rigortype 0.4.6 → 0.4.7

data/lib/rigor/inference/statement_evaluator.rb

@@ -14,7 +14,10 @@ require_relative "block_call_timing"
 require_relative "block_repetition"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
+require_relative "memo_audit"
 require_relative "callee_mutation_chain"
+require_relative "toplevel_def_census"
+require_relative "callee_write_census"
 require_relative "captured_locals"
 require_relative "dynamic_origin"
 require_relative "error_info"
@@ -26,10 +29,13 @@ require_relative "../analysis/check_rules/published_constant_guard"
 require_relative "struct_fold_safety"
 require_relative "closure_escape_analyzer"
 require_relative "content_join"
+require_relative "construction_escape"
 require_relative "define_method_block_self"
 require_relative "macro_block_self_type"
+require_relative "global_writer_reach"
 require_relative "guard_rebinding"
 require_relative "self_call_ivar_writes"
+require_relative "direct_ivar_writes"
 require_relative "intervening_ivar_reset"
 require_relative "match_rebinding"
 require_relative "clause_widening"
@@ -42,6 +48,7 @@ require_relative "method_dispatcher"
 require_relative "method_parameter_binder"
 require_relative "multi_target_binder"
 require_relative "mutation_widening"
+require_relative "out_buffer_mutation"
 require_relative "narrowing"
 require_relative "operand_effects"
 require_relative "operand_walk"
@@ -54,6 +61,7 @@ require_relative "rewrite_mutation"
 require_relative "unknown_store_widening"
 require_relative "untyped_rejoin"
 require_relative "version_guard"
+require_relative "../run_scoped_slots"
 
 module Rigor
   module Inference
@@ -517,9 +525,13 @@ module Rigor
       # def hands on to a self-call counts whether or not the callee resolves: the session's empty scope resolves no
       # callee, and without it an edit that starts or stops forwarding a parameter to a mutating callee would leave
       # the effects equal and the callers' floors stale.
+      #
+      # Issue #2296 — the parameters the def mutates inside a block, or through a Set-only adder, count too: they
+      # floor the caller's argument through {#floor_callee_escaped_args_for_call}'s element-keeping channels.
       def content_mutated_parameter_positions(def_node)
-        slots = content_parameter_slots(def_node)
-        census = callee_content_mutated_parameters(def_node).values
+        slots = forwarding_slots(def_node)
+        census = callee_content_mutated_parameters(def_node).values +
+                 own_block_content_parameters(def_node).values + own_set_content_parameters(def_node).values
         each_forwarding_call(def_node, slots) { |_, forwarded| census += forwarded.map { |name, _| slots[name] } }
         positions, keywords = census.uniq.partition { |slot| slot.is_a?(Integer) }
         positions.sort + keywords.sort
@@ -531,25 +543,691 @@ module Rigor
       # callee floor ({#widen_callee_escaped_argument_captures}) floors after the call, and the ones
       # {CapturedLocals.content_mutations} reports as a block's callee-mutated captures.
       def content_mutated_arguments(call_node)
-        return NO_ARGUMENT_READS unless self_dispatch_call?(call_node)
+        callees = argument_mutating_callees(call_node)
+        return NO_ARGUMENT_READS if callees.empty?
+
+        reads = callees.flat_map do |def_node, offset, owner|
+          arguments_for_slots(call_node, census_of(owner, :callee_content_mutated_parameters, def_node), offset)
+        end
+        callees.size == 1 ? reads : reads.uniq
+      end
+
+      # The `[def, offset]` pairs a self-dispatch `call_node` that passes a local resolves to
+      # ({#resolve_self_callees}) — the defs whose census the callee floor reads; empty for any other call.
+      #
+      # Issue #2336 — a call no def answers that runs code the floor cannot see against its arguments (`pr.call(acc)`,
+      # `obj.method(:poke).call(acc)`, `send(name, acc)`; {#opaque_sink_call?}) answers {OPAQUE_CALLEES}: every
+      # argument it passes reads as written.
+      def argument_mutating_callees(call_node)
+        unless self_dispatch_call?(call_node)
+          found = receiver_callees(call_node)
+          return found unless found.empty? && opaque_sink_call?(call_node)
+
+          return call_passes_local_argument?(call_node) ? OPAQUE_CALLEES : NO_CALLEES
+        end
         # Fast path — only a local passed as an argument can be reported, so a call with none skips the def
         # resolution and the body scan entirely (the overwhelming common case).
-        return NO_ARGUMENT_READS unless call_passes_local_argument?(call_node)
+        return NO_CALLEES unless call_passes_local_argument?(call_node)
+
+        found = resolve_self_callees(call_node)
+        found.empty? && opaque_sink_call?(call_node) ? OPAQUE_CALLEES : found
+      end
+
+      # True for a call whose arguments go to code no def shows: `call` / `instance_exec` / `class_exec` /
+      # `module_exec` on an explicit receiver (a Proc, a Method, a lambda), or a `send` whose target is no literal
+      # ({CalleeWriteCensus}, which reads the same calls inside a callee).
+      def opaque_sink_call?(call_node)
+        name = call_node.name
+        return !CalleeWriteCensus.literal_send?(call_node) if SEND_HAND_OFFS.include?(name)
+        return false unless OPAQUE_SINKS.include?(name)
+
+        # A receiverless `call` is a self-call to a def of that name; `instance_exec` and the rest run their block on
+        # any receiver.
+        name != :call || !self_dispatch_call?(call_node)
+      end
+
+      OPAQUE_SINKS = %i[call instance_exec class_exec module_exec].to_set.freeze
+      private_constant :OPAQUE_SINKS
+
+      # Issue #2510, #2515 — the `[def, 0, owner]` triple an explicit-receiver `recv.name(local)` call resolves to when
+      # `recv` types as a project class object (`Const`, a bare constant or any constant path, or a local holding
+      # one), whose singleton chain has `name` (`def self.name`, `class << self`, `module_function`, an `extend`ed
+      # module, the project superclass's), or as an instance of a project class (`Opts.new.add_format(...)`,
+      # `h = Opts.new; h.add_format(...)`), whose instance chain has `name`: the same census a self-call reads then
+      # floors the passed local, so `Opts.add_format(opts, options)` handing `options` to a block that writes it
+      # leaves the literal behind. `owner` is a {CalleeOwner}: the receiver type the callee's own hand-offs
+      # (`really(parser, options)`) resolve self-calls in, not the caller's class. `resolved_census` keys the shared
+      # memo by the receiver's class and the def node, whose recorded nesting its constants resolve in. A def the
+      # receiver inherits (a superclass's, an included module's) resolves to {FLOOR_ALL} ({#walked_owner}). A receiver
+      # of any other type resolves to nothing, as does `Const.new` of a class that defines its own `self.new`; `send`
+      # hand-offs are not followed through an explicit receiver. The hand-offs inside a callee, whose arguments are
+      # parameters, take {#hand_off_receiver_callees}.
+      def receiver_callees(call_node)
+        return NO_CALLEES if call_node.receiver.nil?
+        return NO_CALLEES unless call_passes_local_argument?(call_node)
+
+        receiver_callees_in(scope, call_node)
+      end
+
+      # {#receiver_callees} for one scope `call_node`'s receiver (or `receiver`, the constant form a callee's local
+      # receiver was assigned) is typed in.
+      def receiver_callees_in(typing_scope, call_node, receiver = call_node.receiver)
+        return NO_CALLEES if overridden_constructor?(receiver, typing_scope)
+
+        receiver_type = typing_scope.type_of(receiver)
+        own = callees_for_receiver_type(receiver_type, call_node.name)
+        return own unless own.empty? && send_hand_off?(call_node)
+
+        shifted_callees(callees_for_receiver_type(receiver_type, send_target(call_node)))
+      end
+
+      # Issue #2336 — the method a `send` hand-off names (`recv.send(:poke, h)`, `send("poke", h)`).
+      def send_target(call_node) = call_node.arguments.arguments.first.unescaped.to_sym
+
+      # `callees` with each offset one further: the callees of a `send` hand-off's target, whose first argument is the
+      # name. A capped answer stays as it is.
+      def shifted_callees(callees)
+        return callees if callees.empty? || callees.equal?(CAPPED_HAND_OFF)
+
+        shifted = callees.map { |def_node, offset, owner| [def_node, offset + 1, owner] }
+        callees.is_a?(UnionCallees) ? UnionCallees.new(shifted) : shifted
+      end
+
+      # `[def, 0, owner]` for `name` called on a receiver of `receiver_type`, or none.
+      def callees_for_receiver_type(receiver_type, name)
+        if receiver_type.is_a?(Type::Union)
+          return receiver_type.members.flat_map { |member| callees_for_receiver_type(member, name) }
+                              .uniq { |callee, _, owner| [callee.object_id, owner] }
+        end
+
+        singleton = receiver_type.is_a?(Type::Singleton)
+        return NO_CALLEES unless singleton || receiver_type.is_a?(Type::Nominal)
+
+        class_name = receiver_type.class_name
+        found, defining =
+          if singleton then scope.singleton_def_through_ancestors(class_name, name)
+          else scope.user_def_through_ancestors(class_name, name)
+          end
+        side = singleton ? :singleton : :instance
+        return unresolved_receiver_callees(receiver_type, side, name) if found.nil?
+
+        [[found, 0, walked_owner(defining, class_name, CalleeOwner.new(receiver_type))]]
+      end
+
+      # `owner`, the owner a def found on `defining` by a lookup on `class_name` is walked under, or {FLOOR_ALL} for a
+      # def the class inherits (`defining` is not `class_name`). An inherited def is not walked (#2521): walking it
+      # exposed the own-def census's blind spots, which #2595 closes ({#callee_write_census}), and the hand-offs #2336
+      # lists, which stay open and which the floor masks.
+      def walked_owner(defining, class_name, owner)
+        defining == class_name ? owner : FLOOR_ALL
+      end
+
+      # Issue #2336 — what a call of `name` on a receiver of `receiver_type` reaches when its `side` chain has no def of
+      # the name: a body an ownerless definition row may give it ({#receiver_ownerless_body?}), floored outright; on
+      # the singleton side, a same-named instance def
+      # written as a `module_function def x` argument ({Scope#module_function_row_def?}), which the singleton def table
+      # does not hold, walked as a class method; else the chain's `method_missing`.
+      def unresolved_receiver_callees(receiver_type, side, name)
+        class_name = receiver_type.class_name
+        return OPAQUE_CALLEES if receiver_ownerless_body?(name, class_name)
+
+        if side == :singleton
+          found, defining = scope.user_def_through_ancestors(class_name, name)
+          if found && scope.module_function_row_def?(found, defining)
+            return [[found, 0, walked_owner(defining, class_name, CalleeOwner.new(receiver_type))]]
+          end
+        end
+        method_missing_callees(class_name, side, name, 0)
+      end
+
+      # Issue #2336 — true when an ownerless definition row may give `name` a body on `class_name`, the receiver of an
+      # explicit-receiver call ({Scope#ownerless_definition?}). A `define_method` / `define_singleton_method` /
+      # `alias_method` call or a def in a block claims no owner, so it may be the receiver's own and always counts. A
+      # top-level def lives on `Object`, so a method RBS declares on the receiver's class answers ahead of it
+      # (`Bag < Hash` and a top-level `def store`): the top-level rows count only when RBS declares none.
+      def receiver_ownerless_body?(name, class_name)
+        return true if scope.ownerless_definition?(name, top_level: false)
+        return false if rbs_declares?(class_name, name)
+
+        scope.ownerless_definition?(name)
+      end
+
+      # Issue #2336 — true when a body no def table holds may answer the receiverless call of `name` in `class_name`'s
+      # `side` chain, which no def, `method_missing` or top-level def answers: a definer the chain records
+      # (`define_method(:format)` in the class body; {Scope#discovered_method_through_ancestors?}), or, for a name RBS
+      # does not declare on `Object` (`Class` on the singleton side), any ownerless definition row. A name `Object`
+      # declares (`warn`, `format`) is answered by that method once the chain has no definer of it, so a `def warn` in a
+      # `refine Kernel` block or a `define_method` on another class does not count.
+      def self_ownerless_body?(name, class_name, side)
+        return true if scope.discovered_method_through_ancestors?(class_name, name, side)
+        return false if Reflection.instance_method_definition(side == :singleton ? "Class" : "Object", name,
+                                                              scope: scope)
+
+        scope.ownerless_definition?(name)
+      end
+
+      # Issue #2521 (#2570 review) — the `[def, offset, FLOOR_ALL]` a call of `name` that resolves to no def on
+      # `class_name`'s `side` chain reaches when the chain defines `method_missing` and `name` is not a method every
+      # object (`Object`, or `Class` on the singleton side) answers: Ruby calls `method_missing(name, *args)`, so its
+      # parameters sit `offset` places ahead of the call's arguments (-1; 0 for a `send(:name, ...)` hand-off).
+      def method_missing_callees(class_name, side, name, offset)
+        found =
+          if side == :singleton then scope.singleton_def_through_ancestors(class_name, :method_missing).first
+          else scope.user_def_through_ancestors(class_name, :method_missing).first
+          end
+        return NO_CALLEES if found.nil?
+
+        base = side == :singleton ? "Class" : "Object"
+        return NO_CALLEES if Reflection.instance_method_definition(base, name, scope: scope)
+
+        [[found, offset - 1, FLOOR_ALL]]
+      end
+
+      # What a cross-class hand-off carries instead of an evaluator: the receiver type, which is `self` in the callee.
+      # The def's lexical nesting is not carried: it is a property of the def node ({#recorded_def_nesting}), which
+      # keys the census memo and the chain's nodes beside it. Holds no scope, so the run-scoped census memo that keeps
+      # an {CalleeMutationChain::Edge} alive keeps no caller state alive.
+      CalleeOwner = Data.define(:self_type)
+
+      # The owner of an inherited def ({#walked_owner}): its census and hand-offs are not walked. Every content
+      # parameter reads as mutated, so the argument is floored, and a {BudgetTrace::CALLEE_CHAIN_CAP} hit is recorded.
+      FLOOR_ALL = :floor_all
+
+      # Issue #2515 — the owner of a top-level def that may not be the method the call runs (several defs of the name,
+      # an alias, a class chain that may answer it first; {ToplevelDefCensus}, {#top_level_callees}): the def is not
+      # read, and EVERY argument the call passes reads as written, whatever the def's own parameters are, since another
+      # def of the name may take more of them. A hand-off to it floors the handed parameter outright.
+      FLOOR_EVERY = :floor_every
+
+      # Issue #2336 — the answer for a call no def resolves whose arguments the floor reads as written: an opaque sink
+      # ({#opaque_sink_call?}), or a name a definer other than a `def` may give a body ({#receiver_ownerless_body?},
+      # {#self_ownerless_body?}). No def is
+      # read; every argument floors as under {FLOOR_EVERY}.
+      OPAQUE_CALLEES = [[nil, 0, FLOOR_EVERY].freeze].freeze
+
+      # The owner of a top-level def reached from inside a class: its hand-offs resolve at the top level, where `self`
+      # is no instance of the caller's class.
+      TOPLEVEL_OWNER = CalleeOwner.new(nil)
+      OVER_APPROXIMATING = [FLOOR_ALL, FLOOR_EVERY].freeze
+      private_constant :CalleeOwner, :FLOOR_ALL, :FLOOR_EVERY, :OPAQUE_CALLEES, :TOPLEVEL_OWNER, :OVER_APPROXIMATING
+
+      # True for `Const.new` where the class defines its own `self.new`, whose result is not an instance of `Const`.
+      def overridden_constructor?(receiver, typing_scope)
+        return false unless receiver.is_a?(Prism::CallNode) && receiver.name == :new
+
+        klass = typing_scope.type_of(receiver.receiver) if constant_node?(receiver.receiver)
+        klass.is_a?(Type::Singleton) &&
+          !typing_scope.singleton_def_through_ancestors(klass.class_name, :new).first.nil?
+      end
+
+      # Issue #2522 — the callees a hand-off inside `def_node`'s body (`Help.c(p, o)`, `Helper.new.c(p, o)`) resolves
+      # to: the receiver typed once under the `Module.nesting` the declaration walk recorded for `def_node`, so a bare
+      # constant follows Ruby's lookup (the lexical chain, the innermost cref's ancestors, the top level) for the
+      # spelling the def is actually written under (`class B::Opts` reads `::Helper`, `module B; class Opts` reads
+      # `B::Helper`). The nesting is a function of the def node, never of the caller, so the answer cannot depend on
+      # which caller reached the memoised edges first. A def with no recorded nesting takes
+      # {#unrecorded_hand_off_callees}.
+      def hand_off_receiver_callees(call_node, def_node, receiver = call_node.receiver)
+        nesting = exact_def_nesting(def_node)
+        return unrecorded_hand_off_callees(call_node, receiver) if nesting.nil?
+
+        receiver_callees_in(scope.with_lexical_nesting(nesting), call_node, receiver)
+      end
+
+      # The def's recorded `Module.nesting` ({Scope::DiscoveryIndex#recorded_def_nesting}), nil when the declaration
+      # walk recorded none.
+      def recorded_def_nesting(def_node) = scope.discovery.recorded_def_nesting(def_node)
+
+      # The nesting the hand-offs of `def_node`, run with `self_type`, resolve their constants in exactly, or nil. A
+      # def in a `class << self` body answers nil: there Ruby's cref is the singleton class, whose ancestors are not
+      # the class's (#2570 review), and the recorded nesting does not name it. Such a def is receiverless, runs on the
+      # class object, and is not in its cref's instance def table, which a `module_function` / `extend self` def or an
+      # `extend`ed module's def (whose cref is the module itself) is.
+      def exact_def_nesting(def_node, self_type = scope.self_type)
+        nesting = recorded_def_nesting(def_node)
+        return nesting unless self_type.is_a?(Type::Singleton) && def_node.receiver.nil?
+        return nil if nesting.nil? || nesting.empty?
+
+        scope.user_def_for(nesting.first, def_node.name).equal?(def_node) ? nesting : nil
+      end
+
+      # A hand-off in a def whose nesting was not recorded (a def under a header that renders no name, a bundle-served
+      # def outside a rehydrating run): the spelling of the defining class is unknown (`module A; class B::C` has the
+      # nesting `["A::B::C", "A"]`, `class A::B::C` has `["A::B::C"]`), so the union of two resolutions that try
+      # every spelling it could have had, each of which only adds callees:
+      #
+      # - By name: a bare constant `K` as each prefix of the class name followed by `K`, and as the top-level `K`; a
+      #   rooted one (`::K`) as `K` alone.
+      # - Typed: the receiver typed under each truncation of the nested-spelling nesting (`["A::B::C", "A::B", "A"]`
+      #   gives `["A::B::C"]`, `["A::B::C", "A::B"]` and the whole chain), which sees an alias, an inherited or
+      #   included constant and a constant holding an instance.
+      def unrecorded_hand_off_callees(call_node, receiver = call_node.receiver)
+        constructed = receiver.is_a?(Prism::CallNode) && receiver.name == :new
+        written = constant_name(constructed ? receiver.receiver : receiver)
+        return NO_CALLEES if written.nil?
+        return compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed) if hand_off_memo_bypassed?
+
+        memo = unrecorded_hand_off_memo(written)
+        key = [constructed, call_node.name]
+        unless memo.key?(key)
+          return memo[key] = compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed)
+        end
+
+        MemoAudit.check("unrecorded hand-off", memo[key], written, key) do
+          compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed)
+        end
+      end
+
+      def compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed)
+        found = hand_off_class_names(written).flat_map do |class_name|
+          hand_off_callee_in(class_name, constructed, call_node.name)
+        end
+        hand_off_typing_scopes(written).each do |typing_scope|
+          found.concat(receiver_callees_in(typing_scope, call_node, receiver))
+        end
+        found.size > 1 ? found.uniq { |callee, _, owner| [callee.object_id, owner] } : found
+      end
+
+      # The run's per-discovery memo of {#unrecorded_hand_off_callees}: the answer depends on the receiver's spelling,
+      # the class `self` is and its side (a constant's ancestor lookup differs between the class object and an
+      # instance), and the called name, not on the def it sits in.
+      def unrecorded_hand_off_memo(written)
+        table = (Thread.current[UNRECORDED_HAND_OFF_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        self_type = scope.self_type
+        by_side = ((table[scope.discovery] ||= {})[self_type.is_a?(Type::Singleton)] ||= {})
+        (by_side[enclosing_class_name_for(self_type)] ||= {})[written] ||= {}
+      end
+
+      UNRECORDED_HAND_OFF_KEY = RunScopedSlots.register(:rigor_callee_unrecorded_hand_offs)
+      private_constant :UNRECORDED_HAND_OFF_KEY
+
+      # The scopes {#unrecorded_hand_off_callees} types a receiver written as `written` in. A rooted constant and a
+      # top-level def are typed once.
+      def hand_off_typing_scopes(written)
+        name = enclosing_class_name_for(scope.self_type)
+        return [scope.with_lexical_nesting([])] if name.nil?
+        return [scope] if written.start_with?("::")
+
+        parts = name.to_s.split("::")
+        chain = parts.each_index.map { |i| parts[0..(parts.size - 1 - i)].join("::") }
+        chain.each_index.map { |k| scope.with_lexical_nesting(chain[0..k]) }
+      end
+
+      # `[def, 0, owner]` for `name` called on `class_name` (or on its `new`), or none.
+      def hand_off_callee_in(class_name, constructed, name)
+        if constructed
+          return NO_CALLEES unless scope.singleton_def_through_ancestors(class_name, :new).first.nil?
+
+          found = scope.user_def_for(class_name, name)
+          return found.nil? ? NO_CALLEES : [[found, 0, CalleeOwner.new(Type::Combinator.nominal_of(class_name))]]
+        end
+
+        found, defining = scope.singleton_def_through_ancestors(class_name, name)
+        return NO_CALLEES if found.nil?
+
+        owner = CalleeOwner.new(Type::Combinator.singleton_of(class_name))
+        [[found, 0, walked_owner(defining, class_name, owner)]]
+      end
+
+      # The class names a constant written as `written` (`K`, `A::K`, `::K`) can name from the def's class name.
+      def hand_off_class_names(written)
+        return [written.delete_prefix("::")] if written.start_with?("::")
+
+        name = enclosing_class_name_for(scope.self_type)
+        return [written] if name.nil?
+
+        parts = name.to_s.split("::")
+        parts.each_index.map { |i| "#{parts[0..i].join('::')}::#{written}" } << written
+      end
+
+      # True when a census memo must not be read or written: a dependency recorder is active (it must see each
+      # constant read), or this scope carries guard narrowings of constants (`if INST.is_a?(Sub)`), which survive
+      # `with_self_type` and change what the constant types as, so the answer is no longer the def's alone. An audit
+      # recomputation ({MemoAudit}) bypasses them too, so it reads no stored entry.
+      def hand_off_memo_bypassed?
+        Analysis::DependencyRecorder.active? || !scope.constant_narrowings.empty? || MemoAudit.suspended?
+      end
+
+      # The name a constant node is written with, or nil when part of it is not a constant (`foo::Bar`).
+      def constant_name(node)
+        node.full_name if constant_node?(node)
+      rescue Prism::ConstantPathNode::DynamicPartsInConstantPathError, Prism::ConstantPathNode::MissingNodesInConstantPathError
+        nil
+      end
+
+      # The evaluator a hand-off's {CalleeOwner} stands for, built from this one's scope and kept on it.
+      def owner_evaluator(owner)
+        (@owner_evaluators ||= {})[owner] ||=
+          self.class.new(scope: scope.with_self_type(owner.self_type))
+      end
+
+      # The `[def, offset, owner]` triples a call inside `def_node`'s body hands its parameter to: a self-call
+      # ({#resolve_self_callees}, owner nil) or a call on a constant / `Const.new` receiver ({#hand_off_receiver?},
+      # {#hand_off_receiver_callees}).
+      #
+      # Issue #2336 — a call on `itself` is a self-call, and one on `self.class` resolves on the class object `self`
+      # types as. A call on any other receiver the callee's body cannot type (a call's result: `new.store(h)`,
+      # `instance.helper(h)`; a class variable or a global) resolves by name, as an ivar receiver does. A literal
+      # `send` hand-off on any receiver resolves as its target.
+      def hand_off_callees(call_node, def_node, depth = 0)
+        receiver = call_node.receiver
+        return self_hand_off_callees(call_node) if self_dispatch_call?(call_node) || itself_receiver?(receiver)
+
+        if receiver.is_a?(Prism::LocalVariableReadNode) || receiver.is_a?(Prism::ItLocalVariableReadNode)
+          return local_receiver_callees(call_node, def_node, depth)
+        end
+        return receiver_callees_in(scope, call_node) if class_of_self?(receiver)
+        return hand_off_receiver_callees(call_node, def_node) if constant_receiver_form?(receiver)
+
+        named_hand_off_callees(call_node)
+      end
+
+      # {#named_instance_callees} for `call_node`'s name, or a literal `send` hand-off's target.
+      def named_hand_off_callees(call_node)
+        return named_instance_callees(call_node.name) unless send_hand_off?(call_node)
+
+        shifted_callees(named_instance_callees(send_target(call_node)))
+      end
+
+      # `itself` / `self.itself`, which is `self`.
+      def itself_receiver?(receiver)
+        receiver.is_a?(Prism::CallNode) && receiver.name == :itself && receiver.arguments.nil? &&
+          receiver.block.nil? && self_dispatch_call?(receiver)
+      end
+
+      # `self.class`, the class object of `self`.
+      def class_of_self?(receiver)
+        receiver.is_a?(Prism::CallNode) && receiver.name == :class && receiver.receiver.is_a?(Prism::SelfNode) &&
+          receiver.arguments.nil? && receiver.block.nil?
+      end
+
+      # {#resolve_self_callees} for a self-call that is a hand-off inside a def. In a def the evaluator is the top
+      # level's (`self` nil), the def a top-level one, and a top-level def is a private method on `Object`: it may be
+      # called from any object, so a same-named instance def of the caller's class answers the hand-off before the
+      # top-level one. Issue #2515 — the project's same-named instance defs are unioned in as a receiver the callee
+      # cannot type is ({#named_instance_callees}): they floor, never narrow.
+      def self_hand_off_callees(call_node)
+        found = resolve_self_callees(call_node)
+        return found unless enclosing_class_name_for(scope.self_type).nil?
+
+        send_hand_off = send_hand_off?(call_node)
+        target = send_hand_off ? call_node.arguments.arguments.first.unescaped.to_sym : call_node.name
+        named = named_instance_callees(target)
+        return named if named.equal?(CAPPED_HAND_OFF)
+        return found if named.empty?
+
+        named = named.map { |def_node, _offset, owner| [def_node, 1, owner] } if send_hand_off
+        UnionCallees.new(found + named)
+      end
+
+      # True for a call on an explicit receiver: one the callee's body can type without its locals (a constant or
+      # `Const.new`), a local of the callee (#2515: {#local_receiver_callees}), or (issue #2595 for an ivar, #2336 for
+      # any other) one whose type the def's AST does not show, so it resolves by name ({#named_hand_off_callees}).
+      def hand_off_receiver?(node) = node.is_a?(Prism::CallNode) && !node.receiver.nil?
+
+      def constant_receiver_form?(receiver)
+        case receiver
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then true
+        when Prism::CallNode then receiver.name == :new && constant_node?(receiver.receiver)
+        else false
+        end
+      end
+
+      # Issue #2515 — the callees of `local.name(p, o)` inside `def_node`, where `local` is a parameter or a local of
+      # the def. A local every assignment of which in the def is a constant receiver form (`Const`, `Const.new`) is
+      # typed inside the callee, as the constant receiver is ({#hand_off_receiver_callees}). Any other receiver (a
+      # parameter, a local assigned anything else, a block-local) has a type that depends on the caller, which is
+      # not a function of the graph node, so the call resolves by name instead ({#named_instance_callees}).
+      def local_receiver_callees(call_node, def_node, depth)
+        receiver = call_node.receiver
+        typed = receiver.is_a?(Prism::LocalVariableReadNode) && receiver.depth == depth
+        forms = typed_local_forms(def_node, receiver.name) if typed
+        forms = nil if forms && local_object_opened?(def_node, call_node)
+        return named_hand_off_callees(call_node) if forms.nil?
+
+        found = forms.flat_map { |form| hand_off_receiver_callees(call_node, def_node, form) }
+        found.size > 1 ? found.uniq { |callee, _, owner| [callee.object_id, owner] } : found
+      end
+
+      # The constant receiver forms every assignment of the local `name` in `def_node` holds, or nil when `name` is a
+      # parameter, is never assigned, or may hold anything else. The whole body is read, including the scopes the
+      # hand-off walk leaves out (a lambda, an `instance_exec` / `class_exec` / `define_method` block, a block that
+      # shadows the name), so a write there counts. The local is untyped when any write is not a constant form (an
+      # op-write, a multiple assignment, `for` or `rescue =>` target, a pattern capture, any other value), when it is
+      # the receiver of `send` / `public_send` / `__send__` / `singleton_class` or is assigned to another local
+      # (`g = h`), and, for every local, when the body calls `binding`, `eval`, `instance_eval` or
+      # `local_variable_set` on any receiver, which can write a local no node names. A local whose object the syntax
+      # gives methods ({#local_object_opened?}) is untyped at that call. A per-def AST fact, memoised as {#def_census}.
+      def typed_local_forms(def_node, name)
+        def_census(:local_forms, def_node) { local_forms_of(def_node) }[name]
+      end
+
+      # True when the file's syntax gives the receiver local's object methods the declaration tables do not show
+      # (`def h.x`, `h.extend(M)`, `h.define_singleton_method`, `h.singleton_class...`, `class << h`, an
+      # `h.instance_eval` that defines): {Analysis::CheckRules::LexicalMethodSites}, asked once per def for every
+      # call on a local.
+      def local_object_opened?(def_node, call_node)
+        def_census(:opened_local_calls, def_node) { opened_local_call_offsets(def_node) }
+          .include?(call_node.location.start_offset)
+      end
+
+      def opened_local_call_offsets(def_node)
+        require_relative "../analysis/check_rules/lexical_method_sites"
+        sites = Analysis::CheckRules::LexicalMethodSites.new(def_node)
+        offsets = Set.new
+        Source::NodeWalker.each(def_node.body) do |node|
+          next unless node.is_a?(Prism::CallNode) && node.receiver.is_a?(Prism::LocalVariableReadNode)
+
+          offsets << node.location.start_offset if sites.singleton_local_def?(node)
+        end
+        offsets.freeze
+      end
+
+      DYNAMIC_LOCAL_CALLS = Set[:binding, :eval, :instance_eval, :local_variable_set].freeze
+      DISPATCHING_CALLS = Set[:send, :public_send, :__send__, :singleton_class].freeze
+      private_constant :DYNAMIC_LOCAL_CALLS, :DISPATCHING_CALLS
+
+      def local_forms_of(def_node)
+        forms = {}
+        tainted = Set.new
+        return NO_FORMS if collect_local_forms(def_node.body, forms, tainted)
+
+        params = def_node.parameters
+        forms.each_value(&:uniq!)
+        forms.delete_if do |name, values|
+          tainted.include?(name) || !values.all? { |value| constant_receiver_form?(value) } ||
+            parameter_named?(params, name)
+        end
+        forms.empty? ? NO_FORMS : forms
+      end
+
+      # Fills `forms` (`{ name => written values }`) and `tainted` from `node` and everything under it, a nested `def`
+      # body excepted (its locals are its own). True when the body may write locals the nodes do not show.
+      def collect_local_forms(node, forms, tainted)
+        return false if node.nil?
+
+        return false if node.is_a?(Prism::DefNode)
+        return true if node.is_a?(Prism::CallNode) && dynamic_local_call?(node, tainted)
+
+        note_local_write(node, forms, tainted)
+        dynamic = false
+        node.rigor_each_child { |child| dynamic = true if collect_local_forms(child, forms, tainted) }
+        dynamic
+      end
 
