table)
+        def_nodes = scope.discovered_def_nodes
+        singleton_def_nodes = scope.discovered_singleton_def_nodes
+        way = Thread.current[METHOD_DEFINERS_INDEX_KEY]
+        unless way && way[0].equal?(def_nodes) && way[1].equal?(singleton_def_nodes)
+          alt = Thread.current[METHOD_DEFINERS_INDEX_ALT_KEY]
+          alt = nil unless alt && alt[0].equal?(def_nodes) && alt[1].equal?(singleton_def_nodes)
+          Thread.current[METHOD_DEFINERS_INDEX_ALT_KEY] = way
+          way = alt || [def_nodes, singleton_def_nodes, nil, nil]
+          Thread.current[METHOD_DEFINERS_INDEX_KEY] = way
+        end
+        singleton = kind == :singleton
+        way[singleton ? 3 : 2] ||= build_method_definers_index(singleton ? singleton_def_nodes : def_nodes)
       end
 
       def build_method_definers_index(table)
@@ -2541,7 +2921,7 @@ module Rigor
         # below reads it back from here rather than taking a second parameter, so key and frame cannot
         # disagree). It is installed even when nil, which is what stops a blockless callee reached from
         # inside a yielding body from inheriting the outer caller's block.
-        ExpressionTyper.with_yield_value_type(yield_type) do
+        ExpressionTyper.with_call_site_frame(yield_type, forwarded_frame_types(def_node, arg_types)) do
           unless memo_candidate?(stack, plain_signature)
             trace_memo_refusal(stack, plain_signature)
             next compute_user_method_return(def_node, body_scope, stack, summaries,
@@ -2770,6 +3150,28 @@ module Rigor
         evaluate_guarded_user_method_body(def_node, body_scope, stack, signature, context)
       end
 
+      # Issue #1125 — the argument list a `def m(...)` body's `...` re-supplies, or nil for a def without the
+      # forwarding parameter (whose body cannot contain a `...` call at all) and for a call that does not even
+      # satisfy `m`'s own required positionals (that call raises at runtime; the body is not worth re-typing).
+      #
+      # Ruby allows `...` only beside leading positional parameters (`def m(a, ...)`, `def m(a = 1, ...)`) — a
+      # keyword / rest / block parameter next to it is a syntax error — so the tail is the call's own argument
+      # list MINUS the leading positionals those named parameters consume, keeping a trailing keyword shape
+      # (which `takes_keywords?` reads as the keyword tail rather than as a positional). The callee's own
+      # call-site `arg_types` are what remains.
+      def forwarded_frame_types(def_node, arg_types)
+        params = def_node.parameters
+        return nil unless params.is_a?(Prism::ParametersNode)
+        return nil unless params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+
+        positional = arg_types.dup
+        kw_shape = positional.pop if takes_keywords?(params) && positional.last.is_a?(Type::HashShape)
+        return nil if positional.size < params.requireds.size
+
+        tail = positional[(params.requireds.size + params.optionals.size)..] || []
+        kw_shape ? tail + [kw_shape] : tail
+      end
+
       # True when this frame's result is a candidate for the return memo: the one structural precondition,
       # stable across the body walk, that is necessary (but not sufficient) for a FINAL result — this plain
       # signature must not itself be on the recursion guard stack (else we are inside its own cycle,
@@ -3198,7 +3600,8 @@ module Rigor
         locals = bind_params_from_call_types(params, arg_types)
         return nil if locals.nil?
 
-        # Construct the body scope in a SINGLE allocation — the previous `Scope.empty.with_*.with_*…` chain
+        # Construct the body scope in a SINGLE Scope allocation (plus the issue #1358 frame it carries, whose
+        # scans run only on demand) — the previous `Scope.empty.with_*.with_*…` chain
         # allocated a fresh frozen Scope per field, run per user-method-call inference (ADR-44). The
         # discovery index is inherited whole by reference (ADR-53 Track A); the hand-copied per-field list
         # this replaces had silently dropped `data_member_layouts` and `discovered_method_visibilities`.
@@ -3216,7 +3619,9 @@ module Rigor
           lexical_nesting: recorded_def_nesting(def_node),
           discovery: scope.discovery,
           struct_fold_safe_locals: body_fold_safe_locals(def_node, receiver, self_fold_safe),
-          dynamic_origins: scope.dynamic_origins
+          dynamic_origins: scope.dynamic_origins,
+          # Issue #1358 — the callee runs in a frame of its own ({Scope#with_match_frame}).
+          match_frame: MatchRebinding::Frame.new(def_node.body, def_node.parameters)
         )
       end
 
@@ -3296,17 +3701,35 @@ module Rigor
         return nil if locals.nil?
 
         bind_keyword_params(params, kw_shape, locals)
-        locals[params.keyword_rest.name.to_sym] = dynamic_top if params.keyword_rest&.name
+        rest_name = keyword_rest_name(params)
+        locals[rest_name.to_sym] = keyword_rest_type(params, kw_shape) if rest_name
         locals[params.block.name.to_sym] = dynamic_top if params.block&.name
         locals
       end
 
-      # Trailing required positionals after a rest (`def f(a, *m, z)`) shift the correspondence; `...`
-      # arrives as the keyword_rest slot. Both stay declined — correspondence, not width, is the issue.
+      # Trailing required positionals after a rest (`def f(a, *m, z)`) shift the correspondence and stay
+      # declined — correspondence, not width, is the issue. Issue #1125: `def m(...)`'s forwarding slot is no
+      # longer a decline. Its NAMED parameters (a leading `def m(a, ...)` required) bind exactly as before;
+      # the forwarded tail is not a binding, so nothing is bound for it — the body's own `f(...)` reads the
+      # frame's argument list instead ({#forwarded_argument_types}).
       def bindable_param_shape?(params)
-        params.is_a?(Prism::ParametersNode) &&
-          params.posts.empty? &&
-          !params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+        params.is_a?(Prism::ParametersNode) && params.posts.empty?
+      end
+
+      # Whether the def's trailing slot is `...` rather than a named `*rest` / `**rest`. Such a def accepts
+      # an unbounded positional tail it does not name, so it behaves as a rest for the positional
+      # correspondence and binds no local.
+      def forwarding_params?(params)
+        params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+      end
+
+      # A `**rest` parameter's name, or nil when the slot is `def m(...)`'s forwarding parameter —
+      # `Prism::ForwardingParameterNode` carries no name at all.
+      def keyword_rest_name(params)
+        rest = params.keyword_rest
+        return nil unless rest.respond_to?(:name)
+
+        rest.name
       end
 
       def takes_keywords?(params)
@@ -3317,7 +3740,9 @@ module Rigor
         requireds = params.requireds
         optionals = params.optionals
         return nil if positional.size < requireds.size
-        return nil if params.rest.nil? && positional.size > requireds.size + optionals.size
+
+        extra = positional.size - requireds.size - optionals.size
+        return nil if extra.positive? && params.rest.nil? && !forwarding_params?(params)
 
         locals = {}
         requireds.each_with_index { |param, index| bind_positional_param(locals, param, positional[index]) }
@@ -3361,6 +3786,23 @@ module Rigor
         param.respond_to?(:value) && param.value ? literal_default_type(param.value) : dynamic_top
       end
 
+      # Issue #1125 — `**rest` collects the keyword-shape entries no named keyword parameter consumed, as a
+      # closed `HashShape` of their value types. The pre-#1125 `Dynamic[top]` is kept whenever there is
+      # nothing left to collect: no keyword shape at all, an open shape (unknown extras — every remaining-key
+      # answer would be a guess), or a shape whose every pair a named parameter consumed. That last case is
+      # what leaves the literal form's existing binding untouched (`target(a: 1, b: 2)` against
+      # `def target(a:, b:, **rest)` still binds `rest` to `Dynamic[top]`), while a caller that DOES leave
+      # keys over — the only shape where the parameter holds something to report — gets them typed.
+      def keyword_rest_type(params, kw_shape)
+        return dynamic_top if kw_shape.nil? || kw_shape.open?
+
+        consumed = params.keywords.map { |param| param.name.to_s.delete_suffix(":").to_sym }
+        leftovers = kw_shape.pairs.except(*consumed)
+        return dynamic_top if leftovers.empty?
+
+        Type::Combinator.hash_shape_of(leftovers)
+      end
+
       # A default expression contributes its type only when it is lexically scope-free — a scalar literal
       # or an EMPTY collection literal (`options = {}` is the dominant Rails idiom). Anything that could
       # read the def's own lexical scope binds `Dynamic` instead of being mis-typed in the caller's scope.
@@ -3405,11 +3847,60 @@ module Rigor
         scope.environment.nominal_for_name("Object") || dynamic_top
       end
 
+      # Issue #1125 — two call-site argument shapes that used to reach every consumer (the parameter
+      # binder, RBS dispatch, the block-parameter reader) as an opaque `Dynamic[top]` / bare `Nominal[Hash]`
+      # now carry what the callee needs:
+      #
+      # - `f(...)` inside `def m(...)` re-supplies the arguments `m` was called with, read from the frame
+      #   {#infer_user_method_return} installed ({FORWARDED_ARGS_KEY}) — so it expands to a whole LIST, not
+      #   one type, which is why the map became a flat_map.
+      # - a keyword hash built ENTIRELY from a double splat (`f(**h)`) is the shape of `h`, so `f(**h)`
+      #   binds the same parameters the literal form `f(a: 1, b: 2)` does.
+      #
+      # Both are precision-only. A `...` outside a forwarding frame (unreachable in valid Ruby) and a double
+      # splat of anything but a Symbol-keyed closed `HashShape` — a shapeless `Hash[Symbol, V]`, an opaque
+      # value, a mixed hash — fall back to exactly the pre-#1125 answer.
       def call_arg_types(node)
         arguments_node = node.arguments
         return [] if arguments_node.nil?
 
-        arguments_node.arguments.map { |argument| type_of(argument) }
+        arguments_node.arguments.flat_map do |argument|
+          forwarded_argument_types(argument) || [call_arg_type(argument)]
+        end
+      end
+
+      # The frame's argument list when `argument` is `...`, else nil so the caller types it normally.
+      def forwarded_argument_types(argument)
+        return nil unless argument.is_a?(Prism::ForwardingArgumentsNode)
+
+        ExpressionTyper.current_forwarded_arg_types
+      end
+
+      # The type a single call argument contributes; a keyword-hash argument first offers the `HashShape` it
+      # stands for, and otherwise keeps its own type.
+      def call_arg_type(argument)
+        return type_of(argument) unless argument.is_a?(Prism::KeywordHashNode)
+
+        double_splat_hash_shape(argument) || type_of(argument)
+      end
+
+      # The `HashShape` a `f(**h)` keyword-hash argument stands for, or nil to keep the argument's own type.
+      # Declines a MIXED hash (`f(a: 1, **h)` — merging the literal pairs with the splatted shape is a second
+      # shape algebra this slice does not need), an OPEN shape (unknown extras make every missing-keyword
+      # answer a guess rather than a read), a shape with a non-Symbol key (Ruby itself rejects those as
+      # keywords), and a splat of anything that is not a shape at all.
+      def double_splat_hash_shape(node)
+        elements = node.elements
+        return nil unless elements.size == 1
+
+        splat = elements.first
+        return nil unless splat.is_a?(Prism::AssocSplatNode) && splat.value
+
+        type = type_of(splat.value)
+        return nil unless type.is_a?(Type::HashShape)
+        return nil unless type.closed? && type.pairs.each_key.all?(Symbol)
+
+        type
       end
 
       # When the call carries a `Prism::BlockNode`, build the block's entry scope (outer locals plus
@@ -3431,23 +3922,44 @@ module Rigor
         return nil if block_arg.nil?
         return nil if receiver_type.nil?
 
