rigortype 0.3.9 → 0.4.0

data/lib/rigor/inference/statement_evaluator.rb

@@ -9,16 +9,26 @@ require_relative "../source/node_walker"
 require_relative "../source/node_children"
 require_relative "../source/constant_path"
 require_relative "anonymous_meta_class"
+require_relative "block_repetition"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
 require_relative "captured_locals"
 require_relative "dynamic_origin"
+require_relative "error_info"
+require_relative "jump_targets"
+require_relative "last_status"
+require_relative "../analysis/check_rules/declaration_sourced_guard"
 require_relative "../analysis/check_rules/inferred_param_guard"
 require_relative "../analysis/check_rules/published_constant_guard"
 require_relative "struct_fold_safety"
 require_relative "closure_escape_analyzer"
 require_relative "content_join"
+require_relative "define_method_block_self"
+require_relative "macro_block_self_type"
+require_relative "guard_rebinding"
+require_relative "match_rebinding"
 require_relative "element_read_widening"
+require_relative "hash_lookup_mutation"
 require_relative "indexed_narrowing"
 require_relative "index_write_widening"
 require_relative "method_dispatcher"
@@ -26,7 +36,12 @@ require_relative "method_parameter_binder"
 require_relative "multi_target_binder"
 require_relative "mutation_widening"
 require_relative "narrowing"
+require_relative "operand_effects"
+require_relative "operand_walk"
 require_relative "optimistic_origin"
+require_relative "return_barrier"
+require_relative "rewrite_mutation"
+require_relative "unknown_store_widening"
 require_relative "version_guard"
 
 module Rigor
@@ -84,9 +99,16 @@ module Rigor
         Prism::IndexOrWriteNode => :eval_index_or_write,
         Prism::IndexAndWriteNode => :eval_index_write,
         Prism::IndexOperatorWriteNode => :eval_index_write,
+        Prism::CallOrWriteNode => :eval_attribute_compound_write,
+        Prism::CallAndWriteNode => :eval_attribute_compound_write,
+        Prism::CallOperatorWriteNode => :eval_attribute_compound_write,
         Prism::MultiWriteNode => :eval_multi_write,
         Prism::ConstantWriteNode => :eval_constant_write,
         Prism::ConstantPathWriteNode => :eval_constant_write,
+        # Issue #963 — `Const ||= Struct.new(:a) do … end` opens the same class body. The handler's own result is
+        # the default expression pair, so routing the or-writes here adds the body entry and nothing else.
+        Prism::ConstantOrWriteNode => :eval_constant_write,
+        Prism::ConstantPathOrWriteNode => :eval_constant_write,
         Prism::IfNode => :eval_if,
         Prism::UnlessNode => :eval_unless,
         Prism::ElseNode => :eval_else,
@@ -94,7 +116,7 @@ module Rigor
         Prism::CaseMatchNode => :eval_case,
         Prism::WhenNode => :eval_when_or_in,
         Prism::InNode => :eval_when_or_in,
-        Prism::BeginNode => :eval_begin,
+        Prism::BeginNode => :eval_begin_node,
         Prism::RescueNode => :eval_rescue,
         Prism::EnsureNode => :eval_ensure,
         Prism::WhileNode => :eval_loop,
@@ -113,10 +135,41 @@ module Rigor
         Prism::ReturnNode => :eval_return,
         Prism::NextNode => :eval_next,
         Prism::BreakNode => :eval_break,
-        Prism::MatchWriteNode => :eval_match_write
+        Prism::MatchWriteNode => :eval_match_write,
+        Prism::MatchPredicateNode => :eval_match_pattern,
+        Prism::MatchRequiredNode => :eval_match_pattern,
+        Prism::RescueModifierNode => :eval_rescue_modifier,
+        Prism::ArrayNode => :eval_value_container,
+        Prism::HashNode => :eval_value_container,
+        Prism::InterpolatedStringNode => :eval_value_container,
+        Prism::InterpolatedSymbolNode => :eval_value_container,
+        Prism::XStringNode => :eval_xstring,
+        Prism::InterpolatedXStringNode => :eval_xstring,
+        Prism::RangeNode => :eval_value_container
       }.freeze
       private_constant :HANDLERS
 
+      # Issue #1223 — the expressions that evaluate every child, in child order, before producing their value, so
+      # a write inside one is threaded child by child ({#thread_operand}). A construct that may skip a child is
+      # left out: a `rescue` modifier has its own handler, and a regexp interpolation with the `o` flag runs its
+      # parts once per process.
+      OPERAND_CONTAINERS = Set[
+        Prism::ArgumentsNode, Prism::KeywordHashNode, Prism::AssocNode, Prism::AssocSplatNode, Prism::SplatNode,
+        Prism::BlockArgumentNode, Prism::ArrayNode, Prism::HashNode, Prism::InterpolatedStringNode,
+        Prism::InterpolatedSymbolNode, Prism::InterpolatedXStringNode, Prism::EmbeddedStatementsNode,
+        Prism::RangeNode
+      ].freeze
+      private_constant :OPERAND_CONTAINERS
+
+      # Statement sequences an operand may hold, threaded statement by statement like a container ({#thread_operand}).
+      OPERAND_SEQUENCES = Set[Prism::StatementsNode, Prism::ParenthesesNode].freeze
+      private_constant :OPERAND_SEQUENCES
+
+      # The keywords of a pass whose scopes the per-node scope index must not keep — neither the nodes it
+      # evaluates nor the later operands an {OperandWalk} inside it takes ({#walk_recorder}).
+      UNRECORDED = { on_enter: nil, operand_recorder: nil }.freeze
+      private_constant :UNRECORDED
+
       # Thread-local sink (an Array) collecting the value types of explicit `return value` nodes reached while
       # evaluating a method body, so `ExpressionTyper#infer_user_method_return` can join them into the method's inferred
       # return type. The flow value of a `return` is still `Bot` (it transfers control rather than producing a value);
@@ -141,9 +194,8 @@ module Rigor
       # evaluating a loop body, so `eval_loop` / `eval_for` can join a `break`-path binding (`flag = true; break`) into
       # the loop continuation that the fall-through would otherwise drop. Stacks like the return sink: a nested loop
       # installs its own sink, restored on exit, so an inner loop's break does not leak to the outer one. A `break`
-      # inside a block / nested loop targets that inner construct, not the lexical loop — filtered out by the
-      # directly-targeting break set, see {#directly_targeting_breaks}. See
-      # docs/notes/20260615-loop-break-binding-propagation-design.md.
+      # inside a block / nested loop targets that inner construct, not the lexical loop — filtered out by the loop's
+      # {JumpTargets} set ({#loop_jumps}). See docs/notes/20260615-loop-break-binding-propagation-design.md.
       BREAK_SINK_KEY = :rigor_break_sink
       private_constant :BREAK_SINK_KEY
 
@@ -162,8 +214,14 @@ module Rigor
 
       # Lexical class frame: the `name:` field is the qualified class name as it would render in Ruby (e.g.,
       # `"Foo::Bar"`); the `singleton:` field is `true` for `class << self` frames so nested defs resolve to
-      # singleton-method RBS lookups.
-      ClassFrame = Data.define(:name, :singleton)
+      # singleton-method RBS lookups. Issue #1120 — `refinement:` is `true` for the frame a `refine X do … end`
+      # block is entered under: its `def`s redefine X's methods, so none of them binds its parameters from X's
+      # RBS signature for the name ({#build_method_entry_scope}).
+      ClassFrame = Data.define(:name, :singleton, :refinement) do
+        def initialize(name:, singleton:, refinement: false)
+          super
+        end
+      end
 
       # Issue #652 — Ruby's `Module.nesting` for the body currently being evaluated, innermost first, built as
       # the walk ENTERS each declaration rather than reconstructed from the qualified name afterwards. A
@@ -193,14 +251,41 @@ module Rigor
       #   assumption (`result *= i` annotating `1 | 2` rather than
       #   `Integer`). Display-path only — `rigor check` leaves it off,
       #   keeping its diagnostics and wall-clock unchanged.
-      def initialize(scope:, tracer: nil, on_enter: nil, class_context: [].freeze,
-                     lexical_nesting: EMPTY_NESTING, converged_loop_recording: false)
+      # @param next_scope_sink — the Array of `[NextNode, Scope]` pairs
+      #   the innermost enclosing block invocation or loop body collects
+      #   its `next` exits into ({#evaluate_invocation},
+      #   {#loop_iteration}), or nil. The scope twin of the thread-local
+      #   `next` VALUE sink, threaded through `sub_eval` instead so an
+      #   evaluation `ExpressionTyper` starts elsewhere — the block-return
+      #   pass, a recursive method's inference — can never feed it a
+      #   `next` from another context. A `->` body's `next` still lands
+      #   here; the consumer filters by node identity.
+      # @param operand_scope — the scope a call's receiver and arguments
+      #   were typed under, when {#eval_call} runs the rest of that call
+      #   from the scope its operands left ({#invoke_call}); nil otherwise,
+      #   where it is the receiver scope itself ({#operand_scope}).
+      # @param in_operand — true for an evaluator {#thread_operand} opened, and every evaluator it opens: the
+      #   calls it runs are inside another expression's operand, which {#invoke_call} leaves the resets of a
+      #   statement-position call out of; the statement that holds the operand answers for its match globals.
+      # @param operand_recorder — the per-node scope index's recorder, for an evaluator {#thread_operand} opened
+      #   (whose own `on_enter` is nil) and every evaluator it opens but an unrecorded pass ({UNRECORDED}), so an
+      #   {OperandWalk} rooted inside an operand still records its later operands ({#walk_recorder}).
+      # @param operand_types — the later operands' own values ({OperandWalk#types}) for the evaluator that runs a
+      #   call from the scope its operands left, read by {#type_operand}.
+      def initialize(scope:, tracer: nil, on_enter: nil, class_context: [].freeze, # rubocop:disable Metrics/ParameterLists
+                     lexical_nesting: EMPTY_NESTING, converged_loop_recording: false, next_scope_sink: nil,
+                     operand_scope: nil, in_operand: false, operand_recorder: nil, operand_types: nil)
         @scope = scope
         @tracer = tracer
         @on_enter = on_enter
         @class_context = class_context.freeze
         @lexical_nesting = lexical_nesting.freeze
         @converged_loop_recording = converged_loop_recording
+        @next_scope_sink = next_scope_sink
+        @operand_scope = operand_scope
+        @in_operand = in_operand
+        @operand_recorder = operand_recorder
+        @operand_types = operand_types
       end
 
       # Runs `block` with a fresh return sink installed, then yields the collected explicit-`return` value types to the
@@ -255,14 +340,77 @@ module Rigor
       # Evaluate `node` under the receiver scope. Returns `[type, scope']` where `type` is the value the node produces
       # and `scope'` is the scope observable after the node has run. The receiver scope is never mutated.
       def evaluate(node)
+        return evaluator_at(@scope.forget_last_line).evaluate(node) if forget_last_line_first?(node)
+
         @on_enter&.call(node, @scope)
 
         handler = HANDLERS[node.class]
-        return send(handler, node) if handler
+        return forget_implicit_call_guards(node, send(handler, node)) if handler
 
         # Default: the node is treated as a pure expression. Type it through the existing expression typer (which
-        # observes the current scope's locals) and leave the scope unchanged.
-        [@scope.type_of(node, tracer: @tracer), @scope]
+        # observes the current scope's locals) and leave the scope unchanged, but for the match globals a call in it
+        # may rebind (`super(line.sub(re, ""))`, issue #1365).
+        [@scope.type_of(node, tracer: @tracer), forget_rebound_specials(@scope, node)]
+      end
+
+      # Issue #1429 — a compound write or a `for` loop calls a method its syntax does not spell (`r += r` calls `r.+`,
+      # `r[0] ||= 1` calls `r.[]` and `r.[]=`, `for x in r` calls `r.each`). When that method may run code that rebinds
+      # a global or constant, the guard narrowings past the node are restored
+      # ({GuardRebinding.implicit_call_may_rebind?}).
+      def forget_implicit_call_guards(node, result)
+        type, after = result
+        return result unless after.is_a?(Scope) && after.guard_narrowed? &&
+                             GuardRebinding.implicit_call_node?(node) &&
+                             GuardRebinding.implicit_call_may_rebind?(node, @scope)
+
+        [type, after.forget_guard_narrowings]
+      end
+
+      # Issue #1359 — the nodes whose handler runs their parts in order, each from the scope the parts before it
+      # left, so a `$_` reader among them forgets it where it runs ({LastLine}) and a read before it keeps the
+      # narrowing.
+      SEQUENCED_NODES = Set[
+        Prism::ProgramNode, Prism::StatementsNode, Prism::ParenthesesNode, Prism::IfNode, Prism::UnlessNode,
+        Prism::WhileNode, Prism::UntilNode, Prism::ForNode, Prism::CaseNode, Prism::CaseMatchNode, Prism::BeginNode,
+        Prism::AndNode, Prism::OrNode, Prism::ElseNode, Prism::WhenNode, Prism::InNode, Prism::RescueNode,
+        Prism::EnsureNode, Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode,
+        Prism::BlockNode, Prism::LambdaNode
+      ].freeze
+      private_constant :SEQUENCED_NODES
+
+      # True when `node` may set `$_` while `$_` is narrowed, and its handler types parts of it from the scope it
+      # starts in rather than threading them: a call's receiver and arguments, a literal's elements, a value a write
+      # stores. A read of `$_` there may run after the reader (`bar(gets, $_)`, `[gets, $_]`, `gets.to_s + $_`), so
+      # the whole node is evaluated with `$_` forgotten, which costs only a read that runs before the reader.
+      def forget_last_line_first?(node)
+        @scope.last_line_bound? && !SEQUENCED_NODES.include?(node.class) && LastLine.may_set?(node, @scope)
+      end
+
+      # One invocation of `block_node`'s body, from the receiver scope (which the caller has already bound the block's
+      # parameters onto). Returns `[type, fall_through, exit]`: the body's tail type, the scope it falls off the end
+      # with, and the scope the invocation ends with.
+      #
+      # A `next` ends the invocation as surely as falling off the end does, so `exit` is `fall_through` joined
+      # (`Scope#join`) with the scope at every `next` that targets this block ({JumpTargets}). Without that join a
+      # rebind on a jumping branch (`if e.odd?; n = e; next; end`) vanished — `eval_if` carries only the arm that falls
+      # through — and both readers of the exit scope, ADR-56's write-back fixpoint ({#block_exit_bindings}) and issue
+      # #587 (b)'s per-element fold (`ExpressionTyper#captured_exit_bindings`), kept the pre-call binding. A `break` is
+      # NOT joined: it ends the call, so its scope feeds no further invocation ({#join_block_break_bindings}).
+      # `fall_through` is exposed for the fold's unmoved-pin test, which must not count what a `next` arm adds.
+      #
+      # A body with no block-level `next` pays one allocation-free scan and nothing else.
+      def evaluate_invocation(block_node)
+        body = block_node.body
+        return [Type::Combinator.constant_of(nil), scope, scope] if body.nil?
+
+        unless JumpTargets.any?(body, Prism::NextNode)
+          type, fall_through = sub_eval(body, scope, next_scope_sink: nil)
+          return [type, fall_through, fall_through]
+        end
+
+        sink = []
+        type, fall_through = sub_eval(body, scope, next_scope_sink: sink)
+        [type, fall_through, join_jump_scopes(fall_through, sink, JumpTargets.of(body, Prism::NextNode))]
       end
 
       # ADR-89 WD2 — the sorted positions of the positional parameters whose CONTENT `def_node` mutates
@@ -275,6 +423,62 @@ module Rigor
         callee_content_mutated_parameters(def_node).values.uniq.sort
       end
 
+      # The local-variable reads among `call_node`'s positional arguments whose matching parameter the callee
+      # content-mutates, when `call_node` is a self-dispatch call resolving to a user def in this evaluator's scope
+      # (`callee_content_mutated_parameters`); empty for any other call. These are the locals the straight-line
+      # callee floor ({#widen_callee_escaped_argument_captures}) floors after the call, and the ones
+      # {CapturedLocals.content_mutations} reports as a block's callee-mutated captures.
+      def content_mutated_arguments(call_node)
+        return NO_ARGUMENT_READS unless self_dispatch_call?(call_node)
+        # Fast path — only a local passed as an argument can be reported, so a call with none skips the def
+        # resolution and the body scan entirely (the overwhelming common case).
+        return NO_ARGUMENT_READS unless call_passes_local_argument?(call_node)
+
+        def_node = resolve_self_callee_def(call_node)
+        return NO_ARGUMENT_READS if def_node.nil?
+
+        mutated = callee_content_mutated_parameters(def_node)
+        return NO_ARGUMENT_READS if mutated.empty?
+
+        argument_nodes = call_node.arguments.arguments
+        mutated.values.uniq.filter_map do |index|
+          argument = argument_nodes[index]
+          argument if argument.is_a?(Prism::LocalVariableReadNode)
+        end
+      end
+
+      NO_ARGUMENT_READS = [].freeze
+      private_constant :NO_ARGUMENT_READS
+
+      # The value `h[k] += v` / `h[k] ||= v` / `h[k] &&= v` evaluates to in this evaluator's scope: what it stores
+      # through `[]=` ({#index_write_stored_type}). The `[]=` widening and the indexed-narrowing record are scope
+      # effects, so they stay with {#eval_index_or_write} / {#eval_index_write}. `ExpressionTyper` types a
+      # value-position index compound write from here.
+      #
+      # One reading departs from the statement's: a `||=` whose `[]` read is wholly gradual (`Dynamic`, not a
+      # union with a `Dynamic` member) reads as the rvalue. That is the memoization idiom — `CACHE[key] ||=
+      # build(key)`, `(@memo ||= {})[[a, b]] ||= compute`, `@targets[name] ||= new(name)` on an ivar the method
+      # never writes — where the value the idiom returns is the one it stores, and `Dynamic[top] | rhs` sent
+      # every such method to `sig.skipped.untyped-return`. It is the variable form's optimism for an unbound `||=`
+      # target (`ExpressionTyper#type_of_compound_variable_write`) keyed on the slot, and no wider: `&&=` is no
+      # memo (`h[k] &&= v` on an absent slot is `nil`), an operator write has no such reading, and an rvalue
+      # with no truthy part stores nothing truthy, so the slot's own value is the answer whenever it is set:
+      # `opts[k] ||= raise KeyError` is a guard, never `bot`, and `@flags[n] ||= false` is `true` after an
+      # `@flags[n] = true` elsewhere, never provably `false`.
+      #
+      # Nor is a site a block-return pass marked (`Scope#repeated_or_write?`, {RepeatedOrWrites}): the pass types
+      # every run of a repeating body from one entry scope, so its slot's gradual type may be what an EARLIER run
+      # stored rather than an absence of evidence.
+      def index_compound_write_value(node)
+        return index_write_stored_type(node, scope) unless node.is_a?(Prism::IndexOrWriteNode)
+
+        current = index_read_type(node, scope)
+        rhs = scope.type_of(node.value, tracer: tracer)
+        return rhs if memoizing_index_read?(node, current, rhs)
+
+        index_write_stored_type(node, scope, current: current, rhs: rhs)
+      end
+
       private
 
       attr_reader :scope, :tracer
@@ -282,11 +486,16 @@ module Rigor
       # Thread the scope through every child statement in declaration order. The body's value is the type of the last
       # statement (or `Constant[nil]` for an empty body); intermediate statements' types are discarded, but their scope
       # effects are preserved.
+      #
+      # Inside a retrying `begin`'s primary body, each statement's post-scope is also a point the body can raise from
+      # ({#record_raise_points}).
       def eval_statements(node)
         result_type = Type::Combinator.constant_of(nil)
         current = scope
+        raising = Thread.current[RETRY_FRAMES_KEY]
         node.body.each do |stmt|
           result_type, current = sub_eval(stmt, current)
+          record_raise_points(raising, stmt, current) if raising
         end
         [result_type, current]
       end
@@ -321,8 +530,8 @@ module Rigor
         # computed on the RHS *value*'s provenance — a pure ivar read of a currently declaration-sourced ivar — so it
         # survives the local copy. Any other RHS (a call result, a method-local-nil-bearing value) leaves the local
         # flow-live and the diagnostic fires as before.
-        return post_rhs.with_declaration_sourced_local(node.name, rhs_type) if
-          declaration_sourced_ivar_read?(node.value, post_rhs)
+        copied = declaration_sourced_copy(node, rhs_type, post_rhs)
+        return copied if copied
 
         bound = post_rhs.with_local(node.name, rhs_type)
         # ADR-67 WD6b — a local whose RHS is (transitively) rooted at an inferred parameter inherits the
@@ -335,7 +544,10 @@ module Rigor
 
         bound = bound.without_inferred_param_mark(node.name)
         bound = bound.with_local_origin(node.name, rhs_origin(node.value, post_rhs, rhs_type))
-        bound.with_optimistic_local(node.name, optimistic_rhs_origin(node.value, post_rhs))
+        cause = optimistic_rhs_origin(node.value, post_rhs)
+        return bound if cause.nil?
+
+        bound.with_optimistic_local(node.name, cause, miss: optimistic_rhs_miss(node.value, post_rhs))
       end
 
       # Issue #667 — true when this write copies a value whose constancy rests on a foreign published
@@ -358,6 +570,13 @@ module Rigor
         optimistic_origin_for(value_node, scope_after_rhs)
       end
 
+      # Issue #1302 — what the value a marked write binds answers on a miss, recorded beside the mark so a predicate
+      # read through the binding widens only as far as the inline form does: `x = recv&.empty?; !x` keeps its
+      # `true`, while `v = h[k]; v.nil?` still widens. Asked only once {#optimistic_rhs_origin} found a mark.
+      def optimistic_rhs_miss(value_node, scope_after_rhs)
+        Inference::OptimisticOrigin.miss_answer(value_node, scope_after_rhs)
+      end
+
       # The effective optimistic-nil-free cause of an expression. {Inference::OptimisticOrigin.resolve} owns
       # the judgment — the mark on the node itself, the binding a bare local / ivar read resolves through, and
       # the predicate-fold derivation of issue #313.
@@ -375,6 +594,22 @@ module Rigor
         scope_after_rhs.dynamic_origins[value_node]
       end
 
+      # The scope binding the written local with ADR-58's `:local` mark when the write copies a declaration-sourced
+      # value, or nil. Issue #1362 — a read of a global still on its declared seed counts as an ivar read does, bare
+      # or parenthesised (`sep = $/`, `sep = ($/)`), and so does a bare read of a local that copies one (`s = sep`);
+      # the local also records the global it copies, which the consumers compare against the file's own writes to it
+      # ({Analysis::CheckRules::DeclarationSourcedGuard.copied_globals}).
+      def declaration_sourced_copy(node, rhs_type, post_rhs)
+        value = node.value
+        return post_rhs.with_declaration_sourced_local(node.name, rhs_type) if
+          declaration_sourced_ivar_read?(value, post_rhs)
+
+        globals = Analysis::CheckRules::DeclarationSourcedGuard.copied_globals(value, post_rhs)
+        return nil if globals.empty?
+
+        post_rhs.with_declaration_sourced_local(node.name, rhs_type).with_global_copy_marks(node.name, globals)
+      end
+
       # True when `value_node` is a bare instance-variable read whose binding in `scope_at_read` is currently marked
       # declaration-sourced.
       def declaration_sourced_ivar_read?(value_node, scope_at_read)
@@ -392,7 +627,8 @@ module Rigor
         rhs_type, post_rhs = sub_eval(node.value, scope)
         bound = post_rhs.with_ivar(node.name, rhs_type)
         bound = bound.with_ivar_origin(node.name, rhs_origin(node.value, post_rhs, rhs_type))
-        bound = bound.with_optimistic_ivar(node.name, optimistic_rhs_origin(node.value, post_rhs))
+        cause = optimistic_rhs_origin(node.value, post_rhs)
+        bound = bound.with_optimistic_ivar(node.name, cause, miss: optimistic_rhs_miss(node.value, post_rhs)) if cause
         # Issue #667 — the ivar twin of the local stamp. This is the SAME-method half; the cross-method one
         # (`@mode = AppConfig::MODE` in `initialize`, read in a sibling) rides the class-ivar census and is
         # stamped by {#seed_instance_ivars}.
@@ -423,15 +659,38 @@ module Rigor
       # `attr_reader`, the very macro #319 silenced at every other position); inside a module, the module's own
       # `self` — a wrong receiver for every implicit-self call in the body.
       def eval_constant_write(node)
-        result = [scope.type_of(node, tracer: tracer), scope]
-        context = meta_new_constant_body_context(node)
+        after = forget_constant_guard(forget_rebound_specials(scope, node.value), node)
+        result = [scope.type_of(node, tracer: tracer), after]
+        call_node = meta_new_block_call(node)
+        return result if call_node.nil?
+
+        context = meta_new_constant_body_context(node, call_node)
         return result if context.nil?
 
-        call_node = node.value
         enter_meta_class_body(call_node.block, build_block_entry_scope(call_node, call_node.block), context)
         result
       end
 
+      # Issue #1429 — a write to a constant ends a guard's narrowing of every spelling that may name it: `Foo::BAR =
+      # nil` inside `module Foo` writes the constant `BAR` reads, so each narrowing whose last segment is the written
+      # name is dropped, whatever its prefix.
+      def forget_constant_guard(after, node)
+        return after if after.constant_narrowings.empty?
+
+        target = node.respond_to?(:target) ? node.target : node
+        after.without_constant_narrowings_named(target.name.to_s)
+      end
+
+      # The rvalue call whose block is the class body, for every spelling of the write. Issue #963: the `.freeze`
+      # tail and the `||=` / `Const = Const || …` guard are unwrapped by {ScopeIndexer.meta_new_rvalue}, the same
+      # recognition the index walks under, so the two passes enter the same node or neither does. The recognition
+      # is still the loose one — a CallNode carrying a literal block — because the strict-argument shapes the
+      # index declines are entered under an anonymous name rather than dropped.
+      def meta_new_block_call(node)
+        rvalue = ScopeIndexer.meta_new_rvalue(node)
+        rvalue if rvalue.is_a?(Prism::CallNode) && rvalue.block.is_a?(Prism::BlockNode)
+      end
+
       # The class context a meta-new rvalue block is entered under, or nil when the rvalue is not that shape. The
       # KEY must be the one `ScopeIndexer` filed the body's defs and member layout under, so the two passes agree —
       # which is why the decision is delegated to the ScopeIndexer's own recognition rather than re-spelled here. A
@@ -440,10 +699,7 @@ module Rigor
       # — the path spelling included since [#703](https://github.com/rigortype/rigor/issues/703). A shape the
       # ScopeIndexer's stricter argument check rejects (`Const = Struct.new(*names) do … end`) is registered under
       # the call site's anonymous name and is entered under that.
-      def meta_new_constant_body_context(node)
-        call_node = node.value
-        return nil unless call_node.is_a?(Prism::CallNode) && call_node.block.is_a?(Prism::BlockNode)
-
+      def meta_new_constant_body_context(node, call_node)
         constant = meta_new_constant_context(node)
         return constant if constant
 
@@ -459,9 +715,9 @@ module Rigor
         return nil unless ScopeIndexer.meta_new_block_body(node)
 
         case node
-        when Prism::ConstantWriteNode
+        when Prism::ConstantWriteNode, Prism::ConstantOrWriteNode
           @class_context + [ClassFrame.new(name: node.name.to_s, singleton: false)]
-        when Prism::ConstantPathWriteNode
+        when Prism::ConstantPathWriteNode, Prism::ConstantPathOrWriteNode
           frame = ClassFrame.new(name: Source::ConstantPath.qualified_name(node.target), singleton: false)
           Source::ConstantPath.rooted?(node.target) ? [frame] : @class_context + [frame]
         end
@@ -584,11 +840,15 @@ module Rigor
       # The expression value is the result type, matching Ruby's semantics: `(x = params[:f] ||= []); x` observes the
       # post-`||=` value, not the rvalue alone.
       def eval_index_or_write(node)
-        rhs_type, post_rhs = sub_eval(node.value, scope)
-        current_type = scope.type_of(node, tracer: tracer)
-        result_type = Type::Combinator.union(Narrowing.narrow_truthy(current_type), rhs_type)
-
-        key_node = first_index_argument(node)
+        _rhs_type, post_rhs = sub_eval(node.value, scope)
+        result_type = index_write_stored_type(node, scope)
+
+        # A narrowing is keyed on ONE literal slot — `a[k]` — but a multi-index `||=` reads and
+        # stores a splice REGION (`a[0, 1] ||= v`), so keying the result on the first index would
+        # record `a[0]`'s type as the region answer: `a[0, 1] ||= []` would claim `a[0]` non-nil
+        # where the store splices nothing and `a[0]` stays nil at runtime. Decline the record for
+        # any form but the single-index one.
+        key_node = single_index_argument(node)
         address = key_node && IndexedNarrowing.stable_address(node.receiver, key_node)
         # Issue #544 — a receiver with an untracked (Dynamic / Top) constituent can hold a caller-supplied
         # slot value the `||=` keeps, so the recorded default would invent a fact; decline the record.
@@ -601,36 +861,106 @@ module Rigor
                                         arg_types: index_write_arg_types(node, result_type))
         post = post.with_indexed_narrowing(*address, result_type) if address
 
-        [result_type, post]
+        [result_type, forget_rebound_specials(post, node)]
       end
 
       # `h[k] &&= v` / `h[k] += v`. Neither had a handler, so both fell to `evaluate`'s default — typed as a pure
       # expression, scope untouched — and the receiver never widened. They store through `[]=` exactly as
-      # `eval_index_or_write` does, so they take the same widening; the value itself is still typed by the expression
-      # typer (`type_of_assignment_write`), which is what the default did.
+      # `eval_index_or_write` does, so they take the same widening; the stored value is the compound result —
+      # `falsey(h[k]) | v` for `&&=`, the dispatched `h[k] + v` for `+=` — not the rvalue alone.
       def eval_index_write(node)
-        stored = scope.type_of(node, tracer: tracer)
-        [stored,
-         IndexWriteWidening.widen(node: node, current_scope: scope,
-                                  arg_types: index_write_arg_types(node, stored))]
-      end
-
-      # `[key_type, stored_value_type]` for an index-write node, shaped exactly like a `[]=` call's
-      # argument list so the widening seam can join it the same way (issue #560). The stored value is
-      # the node's OWN expression type — for `t[0] += 5` that is the compound machinery's already-computed
-      # `t[0] + 5`, which is the whole point: it is the value the mutation put in the slot, and the one
-      # the retained element evidence provably no longer covers. Returns `[]` when the key is unresolvable,
-      # which reproduces the pre-join widening.
+        _rhs_type, post_rhs = sub_eval(node.value, scope)
+        stored = index_write_stored_type(node, scope)
+        widened = IndexWriteWidening.widen(node: node, current_scope: post_rhs,
+                                           arg_types: index_write_arg_types(node, stored))
+        [stored, forget_rebound_specials(widened, node)]
+      end
+
+      # `[index_type..., stored_value_type]` for an index-write node, shaped exactly like a `[]=`
+      # call's argument list so the widening seam can join it the same way (issue #560) — a
+      # two-index compound write (`a[0, 1] += v`) keeps BOTH index arguments ahead of the stored
+      # value, which is what lets the join read it as a splice (issue #1140). The stored value is
+      # what the write put in the slot — for a compound write {#index_write_stored_type}'s
+      # compound result (`t[0] += 5` stores the already-computed `t[0] + 5`), for an index target
+      # the value its owner stores (the slot {MultiTargetBinder} decomposed, the `for` element, the
+      # rescued exception) — which is the whole point: it
+      # is the value the retained element evidence provably no longer covers. Returns `[]` when the
+      # key is unresolvable, which reproduces the pre-join widening.
+      # The index arguments are typed, and the receiver's joinability read, in `type_scope`: the
+      # evaluator's entry scope by default; a `for` index passes its post-collection scope and a
+      # rescue reference its arm's entry scope, the nearest the engine has to where Ruby evaluates
+      # them (each iteration, the moment of the catch).
       # There is deliberately NO `rescue` here. `Scope#type_of` is a total query over well-formed Prism input,
       # so a raise is an engine bug, and swallowing it would silently downgrade a live seam to "no evidence" —
       # the join would quietly stop happening with nothing to show for it. Let it reach the runner's
       # internal-error path, where it is visible.
-      def index_write_arg_types(node, stored_type)
-        key_node = first_index_argument(node)
-        return MutationWidening::NO_ARG_TYPES if key_node.nil? || stored_type.nil?
-        return MutationWidening::NO_ARG_TYPES unless MutationWidening.joinable_receiver?(node.receiver, scope)
+      def index_write_arg_types(node, stored_type, type_scope: scope)
+        args = node.arguments
+        return MutationWidening::NO_ARG_TYPES if args.nil? || stored_type.nil?
+        return MutationWidening::NO_ARG_TYPES unless MutationWidening.joinable_receiver?(node.receiver, type_scope)
+
+        list = args.respond_to?(:arguments) ? args.arguments : args
+        # A splat argument is marked `nil` — its expansion decides the store's arity at
+        # runtime, which an untyped index type could not express (issue #1140).
+        list.map { |arg| arg.is_a?(Prism::SplatNode) ? nil : type_scope.type_of(arg, tracer: tracer) } + [stored_type]
+      end
+
+      # What a compound index write stores through `[]=` — `a[i] ||= v` stores `truthy(a[i]) | v`,
+      # `a[i] &&= v` stores `falsey(a[i]) | v`, and `a[i] op= v` stores the dispatched `a[i] op v`:
+      # `a[0, 1] += [2]` reads `a[0, 1] + [2]`, not `[2]` (issue #1140). It is also the node's value
+      # outside {#index_compound_write_value}'s memoizing `||=`. That method passes the `current` read
+      # and the `rhs` it already typed, so a nested `(a[i] ||= {})[j] ||= v` chain types each level's
+      # receiver once rather than doubling per level. Any other node falls back to its own type (an
+      # index target — a multi-assign slot, a `for` index, a rescue reference — keeps its untyped
+      # answer).
+      def index_write_stored_type(node, type_scope, current: nil, rhs: nil)
+        case node
+        when Prism::IndexOrWriteNode, Prism::IndexAndWriteNode
+          current ||= index_read_type(node, type_scope)
+          narrowed = if node.is_a?(Prism::IndexOrWriteNode)
+                       Narrowing.narrow_truthy(current)
+                     else
+                       Narrowing.narrow_falsey(current)
+                     end
+          Type::Combinator.union(narrowed, rhs || type_scope.type_of(node.value, tracer: tracer))
+        when Prism::IndexOperatorWriteNode
+          MethodDispatcher.dispatch(
+            receiver_type: index_read_type(node, type_scope), method_name: node.binary_operator,
+            arg_types: [type_scope.type_of(node.value, tracer: tracer)],
+            environment: type_scope.environment
+          ) || Type::Combinator.untyped
+        else
+          type_scope.type_of(node, tracer: tracer)
+        end
+      end
+
+      # True when {#index_compound_write_value} reads the `||=` `node` as the memoization idiom's rvalue: the slot
+      # reads wholly gradual, the rvalue can store something truthy, and no block-return pass marked the site.
+      def memoizing_index_read?(node, current, rhs)
+        current.is_a?(Type::Dynamic) && !Narrowing.narrow_truthy(rhs).is_a?(Type::Bot) &&
+          !scope.repeated_or_write?(node)
+      end
+
+      # The `receiver[i]` read a compound index write performs before storing — the `[]` read on the
+      # receiver's own type with the write's index arguments (a splat reads untyped), refined by a
+      # recorded indexed narrowing when the single-index form names a stable slot. The read takes the
+      # tiers a plain `receiver[i]` call does ({ExpressionTyper#implicit_index_read_type}), so a project
+      # `[]` with no signature answers from its body.
+      def index_read_type(node, read_scope)
+        receiver = read_scope.type_of(node.receiver, tracer: tracer)
+        args = node.arguments
+        list = args.respond_to?(:arguments) ? args.arguments : Array(args)
+        index_types = list.map do |arg|
+          arg.is_a?(Prism::SplatNode) ? Type::Combinator.untyped : read_scope.type_of(arg, tracer: tracer)
+        end
+
+        key = single_index_argument(node)
+        address = key && IndexedNarrowing.stable_address(node.receiver, key)
+        narrowed = address && read_scope.indexed_narrowing(*address)
+        return narrowed if narrowed
 
