rigortype 0.3.6 → 0.3.7

data/lib/rigor/inference/scope_indexer.rb

@@ -9,6 +9,7 @@ require_relative "../source/node_children"
 require_relative "../cache/file_digest"
 require_relative "anonymous_meta_class"
 require_relative "def_handle"
+require_relative "index_write_widening"
 require_relative "mutation_widening"
 require_relative "narrowing"
 require_relative "statement_evaluator"
@@ -37,8 +38,14 @@ module Rigor
     # Nodes that are not part of the program subtree (e.g. synthesised virtual nodes that the caller looks up after the
     # fact) yield the `default_scope`. The returned Hash is mutable in principle but callers MUST treat it as read-only;
     # the indexer itself never exposes a way to update it past construction.
-    # rubocop:disable Metrics/ModuleLength
+    # rubocop:disable-next Metrics/ModuleLength
     module ScopeIndexer
+      # Issue #644 — the census descriptor for a constant write that publishes no value: an unfoldable or
+      # non-literal rvalue, an operator / multi-assign / dynamic-path form, or a name this file writes twice.
+      # A Symbol, so it is distinguishable from a `[literal]` descriptor by class alone and rides the ADR-85
+      # seed bundle through `Marshal` unchanged.
+      CONSTANT_UNPUBLISHABLE = :unpublishable
+
       module_function
 
       # Build the scope index for a Prism program subtree.
@@ -78,7 +85,14 @@ module Rigor
         # Slice 7 phase 6. Same pre-pass shape for cvars (per class) and globals (program-wide). Globals are also
         # materialised into the top-level scope's `globals` map so reads at the top level (and in CLI probes that do not
         # enter a method body) observe the precise type without consulting the accumulator on every lookup.
-        class_cvars = build_class_cvar_index(root, seeded_scope)
+        # Issue #540 — a literal-shape carrier assigned to a constant or class variable is only as good as
+        # the file's OWN mutations of it: `ISPELL_STATUS = {}` with a sibling method writing
+        # `ISPELL_STATUS[:key] = param` must not fold reads through the closed empty shape. One census walk
+        # collects the mutated names; the two accumulators below widen their entries to the Dynamic-wrapped
+        # form so reads stay honest without licensing the negative rules.
+        literal_mutations = collect_literal_receiver_mutations(root)
+
+        class_cvars = widen_mutated_cvars(build_class_cvar_index(root, seeded_scope), literal_mutations[:cvars])
         seeded_scope = seeded_scope.with_discovery(seeded_scope.discovery.with(class_cvars: class_cvars))
         program_globals = build_program_global_index(root, seeded_scope)
         seeded_scope = seeded_scope.with_discovery(seeded_scope.discovery.with(program_globals: program_globals))
@@ -92,9 +106,10 @@ module Rigor
         # `pre_eval:` constant seed `Runner#project_scope_seed_tables` applies). Same-file declarations are the
         # most specific authority, exactly as `merged_classes` above resolves the same collision. Without the
         # merge, the assignment below would silently drop the project seed on every file.
-        in_source_constants = build_in_source_constants(root, seeded_scope)
-        merged_constants = merge_seeded_constants(default_scope.in_source_constants, in_source_constants)
-        seeded_scope = seeded_scope.with_discovery(seeded_scope.discovery.with(in_source_constants: merged_constants))
+        in_source_constants = widen_mutated_constants(
+          build_in_source_constants(root, seeded_scope), literal_mutations[:constants]
+        )
+        seeded_scope = seed_constant_tables(seeded_scope, default_scope, in_source_constants, root)
 
         # Slice 7 phase 12. In-source method discovery. Walks every class/module body for `Prism::DefNode` and
         # recognised `define_method` calls and records the introduced method names. `rigor check` consults the table to
@@ -158,15 +173,11 @@ module Rigor
       # is merged UNDER the cross-file `discovered_def_index_for_paths` seed carried on `default_scope` — same-file
       # declarations win per entry, the cross-file seed supplies sibling-file ancestors.
       def merge_project_method_indexes(seeded_scope, default_scope, root, file_def_nodes)
-        def_nodes = default_scope.discovered_def_nodes.merge(
-          file_def_nodes
-        ) { |_class, cross_file, per_file| cross_file.merge(per_file) }
+        def_nodes, def_nestings = merge_def_node_tables(default_scope, root, file_def_nodes)
         singleton_def_nodes = default_scope.discovered_singleton_def_nodes.merge(
           build_discovered_singleton_def_nodes(root)
         ) { |_class, cross_file, per_file| cross_file.merge(per_file) }
-        superclasses = default_scope.discovered_superclasses.merge(
-          build_discovered_superclasses(root, default_scope.source_path)
-        )
+        superclasses, header_nestings = merge_ancestry_tables(default_scope, root)
         includes = default_scope.discovered_includes.merge(
           build_discovered_includes(root)
         ) { |_class, cross_file, per_file| (cross_file + per_file).uniq }
@@ -179,11 +190,19 @@ module Rigor
         # authoritative).
         data_member_layouts, struct_member_layouts = merge_member_layouts(default_scope, root)
 
+        # #526 — this file's extends folded against the MERGED instance def-nodes (so `extend M` sees a
+        # sibling-file M through the cross-file seed). The project-wide fold in {#finalize_def_index}
+        # covers cross-file CONSUMERS; this covers the file that declares the extend.
+        methods_table = fold_per_file_extends(root, def_nodes, singleton_def_nodes, seeded_scope)
+
         seeded_scope.with_discovery(
           seeded_scope.discovery.with(
+            discovered_methods: methods_table,
             discovered_def_nodes: def_nodes,
+            discovered_def_nestings: def_nestings,
             discovered_singleton_def_nodes: singleton_def_nodes,
             discovered_superclasses: superclasses,
+            discovered_header_nestings: header_nestings,
             discovered_includes: includes,
             discovered_method_visibilities: method_visibilities,
             data_member_layouts: data_member_layouts,
@@ -192,6 +211,54 @@ module Rigor
         )
       end
 
+      # The as-written superclass table and its issue #682 header-nesting twin, each merged over the cross-file
+      # seed. Returned as a pair for the same reason {#merge_def_node_tables} is: both come from ONE walk of the
+      # file, so a caller cannot pair a superclass name with a nesting recorded by a different parse.
+      def merge_ancestry_tables(default_scope, root)
+        file_superclasses, file_header_nestings = build_superclass_tables(root, default_scope.source_path)
+        [default_scope.discovered_superclasses.merge(file_superclasses),
+         merge_header_nestings(default_scope.discovery.discovered_header_nestings.dup,
+                               file_header_nestings).freeze]
+      end
+
+      # The instance-side def-node table and its issue #681 nesting twin, each merged over the cross-file seed.
+      # Returned as a pair so the two stay written together: a node the merge keeps must be the same object the
+      # nesting table keys, and they are only that if both halves take the same file's walk.
+      def merge_def_node_tables(default_scope, root, file_def_nodes)
+        def_nodes = default_scope.discovered_def_nodes.merge(
+          file_def_nodes
+        ) { |_class, cross_file, per_file| cross_file.merge(per_file) }
+        [def_nodes,
+         merge_def_nestings(default_scope.discovery.discovered_def_nestings, build_def_nestings(root))]
+      end
+
+      # Issue #681 — the per-file nesting table over the cross-file seed. Both are keyed by node identity, so
+      # a same-file declaration and its cross-file twin are distinct keys and the merge order is immaterial;
+      # the copy exists only so the seed stays frozen. Skipped when the file declares no `def` at all — since
+      # issue #716 a top-level `def` records its empty chain, so a file of plain top-level helpers no longer
+      # takes that path and pays one copy of the seed, the same as any file that declares a method.
+      def merge_def_nestings(seed, file_nestings)
+        return seed if file_nestings.empty?
+        return file_nestings if seed.empty?
+
+        merged = {}.compare_by_identity
+        merged.merge!(seed)
+        merged.merge!(file_nestings)
+        merged.freeze
+      end
+
+      # The per-file half of the #526 fold: mutable copies of the merged tables take the extends, and the
+      # existence table (already seeded onto the scope) is rebuilt only when the fold touched it.
+      def fold_per_file_extends(root, def_nodes, singleton_def_nodes, seeded_scope)
+        extends = build_discovered_extends(root)
+        methods_table = seeded_scope.discovered_methods
+        return methods_table if extends.empty?
+
+        mutable_methods = methods_table.transform_values(&:dup)
+        fold_extends_into_singleton_tables(extends, def_nodes, singleton_def_nodes, mutable_methods)
+        mutable_methods
+      end
+
       # ADR-48 — the per-file Data + Struct member-layout tables, each merged OVER the cross-file seed so a same-file
       # declaration wins for its own classes. Returned as a pair to keep {#merge_project_method_indexes} under the
       # method-size budget.
@@ -220,6 +287,7 @@ module Rigor
         method_assign_effects = build_method_assign_effects(root)
         walk_class_ivars(root, [], default_scope, accumulator, mutated_ivars,
                          read_before_write, init_writes, method_assign_effects)
+        record_aliased_ivar_mutations!(root, mutated_ivars)
         widen_mutated_ivar_entries!(accumulator, mutated_ivars)
         contribute_read_before_write_nil!(accumulator, read_before_write, init_writes)
         accumulator.transform_values(&:freeze).freeze
@@ -261,6 +329,119 @@ module Rigor
         end
       end
 
+      # An ivar a method RETURNS leaves the object, and every mutation of the returned reference mutates the ivar:
+      # `(bucket_for(entry)[key] ||= {})[name] = row` fills whichever of `@self_rows` / `@path_rows` / `@result_rows`
+      # `bucket_for` handed back. {record_ivar_mutator_call} cannot see it — the mutation's receiver is a `CallNode`,
+      # not an `InstanceVariableReadNode` — so those ivars kept the empty `HashShape` their `initialize` gave them and
+      # `@path_rows.empty?` folded to `Constant[true]` on a hash the class fills. Rigor's own
+      # `lib/rigor/effects/plugin_facts.rb` is the worked site.
+      #
+      # Scope is deliberately narrow: the mutation receiver must be a SELF-call (an explicit receiver is a different
+      # object), the callee must be an instance method of the same class, and only ivars in the callee's RETURN
+      # position count — an ivar merely read in its body (`@rows[owner]` returns the value, not the hash) does not
+      # escape. Over-recording here would widen a shape carrier that nothing mutates, which costs precision on every
+      # reader in the class.
+      #
+      # Runs after the main walk so the returned-ivar summary is complete regardless of definition order, and gated on
+      # a class actually having a returning method — the common class contributes nothing and pays one `defs` lookup.
+      def record_aliased_ivar_mutations!(root, mutated_ivars)
+        defs = collect_class_method_defs(root)
+        returned = returned_ivars_by_method(defs)
+        return if returned.empty?
+
+        defs.each do |class_name, methods|
+          per_class = returned[class_name]
+          next if per_class.nil?
+
+          methods.each_value do |def_node|
+            gather_aliased_mutations(def_node.body, class_name, per_class, mutated_ivars)
+          end
+        end
+      end
+
+      # `{class_name => {method_name => Set<ivar name>}}` for methods that hand an ivar back, dropping the empty sets
+      # so the caller's `next if per_class.nil?` skips a whole class in one lookup.
+      def returned_ivars_by_method(defs)
+        defs.each_with_object({}) do |(class_name, methods), acc|
+          methods.each do |method_name, def_node|
+            ivars = returned_ivars(def_node)
+            (acc[class_name] ||= {})[method_name] = ivars unless ivars.empty?
+          end
+        end
+      end
+
+      # The ivars `def_node` can hand back: an explicit `return @x` anywhere in the body, and the body's tail
+      # expression when it is (or resolves through branch nodes to) a bare ivar read. A tail that computes something
+      # FROM an ivar (`@rows[k]`, `@rows.dup`) hands back a different object and is not an escape.
+      def returned_ivars(def_node)
+        body = def_node.body
+        return EMPTY_IVAR_SET if body.nil?
+
+        found = Set.new
+        collect_explicit_return_ivars(body, found)
+        tail_value_nodes(body).each { |node| found << node.name if node.is_a?(Prism::InstanceVariableReadNode) }
+        found
+      end
+
+      def collect_explicit_return_ivars(node, found)
+        return unless node.is_a?(Prism::Node)
+        return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
+
+        if node.is_a?(Prism::ReturnNode)
+          args = node.arguments&.arguments
+          found << args.first.name if args && args.size == 1 && args.first.is_a?(Prism::InstanceVariableReadNode)
+        end
+
+        node.rigor_each_child { |c| collect_explicit_return_ivars(c, found) }
+      end
+
+      # The expressions a body can evaluate to, resolving through the branch nodes whose value is a sub-expression.
+      # Depth-capped for the same reason every other walk here is: a pathologically nested tail is not worth unbounded
+      # recursion, and stopping early only under-collects (fewer escapes recorded, never more).
+      def tail_value_nodes(node, depth = 0)
+        return [] unless node.is_a?(Prism::Node)
+        return [] if depth >= TAIL_VALUE_DEPTH_CAP
+
+        children = tail_value_children(node)
+        return [node] if children.nil?
+
+        children.flat_map { |child| tail_value_nodes(child, depth + 1) }
+      end
+
+      # The children a node's own value comes from, or nil when the node IS the value. Split out from
+      # {tail_value_nodes} so the recursion stays one line and this stays a lookup table.
+      def tail_value_children(node)
+        case node
+        when Prism::StatementsNode then [node.body.last]
+        when Prism::ParenthesesNode then [node.body]
+        when Prism::BeginNode, Prism::ElseNode, Prism::WhenNode, Prism::InNode then [node.statements]
+        when Prism::IfNode then [node.statements, node.subsequent]
+        when Prism::UnlessNode then [node.statements, node.else_clause]
+        when Prism::CaseNode then node.conditions + [node.else_clause]
+        when Prism::OrNode, Prism::AndNode then [node.left, node.right]
+        end
+      end
+
+      # Records every mutation in `node` whose receiver is a self-call to one of `per_class`'s returning methods.
+      def gather_aliased_mutations(node, class_name, per_class, mutated_ivars)
+        return unless node.is_a?(Prism::Node)
+
+        mutator, receiver = mutation_target(node)
+        escaped_ivars_for_receiver(receiver, per_class)&.each do |ivar_name|
+          per_ivar = ((mutated_ivars[class_name] ||= {})[ivar_name] ||= Set.new)
+          per_ivar << mutator
+        end
+
+        node.rigor_each_child { |c| gather_aliased_mutations(c, class_name, per_class, mutated_ivars) }
+      end
+
+      # The ivars a mutation receiver can be, when the receiver is a same-class self-call. Nil for every other shape.
+      def escaped_ivars_for_receiver(receiver, per_class)
+        return nil unless receiver.is_a?(Prism::CallNode) && receiver.receiver.nil?
+
+        per_class[receiver.name]
+      end
+
       # Walks the post-collected accumulator and widens any Tuple / HashShape entry for an ivar that observed a mutator
       # call anywhere in the same class body. The mutation evidence comes from `gather_ivar_writes` recording every
       # `@ivar.<method>(...)` call whose method is in `MutationWidening::ARRAY_MUTATORS` or `HASH_MUTATORS`.
@@ -317,15 +498,64 @@ module Rigor
         end
       end
 