+        rebound = rebound_operand_typer(call_node)
+        return rebound.send(:block_return_type_for, call_node, receiver_type, arg_types) if rebound
+
         expected = MethodDispatcher.expected_block_param_types(
           receiver_type: receiver_type,
           method_name: call_node.name,
           arg_types: arg_types,
-          environment: scope.environment
+          environment: scope.environment,
+          scope: scope
         )
-        # ADR-16 Tier A: when a registered plugin's `block_as_methods` entry matches `(receiver_type,
-        # call_node.name)`, narrow the block body's `self_type` to the receiver class's instance type. The
-        # narrowing is `nil` for unmatched calls, leaving the existing scope contract unchanged.
-        narrowed_self = MacroBlockSelfType.narrow_self_type_for(
-          scope: scope, call_node: call_node, receiver_type: receiver_type
+        block_return_for(
+          block_arg, expected,
+          call_node: call_node,
+          narrowed_self_type: block_body_self_narrowing(call_node, receiver_type),
+          repeats: !BLOCK_VALUE_DISCARDING.include?(call_node.name) && block_may_repeat?(call_node, receiver_type)
         )
-        block_return_for(block_arg, expected, narrowed_self_type: narrowed_self)
       rescue StandardError
         nil
       end
 
+      # The catalogued iterators that discard their block's value — it selects the block-bearing overload and
+      # nothing more — so the value pass lays no captured binding under their block: the fixpoint would buy a
+      # type nothing reads, and `sum = 0; xs.each { |x| sum += x }` would pay it on top of the ADR-56
+      # write-back's own. The #853 break-arm scan still lays it, since a `break` value is the call's.
+      BLOCK_VALUE_DISCARDING = Set[
+        :each, :each_with_index, :each_with_object, :each_pair, :each_key, :each_value, :each_index,
+        :reverse_each, :each_entry, :each_slice, :each_cons, :each_char, :each_byte, :each_line,
+        :each_codepoint, :times, :upto, :downto, :step
+      ].freeze
+      private_constant :BLOCK_VALUE_DISCARDING
+
+      # Whether the call may run its block more than once, so a later run reads a captured binding an earlier
+      # run rebound — the premise of laying the #587 (b) binding ({#captured_block_bindings}) under the block.
+      # {BlockRepetition.may_repeat?} holds the rule, which the statement pass shares (issue #1412).
+      def block_may_repeat?(call_node, receiver_type)
+        BlockRepetition.may_repeat?(method_name: call_node.name, receiver_type: receiver_type, scope: scope)
+      end
+
       EMPTY_BREAK_ARMS = [].freeze
       private_constant :EMPTY_BREAK_ARMS
 
@@ -3459,13 +3971,15 @@ module Rigor
       # nested block, lambda, `def`, or loop targets THAT construct instead; {JUMP_BOUNDARY_NODES} stops the
       # scan there, and the identity filter drops the ones the sink still collects because the nested
       # construct is walked under the same installation. `break` with no argument carries nil, so the call
-      # becomes optional — which is what Ruby does.
+      # becomes optional — which is what Ruby does. A call that only stores its block ({StoredBlockCall}: `lambda`,
+      # `define_method`, `Thread.new`, …) never runs it, so no arm of that block is the call's value.
       #
       # A failure yields no arms rather than propagating, matching {#block_return_type_for}: a call typed
       # without its break arms is the pre-#853 answer, while a raise here would take out the whole call.
       def call_break_arm_types(node, receiver_override: nil)
         block_node = node.block
         return EMPTY_BREAK_ARMS unless block_node.is_a?(Prism::BlockNode)
+        return EMPTY_BREAK_ARMS if StoredBlockCall.stores_block?(node)
 
         body = block_node.body
         return EMPTY_BREAK_ARMS if body.nil? || !block_level_jump?(body, Prism::BreakNode)
@@ -3484,11 +3998,12 @@ module Rigor
         receiver = receiver_override || call_receiver_type_for(call_node)
         return EMPTY_BREAK_ARMS if receiver.nil?
 
-        narrowed_self = MacroBlockSelfType.narrow_self_type_for(
-          scope: scope, call_node: call_node, receiver_type: receiver
-        )
+        param_types = break_arm_param_types(call_node, receiver)
         block_scope = block_entry_scope(
-          block_node, break_arm_param_types(call_node, receiver), narrowed_self_type: narrowed_self
+          block_node, param_types,
+          call_node: call_node,
+          narrowed_self_type: block_body_self_narrowing(call_node, receiver),
+          captured: repeating_captured_bindings(block_node, param_types, block_may_repeat?(call_node, receiver))
         )
         _result, collected = StatementEvaluator.with_break_value_sink do
           without_block_body_threading { block_scope.evaluate(body) }
@@ -3496,39 +4011,78 @@ module Rigor
         collected.filter_map { |jump, type| type if targets.key?(jump) }
       end
 
+      # The block body's narrowed `self_type`, or `nil` to leave the scope contract unchanged.
+      #
+      # ADR-16 Tier A: a registered plugin's `block_as_methods` entry matching `(receiver_type,
+      # call_node.name)` narrows to the receiver class's instance type.
+      #
+      # Issue #963: `define_method(:name) { ... }` installs its block as an instance method and runs it with
+      # `self` bound to the receiving instance, so the block body's `self` is the INSTANCE side of a class body's
+      # `Singleton[X]`. Both block-entry paths narrow it, and both decline on the same `class << ...` bodies,
+      # because the whole distinction rides on `Scope#singleton_class_body?` rather than on the statement
+      # evaluator's frame stack. This pass therefore cannot compute a carrier the evaluator disagrees with — it
+      # matters wherever the block's value is observable, e.g. a project-declared generic `define_method`
+      # signature that returns the block's own type.
+      def block_body_self_narrowing(call_node, receiver_type)
+        MacroBlockSelfType.narrow_self_type_for(
+          scope: scope, call_node: call_node, receiver_type: receiver_type
+        ) || DefineMethodBlockSelf.narrow_self_type_for(scope: scope, call_node: call_node)
+      end
+
       def break_arm_param_types(call_node, receiver)
         MethodDispatcher.expected_block_param_types(
           receiver_type: receiver,
           method_name: call_node.name,
           arg_types: call_arg_types(call_node),
-          environment: scope.environment
+          environment: scope.environment,
+          scope: scope
         )
       end
 
-      def block_return_for(block_arg, expected, narrowed_self_type: nil)
+      def block_return_for(block_arg, expected, call_node: nil, narrowed_self_type: nil, repeats: false)
         case block_arg
         when Prism::BlockNode
-          type_block_body(block_arg, block_entry_scope(block_arg, expected, narrowed_self_type: narrowed_self_type))
+          captured = repeating_captured_bindings(block_arg, expected, repeats)
+          entry = block_entry_scope(
+            block_arg, expected, call_node: call_node, narrowed_self_type: narrowed_self_type, captured: captured
+          )
+          type_block_body(block_arg, entry, captured: captured)
         when Prism::BlockArgumentNode
           symbol_block_return_type(block_arg, expected)
         end
       end
 
       # The scope a block body is typed under: the surrounding scope plus the parameter bindings the receiving
-      # method's signature implies.
+      # method's signature implies, with the #587 (b) `captured` binding ({#repeating_captured_bindings}) laid
+      # between the two, so the body reads what a captured local, instance variable, class variable or global
+      # holds on ANY run rather than the first.
       #
       # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
-      # yielding method's business, so the return-typing pass must see the same unmodelled-self mark.
-      def block_entry_scope(block_node, expected, narrowed_self_type: nil)
-        bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_node)
-        block_scope = bindings.reduce(scope.entering_opaque_block) do |acc, (name, type)|
-          acc.with_local(name, type)
-        end
+      # yielding method's business, so the return-typing pass must see the same unmodelled-self mark. Issue #1358
+      # — and the same match-global view ({MatchRebinding.block_entry}), which reads the owning `call_node`.
+      def block_entry_scope(block_node, expected, call_node: nil, narrowed_self_type: nil, captured: nil)
+        entry = MatchRebinding.block_entry(scope.entering_opaque_block, block_node, call_node)
+        entry = captured.lay(entry) if captured
+        block_scope = BlockParameterBinder.new(expected_param_types: expected).bind_onto(block_node, entry)
         return block_scope unless narrowed_self_type
 
         block_scope.with_self_type(narrowed_self_type)
       end
 
+      # The #587 (b) captured binding when the call may run the block more than once ({#block_may_repeat?}), and
+      # nil — no binding — for a block it runs at most once, whose captures no earlier run can have moved.
+      def repeating_captured_bindings(block_node, expected, repeats)
+        repeats ? generic_captured_bindings(block_node, expected) : nil
+      end
+
+      # The #587 (b) captured binding for the generic pass — or nil, which keeps the entry scope, when computing
+      # it fails: a raise here would otherwise take out the whole block-return pass.
+      def generic_captured_bindings(block_node, expected)
+        captured_block_bindings(block_node, expected)
+      rescue StandardError
+        nil
+      end
+
       # `&:symbol` desugars to a one-arg Proc that dispatches `symbol` against its argument. When the param
       # type is known and the resulting inner dispatch is precise, this returns the precise carrier;
       # otherwise it returns `Dynamic[Top]` (still non-nil) so the outer dispatcher selects the
@@ -3568,14 +4122,114 @@ module Rigor
       # join, `ops.all? { |o| next false unless o; true }` read as `Constant[true]` and
       # {MethodDispatcher::BlockFolding} folded the call to always-truthy on a program that really can answer
       # false — a warning on correct code.
-      def type_block_body(block_node, block_scope)
+      #
+      # `captured` is the #587 (b) binding `block_scope` was laid over, if any; the names it answers are left to it
+      # ({#tail_only_block_body_type}).
+      def type_block_body(block_node, block_scope, captured: nil)
         body = block_node.body
         return Type::Combinator.constant_of(nil) if body.nil?
 
         arms = block_level_next_arms(body)
         return block_body_type_joining_nexts(body, block_scope, arms) if arms
 
