rigortype 0.4.7 → 0.4.8

data/lib/rigor/inference/expression_typer.rb

@@ -11,6 +11,8 @@ require_relative "../source/node_children"
 require_relative "../source/node_walker"
 require_relative "../analysis/self_call_resolution_recorder"
 require_relative "../run_scoped_slots"
+require_relative "../typing_state"
+require_relative "../type_of_memo"
 require_relative "block_call_timing"
 require_relative "block_repetition"
 require_relative "project_yielder"
@@ -20,6 +22,7 @@ require_relative "body_fixpoint"
 require_relative "budget_trace"
 require_relative "captured_locals"
 require_relative "closure_escape_analyzer"
+require_relative "self_preserving_block"
 require_relative "receiver_blind_block"
 require_relative "def_node_resolver"
 require_relative "dynamic_origin"
@@ -41,6 +44,7 @@ require_relative "mutation_widening"
 require_relative "narrowing"
 require_relative "optimistic_origin"
 require_relative "receiver_alias"
+require_relative "recursion_rebinding"
 require_relative "repeated_or_writes"
 require_relative "singleton_object_constant"
 require_relative "refined_dispatch"
@@ -260,17 +264,36 @@ module Rigor
         @typing_node = typing_node
       end
 
+      # ADR-129 WD2 — the calling thread's {TypingState::State}, cached on the typer the first time a slot is read, so
+      # a later read is an ivar and an array index rather than a `Thread.current` lookup. A typer lives for one query on
+      # one thread; an object kept across threads must not keep one (see {Analysis::IncrementalSession}'s effects
+      # evaluator), or it would write into a state whose thread's {RunScopedSlots.release} has already run. A frame
+      # install whose block's value is the answer calls {TypingState.current} instead: Rigor's own analysis does not
+      # adopt this memoised reader's type at a self-call (#525's self-purity), so the install's answer would read as
+      # `Dynamic` through it.
+      def typing_state = @typing_state ||= TypingState.current
+
       def type_of(node)
         previous = @typing_node
         @typing_node = node
+        # ADR-129 G1′: under the audit, the Frame declarations are asserted around every `type_of`.
+        audited = MemoAudit.enabled?
+        MemoAudit.enter_type_of if audited
         result = if FlowTracer.active?
                    FlowTracer.trace_node(node) { untraced_type_of(node) }
+                 elsif TypeOfMemo.enabled? && @tracer.nil? && @operand_types.nil?
+                   # ADR-129 stage 3 — the shadow memo (G1); shut under a tracer and for a typer with instance state.
+                   state = typing_state
+                   TypeOfMemo.shadow(state, scope, node, callee: !state.stack(INFERENCE_GUARD).empty?) do
+                     untraced_type_of(node)
+                   end
                  else
                    untraced_type_of(node)
                  end
         result
       ensure
         @typing_node = previous
+        MemoAudit.leave_type_of if audited
       end
 
       def untraced_type_of(node)
@@ -299,8 +322,10 @@ module Rigor
       # unchanged before skipping the callee's symbol dependents. nil for an abstract / bodyless def, or when
       # the memo refuses a transient result — the caller treats either as "not provably stable" (keeps the
       # dependents), the conservative direction.
-      def return_type_for(def_node, receiver, arg_types)
-        infer_user_method_return(def_node, receiver, arg_types)
+      #
+      # Issue #1237 — `positionals_unknown:` re-drives a key a splat call observed, binding it the way that call did.
+      def return_type_for(def_node, receiver, arg_types, positionals_unknown: false)
+        infer_user_method_return(def_node, receiver, arg_types, positionals_unknown: positionals_unknown)
       end
 
       # The `receiver[args]` read a compound index write performs before it stores (`c[k] += v` reads `c[k]`),
@@ -317,7 +342,7 @@ module Rigor
       # `name` anyway. Minting a `Prism::CallNode` for the read would hand plugins a node that is not in the
       # tree, through a constructor whose field list changed inside the `prism` range the gemspec accepts.
       def implicit_index_read_type(node, receiver, arg_types)
-        return splat_index_read_type(node, receiver, arg_types) if node.arguments&.arguments&.any?(Prism::SplatNode)
+        return splat_index_read_type(node, receiver, arg_types) if splat_arguments?(node)
 
         try_overriding_def_dispatch(node, receiver, arg_types, method_name: :[]) ||
           index_read_dispatch(node, receiver, arg_types) ||
@@ -342,36 +367,59 @@ module Rigor
         recorded = self.class.recorded_inject_accumulator(block, scope)
         return recorded if recorded
 
-        try_block_inject_fold(call_node, receiver, arg_types)
+        # ADR-129 WD1 — a read-through Table's miss: writing another Table from it touches.
+        typing_state.memo_miss(INJECT_ACCUMULATOR) { try_block_inject_fold(call_node, receiver, arg_types) }
         self.class.recorded_inject_accumulator(block, scope)
       end
 
-      INJECT_ACCUMULATOR_KEY = RunScopedSlots.register(:__rigor_inject_accumulator__)
-      private_constant :INJECT_ACCUMULATOR_KEY
+      # ADR-129 WD1 — a Table, and a read-through cache of the computation's own value: a record read back answers
+      # what typing the call again from the same scope would compute.
+      INJECT_ACCUMULATOR = TypingState.table(
+        :inject_accumulator,
+        run_scoped: true, read_through: true, entries: TypingState::WeakKeyMapEntries,
+        reason: "keyed by block node; a read-through cache of the fold that the call's own typing computes"
+      )
+      private_constant :INJECT_ACCUMULATOR
 
       # The accumulator type {#record_inject_accumulator} stored for `block` when the call was typed from `scope`
-      # itself (by identity), else nil.
+      # itself (by identity) in the current ADR-55 summary generation (#2767, {LoopValueRecord.generation}), else nil.
       def self.recorded_inject_accumulator(block, scope)
-        slot = Thread.current[INJECT_ACCUMULATOR_KEY]&.[](block)
-        slot && slot[0].equal?(scope) ? slot[1] : nil
+        state = TypingState.current
+        slot = state[INJECT_ACCUMULATOR]&.[](block)
+        state.log_read(INJECT_ACCUMULATOR, block, slot || TypingState::ABSENT)
+        slot && slot[0].equal?(scope) && slot[2] == LoopValueRecord.generation ? slot[1] : nil
       end
 
       # ADR-89 WD2 — the current run's return memo bucket as `{ def_node => [MemoEntry, …] }` (only entries
       # that carry a call descriptor, i.e. every stored entry). Read by the incremental session right after a
       # recording run to harvest each analyzed callee's observed call keys → return descriptors. Returns an
-      # empty hash when no bucket exists (a run that memoised nothing). Class method: the bucket lives on
-      # `Thread.current`, independent of any one `ExpressionTyper` instance.
+      # empty hash when no bucket exists (a run that memoised nothing). Class method: the bucket lives in the thread's
+      # {TypingState}, independent of any one `ExpressionTyper` instance.
       #
       # `bucket` defaults to the calling thread's current one; `Runner#run` keeps the bucket its run filled
       # ({.current_return_memo}) and passes it, since the run releases the thread's slot when it ends.
+      #
+      # Issue #3160 — the entries are what the memo STORED. A def one of whose calls it refused to store was observed
+      # under a key no entry lists; {.return_memo_refused?} says which.
       def self.harvest_return_memo(bucket = current_return_memo)
         return {} if bucket.nil?
 
-        bucket.transform_values(&:values)
+        bucket.transform_values { |per_def| per_def.except(RETURN_MEMO_REFUSED).values }
+      end
+
+      # Issue #3160 — whether `bucket` served a result of `def_node` that it refused to store (ADR-84 WD3). That
+      # result reached its caller, so the def's stored entries are not every key it was observed under.
+      def self.return_memo_refused?(bucket, def_node)
+        bucket&.[](def_node)&.key?(RETURN_MEMO_REFUSED) || false
       end
 
+      # Issue #3160 — the per-def key under which {#consult_and_store_return_memo} notes that it served a result it
+      # did not store. No call descriptor is a Symbol, so it never meets a real key.
+      RETURN_MEMO_REFUSED = :refused
+      private_constant :RETURN_MEMO_REFUSED
+
       # The calling thread's return memo bucket (`{ def_node => { descriptor => MemoEntry } }`), or nil.
-      def self.current_return_memo = Thread.current[RETURN_MEMO_KEY]&.last
+      def self.current_return_memo = TypingState.current[RETURN_MEMO]&.last
 
       # Issue #720 — the value the block passed by the call site currently being re-typed evaluates to, or
       # `nil` outside such a frame. Read by {#type_of_yield}.
@@ -381,22 +429,19 @@ module Rigor
       # inference rebuilds freely. It is installed unconditionally — with `nil` — at every user-method
       # inference frame, so a callee reached WITHOUT a block from inside a yielding body cannot read its
       # caller's block.
-      YIELD_VALUE_KEY = :__rigor_yield_value_type__
-      private_constant :YIELD_VALUE_KEY
+      YIELD_VALUE = TypingState.frame(
+        :yield_value_type, reason: "the caller's block value, installed per frame",
+                           witness: "spec/fixtures/typing_state_witnesses/yield_value_type.rb"
+      )
+      private_constant :YIELD_VALUE
 
       def self.current_yield_value_type
-        Thread.current[YIELD_VALUE_KEY]
+        TypingState.current[YIELD_VALUE]
       end
 
       # Runs `block` with `type` installed as the frame's yield value, restoring the previous frame on exit.
-      def self.with_yield_value_type(type)
-        previous = Thread.current[YIELD_VALUE_KEY]
-        Thread.current[YIELD_VALUE_KEY] = type
-        begin
-          yield
-        ensure
-          Thread.current[YIELD_VALUE_KEY] = previous
-        end
+      def self.with_yield_value_type(type, &)
+        TypingState.current.with(YIELD_VALUE, type, &)
       end
 
       # Issue #1125 — the argument types of the call currently being re-typed into the body being walked,
@@ -404,37 +449,48 @@ module Rigor
       # `m` itself was called with, so {#call_arg_types} expands the forwarding node to THIS list instead of
       # the `Dynamic[top]` a bare `Prism::ForwardingArgumentsNode` types as.
       #
-      # A thread-local for the same reason the yield value is (see {YIELD_VALUE_KEY}): `...` names the
+      # A thread-local for the same reason the yield value is (see {YIELD_VALUE}): `...` names the
       # frame's caller, not a binding, and the body is walked through scopes the inference rebuilds freely.
       # It is installed unconditionally — with nil — at every user-method inference frame, so a body reached
       # without `...` cannot read its caller's argument list. Because each frame installs its OWN list, a
       # chain `a(...) -> b(...) -> c(...)` threads through: `b`'s frame holds the types `a` expanded and
       # `c`'s holds `b`'s. The list is the callee's call-site `arg_types`, which is what keeps the ADR-84
       # return memo's `(def_node, receiver, arg_types)` key complete for a forwarding def.
-      FORWARDED_ARGS_KEY = :__rigor_forwarded_call_arg_types__
-      private_constant :FORWARDED_ARGS_KEY
+      FORWARDED_ARGS = TypingState.frame(:forwarded_call_arg_types,
+                                         reason: "the caller's frozen argument list, installed per frame",
+                                         witness: "spec/fixtures/typing_state_witnesses/forwarded_call_arg_types.rb")
+      private_constant :FORWARDED_ARGS
 
       def self.current_forwarded_arg_types
-        Thread.current[FORWARDED_ARGS_KEY]
+        TypingState.current[FORWARDED_ARGS]
       end
 
-      # Runs `block` with `types` installed as the frame's forwarded argument list, restoring the previous
+      # Runs `block` with `types` (frozen) installed as the frame's forwarded argument list, restoring the previous
       # frame on exit.
-      def self.with_forwarded_arg_types(types, &block)
-        previous = Thread.current[FORWARDED_ARGS_KEY]
-        Thread.current[FORWARDED_ARGS_KEY] = types
-        begin
-          block.call
-        ensure
-          Thread.current[FORWARDED_ARGS_KEY] = previous
-        end
+      def self.with_forwarded_arg_types(types, &)
+        TypingState.current.with(FORWARDED_ARGS, types, &)
       end
 
       # The two call-site channels a user-method body may read from its caller — the block a `yield`
       # reaches ({#with_yield_value_type}) and the argument list `...` re-supplies
       # ({#with_forwarded_arg_types}) — installed together, both even when nil, for exactly one frame.
+      #
+      # The frame also clears the reflective-ivar repeat depth ({ReflectiveIvarWrite.in_repeating_body}): it says
+      # the CALLER's loop body is walked once for many runs, while the callee's body starts from its own scope and
+      # reads its own write. The depth only widens and the return memo's key has no term for it, so a body first
+      # reached from a `for` body stored a wider return that every later caller was served. It clears the caller's
+      # jump sinks and retry frames too ({StatementEvaluator.outside_caller_sinks}): a `next`, `break` or raise point
+      # in the callee's body is never the caller's, and a recursive re-walk of the caller's own block otherwise
+      # recorded the callee's arms into it. The block-body
+      # threading suppression is the same kind of caller flag and is NOT cleared here (issue #2782): it is what
+      # keeps a fold from nesting through callee frames, and clearing it re-walked unstorable frames
+      # exponentially, while keying the memo on it cost a fifth of `lib`'s allocations.
       def self.with_call_site_frame(yield_type, forwarded_arg_types, &)
-        with_yield_value_type(yield_type) { with_forwarded_arg_types(forwarded_arg_types, &) }
+        ReflectiveIvarWrite.outside_repeating_body do
+          StatementEvaluator.outside_caller_sinks do
+            TypingState.current.with_pair(YIELD_VALUE, yield_type, FORWARDED_ARGS, forwarded_arg_types, &)
+          end
+        end
       end
 
       private
@@ -1058,7 +1114,7 @@ module Rigor
       # optimistic-carrier decline) and one terminating-arm rule, and cannot drift apart again. Only the
       # value is read; the post-scope belongs to whichever walk owns the statement.
       def type_of_conditional(node)
-        LoopValueRecord.fetch(node, scope) || scope.evaluate(node, tracer: tracer).first
+        LoopValueRecord.fetch(node, scope) || LoopValueRecord.miss { scope.evaluate(node, tracer: tracer).first }
       end
 
       def type_of_else(node)
@@ -1289,7 +1345,7 @@ module Rigor
       def type_of_loop(node)
         return Type::Combinator.constant_of(nil) if break_free_condition_loop?(node)
 
-        LoopValueRecord.fetch(node, scope) || scope.evaluate(node, tracer: tracer).first
+        LoopValueRecord.fetch(node, scope) || LoopValueRecord.miss { scope.evaluate(node, tracer: tracer).first }
       end
 
       def break_free_condition_loop?(node)
@@ -1326,7 +1382,7 @@ module Rigor
       # to bare `Nominal[Range]` when no endpoint contributes a typable shape.
       def nominal_range_for_endpoints(left_node, right_node)
         endpoints = [left_node, right_node].compact.map { |n| range_endpoint_element_type(n) }
-        endpoints.reject! { |t| t.equal?(Type::Combinator.untyped) }
+        endpoints.reject! { |t| Type::Combinator.untyped?(t) }
         return Type::Combinator.nominal_of("Range") if endpoints.empty?
 
         Type::Combinator.nominal_of("Range", type_args: [Type::Combinator.union(*endpoints)])
@@ -1562,13 +1618,20 @@ module Rigor
       # engine walks can enumerate: a plugin's `dynamic_return` answer and the ADR-16 synthetic-method
       # index. They are members of `self` exactly as an `attr_reader` is, so a top-level `def` must not
       # bind ahead of them either.
+      #
+      # Issue #2861 — a bind the #316 gate declines answers `Dynamic[Top]`, never the RBS method of the same name: the
+      # block's real `self` reaches either a same-named method of its own or the top-level `def`, which shadows
+      # `Kernel#format` and every other `Object` / `Kernel` method on the way. Falling through typed
+      # `format(r).bit_length` against `Kernel#format`'s `String` on code that runs the project's `def format`.
       def try_local_def_dispatch(node, receiver, arg_types, block_type = nil)
-        local_def = node.receiver.nil? ? scope.bindable_top_level_def_for(node.name) : nil
-        return nil unless local_def
+        return nil unless node.receiver.nil?
+
+        local_def = scope.bindable_top_level_def_for(node.name)
+        return declined_top_level_def_answer(node) if local_def.nil?
         return nil if self_type_answers?(node.name)
         return nil if plugin_member_answers?(node, receiver)
 
-        local_inference = infer_top_level_user_method(local_def, receiver, arg_types, block_type)
+        local_inference = infer_top_level_user_method(local_def, receiver, node, arg_types, block_type)
         return local_inference if local_inference
 
         # The local def matches by name but the inference was disqualified — the parameter shape is too
@@ -1580,6 +1643,16 @@ module Rigor
         dynamic_top
       end
 
+      # Issue #2861 — the answer for an implicit-self call whose top-level `def` the #316 gate declined: nil (dispatch
+      # as before) when the project defines no top-level `def` of the name, else `Dynamic[Top]`. The gate declines only
+      # where `self_type` is nil, so no member of `self` ({#self_type_answers?}, {#plugin_member_answers?}) can answer.
+      def declined_top_level_def_answer(node)
+        return nil unless scope.opaque_block_self? && scope.self_type.nil?
+        return nil if scope.top_level_def_for(node.name).nil?
+
+        dynamic_top
+      end
+
       # ADR-110 WD1 / #856 — the receiver's own `def` outranks a declaration that only an ANCESTOR carries.
       #
       # RBS resolves through the fully built method table, so `RbsDispatch` answers a subclass call with a
@@ -1712,8 +1785,15 @@ module Rigor
         return true if scope.discovered_method_through_ancestors?(class_name, method_name, :instance)
         return true if meta_member?(class_name, method_name)
         return true if resolve_user_def_through_ancestors(class_name, method_name)
+        return true if rbs_ancestor_answers?(class_name, method_name)
 
-        rbs_ancestor_answers?(class_name, method_name)
+        # Issue #2968 — a class on the chain defines methods under names no table holds (`attr_accessor(*FLAGS)`, a
+        # splatted `Struct.new(*FIELDS)`), so the name may be one of them, ahead of the top-level `def`.
+        return true if Scope::DiscoveryIndex.open_names_on_chain?(scope, class_name, :instance)
+
+        # Issue #2994 — a class on the chain mixes in a module no table names (`include(*MODS)`, `include helper`), so
+        # the name may be that module's, ahead of the top-level `def`.
+        Scope::DiscoveryIndex.unnamed_mixin_on_chain?(scope, class_name)
       end
 
       # The RBS arm of {#instance_self_answers?}. A project class is usually absent from the RBS
@@ -1740,7 +1820,13 @@ module Rigor
         return true if scope.discovered_method_through_ancestors?(class_name, method_name, :singleton)
         return true unless scope.singleton_def_through_ancestors(class_name, method_name).first.nil?
 