-        def_node = resolve_self_callee_def(call_node)
-        return NO_ARGUMENT_READS if def_node.nil?
+      def note_local_write(node, forms, tainted)
+        case node
+        when Prism::LocalVariableWriteNode
+          (forms[node.name] ||= []) << node.value
+          tainted << node.value.name if node.value.is_a?(Prism::LocalVariableReadNode)
+        when Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+             Prism::LocalVariableAndWriteNode, Prism::LocalVariableTargetNode
+          (forms[node.name] ||= []) << node
+        end
+      end
+
+      # True for a `binding` / `eval` / ... call on any receiver (`Kernel.binding` included), which can write a local no
+      # node names. A local receiving a dispatching call (`send`, `singleton_class`, ...) is tainted as a side effect.
+      def dynamic_local_call?(node, tainted)
+        return true if DYNAMIC_LOCAL_CALLS.include?(node.name)
+
+        tainted << node.receiver.name if DISPATCHING_CALLS.include?(node.name) &&
+                                         node.receiver.is_a?(Prism::LocalVariableReadNode)
+        false
+      end
+
+      NO_FORMS = {}.freeze
+      private_constant :NO_FORMS
+
+      def parameter_named?(params, name)
+        return false if params.nil?
+
+        all = [params.requireds, params.optionals, params.posts, params.keywords,
+               [params.rest, params.keyword_rest, params.block]]
+        all.flatten.compact.any? { |param| param.respond_to?(:name) && param.name == name }
+      end
+
+      # Issue #2515 — the `[def, 0, owner]` triples of every user instance def named `name`, for a hand-off on a
+      # receiver whose type the callee cannot know. It over-approximates (it favours flooring, ADR-5), as
+      # {#unrecorded_hand_off_callees} unions spellings. A def on a class nothing subclasses is walked under that
+      # class. A def on a module, or on a class a project class names as its superclass, is {FLOOR_ALL}: the real
+      # receiver may be an includer or a subclass whose overrides the walk would not see (ADR-127 WD4, as an inherited
+      # def, {#walked_owner}). A name no user def has (a core or gem method) contributes nothing; a name with more
+      # than {NAMED_HAND_OFF_CAP} defs answers {CAPPED_HAND_OFF}, which floors the handed parameter outright.
+      def named_instance_callees(name)
+        owners = instance_def_owners(name)
+        return NO_CALLEES if owners.empty?
+        return CAPPED_HAND_OFF if owners.size > NAMED_HAND_OFF_CAP
+
+        opaque = subclassing_opaque?
+        UnionCallees.new(owners.filter_map do |class_name, open|
+          found = scope.user_def_for(class_name, name)
+          next if found.nil?
+
+          [found, 0, open || opaque ? FLOOR_ALL : CalleeOwner.new(Type::Combinator.nominal_of(class_name))]
+        end)
+      end
+
+      # A resolution by name, whose candidates are guesses at the receiver: every edge it yields is an
+      # over-approximation ({CalleeMutationChain::Edge#approx}), as is any hand-off with more than one candidate.
+      class UnionCallees < Array; end
+      private_constant :UnionCallees
+
+      # The most defs one name may have for {#named_instance_callees} to walk them; more floors the parameter. A cap
+      # on the name key's fan-out that floors, not a cut of the walk, so ADR-127's rejection of out-degree caps does
+      # not apply: the answer stays a function of the graph node.
+      NAMED_HAND_OFF_CAP = 8
+
+      # The answer for a name above the cap; {#compute_forwarding_edges} turns it into a floor of each handed
+      # parameter.
+      CAPPED_HAND_OFF = [[nil, 0, nil].freeze].freeze
+      private_constant :NAMED_HAND_OFF_CAP, :CAPPED_HAND_OFF
+
+      # The `[class, open]` owners of `name` ({Scope#user_instance_def_owners}). A function of the discovery and the
+      # name alone, so its run-scoped memo is keyed by both; the answer reads no constant and no narrowing, so
+      # {#hand_off_memo_bypassed?} does not bypass it. A hit does not reach the scope, so a dependency recorder is told
+      # of the reads here. Built per name, not as a whole index: a run holds a discovery per file, and a whole-index
+      # build per file cost more than the walks it served.
+      def instance_def_owners(name)
+        return scope.user_instance_def_owners(name) if MemoAudit.suspended?
+
+        table = (Thread.current[INSTANCE_DEF_INDEX_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        by_name = (table[scope.discovery] ||= {})
+        return by_name[name] = scope.user_instance_def_owners(name) unless by_name.key?(name)
+
+        record_instance_def_owner_reads(name, by_name[name]) if Analysis::DependencyRecorder.active?
+        MemoAudit.check("instance def owners", by_name[name], name) { scope.user_instance_def_owners(name) }
+      end
+
+      # {Scope#subclassing_opacity}'s flag, memoised beside the owners per discovery; a recorder is told its keys on
+      # every call, hit or not.
+      def subclassing_opaque?
+        return scope.subclassing_opacity.first if MemoAudit.suspended?
+
+        table = (Thread.current[INSTANCE_DEF_INDEX_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        by_name = (table[scope.discovery] ||= {})
+        entry = by_name[OPACITY_ENTRY] ||= scope.subclassing_opacity
+        Analysis::DependencyRecorder.read_keys(entry.last) if Analysis::DependencyRecorder.active?
+        MemoAudit.check("subclassing opacity", entry, OPACITY_ENTRY) { scope.subclassing_opacity }.first
+      end
+
+      OPACITY_ENTRY = :"<subclassing-opacity>"
+      private_constant :OPACITY_ENTRY
+
+      def record_instance_def_owner_reads(name, owners)
+        Analysis::DependencyRecorder.read_name(:defines, name)
+        owners.map(&:first).each { |owner| Analysis::DependencyRecorder.read_last_segment(:subclass_of, owner) }
+      end
+
+      INSTANCE_DEF_INDEX_KEY = RunScopedSlots.register(:rigor_callee_instance_def_index)
+      private_constant :INSTANCE_DEF_INDEX_KEY
+
+      def constant_node?(node) = node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+
+      # `census` (a `callee_*_mutated_parameters` name) of `def_node`, read through `owner`, the {CalleeOwner} the
+      # callee's hand-offs resolve in, or this evaluator when the callee is a self-call's.
+      def census_of(owner, census, def_node)
+        return floor_all_census(census, def_node) if owner == FLOOR_ALL
+        return floor_every_census(census) if owner == FLOOR_EVERY
 
-        mutated = callee_content_mutated_parameters(def_node)
+        (owner.nil? ? self : owner_evaluator(owner)).__send__(census, def_node)
+      end
+
+      # The {FLOOR_EVERY} answer: every positional and keyword argument mutated, no hand-offs.
+      def floor_every_census(census)
+        BudgetTrace.hit(BudgetTrace::CALLEE_CHAIN_CAP)
+        census == :forwarding_edges ? NO_FORWARDS : EVERY_ARGUMENT
+      end
+
+      # The {FLOOR_ALL} answer: every content parameter mutated, and (issue #2595) a named rest or keyword rest at
+      # {ANY_SLOT} / {ANY_KEYWORD} ({#forwarding_slots}), no hand-offs.
+      def floor_all_census(census, def_node)
+        BudgetTrace.hit(BudgetTrace::CALLEE_CHAIN_CAP)
+        census == :forwarding_edges ? NO_FORWARDS : forwarding_slots(def_node)
+      end
+
+      # The local-variable reads `call_node` passes to the parameters of `mutated`, a `{ name => slot }` census, the
+      # first `offset` arguments not being the callee's (the `:name` of a `send` hand-off, {#resolve_self_callees}).
+      def arguments_for_slots(call_node, mutated, offset)
         return NO_ARGUMENT_READS if mutated.empty?
 
