rigortype 0.3.9 → 0.4.1

data/lib/rigor/analysis/check_rules.rb

@@ -6,6 +6,7 @@ require_relative "../reflection"
 require_relative "../source/node_walker"
 require_relative "../source/constant_path"
 require_relative "../inference/singleton_object_constant"
+require_relative "shadow_harness"
 require_relative "../type"
 require_relative "diagnostic"
 require_relative "dependency_recorder"
@@ -25,6 +26,9 @@ require_relative "check_rules/ivar_write_collector"
 require_relative "check_rules/main_pass_collector"
 require_relative "check_rules/void_value_use_collector"
 require_relative "check_rules/self_closedness_scanner"
+require_relative "check_rules/source_arity"
+require_relative "check_rules/lexical_method_sites"
+require_relative "check_rules/special_global_setters"
 
 module Rigor
   module Analysis
@@ -57,10 +61,9 @@ module Rigor
       # ADR-87 WD4 — the canonical rule-id table lives in the light `check_rules/rule_ids.rb` (required at the
       # top of this file) so {Analysis::RuleCatalog} can read it without loading the engine.
 
-      # ADR-35 slice 1 — bound for the `def.override-visibility-reduced`
-      # ancestor walk, and the public > protected > private ordering
-      # used to decide whether an override reduces visibility.
-      OVERRIDE_ANCESTOR_WALK_LIMIT = 100
+      # ADR-35 slice 1 — the public > protected > private ordering used to decide whether an override reduces
+      # visibility. The override rules' ancestor walk is bounded by `Scope::ANCESTOR_WALK_LIMIT`, the
+      # resolution chain's.
       VISIBILITY_RANK = { public: 2, protected: 1, private: 0 }.freeze
 
       # Resolves a user-supplied rule token (`undefined-method`,
@@ -135,24 +138,37 @@ module Rigor
       # (`diagnose`'s `Source::NodeWalker.each` `case`), now invoked by
       # {MainPassCollector} on the shared {RuleWalk}. Returns the
       # diagnostics for one node, in the same emission order as before.
-      def main_pass_node_diagnostics(path, node, scope_index)
+      def main_pass_node_diagnostics(path, node, scope_index, eval_ranges = nil, lexical_sites = nil)
         case node
         when Prism::CallNode
-          call_node_diagnostics(path, node, scope_index)
+          call_node_diagnostics(path, node, scope_index, eval_ranges, lexical_sites)
         when Prism::DefNode
           [
-            return_type_mismatch_diagnostic(path, node, scope_index),
+            refinement_aware_return_type_mismatch(path, node, scope_index, lexical_sites),
             override_visibility_diagnostic(path, node, scope_index),
             override_return_widened_diagnostic(path, node, scope_index),
             override_param_narrowed_diagnostic(path, node, scope_index)
           ].compact
         when Prism::IfNode, Prism::UnlessNode
           [unreachable_branch_diagnostic(path, node, scope_index)].compact
+        when Prism::GlobalVariableWriteNode, Prism::GlobalVariableOperatorWriteNode, Prism::MultiWriteNode
+          special_global_write_diagnostics(path, node, scope_index, lexical_sites)
         else
           []
         end
       end
 
+      # Issue #1120, maintainer ruling a′ — a `def` in a `refine X do … end` body redefines X's method by design, so
+      # X's declared return for the name is not its contract and a mismatch against it is not reported. Every other
+      # check in the body stands. The refine-body test runs only once a mismatch would report, so a file pays the
+      # {LexicalMethodSites} walk only then.
+      def refinement_aware_return_type_mismatch(path, node, scope_index, lexical_sites)
+        diagnostic = return_type_mismatch_diagnostic(path, node, scope_index)
+        return diagnostic if diagnostic.nil? || lexical_sites.nil?
+
+        lexical_sites.refinement_def?(node) ? nil : diagnostic
+      end
+
       # Constructs the fresh, unpopulated built-in collector set keyed by
       # role, including the main pass. Split out so the converged walk
       # (ADR-53 B4) can build the collectors, drive them via a
@@ -160,9 +176,12 @@ module Rigor
       # traversal, and hand the populated set back to {.diagnose} as
       # `node_collectors:`. The main pass needs `path` because its per-node
       # diagnostics carry it (ADR-53 B3c hosts it on the same walk).
-      def build_node_collectors(path, scope_index)
+      def build_node_collectors(path, scope_index, root = nil)
+        eval_ranges = receiver_eval_block_ranges(root)
+        lexical_sites = LexicalMethodSites.new(root)
+        main_pass = ->(node) { main_pass_node_diagnostics(path, node, scope_index, eval_ranges, lexical_sites) }
         {
-          main_pass: MainPassCollector.new(->(node) { main_pass_node_diagnostics(path, node, scope_index) }),
+          main_pass: MainPassCollector.new(main_pass),
           void_value_use: VoidValueUseCollector.new(scope_index),
           always_truthy: AlwaysTruthyConditionCollector.new(scope_index),
           unreachable_clauses: UnreachableClauseCollector.new(scope_index),
@@ -195,9 +214,9 @@ module Rigor
       # divergence aborts the run — the corpus-scale half of the
       # equivalence harness (the curated half is `rule_walk_equivalence_spec`).
       def run_node_collectors(path, root, scope_index)
-        collectors = build_node_collectors(path, scope_index)
+        collectors = build_node_collectors(path, scope_index, root)
         RuleWalk.run(root, collectors.values)
-        shadow_verify_node_collectors(path, root, scope_index, collectors) if ENV["RIGOR_SHADOW_RULE_WALK"]
+        shadow_verify_node_collectors(path, root, scope_index, collectors) if ShadowHarness.enabled?
         collectors
       end
 
@@ -239,8 +258,10 @@ module Rigor
       # produces them on the shared walk.
       def main_pass_oracle(path, root, scope_index)
         diagnostics = []
+        eval_ranges = receiver_eval_block_ranges(root)
+        lexical_sites = LexicalMethodSites.new(root)
         Source::NodeWalker.each(root) do |node|
-          diagnostics.concat(main_pass_node_diagnostics(path, node, scope_index))
+          diagnostics.concat(main_pass_node_diagnostics(path, node, scope_index, eval_ranges, lexical_sites))
         end
         diagnostics
       end
@@ -260,10 +281,10 @@ module Rigor
         shadow_verify_node_collectors(path, root, scope_index, collectors)
       end
 
-      def call_node_diagnostics(path, node, scope_index)
+      def call_node_diagnostics(path, node, scope_index, eval_ranges = nil, lexical_sites = nil)
         [
-          undefined_method_diagnostic(path, node, scope_index),
-          unresolved_toplevel_diagnostic(path, node, scope_index),
+          undefined_method_diagnostic(path, node, scope_index, lexical_sites),
+          unresolved_toplevel_diagnostic(path, node, scope_index, eval_ranges),
           wrong_arity_diagnostic(path, node, scope_index),
           argument_type_diagnostic(path, node, scope_index),
           nil_receiver_diagnostic(path, node, scope_index),
@@ -657,7 +678,7 @@ module Rigor
       class << self
         private
 
-        def undefined_method_diagnostic(path, call_node, scope_index) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        def undefined_method_diagnostic(path, call_node, scope_index, lexical_sites = nil) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
           return nil if call_node.receiver.nil?
 
