rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/scope_indexer.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../scope"
 require_relative "../type"
 require_relative "../source/alias_names"
+require_relative "../source/forwardable_delegators"
 require_relative "../source/literals"
 require_relative "../source/constant_path"
 require_relative "object_mixins"
@@ -12,9 +13,13 @@ require_relative "../source/node_children"
 require_relative "../source/node_walker"
 require_relative "../source/parameter_envelope"
 require_relative "../cache/file_digest"
+require_relative "../typing_state"
+require_relative "../memo_audit"
 require_relative "../analysis/check_rules/published_constant_guard"
 require_relative "anonymous_meta_class"
+require_relative "census_foreign_block"
 require_relative "def_handle"
+require_relative "definers_index"
 require_relative "fresh_frame_blocks"
 require_relative "global_write_census"
 require_relative "guard_rebinding"
@@ -25,6 +30,7 @@ require_relative "hash_lookup_mutation"
 require_relative "in_effect_refinements"
 require_relative "refine_census"
 require_relative "refine_self"
+require_relative "receiver_writer_call"
 require_relative "reflective_ivar_write"
 require_relative "index_write_widening"
 require_relative "module_function_state"
@@ -45,6 +51,9 @@ require_relative "scope_indexer/certainty"
 require_relative "scope_indexer/member_layouts_collector"
 require_relative "scope_indexer/declared_ivar_types"
 require_relative "scope_indexer/declared_param_writes"
+require_relative "scope_indexer/constant_ivar_value"
+require_relative "scope_indexer/ivar_contributions"
+require_relative "scope_indexer/empty_seed"
 
 module Rigor
   module Inference
@@ -67,8 +76,8 @@ module Rigor
     # ```
     #
     # Nodes that are not part of the program subtree (e.g. synthesised virtual nodes that the caller looks up after the
-    # fact) yield the `default_scope`. The returned Hash is mutable in principle but callers MUST treat it as read-only;
-    # the indexer itself never exposes a way to update it past construction.
+    # fact) yield the seeded `default_scope`. The returned Hash is mutable in principle but callers MUST treat it as
+    # read-only; the indexer itself never exposes a way to update it past construction.
     # rubocop:disable-next Metrics/ModuleLength
     module ScopeIndexer
       # Issue #644 — the census descriptor for a constant write that publishes no value: an unfoldable or
@@ -109,13 +118,15 @@ module Rigor
       #   `Dynamic[top]`. Off for every other reader, so parameter inference
       #   and sig-gen observe the clause's plain entry.
       # @return identity-comparing
-      #   table whose default value is `default_scope`.
+      #   table whose default value is the seeded `default_scope`.
       # The no-op re-anchoring table (#722 residue 2): shared so the overwhelmingly common
       # nothing-to-re-anchor walk allocates none.
       EMPTY_RENAMES = {}.freeze
 
       # No path whose contributions are all `possible` (issue #2021), the cross-file walks' default.
       EMPTY_PATH_SET = Set.new.freeze
+      # The {IvarWriterCensus} entry kinds the project pre-pass tags with the file that records them.
+      PATH_TAGGED_KINDS = %i[own_write own_write_type].to_set.freeze
 
       # `declared_ivar_types:` — whether an RBS-declared ivar type replaces the census's join of the writes (#1406).
       # `rigor sig-gen` passes false: it proposes what the code says, and reading a declaration back would make a row
@@ -222,20 +233,21 @@ module Rigor
       # nodes in `excluded`: the file's own pass, and each construct {#evaluate_unentered_flow} evaluates in the walk
       # after it.
       def recording_evaluator(table, converged_loop_recording, widen_clauses)
-        lambda do |node, scope, excluded = nil|
+        lambda do |node, scope, excluded = nil, block_only: false|
           on_enter =
             if excluded.nil? || excluded.empty? then ->(visited, at) { table[visited] = at }
             else ->(visited, at) { table[visited] = at unless excluded.include?(visited) }
             end
-          StatementEvaluator.new(scope: scope, on_enter: on_enter, converged_loop_recording: converged_loop_recording,
-                                 widen_clauses: widen_clauses).evaluate(node)
+          evaluator = StatementEvaluator.new(scope: scope, on_enter: on_enter, widen_clauses: widen_clauses,
+                                             converged_loop_recording: converged_loop_recording)
+          block_only ? evaluator.evaluate_block_of(node) : evaluator.evaluate(node)
         end
       end
 
       # Runs the combined methods/def-nodes descent (one walk of the file), seeds the discovered-methods existence table
-      # onto `seeded_scope` (merged UNDER the cross-file pre-pass seed `default_scope` carries), and returns `[scope,
-      # file_def_nodes, file_envelopes]` so the caller can thread the def-node and issue #992 envelope tables into
-      # {#merge_project_method_indexes} without walking the file a second time.
+      # onto `seeded_scope` (merged UNDER the cross-file pre-pass seed `default_scope` carries), and returns
+      # `[scope, [file_def_nodes, file_envelopes, file_siblings]]` so the caller can thread the def-node and issue #992
+      # envelope tables into {#merge_project_method_indexes} without walking the file a second time.
       #
       # ADR-119 WD3 — the file's `possible_discovered_methods` folds over the seed's by {#fold_possible_methods}, so a
       # name the file defines certainly is no longer possible and a name only the file's possible contribution
@@ -306,8 +318,8 @@ module Rigor
         siblings = per_file_siblings(seeded_scope.discovery.sibling_tables, file_tables[0], file_tables[2],
                                      file_singleton, file_visibilities)
         extends, methods_table, unpositioned =
-          merge_and_fold_extends(default_scope, root, def_nodes, singleton_def_nodes, seeded_scope, siblings,
-                                 mixin_unpositioned)
+          merge_and_fold_extends(default_scope, root, [def_nodes, file_tables[0]],
+                                 [singleton_def_nodes, file_singleton[0]], seeded_scope, siblings, mixin_unpositioned)
 
         seeded_scope.with_discovery(
           seeded_scope.discovery.with(
@@ -387,8 +399,9 @@ module Rigor
           default_scope.discovered_includes.merge(file[:includes]) do |_class, cross_file, per_file|
             (per_file + cross_file).uniq
           end,
+          # ADR-129 G4 — each merged list is frozen as the per-file walk's lists are ({#freeze_mixin_lists}).
           default_scope.discovered_prepends.merge(file[:prepends]) do |_class, cross_file, per_file|
-            (per_file + cross_file).uniq
+            (per_file + cross_file).uniq.freeze
           end,
           file[:unpositioned]
         ]
@@ -421,13 +434,23 @@ module Rigor
       # ADR-119 WD1 — the unpositioned union (the seed's, the mixin walks' and this file's extend side) is settled
       # first, because the fold reads it to tell a certain extend edge from a listed one. `siblings` is written by
       # the fold.
-      def merge_and_fold_extends(default_scope, root, def_nodes, singleton_def_nodes, seeded_scope, siblings,
+      # `def_pair` and `singleton_pair` are `[merged table, this file's own]`; the merged tables are frozen once the
+      # fold, their last in-place writer, is done ({#freeze_def_tables}).
+      def merge_and_fold_extends(default_scope, root, def_pair, singleton_pair, seeded_scope, siblings,
                                  mixin_unpositioned)
+        def_nodes = def_pair.first
+        singleton_def_nodes = singleton_pair.first
         file_extends, extends, extend_unpositioned = merge_extend_tables(default_scope, root)
         unpositioned = union_unpositioned(default_scope.discovery.unpositioned_mixins, *mixin_unpositioned,
                                           extend_unpositioned)
         methods_table = fold_per_file_extends(file_extends, def_nodes, singleton_def_nodes, seeded_scope, siblings,
                                               unpositioned)
+        # The fold also writes the singleton hash of each class this file `extend`s, declared there or not.
+        file_extends.each_key { |owner| singleton_def_nodes[owner]&.freeze }
+        freeze_def_tables(def_pair, singleton_pair)
+        # #2300 — the override gate's definers index then inverts the seed once per run, not once per file.
+        DefinersIndex.record_layers(def_nodes, default_scope.discovered_def_nodes)
+        DefinersIndex.record_layers(singleton_def_nodes, default_scope.discovered_singleton_def_nodes)
         [extends, methods_table, unpositioned]
       end
 
@@ -458,6 +481,20 @@ module Rigor
                                walked.fetch(:header_nestings)).freeze]
       end
 
+      # Issue #2330 — the per-file def table is read by identity: the callee-chain census memo is keyed by the
+      # {Scope::DiscoveryIndex} that carries it, which is only sound while the table is never written in place.
+      # Frozen after the extends fold, the last in-place writer; the seed's per-class hashes are frozen already.
+      #
+      # Only the per-class hashes of the classes this file declares are frozen here (the merge made or took
+      # them); a seed-only class's hash was frozen by `finalize_def_index`, so walking the whole table per file is
+      # needless.
+      def freeze_def_tables(*pairs)
+        pairs.each do |table, file_table|
+          file_table.each_key { |owner| table[owner].freeze }
+          table.freeze
+        end
+      end
+
       # The instance-side def-node table and its issue #681 nesting twin, each merged over the cross-file seed.
       # Returned as a pair so the two stay written together: a node the merge keeps must be the same object the
       # nesting table keys, and they are only that if both halves take the same file's walk.
@@ -529,25 +566,45 @@ module Rigor
         mutated_ivars = {}
         read_before_write = {}
         init_writes = {}
-        # WD3 — per-class summary of `{class_name => {method_name => Set<ivar names definitely assigned non-nil on every
-        # completing path>}}`, consulted by `dead_transient_nil_writes` so a ctor that reassigns `@x` indirectly through
-        # an unconditional same-class method call (`mask!`) credits the overwrite. Built once per program here, memoised
-        # by class.
+        # WD3 — per class, then per method, the ivars the method definitely assigns non-nil on every completing path,
+        # consulted by `dead_transient_nil_writes` so a ctor that reassigns `@x` indirectly through an unconditional
+        # same-class method call (`mask!`) credits the overwrite. Built once per program here, memoised by class.
         method_assign_effects = build_method_assign_effects(root)
+        # #2291 — an `@x = LIT` write reads the file's constant table, built on the first such write.
+        accumulator[CONSTANT_IVAR_VALUES] = ConstantIvarValue.new(root, default_scope)
         walk_class_ivars(root, [], default_scope, accumulator, mutated_ivars,
                          read_before_write, init_writes, method_assign_effects)
+        accumulator.delete(CONSTANT_IVAR_VALUES)
         reflective_opaque = accumulator.delete(REFLECTIVE_OPAQUE_CLASSES)
+        singleton_writes = accumulator.delete(SINGLETON_IVAR_WRITES)
         exempt_class_body_writes!(init_writes, accumulator.delete(DEFINE_METHOD_WRITES) || {})
         merge_held_ivar_writes!(accumulator)
         record_aliased_ivar_mutations!(root, mutated_ivars)
         widen_mutated_ivar_entries!(accumulator, mutated_ivars)
+        # #2170 — an ancestor's writes as this file's census types them, before its read-before-write `nil`.
+        writes = instance_side_writes(accumulator, singleton_writes)
         contribute_read_before_write_nil!(accumulator, read_before_write, init_writes)
         make_reflective_classes_gradual!(accumulator, reflective_opaque)
+        # #2079 / #2170 — another file's writes, and the chain's modules' and superclasses', join existing entries.
+        IvarContributions.join!(accumulator, writes, default_scope)
+        # An in-place mutation the file observes widens a joined value too (a same-file ancestor's String literal).
+        widen_mutated_ivar_entries!(accumulator, mutated_ivars)
         # #1406 — an RBS `@x: T` or `attr_* x: T` declaration replaces the census's join of the writes.
         DeclaredIvarTypes.apply!(accumulator, default_scope) if declared_ivar_types
         accumulator.transform_values(&:freeze).freeze
       end
 
+      # #2170 — a copy of the census entries for {IvarContributions} to join as an ancestor's own. #2931 — an ivar a
+      # singleton-side `def` of the class writes is left out: its entry joins that write, which runs on the module or
+      # class object and never on an includer's instance, so the join reads the file's instance-side census entries
+      # for it, as another file's reader does.
+      def instance_side_writes(accumulator, singleton_writes)
+        accumulator.to_h do |class_name, entries|
+          skipped = singleton_writes&.[](class_name)
+          [class_name, skipped ? entries.except(*skipped) : entries.dup]
+        end
+      end
+
       # Folds the class-body writes {#collect_class_body_ivar_writes} held under {CLASS_BODY_WRITES} into the
       # `init_writes` exemption, except for an ivar a `define_method` block, or a `block_as_methods:` block bound to the
       # receiver's instance ({#method_body_block_call?}), of the class writes (#1768). Such an ivar had no census entry
@@ -628,8 +685,8 @@ module Rigor
         end
       end
 
-      # `{class_name => {method_name => Set<ivar name>}}` for methods that hand an ivar back, dropping the empty sets
-      # so the caller's `next if per_class.nil?` skips a whole class in one lookup.
+      # Per class, then per method, the ivars each method hands back, dropping the empty sets so the caller's
+      # `next if per_class.nil?` skips a whole class in one lookup.
       def returned_ivars_by_method(defs)
         defs.each_with_object({}) do |(class_name, methods), acc|
           methods.each do |method_name, def_node|
@@ -718,9 +775,8 @@ module Rigor
       # The widening uses `MutationWidening.widen_for_mutator` — the same primitive
       # `Inference::StatementEvaluator#eval_call` applies for per-method-body widening on a local / ivar receiver. The
       # class-level pass extends that primitive's reach so a `Tuple`-seeded ivar in `initialize` is observed as
-      # `Nominal[Array]` at the entry of every OTHER method body in the class — closing the cross-method gap noted in
-      # ROADMAP § Future cycles / Type-language / engine ("Tuple / HashShape widening for ivar-seeded literals after
-      # mutation"; Redmine 6.1.2 `Redmine::Views::Builders::Structure` is the canonical worked site).
+      # `Nominal[Array]` at the entry of every OTHER method body in the class — closing the cross-method gap
+      # (Redmine 6.1.2 `Redmine::Views::Builders::Structure` is the canonical worked site).
       #
       # Always-safe: the widening can only LOSE precision; the underlying nominal (`Array` / `Hash`) and the element
       # union are preserved.
@@ -765,18 +821,27 @@ module Rigor
           end
 
           widen_member_for_lookup_mutators(member, observed_methods)
-        when Type::Constant
-          # `@s = +"ab"` in one method and `@s << "c"` in another: without this arm the seed stayed pinned at every
-          # other method's entry, and `@s == "ab"` folded always-truthy on a receiver that holds `"abc"`.
-          return member unless StringMutation.constant?(member) &&
-                               observed_methods.any? { |m| StringMutation::MUTATORS.include?(m) }
-
-          Type::Combinator.nominal_of("String")
+        when Type::Constant then widen_constant_for_observed_mutators(member, observed_methods)
         else
           member
         end
       end
 
+      # `@s = +"ab"` in one method and `@s << "c"` in another: without this arm the seed stayed pinned at every other
+      # method's entry, and `@s == "ab"` folded always-truthy on a receiver that holds `"abc"`. A constant-folded Set
+      # (`@s = Set["a"]`, then `@s.clear; @s << 1` elsewhere — issue #2294) takes the untyped floor the Tuple arm takes.
+      def widen_constant_for_observed_mutators(member, observed_methods)
+        if SetMutation.constant?(member)
+          return member unless observed_methods.any? { |m| SetMutation::MUTATORS.include?(m) }
+
+          return Type::Combinator.nominal_of("Set", type_args: [Type::Combinator.untyped])
+        end
+        return member unless StringMutation.constant?(member) &&
+                             observed_methods.any? { |m| StringMutation::MUTATORS.include?(m) }
+
+        Type::Combinator.nominal_of("String")
+      end
+
       # A `HashShape` ivar seed some method gave a default, a default proc or identity keys, and no method stored
       # into, removed from or rewrote: its pairs are the seed's own, so it takes the per-method {HashLookupMutation}
       # widening rather than the untyped floor above — a present key keeps its value across methods, a missing one
@@ -903,6 +968,7 @@ module Rigor
           collect_initializer_block_ivars(node, owner, default_scope, accumulator, mutated_ivars, init_writes)
           record_attr_writer_ivars(node, owner, accumulator) if ATTR_WRITER_MACROS.include?(attr_macro(node))
           collect_define_method_block_ivars(node, owner, default_scope, accumulator, mutated_ivars)
+          collect_receiver_writer_ivars(node, owner, qualified_prefix, default_scope, accumulator, mutated_ivars)
           false
         else
           walk_ivars_meta_new?(node, qualified_prefix, default_scope, accumulator,
@@ -1031,6 +1097,8 @@ module Rigor
                                   read_before_write = nil, init_writes = nil, method_assign_effects = nil,
                                   singleton_self: false)
         return if def_node.body.nil? || qualified_prefix.empty?
+        # Issue #3155 — `def String.q` writes the ivars of another object.
+        return if foreign_def?(def_node, qualified_prefix, false)
 
         class_name = qualified_prefix.join("::")
         singleton = singleton_self || def_node.receiver.is_a?(Prism::SelfNode) ||
@@ -1057,6 +1125,10 @@ module Rigor
         declared = DeclaredParamWrites.collect(def_node, class_name, body_scope) unless singleton
         gather_ivar_writes(def_node.body, body_scope, class_name, accumulator,
                            EMPTY_GUARDED_IVARS, mutated_ivars, dead_writes, declared)
+        if singleton
+          singleton_written = (accumulator[SINGLETON_IVAR_WRITES] ||= {})[class_name] ||= Set.new
+          define_method_written_ivars(def_node.body, singleton_written)
+        end
 
         # B2.3 — collect per-method evidence for the read-before- write nil contribution. The accumulator-level decision
         # ("is this ivar truly read-before-write across the class lifetime?") is finalised at
@@ -1083,7 +1155,7 @@ module Rigor
 
         seen_writes = Set.new
         read_first = Set.new
-        detect_read_before_write(block_node.body, seen_writes, read_first)
+        detect_read_before_write(block_node.body, seen_writes, read_first, class_name)
         init_set = (init_writes[class_name] ||= Set.new)
         seen_writes.each { |name| init_set << name }
       end
@@ -1146,6 +1218,29 @@ module Rigor
         define_method_written_ivars(block.body, written)
       end
 
+      # Issue #2488 — the explicit-receiver arm of {#walk_class_ivars}: `E.attr_writer :w` (or through `send`) records
+      # `@w` as `Dynamic[top]` on `E`, as an `attr_writer` in `E`'s body does ({#record_attr_writer_ivars}), and an
+      # `E.define_method(:m) { … }` block is walked as an instance body of `E`, as one in `E`'s body is
+      # ({#collect_define_method_block_ivars}). `E` resolves as a `class_eval` receiver does; an unnameable one
+      # contributes nothing. A call inside a `def` is that body's to walk.
+      def collect_receiver_writer_ivars(node, owner, qualified_prefix, default_scope, accumulator, mutated_ivars)
+        return if ReceiverWriterCall.receiver(node).nil?
+
+        target = eval_receiver_prefix(node, owner, qualified_prefix, unnameable_self: owner.empty?)
+        return if target.nil? || target.empty?
+
+        class_name = target.join("::")
+        ReceiverWriterCall.writer_ivars(node).each do |ivar|
+          accumulate_ivar_type(accumulator, class_name, ivar, Type::Combinator.untyped)
+        end
+        body = ReceiverWriterCall.define_method_block(node)&.body
+        return if body.nil?
+
+        body_scope = census_body_scope(default_scope, target, Type::Combinator.nominal_of(class_name))
+        gather_ivar_writes(body, body_scope, class_name, accumulator, EMPTY_GUARDED_IVARS, mutated_ivars)
+        define_method_written_ivars(body, (accumulator[DEFINE_METHOD_WRITES] ||= {})[class_name] ||= Set.new)
+      end
+
       # The ivars a `define_method` block body writes, in any write form, outside a nested `def` / `class` / `module`.
       def define_method_written_ivars(node, acc)
         return unless node.is_a?(Prism::Node)
@@ -1191,7 +1286,7 @@ module Rigor
 
         seen_writes = Set.new
         read_first = Set.new
-        detect_read_before_write(def_node.body, seen_writes, read_first)
+        detect_read_before_write(def_node.body, seen_writes, read_first, class_name)
 
         # ADR-38 — `initialize` is the built-in initializer gate; a plugin may declare additional `def`-form initializer
         # methods (minitest `setup`, Rails `after_initialize`, DI setters) on a constrained class. Both fold their
@@ -1306,7 +1401,7 @@ module Rigor
         )
       end
 
-      def detect_read_before_write(node, seen_writes, read_first)
+      def detect_read_before_write(node, seen_writes, read_first, class_name = nil)
         return unless node.is_a?(Prism::Node)
         return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
 
@@ -1316,20 +1411,21 @@ module Rigor
         # not `InstanceVariableWriteNode`s, so the generic descent below never records them as writes. Left unhandled,
         # an ivar written only via massign in `initialize` stays absent from `init_writes`, and
         # `contribute_read_before_write_nil!` then unions a spurious `nil` into its class-ivar seed — masking a
-        # genuinely-typed `@m` (e.g. `Tuple[]`) as `T | nil` at every sibling read. The RHS runs before any target is
-        # committed, so descend into `value` FIRST (an ivar read there is read-before-write), then mark every ivar
-        # target as written.
+        # genuinely-typed `@m` (e.g. `Tuple[]`) as `T | nil` at every sibling read. The RHS runs before any
+        # target is committed, so descend into `value` FIRST (an ivar read there is read-before-write), then mark every
+        # ivar target as written.
         if node.is_a?(Prism::MultiWriteNode)
-          detect_read_before_write(node.value, seen_writes, read_first) if node.value
-          detect_multi_write_target_writes(node, seen_writes, read_first)
+          detect_read_before_write(node.value, seen_writes, read_first, class_name) if node.value
+          detect_multi_write_target_writes(node, seen_writes, read_first, class_name)
           return
         end
 
         # Descend BEFORE recording a write — `@x = @x + 1`'s RHS is an `InstanceVariableReadNode` that runs before the
         # write is committed; the read is therefore read-before-write semantically. `each_child` yields the value
         # child before the lvalue target (`compact_child_nodes` field order), matching this order.
-        node.rigor_each_child do |c|
-          detect_read_before_write(c, seen_writes, read_first)
+        # #2490 — what a block whose `self` is another object reads or writes is that object's.
+        each_census_child(node, class_name) do |c|
+          detect_read_before_write(c, seen_writes, read_first, class_name)
         end
 
         seen_writes << node.name if IVAR_WRITE_NODES.any? { |klass| node.is_a?(klass) }
@@ -1341,19 +1437,19 @@ module Rigor
       # Records each ivar target of a `MultiWriteNode` / nested `MultiTargetNode` into `seen_writes`, and descends into
       # any non-ivar target (a `CallTargetNode` / `IndexTargetNode` receiver such as `@obj.x, @y = …`) so an ivar read
       # inside a target receiver still counts as read-before-write.
-      def detect_multi_write_target_writes(node, seen_writes, read_first)
+      def detect_multi_write_target_writes(node, seen_writes, read_first, class_name = nil)
         targets = (node.lefts || []) + [node.rest].compact + (node.rights || [])
         targets.each do |target|
           case target
           when Prism::InstanceVariableTargetNode
             seen_writes << target.name
           when Prism::MultiTargetNode
-            detect_multi_write_target_writes(target, seen_writes, read_first)
+            detect_multi_write_target_writes(target, seen_writes, read_first, class_name)
           when Prism::SplatNode
             inner = target.expression
             seen_writes << inner.name if inner.is_a?(Prism::InstanceVariableTargetNode)
           else
-            detect_read_before_write(target, seen_writes, read_first)
+            detect_read_before_write(target, seen_writes, read_first, class_name)
           end
         end
       end
@@ -1361,6 +1457,21 @@ module Rigor
       IVAR_BARRIER_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode].freeze
       private_constant :IVAR_BARRIER_NODES
 
+      # Issue #2490 — yields the children of `node` a census walk for `class_name` descends into: all of them, or only
+      # those {CensusForeignBlock.census_children} keeps when `node` runs code whose `self` is another object. A nil
+      # `class_name` keeps them all. A reentered `def` (#2941) is yielded as itself, so a walk that stops at a `def`
+      # skips it; `def_bodies:` yields its body instead, for a walk that counts its writes. `reentry: false` (a
+      # singleton-side `def`) keeps none of the reentered code.
+      def each_census_child(node, class_name, def_bodies: false, reentry: true, &)
+        outside = class_name && CensusForeignBlock.census_children(node, class_name, reentry: reentry)
+        return node.rigor_each_child(&) unless outside
+
+        outside.each do |child|
+          child = child.body if def_bodies && child.is_a?(Prism::DefNode)
+          yield child if child
+        end
+      end
+
       EMPTY_GUARDED_IVARS = Set.new.freeze
 