         argument_nodes = call_node.arguments.arguments
-        mutated.values.uniq.filter_map do |slot|
-          argument = slot.is_a?(Symbol) ? keyword_argument(argument_nodes, slot) : argument_nodes[slot]
+        values = mutated.values.uniq
+        reads = values.filter_map do |slot|
+          next if slot == ANY_SLOT || slot == ANY_KEYWORD || (slot.is_a?(Integer) && (slot + offset).negative?)
+
+          argument = slot.is_a?(Symbol) ? keyword_argument(argument_nodes, slot) : argument_nodes[slot + offset]
           argument = argument.value if argument.is_a?(Prism::ImplicitNode)
           argument if argument.is_a?(Prism::LocalVariableReadNode)
         end
+        reads += rest_arguments(argument_nodes, offset) if values.include?(ANY_SLOT)
+        reads += keyword_rest_arguments(argument_nodes) if values.include?(ANY_KEYWORD)
+        reads.uniq
+      end
+
+      # Every local read passed positionally from `offset` on: what a callee that hands its rest parameter to `super`
+      # may mutate ({#super_forwarded_parameters}).
+      def rest_arguments(argument_nodes, offset)
+        argument_nodes.drop([offset, 0].max).grep(Prism::LocalVariableReadNode)
+      end
+
+      # Every local read passed as a keyword value: what a callee that hands its keyword rest parameter to `super` may
+      # mutate ({#super_forwarded_parameters}).
+      def keyword_rest_arguments(argument_nodes)
+        hash = argument_nodes.last
+        return NO_ARGUMENT_READS unless hash.is_a?(Prism::KeywordHashNode)
+
+        hash.elements.filter_map do |pair|
+          value = pair.value if pair.is_a?(Prism::AssocNode)
+          value = value.value if value.is_a?(Prism::ImplicitNode)
+          value if value.is_a?(Prism::LocalVariableReadNode)
+        end
       end
 
+      # The slot {#super_forwarded_parameters} gives a keyword rest parameter: every keyword value of the call.
+      ANY_KEYWORD = :__any_keyword__
+      private_constant :ANY_KEYWORD
+
       # The value `argument_nodes` pass for the keyword `name` (`poke(acc: a)`), or nil.
       def keyword_argument(argument_nodes, name)
         hash = argument_nodes.last
@@ -585,16 +1263,37 @@ module Rigor
       # evaluator's statement and write-back passes ({#with_repeated_or_write_marks}), type every run of a repeating
       # body from one entry scope, so its slot's gradual type may be what an EARLIER run stored rather than an
       # absence of evidence.
+      #
+      # On a receiver that is itself untracked (a `Dynamic` / `Top` constituent, the #544 test the narrowing
+      # record takes: a parameter, an unbound ivar), the slot may hold what an earlier call stored, so the reading
+      # keeps the rvalue only as far as its class is known ({#untracked_memo_value}, #2292): read as the fresh
+      # literal, `(h[k] ||= {})[:name].upcase` reported a call on `nil` and `(h[k] ||= 1).upcase` one on `1`. A
+      # tracked receiver keeps the literal, so a block fold over a captured `pool = {}`, whose in-place widening
+      # reads `Hash[Dynamic[top], Dynamic[top]]`, still answers `find { |s| (pool[s] ||= s) == "b" }` as `"b"`.
       def index_compound_write_value(node)
         return index_write_stored_type(node, scope) unless node.is_a?(Prism::IndexOrWriteNode)
 
         current = index_read_type(node, scope)
         rhs = scope.type_of(node.value, tracer: tracer)
-        return rhs if memoizing_index_read?(node, current, rhs)
+        if memoizing_index_read?(node, current, rhs)
+          return rhs if tracked_memo_receiver?(node.receiver)
+
+          memo = untracked_memo_value(rhs)
+          return memo if memo
+        end
 
         index_write_stored_type(node, scope, current: current, rhs: rhs)
       end
 
+      # The value of `recv.each_with_object(memo) { |x, acc| … }` given `call_type`, the call's dispatched type
+      # (issue #2411): the memo as the block's content mutations of `acc` leave it ({#each_with_object_return}).
+      # `ExpressionTyper` reads it for every call, so a value position — a method's tail, which
+      # {DefReturnTyper} types through `Scope#type_of` — answers what a statement does; read off the dispatch
+      # alone, `def m = xs.each_with_object({}) { |x, h| h[x] = 1 }` returned the memo argument's `{}`.
+      def each_with_object_value(call_node, call_type)
+        each_with_object_return(call_node, call_type)
+      end
+
       private
 
       attr_reader :scope, :tracer
@@ -626,11 +1325,11 @@ module Rigor
       end
 
       # `name = rvalue` evaluates the rvalue under the entry scope (so earlier assignments in a chained `a = b = expr`
-      # propagate left-to-right) and binds `name` to the result type. Compound assignment forms (`+=` etc.) are deferred
-      # to a follow-up; for now they degrade to "type the rhs, do not rebind" via the default branch in {#evaluate}.
+      # propagate left-to-right) and binds `name` to the result type.
       def eval_local_write(node)
         rhs_type, post_rhs = sub_eval(node.value, scope)
         bound = bind_local_write(node, rhs_type, post_rhs)
+        bound = bound.with_construction_fact(node.name, :synthesised) if synthesised_write?(node, rhs_type)
         # Issue #667 — `m = AppConfig::MODE` makes `m` a copy of a constant the reader's file does not
         # declare, so `m == :production` folding to `true` is the project's configuration and not a logic
         # error the author can see. Stamped LAST, across every binding path above: an RHS can be both an
@@ -641,6 +1340,53 @@ module Rigor
         [rhs_type, bound.with_published_constant_mark(:local, node.name)]
       end
 
+      # Issue #2555 L3 — whether the object a local write binds is one the engine built itself, so the binding
+      # carries the `:synthesised` construction fact ({Scope#construction_fact?}): a collection literal (`[...]`,
+      # `{...}`), or a constructor call on the core class (`Array.new(n, 0)`, `Hash.new(0)`, `Set.new(xs)`,
+      # `Set[1]`) whose value is a carrier of that class. Nothing else is stamped: not a copy of another binding
+      # (`b = a`), a call whose return a signature declares, a parameter, or an instance variable.
+      # The fact is withheld from a local that may escape anywhere in the body ({ConstructionEscape}): a store through
+      # another holder of the object is one no seam sees, and the fact would leave the carrier without the floor that
+      # covered it.
+      def synthesised_write?(node, rhs_type)
+        synthesised_construction?(node.value, rhs_type) &&
+          !ConstructionEscape.escaped?(scope.match_frame&.body, node.name, constructed_carrier_class(rhs_type), scope)
+      end
+
+      def synthesised_construction?(value_node, rhs_type)
+        case value_node
+        when Prism::ArrayNode, Prism::HashNode then true
+        when Prism::CallNode then core_constructor_call?(value_node, rhs_type)
+        else false
+        end
+      end
+
+      CORE_CONSTRUCTOR_NAMES = %i[new []].to_set.freeze
+      private_constant :CORE_CONSTRUCTOR_NAMES
+
+      # The constant receiver must resolve to the core class itself (a project's own `Admin::Set` does not), and the
+      # value must be a carrier of that class.
+      def core_constructor_call?(call, rhs_type)
+        receiver = call.receiver
+        return false unless CORE_CONSTRUCTOR_NAMES.include?(call.name)
+        return false unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+
+        class_name = constructed_carrier_class(rhs_type)
+        return false if class_name.nil?
+
+        receiver_type = scope.type_of(receiver, tracer: tracer)
+        receiver_type.is_a?(Type::Singleton) && receiver_type.class_name == class_name
+      end
+
+      def constructed_carrier_class(type)
+        case type
+        when Type::Tuple then "Array"
+        when Type::HashShape then "Hash"
+        when Type::Nominal then type.class_name if %w[Array Hash Set].include?(type.class_name)
+        when Type::Constant then "Set" if type.value.is_a?(::Set)
+        end
+      end
+
       # The binding half of {#eval_local_write}: the three mutually exclusive provenance paths a local write
       # can take, unchanged from when they were inline.
       def bind_local_write(node, rhs_type, post_rhs)
@@ -740,8 +1486,7 @@ module Rigor
       # Slice 7 phase 1 — instance/class/global variable writes. Each handler evaluates the rvalue under the entry scope
       # and binds the named variable into the post-scope's per-kind binding map. The expression value is the rvalue
       # type, matching Ruby's semantics. Bindings are method-local: a fresh scope is built at every `def` entry through
-      # `build_method_entry_scope`, so writes do not leak across method boundaries until cross-method ivar/cvar tracking
-      # lands.
+      # `build_method_entry_scope`; cross-method ivar and cvar state enters it through the class-level seeds.
       def eval_ivar_write(node)
         rhs_type, post_rhs = sub_eval(node.value, scope)
         # Issue #1446 — a write ends a class guard's narrowing of the variable, as it does a global's.
@@ -980,8 +1725,7 @@ module Rigor
       #    narrowing keyed on `(receiver_kind, receiver_name,
       #    literal_key)` when both receiver and key are stable
       #    (see {Inference::IndexedNarrowing}). Unstable shapes
-      #    fall through to "no scope effect", matching the old
-      #    `Prism::IndexOrWriteNode` default-branch behaviour.
+      #    record no narrowing.
       #
       # The expression value is the result type, matching Ruby's semantics: `(x = params[:f] ||= []); x` observes the
       # post-`||=` value, not the rvalue alone.
@@ -1029,6 +1773,29 @@ module Rigor
         erased || stored
       end
 
+      # The memoizing value on an untracked receiver, or nil when it keeps the stored `Dynamic[top] | v`. A `{}` /
+      # `[]` rvalue (a shape, a tuple, a bare `Hash` / `Array`) erases to `Hash[untyped, untyped]` /
+      # `Array[untyped]`, since the table is not empty after the first store. A construction (a nominal,
+      # parameterised or not, or a `Data` / `Struct` instance, possibly with a `nil` / `false` arm) is kept as the
+      # #1155 reading has it. Anything else carries literal precision (`1`, `:a`, an integer range) and yields nil.
+      def untracked_memo_value(rhs)
+        erased = erase_memo_literal(rhs)
+        return erased if erased
+
+        truthy = Narrowing.narrow_truthy(rhs)
+        members = truthy.is_a?(Type::Union) ? truthy.members : [truthy]
+        rhs if members.all? { |member| MEMO_CONSTRUCTIONS.any? { |klass| member.is_a?(klass) } }
+      end
+
+      MEMO_CONSTRUCTIONS = [Type::Nominal, Type::DataInstance, Type::StructInstance, Type::Dynamic, Type::Top].freeze
+      private_constant :MEMO_CONSTRUCTIONS
+
+      def erase_memo_literal(type)
+        return erase_memo_container(type) unless type.is_a?(Type::Nominal)
+
+        erase_memo_container(type) if type.type_args.empty? && %w[Hash Array].include?(type.class_name)
+      end
+
       def erase_memo_container(type)
         any = Type::Combinator.untyped
         case type
@@ -1113,6 +1880,28 @@ module Rigor
         end
       end
 
+      # Whether a memoizing `||=` on `receiver` reads as the fresh rvalue ({#index_compound_write_value}): the
+      # receiver's type passes the #544 test, and the receiver is a local the current body binds, captured into a
+      # block or not, and no parameter of the enclosing method names ({MatchRebinding::Frame#body_local?}), or
+      # an object fresh at every run (`Hash.new`, {RepeatedOrWrites.fresh_object?}) (issue
+      # #2354). An ivar, cvar or global read, a parameter, or any other expression (a call result, a
+      # parenthesised `||=`) is a table whose gradual slot another call, or an earlier run of this one, may have
+      # filled — an ivar seeded `{}` in `initialize`, a parameter declared `Hash[Symbol, untyped]` — so it widens
+      # through {#untracked_memo_value} like an untracked receiver. Without a frame (no method, class or file
+      # body stamped one) a local receiver is treated as body-bound, as before #2354.
+      def tracked_memo_receiver?(receiver)
+        return false unless body_bound_memo_receiver?(receiver)
+
+        IndexedNarrowing.fully_tracked_receiver_type?(scope.type_of(receiver, tracer: tracer))
+      end
+
+      def body_bound_memo_receiver?(receiver)
+        return RepeatedOrWrites.fresh_object?(receiver) unless receiver.is_a?(Prism::LocalVariableReadNode)
+
+        frame = scope.match_frame
+        frame.nil? || frame.body_local?(receiver.name)
+      end
+
       # True when {#index_compound_write_value} reads the `||=` `node` as the memoization idiom's rvalue: the slot
       # reads wholly gradual, the rvalue can store something truthy, and no block-return pass marked the site.
       def memoizing_index_read?(node, current, rhs)
@@ -1160,17 +1949,46 @@ module Rigor
       # Both mutator-receiver widenings, against one typing of the call's arguments: the bindings the
       # receiver NAMES ({MutationWidening.widen_after_call}) and, when it names none because the
       # receiver is an element read into a local, that element's pin inside its container
-      # ({ElementReadWidening.widen_element_read}, issue #643).
+      # ({ElementReadWidening.widen_element_read}, issue #643) — and, issue #2499, the String a stdlib
+      # out-buffer call fills ({OutBufferMutation}), which names no receiver of the call at all.
       def widen_mutated_receivers(call_node, current_scope)
         arg_types = mutator_arg_types(call_node, current_scope)
         widened = MutationWidening.widen_after_call(call_node: call_node, current_scope: current_scope,
-                                                    arg_types: arg_types)
-        ElementReadWidening.widen_element_read(call_node: call_node, current_scope: widened, arg_types: arg_types)
+                                                    arg_types: arg_types,
+                                                    rewritten_element: rewritten_element(call_node, current_scope))
+        widened = ElementReadWidening.widen_element_read(call_node: call_node, current_scope: widened,
+                                                         arg_types: arg_types)
+        # Issue #2499 — a stdlib call that fills a String argument (`io.read(n, buf)`, `StringIO.new(s)`).
+        OutBufferMutation.floor(call_node, widened)
+      end
+
+      # Issue #2427 — the element an element rewriter (`map!`, `collect!`, `flatten!`) leaves in its receiver, read
+      # off what the non-bang counterpart answers for the same receiver, block and arguments
+      # ({RewriteMutation::TYPED_COUNTERPARTS}): `a.map!(&:to_i)` stores what `a.map(&:to_i)` returns. `nil` when the
+      # call is no such rewriter, or the counterpart has no single element; the widening then takes
+      # {RewriteMutation}'s gradual arm.
+      #
+      # `nil` too when the receiver may name more than one binding (`(flag ? a : b).map!(&:to_i)`): Ruby rewrites
+      # only the one the branch selects, and typing every candidate gave the other one an element it never holds.
+      #
+      # The block and receiver gates only save typing a counterpart nothing consumes: with no block `map` answers an
+      # Enumerator, which has no element to read, and {RewriteMutation.typed} answers nothing for a receiver the
+      # widening does not rewrite.
+      def rewritten_element(call_node, current_scope)
+        counterpart = RewriteMutation::TYPED_COUNTERPARTS[call_node.name]
+        return nil if counterpart.nil?
+        return nil if counterpart != :flatten && call_node.block.nil? # cost guard
+        return nil unless MutationWidening.joinable_receiver?(call_node.receiver, current_scope) # cost guard
+        return nil unless ReceiverAlias.mutated_reads(call_node.receiver).size == 1
+
+        RewriteMutation.counterpart_element(operand_scope.type_of(call_node.copy(name: counterpart)))
       end
 
       # `tr!` / `tr_s!` are typed too: whether they can empty a `non-empty-string` turns on their replacement argument.
       def mutator_arg_types(call_node, current_scope)
-        unless ContentJoin::CONTENT_ADDERS.include?(call_node.name) || StringMutation::TRANSLATORS.include?(call_node.name)
+        name = call_node.name
+        unless ContentJoin::CONTENT_ADDERS.include?(name) || StringMutation::TRANSLATORS.include?(name) ||
+               SetMutation::CONTENT_ADDERS.include?(name)
           return MutationWidening::NO_ARG_TYPES
         end
         unless MutationWidening.joinable_receiver?(call_node.receiver, current_scope) ||
@@ -1440,7 +2258,7 @@ module Rigor
         sub_eval(node.statements, scope)
       end
 
-      # `case pred; when ...; when ...; else; end` and the pattern- matching variant. The predicate's post-scope is
+      # `case pred; when ...; when ...; else; end` and the pattern-matching variant. The predicate's post-scope is
       # shared with every branch (including the else); branches are evaluated independently and merged with
       # nil-injection so half-bound names degrade to `T | nil`.
       def eval_case(node)
@@ -1646,6 +2464,11 @@ module Rigor
           InterveningIvarReset.may_write?(condition, name, before, run_lambdas: true)
         when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode
           false
+        when Prism::GlobalVariableReadNode
+          # Issue #2314 — the question the statement walk asks past a call ({#forget_reached_globals}).
+          body = when_lambda_body(condition)
+          GlobalWriterReach.may_write?(condition, name, before) ||
+            (!body.nil? && GlobalWriterReach.may_write?(body, name, before))
         else
           body = when_lambda_body(condition)
           GuardRebinding.may_rebind?(condition, before) || (!body.nil? && GuardRebinding.may_rebind?(body, before))
@@ -3068,7 +3891,9 @@ module Rigor
         types = [coll_type]
         name = for_collection_variable(node)
         types << CapturedLocals.bound_type(continuation, name) if name
-        deep = DeepErasure.element_mutation?(node.statements, DeepErasure.parameter_names(node.index))
+        deep = DeepErasure.element_mutation?(node.statements, DeepErasure.parameter_names(node.index)) do
+          DeepErasure.holds_set?(coll_type)
+        end
         Type::Combinator.union(*types.compact.map { |type| shape_erased_collection(type, deep: deep) })
       end
 
@@ -3133,11 +3958,11 @@ module Rigor
         forget_guard_if_rebinds(body_entry, node.statements)
       end
 
-      # `for x in coll` is semantically `coll.each { |x| ... }`. We ask the method dispatcher for `coll.each`'s expected
-      # block parameter types — that path consults RBS and the iterator dispatch table, which is more precise than the
-      # structural `collection_element_type` fallback (it knows, e.g., that `Hash[K, V]#each` yields `[K, V]` even when
+      # `for x in coll` is semantically `coll.each { |x| ... }`. The structural `collection_element_type` answers first;
+      # only when it is untyped do we ask the method dispatcher for `coll.each`'s expected block parameter types, which
+      # consult RBS and the iterator dispatch table (they know, e.g., that `Hash[K, V]#each` yields `[K, V]` even when
       # the receiver is not a literal Hash carrier in our local lattice). When the dispatcher returns nothing (no
-      # signature, unknown receiver) we fall back to the structural extractor.
+      # signature, unknown receiver) the structural answer stands.
       def for_iteration_element_type(coll_type)
         structural = collection_element_type(coll_type)
         return structural unless structural.equal?(Type::Combinator.untyped)
@@ -3199,7 +4024,7 @@ module Rigor
 
       # Extracts the per-iteration element type from a collection carrier. `Tuple[T1..Tn]` yields the union of its
       # elements; `Nominal[Array, [T]]` and `Nominal[Range, [T]]` yield `T`; `Nominal[Hash, [K, V]]` yields `Tuple[K,
-      # V]` (Hash#each yields `[key, value]` pairs); `IntegerRange` yields `Integer`; `Constant<Range>` reads the
+      # V]` (Hash#each yields `[key, value]` pairs); `IntegerRange` yields `Integer`; a `Range` constant reads the
       # literal range's element class. Anything else falls back to `untyped`.
       def collection_element_type(type)
         case type
@@ -3500,8 +4325,9 @@ module Rigor
 
       # `class << expr; body; end`. When `expr` is `self`, the body defines class methods on the immediate enclosing
       # class — the innermost frame flips to `singleton: true` so a nested `def foo` resolves through `singleton_method`
-      # rather than `instance_method`. For non-`self` expressions we cannot statically resolve the receiver, so we keep
-      # the existing context and accept that nested defs degrade to the `Dynamic[Top]` default.
+      # rather than `instance_method`. For an expression that is neither `self` nor a constant we cannot statically
+      # resolve the receiver, so we keep the existing context and accept that nested defs degrade to the `Dynamic[Top]`
+      # default.
       # Issue #652 — the body INHERITS this evaluator's chain. Ruby pushes the singleton class onto
       # `Module.nesting` and leaves the enclosing entries beneath it, so `class << Other` written inside
       # `module Admin` reads `Admin::Y`: the enclosing rung is live, and only the singleton rung itself
@@ -3567,11 +4393,9 @@ module Rigor
         invoked = call_operand_scope(node, walk, scope)
         invoked = forget_operand_specials(node, invoked)
         operand_types = walk.types(tracer)
+        # The `each_with_object` memo widening (ADR-56 slice C, B3) is part of the call's type, applied by
+        # `ExpressionTyper#call_type_for` ({#each_with_object_value}).
         call_type = OperandWalk.type_of(scope, node, tracer, operand_types)
-        # ADR-56 slice C (B3) — `each_with_object(memo) { |x, acc| acc << … }` returns the memo; the engine otherwise
-        # types the call `Dynamic[top]`. Compute the joined memo type from the block's content mutations of the memo
-        # block-param and adopt it as the call's return type.
-        call_type = each_with_object_return(node, call_type)
         [call_type, invoke_from(node, invoked, call_type, operand_types)]
       end
 
