rigortype 0.4.0 → 0.4.1

data/lib/rigor/inference/scope_indexer.rb

@@ -20,6 +20,7 @@ require_relative "last_status"
 require_relative "error_info"
 require_relative "hash_lookup_mutation"
 require_relative "index_write_widening"
+require_relative "module_function_state"
 require_relative "multi_target_binder"
 require_relative "mutation_widening"
 require_relative "narrowing"
@@ -27,6 +28,14 @@ require_relative "operand_effects"
 require_relative "statement_evaluator"
 require_relative "struct_fold_safety"
 require_relative "unknown_store_widening"
+require_relative "declaration_walk/traversal"
+require_relative "scope_indexer/class_cvars_collector"
+require_relative "scope_indexer/superclasses_collector"
+require_relative "scope_indexer/def_nestings_collector"
+require_relative "scope_indexer/layered_def_nestings"
+require_relative "scope_indexer/mixin_accumulator"
+require_relative "scope_indexer/certainty"
+require_relative "scope_indexer/member_layouts_collector"
 
 module Rigor
   module Inference
@@ -98,8 +107,8 @@ module Rigor
         # propagates it across every derived scope.
         # Issue #722 residue 2 — the project's settled declaration names are the oracle the file's own
         # compact headers are re-anchored against. `discovered_class_sources` would be the more direct
-        # reading, but it is seeded only under `--record-dependencies`; this table is the one every run
-        # carries, and the fold has already applied its own re-anchoring to it.
+        # reading, but it names files rather than settled declarations, and the fold has already applied its
+        # own re-anchoring to this table.
         declared_types, discovered_classes =
           build_declaration_artifacts(root, default_scope.discovered_classes.keys.to_set)
         # Merge the indexer's findings on top of whatever the base scope already carries so callers that seed cross-file
@@ -152,7 +161,9 @@ module Rigor
         # discovered-methods existence table and the instance def-node table — see {#build_methods_and_def_nodes}.
         # `seed_discovered_methods` seeds the former onto the scope and returns the def-node table for
         # `merge_project_method_indexes` below.
-        seeded_scope, file_def_nodes, file_envelopes = seed_discovered_methods(seeded_scope, default_scope, root)
+        # ADR-119 WD3 — the file's possible contributions, classified once for both def-contribution walks.
+        certainty = Certainty.possible_nodes(root)
+        seeded_scope, file_tables = seed_discovered_methods(seeded_scope, default_scope, root, certainty)
 
         # v0.0.2 #5 + ADR-24 slice 2 — record per-instance-method def nodes, the class -> superclass map, and the
         # class/module -> included-modules map, each merged under the cross-file pre-pass seed (see below). v0.1.2 —
@@ -160,7 +171,7 @@ module Rigor
         # `def.method-visibility-mismatch` and ADR-35 `def.override-visibility-reduced` CheckRules consult the table.
         # Seeded inside `merge_project_method_indexes` so the per-file visibilities merge OVER the cross-file project
         # seed rather than overwriting it.
-        seeded_scope = merge_project_method_indexes(seeded_scope, default_scope, root, file_def_nodes, file_envelopes)
+        seeded_scope = merge_project_method_indexes(seeded_scope, default_scope, root, file_tables, certainty)
 
         table = {}.compare_by_identity
         table.default = seeded_scope
@@ -187,11 +198,22 @@ module Rigor
       # onto `seeded_scope` (merged UNDER the cross-file pre-pass seed `default_scope` carries), and returns `[scope,
       # file_def_nodes, file_envelopes]` so the caller can thread the def-node and issue #992 envelope tables into
       # {#merge_project_method_indexes} without walking the file a second time.
-      def seed_discovered_methods(seeded_scope, default_scope, root)
-        file_methods, file_def_nodes, file_envelopes, file_refinements =
-          build_methods_and_def_nodes(root, default_scope.source_path)
-        discovered_methods = deep_merge_class_methods(default_scope.discovered_methods, file_methods)
-        discovery = seeded_scope.discovery.with(discovered_methods: discovered_methods)
+      #
+      # ADR-119 WD3 — the file's `possible_discovered_methods` folds over the seed's by {#fold_possible_methods}, so a
+      # name the file defines certainly is no longer possible and a name only the file's possible contribution
+      # supplies becomes possible. The file's other siblings are returned for {#merge_project_method_indexes}.
+      def seed_discovered_methods(seeded_scope, default_scope, root, certainty = Certainty.possible_nodes(root))
+        file_methods, file_def_nodes, file_envelopes, file_refinements, file_siblings =
+          build_methods_and_def_nodes(root, default_scope.source_path, certainty: certainty)
+        seed_methods = default_scope.discovered_methods
+        discovered_methods = deep_merge_class_methods(seed_methods, file_methods)
+        discovery = seeded_scope.discovery.with(
+          discovered_methods: discovered_methods,
+          possible_discovered_methods: fold_possible_methods(
+            seeded_scope.discovery.possible_discovered_methods, seed_methods,
+            file_siblings[:possible_discovered_methods], file_methods
+          )
+        )
         # Issue #1120 — only a file that refines something pays the overlay; the cross-file seed already carries
         # every other file's refinements.
         unless file_refinements.empty?
@@ -199,7 +221,7 @@ module Rigor
             discovered_refinements: merge_refinement_tables(default_scope.discovered_refinements, file_refinements)
           )
         end
-        [seeded_scope.with_discovery(discovery), file_def_nodes, file_envelopes]
+        [seeded_scope.with_discovery(discovery), [file_def_nodes, file_envelopes, file_siblings]]
       end
 
       # ADR-48 Struct slice 3 — installs the top-level fold-safe-local set ({Inference::StructFoldSafety}). Struct
@@ -220,19 +242,22 @@ module Rigor
       # Issue #992 — the envelope table is JOINED with the seed rather than overlaid: the seed already carries this
       # file's own contribution (identical, so the join keeps it), and a reopening in a sibling file must still
       # make a disagreeing name opaque here, which "same-file declarations win" would silently undo.
-      def merge_project_method_indexes(seeded_scope, default_scope, root, file_def_nodes, file_envelopes)
-        def_nodes, def_nestings = merge_def_node_tables(default_scope, root, file_def_nodes)
-        singleton_def_nodes = merge_singleton_def_nodes(default_scope, root)
-        superclasses, header_nestings = merge_ancestry_tables(default_scope, root)
-        includes, prepends = merge_mixin_tables(default_scope, root)
+      #
+      # `file_tables` is `[file_def_nodes, file_envelopes, file_siblings]` from {#seed_discovered_methods}.
+      def merge_project_method_indexes(seeded_scope, default_scope, root, file_tables,
+                                       certainty = Certainty.possible_nodes(root))
+        # ADR-116 WD5 — the superclass, def-nesting and member-layout tables come from ONE shared walk.
+        walked = declaration_walk_tables(root, default_scope.source_path)
+        def_nodes, def_nestings = merge_def_node_tables(default_scope, walked, file_tables[0])
+        singleton_def_nodes, file_singleton = merge_singleton_def_nodes(default_scope, root, certainty)
+        superclasses, header_nestings = merge_ancestry_tables(default_scope, walked)
+        includes, prepends, *mixin_unpositioned = merge_mixin_tables(default_scope, root)
         # ADR-35 — per-file visibilities merged OVER the cross-file seed (the current file is authoritative for its own
         # classes; sibling-file ancestors are preserved from the project seed).
-        method_visibilities = default_scope.discovered_method_visibilities.merge(
-          build_discovered_method_visibilities(root)
-        ) { |_class, cross_file, per_file| cross_file.merge(per_file) }
+        method_visibilities, file_visibilities = merge_method_visibilities(default_scope, root, certainty)
         # ADR-48 — per-file Data + Struct member layouts merged OVER the cross-file seed (same-file declaration is
         # authoritative).
-        data_member_layouts, struct_member_layouts = merge_member_layouts(default_scope, root)
+        data_member_layouts, struct_member_layouts = merge_member_layouts(default_scope, walked)
 
         # #526 — this file's extends folded against the MERGED instance def-nodes (so `extend M` sees a
         # sibling-file M through the cross-file seed). The project-wide fold in {#finalize_def_index}
@@ -240,8 +265,11 @@ module Rigor
         #
         # Issue #898 — and the same walk's table is now kept, merged over the cross-file seed the way
         # `includes` is: `Narrowing` asks it what a class object's singleton ancestry holds.
-        extends, methods_table = merge_and_fold_extends(default_scope, root, def_nodes,
-                                                        singleton_def_nodes, seeded_scope)
+        siblings = per_file_siblings(seeded_scope.discovery.sibling_tables, file_tables[0], file_tables[2],
+                                     file_singleton, file_visibilities)
+        extends, methods_table, unpositioned =
+          merge_and_fold_extends(default_scope, root, def_nodes, singleton_def_nodes, seeded_scope, siblings,
+                                 mixin_unpositioned)
 
         seeded_scope.with_discovery(
           seeded_scope.discovery.with(
@@ -252,23 +280,60 @@ module Rigor
             discovered_superclasses: superclasses,
             discovered_header_nestings: header_nestings,
             discovered_includes: includes,
-            discovered_prepends: prepends,
-            discovered_extends: extends,
+            discovered_prepends: prepends, discovered_extends: extends,
+            unpositioned_mixins: unpositioned,
             discovered_method_visibilities: method_visibilities,
-            discovered_parameter_envelopes: merge_envelope_seed(default_scope, file_envelopes),
-            data_member_layouts: data_member_layouts,
-            struct_member_layouts: struct_member_layouts,
-            discovered_deferred_ranges: merge_deferred_ranges_seed(default_scope, root)
+            discovered_parameter_envelopes: merge_envelope_seed(default_scope, file_tables[1]),
+            data_member_layouts: data_member_layouts, struct_member_layouts: struct_member_layouts,
+            discovered_deferred_ranges: merge_deferred_ranges_seed(default_scope, root),
+            # ADR-119 WD1/WD3 — the seed's siblings with this file's folded in ({#per_file_siblings}: the file wins
+            # every slot it writes), which the extends fold above then followed (copy on write, so the seed's
+            # tables are never written).
+            **siblings
           )
         )
       end
 