       # Shared empty result for a def that returns no ivar — the overwhelmingly common case.
@@ -1394,6 +1505,7 @@ module Rigor
         # array/tuple-shaped, else the unanalyzable floor (the same `Dynamic[top]` a single write to an unknown RHS
         # records — an unanalyzable multi-write means unknown, not nil).
         record_multi_write_ivars(node, scope, class_name, accumulator)
+        record_binding_target_ivars(node, scope, class_name, accumulator)
 
         record_ivar_mutator_call(node, class_name, mutated_ivars) if mutated_ivars
 
@@ -1406,7 +1518,10 @@ module Rigor
           return
         end
 
-        node.rigor_each_child do |c|
+        # #2490 — a block or `class <<` body whose `self` is another object writes that object's ivars. #2941 — a `def`
+        # in it that runs on a `class_name` instance again counts its writes.
+        # The reentry is for code that runs on an instance again, so a singleton-side `def` takes none.
+        each_census_child(node, class_name, def_bodies: true, reentry: !scope.self_type.is_a?(Type::Singleton)) do |c|
           gather_ivar_writes(c, scope, class_name, accumulator, guarded_ivars, mutated_ivars, dead_writes, declared)
         end
       end
@@ -1445,13 +1560,21 @@ module Rigor
         method_name, receiver = mutation_target(node)
         return if method_name.nil?
         return unless receiver.is_a?(Prism::InstanceVariableReadNode)
-        return unless MutationWidening::SHAPE_MUTATORS.include?(method_name)
+        return unless ivar_census_mutator?(method_name)
 
         per_class = (mutated_ivars[class_name] ||= {})
         per_ivar = (per_class[receiver.name] ||= Set.new)
         per_ivar << method_name
       end
 
+      # The Set-only names (`add`, `merge`, … — issue #2294) are recorded here rather than in `SHAPE_MUTATORS`, which
+      # every scan reads by name alone: there `merge` would make `Hash#merge`, which returns a new Hash, a mutation of
+      # its receiver. The census is safe to over-collect, since {#widen_member_for_observed_mutators} reads each name
+      # against the table of the carrier it widens.
+      def ivar_census_mutator?(method_name)
+        MutationWidening::SHAPE_MUTATORS.include?(method_name) || SetMutation::MUTATORS.include?(method_name)
+      end
+
       # `[mutator name, receiver node]` for a node that mutates its receiver, `nil` otherwise.
       #
       # `@h[k] ||= v` and its `&&=` / `+=` siblings store through `[]=` but are not `[]=` CallNodes; missing them left
@@ -1586,10 +1709,9 @@ module Rigor
       SAME_CLASS_CALL_DEPTH_CAP = 3
       private_constant :SAME_CLASS_CALL_DEPTH_CAP
 
-      # WD3 — builds the per-class definite-assignment summary `{class_name => {method_name => Set<ivar names assigned
-      # non-nil on every completing path>}}`. Used so a ctor's `dead_transient_nil_writes` can credit an indirect
-      # overwrite through an unconditionally-called same-class method (ipaddr's `initialize` reassigns `@mask_addr` via
-      # `mask!`).
+      # WD3 — builds the per-class definite-assignment summary: per class, then per method, the ivars assigned non-nil
+      # on every completing path. Used so a ctor's `dead_transient_nil_writes` can credit an indirect overwrite through
+      # an unconditionally-called same-class method (ipaddr's `initialize` reassigns `@mask_addr` via `mask!`).
       #
       # Each method's set is computed by the same suffix definite-assignment analysis used for the ctor seed, run from
       # the method body's first statement for every ivar the method writes anywhere. Same-class calls inside a method
@@ -1976,10 +2098,11 @@ module Rigor
       end
 
       def record_ivar_write(node, scope, class_name, accumulator, guarded: false, declared: nil)
-        rvalue_type = declared || scope.type_of(node.value)
+        rvalue_type = declared || accumulator[CONSTANT_IVAR_VALUES]&.type_of(node.value, scope) ||
+                      scope.type_of(node.value)
 
         # `@x = nil unless @x` / `@y = false unless @y` — follow-up to the polarity-aware defensive-init guard fix
-        # (ROADMAP § Future cycles — "Defensive ivar-init with nil / false rvalue"). When the rvalue is itself a falsey
+        # (defensive ivar-init with a nil / false rvalue). When the rvalue is itself a falsey
         # Constant, `union(rvalue, Constant[nil])` collapses (for `nil`) or doesn't widen the type's truthiness profile
         # (for `false`) — the predicate `unless @x` then folds to a single `Constant[nil]` / `Constant[false]` and the
         # `flow.always-truthy-condition` / `-always-falsey-` rule false-fires on the no-op-but-documented-default idiom.
@@ -1989,6 +2112,8 @@ module Rigor
         # `lib/tdiary/configuration.rb:157` for the worked site.
         return if guarded && falsey_constant?(rvalue_type)
 
+        rvalue_type = EmptySeed.erase(node.value, rvalue_type)
+
         rvalue_type = Type::Combinator.union(rvalue_type, Type::Combinator.constant_of(nil)) if guarded
         accumulate_ivar_type(accumulator, class_name, node.name, rvalue_type)
       end
@@ -2018,7 +2143,7 @@ module Rigor
       # `nil`, the guard bound its own ivar, and `ExpressionTyper#compound_write_value` read
       # `truthy(nil) | bot` — an instance method that sig-gen declared `-> bot`.
       def record_ivar_or_write(node, scope, class_name, accumulator)
-        rvalue_type = scope.type_of(node.value)
+        rvalue_type = EmptySeed.erase(node.value, scope.type_of(node.value))
         return if Narrowing.narrow_truthy(rvalue_type).is_a?(Type::Bot)
 
         accumulate_ivar_type(accumulator, class_name, node.name,
@@ -2182,7 +2307,13 @@ module Rigor
       CLASS_BODY_WRITES = :class_body_writes
       # The classes a computed-name `instance_variable_set` may write any ivar of ({#record_reflective_ivar_write}).
       REFLECTIVE_OPAQUE_CLASSES = :reflective_opaque_classes
-      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES, :REFLECTIVE_OPAQUE_CLASSES
+      # The census's {ConstantIvarValue}, which {#record_ivar_write} reads.
+      CONSTANT_IVAR_VALUES = :constant_ivar_values
+      # Issue #2931 — per class, the ivars a singleton-side `def` (`def self.x`) of it writes, which the census files
+      # under the class too (#1958).
+      SINGLETON_IVAR_WRITES = :singleton_ivar_writes
+      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES, :REFLECTIVE_OPAQUE_CLASSES, :CONSTANT_IVAR_VALUES,
+                       :SINGLETON_IVAR_WRITES
 
       # Unions `type` into the class-ivar accumulator for `(class_name, ivar_name)`. Shared by the single-write and
       # multi-write (parallel-assignment) collectors.
@@ -2215,9 +2346,65 @@ module Rigor
 
         rhs_type = scope.type_of(node.value)
         ivars = MultiTargetBinder.bind_marked(node, rhs_type, scope: scope, soften_slots: false).ivars
-        ivars.each { |name, type| accumulate_ivar_type(accumulator, class_name, name, type) }
+        # #2499 — `@a, @b = {}, []` erases each empty seed as a single write does.
+        values = EmptySeed.multi_write_values(node)
+        ivars.each do |name, type|
+          accumulate_ivar_type(accumulator, class_name, name, EmptySeed.erase(values[name], type))
+        end
+      end
+
+      # Issue #1217 — `rescue => @err` and `for @x in xs` (with `for *@x in`, `for @x, y in`) write the ivar through a
+      # target node, not an `InstanceVariableWriteNode`, so the census missed them: a sibling method read the
+      # constructor's `@err = nil` alone and folded `if @err` always-falsey. A rescue reference contributes the
+      # exception instance type the clause names; a `for` index the `Dynamic[top]` floor, since the census does not
+      # type the element, and an unknown value is honest where a missing one is not.
+      def record_binding_target_ivars(node, scope, class_name, accumulator)
+        names = BindingTargets.names(node, Prism::InstanceVariableTargetNode)
+        return if names.empty?
+
+        type = BindingTargets.value_type(node, scope)
+        names.each { |name| accumulate_ivar_type(accumulator, class_name, name, type) }
       end
 
+      # The names a `rescue =>` reference or a `for` index binds through a target of `target_class`, looking through
+      # a splat and a multi-target index.
+      module BindingTargets
+        EMPTY = [].freeze
+        private_constant :EMPTY
+
+        module_function
+
+        def names(node, target_class)
+          root =
+            case node
+            when Prism::RescueNode then node.reference
+            when Prism::ForNode then node.index
+            end
+          return EMPTY if root.nil?
+
+          collect(root, target_class, [])
+        end
+
+        # What an ivar target is written with: a rescue reference's exception instance, as the in-method binding
+        # types it ({ErrorInfo.rescue_exception_type}), a `for` index's `Dynamic[top]` floor.
+        def value_type(node, scope)
+          return Type::Combinator.untyped unless node.is_a?(Prism::RescueNode)
+
+          ErrorInfo.rescue_exception_type(node) { |exception_node| scope.type_of(exception_node) }
+        end
+
+        def collect(target, target_class, acc)
+          case target
+          when target_class then acc << target.name
+          when Prism::SplatNode then collect(target.expression, target_class, acc) if target.expression
+          when Prism::MultiTargetNode
+            [*target.lefts, target.rest, *target.rights].compact.each { |t| collect(t, target_class, acc) }
+          end
+          acc
+        end
+      end
+      private_constant :BindingTargets
+
       def falsey_constant?(type)
         type.is_a?(Type::Constant) && (type.value.nil? || type.value == false)
       end
@@ -2242,7 +2429,7 @@ module Rigor
       def legacy_class_cvar_index(root, default_scope)
         accumulator = {}
         walk_class_cvars(root, [], default_scope, accumulator)
-        accumulator.transform_values(&:freeze).freeze
+        finished_cvar_census(accumulator)
       end
 
       # `def_owner` names the class a `def` leaf's cvar writes belong to when `self` is
@@ -2320,6 +2507,8 @@ module Rigor
         _self_decl, child_prefix, child_cref = ctx
         return true unless node.body
 
+        collect_body_cvar_writes(node.body, child_cref ? [] : child_prefix,
+                                 scope_entering_declaration(default_scope, node.constant_path), accumulator)
         walk_class_cvars(node.body, child_cref ? [] : child_prefix,
                          scope_entering_declaration(default_scope, node.constant_path), accumulator,
                          singleton_cref: child_cref)
@@ -2369,24 +2558,89 @@ module Rigor
         class_name = qualified_prefix.join("::")
         body_scope = census_body_scope(default_scope, qualified_prefix,
                                        Type::Combinator.nominal_of(class_name))
-        gather_cvar_writes(def_node.body, body_scope, class_name, accumulator)
+        gather_cvar_writes(def_node.body, body_scope, class_name, accumulator, join_only: false)
+      end
+
+      # Issue #3204 — the writes a `class` / `module` body makes outside its `def`s (`@@x = nil` at the top of
+      # the body, in a block or a `class << self` there): Ruby resolves each through the body's lexical cref,
+      # so it is the same cvar a sibling `def` reads. Such a write only joins an entry a `def` body's write of
+      # the same class creates: the census misses most of the other ways a cvar is written
+      # (`||=`, `+=`, an including class, a subclass, another file, `class_variable_set` from outside), so a
+      # body-only seed would be precise where Ruby's value is not, and stays unbound. The rvalue is typed with
+      # the class itself as `self`. The gather stops at `def`, `class` and `module`, which their own events enter.
+      def collect_body_cvar_writes(body, qualified_prefix, default_scope, accumulator)
+        return if body.nil? || qualified_prefix.empty?
+
+        class_name = qualified_prefix.join("::")
+        body_scope = census_body_scope(default_scope, qualified_prefix,
+                                       Type::Combinator.singleton_of(class_name))
+        gather_cvar_writes(body, body_scope, class_name, accumulator, join_only: true)
       end
 
-      def gather_cvar_writes(node, scope, class_name, accumulator)
+      def gather_cvar_writes(node, scope, class_name, accumulator, join_only:)
         return unless node.is_a?(Prism::Node)
 
-        record_cvar_write(node, scope, class_name, accumulator) if node.is_a?(Prism::ClassVariableWriteNode)
+        if node.is_a?(Prism::ClassVariableWriteNode)
+          record_cvar_write(accumulator, class_name, node.name, EmptySeed.erase(node.value, scope.type_of(node.value)),
+                            join_only: join_only)
+        end
+        record_reflective_cvar_write(node, scope, class_name, accumulator) if node.is_a?(Prism::CallNode)
+        # Issue #1217 — `rescue => @@c` / `for @@c in xs` write through a target node. Each enters as the
+        # `Dynamic[top]` floor, the rescue reference too: the census keys each class alone, so a superclass's
+        # `@@c = nil` is not in a subclass's entry, and a typed exception entry would read as non-nil there.
+        BindingTargets.names(node, Prism::ClassVariableTargetNode).each do |name|
+          record_cvar_write(accumulator, class_name, name, Type::Combinator.untyped, join_only: join_only)
+        end
         return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
 
-        node.rigor_each_child { |c| gather_cvar_writes(c, scope, class_name, accumulator) }
+        node.rigor_each_child { |c| gather_cvar_writes(c, scope, class_name, accumulator, join_only: join_only) }
       end
 
-      def record_cvar_write(node, scope, class_name, accumulator)
-        rvalue_type = scope.type_of(node.value)
-        accumulator[class_name] ||= {}
-        existing = accumulator[class_name][node.name]
-        accumulator[class_name][node.name] =
-          existing ? Type::Combinator.union(existing, rvalue_type) : rvalue_type
+      # Issue #3204 — `class_variable_set(:@@x, v)` on an implicit or `self` receiver writes the cvar a sibling
+      # `def` reads, as `@@x = v` does. It only joins, like a class-body write: a dynamic name, a `send`, an
+      # explicit receiver or another file may write the same cvar unseen.
+      def record_reflective_cvar_write(node, scope, class_name, accumulator)
+        return unless node.name == :class_variable_set && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+
+        args = node.arguments&.arguments
+        return unless args&.size == 2
+
+        name_node, value = args
+        # A name that is not a cvar's never meets a `def` write's entry, so the join drops it.
+        name = name_node.unescaped if name_node.is_a?(Prism::SymbolNode) || name_node.is_a?(Prism::StringNode)
+        return unless name
+
+        record_cvar_write(accumulator, class_name, name.to_sym, EmptySeed.erase(value, scope.type_of(value)),
+                          join_only: true)
+      end
+
+      # A class-body or `class_variable_set` write no `def` body's write has met yet (issue #3204): it joins an
+      # entry a creating write makes later, and {#finished_cvar_census} drops it when none does.
+      JoinOnlyCvarWrite = Data.define(:type)
+      private_constant :JoinOnlyCvarWrite
+
+      # Every census write unions with what the entry already holds, so the seed does not depend on the order of
+      # the writes. A `join_only` write (a class or module body's, or `class_variable_set`) never creates an entry
+      # on its own: it is held as a {JoinOnlyCvarWrite} until a `def` body's write of the same cvar arrives.
+      def record_cvar_write(accumulator, class_name, name, type, join_only:)
+        entries = (accumulator[class_name] ||= {})
+        existing = entries[name]
+        entries[name] =
+          if existing.nil? then join_only ? JoinOnlyCvarWrite.new(type) : type
+          elsif existing.is_a?(JoinOnlyCvarWrite)
+            joined = Type::Combinator.union(existing.type, type)
+            join_only ? JoinOnlyCvarWrite.new(joined) : joined
+          else Type::Combinator.union(existing, type)
+          end
+      end
+
+      # The census as the discovery index holds it: each cvar only joining writes reached dropped, each class's
+      # entry frozen, then the whole.
+      def finished_cvar_census(accumulator)
+        accumulator.filter_map do |class_name, entries|
+          kept = entries.reject { |_, type| type.is_a?(JoinOnlyCvarWrite) }
+          [class_name, kept.freeze] unless kept.empty?
+        end.to_h.freeze
       end
 
       # The program-global pre-pass's tables on the seeded scope's discovery index, and each global materialised into
@@ -2504,7 +2758,7 @@ module Rigor
       end
 
       def record_global_write(node, scope, accumulator)
-        rvalue_type = scope.type_of(node.value)
+        rvalue_type = EmptySeed.erase(node.value, scope.type_of(node.value))
         existing = accumulator[node.name]
         accumulator[node.name] =
           existing ? Type::Combinator.union(existing, rvalue_type) : rvalue_type
@@ -3269,7 +3523,7 @@ module Rigor
         unless owner.empty?
           body_scope = census_body_scope(default_scope, enclosing_prefix, Type::Combinator.singleton_of(owner))
         end
-        rvalue_type = meta_new_constant_type(node, full) || body_scope.type_of(node.value)
+        rvalue_type = meta_new_constant_type(node, full) || EmptySeed.erase(node.value, body_scope.type_of(node.value))
         existing = accumulator[full]
         accumulator[full] = existing ? Type::Combinator.union(existing, rvalue_type) : rvalue_type
       end
@@ -3443,6 +3697,31 @@ module Rigor
          tables.siblings]
       end
 
+      # Issue #3015 — the bodies of a concern's `included` / `prepended` / `class_methods` blocks, each with the prefix
+      # of the module whose body writes it ({ScopeIndexer#concern_hook_blocks}). Ruby runs such a block on the includer
+      # (or on `Owner::ClassMethods`), so a `def self.x` or `class << self` def in it is not the module's own singleton
+      # method, and the walks that file one ask {#hook_block?} first. Mixed into an accumulator with a
+      # `hook_block_spans` slot.
+      module HookBlockSpans
+        def mark_hook_blocks(blocks, owner)
+          blocks.each do |block|
+            (self.hook_block_spans ||= []) << [block.location.start_offset, block.location.end_offset, owner]
+          end
+        end
+
+        # Whether `node` sits in a block marked for the module `owner` (a prefix).
+        def hook_block?(node, owner)
+          offset = node.location.start_offset
+          !hook_block_spans.nil? &&
+            hook_block_spans.any? { |start, stop, marked| offset >= start && offset < stop && marked == owner }
+        end
+
+        # Whether `def_node` is a `def self.x` in a block marked for the module `owner`.
+        def hook_block_self_def?(def_node, owner)
+          def_node.receiver.is_a?(Prism::SelfNode) && hook_block?(def_node, owner)
+        end
+      end
+
       # The accumulator {#walk_methods_and_def_nodes} threads: the existence table and its issue #992
       # envelope twin, which only {#record_method} and {#record_surface_mark} write, and the issue #1120
       # refinement table, which only {#record_refinement_defs} writes. That last one stays nil until a
@@ -3465,7 +3744,9 @@ module Rigor
       MethodTables = Struct.new(:existence, :envelopes, :refinements, :certainty, :certain, :possible,
                                 :contested_envelopes, :contested_def_nodes, :root, :in_effect, :census,
                                 :refine_text, :literal_seen, :source_bytes, :loose_constants, :block_spans,
-                                :definer_history) do
+                                :definer_history, :forwardable_extends, :hook_block_spans) do
+        include HookBlockSpans
+
         # Issue #2006 — records, in walk order, that a definer other than an alias wrote the instance method `name`
         # of `class_name` at `node`: `def_node` for a `def`, nil for a `define_method(:x)` or an `attr_*` reader or
         # writer, and whether the write is {#certain}. {ScopeIndexer#apply_alias_def_nodes} reads the history to copy
@@ -3567,7 +3848,8 @@ module Rigor
       REFINEMENT_WILDCARD = Scope::DiscoveryIndex::REFINEMENT_WILDCARD
       REFINE_WORD = /\brefine\b/
       HEREDOC_OPENER = /<<[~-]?["'`A-Za-z_]/
-      private_constant :EMPTY_REFINEMENTS, :REFINEMENT_WILDCARD, :REFINE_WORD, :HEREDOC_OPENER
+      COMPARISON_OPERATORS = Set[:==, :!=, :===].freeze
+      private_constant :EMPTY_REFINEMENTS, :REFINEMENT_WILDCARD, :REFINE_WORD, :HEREDOC_OPENER, :COMPARISON_OPERATORS
 
       NO_OFFSETS = [].freeze
       private_constant :NO_OFFSETS
@@ -3660,7 +3942,8 @@ module Rigor
       # `self`, charged to its module or the wildcard), `:literal` (A3's `:refine` / eval-string literal), `:nested` (a
       # `refine` in a refine body, or in a singleton method of one), `:dsl` (where `self` is a class, #1689) and
       # `:raises` (no block, a Proc as the block, another receiver, or a computed target where `self` is `main`), and
-      # `:data` (a `:refine` literal where `self` is a plain class or one of its instances).
+      # `:data` (a `:refine` literal where `self` is a plain class or one of its instances), and `:inert` (issue #2203:
+      # a `:refine` Symbol that is a hash key or a comparison operand, which no call reads as a method name).
       def refine_census(root)
         census = []
         refinements = build_methods_and_def_nodes(root, census: census)[3]
@@ -3839,6 +4122,8 @@ module Rigor
           end
 
           census_call(node, qualified_prefix, tables, refine_body)
+        when Prism::AssocNode
+          census_assoc_key(node, tables)
         when Prism::SymbolNode
           census_symbol(node, tables)
         end
@@ -3894,6 +4179,8 @@ module Rigor
         arguments = node.arguments&.arguments
         return if arguments.nil?
 