+      # Issue #681 — the scope a census pre-pass types an rvalue under. The census walks never enter a body
+      # through `StatementEvaluator`, so nothing stamped the declaration's `Module.nesting` on the scope they
+      # build and `Reflection.lexical_nesting_chain` fell back to peeling `self_type`'s qualified name. That
+      # peel cannot tell a compact `class Admin::Census` (nesting `[Admin::Census]`, so a bare `Post` names
+      # `::Post`) from the nested spelling (nesting `[Admin::Census, Admin]`, where it names `Admin::Post`),
+      # so `@post = Post.new` and `DEFAULT = Post` were recorded under the wrong class and every later read
+      # answered it. The prefix these walks already thread IS the chain — `["Admin::Census"]` for the compact
+      # form, `["Admin", "Census"]` for the nested one — so the fact was in hand and only the stamp was
+      # missing.
+      def census_body_scope(default_scope, qualified_prefix, self_type)
+        default_scope.with_self_type(self_type)
+                     .with_lexical_nesting(census_nesting(default_scope, qualified_prefix))
+      end
+
+      # The chain a census walk answers `Module.nesting` with: the one {#scope_entering_declaration} threaded
+      # on the scope when a header was entered, and only failing that the prefix-derived approximation below.
+      def census_nesting(scope, qualified_prefix)
+        scope&.lexical_nesting || lexical_nesting_for_prefix(qualified_prefix)
+      end
+
+      # The scope a census walk threads into the body a `class` / `module` header opens: the scope it already
+      # threads, carrying that body's real `Module.nesting`.
+      #
+      # Issue #708 — the qualified prefix stopped being sufficient to DERIVE that chain. A rooted header
+      # RESETS the prefix (`class ::Rooted` inside `module Outer` prefixes `["Rooted"]`), so `Outer` is absent
+      # from it entirely and no function of the prefix alone recovers it, while Ruby keeps `Outer` on the
+      # ladder as a live rung. `Source::ConstantPath.pushed_nesting` — the one function both declaration walks
+      # already push with — has that case right, so the chain travels on the scope these walks thread anyway
+      # rather than through every walk's parameter list, and stays a single owner ([#652](https://github.com/rigortype/rigor/issues/652)).
+      def scope_entering_declaration(default_scope, constant_path)
+        return default_scope if default_scope.nil?
+
+        chain = Source::ConstantPath.pushed_nesting(default_scope.lexical_nesting || EMPTY_NESTING,
+                                                    constant_path)
+        chain ? default_scope.with_lexical_nesting(chain) : default_scope
+      end
+
+      # Ruby's `Module.nesting` for a body enclosed by `qualified_prefix`, innermost first: each entry is the
+      # prefix truncated at one declaration, joined, so the compact spelling contributes exactly one entry and
+      # the nested spelling one per `class` / `module` keyword.
+      #
+      # **This is an approximation, and only correct when no ROOTED header encloses the body** — a rooted
+      # header resets the prefix without resetting Ruby's nesting, so the entries beneath the reset are not
+      # in the prefix to be truncated out of it (#708). It remains the answer for a caller that threaded no
+      # chain, where it is what the code did before and never a new firing; the walks that reach a body
+      # thread the real chain via {#scope_entering_declaration}.
+      def lexical_nesting_for_prefix(qualified_prefix)
+        (1..qualified_prefix.size).map { |n| qualified_prefix.first(n).join("::") }.reverse.freeze
+      end
+
       def walk_class_ivars(node, qualified_prefix, default_scope, accumulator, mutated_ivars, # rubocop:disable Metrics/ParameterLists
                            read_before_write = nil, init_writes = nil, method_assign_effects = nil)
         return unless node.is_a?(Prism::Node)
 
         case node
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            child_prefix = qualified_prefix + [name]
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
             if node.body
               # Class-body level `@x = nil` writes don't initialise instance ivars at runtime (the class's own singleton
               # ivars and the instance's ivars are separate stores), but they signal "the author KNOWS @x could be nil"
@@ -335,7 +565,8 @@ module Rigor
               # class-body level then writes `@x = SomeClass.new` inside an instance method gains an unjustified nil
               # widening at every read.
               collect_class_body_ivar_writes(node.body, child_prefix.join("::"), init_writes) if init_writes
-              walk_class_ivars(node.body, child_prefix, default_scope, accumulator,
+              walk_class_ivars(node.body, child_prefix,
+                               scope_entering_declaration(default_scope, node.constant_path), accumulator,
                                mutated_ivars, read_before_write, init_writes, method_assign_effects)
             end
             return
@@ -372,7 +603,7 @@ module Rigor
           else
             Type::Combinator.nominal_of(class_name)
           end
-        body_scope = default_scope.with_self_type(self_type)
+        body_scope = census_body_scope(default_scope, qualified_prefix, self_type)
 
         # C2 — transient `@x = nil` dead-write elimination. When a method body opens with an unconditional `@x = nil`
         # (defensive init) and then *definitely* reassigns `@x` to a non-nil value on every completing path (a later
@@ -404,7 +635,7 @@ module Rigor
 
         class_name = qualified_prefix.join("::")
         self_type = Type::Combinator.nominal_of(class_name)
-        body_scope = default_scope.with_self_type(self_type)
+        body_scope = census_body_scope(default_scope, qualified_prefix, self_type)
 
         gather_ivar_writes(block_node.body, body_scope, class_name, accumulator,
                            EMPTY_GUARDED_IVARS, mutated_ivars)
@@ -576,6 +807,14 @@ module Rigor
       private_constant :IVAR_BARRIER_NODES
 
       EMPTY_GUARDED_IVARS = Set.new.freeze
+
+      # Shared empty result for a def that returns no ivar — the overwhelmingly common case.
+      EMPTY_IVAR_SET = Set.new.freeze
+      private_constant :EMPTY_IVAR_SET
+
+      # Branch nesting a tail expression is followed through. Stopping early only UNDER-collects escapes.
+      TAIL_VALUE_DEPTH_CAP = 8
+      private_constant :TAIL_VALUE_DEPTH_CAP
       private_constant :EMPTY_GUARDED_IVARS
 
       def gather_ivar_writes(node, scope, class_name, accumulator, guarded_ivars = EMPTY_GUARDED_IVARS,
@@ -597,7 +836,7 @@ module Rigor
         # records — an unanalyzable multi-write means unknown, not nil).
         record_multi_write_ivars(node, scope, class_name, accumulator)
 
-        record_ivar_mutator_call(node, class_name, mutated_ivars) if mutated_ivars && node.is_a?(Prism::CallNode)
+        record_ivar_mutator_call(node, class_name, mutated_ivars) if mutated_ivars
 
         # Don't recurse into nested defs, classes, or modules; their ivars belong to their own enclosing class.
         return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
@@ -618,14 +857,33 @@ module Rigor
       # {.widen_mutated_ivar_entries!}). Always-safe to over- collect: any name that the widening primitive declines is
       # ignored at finalization.
       def record_ivar_mutator_call(node, class_name, mutated_ivars)
-        receiver = node.receiver
+        method_name, receiver = mutation_target(node)
+        return if method_name.nil?
         return unless receiver.is_a?(Prism::InstanceVariableReadNode)
-        return unless MutationWidening::ARRAY_MUTATORS.include?(node.name) ||
-                      MutationWidening::HASH_MUTATORS.include?(node.name)
+        return unless MutationWidening::ARRAY_MUTATORS.include?(method_name) ||
+                      MutationWidening::HASH_MUTATORS.include?(method_name)
 
         per_class = (mutated_ivars[class_name] ||= {})
         per_ivar = (per_class[receiver.name] ||= Set.new)
-        per_ivar << node.name
+        per_ivar << method_name
+      end
+
+      # `[mutator name, receiver node]` for a node that mutates its receiver, `nil` otherwise.
+      #
+      # `@h[k] ||= v` and its `&&=` / `+=` siblings store through `[]=` but are not `[]=` CallNodes; missing them left
+      # an `@h = {}` mutated only that way carrying its empty `HashShape` into every sibling method, so `@h.empty?`
+      # folded to `Constant[true]` on a hash the class fills. `IndexWriteWidening::NODE_CLASSES` owns that list; it is
+      # spelled out here as an explicit disjunction because that is what narrows `node` to something with a
+      # `#receiver` — `NODE_CLASSES.any? { … }` reads as a call on `Prism::Node` and Rigor rejects it, correctly.
+      def mutation_target(node)
+        return [node.name, node.receiver] if node.is_a?(Prism::CallNode)
+
+        if node.is_a?(Prism::IndexOrWriteNode) || node.is_a?(Prism::IndexAndWriteNode) ||
+           node.is_a?(Prism::IndexOperatorWriteNode)
+          return [IndexWriteWidening::MUTATOR, node.receiver]
+        end
+
+        nil
       end
 
       # Walk an `IfNode` / `UnlessNode` so writes inside the THEN body that look like defensive ivar initialisation gain
@@ -771,11 +1029,8 @@ module Rigor
 
         case root
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(root.constant_path)
-          if name && root.body
-            child = prefix + [name]
-            collect_class_method_defs(root.body, child, acc)
-          end
+          child = Source::ConstantPath.declaration_prefix(prefix, root.constant_path)
+          collect_class_method_defs(root.body, child, acc) if child && root.body
           return acc
         when Prism::DefNode
           (acc[prefix.join("::")] ||= {})[root.name] = root unless prefix.empty? || root.receiver
@@ -1135,10 +1390,12 @@ module Rigor
 
         case node
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            child_prefix = qualified_prefix + [name]
-            walk_class_cvars(node.body, child_prefix, default_scope, accumulator) if node.body
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            if node.body
+              walk_class_cvars(node.body, child_prefix,
+                               scope_entering_declaration(default_scope, node.constant_path), accumulator)
+            end
             return
           end
         when Prism::DefNode
@@ -1155,7 +1412,8 @@ module Rigor
         return if def_node.body.nil? || qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        body_scope = default_scope.with_self_type(Type::Combinator.nominal_of(class_name))
+        body_scope = census_body_scope(default_scope, qualified_prefix,
+                                       Type::Combinator.nominal_of(class_name))
         gather_cvar_writes(def_node.body, body_scope, class_name, accumulator)
       end
 
@@ -1202,58 +1460,422 @@ module Rigor
       # Slice 7 phase 9 — in-source constant value pre-pass. Walks the entire program (top-level AND inside class /
       # module / def bodies) for `Prism::ConstantWriteNode` and `Prism::ConstantPathWriteNode`, types each rvalue, and
       # accumulates by qualified name. Constants defined inside a class body are qualified with the surrounding class
-      # path; constants written via a path (`Foo::BAR = ...`) use the rendered path as-is.
+      # path; a constant written via a path resolves its own namespace through the enclosing nesting first
+      # ({#constant_path_write_key}) — which is where this walk and the
+      # [#644](https://github.com/rigortype/rigor/issues/644) publication census below stopped agreeing about
+      # a path write's name.
       def build_in_source_constants(root, default_scope)
         accumulator = {}
         walk_constant_writes(root, [], default_scope, accumulator)
         accumulator.freeze
       end
 
