rigortype 0.4.7 → 0.4.8

data/lib/rigor/inference/statement_evaluator.rb

@@ -14,7 +14,7 @@ require_relative "block_call_timing"
 require_relative "block_repetition"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
-require_relative "memo_audit"
+require_relative "../memo_audit"
 require_relative "callee_mutation_chain"
 require_relative "toplevel_def_census"
 require_relative "callee_write_census"
@@ -28,6 +28,7 @@ require_relative "../analysis/check_rules/inferred_param_guard"
 require_relative "../analysis/check_rules/published_constant_guard"
 require_relative "struct_fold_safety"
 require_relative "closure_escape_analyzer"
+require_relative "self_preserving_block"
 require_relative "content_join"
 require_relative "construction_escape"
 require_relative "define_method_block_self"
@@ -62,6 +63,7 @@ require_relative "unknown_store_widening"
 require_relative "untyped_rejoin"
 require_relative "version_guard"
 require_relative "../run_scoped_slots"
+require_relative "../typing_state"
 
 module Rigor
   module Inference
@@ -194,13 +196,22 @@ module Rigor
       # return type. The flow value of a `return` is still `Bot` (it transfers control rather than producing a value);
       # the sink only records what the method *returns* through that edge. nil means "not collecting" — a top-level /
       # DSL-block walk, or inside a nested `def` barrier (whose returns belong to the inner method).
-      RETURN_SINK_KEY = :rigor_return_sink
-      private_constant :RETURN_SINK_KEY
+      #
+      # ADR-129 WD1 — the installation is a Frame and each record is a Resource touch.
+      RETURN_SINK = TypingState.frame(
+        :return_sink,
+        contents: :resource, reason: "installed per method body; each `return` records into it",
+        witness: "spec/fixtures/typing_state_witnesses/return_sink.rb"
+      )
+      private_constant :RETURN_SINK
 
       # Thread-local flag: set while a side pass ({.provisional_returns}) re-types part of a body from a scope other
       # than the one the statement walk holds, so the `return`s it reaches are filed as provisional ({ReturnSink}).
-      PROVISIONAL_RETURNS_KEY = :rigor_provisional_returns
-      private_constant :PROVISIONAL_RETURNS_KEY
+      PROVISIONAL_RETURNS = TypingState.frame(
+        :provisional_returns, reason: "a flag installed around a side pass",
+                              witness: "spec/fixtures/typing_state_witnesses/provisional_returns.rb"
+      )
+      private_constant :PROVISIONAL_RETURNS
 
       # The `return` sink {.with_return_sink} installs. Issue #2299 — a `return` the statement walk records is typed
       # with its real bindings; one a side pass records ({.provisional_returns}) may read a name the pass skipped the
@@ -215,8 +226,9 @@ module Rigor
           @provisional = []
         end
 
-        def record(node, type)
-          if Thread.current[PROVISIONAL_RETURNS_KEY]
+        # `provisional` is the {PROVISIONAL_RETURNS} frame the evaluator reached the `return` under.
+        def record(node, type, provisional)
+          if provisional
             @provisional << [node, type]
           else
             @types << type
@@ -234,14 +246,18 @@ module Rigor
       # Thread-local sink (an Array of `[NextNode, Type]`) collecting the value each `next` carries out of the block it
       # leaves, so `ExpressionTyper#type_block_body` can join those arms into the block's value type. Issue #841: the
       # block-return pass modelled only the fall-through tail, so `ops.all? { |o| next false unless o; true }` read as
-      # `Constant[true]` and folded the call to always-truthy — the same defect `RETURN_SINK_KEY` fixes one level up for
+      # `Constant[true]` and folded the call to always-truthy — the same defect `RETURN_SINK` fixes one level up for
       # a method's early `return`. The flow value of a `next` stays `Bot`.
       #
       # The sink also collects `next`s from nested blocks / loops / defs evaluated under the same installation (they do
       # not install their own), so the consumer filters by node identity against a statically computed
       # directly-targeting set, exactly as the break sink does. nil means "not collecting".
-      NEXT_SINK_KEY = :rigor_next_sink
-      private_constant :NEXT_SINK_KEY
+      NEXT_SINK = TypingState.frame(
+        :next_sink,
+        contents: :resource, reason: "installed per block body; each `next` records into it",
+        witness: "spec/fixtures/typing_state_witnesses/jump_sinks.rb"
+      )
+      private_constant :NEXT_SINK
 
       # Thread-local sink (an Array of `[BreakNode, Scope]`) collecting the scope at each `break` reached while
       # evaluating a loop body, so `eval_loop` / `eval_for` can join a `break`-path binding (`flag = true; break`) into
@@ -249,21 +265,33 @@ module Rigor
       # installs its own sink, restored on exit, so an inner loop's break does not leak to the outer one. A `break`
       # inside a block / nested loop targets that inner construct, not the lexical loop — filtered out by the loop's
       # {JumpTargets} set ({#loop_jumps}). See docs/notes/20260615-loop-break-binding-propagation-design.md.
-      BREAK_SINK_KEY = :rigor_break_sink
-      private_constant :BREAK_SINK_KEY
+      #
+      # ADR-129 WD3 — a construct reads the sink's size before it runs and again after, to find the jumps it recorded
+      # itself ({#restoring_error_info}, {#ensure_jump_marks}), so a read of the contents is delta-internal.
+      BREAK_SINK = TypingState.frame(
+        :break_sink,
+        contents: :resource, read_exemption: :delta_internal,
+        reason: "installed per loop body; each `break` records into it, and an enclosing `ensure` rewrites them",
+        witness: "spec/fixtures/typing_state_witnesses/jump_sinks.rb"
+      )
+      private_constant :BREAK_SINK
 
       # Thread-local sink (an Array of `[BreakNode, Type]`) collecting the value each `break` carries out of the
       # construct it leaves. Issue #853: `break value` terminates the yielding CALL and is that call's value, so —
-      # unlike `next`, which {NEXT_SINK_KEY} joins into the block — these arms are consumed one level up, by
+      # unlike `next`, which {NEXT_SINK} joins into the block — these arms are consumed one level up, by
       # `ExpressionTyper#call_dispatch_type_for`. Without them `ops.all? { |o| break false unless o; true }` folded to
       # `Constant[true]` and warned about a program that really can answer false.
       #
-      # Separate from {BREAK_SINK_KEY}, which records SCOPES for the loop-continuation join: the two consumers want
+      # Separate from {BREAK_SINK}, which records SCOPES for the loop-continuation join: the two consumers want
       # different things from the same node, and a loop body evaluated under a call's collection must keep feeding its
       # own sink. Both are filtered by node identity against a statically computed directly-targeting set, so a `break`
       # that belongs to an inner loop or block never reaches the wrong consumer. nil means "not collecting".
-      BREAK_VALUE_SINK_KEY = :rigor_break_value_sink
-      private_constant :BREAK_VALUE_SINK_KEY
+      BREAK_VALUE_SINK = TypingState.frame(
+        :break_value_sink,
+        contents: :resource, reason: "installed per yielding call; each `break` records into it",
+        witness: "spec/fixtures/typing_state_witnesses/jump_sinks.rb"
+      )
+      private_constant :BREAK_VALUE_SINK
 
       # Lexical class frame: the `name:` field is the qualified class name as it would render in Ruby (e.g.,
       # `"Foo::Bar"`); the `singleton:` field is `true` for `class << self` frames so nested defs resolve to
@@ -356,18 +384,9 @@ module Rigor
       # so a `def` evaluated inside another method's body (which itself installed a sink) does not corrupt the outer
       # one. Used by `ExpressionTyper#infer_user_method_return` to join the explicit returns into the inferred
       # method-return type.
-      def self.with_return_sink
-        previous = Thread.current[RETURN_SINK_KEY]
-        previous_provisional = Thread.current[PROVISIONAL_RETURNS_KEY]
+      def self.with_return_sink(&)
         sink = ReturnSink.new
-        Thread.current[RETURN_SINK_KEY] = sink
-        Thread.current[PROVISIONAL_RETURNS_KEY] = nil
-        begin
-          result = yield
-        ensure
-          Thread.current[RETURN_SINK_KEY] = previous
-          Thread.current[PROVISIONAL_RETURNS_KEY] = previous_provisional
-        end
+        result = TypingState.current.with_pair(RETURN_SINK, sink, PROVISIONAL_RETURNS, nil, &)
         [result, sink.types]
       end
 
@@ -375,48 +394,54 @@ module Rigor
       # on exit. Issue #2299 — {ExpressionTyper#type_block_body}'s tail-only answer types `return r if r` without the
       # `r = yield e` before it, so `r` read `Dynamic[top]` and that went into the enclosing method's return type
       # although the statement walk of the same block recorded `r` with its real binding.
-      def self.provisional_returns
-        previous = Thread.current[PROVISIONAL_RETURNS_KEY]
-        Thread.current[PROVISIONAL_RETURNS_KEY] = true
-        begin
-          yield
-        ensure
-          Thread.current[PROVISIONAL_RETURNS_KEY] = previous
-        end
+      def self.provisional_returns(&)
+        TypingState.current.with(PROVISIONAL_RETURNS, true, &)
       end
 
       # Runs `block` with a fresh `next` sink installed, then yields the collected `[NextNode, Type]` pairs to the
       # caller. Stacks like the return sink, and for the same reason: a block body evaluated inside another block body's
       # evaluation must not spill its arms into the outer collection. Used by `ExpressionTyper#type_block_body` to join
       # the `next` arms into the block's value type.
-      def self.with_next_sink
-        previous = Thread.current[NEXT_SINK_KEY]
+      def self.with_next_sink(&)
         sink = []
-        Thread.current[NEXT_SINK_KEY] = sink
-        begin
-          result = yield
-        ensure
-          Thread.current[NEXT_SINK_KEY] = previous
-        end
+        result = TypingState.current.with(NEXT_SINK, sink, &)
         [result, sink]
       end
 
+      # Runs `block` with none of {CALLER_SINKS} installed: a user-method body re-typed for its return starts outside
+      # its caller's constructs (ADR-129 WD1: the return memo forces these Frames at its entry). Installs only when one
+      # is set, read with `forcing_read`, so the common entry costs no frame.
+      def self.outside_caller_sinks(&)
+        state = TypingState.current
+        return yield if CALLER_SINKS.all? { |slot| state.forcing_read(slot).nil? }
+
+        state.without(CALLER_SINKS, &)
+      end
+
       # Runs `block` with a fresh `break`-value sink installed, then yields the collected `[BreakNode, Type]` pairs to
       # the caller. Stacks like the other sinks: a block body evaluated inside another block body's evaluation must not
       # spill its arms into the outer collection. Used by `ExpressionTyper#call_dispatch_type_for` to union the `break`
       # arms into the yielding call's type (issue #853).
-      def self.with_break_value_sink
-        previous = Thread.current[BREAK_VALUE_SINK_KEY]
+      def self.with_break_value_sink(&)
         sink = []
-        Thread.current[BREAK_VALUE_SINK_KEY] = sink
-        begin
-          result = yield
-        ensure
-          Thread.current[BREAK_VALUE_SINK_KEY] = previous
-        end
+        result = TypingState.current.with(BREAK_VALUE_SINK, sink, &)
         [result, sink]
       end
 
+      # Issue #1246 — enters only `call`'s block, from the receiver scope, as the statement form enters it
+      # ({#evaluate_block_if_present}): the per-node scope index's evaluation of a block a value-position call holds
+      # ({ScopeIndexer#evaluate_unentered_block}). The call's receiver and arguments are left to the index walk.
+      #
+      # Such a block enters with the unknown-`self` mark only ({Scope#with_block_self_unknown}), as the walk entered
+      # it, not with the statement form's opaque-`self` mark ({Scope#entering_opaque_block}): issue #1717 keeps the
+      # latter, which gates binding a call to a cross-file top-level `def`, away from value-position blocks.
+      def evaluate_block_of(call)
+        @value_position_block = call.block
+        evaluate_block_if_present(call)
+      ensure
+        @value_position_block = nil
+      end
+
       # Evaluate `node` under the receiver scope. Returns `[type, scope']` where `type` is the value the node produces
       # and `scope'` is the scope observable after the node has run. The receiver scope is never mutated.
       def evaluate(node)
@@ -810,7 +835,9 @@ module Rigor
         memo = unrecorded_hand_off_memo(written)
         key = [constructed, call_node.name]
         unless memo.key?(key)
-          return memo[key] = compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed)
+          return memo[key] = MemoAudit.key_audit("unrecorded hand-off") do
+            compute_unrecorded_hand_off_callees(call_node, receiver, written, constructed)
+          end
         end
 
         MemoAudit.check("unrecorded hand-off", memo[key], written, key) do
@@ -832,14 +859,18 @@ module Rigor
       # the class `self` is and its side (a constant's ancestor lookup differs between the class object and an
       # instance), and the called name, not on the def it sits in.
       def unrecorded_hand_off_memo(written)
-        table = (Thread.current[UNRECORDED_HAND_OFF_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        table = typing_state.weak_key_map(UNRECORDED_HAND_OFFS)
         self_type = scope.self_type
         by_side = ((table[scope.discovery] ||= {})[self_type.is_a?(Type::Singleton)] ||= {})
         (by_side[enclosing_class_name_for(self_type)] ||= {})[written] ||= {}
       end
 
-      UNRECORDED_HAND_OFF_KEY = RunScopedSlots.register(:rigor_callee_unrecorded_hand_offs)
-      private_constant :UNRECORDED_HAND_OFF_KEY
+      UNRECORDED_HAND_OFFS = TypingState.memo(
+        :callee_unrecorded_hand_offs,
+        run_scoped: true, audit: "unrecorded hand-off",
+        reason: "keyed by discovery, side, class and spelling, all its answer reads"
+      )
+      private_constant :UNRECORDED_HAND_OFFS
 
       # The scopes {#unrecorded_hand_off_callees} types a receiver written as `written` in. A rooted constant and a
       # top-level def are typed once.
@@ -1131,9 +1162,11 @@ module Rigor
       def instance_def_owners(name)
         return scope.user_instance_def_owners(name) if MemoAudit.suspended?
 