@@ -3760,8 +4584,7 @@ module Rigor
         # B2.2 — intervening method call ivar invalidation. An implicit-self / self-receiver call could mutate any ivar
         # of the enclosing class (we cannot prove purity without an effect system). Reset each ivar whose current local
         # binding has narrowed below the class-ivar seed back to the seed itself, so a subsequent `if @flag` predicate
-        # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts). See
-        # [`docs/CURRENT_WORK.md`](../../../docs/CURRENT_WORK.md) § "Flow-folding" — G2 intervening-call case.
+        # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts).
         post_scope = invalidate_ivars_for_intervening_call(node, post_scope) if statement_call
         # Issue #1889 — `instance_variable_set` on `self` writes an ivar no write node shows. It runs after the reset
         # above, which would join a literal-name write back into the class seed.
@@ -3795,9 +4618,32 @@ module Rigor
                          post_scope.forget_guard_narrowings
                        end
         end
+        post_scope = forget_reached_globals(node, post_scope)
         forget_rescued_status(LastStatus.after(node, post_scope, scope), node)
       end
 
+      def guard_narrowed_global?(scope, name)
+        scope.guard_narrowed? && scope.guard_records.key?([:global, name])
+      end
+
+      # Issue #2314 — `post_scope` with each global a project method may write rebound to `Dynamic[top]` when the
+      # statement call `node` may reach that method ({GlobalWriterReach.may_write?}): `$g = nil; reset!; $g + 1`,
+      # with `reset!` assigning `$g`, is `2` in Ruby. A global no reachable method writes keeps its binding. A
+      # `case` whose `when` test may rebind a global subject reads it the same way ({#when_test_rebinds_subject?}).
+      # A global a guard narrowed where the operands started keeps the union issue #1429's restore reads instead
+      # (`return unless $sep; puts(reset_sep); $sep.length` reads `$sep` as the union of its seed and `","`).
+      def forget_reached_globals(node, post_scope)
+        names = GlobalWriterReach.candidates(post_scope)
+        return post_scope if names.empty?
+
+        names.reduce(post_scope) do |acc, name|
+          next acc if guard_narrowed_global?(operand_scope, name)
+          next acc unless GlobalWriterReach.may_write?(node, name, operand_scope)
+
+          acc.with_global(name, Type::Combinator.untyped)
+        end
+      end
+
       # True when the call may rebind this frame's match globals: it is match-capable itself ({#match_capable_call?}),
       # its own block may run a match ({MatchRebinding.block_may_match?} — issue #1358: the block runs in this frame,
       # so `items.each { |i| i =~ re }` rebinds the enclosing method's `$~`, while a match inside a called Ruby method
@@ -3917,7 +4763,8 @@ module Rigor
 
       # Returns a scope with each ivar's narrowed local binding widened back to its class-ivar seed value when the call
       # is one that could plausibly mutate ivars on the enclosing class (implicit-self or explicit `self.foo`).
-      # External- receiver calls (`obj.method`) cannot reach the caller's ivars; they pass through unchanged.
+      # External-receiver calls (`obj.method`) cannot reach the caller's ivars; they pass through unchanged, apart from
+      # the literal-block case below.
       # Issue #1596 — where the call is proven to write only some ivars ({#self_call_ivar_writes}), only those widen.
       #
       # Issue #1402 — a proc's call (`blk.call`) is a candidate too, and so is a call on another receiver whose literal
@@ -3925,11 +4772,19 @@ module Rigor
       # calls do, marking a binding whose narrowing had ruled `nil` out, since the code they run is far more often
       # code that leaves the variable alone. A `yield` or proc call in the call's receiver or arguments
       # (`@items << yield`, `puts(yield)`) widens every narrowed ivar ({InterveningIvarReset.after_operands}).
+      #
+      # Issue #2039 — an implicit-self or `self.` call marks on the same rule only when its write set is unproven
+      # and its callee's body shows no possibly-nil write of the ivar (`mark: :unproven`, {DirectIvarWrites}):
+      # `v2?`, an `attr_reader` call or `respond_to?(:x)` forgets the narrowing without making the ivar newly
+      # nil-reportable, while a callee that assigns it where the program shows (`clear_tag`) widens unmarked.
       def invalidate_ivars_for_intervening_call(call_node, current_scope)
         widened =
           if intervening_call_candidate?(call_node)
-            mark = !InterveningIvarReset.self_call?(call_node)
-            InterveningIvarReset.widen(current_scope, mark: mark) { self_call_ivar_writes(call_node) }
+            mark = InterveningIvarReset.self_call?(call_node) ? :unproven : true
+            direct_writes = -> { DirectIvarWrites.of(call_node, operand_scope) }
+            InterveningIvarReset.widen(current_scope, mark: mark, direct_writes: direct_writes) do
+              self_call_ivar_writes(call_node)
+            end
           else
             InterveningIvarReset.after_block(call_node, current_scope)
           end
@@ -4119,7 +4974,7 @@ module Rigor
       # `resolve_call_method`); plugins recognising their own synthetic call shapes (e.g. `T.assert_type!`) have no
       # method_def and the parameter facts silently skip — the plugin's own diagnostics_for_file path covers those
       # cases. The full plugin-side parameter-targeting story (PHPStan-style Type-Specifying Extensions on
-      # plugin-recognised calls) lives behind a follow-up slice that introduces `:local` / `:argument_at` target kinds.
+      # plugin-recognised calls) lives behind a follow-up slice that introduces an `:argument_at` target kind.
       def apply_plugin_assertions(call_node, current_scope)
         registry = current_scope.environment&.plugin_registry
         return current_scope if registry.nil? || registry.empty?
@@ -4274,7 +5129,7 @@ module Rigor
       def lookup_post_return_arg(call_node, method_def, target_name)
         # Plugin-source contributions arrive without an authoritative method_def (the plugin recognised the call shape
         # directly). Parameter-targeting falls back to "no narrow" in that case — the wider plugin-side parameter
-        # mapping (`:local` / `:argument_at`) is a follow-up slice.
+        # mapping (`:argument_at`) is a follow-up slice.
         return nil if method_def.nil?
 
         arguments = call_node.arguments&.arguments || []
@@ -4471,57 +5326,553 @@ module Rigor
           acc = floor_callee_escaped_args_for_call(receiver, acc)
           receiver = receiver.receiver
         end
-        acc
+        # Issue #2397 — and every self-call in the call's own non-escaping block.
+        floor_block_callee_captures(node, acc)
       end
 
       # Runs for every call of every body it walks, and nearly every call reports no argument, so that case returns
       # before `reduce`: `Enumerable#inject` allocates its iteration state even over an empty array.
-      def floor_callee_escaped_args_for_call(node, base_scope)
-        arguments = content_mutated_arguments(node)
-        return base_scope if arguments.empty?
-
-        arguments.reduce(base_scope) do |acc, argument|
-          next acc unless acc.locals.key?(argument.name)
+      #
+      # Issue #2296 — two more channels follow the bare-carrier floor, each keeping the argument's element type
+      # ({UnknownStoreWidening.callee_block_floor} / {UnknownStoreWidening.callee_set_floor}): a parameter the callee
+      # mutates inside a block (`2.times { |i| acc[i] = v }`), and a Set argument the callee grows through a Set-only
+      # adder (`s.add(x)`, `s.merge(xs)`), which the bare census leaves out because `Hash#merge` does not mutate.
+      #
+      # Issue #2297 — a call may resolve to more than one def ({#resolve_self_callees}); each channel floors through
+      # every one of them before the next channel runs, so a bare-census mutation in any of them still goes first.
+      #
+      # `climbing`, when given, keeps only the argument reads deeper than it: those that climb out of a block that
+      # many levels in ({#floor_block_callee_captures}).
+      def floor_callee_escaped_args_for_call(node, base_scope, climbing: nil)
+        callees = argument_mutating_callees(node)
+        return base_scope if callees.empty?
+
+        acc = floor_callee_channel(node, callees, :callee_content_mutated_parameters, base_scope, climbing) do |type|
+          content_floor_for(type)
+        end
+        acc = floor_splat_arguments(node, callees, acc)
+        # Each closure below is only worth computing when an argument holds something its floor could widen.
+        if floorable_local_argument?(node, acc) { |type| UnknownStoreWidening.callee_floorable?(type) }
+          acc = floor_callee_channel(node, callees, :callee_block_mutated_parameters, acc, climbing) do |type|
+            UnknownStoreWidening.callee_block_floor(type)
+          end
+        end
+        return acc unless floorable_local_argument?(node, acc) { |type| SetMutation.carrier_in?(type) }
 
-          floored = content_floor_for(acc.local(argument.name))
-          floored.nil? ? acc : acc.with_mutated_local(argument.name, floored)
+        callees.each do |def_node, offset, owner|
+          acc = floor_arguments(node, census_of(owner, :callee_set_mutated_parameters, def_node), acc, offset,
+                                climbing) do |type|
+            UnknownStoreWidening.callee_set_floor(type)
+          end
         end
+        acc
       end
 
-      # The `{ name => slot }` parameters whose content the callee mutates, a slot being a positional index or a
-      # keyword symbol: those it mutates itself ({#own_content_parameters}) and, issue #2104, those it passes on to a
-      # self-call whose callee mutates them, through any number of such hand-offs ({CalleeMutationChain}). Each leaves
-      # the caller's argument binding stale after the call, so each floors it. Memoised per def node (the closure is
-      # otherwise recomputed at every call site), and across evaluators by {#resolved_census}.
-      def callee_content_mutated_parameters(def_node)
-        cache = (@callee_mutated_param_cache ||= {}.compare_by_identity)
-        cache[def_node] ||= resolved_census(:close, def_node) do
-          CalleeMutationChain.close(def_node, own: method(:own_content_parameters), edges: method(:forwarding_edges))
+      # Every callee's `census` channel floors the arguments it names with the block's floor, made gradual when the
+      # floor is an over-approximation ({#callee_gradual_floor}). Only a String result is split; the Set channel and
+      # the container elements a floor widens (#2647) are not.
+      def floor_callee_channel(node, callees, census, base_scope, climbing)
+        several = callees.size > 1
+        acc = base_scope
+        callees.each do |def_node, offset, owner|
+          acc = floor_arguments(node, census_of(owner, census, def_node), acc, offset, climbing) do |type|
+            callee_gradual_floor(yield(type), def_node, owner, several)
+          end
         end
+        acc
       end
 
-      # Issue #2104 — the per-thread memo of a census that also resolves self-calls ({#resolve_self_callee_def}), so it
-      # reads, besides `def_node`'s AST, the class self-calls resolve in and the discovery index whose def table they
-      # resolve through. Those two key it: the index by identity, as it is immutable (one slot, as a file's analysis
-      # reads one index; a scope indexed for another file replaces it), the class by name. A run builds hundreds of
-      # thousands of evaluators, and a per-evaluator memo alone recomputed each closure and each def's edges about
-      # thirty times over (#2295's cost on the release gate).
+      # Issue #2397 — the continuation of a `:non_escaping` block whose body hands a captured outer local to a
+      # self-call whose callee mutates it: `acc = [7, 9]; [1].each { poke(acc) }`. The body's own statement floor
+      # rebinds `acc` only inside the block, and neither write-back reads it there (the rebind write-back follows
+      # local writes, the content join follows mutator calls), so the continuation kept the literal and
+      # `acc[0].upcase` reported on correct code.
       #
-      # While a dependency recorder is active the memo is bypassed: a resolution records an ADR-46 read in the file
-      # and in each capture window open at the time, and a hit would leave that read out of them.
-      def resolved_census(kind, def_node)
-        return yield if Analysis::DependencyRecorder.active?
+      # Every call the statement `node` makes before it returns is visited: `node` itself and the calls in its
+      # receiver chain and arguments (`[1].each { poke(acc) }.size`, `foo([1].each { poke(acc) })`), never inside a
+      # block or lambda of them. For each one with a `:non_escaping` block not run on another object
+      # ({#foreign_self_block?}), each self-call in the block floors as at a statement, by position or keyword, its
+      # arguments limited to reads that climb out of the block: a block parameter or a nested block's parameter
+      # shadowing the outer name is not the outer local. The body walk ({#each_node_in_method_scope}) leaves out a
+      # lambda and the block of a nested `instance_eval` / `define_method` / …, whose self-calls are not ours.
+      #
+      # Two readings are conservative, since the floor only forgets: a block that may run zero times floors, as the
+      # escaping path ({#floor_block_body_callee_escaped_args}) does, and the floor applies after the block's
+      # write-back, so a rebind later in the body (`poke(acc); acc = [1, 2]`) is floored too.
+      def floor_block_callee_captures(node, post_scope)
+        acc = post_scope
+        each_node_outside_nested_scopes(node) do |call|
+          next unless call.is_a?(Prism::CallNode) && call.block.is_a?(Prism::BlockNode) && call.block.body
 
-        discovery = scope.discovery
-        slot = Thread.current[RESOLVED_CENSUS_KEY]
-        slot = Thread.current[RESOLVED_CENSUS_KEY] = [discovery, {}] unless slot&.first.equal?(discovery)
-        by_class = (slot.last[kind] ||= {})
-        class_name = enclosing_class_name_for(scope.self_type)
-        by_def = (by_class[class_name] ||= {}.compare_by_identity)
-        by_def.fetch(def_node) { by_def[def_node] = yield }
+          acc = floor_block_body_callee_captures(call, acc)
+        end
+        acc
       end
 