-        threaded_block_body_type(body, block_scope) || block_scope.type_of(body)
+        threaded_block_body_type(body, block_scope) || tail_only_block_body_type(body, block_scope, captured)
+      end
+
+      # The tail typed in the entry scope — except under {#block_body_threading_suppressed?}, where a tail that
+      # reads what its own prefix changed would get the ENTRY binding back, a stale answer rather than a wider
+      # one. There the tail is typed over {#prefix_answered_scope}, which re-answers exactly those names without
+      # evaluating the prefix. The threading's other declines keep the plain tail-only answer: a body with no
+      # prefix, or whose tail ignores it, is not stale, while a `rescue` body and a prefix that can `break`
+      # ({JUMP_NODES}) are typed tail-only with or without the suppression, and neither path re-answers them.
+      #
+      # A failure in the re-answer falls back to the plain tail-only answer, for the reason
+      # {#threaded_block_body_type} gives: a raise reaching `block_return_type_for` would report "no block".
+      def tail_only_block_body_type(body, block_scope, captured)
+        return block_scope.type_of(body) unless block_body_threading_suppressed? && body.is_a?(Prism::StatementsNode)
+
+        answered =
+          begin
+            prefix_answered_scope(body.body, block_scope, captured)
+          rescue StandardError
+            block_scope
+          end
+        answered.type_of(body)
+      end
+
+      # `block_scope` with every name the tail reads and the prefix changed ({#tail_dependent_body_names}) bound to
+      # what the prefix can have left in it, answered without evaluating the prefix — which is the cost the
+      # suppression refuses — on the terms the per-element fold's captured binding answers a capture under the same
+      # suppression:
+      #
+      # - a name the prefix REBINDS reads `Dynamic[top]` ({#captured_floor}'s answer). `i += w; i` inside a block
+      #   the call runs once read `i` at its entry `0`, and `k == 0` then fired always-truthy on a `k` Ruby holds
+      #   as `1`.
+      # - a name the prefix only MUTATES IN PLACE reads its unknown-store widening ({UnknownStoreWidening.widen}),
+      #   the binding {#stored_capture_bindings} lays: `|_k, a| a << w; a` over `{ x: [], y: [] }` read `a` as its
+      #   entry `[]` and the call as `Array[[]]`; it now reads `Array[Array[Dynamic[top]]]`.
+      #
+      # That is a floor per NAME, not per block, so the structure around a floored name survives (`e = e.to_s; [e, w]`
+      # keeps its Tuple), and it is limited to the names tail-only answers stale. A name the entry scope does not bind —
+      # a body-local, or an instance variable, class variable or global nothing bound yet — already reads
+      # `Dynamic[top]`. An instance variable on its ADR-58 class-wide seed takes no floor for a rebind, since the seed
+      # is the union of every write in the class, this prefix's included, though its mutation sites still widen it
+      # ({#class_seeded_ivar?}). A name whose widening declines keeps its entry binding, because the threaded body
+      # would have kept it as well: `s = String.new; … { s << "x"; s }` is `String` either way, and a precise nominal
+      # `Array[String]` is a claim the widening may not grow on either path. And a name the #587 (b) `captured` binding
+      # answers is left to it, as {#unanswered_tail_dependency?} leaves it: the per-element fold computes that binding
+      # before it suppresses the threading above its cap, so it can hold the fixpoint's converged `Integer` for
+      # `total += e; total`, which a floor here would throw away.
+      def prefix_answered_scope(statements, block_scope, captured)
+        return block_scope if statements.size < 2
+
+        names = tail_dependent_body_names(statements) - (captured&.names || EMPTY_NAME_SET)
+        return block_scope if names.empty?
+
+        rebound, sites = prefix_changes(statements)
+        names.reduce(block_scope) do |acc, name|
+          answer = prefix_left_binding(block_scope, name, rebound, sites)
+          answer ? CapturedLocals.bind(acc, name, answer) : acc
+        end
+      end
+
+      def prefix_left_binding(block_scope, name, rebound, sites)
+        entry = CapturedLocals.bound_type(block_scope, name)
+        return nil if entry.nil?
+
+        return Type::Combinator.untyped if rebound.include?(name) && !class_seeded_ivar?(block_scope, name)
+
+        widened = UnknownStoreWidening.widen(entry, sites.fetch(name, NO_MUTATION_SITES))
+        widened == entry ? nil : widened
+      end
+
+      # An instance variable still on its ADR-58 class-wide seed: the union of every WRITE in the class, so a rebind
+      # in the prefix is already in it and needs no floor. An in-place mutation is no write — `@out << w.to_s` leaves
+      # the seed `"k"` while the object holds `"k1"` — so the mutation sites still widen the seed, as they widen any
+      # other entry binding.
+      def class_seeded_ivar?(block_scope, name)
+        CapturedLocals.ivar_name?(name) && block_scope.declaration_sourced?(:ivar, name)
+      end
+
+      NO_MUTATION_SITES = [].freeze
+      private_constant :NO_MUTATION_SITES
+
+      # The prefix's changes split the way {#prefix_left_binding} answers them: the names a write node rebinds,
+      # and each in-place mutation site filed under every variable its receiver can evaluate to. The walk and both
+      # predicates are {#prefix_statement_jump_free?}'s, so a name {#tail_dependent_body_names} reports is always
+      # filed here under one of the two. Only a suppressed tail-only body with a dependent tail pays it.
+      def prefix_changes(statements)
+        rebound = Set.new
+        sites = {}
+        statements[0...-1].each do |statement|
+          Source::NodeWalker.each_with_ancestors(statement) do |node, ancestors|
+            rebound << node.name if VARIABLE_WRITE_NODES.include?(node.class)
+            next unless in_place_mutation?(node)
+
+            nested = ancestors.any? { |ancestor| CLOSURE_NODES.include?(ancestor.class) }
+            each_mutated_name(node, nested) { |name| (sites[name] ||= []) << node }
+          end
+        end
+        [rebound, sites]
       end
 
       # Evaluates the body once under a `next` sink and joins the arms that leave THIS block with the
@@ -3616,39 +4270,14 @@ module Rigor
         block_level_jump_nodes(body, Prism::NextNode)
       end
 
-      # True when a `klass` jump is reachable from `node` without crossing a construct that retargets it.
-      # Allocation-free and early-exiting: this is the scan every block body pays, and the overwhelming
-      # majority of them answer false on it.
-      def block_level_jump?(node, klass)
-        return false if node.nil?
-        return true if node.is_a?(klass)
-
-        node.rigor_each_child do |child|
-          next if JUMP_BOUNDARY_NODES.include?(child.class)
-
-          return true if block_level_jump?(child, klass)
-        end
-        false
-      end
-
-      # The identity-keyed set of `klass` jumps that target THIS block — every one {#block_level_jump?} would
-      # answer true for, rather than the first. The sinks in `StatementEvaluator` also collect jumps from
-      # nested blocks / loops / defs evaluated under the same installation, so the consumer filters against
-      # this set by node identity.
-      def block_level_jump_nodes(body, klass)
-        found = {}.compare_by_identity
-        collect_block_level_jumps(body, klass, found)
-        found
-      end
-
-      def collect_block_level_jumps(node, klass, found)
-        found[node] = true if node.is_a?(klass)
-        node.rigor_each_child do |child|
-          next if JUMP_BOUNDARY_NODES.include?(child.class)
+      # True when a `klass` jump is reachable from `node` without crossing a construct that retargets it
+      # ({JumpTargets.any?}, allocation-free and early-exiting: this is the scan every block body pays).
+      def block_level_jump?(node, klass) = JumpTargets.any?(node, klass)
 
-          collect_block_level_jumps(child, klass, found)
-        end
-      end
+      # The identity-keyed set of `klass` jumps that target THIS block ({JumpTargets.of}). The sinks in
+      # `StatementEvaluator` also collect jumps from nested blocks / loops / defs evaluated under the same
+      # installation, so the consumer filters against this set by node identity.
+      def block_level_jump_nodes(body, klass) = JumpTargets.of(body, klass)
 
       # Re-typing the whole body would be wrong to do unconditionally: this path runs for EVERY block-bearing
       # call, and the statements ahead of the tail are pure cost whenever the tail does not depend on them.
@@ -3663,8 +4292,11 @@ module Rigor
       # - the fold is not re-entrant. `StatementEvaluator#eval_call` already evaluates each nested block body
       #   once, plus up to three more times under the ADR-56 `BodyFixpoint` when the block rebinds a captured
       #   local, so a fold nested inside a fold would multiply that work per block-nesting level. Inside a
-      #   threaded body a nested block-bearing call reverts to the tail-only path — a wider answer in a rare
-      #   shape, never a new false positive.
+      #   threaded body a nested block-bearing call reverts to the tail-only path. That is a wider answer only
+      #   while the nested tail ignores its own prefix: a tail reading a parameter or captured local the prefix
+      #   mutated gets the ENTRY binding back, so the per-element and per-pair folds floor that shape
+      #   ({#tail_only_body_floor}), and the generic block-return pass re-answers each stale name on its own
+      #   ({#prefix_answered_scope}).
       #
       # ADR-56 interaction: the fold cannot double-apply or fight the captured-local write-back. That
       # write-back is `StatementEvaluator#write_back_block_captures`, computed from the CALLER's scope into
@@ -3728,10 +4360,11 @@ module Rigor
       private_constant :VARIABLE_WRITE_NODES
 
       # Every node that OBSERVES a variable binding: the plain reads plus the compound writes, which read
-      # their target before rebinding it (`v += 1` in the tail depends on an earlier `v = 0`).
+      # their target before rebinding it (`v += 1` in the tail depends on an earlier `v = 0`). An `it` read
+      # observes the local `:it` ({ReceiverAlias.read_name}); it has no `name` of its own.
       VARIABLE_READ_NODES = (
         VARIABLE_WRITE_NODES | [
-          Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode,
+          Prism::LocalVariableReadNode, Prism::ItLocalVariableReadNode, Prism::InstanceVariableReadNode,
           Prism::ClassVariableReadNode, Prism::GlobalVariableReadNode
         ]
       ).freeze
@@ -3758,11 +4391,9 @@ module Rigor
       # nothing about our block's value — it neither triggers the decline nor joins as an arm. A nested
       # `BlockNode` / `LambdaNode` is the jump's own block (`do xs.each { next 1 }; v = 42; v end` threads
       # soundly — the inner `next` ends the inner iteration); a loop consumes both forms (`while … next 5 …
-      # end` continues the loop); a `DefNode` body is a different method entirely.
-      JUMP_BOUNDARY_NODES = Set[
-        Prism::BlockNode, Prism::LambdaNode, Prism::DefNode,
-        Prism::WhileNode, Prism::UntilNode, Prism::ForNode
-      ].freeze
+      # end` continues the loop); a `DefNode` body is a different method entirely. The set is
+      # {JumpTargets::BOUNDARY_NODES}, shared with `StatementEvaluator`'s loop and block joins.
+      JUMP_BOUNDARY_NODES = JumpTargets::BOUNDARY_NODES
       private_constant :JUMP_BOUNDARY_NODES
 
       # True when the tail statement observes a variable name one of the earlier statements binds OR mutates
@@ -3777,9 +4408,13 @@ module Rigor
       # hands downstream rules a provably-empty array. Threading is the fix, not a cost: `StatementEvaluator`
       # runs `MutationWidening.widen_after_call` on the `push`, so the threaded tail reads the widened
       # `Array[…]`. A call therefore contributes every variable its receiver can evaluate to
-      # ({ReceiverAlias.candidates} — the ternary-selected receiver of issue #277 included) whenever its name
-      # is one the widening responds to ({MutationWidening::SHAPE_MUTATORS}); keying on the widening's own
-      # tables is what keeps "the scan says thread" and "threading changes something" the same predicate.
+      # ({ReceiverAlias.mutated_reads} — the ternary-selected receiver of issue #277 included) whenever its
+      # name is one the widening responds to ({MutationWidening::SHAPE_MUTATORS}); keying on the widening's own
+      # tables and receiver answer is what keeps "the scan says thread" and "threading changes something" the
+      # same predicate. The index-write nodes ({INDEX_WRITE_NODES}) store through `[]=` without being a call,
+      # so a name-keyed scan missed them and `h[:a] += 1; h[:a]` kept the literal's `0`; they contribute their
+      # receiver the same way. A scan that read only local and instance-variable receivers missed `$g << w; $g`
+      # and `it << w; it` the same way, while the tail kept the entry `"k"` / `[]`.
       #
       # Cost is two walks of the body, the second only when the first found a write and no jump — the same
       # order of cost `StatementEvaluator`'s own per-call captured-write scan already pays, and far below
@@ -3792,22 +4427,25 @@ module Rigor
         return false if written.nil?
 
