rigortype 0.4.6 → 0.4.8

data/lib/rigor/inference/statement_evaluator.rb

@@ -14,7 +14,10 @@ require_relative "block_call_timing"
 require_relative "block_repetition"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
+require_relative "../memo_audit"
 require_relative "callee_mutation_chain"
+require_relative "toplevel_def_census"
+require_relative "callee_write_census"
 require_relative "captured_locals"
 require_relative "dynamic_origin"
 require_relative "error_info"
@@ -25,11 +28,15 @@ require_relative "../analysis/check_rules/inferred_param_guard"
 require_relative "../analysis/check_rules/published_constant_guard"
 require_relative "struct_fold_safety"
 require_relative "closure_escape_analyzer"
+require_relative "self_preserving_block"
 require_relative "content_join"
+require_relative "construction_escape"
 require_relative "define_method_block_self"
 require_relative "macro_block_self_type"
+require_relative "global_writer_reach"
 require_relative "guard_rebinding"
 require_relative "self_call_ivar_writes"
+require_relative "direct_ivar_writes"
 require_relative "intervening_ivar_reset"
 require_relative "match_rebinding"
 require_relative "clause_widening"
@@ -42,6 +49,7 @@ require_relative "method_dispatcher"
 require_relative "method_parameter_binder"
 require_relative "multi_target_binder"
 require_relative "mutation_widening"
+require_relative "out_buffer_mutation"
 require_relative "narrowing"
 require_relative "operand_effects"
 require_relative "operand_walk"
@@ -54,6 +62,8 @@ require_relative "rewrite_mutation"
 require_relative "unknown_store_widening"
 require_relative "untyped_rejoin"
 require_relative "version_guard"
+require_relative "../run_scoped_slots"
+require_relative "../typing_state"
 
 module Rigor
   module Inference
@@ -186,13 +196,22 @@ module Rigor
       # return type. The flow value of a `return` is still `Bot` (it transfers control rather than producing a value);
       # the sink only records what the method *returns* through that edge. nil means "not collecting" — a top-level /
       # DSL-block walk, or inside a nested `def` barrier (whose returns belong to the inner method).
-      RETURN_SINK_KEY = :rigor_return_sink
-      private_constant :RETURN_SINK_KEY
+      #
+      # ADR-129 WD1 — the installation is a Frame and each record is a Resource touch.
+      RETURN_SINK = TypingState.frame(
+        :return_sink,
+        contents: :resource, reason: "installed per method body; each `return` records into it",
+        witness: "spec/fixtures/typing_state_witnesses/return_sink.rb"
+      )
+      private_constant :RETURN_SINK
 
       # Thread-local flag: set while a side pass ({.provisional_returns}) re-types part of a body from a scope other
       # than the one the statement walk holds, so the `return`s it reaches are filed as provisional ({ReturnSink}).
-      PROVISIONAL_RETURNS_KEY = :rigor_provisional_returns
-      private_constant :PROVISIONAL_RETURNS_KEY
+      PROVISIONAL_RETURNS = TypingState.frame(
+        :provisional_returns, reason: "a flag installed around a side pass",
+                              witness: "spec/fixtures/typing_state_witnesses/provisional_returns.rb"
+      )
+      private_constant :PROVISIONAL_RETURNS
 
       # The `return` sink {.with_return_sink} installs. Issue #2299 — a `return` the statement walk records is typed
       # with its real bindings; one a side pass records ({.provisional_returns}) may read a name the pass skipped the
@@ -207,8 +226,9 @@ module Rigor
           @provisional = []
         end
 
-        def record(node, type)
-          if Thread.current[PROVISIONAL_RETURNS_KEY]
+        # `provisional` is the {PROVISIONAL_RETURNS} frame the evaluator reached the `return` under.
+        def record(node, type, provisional)
+          if provisional
             @provisional << [node, type]
           else
             @types << type
@@ -226,14 +246,18 @@ module Rigor
       # Thread-local sink (an Array of `[NextNode, Type]`) collecting the value each `next` carries out of the block it
       # leaves, so `ExpressionTyper#type_block_body` can join those arms into the block's value type. Issue #841: the
       # block-return pass modelled only the fall-through tail, so `ops.all? { |o| next false unless o; true }` read as
-      # `Constant[true]` and folded the call to always-truthy — the same defect `RETURN_SINK_KEY` fixes one level up for
+      # `Constant[true]` and folded the call to always-truthy — the same defect `RETURN_SINK` fixes one level up for
       # a method's early `return`. The flow value of a `next` stays `Bot`.
       #
       # The sink also collects `next`s from nested blocks / loops / defs evaluated under the same installation (they do
       # not install their own), so the consumer filters by node identity against a statically computed
       # directly-targeting set, exactly as the break sink does. nil means "not collecting".
-      NEXT_SINK_KEY = :rigor_next_sink
-      private_constant :NEXT_SINK_KEY
+      NEXT_SINK = TypingState.frame(
+        :next_sink,
+        contents: :resource, reason: "installed per block body; each `next` records into it",
+        witness: "spec/fixtures/typing_state_witnesses/jump_sinks.rb"
+      )
+      private_constant :NEXT_SINK
 
       # Thread-local sink (an Array of `[BreakNode, Scope]`) collecting the scope at each `break` reached while
       # evaluating a loop body, so `eval_loop` / `eval_for` can join a `break`-path binding (`flag = true; break`) into
@@ -241,21 +265,33 @@ module Rigor
       # installs its own sink, restored on exit, so an inner loop's break does not leak to the outer one. A `break`
       # inside a block / nested loop targets that inner construct, not the lexical loop — filtered out by the loop's
       # {JumpTargets} set ({#loop_jumps}). See docs/notes/20260615-loop-break-binding-propagation-design.md.
-      BREAK_SINK_KEY = :rigor_break_sink
-      private_constant :BREAK_SINK_KEY
+      #
+      # ADR-129 WD3 — a construct reads the sink's size before it runs and again after, to find the jumps it recorded
+      # itself ({#restoring_error_info}, {#ensure_jump_marks}), so a read of the contents is delta-internal.
+      BREAK_SINK = TypingState.frame(
+        :break_sink,
+        contents: :resource, read_exemption: :delta_internal,
+        reason: "installed per loop body; each `break` records into it, and an enclosing `ensure` rewrites them",
+        witness: "spec/fixtures/typing_state_witnesses/jump_sinks.rb"
+      )
+      private_constant :BREAK_SINK
 
       # Thread-local sink (an Array of `[BreakNode, Type]`) collecting the value each `break` carries out of the
       # construct it leaves. Issue #853: `break value` terminates the yielding CALL and is that call's value, so —
-      # unlike `next`, which {NEXT_SINK_KEY} joins into the block — these arms are consumed one level up, by
+      # unlike `next`, which {NEXT_SINK} joins into the block — these arms are consumed one level up, by
       # `ExpressionTyper#call_dispatch_type_for`. Without them `ops.all? { |o| break false unless o; true }` folded to
       # `Constant[true]` and warned about a program that really can answer false.
       #
-      # Separate from {BREAK_SINK_KEY}, which records SCOPES for the loop-continuation join: the two consumers want
+      # Separate from {BREAK_SINK}, which records SCOPES for the loop-continuation join: the two consumers want
       # different things from the same node, and a loop body evaluated under a call's collection must keep feeding its
       # own sink. Both are filtered by node identity against a statically computed directly-targeting set, so a `break`
       # that belongs to an inner loop or block never reaches the wrong consumer. nil means "not collecting".
-      BREAK_VALUE_SINK_KEY = :rigor_break_value_sink
-      private_constant :BREAK_VALUE_SINK_KEY
+      BREAK_VALUE_SINK = TypingState.frame(
+        :break_value_sink,
+        contents: :resource, reason: "installed per yielding call; each `break` records into it",
+        witness: "spec/fixtures/typing_state_witnesses/jump_sinks.rb"
+      )
+      private_constant :BREAK_VALUE_SINK
 
       # Lexical class frame: the `name:` field is the qualified class name as it would render in Ruby (e.g.,
       # `"Foo::Bar"`); the `singleton:` field is `true` for `class << self` frames so nested defs resolve to
@@ -348,18 +384,9 @@ module Rigor
       # so a `def` evaluated inside another method's body (which itself installed a sink) does not corrupt the outer
       # one. Used by `ExpressionTyper#infer_user_method_return` to join the explicit returns into the inferred
       # method-return type.
-      def self.with_return_sink
-        previous = Thread.current[RETURN_SINK_KEY]
-        previous_provisional = Thread.current[PROVISIONAL_RETURNS_KEY]
+      def self.with_return_sink(&)
         sink = ReturnSink.new
-        Thread.current[RETURN_SINK_KEY] = sink
-        Thread.current[PROVISIONAL_RETURNS_KEY] = nil
-        begin
-          result = yield
-        ensure
-          Thread.current[RETURN_SINK_KEY] = previous
-          Thread.current[PROVISIONAL_RETURNS_KEY] = previous_provisional
-        end
+        result = TypingState.current.with_pair(RETURN_SINK, sink, PROVISIONAL_RETURNS, nil, &)
         [result, sink.types]
       end
 
@@ -367,48 +394,54 @@ module Rigor
       # on exit. Issue #2299 — {ExpressionTyper#type_block_body}'s tail-only answer types `return r if r` without the
       # `r = yield e` before it, so `r` read `Dynamic[top]` and that went into the enclosing method's return type
       # although the statement walk of the same block recorded `r` with its real binding.
-      def self.provisional_returns
-        previous = Thread.current[PROVISIONAL_RETURNS_KEY]
-        Thread.current[PROVISIONAL_RETURNS_KEY] = true
-        begin
-          yield
-        ensure
-          Thread.current[PROVISIONAL_RETURNS_KEY] = previous
-        end
+      def self.provisional_returns(&)
+        TypingState.current.with(PROVISIONAL_RETURNS, true, &)
       end
 
       # Runs `block` with a fresh `next` sink installed, then yields the collected `[NextNode, Type]` pairs to the
       # caller. Stacks like the return sink, and for the same reason: a block body evaluated inside another block body's
       # evaluation must not spill its arms into the outer collection. Used by `ExpressionTyper#type_block_body` to join
       # the `next` arms into the block's value type.
-      def self.with_next_sink
-        previous = Thread.current[NEXT_SINK_KEY]
+      def self.with_next_sink(&)
         sink = []
-        Thread.current[NEXT_SINK_KEY] = sink
-        begin
-          result = yield
-        ensure
-          Thread.current[NEXT_SINK_KEY] = previous
-        end
+        result = TypingState.current.with(NEXT_SINK, sink, &)
         [result, sink]
       end
 
+      # Runs `block` with none of {CALLER_SINKS} installed: a user-method body re-typed for its return starts outside
+      # its caller's constructs (ADR-129 WD1: the return memo forces these Frames at its entry). Installs only when one
+      # is set, read with `forcing_read`, so the common entry costs no frame.
+      def self.outside_caller_sinks(&)
+        state = TypingState.current
+        return yield if CALLER_SINKS.all? { |slot| state.forcing_read(slot).nil? }
+
+        state.without(CALLER_SINKS, &)
+      end
+
       # Runs `block` with a fresh `break`-value sink installed, then yields the collected `[BreakNode, Type]` pairs to
       # the caller. Stacks like the other sinks: a block body evaluated inside another block body's evaluation must not
       # spill its arms into the outer collection. Used by `ExpressionTyper#call_dispatch_type_for` to union the `break`
       # arms into the yielding call's type (issue #853).
-      def self.with_break_value_sink
-        previous = Thread.current[BREAK_VALUE_SINK_KEY]
+      def self.with_break_value_sink(&)
         sink = []
-        Thread.current[BREAK_VALUE_SINK_KEY] = sink
-        begin
-          result = yield
-        ensure
-          Thread.current[BREAK_VALUE_SINK_KEY] = previous
-        end
+        result = TypingState.current.with(BREAK_VALUE_SINK, sink, &)
         [result, sink]
       end
 
+      # Issue #1246 — enters only `call`'s block, from the receiver scope, as the statement form enters it
+      # ({#evaluate_block_if_present}): the per-node scope index's evaluation of a block a value-position call holds
+      # ({ScopeIndexer#evaluate_unentered_block}). The call's receiver and arguments are left to the index walk.
+      #
+      # Such a block enters with the unknown-`self` mark only ({Scope#with_block_self_unknown}), as the walk entered
+      # it, not with the statement form's opaque-`self` mark ({Scope#entering_opaque_block}): issue #1717 keeps the
+      # latter, which gates binding a call to a cross-file top-level `def`, away from value-position blocks.
+      def evaluate_block_of(call)
+        @value_position_block = call.block
+        evaluate_block_if_present(call)
+      ensure
+        @value_position_block = nil
+      end
+
       # Evaluate `node` under the receiver scope. Returns `[type, scope']` where `type` is the value the node produces
       # and `scope'` is the scope observable after the node has run. The receiver scope is never mutated.
       def evaluate(node)
@@ -517,9 +550,13 @@ module Rigor
       # def hands on to a self-call counts whether or not the callee resolves: the session's empty scope resolves no
       # callee, and without it an edit that starts or stops forwarding a parameter to a mutating callee would leave
       # the effects equal and the callers' floors stale.
+      #
+      # Issue #2296 — the parameters the def mutates inside a block, or through a Set-only adder, count too: they
+      # floor the caller's argument through {#floor_callee_escaped_args_for_call}'s element-keeping channels.
       def content_mutated_parameter_positions(def_node)
-        slots = content_parameter_slots(def_node)
-        census = callee_content_mutated_parameters(def_node).values
+        slots = forwarding_slots(def_node)
+        census = callee_content_mutated_parameters(def_node).values +
+                 own_block_content_parameters(def_node).values + own_set_content_parameters(def_node).values
         each_forwarding_call(def_node, slots) { |_, forwarded| census += forwarded.map { |name, _| slots[name] } }
         positions, keywords = census.uniq.partition { |slot| slot.is_a?(Integer) }
         positions.sort + keywords.sort
@@ -531,25 +568,703 @@ module Rigor
       # callee floor ({#widen_callee_escaped_argument_captures}) floors after the call, and the ones
       # {CapturedLocals.content_mutations} reports as a block's callee-mutated captures.
       def content_mutated_arguments(call_node)
-        return NO_ARGUMENT_READS unless self_dispatch_call?(call_node)
+        callees = argument_mutating_callees(call_node)
+        return NO_ARGUMENT_READS if callees.empty?
+
+        reads = callees.flat_map do |def_node, offset, owner|
+          arguments_for_slots(call_node, census_of(owner, :callee_content_mutated_parameters, def_node), offset)
+        end
+        callees.size == 1 ? reads : reads.uniq
+      end
+
+      # The `[def, offset]` pairs a self-dispatch `call_node` that passes a local resolves to
+      # ({#resolve_self_callees}) — the defs whose census the callee floor reads; empty for any other call.
+      #
+      # Issue #2336 — a call no def answers that runs code the floor cannot see against its arguments (`pr.call(acc)`,
+      # `obj.method(:poke).call(acc)`, `send(name, acc)`; {#opaque_sink_call?}) answers {OPAQUE_CALLEES}: every
+      # argument it passes reads as written.
+      def argument_mutating_callees(call_node)
+        unless self_dispatch_call?(call_node)
+          found = receiver_callees(call_node)
+          return found unless found.empty? && opaque_sink_call?(call_node)
+
+          return call_passes_local_argument?(call_node) ? OPAQUE_CALLEES : NO_CALLEES
+        end
         # Fast path — only a local passed as an argument can be reported, so a call with none skips the def
         # resolution and the body scan entirely (the overwhelming common case).
-        return NO_ARGUMENT_READS unless call_passes_local_argument?(call_node)
+        return NO_CALLEES unless call_passes_local_argument?(call_node)
+
+        found = resolve_self_callees(call_node)
+        found.empty? && opaque_sink_call?(call_node) ? OPAQUE_CALLEES : found
+      end
+
+      # True for a call whose arguments go to code no def shows: `call` / `instance_exec` / `class_exec` /
+      # `module_exec` on an explicit receiver (a Proc, a Method, a lambda), or a `send` whose target is no literal
+      # ({CalleeWriteCensus}, which reads the same calls inside a callee).
+      def opaque_sink_call?(call_node)
+        name = call_node.name
+        return !CalleeWriteCensus.literal_send?(call_node) if SEND_HAND_OFFS.include?(name)
+        return false unless OPAQUE_SINKS.include?(name)
+
+        # A receiverless `call` is a self-call to a def of that name; `instance_exec` and the rest run their block on
+        # any receiver.
+        name != :call || !self_dispatch_call?(call_node)
+      end
+
+      OPAQUE_SINKS = %i[call instance_exec class_exec module_exec].to_set.freeze
+      private_constant :OPAQUE_SINKS
+
+      # Issue #2510, #2515 — the `[def, 0, owner]` triple an explicit-receiver `recv.name(local)` call resolves to when
+      # `recv` types as a project class object (`Const`, a bare constant or any constant path, or a local holding
+      # one), whose singleton chain has `name` (`def self.name`, `class << self`, `module_function`, an `extend`ed
+      # module, the project superclass's), or as an instance of a project class (`Opts.new.add_format(...)`,
+      # `h = Opts.new; h.add_format(...)`), whose instance chain has `name`: the same census a self-call reads then
+      # floors the passed local, so `Opts.add_format(opts, options)` handing `options` to a block that writes it
+      # leaves the literal behind. `owner` is a {CalleeOwner}: the receiver type the callee's own hand-offs
+      # (`really(parser, options)`) resolve self-calls in, not the caller's class. `resolved_census` keys the shared
+      # memo by the receiver's class and the def node, whose recorded nesting its constants resolve in. A def the
+      # receiver inherits (a superclass's, an included module's) resolves to {FLOOR_ALL} ({#walked_owner}). A receiver
+      # of any other type resolves to nothing, as does `Const.new` of a class that defines its own `self.new`; `send`
+      # hand-offs are not followed through an explicit receiver. The hand-offs inside a callee, whose arguments are
+      # parameters, take {#hand_off_receiver_callees}.
+      def receiver_callees(call_node)
+        return NO_CALLEES if call_node.receiver.nil?
+        return NO_CALLEES unless call_passes_local_argument?(call_node)
+
+        receiver_callees_in(scope, call_node)
+      end
+
+      # {#receiver_callees} for one scope `call_node`'s receiver (or `receiver`, the constant form a callee's local
+      # receiver was assigned) is typed in.
+      def receiver_callees_in(typing_scope, call_node, receiver = call_node.receiver)
+        return NO_CALLEES if overridden_constructor?(receiver, typing_scope)
+
+        receiver_type = typing_scope.type_of(receiver)
+        own = callees_for_receiver_type(receiver_type, call_node.name)
+        return own unless own.empty? && send_hand_off?(call_node)
+
+        shifted_callees(callees_for_receiver_type(receiver_type, send_target(call_node)))
+      end
+
+      # Issue #2336 — the method a `send` hand-off names (`recv.send(:poke, h)`, `send("poke", h)`).
+      def send_target(call_node) = call_node.arguments.arguments.first.unescaped.to_sym
+
+      # `callees` with each offset one further: the callees of a `send` hand-off's target, whose first argument is the
+      # name. A capped answer stays as it is.
+      def shifted_callees(callees)
+        return callees if callees.empty? || callees.equal?(CAPPED_HAND_OFF)
+
+        shifted = callees.map { |def_node, offset, owner| [def_node, offset + 1, owner] }
+        callees.is_a?(UnionCallees) ? UnionCallees.new(shifted) : shifted
+      end
+
+      # `[def, 0, owner]` for `name` called on a receiver of `receiver_type`, or none.
+      def callees_for_receiver_type(receiver_type, name)
+        if receiver_type.is_a?(Type::Union)
+          return receiver_type.members.flat_map { |member| callees_for_receiver_type(member, name) }
+                              .uniq { |callee, _, owner| [callee.object_id, owner] }
+        end
+
+        singleton = receiver_type.is_a?(Type::Singleton)
+        return NO_CALLEES unless singleton || receiver_type.is_a?(Type::Nominal)
+
+        class_name = receiver_type.class_name
+        found, defining =
+          if singleton then scope.singleton_def_through_ancestors(class_name, name)
+          else scope.user_def_through_ancestors(class_name, name)
+          end
+        side = singleton ? :singleton : :instance
+        return unresolved_receiver_callees(receiver_type, side, name) if found.nil?
+
+        [[found, 0, walked_owner(defining, class_name, CalleeOwner.new(receiver_type))]]
+      end
+
+      # `owner`, the owner a def found on `defining` by a lookup on `class_name` is walked under, or {FLOOR_ALL} for a
+      # def the class inherits (`defining` is not `class_name`). An inherited def is not walked (#2521): walking it
+      # exposed the own-def census's blind spots, which #2595 closes ({#callee_write_census}), and the hand-offs #2336
+      # lists, which stay open and which the floor masks.
+      def walked_owner(defining, class_name, owner)
+        defining == class_name ? owner : FLOOR_ALL
+      end
+
+      # Issue #2336 — what a call of `name` on a receiver of `receiver_type` reaches when its `side` chain has no def of
+      # the name: a body an ownerless definition row may give it ({#receiver_ownerless_body?}), floored outright; on
+      # the singleton side, a same-named instance def
+      # written as a `module_function def x` argument ({Scope#module_function_row_def?}), which the singleton def table
+      # does not hold, walked as a class method; else the chain's `method_missing`.
+      def unresolved_receiver_callees(receiver_type, side, name)
+        class_name = receiver_type.class_name
+        return OPAQUE_CALLEES if receiver_ownerless_body?(name, class_name)
+
+        if side == :singleton
+          found, defining = scope.user_def_through_ancestors(class_name, name)
+          if found && scope.module_function_row_def?(found, defining)
+            return [[found, 0, walked_owner(defining, class_name, CalleeOwner.new(receiver_type))]]
+          end
+        end
+        method_missing_callees(class_name, side, name, 0)
+      end
+
+      # Issue #2336 — true when an ownerless definition row may give `name` a body on `class_name`, the receiver of an
+      # explicit-receiver call ({Scope#ownerless_definition?}). A `define_method` / `define_singleton_method` /
+      # `alias_method` call or a def in a block claims no owner, so it may be the receiver's own and always counts. A
+      # top-level def lives on `Object`, so a method RBS declares on the receiver's class answers ahead of it
+      # (`Bag < Hash` and a top-level `def store`): the top-level rows count only when RBS declares none.
+      def receiver_ownerless_body?(name, class_name)
+        return true if scope.ownerless_definition?(name, top_level: false)
+        return false if rbs_declares?(class_name, name)
+
+        scope.ownerless_definition?(name)
+      end
+
+      # Issue #2336 — true when a body no def table holds may answer the receiverless call of `name` in `class_name`'s
+      # `side` chain, which no def, `method_missing` or top-level def answers: a definer the chain records
+      # (`define_method(:format)` in the class body; {Scope#discovered_method_through_ancestors?}), or, for a name RBS
+      # does not declare on `Object` (`Class` on the singleton side), any ownerless definition row. A name `Object`
+      # declares (`warn`, `format`) is answered by that method once the chain has no definer of it, so a `def warn` in a
+      # `refine Kernel` block or a `define_method` on another class does not count.
+      def self_ownerless_body?(name, class_name, side)
+        return true if scope.discovered_method_through_ancestors?(class_name, name, side)
+        return false if Reflection.instance_method_definition(side == :singleton ? "Class" : "Object", name,
+                                                              scope: scope)
+
+        scope.ownerless_definition?(name)
+      end
+
+      # Issue #2521 (#2570 review) — the `[def, offset, FLOOR_ALL]` a call of `name` that resolves to no def on
+      # `class_name`'s `side` chain reaches when the chain defines `method_missing` and `name` is not a method every
+      # object (`Object`, or `Class` on the singleton side) answers: Ruby calls `method_missing(name, *args)`, so its
+      # parameters sit `offset` places ahead of the call's arguments (-1; 0 for a `send(:name, ...)` hand-off).
+      def method_missing_callees(class_name, side, name, offset)
+        found =
+          if side == :singleton then scope.singleton_def_through_ancestors(class_name, :method_missing).first
+          else scope.user_def_through_ancestors(class_name, :method_missing).first
+          end
+        return NO_CALLEES if found.nil?
+
+        base = side == :singleton ? "Class" : "Object"
+        return NO_CALLEES if Reflection.instance_method_definition(base, name, scope: scope)
+
+        [[found, offset - 1, FLOOR_ALL]]
+      end
+
+      # What a cross-class hand-off carries instead of an evaluator: the receiver type, which is `self` in the callee.
+      # The def's lexical nesting is not carried: it is a property of the def node ({#recorded_def_nesting}), which
+      # keys the census memo and the chain's nodes beside it. Holds no scope, so the run-scoped census memo that keeps
+      # an {CalleeMutationChain::Edge} alive keeps no caller state alive.
+      CalleeOwner = Data.define(:self_type)
+
+      # The owner of an inherited def ({#walked_owner}): its census and hand-offs are not walked. Every content
+      # parameter reads as mutated, so the argument is floored, and a {BudgetTrace::CALLEE_CHAIN_CAP} hit is recorded.
+      FLOOR_ALL = :floor_all
+
+      # Issue #2515 — the owner of a top-level def that may not be the method the call runs (several defs of the name,
+      # an alias, a class chain that may answer it first; {ToplevelDefCensus}, {#top_level_callees}): the def is not
+      # read, and EVERY argument the call passes reads as written, whatever the def's own parameters are, since another
+      # def of the name may take more of them. A hand-off to it floors the handed parameter outright.
+      FLOOR_EVERY = :floor_every
+
+      # Issue #2336 — the answer for a call no def resolves whose arguments the floor reads as written: an opaque sink
+      # ({#opaque_sink_call?}), or a name a definer other than a `def` may give a body ({#receiver_ownerless_body?},
+      # {#self_ownerless_body?}). No def is
+      # read; every argument floors as under {FLOOR_EVERY}.
+      OPAQUE_CALLEES = [[nil, 0, FLOOR_EVERY].freeze].freeze
+
+      # The owner of a top-level def reached from inside a class: its hand-offs resolve at the top level, where `self`
+      # is no instance of the caller's class.
+      TOPLEVEL_OWNER = CalleeOwner.new(nil)
+      OVER_APPROXIMATING = [FLOOR_ALL, FLOOR_EVERY].freeze
+      private_constant :CalleeOwner, :FLOOR_ALL, :FLOOR_EVERY, :OPAQUE_CALLEES, :TOPLEVEL_OWNER, :OVER_APPROXIMATING
+
+      # True for `Const.new` where the class defines its own `self.new`, whose result is not an instance of `Const`.
+      def overridden_constructor?(receiver, typing_scope)
+        return false unless receiver.is_a?(Prism::CallNode) && receiver.name == :new
+
+        klass = typing_scope.type_of(receiver.receiver) if constant_node?(receiver.receiver)
+        klass.is_a?(Type::Singleton) &&
+          !typing_scope.singleton_def_through_ancestors(klass.class_name, :new).first.nil?
+      end
+
+      # Issue #2522 — the callees a hand-off inside `def_node`'s body (`Help.c(p, o)`, `Helper.new.c(p, o)`) resolves
+      # to: the receiver typed once under the `Module.nesting` the declaration walk recorded for `def_node`, so a bare
+      # constant follows Ruby's lookup (the lexical chain, the innermost cref's ancestors, the top level) for the
+      # spelling the def is actually written under (`class B::Opts` reads `::Helper`, `module B; class Opts` reads
+      # `B::Helper`). The nesting is a function of the def node, never of the caller, so the answer cannot depend on
+      # which caller reached the memoised edges first. A def with no recorded nesting takes
+      # {#unrecorded_hand_off_callees}.
+      def hand_off_receiver_callees(call_node, def_node, receiver = call_node.receiver)
+        nesting = exact_def_nesting(def_node)
+        return unrecorded_hand_off_callees(call_node, receiver) if nesting.nil?
+
+        receiver_callees_in(scope.with_lexical_nesting(nesting), call_node, receiver)
+      end
+
+      # The def's recorded `Module.nesting` ({Scope::DiscoveryIndex#recorded_def_nesting}), nil when the declaration
+      # walk recorded none.
+      def recorded_def_nesting(def_node) = scope.discovery.recorded_def_nesting(def_node)
+
+      # The nesting the hand-offs of `def_node`, run with `self_type`, resolve their constants in exactly, or nil. A
+      # def in a `class << self` body answers nil: there Ruby's cref is the singleton class, whose ancestors are not
+      # the class's (#2570 review), and the recorded nesting does not name it. Such a def is receiverless, runs on the
+      # class object, and is not in its cref's instance def table, which a `module_function` / `extend self` def or an
+      # `extend`ed module's def (whose cref is the module itself) is.
+      def exact_def_nesting(def_node, self_type = scope.self_type)
+        nesting = recorded_def_nesting(def_node)
+        return nesting unless self_type.is_a?(Type::Singleton) && def_node.receiver.nil?
+        return nil if nesting.nil? || nesting.empty?
+
+        scope.user_def_for(nesting.first, def_node.name).equal?(def_node) ? nesting : nil
+      end
+
+      # A hand-off in a def whose nesting was not recorded (a def under a header that renders no name, a bundle-served
+      # def outside a rehydrating run): the spelling of the defining class is unknown (`module A; class B::C` has the
+      # nesting `["A::B::C", "A"]`, `class A::B::C` has `["A::B::C"]`), so the union of two resolutions that try
+      # every spelling it could have had, each of which only adds callees:
+      #
+      # - By name: a bare constant `K` as each prefix of the class name followed by `K`, and as the top-level `K`; a
+      #   rooted one (`::K`) as `K` alone.
+      # - Typed: the receiver typed under each truncation of the nested-spelling nesting (`["A::B::C", "A::B", "A"]`
+      #   gives `["A::B::C"]`, `["A::B::C", "A::B"]` and the whole chain), which sees an alias, an inherited or
+      #   included constant and a constant holding an instance.
+      def unrecorded_hand_off_callees(call_node, receiver = call_node.receiver)
+        constructed = receiver.is_a?(Prism::CallNode) && receiver.name == :new
+        written = constant_name(constructed ? receiver.receiver : receiver)
+        return NO_CALLEES if written.nil?
+        return compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed) if hand_off_memo_bypassed?
+
+        memo = unrecorded_hand_off_memo(written)
+        key = [constructed, call_node.name]
+        unless memo.key?(key)
+          return memo[key] = MemoAudit.key_audit("unrecorded hand-off") do
+            compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed)
+          end
+        end
+
+        MemoAudit.check("unrecorded hand-off", memo[key], written, key) do
+          compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed)
+        end
+      end
+
+      def compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed)
+        found = hand_off_class_names(written).flat_map do |class_name|
+          hand_off_callee_in(class_name, constructed, call_node.name)
+        end
+        hand_off_typing_scopes(written).each do |typing_scope|
+          found.concat(receiver_callees_in(typing_scope, call_node, receiver))
+        end
+        found.size > 1 ? found.uniq { |callee, _, owner| [callee.object_id, owner] } : found
+      end
+
+      # The run's per-discovery memo of {#unrecorded_hand_off_callees}: the answer depends on the receiver's spelling,
+      # the class `self` is and its side (a constant's ancestor lookup differs between the class object and an
+      # instance), and the called name, not on the def it sits in.
+      def unrecorded_hand_off_memo(written)
+        table = typing_state.weak_key_map(UNRECORDED_HAND_OFFS)
+        self_type = scope.self_type
+        by_side = ((table[scope.discovery] ||= {})[self_type.is_a?(Type::Singleton)] ||= {})
+        (by_side[enclosing_class_name_for(self_type)] ||= {})[written] ||= {}
+      end
+
+      UNRECORDED_HAND_OFFS = TypingState.memo(
+        :callee_unrecorded_hand_offs,
+        run_scoped: true, audit: "unrecorded hand-off",
+        reason: "keyed by discovery, side, class and spelling, all its answer reads"
+      )
+      private_constant :UNRECORDED_HAND_OFFS
+
+      # The scopes {#unrecorded_hand_off_callees} types a receiver written as `written` in. A rooted constant and a
+      # top-level def are typed once.
+      def hand_off_typing_scopes(written)
+        name = enclosing_class_name_for(scope.self_type)
+        return [scope.with_lexical_nesting([])] if name.nil?
+        return [scope] if written.start_with?("::")
+
+        parts = name.to_s.split("::")
+        chain = parts.each_index.map { |i| parts[0..(parts.size - 1 - i)].join("::") }
+        chain.each_index.map { |k| scope.with_lexical_nesting(chain[0..k]) }
+      end
+
+      # `[def, 0, owner]` for `name` called on `class_name` (or on its `new`), or none.
+      def hand_off_callee_in(class_name, constructed, name)
+        if constructed
+          return NO_CALLEES unless scope.singleton_def_through_ancestors(class_name, :new).first.nil?
+
+          found = scope.user_def_for(class_name, name)
+          return found.nil? ? NO_CALLEES : [[found, 0, CalleeOwner.new(Type::Combinator.nominal_of(class_name))]]
+        end
+
+        found, defining = scope.singleton_def_through_ancestors(class_name, name)
+        return NO_CALLEES if found.nil?
+
+        owner = CalleeOwner.new(Type::Combinator.singleton_of(class_name))
+        [[found, 0, walked_owner(defining, class_name, owner)]]
+      end
+
+      # The class names a constant written as `written` (`K`, `A::K`, `::K`) can name from the def's class name.
+      def hand_off_class_names(written)
+        return [written.delete_prefix("::")] if written.start_with?("::")
+
+        name = enclosing_class_name_for(scope.self_type)
+        return [written] if name.nil?
+
+        parts = name.to_s.split("::")
+        parts.each_index.map { |i| "#{parts[0..i].join('::')}::#{written}" } << written
+      end
+
+      # True when a census memo must not be read or written: a dependency recorder is active (it must see each
+      # constant read), or this scope carries guard narrowings of constants (`if INST.is_a?(Sub)`), which survive
+      # `with_self_type` and change what the constant types as, so the answer is no longer the def's alone. An audit
+      # recomputation ({MemoAudit}) bypasses them too, so it reads no stored entry.
+      def hand_off_memo_bypassed?
+        Analysis::DependencyRecorder.active? || !scope.constant_narrowings.empty? || MemoAudit.suspended?
+      end
+
+      # The name a constant node is written with, or nil when part of it is not a constant (`foo::Bar`).
+      def constant_name(node)
+        node.full_name if constant_node?(node)
+      rescue Prism::ConstantPathNode::DynamicPartsInConstantPathError, Prism::ConstantPathNode::MissingNodesInConstantPathError
+        nil
+      end
+
+      # The evaluator a hand-off's {CalleeOwner} stands for, built from this one's scope and kept on it.
+      def owner_evaluator(owner)
+        (@owner_evaluators ||= {})[owner] ||=
+          self.class.new(scope: scope.with_self_type(owner.self_type))
+      end
+
+      # The `[def, offset, owner]` triples a call inside `def_node`'s body hands its parameter to: a self-call
+      # ({#resolve_self_callees}, owner nil) or a call on a constant / `Const.new` receiver ({#hand_off_receiver?},
+      # {#hand_off_receiver_callees}).
+      #
+      # Issue #2336 — a call on `itself` is a self-call, and one on `self.class` resolves on the class object `self`
+      # types as. A call on any other receiver the callee's body cannot type (a call's result: `new.store(h)`,
+      # `instance.helper(h)`; a class variable or a global) resolves by name, as an ivar receiver does. A literal
+      # `send` hand-off on any receiver resolves as its target.
+      def hand_off_callees(call_node, def_node, depth = 0)
+        receiver = call_node.receiver
+        return self_hand_off_callees(call_node) if self_dispatch_call?(call_node) || itself_receiver?(receiver)
+
+        if receiver.is_a?(Prism::LocalVariableReadNode) || receiver.is_a?(Prism::ItLocalVariableReadNode)
+          return local_receiver_callees(call_node, def_node, depth)
+        end
+        return receiver_callees_in(scope, call_node) if class_of_self?(receiver)
+        return hand_off_receiver_callees(call_node, def_node) if constant_receiver_form?(receiver)
+
+        named_hand_off_callees(call_node)
+      end
+
+      # {#named_instance_callees} for `call_node`'s name, or a literal `send` hand-off's target.
+      def named_hand_off_callees(call_node)
+        return named_instance_callees(call_node.name) unless send_hand_off?(call_node)
+
+        shifted_callees(named_instance_callees(send_target(call_node)))
+      end
+
+      # `itself` / `self.itself`, which is `self`.
+      def itself_receiver?(receiver)
+        receiver.is_a?(Prism::CallNode) && receiver.name == :itself && receiver.arguments.nil? &&
+          receiver.block.nil? && self_dispatch_call?(receiver)
+      end
+
+      # `self.class`, the class object of `self`.
+      def class_of_self?(receiver)
+        receiver.is_a?(Prism::CallNode) && receiver.name == :class && receiver.receiver.is_a?(Prism::SelfNode) &&
+          receiver.arguments.nil? && receiver.block.nil?
+      end
+
+      # {#resolve_self_callees} for a self-call that is a hand-off inside a def. In a def the evaluator is the top
+      # level's (`self` nil), the def a top-level one, and a top-level def is a private method on `Object`: it may be
+      # called from any object, so a same-named instance def of the caller's class answers the hand-off before the
+      # top-level one. Issue #2515 — the project's same-named instance defs are unioned in as a receiver the callee
+      # cannot type is ({#named_instance_callees}): they floor, never narrow.
+      def self_hand_off_callees(call_node)
+        found = resolve_self_callees(call_node)
+        return found unless enclosing_class_name_for(scope.self_type).nil?
+
+        send_hand_off = send_hand_off?(call_node)
+        target = send_hand_off ? call_node.arguments.arguments.first.unescaped.to_sym : call_node.name
+        named = named_instance_callees(target)
+        return named if named.equal?(CAPPED_HAND_OFF)
+        return found if named.empty?
+
+        named = named.map { |def_node, _offset, owner| [def_node, 1, owner] } if send_hand_off
+        UnionCallees.new(found + named)
+      end
+
+      # True for a call on an explicit receiver: one the callee's body can type without its locals (a constant or
+      # `Const.new`), a local of the callee (#2515: {#local_receiver_callees}), or (issue #2595 for an ivar, #2336 for
+      # any other) one whose type the def's AST does not show, so it resolves by name ({#named_hand_off_callees}).
+      def hand_off_receiver?(node) = node.is_a?(Prism::CallNode) && !node.receiver.nil?
+
+      def constant_receiver_form?(receiver)
+        case receiver
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then true
+        when Prism::CallNode then receiver.name == :new && constant_node?(receiver.receiver)
+        else false
+        end
+      end
+
+      # Issue #2515 — the callees of `local.name(p, o)` inside `def_node`, where `local` is a parameter or a local of
+      # the def. A local every assignment of which in the def is a constant receiver form (`Const`, `Const.new`) is
+      # typed inside the callee, as the constant receiver is ({#hand_off_receiver_callees}). Any other receiver (a
+      # parameter, a local assigned anything else, a block-local) has a type that depends on the caller, which is
+      # not a function of the graph node, so the call resolves by name instead ({#named_instance_callees}).
+      def local_receiver_callees(call_node, def_node, depth)
+        receiver = call_node.receiver
+        typed = receiver.is_a?(Prism::LocalVariableReadNode) && receiver.depth == depth
+        forms = typed_local_forms(def_node, receiver.name) if typed
+        forms = nil if forms && local_object_opened?(def_node, call_node)
+        return named_hand_off_callees(call_node) if forms.nil?
+
+        found = forms.flat_map { |form| hand_off_receiver_callees(call_node, def_node, form) }
+        found.size > 1 ? found.uniq { |callee, _, owner| [callee.object_id, owner] } : found
+      end
+
+      # The constant receiver forms every assignment of the local `name` in `def_node` holds, or nil when `name` is a
+      # parameter, is never assigned, or may hold anything else. The whole body is read, including the scopes the
+      # hand-off walk leaves out (a lambda, an `instance_exec` / `class_exec` / `define_method` block, a block that
+      # shadows the name), so a write there counts. The local is untyped when any write is not a constant form (an
+      # op-write, a multiple assignment, `for` or `rescue =>` target, a pattern capture, any other value), when it is
+      # the receiver of `send` / `public_send` / `__send__` / `singleton_class` or is assigned to another local
+      # (`g = h`), and, for every local, when the body calls `binding`, `eval`, `instance_eval` or
+      # `local_variable_set` on any receiver, which can write a local no node names. A local whose object the syntax
+      # gives methods ({#local_object_opened?}) is untyped at that call. A per-def AST fact, memoised as {#def_census}.
+      def typed_local_forms(def_node, name)
+        def_census(:local_forms, def_node) { local_forms_of(def_node) }[name]
+      end
+
+      # True when the file's syntax gives the receiver local's object methods the declaration tables do not show
+      # (`def h.x`, `h.extend(M)`, `h.define_singleton_method`, `h.singleton_class...`, `class << h`, an
+      # `h.instance_eval` that defines): {Analysis::CheckRules::LexicalMethodSites}, asked once per def for every
+      # call on a local.
+      def local_object_opened?(def_node, call_node)
+        def_census(:opened_local_calls, def_node) { opened_local_call_offsets(def_node) }
+          .include?(call_node.location.start_offset)
+      end
+
+      def opened_local_call_offsets(def_node)
+        require_relative "../analysis/check_rules/lexical_method_sites"
+        sites = Analysis::CheckRules::LexicalMethodSites.new(def_node)
+        offsets = Set.new
+        Source::NodeWalker.each(def_node.body) do |node|
+          next unless node.is_a?(Prism::CallNode) && node.receiver.is_a?(Prism::LocalVariableReadNode)
+
+          offsets << node.location.start_offset if sites.singleton_local_def?(node)
+        end
+        offsets.freeze
+      end
+
+      DYNAMIC_LOCAL_CALLS = Set[:binding, :eval, :instance_eval, :local_variable_set].freeze
+      DISPATCHING_CALLS = Set[:send, :public_send, :__send__, :singleton_class].freeze
+      private_constant :DYNAMIC_LOCAL_CALLS, :DISPATCHING_CALLS
+
+      def local_forms_of(def_node)
+        forms = {}
+        tainted = Set.new
+        return NO_FORMS if collect_local_forms(def_node.body, forms, tainted)
+
+        params = def_node.parameters
+        forms.each_value(&:uniq!)
+        forms.delete_if do |name, values|
+          tainted.include?(name) || !values.all? { |value| constant_receiver_form?(value) } ||
+            parameter_named?(params, name)
+        end
+        forms.empty? ? NO_FORMS : forms
+      end
+
+      # Fills `forms` (`{ name => written values }`) and `tainted` from `node` and everything under it, a nested `def`
+      # body excepted (its locals are its own). True when the body may write locals the nodes do not show.
+      def collect_local_forms(node, forms, tainted)
+        return false if node.nil?
+
+        return false if node.is_a?(Prism::DefNode)
+        return true if node.is_a?(Prism::CallNode) && dynamic_local_call?(node, tainted)
+
+        note_local_write(node, forms, tainted)
+        dynamic = false
+        node.rigor_each_child { |child| dynamic = true if collect_local_forms(child, forms, tainted) }
+        dynamic
+      end
+
+      def note_local_write(node, forms, tainted)
+        case node
+        when Prism::LocalVariableWriteNode
+          (forms[node.name] ||= []) << node.value
+          tainted << node.value.name if node.value.is_a?(Prism::LocalVariableReadNode)
+        when Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode,
+             Prism::LocalVariableAndWriteNode, Prism::LocalVariableTargetNode
+          (forms[node.name] ||= []) << node
+        end
+      end
+
+      # True for a `binding` / `eval` / ... call on any receiver (`Kernel.binding` included), which can write a local no
+      # node names. A local receiving a dispatching call (`send`, `singleton_class`, ...) is tainted as a side effect.
+      def dynamic_local_call?(node, tainted)
+        return true if DYNAMIC_LOCAL_CALLS.include?(node.name)
+
+        tainted << node.receiver.name if DISPATCHING_CALLS.include?(node.name) &&
+                                         node.receiver.is_a?(Prism::LocalVariableReadNode)
+        false
+      end
+
+      NO_FORMS = {}.freeze
+      private_constant :NO_FORMS
+
+      def parameter_named?(params, name)
+        return false if params.nil?
+
+        all = [params.requireds, params.optionals, params.posts, params.keywords,
+               [params.rest, params.keyword_rest, params.block]]
+        all.flatten.compact.any? { |param| param.respond_to?(:name) && param.name == name }
+      end
+
+      # Issue #2515 — the `[def, 0, owner]` triples of every user instance def named `name`, for a hand-off on a
+      # receiver whose type the callee cannot know. It over-approximates (it favours flooring, ADR-5), as
+      # {#unrecorded_hand_off_callees} unions spellings. A def on a class nothing subclasses is walked under that
+      # class. A def on a module, or on a class a project class names as its superclass, is {FLOOR_ALL}: the real
+      # receiver may be an includer or a subclass whose overrides the walk would not see (ADR-127 WD4, as an inherited
+      # def, {#walked_owner}). A name no user def has (a core or gem method) contributes nothing; a name with more
+      # than {NAMED_HAND_OFF_CAP} defs answers {CAPPED_HAND_OFF}, which floors the handed parameter outright.
+      def named_instance_callees(name)
+        owners = instance_def_owners(name)
+        return NO_CALLEES if owners.empty?
+        return CAPPED_HAND_OFF if owners.size > NAMED_HAND_OFF_CAP
+
+        opaque = subclassing_opaque?
+        UnionCallees.new(owners.filter_map do |class_name, open|
+          found = scope.user_def_for(class_name, name)
+          next if found.nil?
+
+          [found, 0, open || opaque ? FLOOR_ALL : CalleeOwner.new(Type::Combinator.nominal_of(class_name))]
+        end)
+      end
+
+      # A resolution by name, whose candidates are guesses at the receiver: every edge it yields is an
+      # over-approximation ({CalleeMutationChain::Edge#approx}), as is any hand-off with more than one candidate.
+      class UnionCallees < Array; end
+      private_constant :UnionCallees
+
+      # The most defs one name may have for {#named_instance_callees} to walk them; more floors the parameter. A cap
+      # on the name key's fan-out that floors, not a cut of the walk, so ADR-127's rejection of out-degree caps does
+      # not apply: the answer stays a function of the graph node.
+      NAMED_HAND_OFF_CAP = 8
 