-      RESOLVED_CENSUS_KEY = :rigor_callee_resolved_census
+      def floor_block_body_callee_captures(call_node, post_scope)
+        return post_scope unless classify_closure_escape(call_node) == :non_escaping
+        return post_scope if foreign_self_block?(call_node)
+
+        acc = post_scope
+        each_node_in_caller_block(call_node.block.body, 0) do |node, depth|
+          acc = floor_callee_escaped_args_for_call(node, acc, climbing: depth)
+        end
+        acc
+      end
+
+      # Yields every call under `node` with the number of blocks and lambdas it sits in, for
+      # {#floor_block_callee_captures}. A lambda is entered, as the escaping path floors one: it may be called in the
+      # block (`l.call`, `-> { ... }.call`). A nested def is not. Nor is the block of a nested call whose self-calls
+      # are provably not the caller's: one run on another object ({#foreign_block_call?}), a `define_method` /
+      # `define_singleton_method` method body, or a `Class.new` / `Module.new` / `Struct.new` / `Data.define` block.
+      # An `instance_eval` / `class_exec` / … on any other receiver (none, `self`, an instance) is entered.
+      def each_node_in_caller_block(node, depth, &)
+        return if node.nil?
+
+        yield node, depth if node.is_a?(Prism::CallNode)
+        skip_block = node.is_a?(Prism::CallNode) && foreign_block_call?(node)
+        node.rigor_each_child do |child|
+          next if child.is_a?(Prism::DefNode)
+
+          if child.is_a?(Prism::BlockNode) || child.is_a?(Prism::LambdaNode)
+            each_node_in_caller_block(child, depth + 1, &) unless skip_block && child.is_a?(Prism::BlockNode)
+          else
+            each_node_in_caller_block(child, depth, &)
+          end
+        end
+      end
+
+      def foreign_block_call?(call_node)
+        return false unless self_rebinding_block_call?(call_node)
+        return true if %i[define_method define_singleton_method].include?(call_node.name)
+        return true unless AnonymousMetaClass.block_form_receiver(call_node).nil?
+
+        foreign_self_block?(call_node)
+      end
+
+      # Issue #2515 — the floor for a `*x` argument whose `x` is a local holding an array (`args = [parser, options];
+      # Opts.add_format(*args)`). The hash travels inside the array, so the caller's `options` is the array's element,
+      # not an argument, and the per-parameter floor never sees it. An element the callee writes is floored at its place
+      # in the array's type and in every local bound to an equal type (the element's source: only the type is known, so
+      # an equal literal in another local is floored too).
+      #
+      # A known tuple whose splat sits at a fixed position (only plain positional arguments before it) binds element
+      # `j` to the callee's slot `index - offset + j` and floors it when that slot is in the channel's census. Any other
+      # case floors every element when the callee writes any positional parameter: an array that is no longer a tuple
+      # (it was mutated), a splat after another splat, an `offset` that swallows the splat. An element that reaches the
+      # callee's rest or post parameter floors when the callee may write it ({#rest_parameter_written?}). A splat of
+      # anything but a local (a call result, an ivar) is not followed.
+      def floor_splat_arguments(node, callees, base_scope)
+        arguments = node.arguments.arguments
+        return base_scope unless arguments.any?(Prism::SplatNode)
+
+        fixed = true
+        arguments.each_with_index.reduce(base_scope) do |acc, (argument, index)|
+          next acc unless argument.is_a?(Prism::SplatNode)
+
+          read = argument.expression
+          at = fixed ? index : nil
+          fixed = false
+          next acc unless read.is_a?(Prism::LocalVariableReadNode) && acc.locals.key?(read.name)
+
+          floor_splat_local(read.name, at, callees, acc)
+        end
+      end
+
+      # Every callee's channels in turn. The callees are a call's own ({#argument_mutating_callees}), never the nil
+      # sentinel {CAPPED_HAND_OFF}, which only a hand-off inside a def answers ({#rest_hand_off_writes?} reads it).
+      def floor_splat_local(name, at, callees, base_scope)
+        channels = splat_channels
+        origin = base_scope.local(name)
+        callees.reduce(base_scope) do |acc, (def_node, offset, owner)|
+          rest = rest_parameter_written?(def_node, owner)
+          channels.reduce(acc) do |inner, (census, floor)|
+            mutated = census_of(owner, census, def_node)
+            writer = ->(count, position) { splat_written_elements(count, position, offset, def_node, mutated, rest) }
+            floor_splat_arrays(name, at, writer, floor, inner, origin)
+          end
+        end
+      end
+
+      # `base_scope` with the elements of the array local `name` the callee writes floored. The local may be a union
+      # (`cond ? [p, o] : [p, q]`, or an array rebound in a block) and may include nil (`args = [...] if cond`): each
+      # array member floors on its own, and a union of arrays, whose position is unknown, takes the any-slot rule. A
+      # local bound to an equal array type (`args2 = args`) is rebuilt too.
+      def floor_splat_arrays(name, at, writer, floor, base_scope, origin)
+        current = base_scope.local(name)
+        members = current.is_a?(Type::Union) ? current.members : [current]
+        arrays = members.count { |member| splat_elements(member) }
+        return base_scope if arrays.zero?
+
+        origins = splat_origin_members(origin, members)
+        acc = base_scope
+        floored = members.each_with_index.map do |member, index|
+          elements = splat_elements(member)
+          next member if elements.nil?
+
+          position = member.is_a?(Type::Tuple) && arrays == 1 ? at : nil
+          written = writer.call(elements.size, position)
+          next member if written.empty?
+
+          source = splat_elements(origins[index]) || elements
+          rebuilt, acc = floor_array_elements(member, elements, [written, source], floor, acc, name)
+          rebuilt
+        end
+        return acc if floored == members
+
+        rebind_array_aliases(name, current, Type::Combinator.union(*floored), acc)
+      end
+
+      # The members of the array local as it was before the channels ran, aligned with `members`, or `members` itself
+      # when a channel merged or dropped some.
+      def splat_origin_members(origin, members)
+        origin_members = splat_parts(origin)
+        origin_members.size == members.size ? origin_members : members
+      end
+
+      # `scope_in` with `name`, and every local bound to the same array type `before`, rebound to `after`.
+      def rebind_array_aliases(name, before, after, scope_in)
+        aliased = scope_in.locals.reduce(scope_in) do |acc, (other, bound)|
+          other != name && bound == before ? acc.with_mutated_local(other, after) : acc
+        end
+        aliased.with_mutated_local(name, after)
+      end
+
+      def splat_channels
+        [[:callee_content_mutated_parameters, method(:content_floor_for)],
+         [:callee_block_mutated_parameters, UnknownStoreWidening.method(:callee_block_floor)],
+         [:callee_set_mutated_parameters, UnknownStoreWidening.method(:callee_set_floor)]]
+      end
+
+      # The element types of `type` when it is an array a splat spreads, or nil: a tuple's, or a nominal `Array[T]`'s.
+      def splat_elements(type)
+        if type.is_a?(Type::Tuple) then type.elements
+        elsif type.is_a?(Type::Nominal) && type.class_name == "Array" && type.type_args.size == 1 then type.type_args
+        end
+      end
+
+      # The indexes of the `count` array elements the callee writes, for a splat at the call's argument `at` (nil: a
+      # position the call does not show, or an array of unknown length). `rest` is true when the callee may write its
+      # rest parameter ({#rest_parameter_written?}).
+      def splat_written_elements(count, at, offset, def_node, mutated, rest)
+        slots = mutated.values
+        return NO_ELEMENTS unless rest || slots.any? { |slot| slot.is_a?(Integer) || slot == ANY_SLOT }
+        return (0...count).to_a if at.nil? || at < offset || slots.include?(ANY_SLOT)
+
+        named = content_parameter_slots(def_node).each_value.grep(Integer).size
+        (0...count).select do |j|
+          slot = at - offset + j
+          slot >= named ? rest : slots.include?(slot)
+        end
+      end
+
+      NO_ELEMENTS = [].freeze
+      private_constant :NO_ELEMENTS
+
+      # `[array, scope]`: the array type `member` with its `written` elements floored by `floor`, and `scope_in` with
+      # every caller local (other than `name`) the floored elements could be floored too. A union element floors member
+      # by member; every element of the array holding a floored type is rebuilt (`[options, options]`, one slot
+      # written); a local is floored (gradually, {#floor_locals_accepted_by}) when a floored part accepts its type.
+      # Locals are matched against the `source` elements, the array as it was before an earlier channel floored it,
+      # so a floored `Hash[untyped, untyped]` element does not match every hash.
+      def floor_array_elements(member, elements, written_and_source, floor, scope_in, name)
+        written, source = written_and_source
+        acc = scope_in
+        pairs = []
+        written.each do |j|
+          splat_parts(source[j]).each { |part| acc = floor_locals_accepted_by(part, name, floor, acc) }
+          splat_parts(elements[j]).each do |part|
+            replacement = floor.call(part)
+            pairs << [part, replacement] unless replacement.nil? || replacement == part
+          end
+        end
+        return [member, acc] if pairs.empty?
+
+        floored = elements.map { |element| replace_splat_parts(element, pairs) }
+        rebuilt = if member.is_a?(Type::Tuple)
+                    Type::Combinator.tuple_of(*floored)
+                  else
+                    Type::Combinator.nominal_of("Array", type_args: floored)
+                  end
+        [rebuilt, acc]
+      end
+
+      def splat_parts(type) = type.is_a?(Type::Union) ? type.members : [type]
+
+      # `element` with the floored parts replaced, gradually ({#gradual_floor}): an element is floored by
+      # over-approximation as often as by a precise slot (a repeated type, an unknown position, a rest read as written),
+      # and one the callee never writes must not start failing against a literal parameter type.
+      def replace_splat_parts(element, pairs)
+        parts = splat_parts(element)
+        replaced = parts.map do |part|
+          replacement = pairs.find { |from, _| from == part }&.last
+          replacement ? gradual_floor(replacement) : part
+        end
+        replaced == parts ? element : Type::Combinator.union(*replaced)
+      end
+
+      # `scope_in` with each carrier local other than `except` whose type `part` accepts (it is a subtype of, or equal
+      # to, the element: `args << options` widens the pushed `{ format: "text" }` to `Hash[Symbol, String]`) floored
+      # with `floor`. Such a local is only a guess at the element's source (the type is all the array records), so its
+      # floor is gradual ({#gradual_floor}): it may forget a fact, never add a finding. A `Dynamic` part matches no
+      # local: it stands for any value and would floor every carrier in scope.
+      def floor_locals_accepted_by(part, except, floor, scope_in)
+        return scope_in if part.is_a?(Type::Dynamic)
+
+        scope_in.locals.reduce(scope_in) do |acc, (other, bound)|
+          next acc if other == except || !UnknownStoreWidening.callee_floorable?(bound)
+          next acc unless Acceptance.accepts(part, bound).yes?
+
+          floored = floor.call(bound)
+          floored.nil? || floored == bound ? acc : acc.with_mutated_local(other, gradual_floor(floored))
+        end
+      end
+
+      # `type` with a bare `String` carrier made gradual (`Dynamic[String]`): a floor to the nominal `String` fails
+      # against a literal parameter type (`("text") -> String`) that the unmutated local satisfied.
+      def gradual_floor(type)
+        return Type::Combinator.union(*type.members.map { |member| gradual_floor(member) }) if type.is_a?(Type::Union)
+
+        string_carrier?(type) ? Type::Combinator.dynamic(type) : type
+      end
+
+      # `floored`, a callee floor (content or block channel) of an argument of a call to `def_node` under `owner`,
+      # made gradual when the floor is an over-approximation ({#over_approximating_callee?}) or the call has several
+      # callees. The one place both channels take the rule.
+      def callee_gradual_floor(floored, def_node, owner, several)
+        # Only a String carrier turns gradual, so the callee is walked only for one (this runs per floored argument).
+        return floored unless string_carrier_in?(floored)
+
+        several || over_approximating_callee?(def_node, owner) ? gradual_floor(floored) : floored
+      end
+
+      def string_carrier_in?(type)
+        type.is_a?(Type::Union) ? type.members.any? { |member| string_carrier?(member) } : string_carrier?(type)
+      end
+
+      # Issue #2515 — true when the floor a call applies to `def_node`'s arguments is an over-approximation, with no
+      # proof that the callee writes the argument it floors: the owner is {FLOOR_ALL} (an inherited def, a
+      # `method_missing`) or {FLOOR_EVERY} (a top-level def that may not be the one called), or the callee hands a
+      # parameter on, through any hop, to one of those, by name or to several candidates. A def read as written that
+      # writes the argument keeps the
+      # precise floor, which is what a later `Integer` parameter or `no_such_method` on the String needs to report.
+      # The walk is bounded by {CalleeMutationChain::MAX_NODES}; past it the answer is true.
+      def over_approximating_callee?(def_node, owner)
+        return true if OVER_APPROXIMATING.include?(owner)
+
+        seen = {}.compare_by_identity
+        queue = [[def_node, owner]]
+        until queue.empty?
+          node, node_owner = queue.shift
+          next if (seen[node] ||= {}).key?(node_owner)
+
+          seen[node][node_owner] = true
+          return true if seen.sum { |_, owners| owners.size } > CalleeMutationChain::MAX_NODES
+
+          census_of(node_owner, :forwarding_edges, node).each do |edge|
+            return true if edge.approx || OVER_APPROXIMATING.include?(edge.owner)
+
+            queue << [edge.callee, edge.owner || node_owner]
+          end
+        end
+        false
+      end
+
+      def string_carrier?(type) = type.is_a?(Type::Nominal) && type.class_name == "String"
+
+      # True when `def_node` has a rest, post or `...` parameter, so a slot no longer names the parameter an element
+      # binds.
+      def variable_arity?(def_node)
+        params = def_node.parameters
+        return false if params.nil?
+
+        !params.rest.nil? || !params.posts.empty? || params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+      end
+
+      # Issue #2515 — true when a callee's rest parameter (`*args`, `*`, `...`) may be written, so an element a splat
+      # binds to it floors: the body reads it anywhere but as a splat argument of a call (`args.first[:k] = 1`), or
+      # hands it on (`b(*args)`) to a call that resolves to a def which writes a positional parameter or has a rest
+      # parameter of its own that it hands on. A rest handed to a call that resolves to no user def hands off nothing,
+      # as for any hand-off. A callee reached through an inherited lookup ({FLOOR_ALL}) reads as written, as its
+      # parameters do.
+      def rest_parameter_written?(def_node, owner)
+        return true if def_node.nil?
+        return false unless variable_arity?(def_node)
+        return true if owner == FLOOR_ALL
+
+        other, calls = def_census(:rest_uses, def_node) { rest_uses(def_node) }
+        return true if other
+
+        evaluator = owner.nil? ? self : owner_evaluator(owner)
+        calls.any? { |call_node, depth| evaluator.__send__(:rest_hand_off_writes?, call_node, def_node, depth) }
+      end
+
+      # True when a call that splats a rest parameter hands it to a def that writes a positional parameter or has a
+      # rest or post parameter of its own, read in this evaluator, the one the call's def runs in. A nil callee is
+      # {CAPPED_HAND_OFF}'s sentinel (a name with too many defs) and reads as written.
+      def rest_hand_off_writes?(call_node, def_node, depth)
+        hand_off_callees(call_node, def_node, depth).any? do |callee, _offset, callee_owner|
+          next true if callee.nil? || variable_arity?(callee)
+
+          census = census_of(callee_owner, :callee_content_mutated_parameters, callee)
+          census.value?(ANY_SLOT) || census.each_value.any?(Integer)
+        end
+      end
+
+      # `[other, calls]` for `def_node`'s rest parameter: `other` is true when it is read except as a splat argument
+      # (`*args`, `*`) of a call, `calls` the calls that splat it ({#rest_parameter_written?}). An AST property.
+      def rest_uses(def_node)
+        params = def_node.parameters
+        name = params.rest.is_a?(Prism::RestParameterNode) ? params.rest.name : nil
+        forwarding = params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+        reads = 0
+        splatted = 0
+        calls = []
+        each_node_in_method_scope(def_node.body, 0) do |node, depth|
+          reads += 1 if name && splat_reads?(node, name, depth)
+          next unless node.is_a?(Prism::CallNode) && node.arguments
+
+          spread = node.arguments.arguments.select { |a| rest_splat?(a, name, forwarding, depth) }
+          next if spread.empty?
+
+          splatted += spread.count { |a| a.is_a?(Prism::SplatNode) && a.expression }
+          calls << [node, depth]
+        end
+        [reads > splatted, calls.freeze].freeze
+      end
+
+      def rest_splat?(argument, name, forwarding, depth)
+        case argument
+        when Prism::ForwardingArgumentsNode then forwarding
+        when Prism::SplatNode
+          argument.expression.nil? ? name.nil? : !name.nil? && splat_reads?(argument.expression, name, depth)
+        else false
+        end
+      end
+
+      def splat_reads?(node, name, depth)
+        node.is_a?(Prism::LocalVariableReadNode) && node.name == name && node.depth == depth
+      end
+
+      # True when a local `node` passes (positionally or as a keyword's value) is bound in `scope` to a type the
+      # block accepts.
+      def floorable_local_argument?(node, scope, &)
+        node.arguments.arguments.any? do |argument|
+          if argument.is_a?(Prism::KeywordHashNode)
+            argument.elements.any? do |pair|
+              pair.is_a?(Prism::AssocNode) && floorable_local?(pair.value, scope, &)
+            end
+          else
+            floorable_local?(argument, scope, &)
+          end
+        end
+      end
+
+      def floorable_local?(node, scope)
+        node = node.value if node.is_a?(Prism::ImplicitNode)
+        node.is_a?(Prism::LocalVariableReadNode) && scope.locals.key?(node.name) && yield(scope.local(node.name))
+      end
+
+      # `base_scope` with each local `node` passes to a parameter of `mutated` rebound to what the block answers for
+      # its binding; a nil answer, or an answer equal to the binding, leaves it.
+      def floor_arguments(node, mutated, base_scope, offset, climbing = nil)
+        arguments = arguments_for_slots(node, mutated, offset)
+        return base_scope if arguments.empty?
+
+        arguments.reduce(base_scope) do |acc, argument|
+          next acc unless acc.locals.key?(argument.name)
+          next acc if climbing && argument.depth <= climbing
+
+          current = acc.local(argument.name)
+          floored = yield(current)
+          floored.nil? || floored == current ? acc : acc.with_mutated_local(argument.name, floored)
+        end
+      end
+
+      # The `{ name => slot }` parameters whose content the callee mutates, a slot being a positional index or a
+      # keyword symbol: those it mutates itself ({#own_content_parameters}) and, issue #2104, those it passes on to a
+      # self-call whose callee mutates them, through any number of such hand-offs ({CalleeMutationChain}). Each leaves
+      # the caller's argument binding stale after the call, so each floors it. Memoised per def node (the closure is
+      # otherwise recomputed at every call site), and across evaluators by {#resolved_census}.
+      def callee_content_mutated_parameters(def_node)
+        cache = (@callee_mutated_param_cache ||= {}.compare_by_identity)
+        cache[def_node] ||= resolved_census(:close, def_node) do
+          CalleeMutationChain.close(def_node, own: hop_census(:own_content_parameters),
+                                              edges: hop_census(:forwarding_edges), **callee_chain_store)
+        end
+      end
+
+      # Issue #2515 — `census` as the `(def, owner)` callback {CalleeMutationChain} reads a hop through: `owner` is the
+      # evaluator a cross-class hand-off resolves in, nil for the evaluator the closure started in.
+      def hop_census(census) = ->(def_node, owner) { census_of(owner, census, def_node) }
+
+      # ADR-127 WD2 — the run's successor store for {CalleeMutationChain} keyed by discovery: `def => owner => name =>
+      # [callee, name, owner, ...]`, a graph fact (the nodes a parameter is handed to), never a walk's conclusion. The
+      # edges do not depend on which census a closure reads, so one store serves all three. The nil owner is stored
+      # under the side and class the closure runs in, the same context {#resolved_census} keys by. Bypassed (nothing
+      # read or written) under {#hand_off_memo_bypassed?}, as the memos it sits beside.
+      def callee_chain_store
+        return NO_CHAIN_STORE if hand_off_memo_bypassed?
+
+        table = (Thread.current[CHAIN_STORE_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        self_type = scope.self_type
+        { store: (table[scope.discovery] ||= {}.compare_by_identity),
+          ctx: [self_type.is_a?(Type::Singleton), enclosing_class_name_for(self_type)] }
+      end
+
+      CHAIN_STORE_KEY = RunScopedSlots.register(:rigor_callee_chain_successors)
+      NO_CHAIN_STORE = {}.freeze
+      private_constant :CHAIN_STORE_KEY, :NO_CHAIN_STORE
+
+      # Issue #2296 — the `{ name => slot }` parameters the callee mutates inside a block in its body
+      # ({#own_block_content_parameters}), closed over hand-offs as {#callee_content_mutated_parameters} is.
+      def callee_block_mutated_parameters(def_node)
+        cache = (@callee_block_param_cache ||= {}.compare_by_identity)
+        cache[def_node] ||= resolved_census(:close_block, def_node) do
+          CalleeMutationChain.close(def_node, own: hop_census(:own_block_content_parameters),
+                                              edges: hop_census(:forwarding_edges), **callee_chain_store)
+        end
+      end
+
+      # Issue #2296 — the `{ name => slot }` parameters the callee grows through a Set-only adder
+      # ({#own_set_content_parameters}), closed over hand-offs the same way.
+      def callee_set_mutated_parameters(def_node)
+        cache = (@callee_set_param_cache ||= {}.compare_by_identity)
+        cache[def_node] ||= resolved_census(:close_set, def_node) do
+          CalleeMutationChain.close(def_node, own: hop_census(:own_set_content_parameters),
+                                              edges: hop_census(:forwarding_edges), **callee_chain_store)
+        end
+      end
+
+      # Issue #2104 — the per-thread memo of a census that also resolves self-calls ({#resolve_self_callees}), so it
+      # reads, besides `def_node`'s AST, the class self-calls resolve in and the discovery index whose def table they
+      # resolve through. Those two key it: the index by identity, as it is immutable (one entry per live index, held
+      # weakly: a table dropped with its index), the class by name. A run builds hundreds of
+      # thousands of evaluators, and a per-evaluator memo alone recomputed each closure and each def's edges about
+      # thirty times over (#2295's cost on the release gate). Issue #2297 — the side self-calls resolve on
+      # ({#resolve_self_callees}) keys it too: a singleton-side table apart from the instance-side one.
+      #
+      # While a dependency recorder is active the memo is bypassed: a resolution records an ADR-46 read in the file
+      # and in each capture window open at the time, and a hit would leave that read out of them. It is bypassed, read
+      # and write, while this scope carries guard narrowings of constants ({#hand_off_memo_bypassed?}, #2524): they
+      # survive `with_self_type` and change what a constant in the def's body types as, so the census is no longer
+      # the def's alone, and the first caller's narrowing must not become every later caller's answer.
+      def resolved_census(kind, def_node, &)
+        return yield if hand_off_memo_bypassed?
+
+        discovery = scope.discovery
+        table = (Thread.current[RESOLVED_CENSUS_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        slot = (table[discovery] ||= [{}, {}])
+        self_type = scope.self_type
+        by_class = (slot[self_type.is_a?(Type::Singleton) ? 1 : 0][kind] ||= {})
+        class_name = enclosing_class_name_for(self_type)
+        by_def = (by_class[class_name] ||= {}.compare_by_identity)
+        return by_def[def_node] = yield unless by_def.key?(def_node)
+
+        MemoAudit.check("resolved census", by_def[def_node], kind, class_name, &)
+      end
+
+      RESOLVED_CENSUS_KEY = RunScopedSlots.register(:rigor_callee_resolved_census)
       private_constant :RESOLVED_CENSUS_KEY
 