         Source::NodeWalker.each(statements.last) do |node|
-          return true if VARIABLE_READ_NODES.include?(node.class) && written.include?(node.name)
+          return true if VARIABLE_READ_NODES.include?(node.class) && written.include?(ReceiverAlias.read_name(node))
         end
         false
       end
 
       # WHICH names the predicate above answers YES on — every name the tail observes that the prefix binds
-      # or mutates in place. Only the arity-cap floor ({#unanswered_tail_dependency?}) needs them, which is
+      # or mutates in place. Only the tail-only floor ({#unanswered_tail_dependency?}) needs them, which is
       # why the predicate is not written over this method: the predicate runs for every multi-statement block
-      # body and short-circuits on the first hit, the floor runs for a handful of calls. Sharing
+      # body and short-circuits on the first hit, the floor runs only for a walk typed tail-only. Sharing
       # {#prefix_written_names} is what keeps the two from drifting about what the prefix binds.
       def tail_dependent_body_names(statements)
         written = prefix_written_names(statements)
         return EMPTY_NAME_SET if written.nil?
 
         Source::NodeWalker.each(statements.last).filter_map do |node|
-          node.name if VARIABLE_READ_NODES.include?(node.class) && written.include?(node.name)
+          next unless VARIABLE_READ_NODES.include?(node.class)
+
+          name = ReceiverAlias.read_name(node)
+          name if written.include?(name)
         end.to_set
       end
 
@@ -3816,7 +4454,7 @@ module Rigor
       def prefix_written_names(statements)
         written = Set.new
         statements[0...-1].each do |statement|
-          return nil unless prefix_statement_jump_free?(statement, written, false)
+          return nil unless prefix_statement_jump_free?(statement, written, false, false)
         end
         return nil if written.empty?
 
@@ -3827,40 +4465,73 @@ module Rigor
       private_constant :EMPTY_NAME_SET
 
       # True when `node` cannot jump out of the block with a value, collecting into `written` the names it
-      # binds (a variable-write node) or mutates in place (a {MutationWidening::SHAPE_MUTATORS} call, through
-      # every variable its receiver can evaluate to) on the way down. `retargeted` is true once the descent
-      # has passed a boundary.
+      # binds (a variable-write node) or mutates in place (a {MutationWidening::SHAPE_MUTATORS} call or an
+      # {INDEX_WRITE_NODES} store, through every variable its receiver can evaluate to) on the way down.
+      # `retargeted` is true once the descent has passed a boundary, and `nested` once it has passed a block or
+      # lambda ({CLOSURE_NODES}), whose `it` is not the body's.
       #
       # A `Prism::DefinedNode`'s operand is never evaluated, so it is not descended into — the same rule
       # {Source::NodeWalker} applies, for the same reason: neither a write nor a jump under `defined?` runs.
-      def prefix_statement_jump_free?(node, written, retargeted)
+      def prefix_statement_jump_free?(node, written, retargeted, nested)
         return false if !retargeted && JUMP_NODES.include?(node.class)
 
         written << node.name if VARIABLE_WRITE_NODES.include?(node.class)
-        collect_mutated_receivers(node, written) if node.is_a?(Prism::CallNode)
+        each_mutated_name(node, nested) { |name| written << name } if in_place_mutation?(node)
         return true if node.is_a?(Prism::DefinedNode)
 
         child_retargeted = retargeted || JUMP_BOUNDARY_NODES.include?(node.class)
+        child_nested = nested || CLOSURE_NODES.include?(node.class)
         node.rigor_each_child do |child|
-          return false unless prefix_statement_jump_free?(child, written, child_retargeted)
+          return false unless prefix_statement_jump_free?(child, written, child_retargeted, child_nested)
         end
         true
       end
 
-      def collect_mutated_receivers(call_node, written)
-        return unless MutationWidening::SHAPE_MUTATORS.include?(call_node.name)
+      # The forms that store through `[]=` without being a `[]=` call ({IndexWriteWidening::CONTENT_WRITE_NODE_CLASSES}).
+      # `StatementEvaluator` widens the three compound writes in straight-line code, and its captured-local
+      # write-back widens all four when a nested block stores through one. A straight-line index TARGET widens
+      # too, at the multi-assign, `for` index or `rescue =>` reference that owns it (`eval_multi_write`,
+      # `bind_for_index`, `bind_rescue_reference`).
+      INDEX_WRITE_NODES = Set.new(IndexWriteWidening::CONTENT_WRITE_NODE_CLASSES).freeze
+      private_constant :INDEX_WRITE_NODES
+
+      def in_place_mutation?(node)
+        return MutationWidening::SHAPE_MUTATORS.include?(node.name) if node.is_a?(Prism::CallNode)
+
+        INDEX_WRITE_NODES.include?(node.class)
+      end
+
+      # Yields the name of every variable the in-place mutation `node` changes: its receiver's
+      # {ReceiverAlias.mutated_reads}, the answer the straight-line widening the threaded body runs reads too, so a
+      # global or class variable counts (`$g << w; $g`) as well as a local, an instance variable and the `it`
+      # parameter. An `it` read `nested` under a block or lambda inside the prefix is that closure's own parameter,
+      # never the body's `it`, so it names nothing here: `[[]].each { it << w }; it` leaves the body's `it` as it was.
+      def each_mutated_name(node, nested)
+        ReceiverAlias.mutated_reads(node.receiver).each do |read|
+          next if nested && read.is_a?(Prism::ItLocalVariableReadNode)
 
-        ReceiverAlias.candidates(call_node.receiver).each { |read| written << read.name }
+          yield ReceiverAlias.read_name(read)
+        end
       end
 
+      # The closures whose `it` is their own: a nested block or lambda always binds `it` to its own parameter.
+      CLOSURE_NODES = Set[Prism::BlockNode, Prism::LambdaNode].freeze
+      private_constant :CLOSURE_NODES
+
       # v0.0.6 phase 2 — per-element block fold for Tuple receivers under `:map` / `:collect`. Walks every
       # Tuple position, binds the block parameter to that element's type, and re-types the block body. The
       # per-position results are assembled into `Tuple[U_1..U_n]`, strictly tighter than the RBS-projected
       # `Array[union]`.
       #
       # Declines (returns nil) when the receiver is not a `Tuple` with at least one element, when the call
-      # has no `Prism::BlockNode`, when the method is outside the supported set, when block typing raises
-      # mid-loop, or when the block has no body. The decline path leaves the dispatch chain untouched.
+      # has no `Prism::BlockNode`, when the method is outside the supported set, when the call carries an
+      # argument, when block typing raises mid-loop, or when the block has no body. The decline path leaves the
+      # dispatch chain untouched.
+      #
+      # The walk reads only the block, so an argument declines: `index(value)` / `find_index(value)` search by
+      # `==` without running the block, and `find(ifnone)` / `detect(ifnone)` answer `ifnone.call` when no
+      # position matches. `r = [1, 2].find(-> { 0 }) { |e| e > 5 }` is `0` at runtime; the walk answered `nil`,
+      # and `r + 1` then reported a nil receiver on correct code. The other supported methods take no argument.
       PER_ELEMENT_TUPLE_METHODS = Set[
         :map, :collect, :filter_map, :flat_map,
         :select, :filter, :reject,
@@ -3874,6 +4545,9 @@ module Rigor
       ].freeze
       private_constant :HASH_SHAPE_TRANSFORM_METHODS
 
+      IN_PLACE_HASH_SHAPE_TRANSFORMS = Set[:transform_keys!, :transform_values!].freeze
+      private_constant :IN_PLACE_HASH_SHAPE_TRANSFORMS
+
       # Cardinality cap for per-element block fold over finite-bound `Constant<Range>` receivers. Walking
       # `(1..1_000_000).map { … }` element-wise would balloon block-typing cost and explode the resulting
       # Tuple, so only short ranges expand into per-position folds. Larger ranges decline so the RBS tier
@@ -3883,7 +4557,7 @@ module Rigor
 
       def try_per_element_block_fold(call_node, receiver_type)
         return nil unless PER_ELEMENT_TUPLE_METHODS.include?(call_node.name)
-        return nil if find_family_with_args?(call_node)
+        return nil unless call_node.arguments.nil?
 
         element_types = per_element_elements_of(receiver_type)
         return nil if element_types.nil? || element_types.empty?
@@ -3892,12 +4566,13 @@ module Rigor
         return nil if per_position.nil? || per_position.any?(&:nil?)
 
         assemble_per_element_result(call_node.name, per_position, element_types) ||
-          find_family_floor(call_node.name, element_types)
+          undecided_fold_floor(call_node.name, element_types, receiver_type)
       end
 
-      # The honest answer for `find` / `detect` / `find_index` / `index` when this fold walked every position
-      # and the assembler still could not decide — which happens for exactly one reason: some position's
-      # predicate is not a `Constant`, so "the first matching one" is not a static fact.
+      # The honest answer for the find family (`find` / `detect` / `find_index` / `index`) and the filter family
+      # (`select` / `filter` / `reject`) when this fold walked every position and the assembler still could not
+      # decide — which happens for exactly one reason: some position's predicate is not a `Constant`, so "the
+      # first matching one" or "the ones kept" is not a static fact.
       #
       # Falling through to the dispatcher was WRONG for this family, and issue #617 residue (1) is the bill:
       # `seen = 0; [1, 2].find do |e| seen += 1; seen == 2 end` answered `nil` where the runtime answers `2`.
@@ -3912,19 +4587,39 @@ module Rigor
       # back an element, it does not compute one. `find_index` / `index` answer a position in the receiver, so
       # `Integer?` is their floor.
       #
-      # Nothing else in {PER_ELEMENT_TUPLE_METHODS} takes a floor: `map`'s assembler cannot decline,
-      # and `select` / `reject` / `filter_map` / `flat_map` fall through to an RBS projection that is merely
-      # wider, never wrong — `BlockFolding`'s filter folds decline on a non-Constant block instead of
-      # answering.
-      def find_family_floor(method_name, element_types)
+      # `select` / `filter` / `reject` take a floor for the same reason. Their fall-through is not merely
+      # wider: `BlockFolding`'s filter folds DO answer on a `Constant` block, and the entry-scope pin hands
+      # them one, so `seen = 0; [1, 2].select do |e| seen += 1; seen == 2 end` answered a provably-empty `[]`
+      # where Ruby answers `[2]`. Nested inside a threaded body, where a position can be typed tail-only
+      # ({#tail_only_body_floor}), `[[], []].select do |a| a << w; a.any? end` did the same. Their floor is an
+      # Array of the receiver's own elements: which of them survive is undecided, and what they are is not.
+      # A range receiver's elements are widened first ({#filter_family_floor}).
+      #
+      # Nothing else in {PER_ELEMENT_TUPLE_METHODS} takes a floor. `map`'s assembler cannot decline, and
+      # `BlockFolding` never folds `filter_map` / `flat_map`, so their fall-through is the RBS `Array[U]`
+      # projection.
+      def undecided_fold_floor(method_name, element_types, receiver_type)
         case method_name
         when :find, :detect
           Type::Combinator.union(*element_types, Type::Combinator.constant_of(nil))
+        when :select, :filter, :reject
+          filter_family_floor(element_types, receiver_type)
         when :find_index, :index
           Type::Combinator.union(Type::Combinator.nominal_of("Integer"), Type::Combinator.constant_of(nil))
         end
       end
 