-        def_node = resolve_self_callee_def(call_node)
-        return NO_ARGUMENT_READS if def_node.nil?
+      # The answer for a name above the cap; {#compute_forwarding_edges} turns it into a floor of each handed
+      # parameter.
+      CAPPED_HAND_OFF = [[nil, 0, nil].freeze].freeze
+      private_constant :NAMED_HAND_OFF_CAP, :CAPPED_HAND_OFF
 
-        mutated = callee_content_mutated_parameters(def_node)
+      # The `[class, open]` owners of `name` ({Scope#user_instance_def_owners}). A function of the discovery and the
+      # name alone, so its run-scoped memo is keyed by both; the answer reads no constant and no narrowing, so
+      # {#hand_off_memo_bypassed?} does not bypass it. A hit does not reach the scope, so a dependency recorder is told
+      # of the reads here. Built per name, not as a whole index: a run holds a discovery per file, and a whole-index
+      # build per file cost more than the walks it served.
+      def instance_def_owners(name)
+        return scope.user_instance_def_owners(name) if MemoAudit.suspended?
+
+        table = typing_state.weak_key_map(INSTANCE_DEF_INDEX)
+        by_name = (table[scope.discovery] ||= {})
+        unless by_name.key?(name)
+          return by_name[name] = MemoAudit.key_audit("instance def owners") { scope.user_instance_def_owners(name) }
+        end
+
+        record_instance_def_owner_reads(name, by_name[name]) if Analysis::DependencyRecorder.active?
+        MemoAudit.check("instance def owners", by_name[name], name) { scope.user_instance_def_owners(name) }
+      end
+
+      # {Scope#subclassing_opacity}'s flag, memoised beside the owners per discovery; a recorder is told its keys on
+      # every call, hit or not.
+      def subclassing_opaque?
+        return scope.subclassing_opacity.first if MemoAudit.suspended?
+
+        table = typing_state.weak_key_map(INSTANCE_DEF_INDEX)
+        by_name = (table[scope.discovery] ||= {})
+        entry = by_name[OPACITY_ENTRY] ||= MemoAudit.key_audit("subclassing opacity") { scope.subclassing_opacity }
+        Analysis::DependencyRecorder.read_keys(entry.last) if Analysis::DependencyRecorder.active?
+        MemoAudit.check("subclassing opacity", entry, OPACITY_ENTRY) { scope.subclassing_opacity }.first
+      end
+
+      OPACITY_ENTRY = :"<subclassing-opacity>"
+      private_constant :OPACITY_ENTRY
+
+      def record_instance_def_owner_reads(name, owners)
+        Analysis::DependencyRecorder.read_name(:defines, name)
+        owners.map(&:first).each { |owner| Analysis::DependencyRecorder.read_last_segment(:subclass_of, owner) }
+      end
+
+      INSTANCE_DEF_INDEX = TypingState.memo(
+        :callee_instance_def_index,
+        run_scoped: true, audit: ["instance def owners", "subclassing opacity"],
+        reason: "keyed by discovery and name, all its answer reads"
+      )
+      private_constant :INSTANCE_DEF_INDEX
+
+      def constant_node?(node) = node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+
+      # `census` (a `callee_*_mutated_parameters` name) of `def_node`, read through `owner`, the {CalleeOwner} the
+      # callee's hand-offs resolve in, or this evaluator when the callee is a self-call's.
+      def census_of(owner, census, def_node)
+        return floor_all_census(census, def_node) if owner == FLOOR_ALL
+        return floor_every_census(census) if owner == FLOOR_EVERY
+
+        (owner.nil? ? self : owner_evaluator(owner)).__send__(census, def_node)
+      end
+
+      # The {FLOOR_EVERY} answer: every positional and keyword argument mutated, no hand-offs.
+      def floor_every_census(census)
+        BudgetTrace.hit(BudgetTrace::CALLEE_CHAIN_CAP)
+        census == :forwarding_edges ? NO_FORWARDS : EVERY_ARGUMENT
+      end
+
+      # The {FLOOR_ALL} answer: every content parameter mutated, and (issue #2595) a named rest or keyword rest at
+      # {ANY_SLOT} / {ANY_KEYWORD} ({#forwarding_slots}), no hand-offs.
+      def floor_all_census(census, def_node)
+        BudgetTrace.hit(BudgetTrace::CALLEE_CHAIN_CAP)
+        census == :forwarding_edges ? NO_FORWARDS : forwarding_slots(def_node)
+      end
+
+      # The local-variable reads `call_node` passes to the parameters of `mutated`, a `{ name => slot }` census, the
+      # first `offset` arguments not being the callee's (the `:name` of a `send` hand-off, {#resolve_self_callees}).
+      def arguments_for_slots(call_node, mutated, offset)
         return NO_ARGUMENT_READS if mutated.empty?
 
         argument_nodes = call_node.arguments.arguments
-        mutated.values.uniq.filter_map do |slot|
-          argument = slot.is_a?(Symbol) ? keyword_argument(argument_nodes, slot) : argument_nodes[slot]
+        values = mutated.values.uniq
+        reads = values.filter_map do |slot|
+          next if slot == ANY_SLOT || slot == ANY_KEYWORD || (slot.is_a?(Integer) && (slot + offset).negative?)
+
+          argument = slot.is_a?(Symbol) ? keyword_argument(argument_nodes, slot) : argument_nodes[slot + offset]
           argument = argument.value if argument.is_a?(Prism::ImplicitNode)
           argument if argument.is_a?(Prism::LocalVariableReadNode)
         end
+        reads += rest_arguments(argument_nodes, offset) if values.include?(ANY_SLOT)
+        reads += keyword_rest_arguments(argument_nodes) if values.include?(ANY_KEYWORD)
+        reads.uniq
+      end
+
+      # Every local read passed positionally from `offset` on: what a callee that hands its rest parameter to `super`
+      # may mutate ({#super_forwarded_parameters}).
+      def rest_arguments(argument_nodes, offset)
+        argument_nodes.drop([offset, 0].max).grep(Prism::LocalVariableReadNode)
+      end
+
+      # Every local read passed as a keyword value: what a callee that hands its keyword rest parameter to `super` may
+      # mutate ({#super_forwarded_parameters}).
+      def keyword_rest_arguments(argument_nodes)
+        hash = argument_nodes.last
+        return NO_ARGUMENT_READS unless hash.is_a?(Prism::KeywordHashNode)
+
+        hash.elements.filter_map do |pair|
+          value = pair.value if pair.is_a?(Prism::AssocNode)
+          value = value.value if value.is_a?(Prism::ImplicitNode)
+          value if value.is_a?(Prism::LocalVariableReadNode)
+        end
       end
 
+      # The slot {#super_forwarded_parameters} gives a keyword rest parameter: every keyword value of the call.
+      ANY_KEYWORD = :__any_keyword__
+      private_constant :ANY_KEYWORD
+
       # The value `argument_nodes` pass for the keyword `name` (`poke(acc: a)`), or nil.
       def keyword_argument(argument_nodes, name)
         hash = argument_nodes.last
@@ -585,20 +1300,48 @@ module Rigor
       # evaluator's statement and write-back passes ({#with_repeated_or_write_marks}), type every run of a repeating
       # body from one entry scope, so its slot's gradual type may be what an EARLIER run stored rather than an
       # absence of evidence.
+      #
+      # On a receiver that is itself untracked (a `Dynamic` / `Top` constituent, the #544 test the narrowing
+      # record takes: a parameter, an unbound ivar), the slot may hold what an earlier call stored, so the reading
+      # keeps the rvalue only as far as its class is known ({#untracked_memo_value}, #2292): read as the fresh
+      # literal, `(h[k] ||= {})[:name].upcase` reported a call on `nil` and `(h[k] ||= 1).upcase` one on `1`. A
+      # tracked receiver keeps the literal, so a block fold over a captured `pool = {}`, whose in-place widening
+      # reads `Hash[Dynamic[top], Dynamic[top]]`, still answers `find { |s| (pool[s] ||= s) == "b" }` as `"b"`.
       def index_compound_write_value(node)
         return index_write_stored_type(node, scope) unless node.is_a?(Prism::IndexOrWriteNode)
 
         current = index_read_type(node, scope)
         rhs = scope.type_of(node.value, tracer: tracer)
-        return rhs if memoizing_index_read?(node, current, rhs)
+        if memoizing_index_read?(node, current, rhs)
+          return rhs if tracked_memo_receiver?(node.receiver)
+
+          memo = untracked_memo_value(rhs)
+          return memo if memo
+        end
 
         index_write_stored_type(node, scope, current: current, rhs: rhs)
       end
 
+      # The value of `recv.each_with_object(memo) { |x, acc| … }` given `call_type`, the call's dispatched type
+      # (issue #2411): the memo as the block's content mutations of `acc` leave it ({#each_with_object_return}).
+      # `ExpressionTyper` reads it for every call, so a value position — a method's tail, which
+      # {DefReturnTyper} types through `Scope#type_of` — answers what a statement does; read off the dispatch
+      # alone, `def m = xs.each_with_object({}) { |x, h| h[x] = 1 }` returned the memo argument's `{}`.
+      def each_with_object_value(call_node, call_type)
+        each_with_object_return(call_node, call_type)
+      end
+
       private
 
       attr_reader :scope, :tracer
 
+      # ADR-129 WD2 — the calling thread's {TypingState::State}, cached on the evaluator the first time a slot is read.
+      # An evaluator kept across threads must be kept per state instead ({ExpressionTyper#typing_state}). A frame
+      # install whose block's value is the answer calls {TypingState.current} instead: Rigor's own analysis does not
+      # adopt this memoised reader's type at a self-call (#525's self-purity), so the install's answer would read as
+      # `Dynamic` through it.
+      def typing_state = @typing_state ||= TypingState.current
+
       # Thread the scope through every child statement in declaration order. The body's value is the type of the last
       # statement (or `Constant[nil]` for an empty body); intermediate statements' types are discarded, but their scope
       # effects are preserved.
@@ -608,7 +1351,7 @@ module Rigor
       def eval_statements(node)
         result_type = Type::Combinator.constant_of(nil)
         current = scope
-        raising = Thread.current[RETRY_FRAMES_KEY]
+        raising = typing_state[RETRY_FRAMES]
         node.body.each do |stmt|
           result_type, current = sub_eval(stmt, current)
           record_raise_points(raising, stmt, current) if raising
@@ -626,11 +1369,11 @@ module Rigor
       end
 
       # `name = rvalue` evaluates the rvalue under the entry scope (so earlier assignments in a chained `a = b = expr`
-      # propagate left-to-right) and binds `name` to the result type. Compound assignment forms (`+=` etc.) are deferred
-      # to a follow-up; for now they degrade to "type the rhs, do not rebind" via the default branch in {#evaluate}.
+      # propagate left-to-right) and binds `name` to the result type.
       def eval_local_write(node)
         rhs_type, post_rhs = sub_eval(node.value, scope)
         bound = bind_local_write(node, rhs_type, post_rhs)
+        bound = bound.with_construction_fact(node.name, :synthesised) if synthesised_write?(node, rhs_type)
         # Issue #667 — `m = AppConfig::MODE` makes `m` a copy of a constant the reader's file does not
         # declare, so `m == :production` folding to `true` is the project's configuration and not a logic
         # error the author can see. Stamped LAST, across every binding path above: an RHS can be both an
@@ -641,6 +1384,53 @@ module Rigor
         [rhs_type, bound.with_published_constant_mark(:local, node.name)]
       end
 
+      # Issue #2555 L3 — whether the object a local write binds is one the engine built itself, so the binding
+      # carries the `:synthesised` construction fact ({Scope#construction_fact?}): a collection literal (`[...]`,
+      # `{...}`), or a constructor call on the core class (`Array.new(n, 0)`, `Hash.new(0)`, `Set.new(xs)`,
+      # `Set[1]`) whose value is a carrier of that class. Nothing else is stamped: not a copy of another binding
+      # (`b = a`), a call whose return a signature declares, a parameter, or an instance variable.
+      # The fact is withheld from a local that may escape anywhere in the body ({ConstructionEscape}): a store through
+      # another holder of the object is one no seam sees, and the fact would leave the carrier without the floor that
+      # covered it.
+      def synthesised_write?(node, rhs_type)
+        synthesised_construction?(node.value, rhs_type) &&
+          !ConstructionEscape.escaped?(scope.match_frame&.body, node.name, constructed_carrier_class(rhs_type), scope)
+      end
+
+      def synthesised_construction?(value_node, rhs_type)
+        case value_node
+        when Prism::ArrayNode, Prism::HashNode then true
+        when Prism::CallNode then core_constructor_call?(value_node, rhs_type)
+        else false
+        end
+      end
+
+      CORE_CONSTRUCTOR_NAMES = %i[new []].to_set.freeze
+      private_constant :CORE_CONSTRUCTOR_NAMES
+
+      # The constant receiver must resolve to the core class itself (a project's own `Admin::Set` does not), and the
+      # value must be a carrier of that class.
+      def core_constructor_call?(call, rhs_type)
+        receiver = call.receiver
+        return false unless CORE_CONSTRUCTOR_NAMES.include?(call.name)
+        return false unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+
+        class_name = constructed_carrier_class(rhs_type)
+        return false if class_name.nil?
+
+        receiver_type = scope.type_of(receiver, tracer: tracer)
+        receiver_type.is_a?(Type::Singleton) && receiver_type.class_name == class_name
+      end
+
+      def constructed_carrier_class(type)
+        case type
+        when Type::Tuple then "Array"
+        when Type::HashShape then "Hash"
+        when Type::Nominal then type.class_name if %w[Array Hash Set].include?(type.class_name)
+        when Type::Constant then "Set" if type.value.is_a?(::Set)
+        end
+      end
+
       # The binding half of {#eval_local_write}: the three mutually exclusive provenance paths a local write
       # can take, unchanged from when they were inline.
       def bind_local_write(node, rhs_type, post_rhs)
@@ -710,7 +1500,7 @@ module Rigor
       def rhs_origin(value_node, scope_after_rhs, rhs_type)
         return nil unless rhs_type.is_a?(Type::Dynamic)
 
-        scope_after_rhs.dynamic_origins[value_node]
+        scope_after_rhs.dynamic_origin(value_node)
       end
 
       # The scope binding the written local with ADR-58's `:local` mark when the write copies a declaration-sourced
@@ -740,8 +1530,7 @@ module Rigor
       # Slice 7 phase 1 — instance/class/global variable writes. Each handler evaluates the rvalue under the entry scope
       # and binds the named variable into the post-scope's per-kind binding map. The expression value is the rvalue
       # type, matching Ruby's semantics. Bindings are method-local: a fresh scope is built at every `def` entry through
-      # `build_method_entry_scope`, so writes do not leak across method boundaries until cross-method ivar/cvar tracking
-      # lands.
+      # `build_method_entry_scope`; cross-method ivar and cvar state enters it through the class-level seeds.
       def eval_ivar_write(node)
         rhs_type, post_rhs = sub_eval(node.value, scope)
         # Issue #1446 — a write ends a class guard's narrowing of the variable, as it does a global's.
@@ -980,13 +1769,13 @@ module Rigor
       #    narrowing keyed on `(receiver_kind, receiver_name,
       #    literal_key)` when both receiver and key are stable
       #    (see {Inference::IndexedNarrowing}). Unstable shapes
-      #    fall through to "no scope effect", matching the old
-      #    `Prism::IndexOrWriteNode` default-branch behaviour.
+      #    record no narrowing.
       #
       # The expression value is the result type, matching Ruby's semantics: `(x = params[:f] ||= []); x` observes the
       # post-`||=` value, not the rvalue alone.
       def eval_index_or_write(node)
-        _rhs_type, post_rhs = sub_eval(node.value, scope)
+        operands = index_write_operand_scope(node)
+        _rhs_type, post_rhs = sub_eval(node.value, operands)
         result_type = index_write_stored_type(node, scope)
 
         # A narrowing is keyed on ONE literal slot — `a[k]` — but a multi-index `||=` reads and
@@ -994,8 +1783,7 @@ module Rigor
         # record `a[0]`'s type as the region answer: `a[0, 1] ||= []` would claim `a[0]` non-nil
         # where the store splices nothing and `a[0]` stays nil at runtime. Decline the record for
         # any form but the single-index one.
-        key_node = single_index_argument(node)
-        address = key_node && IndexedNarrowing.stable_address(node.receiver, key_node)
+        address = recordable_slot_address(node)
         # Issue #544 — a receiver with an untracked (Dynamic / Top) constituent can hold a caller-supplied
         # slot value the `||=` keeps, so the recorded default would invent a fact; decline the record.
         address = nil if address && !IndexedNarrowing.fully_tracked_receiver_type?(scope.type_of(node.receiver))
@@ -1004,7 +1792,9 @@ module Rigor
         # the reverse order would trade this feature away for the widening. The two are complementary — the shape
         # forgets that the collection is still empty, the narrowing remembers that THIS slot is now non-nil.
         post = IndexWriteWidening.widen(node: node, current_scope: post,
-                                        arg_types: index_write_arg_types(node, result_type))
+                                        arg_types: index_write_arg_types(node, result_type, join_scope: operands))
+        # Issue #1218 — a key that is not a literal (`h[k] ||= v`) may name a slot another `||=` narrowed.
+        post = IndexedNarrowing.invalidate_indexed_write(node, post)
         post = post.with_indexed_narrowing(*address, result_type) if address
 
         # The value the expression yields takes the memoizing reading ({#index_compound_write_value}, #1155) for a
@@ -1029,6 +1819,29 @@ module Rigor
         erased || stored
       end
 