-        rbs_declared_on_class?(safe_rbs_method_definition(class_name, method_name, :singleton), class_name)
+        declared = safe_rbs_method_definition(class_name, method_name, :singleton)
+        return true if rbs_declared_on_class?(declared, class_name)
+
+        # Issue #2994 — a class object on the chain that a module no table names may extend through a hook (the
+        # `:include_hook` open mark of a class with `include(*MODS)`), a class that `extend(*EMODS)`s, or an extended
+        # module whose own module set is unknown, may answer any name ahead of the top-level `def`.
+        Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods).unnamed_mixin?
       end
 
       # A `Struct.new(:a, :b)` / `Data.define(:a, :b)` member accessor. The layouts are a discovery table of
@@ -1775,7 +1861,148 @@ module Rigor
       def call_type_for(node)
         return safe_navigation_call_type(node) if node.safe_navigation?
 
-        memo_object_value(node, attribute_write_value(node, call_dispatch_type_for(node)))
+        memo_object_value(node, class_test_find_value(node, attribute_write_value(node, call_dispatch_type_for(node))))
+      end
+
+      CLASS_TEST_FINDERS = Set[:find, :detect, :rfind].freeze
+      CLASS_TEST_PREDICATES = Set[:is_a?, :kind_of?, :instance_of?].freeze
+      private_constant :CLASS_TEST_FINDERS, :CLASS_TEST_PREDICATES
+
+      # Issue #2719 — `find` / `detect` / `rfind` whose block is one class test on its one parameter
+      # (`ancestors.rfind { |n| n.is_a?(Prism::DefNode) }`) returns an element that passed the test, or `nil`. The
+      # dispatched `E?` is narrowed by that test, through the same {Narrowing} rule an `if n.is_a?(C)` edge takes, and
+      # keeps its `nil`. Only an answer that already carries `nil` is narrowed, so an untyped receiver's `Dynamic`
+      # stays as it was; a test that leaves no element (`Bot`, a class the element type is disjoint from) keeps the
+      # dispatched answer too, since `nil` alone would be a verdict that the guard never matches. Any other block
+      # shape, an `ifnone` argument, and a block with more than one parameter or statement keep today's answer.
+      def class_test_find_value(node, result)
+        param = class_test_find_parameter(node)
+        return result if param.nil?
+        return result unless result.is_a?(Type::Union) && result.members.any? { |m| nil_constant?(m) }
+        return result unless element_or_nil?(node, result)
+        # A refinement in effect may replace the finder with a body whose answer only happens to read as an element
+        # or nil (`refine(Array) { def find = [2.5, 1, nil].sample }`), so the call keeps its answer.
+        return result unless scope.in_effect_refinements(node).empty?
+
+        truthy, = Narrowing.predicate_scopes(node.block.body.body.first, scope.with_local(param, result))
+        narrowed = truthy.local(param)
+        return result if narrowed.nil?
+
+        non_nil = Narrowing.narrow_non_nil(narrowed)
+        return result if non_nil.is_a?(Type::Bot) || introduces_dynamic?(non_nil, result)
+
+        Type::Combinator.union(non_nil, Type::Combinator.constant_of(nil))
+      end
+
+      def nil_constant?(type) = type.is_a?(Type::Constant) && type.value.nil?
+
+      # True when the dispatched answer is exactly the receiver's element type or nil: the call really answers "an
+      # element the block accepted, or nil". Whatever else wins the dispatch (a refinement, a reopened `Array` or
+      # `Enumerable`, a gem's override) and answers anything else keeps its answer, and so does a receiver whose
+      # element type cannot be read.
+      def element_or_nil?(node, result)
+        type = type_of(node.receiver)
+        members = type.is_a?(Type::Union) ? type.members : [type]
+        elements = members.map { |member| MethodDispatcher::IteratorDispatch.element_type_of(member) }
+        return false if elements.include?(nil)
+
+        result == Type::Combinator.union(*elements, Type::Combinator.constant_of(nil))
+      end
+
+      # A narrowing that cannot order an element's class against the tested one answers `Dynamic[top]` for it (a
+      # project class with no RBS, typically); that is the test's "cannot tell", not a narrower element, so the
+      # dispatched answer stands.
+      def introduces_dynamic?(narrowed, result)
+        members = narrowed.is_a?(Type::Union) ? narrowed.members : [narrowed]
+        members.any? { |member| member.is_a?(Type::Dynamic) && !result.members.include?(member) }
+      end
+
+      # The block parameter's name when `node` is a block-only `find` / `detect` / `rfind` whose block takes exactly
+      # one plain parameter and whose body is one `is_a?` / `kind_of?` / `instance_of?` call on that parameter with a
+      # single constant argument; nil otherwise.
+      def class_test_find_parameter(node)
+        # `detect(ifnone)` answers `ifnone.call` when nothing matches, which is not an element. A guard: today the
+        # dispatched answer of an argument-bearing `detect` never carries the `nil` the narrowing needs, so the
+        # call would already keep its answer.
+        return nil unless CLASS_TEST_FINDERS.include?(node.name) && node.arguments.nil?
+
+        block = node.block
+        return nil unless block.is_a?(Prism::BlockNode)
+
+        name = single_block_parameter(block)
+        return nil if name.nil?
+
+        body = block.body
+        return nil unless body.is_a?(Prism::StatementsNode) && body.body.size == 1
+
+        return nil unless class_test_on?(body.body.first, name)
+
+        core_finder_call?(node) ? name : nil
+      end
+
+      # The owners whose `find` / `detect` / `rfind` return an element the block accepted: core `Array` and
+      # `Enumerable` (`Hash`, `Set` and `Range` take `Enumerable`'s).
+      CORE_FINDER_OWNERS = %w[Array Enumerable].freeze
+      private_constant :CORE_FINDER_OWNERS
+
+      # True when every member of the call's receiver dispatches `node.name` to core `Array` or `Enumerable`: the
+      # method's RBS owner is one of {CORE_FINDER_OWNERS} and the project defines no method by that name on the
+      # class or an ancestor. A project or gem `find` may return anything its block did not test
+      # (`def find = yield(1) ? 2.0 : nil`), so the name alone is not enough. {#element_or_nil?} closes the spellings
+      # this cannot see (a refinement, a reopened module the discovery walk does not reach).
+      def core_finder_call?(node)
+        receiver = node.receiver
+        return false if receiver.nil?
+
+        type = type_of(receiver)
+        members = type.is_a?(Type::Union) ? type.members : [type]
+        members.all? { |member| core_finder_member?(member, node.name) }
+      end
+
+      def core_finder_member?(member, method_name)
+        class_name =
+          case member
+          when Type::Nominal then member.class_name
+          when Type::Tuple then "Array"
+          when Type::HashShape then "Hash"
+          end
+        return false if class_name.nil?
+        return false if scope.discovered_method_through_ancestors?(class_name, method_name, :instance)
+
+        defined_in = safe_rbs_method_definition(class_name, method_name, :instance)&.defined_in
+        return false if defined_in.nil?
+
+        owner = defined_in.to_s.delete_prefix("::")
+        return false unless CORE_FINDER_OWNERS.include?(owner)
+
+        # A reopened core owner (`module Enumerable; def find = 2.5; end`) replaces the method for every includer,
+        # which the ancestor walk above does not reach for a class whose ancestry RBS alone records (`Set`).
+        !scope.discovered_method?(owner, method_name, :instance)
+      end
+
+      def single_block_parameter(block)
+        params = block.parameters
+        return nil unless params.is_a?(Prism::BlockParametersNode) && params.locals.empty?
+
+        list = params.parameters
+        return nil if list.nil? || list.requireds.size != 1
+        return nil unless list.optionals.empty? && list.rest.nil? && list.posts.empty? &&
+                          list.keywords.empty? && list.keyword_rest.nil? && list.block.nil?
+
+        required = list.requireds.first
+        required.is_a?(Prism::RequiredParameterNode) ? required.name : nil
+      end
+
+      def class_test_on?(test, name)
+        return false unless test.is_a?(Prism::CallNode) && CLASS_TEST_PREDICATES.include?(test.name)
+        return false if test.block || test.safe_navigation?
+
+        receiver = test.receiver
+        return false unless receiver.is_a?(Prism::LocalVariableReadNode) && receiver.name == name
+
+        args = test.arguments&.arguments
+        !args.nil? && args.size == 1 &&
+          (args.first.is_a?(Prism::ConstantReadNode) || args.first.is_a?(Prism::ConstantPathNode))
       end
 
       # Issue #2411 — `recv.each_with_object(memo) { |x, acc| acc[k] = v }` returns the memo as the block's
@@ -1938,7 +2165,7 @@ module Rigor
         return type unless type.is_a?(Type::Constant) && [true, false].include?(type.value)
         # The carrier read itself keeps its declared answer even when that is a literal `true` /
         # `false` — the mark says its nil-freeness is a bet, not that the value's class widened.
-        return type if scope.optimistic_origins[node]
+        return type if scope.optimistic_origin(node)
         return type if OptimisticOrigin.resolve(node, scope).nil?
 
         # Widen only toward what a miss really answers: a safe-navigation call answers `nil`, and
@@ -2068,7 +2295,7 @@ module Rigor
         return dynamic_top if name && refined_name_for?(receiver, name, list)
 
         block_name = symbol_block_argument(node)
-        dynamic_top if block_name && refined_anywhere?(block_name, list)
+        dynamic_top if block_name && RefinedDispatch.refined_anywhere?(scope, block_name, list)
       end
 
       REFINED_NAMING_CALLS = Set[:send, :__send__, :public_send, :respond_to?, :method, :public_method].freeze
@@ -2104,17 +2331,6 @@ module Rigor
         end
       end
 
-      # ADR-121 WD7 — a names-wildcard row counts as a refinement of every name.
-      def refined_anywhere?(name, list)
-        refinements = scope.discovered_refinements
-        wildcard = Scope::DiscoveryIndex::REFINEMENT_WILDCARD
-        return true if list.include?(InEffectRefinements::UNKNOWN) &&
-                       refinements.any? { |_refined, methods| methods.key?(name) || methods.key?(wildcard) }
-
-        !RefinedDispatch.targets(refinements, name, list).nil? ||
-          !RefinedDispatch.targets(refinements, wildcard, list).nil?
-      end
-
       # ADR-121 WD7 — does the call's lexical list (a plugin-declared module is the plugin's declaration and never
       # opaque) hold an opaque module? `list` is the full list, which is the lexical one when nothing is declared.
       def opaque_refinement_span?(node, list)
@@ -2152,7 +2368,7 @@ module Rigor
         return nil if winner.nil?
         return dynamic_top if winner == RefinedDispatch::UNKNOWN
 
-        refined_body_return(winner, node.name, Type::Combinator.nominal_of(class_name), arg_types, block_type) ||
+        refined_body_return(winner, node, Type::Combinator.nominal_of(class_name), arg_types, block_type) ||
           dynamic_top
       end
 
@@ -2171,15 +2387,17 @@ module Rigor
       #
       # A body another file wrote is re-typed with that file's in-effect refinements at the `def` (its own module
       # among them), so a sibling override it calls answers from its refine body too.
-      def refined_body_return(winner, method_name, self_type, arg_types, block_type)
+      def refined_body_return(winner, call_node, self_type, arg_types, block_type)
         def_node, foreign =
-          InEffectRefinements.refinement_def_with_query(scope, winner.module_name, winner.refined_class, method_name)
+          InEffectRefinements.refinement_def_with_query(scope, winner.module_name, winner.refined_class, call_node.name)
         return nil if def_node.nil?
 
         refinements = foreign&.at(def_node.location.start_offset) do |name|
           InEffectRefinements.activated_modules(scope, name)
         end
-        infer_user_method_return(def_node, self_type, arg_types, yield_type: block_type, refinements: refinements)
+        arg_types, positionals_unknown = positional_correspondence(call_node, arg_types)
+        infer_user_method_return(def_node, self_type, arg_types, yield_type: block_type, refinements: refinements,
+                                                                 positionals_unknown: positionals_unknown)
       rescue StandardError
         nil
       end
@@ -2199,6 +2417,151 @@ module Rigor
         end
       end
 