+      # Returns `[merged table, [file table, file contested slots]]` ({#build_method_visibility_tables}).
+      def merge_method_visibilities(default_scope, root, certainty)
+        file_visibilities = build_method_visibility_tables(root, certainty: certainty)
+        merged = default_scope.discovered_method_visibilities.merge(
+          file_visibilities.first
+        ) { |_class, cross_file, per_file| cross_file.merge(per_file) }
+        [merged, file_visibilities]
+      end
+
       # Per-file singleton def nodes merged OVER the cross-file seed (same-file declaration is
       # authoritative for its own classes, sibling-file defs are preserved).
-      def merge_singleton_def_nodes(default_scope, root)
-        default_scope.discovered_singleton_def_nodes.merge(
-          build_discovered_singleton_def_nodes(root)
+      #
+      # Returns `[merged table, [file table, file contested slots]]` ({#build_singleton_def_tables}).
+      def merge_singleton_def_nodes(default_scope, root, certainty)
+        file_singleton = build_singleton_def_tables(root, certainty: certainty)
+        merged = default_scope.discovered_singleton_def_nodes.merge(
+          file_singleton.first
         ) { |_class, cross_file, per_file| cross_file.merge(per_file) }
+        [merged, file_singleton]
+      end
+
+      # ADR-119 WD3 — the per-file merge of the slot siblings, under the members' own merges: this file's
+      # `def_nodes`, singleton defs and visibilities win every slot they write, so the seed's contest on those keys
+      # is replaced by the file's ({#fold_slot_contests}); the envelopes are joined, so their contests union. The
+      # possible methods were folded already ({#seed_discovered_methods}).
+      def per_file_siblings(siblings, file_def_nodes, file_siblings, file_singleton, file_visibilities)
+        file_singleton_def_nodes, file_singleton_contested = file_singleton
+        siblings[:contested_discovered_method_visibilities] = fold_slot_contests(
+          siblings[:contested_discovered_method_visibilities], *file_visibilities
+        )
+        siblings[:contested_discovered_def_nodes] = fold_slot_contests(
+          siblings[:contested_discovered_def_nodes], file_def_nodes, file_siblings[:contested_discovered_def_nodes]
+        )
+        siblings[:contested_discovered_singleton_def_nodes] = fold_slot_contests(
+          siblings[:contested_discovered_singleton_def_nodes], file_singleton_def_nodes, file_singleton_contested
+        )
+        siblings[:contested_discovered_parameter_envelopes] = union_paths(
+          siblings[:contested_discovered_parameter_envelopes], file_siblings[:contested_discovered_parameter_envelopes]
+        )
+        siblings
       end
 
       # Issue #1123 — the two instance-side mixin tables, from ONE descent of this file. Each merges over
@@ -284,28 +349,60 @@ module Rigor
           end,
           default_scope.discovered_prepends.merge(file[:prepends]) do |_class, cross_file, per_file|
             (per_file + cross_file).uniq
-          end
+          end,
+          file[:unpositioned]
         ]
       end
 
+      # The union of `{class => {side => [names]}}` tables — how {Scope::DiscoveryIndex#unpositioned_mixins}
+      # folds: an edge any contribution cannot position stays unpositioned. The per-file index folds its own
+      # walk over a seed that already carries this file's edges, so the first table itself comes back unless a
+      # contribution holds a name the seed lacks: the whole project table is copied only then.
+      def union_unpositioned(first, *others)
+        result = nil
+        others.each do |table|
+          table.each do |owner, sides|
+            sides.each do |side, names|
+              have = (result || first).dig(owner, side)
+              next if have && names.all? { |name| have.include?(name) }
+
+              result ||= first.dup
+              result[owner] = (result[owner] || {}).merge(side => ((have || []) | names).freeze).freeze
+            end
+          end
+        end
+        result ? result.freeze : first
+      end
+
       # The `extend`-edge half of {#merge_project_method_indexes}: merges this file's `extend`s over the
       # cross-file seed AND folds them against the merged def tables — the #526 fold that turns an
       # extended module's instance defs into singleton-side method entries on the extending class.
-      def merge_and_fold_extends(default_scope, root, def_nodes, singleton_def_nodes, seeded_scope)
-        file_extends, extends = merge_extend_tables(default_scope, root)
-        methods_table = fold_per_file_extends(file_extends, def_nodes, singleton_def_nodes, seeded_scope)
-        [extends, methods_table]
+      #
+      # ADR-119 WD1 — the unpositioned union (the seed's, the mixin walks' and this file's extend side) is settled
+      # first, because the fold reads it to tell a certain extend edge from a listed one. `siblings` is written by
+      # the fold.
+      def merge_and_fold_extends(default_scope, root, def_nodes, singleton_def_nodes, seeded_scope, siblings,
+                                 mixin_unpositioned)
+        file_extends, extends, extend_unpositioned = merge_extend_tables(default_scope, root)
+        unpositioned = union_unpositioned(default_scope.discovery.unpositioned_mixins, *mixin_unpositioned,
+                                          extend_unpositioned)
+        methods_table = fold_per_file_extends(file_extends, def_nodes, singleton_def_nodes, seeded_scope, siblings,
+                                              unpositioned)
+        [extends, methods_table, unpositioned]
       end
 
       # Issue #1097 — this file's def / block / lambda ranges merged over the cross-file seed; the
       # ordering predicates key the table by `source_path`, so the entry must exist even on a run
-      # that never built the project pre-pass. When the pre-pass DID run the entry is already the
-      # identical walk product — keep it instead of re-walking the AST.
+      # that never built the project pre-pass. A seeded entry is only the identical walk product when
+      # the pre-pass read the same bytes (a mutant analysed under a seed of the unmutated files does
+      # not), so the file is always re-walked and the seed is kept only when the rows are equal — which
+      # spares the project-wide Hash copy per file. Issue #1548.
       def merge_deferred_ranges_seed(default_scope, root)
         seeded = default_scope.discovered_deferred_ranges
-        return seeded if seeded.key?(default_scope.source_path)
+        fresh = build_deferred_ranges(root)
+        return seeded if seeded[default_scope.source_path] == fresh
 
-        seeded.merge(default_scope.source_path => build_deferred_ranges(root))
+        seeded.merge(default_scope.source_path => fresh)
       end
 
       def merge_envelope_seed(default_scope, file_envelopes)
@@ -315,70 +412,69 @@ module Rigor
       # The as-written superclass table and its issue #682 header-nesting twin, each merged over the cross-file
       # seed. Returned as a pair for the same reason {#merge_def_node_tables} is: both come from ONE walk of the
       # file, so a caller cannot pair a superclass name with a nesting recorded by a different parse.
-      def merge_ancestry_tables(default_scope, root)
-        file_superclasses, file_header_nestings = build_superclass_tables(root, default_scope.source_path)
-        [default_scope.discovered_superclasses.merge(file_superclasses),
+      def merge_ancestry_tables(default_scope, walked)
+        [default_scope.discovered_superclasses.merge(walked.fetch(:superclasses)),
          merge_header_nestings(default_scope.discovery.discovered_header_nestings.dup,
-                               file_header_nestings).freeze]
+                               walked.fetch(:header_nestings)).freeze]
       end
 
       # The instance-side def-node table and its issue #681 nesting twin, each merged over the cross-file seed.
       # Returned as a pair so the two stay written together: a node the merge keeps must be the same object the
       # nesting table keys, and they are only that if both halves take the same file's walk.
-      def merge_def_node_tables(default_scope, root, file_def_nodes)
+      def merge_def_node_tables(default_scope, walked, file_def_nodes)
         def_nodes = default_scope.discovered_def_nodes.merge(
           file_def_nodes
         ) { |_class, cross_file, per_file| cross_file.merge(per_file) }
         [def_nodes,
-         merge_def_nestings(default_scope.discovery.discovered_def_nestings, build_def_nestings(root))]
+         merge_def_nestings(default_scope.discovery.discovered_def_nestings, walked.fetch(:def_nestings))]
       end
 
       # Issue #681 — the per-file nesting table over the cross-file seed. Both are keyed by node identity, so
-      # a same-file declaration and its cross-file twin are distinct keys and the merge order is immaterial;
-      # the copy exists only so the seed stays frozen. Skipped when the file declares no `def` at all — since
-      # issue #716 a top-level `def` records its empty chain, so a file of plain top-level helpers no longer
-      # takes that path and pays one copy of the seed, the same as any file that declares a method.
+      # a same-file declaration and its cross-file twin are distinct keys and the layering order is immaterial.
+      # Issue #1507 — layered by lookup ({LayeredDefNestings}) instead of copied: the copy was one insert per
+      # `def` in the project for every analysed file. Either table alone is returned as it is when the other is
+      # empty — since issue #716 a top-level `def` records its empty chain, so only a file declaring no `def` at
+      # all hands back the seed itself.
       def merge_def_nestings(seed, file_nestings)
         return seed if file_nestings.empty?
         return file_nestings if seed.empty?
 