+      # A `Constant<Range>` receiver's elements are values this walk enumerated, not ones the program wrote, and
+      # the RBS answer the floor replaces carried no pin. Kept, the pins would make `(1..4).filter { … }` an
+      # `Array[1 | 2 | 3 | 4]` that a later `q << 9` cannot widen (#580 leaves a precise Array without a
+      # gradual arm alone), so `q.last == 9` would fold always-falsey on correct code. A Tuple receiver's pins
+      # are the literal's own and stay, as the RBS projection kept them.
+      def filter_family_floor(element_types, receiver_type)
+        element = Type::Combinator.union(*element_types)
+        element = Type::Combinator.widen_value_pinned(element) if receiver_type.is_a?(Type::Constant)
+        Type::Combinator.nominal_of("Array", type_args: [element])
+      end
+
       # Evaluates the call's block once per receiver element. Two block shapes are supported:
       #
       # - `Prism::BlockNode` — a full `do … end` / `{ … }` block; the body is re-typed per position with the
@@ -3957,49 +4652,84 @@ module Rigor
       def per_element_body_results(block, element_types)
         captured = per_element_captured_bindings(block, element_types)
         results = lambda do
-          element_types.map { |element_type| type_block_body_with_param(block, [element_type], captured: captured) }
+          element_types.each_with_index.map do |element_type, position|
+            type_block_body_with_param(block, [element_type], captured: captured, position: position)
+          end
         end
-        return results.call if element_types.size <= PER_ELEMENT_THREADING_LIMIT
-        return uncapped_body_floor(element_types) if unanswered_tail_dependency?(block, captured)
+        return results.call unless tail_only_walk?(element_types)
+        return tail_only_body_floor(element_types) if unanswered_tail_dependency?(block, captured)
 
         without_block_body_threading(&results)
       end
 
-      # Above {PER_ELEMENT_THREADING_LIMIT} the threading is suppressed, and a position is typed tail-only.
-      # For a tail that reads what the body's own prefix wrote or mutated, tail-only is not a wider answer —
-      # it is the ENTRY binding, which the prefix has already falsified.
+      # A position is typed tail-only in two cases: above {PER_ELEMENT_THREADING_LIMIT}, where this walk
+      # suppresses the threading itself, and anywhere the walk runs nested inside a body some other pass is
+      # already evaluating whole. {#threaded_block_body_type}, the `next` join
+      # ({#block_body_type_joining_nexts}), the break-arm collection ({#collect_break_arm_types}), the
+      # captured-local fixpoint ({#captured_exit_bindings}) and an enclosing walk of this fold above the cap
+      # all suppress the threading while they run, so a fold never re-enters. The second case has no arity in
+      # it: `[[], []].map do |a| a << w; a end` inside a threaded `m.synchronize do w = v; … end` is typed
+      # tail-only at two positions.
+      def tail_only_walk?(element_types)
+        element_types.size > PER_ELEMENT_THREADING_LIMIT || block_body_threading_suppressed?
+      end
+
+      # Wherever a position is typed tail-only ({#tail_only_walk?}), a tail that reads what the body's own
+      # prefix wrote or mutated does not get a wider answer. It gets the ENTRY binding, which the prefix has
+      # already falsified.
       #
       # #584's cliff comment promised `Dynamic[top]` above the cap, and that held for a body-LOCAL: `[1, …,
-      # 9].map do v = e; v end` has no entry binding for `v`, so tail-only lands on `Dynamic[top]` by itself.
-      # A mutated PARAMETER has one, and issue #617 residue (2) is what it buys: `([[]] * 9).map do |a| a <<
-      # 1; a end` answered nine stale `[]`, a provably-empty array at every position of a result whose slots
-      # each hold `[1]`. Flooring the whole walk restores the promise for both shapes — the cost the cap
-      # refuses to pay is the per-position body evaluation, and declining to pay it means declining to know,
-      # not answering the pre-state.
-      #
-      # {#tail_depends_on_body_binding?} is the same predicate the threading gate uses, so "would threading
-      # have changed this tail" and "is tail-only untrustworthy here" stay one question. A body it answers
-      # false for keeps its exact tail-only fold above the cap, which is every single-statement block and
-      # every multi-statement block whose tail ignores its prefix.
-      def uncapped_body_floor(element_types)
+      # 9].map do v = e; v end` has no entry binding for `v`, so tail-only lands on `Dynamic[top]` by itself,
+      # which is why a body-local alone does not call for the floor. A mutated PARAMETER has one, and issue
+      # #617 residue (2) is what it buys: `([[]] * 9).map do |a| a << 1; a end` answered nine stale `[]`, a
+      # provably-empty array at every position of a result whose slots all hold the one array the nine `<<`
+      # filled. Nested under the suppression the same body did it at two positions, and a `transform_values`
+      # over `{ x: [], y: [] }` did it at every pair ({#tail_only_pairs_floored?}). Flooring every position
+      # restores the promise for the positions; the assembler still decides the call from them, and a method
+      # whose fall-through could read a pin again takes its own floor ({#undecided_fold_floor}). What the cap
+      # and the suppression refuse to pay is the per-position body evaluation, and refusing to pay it means
+      # declining to know, not answering the pre-state.
+      #
+      # The names come from the scan the threading gate uses ({#tail_depends_on_body_binding?}), so "would
+      # threading have changed this tail" and "is tail-only untrustworthy here" stay one question. A body
+      # {#unanswered_tail_dependency?} answers false for keeps its exact fold: every single-statement block,
+      # and every multi-statement block whose tail ignores its prefix, reads only its own body-locals, or
+      # leaves through a `next` (the last is evaluated whole, never tail-only).
+      def tail_only_body_floor(element_types)
         Array.new(element_types.size) { Type::Combinator.untyped }
       end
 
       # True when the tail reads something the prefix changed that NOTHING has re-answered for this walk.
       #
-      # `captured` is the converged binding of every outer local the block rebinds ({#per_element_captured_bindings}),
-      # and its cost is independent of the arity, so it keeps working above the cap: `total = 0; [1, …,
-      # 9].map do total += e; total end` reads `total` as the fixpoint's `Integer` at every position and needs
-      # no floor. What the cap actually withholds is the per-position body evaluation, so the names it leaves
-      # unanswered are the ones the fixpoint does not cover — a mutated block PARAMETER (issue #617 residue
-      # (2)'s `|a| a << 1; a`) or a mutated outer local the block never rebinds.
+      # `captured` is the #587 (b) any-iteration binding of every outer local and instance variable the block
+      # rebinds or mutates in place ({#per_element_captured_bindings}), and its cost is independent of the
+      # arity, so it keeps working above the cap: `total = 0; [1, …, 9].map do total += e; total end` reads
+      # `total` as the fixpoint's `Integer` at every position and needs no floor, and `out = []; … do out << e;
+      # out.size end` reads `out` as the widened `Array[Dynamic[top]]`, whose content carries a gradual arm and
+      # whose arity is open. Under the nesting suppression a rebound name takes the escaping-block floor name by
+      # name, so `[total, e]` keeps its `Tuple` rather than collapsing whole, and the in-place widening, which
+      # evaluates no body, applies as it does anywhere. What a tail-only walk withholds is the per-position body
+      # evaluation, so the names left unanswered are the ones neither binding covers — a mutated block
+      # PARAMETER (issue #617 residue (2)'s `|a| a << 1; a`), and a captured local whose in-place widening
+      # declined, which is left out of `captured` for exactly this reason.
+      #
+      # Two tails are answered without it. A name with no ENTRY binding — a body-local such as `key = k.to_s;
+      # [key, n + w]` — reads as `Dynamic[top]` under tail-only by itself, which is sound, so flooring the
+      # whole position would only erase the structure around it. Instance and global variables always count,
+      # since the scope may still hold a pre-state for them. And a body with a block-level `next` is never
+      # typed tail-only at all: {#block_body_type_joining_nexts} evaluates the whole body whatever the
+      # suppression says.
       def unanswered_tail_dependency?(block, captured)
         body = block.body
         return false unless body.is_a?(Prism::StatementsNode)
         return false if body.body.size < 2
+        return false if block_level_jump?(body, Prism::NextNode)
+
+        names = tail_dependent_body_names(body.body) - (captured&.names || EMPTY_NAME_SET)
+        return false if names.empty?
 
-        answered = captured&.keys || []
-        tail_dependent_body_names(body.body).any? { |name| !answered.include?(name) }
+        entry = BlockParameterBinder.new.bind_onto(block, scope)
+        names.any? { |name| name.start_with?("@", "$") || !entry.local(name).nil? }
       end
 