+        return census_compared_literal(arguments.first, tables) if COMPARISON_OPERATORS.include?(node.name)
+
         strings = RefineCensus.string_literal_call?(node)
         arguments.each do |argument|
           next unless RefineCensus.refine_symbol?(argument) || (strings && RefineCensus.refine_string?(argument))
@@ -3928,6 +4215,26 @@ module Rigor
 
       def constant_shaped?(node) = node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
 
+      # Issue #2203 — a `:refine` Symbol a comparison reads (`node.name == :refine`, `!=`, `===`) is a value compared,
+      # never a method name a call runs: it is inert (`:inert`), and records no row.
+      def census_compared_literal(argument, tables)
+        return unless RefineCensus.refine_symbol?(argument) && !tables.literal_seen?(argument)
+
+        tables.see_literal(argument)
+        tables.account(argument, :inert)
+      end
+
+      # Issue #2203 — a `:refine` Symbol that is a hash key (`h(x, refine: true)`, `{ refine: 1 }`, `{ :refine => 1 }`)
+      # names an option, not `Module#refine`: it is inert (`:inert`), and records no row. A `:refine` value stays a
+      # literal.
+      def census_assoc_key(node, tables)
+        key = node.key
+        return unless RefineCensus.refine_symbol?(key) && !tables.literal_seen?(key)
+
+        tables.see_literal(key)
+        tables.account(key, :inert)
+      end
+
       # A3 — a `:refine` Symbol anywhere else (`alias my_refine refine`, `%i[refine]`, a hash) names `Module#refine`
       # for code the walk cannot follow, run on the module the in-effect walk says `self` is there; where `self` is a
       # plain class or one of its instances it is data.
@@ -4101,6 +4408,11 @@ module Rigor
               census_scan(node.superclass, qualified_prefix, methods_acc)
             end
             record_declaration_facts(node, child_prefix, methods_acc.at(node)) unless child_cref
+            unless child_cref
+              methods_acc.mark_hook_blocks(concern_hook_blocks(node, child_prefix), child_prefix)
+              record_concern_class_methods(node, child_prefix, methods_acc, def_nodes_acc)
+              record_hook_definer_calls(node, child_prefix, methods_acc)
+            end
             body_prefix = child_cref ? [] : child_prefix
             if node.body
               walk_methods_and_def_nodes(node.body, body_prefix, false, methods_acc, def_nodes_acc,
@@ -4120,11 +4432,12 @@ module Rigor
           if !node.expression.is_a?(Prism::SelfNode) || tables.in_block?(node)
             record_singleton_body_prepends(node, qualified_prefix, tables)
           end
+          record_constant_singleton_prepends(node, qualified_prefix, tables)
           walk_methods_and_def_nodes(node.expression, qualified_prefix, in_singleton_class,
                                      methods_acc, def_nodes_acc, source_path, def_owner_prefix,
                                      singleton_cref: singleton_cref,
                                      defs_singleton: defs_singleton)
-          if node.body
+          if node.body && !hook_block_singleton?(node, in_singleton_class, owner_prefix, methods_acc)
             # The body's lexical cref is unnameable AND its qualified prefix stays the
             # ENCLOSING lexical one — `class C3::CD` below `class <<` resolves `C3`
             # lexically, never against the singleton's name. `singleton_prefix` rides
@@ -4138,6 +4451,7 @@ module Rigor
         when Prism::ConstantWriteNode, Prism::ConstantPathWriteNode, Prism::ConstantOrWriteNode,
              Prism::ConstantPathOrWriteNode
           record_meta_superclass(node, qualified_prefix, def_owner_prefix, methods_acc.at(node))
+          record_struct_same_class(node, qualified_prefix, def_owner_prefix, methods_acc.at(node))
           if (split = meta_new_block_split(node, qualified_prefix, def_owner_prefix, singleton_cref))
             enclosing, body, body_self = split
             # A meta-new block rebinds only `self` — `Module.nesting` stays lexical — so
@@ -4179,11 +4493,13 @@ module Rigor
             node.rigor_each_child { |child| census_scan(child, qualified_prefix, methods_acc) }
           end
           record_foreign_singleton_def(node, qualified_prefix, owner_prefix, methods_acc.at(node))
+          return if methods_acc.hook_block_self_def?(node, owner_prefix)
+
           unless def_owner_prefix&.empty? || defs_singleton == :unnameable ||
                  (singleton_cref && owner_prefix.empty?)
-            singleton_def = in_singleton_class || defs_singleton
+            singleton_def = def_context(in_singleton_class, defs_singleton)
             record_def_method(node, owner_prefix, singleton_def, methods_acc.at(node))
-            record_def_body_evidence(node, owner_prefix, methods_acc)
+            record_def_body_evidence(node, owner_prefix, methods_acc, singleton_def ? :singleton : :instance)
             record_def_node(node, owner_prefix, singleton_def, def_nodes_acc, methods_acc)
           end
           return
@@ -4199,11 +4515,15 @@ module Rigor
             end
           end
           return
+        when Prism::AssocNode
+          census_assoc_key(node, methods_acc) if methods_acc.mentions_refine?
         when Prism::SymbolNode
           census_symbol(node, methods_acc) if methods_acc.mentions_refine?
         when Prism::CallNode
           census_literal_arguments(node, qualified_prefix, methods_acc) if methods_acc.mentions_refine?
           if receiver_eval_call?(node)
+            record_singleton_eval_definers(node, owner_prefix, in_singleton_class, methods_acc.at(node))
+            record_constant_singleton_eval_defs(node, qualified_prefix, methods_acc.at(node))
             return walk_eval_methods_and_defs(node, qualified_prefix, in_singleton_class, methods_acc,
                                               def_nodes_acc, source_path, def_owner_prefix,
                                               singleton_cref: singleton_cref,
@@ -4212,13 +4532,15 @@ module Rigor
           anonymous = record_call_node_methods(node, owner_prefix, in_singleton_class, methods_acc.at(node),
                                                source_path)
           unless in_singleton_class
-            superseded = call_superseded_names(node)
+            superseded = call_superseded_names(node, owner_prefix, methods_acc)
             supersede_def_nodes(superseded, owner_prefix, def_nodes_acc, methods_acc.at(node))
             note_call_definers(node, superseded, owner_prefix, methods_acc.at(node))
           end
           tables = methods_acc.at(node)
           record_singleton_prepend(node, qualified_prefix, tables,
                                    self_ok: node.name == :prepend && tables.in_block?(node))
+          own_prefix = def_owner_prefix&.empty? || defs_singleton == :unnameable ? EMPTY_PREFIX : owner_prefix
+          record_own_singleton_prepend(node, [own_prefix, qualified_prefix], in_singleton_class, tables)
           # Issue #1120 — a refine body's defs go to the refinement table and nowhere else.
           if (target = methods_acc.refine_target_of(node))
             return record_literal_target_refine(node, target, qualified_prefix, owner_prefix, methods_acc)
@@ -4332,6 +4654,27 @@ module Rigor
         record_surface_mark(tables, child_prefix.join("::"), Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK)
       end
 
+      # Issue #2979 — `K = Struct.new("Named", :a)`, with or without a block, binds `K` and `Struct::Named` to one class
+      # object, so each name's bucket takes a `[ENVELOPE_SAME_CLASS_KIND, other]` entry and the method chain of either
+      # reads the other's tables (`Scope::ResolutionChain`). Only the bare factory call qualifies: under a wrapping
+      # `Class.new(Struct.new("Named", :a))` the constant names a SUBCLASS of `Struct::Named`, which already reaches it
+      # as an ancestor only one way.
+      def record_struct_same_class(node, qualified_prefix, self_base, tables)
+        rvalue = meta_new_rvalue(node)
+        return unless struct_new_call?(rvalue)
+
+        named = AnonymousMetaClass.struct_class_name(rvalue)
+        return if named.nil?
+
+        child_prefix = meta_new_child_prefix(node, qualified_prefix, self_base)
+        return if child_prefix.nil? || child_prefix.empty?
+
+        class_name = child_prefix.join("::")
+        kind = Scope::DiscoveryIndex::ENVELOPE_SAME_CLASS_KIND
+        record_envelope(tables.envelopes, class_name, [kind, named], Source::ParameterEnvelope::OPAQUE)
+        record_envelope(tables.envelopes, named, [kind, class_name], Source::ParameterEnvelope::OPAQUE)
+      end
+
       def record_meta_new_facts(rvalue, child_prefix, tables)
         record_meta_members(rvalue, child_prefix, tables)
         # `Module.new(&BODY)`: the body runs on the new module but cannot be read, so its surface is unknown (#1816).
@@ -4359,11 +4702,111 @@ module Rigor
         record_define_method(node, qualified_prefix, in_singleton_class, methods_acc) if node.name == :define_method
         record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc) if attr_macro(node)
         record_module_attr_methods(node, qualified_prefix, methods_acc) if MODULE_ATTR_MACROS.key?(node.name)
+        record_forwardable_methods(node, qualified_prefix, in_singleton_class, methods_acc)
         record_alias_method_call(node, qualified_prefix, in_singleton_class, methods_acc)
         record_surface_evidence(node, qualified_prefix, methods_acc)
+        record_self_definer_call(node, qualified_prefix, in_singleton_class, methods_acc)
         AnonymousMetaClass.name_for(node, source_path)
       end
 
+      # Issue #2901 — the class-body calls on `self` that open the class to `call.undefined-method` without a name
+      # this walk can read: `send(:define_method, m)` (the instance side, or the singleton side in a `class << self`
+      # body), `define_singleton_method(m)` (the singleton side, outside `class << self`, where it would define on the
+      # singleton's own singleton), and a call of any other name, filed as a
+      # {Scope::DiscoveryIndex::ENVELOPE_BODY_CALL_KIND} entry for the reader to resolve against the class's macros.
+      def record_self_definer_call(node, qualified_prefix, in_singleton_class, accumulator)
+        return if qualified_prefix.empty? || !(node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+
+        class_name = qualified_prefix.join("::")
+        if node.name == :define_singleton_method
+          record_open_singleton_definer(node, class_name, in_singleton_class, accumulator)
+          record_literal_self_definer(node, class_name, in_singleton_class, accumulator)
+        elsif SURFACE_SEND_CALLS.include?(node.name)
+          record_sent_define_method(node, class_name, in_singleton_class, accumulator)
+          record_literal_self_definer(node, class_name, in_singleton_class, accumulator)
+        elsif MODULE_NEW_MIXIN_CALLS.include?(node.name)
+          record_module_new_mixin(node, class_name, in_singleton_class, accumulator)
+        elsif !in_singleton_class && !BODY_CALL_EXCLUDED.include?(node.name)
+          key = [Scope::DiscoveryIndex::ENVELOPE_BODY_CALL_KIND, node.name]
+          record_envelope(accumulator.envelopes, class_name, key, Source::ParameterEnvelope::OPAQUE)
+        end
+      end
+
+      # The class-body calls this walk reads as definers of their own, or that core's `Module` answers: a project
+      # macro of one of these names is not looked for.
+      BODY_CALL_EXCLUDED = %i[
+        define_method define_singleton_method alias_method attr_reader attr_writer attr_accessor include extend prepend
+        private public protected module_function private_class_method public_class_method private_constant
+        public_constant require require_relative autoload autoload_relative
+      ].to_set.freeze
+      private_constant :BODY_CALL_EXCLUDED
+
+      def record_open_singleton_definer(node, class_name, in_singleton_class, accumulator)
+        return if in_singleton_class || !computed_first_name?(node.arguments&.arguments)
+
+        record_surface_mark(accumulator, class_name, Scope::DiscoveryIndex::ENVELOPE_OPEN_SINGLETON_NAMES_MARK)
+      end
+
+      def record_sent_define_method(node, class_name, in_singleton_class, accumulator)
+        arguments = node.arguments&.arguments
+        return unless arguments && literal_method_name(arguments.first) == :define_method
+        return unless computed_first_name?(arguments.drop(1))
+
+        record_surface_mark(accumulator, class_name, open_names_mark(in_singleton_class))
+      end
+
+      # Issue #2975 — `include(Module.new { %i[a b].each { |x| define_method(x) {} } })` mixes in a module whose body
+      # runs a computed `define_method` on its own `self`, so the side the mixin lands on (the instance side, or the
+      # singleton side in a `class << self` body) is open as a direct `define_method(m)` there would leave it.
+      def record_module_new_mixin(node, class_name, in_singleton_class, accumulator)
+        return unless module_new_definer_argument?(node)
+
+        record_surface_mark(accumulator, class_name, open_names_mark(in_singleton_class))
+      end
+
+      MODULE_NEW_MIXIN_CALLS = %i[include prepend].to_set.freeze
+      private_constant :MODULE_NEW_MIXIN_CALLS
+
+      # Whether a mixin call's argument is a `Module.new { … }` whose body runs a computed `define_method` on the
+      # module ({#runs_computed_self_definer?}).
+      def module_new_definer_argument?(node)
+        (node.arguments&.arguments || []).any? do |argument|
+          module_new_call?(argument) && argument.block.is_a?(Prism::BlockNode) &&
+            runs_computed_self_definer?(argument.block.body)
+        end
+      end
+
+      # Issue #2975 — `singleton_class.class_eval { def my_attr(*n) = n.each { |x| define_method(x) {} } }` in a class
+      # body, or the same on `Const.singleton_class`, defines a class macro the eval-body walk files under no owner: the
+      # method takes the singleton-side definer entry {#record_computed_definer} gives a `def self.my_attr`.
+      def record_singleton_eval_definers(node, qualified_prefix, in_singleton_class, tables)
+        return if in_singleton_class || !CLASS_EVAL_BLOCK_CALLS.include?(node.name)
+
+        receiver = node.receiver
+        return unless singleton_class_of_receiver?(receiver)
+
+        current = qualified_prefix.empty? ? nil : qualified_prefix.join("::")
+        owner = singleton_class_owner(node, receiver.receiver, qualified_prefix, current)
+        return if owner.nil?
+
+        body = node.block.body
+        return unless body.is_a?(Prism::StatementsNode)
+
+        body.body.each do |statement|
+          next unless statement.is_a?(Prism::DefNode) && statement.receiver.nil?
+
+          record_computed_definer(statement, owner.split("::"), tables, :singleton)
+        end
+      end
+
+      CLASS_EVAL_BLOCK_CALLS = %i[class_eval module_eval class_exec module_exec].to_set.freeze
+      private_constant :CLASS_EVAL_BLOCK_CALLS
+
+      # Whether a definer's argument list starts with a name that is not a Symbol or String literal.
+      def computed_first_name?(arguments)
+        !arguments.nil? && !arguments.empty? && literal_method_name(arguments.first).nil?
+      end
+
       # The `alias_method :new, :old` CallNode twin of {#record_alias_method} (#533): the NEW name joins
       # the discovered-methods table so calls to it stop reading undefined, and
       # {#apply_alias_def_nodes}'s map walk gives it the ORIGINAL def node for return inference.
@@ -4664,17 +5107,27 @@ module Rigor
       # (#590). Their bodies are entered as class bodies, so a member read inside one dispatches on the struct's
       # own class and must find the reader there: a member that shadows a `Kernel` private (`lambda`) otherwise
       # falls through to `Kernel#lambda`, and `lambda.upcase` reports an undefined method on `Proc` — a wrong-type
-      # diagnostic on correct code. No-op for `Class.new` / `Module.new` and for a factory whose members are not
-      # literal Symbols (nothing to register).
+      # diagnostic on correct code. No-op for `Class.new` / `Module.new`. A splatted member list registers its literal
+      # members and opens the instance side ({#record_meta_member_names}).
       def record_meta_members(factory_call, qualified_prefix, accumulator, allow_outer_block: true)
         factory_call = resolve_meta_factory_call(factory_call, allow_outer_block: allow_outer_block)
         return unless factory_call
 
-        members = meta_member_names(factory_call)
-        return if members.empty?
+        # Issue #2968 — `K = Struct.new("Named", :a)` makes one class under two names, `K` and `Struct::Named`; the
+        # members are credited on both.
+        named = AnonymousMetaClass.struct_class_name(factory_call) if struct_new_call?(factory_call)
+        [qualified_prefix.join("::"), named].compact.uniq.each do |class_name|
+          record_meta_member_names(factory_call, class_name, accumulator)
+        end
+      end
 
-        class_name = qualified_prefix.join("::")
-        members.each { |member| record_method(accumulator, class_name, member, :instance) }
+      # Issue #2968 — a splatted member list (`Struct.new(*FIELDS)`) names members this walk cannot read, so the
+      # instance side opens: no name is provably missing there.
+      def record_meta_member_names(factory_call, class_name, accumulator)
+        if meta_members_open?(factory_call)
+          record_surface_mark(accumulator, class_name, Scope::DiscoveryIndex::ENVELOPE_OPEN_INSTANCE_NAMES_MARK)
+        end
+        meta_member_names(factory_call).each { |member| record_method(accumulator, class_name, member, :instance) }
       end
 
       # Unwinds nested single-parent `Class.new(...)` calls to a root `Struct.new(...)` / `Data.define(...)`.
@@ -4705,22 +5158,33 @@ module Rigor
         data_define_call?(call_node) || struct_new_call?(call_node)
       end
 
-      # The Symbol member names of a `Data.define(*Symbol)` / `Struct.new(*Symbol [, keyword_init:])` call. For
-      # `Struct.new` the trailing `keyword_init:` hash is stripped by {#struct_new_positionals}; a leading
-      # String class name is NOT stripped, so `Struct.new("Name", :a) do` registers no members and the body
-      # is entered under the anonymous name (consistent between passes). `Data.define` args are all Symbols.
+      # The literal Symbol member names of a `Data.define` / `Struct.new` call ({#meta_member_positionals}). A splatted
+      # argument contributes none; {#meta_members_open?} says the list is then incomplete.
       def meta_member_names(call_node)
+        meta_member_positionals(call_node).filter_map { |arg| arg.unescaped.to_sym if arg.is_a?(Prism::SymbolNode) }
+      end
+
+      # Issue #2968 — whether a `Data.define` / `Struct.new` call's member list holds a splat, so its members are not
+      # all literal and the reader set is unknown. A layout table or a closed reader set must not be built from it.
+      def meta_members_open?(call_node)
+        meta_member_positionals(call_node).any?(Prism::SplatNode)
+      end
+
+      # The member arguments of a `Data.define` / `Struct.new` call. For `Struct.new` the trailing `keyword_init:` hash
+      # is stripped ({#struct_new_positionals}). A leading class-name String (`Struct.new("Named", :a)`) is neither a
+      # Symbol nor a splat, so it is no member and does not open the list.
+      def meta_member_positionals(call_node)
         raw = call_node.arguments&.arguments || []
-        symbols = struct_new_call?(call_node) ? (struct_new_positionals(raw) || []) : raw
-        symbols.filter_map { |arg| arg.unescaped.to_sym if arg.is_a?(Prism::SymbolNode) }
+        struct_new_call?(call_node) ? struct_new_positionals(raw) : raw
       end
 
       def record_def_method(def_node, qualified_prefix, in_singleton_class, accumulator)
         return if qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        singleton = def_singleton?(def_node, qualified_prefix, in_singleton_class)
-        kind = singleton ? :singleton : :instance
+        kind = def_side(def_node, qualified_prefix, in_singleton_class)
+        return if kind.nil?
+
         record_method(accumulator, class_name, def_node.name, kind, Source::ParameterEnvelope.of(def_node))
       end
 
@@ -4729,12 +5193,20 @@ module Rigor
       # `def decorate(obj) = obj.extend(Decorator)`. A class-body macro records the same evidence in
       # {#record_surface_evidence}; `send` is left out here because inside a body it is an ordinary call far
       # more often than a definition.
-      def record_def_body_evidence(def_node, qualified_prefix, tables)
+      # The side a `def`'s body evidence is filed on: a `def self.x`'s singleton side, unless the caller files it as an
+      # instance method elsewhere (`receiver_side: false`, #3005's `Owner::<included>`).
+      def evidence_side(def_node, side, receiver_side) = receiver_side && def_node.receiver ? :singleton : side
+
+      def record_def_body_evidence(def_node, qualified_prefix, tables, side, receiver_side: true)
         return if def_node.body.nil?
 