-        table = (Thread.current[INSTANCE_DEF_INDEX_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        table = typing_state.weak_key_map(INSTANCE_DEF_INDEX)
         by_name = (table[scope.discovery] ||= {})
-        return by_name[name] = scope.user_instance_def_owners(name) unless by_name.key?(name)
+        unless by_name.key?(name)
+          return by_name[name] = MemoAudit.key_audit("instance def owners") { scope.user_instance_def_owners(name) }
+        end
 
         record_instance_def_owner_reads(name, by_name[name]) if Analysis::DependencyRecorder.active?
         MemoAudit.check("instance def owners", by_name[name], name) { scope.user_instance_def_owners(name) }
@@ -1144,9 +1177,9 @@ module Rigor
       def subclassing_opaque?
         return scope.subclassing_opacity.first if MemoAudit.suspended?
 
-        table = (Thread.current[INSTANCE_DEF_INDEX_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        table = typing_state.weak_key_map(INSTANCE_DEF_INDEX)
         by_name = (table[scope.discovery] ||= {})
-        entry = by_name[OPACITY_ENTRY] ||= scope.subclassing_opacity
+        entry = by_name[OPACITY_ENTRY] ||= MemoAudit.key_audit("subclassing opacity") { scope.subclassing_opacity }
         Analysis::DependencyRecorder.read_keys(entry.last) if Analysis::DependencyRecorder.active?
         MemoAudit.check("subclassing opacity", entry, OPACITY_ENTRY) { scope.subclassing_opacity }.first
       end
@@ -1159,8 +1192,12 @@ module Rigor
         owners.map(&:first).each { |owner| Analysis::DependencyRecorder.read_last_segment(:subclass_of, owner) }
       end
 
-      INSTANCE_DEF_INDEX_KEY = RunScopedSlots.register(:rigor_callee_instance_def_index)
-      private_constant :INSTANCE_DEF_INDEX_KEY
+      INSTANCE_DEF_INDEX = TypingState.memo(
+        :callee_instance_def_index,
+        run_scoped: true, audit: ["instance def owners", "subclassing opacity"],
+        reason: "keyed by discovery and name, all its answer reads"
+      )
+      private_constant :INSTANCE_DEF_INDEX
 
       def constant_node?(node) = node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
 
@@ -1298,6 +1335,13 @@ module Rigor
 
       attr_reader :scope, :tracer
 
+      # ADR-129 WD2 — the calling thread's {TypingState::State}, cached on the evaluator the first time a slot is read.
+      # An evaluator kept across threads must be kept per state instead ({ExpressionTyper#typing_state}). A frame
+      # install whose block's value is the answer calls {TypingState.current} instead: Rigor's own analysis does not
+      # adopt this memoised reader's type at a self-call (#525's self-purity), so the install's answer would read as
+      # `Dynamic` through it.
+      def typing_state = @typing_state ||= TypingState.current
+
       # Thread the scope through every child statement in declaration order. The body's value is the type of the last
       # statement (or `Constant[nil]` for an empty body); intermediate statements' types are discarded, but their scope
       # effects are preserved.
@@ -1307,7 +1351,7 @@ module Rigor
       def eval_statements(node)
         result_type = Type::Combinator.constant_of(nil)
         current = scope
-        raising = Thread.current[RETRY_FRAMES_KEY]
+        raising = typing_state[RETRY_FRAMES]
         node.body.each do |stmt|
           result_type, current = sub_eval(stmt, current)
           record_raise_points(raising, stmt, current) if raising
@@ -1456,7 +1500,7 @@ module Rigor
       def rhs_origin(value_node, scope_after_rhs, rhs_type)
         return nil unless rhs_type.is_a?(Type::Dynamic)
 
-        scope_after_rhs.dynamic_origins[value_node]
+        scope_after_rhs.dynamic_origin(value_node)
       end
 
       # The scope binding the written local with ADR-58's `:local` mark when the write copies a declaration-sourced
@@ -1730,7 +1774,8 @@ module Rigor
       # The expression value is the result type, matching Ruby's semantics: `(x = params[:f] ||= []); x` observes the
       # post-`||=` value, not the rvalue alone.
       def eval_index_or_write(node)
-        _rhs_type, post_rhs = sub_eval(node.value, scope)
+        operands = index_write_operand_scope(node)
+        _rhs_type, post_rhs = sub_eval(node.value, operands)
         result_type = index_write_stored_type(node, scope)
 
         # A narrowing is keyed on ONE literal slot — `a[k]` — but a multi-index `||=` reads and
@@ -1738,8 +1783,7 @@ module Rigor
         # record `a[0]`'s type as the region answer: `a[0, 1] ||= []` would claim `a[0]` non-nil
         # where the store splices nothing and `a[0]` stays nil at runtime. Decline the record for
         # any form but the single-index one.
-        key_node = single_index_argument(node)
-        address = key_node && IndexedNarrowing.stable_address(node.receiver, key_node)
+        address = recordable_slot_address(node)
         # Issue #544 — a receiver with an untracked (Dynamic / Top) constituent can hold a caller-supplied
         # slot value the `||=` keeps, so the recorded default would invent a fact; decline the record.
         address = nil if address && !IndexedNarrowing.fully_tracked_receiver_type?(scope.type_of(node.receiver))
@@ -1748,7 +1792,9 @@ module Rigor
         # the reverse order would trade this feature away for the widening. The two are complementary — the shape
         # forgets that the collection is still empty, the narrowing remembers that THIS slot is now non-nil.
         post = IndexWriteWidening.widen(node: node, current_scope: post,
-                                        arg_types: index_write_arg_types(node, result_type))
+                                        arg_types: index_write_arg_types(node, result_type, join_scope: operands))
+        # Issue #1218 — a key that is not a literal (`h[k] ||= v`) may name a slot another `||=` narrowed.
+        post = IndexedNarrowing.invalidate_indexed_write(node, post)
         post = post.with_indexed_narrowing(*address, result_type) if address
 
         # The value the expression yields takes the memoizing reading ({#index_compound_write_value}, #1155) for a
@@ -1814,14 +1860,76 @@ module Rigor
       # expression, scope untouched — and the receiver never widened. They store through `[]=` exactly as
       # `eval_index_or_write` does, so they take the same widening; the stored value is the compound result —
       # `falsey(h[k]) | v` for `&&=`, the dispatched `h[k] + v` for `+=` — not the rvalue alone.
+      #
+      # Issue #1218 — the widening carries the receiver's slot narrowings across its rebind
+      # ({MutationRejoin.carry_slot_narrowings}), so a `h[:e] ||= 0` narrowing outlived `h[:e] += 1` and the slot
+      # kept reading `0`. The store drops the narrowing on the slot it overwrote, as a `[]=` call does
+      # ({IndexedNarrowing.invalidate_indexed_write}: every narrowing on the receiver when the index is not one
+      # literal key). A slot that held a narrowing then records the value the write stored, which the read it
+      # performed took from that narrowing; a slot with none records nothing new.
       def eval_index_write(node)
-        _rhs_type, post_rhs = sub_eval(node.value, scope)
+        operands = index_write_operand_scope(node)
+        _rhs_type, post_rhs = sub_eval(node.value, operands)
         stored = index_write_stored_type(node, scope)
         widened = IndexWriteWidening.widen(node: node, current_scope: post_rhs,
-                                           arg_types: index_write_arg_types(node, stored))
+                                           arg_types: index_write_arg_types(node, stored, join_scope: operands))
+        widened = IndexedNarrowing.invalidate_indexed_write(node, widened)
+        address = recordable_slot_address(node)
+        widened = widened.with_indexed_narrowing(*address, stored) if address && scope.indexed_narrowing(*address)
         [stored, forget_rebound_specials(widened, node)]
       end
 
+      # The `(receiver, key)` slot a compound index write may record its stored value on, or nil. A narrowing is
+      # keyed on ONE literal slot, so a multi-index form, which reads and stores a splice region, records none. The
+      # receiver's `[]=` must leave the stored value at that slot ({IndexedNarrowing.verbatim_slot?}: a `Hash` or
+      # `Array`, and no negative index on an `Array`), and the rvalue must not rebind the receiver variable
+      # ({#rvalue_rebinds_receiver?}), since the store went to the object it named before (issue #1218).
+      def recordable_slot_address(node)
+        key_node = single_index_argument(node)
+        address = key_node && IndexedNarrowing.stable_address(node.receiver, key_node)
+        return nil if address.nil?
+        return nil unless IndexedNarrowing.verbatim_slot?(scope.type_of(node.receiver, tracer: tracer), address.last)
+        return nil if rvalue_rebinds_receiver?(node)
+
+        address
+      end
+
+      # Whether a compound index write's rvalue may rebind its stable receiver variable: it writes the variable
+      # (`h[k] += (h = {}; 1)`, `@h ||= …`, a multiple-assignment target, in a block too:
+      # {OperandEffects.written_variables}), or, for an instance variable, the intervening-call reset past the
+      # rvalue's self calls rebinds it ({InterveningIvarReset.after_operand}). That reset widens only a binding
+      # narrower than the class-ivar seed, and only for a call not proven to leave it alone, so
+      # `@h = { k: nil }; @h[:k] += (reset; 1)` with a `reset` that assigns `@h` is a rebind, and `@t[:k] ||=
+      # compute(1)` on a `@t` the class binds to one shape is not. A store into another slot of the receiver
+      # (`h[:a] ||= (h[:b] ||= [])`) is no rebind either.
+      def rvalue_rebinds_receiver?(node)
+        receiver = node.receiver
+        name = receiver.name
+        return true if OperandEffects.written_variables(node.value).include?(name)
+        return false unless receiver.is_a?(Prism::InstanceVariableReadNode)
+
+        !InterveningIvarReset.after_operand(node.value, scope).ivar(name).equal?(scope.ivar(name))
+      end
+
+      # The scope a compound index write's rvalue runs from: Ruby evaluates the receiver, then the index arguments,
+      # then the rvalue, so a write in either is threaded in that order ({#thread_operand}) before the rvalue. An
+      # index write takes no block-pass argument (a syntax error since Ruby 3.4).
+      #
+      # Issue #1272 — `(h ||= {})[k] ||= v`, `(@h ||= {})[k] ||= v` and `h[(i = 1)] ||= v` left `h`, `@h` and `i`
+      # on their pre-write bindings, so a later `h.fetch(k)` on a nil-initialised `h` reported a call on `nil`. A
+      # receiver or argument holding no write answers the entry scope unchanged.
+      #
+      # The receiver's joinability is read from this scope ({#index_write_arg_types}' `join_scope`), since the
+      # binding the store widens is the one the receiver's write left (`h` is `{}`, not the entry's `nil`). The read,
+      # the stored value and the widening's argument types are still typed from the entry scope (TODO #3100): the
+      # receiver expression's own value (`(h ||= {})` is the hash) answers what its write produced, but an rvalue
+      # reading a variable an index argument writes (`h[(i = 1)] ||= i + 1`) is typed at its pre-write binding.
+      def index_write_operand_scope(node)
+        walk = OperandWalk.new(walk_recorder)
+        after = thread_operand(node.receiver, scope, walk, scope)
+        thread_operand(node.arguments, after, walk, scope)
+      end
+
       # `[index_type..., stored_value_type]` for an index-write node, shaped exactly like a `[]=`
       # call's argument list so the widening seam can join it the same way (issue #560) — a
       # two-index compound write (`a[0, 1] += v`) keeps BOTH index arguments ahead of the stored
@@ -1835,15 +1943,16 @@ module Rigor
       # The index arguments are typed, and the receiver's joinability read, in `type_scope`: the
       # evaluator's entry scope by default; a `for` index passes its post-collection scope and a
       # rescue reference its arm's entry scope, the nearest the engine has to where Ruby evaluates
-      # them (each iteration, the moment of the catch).
+      # them (each iteration, the moment of the catch). A compound index write reads the joinability alone in
+      # `join_scope`, the scope its receiver and index arguments left ({#index_write_operand_scope}).
       # There is deliberately NO `rescue` here. `Scope#type_of` is a total query over well-formed Prism input,
       # so a raise is an engine bug, and swallowing it would silently downgrade a live seam to "no evidence" —
       # the join would quietly stop happening with nothing to show for it. Let it reach the runner's
       # internal-error path, where it is visible.
-      def index_write_arg_types(node, stored_type, type_scope: scope)
+      def index_write_arg_types(node, stored_type, type_scope: scope, join_scope: type_scope)
         args = node.arguments
         return MutationWidening::NO_ARG_TYPES if args.nil? || stored_type.nil?
-        return MutationWidening::NO_ARG_TYPES unless MutationWidening.joinable_receiver?(node.receiver, type_scope)
+        return MutationWidening::NO_ARG_TYPES unless MutationWidening.joinable_receiver?(node.receiver, join_scope)
 