           scope = scope_index[call_node]
@@ -665,10 +686,20 @@ module Rigor
 
           # The two exemptions that hold whatever shape the receiver has. Ahead of the receiver-shape
           # branch below because a plugin is consulted ONCE for the whole receiver, union included, so the
-          # gate belongs where that one consult is rather than duplicated into each shape's path. On the
-          # union side that is placement, not demonstrated coverage: no fixture reaches the gate through
-          # `union_undefined_method_diagnostic` today — every plugin-typed union anyone has built carries a
-          # `Singleton` arm, which `union_arm_blocks_undefined_fire?` declines on outright.
+          # gate belongs where that one consult is rather than duplicated into each shape's path.
+          #
+          # The union side of that placement IS reachable, contrary to what this comment used to say. The
+          # shape needs a non-nil union of at least two RBS-DECLARED classes — an undeclared arm is an
+          # ADR-26 open receiver and `union_arm_blocks_undefined_fire?` bails before the method lookup,
+          # which is why the earlier probes read silent and were misread as the gate being unreachable.
+          # `spec/integration/composite_receiver_plugin_typed_suppression_spec.rb` builds it. What keeps
+          # the gate from firing there today is that the dispatcher no longer records a plugin-typed call
+          # it declined (#1101), not that no such union can be built.
+          #
+          # Note what the gate would do if it were reached: the scalar `Ledger#settle` a plugin declares
+          # is exempt here, while `(Ledger | Invoice)#settle` is not, because the union rule's own
+          # `method_present_anywhere?` reads RBS and project source and never asks the registry. Closing
+          # that asymmetry is #653's union coverage, not this rule's placement.
           # See {#call_site_exempt?}.
           return nil if call_site_exempt?(call_node, scope)
 
@@ -739,7 +770,7 @@ module Rigor
           method_def = lookup_method(receiver_type, class_name, call_node.name, scope)
           return nil if method_def
 
-          return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind)
+          return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites)
 
           definition_site = project_definition_site(scope, class_name, call_node.name, kind)
           # Issue #735 — the site is evidence, and whose RBS this is decides what it is evidence OF. On a
@@ -754,9 +785,54 @@ module Rigor
           build_undefined_method_diagnostic(path, call_node, receiver_type, definition_site, class_name)
         end
 
-        # The two probes that run only once every cheaper answer has come back "absent", kept together
+        # Issue #1120 — the method exists at THIS call site but not everywhere: a refinement whose `using` is in
+        # effect here, or a `def o.m` on the receiver local in this scope. Asked from {#last_resort_surface_answers?},
+        # once every project-wide table has come back "absent", so the file walk behind {LexicalMethodSites} runs
+        # only for a call about to fire.
+        # A refinement answers instance-side receivers only: a refined singleton (`refine X.singleton_class`) names
+        # no constant target, so nothing records it.
+        def lexically_defined_method?(class_name, call_node, scope, kind, lexical_sites)
+          return false if lexical_sites.nil?
+          return true if lexical_sites.singleton_local_def?(call_node)
+          return false unless kind == :instance
+
+          # ADR-46 — the answer below is a function of every refinement of this name in the project, so the
+          # consumer depends on the name whichever way it answers; a refine body edited in another file must
+          # re-check it (`IncrementalSession#refinement_affected`).
+          DependencyRecorder.read_name(:refinement, call_node.name) if DependencyRecorder.active?
+          modules = refining_modules(scope, class_name, call_node.name)
+          !modules.nil? && lexical_sites.refinement_active?(call_node, modules)
+        end
+
+        # Issue #1120 — every module that refines `method_name` into `class_name` or one of its ancestors (a
+        # refinement of `Object` reaches a `String` receiver), or nil when none does. The table is empty on a
+        # project that refines nothing, which answers without a lookup.
+        def refining_modules(scope, class_name, method_name)
+          refinements = scope.discovered_refinements
+          return nil if refinements.empty?
+
+          modules = nil
+          refinements.each do |refined, methods|
+            names = methods[method_name]
+            next if names.nil? || !refined_receiver_class?(scope, class_name, refined)
+
+            (modules ||= []).concat(names)
+          end
+          modules
+        end
+
+        def refined_receiver_class?(scope, class_name, refined)
+          return true if class_name == refined
+
+          environment = scope.environment
+          !environment.nil? && environment.class_ordering(class_name, refined) == :subclass
+        end
+
+        # The probes that run only once every cheaper answer has come back "absent", kept together
         # because they share that position and nothing else.
         #
+        # - Issue #1120 — a method that exists at this call site only: a refinement in effect here, or a
+        #   singleton `def` on the receiver local ({#lexically_defined_method?}).
         # - Issue #739 — an instance-side MODULE receiver. A value typed as a mixin module is an instance of
         #   some class that includes it, and that class contributes an arbitrary surface: inside
         #   `module Attachable::InstanceMethods`, `self.project` is defined by the ActiveRecord model that
@@ -777,7 +853,8 @@ module Rigor
         #   it"; a project ancestor still might, and the typer has already resolved the site through
         #   exactly this walk. It is last because it is the only probe here that walks the class graph
         #   (see {#ancestry_declares_method?} for why that placement is load-bearing, not tidiness).
-        def last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind)
+        def last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites = nil)
+          return true if lexically_defined_method?(class_name, call_node, scope, kind, lexical_sites)
           return true if module_mixin_receiver?(receiver_type, scope)
           return true if mixin_self_class_receiver?(call_node, scope)
           return true if unknown_mixin_includer?(class_name, scope)
@@ -933,7 +1010,7 @@ module Rigor
         # Authored severity is `:warning`; the severity profile
         # remaps it (`strict` → `:error`, `balanced` →
         # `:warning`, `lenient` → `:off` / suppressed).
-        def unresolved_toplevel_diagnostic(path, call_node, scope_index)
+        def unresolved_toplevel_diagnostic(path, call_node, scope_index, eval_ranges = nil)
           return nil unless call_node.receiver.nil?
 
           scope = scope_index[call_node]
@@ -944,10 +1021,51 @@ module Rigor
           return nil if scope.top_level_def_for(name)
           return nil if source_declared_method?(scope, "Object", name, :instance)
           return nil if Rigor::Reflection.instance_method_definition("Object", name, scope: scope)
+          # `Target.class_eval { def added = 1; def use_added = added }` files the defs on Target
+          # but leaves the eval body with a nil `self_type`, so `toplevel?` still holds. An eval
+          # body is morally a class body, so ADR-34 stays silent there — including on a genuinely
+          # undefined name inside the block. Ranges are computed once per file.
+          return nil if call_inside_receiver_eval_ranges?(eval_ranges, call_node)
 