+      # Issue #1237 — whether the call's argument list leaves the positional correspondence unknown: it holds a
+      # `*splat`, or a `...` with no forwarding frame to expand it from. `call_arg_types` carries either as ONE
+      # argument, so a body re-typed from that list bound it to one parameter: `def count(*keys) = keys.size`
+      # called as `r.count(*[0, 1])` folded to `1` and drew an always-falsey `== 2`. A Tuple splat of known
+      # arity is not expanded either.
+      def splat_arguments?(node)
+        arguments = node.arguments&.arguments
+        return false if arguments.nil?
+
+        arguments.any?(Prism::SplatNode) ||
+          (forwards_arguments?(arguments) && ExpressionTyper.current_forwarded_arg_types.nil?)
+      end
+
+      # The argument list and the `positionals_unknown:` flag a body tier re-types a user `def` with. Under
+      # {#splat_arguments?} the body is still re-typed, so a body that always raises still answers `bot` and a
+      # return that does not read its arguments is kept, but with no positional correspondence
+      # ({#bind_params_without_correspondence}): the list is the call's keyword shape alone. Only a trailing
+      # keyword-hash argument the call writes and {#call_arg_type} types as a `HashShape` supplies one. Any
+      # other call leaves the keywords unknown (an open empty shape), because a splatted array's last element
+      # is passed as keywords when it is a `ruby2_keywords` hash.
+      #
+      # Issue #3157 — a call whose every splat {#expand_tuple_splats} can expand is bound as the equivalent
+      # positional call. Issue #3099 — a literal `**{}` passes no argument and is dropped. Issue #3191 — any other
+      # trailing keyword hash holding a double splat is bound with no positional correspondence unless it is typed
+      # as a non-empty closed shape ({#unknown_double_splat?}).
+      def positional_correspondence(call_node, arg_types)
+        arguments = call_node.arguments&.arguments
+        unless splat_arguments?(call_node)
+          return [arg_types[0...-1], false] if literal_empty_double_splat?(arguments&.last)
+          return [[UNKNOWN_KEYWORDS], true] if unknown_double_splat?(arguments&.last, arg_types.last)
+
+          return [arg_types, false]
+        end
+
+        expanded = expand_tuple_splats(arguments, arg_types)
+        return [expanded, false] if expanded
+
+        last = arguments.last
+        keywords = arg_types.last if last.is_a?(Prism::KeywordHashNode) && keyword_shape?(arg_types.last)
+        [[keywords || UNKNOWN_KEYWORDS], true]
+      end
+
+      UNKNOWN_KEYWORDS = Type::Combinator.hash_shape_of({}, extra_keys: :open)
+      private_constant :UNKNOWN_KEYWORDS
+
+      # Issue #3099 — whether `argument` is a keyword hash built only of literal empty double splats (`**{}`),
+      # which Ruby passes as no argument at all.
+      def literal_empty_double_splat?(argument)
+        argument.is_a?(Prism::KeywordHashNode) &&
+          argument.elements.all? do |element|
+            element.is_a?(Prism::AssocSplatNode) && element.value.is_a?(Prism::HashNode) &&
+              element.value.elements.empty?
+          end
+      end
+
+      # Issues #3099 / #3191 — whether `argument` is a keyword hash holding a double splat whose type (`type`) is
+      # not a non-empty closed shape. Ruby passes such a hash as a trailing positional `Hash` to a method that
+      # declares no keywords when it is non-empty, and passes nothing when it is empty, so the call does not say
+      # how many positionals the callee receives. An empty closed shape (`**h`, `h = {}`) may be a stale read of
+      # a hash a callee filled; an open or shapeless one (`**opts`), a mixed `k: 1, **h`, two splats `**h, **h`
+      # and `**nil` are not typed as a shape at all ({#double_splat_hash_shape}). Bound as given, each left a
+      # positional `Hash`: `def count(*keys) = keys.size` called `r.count(1, 2, **opts)` folded to `3`.
+      def unknown_double_splat?(argument, type)
+        argument.is_a?(Prism::KeywordHashNode) && argument.elements.any?(Prism::AssocSplatNode) &&
+          !keyword_shape?(type)
+      end
+
+      # Issue #3157 — the argument list with each `*splat` replaced by its elements, or nil to keep the
+      # no-correspondence binding. It expands only when every splat's operand is an array literal, so its arity is
+      # syntactic, and every element is {#provably_not_hash?}: a splatted array's last element is passed as
+      # keywords when it is a `ruby2_keywords` hash. A splat of a local or any other expression is not expanded,
+      # because a `Tuple` read there may be a stale fold of an array that has since grown or shrunk. A trailing
+      # keyword hash must be a literal `**{}` (dropped) or a non-empty shape; an open, mixed or empty non-literal
+      # one leaves the keywords unknown. A list holding `...` is not expanded: its argument types do not line up
+      # with its argument nodes. The splat's own entry in `arg_types` is `Dynamic[top]` ({#type_of_non_value}),
+      # so the literal's elements are typed here.
+      #
+      # Only a call outside every re-typed body frame expands (the main walk's call sites). Inside a frame a rest
+      # parameter holds the caller's arguments, so a chain `m1(*a) = m2(*[a, 1]) + m2(*[a, a])` handed each level
+      # a deeper element type and walked every combination of every level
+      # (spec/rigor/inference/splat_chain_growth_spec.rb).
+      def expand_tuple_splats(arguments, arg_types)
+        return nil if forwards_arguments?(arguments)
+        return nil unless typing_state.stack(INFERENCE_GUARD).empty?
+
+        last = arguments.last
+        trailing_keywords = last.is_a?(Prism::KeywordHashNode)
+        return nil if trailing_keywords && !literal_empty_double_splat?(last) && !keyword_shape?(arg_types.last)
+
+        expanded = []
+        arguments.each_with_index do |argument, index|
+          next if argument.equal?(last) && trailing_keywords && literal_empty_double_splat?(last)
+          next expanded << arg_types[index] unless argument.is_a?(Prism::SplatNode)
+
+          elements = literal_splat_elements(argument)
+          return nil if elements.nil?
+
+          expanded.concat(elements)
+        end
+        expanded
+      end
+
+      # Whether a trailing keyword-hash argument's type is a shape with at least one pair. {#call_arg_type} types a
+      # keyword hash as a shape only when it is closed.
+      def keyword_shape?(type)
+        type.is_a?(Type::HashShape) && !type.pairs.empty?
+      end
+
+      # The element types of `*[a, b]`, each typed on its own, or nil unless the operand is an array literal whose
+      # every element is {#provably_not_hash?}. A splat element (`*[*t]`) types `Dynamic[top]`
+      # ({#type_of_non_value}), so it declines too.
+      def literal_splat_elements(splat)
+        literal = unparenthesized(splat.expression)
+        return nil unless literal.is_a?(Prism::ArrayNode)
+
+        types = literal.elements.map { |element| type_of(element) }
+        types if types.all? { |type| provably_not_hash?(type) }
+      end
+
+      # Classes no instance of which is a `Hash`. A `Nominal` of any other class may be a `Hash` subclass.
+      NON_HASH_CLASSES = %w[
+        Integer Float Rational Complex String Symbol Array Range Regexp NilClass TrueClass FalseClass Proc
+      ].to_set.freeze
+      private_constant :NON_HASH_CLASSES
+
+      # `*([1, 2])`'s array literal, or the node itself when it is not a parenthesised single expression.
+      def unparenthesized(node)
+        return node unless node.is_a?(Prism::ParenthesesNode) && node.body.is_a?(Prism::StatementsNode)
+
+        statements = node.body.body
+        statements.size == 1 ? statements.first : node
+      end
+
+      # Whether no value of `type` is a `Hash`. Anything this does not recognise answers false. A `Constant` never
+      # carries a `Hash` (it holds scalars only).
+      def provably_not_hash?(type)
+        case type
+        when Type::Constant, Type::Tuple, Type::IntegerRange then true
+        when Type::Nominal then NON_HASH_CLASSES.include?(type.class_name)
+        when Type::Union then type.members.all? { |member| provably_not_hash?(member) }
+        when Type::Refined, Type::Difference then provably_not_hash?(type.base)
+        else false
+        end
+      end
+
       # The post-dispatch tiers for a call `MethodDispatcher` could not answer, in their historical
       # order; extracted from {#call_dispatch_type_for} whole.
       def dispatch_miss_result(node, receiver, arg_types, block_type = nil)
@@ -2414,8 +2777,10 @@ module Rigor
       # `scope.self_type` (or implicit `Object`) as the receiver carrier so the body's own self is
       # consistent with the call site's. Returns nil when the parameter shape disqualifies the def, when the
       # body is empty, or when the inference raises.
-      def infer_top_level_user_method(def_node, receiver, arg_types, block_type = nil)
-        infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
+      def infer_top_level_user_method(def_node, receiver, call_node, arg_types, block_type = nil)
+        arg_types, positionals_unknown = positional_correspondence(call_node, arg_types)
+        infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type,
+                                                                positionals_unknown: positionals_unknown)
       rescue StandardError
         nil
       end
@@ -2467,6 +2832,9 @@ module Rigor
         case type
         when Type::Constant then true
         when Type::Tuple then type.elements.all? { |element| fully_value_pinned?(element) }
+        when Type::HashShape
+          # Issue #3115 — the shape {#pinned_shape_descriptor} keys an unroll on is as pinned as a result.
+          type.closed? && type.optional_keys.empty? && type.pairs.each_value.all? { |value| fully_value_pinned?(value) }
         else false
         end
       end
@@ -2553,9 +2921,10 @@ module Rigor
         def_node, owner, raising = resolve_typing_def_with_owner(receiver.class_name, method_name)
         return every_definer_raises_type(raising, receiver, call_node, arg_types, block_type) if def_node.nil?
 
+        arg_types, positionals_unknown = positional_correspondence(call_node, arg_types)
         result = infer_user_method_return(def_node, receiver, arg_types,
                                           self_fold_safe: fold_safe_call_receiver?(call_node),
-                                          yield_type: block_type)
+                                          yield_type: block_type, positionals_unknown: positionals_unknown)
         return result if result.nil?
 
         degrade_if_overridable(result, owner, method_name, :instance)
@@ -2637,7 +3006,9 @@ module Rigor
         # proven to be the method Ruby calls, so the call falls through to `Dynamic`.
         return nil if scope.discovery.contested?(:discovered_singleton_def_nodes, [owner, method_name.to_sym])
 
-        result = infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
+        arg_types, positionals_unknown = positional_correspondence(call_node, arg_types)
+        result = infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type,
+                                                                         positionals_unknown: positionals_unknown)
         return result if result.nil?
 
         degrade_if_overridable(result, owner, method_name, :singleton)
@@ -2659,13 +3030,185 @@ module Rigor
         cache = (by_singleton[scope.discovered_singleton_def_nodes] ||= {})
         table = (cache[class_name.to_s] ||= {})
         key = method_name.to_sym
-        return table[key] if table.key?(key)
+        if table.key?(key)
+          return MemoAudit.check("class graph singleton def", table[key], class_name, key) do
+            compute_singleton_def_with_owner(class_name, method_name)
+          end
+        end
+
+        table[key] = MemoAudit.key_audit("class graph singleton def") do
+          compute_singleton_def_with_owner(class_name, method_name)
+        end
+      end
 
+      def compute_singleton_def_with_owner(class_name, method_name)
         found = scope.singleton_def_through_ancestors(class_name, method_name)
         owner = found.last
         found = [nil, nil] if owner && SingletonExternalAhead.withhold?(scope, class_name, method_name, owner)
         found = [nil, nil] if found.last && dynamic_singleton_definer_ahead?(class_name, method_name, found.last)
-        table[key] = found
+        found = [nil, nil] if found.last && singleton_hook_order_split?(class_name, method_name)
+        found = [nil, nil] if found.last && singleton_mixin_split?(class_name, method_name, found)
+        found = [nil, nil] if found.last && unseen_definer_split?(class_name, method_name, found)
+        found
+      end
+
+      # A definer no def table holds that Ruby may call instead of `found`: a hook-placed one, or a foreign `def C.x`.
+      def unseen_definer_split?(class_name, method_name, found)
+        hidden_hook_split?(class_name, method_name, found.last) || foreign_definer_behind_copy?(method_name, found)
+      end
+
+      # Issue #3155 — a `def C.x` outside C's body (in the extended module, another class or the file) defines C's
+      # own `x`, which no def table holds, only its object-singleton mark. A fold copy found on C may then be a
+      # body Ruby does not call, so the typing read withholds.
+      def foreign_definer_behind_copy?(method_name, found)
+        node, owner = found
+        return false unless singleton_copy_head(owner, node) != owner
+
+        SingletonHookDecline.foreign_singleton_definer?(scope, owner, method_name)
+      end
+
+      # The hook-placed definers a found singleton `def` may not be the one Ruby calls through.
+      def hidden_hook_split?(class_name, method_name, owner)
+        hidden_hook_definer?(class_name, method_name, owner) || hook_block_rival?(class_name, method_name, owner)
+      end
+
+      # Issue #3005 — a class object's own `def self.x` and a `def self.x` a concern's `included` block defines on it
+      # replace each other in the order the `def` and the `include` run, which the tables do not hold, so the typing
+      # read withholds when the answer is a class object's own `def` and its level's hook-block module defines the
+      # name too.
+      def hook_block_rival?(class_name, method_name, owner)
+        chain = Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods)
+        index = chain.entries.index { |entry| !entry.external? && entry.side == :singleton && entry.name == owner }
+        !index.nil? && chain.hook_block_rival?(scope, index, method_name)
+      end
+
+      # Issue #1592 — a module a hook extends the class with may define the name private (`class_methods do private;
+      # def x`), which Ruby refuses on an explicit receiver. The visibility rule does not reach that module, so the
+      # typing read withholds rather than answer a call Ruby raises on. A module the class `extend`s itself is left to
+      # that rule.
+      def hidden_hook_definer?(class_name, method_name, owner)
+        visibility = scope.discovered_method_visibility(owner, method_name)
+        return false if visibility.nil? || visibility == :public
+
+        chain = Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods)
+        return false unless chain.entries.any? { |entry| entry.name == owner && entry.side == :instance }
+
+        scope.singleton_extends_of(class_name).none? do |raw|
+          written = raw.delete_prefix("::")
+          owner == written || owner.end_with?("::#{written}")
+        end
+      end
+
+      # Issue #1592 — whether to withhold `method_name`'s class-side answer: a class object on the chain has
+      # hook-extended modules whose order against its own `extend`s is not a fact, and the orders give different
+      # definers (the retro world's against the chain's, or, with no retro world, the class objects' alone against
+      # the chain's). A `def` the extends fold copied onto a class object is read where Ruby finds it, at the extended
+      # module's own entry, since the copy sits ahead of every module in both orders.
+      def singleton_hook_order_split?(class_name, method_name)
+        chain = Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods)
+        return false unless chain.hook_order_marked?
+
+        answer = positioned_singleton_definer(chain, method_name)
+        retro = chain.retro_world
+        return answer != positioned_singleton_definer(retro, method_name) if retro
+
+        answer != positioned_singleton_definer(chain, method_name, copies: true)
+      end
+
+      # Issues #2998 and #3020 — whether a singleton-side mixin of a class object on the chain may answer ahead of
+      # `found`: a named prepend master's order does not place, or a module no table names.
+      def singleton_mixin_split?(class_name, method_name, found)
+        singleton_prepend_split?(class_name, method_name, found) ||
+          unnamed_singleton_mixin_split?(class_name, method_name)
+      end
+
+      # Issue #2998 — whether to withhold the class-side answer `found` on a chain whose class objects have
+      # singleton-side prepends of their own: master's order, which a chain that does not stand answers, places no
+      # such prepend, so its definer may not be the one Ruby's order reaches first. A `def` the extends fold copied
+      # onto a class object is compared as its module's. A definer from a prepend region whose order is not a fact
+      # is withheld whichever order answers.
+      def singleton_prepend_split?(class_name, method_name, found)
+        chain = Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods)
+        return false unless chain.singleton_prepend_marked?
+
+        answer = positioned_singleton_definer(chain, method_name)
+        return true if unordered_prepend_definer?(chain, answer)
+
+        node, owner = found
+        head = scope.singleton_def_for(owner, method_name).equal?(node) ? singleton_copy_head(owner, node) : owner
+        head != answer
+      end
+
+      # Whether `answer` is a module in the prepend region of a class object on the chain whose prepends have no known
+      # order: the entries between the start of that class's level and its own entry.
+      def unordered_prepend_definer?(chain, answer)
+        chain.prepend_order_nodes.any? do |node|
+          level = chain.level_classes.index(node)
+          next true if level.nil?
+
+          start = chain.level_starts[level]
+          own = chain.entries.index { |entry| entry.side == :singleton && entry.name == node }
+          next true if own.nil?
+
+          chain.entries[start...own].any? { |entry| entry.name == answer }
+        end
+      end
+
+      # Issue #3020 — whether to withhold the class-side answer on a chain whose class objects mix a module no table
+      # names into their singleton side, which may define the name. A prepend (`class << self; prepend(*MODS)`) sits
+      # ahead of the class object's own `def self.`, so a definer at or behind that class object's level is withheld;
+      # an `extend(*MODS)` or a `class << self` `include(*MODS)` sits right behind it, so a definer behind the class
+      # object's own entry is withheld and its own `def self.` still answers.
+      def unnamed_singleton_mixin_split?(class_name, method_name)
+        chain = Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods)
+        prepends = chain.unnamed_prepend_nodes
+        extends = chain.unnamed_extend_nodes
+        return false if prepends.empty? && extends.empty?
+
+        answer = positioned_singleton_definer(chain, method_name)
+        prepends.any? { |node| !answered_ahead?(chain, answer, level_start_of(chain, node)) } ||
+          extends.any? { |node| !answered_ahead?(chain, answer, own_singleton_index(chain, node)&.succ) }
+      end
+
+      # Whether `answer` owns an entry before `stop` (nil when the position is unknown: never). A nil `answer` (no class
+      # object's own def) owns none.
+      def answered_ahead?(chain, answer, stop)
+        !stop.nil? && chain.entries[0...stop].any? { |entry| entry.name == answer }
+      end
+
+      def level_start_of(chain, node)
+        level = chain.level_classes.index(node)
+        level && chain.level_starts[level]
+      end
+
+      def own_singleton_index(chain, node)
+        chain.entries.index { |entry| entry.side == :singleton && entry.name == node }
+      end
+
+      # The owner of the first `def` of the name along the chain: a fold copy is skipped, or with `copies:` read as
+      # its module's, on the class objects alone (the answer master gives).
+      def positioned_singleton_definer(chain, method_name, copies: false)
+        chain.search(scope, side: copies ? :singleton : nil) do |entry|
+          next if entry.external?
+
+          name = entry.name
+          if entry.side == :singleton
+            node = scope.singleton_def_for(name, method_name)
+            next nil if node.nil?
+
+            head = singleton_copy_head(name, node)
+            copies ? head : (name if head == name)
+          elsif scope.user_def_for(name, method_name)
+            name
+          end
+        end
+      end
+
+      # The module a receiverless singleton `def` was written in when the extends fold copied it onto `owner`, else
+      # `owner`.
+      def singleton_copy_head(owner, node)
+        head = node.receiver.nil? ? scope.discovery.recorded_def_nesting(node)&.first : nil
+        head.nil? ? owner : head
       end
 
       SINGLETON_WILDCARD_SLOT = %i[singleton *].freeze
@@ -2693,6 +3236,8 @@ module Rigor
           next if entry.external?
           return false if entry.name == owner.to_s
           return true if entry_defines_without_def?(entry, name)
+          # Issue #1592 — a hook of a module the class includes may have extended it with a module no table names.
+          return true if entry.side == :singleton && chain.hook_open_nodes.include?(entry.name)
         end
         false
       end
@@ -2744,7 +3289,9 @@ module Rigor
         def_node = SingletonObjectConstant.def_node_for(call_node, receiver, method_name, scope)
         return nil if def_node.nil?
 
-        infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type)
+        arg_types, positionals_unknown = positional_correspondence(call_node, arg_types)
+        infer_user_method_return(def_node, receiver, arg_types, yield_type: block_type,
+                                                                positionals_unknown: positionals_unknown)
       rescue StandardError
         nil
       end
@@ -2756,8 +3303,14 @@ module Rigor
       # external entries this lookup passes over. Cross-file: the chain is built from the tables the runner
       # seeds from the project-wide pre-pass, cycle-guarded and capped at `Scope::ANCESTOR_WALK_LIMIT`.
 