+      # Issue #540 — the mutation census behind the two wideners. Walks the whole tree once, tracking the
+      # lexical class/module prefix, and records every node that MUTATES a constant-read or
+      # class-variable-read receiver: the `Index{Or,And,Operator}Write` family, and a CallNode whose name
+      # is a known in-place mutator (`MutationWidening`'s tables) or a plain attribute/index writer
+      # (`name=` / `[]=`). Non-mutating reads never register, so `VERSION`-style constants keep their fold.
+      #
+      # @return [Hash{Symbol => Object}] `:constants` — a Set of candidate qualified names (each mutation
+      #   contributes every lexical-resolution candidate, `A::B::C` outward to bare `C`, mirroring how the
+      #   reads resolve); `:cvars` — `{class_name => Set[Symbol]}`.
+      def collect_literal_receiver_mutations(root)
+        census = { constants: Set.new, cvars: Hash.new { |h, k| h[k] = Set.new } }
+        walk_literal_receiver_mutations(root, [], census, EMPTY_NESTING)
+        census
+      end
+
+      def walk_literal_receiver_mutations(node, qualified_prefix, census, nesting = EMPTY_NESTING)
+        return unless node.is_a?(Prism::Node)
+
+        case node
+        when Prism::ClassNode, Prism::ModuleNode
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            if node.body
+              walk_literal_receiver_mutations(node.body, child_prefix, census,
+                                              Source::ConstantPath.pushed_nesting(nesting,
+                                                                                  node.constant_path) || nesting)
+            end
+            return
+          end
+        else
+          record_literal_receiver_mutation(node, qualified_prefix, nesting, census)
+        end
+
+        node.rigor_each_child { |child| walk_literal_receiver_mutations(child, qualified_prefix, census, nesting) }
+      end
+
+      # Two parameters because the two arms key on two DIFFERENT TABLES, not because the values differ:
+      # `nesting.first` and `qualified_prefix.join("::")` are in fact always equal, since
+      # `.declaration_prefix` and `.pushed_nesting` branch on the same `rooted?` and qualify against the same
+      # parent. `qualified_prefix` is what a class variable must key on because it is the join key with
+      # `build_class_cvar_index`, which derives its own key from the same `declaration_prefix` — so the two
+      # tables agree by construction. `nesting` is what a constant name must resolve through because the
+      # ladder walks every rung, not just the innermost, and a rooted header drops the outer rungs from the
+      # prefix while Ruby keeps them ([#708](https://github.com/rigortype/rigor/issues/708)).
+      def record_literal_receiver_mutation(node, qualified_prefix, nesting, census)
+        receiver = mutating_receiver_of(node)
+        return if receiver.nil?
+
+        case receiver
+        when Prism::ConstantReadNode
+          constant_mutation_candidates(receiver.name.to_s, nesting, census[:constants])
+        when Prism::ConstantPathNode
+          # The lexical candidates a PATH spelling reaches, for the same reason the bare arm above takes
+          # them: `Holder::TABLE[:k] = 1` inside `module Admin` mutates whatever `Holder::TABLE` resolves
+          # to there, and since [#690](https://github.com/rigortype/rigor/issues/690) the write accumulator
+          # keys that entry `Admin::Holder::TABLE`. Recording only the as-written name left the mutated
+          # constant matched by nothing and its closed empty shape intact — the very fold #540 exists to
+          # retract. Over-recording only widens, which is the direction this census is allowed to err in.
+          full = Source::ConstantPath.qualified_name_or_nil(receiver)
+          constant_mutation_candidates(full, nesting, census[:constants]) if full
+        when Prism::ClassVariableReadNode
+          census[:cvars][qualified_prefix.join("::")] << receiver.name unless qualified_prefix.empty?
+        end
+      end
+
+      # The receiver a node mutates, or nil when the node is not a mutation.
+      def mutating_receiver_of(node)
+        case node
+        when Prism::IndexOrWriteNode, Prism::IndexAndWriteNode, Prism::IndexOperatorWriteNode
+          node.receiver
+        when Prism::CallNode
+          return nil if node.receiver.nil?
+          return node.receiver if node.attribute_write?
+          return node.receiver if MutationWidening::ARRAY_MUTATORS.include?(node.name) ||
+                                  MutationWidening::HASH_MUTATORS.include?(node.name)
+
+          nil
+        end
+      end
+
+      # Every lexical-resolution candidate for a bare constant name written at `nesting`, innermost first
+      # — `["A::B", "A"]` + `C` yields `A::B::C`, `A::C`, `C` — so the widener matches whichever form the
+      # write accumulator recorded.
+      #
+      # Issue #708 — this reads Ruby's `Module.nesting`, which the enclosing qualified prefix used to be a
+      # faithful stand-in for. It stopped being one when a rooted header gained the power to RESET that
+      # prefix: a bare `TABLE[:k] = 1` inside `class ::Rooted` in `module Outer` mutates `Outer::TABLE`, and
+      # candidates built from the reset prefix never name it, so the closed shape was never widened and
+      # `Outer::TABLE.empty?` folded to `true` on a table the program fills.
+      def constant_mutation_candidates(base_name, nesting, into)
+        nesting.each { |entry| into << "#{entry}::#{base_name}" }
+        into << base_name
+      end
+
+      def widen_mutated_constants(accumulator, mutated_names)
+        return accumulator if mutated_names.empty?
+
+        widened = accumulator.dup
+        mutated_names.each do |name|
+          existing = widened[name]
+          next if existing.nil? || existing.is_a?(Type::Dynamic)
+
+          widened[name] = Type::Combinator.dynamic(existing)
+        end
+        widened.freeze
+      end
+
+      def widen_mutated_cvars(accumulator, mutated_by_class)
+        return accumulator if mutated_by_class.empty?
+
+        widened = accumulator.dup
+        mutated_by_class.each do |class_name, names|
+          table = widened[class_name]
+          next if table.nil?
+
+          updated = table.dup
+          names.each do |cvar|
+            existing = updated[cvar]
+            next if existing.nil? || existing.is_a?(Type::Dynamic)
+
+            updated[cvar] = Type::Combinator.dynamic(existing)
+          end
+          widened[class_name] = updated.freeze
+        end
+        widened.freeze
+      end
+
       # Issue #352 — folds the project-wide `pre_eval:` constant seed under this file's own table. Returns the
       # per-file table unchanged (same frozen object) when nothing was seeded, so a run without `pre_eval:`
       # constants allocates and compares exactly what it did before.
+      # Issue #644 — merges the per-file constant table OVER the project seed and records, alongside it,
+      # which of those names THIS FILE declares (as last segments). The second table is the other half of
+      # `Scope#published_constant?`: a project-published constant the analysed file also assigns is one its
+      # author can see, so the truthiness rules keep firing on it. Both are seeded here, where the per-file
+      # table is still separable from the project seed it is about to merge over.
+      def seed_constant_tables(seeded_scope, default_scope, in_source_constants, root)
+        merged = merge_seeded_constants(default_scope.in_source_constants, in_source_constants)
+        seeded_scope.with_discovery(
+          seeded_scope.discovery.with(in_source_constants: merged,
+                                      local_constant_names: local_constant_name_set(root, default_scope))
+        )
+      end
+
+      # The QUALIFIED names this file assigns that the project also published, frozen. Read from the same
+      # {#constant_writes_for_file} census the cross-file table is built from, not from the typed per-file
+      # table: the typed walk cannot see a multi-assign / `self::` / operator-write target, so deriving the
+      # exemption from it would be a second source of truth blind to exactly the forms the census exists to
+      # catch. Gated on the project having published anything at all, so a project with no cross-file value
+      # constants pays no extra walk and allocates nothing; the result is filtered to the published names, so
+      # what it holds is bounded by what the exemption can ever be asked about.
+      def local_constant_name_set(root, default_scope)
+        published = default_scope.published_constant_names
+        return Scope::DiscoveryIndex::EMPTY.local_constant_names if published.empty?
+
+        names = constant_writes_for_file(root).keys.select { |name| published.include?(name.split("::").last) }
+        names.empty? ? Scope::DiscoveryIndex::EMPTY.local_constant_names : names.to_set.freeze
+      end
+
       def merge_seeded_constants(seeded, per_file)
         return per_file if seeded.nil? || seeded.empty?
 
         seeded.merge(per_file).freeze
       end
 
-      def walk_constant_writes(node, qualified_prefix, default_scope, accumulator)
+      # Issue #705 — the block-taking calls that swap `self` for the RECEIVER: Ruby evaluates the block with
+      # the receiver as `self` and leaves `Module.nesting` untouched, so `self::BAR = …` inside one names the
+      # receiver's `BAR` while a bare `BAR = …` in the same block still names the enclosing namespace's.
+      SELF_REBINDING_EVAL_CALLS = %i[class_eval module_eval class_exec module_exec].freeze
+      private_constant :SELF_REBINDING_EVAL_CALLS
+
+      # …and the ones whose block `self` this walk cannot name. An `instance_eval` / `instance_exec` body
+      # evaluates on the RECEIVER OBJECT, which is a class or module only when the receiver happens to be one
+      # (`Klass.instance_eval { self::BAR = 1 }` defines `Klass::BAR`; `obj.instance_eval` raises `TypeError`),
+      # and a `define_method` body on the receiver at call time. A syntactic walk cannot tell those apart, so
+      # the write is declined — gradual for the legal case, and no guess for the rest.
+      OPAQUE_SELF_BLOCK_CALLS = %i[instance_eval instance_exec define_method].freeze
+      private_constant :OPAQUE_SELF_BLOCK_CALLS
+
+      # The sentinel for "`self` was rebound to something no class/module name reaches". A `self::BAR = …`
+      # under it is DECLINED — the same answer a dynamic base takes, for the same reason.
+      OPAQUE_SELF = :__rigor_opaque_self__
+      private_constant :OPAQUE_SELF
+
+      # The owner whose constants the census spells BARE — `Object`'s constants are the top-level ones.
+      OBJECT_OWNER = "Object"
+      private_constant :OBJECT_OWNER
+
+      def walk_constant_writes(node, qualified_prefix, default_scope, accumulator, self_owner = nil)
         return unless node.is_a?(Prism::Node)
 
         case node
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            child_prefix = qualified_prefix + [name]
-            walk_constant_writes(node.body, child_prefix, default_scope, accumulator) if node.body
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            if node.body
+              walk_constant_writes(node.body, child_prefix,
+                                   scope_entering_declaration(default_scope, node.constant_path),
+                                   accumulator)
+            end
             return
           end
         when Prism::ConstantWriteNode
-          record_constant_write(node, qualified_prefix, default_scope, accumulator, node.name.to_s)
+          record_constant_write(node, qualified_prefix, default_scope, accumulator,
+                                qualified_write_name(qualified_prefix, node.name.to_s), self_owner)
           return
         when Prism::ConstantPathWriteNode
-          full = Source::ConstantPath.qualified_name(node.target)
-          record_constant_write(node, [], default_scope, accumulator, full) if full
+          full = constant_path_write_key(node.target, qualified_prefix, default_scope, self_owner)
+          record_constant_write(node, qualified_prefix, default_scope, accumulator, full, self_owner) if full
           return
         end
 
+        walk_constant_write_children(node, qualified_prefix, default_scope, accumulator, self_owner)
+      end
+
+      # Recursion into `node`'s children, swapping `self` for the ONE child a self-rebinding call evaluates
+      # under a different receiver — its block. Every other child, and every child of a node that rebinds
+      # nothing, keeps the `self` it was reached under.
+      #
+      # The block is identified by its CLASS rather than by identity against `CallNode#block`. These walks
+      # recurse over every node kind, so `node` here is the whole `Prism::Node` union and reading a member
+      # only a call carries off it is exactly the shape Rigor's own check rejects. The test is equivalent:
+      # `rebound` is non-nil only where {#rebound_block_self} already saw a `Prism::BlockNode` in the `block`
+      # field, and no other child of a call can be one — a receiver is an expression, arguments sit under
+      # `ArgumentsNode`, and a `&blk` pass-through is a `BlockArgumentNode`.
+      def walk_constant_write_children(node, qualified_prefix, default_scope, accumulator, self_owner)
+        rebound = rebound_block_self(node, qualified_prefix, default_scope)
         node.rigor_each_child do |child|
-          walk_constant_writes(child, qualified_prefix, default_scope, accumulator)
+          owner = rebound && child.is_a?(Prism::BlockNode) ? rebound : self_owner
+          walk_constant_writes(child, qualified_prefix, default_scope, accumulator, owner)
         end
       end
 
-      def record_constant_write(node, qualified_prefix, default_scope, accumulator, base_name)
-        full = qualified_prefix.empty? ? base_name : "#{qualified_prefix.join('::')}::#{base_name}"
+      # Issue #705 — the class or module `self` names inside `node`'s BLOCK, or nil when `node` opens no
+      # block that rebinds `self` (an ordinary block keeps the `self` it closed over, so a `self::BAR = …`
+      # there is still the enclosing declaration's and every walk below this stays as it was).
+      #
+      # {OPAQUE_SELF} where the new `self` reaches no class or module name: a `class_eval` receiver that is
+      # not a static constant path, an {OPAQUE_SELF_BLOCK_CALLS} body, and the `Class.new { … }` /
+      # `Module.new` / `Struct.new` / `Data.define` block, whose class is named only by a constant write the
+      # walk would have to thread down to it. Declining there costs a resolution the engine never had; naming
+      # the LEXICAL enclosure instead is the guess that fires, because it is the one name Ruby is guaranteed
+      # NOT to have written.
+      def rebound_block_self(node, qualified_prefix, default_scope = nil)
+        return nil unless node.is_a?(Prism::CallNode) && node.block.is_a?(Prism::BlockNode)
+        return OPAQUE_SELF if OPAQUE_SELF_BLOCK_CALLS.include?(node.name) || meta_new_constant_rvalue?(node)
+        return nil unless SELF_REBINDING_EVAL_CALLS.include?(node.name)
+
+        eval_receiver_self(node.receiver, qualified_prefix, default_scope)
+      end
+
+      # The `self` a `Recv.class_eval { … }` block runs under. An implicit or literal `self` receiver leaves
+      # `self` where it was — nil, so nothing about the walk changes. A static constant path resolves the way
+      # a path write's own namespace resolves ({#resolved_write_namespace}); anything else is opaque. A nil
+      # `default_scope` is the publication census, which has no class knowledge to resolve through and keys a
+      # path AS WRITTEN, so the receiver keeps its spelling there too.
+      def eval_receiver_self(receiver, qualified_prefix, default_scope)
+        return nil if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+        name = Source::ConstantPath.qualified_name_or_nil(receiver)
+        return OPAQUE_SELF if name.nil?
+        return name if default_scope.nil? || qualified_prefix.empty? || Source::ConstantPath.rooted?(receiver)
+
+        resolved_write_namespace(name, qualified_prefix, default_scope)
+      end
+
+      # Issue #690 — `enclosing_prefix` is the lexical declaration prefix the write SITS UNDER, `full` the
+      # qualified name it WRITES. The two coincide for a bare `BAR = …` and diverge for a `Foo::BAR = …`,
+      # which is why they are separate parameters. One parameter served both roles, so the path form had to
+      # pass it EMPTY to keep the caller-supplied name intact — and that lost the key's qualification and the
+      # rvalue's lexical context together, in the same argument.
+      #
+      # Issue #705 — and the rvalue needs BOTH halves of the context separately as well, because a
+      # `class_eval` block moves one and not the other. `Module.nesting` stays lexical, so a bare `Post` in
+      # `Other.class_eval { … }` inside `module Admin` is still `Admin::Post`; `self` becomes the RECEIVER, so
+      # `self` and an implicit-self call in the same block answer on `Other`. Reading the self type off
+      # `enclosing_prefix` typed `self::REF = self` as `singleton(Admin)` and `self::V = build` through
+      # `Admin.build` — wrong on correct code, and reachable at a reader the moment the key stopped being a
+      # guess. `self_owner` is a String exactly when the walk resolved a rebound `self`.
+      def record_constant_write(node, enclosing_prefix, default_scope, accumulator, full, self_owner = nil)
+        owner = self_owner.is_a?(String) ? self_owner : enclosing_prefix.join("::")
         body_scope = default_scope
-        unless qualified_prefix.empty?
-          body_scope = body_scope.with_self_type(Type::Combinator.singleton_of(qualified_prefix.join("::")))
+        unless owner.empty?
+          body_scope = census_body_scope(default_scope, enclosing_prefix, Type::Combinator.singleton_of(owner))
         end
         rvalue_type = meta_new_constant_type(node, full) || body_scope.type_of(node.value)
         existing = accumulator[full]
         accumulator[full] = existing ? Type::Combinator.union(existing, rvalue_type) : rvalue_type
       end
 