       # The parameters `def_node` mutates itself, from either channel: those escape-mutated inside a block (which may
@@ -4530,17 +5881,261 @@ module Rigor
       # ({#def_census}) rather than per evaluator: a chain reads its callees' census from every evaluator that floors a
       # call into it.
       def own_content_parameters(def_node)
-        def_census(:own, def_node) { escaped_content_parameters(def_node).merge(direct_content_parameters(def_node)) }
+        def_census(:own, def_node) do
+          own = escaped_content_parameters(def_node).merge(direct_content_parameters(def_node))
+          written = callee_write_census(def_node).written
+          own = own.merge(written_slots(def_node, written)) unless written.empty?
+          handed = super_forwarded_parameters(def_node)
+          handed.empty? ? own : own.merge(handed)
+        end
+      end
+
+      # Issue #2595 — the parameter writes the content scans above miss: a shape mutator they do not count
+      # (`h.merge!(x)`), a write through an alias (`other = h`, `h.tap { |x| }`, `[h].each { |x| }`, `@x = h`), and
+      # the aliases themselves, which {#forwarded_parameters} follows as hand-offs ({CalleeWriteCensus}). A property
+      # of the def's AST alone, memoised per def node for the thread.
+      def callee_write_census(def_node)
+        def_census(:writes, def_node) do
+          CalleeWriteCensus.scan(def_node.body, census_seeds(def_node),
+                                 tables: CENSUS_TABLES, rebinds: parameter_rebinds(def_node),
+                                 returns: returns_counted?(def_node), anonymous: anonymous_rests?(def_node))
+        end
+      end
+
+      # Issue #2336 — the calls whose block is a method body of the class (`define_method(:go) { poke(h) }`): the
+      # hand-off walk leaves it out ({#each_node_in_method_scope}), so the write census reads a call in it that passes
+      # a parameter as written ({CalleeWriteCensus}). A block run on another `self` (`instance_exec`, `Class.new`)
+      # stays out: a self-call there is not a call on the method's receiver.
+      METHOD_BODY_BLOCK_CALLS = %i[define_method define_singleton_method].to_set.freeze
+      private_constant :METHOD_BODY_BLOCK_CALLS
+
+      # Issue #2336 — whether the value a def returns counts as a write of the parameter it is ({CalleeWriteCensus}):
+      # not for `initialize`, whose value `new` drops, nor for a setter (`x=`, `[]=`), whose value an assignment drops.
+      def returns_counted?(def_node)
+        name = def_node.name
+        name != :initialize && name != :[]= && !SETTER_NAME.match?(name)
+      end
+
+      # An attribute writer's name: an identifier followed by `=` (`format=`), not an operator (`==`, `<=`, `===`).
+      SETTER_NAME = /\A[A-Za-z_][A-Za-z0-9_]*=\z/
+      private_constant :SETTER_NAME
+
+      # Issue #2336 — true when `def_node` has an anonymous rest (`*`), keyword rest (`**`) or `...`, whose arguments
+      # an opaque sink may receive ({CalleeWriteCensus::ANONYMOUS_REST}).
+      def anonymous_rests?(def_node)
+        params = def_node.parameters
+        return false if params.nil?
+
+        (params.rest.is_a?(Prism::RestParameterNode) && params.rest.name.nil?) ||
+          (params.keyword_rest.is_a?(Prism::KeywordRestParameterNode) && params.keyword_rest.name.nil?) ||
+          params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+      end
+
+      # The parameters {#callee_write_census} follows: each content parameter holds the caller's argument itself
+      # (`:same`); a named rest (`*args`) or keyword rest (`**kw`) holds the caller's arguments as elements (`:held`).
+      def census_seeds(def_node)
+        seeds = content_parameter_slots(def_node).transform_values { :same }
+        rest_parameter_names(def_node).each_key { |name| seeds[name] = :held }
+        seeds
+      end
+
+      # `{ name => census key }` for a named rest (`*args` reads as {REST_PARAMETER}) and keyword rest (`**kw` reads as
+      # {KEYWORD_REST_PARAMETER}) of `def_node`.
+      def rest_parameter_names(def_node)
+        params = def_node.parameters
+        return NO_PARAMETER_SLOTS if params.nil?
+
+        rest = params.rest
+        keyword_rest = params.keyword_rest
+        names = {}
+        names[rest.name] = REST_PARAMETER if rest.is_a?(Prism::RestParameterNode) && rest.name
+        names[keyword_rest.name] = KEYWORD_REST_PARAMETER if keyword_rest.is_a?(Prism::KeywordRestParameterNode) &&
+                                                             keyword_rest.name
+        names
+      end
+
+      # The own-census entries for the parameter names {#callee_write_census} wrote: a content parameter at its slot,
+      # a rest at {ANY_SLOT} and a keyword rest at {ANY_KEYWORD}, the slots every argument they bind reaches.
+      #
+      # Issue #2336 — an anonymous rest, keyword rest or `...` an opaque sink received
+      # ({CalleeWriteCensus::ANONYMOUS_REST}) is written at its slot too.
+      def written_slots(def_node, written)
+        found = content_parameter_slots(def_node).slice(*written)
+        rest_parameter_names(def_node).each do |name, key|
+          found[key] = key == REST_PARAMETER ? ANY_SLOT : ANY_KEYWORD if written.include?(name)
+        end
+        rests = rest_parameters(def_node)
+        if written.include?(CalleeWriteCensus::ANONYMOUS_REST) && rests.include?(REST_PARAMETER)
+          found[REST_PARAMETER] = ANY_SLOT
+        end
+        if written.include?(CalleeWriteCensus::ANONYMOUS_KEYWORD_REST) && rests.include?(KEYWORD_REST_PARAMETER)
+          found[KEYWORD_REST_PARAMETER] = ANY_KEYWORD
+        end
+        found
+      end
+
+      # Issue #2521 (#2570 review) — the parameters `def_node` hands to the method it overrides: every content
+      # parameter under a zsuper (`super`, which passes them all), and each one an explicit `super(...)` passes as an
+      # argument or keyword value, at the block depth the call sits at. The overridden def is not followed; the
+      # parameter reads as mutated, so a literal handed through an override that forwards it is floored.
+      #
+      # A rest parameter (`*`, `*args`, `...`) handed on whole (a zsuper, `super(*args)`, `super(...)`) reads as
+      # mutated under {REST_PARAMETER}, the name an argument the call binds to the rest parameter reaches
+      # ({#compute_forwarding_edges}), at {ANY_SLOT} ({#arguments_for_slots}).
+      def super_forwarded_parameters(def_node)
+        # A cheap gate first: the walk below runs for the few defs whose source mentions `super` at all.
+        body = def_node.body
+        return NO_PARAMETER_SLOTS if body.nil? || !body.slice.include?("super")
+
+        slots = content_parameter_slots(def_node)
+        rests = rest_parameters(def_node)
+        return NO_PARAMETER_SLOTS if slots.empty? && rests.empty?
+
+        names = super_forwarded_names(def_node, slots, rests)
+        return NO_PARAMETER_SLOTS if names.nil?
+
+        found = slots.slice(*names)
+        found[REST_PARAMETER] = ANY_SLOT if names.include?(REST_PARAMETER)
+        found[KEYWORD_REST_PARAMETER] = ANY_KEYWORD if names.include?(KEYWORD_REST_PARAMETER)
+        found
       end
 
+      # The parameter names `def_node` hands to `super` ({#super_forwarded_parameters}), or nil when it calls none.
+      # `rests` holds the rest names the def has ({#rest_parameters}).
+      def super_forwarded_names(def_node, slots, rests)
+        names = nil
+        each_node_in_method_scope(def_node.body, 0) do |node, depth|
+          case node
+          when Prism::ForwardingSuperNode
+            (names ||= Set.new).merge(slots.keys.reject { |name| after_rebind?(def_node, name, node) }).merge(rests)
+          when Prism::SuperNode
+            handed = super_argument_parameters(node, slots, depth).reject { |name| after_rebind?(def_node, name, node) }
+            (names ||= Set.new).merge(handed)
+            names.merge(rests & splatted_rests(node))
+          end
+        end
+        names
+      end
+
+      # The names {#super_forwarded_parameters} records a positional and a keyword rest parameter handed to `super`
+      # under; no local can be named with a leading `*`.
+      REST_PARAMETER = :"*rest"
+      KEYWORD_REST_PARAMETER = :"**rest"
+      REST_NAMES = [REST_PARAMETER].freeze
+      KEYWORD_REST_NAMES = [KEYWORD_REST_PARAMETER].freeze
+      private_constant :REST_PARAMETER, :KEYWORD_REST_PARAMETER, :REST_NAMES, :KEYWORD_REST_NAMES
+
+      # The rest names an argument the call binds to no named parameter of `callee` reaches, when `callee` hands that
+      # rest parameter to `super` ({#super_forwarded_parameters}); empty otherwise. `slot` is the call's positional
+      # index, or the keyword.
+      def handed_rest_names(callee, slot)
+        own = own_content_parameters(callee)
+        if slot.is_a?(Symbol) then own.key?(KEYWORD_REST_PARAMETER) ? KEYWORD_REST_NAMES : NO_FORWARDS
+        else own.key?(REST_PARAMETER) ? REST_NAMES : NO_FORWARDS
+        end
+      end
+
+      # The rest parameters `def_node` has, as {REST_PARAMETER} / {KEYWORD_REST_PARAMETER}: `*args` / `*`, `**kw` /
+      # `**`, both for `...`.
+      def rest_parameters(def_node)
+        params = def_node.parameters
+        return NO_FORWARDS if params.nil?
+
+        forwarding = params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+        rests = []
+        rests << REST_PARAMETER if forwarding || params.rest.is_a?(Prism::RestParameterNode)
+        rests << KEYWORD_REST_PARAMETER if forwarding || params.keyword_rest.is_a?(Prism::KeywordRestParameterNode)
+        rests
+      end
+
+      # The rests an explicit `super(...)` passes on whole: a splat (`*args`, `*`), a double splat (`**kw`, `**`) in its
+      # keywords, or `...` for both.
+      def splatted_rests(node)
+        (node.arguments&.arguments || []).flat_map do |argument|
+          case argument
+          when Prism::SplatNode then REST_NAMES
+          when Prism::ForwardingArgumentsNode then [REST_PARAMETER, KEYWORD_REST_PARAMETER]
+          when Prism::KeywordHashNode
+            argument.elements.any?(Prism::AssocSplatNode) ? KEYWORD_REST_NAMES : NO_FORWARDS
+          else NO_FORWARDS
+          end
+        end
+      end
+
+      def super_argument_parameters(node, slots, depth)
+        arguments = node.arguments&.arguments || []
+        arguments.flat_map do |argument|
+          if argument.is_a?(Prism::KeywordHashNode)
+            argument.elements.filter_map do |pair|
+              parameter_read_name(pair.value, slots, depth) if pair.is_a?(Prism::AssocNode)
+            end
+          else
+            [parameter_read_name(argument, slots, depth)].compact
+          end
+        end
+      end
+
+      # Issue #2296 — the parameters `def_node` content-mutates inside a block of its body, at any nesting: a
+      # mutation whose receiver reads the parameter itself at the block depth it sits at, so a block parameter or
+      # block-local of the same name, and a block-local copy (`t = [acc[i]]; t[0] = v`), do not count. A lambda or
+      # nested def is not entered (its body is not run by the call), nor is a block that runs on another `self`
+      # ({#each_node_in_method_scope}). The walk counts the method body too: a mutation there, or in an escaping
+      # block, is one the bare census ({#own_content_parameters}) also counts, and its floor runs first, leaving this
+      # one nothing to widen. A property of the AST alone, memoised per def node for the thread.
+      def own_block_content_parameters(def_node) = block_and_set_parameters(def_node)[0]
+
+      # Issue #2296 — the parameters `def_node` grows through a Set-only adder ({SET_ONLY_ADDERS}) in its body or a
+      # block in it, read at the depth it sits at as above. The name alone does not say the receiver is a Set
+      # (`Hash#merge` returns a new Hash), so only a Set argument is floored on it
+      # ({UnknownStoreWidening.callee_set_floor}).
+      def own_set_content_parameters(def_node) = block_and_set_parameters(def_node)[1]
+
+      # Both censuses above, `[block, set]`, from one walk of the method scope, memoised per def node for the thread.
+      def block_and_set_parameters(def_node)
+        def_census(:block_and_set, def_node) do
+          slots = content_parameter_slots(def_node)
+          next NO_BLOCK_AND_SET if slots.empty?
+
+          block = nil
+          set = nil
+          each_node_in_method_scope(def_node.body, 0) do |node, depth|
+            name = content_mutation_target(node) { |r| r.depth == depth }.first
+            (block ||= Set.new) << name if counted_mutation?(def_node, slots, name, node)
+            name = set_only_adder_target(node, depth)
+            (set ||= Set.new) << name if counted_mutation?(def_node, slots, name, node)
+          end
+          [block.nil? ? NO_PARAMETER_SLOTS : slots.slice(*block), set.nil? ? NO_PARAMETER_SLOTS : slots.slice(*set)]
+        end
+      end
+
+      # True when `name`, the local the mutation `node` targets, is one of `slots`' parameters and `node` runs before
+      # any rebind of it ({#after_rebind?}).
+      def counted_mutation?(def_node, slots, name, node)
+        !name.nil? && slots.key?(name) && !after_rebind?(def_node, name, node)
+      end
+
+      # The local `node` grows through a Set-only adder when its receiver reads that local at `depth`, else nil.
+      def set_only_adder_target(node, depth)
+        return unless node.is_a?(Prism::CallNode) && SET_ONLY_ADDERS.include?(node.name)
+
+        receiver = node.receiver
+        receiver.name if receiver.is_a?(Prism::LocalVariableReadNode) && receiver.depth == depth
+      end
+
+      NO_PARAMETER_SLOTS = {}.freeze
+      NO_BLOCK_AND_SET = [NO_PARAMETER_SLOTS, NO_PARAMETER_SLOTS].freeze
+      private_constant :NO_PARAMETER_SLOTS, :NO_BLOCK_AND_SET
+
       # Issue #2104 — the per-thread memo of a census that reads nothing but `def_node`'s AST, under `kind`.
-      def def_census(kind, def_node)
+      def def_census(kind, def_node, &)
         table = (Thread.current[DEF_CENSUS_KEY] ||= ObjectSpace::WeakKeyMap.new)
         entry = (table[def_node] ||= {})
-        entry.fetch(kind) { entry[kind] = yield }
+        return entry[kind] = yield unless entry.key?(kind)
+
+        MemoAudit.check("def census", entry[kind], kind, &)
       end
 
-      DEF_CENSUS_KEY = :rigor_callee_def_census
+      DEF_CENSUS_KEY = RunScopedSlots.register(:rigor_callee_def_census)
       private_constant :DEF_CENSUS_KEY
 
       # Issue #2104 — the {CalleeMutationChain::Edge}s along which `def_node` hands one of its parameters, unchanged, to
@@ -4553,19 +6148,39 @@ module Rigor
         cache[def_node] ||= resolved_census(:edges, def_node) { compute_forwarding_edges(def_node) }
       end
 
+      # True for a hand-off answer with more than one candidate, or resolved by name ({UnionCallees}): its edges are
+      # over-approximations ({CalleeMutationChain::Edge#approx}).
+      def approximate_hand_off?(callees) = callees.size > 1 || callees.is_a?(UnionCallees)
+
+      # True for a hand-off answer that reads the handed parameter as written whatever the callee is: a name with too
+      # many defs ({CAPPED_HAND_OFF}) or a top-level def that may not be the one called ({FLOOR_EVERY}).
+      def floors_outright?(callees)
+        callees.equal?(CAPPED_HAND_OFF) || callees.any? { |_callee, _offset, owner| owner == FLOOR_EVERY }
+      end
+
       def compute_forwarding_edges(def_node)
-        slots = content_parameter_slots(def_node)
+        slots = forwarding_slots(def_node)
         edges = []
-        each_forwarding_call(def_node, slots) do |call_node, forwarded|
-          callee = resolve_self_callee_def(call_node)
-          next if callee.nil?
+        each_forwarding_call(def_node, slots) do |call_node, forwarded, depth|
+          callees = hand_off_callees(call_node, def_node, depth)
+          if floors_outright?(callees)
+            forwarded.map(&:first).each do |name|
+              edges << CalleeMutationChain::Edge.new(name: name, slot: slots[name], callee: def_node,
+                                                     callee_names: [name], owner: FLOOR_ALL)
+            end
+            next
+          end
 
-          callee_slots = content_parameter_slots(callee)
-          forwarded.each do |name, callee_slot|
-            names = bound_parameter_names(callee_slots, callee_slot)
-            next if names.empty?
+          callees.each do |callee, offset, owner|
+            callee_slots = content_parameter_slots(callee)
+            forwarded.each do |name, index|
+              names = bound_parameter_names(callee_slots, index.is_a?(Integer) ? index - offset : index)
+              names = handed_rest_names(callee, index) if names.empty? && index != ANY_SLOT
+              next if names.empty?
 
-            edges << CalleeMutationChain::Edge.new(name: name, slot: slots[name], callee: callee, callee_names: names)
+              edges << CalleeMutationChain::Edge.new(name: name, slot: slots[name], callee: callee, callee_names: names,
+                                                     owner: owner, approx: approximate_hand_off?(callees))
+            end
           end
         end
         edges.empty? ? NO_FORWARDS : edges
@@ -4581,11 +6196,13 @@ module Rigor
 
       def forwarding_calls(def_node, slots)
         calls = []
+        context = HandOffContext.new(census: callee_write_census(def_node), seeds: census_seeds(def_node),
+                                     rests: rest_parameter_names(def_node), rebinds: parameter_rebinds(def_node))
         each_node_in_method_scope(def_node.body, 0) do |descendant, depth|
-          next unless self_dispatch_call?(descendant)
+          next unless self_dispatch_call?(descendant) || hand_off_receiver?(descendant)
 
-          forwarded = forwarded_parameters(descendant, slots, depth)
-          calls << [descendant, forwarded] unless forwarded.empty?
+          forwarded = forwarded_parameters(descendant, slots, depth, context)
+          calls << [descendant, forwarded, depth] unless forwarded.empty?
         end
         calls.empty? ? NO_FORWARDS : calls
       end
@@ -4596,8 +6213,11 @@ module Rigor
       # `[[parameter_name, callee_slot], ...]` for the arguments of `call_node` that read one of `slots`' parameters at
       # `depth`, the block nesting the call sits at: a read of the method's own parameter there has that depth. An
       # argument after a splat or `...` has an index that says nothing about the parameter it binds, so it binds
-      # {ANY_SLOT}, any positional parameter of the callee; one before the first splat keeps its index.
-      def forwarded_parameters(call_node, slots, depth)
+      # {ANY_SLOT}, any positional parameter of the callee; one before the first splat keeps its index among the call's
+      # arguments, which {#compute_forwarding_edges} shifts by each callee's offset ({#resolve_self_callees}).
+      # Issue #2595 — an argument that reads an alias of a parameter (`other = h; poke(other)`, `@x = h; poke(@x)`, a
+      # block parameter of `h.tap`) hands on that parameter too (`census`, {#callee_write_census}).
+      def forwarded_parameters(call_node, slots, depth, context = NO_HAND_OFF_CONTEXT)
         args = call_node.arguments
         return NO_FORWARDS unless args.is_a?(Prism::ArgumentsNode)
 
@@ -4605,11 +6225,14 @@ module Rigor
         forwarded = []
         args.arguments.each_with_index do |argument, index|
           if argument.is_a?(Prism::KeywordHashNode)
-            forwarded.concat(forwarded_keywords(argument, slots, depth))
+            forwarded.concat(forwarded_keywords(argument, slots, depth, context))
           elsif argument.is_a?(Prism::SplatNode) || argument.is_a?(Prism::ForwardingArgumentsNode)
             spread = true
-          elsif (name = parameter_read_name(argument, slots, depth))
-            forwarded << [name, spread ? ANY_SLOT : index]
+            rest = splatted_rest(argument, depth, context)
+            forwarded << [rest, ANY_SLOT] if rest
+          else
+            slot = spread ? ANY_SLOT : index
+            handed_names(argument, slots, depth, context) { |name| forwarded << [name, slot] }
           end
         end
         forwarded
@@ -4617,27 +6240,95 @@ module Rigor
 
       # The `callee_slot` of an argument whose parameter the call does not show (one after a splat).
       ANY_SLOT = :__any_positional__
-      private_constant :ANY_SLOT
+
+      # The census {FLOOR_EVERY} answers: the rest and keyword-rest slots, which {#arguments_for_slots} reads as every
+      # positional argument and every keyword value of the call.
+      EVERY_ARGUMENT = { REST_PARAMETER => ANY_SLOT, KEYWORD_REST_PARAMETER => ANY_KEYWORD }.freeze
+      private_constant :ANY_SLOT, :EVERY_ARGUMENT
 
       # The names of the callee's parameters (`callee_slots`, {#content_parameter_slots}) an argument bound to `slot`
       # may reach: the one at that slot, or every positional one for {ANY_SLOT}.
       def bound_parameter_names(callee_slots, slot)
         if slot == ANY_SLOT
           callee_slots.filter_map { |name, at| name if at.is_a?(Integer) }
+        elsif slot == ANY_KEYWORD
+          callee_slots.filter_map { |name, at| name if at.is_a?(Symbol) }
         else
           callee_slots.filter_map { |name, at| name if at == slot }
         end
       end
 
-      def forwarded_keywords(hash_node, slots, depth)
-        hash_node.elements.filter_map do |pair|
+      # Issue #2336 — a double splat of the def's own keyword rest (`poke(**kw)`) hands it on whole, at {ANY_KEYWORD}.
+      def forwarded_keywords(hash_node, slots, depth, context)
+        found = []
+        hash_node.elements.each do |pair|
+          if pair.is_a?(Prism::AssocSplatNode)
+            rest = splatted_keyword_rest(pair, depth, context)
+            found << [rest, ANY_KEYWORD] if rest
+          end
           next unless pair.is_a?(Prism::AssocNode) && pair.key.is_a?(Prism::SymbolNode)
 
-          name = parameter_read_name(pair.value, slots, depth)
-          [name, pair.key.unescaped.to_sym] if name
+          keyword = pair.key.unescaped.to_sym
+          handed_names(pair.value, slots, depth, context) { |name| found << [name, keyword] }
+        end
+        found
+      end
+
+      # Yields each parameter `node` may hand on: the one it reads ({#parameter_read_name}) and those it may be through
+      # an alias or an expression ({CalleeWriteCensus.handed_aliases}). An element of a named rest or keyword rest
+      # (`x = args[0]; poke(x)`, `poke(kw[:h])`) hands on that rest, under {REST_PARAMETER} / {KEYWORD_REST_PARAMETER}
+      # ({#forwarding_slots}).
+      #
+      # Issue #2336 — a read of the parameter after the def rebound it to a new object (`acc = acc.dup; poke(acc)`)
+      # hands on the copy, not the caller's argument ({#after_rebind?}).
+      def handed_names(node, slots, depth, context)
+        name = parameter_read_name(node, slots, depth)
+        yield name if name && !CalleeWriteCensus.rebound?(context.rebinds, name, node)
+        node = node.value if node.is_a?(Prism::ImplicitNode)
+        aliases = CalleeWriteCensus.handed_aliases(context.census, context.seeds, node, depth,
+                                                   fresh: FRESH_RESULTS, copiers: CENSUS_COPIERS)
+        aliases.each do |aliased|
+          next if aliased == name
+
+          if slots.key?(aliased) then yield aliased
+          elsif (rest = context.rests[aliased]) then yield rest
+          end
         end
       end
 