-      CLASS_GRAPH_CACHE_KEY = RunScopedSlots.register(:__rigor_class_graph_cache__)
-      private_constant :CLASS_GRAPH_CACHE_KEY
+      CLASS_GRAPH_CACHE = TypingState.memo(
+        :class_graph_cache,
+        run_scoped: true,
+        audit: ["class graph user def", "class graph typing def", "class graph singleton def", "class graph yields",
+                "class graph self pure"],
+        reason: "pure functions of the frozen discovery index it keys on"
+      )
+      private_constant :CLASS_GRAPH_CACHE
 
       # Memo for the static class-graph resolvers below. They are pure functions of the scope's *frozen*
       # discovery tables — `user_def_for` / `superclass_of` / `includes_of` and the ancestor-name resolver
@@ -2775,8 +3328,8 @@ module Rigor
       #
       # ONE slot, replaced rather than accumulated — the same shape, and now the same key, as
       # {MethodDispatcher::RbsDispatch}'s `core_stdlib_memo`. `ExpressionTyper` is rebuilt per
-      # `Scope#type_of`, so the slot lives on `Thread.current` rather than on `self`. A `Scope` merges its
-      # file's discovery with the project pre-pass, so every analysed file arrives with a fresh index: an
+      # `Scope#type_of`, so the slot lives in the thread's {TypingState} rather than on `self`. A `Scope` merges
+      # its file's discovery with the project pre-pass, so every analysed file arrives with a fresh index: an
       # identity-keyed *store* grew one bucket per file and, because the keys ARE the tables, pinned every
       # file's whole discovery index for the length of the run. What that bought, measured over
       # `lib`+`plugins`: 552 buckets holding 1,834 entries between them, and 58 of 80,106 calls answered
@@ -2786,23 +3339,32 @@ module Rigor
       # because one `equal?` is cheaper than three identity-hash lookups.
       #
       # Steady-state cost is one `equal?` check and zero allocation; the array and the buckets are
-      # allocated once per index. (Pool mode forks per worker, so the `Thread.current` slot is
+      # allocated once per index. (Pool mode forks per worker, so the per-thread slot is
       # process-local and never crosses a project boundary — and note that the parent's reported
       # `Memory peak` therefore does not see a worker's share of this at all.)
+      #
+      # ADR-129 WD1 — every bucket's hit goes through `MemoAudit.check`; an audit recomputation gets fresh buckets that
+      # nothing stores, so it reads no entry and leaves none.
       def class_graph_buckets
+        return fresh_class_graph_buckets if MemoAudit.enabled? && MemoAudit.suspended?
+
         discovery = scope.discovery
-        slot = Thread.current[CLASS_GRAPH_CACHE_KEY]
+        state = typing_state
+        slot = state[CLASS_GRAPH_CACHE]
         unless slot && slot[0].equal?(discovery)
           # `self_pure` is issue #525's grant scan (identity-keyed by def node); it belongs here because it
           # is a pure function of the same frozen index — the sibling resolver it walks reads nothing else.
           # `singleton_def` is added lazily by {#singleton_def_through_ancestors}'s caller.
-          slot = [discovery,
-                  { user_def: {}, typing_def: {}, self_pure: {}.compare_by_identity, yields: {}.compare_by_identity }]
-          Thread.current[CLASS_GRAPH_CACHE_KEY] = slot
+          slot = [discovery, fresh_class_graph_buckets]
+          state[CLASS_GRAPH_CACHE] = slot
         end
         slot[1]
       end
 
+      def fresh_class_graph_buckets
+        { user_def: {}, typing_def: {}, self_pure: {}.compare_by_identity, yields: {}.compare_by_identity }
+      end
+
       # ADR-119 C2-b1 — the TYPING read of {#resolve_user_def_with_owner}: the same `[def_node, owner]` pair, but
       # answered through {DefinerResolution} so a chain that does not stand for the name (a conditional definer,
       # a conditional include, a fork, an external ancestor that may answer first) is `[nil, nil]` and the call
@@ -2817,17 +3379,26 @@ module Rigor
         cache = class_graph_buckets[:typing_def]
         table = (cache[class_name.to_s] ||= {})
         key = method_name.to_sym
-        return table[key] if table.key?(key)
-
-        table[key] =
-          case DefinerResolution.resolve(scope, class_name, method_name, :instance, question: :definer)
-          in DefinerResolution::Known(answer: [node, owner])
-            [node, owner]
-          in DefinerResolution::UNKNOWN
-            [nil, nil, every_project_definer(class_name, method_name)]
-          in DefinerResolution::ABSENT
-            [nil, nil]
+        if table.key?(key)
+          return MemoAudit.check("class graph typing def", table[key], class_name, key) do
+            compute_typing_def_with_owner(class_name, method_name)
           end
+        end
+
+        table[key] = MemoAudit.key_audit("class graph typing def") do
+          compute_typing_def_with_owner(class_name, method_name)
+        end
+      end
+
+      def compute_typing_def_with_owner(class_name, method_name)
+        case DefinerResolution.resolve(scope, class_name, method_name, :instance, question: :definer)
+        in DefinerResolution::Known(answer: [node, owner])
+          [node, owner]
+        in DefinerResolution::UNKNOWN
+          [nil, nil, every_project_definer(class_name, method_name)]
+        in DefinerResolution::ABSENT
+          [nil, nil]
+        end
       end
 
       # ADR-119 C2-b1 errata (the `bot` exception) — an UNKNOWN chain does not say WHICH definer Ruby calls, but
@@ -2841,9 +3412,11 @@ module Rigor
         return nil if defs.nil?
 
         self_fold_safe = fold_safe_call_receiver?(call_node)
+        arg_types, positionals_unknown = positional_correspondence(call_node, arg_types)
         defs.each do |def_node|
           result = infer_user_method_return(def_node, receiver, arg_types,
-                                            self_fold_safe: self_fold_safe, yield_type: block_type)
+                                            self_fold_safe: self_fold_safe, yield_type: block_type,
+                                            positionals_unknown: positionals_unknown)
           return nil unless result.is_a?(Type::Bot)
         end
         Type::Combinator.bot
@@ -2918,9 +3491,15 @@ module Rigor
         cache = class_graph_buckets[:user_def]
         table = (cache[class_name.to_s] ||= {})
         key = method_name.to_sym
-        return table[key] if table.key?(key)
+        if table.key?(key)
+          return MemoAudit.check("class graph user def", table[key], class_name, key) do
+            compute_user_def_with_owner(class_name, method_name)
+          end
+        end
 
-        table[key] = compute_user_def_with_owner(class_name, method_name)
+        table[key] = MemoAudit.key_audit("class graph user def") do
+          compute_user_def_with_owner(class_name, method_name)
+        end
       end
 
       # ADR-24 slice 2 — the walk itself lives on `Scope` ({Scope#user_def_through_ancestors}); it reads
@@ -2957,8 +3536,12 @@ module Rigor
         dynamic_top
       end
 
-      OVERRIDE_GATE_CACHE_KEY = RunScopedSlots.register(:__rigor_overridable_method_gate__)
-      private_constant :OVERRIDE_GATE_CACHE_KEY
+      OVERRIDE_GATE_CACHE = TypingState.memo(
+        :overridable_method_gate,
+        run_scoped: true, audit: "overridable method gate",
+        reason: "pure functions of the frozen discovery index it keys on"
+      )
+      private_constant :OVERRIDE_GATE_CACHE
 
       # Memo for {#overridden_in_project?}, nested `kind → owner → method_name`. The predicate is a pure
       # function of the scope's frozen discovery tables, so that index's *identity* is what says whether a
@@ -2988,10 +3571,11 @@ module Rigor
       # keyed and bounded differently for exactly that reason.
       def override_gate_buckets
         discovery = scope.discovery
-        slot = Thread.current[OVERRIDE_GATE_CACHE_KEY]
+        state = typing_state
+        slot = state[OVERRIDE_GATE_CACHE]
         unless slot && slot[0].equal?(discovery)
           slot = [discovery, { instance: {}, singleton: {} }]
-          Thread.current[OVERRIDE_GATE_CACHE_KEY] = slot
+          state[OVERRIDE_GATE_CACHE] = slot
         end
         slot[1]
       end
@@ -3002,10 +3586,18 @@ module Rigor
       # reopen of `owner` itself is NOT an override (monkey-patch reopen shares the owner identity). Memoized
       # per `(owner, method_name, kind)`.
       def overridden_in_project?(owner, method_name, kind)
+        return compute_overridden_in_project?(owner, method_name, kind) if MemoAudit.enabled? && MemoAudit.suspended?
+
         by_owner = (override_gate_buckets[kind][owner] ||= {})
-        return by_owner[method_name] if by_owner.key?(method_name)
+        if by_owner.key?(method_name)
+          return MemoAudit.check("overridable method gate", by_owner[method_name], owner, method_name) do
+            compute_overridden_in_project?(owner, method_name, kind)
+          end
+        end
 
-        by_owner[method_name] = compute_overridden_in_project?(owner, method_name, kind)
+        by_owner[method_name] = MemoAudit.key_audit("overridable method gate") do
+          compute_overridden_in_project?(owner, method_name, kind)
+        end
       end
 
       def compute_overridden_in_project?(owner, method_name, kind)
@@ -3030,16 +3622,23 @@ module Rigor
       EMPTY_REDEFINERS = [].freeze
       private_constant :EMPTY_REDEFINERS
 
-      METHOD_DEFINERS_INDEX_KEY = RunScopedSlots.register(:__rigor_method_definers_index__)
-      private_constant :METHOD_DEFINERS_INDEX_KEY
-
-      # The second way. Two flat thread slots rather than one slot holding an array of ways: a
-      # `Thread.current[KEY] ||= […]` seeds the store with an array LITERAL, which folds to a tuple whose
-      # elements are pinned, and the engine then reads the `way[0].equal?(…)` guards below as always-falsey
-      # (`make check` fires `flow.always-truthy-condition` on this very file). Two keys read as two plain
-      # `Thread.current` reads and keep the guards analysable.
-      METHOD_DEFINERS_INDEX_ALT_KEY = RunScopedSlots.register(:__rigor_method_definers_index_alt__)
-      private_constant :METHOD_DEFINERS_INDEX_ALT_KEY
+      METHOD_DEFINERS_INDEX = TypingState.memo(
+        :method_definers_index,
+        run_scoped: true, audit: "method definers index",
+        reason: "pure functions of the def tables it keys on"
+      )
+      private_constant :METHOD_DEFINERS_INDEX
+
+      # The second way. Two flat slots rather than one slot holding an array of ways: a `slot ||= […]` seeds the
+      # store with an array LITERAL, which folds to a tuple whose elements are pinned, and the engine then reads the
+      # `way[0].equal?(…)` guards below as always-falsey (`make check` fires `flow.always-truthy-condition` on this
+      # very file). Two slots read as two plain reads and keep the guards analysable.
+      METHOD_DEFINERS_INDEX_ALT = TypingState.memo(
+        :method_definers_index_alt,
+        run_scoped: true, audit: "method definers index alt",
+        reason: "pure functions of the def tables it keys on"
+      )
+      private_constant :METHOD_DEFINERS_INDEX_ALT
 
       # `method_name (Symbol) → [owner names]` inverted index over the instance / singleton def tables,
       # valid for exactly as long as the table it inverts: a new analysis generation, or a `Scope` that swaps
@@ -3080,19 +3679,52 @@ module Rigor
       # def-table-keyed one misses 201 — it would rebuild the seed's 934-entry table once per file and hand
       # back the +22.6 % this bound exists to avoid. Check that number before widening this key to match
       # its siblings.
+      #
+      # ADR-129 WD1 — a hit in either way is audited against an index built with every memo bypassed, compared in
+      # {DefinersIndex.canonical} form (a `Layered` index and a whole one hold the same owners, in any order).
       def method_definers_index(kind)
-        def_nodes = scope.discovered_def_nodes
-        singleton_def_nodes = scope.discovered_singleton_def_nodes
-        way = Thread.current[METHOD_DEFINERS_INDEX_KEY]
-        unless way && way[0].equal?(def_nodes) && way[1].equal?(singleton_def_nodes)
-          alt = Thread.current[METHOD_DEFINERS_INDEX_ALT_KEY]
-          alt = nil unless alt && alt[0].equal?(def_nodes) && alt[1].equal?(singleton_def_nodes)
-          Thread.current[METHOD_DEFINERS_INDEX_ALT_KEY] = way
-          way = alt || [def_nodes, singleton_def_nodes, nil, nil]
-          Thread.current[METHOD_DEFINERS_INDEX_KEY] = way
-        end
         singleton = kind == :singleton
-        way[singleton ? 3 : 2] ||= DefinersIndex.for(singleton ? singleton_def_nodes : def_nodes)
+        table = singleton ? scope.discovered_singleton_def_nodes : scope.discovered_def_nodes
+        return DefinersIndex.for(table) if MemoAudit.enabled? && MemoAudit.suspended?
+
+        state = typing_state
+        primary = current_definers_way?(state[METHOD_DEFINERS_INDEX])
+        way = primary ? state[METHOD_DEFINERS_INDEX] : rotate_definers_ways(state)
+        position = singleton ? 3 : 2
+        index = way[position]
+        return way[position] = MemoAudit.key_audit("method definers index") { DefinersIndex.for(table) } if index.nil?
+
+        audit_definers_index(primary, index, kind, table) if MemoAudit.enabled?
+        index
+      end
+
+      # Whether `way` was built over this scope's two def tables.
+      def current_definers_way?(way)
+        !way.nil? && way[0].equal?(scope.discovered_def_nodes) && way[1].equal?(scope.discovered_singleton_def_nodes)
+      end
+
+      # Makes the alternate way current when it was built over this scope's def tables, or a fresh way otherwise; the
+      # way it replaces becomes the alternate.
+      def rotate_definers_ways(state)
+        alt = state[METHOD_DEFINERS_INDEX_ALT]
+        alt = nil unless current_definers_way?(alt)
+        state[METHOD_DEFINERS_INDEX_ALT] = state[METHOD_DEFINERS_INDEX]
+        state[METHOD_DEFINERS_INDEX] =
+          alt || [scope.discovered_def_nodes, scope.discovered_singleton_def_nodes, nil, nil]
+      end
+
+      # A hit in the current way (`primary`) or the alternate one, checked in {DefinersIndex.canonical} form.
+      def audit_definers_index(primary, index, kind, table)
+        canonical = DefinersIndex.canonical(index)
+        if primary
+          MemoAudit.check("method definers index", canonical, kind) do
+            DefinersIndex.canonical(DefinersIndex.for(table))
+          end
+        else
+          MemoAudit.check("method definers index alt", canonical, kind) do
+            DefinersIndex.canonical(DefinersIndex.for(table))
+          end
+        end
       end
 
       # True when `candidate`'s ancestor chain (superclasses + included/prepended modules) reaches `owner` —
@@ -3105,18 +3737,30 @@ module Rigor
         !chain.search(scope) { |entry| entry.name == owner }.nil?
       end
 
-      INFERENCE_GUARD_KEY = :__rigor_user_method_inference_stack__
-      private_constant :INFERENCE_GUARD_KEY
+      # ADR-129 WD3 — an id-determined Resource: {TypingState::State#push} and {TypingState::State#pop} each take a
+      # fresh id, so the stack's contents are fixed while the id is and a read of it refuses nothing.
+      INFERENCE_GUARD = TypingState.resource(
+        :user_method_inference_stack,
+        read_exemption: :id_determined,
+        reason: "the ADR-55 recursion guard, pushed and popped in place by each inference frame"
+      )
+      private_constant :INFERENCE_GUARD
 
-      INFERENCE_UNROLL_FUEL_KEY = :__rigor_user_method_unroll_fuel__
-      private_constant :INFERENCE_UNROLL_FUEL_KEY
+      INFERENCE_UNROLL_FUEL = TypingState.resource(
+        :user_method_unroll_fuel,
+        reason: "ADR-55 unroll fuel, consumed in place per outermost entry"
+      )
+      private_constant :INFERENCE_UNROLL_FUEL
 
       # ADR-55 slice 2 — thread-local fixpoint return-summary table, keyed by the plain `(receiver, method)`
       # signature (NOT the value-extended signature: extended frames from slice 1 share the same summary).
       # Each entry is `{ assumption:, consulted: }` where `assumption` is the current Kleene iterate (seeded
       # `bot`) and `consulted` flips true when an in-cycle re-entry returns it.
-      INFERENCE_SUMMARY_KEY = :__rigor_user_method_return_summary__
-      private_constant :INFERENCE_SUMMARY_KEY
+      INFERENCE_SUMMARY = TypingState.resource(
+        :user_method_return_summary,
+        reason: "ADR-55 Kleene summaries and their `:consulted` flag, rewritten in place"
+      )
+      private_constant :INFERENCE_SUMMARY
 
       # Per-thread append-only log of the seed depths of every in-flight summary `consult_summary` read
       # (ADR-55 slice 2 mutual-recursion soundness fix, 2026-06-12). Each fixpoint owner records the guard
@@ -3127,8 +3771,11 @@ module Rigor
       # `untyped` rather than fold one branch's seed into a "final" constant. Own-signature consults log
       # depth == own depth, and a nested fixpoint that completes within the evaluation logs depths > own
       # depth; neither is foreign. Cleared with the summary table when the guard stack drains to empty.
-      SUMMARY_CONSULT_DEPTHS_KEY = :__rigor_user_method_summary_consult_depths__
-      private_constant :SUMMARY_CONSULT_DEPTHS_KEY
+      SUMMARY_CONSULT_DEPTHS = TypingState.resource(
+        :user_method_summary_consult_depths,
+        reason: "ADR-55 consult log, appended in place and read as a delta"
+      )
+      private_constant :SUMMARY_CONSULT_DEPTHS
 