       # Issue #587 (b) — first-iteration pinning. Every position of this fold is typed from the SAME entry
@@ -4014,12 +4744,12 @@ module Rigor
       # position's entry scope, so a position answers what the local can be in ANY iteration
       # (`[Integer, Integer]`), never what it was in the first.
       #
-      # Only the rebound names move. A position whose tail reads an untouched captured local or a block-local
-      # keeps its exact fold (`[5, 5]`, `[42, 42]`), and a predicate that ignores the rebound counter still
-      # decides (`select do seen += 1; e > 1 end` still folds to `[2]`); a blanket decline would have lost all
-      # three for nothing. The fixpoint binds the block parameter to the union of the elements, so its cost
-      # is independent of the arity — which is why the per-element threading cap is NOT a reason to floor: a
-      # ninth element keeps `Integer` where it would otherwise keep the stale `0`.
+      # Only the names the body changes move. A position whose tail reads an untouched captured local or a
+      # block-local keeps its exact fold (`[5, 5]`, `[42, 42]`), and a predicate that ignores the rebound
+      # counter still decides (`select do seen += 1; e > 1 end` still folds to `[2]`); a blanket decline would
+      # have lost all three for nothing. The fixpoint binds the block parameter to the union of the elements,
+      # so its cost is independent of the arity — which is why the per-element threading cap is NOT a reason to
+      # floor: a ninth element keeps `Integer` where it would otherwise keep the stale `0`.
       #
       # Under threading suppression — this fold nested inside another threaded body — the fixpoint's body
       # evaluations are exactly the re-entrant cost the suppression exists to refuse, so the names take the
@@ -4027,74 +4757,256 @@ module Rigor
       # fixpoint takes the same floor rather than the seed — a seed that reaches a position is the pin this
       # exists to remove.
       #
-      # Returns `nil` (no binding to apply) for the overwhelmingly common body that rebinds nothing captured.
+      # An instance variable pins the same way — the block shares the caller's `self`, so `@t = 0; [1,
+      # 2].map { @t += 1 }` folded to `[1, 1]` too — and so do a class variable and a global. Each takes the
+      # same treatment under every rule above: the ones the body rebinds ({CapturedLocals.writes} with
+      # `non_locals: true`, which also counts `self.w = …` as a rebind of `@w`) join the name set. They keep
+      # their sigil, so the one map cannot confuse `@t` with a local `t`, and the arity-cap floor
+      # ({#unanswered_tail_dependency?}), which compares names sigil-and-all, counts a rebound ivar as answered.
+      #
+      # A name the body rebinds where the fixpoint's pass cannot see it ({UnthreadedRebinds}) takes the floor
+      # outright; see {#converged_captured_bindings}. The optimistic nil-freeness mark a pass's exit binding
+      # carries is kept with the converged type ({CapturedLocals::Bindings}).
+      #
+      # The same pin has a CONTENT half the rebind set cannot see: a captured receiver the body mutates in place
+      # is never rebound, so `h = { a: 0 }; [:a, :a].map { |k| h[k] = h[k] + 1 }` read `h` at its entry
+      # contents at every position and folded to `[1, 1]` (runtime `[1, 2]`). Each such local
+      # ({CapturedLocals.content_mutations}) is bound as if every mutation site in the body had already stored
+      # an unknown value ({UnknownStoreWidening.widen}): `Hash[Dynamic[top] | Symbol, Dynamic[top] |
+      # Integer]`, an open arity with a gradual arm on every content parameter a storing site touches. A local
+      # whose widening declines (a precise nominal) gets no binding at all, so it keeps today's answer. The
+      # binding evaluates no body, so it applies under threading suppression too; the rebind fixpoint runs
+      # over it, and a local the body both rebinds and mutates takes the same widening over its converged
+      # type — the rebind can bring a fresh literal back, which the next iteration then mutates. A local mutated
+      # through an element read (`a[0] << e`) or passed to a self-call whose callee content-mutates that
+      # parameter (`add_to(a, e)`) takes it too, widened as straight-line code widens it after such a site. An
+      # unmutated captured local keeps its exact binding (`h = { a: 0 }; [:a, :a].map { |k| h[k] }` still folds
+      # to `[0, 0]`). An instance variable the body mutates in place takes the same binding
+      # ({CapturedLocals.content_mutations} with `non_locals: true`, on the rebind set's terms): once the #587
+      # (a) gate threads an index write, `@cache[:first] ||= e` pins the same way. So do a class variable and a
+      # global.
+      #
+      # The generic block-return pass lays the same binding ({#block_entry_scope}), with the fixpoint's block
+      # parameters bound to the signature's instead of to the elements' union.
+      #
+      # The binding also marks the index `||=` sites whose slot an earlier position may have filled
+      # ({RepeatedOrWrites}), so the memoizing `||=` reading (`StatementEvaluator#index_compound_write_value`)
+      # does not take such a slot's lone `Dynamic` for "no evidence about the slot" and answer one position's
+      # rvalue: `cache = {}; [1, 2].find { |e| (cache[:first] ||= e) == 2 }` answered `2 == 2` at the second
+      # position and folded `find` to `2` where Ruby, keeping the first iteration's `1`, answers `nil`.
+      #
+      # Returns `nil` (no binding to apply) for the overwhelmingly common body that rebinds and mutates nothing
+      # captured and holds no such site.
       def per_element_captured_bindings(block, element_types)
-        names = CapturedLocals.writes(block, scope)
-        return nil if names.empty?
-        return captured_floor(names) if block_body_threading_suppressed?
+        captured_block_bindings(block, [Type::Combinator.union(*element_types)], element_types: element_types)
+      end
+
+      # The #587 (b) binding for `block`, with the fixpoint's block parameters bound to `param_types`.
+      # `element_types` is the per-element fold's positions, which {RepeatedOrWrites} reads; nil for the generic
+      # block-return pass.
+      def captured_block_bindings(block, param_types, element_types: nil)
+        stores = CapturedLocals.content_mutations(block, scope, non_locals: true)
+        names = CapturedLocals.writes(block, scope, non_locals: true)
+        repeated = RepeatedOrWrites.sites(block, stores, scope, element_types: element_types)
+        return nil if stores.empty? && names.empty? && repeated.empty?
+
+        stored = stored_capture_bindings(stores)
+        types = stored.dup
+        marks = {}
+        unless names.empty?
+          rebound_capture_bindings(block, names, param_types, stored, marks).each do |name, converged|
+            types[name] = stores.key?(name) ? UnknownStoreWidening.widen(converged, stores[name]) : converged
+          end
+        end
+        return nil if types.empty? && repeated.empty?
 
-        begin
-          converged_captured_bindings(block, names, element_types)
-        rescue StandardError
-          captured_floor(names)
+        CapturedLocals::Bindings.new(types: types, marks: marks, repeated: repeated)
+      end
+
+      # Only a binding the widening MOVED is recorded. One it declined (a precise nominal, a refinement under
+      # `sort!`) is still the entry binding, which says nothing about later iterations; recording it would make the
+      # arity-cap floor ({#unanswered_tail_dependency?}) treat the name as answered and type the tail from that
+      # stale binding. Left out, the name keeps the entry binding below the cap and
+      # the floor above it, which is the fold's answer without this pass.
+      def stored_capture_bindings(stores)
+        stores.each_with_object({}) do |(name, sites), bindings|
+          seed = CapturedLocals.bound_type(scope, name)
+          next if seed.nil?
+
+          widened = UnknownStoreWidening.widen(seed, sites)
+          bindings[name] = widened unless widened == seed
         end
       end
 
+      # `stored` is laid under every fixpoint pass, so the rebind converges over the widened contents rather
+      # than the entry ones. `marks` collects the optimistic nil-freeness mark a pass's exit binding carries.
+      def rebound_capture_bindings(block, names, param_types, stored, marks)
+        return captured_floor(names) if block_body_threading_suppressed?
+
+        converged_captured_bindings(block, names, param_types, stored, marks)
+      rescue StandardError
+        captured_floor(names)
+      end
+
       def captured_floor(names)
         names.to_h { |name| [name, Type::Combinator.untyped] }
       end
 
-      def converged_captured_bindings(block, names, element_types)
-        param_types = [Type::Combinator.union(*element_types)]
-        seeds = names.to_h { |name| [name, scope.local(name)] }
+      # A name the body rebinds somewhere the pass's exit scope never sees ({UnthreadedRebinds}) takes the floor
+      # without running the fixpoint, and is bound to it under every pass, so a name that reads it converges over
+      # the floor rather than over the pin: `t = s` after an unthreaded `s` rebind would otherwise converge on
+      # the first iteration's `s`. The unmoved-pin test below still runs over every other name.
+      def converged_captured_bindings(block, names, param_types, stored, marks)
+        floored = UnthreadedRebinds.names(block, names)
+        moving = names.reject { |name| floored.include?(name) }
+        # Issue #1358 — each pass is an iteration, so it reads the match globals the block entry does.
+        base = stored.reduce(MatchRebinding.block_entry(scope, block)) do |acc, (name, type)|
+          CapturedLocals.bind(acc, name, type)
+        end
+        base = floored.reduce(base) { |acc, name| CapturedLocals.bind(acc, name, Type::Combinator.untyped) }
+        seeds = moving.to_h { |name| [name, CapturedLocals.bound_type(base, name)] }
+        moved = {}
         converged = BodyFixpoint.converge(
-          names: names,
+          names: moving,
           seed_bindings: seeds,
           widen: Type::Combinator.method(:widen_value_pinned),
-          evaluate_body: ->(bindings) { captured_exit_bindings(block, param_types, bindings, names) }
+          evaluate_body: lambda do |bindings|
+            captured_exit_bindings(block, param_types, base, bindings, moved, marks)
+          end
         )
-        unmoved_pins_floored(converged, seeds)
+        unmoved_pins_floored(converged, seeds, moved).merge(captured_floor(floored))
       end
 
       # A name the write scan says this block REBINDS, whose fixpoint came back on exactly its value-pinned
       # seed, is floored rather than believed.
       #
-      # The fixpoint reads each pass's exit binding out of `StatementEvaluator`, and that evaluator only
-      # threads a write it sees as a STATEMENT: a rebind nested inside an expression — `(seen += 1) == 2` as
-      # the block's whole body — leaves the exit scope holding the entry binding, so the fixpoint converges on
-      # the seed and every position of the fold answers the first iteration again. That is issue #617 residue
-      # (1)'s one-liner, `seen = 0; [1, 2].find { |e| (seen += 1) == 2 }` answering `nil` where Ruby answers
-      # `2`: the pinned `Constant[0]` made both predicates `Constant[false]`, and `find` short-circuits on a
-      # provably-falsey block.
+      # The fixpoint reads each pass's exit binding out of `StatementEvaluator`, and that evaluator does not
+      # thread a write from every position: a rebind nested where it types a pure value leaves the exit scope
+      # holding the entry binding, so the fixpoint converges on the seed and every position of the fold answers
+      # the first iteration again. That is issue #617 residue (1)'s one-liner, `seen = 0; [1, 2].find { |e|
+      # (seen += 1) == 2 }` answering `nil` where Ruby answers `2`: the pinned `Constant[0]` made both
+      # predicates `Constant[false]`, and `find` short-circuits on a provably-falsey block. The evaluator has
+      # threaded a call's receiver since #1223, but a `when` condition or a `yield` argument is still such a
+      # position.
       #
       # An unmoved pin cannot be distinguished from a write that genuinely restores its own entry value
       # (`x = 5; xs.each { x = 5 }`), so the floor gives that shape up too. It is the far cheaper side: a
       # value-pinned seed the block rebinds is the exact pre-state this fold exists to stop trusting, and
       # `Dynamic[top]` is the same escaping-block floor {#captured_floor} already uses. Seeds that carry no
-      # value pinning are left alone — there is no first-iteration constant in them to remove, and widening a
+      # pinning are left alone — there is no first-iteration value or shape in them to remove, and widening a
       # `Nominal` here would only lose a class for nothing.
-      def unmoved_pins_floored(converged, seeds)
+      #
+      # A second route reaches this test with nothing hidden from the evaluator. The fixpoint stops after
+      # {BodyFixpoint::CAP} passes, so a rebind a counter guards past the third iteration (`row = [v, v] if
+      # count > 3`) runs in none of them, and the widen on the capped pass erases a `Constant`'s value but leaves
+      # a `Tuple` / `HashShape` as it is. `row = []` therefore came back on its seed, and `sizes.last == 2`
+      # folded always-falsey on a runtime `2`, so a shape carrier counts as pinned ({#value_pinned?}). For a
+      # shape the unmoved test only asks whether the seed already covers the converged type, so any rebind the
+      # seed covers is floored with it, not only one restoring the entry value: `qr = n.divmod(3)` rebound to
+      # another `divmod` reads `Dynamic[top]` too.
+      #
+      # The pin test reads a binding as a whole and nothing else. A `0 | Integer` seed is floored too, although a
+      # threaded `x += 1` only joins back into it: an unthreaded write storing another class (`log(x = nil)`)
+      # converges on the same seed, and only the floor keeps `x.nil?` from folding to `false`. Nor does a pass
+      # whose exit binding moved prove the rebind was threaded — a narrowing (`next false unless x`) or a
+      # threaded prefix (`x ||= 0`) moves it while `(x += 1) == 2` stays unthreaded.
+      #
+      # "Unmoved" compares against the fixpoint's own seed, but "pinned" is asked of the CALL-SITE binding. For a
+      # name the body also mutates in place the seed is already the in-place widening of that binding
+      # ({#stored_capture_bindings}), and the widening erases exactly the pin this test looks for: `s = +"ab"`
+      # seeds `String`, not `"ab"`. Asking the seed would let a nested rebind the evaluator cannot see (`(s &&=
+      # s.to_sym)` inside an expression) converge on `String` and be believed, where the local really holds a
+      # Symbol from the second iteration on. For every other name the two bindings are the same. The price is
+      # the trade the paragraph above already makes: a name the body mutates and VISIBLY rebinds to the widened
+      # class (`t << "c"; t = t.strip`) converges on that seed as well, and is floored with the hidden case.
+      #
+      # A statement rebind does not buy that case back, because converging on the widened seed is not evidence
+      # that the rebind was all there was. The capped pass above runs no rebind a counter guards past the third
+      # iteration (`s = s.dup; n += 1; s = [e] if n > 3`), and the scans see only write nodes in the body, so a
+      # lambda defined outside it (`close = -> { cur = nil }; … close.call`) or `binding.local_variable_set`
+      # rebinds the local where no pass looks. Both converge on the seed next to a statement rebind, and
+      # believing `String` there reports `undefined method` or an always-falsey `cur.nil?` on correct code.
+      #
+      # A pass's exit binding also joins every block-level `next` ({StatementEvaluator#evaluate_invocation}), and
+      # a rebind on a `next` arm moves the converged binding off its seed while an unthreaded write on the
+      # fall-through stays invisible: `if c; seen = 100; next false; end; (seen += 1) == 2` converged on `0 |
+      # 100` and folded `find` to `nil`. So `moved` ({#captured_exit_bindings}) records which path moved each
+      # name. One the FALL-THROUGH moved is believed; one only a `next` arm moved is unmoved for this test, and
+      # floored with the hidden case; one neither moved is judged against its seed as before, so a block without
+      # a block-level `next` is judged exactly as it always was.
+      #
+      # {UnthreadedRebinds} floors every name it can show is rebound out of the pass's sight before this test
+      # runs, whatever the fixpoint converged to — the threaded `||=` that moves the fall-through beside an
+      # unthreaded `(seen += 1) == 2` included — so this test only ever sees a name whose rebinds the scan found
+      # threaded. It stays as the backstop for what the scan cannot see, and so the `0 | Integer` seed above
+      # keeps its floor: skipping it for a scan-clean name would trade that backstop for precision.
+      def unmoved_pins_floored(converged, seeds, moved)
         converged.to_h do |name, type|
-          seed = seeds[name]
-          next [name, type] unless type == seed && value_pinned?(seed)
+          unmoved =
+            case moved[name]
+            when :fall_through then false
+            when :jump then true
+            else type == seeds[name]
+            end
+          next [name, type] unless unmoved && value_pinned?(CapturedLocals.bound_type(scope, name))
 