-        [scope.type_of(key_node, tracer: tracer), stored_type]
+        typer = ExpressionTyper.new(scope: read_scope, tracer: tracer)
+        typer.implicit_index_read_type(node, receiver, index_types) || Type::Combinator.untyped
       end
 
       # Argument types for a straight-line content mutator (`arr << x`, `h[k] = v`).
@@ -659,22 +989,28 @@ module Rigor
         ElementReadWidening.widen_element_read(call_node: call_node, current_scope: widened, arg_types: arg_types)
       end
 
+      # `tr!` / `tr_s!` are typed too: whether they can empty a `non-empty-string` turns on their replacement argument.
       def mutator_arg_types(call_node, current_scope)
-        return MutationWidening::NO_ARG_TYPES unless ContentJoin::CONTENT_ADDERS.include?(call_node.name)
+        unless ContentJoin::CONTENT_ADDERS.include?(call_node.name) || StringMutation::TRANSLATORS.include?(call_node.name)
+          return MutationWidening::NO_ARG_TYPES
+        end
         unless MutationWidening.joinable_receiver?(call_node.receiver, current_scope) ||
                ElementReadWidening.joinable_element_read?(call_node.receiver, current_scope)
           return MutationWidening::NO_ARG_TYPES
         end
 
-        content_arg_types(call_node, scope)
+        content_arg_types(call_node, operand_scope, @operand_types)
       end
 
-      def first_index_argument(node)
+      # The index node of an index-write when it holds exactly one index argument — the only form
+      # whose stored value lands on a nameable slot (`a[k]`). Multi-index forms address a splice
+      # region and answer `nil`.
+      def single_index_argument(node)
         args = node.arguments
         return nil if args.nil?
 
         list = args.respond_to?(:arguments) ? args.arguments : args
-        list.first
+        list.size == 1 ? list.first : nil
       end
 
       def dispatch_operator(current, rhs, operator)
@@ -690,13 +1026,94 @@ module Rigor
       # `a, b = rhs` — Slice 5 phase 2 sub-phase 2 destructuring. Evaluates the right-hand side under the entry scope,
       # then decomposes its type against the multi-write target tree (Prism::MultiWriteNode#lefts/rest/rights, including
       # nested Prism::MultiTargetNode for the `(b, c)` form). Tuple-shaped right-hand sides produce per-slot types
-      # element-wise; other carriers fall back to `Dynamic[Top]` per slot. The expression value is the right-hand side
-      # type (matching Ruby's semantics: `(a, b = [1, 2])` evaluates to `[1, 2]`).
+      # element-wise, an `Array[T]` binds each fixed slot to `T` with the optimistic-nil-free mark (issue #1093), a
+      # union distributes over its members and a value with no implicit `to_ary` binds as `[rhs]` (issue #1094), and
+      # other carriers fall back to `Dynamic[Top]` per slot. Instance-variable targets bind by the same rules, with the
+      # optimistic mark recorded per ivar (issue #1110). A right-hand side that is itself optimistically nil-free
+      # (`k, v = pairs.first`, or a local bound to one) marks every name it binds, and a literal one
+      # (`x, y = pairs.first, 1`) marks each slot by its element: a miss binds `nil` to every such slot
+      # ({Inference::OptimisticOrigin.destructuring_marks}). The expression value is the right-hand side type
+      # (matching Ruby's semantics: `(a, b = [1, 2])` evaluates to `[1, 2]`).
+      #
+      # An index target (`h[:a], z = 1, 2`, nested or splatted too) stores its slot through `[]=`, so its receiver
+      # widens here exactly as the plain store `h[:a] = 1` widens it, joining the slot's value as content evidence
+      # (issue #560) — otherwise the literal survives and a later `h[:a] == 0` folds on its stale `0`. The widening
+      # runs AFTER the bindings: Ruby evaluates a target's receiver before any target is assigned, so
+      # `h, h[:a] = h, 1` stores into the object `h` is bound to afterwards, and widening first would let the
+      # binding of `h` restore the literal. When a target rebinds the receiver's variable to another object
+      # instead, widening that one only loses precision.
+      #
+      # The stored value is the slot the binder decomposed, softened as a local in the same position is. The
+      # ADR-57 softening that drops a slot's `nil` is honest for a local because of the optimistic mark, which a
+      # stored value never carries — but it does not need one here: the straight-line join always adds the
+      # `Dynamic[top]` floor ({MutationWidening#gradual_floor}), so no fold can rest on the dropped `nil`. Joining
+      # the `nil` instead would fire `call.possible-nil-receiver` on the correlated guard the softening exists for,
+      # `r[:k], r[:v] = h.find { … }; r[:v].upcase if r[:k]`.
+      #
+      # Each store then drops the indexed narrowing it overwrites, through the same
+      # {IndexedNarrowing.invalidate_indexed_write} a `[]=` call takes (it reads only `receiver` and `arguments`,
+      # which an index target shares): the widening carries a Nominal receiver's slot narrowings across its
+      # rebind, so `m[:a] ||= "d"; m[:a], y = 1, 2` would otherwise keep reading `"d"`.
       def eval_multi_write(node)
         rhs_type, post_rhs = sub_eval(node.value, scope)
-        bindings = MultiTargetBinder.bind(node, rhs_type)
-        post = bindings.reduce(post_rhs) { |acc, (name, type)| acc.with_local(name, type) }
-        [rhs_type, post]
+        marks = Inference::OptimisticOrigin.destructuring_marks(node.value, post_rhs)
+        bound = MultiTargetBinder.bind_marked(node, rhs_type, optimistic: marks, scope: post_rhs)
+        miss = marks == false ? nil : Inference::OptimisticOrigin.destructuring_miss(node.value, post_rhs)
+        post = widen_index_targets(bound, bound.apply_to(post_rhs, miss: miss), type_scope: scope)
+        [rhs_type, widen_attribute_targets(node, post)]
+      end
+
+      # `recv.attr ||= v` / `&&=` / `op=` calls the writer `attr=` on `recv`, so a writer the mutation widening
+      # responds to widens the receiver as the plain call does: `h.default ||= 0` reopens `h` as `h.default = 0`
+      # does ({HashLookupMutation}). The node's value is typed as before; the widening is its only scope effect.
+      def eval_attribute_compound_write(node)
+        widened = widen_attribute_write(node.receiver, node.write_name, scope)
+        [scope.type_of(node, tracer: tracer), forget_rebound_specials(widened, node)]
+      end
+
+      # The scope effect of calling the writer `writer` on `receiver` outside a `CallNode`: the receiver widening, and
+      # the receiver-wide drop of recorded `receiver[key]` narrowings `IndexedNarrowing` makes after a mutator call.
+      def widen_attribute_write(receiver, writer, current_scope)
+        widened = MutationWidening.widen_receiver_aliases(receiver, writer, current_scope)
+        stable = IndexedNarrowing.stable_receiver(receiver)
+        return widened unless stable && IndexedNarrowing.mutator?(writer)
+
+        widened.without_indexed_narrowings_for(*stable)
+      end
+
+      # The attribute targets of a multi-write (`h.default, x = 0, 1`), nested ones included, each widening its
+      # receiver as the plain writer call would.
+      def widen_attribute_targets(node, post)
+        targets = [*node.lefts, node.rest, *node.rights]
+        targets.reduce(post) do |acc, target|
+          target = target.expression if target.is_a?(Prism::SplatNode)
+          case target
+          when Prism::CallTargetNode then widen_attribute_write(target.receiver, target.name, acc)
+          when Prism::MultiTargetNode then widen_attribute_targets(target, acc)
+          else acc
+          end
+        end
+      end
+
+      # Widens the receiver of every index target a {MultiTargetBinder} result reports, over the scope its bindings
+      # were applied to — the multi-write and the `for a, h[:k] in pairs` index share it.
+      def widen_index_targets(bound, post, type_scope:)
+        bound.index_targets.reduce(post) do |acc, (target, stored)|
+          widen_index_target(target, stored, acc, type_scope: type_scope)
+        end
+      end
+
+      # An index target (`Prism::IndexTargetNode`) stores `stored` through `[]=` on its receiver wherever it
+      # appears — a multi-assign slot, a `for` index, a rescue reference — so its receiver widens exactly as the
+      # plain store `h[:a] = v` widens it, joining `stored` as content evidence (issue #560), and drops the
+      # `h[:a] ||= default` narrowing on the slot it overwrote, as `eval_call` drops it after a `[]=` — the
+      # widening carries slot narrowings across the rebind, so without the drop `h[:a]` keeps reading the default.
+      # `type_scope` types the index arguments and gates the evidence (`joinable_receiver?`); `current_scope` is
+      # the one widened.
+      def widen_index_target(target, stored, current_scope, type_scope:)
+        widened = IndexWriteWidening.widen(node: target, current_scope: current_scope,
+                                           arg_types: index_write_arg_types(target, stored, type_scope: type_scope))
+        IndexedNarrowing.invalidate_indexed_write(target, widened)
       end
 
       # `if pred; t; (elsif/else)?` runs the predicate first (its post-scope is shared by both branches), then asks
@@ -706,26 +1123,23 @@ module Rigor
       # phase 2 behaviour. The branches' result types are unioned; their post-scopes are joined with nil-injection on
       # half-bound names so a name set in one branch but not the other is observable as `T | nil` after the if.
       def eval_if(node)
-        pred_type, post_pred = sub_eval(node.predicate, scope)
+        pred_type, post_pred, truthy_scope, falsey_scope = eval_with_edges(node.predicate, scope)
 
         # When the predicate is a known-truthy / known-falsey type (notably `Constant[true]` / `Constant[false]` after
         # the constant-fold tier), only the live branch contributes a type and a post-scope. The dead branch is skipped
         # so the result type is precise (`Constant[:even]` instead of the joined `Constant[:even] | Constant[:odd]`).
-        live = live_branch_for_if(node, pred_type, post_pred)
+        live = live_branch_for_if(node, pred_type, post_pred, truthy_scope, falsey_scope)
         if live
           live_type, _live_scope = live
           # When the provably-live then-branch terminates and there is no else, apply the same falsey-scope narrowing as
           # the standard early-return path below. Without this, `return if @ivar.nil?` with an ivar seeded as
           # Constant[nil] (making nil? = Constant[true] and the then-branch "provably live") propagates the un-narrowed
           # nil scope past the guard instead of Bot.
-          if branch_terminates?(node.statements, live_type) && node.subsequent.nil?
-            _, falsey_scope = Narrowing.predicate_scopes(node.predicate, post_pred)
-            return [live_type, falsey_scope]
-          end
+          return [live_type, falsey_scope] if branch_terminates?(node.statements, live_type) && node.subsequent.nil?
+
           return live
         end
 
-        truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, post_pred)
         then_type, then_scope = eval_branch_or_nil(node.statements, truthy_scope)
         else_type, else_scope = eval_branch_or_nil(node.subsequent, falsey_scope)
         # Slice 7 phase 14 — early-return narrowing. When the then-branch unconditionally exits (return / next / break /
@@ -754,22 +1168,19 @@ module Rigor
       # chain). The narrower's truthy/falsey edges are routed in swapped form because `unless` runs its body when the
       # predicate is falsey.
       def eval_unless(node)
-        pred_type, post_pred = sub_eval(node.predicate, scope)
+        pred_type, post_pred, truthy_scope, falsey_scope = eval_with_edges(node.predicate, scope)
 
-        live = live_branch_for_unless(node, pred_type, post_pred)
+        live = live_branch_for_unless(node, pred_type, post_pred, truthy_scope, falsey_scope)
         if live
           live_type, _live_scope = live
           # Mirror of the eval_if fix: when the provably-live unless-body terminates and there is no else, apply the
           # truthy-scope narrowing so `return unless @ivar` with a nil-seeded ivar doesn't propagate the nil scope past
           # the guard.
-          if branch_terminates?(node.statements, live_type) && node.else_clause.nil?
-            truthy_scope, = Narrowing.predicate_scopes(node.predicate, post_pred)
-            return [live_type, truthy_scope]
-          end
+          return [live_type, truthy_scope] if branch_terminates?(node.statements, live_type) && node.else_clause.nil?
+
           return live
         end
 
-        truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, post_pred)
         then_type, then_scope = eval_branch_or_nil(node.statements, falsey_scope)
         else_type, else_scope = eval_branch_or_nil(node.else_clause, truthy_scope)
         # Slice 7 phase 14 — same early-return narrowing as `if`: when the body unconditionally exits and there is no
@@ -792,20 +1203,29 @@ module Rigor
       # the caller falls through to the standard both-branch evaluation. Constant `true`/`false` is the obvious trigger;
       # non-falsey carriers like `Nominal[Integer]` (Integer is always truthy in Ruby — including 0) also collapse the
       # dead else.
-      def live_branch_for_if(node, pred_type, post_pred)
+      def live_branch_for_if(node, pred_type, post_pred, truthy_scope, falsey_scope)
+        truthy_scope, falsey_scope = live_branch_scopes(node.predicate, post_pred, truthy_scope, falsey_scope)
         case branch_certainty(node.predicate, pred_type, post_pred)
-        when :truthy then eval_branch_or_nil(node.statements, post_pred)
-        when :falsey then eval_branch_or_nil(node.subsequent, post_pred)
+        when :truthy then eval_branch_or_nil(node.statements, truthy_scope)
+        when :falsey then eval_branch_or_nil(node.subsequent, falsey_scope)
         end
       end
 
-      def live_branch_for_unless(node, pred_type, post_pred)
+      def live_branch_for_unless(node, pred_type, post_pred, truthy_scope, falsey_scope)
+        truthy_scope, falsey_scope = live_branch_scopes(node.predicate, post_pred, truthy_scope, falsey_scope)
         case branch_certainty(node.predicate, pred_type, post_pred)
-        when :truthy then eval_branch_or_nil(node.else_clause, post_pred)
-        when :falsey then eval_branch_or_nil(node.statements, post_pred)
+        when :truthy then eval_branch_or_nil(node.else_clause, truthy_scope)
+        when :falsey then eval_branch_or_nil(node.statements, falsey_scope)
         end
       end
 
+      # A provably-live branch runs from the post-predicate scope, un-narrowed, except under an `&&` / `||` whose right
+      # operand writes ({#eval_with_edges}): there the joined scope still reads the write as possibly `nil`, and the
+      # live edge is the one on which the right operand ran (`if text && (w = text.size)` with `text` a String).
+      def live_branch_scopes(predicate, post_pred, truthy_scope, falsey_scope)
+        and_or_right_effects?(predicate) ? [truthy_scope, falsey_scope] : [post_pred, post_pred]
+      end
+
       # ADR-47 WD5 — a decidable **version guard** answers first (#627). `RUBY_VERSION >= "3.1"` and the
       # `Gem::Version.new(…) <cmp> Gem::Version.new(…)` spellings fold from literals the analyzer can read, so the arm
       # that cannot run on the Ruby being checked with is elided exactly as `if false`'s is: it is never evaluated, so
@@ -843,8 +1263,12 @@ module Rigor
       # shared with every branch (including the else); branches are evaluated independently and merged with
       # nil-injection so half-bound names degrade to `T | nil`.
       def eval_case(node)
-        post_pred = node.predicate ? sub_eval(node.predicate, scope).last : scope
-        branch_results, falsey_scope = eval_case_when_branches(node.predicate, node.conditions, post_pred)
+        subject_type, post_pred = node.predicate ? sub_eval(node.predicate, scope) : [nil, scope]
+        branch_results, falsey_scope = eval_case_when_branches(subject_type, node.predicate, node.conditions, post_pred)
+        if pattern_case_matches_every_path?(node, branch_results)
+          return unmatched_pattern_result(branch_results, node.conditions)
+        end
+
         else_result = eval_case_else(node.else_clause, falsey_scope)
 
         all_results = [*branch_results, else_result]
@@ -855,6 +1279,21 @@ module Rigor
         ]
       end
 
+      # Issue #1122 — a `case/in` with no `else` has no "nothing matched" path: CRuby raises
+      # `NoMatchingPatternError` when no pattern matches, so the continuation is reached only through a
+      # matched clause. The shared `else` arm would inject that impossible path anyway — `Constant[nil]`
+      # for the type and the entry scope for the continuation, which nil-injects every pattern-bound name.
+      # `case [1, "a"] in [i, s] then i end; i + 1` then read as `i + 1` on `1 | nil` and drew a false
+      # `possible nil receiver` on a name bound on every path that reaches it. A `case/when` keeps the
+      # arm: a subject matching no clause really does fall through as `nil`.
+      def pattern_case_matches_every_path?(node, branch_results)
+        node.is_a?(Prism::CaseMatchNode) && node.else_clause.nil? && !branch_results.empty?
+      end
+
+      def unmatched_pattern_result(branch_results, branch_nodes)
+        [Type::Combinator.union(*branch_results.map(&:first)), join_case_branch_scopes(branch_results, branch_nodes)]
+      end
+
       # Joins the post-scopes of every `when`/`in`/`else` branch, dropping the scope of any branch that terminates
       # (raises / returns / throws / types to `Bot`) before the merge — control never falls through such a branch, so
       # its half-bound locals must not nil-inject the names a live sibling branch assigned. Mirrors the
@@ -872,22 +1311,31 @@ module Rigor
         reduce_scopes_with_nil_injection(live)
       end
 
-      def eval_case_when_branches(subject, conditions, entry_scope)
+      def eval_case_when_branches(subject_type, subject, conditions, entry_scope)
         results = []
         falsey_scope = entry_scope
         conditions.each do |branch|
+          # Issue #1359 — a clause's conditions, or its pattern's pins and guard, run before its body and before
+          # every later clause, and the walk types them without evaluating them, so a reader there forgets `$_` here.
+          falsey_scope = LastLine.forget_if_set(falsey_scope, *clause_tests(branch))
           # ADR-47 WD2 — record the scope ENTERING this clause (the subject narrowed by every earlier clause's negation)
           # on the clause's first condition node, so `flow.unreachable-clause` can tell a prior-exhausted subject (entry
           # already `bot`) from a per-clause-disjoint one (entry concrete, this clause disjoint). `on_enter`-only (no
           # recursion) so no condition sub-expression is newly typed; `propagate` preserves the entry because it already
           # keys the node.
           record_clause_entry_scope(branch, falsey_scope)
-          body_scope, falsey_scope = branch_body_and_falsey_scopes(subject, branch, falsey_scope)
+          body_scope, falsey_scope = branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
           results << sub_eval(branch, body_scope)
         end
         [results, falsey_scope]
       end
 
+      # What a `when` / `in` clause runs to decide whether it matches, without its body: the `when` conditions, or the
+      # `in` pattern with its pins and guard.
+      def clause_tests(branch)
+        branch.is_a?(Prism::WhenNode) ? branch.conditions : [branch.pattern]
+      end
+
       # ADR-47 WD2/WD3 — record the scope ENTERING a `when`/`in` clause on the node `flow.unreachable-clause` reads to
       # classify a dead clause (`when`: first condition; `in`: the pattern). `on_enter`-only so no sub-expression is
       # newly typed; `propagate` preserves it.
@@ -903,9 +1351,10 @@ module Rigor
       # Returns `[body_scope, updated_falsey_scope]` for a single branch. `WhenNode` branches narrow through
       # `Narrowing.case_when_scopes`. `InNode` branches narrow soundly only for a bare class pattern (`in C` / `in C =>
       # x`, pure `is_a?`); every other pattern keeps the conservative "body = entry + bindings, falsey unchanged" shape.
-      def branch_body_and_falsey_scopes(subject, branch, falsey_scope)
+      # `subject_type` is the predicate's type, which an `in` branch's pattern decomposes to type the names it binds.
+      def branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
         if branch.is_a?(Prism::InNode)
-          in_branch_body_and_falsey_scopes(subject, branch, falsey_scope)
+          in_branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
         else
           when_conditions = branch.respond_to?(:conditions) ? branch.conditions : []
           Narrowing.case_when_scopes(subject, when_conditions, falsey_scope)
@@ -917,12 +1366,15 @@ module Rigor
       # falsey scope has `C` removed. Other patterns can fail to match even when a class test would pass (deconstruction
       # arity, hash keys, ...), so removing anything from the falsey scope would be unsound — they keep the conservative
       # shape.
-      def in_branch_body_and_falsey_scopes(subject, branch, falsey_scope)
+      def in_branch_body_and_falsey_scopes(subject_type, subject, branch, falsey_scope)
         class_node = bare_class_pattern_node(branch.pattern)
-        return [apply_in_pattern_bindings(subject, branch.pattern, falsey_scope), falsey_scope] unless class_node
+        unless class_node
+          bound = apply_in_pattern_bindings(subject_type, subject, branch.pattern, falsey_scope)
+          return [bound, falsey_scope]
+        end
 
         truthy_scope, narrowed_falsey = Narrowing.case_when_scopes(subject, [class_node], falsey_scope)
-        [apply_in_pattern_bindings(subject, branch.pattern, truthy_scope), narrowed_falsey]
+        [apply_in_pattern_bindings(subject_type, subject, branch.pattern, truthy_scope), narrowed_falsey]
       end
 
       # The class-constant node of a `in C` / `in C => x` pattern (the only `in` shapes whose match is pure `is_a?`), or
@@ -949,38 +1401,73 @@ module Rigor
         sub_eval(node.statements, scope)
       end
 
+      # Issue #1360 — a `begin` with a rescue chain runs through {#eval_begin} with `$!` and `$@` restored as it
+      # leaves ({#restoring_error_info}): Ruby restores them once the `begin` exits, however it exits, so the binding
+      # its rescue clauses made ({#bind_rescue_reference}) never reaches the code after it. The retry edge carries
+      # locals and instance variables only, so a retried body reads them as the `begin` found them already. A `begin`
+      # without a rescue chain binds neither.
+      #
+      # A body a `retry` re-enters runs again after the exception it raised, which may have come while a subprocess
+      # waited and so left `$?` nil, and the retry edge does not carry `$?`: such a `begin` is evaluated with `$?`
+      # unbound.
+      def eval_begin_node(node)
+        return eval_begin(node) unless node.rescue_clause
+        return evaluator_at(scope.forget_last_status).send(:eval_begin_node, node) if status_retried?(node)
+
+        restoring_error_info { eval_begin(node) }
+      end
+
+      # True when `$?` is bound and a rescue clause of `node` holds a `retry` that re-enters it.
+      def status_retried?(node)
+        return false unless scope.global(:$?)
+
+        current = node.rescue_clause
+        current = current.subsequent until current.nil? || collect_retries(current.statements)
+        !current.nil?
+      end
+
+      # The `[type, scope]` the block answers, for a `begin` or rescue modifier that starts from this evaluator's
+      # scope, with `$!` and `$@` in that scope, and in each scope a `next` or `break` recorded into the jump sinks
+      # while it ran, put back as this scope binds them ({ErrorInfo.restore}): the control those carry has left every
+      # rescue clause the construct entered.
+      def restoring_error_info
+        marks = [@next_scope_sink&.size, Thread.current[BREAK_SINK_KEY]&.size]
+        type, after = yield
+        [[@next_scope_sink, marks.first], [Thread.current[BREAK_SINK_KEY], marks.last]].each do |sink, mark|
+          next if sink.nil? || mark.nil?
+
+          (mark...sink.size).each do |index|
+            jump, jump_scope = sink[index]
+            sink[index] = [jump, ErrorInfo.restore(jump_scope, scope)]
+          end
+        end
+        [type, ErrorInfo.restore(after, scope)]
+      end
+
       # `begin; body; rescue ...; else; ensure; end`. The body and the rescue chain are alternative exit paths whose
       # scopes are joined with nil-injection. The else-clause replaces the body's value when present (matching Ruby
       # semantics: else runs only if the body raises no exception). The ensure-clause runs but does not contribute to
       # the value; its scope effects are layered on the joined exit scope so locals bound exclusively in `ensure` stay
       # observable.
       def eval_begin(node)
-        entry = scope
-        primary_type, primary_scope = eval_begin_primary_under(node, entry)
-        rescue_chain = collect_rescue_chain_results(node.rescue_clause, entry)
-
-        # B2.1 — retry-edge widening. When any rescue body contains `Prism::RetryNode`, control re-enters the primary
-        # body with the rescue arm's rebinds visible. Today's flow loses that effect, so a counter like `tries = 0; ...;
-        # rescue; tries += 1; retry; end` observes `tries: Constant[0]` inside the body and any `tries > 100` predicate
-        # folds to always-falsey. The fix: widen rebound locals / ivars in any retry-emitting arm to their Nominal
-        # envelope (Constant → Nominal[<class>], Tuple → Array, HashShape → Hash), then re-evaluate primary body AND
-        # rescue chain once under the widened entry. Nominal envelope is the maximally widened form so the re-evaluation
-        # converges in one step.
-        widened_entry = widen_entry_for_retry(entry, rescue_chain)
-        if widened_entry
-          primary_type, primary_scope = eval_begin_primary_under(node, widened_entry)
-          rescue_chain = collect_rescue_chain_results(node.rescue_clause, widened_entry)
-        end
-
-        # Rescue arms whose body unconditionally exits (`return`, `next`, `break`, `raise`, `throw`, `exit`, `abort`,
-        # `fail`) contribute neither a type fragment NOR a scope to the post-begin flow — control left the `begin` via
-        # that arm. Mirrors the `eval_if` / `eval_unless` / `eval_and_or` early-return narrowing. Without this filter, a
-        # `rescue ... return` on a local bound only in the primary body nil-injects that local across the join,
-        # defeating the rescue arm's whole point of guaranteeing the primary local is in scope for downstream
-        # statements.
-        live_rescues = rescue_chain.reject { |_pair, arm_node| branch_unconditionally_exits?(arm_node.statements) }
-                                   .map(&:first)
-
+        jump_marks = ensure_jump_marks(node)
+        edge = retry_edge_for(node)
+        # Issue #1359 — `$_` is not among the bindings the retry widening below carries, so a body that runs again
+        # after it, or a rescue clause, may have set `$_` enters with it forgotten; a rescue clause runs after any
+        # prefix of the body, and so reads it forgotten whenever the body may set it.
+        entry = edge ? forget_guard_if_rebinds(LastLine.forget_if_set(scope, node), node) : scope
+        primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge)
+        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry_scope(node, entry), edge: edge)
+
+        # B2.1 — retry-edge widening. When a `retry` in the rescue chain targets this `begin`, control re-enters the
+        # primary body carrying every rebind made before the retry: the arm's (`rescue; tries += 1; retry; end`), and
+        # the primary body's own, since it can raise after any prefix of itself (`begin; tries += 1; raise if tries < 3;
+        # rescue; retry; end`). Without the widening the re-entry keeps `tries: Constant[0]` and the predicate folds.
+        # {#eval_retried_begin} re-evaluates the primary body AND the rescue chain under a widened entry.
+        retried = edge && eval_retried_begin(node, entry, edge)
+        primary_type, primary_scope, rescue_chain = retried if retried
+
+        live_rescues = live_rescue_results(rescue_chain)
         if live_rescues.empty?
           exit_type = primary_type
           exit_scope = primary_scope
@@ -990,6 +1477,7 @@ module Rigor
         end
 
         if node.ensure_clause
+          carry_jumps_through_ensure(node.ensure_clause, jump_marks)
           _ensure_type, ensure_scope = sub_eval(node.ensure_clause, exit_scope)
           exit_scope = ensure_scope
         end
@@ -997,16 +1485,67 @@ module Rigor
         [exit_type, exit_scope]
       end
 
+      # The scope a rescue clause of `node` enters with: it runs after any prefix of the body, so neither a `$_`
+      # (issue #1359) nor a guard's narrowing of a global or constant (issue #1429) the body may rebind holds there.
+      def rescue_entry_scope(node, entry)
+        forget_guard_if_rebinds(LastLine.forget_if_set(entry, node.statements), node.statements)
+      end
+
+      # Rescue arms that never fall through contribute neither a type fragment NOR a scope to the post-begin flow —
+      # control left the `begin` via that arm. That is an arm ending in `return`, `next`, `break`, `raise`, `throw`,
+      # `exit`, `abort` or `fail`, and one whose type is `bot` ({#branch_terminates?}): an arm ending in `retry`, or in
+      # `tries < 3 ? retry : raise`, leaves back into the primary body, and joining its scope would carry the retry
+      # edge's widened entry past the `begin`. Mirrors the `eval_if` / `eval_unless` / `eval_and_or` early-return
+      # narrowing. Without this filter, a `rescue ... return` on a local bound only in the primary body nil-injects that
+      # local across the join, defeating the rescue arm's whole point of guaranteeing the primary local is in scope for
+      # downstream statements.
+      def live_rescue_results(rescue_chain)
+        rescue_chain.reject { |(arm_type, _), arm_node| branch_terminates?(arm_node.statements, arm_type) }
+                    .map(&:first)
+      end
+
+      # The jump sinks' sizes as a `begin … ensure` starts, or nil for a `begin` without `ensure`: every `next` /
+      # `break` scope recorded past these marks leaves through that `ensure`.
+      def ensure_jump_marks(node)
+        return nil unless node.ensure_clause
+
+        [@next_scope_sink&.size, Thread.current[BREAK_SINK_KEY]&.size]
+      end
+
+      # A `next` or `break` inside `begin … ensure` leaves only once the `ensure` clause has run, so each jump scope the
+      # clauses recorded is replaced by that scope carried through the clause: `buf = nil; next if c` under `ensure
+      # buf = +"reset"` leaves with `"reset"`, never `nil`. The clause is evaluated without recording into the
+      # per-node scope index, which keeps the fall-through's visit.
+      def carry_jumps_through_ensure(ensure_clause, marks)
+        next_mark, break_mark = marks
+        carry_through_ensure(ensure_clause, @next_scope_sink, next_mark)
+        carry_through_ensure(ensure_clause, Thread.current[BREAK_SINK_KEY], break_mark)
+      end
+
+      def carry_through_ensure(ensure_clause, sink, mark)
+        return if sink.nil? || mark.nil?
+
+        (mark...sink.size).each do |index|
+          jump, jump_scope = sink[index]
+          sink[index] = [jump, sub_eval(ensure_clause, jump_scope, **UNRECORDED).last]
+        end
+      end
+
       # `BeginNode#statements` is the primary body; when an else-clause is present, its value replaces the body's per
       # Ruby semantics (the else runs only when no exception was raised), but the body's scope effects still apply
       # because the body did run before the else.
-      def eval_begin_primary_under(node, entry_scope)
+      #
+      # `edge`, when given, collects every scope the primary body could raise from: the scope after each statement of
+      # its frame ({#record_raise_points}), and the scope it ends with. The else-clause is not among them: what it
+      # raises is not rescued here.
+      def eval_begin_primary_under(node, entry_scope, edge: nil)
         body_type, body_scope =
           if node.statements
-            sub_eval(node.statements, entry_scope)
+            with_raise_frame(edge) { sub_eval(node.statements, entry_scope) }
           else
             [Type::Combinator.constant_of(nil), entry_scope]
           end
+        edge.raise_scopes << body_scope if edge
 
         if node.else_clause
           else_type, else_scope = sub_eval(node.else_clause, body_scope)
@@ -1016,92 +1555,293 @@ module Rigor
         end
       end
 