       # ADR-57 follow-up — run-scoped memo for resolved user-method return types. The ADR-57 gate-open made
       # every resolved in-body self-call adopt the callee's inferred return, which re-types the callee body
@@ -3151,7 +3798,7 @@ module Rigor
       # post-hoc (ADR-84 WD3): candidacy only requires that the plain signature not already be on the
       # recursion guard stack (a frame inside its own cycle returns a Kleene iterate by construction), and
       # the store gate brackets the compute over the transient-event depth log
-      # (TRANSIENT_EVENT_DEPTHS_KEY), refusing only when an event referenced a frame BELOW the bracket's
+      # (TRANSIENT_EVENT_DEPTHS), refusing only when an event referenced a frame BELOW the bracket's
       # entry depth — proof the ancestor context (an in-flight ancestor summary, the shared unroll fuel, a
       # possibly-ancestor-caused clamp) influenced the result. Events at-or-above the entry depth are the
       # compute's own deterministic machinery — a recursive method's own converged fixpoint stores from a
@@ -3175,10 +3822,68 @@ module Rigor
       # parse). Only the current generation's bucket is retained (single slot) — a rolled-over run's entries
       # become garbage instead of accumulating across LSP runs, and the run that filled the slot releases it
       # when it ends ({RunScopedSlots}; `Runner#run` keeps its bucket for `#return_summaries`).
-      # `ExpressionTyper` is rebuilt per `Scope#type_of`, so the store lives on `Thread.current`; fork-pool
+      # `ExpressionTyper` is rebuilt per `Scope#type_of`, so the store lives in the thread's {TypingState}; fork-pool
       # workers are separate processes, so it never crosses a project boundary (ADR-84 WD5).
-      RETURN_MEMO_KEY = RunScopedSlots.register(:__rigor_user_method_return_memo__)
-      private_constant :RETURN_MEMO_KEY
+      #
+      # ADR-129 WD1 — a Table, not a Memo: its WD3 serves a standalone result where a fresh compute inside a cycle
+      # would be tainted, and its WD6 serves a stored `untyped`, so it is not extensional. Its reads and stores are
+      # journaled ({#log_return_memo}).
+      # ADR-129 WD3 — the return memo's entry protocol. The slot holds `[generation, bucket]` ({#return_memo_bucket}),
+      # and a journal record keys an entry on `[def_node, memo_key]`. A replay writes into the bucket the slot holds: a
+      # `type_of` memo entry lives no longer than its file's analysis, inside one run generation, so a slot with no
+      # bucket means the entry outlived its run, which is a defect to surface rather than a bucket to invent.
+      module ReturnMemoEntries
+        module_function
+
+        def entry(slot_value, key)
+          per_def = slot_value&.[](1)&.[](key[0])
+          per_def.nil? ? TypingState::ABSENT : per_def.fetch(key[1], TypingState::ABSENT)
+        end
+
+        def put(slot_value, key, value)
+          (slot_value[1][key[0]] ||= {})[key[1]] = value
+        end
+
+        def delete(slot_value, key)
+          per_def = slot_value && slot_value[1][key[0]]
+          per_def&.delete(key[1])
+        end
+
+        def container(state, slot)
+          state[slot] || raise(ArgumentError, "no return memo bucket to replay into: its entry outlived its run")
+        end
+      end
+
+      RETURN_MEMO = TypingState.table(
+        :user_method_return_memo,
+        run_scoped: true, computed: "return memo", entries: ReturnMemoEntries,
+        reason: "ADR-84 return memo; not extensional (its WD3 and WD6), so its reads and stores are journaled"
+      )
+      private_constant :RETURN_MEMO
+
+      # ADR-129 WD1's key audit of a return-memo miss. The key carries the yield value ({YIELD_VALUE}, read through
+      # `key_frame`). {.with_call_site_frame} installs the forwarded-argument list, derived from `arg_types`, repeat
+      # depth zero and none of the caller's jump sinks or retry frames before the key is built, and
+      # {#infer_user_method_return} installs the key-presence walk off, so the computation reads those forms. The
+      # bucket keys on the run generation ({#return_memo_bucket}), within which ADR-130's run-level flags are fixed, so
+      # the key carries them. Two Frames are read without a key term, each a known gap: the block-body threading
+      # suppression (#2782) and Acceptance's unread-shape refusal (#2866).
+      RETURN_MEMO_KEY_AUDIT = MemoAudit.key_declaration(
+        forced: %i[forwarded_call_arg_types reflective_ivar_write_repeating key_presence_walk next_sink break_sink
+                   break_value_sink retry_frames],
+        carried: {
+          interface_erasure: "installed around a whole run; the bucket keys on the run generation",
+          interface_dispatch_off: "installed around a whole run; the bucket keys on the run generation"
+        },
+        gaps: {
+          threaded_block_body: "#2782: the return memo reads the block-body threading suppression without keying on " \
+                               "it; keying on it cost a fifth of lib's allocations, and clearing it per callee " \
+                               "frame re-walked unstorable frames exponentially",
+          acceptance_unread_shape_refused: "#2866: a callee body typed inside Acceptance.refusing_unread " \
+                                           "reads the caller's refusal, and the return memo does not key on it"
+        }
+      ).freeze
+      private_constant :RETURN_MEMO_KEY_AUDIT
 
       # ADR-84 WD2 — one memo entry: the final inferred return plus, when the entry was computed under
       # ADR-46 dependency recording, the frozen `Analysis::DependencyRecorder::ReadSet` its body walk
@@ -3190,7 +3895,10 @@ module Rigor
       # when every return is unchanged, skips its symbol dependents. Carrying two frozen type refs is
       # negligible on the memo-store path (already in scope) and never enters memo equality (entries are
       # keyed by `memo_key`, retrieved by `.result` / `.read_set`).
-      MemoEntry = Data.define(:result, :read_set, :receiver, :arg_types)
+      #
+      # Issue #1237 — `positionals_unknown` marks an entry a splat call stored ({#positional_correspondence}): the
+      # session re-drives its key the same way ({#return_type_for}).
+      MemoEntry = Data.define(:result, :read_set, :receiver, :arg_types, :positionals_unknown)
       private_constant :MemoEntry
 
       # ADR-84 WD3 — thread-local transient-machinery event log, appended by `note_transient_fallback` at
@@ -3246,8 +3954,11 @@ module Rigor
       # sense above — position 0 is always a sound (conservative) choice; spec/rigor/inference/
       # return_memo_taint_spec.rb pins this (no raw `BudgetTrace.hit` on the recursion categories outside
       # the helper).
-      TRANSIENT_EVENT_DEPTHS_KEY = :__rigor_user_method_transient_event_depths__
-      private_constant :TRANSIENT_EVENT_DEPTHS_KEY
+      TRANSIENT_EVENT_DEPTHS = TypingState.resource(
+        :user_method_transient_event_depths,
+        reason: "ADR-84 WD3 event log, appended in place and read as a delta"
+      )
+      private_constant :TRANSIENT_EVENT_DEPTHS
 
       # Per-inference recursion context threaded through the guard / fixpoint helpers (ADR-55 slice 2).
       # Bundles the call descriptor (`receiver`, `arg_types`, `plain_signature`), the thread-local summary
@@ -3255,7 +3966,7 @@ module Rigor
       # carried separately (it is the body owner, not call context).
       RecursionContext = Data.define(
         :receiver, :arg_types, :plain_signature, :summaries, :would_have_been_guarded,
-        :self_fold_safe
+        :self_fold_safe, :positionals_unknown
       )
       private_constant :RecursionContext
 
@@ -3295,24 +4006,27 @@ module Rigor
       # The return memo and the recursion guard do not key on them, which holds because such a node comes only from
       # `DefNodeResolver.refinement_query`'s own parse and always carries that file's one list; a caller that types
       # the same node under another list must add it to the key.
+      #
+      # Issue #1237 — `positionals_unknown:` re-types the body with no positional correspondence
+      # ({#positional_correspondence}): `arg_types` is then the call's keyword shape alone. Such a frame reads and
+      # stores the return memo under a key of its own ({#return_memo_key}), which the incremental session re-drives
+      # with the same flag ({#return_type_for}), and installs no `...` forwarding list.
       def infer_user_method_return(def_node, receiver, arg_types, self_fold_safe: false, yield_type: nil,
-                                   refinements: nil)
+                                   refinements: nil, positionals_unknown: false)
         return nil if def_node.body.nil?
-        unless KeyPresenceGuard.active?
-          return infer_user_method_return_unguarded(def_node, receiver, arg_types, self_fold_safe, yield_type,
-                                                    refinements)
-        end
 
-        KeyPresenceGuard.without_guards do
-          infer_user_method_return_unguarded(def_node, receiver, arg_types, self_fold_safe, yield_type, refinements)
-        end
+        call = [def_node, receiver, arg_types, self_fold_safe, yield_type, refinements, positionals_unknown]
+        return infer_user_method_return_unguarded(*call) unless KeyPresenceGuard.forcing_off?
+
+        KeyPresenceGuard.without_guards { infer_user_method_return_unguarded(*call) }
       end
 
       def infer_user_method_return_unguarded(def_node, receiver, arg_types, self_fold_safe, yield_type,
-                                             refinements = nil)
+                                             refinements, positionals_unknown)
         yield_type = nil unless yield_type && body_yields?(def_node)
         body_scope = build_user_method_body_scope(def_node, receiver, arg_types,
-                                                  self_fold_safe: self_fold_safe)
+                                                  self_fold_safe: self_fold_safe,
+                                                  positionals_unknown: positionals_unknown)
         return nil if body_scope.nil?
 
         body_scope = body_scope.with_declared_refinements(refinements) if refinements
@@ -3325,8 +4039,7 @@ module Rigor
         # resolving during the main walk. `describe(:short)` keeps non-Nominal receivers (the implicit
         # `Object` carrier for top-level / DSL-block defs) printable.
         plain_signature = [receiver.describe(:short), def_node.name]
-        stack = (Thread.current[INFERENCE_GUARD_KEY] ||= [])
-        summaries = (Thread.current[INFERENCE_SUMMARY_KEY] ||= {})
+        stack = typing_state.stack(INFERENCE_GUARD)
 
         # WD0 (RIGOR_BUDGET_TRACE) — one entry into user-method return inference. No-op when disabled.
         BudgetTrace.hit(BudgetTrace::MEMO_ENTRIES)
@@ -3349,11 +4062,12 @@ module Rigor
         # below reads it back from here rather than taking a second parameter, so key and frame cannot
         # disagree). It is installed even when nil, which is what stops a blockless callee reached from
         # inside a yielding body from inheriting the outer caller's block.
-        ExpressionTyper.with_call_site_frame(yield_type, forwarded_frame_types(def_node, arg_types)) do
+        forwarded = positionals_unknown ? nil : forwarded_frame_types(def_node, arg_types)
+        ExpressionTyper.with_call_site_frame(yield_type, forwarded) do
           unless memo_candidate?(stack, plain_signature)
             trace_memo_refusal(stack, plain_signature)
-            next compute_user_method_return(def_node, body_scope, stack, summaries,
-                                            receiver, arg_types, plain_signature)
+            next compute_user_method_return(def_node, body_scope, stack, receiver, arg_types, plain_signature,
+                                            positionals_unknown: positionals_unknown)
           end
 
           # INVARIANT (ADR-46 recording soundness, ADR-84 WD2) — the deep cross-file dependency edges (the
@@ -3370,8 +4084,8 @@ module Rigor
           # (ActiveStorage video_analyzer.rb's subtree, 0.43s -> >90s; PR #79) and stays rejected. Pinned by
           # spec/rigor/inference/return_memo_recording_spec.rb (cross-file replay completeness) and
           # dependency_recorder_spec.rb's transitive deep-edge example.
-          consult_and_store_return_memo(def_node, body_scope, stack, summaries,
-                                        receiver, arg_types, plain_signature)
+          consult_and_store_return_memo(def_node, body_scope, stack, receiver, arg_types, plain_signature,
+                                        positionals_unknown: positionals_unknown)
         end
       end
 
@@ -3392,9 +4106,15 @@ module Rigor
       # replaced with the analysis generation cannot outlive the nodes it holds.
       def body_yields?(def_node)
         cache = class_graph_buckets[:yields]
-        return cache[def_node] if cache.key?(def_node)
+        if cache.key?(def_node)
+          return MemoAudit.check("class graph yields", cache[def_node], def_node.name) do
+            yield_reachable?(def_node.body, def_node.parameters&.block&.name)
+          end
+        end
 
-        cache[def_node] = yield_reachable?(def_node.body, def_node.parameters&.block&.name)
+        cache[def_node] = MemoAudit.key_audit("class graph yields") do
+          yield_reachable?(def_node.body, def_node.parameters&.block&.name)
+        end
       end
 
       def yield_reachable?(node, block_name)
@@ -3425,7 +4145,7 @@ module Rigor
       # The candidate-frame memo path: consult the current run generation's bucket, and on a miss compute
       # and store a FINAL result. Reached only when `memo_candidate?` held (see `infer_user_method_return`).
       # The store gate (ADR-84 WD3): a result is stored when no transient-machinery event during the
-      # bracket referenced a stack frame BELOW the bracket's entry depth (see TRANSIENT_EVENT_DEPTHS_KEY).
+      # bracket referenced a stack frame BELOW the bracket's entry depth (see TRANSIENT_EVENT_DEPTHS).
       # A separate ADR-55 fixpoint-consult bracket counter used to sit in front of this test; it is gone
       # (issue #875) because the event log already subsumes it — the sole `consult_summary` call site is
       # the in-cycle guard hit, which logs its event at the consulted owner's position first, so a consult
@@ -3439,8 +4159,11 @@ module Rigor
       # is already `Dynamic[top]` is stored anyway — see `top_result?`. A hit under ADR-46 recording
       # replays the entry's captured read-set into the current consumer (see the INVARIANT comment at the
       # call site).
-      def consult_and_store_return_memo(def_node, body_scope, stack, summaries,
-                                        receiver, arg_types, plain_signature)
+      #
+      # ADR-129 WD3 — the ADR-55 summaries are not read here: a hit neither reads nor writes them, and a miss's
+      # compute takes them ({#return_summaries}).
+      def consult_and_store_return_memo(def_node, body_scope, stack, receiver, arg_types, plain_signature,
+                                        positionals_unknown: false)
         per_def = (return_memo_bucket[def_node] ||= {})
         # Issue #525 — the `:self` fold-safety grant is a THIRD call-site-varying dimension: the same
         # `(receiver, arg_types)` body returns a folded member type when the caller's receiver expression
@@ -3451,11 +4174,8 @@ module Rigor
         # passed in for the same reason: a yielding callee's return depends on the block THIS call site
         # hands it, so two call sites passing differently-typed blocks must not share an entry. It is nil
         # for every def that cannot reach a `yield`, which is where the memo's mass is.
-        memo_key = [receiver.describe(:short),
-                    arg_types.map { |type| type.describe(:short) },
-                    body_scope.struct_fold_safe?(:self),
-                    ExpressionTyper.current_yield_value_type&.describe(:short)]
-        if (entry = per_def[memo_key])
+        memo_key = return_memo_key(body_scope, receiver, arg_types, positionals_unknown: positionals_unknown)
+        if (entry = recall_return_memo(per_def, def_node, memo_key))
           BudgetTrace.hit(BudgetTrace::MEMO_HITS)
           Analysis::DependencyRecorder.replay(entry.read_set) if Analysis::DependencyRecorder.active?
           return entry.result
@@ -3465,20 +4185,65 @@ module Rigor
 
         entry_depth = stack.size
         event_mark = transient_event_mark
-        result, read_set = compute_with_read_capture(def_node, body_scope, stack, summaries,
-                                                     receiver, arg_types, plain_signature)
+        result, read_set = MemoAudit.key_audit("return memo", RETURN_MEMO_KEY_AUDIT, memo_key) do
+          compute_with_read_capture(def_node, body_scope, stack, receiver, arg_types, plain_signature,
+                                    positionals_unknown)
+        end
 
         if context_tainted?(event_mark, entry_depth) && !top_result?(result)
           BudgetTrace.hit(BudgetTrace::MEMO_REFUSE_TRANSIENT)
+          per_def[RETURN_MEMO_REFUSED] = true
         else
-          per_def[memo_key] = MemoEntry.new(result: result, read_set: read_set,
-                                            receiver: receiver, arg_types: arg_types)
+          store_return_memo(per_def, def_node, memo_key,
+                            MemoEntry.new(result: result, read_set: read_set, receiver: receiver, arg_types: arg_types,
+                                          positionals_unknown: positionals_unknown))
         end
         result
       end
 
+      # The return memo's key: the call descriptor, the body scope's `:self` grant, and the yield-value Frame, read as a
+      # key term (ADR-129 WD1's key audit). Issue #1237 — a frame with no positional correspondence keys one term more,
+      # {POSITIONALS_UNKNOWN_KEY}, so it never shares an entry with a positional call whose list reads the same; every
+      # other key is as it was.
+      def return_memo_key(body_scope, receiver, arg_types, positionals_unknown: false)
+        MemoAudit.key do
+          key = [receiver.describe(:short),
+                 arg_types.map { |type| type.describe(:short) },
+                 body_scope.struct_fold_safe?(:self),
+                 typing_state.key_frame(YIELD_VALUE)&.describe(:short)]
+          positionals_unknown ? key << POSITIONALS_UNKNOWN_KEY : key
+        end
+      end
+
+      POSITIONALS_UNKNOWN_KEY = :positionals_unknown
+      private_constant :POSITIONALS_UNKNOWN_KEY
+
+      # The entry `per_def` holds for `memo_key`, or nil, journaled as a Table read (ADR-129 WD3).
+      def recall_return_memo(per_def, def_node, memo_key)
+        entry = per_def[memo_key]
+        log_return_memo(:read, def_node, memo_key, entry || TypingState::ABSENT)
+        entry
+      end
+
+      # Stores `entry` for `memo_key`, journaled as a Table write (ADR-129 WD3), logged before the store so a priors
+      # window notes the entry it replaces.
+      def store_return_memo(per_def, def_node, memo_key, entry)
+        log_return_memo(:write, def_node, memo_key, entry)
+        per_def[memo_key] = entry
+      end
+
+      # ADR-129 WD3 — journals a return-memo read or store under `[def_node, memo_key]`. The composite key is built
+      # only while a capture is open, so a run with the `type_of` memo off allocates nothing here.
+      def log_return_memo(kind, def_node, memo_key, value)
+        state = typing_state
+        return unless state.capturing?
+
+        key = [def_node, memo_key].freeze
+        kind == :read ? state.log_read(RETURN_MEMO, key, value) : state.log_write(RETURN_MEMO, key, value)
+      end
+
       def transient_event_mark
-        Thread.current[TRANSIENT_EVENT_DEPTHS_KEY]&.size || 0
+        typing_state.read(TRANSIENT_EVENT_DEPTHS)&.size || 0
       end
 
       # ADR-84 WD3 — true when a transient-machinery event logged during the bracket (entries past
@@ -3490,7 +4255,7 @@ module Rigor
       # outermost entry, so the suffix slice allocated an array per candidate compute — a term quadratic in
       # the event count, and the `ary_ensure_room_for_push` / GC-sweep profile issue #870 sampled.
       def context_tainted?(event_mark, entry_depth)
-        log = Thread.current[TRANSIENT_EVENT_DEPTHS_KEY]
+        log = typing_state.read(TRANSIENT_EVENT_DEPTHS)
         return false if log.nil? || log.size <= event_mark
 
         index = event_mark
@@ -3522,31 +4287,29 @@ module Rigor
       # happen in practice is the byte-identical `--format json` runs over `lib`, `plugins/*/lib`,
       # `examples/*/lib` and the survey projects recorded on issue #872.
       def top_result?(result)
-        result.equal?(Type::Combinator.untyped)
+        Type::Combinator.untyped?(result)
       end
 