+      # The memoizing value on an untracked receiver, or nil when it keeps the stored `Dynamic[top] | v`. A `{}` /
+      # `[]` rvalue (a shape, a tuple, a bare `Hash` / `Array`) erases to `Hash[untyped, untyped]` /
+      # `Array[untyped]`, since the table is not empty after the first store. A construction (a nominal,
+      # parameterised or not, or a `Data` / `Struct` instance, possibly with a `nil` / `false` arm) is kept as the
+      # #1155 reading has it. Anything else carries literal precision (`1`, `:a`, an integer range) and yields nil.
+      def untracked_memo_value(rhs)
+        erased = erase_memo_literal(rhs)
+        return erased if erased
+
+        truthy = Narrowing.narrow_truthy(rhs)
+        members = truthy.is_a?(Type::Union) ? truthy.members : [truthy]
+        rhs if members.all? { |member| MEMO_CONSTRUCTIONS.any? { |klass| member.is_a?(klass) } }
+      end
+
+      MEMO_CONSTRUCTIONS = [Type::Nominal, Type::DataInstance, Type::StructInstance, Type::Dynamic, Type::Top].freeze
+      private_constant :MEMO_CONSTRUCTIONS
+
+      def erase_memo_literal(type)
+        return erase_memo_container(type) unless type.is_a?(Type::Nominal)
+
+        erase_memo_container(type) if type.type_args.empty? && %w[Hash Array].include?(type.class_name)
+      end
+
       def erase_memo_container(type)
         any = Type::Combinator.untyped
         case type
@@ -1047,14 +1860,76 @@ module Rigor
       # expression, scope untouched — and the receiver never widened. They store through `[]=` exactly as
       # `eval_index_or_write` does, so they take the same widening; the stored value is the compound result —
       # `falsey(h[k]) | v` for `&&=`, the dispatched `h[k] + v` for `+=` — not the rvalue alone.
+      #
+      # Issue #1218 — the widening carries the receiver's slot narrowings across its rebind
+      # ({MutationRejoin.carry_slot_narrowings}), so a `h[:e] ||= 0` narrowing outlived `h[:e] += 1` and the slot
+      # kept reading `0`. The store drops the narrowing on the slot it overwrote, as a `[]=` call does
+      # ({IndexedNarrowing.invalidate_indexed_write}: every narrowing on the receiver when the index is not one
+      # literal key). A slot that held a narrowing then records the value the write stored, which the read it
+      # performed took from that narrowing; a slot with none records nothing new.
       def eval_index_write(node)
-        _rhs_type, post_rhs = sub_eval(node.value, scope)
+        operands = index_write_operand_scope(node)
+        _rhs_type, post_rhs = sub_eval(node.value, operands)
         stored = index_write_stored_type(node, scope)
         widened = IndexWriteWidening.widen(node: node, current_scope: post_rhs,
-                                           arg_types: index_write_arg_types(node, stored))
+                                           arg_types: index_write_arg_types(node, stored, join_scope: operands))
+        widened = IndexedNarrowing.invalidate_indexed_write(node, widened)
+        address = recordable_slot_address(node)
+        widened = widened.with_indexed_narrowing(*address, stored) if address && scope.indexed_narrowing(*address)
         [stored, forget_rebound_specials(widened, node)]
       end
 
+      # The `(receiver, key)` slot a compound index write may record its stored value on, or nil. A narrowing is
+      # keyed on ONE literal slot, so a multi-index form, which reads and stores a splice region, records none. The
+      # receiver's `[]=` must leave the stored value at that slot ({IndexedNarrowing.verbatim_slot?}: a `Hash` or
+      # `Array`, and no negative index on an `Array`), and the rvalue must not rebind the receiver variable
+      # ({#rvalue_rebinds_receiver?}), since the store went to the object it named before (issue #1218).
+      def recordable_slot_address(node)
+        key_node = single_index_argument(node)
+        address = key_node && IndexedNarrowing.stable_address(node.receiver, key_node)
+        return nil if address.nil?
+        return nil unless IndexedNarrowing.verbatim_slot?(scope.type_of(node.receiver, tracer: tracer), address.last)
+        return nil if rvalue_rebinds_receiver?(node)
+
+        address
+      end
+
+      # Whether a compound index write's rvalue may rebind its stable receiver variable: it writes the variable
+      # (`h[k] += (h = {}; 1)`, `@h ||= …`, a multiple-assignment target, in a block too:
+      # {OperandEffects.written_variables}), or, for an instance variable, the intervening-call reset past the
+      # rvalue's self calls rebinds it ({InterveningIvarReset.after_operand}). That reset widens only a binding
+      # narrower than the class-ivar seed, and only for a call not proven to leave it alone, so
+      # `@h = { k: nil }; @h[:k] += (reset; 1)` with a `reset` that assigns `@h` is a rebind, and `@t[:k] ||=
+      # compute(1)` on a `@t` the class binds to one shape is not. A store into another slot of the receiver
+      # (`h[:a] ||= (h[:b] ||= [])`) is no rebind either.
+      def rvalue_rebinds_receiver?(node)
+        receiver = node.receiver
+        name = receiver.name
+        return true if OperandEffects.written_variables(node.value).include?(name)
+        return false unless receiver.is_a?(Prism::InstanceVariableReadNode)
+
+        !InterveningIvarReset.after_operand(node.value, scope).ivar(name).equal?(scope.ivar(name))
+      end
+
+      # The scope a compound index write's rvalue runs from: Ruby evaluates the receiver, then the index arguments,
+      # then the rvalue, so a write in either is threaded in that order ({#thread_operand}) before the rvalue. An
+      # index write takes no block-pass argument (a syntax error since Ruby 3.4).
+      #
+      # Issue #1272 — `(h ||= {})[k] ||= v`, `(@h ||= {})[k] ||= v` and `h[(i = 1)] ||= v` left `h`, `@h` and `i`
+      # on their pre-write bindings, so a later `h.fetch(k)` on a nil-initialised `h` reported a call on `nil`. A
+      # receiver or argument holding no write answers the entry scope unchanged.
+      #
+      # The receiver's joinability is read from this scope ({#index_write_arg_types}' `join_scope`), since the
+      # binding the store widens is the one the receiver's write left (`h` is `{}`, not the entry's `nil`). The read,
+      # the stored value and the widening's argument types are still typed from the entry scope (TODO #3100): the
+      # receiver expression's own value (`(h ||= {})` is the hash) answers what its write produced, but an rvalue
+      # reading a variable an index argument writes (`h[(i = 1)] ||= i + 1`) is typed at its pre-write binding.
+      def index_write_operand_scope(node)
+        walk = OperandWalk.new(walk_recorder)
+        after = thread_operand(node.receiver, scope, walk, scope)
+        thread_operand(node.arguments, after, walk, scope)
+      end
+
       # `[index_type..., stored_value_type]` for an index-write node, shaped exactly like a `[]=`
       # call's argument list so the widening seam can join it the same way (issue #560) — a
       # two-index compound write (`a[0, 1] += v`) keeps BOTH index arguments ahead of the stored
@@ -1068,15 +1943,16 @@ module Rigor
       # The index arguments are typed, and the receiver's joinability read, in `type_scope`: the
       # evaluator's entry scope by default; a `for` index passes its post-collection scope and a
       # rescue reference its arm's entry scope, the nearest the engine has to where Ruby evaluates
-      # them (each iteration, the moment of the catch).
+      # them (each iteration, the moment of the catch). A compound index write reads the joinability alone in
+      # `join_scope`, the scope its receiver and index arguments left ({#index_write_operand_scope}).
       # There is deliberately NO `rescue` here. `Scope#type_of` is a total query over well-formed Prism input,
       # so a raise is an engine bug, and swallowing it would silently downgrade a live seam to "no evidence" —
       # the join would quietly stop happening with nothing to show for it. Let it reach the runner's
       # internal-error path, where it is visible.
-      def index_write_arg_types(node, stored_type, type_scope: scope)
+      def index_write_arg_types(node, stored_type, type_scope: scope, join_scope: type_scope)
         args = node.arguments
         return MutationWidening::NO_ARG_TYPES if args.nil? || stored_type.nil?
-        return MutationWidening::NO_ARG_TYPES unless MutationWidening.joinable_receiver?(node.receiver, type_scope)
+        return MutationWidening::NO_ARG_TYPES unless MutationWidening.joinable_receiver?(node.receiver, join_scope)
 
         list = args.respond_to?(:arguments) ? args.arguments : args
         # A splat argument is marked `nil` — its expansion decides the store's arity at
@@ -1113,6 +1989,28 @@ module Rigor
         end
       end
 
+      # Whether a memoizing `||=` on `receiver` reads as the fresh rvalue ({#index_compound_write_value}): the
+      # receiver's type passes the #544 test, and the receiver is a local the current body binds, captured into a
+      # block or not, and no parameter of the enclosing method names ({MatchRebinding::Frame#body_local?}), or
+      # an object fresh at every run (`Hash.new`, {RepeatedOrWrites.fresh_object?}) (issue
+      # #2354). An ivar, cvar or global read, a parameter, or any other expression (a call result, a
+      # parenthesised `||=`) is a table whose gradual slot another call, or an earlier run of this one, may have
+      # filled — an ivar seeded `{}` in `initialize`, a parameter declared `Hash[Symbol, untyped]` — so it widens
+      # through {#untracked_memo_value} like an untracked receiver. Without a frame (no method, class or file
+      # body stamped one) a local receiver is treated as body-bound, as before #2354.
+      def tracked_memo_receiver?(receiver)
+        return false unless body_bound_memo_receiver?(receiver)
+
+        IndexedNarrowing.fully_tracked_receiver_type?(scope.type_of(receiver, tracer: tracer))
+      end
+
+      def body_bound_memo_receiver?(receiver)
+        return RepeatedOrWrites.fresh_object?(receiver) unless receiver.is_a?(Prism::LocalVariableReadNode)
+
+        frame = scope.match_frame
+        frame.nil? || frame.body_local?(receiver.name)
+      end
+
       # True when {#index_compound_write_value} reads the `||=` `node` as the memoization idiom's rvalue: the slot
       # reads wholly gradual, the rvalue can store something truthy, and no block-return pass marked the site.
       def memoizing_index_read?(node, current, rhs)
@@ -1160,29 +2058,113 @@ module Rigor
       # Both mutator-receiver widenings, against one typing of the call's arguments: the bindings the
       # receiver NAMES ({MutationWidening.widen_after_call}) and, when it names none because the
       # receiver is an element read into a local, that element's pin inside its container
-      # ({ElementReadWidening.widen_element_read}, issue #643).
-      def widen_mutated_receivers(call_node, current_scope)
+      # ({ElementReadWidening.widen_element_read}, issue #643) — and, issue #2499, the String a stdlib
+      # out-buffer call fills ({OutBufferMutation}), which names no receiver of the call at all.
+      #
+      # Issue #2335 — a literal-symbol `send` (`a.send(:push, x)`) widens as the call it makes, and a mutation through a
+      # receiver that may be another local's object floors every local whose object another holder may reach
+      # ({AliasMutationFloor}).
+      def widen_mutated_receivers(node, current_scope)
+        call_node = AliasMutationFloor.literal_send_target(node) || node
         arg_types = mutator_arg_types(call_node, current_scope)
         widened = MutationWidening.widen_after_call(call_node: call_node, current_scope: current_scope,
-                                                    arg_types: arg_types)
-        ElementReadWidening.widen_element_read(call_node: call_node, current_scope: widened, arg_types: arg_types)
+                                                    arg_types: arg_types,
+                                                    rewritten_element: rewritten_element(call_node, current_scope))
+        widened = ElementReadWidening.widen_element_read(call_node: call_node, current_scope: widened,
+                                                         arg_types: arg_types)
+        if AliasMutationFloor.candidate?(call_node)
+          widened = AliasMutationFloor.floor_after_call(call_node, widened) do
+            named_receiver_locals(call_node.receiver)
+          end
+        end
+        # Issue #2499 — a stdlib call that fills a String argument (`io.read(n, buf)`, `StringIO.new(s)`).
+        floor_ivar_mutating_callee(node, OutBufferMutation.floor(call_node, widened))
       end
 
-      # `tr!` / `tr_s!` are typed too: whether they can empty a `non-empty-string` turns on their replacement argument.
-      def mutator_arg_types(call_node, current_scope)
-        unless ContentJoin::CONTENT_ADDERS.include?(call_node.name) || StringMutation::TRANSLATORS.include?(call_node.name)
-          return MutationWidening::NO_ARG_TYPES
-        end
-        unless MutationWidening.joinable_receiver?(call_node.receiver, current_scope) ||
-               ElementReadWidening.joinable_element_read?(call_node.receiver, current_scope)
-          return MutationWidening::NO_ARG_TYPES
+      # Issue #2335 — a call on a local that may hold another local's object (`box = Box.new(a)`) to a project method
+      # that mutates one of its instance variables (`def add(v) = @items << v`) may mutate that object: every local
+      # whose object another holder may reach takes one unknown store ({AliasMutationFloor.floor_after_written_local}).
+      def floor_ivar_mutating_callee(call_node, current_scope)
+        receiver = call_node.receiver
+        return current_scope if MutationWidening::SHAPE_MUTATORS.include?(call_node.name) || send_hand_off?(call_node)
+        return floor_self_ivar_callee(call_node, current_scope) if self_dispatch_call?(call_node)
+        return current_scope unless receiver.is_a?(Prism::LocalVariableReadNode)
+        return current_scope unless callee_bearing?(current_scope.local(receiver.name))
+        return current_scope unless AliasMutationFloor.reaches_other_locals?(current_scope, receiver, call_node)
+
+        callees = receiver_callees_in(scope, call_node)
+        return current_scope unless callees.any? { |def_node, _, _| AliasMutationFloor.mutates_ivar?(def_node) }
+
+        AliasMutationFloor.floor_after_written_local(current_scope, receiver, call_node)
+      end
+
+      # The same for a call on `self` (`push_it(v)`, `self.push_it(v)`): its ivars hold whatever locals were handed to
+      # them (`@items = a`, `a = @q`), so every aliased local holding a literal shape takes one unknown store.
+      def floor_self_ivar_callee(call_node, current_scope)
+        return current_scope unless AliasMutationFloor.holder_call_reaches?(current_scope, call_node)
+        return current_scope unless resolve_self_callees(call_node).any? do |def_node, _, _|
+          AliasMutationFloor.mutates_ivar?(def_node)
         end
 
-        content_arg_types(call_node, operand_scope, @operand_types)
+        AliasMutationFloor.floor_after_holder_call(current_scope, call_node)
       end
 
-      # The index node of an index-write when it holds exactly one index argument — the only form
-      # whose stored value lands on a nameable slot (`a[k]`). Multi-index forms address a splice
+      # A binding `receiver_callees_in` can resolve a project def on: a class or instance type, or a union of them. Any
+      # other binding resolves none, so the floor skips the resolution for it.
+      def callee_bearing?(type) = type.is_a?(Type::Nominal) || type.is_a?(Type::Singleton) || type.is_a?(Type::Union)
+
+      # The locals a mutator's receiver names ({ReceiverAlias.mutated_reads}), which the named path widens, and the
+      # root of an element read (`c[0].shift`), whose element {ElementReadWidening} widens.
+      def named_receiver_locals(receiver)
+        return nil if receiver.nil?
+        return receiver.name if receiver.is_a?(Prism::LocalVariableReadNode)
+
+        names = ReceiverAlias.mutated_reads(receiver).filter_map do |read|
+          ReceiverAlias.read_name(read) if read.is_a?(Prism::LocalVariableReadNode)
+        end
+        root = ElementReadWidening.element_read_path(receiver)&.first
+        root ? names << root.name : names
+      end
+
+      # Issue #2427 — the element an element rewriter (`map!`, `collect!`, `flatten!`) leaves in its receiver, read
+      # off what the non-bang counterpart answers for the same receiver, block and arguments
+      # ({RewriteMutation::TYPED_COUNTERPARTS}): `a.map!(&:to_i)` stores what `a.map(&:to_i)` returns. `nil` when the
+      # call is no such rewriter, or the counterpart has no single element; the widening then takes
+      # {RewriteMutation}'s gradual arm.
+      #
+      # `nil` too when the receiver may name more than one binding (`(flag ? a : b).map!(&:to_i)`): Ruby rewrites
+      # only the one the branch selects, and typing every candidate gave the other one an element it never holds.
+      #
+      # The block and receiver gates only save typing a counterpart nothing consumes: with no block `map` answers an
+      # Enumerator, which has no element to read, and {RewriteMutation.typed} answers nothing for a receiver the
+      # widening does not rewrite.
+      def rewritten_element(call_node, current_scope)
+        counterpart = RewriteMutation::TYPED_COUNTERPARTS[call_node.name]
+        return nil if counterpart.nil?
+        return nil if counterpart != :flatten && call_node.block.nil? # cost guard
+        return nil unless MutationWidening.joinable_receiver?(call_node.receiver, current_scope) # cost guard
+        return nil unless ReceiverAlias.mutated_reads(call_node.receiver).size == 1
+
+        RewriteMutation.counterpart_element(operand_scope.type_of(call_node.copy(name: counterpart)))
+      end
+
+      # `tr!` / `tr_s!` are typed too: whether they can empty a `non-empty-string` turns on their replacement argument.
+      def mutator_arg_types(call_node, current_scope)
+        name = call_node.name
+        unless ContentJoin::CONTENT_ADDERS.include?(name) || StringMutation::TRANSLATORS.include?(name) ||
+               SetMutation::CONTENT_ADDERS.include?(name)
+          return MutationWidening::NO_ARG_TYPES
+        end
+        unless MutationWidening.joinable_receiver?(call_node.receiver, current_scope) ||
+               ElementReadWidening.joinable_element_read?(call_node.receiver, current_scope)
+          return MutationWidening::NO_ARG_TYPES
+        end
+
+        content_arg_types(call_node, operand_scope, @operand_types)
+      end
+
+      # The index node of an index-write when it holds exactly one index argument — the only form
+      # whose stored value lands on a nameable slot (`a[k]`). Multi-index forms address a splice
       # region and answer `nil`.
       def single_index_argument(node)
         args = node.arguments
@@ -1250,14 +2232,17 @@ module Rigor
         [scope.type_of(node, tracer: tracer), forget_rebound_specials(widened, node)]
       end
 
-      # The scope effect of calling the writer `writer` on `receiver` outside a `CallNode`: the receiver widening, and
-      # the receiver-wide drop of recorded `receiver[key]` narrowings `IndexedNarrowing` makes after a mutator call.
+      # The scope effect of calling the writer `writer` on `receiver` outside a `CallNode`: the receiver widening, the
+      # drop of every method-chain narrowing rooted at the receiver that `eval_call` makes after any call on it (issue
+      # #2693: `x.r ||= v`, `x.r, y = …` and `for x.r in …` call `r=`), and the receiver-wide drop of recorded
+      # `receiver[key]` narrowings `IndexedNarrowing` makes after a mutator call.
       def widen_attribute_write(receiver, writer, current_scope)
         widened = MutationWidening.widen_receiver_aliases(receiver, writer, current_scope)
         stable = IndexedNarrowing.stable_receiver(receiver)
-        return widened unless stable && IndexedNarrowing.mutator?(writer)
+        return widened unless stable
 
-        widened.without_indexed_narrowings_for(*stable)
+        widened = widened.without_method_chain_narrowings_for(*stable)
+        IndexedNarrowing.mutator?(writer) ? widened.without_indexed_narrowings_for(*stable) : widened
       end
 
       # The attribute targets of a multi-write (`h.default, x = 0, 1`), nested ones included, each widening its
@@ -1337,11 +2322,7 @@ module Rigor
         return [Type::Combinator.union(then_type, else_type), then_scope] \
           if branch_terminates?(node.subsequent, else_type) && node.statements
 
-        [
-          Type::Combinator.union(then_type, else_type),
-          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
-                              [node.statements, node.subsequent])
-        ]
+        if_join(node.statements, node.subsequent, [then_type, then_scope], [else_type, else_scope], post_pred)
       end
 
       # `unless pred; t; else; e; end`. Same shape as `if`, but Prism exposes the else-branch as `else_clause` (no elsif
@@ -1373,11 +2354,22 @@ module Rigor
         return [Type::Combinator.union(then_type, else_type), then_scope] \
           if branch_terminates?(node.else_clause, else_type) && node.statements
 
-        [
-          Type::Combinator.union(then_type, else_type),
-          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
-                              [node.statements, node.else_clause])
-        ]
+        if_join(node.statements, node.else_clause, [then_type, then_scope], [else_type, else_scope], post_pred)
+      end
+
+      # The `[type, post_scope]` an `if` / `unless` with both branches evaluated ends with, once the arms above found no
+      # terminating branch by {#branch_terminates?}.
+      #
+      # Issue #1230 — the then-body (`then_node`) certainly exits beside an else (`else_node`): the only surviving path
+      # is the else that RAN, so the continuation is the else's exit scope, the predicate's other edge PLUS the else's
+      # writes, not a join with the exited body's writes. {#branch_certainly_exits?} is stricter than
+      # {#branch_terminates?}, which the arms above use: a `bot`-typed helper call does not qualify (issue #3110).
+      # Otherwise both exit scopes join with nil-injection.
+      def if_join(then_node, else_node, (then_type, then_scope), (else_type, else_scope), post_pred)
+        type = Type::Combinator.union(then_type, else_type)
+        return [type, else_scope] if else_node && branch_certainly_exits?(then_node)
+
+        [type, UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred, [then_node, else_node])]
       end
 
       # Returns the `[type, post_scope]` of the live branch when the predicate is provably truthy / falsey, else nil so
@@ -1440,7 +2432,7 @@ module Rigor
         sub_eval(node.statements, scope)
       end
 
-      # `case pred; when ...; when ...; else; end` and the pattern- matching variant. The predicate's post-scope is
+      # `case pred; when ...; when ...; else; end` and the pattern-matching variant. The predicate's post-scope is
       # shared with every branch (including the else); branches are evaluated independently and merged with
       # nil-injection so half-bound names degrade to `T | nil`.
       def eval_case(node)
@@ -1646,6 +2638,11 @@ module Rigor
           InterveningIvarReset.may_write?(condition, name, before, run_lambdas: true)
         when Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode
           false
+        when Prism::GlobalVariableReadNode
+          # Issue #2314 — the question the statement walk asks past a call ({#forget_reached_globals}).
+          body = when_lambda_body(condition)
+          GlobalWriterReach.may_write?(condition, name, before) ||
+            (!body.nil? && GlobalWriterReach.may_write?(body, name, before))
         else
           body = when_lambda_body(condition)
           GuardRebinding.may_rebind?(condition, before) || (!body.nil? && GuardRebinding.may_rebind?(body, before))
@@ -1757,9 +2754,12 @@ module Rigor
       # while it ran, put back as this scope binds them ({ErrorInfo.restore}): the control those carry has left every
       # rescue clause the construct entered.
       def restoring_error_info
-        marks = [@next_scope_sink&.size, Thread.current[BREAK_SINK_KEY]&.size]
+        state = typing_state
+        marks = [@next_scope_sink&.size, state[BREAK_SINK]&.size]
         type, after = yield
-        [[@next_scope_sink, marks.first], [Thread.current[BREAK_SINK_KEY], marks.last]].each do |sink, mark|
+        break_sink = state[BREAK_SINK]
+        state.touch(BREAK_SINK) if break_sink && marks.last && marks.last < break_sink.size
+        [[@next_scope_sink, marks.first], [break_sink, marks.last]].each do |sink, mark|
           next if sink.nil? || mark.nil?
 
           (mark...sink.size).each do |index|
@@ -1782,9 +2782,12 @@ module Rigor
         # after it, or a rescue clause, may have set `$_` enters with it forgotten; a rescue clause runs after any
         # prefix of the body, and so reads it forgotten whenever the body may set it.
         entry = edge ? forget_guard_if_rebinds(LastLine.forget_if_set(scope, node), node) : scope
-        primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge)
-        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry_scope(node, entry),
-                                                    edge: edge, writes: rescue_writes(node, edge))
+        rescue_entry = rescue_entry_scope(node, entry)
+        collector = begin_fact_collector(node, rescue_entry, edge)
+        primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge, collector: collector)
+        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry,
+                                                    edge: edge, writes: rescue_writes(node, edge),
+                                                    raise_scopes: collector&.raise_scopes)
 
         # B2.1 — retry-edge widening. When a `retry` in the rescue chain targets this `begin`, control re-enters the
         # primary body carrying every rebind made before the retry: the arm's (`rescue; tries += 1; retry; end`), and
@@ -1880,7 +2883,10 @@ module Rigor
       # none, so an `ensure` clause inside it, nested at any depth, is evaluated once rather than once per pass of
       # every enclosing clause holding a jump.
       def jump_sinks_installed?
-        !@next_scope_sink.nil? || JUMP_SINK_KEYS.any? { |key| Thread.current[key] }
+        return true unless @next_scope_sink.nil?
+
+        state = typing_state
+        JUMP_SINKS.any? { |slot| state[slot] }
       end
 
       # Whether `node` holds a `return`, `next` or `break` outside a nested `def`.
@@ -1936,12 +2942,8 @@ module Rigor
       end
 
       # Runs `block` with no `return`, `next`, `break` or retry-frame sink installed.
-      def without_jump_sinks
-        previous = CLAUSE_SINK_KEYS.map { |key| Thread.current[key] }
-        CLAUSE_SINK_KEYS.each { |key| Thread.current[key] = nil }
-        yield
-      ensure
-        CLAUSE_SINK_KEYS.zip(previous).each { |key, value| Thread.current[key] = value } if previous
+      def without_jump_sinks(&)
+        TypingState.current.without(CLAUSE_SINKS, &)
       end
 
       # The scope a rescue clause of `node` enters with: it runs after any prefix of the body, so neither a `$_`
@@ -1950,6 +2952,65 @@ module Rigor
         forget_guard_if_rebinds(LastLine.forget_if_set(entry, node.statements), node.statements)
       end
 
+      # Issue #2691 — a rescue clause runs after any prefix of the `begin` body raised, so a fact the clause's
+      # entry scope holds for an indexed read (`h[:k]`) or a single-hop chain (`x.r`) survives into it only where
+      # EVERY scope the body can raise from still binds the identical type object. `raise_scopes` is that set —
+      # the post-scope of each statement of the body's frame and the scope it ends with
+      # ({#eval_begin_primary_under}'s collector) — not the fall-through exit alone: `eval_if` and kin discard a
+      # branch that terminates, so a write on `if c; @x.r = nil; raise; end` never reaches the exit scope.
+      # `equal?` keeps only an untouched fact: a re-narrowed or re-joined one is a new object and drops (the
+      # conservative side).
+      #
+      # The residual is a fact the body drops and then re-establishes as the identical (interned) type object:
+      # raise points after the re-establishment keep it, which is correct, and the only unsound window would be a
+      # raise point whose recorded scope still binds the object although the fact was invalidated and not yet
+      # re-established. No producer reaches that today — a rebind or a clause widening answers `Dynamic[top]`,
+      # never the fact's type ({ClauseWidening}), and a widened slot read floors to `Dynamic` rather than
+      # reinstalling the recorded object.
+      #
+      # The filter covers rescue entries only: an `ensure` clause enters from the scope past the `begin` — the
+      # join of the fall-through exits — so it keeps a fact a terminating-branch write voided, the pre-#2691
+      # hole left open because collecting raise points for every `ensure`-only `begin` costs a frame walk.
+      def clause_fact_scope(entry_scope, raise_scopes)
+        return entry_scope if entry_scope.indexed_narrowings.empty? && entry_scope.method_chain_narrowings.empty?
+
+        indexed = entry_scope.indexed_narrowings.reduce(entry_scope) do |acc, (key, type)|
+          if raise_scopes.all? { |point| point.indexed_narrowings[key].equal?(type) }
+            acc
+          else
+            acc.without_indexed_narrowing(key.receiver_kind, key.receiver_name, key.key)
+          end
+        end
+        indexed.method_chain_narrowings.reduce(indexed) do |acc, (key, type)|
+          if raise_scopes.all? { |point| point.method_chain_narrowings[key].equal?(type) }
+            acc
+          else
+            acc.without_method_chain_narrowing(key.receiver_kind, key.receiver_name, key.method_name)
+          end
+        end
+      end
+
+      # Issue #2691 — the {BodyRaiseScopes} {#eval_begin_primary_under} fills while evaluating `node`'s primary
+      # body, or nil when {#clause_fact_scope} has nothing to filter: no rescue clause, no body, or a `clause_entry`
+      # (the scope the chain enters with — `rescue_entry_scope`'s result, or the retry-widened entry under an
+      # edge) holding no indexed or method-chain fact. The frame walk is skipped unless a fact could drop, so a
+      # `begin` whose entry binds none pays nothing.
+      def begin_fact_collector(node, clause_entry, edge)
+        return nil unless node.rescue_clause && node.statements
+        return nil if clause_entry.indexed_narrowings.empty? && clause_entry.method_chain_narrowings.empty?
+
+        frame = edge ? edge.frame : primary_body_frame(node.statements)
+        BodyRaiseScopes.new(frame: frame, raise_scopes: [])
+      end
+
+      # The set {#walk_primary_frame} collects for a primary body — the nodes whose post-statement scopes are the
+      # body's raise points — without the write-name pass a retry edge also needs.
+      def primary_body_frame(statements)
+        frame = Set.new.compare_by_identity
+        walk_primary_frame(statements, true, frame, Set.new)
+        frame
+      end
+
       # Rescue arms that never fall through contribute neither a type fragment NOR a scope to the post-begin flow —
       # control left the `begin` via that arm. That is an arm ending in `return`, `next`, `break`, `raise`, `throw`,
       # `exit`, `abort` or `fail`, and one whose type is `bot` ({#branch_terminates?}): an arm ending in `retry`, or in
@@ -1968,7 +3029,7 @@ module Rigor
       def ensure_jump_marks(node)
         return nil unless node.ensure_clause
 
-        [@next_scope_sink&.size, Thread.current[BREAK_SINK_KEY]&.size]
+        [@next_scope_sink&.size, typing_state[BREAK_SINK]&.size]
       end
 
       # A `next` or `break` inside `begin … ensure` leaves only once the `ensure` clause has run, so each jump scope the
@@ -1978,7 +3039,10 @@ module Rigor
       def carry_jumps_through_ensure(ensure_clause, marks)
         next_mark, break_mark = marks
         carry_through_ensure(ensure_clause, @next_scope_sink, next_mark)
-        carry_through_ensure(ensure_clause, Thread.current[BREAK_SINK_KEY], break_mark)
+        state = typing_state
+        break_sink = state[BREAK_SINK]
+        state.touch(BREAK_SINK) if break_sink && break_mark && break_mark < break_sink.size
+        carry_through_ensure(ensure_clause, break_sink, break_mark)
       end
 
       def carry_through_ensure(ensure_clause, sink, mark)
@@ -1997,13 +3061,23 @@ module Rigor
       # `edge`, when given, collects every scope the primary body could raise from: the scope after each statement of
       # its frame ({#record_raise_points}), and the scope it ends with. The else-clause is not among them: what it
       # raises is not rescued here.
-      def eval_begin_primary_under(node, entry_scope, edge: nil)
+      #
+      # `collector`, when given, is a {BodyRaiseScopes} the same recording fills for {#clause_fact_scope} — built
+      # only when the clause entry still holds an indexed or method-chain fact a raise-point write could
+      # invalidate ({#begin_fact_collector}). A retry `edge` collects the same scopes for its own widening; the
+      # collector is separate so each evaluation pass filters against exactly its own raise points.
+      #
+      # Returns `[type, scope]`: the construct's value and exit scope (the else-clause's when present). The scope the
+      # primary body alone ended with is recorded as a raise point before the `else` runs — the `else` runs only when
+      # nothing raised, so its effects are no raise point's.
+      def eval_begin_primary_under(node, entry_scope, edge: nil, collector: nil)
         body_type, body_scope =
           if node.statements
-            with_raise_frame(edge) { sub_eval(node.statements, entry_scope) }
+            with_raise_frame(edge, collector) { sub_eval(node.statements, entry_scope) }
           else
             [Type::Combinator.constant_of(nil), entry_scope]
           end
+        collector.raise_scopes << body_scope if collector
         edge.raise_scopes << body_scope if edge
 
         if node.else_clause
@@ -2027,6 +3101,13 @@ module Rigor
       end
       private_constant :RetryEdge
 
+      # Issue #2691 — the raise-point scopes one evaluation of a `begin` primary body collects for
+      # {#clause_fact_scope}: {RetryEdge}'s `frame` / `raise_scopes` pair without the retry bookkeeping, so
+      # {#record_raise_points} records into it exactly as into an edge. `frame` is the body's own frame — shared
+      # with the retry edge when one exists, since both walks collect the same nodes.
+      BodyRaiseScopes = Data.define(:frame, :raise_scopes)
+      private_constant :BodyRaiseScopes
+
       # The entry and edge one widening reads, whether it widens to the Nominal envelope or keeps literals, and, per
       # name, the rebinds it has already weighed: a statement-by-statement body shares one binding object across every
       # scope until the name is rebound, and weighing each copy again is what made a long body quadratic.
@@ -2035,17 +3116,29 @@ module Rigor
       end
       private_constant :RetryWidening
 
-      # The thread-local stack of the {RetryEdge}s whose primary body is being evaluated, innermost last, or nil.
-      RETRY_FRAMES_KEY = :rigor_retry_frames
-      private_constant :RETRY_FRAMES_KEY
+      # The thread-local stack of the raise-point frames whose primary body is being evaluated, innermost last, or
+      # nil: a {RetryEdge} and/or a {BodyRaiseScopes}. The
+      # frozen stack is the Frame; a statement's raise point recorded into a frame is a Resource touch
+      # ({#record_raise_points}).
+      RETRY_FRAMES = TypingState.frame(
+        :retry_frames,
+        contents: :resource, reason: "installed per retrying body; each raise point records into it",
+        witness: "spec/fixtures/typing_state_witnesses/retry_frames.rb"
+      )
+      private_constant :RETRY_FRAMES
 
       # The thread-local sinks a widened clause pass ({#without_jump_sinks}) leaves uninstalled.
-      CLAUSE_SINK_KEYS = [RETURN_SINK_KEY, NEXT_SINK_KEY, BREAK_SINK_KEY, BREAK_VALUE_SINK_KEY, RETRY_FRAMES_KEY].freeze
-      private_constant :CLAUSE_SINK_KEYS
+      CLAUSE_SINKS = [RETURN_SINK, NEXT_SINK, BREAK_SINK, BREAK_VALUE_SINK, RETRY_FRAMES].freeze
+      private_constant :CLAUSE_SINKS
 
       # The thread-local sinks a `return`, `next` or `break` is collected into.
-      JUMP_SINK_KEYS = (CLAUSE_SINK_KEYS - [RETRY_FRAMES_KEY]).freeze
-      private_constant :JUMP_SINK_KEYS
+      JUMP_SINKS = (CLAUSE_SINKS - [RETRY_FRAMES]).freeze
+      private_constant :JUMP_SINKS
+
+      # The sinks a caller's construct installs and a callee's body must not record into: a `next`, `break` or raise
+      # point in the callee belongs to the callee's own constructs, never to the caller's block, loop or retrying body.
+      CALLER_SINKS = [NEXT_SINK, BREAK_SINK, BREAK_VALUE_SINK, RETRY_FRAMES].freeze
+      private_constant :CALLER_SINKS
 
       # The retry edge of `node`, or nil when no `retry` in its rescue chain targets it. Allocation-free for a `begin`
       # no `retry` targets.
@@ -2123,8 +3216,11 @@ module Rigor
       end
 
       def eval_begin_paths(node, entry, edge)
-        primary = eval_begin_primary_under(node, entry, edge: edge)
-        [*primary, collect_rescue_chain_results(node.rescue_clause, entry, edge: edge)]
+        collector = begin_fact_collector(node, entry, edge)
+        primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge, collector: collector)
+        [primary_type, primary_scope,
+         collect_rescue_chain_results(node.rescue_clause, entry,
+                                      edge: edge, raise_scopes: collector&.raise_scopes)]
       end
 
       # B2.1 — the entry scope widened by what crosses the retry edge, or nil when nothing does. A local or ivar bound
@@ -2149,28 +3245,33 @@ module Rigor
         widened
       end
 
-      # Runs `block` with `edge` on top of the thread-local stack {#record_raise_points} reads.
-      def with_raise_frame(edge)
-        return yield unless edge
+      # Runs `block` with `frames` — a retry edge and/or a {BodyRaiseScopes}, nils skipped — on top of the
+      # thread-local stack {#record_raise_points} reads.
+      def with_raise_frame(first, second, &)
+        return yield if first.nil? && second.nil?
 