+      # The accumulator key for a `Foo::BAR = …`. Ruby resolves the path's NAMESPACE through the nesting at
+      # the write site, so `Holder::DEFAULT = …` inside `module Admin` names `Admin::Holder::DEFAULT`
+      # whenever `Admin::Holder` is a class or module some source declares. Filing the entry under the
+      # as-written spelling put it where no read of the resolved name reaches it: a read spelled
+      # `Admin::Holder::DEFAULT` answered `Dynamic[top]`, and the in-namespace spelling fell past the
+      # qualified rung of the lexical ladder to the bare one, hit the mis-keyed entry, and got a top-level
+      # constant of the same name — `call.undefined-method` on correct code ([#690](https://github.com/rigortype/rigor/issues/690)).
+      #
+      # Two static forms keep the as-written key because their namespace is not the enclosing one: a write at
+      # the top level, and a rooted `::Foo::BAR`, which names the top level by definition. Re-qualifying a
+      # namespace the code does not name would file the entry under a guess.
+      #
+      # A target that renders no static path is NOT a third such form, and must not be handled by rendering
+      # it leniently. `self::BAR = …` names whatever `self` is at that point — the enclosing declaration in
+      # an ordinary body, the receiver inside a `class_eval` block ([#705](https://github.com/rigortype/rigor/issues/705)),
+      # which is why `self_owner` travels with the walk rather than being read off `qualified_prefix`. Any
+      # other dynamic base (`klass::BAR`) is attributable to no namespace at all and is DECLINED:
+      # `qualified_name`'s lenient render drops the dynamic segment and yields the bare trailing name, so
+      # recording it filed a value under a name the write never touched — and once the rvalue is typed under
+      # the enclosing nesting, that bare key outranks an RBS top-level constant declaration and hands every
+      # reader of the top-level name a receiver Ruby never names there.
+      def constant_path_write_key(target, qualified_prefix, default_scope, self_owner = nil)
+        return Source::ConstantPath.qualified_name(target) if Source::ConstantPath.rooted?(target)
+
+        written = Source::ConstantPath.qualified_name_or_nil(target)
+        return dynamic_base_write_key(target, qualified_prefix, self_owner) if written.nil?
+        return written if qualified_prefix.empty?
+
+        namespace, _, base = written.rpartition("::")
+        return written if namespace.empty?
+
+        "#{resolved_write_namespace(namespace, qualified_prefix, default_scope)}::#{base}"
+      end
+
+      # The key for a path write whose base is not a static constant path: the name `self` carries for a
+      # `self::BAR = …`, and nil — decline to record the write at all — for every other dynamic base.
+      def dynamic_base_write_key(target, qualified_prefix, self_owner = nil)
+        return nil unless target.parent.is_a?(Prism::SelfNode)
+
+        base = target.name&.to_s
+        base && self_write_name(qualified_prefix, self_owner, base)
+      end
+
+      # The qualified name a `self::BAR = …` writes. `self_owner` is nil in the ordinary case — `self` is the
+      # enclosing declaration, so the write takes the key a bare `BAR = …` in the same body takes — a class or
+      # module name where a `class_eval`-family block rebound `self` to one, and {OPAQUE_SELF} where it
+      # rebound `self` to something unnameable, which declines the write (nil) rather than filing it under a
+      # namespace Ruby did not touch ([#705](https://github.com/rigortype/rigor/issues/705)).
+      #
+      # `Object` is the one owner that is not a namespace of its own: its constants ARE the top-level ones, and
+      # every other census key spells those bare. Keying `Object::T` would file the write beside a sibling's
+      # plain `T = 2` instead of on top of it, so the conflict between them goes undetected and one of the two
+      # values publishes — the direction this whole issue is about.
+      def self_write_name(qualified_prefix, self_owner, base)
+        return qualified_write_name(qualified_prefix, base) if self_owner.nil?
+        return nil if self_owner.equal?(OPAQUE_SELF)
+        return base if self_owner == OBJECT_OWNER
+
+        "#{self_owner}::#{base}"
+      end
+
+      # The namespace of a `Foo::BAR = …`, resolved the way a READ of the same spelling resolves it: the
+      # first `<nesting entry>::Foo` that names a known class or module, innermost first, and the as-written
+      # name when none does. Only class/module knowledge participates — a value constant owns no constants —
+      # and the ancestor rung {Reflection.resolve_constant_type} walks is deliberately skipped, so a
+      # namespace no source declares keeps the key it has today rather than moving to a guess.
+      def resolved_write_namespace(namespace, qualified_prefix, scope)
+        census_nesting(scope, qualified_prefix).each do |entry|
+          candidate = "#{entry}::#{namespace}"
+          return candidate if known_namespace?(candidate, scope)
+        end
+        namespace
+      end
+
+      # True when `name` is a class or module some source declares: a project declaration in
+      # `discovered_classes` or an RBS-known class object. The [#528](https://github.com/rigortype/rigor/issues/528)
+      # synthesized namespace prefixes reach that table for THIS FILE only — the runner's cross-file seed
+      # (`discovered_project_index_for_paths`) returns `collect_class_decls`'s raw declarations without the
+      # synthesis its sibling `discovered_classes_for_paths` applies — so a namespace known only through ANOTHER
+      # file's COMPACT declaration (`class Admin::Holder::Inner`) does not move the key, where an explicit
+      # `module Admin; class Holder` there does. Under-resolution, the direction this probe may err in.
+      #
+      # The RBS half needs no dependency edge — the loaded signature set is part of the run fingerprint — but
+      # both project answers do; see {#record_namespace_probe}.
+      def known_namespace?(name, scope)
+        if scope.discovered_classes.key?(name)
+          record_namespace_probe(name, scope, hit: true)
+          return true
+        end
+
+        environment = scope.environment
+        return true if !environment.nil? && !environment.singleton_for_name(name).nil?
+
+        record_namespace_probe(name, scope, hit: false)
+        false
+      end
+
+      # ADR-46 — the key this census files a path write under is a function of ANOTHER file's class
+      # declarations, and no edge the READER records covers it: a reference's negative key is
+      # `class:<last segment>` of the name that failed to resolve, whereas here the write's key moves because
+      # a MIDDLE segment appeared (`Holder::DEFAULT` inside `module Admin` starts naming
+      # `Admin::Holder::DEFAULT` the moment some file declares `Admin::Holder`). Both directions therefore
+      # need their own edge, recorded where the probe happens: a POSITIVE one on the file declaring the
+      # namespace we resolved through, so deleting it moves the key back, and a NEGATIVE `class:` one on
+      # every candidate that missed, so declaring it later moves the key forward. Without them a warm
+      # incremental run serves a cached answer computed against a namespace that has since appeared. Gated on
+      # the recorder, which is off on every ordinary run.
+      def record_namespace_probe(name, scope, hit:)
+        return unless Analysis::DependencyRecorder.active?
+
+        if hit
+          scope.discovered_class_sources[name]&.each { |site| Analysis::DependencyRecorder.read_site(site) }
+        else
+          Analysis::DependencyRecorder.read_missing(:class, name.split("::").last)
+        end
+      end
+
       # Survey item (e): when the rvalue is a recognised `Module.new do ... end` / `Class.new do ... end` /
       # `Struct.new(*sym) do ... end` / `Data.define(*sym) do ... end` form, type the named constant as
       # `Singleton[<full>]` so the discovered-method table registered under `full` becomes reachable through
@@ -1334,9 +1956,8 @@ module Rigor
 
         case node
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            child_prefix = qualified_prefix + [name]
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
             record_meta_superclass_members(node, child_prefix, methods_acc) if node.is_a?(Prism::ClassNode)
             if node.body
               walk_methods_and_def_nodes(node.body, child_prefix, false, methods_acc, def_nodes_acc, source_path)
@@ -1354,11 +1975,12 @@ module Rigor
         when Prism::ConstantWriteNode
           if meta_new_block_body(node)
             child_prefix = qualified_prefix + [node.name.to_s]
+            record_meta_members(node.value, child_prefix, methods_acc)
             walk_methods_and_def_nodes(meta_new_block_body(node), child_prefix, false, methods_acc, def_nodes_acc,
                                        source_path)
-            # No anonymous registration here: the constant IS the name, and `StatementEvaluator` never routes a
-            # constant-write rvalue through the block-body narrowing (its scope index still shows `self` as
-            # `Dynamic[top]` inside such a body), so the two passes agree on the constant name alone.
+            # No anonymous registration here: the constant IS the name, and `StatementEvaluator#eval_constant_write`
+            # enters the body under it (#590) by asking THIS recognition (`meta_new_block_body`), so the two passes
+            # agree on the constant name alone.
             return
           end
         when Prism::DefNode
@@ -1390,14 +2012,30 @@ module Rigor
       def record_call_node_methods(node, qualified_prefix, in_singleton_class, methods_acc, source_path)
         record_define_method(node, qualified_prefix, in_singleton_class, methods_acc) if node.name == :define_method
         record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc) if ATTR_MACROS.include?(node.name)
+        record_module_attr_methods(node, qualified_prefix, methods_acc) if MODULE_ATTR_MACROS.key?(node.name)
+        record_alias_method_call(node, qualified_prefix, in_singleton_class, methods_acc)
         AnonymousMetaClass.name_for(node, source_path)
       end
 
+      # The `alias_method :new, :old` CallNode twin of {#record_alias_method} (#533): the NEW name joins
+      # the discovered-methods table so calls to it stop reading undefined, and
+      # {#apply_alias_def_nodes}'s map walk gives it the ORIGINAL def node for return inference.
+      def record_alias_method_call(call_node, qualified_prefix, in_singleton_class, accumulator)
+        return if qualified_prefix.empty?
+
+        names = alias_method_call_names(call_node)
+        return if names.nil?
+
+        kind = in_singleton_class ? :singleton : :instance
+        record_method_kind(accumulator, qualified_prefix.join("::"), names.first, kind)
+      end
+
       # #319 — walks a `Class.new do ... end` / `Module.new do ... end` / `Struct.new(*sym) do ... end` /
       # `Data.define(*sym) do ... end` block body as the class body it is at runtime, keyed by the call site's
       # synthetic anonymous `name`; the call's other children (receiver, arguments) keep the enclosing prefix.
       def walk_anonymous_meta_block(call_node, name, qualified_prefix, in_singleton_class, methods_acc,
                                     def_nodes_acc, source_path)
+        record_meta_members(call_node, [name], methods_acc)
         call_node.rigor_each_child do |child|
           if child.equal?(call_node.block)
             body = call_node.block.body
@@ -1461,6 +2099,7 @@ module Rigor
         return nil unless node.is_a?(Prism::ConstantWriteNode)
 
         rvalue = node.value
+        return nil unless rvalue.is_a?(Prism::CallNode)
         return nil unless data_define_call?(rvalue) ||
                           struct_new_call?(rvalue) ||
                           module_new_call?(rvalue) ||
@@ -1473,22 +2112,61 @@ module Rigor
       # the subclass that no `def` / `attr_*` declares. Register them in the discovered-methods existence table so an
       # implicit-self read of a member inside the class body is known to exist — both for the existing undefined-method
       # suppression and for the ADR-24 slice-4 self-call recorder, which must treat a synthesized member as an existing
-      # method, not an unresolved call. The block-form (`Const = Data.define(:a) do ... end`) is handled by the
-      # `ConstantWriteNode` branch's block recursion; its members type `self` as `Object`, out of scope here.
+      # method, not an unresolved call.
       def record_meta_superclass_members(class_node, qualified_prefix, accumulator)
-        superclass = class_node.superclass
-        return unless data_define_call?(superclass) || struct_new_call?(superclass)
+        record_meta_members(class_node.superclass, qualified_prefix, accumulator, allow_outer_block: false)
+      end
+
+      # The registration itself, shared with the two BLOCK forms — `Const = Struct.new(:a) do … end` from the
+      # `ConstantWriteNode` branch and the anonymous `Struct.new(:a) do … end` from {#walk_anonymous_meta_block}
+      # (#590). Their bodies are entered as class bodies, so a member read inside one dispatches on the struct's
+      # own class and must find the reader there: a member that shadows a `Kernel` private (`lambda`) otherwise
+      # falls through to `Kernel#lambda`, and `lambda.upcase` reports an undefined method on `Proc` — a wrong-type
+      # diagnostic on correct code. No-op for `Class.new` / `Module.new` and for a factory whose members are not
+      # literal Symbols (nothing to register).
+      def record_meta_members(factory_call, qualified_prefix, accumulator, allow_outer_block: true)
+        factory_call = resolve_meta_factory_call(factory_call, allow_outer_block: allow_outer_block)
+        return unless factory_call
 
-        members = meta_member_names(superclass)
+        members = meta_member_names(factory_call)
         return if members.empty?
 
         class_name = qualified_prefix.join("::")
         members.each { |member| record_method_kind(accumulator, class_name, member, :instance) }
       end
 
+      # Unwinds nested single-parent `Class.new(...)` calls to a root `Struct.new(...)` / `Data.define(...)`.
+      # A nested wrapper or factory block is declined because its method overrides belong to the intermediate
+      # superclass and cannot be attributed to the outer class's reader-override guard.
+      def resolve_meta_factory_call(call_node, allow_outer_block: true)
+        wrapped = false
+        while class_new_call?(call_node)
+          return nil if intermediate_factory_block?(call_node, wrapped, allow_outer_block)
+
+          arguments = call_node.arguments&.arguments
+          return nil unless arguments&.one?
+
+          call_node = arguments.first
+          wrapped = true
+        end
+        return nil unless meta_factory_call?(call_node)
+        return nil if intermediate_factory_block?(call_node, wrapped, allow_outer_block)
+
+        call_node
+      end
+
+      def intermediate_factory_block?(call_node, wrapped, allow_outer_block)
+        (wrapped || !allow_outer_block) && !call_node.block.nil?
+      end
+
+      def meta_factory_call?(call_node)
+        data_define_call?(call_node) || struct_new_call?(call_node)
+      end
+
       # The Symbol member names of a `Data.define(*Symbol)` / `Struct.new(*Symbol [, keyword_init:])` call. For
-      # `Struct.new` the optional leading String name and trailing `keyword_init:` hash are stripped by
-      # {#struct_new_positionals}; `Data.define` args are all Symbols already.
+      # `Struct.new` the trailing `keyword_init:` hash is stripped by {#struct_new_positionals}; a leading
+      # String class name is NOT stripped, so `Struct.new("Name", :a) do` registers no members and the body
+      # is entered under the anonymous name (consistent between passes). `Data.define` args are all Symbols.
       def meta_member_names(call_node)
         raw = call_node.arguments&.arguments || []
         symbols = struct_new_call?(call_node) ? (struct_new_positionals(raw) || []) : raw
@@ -1592,9 +2270,9 @@ module Rigor
 
         case node
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            walk_singleton_body(node.body, qualified_prefix + [name], false, accumulator) if node.body
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            walk_singleton_body(node.body, child_prefix, false, accumulator) if node.body
             return
           end
         when Prism::SingletonClassNode
@@ -1621,6 +2299,68 @@ module Rigor
         end
       end
 