           build_unresolved_toplevel_diagnostic(path, call_node)
         end
 
+        # ScopeIndexer keeps RECEIVER_EVAL_CALLS private; this list is the same family
+        # (`class_eval` / `module_eval` / `class_exec` / `module_exec` / `instance_eval` /
+        # `instance_exec`). Used only to decline ADR-34 inside those blocks.
+        RECEIVER_EVAL_CALL_NAMES = %i[
+          class_eval module_eval class_exec module_exec instance_eval instance_exec
+        ].freeze
+        private_constant :RECEIVER_EVAL_CALL_NAMES
+        EMPTY_EVAL_RANGES = [].freeze
+        private_constant :EMPTY_EVAL_RANGES
+
+        def receiver_eval_block_ranges(root)
+          return EMPTY_EVAL_RANGES if root.nil?
+
+          ranges = []
+          Source::NodeWalker.each(root) do |node|
+            next unless node.is_a?(Prism::CallNode)
+            next unless RECEIVER_EVAL_CALL_NAMES.include?(node.name)
+
+            block = node.block
+            next unless block.is_a?(Prism::BlockNode)
+
+            loc = block.location
+            ranges << [loc.start_offset, loc.end_offset]
+          end
+          ranges
+        end
+
+        def call_inside_receiver_eval_ranges?(eval_ranges, call_node)
+          return false if eval_ranges.nil? || eval_ranges.empty?
+
+          loc = call_node.location
+          eval_ranges.any? do |start_offset, end_offset|
+            loc.start_offset >= start_offset && loc.end_offset <= end_offset
+          end
+        end
+
         def build_unresolved_toplevel_diagnostic(path, call_node)
           Diagnostic.from_message_loc(
             call_node,
@@ -1449,7 +1567,7 @@ module Rigor
         # by `undefined_method_diagnostic`; it returns nil
         # when the call's receiver / RBS coverage / call shape
         # disqualifies the rule.
-        # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
+        # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         def wrong_arity_diagnostic(path, call_node, scope_index)
           return nil if call_node.receiver.nil?
           return nil unless plain_positional_call?(call_node)
@@ -1481,25 +1599,110 @@ module Rigor
           # `.new` against the real `Struct.new(*Symbol)` signature is a
           # false positive. Skip arity-checking the chained position.
           return nil if anonymous_struct_new_call?(call_node, class_name, kind)
-          return nil if scope.discovered_method?(class_name, call_node.name, kind)
-
-          return nil unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
-          return nil unless definition_available?(receiver_type, class_name, scope)
 
-          method_def = trustworthy_signature(receiver_type, class_name, call_node, scope)
-          return nil if method_def.nil?
-          return nil if undeclared_constructor?(class_name, call_node, kind, method_def)
-
-          arity_envelope = compute_arity_envelope(method_def)
+          arity_envelope = arity_envelope_for(receiver_type, class_name, call_node, scope, kind)
           return nil if arity_envelope.nil?
 
           actual = (call_node.arguments&.arguments || []).size
-          min, max = arity_envelope
-          return nil if actual.between?(min, max)
+          min, max, source_arity = arity_envelope
+          if actual.between?(min, max)
+            source_arity&.settle_by_definitions
+            return nil
+          end
+          # Issue #992 — a source envelope's remaining declines can only withhold, so they run only now.
+          source_arity&.settle_by_walk
+          return nil if source_arity && !source_arity.authoritative?(class_name)
 
           build_arity_diagnostic(path, call_node, class_name, min, max, actual)
         end
 
+        # The `[min, max]` the call is checked against — a declared signature's, or (issue #992) the project
+        # `def`'s own when no signature declares the method, with the {SourceArity} that found it as a third
+        # element — or nil when neither may be trusted.
+        #
+        # Issue #991 — `discovered_method?` used to exempt the call outright before ever asking for a
+        # declaration. `trustworthy_signature` is the same lookup `argument_type_diagnostic` treats as
+        # authoritative over a source `def` (see its own comment beside that call), and the two rules must agree
+        # on whose contract binds, so a declared method is checked against its declaration.
+        def arity_envelope_for(receiver_type, class_name, call_node, scope, kind)
+          if Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
+            return nil unless definition_available?(receiver_type, class_name, scope)
+
+            method_def = trustworthy_signature(receiver_type, class_name, call_node, scope)
+            if method_def && !Rigor::RbsExtended.inferred_signature?(method_def)
+              return nil if undeclared_constructor?(class_name, call_node, kind, method_def)
+
+              return compute_arity_envelope(method_def)
+            end
+            return nil unless source_lane_open?(method_def, receiver_type, class_name, call_node, scope)
+          end
+
+          source_arity_envelope(class_name, call_node, scope, kind)
+        end
+
+        # Issue #992 — whether a class RBS knows may still be checked against its project `def`. Two lanes:
+        #
+        # - the member resolved and carries `%a{rigor:v1:inferred-signature}`: under ADR-93 the bundled
+        #   `rigor-rbs-inline` plugin emits a full skeleton for EVERY `def` in a file carrying at least one
+        #   annotation (#823), with every type slot defaulted, so nobody asserted anything about it. Its arity
+        #   is NOT read here — the `def`'s envelope is, through the same {SourceArity} walk as a method with no
+        #   member at all, so one `def` is never judged by two readings of its parameter list;
+        # - no member resolved, and the class's declaration is the project's own `sig/`
+        #   (`project_declared_class?`): a partial sidecar of a project class whose `def` lives in source.
+        #
+        # Everything else declines. A bundled declaration (core / stdlib / gem) describes a class the project
+        # does not own, so a project `def` on it is an ADR-17 monkey-patch that another library may patch too;
+        # a lookup that raised, or a name an open receiver only inherited (`trustworthy_signature` answered
+        # nil for those while a raw lookup does not), is not "no member".
+        def source_lane_open?(method_def, receiver_type, class_name, call_node, scope)
+          return true if method_def
+
+          lookup_method(receiver_type, class_name, call_node.name, scope).nil? &&
+            Rigor::Reflection.project_declared_class?(class_name, scope: scope)
+        end
+
+        # Issue #992 — stage 1 of {SourceArity}: the nearest project definition's envelope, after the
+        # receiver-level declines that need no walk. Stage 2 (`SourceArity#authoritative?`) runs only once the
+        # count is known to fall outside it.
+        def source_arity_envelope(class_name, call_node, scope, kind)
+          return nil unless scope.discovered_parameter_envelopes.key?(Scope::DiscoveryIndex::ENVELOPE_PROJECT_WIDE)
+          return nil if unbounded_receiver_surface?(class_name, scope)
+          return nil if plugin_typed_call?(call_node, scope)
+          # An instance of a project module is an instance of whatever includes it (#739's reasoning, which
+          # `module_mixin_receiver?` can only apply to a module RBS declares).
+          return nil if kind == :instance && project_module?(class_name, scope)
+          return nil if project_module_class_receiver?(call_node, scope)
+
+          arity = SourceArity.new(scope, call_node.name, kind)
+          envelope = arity.owner_envelope(class_name)
+          if envelope.nil? || envelope[2]
+            envelope.nil? && arity.ambiguous? ? arity.settle_by_walk : arity.settle_by_definitions
+            return nil
+          end
+
+          [envelope[0], envelope[1] || Float::INFINITY, arity]
+        end
+
+        # `self.class.f(1)` inside a project module's instance method: the engine types `self.class` as the
+        # module's singleton, but at runtime it is the includer's class, whose class methods are its own. The
+        # source-lane twin of {#mixin_self_class_receiver?}, which can only see a module RBS declares.
+        def project_module_class_receiver?(call_node, scope)
+          receiver = call_node.receiver
+          return false unless receiver.is_a?(Prism::CallNode) && receiver.name == :class && receiver.arguments.nil?
+          return false if receiver.receiver.nil?
+
+          inner = concrete_class_name(scope.type_of(receiver.receiver))
+          !inner.nil? && project_module?(inner, scope)
+        end
+
+        # Read off the table directly rather than through `Scope#parameter_envelopes_of`: a class does not turn
+        # into a module without its declaration (and so the receiver's own typing) changing, so this answer
+        # needs no ADR-46 class edge of its own.
+        def project_module?(class_name, scope)
+          bucket = scope.discovered_parameter_envelopes[class_name.to_s]
+          !bucket.nil? && bucket.key?(Scope::DiscoveryIndex::ENVELOPE_MODULE_MARK)
+        end
+
         # Issue #917 — no loaded RBS declares a constructor for this class. The definition builder
         # synthesizes `.new` from the nearest `initialize` in the ancestry, and when nothing declares
         # one that is `BasicObject#initialize: () -> void`, so `.new` derives a nullary envelope that
@@ -1640,7 +1843,10 @@ module Rigor
           # {DeclarationSourcedGuard} exactly what it asked before — but it
           # now asks it through the predicate the argument-type gates share
           # (issue #324), which is what keeps the two rules from drifting.
-          return nil if DeclarationSourcedGuard.marked?(call_node.receiver, scope)
+          #
+          # Issue #1362 — a local copied from a global still on its declared seed (`sep = $/`) is asked against the
+          # file's writes to that global instead: its declared `nil` is withheld, and one the file writes still fires.
+          return nil if DeclarationSourcedGuard.withholds_nil?(call_node.receiver, scope)
 