-      # B2.1 — return a widened entry scope when at least one rescue arm in `rescue_chain` contains a `Prism::RetryNode`
-      # AND that arm rebinds at least one local or ivar relative to the original entry. Returns nil when no widening is
-      # needed (no retry, or no rebinds reachable across the retry edge).
-      #
-      # Always-safe: the widening can only LOSE precision; it never invents a fact (Nominal envelope is a superset of
-      # the Constant / shape carrier it widens from). Convergent in one step because Nominal envelope is the maximally
-      # widened form against the engine's current carrier set.
-      def widen_entry_for_retry(entry_scope, rescue_chain)
-        widened = nil
-        rescue_chain.each do |(_arm_type, arm_post_scope), arm_node|
-          next unless arm_contains_retry?(arm_node)
+      # B2.1 — what one pass over a `begin` whose rescue chain retries collects: the `retry` nodes that target it, the
+      # arms holding them, the nodes of its primary body's frame and the names that frame writes, and the scopes control
+      # carries back into the primary body — at each point the body can raise from (`raise_scopes`), and at each of
+      # those `retry`s together with the post-scope of each arm holding one (`retry_scopes`).
+      RetryEdge = Data.define(:retries, :retrying_arms, :frame, :body_writes, :raise_scopes, :retry_scopes) do
+        def fresh = with(raise_scopes: [], retry_scopes: [])
 
-          accumulator = widened || entry_scope
-          accumulator = absorb_retry_rebinds(accumulator, entry_scope, arm_post_scope)
-          widened = accumulator
+        def merge(other)
+          with(raise_scopes: raise_scopes + other.raise_scopes, retry_scopes: retry_scopes + other.retry_scopes)
         end
-        return nil if widened.nil? || widened == entry_scope
+      end
+      private_constant :RetryEdge
 
-        widened
+      # The entry and edge one widening reads, whether it widens to the Nominal envelope or keeps literals, and, per
+      # name, the rebinds it has already weighed: a statement-by-statement body shares one binding object across every
+      # scope until the name is rebound, and weighing each copy again is what made a long body quadratic.
+      RetryWidening = Data.define(:entry, :edge, :envelope, :weighed) do
+        def initialize(entry:, edge:, envelope:, weighed: {}) = super
       end
+      private_constant :RetryWidening
 
-      def arm_contains_retry?(node)
-        return false unless node.is_a?(Prism::Node)
-        return true if node.is_a?(Prism::RetryNode)
-        # Don't descend into nested blocks / defs / classes / modules — a `retry` inside a nested method body or block
-        # targets its own enclosing `begin`, not this one.
-        return false if node.is_a?(Prism::DefNode) ||
-                        node.is_a?(Prism::ClassNode) ||
-                        node.is_a?(Prism::ModuleNode) ||
-                        node.is_a?(Prism::BlockNode)
+      # The thread-local stack of the {RetryEdge}s whose primary body is being evaluated, innermost last, or nil.
+      RETRY_FRAMES_KEY = :rigor_retry_frames
+      private_constant :RETRY_FRAMES_KEY
 
-        found = false
-        node.rigor_each_child do |c|
-          next unless arm_contains_retry?(c)
+      # The retry edge of `node`, or nil when no `retry` in its rescue chain targets it. Allocation-free for a `begin`
+      # no `retry` targets.
+      def retry_edge_for(node)
+        retries = nil
+        retrying_arms = nil
+        current = node.rescue_clause
+        while current
+          found = collect_retries(current.statements)
+          if found
+            (retries ||= Set.new.compare_by_identity).merge(found)
+            (retrying_arms ||= Set.new.compare_by_identity) << current
+          end
+          current = current.subsequent
+        end
+        return nil unless retries
+
+        frame = Set.new.compare_by_identity
+        body_writes = Set.new
+        walk_primary_frame(node.statements, true, frame, body_writes) if node.statements
+        RetryEdge.new(retries: retries, retrying_arms: retrying_arms, frame: frame, body_writes: body_writes,
+                      raise_scopes: [], retry_scopes: [])
+      end
+
+      # The `retry` nodes under `node` that re-enter the `begin` whose rescue arm holds it, or nil for none. A nested
+      # `rescue` clause, or a rescue modifier's fallback, owns the `retry`s inside it (Ruby 4.0.5 retries the modifier's
+      # own expression), and a nested block, lambda, `def` or class body cannot hold one for this `begin`.
+      def collect_retries(node, found = nil)
+        case node
+        when nil, Prism::RescueNode then found
+        when Prism::RetryNode then (found || []) << node
+        when Prism::RescueModifierNode then collect_retries(node.expression, found)
+        else
+          return found if scope_boundary?(node)
 
-          found = true
-          break
+          node.rigor_each_child { |child| found = collect_retries(child, found) }
+          found
         end
-        found
       end
 
-      def absorb_retry_rebinds(accumulator, entry_scope, arm_post_scope)
-        scope_acc = accumulator
-        # Walk every local visible in either side, compare types, widen to Nominal envelope on a difference.
-        local_keys = arm_post_scope.locals.keys | entry_scope.locals.keys
-        local_keys.each do |name|
-          pre = entry_scope.local(name)
-          post = arm_post_scope.local(name)
-          next if pre == post || post.nil?
+      def scope_boundary?(node)
+        SCOPE_NESTING_NODES.any? { |klass| node.is_a?(klass) } || SCOPE_BODY_NODES.any? { |klass| node.is_a?(klass) }
+      end
+
+      RETRY_WRITE_NODES = (CapturedLocals::LOCAL_WRITE_NODES | CapturedLocals::NON_LOCAL_WRITE_NODES).freeze
+      private_constant :RETRY_WRITE_NODES
+
+      # Collects into `frame` the nodes of the primary body that run in its own frame — a nested block or lambda keeps
+      # its own locals (a block parameter can shadow the counter) — and into `writes` every variable name the body
+      # writes, a block's included (it may write an outer local). A `def` or class body runs nothing here.
+      def walk_primary_frame(node, in_frame, frame, writes)
+        return if SCOPE_BODY_NODES.any? { |klass| node.is_a?(klass) }
+
+        in_frame &&= SCOPE_NESTING_NODES.none? { |klass| node.is_a?(klass) }
+        frame << node if in_frame
+        writes << node.name if RETRY_WRITE_NODES.include?(node.class)
+        node.rigor_each_child { |child| walk_primary_frame(child, in_frame, frame, writes) }
+      end
+
+      # B2.1 — the primary path's `[type, scope]` and the rescue chain's results re-evaluated under an entry the retry
+      # edge widens, or nil when nothing crosses the edge. The widening first keeps literals, the entry joined with each
+      # rebind, and holds when one re-evaluation under it puts nothing new on the edge: `st = :ok; …; st = :retrying`
+      # stays `:ok | :retrying`. A counter moves again (`0 | 1` meets `2`), so the entry is then widened to the Nominal
+      # envelope of everything both passes saw, and evaluated once more; that pass is taken as converged.
+      def eval_retried_begin(node, entry, edge)
+        literal = widen_entry_for_retry(RetryWidening.new(entry: entry, edge: edge, envelope: false))
+        return nil unless literal
+
+        closing = edge.fresh
+        result = eval_begin_paths(node, literal, closing)
+        return result unless widen_entry_for_retry(RetryWidening.new(entry: literal, edge: closing, envelope: false))
+
+        widened = widen_entry_for_retry(RetryWidening.new(entry: entry, edge: edge.merge(closing), envelope: true))
+        eval_begin_paths(node, widened || literal, nil)
+      end
+
+      def eval_begin_paths(node, entry, edge)
+        primary = eval_begin_primary_under(node, entry, edge: edge)
+        [*primary, collect_rescue_chain_results(node.rescue_clause, entry, edge: edge)]
+      end
+
+      # B2.1 — the entry scope widened by what crosses the retry edge, or nil when nothing does. A local or ivar bound
+      # in the entry widens when a scope on the edge binds it to a type the accumulated binding does not already
+      # accept ({#retry_binding_accepted?}): inside `log if m == :fast` the scope holds `m: :fast`, which the entry's
+      # `:fast | :slow` accepts, and widening it would turn a declared `:fast | :slow` return into `Symbol`.
+      #
+      # A name the entry does not bind joins the edge only from a retrying arm, and only when the primary body never
+      # writes it. One the body writes reads as `Dynamic[top]` on the first entry, as it does on this pass; binding a
+      # type onto the edge would claim it set even when the body raised before assigning it — the arm's `conn.close if
+      # conn` would fold to always-truthy for the body's connection, or to always-falsey for the arm's own `conn = nil`.
+      def widen_entry_for_retry(widening)
+        widened = widening.entry
+        widening.edge.retry_scopes.each do |retry_scope|
+          widened = absorb_retry_rebinds(widened, retry_scope, widening)
+        end
+        widening.edge.raise_scopes.each do |raise_scope|
+          widened = absorb_retry_rebinds(widened, raise_scope, widening, bound_on_entry: true)
+        end
+        return nil if widened == widening.entry
+
+        widened
+      end
+
+      # Runs `block` with `edge` on top of the thread-local stack {#record_raise_points} reads.
+      def with_raise_frame(edge)
+        return yield unless edge
 
-          widened = retry_widened_type(pre, post)
-          scope_acc = scope_acc.with_local(name, widened)
+        previous = Thread.current[RETRY_FRAMES_KEY]
+        Thread.current[RETRY_FRAMES_KEY] = previous ? [*previous, edge] : [edge]
+        begin
+          yield
+        ensure
+          Thread.current[RETRY_FRAMES_KEY] = previous
+        end
+      end
+
+      # The scope after each statement of a retrying primary body's frame is a point the body can raise from, the next
+      # statement's being the one after. Together they carry every rebind a retry can re-enter with, including one on a
+      # branch that then raises and so never reaches the body's exit scope (`if bad; tries += 1; raise; end`), and a
+      # write threaded into the raising call's own operands (`raise Retry.new(tries += 1) if flaky?`). A statement of a
+      # nested block or lambda body is not in the frame (a block parameter can shadow the counter); the block's effect
+      # on this frame shows in the post-scope of the statement holding it. Recording from the evaluator rather than
+      # `on_enter` keeps a statement reached with the index recorder off (a threaded operand, a loop fixpoint pass).
+      def record_raise_points(frames, stmt, stmt_scope)
+        frames.each { |edge| edge.raise_scopes << stmt_scope if edge.frame.include?(stmt) }
+      end
+
+      # An `on_enter` that records, besides forwarding to the installed one, the entry scope of each `retry` of `edge`
+      # the rescue chain reaches: the scope control carries back into the primary body.
+      def retry_scope_recorder(edge)
+        forward = @on_enter
+        lambda do |node, node_scope|
+          edge.retry_scopes << node_scope if edge.retries.include?(node)
+          forward&.call(node, node_scope)
         end
-        ivar_keys = arm_post_scope.ivars.keys | entry_scope.ivars.keys
-        ivar_keys.each do |name|
-          pre = entry_scope.ivar(name)
-          post = arm_post_scope.ivar(name)
-          next if pre == post || post.nil?
+      end
+
+      # Widens against the accumulator's binding rather than the entry's, so a name rebound differently by two arms, or
+      # at two points of the primary body, keeps every rebind instead of only the last one absorbed.
+      def absorb_retry_rebinds(accumulator, post_scope, widening, bound_on_entry: false)
+        scope_acc = absorb_retry_kind_rebinds(accumulator, post_scope, widening, :local, bound_on_entry)
+        absorb_retry_kind_rebinds(scope_acc, post_scope, widening, :ivar, bound_on_entry)
+      end
 
-          widened = retry_widened_type(pre, post)
-          scope_acc = scope_acc.with_ivar(name, widened)
+      RETRY_KIND_TABLES = { local: :locals, ivar: :ivars }.freeze
+      private_constant :RETRY_KIND_TABLES
+
+      # Walk every name of `kind` visible on either side (only the entry's under `bound_on_entry`), and widen a binding
+      # the accumulated one does not already accept.
+      def absorb_retry_kind_rebinds(scope_acc, post_scope, widening, kind, bound_on_entry)
+        getter = VAR_KIND_GETTERS.fetch(kind)
+        table = RETRY_KIND_TABLES.fetch(kind)
+        names = widening.entry.public_send(table).keys
+        names |= post_scope.public_send(table).keys unless bound_on_entry
+        names.each do |name|
+          post = post_scope.public_send(getter, name)
+          next if post.nil? || retry_rebind_settled?(widening, name, widening.entry.public_send(getter, name), post)
+
+          current = scope_acc.public_send(getter, name)
+          if current ? retry_binding_accepted?(current, post) : widening.edge.body_writes.include?(name)
+            scope_acc = forget_diverged_copy(scope_acc, post_scope, kind, name)
+            next
+          end
+
+          scope_acc = rebind_retried(scope_acc, post_scope, kind, name,
+                                     retry_widened_type(current, post, kind, widening.envelope))
         end
         scope_acc
       end
 
-      def retry_widened_type(pre, post)
-        # `pre` is nil when the local was introduced inside the rescue body. The retry edge brings it back into the
-        # primary body's entry — widen the post type itself.
-        envelope = nominal_envelope_for(post)
-        return envelope if pre.nil?
+      # The rebind joins the binding a retry re-enters with into the accumulated one, so ADR-58's local mark stays only
+      # when both scopes carry it, as `Scope#join` keeps it (issue #1287): `up(r)` in the body floors `r` in place and
+      # keeps the mark, while `r = other` in the rescue arm is a write and drops it. Issue #1362 — as in `Scope#join`, a
+      # copy of global seeds keeps its mark with the union of both scopes' globals, and only when both copy some.
+      def rebind_retried(scope_acc, post_scope, kind, name, type)
+        rebound = rebind_variable(scope_acc, kind, name, type)
+        return rebound unless kind == :local && scope_acc.declaration_sourced?(:local, name) &&
+                              post_scope.declaration_sourced?(:local, name)
+
+        copies = scope_acc.declaration_sourced_global_copies(name)
+        post_copies = post_scope.declaration_sourced_global_copies(name)
+        return rebound unless copies.empty? == post_copies.empty?
+
+        rebound.with_local_declaration_mark(name).with_global_copy_marks(name, copies | post_copies)
+      end
+
+      # Issue #1362 — a re-entered binding the accumulated one already accepts is not rebound, so ADR-58's mark would
+      # stand on a local that copies a global's seed while the retried pass holds something else. As at a join, a copy
+      # of other global seeds adds their globals to the record, and any other value makes the local flow-live.
+      def forget_diverged_copy(scope_acc, post_scope, kind, name)
+        return scope_acc unless kind == :local
 
-        nominal_envelope_for(Type::Combinator.union(pre, envelope))
+        copies = scope_acc.declaration_sourced_global_copies(name)
+        return scope_acc if copies.empty?
+
+        post_copies = post_scope.declaration_sourced_global_copies(name)
+        return scope_acc.without_local_declaration_marks(name) if post_copies.empty?
+
+        scope_acc.with_global_copy_marks(name, post_copies)
+      end
+
+      # Whether `post` needs no weighing: this widening has weighed it for `name` already, or it is the entry's binding.
+      def retry_rebind_settled?(widening, name, pre, post)
+        return true unless (widening.weighed[name] ||= Set.new.compare_by_identity).add?(post)
+
+        pre.equal?(post) || pre == post
+      end
+
+      # Whether the binding `current` already covers `post`. A `post` carrying `Dynamic` anywhere could be any value,
+      # which only a `current` with a `Dynamic` member covers: `Array[Integer]` gradually accepts `Array[untyped]`, but
+      # keeping it would claim the elements are still Integers.
+      def retry_binding_accepted?(current, post)
+        return ContentJoin.union_members(current).any?(Type::Dynamic) if carries_dynamic?(post)
+
+        Acceptance.accepts(current, post).yes?
+      end
+
+      def carries_dynamic?(type)
+        case type
+        when Type::Dynamic then true
+        when Type::Union then type.members.any? { |member| carries_dynamic?(member) }
+        when Type::Nominal then type.type_args.any? { |arg| carries_dynamic?(arg) }
+        when Type::Tuple then type.elements.any? { |element| carries_dynamic?(element) }
+        when Type::HashShape then type.pairs.each_value.any? { |value| carries_dynamic?(value) }
+        when Type::Difference, Type::Refined then carries_dynamic?(type.base)
+        else false
+        end
+      end
+
+      # The accumulated binding joined with a rebind, widened to the Nominal envelope when `envelope` is set.
+      #
+      # `current` is nil when the name was introduced inside a retrying arm. Such a local is nil on the first entry, and
+      # stays nil past a `begin` whose body never raised, which reaches the exit only through the primary path (a
+      # retrying arm does not join it), so the edge carries `nil` along with the rebind. An instance variable's
+      # first-entry value is unknown rather than nil (another method may set it), so it takes the rebind alone.
+      def retry_widened_type(current, post, kind, envelope)
+        rebind = envelope ? nominal_envelope_for(post) : post
+        return rebind if current.nil? && kind == :ivar
+        return Type::Combinator.union(Type::Combinator.constant_of(nil), rebind) if current.nil?
+
+        joined = Type::Combinator.union(current, rebind)
+        envelope ? nominal_envelope_for(joined) : joined
       end
 
       # Nominal envelope of a value type: widens Constant / Tuple / HashShape carriers to the underlying class's
       # `Nominal`, preserving everything else (`Nominal`, `Union` of non-shape members, `Top`, `Dynamic`, `Bot`). Union
-      # members are walked individually.
+      # members are walked individually. `nil`, `true` and `false` are the only values of their classes, so their
+      # Constant already is the envelope; `Nominal[FalseClass] | Nominal[TrueClass]` would not be accepted where `bool`
+      # is declared.
       def nominal_envelope_for(type)
         members = type.is_a?(Type::Union) ? type.members : [type]
         widened = members.map { |m| nominal_envelope_member(m) }
         Type::Combinator.union(*widened)
       end
 
+      SINGLE_VALUE_CONSTANTS = [nil, true, false].freeze
+      private_constant :SINGLE_VALUE_CONSTANTS
+
       def nominal_envelope_member(member)
         case member
         when Type::Constant
+          return member if SINGLE_VALUE_CONSTANTS.include?(member.value)
+
           Type::Combinator.nominal_of(member.value.class.name)
         when Type::Tuple
           MutationWidening.widen_tuple(member)
@@ -1112,12 +1852,19 @@ module Rigor
         end
       end
 
-      def collect_rescue_chain_results(rescue_node, entry_scope)
+      # `edge`, when given, collects the scope at each of its `retry`s ({#retry_scope_recorder}) and the post-scope of
+      # each arm holding one. The latter still carries a rebind the `retry` itself does not see: a write an `ensure`
+      # runs on the way out (`begin; retry; ensure; tries += 1; end`), or one made before a `retry` the evaluator only
+      # types (`log(tries < 5 ? retry : :gave_up)`).
+      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil)
+        on_enter = edge ? retry_scope_recorder(edge) : @on_enter
         results = []
         current = rescue_node
         while current
           rescue_scope = bind_rescue_reference(current, entry_scope)
-          results << [eval_branch_or_nil(current.statements, rescue_scope), current]
+          arm = eval_branch_or_nil(current.statements, rescue_scope, on_enter: on_enter)
+          edge.retry_scopes << arm.last if edge&.retrying_arms&.include?(current)
+          results << [arm, current]
           current = current.subsequent
         end
         results
@@ -1127,25 +1874,54 @@ module Rigor
         eval_branch_or_nil(node.statements, scope)
       end
 
+      # Issue #1360 — an `ensure` clause runs after the body or a rescue clause finished, but also after one raised,
+      # when `$!` is the exception in flight and a subprocess the body would have run has not set `$?`. So the clause
+      # reads `$!`, `$@` and `$?` unbound, whatever it enters with. It cannot write them, so past the clause they are
+      # what it entered with — the scope of a `begin` that finished, the only one the code after it runs from — unless
+      # it ran a subprocess itself.
+      #
+      # Issue #1415 — the clause also runs after a `return`, `break` or `next` out of the body, from a scope other than
+      # the one it enters with here, so a bound `$_` reads `Dynamic[top]` in it (`while gets; return $_ if …; end`
+      # ensures with the line, not the loop's `nil`). Past the clause `$_` is what it entered with, but only where the
+      # clause left that `Dynamic[top]` in place and cannot set `$_` itself: a call the statement rules forget `$_` for
+      # (a closure of the frame, `binding`, a forwarded block) leaves it unbound, and the clause's scope then stands.
       def eval_ensure(node)
-        eval_branch_or_nil(node.statements, scope)
+        entry = scope.forget_error_info.forget_last_status
+        line = scope.global(:$_)
+        entry = entry.untyped_last_line if line
+        type, after = eval_branch_or_nil(node.statements, entry)
+        after = after.with_global(:$_, line) if line && last_line_kept?(after, node)
+        [type, LastStatus.restore_unless_set(ErrorInfo.restore(after, scope), scope)]
+      end
+
+      # True when the clause's scope `after` still binds `$_` to the `Dynamic[top]` the entry gave it and the clause
+      # holds nothing that may set it ({LastLine.may_set?}).
+      def last_line_kept?(after, node)
+        after.global(:$_) == Type::Combinator.untyped && !LastLine.may_set?(node.statements, scope)
       end
 
       # `while pred; body; end` / `until pred; body; end`. The body might run zero or more times, so half-bound names
       # degrade to `T | nil` in the post-loop scope. The loop expression itself types as `Constant[nil]` (Slice 3 phase
       # 1), reflecting the common case where no `break VALUE` is observed.
       def eval_loop(node)
-        _pred_type, post_pred = sub_eval(node.predicate, scope)
+        _pred_type, post_pred = sub_eval(node.predicate, loop_entry_scope(node))
+        post_pred = widen_predicate_pins(node, post_pred)
         return [Type::Combinator.constant_of(nil), narrow_loop_exit_edge(node, post_pred)] if node.statements.nil?
 
         # The historical single body pass joined with the pre-loop scope. This continues to carry everything the
         # fixpoint does NOT track: receiver-mutation widening of non-rebound locals (`buf.push(i)` widens `buf`'s
-        # Tuple), body-introduced locals' nil-injection, and the loop value itself. The fixpoint then OVERLAYS only the
-        # rebound-local bindings it corrects.
+        # Tuple), body-introduced locals' nil-injection, an instance variable's rebind, and the loop value itself. The
+        # fixpoint then OVERLAYS only the rebound-local bindings it corrects.
+        #
+        # Like every fixpoint pass, it enters the body on the predicate's loop-entry edge ({#loop_pass_entry}): the
+        # body of `while (line = gets)` reads `line` as `String`, and the body of `while gets` reads `$_` as one
+        # (issue #1359), also when the body rebinds no local and this is the only pass. A `begin … end while` body runs
+        # once before the predicate is first tested, so its pass enters from the post-predicate scope unnarrowed.
         #
-        # The pass runs under a break sink so a `break`-path binding (`flag = true; break`) the fall-through
-        # `body_scope` drops is collected for the continuation join below.
-        break_targets, break_sink, body_scope = capture_loop_body_breaks(node.statements, post_pred)
+        # The pass ends with its `next` exits as well as its fall-through ({#loop_iteration}). Its `break` arms are
+        # superseded by the fixpoint's converged pass ({#loop_break_arms}) except in a `begin … end while` loop, below.
+        jumps = loop_jumps(node.statements)
+        body_scope, first_breaks = single_pass(node, post_pred, jumps)
         base_scope = join_with_nil_injection(post_pred, body_scope)
 
         rebound, body_first = loop_body_local_writes(node.statements, post_pred)
@@ -1159,34 +1935,97 @@ module Rigor
           return [Type::Combinator.constant_of(nil), narrow_loop_exit_edge(node, fast)]
         end
 
-        post_loop = converged_loop_scope(node, post_pred, base_scope, names, body_first)
-        # Recover `break`-path bindings the fall-through dropped (`flag = true; break` -> `flag` is `false | true`, not
-        # the stale `false`).
-        post_loop = join_break_scopes(post_loop, break_sink, break_targets, names)
+        post_loop = converged_loop_scope(node, post_pred, base_scope, names, body_first, jumps)
+        # A `begin … end while` / `until` body runs once before the predicate is first tested, so that iteration's
+        # entry lies outside every fixpoint pass's predicate-narrowed one, and a `break` only it can take (`if state ==
+        # :idle` under `end while state != :idle`) is dead in every converged pass. The single pass runs from the
+        # un-narrowed post-predicate scope, so its arms stand in for that first iteration.
+        post_loop = join_break_scopes(post_loop, first_breaks, names) if node.begin_modifier?
         post_loop = narrow_loop_exit_edge(node, post_loop)
         [Type::Combinator.constant_of(nil), post_loop]
       end
 
+      # Issue #1359 — the scope a loop's predicate first runs from: a body that may set `$_` runs again after it ran,
+      # so neither the predicate nor any pass over the body reads a `$_` narrowing from before the loop. A `while
+      # gets` predicate narrows it afresh.
+      #
+      # Issue #1429 — nor a guard's narrowing of a global or constant, when the body or the predicate, which run again
+      # after each iteration, may rebind it by a write or a call ({#forget_guard_if_rebinds}).
+      def loop_entry_scope(node)
+        forget_guard_if_rebinds(LastLine.forget_if_set(scope, node.statements), node.statements, node.predicate)
+      end
+
+      # Issue #1429 — `entry` with its guard narrowings restored when any of `nodes` may rebind a global or constant
+      # ({GuardRebinding.may_rebind?}): the loop and retry back edges and a rescue clause, which runs after any prefix
+      # of the body, reach the code again after such a node ran.
+      def forget_guard_if_rebinds(entry, *nodes)
+        return entry unless entry.guard_narrowed? && nodes.any? { |node| GuardRebinding.may_rebind?(node, entry) }
+
+        entry.forget_guard_narrowings
+      end
+
+      # {#eval_loop}'s single body pass. It enters on the predicate's loop-entry edge, as every fixpoint pass does,
+      # except a `begin … end while` body, which runs once before the predicate is tested, and a body a `redo`
+      # targets, which runs again without the predicate being tested again.
+      def single_pass(node, post_pred, jumps)
+        entry =
+          if node.begin_modifier? || jumps.redoes
+            post_pred
+          else
+            loop_pass_entry(node, post_pred, NO_LOOP_BINDINGS, NO_LOOP_NAMES, jumps)
+          end
+        loop_iteration(node.statements, entry, jumps)
+      end
+
+      # A `while` / `until` predicate runs before every iteration and once more to leave, but the walk evaluates it
+      # once, from the scope before the loop. A variable it writes therefore holds its first evaluation's value, and a
+      # value pin there is a claim about that evaluation alone when a later evaluation can store something else: when
+      # the predicate reads the variable it writes (`i = 0; while (i += 1) < 3; end` pinned `i` to `1`, and the exit
+      # edge `i >= 3` contradicted the pin and left `i` as `bot`), or reads one the body rebinds (`while check(k = i *
+      # 2); i += 1; end`). Each such binding is widened past its value pin (`Type::Combinator.widen_value_pinned`), as
+      # the loop fixpoint widens a body's rebinds; a write that reads neither stores the same answer every time and
+      # keeps it (`until line = (flag ? "x" : nil)` still exits on `"x"`). Issue #1223 made the shape common: a write
+      # nested in a predicate's call operand was not threaded at all before it.
+      def widen_predicate_pins(node, post_pred)
+        written = OperandEffects.written_variables(node.predicate)
+        return post_pred if written.empty?
+
+        reads = OperandEffects.read_variables(node.predicate)
+        body_writes = OperandEffects.written_variables(node.statements)
+        varying = reads.intersect?(body_writes) ? written : written & reads
+        varying.reduce(post_pred) do |acc, name|
+          current = CapturedLocals.bound_type(acc, name)
+          next acc if current.nil?
+
+          widened = Type::Combinator.widen_value_pinned(current)
+          widened == current ? acc : CapturedLocals.bind(acc, name, widened)
+        end
+      end
+
       # The continuation scope for a loop whose body rebinds locals: the ADR-56 slice-B rebind fixpoint overlaid on
-      # `base_scope`, then the slice-C receiver-content writeback.
-      def converged_loop_scope(node, post_pred, base_scope, names, body_first)
+      # `base_scope`, then the slice-C receiver-content writeback, then the `break`-path bindings the fall-through
+      # dropped (`flag = true; break` -> `flag` is `false | true`, not the stale `false`).
+      def converged_loop_scope(node, post_pred, base_scope, names, body_first, jumps)
         # ADR-56 slice B — loop-body fixpoint. The body runs 0..N times and may compound (`d *= 2`), so the historical
         # single body pass joined with the pre-loop scope kept stale folded constants (`d = 1; while …; d *= 2; end` →
         # `1 | 2`, never reaching `4, 8`). Fold each body-written local's continuation binding through the same capped
         # fixpoint slice A uses for non-escaping block captures. Seed: a pre-existing local seeds with its
         # post-predicate binding; a local FIRST assigned inside the body seeds with `nil` so the 0-iteration path
         # degrades it to `T | nil`, matching the nil-injection treatment.
-        result = loop_rebind_fixpoint(node, post_pred, names, body_first)
+        break_pass = jumps.breaks && { entry: nil, arms: [] }
+        result = loop_rebind_fixpoint(node, post_pred, names, body_first, jumps, break_pass)
         # Display-path re-record: the fixpoint's body re-evaluations fire `on_enter` with the cap-N INTERMEDIATE
         # assumptions, so the last-visit-wins scope index would annotate loop-body lines with stale pre-convergence
         # constants. One extra pass from the converged bindings (result discarded) re-records the body's entry scopes.
-        record_converged_loop_body(node, post_pred, result, names, body_first)
+        record_converged_loop_body(node, post_pred, result, names, body_first, jumps, break_pass)
         post_loop = result.reduce(base_scope) { |acc, (name, type)| acc.with_local(name, type) }
         # ADR-56 slice C — loop-body receiver-content element-type join. A loop that content-mutates a collection (`acc
         # << n`) keeps only the seed's element types after the single-pass widen; join the appended/stored types into
         # the continuation collection. Pre-state comes from `post_pred` for a name the loop only content-mutates and
         # from `post_loop` for one it also rebinds, so composition still works — see {#loop_content_writeback}.
-        loop_content_writeback(node.statements, post_loop, pre_body: post_pred, rebound: names)
+        post_loop = loop_content_writeback(node.statements, post_loop, pre_body: post_pred, rebound: names)
+        arms = loop_break_arms(node, post_pred, result, body_first, jumps, break_pass)
+        join_break_scopes(post_loop, arms, names)
       end
 
       # Item 4 — loop-exit predicate narrowing. A `while pred` / `until pred` loop exits PRECISELY on the predicate's
@@ -1220,33 +2059,35 @@ module Rigor
         found
       end
 
-      # A `break` inside one of these nested constructs targets the inner construct (an inner loop, a block's method, a
-      # nested def), NOT the lexical loop — so the directly-targeting break scan does not descend into them.
-      BREAK_BOUNDARY_NODES = [
-        Prism::ForNode, Prism::WhileNode, Prism::UntilNode,
-        Prism::BlockNode, Prism::LambdaNode, Prism::DefNode,
-        Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode
-      ].freeze
-      private_constant :BREAK_BOUNDARY_NODES
-
-      # The `BreakNode`s that lexically target THIS loop — reachable from the body without crossing a nested loop /
-      # block / def boundary. An identity-keyed Hash used as a membership set to filter the collected break scopes (the
-      # thread-local sink also collects breaks from nested blocks that did not install their own sink).
-      def directly_targeting_breaks(statements)
-        found = {}.compare_by_identity
-        collect_direct_breaks(statements, found)
-        found
-      end
+      # The jumps that target a loop body ({JumpTargets}): its `next`s and its `break`s, each an identity-keyed Hash
+      # used as a membership set, or nil when the body has none, and whether a `redo` does (issue #1359: the body then
+      # runs again without the predicate being tested, {#single_pass}). The sinks also collect jumps that belong to a
+      # construct evaluated under the loop's collection without installing its own (a `->` body), and the consumers
+      # filter against these sets.
+      LoopJumps = Data.define(:nexts, :breaks, :redoes)
+      private_constant :LoopJumps
 
-      def collect_direct_breaks(node, found)
-        return if node.nil?
+      NO_LOOP_JUMPS = LoopJumps.new(nexts: nil, breaks: nil, redoes: false)
+      # In {JumpTargets.kinds}' bit order: `next` 0b001, `break` 0b010, `redo` 0b100.
+      LOOP_JUMP_CLASSES = [Prism::NextNode, Prism::BreakNode, Prism::RedoNode].freeze
+      private_constant :NO_LOOP_JUMPS, :LOOP_JUMP_CLASSES
 
-        found[node] = true if node.is_a?(Prism::BreakNode)
-        node.rigor_each_child do |child|
-          next if BREAK_BOUNDARY_NODES.any? { |klass| child.is_a?(klass) }
+      NO_BREAK_ARMS = [].freeze
+      private_constant :NO_BREAK_ARMS
 
-          collect_direct_breaks(child, found)
-        end
+      # The rebind assumptions and body-first names of the single body pass, which overlays none ({#eval_loop}).
+      NO_LOOP_BINDINGS = {}.freeze
+      NO_LOOP_NAMES = [].freeze
+      private_constant :NO_LOOP_BINDINGS, :NO_LOOP_NAMES
+
+      # A body with no targeting jump pays two allocation-free scans.
+      def loop_jumps(statements)
+        kinds = JumpTargets.kinds(statements, LOOP_JUMP_CLASSES)
+        return NO_LOOP_JUMPS if kinds.zero?
+
+        nexts = JumpTargets.of(statements, Prism::NextNode) if kinds.anybits?(0b001)
+        breaks = JumpTargets.of(statements, Prism::BreakNode) if kinds.anybits?(0b010)
+        LoopJumps.new(nexts: nexts, breaks: breaks, redoes: kinds.anybits?(0b100))
       end
 