+      EMPTY_NESTING = [].freeze
+
+      # The empty qualified prefix. Distinct from {EMPTY_NESTING} only in what it MEANS: the two are handed
+      # to different parameters, and this cycle spent a blocker on a prefix and a nesting sharing a name.
+      EMPTY_PREFIX = [].freeze
+      private_constant :EMPTY_NESTING
+
+      # Issue #681 — `{Prism::DefNode => Module.nesting}` for every `def` the file declares inside a class or
+      # module body, keyed by node IDENTITY so the answer follows the DECLARATION rather than the class a
+      # call happens to dispatch on. `Inference::ExpressionTyper#build_user_method_body_scope` rebuilds a
+      # callee's body scope from the RECEIVER'S TYPE alone when it needs that callee's return, so unlike the
+      # census scopes (#692) there is no prefix in hand to stamp: recording the chain where the declaration is
+      # indexed is what makes the re-walk and the declaration walk agree BY CONSTRUCTION, which is the
+      # argument #685 used to make {Reflection.lexical_nesting_chain} the single owner.
+      #
+      # Keyed on the def node and not on `(class, method)` because an inherited body is re-walked with the
+      # SUBCLASS as receiver: `class Admin::CompactBase` declares `make`, `module Admin; class Child <
+      # CompactBase` calls it, and the bare `Post` inside `make` names `::Post` — the constant the compact
+      # declaration that OWNS the body reaches, not the one the receiver's spelling would suggest.
+      #
+      # A separate descent rather than a leaf of the fused methods/def-nodes walk: it needs the CHAIN
+      # threaded, which the fused walk does not carry (a singleton-class body and a `Class.new` block body
+      # both push a qualified prefix while pushing no `Module.nesting` entry), and threading a second value
+      # through that walk and its anonymous-block twin exceeds their parameter budget. It stops at every
+      # `Prism::DefNode`, so a def-dense file pays only the declaration spine.
+      def build_def_nestings(root)
+        accumulator = {}.compare_by_identity
+        walk_def_nestings(root, EMPTY_NESTING, accumulator)
+        accumulator.freeze
+      end
+
+      # Records `nesting` for every `def` reachable from `node`. Only a `class` / `module` keyword pushes an
+      # entry (qualified against the entry already on top, so a compact `class Admin::X` contributes ONE);
+      # every other body — a singleton class, a `Class.new` / `Module.new` block, any other block — inherits
+      # the chain unchanged, because Ruby pushes no cref for them.
+      #
+      # Issue #716 — a top-level `def` records the EMPTY chain, and that is a recorded answer rather than the
+      # absence of one. Ruby's `Module.nesting` in a top-level body IS `[]`, so `def helper = Post.new` names
+      # `::Post` wherever it is later called from; recording nothing left
+      # {Reflection.lexical_nesting_chain} peeling the CALLER's qualified name, which answered `Admin::Post`
+      # for a call made from inside `module Admin`. The table is keyed by node identity and populated only by
+      # this walk, so "present with `[]`" (walked, and top level) stays distinguishable from "absent" (no
+      # declaration walk built this scope — a plugin-constructed scope, an anonymous `Class.new` re-entered
+      # through `Scope#evaluate`), which keeps the peel where it is still the only available answer.
+      def walk_def_nestings(node, nesting, accumulator)
+        return unless node.is_a?(Prism::Node)
+
+        case node
+        when Prism::ClassNode, Prism::ModuleNode
+          if node.body
+            walk_def_nestings(node.body, Source::ConstantPath.pushed_nesting(nesting, node.constant_path),
+                              accumulator)
+          end
+          return
+        when Prism::DefNode
+          accumulator[node] = nesting unless nesting.nil?
+          return
+        end
+
+        node.rigor_each_child { |child| walk_def_nestings(child, nesting, accumulator) }
+      end
+
       # Walks a class/module/singleton-class body's direct statements in source order, threading the
       # bare-`module_function` toggle: once a bare `module_function` is seen, every subsequent `def` in the body
       # registers as a singleton method. Nested classes/modules/defs and `module_function :a, :b` named forms recurse /
@@ -1700,41 +2440,153 @@ module Rigor
       # ADR-24 slice 2 — per-class table mapping a fully qualified user class to its superclass name AS WRITTEN at the
       # `class Foo < Bar` declaration. Only constant superclasses are recorded (`class Foo < Struct.new(...)` and other
       # non-constant superclasses produce no entry). The as-written name is resolved to a qualified class at the call
-      # site against the subclass's lexical nesting — see `ExpressionTyper#resolve_ancestor_class_name`.
-      def build_discovered_superclasses(root, source_path = nil)
-        accumulator = {}
+      # site against the nesting the declaration's HEADER sits in — see {Scope#ancestor_name_candidates}, which reads
+      # the second table this walk builds.
+      #
+      # Issue #682 — `header_nestings` maps the same qualified class name to that nesting: `Module.nesting` where the
+      # `class` / `module` KEYWORD is written, which is the body's chain minus the declaration's own entry. It is
+      # recorded here, with the walk's prefix in hand, because it is unrecoverable afterwards: `class Admin::Widget`
+      # and `module Admin; class Widget` render the identical `"Admin::Widget"`, and an ancestor name is resolved in
+      # the enclosing cref — `[]` for the first spelling, `["Admin"]` for the second. A class reopened under two
+      # spellings keeps the LAST one walked, matching how `superclasses` itself merges.
+      #
+      # @return [Array(Hash{String=>String}, Hash{String=>Array[String]})] `[superclasses, header_nestings]`
+      def build_superclass_tables(root, source_path = nil)
+        accumulator = { superclasses: {}, header_nestings: {} }
         walk_class_superclasses(root, [], accumulator, source_path)
-        accumulator.freeze
+        [accumulator[:superclasses].freeze, accumulator[:header_nestings].freeze]
       end
 
-      def walk_class_superclasses(node, qualified_prefix, accumulator, source_path = nil)
+      def walk_class_superclasses(node, qualified_prefix, accumulator, source_path = nil, nesting = EMPTY_NESTING)
         return unless node.is_a?(Prism::Node)
 
         case node
         when Prism::CallNode
-          record_anonymous_meta_superclass(node, accumulator, source_path)
-        when Prism::ClassNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            full = (qualified_prefix + [name]).join("::")
-            superclass = node.superclass && Source::ConstantPath.qualified_name(node.superclass)
-            accumulator[full] = superclass if superclass
-            walk_class_superclasses(node.body, qualified_prefix + [name], accumulator) if node.body
-            return
-          end
-        when Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            walk_class_superclasses(node.body, qualified_prefix + [name], accumulator) if node.body
+          record_anonymous_meta_superclass(node, accumulator[:superclasses], source_path)
+        when Prism::ClassNode, Prism::ModuleNode
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            record_declaration_ancestry(node, nesting, child_prefix, accumulator)
+            if node.body
+              walk_class_superclasses(node.body, child_prefix, accumulator, nil,
+                                      Source::ConstantPath.pushed_nesting(nesting, node.constant_path) ||
+                                      nesting)
+            end
             return
           end
         end
 
         node.rigor_each_child do |child|
-          walk_class_superclasses(child, qualified_prefix, accumulator, source_path)
+          walk_class_superclasses(child, qualified_prefix, accumulator, source_path, nesting)
         end
       end
 
+      # One declaration's two ancestry facts: the as-written superclass name (classes only), and the
+      # `Module.nesting` its header is written in. `nesting` is the chain in force OUTSIDE the header — the
+      # header is evaluated before the body is entered, so the declaration's own entry is not on the ladder
+      # its superclass name walks — which is why the walk pushes only when it recurses into the body. The
+      # chain is threaded rather than derived from the enclosing prefix because a rooted header resets that
+      # prefix without resetting Ruby's nesting ([#708](https://github.com/rigortype/rigor/issues/708)).
+      def record_declaration_ancestry(node, nesting, child_prefix, accumulator)
+        full = child_prefix.join("::")
+        add_header_nesting(accumulator[:header_nestings], full, nesting) if declares_ancestor_name?(node)
+        return unless node.is_a?(Prism::ClassNode)
+
+        accumulator[:superclasses][full] = recorded_ancestor_name(node.superclass) if node.superclass
+      end
+
+      # Issue #722 residue 1 / #637 — the recorded ancestor name, carrying the ROOTED marker when the site
+      # wrote one. `Source::ConstantPath.qualified_name` renders segments only, so `class Rooted < ::Base`
+      # recorded the same `"Base"` a bare `< Base` does, and the resolver then walked the enclosing nesting
+      # and answered `A::Base` — a class Ruby never looks at, on a spelling whose whole point is that it
+      # does not.
+      #
+      # The marker rides the existing table's VALUE rather than a new table. It is still a String, so the
+      # per-file index, the cross-file fold and the ADR-85 seed bundle carry it unchanged; the three
+      # resolvers that read it strip and anchor. `IncrementalSnapshot::SCHEMA` is bumped anyway, because an
+      # older blob's un-rooted value is indistinguishable from "not rooted" and a warm run would keep the
+      # pre-fix answer for every unchanged file.
+      def recorded_ancestor_name(node)
+        name = Source::ConstantPath.qualified_name(node)
+        return name if name.nil? || !Source::ConstantPath.rooted?(node)
+
+        "::#{name}"
+      end
+
+      # Whether this declaration SITE writes an ancestor name — a superclass in its header, or a mixin call
+      # in its own body. Only such a site contributes a header nesting.
+      #
+      # Issue #708's review: a per-CLASS union of every site's chain is wrong for a rooted reopen inside
+      # another namespace. `class ::Foo; def extra = 1; end` written in `module Outer` contributed `["Outer"]`
+      # to `Foo`, and the ancestor rung then resolved `Foo`'s superclass `Base` as `Outer::Base` — a class
+      # Ruby never looks at, ahead of the right one, on a site that named no ancestor at all. A site that
+      # writes no ancestor name has no ancestor for its cref to govern, so it has nothing to say here.
+      #
+      # This keeps what the union was FOR. It was added because last-writer-wins let one rails TEST file
+      # reopening `ActiveRecord::Relation` compactly beat the library declaration, costing the class all nine
+      # of its `include`d modules; that reopen writes no ancestor name either, so it now contributes nothing
+      # rather than winning — the protection comes from the recording rule instead of from a merge rule.
+      # Two sites that BOTH write ancestor names still union, which is the conservative reading of an
+      # ambiguity one table cannot represent.
+      #
+      # The mixin scan counts only a call whose `self` is the declaration itself, so it stops at every
+      # construct that rebinds `self`: a nested `class` / `module` (that body's calls belong to the nested
+      # class), a `class << self` body, and a block `#rebound_block_self` classifies as rebinding — the
+      # `Class.new` / `Module.new` / `Struct.new` / `Data.define` and `class_eval` family. An `include`
+      # written in any of those attaches to something other than this class, so treating it as this site's
+      # ancestor name reinstates exactly the defect above with a different spelling.
+      #
+      # It stays structural rather than exhaustive: `self.include M` and `send(:include, M)` record nothing
+      # and fall back to the peel, which is this walk's pre-#682 answer and never a new firing — and the
+      # includes walk misses those two as well, so the class's ancestry agrees. For the REBINDING shapes it
+      # does not: `walk_class_includes` still charges an `include` written in a `class << self` body or a
+      # `Class.new` block to the enclosing class, where Ruby attaches it elsewhere. This scan is right and
+      # that one is wrong; the divergence is [#728](https://github.com/rigortype/rigor/issues/728).
+      def declares_ancestor_name?(node)
+        return true if node.is_a?(Prism::ClassNode) && node.superclass
+
+        body = node.body
+        body ? mixin_call_in_body?(body) : false
+      end
+
+      def mixin_call_in_body?(node)
+        return false unless node.is_a?(Prism::Node)
+        return false if node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode) ||
+                        node.is_a?(Prism::SingletonClassNode)
+        return true if node.is_a?(Prism::CallNode) && node.receiver.nil? && MIXIN_CALL_NAMES.include?(node.name)
+
+        rebinds = rebound_block_self(node, EMPTY_PREFIX)
+        node.rigor_each_child do |child|
+          next if rebinds && child.is_a?(Prism::BlockNode)
+
+          return true if mixin_call_in_body?(child)
+        end
+        false
+      end
+
+      # Adds one declaration site's header nesting to the per-class table, UNIONING it with what a
+      # previous site recorded, most-qualified first. A class reopened under two spellings has two header
+      # nestings while the ancestor names its sites write collapse into ONE table, so taking either site's
+      # chain alone drops a candidate the other one had — and dropping a candidate drops an ancestor edge,
+      # the false-positive direction. Rails is the corpus case: `activerecord` declares
+      # `ActiveRecord::Relation` inside `module ActiveRecord` and one test file reopens it as the compact
+      # `class ActiveRecord::Relation`, so last-writer-wins cost the library class nine included modules.
+      # The union is the conservative reading of an ambiguity the per-class table cannot represent: it
+      # degrades such a class to the pre-fix candidate list rather than to a shorter one.
+      def add_header_nesting(table, name, entries)
+        existing = table[name]
+        return table[name] = entries.freeze if existing.nil?
+        return if entries.all? { |entry| existing.include?(entry) }
+
+        table[name] = (existing | entries).sort_by { |entry| [-entry.split("::").size, entry] }.freeze
+      end
+
+      # {#add_header_nesting} over a whole table, for the per-file and cross-file merges.
+      def merge_header_nestings(target, incoming)
+        incoming.each { |name, entries| add_header_nesting(target, name, entries) }
+        target
+      end
+
       # #319 — `Class.new(Parent) do ... end` names its superclass in the first positional. Recording it under the
       # call site's anonymous name keeps `Parent`'s surface reachable from the block body (whose `self_type` is now
       # `Singleton[<anonymous>]`) and from an instance of the resulting class, so giving the anonymous class an
@@ -1745,6 +2597,11 @@ module Rigor
         arg = call_node.arguments&.arguments&.first
         return if arg.nil?
 
+        # Issue #722 residue 1 — deliberately NOT marked rooted here, unlike the `class X < ::Parent`
+        # header. Marking it changed nothing observable: `Made = Class.new(::Base)` inside a namespace that
+        # shadows `Base` still resolved the shadow, so the anonymous class's ancestry is reached by a path
+        # that does not read this value, and shipping a marker no resolver honours would be a change with
+        # no gate. The residue stays on #722 with that finding attached.
         superclass = Source::ConstantPath.qualified_name(arg)
         return if superclass.nil?
 