       # ADR-84 WD2 — the memo-miss compute, wrapped in a `DependencyRecorder.capture` window when ADR-46
       # recording is active so the entry can carry its replayable read-set. Returns `[result, read_set]`
       # (`read_set` nil when not recording).
-      def compute_with_read_capture(def_node, body_scope, stack, summaries,
-                                    receiver, arg_types, plain_signature)
+      def compute_with_read_capture(def_node, body_scope, stack, receiver, arg_types, plain_signature,
+                                    positionals_unknown)
+        call = [def_node, body_scope, stack, receiver, arg_types, plain_signature]
         unless Analysis::DependencyRecorder.active?
-          return [compute_user_method_return(def_node, body_scope, stack, summaries,
-                                             receiver, arg_types, plain_signature), nil]
+          return [compute_user_method_return(*call, positionals_unknown: positionals_unknown), nil]
         end
 
-        Analysis::DependencyRecorder.capture do
-          compute_user_method_return(def_node, body_scope, stack, summaries,
-                                     receiver, arg_types, plain_signature)
-        end
+        Analysis::DependencyRecorder.capture { compute_user_method_return(*call, positionals_unknown: positionals_unknown) }
       end
 
       # The ADR-55 recursion-guard + value-unroll + fixpoint body of user-method return inference, factored
       # out so `infer_user_method_return` is a thin memo wrapper (the memo is the ADR-57 follow-up; this is
       # unchanged from pre-memo behaviour).
-      def compute_user_method_return(def_node, body_scope, stack, summaries,
-                                     receiver, arg_types, plain_signature)
+      def compute_user_method_return(def_node, body_scope, stack, receiver, arg_types, plain_signature,
+                                     positionals_unknown: false)
         trace_body_eval(plain_signature)
+        summaries = return_summaries
         # ADR-55 slice 1: when every bound argument is value-pinned, extend the guard key with a stable
         # descriptor of the argument *values* so distinct constant frames may recurse (e.g. `factorial(5)`
         # folds to `Constant[120]`). Distinct constant frames are bounded by `RECURSION_UNROLL_FUEL` per
@@ -3566,7 +4329,11 @@ module Rigor
           # `bot`) instead of bare `untyped`. The fixpoint loop below seeds the entry on the outermost frame;
           # if a re-entry beats it here the entry already exists. The WD4 composition: slice 1's clamp/fuel
           # fallbacks also route here when a summary is active.
-          return consult_summary(summaries, plain_signature)
+          # Issue #3162 — the summary is read only where its frame covers the re-entry's own parameter
+          # bindings and block. A value-keyed re-entry is tested like any other: the unroll frame it
+          # re-enters holds its constants, but the summary it reads is the outermost frame's.
+          floor = uncovered_reentry_floor(summaries[plain_signature], def_node, body_scope, positionals_unknown)
+          return floor || consult_summary(summaries, plain_signature)
         end
 
         # ADR-55 WD1 clamp (governing rule): the constant-arg unroll may only ever surface a fully
@@ -3586,11 +4353,16 @@ module Rigor
           # Issue #525 — read off the built scope so the bot-collapse retry rebuilds a widened scope with
           # the SAME `:self` polarity the first attempt used; a retry that silently dropped the grant would
           # return a different type for the same call.
-          self_fold_safe: body_scope.struct_fold_safe?(:self)
+          self_fold_safe: body_scope.struct_fold_safe?(:self),
+          positionals_unknown: positionals_unknown
         )
         evaluate_guarded_user_method_body(def_node, body_scope, stack, signature, context)
       end
 
+      # ADR-55 — the thread's in-flight fixpoint summaries, created on first use. Taken only by a compute, never on a
+      # return-memo hit (ADR-129 WD3), and cleared when the guard stack drains.
+      def return_summaries = typing_state.acquire(INFERENCE_SUMMARY) { {} }
+
       # Issue #1125 — the argument list a `def m(...)` body's `...` re-supplies, or nil for a def without the
       # forwarding parameter (whose body cannot contain a `...` call at all) and for a call that does not even
       # satisfy `m`'s own required positionals (that call raises at runtime; the body is not worth re-typing).
@@ -3609,8 +4381,9 @@ module Rigor
         kw_shape = positional.pop if takes_keywords?(params) && positional.last.is_a?(Type::HashShape)
         return nil if positional.size < params.requireds.size
 
+        # Frozen: a Frame value does not change while it is installed (ADR-129 WD1).
         tail = positional[(params.requireds.size + params.optionals.size)..] || []
-        kw_shape ? tail + [kw_shape] : tail
+        (kw_shape ? tail + [kw_shape] : tail).freeze
       end
 
       # True when this frame's result is a candidate for the return memo: the one structural precondition,
@@ -3631,13 +4404,14 @@ module Rigor
       # `def_nodes` table identity for runner-less scopes (single-file probes) — the pre-WD2 per-file
       # scope. A generation mismatch drops the previous bucket whole, so a re-run in one process (LSP,
       # ADR-62 warm loop) can neither hit stale entries nor accumulate them. The bucket maps `def_node`
-      # (object identity, held strongly — see RETURN_MEMO_KEY) to its per-descriptor entries.
+      # (object identity, held strongly — see RETURN_MEMO) to its per-descriptor entries.
       def return_memo_bucket
         generation = scope.run_generation || scope.discovered_def_nodes
-        slot = Thread.current[RETURN_MEMO_KEY]
+        state = typing_state
+        slot = state[RETURN_MEMO]
         unless slot && slot[0].equal?(generation)
           slot = [generation, {}.compare_by_identity]
-          Thread.current[RETURN_MEMO_KEY] = slot
+          state[RETURN_MEMO] = slot
         end
         slot[1]
       end
@@ -3687,10 +4461,10 @@ module Rigor
       # referenced frame's stack position to the load-bearing thread-local event log (regardless of
       # RIGOR_BUDGET_TRACE) and forwards the category to `BudgetTrace`. The taint spec pins that no
       # recursion-machinery `BudgetTrace.hit` exists outside this helper, so a future fallback cannot
-      # silently join unlogged (see the audit table at TRANSIENT_EVENT_DEPTHS_KEY; `context_depth` 0 is
+      # silently join unlogged (see the audit table at TRANSIENT_EVENT_DEPTHS; `context_depth` 0 is
       # always a sound conservative choice).
       def note_transient_fallback(category, context_depth)
-        (Thread.current[TRANSIENT_EVENT_DEPTHS_KEY] ||= []) << context_depth
+        typing_state.append(TRANSIENT_EVENT_DEPTHS, context_depth)
         BudgetTrace.hit(category)
       end
 
@@ -3702,25 +4476,53 @@ module Rigor
         # The outermost frame for this plain signature owns the summary entry and runs the fixpoint loop.
         # ADR-55 WD2.
         outermost = stack.none? { |frame| plain_part(frame) == context.plain_signature }
-        stack.push(signature)
+        first_unpinned = first_unpinned_frame?(stack, signature, context)
+        state = typing_state
+        state.push(INFERENCE_GUARD, signature)
         begin
           if outermost
             fixpoint_user_method_return(def_node, body_scope, context)
+          elsif first_unpinned
+            nested_fixpoint_user_method_return(def_node, body_scope, context)
           else
             type, = evaluate_body_with_returns(body_scope, def_node.body)
             clamp_unroll_result(type, context.would_have_been_guarded)
           end
         ensure
-          stack.pop
+          state.pop(INFERENCE_GUARD)
           if stack.empty?
-            Thread.current[INFERENCE_UNROLL_FUEL_KEY] = nil
-            Thread.current[INFERENCE_SUMMARY_KEY] = nil
-            Thread.current[SUMMARY_CONSULT_DEPTHS_KEY] = nil
-            Thread.current[TRANSIENT_EVENT_DEPTHS_KEY] = nil
+            state.write(INFERENCE_UNROLL_FUEL, nil)
+            state.write(INFERENCE_SUMMARY, nil)
+            state.write(SUMMARY_CONSULT_DEPTHS, nil)
+            state.write(TRANSIENT_EVENT_DEPTHS, nil)
           end
         end
       end
 
+      # Issue #3162 — whether this frame is the first of its signature with an unpinned argument: every
+      # frame of the signature below it is a constant-argument unroll frame, and the recursion has now
+      # passed something that is no constant (`rec(k - 1, *rest)` out of `rec(3, 1)`). The outermost
+      # frame's summary is the return of a body typed for its constants, which does not cover this
+      # frame's re-entries, so this frame owns a summary of its own. A frame that is all constants but
+      # out of unroll fuel is not one: its re-entries keep reading the outermost frame's summary, whose
+      # `bot` sends the outermost frame to the widened retry. Asked before the frame is pushed.
+      def first_unpinned_frame?(stack, signature, context)
+        plain_signature = context.plain_signature
+        signature.equal?(plain_signature) && stack.none?(plain_signature) &&
+          constant_argument_value_key(context.arg_types).nil?
+      end
+
+      # The fixpoint of a {#first_unpinned_frame?} frame, run over its own summary entry; the outermost
+      # frame's entry is put back afterwards.
+      def nested_fixpoint_user_method_return(def_node, body_scope, context)
+        summaries = context.summaries
+        outer = summaries[context.plain_signature]
+        fixpoint_user_method_return(def_node, body_scope, context)
+      ensure
+        summaries[context.plain_signature] = outer
+        LoopValueRecord.advance_generation
+      end
+
       # Evaluates a method body and joins the value types of every explicit `return value` reached during
       # the walk with the body's tail type.
       #
@@ -3749,14 +4551,11 @@ module Rigor
       def fixpoint_user_method_return(def_node, body_scope, context, widened: false)
         plain_signature = context.plain_signature
         summaries = context.summaries
-        depth = seed_fixpoint_summary(summaries, plain_signature)
-        consult_depths = (Thread.current[SUMMARY_CONSULT_DEPTHS_KEY] ||= [])
+        depth = seed_fixpoint_summary(summaries, plain_signature, body_scope, context.receiver)
 
-        RECURSION_FIXPOINT_CAP.times do |iteration|
-          summaries[plain_signature][:consulted] = false
-          consult_mark = consult_depths.size
-          type, = evaluate_body_with_returns(body_scope, def_node.body)
-          computed = clamp_unroll_result(type, context.would_have_been_guarded)
+        iteration = 0
+        while iteration < RECURSION_FIXPOINT_CAP
+          computed, entangled = evaluate_fixpoint_iterate(def_node, body_scope, context, depth)
 
           # Cross-signature mutual recursion (ADR-55 soundness fix, 2026-06-12): the evaluation consulted an
           # ANCESTOR signature's in-flight summary (seed depth shallower than this frame's), so `computed`
@@ -3764,9 +4563,7 @@ module Rigor
           # `Constant[false]`. The per-signature iteration below cannot converge such an entangled pair (each
           # side's iterate is conditioned on the other's unfinished assumption), so degrade this frame to the
           # sound `untyped` floor instead of surfacing a one-sided value.
-          if consult_depths[consult_mark..].any? { |d| d < depth }
-            return degrade_entangled_fixpoint(summaries, plain_signature)
-          end
+          return degrade_entangled_fixpoint(summaries, plain_signature) if entangled
 
           # The summary was never consulted — the method did not recurse on this evaluation, so there is no
           # fixpoint to chase. Return the computed type directly (pre-fixpoint behaviour for non-recursive
@@ -3784,26 +4581,153 @@ module Rigor
             return resolved unless resolved.nil?
           end
 
+          # Issue #3162 — a re-entry read the summary for arguments this frame's parameters do not cover
+          # (`acc(n - 1, k + 1)` against `k = 1`), so `computed` holds this frame's base case as that
+          # call's answer. The evaluation is discarded and the body typed again with such a re-entry
+          # answering `Dynamic[top]`; it is not a Kleene step.
+          next if floored_uncovered_reentries?(summaries[plain_signature])
+
           converged = fixpoint_step(summaries, plain_signature, computed, iteration)
           return converged if converged
+
+          iteration += 1
         end
 
         # Out of iterations and still unstable. The collapse is the loop's own tail rather than a branch
-        # inside `fixpoint_step`: `Integer#times` yields its receiver when no iteration returns, so a
-        # tail-less loop reads as a path that returns an Integer summary (the `def.return-type-mismatch`
-        # on `return_type_for` this shape retired), and the loop, not the step, owns its cap.
+        # inside `fixpoint_step`: the loop, not the step, owns its cap.
         collapse_fixpoint_cap(summaries, plain_signature)
       end
 
+      # One body evaluation of the fixpoint loop, as `[computed, entangled]`: the clamped return, and
+      # whether the evaluation consulted an ancestor signature's in-flight summary (one seeded shallower
+      # than `depth`). Clears the summary's per-evaluation record first.
+      def evaluate_fixpoint_iterate(def_node, body_scope, context, depth)
+        entry = context.summaries[context.plain_signature]
+        entry[:consulted] = false
+        entry[:uncovered] = false
+        consult_depths = typing_state.acquire(SUMMARY_CONSULT_DEPTHS) { [] }
+        consult_mark = consult_depths.size
+        type, = evaluate_body_with_returns(body_scope, def_node.body)
+        computed = clamp_unroll_result(type, context.would_have_been_guarded)
+        [computed, consult_depths[consult_mark..].any? { |consulted| consulted < depth }]
+      end
+
+      # Switches the summary to its floor after an evaluation in which an uncovered re-entry read it, and
+      # says whether it did. Once on the floor such a re-entry never reads the summary again, so the
+      # switch happens at most once per fixpoint.
+      #
+      # A `bot` iterate has been to the widened retry first. When that retry found no exit either
+      # (`spin`), the entry here is the retry's own, which noted nothing, and the answer stays `bot`.
+      def floored_uncovered_reentries?(entry)
+        return false unless entry[:uncovered] && !entry[:floor]
+
+        entry[:floor] = true
+        LoopValueRecord.advance_generation
+        true
+      end
+
+      # Issue #3162 — the answer of a re-entry the summary's frame does not cover, or nil for one that
+      # reads the summary. The uncovered re-entry is noted on the entry; until the fixpoint owner has
+      # switched the summary to its floor ({#floored_uncovered_reentries?}) it still reads the summary,
+      # so a body whose iterate is `bot` reaches the widened retry as before. On the floor it answers
+      # `untyped`, the pre-slice-2 observable for an in-cycle call.
+      def uncovered_reentry_floor(entry, def_node, body_scope, positionals_unknown)
+        return nil if entry.nil?
+        return nil if summary_covers_reentry?(entry, def_node, body_scope.locals, positionals_unknown)
+
+        entry[:uncovered] = true
+        return nil unless entry[:floor]
+
+        scope.record_dynamic_origin(@typing_node, DynamicOrigin::ANALYZER_BUDGET_CUTOFF) if @typing_node
+        Type::Combinator.untyped
+      end
+
+      # Issue #3162 — whether the summary's frame covers a re-entry's parameter bindings (`locals`, as the
+      # guard site built them): every parameter of the frame holds a type that includes what the re-entry
+      # bound it to. The summary is the return of the frame's body under the frame's bindings, so it is
+      # the re-entry's return only then; a parameter passed through unchanged is the same type object.
+      #
+      # A re-entry through a call-site `*splat` has no positional correspondence, and its binder holds
+      # `Dynamic[top]` for every positional. There the def's own calls are read instead
+      # ({RecursionRebinding}): a positional every one of them passes through unchanged (`*rest` as
+      # `*rest`) is covered, and any other is not.
+      #
+      # The block is part of the frame too: `yield` answers the frame's block ({#reentry_block_covered?}).
+      def summary_covers_reentry?(entry, def_node, locals, positionals_unknown)
+        return false unless reentry_block_covered?(entry, def_node)
+
+        kept = (entry[:kept] ||= kept_positional_parameters(def_node, entry[:receiver])) if positionals_unknown
+        frame = entry[:locals]
+        locals.all? do |name, argument|
+          bound = frame[name]
+          bound.nil? || kept&.include?(name) || binding_covers?(bound, argument)
+        end
+      end
+
+      # Whether the re-entry runs with a block the summary's frame covers. A re-entry with no block, or
+      # one that passes the def's own block parameter on (`&blk`, or the anonymous `&`), does; `&blk` is
+      # the frame's block only while the body never assigns `blk` and no block or lambda in it declares
+      # the name ({RecursionRebinding}'s write and block-local scan, as for a positional). One that
+      # passes another `&expression` does not. A block literal does when the value it yields is covered
+      # by the value the frame's block yields, which is nil on both sides for a def that never `yield`s.
+      # The re-entry's call is the node being typed; with none to read, only the yield values are compared.
+      def reentry_block_covered?(entry, def_node)
+        block = @typing_node.block if @typing_node.is_a?(Prism::CallNode)
+        return true if @typing_node.is_a?(Prism::CallNode) && block.nil?
+        return own_block_passed?(def_node, block) if block.is_a?(Prism::BlockArgumentNode)
+
+        yielded = ExpressionTyper.current_yield_value_type
+        return true if yielded.nil?
+
+        frame_yield = entry[:yield]
+        !frame_yield.nil? && binding_covers?(frame_yield, yielded)
+      end
+
+      def own_block_passed?(def_node, block)
+        params = def_node.parameters
+        own = params.block if params.is_a?(Prism::ParametersNode)
+        return false if own.nil?
+
+        expression = block.expression
+        return own.name.nil? if expression.nil?
+        return false unless expression.is_a?(Prism::LocalVariableReadNode) && expression.name == own.name
+
+        written = RecursionRebinding.rebound_parameters(def_node, Set.new)
+        written != RecursionRebinding::ALL && !written.include?(own.name)
+      end
+
+      # `2` is covered by `Integer` though their union is spelled `2 | Integer`, so the argument is also
+      # tried with its value pins widened.
+      def binding_covers?(bound, argument)
+        return true if argument.equal?(bound) || Type::Combinator.untyped?(bound) || argument == bound
+        return false if Type::Combinator.untyped?(argument)
+        return true if Type::Combinator.union(bound, argument) == bound
+
+        Type::Combinator.union(bound, widen_bound_argument(argument)) == bound
+      end
+
+      def kept_positional_parameters(def_node, receiver)
+        params = def_node.parameters
+        rebound = recursion_rebound_parameters(def_node, receiver)
+        return [] if rebound == RecursionRebinding::ALL || !params.is_a?(Prism::ParametersNode)
+
+        positionals = params.requireds + params.optionals + params.posts + [params.rest]
+        positionals.filter_map { |param| param.name if param.respond_to?(:name) && param.name } - rebound.to_a
+      end
+
       # Seeds the thread-local summary entry for a fixpoint owner: the `bot` Kleene seed plus the
       # guard-stack depth at seed time (the frame for this signature is already pushed), which
       # `consult_summary` logs so nested fixpoints can detect a foreign in-flight (ancestor) consult.
       # Returns the seed depth. ADR-55 slice 2.
-      def seed_fixpoint_summary(summaries, plain_signature)
-        depth = (Thread.current[INFERENCE_GUARD_KEY] || []).size
+      def seed_fixpoint_summary(summaries, plain_signature, body_scope, receiver)
+        depth = typing_state[INFERENCE_GUARD]&.size || 0
         summaries[plain_signature] = {
-          assumption: Type::Combinator.bot, consulted: false, depth: depth
+          assumption: Type::Combinator.bot, consulted: false, depth: depth,
+          # Issue #3162 — the frame the summary is the return of, for {#summary_covers_reentry?}.
+          locals: body_scope.locals, yield: ExpressionTyper.current_yield_value_type, receiver: receiver,
+          uncovered: false, floor: false
         }
+        LoopValueRecord.advance_generation
         depth
       end
 