-        previous = Thread.current[RETRY_FRAMES_KEY]
-        Thread.current[RETRY_FRAMES_KEY] = previous ? [*previous, edge] : [edge]
-        begin
-          yield
-        ensure
-          Thread.current[RETRY_FRAMES_KEY] = previous
-        end
+        frames = first && second ? [first, second] : [first || second]
+        state = TypingState.current
+        previous = state[RETRY_FRAMES]
+        state.with(RETRY_FRAMES, (previous ? previous + frames : frames).freeze, &)
       end
 
-      # The scope after each statement of a retrying primary body's frame is a point the body can raise from, the next
-      # statement's being the one after. Together they carry every rebind a retry can re-enter with, including one on a
-      # branch that then raises and so never reaches the body's exit scope (`if bad; tries += 1; raise; end`), and a
-      # write threaded into the raising call's own operands (`raise Retry.new(tries += 1) if flaky?`). A statement of a
-      # nested block or lambda body is not in the frame (a block parameter can shadow the counter); the block's effect
+      # The scope after each statement of a primary body's frame is a point the body can raise from, the next
+      # statement's being the one after — into every frame on the stack: a retrying begin's edge, which carries
+      # every rebind a retry can re-enter with, and a {BodyRaiseScopes}, which {#clause_fact_scope} intersects
+      # over. Both see a rebind on a branch that then raises and so never reaches the body's exit scope
+      # (`if bad; tries += 1; raise; end`), and a write threaded into the raising call's own operands
+      # (`raise Retry.new(tries += 1) if flaky?`). A statement of a nested block or lambda body is not in the
+      # frame (a block parameter can shadow the counter); the block's effect
       # on this frame shows in the post-scope of the statement holding it. Recording from the evaluator rather than
       # `on_enter` keeps a statement reached with the index recorder off (a threaded operand, a loop fixpoint pass).
       def record_raise_points(frames, stmt, stmt_scope)
-        frames.each { |edge| edge.raise_scopes << stmt_scope if edge.frame.include?(stmt) }
+        frames.each do |collector|
+          next unless collector.frame.include?(stmt)
+
+          typing_state.touch(RETRY_FRAMES)
+          collector.raise_scopes << stmt_scope
+        end
       end
 
       # An `on_enter` that records, besides forwarding to the installed one, the entry scope of each `retry` of `edge`
@@ -2327,7 +3428,14 @@ module Rigor
       # Issue #1231 — `writes` widens the scope each clause enters with ({#widen_clause_entry}) before its
       # reference is bound, so `rescue => e` still binds `e` to the exception. It is nil under a retry edge, which
       # already carries every scope the primary body raises from ({#widen_entry_for_retry}).
-      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil, writes: nil)
+      # `raise_scopes`, when given, is every scope the primary body can raise from — the post-scope of each
+      # statement of its frame and the scope it ends with ({#eval_begin_primary_under}'s collector): the rescue
+      # entry keeps only the indexed and method-chain facts every one of them still binds verbatim
+      # ({#clause_fact_scope}).
+      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil, writes: nil, raise_scopes: nil)
+        return [] if rescue_node.nil?
+
+        entry_scope = clause_fact_scope(entry_scope, raise_scopes) if raise_scopes
         on_enter = edge ? retry_scope_recorder(edge) : @on_enter
         results = []
         current = rescue_node
@@ -2375,7 +3483,7 @@ module Rigor
       # True when the clause's scope `after` still binds `$_` to the `Dynamic[top]` the entry gave it and the clause
       # holds nothing that may set it ({LastLine.may_set?}).
       def last_line_kept?(after, node)
-        after.global(:$_) == Type::Combinator.untyped && !LastLine.may_set?(node.statements, scope)
+        Type::Combinator.untyped?(after.global(:$_)) && !LastLine.may_set?(node.statements, scope)
       end
 
       # Issue #1889 — {#eval_for} with a literal-name `instance_variable_set` in the body joining its value into the
@@ -2649,15 +3757,9 @@ module Rigor
       # Installs a fresh thread-local break sink around `yield` (a loop-body evaluation), returning `[collected,
       # yield_result]`. Stacks: the previous sink is restored on exit so a nested loop's breaks do not leak to the
       # enclosing loop.
-      def collect_break_scopes
-        previous = Thread.current[BREAK_SINK_KEY]
+      def collect_break_scopes(&)
         sink = []
-        Thread.current[BREAK_SINK_KEY] = sink
-        begin
-          result = yield
-        ensure
-          Thread.current[BREAK_SINK_KEY] = previous
-        end
+        result = TypingState.current.with(BREAK_SINK, sink, &)
         [sink, result]
       end
 
@@ -2734,7 +3836,7 @@ module Rigor
       # from the widened binding reaches it ({#loop_break_arms}); without it the method inferred `true` and a
       # caller's test on it folded always-truthy on correct code.
       def later_pass_returns?(statements)
-        !Thread.current[RETURN_SINK_KEY].nil? && ReturnBarrier.exits_method?(statements)
+        !typing_state[RETURN_SINK].nil? && ReturnBarrier.exits_method?(statements)
       end
 
       # Joins each `break` arm's body-written local bindings into the loop continuation, so a `break`-path binding the
@@ -2746,12 +3848,11 @@ module Rigor
       def join_break_scopes(continuation, breaks, names)
         return continuation if breaks.empty? || names.empty?
 
-        floor = Type::Combinator.untyped
         breaks.reduce(continuation) do |cont, break_scope|
           names.reduce(cont) do |acc, name|
             break_value = CapturedLocals.bound_type(break_scope, name)
             current = CapturedLocals.bound_type(acc, name)
-            next acc if break_value.nil? || current == floor
+            next acc if break_value.nil? || Type::Combinator.untyped?(current)
 
             bind_capture(acc, name, current ? Type::Combinator.union(current, break_value) : break_value)
           end
@@ -3068,7 +4169,9 @@ module Rigor
         types = [coll_type]
         name = for_collection_variable(node)
         types << CapturedLocals.bound_type(continuation, name) if name
-        deep = DeepErasure.element_mutation?(node.statements, DeepErasure.parameter_names(node.index))
+        deep = DeepErasure.element_mutation?(node.statements, DeepErasure.parameter_names(node.index)) do
+          DeepErasure.holds_set?(coll_type)
+        end
         Type::Combinator.union(*types.compact.map { |type| shape_erased_collection(type, deep: deep) })
       end
 
@@ -3133,14 +4236,14 @@ module Rigor
         forget_guard_if_rebinds(body_entry, node.statements)
       end
 
-      # `for x in coll` is semantically `coll.each { |x| ... }`. We ask the method dispatcher for `coll.each`'s expected
-      # block parameter types — that path consults RBS and the iterator dispatch table, which is more precise than the
-      # structural `collection_element_type` fallback (it knows, e.g., that `Hash[K, V]#each` yields `[K, V]` even when
+      # `for x in coll` is semantically `coll.each { |x| ... }`. The structural `collection_element_type` answers first;
+      # only when it is untyped do we ask the method dispatcher for `coll.each`'s expected block parameter types, which
+      # consult RBS and the iterator dispatch table (they know, e.g., that `Hash[K, V]#each` yields `[K, V]` even when
       # the receiver is not a literal Hash carrier in our local lattice). When the dispatcher returns nothing (no
-      # signature, unknown receiver) we fall back to the structural extractor.
+      # signature, unknown receiver) the structural answer stands.
       def for_iteration_element_type(coll_type)
         structural = collection_element_type(coll_type)
-        return structural unless structural.equal?(Type::Combinator.untyped)
+        return structural unless Type::Combinator.untyped?(structural)
 
         block_params = MethodDispatcher.expected_block_param_types(
           receiver_type: coll_type,
@@ -3174,13 +4277,17 @@ module Rigor
           scope.with_ivar(index_node.name, element_type).without_ivar_guard(index_node.name)
         when Prism::GlobalVariableTargetNode
           scope.with_global(index_node.name, element_type)
+        when Prism::ClassVariableTargetNode
+          scope.with_cvar(index_node.name, element_type)
         when Prism::IndexTargetNode
           widen_index_target(index_node, element_type, scope, type_scope: scope)
+        when Prism::CallTargetNode
+          widen_attribute_write(index_node.receiver, index_node.name, scope)
         when Prism::MultiTargetNode
           bound = MultiTargetBinder.bind_marked(index_node, element_type, scope: scope)
-          widen_index_targets(bound, bound.apply_to(scope), type_scope: scope)
+          widen_attribute_targets(index_node, widen_index_targets(bound, bound.apply_to(scope), type_scope: scope))
         when Prism::SplatNode
-          bind_for_splat_index(index_node, scope)
+          bind_for_splat_index(index_node, element_type, scope)
         else
           scope
         end
@@ -3188,18 +4295,34 @@ module Rigor
 
       # `for *h[:a] in pairs` — Prism gives a bare splat index as a `SplatNode`, not a `MultiTargetNode`, so the
       # binder never sees it. The store is `*h[:a] = element`, an array of the element's `to_ary` parts; the receiver
-      # widens with the binder's floor for a rest it cannot decompose, `Dynamic[top]`. A bare `*name` target stays
-      # unbound here, as before.
-      def bind_for_splat_index(splat, scope)
+      # widens with the binder's floor for a rest it cannot decompose, `Dynamic[top]`. `for *x.r in pairs` calls `r=`
+      # and widens as `for x.r in` does (issue #2693).
+      #
+      # Issue #1217 — a bare `*a` / `*@a` / `*@@a` / `*$a` binds the name to the rest
+      # {MultiTargetBinder.decompose_slots} reads off the element: a `Tuple` element exactly, an `Array[T]` element as
+      # `Array[T]`, and anything else — a union, a value Ruby would wrap as `[element]` — the `Dynamic[top]` floor.
+      # Left unbound, a read after the loop folded on the pre-loop binding.
+      def bind_for_splat_index(splat, element_type, scope)
         target = splat.expression
-        return scope unless target.is_a?(Prism::IndexTargetNode)
-
-        widen_index_target(target, Type::Combinator.untyped, scope, type_scope: scope)
+        case target
+        when Prism::CallTargetNode
+          widen_attribute_write(target.receiver, target.name, scope)
+        when Prism::IndexTargetNode
+          widen_index_target(target, Type::Combinator.untyped, scope, type_scope: scope)
+        when Prism::LocalVariableTargetNode, Prism::InstanceVariableTargetNode,
+             Prism::ClassVariableTargetNode, Prism::GlobalVariableTargetNode
+          _, rest, = MultiTargetBinder.decompose_slots(
+            element_type, front_count: 0, back_count: 0, rest_present: true, scope: scope
+          )
+          bind_for_index(target, rest, scope)
+        else
+          scope
+        end
       end
 
       # Extracts the per-iteration element type from a collection carrier. `Tuple[T1..Tn]` yields the union of its
       # elements; `Nominal[Array, [T]]` and `Nominal[Range, [T]]` yield `T`; `Nominal[Hash, [K, V]]` yields `Tuple[K,
-      # V]` (Hash#each yields `[key, value]` pairs); `IntegerRange` yields `Integer`; `Constant<Range>` reads the
+      # V]` (Hash#each yields `[key, value]` pairs); `IntegerRange` yields `Integer`; a `Range` constant reads the
       # literal range's element class. Anything else falls back to `untyped`.
       def collection_element_type(type)
         case type
@@ -3500,8 +4623,9 @@ module Rigor
 
       # `class << expr; body; end`. When `expr` is `self`, the body defines class methods on the immediate enclosing
       # class — the innermost frame flips to `singleton: true` so a nested `def foo` resolves through `singleton_method`
-      # rather than `instance_method`. For non-`self` expressions we cannot statically resolve the receiver, so we keep
-      # the existing context and accept that nested defs degrade to the `Dynamic[Top]` default.
+      # rather than `instance_method`. For an expression that is neither `self` nor a constant we cannot statically
+      # resolve the receiver, so we keep the existing context and accept that nested defs degrade to the `Dynamic[Top]`
+      # default.
       # Issue #652 — the body INHERITS this evaluator's chain. Ruby pushes the singleton class onto
       # `Module.nesting` and leaves the enclosing entries beneath it, so `class << Other` written inside
       # `module Admin` reads `Admin::Y`: the enclosing rung is live, and only the singleton rung itself
@@ -3530,13 +4654,9 @@ module Rigor
         # false positives in `prism-1.9.0`'s auto-generated `copy` methods alone. A nested `def` is a return barrier:
         # its body's `return`s belong to the inner method, not the one currently being inferred. Suspend the return sink
         # across the nested body so `eval_return` does not record them into the outer method's return type.
-        outer_sink = Thread.current[RETURN_SINK_KEY]
-        Thread.current[RETURN_SINK_KEY] = nil
-        begin
+        typing_state.with(RETURN_SINK, nil) do
           sub_eval(node.parameters, body_scope, class_context: @class_context) if node.parameters
           sub_eval(node.body, body_scope, class_context: @class_context) if node.body
-        ensure
-          Thread.current[RETURN_SINK_KEY] = outer_sink
         end
         [Type::Combinator.constant_of(node.name), scope]
       end
@@ -3567,11 +4687,9 @@ module Rigor
         invoked = call_operand_scope(node, walk, scope)
         invoked = forget_operand_specials(node, invoked)
         operand_types = walk.types(tracer)
+        # The `each_with_object` memo widening (ADR-56 slice C, B3) is part of the call's type, applied by
+        # `ExpressionTyper#call_type_for` ({#each_with_object_value}).
         call_type = OperandWalk.type_of(scope, node, tracer, operand_types)
-        # ADR-56 slice C (B3) — `each_with_object(memo) { |x, acc| acc << … }` returns the memo; the engine otherwise
-        # types the call `Dynamic[top]`. Compute the joined memo type from the block's content mutations of the memo
-        # block-param and adopt it as the call's return type.
-        call_type = each_with_object_return(node, call_type)
         [call_type, invoke_from(node, invoked, call_type, operand_types)]
       end
 
@@ -3760,8 +4878,7 @@ module Rigor
         # B2.2 — intervening method call ivar invalidation. An implicit-self / self-receiver call could mutate any ivar
         # of the enclosing class (we cannot prove purity without an effect system). Reset each ivar whose current local
         # binding has narrowed below the class-ivar seed back to the seed itself, so a subsequent `if @flag` predicate
-        # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts). See
-        # [`docs/CURRENT_WORK.md`](../../../docs/CURRENT_WORK.md) § "Flow-folding" — G2 intervening-call case.
+        # observes the seed's union (not the pre-call narrowed value). Always-safe (only widens; no new facts).
         post_scope = invalidate_ivars_for_intervening_call(node, post_scope) if statement_call
         # Issue #1889 — `instance_variable_set` on `self` writes an ivar no write node shows. It runs after the reset
         # above, which would join a literal-name write back into the class seed.
@@ -3795,9 +4912,32 @@ module Rigor
                          post_scope.forget_guard_narrowings
                        end
         end
+        post_scope = forget_reached_globals(node, post_scope)
         forget_rescued_status(LastStatus.after(node, post_scope, scope), node)
       end
 
+      def guard_narrowed_global?(scope, name)
+        scope.guard_narrowed? && scope.guard_records.key?([:global, name])
+      end
+
+      # Issue #2314 — `post_scope` with each global a project method may write rebound to `Dynamic[top]` when the
+      # statement call `node` may reach that method ({GlobalWriterReach.may_write?}): `$g = nil; reset!; $g + 1`,
+      # with `reset!` assigning `$g`, is `2` in Ruby. A global no reachable method writes keeps its binding. A
+      # `case` whose `when` test may rebind a global subject reads it the same way ({#when_test_rebinds_subject?}).
+      # A global a guard narrowed where the operands started keeps the union issue #1429's restore reads instead
+      # (`return unless $sep; puts(reset_sep); $sep.length` reads `$sep` as the union of its seed and `","`).
+      def forget_reached_globals(node, post_scope)
+        names = GlobalWriterReach.candidates(post_scope)
+        return post_scope if names.empty?
+
+        names.reduce(post_scope) do |acc, name|
+          next acc if guard_narrowed_global?(operand_scope, name)
+          next acc unless GlobalWriterReach.may_write?(node, name, operand_scope)
+
+          acc.with_global(name, Type::Combinator.untyped)
+        end
+      end
+
       # True when the call may rebind this frame's match globals: it is match-capable itself ({#match_capable_call?}),
       # its own block may run a match ({MatchRebinding.block_may_match?} — issue #1358: the block runs in this frame,
       # so `items.each { |i| i =~ re }` rebinds the enclosing method's `$~`, while a match inside a called Ruby method
@@ -3917,7 +5057,8 @@ module Rigor
 
       # Returns a scope with each ivar's narrowed local binding widened back to its class-ivar seed value when the call
       # is one that could plausibly mutate ivars on the enclosing class (implicit-self or explicit `self.foo`).
-      # External- receiver calls (`obj.method`) cannot reach the caller's ivars; they pass through unchanged.
+      # External-receiver calls (`obj.method`) cannot reach the caller's ivars; they pass through unchanged, apart from
+      # the literal-block case below.
       # Issue #1596 — where the call is proven to write only some ivars ({#self_call_ivar_writes}), only those widen.
       #
       # Issue #1402 — a proc's call (`blk.call`) is a candidate too, and so is a call on another receiver whose literal
@@ -3925,11 +5066,19 @@ module Rigor
       # calls do, marking a binding whose narrowing had ruled `nil` out, since the code they run is far more often
       # code that leaves the variable alone. A `yield` or proc call in the call's receiver or arguments
       # (`@items << yield`, `puts(yield)`) widens every narrowed ivar ({InterveningIvarReset.after_operands}).
+      #
+      # Issue #2039 — an implicit-self or `self.` call marks on the same rule only when its write set is unproven
+      # and its callee's body shows no possibly-nil write of the ivar (`mark: :unproven`, {DirectIvarWrites}):
+      # `v2?`, an `attr_reader` call or `respond_to?(:x)` forgets the narrowing without making the ivar newly
+      # nil-reportable, while a callee that assigns it where the program shows (`clear_tag`) widens unmarked.
       def invalidate_ivars_for_intervening_call(call_node, current_scope)
         widened =
           if intervening_call_candidate?(call_node)
-            mark = !InterveningIvarReset.self_call?(call_node)
-            InterveningIvarReset.widen(current_scope, mark: mark) { self_call_ivar_writes(call_node) }
+            mark = InterveningIvarReset.self_call?(call_node) ? :unproven : true
+            direct_writes = -> { DirectIvarWrites.of(call_node, operand_scope) }
+            InterveningIvarReset.widen(current_scope, mark: mark, direct_writes: direct_writes) do
+              self_call_ivar_writes(call_node)
+            end
           else
             InterveningIvarReset.after_block(call_node, current_scope)
           end
@@ -4119,7 +5268,7 @@ module Rigor
       # `resolve_call_method`); plugins recognising their own synthetic call shapes (e.g. `T.assert_type!`) have no
       # method_def and the parameter facts silently skip — the plugin's own diagnostics_for_file path covers those
       # cases. The full plugin-side parameter-targeting story (PHPStan-style Type-Specifying Extensions on
-      # plugin-recognised calls) lives behind a follow-up slice that introduces `:local` / `:argument_at` target kinds.
+      # plugin-recognised calls) lives behind a follow-up slice that introduces an `:argument_at` target kind.
       def apply_plugin_assertions(call_node, current_scope)
         registry = current_scope.environment&.plugin_registry
         return current_scope if registry.nil? || registry.empty?
@@ -4274,7 +5423,7 @@ module Rigor
       def lookup_post_return_arg(call_node, method_def, target_name)
         # Plugin-source contributions arrive without an authoritative method_def (the plugin recognised the call shape
         # directly). Parameter-targeting falls back to "no narrow" in that case — the wider plugin-side parameter
-        # mapping (`:local` / `:argument_at`) is a follow-up slice.
+        # mapping (`:argument_at`) is a follow-up slice.
         return nil if method_def.nil?
 
         arguments = call_node.arguments&.arguments || []
@@ -4301,8 +5450,15 @@ module Rigor
         narrowed = Narrowing.safe_navigation_block_scope(node, scope)
         return enter_call_block(node, block) if narrowed.equal?(scope)
 
-        evaluator_at(narrowed, operand_scope: operand_scope, operand_types: @operand_types)
-          .send(:enter_call_block, node, block)
+        narrowed_evaluator = evaluator_at(narrowed, operand_scope: operand_scope, operand_types: @operand_types)
+        narrowed_evaluator.send(:enter_call_block_carrying, node, block, @value_position_block)
+      end
+
+      # The safe-navigation arm of {#evaluate_block_if_present}: the narrowed evaluator enters the block carrying the
+      # value-position mark {#evaluate_block_of} set on this one, which {#block_self_entry} reads.
+      def enter_call_block_carrying(node, block, value_position_block)
+        @value_position_block = value_position_block
+        enter_call_block(node, block)
       end
 
       def enter_call_block(node, block)
@@ -4360,14 +5516,8 @@ module Rigor
       end
 
       # Runs the block with the method's return sink suspended, for a body whose `return` is not the method's.
-      def without_return_sink
-        outer_sink = Thread.current[RETURN_SINK_KEY]
-        Thread.current[RETURN_SINK_KEY] = nil
-        begin
-          yield
-        ensure
-          Thread.current[RETURN_SINK_KEY] = outer_sink
-        end
+      def without_return_sink(&)
+        TypingState.current.with(RETURN_SINK, nil, &)
       end
 
       # Issue #963 — `define_method(:name) { ... }` in a class body defines an INSTANCE method, and Ruby runs
@@ -4471,20 +5621,470 @@ module Rigor
           acc = floor_callee_escaped_args_for_call(receiver, acc)
           receiver = receiver.receiver
         end
-        acc
+        # Issue #2397 — and every self-call in the call's own non-escaping block.
+        floor_block_callee_captures(node, acc)
       end
 