       # Installs a fresh thread-local break sink around `yield` (a loop-body evaluation), returning `[collected,
@@ -1264,31 +2105,81 @@ module Rigor
         [sink, result]
       end
 
-      # Runs a loop body's single pass under a break sink. Returns the directly-targeting break set, the collected break
-      # scopes, and the fall-through body scope — the three inputs the continuation's {#join_break_scopes} needs. Shared
-      # by `eval_loop` and `eval_for`.
-      def capture_loop_body_breaks(statements, entry)
-        targets = directly_targeting_breaks(statements)
-        sink, (_type, body_scope) = collect_break_scopes { sub_eval(statements, entry) }
-        [targets, sink, body_scope]
+      # One evaluation of a loop body from `entry`. Returns `[exit, breaks]`: the scope the iteration ends with, and the
+      # scopes at the `break`s that target the loop ({LoopJumps}). Every reader of a loop body goes through here — the
+      # single pass `eval_loop` joins with the pre-loop scope, each pass of its rebind fixpoint, and `eval_for`'s only
+      # pass.
+      #
+      # A `next` returns to the predicate as surely as falling off the end does, so `exit` is the fall-through joined
+      # with the scope at every `next` that targets the loop. Without that join a rebind on a jumping branch (`if
+      # i.odd?; w = i; next; end`) vanished — `eval_if` carries only the arm that falls through — and `w` kept its
+      # pre-loop binding. The join nil-injects: a local first bound on a `next` path is unbound on the fall-through, and
+      # a plain `Scope#join` would drop it and leave the fixpoint only its `nil` seed.
+      #
+      # The `next` scopes are collected into a sink threaded through `sub_eval` ({#evaluate_invocation} does the same
+      # for a block), and the `break` scopes into a thread-local one, each installed only when the body has such a
+      # jump. `recorded: false` evaluates without recording into the per-node scope index.
+      def loop_iteration(statements, entry, jumps, recorded: true)
+        next_sink = jumps.nexts && []
+        recording = recorded ? {} : UNRECORDED
+        evaluate = -> { sub_eval(statements, entry, next_scope_sink: next_sink, **recording).last }
+        if jumps.breaks
+          break_sink, fall_through = collect_break_scopes(&evaluate)
+          breaks = targeted_scopes(break_sink, jumps.breaks)
+        else
+          fall_through = evaluate.call
+          breaks = NO_BREAK_ARMS
+        end
+        return [fall_through, breaks] if next_sink.nil?
+
+        exit_scope = targeted_scopes(next_sink, jumps.nexts).reduce(fall_through) do |acc, next_scope|
+          join_with_nil_injection(acc, next_scope)
+        end
+        [exit_scope, breaks]
+      end
+
+      # The `break` scopes the continuation joins. A `break` leaves the loop, so its binding starts no further iteration
+      # and is no input to the rebind fixpoint; it IS the continuation's binding on that path. The arms must come from a
+      # pass whose entry is the CONVERGED binding, which contains every iteration's entry: read from the first pass
+      # alone, a `break` whose branch is dead before any loop-carried rebind has moved (`break(flag = true) if i == 2`
+      # while `i` is still `1`) was never reached and `flag` stayed `false`.
+      #
+      # The fixpoint's last pass is usually one — a fixpoint that stabilised ran it from the binding it returns — so
+      # its arms are reused ({#loop_body_exit_bindings}). A capped fixpoint's widened binding was never evaluated, so
+      # only then does one more pass run, without recording into the per-node scope index: that index keeps the
+      # fixpoint's own last pass, which the check path's diagnostics read. On the display path the re-record pass
+      # ({#record_converged_loop_body}) already ran from the converged binding and leaves its arms here, so no
+      # unrecorded pass follows it. The block write-back reads its `break` arms the same way
+      # ({#join_block_break_bindings}).
+      #
+      # The unrecorded pass is otherwise an ordinary evaluation: a `return` it reaches joins the enclosing method's
+      # inferred return type, as one any other pass reaches does. That only widens the return, toward values a capped
+      # fixpoint's own passes never evaluated.
+      def loop_break_arms(node, post_pred, converged, body_first, jumps, break_pass)
+        return NO_BREAK_ARMS if break_pass.nil?
+        return break_pass[:arms] if break_pass[:entry] == converged.except(*body_first)
+
+        entry = loop_pass_entry(node, post_pred, converged, body_first, jumps)
+        loop_iteration(node.statements, entry, jumps, recorded: false).last
       end
 
-      # Joins each directly-targeting break's body-written local bindings into the loop continuation, so a `break`-path
-      # binding the fall-through dropped is recovered (`flag = true; break` -> `flag` becomes `false | true`). Only
+      # Joins each `break` arm's body-written local bindings into the loop continuation, so a `break`-path binding the
+      # fall-through dropped is recovered (`flag = true; break` -> `flag` becomes `false | true`). Only
       # loop-body-written names are joined — an unchanged local unions to itself; a break-only-written local is already
-      # present via the fixpoint / nil-injection seed, so the union reflects its break value.
-      def join_break_scopes(continuation, sink, targeting, names)
-        return continuation if sink.empty? || names.empty?
-
-        breaks = sink.select { |(node, _scope)| targeting.key?(node) }
-        breaks.reduce(continuation) do |cont, (_node, break_scope)|
+      # present via the fixpoint / nil-injection seed, so the union reflects its break value. A name whose continuation
+      # binding is `Dynamic[top]` — the fixpoint's floor on non-convergence, or a local that was untyped already —
+      # keeps it: a precise arm unioned into it would read as knowledge the analysis does not have.
+      def join_break_scopes(continuation, breaks, names)
+        return continuation if breaks.empty? || names.empty?
+
+        floor = Type::Combinator.untyped
+        breaks.reduce(continuation) do |cont, break_scope|
           names.reduce(cont) do |acc, name|
             break_value = break_scope.local(name)
-            next acc if break_value.nil?
-
             current = acc.local(name)
-            joined = current ? Type::Combinator.union(current, break_value) : break_value
-            acc.with_local(name, joined)
+            next acc if break_value.nil? || current == floor
+
+            acc.with_local(name, current ? Type::Combinator.union(current, break_value) : break_value)
           end
         end
       end
@@ -1324,9 +2215,14 @@ module Rigor
         end
         return post_loop if mutations.empty?
 
+        rewrites = local_rewrites(statements) { true }
         mutations.reduce(post_loop) do |acc, (name, calls)|
-          joined = join_content_for_local(name, calls, content_seed_scope(name, acc, pre_body, rebound), post_loop)
-          joined.nil? ? acc : acc.with_local(name, joined)
+          seed_scope = content_seed_scope(name, acc, pre_body, rebound)
+          seed = lookup_mutated_seed(statements, name, seed_scope.local(name)) { |depth, nesting| depth == nesting }
+          joined = join_content_for_param(calls, seed, post_loop)
+          next acc if joined.nil?
+
+          acc.with_mutated_local(name, rewritten_capture(joined, seed, rewrites.fetch(name, NO_REWRITES)))
         end
       end
 
@@ -1341,26 +2237,30 @@ module Rigor
 
       # Re-evaluates the loop body once from the converged fixpoint bindings, solely for the `on_enter` side effect of
       # re-recording the body's per-node entry scopes. Gated behind the display-path-only `converged_loop_recording`
-      # flag so the check path neither pays the extra body evaluation nor risks any diagnostic drift.
-      def record_converged_loop_body(node, post_pred, bindings, names, body_first)
+      # flag so the check path neither pays the extra body evaluation nor risks any diagnostic drift. The pass leaves
+      # its `break` arms in `break_pass`, which {#loop_break_arms} then reuses instead of running a pass of its own.
+      def record_converged_loop_body(node, post_pred, bindings, names, body_first, jumps, break_pass)
         return unless @converged_loop_recording && @on_enter
 
-        loop_body_exit_bindings(node, post_pred, bindings, names, body_first)
+        loop_body_exit_bindings(node, post_pred, bindings, names, body_first, jumps, break_pass)
         nil
       end
 
       # Runs the slice-B loop-body rebind fixpoint, returning the per-name continuation binding. Seed: a pre-existing
       # local seeds with its post-predicate binding; a local FIRST assigned inside the body seeds with `nil` so the
       # 0-iteration path (the body may never run) degrades it to `T | nil`, matching the historical nil-injection
-      # treatment.
-      def loop_rebind_fixpoint(node, post_pred, names, body_first)
+      # treatment. `break_pass` rides along so every pass leaves its `break` arms for {#loop_break_arms}.
+      def loop_rebind_fixpoint(node, post_pred, names, body_first, jumps, break_pass)
         nil_const = Type::Combinator.constant_of(nil)
         seed = names.to_h { |name| [name, post_pred.local(name) || nil_const] }
+        evaluate_body = lambda do |bindings|
+          loop_body_exit_bindings(node, post_pred, bindings, names, body_first, jumps, break_pass)
+        end
         BodyFixpoint.converge(
           names: names,
           seed_bindings: seed,
           widen: Type::Combinator.method(:widen_value_pinned),
-          evaluate_body: ->(bindings) { loop_body_exit_bindings(node, post_pred, bindings, names, body_first) }
+          evaluate_body: evaluate_body
         )
       end
 
@@ -1400,40 +2300,102 @@ module Rigor
       # exists only to model the 0-iteration path and is kept as a join constituent by {BodyFixpoint#converge}; feeding
       # that `nil` back into the body re-evaluation would leak it past a condition-form assignment the engine does not
       # thread into the branch (`if exps.size > (count = 3)`), false-firing `+`/nil-receiver on the guarded use.
-      def loop_body_exit_bindings(node, post_pred, bindings, names, body_first)
+      #
+      # The exit joins the pass's `next` exits ({#loop_iteration}), so a `next`-path rebind feeds the next iteration.
+      # With a `break_pass` record the pass also leaves its entry and its `break` arms there for {#loop_break_arms};
+      # `BodyFixpoint` hands every pass the same mutable assumption, and `except` copies it before the fixpoint moves
+      # it.
+      def loop_body_exit_bindings(node, post_pred, bindings, names, body_first, jumps, break_pass = nil)
+        entry = loop_pass_entry(node, post_pred, bindings, body_first, jumps)
+        exit_scope, breaks = loop_iteration(node.statements, entry, jumps)
+        if break_pass
+          break_pass[:entry] = bindings.except(*body_first)
+          break_pass[:arms] = breaks
+        end
+        names.to_h { |name| [name, exit_scope.local(name)] }
+      end
+
+      # The scope one fixpoint pass enters the body with: `post_pred` overlaid with the pre-existing names' running
+      # assumption, then narrowed by the predicate's loop-entry edge ({#loop_body_exit_bindings} carries the why).
+      def loop_pass_entry(node, post_pred, bindings, body_first, jumps)
         overlaid = bindings.except(*body_first)
         entry = overlaid.reduce(post_pred) { |acc, (name, type)| acc.with_local(name, type) }
+        entry = loop_content_entry(node.statements, post_pred, entry)
         truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, entry)
-        body_entry = node.is_a?(Prism::UntilNode) ? falsey_scope : truthy_scope
-        _type, exit_scope = sub_eval(node.statements, body_entry)
-        names.to_h { |name| [name, exit_scope.local(name)] }
+        edge = node.is_a?(Prism::UntilNode) ? falsey_scope : truthy_scope
+        # Issue #1359 — a `redo` re-enters the body without testing the predicate again, so a `$_` the predicate
+        # narrowed does not hold there when the body may set it.
+        return edge unless jumps.redoes
+
+        LastLine.forget_if_set(edge, node.statements)
+      end
+
+      # Issue #1412 — the loop-body counterpart of {#repeating_block_entry}: `entry` with every local the body
+      # mutates in place ({CapturedLocals.loop_content_mutations}, bound in `base`) at its unknown-store widening
+      # ({#unknown_store_binding}). A body runs again after it ran, so a later iteration reads what an earlier one
+      # stored, and every pass over it — the single pass and each fixpoint pass ({#loop_pass_entry}), and a `for`
+      # body's only pass — enters this way. A name the pass also rebinds is widened over its running assumption, as
+      # the block write-back widens it ({#capture_pass_bindings}); a name `entry` does not bind is left alone. The
+      # widening keeps the binding's issue #1287 marks, as {#block_pass_entry} keeps them.
+      def loop_content_entry(statements, base, entry)
+        stores = loop_content_mutations(statements, base)
+        return entry if stores.empty?
+
+        stores.reduce(entry) do |acc, (name, sites)|
+          type = acc.local(name)
+          type.nil? ? acc : acc.with_mutated_local(name, unknown_store_binding(type, sites))
+        end
+      end
+
+      # {CapturedLocals.loop_content_mutations} of a loop body against `base`, once per pair: every pass of one
+      # loop asks with the same body and the same post-predicate scope. The slot is keyed on both, so a body asked
+      # against another scope is scanned again.
+      def loop_content_mutations(statements, base)
+        memo = (@loop_content_mutations ||= {}.compare_by_identity)[statements]
+        return memo[1] if memo && memo[0].equal?(base)
+
+        stores = CapturedLocals.loop_content_mutations(statements, base)
+        @loop_content_mutations[statements] = [base, stores]
+        stores
       end
 
       # `for index in collection; body; end`. Unlike `each {}` blocks, `for` does NOT create a new variable scope: the
       # index variable AND every local written in the body leak to the surrounding scope. The collection is evaluated
       # once; the body runs zero or more times, so the post-loop scope is the join of the no-iteration scope (just
       # `post_collection`) and the body scope, with half-bound names degraded to `T | nil` via nil-injection. The loop
-      # expression itself types as `Constant[nil]` (the common case where no `break VALUE` is observed), matching the
-      # policy `eval_loop` uses for `while` / `until`.
+      # expression itself types as `Constant[nil]`, the policy `eval_loop` uses for `while` / `until` — a known gap for
+      # `for`, whose value in Ruby is the collection it iterated (issue #1216).
       def eval_for(node)
         coll_type, post_coll = sub_eval(node.collection, scope)
         element_type = for_iteration_element_type(coll_type)
-        body_entry = bind_for_index(node.index, element_type, post_coll)
+        # Issue #1359 — a body that may set `$_` runs again after it ran, as a `while` body does ({#eval_loop}).
+        body_entry = LastLine.forget_if_set(bind_for_index(node.index, element_type, post_coll), node.statements)
+        body_entry = forget_guard_for_body(node, post_coll, body_entry)
+        body_entry = loop_content_entry(node.statements, post_coll, body_entry)
 
         if node.statements.nil?
           return [Type::Combinator.constant_of(nil), join_with_nil_injection(post_coll, body_entry)]
         end
 
-        # Run the body pass under a break sink so a `break`-path binding the fall-through drops is recovered into the
-        # continuation (the `for` sibling of `eval_loop`'s break join; `for` has no fixpoint, so the single-pass join is
-        # the only continuation).
-        break_targets, break_sink, body_scope = capture_loop_body_breaks(node.statements, body_entry)
+        # The body pass ends with its `next` exits as well as its fall-through, and its `break` arms are recovered into
+        # the continuation (the `for` sibling of `eval_loop`'s break join; `for` has no fixpoint, so the single pass is
+        # the only continuation and the only source of `break` arms).
+        jumps = loop_jumps(node.statements)
+        body_scope, breaks = loop_iteration(node.statements, body_entry, jumps)
         continuation = join_with_nil_injection(post_coll, body_scope)
         pre_existing, body_first = loop_body_local_writes(node.statements, post_coll)
-        continuation = join_break_scopes(continuation, break_sink, break_targets, pre_existing + body_first)
+        continuation = join_break_scopes(continuation, breaks, pre_existing + body_first)
         [Type::Combinator.constant_of(nil), continuation]
       end
 
+      # Issue #1429 — a `for` body runs after the collection's `each`, which may be a project method, and after itself.
+      def forget_guard_for_body(node, post_coll, body_entry)
+        return body_entry unless body_entry.guard_narrowed?
+        return body_entry.forget_guard_narrowings if GuardRebinding.implicit_call_may_rebind?(node, post_coll)
+
+        forget_guard_if_rebinds(body_entry, node.statements)
+      end
+
       # `for x in coll` is semantically `coll.each { |x| ... }`. We ask the method dispatcher for `coll.each`'s expected
       # block parameter types — that path consults RBS and the iterator dispatch table, which is more precise than the
       # structural `collection_element_type` fallback (it knows, e.g., that `Hash[K, V]#each` yields `[K, V]` even when
@@ -1447,7 +2409,8 @@ module Rigor
           receiver_type: coll_type,
           method_name: :each,
           arg_types: [],
-          environment: scope.environment
+          environment: scope.environment,
+          scope: scope
         )
         return structural if block_params.nil? || block_params.empty?
 
@@ -1459,18 +2422,38 @@ module Rigor
       # Binds the `for` index variable(s) into `scope`. A single `LocalVariableTargetNode` is bound to `element_type`
       # (the per-iteration value the collection yields). A `MultiTargetNode` (`for a, b in pairs`) delegates to
       # {MultiTargetBinder}, which decomposes a tuple-shaped element into the inner slots.
+      #
+      # An index target — the whole index (`for h[:a] in xs`) or a slot of a multi-target one (`for h[:a], w in
+      # pairs`) — stores the element / its slot through `[]=` at the top of every iteration, so its receiver widens
+      # here, before the body, exactly as a multi-assign target's does; the body then reads the widened receiver and
+      # the post-loop join keeps it beside the zero-iteration literal, as it keeps a body store's `h[:a] = x`.
       def bind_for_index(index_node, element_type, scope)
         case index_node
         when Prism::LocalVariableTargetNode
           scope.with_local(index_node.name, element_type)
+        when Prism::IndexTargetNode
+          widen_index_target(index_node, element_type, scope, type_scope: scope)
         when Prism::MultiTargetNode
-          MultiTargetBinder.bind(index_node, element_type)
-                           .reduce(scope) { |s, (name, type)| s.with_local(name, type) }
+          bound = MultiTargetBinder.bind_marked(index_node, element_type, scope: scope)
+          widen_index_targets(bound, bound.apply_to(scope), type_scope: scope)
+        when Prism::SplatNode
+          bind_for_splat_index(index_node, scope)
         else
           scope
         end
       end
 
+      # `for *h[:a] in pairs` — Prism gives a bare splat index as a `SplatNode`, not a `MultiTargetNode`, so the
+      # binder never sees it. The store is `*h[:a] = element`, an array of the element's `to_ary` parts; the receiver
+      # widens with the binder's floor for a rest it cannot decompose, `Dynamic[top]`. A bare `*name` target stays
+      # unbound here, as before.
+      def bind_for_splat_index(splat, scope)
+        target = splat.expression
+        return scope unless target.is_a?(Prism::IndexTargetNode)
+
+        widen_index_target(target, Type::Combinator.untyped, scope, type_scope: scope)
+      end
+
       # Extracts the per-iteration element type from a collection carrier. `Tuple[T1..Tn]` yields the union of its
       # elements; `Nominal[Array, [T]]` and `Nominal[Range, [T]]` yield `T`; `Nominal[Hash, [K, V]]` yields `Tuple[K,
       # V]` (Hash#each yields `[key, value]` pairs); `IntegerRange` yields `Integer`; `Constant<Range>` reads the
@@ -1531,45 +2514,178 @@ module Rigor
       # `branch_terminates?`) — the post-OR / post-AND scope is the LHS-skipped edge alone: `a or raise` only survives
       # when `a` was truthy, so subsequent statements observe `a` narrowed to its truthy fragment; the symmetric `a and
       # raise` survives only when `a` was falsey. Same shape as the `eval_if` / `eval_unless` early-return narrowing.
+      #
+      # This is the only and/or typer: `ExpressionTyper` reads a value-position `&&` / `||` from here (issue #1016),
+      # so the RHS narrowing and the constant short-circuit below cannot differ between a statement and a value.
       def eval_and_or(node)
-        left_type, left_scope = sub_eval(node.left, scope)
-        truthy_left, falsey_left = Narrowing.predicate_scopes(node.left, left_scope)
-        rhs_entry = node.is_a?(Prism::AndNode) ? truthy_left : falsey_left
-        right_type, right_scope = sub_eval(node.right, rhs_entry)
+        and_or_with_edges(node, edges: false)
+      end
+
+      # {#eval_and_or}, and with `edges:` also the operator's truthy and falsey edge scopes as a predicate
+      # ({#eval_with_edges}), read off the scopes its operands left rather than off the joined result.
+      def and_or_with_edges(node, edges:)
+        and_node = node.is_a?(Prism::AndNode)
+        left_type, left_scope, truthy_left, falsey_left = eval_with_edges(node.left, scope)
+        right_entry = and_node ? truthy_left : falsey_left
+        right_type, right_scope, truthy_right, falsey_right =
+          edges ? eval_with_edges(node.right, right_entry) : sub_eval(node.right, right_entry)
+        skipped_type = and_node ? Narrowing.narrow_falsey(left_type) : Narrowing.narrow_truthy(left_type)
 
+        # Control never reaches any statement after `a or raise` via the RHS edge — the RHS scope is discarded.
         if branch_terminates?(node.right, right_type)
-          # Control never reaches any statement after `a or raise` via the RHS edge — the RHS scope is discarded.
-          surviving_type =
-            if node.is_a?(Prism::AndNode)
-              Narrowing.narrow_falsey(left_type)
-            else
-              Narrowing.narrow_truthy(left_type)
-            end
-          surviving_scope = node.is_a?(Prism::AndNode) ? falsey_left : truthy_left
-          return [surviving_type, surviving_scope]
+          skipped_scope = and_node ? falsey_left : truthy_left
+          return [skipped_type, skipped_scope, *(Narrowing.predicate_scopes(node, skipped_scope) if edges)]
         end
 
-        skipped_type =
-          if node.is_a?(Prism::AndNode)
-            Narrowing.narrow_falsey(left_type)
-          else
-            Narrowing.narrow_truthy(left_type)
-          end
-        [
-          Type::Combinator.union(skipped_type, right_type),
-          join_with_nil_injection(left_scope, right_scope)
-        ]
+        # A dead RHS is still evaluated and its scope still joins, so a write inside it nil-injects exactly as
+        # before; only its value is dropped, because it cannot be the value of the expression.
+        joined_scope = join_with_nil_injection(left_scope, right_scope)
+        type = skipped_type
+        type = Type::Combinator.union(skipped_type, right_type) unless right_operand_dead?(node, left_type, left_scope)
+        return [type, joined_scope] unless edges
+
+        ran = ran_edge(node, right_scope, and_node ? truthy_right : falsey_right, and_node)
+        return [type, joined_scope, ran, join_with_nil_injection(falsey_left, falsey_right)] if and_node
+
+        [type, joined_scope, join_with_nil_injection(truthy_left, truthy_right), ran]
+      end
+
+      # The edge on which the right operand certainly ran — `&&`'s truthy one, `||`'s falsey one. It is the right
+      # operand's own edge, which keeps every binding and provenance mark the operands' writes made, with the
+      # instance variables and globals of the whole operator narrowed over the scope the right operand left laid over
+      # it. A call in the right operand resets the instance variables and regex globals the left operand narrowed
+      # (`@parent && (node = find_node)` read `@parent` as nilable, `$1` after `line =~ re && (k = Integer($2))` as
+      # nil), and narrowing afresh puts that back as the joined-scope narrowing always did. No call resets a local, so
+      # locals keep the right operand's edge: re-narrowing one the operands write can contradict its new value
+      # (`x.nil? && log(x = "d") && ok` read `x` as `bot`) or drop the marks its write stamped (a published-constant
+      # copy `m = AppConfig::MODE`). A variable the operands write is never overlaid, for the same reason.
+      def ran_edge(node, right_scope, right_edge, and_node)
+        truthy, falsey = Narrowing.predicate_scopes(node, right_scope)
+        renarrowed = and_node ? truthy : falsey
+        written = OperandEffects.written_variables(node)
+        edge = renarrowed.ivars.reduce(right_edge) do |acc, (name, type)|
+          written.include?(name) || acc.ivar(name) == type ? acc : acc.with_ivar(name, type)
+        end
+        renarrowed.globals.reduce(edge) do |acc, (name, type)|
+          written.include?(name) || acc.global(name) == type ? acc : acc.with_global(name, type)
+        end
       end
 
-      # `(body)`. Threads scope through the inner expression so `(x = 1; x + 2)` binds `x` and produces `Constant[3]`.
-      def eval_parentheses(node)
-        return [Type::Combinator.constant_of(nil), scope] if node.body.nil?
+      # `[type, scope, truthy_edge, falsey_edge]` for `node` evaluated from `entry` as a predicate. The edges are
+      # `Narrowing.predicate_scopes` of the scope `node` leaves, except for an `&&` / `||` whose right operand, or
+      # the right operand of an `&&` / `||` on its left, holds a write or jump ({OperandEffects}). The scope such an
+      # operator leaves joins the path where that operand ran with the path that skipped it, so a local the operand
+      # binds reads `nil` there as well, and narrowing that scope cannot tell that the operand certainly ran on the
+      # truthy edge of an `&&` and on the falsey edge of an `||`: `if a && xs.size > (n = f)` read `n` as `nil |
+      # Integer` in the body and reported `n + 1`. Those edges are built from the scopes the operands left instead —
+      # the right operand's edge under the left operand's, and the join where either path reaches the edge. Issue
+      # #1223 threads such a write for every operand, not only for a statement-position one.
+      def eval_with_edges(node, entry)
+        unless and_or_right_effects?(node)
+          type, post = sub_eval(node, entry)
+          return [type, post, *Narrowing.predicate_scopes(node, post)]
+        end
 
-        sub_eval(node.body, scope)
+        @on_enter&.call(node, entry)
+        evaluator_at(entry).send(:and_or_with_edges, node, edges: true)
       end
 