           [name, Type::Combinator.untyped]
         end
       end
 
+      # A binding carries a pin when widening its values changes it, or when it is a `Tuple` / `HashShape` —
+      # alone or as one member of a union. A shape carrier is pinned whatever its elements are: its arity and
+      # key set are one assignment's, and the fixpoint's final widen erases a value but never a shape.
       def value_pinned?(type)
-        !type.nil? && Type::Combinator.widen_value_pinned(type) != type
+        case type
+        when nil then false
+        when Type::Tuple, Type::HashShape then true
+        when Type::Union then type.members.any? { |member| value_pinned?(member) }
+        else Type::Combinator.widen_value_pinned(type) != type
+        end
       end
 
       # One fixpoint pass: the body evaluated from `bindings` with the block parameters bound over them (the
-      # same layering as {#type_block_body_with_param}), returning the per-name exit binding. Threading is
-      # suppressed for the pass, as it is for every full body evaluation the block-return pass runs.
-      def captured_exit_bindings(block, param_types, bindings, names)
-        params = BlockParameterBinder.new(expected_param_types: param_types).bind(block)
-        entry = bindings.reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
-        entry = params.reduce(entry) { |acc, (name, type)| acc.with_local(name, type) }
-        _type, exit_scope = without_block_body_threading { entry.evaluate(block.body) }
-        names.to_h { |name| [name, exit_scope.local(name)] }
+      # same layering as {#type_block_body_with_param}), returning the per-name exit binding — the invocation's
+      # exit, which joins every block-level `next` ({StatementEvaluator#evaluate_invocation}), so a rebind on a
+      # jumping path reaches the fixpoint. `moved` records, per name, whether this pass's FALL-THROUGH moved it
+      # off its entry (`:fall_through`) or only the joined `next` arms did (`:jump`), for {#unmoved_pins_floored}.
+      # An exit mark is recorded into `marks` and carried into later passes, since the next iteration enters on
+      # that binding. Threading is suppressed for the pass, as it is for every full body evaluation the
+      # block-return pass runs.
+      def captured_exit_bindings(block, param_types, base, bindings, moved, marks)
+        entry = bindings.reduce(base) do |acc, (name, type)|
+          CapturedLocals.bind(acc, name, type, optimistic: marks[name])
+        end
+        entry = BlockParameterBinder.new(expected_param_types: param_types).bind_onto(block, entry)
+        _type, fall_through, exit_scope = without_block_body_threading do
+          StatementEvaluator.new(scope: entry).evaluate_invocation(block)
+        end
+        bindings.to_h do |name, entry_type|
+          exit_type = CapturedLocals.bound_type(exit_scope, name)
+          record_capture_move(moved, name, entry_type, fall_through, exit_type)
+          mark = CapturedLocals.optimistic_mark(exit_scope, name)
+          marks[name] ||= mark if mark
+          [name, exit_type]
+        end
+      end
+
+      # Which path of one pass moved `name` off its `entry_type`: the fall-through outranks a `next` arm, and a
+      # name the fall-through moved in any pass stays moved.
+      def record_capture_move(moved, name, entry_type, fall_through, exit_type)
+        if moved_off?(entry_type, CapturedLocals.bound_type(fall_through, name))
+          moved[name] = :fall_through
+        elsif moved_off?(entry_type, exit_type)
+          moved[name] ||= :jump
+        end
+      end
+
+      # True when `after` is not already contained in `before` — the same stability test `BodyFixpoint` applies.
+      def moved_off?(before, after)
+        return false if after.nil?
+        return true if before.nil?
+
+        Type::Combinator.union(before, after) != before
       end
 
       def per_element_symbol_results(block_arg, element_types)
@@ -4318,15 +5230,6 @@ module Rigor
         converged[:__inject_acc__] || seed_acc
       end
 
-      # `index(value)` and `find_index(value)` carry a positional argument and search by `==` rather than
-      # running the block. Decline so the RBS tier owns those forms.
-      def find_family_with_args?(call_node)
-        return false unless %i[find_index index].include?(call_node.name)
-
-        args = call_node.arguments
-        !args.nil? && !args.arguments.empty?
-      end
-
       def assemble_per_element_result(method_name, per_position, element_types)
         case method_name
         when :map, :collect then Type::Combinator.tuple_of(*per_position)
@@ -4394,28 +5297,40 @@ module Rigor
       # `find` / `detect`: returns the first receiver element whose block result is Ruby-truthy, or `nil`
       # when no position folds to truthy.
       #
-      # Folds tightly only when every per-position block result is a `Type::Constant` — otherwise we cannot
-      # decide which position (if any) is "the first matching one". When the first decisive truthy position
-      # is found, the answer is the corresponding receiver element. When every position folds to falsey,
-      # the answer is `Constant[nil]`.
+      # When the first decisive truthy position is found, the answer is the corresponding receiver element,
+      # joined with the element of every earlier position whose result is not a `Type::Constant`: such a
+      # position may match first, but the search ends at the truthy one whatever it answers, so the call
+      # never returns `nil`. When every position folds to falsey, the answer is `Constant[nil]`. With no
+      # decisive truthy position and some undecided one, it declines ({#undecided_fold_floor}).
       def assemble_find_result(per_position, element_types)
-        return nil unless per_position.all?(Type::Constant)
+        candidates = first_match_candidates(per_position)
+        return candidates if candidates.nil? || candidates.equal?(NO_MATCH)
 
-        first_truthy_index = per_position.index { |type| truthy_constant?(type) }
-        return Type::Combinator.constant_of(nil) if first_truthy_index.nil?
-
-        element_types[first_truthy_index]
+        Type::Combinator.union(*candidates.map { |index| element_types[index] })
       end
 
       # `find_index` / `index`: returns the index of the first truthy position, or `Constant[nil]` when
-      # nothing matches.
+      # nothing matches, on {#assemble_find_result}'s terms.
       def assemble_find_index_result(per_position)
-        return nil unless per_position.all?(Type::Constant)
+        candidates = first_match_candidates(per_position)
+        return candidates if candidates.nil? || candidates.equal?(NO_MATCH)
+
+        Type::Combinator.union(*candidates.map { |index| Type::Combinator.constant_of(index) })
+      end
+
+      NO_MATCH = Type::Combinator.constant_of(nil)
+      private_constant :NO_MATCH
 
+      # The positions `find` may stop at — the first decisive truthy one and every undecided one before it —
+      # `NO_MATCH` when every position folds falsey, or nil when an undecided position has no truthy one after it.
+      def first_match_candidates(per_position)
         first_truthy_index = per_position.index { |type| truthy_constant?(type) }
-        return Type::Combinator.constant_of(nil) if first_truthy_index.nil?
+        if first_truthy_index.nil?
+          return per_position.all?(Type::Constant) ? NO_MATCH : nil
+        end
 
-        Type::Combinator.constant_of(first_truthy_index)
+        undecided = (0...first_truthy_index).reject { |index| per_position[index].is_a?(Type::Constant) }
+        undecided + [first_truthy_index]
       end
 
       def truthy_constant?(type)
@@ -4436,28 +5351,47 @@ module Rigor
       #   `Constant[Symbol | String]` — otherwise the tier declines (the new key cannot be used as a static
       #   HashShape index). Collisions (two old keys mapping to the same new key) also decline.
       #
+      # Two runtime behaviours fall outside this model, and both decline:
+      #
+      # - A call with arguments. `transform_keys(mapping)` renames the keys `mapping` names and yields only
+      #   the rest to the block, and the fold never reads the mapping. `transform_values` takes none.
+      # - An in-place form whose block could see the receiver ({ReceiverBlindBlock}). The bang forms rewrite
+      #   the receiver pair by pair, so the block can see pairs it has already rewritten, while the fold types
+      #   every pair against the pre-call shape. The non-bang forms build a new hash and keep the exact fold.
+      #
       # Returns `nil` on any decline so the dispatcher falls through to `RbsDispatch` and gets the widened
       # `Hash[K, V]` answer.
       def try_hash_shape_block_fold(call_node, receiver_type)
-        return nil unless HASH_SHAPE_TRANSFORM_METHODS.include?(call_node.name)
-        return nil unless receiver_type.is_a?(Type::HashShape)
-        return nil unless receiver_type.closed?
-        return nil unless receiver_type.optional_keys.empty?
+        return nil unless hash_shape_fold_applicable?(call_node, receiver_type)
 
         block_arg = call_node.block
-        return nil if block_arg.nil?
+        return nil if in_place_block_sees_receiver?(call_node.name, block_arg)
 
         if %i[transform_values transform_values!].include?(call_node.name)
           fold_hash_shape_transform_values(receiver_type, block_arg)
         else
-          fold_hash_shape_transform_keys(receiver_type, block_arg)
+          fold_hash_shape_transform_keys(receiver_type, block_arg, in_place: call_node.name == :transform_keys!)
         end
       end
 