-        merged = {}.compare_by_identity
-        merged.merge!(seed)
-        merged.merge!(file_nestings)
-        merged.freeze
+        LayeredDefNestings.new(file_nestings, seed)
       end
 
       # Issue #898 — one walk, two consumers: the raw per-file table the #526 method fold reads, and the
       # same table merged over the cross-file seed for the scope. Returned as a pair so a caller cannot
       # pair the fold with a table a different parse produced, as {#merge_ancestry_tables} is.
       def merge_extend_tables(default_scope, root)
-        file_extends = build_discovered_extends(root)
+        file = extend_tables(root)
+        file_extends = file.fetch(:extends)
         # The table stores singleton-ancestor search order, so the file under analysis — the
         # later-loading contribution for a reopened class — prepends over the cross-file seed.
         merged = default_scope.discovered_extends.merge(
           file_extends
         ) { |_class, cross_file, per_file| (per_file + cross_file).uniq }
-        [file_extends, merged]
+        [file_extends, merged, file.fetch(:unpositioned)]
       end
 
       # The per-file half of the #526 fold: mutable copies of the merged tables take the extends, and the
       # existence table (already seeded onto the scope) is rebuilt only when the fold touched it.
-      def fold_per_file_extends(extends, def_nodes, singleton_def_nodes, seeded_scope)
+      def fold_per_file_extends(extends, def_nodes, singleton_def_nodes, seeded_scope, siblings, unpositioned)
         methods_table = seeded_scope.discovered_methods
         return methods_table if extends.empty?
 
         mutable_methods = methods_table.transform_values(&:dup)
-        fold_extends_into_singleton_tables(extends, def_nodes, singleton_def_nodes, mutable_methods)
+        fold_extends_into_singleton_tables(extends, def_nodes, singleton_def_nodes, mutable_methods,
+                                           siblings: siblings, unpositioned: unpositioned)
         mutable_methods
       end
 
       # ADR-48 — the per-file Data + Struct member-layout tables, each merged OVER the cross-file seed so a same-file
       # declaration wins for its own classes. Returned as a pair to keep {#merge_project_method_indexes} under the
       # method-size budget.
-      def merge_member_layouts(default_scope, root)
+      def merge_member_layouts(default_scope, walked)
         [
-          default_scope.data_member_layouts.merge(build_data_member_layouts(root)),
-          default_scope.struct_member_layouts.merge(build_struct_member_layouts(root))
+          default_scope.data_member_layouts.merge(walked.fetch(:data_member_layouts)),
+          default_scope.struct_member_layouts.merge(walked.fetch(:struct_member_layouts))
         ]
       end
 
@@ -1946,7 +2042,20 @@ module Rigor
       # `Prism::ClassVariableWriteNode` writes inside ANY def body (instance or singleton) of the enclosing class,
       # because Ruby cvars are shared across both facets. The resulting table is seeded into both instance and singleton
       # method bodies through `Scope#class_cvars_for`.
+      #
+      # ADR-116 WD5 — built by {ClassCvarsCollector} on the shared {DeclarationWalk}; `RIGOR_SHADOW_RULE_WALK`
+      # checks it against {#legacy_class_cvar_index}.
       def build_class_cvar_index(root, default_scope)
+        collector = ClassCvarsCollector.new
+        DeclarationWalk.run(root, [collector], DeclarationWalk::Context.root(scope: default_scope))
+        DeclarationWalk::Shadow.verified(:class_cvars, default_scope.source_path, collector.table) do
+          legacy_class_cvar_index(root, default_scope)
+        end
+      end
+
+      # The walker {ClassCvarsCollector} replaced, kept as the shadow harness's oracle until ADR-116 WD5 has
+      # ported every table walker onto {DeclarationWalk}.
+      def legacy_class_cvar_index(root, default_scope)
         accumulator = {}
         walk_class_cvars(root, [], default_scope, accumulator)
         accumulator.transform_values(&:freeze).freeze
@@ -2867,8 +2976,7 @@ module Rigor
       # `ArgumentsNode`, and a `&blk` pass-through is a `BlockArgumentNode`.
       def walk_constant_write_children(node, qualified_prefix, default_scope, accumulator, self_owner,
                                        singleton_cref)
-        rebound = rebound_block_self(node, qualified_prefix, default_scope, nil,
-                                     rebound_self_base(self_owner))
+        rebound = rebound_block_self(node, qualified_prefix, default_scope, nil, self_owner)
         node.rigor_each_child do |child|
           rebinds_self = rebound && child.is_a?(Prism::BlockNode)
           owner = rebinds_self ? rebound : self_owner
@@ -2894,14 +3002,18 @@ module Rigor
       # caller ({#meta_new_block_owner}) ([#710](https://github.com/rigortype/rigor/issues/710)). It is
       # supplied only by the publication census; the typed walk returns at a `ConstantWriteNode` without
       # descending into its rvalue, so no `self::` write inside one reaches that walk at all.
+      #
+      # `self_owner` is the enclosing body's self as the walk carries it, unsplit. Every walk asks this at
+      # every node it visits, and only an eval call reads the self, so the split waits until one does
+      # ([#1502](https://github.com/rigortype/rigor/issues/1502)).
       def rebound_block_self(node, qualified_prefix, default_scope = nil, meta_owner = nil,
-                             self_prefix = nil)
+                             self_owner = nil)
         return nil unless node.is_a?(Prism::CallNode) && node.block.is_a?(Prism::BlockNode)
         return OPAQUE_SELF if OPAQUE_SELF_BLOCK_CALLS.include?(node.name)
         return meta_owner || OPAQUE_SELF if meta_new_constant_rvalue?(node)
         return nil unless RECEIVER_EVAL_CALLS.include?(node.name)
 
-        eval_receiver_self(node.receiver, qualified_prefix, default_scope, self_prefix)
+        eval_receiver_self(node.receiver, qualified_prefix, default_scope, rebound_self_base(self_owner))
       end
 
       # Issue #710 — the qualified name a `Klass = Class.new { … }` gives the block's class, or nil when
@@ -3128,20 +3240,59 @@ module Rigor
       # Issue #1120 — and a fourth, `refinements`: `{refined class => {method => [refining modules]}}`, the
       # `def`s of every `refine X do … end` body ({#record_refinement_defs}). Those are kept OUT of the first
       # three tables, which answer everywhere: a refined method exists only where a `using` is in effect.
-      def build_methods_and_def_nodes(root, source_path = nil)
-        tables = MethodTables.new({}, {})
+      #
+      # ADR-119 WD3 — and a fifth, the file's def-contribution siblings ({MethodTables#siblings}):
+      # `possible_discovered_methods`, `contested_discovered_def_nodes` and
+      # `contested_discovered_parameter_envelopes`, from the {Certainty} classification `certainty` (computed here
+      # when the caller has none).
+      def build_methods_and_def_nodes(root, source_path = nil, certainty: Certainty.possible_nodes(root))
+        tables = MethodTables.new({}, {}, nil, certainty, true)
         def_nodes = {}
         walk_methods_and_def_nodes(root, [], false, tables, def_nodes, source_path)
-        apply_alias_def_nodes(root, def_nodes)
+        apply_alias_def_nodes(root, def_nodes, tables)
         [tables.existence.transform_values(&:freeze).freeze, def_nodes.transform_values(&:freeze).freeze,
-         tables.envelopes.transform_values(&:freeze).freeze, freeze_refinements(tables.refinements)]
+         tables.envelopes.transform_values(&:freeze).freeze, freeze_refinements(tables.refinements),
+         tables.siblings]
       end
 
       # The accumulator {#walk_methods_and_def_nodes} threads: the existence table and its issue #992
       # envelope twin, which only {#record_method} and {#record_surface_mark} write, and the issue #1120
       # refinement table, which only {#record_refinement_defs} writes. That last one stays nil until a
       # `refine` block is seen, so a file without one allocates nothing for it.
-      MethodTables = Struct.new(:existence, :envelopes, :refinements)
+      #
+      # ADR-119 WD3 — `certainty` is the file's {Certainty} answer and `certain` whether the contribution being
+      # recorded is certain ({#at} sets it before each recorder). `possible`, `contested_envelopes` and
+      # `contested_def_nodes` are the siblings the recorders fill, each nil until a possible contribution writes it.
+      MethodTables = Struct.new(:existence, :envelopes, :refinements, :certainty, :certain, :possible,
+                                :contested_envelopes, :contested_def_nodes) do
+        # Sets {#certain} for the contribution `node` and returns the tables.
+        def at(node)
+          self.certain = !Certainty.possible?(certainty, node)
+          self
+        end
+
+        # The `{sibling name => table}` part this walk fills, frozen, with the shared empty value for each
+        # sibling nothing wrote.
+        def siblings
+          empty = Scope::DiscoveryIndex::EMPTY_SIBLINGS
+          {
+            possible_discovered_methods:
+              possible ? possible.transform_values(&:freeze).freeze : empty[:possible_discovered_methods],
+            contested_discovered_def_nodes:
+              frozen_paths(contested_def_nodes) || empty[:contested_discovered_def_nodes],
+            contested_discovered_parameter_envelopes:
+              frozen_paths(contested_envelopes) || empty[:contested_discovered_parameter_envelopes]
+          }.freeze
+        end
+
+        private
+
+        def frozen_paths(set)
+          return nil if set.nil? || set.empty?
+
+          set.each(&:freeze).freeze
+        end
+      end
 
       EMPTY_REFINEMENTS = {}.freeze
       private_constant :EMPTY_REFINEMENTS
@@ -3215,9 +3366,58 @@ module Rigor
 