         list = args.respond_to?(:arguments) ? args.arguments : args
         # A splat argument is marked `nil` — its expansion decides the store's arity at
@@ -1951,15 +2060,70 @@ module Rigor
       # receiver is an element read into a local, that element's pin inside its container
       # ({ElementReadWidening.widen_element_read}, issue #643) — and, issue #2499, the String a stdlib
       # out-buffer call fills ({OutBufferMutation}), which names no receiver of the call at all.
-      def widen_mutated_receivers(call_node, current_scope)
+      #
+      # Issue #2335 — a literal-symbol `send` (`a.send(:push, x)`) widens as the call it makes, and a mutation through a
+      # receiver that may be another local's object floors every local whose object another holder may reach
+      # ({AliasMutationFloor}).
+      def widen_mutated_receivers(node, current_scope)
+        call_node = AliasMutationFloor.literal_send_target(node) || node
         arg_types = mutator_arg_types(call_node, current_scope)
         widened = MutationWidening.widen_after_call(call_node: call_node, current_scope: current_scope,
                                                     arg_types: arg_types,
                                                     rewritten_element: rewritten_element(call_node, current_scope))
         widened = ElementReadWidening.widen_element_read(call_node: call_node, current_scope: widened,
                                                          arg_types: arg_types)
+        if AliasMutationFloor.candidate?(call_node)
+          widened = AliasMutationFloor.floor_after_call(call_node, widened) do
+            named_receiver_locals(call_node.receiver)
+          end
+        end
         # Issue #2499 — a stdlib call that fills a String argument (`io.read(n, buf)`, `StringIO.new(s)`).
-        OutBufferMutation.floor(call_node, widened)
+        floor_ivar_mutating_callee(node, OutBufferMutation.floor(call_node, widened))
+      end
+
+      # Issue #2335 — a call on a local that may hold another local's object (`box = Box.new(a)`) to a project method
+      # that mutates one of its instance variables (`def add(v) = @items << v`) may mutate that object: every local
+      # whose object another holder may reach takes one unknown store ({AliasMutationFloor.floor_after_written_local}).
+      def floor_ivar_mutating_callee(call_node, current_scope)
+        receiver = call_node.receiver
+        return current_scope if MutationWidening::SHAPE_MUTATORS.include?(call_node.name) || send_hand_off?(call_node)
+        return floor_self_ivar_callee(call_node, current_scope) if self_dispatch_call?(call_node)
+        return current_scope unless receiver.is_a?(Prism::LocalVariableReadNode)
+        return current_scope unless callee_bearing?(current_scope.local(receiver.name))
+        return current_scope unless AliasMutationFloor.reaches_other_locals?(current_scope, receiver, call_node)
+
+        callees = receiver_callees_in(scope, call_node)
+        return current_scope unless callees.any? { |def_node, _, _| AliasMutationFloor.mutates_ivar?(def_node) }
+
+        AliasMutationFloor.floor_after_written_local(current_scope, receiver, call_node)
+      end
+
+      # The same for a call on `self` (`push_it(v)`, `self.push_it(v)`): its ivars hold whatever locals were handed to
+      # them (`@items = a`, `a = @q`), so every aliased local holding a literal shape takes one unknown store.
+      def floor_self_ivar_callee(call_node, current_scope)
+        return current_scope unless AliasMutationFloor.holder_call_reaches?(current_scope, call_node)
+        return current_scope unless resolve_self_callees(call_node).any? do |def_node, _, _|
+          AliasMutationFloor.mutates_ivar?(def_node)
+        end
+
+        AliasMutationFloor.floor_after_holder_call(current_scope, call_node)
+      end
+
+      # A binding `receiver_callees_in` can resolve a project def on: a class or instance type, or a union of them. Any
+      # other binding resolves none, so the floor skips the resolution for it.
+      def callee_bearing?(type) = type.is_a?(Type::Nominal) || type.is_a?(Type::Singleton) || type.is_a?(Type::Union)
+
+      # The locals a mutator's receiver names ({ReceiverAlias.mutated_reads}), which the named path widens, and the
+      # root of an element read (`c[0].shift`), whose element {ElementReadWidening} widens.
+      def named_receiver_locals(receiver)
+        return nil if receiver.nil?
+        return receiver.name if receiver.is_a?(Prism::LocalVariableReadNode)
+
+        names = ReceiverAlias.mutated_reads(receiver).filter_map do |read|
+          ReceiverAlias.read_name(read) if read.is_a?(Prism::LocalVariableReadNode)
+        end
+        root = ElementReadWidening.element_read_path(receiver)&.first
+        root ? names << root.name : names
       end
 
       # Issue #2427 — the element an element rewriter (`map!`, `collect!`, `flatten!`) leaves in its receiver, read
@@ -2068,14 +2232,17 @@ module Rigor
         [scope.type_of(node, tracer: tracer), forget_rebound_specials(widened, node)]
       end
 
-      # The scope effect of calling the writer `writer` on `receiver` outside a `CallNode`: the receiver widening, and
-      # the receiver-wide drop of recorded `receiver[key]` narrowings `IndexedNarrowing` makes after a mutator call.
+      # The scope effect of calling the writer `writer` on `receiver` outside a `CallNode`: the receiver widening, the
+      # drop of every method-chain narrowing rooted at the receiver that `eval_call` makes after any call on it (issue
+      # #2693: `x.r ||= v`, `x.r, y = …` and `for x.r in …` call `r=`), and the receiver-wide drop of recorded
+      # `receiver[key]` narrowings `IndexedNarrowing` makes after a mutator call.
       def widen_attribute_write(receiver, writer, current_scope)
         widened = MutationWidening.widen_receiver_aliases(receiver, writer, current_scope)
         stable = IndexedNarrowing.stable_receiver(receiver)
-        return widened unless stable && IndexedNarrowing.mutator?(writer)
+        return widened unless stable
 
-        widened.without_indexed_narrowings_for(*stable)
+        widened = widened.without_method_chain_narrowings_for(*stable)
+        IndexedNarrowing.mutator?(writer) ? widened.without_indexed_narrowings_for(*stable) : widened
       end
 
       # The attribute targets of a multi-write (`h.default, x = 0, 1`), nested ones included, each widening its
@@ -2155,11 +2322,7 @@ module Rigor
         return [Type::Combinator.union(then_type, else_type), then_scope] \
           if branch_terminates?(node.subsequent, else_type) && node.statements
 
-        [
-          Type::Combinator.union(then_type, else_type),
-          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
-                              [node.statements, node.subsequent])
-        ]
+        if_join(node.statements, node.subsequent, [then_type, then_scope], [else_type, else_scope], post_pred)
       end
 
       # `unless pred; t; else; e; end`. Same shape as `if`, but Prism exposes the else-branch as `else_clause` (no elsif
@@ -2191,11 +2354,22 @@ module Rigor
         return [Type::Combinator.union(then_type, else_type), then_scope] \
           if branch_terminates?(node.else_clause, else_type) && node.statements
 
-        [
-          Type::Combinator.union(then_type, else_type),
-          UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred,
-                              [node.statements, node.else_clause])
-        ]
+        if_join(node.statements, node.else_clause, [then_type, then_scope], [else_type, else_scope], post_pred)
+      end
+
+      # The `[type, post_scope]` an `if` / `unless` with both branches evaluated ends with, once the arms above found no
+      # terminating branch by {#branch_terminates?}.
+      #
+      # Issue #1230 — the then-body (`then_node`) certainly exits beside an else (`else_node`): the only surviving path
+      # is the else that RAN, so the continuation is the else's exit scope, the predicate's other edge PLUS the else's
+      # writes, not a join with the exited body's writes. {#branch_certainly_exits?} is stricter than
+      # {#branch_terminates?}, which the arms above use: a `bot`-typed helper call does not qualify (issue #3110).
+      # Otherwise both exit scopes join with nil-injection.
+      def if_join(then_node, else_node, (then_type, then_scope), (else_type, else_scope), post_pred)
+        type = Type::Combinator.union(then_type, else_type)
+        return [type, else_scope] if else_node && branch_certainly_exits?(then_node)
+
+        [type, UntypedRejoin.apply(join_with_nil_injection(then_scope, else_scope), post_pred, [then_node, else_node])]
       end
 
       # Returns the `[type, post_scope]` of the live branch when the predicate is provably truthy / falsey, else nil so
@@ -2580,9 +2754,12 @@ module Rigor
       # while it ran, put back as this scope binds them ({ErrorInfo.restore}): the control those carry has left every
       # rescue clause the construct entered.
       def restoring_error_info
-        marks = [@next_scope_sink&.size, Thread.current[BREAK_SINK_KEY]&.size]
+        state = typing_state
+        marks = [@next_scope_sink&.size, state[BREAK_SINK]&.size]
         type, after = yield
-        [[@next_scope_sink, marks.first], [Thread.current[BREAK_SINK_KEY], marks.last]].each do |sink, mark|
+        break_sink = state[BREAK_SINK]
+        state.touch(BREAK_SINK) if break_sink && marks.last && marks.last < break_sink.size
+        [[@next_scope_sink, marks.first], [break_sink, marks.last]].each do |sink, mark|
           next if sink.nil? || mark.nil?
 
           (mark...sink.size).each do |index|
@@ -2605,9 +2782,12 @@ module Rigor
         # after it, or a rescue clause, may have set `$_` enters with it forgotten; a rescue clause runs after any
         # prefix of the body, and so reads it forgotten whenever the body may set it.
         entry = edge ? forget_guard_if_rebinds(LastLine.forget_if_set(scope, node), node) : scope
-        primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge)
-        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry_scope(node, entry),
-                                                    edge: edge, writes: rescue_writes(node, edge))
+        rescue_entry = rescue_entry_scope(node, entry)
+        collector = begin_fact_collector(node, rescue_entry, edge)
+        primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge, collector: collector)
+        rescue_chain = collect_rescue_chain_results(node.rescue_clause, rescue_entry,
+                                                    edge: edge, writes: rescue_writes(node, edge),
+                                                    raise_scopes: collector&.raise_scopes)
 
         # B2.1 — retry-edge widening. When a `retry` in the rescue chain targets this `begin`, control re-enters the
         # primary body carrying every rebind made before the retry: the arm's (`rescue; tries += 1; retry; end`), and
@@ -2703,7 +2883,10 @@ module Rigor
       # none, so an `ensure` clause inside it, nested at any depth, is evaluated once rather than once per pass of
       # every enclosing clause holding a jump.
       def jump_sinks_installed?
-        !@next_scope_sink.nil? || JUMP_SINK_KEYS.any? { |key| Thread.current[key] }
+        return true unless @next_scope_sink.nil?
+
+        state = typing_state
+        JUMP_SINKS.any? { |slot| state[slot] }
       end
 
       # Whether `node` holds a `return`, `next` or `break` outside a nested `def`.
@@ -2759,12 +2942,8 @@ module Rigor
       end
 
       # Runs `block` with no `return`, `next`, `break` or retry-frame sink installed.
-      def without_jump_sinks
-        previous = CLAUSE_SINK_KEYS.map { |key| Thread.current[key] }
-        CLAUSE_SINK_KEYS.each { |key| Thread.current[key] = nil }
-        yield
-      ensure
-        CLAUSE_SINK_KEYS.zip(previous).each { |key, value| Thread.current[key] = value } if previous
+      def without_jump_sinks(&)
+        TypingState.current.without(CLAUSE_SINKS, &)
       end
 
       # The scope a rescue clause of `node` enters with: it runs after any prefix of the body, so neither a `$_`
@@ -2773,6 +2952,65 @@ module Rigor
         forget_guard_if_rebinds(LastLine.forget_if_set(entry, node.statements), node.statements)
       end
 
+      # Issue #2691 — a rescue clause runs after any prefix of the `begin` body raised, so a fact the clause's
+      # entry scope holds for an indexed read (`h[:k]`) or a single-hop chain (`x.r`) survives into it only where
+      # EVERY scope the body can raise from still binds the identical type object. `raise_scopes` is that set —
+      # the post-scope of each statement of the body's frame and the scope it ends with
+      # ({#eval_begin_primary_under}'s collector) — not the fall-through exit alone: `eval_if` and kin discard a
+      # branch that terminates, so a write on `if c; @x.r = nil; raise; end` never reaches the exit scope.
+      # `equal?` keeps only an untouched fact: a re-narrowed or re-joined one is a new object and drops (the
+      # conservative side).
+      #
+      # The residual is a fact the body drops and then re-establishes as the identical (interned) type object:
+      # raise points after the re-establishment keep it, which is correct, and the only unsound window would be a
+      # raise point whose recorded scope still binds the object although the fact was invalidated and not yet
+      # re-established. No producer reaches that today — a rebind or a clause widening answers `Dynamic[top]`,
+      # never the fact's type ({ClauseWidening}), and a widened slot read floors to `Dynamic` rather than
+      # reinstalling the recorded object.
+      #
+      # The filter covers rescue entries only: an `ensure` clause enters from the scope past the `begin` — the
+      # join of the fall-through exits — so it keeps a fact a terminating-branch write voided, the pre-#2691
+      # hole left open because collecting raise points for every `ensure`-only `begin` costs a frame walk.
+      def clause_fact_scope(entry_scope, raise_scopes)
+        return entry_scope if entry_scope.indexed_narrowings.empty? && entry_scope.method_chain_narrowings.empty?
+
+        indexed = entry_scope.indexed_narrowings.reduce(entry_scope) do |acc, (key, type)|
+          if raise_scopes.all? { |point| point.indexed_narrowings[key].equal?(type) }
+            acc
+          else
+            acc.without_indexed_narrowing(key.receiver_kind, key.receiver_name, key.key)
+          end
+        end
+        indexed.method_chain_narrowings.reduce(indexed) do |acc, (key, type)|
+          if raise_scopes.all? { |point| point.method_chain_narrowings[key].equal?(type) }
+            acc
+          else
+            acc.without_method_chain_narrowing(key.receiver_kind, key.receiver_name, key.method_name)
+          end
+        end
+      end
+
+      # Issue #2691 — the {BodyRaiseScopes} {#eval_begin_primary_under} fills while evaluating `node`'s primary
+      # body, or nil when {#clause_fact_scope} has nothing to filter: no rescue clause, no body, or a `clause_entry`
+      # (the scope the chain enters with — `rescue_entry_scope`'s result, or the retry-widened entry under an
+      # edge) holding no indexed or method-chain fact. The frame walk is skipped unless a fact could drop, so a
+      # `begin` whose entry binds none pays nothing.
+      def begin_fact_collector(node, clause_entry, edge)
+        return nil unless node.rescue_clause && node.statements
+        return nil if clause_entry.indexed_narrowings.empty? && clause_entry.method_chain_narrowings.empty?
+
+        frame = edge ? edge.frame : primary_body_frame(node.statements)
+        BodyRaiseScopes.new(frame: frame, raise_scopes: [])
+      end
+
+      # The set {#walk_primary_frame} collects for a primary body — the nodes whose post-statement scopes are the
+      # body's raise points — without the write-name pass a retry edge also needs.
+      def primary_body_frame(statements)
+        frame = Set.new.compare_by_identity
+        walk_primary_frame(statements, true, frame, Set.new)
+        frame
+      end
+
       # Rescue arms that never fall through contribute neither a type fragment NOR a scope to the post-begin flow —
       # control left the `begin` via that arm. That is an arm ending in `return`, `next`, `break`, `raise`, `throw`,
       # `exit`, `abort` or `fail`, and one whose type is `bot` ({#branch_terminates?}): an arm ending in `retry`, or in
@@ -2791,7 +3029,7 @@ module Rigor
       def ensure_jump_marks(node)
         return nil unless node.ensure_clause
 