@@ -1768,16 +2625,18 @@ module Rigor
 
         case node
         when Prism::ClassNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            record_data_member_layout(accumulator, qualified_prefix + [name], node.superclass)
-            walk_data_member_layouts(node.body, qualified_prefix + [name], accumulator) if node.body
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            record_data_member_layout(
+              accumulator, child_prefix, node.superclass, allow_outer_block: false
+            )
+            walk_data_member_layouts(node.body, child_prefix, accumulator) if node.body
             return
           end
         when Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            walk_data_member_layouts(node.body, qualified_prefix + [name], accumulator) if node.body
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            walk_data_member_layouts(node.body, child_prefix, accumulator) if node.body
             return
           end
         when Prism::ConstantWriteNode
@@ -1791,8 +2650,9 @@ module Rigor
 
       # Records `qualified -> [members]` when `expr` is a `Data.define(*Symbol)` call with at least one literal-Symbol
       # member.
-      def record_data_member_layout(accumulator, qualified_parts, expr)
-        return unless data_define_call?(expr)
+      def record_data_member_layout(accumulator, qualified_parts, expr, allow_outer_block: true)
+        expr = resolve_meta_factory_call(expr, allow_outer_block: allow_outer_block)
+        return unless expr && data_define_call?(expr)
 
         members = meta_member_names(expr)
         return if members.empty?
@@ -1815,16 +2675,18 @@ module Rigor
 
         case node
         when Prism::ClassNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            record_struct_member_layout(accumulator, qualified_prefix + [name], node.superclass)
-            walk_struct_member_layouts(node.body, qualified_prefix + [name], accumulator) if node.body
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            record_struct_member_layout(
+              accumulator, child_prefix, node.superclass, allow_outer_block: false
+            )
+            walk_struct_member_layouts(node.body, child_prefix, accumulator) if node.body
             return
           end
         when Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            walk_struct_member_layouts(node.body, qualified_prefix + [name], accumulator) if node.body
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            walk_struct_member_layouts(node.body, child_prefix, accumulator) if node.body
             return
           end
         when Prism::ConstantWriteNode
@@ -1838,8 +2700,9 @@ module Rigor
 
       # Records `qualified -> { members:, keyword_init: }` when `expr` is a `Struct.new(*Symbol [, keyword_init:
       # <bool>])` call with at least one literal-Symbol member.
-      def record_struct_member_layout(accumulator, qualified_parts, expr)
-        return unless struct_new_call?(expr)
+      def record_struct_member_layout(accumulator, qualified_parts, expr, allow_outer_block: true)
+        expr = resolve_meta_factory_call(expr, allow_outer_block: allow_outer_block)
+        return unless expr && struct_new_call?(expr)
 
         members = meta_member_names(expr)
         return if members.empty?
@@ -1882,14 +2745,21 @@ module Rigor
 
         case node
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            full = (qualified_prefix + [name]).join("::")
-            walk_class_includes(node.body, qualified_prefix + [name], full, accumulator) if node.body
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            full = child_prefix.join("::")
+            walk_class_includes(node.body, child_prefix, full, accumulator) if node.body
             return
           end
+        when Prism::SingletonClassNode
+          # Issue #728 — `class << self; include M; end` mixes M into the SINGLETON: it contributes class
+          # methods, not the instance surface this table feeds. Descending with no owner keeps any nested
+          # declaration walked (a `ClassNode` child sets its own owner) while the mixin calls in the
+          # singleton body record nothing, which is what `extends` is for.
+          current_class = nil
         when Prism::CallNode
           record_mixin_call(node, current_class, accumulator)
+          return walk_mixin_call_children(node, qualified_prefix, current_class, accumulator)
         end
 
         node.rigor_each_child do |child|
@@ -1897,6 +2767,30 @@ module Rigor
         end
       end
 
+      # Issue #728 — a block that REBINDS `self` owns the mixin calls written in it, and this walk used to
+      # hand them to the lexically enclosing declaration. `Thing = Class.new { include Taggable }` inside
+      # `class Outer` registered `Taggable` on `Outer`, so `Outer.new.tag` typed `:tagged` where MRI raises
+      # `NoMethodError` — a wrong answer, not a wider one. The classification is
+      # {#rebound_block_self}, the same one #721 gave its own mixin scan.
+      #
+      # `Recv.class_eval { include M }` resolves to `Recv` and now records there, which it never did before
+      # (the block's owner was the lexical enclosure, so at the top level the include was simply dropped).
+      # An OPAQUE rebinding — `Class.new` / `Module.new` / a non-constant `class_eval` receiver — records
+      # nothing: the class exists but this walk cannot name it, and naming the lexical enclosure instead is
+      # the one answer Ruby is guaranteed not to have written.
+      def walk_mixin_call_children(node, qualified_prefix, current_class, accumulator)
+        rebound = rebound_block_self(node, qualified_prefix)
+        node.rigor_each_child do |child|
+          owner =
+            if rebound && child.is_a?(Prism::BlockNode)
+              rebound == OPAQUE_SELF ? nil : rebound
+            else
+              current_class
+            end
+          walk_class_includes(child, qualified_prefix, owner, accumulator)
+        end
+      end
+
       def record_mixin_call(node, current_class, accumulator)
         return unless current_class && node.receiver.nil?
         return unless MIXIN_CALL_NAMES.include?(node.name)
@@ -1907,6 +2801,78 @@ module Rigor
         end
       end
 
+      # Issue #526 — `extend M` / `extend self` / bare `module_function`, the singleton-side siblings of
+      # {#build_discovered_includes}. `extend self` and the bare `module_function` toggle both map the
+      # module's own instance defs onto its singleton (recorded as extending ITSELF); `module_function`
+      # with symbol arguments already resolves through the existing recording, and the toggle's
+      # order-sensitivity (only SUBSEQUENT defs become module functions) is deliberately over-approximated
+      # — the extra names only suppress `undefined-method` and enable inference on calls that raise at
+      # runtime, both the ADR-5-safe direction.
+      def build_discovered_extends(root)
+        accumulator = {}
+        walk_class_extends(root, [], nil, accumulator)
+        accumulator.transform_values { |mods| mods.uniq.freeze }.freeze
+      end
+
+      def walk_class_extends(node, qualified_prefix, current_class, accumulator)
+        return unless node.is_a?(Prism::Node)
+
+        case node
+        when Prism::ClassNode, Prism::ModuleNode
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            full = child_prefix.join("::")
+            walk_class_extends(node.body, child_prefix, full, accumulator) if node.body
+            return
+          end
+        when Prism::CallNode
+          record_extend_call(node, current_class, accumulator)
+        end
+
+        node.rigor_each_child do |child|
+          walk_class_extends(child, qualified_prefix, current_class, accumulator)
+        end
+      end
+
+      def record_extend_call(node, current_class, accumulator)
+        return unless current_class && node.receiver.nil?
+
+        case node.name
+        when :extend then record_extend_targets(node, current_class, accumulator)
+        when :module_function
+          (accumulator[current_class] ||= []) << current_class if node.arguments.nil?
+        end
+      end
+
+      def record_extend_targets(node, current_class, accumulator)
+        node.arguments&.arguments&.each do |arg|
+          target = arg.is_a?(Prism::SelfNode) ? current_class : Source::ConstantPath.qualified_name(arg)
+          (accumulator[current_class] ||= []) << target if target
+        end
+      end
+
+      # The materialization half of #526: for every `C extends M`, M's INSTANCE defs become C's
+      # SINGLETON defs — existence (so `C.helper` stops firing undefined-method) and def nodes (so
+      # call-site return inference runs with `self = Singleton[C]`, which is what Ruby binds). A name C
+      # already defines on its own singleton wins (`||=`); an extend target with no discovered defs
+      # contributes nothing (RBS-module extends stay on the dispatch tiers).
+      def fold_extends_into_singleton_tables(extends, def_nodes, singleton_def_nodes, methods)
+        extends.each do |class_name, mods|
+          mods.each do |mod_name|
+            source_defs = def_nodes[mod_name]
+            next if source_defs.nil?
+
+            # An inner table inherited unchanged from a frozen seed must be thawed before the fold writes.
+            target = singleton_def_nodes[class_name]
+            target = singleton_def_nodes[class_name] = (target ? target.dup : {}) if target.nil? || target.frozen?
+            source_defs.each do |method_name, def_node|
+              target[method_name] ||= def_node
+              record_method_kind(methods, class_name, method_name, :singleton)
+            end
+          end
+        end
+      end
+
       VISIBILITY_MODIFIERS = %i[public private protected].freeze
 
       # v0.1.2 — per-class method-visibility table for the `def.method-visibility-mismatch` CheckRule.
@@ -1933,15 +2899,14 @@ module Rigor
         accumulator.transform_values(&:freeze).freeze
       end
 
-      # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/AbcSize
+      # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/MethodLength
       def walk_method_visibilities(node, qualified_prefix, in_singleton_class, current_visibility, accumulator)
         return current_visibility unless node.is_a?(Prism::Node)
 
         case node
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            child_prefix = qualified_prefix + [name]
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
             walk_method_visibilities(node.body, child_prefix, false, :public, accumulator) if node.body
             return current_visibility
           end
@@ -1982,7 +2947,6 @@ module Rigor
         end
         current_visibility
       end
-      # rubocop:enable Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/AbcSize
 
       def record_def_visibility(def_node, qualified_prefix, in_singleton_class, current_visibility, accumulator)
         return if def_node.receiver.is_a?(Prism::SelfNode) || in_singleton_class
@@ -2071,9 +3035,9 @@ module Rigor
 
         case node
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            collect_class_alias_map(node.body, qualified_prefix + [name], accumulator) if node.body
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            collect_class_alias_map(node.body, child_prefix, accumulator) if node.body
             return accumulator
           end
         when Prism::SingletonClassNode
@@ -2081,12 +3045,36 @@ module Rigor
         when Prism::AliasMethodNode
           record_alias_map_entry(node, qualified_prefix, accumulator)
           return accumulator
+        when Prism::CallNode
+          # `alias_method :new, :old` — the CallNode twin of the `alias` keyword (#533; liquid's i18n
+          # `t` alias was the corpus case). Recorded, then the walk continues: unlike AliasMethodNode a
+          # call's children can carry further class bodies (`Class.new do … end`).
+          names = alias_method_call_names(node)
+          if names && !qualified_prefix.empty?
+            (accumulator[qualified_prefix.join("::")] ||= {})[names.first] =
+              names.last
+          end
         end
 
         node.rigor_each_child { |child| collect_class_alias_map(child, qualified_prefix, accumulator) }
         accumulator
       end
 
+      # `[new_name, old_name]` for an implicit-self `alias_method` call with two literal symbol /
+      # string arguments, or nil. A variable-named alias is runtime data and stays unrecorded.
+      def alias_method_call_names(call_node)
+        return nil unless call_node.name == :alias_method && call_node.receiver.nil?
+
+        args = call_node.arguments&.arguments
+        return nil unless args && args.size == 2
+
+        new_name = literal_method_name(args[0])
+        old_name = literal_method_name(args[1])
+        return nil if new_name.nil? || old_name.nil?
+
+        [new_name, old_name]
+      end
+
       def record_alias_map_entry(alias_node, qualified_prefix, accumulator)
         return if qualified_prefix.empty?
         return unless alias_node.new_name.is_a?(Prism::SymbolNode) && alias_node.old_name.is_a?(Prism::SymbolNode)
@@ -2134,6 +3122,53 @@ module Rigor
         end
       end
 
+      # Issue #736 — the module-level accessor macros, which introduce methods on BOTH sides of the class.
+      # ActiveSupport defines them on `Module`, so every class and module body can use them, and Rails codebases
+      # do: `mattr_accessor` / `cattr_accessor` (an alias of it) and `class_attribute` account for 92 false
+      # `call.undefined-method` on redmine the moment any `sig/` declares the class — invisible before that,
+      # because an undeclared receiver is not a receiver the rule can speak about.
+      #
+      # The value is `[reader, writer, predicate]`. `class_attribute` also defines `x?` on both sides.
+      #
+      # Recognising ActiveSupport's spellings in the engine's own walk is a deliberate exception to "steer
+      # metaprogramming toward the plugin API": the consumer that has to see these is the cross-file
+      # `discovered_methods` table (`finalize_def_index` keeps accessor-introduced names there precisely
+      # because they are not monkey-patches), and no plugin surface reaches it — the ADR-16 synthetic-method
+      # tier feeds the DISPATCHER, which `Analysis::CheckRules` does not consult. A name table is the smallest
+      # thing that works; a plugin-supplied one can replace it whenever that surface exists.
+      MODULE_ATTR_MACROS = {
+        mattr_reader: [true, false, false], mattr_writer: [false, true, false],
+        mattr_accessor: [true, true, false], cattr_reader: [true, false, false],
+        cattr_writer: [false, true, false], cattr_accessor: [true, true, false],
+        class_attribute: [true, true, true]
+      }.freeze
+
+      # Both kinds, unconditionally. `instance_accessor: false` (and its `instance_reader:` /
+      # `instance_writer:` / `instance_predicate:` siblings) narrows the real surface, and honouring them here
+      # would buy a missed detection on a shape nobody writes by accident — this table's only consumer is a
+      # SUPPRESSION, where over-recording costs a diagnostic that would have fired on working code anyway.
+      def record_module_attr_methods(call_node, qualified_prefix, accumulator)
+        return if qualified_prefix.empty?
+        return unless call_node.receiver.nil? # only the implicit-self macro defines on the lexical class
+        return if call_node.arguments.nil?
+
+        reader, writer, predicate = MODULE_ATTR_MACROS.fetch(call_node.name)
+        class_name = qualified_prefix.join("::")
+        call_node.arguments.arguments.each do |arg|
+          base = literal_method_name(arg)
+          next if base.nil?
+
+          record_both_kinds(accumulator, class_name, base) if reader
+          record_both_kinds(accumulator, class_name, :"#{base}=") if writer
+          record_both_kinds(accumulator, class_name, :"#{base}?") if predicate
+        end
+      end
+
+      def record_both_kinds(accumulator, class_name, method_name)
+        record_method_kind(accumulator, class_name, method_name, :instance)
+        record_method_kind(accumulator, class_name, method_name, :singleton)
+      end
+
       def literal_method_name(node)
         return nil unless node.is_a?(Prism::SymbolNode) || node.is_a?(Prism::StringNode)
 
@@ -2169,7 +3204,7 @@ module Rigor
           # Skip files that fail to parse or read; the per-file analyzer surfaces the parse error separately.
           next
         end
-        accumulator.freeze
+        synthesize_namespace_prefixes(accumulator).freeze
       end
 