       # The walk's single existence writer. Everything except a `def` passes no envelope and so records
       # {Source::ParameterEnvelope::OPAQUE}.
+      #
+      # ADR-119 WD3 — the existence table's `possible` sibling follows the contribution's certainty
+      # ({MethodTables#certain}): a certain contribution removes its kind from the name's possible kind, and a
+      # possible one adds its kind unless the table already answered that kind certainly. A possible contribution
+      # also contests the envelope entry it joins (envelopes are joined, so one possible joiner is enough).
       def record_method(tables, class_name, method_name, kind, envelope = Source::ParameterEnvelope::OPAQUE)
+        follow_method_certainty(tables, class_name, method_name, kind) unless tables.certain && tables.possible.nil?
         record_method_kind(tables.existence, class_name, method_name, kind)
         record_envelope(tables.envelopes, class_name, [kind, method_name], envelope)
+        contest_envelope(tables, class_name, [kind, method_name]) unless tables.certain
+      end
+
+      # The `possible_discovered_methods` half of {#record_method}, read BEFORE the existence table is written.
+      def follow_method_certainty(tables, class_name, method_name, kind)
+        if tables.certain
+          settle_possible_kind(tables.possible, class_name, method_name, kind)
+        else
+          sitting = tables.possible&.dig(class_name, method_name)
+          return if kind_covers?(tables.existence[class_name]&.[](method_name), kind) && !kind_covers?(sitting, kind)
+
+          row = ((tables.possible ||= {})[class_name] ||= {})
+          row[method_name] = merge_sibling_kind(sitting, kind)
+        end
+      end
+
+      # A certain contribution: `kind` leaves the name's possible kind, and an emptied row goes.
+      def settle_possible_kind(possible, class_name, method_name, kind)
+        row = possible[class_name]
+        return if row.nil?
+
+        remaining = without_kind(row[method_name], kind)
+        return if remaining == row[method_name]
+
+        remaining.nil? ? row.delete(method_name) : (row[method_name] = remaining)
+        possible.delete(class_name) if row.empty?
+      end
+
+      # Whether a recorded kind (`:instance`, `:singleton`, `:both`, or nil) answers `kind`.
+      def kind_covers?(recorded, kind)
+        !recorded.nil? && (recorded == kind || recorded == Scope::DiscoveryIndex::METHOD_KIND_BOTH)
+      end
+
+      # `recorded` less `kind`: nil when nothing remains.
+      def without_kind(recorded, kind)
+        return nil if recorded.nil? || recorded == kind
+        return recorded unless recorded == Scope::DiscoveryIndex::METHOD_KIND_BOTH
+
+        kind == :instance ? :singleton : :instance
+      end
+
+      def contest_envelope(tables, class_name, key)
+        (tables.contested_envelopes ||= Set.new) << [class_name, key]
       end
 
       def record_envelope(envelopes, class_name, key, envelope)
@@ -3303,7 +3503,7 @@ module Rigor
             # `self::` header under a REBOUND self (eval/meta-new body) names
             # `owner::Name` instead.
             child_cref = unnameable_decl?(node, self_decl, singleton_cref)
-            record_declaration_facts(node, child_prefix, methods_acc) unless child_cref
+            record_declaration_facts(node, child_prefix, methods_acc.at(node)) unless child_cref
             body_prefix = child_cref ? [] : child_prefix
             if node.body
               walk_methods_and_def_nodes(node.body, body_prefix, false, methods_acc, def_nodes_acc,
@@ -3346,7 +3546,9 @@ module Rigor
             child_prefix = meta_new_child_prefix(node, qualified_prefix, def_owner_prefix)
             meta_ownerless = singleton_cref &&
                              !meta_new_path_target_nameable?(node, def_owner_prefix)
-            record_meta_new_facts(meta_new_rvalue(node), child_prefix, methods_acc) if child_prefix && !meta_ownerless
+            if child_prefix && !meta_ownerless
+              record_meta_new_facts(meta_new_rvalue(node), child_prefix, methods_acc.at(node))
+            end
             enclosing.each do |part|
               walk_methods_and_def_nodes(part, qualified_prefix, in_singleton_class, methods_acc,
                                          def_nodes_acc, source_path, def_owner_prefix,
@@ -3373,16 +3575,16 @@ module Rigor
           unless def_owner_prefix&.empty? || defs_singleton == :unnameable ||
                  (singleton_cref && owner_prefix.empty?)
             singleton_def = in_singleton_class || defs_singleton
-            record_def_method(node, owner_prefix, singleton_def, methods_acc)
+            record_def_method(node, owner_prefix, singleton_def, methods_acc.at(node))
             record_def_body_evidence(node, owner_prefix, methods_acc)
-            record_def_node(node, owner_prefix, singleton_def, def_nodes_acc)
+            record_def_node(node, owner_prefix, singleton_def, def_nodes_acc, methods_acc)
           end
           return
         when Prism::AliasMethodNode, Prism::UndefNode
           unless def_owner_prefix&.empty? || defs_singleton == :unnameable ||
                  (singleton_cref && owner_prefix.empty?)
             record_alias_or_undef(node, owner_prefix, in_singleton_class || defs_singleton,
-                                  methods_acc)
+                                  methods_acc.at(node))
           end
           return
         when Prism::CallNode
@@ -3392,7 +3594,8 @@ module Rigor
                                               singleton_cref: singleton_cref,
                                               defs_singleton: defs_singleton)
           end
-          anonymous = record_call_node_methods(node, owner_prefix, in_singleton_class, methods_acc, source_path)
+          anonymous = record_call_node_methods(node, owner_prefix, in_singleton_class, methods_acc.at(node),
+                                               source_path)
           # Issue #1120 — a refine body's defs go to the refinement table and nowhere else.
           if (target = refine_target(node))
             return record_refinement_defs(node, target, qualified_prefix, owner_prefix, methods_acc)
@@ -3514,7 +3717,7 @@ module Rigor
       def walk_anonymous_meta_block(call_node, name, qualified_prefix, in_singleton_class, methods_acc, # rubocop:disable Metrics/ParameterLists
                                     def_nodes_acc, source_path, def_owner_prefix = nil,
                                     singleton_cref: false, defs_singleton: false)
-        record_meta_members(call_node, [name], methods_acc)
+        record_meta_members(call_node, [name], methods_acc.at(call_node))
         call_node.rigor_each_child do |child|
           if child.equal?(call_node.block)
             body = call_node.block.body
@@ -3928,13 +4131,30 @@ module Rigor
       # same-named local method.
       TOP_LEVEL_DEF_KEY = "<toplevel>"
 
-      def record_def_node(def_node, qualified_prefix, in_singleton_class, accumulator)
+      #
+      # ADR-119 WD3 — the slot follows its writer (later-wins): a certain write clears the key from
+      # `contested_discovered_def_nodes` and a possible one adds it ({MethodTables#certain}, set for `def_node`).
+      def record_def_node(def_node, qualified_prefix, in_singleton_class, accumulator, tables = nil)
         return if def_singleton?(def_node, qualified_prefix, in_singleton_class)
 
         class_name = qualified_prefix.empty? ? TOP_LEVEL_DEF_KEY : qualified_prefix.join("::")
         accumulator[class_name] ||= {}
         accumulator[class_name][def_node.name] = def_node
-        record_anonymous_body_def_as_toplevel(def_node, qualified_prefix, accumulator)
+        follow_slot_writer(tables, :contested_def_nodes, [class_name, def_node.name], tables.nil? || tables.certain)
+        record_anonymous_body_def_as_toplevel(def_node, qualified_prefix, accumulator, tables)
+      end
+
+      # ADR-119 WD3 — a single-valued slot's contest follows the write that holds it: `certain` clears `key` from
+      # the `slot` Set of `tables`, a possible write adds it. Nil `tables` (a caller with no certainty) is a no-op.
+      def follow_slot_writer(tables, slot, key, certain)
+        return if tables.nil?
+
+        if certain
+          set = tables[slot]
+          set&.delete(key)
+        else
+          (tables[slot] ||= Set.new) << key
+        end
       end
 
       # #319 — a `def` inside an anonymous `Class.new` / `Module.new` body ALSO stays in the `<toplevel>` table.
@@ -3946,12 +4166,16 @@ module Rigor
       # `spawn(...) { start }` block. Giving the body a class of its own must not silently retract it: the call
       # resolves at runtime, and `call.unresolved-toplevel` firing on it would be a new false positive traded
       # for the ones this change retires. Never clobbers a real top-level `def` of the same name.
-      def record_anonymous_body_def_as_toplevel(def_node, qualified_prefix, accumulator)
+      def record_anonymous_body_def_as_toplevel(def_node, qualified_prefix, accumulator, tables = nil)
         return unless qualified_prefix.length == 1
         return unless Type::AnonymousClassName.match?(qualified_prefix.first)
 
         table = (accumulator[TOP_LEVEL_DEF_KEY] ||= {})
-        table[def_node.name] ||= def_node
+        return if table.key?(def_node.name)
+
+        table[def_node.name] = def_node
+        follow_slot_writer(tables, :contested_def_nodes, [TOP_LEVEL_DEF_KEY, def_node.name],
+                           tables.nil? || tables.certain)
       end
 
       # Module-singleton call resolution (ADR-57 follow-up) — the SINGLETON-side mirror of `build_discovered_def_nodes`.
@@ -3963,9 +4187,43 @@ module Rigor
       # singleton defs (`def self.x` outside any class — `self` is `main`) are not recorded; they have no constant
       # receiver to dispatch through.
       def build_discovered_singleton_def_nodes(root)
-        accumulator = {}
+        build_singleton_def_tables(root).first
+      end
+
+      # ADR-119 WD3 — {#build_discovered_singleton_def_nodes} with its sibling: `[table,
+      # contested_discovered_singleton_def_nodes]`, the second a frozen Set of `[class, name]` keys whose slot a
+      # possible `def self.x`, `class << self` def or `module_function` copy wrote last ({Certainty} `certainty`).
+      def build_singleton_def_tables(root, certainty: Certainty.possible_nodes(root))
+        accumulator = SingletonDefTable.new.track(certainty)
         walk_singleton_def_nodes(root, [], false, accumulator)
-        accumulator.transform_values(&:freeze).freeze
+        [accumulator.transform_values(&:freeze).freeze, accumulator.contested_paths]
+      end
+
+      # The singleton walk's accumulator: the `{class => {name => DefNode}}` table, plus the contested slots, which
+      # follow each slot's writer ({#follow_slot_writer}'s rule).
+      class SingletonDefTable < Hash
+        def track(certainty)
+          @certainty = certainty
+          @contested = nil
+          self
+        end
+
+        # Writes the slot; `node` and `other` are the contributions the write rests on, possible when either is.
+        def write(class_name, name, def_node, node, other = nil)
+          (self[class_name] ||= {})[name] = def_node
+          if Certainty.possible?(@certainty, node) || (other && Certainty.possible?(@certainty, other))
+            (@contested ||= Set.new) << [class_name, name]
+          else
+            @contested&.delete([class_name, name])
+          end
+        end
+
+        def contested_paths
+          contested = @contested
+          return contested.each(&:freeze).freeze if contested && !contested.empty?
+
+          Scope::DiscoveryIndex::EMPTY_SIBLINGS[:contested_discovered_singleton_def_nodes]
+        end
       end
 