+        side = evidence_side(def_node, side, receiver_side)
+
+        definer = false
         Source::NodeWalker.each(def_node.body) do |node|
           if node.is_a?(Prism::SingletonClassNode)
             record_singleton_body_prepends(node, qualified_prefix, tables)
+            record_constant_singleton_prepends(node, qualified_prefix, tables, owner: true)
             next
           end
           next unless node.is_a?(Prism::CallNode)
@@ -4742,13 +5214,629 @@ module Rigor
           if node.name == :extend
             record_object_extension(node, qualified_prefix, tables)
           elsif SURFACE_EVAL_CALLS.include?(node.name) || SURFACE_NAMING_CALLS.include?(node.name)
+            definer ||= computed_self_define_method?(node)
             record_body_rewrite(node, qualified_prefix, tables)
           else
             record_singleton_prepend(node, qualified_prefix, tables, self_ok: true)
           end
         end
+        record_computed_definer(def_node, qualified_prefix, tables, side) if definer
+        record_hook_extends(def_node, qualified_prefix, tables, side)
+      end
+
+      # Issue #2975 — an ActiveSupport::Concern-style hook, `def self.included(base) = base.extend(ClassMethods)`, puts
+      # `ClassMethods` on every includer's singleton chain, which no `extend` edge of the includer records. The module
+      # takes a `[ENVELOPE_HOOK_EXTEND_KIND, "ClassMethods"]` entry per constant extended on the hook's parameter, as
+      # written, so `call.undefined-method` can resolve an includer's class-body macro calls against it.
+      #
+      # Issue #1592 — the entry also names the hook (`[ENVELOPE_HOOK_EXTEND_KIND, "ClassMethods", :included]`), so the
+      # includer's singleton resolution chain draws the module only for the edge whose hook runs. Only a direct
+      # statement of the hook body with constant arguments and no `return` / `next` / `break` in an earlier
+      # statement is a fact the chain can place. Any other extend of the parameter anywhere in the body (nested,
+      # conditional, after an early exit, or with an argument that is not a constant), a `base.send(:extend, …)`, a
+      # `base.singleton_class.include` / `prepend` and a `class_eval`-family block on the parameter take a
+      # `[ENVELOPE_HOOK_EXTEND_OPEN_KIND, hook]` entry instead of, or beside, the named one. Each definition also takes
+      # a `[ENVELOPE_HOOK_DEF_KIND, hook, source]` entry, so a module that defines the hook twice (in two files, or
+      # twice in one) is read as open: which definition Ruby keeps is load order.
+      def record_hook_extends(def_node, qualified_prefix, tables, side)
+        return unless side == :singleton && HOOK_EXTEND_DEFS.include?(def_node.name) && !qualified_prefix.empty?
+
+        owner = qualified_prefix.join("::")
+        hook = def_node.name
+        def_key = [Scope::DiscoveryIndex::ENVELOPE_HOOK_DEF_KIND, hook, def_node.slice.split.join(" ")]
+        record_envelope(tables.envelopes, owner, def_key, Source::ParameterEnvelope::OPAQUE)
+        param = def_node.parameters&.requireds&.first
+        return unless param.is_a?(Prism::RequiredParameterNode)
+
+        target = ->(call) { hook_param_receiver?(call.receiver, param.name) }
+        scan_hook_body(def_node.body, target, owner, tables, hook) do |node|
+          hook_singleton_reshape?(node, param.name)
+        end
+      end
+
+      # The shared walk of a hook body or a concern's hook block: `target` says whether a call's receiver is the
+      # includer, the block says whether a call reshapes the includer's singleton some other way.
+      def scan_hook_body(body, target, owner, tables, hook)
+        placeable = placeable_hook_statements(body)
+        Source::NodeWalker.each(body) do |node|
+          if node.is_a?(Prism::CallNode) && node.name == :extend && target.call(node)
+            complete = record_hook_extend_arguments(node, owner, tables, hook)
+            record_hook_extend_open(owner, tables, hook) unless complete && placeable.include?(node)
+          elsif (node.is_a?(Prism::CallNode) && yield(node)) || singleton_mixin_body?(node)
+            record_hook_extend_open(owner, tables, hook)
+          end
+        end
+      end
+
+      # The direct statements of a body that run unless an earlier statement raised: those before the first
+      # statement holding a `return`, `next` or `break` anywhere in it. An endless `def` has its one expression.
+      def placeable_hook_statements(body)
+        statements = body.is_a?(Prism::StatementsNode) ? body.body : [body].compact
+        placeable = Set.new.compare_by_identity
+        statements.each do |statement|
+          break if exits_early?(statement)
+
+          placeable << statement
+        end
+        placeable
+      end
+
+      # A `next` or `break` inside a block or lambda leaves only that block, and a lambda's `return` only the lambda;
+      # a `return` inside a block leaves the hook.
+      def exits_early?(node, in_block: false)
+        case node
+        when Prism::ReturnNode then true
+        when Prism::NextNode, Prism::BreakNode then !in_block
+        when Prism::LambdaNode then false
+        else
+          inner = in_block || node.is_a?(Prism::BlockNode)
+          node.rigor_each_child { |child| return true if exits_early?(child, in_block: inner) }
+          false
+        end
+      end
+
+      # A `class << self` body that mixes in, anywhere under a hook body or block.
+      def singleton_mixin_body?(node)
+        return false unless node.is_a?(Prism::SingletonClassNode) && node.expression.is_a?(Prism::SelfNode)
+
+        found = false
+        Source::NodeWalker.each(node.body) do |child|
+          found ||= child.is_a?(Prism::CallNode) && MIXIN_SELF_CALLS.include?(child.name) && child.receiver.nil?
+        end
+        found
+      end
+
+      MIXIN_SELF_CALLS = %i[include prepend extend].freeze
+      private_constant :MIXIN_SELF_CALLS
+
+      def hook_param_receiver?(receiver, name)
+        receiver.is_a?(Prism::LocalVariableReadNode) && receiver.name == name
+      end
+
+      # A hook-body call that may mix into the parameter's singleton class without a plain `base.extend(…)`:
+      # `base.send(:extend, M)` (or `__send__` / `public_send`), `base.singleton_class.include(M)` / `prepend(M)`, and a
+      # `class_eval` / `instance_eval` / `module_eval`-family call on the parameter, whose block runs with it as `self`.
+      def hook_singleton_reshape?(node, name)
+        receiver = node.receiver
+        if HOOK_SEND_CALLS.include?(node.name)
+          send_extend?(node) && hook_param_receiver?(receiver, name)
+        elsif HOOK_EVAL_CALLS.include?(node.name)
+          hook_param_receiver?(receiver, name)
+        else
+          %i[include prepend].include?(node.name) && receiver.is_a?(Prism::CallNode) &&
+            receiver.name == :singleton_class && hook_param_receiver?(receiver.receiver, name)
+        end
+      end
+
+      HOOK_EVAL_CALLS = %i[class_eval class_exec module_eval module_exec instance_eval instance_exec].freeze
+      private_constant :HOOK_EVAL_CALLS
+
+      # `send(:extend, …)`, `__send__` or `public_send`, on whatever receiver.
+      def send_extend?(node)
+        first = node.arguments&.arguments&.first
+        HOOK_SEND_CALLS.include?(node.name) && first.is_a?(Prism::SymbolNode) && first.unescaped == "extend"
+      end
+
+      HOOK_SEND_CALLS = %i[send __send__ public_send].freeze
+      private_constant :HOOK_SEND_CALLS
+
+      # Records each constant argument as written and answers whether every argument was one.
+      def record_hook_extend_arguments(node, owner, tables, hook)
+        arguments = node.arguments&.arguments || []
+        complete = !arguments.empty?
+        arguments.each do |argument|
+          written = Source::ConstantPath.qualified_name_or_nil(argument)
+          next complete = false if written.nil?
+
+          key = [Scope::DiscoveryIndex::ENVELOPE_HOOK_EXTEND_KIND, written, hook]
+          record_envelope(tables.envelopes, owner, key, Source::ParameterEnvelope::OPAQUE)
+        end
+        complete
+      end
+
+      def record_hook_extend_open(owner, tables, hook)
+        key = [Scope::DiscoveryIndex::ENVELOPE_HOOK_EXTEND_OPEN_KIND, hook]
+        record_envelope(tables.envelopes, owner, key, Source::ParameterEnvelope::OPAQUE)
+      end
+
+      HOOK_EXTEND_DEFS = %i[included prepended].to_set.freeze
+      private_constant :HOOK_EXTEND_DEFS
+
+      # Issue #2997 — a module's `included` / `prepended` hook defined by a call rather than `def self.included`:
+      # `define_singleton_method(:included) { |base| base.extend(X) }` written as a statement of the module body is
+      # read as {#record_hook_extends} reads the `def` (a `[ENVELOPE_HOOK_DEF_KIND, hook, source]` entry, and the
+      # block body scanned with its first parameter as the includer). (`class << self; def included(base)` already
+      # reaches {#record_hook_extends} as a singleton `def`.) Any other call that may define a hook takes a
+      # `[ENVELOPE_HOOK_EXTEND_OPEN_KIND, hook]` entry, for each hook a non-literal name may spell: one nested in
+      # a block, method or condition, one without a block of one plain parameter, `send(:define_singleton_method,
+      # …)`, `singleton_class.define_method(…)`, and `define_method` in the body of `class << self`.
+      def record_hook_definer_calls(node, child_prefix, methods_acc)
+        return unless node.is_a?(Prism::ModuleNode) && node.body.is_a?(Prism::StatementsNode)
+
+        owner = child_prefix.join("::")
+        direct = node.body.body
+        each_hook_definer(node.body, false) do |call, hooks|
+          tables = methods_acc.at(call)
+          param = readable_hook_parameter(call) if direct.any? { |statement| statement.equal?(call) }
+          if param
+            record_hook_block(call, param, owner, tables, hooks.first)
+          else
+            hooks.each { |hook| record_hook_extend_open(owner, tables, hook) }
+          end
+        end
+      end
+
+      # The entries of one readable `define_singleton_method(:hook) { |base| … }`.
+      def record_hook_block(call, param, owner, tables, hook)
+        def_key = [Scope::DiscoveryIndex::ENVELOPE_HOOK_DEF_KIND, hook, call.slice.split.join(" ")]
+        record_envelope(tables.envelopes, owner, def_key, Source::ParameterEnvelope::OPAQUE)
+        body = call.block&.body
+        return if body.nil?
+
+        target = ->(extend_call) { hook_param_receiver?(extend_call.receiver, param.name) }
+        scan_hook_body(body, target, owner, tables, hook) { |inner| hook_singleton_reshape?(inner, param.name) }
+      end
+
+      # Yields each call under a module body that may define the module's `included` / `prepended`, with the hooks
+      # it may define. A nested class or module body has its own self, and so has an instance `def`'s body; in a
+      # `class << self` body `define_method` defines on the module and `define_singleton_method` on its singleton
+      # class, and in a singleton `def`'s body `self` is the module again.
+      def each_hook_definer(node, in_singleton, &)
+        case node
+        when Prism::ClassNode, Prism::ModuleNode then nil
+        when Prism::SingletonClassNode
+          each_hook_definer(node.expression, in_singleton, &)
+          each_hook_definer(node.body, !in_singleton && node.expression.is_a?(Prism::SelfNode), &)
+        when Prism::DefNode
+          each_hook_definer(node.body, false, &) if in_singleton || node.receiver.is_a?(Prism::SelfNode)
+        else
+          if node.is_a?(Prism::CallNode)
+            hooks = hook_definer_names(node, in_singleton)
+            yield node, hooks unless hooks.nil?
+          end
+          node&.rigor_each_child { |child| each_hook_definer(child, in_singleton, &) }
+        end
+      end
+
+      # The hooks a call may define on the module whose body runs it, or nil for a call that defines none.
+      def hook_definer_names(node, in_singleton)
+        name_node = hook_definer_name_node(node, in_singleton)
+        return nil if name_node.nil?
+
+        name = literal_method_name(name_node)
+        return HOOK_EXTEND_DEFS.include?(name) ? [name] : nil if name
+
+        hooks = HOOK_EXTEND_DEFS.select { |hook| hook.start_with?(literal_name_prefix(name_node)) }
+        hooks.empty? ? nil : hooks
+      end
+
+      # The literal text an interpolated name starts with (`"is_"` for `"is_#{n}"`), or `""` for a name computed any
+      # other way: only a hook whose name starts with it may be the one defined.
+      def literal_name_prefix(node)
+        return "" unless node.is_a?(Prism::InterpolatedSymbolNode) || node.is_a?(Prism::InterpolatedStringNode)
+
+        first = node.parts.first
+        first.is_a?(Prism::StringNode) ? first.unescaped : ""
+      end
+
+      # The argument naming the method a call that may define a singleton method of the module defines, or nil.
+      def hook_definer_name_node(node, in_singleton)
+        arguments = node.arguments&.arguments || []
+        if HOOK_SEND_CALLS.include?(node.name) && self_receiver?(node.receiver)
+          definer = literal_method_name(arguments.first)
+          arguments[1] if definer == :define_singleton_method || (in_singleton && definer == :define_method)
+        elsif singleton_definer_call?(node, in_singleton)
+          arguments.first
+        end
+      end
+
+      def singleton_definer_call?(node, in_singleton)
+        receiver = node.receiver
+        case node.name
+        when :define_singleton_method then !in_singleton && self_receiver?(receiver)
+        when :define_method
+          (in_singleton && self_receiver?(receiver)) ||
+            (receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class && self_receiver?(receiver.receiver))
+        else false
+        end
+      end
+
+      def self_receiver?(receiver) = receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+      # The includer parameter of a `define_singleton_method(:hook) { |base| … }` the hook read can place: one literal
+      # hook name, a literal block, and a plain first parameter. Nil for any other shape.
+      def readable_hook_parameter(call)
+        arguments = call.arguments&.arguments || []
+        return nil unless call.name == :define_singleton_method && arguments.size == 1
+        return nil unless literal_method_name(arguments.first) && call.block.is_a?(Prism::BlockNode)
+
+        params = call.block.parameters
+        param = params.parameters&.requireds&.first if params.is_a?(Prism::BlockParametersNode)
+        param.is_a?(Prism::RequiredParameterNode) ? param : nil
+      end
+
+      # Issue #2986 — a module whose body runs `extend ActiveSupport::Concern` has `Concern#append_features` (or
+      # `prepend_features`) extend each direct includer with `const_get(:ClassMethods)`, as #2975's hook does with its
+      # constant, so the module takes a `[ENVELOPE_HOOK_EXTEND_KIND, "ClassMethods", :const_get]` entry. A
+      # `class_methods do … end` block of that body is a `module_eval` of `Owner::ClassMethods`: each `def` in it is
+      # also recorded on that module, with its body's evidence (a computed definer's entry among it), so the hook
+      # reader resolves and reads it. The walk keeps recording the same `def` on the module itself as before. A call on
+      # `self` in an `included do … end` or `prepended do … end` block takes a
+      # `[ENVELOPE_HOOK_BODY_CALL_KIND, hook, name]` entry, since Ruby runs that block in the includer's class body.
+      #
+      # Issue #1592 — the `def` node is filed on `Owner::ClassMethods` too, so the includer's singleton resolution
+      # chain, which holds that module, answers a class-side call with the `def`'s own return type.
+      #
+      # Issue #2997 — a `class_methods` block is read in every body of the module, not only one that runs `extend
+      # ActiveSupport::Concern` itself: a reopening in another file runs it on a module that is already a concern, and
+      # where it loads first Ruby raises `NoMethodError` at load, so no running program has the includer without the
+      # method. The module is a concern, and its includers draw on `Owner::ClassMethods`, only when some body records
+      # the concern entry.
+      def record_concern_class_methods(node, child_prefix, methods_acc, def_nodes_acc)
+        return unless node.is_a?(Prism::ModuleNode) && node.body.is_a?(Prism::StatementsNode)
+
+        concern = concern_body?(node.body, child_prefix)
+        owner = child_prefix.join("::")
+        if concern
+          key = [Scope::DiscoveryIndex::ENVELOPE_HOOK_EXTEND_KIND, "ClassMethods", :const_get]
+          record_envelope(methods_acc.at(node).envelopes, owner, key, Source::ParameterEnvelope::OPAQUE)
+          record_concern_dependencies(node.body.body, child_prefix, owner, methods_acc)
+        end
+        node.body.body.each do |statement|
+          next unless statement.is_a?(Prism::CallNode) && block_statement?(statement)
+
+          if statement.name == :class_methods
+            record_class_methods_block(statement, [*child_prefix, "ClassMethods"], methods_acc, def_nodes_acc)
+          elsif CONCERN_HOOK_BLOCKS.include?(statement.name)
+            hook = concern ? statement.name : Scope::DiscoveryIndex::CONCERN_BLOCK_HOOKS.fetch(statement.name)
+            record_concern_hook_block(statement, hook, owner, methods_acc)
+            record_hook_block_singleton_defs(statement, hook, child_prefix, methods_acc, def_nodes_acc)
+          end
+        end
+      end
+
+      # Issue #3005 — a `def self.x` in an `included do … end` (or `prepended do … end`) block defines `x` on the
+      # includer's singleton class, since Ruby runs the block in the includer's class body. Each such `def` is filed
+      # as an instance method of the module's `Owner::<included>` (`<prepended>`), a name no program can spell, and
+      # the module takes a `[ENVELOPE_HOOK_EXTEND_KIND, "<included>", hook]` entry, so the includer's singleton
+      # resolution chain holds that module where the hook's own extends go: after the includer's singleton and any
+      # module prepended to it, ahead of the concern's `ClassMethods`.
+      #
+      # Issue #3015 — a receiverless `def` written as a statement of a `class << self` body in the block (found with
+      # {#each_class_methods_def}'s stops) is filed the same way. A `class << self` body with a statement-level
+      # visibility call (`private`, `private :x`, `private def x`) may make a `def` non-public, which the module does
+      # not record, so it files none of its `def`s and opens the hook instead ({#record_hook_extend_open}).
+      def record_hook_block_singleton_defs(statement, hook, child_prefix, methods_acc, def_nodes_acc)
+        segment = "<#{statement.name}>"
+        prefix = [*child_prefix, segment]
+        name = prefix.join("::")
+        owner = child_prefix.join("::")
+        defs = hook_block_singleton_defs(statement.block.body, owner, hook, methods_acc)
+        return if defs.empty?
+
+        defs.each do |def_node|
+          record_method(methods_acc.at(def_node), name, def_node.name, :instance, Source::ParameterEnvelope.of(def_node))
+          (def_nodes_acc[name] ||= {})[def_node.name] = def_node
+          record_def_body_evidence(def_node, prefix, methods_acc, :instance, receiver_side: false)
+        end
+        key = [Scope::DiscoveryIndex::ENVELOPE_HOOK_EXTEND_KIND, segment, hook]
+        record_envelope(methods_acc.at(statement).envelopes, owner, key, Source::ParameterEnvelope::OPAQUE)
+      end
+
+      # The `def`s {#record_hook_block_singleton_defs} files, opening the hook of `owner` for each `class << self` body
+      # with a visibility call.
+      def hook_block_singleton_defs(body, owner, hook, methods_acc)
+        defs = []
+        each_class_methods_def(body) { |def_node| defs << def_node if def_node.receiver.is_a?(Prism::SelfNode) }
+        each_hook_block_singleton_class(body) do |singleton|
+          statements = statements_of(singleton.body)
+          if statements.any? { |child| singleton_body_visibility_call?(child) }
+            record_hook_extend_open(owner, methods_acc.at(singleton), hook)
+          else
+            statements.each { |child| defs << child if child.is_a?(Prism::DefNode) && child.receiver.nil? }
+          end
+        end
+        defs
+      end
+
+      # Issue #3015 — the `class << self` bodies of an `included` / `prepended` block, with {#each_class_methods_def}'s
+      # stops.
+      def each_hook_block_singleton_class(node, &)
+        case node
+        when Prism::SingletonClassNode then yield node if node.expression.is_a?(Prism::SelfNode)
+        when *CONCERN_BLOCK_STOPS then nil
+        else node&.rigor_each_child { |child| each_hook_block_singleton_class(child, &) }
+        end
+      end
+
+      SINGLETON_BODY_VISIBILITY_CALLS = %i[private protected public private_class_method public_class_method].freeze
+      private_constant :SINGLETON_BODY_VISIBILITY_CALLS
+
+      def singleton_body_visibility_call?(statement)
+        statement.is_a?(Prism::CallNode) && statement.receiver.nil? &&
+          SINGLETON_BODY_VISIBILITY_CALLS.include?(statement.name)
+      end
+
+      def record_class_methods_block(statement, class_methods_prefix, methods_acc, def_nodes_acc)
+        each_class_methods_def(statement.block&.body) do |def_node|
+          record_def_method(def_node, class_methods_prefix, false, methods_acc.at(def_node))
+          record_def_node(def_node, class_methods_prefix, false, def_nodes_acc)
+          record_def_body_evidence(def_node, class_methods_prefix, methods_acc, :instance)
+        end
+      end
+
+      # Issue #2992 — `Concern#append_features` (or `prepend_features`) of a concern `include`d (or `prepend`ed) into a
+      # module that has already run `extend ActiveSupport::Concern` records it as a dependency of that module and
+      # includes nothing; the module's final includer includes it. Only a constant argument of an `include` /
+      # `prepend` on the module's own `self` ({#concern_dependency_arguments}) written as a statement of the body
+      # AFTER the body's own `extend` is provably such a dependency: one written ahead of it, or in a reopening
+      # without it, may run first and is an ordinary include.
+      # Each such constant takes a `[ENVELOPE_CONCERN_DEPENDENCY_KIND, written]` entry; whether it names a concern is
+      # the reader's question. One statement's constants are recorded last first: `include A, B` runs
+      # `B.append_features` first, so the dependencies list it ahead, and a reader that reverses the entries to put a
+      # later statement's nearer keeps one statement's in argument order, as Ruby searches them.
+      def record_concern_dependencies(statements, child_prefix, owner, methods_acc)
+        extend_at = statements.index { |statement| concern_extend?(statement, child_prefix) }
+        statements.drop(extend_at + 1).each do |statement|
+          arguments = concern_dependency_arguments(statement)
+          next if arguments.nil?
+
+          arguments.reverse_each do |argument|
+            written = Source::ConstantPath.qualified_name_or_nil(argument)
+            next if written.nil?
+
+            key = [Scope::DiscoveryIndex::ENVELOPE_CONCERN_DEPENDENCY_KIND, written]
+            record_envelope(methods_acc.at(statement).envelopes, owner, key, Source::ParameterEnvelope::OPAQUE)
+          end
+        end
+      end
+
+      # The arguments of a statement that `include`s or `prepend`s on the module's own `self`, or nil. Issue #2995 —
+      # `self.include Dep` and a receiverless or `self.` `send(:include, Dep)` run the same `append_features` as a
+      # bare `include Dep`, and the include walk records them as it does.
+      def concern_dependency_arguments(statement)
+        return nil unless statement.is_a?(Prism::CallNode) && statement.block.nil? &&
+                          lexical_self_receiver?(statement.receiver)
+
+        kind, arguments, = mixin_call_view(statement)
+        arguments if MIXIN_CALL_NAMES.include?(kind)
+      end
+
+      # Issue #1592 — an `extend` on `self` in the block extends the includer as `base.extend` in a hook does, so it
+      # records the same entries, named by the block's hook ({#record_hook_extends}), and any `extend` nested in the
+      # block, a `class << self` mixin or a `send(:extend, …)` there is open.
+      #
+      # Issue #3005 — read in every body of the module, as a `class_methods` block is: in a body that does not run
+      # `extend ActiveSupport::Concern` itself the entries name the block's gated hook
+      # ({Scope::DiscoveryIndex::CONCERN_BLOCK_HOOKS}), which a reader takes as the plain hook only for a concern.
+      def record_concern_hook_block(statement, hook, owner, methods_acc)
+        body = statement.block.body
+        each_self_call(body) do |call|
+          entry = [Scope::DiscoveryIndex::ENVELOPE_HOOK_BODY_CALL_KIND, hook, call.name]
+          record_envelope(methods_acc.at(call).envelopes, owner, entry, Source::ParameterEnvelope::OPAQUE)
+        end
+        return if body.nil?
+
+        target = ->(call) { call.receiver.nil? || call.receiver.is_a?(Prism::SelfNode) }
+        scan_hook_body(body, target, owner, methods_acc.at(statement), hook) { |call| send_extend?(call) }
+      end
+
+      CONCERN_HOOK_BLOCKS = %i[included prepended].to_set.freeze
+      HOOK_BLOCK_CALLS = (CONCERN_HOOK_BLOCKS | [:class_methods]).freeze
+
+      # Issue #3015 — the blocks of the `included` / `prepended` / `class_methods` statements of a module body that
+      # runs `extend ActiveSupport::Concern` itself; none for any other body, whose `included` may be its own DSL. A
+      # reopening without the `extend` is not read.
+      def concern_hook_blocks(node, child_prefix)
+        return [] unless node.is_a?(Prism::ModuleNode) && concern_body?(node.body, child_prefix)
+
+        node.body.body.filter_map do |statement|
+          statement.block if block_statement?(statement) && HOOK_BLOCK_CALLS.include?(statement.name)
+        end
+      end
+
+      # Issue #3015 — whether `node` is a `class << self` in a block {HookBlockSpans#mark_hook_blocks} marked for the
+      # module the walk is in: the defs of its body are not the module's own singleton methods, and the walks do not
+      # file them there.
+      def hook_block_singleton?(node, in_singleton_class, owner_prefix, accumulator)
+        !in_singleton_class && node.expression.is_a?(Prism::SelfNode) && accumulator.hook_block?(node, owner_prefix)
+      end
+      private_constant :CONCERN_HOOK_BLOCKS, :HOOK_BLOCK_CALLS
+
+      # Whether a module body runs `extend ActiveSupport::Concern` as one of its own statements (`extend Concern`
+      # in a module nested in `module ActiveSupport`).
+      def concern_body?(body, child_prefix)
+        return false unless body.is_a?(Prism::StatementsNode)
+
+        body.body.any? { |statement| concern_extend?(statement, child_prefix) }
+      end
+
+      #
+      # Issue #3005 — `self.extend ActiveSupport::Concern` and a receiverless or `self.` `send` / `public_send` /
+      # `__send__(:extend, ActiveSupport::Concern)` run the same `extend` on the module ({#mixin_call_view}).
+      def concern_extend?(statement, child_prefix)
+        return false unless statement.is_a?(Prism::CallNode) && lexical_self_receiver?(statement.receiver)
+
+        kind, arguments, = mixin_call_view(statement)
+        return false unless kind == :extend
+
+        arguments.any? do |argument|
+          written = Source::ConstantPath.qualified_name_or_nil(argument)&.delete_prefix("::")
+          written == "ActiveSupport::Concern" || (written == "Concern" && child_prefix.first == "ActiveSupport")
+        end
+      end
+
+      # A receiverless block call (`class_methods do … end`, `included do … end`). Concern's methods take no
+      # positional argument here (`class_methods` raises on one), so arguments are not looked at.
+      def block_statement?(node)
+        node.is_a?(Prism::CallNode) && node.receiver.nil? && node.block.is_a?(Prism::BlockNode)
+      end
+
+      # The `def`s a `class_methods` block body writes, directly or wrapped in a call (`private def x`), not those in
+      # a nested `def`, class, module, singleton-class, block or lambda body, which define elsewhere or later.
+      def each_class_methods_def(node, &)
+        case node
+        when Prism::DefNode then yield node
+        when *CONCERN_BLOCK_STOPS then nil
+        else node&.rigor_each_child { |child| each_class_methods_def(child, &) }
+        end
+      end
+
+      # The calls on `self` (no receiver, or `self.`) an `included` / `prepended` block body makes, not those in a
+      # nested `def`, class, module, singleton-class or lambda body.
+      #
+      # Issue #2992 — a block that keeps `self` and runs as the block body runs (`[1].each { my_c :x }`) makes its
+      # calls on the includer too, so the walk enters it ({#self_call_block?}). Any other block stays out; its call's
+      # receiver and arguments are still read.
+      def each_self_call(node, &)
+        case node
+        when *SELF_CALL_STOPS then nil
+        when Prism::CallNode
+          yield node if node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+          if node.block.is_a?(Prism::BlockNode) && !self_call_block?(node)
+            [node.receiver, node.arguments].each { |part| each_self_call(part, &) }
+          else
+            node.rigor_each_child { |child| each_self_call(child, &) }
+          end
+        else node&.rigor_each_child { |child| each_self_call(child, &) }
+        end
+      end
+
+      # Whether a call's block may run on the includer while the hook block runs. Every block may, since leaving one
+      # out would report the macro's names, except one that rebinds `self` ({#rebinds_self_block?}) and the calls
+      # known to keep a block for later: a receiverless `lambda` / `proc` and `Proc.new`, which run it only when
+      # called, and `Kernel.lambda` / `Kernel.proc`; `on_load` on any receiver, which runs it when a framework
+      # component loads; and a receiverless framework callback macro (`after_save { }`), which runs it on an instance.
+      #
+      # Issue #3000 — the callback stop is a list of the Rails callback macros, not a `before_` / `after_` /
+      # `around_` prefix: a project macro so named may yield at once (`def self.after_foo = yield`), and entering a
+      # block that runs later only loses a report.
+      def self_call_block?(node)
+        return false if rebinds_self_block?(node)
+        return false if node.name == :on_load
+
+        receiver = node.receiver
+        if receiver.nil?
+          !DEFERRED_BLOCK_CALLS.include?(node.name) && !CALLBACK_MACROS.include?(node.name)
+        elsif DEFERRED_BLOCK_CALLS.include?(node.name)
+          !constant_named?(receiver, "Kernel")
+        else
+          !(node.name == :new && constant_named?(receiver, "Proc"))
+        end
+      end
+
+      def constant_named?(node, name)
+        Source::ConstantPath.qualified_name_or_nil(node)&.delete_prefix("::") == name
+      end
+
+      DEFERRED_BLOCK_CALLS = %i[lambda proc].freeze
+      # The callback macros of ActiveModel (validations), ActiveRecord (`Callbacks::CALLBACKS`, transactions),
+      # ActiveJob (callbacks, `after_discard`), AbstractController (with its `prepend_` / `append_` forms),
+      # ActionMailer, ActionMailbox, ActionCable (channel, connection), ActiveSupport::CurrentAttributes and
+      # ActiveSupport::Reloader, read from Rails 8.1.3.
+      CALLBACK_MACROS = %i[
+        before_validation after_validation
+        after_initialize after_find after_touch
+        before_save around_save after_save before_create around_create after_create
+        before_update around_update after_update before_destroy around_destroy after_destroy
+        before_commit after_commit after_rollback
+        after_save_commit after_create_commit after_update_commit after_destroy_commit
+        before_perform around_perform after_perform before_enqueue around_enqueue after_enqueue after_discard
+        before_action around_action after_action
+        prepend_before_action prepend_around_action prepend_after_action
+        append_before_action append_around_action append_after_action
+        before_processing around_processing after_processing
+        before_reset after_reset before_class_unload after_class_unload
+        before_deliver around_deliver after_deliver
+        before_subscribe after_subscribe before_unsubscribe after_unsubscribe
+        before_command around_command after_command
+      ].to_set.freeze
+      private_constant :DEFERRED_BLOCK_CALLS, :CALLBACK_MACROS
+
+      CONCERN_BLOCK_STOPS = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode,
+                             Prism::BlockNode, Prism::LambdaNode].freeze
+      SELF_CALL_STOPS = (CONCERN_BLOCK_STOPS - [Prism::BlockNode]).freeze
+      private_constant :CONCERN_BLOCK_STOPS, :SELF_CALL_STOPS
+
+      # Issue #2901 — a method whose body runs a `define_method` on its own `self` with a computed name, directly or in
+      # a block that keeps `self` (`def self.my_attr(*n) = n.each { |x| define_method(x) {} }`), is a class macro: a
+      # class body that calls it gains members no table names. The method takes a
+      # `[ENVELOPE_COMPUTED_DEFINER_KIND, side, name]` entry, which `call.undefined-method` resolves a class's body
+      # calls against. A `def Other.x` (another object's method) records none, and neither does a `define_method` inside
+      # a nested `def`, a class body or a block that rebinds `self` ({#rebinds_self_block?}).
+      #
+      # Issue #2975 — the entry carries the side the method is defined on (`:singleton` for `def self.x` or a
+      # `class << self` body, `:instance` otherwise), so a body call resolves only against a macro on the side its
+      # singleton chain reaches.
+      def record_computed_definer(def_node, qualified_prefix, tables, side)
+        return if qualified_prefix.empty?
+        return unless def_node.receiver.nil? || def_node.receiver.is_a?(Prism::SelfNode)
+        return unless runs_computed_self_definer?(def_node.body)
+
+        key = [Scope::DiscoveryIndex::ENVELOPE_COMPUTED_DEFINER_KIND, side, def_node.name]
+        record_envelope(tables.envelopes, qualified_prefix.join("::"), key, Source::ParameterEnvelope::OPAQUE)
+      end
+
+      def computed_self_define_method?(node)
+        node.name == :define_method && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)) &&
+          computed_first_name?(node.arguments&.arguments)
       end
 