-      # `class Foo; body; end` and `module Foo; body; end`. The class body runs in a fresh scope (Ruby's class scope
-      # does not see the outer locals), and the StatementEvaluator pushes a new `ClassFrame` so nested `def`s know their
+      def and_or_right_effects?(node)
+        return false unless node.is_a?(Prism::AndNode) || node.is_a?(Prism::OrNode)
+
+        OperandEffects.any?(node.right) || and_or_right_effects?(node.left)
+      end
+
+      # Whether a genuine `Constant` left operand proves the RHS never supplies the value: `false && b` and
+      # `1 || b`. The gate is `Constant`-only (issue #152 evaluated a wider one and declined it).
+      #
+      # Issue #313 — it MUST decline an optimistically nil-free operand. A uniform-valued literal hash reads as a lone
+      # `Constant` (`UNIFORM[key]` → `1`), so without the mark `UNIFORM[key] || key` would discard the author's
+      # fallback, and `MAP[key].nil? && b` would drop `b` the program runs when the lookup misses. The mark is
+      # resolved against the LEFT operand's post-scope, as `branch_certainty` does for `if`, so a write in the left
+      # operand (`(v = MAP[key]) || key`) is judged by the binding it just made rather than by an older one.
+      def right_operand_dead?(node, left_type, left_scope)
+        return false unless left_type.is_a?(Type::Constant)
+        return false unless optimistic_origin_for(node.left, left_scope).nil?
+
+        truthy = left_type.value ? true : false
+        node.is_a?(Prism::AndNode) ? !truthy : truthy
+      end
+
+      # `(body)`. Threads scope through the inner expression so `(x = 1; x + 2)` binds `x` and produces `Constant[3]`.
+      def eval_parentheses(node)
+        return [Type::Combinator.constant_of(nil), scope] if node.body.nil?
+
+        sub_eval(node.body, scope)
+      end
+
+      # An array or hash literal, an interpolation or a range: its value is the literal's, typed where it starts, and
+      # its scope is the one its children leave in order ({#thread_operand}). Issue #1223 — `[s = 1]`, `x = [:a, s +=
+      # 1]` and `"#{s = 1}"` left `s` on its pre-write binding. A literal holding no write or jump keeps the entry
+      # scope and costs one scan. Issue #1256 — an element after one that wrote is typed from the scope the elements
+      # before it left ({OperandWalk}), so `[n += 1, n += 1]` is `[1, 2]`.
+      def eval_value_container(node)
+        unless OperandEffects.any?(node)
+          return [scope.type_of(node, tracer: tracer), forget_rebound_specials(scope, node)]
+        end
+
+        walk = OperandWalk.new(walk_recorder)
+        after = thread_operand_children(node, scope, walk, scope)
+        [OperandWalk.type_of(scope, node, tracer, walk.types(tracer)), forget_rebound_specials(after, node)]
+      end
+
+      # Issue #1360 — a backtick or `%x` command runs its interpolations, then the subprocess, which leaves `$?` a
+      # `Process::Status` ({LastStatus.after}).
+      def eval_xstring(node)
+        type, after =
+          if node.is_a?(Prism::InterpolatedXStringNode)
+            eval_value_container(node)
+          else
+            [scope.type_of(node, tracer: tracer), forget_rebound_specials(scope, node)]
+          end
+        [type, LastStatus.after(node, after, scope)]
+      end
+
+      # `expr rescue alt`. The rescue arm runs only when `expr` raised, possibly after some of its writes, so the arm
+      # starts from the entry scope joined with the scope `expr` leaves, and the result joins the arm's scope with
+      # the one `expr` leaves; an arm that always exits (`rescue next`) contributes no scope. Issue #1223 — `x = foo
+      # rescue (s = 1)` left `s` on its pre-write binding. The value is the modifier's own, and one holding no write
+      # or jump keeps the entry scope.
+      #
+      # Issue #1360 — the arm runs with `$!` bound to the `StandardError` it rescued, `$@` to its backtrace and `$?`
+      # unbound ({ErrorInfo.modifier_entry}), and the modifier leaves, through its end or a jump in the arm, with `$!`
+      # and `$@` restored to what it found. `$?` is unbound past a modifier whose arm may fall through: `expr` may have
+      # raised while a subprocess waited, which leaves it nil. The threaded path gets that from the join with the arm.
+      def eval_rescue_modifier(node)
+        unless OperandEffects.any?(node)
+          return [scope.type_of(node, tracer: tracer), forget_rebound_specials(scope, node)]
+        end
+
+        type, after = restoring_error_info { thread_rescue_modifier(node) }
+        [type, forget_rebound_specials(after, node)]
+      end
+
+      def thread_rescue_modifier(node)
+        walk = OperandWalk.new(walk_recorder)
+        after_expression = thread_operand(node.expression, scope, walk, scope)
+        # The arm is threaded outside the walk: its entry nil-injects a local `expr` first binds, which is the
+        # sound join (the raise may come before the write) but reads `u` as `String?` in `Float(u = s) rescue
+        # u.strip`, where the raise almost always comes from `Float` after it. Neither the arm nor anything in it
+        # is recorded or typed from there, which keeps it where it was before #1256: an ADR-5 trade of the rare
+        # raise-before-write path for no false positive on the common one.
+        arm_entry = ErrorInfo.modifier_entry(join_with_nil_injection(scope, after_expression), node.rescue_expression)
+        after_rescue = thread_operand(node.rescue_expression, arm_entry, OperandWalk.new(nil), arm_entry)
+        type = OperandWalk.type_of(scope, node, tracer, walk.types(tracer))
+        after = if branch_unconditionally_exits?(node.rescue_expression)
+                  after_expression
+                else
+                  join_with_nil_injection(after_expression, after_rescue)
+                end
+        [type, after]
+      end
+
+      # `class Foo; body; end` and `module Foo; body; end`. The class body runs in a fresh scope (Ruby's class scope
+      # does not see the outer locals), and the StatementEvaluator pushes a new `ClassFrame` so nested `def`s know their
       # lexical owner. The outer scope is unchanged on exit because Ruby's class definition does not bind any local in
       # the enclosing scope. The class body's value is the value of its last statement (`Constant[nil]` for an empty
       # body); we discard the body's post-scope.
@@ -1639,14 +2755,155 @@ module Rigor
       #
       # The handler still re-evaluates the block under its entry scope so the per-node scope index sees the bindings on
       # the `on_enter` callback path. Block effects do NOT leak into the post-call scope: a block-local write is
-      # observed only inside the block body. The receiver and arguments still observe the outer scope, matching Ruby
-      # evaluation order.
+      # observed only inside the block body.
+      #
+      # Issue #1223 — Ruby evaluates the receiver, then the arguments, and only then runs the method, so a write in
+      # an operand (`out << (n += 1)`, `puts(g = e)`, `(seen += 1) == 2`) is visible to the block and to everything
+      # after the call. {#call_operand_scope} threads each operand that holds one; when none does it answers the
+      # entry scope itself and the call is handled exactly as before. Otherwise the rest of the call — the block's
+      # entry, its write-back and every post-call widening — runs from the scope the operands left
+      # ({#invoke_call}), while the call's value is still typed where the operands started ({#operand_scope}), and
+      # each operand where it was entered: `out << (n += 1)` appends `1`, not the `2` a re-typing after the write
+      # reads. Issue #1256 — an operand after one that wrote is entered from the scope the operands before it left,
+      # and {OperandWalk} records it into the per-node scope index and types it from there: `puts(b.unshift("s"),
+      # b.first.upcase)` reads `b` as the `unshift` left it. The operands are threaded first and the call is typed
+      # after, with those later operands' values in hand, so no operand is typed twice.
       def eval_call(node)
-        call_type = scope.type_of(node, tracer: tracer)
+        walk = OperandWalk.new(walk_recorder)
+        invoked = call_operand_scope(node, walk, scope)
+        invoked = forget_operand_specials(node, invoked)
+        operand_types = walk.types(tracer)
+        call_type = OperandWalk.type_of(scope, node, tracer, operand_types)
         # ADR-56 slice C (B3) — `each_with_object(memo) { |x, acc| acc << … }` returns the memo; the engine otherwise
         # types the call `Dynamic[top]`. Compute the joined memo type from the block's content mutations of the memo
         # block-param and adopt it as the call's return type.
         call_type = each_with_object_return(node, call_type)
+        [call_type, invoke_from(node, invoked, call_type, operand_types)]
+      end
+
+      # The scope after `node` runs as another expression's operand ({#thread_operand}), from the receiver scope.
+      # Such a call is not typed, since its value is discarded and typing it re-types the whole subtree the
+      # enclosing root types — once per level of an operator chain whose every operand writes (`f(a = 1) + f(a =
+      # 2) + …`), and each through the callee's return inference. For the same reason it applies no post-return
+      # narrowing ({#invoke_call}): each of those resolves the method by typing the receiver, the same subtree
+      # again. They only narrow, and a call in an operand never applied them before #1223, so leaving them out is
+      # the sound side. Its own later operands join `walk` and are typed as soon as they are all taken, so its
+      # invocation reads them ({#type_operand}) and the enclosing root does not type them again.
+      def call_effects(node, walk, typed_from)
+        mark = walk.mark
+        invoked = call_operand_scope(node, walk, typed_from)
+        invoke_from(node, invoked, nil, walk.types(tracer, since: mark))
+      end
+
+      # The rest of the call from `invoked`, the scope its operands left, with each later operand's own value in
+      # `operand_types` for the helpers that type the call's operands ({#type_operand}).
+      def invoke_from(node, invoked, call_type, operand_types)
+        return invoke_call(node, call_type) if invoked.equal?(scope) && operand_types.nil?
+
+        evaluator_at(invoked, operand_scope: scope, operand_types: operand_types).send(:invoke_call, node, call_type)
+      end
+
+      # The scope Ruby runs `node`'s method from: the receiver, then the arguments, then a block-pass argument, each
+      # threaded in turn ({#thread_operand}). A safe-navigation call skips its arguments when the receiver is nil,
+      # so their scope joins with the receiver's. Issue #1468 — and runs them only when it is not, so they are
+      # entered with the receiver narrowed to its non-nil fragment ({Narrowing.safe_navigation_scope}). That entry
+      # is not the scope the call is typed from, so {OperandWalk} records and types each of them from it. The
+      # narrowing ends with the operands: when they wrote nothing the scope after them is the receiver's.
+      def call_operand_scope(node, walk, typed_from)
+        after_receiver = thread_operand(node.receiver, scope, walk, typed_from)
+        entered = Narrowing.safe_navigation_scope(node, after_receiver)
+        after_arguments = thread_operand(node.arguments, entered, walk, typed_from)
+        block_pass = node.block
+        if block_pass.is_a?(Prism::BlockArgumentNode)
+          after_arguments = thread_operand(block_pass, after_arguments, walk, typed_from)
+        end
+        return after_arguments if after_arguments.equal?(after_receiver) || !node.safe_navigation?
+        return after_receiver if after_arguments.equal?(entered)
+
+        join_with_nil_injection(after_receiver, after_arguments)
+      end
+
+      # The scope after `node` from `entry`, for an expression otherwise typed as a pure value. One that holds no
+      # write or jump ({OperandEffects}) answers `entry` itself. A call contributes its effects without its value
+      # ({#call_effects}), any other node with a handler is evaluated through it, and an {OPERAND_CONTAINERS} node
+      # threads its children in order.
+      #
+      # `typed_from` is the scope the root types `node` from: its own entry, or that of the nearest enclosing operand
+      # {OperandWalk} took as a later one. When `entry` is not that scope, an earlier operand has moved it, and `walk`
+      # takes `node` ({OperandWalk#later}) before anything below it, so its descendants are typed and recorded against
+      # `entry` in turn. Nothing else is recorded into the per-node scope index.
+      #
+      # A call threaded this way is an operand, so it also leaves out the two resets a statement-position call
+      # applies because it might have done anything ({#invoke_call}): the class's narrowed instance variables and the
+      # regex globals. A call in an operand never applied them before #1223, and applying them only when the operand
+      # happens to write made `$stdout.puts(Integer(v = $2)); $1.upcase` report where `$stdout.puts(Integer($2))`
+      # does not. The same holds for every call under an operand evaluated through its handler, so the evaluator
+      # carries `in_operand` into everything it opens: an in-place mutation counts as an effect, and threading
+      # `opts[:k] = strict? ? queue.shift : nil` must not let the typed `strict?` inside the ternary reset
+      # the regex globals or the narrowed ivars that the same line without the `shift` leaves alone. Issue #1365 —
+      # the statement that holds the operand forgets the regex globals for every call in it instead, threaded or not,
+      # when that call is known to match ({#forget_operand_specials}), so an operand's answer still does not
+      # depend on whether it writes.
+      def thread_operand(node, entry, walk, typed_from)
+        return entry unless node.is_a?(Prism::Node)
+
+        taken = !entry.equal?(typed_from)
+        slot = walk.later(node, entry) if taken
+        typed_from = entry if slot
+        unless OperandEffects.any?(node)
+          # A taken position with no value of its own leaves its children to be taken: nothing types it whole.
+          thread_operand_children(node, entry, walk, typed_from) if taken && slot.nil?
+          return entry
+        end
+
+        operand = evaluator_at(entry, on_enter: nil, in_operand: true, operand_recorder: walk.recorder)
+        return operand.send(:call_effects, node, walk, typed_from) if node.is_a?(Prism::CallNode)
+        # A container is threaded child by child even when it has a handler: the handler types the whole literal,
+        # which a nested literal would repeat once per level of nesting. A statement list or `(…)` inside an operand
+        # runs its statements in order just the same, and evaluating it would type each statement it holds.
+        if OPERAND_CONTAINERS.include?(node.class) || OPERAND_SEQUENCES.include?(node.class)
+          return thread_operand_children(node, entry, walk, typed_from)
+        end
+        return entry unless HANDLERS.key?(node.class)
+
+        # The handler types the operand from `entry`, which is the value a later operand takes.
+        type, after = operand.evaluate(node)
+        walk.resolve(slot, type) if slot
+        after
+      end
+
+      def thread_operand_children(node, entry, walk, typed_from)
+        threaded = entry
+        node.rigor_each_child { |child| threaded = thread_operand(child, threaded, walk, typed_from) }
+        threaded
+      end
+
+      # The recorder an {OperandWalk} rooted here records later operands with: the per-node scope index's, whether
+      # this evaluator records into it itself or is an operand evaluator threading a recording one's operands. An
+      # unrecorded pass ({UNRECORDED}) has neither.
+      def walk_recorder
+        @operand_recorder || @on_enter
+      end
+
+      # A call operand's type, read from where the call's operands were typed ({#operand_scope}), with each later
+      # operand's own value ({OperandWalk}) where the call has one.
+      def type_operand(node)
+        OperandWalk.type_of(operand_scope, node, tracer, @operand_types)
+      end
+
+      # The scope this evaluator types a call's receiver and arguments under: where they were evaluated, which
+      # {#invoke_call} under {#call_effects}' rebase is not the receiver scope. Every helper below that types the
+      # current call's own operands reads this rather than `scope`, so it reads exactly what it read before the
+      # rebase existed.
+      def operand_scope
+        @operand_scope || scope
+      end
+
+      # The rest of {#eval_call}: the call's block and every effect the call leaves on the scope, from the receiver
+      # scope, which is the scope its operands left. Returns the post-call scope. `call_type` is nil for a threaded
+      # operand, which applies no post-return narrowing ({#call_effects}); nor does a call an operand evaluator
+      # types through a handler ({#thread_operand}).
+      def invoke_call(node, call_type)
         evaluate_block_if_present(node)
         # `ruby2_keywords def foo(...)` (and similar wrappers like `private def`, `public def`, `module_function def`)
         # parse the def as the call's positional argument; the ExpressionTyper#type_of_def handler types it as
@@ -1662,9 +2919,8 @@ module Rigor
         # scope; the spec MUST in § "Fact stability and mutation" names captured locals a first-class invalidation
         # category. (The escaping / unknown path already widened to Dynamic[top] via `record_closure_escape_if_any`.)
         post_scope = write_back_block_captures(node, post_scope)
-        post_scope = apply_rbs_extended_assertions(node, post_scope)
-        post_scope = apply_plugin_assertions(node, post_scope)
-        post_scope = apply_rspec_matcher_narrowing(node, post_scope)
+        statement_call = !call_type.nil? && !@in_operand
+        post_scope = apply_post_return_narrowing(node, post_scope) if statement_call
         # Flow-folding G1 / G2 — widen a local- or instance-variable binding when the call is an in-place mutator on it
         # (e.g. `arms << x`, `@tags << hashtag`). Stops a literal-shape carrier (`Tuple` / `HashShape`) from outliving
         # its justification when the value is mutated. Always-safe (loses precision, never invents facts).
@@ -1674,7 +2930,7 @@ module Rigor
         # sibling `s.y` stays precise. `call_type` is the setter's own result (the assigned value type). Sound only for
         # a fold-safe local (never aliased / escaped, straight-line setters) — the fold-safe scan is the gate.
         post_scope = MethodDispatcher::StructFolding.apply_setter_writeback(
-          call_node: node, assigned_type: call_type, scope: post_scope
+          call_node: node, assigned_type: call_type || local_attribute_write_value(node), scope: post_scope
         )
         # ADR-57 slice 3 work-item 1 (cross-method-boundary variant). When a self-call resolves to a user method that
         # CONTENT-mutates one of its parameters inside an escaping block (the `build_option_parser(opts)` idiom — the
@@ -1710,41 +2966,148 @@ module Rigor
         # binding has narrowed below the class-ivar seed back to the seed itself, so a subsequent `if @flag` predicate
         # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts). See
         # [`docs/CURRENT_WORK.md`](../../../docs/CURRENT_WORK.md) § "Flow-folding" — G2 intervening-call case.
-        post_scope = invalidate_ivars_for_intervening_call(node, post_scope)
+        post_scope = invalidate_ivars_for_intervening_call(node, post_scope) if statement_call
         # C1 — regex match-data globals (`$~`, `$1..$9`, `$&`, …) are narrowed to non-nil on a successful-match edge; a
         # later call that itself runs a regex match rebinds them, so the narrowed facts must be dropped. We forget them
-        # only when the call is match-CAPABLE (a regex-matching method, or an implicit-self / unknown-receiver call
-        # whose body we cannot prove match-free). A call provably match-free on a known receiver — `$3.to_i`, `year <
-        # 50` — does NOT clobber, so the multi-statement `m = /…/ =~ s; …; use($2)` stdlib idiom keeps its precision
-        # while a genuinely interposed match still invalidates.
+        # only when the call may run a match in this frame ({#rebinds_match_globals?}). A call provably match-free on a
+        # known receiver — `$3.to_i`, `year < 50` — does NOT clobber, so the multi-statement `m = /…/ =~ s; …; use($2)`
+        # stdlib idiom keeps its precision while a genuinely interposed match still invalidates.
         # The chain above is Scope-total by construction (every helper returns its input scope or a
         # combinator result); the `||=` is a runtime no-op that pins the INFERRED type back to Scope for
         # the negative rules when a helper's return widens to `Scope?` under call-site binding (#524).
         post_scope ||= scope
-        post_scope = post_scope.forget_match_globals if match_capable_call?(node)
-        [call_type, post_scope]
+        statement_call ? rebind_statement_specials(node, post_scope) : post_scope
+      end
+
+      # `post_scope`, past a statement call, with the specials the call rebinds: the match globals and `$_` forgotten
+      # when it may rebind them in this frame, and `$?` bound when it, or an operand, certainly ran a subprocess, since
+      # `$?` is the thread's (issue #1360, {LastStatus.after}).
+      # Issue #1429 — and a guard's narrowing of a global or constant restored when the call may run code that rebinds
+      # it ({GuardRebinding.call_may_rebind?}).
+      def rebind_statement_specials(node, post_scope)
+        post_scope = post_scope.forget_match_globals if rebinds_match_globals?(node, post_scope)
+        post_scope = post_scope.forget_last_line if rebinds_last_line?(node, post_scope)
+        if post_scope.guard_narrowed? && GuardRebinding.call_may_rebind?(node, operand_scope)
+          post_scope = post_scope.forget_guard_narrowings
+        end
+        forget_rescued_status(LastStatus.after(node, post_scope, scope), node)
+      end
+
+      # True when the call may rebind this frame's match globals: it is match-capable itself ({#match_capable_call?}),
+      # its own block may run a match ({MatchRebinding.block_may_match?} — issue #1358: the block runs in this frame,
+      # so `items.each { |i| i =~ re }` rebinds the enclosing method's `$~`, while a match inside a called Ruby method
+      # rebinds that method's own), or the frame has made a closure that may run one whenever it is called
+      # ({Scope#match_rebinding_closure?}). The receiver chain and arguments ran before the call, and
+      # {#forget_operand_specials} answered for them. The scans run only while a match global is narrowed, the
+      # one state a forget can drop.
+      def rebinds_match_globals?(node, post_scope)
+        return false unless post_scope.match_globals_bound?
+        return true if match_capable_call?(node)
+
+        MatchRebinding.block_may_match?(node, scope) || post_scope.match_rebinding_closure?
+      end
+
+      # Issue #1359 — whether the call rebinds `$_`, which shares the match globals' frame slot and so their call
+      # rules ({LastLine.call_rebinds?}): a reader, or a block or closure of this frame that may run one, does; a
+      # call into a method defined in Ruby does not. The receiver chain and arguments ran before the call, and
+      # {#forget_operand_specials} answered for them. The scans run only while `$_` is narrowed.
+      def rebinds_last_line?(node, post_scope)
+        post_scope.last_line_bound? && LastLine.call_rebinds?(node, scope)
+      end
+
+      # Issue #1365 — the scope a statement call runs its method from, with the match globals forgotten when its
+      # receiver chain or arguments may rebind them ({MatchRebinding.operands_may_rebind?}): Ruby runs those first,
+      # so the call's own block already reads the rebound globals (`s.sub(re, "").each_char { $1 }`). No call in them
+      # forgot before, so each forgets here only when it is known to match ({MatchRebinding::Calls.rebinds?}), and
+      # none resets by itself ({#invoke_call}), so an operand's answer does not depend on whether the evaluator
+      # threads it: `$stdout.puts(Integer(v = $2))` keeps `$1` narrowed as `$stdout.puts(Integer($2))` does. `$_`
+      # is forgotten the same way when they may set it (`line = gets.chomp`, issue #1359).
+      def forget_operand_specials(node, invoked)
+        return invoked if @in_operand
+
+        if invoked.match_globals_bound? && MatchRebinding.operands_may_rebind?(node, scope)
+          invoked = invoked.forget_match_globals
+        end
+        # Issue #1429 — a guard narrowing the receiver chain or an argument may rebind.
+        if invoked.guard_narrowed? && GuardRebinding.operands_may_rebind?(node, scope)
+          invoked = invoked.forget_guard_narrowings
+        end
+        return invoked unless invoked.last_line_bound? && LastLine.operands_may_set?(node, scope)
+
+        invoked.forget_last_line
       end
 
-      # Method names that (may) run a regex match and therefore rebind the `$~` family. Conservative over-approximation
-      # — a few set globals only with a Regexp argument, but we do not inspect args.
-      MATCH_CAPABLE_METHODS = %i[
-        =~ match match? gsub gsub! sub sub! scan split slice slice!
-        [] partition rpartition index rindex === grep grep_v
-      ].freeze
-      private_constant :MATCH_CAPABLE_METHODS
-
-      # True when `node` could rebind the regex match-data globals: a known regex-matching method by name, or an
-      # implicit-self / self-receiver call whose body we cannot inspect for an internal match. An explicit-receiver call
-      # to a non-matching method (`$3.to_i`, `year < 50`, `buf << c`) is treated as match-free so the multi-statement `m
-      # = /…/ =~ s; …; use($2)` idiom keeps the narrowed globals. The over-approximation is one-directional: a user
-      # method that secretly matches on an explicit receiver is the only escape, and re-narrowing on the next real guard
-      # recovers — weighed against the false-positive cost, precision wins here.
+      # Issue #1365 — `after` with the match globals forgotten when `node`, a value this statement types without
+      # evaluating the calls in it as statements (an array, hash or interpolation literal, a `rescue` modifier, a
+      # constant's value, a `super` or `yield`), may rebind them ({MatchRebinding.value_may_rebind?}), and `$_` when
+      # it may set it ({LastLine.may_set?}, issue #1359). Inside an operand the statement that holds it answers
+      # instead.
+      def forget_rebound_specials(after, node)
+        return after if @in_operand
+
+        if after.match_globals_bound? && MatchRebinding.value_may_rebind?(node, scope)
+          after = after.forget_match_globals
+        end
+        after = after.forget_last_line if after.last_line_bound? && LastLine.may_set?(node, scope)
+        # Issue #1429 — and a guard's narrowing of a global or constant, when a call in it may rebind one.
+        after = after.forget_guard_narrowings if after.guard_narrowed? && GuardRebinding.may_rebind?(node, scope)
+        forget_rescued_status(after, node)
+      end
+
+      # Issue #1360 — `after`, past a statement, with `$?` forgotten when the statement may fall through a rescue in its
+      # own frame ({#rescues_through?}): the exception rescued there may have been raised while a subprocess waited,
+      # which leaves `$?` nil, and a rescue in an operand or a block the statement passes never joins its scope back.
+      def forget_rescued_status(after, node)
+        return after unless after.global(:$?) && rescues_through?(node)
+
+        after.forget_last_status
+      end
+
+      # True when running `node` may leave a rescue clause, or the fallback of a rescue modifier that may fall
+      # through, and go on: anywhere in its operands and the blocks it passes, but not in a lambda, a block a call
+      # keeps to run later ({StoredBlockCall.stores_block?}, which includes a thread's) or a `def`, none of which runs
+      # there.
+      def rescues_through?(node)
+        case node
+        when Prism::RescueNode then return true
+        when Prism::RescueModifierNode then return true unless branch_unconditionally_exits?(node.rescue_expression)
+        when Prism::DefNode, Prism::LambdaNode then return false
+        end
+        kept = node.block if node.is_a?(Prism::CallNode) && StoredBlockCall.stores_block?(node)
+        found = false
+        node.rigor_each_child { |child| found ||= !child.equal?(kept) && rescues_through?(child) }
+        found
+      end
+
+      # The value an untyped setter call on a local stores (`foo(s.x = v)`), for the Struct member write-back; nil for
+      # any other call, which that write-back ignores.
+      def local_attribute_write_value(node)
+        return nil unless node.attribute_write? && node.receiver.is_a?(Prism::LocalVariableReadNode)
+
+        type_operand(node)
+      end
+
+      def apply_post_return_narrowing(node, post_scope)
+        post_scope = apply_rbs_extended_assertions(node, post_scope)
+        post_scope = apply_plugin_assertions(node, post_scope)
+        apply_rspec_matcher_narrowing(node, post_scope)
+      end
+
+      # True when `node` could rebind the regex match-data globals by itself
+      # ({MatchRebinding::Calls.statement_rebinds?}): a method that matches on this frame's behalf, on any receiver,
+      # read with the operands where they were typed (issue #1365: a name the old table forgot on keeps forgetting
+      # unless its literal arguments prove it match-free, so `row[:name]`, `csv.split(",")` and `s.match?(re)` keep
+      # the narrowing and `row[key]` does not; any other call forgets when it is known to match, as
+      # `u.start_with?(/(q)/)` is); or an implicit-self / `self.` call that may reach this frame's slot. Issue #1364 —
+      # a method defined in Ruby runs in a frame of its own, so a match in its body rebinds its own `$~`, never its
+      # caller's, and `log("parsed"); key = $1` keeps `$1` narrowed; such a call forgets as every implicit-self call
+      # did before only in a frame that hands its slot to code the analyzer does not trace, or where no body stamped
+      # a frame. A call to a non-matching method (`$3.to_i`, `year < 50`, `buf << c`) is match-free, so the
+      # multi-statement `m = /…/ =~ s; …; use($2)` idiom keeps the narrowed globals.
       def match_capable_call?(node)
         return true unless node.is_a?(Prism::CallNode)
-        return true if MATCH_CAPABLE_METHODS.include?(node.name)
 
-        receiver = node.receiver
-        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+        MatchRebinding::Calls.statement_rebinds?(node, operand_scope)
       end
 
       # Returns a scope with each ivar's narrowed local binding widened back to its class-ivar seed value when the call
@@ -2105,6 +3468,10 @@ module Rigor
         return nil if method_def.nil?
 
         arguments = call_node.arguments&.arguments || []
+        # A `(?)` overload (`RBS::Types::UntypedFunction`, #1430) names no parameter and accepts any argument list,
+        # so a call may reach it with the target's position holding anything: no overload proves the target.
+        return nil unless method_def.method_types.all? { |mt| mt.type.respond_to?(:required_positionals) }
+
         method_def.method_types.each do |mt|
           params = mt.type.required_positionals + mt.type.optional_positionals
           index = params.find_index { |param| param.name == target_name }
@@ -2113,11 +3480,23 @@ module Rigor
         nil
       end
 
+      # Issue #1468 — the block of `recv&.m { … }` runs only once `recv` is non-nil, so it is entered from the scope
+      # with the receiver narrowed ({Narrowing.safe_navigation_block_scope}), and every entry rule
+      # {#enter_call_block} applies reads that scope as any other. The receiver's own type, which the block's
+      # parameters and the repetition rules are read from, stays where the call's operands were typed.
       def evaluate_block_if_present(node)
         block = node.block
         return unless block.is_a?(Prism::BlockNode)
 
-        block_entry = build_block_entry_scope(node, block)
+        narrowed = Narrowing.safe_navigation_block_scope(node, scope)
+        return enter_call_block(node, block) if narrowed.equal?(scope)
+
+        evaluator_at(narrowed, operand_scope: operand_scope, operand_types: @operand_types)
+          .send(:enter_call_block, node, block)
+      end
+
+      def enter_call_block(node, block)
+        block_entry = narrow_define_method_block_self(node, repeating_block_entry(node, block))
         # #319 — `Class.new do ... end` and friends evaluate their block as a CLASS BODY (`class_eval`
         # semantics): `self` is the freshly created class, so a `def` inside defines an instance method on it
         # and `attr_reader` runs as a class-level macro. Enter the block under the same `self_type` /
@@ -2127,12 +3506,71 @@ module Rigor
         # call in the body as `call.unresolved-toplevel`.
         #
         # Outer locals stay visible: unlike a `class` keyword body, the block is a closure.
+        refined = refined_class_context(node)
+        return enter_meta_class_body(block, block_entry, refined) if refined
+
         anonymous = AnonymousMetaClass.name_for(node, scope.source_path)
-        return sub_eval(block, block_entry) if anonymous.nil?
+        if anonymous.nil?
+          return sub_eval(block, block_entry) unless return_barrier_block?(node)
+
+          return without_return_sink { sub_eval(block, block_entry) }
+        end
 
         enter_meta_class_body(block, block_entry, [ClassFrame.new(name: anonymous, singleton: false)])
       end
 
+      # Issue #1120 — `refine X do … end` in a module body. A `def` in the block defines an instance method of X (a
+      # refined one), so its body runs with an instance of X as `self` and reads X's instance variables, exactly as
+      # a `def` in a `class X` body does. Entering the block as X's class body gives it that through the ordinary
+      # {#self_type_for_method_body} route. Only a constant X is modelled ({ScopeIndexer.refine_target}). One that
+      # does not type as a class object (a gem class with no RBS) keeps the name as written: the body is still some
+      # class's body, and leaving it on the enclosing `self` made a `refine` at the file's top level report every
+      # implicit-self call in it as `call.unresolved-toplevel`.
+      def refined_class_context(node)
+        target = ScopeIndexer.refine_target(node)
+        return nil if target.nil?
+
+        refined = scope.type_of(target)
+        name = refined.is_a?(Type::Singleton) ? refined.class_name : Source::ConstantPath.qualified_name(target)
+        return nil if name.nil?
+
+        [ClassFrame.new(name: name.delete_prefix("::"), singleton: false, refinement: true)]
+      end
+
+      # The block calls whose body `return` leaves only the block ({ReturnBarrier.block_call?}). Like a `->` body
+      # ({#eval_lambda}), each runs with the enclosing method's return sink suspended.
+      def return_barrier_block?(node)
+        ReturnBarrier.block_call?(node)
+      end
+
+      # Runs the block with the method's return sink suspended, for a body whose `return` is not the method's.
+      def without_return_sink
+        outer_sink = Thread.current[RETURN_SINK_KEY]
+        Thread.current[RETURN_SINK_KEY] = nil
+        begin
+          yield
+        ensure
+          Thread.current[RETURN_SINK_KEY] = outer_sink
+        end
+      end
+
+      # Issue #963 — `define_method(:name) { ... }` in a class body defines an INSTANCE method, and Ruby runs
+      # the block with `self` bound to the receiving instance. Without this the block inherits the class body's
+      # `Singleton[C]`, and #618's own-method veto asks the singleton side of a name the instance side answers.
+      # {DefineMethodBlockSelf} owns the match; a non-match leaves the entry scope exactly as it was.
+      #
+      # The exclusion — the `class << ...` BODY, where `self` is the singleton class and the call defines a class
+      # method — rides on `Scope#singleton_class_body?`, not on the frame stack: a `def` reached from that body
+      # still carries the singleton frame although its `self` is the class object, and it is an instance method
+      # the call defines there. Carrying the mark on the scope is also what lets the return-typing path apply the
+      # same exclusion, which has no frame stack of its own.
+      def narrow_define_method_block_self(call_node, block_entry)
+        narrowed = DefineMethodBlockSelf.narrow_self_type_for(
+          scope: scope, call_node: call_node
+        )
+        narrowed ? block_entry.with_self_type(narrowed) : block_entry
+      end
+
       # Enters a meta-new `block` as the body of the class `class_context` names: `self_type` is that class's
       # singleton, so a `def` inside binds an instance method on it through the ordinary
       # {#self_type_for_method_body} route, while `block_entry` keeps the outer locals visible. Shared by the two
@@ -2146,7 +3584,7 @@ module Rigor
       # frame is still pushed — it is what a nested `def` registers its method under — which is exactly the
       # divergence that makes the chain a separate record rather than a view of the frame stack.
       def enter_meta_class_body(block, block_entry, class_context)
-        entry = block_entry.with_self_type(self_type_for_class_body(class_context))
+        entry = block_entry.with_self_type(self_type_for_class_body(class_context)).with_singleton_class_body(false)
         sub_eval(block, stamp_nesting(entry, @lexical_nesting), class_context: class_context)
       end
 
@@ -2209,19 +3647,18 @@ module Rigor
         acc
       end
 
+      # Runs for every call of every body it walks, and nearly every call reports no argument, so that case returns
+      # before `reduce`: `Enumerable#inject` allocates its iteration state even over an empty array.
       def floor_callee_escaped_args_for_call(node, base_scope)
-        return base_scope unless self_dispatch_call?(node)
-        # Fast path — the floor only ever touches a local passed as an argument, so a call with no arguments cannot
-        # floor anything. Skip the def resolution + body scan entirely (the overwhelming common case).
-        return base_scope unless call_passes_local_argument?(node)
-
-        def_node = resolve_self_callee_def(node)
-        return base_scope if def_node.nil?
+        arguments = content_mutated_arguments(node)
+        return base_scope if arguments.empty?
 
-        mutated = callee_content_mutated_parameters(def_node)
-        return base_scope if mutated.empty?
+        arguments.reduce(base_scope) do |acc, argument|
+          next acc unless acc.locals.key?(argument.name)
 
-        floor_arguments_at_positions(node, mutated, base_scope)
+          floored = content_floor_for(acc.local(argument.name))
+          floored.nil? ? acc : acc.with_mutated_local(argument.name, floored)
+        end
       end
 
       # The `{ name => position }` positional parameters whose content the callee mutates, from either channel: those
@@ -2367,20 +3804,6 @@ module Rigor
         end
       end
 
-      def floor_arguments_at_positions(node, positions, base_scope)
-        args = node.arguments
-        return base_scope unless args.respond_to?(:arguments)
-
-        argument_nodes = args.arguments
-        positions.values.uniq.reduce(base_scope) do |acc, index|
-          arg = argument_nodes[index]
-          next acc unless arg.is_a?(Prism::LocalVariableReadNode) && acc.locals.key?(arg.name)
-
-          floored = content_floor_for(acc.local(arg.name))
-          floored.nil? ? acc : acc.with_local(arg.name, floored)
-        end
-      end
-
       # Walk the receiver chain of `node` and fold the escaping-content widening of every block-bearing, escaping
       # receiver call into `base_scope`. Only receiver calls are walked — `node` itself is handled by the caller. A
       # `:non_escaping` receiver block is left to slice C's non-escaping write-back (which the receiver expression
@@ -2422,7 +3845,7 @@ module Rigor
 
         mutations.keys.reduce(post_scope) do |acc, name|
           floored = content_floor_for(acc.local(name))
-          floored.nil? ? acc : acc.with_local(name, floored)
+          floored.nil? ? acc : acc.with_mutated_local(name, floored)
         end
       end
 
@@ -2445,10 +3868,17 @@ module Rigor
 
       # The Dynamic-floor carrier for a content-mutated escaping capture, or nil when the pre-state is not a recognised
       # mutable collection (leave it alone — e.g. an already-`Dynamic` binding or an unknown shape).
+      #
+      # A String counts in any refined form (`non-empty-string`, `decimal-int-string`), which `stringish?` does not
+      # accept: the mutation can empty or rewrite it as it can a plain `String`.
       def content_floor_for(type)
         return nil if type.nil?
+        # A union with a String member floors member by member, so neither carrier swallows the other and a member no
+        # mutation can fill (`nil`) stays: taken whole, `Array | String` floored to `Array[untyped]` and `String?` to
+        # nothing at all.
+        return UnknownStoreWidening.content_floor(type) if string_union?(type)
 
-        if stringish?(type)
+        if UnknownStoreWidening.carrier_class(type) == "String"
           Type::Combinator.nominal_of("String")
         elsif hashish?(type)
           Type::Combinator.nominal_of("Hash",
@@ -2459,12 +3889,26 @@ module Rigor
         end
       end
 
+      # The type of `call_node`'s explicit receiver where its operands were typed ({#type_operand}), computed once per
+      # call: the block's entry (its parameter types, a DSL `self`, the #1412 repeat gate), its escape class and
+      # every write-back pass all ask, and {#type_operand} types the receiver afresh each time. The one slot is
+      # keyed on the node, and an evaluator types every operand from the same scope.
+      def explicit_receiver_type(call_node)
+        memo = @explicit_receiver_type
+        return memo[1] if memo && memo[0].equal?(call_node)
+
+        type = type_operand(call_node.receiver)
+        @explicit_receiver_type = [call_node, type]
+        type
+      end
+
       def classify_closure_escape(call_node)
-        receiver_type = call_node.receiver ? scope.type_of(call_node.receiver, tracer: tracer) : nil
+        receiver_type = call_node.receiver ? explicit_receiver_type(call_node) : nil
         ClosureEscapeAnalyzer.classify(
           receiver_type: receiver_type,
           method_name: call_node.name,
-          environment: scope.environment
+          environment: scope.environment,
+          scope: scope
         )
       rescue StandardError
         :unknown
@@ -2474,11 +3918,16 @@ module Rigor
       # drop matches the spec line "facts about locals it can write become unstable after the escape point": rather than
       # synthesise the union of the block's write types (which the current pass does not yet expose), we discard the
       # narrowed binding altogether. A future sub-phase MAY refine this to the union of the block's actual writes.
+      #
+      # An instance variable the body rebinds is dropped the same way: the block shares the caller's `self`, so a
+      # callback that runs later writes the very ivar the continuation reads (`@clicked = false; button.on_click {
+      # @clicked = true }` left `if @clicked` folding always-falsey). One still on its ADR-58 declaration seed is
+      # left alone ({CapturedLocals.writes}): that seed already holds whatever the callback stores.
       def drop_captured_narrowing(block_node, base_scope)
-        names = CapturedLocals.writes(block_node, base_scope)
+        names = CapturedLocals.writes(block_node, base_scope, ivars: true)
         return base_scope if names.empty?
 
-        names.reduce(base_scope) { |acc, name| acc.with_local(name, Type::Combinator.untyped) }
+        names.reduce(base_scope) { |acc, name| bind_capture(acc, name, Type::Combinator.untyped) }
       end
 
       # ADR-56 slice A. For a `:non_escaping` block, fold the continuation binding of every outer local the body can
@@ -2487,25 +3936,154 @@ module Rigor
       # — `[].each { … }` — stays sound), value-pinned- widened on the final permitted iteration, and floored to
       # `Dynamic[top]` on non-convergence (matching `drop_captured_narrowing`).
       #
-      # Fast path: a block writing no outer local leaves `post_scope` byte-identical (the overwhelming majority of
-      # blocks), so this costs one extra `CapturedLocals.writes` walk and nothing else.
+      # The instance variables the body rebinds (`CapturedLocals.writes` with `ivars: true`) outlive the call the same
+      # way — `@n = 0; [1, 2].each { @n += 1 }` left `@n == 0` folding always-truthy — so they join the name set,
+      # seeded from their pre-call binding. See {#converge_captures_by_kind} for how a block that rebinds both kinds is
+      # answered.
+      #
+      # Fast path: a block writing no outer local and no rebindable ivar leaves `post_scope` byte-identical (the
+      # overwhelming majority of blocks), so this costs one `CapturedLocals.writes` walk and nothing else.
+      #
+      # Every pass reads a captured local the body mutates IN PLACE at its unknown-store widening
+      # ({#capture_pass_bindings}), never at the contents the collection held before the call: only the rebound names
+      # move between passes, so a rebind read from such a collection (`last = a.last; a << x`) would otherwise record
+      # the first iteration's answer on every pass and the fixpoint would close over it (ADR-56 WD2.13, second
+      # residue).
       def write_back_block_captures(call_node, post_scope)
         block = call_node.block
         return post_scope unless block.is_a?(Prism::BlockNode)
         return post_scope unless classify_closure_escape(call_node) == :non_escaping
 
-        names = CapturedLocals.writes(block, scope)
+        names = CapturedLocals.writes(block, scope, ivars: true)
         return post_scope if names.empty?
 