       # Issue #1097 — `[[start_offset, end_offset, name, kind, owner], ...]` for every `def` / block /
@@ -4004,12 +4262,14 @@ module Rigor
                                defs_singleton: false)
         return unless node.is_a?(Prism::Node)
 
-        if CLASS_BODY_NODES.any? { |kind| node.is_a?(kind) }
+        # Tested by exact class (Prism's node classes have no subclasses): the three `any?` scans this
+        # replaced ran a block per list member at every node ([#1507](https://github.com/rigortype/rigor/issues/1507)).
+        if CLASS_BODY_NODES.include?(node.class)
           return walk_deferred_lexical_body(node, qualified_prefix, in_singleton_class,
                                             inside_deferred, mf_offsets, ranges, def_owner_prefix,
                                             singleton_cref: singleton_cref)
         end
-        if META_WRITE_NODES.any? { |kind| node.is_a?(kind) }
+        if META_WRITE_NODES.include?(node.class)
           return walk_deferred_meta_new(node, qualified_prefix, in_singleton_class, inside_deferred,
                                         mf_offsets, ranges, def_owner_prefix,
                                         singleton_cref: singleton_cref)
@@ -4019,7 +4279,7 @@ module Rigor
                                         mf_offsets, ranges, def_owner_prefix, singleton_cref,
                                         defs_singleton)
         end
-        if DEFERRED_RANGE_NODES.any? { |kind| node.is_a?(kind) }
+        if DEFERRED_RANGE_NODES.include?(node.class)
           # Deferred: a call inside runs at invocation / interpreter-exit time. `BEGIN`
           # (PreExecutionNode) is the opposite — eager, before the class body — and stays unlisted.
           ranges << [node.location.start_offset, node.location.end_offset, nil, nil, nil]
@@ -4052,10 +4312,10 @@ module Rigor
                                                          defs_singleton: defs_singleton)
       end
 
-      DEFERRED_RANGE_NODES = [Prism::BlockNode, Prism::LambdaNode, Prism::PostExecutionNode].freeze
-      META_WRITE_NODES = [Prism::ConstantWriteNode, Prism::ConstantPathWriteNode,
-                          Prism::ConstantOrWriteNode, Prism::ConstantPathOrWriteNode].freeze
-      CLASS_BODY_NODES = [Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      DEFERRED_RANGE_NODES = Set[Prism::BlockNode, Prism::LambdaNode, Prism::PostExecutionNode].freeze
+      META_WRITE_NODES = Set[Prism::ConstantWriteNode, Prism::ConstantPathWriteNode,
+                             Prism::ConstantOrWriteNode, Prism::ConstantPathOrWriteNode].freeze
+      CLASS_BODY_NODES = Set[Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
       private_constant :DEFERRED_RANGE_NODES, :META_WRITE_NODES, :CLASS_BODY_NODES
 
       def walk_deferred_children(node, qualified_prefix, in_singleton_class, inside_deferred, # rubocop:disable Metrics/ParameterLists
@@ -4156,7 +4416,7 @@ module Rigor
       end
 
       # Body-level entry for a class / module / `class <<` / meta-`new` / eval-block body: prescans
-      # the body's `module_function` state first ({#collect_module_function_state} — bare-call
+      # the body's `module_function` state first ({ModuleFunctionState.prescan_deferred} — bare-call
       # offsets plus the retro-install and `module_function def x` rows), then walks each statement
       # with the offsets in hand. The prescan looks through nested containers (`if` / `begin` /
       # `rescue` / blocks) because a `module_function` that RAN there still flips later defs —
@@ -4173,8 +4433,8 @@ module Rigor
           # `module_function` under an unnameable definee (`class <<` + `instance_eval`)
           # toggles the metaclass — its rows must not name the enclosing class.
           prescan_owner = defs_singleton == :unnameable ? EMPTY_PREFIX : owner_prefix
-          collect_module_function_state(body, prescan_owner, in_singleton_class, mf_offsets,
-                                        ranges)
+          ModuleFunctionState.prescan_deferred(body, prescan_owner, in_singleton_class, mf_offsets,
+                                               ranges)
         end
         statements_of(body).each do |stmt|
           walk_deferred_ranges(stmt, qualified_prefix, in_singleton_class, inside_deferred,
@@ -4183,49 +4443,6 @@ module Rigor
         end
       end
 
-      # The `module_function` prescan over one body's subtree: bare-call offsets (defs starting after
-      # one are module functions), a `:singleton` row at each `module_function :name` call — the
-      # retro-install happens AT THE CALL, not the def — and a `:both` / `:singleton` row for a
-      # `module_function def x` argument. Nested class / module / `class <<` / def bodies are skipped:
-      # `module_function` there targets a different module. An `END` body is skipped too — it runs at
-      # interpreter exit, after every def — and so is a `*_eval` / `*_exec` block, whose `self`
-      # rebinds to the receiver's module. Blocks, lambdas and control-flow containers are entered —
-      # their `self` is still this module, so the call really can toggle.
-      def collect_module_function_state(node, qualified_prefix, in_singleton_class, mf_offsets, ranges)
-        return unless node.is_a?(Prism::Node)
-        return if node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode) ||
-                  node.is_a?(Prism::SingletonClassNode) || node.is_a?(Prism::DefNode) ||
-                  node.is_a?(Prism::PostExecutionNode)
-
-        if node.is_a?(Prism::CallNode)
-          if module_function_toggle?(node)
-            return collect_module_function_call(node, qualified_prefix, in_singleton_class,
-                                                mf_offsets, ranges)
-          end
-          if receiver_eval_call?(node)
-            return collect_eval_call_state(node, qualified_prefix, in_singleton_class, mf_offsets,
-                                           ranges)
-          end
-        end
-
-        node.rigor_each_child do |child|
-          collect_module_function_state(child, qualified_prefix, in_singleton_class, mf_offsets, ranges)
-        end
-      end
-
-      # The prescan's eval arm: a `*_eval` / `*_exec` block's self rebinds to the receiver's module,
-      # so only the call's receiver and arguments keep this module's `module_function` context.
-      def collect_eval_call_state(node, qualified_prefix, in_singleton_class, mf_offsets, ranges)
-        if node.receiver
-          collect_module_function_state(node.receiver, qualified_prefix, in_singleton_class,
-                                        mf_offsets, ranges)
-        end
-        node.arguments&.arguments&.each do |arg|
-          collect_module_function_state(arg, qualified_prefix, in_singleton_class, mf_offsets,
-                                        ranges)
-        end
-      end
-
       # The wider form: any call whose block rebinds `self` to the receiver — `instance_eval` and
       # `instance_exec` included. Walks that read `self`-anchored facts use this gate; walks that
       # own `def` leaves additionally split on {INSTANCE_EVAL_CALLS}, whose `def`s bind on the
@@ -4234,29 +4451,6 @@ module Rigor
         node.block.is_a?(Prism::BlockNode) && RECEIVER_EVAL_CALLS.include?(node.name)
       end
 
-      def collect_module_function_call(node, qualified_prefix, in_singleton_class, mf_offsets, ranges)
-        if bare_module_function?(node)
-          mf_offsets << node.location.start_offset
-        else
-          owner = qualified_prefix.empty? ? nil : qualified_prefix.join("::")
-          node.arguments&.arguments&.each do |arg|
-            if arg.is_a?(Prism::DefNode)
-              kind = def_singleton?(arg, qualified_prefix, in_singleton_class) ? :singleton : :both
-              ranges << [arg.location.start_offset, arg.location.end_offset, arg.name, kind, owner]
-            elsif (name = symbol_argument_name(arg))
-              ranges << [node.location.start_offset, node.location.end_offset, name, :singleton, owner]
-            else
-              collect_module_function_state(arg, qualified_prefix, in_singleton_class, mf_offsets,
-                                            ranges)
-            end
-          end
-        end
-        return unless node.block
-
-        collect_module_function_state(node.block, qualified_prefix, in_singleton_class, mf_offsets,
-                                      ranges)
-      end
-
       # A `class_eval` / `module_eval` / `class_exec` / `module_exec` block is NOT deferred: it runs
       # eagerly during the receiver's call, as a class-ish body — its `module_function` state gets
       # its own prescan, and its defs belong to the RECEIVER's surface. A nameable receiver gives
@@ -4620,7 +4814,7 @@ module Rigor
 
         kind = if def_singleton?(def_node, qualified_prefix, in_singleton_class)
                  :singleton
-               elsif mf_offsets.any? { |offset| offset < start }
+               elsif ModuleFunctionState.deferred_module_function?(mf_offsets, start)
                  :both
                else
                  :instance
@@ -4773,12 +4967,27 @@ module Rigor
       # CompactBase` calls it, and the bare `Post` inside `make` names `::Post` — the constant the compact
       # declaration that OWNS the body reaches, not the one the receiver's spelling would suggest.
       #
-      # A separate descent rather than a leaf of the fused methods/def-nodes walk: it needs the CHAIN
-      # threaded, which the fused walk does not carry (a singleton-class body and a `Class.new` block body
-      # both push a qualified prefix while pushing no `Module.nesting` entry), and threading a second value
-      # through that walk and its anonymous-block twin exceeds their parameter budget. It stops at every
-      # `Prism::DefNode`, so a def-dense file pays only the declaration spine.
+      # Not a leaf of the fused methods/def-nodes walk: it needs the CHAIN threaded, which the fused walk does
+      # not carry (a singleton-class body and a `Class.new` block body both push a qualified prefix while
+      # pushing no `Module.nesting` entry). {DefNestingsCollector} declines at every `Prism::DefNode`, so a
+      # def-dense file pays only the declaration spine.
+      #
+      # ADR-116 WD5 — production builds this table in {#declaration_walk_tables}' shared run, and nothing in
+      # `lib` calls this builder. It runs the collector alone and stays for the specs, which compare it with
+      # the shared run; `RIGOR_SHADOW_RULE_WALK` checks it against {#legacy_def_nestings}.
       def build_def_nestings(root)
+        collector = DefNestingsCollector.new
+        DeclarationWalk.run(root, [collector], superclass_walk_root(nil))
+        verified_def_nestings(root, collector.table)
+      end
+
+      def verified_def_nestings(root, table, source_path = nil)
+        DeclarationWalk::Shadow.verified(:def_nestings, source_path, table) { legacy_def_nestings(root) }
+      end
+
+      # The walker {DefNestingsCollector} replaced, kept as the shadow harness's oracle until ADR-116 WD5 has
+      # ported every table walker onto {DeclarationWalk}.
+      def legacy_def_nestings(root)
         accumulator = {}.compare_by_identity
         walk_def_nestings(root, EMPTY_NESTING, accumulator)
         accumulator.freeze
@@ -4904,24 +5113,21 @@ module Rigor
       end
 