       # ADR-24 slice 2 — cross-file companion to `discovered_classes_for_paths`. Walks every project file once and
@@ -2249,12 +3284,30 @@ module Rigor
       def declaration_signature(file_index)
         parts = []
         append_ancestry_signature(parts, file_index)
+        append_constant_signature(parts, file_index)
         append_declaration_tables(parts, file_index)
         append_def_signatures(parts, file_index[:def_nodes], "#")
         append_def_signatures(parts, file_index[:singleton_def_nodes], ".")
         Digest::SHA256.hexdigest(parts.join("\x00"))
       end
 
+      # Issue #644 — the cross-file VALUE-constant surface. Load-bearing for soundness, not precision: a
+      # file's published constants are a declaration-level fact its file-level dependents consume, so
+      # `FOO = :sym` becoming `FOO = :other` MUST move this signature or the reader would be declaration-
+      # stable, dropped from the closure, and served the pre-edit `:sym`. Both halves are here: the write
+      # NAMES (an added / removed / renamed assignment) and the published VALUES (a same-name value edit).
+      def append_constant_signature(parts, file_index)
+        parts.concat((file_index[:constant_writes] || {}).sort.map do |name, by_path|
+          "k:#{name}=#{constant_descriptor_signature(by_path.values.first)}"
+        end)
+      end
+
+      # `[literal]` renders its value; an unpublishable write renders as `?`. Both halves matter: a write
+      # appearing or vanishing moves the signature, and so does the same name's value changing.
+      def constant_descriptor_signature(descriptor)
+        descriptor.is_a?(Array) ? descriptor.first.inspect : "?"
+      end
+
       # The class-declaration + ancestry + member-layout surface of the declaration signature (declared class
       # names, superclass / include ancestry, Data/Struct member layouts). Kept out of
       # {#declaration_signature} to hold its ABC budget.
@@ -2466,7 +3519,23 @@ module Rigor
       # bundle's carries {DefHandle}s. The merges never deref the value, so both fold identically.
       def fold_file_index(acc, file_index)
         fold_def_tables(acc, file_index)
+        # Issue #681 — a re-walked file contributes live nodes and their chains together. A file restored from
+        # a seed bundle contributes NO entry here and cannot: this table is keyed by node identity, and the
+        # only object a bundle has is a {DefHandle}. Issue #707 — the chain travels ON the handle instead, and
+        # {DefNodeResolver} re-attaches it to the node it mints, so both paths answer the same chain for the
+        # same body without either one keying a table by an object the other never sees.
+        acc[:def_nestings].merge!(file_index[:def_nestings] || {})
         fold_ancestry_tables(acc, file_index)
+        fold_constant_tables(acc, file_index)
+      end
+
+      # Issue #644 — the census folds per (name, path), so a re-folded file replaces exactly its own
+      # contribution and the fold stays order-independent. `|| {}` keeps it total over a pre-#644 seed
+      # bundle, which carries no census.
+      def fold_constant_tables(acc, file_index)
+        (file_index[:constant_writes] || {}).each do |name, by_path|
+          (acc[:constant_writes][name] ||= {}).merge!(by_path)
+        end
       end
 
       # def_nodes / singleton_def_nodes / method_visibilities / methods fold class-nested later-wins;
@@ -2492,12 +3561,21 @@ module Rigor
       # superclasses later-wins; includes / class_sources accumulate; member layouts later-wins.
       def fold_ancestry_tables(acc, file_index)
         acc[:superclasses].merge!(file_index[:superclasses])
-        file_index[:includes].each { |cn, mods| acc[:includes][cn] = ((acc[:includes][cn] || []) + mods).uniq }
+        # Issue #682 — a pre-#682 seed bundle carries no header nestings; the SCHEMA bump makes such a blob a
+        # cold rebuild, but default so any in-flight fold stays total and simply peels for those classes.
+        merge_header_nestings(acc[:header_nestings], file_index[:header_nestings] || {})
+        accumulate_module_lists(acc[:includes], file_index[:includes])
+        accumulate_module_lists(acc[:extends], file_index[:extends] || {})
         file_index[:class_sources].each { |cn, files| (acc[:class_sources][cn] ||= Set.new).merge(files) }
         acc[:data_member_layouts].merge!(file_index[:data_member_layouts])
         acc[:struct_member_layouts].merge!(file_index[:struct_member_layouts])
       end
 
+      # Shared accumulate-and-dedupe fold for the class -> module-name-list tables (includes / extends).
+      def accumulate_module_lists(target, additions)
+        additions.each { |cn, mods| target[cn] = ((target[cn] || []) + mods).uniq }
+      end
+
       # ADR-85 WD2 — converts a file's live single-file index + its class table into a Marshal-clean seed
       # bundle: the plain-data tables verbatim, the def-node tables re-expressed as `[node_id, name,
       # fingerprint]` triples (the path is the bundle key), the class-source names (path implicit), and the
@@ -2514,15 +3592,22 @@ module Rigor
           # value stored here equals the one a later recheck recomputes for an unchanged declaration.
           declaration_signature: declaration_signature(file_index),
           classes: file_classes,
-          def_nodes: live_defs_to_bundle(file_index[:def_nodes]),
-          singleton_def_nodes: live_defs_to_bundle(file_index[:singleton_def_nodes]),
+          extends: file_index[:extends],
+          def_nodes: live_defs_to_bundle(file_index[:def_nodes], file_index[:def_nestings]),
+          singleton_def_nodes: live_defs_to_bundle(file_index[:singleton_def_nodes], file_index[:def_nestings]),
           def_sources: file_index[:def_sources],
           singleton_def_sources: file_index[:singleton_def_sources],
           superclasses: file_index[:superclasses],
+          # Issue #682 — plain `{class name => Array[String]}` data, so the bundle stays Marshal-clean and a
+          # warm incremental file resolves its ancestor names the way a cold walk of it does.
+          header_nestings: file_index[:header_nestings],
           includes: file_index[:includes],
           method_visibilities: file_index[:method_visibilities],
           methods: file_index[:methods],
           class_source_names: file_index[:class_sources].keys,
+          # Issue #644 — the file's publication census (`name => [literal] | :unpublishable`; the path is
+          # the bundle key). Plain data, so the bundle stays Marshal-clean.
+          constant_writes: file_index[:constant_writes].transform_values { |by_path| by_path.values.first },
           data_member_layouts: file_index[:data_member_layouts],
           struct_member_layouts: file_index[:struct_member_layouts]
         }
@@ -2540,42 +3625,60 @@ module Rigor
           # but default to `{}` so any in-flight fold stays total.
           singleton_def_sources: bundle[:singleton_def_sources] || {},
           superclasses: bundle[:superclasses],
+          header_nestings: bundle[:header_nestings] || {},
           includes: bundle[:includes],
+          # #526 — pre-extends bundles lack the key; default `{}` keeps the fold total.
+          extends: bundle[:extends] || {},
           method_visibilities: bundle[:method_visibilities],
           methods: bundle[:methods],
           class_sources: bundle[:class_source_names].to_h { |name| [name, Set[path]] },
+          # Issue #644 — a pre-#644 bundle carries no census; the SCHEMA bump makes such a blob a cold
+          # rebuild, but default so any in-flight fold stays total.
+          constant_writes: (bundle[:constant_writes] || {}).transform_values { |descriptor| { path => descriptor } },
           data_member_layouts: bundle[:data_member_layouts],
           struct_member_layouts: bundle[:struct_member_layouts]
         }
       end
 
-      # `{class => {method => Prism::DefNode}}` → `{class => {method => [node_id, name, fingerprint]}}`.
-      def live_defs_to_bundle(defs)
+      # `{class => {method => Prism::DefNode}}` → `{class => {method => [node_id, name, fingerprint,
+      # nesting]}}`. Issue #707 — `nestings` is this file's identity-keyed `{DefNode => Module.nesting}` table,
+      # read here while the live nodes are still in hand, because it is the LAST moment the two can be paired:
+      # the bundle's reader has only the row. Issue #716 — `[]` for a top-level def, which records the empty
+      # chain; nil only for a def no declaration walk reached.
+      def live_defs_to_bundle(defs, nestings)
         defs.transform_values do |methods|
           methods.transform_values do |node|
-            [node.node_id, node.name.to_s, Digest::SHA256.hexdigest(node.location.slice)]
+            [node.node_id, node.name.to_s, Digest::SHA256.hexdigest(node.location.slice), nestings[node]]
           end
         end
       end
 
-      # `{class => {method => [node_id, name, fingerprint]}}` → `{class => {method => DefHandle}}` for `path`.
+      # `{class => {method => [node_id, name, fingerprint, nesting]}}` → `{class => {method => DefHandle}}`
+      # for `path`.
       def bundle_defs_to_handles(defs, path)
         defs.transform_values do |methods|
-          methods.transform_values do |(node_id, name, fingerprint)|
-            DefHandle.new(path: path, node_id: node_id, name: name, fingerprint: fingerprint)
+          methods.transform_values do |(node_id, name, fingerprint, nesting)|
+            DefHandle.new(path: path, node_id: node_id, name: name, fingerprint: fingerprint, nesting: nesting)
           end
         end
       end
 
       # The empty per-run accumulator the def-index passes fold each file into.
       def new_def_index_accumulator
-        { def_nodes: {}, singleton_def_nodes: {}, def_sources: {}, singleton_def_sources: {},
-          superclasses: {}, includes: {}, method_visibilities: {}, methods: {}, class_sources: {},
+        { def_nodes: {}, def_nestings: {}.compare_by_identity,
+          singleton_def_nodes: {}, def_sources: {}, singleton_def_sources: {},
+          superclasses: {}, header_nestings: {}, includes: {}, extends: {}, method_visibilities: {}, methods: {},
+          class_sources: {},
+          constant_writes: {},
           data_member_layouts: {}, struct_member_layouts: {} }
       end
 
       # Post-processes and freezes a fully-folded def-index accumulator.
       def finalize_def_index(acc)
+        # Issue #644 — resolve the cross-file constant-reassignment rule here, where the whole project's
+        # write census is known, and turn the surviving literals into their published `Type::Constant`.
+        acc[:constant_values], acc[:constant_sources] = finalize_constant_writes(acc[:constant_writes])
+        fold_extends_into_singleton_tables(acc[:extends], acc[:def_nodes], acc[:singleton_def_nodes], acc[:methods])
         # Cross-file method suppression is for the project's OWN accessors (attr_* / define_method / alias) — NOT for
         # plain `def`s. A cross-file `def` on a class is exactly the ADR-17 monkey-patch case the undefined-method rule
         # deliberately surfaces (fire + def-site annotation, nudging `pre_eval:`), so dropping the `def`-declared names
@@ -2583,7 +3686,7 @@ module Rigor
         # for `obj.x` in another.
         acc[:methods] = subtract_def_methods(acc[:methods], acc[:def_nodes])
         %i[def_nodes singleton_def_nodes def_sources singleton_def_sources includes method_visibilities
-           methods class_sources].each do |key|
+           methods class_sources constant_sources].each do |key|
           acc[key].each_value(&:freeze)
         end
         acc.transform_values(&:freeze)
@@ -2616,23 +3719,35 @@ module Rigor
         # def-nodes ×2). See {#build_methods_and_def_nodes}.
         file_methods, file_def_nodes = build_methods_and_def_nodes(root, path)
         merge_discovered_defs(acc[:def_nodes], acc[:def_sources], path, file_def_nodes)
+        # Issue #681 — node-identity keyed, so this is a flat union: no two files can contribute the same key.
+        acc[:def_nestings].merge!(build_def_nestings(root))
         # ADR-46 slice 4 (singleton) — record the singleton-side `"path:line"` sources alongside the nodes,
         # the exact mirror of the instance-side `merge_discovered_defs`, so a class/singleton-method body edit
         # produces a changed `"Class.method"` fingerprint pair (and its call sites a symbol edge) instead of
         # silently degrading to the file's full ancestry closure.
         merge_discovered_defs(acc[:singleton_def_nodes], acc[:singleton_def_sources], path,
                               build_discovered_singleton_def_nodes(root))
-        superclasses = build_discovered_superclasses(root, path)
+        superclasses, header_nestings = build_superclass_tables(root, path)
         includes = build_discovered_includes(root)
         acc[:superclasses].merge!(superclasses)
-        includes.each do |class_name, mods|
-          acc[:includes][class_name] = ((acc[:includes][class_name] || []) + mods).uniq
-        end
+        merge_header_nestings(acc[:header_nestings], header_nestings)
+        accumulate_module_lists(acc[:includes], includes)
+        accumulate_module_lists(acc[:extends], build_discovered_extends(root))
         record_class_sources(acc[:class_sources], path, root, superclasses, includes, file_def_nodes)
+        merge_constant_literal_tables(acc, root, path)
         merge_class_keyed_index_tables(acc, root, file_methods)
         merge_member_layout_tables(acc, root)
       end
 
+      # Issue #644 — folds one file's publication census into the cross-file accumulator, keyed by
+      # (name, path) (kept out of {#accumulate_project_index} to hold its ABC budget). The conflict rule that
+      # makes the fold order irrelevant runs at {#finalize_constant_writes}.
+      def merge_constant_literal_tables(acc, root, path)
+        constant_writes_for_file(root).each do |name, descriptor|
+          (acc[:constant_writes][name] ||= {})[path] = descriptor
+        end
+      end
+
       # Folds one file's Data + Struct member-layout tables into the cross-file accumulator (kept out of
       # {#accumulate_project_index} to hold its ABC budget).
       def merge_member_layout_tables(acc, root)
@@ -2668,6 +3783,220 @@ module Rigor
         names.each { |name| (class_sources[name] ||= Set.new) << path }
       end
 