+      def runs_computed_self_definer?(node)
+        case node
+        when Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode
+          return false
+        when Prism::CallNode
+          return true if computed_self_define_method?(node)
+          # Issue #2975 — `include(Module.new { define_method(x) {} })` on `self` puts the computed method on `self`'s
+          # instance side, as a direct `define_method(x)` would.
+          return true if MODULE_NEW_MIXIN_CALLS.include?(node.name) &&
+                         (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)) &&
+                         module_new_definer_argument?(node)
+          if rebinds_self_block?(node)
+            return [node.receiver, node.arguments].any? do |part|
+              runs_computed_self_definer?(part)
+            end
+          end
+        end
+        return false unless node.is_a?(Prism::Node)
+
+        node.rigor_each_child { |child| return true if runs_computed_self_definer?(child) }
+        false
+      end
+
+      # A call whose block runs with another `self`: a class factory (`Class.new { }`), a definer's own body
+      # (`define_method(:x) { }` runs on an instance), or an eval on a receiver other than `self`.
+      def rebinds_self_block?(node)
+        return false unless node.block.is_a?(Prism::BlockNode)
+        return true if meta_new_constant_rvalue?(node) || SELF_DEFINER_BLOCK_CALLS.include?(node.name)
+
+        RECEIVER_EVAL_CALLS.include?(node.name) && !(node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+      end
+
+      SELF_DEFINER_BLOCK_CALLS = %i[define_method define_singleton_method].freeze
+      private_constant :SELF_DEFINER_BLOCK_CALLS
+
       # Issue #1820 — `obj.singleton_class.prepend(M)`, or `prepend M` in a `class << obj` body, puts `M` ahead of
       # `obj`'s class even when the class already includes it (`prepend` re-inserts it; `extend` would not), so
       # `M`'s refinement answers first for that object. `M` takes {Scope::DiscoveryIndex::ENVELOPE_OBJECT_EXTENDED_MARK},
@@ -4766,6 +5854,56 @@ module Rigor
         record_object_extension(node, qualified_prefix, tables) if singleton
       end
 
+      # Issue #2998 — a prepend to the class object's own singleton class, `prepend P` in a `class << self` body or
+      # `singleton_class.prepend P` / `singleton_class.send(:prepend, P)` in the class body, files a
+      # `[ENVELOPE_SINGLETON_PREPEND_KIND, "P"]` entry per constant argument, as the extends walk spells it, under the
+      # owner the walk passes in. The extends walk records the same edge in `discovered_extends`, and the singleton
+      # resolution chain reads the entries that match one of those edges as prepends.
+      #
+      # A constant receiver's `Const.singleton_class.prepend P` (or its `send` spelling) files the entry on every name
+      # the constant can denote from the call site, as {#record_body_rewrite} marks it; the extends walk records that
+      # edge unpositioned, so the chain's reading of it is master's and the typing read declines where they differ.
+      # `prefixes` is `[owner_prefix, qualified_prefix]`: the class `self` names (empty where it names none) and the
+      # lexical prefix a constant resolves against.
+      #
+      # Issue #3020 — an argument that names no module (`prepend(*MODS)`, `prepend helper`; {#opaque_mixin_argument?})
+      # files `[ENVELOPE_SINGLETON_PREPEND_KIND, "?"]`: the extends walk lists that edge as {MixinAccumulator::UNNAMED},
+      # which cannot say a prepend from an `extend`, and the chain reads the entry as a prepend region it cannot name.
+      def record_own_singleton_prepend(node, prefixes, in_singleton_class, tables)
+        kind, arguments, = mixin_call_view(node)
+        return unless kind == :prepend
+
+        owners = singleton_prepend_owners(node.receiver, *prefixes, in_singleton_class)
+        arguments.each do |argument|
+          name = Source::ConstantPath.qualified_name(argument)
+          name ||= MixinAccumulator::UNNAMED if opaque_mixin_argument?(argument)
+          next unless name
+
+          key = [Scope::DiscoveryIndex::ENVELOPE_SINGLETON_PREPEND_KIND, name]
+          owners.each { |owner| record_envelope(tables.envelopes, owner, key, Source::ParameterEnvelope::OPAQUE) }
+        end
+      end
+
+      # The classes whose singleton a prepend call on `receiver` reaches: the enclosing class for `prepend` in its
+      # `class << self` body or `singleton_class.prepend` on a bare or `self.` receiver, and every name a constant
+      # receiver's `Const.singleton_class` can denote.
+      def singleton_prepend_owners(receiver, owner_prefix, qualified_prefix, in_singleton_class)
+        own = owner_prefix.empty? ? EMPTY_PREFIX : [owner_prefix.join("::")]
+        return own if in_singleton_class && lexical_self_receiver?(receiver)
+        return EMPTY_PREFIX unless singleton_class_of_receiver?(receiver)
+
+        object = receiver.receiver
+        return in_singleton_class ? EMPTY_PREFIX : own if lexical_self_receiver?(object)
+        return EMPTY_PREFIX unless object.is_a?(Prism::ConstantReadNode) || object.is_a?(Prism::ConstantPathNode)
+
+        constant_receiver_candidates(object, qualified_prefix)
+      end
+
+      # A bare or `self.` receiver's `singleton_class` call: `singleton_class` or `self.singleton_class`.
+      def self_singleton_class?(receiver)
+        singleton_class_of_receiver?(receiver) && lexical_self_receiver?(receiver.receiver)
+      end
+
       def singleton_class_call?(receiver, self_ok)
         return false unless receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class
         return false unless receiver.arguments.nil?
@@ -4774,6 +5912,28 @@ module Rigor
         self_ok || !(object.nil? || object.is_a?(Prism::SelfNode))
       end
 
+      # Issue #3010 — the singleton-prepend entries of a `class << Const` body's prepends on the other names the
+      # constant can denote ({#constant_singleton_owners}); the body's own walk files them under the owner. The
+      # extends walk records the matching edges, unpositioned ({#record_constant_singleton_candidates}). In a method
+      # body, which the methods walk does not enter, `owner:` files them under the owner too.
+      def record_constant_singleton_prepends(node, qualified_prefix, tables, owner: false)
+        return unless constant_singleton_class?(node)
+
+        resolved, others = constant_singleton_owners(node, qualified_prefix)
+        others = [resolved, *others] if owner
+        return if others.empty? || node.body.nil?
+
+        each_singleton_body_prepend(node.body) do |call|
+          mixin_call_view(call)[1].each do |argument|
+            name = Source::ConstantPath.qualified_name(argument)
+            next unless name
+
+            key = [Scope::DiscoveryIndex::ENVELOPE_SINGLETON_PREPEND_KIND, name]
+            others.each { |owner| record_envelope(tables.envelopes, owner, key, Source::ParameterEnvelope::OPAQUE) }
+          end
+        end
+      end
+
       def record_singleton_body_prepends(node, qualified_prefix, tables)
         return if node.body.nil?
 
@@ -4805,17 +5965,44 @@ module Rigor
         end
       end
 
-      # `def Foo.bar` inside `module Foo` (or `def Meta.init` inside `module Meta`) is semantically equivalent to `def
-      # self.bar`: at the def-site, the runtime value of the constant `Foo` is the module itself (== `self`). Recognise
-      # the form so the method registers as singleton on the enclosing class.
+      # The side of the enclosing class `qualified_prefix` a `def` defines its method on: `:instance`, `:singleton`, or
+      # nil when the def defines no method of that class.
       #
-      # The cross-class form `def Bar.baz` inside `module Foo` — where the receiver names a constant other than the
-      # enclosing class — is not supported at this slice; falls through to `:instance` (current behaviour) rather than
-      # silently re-routing the registration.
+      # `in_singleton_class` is true in a `class << self` body and `:eval` in an `instance_eval` block on the class
+      # ({#def_context}), whose `self` is the class itself.
+      #
+      # - A receiverless def lands on the instance side, or on the singleton side in either body.
+      # - `def self.x` is a singleton method. `def Foo.x` inside `module Foo` (or `def Meta.init` inside `module Meta`)
+      #   is the same: at the def-site the constant `Foo` is the module itself (== `self`).
+      # - Issue #3155 — any other receiver (`def String.q`, `def A.z` in `A::B`, `def obj.q` on a local or a constant
+      #   holding an object) is a singleton method of that object, not the enclosing class, and `def self.x` in a
+      #   `class << self` body is a method of the singleton class's own singleton: nil. The def's body is still
+      #   walked; only the method is not filed on the enclosing class. A constant receiver's own singleton is
+      #   {#record_foreign_singleton_def}'s.
+      def def_side(def_node, qualified_prefix, in_singleton_class)
+        receiver = def_node.receiver
+        if receiver.nil?
+          in_singleton_class ? :singleton : :instance
+        elsif receiver.is_a?(Prism::SelfNode)
+          in_singleton_class == true ? nil : :singleton
+        elsif def_receiver_targets_lexical_self?(receiver, qualified_prefix)
+          :singleton
+        end
+      end
+
+      # The `in_singleton_class` {#def_side} reads for a def under a walk's two flags: an `instance_eval` block's
+      # `defs_singleton` (`self` is the receiver, so `def self.x` is its singleton method) unless the def is also in
+      # a `class << self` body.
+      def def_context(in_singleton_class, defs_singleton)
+        in_singleton_class || (defs_singleton ? :eval : false)
+      end
+
       def def_singleton?(def_node, qualified_prefix, in_singleton_class)
-        return true if def_node.receiver.is_a?(Prism::SelfNode) || in_singleton_class
+        def_side(def_node, qualified_prefix, in_singleton_class) == :singleton
+      end
 
-        def_receiver_targets_lexical_self?(def_node.receiver, qualified_prefix)
+      def foreign_def?(def_node, qualified_prefix, in_singleton_class)
+        def_side(def_node, qualified_prefix, in_singleton_class).nil?
       end
 
       # Only `Prism::ConstantReadNode` is observed in real Ruby — Prism mis-parses `def C::P.method` as `def C.P` (Ruby
@@ -4848,7 +6035,7 @@ module Rigor
       # ADR-119 WD3 — the slot follows its writer (later-wins): a certain write clears the key from
       # `contested_discovered_def_nodes` and a possible one adds it ({MethodTables#certain}, set for `def_node`).
       def record_def_node(def_node, qualified_prefix, in_singleton_class, accumulator, tables = nil)
-        return if def_singleton?(def_node, qualified_prefix, in_singleton_class)
+        return unless def_side(def_node, qualified_prefix, in_singleton_class) == :instance
 
         class_name = qualified_prefix.empty? ? TOP_LEVEL_DEF_KEY : qualified_prefix.join("::")
         accumulator[class_name] ||= {}
@@ -4873,8 +6060,9 @@ module Rigor
 
       # Issue #1989 — the instance method names a non-`def` definer written on the class body's self replaces:
       # each reader (and `x=` writer) an `attr_*` call declares, a literal `define_method(:x)`, and the new name of
-      # an `alias_method :x, :y` call. A non-literal name replaces nothing Rigor can name.
-      def call_superseded_names(call_node)
+      # an `alias_method :x, :y` call, and each instance-side name of a Forwardable delegator (#2793). A non-literal
+      # name replaces nothing Rigor can name.
+      def call_superseded_names(call_node, qualified_prefix, accumulator)
         if (macro = attr_macro(call_node))
           names = []
           each_attr_macro_name(call_node) do |base|
@@ -4884,6 +6072,8 @@ module Rigor
           names
         elsif call_node.name == :define_method
           define_method_superseded_name(call_node)
+        elsif (forwarded = forwardable_superseded_names(call_node, qualified_prefix, accumulator)).any?
+          forwarded
         else
           Source::AliasNames.alias_method_call_names(call_node)&.first(1) || []
         end
@@ -4969,6 +6159,10 @@ module Rigor
       # The singleton walk's accumulator: the `{class => {name => DefNode}}` table, plus the contested slots, which
       # follow each slot's writer ({#follow_slot_writer}'s rule).
       class SingletonDefTable < Hash
+        include HookBlockSpans
+
+        attr_accessor :hook_block_spans
+
         # Issue #1936 — contests the slots of `names` (every slot of `class_name` for `:all`) that an earlier write
         # filled: a later non-`def` definer replaced the `def` they hold. The slot keeps the `def`, as
         # {ScopeIndexer#supersede_def_nodes} keeps the instance one, and a later write clears the contest.
@@ -5160,7 +6354,7 @@ module Rigor
                                  mf_offsets, ranges, def_owner_prefix, singleton_cref,
                                  defs_singleton)
         owner = defs_singleton == :unnameable ? EMPTY_PREFIX : (def_owner_prefix || qualified_prefix)
-        record_deferred_def(node, owner, in_singleton_class || defs_singleton, inside_deferred,
+        record_deferred_def(node, owner, def_context(in_singleton_class, defs_singleton), inside_deferred,
                             mf_offsets, ranges)
         walk_deferred_children(node, qualified_prefix, in_singleton_class, true, mf_offsets,
                                ranges, def_owner_prefix, singleton_cref: singleton_cref,
@@ -5428,18 +6622,35 @@ module Rigor
       # proves `S::A` exists). Memoized on the `Prism::Source` every node's
       # location shares — threading the set through the dozen eval-consuming
       # walks would dwarf the resolution it feeds, so the one re-parse this
-      # needs happens once per file. The memo lives in an ivar ON the source
-      # (rather than a WeakMap keyed on it): the entry's lifetime is the
-      # parse's own, nothing mutable sits in a constant, and a worker parsing
-      # the same text gets its own source and its own set.
+      # needs happens once per file. The memo is a {TypingState} Memo, a
+      # WeakKeyMap keyed on the source: the entry's lifetime is the parse's own
+      # (the map holds the key weakly), the set is a pure function of the
+      # source's text, and a worker parsing the same text gets its own source
+      # and its own set. Not run-scoped: an entry holds no run's tables.
+      DECLARED_NAMES = TypingState.memo(
+        :scope_index_declared_names,
+        audit: "scope index declared names",
+        reason: "a WeakKeyMap keyed on the Prism::Source; the frozen set is a pure function of the source's text"
+      )
+      private_constant :DECLARED_NAMES
+
       def eval_file_declared_names(node)
         source = node.location.send(:source)
-        source.instance_variable_get(:@rigor_declared_names) ||
-          source.instance_variable_set(:@rigor_declared_names, begin
-            names = Set.new
-            collect_declared_constant_names(Prism.parse(source.source).value, [], names)
-            names.freeze
-          end)
+        return scan_declared_names(source) if MemoAudit.enabled? && MemoAudit.suspended?
+
+        table = TypingState.current.weak_key_map(DECLARED_NAMES)
+        stored = table[source]
+        if stored.nil?
+          return table[source] = MemoAudit.key_audit("scope index declared names") { scan_declared_names(source) }
+        end
+
+        MemoAudit.check("scope index declared names", stored, source.source.bytesize) { scan_declared_names(source) }
+      end
+
+      def scan_declared_names(source)
+        names = Set.new
+        collect_declared_constant_names(Prism.parse(source.source).value, [], names)
+        names.freeze
       end
 
       # The walk behind {eval_file_declared_names}: every qualified constant
@@ -5669,7 +6880,11 @@ module Rigor
           return
         end
 
-        kind = if def_singleton?(def_node, qualified_prefix, in_singleton_class)
+        side = def_side(def_node, qualified_prefix, in_singleton_class)
+        # Issue #3155 — a def on another object's singleton claims no owner or side, as a deferred one.
+        return ranges << [start, def_node.location.end_offset, def_node.name, nil, nil] if side.nil?
+
+        kind = if side == :singleton
                  :singleton
                elsif ModuleFunctionState.deferred_module_function?(mf_offsets, start)
                  :both
@@ -5684,7 +6899,7 @@ module Rigor
       # `module_function` toggle threads correctly across the body's *sibling* statements (a child-by-child recursion
       # would reset it). At the top level / inside an arbitrary node there is no `module_function` state to carry, so
       # descent is a plain per-child walk.
-      def walk_singleton_def_nodes(node, qualified_prefix, in_singleton_class, accumulator, # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+      def walk_singleton_def_nodes(node, qualified_prefix, in_singleton_class, accumulator, # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
                                    def_owner_prefix = nil, singleton_cref: false,
                                    defs_singleton: false)
         return unless node.is_a?(Prism::Node)
@@ -5708,6 +6923,7 @@ module Rigor
             # ownerless like `class << <non-constant>`; nameable headers re-anchor.
             child_cref = unnameable_decl?(node, self_decl, singleton_cref)
             body_prefix = child_cref ? [] : child_prefix
+            accumulator.mark_hook_blocks(concern_hook_blocks(node, child_prefix), child_prefix) unless child_cref
             if node.body
               walk_singleton_body(node.body, body_prefix, false, accumulator, nil,
                                   singleton_cref: child_cref)
@@ -5723,7 +6939,8 @@ module Rigor
           walk_singleton_def_nodes(node.expression, qualified_prefix, in_singleton_class,
                                    accumulator, def_owner_prefix, singleton_cref: singleton_cref,
                                                                   defs_singleton: defs_singleton)
-          if node.body
+          if node.body && !hook_block_singleton?(node, in_singleton_class, def_owner_prefix || qualified_prefix,
+                                                 accumulator)
             walk_singleton_body(node.body, qualified_prefix, true, accumulator, singleton_prefix,
                                 singleton_cref: true)
           end
@@ -5735,9 +6952,11 @@ module Rigor
         when Prism::DefNode
           # `:unnameable` is the `class <<` + `instance_eval` definee — the singleton's own
           # singleton — which this table cannot name either.
+          owner = def_owner_prefix || qualified_prefix
+          return if accumulator.hook_block_self_def?(node, owner)
+
           unless defs_singleton == :unnameable
-            record_singleton_def_node(node, def_owner_prefix || qualified_prefix,
-                                      in_singleton_class || defs_singleton, false, accumulator)
+            record_singleton_def_node(node, owner, def_context(in_singleton_class, defs_singleton), false, accumulator)
           end
           return
         end
@@ -5995,7 +7214,7 @@ module Rigor
             # `:unnameable` is the `class <<` + `instance_eval` definee — the singleton's own
             # singleton — which this table cannot name either.
             unless defs_singleton == :unnameable
-              record_singleton_def_node(stmt, owner_prefix, in_singleton_class || defs_singleton,
+              record_singleton_def_node(stmt, owner_prefix, def_context(in_singleton_class, defs_singleton),
                                         module_function_on, accumulator)
             end
             next
@@ -6037,8 +7256,9 @@ module Rigor
       # function's copy as possible, so the slot holds the later def, contested, rather than the def the
       # slot held before (#1968).
       def record_singleton_def_node(def_node, qualified_prefix, in_singleton_class, module_function_on, accumulator)
-        declared = def_singleton?(def_node, qualified_prefix, in_singleton_class)
-        return unless declared || module_function_on
+        side = def_side(def_node, qualified_prefix, in_singleton_class)
+        declared = side == :singleton
+        return unless declared || (module_function_on && side == :instance)
         return if qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
@@ -6634,6 +7854,7 @@ module Rigor
       def record_data_member_layout(accumulator, qualified_parts, expr, allow_outer_block: true)
         expr = resolve_meta_factory_call(expr, allow_outer_block: allow_outer_block)
         return unless expr && data_define_call?(expr)
+        return if meta_members_open?(expr)
 
         members = meta_member_names(expr)
         return if members.empty?
@@ -6756,6 +7977,7 @@ module Rigor
       def record_struct_member_layout(accumulator, qualified_parts, expr, allow_outer_block: true)
         expr = resolve_meta_factory_call(expr, allow_outer_block: allow_outer_block)
         return unless expr && struct_new_call?(expr)
+        return if meta_members_open?(expr)
 
         members = meta_member_names(expr)
         return if members.empty?
@@ -6924,6 +8146,7 @@ module Rigor
 
         _self_decl, child_prefix, child_cref = ctx
         accumulator.direct_body(node.body) if accumulator.direct?(node)
+        accumulator.class_body(node.body)
         walk_class_includes(node.body, child_cref ? [] : child_prefix,
                             child_cref ? nil : child_prefix.join("::"), accumulator,
                             singleton_cref: child_cref)
@@ -7020,7 +8243,8 @@ module Rigor
       def record_mixin_call(node, qualified_prefix, current_class, accumulator)
         taint_opaque_eval(node, current_class, accumulator)
         view = mixin_call_view(node)
-        return if view.nil? || view.first.nil?
+        return taint_computed_mixin_send(node, current_class, accumulator, INSTANCE_MIXIN_NAMES, :include) if view.nil?
+        return if view.first.nil?
 
         kind = view.first
         current_class ||= toplevel_include_owner(node, qualified_prefix, current_class, accumulator)
@@ -7030,20 +8254,68 @@ module Rigor
         return if instance_mixin_recorded?(node, view, qualified_prefix, current_class, accumulator)
 
         # A mixin call the tables cannot hold still reshapes the ancestry: taint the whole owner side.
-        effects.each { |owner, side| accumulator.taint(owner, side) }
+        taint_unrecorded_mixin(node, kind, view[1], effects, accumulator)
+      end
+
+      # Issue #2991 — an unrecorded `include` / `prepend` that reaches the instance side (its receiver is not a
+      # `singleton_class` call) leaves that side's module SET unknown when an argument is not a constant
+      # (`include(*MODS)`, `include helper`) or the receiver is a hook parameter (`base.include M`), which lists
+      # {MixinAccumulator::UNNAMED}. A `Module.new { … }` argument keeps its #2975 reading. A hook's `base.extend M` or
+      # `base.singleton_class.include M` taints the instance side's order alone: it mixes nothing into it.
+      #
+      # Issue #2995 — an instance-side call whose arguments are all constants is recorded wherever the walk names its
+      # owner (`self.include M` and a receiverless `send(:include, M)` included), so none reaches here with a module
+      # the tables do not hold. The extends walk's taint of `Const.include M` inside `class << self` is the one
+      # constant-argument call that does, and the include walk records that edge under `Const`.
+      #
+      # Issue #2994 — the singleton side lists {MixinAccumulator::UNNAMED} too when an unrecorded call reaching it has
+      # an argument that is not a constant: `extend(*EMODS)`, `extend helper`, `include(*MODS)` inside `class << self`,
+      # or a `self` argument. A hook parameter's `base.extend(*X)` extends the includer, not the module the hook is
+      # written in, so it leaves that module's singleton side unnamed-free.
+      def taint_unrecorded_mixin(node, kind, arguments, effects, accumulator)
+        opaque = arguments.any? { |arg| opaque_mixin_argument?(arg) }
+        hook = hook_parameter_receiver?(node.receiver, accumulator)
+        unnamed = INSTANCE_MIXIN_NAMES.include?(kind) && !singleton_class_eval_receiver?(node.receiver) &&
+                  (hook || opaque)
+        effects.each do |owner, side|
+          accumulator.taint(owner, side, unnamed: side == :include ? unnamed : opaque && !hook)
+        end
       end
 
-      # Records the instance-side edges of a call {#mixin_call_recorded?} accepts. False when it recorded
-      # nothing — the caller then taints the owner instead. `view` is {#mixin_call_view}'s, so
-      # `Integer.send(:include, Ext)` records `Ext` as `Integer.include(Ext)` does (issue #1722).
+      # A `self` argument counts as opaque, as the instance side reads it: a `Target.send(:extend, self)` written in a
+      # module body reaches here with the module no table records under `Target`.
+      def opaque_mixin_argument?(arg)
+        Source::ConstantPath.qualified_name(arg).nil? && !module_new_call?(arg)
+      end
+
+      # A hook parameter itself (`base` in `def self.included(base)`): its class is the includer, which the walk cannot
+      # name, so a mixin on it is read as unnamed rather than by its constant (#2991).
+      def hook_parameter_receiver?(receiver, accumulator)
+        receiver.is_a?(Prism::LocalVariableReadNode) && accumulator.hook_local?(receiver.name)
+      end
+
+      # Records the instance-side edges of an `include` / `prepend` call. False when it recorded nothing — the caller
+      # then taints the owner instead. `view` is {#mixin_call_view}'s, so `Integer.send(:include, Ext)` records `Ext` as
+      # `Integer.include(Ext)` does (issue #1722).
+      #
+      # A receiverless `include` / `prepend` needs an enclosing declaration to file the edge under, and the RECEIVER
+      # form (`Base.prepend(Loud)`, issue #1123; `Integer.include(Ext)` and `Integer.send(:include, Ext)`, issue
+      # #1722) files it under the class the receiver names. A receiver-form edge is unpositioned wherever it is written
+      # ({MixinAccumulator#note}), so a reader that depends on ORDER declines on it, while the set-shaped readers
+      # (undefined-method suppression, arity, visibility) see the module as they see an in-body `include`.
+      #
+      # Issue #2995 — `self.include M`, `self.prepend M` and a receiverless or `self.` `send` / `public_send` /
+      # `__send__(:include | :prepend, M)` are the same call on the same `self` as a bare `include M`, so they file
+      # the edge under the enclosing class as it does, positioned where it would be ({MixinAccumulator#note}). The
+      # walk names that `self` exactly where it names a bare `include`'s: `current_class` is nil wherever it cannot.
       def instance_mixin_recorded?(node, view, qualified_prefix, current_class, accumulator)
-        kind, arguments, via_send = view
-        return false unless mixin_call_recorded?(node, kind, via_send, current_class)
+        kind, arguments, = view
+        return false unless mixin_call_recorded?(kind)
 
         targets = arguments.filter_map { |arg| Source::ConstantPath.qualified_name(arg) }
         return false if targets.empty?
 