       # Walks a class/module/singleton-class body's direct statements in source order, threading the
-      # bare-`module_function` toggle: once a bare `module_function` is seen, every subsequent `def` in the body
-      # registers as a singleton method. Nested classes/modules/defs and `module_function :a, :b` named forms recurse /
-      # record through the general walker so the toggle stays scoped to its own body.
+      # bare-`module_function` toggle ({ModuleFunctionState.each_singleton_sibling}): once a bare
+      # `module_function` is seen, every subsequent `def` in the body registers as a singleton method. Nested
+      # classes/modules/defs recurse through the general walker so the toggle stays scoped to its own body, and a
+      # `module_function :a, :b` named form records through {#record_module_function_names}.
       def walk_singleton_body(body, qualified_prefix, in_singleton_class, accumulator,
                               def_owner_prefix = nil, singleton_cref: false,
                               defs_singleton: false)
         owner_prefix = def_owner_prefix || qualified_prefix
-        module_function_on = false
-        statements_of(body).each do |stmt|
-          if stmt.is_a?(Prism::CallNode) && module_function_toggle?(stmt)
-            if bare_module_function?(stmt)
-              module_function_on = true
-            else
-              # `:unnameable` — the named defs the call copies live on the metaclass,
-              # which this table cannot name either.
-              record_module_function_names(stmt, owner_prefix, body, accumulator) unless
-                defs_singleton == :unnameable
-            end
+        statements = statements_of(body)
+        ModuleFunctionState.each_singleton_sibling(statements) do |stmt, module_function_on, named_call|
+          if named_call
+            # `:unnameable` — the named defs the call copies live on the metaclass,
+            # which this table cannot name either.
+            record_module_function_names(stmt, owner_prefix, statements, accumulator) unless
+              defs_singleton == :unnameable
             next
           end
           if stmt.is_a?(Prism::DefNode)
@@ -4972,42 +5178,30 @@ module Rigor
         return if qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        (accumulator[class_name] ||= {})[def_node.name] = def_node
-      end
-
-      # A bare `module_function` (no arguments) flips every following `def` in the module body to module-function
-      # (instance + singleton) mode.
-      def module_function_toggle?(node)
-        node.name == :module_function && node.receiver.nil?
+        write_singleton_slot(accumulator, class_name, def_node.name, def_node, def_node)
       end
 
-      def bare_module_function?(node)
-        node.arguments.nil? || node.arguments.arguments.empty?
+      # One singleton slot write, through {SingletonDefTable#write} when the walk tracks certainty.
+      def write_singleton_slot(accumulator, class_name, name, def_node, node, other = nil)
+        if accumulator.is_a?(SingletonDefTable)
+          accumulator.write(class_name, name, def_node, node, other)
+        else
+          (accumulator[class_name] ||= {})[name] = def_node
+        end
       end
 
-      # `module_function :a, :b` retro-marks named siblings (defined earlier OR later in the same body) as
-      # module-functions. Resolves each symbol-literal argument against the body's own `def`s and registers the matching
-      # `DefNode` on the module's singleton side. Non-symbol arguments and names with no matching `def` are skipped (a
-      # miss degrades to today's `Dynamic`, never a false resolution).
-      def record_module_function_names(node, qualified_prefix, body, accumulator)
+      # `module_function :a, :b` retro-marks named siblings as module-functions: registers on the module's singleton
+      # side each `DefNode` {ModuleFunctionState.each_singleton_copy} resolves among the body's direct `statements`.
+      # Non-symbol arguments and names with no matching `def` are skipped (a miss degrades to today's `Dynamic`).
+      def record_module_function_names(node, qualified_prefix, statements, accumulator)
         return if qualified_prefix.empty?
 
-        defs_by_name = statements_of(body).each_with_object({}) do |stmt, acc|
-          acc[stmt.name] = stmt if stmt.is_a?(Prism::DefNode) && stmt.receiver.nil?
-        end
         class_name = qualified_prefix.join("::")
-        node.arguments&.arguments&.each do |arg|
-          name = symbol_argument_name(arg)
-          def_node = name && defs_by_name[name]
-          (accumulator[class_name] ||= {})[name] = def_node if def_node
+        ModuleFunctionState.each_singleton_copy(node, statements) do |name, def_node|
+          write_singleton_slot(accumulator, class_name, name, def_node, node, def_node)
         end
       end
 
-      # The Symbol value of a `:name` / `"name"` literal argument, or nil.
-      def symbol_argument_name(arg)
-        arg.unescaped.to_sym if arg.is_a?(Prism::SymbolNode) || arg.is_a?(Prism::StringNode)
-      end
-
       # ADR-24 slice 2 — per-class table mapping a fully qualified user class to its superclass name AS WRITTEN at the
       # `class Foo < Bar` declaration. Only constant superclasses are recorded (`class Foo < Struct.new(...)` and other
       # non-constant superclasses produce no entry). The as-written name is resolved to a qualified class at the call
@@ -5021,13 +5215,57 @@ module Rigor
       # the enclosing cref — `[]` for the first spelling, `["Admin"]` for the second. A class reopened under two
       # spellings keeps the LAST one walked, matching how `superclasses` itself merges.
       #
+      # ADR-116 WD5 — built by {SuperclassesCollector} on the shared {DeclarationWalk}, following the two
+      # legacy variants it declares; `RIGOR_SHADOW_RULE_WALK` checks both tables against
+      # {#legacy_superclass_tables}. Production builds both in {#declaration_walk_tables}' shared run, and
+      # nothing in `lib` calls this builder: it runs the collector alone and stays for the specs, which
+      # compare it with the shared run.
+      #
       # @return the `[superclasses, header_nestings]` pair
       def build_superclass_tables(root, source_path = nil)
+        collector = SuperclassesCollector.new
+        DeclarationWalk.run(root, [collector], superclass_walk_root(source_path))
+        verified_superclass_tables(root, source_path, collector.tables)
+      end
+
+      # The root context the superclass tables are walked from: the ancestry nesting starts empty and the
+      # anonymous-class key carries the file's path.
+      def superclass_walk_root(source_path, scope: nil)
+        DeclarationWalk::Context.root(scope: scope, nesting: EMPTY_NESTING, source_path: source_path)
+      end
+
+      # `tables` once the shadow harness has compared them with the legacy walker's, when it is on.
+      def verified_superclass_tables(root, source_path, tables)
+        DeclarationWalk::Shadow.verified(:superclass_tables, source_path, tables) do
+          legacy_superclass_tables(root, source_path)
+        end
+      end
+
+      # The walker {SuperclassesCollector} replaced, kept as the shadow harness's oracle until ADR-116 WD5 has
+      # ported every table walker onto {DeclarationWalk}.
+      def legacy_superclass_tables(root, source_path = nil)
         accumulator = { superclasses: {}, header_nestings: {} }
         walk_class_superclasses(root, [], accumulator, source_path)
         [accumulator[:superclasses].freeze, accumulator[:header_nestings].freeze]
       end
 