       # Runs for every call of every body it walks, and nearly every call reports no argument, so that case returns
       # before `reduce`: `Enumerable#inject` allocates its iteration state even over an empty array.
-      def floor_callee_escaped_args_for_call(node, base_scope)
-        arguments = content_mutated_arguments(node)
+      #
+      # Issue #2296 — two more channels follow the bare-carrier floor, each keeping the argument's element type
+      # ({UnknownStoreWidening.callee_block_floor} / {UnknownStoreWidening.callee_set_floor}): a parameter the callee
+      # mutates inside a block (`2.times { |i| acc[i] = v }`), and a Set argument the callee grows through a Set-only
+      # adder (`s.add(x)`, `s.merge(xs)`), which the bare census leaves out because `Hash#merge` does not mutate.
+      #
+      # Issue #2297 — a call may resolve to more than one def ({#resolve_self_callees}); each channel floors through
+      # every one of them before the next channel runs, so a bare-census mutation in any of them still goes first.
+      #
+      # `climbing`, when given, keeps only the argument reads deeper than it: those that climb out of a block that
+      # many levels in ({#floor_block_callee_captures}).
+      def floor_callee_escaped_args_for_call(node, base_scope, climbing: nil)
+        callees = argument_mutating_callees(node)
+        return base_scope if callees.empty?
+
+        acc = floor_callee_channel(node, callees, :callee_content_mutated_parameters, base_scope, climbing) do |type|
+          content_floor_for(type)
+        end
+        acc = floor_splat_arguments(node, callees, acc)
+        # Each closure below is only worth computing when an argument holds something its floor could widen.
+        if floorable_local_argument?(node, acc) { |type| UnknownStoreWidening.callee_floorable?(type) }
+          acc = floor_callee_channel(node, callees, :callee_block_mutated_parameters, acc, climbing) do |type|
+            UnknownStoreWidening.callee_block_floor(type)
+          end
+        end
+        return acc unless floorable_local_argument?(node, acc) { |type| SetMutation.carrier_in?(type) }
+
+        callees.each do |def_node, offset, owner|
+          acc = floor_arguments(node, census_of(owner, :callee_set_mutated_parameters, def_node), acc, offset,
+                                climbing) do |type|
+            UnknownStoreWidening.callee_set_floor(type)
+          end
+        end
+        acc
+      end
+
+      # Every callee's `census` channel floors the arguments it names with the block's floor, made gradual when the
+      # floor is an over-approximation ({#callee_gradual_floor}). Only a String result is split; the Set channel and
+      # the container elements a floor widens (#2647) are not.
+      def floor_callee_channel(node, callees, census, base_scope, climbing)
+        several = callees.size > 1
+        acc = base_scope
+        callees.each do |def_node, offset, owner|
+          acc = floor_arguments(node, census_of(owner, census, def_node), acc, offset, climbing) do |type|
+            callee_gradual_floor(yield(type), def_node, owner, several)
+          end
+        end
+        acc
+      end
+
+      # Issue #2397 — the continuation of a `:non_escaping` block whose body hands a captured outer local to a
+      # self-call whose callee mutates it: `acc = [7, 9]; [1].each { poke(acc) }`. The body's own statement floor
+      # rebinds `acc` only inside the block, and neither write-back reads it there (the rebind write-back follows
+      # local writes, the content join follows mutator calls), so the continuation kept the literal and
+      # `acc[0].upcase` reported on correct code.
+      #
+      # Every call the statement `node` makes before it returns is visited: `node` itself and the calls in its
+      # receiver chain and arguments (`[1].each { poke(acc) }.size`, `foo([1].each { poke(acc) })`), never inside a
+      # block or lambda of them. For each one with a `:non_escaping` block not run on another object
+      # ({#foreign_self_block?}), each self-call in the block floors as at a statement, by position or keyword, its
+      # arguments limited to reads that climb out of the block: a block parameter or a nested block's parameter
+      # shadowing the outer name is not the outer local. The body walk ({#each_node_in_method_scope}) leaves out a
+      # lambda and the block of a nested `instance_eval` / `define_method` / …, whose self-calls are not ours.
+      #
+      # Two readings are conservative, since the floor only forgets: a block that may run zero times floors, as the
+      # escaping path ({#floor_block_body_callee_escaped_args}) does, and the floor applies after the block's
+      # write-back, so a rebind later in the body (`poke(acc); acc = [1, 2]`) is floored too.
+      def floor_block_callee_captures(node, post_scope)
+        acc = post_scope
+        each_node_outside_nested_scopes(node) do |call|
+          next unless call.is_a?(Prism::CallNode) && call.block.is_a?(Prism::BlockNode) && call.block.body
+
+          acc = floor_block_body_callee_captures(call, acc)
+        end
+        acc
+      end
+
+      def floor_block_body_callee_captures(call_node, post_scope)
+        return post_scope unless classify_closure_escape(call_node) == :non_escaping
+        return post_scope if foreign_self_block?(call_node)
+
+        acc = post_scope
+        each_node_in_caller_block(call_node.block.body, 0) do |node, depth|
+          acc = floor_callee_escaped_args_for_call(node, acc, climbing: depth)
+        end
+        acc
+      end
+
+      # Yields every call under `node` with the number of blocks and lambdas it sits in, for
+      # {#floor_block_callee_captures}. A lambda is entered, as the escaping path floors one: it may be called in the
+      # block (`l.call`, `-> { ... }.call`). A nested def is not. Nor is the block of a nested call whose self-calls
+      # are provably not the caller's: one run on another object ({#foreign_block_call?}), a `define_method` /
+      # `define_singleton_method` method body, or a `Class.new` / `Module.new` / `Struct.new` / `Data.define` block.
+      # An `instance_eval` / `class_exec` / … on any other receiver (none, `self`, an instance) is entered.
+      def each_node_in_caller_block(node, depth, &)
+        return if node.nil?
+
+        yield node, depth if node.is_a?(Prism::CallNode)
+        skip_block = node.is_a?(Prism::CallNode) && foreign_block_call?(node)
+        node.rigor_each_child do |child|
+          next if child.is_a?(Prism::DefNode)
+
+          if child.is_a?(Prism::BlockNode) || child.is_a?(Prism::LambdaNode)
+            each_node_in_caller_block(child, depth + 1, &) unless skip_block && child.is_a?(Prism::BlockNode)
+          else
+            each_node_in_caller_block(child, depth, &)
+          end
+        end
+      end
+
+      def foreign_block_call?(call_node)
+        return false unless self_rebinding_block_call?(call_node)
+        return true if %i[define_method define_singleton_method].include?(call_node.name)
+        return true unless AnonymousMetaClass.block_form_receiver(call_node).nil?
+
+        foreign_self_block?(call_node)
+      end
+
+      # Issue #2515 — the floor for a `*x` argument whose `x` is a local holding an array (`args = [parser, options];
+      # Opts.add_format(*args)`). The hash travels inside the array, so the caller's `options` is the array's element,
+      # not an argument, and the per-parameter floor never sees it. An element the callee writes is floored at its place
+      # in the array's type and in every local bound to an equal type (the element's source: only the type is known, so
+      # an equal literal in another local is floored too).
+      #
+      # A known tuple whose splat sits at a fixed position (only plain positional arguments before it) binds element
+      # `j` to the callee's slot `index - offset + j` and floors it when that slot is in the channel's census. Any other
+      # case floors every element when the callee writes any positional parameter: an array that is no longer a tuple
+      # (it was mutated), a splat after another splat, an `offset` that swallows the splat. An element that reaches the
+      # callee's rest or post parameter floors when the callee may write it ({#rest_parameter_written?}). A splat of
+      # anything but a local (a call result, an ivar) is not followed.
+      def floor_splat_arguments(node, callees, base_scope)
+        arguments = node.arguments.arguments
+        return base_scope unless arguments.any?(Prism::SplatNode)
+
+        fixed = true
+        arguments.each_with_index.reduce(base_scope) do |acc, (argument, index)|
+          next acc unless argument.is_a?(Prism::SplatNode)
+
+          read = argument.expression
+          at = fixed ? index : nil
+          fixed = false
+          next acc unless read.is_a?(Prism::LocalVariableReadNode) && acc.locals.key?(read.name)
+
+          floor_splat_local(read.name, at, callees, acc)
+        end
+      end
+
+      # Every callee's channels in turn. The callees are a call's own ({#argument_mutating_callees}), never the nil
+      # sentinel {CAPPED_HAND_OFF}, which only a hand-off inside a def answers ({#rest_hand_off_writes?} reads it).
+      def floor_splat_local(name, at, callees, base_scope)
+        channels = splat_channels
+        origin = base_scope.local(name)
+        callees.reduce(base_scope) do |acc, (def_node, offset, owner)|
+          rest = rest_parameter_written?(def_node, owner)
+          channels.reduce(acc) do |inner, (census, floor)|
+            mutated = census_of(owner, census, def_node)
+            writer = ->(count, position) { splat_written_elements(count, position, offset, def_node, mutated, rest) }
+            floor_splat_arrays(name, at, writer, floor, inner, origin)
+          end
+        end
+      end
+
+      # `base_scope` with the elements of the array local `name` the callee writes floored. The local may be a union
+      # (`cond ? [p, o] : [p, q]`, or an array rebound in a block) and may include nil (`args = [...] if cond`): each
+      # array member floors on its own, and a union of arrays, whose position is unknown, takes the any-slot rule. A
+      # local bound to an equal array type (`args2 = args`) is rebuilt too.
+      def floor_splat_arrays(name, at, writer, floor, base_scope, origin)
+        current = base_scope.local(name)
+        members = current.is_a?(Type::Union) ? current.members : [current]
+        arrays = members.count { |member| splat_elements(member) }
+        return base_scope if arrays.zero?
+
+        origins = splat_origin_members(origin, members)
+        acc = base_scope
+        floored = members.each_with_index.map do |member, index|
+          elements = splat_elements(member)
+          next member if elements.nil?
+
+          position = member.is_a?(Type::Tuple) && arrays == 1 ? at : nil
+          written = writer.call(elements.size, position)
+          next member if written.empty?
+
+          source = splat_elements(origins[index]) || elements
+          rebuilt, acc = floor_array_elements(member, elements, [written, source], floor, acc, name)
+          rebuilt
+        end
+        return acc if floored == members
+
+        rebind_array_aliases(name, current, Type::Combinator.union(*floored), acc)
+      end
+
+      # The members of the array local as it was before the channels ran, aligned with `members`, or `members` itself
+      # when a channel merged or dropped some.
+      def splat_origin_members(origin, members)
+        origin_members = splat_parts(origin)
+        origin_members.size == members.size ? origin_members : members
+      end
+
+      # `scope_in` with `name`, and every local bound to the same array type `before`, rebound to `after`.
+      def rebind_array_aliases(name, before, after, scope_in)
+        aliased = scope_in.locals.reduce(scope_in) do |acc, (other, bound)|
+          other != name && bound == before ? acc.with_mutated_local(other, after) : acc
+        end
+        aliased.with_mutated_local(name, after)
+      end
+
+      def splat_channels
+        [[:callee_content_mutated_parameters, method(:content_floor_for)],
+         [:callee_block_mutated_parameters, UnknownStoreWidening.method(:callee_block_floor)],
+         [:callee_set_mutated_parameters, UnknownStoreWidening.method(:callee_set_floor)]]
+      end
+
+      # The element types of `type` when it is an array a splat spreads, or nil: a tuple's, or a nominal `Array[T]`'s.
+      def splat_elements(type)
+        if type.is_a?(Type::Tuple) then type.elements
+        elsif type.is_a?(Type::Nominal) && type.class_name == "Array" && type.type_args.size == 1 then type.type_args
+        end
+      end
+
+      # The indexes of the `count` array elements the callee writes, for a splat at the call's argument `at` (nil: a
+      # position the call does not show, or an array of unknown length). `rest` is true when the callee may write its
+      # rest parameter ({#rest_parameter_written?}).
+      def splat_written_elements(count, at, offset, def_node, mutated, rest)
+        slots = mutated.values
+        return NO_ELEMENTS unless rest || slots.any? { |slot| slot.is_a?(Integer) || slot == ANY_SLOT }
+        return (0...count).to_a if at.nil? || at < offset || slots.include?(ANY_SLOT)
+
+        named = content_parameter_slots(def_node).each_value.grep(Integer).size
+        (0...count).select do |j|
+          slot = at - offset + j
+          slot >= named ? rest : slots.include?(slot)
+        end
+      end
+
+      NO_ELEMENTS = [].freeze
+      private_constant :NO_ELEMENTS
+
+      # `[array, scope]`: the array type `member` with its `written` elements floored by `floor`, and `scope_in` with
+      # every caller local (other than `name`) the floored elements could be floored too. A union element floors member
+      # by member; every element of the array holding a floored type is rebuilt (`[options, options]`, one slot
+      # written); a local is floored (gradually, {#floor_locals_accepted_by}) when a floored part accepts its type.
+      # Locals are matched against the `source` elements, the array as it was before an earlier channel floored it,
+      # so a floored `Hash[untyped, untyped]` element does not match every hash.
+      def floor_array_elements(member, elements, written_and_source, floor, scope_in, name)
+        written, source = written_and_source
+        acc = scope_in
+        pairs = []
+        written.each do |j|
+          splat_parts(source[j]).each { |part| acc = floor_locals_accepted_by(part, name, floor, acc) }
+          splat_parts(elements[j]).each do |part|
+            replacement = floor.call(part)
+            pairs << [part, replacement] unless replacement.nil? || replacement == part
+          end
+        end
+        return [member, acc] if pairs.empty?
+
+        floored = elements.map { |element| replace_splat_parts(element, pairs) }
+        rebuilt = if member.is_a?(Type::Tuple)
+                    Type::Combinator.tuple_of(*floored)
+                  else
+                    Type::Combinator.nominal_of("Array", type_args: floored)
+                  end
+        [rebuilt, acc]
+      end
+
+      def splat_parts(type) = type.is_a?(Type::Union) ? type.members : [type]
+
+      # `element` with the floored parts replaced, gradually ({#gradual_floor}): an element is floored by
+      # over-approximation as often as by a precise slot (a repeated type, an unknown position, a rest read as written),
+      # and one the callee never writes must not start failing against a literal parameter type.
+      def replace_splat_parts(element, pairs)
+        parts = splat_parts(element)
+        replaced = parts.map do |part|
+          replacement = pairs.find { |from, _| from == part }&.last
+          replacement ? gradual_floor(replacement) : part
+        end
+        replaced == parts ? element : Type::Combinator.union(*replaced)
+      end
+
+      # `scope_in` with each carrier local other than `except` whose type `part` accepts (it is a subtype of, or equal
+      # to, the element: `args << options` widens the pushed `{ format: "text" }` to `Hash[Symbol, String]`) floored
+      # with `floor`. Such a local is only a guess at the element's source (the type is all the array records), so its
+      # floor is gradual ({#gradual_floor}): it may forget a fact, never add a finding. A `Dynamic` part matches no
+      # local: it stands for any value and would floor every carrier in scope.
+      def floor_locals_accepted_by(part, except, floor, scope_in)
+        return scope_in if part.is_a?(Type::Dynamic)
+
+        scope_in.locals.reduce(scope_in) do |acc, (other, bound)|
+          next acc if other == except || !UnknownStoreWidening.callee_floorable?(bound)
+          next acc unless Acceptance.accepts(part, bound).yes?
+
+          floored = floor.call(bound)
+          floored.nil? || floored == bound ? acc : acc.with_mutated_local(other, gradual_floor(floored))
+        end
+      end
+
+      # `type` with a bare `String` carrier made gradual (`Dynamic[String]`): a floor to the nominal `String` fails
+      # against a literal parameter type (`("text") -> String`) that the unmutated local satisfied.
+      def gradual_floor(type)
+        return Type::Combinator.union(*type.members.map { |member| gradual_floor(member) }) if type.is_a?(Type::Union)
+
+        string_carrier?(type) ? Type::Combinator.dynamic(type) : type
+      end
+
+      # `floored`, a callee floor (content or block channel) of an argument of a call to `def_node` under `owner`,
+      # made gradual when the floor is an over-approximation ({#over_approximating_callee?}) or the call has several
+      # callees. The one place both channels take the rule.
+      def callee_gradual_floor(floored, def_node, owner, several)
+        # Only a String carrier turns gradual, so the callee is walked only for one (this runs per floored argument).
+        return floored unless string_carrier_in?(floored)
+
+        several || over_approximating_callee?(def_node, owner) ? gradual_floor(floored) : floored
+      end
+
+      def string_carrier_in?(type)
+        type.is_a?(Type::Union) ? type.members.any? { |member| string_carrier?(member) } : string_carrier?(type)
+      end
+
+      # Issue #2515 — true when the floor a call applies to `def_node`'s arguments is an over-approximation, with no
+      # proof that the callee writes the argument it floors: the owner is {FLOOR_ALL} (an inherited def, a
+      # `method_missing`) or {FLOOR_EVERY} (a top-level def that may not be the one called), or the callee hands a
+      # parameter on, through any hop, to one of those, by name or to several candidates. A def read as written that
+      # writes the argument keeps the
+      # precise floor, which is what a later `Integer` parameter or `no_such_method` on the String needs to report.
+      # The walk is bounded by {CalleeMutationChain::MAX_NODES}; past it the answer is true.
+      def over_approximating_callee?(def_node, owner)
+        return true if OVER_APPROXIMATING.include?(owner)
+
+        seen = {}.compare_by_identity
+        queue = [[def_node, owner]]
+        until queue.empty?
+          node, node_owner = queue.shift
+          next if (seen[node] ||= {}).key?(node_owner)
+
+          seen[node][node_owner] = true
+          return true if seen.sum { |_, owners| owners.size } > CalleeMutationChain::MAX_NODES
+
+          census_of(node_owner, :forwarding_edges, node).each do |edge|
+            return true if edge.approx || OVER_APPROXIMATING.include?(edge.owner)
+
+            queue << [edge.callee, edge.owner || node_owner]
+          end
+        end
+        false
+      end
+
+      def string_carrier?(type) = type.is_a?(Type::Nominal) && type.class_name == "String"
+
+      # True when `def_node` has a rest, post or `...` parameter, so a slot no longer names the parameter an element
+      # binds.
+      def variable_arity?(def_node)
+        params = def_node.parameters
+        return false if params.nil?
+
+        !params.rest.nil? || !params.posts.empty? || params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+      end
+
+      # Issue #2515 — true when a callee's rest parameter (`*args`, `*`, `...`) may be written, so an element a splat
+      # binds to it floors: the body reads it anywhere but as a splat argument of a call (`args.first[:k] = 1`), or
+      # hands it on (`b(*args)`) to a call that resolves to a def which writes a positional parameter or has a rest
+      # parameter of its own that it hands on. A rest handed to a call that resolves to no user def hands off nothing,
+      # as for any hand-off. A callee reached through an inherited lookup ({FLOOR_ALL}) or one that may not be the def
+      # the call runs ({FLOOR_EVERY}) reads as written, as its parameters do: neither owner is a {CalleeOwner}, so its
+      # body's hand-offs cannot be read under it.
+      def rest_parameter_written?(def_node, owner)
+        return true if def_node.nil?
+        return false unless variable_arity?(def_node)
+        return true if [FLOOR_ALL, FLOOR_EVERY].include?(owner)
+
+        other, calls = def_census(:rest_uses, def_node) { rest_uses(def_node) }
+        return true if other
+
+        evaluator = owner.nil? ? self : owner_evaluator(owner)
+        calls.any? { |call_node, depth| evaluator.__send__(:rest_hand_off_writes?, call_node, def_node, depth) }
+      end
+
+      # True when a call that splats a rest parameter hands it to a def that writes a positional parameter or has a
+      # rest or post parameter of its own, read in this evaluator, the one the call's def runs in. A nil callee is
+      # {CAPPED_HAND_OFF}'s sentinel (a name with too many defs) and reads as written.
+      def rest_hand_off_writes?(call_node, def_node, depth)
+        hand_off_callees(call_node, def_node, depth).any? do |callee, _offset, callee_owner|
+          next true if callee.nil? || variable_arity?(callee)
+
+          census = census_of(callee_owner, :callee_content_mutated_parameters, callee)
+          census.value?(ANY_SLOT) || census.each_value.any?(Integer)
+        end
+      end
+
+      # `[other, calls]` for `def_node`'s rest parameter: `other` is true when it is read except as a splat argument
+      # (`*args`, `*`) of a call, `calls` the calls that splat it ({#rest_parameter_written?}). An AST property.
+      def rest_uses(def_node)
+        params = def_node.parameters
+        name = params.rest.is_a?(Prism::RestParameterNode) ? params.rest.name : nil
+        forwarding = params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+        reads = 0
+        splatted = 0
+        calls = []
+        each_node_in_method_scope(def_node.body, 0) do |node, depth|
+          reads += 1 if name && splat_reads?(node, name, depth)
+          next unless node.is_a?(Prism::CallNode) && node.arguments
+
+          spread = node.arguments.arguments.select { |a| rest_splat?(a, name, forwarding, depth) }
+          next if spread.empty?
+
+          splatted += spread.count { |a| a.is_a?(Prism::SplatNode) && a.expression }
+          calls << [node, depth]
+        end
+        [reads > splatted, calls.freeze].freeze
+      end
+
+      def rest_splat?(argument, name, forwarding, depth)
+        case argument
+        when Prism::ForwardingArgumentsNode then forwarding
+        when Prism::SplatNode
+          argument.expression.nil? ? name.nil? : !name.nil? && splat_reads?(argument.expression, name, depth)
+        else false
+        end
+      end
+
+      def splat_reads?(node, name, depth)
+        node.is_a?(Prism::LocalVariableReadNode) && node.name == name && node.depth == depth
+      end
+
+      # True when a local `node` passes (positionally or as a keyword's value) is bound in `scope` to a type the
+      # block accepts.
+      def floorable_local_argument?(node, scope, &)
+        node.arguments.arguments.any? do |argument|
+          if argument.is_a?(Prism::KeywordHashNode)
+            argument.elements.any? do |pair|
+              pair.is_a?(Prism::AssocNode) && floorable_local?(pair.value, scope, &)
+            end
+          else
+            floorable_local?(argument, scope, &)
+          end
+        end
+      end
+
+      def floorable_local?(node, scope)
+        node = node.value if node.is_a?(Prism::ImplicitNode)
+        node.is_a?(Prism::LocalVariableReadNode) && scope.locals.key?(node.name) && yield(scope.local(node.name))
+      end
+
+      # `base_scope` with each local `node` passes to a parameter of `mutated` rebound to what the block answers for
+      # its binding; a nil answer, or an answer equal to the binding, leaves it. Issue #2335 — an argument that may be
+      # another local's object (a block parameter, a copy) floors every local another holder may reach
+      # ({AliasMutationFloor.floor_after_written_local}), a block-local one included.
+      def floor_arguments(node, mutated, base_scope, offset, climbing = nil)
+        arguments = arguments_for_slots(node, mutated, offset)
         return base_scope if arguments.empty?
 
         arguments.reduce(base_scope) do |acc, argument|
+          acc = AliasMutationFloor.floor_after_written_local(acc, argument, node)
           next acc unless acc.locals.key?(argument.name)
+          next acc if climbing && argument.depth <= climbing
 
-          floored = content_floor_for(acc.local(argument.name))
-          floored.nil? ? acc : acc.with_mutated_local(argument.name, floored)
+          current = acc.local(argument.name)
+          floored = yield(current)
+          floored.nil? || floored == current ? acc : acc.with_mutated_local(argument.name, floored)
         end
       end
 
@@ -4496,33 +6096,112 @@ module Rigor
       def callee_content_mutated_parameters(def_node)
         cache = (@callee_mutated_param_cache ||= {}.compare_by_identity)
         cache[def_node] ||= resolved_census(:close, def_node) do
-          CalleeMutationChain.close(def_node, own: method(:own_content_parameters), edges: method(:forwarding_edges))
+          CalleeMutationChain.close(def_node, own: hop_census(:own_content_parameters),
+                                              edges: hop_census(:forwarding_edges), **callee_chain_store)
+        end
+      end
+
+      # Issue #2515 — `census` as the `(def, owner)` callback {CalleeMutationChain} reads a hop through: `owner` is the
+      # evaluator a cross-class hand-off resolves in, nil for the evaluator the closure started in.
+      def hop_census(census) = ->(def_node, owner) { census_of(owner, census, def_node) }
+
+      # ADR-127 WD2 — the run's successor store for {CalleeMutationChain} keyed by discovery: `def => owner => name =>
+      # [callee, name, owner, ...]`, a graph fact (the nodes a parameter is handed to), never a walk's conclusion. The
+      # edges do not depend on which census a closure reads, so one store serves all three. The nil owner is stored
+      # under the side and class the closure runs in, the same context {#resolved_census} keys by. Bypassed (nothing
+      # read or written) under {#hand_off_memo_bypassed?}, as the memos it sits beside.
+      def callee_chain_store
+        return NO_CHAIN_STORE if hand_off_memo_bypassed?
+
+        table = typing_state.weak_key_map(CHAIN_STORE)
+        self_type = scope.self_type
+        { store: (table[scope.discovery] ||= {}.compare_by_identity),
+          ctx: [self_type.is_a?(Type::Singleton), enclosing_class_name_for(self_type)] }
+      end
+
+      CHAIN_STORE = TypingState.memo(
+        :callee_chain_successors,
+        run_scoped: true, audit: "successor",
+        reason: "graph facts keyed by discovery, the same whichever census reads them"
+      )
+      NO_CHAIN_STORE = {}.freeze
+      private_constant :CHAIN_STORE, :NO_CHAIN_STORE
+
+      # Issue #2296 — the `{ name => slot }` parameters the callee mutates inside a block in its body
+      # ({#own_block_content_parameters}), closed over hand-offs as {#callee_content_mutated_parameters} is.
+      def callee_block_mutated_parameters(def_node)
+        cache = (@callee_block_param_cache ||= {}.compare_by_identity)
+        cache[def_node] ||= resolved_census(:close_block, def_node) do
+          CalleeMutationChain.close(def_node, own: hop_census(:own_block_content_parameters),
+                                              edges: hop_census(:forwarding_edges), **callee_chain_store)
         end
       end
 
-      # Issue #2104 — the per-thread memo of a census that also resolves self-calls ({#resolve_self_callee_def}), so it
+      # Issue #2296 — the `{ name => slot }` parameters the callee grows through a Set-only adder
+      # ({#own_set_content_parameters}), closed over hand-offs the same way.
+      def callee_set_mutated_parameters(def_node)
+        cache = (@callee_set_param_cache ||= {}.compare_by_identity)
+        cache[def_node] ||= resolved_census(:close_set, def_node) do
+          CalleeMutationChain.close(def_node, own: hop_census(:own_set_content_parameters),
+                                              edges: hop_census(:forwarding_edges), **callee_chain_store)
+        end
+      end
+
+      # Issue #2104 — the per-thread memo of a census that also resolves self-calls ({#resolve_self_callees}), so it
       # reads, besides `def_node`'s AST, the class self-calls resolve in and the discovery index whose def table they
-      # resolve through. Those two key it: the index by identity, as it is immutable (one slot, as a file's analysis
-      # reads one index; a scope indexed for another file replaces it), the class by name. A run builds hundreds of
+      # resolve through. Those two key it: the index by identity, as it is immutable (one entry per live index, held
+      # weakly: a table dropped with its index), the class by name. A run builds hundreds of
       # thousands of evaluators, and a per-evaluator memo alone recomputed each closure and each def's edges about
-      # thirty times over (#2295's cost on the release gate).
+      # thirty times over (#2295's cost on the release gate). Issue #2297 — the side self-calls resolve on
+      # ({#resolve_self_callees}) keys it too: a singleton-side table apart from the instance-side one.
       #
       # While a dependency recorder is active the memo is bypassed: a resolution records an ADR-46 read in the file
-      # and in each capture window open at the time, and a hit would leave that read out of them.
-      def resolved_census(kind, def_node)
-        return yield if Analysis::DependencyRecorder.active?
+      # and in each capture window open at the time, and a hit would leave that read out of them. It is bypassed, read
+      # and write, while this scope carries guard narrowings of constants ({#hand_off_memo_bypassed?}, #2524): they
+      # survive `with_self_type` and change what a constant in the def's body types as, so the census is no longer
+      # the def's alone, and the first caller's narrowing must not become every later caller's answer.
+      def resolved_census(kind, def_node, &)
+        # An audit recomputation bypasses the memo but still opens the site's declaration (ADR-129 WD1).
+        return MemoAudit.key_audit("resolved census", RESOLVED_CENSUS_KEY_AUDIT, &) if MemoAudit.suspended?
+        return yield if hand_off_memo_bypassed?
 
         discovery = scope.discovery
-        slot = Thread.current[RESOLVED_CENSUS_KEY]
-        slot = Thread.current[RESOLVED_CENSUS_KEY] = [discovery, {}] unless slot&.first.equal?(discovery)
-        by_class = (slot.last[kind] ||= {})
-        class_name = enclosing_class_name_for(scope.self_type)
+        table = typing_state.weak_key_map(RESOLVED_CENSUS)
+        slot = (table[discovery] ||= [{}, {}])
+        self_type = scope.self_type
+        by_class = (slot[self_type.is_a?(Type::Singleton) ? 1 : 0][kind] ||= {})
+        class_name = enclosing_class_name_for(self_type)
         by_def = (by_class[class_name] ||= {}.compare_by_identity)
-        by_def.fetch(def_node) { by_def[def_node] = yield }
+        unless by_def.key?(def_node)
+          return by_def[def_node] = MemoAudit.key_audit("resolved census", RESOLVED_CENSUS_KEY_AUDIT, &)
+        end
+
+        MemoAudit.check("resolved census", by_def[def_node], kind, class_name) do
+          MemoAudit.key_audit("resolved census", RESOLVED_CENSUS_KEY_AUDIT, &)
+        end
       end
 
-      RESOLVED_CENSUS_KEY = :rigor_callee_resolved_census
-      private_constant :RESOLVED_CENSUS_KEY
+      RESOLVED_CENSUS = TypingState.memo(
+        :callee_resolved_census,
+        run_scoped: true, audit: "resolved census",
+        reason: "keyed by discovery, side, kind, class and def, all its answer reads; audited by MemoAudit"
+      )
+      private_constant :RESOLVED_CENSUS
+
+      # ADR-129 WD1's key audit of a resolved-census miss. A census types a callee's receivers ({#receiver_callees_in})
+      # under the frames its caller installed, and keys on none of them: a known gap, #2867.
+      CENSUS_CALLER_FRAMES = %i[
+        threaded_block_body key_presence_walk return_sink next_sink break_sink break_value_sink retry_frames
+        interface_erasure interface_dispatch_off
+      ].freeze
+      private_constant :CENSUS_CALLER_FRAMES
+      RESOLVED_CENSUS_KEY_AUDIT = MemoAudit.key_declaration(
+        gaps: CENSUS_CALLER_FRAMES.to_h do |name|
+          [name, "#2867: the census types a callee's receivers under the caller's frames, and its key carries " \
+                 "none of them"]
+        end
+      ).freeze
+      private_constant :RESOLVED_CENSUS_KEY_AUDIT
 
       # The parameters `def_node` mutates itself, from either channel: those escape-mutated inside a block (which may
       # run later / repeatedly) AND those mutated directly in the method body during the call itself
@@ -4530,18 +6209,269 @@ module Rigor
       # ({#def_census}) rather than per evaluator: a chain reads its callees' census from every evaluator that floors a
       # call into it.
       def own_content_parameters(def_node)
-        def_census(:own, def_node) { escaped_content_parameters(def_node).merge(direct_content_parameters(def_node)) }
+        def_census(:own, def_node) do
+          own = escaped_content_parameters(def_node).merge(direct_content_parameters(def_node))
+          written = callee_write_census(def_node).written
+          own = own.merge(written_slots(def_node, written)) unless written.empty?
+          handed = super_forwarded_parameters(def_node)
+          handed.empty? ? own : own.merge(handed)
+        end
+      end
+
+      # Issue #2595 — the parameter writes the content scans above miss: a shape mutator they do not count
+      # (`h.merge!(x)`), a write through an alias (`other = h`, `h.tap { |x| }`, `[h].each { |x| }`, `@x = h`), and
+      # the aliases themselves, which {#forwarded_parameters} follows as hand-offs ({CalleeWriteCensus}). A property
+      # of the def's AST alone, memoised per def node for the thread.
+      def callee_write_census(def_node)
+        def_census(:writes, def_node) do
+          CalleeWriteCensus.scan(def_node.body, census_seeds(def_node),
+                                 tables: CENSUS_TABLES, rebinds: parameter_rebinds(def_node),
+                                 returns: returns_counted?(def_node), anonymous: anonymous_rests?(def_node))
+        end
+      end
+
+      # Issue #2336 — the calls whose block is a method body of the class (`define_method(:go) { poke(h) }`): the
+      # hand-off walk leaves it out ({#each_node_in_method_scope}), so the write census reads a call in it that passes
+      # a parameter as written ({CalleeWriteCensus}). A block run on another `self` (`instance_exec`, `Class.new`)
+      # stays out: a self-call there is not a call on the method's receiver.
+      METHOD_BODY_BLOCK_CALLS = %i[define_method define_singleton_method].to_set.freeze
+      private_constant :METHOD_BODY_BLOCK_CALLS
+
+      # Issue #2336 — whether the value a def returns counts as a write of the parameter it is ({CalleeWriteCensus}):
+      # not for `initialize`, whose value `new` drops, nor for a setter (`x=`, `[]=`), whose value an assignment drops.
+      def returns_counted?(def_node)
+        name = def_node.name
+        name != :initialize && name != :[]= && !SETTER_NAME.match?(name)
+      end
+
+      # An attribute writer's name: an identifier followed by `=` (`format=`), not an operator (`==`, `<=`, `===`).
+      SETTER_NAME = /\A[A-Za-z_][A-Za-z0-9_]*=\z/
+      private_constant :SETTER_NAME
+
+      # Issue #2336 — true when `def_node` has an anonymous rest (`*`), keyword rest (`**`) or `...`, whose arguments
+      # an opaque sink may receive ({CalleeWriteCensus::ANONYMOUS_REST}).
+      def anonymous_rests?(def_node)
+        params = def_node.parameters
+        return false if params.nil?
+
+        (params.rest.is_a?(Prism::RestParameterNode) && params.rest.name.nil?) ||
+          (params.keyword_rest.is_a?(Prism::KeywordRestParameterNode) && params.keyword_rest.name.nil?) ||
+          params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
       end
 
+      # The parameters {#callee_write_census} follows: each content parameter holds the caller's argument itself
+      # (`:same`); a named rest (`*args`) or keyword rest (`**kw`) holds the caller's arguments as elements (`:held`).
+      def census_seeds(def_node)
+        seeds = content_parameter_slots(def_node).transform_values { :same }
+        rest_parameter_names(def_node).each_key { |name| seeds[name] = :held }
+        seeds
+      end
+
+      # `{ name => census key }` for a named rest (`*args` reads as {REST_PARAMETER}) and keyword rest (`**kw` reads as
+      # {KEYWORD_REST_PARAMETER}) of `def_node`.
+      def rest_parameter_names(def_node)
+        params = def_node.parameters
+        return NO_PARAMETER_SLOTS if params.nil?
+
+        rest = params.rest
+        keyword_rest = params.keyword_rest
+        names = {}
+        names[rest.name] = REST_PARAMETER if rest.is_a?(Prism::RestParameterNode) && rest.name
+        names[keyword_rest.name] = KEYWORD_REST_PARAMETER if keyword_rest.is_a?(Prism::KeywordRestParameterNode) &&
+                                                             keyword_rest.name
+        names
+      end
+
+      # The own-census entries for the parameter names {#callee_write_census} wrote: a content parameter at its slot,
+      # a rest at {ANY_SLOT} and a keyword rest at {ANY_KEYWORD}, the slots every argument they bind reaches.
+      #
+      # Issue #2336 — an anonymous rest, keyword rest or `...` an opaque sink received
+      # ({CalleeWriteCensus::ANONYMOUS_REST}) is written at its slot too.
+      def written_slots(def_node, written)
+        found = content_parameter_slots(def_node).slice(*written)
+        rest_parameter_names(def_node).each do |name, key|
+          found[key] = key == REST_PARAMETER ? ANY_SLOT : ANY_KEYWORD if written.include?(name)
+        end
+        rests = rest_parameters(def_node)
+        if written.include?(CalleeWriteCensus::ANONYMOUS_REST) && rests.include?(REST_PARAMETER)
+          found[REST_PARAMETER] = ANY_SLOT
+        end
+        if written.include?(CalleeWriteCensus::ANONYMOUS_KEYWORD_REST) && rests.include?(KEYWORD_REST_PARAMETER)
+          found[KEYWORD_REST_PARAMETER] = ANY_KEYWORD
+        end
+        found
+      end
+
+      # Issue #2521 (#2570 review) — the parameters `def_node` hands to the method it overrides: every content
+      # parameter under a zsuper (`super`, which passes them all), and each one an explicit `super(...)` passes as an
+      # argument or keyword value, at the block depth the call sits at. The overridden def is not followed; the
+      # parameter reads as mutated, so a literal handed through an override that forwards it is floored.
+      #
+      # A rest parameter (`*`, `*args`, `...`) handed on whole (a zsuper, `super(*args)`, `super(...)`) reads as
+      # mutated under {REST_PARAMETER}, the name an argument the call binds to the rest parameter reaches
+      # ({#compute_forwarding_edges}), at {ANY_SLOT} ({#arguments_for_slots}).
+      def super_forwarded_parameters(def_node)
+        # A cheap gate first: the walk below runs for the few defs whose source mentions `super` at all.
+        body = def_node.body
+        return NO_PARAMETER_SLOTS if body.nil? || !body.slice.include?("super")
+
+        slots = content_parameter_slots(def_node)
+        rests = rest_parameters(def_node)
+        return NO_PARAMETER_SLOTS if slots.empty? && rests.empty?
+
+        names = super_forwarded_names(def_node, slots, rests)
+        return NO_PARAMETER_SLOTS if names.nil?
+
+        found = slots.slice(*names)
+        found[REST_PARAMETER] = ANY_SLOT if names.include?(REST_PARAMETER)
+        found[KEYWORD_REST_PARAMETER] = ANY_KEYWORD if names.include?(KEYWORD_REST_PARAMETER)
+        found
+      end
+
+      # The parameter names `def_node` hands to `super` ({#super_forwarded_parameters}), or nil when it calls none.
+      # `rests` holds the rest names the def has ({#rest_parameters}).
+      def super_forwarded_names(def_node, slots, rests)
+        names = nil
+        each_node_in_method_scope(def_node.body, 0) do |node, depth|
+          case node
+          when Prism::ForwardingSuperNode
+            (names ||= Set.new).merge(slots.keys.reject { |name| after_rebind?(def_node, name, node) }).merge(rests)
+          when Prism::SuperNode
+            handed = super_argument_parameters(node, slots, depth).reject { |name| after_rebind?(def_node, name, node) }
+            (names ||= Set.new).merge(handed)
+            names.merge(rests & splatted_rests(node))
+          end
+        end
+        names
+      end
+
+      # The names {#super_forwarded_parameters} records a positional and a keyword rest parameter handed to `super`
+      # under; no local can be named with a leading `*`.
+      REST_PARAMETER = :"*rest"
+      KEYWORD_REST_PARAMETER = :"**rest"
+      REST_NAMES = [REST_PARAMETER].freeze
+      KEYWORD_REST_NAMES = [KEYWORD_REST_PARAMETER].freeze
+      private_constant :REST_PARAMETER, :KEYWORD_REST_PARAMETER, :REST_NAMES, :KEYWORD_REST_NAMES
+
+      # The rest names an argument the call binds to no named parameter of `callee` reaches, when `callee` hands that
+      # rest parameter to `super` ({#super_forwarded_parameters}); empty otherwise. `slot` is the call's positional
+      # index, or the keyword.
+      def handed_rest_names(callee, slot)
+        own = own_content_parameters(callee)
+        if slot.is_a?(Symbol) then own.key?(KEYWORD_REST_PARAMETER) ? KEYWORD_REST_NAMES : NO_FORWARDS
+        else own.key?(REST_PARAMETER) ? REST_NAMES : NO_FORWARDS
+        end
+      end
+
+      # The rest parameters `def_node` has, as {REST_PARAMETER} / {KEYWORD_REST_PARAMETER}: `*args` / `*`, `**kw` /
+      # `**`, both for `...`.
+      def rest_parameters(def_node)
+        params = def_node.parameters
+        return NO_FORWARDS if params.nil?
+
+        forwarding = params.keyword_rest.is_a?(Prism::ForwardingParameterNode)
+        rests = []
+        rests << REST_PARAMETER if forwarding || params.rest.is_a?(Prism::RestParameterNode)
+        rests << KEYWORD_REST_PARAMETER if forwarding || params.keyword_rest.is_a?(Prism::KeywordRestParameterNode)
+        rests
+      end
+
+      # The rests an explicit `super(...)` passes on whole: a splat (`*args`, `*`), a double splat (`**kw`, `**`) in its
+      # keywords, or `...` for both.
+      def splatted_rests(node)
+        (node.arguments&.arguments || []).flat_map do |argument|
+          case argument
+          when Prism::SplatNode then REST_NAMES
+          when Prism::ForwardingArgumentsNode then [REST_PARAMETER, KEYWORD_REST_PARAMETER]
+          when Prism::KeywordHashNode
+            argument.elements.any?(Prism::AssocSplatNode) ? KEYWORD_REST_NAMES : NO_FORWARDS
+          else NO_FORWARDS
+          end
+        end
+      end
+
+      def super_argument_parameters(node, slots, depth)
+        arguments = node.arguments&.arguments || []
+        arguments.flat_map do |argument|
+          if argument.is_a?(Prism::KeywordHashNode)
+            argument.elements.filter_map do |pair|
+              parameter_read_name(pair.value, slots, depth) if pair.is_a?(Prism::AssocNode)
+            end
+          else
+            [parameter_read_name(argument, slots, depth)].compact
+          end
+        end
+      end
+
+      # Issue #2296 — the parameters `def_node` content-mutates inside a block of its body, at any nesting: a
+      # mutation whose receiver reads the parameter itself at the block depth it sits at, so a block parameter or
+      # block-local of the same name, and a block-local copy (`t = [acc[i]]; t[0] = v`), do not count. A lambda or
+      # nested def is not entered (its body is not run by the call), nor is a block that runs on another `self`
+      # ({#each_node_in_method_scope}). The walk counts the method body too: a mutation there, or in an escaping
+      # block, is one the bare census ({#own_content_parameters}) also counts, and its floor runs first, leaving this
+      # one nothing to widen. A property of the AST alone, memoised per def node for the thread.
+      def own_block_content_parameters(def_node) = block_and_set_parameters(def_node)[0]
+
+      # Issue #2296 — the parameters `def_node` grows through a Set-only adder ({SET_ONLY_ADDERS}) in its body or a
+      # block in it, read at the depth it sits at as above. The name alone does not say the receiver is a Set
+      # (`Hash#merge` returns a new Hash), so only a Set argument is floored on it
+      # ({UnknownStoreWidening.callee_set_floor}).
+      def own_set_content_parameters(def_node) = block_and_set_parameters(def_node)[1]
+
+      # Both censuses above, `[block, set]`, from one walk of the method scope, memoised per def node for the thread.
+      def block_and_set_parameters(def_node)
+        def_census(:block_and_set, def_node) do
+          slots = content_parameter_slots(def_node)
+          next NO_BLOCK_AND_SET if slots.empty?
+
+          block = nil
+          set = nil
+          each_node_in_method_scope(def_node.body, 0) do |node, depth|
+            name = content_mutation_target(node) { |r| r.depth == depth }.first
+            (block ||= Set.new) << name if counted_mutation?(def_node, slots, name, node)
+            name = set_only_adder_target(node, depth)
+            (set ||= Set.new) << name if counted_mutation?(def_node, slots, name, node)
+          end
+          [block.nil? ? NO_PARAMETER_SLOTS : slots.slice(*block), set.nil? ? NO_PARAMETER_SLOTS : slots.slice(*set)]
+        end
+      end
+
+      # True when `name`, the local the mutation `node` targets, is one of `slots`' parameters and `node` runs before
+      # any rebind of it ({#after_rebind?}).
+      def counted_mutation?(def_node, slots, name, node)
+        !name.nil? && slots.key?(name) && !after_rebind?(def_node, name, node)
+      end
+
+      # The local `node` grows through a Set-only adder when its receiver reads that local at `depth`, else nil.
+      def set_only_adder_target(node, depth)
+        return unless node.is_a?(Prism::CallNode) && SET_ONLY_ADDERS.include?(node.name)
+
+        receiver = node.receiver
+        receiver.name if receiver.is_a?(Prism::LocalVariableReadNode) && receiver.depth == depth
+      end
+
+      NO_PARAMETER_SLOTS = {}.freeze
+      NO_BLOCK_AND_SET = [NO_PARAMETER_SLOTS, NO_PARAMETER_SLOTS].freeze
+      private_constant :NO_PARAMETER_SLOTS, :NO_BLOCK_AND_SET
+
       # Issue #2104 — the per-thread memo of a census that reads nothing but `def_node`'s AST, under `kind`.
-      def def_census(kind, def_node)
-        table = (Thread.current[DEF_CENSUS_KEY] ||= ObjectSpace::WeakKeyMap.new)
+      def def_census(kind, def_node, &)
+        # An audit recomputation bypasses the memo, so it reads no stored entry (ADR-127 WD3, #3071).
+        return MemoAudit.key_audit("def census", &) if MemoAudit.suspended?
+
+        table = typing_state.weak_key_map(DEF_CENSUS)
         entry = (table[def_node] ||= {})
-        entry.fetch(kind) { entry[kind] = yield }
+        return entry[kind] = MemoAudit.key_audit("def census", &) unless entry.key?(kind)
+
+        MemoAudit.check("def census", entry[kind], kind, &)
       end
 