           # ADR-67 WD6b — an inferred-parameter receiver's type (incl. any nil constituent unioned in from a
           # nil call site) is an open-call-site lower bound; a possible-nil firing against it is an FP by
@@ -2165,6 +2371,200 @@ module Rigor
           )
         end
 
+        # Issue #1367 (ADR-117 Decision point 1, WD2) — `global.write-type-mismatch` and `global.readonly-write`: a
+        # write to a special global that the interpreter's setter rejects, so the write raises every time it runs.
+        # The envelope is {SpecialGlobalSetters}: the setter, not the global's RBS declaration.
+        #
+        # - `global.readonly-write` needs no type. `$g = v`, `$g op= v` and a target of a multiple assignment
+        #   (`$g, x = …`, `*$g`) always write, so a write to a read-only special raises.
+        # - `global.write-type-mismatch` checks `$g = v` only when `v` is a literal node
+        #   ({SpecialGlobalSetters.literal_class}), whose class the syntax fixes. Any other value is never reported,
+        #   whatever its inferred type: a class RBS declares without `write` or `to_str` does not prove the object
+        #   lacks it (a singleton `def`, an `extend`, or a run-time `alias to_str to_s`, as URI has).
+        # - `$g ||= v` and `$g &&= v` write only when the current value is falsy (truthy), so neither rule checks
+        #   them, nor a `for` index or a `rescue => $g` reference.
+        # - A special that any project file aliases (`alias $stdout $out`, either side) is exempt from both.
+        def special_global_write_diagnostics(path, node, scope_index, lexical_sites)
+          case node
+          when Prism::GlobalVariableWriteNode
+            [readonly_global_write_diagnostic(path, node, scope_index) ||
+              global_write_type_diagnostic(path, node, scope_index, lexical_sites)].compact
+          when Prism::GlobalVariableOperatorWriteNode
+            [readonly_global_write_diagnostic(path, node, scope_index)].compact
+          when Prism::MultiWriteNode
+            multi_write_global_targets(node).filter_map do |target|
+              readonly_global_write_diagnostic(path, target, scope_index)
+            end
+          else
+            []
+          end
+        end
+
+        # The `GlobalVariableTargetNode`s a multiple assignment writes, through a splat (`*$g`) and nested
+        # destructuring (`(a, $g), b = …`).
+        def multi_write_global_targets(node)
+          [*node.lefts, node.rest, *node.rights].flat_map do |target|
+            case target
+            when Prism::GlobalVariableTargetNode then [target]
+            when Prism::SplatNode
+              target.expression.is_a?(Prism::GlobalVariableTargetNode) ? [target.expression] : []
+            when Prism::MultiTargetNode then multi_write_global_targets(target)
+            else []
+            end
+          end
+        end
+
+        def readonly_global_write_diagnostic(path, node, scope_index)
+          return nil unless SpecialGlobalSetters.read_only?(node.name)
+
+          scope = scope_index[node]
+          return nil if scope.nil? || global_aliased?(scope, node.name)
+
+          location = node.respond_to?(:name_loc) ? node.name_loc : node.location
+          Diagnostic.from_location(
+            location,
+            rule: RULE_GLOBAL_READONLY_WRITE,
+            path: path,
+            message: "`#{node.name}' is a read-only variable; this write raises NameError at runtime",
+            severity: :error
+          )
+        end
+
+        def global_write_type_diagnostic(path, node, scope_index, lexical_sites)
+          contract = SpecialGlobalSetters.contract_for(node.name)
+          return nil if contract.nil?
+
+          class_name = SpecialGlobalSetters.literal_class(node.value)
+          return nil if class_name.nil?
+
+          scope = scope_index[node]
+          return nil if scope.nil?
+          return nil unless literal_rejected?(class_name, contract, node, scope, lexical_sites)
+          return nil if global_aliased?(scope, node.name)
+
+          build_global_write_type_diagnostic(path, node, contract, class_name)
+        end
+
+        # The project's {Inference::GlobalWriteCensus} with the `pre_eval:` files' own.
+        def global_write_census(scope)
+          census = scope.discovered_global_write_census
+          pre_eval = scope.environment&.project_patched_methods&.write_census
+          pre_eval.nil? || pre_eval.empty? ? census : census | pre_eval
+        end
+
+        # Whether any project or `pre_eval:` file aliases `name`, on either side, which can make it another variable.
+        def global_aliased?(scope, name)
+          Inference::GlobalWriteCensus.aliased?(global_write_census(scope), name)
+        end
+
+        # A literal is rejected when its class is none the setter takes and, for a setter that also converts
+        # (`to_str`, `to_int`) or asks for `write`, the literal's object cannot answer that method.
+        def literal_rejected?(class_name, contract, node, scope, lexical_sites)
+          return false if contract.accepts_class?(class_name)
+          return true if contract.conversion.nil?
+
+          !literal_may_answer?(class_name, contract.conversion, node, scope, lexical_sites)
+        end
+
+        # The escape hatches through which an object answers a method its class does not define: the setter's
+        # `respond_to?` and implicit conversion both consult them.
+        GLOBAL_WRITE_HATCHES = %i[method_missing respond_to_missing? respond_to?].freeze
+        private_constant :GLOBAL_WRITE_HATCHES
+
+        # Where RBS core declares the hatches every object inherits unchanged.
+        DEFAULT_HATCH_OWNERS = %w[::BasicObject ::Kernel ::Object].freeze
+        private_constant :DEFAULT_HATCH_OWNERS
+
+        # Whether the literal's object may answer `method_name` after all:
+        #
+        # - RBS gives its class the method, or a hatch of its own (a project `sig/` reopening or `include` counts);
+        # - the program defines the method or a hatch anywhere, in any spelling, on any receiver
+        #   ({Inference::GlobalWriteCensus}): no census of where a definition lands can be complete
+        #   (`class << nil`, `K = Integer; class K`, `[Integer].each { |k| k.define_method(:write) }`);
+        # - an ancestor's surface is rewritten from outside (`Integer.include(M)`, `Object.include(M)`, a string
+        #   `class_eval`: the `ENVELOPE_DYNAMIC_MARK`), or it or `Object` mixes in a module RBS does not rule out;
+        # - for `write` only, a refinement that may add it is in effect at the write ({#refined_writer_in_effect?}).
+        def literal_may_answer?(class_name, method_name, node, scope, lexical_sites)
+          definition = Rigor::Reflection.instance_definition(class_name, scope: scope)
+          return true if definition.nil?
+          return true if definition.methods.key?(method_name) || overridden_hatch?(definition)
+
+          ancestors = definition.ancestors.ancestors.to_set { |ancestor| ancestor.name.to_s.delete_prefix("::") }