-        owner = node.receiver.nil? ? current_class : prepend_call_receiver(node, qualified_prefix)
+        owner = lexical_self_receiver?(node.receiver) ? current_class : prepend_call_receiver(node, qualified_prefix)
         return false if owner.nil?
 
         write_mixin_targets(accumulator, owner, targets, prepend: kind == :prepend)
@@ -7053,7 +8325,234 @@ module Rigor
 
       MIXIN_KINDS = %i[include prepend extend].freeze
       SEND_CALL_NAMES = %i[send public_send __send__].freeze
-      private_constant :MIXIN_KINDS, :SEND_CALL_NAMES
+      EXTEND_MIXIN_NAMES = %i[extend].freeze
+      private_constant :MIXIN_KINDS, :SEND_CALL_NAMES, :EXTEND_MIXIN_NAMES
+
+      # Issue #3006 — a receiverless or `self.` `send` / `public_send` / `__send__` written in a class body
+      # ({MixinAccumulator#class_body_scope}) whose name is computed and which passes at least one further argument
+      # may be an `include`, `prepend` or `extend` the walk cannot record: it lists {MixinAccumulator::UNNAMED} on
+      # `side` of the enclosing class when the name may be one of `kinds`. A name that is a local of the call's scope
+      # bound only to name literals is read as those names ({#local_send_names}), so `m = :attr_reader; send(m, :x)`
+      # marks nothing. A hook parameter's `base.send(meth, M)` is read wherever the hook is, as
+      # {#taint_unrecorded_mixin} reads `base.send(:include, M)`.
+      def taint_computed_mixin_send(node, current_class, accumulator, kinds, side, in_singleton: false)
+        return unless current_class
+
+        name = computed_send_name(node, accumulator)
+        return if name.nil?
+
+        scope = accumulator.class_body_scope(node)
+        hook = hook_parameter_receiver?(node.receiver, accumulator)
+        return if scope.nil? && !hook
+
+        names = scope && local_send_names(name, scope)
+        # Inside `class << self` the instance walk is ownerless, so this walk keeps the hook's instance-side taint too,
+        # as {#record_extend_call} does for `base.send(:include, M)`.
+        sides = in_singleton ? [side, :include] : [side]
+        return taint_computed_hook_send(current_class, accumulator, names, sides) if hook
+        return if names&.none? { |literal| kinds.any? { |kind| kind.name == literal } }
+
+        accumulator.taint(current_class, side, unnamed: true)
+      end
+
+      # A hook parameter's computed `send`, read as {#taint_unrecorded_mixin} reads the literal one: it taints the
+      # enclosing module's `sides` when the name may be any mixin's, and lists the unnamed marker on the instance side
+      # alone, when the name may be `include` or `prepend`.
+      def taint_computed_hook_send(current_class, accumulator, names, sides)
+        return if names&.none? { |literal| MIXIN_KINDS.any? { |kind| kind.name == literal } }
+
+        instance = names.nil? || names.any? { |literal| INSTANCE_MIXIN_NAMES.any? { |kind| kind.name == literal } }
+        sides.each { |side| accumulator.taint(current_class, side, unnamed: side == :include && instance) }
+      end
+
+      # The name argument of a receiverless, `self.` or hook-parameter `send`-family call that passes at least one
+      # further argument, when no literal spells it; else nil.
+      def computed_send_name(node, accumulator)
+        return unless SEND_CALL_NAMES.include?(node.name)
+        return unless lexical_self_receiver?(node.receiver) || hook_parameter_receiver?(node.receiver, accumulator)
+
+        arguments = node.arguments&.arguments
+        return if arguments.nil? || arguments.size < 2
+
+        first = arguments.first
+        first unless literal_send_name(first)
+      end
+
+      LOCAL_SCOPE_BOUNDARIES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      private_constant :LOCAL_SCOPE_BOUNDARIES
+
+      # The names a local `send` argument can hold: every literal a `local = :name` / `local = "name"` in `scope`
+      # writes, or nil when the argument is not a local, or when the local has no such write or any other binding in
+      # `scope` — a parameter (the `def`'s or a block's, which may shadow it), a multiple or operator write, a pattern
+      # or a regexp capture. Blocks share their scope's locals, so they are searched; a nested `def` or declaration
+      # opens a scope of its own, so it is not.
+      #
+      # Issue #3024 — one block parameter is not opaque: as the FIRST parameter of `each` / `each_with_index` /
+      # `map` over a literal array (or a constant the same scope assigns a literal array), it holds each element in
+      # turn, so the elements are read as the candidate names ({#iterated_element_source}). An element that is not
+      # a name literal still means "may be anything".
+      def local_send_names(argument, scope)
+        return nil unless argument.is_a?(Prism::LocalVariableReadNode)
+
+        names = []
+        root = scope.is_a?(Prism::DefNode) ? scope.compact_child_nodes : [scope]
+        return nil unless collect_local_send_names(root, argument.name, names, root)
+
+        names.empty? ? nil : names
+      end
+
+      def collect_local_send_names(nodes, local, names, scope_nodes)
+        nodes.all? do |node|
+          next true if LOCAL_SCOPE_BOUNDARIES.any? { |kind| node.is_a?(kind) }
+
+          iterated = iterated_element_names(node, local, scope_nodes)
+          next false if iterated == false
+
+          if iterated
+            names.concat(iterated)
+            next collect_local_send_names(iterated_element_children(node), local, names, scope_nodes)
+          end
+
+          literal = local_send_name_literal(node, local)
+          next false if literal == :clash
+
+          names << literal if literal
+
+          collect_local_send_names(node.compact_child_nodes, local, names, scope_nodes)
+        end
+      end
+
+      # Issue #3024 — the `each` / `each_with_index` / `map` arm of {#collect_local_send_names}: when `node` is
+      # such an iterator whose first block parameter is `local`, the iterated array's elements are `local`'s
+      # candidate names ({#iterated_element_source}), each read as {#literal_send_name}. False when an element
+      # may spell any name; nil when `node` is not that iterator, so the caller's plain-write and binding checks
+      # apply.
+      def iterated_element_names(node, local, scope_nodes)
+        elements = iterated_element_source(node, local, scope_nodes)
+        return if elements.nil?
+        return false if elements == :unknown
+
+        names = elements.map { |element| literal_send_name(element) }
+        return false if names.any?(&:nil?)
+
+        names
+      end
+
+      # The name literal a `local = :name` / `local = "name"` write binds `local` to for
+      # {#collect_local_send_names}, `:clash` when `node` binds `local` to anything else — a non-literal write,
+      # a target, an operator write, a parameter — or nil when `node` does not bind `local` at all.
+      def local_send_name_literal(node, local)
+        if node.is_a?(Prism::LocalVariableWriteNode) && node.name == local
+          name = literal_send_name(node.value)
+          return :clash if name.nil?
+
+          return name
+        end
+        :clash if local_binding?(node, local)
+      end
+
+      # Issue #3024 — the array elements `node` iterates when it is an `each` / `each_with_index` / `map` call
+      # whose FIRST block parameter is `local`: a literal `ArrayNode` receiver's elements, or a bare constant the
+      # same scope assigns a literal array exactly once ({#constant_array_elements}). `:unknown` when the call is
+      # such an iterator on `local` but its elements cannot be read — a non-literal receiver, or a constant that
+      # is unwritten, multiply written or not array-valued — so the parameter may hold anything; nil when `node`
+      # is not the iterator or `local` is not its first parameter.
+      def iterated_element_source(node, local, scope_nodes)
+        return unless node.is_a?(Prism::CallNode) && ARRAY_ITERATORS.include?(node.name)
+
+        block = node.block
+        return unless block.is_a?(Prism::BlockNode)
+        return unless iterated_first_parameter?(block, local)
+
+        iterated_receiver_elements(node.receiver, scope_nodes) || :unknown
+      end
+
+      # Whether `local` is the first parameter of `block` and no other parameter binds it too (`|m, m = x|` — the
+      # later binding wins, so the first is not the element).
+      def iterated_first_parameter?(block, local)
+        declared = block.parameters
+        return false unless declared.is_a?(Prism::BlockParametersNode)
+
+        parameters = declared.parameters
+        first = parameters&.requireds&.first
+        return false unless first.is_a?(Prism::RequiredParameterNode) && first.name == local
+
+        Source::NodeWalker.each(parameters).none? do |param|
+          !param.equal?(first) && local_binding?(param, local)
+        end
+      end
+
+      # The elements of the array `receiver` denotes for {#iterated_element_source}: a literal array's own, or a
+      # bare constant's when the same scope assigns it a literal array exactly once. Nil when it denotes anything
+      # else — a qualified or rooted constant, a local, a call — so the iterated value may be anything.
+      def iterated_receiver_elements(receiver, scope_nodes)
+        return receiver.elements if receiver.is_a?(Prism::ArrayNode)
+        return unless receiver.is_a?(Prism::ConstantReadNode)
+
+        constant_array_elements(receiver.name, scope_nodes)
+      end
+
+      # The elements of the literal array `name` is assigned in `nodes`' scope, or nil when it is written any
+      # other number of times or its value is not an array literal — the constant may then hold anything. Only
+      # a single plain `NAME = […]` write closes; in-place mutation (`KINDS << :include`) is unmodeled.
+      def constant_array_elements(name, nodes)
+        writes = constant_write_nodes(nodes, name)
+        return unless writes.one? && writes.first.is_a?(Prism::ConstantWriteNode)
+
+        value = writes.first.value
+        value.elements if value.is_a?(Prism::ArrayNode)
+      end
+
+      # Every write binding the bare constant `name` in `nodes`' scope — a plain `NAME = …`, a multi-assign
+      # target or an operator / `&&=` / `||=` write, mirroring {#local_binding?} — stopping where
+      # {#collect_local_send_names} stops, since a nested `def` or declaration binds its own constants — so
+      # {#constant_array_elements} can tell one literal-array assignment from none or several.
+      def constant_write_nodes(nodes, name)
+        nodes.flat_map do |node|
+          next [] if LOCAL_SCOPE_BOUNDARIES.any? { |kind| node.is_a?(kind) }
+
+          own = constant_binding?(node, name) ? [node] : []
+          own + constant_write_nodes(node.compact_child_nodes, name)
+        end
+      end
+
+      # A node that binds the bare constant `name`: every `Prism::Constant*` binding class — write, target,
+      # operator, `&&=` and `||=` — except the `ConstantReadNode` and `ConstantPath*` spellings, which read
+      # `name` or bind a qualified `A::NAME` rather than `name` itself.
+      def constant_binding?(node, name)
+        return false unless node.respond_to?(:name) && node.name == name
+
+        klass = node.class.name
+        klass.start_with?("Prism::Constant") && !klass.start_with?("Prism::ConstantPath") &&
+          !node.is_a?(Prism::ConstantReadNode)
+      end
+
+      # The children of an iterator call {#iterated_element_source} matched, minus its block's parameters — the
+      # first is `local` bound to the elements and the rest bind other names — so the usual scan still sees every
+      # other binding of `local` in the receiver, arguments and body.
+      def iterated_element_children(node)
+        [node.receiver, node.arguments, node.block.body].compact
+      end
+
+      # The method name a `send` argument spells: a name literal's, or `""` — no mixin's — for an interpolation with a
+      # literal part no mixin name contains (`"#{name}_from_params"`). Nil when it may spell any name.
+      def literal_send_name(value)
+        return value.unescaped if value.is_a?(Prism::SymbolNode) || value.is_a?(Prism::StringNode)
+        return nil unless value.is_a?(Prism::InterpolatedStringNode) || value.is_a?(Prism::InterpolatedSymbolNode)
+
+        excluded = value.parts.any? do |part|
+          part.is_a?(Prism::StringNode) && MIXIN_KINDS.none? { |kind| kind.name.include?(part.unescaped) }
+        end
+        excluded ? "" : nil
+      end
+
+      # A node other than a plain write that binds `local`: a target, an operator write or a parameter.
+      def local_binding?(node, local)
+        return false if node.is_a?(Prism::LocalVariableReadNode) || !node.respond_to?(:name) || node.name != local
+
+        node.class.name.start_with?("Prism::LocalVariable") || node.class.name.end_with?("ParameterNode") ||
+          node.is_a?(Prism::BlockLocalVariableNode)
+      end
 
       # `[kind, arguments, via_send]` for a call that mixes modules in — `include` / `prepend` / `extend`, or
       # `send(:include, M)` and its `public_send` / `__send__` twins with a literal first argument — else nil.
@@ -7112,8 +8611,9 @@ module Rigor
       end
 
       HOOK_DEFS = %i[included extended prepended inherited].freeze
+      INSTANCE_MIXIN_NAMES = %i[include prepend].freeze
       MIXIN_EVAL_CALLS = %i[class_eval module_eval class_exec module_exec instance_eval instance_exec].freeze
-      private_constant :HOOK_DEFS, :MIXIN_EVAL_CALLS
+      private_constant :HOOK_DEFS, :MIXIN_EVAL_CALLS, :INSTANCE_MIXIN_NAMES
 
       # The parameter names of a `def included(base)`-style hook (a hook is written `def self.included`, or
       # `def included` inside `class << self`), else nil.
@@ -7148,9 +8648,14 @@ module Rigor
         receiver = node.receiver
         return if receiver.nil? || receiver.is_a?(Prism::SelfNode)
         return if Source::ConstantPath.qualified_name_or_nil(receiver)
-        return unless hook_receiver?(receiver, accumulator) || block_mixes_in?(node.block)
 
-        accumulator.taint(current_class, :include)
+        hook = hook_receiver?(receiver, accumulator)
+        return unless hook || block_mixes_in?(node.block)
+
+        # Issue #2991 — the set is unknown only where the block may mix into the class itself: a hook's `base`, or a
+        # receiverless `include` / `prepend` in the block of a receiver other than a `singleton_class`.
+        unnamed = hook || (!singleton_class_eval_receiver?(receiver) && block_mixes_into_self?(node.block))
+        accumulator.taint(current_class, :include, unnamed: unnamed)
         accumulator.taint(current_class, :extend)
       end
 
@@ -7162,6 +8667,22 @@ module Rigor
         found
       end
 
+      # A receiverless or `self.` `include` / `prepend` (or its `send` spelling) anywhere in `node`.
+      def block_mixes_into_self?(node)
+        if node.is_a?(Prism::CallNode) && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+          view = mixin_call_view(node)
+          return true if view && INSTANCE_MIXIN_NAMES.include?(view.first)
+        end
+
+        found = false
+        node.rigor_each_child { |child| found ||= block_mixes_into_self?(child) }
+        found
+      end
+
+      def singleton_class_eval_receiver?(receiver)
+        receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class
+      end
+
       def singleton_class_receiver?(receiver)
         receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class && receiver.arguments.nil? &&
           (receiver.receiver.nil? || receiver.receiver.is_a?(Prism::SelfNode))
@@ -7193,19 +8714,8 @@ module Rigor
         list.unshift(*(prepend ? targets : targets.reject { |target| list.include?(target) }))
       end
 
-      # Whether a mixin call contributes to the tables at all: a receiverless `include` / `prepend` needs an
-      # enclosing declaration to file the edge under, and the RECEIVER form (`Base.prepend(Loud)`, issue #1123;
-      # `Integer.include(Ext)` and `Integer.send(:include, Ext)`, issue #1722) files it under the class the
-      # receiver names. A receiver-form edge is unpositioned wherever it is written ({MixinAccumulator#note}), so
-      # a reader that depends on ORDER declines on it, while the set-shaped readers (undefined-method
-      # suppression, arity, visibility) see the module as they see an in-body `include`. A receiverless `send`
-      # stays a taint: the walk does not resolve its `self`.
-      def mixin_call_recorded?(node, kind, via_send, current_class)
-        return false unless MIXIN_CALL_NAMES.include?(kind)
-        return !via_send && !current_class.nil? if node.receiver.nil?
-
-        true
-      end
+      # Whether a mixin call's kind reaches the instance-side tables: `include` and `prepend`.
+      def mixin_call_recorded?(kind) = MIXIN_CALL_NAMES.include?(kind)
 
       # Issue #1697 — a receiverless `include M` written as a statement of the file's own top level is
       # `main.include`, which is `Object.include`: it mixes M into `Object`. It is recorded under its own
@@ -7214,14 +8724,22 @@ module Rigor
       # walk that types a call reaches it: what Ruby reaches first for a name such an include supplies
       # depends on more than the chain shows (a block that rebinds `self`, an `extend` or a singleton `def`
       # on `main`), so only the diagnostic silences read it (`Inference::ObjectMixins`), and typing is
-      # issue #1715's. Only a direct program statement counts.
-      # The same call inside a top-level block, a method body or a conditional stays unrecorded, as before:
-      # its `self` may not be `main` (a `describe do include M end` or `class_exec` block rebinds it, while
-      # `[1].each do include M end` does not, and the walk cannot tell them apart), and it may not run. `main`
-      # has no `prepend`, and a top-level `extend M` reaches `main`'s singleton alone, so neither is recorded.
+      # issue #1715's. `main` has no `prepend`, and a top-level `extend M` reaches `main`'s singleton alone, so
+      # neither is recorded.
+      #
+      # Issue #3007 — the call counts wherever {MixinAccumulator::MainSelfCalls} takes its `self` to be `main`: a
+      # program statement, or a call under top-level control flow (`if`, `begin`, `case`, …) or in a top-level
+      # `def` body. Such a call may not run, so its edge is in the set with no position ({MixinAccumulator#note}),
+      # as ADR-119 WD7 records an `include` in a method body. The same call inside a top-level block stays
+      # unrecorded: its `self` may not be `main` (a `describe do include M end` or `class_exec` block rebinds it,
+      # while `[1].each do include M end` does not, and the walk cannot tell them apart).
+      #
+      # Issue #2995 — `self.include M`, a receiverless or `self.` `send(:include, M)` and its `__send__` twin are the
+      # same `main.include`. `public_send(:include, M)` is not: `main`'s `include` is private, so it raises.
       def toplevel_include_owner(node, qualified_prefix, current_class, accumulator)
         return nil unless current_class.nil? && qualified_prefix.empty?
-        return nil unless node.receiver.nil? && node.name == :include
+        return nil unless lexical_self_receiver?(node.receiver) && node.name != :public_send
+        return nil unless mixin_call_view(node)&.first == :include
 
         accumulator.program_statement?(node) ? ObjectMixins::TOPLEVEL_INCLUDE_KEY : nil
       end
@@ -7283,8 +8801,8 @@ module Rigor
                                           singleton_cref)
         when Prism::SingletonClassNode
           # Issue #915 — `class << self` opens the enclosing declaration's OWN singleton, so an `include`
-          # written in it is the same singleton ancestor an `extend` in the class body would add. Only the
-          # `self` form is followed: `class << obj` names something this walk cannot resolve to a class.
+          # written in it is the same singleton ancestor an `extend` in the class body would add. Issue #3010 —
+          # `class << Const` is followed too; `class << obj` names something this walk cannot resolve to a class.
           # Nested declarations inside the body take the `ClassNode` branch above and reset the flag with
           # their own owner, so the marker cannot leak past the singleton body it belongs to.
           return walk_extends_singleton_class(node, qualified_prefix, current_class, accumulator,
@@ -7337,7 +8855,8 @@ module Rigor
 
       # The `class <<` arm of {#walk_class_extends}: the expression evaluates in the enclosing
       # context while the body is the singleton's — `class << self` keeps the enclosing owner
-      # (its `include` is the singleton ancestor #915 folds), other operands walk ownerless.
+      # (its `include` is the singleton ancestor #915 folds), `class << Const` takes the class the
+      # constant names (#3010), other operands walk ownerless.
       # `self` inside is the singleton — `self::` receivers decline — and the lexical cref
       # below is unnameable in every case.
       def walk_extends_singleton_class(node, qualified_prefix, current_class, accumulator,
@@ -7346,17 +8865,114 @@ module Rigor
                            in_singleton: in_singleton, singleton_self: singleton_self,
                            singleton_cref: singleton_cref)
         return unless node.body
+        return walk_extends_constant_singleton(node, qualified_prefix, accumulator) if constant_singleton_class?(node)
 
         # `class << self` keeps the owner only at the FIRST level — nested inside a
         # singleton body, `self` IS the singleton and `class << self` opens the
         # singleton's own singleton (`#<Class:#<Class:C>>`), which nothing names.
         opens_self = node.expression.is_a?(Prism::SelfNode) && !in_singleton
         accumulator.direct_body(node.body) if opens_self && accumulator.direct?(node)
+        accumulator.class_body(node.body) if opens_self
         walk_class_extends(node.body, qualified_prefix, opens_self ? current_class : nil,
                            accumulator, in_singleton: opens_self,
                                         singleton_self: true, singleton_cref: true)
       end
 