+      # ADR-116 WD5 — the file's superclass, header-nesting, def-nesting and member-layout tables from ONE
+      # shared {DeclarationWalk}: the file is descended once for all of them, where the legacy walkers
+      # descended it once per table. `RIGOR_SHADOW_RULE_WALK` checks each table against its legacy walker.
+      #
+      # @return `{ superclasses:, header_nestings:, def_nestings:, data_member_layouts:, struct_member_layouts: }`
+      def declaration_walk_tables(root, source_path = nil)
+        superclasses = SuperclassesCollector.new
+        layouts = MemberLayoutsCollector.new
+        def_nestings = DefNestingsCollector.new
+        DeclarationWalk.run(root, [superclasses, layouts, def_nestings], superclass_walk_root(source_path))
+        supers, header_nestings = verified_superclass_tables(root, source_path, superclasses.tables)
+        data, struct = verified_member_layouts(root, layouts.tables, source_path)
+        { superclasses: supers, header_nestings: header_nestings,
+          def_nestings: verified_def_nestings(root, def_nestings.table, source_path),
+          data_member_layouts: data, struct_member_layouts: struct }
+      end
+
       # `self_base` names a rebound `self` for `self::`-anchored headers — a meta-new
       # block's class; `[]` marks a self no name covers.
       def walk_class_superclasses(node, qualified_prefix, accumulator, source_path = nil,
@@ -5342,7 +5580,31 @@ module Rigor
       # `Data.define` is recorded: `Struct.new` instances are mutable, so member-value folding would be unsound (the
       # Struct follow-up is deferred — see ADR-48 § "Struct follow-up"). Consumed by
       # {Inference::MethodDispatcher::DataFolding} via {Scope#data_member_layout}.
+      #
+      # ADR-116 WD5 — built with its Struct sibling by {MemberLayoutsCollector}. Production builds both in
+      # {#declaration_walk_tables}' shared run, and nothing in `lib` calls this builder: it stays for the specs,
+      # and walks both layout tables to return this one.
       def build_data_member_layouts(root)
+        member_layout_tables(root).first
+      end
+
+      # `[data_member_layouts, struct_member_layouts]` from a {MemberLayoutsCollector} run of its own, checked by
+      # `RIGOR_SHADOW_RULE_WALK` against the two legacy walkers. Spec-only, like the two builders on it.
+      def member_layout_tables(root)
+        collector = MemberLayoutsCollector.new
+        DeclarationWalk.run(root, [collector], superclass_walk_root(nil))
+        verified_member_layouts(root, collector.tables)
+      end
+
+      def verified_member_layouts(root, tables, source_path = nil)
+        DeclarationWalk::Shadow.verified(:member_layouts, source_path, tables) do
+          [legacy_data_member_layouts(root), legacy_struct_member_layouts(root)]
+        end
+      end
+
+      # The walker {MemberLayoutsCollector} replaced for the `Data.define` table, kept as the shadow harness's
+      # oracle until ADR-116 WD5 has ported every table walker onto {DeclarationWalk}.
+      def legacy_data_member_layouts(root)
         accumulator = {}
         walk_data_member_layouts(root, [], accumulator)
         accumulator.freeze
@@ -5445,7 +5707,16 @@ module Rigor
       # table so the existing `Data.define` value-shape contract (a bare `[Symbol]`) is untouched: a Struct entry
       # carries `{ members:, keyword_init: }` because the dispatcher needs the flag to fold the matching `.new` call
       # form (positional vs keyword) without manufacturing a wrong map.
+      #
+      # ADR-116 WD5 — production builds it in {#declaration_walk_tables}' shared run; this builder is spec-only,
+      # like {#build_data_member_layouts}.
       def build_struct_member_layouts(root)
+        member_layout_tables(root).last
+      end
+
+      # The walker {MemberLayoutsCollector} replaced for the `Struct.new` table, kept as the shadow harness's
+      # oracle until ADR-116 WD5 has ported every table walker onto {DeclarationWalk}.
+      def legacy_struct_member_layouts(root)
         accumulator = {}
         walk_struct_member_layouts(root, [], accumulator)
         accumulator.freeze
@@ -5589,7 +5860,7 @@ module Rigor
       # stored in instance-ancestor SEARCH order: a later `prepend` statement puts its module NEARER than
       # an earlier one (`prepend A; prepend B` searches B before A) while the arguments of ONE
       # `prepend A, B` keep call order — exactly the convention {#record_extend_targets} documents for
-      # `extend`, and the order `Scope#user_def_through_ancestors`'s prepend wedge consumes. Ruby inserts a
+      # `extend`, and the order `Scope::ResolutionChain` reads a body's prepends in. Ruby inserts a
       # prepended module, and its own ancestry, immediately BEFORE the class that prepends it, so these
       # names outrank the class's own `def`s; without the kind recorded separately from {#build_discovered_includes}
       # there was nothing to order on and `prepend` was silently an `include`.
@@ -5599,13 +5870,16 @@ module Rigor
 
       # One descent, both instance-side mixin tables: the walk classifies each mixin call it sees, so the
       # two tables cost one walk rather than two. Each value is frozen and de-duplicated per class, as the
-      # single-table builder always did.
+      # single-table builder always did. `:unpositioned` names the recorded edges whose order is not a fact
+      # ({MixinAccumulator}).
       def mixin_tables(root)
-        accumulator = {}
+        accumulator = MixinAccumulator.new
+        accumulator.direct_body(program_statements(root))
         walk_class_includes(root, [], nil, accumulator)
         {
           includes: freeze_mixin_lists(accumulator, :include),
-          prepends: freeze_mixin_lists(accumulator, :prepend)
+          prepends: freeze_mixin_lists(accumulator, :prepend),
+          unpositioned: accumulator.unpositioned
         }
       end
 
@@ -5620,7 +5894,10 @@ module Rigor
       # already store nearest-first (see {#write_mixin_targets}), so the concat preserves MRO.
       def freeze_mixin_lists(accumulator, kind)
         accumulator.each_with_object({}) do |(class_name, kinds), out|
-          names = mixin_names_for(kinds, kind).uniq.freeze
+          names = mixin_names_for(kinds, kind)
+          # The instance-side projection is a SET in search order; the prepend table keeps every statement.
+          names = names.uniq if kind == :include
+          names = names.freeze
           out[class_name] = names unless names.empty?
         end.freeze
       end
@@ -5635,6 +5912,12 @@ module Rigor
         end
       end
 
+      # The top-level statements of a parsed file: the one body whose declarations need no enclosing
+      # declaration to be direct ({MixinAccumulator}).
+      def program_statements(root)
+        root.is_a?(Prism::ProgramNode) ? root.statements : root
+      end
+
       def walk_class_includes(node, qualified_prefix, current_class, accumulator,
                               singleton_self: false, singleton_cref: false)
         return unless node.is_a?(Prism::Node)
@@ -5665,6 +5948,25 @@ module Rigor
                                           singleton_self, singleton_cref)
         end
 
+        walk_includes_children(node, qualified_prefix, current_class, accumulator, singleton_self, singleton_cref)
+      end
+
+      # The generic descent of {#walk_class_includes}; a `self.included(base)`-style hook's body walks with
+      # its parameters in scope ({MixinAccumulator#with_hook_params}).
+      def walk_includes_children(node, qualified_prefix, current_class, accumulator, singleton_self, singleton_cref)
+        hook_params = hook_def_params(node)
+        if hook_params
+          return accumulator.with_hook_params(hook_params) do
+            walk_includes_children_plain(node, qualified_prefix, current_class, accumulator, singleton_self,
+                                         singleton_cref)
+          end
+        end
+
+        walk_includes_children_plain(node, qualified_prefix, current_class, accumulator, singleton_self, singleton_cref)
+      end
+
+      def walk_includes_children_plain(node, qualified_prefix, current_class, accumulator, singleton_self,
+                                       singleton_cref)
         node.rigor_each_child do |child|
           walk_class_includes(child, qualified_prefix, current_class, accumulator,
                               singleton_self: singleton_self, singleton_cref: singleton_cref)
@@ -5682,6 +5984,7 @@ module Rigor
         return true unless node.body
 
         _self_decl, child_prefix, child_cref = ctx
+        accumulator.direct_body(node.body) if accumulator.direct?(node)
         walk_class_includes(node.body, child_cref ? [] : child_prefix,
                             child_cref ? nil : child_prefix.join("::"), accumulator,
                             singleton_cref: child_cref)
@@ -5752,7 +6055,7 @@ module Rigor
         # names, so it declines rather than re-anchoring to the lexical class.
         unnameable_self = singleton_self || (singleton_cref && current_class.nil?)
         rebound = rebound_block_self(node, qualified_prefix, nil, nil,
-                                     rebound_self_base(unnameable_self ? OPAQUE_SELF : current_class))
+                                     unnameable_self ? OPAQUE_SELF : current_class)
         node.rigor_each_child do |child|
           rebinds_self = rebound && child.is_a?(Prism::BlockNode)
           owner =
@@ -5776,15 +6079,150 @@ module Rigor
       # it or the set-shaped consumers (arity, visibility, undefined-method suppression) would answer
       # differently for the two spellings of one edge.
       def record_mixin_call(node, qualified_prefix, current_class, accumulator)
-        return unless mixin_call_recorded?(node, current_class)
+        taint_opaque_eval(node, current_class, accumulator)
+        kind, _arguments, via_send = mixin_call_view(node)
+        return if kind.nil?
+
+        effects = mixin_effects(node, kind, qualified_prefix, current_class, accumulator, in_singleton: false)
+                  .select { |_owner, side| side == :include }
+        return if effects.empty?
+        return if !via_send && instance_mixin_recorded?(node, qualified_prefix, current_class, accumulator)
+
+        # A mixin call the tables cannot hold still reshapes the ancestry: taint the whole owner side.
+        effects.each { |owner, side| accumulator.taint(owner, side) }
+      end
+
+      # Records the instance-side edges of a call {#mixin_call_recorded?} accepts. False when it recorded
+      # nothing — the caller then taints the owner instead.
+      def instance_mixin_recorded?(node, qualified_prefix, current_class, accumulator)
+        return false unless mixin_call_recorded?(node, current_class)
 
-        targets = node.arguments&.arguments&.filter_map { |arg| Source::ConstantPath.qualified_name(arg) }
-        return if targets.nil? || targets.empty?
+        arguments = node.arguments&.arguments || []
+        targets = arguments.filter_map { |arg| Source::ConstantPath.qualified_name(arg) }
+        return false if targets.empty?
 
         owner = node.receiver.nil? ? current_class : prepend_call_receiver(node, qualified_prefix)
-        return if owner.nil?
+        return false if owner.nil?
 