+          names = [method_name, *GLOBAL_WRITE_HATCHES]
+          census = global_write_census(scope)
+          program_may_answer?(ancestors, names, census, scope) ||
+            (method_name == :write && refined_writer_in_effect?(census, node, lexical_sites))
+        end
+
+        def overridden_hatch?(definition)
+          GLOBAL_WRITE_HATCHES.any? do |name|
+            method = definition.methods[name]
+            method && !DEFAULT_HATCH_OWNERS.include?(method.defined_in.to_s)
+          end
+        end
+
+        def program_may_answer?(ancestors, names, census, scope)
+          return true if Inference::GlobalWriteCensus.defines_any_of?(census, names)
+
+          dynamic_mark = Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK
+          return true if ancestors.any? { |owner| scope.parameter_envelopes_of(owner).key?(dynamic_mark) }
+
+          main_mixins = Inference::GlobalWriteCensus.main_mixins(census)
+          main_mixins.any? { |mixin| rbs_mixin_may_answer?(mixin, names, scope) } ||
+            mixin_may_answer?(ancestors, names, scope)
+        end
+
+        # A module an ancestor of the literal's class mixes in through a class body (`class Integer; include
+        # Writable; end`), followed through the modules it mixes in in turn. A project module answers when its
+        # surface is rewritten beyond literal names (a `send(:include, …)`, a non-constant mixin); its literal
+        # definitions are the census's. Any other module answers when RBS does not know it or declares one of
+        # `names`.
+        def mixin_may_answer?(ancestors, names, scope)
+          queue = ancestors.flat_map { |owner| scope.includes_of(owner) }
+          seen = Set.new
+          until queue.empty?
+            mixin = queue.shift
+            next unless seen.add?(mixin)
+
+            bucket = scope.parameter_envelopes_of(mixin)
+            if bucket.key?(Scope::DiscoveryIndex::ENVELOPE_MODULE_MARK)
+              return true if bucket.key?(Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK)
+
+              queue.concat(scope.includes_of(mixin))
+            elsif rbs_mixin_may_answer?(mixin, names, scope)
+              return true
+            end
+          end
+          false
+        end
+
+        def rbs_mixin_may_answer?(mixin, names, scope)
+          definition = Rigor::Reflection.instance_definition(mixin, scope: scope)
+          definition.nil? || definition.methods.key?(names.first) || overridden_hatch?(definition)
+        end
+
+        # For `write` only: some refinement may add `write` (a `def`, `define_method` or `alias_method` in a `refine`
+        # block, or an `import_methods`), and a `using` is in effect at the write. Which class it refines is not asked:
+        # the target may be computed (`[Array].each { |k| refine(k) { … } }`) or a constant alias (`T = Array;
+        # refine(T)`), so a refined `write` on any class declines every literal. `respond_to?(:write)` honours an
+        # active refinement on Ruby 4.0.5; a refined `respond_to_missing?` or `respond_to?`, and every implicit
+        # conversion, do not, so a refinement that adds only those leaves the write reported.
+        def refined_writer_in_effect?(census, node, lexical_sites)
+          Inference::GlobalWriteCensus.refines_write?(census) &&
+            (lexical_sites.nil? || lexical_sites.using_in_effect?(node))
+        end
+
+        def build_global_write_type_diagnostic(path, node, contract, class_name)
+          Diagnostic.from_name_loc(
+            node,
+            rule: RULE_GLOBAL_WRITE_TYPE_MISMATCH,
+            path: path,
+            message: "`#{node.name}' accepts only #{contract.accepts}; this write assigns " \
+                     "#{SpecialGlobalSetters.literal_description(class_name)}, which raises TypeError at runtime",
+            severity: :error
+          )
+        end
+
         # v0.1.2 — `flow.unreachable-branch`. Fires when an `IfNode` / `UnlessNode` whose predicate is a
         # literal `true` / `false` / `nil` (or a literal numeric / string / symbol whose Ruby truthiness is
         # known at-a-glance) has an observable dead branch. The diagnostic points at the dead branch (not
@@ -2231,6 +2631,9 @@ module Rigor
         #   `Prism::SelfNode` are also skipped — Ruby 2.7+ permits `self.foo` for private methods.
         # - Receiver MUST resolve to a `Type::Nominal` so the rule has a single class identity to query.
         #   Unions / Dynamic / shape carriers are skipped.
+        # - Issue #1568 — a module the class PREPENDS sits ahead of it in Ruby's order, so a definition there
+        #   is what the call reaches; the class's own private `def` answers only when nothing prepended
+        #   defines the name ({#reached_definer_visibility}).
         def visibility_mismatch_diagnostic(path, call_node, scope_index)
           return nil unless explicit_non_self_receiver?(call_node.receiver)
 
@@ -2247,9 +2650,33 @@ module Rigor
           visibility = scope.discovered_method_visibility(receiver_type.class_name, call_node.name)
           return nil unless visibility == :private
 
+          reached = reached_definer_visibility(scope, receiver_type.class_name, call_node.name)
+          return nil if reached == :undecided
+          return nil unless reached.nil? || reached == :private
+
           build_visibility_mismatch_diagnostic(path, call_node, receiver_type)
         end
 
+        # Issue #1568, ADR-119 C1c — the recorded visibility of the definition a call on `class_name` reaches: the
+        # first project entry on the class's {Scope::ResolutionChain} from its head that records the name, so a
+        # module the class PREPENDS answers ahead of the class. `Inference::DefinerResolution` reads it with the
+        # `:visibility` question's default answer. It is `:undecided` wherever the chain does not settle the order
+        # (an unpositioned or forked mixin, a conditional include) or an ancestor ahead of the definer may define
+        # the name (one RBS does not know), and the caller declines; a definer whose visibility slot ADR-119's
+        # producers contest is not alone (`DefinerResolution` asks the next candidate too), so it is `:undecided`
+        # there without a read of the table here. nil is nothing recording the name at all, and the class's own
+        # visibility stands. An ancestor the project does not declare is passed over, as the method lookup passes it.
+        def reached_definer_visibility(scope, class_name, method_name)
+          case Inference::DefinerResolution.resolve(scope, class_name, method_name, :instance, question: :visibility)
+          in Inference::DefinerResolution::Known(answer:)
+            answer
+          in Inference::DefinerResolution::UNKNOWN
+            :undecided
+          in Inference::DefinerResolution::ABSENT
+            nil
+          end
+        end
+
         def explicit_non_self_receiver?(receiver)
           return false if receiver.nil?
           return false if receiver.is_a?(Prism::SelfNode)
@@ -2503,7 +2930,7 @@ module Rigor
           return nil if method_def.nil?
 