+      # The keyword-rest key a `**kw` double splat of the def's own named keyword rest hands on whole, or nil.
+      def splatted_keyword_rest(pair, depth, context)
+        read = pair.value
+        return unless read.is_a?(Prism::LocalVariableReadNode) && read.depth == depth
+
+        rest = context.rests[read.name]
+        rest if rest == KEYWORD_REST_PARAMETER
+      end
+
+      # The rest key a `*args` splat of the def's own named rest hands on whole (`poke(*args)`), or nil.
+      def splatted_rest(argument, depth, context)
+        read = argument.is_a?(Prism::SplatNode) ? argument.expression : nil
+        return unless read.is_a?(Prism::LocalVariableReadNode) && read.depth == depth
+
+        rest = context.rests[read.name]
+        rest if rest == REST_PARAMETER
+      end
+
+      # What {#forwarded_parameters} reads a def's hand-offs with: its write census, its census seeds, its named
+      # rests and its parameter rebinds ({#parameter_rebinds}).
+      HandOffContext = Data.define(:census, :seeds, :rests, :rebinds)
+      NO_HAND_OFF_CONTEXT = HandOffContext.new(census: CalleeWriteCensus::EMPTY, seeds: {}.freeze, rests: {}.freeze,
+                                               rebinds: {}.freeze)
+      private_constant :HandOffContext, :NO_HAND_OFF_CONTEXT
+
+      # The slots a hand-off's forwarded name maps to: each content parameter's, and {ANY_SLOT} / {ANY_KEYWORD} for the
+      # rest keys an element of a named rest or keyword rest hands on under ({#handed_names}).
+      def forwarding_slots(def_node)
+        slots = content_parameter_slots(def_node)
+        rest_parameter_names(def_node).each_value { |key| slots[key] = key == REST_PARAMETER ? ANY_SLOT : ANY_KEYWORD }
+        slots
+      end
+
       # The parameter `node` reads when it is a read of one of `slots`' names at `depth` (a keyword shorthand
       # `poke(acc:)` wraps the read in an `ImplicitNode`), else nil.
       def parameter_read_name(node, slots, depth)
@@ -4647,16 +6338,168 @@ module Rigor
         node.name if slots.key?(node.name)
       end
 
-      # The user def a self-dispatch `node` resolves to in the enclosing class, or nil. Reuses the discovery index
-      # `Scope#user_def_for` reads; no ancestor walk (the boundary-escape idiom is same-class), keeping this off the hot
-      # path for the overwhelming majority of self-calls that resolve to nothing escaping.
-      def resolve_self_callee_def(node)
-        class_name = enclosing_class_name_for(scope.self_type)
-        return scope.top_level_def_for(node.name) if class_name.nil?
+      # The `[def, offset]` pairs a self-dispatch `node` resolves to in the enclosing class, `offset` being how many
+      # leading arguments of `node` are not the def's. Issue #2521 — the instance def is looked up along the class's
+      # ancestors ({Scope#user_def_through_ancestors}), as Ruby dispatches the call: an inherited def is now walked
+      # under the receiver's class, so a self-call inside it to another inherited def must still be found there.
+      #
+      # Issue #2297 — in a singleton-side body (`def self.x`, a `def` in `class << self`), whose `self` is the class
+      # object, a self-call resolves to the singleton def of that name AND to the same-named instance def, so the floor
+      # applies when either mutates. Ruby calls only the singleton side, but the hand-offs that reach an instance def
+      # from there (`new.call(acc)`, `instance.helper(acc)`) and the singleton defs the index does not record
+      # (`module_function :poke`, `define_singleton_method`, `alias_method` in `class << self`) are not followed, and
+      # dropping the instance def floored too little on correct code
+      # (`approval-queue.d/callee-floor-singleton-side.md`).
+      # An instance-side body resolves to instance defs only.
+      #
+      # A `send(:name, ...)` / `public_send(:name, ...)` with a symbol literal resolves as the self-call `name(...)`,
+      # offset 1, on each side that has no def of the `send` / `public_send` name itself; on a side that has one, it is
+      # an ordinary self-call to that def, offset 0.
+      def resolve_self_callees(node)
+        self_type = scope.self_type
+        class_name = enclosing_class_name_for(self_type)
+        return top_level_callees(node, nil) if class_name.nil?
+
+        instance = ancestor_side_callee(node, class_name) do |name|
+          scope.user_def_through_ancestors(class_name, name)
+        end
+        side = self_type.is_a?(Type::Singleton) ? :singleton : :instance
+        singleton = inherited_singleton_callee(node, self_type) if side == :singleton
+        return unanswered_self_callees(node, class_name, side) unless instance || singleton
+        return [instance] if singleton.nil?
+        return [singleton] if instance.nil?
+        return [instance] if singleton.first.equal?(instance.first)
+
+        [singleton, instance]
+      end
+
+      # Issue #2515 — the `[def, offset, owner]` a receiverless call resolves to in the project's top-level defs: a
+      # top-level def is a private method on `Object`, so a call outside any class body, and a call in a class whose
+      # chain does not answer the name, reaches it. `class_name` is nil outside a class (the callee's own hand-offs
+      # resolve in this evaluator, owner nil), else the class and side the chain was searched on. The def is read as
+      # written only when nothing else can answer it ({ToplevelDefCensus.reliable?}, and for a class the chain
+      # {#chain_may_answer?}); otherwise it reads as {FLOOR_EVERY}, every argument written. Nothing when no top-level
+      # def has the name.
+      def top_level_callees(node, class_name, side = nil)
+        target = nil
+        found = side_callee(node) do |name|
+          def_node = scope.top_level_def_for(name)
+          target = name unless def_node.nil?
+          def_node
+        end
+        return NO_CALLEES if found.nil?
+
+        def_node, offset = found
+        floor = !ToplevelDefCensus.reliable?(scope, target) ||
+                (!class_name.nil? && chain_may_answer?(class_name, side, target))
+        [[def_node, offset, if floor
+                              FLOOR_EVERY
+                            else
+                              (class_name.nil? ? nil : TOPLEVEL_OWNER)
+                            end]]
+      end
+
+      # A self-call the class's own chain found no def for: the chain's `method_missing` answers it, else the project's
+      # top-level def of that name (Ruby searches `Object` before `method_missing`, so with both the top-level def runs
+      # and the `method_missing` reading is the over-approximation; both are returned and the top-level one floors
+      # every argument).
+      #
+      # Issue #2336 — a name nothing above answers floors every argument when a `define_method` /
+      # `define_singleton_method` / `alias_method` call gives it a body ({#self_ownerless_body?}).
+      def unanswered_self_callees(node, class_name, side)
+        missing = self_method_missing_callees(node, class_name, side)
+        top = top_level_callees(node, class_name, side)
+        if missing.empty? && top.empty?
+          name = send_hand_off?(node) ? send_target(node) : node.name
+          return self_ownerless_body?(name, class_name, side) ? OPAQUE_CALLEES : NO_CALLEES
+        end
+        return top if missing.empty?
+        return missing if top.empty?
 
-        scope.user_def_for(class_name, node.name)
+        missing + top.map { |def_node, offset, _owner| [def_node, offset, FLOOR_EVERY] }
       end
 
+      # True when something besides `Object` may answer a receiverless call of `name` in `class_name`'s `side`: the
+      # class is no project class, a definer other than a `def` sits on its chain (`attr_*`, `define_method`, a budget
+      # cut), or an ancestor the project does not declare is unknown to RBS or declares the name there (a
+      # `< ActiveRecord::Base` the environment has no RBS for may define anything). The project's own `def`s were
+      # searched already ({#resolve_self_callees}).
+      def chain_may_answer?(class_name, side, name)
+        return true unless project_class?(class_name)
+        return true if scope.discovered_method_through_ancestors?(class_name, name, side)
+        return true if rbs_declares?(class_name, name) || (side == :singleton && rbs_declares?("Class", name))
+
+        external = scope.external_ancestor_name_candidates(class_name)
+        external += scope.singleton_extends_of(class_name).map { |module_name| [module_name] } if side == :singleton
+        external.any? do |candidates|
+          known = candidates.find { |candidate| Reflection.rbs_class_known?(candidate, scope: scope) }
+          known.nil? ? candidates.none? { |candidate| project_class?(candidate) } : rbs_declares?(known, name)
+        end
+      end
+
+      # A class or module the project declares, even one with no method of its own.
+      def project_class?(name) = scope.known_user_class?(name) || scope.declared_class?(name)
+
+      def rbs_declares?(class_name, name)
+        !Reflection.instance_method_definition(class_name, name, scope: scope).nil? ||
+          !Reflection.singleton_method_definition(class_name, name, scope: scope).nil?
+      end
+
+      # The `[def, offset, owner]` a singleton-side self-call resolves to along the singleton chain: owner nil for a
+      # def of the class itself, {FLOOR_ALL} for one it inherits ({#walked_owner}).
+      def inherited_singleton_callee(node, self_type)
+        class_name = self_type.class_name
+        ancestor_side_callee(node, class_name) do |name|
+          scope.singleton_def_through_ancestors(class_name, name)
+        end
+      end
+
+      # The `[def, offset, owner]` `node` resolves to through a lookup on `class_name` that answers `[def, defining]`
+      # (the block), owner nil, or {FLOOR_ALL} ({#walked_owner}); nil when nothing answers.
+      def ancestor_side_callee(node, class_name)
+        defining = nil
+        found = side_callee(node) do |name|
+          def_node, owner = yield(name)
+          defining = owner unless def_node.nil?
+          def_node
+        end
+        found && [*found, walked_owner(defining, class_name, nil)]
+      end
+
+      # {#method_missing_callees} for a self-call `node` that resolves to nothing; a `send(:name, ...)` hand-off
+      # passes the name as `method_missing`'s own first argument.
+      def self_method_missing_callees(node, class_name, side)
+        if send_hand_off?(node)
+          method_missing_callees(class_name, side, node.arguments.arguments.first.unescaped.to_sym, 1)
+        else
+          method_missing_callees(class_name, side, node.name, 0)
+        end
+      end
+
+      # The `[def, offset]` `node` resolves to on one side, whose def table the block looks a name up in, or nil.
+      def side_callee(node)
+        if send_hand_off?(node)
+          own = yield(node.name)
+          return [own, 0] if own
+
+          target = yield(node.arguments.arguments.first.unescaped.to_sym)
+          return target && [target, 1]
+        end
+
+        found = yield(node.name)
+        found && [found, 0]
+      end
+
+      # True for a `send` / `public_send` / `__send__` whose first argument is a literal target name: a symbol, or
+      # (issue #2336) a string (`send("poke", h)`).
+      def send_hand_off?(node)
+        SEND_HAND_OFFS.include?(node.name) && CalleeWriteCensus.literal_send?(node)
+      end
+
+      SEND_HAND_OFFS = %i[send public_send __send__].freeze
+      NO_CALLEES = [].freeze
+      private_constant :SEND_HAND_OFFS, :NO_CALLEES
+
       def self_dispatch_call?(node)
         return false unless node.is_a?(Prism::CallNode)
 
@@ -4664,7 +6507,7 @@ module Rigor
       end
 
       # The set of `[name, slot]` parameters of `def_node` whose content a block in the body escape-mutates.
-      # Memoised per def node (the body walk is otherwise repeated at every call site). A parameter is "escape- mutated"
+      # Memoised per def node (the body walk is otherwise repeated at every call site). A parameter is "escape-mutated"
       # when a `param[k] = v` / `param << x` mutation on it appears inside a block whose receiving call is not proven
       # non-escaping.
       def escaped_content_parameters(def_node)
@@ -4681,8 +6524,10 @@ module Rigor
           next unless descendant.is_a?(Prism::CallNode) && descendant.block.is_a?(Prism::BlockNode)
           next if syntactically_non_escaping_call?(descendant)
 
-          collect_content_mutations(descendant.block.body).each_key do |name|
-            mutated << name if positions.key?(name)
+          collect_content_mutations(descendant.block.body).each do |name, nodes|
+            next unless positions.key?(name)
+
+            mutated << name if nodes.any? { |node| !after_rebind?(def_node, name, node) }
           end
         end
         positions.slice(*mutated)
@@ -4694,9 +6539,9 @@ module Rigor
       # parameter-name read is genuinely at method scope (depth 0) rather than a block-local of the same name that
       # merely shadows the parameter — so we never floor a caller argument the callee did not actually mutate.
       #
-      # A mutation inside a NON-escaping block (`n.times { |i| acc[i] = v }`) is not counted: the bare-collection floor
-      # it would apply turned haml's `AttributeCompiler#compile` (a `temple` array a helper fills in a `times` block,
-      # returned against a declared tuple) into a `def.return-type-mismatch` (af3efef33, and again under #2104).
+      # A mutation inside a NON-escaping block (`n.times { |i| acc[i] = v }`) is not counted here: the bare-collection
+      # floor this census applies dropped the element type (af3efef33, and again under #2104). Issue #2296 counts it in
+      # {#own_block_content_parameters}, whose floor keeps the element type.
       def direct_content_parameters(def_node)
         cache = (@direct_param_cache ||= {}.compare_by_identity)
         cache[def_node] ||= compute_direct_content_parameters(def_node)
@@ -4709,11 +6554,110 @@ module Rigor
         mutated = Set.new
         each_node_outside_nested_scopes(def_node.body) do |descendant|
           name, = content_mutation_target(descendant) { |r| r.is_a?(Prism::LocalVariableReadNode) && r.depth.zero? }
-          mutated << name if !name.nil? && positions.key?(name)
+          mutated << name if !name.nil? && positions.key?(name) && !after_rebind?(def_node, name, descendant)
         end
         positions.slice(*mutated)
       end
 
+      # Issue #2296 — true when `node` runs after the def has rebound its parameter `name` to a fresh object
+      # (`acc = acc.dup` as a statement of the method body, ahead of `node`): from there `name` holds another object,
+      # so a mutation of it does not reach the caller's argument. Only an unconditional rebind counts, a write that is
+      # itself a statement of the body, not one under a branch, a loop, a block or `||=`. Its value MUST provably be a
+      # new object ({#fresh_value?}): `acc = acc.to_a` or `s = s.to_s` hands back the same object, so a mutation after
+      # it still reaches the caller. A def whose body has a `rescue` or `ensure` clause never rebinds, since the clause
+      # runs with whichever binding the raise left. And only a node that starts after the write ends counts, so
+      # `acc = poke(acc)` still passes the original.
+      def after_rebind?(def_node, name, node)
+        offset = parameter_rebinds(def_node)[name]
+        !offset.nil? && node.location.start_offset >= offset
+      end
+
+      # `{ name => end_offset }` of the first unconditional fresh rebind of each parameter ({#after_rebind?}),
+      # memoised per def node for the thread.
+      def parameter_rebinds(def_node)
+        def_census(:rebinds, def_node) do
+          slots = content_parameter_slots(def_node)
+          rebinds = nil
+          body_statements(def_node.body).each do |statement|
+            next unless fresh_rebind?(statement, slots)
+
+            (rebinds ||= {})[statement.name] ||= statement.location.end_offset
+          end
+          rebinds || NO_PARAMETER_SLOTS
+        end
+      end
+
+      def fresh_rebind?(statement, slots)
+        case statement
+        when Prism::LocalVariableWriteNode
+          statement.depth.zero? && slots.key?(statement.name) && fresh_value?(statement.value, statement.name)
+        when Prism::LocalVariableOperatorWriteNode
+          statement.depth.zero? && slots.key?(statement.name) &&
+            FRESH_OPERATORS.include?(statement.binary_operator)
+        else false
+        end
+      end
+
+      # A value that is always a new object: a `dup` / `clone`, an Array / Hash / String literal, `new` on a core
+      # collection class ({#core_collection_constant?}), or one of {FRESH_COPIERS} called on the parameter itself. Any
+      # other call may return its receiver.
+      def fresh_value?(value, name)
+        case value
+        when Prism::ArrayNode, Prism::HashNode, Prism::StringNode, Prism::InterpolatedStringNode then true
+        when Prism::CallNode then fresh_call?(value, name)
+        else false
+        end
+      end
+
+      def fresh_call?(call, name)
+        return true if FRESH_DUPLICATORS.include?(call.name)
+        return core_collection_constant?(call.receiver) if call.name == :new
+
+        receiver = call.receiver
+        FRESH_COPIERS.include?(call.name) && receiver.is_a?(Prism::LocalVariableReadNode) && receiver.name == name
+      end
+
+      # `::Array` / `::Hash` / `::String` / `::Set`, written `::`-rooted: the core classes whose `new` always builds a
+      # new object. A project class's `new` may hand back its argument (`Ident.new(acc)`) or wrap it (`Wrap.new(acc)`,
+      # whose `[]=` writes through), so it is no fresh rebind. The census reads the AST alone and cannot resolve a bare
+      # `Array`, which a namespace may shadow (`M::Array`), so only the rooted spelling counts.
+      def core_collection_constant?(node)
+        node.is_a?(Prism::ConstantPathNode) && node.parent.nil? && FRESH_CONSTRUCTED.include?(node.name)
+      end
+
+      FRESH_DUPLICATORS = %i[dup clone].to_set.freeze
+      FRESH_CONSTRUCTED = %i[Array Hash String Set].to_set.freeze
+      FRESH_COPIERS = %i[map collect select reject merge + -].to_set.freeze
+      FRESH_OPERATORS = %i[+ -].to_set.freeze
+      # The calls whose result {#callee_write_census} reads as a new object rather than an alias of the receiver.
+      # The calls {#callee_write_census} reads as a new container of the receiver's elements, on an Array, a Hash and a
+      # String alike: a write to the result misses the receiver, an element of it may be a part. `to_a`, `to_h`
+      # (without a block; `to_h { }` is read as one in {CalleeWriteCensus}), `to_s`, `each_slice`, `each_cons` and
+      # `each_with_index` stay out: each returns its receiver on one of them.
+      CENSUS_COPIERS = %i[
+        slice except compact transform_values transform_keys filter_map group_by partition sort sort_by uniq flatten
+        reverse keys values inspect zip filter flat_map collect_concat take drop
+      ].to_set.freeze
+      # The calls whose result {#callee_write_census} reads as a new object holding nothing of the receiver's.
+      FRESH_RESULTS = (FRESH_DUPLICATORS | FRESH_COPIERS | %i[join]).freeze
+      private_constant :FRESH_DUPLICATORS, :FRESH_CONSTRUCTED, :FRESH_COPIERS, :FRESH_OPERATORS, :CENSUS_COPIERS,
+                       :FRESH_RESULTS
+
+      # The statements a def body runs in order: a statements list, with a parenthesised list (an endless def's
+      # `= (a; b)`) read in place, or the lone expression. A body with a `rescue` / `ensure` clause (a `BeginNode`)
+      # answers none, so it never rebinds.
+      def body_statements(body)
+        case body
+        when nil, Prism::BeginNode then NO_FORWARDS
+        when Prism::StatementsNode then body.body.flat_map { |statement| body_statements_of(statement) }
+        else [body]
+        end
+      end
+
+      def body_statements_of(statement)
+        statement.is_a?(Prism::ParenthesesNode) ? body_statements(statement.body) : [statement]
+      end
+
       # Yields every node reachable from `body` without crossing into a nested block / def / lambda — i.e. the nodes
       # that execute in the method's own scope. A local-variable read found here has depth 0 relative to the method, so
       # a content mutation whose receiver is a positional-parameter name is a genuine mutation of that parameter.
@@ -4766,7 +6710,7 @@ module Rigor
       end
 
       # A receiver-independent over-approximation of `ClosureEscapeAnalyzer`'s non-escaping verdict, used when scanning
-      # a callee body where the block- owning call's receiver TYPE is not available. A call whose method name is a known
+      # a callee body where the block-owning call's receiver TYPE is not available. A call whose method name is a known
       # structural iterator (`each` / `map` / `tap` / …) runs its block synchronously and does not retain it, so its
       # captured mutations are not a cross-boundary escape. Any other name (`on`, `subscribe`, `define_method`, an
       # unknown DSL hook) is treated as escaping — sound, since mis-classifying a truly-non-escaping call only floors an
@@ -4812,6 +6756,8 @@ module Rigor
           case arg
           when Prism::LocalVariableReadNode
             scope.locals.key?(arg.name)
+          when Prism::SplatNode
+            arg.expression.is_a?(Prism::LocalVariableReadNode) && scope.locals.key?(arg.expression.name)
           when Prism::KeywordHashNode
             arg.elements.any? do |pair|
               next false unless pair.is_a?(Prism::AssocNode)
@@ -4907,6 +6853,18 @@ module Rigor
                                                   Type::Combinator.untyped])
         elsif arrayish?(type)
           Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.untyped])
+        elsif setish?(type)
+          Type::Combinator.nominal_of("Set", type_args: [Type::Combinator.untyped])
+        end
+      end
+
+      # A `Set` carrier, constant-folded or nominal, for the callee floor above (issue #2294).
+      def setish?(type)
+        case type
+        when Type::Constant then SetMutation.constant?(type)
+        when Type::Nominal then type.class_name == "Set"
+        when Type::Union then type.members.any? { |m| setish?(m) }
+        else false
         end
       end
 
@@ -5021,7 +6979,7 @@ module Rigor
       # ADR-56 slice A. For a `:non_escaping` block, fold the continuation binding of every outer local the body can
       # rebind back into `post_scope`. The binding is a capped fixpoint (cap 3) over the block body re-evaluated under
       # the running per-name assumption, joined with the pre-call binding (kept as a constituent so the 0-iteration path
-      # — `[].each { … }` — stays sound), value-pinned- widened on the final permitted iteration, and floored to
+      # — `[].each { … }` — stays sound), value-pinned widened on the final permitted iteration, and floored to
       # `Dynamic[top]` on non-convergence (matching `drop_captured_narrowing`).
       #
       # The instance variables the body rebinds (`CapturedLocals.writes` with `ivars: true`) outlive the call the same
@@ -5641,7 +7599,7 @@ module Rigor
       end
 
       # ADR-56 slice C (B3). For `recv.each_with_object(memo) { |x, acc| … }` the return is the memo object after the
-      # block has mutated it through the `acc` alias. Compute the joined memo type the same way captured- local content
+      # block has mutated it through the `acc` alias. Compute the joined memo type the same way captured-local content
       # mutations are joined: pre-state = the memo argument's type, added evidence = the content-mutator args on the
       # memo block param. Returns `call_type` unchanged for any other call, a missing block, or a memo whose pre-state
       # is not a collection.
@@ -5660,28 +7618,239 @@ module Rigor
         body = block.body
         return call_type if body.nil?
 