@@ -3816,13 +4740,14 @@ module Rigor
         note_transient_fallback(BudgetTrace::RECURSION_GUARD, own_guard_frame_position)
         scope.record_dynamic_origin(@typing_node, DynamicOrigin::ANALYZER_BUDGET_CUTOFF) if @typing_node
         summaries[plain_signature][:assumption] = Type::Combinator.untyped
+        LoopValueRecord.advance_generation
         Type::Combinator.untyped
       end
 
       # The stack position of the currently-evaluating owner frame (the guard stack's top) — the
       # self-referential `context_depth` for events that are deterministic per owner (ADR-84 WD3).
       def own_guard_frame_position
-        size = Thread.current[INFERENCE_GUARD_KEY]&.size || 0
+        size = typing_state[INFERENCE_GUARD]&.size || 0
         size.positive? ? size - 1 : 0
       end
 
@@ -3843,6 +4768,7 @@ module Rigor
         return candidate if joined == assumption
 
         summaries[plain_signature][:assumption] = joined
+        LoopValueRecord.advance_generation
         nil
       end
 
@@ -3854,17 +4780,67 @@ module Rigor
         note_transient_fallback(BudgetTrace::RECURSION_FIXPOINT_CAP, own_guard_frame_position)
         scope.record_dynamic_origin(@typing_node, DynamicOrigin::ANALYZER_BUDGET_CUTOFF) if @typing_node
         summaries[plain_signature][:assumption] = Type::Combinator.untyped
+        LoopValueRecord.advance_generation
         Type::Combinator.untyped
       end
 
       # Rebuilds the user-method body scope with every bound positional parameter widened to its nominal
       # base (`1 | 2 | 3` → `Integer`, `Constant[:x]` → `Symbol`). Used by the bot-collapse retry in
       # `fixpoint_user_method_return`: call-site argument narrowing can prune a recursive method's base
-      # case, and widening restores the declared-type view under which the base case is reachable. Returns
-      # `nil` when the parameter shape is not inferable (mirrors `build_user_method_body_scope`).
-      def widened_user_method_body_scope(def_node, receiver, arg_types, self_fold_safe: false)
-        widened_args = arg_types.map { |arg_type| widen_value_pinned(arg_type) }
-        build_user_method_body_scope(def_node, receiver, widened_args, self_fold_safe: self_fold_safe)
+      # case, and widening restores the declared-type view under which the base case is reachable. A
+      # parameter the def's own recursive calls rebind is bound `Dynamic[top]` instead ({RecursionRebinding}).
+      # Returns `nil` when the parameter shape is not inferable (mirrors `build_user_method_body_scope`).
+      def widened_user_method_body_scope(def_node, receiver, arg_types, self_fold_safe: false,
+                                         positionals_unknown: false)
+        widened_args = arg_types.map { |arg_type| widen_bound_argument(arg_type) }
+        build_user_method_body_scope(def_node, receiver, widened_args,
+                                     self_fold_safe: self_fold_safe, positionals_unknown: positionals_unknown,
+                                     rebound: recursion_rebound_parameters(def_node, receiver))
+      end
+
+      # Issue #3115 — {RecursionRebinding.rebound_parameters} for `def_node`, told the def's other names: a name
+      # the body calls is an alias when `receiver`'s class resolves it to this same def (`alias al2 al1` makes
+      # `al2(n - 1, !f)` a recursive call). A receiver whose class cannot be asked rebinds every parameter.
+      def recursion_rebound_parameters(def_node, receiver)
+        names = Set[def_node.name]
+        RecursionRebinding.called_names(def_node.body).each do |name|
+          next if name == def_node.name
+
+          resolved = recursion_def_for(receiver, name)
+          return RecursionRebinding::ALL if resolved == :unknown
+
+          names << name if resolved.equal?(def_node)
+        end
+        RecursionRebinding.rebound_parameters(def_node, names)
+      end
+
+      def recursion_def_for(receiver, method_name)
+        return scope.singleton_def_for(receiver.class_name, method_name) if receiver.is_a?(Type::Singleton)
+        return :unknown unless user_inference_receiver?(receiver)
+
+        resolve_user_def_through_ancestors(receiver.class_name, method_name)
+      end
+
+      # Issue #3115 — one argument of the widened retry. A keyword argument reaches the binder inside the call's
+      # trailing `HashShape`, which {#widen_value_pinned} leaves as it is (a shape is not a value pin), so a
+      # keyword parameter kept its call-site pin through the retry and the base case stayed pruned: the body
+      # then converged on the `bot` seed. A shape carrier keeps its keys, policy and arity, and the values it
+      # holds widen at every depth: a `HashShape`'s values, a `Tuple`'s elements and a `Union`'s members.
+      def widen_bound_argument(arg_type)
+        case arg_type
+        when Type::HashShape
+          Type::HashShape.new(
+            arg_type.pairs.transform_values { |value| widen_bound_argument(value) },
+            required_keys: arg_type.required_keys, optional_keys: arg_type.optional_keys,
+            read_only_keys: arg_type.read_only_keys, extra_keys: arg_type.extra_keys
+          )
+        when Type::Tuple
+          Type::Combinator.tuple_of(*arg_type.elements.map { |element| widen_bound_argument(element) })
+        when Type::Union
+          Type::Combinator.union(*arg_type.members.map { |member| widen_bound_argument(member) })
+        else
+          widen_value_pinned(arg_type)
+        end
       end
 
       # ADR-55 slice 2 bot-collapse resolution (2026-06-11). Called when a fixpoint iteration computed `bot`
@@ -3885,7 +4861,8 @@ module Rigor
       def resolve_bot_collapse(def_node, context, widened:)
         unless widened
           widened_scope = widened_user_method_body_scope(def_node, context.receiver, context.arg_types,
-                                                         self_fold_safe: context.self_fold_safe)
+                                                         self_fold_safe: context.self_fold_safe,
+                                                         positionals_unknown: context.positionals_unknown)
           return fixpoint_user_method_return(def_node, widened_scope, context, widened: true) unless widened_scope.nil?
         end
 
@@ -3927,7 +4904,7 @@ module Rigor
         return Type::Combinator.untyped if entry.nil?
 
         entry[:consulted] = true
-        (Thread.current[SUMMARY_CONSULT_DEPTHS_KEY] ||= []) << entry[:depth]
+        typing_state.append(SUMMARY_CONSULT_DEPTHS, entry[:depth])
         entry[:assumption]
       end
 
@@ -3966,10 +4943,11 @@ module Rigor
       # drains back to empty. On exhaustion (return 0) it records a `RECURSION_UNROLL_FUEL` hit so the caller
       # keeps the plain `(receiver, method)` signature — today's behaviour.
       def unroll_fuel_remaining(stack)
-        remaining = Thread.current[INFERENCE_UNROLL_FUEL_KEY]
+        state = typing_state
+        remaining = state.read(INFERENCE_UNROLL_FUEL)
         remaining = RECURSION_UNROLL_FUEL if remaining.nil? || stack.empty?
         if remaining.positive?
-          Thread.current[INFERENCE_UNROLL_FUEL_KEY] = remaining - 1
+          state.write(INFERENCE_UNROLL_FUEL, remaining - 1)
         else
           # ADR-84 WD3 — position 0: fuel is one shared resource seeded at the stack bottom, so its
           # exhaustion is context-dependent for every nested bracket.
@@ -4018,9 +4996,28 @@ module Rigor
             total += descriptor.last
           end
           [["t", parts], total]
+        when Type::HashShape then pinned_shape_descriptor(arg)
         end
       end
 
+      # Issue #3115 — a call's keyword arguments arrive as one closed `HashShape`, so `m(n: 2)` is as
+      # value-pinned as `m(2)` when every entry is. An open shape, or one with an optional key, does not name
+      # one argument list and stays on the type-keyed path.
+      def pinned_shape_descriptor(shape)
+        return nil unless shape.closed? && shape.optional_keys.empty?
+
+        parts = []
+        total = 1
+        shape.pairs.each do |key, value|
+          descriptor = pinned_value_descriptor(value)
+          return nil if descriptor.nil?
+
+          parts << [key.inspect, descriptor.first]
+          total += descriptor.last
+        end
+        [["h", parts], total]
+      end
+
       # Builds the body scope for a user-defined instance method call: a fresh `Scope` with `self_type` set
       # to the receiver's nominal type, the project-wide accumulators inherited (so the body sees the same
       # `discovered_classes` / `class_ivars` / etc. the caller does), and the call's `arg_types` bound to
@@ -4042,11 +5039,25 @@ module Rigor
       # through it. Record a per-file write kind in the census instead, as {ScopeIndexer::CONSTANT_MEMO} does
       # (#1276). Setting `source_path` here was rejected: plugins read it, and the return memo would become
       # caller-dependent.
-      def build_user_method_body_scope(def_node, receiver, arg_types, self_fold_safe: false)
+      #
+      # Issue #3115 — `rebound:` is the widened retry's set ({#widened_user_method_body_scope}): the parameters
+      # the def's own recursive calls rebind ({RecursionRebinding}), each bound `Dynamic[top]` whether the call
+      # wrote the slot or a default filled it. The retry types the body for every call the recursion makes,
+      # and such a slot holds whatever a recursive call passes (`tog(n: n - 1, f: !f)` against `f: false`).
+      def build_user_method_body_scope(def_node, receiver, arg_types, self_fold_safe: false,
+                                       positionals_unknown: false, rebound: nil)
         params = def_node.parameters
-        locals = bind_params_from_call_types(params, arg_types)
+        locals =
+          if positionals_unknown
+            bind_params_without_correspondence(params, arg_types.last)
+          else
+            bind_params_from_call_types(params, arg_types)
+          end
         return nil if locals.nil?
 
+        rebound = locals.keys if rebound == RecursionRebinding::ALL
+        rebound&.each { |name| locals[name] = dynamic_top if locals.key?(name) }
+
         # Construct the body scope in a SINGLE Scope allocation (plus the issue #1358 frame it carries, whose
         # scans run only on demand) — the previous `Scope.empty.with_*.with_*…` chain
         # allocated a fresh frozen Scope per field, run per user-method-call inference (ADR-44). The
@@ -4111,9 +5122,15 @@ module Rigor
       def self_fold_safe_grant?(def_node, receiver)
         per_def = (class_graph_buckets[:self_pure][def_node] ||= {})
         key = [receiver.class_name, receiver.member_names]
-        return per_def[key] if per_def.key?(key)
+        if per_def.key?(key)
+          return MemoAudit.check("class graph self pure", per_def[key], def_node.name, key) do
+            self_fold_safe_body?(def_node.body, receiver, [def_node])
+          end
+        end
 
-        per_def[key] = self_fold_safe_body?(def_node.body, receiver, [def_node])
+        per_def[key] = MemoAudit.key_audit("class graph self pure") do
+          self_fold_safe_body?(def_node.body, receiver, [def_node])
+        end
       end
 
       # Whether `body`'s every use of `self` is a pure read, resolving each unrecognised self-call against
@@ -4148,6 +5165,11 @@ module Rigor
         locals = bind_positional_params(params, positional)
         return nil if locals.nil?
 
+        bind_keyword_and_block_params(params, kw_shape, locals)
+      end
+
+      # The keyword, `**rest` and block parameters' bindings, added to `locals`, which it returns.
+      def bind_keyword_and_block_params(params, kw_shape, locals)
         bind_keyword_params(params, kw_shape, locals)
         rest_name = keyword_rest_name(params)
         locals[rest_name.to_sym] = keyword_rest_type(params, kw_shape) if rest_name
@@ -4155,6 +5177,25 @@ module Rigor
         locals
       end
 
+      # Issue #1237 — the locals table for a call whose positional correspondence is unknown (a `*splat` at the
+      # call site). Every positional parameter (required, optional, trailing) binds `Dynamic[top]` and the rest
+      # parameter an `Array[untyped]`; the keyword parameters bind from `keywords` as {#bind_keyword_params} does
+      # for any call, so an open shape leaves them `Dynamic[top]`. An optional's default is not used: the splat
+      # may supply the slot.
+      def bind_params_without_correspondence(params, keywords)
+        return {} if params.nil?
+        return nil unless params.is_a?(Prism::ParametersNode)
+
+        locals = {}
+        (params.requireds + params.posts).each { |param| bind_positional_param(locals, param, dynamic_top) }
+        params.optionals.each { |param| locals[param.name.to_sym] = dynamic_top }
+        rest = params.rest
+        if rest.respond_to?(:name) && rest.name
+          locals[rest.name.to_sym] = Type::Combinator.nominal_of("Array", type_args: [dynamic_top])
+        end
+        bind_keyword_and_block_params(params, keywords, locals)
+      end
+
       # Trailing required positionals after a rest (`def f(a, *m, z)`) shift the correspondence and stay
       # declined — correspondence, not width, is the issue. Issue #1125: `def m(...)`'s forwarding slot is no
       # longer a decline. Its NAMED parameters (a leading `def m(a, ...)` required) bind exactly as before;
@@ -4300,7 +5341,7 @@ module Rigor
       # now carry what the callee needs:
       #
       # - `f(...)` inside `def m(...)` re-supplies the arguments `m` was called with, read from the frame
-      #   {#infer_user_method_return} installed ({FORWARDED_ARGS_KEY}) — so it expands to a whole LIST, not
+      #   {#infer_user_method_return} installed ({FORWARDED_ARGS}) — so it expands to a whole LIST, not
       #   one type, which is why the map became a flat_map.
       # - a keyword hash built ENTIRELY from a double splat (`f(**h)`) is the shape of `h`, so `f(**h)`
       #   binds the same parameters the literal form `f(a: 1, b: 2)` does.
@@ -4396,7 +5437,7 @@ module Rigor
         )
         block_return_for(
           block_arg, expected,
-          call_node: call_node,
+          call_node: call_node, receiver_type: receiver_type,
           narrowing: block_body_self_narrowing(call_node, receiver_type),
           repeats: !BLOCK_VALUE_DISCARDING.include?(call_node.name) && block_may_repeat?(call_node, receiver_type)
         )
@@ -4469,7 +5510,7 @@ module Rigor
         param_types = break_arm_param_types(call_node, receiver)
         block_scope = block_entry_scope(
           block_node, param_types,
-          call_node: call_node,
+          call_node: call_node, receiver_type: receiver,
           narrowing: block_body_self_narrowing(call_node, receiver),
           captured: repeating_captured_bindings(block_node, param_types, block_may_repeat?(call_node, receiver))
         )
@@ -4512,12 +5553,13 @@ module Rigor
         )
       end
 
-      def block_return_for(block_arg, expected, call_node: nil, narrowing: nil, repeats: false)
+      def block_return_for(block_arg, expected, call_node: nil, narrowing: nil, repeats: false, receiver_type: nil)
         case block_arg
         when Prism::BlockNode
           captured = repeating_captured_bindings(block_arg, expected, repeats)
           entry = block_entry_scope(
-            block_arg, expected, call_node: call_node, narrowing: narrowing, captured: captured
+            block_arg, expected,
+            call_node: call_node, narrowing: narrowing, captured: captured, receiver_type: receiver_type
           )
           type_block_body(block_arg, entry, captured: captured)
         when Prism::BlockArgumentNode
@@ -4545,8 +5587,16 @@ module Rigor
       # Issue #316 — mirrors `StatementEvaluator#build_block_entry_scope`: the block body's `self` is the
       # yielding method's business, so the return-typing pass must see the same unmodelled-self mark. Issue #1358
       # — and the same match-global view ({MatchRebinding.block_entry}), which reads the owning `call_node`.
-      def block_entry_scope(block_node, expected, call_node: nil, narrowing: nil, captured: nil)
-        entry = MatchRebinding.block_entry(scope.entering_opaque_block, block_node, call_node)
+      #
+      # Issue #2861 — and the same self-preserving entry ({SelfPreservingBlock}), read off `receiver_type`.
+      def block_entry_scope(block_node, expected, call_node: nil, narrowing: nil, captured: nil, receiver_type: nil)
+        self_entry = if SelfPreservingBlock.call?(call_node, receiver_type, scope)
+                       scope.entering_self_preserving_block
+                     else
+                       scope.entering_opaque_block
+                     end
+        entry = MatchRebinding.block_entry(self_entry, block_node, call_node)
+        entry = entry.entering_block_without_gradual_marks(block_node)
         entry = captured.lay(entry) if captured
         block_scope = BlockParameterBinder.new(expected_param_types: expected).bind_onto(block_node, entry)
         return block_scope unless narrowing
@@ -4816,23 +5866,20 @@ module Rigor
       # Suppression flag for {#threaded_block_body_type} — set while a fold is running (so a fold never nests)
       # and while the per-element Tuple fold is over its arity cap. Thread-local because block typing is
       # re-entrant within one thread and the fork-pool workers each own their own.
-      THREADED_BLOCK_BODY_KEY = :__rigor_threaded_block_body__
-      private_constant :THREADED_BLOCK_BODY_KEY
+      THREADED_BLOCK_BODY = TypingState.frame(
+        :threaded_block_body, reason: "a suppression flag installed per fold",
+                              witness: "spec/fixtures/typing_state_witnesses/threaded_block_body.rb"
+      )
+      private_constant :THREADED_BLOCK_BODY
 
       def block_body_threading_suppressed?
-        Thread.current[THREADED_BLOCK_BODY_KEY] ? true : false
+        typing_state[THREADED_BLOCK_BODY] ? true : false
       end
 