+      # Issue #3010 — `class << Const` opens the class object's own singleton class, so an `include` / `prepend` in its
+      # body is a singleton mixin on `Const`, as one in `class << self` inside `Const`'s body is. The body walks with
+      # the class `Const` resolves to from the lexical scope ({#constant_singleton_owners}, the class its `def`s record
+      # under) as owner. Its edges are positioned only where the order is a fact: the `class <<` is a direct statement
+      # of a file that declares that class, and no more-nested name the constant could denote is left. Anywhere else (a
+      # method body, a conditional, another file) they are unpositioned, and a prepend also records, unpositioned, on
+      # every other name the constant can denote ({#record_constant_singleton_candidates}), as #2998's
+      # `Const.singleton_class.prepend P` does.
+      def walk_extends_constant_singleton(node, qualified_prefix, accumulator)
+        owner, others = constant_singleton_owners(node, qualified_prefix)
+        if others.empty? && accumulator.direct?(node) && eval_file_declared_names(node).include?(owner)
+          accumulator.direct_body(node.body)
+        end
+        walk_class_extends(node.body, qualified_prefix, owner, accumulator,
+                           in_singleton: true, singleton_self: true, singleton_cref: true)
+        record_constant_singleton_candidates(node.body, others, accumulator)
+      end
+
+      # Each candidate class past the owner takes the body's prepends unpositioned; an argument that names no module
+      # (`prepend(*MODS)`) leaves its singleton set unknown, as {#taint_unrecorded_mixin} reads it on the owner.
+      def record_constant_singleton_candidates(body, candidates, accumulator)
+        return if candidates.empty?
+
+        each_singleton_body_prepend(body) do |call|
+          candidates.each do |candidate|
+            next unless record_extend_targets(call, candidate, accumulator).empty?
+
+            accumulator.taint(candidate, :extend, unnamed: true)
+          end
+        end
+      end
+
+      # A `class << Const` whose operand is a constant read (`class << Foo = expr` opens an object's singleton).
+      def constant_singleton_class?(node)
+        node.expression.is_a?(Prism::ConstantReadNode) || node.expression.is_a?(Prism::ConstantPathNode)
+      end
+
+      # `[owner, others]` for a `class << Const`: the class the constant resolves to from the lexical scope
+      # ({#singleton_class_prefix}, where the body's `def`s record), and the other names it can denote from there
+      # ({#constant_receiver_candidates}). `others` is empty when the constant can denote one name only, when it names
+      # the enclosing class itself (`class << Foo` inside `class Foo`, which {#singleton_class_prefix} reads as
+      # `class << self`), or when the owner is the innermost candidate and the file declares it ahead of the `class <<`
+      # ({#declared_before?}): Ruby resolves the constant when the statement runs, so a nested class the file declares
+      # later does not exist yet there.
+      def constant_singleton_owners(node, qualified_prefix)
+        owner = singleton_class_prefix(node, nil, qualified_prefix).join("::")
+        candidates = constant_receiver_candidates(node.expression, qualified_prefix)
+        # One candidate needs no re-parse: whichever statement declares it, the constant can name nothing else.
+        return [owner, EMPTY_PREFIX] if candidates.size == 1 || qualified_prefix.join("::") == owner
+        return [owner, EMPTY_PREFIX] if candidates.first == owner && declared_before?(node, owner)
+
+        [owner, candidates - [owner]]
+      end
+
+      # Issue #3010 — whether `node`'s file declares `name` (a `class` / `module` declaration or a bare constant
+      # write) at a statement that starts ahead of `node`. Asked only where a `class << Const` has a nested candidate
+      # the file declares, so it re-parses the file rather than keep a table every file would pay for.
+      def declared_before?(node, name)
+        source = node.location.send(:source).source
+        declaration_before?(Prism.parse(source).value, EMPTY_PREFIX, name, node.location.start_offset)
+      end
+
+      def declaration_before?(node, prefix, name, limit)
+        return false unless node.is_a?(Prism::Node) && node.location.start_offset < limit
+
+        case node
+        when Prism::ClassNode, Prism::ModuleNode
+          child = Source::ConstantPath.declaration_prefix(prefix, node.constant_path)
+          return false if child.nil?
+          return true if child.join("::") == name
+
+          return declaration_before?(node.body, child, name, limit)
+        when Prism::ConstantWriteNode
+          return true if (prefix + [node.name.to_s]).join("::") == name
+        when Prism::DefNode, Prism::SingletonClassNode
+          # A `def` body declares no constant, and a `class <<` body's are the singleton class's.
+          return false
+        end
+        node.rigor_each_child { |child| return true if declaration_before?(child, prefix, name, limit) }
+        false
+      end
+
+      # The receiverless or `self.` `prepend` calls (direct or `send` spelling) of a `class <<` body, outside any
+      # nested `def` or declaration body.
+      def each_singleton_body_prepend(node, &)
+        return unless node.is_a?(Prism::Node)
+        return if CODE_BODY_NODES.any? { |klass| node.is_a?(klass) }
+
+        if node.is_a?(Prism::CallNode) && lexical_self_receiver?(node.receiver) &&
+           mixin_call_view(node)&.first == :prepend
+          yield node
+        end
+        node.rigor_each_child { |child| each_singleton_body_prepend(child, &) }
+      end
+
       # The declaration arm of {#walk_class_extends}: under an unnameable cref a bare/`self::`
       # header opens `#<singleton>::Name` — ownerless; nameable headers re-anchor at a
       # real cref.
@@ -7370,6 +8986,7 @@ module Rigor
         child_cref = unnameable_decl?(node, self_decl, singleton_cref)
         accumulator.direct_body(node.body) if accumulator.direct?(node)
         accumulator.body_statements(node.body)
+        accumulator.class_body(node.body)
         walk_class_extends(node.body, child_cref ? [] : child_prefix,
                            child_cref ? nil : child_prefix.join("::"), accumulator,
                            singleton_cref: child_cref)
@@ -7646,16 +9263,24 @@ module Rigor
         return if singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator,
                                                    in_singleton: in_singleton)
 
-        kind, _arguments, via_send = mixin_call_view(node)
-        return if kind.nil?
+        kind, arguments, via_send = mixin_call_view(node)
+        if kind.nil?
+          # Inside `class << self` a computed `include` / `prepend` reaches the singleton side; an `extend` reaches the
+          # singleton's own singleton, which nothing names.
+          kinds = in_singleton ? INSTANCE_MIXIN_NAMES : EXTEND_MIXIN_NAMES
+          return taint_computed_mixin_send(node, current_class, accumulator, kinds, :extend, in_singleton: in_singleton)
+        end
 
         effects = mixin_effects(node, kind, qualified_prefix, current_class, accumulator, in_singleton: in_singleton)
                   .select { |_owner, side| side == :extend || in_singleton }
         return if effects.empty?
-        return if !via_send && singleton_mixin_recorded?(node, kind, qualified_prefix, current_class, accumulator,
-                                                         in_singleton)
+        # A `send` spelling is recorded only on the lexical `self` (#2995); `Const.send(:extend, M)` stays a taint.
+        return if (!via_send || lexical_self_receiver?(node.receiver)) &&
+                  singleton_mixin_recorded?(node, kind, qualified_prefix, current_class, accumulator, in_singleton)
 
-        effects.each { |owner, side| accumulator.taint(owner, side) }
+        # Issue #2991 — as in {#record_mixin_call}: an unrecorded instance-side call (a hook's `base.include M` written
+        # in `class << self`) lists its names, or the unnamed marker.
+        taint_unrecorded_mixin(node, kind, arguments, effects, accumulator)
       end
 
       # Issue #1752 — a call that rewrites a singleton class reached through `singleton_class` (`singleton_class.
@@ -7679,23 +9304,53 @@ module Rigor
         # Inside `class << self` a bare `singleton_class` is the singleton's own singleton, one level up from the
         # owner's extend side, so that call stays a taint.
         up_level = in_singleton && lexical_self_receiver?(receiver.receiver)
-        return true if !up_level && singleton_class_include_recorded?(node, owner, accumulator)
+        if !up_level && singleton_class_include_recorded?(node, owner, accumulator)
+          record_prepend_candidates(node, receiver.receiver, qualified_prefix, owner, accumulator)
+          return true
+        end
 
-        accumulator.taint(owner, :extend)
+        # Issue #2994 — an `include` / `prepend` whose argument names no module (`singleton_class.include(*MODS)`)
+        # leaves the owner's singleton set unknown, as {#taint_unrecorded_mixin} reads an `extend(*EMODS)`.
+        accumulator.taint(owner, :extend, unnamed: unnamed_singleton_include?(node))
         true
       end
 
+      def unnamed_singleton_include?(node)
+        INSTANCE_MIXIN_NAMES.include?(node.name) &&
+          (node.arguments&.arguments || []).any? { |arg| opaque_mixin_argument?(arg) }
+      end
+
       # Issue #2094 — `Float.singleton_class.include(Ext)` (or `prepend`, which the extend table cannot order, so the
       # edge is unpositioned as every receiver-form edge is) puts `Ext` on the singleton side as `Float.extend(Ext)`
       # does, the fold #915 gives `class << self; include M`. A `send` spelling or an argument that is not a constant
       # stays a taint.
+      #
+      # Issue #2998 — a prepend, spelt directly or as `send(:prepend, P)`, is recorded, and the methods walk files it as
+      # a singleton prepend ({#record_own_singleton_prepend}). One on the enclosing class's own `singleton_class` (a
+      # bare or `self.` receiver) runs where it is written, as `prepend P` in `class << self` does, so a direct
+      # statement of the body is positioned; a constant receiver's stays unpositioned.
       def singleton_class_include_recorded?(node, owner, accumulator)
-        return false unless %i[include prepend].include?(node.name)
-
-        arguments = node.arguments&.arguments || []
+        kind, sent, = mixin_call_view(node)
+        prepend = kind == :prepend
+        arguments = prepend ? sent : node.arguments&.arguments || []
+        return false unless prepend || node.name == :include
         return false if arguments.empty? || arguments.any? { |arg| Source::ConstantPath.qualified_name(arg).nil? }
 
-        !record_extend_targets(node, owner, accumulator).empty?
+        positioned = prepend && lexical_self_receiver?(node.receiver.receiver)
+        !record_extend_targets(node, owner, accumulator, positioned: positioned).empty?
+      end
+
+      # Issue #2998 — a constant receiver's `Const.singleton_class.prepend P` also records the edge, unpositioned, under
+      # every other name the constant can denote from the call site, the names the methods walk files its
+      # singleton-prepend entry under ({#singleton_prepend_owners}): which class Ruby reaches is not a fact here, so
+      # each candidate's typing read declines where the prepend could answer.
+      def record_prepend_candidates(node, object, qualified_prefix, owner, accumulator)
+        return unless mixin_call_view(node)&.first == :prepend
+        return unless object.is_a?(Prism::ConstantReadNode) || object.is_a?(Prism::ConstantPathNode)
+
+        (constant_receiver_candidates(object, qualified_prefix) - [owner]).each do |candidate|
+          record_extend_targets(node, candidate, accumulator)
+        end
       end
 
       # A bare or `self.` receiver: the lexical `self`.
@@ -7759,10 +9414,12 @@ module Rigor
         accumulator.note(node, current_class, :extend, [current_class], complete: true)
       end
 
-      # Records the singleton-side edges of a receiverless `extend` (or, inside `class << self`, `include` /
-      # `prepend`). False when it recorded nothing.
+      # Records the singleton-side edges of a receiverless or `self.` `extend` (or, inside `class << self`,
+      # `include` / `prepend`), and of their `send` spellings (#2995). False when it recorded nothing.
       def singleton_mixin_recorded?(node, kind, qualified_prefix, current_class, accumulator, in_singleton)
-        return receiver_extend_recorded?(node, kind, qualified_prefix, accumulator) if node.receiver
+        unless lexical_self_receiver?(node.receiver)
+          return receiver_extend_recorded?(node, kind, qualified_prefix, accumulator)
+        end
         return false unless current_class
         return false unless in_singleton ? MIXIN_CALL_NAMES.include?(kind) : kind == :extend
 
@@ -7788,9 +9445,12 @@ module Rigor
       # (`extend A; extend B` → singleton ancestors `[B, A]`) while the arguments of a single
       # `extend A, B` keep call order (`[A, B]`). Prepending each call's argument list preserves both,
       # and consumers iterating the list forward read the same order the singleton ancestry searches.
-      def record_extend_targets(node, current_class, accumulator)
+      #
+      # The arguments are {#mixin_call_view}'s, so a `send(:extend, M)` (#2995) reads `M` and not its name literal.
+      # `positioned` says a receiver-form call still runs where it is written ({#singleton_class_include_recorded?}).
+      def record_extend_targets(node, current_class, accumulator, positioned: false)
         targets = []
-        arguments = node.arguments&.arguments || []
+        arguments = mixin_call_view(node)[1]
         arguments.each do |arg|
           target = arg.is_a?(Prism::SelfNode) ? current_class : Source::ConstantPath.qualified_name(arg)
           targets << target if target
@@ -7804,7 +9464,8 @@ module Rigor
         # unpositioned and the chain settles to the readers' own answer.
         accumulator.taint(current_class, :extend) if targets.any? { |target| list.include?(target) }
         list.unshift(*targets)
-        accumulator.note(node, current_class, :extend, targets, complete: targets.size == arguments.size)
+        accumulator.note(node, current_class, :extend, targets, complete: targets.size == arguments.size,
+                                                                positioned: positioned)
         targets
       end
 
@@ -7990,6 +9651,10 @@ module Rigor
       # written directly in the body settles the default again. A named target does not read the running default,
       # so a toggle does not contest it. A certain write clears the slot's contest.
       class VisibilityTable < Hash
+        include HookBlockSpans
+
+        attr_accessor :hook_block_spans
+
         # The bare toggles the walk has met so far; a body's statement loop compares it around each child.
         attr_accessor :toggles
         # Whether the running default of the body being walked rests on an uncertain toggle.
@@ -8112,6 +9777,22 @@ module Rigor
         VISIBILITY_TOGGLES.include?(name) ? [name, arguments] : nil
       end
 
+      # Issue #1592 — a concern's `class_methods do … end` block is a `module_eval` of `Owner::ClassMethods`, whose
+      # visibility starts public: its `def`s' visibilities are recorded on that module too, as its `def`s are.
+      # Issue #2997 — in every body of the module, as {#record_concern_class_methods} reads its `def`s.
+      def walk_class_methods_visibilities(node, child_prefix, accumulator)
+        return unless node.is_a?(Prism::ModuleNode) && node.body.is_a?(Prism::StatementsNode)
+
+        node.body.body.each do |statement|
+          next unless statement.is_a?(Prism::CallNode) && block_statement?(statement) &&
+                      statement.name == :class_methods && statement.block.body
+
+          accumulator.body do
+            walk_method_visibilities(statement.block.body, [*child_prefix, "ClassMethods"], false, :public, accumulator)
+          end
+        end
+      end
+
       # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity, Metrics/AbcSize
       def walk_method_visibilities(node, qualified_prefix, in_singleton_class, current_visibility, accumulator, # rubocop:disable Metrics/ParameterLists
                                    def_owner_prefix = nil, singleton_cref: false,
@@ -8130,11 +9811,13 @@ module Rigor
             # ownerless; nameable headers re-anchor at a real cref.
             child_cref = unnameable_decl?(node, self_decl, singleton_cref)
             body_prefix = child_cref ? [] : child_prefix
+            accumulator.mark_hook_blocks(concern_hook_blocks(node, child_prefix), child_prefix) unless child_cref
             if node.body
               accumulator.body do
                 walk_method_visibilities(node.body, body_prefix, false, :public,
                                          accumulator, nil, singleton_cref: child_cref)
               end
+              walk_class_methods_visibilities(node, child_prefix, accumulator) unless child_cref
             end
             return current_visibility
           end
@@ -8163,6 +9846,8 @@ module Rigor
             return current_visibility
           end
         when Prism::DefNode
+          return current_visibility if accumulator.hook_block_self_def?(node, owner_prefix)
+
           contest_foreign_singleton_visibility(node, qualified_prefix, owner_prefix, in_singleton_class, accumulator)
           record_def_visibility(node, owner_prefix, visibility_side(in_singleton_class, defs_singleton),
                                 current_visibility, accumulator)
@@ -8273,6 +9958,7 @@ module Rigor
                                  singleton_cref: singleton_cref,
                                  defs_singleton: defs_singleton)
         return unless node.body
+        return if hook_block_singleton?(node, in_singleton_class, def_owner_prefix || qualified_prefix, accumulator)
 
         accumulator.body do
           walk_method_visibilities(node.body, qualified_prefix, true, :public, accumulator,
@@ -8775,6 +10461,7 @@ module Rigor
           constant_receiver_candidates(receiver, qualified_prefix).each do |name|
             record_surface_mark(tables, name, Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK)
           end
+          record_constant_singleton_definer(node, receiver, qualified_prefix, tables)
         elsif singleton_class_of_receiver?(receiver) && singleton_class_named_call?(node)
           record_singleton_class_names(node, receiver.receiver, qualified_prefix, tables)
         end
@@ -8809,8 +10496,64 @@ module Rigor
         return if def_receiver_targets_lexical_self?(receiver, owner_prefix)
 
         constant_receiver_candidates(receiver, qualified_prefix).each do |name|
-          record_envelope(tables.envelopes, name, [:singleton, node.name], Source::ParameterEnvelope::OPAQUE)
-          contest_envelope(tables, name, [:singleton, node.name]) unless tables.certain
+          record_object_singleton(tables, name, node.name)
+        end
+      end
+
+      # Issue #3016 — `Const.define_singleton_method(:x) { … }` with a literal name defines `x` on `Const`'s object, and
+      # is filed as {#record_foreign_singleton_def} files `def Const.x`: an opaque singleton envelope on every name the
+      # constant can denote. A computed name may define any name, so it marks each candidate with the singleton side's
+      # open-names mark instead, as a computed `define_method` on a constant marks the instance side.
+      def record_constant_singleton_definer(node, receiver, qualified_prefix, tables)
+        names = define_singleton_method_names(node)
+        return if names.nil?
+
+        candidates = constant_receiver_candidates(receiver, qualified_prefix)
+        if names == :all
+          candidates.each do |owner|
+            record_surface_mark(tables, owner, Scope::DiscoveryIndex::ENVELOPE_OPEN_SINGLETON_NAMES_MARK)
+          end
+          return
+        end
+
+        candidates.product(names) do |owner, name|
+          record_envelope(tables.envelopes, owner, [:singleton, name], Source::ParameterEnvelope::OPAQUE)
+          record_envelope(tables.envelopes, owner, [Scope::DiscoveryIndex::ENVELOPE_OBJECT_SINGLETON_KIND, name],
+                          Source::ParameterEnvelope::OPAQUE)
+        end
+      end
+
+      # A `def Const.x` written outside `Const`'s body, or one in a `Const.singleton_class.class_eval` block: the opaque
+      # `[:singleton, x]` envelope, contested unless certain, and the
+      # {Scope::DiscoveryIndex::ENVELOPE_OBJECT_SINGLETON_KIND} entry the class-object path reads (#3018).
+      def record_object_singleton(tables, owner, method_name)
+        record_envelope(tables.envelopes, owner, [:singleton, method_name], Source::ParameterEnvelope::OPAQUE)
+        contest_envelope(tables, owner, [:singleton, method_name]) unless tables.certain
+        record_envelope(tables.envelopes, owner, [Scope::DiscoveryIndex::ENVELOPE_OBJECT_SINGLETON_KIND, method_name],
+                        Source::ParameterEnvelope::OPAQUE)
+      end
+
+      # Issue #3018 — `Const.singleton_class.class_eval { def x … }` (or `module_eval` / `class_exec` / `module_exec`)
+      # defines `x` on `Const`'s object, as `def Const.x` does, and is filed as {#record_foreign_singleton_def} files
+      # that def ({#record_object_singleton}) on every name the constant can denote. The eval-body walk files these
+      # defs under no owner, since the receiver is a call. Every receiverless `def` in the block counts, one under a
+      # conditional included, as {#each_refinement_def} yields them: not one under a `class` / `module` / `class <<`
+      # body, which opens another definee, nor one inside another `def`, which installs only when that runs.
+      # `instance_eval` on the singleton class is not filed: its defs land on the singleton class's own singleton (Ruby
+      # 4.0.5 raises NoMethodError on `Const.x` there).
+      def record_constant_singleton_eval_defs(node, qualified_prefix, tables)
+        return unless CLASS_EVAL_BLOCK_CALLS.include?(node.name)
+
+        receiver = node.receiver
+        return unless singleton_class_of_receiver?(receiver)
+
+        body = node.block.body
+        return if body.nil?
+
+        # A bare, `self` or local receiver of `singleton_class` renders no constant, so it yields no candidate.
+        candidates = constant_receiver_candidates(receiver.receiver, qualified_prefix)
+        each_refinement_def(body) do |def_node|
+          candidates.each { |owner| record_object_singleton(tables, owner, def_node.name) }
         end
       end
 
@@ -8859,22 +10602,33 @@ module Rigor
         SURFACE_MIXIN_CALLS.include?(node.name) || SURFACE_MIXIN_HELPER.match?(node.name.to_s)
       end
 
+      # Issue #2995 — a `send` / `public_send` / `__send__` of `:include`, `:prepend` or `:extend` is that mixin call,
+      # which the mixin walk records as the bare call, so it is judged by its own arguments as the bare call is.
       def dynamic_surface_call?(node)
-        return true if SURFACE_EVAL_CALLS.include?(node.name) || SURFACE_SEND_CALLS.include?(node.name)
+        return true if SURFACE_EVAL_CALLS.include?(node.name)
+
+        if SURFACE_SEND_CALLS.include?(node.name)
+          kind, arguments, = mixin_call_view(node)
+          return kind.nil? || dynamic_mixin_arguments?(arguments)
+        end
 
         arguments = node.arguments&.arguments || []
         if SURFACE_NAMING_CALLS.include?(node.name)
           arguments.empty? || literal_method_name(arguments.first).nil?
         elsif surface_mixin_call?(node)
-          arguments.any? do |argument|
-            !(argument.is_a?(Prism::ConstantReadNode) || argument.is_a?(Prism::ConstantPathNode) ||
-              argument.is_a?(Prism::SelfNode))
-          end
+          dynamic_mixin_arguments?(arguments)
         else
           false
         end
       end
 
+      def dynamic_mixin_arguments?(arguments)
+        arguments.any? do |argument|
+          !(argument.is_a?(Prism::ConstantReadNode) || argument.is_a?(Prism::ConstantPathNode) ||
+            argument.is_a?(Prism::SelfNode))
+        end
+      end
+
       # Every qualified name a constant receiver written inside `qualified_prefix` can denote, innermost
       # first: the walk runs before any scope exists, so it cannot resolve the constant, and over-marking a
       # same-named class elsewhere only withholds a check.
@@ -9155,15 +10909,76 @@ module Rigor
       end
 
       def record_define_method(call_node, qualified_prefix, in_singleton_class, accumulator)
-        return if qualified_prefix.empty?
         return if call_node.arguments.nil? || call_node.arguments.arguments.empty?
 
-        first_arg = call_node.arguments.arguments.first
-        method_name = literal_method_name(first_arg)
-        return if method_name.nil?
+        method_name = literal_method_name(call_node.arguments.arguments.first)
+        receiver = call_node.receiver
+        if method_name && (receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode))
+          return record_constant_define_method(call_node, receiver, method_name, qualified_prefix, accumulator)
+        end
+        return if qualified_prefix.empty?
+        if method_name.nil?
+          return record_open_define_method(call_node, qualified_prefix, in_singleton_class,
+                                           accumulator)
+        end
 
-        class_name = qualified_prefix.join("::")
-        record_method(accumulator, class_name, method_name, in_singleton_class ? :singleton : :instance)
+        # A receiver other than a constant may still be `self` (`[self, k].each { |c| c.define_method(:x) {} }`), so
+        # the name stays on the class the walk places the call in.
+        record_method(accumulator, qualified_prefix.join("::"), method_name,
+                      in_singleton_class ? :singleton : :instance)
+      end
+
+      # Issue #2975 — `Other.define_method(:x)` defines `Other#x`, whichever class body or side it is written in: the
+      # constant resolves as a `class << Other` operand does ({#singleton_class_owner}), and the enclosing class
+      # records nothing.
+      def record_constant_define_method(call_node, receiver, method_name, qualified_prefix, accumulator)
+        owner = singleton_class_owner(call_node, receiver, qualified_prefix, nil)
+        record_method(accumulator, owner, method_name, :instance) if owner
+      end
+
+      # Issue #2975 — the literal twins of {#record_self_definer_call}'s computed definers on `self`:
+      # `send(:define_method, :x)` records `x` where a direct `define_method(:x)` there would, and
+      # `define_singleton_method(:x)` records the class object's `x`. In a `class << self` body the latter defines on
+      # the singleton's own singleton, which nothing names, so it records nothing.
+      def record_literal_self_definer(node, class_name, in_singleton_class, accumulator)
+        arguments = node.arguments&.arguments
+        return if arguments.nil? || arguments.empty?
+
+        if node.name == :define_singleton_method
+          name = literal_method_name(arguments.first)
+          record_method(accumulator, class_name, name, :singleton) if name && !in_singleton_class
+        elsif literal_method_name(arguments.first) == :define_method && arguments.length > 1
+          name = literal_method_name(arguments[1])
+          record_method(accumulator, class_name, name, in_singleton_class ? :singleton : :instance) if name
+        end
+      end
+
+      # Issue #2793 — a `define_method` on `self` whose name is not a literal defines a method this walk cannot name,
+      # on the side and owner a literal one would record under (the walk's placement: a `Class.new { }` or
+      # `Struct.new { }` body is its own class's, an eval body its receiver's, a `class << self` body the singleton
+      # side), so that side reads as open to `call.undefined-method`.
+      #
+      # Issue #2901 — on a constant receiver (`Other.define_method(m)`) it defines instance methods of that constant's
+      # class, whichever side the call sits on: each class the constant can denote from here opens its instance side
+      # ({#constant_receiver_candidates}), and the enclosing class does not. Any other receiver opens nothing.
+      def record_open_define_method(call_node, qualified_prefix, in_singleton_class, accumulator)
+        receiver = call_node.receiver
+        if receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+          constant_receiver_candidates(receiver, qualified_prefix).each do |name|
+            record_surface_mark(accumulator, name, Scope::DiscoveryIndex::ENVELOPE_OPEN_INSTANCE_NAMES_MARK)
+          end
+        elsif receiver.nil? || receiver.is_a?(Prism::SelfNode)
+          record_surface_mark(accumulator, qualified_prefix.join("::"), open_names_mark(in_singleton_class))
+        end
+      end
+
+      # The side's open-names mark a computed definer on `self` records: the singleton side in a `class << self` body.
+      def open_names_mark(in_singleton_class)
+        if in_singleton_class
+          Scope::DiscoveryIndex::ENVELOPE_OPEN_SINGLETON_NAMES_MARK
+        else
+          Scope::DiscoveryIndex::ENVELOPE_OPEN_INSTANCE_NAMES_MARK
+        end
       end
 