-      DEF_CENSUS_KEY = :rigor_callee_def_census
-      private_constant :DEF_CENSUS_KEY
+      DEF_CENSUS = TypingState.memo(
+        :callee_def_census,
+        run_scoped: true, audit: "def census",
+        reason: "keyed by def node, the only input it reads; audited by MemoAudit"
+      )
+      private_constant :DEF_CENSUS
 
       # Issue #2104 — the {CalleeMutationChain::Edge}s along which `def_node` hands one of its parameters, unchanged, to
       # a self-call resolving to a user def: a positional argument or a keyword value that reads the parameter itself
@@ -4553,19 +6483,39 @@ module Rigor
         cache[def_node] ||= resolved_census(:edges, def_node) { compute_forwarding_edges(def_node) }
       end
 
+      # True for a hand-off answer with more than one candidate, or resolved by name ({UnionCallees}): its edges are
+      # over-approximations ({CalleeMutationChain::Edge#approx}).
+      def approximate_hand_off?(callees) = callees.size > 1 || callees.is_a?(UnionCallees)
+
+      # True for a hand-off answer that reads the handed parameter as written whatever the callee is: a name with too
+      # many defs ({CAPPED_HAND_OFF}) or a top-level def that may not be the one called ({FLOOR_EVERY}).
+      def floors_outright?(callees)
+        callees.equal?(CAPPED_HAND_OFF) || callees.any? { |_callee, _offset, owner| owner == FLOOR_EVERY }
+      end
+
       def compute_forwarding_edges(def_node)
-        slots = content_parameter_slots(def_node)
+        slots = forwarding_slots(def_node)
         edges = []
-        each_forwarding_call(def_node, slots) do |call_node, forwarded|
-          callee = resolve_self_callee_def(call_node)
-          next if callee.nil?
+        each_forwarding_call(def_node, slots) do |call_node, forwarded, depth|
+          callees = hand_off_callees(call_node, def_node, depth)
+          if floors_outright?(callees)
+            forwarded.map(&:first).each do |name|
+              edges << CalleeMutationChain::Edge.new(name: name, slot: slots[name], callee: def_node,
+                                                     callee_names: [name], owner: FLOOR_ALL)
+            end
+            next
+          end
 
-          callee_slots = content_parameter_slots(callee)
-          forwarded.each do |name, callee_slot|
-            names = bound_parameter_names(callee_slots, callee_slot)
-            next if names.empty?
+          callees.each do |callee, offset, owner|
+            callee_slots = content_parameter_slots(callee)
+            forwarded.each do |name, index|
+              names = bound_parameter_names(callee_slots, index.is_a?(Integer) ? index - offset : index)
+              names = handed_rest_names(callee, index) if names.empty? && index != ANY_SLOT
+              next if names.empty?
 
-            edges << CalleeMutationChain::Edge.new(name: name, slot: slots[name], callee: callee, callee_names: names)
+              edges << CalleeMutationChain::Edge.new(name: name, slot: slots[name], callee: callee, callee_names: names,
+                                                     owner: owner, approx: approximate_hand_off?(callees))
+            end
           end
         end
         edges.empty? ? NO_FORWARDS : edges
@@ -4581,11 +6531,13 @@ module Rigor
 
       def forwarding_calls(def_node, slots)
         calls = []
+        context = HandOffContext.new(census: callee_write_census(def_node), seeds: census_seeds(def_node),
+                                     rests: rest_parameter_names(def_node), rebinds: parameter_rebinds(def_node))
         each_node_in_method_scope(def_node.body, 0) do |descendant, depth|
-          next unless self_dispatch_call?(descendant)
+          next unless self_dispatch_call?(descendant) || hand_off_receiver?(descendant)
 
-          forwarded = forwarded_parameters(descendant, slots, depth)
-          calls << [descendant, forwarded] unless forwarded.empty?
+          forwarded = forwarded_parameters(descendant, slots, depth, context)
+          calls << [descendant, forwarded, depth] unless forwarded.empty?
         end
         calls.empty? ? NO_FORWARDS : calls
       end
@@ -4596,8 +6548,11 @@ module Rigor
       # `[[parameter_name, callee_slot], ...]` for the arguments of `call_node` that read one of `slots`' parameters at
       # `depth`, the block nesting the call sits at: a read of the method's own parameter there has that depth. An
       # argument after a splat or `...` has an index that says nothing about the parameter it binds, so it binds
-      # {ANY_SLOT}, any positional parameter of the callee; one before the first splat keeps its index.
-      def forwarded_parameters(call_node, slots, depth)
+      # {ANY_SLOT}, any positional parameter of the callee; one before the first splat keeps its index among the call's
+      # arguments, which {#compute_forwarding_edges} shifts by each callee's offset ({#resolve_self_callees}).
+      # Issue #2595 — an argument that reads an alias of a parameter (`other = h; poke(other)`, `@x = h; poke(@x)`, a
+      # block parameter of `h.tap`) hands on that parameter too (`census`, {#callee_write_census}).
+      def forwarded_parameters(call_node, slots, depth, context = NO_HAND_OFF_CONTEXT)
         args = call_node.arguments
         return NO_FORWARDS unless args.is_a?(Prism::ArgumentsNode)
 
@@ -4605,11 +6560,14 @@ module Rigor
         forwarded = []
         args.arguments.each_with_index do |argument, index|
           if argument.is_a?(Prism::KeywordHashNode)
-            forwarded.concat(forwarded_keywords(argument, slots, depth))
+            forwarded.concat(forwarded_keywords(argument, slots, depth, context))
           elsif argument.is_a?(Prism::SplatNode) || argument.is_a?(Prism::ForwardingArgumentsNode)
             spread = true
-          elsif (name = parameter_read_name(argument, slots, depth))
-            forwarded << [name, spread ? ANY_SLOT : index]
+            rest = splatted_rest(argument, depth, context)
+            forwarded << [rest, ANY_SLOT] if rest
+          else
+            slot = spread ? ANY_SLOT : index
+            handed_names(argument, slots, depth, context) { |name| forwarded << [name, slot] }
           end
         end
         forwarded
@@ -4617,25 +6575,93 @@ module Rigor
 
       # The `callee_slot` of an argument whose parameter the call does not show (one after a splat).
       ANY_SLOT = :__any_positional__
-      private_constant :ANY_SLOT
+
+      # The census {FLOOR_EVERY} answers: the rest and keyword-rest slots, which {#arguments_for_slots} reads as every
+      # positional argument and every keyword value of the call.
+      EVERY_ARGUMENT = { REST_PARAMETER => ANY_SLOT, KEYWORD_REST_PARAMETER => ANY_KEYWORD }.freeze
+      private_constant :ANY_SLOT, :EVERY_ARGUMENT
 
       # The names of the callee's parameters (`callee_slots`, {#content_parameter_slots}) an argument bound to `slot`
       # may reach: the one at that slot, or every positional one for {ANY_SLOT}.
       def bound_parameter_names(callee_slots, slot)
         if slot == ANY_SLOT
           callee_slots.filter_map { |name, at| name if at.is_a?(Integer) }
+        elsif slot == ANY_KEYWORD
+          callee_slots.filter_map { |name, at| name if at.is_a?(Symbol) }
         else
           callee_slots.filter_map { |name, at| name if at == slot }
         end
       end
 
-      def forwarded_keywords(hash_node, slots, depth)
-        hash_node.elements.filter_map do |pair|
-          next unless pair.is_a?(Prism::AssocNode) && pair.key.is_a?(Prism::SymbolNode)
+      # Issue #2336 — a double splat of the def's own keyword rest (`poke(**kw)`) hands it on whole, at {ANY_KEYWORD}.
+      def forwarded_keywords(hash_node, slots, depth, context)
+        found = []
+        hash_node.elements.each do |pair|
+          if pair.is_a?(Prism::AssocSplatNode)
+            rest = splatted_keyword_rest(pair, depth, context)
+            found << [rest, ANY_KEYWORD] if rest
+          end
+          next unless pair.is_a?(Prism::AssocNode) && pair.key.is_a?(Prism::SymbolNode)
+
+          keyword = pair.key.unescaped.to_sym
+          handed_names(pair.value, slots, depth, context) { |name| found << [name, keyword] }
+        end
+        found
+      end
+
+      # Yields each parameter `node` may hand on: the one it reads ({#parameter_read_name}) and those it may be through
+      # an alias or an expression ({CalleeWriteCensus.handed_aliases}). An element of a named rest or keyword rest
+      # (`x = args[0]; poke(x)`, `poke(kw[:h])`) hands on that rest, under {REST_PARAMETER} / {KEYWORD_REST_PARAMETER}
+      # ({#forwarding_slots}).
+      #
+      # Issue #2336 — a read of the parameter after the def rebound it to a new object (`acc = acc.dup; poke(acc)`)
+      # hands on the copy, not the caller's argument ({#after_rebind?}).
+      def handed_names(node, slots, depth, context)
+        name = parameter_read_name(node, slots, depth)
+        yield name if name && !CalleeWriteCensus.rebound?(context.rebinds, name, node)
+        node = node.value if node.is_a?(Prism::ImplicitNode)
+        aliases = CalleeWriteCensus.handed_aliases(context.census, context.seeds, node, depth,
+                                                   fresh: FRESH_RESULTS, copiers: CENSUS_COPIERS)
+        aliases.each do |aliased|
+          next if aliased == name
+
+          if slots.key?(aliased) then yield aliased
+          elsif (rest = context.rests[aliased]) then yield rest
+          end
+        end
+      end
+
+      # The keyword-rest key a `**kw` double splat of the def's own named keyword rest hands on whole, or nil.
+      def splatted_keyword_rest(pair, depth, context)
+        read = pair.value
+        return unless read.is_a?(Prism::LocalVariableReadNode) && read.depth == depth
+
+        rest = context.rests[read.name]
+        rest if rest == KEYWORD_REST_PARAMETER
+      end
+
+      # The rest key a `*args` splat of the def's own named rest hands on whole (`poke(*args)`), or nil.
+      def splatted_rest(argument, depth, context)
+        read = argument.is_a?(Prism::SplatNode) ? argument.expression : nil
+        return unless read.is_a?(Prism::LocalVariableReadNode) && read.depth == depth
+
+        rest = context.rests[read.name]
+        rest if rest == REST_PARAMETER
+      end
+
+      # What {#forwarded_parameters} reads a def's hand-offs with: its write census, its census seeds, its named
+      # rests and its parameter rebinds ({#parameter_rebinds}).
+      HandOffContext = Data.define(:census, :seeds, :rests, :rebinds)
+      NO_HAND_OFF_CONTEXT = HandOffContext.new(census: CalleeWriteCensus::EMPTY, seeds: {}.freeze, rests: {}.freeze,
+                                               rebinds: {}.freeze)
+      private_constant :HandOffContext, :NO_HAND_OFF_CONTEXT
 
-          name = parameter_read_name(pair.value, slots, depth)
-          [name, pair.key.unescaped.to_sym] if name
-        end
+      # The slots a hand-off's forwarded name maps to: each content parameter's, and {ANY_SLOT} / {ANY_KEYWORD} for the
+      # rest keys an element of a named rest or keyword rest hands on under ({#handed_names}).
+      def forwarding_slots(def_node)
+        slots = content_parameter_slots(def_node)
+        rest_parameter_names(def_node).each_value { |key| slots[key] = key == REST_PARAMETER ? ANY_SLOT : ANY_KEYWORD }
+        slots
       end
 
       # The parameter `node` reads when it is a read of one of `slots`' names at `depth` (a keyword shorthand
@@ -4647,16 +6673,168 @@ module Rigor
         node.name if slots.key?(node.name)
       end
 
-      # The user def a self-dispatch `node` resolves to in the enclosing class, or nil. Reuses the discovery index
-      # `Scope#user_def_for` reads; no ancestor walk (the boundary-escape idiom is same-class), keeping this off the hot
-      # path for the overwhelming majority of self-calls that resolve to nothing escaping.
-      def resolve_self_callee_def(node)
-        class_name = enclosing_class_name_for(scope.self_type)
-        return scope.top_level_def_for(node.name) if class_name.nil?
+      # The `[def, offset]` pairs a self-dispatch `node` resolves to in the enclosing class, `offset` being how many
+      # leading arguments of `node` are not the def's. Issue #2521 — the instance def is looked up along the class's
+      # ancestors ({Scope#user_def_through_ancestors}), as Ruby dispatches the call: an inherited def is now walked
+      # under the receiver's class, so a self-call inside it to another inherited def must still be found there.
+      #
+      # Issue #2297 — in a singleton-side body (`def self.x`, a `def` in `class << self`), whose `self` is the class
+      # object, a self-call resolves to the singleton def of that name AND to the same-named instance def, so the floor
+      # applies when either mutates. Ruby calls only the singleton side, but the hand-offs that reach an instance def
+      # from there (`new.call(acc)`, `instance.helper(acc)`) and the singleton defs the index does not record
+      # (`module_function :poke`, `define_singleton_method`, `alias_method` in `class << self`) are not followed, and
+      # dropping the instance def floored too little on correct code
+      # (`approval-queue.d/callee-floor-singleton-side.md`).
+      # An instance-side body resolves to instance defs only.
+      #
+      # A `send(:name, ...)` / `public_send(:name, ...)` with a symbol literal resolves as the self-call `name(...)`,
+      # offset 1, on each side that has no def of the `send` / `public_send` name itself; on a side that has one, it is
+      # an ordinary self-call to that def, offset 0.
+      def resolve_self_callees(node)
+        self_type = scope.self_type
+        class_name = enclosing_class_name_for(self_type)
+        return top_level_callees(node, nil) if class_name.nil?
+
+        instance = ancestor_side_callee(node, class_name) do |name|
+          scope.user_def_through_ancestors(class_name, name)
+        end
+        side = self_type.is_a?(Type::Singleton) ? :singleton : :instance
+        singleton = inherited_singleton_callee(node, self_type) if side == :singleton
+        return unanswered_self_callees(node, class_name, side) unless instance || singleton
+        return [instance] if singleton.nil?
+        return [singleton] if instance.nil?
+        return [instance] if singleton.first.equal?(instance.first)
+
+        [singleton, instance]
+      end
+
+      # Issue #2515 — the `[def, offset, owner]` a receiverless call resolves to in the project's top-level defs: a
+      # top-level def is a private method on `Object`, so a call outside any class body, and a call in a class whose
+      # chain does not answer the name, reaches it. `class_name` is nil outside a class (the callee's own hand-offs
+      # resolve in this evaluator, owner nil), else the class and side the chain was searched on. The def is read as
+      # written only when nothing else can answer it ({ToplevelDefCensus.reliable?}, and for a class the chain
+      # {#chain_may_answer?}); otherwise it reads as {FLOOR_EVERY}, every argument written. Nothing when no top-level
+      # def has the name.
+      def top_level_callees(node, class_name, side = nil)
+        target = nil
+        found = side_callee(node) do |name|
+          def_node = scope.top_level_def_for(name)
+          target = name unless def_node.nil?
+          def_node
+        end
+        return NO_CALLEES if found.nil?
+
+        def_node, offset = found
+        floor = !ToplevelDefCensus.reliable?(scope, target) ||
+                (!class_name.nil? && chain_may_answer?(class_name, side, target))
+        [[def_node, offset, if floor
+                              FLOOR_EVERY
+                            else
+                              (class_name.nil? ? nil : TOPLEVEL_OWNER)
+                            end]]
+      end
+
+      # A self-call the class's own chain found no def for: the chain's `method_missing` answers it, else the project's
+      # top-level def of that name (Ruby searches `Object` before `method_missing`, so with both the top-level def runs
+      # and the `method_missing` reading is the over-approximation; both are returned and the top-level one floors
+      # every argument).
+      #
+      # Issue #2336 — a name nothing above answers floors every argument when a `define_method` /
+      # `define_singleton_method` / `alias_method` call gives it a body ({#self_ownerless_body?}).
+      def unanswered_self_callees(node, class_name, side)
+        missing = self_method_missing_callees(node, class_name, side)
+        top = top_level_callees(node, class_name, side)
+        if missing.empty? && top.empty?
+          name = send_hand_off?(node) ? send_target(node) : node.name
+          return self_ownerless_body?(name, class_name, side) ? OPAQUE_CALLEES : NO_CALLEES
+        end
+        return top if missing.empty?
+        return missing if top.empty?
+
+        missing + top.map { |def_node, offset, _owner| [def_node, offset, FLOOR_EVERY] }
+      end
+
+      # True when something besides `Object` may answer a receiverless call of `name` in `class_name`'s `side`: the
+      # class is no project class, a definer other than a `def` sits on its chain (`attr_*`, `define_method`, a budget
+      # cut), or an ancestor the project does not declare is unknown to RBS or declares the name there (a
+      # `< ActiveRecord::Base` the environment has no RBS for may define anything). The project's own `def`s were
+      # searched already ({#resolve_self_callees}).
+      def chain_may_answer?(class_name, side, name)
+        return true unless project_class?(class_name)
+        return true if scope.discovered_method_through_ancestors?(class_name, name, side)
+        return true if rbs_declares?(class_name, name) || (side == :singleton && rbs_declares?("Class", name))
+
+        external = scope.external_ancestor_name_candidates(class_name)
+        external += scope.singleton_extends_of(class_name).map { |module_name| [module_name] } if side == :singleton
+        external.any? do |candidates|
+          known = candidates.find { |candidate| Reflection.rbs_class_known?(candidate, scope: scope) }
+          known.nil? ? candidates.none? { |candidate| project_class?(candidate) } : rbs_declares?(known, name)
+        end
+      end
+
+      # A class or module the project declares, even one with no method of its own.
+      def project_class?(name) = scope.known_user_class?(name) || scope.declared_class?(name)
+
+      def rbs_declares?(class_name, name)
+        !Reflection.instance_method_definition(class_name, name, scope: scope).nil? ||
+          !Reflection.singleton_method_definition(class_name, name, scope: scope).nil?
+      end
+
+      # The `[def, offset, owner]` a singleton-side self-call resolves to along the singleton chain: owner nil for a
+      # def of the class itself, {FLOOR_ALL} for one it inherits ({#walked_owner}).
+      def inherited_singleton_callee(node, self_type)
+        class_name = self_type.class_name
+        ancestor_side_callee(node, class_name) do |name|
+          scope.singleton_def_through_ancestors(class_name, name)
+        end
+      end
+
+      # The `[def, offset, owner]` `node` resolves to through a lookup on `class_name` that answers `[def, defining]`
+      # (the block), owner nil, or {FLOOR_ALL} ({#walked_owner}); nil when nothing answers.
+      def ancestor_side_callee(node, class_name)
+        defining = nil
+        found = side_callee(node) do |name|
+          def_node, owner = yield(name)
+          defining = owner unless def_node.nil?
+          def_node
+        end
+        found && [*found, walked_owner(defining, class_name, nil)]
+      end
+
+      # {#method_missing_callees} for a self-call `node` that resolves to nothing; a `send(:name, ...)` hand-off
+      # passes the name as `method_missing`'s own first argument.
+      def self_method_missing_callees(node, class_name, side)
+        if send_hand_off?(node)
+          method_missing_callees(class_name, side, node.arguments.arguments.first.unescaped.to_sym, 1)
+        else
+          method_missing_callees(class_name, side, node.name, 0)
+        end
+      end
+
+      # The `[def, offset]` `node` resolves to on one side, whose def table the block looks a name up in, or nil.
+      def side_callee(node)
+        if send_hand_off?(node)
+          own = yield(node.name)
+          return [own, 0] if own
+
+          target = yield(node.arguments.arguments.first.unescaped.to_sym)
+          return target && [target, 1]
+        end
+
+        found = yield(node.name)
+        found && [found, 0]
+      end
 
-        scope.user_def_for(class_name, node.name)
+      # True for a `send` / `public_send` / `__send__` whose first argument is a literal target name: a symbol, or
+      # (issue #2336) a string (`send("poke", h)`).
+      def send_hand_off?(node)
+        SEND_HAND_OFFS.include?(node.name) && CalleeWriteCensus.literal_send?(node)
       end
 
+      SEND_HAND_OFFS = %i[send public_send __send__].freeze
+      NO_CALLEES = [].freeze
+      private_constant :SEND_HAND_OFFS, :NO_CALLEES
+
       def self_dispatch_call?(node)
         return false unless node.is_a?(Prism::CallNode)
 
@@ -4664,7 +6842,7 @@ module Rigor
       end
 
       # The set of `[name, slot]` parameters of `def_node` whose content a block in the body escape-mutates.
-      # Memoised per def node (the body walk is otherwise repeated at every call site). A parameter is "escape- mutated"
+      # Memoised per def node (the body walk is otherwise repeated at every call site). A parameter is "escape-mutated"
       # when a `param[k] = v` / `param << x` mutation on it appears inside a block whose receiving call is not proven
       # non-escaping.
       def escaped_content_parameters(def_node)
@@ -4681,8 +6859,10 @@ module Rigor
           next unless descendant.is_a?(Prism::CallNode) && descendant.block.is_a?(Prism::BlockNode)
           next if syntactically_non_escaping_call?(descendant)
 
-          collect_content_mutations(descendant.block.body).each_key do |name|
-            mutated << name if positions.key?(name)
+          collect_content_mutations(descendant.block.body).each do |name, nodes|
+            next unless positions.key?(name)
+
+            mutated << name if nodes.any? { |node| !after_rebind?(def_node, name, node) }
           end
         end
         positions.slice(*mutated)
@@ -4694,9 +6874,9 @@ module Rigor
       # parameter-name read is genuinely at method scope (depth 0) rather than a block-local of the same name that
       # merely shadows the parameter — so we never floor a caller argument the callee did not actually mutate.
       #
-      # A mutation inside a NON-escaping block (`n.times { |i| acc[i] = v }`) is not counted: the bare-collection floor
-      # it would apply turned haml's `AttributeCompiler#compile` (a `temple` array a helper fills in a `times` block,
-      # returned against a declared tuple) into a `def.return-type-mismatch` (af3efef33, and again under #2104).
+      # A mutation inside a NON-escaping block (`n.times { |i| acc[i] = v }`) is not counted here: the bare-collection
+      # floor this census applies dropped the element type (af3efef33, and again under #2104). Issue #2296 counts it in
+      # {#own_block_content_parameters}, whose floor keeps the element type.
       def direct_content_parameters(def_node)
         cache = (@direct_param_cache ||= {}.compare_by_identity)
         cache[def_node] ||= compute_direct_content_parameters(def_node)
@@ -4709,11 +6889,110 @@ module Rigor
         mutated = Set.new
         each_node_outside_nested_scopes(def_node.body) do |descendant|
           name, = content_mutation_target(descendant) { |r| r.is_a?(Prism::LocalVariableReadNode) && r.depth.zero? }
-          mutated << name if !name.nil? && positions.key?(name)
+          mutated << name if !name.nil? && positions.key?(name) && !after_rebind?(def_node, name, descendant)
         end
         positions.slice(*mutated)
       end
 
+      # Issue #2296 — true when `node` runs after the def has rebound its parameter `name` to a fresh object
+      # (`acc = acc.dup` as a statement of the method body, ahead of `node`): from there `name` holds another object,
+      # so a mutation of it does not reach the caller's argument. Only an unconditional rebind counts, a write that is
+      # itself a statement of the body, not one under a branch, a loop, a block or `||=`. Its value MUST provably be a
+      # new object ({#fresh_value?}): `acc = acc.to_a` or `s = s.to_s` hands back the same object, so a mutation after
+      # it still reaches the caller. A def whose body has a `rescue` or `ensure` clause never rebinds, since the clause
+      # runs with whichever binding the raise left. And only a node that starts after the write ends counts, so
+      # `acc = poke(acc)` still passes the original.
+      def after_rebind?(def_node, name, node)
+        offset = parameter_rebinds(def_node)[name]
+        !offset.nil? && node.location.start_offset >= offset
+      end
+
+      # `{ name => end_offset }` of the first unconditional fresh rebind of each parameter ({#after_rebind?}),
+      # memoised per def node for the thread.
+      def parameter_rebinds(def_node)
+        def_census(:rebinds, def_node) do
+          slots = content_parameter_slots(def_node)
+          rebinds = nil
+          body_statements(def_node.body).each do |statement|
+            next unless fresh_rebind?(statement, slots)
+
+            (rebinds ||= {})[statement.name] ||= statement.location.end_offset
+          end
+          rebinds || NO_PARAMETER_SLOTS
+        end
+      end
+
+      def fresh_rebind?(statement, slots)
+        case statement
+        when Prism::LocalVariableWriteNode
+          statement.depth.zero? && slots.key?(statement.name) && fresh_value?(statement.value, statement.name)
+        when Prism::LocalVariableOperatorWriteNode
+          statement.depth.zero? && slots.key?(statement.name) &&
+            FRESH_OPERATORS.include?(statement.binary_operator)
+        else false
+        end
+      end
+
+      # A value that is always a new object: a `dup` / `clone`, an Array / Hash / String literal, `new` on a core
+      # collection class ({#core_collection_constant?}), or one of {FRESH_COPIERS} called on the parameter itself. Any
+      # other call may return its receiver.
+      def fresh_value?(value, name)
+        case value
+        when Prism::ArrayNode, Prism::HashNode, Prism::StringNode, Prism::InterpolatedStringNode then true
+        when Prism::CallNode then fresh_call?(value, name)
+        else false
+        end
+      end
+
+      def fresh_call?(call, name)
+        return true if FRESH_DUPLICATORS.include?(call.name)
+        return core_collection_constant?(call.receiver) if call.name == :new
+
+        receiver = call.receiver
+        FRESH_COPIERS.include?(call.name) && receiver.is_a?(Prism::LocalVariableReadNode) && receiver.name == name
+      end
+
+      # `::Array` / `::Hash` / `::String` / `::Set`, written `::`-rooted: the core classes whose `new` always builds a
+      # new object. A project class's `new` may hand back its argument (`Ident.new(acc)`) or wrap it (`Wrap.new(acc)`,
+      # whose `[]=` writes through), so it is no fresh rebind. The census reads the AST alone and cannot resolve a bare
+      # `Array`, which a namespace may shadow (`M::Array`), so only the rooted spelling counts.
+      def core_collection_constant?(node)
+        node.is_a?(Prism::ConstantPathNode) && node.parent.nil? && FRESH_CONSTRUCTED.include?(node.name)
+      end
+
+      FRESH_DUPLICATORS = %i[dup clone].to_set.freeze
+      FRESH_CONSTRUCTED = %i[Array Hash String Set].to_set.freeze
+      FRESH_COPIERS = %i[map collect select reject merge + -].to_set.freeze
+      FRESH_OPERATORS = %i[+ -].to_set.freeze
+      # The calls whose result {#callee_write_census} reads as a new object rather than an alias of the receiver.
+      # The calls {#callee_write_census} reads as a new container of the receiver's elements, on an Array, a Hash and a
+      # String alike: a write to the result misses the receiver, an element of it may be a part. `to_a`, `to_h`
+      # (without a block; `to_h { }` is read as one in {CalleeWriteCensus}), `to_s`, `each_slice`, `each_cons` and
+      # `each_with_index` stay out: each returns its receiver on one of them.
+      CENSUS_COPIERS = %i[
+        slice except compact transform_values transform_keys filter_map group_by partition sort sort_by uniq flatten
+        reverse keys values inspect zip filter flat_map collect_concat take drop
+      ].to_set.freeze
+      # The calls whose result {#callee_write_census} reads as a new object holding nothing of the receiver's.
+      FRESH_RESULTS = (FRESH_DUPLICATORS | FRESH_COPIERS | %i[join]).freeze
+      private_constant :FRESH_DUPLICATORS, :FRESH_CONSTRUCTED, :FRESH_COPIERS, :FRESH_OPERATORS, :CENSUS_COPIERS,
+                       :FRESH_RESULTS
+
+      # The statements a def body runs in order: a statements list, with a parenthesised list (an endless def's
+      # `= (a; b)`) read in place, or the lone expression. A body with a `rescue` / `ensure` clause (a `BeginNode`)
+      # answers none, so it never rebinds.
+      def body_statements(body)
+        case body
+        when nil, Prism::BeginNode then NO_FORWARDS
+        when Prism::StatementsNode then body.body.flat_map { |statement| body_statements_of(statement) }
+        else [body]
+        end
+      end
+
+      def body_statements_of(statement)
+        statement.is_a?(Prism::ParenthesesNode) ? body_statements(statement.body) : [statement]
+      end
+
       # Yields every node reachable from `body` without crossing into a nested block / def / lambda — i.e. the nodes
       # that execute in the method's own scope. A local-variable read found here has depth 0 relative to the method, so
       # a content mutation whose receiver is a positional-parameter name is a genuine mutation of that parameter.
@@ -4766,7 +7045,7 @@ module Rigor
       end
 