       # Runs the block with the scope-threading fold suppressed, restoring the previous state (not clearing
       # it) on the way out, so nesting a suppressed region inside another cannot re-enable threading.
-      def without_block_body_threading
-        previous = Thread.current[THREADED_BLOCK_BODY_KEY]
-        Thread.current[THREADED_BLOCK_BODY_KEY] = true
-        begin
-          yield
-        ensure
-          Thread.current[THREADED_BLOCK_BODY_KEY] = previous
-        end
+      def without_block_body_threading(&)
+        TypingState.current.with(THREADED_BLOCK_BODY, true, &)
       end
 
       # Every variable-write form whose name `StatementEvaluator` threads into the following statement's
@@ -5027,11 +6074,13 @@ module Rigor
       # position matches. `r = [1, 2].find(-> { 0 }) { |e| e > 5 }` is `0` at runtime; the walk answered `nil`,
       # and `r + 1` then reported a nil receiver on correct code. The other supported methods take no argument.
       PER_ELEMENT_TUPLE_METHODS = Set[
-        :map, :collect, :filter_map, :flat_map,
-        :select, :filter, :reject,
-        :find, :detect, :find_index, :index
+        :map, :collect, :filter_map, :flat_map, :collect_concat,
+        :select, :filter, :find_all, :reject, :take_while, :drop_while,
+        :partition, :count, :find, :detect, :rfind, :find_index, :index, :rindex
       ].freeze
-      private_constant :PER_ELEMENT_TUPLE_METHODS
+      ARRAY_ONLY_PER_ELEMENT_METHODS = Set[:index, :rindex, :rfind].freeze
+      REVERSE_PER_ELEMENT_METHODS = Set[:rfind, :rindex].freeze
+      private_constant :PER_ELEMENT_TUPLE_METHODS, :ARRAY_ONLY_PER_ELEMENT_METHODS, :REVERSE_PER_ELEMENT_METHODS
 
       HASH_SHAPE_TRANSFORM_METHODS = Set[
         :transform_keys, :transform_keys!,
@@ -5050,23 +6099,35 @@ module Rigor
       private_constant :PER_ELEMENT_RANGE_LIMIT
 
       def try_per_element_block_fold(call_node, receiver_type)
-        return nil unless PER_ELEMENT_TUPLE_METHODS.include?(call_node.name)
+        name = call_node.name
+        return nil unless PER_ELEMENT_TUPLE_METHODS.include?(name)
+        return nil if ARRAY_ONLY_PER_ELEMENT_METHODS.include?(name) && !receiver_type.is_a?(Type::Tuple)
         return nil unless call_node.arguments.nil?
 
         element_types = per_element_elements_of(receiver_type)
         return nil if element_types.nil? || element_types.empty?
 
-        per_position = per_element_block_results(call_node.block, element_types)
+        per_position = evaluate_per_element_positions(call_node.block, element_types, name)
+        return nil if per_position.nil?
+
+        assemble_per_element_result(name, per_position, element_types) ||
+          undecided_fold_floor(name, element_types, receiver_type)
+      end
+
+      def evaluate_per_element_positions(block, element_types, method_name)
+        reverse = REVERSE_PER_ELEMENT_METHODS.include?(method_name)
+        eval_elements = reverse ? element_types.reverse : element_types
+        per_position = per_element_block_results(block, eval_elements)
         return nil if per_position.nil? || per_position.any?(&:nil?)
 
-        assemble_per_element_result(call_node.name, per_position, element_types) ||
-          undecided_fold_floor(call_node.name, element_types, receiver_type)
+        reverse ? per_position.reverse : per_position
       end
 
-      # The honest answer for the find family (`find` / `detect` / `find_index` / `index`) and the filter family
-      # (`select` / `filter` / `reject`) when this fold walked every position and the assembler still could not
-      # decide — which happens for exactly one reason: some position's predicate is not a `Constant`, so "the
-      # first matching one" or "the ones kept" is not a static fact.
+      # The honest answer for the find family (`find` / `detect` / `rfind` / `find_index` / `index` / `rindex`),
+      # the filter family (`select` / `filter` / `find_all` / `reject` / `take_while` / `drop_while`), and `count`
+      # when this fold walked every position and the assembler still could not decide — which happens for
+      # exactly one reason: some position's predicate is not a `Constant`, so "the matching one" or "the ones
+      # kept" is not a static fact.
       #
       # Falling through to the dispatcher was WRONG for this family, and issue #617 residue (1) is the bill:
       # `seen = 0; [1, 2].find do |e| seen += 1; seen == 2 end` answered `nil` where the runtime answers `2`.
@@ -5076,30 +6137,34 @@ module Rigor
       # typed the predicate per position and saw that it does not fold. Answering here is what keeps that
       # knowledge from being thrown away in favour of a worse-informed tier.
       #
-      # The floor is what `find` can return and no tighter: one of the receiver's own elements, or `nil` when
-      # no element matches. Value pinning survives because it is still true of every candidate — `find` hands
-      # back an element, it does not compute one. `find_index` / `index` answer a position in the receiver, so
-      # `Integer?` is their floor.
-      #
-      # `select` / `filter` / `reject` take a floor for the same reason. Their fall-through is not merely
-      # wider: `BlockFolding`'s filter folds DO answer on a `Constant` block, and the entry-scope pin hands
-      # them one, so `seen = 0; [1, 2].select do |e| seen += 1; seen == 2 end` answered a provably-empty `[]`
-      # where Ruby answers `[2]`. Nested inside a threaded body, where a position can be typed tail-only
-      # ({#tail_only_body_floor}), `[[], []].select do |a| a << w; a.any? end` did the same. Their floor is an
-      # Array of the receiver's own elements: which of them survive is undecided, and what they are is not.
-      # A range receiver's elements are widened first ({#filter_family_floor}).
+      # The floor is what `find` / `rfind` can return and no tighter: one of the receiver's own elements, or
+      # `nil` when no element matches. Value pinning survives because it is still true of every candidate —
+      # `find` hands back an element, it does not compute one. `find_index` / `index` / `rindex` answer a
+      # position in the receiver, so `Integer?` is their floor.
+      #
+      # `select` / `filter` / `find_all` / `reject` / `take_while` / `drop_while` take a floor for the same
+      # reason. Their fall-through is not merely wider: `BlockFolding`'s filter folds DO answer on a `Constant`
+      # block, and the entry-scope pin hands them one, so `seen = 0; [1, 2].select do |e| seen += 1; seen == 2
+      # end` answered a provably-empty `[]` where Ruby answers `[2]`. Nested inside a threaded body, where a
+      # position can be typed tail-only ({#tail_only_body_floor}), `[[], []].select do |a| a << w; a.any? end`
+      # did the same. Their floor is an Array of the receiver's own elements: which of them survive is
+      # undecided, and what they are is not. A range receiver's elements are widened first
+      # ({#filter_family_floor}). `count` likewise floors to `Integer` so an undecided block never falls through
+      # to `BlockFolding`'s entry-scope `0` or `size`.
       #
       # Nothing else in {PER_ELEMENT_TUPLE_METHODS} takes a floor. `map`'s assembler cannot decline, and
-      # `BlockFolding` never folds `filter_map` / `flat_map`, so their fall-through is the RBS `Array[U]`
+      # `BlockFolding` never folds `filter_map` / `flat_map` / `partition`, so their fall-through is the RBS
       # projection.
       def undecided_fold_floor(method_name, element_types, receiver_type)
         case method_name
-        when :find, :detect
+        when :find, :detect, :rfind
           Type::Combinator.union(*element_types, Type::Combinator.constant_of(nil))
-        when :select, :filter, :reject
+        when :select, :filter, :find_all, :reject, :take_while, :drop_while
           filter_family_floor(element_types, receiver_type)
-        when :find_index, :index
+        when :find_index, :index, :rindex
           Type::Combinator.union(Type::Combinator.nominal_of("Integer"), Type::Combinator.constant_of(nil))
+        when :count
+          Type::Combinator.nominal_of("Integer")
         end
       end
 
@@ -5637,9 +6702,13 @@ module Rigor
       # Records `type` as the accumulator `block` receives when typed from this typer's scope
       # ({.recorded_inject_accumulator}). Prism nodes compare by identity. The keys are weak but the values strong,
       # and a recorded scope reaches the parse tree that holds the key, so a record never goes on its own (issue
-      # #2412): the map is a run-scoped slot ({RunScopedSlots}), emptied when the run that filled it ends.
+      # #2412): the map is a run-scoped slot ({TypingState.release_run_scoped}), emptied when the run that filled it
+      # ends.
       def record_inject_accumulator(block, type)
-        (Thread.current[INJECT_ACCUMULATOR_KEY] ||= ObjectSpace::WeakKeyMap.new)[block] = [scope, type].freeze
+        record = [scope, type, LoopValueRecord.generation].freeze
+        state = typing_state
+        state.log_write(INJECT_ACCUMULATOR, block, record)
+        state.weak_key_map(INJECT_ACCUMULATOR)[block] = record
       end
 
       # Issue #1332 — the #587 (b) captured-block binding ({#captured_block_bindings}) both inject arms lay under
@@ -5754,18 +6823,44 @@ module Rigor
         result
       end
 
+      PER_ELEMENT_ASSEMBLERS = {
+        map: :assemble_map_result,
+        collect: :assemble_map_result,
+        filter_map: :assemble_filter_map_result,
+        flat_map: :assemble_flat_map_result,
+        collect_concat: :assemble_flat_map_result,
+        select: :assemble_select_result,
+        filter: :assemble_select_result,
+        find_all: :assemble_select_result,
+        reject: :assemble_reject_result,
+        take_while: :assemble_take_while_result,
+        drop_while: :assemble_drop_while_result,
+        partition: :assemble_partition_result,
+        count: :assemble_count_result,
+        find: :assemble_find_result,
+        detect: :assemble_find_result,
+        rfind: :assemble_rfind_result,
+        find_index: :assemble_find_index_result,
+        index: :assemble_find_index_result,
+        rindex: :assemble_rindex_result
+      }.freeze
+      private_constant :PER_ELEMENT_ASSEMBLERS
+
       def assemble_per_element_result(method_name, per_position, element_types)
-        case method_name
-        when :map, :collect then Type::Combinator.tuple_of(*per_position)
-        when :filter_map then assemble_filter_map_result(per_position)
-        when :flat_map then assemble_flat_map_result(per_position)
-        when :select, :filter
-          assemble_filter_result(per_position, element_types, keep_on_truthy: true)
-        when :reject
-          assemble_filter_result(per_position, element_types, keep_on_truthy: false)
-        when :find, :detect then assemble_find_result(per_position, element_types)
-        when :find_index, :index then assemble_find_index_result(per_position)
-        end
+        handler = PER_ELEMENT_ASSEMBLERS[method_name]
+        send(handler, per_position, element_types) if handler
+      end
+
+      def assemble_map_result(per_position, _element_types)
+        Type::Combinator.tuple_of(*per_position)
+      end
+
+      def assemble_select_result(per_position, element_types)
+        assemble_filter_result(per_position, element_types, keep_on_truthy: true)
+      end
+
+      def assemble_reject_result(per_position, element_types)
+        assemble_filter_result(per_position, element_types, keep_on_truthy: false)
       end
 
       # `select` / `filter` / `reject`: keeps each receiver element whose per-position predicate result
@@ -5785,10 +6880,51 @@ module Rigor
         Type::Combinator.tuple_of(*kept)
       end
 
+      # `take_while` / `drop_while`: stops at the first falsey `Constant` position when every preceding
+      # position is a truthy `Constant` (or takes/drops all elements when every position is a truthy
+      # `Constant`). Declines when an undecided position precedes the stopping point.
+      def assemble_take_while_result(per_position, element_types)
+        cutoff = leading_truthy_cutoff(per_position)
+        return nil if cutoff.nil?
+
+        Type::Combinator.tuple_of(*element_types[0...cutoff])
+      end
+
+      def assemble_drop_while_result(per_position, element_types)
+        cutoff = leading_truthy_cutoff(per_position)
+        return nil if cutoff.nil?
+
+        Type::Combinator.tuple_of(*element_types[cutoff..])
+      end
+
+      def leading_truthy_cutoff(per_position)
+        first_falsey_index = per_position.index { |type| falsey_constant?(type) }
+        return (per_position.all?(Type::Constant) ? per_position.size : nil) if first_falsey_index.nil?
+        return nil unless per_position[0...first_falsey_index].all?(Type::Constant)
+
+        first_falsey_index
+      end
+
+      # `partition`: returns `Tuple[truthy_tuple, falsey_tuple]` when every position folds to a `Constant`.
+      def assemble_partition_result(per_position, element_types)
+        return nil unless per_position.all?(Type::Constant)
+
+        truthy = assemble_filter_result(per_position, element_types, keep_on_truthy: true)
+        falsey = assemble_filter_result(per_position, element_types, keep_on_truthy: false)
+        Type::Combinator.tuple_of(truthy, falsey)
+      end
+
+      # `count`: returns `Constant[Integer]` of the truthy positions when every position folds to a `Constant`.
+      def assemble_count_result(per_position, _element_types)
+        return nil unless per_position.all?(Type::Constant)
+
+        Type::Combinator.constant_of(per_position.count { |type| truthy_constant?(type) })
+      end
+
       # `filter_map` folds tightly only when every per-position result is a `Constant`: positions whose
       # value is `nil` or `false` drop, the rest survive in declaration order. When any position is
       # non-Constant the dispatcher declines (returns nil) so the RBS tier widens to `Array[U]`.
-      def assemble_filter_map_result(per_position)
+      def assemble_filter_map_result(per_position, _element_types = nil)
         return nil unless per_position.all?(Type::Constant)
 
         kept = per_position.reject { |type| type.value.nil? || type.value == false }
@@ -5803,7 +6939,7 @@ module Rigor
       #
       # `Type::Constant` only ever holds non-Array scalars (the carrier rejects Array literals), so a single
       # `Constant` safely contributes itself as a single Tuple element.
-      def assemble_flat_map_result(per_position)
+      def assemble_flat_map_result(per_position, _element_types = nil)
         flattened = per_position.flat_map { |type| flat_map_contribution(type) }
         return nil if flattened.nil? || flattened.any?(&:nil?)
 
@@ -5833,15 +6969,32 @@ module Rigor
         Type::Combinator.union(*candidates.map { |index| element_types[index] })
       end
 
+      # `rfind`: reverse of `find` — returns the last receiver element whose block result is Ruby-truthy,
+      # joined with any undecided positions to its right.
+      def assemble_rfind_result(per_position, element_types)
+        candidates = last_match_candidates(per_position)
+        return candidates if candidates.nil? || candidates.equal?(NO_MATCH)
+
+        Type::Combinator.union(*candidates.map { |index| element_types[index] })
+      end
+
       # `find_index` / `index`: returns the index of the first truthy position, or `Constant[nil]` when
       # nothing matches, on {#assemble_find_result}'s terms.
-      def assemble_find_index_result(per_position)
+      def assemble_find_index_result(per_position, _element_types = nil)
         candidates = first_match_candidates(per_position)
         return candidates if candidates.nil? || candidates.equal?(NO_MATCH)
 
         Type::Combinator.union(*candidates.map { |index| Type::Combinator.constant_of(index) })
       end
 
+      # `rindex`: returns the index of the last truthy position, or `Constant[nil]` when nothing matches.
+      def assemble_rindex_result(per_position, _element_types = nil)
+        candidates = last_match_candidates(per_position)
+        return candidates if candidates.nil? || candidates.equal?(NO_MATCH)
+
+        Type::Combinator.union(*candidates.map { |index| Type::Combinator.constant_of(index) })
+      end
+
       NO_MATCH = Type::Combinator.constant_of(nil)
       private_constant :NO_MATCH
 
@@ -5857,8 +7010,27 @@ module Rigor
         undecided + [first_truthy_index]
       end
 
+      # The positions `rfind` / `rindex` may stop at — the last decisive truthy one and every undecided one
+      # after it — `NO_MATCH` when every position folds falsey, or nil when an undecided position has no
+      # truthy one before it.
+      def last_match_candidates(per_position)
+        last_truthy_index = per_position.rindex { |type| truthy_constant?(type) }
+        if last_truthy_index.nil?
+          return per_position.all?(Type::Constant) ? NO_MATCH : nil
+        end
+
+        undecided = ((last_truthy_index + 1)...per_position.size).reject do |index|
+          per_position[index].is_a?(Type::Constant)
+        end
+        [last_truthy_index] + undecided
+      end
+
       def truthy_constant?(type)
-        type.is_a?(Type::Constant) && type.value && type.value != false
+        type.is_a?(Type::Constant) && !type.value.nil? && type.value != false
+      end
+
+      def falsey_constant?(type)
+        type.is_a?(Type::Constant) && (type.value.nil? || type.value == false)
       end
 
       # Per-pair block fold for `HashShape#transform_keys` and `HashShape#transform_values` (and their bang