-        seed = names.to_h { |name| [name, scope.local(name)] }
-        result = BodyFixpoint.converge(
+        break_pass = block_break_pass(block)
+        result = converge_captures_by_kind(call_node, block, names, break_pass)
+        result = join_block_break_bindings(call_node, block, result, break_pass)
+        result.reduce(post_scope) { |acc, (name, type)| bind_capture(acc, name, type) }
+      end
+
+      # The {BodyFixpoint} continuation of `names`, seeded from their pre-call bindings.
+      def converge_block_captures(call_node, block, names, break_pass)
+        BodyFixpoint.converge(
           names: names,
-          seed_bindings: seed,
+          seed_bindings: names.to_h { |name| [name, CapturedLocals.bound_type(scope, name)] },
           widen: Type::Combinator.method(:widen_value_pinned),
-          evaluate_body: ->(bindings) { block_exit_bindings(call_node, block, bindings, names) }
+          evaluate_body: ->(bindings) { block_pass_exit_bindings(call_node, block, bindings, names, break_pass) }
         )
+      end
+
+      # The continuation of a block's rebound names. One {BodyFixpoint} over locals and ivars together is the wrong
+      # answer for most of them: its final pass widens every name while any name still moves, so an ivar counter beside
+      # `mode = :b` turned `mode`'s converged `:a | :b` into `Symbol` — and a local counter beside `@mode = :b` did the
+      # same to `@mode` — and `take(mode)` against `(:a | :b) -> void` fired on code each kind's own fixpoint accepts.
+      #
+      # So each kind converges on its own first, with the other at its pre-call binding; for a block that rebinds one
+      # kind that is the only fixpoint, and for the locals it is exactly the one a block rebinding no ivar has always
+      # had. A name converged that way is wrong when it reads the other kind (`last = @n; @n += 1`, `@last = count`),
+      # so one more pass under the settled bindings checks every name, and one whose exit leaves its settled binding
+      # takes its answer from a joint fixpoint over both kinds, computed only then. The check repeats, because a name
+      # read off a moved one (`first = last`) may move in turn; every round moves a name to its joint answer or stops.
+      #
+      # The body's last evaluation is therefore a pass under the settled bindings, so the scopes recorded inside the
+      # block read those rather than a pass that pinned one kind to its pre-call value.
+      #
+      # `break_pass` ({#block_break_pass}) rides along so every pass — a fixpoint's or a check's — leaves its `break`
+      # scopes for {#join_block_break_bindings}.
+      def converge_captures_by_kind(call_node, block, names, break_pass)
+        kinds = names.partition { |name| !CapturedLocals.ivar_name?(name) }
+        return converge_block_captures(call_node, block, names, break_pass) if kinds.any?(&:empty?)
+
+        settled = kinds.map { |kind| converge_block_captures(call_node, block, kind, break_pass) }.reduce(:merge)
+        joint = nil
+        loop do
+          exits = block_pass_exit_bindings(call_node, block, settled, names, break_pass)
+          moved = escaped_captures(settled, exits, joint)
+          return settled if moved.empty?
+
+          joint ||= converge_block_captures(call_node, block, names, break_pass)
+          moved.each { |name| settled[name] = joint[name] }
+        end
+      end
+
+      # The names whose `exits` leave their `settled` binding, less those already on their `joint` answer.
+      def escaped_captures(settled, exits, joint)
+        settled.keys.select do |name|
+          exit_type = exits[name]
+          next false if exit_type.nil? || (joint && settled[name] == joint[name])
 
-        result.reduce(post_scope) { |acc, (name, type)| acc.with_local(name, type) }
+          Type::Combinator.union(settled[name], exit_type) != settled[name]
+        end
+      end
+
+      # Binds a name from `CapturedLocals.writes`. An ivar goes through {CapturedLocals.bind}, which keeps its issue
+      # #286 optimistic mark. A local keeps the plain `with_local` these seams have always used, so a block that
+      # rebinds no ivar leaves the locals exactly as before.
+      def bind_capture(scope, name, type)
+        CapturedLocals.ivar_name?(name) ? CapturedLocals.bind(scope, name, type) : scope.with_local(name, type)
+      end
+
+      # A block-level `break` ends the CALL, so the binding it leaves with starts no further iteration and is no input
+      # to the write-back fixpoint — feeding it back would type the next pass's body under a value the body never sees
+      # (`acc = "s"; break` reaching the next pass's `acc`). It IS the continuation's binding on that path, though, and
+      # without this join `found = nil; xs.each { |x| if x > 1; found = x; break; end }` left `found` on `nil` and
+      # folded `if found` always-falsey.
+      #
+      # The arms must come from a pass whose entry is the CONVERGED binding, which contains every iteration's entry.
+      # The write-back's last pass usually is one — a fixpoint that stabilised, and every by-kind check pass
+      # ({#converge_captures_by_kind}), ran from the binding it returns — so its arms are reused
+      # ({#block_pass_exit_bindings}). A capped fixpoint's widened binding was never evaluated, so only then does one
+      # more pass run, without recording into the per-node scope index: that index keeps the write-back's own last
+      # pass, which the check path's diagnostics read, exactly as the loop fixpoint's converged re-record is
+      # display-only ({#record_converged_loop_body}). A name the fixpoint floored to `Dynamic[top]` keeps the floor; a
+      # precise arm unioned into it would read as knowledge the analysis does not have.
+      def join_block_break_bindings(call_node, block, converged, break_pass)
+        return converged if break_pass.nil?
+
+        arms =
+          if break_pass[:entry] == converged
+            break_pass[:arms]
+          else
+            converged_break_arms(call_node, block, converged, break_pass[:targets])
+          end
+        return converged if arms.empty?
+
+        floor = Type::Combinator.untyped
+        converged.to_h do |name, type|
+          next [name, type] if type == floor
+
+          [name, Type::Combinator.union(type, *arms.filter_map { |arm| CapturedLocals.bound_type(arm, name) })]
+        end
+      end
+
+      # nil for a body with no block-level `break` — one allocation-free scan, and the write-back runs exactly as
+      # before. Otherwise the record {#block_pass_exit_bindings} fills: the targeting `break`s, and the entry
+      # bindings and `break` scopes of the most recent fixpoint pass.
+      def block_break_pass(block)
+        body = block.body
+        return nil unless JumpTargets.any?(body, Prism::BreakNode)
+
+        { targets: JumpTargets.of(body, Prism::BreakNode), entry: nil, arms: [] }
+      end
+
+      # One write-back fixpoint pass ({#block_exit_bindings}), collecting the scopes at the block-level `break`s it
+      # reaches when there are any. `BodyFixpoint` hands every pass the same mutable assumption, so the entry is
+      # copied before the fixpoint moves it.
+      def block_pass_exit_bindings(call_node, block, bindings, names, break_pass)
+        return block_exit_bindings(call_node, block, bindings, names) if break_pass.nil?
+
+        sink, exits = collect_break_scopes { block_exit_bindings(call_node, block, bindings, names) }
+        break_pass[:entry] = bindings.dup
+        break_pass[:arms] = targeted_scopes(sink, break_pass[:targets])
+        exits
+      end
+
+      # The `break` scopes of one unrecorded pass from `converged` — for a capped fixpoint, whose widened binding no
+      # pass has run from.
+      def converged_break_arms(call_node, block, converged, targets)
+        entry = block_pass_entry(call_node, block, converged)
+        sink, = collect_break_scopes { sub_eval(block, entry, **UNRECORDED) }
+        targeted_scopes(sink, targets)
       end
 
       # ADR-56 slice C — receiver-content element-type join. After the rebind write-back and
@@ -2525,8 +4103,8 @@ module Rigor
       # post-call effect applied ahead of the widening; the pre-CALL `scope` would carry neither. The loop seam makes
       # the same choice with `pre_body`; see {#loop_content_writeback}.
       #
-      # The block body is typed once for argument evidence; the floor is `Array[Dynamic[top]]` /
-      # `Hash[untyped, untyped]` (the sound empty-seed behaviour). Always sound — only ever widens.
+      # The stored evidence is typed in the block-entry scope and iterated to a fixpoint when a store reads a
+      # collection the join moves — see {#join_content_to_fixpoint}. Always sound — only ever widens.
       def content_writeback_block_captures(call_node, post_scope, seed_scope:)
         block = call_node.block
         return post_scope unless block.is_a?(Prism::BlockNode)
@@ -2535,14 +4113,424 @@ module Rigor
         body = block.body
         return post_scope if body.nil?
 
-        mutations = collect_content_mutations(body)
+        shadows = {}.compare_by_identity
+        mutations = captured_content_mutations(block, shadows)
         return post_scope if mutations.empty?
 
-        entry = build_block_entry_scope(call_node, block)
-        mutations.reduce(post_scope) do |acc, (name, calls)|
-          joined = join_content_for_local(name, calls, seed_scope, entry)
-          joined.nil? ? acc : acc.with_local(name, joined)
+        seeds = mutations.to_h do |name, _calls|
+          [name, lookup_mutated_seed(body, name, seed_scope.local(name)) { |depth, nesting| depth > nesting }]
+        end
+        shadow_rebound_reads(block, mutations, seeds, shadows)
+        joined = join_content_to_fixpoint(mutations, seeds, build_block_entry_scope(call_node, block), shadows)
+        rewrites = local_rewrites(block.body) { |receiver, ancestors| receiver.depth > scope_nesting(ancestors) }
+        joined.reduce(post_scope) do |acc, (name, type)|
+          acc.with_mutated_local(name, rewritten_capture(type, seeds[name], rewrites.fetch(name, NO_REWRITES)))
+        end
+      end
+
+      NO_REWRITES = [].freeze
+      private_constant :NO_REWRITES
+
+      # The {RewriteMutation} names `root` calls on each local its block admits — `a.map!(&:to_s)` beside an `a << x`.
+      # The receiver test is the one the caller's content-mutation walk applies.
+      def local_rewrites(root)
+        rewrites = {}
+        Source::NodeWalker.each_with_ancestors(root) do |node, ancestors|
+          next unless node.is_a?(Prism::CallNode) && RewriteMutation.rewriter?(node.name)
+
+          receiver = node.receiver
+          next unless receiver.is_a?(Prism::LocalVariableReadNode) && yield(receiver, ancestors)
+
+          (rewrites[receiver.name] ||= []) << node.name
+        end
+        rewrites
+      end
+
+      # The slice-C join (and the loop seam's) rebuilds a collection from its SEED, so the rewrite the body's own
+      # widening applied is gone from it: `a = [1]; [0].each { a.map!(&:to_s); a << "x" }` read `Array["x" | 1]`, and
+      # `a[0] == "1"` folded always-falsey. Each rewrite the body makes on the local is re-applied here, on the seam's
+      # terms: a seed the straight-line widening may not grow (a precise nominal, #561) is left as the join answered it.
+      def rewritten_capture(type, seed, method_names)
+        return type if method_names.empty? || !MutationWidening.shape_carrier?(seed)
+
+        method_names.uniq.reduce(type) { |acc, method_name| RewriteMutation.arm_through(acc, method_name) }
+      end
+
+      # Adds to each store's `shadows` every local it reads that the block body writes and the block-entry scope binds:
+      # an outer local the body rebinds, or a block parameter or `;`-local it reassigns. A local the body introduces
+      # already reads `Dynamic[top]` there. A joined collection the body also rebinds is included: the join's seed
+      # carries slice A's continuation, which misses a value written between two rebinds.
+      #
+      # The block-entry scope binds such a local where the call found it, so a store reading one recorded the first
+      # iteration's value: `total = 0; out = []; [1, 2].each { |x| total += x; out << total }` stored `0` as far as the
+      # join could tell, `out` read `Array[0]`, and `out.last == 3` folded always-falsey on a program whose `out` is
+      # `[1, 3]`. Typed as `Dynamic[top]`, the store is `out`'s one unknown member and nothing folds.
+      #
+      # Every precise reading tried reported on correct code instead:
+      #
+      # - slice A's continuation misses a value written between two rebinds;
+      # - joined with the block-entry typing, it still stores exit values no store reads;
+      # - one more walk of the body to the store inherits every gap in the engine's in-body flow.
+      #
+      # See ADR-56 WD2.13.
+      def shadow_rebound_reads(block, sites, seeds, shadows)
+        entry_names = scope.locals.keys | CapturedLocals.introduced_locals(block).to_a
+        written = scope_local_writes(block) & entry_names
+        return if written.empty?
+
+        sites.each do |name, nodes|
+          # A mixed `Array | Hash` seed reads as a Hash here: its key arguments are the Hash side's evidence, and a
+          # `Dynamic` index only makes the Array side read the store as both forms.
+          array = content_kind(seeds[name]) == :array
+          nodes.each do |site|
+            names = store_value_reads(site, array) & written
+            shadows[site] = shadows.fetch(site, []) | names unless names.empty?
+          end
+        end
+      end
+
+      # The locals a store reads to build what it stores. An Array index write's index arguments are left out, and so
+      # is any name they read: the join classifies the store as an element or a splice from the index's type, and a
+      # `Dynamic` index reads as both, so `grid[i] = [x, x]` would join `x` itself as a member of `grid` beside the
+      # pair. Such an index keeps its block-entry binding, which is master's reading, and so does a stored value that
+      # reads the same name: `ids[n] = n; n += 1` still stores `n`'s first-iteration value.
+      def store_value_reads(site, array)
+        return local_reads(site) unless array
+
+        if site.is_a?(Prism::CallNode) && site.name == :[]=
+          *index, value = site.arguments&.arguments || []
+          [value, site.receiver].compact.flat_map { |n| local_reads(n) } - index.flat_map { |n| local_reads(n) }
+        elsif IndexWriteWidening.index_write?(site)
+          value = site.respond_to?(:value) ? site.value : nil
+          [value, site.receiver].compact.flat_map { |n| local_reads(n) } - local_reads(site.arguments)
+        else
+          local_reads(site)
+        end
+      end
+
+      # Every local the block writes in its own scope or an outer one, in its body or in a parameter's default. A
+      # write inside an inner block or lambda to a name that block introduces is a different variable: its `depth`
+      # climbs fewer scopes than it is nested in. A method, class or module body inside the block is a scope of its own.
+      def scope_local_writes(block)
+        names = []
+        [block.parameters, block.body].compact.each do |root|
+          Source::NodeWalker.each_with_ancestors(root) do |node, ancestors|
+            next unless CapturedLocals::LOCAL_WRITE_NODES.any? { |klass| node.is_a?(klass) }
+
+            names << node.name if same_scope_local?(node, ancestors)
+          end
+        end
+        names.uniq
+      end
+
+      # The bodies that open a scope of their own, where a local's `depth` starts again from zero.
+      SCOPE_BODY_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      private_constant :SCOPE_BODY_NODES
+
+      # True when the local `node` names lives in the scope the walk started in or an outer one.
+      def same_scope_local?(node, ancestors)
+        return false if ancestors.any? { |ancestor| SCOPE_BODY_NODES.any? { |klass| ancestor.is_a?(klass) } }
+
+        node.depth >= scope_nesting(ancestors)
+      end
+
+      # The nodes that read a local's current value: a plain read, and the compound writes that read before they store.
+      LOCAL_READ_NODES = [
+        Prism::LocalVariableReadNode,
+        Prism::LocalVariableOperatorWriteNode,
+        Prism::LocalVariableOrWriteNode,
+        Prism::LocalVariableAndWriteNode
+      ].freeze
+      private_constant :LOCAL_READ_NODES
+
+      # Every local `node` reads from the scope it sits in: a read inside an inner block of a name that block
+      # introduces is a different variable.
+      def local_reads(node)
+        return [] if node.nil?
+
+        names = []
+        Source::NodeWalker.each_with_ancestors(node) do |n, ancestors|
+          next unless LOCAL_READ_NODES.any? { |klass| n.is_a?(klass) }
+
+          names << n.name if same_scope_local?(n, ancestors)
+        end
+        names.uniq
+      end
+
+      # The evidence a content join reads, per collection kind: one element union for an Array, a key union and a
+      # value union for a Hash, all three for a seed carrying both ({ContentJoin.join_mixed_content}), and none for a
+      # String, which widens to `String` whatever it stored.
+      CONTENT_EVIDENCE_SLOTS = {
+        array: %i[element].freeze, hash: %i[key value].freeze, mixed: %i[key value element].freeze, string: [].freeze
+      }.freeze
+      private_constant :CONTENT_EVIDENCE_SLOTS
+
+      # The joined continuation carrier of each content-mutated name, shared by the block seam and
+      # {#each_with_object_return}. `sites` maps each name to its mutation nodes, `seeds` to its pre-state; the answer
+      # omits a name whose pre-state is no collection.
+      #
+      # The evidence is typed in the block-entry scope, where each mutated collection still holds its PRE-CALL
+      # contents. A store whose evidence reads one of them therefore records the FIRST iteration's answer: `h = { a:
+      # 0 }; [:a, :a, :a].each { |k| h[k] = h[k] + 1 }` stored `1` as far as a single pass could tell, the join read
+      # `Hash[:a | Symbol, 0 | 1]`, and `h[:a] == 3` folded always-falsey on a program that prints.
+      #
+      # So each collection a store reads is bound to what it holds at ANY iteration's entry. A name none of whose
+      # stores reads a mutated Array or Hash is FIXED: its evidence is the same on every iteration, so it is typed
+      # once and the name is bound to its own join — a String to `String`, whatever it stored, so `lens << buf.length`
+      # after `buf << w` reads `Integer`, not the length of `buf`'s pre-call value. Every other name MOVES, and its
+      # evidence is iterated to a fixpoint through {BodyFixpoint}: each of its evidence slots is one fixpoint name,
+      # and each pass re-types its stores with every moving collection bound to its seed joined with the evidence so
+      # far. The join above widens to `Hash[Symbol, 0 | Integer]` on the final pass, and evidence that keeps growing
+      # structurally floors to `Dynamic[top]`, the slot's one-unknown-store answer. Only moving slots are ever
+      # widened, so `acc << 1` beside such a store keeps `Array[1]`.
+      #
+      # That is what keeps this seam's claim to complete evidence ({MutationWidening#gradual_floor} rests on it): the
+      # scan sees every store in the body, and no store's evidence is read off a first-iteration binding. The final
+      # pass trusts its widening without re-checking it, exactly as slice A's fixpoint does (ADR-56 WD3). A gradual
+      # arm on every self-reading store would be sound too, but its `Dynamic` would quiet every later read of the
+      # collection, where the converged `Integer` still reports `h[:a].upcase`. With no moving name — the `acc = [];
+      # xs.each { |x| acc.push(x) }` accumulator — this is the single pass it always was.
+      #
+      # `shadows` maps a site to the names its evidence is typed with bound to `Dynamic[top]`. A site nested in an inner
+      # block or lambda lists the names that block binds itself (parameters, `;`-locals): the entry scope is the seam
+      # block's, where such a name resolves to the OUTER local it shadows, and `|y| out << y.first` inside the block
+      # must not read an outer `y = [0]`. Every site also lists the locals it reads that the body writes
+      # ({#shadow_rebound_reads}).
+      def join_content_to_fixpoint(sites, seeds, entry, shadows = NO_SHADOWS)
+        kinds = seeds.filter_map { |name, seed| (kind = content_kind(seed)) && [name, kind] }.to_h
+        return {} if kinds.empty?
+
+        moving = moving_content_names(sites, kinds)
+        fixed = kinds.except(*moving)
+        strings, settled = fixed.partition { |_name, kind| kind == :string }.map(&:to_h)
+        fixed_entry = bind_content_joins(entry, strings, seeds, {})
+        evidence = content_evidence(sites, fixed, fixed_entry, shadows)
+        unless moving.empty?
+          base = bind_content_joins(fixed_entry, settled, seeds, evidence)
+          evidence = evidence.merge(converge_content_evidence(sites, seeds, kinds.slice(*moving), base, shadows))
+        end
+        kinds.to_h { |name, kind| [name, join_content_evidence(seeds[name], kind, name, evidence)] }
+      end
+
+      # The pre-state's collection kind, or nil when the join has no carrier to rederive — the dispatch
+      # {#join_content_for_param} makes, and the reason it answers nil for the same pre-states. A seed carrying both
+      # an Array and a Hash member is `:mixed`, and each side joins with its own class's evidence.
+      def content_kind(pre_state)
+        return nil if pre_state.nil?
+        return :string if stringish?(pre_state)
+        return (arrayish?(pre_state) ? :mixed : :hash) if hashish?(pre_state)
+
+        :array if arrayish?(pre_state)
+      end
+
+      # The names whose evidence can differ between iterations: a store that reads a mutated Array or Hash among its
+      # arguments (a `[]=` call's stored value is one), or an Array-side compound index write (`a[i] += v`), whose
+      # stored value is computed from the slot it overwrites. A String never moves — its join is `String` whatever it
+      # stored — and the Hash side floors an index write's value, so there only the key arguments are typed.
+      def moving_content_names(sites, kinds)
+        movable = kinds.reject { |_name, kind| kind == :string }.keys
+        movable.select do |name|
+          sites[name].any? do |node|
+            (kinds[name] == :array && IndexWriteWidening.index_write?(node)) || store_arguments_read?(node, movable)
+          end
+        end
+      end
+
+      def bind_content_joins(scope, kinds, seeds, evidence)
+        kinds.reduce(scope) do |acc, (name, kind)|
+          acc.with_local(name, content_entry_binding(seeds[name], kind, name, evidence))
+        end
+      end
+
+      # What a collection holds at any iteration's entry, given the evidence so far: its join, plus the seed members
+      # that join refutes. The join already covers every other seed value — a `Tuple`, `HashShape` or `Difference`
+      # is absorbed into the rederived carrier and any other member survives beside it — but it drops a seed's
+      # `nil` ({ContentJoin::NON_SURVIVING_CLASSES}). The first iteration's entry still holds that `nil`, and it can
+      # outlive another collection's growth: without it `out << a.nil?; a ||= []; a << v` read `Array[false]`.
+      # Unioning the whole seed back would re-add its literal shape as well, and dispatch over `[] | Array[2]` is
+      # wider than over `Array[2]`, so `a[0, 1] ||= [2]` stopped converging.
+      def content_entry_binding(seed, kind, name, evidence)
+        join = join_content_evidence(seed, kind, name, evidence)
+        members = seed.is_a?(Type::Union) ? seed.members : [seed]
+        refuted = members.select do |member|
+          ContentJoin::NON_SURVIVING_CLASSES.include?(ContentJoin.evidence_class(member))
+        end
+        refuted.empty? ? join : Type::Combinator.union(join, *refuted)
+      end
+
+      # The nodes that open a local scope a read's `depth` counts.
+      SCOPE_NESTING_NODES = [Prism::BlockNode, Prism::LambdaNode].freeze
+      private_constant :SCOPE_NESTING_NODES
+
+      # The block's captured content mutations: `{ name => [node, ...] }` for every content mutator whose receiver is
+      # a local from OUTSIDE the block. A read's `depth` counts the scopes it climbs, so it reaches past the seam's
+      # block only when it climbs more scopes than the blocks and lambdas nested between it and the block's body.
+      # `collect_content_mutations` tests `depth >= 1`, which is that rule only directly in the body: it took a block
+      # PARAMETER mutated inside a nested block (`|y| [9].each { y << 9 }`), or a nested block's own parameter one
+      # level deeper, for the outer local it shadows, and the join rebound the parameter to that local's contents.
+      #
+      # Each site nested in an inner block or lambda is recorded in `shadows` with the names those blocks bind
+      # themselves (see {#join_content_to_fixpoint}).
+      def captured_content_mutations(block, shadows)
+        mutations = Hash.new { |h, k| h[k] = [] }
+        Source::NodeWalker.each_with_ancestors(block.body) do |node, ancestors|
+          name, site = content_mutation_target(node) { |receiver| receiver.depth > scope_nesting(ancestors) }
+          next if name.nil?
+
+          mutations[name] << site
+          record_shadows(shadows, site, ancestors)
+        end
+        mutations
+      end
+
+      def scope_nesting(ancestors)
+        ancestors.count { |ancestor| scope_nesting_node?(ancestor) }
+      end
+
+      def scope_nesting_node?(node)
+        SCOPE_NESTING_NODES.any? { |klass| node.is_a?(klass) }
+      end
+
+      def record_shadows(shadows, site, ancestors)
+        names = ancestors.select { |a| scope_nesting_node?(a) }
+                         .flat_map { |a| CapturedLocals.introduced_locals(a).to_a }
+        shadows[site] = names unless names.empty?
+      end
+
+      # `scope` with each name a site's enclosing inner blocks bind bound to `Dynamic[top]`: the seam's scope cannot
+      # see those bindings, and the name would otherwise resolve to the outer local it shadows.
+      def site_evidence_scope(scope, site, shadows)
+        names = shadows[site]
+        return scope if names.nil?
+
+        names.reduce(scope) { |acc, name| acc.with_local(name, Type::Combinator.untyped) }
+      end
+
+      # `base` binds every fixed name to its join; the moving names are rebound on each pass.
+      def converge_content_evidence(sites, seeds, kinds, base, shadows)
+        slots = kinds.flat_map { |name, kind| CONTENT_EVIDENCE_SLOTS.fetch(kind).map { |slot| [name, slot] } }
+        BodyFixpoint.converge(
+          names: slots,
+          seed_bindings: slots.to_h { |slot| [slot, Type::Combinator.bot] },
+          widen: Type::Combinator.method(:widen_value_pinned),
+          evaluate_body: lambda do |assumption|
+            pass_entry = kinds.reduce(base) do |acc, (name, kind)|
+              acc.with_local(name, content_carrier_under(seeds[name], kind, name, assumption))
+            end
+            content_evidence(sites, kinds, pass_entry, shadows)
+          end
+        )
+      end
+
+      # The binding a fixpoint pass reads a moving collection at: its seed until any evidence exists, then — as for a
+      # fixed name — {#content_entry_binding} over the evidence so far.
+      def content_carrier_under(seed, kind, name, evidence)
+        no_evidence = CONTENT_EVIDENCE_SLOTS.fetch(kind).all? { |slot| present_evidence(evidence[[name, slot]]).empty? }
+        no_evidence ? seed : content_entry_binding(seed, kind, name, evidence)
+      end
+
+      # `{ [name, slot] => union }` for every collection name, typed in `evidence_scope`; a slot no store contributes
+      # to reads `bot`.
+      def content_evidence(sites, kinds, evidence_scope, shadows)
+        kinds.each_with_object({}) do |(name, kind), evidence|
+          case kind
+          when :hash
+            record_pair_evidence(evidence, name, hash_pair_evidence(sites[name], evidence_scope, shadows))
+          when :array
+            evidence[[name, :element]] =
+              Type::Combinator.union(*array_element_evidence(sites[name], evidence_scope, shadows).compact)
+          when :mixed
+            pairs, elements = mixed_content_evidence(sites[name], evidence_scope, shadows)
+            record_pair_evidence(evidence, name, pairs)
+            evidence[[name, :element]] = Type::Combinator.union(*elements.compact)
+          end
+        end
+      end
+
+      # A collection seed with a String member (`[1] | "ab"`) joins that member as `String` and the rest as the
+      # collection it is ({#join_string_members}); joined whole, the String member survived with its value pinned
+      # although a String mutator in the body is what put the name here.
+      def join_content_evidence(seed, kind, name, evidence)
+        if kind != :string && string_union?(seed)
+          return join_string_members(seed) { |others| join_content_evidence(others, kind, name, evidence) }
+        end
+
+        case kind
+        when :string
+          Type::Combinator.nominal_of("String")
+        when :hash
+          ContentJoin.join_hash_content(seed, joined_pair_evidence(name, evidence))
+        when :mixed
+          ContentJoin.join_mixed_content(
+            seed, joined_pair_evidence(name, evidence), present_evidence(evidence[[name, :element]])
+          )
+        else
+          ContentJoin.join_array_content(seed, present_evidence(evidence[[name, :element]]))
+        end
+      end
+
+      def record_pair_evidence(evidence, name, pairs)
+        evidence[[name, :key]] = Type::Combinator.union(*pairs.map(&:first).compact)
+        evidence[[name, :value]] = Type::Combinator.union(*pairs.map(&:last).compact)
+      end
+
+      # The `[pairs, elements]` the `calls` on a mixed `Array | Hash` seed store, typed in `entry_scope`. The seam
+      # cannot tell which member a store reached, so an index store (`[]=` or an index write) is routed by its index.
+      # One no Array accepts — a Symbol, String, `nil` or boolean key, where `[1][:k] = v` raises `TypeError` — is the
+      # Hash side's alone. One that could reach either member floors BOTH sides to `Dynamic[top]`: read precisely, its
+      # value lands on the side it never reached, and a hand-written `-> Array[Integer] | Hash[Symbol, String]`
+      # rejects the `Array["t" | Integer]` a guarded `x[:b] = "t" if x.is_a?(Hash)` made of the Array member. Every
+      # other adder belongs to one class, and each side reads it as its single-class join does.
+      def mixed_content_evidence(calls, entry_scope, shadows = NO_SHADOWS)
+        index_stores, adders = calls.partition { |c| index_write?(c) || (c.is_a?(Prism::CallNode) && c.name == :[]=) }
+        hash_only, either = index_stores.partition do |site|
+          array_index_excluded?(site, site_evidence_scope(entry_scope, site, shadows))
         end
+        pairs = hash_pair_evidence(adders + hash_only, entry_scope, shadows)
+        elements = array_element_evidence(adders, entry_scope, shadows)
+        return [pairs, elements] if either.empty?
+
+        untyped = Type::Combinator.untyped
+        [pairs + [[untyped, untyped]], elements + [untyped]]
+      end
+
+      # The classes an Array index never converts from: none defines `to_int`, and none is a Range.
+      NON_ARRAY_INDEX_CLASSES = %w[Symbol String NilClass TrueClass FalseClass].to_set.freeze
+      private_constant :NON_ARRAY_INDEX_CLASSES
+
+      # True when one of the index store `site`'s index arguments provably holds no value an Array accepts as an index.
+      # A splat, and a type with any member of another or unknown class, may hold one.
+      def array_index_excluded?(site, scope)
+        arguments = site.arguments
+        list = arguments.is_a?(Prism::ArgumentsNode) ? arguments.arguments : []
+        list = list.take(list.size - 1) if site.is_a?(Prism::CallNode)
+        list.any? do |arg|
+          next false if arg.is_a?(Prism::SplatNode)
+
+          ContentJoin.union_members(scope.type_of(arg, tracer: tracer)).all? do |member|
+            NON_ARRAY_INDEX_CLASSES.include?(ContentJoin.evidence_class(member))
+          end
+        end
+      rescue StandardError
+        false
+      end
+
+      # The Hash side's evidence as the one `[key, value]` pair its slots join to, or none.
+      def joined_pair_evidence(name, evidence)
+        key = present_evidence(evidence[[name, :key]]).first
+        value = present_evidence(evidence[[name, :value]]).first
+        key.nil? && value.nil? ? [] : [[key, value]]
+      end
+
+      def present_evidence(type)
+        type.nil? || type.is_a?(Type::Bot) ? [] : [type]
+      end
+
+      def store_arguments_read?(node, names)
+        arguments = node.arguments
+        return false if arguments.nil?
+
+        Source::NodeWalker.each(arguments).any? { |n| n.is_a?(Prism::LocalVariableReadNode) && names.include?(n.name) }
       end
 
       # ADR-56 slice C (B3). For `recv.each_with_object(memo) { |x, acc| … }` the return is the memo object after the
@@ -2567,15 +4555,51 @@ module Rigor
 
         # The memo alias is a block-local (depth 0) — collect content mutations on it directly rather than via the
         # captured-local walk.
-        calls = body_content_mutations_on(body, memo_param)
+        shadows = {}.compare_by_identity
+        calls = body_content_mutations_on(body, memo_param, shadows)
         return call_type if calls.empty?
 