       # A receiver-independent over-approximation of `ClosureEscapeAnalyzer`'s non-escaping verdict, used when scanning
-      # a callee body where the block- owning call's receiver TYPE is not available. A call whose method name is a known
+      # a callee body where the block-owning call's receiver TYPE is not available. A call whose method name is a known
       # structural iterator (`each` / `map` / `tap` / …) runs its block synchronously and does not retain it, so its
       # captured mutations are not a cross-boundary escape. Any other name (`on`, `subscribe`, `define_method`, an
       # unknown DSL hook) is treated as escaping — sound, since mis-classifying a truly-non-escaping call only floors an
@@ -4804,14 +7083,21 @@ module Rigor
       # True when at least one argument of `node` is a bare local-variable read (positional or keyword value) bound in
       # the current scope — a cheap pre-filter so the def resolution / body scan only runs for calls that could actually
       # floor something.
+      # A local bound in the current scope, or (issue #2335) one whose object another local may share, which the
+      # alias floor reads a callee's write through ({AliasMutationFloor.reaches_other_locals?}).
+      def passed_local?(read, node)
+        scope.locals.key?(read.name) || AliasMutationFloor.reaches_other_locals?(scope, read, node)
+      end
+
       def call_passes_local_argument?(node)
         args = node.arguments
         return false unless args.respond_to?(:arguments)
 
         args.arguments.any? do |arg|
           case arg
-          when Prism::LocalVariableReadNode
-            scope.locals.key?(arg.name)
+          when Prism::LocalVariableReadNode then passed_local?(arg, node)
+          when Prism::SplatNode
+            arg.expression.is_a?(Prism::LocalVariableReadNode) && scope.locals.key?(arg.expression.name)
           when Prism::KeywordHashNode
             arg.elements.any? do |pair|
               next false unless pair.is_a?(Prism::AssocNode)
@@ -4835,7 +7121,7 @@ module Rigor
         while receiver.is_a?(Prism::CallNode)
           if receiver.block.is_a?(Prism::BlockNode) &&
              classify_closure_escape(receiver) != :non_escaping
-            acc = widen_escaping_content_captures(receiver.block, acc)
+            acc = widen_escaping_content_captures(receiver.block, acc, foreign_self: foreign_self_block?(receiver))
           end
           receiver = receiver.receiver
         end
@@ -4853,7 +7139,14 @@ module Rigor
       # `Array[Dynamic[top]]`, Hash -> `Hash[untyped, untyped]`, String -> `String`. The seed's element/key/value
       # precision is forgotten; only the carrier survives. Read-only captures and locals the block merely rebinds
       # (already floored by `drop_captured_narrowing`) are untouched.
-      def widen_escaping_content_captures(block_node, post_scope)
+      #
+      # An instance variable of this scope's `self` the body mutates in place is floored too (issue #1208): a callback
+      # that runs `@opts[:format] = "json"` later left `@opts[:format]` folding to `"text"`, and so are a class variable
+      # and a global (issue #3096). Each floors member by member ({#member_content_floor}, issue #3095), so a lazily
+      # initialised `@buf = flag ? [1] : nil` keeps its `nil`. An instance variable under a block that runs on another
+      # object is that object's, and so is every one when `foreign_self` says the closure itself does; a class
+      # variable resolves lexically and a global is global, so neither depends on `self`.
+      def widen_escaping_content_captures(block_node, post_scope, foreign_self: false)
         body = block_node.body
         return post_scope if body.nil?
 
@@ -4861,13 +7154,83 @@ module Rigor
         # `local[k] = v` write, which `collect_content_mutations` cannot see (see below).
         post_scope = floor_block_body_callee_escaped_args(body, post_scope)
 
-        mutations = collect_content_mutations(body)
-        return post_scope if mutations.empty?
+        post_scope = collect_content_mutations(body).keys.reduce(post_scope) do |acc, name|
+          floored = content_floor_for(CapturedLocals.bound_type(acc, name))
+          floored.nil? ? acc : bind_mutated_capture(acc, name, floored)
+        end
+
+        floor_non_local_contents(escaping_non_local_content_mutations(body, post_scope, foreign_self), post_scope)
+      end
+
+      # `scope` with each instance variable, class variable or global in `names` floored member by member.
+      def floor_non_local_contents(names, scope)
+        names.reduce(scope) do |acc, name|
+          bound = CapturedLocals.bound_type(acc, name)
+          floored = member_content_floor(bound)
+          floored.equal?(bound) ? acc : CapturedLocals.bind(acc, name, floored)
+        end
+      end
+
+      # `type` with each member {#content_floor_for} recognises floored to its bare carrier and every other member
+      # kept (issue #3095): `Array[1]?` reads `Array[Dynamic[top]]?` and `3 | [1]` reads `3 | Array[Dynamic[top]]`,
+      # so the floor neither drops the `nil` a callback that never runs leaves nor narrows the binding. `type` itself
+      # when no member floors.
+      def member_content_floor(type)
+        members = type.is_a?(Type::Union) ? type.members : [type]
+        floored = members.map { |member| content_floor_for(member) || member }
+        return type if floored.each_with_index.all? { |member, index| member.equal?(members[index]) }
+
+        Type::Combinator.union(*floored)
+      end
+
+      # The instance variables of `scope`'s `self`, the class variables and the globals an escaping body mutates in
+      # place, on the terms {#capturable_non_local?} reads against `scope` — the continuation the floor writes into.
+      def escaping_non_local_content_mutations(body, scope, foreign_self)
+        names = nil
+        Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
+          name, content = non_local_shape_mutation(node)
+          next if name.nil?
+          next unless (content && capturable_non_local?(name, ancestors, scope, foreign_self: foreign_self)) ||
+                      block_defined_method_capture?(name, ancestors, scope, foreign_self)
+
+          (names ||= []) << name
+        end
+        names ? names.uniq : NO_REWRITES
+      end
+
+      # `[name, content]` when `node` mutates an instance variable, class variable or global in place, else nil.
+      # `content` says a content scan counts the mutation ({CONTENT_MUTATORS}, or an index write). A method the block
+      # defines counts every name the straight-line widening responds to as well ({CALLEE_WRITE_MUTATORS}: `merge!`,
+      # `map!`, `clear`, …), because its floor reads no evidence from the call (issue #3163).
+      def non_local_shape_mutation(node)
+        content = index_write?(node)
+        unless content
+          return nil unless node.is_a?(Prism::CallNode) && CALLEE_WRITE_MUTATORS.include?(node.name)
+
+          content = CONTENT_MUTATORS.include?(node.name)
+        end
+        receiver = node.receiver
+        NON_LOCAL_READ_NODES.include?(receiver.class) ? [receiver.name, content] : nil
+      end
+
+      # Issue #3163 — `post_scope` with every instance variable, class variable and global floored member by member
+      # ({#member_content_floor}) that a method defined in `call_node`'s non-escaping block mutates in place
+      # ({#block_defined_method_capture?}). The block, or anything it calls, may call that method before it returns:
+      # `$buf = []; [1].each { def h; $buf << 1; end; h }` leaves `$buf` as `[1]`, and the content join reads no
+      # evidence from a method body, which it types in no scope of the block's. No call is followed, so a method the
+      # block defines and nothing calls floors too. An escaping block floors the same names
+      # ({#escaping_non_local_content_mutations}).
+      def floor_block_defined_method_mutations(call_node, block, post_scope)
+        foreign = foreign_self_block?(call_node)
+        names = nil
+        Source::NodeWalker.each_with_ancestors(block.body) do |node, ancestors|
+          name, = non_local_shape_mutation(node)
+          # Read against the continuation: a variable the block itself first binds has no pre-call binding.
+          next if name.nil? || !block_defined_method_capture?(name, ancestors, post_scope, foreign)
 
-        mutations.keys.reduce(post_scope) do |acc, name|
-          floored = content_floor_for(acc.local(name))
-          floored.nil? ? acc : acc.with_mutated_local(name, floored)
+          (names ||= []) << name
         end
+        names.nil? ? post_scope : floor_non_local_contents(names.uniq, post_scope)
       end
 
       # Inside an ESCAPING block body, a captured outer local can be content- mutated transitively: the body is (or
@@ -4907,6 +7270,18 @@ module Rigor
                                                   Type::Combinator.untyped])
         elsif arrayish?(type)
           Type::Combinator.nominal_of("Array", type_args: [Type::Combinator.untyped])
+        elsif setish?(type)
+          Type::Combinator.nominal_of("Set", type_args: [Type::Combinator.untyped])
+        end
+      end
+
+      # A `Set` carrier, constant-folded or nominal, for the callee floor above (issue #2294).
+      def setish?(type)
+        case type
+        when Type::Constant then SetMutation.constant?(type)
+        when Type::Nominal then type.class_name == "Set"
+        when Type::Union then type.members.any? { |m| setish?(m) }
+        else false
         end
       end
 
@@ -4981,7 +7356,7 @@ module Rigor
       # continuation holds each rebound capture at `Dynamic[top]` ({#drop_captured_narrowing}), and the pass reads it
       # so: `seen = 0; yielder { return :ret if (seen += 1) > 1 }` reaches the `return`.
       def collect_repeated_block_returns(call_node, post_scope)
-        return if Thread.current[RETURN_SINK_KEY].nil?
+        return if typing_state[RETURN_SINK].nil?
 
         block = call_node.block
         return unless repeated_block_return_candidate?(call_node, block)
@@ -5021,7 +7396,7 @@ module Rigor
       # ADR-56 slice A. For a `:non_escaping` block, fold the continuation binding of every outer local the body can
       # rebind back into `post_scope`. The binding is a capped fixpoint (cap 3) over the block body re-evaluated under
       # the running per-name assumption, joined with the pre-call binding (kept as a constituent so the 0-iteration path
-      # — `[].each { … }` — stays sound), value-pinned- widened on the final permitted iteration, and floored to
+      # — `[].each { … }` — stays sound), value-pinned widened on the final permitted iteration, and floored to
       # `Dynamic[top]` on non-convergence (matching `drop_captured_narrowing`).
       #
       # The instance variables the body rebinds (`CapturedLocals.writes` with `ivars: true`) outlive the call the same
@@ -5118,16 +7493,16 @@ module Rigor
         end
       end
 
-      # Binds a name from `CapturedLocals.writes`. An ivar goes through {CapturedLocals.bind}, which keeps its issue
-      # #286 optimistic mark. A local keeps the plain `with_local` these seams have always used, so a block that
-      # rebinds no ivar leaves the locals exactly as before.
+      # Binds a name from `CapturedLocals.writes`. An ivar (or any other non-local) goes through
+      # {CapturedLocals.bind}, which keeps an ivar's issue #286 optimistic mark. A local keeps the plain `with_local`
+      # these seams have always used, so a block that rebinds no ivar leaves the locals exactly as before.
       #
       # Issue #1402 — `optimistic` is a mark a write-back pass's exit held ({#with_capture_exit_marks}); a name that has
       # one binds through {CapturedLocals.bind} whatever its kind, which adds it.
       def bind_capture(scope, name, type, optimistic: nil)
         return CapturedLocals.bind(scope, name, type, optimistic: optimistic) if optimistic
 
-        CapturedLocals.ivar_name?(name) ? CapturedLocals.bind(scope, name, type) : scope.with_local(name, type)
+        CapturedLocals.local_name?(name) ? scope.with_local(name, type) : CapturedLocals.bind(scope, name, type)
       end
 
       # A block-level `break` ends the CALL, so the binding it leaves with starts no further iteration and is no input
@@ -5155,9 +7530,8 @@ module Rigor
           end
         return converged if arms.empty?
 
-        floor = Type::Combinator.untyped
         converged.to_h do |name, type|
-          next [name, type] if type == floor
+          next [name, type] if Type::Combinator.untyped?(type)
 
           [name, Type::Combinator.union(type, *arms.filter_map { |arm| CapturedLocals.bound_type(arm, name) })]
         end
@@ -5216,22 +7590,48 @@ module Rigor
         block = call_node.block
         return post_scope unless block.is_a?(Prism::BlockNode)
         return post_scope unless classify_closure_escape(call_node) == :non_escaping
+        return post_scope if block.body.nil?
 
-        body = block.body
-        return post_scope if body.nil?
+        post_scope = join_block_content_captures(call_node, block, post_scope, seed_scope)
+        # Issue #3163 — a method the block defines may run during the block, so its in-place mutations of an instance
+        # variable, class variable or global floor that binding. The join reads no evidence from a method body.
+        floor_block_defined_method_mutations(call_node, block, post_scope)
+      end
 
+      # The join {#content_writeback_block_captures} documents, for a non-escaping `block` with a body.
+      def join_block_content_captures(call_node, block, post_scope, seed_scope)
+        body = block.body
         shadows = {}.compare_by_identity
-        mutations = captured_content_mutations(block, shadows)
+        mutations = captured_content_mutations(block, shadows, call_node)
         return post_scope if mutations.empty?
 
         seeds = mutations.to_h do |name, _calls|
-          [name, lookup_mutated_seed(body, name, seed_scope.local(name)) { |depth, nesting| depth > nesting }]
+          seed = CapturedLocals.bound_type(seed_scope, name)
+          [name, lookup_mutated_seed(body, name, seed) { |depth, nesting| depth > nesting }]
         end
-        shadow_rebound_reads(block, mutations, seeds, shadows)
+        shadow_rebound_reads(block, mutations, seeds, shadows, call_node)
         joined = join_content_to_fixpoint(mutations, seeds, build_block_entry_scope(call_node, block), shadows)
         rewrites = local_rewrites(block.body) { |receiver, ancestors| receiver.depth > scope_nesting(ancestors) }
         joined.reduce(post_scope) do |acc, (name, type)|
-          acc.with_mutated_local(name, rewritten_capture(type, seeds[name], rewrites.fetch(name, NO_REWRITES)))
+          bind_mutated_capture(acc, name, rewritten_capture(type, seeds[name], rewrites.fetch(name, NO_REWRITES)))
+        end
+      end
+
+      # `scope` with a capture the block mutated in place bound to its joined or floored content: a local through
+      # `Scope#with_mutated_local`, which keeps the marks a source-level write drops, and an instance variable, class
+      # variable or global through {CapturedLocals.bind}, which keeps an ivar's optimistic nil-freeness mark. The
+      # binding still names the same object.
+      def bind_mutated_capture(scope, name, type)
+        CapturedLocals.local_name?(name) ? scope.with_mutated_local(name, type) : CapturedLocals.bind(scope, name, type)
+      end
+
+      # `scope` with a content seam's working binding for `name` — its join so far, or `Dynamic[top]` for a read the
+      # body rebinds — whatever kind of variable it is.
+      def bind_capture_slot(scope, name, type)
+        case CapturedLocals.variable_kind(name)
+        when :local then scope.with_local(name, type)
+        when :ivar then scope.with_ivar(name, type)
+        else CapturedLocals.bind(scope, name, type)
         end
       end
 
@@ -5240,19 +7640,29 @@ module Rigor
 
       # The {RewriteMutation} names `root` calls on each local its block admits — `a.map!(&:to_s)` beside an `a << x`.
       # The receiver test is the one the caller's content-mutation walk applies.
-      def local_rewrites(root)
+      def local_rewrites(root, &)
         rewrites = {}
         Source::NodeWalker.each_with_ancestors(root) do |node, ancestors|
           next unless node.is_a?(Prism::CallNode) && RewriteMutation.rewriter?(node.name)
 
           receiver = node.receiver
-          next unless receiver.is_a?(Prism::LocalVariableReadNode) && yield(receiver, ancestors)
+          next unless rewritten_capture_receiver?(receiver, ancestors, &)
 
           (rewrites[receiver.name] ||= []) << node.name
         end
         rewrites
       end
 
+      # A local the caller's test admits, or an instance variable, class variable or global outside a body that makes
+      # it another variable ({#under_scope_body?}): the names the content walks can collect.
+      def rewritten_capture_receiver?(receiver, ancestors)
+        case receiver
+        when Prism::LocalVariableReadNode then yield(receiver, ancestors)
+        when *NON_LOCAL_READ_NODES then !under_scope_body?(ancestors, CapturedLocals.variable_kind(receiver.name))
+        else false
+        end
+      end
+
       # The slice-C join (and the loop seam's) rebuilds a collection from its SEED, so the rewrite the body's own
       # widening applied is gone from it: `a = [1]; [0].each { a.map!(&:to_s); a << "x" }` read `Array["x" | 1]`, and
       # `a[0] == "1"` folded always-falsey. Each rewrite the body makes on the local is re-applied here, on the seam's
@@ -5279,10 +7689,14 @@ module Rigor
       # - joined with the block-entry typing, it still stores exit values no store reads;
       # - one more walk of the body to the store inherits every gap in the engine's in-body flow.
       #
+      # An instance variable the body rebinds is one too (issue #1235): `@total += x; out << @total` stored the
+      # pre-call `@total`, and so are a class variable and a global (issue #3096). Each counts on the terms the content
+      # walk takes one ({#capturable_non_local?}).
+      #
       # See ADR-56 WD2.13.
-      def shadow_rebound_reads(block, sites, seeds, shadows)
+      def shadow_rebound_reads(block, sites, seeds, shadows, call_node)
         entry_names = scope.locals.keys | CapturedLocals.introduced_locals(block).to_a
-        written = scope_local_writes(block) & entry_names
+        written = (scope_local_writes(block) & entry_names) | rebound_capturable_non_locals(block, call_node)
         return if written.empty?
 
         sites.each do |name, nodes|
@@ -5296,6 +7710,23 @@ module Rigor
         end
       end
 
+      # The instance variables, class variables and globals the block body writes that {#capturable_non_local?}
+      # accepts; no instance variable for a block that runs on another object. Every self-rebinding call classifies
+      # `:unknown` today, so neither content seam that calls this meets one; the guard keeps the answer right should
+      # the escape analysis learn to call one non-escaping.
+      def rebound_capturable_non_locals(block, call_node)
+        return NO_REWRITES if block.body.nil?
+
+        foreign = foreign_self_block?(call_node)
+        names = []
+        Source::NodeWalker.each_with_ancestors(block.body) do |node, ancestors|
+          next unless CapturedLocals::NON_LOCAL_WRITE_NODES.include?(node.class)
+
+          names << node.name if capturable_non_local?(node.name, ancestors, scope, foreign_self: foreign)
+        end
+        names.uniq
+      end
+
       # The locals a store reads to build what it stores. An Array index write's index arguments are left out, and so
       # is any name they read: the join classifies the store as an element or a splice from the index's type, and a
       # `Dynamic` index reads as both, so `grid[i] = [x, x]` would join `x` itself as a member of `grid` beside the
@@ -5334,6 +7765,29 @@ module Rigor
       SCOPE_BODY_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
       private_constant :SCOPE_BODY_NODES
 
+      CLASS_BODY_NODES = [Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      private_constant :CLASS_BODY_NODES
+
+      # The bodies under a block body where a non-local of each kind is no longer the one the block's caller sees, or
+      # does not run while the block does. A `def` body runs only when called. A class or module body is a class of
+      # its own for an instance variable and a class variable, but runs at once and reads the one global. `class <<
+      # self` keeps the enclosing class's class variables, so only an instance variable leaves there.
+      NON_LOCAL_SCOPE_BODY_NODES = {
+        ivar: SCOPE_BODY_NODES,
+        cvar: [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode].freeze,
+        global: [Prism::DefNode].freeze
+      }.freeze
+      private_constant :NON_LOCAL_SCOPE_BODY_NODES
+
+      # True when a non-local of `kind` (`:ivar`, `:cvar` or `:global`) at `ancestors` under a block body sits in a body
+      # the block defines that makes it another variable or does not run during the block
+      # ({NON_LOCAL_SCOPE_BODY_NODES}): for an instance variable, any method, class or module body, where `self` is that
+      # body's own.
+      def under_scope_body?(ancestors, kind = :ivar)
+        bodies = NON_LOCAL_SCOPE_BODY_NODES.fetch(kind)
+        ancestors.any? { |a| bodies.any? { |k| a.is_a?(k) } }
+      end
+
       # True when the local `node` names lives in the scope the walk started in or an outer one.
       def same_scope_local?(node, ancestors)
         return false if ancestors.any? { |ancestor| SCOPE_BODY_NODES.any? { |klass| ancestor.is_a?(klass) } }
@@ -5350,16 +7804,37 @@ module Rigor
       ].freeze
       private_constant :LOCAL_READ_NODES
 
-      # Every local `node` reads from the scope it sits in: a read inside an inner block of a name that block
-      # introduces is a different variable.
+      # The same for an instance variable, a class variable and a global.
+      NON_LOCAL_VALUE_READ_NODES = Set[
+        Prism::InstanceVariableReadNode,
+        Prism::InstanceVariableOperatorWriteNode,
+        Prism::InstanceVariableOrWriteNode,
+        Prism::InstanceVariableAndWriteNode,
+        Prism::ClassVariableReadNode,
+        Prism::ClassVariableOperatorWriteNode,
+        Prism::ClassVariableOrWriteNode,
+        Prism::ClassVariableAndWriteNode,
+        Prism::GlobalVariableReadNode,
+        Prism::GlobalVariableOperatorWriteNode,
+        Prism::GlobalVariableOrWriteNode,
+        Prism::GlobalVariableAndWriteNode
+      ].freeze
+      private_constant :NON_LOCAL_VALUE_READ_NODES
+
+      # Every local `node` reads from the scope it sits in, and every instance variable, class variable or global
+      # outside a nested method or class body: a read inside an inner block of a name that block introduces is a
+      # different variable. The caller intersects the answer with the names the body writes, which
+      # {#rebound_capturable_non_locals} has already filtered.
       def local_reads(node)
         return [] if node.nil?
 
         names = []
         Source::NodeWalker.each_with_ancestors(node) do |n, ancestors|
-          next unless LOCAL_READ_NODES.any? { |klass| n.is_a?(klass) }
-
-          names << n.name if same_scope_local?(n, ancestors)
+          if LOCAL_READ_NODES.any? { |klass| n.is_a?(klass) }
+            names << n.name if same_scope_local?(n, ancestors)
+          elsif NON_LOCAL_VALUE_READ_NODES.include?(n.class)
+            names << n.name unless under_scope_body?(ancestors, CapturedLocals.variable_kind(n.name))
+          end
         end
         names.uniq
       end
@@ -5445,7 +7920,7 @@ module Rigor
 
       def bind_content_joins(scope, kinds, seeds, evidence)
         kinds.reduce(scope) do |acc, (name, kind)|
-          acc.with_local(name, content_entry_binding(seeds[name], kind, name, evidence))
+          bind_capture_slot(acc, name, content_entry_binding(seeds[name], kind, name, evidence))
         end
       end
 
@@ -5478,10 +7953,23 @@ module Rigor
       #
       # Each site nested in an inner block or lambda is recorded in `shadows` with the names those blocks bind
       # themselves (see {#join_content_to_fixpoint}).
-      def captured_content_mutations(block, shadows)
+      #
+      # Issue #1208 — an instance variable is a capture too: every block made in a method shares its `self`, so `@out
+      # << x` in the body grows the method's `@out` exactly as `out << x` grows `out`. It counts on the terms
+      # {CapturedLocals.writes} takes a rebound one: bound at the call site and not on its ADR-58 declaration seed
+      # ({CapturedLocals.rebindable_ivar?}), outside a nested method or class body, and not in a block that runs on
+      # another object ({CapturedLocals.under_foreign_self_block?}, or `call_node`'s own block).
+      #
+      # Issue #3096 — a class variable and a global are captures on the same terms, less the foreign-self one: Ruby
+      # resolves a class variable lexically, and a global is the same one whatever `self` is.
+      def captured_content_mutations(block, shadows, call_node)
         mutations = Hash.new { |h, k| h[k] = [] }
+        # Every self-rebinding call classifies `:unknown` today, so this seam does not meet one; the guard keeps the
+        # ivar arm right should the escape analysis learn to call one non-escaping.
+        foreign = foreign_self_block?(call_node)
         Source::NodeWalker.each_with_ancestors(block.body) do |node, ancestors|
           name, site = content_mutation_target(node) { |receiver| receiver.depth > scope_nesting(ancestors) }
+          name, site = non_local_content_mutation_target(node, ancestors, foreign) if name.nil?
           next if name.nil?
 
           mutations[name] << site
@@ -5490,6 +7978,89 @@ module Rigor
         mutations
       end
 
+      # `[name, node]` when `node` mutates the content of an instance variable of this scope's `self`, a class
+      # variable or a global that the content seams may join ({#captured_content_mutations}), else
+      # {NO_CONTENT_MUTATION}. `foreign_self` says the seam's block runs on another object.
+      def non_local_content_mutation_target(node, ancestors, foreign_self)
+        is_call_mutator = node.is_a?(Prism::CallNode) && CONTENT_MUTATORS.include?(node.name)
+        return NO_CONTENT_MUTATION unless is_call_mutator || index_write?(node)
+
+        receiver = node.receiver
+        return NO_CONTENT_MUTATION unless NON_LOCAL_READ_NODES.include?(receiver.class)
+        return NO_CONTENT_MUTATION unless capturable_non_local?(receiver.name, ancestors, scope, foreign_self:)
+        return NO_CONTENT_MUTATION unless collection_only?(CapturedLocals.bound_type(scope, receiver.name))
+
+        [receiver.name, node]
+      end
+
+      # The receiver reads of a variable the content seams take besides a local.
+      NON_LOCAL_READ_NODES = Set[
+        Prism::InstanceVariableReadNode, Prism::ClassVariableReadNode, Prism::GlobalVariableReadNode
+      ].freeze
+      private_constant :NON_LOCAL_READ_NODES
+
+      # True when every member of `type` is an Array, a Hash or a String carrier. The non-escaping join takes an
+      # instance variable only then: it drops a seed's `nil` after a guarded mutation (#1219), so `@buf = flag ? [1] :
+      # nil; [1].each { @buf << 2 if @buf }` would lose the `nil` the runtime keeps when the block never runs it. The
+      # local spelling has the gap; an instance variable, the common lazily-initialised spelling, keeps its pre-call
+      # binding until it closes. The escaping floor takes every instance variable ({#member_content_floor}).
+      def collection_only?(type)
+        return false if type.nil?
+        return type.members.all? { |member| collection_only?(member) } if type.is_a?(Type::Union)
+
+        arrayish?(type) || hashish?(type) || UnknownStoreWidening.carrier_class(type) == "String"
+      end
+
+      # True when the non-local `name`, read or written at `ancestors` under a block body, is one the content seams
+      # take against `in_scope`: bound there ({CapturedLocals.rebindable_non_local?}, which keeps an instance
+      # variable on its declaration seed out) and outside a body the block defines that makes it another variable or
+      # runs later ({#under_scope_body?}).
+      #
+      # - An instance variable must be `self`'s: not under a block that runs on another object, nor in a seam whose
+      #   block does (`foreign_self`), nor in any method, class or module body.
+      # - A class variable resolves lexically and a global is global, so `self` does not matter to either (issue
+      #   #3096). A `def` body runs only when called, so neither counts there. A class or module body runs at once:
+      #   it reads its own class variables but the one global, so a global counts there. `class << self` keeps the
+      #   enclosing class's class variables, so a class variable counts there.
+      # - A global Ruby's own signatures declare (`$stdout`, `$;`, `$0`, the frame-local `$~` and `$_`, …) is left
+      #   alone: the interpreter owns it, and some of them read through a getter (`$0` answers a frozen copy).
+      def capturable_non_local?(name, ancestors, in_scope, foreign_self: false)
+        return false if under_scope_body?(ancestors, CapturedLocals.variable_kind(name))
+
+        non_local_of_scope?(name, ancestors, in_scope, foreign_self)
+      end
+
+      # Issue #3163 — true when the non-local `name`, mutated at `ancestors` under a block body, sits in a method the
+      # block defines and is one the content floor takes against `in_scope`. {#capturable_non_local?} leaves a `def`
+      # body out because it runs only when called, but the block may call it. The terms are that method's, less the
+      # `def` boundary:
+      #
+      # - A class or module body or a `class << self` between the block and the mutation still leaves every kind out:
+      #   a method defined there is another class's, and the walks do not ask who calls it.
+      # - An instance variable in a method defined on an explicit receiver other than `self` (`def other.m`) is that
+      #   object's. A plain `def` counts wherever it is written, so one in a class body's block, whose instance
+      #   variables are an instance's and not the class's, floors the class's too.
+      def block_defined_method_capture?(name, ancestors, in_scope, foreign_self)
+        defs = ancestors.grep(Prism::DefNode)
+        return false if defs.empty? || ancestors.any? { |a| CLASS_BODY_NODES.any? { |k| a.is_a?(k) } }
+
+        foreign_def = defs.any? { |d| !d.receiver.nil? && !d.receiver.is_a?(Prism::SelfNode) }
+        return false if foreign_def && CapturedLocals.variable_kind(name) == :ivar
+
+        non_local_of_scope?(name, ancestors, in_scope, foreign_self)
+      end
+
+      # The half of {#capturable_non_local?} that does not read the bodies between the block and the non-local.
+      def non_local_of_scope?(name, ancestors, in_scope, foreign_self)
+        case CapturedLocals.variable_kind(name)
+        when :ivar
+          return false if foreign_self || CapturedLocals.under_foreign_self_block?(ancestors, in_scope)
+        when :global
+          return false if in_scope.environment.global_for_name(name, builtin: true)
+        end
+        CapturedLocals.rebindable_non_local?(in_scope, name)
+      end
+
       def scope_nesting(ancestors)
         ancestors.count { |ancestor| scope_nesting_node?(ancestor) }
       end
@@ -5510,7 +8081,7 @@ module Rigor
         names = shadows[site]
         return scope if names.nil?
 
-        names.reduce(scope) { |acc, name| acc.with_local(name, Type::Combinator.untyped) }
+        names.reduce(scope) { |acc, name| bind_capture_slot(acc, name, Type::Combinator.untyped) }
       end
 
       # `base` binds every fixed name to its join; the moving names are rebound on each pass.
@@ -5522,7 +8093,7 @@ module Rigor
           widen: Type::Combinator.method(:widen_value_pinned),
           evaluate_body: lambda do |assumption|
             pass_entry = kinds.reduce(base) do |acc, (name, kind)|
-              acc.with_local(name, content_carrier_under(seeds[name], kind, name, assumption))
+              bind_capture_slot(acc, name, content_carrier_under(seeds[name], kind, name, assumption))
             end
             content_evidence(sites, kinds, pass_entry, shadows)
           end
@@ -5633,15 +8204,23 @@ module Rigor
         type.nil? || type.is_a?(Type::Bot) ? [] : [type]
       end
 
+      # A joined name is a local, an instance variable (#1208), a class variable or a global (#3096), so a store
+      # reading any of them moves.
+      CAPTURE_READ_NODES = Set[
+        Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, Prism::ClassVariableReadNode,
+        Prism::GlobalVariableReadNode
+      ].freeze
+      private_constant :CAPTURE_READ_NODES
+
       def store_arguments_read?(node, names)
         arguments = node.arguments
         return false if arguments.nil?
 