-        [@next_scope_sink&.size, Thread.current[BREAK_SINK_KEY]&.size]
+        [@next_scope_sink&.size, typing_state[BREAK_SINK]&.size]
       end
 
       # A `next` or `break` inside `begin … ensure` leaves only once the `ensure` clause has run, so each jump scope the
@@ -2801,7 +3039,10 @@ module Rigor
       def carry_jumps_through_ensure(ensure_clause, marks)
         next_mark, break_mark = marks
         carry_through_ensure(ensure_clause, @next_scope_sink, next_mark)
-        carry_through_ensure(ensure_clause, Thread.current[BREAK_SINK_KEY], break_mark)
+        state = typing_state
+        break_sink = state[BREAK_SINK]
+        state.touch(BREAK_SINK) if break_sink && break_mark && break_mark < break_sink.size
+        carry_through_ensure(ensure_clause, break_sink, break_mark)
       end
 
       def carry_through_ensure(ensure_clause, sink, mark)
@@ -2820,13 +3061,23 @@ module Rigor
       # `edge`, when given, collects every scope the primary body could raise from: the scope after each statement of
       # its frame ({#record_raise_points}), and the scope it ends with. The else-clause is not among them: what it
       # raises is not rescued here.
-      def eval_begin_primary_under(node, entry_scope, edge: nil)
+      #
+      # `collector`, when given, is a {BodyRaiseScopes} the same recording fills for {#clause_fact_scope} — built
+      # only when the clause entry still holds an indexed or method-chain fact a raise-point write could
+      # invalidate ({#begin_fact_collector}). A retry `edge` collects the same scopes for its own widening; the
+      # collector is separate so each evaluation pass filters against exactly its own raise points.
+      #
+      # Returns `[type, scope]`: the construct's value and exit scope (the else-clause's when present). The scope the
+      # primary body alone ended with is recorded as a raise point before the `else` runs — the `else` runs only when
+      # nothing raised, so its effects are no raise point's.
+      def eval_begin_primary_under(node, entry_scope, edge: nil, collector: nil)
         body_type, body_scope =
           if node.statements
-            with_raise_frame(edge) { sub_eval(node.statements, entry_scope) }
+            with_raise_frame(edge, collector) { sub_eval(node.statements, entry_scope) }
           else
             [Type::Combinator.constant_of(nil), entry_scope]
           end
+        collector.raise_scopes << body_scope if collector
         edge.raise_scopes << body_scope if edge
 
         if node.else_clause
@@ -2850,6 +3101,13 @@ module Rigor
       end
       private_constant :RetryEdge
 
+      # Issue #2691 — the raise-point scopes one evaluation of a `begin` primary body collects for
+      # {#clause_fact_scope}: {RetryEdge}'s `frame` / `raise_scopes` pair without the retry bookkeeping, so
+      # {#record_raise_points} records into it exactly as into an edge. `frame` is the body's own frame — shared
+      # with the retry edge when one exists, since both walks collect the same nodes.
+      BodyRaiseScopes = Data.define(:frame, :raise_scopes)
+      private_constant :BodyRaiseScopes
+
       # The entry and edge one widening reads, whether it widens to the Nominal envelope or keeps literals, and, per
       # name, the rebinds it has already weighed: a statement-by-statement body shares one binding object across every
       # scope until the name is rebound, and weighing each copy again is what made a long body quadratic.
@@ -2858,17 +3116,29 @@ module Rigor
       end
       private_constant :RetryWidening
 
-      # The thread-local stack of the {RetryEdge}s whose primary body is being evaluated, innermost last, or nil.
-      RETRY_FRAMES_KEY = :rigor_retry_frames
-      private_constant :RETRY_FRAMES_KEY
+      # The thread-local stack of the raise-point frames whose primary body is being evaluated, innermost last, or
+      # nil: a {RetryEdge} and/or a {BodyRaiseScopes}. The
+      # frozen stack is the Frame; a statement's raise point recorded into a frame is a Resource touch
+      # ({#record_raise_points}).
+      RETRY_FRAMES = TypingState.frame(
+        :retry_frames,
+        contents: :resource, reason: "installed per retrying body; each raise point records into it",
+        witness: "spec/fixtures/typing_state_witnesses/retry_frames.rb"
+      )
+      private_constant :RETRY_FRAMES
 
       # The thread-local sinks a widened clause pass ({#without_jump_sinks}) leaves uninstalled.
-      CLAUSE_SINK_KEYS = [RETURN_SINK_KEY, NEXT_SINK_KEY, BREAK_SINK_KEY, BREAK_VALUE_SINK_KEY, RETRY_FRAMES_KEY].freeze
-      private_constant :CLAUSE_SINK_KEYS
+      CLAUSE_SINKS = [RETURN_SINK, NEXT_SINK, BREAK_SINK, BREAK_VALUE_SINK, RETRY_FRAMES].freeze
+      private_constant :CLAUSE_SINKS
 
       # The thread-local sinks a `return`, `next` or `break` is collected into.
-      JUMP_SINK_KEYS = (CLAUSE_SINK_KEYS - [RETRY_FRAMES_KEY]).freeze
-      private_constant :JUMP_SINK_KEYS
+      JUMP_SINKS = (CLAUSE_SINKS - [RETRY_FRAMES]).freeze
+      private_constant :JUMP_SINKS
+
+      # The sinks a caller's construct installs and a callee's body must not record into: a `next`, `break` or raise
+      # point in the callee belongs to the callee's own constructs, never to the caller's block, loop or retrying body.
+      CALLER_SINKS = [NEXT_SINK, BREAK_SINK, BREAK_VALUE_SINK, RETRY_FRAMES].freeze
+      private_constant :CALLER_SINKS
 
       # The retry edge of `node`, or nil when no `retry` in its rescue chain targets it. Allocation-free for a `begin`
       # no `retry` targets.
@@ -2946,8 +3216,11 @@ module Rigor
       end
 
       def eval_begin_paths(node, entry, edge)
-        primary = eval_begin_primary_under(node, entry, edge: edge)
-        [*primary, collect_rescue_chain_results(node.rescue_clause, entry, edge: edge)]
+        collector = begin_fact_collector(node, entry, edge)
+        primary_type, primary_scope = eval_begin_primary_under(node, entry, edge: edge, collector: collector)
+        [primary_type, primary_scope,
+         collect_rescue_chain_results(node.rescue_clause, entry,
+                                      edge: edge, raise_scopes: collector&.raise_scopes)]
       end
 
       # B2.1 — the entry scope widened by what crosses the retry edge, or nil when nothing does. A local or ivar bound
@@ -2972,28 +3245,33 @@ module Rigor
         widened
       end
 
-      # Runs `block` with `edge` on top of the thread-local stack {#record_raise_points} reads.
-      def with_raise_frame(edge)
-        return yield unless edge
+      # Runs `block` with `frames` — a retry edge and/or a {BodyRaiseScopes}, nils skipped — on top of the
+      # thread-local stack {#record_raise_points} reads.
+      def with_raise_frame(first, second, &)
+        return yield if first.nil? && second.nil?
 
-        previous = Thread.current[RETRY_FRAMES_KEY]
-        Thread.current[RETRY_FRAMES_KEY] = previous ? [*previous, edge] : [edge]
-        begin
-          yield
-        ensure
-          Thread.current[RETRY_FRAMES_KEY] = previous
-        end
+        frames = first && second ? [first, second] : [first || second]
+        state = TypingState.current
+        previous = state[RETRY_FRAMES]
+        state.with(RETRY_FRAMES, (previous ? previous + frames : frames).freeze, &)
       end
 
-      # The scope after each statement of a retrying primary body's frame is a point the body can raise from, the next
-      # statement's being the one after. Together they carry every rebind a retry can re-enter with, including one on a
-      # branch that then raises and so never reaches the body's exit scope (`if bad; tries += 1; raise; end`), and a
-      # write threaded into the raising call's own operands (`raise Retry.new(tries += 1) if flaky?`). A statement of a
-      # nested block or lambda body is not in the frame (a block parameter can shadow the counter); the block's effect
+      # The scope after each statement of a primary body's frame is a point the body can raise from, the next
+      # statement's being the one after — into every frame on the stack: a retrying begin's edge, which carries
+      # every rebind a retry can re-enter with, and a {BodyRaiseScopes}, which {#clause_fact_scope} intersects
+      # over. Both see a rebind on a branch that then raises and so never reaches the body's exit scope
+      # (`if bad; tries += 1; raise; end`), and a write threaded into the raising call's own operands
+      # (`raise Retry.new(tries += 1) if flaky?`). A statement of a nested block or lambda body is not in the
+      # frame (a block parameter can shadow the counter); the block's effect
       # on this frame shows in the post-scope of the statement holding it. Recording from the evaluator rather than
       # `on_enter` keeps a statement reached with the index recorder off (a threaded operand, a loop fixpoint pass).
       def record_raise_points(frames, stmt, stmt_scope)
-        frames.each { |edge| edge.raise_scopes << stmt_scope if edge.frame.include?(stmt) }
+        frames.each do |collector|
+          next unless collector.frame.include?(stmt)
+
+          typing_state.touch(RETRY_FRAMES)
+          collector.raise_scopes << stmt_scope
+        end
       end
 
       # An `on_enter` that records, besides forwarding to the installed one, the entry scope of each `retry` of `edge`
@@ -3150,7 +3428,14 @@ module Rigor
       # Issue #1231 — `writes` widens the scope each clause enters with ({#widen_clause_entry}) before its
       # reference is bound, so `rescue => e` still binds `e` to the exception. It is nil under a retry edge, which
       # already carries every scope the primary body raises from ({#widen_entry_for_retry}).
-      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil, writes: nil)
+      # `raise_scopes`, when given, is every scope the primary body can raise from — the post-scope of each
+      # statement of its frame and the scope it ends with ({#eval_begin_primary_under}'s collector): the rescue
+      # entry keeps only the indexed and method-chain facts every one of them still binds verbatim
+      # ({#clause_fact_scope}).
+      def collect_rescue_chain_results(rescue_node, entry_scope, edge: nil, writes: nil, raise_scopes: nil)
+        return [] if rescue_node.nil?
+
+        entry_scope = clause_fact_scope(entry_scope, raise_scopes) if raise_scopes
         on_enter = edge ? retry_scope_recorder(edge) : @on_enter
         results = []
         current = rescue_node
@@ -3198,7 +3483,7 @@ module Rigor
       # True when the clause's scope `after` still binds `$_` to the `Dynamic[top]` the entry gave it and the clause
       # holds nothing that may set it ({LastLine.may_set?}).
       def last_line_kept?(after, node)
-        after.global(:$_) == Type::Combinator.untyped && !LastLine.may_set?(node.statements, scope)
+        Type::Combinator.untyped?(after.global(:$_)) && !LastLine.may_set?(node.statements, scope)
       end
 
       # Issue #1889 — {#eval_for} with a literal-name `instance_variable_set` in the body joining its value into the
@@ -3472,15 +3757,9 @@ module Rigor
       # Installs a fresh thread-local break sink around `yield` (a loop-body evaluation), returning `[collected,
       # yield_result]`. Stacks: the previous sink is restored on exit so a nested loop's breaks do not leak to the
       # enclosing loop.
-      def collect_break_scopes
-        previous = Thread.current[BREAK_SINK_KEY]
+      def collect_break_scopes(&)
         sink = []
-        Thread.current[BREAK_SINK_KEY] = sink
-        begin
-          result = yield
-        ensure
-          Thread.current[BREAK_SINK_KEY] = previous
-        end
+        result = TypingState.current.with(BREAK_SINK, sink, &)
         [sink, result]
       end
 
@@ -3557,7 +3836,7 @@ module Rigor
       # from the widened binding reaches it ({#loop_break_arms}); without it the method inferred `true` and a
       # caller's test on it folded always-truthy on correct code.
       def later_pass_returns?(statements)
-        !Thread.current[RETURN_SINK_KEY].nil? && ReturnBarrier.exits_method?(statements)
+        !typing_state[RETURN_SINK].nil? && ReturnBarrier.exits_method?(statements)
       end
 
       # Joins each `break` arm's body-written local bindings into the loop continuation, so a `break`-path binding the
@@ -3569,12 +3848,11 @@ module Rigor
       def join_break_scopes(continuation, breaks, names)
         return continuation if breaks.empty? || names.empty?
 