           param_overrides = Rigor::RbsExtended.param_type_override_map(method_def, environment: scope.environment)
-          mismatch = argument_mismatch(method_def.method_types, call_node, scope, param_overrides)
+          mismatch = argument_mismatch(method_def.method_types, call_node, scope, param_overrides, scope_index)
           return nil if mismatch.nil?
           return nil if inferred_param_mismatch_verdict?(call_node, mismatch, scope)
 
@@ -2529,12 +2956,15 @@ module Rigor
         # overload rejects) plus, on non-coerce methods, the non-nil channel
         # (a single-concrete-class argument every overload rejects). See
         # {#multi_overload_argument_mismatch}.
-        def argument_mismatch(method_types, call_node, scope, param_overrides)
+        #
+        # Each argument is typed from its own index entry, which is the call's unless an earlier operand moved
+        # the scope it was entered from (issue #1256): `(k = 0; 5)[k]` checks `k` as the `0` it holds there.
+        def argument_mismatch(method_types, call_node, scope, param_overrides, scope_index)
           mismatch =
             if method_types.size == 1
-              first_argument_mismatch(method_types.first, call_node, scope, param_overrides)
+              first_argument_mismatch(method_types.first, call_node, scope, param_overrides, scope_index)
             else
-              multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides)
+              multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides, scope_index)
             end
           return nil if mismatch && keyword_bearing?(method_types) && nil_tainted?(mismatch[:actual])
 
@@ -2586,28 +3016,35 @@ module Rigor
         #   stays deferred), and decides acceptance on the RBS param type
         #   ({#param_accepts_arg_class?}) so it sees through the `int` / `string`
         #   interface-aliases the translator degrades.
-        def multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides)
+        def multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides, scope_index)
           functions = method_types.map(&:type)
           return nil unless functions.all? { |function| argument_check_eligible?(function) }
 
           coerce_method = COERCE_DISPATCH_METHODS.include?(call_node.name)
           arguments = call_node.arguments&.arguments || []
           arguments.each_with_index do |arg, index|
-            arg_type = scope.type_of(arg)
             params = checkable_overload_params(method_types, index, param_overrides, scope)
             next if params.nil?
 
-            mismatch =
-              if nil_member?(arg_type) # pure nil only — not a `T | nil` union
-                nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
-              elsif !coerce_method
-                non_nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
-              end
+            mismatch = overload_argument_mismatch(arg, params, param_overrides,
+                                                  argument_scope(arg, scope, scope_index), coerce_method)
             return mismatch if mismatch
           end
           nil
         end
 
+        # The mismatch (or nil) for one argument against the parameter every overload has at its position. Issue
+        # #1362 — a builtin global's seed, or its copy, is judged by the file's writes to the global.
+        def overload_argument_mismatch(arg, params, param_overrides, arg_scope, coerce_method)
+          written = DeclarationSourcedGuard.written_type(arg, arg_scope)
+          arg_type = written || arg_scope.type_of(arg)
+          if nil_member?(arg_type) # pure nil only — not a `T | nil` union
+            nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, arg_scope, written: !written.nil?)
+          elsif !coerce_method
+            non_nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, arg_scope)
+          end
+        end
+
         # The parameter set at `index` that a verdict may rest on, or nil when there is none — the two
         # reasons being arity divergence (an overload with no param there, which is `call.wrong-arity`'s
         # concern) and an overload whose param names a class carrying no definition ({#stub_typed_param?},
@@ -2623,8 +3060,8 @@ module Rigor
 
         # The nil channel: a pure `nil` argument no overload admits (ADR-58
         # parity excuses a declaration-sourced ivar nil).
-        def nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
-          return nil if declaration_sourced_nil_argument?(arg, scope)
+        def nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope, written: false)
+          return nil if !written && declaration_sourced_nil_argument?(arg, scope)
           return nil if params.any? { |param| param_admits_nil?(param, param_overrides, scope) }
 
           { node: arg, name: nil, expected: overload_param_expected_label(params), actual: arg_type }
@@ -2891,7 +3328,7 @@ module Rigor
           DeclarationSourcedGuard.marked?(arg, scope)
         end
 
-        def first_argument_mismatch(method_type, call_node, scope, param_overrides)
+        def first_argument_mismatch(method_type, call_node, scope, param_overrides, scope_index)
           function = method_type.type
           return nil unless argument_check_eligible?(function)
 
@@ -2901,12 +3338,17 @@ module Rigor
             param = params[index]
             next if param.nil? # arity mismatch is the wrong-arity rule's concern.
 
-            mismatch = single_argument_mismatch(param, arg, scope, param_overrides)
+            mismatch = single_argument_mismatch(param, arg, argument_scope(arg, scope, scope_index), param_overrides)
             return mismatch if mismatch
           end
           nil
         end
 
+        # The scope `arg` is checked from: its own index entry ({#argument_mismatch}), else the call's.
+        def argument_scope(arg, call_scope, scope_index)
+          scope_index[arg] || call_scope
+        end
+
         # The mismatch (or nil) for one positional argument against one
         # parameter. The nil channel decides a pure `nil` argument on the RBS
         # parameter type — seeing through the `string` / `int` interface-alias
@@ -2917,6 +3359,17 @@ module Rigor
         def single_argument_mismatch(param, arg, scope, param_overrides)
           return nil if stub_typed_param?(param, param_overrides, scope)
 
+          # Issue #1362 (ADR-58 parity, ADR-117 Decision point 2) — a read of a builtin global still on its declared
+          # seed, or a local copied from one, is judged by the file's writes to the global, as the argument was
+          # before the join: the declared members are not diagnostic fuel.
+          written = DeclarationSourcedGuard.written_type(arg, scope)
+          return written_argument_mismatch(param, arg, written, scope, param_overrides) if written
+
+          read_argument_mismatch(param, arg, scope, param_overrides)
+        end
+
+        # {#single_argument_mismatch} for an argument that reads no builtin global's seed directly.
+        def read_argument_mismatch(param, arg, scope, param_overrides)
           arg_type = scope.type_of(arg)
 
           if nil_member?(arg_type)
@@ -2930,10 +3383,42 @@ module Rigor
           return nil if param_type.is_a?(Type::Dynamic) || param_type.is_a?(Type::Top)
           return nil if arg_type.is_a?(Type::Dynamic) || arg_type.is_a?(Type::Top)
           return nil unless argument_genuinely_mismatches?(arg, arg_type, param_type, scope)
+          # Issue #1362 — a value that mixes such a global with something else (`c ? $stdout : StringIO.new`) is judged
+          # without the declared members the file never writes, as it was before the join.
+          return nil if DeclarationSourcedGuard.declared_only_rejection?(arg_type, param_type, scope) do |stripped|
+            !plain_argument_rejects?(param, stripped, scope, param_overrides)
+          end
 