+      # Issue #644 — the cross-file VALUE-constant pre-pass, the twin of {#record_class_sources} for plain
+      # constant ASSIGNMENTS. Returns one file's **publication census**: `{qualified name => descriptor}`,
+      # where the descriptor is either `[literal]` (a publishable frozen scalar) or {CONSTANT_UNPUBLISHABLE}.
+      #
+      # EVERY constant write is censused, whatever its rvalue and whatever its form, because the census is
+      # three things at once and only the first cares about the value:
+      #
+      # 1. the published table ({#finalize_constant_writes}: a name publishes only when exactly one file
+      #    writes it and that write is a literal),
+      # 2. the attribution the ADR-46 positive edge reads, and
+      # 3. the producer whose per-file DIFF re-checks readers on an incremental run
+      #    ({Analysis::Incremental.changed_constant_publications}).
+      #
+      # A write the census cannot see does not merely lose precision — it silently bypasses the conflict rule
+      # and publishes a value the program does not have. That is why the operator / multi-assign / chained /
+      # `self::` forms below are censused as unpublishable rather than skipped.
+      #
+      # **Why the publishable set is only Symbol / Integer / Float.** Publishing turns `Dynamic[top]` into a
+      # real type at every reader in the project, which is precisely where a wrong answer becomes a diagnostic
+      # on correct code (AGENTS.md § "Implementation Guidelines"), so the recognised set is the one whose
+      # precision is worth that risk.
+      #
+      # - `String` / `Array` / `Hash` literals are MUTABLE. A sibling file's `PATH << "/x"` or `LIST.push(...)`
+      #   moves the value this table pinned, and only the DECLARING file's `widen_mutated_constants` census can
+      #   see such a mutation. The composite two additionally carry the `HashShape` / `Tuple` hazard
+      #   {PreEvalConstants} documents (a closed `HashShape` makes `CONFIG.fetch(:b)` fire; a `Tuple` routes
+      #   through `ShapeDispatch` instead of the RBS overload a call site relied on).
+      # - `nil` declines for {PreEvalConstants}' reason: at declaration position it is a placeholder for a
+      #   value assigned later far more often than it is a genuine `NilClass`.
+      # - `true` / `false` DO publish. They are branched on rather than dispatched to, so the value would fuel
+      #   `flow.always-truthy-condition` at every `if FEATURE_FLAG` in another file; that is withheld at the
+      #   rule instead ({Analysis::CheckRules::PublishedConstantGuard}), which is the repo's own answer to a
+      #   value that is real but must not be concluded from, and it keeps the treatment of every published
+      #   kind the same.
+      #
+      # Everything else — a method call, a constant alias, `ENV[...]`, a `Data.define` — is not a literal, so
+      # the reader keeps today's `Dynamic[top]`. Declining is always the safe answer.
+      #
+      # A name written TWICE in one file is unpublishable too, which is what makes a conditional
+      # `X = :a if c` / `X = :b` pair gradual rather than pinned to whichever arm the walk saw first.
+      def constant_writes_for_file(root)
+        writes = {}
+        walk_constant_write_census(root, [], writes, Set.new)
+        writes
+      end
+
+      # Mirrors {#walk_constant_writes}'s traversal for the forms it shares — the lexical class/module prefix
+      # qualifies a bare `ConstantWriteNode` — and extends it to the four forms that walk misses, each
+      # censused as unpublishable: an operator / `&&=` /
+      # `||=` constant write, a `ConstantTargetNode` under a `MultiWriteNode` (`A, B = :x, :y`), a `self::X =`
+      # whose target renders no qualified name, and the inner write of a chain (`C = D = :x`), which is why a
+      # `ConstantWriteNode` descends into its own rvalue instead of returning.
+      def walk_constant_write_census(node, qualified_prefix, writes, seen, self_owner = nil)
+        return unless node.is_a?(Prism::Node)
+
+        case node
+        when Prism::ClassNode, Prism::ModuleNode
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            walk_constant_write_census(node.body, child_prefix, writes, seen) if node.body
+            return
+          end
+        else
+          census_constant_write(node, qualified_prefix, writes, seen, self_owner)
+        end
+
+        rebound = rebound_block_self(node, qualified_prefix)
+        node.rigor_each_child do |child|
+          owner = rebound && child.is_a?(Prism::BlockNode) ? rebound : self_owner
+          walk_constant_write_census(child, qualified_prefix, writes, seen, owner)
+        end
+      end
+
+      # Censuses `node` when it is any constant-assigning form. Only a plain `ConstantWriteNode` /
+      # `ConstantPathWriteNode` can contribute a VALUE; every other form is recorded unpublishable, which
+      # suppresses publication of the name exactly as a second file's write would.
+      def census_constant_write(node, qualified_prefix, writes, seen, self_owner = nil)
+        case node
+        when Prism::ConstantWriteNode
+          record_constant_write_census(qualified_write_name(qualified_prefix, node.name.to_s),
+                                       constant_literal_value(node.value), writes, seen)
+        when Prism::ConstantPathWriteNode
+          record_constant_write_census(constant_path_write_name(node.target, qualified_prefix, self_owner),
+                                       constant_path_write_literal(node, self_owner), writes, seen)
+        when Prism::ConstantOperatorWriteNode, Prism::ConstantOrWriteNode, Prism::ConstantAndWriteNode
+          record_constant_write_census(qualified_write_name(qualified_prefix, node.name.to_s), nil, writes, seen)
+        when Prism::ConstantPathOperatorWriteNode, Prism::ConstantPathOrWriteNode, Prism::ConstantPathAndWriteNode
+          record_constant_write_census(constant_path_write_name(node.target, qualified_prefix, self_owner),
+                                       nil, writes, seen)
+        when Prism::MultiWriteNode
+          census_multi_write_constants(node, qualified_prefix, writes, seen, self_owner)
+        end
+      end
+
+      # `A, B = :x, :y` and `A, *rest = …`. A destructured element's value is a projection of the right-hand
+      # side, which this syntactic walk does not evaluate, so every constant target is censused unpublishable.
+      def census_multi_write_constants(node, qualified_prefix, writes, seen, self_owner = nil)
+        targets = node.lefts + node.rights
+        targets << node.rest if node.rest
+        targets.each do |target|
+          case target
+          when Prism::ConstantTargetNode
+            record_constant_write_census(qualified_write_name(qualified_prefix, target.name.to_s), nil, writes, seen)
+          when Prism::ConstantPathTargetNode
+            record_constant_write_census(constant_path_write_name(target, qualified_prefix, self_owner),
+                                         nil, writes, seen)
+          end
+        end
+      end
+
+      # The qualified name a constant-path write targets, for the PUBLICATION census only. `Foo::BAR = …`
+      # renders as written — deliberately NOT what {#constant_path_write_key} answers for the typed table,
+      # which resolves the namespace through the enclosing nesting
+      # ([#690](https://github.com/rigortype/rigor/issues/690)). Moving this one changes which name a value
+      # publishes to the whole project, an over-suppression question with its own safety story, so the two
+      # censuses key a path write differently until that is settled.
+      # `self::BAR = …` names whatever `self` is at that point, which the walk carries in `self_owner`
+      # ([#705](https://github.com/rigortype/rigor/issues/705)) — the enclosing lexical namespace in an
+      # ordinary body, the receiver inside a `class_eval` block. Where that `self` is {OPAQUE_SELF}, and for
+      # any other dynamic receiver (`klass::BAR = …`), the target is "some class, then `::BAR`" and the name
+      # falls back to the bare last segment — the one spelling that class could make it, `Object`. Suppressing
+      # a top-level name is gradual typing, which is the safe direction here; the VALUE is what such a write
+      # must not contribute ({#constant_path_write_literal}).
+      def constant_path_write_name(target, qualified_prefix, self_owner = nil)
+        full = Source::ConstantPath.qualified_name_or_nil(target)
+        return full if full
+
+        base = target.name&.to_s
+        return nil if base.nil?
+        return base unless target.parent.is_a?(Prism::SelfNode)
+
+        self_write_name(qualified_prefix, self_owner, base) || base
+      end
+
+      # The publishable literal a path write contributes — none, whenever its base is not statically
+      # nameable ([#705](https://github.com/rigortype/rigor/issues/705)). `[Foo].each { |k| k::X = 1 }`
+      # renders as the bare `X`, and publishing `1` under it handed every reader of the top-level `X` a value
+      # the program never has: `X == 2` folded to `false`, and in the WRITING file — where
+      # `Scope#local_constant_names` exempts the name from #644's withholding guard —
+      # `flow.always-truthy-condition` then fired on correct code.
+      #
+      # The NAME still enters the census, because a decline means opposite things in the two censuses. In the
+      # typed one, recording no type is gradual. Here, recording nothing would leave ANOTHER file's value for
+      # the name trusted — silence is the risky direction, and the census's own gradual answer is to say the
+      # name was touched and no value for it is safe.
+      def constant_path_write_literal(node, self_owner)
+        return nil unless nameable_write_target?(node.target, self_owner)
+
+        constant_literal_value(node.value)
+      end
+
+      # True when the census can name what the write targets: a static constant path, or a `self::BAR` whose
+      # `self` the walk resolved to a class or module.
+      def nameable_write_target?(target, self_owner)
+        return true if Source::ConstantPath.qualified_name_or_nil(target)
+        return false unless target.parent.is_a?(Prism::SelfNode)
+
+        !self_owner.equal?(OPAQUE_SELF)
+      end
+
+      def qualified_write_name(qualified_prefix, base_name)
+        qualified_prefix.empty? ? base_name : "#{qualified_prefix.join('::')}::#{base_name}"
+      end
+
+      # Records one censused write. `seen` carries the names this file has already written, so a repeat write
+      # retracts the publishable descriptor whatever either rvalue was — neither arm of an in-file
+      # reassignment is ever published, and the name still counts as written.
+      def record_constant_write_census(full, literal, writes, seen)
+        return if full.nil?
+
+        writes[full] = seen.add?(full) ? (literal || CONSTANT_UNPUBLISHABLE) : CONSTANT_UNPUBLISHABLE
+      end
+
+      # The frozen-scalar literal fold: `[value]` for a publishable rvalue, nil to decline. The one-element
+      # Array is the presence wrapper (`false` is a legitimate published value), and the raw Ruby value is
+      # what rides the ADR-85 seed bundle through `Marshal`.
+      def constant_literal_value(rvalue)
+        case rvalue
+        when Prism::SymbolNode then symbol_literal_publication(rvalue)
+        when Prism::IntegerNode, Prism::FloatNode then [rvalue.value]
+        when Prism::TrueNode then [true]
+        when Prism::FalseNode then [false]
+        end
+      end
+
+      # `Prism::SymbolNode` is the STATIC symbol node (a dynamic `:"#{x}"` parses as
+      # `InterpolatedSymbolNode` and never reaches here), so its unescaped text is the whole value.
+      def symbol_literal_publication(node)
+        text = node.unescaped
+        text.is_a?(String) ? [text.to_sym] : nil
+      end
+
+      # Issue #644 — materialises the published table and the write attribution from the folded census.
+      #
+      # A name publishes only when exactly ONE file writes it and that write is a literal. Two files writing
+      # the same qualified name is a cross-file reassignment whose winner is load order, so the name stays
+      # `Dynamic[top]` — the type it already had, and the widest there is. The rule runs at finalize (not at
+      # fold time) so the fold stays order-independent, which is what lets the ADR-85 incremental path re-fold
+      # a changed file's contribution in place.
+      #
+      # @return [Array(Hash, Hash)] `[{name => Type}, {name => Set[path]}]`.
+      def finalize_constant_writes(writes)
+        values = {}
+        sources = {}
+        writes.each do |name, by_path|
+          sources[name] = by_path.keys.to_set.freeze
+          next unless by_path.size == 1
+
+          descriptor = by_path.values.first
+          values[name] = Type::Combinator.constant_of(descriptor.first) if descriptor.is_a?(Array)
+        end
+        [values, sources]
+      end
+
       # Merges one file's `class → method → DefNode` map into the cross-file `def_nodes` index and records each method's
       # first- seen `"path:line"` definition site in `def_sources` (ADR-17 — the un-registered-project-patch signal
       # `call.undefined-method` and `rigor triage` key on).
@@ -2688,11 +4017,11 @@ module Rigor
 
         case node
         when Prism::ClassNode, Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          if name
-            full = (qualified_prefix + [name]).join("::")
+          child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+          if child_prefix
+            full = child_prefix.join("::")
             accumulator[full] = Type::Combinator.singleton_of(full)
-            return collect_class_decls(node.body, qualified_prefix + [name], accumulator) if node.body
+            return collect_class_decls(node.body, child_prefix, accumulator) if node.body
           end
         when Prism::ConstantWriteNode
           record_class_new_constant_decl(node, qualified_prefix, accumulator)
@@ -2775,7 +4104,32 @@ module Rigor
         identity_table = {}.compare_by_identity
         discovered = {}
         record_declarations(root, [], identity_table, discovered)
-        [identity_table.freeze, discovered.freeze]
+        [identity_table.freeze, synthesize_namespace_prefixes(discovered).freeze]
+      end
+
+      # Issue #528 — every proper prefix of a discovered COMPACT class name is a namespace module that
+      # provably exists at runtime, even when no `module X` declaration is anywhere in the source
+      # (Zeitwerk derives it from the directory: mastodon writes `class Api::V1::AccountsController`
+      # and never `module Api`). Registering the prefixes lets a bare `Api` read — and the inner
+      # ConstantReadNodes of every resolving constant path — type as the namespace singleton instead of
+      # falling to the unresolved fallback (~500 sites on mastodon). An explicitly-declared name always
+      # wins: prefixes never overwrite an existing entry.
+      def synthesize_namespace_prefixes(discovered)
+        additions = {}
+        discovered.each_key do |full|
+          next unless full.include?("::")
+
+          segments = full.split("::")
+          (1...segments.size).each do |keep|
+            prefix = segments.first(keep).join("::")
+            next if discovered.key?(prefix) || additions.key?(prefix)
+
+            additions[prefix] = Type::Combinator.singleton_of(prefix)
+          end
+        end
+        return discovered if additions.empty?
+
+        discovered.merge(additions)
       end
 
       def record_declarations(node, qualified_prefix, identity_table, discovered)
@@ -2794,14 +4148,13 @@ module Rigor
       end
 
       def record_class_or_module?(node, qualified_prefix, identity_table, discovered)
-        name = Source::ConstantPath.qualified_name(node.constant_path)
-        return false unless name
+        child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+        return false unless child_prefix
 
-        full = (qualified_prefix + [name]).join("::")
+        full = child_prefix.join("::")
         singleton = Type::Combinator.singleton_of(full)
         identity_table[node.constant_path] = singleton
         discovered[full] = singleton
-        child_prefix = qualified_prefix + [name]
         record_declarations(node.body, child_prefix, identity_table, discovered) if node.body
         true
       end
@@ -2818,7 +4171,8 @@ module Rigor
       # The block body, if present, is recursed into so any nested class/module declarations in the override block (rare
       # but legal) still feed the discovered table.
       def record_meta_new_constant?(node, qualified_prefix, identity_table, discovered)
-        return false unless data_define_call?(node.value) || struct_new_call?(node.value)
+        factory_call = resolve_meta_factory_call(node.value)
+        return false unless factory_call
 
         full = (qualified_prefix + [node.name.to_s]).join("::")
         discovered[full] = Type::Combinator.singleton_of(full)
@@ -2932,6 +4286,5 @@ module Rigor
         propagate(node.else_clause, table, truthy_scope) if node.else_clause
       end
     end
-    # rubocop:enable Metrics/ModuleLength
   end
 end