-        floor = Type::Combinator.untyped
         breaks.reduce(continuation) do |cont, break_scope|
           names.reduce(cont) do |acc, name|
             break_value = CapturedLocals.bound_type(break_scope, name)
             current = CapturedLocals.bound_type(acc, name)
-            next acc if break_value.nil? || current == floor
+            next acc if break_value.nil? || Type::Combinator.untyped?(current)
 
             bind_capture(acc, name, current ? Type::Combinator.union(current, break_value) : break_value)
           end
@@ -3965,7 +4243,7 @@ module Rigor
       # signature, unknown receiver) the structural answer stands.
       def for_iteration_element_type(coll_type)
         structural = collection_element_type(coll_type)
-        return structural unless structural.equal?(Type::Combinator.untyped)
+        return structural unless Type::Combinator.untyped?(structural)
 
         block_params = MethodDispatcher.expected_block_param_types(
           receiver_type: coll_type,
@@ -3999,13 +4277,17 @@ module Rigor
           scope.with_ivar(index_node.name, element_type).without_ivar_guard(index_node.name)
         when Prism::GlobalVariableTargetNode
           scope.with_global(index_node.name, element_type)
+        when Prism::ClassVariableTargetNode
+          scope.with_cvar(index_node.name, element_type)
         when Prism::IndexTargetNode
           widen_index_target(index_node, element_type, scope, type_scope: scope)
+        when Prism::CallTargetNode
+          widen_attribute_write(index_node.receiver, index_node.name, scope)
         when Prism::MultiTargetNode
           bound = MultiTargetBinder.bind_marked(index_node, element_type, scope: scope)
-          widen_index_targets(bound, bound.apply_to(scope), type_scope: scope)
+          widen_attribute_targets(index_node, widen_index_targets(bound, bound.apply_to(scope), type_scope: scope))
         when Prism::SplatNode
-          bind_for_splat_index(index_node, scope)
+          bind_for_splat_index(index_node, element_type, scope)
         else
           scope
         end
@@ -4013,13 +4295,29 @@ module Rigor
 
       # `for *h[:a] in pairs` — Prism gives a bare splat index as a `SplatNode`, not a `MultiTargetNode`, so the
       # binder never sees it. The store is `*h[:a] = element`, an array of the element's `to_ary` parts; the receiver
-      # widens with the binder's floor for a rest it cannot decompose, `Dynamic[top]`. A bare `*name` target stays
-      # unbound here, as before.
-      def bind_for_splat_index(splat, scope)
+      # widens with the binder's floor for a rest it cannot decompose, `Dynamic[top]`. `for *x.r in pairs` calls `r=`
+      # and widens as `for x.r in` does (issue #2693).
+      #
+      # Issue #1217 — a bare `*a` / `*@a` / `*@@a` / `*$a` binds the name to the rest
+      # {MultiTargetBinder.decompose_slots} reads off the element: a `Tuple` element exactly, an `Array[T]` element as
+      # `Array[T]`, and anything else — a union, a value Ruby would wrap as `[element]` — the `Dynamic[top]` floor.
+      # Left unbound, a read after the loop folded on the pre-loop binding.
+      def bind_for_splat_index(splat, element_type, scope)
         target = splat.expression
-        return scope unless target.is_a?(Prism::IndexTargetNode)
-
-        widen_index_target(target, Type::Combinator.untyped, scope, type_scope: scope)
+        case target
+        when Prism::CallTargetNode
+          widen_attribute_write(target.receiver, target.name, scope)
+        when Prism::IndexTargetNode
+          widen_index_target(target, Type::Combinator.untyped, scope, type_scope: scope)
+        when Prism::LocalVariableTargetNode, Prism::InstanceVariableTargetNode,
+             Prism::ClassVariableTargetNode, Prism::GlobalVariableTargetNode
+          _, rest, = MultiTargetBinder.decompose_slots(
+            element_type, front_count: 0, back_count: 0, rest_present: true, scope: scope
+          )
+          bind_for_index(target, rest, scope)
+        else
+          scope
+        end
       end
 
       # Extracts the per-iteration element type from a collection carrier. `Tuple[T1..Tn]` yields the union of its
@@ -4356,13 +4654,9 @@ module Rigor
         # false positives in `prism-1.9.0`'s auto-generated `copy` methods alone. A nested `def` is a return barrier:
         # its body's `return`s belong to the inner method, not the one currently being inferred. Suspend the return sink
         # across the nested body so `eval_return` does not record them into the outer method's return type.
-        outer_sink = Thread.current[RETURN_SINK_KEY]
-        Thread.current[RETURN_SINK_KEY] = nil
-        begin
+        typing_state.with(RETURN_SINK, nil) do
           sub_eval(node.parameters, body_scope, class_context: @class_context) if node.parameters
           sub_eval(node.body, body_scope, class_context: @class_context) if node.body
-        ensure
-          Thread.current[RETURN_SINK_KEY] = outer_sink
         end
         [Type::Combinator.constant_of(node.name), scope]
       end
@@ -5156,8 +5450,15 @@ module Rigor
         narrowed = Narrowing.safe_navigation_block_scope(node, scope)
         return enter_call_block(node, block) if narrowed.equal?(scope)
 
-        evaluator_at(narrowed, operand_scope: operand_scope, operand_types: @operand_types)
-          .send(:enter_call_block, node, block)
+        narrowed_evaluator = evaluator_at(narrowed, operand_scope: operand_scope, operand_types: @operand_types)
+        narrowed_evaluator.send(:enter_call_block_carrying, node, block, @value_position_block)
+      end
+
+      # The safe-navigation arm of {#evaluate_block_if_present}: the narrowed evaluator enters the block carrying the
+      # value-position mark {#evaluate_block_of} set on this one, which {#block_self_entry} reads.
+      def enter_call_block_carrying(node, block, value_position_block)
+        @value_position_block = value_position_block
+        enter_call_block(node, block)
       end
 
       def enter_call_block(node, block)
@@ -5215,14 +5516,8 @@ module Rigor
       end
 
       # Runs the block with the method's return sink suspended, for a body whose `return` is not the method's.
-      def without_return_sink
-        outer_sink = Thread.current[RETURN_SINK_KEY]
-        Thread.current[RETURN_SINK_KEY] = nil
-        begin
-          yield
-        ensure
-          Thread.current[RETURN_SINK_KEY] = outer_sink
-        end
+      def without_return_sink(&)
+        TypingState.current.with(RETURN_SINK, nil, &)
       end
 
       # Issue #963 — `define_method(:name) { ... }` in a class body defines an INSTANCE method, and Ruby runs
@@ -5693,12 +5988,13 @@ module Rigor
       # binds to it floors: the body reads it anywhere but as a splat argument of a call (`args.first[:k] = 1`), or
       # hands it on (`b(*args)`) to a call that resolves to a def which writes a positional parameter or has a rest
       # parameter of its own that it hands on. A rest handed to a call that resolves to no user def hands off nothing,
-      # as for any hand-off. A callee reached through an inherited lookup ({FLOOR_ALL}) reads as written, as its
-      # parameters do.
+      # as for any hand-off. A callee reached through an inherited lookup ({FLOOR_ALL}) or one that may not be the def
+      # the call runs ({FLOOR_EVERY}) reads as written, as its parameters do: neither owner is a {CalleeOwner}, so its
+      # body's hand-offs cannot be read under it.
       def rest_parameter_written?(def_node, owner)
         return true if def_node.nil?
         return false unless variable_arity?(def_node)
-        return true if owner == FLOOR_ALL
+        return true if [FLOOR_ALL, FLOOR_EVERY].include?(owner)
 
         other, calls = def_census(:rest_uses, def_node) { rest_uses(def_node) }
         return true if other
@@ -5774,12 +6070,15 @@ module Rigor
       end
 
       # `base_scope` with each local `node` passes to a parameter of `mutated` rebound to what the block answers for
-      # its binding; a nil answer, or an answer equal to the binding, leaves it.
+      # its binding; a nil answer, or an answer equal to the binding, leaves it. Issue #2335 — an argument that may be
+      # another local's object (a block parameter, a copy) floors every local another holder may reach
+      # ({AliasMutationFloor.floor_after_written_local}), a block-local one included.
       def floor_arguments(node, mutated, base_scope, offset, climbing = nil)
         arguments = arguments_for_slots(node, mutated, offset)
         return base_scope if arguments.empty?
 
         arguments.reduce(base_scope) do |acc, argument|
+          acc = AliasMutationFloor.floor_after_written_local(acc, argument, node)
           next acc unless acc.locals.key?(argument.name)
           next acc if climbing && argument.depth <= climbing
 
@@ -5814,15 +6113,19 @@ module Rigor
       def callee_chain_store
         return NO_CHAIN_STORE if hand_off_memo_bypassed?
 
-        table = (Thread.current[CHAIN_STORE_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        table = typing_state.weak_key_map(CHAIN_STORE)
         self_type = scope.self_type
         { store: (table[scope.discovery] ||= {}.compare_by_identity),
           ctx: [self_type.is_a?(Type::Singleton), enclosing_class_name_for(self_type)] }
       end
 
-      CHAIN_STORE_KEY = RunScopedSlots.register(:rigor_callee_chain_successors)
+      CHAIN_STORE = TypingState.memo(
+        :callee_chain_successors,
+        run_scoped: true, audit: "successor",
+        reason: "graph facts keyed by discovery, the same whichever census reads them"
+      )
       NO_CHAIN_STORE = {}.freeze
-      private_constant :CHAIN_STORE_KEY, :NO_CHAIN_STORE
+      private_constant :CHAIN_STORE, :NO_CHAIN_STORE
 
       # Issue #2296 — the `{ name => slot }` parameters the callee mutates inside a block in its body
       # ({#own_block_content_parameters}), closed over hand-offs as {#callee_content_mutated_parameters} is.
@@ -5858,22 +6161,47 @@ module Rigor
       # survive `with_self_type` and change what a constant in the def's body types as, so the census is no longer
       # the def's alone, and the first caller's narrowing must not become every later caller's answer.
       def resolved_census(kind, def_node, &)
+        # An audit recomputation bypasses the memo but still opens the site's declaration (ADR-129 WD1).
+        return MemoAudit.key_audit("resolved census", RESOLVED_CENSUS_KEY_AUDIT, &) if MemoAudit.suspended?
         return yield if hand_off_memo_bypassed?
 
         discovery = scope.discovery
-        table = (Thread.current[RESOLVED_CENSUS_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        table = typing_state.weak_key_map(RESOLVED_CENSUS)
         slot = (table[discovery] ||= [{}, {}])
         self_type = scope.self_type
         by_class = (slot[self_type.is_a?(Type::Singleton) ? 1 : 0][kind] ||= {})
         class_name = enclosing_class_name_for(self_type)
         by_def = (by_class[class_name] ||= {}.compare_by_identity)
-        return by_def[def_node] = yield unless by_def.key?(def_node)
+        unless by_def.key?(def_node)
+          return by_def[def_node] = MemoAudit.key_audit("resolved census", RESOLVED_CENSUS_KEY_AUDIT, &)
+        end
 
-        MemoAudit.check("resolved census", by_def[def_node], kind, class_name, &)
+        MemoAudit.check("resolved census", by_def[def_node], kind, class_name) do
+          MemoAudit.key_audit("resolved census", RESOLVED_CENSUS_KEY_AUDIT, &)
+        end
       end
 
-      RESOLVED_CENSUS_KEY = RunScopedSlots.register(:rigor_callee_resolved_census)
-      private_constant :RESOLVED_CENSUS_KEY
+      RESOLVED_CENSUS = TypingState.memo(
+        :callee_resolved_census,
+        run_scoped: true, audit: "resolved census",
+        reason: "keyed by discovery, side, kind, class and def, all its answer reads; audited by MemoAudit"
+      )
+      private_constant :RESOLVED_CENSUS
+
+      # ADR-129 WD1's key audit of a resolved-census miss. A census types a callee's receivers ({#receiver_callees_in})
+      # under the frames its caller installed, and keys on none of them: a known gap, #2867.
+      CENSUS_CALLER_FRAMES = %i[
+        threaded_block_body key_presence_walk return_sink next_sink break_sink break_value_sink retry_frames
+        interface_erasure interface_dispatch_off
+      ].freeze
+      private_constant :CENSUS_CALLER_FRAMES
+      RESOLVED_CENSUS_KEY_AUDIT = MemoAudit.key_declaration(
+        gaps: CENSUS_CALLER_FRAMES.to_h do |name|
+          [name, "#2867: the census types a callee's receivers under the caller's frames, and its key carries " \
+                 "none of them"]
+        end
+      ).freeze
+      private_constant :RESOLVED_CENSUS_KEY_AUDIT
 
       # The parameters `def_node` mutates itself, from either channel: those escape-mutated inside a block (which may
       # run later / repeatedly) AND those mutated directly in the method body during the call itself
@@ -6128,15 +6456,22 @@ module Rigor
 
       # Issue #2104 — the per-thread memo of a census that reads nothing but `def_node`'s AST, under `kind`.
       def def_census(kind, def_node, &)
-        table = (Thread.current[DEF_CENSUS_KEY] ||= ObjectSpace::WeakKeyMap.new)
+        # An audit recomputation bypasses the memo, so it reads no stored entry (ADR-127 WD3, #3071).
+        return MemoAudit.key_audit("def census", &) if MemoAudit.suspended?
+
+        table = typing_state.weak_key_map(DEF_CENSUS)
         entry = (table[def_node] ||= {})
-        return entry[kind] = yield unless entry.key?(kind)
+        return entry[kind] = MemoAudit.key_audit("def census", &) unless entry.key?(kind)
 
         MemoAudit.check("def census", entry[kind], kind, &)
       end
 
-      DEF_CENSUS_KEY = RunScopedSlots.register(:rigor_callee_def_census)
-      private_constant :DEF_CENSUS_KEY
+      DEF_CENSUS = TypingState.memo(
+        :callee_def_census,
+        run_scoped: true, audit: "def census",
+        reason: "keyed by def node, the only input it reads; audited by MemoAudit"
+      )
+      private_constant :DEF_CENSUS
 
       # Issue #2104 — the {CalleeMutationChain::Edge}s along which `def_node` hands one of its parameters, unchanged, to
       # a self-call resolving to a user def: a positional argument or a keyword value that reads the parameter itself
@@ -6748,14 +7083,19 @@ module Rigor
       # True when at least one argument of `node` is a bare local-variable read (positional or keyword value) bound in
       # the current scope — a cheap pre-filter so the def resolution / body scan only runs for calls that could actually
       # floor something.
+      # A local bound in the current scope, or (issue #2335) one whose object another local may share, which the
+      # alias floor reads a callee's write through ({AliasMutationFloor.reaches_other_locals?}).
+      def passed_local?(read, node)
+        scope.locals.key?(read.name) || AliasMutationFloor.reaches_other_locals?(scope, read, node)
+      end
+
       def call_passes_local_argument?(node)
         args = node.arguments
         return false unless args.respond_to?(:arguments)
 
         args.arguments.any? do |arg|
           case arg
-          when Prism::LocalVariableReadNode
-            scope.locals.key?(arg.name)
+          when Prism::LocalVariableReadNode then passed_local?(arg, node)
           when Prism::SplatNode
             arg.expression.is_a?(Prism::LocalVariableReadNode) && scope.locals.key?(arg.expression.name)
           when Prism::KeywordHashNode
@@ -6781,7 +7121,7 @@ module Rigor
         while receiver.is_a?(Prism::CallNode)
           if receiver.block.is_a?(Prism::BlockNode) &&
              classify_closure_escape(receiver) != :non_escaping
-            acc = widen_escaping_content_captures(receiver.block, acc)
+            acc = widen_escaping_content_captures(receiver.block, acc, foreign_self: foreign_self_block?(receiver))
           end
           receiver = receiver.receiver
         end
@@ -6799,7 +7139,14 @@ module Rigor
       # `Array[Dynamic[top]]`, Hash -> `Hash[untyped, untyped]`, String -> `String`. The seed's element/key/value
       # precision is forgotten; only the carrier survives. Read-only captures and locals the block merely rebinds
       # (already floored by `drop_captured_narrowing`) are untouched.
-      def widen_escaping_content_captures(block_node, post_scope)
+      #
+      # An instance variable of this scope's `self` the body mutates in place is floored too (issue #1208): a callback
+      # that runs `@opts[:format] = "json"` later left `@opts[:format]` folding to `"text"`, and so are a class variable
+      # and a global (issue #3096). Each floors member by member ({#member_content_floor}, issue #3095), so a lazily
+      # initialised `@buf = flag ? [1] : nil` keeps its `nil`. An instance variable under a block that runs on another
+      # object is that object's, and so is every one when `foreign_self` says the closure itself does; a class
+      # variable resolves lexically and a global is global, so neither depends on `self`.
+      def widen_escaping_content_captures(block_node, post_scope, foreign_self: false)
         body = block_node.body
         return post_scope if body.nil?
 