-        pre_state = scope.type_of(memo_arg, tracer: tracer)
-        entry = build_block_entry_scope(call_node, block)
-        joined = join_content_for_param(calls, pre_state, entry)
+        pre_state = lookup_mutated_seed(body, memo_param, scope.type_of(memo_arg, tracer: tracer)) do |depth, nesting|
+          depth == nesting
+        end
+        joined = join_memo_content(call_node, memo_param, calls, pre_state, shadows)
         joined || call_type
       end
 
+      # `seed` as the {HashLookupMutation} calls `body` makes on `name` leave it. They add no content, so the join
+      # never sees them as sites, and a seed read before `widen_after_block` is still the closed shape whose known
+      # values answer every missing key: `b = { a: 1 }; [1].each { b.default = 0; b[:c] = 2 }` read `b[:zz]` as
+      # `1 | 2`, and so did an `each_with_object({})` memo given a default beside its stores, and a `while` body. The
+      # block receives a read's `depth` and its enclosing block count, and says whether the read is the variable
+      # `seed` describes. A `def` opens a scope of its own, so nothing under one is.
+      def lookup_mutated_seed(body, name, seed)
+        Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
+          next unless node.is_a?(Prism::CallNode) && HashLookupMutation::MUTATORS.include?(node.name)
+          next if ancestors.any?(Prism::DefNode)
+
+          receiver = node.receiver
+          next unless receiver.is_a?(Prism::LocalVariableReadNode) && receiver.name == name
+          next unless yield(receiver.depth, scope_nesting(ancestors))
+
+          seed = MutationWidening.widen_for_mutator(seed, node.name) || seed
+        end
+        seed
+      end
+
+      # The memo's joined carrier. The captured collections the block content-mutates join alongside it, and only the
+      # memo's carrier is kept: a memo store reading one of them (`buf << w; m << buf.length`) must see it as it
+      # stands at any iteration's entry, not at its pre-call contents. Their own continuation is the block seam's to
+      # write.
+      def join_memo_content(call_node, memo_param, calls, pre_state, shadows)
+        block = call_node.block
+        captured = captured_content_mutations(block, shadows)
+        seeds = captured.keys.to_h { |name| [name, scope.local(name)] }
+        seeds[memo_param] = pre_state
+        sites = captured.merge(memo_param => calls)
+        shadow_rebound_reads(block, sites, seeds, shadows)
+        join_content_to_fixpoint(sites, seeds, build_block_entry_scope(call_node, block), shadows)[memo_param]
+      end
+
       # The name of the memo block parameter (the SECOND positional param of an `each_with_object` block), or nil when
       # the block does not bind a second positional param.
       def each_with_object_memo_param(block)
@@ -2592,18 +4616,21 @@ module Rigor
         second.respond_to?(:name) ? second.name : nil
       end
 
-      # Content-mutator calls on a block-local receiver `var_name` (depth 0) within `body`.
-      def body_content_mutations_on(body, var_name)
+      # Content-mutator calls on the block-local `var_name` within `body` — directly, or from a nested block that
+      # reaches it by exactly the scopes it is nested in. A nested block's own parameter of the same name is a
+      # different variable and does not count.
+      def body_content_mutations_on(body, var_name, shadows)
         calls = []
-        Source::NodeWalker.each(body) do |descendant|
+        Source::NodeWalker.each_with_ancestors(body) do |descendant, ancestors|
           next unless descendant.is_a?(Prism::CallNode)
-          next unless ContentJoin::CONTENT_ADDERS.include?(descendant.name)
+          next unless CONTENT_MUTATORS.include?(descendant.name)
 
           receiver = descendant.receiver
           next unless receiver.is_a?(Prism::LocalVariableReadNode)
-          next unless receiver.name == var_name
+          next unless receiver.name == var_name && receiver.depth == scope_nesting(ancestors)
 
           calls << descendant
+          record_shadows(shadows, descendant, ancestors)
         end
         calls
       end
@@ -2616,11 +4643,14 @@ module Rigor
       # Dynamic out: a shapeless pre-state falls through to `join_array_param`, which declines it.
       def join_content_for_param(calls, pre_state, block_entry)
         return nil if pre_state.nil?
+        return join_string_union(calls, pre_state, block_entry) if string_union?(pre_state)
 
         if stringish?(pre_state)
           # String carries no element parameter; mutating `<<`/`concat` makes the constant value unsound (`s = "a"; s <<
           # x` → runtime `"a…"`), so widen to the nominal base. Sound — only widens.
           Type::Combinator.nominal_of("String")
+        elsif content_kind(pre_state) == :mixed
+          ContentJoin.join_mixed_content(pre_state, *mixed_content_evidence(calls, block_entry))
         elsif hashish?(pre_state)
           join_hash_param(calls, pre_state, block_entry)
         else
@@ -2628,8 +4658,35 @@ module Rigor
         end
       end
 
+      # A union with a String member (`Array | String`, `String?`) joins member by member: the String members widen to
+      # `String`, which has no element evidence to join, and the rest join as a union of their own. Joined whole, the
+      # union reached the Array or Hash join, which dropped the String member and read a String mutator's arguments as
+      # elements — `x.force_encoding(e)` on an `Array | String` capture typed it `Array[1 | Encoding]`.
+      def join_string_union(calls, union, block_entry)
+        join_string_members(union) { |others| join_content_for_param(calls, others, block_entry) }
+      end
+
+      # `String` for the String members of `union`, beside what the block answers for the rest (as a union of their
+      # own), or the rest unchanged when the block answers nil.
+      def join_string_members(union)
+        rest = union.members.reject { |member| string_member?(member) }
+        string = Type::Combinator.nominal_of("String")
+        return string if rest.empty?
+
+        others = Type::Combinator.union(*rest)
+        Type::Combinator.union(string, yield(others) || others)
+      end
+
+      def string_union?(type)
+        type.is_a?(Type::Union) && type.members.any? { |member| string_member?(member) }
+      end
+
+      def string_member?(type)
+        UnknownStoreWidening.carrier_class(type) == "String"
+      end
+
       def join_hash_param(calls, pre_state, block_entry)
-        pairs = calls.flat_map { |c| hash_pair_types(c, block_entry) }
+        pairs = hash_pair_evidence(calls, block_entry)
         return nil if pairs.empty? && !hashish?(pre_state)
 
         ContentJoin.join_hash_content(pre_state, pairs)
@@ -2638,14 +4695,49 @@ module Rigor
       def join_array_param(calls, pre_state, block_entry)
         return nil unless arrayish?(pre_state)
 
-        added = calls.flat_map do |c|
-          # Index-write on an array (`a[i] += v`) introduces no new element evidence we can cheaply attribute — the
-          # array-arity forget already widened the binding; contribute nothing.
-          next [] if index_write?(c)
+        ContentJoin.join_array_content(pre_state, array_element_evidence(calls, block_entry))
+      end
+
+      # No site sits under an inner block that shadows a name — the loop seam's answer, and the default.
+      NO_SHADOWS = {}.freeze
+      private_constant :NO_SHADOWS
+
+      # The `[key, value]` pairs `calls` store into a Hash, typed in `block_entry`.
+      def hash_pair_evidence(calls, block_entry, shadows = NO_SHADOWS)
+        calls.flat_map { |c| hash_pair_types(c, site_evidence_scope(block_entry, c, shadows)) }
+      end
+
+      # The elements `calls` add to an Array, typed in `block_entry`.
+      def array_element_evidence(calls, entry_scope, shadows = NO_SHADOWS)
+        calls.flat_map do |c|
+          block_entry = site_evidence_scope(entry_scope, c, shadows)
+          # An index-write in the block (`a[i] += v`, `a[i] ||= v`, an index target) stores
+          # through `[]=` the same way — emit its index arguments ahead of the node's own stored
+          # type so the join classifies the same splice / element forms the straight-line path
+          # does (issue #1140).
+          next ContentJoin.array_added_elements(:[]=, index_write_block_arg_types(c, block_entry)) if index_write?(c)
 
           ContentJoin.array_added_elements(c.name, content_arg_types(c, block_entry))
         end
-        ContentJoin.join_array_content(pre_state, added)
+      end
+
+      # `[index_type..., stored_value_type]` for an index-write node inside a block, typed in the
+      # block-entry scope — the stored value is what the write stores through `[]=`, which for a
+      # compound write is the dispatched compound result (`a[i] += v` stores `a[i] + v`, the same
+      # compound result the node itself types as); an index target (a multi-assign slot, a `for`
+      # index, a rescue reference) stays untyped.
+      # `[]` when any type cannot be read, which reproduces the pre-join no-evidence answer.
+      def index_write_block_arg_types(node, block_entry)
+        args = node.arguments
+        return [] if args.nil?
+
+        stored = index_write_stored_type(node, block_entry)
+        return [] if stored.nil?
+
+        list = args.respond_to?(:arguments) ? args.arguments : args
+        list.map { |a| a.is_a?(Prism::SplatNode) ? nil : block_entry.type_of(a, tracer: tracer) } + [stored]
+      rescue StandardError
+        []
       end
 
       # Walks the block body for content-mutator calls (`<<`, `push`, `[]=`, …) whose receiver is a captured outer local
@@ -2660,17 +4752,24 @@ module Rigor
         mutations
       end
 
-      # Index-write forms (`h[k] ||= v`, `h[k] += v`, `h[k] = v` via a multi-assign target) that mutate a collection's
+      # Index-write forms (`h[k] ||= v`, `h[k] += v`, and an index target's `h[k] = v` — a multi-assign slot, a `for`
+      # index, a rescue reference) that mutate a collection's
       # CONTENT without a `[]=` CallNode. `h[k] ||= []; h[k] << v` mutates `h` through the OrWrite even though the
       # appended values land on the nested array — leaving `h` an empty `{}` is unsound (`h.empty?` folds to `true`).
-      INDEX_WRITE_NODES = [
-        Prism::IndexOrWriteNode,
-        Prism::IndexAndWriteNode,
-        Prism::IndexOperatorWriteNode,
-        Prism::IndexTargetNode
-      ].freeze
+      INDEX_WRITE_NODES = IndexWriteWidening::CONTENT_WRITE_NODE_CLASSES
       private_constant :INDEX_WRITE_NODES
 
+      # Every call name a content scan counts: the adders the joins read evidence from, and the String mutators no
+      # Array or Hash table lists. A String carries no element parameter, so a join answers a String pre-state with the
+      # bare `String` whatever the name, and a floor floors it; without them `def strip(s) = s.delete_prefix!("a")` and
+      # an escaping `-> { s.upcase! }` left the caller's `+"ab"` pinned. A name an Array or Hash table also lists stays
+      # with those tables' adders: a scan cannot see the receiver's class, and the Array join reads a non-adder's
+      # arguments as appended elements (`slice!(0)`'s index).
+      CONTENT_MUTATORS = (ContentJoin::CONTENT_ADDERS |
+                          (StringMutation::MUTATORS - MutationWidening::ARRAY_MUTATORS -
+                           MutationWidening::HASH_MUTATORS)).freeze
+      private_constant :CONTENT_MUTATORS
+
       # The shared "not a content mutation" answer. This predicate runs on every node of every block, loop and
       # method body it censuses (~950k calls on the lib self-check) and almost always declines, so a fresh
       # `[nil, nil]` per decline was one of the largest allocation sites in the evaluator.
@@ -2681,7 +4780,7 @@ module Rigor
       # (depth predicate), else the frozen `[nil, nil]`. Covers `[]=`-style CallNode mutators and the index-write node
       # forms.
       def content_mutation_target(node)
-        is_call_mutator = node.is_a?(Prism::CallNode) && ContentJoin::CONTENT_ADDERS.include?(node.name)
+        is_call_mutator = node.is_a?(Prism::CallNode) && CONTENT_MUTATORS.include?(node.name)
         return NO_CONTENT_MUTATION unless is_call_mutator || index_write?(node)
 
         receiver = node.receiver
@@ -2691,13 +4790,6 @@ module Rigor
         [receiver.name, node]
       end
 
-      # Computes the joined continuation collection type for one captured local from its content-mutator calls. Returns
-      # `nil` (no overlay) when the pre-state is neither an Array-ish nor a Hash-ish binding — e.g. a String
-      # accumulator, whose `<<` carries no element parameter and whose binding already types as `String`.
-      def join_content_for_local(name, calls, post_scope, block_entry)
-        join_content_for_param(calls, post_scope.local(name), block_entry)
-      end
-
       def index_write?(node)
         INDEX_WRITE_NODES.any? { |k| node.is_a?(k) }
       end
@@ -2742,10 +4834,16 @@ module Rigor
           return [[key, Type::Combinator.untyped]]
         end
 
+        # Only a Hash adder stores a pair; a String mutator a content scan counted (`x.sub!("a", "b")` on a
+        # `Hash | String` capture) stores none.
+        return [] unless ContentJoin::HASH_CONTENT_ADDERS.include?(node.name)
+
         args = content_arg_types(node, block_entry)
         return [] if args.size < 2
 
-        [[args.first, args.last]]
+        # A splat index marker (`nil`) means unknown arity only to the Array classifier;
+        # read as a key it is an unknown value — degrade to untyped (issue #1140).
+        [[args.first || Type::Combinator.untyped, args.last]]
       end
 
       # Type of the index expression of an index-write node (`h[k] ||= v`).
@@ -2762,33 +4860,198 @@ module Rigor
       # Argument types for a content-mutator call, typed against the block-entry scope (block params bound). A
       # sub-evaluator over `block_entry` keeps the argument typing flow-correct for params / `;`-locals without leaking
       # into the outer scope.
-      def content_arg_types(call_node, block_entry)
+      def content_arg_types(call_node, block_entry, operand_types = nil)
         arguments = call_node.arguments
         return [] if arguments.nil?
 
-        arguments.arguments.map { |arg| block_entry.type_of(arg, tracer: tracer) }
+        list = arguments.arguments
+        list.map.with_index do |arg, i|
+          # For `[]=` a splat in an index position leaves the store's arity open — it is
+          # marked `nil` for {ContentJoin.array_added_elements}, which counts it as
+          # arity-unknown rather than as the untyped index it would type as (issue #1140).
+          next nil if call_node.name == :[]= && i < list.size - 1 && arg.is_a?(Prism::SplatNode)
+
+          OperandWalk.type_of(block_entry, arg, tracer, operand_types)
+        end
       rescue StandardError
         []
       end
 
-      # Evaluates `block`'s body once with each written outer local bound to the supplied `bindings` (block params /
-      # `;`-locals re-bound as usual) and returns the per-name exit binding for `names`. Used as the `BodyFixpoint`
-      # body-evaluator.
+      # Evaluates `block`'s body once with each written outer local or ivar bound to the supplied `bindings` (block
+      # params / `;`-locals re-bound as usual) and returns the per-name exit binding for `names`. Used as the
+      # `BodyFixpoint` body-evaluator.
       def block_exit_bindings(call_node, block, bindings, names)
+        _type, exit_scope = sub_eval(block, block_pass_entry(call_node, block, bindings))
+        names.to_h { |name| [name, CapturedLocals.bound_type(exit_scope, name)] }
+      end
+
+      # The entry scope of one write-back pass: the block's entry with each written outer local or ivar bound to
+      # `bindings`, and each captured local the body only mutates in place at its widening ({#capture_pass_bindings}).
+      # That widening describes the same object, so it keeps the marks a source-level write drops (issue #1287,
+      # `Scope#with_mutated_local`): a local copied from a declaration-seeded ivar stays exempt from nil-receiver
+      # reports, as it does after straight-line `r << x`.
+      def block_pass_entry(call_node, block, bindings)
         entry = build_block_entry_scope(call_node, block)
-        entry = bindings.reduce(entry) { |acc, (name, type)| acc.with_local(name, type) }
-        _type, exit_scope = sub_eval(block, entry)
-        names.to_h { |name| [name, exit_scope.local(name)] }
+        capture_pass_bindings(block, bindings).reduce(entry) do |acc, (name, type)|
+          bindings.key?(name) ? bind_capture(acc, name, type) : acc.with_mutated_local(name, type)
+        end
+      end
+
+      NO_CAPTURE_BINDINGS = {}.freeze
+      private_constant :NO_CAPTURE_BINDINGS
+
+      # Issue #1412 — the entry of the statement pass over a block ({#evaluate_block_if_present}). A block its call
+      # may run more than once ({BlockRepetition.may_repeat?}, the gate the block-return pass lays the #587 (b)
+      # binding under) enters with every captured local it mutates in place at its unknown-store widening
+      # ({#capture_pass_bindings}), as each ADR-56 write-back pass enters. The write-back runs only for a
+      # non-escaping body that also REBINDS a capture, so a body that only mutates one (`depth = []; lines.each {
+      # |tl| puts depth.last.length if depth.last; depth << tl }`) was typed from `[]` on every pass: `depth.last`
+      # read `nil`, and the guarded read reported `undefined method` for nil on correct code. A later pass reads
+      # what an earlier one stored, so the widening's gradual arm is the honest entry. The price is that a read
+      # only the first pass makes is gradual too — a false negative, the same one the write-back's passes take.
+      #
+      # A repeating call the escape analysis leaves `:unknown` (an iterator name on an untyped receiver) gets no
+      # write-back at all, so a capture it rebinds from a `nil` placeholder read `nil` on every pass (`names = nil;
+      # io.each_line { … names = {} … names[l] = true }`). Such a capture enters at {#unproven_rebind_bindings}.
+      #
+      # This costs no body pass. A body that can neither rebind nor mutate a captured binding
+      # ({CapturedLocals.may_touch_capture?}, an allocation-free scan) — most of them — skips the gate, and the
+      # gate reads the one receiver type and escape class the rest of {#eval_call} reads.
+      def repeating_block_entry(call_node, block)
+        body = block.body
+        return build_block_entry_scope(call_node, block) if body.nil? || !CapturedLocals.may_touch_capture?(body, scope)
+
+        classification = repeating_block_class(call_node)
+        return build_block_entry_scope(call_node, block) if classification.nil?
+
+        bindings = unproven_rebind_bindings(call_node, block, classification)
+        return build_block_entry_scope(call_node, block) if bindings.empty? && block_content_mutations(block).empty?
+
+        block_pass_entry(call_node, block, bindings)
+      end
+
+      # The call's {ClosureEscapeAnalyzer} class when {BlockRepetition.may_repeat?} holds for it, else nil. The
+      # receiver is the one the block-return pass asks about: the explicit receiver, or the implicit `self`
+      # (`Object` at the top level).
+      def repeating_block_class(call_node)
+        receiver_type =
+          if call_node.receiver
+            explicit_receiver_type(call_node)
+          else
+            operand_scope.self_type || operand_scope.environment.nominal_for_name("Object")
+          end
+        return nil if receiver_type.nil?
+
+        method_name = call_node.name
+        classification = ClosureEscapeAnalyzer.classify(receiver_type: receiver_type, method_name: method_name,
+                                                        scope: scope)
+        repeats = BlockRepetition.may_repeat?(
+          method_name: method_name, receiver_type: receiver_type, scope: scope, classification: classification
+        )
+        repeats ? classification : nil
+      rescue StandardError
+        nil
+      end
+
+      # The binding each outer local or ivar the body rebinds ({CapturedLocals.writes}) from a sentinel seed — `nil` or
+      # `false`, alone or as a union of the two — enters a repeating call's body with when the write-back will not run
+      # its passes for it ({#write_back_block_captures} reaches only an explicit receiver classified
+      # `:non_escaping`): the seed joined with `Dynamic[top]`. A sentinel is a placeholder the body replaces before
+      # the reads it guards (`names = nil; io.each_line { |l| if state == :start; names = {}; else names[l] = true;
+      # end }`), so a later pass reads whatever replaced it, and no pass types that here. Any other seed keeps its
+      # call-site binding: the first pass reads it, and a later pass's binding is left unmodelled, as it was before.
+      # A call the write-back reaches answers none: its fixpoint enters every pass it records at the converged
+      # binding.
+      def unproven_rebind_bindings(call_node, block, classification)
+        return NO_CAPTURE_BINDINGS if call_node.receiver && classification == :non_escaping
+
+        names = CapturedLocals.writes(block, scope, ivars: true)
+        return NO_CAPTURE_BINDINGS if names.empty?
+
+        untyped = Type::Combinator.untyped
+        names.each_with_object({}) do |name, acc|
+          seed = CapturedLocals.bound_type(scope, name)
+          acc[name] = Type::Combinator.union(seed, untyped) if seed && sentinel_seed?(seed)
+        end
+      end
+
+      def sentinel_seed?(type)
+        case type
+        when Type::Constant then type.value.nil? || type.value == false
+        when Type::Union then type.members.all? { |member| sentinel_seed?(member) }
+        else false
+        end
+      end
+
+      # `bindings` plus the pass binding of every captured local the body mutates in place
+      # ({CapturedLocals.content_mutations}): its binding widened for a store of UNKNOWN values at every mutation site
+      # ({#unknown_store_binding}), so it holds whatever any earlier iteration stored. A name the pass does not move
+      # is widened from its call-site binding; a name it moves (the body both rebinds and mutates it) is widened over
+      # the running assumption, as the per-element fold widens the same name (#587 (b)) — that assumption carries the
+      # exits of the body's straight-line seam, which can close the collection without a gradual arm
+      # (`stack ||= [0]; top = stack.pop; stack.push(x)` kept `top` at `0?`). The stored values are not typed: one
+      # computed from the collection's own entry contents is the same first-iteration answer. `bindings` itself
+      # comes back for the common body that mutates nothing captured.
+      #
+      # The price is the gradual arm on a rebind that reads such a collection — `last = a.last; a << x` over `a =
+      # [0]` reads `0 | Dynamic[top] | nil`, not `0 | 1 | 2 | nil`. Precise evidence would mean iterating this
+      # fixpoint jointly with slice C's content join; ADR-56 WD2.13 records why that was not taken.
+      def capture_pass_bindings(block, bindings)
+        stores = block_content_mutations(block)
+        return bindings if stores.empty?
+
+        widened = stores.each_with_object({}) do |(name, sites), acc|
+          next if bindings.key?(name)
+
+          seed = scope.local(name)
+          acc[name] = unknown_store_binding(seed, sites) unless seed.nil?
+        end
+        widened.merge(bindings.to_h do |name, type|
+          sites = stores[name]
+          [name, sites.nil? || type.nil? ? type : unknown_store_binding(type, sites)]
+        end)
+      end
+
+      # {CapturedLocals.content_mutations} of `block` against this evaluator's scope, once per block: every write-back
+      # pass asks, and neither input changes between them.
+      def block_content_mutations(block)
+        (@block_content_mutations ||= {}.compare_by_identity)[block] ||= CapturedLocals.content_mutations(block, scope)
+      end
+
+      # `type` widened through `sites` for a store of unknown values, with one more step: when the result is still a
+      # collection whose contents are value-pinned, those pins are the first-iteration answer and the contents take
+      # the gradual arm. A widening that DECLINES leaves such a binding — `s = [0, 9]; s.pop` leaves `Array[0 | 9]`,
+      # a nominal the `push` in the body then declines — and so does one that only changes a refinement: under `if
+      # s.any?` the `pop` drops `non-empty-array[0 | 9]` to that same pinned `Array[0 | 9]` before the `push` declines
+      # it. Either way `top = s.last; s.push(x)` would keep `top` at `0 | 9`. A result that already carries the arm
+      # is unchanged by it.
+      def unknown_store_binding(type, sites)
+        widened = UnknownStoreWidening.widen(type, sites)
+        return widened unless UnknownStoreWidening.value_pinned_collection?(widened)
+
+        UnknownStoreWidening.gradual_content(widened)
       end
 
       # `Prism::BlockNode` is reached through {#eval_call}; the handler runs the body under `scope`, which the caller
       # has already augmented with the block's parameter bindings. Effects do not leak past the block (the outer
       # eval_call returns the caller's scope unchanged), but the body's local writes are threaded through subsequent
       # statements *inside* the block so `each { |x| sum = x; sum.succ }` types `sum.succ` under the `sum: x` binding.
+      # The scope returned is the one the invocation ENDS with — the fall-through joined with every `next` that
+      # leaves it ({#evaluate_invocation}).
       def eval_block(node)
-        return [Type::Combinator.constant_of(nil), scope] if node.body.nil?
+        type, _fall_through, exit_scope = evaluate_invocation(node)
+        [type, exit_scope]
+      end
 
-        sub_eval(node.body, scope)
+      # `base` joined with every collected jump scope whose node is in `targets` — a jump belonging to a nested
+      # construct lands in the same sink and is dropped by identity.
+      def join_jump_scopes(base, sink, targets)
+        targeted_scopes(sink, targets).reduce(base) { |acc, jump_scope| acc.join(jump_scope) }
+      end
+
+      # The scopes a sink collected at the jumps in `targets`.
+      def targeted_scopes(sink, targets)
+        sink.filter_map { |node, jump_scope| jump_scope if targets.key?(node) }
       end
 
       # Issue #878 — `->() { }` and `lambda { }` build the same object, so they MUST type the same. The `lambda`
@@ -2803,9 +5066,13 @@ module Rigor
       # literal is a value that outlives the expression, exactly like the Proc `lambda` returns, so the outer locals it
       # can rebind lose their narrowing rather than being written back through ADR-56's non-escaping fixpoint. Both
       # halves are widenings — the two spellings now agree in both directions instead of `->` being the precise one.
+      # A lambda is a return barrier: `return` inside it returns from the lambda, so its body runs with the method's
+      # return sink suspended, as a nested `def` body does ({#eval_def}). Issue #1223 made the barrier matter more
+      # often: a lambda passed as an argument (`register(-> { return :skip if … })`) is now evaluated with its
+      # enclosing call's operands, where it used to be typed as a value only.
       def eval_lambda(node)
         lambda_type = scope.type_of(node, tracer: tracer)
-        sub_eval(node.body, build_block_entry_scope(nil, node)) unless node.body.nil?
+        without_return_sink { sub_eval(node.body, build_block_entry_scope(nil, node)) } unless node.body.nil?
 
         [lambda_type, escaping_closure_captures(node, scope)]
       end
@@ -2827,17 +5094,46 @@ module Rigor
       # when the runtime would actually `NoMethodError` on `nil`.
       def build_block_entry_scope(call_node, block_node)
         expected = expected_block_param_types_for(call_node)
-        bindings = BlockParameterBinder.new(expected_param_types: expected).bind(block_node)
         # Issue #316 — every block body enters with `self` unmodelled (`Scope#entering_opaque_block`); the
         # yielding method, not the lexical context, decides what `self` is, and Rigor does not track it.
-        scope_with_params = bindings.reduce(scope.entering_opaque_block) do |acc, (name, type)|
-          acc.with_local(name, type)
-        end
+        # Issue #1358 — a body that may run a match reads the match globals an earlier iteration may have rebound
+        # ({MatchRebinding.block_entry}).
+        entry = MatchRebinding.block_entry(scope.entering_opaque_block, block_node, call_node)
+        scope_with_params = BlockParameterBinder.new(expected_param_types: expected).bind_onto(block_node, entry)
+        # ADR-16 Tier A — a plugin `block_as_methods:` entry that matches `(receiver, name)` narrows the
+        # body's `self` to the object the DSL `instance_eval`s the block on (`params` on
+        # `Grape::Validations::ParamsScope`, `namespace` on the `Grape::API::Instance` class object, verb
+        # bodies on `Grape::Endpoint`). The expression-side narrowing
+        # ({ExpressionTyper#block_body_self_narrowing}) already applies the same contract to block-return
+        # typing; without it here the recorded per-node scopes — what `dump_type`/`assert_type` and the
+        # survey read — keep the enclosing `self_type` and every DSL call inside stays `Dynamic[top]`.
+        narrowed = call_node && narrow_macro_block_self(call_node)
+        scope_with_params = scope_with_params.with_self_type(narrowed) if narrowed
         block_local_names(block_node).reduce(scope_with_params) do |acc, name|
           acc.with_local(name, Type::Combinator.constant_of(nil))
         end
       end
 
+      # The receiver an ADR-16 `block_as_methods:` match is keyed on: the explicit receiver's type, or the
+      # current `self_type` for an implicit-self DSL call (the `params do` / `namespace do` shapes, whose
+      # receiver is the enclosing `Singleton[X]`). A miss leaves the entry scope as built — the false-
+      # positive-safe direction.
+      def narrow_macro_block_self(call_node)
+        receiver_type =
+          if call_node.receiver
+            explicit_receiver_type(call_node)
+          else
+            scope.self_type
+          end
+        return nil if receiver_type.nil?
+
+        MacroBlockSelfType.narrow_self_type_for(
+          scope: scope, call_node: call_node, receiver_type: receiver_type
+        )
+      rescue StandardError
+        nil
+      end
+
       def block_local_names(block_node)
         params_root = block_node.parameters
         return [] unless params_root.is_a?(Prism::BlockParametersNode)
@@ -2850,7 +5146,12 @@ module Rigor
       def expected_block_param_types_for(call_node)
         return [] if call_node.nil?
 
-        receiver_type = call_node.receiver ? scope.type_of(call_node.receiver, tracer: tracer) : nil
+        receiver_type =
+          if call_node.receiver
+            explicit_receiver_type(call_node)
+          else
+            scope.self_type || scope.environment.nominal_for_name("Object")
+          end
         return [] if receiver_type.nil?
 
         arg_types = call_arg_types_for(call_node)
@@ -2858,7 +5159,8 @@ module Rigor
           receiver_type: receiver_type,
           method_name: call_node.name,
           arg_types: arg_types,
-          environment: scope.environment
+          environment: scope.environment,
+          scope: scope
         )
       rescue StandardError
         []
@@ -2868,7 +5170,7 @@ module Rigor
         arguments = call_node.arguments
         return [] if arguments.nil?
 
-        arguments.arguments.map { |arg| scope.type_of(arg, tracer: tracer) }
+        arguments.arguments.map { |arg| type_operand(arg) }
       end
 
       # ----- def/class helpers -----
@@ -2883,6 +5185,11 @@ module Rigor
         fresh = build_fresh_body_scope
         body_self = self_type_for_class_body(new_context)
         fresh = fresh.with_self_type(body_self) if body_self
+        # Issue #963 — `self` in a `class << ...` body is the SINGLETON class, which shares the `Singleton[X]`
+        # carrier a `class X` body gets. The mark is the only thing that tells the two apart downstream, and a
+        # `def` reached from this body clears it by starting from a fresh scope.
+        fresh = fresh.with_singleton_class_body(node.is_a?(Prism::SingletonClassNode))
+        fresh = fresh.with_match_frame(node.body)
         fresh = stamp_nesting(fresh, new_nesting)
         sub_eval(node.body, fresh, class_context: new_context, lexical_nesting: new_nesting)
       end
@@ -2891,7 +5198,9 @@ module Rigor
         singleton = singleton_def?(def_node)
         binder = MethodParameterBinder.new(
           environment: scope.environment,
-          class_path: current_class_path,
+          # Issue #1120 — a refinement exists to redefine, so X's declared parameters for the name are not this
+          # def's contract; it binds its parameters as an undeclared method does.
+          class_path: @class_context.last&.refinement ? nil : current_class_path,
           singleton: singleton,
           source_path: scope.source_path
         )
@@ -2917,6 +5226,9 @@ module Rigor
         fresh = seed_instance_ivars(fresh, singleton: singleton)
         fresh = seed_class_cvars(fresh)
         fresh = seed_program_globals(fresh)
+        # Issue #1358 — the body runs in a frame of its own, whose match globals its blocks and closures share, and
+        # so do its parameters' default expressions.
+        fresh = fresh.with_match_frame(def_node.body, def_node.parameters)
         # ADR-48 Struct slice 3 — install the method body's fold-safe-local set so a member read off a mutation-free
         # local folds during the in-body walk (the call-return inference path is seeded separately).
         fresh = fresh.with_struct_fold_safe(
@@ -3016,14 +5328,21 @@ module Rigor
         seeded.reduce(body_scope) { |acc, (name, type)| acc.with_cvar(name, type) }
       end
 
-      # Globals are process-wide. The body scope already inherited the program-globals accumulator through
-      # `with_program_globals`; seeding here just materialises each entry into the body's `globals` map so reads observe
-      # a precise type without consulting the accumulator on every lookup.
+      # Globals are process-wide. The body scope already inherited the program-global tables through its discovery
+      # index; seeding here just materialises each entry into the body's `globals` map so reads observe a precise type
+      # without consulting the index on every lookup. The frame-local `$_` and `$~` are not in it (issue #1359): a
+      # method body starts with a slot of its own. A global Ruby's own signatures declare is seeded with its declared
+      # type joined with the file's writes, under the ADR-58 `:global` mark (issue #1362,
+      # `ScopeIndexer#join_declared_globals`, `Scope#seed_declaration_sourced_global`).
       def seed_program_globals(body_scope)
-        seeded = scope.program_globals
-        return body_scope if seeded.empty?
+        written = scope.program_globals
+        return body_scope if written.empty?
 