+      def hash_shape_fold_applicable?(call_node, receiver_type)
+        HASH_SHAPE_TRANSFORM_METHODS.include?(call_node.name) &&
+          receiver_type.is_a?(Type::HashShape) && receiver_type.closed? && receiver_type.optional_keys.empty? &&
+          call_node.arguments.nil? && !call_node.block.nil?
+      end
+
+      def in_place_block_sees_receiver?(method_name, block_arg)
+        IN_PLACE_HASH_SHAPE_TRANSFORMS.include?(method_name) &&
+          block_arg.is_a?(Prism::BlockNode) && !ReceiverBlindBlock.blind?(block_arg, scope)
+      end
+
       def fold_hash_shape_transform_values(shape, block_arg)
+        captured = hash_block_captured_bindings(block_arg, shape.pairs.values)
+        return hash_shape_values_floor(shape) if tail_only_pairs_floored?(shape, block_arg, captured)
+
         new_pairs = {}
-        shape.pairs.each do |key, value|
-          new_value = apply_hash_block(block_arg, value)
+        shape.pairs.each_with_index do |(key, value), position|
+          new_value = apply_hash_block(block_arg, value, captured: captured, position: position)
           return nil if new_value.nil?
 
           new_pairs[key] = new_value
@@ -4465,28 +5399,125 @@ module Rigor
         Type::Combinator.hash_shape_of(new_pairs)
       end
 
-      def fold_hash_shape_transform_keys(shape, block_arg)
-        new_pairs = {}
-        shape.pairs.each do |key, value|
-          key_type = Type::Combinator.constant_of(key)
-          new_key_type = apply_hash_block(block_arg, key_type)
-          return nil unless new_key_type.is_a?(Type::Constant)
+      def fold_hash_shape_transform_keys(shape, block_arg, in_place: false)
+        key_types = shape.pairs.keys.map { |key| Type::Combinator.constant_of(key) }
+        captured = hash_block_captured_bindings(block_arg, key_types)
+        return hash_keys_floor(shape) if tail_only_pairs_floored?(shape, block_arg, captured)
 
-          new_key = new_key_type.value
-          return nil unless new_key.is_a?(Symbol) || new_key.is_a?(String)
-          return nil if new_pairs.key?(new_key)
+        new_pairs = {}
+        key_types.zip(shape.pairs.values).each_with_index do |(key_type, value), position|
+          typed_key = apply_hash_block(block_arg, key_type, captured: captured, position: position)
+          new_key = new_shape_key(typed_key, new_pairs)
+          return undecided_keys_floor(shape, block_arg, key_types, captured) if new_key.nil?
 
           new_pairs[new_key] = value
         end
-        Type::Combinator.hash_shape_of(new_pairs)
+        Type::Combinator.hash_shape_of(in_place ? in_place_key_order(shape.pairs, new_pairs) : new_pairs)
+      end
+
+      # `transform_keys!` rewrites the receiver in place, pair by pair, so its pairs end in a different order from
+      # the new hash `transform_keys` builds. For each old pair, CRuby's `rb_hash_transform_keys_bang` deletes the
+      # old key unless an earlier pair already produced it as a new key, then stores the new key: in place when the
+      # new key is an old key not yet reached, appended otherwise. `{ a: 1, b: 2, c: 3 }.transform_keys! { |k| k ==
+      # :b ? :c : (k == :c ? :b : k) }` is `{ c: 2, a: 1, b: 3 }`, not `{ a: 1, c: 2, b: 3 }`, and `r.keys.first ==
+      # :a` folded always-truthy on the wrong order. Replaying those steps over a Ruby `Hash`, which orders its keys
+      # the same way, gives the same order. `new_pairs` is collision-free and in the old pairs' order, so every
+      # old key is either deleted or overwritten, and no old value survives.
+      def in_place_key_order(old_pairs, new_pairs)
+        produced = {}
+        old_pairs.keys.zip(new_pairs).each_with_object(old_pairs.dup) do |(old_key, (new_key, value)), result|
+          result.delete(old_key) unless produced.key?(old_key)
+          result[new_key] = value
+          produced[new_key] = true
+        end
+      end
+
+      # The key a pair's block result can index the new `HashShape` with — a `Constant` Symbol or String that no
+      # earlier pair already took — or nil.
+      def new_shape_key(new_key_type, new_pairs)
+        return nil unless new_key_type.is_a?(Type::Constant)
+
+        new_key = new_key_type.value
+        return nil unless new_key.is_a?(Symbol) || new_key.is_a?(String)
+
+        new_pairs.key?(new_key) ? nil : new_key
+      end
+
+      # A key fold that cannot build a `HashShape` declines to the dispatcher — except under the suppression, where
+      # the dispatcher's block-return pass is typed tail-only too and read a captured value the body mutates in
+      # place at its entry contents: `buf = +"k"; … { a: 1 }.transform_keys { |k| buf << w.to_s; buf }` answered
+      # `Hash["k", 1]` for `{ "k1" => 1 }`, though the pairs themselves were typed over the #587 (b) binding that
+      # answers `buf`. There the fold answers from the keys it typed, `Hash[union(<new keys>), union(<values>)]`,
+      # and takes the plain floor ({#hash_keys_floor}) when a pair could not be typed at all. The pairs are
+      # re-typed for it, which only a suppressed, undecided key fold pays. That pass now re-answers such a name
+      # itself ({#prefix_answered_scope}), so a decline would no longer read `"k"`; the fold still answers from
+      # the pairs it has typed.
+      def undecided_keys_floor(shape, block_arg, key_types, captured)
+        return nil unless block_body_threading_suppressed?
+
+        new_key_types = key_types.each_with_index.map do |key_type, position|
+          apply_hash_block(block_arg, key_type, captured: captured, position: position)
+        end
+        return hash_keys_floor(shape) if new_key_types.any?(&:nil?)
+
+        Type::Combinator.nominal_of(
+          "Hash", type_args: [Type::Combinator.union(*new_key_types), Type::Combinator.union(*shape.pairs.values)]
+        )
+      end
+
+      # The per-pair twin of issue #587 (b)'s first-iteration pin. Every pair is typed from the SAME entry scope,
+      # so a body that rebinds a captured outer local answered the first pair's value at every pair: `total = 0;
+      # { x: 1, y: 2 }.transform_values { total += 1 }` folded to `{ x: 1, y: 1 }` (runtime `{ x: 1, y: 2 }`),
+      # and `r[:y] == 1` then fired always-truthy on correct code. The pairs take the per-element fold's
+      # captured-local entry binding ({#per_element_captured_bindings}) — the fixpoint's block parameter bound
+      # to the union of the values, or of the `Constant` keys — rather than a copy of it: issue #1198 is where
+      # the block-entry models consolidate. A captured local the body does not change keeps its exact per-pair
+      # fold, and a `&:symbol` block captures nothing.
+      #
+      # An empty shape has no pair to type, so it does not pay for the fixpoint.
+      def hash_block_captured_bindings(block_arg, param_types)
+        return nil unless block_arg.is_a?(Prism::BlockNode)
+        return nil if param_types.empty?
+
+        per_element_captured_bindings(block_arg, param_types)
+      end
+
+      # The per-pair fold has no arity cap, so running nested inside a body another pass is evaluating whole
+      # ({#tail_only_walk?}'s second case) is the one way it reaches a tail-only pair the dependency predicate
+      # can flag, and that pair holds the same pre-state {#tail_only_body_floor} describes:
+      # `{ x: [], y: [] }.transform_values do |a| a << w; a end` inside a threaded `m.synchronize do w = v; …
+      # end` answered `{ x: [], y: [] }` for a hash whose values each hold `[1]`, and `r[:x].first + 1` was
+      # then reported on correct code. The floor is the Tuple fold's, applied per pair and over the same
+      # `captured` names, with the fold answering it rather than declining: a decline reached the dispatcher,
+      # whose block-return pass the same suppression typed tail-only, so `k = "#{k}#{w}"; k` read its keys
+      # as the entry `:a | :b` until that pass re-answered the stale name itself ({#prefix_answered_scope}).
+      # An empty shape types no pair, so it keeps its exact `{}`.
+      def tail_only_pairs_floored?(shape, block_arg, captured)
+        !shape.pairs.empty? && block_arg.is_a?(Prism::BlockNode) && block_body_threading_suppressed? &&
+          unanswered_tail_dependency?(block_arg, captured)
+      end
+
+      # `transform_values` keeps the keys and answers every value `Dynamic[top]`.
+      def hash_shape_values_floor(shape)
+        Type::Combinator.hash_shape_of(shape.pairs.transform_values { Type::Combinator.untyped })
+      end
+
+      # `transform_keys` keeps the values, but a `Dynamic[top]` key cannot index a `HashShape`, and two keys may
+      # collide, so the floor is the plain `Hash` over them.
+      def hash_keys_floor(shape)
+        Type::Combinator.nominal_of(
+          "Hash", type_args: [Type::Combinator.untyped, Type::Combinator.union(*shape.pairs.values)]
+        )
       end
 
       # Applies a single-argument block (either a full BlockNode or a `&:symbol` BlockArgumentNode) to
-      # `param_type` and returns the resulting type, or `nil` on failure.
-      def apply_hash_block(block_arg, param_type)
+      # `param_type` and returns the resulting type, or `nil` on failure. `captured:` is the pair-independent
+      # entry binding from {#hash_block_captured_bindings}, and `position:` the pair's index, which picks the
+      # index `||=` sites that binding marks there.
+      def apply_hash_block(block_arg, param_type, captured: nil, position: nil)
         case block_arg
         when Prism::BlockNode
-          type_block_body_with_param(block_arg, [param_type])
+          type_block_body_with_param(block_arg, [param_type], captured: captured, position: position)
         when Prism::BlockArgumentNode
           expression = block_arg.expression
           return nil unless expression.is_a?(Prism::SymbolNode)
@@ -4503,13 +5534,18 @@ module Rigor
         end
       end
 
-      # `captured:` — issue #587 (b): the per-name entry binding of every captured outer local the body rebinds
+      # `captured:` — issue #587 (b): the per-name entry binding of every captured outer local and instance
+      # variable the body rebinds, and of every captured local it mutates in place
       # ({#per_element_captured_bindings}), laid under the parameter bindings so a parameter still shadows.
-      def type_block_body_with_param(block_node, expected_param_types, captured: nil)
-        bindings = BlockParameterBinder.new(expected_param_types: expected_param_types).bind(block_node)
-        block_scope = (captured || {}).reduce(scope) { |acc, (name, type)| acc.with_local(name, type) }
-        block_scope = bindings.reduce(block_scope) { |acc, (name, type)| acc.with_local(name, type) }
-        type_block_body(block_node, block_scope)
+      # `position:` is the element's index in the fold; the binding marks the index `||=` sites an earlier
+      # position may have filled there ({RepeatedOrWrites::Marks}).
+      def type_block_body_with_param(block_node, expected_param_types, captured: nil, position: nil)
+        # Issue #1358 — a position past the first runs after an earlier one may have rebound the match globals.
+        entry = MatchRebinding.block_entry(scope, block_node)
+        block_scope = captured ? captured.lay(entry, position: position) : entry
+        block_scope = BlockParameterBinder.new(expected_param_types: expected_param_types)
+                                          .bind_onto(block_node, block_scope)
+        type_block_body(block_node, block_scope, captured: captured)
       rescue StandardError
         nil
       end