@@ -6807,15 +7154,85 @@ module Rigor
         # `local[k] = v` write, which `collect_content_mutations` cannot see (see below).
         post_scope = floor_block_body_callee_escaped_args(body, post_scope)
 
-        mutations = collect_content_mutations(body)
-        return post_scope if mutations.empty?
+        post_scope = collect_content_mutations(body).keys.reduce(post_scope) do |acc, name|
+          floored = content_floor_for(CapturedLocals.bound_type(acc, name))
+          floored.nil? ? acc : bind_mutated_capture(acc, name, floored)
+        end
+
+        floor_non_local_contents(escaping_non_local_content_mutations(body, post_scope, foreign_self), post_scope)
+      end
 
-        mutations.keys.reduce(post_scope) do |acc, name|
-          floored = content_floor_for(acc.local(name))
-          floored.nil? ? acc : acc.with_mutated_local(name, floored)
+      # `scope` with each instance variable, class variable or global in `names` floored member by member.
+      def floor_non_local_contents(names, scope)
+        names.reduce(scope) do |acc, name|
+          bound = CapturedLocals.bound_type(acc, name)
+          floored = member_content_floor(bound)
+          floored.equal?(bound) ? acc : CapturedLocals.bind(acc, name, floored)
         end
       end
 
+      # `type` with each member {#content_floor_for} recognises floored to its bare carrier and every other member
+      # kept (issue #3095): `Array[1]?` reads `Array[Dynamic[top]]?` and `3 | [1]` reads `3 | Array[Dynamic[top]]`,
+      # so the floor neither drops the `nil` a callback that never runs leaves nor narrows the binding. `type` itself
+      # when no member floors.
+      def member_content_floor(type)
+        members = type.is_a?(Type::Union) ? type.members : [type]
+        floored = members.map { |member| content_floor_for(member) || member }
+        return type if floored.each_with_index.all? { |member, index| member.equal?(members[index]) }
+
+        Type::Combinator.union(*floored)
+      end
+
+      # The instance variables of `scope`'s `self`, the class variables and the globals an escaping body mutates in
+      # place, on the terms {#capturable_non_local?} reads against `scope` — the continuation the floor writes into.
+      def escaping_non_local_content_mutations(body, scope, foreign_self)
+        names = nil
+        Source::NodeWalker.each_with_ancestors(body) do |node, ancestors|
+          name, content = non_local_shape_mutation(node)
+          next if name.nil?
+          next unless (content && capturable_non_local?(name, ancestors, scope, foreign_self: foreign_self)) ||
+                      block_defined_method_capture?(name, ancestors, scope, foreign_self)
+
+          (names ||= []) << name
+        end
+        names ? names.uniq : NO_REWRITES
+      end
+
+      # `[name, content]` when `node` mutates an instance variable, class variable or global in place, else nil.
+      # `content` says a content scan counts the mutation ({CONTENT_MUTATORS}, or an index write). A method the block
+      # defines counts every name the straight-line widening responds to as well ({CALLEE_WRITE_MUTATORS}: `merge!`,
+      # `map!`, `clear`, …), because its floor reads no evidence from the call (issue #3163).
+      def non_local_shape_mutation(node)
+        content = index_write?(node)
+        unless content
+          return nil unless node.is_a?(Prism::CallNode) && CALLEE_WRITE_MUTATORS.include?(node.name)
+
+          content = CONTENT_MUTATORS.include?(node.name)
+        end
+        receiver = node.receiver
+        NON_LOCAL_READ_NODES.include?(receiver.class) ? [receiver.name, content] : nil
+      end
+
+      # Issue #3163 — `post_scope` with every instance variable, class variable and global floored member by member
+      # ({#member_content_floor}) that a method defined in `call_node`'s non-escaping block mutates in place
+      # ({#block_defined_method_capture?}). The block, or anything it calls, may call that method before it returns:
+      # `$buf = []; [1].each { def h; $buf << 1; end; h }` leaves `$buf` as `[1]`, and the content join reads no
+      # evidence from a method body, which it types in no scope of the block's. No call is followed, so a method the
+      # block defines and nothing calls floors too. An escaping block floors the same names
+      # ({#escaping_non_local_content_mutations}).
+      def floor_block_defined_method_mutations(call_node, block, post_scope)
+        foreign = foreign_self_block?(call_node)
+        names = nil
+        Source::NodeWalker.each_with_ancestors(block.body) do |node, ancestors|
+          name, = non_local_shape_mutation(node)
+          # Read against the continuation: a variable the block itself first binds has no pre-call binding.
+          next if name.nil? || !block_defined_method_capture?(name, ancestors, post_scope, foreign)
+
+          (names ||= []) << name
+        end
+        names.nil? ? post_scope : floor_non_local_contents(names.uniq, post_scope)
+      end
+
       # Inside an ESCAPING block body, a captured outer local can be content- mutated transitively: the body is (or
       # contains) a self-call that escape-mutates one of its arguments. The canonical shape is the CLI's own
       # `OptionParser.new { |opts| define_options(opts, options) }` — the block body is a bare `define_options(opts,
@@ -6939,7 +7356,7 @@ module Rigor
       # continuation holds each rebound capture at `Dynamic[top]` ({#drop_captured_narrowing}), and the pass reads it
       # so: `seen = 0; yielder { return :ret if (seen += 1) > 1 }` reaches the `return`.
       def collect_repeated_block_returns(call_node, post_scope)
-        return if Thread.current[RETURN_SINK_KEY].nil?
+        return if typing_state[RETURN_SINK].nil?
 
         block = call_node.block
         return unless repeated_block_return_candidate?(call_node, block)
@@ -7076,16 +7493,16 @@ module Rigor
         end
       end
 
-      # Binds a name from `CapturedLocals.writes`. An ivar goes through {CapturedLocals.bind}, which keeps its issue
-      # #286 optimistic mark. A local keeps the plain `with_local` these seams have always used, so a block that
-      # rebinds no ivar leaves the locals exactly as before.
+      # Binds a name from `CapturedLocals.writes`. An ivar (or any other non-local) goes through
+      # {CapturedLocals.bind}, which keeps an ivar's issue #286 optimistic mark. A local keeps the plain `with_local`
+      # these seams have always used, so a block that rebinds no ivar leaves the locals exactly as before.
       #
       # Issue #1402 — `optimistic` is a mark a write-back pass's exit held ({#with_capture_exit_marks}); a name that has
       # one binds through {CapturedLocals.bind} whatever its kind, which adds it.
       def bind_capture(scope, name, type, optimistic: nil)
         return CapturedLocals.bind(scope, name, type, optimistic: optimistic) if optimistic
 
-        CapturedLocals.ivar_name?(name) ? CapturedLocals.bind(scope, name, type) : scope.with_local(name, type)
+        CapturedLocals.local_name?(name) ? scope.with_local(name, type) : CapturedLocals.bind(scope, name, type)
       end
 
       # A block-level `break` ends the CALL, so the binding it leaves with starts no further iteration and is no input
@@ -7113,9 +7530,8 @@ module Rigor
           end
         return converged if arms.empty?
 
-        floor = Type::Combinator.untyped
         converged.to_h do |name, type|
-          next [name, type] if type == floor
+          next [name, type] if Type::Combinator.untyped?(type)
 
           [name, Type::Combinator.union(type, *arms.filter_map { |arm| CapturedLocals.bound_type(arm, name) })]
         end
@@ -7174,22 +7590,48 @@ module Rigor
         block = call_node.block
         return post_scope unless block.is_a?(Prism::BlockNode)
         return post_scope unless classify_closure_escape(call_node) == :non_escaping
+        return post_scope if block.body.nil?
 
-        body = block.body
-        return post_scope if body.nil?
+        post_scope = join_block_content_captures(call_node, block, post_scope, seed_scope)
+        # Issue #3163 — a method the block defines may run during the block, so its in-place mutations of an instance
+        # variable, class variable or global floor that binding. The join reads no evidence from a method body.
+        floor_block_defined_method_mutations(call_node, block, post_scope)
+      end
 
+      # The join {#content_writeback_block_captures} documents, for a non-escaping `block` with a body.
+      def join_block_content_captures(call_node, block, post_scope, seed_scope)
+        body = block.body
         shadows = {}.compare_by_identity
-        mutations = captured_content_mutations(block, shadows)
+        mutations = captured_content_mutations(block, shadows, call_node)
         return post_scope if mutations.empty?
 
         seeds = mutations.to_h do |name, _calls|
-          [name, lookup_mutated_seed(body, name, seed_scope.local(name)) { |depth, nesting| depth > nesting }]
+          seed = CapturedLocals.bound_type(seed_scope, name)
+          [name, lookup_mutated_seed(body, name, seed) { |depth, nesting| depth > nesting }]
         end
-        shadow_rebound_reads(block, mutations, seeds, shadows)
+        shadow_rebound_reads(block, mutations, seeds, shadows, call_node)
         joined = join_content_to_fixpoint(mutations, seeds, build_block_entry_scope(call_node, block), shadows)
         rewrites = local_rewrites(block.body) { |receiver, ancestors| receiver.depth > scope_nesting(ancestors) }
         joined.reduce(post_scope) do |acc, (name, type)|
-          acc.with_mutated_local(name, rewritten_capture(type, seeds[name], rewrites.fetch(name, NO_REWRITES)))
+          bind_mutated_capture(acc, name, rewritten_capture(type, seeds[name], rewrites.fetch(name, NO_REWRITES)))
+        end
+      end
+
+      # `scope` with a capture the block mutated in place bound to its joined or floored content: a local through
+      # `Scope#with_mutated_local`, which keeps the marks a source-level write drops, and an instance variable, class
+      # variable or global through {CapturedLocals.bind}, which keeps an ivar's optimistic nil-freeness mark. The
+      # binding still names the same object.
+      def bind_mutated_capture(scope, name, type)
+        CapturedLocals.local_name?(name) ? scope.with_mutated_local(name, type) : CapturedLocals.bind(scope, name, type)
+      end
+
+      # `scope` with a content seam's working binding for `name` — its join so far, or `Dynamic[top]` for a read the
+      # body rebinds — whatever kind of variable it is.
+      def bind_capture_slot(scope, name, type)
+        case CapturedLocals.variable_kind(name)
+        when :local then scope.with_local(name, type)
+        when :ivar then scope.with_ivar(name, type)
+        else CapturedLocals.bind(scope, name, type)
         end
       end
 
@@ -7198,19 +7640,29 @@ module Rigor
 
       # The {RewriteMutation} names `root` calls on each local its block admits — `a.map!(&:to_s)` beside an `a << x`.
       # The receiver test is the one the caller's content-mutation walk applies.
-      def local_rewrites(root)
+      def local_rewrites(root, &)
         rewrites = {}
         Source::NodeWalker.each_with_ancestors(root) do |node, ancestors|
           next unless node.is_a?(Prism::CallNode) && RewriteMutation.rewriter?(node.name)
 
           receiver = node.receiver
-          next unless receiver.is_a?(Prism::LocalVariableReadNode) && yield(receiver, ancestors)
+          next unless rewritten_capture_receiver?(receiver, ancestors, &)
 
           (rewrites[receiver.name] ||= []) << node.name
         end
         rewrites
       end
 
+      # A local the caller's test admits, or an instance variable, class variable or global outside a body that makes
+      # it another variable ({#under_scope_body?}): the names the content walks can collect.
+      def rewritten_capture_receiver?(receiver, ancestors)
+        case receiver
+        when Prism::LocalVariableReadNode then yield(receiver, ancestors)
+        when *NON_LOCAL_READ_NODES then !under_scope_body?(ancestors, CapturedLocals.variable_kind(receiver.name))
+        else false
+        end
+      end
+
       # The slice-C join (and the loop seam's) rebuilds a collection from its SEED, so the rewrite the body's own
       # widening applied is gone from it: `a = [1]; [0].each { a.map!(&:to_s); a << "x" }` read `Array["x" | 1]`, and
       # `a[0] == "1"` folded always-falsey. Each rewrite the body makes on the local is re-applied here, on the seam's
@@ -7237,10 +7689,14 @@ module Rigor
       # - joined with the block-entry typing, it still stores exit values no store reads;
       # - one more walk of the body to the store inherits every gap in the engine's in-body flow.
       #
+      # An instance variable the body rebinds is one too (issue #1235): `@total += x; out << @total` stored the
+      # pre-call `@total`, and so are a class variable and a global (issue #3096). Each counts on the terms the content
+      # walk takes one ({#capturable_non_local?}).
+      #
       # See ADR-56 WD2.13.
-      def shadow_rebound_reads(block, sites, seeds, shadows)
+      def shadow_rebound_reads(block, sites, seeds, shadows, call_node)
         entry_names = scope.locals.keys | CapturedLocals.introduced_locals(block).to_a
-        written = scope_local_writes(block) & entry_names
+        written = (scope_local_writes(block) & entry_names) | rebound_capturable_non_locals(block, call_node)
         return if written.empty?
 