-        seeded.reduce(body_scope) { |acc, (name, type)| acc.with_global(name, type) }
+        seeds = scope.discovery.program_global_seeds
+        written.reduce(body_scope) do |acc, (name, type)|
+          seed = seeds[name]
+          seed ? acc.seed_declaration_sourced_global(name, seed) : acc.with_global(name, type)
+        end
       end
 
       # Slice A-declarations. Class- and method-bodies start from a fresh local-empty scope, but they MUST keep the
@@ -3183,21 +5502,33 @@ module Rigor
       def eval_next(node)
         sink = Thread.current[NEXT_SINK_KEY]
         sink << [node, jump_value_type(node)] if sink
+        @next_scope_sink << [node, jump_scope(node)] if @next_scope_sink
         [Type::Combinator.bot, scope]
       end
 
-      # A `break` transfers control to the loop exit (its flow value is `Bot`, like `return`). It records the current
-      # scope into the active loop's break sink so the loop join can recover a `break`-path binding the fall-through
-      # would drop (`flag = true; break` -> `flag` is `false | true` after the loop). nil sink = a `break` not inside an
-      # inferred loop body (a block targeting a method, or top-level) — left to the existing escaping-block / no-op
-      # handling.
+      # The scope control leaves with at a `next` / `break`: the entry scope threaded through the jump's arguments, so a
+      # write inside one (`next(n = :odd)`, `break(flag = true)`) is part of the path that leaves. The arguments are
+      # evaluated without recording into the per-node scope index: whether a sink is collecting depends on unrelated
+      # context (a captured write elsewhere in the block), and the index must not change with it.
+      def jump_scope(node)
+        args = node.arguments&.arguments || []
+        args.reduce(scope) { |acc, arg| sub_eval(arg, acc, **UNRECORDED).last }
+      end
+
+      # A `break` transfers control to the loop exit (its flow value is `Bot`, like `return`). It records the scope it
+      # leaves with ({#jump_scope}) into the active break sink so the loop join can recover a `break`-path binding the
+      # fall-through would drop (`flag = true; break` -> `flag` is `false | true` after the loop); ADR-56's block
+      # write-back reads the same sink for a `break` that ends a yielding call ({#join_block_break_bindings}), and an
+      # enclosing `begin … ensure` carries the recorded scope through its clause ({#carry_jumps_through_ensure}). nil
+      # sink = a `break` reached outside either collection (top level, or an escaping block) — left to the existing
+      # escaping-block / no-op handling.
       #
       # Issue #853: the value it carries out belongs to the yielding CALL, so it is recorded into the separate
       # break-value sink for `ExpressionTyper#call_dispatch_type_for` to union in. Both sinks are optional and
       # independent — a loop body collects scopes while an enclosing call collects values from the same walk.
       def eval_break(node)
         sink = Thread.current[BREAK_SINK_KEY]
-        sink << [node, scope] if sink
+        sink << [node, jump_scope(node)] if sink
         value_sink = Thread.current[BREAK_VALUE_SINK_KEY]
         value_sink << [node, jump_value_type(node)] if value_sink
         [Type::Combinator.bot, scope]
@@ -3215,15 +5546,34 @@ module Rigor
         Type::Combinator.tuple_of(*args.map { |arg| sub_eval(arg, scope).first })
       end
 
-      def sub_eval(node, with_scope, class_context: @class_context, lexical_nesting: @lexical_nesting)
+      # `on_enter: nil` evaluates without recording into the per-node scope index — for a pass whose scopes are not
+      # the ones the index should keep. `next_scope_sink:` is replaced only by {#evaluate_invocation} and
+      # {#loop_iteration}.
+      def sub_eval(node, with_scope, class_context: @class_context, lexical_nesting: @lexical_nesting,
+                   on_enter: @on_enter, next_scope_sink: @next_scope_sink, operand_recorder: @operand_recorder)
+        evaluator_at(with_scope, class_context: class_context, lexical_nesting: lexical_nesting, on_enter: on_enter,
+                                 next_scope_sink: next_scope_sink, operand_recorder: operand_recorder).evaluate(node)
+      end
+
+      # An evaluator over `with_scope` that inherits everything else from this one. `operand_scope:` and
+      # `operand_types:` are set only by {#invoke_from}, for the evaluator that runs a call from the scope its
+      # operands left.
+      def evaluator_at(with_scope, class_context: @class_context, lexical_nesting: @lexical_nesting, # rubocop:disable Metrics/ParameterLists
+                       on_enter: @on_enter, next_scope_sink: @next_scope_sink, operand_scope: nil,
+                       in_operand: @in_operand, operand_recorder: @operand_recorder, operand_types: nil)
         StatementEvaluator.new(
           scope: with_scope,
           tracer: tracer,
-          on_enter: @on_enter,
+          on_enter: on_enter,
           class_context: class_context,
           lexical_nesting: lexical_nesting,
-          converged_loop_recording: @converged_loop_recording
-        ).evaluate(node)
+          converged_loop_recording: @converged_loop_recording,
+          next_scope_sink: next_scope_sink,
+          operand_scope: operand_scope,
+          in_operand: in_operand,
+          operand_recorder: operand_recorder,
+          operand_types: operand_types
+        )
       end
 
       # Slice 7 phase 14 — branch exit detection. Returns true when the branch's body unconditionally exits the
@@ -3279,10 +5629,10 @@ module Rigor
           branch_type.is_a?(Type::Bot)
       end
 
-      def eval_branch_or_nil(branch_node, branch_scope)
+      def eval_branch_or_nil(branch_node, branch_scope, on_enter: @on_enter)
         return [Type::Combinator.constant_of(nil), branch_scope] if branch_node.nil?
 
-        sub_eval(branch_node, branch_scope)
+        sub_eval(branch_node, branch_scope, on_enter: on_enter)
       end
 
       # Joins two branch scopes at a control-flow merge point. Names bound in only one branch are nil-injected into the
@@ -3310,17 +5660,31 @@ module Rigor
       # ---------------------------------------------------------------
 
       # Returns `scope` extended with the rescue reference variable bound to the exception instance type. Leaves scope
-      # unchanged when the node carries no reference (bare `rescue` without `=> var`).
+      # unchanged when the node carries no reference (bare `rescue` without `=> var`). An index-target reference
+      # (`rescue => h[:e]`) stores the exception through `[]=` instead, so its receiver widens with the exception
+      # instance type as the stored value, exactly as `rescue => e; h[:e] = e` widens it.
+      #
+      # Issue #1360 — with or without a reference, the clause runs with `$!` bound to the exception it rescued, `$@` to
+      # its backtrace and `$?` unbound ({ErrorInfo.rescue_entry}); {#eval_begin_node} restores `$!` and `$@` once the
+      # `begin` exits.
       def bind_rescue_reference(rescue_node, scope)
+        exception_type = rescue_exception_type(rescue_node, scope)
         ref = rescue_node.reference
-        return scope unless ref.is_a?(Prism::LocalVariableTargetNode)
-
-        scope.with_local(ref.name, rescue_exception_type(rescue_node, scope))
+        reference = ref.name if ref.is_a?(Prism::LocalVariableTargetNode)
+        scope = ErrorInfo.rescue_entry(scope, exception_type, rescue_node.statements, reference)
+        case ref
+        when Prism::LocalVariableTargetNode
+          scope.with_local(ref.name, exception_type)
+        when Prism::IndexTargetNode
+          widen_index_target(ref, exception_type, scope, type_scope: scope)
+        else
+          scope
+        end
       end
 
       # Derives the exception instance type for a `RescueNode`. When the exceptions list is empty (bare `rescue`) the
-      # type is `StandardError`. When one or more exception classes are named the types are unioned. Falls back to
-      # `StandardError` for any class that cannot be resolved to a `Singleton` type.
+      # type is `StandardError`. When one or more exception classes are named the types are unioned. A class that
+      # cannot be resolved to a `Singleton` type contributes `Dynamic[top]`.
       def rescue_exception_type(rescue_node, scope)
         exceptions = rescue_node.exceptions
         if exceptions.empty?
@@ -3338,87 +5702,392 @@ module Rigor
       # ---------------------------------------------------------------
 
       # Builds the entry scope for an `in` branch by injecting every variable captured by the pattern as a local
-      # binding.
-      def apply_in_pattern_bindings(subject, pattern, scope)
-        bindings = collect_in_pattern_bindings(subject, pattern, scope)
+      # binding. `subject_type` is the type of the `case` subject — nil when the `case` carries no predicate, which
+      # leaves every binding at the `Dynamic[top]` floor — and `subject_node` the subject expression, which the
+      # `deconstruct` / `deconstruct_keys` dispatch reads for its freshness gate.
+      def apply_in_pattern_bindings(subject_type, subject_node, pattern, scope)
+        bindings = collect_in_pattern_bindings(subject_type, pattern, scope, subject_node: subject_node)
         bindings.reduce(scope) { |s, (name, type)| s.with_local(name, type) }
       end
 
-      # Returns an array of `[Symbol, Rigor::Type]` pairs for every variable captured by `pattern`. Unrecognised pattern
-      # nodes contribute no bindings (fail-soft).
-      def collect_in_pattern_bindings(subject, pattern, scope)
+      # Returns an array of `[Symbol, Rigor::Type]` pairs for every variable captured by `pattern`, typed against the
+      # subject. Unrecognised pattern nodes contribute no bindings (fail-soft).
+      #
+      # A union subject distributes first (see {#collect_union_pattern_bindings}); every other subject walks the
+      # pattern once, and each node kind decides how much of the subject it can name:
+      #
+      # - a bare target (`in [i, s]`, `in x`) binds the slot the enclosing pattern hands it,
+      # - a capture (`Integer => i`, `[a, b] => whole`) binds its own constraint, and recurses into the captured
+      #   pattern,
+      # - an array / find / hash pattern decomposes the subject (see the three collectors below).
+      def collect_in_pattern_bindings(subject_type, pattern, scope, subject_node: nil)
+        if subject_type.is_a?(Type::Union)
+          return collect_union_pattern_bindings(subject_type.members, pattern, scope, subject_node: subject_node)
+        end
+
         case pattern
         when Prism::CapturePatternNode
-          [[pattern.target.name, pattern_capture_type(pattern.value, scope)]]
+          collect_capture_pattern_bindings(subject_type, pattern, scope)
         when Prism::LocalVariableTargetNode
-          subject_type = subject.is_a?(Prism::LocalVariableReadNode) ? scope.local(subject.name) : nil
           [[pattern.name, subject_type || Type::Combinator.untyped]]
         when Prism::ImplicitNode
-          collect_in_pattern_bindings(subject, pattern.value, scope)
+          collect_in_pattern_bindings(subject_type, pattern.value, scope)
         when Prism::ArrayPatternNode
-          collect_array_pattern_bindings(pattern, scope)
+          collect_array_pattern_bindings(subject_type, pattern, scope, subject_node: subject_node)
         when Prism::FindPatternNode
-          collect_find_pattern_bindings(pattern, scope)
+          collect_find_pattern_bindings(subject_type, pattern, scope, subject_node: subject_node)
         when Prism::HashPatternNode
-          collect_hash_pattern_bindings(pattern, scope)
+          collect_hash_pattern_bindings(subject_type, pattern, scope, subject_node: subject_node)
         when Prism::AlternationPatternNode
-          collect_alternation_pattern_bindings(subject, pattern, scope)
+          collect_alternation_pattern_bindings(subject_type, pattern, scope)
         else
           []
         end
       end
 
-      def collect_array_pattern_bindings(pattern, scope)
-        bindings = [*pattern.requireds, *pattern.posts].flat_map do |elem|
-          collect_in_pattern_bindings(nil, elem, scope)
+      # `pattern => target` binds `target` to what the pattern matched AND every name the pattern itself binds:
+      # `in [a, b] => whole` binds `a`, `b` and `whole`. The target's own type is the pattern's constraint when it
+      # names a class (`Integer => i`), and the subject otherwise — a capture over any other pattern IS the subject
+      # the pattern matched.
+      def collect_capture_pattern_bindings(subject_type, pattern, scope)
+        target = pattern.target
+        inner = collect_in_pattern_bindings(subject_type, pattern.value, scope)
+        return inner unless target.is_a?(Prism::LocalVariableTargetNode)
+
+        [[target.name, capture_pattern_type(subject_type, pattern.value, scope)]] + inner
+      end
+
+      # `in [i, s]` / `in [a, *rest, z]` / `in Foo[a, b]`.
+      def collect_array_pattern_bindings(subject_type, pattern, scope, subject_node:)
+        subject_type = pattern_class_constraint(subject_type, pattern.constant, scope)
+        fronts, rest_type, backs = pattern_slot_types(subject_type, pattern, scope, subject_node)
+        bindings = pattern.requireds.each_with_index.flat_map do |elem, i|
+          collect_in_pattern_bindings(fronts[i], elem, scope)
+        end
+        bindings += pattern.posts.each_with_index.flat_map do |elem, i|
+          collect_in_pattern_bindings(backs[i], elem, scope)
+        end
+        append_array_splat_binding(bindings, pattern.rest, rest_type)
+        bindings
+      end
+
+      # The per-slot types a positional pattern reads: the subject's own decomposition when it is a carrier
+      # {MultiTargetBinder.decompose_slots} accepts (`Tuple`, `Array[T]`), else the `deconstruct` projection of a
+      # subject that defines one (`Struct#deconstruct`, a `Data` instance, a class whose `deconstruct` names the
+      # parts), else the `Dynamic[top]` floor per slot.
+      def pattern_slot_types(subject_type, pattern, scope, subject_node)
+        view = positional_pattern_view(subject_type, scope, subject_node)
+        return floor_pattern_slots(pattern.requireds.size, pattern.posts.size, !pattern.rest.nil?) if view.nil?
+
+        MultiTargetBinder.decompose_slots(
+          view, front_count: pattern.requireds.size, back_count: pattern.posts.size,
+                rest_present: !pattern.rest.nil?, scope: scope
+        )
+      end
+
+      # The carrier a positional pattern decomposes: the subject itself when {MultiTargetBinder} already accepts it,
+      # else what the subject's `deconstruct` answers with (a `Tuple` / `Array[T]` carrier), else nil.
+      #
+      # `subject_node` rides along as the dispatch's call node so the `Struct` fold's freshness gate can see the
+      # receiver: `case Point.new(1, 2); in [x, y]` is a freshly materialised instance and folds, while a stored
+      # binding that may have been mutated since does not (ADR-48).
+      def positional_pattern_view(subject_type, scope, subject_node)
+        return subject_type if subject_type.is_a?(Type::Tuple)
+        return subject_type if MultiTargetBinder.array_element_type(subject_type)
+
+        deconstruct_projection(subject_type, scope, subject_node)
+      end
+
+      # What `subject.deconstruct` answers with, when that is a carrier this binder decomposes; nil otherwise —
+      # an absent method, or `Struct#deconstruct`'s RBS `Array[untyped]` for a class whose members are not known.
+      def deconstruct_projection(subject_type, scope, subject_node)
+        result = struct_instance_projection(subject_type, :deconstruct, scope, subject_node) ||
+                 pattern_decomposition_dispatch(subject_type, :deconstruct, [], scope) ||
+                 source_decomposition_projection(subject_type, :deconstruct, [], scope)
+        return nil if result.nil?
+        return result if result.is_a?(Type::Tuple) || MultiTargetBinder.array_element_type(result)
+
+        nil
+      end
+
+      # The inferred return type of a project-defined `deconstruct` / `deconstruct_keys` (issue #1122). The
+      # dispatcher answers nil for a class no RBS describes: the body-inference tier that would type
+      # `subject.deconstruct` lives on `ExpressionTyper` and needs the call NODE a pattern does not have, so
+      # this asks the scope's own entry point for the same answer a resolved call site gets (ADR-84 memo
+      # included). nil when the project defines no such method, or when the body's answer is the gradual floor.
+      def source_decomposition_projection(subject_type, method_name, arg_types, scope)
+        return nil unless subject_type.is_a?(Type::Nominal)
+
+        def_node = scope.discovered_def_nodes[subject_type.class_name]&.[](method_name)
+        return nil if def_node.nil?
+
+        result = scope.user_method_return(def_node, subject_type, arg_types)
+        return nil if result.nil? || result.is_a?(Type::Dynamic) || result.is_a?(Type::Top)
+
+        result
+      end
+
+      # A `StructInstance`'s own projection — `Tuple` of its member values for `deconstruct`, `HashShape` of
+      # its members for `deconstruct_keys` — or nil when the subject is another carrier or the projection would
+      # be unsound.
+      #
+      # The `Struct` fold's freshness gate cannot answer for a pattern through the dispatcher: it asks whether
+      # the CALL's receiver was freshly materialised (`Point.new(1, 2).x`), while a pattern's subject node IS
+      # that materialisation (`case Point.new(1, 2); in [x, y]`). The gate still applies — a `Struct` is
+      # mutable, so a stored binding's member map may be stale (ADR-48) — so this asks it the pattern's own
+      # question, with the subject expression as the materialisation. A `Data` instance needs none of this:
+      # it is frozen, and the dispatcher already projects it (see `DataFolding`).
+      def struct_instance_projection(subject_type, method_name, scope, subject_node)
+        return nil unless subject_type.is_a?(Type::StructInstance)
+        return nil unless MethodDispatcher::StructMaterialization.materialization_call?(subject_node, subject_type,
+                                                                                        scope)
+
+        case method_name
+        when :deconstruct then Type::Combinator.tuple_of(*subject_type.members.values)
+        when :deconstruct_keys then Type::Combinator.hash_shape_of(subject_type.members.dup)
+        end
+      end
+
+      # `deconstruct` / `deconstruct_keys` on a subject carrier. A `Dynamic` / `Top` answer is the gradual floor
+      # rather than a method's result, so it reads as "cannot ask" to every caller here.
+      #
+      # The subject node is deliberately NOT passed as the dispatch's `call_node`: the tiers read a call node's
+      # receiver and arguments, and a pattern's subject is any expression at all — `StructFolding`'s freshness
+      # gate dereferences `call_node.receiver`, which a local read or a literal does not answer. The one
+      # freshness question a pattern needs (`case Point.new(1, 2)`) is asked by
+      # {#struct_instance_projection} instead.
+      def pattern_decomposition_dispatch(subject_type, method_name, args, scope)
+        return nil if subject_type.nil?
+
+        result = MethodDispatcher.dispatch(
+          receiver_type: subject_type, method_name: method_name, arg_types: args,
+          environment: scope.environment, scope: scope
+        )
+        return nil if result.is_a?(Type::Dynamic) || result.is_a?(Type::Top)
+
+        result
+      end
+
+      # `in [*pre, m, *post]`. Ruby matches a find pattern's required elements at the EARLIEST position the
+      # surrounding splats allow (the pre-splat is non-greedy: `[1, 2, 3] in [*pre, x, *post]` binds `pre = []`, `x =
+      # 1`), but a required that does not match there slides right, so each required binds the union of every
+      # position it could occupy and the surrounding splats bind an `Array` of the subject's element type.
+      def collect_find_pattern_bindings(subject_type, pattern, scope, subject_node:)
+        subject_type = pattern_class_constraint(subject_type, pattern.constant, scope)
+        view = positional_pattern_view(subject_type, scope, subject_node)
+        slots = find_pattern_slots(view, pattern.requireds.size)
+        bindings = pattern.requireds.each_with_index.flat_map do |elem, i|
+          collect_in_pattern_bindings(slots ? slots[i] : Type::Combinator.untyped, elem, scope)
         end
-        append_array_splat_binding(bindings, pattern.rest)
+        surround = find_pattern_surround_type(view)
+        [pattern.left, pattern.right].each { |splat| append_array_splat_binding(bindings, splat, surround) }
         bindings
       end
 
-      def collect_hash_pattern_bindings(pattern, scope)
+      # The type each of a find pattern's `count` requireds can see, or nil when the subject cannot supply that many
+      # elements (the pattern cannot match).
+      def find_pattern_slots(view, count)
+        if view.is_a?(Type::Tuple)
+          elements = view.elements
+          return nil if elements.size < count
+
+          return Array.new(count) { |i| Type::Combinator.union(*elements[i..(elements.size - count + i)]) }
+        end
+
+        element = view && MultiTargetBinder.array_element_type(view)
+        element && Array.new(count) { element }
+      end
+
+      # `*pre` / `*post` capture the elements the requireds did not: `Array[T]` for an `Array[T]` subject, an `Array`
+      # of the element union for a `Tuple`, `Array[untyped]` when the subject could not be decomposed.
+      def find_pattern_surround_type(view)
+        element = case view
+                  when Type::Tuple then union_of_types(view.elements)
+                  else view && MultiTargetBinder.array_element_type(view)
+                  end
+        Type::Combinator.nominal_of("Array", type_args: [element || Type::Combinator.untyped])
+      end
+
+      # `in {name: String => n}` / `in {name:, **rest}`. Each element reads the subject's value at its key through
+      # the subject's `deconstruct_keys` projection; `**rest` binds the remaining entries.
+      def collect_hash_pattern_bindings(subject_type, pattern, scope, subject_node:)
+        subject_type = pattern_class_constraint(subject_type, pattern.constant, scope)
+        view = hash_pattern_view(subject_type, scope, subject_node)
         bindings = pattern.elements.flat_map do |assoc|
           next [] unless assoc.is_a?(Prism::AssocNode) && assoc.value
 
-          collect_in_pattern_bindings(nil, assoc.value, scope)
+          collect_in_pattern_bindings(hash_pattern_value_type(view, assoc.key), assoc.value, scope)
         end
         rest = pattern.rest
-        if rest.is_a?(Prism::AssocSplatNode)
-          val = rest.value
-          bindings << [val.name, hash_pattern_rest_type] if val.is_a?(Prism::LocalVariableTargetNode)
+        if rest.is_a?(Prism::AssocSplatNode) && rest.value.is_a?(Prism::LocalVariableTargetNode)
+          bindings << [rest.value.name, hash_pattern_rest_type(view)]
         end
         bindings
       end
 
-      def collect_find_pattern_bindings(pattern, scope)
-        bindings = pattern.requireds.flat_map do |elem|
-          collect_in_pattern_bindings(nil, elem, scope)
-        end
-        [pattern.left, pattern.right].each { |splat| append_array_splat_binding(bindings, splat) }
-        bindings
+      # The `Hash`-shaped view a hash pattern reads: the subject's `deconstruct_keys` answer, which is a `HashShape`
+      # for a shape carrier or a `deconstruct_keys` body and `Hash[K, V]` for the RBS answer of a plain `Hash` — or
+      # nil when the subject cannot be asked.
+      def hash_pattern_view(subject_type, scope, subject_node)
+        args = [Type::Combinator.constant_of(nil)]
+        struct_instance_projection(subject_type, :deconstruct_keys, scope, subject_node) ||
+          pattern_decomposition_dispatch(subject_type, :deconstruct_keys, args, scope) ||
+          source_decomposition_projection(subject_type, :deconstruct_keys, args, scope)
       end
 
-      # `[..., *rest, ...]` / `[*pre, x, *post]` capture an Array of the unmatched elements; bind `rest` to
-      # `Array[untyped]` rather than the previous bare `untyped`. Per-element typing waits on subject-aware element-type
-      # extraction (the binder doesn't see the case subject).
-      def append_array_splat_binding(bindings, splat)
-        return unless splat.is_a?(Prism::SplatNode)
+      # The value type the pattern's key reads out of the view: a `HashShape` answers per key, a `Hash[K, V]`
+      # answers `V` for every key, and anything else — a key the AST does not pin (`in {"#{k}": v}`), a shape that
+      # does not carry the key — answers the floor.
+      def hash_pattern_value_type(view, key_node)
+        key = hash_pattern_key(key_node)
+        return Type::Combinator.untyped if key.nil?
+        return view.pairs[key] || Type::Combinator.untyped if view.is_a?(Type::HashShape)
 
-        target = splat.expression
-        return unless target.is_a?(Prism::LocalVariableTargetNode)
+        hash_value_type(view) || Type::Combinator.untyped
+      end
 
-        bindings << [target.name, Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.untyped])]
+      # The key a hash pattern element names, or nil when the AST does not pin one (an interpolated or computed key).
+      def hash_pattern_key(key_node)
+        case key_node
+        when Prism::SymbolNode then key_node.unescaped.to_sym
+        when Prism::StringNode then key_node.unescaped
+        end
       end
 
       # `{ key:, **rest }` binds `rest` to a Hash whose keys are Symbols (the only legal key shape for a hash pattern)
-      # and whose values are untyped (the binder can't see the subject's value type).
-      def hash_pattern_rest_type
+      # and whose values are the view's own value type — the entries the pattern named are a subset of it.
+      def hash_pattern_rest_type(view)
+        value = view.is_a?(Type::HashShape) ? union_of_types(view.pairs.values) : hash_value_type(view)
         Type::Combinator.nominal_of(
           "Hash",
-          type_args: [Type::Combinator.nominal_of("Symbol"), Type::Combinator.untyped]
+          type_args: [Type::Combinator.nominal_of("Symbol"), value || Type::Combinator.untyped]
         )
       end
 
+      # The `V` of a `Hash[K, V]`, or nil for a raw `Hash`, a non-`Hash` nominal, or a `Dynamic` / `Top` value.
+      def hash_value_type(type)
+        return nil unless type.is_a?(Type::Nominal) && type.class_name == "Hash" && type.type_args.size == 2
+
+        value = type.type_args.last
+        return nil if value.is_a?(Type::Dynamic) || value.is_a?(Type::Top)
+
+        value
+      end
+
+      # The union of a list of types, ignoring the gradual floor (`Dynamic[top]` / `Top` carries nothing to union)
+      # and answering nil when nothing is left.
+      def union_of_types(types)
+        known = types.reject { |type| type.is_a?(Type::Dynamic) || type.is_a?(Type::Top) }
+        known.empty? ? nil : Type::Combinator.union(*known)
+      end
+
+      # `[..., *rest, ...]` / `[*pre, x, *post]` capture an Array of the unmatched elements. `rest_type` is the
+      # enclosing decomposition's own rest (a `Tuple` of the middle elements for a tuple subject, `Array[T]` for an
+      # `Array[T]`); without one — a subject that did not decompose — the rest is `Array[untyped]`.
+      def append_array_splat_binding(bindings, splat, rest_type)
+        return unless splat.is_a?(Prism::SplatNode)
+
+        target = splat.expression
+        return unless target.is_a?(Prism::LocalVariableTargetNode)
+
+        bindings << [target.name, rest_type || Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.untyped])]
+      end
+
+      # The `Dynamic[top]` floor per slot, for a subject no rule decomposes.
+      def floor_pattern_slots(front_count, back_count, rest_present)
+        [
+          Array.new(front_count) { Type::Combinator.untyped },
+          rest_present ? Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.untyped]) : nil,
+          Array.new(back_count) { Type::Combinator.untyped }
+        ]
+      end
+
+      # The class a pattern's own constant asserts (`in Point[x, y]`, `in Foo{...}`), applied to the subject. An
+      # opaque subject — `Dynamic` / `Top`, which no `is_a?`-style narrowing can refine — becomes `Nominal[C]`: the
+      # pattern's `C === subject` test has just established the class, which is what lets a constrained pattern bind
+      # off a subject whose own type named nothing. A subject whose class is already known keeps it.
+      def pattern_class_constraint(subject_type, constant_node, scope)
+        return subject_type if constant_node.nil?
+
+        nominal = singleton_to_nominal(sub_eval(constant_node, scope).first)
+        return subject_type unless opaque_pattern_subject?(subject_type)
+        return subject_type if nominal.is_a?(Type::Dynamic) || nominal.is_a?(Type::Top)
+
+        nominal
+      end
+
+      def opaque_pattern_subject?(subject_type)
+        subject_type.nil? || subject_type.is_a?(Type::Dynamic) || subject_type.is_a?(Type::Top)
+      end
+
+      # Distributes a union subject over the pattern, the rule {MultiTargetBinder} applies to `a, b = union`: every
+      # member walks the same pattern and each name binds the join of its per-member types, while a member that binds
+      # `Dynamic[top]` floors the name for the whole union — a precise member must not stand for one nothing is known
+      # about. A member that PROVABLY cannot match the pattern contributes nothing at all instead of flooring:
+      # `case maybe; in [a, b]` over `Tuple[1, "a"] | nil` binds `1` / `"a"`, because a `nil` subject raises
+      # `NoMatchingPatternError` rather than reaching the body.
+      def collect_union_pattern_bindings(members, pattern, scope, subject_node: nil)
+        reachable = members.reject { |member| pattern_match_impossible?(member, pattern, scope) }
+        walks = (reachable.empty? ? [Type::Combinator.untyped] : reachable).map do |member|
+          collect_in_pattern_bindings(member, pattern, scope, subject_node: subject_node)
+        end
+        merge_pattern_bindings(walks)
+      end
+
+      # Whether `type` provably cannot match `pattern`, so its arm contributes no binding. Only the two
+      # decompositions a pattern asks for are checked — `deconstruct` (array / find patterns) and `deconstruct_keys`
+      # (hash patterns) — and both only for a class the RBS environment knows, whose method set is closed, the same
+      # rule `array_conversion_free?` applies to the multi-assign `to_ary` question (issue #1094). A carrier the
+      # check cannot prove negative about (Dynamic, a source class, an unresolved constant) answers false, which
+      # keeps the union at the conservative floor.
+      def pattern_match_impossible?(type, pattern, scope)
+        case pattern
+        when Prism::ArrayPatternNode, Prism::FindPatternNode then !decomposable_as_array?(type, scope)
+        when Prism::HashPatternNode then !decomposable_as_hash?(type, scope)
+        when Prism::CapturePatternNode then pattern_match_impossible?(type, pattern.value, scope)
+        else false
+        end
+      end
+
+      def decomposable_as_array?(type, scope)
+        return true unless pattern_decomposition_dispatch(type, :deconstruct, [], scope).nil?
+
+        class_name = MultiTargetBinder.conversion_class_name(type)
+        class_name.nil? || !MethodDispatcher::RbsDispatch.array_conversion_free?(class_name, scope)
+      end
+
+      def decomposable_as_hash?(type, scope)
+        args = [Type::Combinator.constant_of(nil)]
+        return true unless pattern_decomposition_dispatch(type, :deconstruct_keys, args, scope).nil?
+
+        class_name = MultiTargetBinder.conversion_class_name(type)
+        return true if class_name.nil? || scope.environment.nil?
+
+        !Reflection.rbs_class_known?(class_name, environment: scope.environment)
+      end
+
+      # Joins per-member binding lists by name: `Dynamic[top]` from any walk — or a name a walk does not bind —
+      # floors the name, otherwise the members union. The first walk's order is the declaration order.
+      def merge_pattern_bindings(walks)
+        floor = Type::Combinator.untyped
+        walks.first.map do |name, _type|
+          types = walks.map { |walk| walk.assoc(name)&.last }
+          [name, types.any? { |type| type.nil? || type == floor } ? floor : Type::Combinator.union(*types)]
+        end
+      end
+
+      # `expr in pattern` (a `MatchPredicateNode`, evaluating to a boolean) and `expr => pattern` (a
+      # `MatchRequiredNode`, evaluating to `nil` and raising `NoMatchingPatternError` on a mismatch) — the one-line
+      # pattern matches. Both bind every name the pattern captures into the post-scope, decomposed exactly as an `in`
+      # branch of a `case` is, and WITHOUT the nil-injection a surrounding join would add: a name is read on the
+      # truthy side only after the pattern matched it, which is the shape `if config in {timeout: Integer => t}`
+      # depends on.
+      def eval_match_pattern(node)
+        subject_type, post_value = sub_eval(node.value, scope)
+        bound = apply_in_pattern_bindings(subject_type, node.value, node.pattern, post_value)
+        [scope.type_of(node, tracer: tracer), bound]
+      end
+
       # --------------------------------------------------------------- named-capture regex binding (`MatchWriteNode`)
       # ---------------------------------------------------------------
 
@@ -3449,26 +6118,43 @@ module Rigor
         type.is_a?(Type::Singleton) ? Type::Combinator.nominal_of(type.class_name) : Type::Combinator.untyped
       end
 
-      # Returns the type to bind for a `CapturePatternNode`'s target. Plain class references collapse to the matching
-      # `Nominal[T]`; `AlternationPatternNode` (`Integer | String => x`) unions every alternate's resolved type.
-      # Anything else falls back to `untyped` (the conservative legacy behaviour).
-      def pattern_capture_type(value_node, scope)
-        if value_node.is_a?(Prism::AlternationPatternNode)
-          left = pattern_capture_type(value_node.left, scope)
-          right = pattern_capture_type(value_node.right, scope)
-          Type::Combinator.union(left, right)
-        else
+      # Returns the type to bind for a `CapturePatternNode`'s target. A class reference (`Integer => x`, and every
+      # alternate of `Integer | String => x`) answers the constraint's `Nominal[T]` — the pattern's own `T ===
+      # subject` test is what licenses the binding even when the subject's type is opaque. A value pattern (`1 => x`)
+      # answers the literal's own type. A capture over any other pattern (`[a, b] => whole`, `^(x) => y`) answers the
+      # subject, which is what that pattern matched.
+      def capture_pattern_type(subject_type, value_node, scope)
+        case value_node
+        when Prism::ConstantReadNode, Prism::ConstantPathNode
           singleton_to_nominal(sub_eval(value_node, scope).first)
+        when Prism::AlternationPatternNode
+          Type::Combinator.union(
+            capture_pattern_type(subject_type, value_node.left, scope),
+            capture_pattern_type(subject_type, value_node.right, scope)
+          )
+        when Prism::ArrayPatternNode, Prism::FindPatternNode, Prism::HashPatternNode,
+             Prism::PinnedVariableNode, Prism::PinnedExpressionNode, Prism::ImplicitNode
+          subject_type || Type::Combinator.untyped
+        else
+          literal_pattern_type(value_node, scope)
         end
       end
 
-      # `in PatternA | PatternB` — Ruby requires both alternates to bind the same names, but the binder runs against the
-      # AST and cannot enforce that. We collect bindings from each side and merge by name, unioning types when both
+      # The type a non-class pattern node evaluates to: `Constant[1]` for `1 => x`, the nominal for `/re/ => x`,
+      # the range for `1..5 => x`. A class reference is the one carrier that must convert (`Singleton[C]` is the
+      # class object; the binding holds an instance), which the caller's constant arm does.
+      def literal_pattern_type(value_node, scope)
+        type = sub_eval(value_node, scope).first
+        type.is_a?(Type::Singleton) ? singleton_to_nominal(type) : type
+      end
+
+      # `in PatternA | PatternB` — Ruby requires both alternates to bind the same names, but the binder runs against
+      # the AST and cannot enforce that. We collect bindings from each side and merge by name, unioning types when both
       # alternates contribute. Names that only one alternate contributes still surface (the parser would have rejected
       # the case at compile time, so by the time we see it the user's intent is the merged set).
-      def collect_alternation_pattern_bindings(subject, pattern, scope)
-        left = collect_in_pattern_bindings(subject, pattern.left, scope)
-        right = collect_in_pattern_bindings(subject, pattern.right, scope)
+      def collect_alternation_pattern_bindings(subject_type, pattern, scope)
+        left = collect_in_pattern_bindings(subject_type, pattern.left, scope)
+        right = collect_in_pattern_bindings(subject_type, pattern.right, scope)
         merged = {}
         (left + right).each do |name, type|
           merged[name] = merged.key?(name) ? Type::Combinator.union(merged[name], type) : type