           { node: arg, name: param.name, expected: param_type, actual: arg_type }
         end
 
+        # The mismatch for an argument judged by `written`, the file's writes to the builtin globals it reads the
+        # seeds of, through the channels {#single_argument_mismatch} runs, without the ADR-58 withholding: before
+        # the join the global carried no mark.
+        def written_argument_mismatch(param, arg, written, scope, param_overrides)
+          return nil unless plain_argument_rejects?(param, written, scope, param_overrides)
+
+          expected =
+            if nil_member?(written)
+              overload_param_expected_label([param])
+            else
+              param_overrides[param.name] || translate_param_type(param.type, scope.environment)
+            end
+          { node: arg, name: param.name, expected: expected, actual: written }
+        end
+
+        # True when `param` rejects an argument of type `type` on the terms of {#single_argument_mismatch}'s nil and
+        # non-nil channels, without the ADR-58 withholding.
+        def plain_argument_rejects?(param, type, scope, param_overrides)
+          return !param_admits_nil?(param, param_overrides, scope) if nil_member?(type)
+
+          param_type = param_overrides[param.name] || translate_param_type(param.type, scope.environment)
+          return false if param_type.is_a?(Type::Dynamic) || param_type.is_a?(Type::Top)
+          return false if type.is_a?(Type::Dynamic) || type.is_a?(Type::Top)
+
+          Inference::Acceptance.accepts(param_type, type, mode: :gradual).no?
+        end
+
         # The parameter rejects the argument AND the rejection is not a
         # withheld declaration-sourced-nil case.
         def argument_genuinely_mismatches?(arg, arg_type, param_type, scope)
@@ -3100,15 +3585,28 @@ module Rigor
           declared = declared_return_type(def_node, scope_index)
           return nil if declared.nil?
 
-          inferred = inner_scope.type_of(last_expr)
+          # Issue #1362 — a body that ends on a builtin global still on its declared seed, or on a local copied from
+          # one, is judged by the file's writes to the global, as for an argument ({#single_argument_mismatch}).
+          inferred = DeclarationSourcedGuard.written_type(last_expr, inner_scope) || inner_scope.type_of(last_expr)
           return nil if dynamic_top?(inferred)
 
           severity = compare_return(declared, inferred)
           return nil if severity.nil?
+          return nil if declared_only_return?(last_expr, inferred, declared, inner_scope)
 
           build_return_type_mismatch_diagnostic(path, def_node, declared, inferred, severity)
         end
 
+        # Issue #1362 — a body that ends on a value mixing a builtin global's seed with something else is judged
+        # without the declared members the file never writes, as for an argument.
+        def declared_only_return?(last_expr, inferred, declared, scope)
+          return false unless DeclarationSourcedGuard.global_sources(last_expr, scope).empty?
+
+          DeclarationSourcedGuard.declared_only_rejection?(inferred, declared, scope) do |stripped|
+            compare_return(declared, stripped).nil?
+          end
+        end
+
         # The body of a `def` is the last `Prism::StatementsNode` child (or a single expression for
         # one-liner defs). Take the last statement; that's the implicit return.
         def body_last_expression(body)
@@ -3138,8 +3636,11 @@ module Rigor
           self_type = scope.self_type
           return nil unless self_type.respond_to?(:class_name)
 
+          side = def_node.receiver.nil? ? receiverless_def_side(scope, self_type.class_name, def_node) : :singleton
+          return nil if side.nil?
+
           method_def =
-            if def_node.receiver.nil? && !singleton_context_def?(scope, self_type.class_name, def_node.name)
+            if side == :instance
               Reflection.instance_method_definition(self_type.class_name, def_node.name, scope: scope)
             else
               Reflection.singleton_method_definition(self_type.class_name, def_node.name, scope: scope)
@@ -3153,14 +3654,26 @@ module Rigor
           declared_return_union(method_def, scope.environment)
         end
 
-        # A receiverless `def` inside `class << self` is a singleton def; the def NODE alone cannot say
-        # so, but the discovery walk recorded it under the singleton kind (and not the instance kind).
-        # Without this, `class << self; def load` compared its body against `Kernel#load: -> bool` — the
-        # inherited INSTANCE method — instead of its own `def self.load` signature. A name defined on
-        # both facets stays on the instance lookup (the pre-existing conservative reading).
-        def singleton_context_def?(scope, class_name, method_name)
-          scope.discovered_method?(class_name, method_name, :singleton) &&
-            !scope.discovered_method?(class_name, method_name, :instance)
+        # Which side a receiverless `def` defines, from the indexer's own record of THAT node: the instance table
+        # holding it makes it an instance def, the singleton table (`class << self` bodies, and a `def` under
+        # `Const.instance_eval` that the indexer attributes to the singleton) a singleton def. A node neither table
+        # holds (a `def` in a block whose `self` the engine does not model, such as `E.class_eval do` inside
+        # `class << self`, a redefinition a later `def` replaced) or both do is `nil`, and the caller declines: no
+        # world is consulted, but the record cannot say which signature the body answers to.
+        def receiverless_def_side(scope, class_name, def_node)
+          instance = same_def_node?(scope.user_def_for(class_name, def_node.name), def_node)
+          singleton = same_def_node?(scope.singleton_def_for(class_name, def_node.name), def_node)
+          return :instance if instance && !singleton
+          return :singleton if singleton && !instance
+
+          nil
+        end
+
+        # The tables hold the live node or one re-resolved from a `DefHandle`, so identity is the name and span.
+        def same_def_node?(recorded, def_node)
+          recorded.is_a?(Prism::DefNode) && recorded.name == def_node.name &&
+            recorded.location.start_offset == def_node.location.start_offset &&
+            recorded.location.end_offset == def_node.location.end_offset
         end
 
         # `type_vars:` — ADR-35 WD9 tier 1. When the caller supplies a generic-instantiation
@@ -3268,82 +3781,57 @@ module Rigor
           override_rank < parent_rank
         end
 