         sites.each do |name, nodes|
@@ -7254,6 +7710,23 @@ module Rigor
         end
       end
 
+      # The instance variables, class variables and globals the block body writes that {#capturable_non_local?}
+      # accepts; no instance variable for a block that runs on another object. Every self-rebinding call classifies
+      # `:unknown` today, so neither content seam that calls this meets one; the guard keeps the answer right should
+      # the escape analysis learn to call one non-escaping.
+      def rebound_capturable_non_locals(block, call_node)
+        return NO_REWRITES if block.body.nil?
+
+        foreign = foreign_self_block?(call_node)
+        names = []
+        Source::NodeWalker.each_with_ancestors(block.body) do |node, ancestors|
+          next unless CapturedLocals::NON_LOCAL_WRITE_NODES.include?(node.class)
+
+          names << node.name if capturable_non_local?(node.name, ancestors, scope, foreign_self: foreign)
+        end
+        names.uniq
+      end
+
       # The locals a store reads to build what it stores. An Array index write's index arguments are left out, and so
       # is any name they read: the join classifies the store as an element or a splice from the index's type, and a
       # `Dynamic` index reads as both, so `grid[i] = [x, x]` would join `x` itself as a member of `grid` beside the
@@ -7292,6 +7765,29 @@ module Rigor
       SCOPE_BODY_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
       private_constant :SCOPE_BODY_NODES
 
+      CLASS_BODY_NODES = [Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      private_constant :CLASS_BODY_NODES
+
+      # The bodies under a block body where a non-local of each kind is no longer the one the block's caller sees, or
+      # does not run while the block does. A `def` body runs only when called. A class or module body is a class of
+      # its own for an instance variable and a class variable, but runs at once and reads the one global. `class <<
+      # self` keeps the enclosing class's class variables, so only an instance variable leaves there.
+      NON_LOCAL_SCOPE_BODY_NODES = {
+        ivar: SCOPE_BODY_NODES,
+        cvar: [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode].freeze,
+        global: [Prism::DefNode].freeze
+      }.freeze
+      private_constant :NON_LOCAL_SCOPE_BODY_NODES
+
+      # True when a non-local of `kind` (`:ivar`, `:cvar` or `:global`) at `ancestors` under a block body sits in a body
+      # the block defines that makes it another variable or does not run during the block
+      # ({NON_LOCAL_SCOPE_BODY_NODES}): for an instance variable, any method, class or module body, where `self` is that
+      # body's own.
+      def under_scope_body?(ancestors, kind = :ivar)
+        bodies = NON_LOCAL_SCOPE_BODY_NODES.fetch(kind)
+        ancestors.any? { |a| bodies.any? { |k| a.is_a?(k) } }
+      end
+
       # True when the local `node` names lives in the scope the walk started in or an outer one.
       def same_scope_local?(node, ancestors)
         return false if ancestors.any? { |ancestor| SCOPE_BODY_NODES.any? { |klass| ancestor.is_a?(klass) } }
@@ -7308,16 +7804,37 @@ module Rigor
       ].freeze
       private_constant :LOCAL_READ_NODES
 
-      # Every local `node` reads from the scope it sits in: a read inside an inner block of a name that block
-      # introduces is a different variable.
+      # The same for an instance variable, a class variable and a global.
+      NON_LOCAL_VALUE_READ_NODES = Set[
+        Prism::InstanceVariableReadNode,
+        Prism::InstanceVariableOperatorWriteNode,
+        Prism::InstanceVariableOrWriteNode,
+        Prism::InstanceVariableAndWriteNode,
+        Prism::ClassVariableReadNode,
+        Prism::ClassVariableOperatorWriteNode,
+        Prism::ClassVariableOrWriteNode,
+        Prism::ClassVariableAndWriteNode,
+        Prism::GlobalVariableReadNode,
+        Prism::GlobalVariableOperatorWriteNode,
+        Prism::GlobalVariableOrWriteNode,
+        Prism::GlobalVariableAndWriteNode
+      ].freeze
+      private_constant :NON_LOCAL_VALUE_READ_NODES
+
+      # Every local `node` reads from the scope it sits in, and every instance variable, class variable or global
+      # outside a nested method or class body: a read inside an inner block of a name that block introduces is a
+      # different variable. The caller intersects the answer with the names the body writes, which
+      # {#rebound_capturable_non_locals} has already filtered.
       def local_reads(node)
         return [] if node.nil?
 
         names = []
         Source::NodeWalker.each_with_ancestors(node) do |n, ancestors|
-          next unless LOCAL_READ_NODES.any? { |klass| n.is_a?(klass) }
-
-          names << n.name if same_scope_local?(n, ancestors)
+          if LOCAL_READ_NODES.any? { |klass| n.is_a?(klass) }
+            names << n.name if same_scope_local?(n, ancestors)
+          elsif NON_LOCAL_VALUE_READ_NODES.include?(n.class)
+            names << n.name unless under_scope_body?(ancestors, CapturedLocals.variable_kind(n.name))
+          end
         end
         names.uniq
       end
@@ -7403,7 +7920,7 @@ module Rigor
 
       def bind_content_joins(scope, kinds, seeds, evidence)
         kinds.reduce(scope) do |acc, (name, kind)|
-          acc.with_local(name, content_entry_binding(seeds[name], kind, name, evidence))
+          bind_capture_slot(acc, name, content_entry_binding(seeds[name], kind, name, evidence))
         end
       end
 
@@ -7436,10 +7953,23 @@ module Rigor
       #
       # Each site nested in an inner block or lambda is recorded in `shadows` with the names those blocks bind
       # themselves (see {#join_content_to_fixpoint}).
-      def captured_content_mutations(block, shadows)
+      #
+      # Issue #1208 — an instance variable is a capture too: every block made in a method shares its `self`, so `@out
+      # << x` in the body grows the method's `@out` exactly as `out << x` grows `out`. It counts on the terms
+      # {CapturedLocals.writes} takes a rebound one: bound at the call site and not on its ADR-58 declaration seed
+      # ({CapturedLocals.rebindable_ivar?}), outside a nested method or class body, and not in a block that runs on
+      # another object ({CapturedLocals.under_foreign_self_block?}, or `call_node`'s own block).
+      #
+      # Issue #3096 — a class variable and a global are captures on the same terms, less the foreign-self one: Ruby
+      # resolves a class variable lexically, and a global is the same one whatever `self` is.
+      def captured_content_mutations(block, shadows, call_node)
         mutations = Hash.new { |h, k| h[k] = [] }
+        # Every self-rebinding call classifies `:unknown` today, so this seam does not meet one; the guard keeps the
+        # ivar arm right should the escape analysis learn to call one non-escaping.
+        foreign = foreign_self_block?(call_node)
         Source::NodeWalker.each_with_ancestors(block.body) do |node, ancestors|
           name, site = content_mutation_target(node) { |receiver| receiver.depth > scope_nesting(ancestors) }
+          name, site = non_local_content_mutation_target(node, ancestors, foreign) if name.nil?
           next if name.nil?
 
           mutations[name] << site
@@ -7448,6 +7978,89 @@ module Rigor
         mutations
       end
 
+      # `[name, node]` when `node` mutates the content of an instance variable of this scope's `self`, a class
+      # variable or a global that the content seams may join ({#captured_content_mutations}), else
+      # {NO_CONTENT_MUTATION}. `foreign_self` says the seam's block runs on another object.
+      def non_local_content_mutation_target(node, ancestors, foreign_self)
+        is_call_mutator = node.is_a?(Prism::CallNode) && CONTENT_MUTATORS.include?(node.name)
+        return NO_CONTENT_MUTATION unless is_call_mutator || index_write?(node)
+
+        receiver = node.receiver
+        return NO_CONTENT_MUTATION unless NON_LOCAL_READ_NODES.include?(receiver.class)
+        return NO_CONTENT_MUTATION unless capturable_non_local?(receiver.name, ancestors, scope, foreign_self:)
+        return NO_CONTENT_MUTATION unless collection_only?(CapturedLocals.bound_type(scope, receiver.name))
+
+        [receiver.name, node]
+      end
+
+      # The receiver reads of a variable the content seams take besides a local.
+      NON_LOCAL_READ_NODES = Set[
+        Prism::InstanceVariableReadNode, Prism::ClassVariableReadNode, Prism::GlobalVariableReadNode
+      ].freeze
+      private_constant :NON_LOCAL_READ_NODES
+
+      # True when every member of `type` is an Array, a Hash or a String carrier. The non-escaping join takes an
+      # instance variable only then: it drops a seed's `nil` after a guarded mutation (#1219), so `@buf = flag ? [1] :
+      # nil; [1].each { @buf << 2 if @buf }` would lose the `nil` the runtime keeps when the block never runs it. The
+      # local spelling has the gap; an instance variable, the common lazily-initialised spelling, keeps its pre-call
+      # binding until it closes. The escaping floor takes every instance variable ({#member_content_floor}).
+      def collection_only?(type)
+        return false if type.nil?
+        return type.members.all? { |member| collection_only?(member) } if type.is_a?(Type::Union)
+
+        arrayish?(type) || hashish?(type) || UnknownStoreWidening.carrier_class(type) == "String"
+      end
+
+      # True when the non-local `name`, read or written at `ancestors` under a block body, is one the content seams
+      # take against `in_scope`: bound there ({CapturedLocals.rebindable_non_local?}, which keeps an instance
+      # variable on its declaration seed out) and outside a body the block defines that makes it another variable or
+      # runs later ({#under_scope_body?}).
+      #
+      # - An instance variable must be `self`'s: not under a block that runs on another object, nor in a seam whose
+      #   block does (`foreign_self`), nor in any method, class or module body.
+      # - A class variable resolves lexically and a global is global, so `self` does not matter to either (issue
+      #   #3096). A `def` body runs only when called, so neither counts there. A class or module body runs at once:
+      #   it reads its own class variables but the one global, so a global counts there. `class << self` keeps the
+      #   enclosing class's class variables, so a class variable counts there.
+      # - A global Ruby's own signatures declare (`$stdout`, `$;`, `$0`, the frame-local `$~` and `$_`, …) is left
+      #   alone: the interpreter owns it, and some of them read through a getter (`$0` answers a frozen copy).
+      def capturable_non_local?(name, ancestors, in_scope, foreign_self: false)
+        return false if under_scope_body?(ancestors, CapturedLocals.variable_kind(name))
+
+        non_local_of_scope?(name, ancestors, in_scope, foreign_self)
+      end
+
+      # Issue #3163 — true when the non-local `name`, mutated at `ancestors` under a block body, sits in a method the
+      # block defines and is one the content floor takes against `in_scope`. {#capturable_non_local?} leaves a `def`
+      # body out because it runs only when called, but the block may call it. The terms are that method's, less the
+      # `def` boundary:
+      #
+      # - A class or module body or a `class << self` between the block and the mutation still leaves every kind out:
+      #   a method defined there is another class's, and the walks do not ask who calls it.
+      # - An instance variable in a method defined on an explicit receiver other than `self` (`def other.m`) is that
+      #   object's. A plain `def` counts wherever it is written, so one in a class body's block, whose instance
+      #   variables are an instance's and not the class's, floors the class's too.
+      def block_defined_method_capture?(name, ancestors, in_scope, foreign_self)
+        defs = ancestors.grep(Prism::DefNode)
+        return false if defs.empty? || ancestors.any? { |a| CLASS_BODY_NODES.any? { |k| a.is_a?(k) } }
+
+        foreign_def = defs.any? { |d| !d.receiver.nil? && !d.receiver.is_a?(Prism::SelfNode) }
+        return false if foreign_def && CapturedLocals.variable_kind(name) == :ivar
+
+        non_local_of_scope?(name, ancestors, in_scope, foreign_self)
+      end
+
+      # The half of {#capturable_non_local?} that does not read the bodies between the block and the non-local.
+      def non_local_of_scope?(name, ancestors, in_scope, foreign_self)
+        case CapturedLocals.variable_kind(name)
+        when :ivar
+          return false if foreign_self || CapturedLocals.under_foreign_self_block?(ancestors, in_scope)
+        when :global
+          return false if in_scope.environment.global_for_name(name, builtin: true)
+        end
+        CapturedLocals.rebindable_non_local?(in_scope, name)
+      end
+
       def scope_nesting(ancestors)
         ancestors.count { |ancestor| scope_nesting_node?(ancestor) }
       end
@@ -7468,7 +8081,7 @@ module Rigor
         names = shadows[site]
         return scope if names.nil?
 
-        names.reduce(scope) { |acc, name| acc.with_local(name, Type::Combinator.untyped) }
+        names.reduce(scope) { |acc, name| bind_capture_slot(acc, name, Type::Combinator.untyped) }
       end
 
       # `base` binds every fixed name to its join; the moving names are rebound on each pass.
@@ -7480,7 +8093,7 @@ module Rigor
           widen: Type::Combinator.method(:widen_value_pinned),
           evaluate_body: lambda do |assumption|
             pass_entry = kinds.reduce(base) do |acc, (name, kind)|
-              acc.with_local(name, content_carrier_under(seeds[name], kind, name, assumption))
+              bind_capture_slot(acc, name, content_carrier_under(seeds[name], kind, name, assumption))
             end
             content_evidence(sites, kinds, pass_entry, shadows)
           end
@@ -7591,11 +8204,19 @@ module Rigor
         type.nil? || type.is_a?(Type::Bot) ? [] : [type]
       end
 
+      # A joined name is a local, an instance variable (#1208), a class variable or a global (#3096), so a store
+      # reading any of them moves.
+      CAPTURE_READ_NODES = Set[
+        Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode, Prism::ClassVariableReadNode,
+        Prism::GlobalVariableReadNode
+      ].freeze
+      private_constant :CAPTURE_READ_NODES
+
       def store_arguments_read?(node, names)
         arguments = node.arguments
         return false if arguments.nil?
 