-        Source::NodeWalker.each(arguments).any? { |n| n.is_a?(Prism::LocalVariableReadNode) && names.include?(n.name) }
+        Source::NodeWalker.each(arguments).any? { |n| CAPTURE_READ_NODES.include?(n.class) && names.include?(n.name) }
       end
 
       # ADR-56 slice C (B3). For `recv.each_with_object(memo) { |x, acc| … }` the return is the memo object after the
-      # block has mutated it through the `acc` alias. Compute the joined memo type the same way captured- local content
+      # block has mutated it through the `acc` alias. Compute the joined memo type the same way captured-local content
       # mutations are joined: pre-state = the memo argument's type, added evidence = the content-mutator args on the
       # memo block param. Returns `call_type` unchanged for any other call, a missing block, or a memo whose pre-state
       # is not a collection.
@@ -5660,33 +8239,250 @@ module Rigor
         body = block.body
         return call_type if body.nil?
 
+        memo_after_block(call_node, call_type, memo_param, body)
+      end
+
+      # {#each_with_object_return}'s answer once the call is known to bind a memo parameter in a block with a body.
+      def memo_after_block(call_node, call_type, memo_param, body)
+        memo_arg = call_node.arguments.arguments.first
+        memo_type = scope.type_of(memo_arg, tracer: tracer)
+        pre_state = lookup_mutated_seed(body, memo_param, memo_type, MEMO_SEED_MUTATORS) do |depth, nesting|
+          depth == nesting
+        end
+        reach = memo_scan_reach(body, memo_param)
+        return content_floor_for(pre_state) || call_type if reach == :escape
+
         # The memo alias is a block-local (depth 0) — collect content mutations on it directly rather than via the
         # captured-local walk.
         shadows = {}.compare_by_identity
         calls = body_content_mutations_on(body, memo_param, shadows)
-        return call_type if calls.empty?
+        memo = if calls.empty?
+                 # Issue #2411 — a memo the block only reshapes (`m.merge!(s)`, `m.delete(k)`) answers its widened seed.
+                 pre_state.equal?(memo_type) ? call_type : pre_state
+               else
+                 join_memo_content(call_node, memo_param, calls, pre_state, shadows) || call_type
+               end
+        memo = floor_memo_callee_escapes(body, memo_param, memo)
+        reach == :values ? memo_value_floor(memo) : memo
+      end
+
+      # Issue #2411 — `memo` with its values or elements floored to `Dynamic[top]` and a Hash's keys kept: a reader's
+      # value is an element the block may then mutate where no scan sees it (`h[x] << "s"`, `v = h[:k]; v << "s"`,
+      # `h[:k][:n] = "s"`), so the join's element types are not what the memo holds. A memo whose every value or
+      # element is of a class no method mutates ({MEMO_IMMUTABLE_CLASSES}) keeps its join: `m[k] = m[k] + 1` reads an
+      # Integer, which nothing in the block can change.
+      def memo_value_floor(type)
+        return type if memo_contents_immutable?(type)
 
-        pre_state = lookup_mutated_seed(body, memo_param, scope.type_of(memo_arg, tracer: tracer)) do |depth, nesting|
-          depth == nesting
+        case type
+        when Type::Union then Type::Combinator.union(*type.members.map { |member| memo_value_floor(member) })
+        when Type::Nominal
+          return content_floor_for(type) || type unless type.class_name == "Hash" && type.type_args.size == 2
+
+          Type::Combinator.nominal_of("Hash", type_args: [type.type_args.first, Type::Combinator.untyped])
+        else content_floor_for(type) || type
+        end
+      end
+
+      # The classes whose instances no method mutates.
+      MEMO_IMMUTABLE_CLASSES = Set[
+        "Integer", "Float", "Symbol", "NilClass", "TrueClass", "FalseClass", "Rational", "Complex"
+      ].freeze
+      private_constant :MEMO_IMMUTABLE_CLASSES
+
+      # Whether every value of a Hash memo, or every element of an Array memo, is of a {MEMO_IMMUTABLE_CLASSES} class.
+      def memo_contents_immutable?(type)
+        case type
+        when Type::Union then type.members.all? { |member| memo_contents_immutable?(member) }
+        when Type::Nominal
+          slot = type.class_name == "Hash" ? 1 : 0
+          %w[Hash Array].include?(type.class_name) && !type.type_args[slot].nil? &&
+            memo_immutable_value?(type.type_args[slot])
+        when Type::Tuple then type.elements.all? { |element| memo_immutable_value?(element) }
+        when Type::HashShape then type.pairs.values.all? { |value| memo_immutable_value?(value) }
+        else false
+        end
+      end
+
+      def memo_immutable_value?(type)
+        case type
+        when Type::Union then type.members.all? { |member| memo_immutable_value?(member) }
+        when Type::Constant then MEMO_IMMUTABLE_CLASSES.include?(type.value.class.name)
+        when Type::Nominal then MEMO_IMMUTABLE_CLASSES.include?(type.class_name)
+        when Type::IntegerRange, Type::FloatRange then true
+        else false
+        end
+      end
+
+      # Issue #2411 — whether the block can change the memo where neither the join nor the callee floor sees it, so
+      # the memo answers its content floor ({#content_floor_for}) instead of the join. Read as an expression, the
+      # join's answer reaches every use of the call, and one that misses a store reports on correct code:
+      # `|x, h| g = h; g["s"] = "v"; h[:a] = 2` joined `Hash[:a, 2]`, and `.fetch("s").upcase` read `2`. Every read
+      # or write of the memo's name in its own scope ({#scope_nesting}) must be one the scan models
+      # ({#memo_read_modelled?}); a rebinding write (`h = {}`) is not, since the stores after it reach another object.
+      # Answers `:escape` for such a read or write, `:values` when the only unmodelled reads are readers whose value
+      # is used ({#memo_value_floor}), and nil when every read is modelled.
+      def memo_scan_reach(body, memo_param)
+        reach = nil
+        Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
+          next unless MEMO_NAME_NODES.any? { |klass| node.is_a?(klass) } && node.name == memo_param
+          next unless node.depth == scope_nesting(ancestors)
+
+          modelled = node.is_a?(Prism::LocalVariableReadNode) && memo_read_modelled?(node, ancestors)
+          return :escape unless modelled
+
+          reach = :values if modelled == :values
+        end
+        reach
+      end
+
+      # The nodes that read or bind a local by name. `LocalVariableTargetNode` covers a multi-assign and a `rescue =>`.
+      MEMO_NAME_NODES = [
+        Prism::LocalVariableReadNode, Prism::LocalVariableWriteNode, Prism::LocalVariableTargetNode,
+        Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableOrWriteNode, Prism::LocalVariableAndWriteNode
+      ].freeze
+      private_constant :MEMO_NAME_NODES
+
+      # The memo reads that cannot hand the object to anything the scan does not see. A call on the memo is one when
+      # it takes no block (`tap`, `each` and `then` yield it) and the scan knows the method: one whose value never is
+      # the memo ({MEMO_VALUE_READERS}), or a mutator the join or the seed widening reads ({CONTENT_MUTATORS},
+      # {MEMO_SEED_MUTATORS}) whose value, the memo for `h << x` and `h.merge!(s)`, is discarded
+      # ({#memo_value_discarded?}). Any other name is not: `h.send(:store, :t, "t")` stores what no scan sees. An index
+      # compound write on it is one. So is an argument of a self-call that resolves to a user def, whose census the
+      # callee floor reads ({#floor_memo_callee_escapes}), when the call's value is discarded: `keep(h)["s"] = "v"`
+      # stores through the value. Any other read — `g = h`, `[h]`, `Helper.fill(h, x)`, an unresolved self-call — is
+      # not.
+      def memo_read_modelled?(read, ancestors)
+        parent = ancestors.last
+        if parent.respond_to?(:receiver) && parent.receiver.equal?(read)
+          return true if INDEX_WRITE_NODES.any? { |klass| parent.is_a?(klass) }
+          return false unless parent.is_a?(Prism::CallNode) && parent.block.nil?
+
+          return memo_receiver_call_modelled?(parent, ancestors[0...-1])
+        end
+        memo_self_call_argument?(ancestors)
+      end
+
+      # True, false, or `:values` for a reader whose value is used: the value may be an element the block mutates.
+      # A mutator given a splat or `**` argument is not modelled: the join reads each argument by position, and
+      # `h.store(*kv)` stored a pair it never saw.
+      def memo_receiver_call_modelled?(call, ancestors)
+        mutator = CONTENT_MUTATORS.include?(call.name) || MEMO_SEED_MUTATORS.include?(call.name)
+        return false if mutator && memo_splat_arguments?(call)
+        return memo_value_discarded?(call, ancestors) || :values if MEMO_VALUE_READERS.include?(call.name)
+        return false unless mutator
+
+        memo_value_discarded?(call, ancestors)
+      end
+
+      def memo_splat_arguments?(call)
+        (call.arguments&.arguments || []).any? do |argument|
+          argument.is_a?(Prism::SplatNode) ||
+            (argument.is_a?(Prism::KeywordHashNode) && argument.elements.any?(Prism::AssocSplatNode))
+        end
+      end
+
+      # Methods of Hash and Array whose value is never the receiver itself, so using it hands nothing on.
+      MEMO_VALUE_READERS = Set[
+        :[], :[]=, :store, :fetch, :dig, :key?, :has_key?, :include?, :member?, :key, :value?, :has_value?,
+        :size, :length, :count, :empty?, :any?, :none?, :keys, :values, :values_at, :fetch_values, :first, :last,
+        :delete, :pop, :shift, :to_s, :inspect, :hash, :==, :!=, :eql?, :equal?, :frozen?, :nil?, :is_a?,
+        :kind_of?, :instance_of?, :respond_to?, :class, :join, :sum, :min, :max, :dup, :clone
+      ].freeze
+      private_constant :MEMO_VALUE_READERS
+
+      # Iterators whose block's value the call never reads.
+      MEMO_BLOCK_VALUE_DROPPING = Set[
+        :each, :each_with_index, :each_pair, :each_key, :each_value, :each_index, :reverse_each, :each_slice,
+        :each_cons, :each_entry, :each_char, :each_line, :each_byte, :times, :upto, :downto, :step, :loop
+      ].freeze
+      private_constant :MEMO_BLOCK_VALUE_DROPPING
+
+      # Whether `node`'s value is dropped: a statement that is not its sequence's last, or the last one of a sequence
+      # whose own value is dropped, up through `if` / `unless` arms, `begin` / `rescue` bodies and parentheses, to the
+      # `each_with_object` block body, whose value the call never answers, or to the body of a nested block whose
+      # call never reads its value ({MEMO_BLOCK_VALUE_DROPPING}: `xs.each { |y| acc << y }`). Any other block's value
+      # may be the memo handed on (`map { acc << y }`).
+      def memo_value_discarded?(node, ancestors)
+        return true if ancestors.empty?
+
+        parent = ancestors.last
+        up = ancestors[0...-1]
+        case parent
+        when Prism::StatementsNode
+          return true unless parent.body.last.equal?(node)
+
+          block = up.last
+          return memo_value_discarded?(parent, up) unless block.is_a?(Prism::BlockNode)
+
+          up[-2].is_a?(Prism::CallNode) && MEMO_BLOCK_VALUE_DROPPING.include?(up[-2].name)
+        when Prism::IfNode, Prism::UnlessNode
+          !parent.predicate.equal?(node) && memo_value_discarded?(parent, up)
+        when Prism::ElseNode, Prism::BeginNode, Prism::RescueNode, Prism::ParenthesesNode
+          memo_value_discarded?(parent, up)
+        when Prism::EnsureNode then true
+        else false
+        end
+      end
+
+      # Whether the read under `ancestors` is a positional or keyword argument of a self-call resolving to a user def.
+      # Its value must be discarded: the callee may return the memo (`def keep(h) = h`) or wrap it.
+      def memo_self_call_argument?(ancestors)
+        depth = ancestors.size - 1
+        depth -= 2 if ancestors[depth].is_a?(Prism::AssocNode) && ancestors[depth - 1].is_a?(Prism::KeywordHashNode)
+        call = ancestors[depth - 1]
+        return false unless ancestors[depth].is_a?(Prism::ArgumentsNode) && call.is_a?(Prism::CallNode)
+        return false unless self_dispatch_call?(call) && memo_value_discarded?(call, ancestors[0...(depth - 1)])
+
+        !resolve_self_callees(call).empty?
+      end
+
+      # Issue #2411 — `memo` floored as a captured local is when the block hands it to a self-call whose callee
+      # mutates it ({#floor_callee_escaped_args_for_call}, the walk {#floor_block_body_callee_captures} makes): the
+      # join reads only the stores in the block, so `|x, out| record(out, x); out[[x, :e]] = 1` joined
+      # `Hash[[Integer, :e], 1]` while `record` stored other keys, and a memo the block only passed on kept its `{}`.
+      # Every read of the memo's name counts, a nested block's parameter shadowing it included: the floor only forgets.
+      # The walk runs on an evaluator whose scope binds the memo, since the floor reads only locals its scope binds.
+      def floor_memo_callee_escapes(body, memo_param, memo)
+        StatementEvaluator.new(scope: scope.with_local(memo_param, memo), tracer: tracer)
+                          .callee_floored_local(body, memo_param)
+      end
+
+      protected
+
+      # `name` as the self-calls in `body` leave it, each flooring the arguments its callee mutates
+      # ({#floor_memo_callee_escapes}).
+      def callee_floored_local(body, name)
+        floored = scope
+        each_node_in_caller_block(body, 0) do |node, _depth|
+          floored = floor_callee_escaped_args_for_call(node, floored)
         end
-        joined = join_memo_content(call_node, memo_param, calls, pre_state, shadows)
-        joined || call_type
+        floored.local(name)
       end
 
+      private
+
       # `seed` as the {HashLookupMutation} calls `body` makes on `name` leave it. They add no content, so the join
       # never sees them as sites, and a seed read before `widen_after_block` is still the closed shape whose known
       # values answer every missing key: `b = { a: 1 }; [1].each { b.default = 0; b[:c] = 2 }` read `b[:zz]` as
       # `1 | 2`, and so did an `each_with_object({})` memo given a default beside its stores, and a `while` body. The
       # block receives a read's `depth` and its enclosing block count, and says whether the read is the variable
-      # `seed` describes. A `def` opens a scope of its own, so nothing under one is.
-      def lookup_mutated_seed(body, name, seed)
+      # `seed` describes. A `def` opens a scope of its own, so nothing under one is. `mutators` widens the call names
+      # read; the `each_with_object` memo passes {MEMO_SEED_MUTATORS}.
+      def lookup_mutated_seed(body, name, seed, mutators = HashLookupMutation::MUTATORS)
         Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
-          next unless node.is_a?(Prism::CallNode) && HashLookupMutation::MUTATORS.include?(node.name)
+          next unless node.is_a?(Prism::CallNode) && mutators.include?(node.name)
           next if ancestors.any?(Prism::DefNode)
 
           receiver = node.receiver
-          next unless receiver.is_a?(Prism::LocalVariableReadNode) && receiver.name == name
-          next unless yield(receiver.depth, scope_nesting(ancestors))
+          case receiver
+          when Prism::LocalVariableReadNode
+            next unless receiver.name == name && yield(receiver.depth, scope_nesting(ancestors))
+          when Prism::InstanceVariableReadNode, Prism::ClassVariableReadNode, Prism::GlobalVariableReadNode
+            next unless receiver.name == name && capturable_non_local?(name, ancestors, scope)
+          else
+            next
+          end
 
           seed = MutationWidening.widen_for_mutator(seed, node.name) || seed
         end
@@ -5699,11 +8495,11 @@ module Rigor
       # write.
       def join_memo_content(call_node, memo_param, calls, pre_state, shadows)
         block = call_node.block
-        captured = captured_content_mutations(block, shadows)
-        seeds = captured.keys.to_h { |name| [name, scope.local(name)] }
+        captured = captured_content_mutations(block, shadows, call_node)
+        seeds = captured.keys.to_h { |name| [name, CapturedLocals.bound_type(scope, name)] }
         seeds[memo_param] = pre_state
         sites = captured.merge(memo_param => calls)
-        shadow_rebound_reads(block, sites, seeds, shadows)
+        shadow_rebound_reads(block, sites, seeds, shadows, call_node)
         join_content_to_fixpoint(sites, seeds, build_block_entry_scope(call_node, block), shadows)[memo_param]
       end
 
@@ -5723,21 +8519,19 @@ module Rigor
         second.respond_to?(:name) ? second.name : nil
       end
 
-      # Content-mutator calls on the block-local `var_name` within `body` — directly, or from a nested block that
-      # reaches it by exactly the scopes it is nested in. A nested block's own parameter of the same name is a
-      # different variable and does not count.
+      # Content mutations of the block-local `var_name` within `body` — directly, or from a nested block that reaches
+      # it by exactly the scopes it is nested in. A nested block's own parameter of the same name is a different
+      # variable and does not count. The sites are the ones {#captured_content_mutations} reads for a captured local
+      # ({#content_mutation_target}), the index compound writes included: scanning calls alone, `h[x] ||= []` was no
+      # store, and the memo kept its `{}`.
       def body_content_mutations_on(body, var_name, shadows)
         calls = []
         Source::NodeWalker.each_with_ancestors(body) do |descendant, ancestors|
-          next unless descendant.is_a?(Prism::CallNode)
-          next unless CONTENT_MUTATORS.include?(descendant.name)
-
-          receiver = descendant.receiver
-          next unless receiver.is_a?(Prism::LocalVariableReadNode)
-          next unless receiver.name == var_name && receiver.depth == scope_nesting(ancestors)
+          name, site = content_mutation_target(descendant) { |receiver| receiver.depth == scope_nesting(ancestors) }
+          next unless name == var_name
 
-          calls << descendant
-          record_shadows(shadows, descendant, ancestors)
+          calls << site
+          record_shadows(shadows, site, ancestors)
         end
         calls
       end
@@ -5877,6 +8671,29 @@ module Rigor
                            MutationWidening::HASH_MUTATORS)).freeze
       private_constant :CONTENT_MUTATORS
 
+      # The memo's seed widens on every shape mutator its scan does not read evidence from, as a captured local's
+      # binding does on the block seam ({MutationWidening.widen_after_block}): the {HashLookupMutation} calls, and the
+      # rewriters and removers (`merge!`, `update`, `delete`, `replace`, …) whose added content no join can read. Read
+      # off the memo argument alone, `xs.each_with_object({}) { |s, m| m.merge!(s) }` answered the empty `{}`.
+      MEMO_SEED_MUTATORS = (MutationWidening::SHAPE_MUTATORS - CONTENT_MUTATORS).freeze
+      private_constant :MEMO_SEED_MUTATORS
+
+      # Issue #2296 — the Set adders {CONTENT_MUTATORS} leaves out (`add`, `add?`, `merge`): a scan cannot see the
+      # receiver's class, and `merge` on a Hash returns a new Hash, so the callee census keeps them apart and floors
+      # only a Set argument on them.
+      SET_ONLY_ADDERS = (SetMutation::CONTENT_ADDERS - CONTENT_MUTATORS).freeze
+      private_constant :SET_ONLY_ADDERS
+
+      # Issue #2595 — every name the callee write census ({#callee_write_census}) counts as a write: the shape mutators
+      # the widening reads ({MutationWidening::SHAPE_MUTATORS}) and the content scans' own names. A Set-only adder
+      # stays out: `merge` on a Hash returns a new Hash.
+      CALLEE_WRITE_MUTATORS = (MutationWidening::SHAPE_MUTATORS | CONTENT_MUTATORS).freeze
+      # The tables {#callee_write_census} scans with.
+      CENSUS_TABLES = CalleeWriteCensus::Tables.new(mutators: CALLEE_WRITE_MUTATORS, handled: CONTENT_MUTATORS,
+                                                    fresh: FRESH_RESULTS, copiers: CENSUS_COPIERS,
+                                                    foreign_calls: METHOD_BODY_BLOCK_CALLS)
+      private_constant :CALLEE_WRITE_MUTATORS, :CENSUS_TABLES
+
       # The shared "not a content mutation" answer. This predicate runs on every node of every block, loop and
       # method body it censuses (~950k calls on the lib self-check) and almost always declines, so a fresh
       # `[nil, nil]` per decline was one of the largest allocation sites in the evaluator.
@@ -6239,7 +9056,8 @@ module Rigor
       # ({#record_closure_escape_if_any}) and a lambda literal ({#eval_lambda}) — so they cannot drift.
       def escaping_closure_captures(closure_node, post_scope, foreign_self: false)
         widen_escaping_content_captures(closure_node,
-                                        drop_captured_narrowing(closure_node, post_scope, foreign_self: foreign_self))
+                                        drop_captured_narrowing(closure_node, post_scope, foreign_self: foreign_self),
+                                        foreign_self: foreign_self)
       end
 
       # Issue #1402 — whether `call_node`'s block runs on an object that is provably not `self`
@@ -6249,6 +9067,30 @@ module Rigor
         InterveningIvarReset.foreign_self_block?(call_node, operand_scope)
       end
 
+      # The scope a block body's `self` marks start from: the statement form's opaque `self` (issue #316), or the
+      # walk's unknown-`self` mark alone (issue #1717) for the value-position block {#evaluate_block_of} enters and for
+      # every block entered beneath it. A scope carrying the unknown-`self` mark without the opaque one comes only from
+      # the index walk ({Scope#with_block_self_unknown}), so it is how a nested block knows it sits under one: the
+      # opaque mark, which declines a cross-file top-level `def`, stays off the whole value-position subtree.
+      #
+      # Issue #2861 — a block whose call provably runs it under the caller's `self` ({SelfPreservingBlock}:
+      # `rows.map { … }`) enters with no opaque mark the caller's scope does not already carry
+      # ({Scope#entering_self_preserving_block}).
+      def block_self_entry(block_node, call_node = nil)
+        walked = block_node.equal?(@value_position_block) || scope.walked_block_self_unknown?
+        return scope.with_block_self_unknown(true) if walked
+        return scope.entering_self_preserving_block if self_preserving_block?(call_node)
+
+        scope.entering_opaque_block
+      end
+
+      def self_preserving_block?(call_node)
+        return false if call_node.nil? || call_node.receiver.nil?
+
+        SelfPreservingBlock.call?(call_node, explicit_receiver_type(call_node), scope,
+                                  classification: classify_closure_escape(call_node))
+      end
+
       # Builds the entry scope for a block body. The block sees the outer scope's locals (Ruby's lexical scoping rule)
       # and adds bindings for every named block parameter on top. Parameter types come from the receiving method's RBS
       # signature when one is available; the rest default to `Dynamic[Top]`.
@@ -6263,7 +9105,8 @@ module Rigor
         # yielding method, not the lexical context, decides what `self` is, and Rigor does not track it.
         # Issue #1358 — a body that may run a match reads the match globals an earlier iteration may have rebound
         # ({MatchRebinding.block_entry}).
-        entry = MatchRebinding.block_entry(scope.entering_opaque_block, block_node, call_node)
+        entry = MatchRebinding.block_entry(block_self_entry(block_node, call_node), block_node, call_node)
+        entry = entry.entering_block_without_gradual_marks(block_node)
         scope_with_params = BlockParameterBinder.new(expected_param_types: expected).bind_onto(block_node, entry)
         # ADR-16 Tier A — a plugin `block_as_methods:` entry that matches `(receiver, name)` narrows the
         # body's `self` to the object the DSL `instance_eval`s the block on (`params` on
@@ -6399,7 +9242,8 @@ module Rigor
           # def's contract; it binds its parameters as an undeclared method does.
           class_path: @class_context.last&.refinement ? nil : current_class_path,
           singleton: singleton,
-          source_path: scope.source_path
+          source_path: scope.source_path,
+          scope: scope
         )
         bindings = binder.bind(def_node)
         # ADR-67 WD3 — override an undeclared parameter with its call-site inferred type (precision-additive; an
@@ -6484,7 +9328,7 @@ module Rigor
       # True for the `Dynamic[Top]` carrier `MethodParameterBinder` leaves on an undeclared parameter — the only
       # bindings ADR-67 WD3 overrides.
       def untyped_binding?(type)
-        type.is_a?(Type::Dynamic) && type.static_facet.is_a?(Type::Top)
+        Type::Combinator.untyped?(type)
       end
 
       def seed_instance_ivars(body_scope, singleton:)
@@ -6696,8 +9540,13 @@ module Rigor
       # nested body, so this handler only ever appends a return that genuinely exits the method currently being
       # inferred.
       def eval_return(node)
-        sink = Thread.current[RETURN_SINK_KEY]
-        sink&.record(node, jump_value_type(node))
+        state = typing_state
+        sink = state[RETURN_SINK]
+        if sink
+          type = jump_value_type(node)
+          state.touch(RETURN_SINK)
+          sink.record(node, type, state[PROVISIONAL_RETURNS])
+        end
         [Type::Combinator.bot, scope]
       end
 
@@ -6711,8 +9560,13 @@ module Rigor
       # dead arm), so the join is flow-sensitive for free: `[1, 2].map { |x| next nil if x.nil?; x.to_s }` keeps its
       # exact per-element answer.
       def eval_next(node)
-        sink = Thread.current[NEXT_SINK_KEY]
-        sink << [node, jump_value_type(node)] if sink
+        state = typing_state
+        sink = state[NEXT_SINK]
+        if sink
+          type = jump_value_type(node)
+          state.touch(NEXT_SINK)
+          sink << [node, type]
+        end
         @next_scope_sink << [node, jump_scope(node)] if @next_scope_sink
         [Type::Combinator.bot, scope]
       end
@@ -6738,10 +9592,19 @@ module Rigor
       # break-value sink for `ExpressionTyper#call_dispatch_type_for` to union in. Both sinks are optional and
       # independent — a loop body collects scopes while an enclosing call collects values from the same walk.
       def eval_break(node)
-        sink = Thread.current[BREAK_SINK_KEY]
-        sink << [node, jump_scope(node)] if sink
-        value_sink = Thread.current[BREAK_VALUE_SINK_KEY]
-        value_sink << [node, jump_value_type(node)] if value_sink
+        state = typing_state
+        sink = state[BREAK_SINK]
+        if sink
+          jump = jump_scope(node)
+          state.touch(BREAK_SINK)
+          sink << [node, jump]
+        end
+        value_sink = state[BREAK_VALUE_SINK]
+        if value_sink
+          type = jump_value_type(node)
+          state.touch(BREAK_VALUE_SINK)
+          value_sink << [node, type]
+        end
         [Type::Combinator.bot, scope]
       end
 
@@ -6847,6 +9710,39 @@ module Rigor
           branch_type.is_a?(Type::Bot)
       end
 
+      # Issue #1230 — a strict, syntactic-only exit test for the then-exits-beside-an-else arm ({#if_join}). The
+      # branch's last statement is a `return` / `next` / `break`; a receiver-less `raise` / `fail` /
+      # `exit` / `exit!` / `abort` / `throw` whose name no project file defines on any class or module, at the top level
+      # or by `define_method` ({Scope#project_method_name?}); or an if / unless / case with an else whose every arm
+      # certainly exits. A `redo` / `retry` does not: it re-runs a loop body or a `begin` that reads the branch's
+      # writes. Unlike {#branch_terminates?} it reads no type, so a `bot`-typed helper call does not qualify:
+      # the typer types a call to an overridable or Kernel-shadowing project method `bot` (issue #3110).
+      def branch_certainly_exits?(node)
+        case node
+        when Prism::ReturnNode, Prism::NextNode, Prism::BreakNode then true
+        when Prism::CallNode then certain_exit_call?(node)
+        when Prism::StatementsNode then branch_certainly_exits?(node.body.last)
+        when Prism::ParenthesesNode then branch_certainly_exits?(node.body)
+        when Prism::ElseNode then branch_certainly_exits?(node.statements)
+        when Prism::IfNode, Prism::UnlessNode
+          branch_certainly_exits?(node.statements) && branch_certainly_exits?(node_else_branch(node))
+        when Prism::CaseNode, Prism::CaseMatchNode then case_certainly_exits?(node)
+        else false
+        end
+      end
+
+      def certain_exit_call?(node)
+        node.receiver.nil? && CERTAIN_EXIT_NAMES.include?(node.name) && !scope.project_method_name?(node.name)
+      end
+
+      def case_certainly_exits?(node)
+        !node.else_clause.nil? && branch_certainly_exits?(node.else_clause) &&
+          node.conditions.all? { |arm| branch_certainly_exits?(arm.statements) }
+      end
+
+      CERTAIN_EXIT_NAMES = %i[raise fail exit exit! abort throw].freeze
+      private_constant :CERTAIN_EXIT_NAMES
+
       def eval_branch_or_nil(branch_node, branch_scope, on_enter: @on_enter)
         return [Type::Combinator.constant_of(nil), branch_scope] if branch_node.nil?
 
@@ -6899,6 +9795,8 @@ module Rigor
           scope.with_ivar(ref.name, exception_type).without_ivar_guard(ref.name)
         when Prism::GlobalVariableTargetNode
           scope.with_global(ref.name, exception_type)
+        when Prism::ClassVariableTargetNode
+          scope.with_cvar(ref.name, exception_type)
         when Prism::IndexTargetNode
           widen_index_target(ref, exception_type, scope, type_scope: scope)
         else
@@ -6906,20 +9804,11 @@ module Rigor
         end
       end
 
-      # Derives the exception instance type for a `RescueNode`. When the exceptions list is empty (bare `rescue`) the
-      # type is `StandardError`. When one or more exception classes are named the types are unioned. A class that
-      # cannot be resolved to a `Singleton` type contributes `Dynamic[top]`.
+      # Derives the exception instance type for a `RescueNode` ({ErrorInfo.rescue_exception_type}): `StandardError` for
+      # a bare `rescue`, else the union of the named classes' instances, with `Dynamic[top]` for one that does not
+      # resolve to a `Singleton`.
       def rescue_exception_type(rescue_node, scope)
-        exceptions = rescue_node.exceptions
-        if exceptions.empty?
-          Type::Combinator.nominal_of("StandardError")
-        else
-          types = exceptions.map do |exc_node|
-            singleton_type, = sub_eval(exc_node, scope)
-            singleton_to_nominal(singleton_type)
-          end
-          Type::Combinator.union(*types)
-        end
+        ErrorInfo.rescue_exception_type(rescue_node) { |exception_node| sub_eval(exception_node, scope).first }
       end
 
       # --------------------------------------------------------------- `case/in` pattern variable binding helpers
@@ -6931,7 +9820,27 @@ module Rigor
       # `deconstruct` / `deconstruct_keys` dispatch reads for its freshness gate.
       def apply_in_pattern_bindings(subject_type, subject_node, pattern, scope)
         bindings = collect_in_pattern_bindings(subject_type, pattern, scope, subject_node: subject_node)
-        bindings.reduce(scope) { |s, (name, type)| s.with_local(name, type) }
+        bound = bindings.reduce(scope) { |s, (name, type)| s.with_local(name, type) }
+        marked = subject_node.is_a?(Prism::LocalVariableReadNode) && scope.gradual_narrowing?(subject_node.name)
+        mark_gradual_class_capture(subject_type, pattern, bound, marked: marked)
+      end
+
+      # Issue #2656 — `in C => y` over a `Dynamic` subject binds `y` to `C`'s `Nominal`, as a class guard's edge binds
+      # the subject, and marks it as that edge marks a local ({Narrowing.mark_gradual_local}). Only a capture of
+      # the whole subject by a class or an alternation of classes is marked.
+      def mark_gradual_class_capture(subject_type, pattern, scope, marked: false)
+        return scope unless pattern.is_a?(Prism::CapturePatternNode) && class_capture_value?(pattern.value)
+
+        name = pattern.target.name
+        Narrowing.mark_gradual_local(scope, name, subject_type, scope.local(name), marked: marked)
+      end
+
+      def class_capture_value?(value)
+        case value
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then true
+        when Prism::AlternationPatternNode then class_capture_value?(value.left) && class_capture_value?(value.right)
+        else false
+        end
       end
 
       # Returns an array of `[Symbol, Rigor::Type]` pairs for every variable captured by `pattern`, typed against the
@@ -7311,7 +10220,8 @@ module Rigor
         floor = Type::Combinator.untyped
         walks.first.map do |name, _type|
           types = walks.map { |walk| walk.assoc(name)&.last }
-          [name, types.any? { |type| type.nil? || type == floor } ? floor : Type::Combinator.union(*types)]
+          floored = types.any? { |type| type.nil? || Type::Combinator.untyped?(type) }
+          [name, floored ? floor : Type::Combinator.union(*types)]
         end
       end