-        # Breadth-first walk of the project-discovered ancestor chain (included / prepended modules first,
-        # then the superclass — Ruby's MRO ordering), yielding each resolved ancestor class name
-        # nearest-first. Returns the first truthy value the block produces, or nil. Cross-file: the chain
-        # is followed through the scope tables the runner seeds from the project pre-pass (ADR-24 WD1).
-        # Cycle-guarded and node-count-capped. Mirrors `ExpressionTyper#resolve_user_def_through_ancestors`.
-        def each_project_ancestor(scope, class_name)
-          queue = ancestor_class_names(scope, class_name)
-          seen = { class_name.to_s => true }
-          visited = 0
-          until queue.empty?
-            current = queue.shift
-            next if current.nil? || seen[current]
-
-            seen[current] = true
-            visited += 1
-            return nil if visited > OVERRIDE_ANCESTOR_WALK_LIMIT
-
-            result = yield current
-            return result if result
-
-            ancestor_class_names(scope, current).each { |name| queue.push(name) }
-          end
-          nil
+        # The project ancestors whose definitions `class_name`'s own `def` OVERRIDES are the entries AFTER the
+        # class on its {Scope::ResolutionChain}, nearest first; {#nearest_ancestor_visibility} and
+        # {#nearest_ancestor_method_def} each read the first of them that answers their question through
+        # `Inference::DefinerResolution` (ADR-119 C1c), `from:` the position after the class. Both are instance
+        # side only: the singleton override rules do not exist, and the singleton side's own read lands with
+        # ADR-119's singleton design.
+        #
+        # Issue #1568 — the walk this replaced was breadth-first from the class's direct ancestors, and those
+        # include the modules the class PREPENDS. A prepended module sits BEFORE the class in Ruby's order: its
+        # `def` overrides the class's, not the other way round, so `prepend P` with a public `P#foo` and a
+        # private `C#foo` reported `C#foo` as reducing `P#foo`'s visibility. It also reached `Base` before a
+        # module included through an included module (#1567's order).
+        #
+        # ADR-119 WD3 — for the two override lints *absent* always counts: a chain that does not settle (a mixin
+        # whose position the tables cannot vouch for, a fork whose worlds disagree, a conditional or
+        # block-scoped `include`), or an external ancestor ahead of the parent that RBS does not know or knows
+        # and declares the name in, is `UNKNOWN`, and the lint stays silent rather than answer from the
+        # breadth-first order the walk used before (`Scope::ResolutionChain::MasterOrder`) where the order is
+        # not known. The two lints read only the `[owner, value]` of a `Known`.
+        #
+        # ADR-46 slice 3 — an ancestor the project does not declare ends the walk's reach into it, and a class
+        # defined LATER under that name would change the answer; `DefinerResolution` files the negative class
+        # edge of each external entry it tests.
+        def overridden_ancestors_start(scope, class_name)
+          own = Scope::ResolutionChain.for(scope, class_name.to_s, :instance, :methods).index_of(class_name.to_s)
+          own && (own + 1)
         end
 
         # `[defining_class, visibility]` for the nearest user-source ancestor that defines an instance
         # method `method_name`, or nil.
         def nearest_ancestor_visibility(scope, class_name, method_name)
-          each_project_ancestor(scope, class_name) do |ancestor|
-            # Stop at the nearest ancestor that DEFINES the method; its visibility may be nil (unknown) —
-            # the caller treats unknown as "cannot prove a reduction" and stays silent. Never fabricate
-            # `:public` from a missing entry (that produced a large false-positive cluster on cross-file
-            # Rails concerns).
-            [ancestor, scope.discovered_method_visibility(ancestor, method_name)] if scope.user_def_for(ancestor,
-                                                                                                        method_name)
-          end
-        end
-
-        # Direct ancestors of `class_name` as project-discovered, qualified names: included / prepended
-        # modules first, then the superclass. As-written names are resolved against the nesting the
-        # subclass's declaration header is written in (`Scope#ancestor_name_candidates`, the single owner of
-        # that order); names that resolve to no project class/module (RBS-known / third-party) are dropped.
-        def ancestor_class_names(scope, class_name)
-          names = []
-          scope.includes_of(class_name).each do |raw|
-            resolved = resolve_override_ancestor_name(scope, class_name, raw)
-            names << resolved if resolved
-          end
-          raw_super = scope.superclass_of(class_name)
-          if raw_super
-            resolved_super = resolve_override_ancestor_name(scope, class_name, raw_super)
-            names << resolved_super if resolved_super
+          from = overridden_ancestors_start(scope, class_name)
+          return nil if from.nil?
+
+          case Inference::DefinerResolution.resolve(scope, class_name, method_name, :instance,
+                                                    question: :override, from: from) do |ancestor|
+                 # Stop at the nearest ancestor that DEFINES the method; its visibility may be nil (unknown) —
+                 # the caller treats unknown as "cannot prove a reduction" and stays silent. Never fabricate
+                 # `:public` from a missing entry (that produced a large false-positive cluster on
+                 # cross-file Rails concerns). The `:unrecorded` marker stands for that nil in the answer.
+                 next unless scope.user_def_for(ancestor, method_name)
+
+                 scope.discovered_method_visibility(ancestor, method_name) || :unrecorded
+               end
+          in Inference::DefinerResolution::Known(answer: [owner, visibility])
+            [owner, visibility == :unrecorded ? nil : visibility]
+          in Inference::DefinerResolution::UNKNOWN # the case/in contract needs one arm per answer
+            nil
+          in Inference::DefinerResolution::ABSENT # rubocop:disable Lint/DuplicateBranch -- see above
+            nil
           end
-          names
-        end
-
-        # Issue #732 — the predicate is asked of the SCOPE, not re-implemented here. This rule kept its own
-        # three-table copy until #723 widened the scope's with `discovered_methods` and left this one behind,
-        # so the two disagreed about exactly one shape (a project class with no instance def, no superclass
-        # and no include — `class Base; def self.build = :built; end`) with nothing observing the fork. #682
-        # made `Scope` the single owner of the candidate ORDER; this makes it the single owner of the
-        # predicate that filters those candidates too.
-        def resolve_override_ancestor_name(scope, subclass_qualified, raw_ancestor)
-          resolved = scope.ancestor_name_candidates(subclass_qualified, raw_ancestor)
-                          .find { |candidate| scope.known_user_class?(candidate) }
-          return resolved if resolved
-
-          # ADR-46 slice 3 — the override checker reads the class graph
-          # directly (not through the recorder's `Scope` choke points), and
-          # short-circuits when the ancestor resolves to no project class, so
-          # an incremental re-check has no edge telling it to re-check this
-          # subclass when that ancestor is later defined. Record a negative
-          # class edge (keyed on the unqualified name) so the appeared-class
-          # widening picks it up.
-          DependencyRecorder.read_missing(:class, raw_ancestor.to_s.split("::").last) if DependencyRecorder.active?
-          nil
         end
 
         def build_override_visibility_diagnostic(path, def_node, parent_class, parent_visibility, override_visibility)
@@ -3423,9 +3911,23 @@ module Rigor
         # `[defining_class, RBS::Definition::Method]` for the nearest project-discovered ancestor whose
         # RBS declares `method_name` (not the starting class's own declaration), or nil.
         def nearest_ancestor_method_def(scope, class_name, method_name)
-          each_project_ancestor(scope, class_name) do |ancestor|
-            method_def = safe_instance_method_definition(ancestor, method_name, scope)
-            [ancestor, method_def] if method_def && !defined_on?(method_def, class_name)
+          from = overridden_ancestors_start(scope, class_name)
+          return nil if from.nil?
+
+          case Inference::DefinerResolution.resolve(scope, class_name, method_name, :instance,
+                                                    question: :override, from: from) do |ancestor|
+                 method_def = safe_instance_method_definition(ancestor, method_name, scope)
+                 # The signature text is the answer two worlds compare: an `RBS::Definition::Method` has no
+                 # structural equality of its own.
+                 method_def.method_types.map(&:to_s) if method_def && !defined_on?(method_def, class_name)
+               end
+          in Inference::DefinerResolution::Known(owner:)
+            method_def = safe_instance_method_definition(owner, method_name, scope)
+            method_def && [owner, method_def]
+          in Inference::DefinerResolution::UNKNOWN # the case/in contract needs one arm per answer
+            nil
+          in Inference::DefinerResolution::ABSENT # rubocop:disable Lint/DuplicateBranch -- see above
+            nil
           end
         end