+        memo_after_block(call_node, call_type, memo_param, body)
+      end
+
+      # {#each_with_object_return}'s answer once the call is known to bind a memo parameter in a block with a body.
+      def memo_after_block(call_node, call_type, memo_param, body)
+        memo_arg = call_node.arguments.arguments.first
+        memo_type = scope.type_of(memo_arg, tracer: tracer)
+        pre_state = lookup_mutated_seed(body, memo_param, memo_type, MEMO_SEED_MUTATORS) do |depth, nesting|
+          depth == nesting
+        end
+        reach = memo_scan_reach(body, memo_param)
+        return content_floor_for(pre_state) || call_type if reach == :escape
+
         # The memo alias is a block-local (depth 0) — collect content mutations on it directly rather than via the
         # captured-local walk.
         shadows = {}.compare_by_identity
         calls = body_content_mutations_on(body, memo_param, shadows)
-        return call_type if calls.empty?
+        memo = if calls.empty?
+                 # Issue #2411 — a memo the block only reshapes (`m.merge!(s)`, `m.delete(k)`) answers its widened seed.
+                 pre_state.equal?(memo_type) ? call_type : pre_state
+               else
+                 join_memo_content(call_node, memo_param, calls, pre_state, shadows) || call_type
+               end
+        memo = floor_memo_callee_escapes(body, memo_param, memo)
+        reach == :values ? memo_value_floor(memo) : memo
+      end
+
+      # Issue #2411 — `memo` with its values or elements floored to `Dynamic[top]` and a Hash's keys kept: a reader's
+      # value is an element the block may then mutate where no scan sees it (`h[x] << "s"`, `v = h[:k]; v << "s"`,
+      # `h[:k][:n] = "s"`), so the join's element types are not what the memo holds. A memo whose every value or
+      # element is of a class no method mutates ({MEMO_IMMUTABLE_CLASSES}) keeps its join: `m[k] = m[k] + 1` reads an
+      # Integer, which nothing in the block can change.
+      def memo_value_floor(type)
+        return type if memo_contents_immutable?(type)
 
-        pre_state = lookup_mutated_seed(body, memo_param, scope.type_of(memo_arg, tracer: tracer)) do |depth, nesting|
-          depth == nesting
+        case type
+        when Type::Union then Type::Combinator.union(*type.members.map { |member| memo_value_floor(member) })
+        when Type::Nominal
+          return content_floor_for(type) || type unless type.class_name == "Hash" && type.type_args.size == 2
+
+          Type::Combinator.nominal_of("Hash", type_args: [type.type_args.first, Type::Combinator.untyped])
+        else content_floor_for(type) || type
+        end
+      end
+
+      # The classes whose instances no method mutates.
+      MEMO_IMMUTABLE_CLASSES = Set[
+        "Integer", "Float", "Symbol", "NilClass", "TrueClass", "FalseClass", "Rational", "Complex"
+      ].freeze
+      private_constant :MEMO_IMMUTABLE_CLASSES
+
+      # Whether every value of a Hash memo, or every element of an Array memo, is of a {MEMO_IMMUTABLE_CLASSES} class.
+      def memo_contents_immutable?(type)
+        case type
+        when Type::Union then type.members.all? { |member| memo_contents_immutable?(member) }
+        when Type::Nominal
+          slot = type.class_name == "Hash" ? 1 : 0
+          %w[Hash Array].include?(type.class_name) && !type.type_args[slot].nil? &&
+            memo_immutable_value?(type.type_args[slot])
+        when Type::Tuple then type.elements.all? { |element| memo_immutable_value?(element) }
+        when Type::HashShape then type.pairs.values.all? { |value| memo_immutable_value?(value) }
+        else false
+        end
+      end
+
+      def memo_immutable_value?(type)
+        case type
+        when Type::Union then type.members.all? { |member| memo_immutable_value?(member) }
+        when Type::Constant then MEMO_IMMUTABLE_CLASSES.include?(type.value.class.name)
+        when Type::Nominal then MEMO_IMMUTABLE_CLASSES.include?(type.class_name)
+        when Type::IntegerRange, Type::FloatRange then true
+        else false
+        end
+      end
+
+      # Issue #2411 — whether the block can change the memo where neither the join nor the callee floor sees it, so
+      # the memo answers its content floor ({#content_floor_for}) instead of the join. Read as an expression, the
+      # join's answer reaches every use of the call, and one that misses a store reports on correct code:
+      # `|x, h| g = h; g["s"] = "v"; h[:a] = 2` joined `Hash[:a, 2]`, and `.fetch("s").upcase` read `2`. Every read
+      # or write of the memo's name in its own scope ({#scope_nesting}) must be one the scan models
+      # ({#memo_read_modelled?}); a rebinding write (`h = {}`) is not, since the stores after it reach another object.
+      # Answers `:escape` for such a read or write, `:values` when the only unmodelled reads are readers whose value
+      # is used ({#memo_value_floor}), and nil when every read is modelled.
+      def memo_scan_reach(body, memo_param)
+        reach = nil
+        Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
+          next unless MEMO_NAME_NODES.any? { |klass| node.is_a?(klass) } && node.name == memo_param
+          next unless node.depth == scope_nesting(ancestors)
+
+          modelled = node.is_a?(Prism::LocalVariableReadNode) && memo_read_modelled?(node, ancestors)
+          return :escape unless modelled
+
+          reach = :values if modelled == :values
+        end
+        reach
+      end
+
+      # The nodes that read or bind a local by name. `LocalVariableTargetNode` covers a multi-assign and a `rescue =>`.
+      MEMO_NAME_NODES = [
+        Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode, Prism::LocalVariableTargetNode,
+        Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode
+      ].freeze
+      private_constant :MEMO_NAME_NODES
+
+      # The memo reads that cannot hand the object to anything the scan does not see. A call on the memo is one when
+      # it takes no block (`tap`, `each` and `then` yield it) and the scan knows the method: one whose value never is
+      # the memo ({MEMO_VALUE_READERS}), or a mutator the join or the seed widening reads ({CONTENT_MUTATORS},
+      # {MEMO_SEED_MUTATORS}) whose value, the memo for `h << x` and `h.merge!(s)`, is discarded
+      # ({#memo_value_discarded?}). Any other name is not: `h.send(:store, :t, "t")` stores what no scan sees. An index
+      # compound write on it is one. So is an argument of a self-call that resolves to a user def, whose census the
+      # callee floor reads ({#floor_memo_callee_escapes}), when the call's value is discarded: `keep(h)["s"] = "v"`
+      # stores through the value. Any other read — `g = h`, `[h]`, `Helper.fill(h, x)`, an unresolved self-call — is
+      # not.
+      def memo_read_modelled?(read, ancestors)
+        parent = ancestors.last
+        if parent.respond_to?(:receiver) && parent.receiver.equal?(read)
+          return true if INDEX_WRITE_NODES.any? { |klass| parent.is_a?(klass) }
+          return false unless parent.is_a?(Prism::CallNode) && parent.block.nil?
+
+          return memo_receiver_call_modelled?(parent, ancestors[0...-1])
+        end
+        memo_self_call_argument?(ancestors)
+      end
+
+      # True, false, or `:values` for a reader whose value is used: the value may be an element the block mutates.
+      # A mutator given a splat or `**` argument is not modelled: the join reads each argument by position, and
+      # `h.store(*kv)` stored a pair it never saw.
+      def memo_receiver_call_modelled?(call, ancestors)
+        mutator = CONTENT_MUTATORS.include?(call.name) || MEMO_SEED_MUTATORS.include?(call.name)
+        return false if mutator && memo_splat_arguments?(call)
+        return memo_value_discarded?(call, ancestors) || :values if MEMO_VALUE_READERS.include?(call.name)
+        return false unless mutator
+
+        memo_value_discarded?(call, ancestors)
+      end
+
+      def memo_splat_arguments?(call)
+        (call.arguments&.arguments || []).any? do |argument|
+          argument.is_a?(Prism::SplatNode) ||
+            (argument.is_a?(Prism::KeywordHashNode) && argument.elements.any?(Prism::AssocSplatNode))
         end
-        joined = join_memo_content(call_node, memo_param, calls, pre_state, shadows)
-        joined || call_type
       end
 
+      # Methods of Hash and Array whose value is never the receiver itself, so using it hands nothing on.
+      MEMO_VALUE_READERS = Set[
+        :[], :[]=, :store, :fetch, :dig, :key?, :has_key?, :include?, :member?, :key, :value?, :has_value?,
+        :size, :length, :count, :empty?, :any?, :none?, :keys, :values, :values_at, :fetch_values, :first, :last,
+        :delete, :pop, :shift, :to_s, :inspect, :hash, :==, :!=, :eql?, :equal?, :frozen?, :nil?, :is_a?,
+        :kind_of?, :instance_of?, :respond_to?, :class, :join, :sum, :min, :max, :dup, :clone
+      ].freeze
+      private_constant :MEMO_VALUE_READERS
+
+      # Iterators whose block's value the call never reads.
+      MEMO_BLOCK_VALUE_DROPPING = Set[
+        :each, :each_with_index, :each_pair, :each_key, :each_value, :each_index, :reverse_each, :each_slice,
+        :each_cons, :each_entry, :each_char, :each_line, :each_byte, :times, :upto, :downto, :step, :loop
+      ].freeze
+      private_constant :MEMO_BLOCK_VALUE_DROPPING
+
+      # Whether `node`'s value is dropped: a statement that is not its sequence's last, or the last one of a sequence
+      # whose own value is dropped, up through `if` / `unless` arms, `begin` / `rescue` bodies and parentheses, to the
+      # `each_with_object` block body, whose value the call never answers, or to the body of a nested block whose
+      # call never reads its value ({MEMO_BLOCK_VALUE_DROPPING}: `xs.each { |y| acc << y }`). Any other block's value
+      # may be the memo handed on (`map { acc << y }`).
+      def memo_value_discarded?(node, ancestors)
+        return true if ancestors.empty?
+
+        parent = ancestors.last
+        up = ancestors[0...-1]
+        case parent
+        when Prism::StatementsNode
+          return true unless parent.body.last.equal?(node)
+
+          block = up.last
+          return memo_value_discarded?(parent, up) unless block.is_a?(Prism::BlockNode)
+
+          up[-2].is_a?(Prism::CallNode) && MEMO_BLOCK_VALUE_DROPPING.include?(up[-2].name)
+        when Prism::IfNode, Prism::UnlessNode
+          !parent.predicate.equal?(node) && memo_value_discarded?(parent, up)
+        when Prism::ElseNode, Prism::BeginNode, Prism::RescueNode, Prism::ParenthesesNode
+          memo_value_discarded?(parent, up)
+        when Prism::EnsureNode then true
+        else false
+        end
+      end
+
+      # Whether the read under `ancestors` is a positional or keyword argument of a self-call resolving to a user def.
+      # Its value must be discarded: the callee may return the memo (`def keep(h) = h`) or wrap it.
+      def memo_self_call_argument?(ancestors)
+        depth = ancestors.size - 1
+        depth -= 2 if ancestors[depth].is_a?(Prism::AssocNode) && ancestors[depth - 1].is_a?(Prism::KeywordHashNode)
+        call = ancestors[depth - 1]
+        return false unless ancestors[depth].is_a?(Prism::ArgumentsNode) && call.is_a?(Prism::CallNode)
+        return false unless self_dispatch_call?(call) && memo_value_discarded?(call, ancestors[0...(depth - 1)])
+
+        !resolve_self_callees(call).empty?
+      end
+
+      # Issue #2411 — `memo` floored as a captured local is when the block hands it to a self-call whose callee
+      # mutates it ({#floor_callee_escaped_args_for_call}, the walk {#floor_block_body_callee_captures} makes): the
+      # join reads only the stores in the block, so `|x, out| record(out, x); out[[x, :e]] = 1` joined
+      # `Hash[[Integer, :e], 1]` while `record` stored other keys, and a memo the block only passed on kept its `{}`.
+      # Every read of the memo's name counts, a nested block's parameter shadowing it included: the floor only forgets.
+      # The walk runs on an evaluator whose scope binds the memo, since the floor reads only locals its scope binds.
+      def floor_memo_callee_escapes(body, memo_param, memo)
+        StatementEvaluator.new(scope: scope.with_local(memo_param, memo), tracer: tracer)
+                          .callee_floored_local(body, memo_param)
+      end
+
+      protected
+
+      # `name` as the self-calls in `body` leave it, each flooring the arguments its callee mutates
+      # ({#floor_memo_callee_escapes}).
+      def callee_floored_local(body, name)
+        floored = scope
+        each_node_in_caller_block(body, 0) do |node, _depth|
+          floored = floor_callee_escaped_args_for_call(node, floored)
+        end
+        floored.local(name)
+      end
+
+      private
+
       # `seed` as the {HashLookupMutation} calls `body` makes on `name` leave it. They add no content, so the join
       # never sees them as sites, and a seed read before `widen_after_block` is still the closed shape whose known
       # values answer every missing key: `b = { a: 1 }; [1].each { b.default = 0; b[:c] = 2 }` read `b[:zz]` as
       # `1 | 2`, and so did an `each_with_object({})` memo given a default beside its stores, and a `while` body. The
       # block receives a read's `depth` and its enclosing block count, and says whether the read is the variable
-      # `seed` describes. A `def` opens a scope of its own, so nothing under one is.
-      def lookup_mutated_seed(body, name, seed)
+      # `seed` describes. A `def` opens a scope of its own, so nothing under one is. `mutators` widens the call names
+      # read; the `each_with_object` memo passes {MEMO_SEED_MUTATORS}.
+      def lookup_mutated_seed(body, name, seed, mutators = HashLookupMutation::MUTATORS)
         Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
-          next unless node.is_a?(Prism::CallNode) && HashLookupMutation::MUTATORS.include?(node.name)
+          next unless node.is_a?(Prism::CallNode) && mutators.include?(node.name)
           next if ancestors.any?(Prism::DefNode)
 
           receiver = node.receiver
@@ -5723,21 +7892,19 @@ module Rigor
         second.respond_to?(:name) ? second.name : nil
       end
 
-      # Content-mutator calls on the block-local `var_name` within `body` — directly, or from a nested block that
-      # reaches it by exactly the scopes it is nested in. A nested block's own parameter of the same name is a
-      # different variable and does not count.
+      # Content mutations of the block-local `var_name` within `body` — directly, or from a nested block that reaches
+      # it by exactly the scopes it is nested in. A nested block's own parameter of the same name is a different
+      # variable and does not count. The sites are the ones {#captured_content_mutations} reads for a captured local
+      # ({#content_mutation_target}), the index compound writes included: scanning calls alone, `h[x] ||= []` was no
+      # store, and the memo kept its `{}`.
       def body_content_mutations_on(body, var_name, shadows)
         calls = []
         Source::NodeWalker.each_with_ancestors(body) do |descendant, ancestors|
-          next unless descendant.is_a?(Prism::CallNode)
-          next unless CONTENT_MUTATORS.include?(descendant.name)
-
-          receiver = descendant.receiver
-          next unless receiver.is_a?(Prism::LocalVariableReadNode)
-          next unless receiver.name == var_name && receiver.depth == scope_nesting(ancestors)
+          name, site = content_mutation_target(descendant) { |receiver| receiver.depth == scope_nesting(ancestors) }
+          next unless name == var_name
 
-          calls << descendant
-          record_shadows(shadows, descendant, ancestors)
+          calls << site
+          record_shadows(shadows, site, ancestors)
         end
         calls
       end
@@ -5877,6 +8044,29 @@ module Rigor
                            MutationWidening::HASH_MUTATORS)).freeze
       private_constant :CONTENT_MUTATORS
 
+      # The memo's seed widens on every shape mutator its scan does not read evidence from, as a captured local's
+      # binding does on the block seam ({MutationWidening.widen_after_block}): the {HashLookupMutation} calls, and the
+      # rewriters and removers (`merge!`, `update`, `delete`, `replace`, …) whose added content no join can read. Read
+      # off the memo argument alone, `xs.each_with_object({}) { |s, m| m.merge!(s) }` answered the empty `{}`.
+      MEMO_SEED_MUTATORS = (MutationWidening::SHAPE_MUTATORS - CONTENT_MUTATORS).freeze
+      private_constant :MEMO_SEED_MUTATORS
+
+      # Issue #2296 — the Set adders {CONTENT_MUTATORS} leaves out (`add`, `add?`, `merge`): a scan cannot see the
+      # receiver's class, and `merge` on a Hash returns a new Hash, so the callee census keeps them apart and floors
+      # only a Set argument on them.
+      SET_ONLY_ADDERS = (SetMutation::CONTENT_ADDERS - CONTENT_MUTATORS).freeze
+      private_constant :SET_ONLY_ADDERS
+
+      # Issue #2595 — every name the callee write census ({#callee_write_census}) counts as a write: the shape mutators
+      # the widening reads ({MutationWidening::SHAPE_MUTATORS}) and the content scans' own names. A Set-only adder
+      # stays out: `merge` on a Hash returns a new Hash.
+      CALLEE_WRITE_MUTATORS = (MutationWidening::SHAPE_MUTATORS | CONTENT_MUTATORS).freeze
+      # The tables {#callee_write_census} scans with.
+      CENSUS_TABLES = CalleeWriteCensus::Tables.new(mutators: CALLEE_WRITE_MUTATORS, handled: CONTENT_MUTATORS,
+                                                    fresh: FRESH_RESULTS, copiers: CENSUS_COPIERS,
+                                                    foreign_calls: METHOD_BODY_BLOCK_CALLS)
+      private_constant :CALLEE_WRITE_MUTATORS, :CENSUS_TABLES
+
       # The shared "not a content mutation" answer. This predicate runs on every node of every block, loop and
       # method body it censuses (~950k calls on the lib self-check) and almost always declines, so a fresh
       # `[nil, nil]` per decline was one of the largest allocation sites in the evaluator.