       # The `attr_*` accessor macros that introduce methods Rigor must treat as source-declared. Without this, a class
@@ -9187,6 +11002,19 @@ module Rigor
           record_method(accumulator, class_name, base, kind) if reader
           record_method(accumulator, class_name, :"#{base}=", kind) if writer
         end
+        return unless attr_macro_computed?(call_node)
+
+        # Issue #2901 — `attr_accessor(*NAMES)` defines members this walk cannot name, so its side opens.
+        record_surface_mark(accumulator, class_name, open_names_mark(in_singleton_class))
+      end
+
+      # Whether an `attr_*` call ({#attr_macro}) passes a name argument that is not a Symbol or String literal.
+      def attr_macro_computed?(call_node)
+        arguments = call_node.arguments&.arguments
+        return false if arguments.nil?
+
+        arguments = arguments.drop(1) if SURFACE_SEND_CALLS.include?(call_node.name)
+        arguments.any? { |arg| literal_method_name(arg).nil? }
       end
 
       # Yields each name an `attr_*` call declares ({#attr_macro}): a Symbol or String literal argument. A
@@ -9231,13 +11059,14 @@ module Rigor
       # because they are not monkey-patches), and no plugin surface reaches it — the ADR-16 synthetic-method
       # tier feeds the DISPATCHER, which `Analysis::CheckRules` does not consult. A name table is the smallest
       # thing that works; a plugin-supplied one can replace it whenever that surface exists.
-      MODULE_ATTR_MACROS = {
-        mattr_reader: [true, false, false], mattr_writer: [false, true, false],
-        mattr_accessor: [true, true, false], cattr_reader: [true, false, false],
-        cattr_writer: [false, true, false], cattr_accessor: [true, true, false],
-        class_attribute: [true, true, true]
-      }.freeze
-      Ractor.make_shareable(MODULE_ATTR_MACROS)
+      MODULE_ATTR_MACROS = Ractor.make_shareable(
+        {
+          mattr_reader: [true, false, false], mattr_writer: [false, true, false],
+          mattr_accessor: [true, true, false], cattr_reader: [true, false, false],
+          cattr_writer: [false, true, false], cattr_accessor: [true, true, false],
+          class_attribute: [true, true, true]
+        }
+      )
 
       # Both kinds, unconditionally. `instance_accessor: false` (and its `instance_reader:` /
       # `instance_writer:` / `instance_predicate:` siblings) narrows the real surface, and honouring them here
@@ -9260,6 +11089,70 @@ module Rigor
         end
       end
 
+      # Issue #2793 — the `extend` that decides the side of an {Source::ForwardableDelegators::AMBIGUOUS} macro
+      # (`def_delegators`, `def_delegator`, `delegate`): `Forwardable` makes them instance methods,
+      # `SingleForwardable` singleton methods.
+      FORWARDABLE_MODULES = { Forwardable: :instance, SingleForwardable: :singleton }.freeze
+
+      # Issue #2793 — a Forwardable delegator macro defines its literal names as methods, which join the existence
+      # table so `call.undefined-method` stops firing on them (their return types stay unknown: the envelope is
+      # opaque and no `def` node backs them). The side is the macro's own, or, for an ambiguous macro, the side
+      # of the `extend` this walk met earlier in the body: singleton under a lone `extend SingleForwardable`,
+      # instance otherwise (a class extended in another file or by a superclass is far likelier `Forwardable`).
+      # Inside `class << self` the macro defines on the singleton class. A name the syntax hides
+      # (`def_delegators :@x, *NAMES`) marks the class {Scope::DiscoveryIndex::ENVELOPE_OPEN_NAMES_MARK}.
+      def record_forwardable_methods(call_node, qualified_prefix, in_singleton_class, accumulator)
+        return if qualified_prefix.empty?
+
+        class_name = qualified_prefix.join("::")
+        note_forwardable_extend(call_node, class_name, accumulator) unless in_singleton_class
+        delegation = Source::ForwardableDelegators.of(call_node)
+        return if delegation.nil?
+
+        kind = forwardable_side(delegation, class_name, in_singleton_class, accumulator)
+        delegation.names.each { |name| record_method(accumulator, class_name, name, kind) }
+        return unless delegation.open?
+
+        record_surface_mark(accumulator, class_name, Scope::DiscoveryIndex::ENVELOPE_OPEN_NAMES_MARK)
+      end
+
+      def note_forwardable_extend(call_node, class_name, accumulator)
+        return unless call_node.name == :extend && call_node.receiver.nil?
+
+        (call_node.arguments&.arguments || []).each do |argument|
+          side = FORWARDABLE_MODULES[forwardable_module_name(argument)]
+          next if side.nil?
+
+          ((accumulator.forwardable_extends ||= {})[class_name] ||= Set.new) << side
+        end
+      end
+
+      def forwardable_module_name(node)
+        case node
+        when Prism::ConstantReadNode then node.name
+        when Prism::ConstantPathNode then node.parent.nil? ? node.name : nil
+        end
+      end
+
+      def forwardable_side(delegation, class_name, in_singleton_class, accumulator)
+        return :singleton if in_singleton_class
+        return delegation.side unless delegation.side == Source::ForwardableDelegators::AMBIGUOUS
+
+        extended = accumulator.forwardable_extends&.[](class_name)
+        extended == Set[:singleton] ? :singleton : :instance
+      end
+
+      # The instance names a Forwardable macro defines, for {#call_superseded_names}: a delegator written after a
+      # `def` of the name replaces it. Asked only outside `class << self`, and a macro whose side settles to the
+      # singleton (`extend SingleForwardable; def_delegators :@x, :size`) leaves an instance `def size` standing.
+      def forwardable_superseded_names(call_node, qualified_prefix, accumulator)
+        delegation = Source::ForwardableDelegators.of(call_node)
+        return [] if delegation.nil? || qualified_prefix.empty?
+
+        side = forwardable_side(delegation, qualified_prefix.join("::"), false, accumulator)
+        side == :instance ? delegation.names : []
+      end
+
       def record_both_kinds(accumulator, class_name, method_name)
         record_method(accumulator, class_name, method_name, :instance)
         record_method(accumulator, class_name, method_name, :singleton)
@@ -9290,8 +11183,12 @@ module Rigor
           physical = buffer ? buffer.resolve(path) : path
           source = File.read(physical)
           root = Prism.parse(source, filepath: path).value
-          collect_class_decls(root, [], accumulator)
-        rescue StandardError
+          file_classes = {}
+          collect_class_decls(root, [], file_classes)
+          accumulator.merge!(file_classes) # all or nothing: an overflow above contributes none of this file (#2455)
+        rescue StandardError, SystemStackError => e
+          raise if uncontainable_overflow?(e)
+
           # Skip files that fail to parse or read; the per-file analyzer surfaces the parse error separately.
           next
         end
@@ -9318,10 +11215,12 @@ module Rigor
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           root = Prism.parse(File.read(physical), filepath: path).value
-          accumulate_project_index(acc, path, root)
+          fold_file_index(acc, build_file_index(path, root)) # all or nothing per file (#2455)
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
-        rescue StandardError
+        rescue StandardError, SystemStackError => e
+          raise if uncontainable_overflow?(e)
+
           # Skip files that fail to parse or read; the per-file analyzer surfaces the parse error separately.
           next
         end
@@ -9358,7 +11257,9 @@ module Rigor
           file_summary(file_index).each { |key, table| per_file[key][path] = table unless table.nil? }
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
-        rescue StandardError
+        rescue StandardError, SystemStackError => e
+          raise if uncontainable_overflow?(e)
+
           next
         end
         { def_index: finalize_def_index(acc), code_fingerprints: code_fingerprints,
@@ -9642,21 +11543,35 @@ module Rigor
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           root = Prism.parse(File.read(physical), filepath: path).value
-          collect_class_decls(root, [], classes)
-          if uncertain.include?(path)
-            fold_file_index(acc, without_written_slots(build_file_index(path, root, uncertain: true), acc))
-          else
-            accumulate_project_index(acc, path, root)
-          end
+          # All or nothing per file, as the incremental loop below: both tables are built in isolation and folded only
+          # once the whole file walked, so a file that overflows the stack contributes none of either (#2455).
+          file_classes = {}
+          collect_class_decls(root, [], file_classes)
+          file_index = if uncertain.include?(path)
+                         without_written_slots(build_file_index(path, root, uncertain: true), acc)
+                       else
+                         build_file_index(path, root)
+                       end
+          fold_file_index(acc, file_index)
+          classes.merge!(file_classes)
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
-        rescue StandardError
+        rescue StandardError, SystemStackError => e
+          raise if uncontainable_overflow?(e)
+
           # Skip files that fail to parse or read; the per-file analyzer surfaces the parse error separately.
           next
         end
         finalize_project_index(classes, acc)
       end
 
+      # #2455 — a `SystemStackError` raised from C (`Prism.parse` of a source nested near its own cap) has no
+      # backtrace and leaves the process unable to survive a second one, so it is not contained: it keeps the
+      # run-level abort.
+      def uncontainable_overflow?(error)
+        error.is_a?(SystemStackError) && error.backtrace.nil?
+      end
+
       # The shared tail of the two whole-project discovery walks: settles the def-index and re-anchors the
       # `classes` table it accumulated beside it.
       def finalize_project_index(classes, acc)
@@ -9697,7 +11612,7 @@ module Rigor
       # @return `{ classes:, def_index:, bundles: }`.
       # @param uncertain — issue #2021: as {#discovered_project_index_for_paths}. Such a file is always re-walked and
       #   keeps no bundle, since a bundle does not record that its contributions were all possible.
-      def discovered_project_index_incremental(paths, seed_bundles:, buffer: nil, uncertain: EMPTY_PATH_SET) # rubocop:disable Metrics/AbcSize
+      def discovered_project_index_incremental(paths, seed_bundles:, buffer: nil, uncertain: EMPTY_PATH_SET) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         classes = {}
         acc = new_def_index_accumulator
         bundles = {}
@@ -9726,7 +11641,9 @@ module Rigor
           end
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
-        rescue StandardError
+        rescue StandardError, SystemStackError => e
+          raise if uncontainable_overflow?(e)
+
           # Skip files that fail to parse / read; the per-file analyzer surfaces the parse error separately.
           next
         end
@@ -10423,10 +12340,11 @@ module Rigor
 
       # #1154 — tags each `[:own_write, class, ivar]` entry with the file that records it, so a reader of the merged
       # census can tell a second file writing the same ivar of the same class (`UnseenIvarWriters`).
+      # Issue #2079 — and each `[:own_write_type, class, ivar, value]` entry, which {IvarContributions} reads.
       def attribute_own_writes(census, path)
-        return census unless census.any? { |entry| entry.first == :own_write }
+        return census unless census.any? { |entry| PATH_TAGGED_KINDS.include?(entry.first) }
 
-        census.to_set { |entry| entry.first == :own_write ? [*entry, path].freeze : entry }
+        census.to_set { |entry| PATH_TAGGED_KINDS.include?(entry.first) ? [*entry, path].freeze : entry }
       end
 
       # Folds one file's Data + Struct member-layout tables into the cross-file accumulator (kept out of
@@ -10562,7 +12480,8 @@ module Rigor
                                          singleton_cref)
         else
           census_constant_write(node, qualified_prefix, tables, self_owner, singleton_cref: singleton_cref)
-          tables.write_census.visit(node, top_level: qualified_prefix.empty?, owner: ivar_owner)
+          tables.write_census.visit(node, top_level: qualified_prefix.empty?, owner: ivar_owner,
+                                          receiver_owner: census_receiver_owner(node, qualified_prefix, self_owner))
         end
 
         rebound = rebound_block_self(node, qualified_prefix, nil, meta_owner, self_owner)
@@ -10604,6 +12523,16 @@ module Rigor
         qualified_prefix
       end
 
+      # Issue #2488 — the class an explicit-receiver writer call (`E.attr_writer :w`, `E.define_method(:m) { … }`)
+      # names, resolved as a `class_eval` receiver is in this census (keyed as written), or nil.
+      def census_receiver_owner(node, qualified_prefix, self_owner)
+        receiver = ReceiverWriterCall.receiver(node)
+        return nil if receiver.nil?
+
+        name = eval_receiver_self(receiver, qualified_prefix, nil, rebound_self_base(self_owner))
+        name if name.is_a?(String)
+      end
+
       # Under an unnameable cref a bare/`self::` header pushes `#<singleton>::Name` — still
       # unnameable — so the body keeps the OPAQUE self and the cref flag; nameable
       # headers re-anchor at a real cref.
@@ -10859,7 +12788,7 @@ module Rigor
       # A {DYNAMIC_TARGET_PREFIX} key is not a name and never publishes; it is expanded by
       # {#apply_dynamic_target_writes} into a retraction over the names it could have written.
       #
-      # @return `[{name => Type}, {name => Set[path]}]`.
+      # @return the value table and the table of source paths per name.
       def finalize_constant_writes(writes)
         values = {}
         sources = {}
@@ -11607,20 +13536,25 @@ module Rigor
 
       # Recognises `Data.define(*Symbol)` and `Data.define(*Symbol) do ... end` at constant-write rvalue position. The
       # receiver MUST be the bare `Data` constant (or `::Data`); other receivers (a local variable, a method call
-      # return) are rejected because their identity is not statically known.
+      # return) are rejected because their identity is not statically known. Issue #2968 — a splatted member list
+      # (`Data.define(*FIELDS)`) still creates the class; {#meta_members_open?} marks its members unknown.
       def data_define_call?(node)
         return false unless node.is_a?(Prism::CallNode)
         return false unless node.name == :define
         return false unless meta_constant_receiver?(node.receiver, :Data)
 
         args = node.arguments&.arguments || []
-        args.all?(Prism::SymbolNode)
+        args.all? { |arg| meta_member_argument?(arg) }
       end
 
       # Recognises `Struct.new(*Symbol)` and `Struct.new(*Symbol, keyword_init: <expr>)` at constant-write rvalue
       # position. A trailing `KeywordHashNode` (the `keyword_init: ...` form) is accepted but does not contribute to
       # member discovery; every other argument MUST be a `Prism::SymbolNode`. At least one Symbol member is required —
       # `Struct.new()` is a degenerate form callers don't typically use.
+      #
+      # Issue #2968 — a leading String (`Struct.new("Named", :a)`, the class `Struct::Named`) and a splatted member list
+      # (`Struct.new(*FIELDS)`) create the class just the same. {#meta_member_positionals} drops the String;
+      # {#meta_members_open?} marks a splatted list's members unknown.
       def struct_new_call?(node)
         return false unless meta_call_with_name?(node, :Struct, :new)
 
@@ -11628,7 +13562,12 @@ module Rigor
         positional = struct_new_positionals(args)
         return false if positional.nil? || positional.empty?
 
-        positional.all?(Prism::SymbolNode)
+        positional = positional.drop(1) if positional.first.is_a?(Prism::StringNode)
+        positional.all? { |arg| meta_member_argument?(arg) }
+      end
+
+      def meta_member_argument?(arg)
+        arg.is_a?(Prism::SymbolNode) || arg.is_a?(Prism::SplatNode)
       end
 
       # Recognises `Module.new` and `Module.new(&block)` / `Module.new do ... end` at constant-write rvalue position.
@@ -11734,8 +13673,18 @@ module Rigor
       }.freeze
       private_constant :UNENTERED_FLOW_ENTRY
 
-      UNENTERED_EVALUATOR_KEY = :rigor_scope_index_unentered_evaluator
-      private_constant :UNENTERED_EVALUATOR_KEY
+      # ADR-129 WD1 — a Frame: {#with_unentered_evaluator} installs the walk's evaluation for the walk and restores the
+      # outer one, and whether one is installed changes answers (an unentered construct is evaluated only inside a
+      # walk).
+      UNENTERED_EVALUATOR = TypingState.frame(
+        :scope_index_unentered_evaluator,
+        reason: "installed around the index walk that evaluates its unentered constructs; the lambda writes the " \
+                "walk's own table (the walk's state, not typing state) and reads its converged-loop recording and " \
+                "clause widening, and is frozen while installed",
+        # G1′: the evaluation types under the Frame, but only the index walk, outside `type_of`, reads it.
+        typing_never_reads: true
+      )
+      private_constant :UNENTERED_EVALUATOR
 
       # Issues #2196 and #2056 — an `&&` / `||` / `and` / `or`, an `if` / `unless` / ternary or a `while` / `until`
       # in a value position (an array element, a hash value, a call argument, an interpolation, a multi-value
@@ -11746,6 +13695,8 @@ module Rigor
       # the scope this walk reached it with, under the index's own recorder, so each part is recorded with the scope
       # the statement form records it with. What it does not visit (a dead arm) is walked as before.
       def evaluate_unentered_flow(node, table, current_scope)
+        return evaluate_unentered_block(node, table, current_scope) if node.is_a?(Prism::CallNode)
+
         entry = UNENTERED_FLOW_ENTRY[node.class]
         return if entry.nil?
 
@@ -11754,10 +13705,27 @@ module Rigor
         part = node.public_send(entry) || (node.conditions.first&.conditions&.first if node.is_a?(Prism::CaseNode))
         return if part.nil? || table.key?(part)
 
-        evaluate = Thread.current[UNENTERED_EVALUATOR_KEY]
+        evaluate = TypingState.current[UNENTERED_EVALUATOR]
         evaluate&.call(node, current_scope, code_body_nodes(node, current_scope.source_path))
       end
 
+      # Issue #1246 — the block of a call in a value position (`show([1].map { x = "s"; x.upcase })`, a receiver
+      # chain, an array element, a `->`'s body) is never entered: {StatementEvaluator} types the call through
+      # `ExpressionTyper`, and this walk could only floor a local the block rebinds ({#closure_scope}). Such a block
+      # is entered here instead, alone, from the scope this walk reached its call with, so its body is recorded with
+      # the scopes the statement form records: a capture read before the block rebinds it reads its binding, and the
+      # block's parameters are bound. The call's receiver and arguments stay with the walk. A class-creating or
+      # `refine` block keeps the walk ({#unentered_block_entry}), and a code body inside the block is left out of the
+      # recording ({#code_body_nodes}). A `super` block is a `SuperNode`'s, which the evaluator never enters either.
+      def evaluate_unentered_block(node, table, current_scope)
+        block = node.block
+        return unless block.is_a?(Prism::BlockNode)
+        return if table.key?(block) || class_body_block_call?(node, current_scope.source_path)
+
+        evaluate = TypingState.current[UNENTERED_EVALUATOR]
+        evaluate&.call(node, current_scope, code_body_nodes(block, current_scope.source_path), block_only: true)
+      end
+
       # The evaluation of an unentered construct starts with no class frame and no lexical nesting, which only a code
       # body observes: a `def`, a `class` / `module` / `class << …` body, and the block of a class-creating call
       # (`Class.new { … }`, `Struct.new`, `Data.define`, `Module.new`) or of a `refine`, whose `def`s and constants
@@ -11791,12 +13759,8 @@ module Rigor
       # Index walks nest (a rule may re-index a file while another file's walk is suspended), so the outer one is
       # restored on exit. A `propagate` called directly while an outer index walk is running would record into the
       # OUTER index's table through it; nothing outside {#index} calls `propagate`.
-      def with_unentered_evaluator(evaluate)
-        outer = Thread.current[UNENTERED_EVALUATOR_KEY]
-        Thread.current[UNENTERED_EVALUATOR_KEY] = evaluate
-        yield
-      ensure
-        Thread.current[UNENTERED_EVALUATOR_KEY] = outer
+      def with_unentered_evaluator(evaluate, &)
+        TypingState.current.with(UNENTERED_EVALUATOR, evaluate.freeze, &)
       end
 
       SELF_OPENING_BODIES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
@@ -11804,6 +13768,12 @@ module Rigor
 
       # Issue #1717 — a `def` / `class` / `module` body opens its own `self`, so an enclosing unentered block's
       # unknown-`self` mark ({Scope#block_self_unknown?}) stops at it, as the evaluator's fresh body scope does.
+      # Issue #1246 — it opens its own local table too, so a name in it (a `def`'s parameter, a body local) is a new
+      # variable, never the enclosing statement's local of that name: `show(Class.new { def call(o) = o + 1 })` after
+      # `o = { x: 1 }` read the parameter as the Hash. Such a name reads `Dynamic[top]` ({#shadow_local}), as in an
+      # unentered closure ({#closure_scope}); a body the evaluator entered is recorded and keeps its own scopes. Only
+      # the parameters and the body take that table: a `def`'s receiver, a `class`'s name and superclass and a
+      # `class << …`'s expression run in the enclosing scope (`class K < base.nope; base = 2; end`).
       # A `case` narrows its clauses ({#propagate_subjectless_case}, {#propagate_subject_case}). Every other node
       # hands its children the scope as is.
       def propagate_children(node, table, current_scope)
@@ -11812,10 +13782,19 @@ module Rigor
 
           return propagate_subject_case(node, table, current_scope)
         end
+        return propagate_code_body(node, table, current_scope) if SELF_OPENING_BODIES.include?(node.class)
 
-        child_scope =
-          SELF_OPENING_BODIES.include?(node.class) ? current_scope.with_block_self_unknown(false) : current_scope
-        node.rigor_each_child { |child| propagate(child, table, child_scope) }
+        node.rigor_each_child { |child| propagate(child, table, current_scope) }
+      end
+
+      def propagate_code_body(node, table, current_scope)
+        outer_scope = current_scope.with_block_self_unknown(false)
+        inner = [node.body]
+        inner << node.parameters if node.is_a?(Prism::DefNode)
+        inner_scope = node.locals.reduce(outer_scope) { |acc, name| shadow_local(acc, name) }
+        node.rigor_each_child do |child|
+          propagate(child, table, inner.any? { |part| part.equal?(child) } ? inner_scope : outer_scope)
+        end
       end
 
       # Issue #1361 — the block of `Thread.new`, `Fiber.new`, `define_method` and the other calls
@@ -11833,6 +13812,10 @@ module Rigor
       # argument one scope and threads none, so arguments that write keep the call's: an earlier one may rebind the
       # receiver a later one reads (`return y&.concat((y = nil).to_s, y.upcase)`, where the evaluator threads no
       # operand).
+      #
+      # Issue #1246 — the block of a value-position call is evaluated before this walk reaches it
+      # ({#evaluate_unentered_block}), so it arrives recorded and keeps the evaluator's entry. The block entries
+      # above therefore reach only a block that evaluation declines: a class-creating or `refine` block.
       def propagate_call(node, table, current_scope, recorded: false)
         block = node.block
         operands =
@@ -11868,6 +13851,7 @@ module Rigor
         current_scope = Narrowing.safe_navigation_block_scope(node, current_scope)
         # Issue #1429 — nor a guard's narrowing of a global or constant the body may run after code rebinds.
         current_scope = GuardRebinding.block_entry(current_scope, block, node)
+        current_scope = current_scope.entering_block_without_gradual_marks(block)
         entry =
           if FreshFrameBlocks.fresh_entry?(node, current_scope)
             FreshFrameBlocks.entry(current_scope, node)
@@ -11997,14 +13981,17 @@ module Rigor
       # `it` as the outer block's). An enclosing binding of such a name is replaced with `Dynamic[top]`. Not the
       # signature's parameter type: this walk evaluates nothing, and a body write to the name is never threaded,
       # so any narrower claim could be stale. A name the enclosing scope does not bind is left unbound, which
-      # reads the same `Dynamic[top]`. Captured names — outer locals the body reads or rebinds without
-      # redeclaring them — keep the enclosing binding. Issue #1360 — a `->` body and its parameter defaults run
-      # whenever the lambda is called, so they read `$!`, `$@` and `$?` unbound ({FreshFrameBlocks.closure_entry}).
+      # reads the same `Dynamic[top]`. Issue #1246 — for the same reason a captured name the body (or a closure
+      # nested in it) writes reads `Dynamic[top]` too ({#widen_condition_writes}): `x = 1; show([1].map { x = "s";
+      # x.upcase })` read `x` as `1` after the write. A captured name the body only reads keeps the enclosing
+      # binding. Issue #1360 — a `->` body and its parameter defaults run whenever the lambda is called, so they read
+      # `$!`, `$@` and `$?` unbound ({FreshFrameBlocks.closure_entry}).
       def closure_scope(closure, scope)
         scope = GuardRebinding.block_entry(scope, closure, nil)
         scope = FreshFrameBlocks.closure_entry(scope, closure, nil)
         scope = shadow_local(scope, :it) if closure.parameters.is_a?(Prism::ItParametersNode)
-        closure.locals.reduce(scope) { |acc, name| shadow_local(acc, name) }
+        scope = closure.locals.reduce(scope) { |acc, name| shadow_local(acc, name) }
+        widen_condition_writes(closure, scope)
       end
 
       def shadow_local(scope, name)