-        Source::NodeWalker.each(arguments).any? { |n| n.is_a?(Prism::LocalVariableReadNode) && names.include?(n.name) }
+        Source::NodeWalker.each(arguments).any? { |n| CAPTURE_READ_NODES.include?(n.class) && names.include?(n.name) }
       end
 
       # ADR-56 slice C (B3). For `recv.each_with_object(memo) { |x, acc| … }` the return is the memo object after the
@@ -7854,8 +8475,14 @@ module Rigor
           next if ancestors.any?(Prism::DefNode)
 
           receiver = node.receiver
-          next unless receiver.is_a?(Prism::LocalVariableReadNode) && receiver.name == name
-          next unless yield(receiver.depth, scope_nesting(ancestors))
+          case receiver
+          when Prism::LocalVariableReadNode
+            next unless receiver.name == name && yield(receiver.depth, scope_nesting(ancestors))
+          when Prism::InstanceVariableReadNode, Prism::ClassVariableReadNode, Prism::GlobalVariableReadNode
+            next unless receiver.name == name && capturable_non_local?(name, ancestors, scope)
+          else
+            next
+          end
 
           seed = MutationWidening.widen_for_mutator(seed, node.name) || seed
         end
@@ -7868,11 +8495,11 @@ module Rigor
       # write.
       def join_memo_content(call_node, memo_param, calls, pre_state, shadows)
         block = call_node.block
-        captured = captured_content_mutations(block, shadows)
-        seeds = captured.keys.to_h { |name| [name, scope.local(name)] }
+        captured = captured_content_mutations(block, shadows, call_node)
+        seeds = captured.keys.to_h { |name| [name, CapturedLocals.bound_type(scope, name)] }
         seeds[memo_param] = pre_state
         sites = captured.merge(memo_param => calls)
-        shadow_rebound_reads(block, sites, seeds, shadows)
+        shadow_rebound_reads(block, sites, seeds, shadows, call_node)
         join_content_to_fixpoint(sites, seeds, build_block_entry_scope(call_node, block), shadows)[memo_param]
       end
 
@@ -8429,7 +9056,8 @@ module Rigor
       # ({#record_closure_escape_if_any}) and a lambda literal ({#eval_lambda}) — so they cannot drift.
       def escaping_closure_captures(closure_node, post_scope, foreign_self: false)
         widen_escaping_content_captures(closure_node,
-                                        drop_captured_narrowing(closure_node, post_scope, foreign_self: foreign_self))
+                                        drop_captured_narrowing(closure_node, post_scope, foreign_self: foreign_self),
+                                        foreign_self: foreign_self)
       end
 
       # Issue #1402 — whether `call_node`'s block runs on an object that is provably not `self`
@@ -8439,6 +9067,30 @@ module Rigor
         InterveningIvarReset.foreign_self_block?(call_node, operand_scope)
       end
 
+      # The scope a block body's `self` marks start from: the statement form's opaque `self` (issue #316), or the
+      # walk's unknown-`self` mark alone (issue #1717) for the value-position block {#evaluate_block_of} enters and for
+      # every block entered beneath it. A scope carrying the unknown-`self` mark without the opaque one comes only from
+      # the index walk ({Scope#with_block_self_unknown}), so it is how a nested block knows it sits under one: the
+      # opaque mark, which declines a cross-file top-level `def`, stays off the whole value-position subtree.
+      #
+      # Issue #2861 — a block whose call provably runs it under the caller's `self` ({SelfPreservingBlock}:
+      # `rows.map { … }`) enters with no opaque mark the caller's scope does not already carry
+      # ({Scope#entering_self_preserving_block}).
+      def block_self_entry(block_node, call_node = nil)
+        walked = block_node.equal?(@value_position_block) || scope.walked_block_self_unknown?
+        return scope.with_block_self_unknown(true) if walked
+        return scope.entering_self_preserving_block if self_preserving_block?(call_node)
+
+        scope.entering_opaque_block
+      end
+
+      def self_preserving_block?(call_node)
+        return false if call_node.nil? || call_node.receiver.nil?
+
+        SelfPreservingBlock.call?(call_node, explicit_receiver_type(call_node), scope,
+                                  classification: classify_closure_escape(call_node))
+      end
+
       # Builds the entry scope for a block body. The block sees the outer scope's locals (Ruby's lexical scoping rule)
       # and adds bindings for every named block parameter on top. Parameter types come from the receiving method's RBS
       # signature when one is available; the rest default to `Dynamic[Top]`.
@@ -8453,7 +9105,8 @@ module Rigor
         # yielding method, not the lexical context, decides what `self` is, and Rigor does not track it.
         # Issue #1358 — a body that may run a match reads the match globals an earlier iteration may have rebound
         # ({MatchRebinding.block_entry}).
-        entry = MatchRebinding.block_entry(scope.entering_opaque_block, block_node, call_node)
+        entry = MatchRebinding.block_entry(block_self_entry(block_node, call_node), block_node, call_node)
+        entry = entry.entering_block_without_gradual_marks(block_node)
         scope_with_params = BlockParameterBinder.new(expected_param_types: expected).bind_onto(block_node, entry)
         # ADR-16 Tier A — a plugin `block_as_methods:` entry that matches `(receiver, name)` narrows the
         # body's `self` to the object the DSL `instance_eval`s the block on (`params` on
@@ -8589,7 +9242,8 @@ module Rigor
           # def's contract; it binds its parameters as an undeclared method does.
           class_path: @class_context.last&.refinement ? nil : current_class_path,
           singleton: singleton,
-          source_path: scope.source_path
+          source_path: scope.source_path,
+          scope: scope
         )
         bindings = binder.bind(def_node)
         # ADR-67 WD3 — override an undeclared parameter with its call-site inferred type (precision-additive; an
@@ -8674,7 +9328,7 @@ module Rigor
       # True for the `Dynamic[Top]` carrier `MethodParameterBinder` leaves on an undeclared parameter — the only
       # bindings ADR-67 WD3 overrides.
       def untyped_binding?(type)
-        type.is_a?(Type::Dynamic) && type.static_facet.is_a?(Type::Top)
+        Type::Combinator.untyped?(type)
       end
 
       def seed_instance_ivars(body_scope, singleton:)
@@ -8886,8 +9540,13 @@ module Rigor
       # nested body, so this handler only ever appends a return that genuinely exits the method currently being
       # inferred.
       def eval_return(node)
-        sink = Thread.current[RETURN_SINK_KEY]
-        sink&.record(node, jump_value_type(node))
+        state = typing_state
+        sink = state[RETURN_SINK]
+        if sink
+          type = jump_value_type(node)
+          state.touch(RETURN_SINK)
+          sink.record(node, type, state[PROVISIONAL_RETURNS])
+        end
         [Type::Combinator.bot, scope]
       end
 
@@ -8901,8 +9560,13 @@ module Rigor
       # dead arm), so the join is flow-sensitive for free: `[1, 2].map { |x| next nil if x.nil?; x.to_s }` keeps its
       # exact per-element answer.
       def eval_next(node)
-        sink = Thread.current[NEXT_SINK_KEY]
-        sink << [node, jump_value_type(node)] if sink
+        state = typing_state
+        sink = state[NEXT_SINK]
+        if sink
+          type = jump_value_type(node)
+          state.touch(NEXT_SINK)
+          sink << [node, type]
+        end
         @next_scope_sink << [node, jump_scope(node)] if @next_scope_sink
         [Type::Combinator.bot, scope]
       end
@@ -8928,10 +9592,19 @@ module Rigor
       # break-value sink for `ExpressionTyper#call_dispatch_type_for` to union in. Both sinks are optional and
       # independent — a loop body collects scopes while an enclosing call collects values from the same walk.
       def eval_break(node)
-        sink = Thread.current[BREAK_SINK_KEY]
-        sink << [node, jump_scope(node)] if sink
-        value_sink = Thread.current[BREAK_VALUE_SINK_KEY]
-        value_sink << [node, jump_value_type(node)] if value_sink
+        state = typing_state
+        sink = state[BREAK_SINK]
+        if sink
+          jump = jump_scope(node)
+          state.touch(BREAK_SINK)
+          sink << [node, jump]
+        end
+        value_sink = state[BREAK_VALUE_SINK]
+        if value_sink
+          type = jump_value_type(node)
+          state.touch(BREAK_VALUE_SINK)
+          value_sink << [node, type]
+        end
         [Type::Combinator.bot, scope]
       end
 
@@ -9037,6 +9710,39 @@ module Rigor
           branch_type.is_a?(Type::Bot)
       end
 
+      # Issue #1230 — a strict, syntactic-only exit test for the then-exits-beside-an-else arm ({#if_join}). The
+      # branch's last statement is a `return` / `next` / `break`; a receiver-less `raise` / `fail` /
+      # `exit` / `exit!` / `abort` / `throw` whose name no project file defines on any class or module, at the top level
+      # or by `define_method` ({Scope#project_method_name?}); or an if / unless / case with an else whose every arm
+      # certainly exits. A `redo` / `retry` does not: it re-runs a loop body or a `begin` that reads the branch's
+      # writes. Unlike {#branch_terminates?} it reads no type, so a `bot`-typed helper call does not qualify:
+      # the typer types a call to an overridable or Kernel-shadowing project method `bot` (issue #3110).
+      def branch_certainly_exits?(node)
+        case node
+        when Prism::ReturnNode, Prism::NextNode, Prism::BreakNode then true
+        when Prism::CallNode then certain_exit_call?(node)
+        when Prism::StatementsNode then branch_certainly_exits?(node.body.last)
+        when Prism::ParenthesesNode then branch_certainly_exits?(node.body)
+        when Prism::ElseNode then branch_certainly_exits?(node.statements)
+        when Prism::IfNode, Prism::UnlessNode
+          branch_certainly_exits?(node.statements) && branch_certainly_exits?(node_else_branch(node))
+        when Prism::CaseNode, Prism::CaseMatchNode then case_certainly_exits?(node)
+        else false
+        end
+      end
+
+      def certain_exit_call?(node)
+        node.receiver.nil? && CERTAIN_EXIT_NAMES.include?(node.name) && !scope.project_method_name?(node.name)
+      end
+
+      def case_certainly_exits?(node)
+        !node.else_clause.nil? && branch_certainly_exits?(node.else_clause) &&
+          node.conditions.all? { |arm| branch_certainly_exits?(arm.statements) }
+      end
+
+      CERTAIN_EXIT_NAMES = %i[raise fail exit exit! abort throw].freeze
+      private_constant :CERTAIN_EXIT_NAMES
+
       def eval_branch_or_nil(branch_node, branch_scope, on_enter: @on_enter)
         return [Type::Combinator.constant_of(nil), branch_scope] if branch_node.nil?
 
@@ -9089,6 +9795,8 @@ module Rigor
           scope.with_ivar(ref.name, exception_type).without_ivar_guard(ref.name)
         when Prism::GlobalVariableTargetNode
           scope.with_global(ref.name, exception_type)
+        when Prism::ClassVariableTargetNode
+          scope.with_cvar(ref.name, exception_type)
         when Prism::IndexTargetNode
           widen_index_target(ref, exception_type, scope, type_scope: scope)
         else
@@ -9096,20 +9804,11 @@ module Rigor
         end
       end
 
-      # Derives the exception instance type for a `RescueNode`. When the exceptions list is empty (bare `rescue`) the
-      # type is `StandardError`. When one or more exception classes are named the types are unioned. A class that
-      # cannot be resolved to a `Singleton` type contributes `Dynamic[top]`.
+      # Derives the exception instance type for a `RescueNode` ({ErrorInfo.rescue_exception_type}): `StandardError` for
+      # a bare `rescue`, else the union of the named classes' instances, with `Dynamic[top]` for one that does not
+      # resolve to a `Singleton`.
       def rescue_exception_type(rescue_node, scope)
-        exceptions = rescue_node.exceptions
-        if exceptions.empty?
-          Type::Combinator.nominal_of("StandardError")
-        else
-          types = exceptions.map do |exc_node|
-            singleton_type, = sub_eval(exc_node, scope)
-            singleton_to_nominal(singleton_type)
-          end
-          Type::Combinator.union(*types)
-        end
+        ErrorInfo.rescue_exception_type(rescue_node) { |exception_node| sub_eval(exception_node, scope).first }
       end
 
       # --------------------------------------------------------------- `case/in` pattern variable binding helpers
@@ -9121,7 +9820,27 @@ module Rigor
       # `deconstruct` / `deconstruct_keys` dispatch reads for its freshness gate.
       def apply_in_pattern_bindings(subject_type, subject_node, pattern, scope)
         bindings = collect_in_pattern_bindings(subject_type, pattern, scope, subject_node: subject_node)
-        bindings.reduce(scope) { |s, (name, type)| s.with_local(name, type) }
+        bound = bindings.reduce(scope) { |s, (name, type)| s.with_local(name, type) }
+        marked = subject_node.is_a?(Prism::LocalVariableReadNode) && scope.gradual_narrowing?(subject_node.name)
+        mark_gradual_class_capture(subject_type, pattern, bound, marked: marked)
+      end
+
+      # Issue #2656 — `in C => y` over a `Dynamic` subject binds `y` to `C`'s `Nominal`, as a class guard's edge binds
+      # the subject, and marks it as that edge marks a local ({Narrowing.mark_gradual_local}). Only a capture of
+      # the whole subject by a class or an alternation of classes is marked.
+      def mark_gradual_class_capture(subject_type, pattern, scope, marked: false)
+        return scope unless pattern.is_a?(Prism::CapturePatternNode) && class_capture_value?(pattern.value)
+
+        name = pattern.target.name
+        Narrowing.mark_gradual_local(scope, name, subject_type, scope.local(name), marked: marked)
+      end
+
+      def class_capture_value?(value)
+        case value
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then true
+        when Prism::AlternationPatternNode then class_capture_value?(value.left) && class_capture_value?(value.right)
+        else false
+        end
       end
 
       # Returns an array of `[Symbol, Rigor::Type]` pairs for every variable captured by `pattern`, typed against the
@@ -9501,7 +10220,8 @@ module Rigor
         floor = Type::Combinator.untyped
         walks.first.map do |name, _type|
           types = walks.map { |walk| walk.assoc(name)&.last }
-          [name, types.any? { |type| type.nil? || type == floor } ? floor : Type::Combinator.union(*types)]
+          floored = types.any? { |type| type.nil? || Type::Combinator.untyped?(type) }
+          [name, floored ? floor : Type::Combinator.union(*types)]
         end
       end