         write_mixin_targets(accumulator, owner, targets, prepend: node.name == :prepend)
+        accumulator.note(node, owner, :include, targets, complete: targets.size == arguments.size)
+        true
+      end
+
+      MIXIN_KINDS = %i[include prepend extend].freeze
+      SEND_CALL_NAMES = %i[send public_send __send__].freeze
+      private_constant :MIXIN_KINDS, :SEND_CALL_NAMES
+
+      # `[kind, arguments, via_send]` for a call that mixes modules in — `include` / `prepend` / `extend`, or
+      # `send(:include, M)` and its `public_send` / `__send__` twins with a literal first argument — else nil.
+      # A computed `send` name is not read as a mixin: it names nothing this walk could taint by.
+      def mixin_call_view(node)
+        return [node.name, node.arguments&.arguments || [], false] if MIXIN_KINDS.include?(node.name)
+        return unless SEND_CALL_NAMES.include?(node.name)
+
+        arguments = node.arguments&.arguments || []
+        first = arguments.first
+        return unless first.is_a?(Prism::SymbolNode) || first.is_a?(Prism::StringNode)
+
+        # By string: a name literal need not be a valid symbol in its encoding.
+        kind = MIXIN_KINDS.find { |candidate| candidate.name == first.unescaped }
+        [kind, arguments.drop(1), true] if kind
+      end
+
+      # `[[owner, side], …]` — the ancestry sides a mixin call reshapes. `self` and the implicit receiver
+      # are the enclosing class (`:include` for `include` / `prepend`, `:extend` for `extend`, and both
+      # flip to `:extend` inside `class << self`); `singleton_class` is the singleton side; a constant is
+      # that class; any other receiver is unknown, so it may be the class that includes this one from a
+      # hook (`base.include M`) and taints both sides of the enclosing class.
+      def mixin_effects(node, kind, qualified_prefix, current_class, accumulator, in_singleton:)
+        receiver = node.receiver
+        side = kind == :extend ? :extend : :include
+        pairs =
+          if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+            own_mixin_effects(kind, side, current_class, in_singleton)
+          else
+            receiver_mixin_effects(node, side, qualified_prefix, current_class, accumulator)
+          end
+        pairs.reject { |owner, _side| owner.nil? }
+      end
+
+      # The implicit-receiver / `self` arm of {#mixin_effects}: inside `class << self`, `include` / `prepend`
+      # are singleton-side and `extend` reaches the singleton's own singleton, which nothing names.
+      def own_mixin_effects(kind, side, current_class, in_singleton)
+        return [] if in_singleton && kind == :extend
+
+        [[current_class, in_singleton ? :extend : side]]
+      end
+
+      # A receiver that is not `self` reshapes the class it names, or the singleton of `singleton_class`. Any
+      # other receiver is an object of its own (`ids.prepend(1)`, `obj.extend(Decorator)`) and reshapes none of
+      # the enclosing class's ancestry — except in a `self.included(base)`-style hook, where `base` IS the
+      # class that includes the enclosing module and a call on it taints both sides of the enclosing class.
+      def receiver_mixin_effects(node, side, qualified_prefix, current_class, accumulator)
+        receiver = node.receiver
+        return [[current_class, :extend]] if singleton_class_receiver?(receiver)
+
+        owner = prepend_call_receiver(node, qualified_prefix)
+        return [[owner, side]] if owner
+        return [] unless hook_receiver?(receiver, accumulator)
+
+        [[current_class, :include], [current_class, :extend]]
+      end
+
+      HOOK_DEFS = %i[included extended prepended inherited].freeze
+      MIXIN_EVAL_CALLS = %i[class_eval module_eval class_exec module_exec instance_eval instance_exec].freeze
+      private_constant :HOOK_DEFS, :MIXIN_EVAL_CALLS
+
+      # The parameter names of a `def included(base)`-style hook (a hook is written `def self.included`, or
+      # `def included` inside `class << self`), else nil.
+      def hook_def_params(node)
+        return nil unless node.is_a?(Prism::DefNode) && HOOK_DEFS.include?(node.name)
+
+        parameters = node.parameters
+        return [] unless parameters
+
+        (parameters.requireds + parameters.optionals).filter_map do |parameter|
+          parameter.name if parameter.respond_to?(:name)
+        end
+      end
+
+      # Whether `receiver` is a hook parameter, or `singleton_class` / a no-argument call chain off one.
+      def hook_receiver?(receiver, accumulator)
+        case receiver
+        when Prism::LocalVariableReadNode then accumulator.hook_local?(receiver.name)
+        when Prism::CallNode
+          receiver.arguments.nil? && receiver.receiver && hook_receiver?(receiver.receiver, accumulator)
+        else false
+        end
+      end
+
+      # `base.class_eval { include X }` in a hook, and `opaque.module_eval { include B }` anywhere: the block
+      # opens a class this walk cannot name, so its mixin calls record nowhere, yet the enclosing class's
+      # ancestry is what the reader was asked about. Taint both sides of the enclosing class. Outside a hook
+      # the block is scanned for a mixin call first, so an ordinary `obj.instance_eval { … }` DSL taints nothing.
+      def taint_opaque_eval(node, current_class, accumulator)
+        return unless current_class && node.block.is_a?(Prism::BlockNode) && MIXIN_EVAL_CALLS.include?(node.name)
+
+        receiver = node.receiver
+        return if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+        return if Source::ConstantPath.qualified_name_or_nil(receiver)
+        return unless hook_receiver?(receiver, accumulator) || block_mixes_in?(node.block)
+
+        accumulator.taint(current_class, :include)
+        accumulator.taint(current_class, :extend)
+      end
+
+      def block_mixes_in?(node)
+        return true if node.is_a?(Prism::CallNode) && (MIXIN_KINDS.include?(node.name) || mixin_call_view(node))
+
+        found = false
+        node.rigor_each_child { |child| found ||= block_mixes_in?(child) }
+        found
+      end
+
+      def singleton_class_receiver?(receiver)
+        receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class && receiver.arguments.nil? &&
+          (receiver.receiver.nil? || receiver.receiver.is_a?(Prism::SelfNode))
       end
 
       # Issue #1123 — one class's contribution to the two tables. A prepended module lands in BOTH: the
@@ -5802,12 +6240,15 @@ module Rigor
       # freeze time — ahead of every include, where Ruby puts them.
       def write_mixin_targets(accumulator, owner, targets, prepend:)
         bucket = accumulator[owner] ||= {}
-        if prepend
-          (bucket[:prepend] ||= []).unshift(*targets)
-        else
-          list = (bucket[:include] ||= [])
-          list.unshift(*targets.reject { |target| list.include?(target) })
-        end
+        kind, other = prepend ? %i[prepend include] : %i[include prepend]
+        list = (bucket[kind] ||= [])
+        # A target the OTHER kind already carries (`include M; prepend M`) is one body the two tables cannot
+        # represent (Ruby's `[M, C, M]`), so the instance side is named unpositioned.
+        accumulator.taint(owner, :include) if targets.any? { |target| bucket[other]&.include?(target) }
+        # A repeated `include` keeps its first position (Ruby skips it). A repeated `prepend` is KEPT: the
+        # prepend table holds every statement, nearest first, so the readers that walk the raw list see what
+        # they always saw, and the resolution chain dedupes per owner, first statement winning.
+        list.unshift(*(prepend ? targets : targets.reject { |target| list.include?(target) }))
       end
 
       # Whether a mixin call contributes to the tables at all: a receiverless `include` / `prepend` needs an
@@ -5851,9 +6292,19 @@ module Rigor
       # Issue #915 — plus `class << self; include M; end`, the same singleton ancestor spelled through the
       # singleton-class body. It folds like an `extend` because Ruby makes it one.
       def build_discovered_extends(root)
-        accumulator = {}
+        extend_tables(root).fetch(:extends)
+      end
+
+      # {#build_discovered_extends} and the `extend` edges whose order is not a fact ({MixinAccumulator}), from
+      # one descent.
+      def extend_tables(root)
+        accumulator = MixinAccumulator.new
+        accumulator.direct_body(program_statements(root))
         walk_class_extends(root, [], nil, accumulator)
-        accumulator.transform_values { |mods| mods.uniq.freeze }.freeze
+        {
+          extends: accumulator.transform_values { |mods| mods.uniq.freeze }.freeze,
+          unpositioned: accumulator.unpositioned
+        }
       end
 
       def walk_class_extends(node, qualified_prefix, current_class, accumulator, in_singleton: false,
@@ -5880,18 +6331,40 @@ module Rigor
           return if walk_extends_meta_new?(node, qualified_prefix, current_class, accumulator,
                                            in_singleton, singleton_self, singleton_cref)
         when Prism::CallNode
-          record_extend_call(node, current_class, accumulator, in_singleton: in_singleton)
+          record_extend_call(node, qualified_prefix, current_class, accumulator, in_singleton: in_singleton)
           if receiver_eval_call?(node)
             return walk_eval_extends_call(node, qualified_prefix, current_class, accumulator,
                                           in_singleton: in_singleton, singleton_self: singleton_self,
                                           singleton_cref: singleton_cref)
           end
-          if node.block.is_a?(Prism::BlockNode)
-            return walk_extends_block_call(node, qualified_prefix, current_class, accumulator,
-                                           in_singleton, singleton_self, singleton_cref)
+          if node.block.is_a?(Prism::BlockNode) &&
+             extends_block_handled?(node, qualified_prefix, current_class, accumulator,
+                                    in_singleton, singleton_self, singleton_cref)
+            return
           end
         end
 
+        walk_extends_children(node, qualified_prefix, current_class, accumulator, in_singleton, singleton_self,
+                              singleton_cref)
+      end
+
+      # The generic descent of {#walk_class_extends}; a hook's body walks with its parameters in scope.
+      def walk_extends_children(node, qualified_prefix, current_class, accumulator, in_singleton, singleton_self,
+                                singleton_cref)
+        hook_params = hook_def_params(node)
+        if hook_params
+          return accumulator.with_hook_params(hook_params) do
+            walk_extends_children_plain(node, qualified_prefix, current_class, accumulator, in_singleton,
+                                        singleton_self, singleton_cref)
+          end
+        end
+
+        walk_extends_children_plain(node, qualified_prefix, current_class, accumulator, in_singleton, singleton_self,
+                                    singleton_cref)
+      end
+
+      def walk_extends_children_plain(node, qualified_prefix, current_class, accumulator, in_singleton,
+                                      singleton_self, singleton_cref)
         node.rigor_each_child do |child|
           walk_class_extends(child, qualified_prefix, current_class, accumulator,
                              in_singleton: in_singleton, singleton_self: singleton_self,
@@ -5915,6 +6388,7 @@ module Rigor
         # singleton body, `self` IS the singleton and `class << self` opens the
         # singleton's own singleton (`#<Class:#<Class:C>>`), which nothing names.
         opens_self = node.expression.is_a?(Prism::SelfNode) && !in_singleton
+        accumulator.direct_body(node.body) if opens_self && accumulator.direct?(node)
         walk_class_extends(node.body, qualified_prefix, opens_self ? current_class : nil,
                            accumulator, in_singleton: opens_self,
                                         singleton_self: true, singleton_cref: true)
@@ -5931,6 +6405,8 @@ module Rigor
         return unless child_prefix && node.body
 
         child_cref = unnameable_decl?(node, self_decl, singleton_cref)
+        accumulator.direct_body(node.body) if accumulator.direct?(node)
+        accumulator.body_statements(node.body)
         walk_class_extends(node.body, child_cref ? [] : child_prefix,
                            child_cref ? nil : child_prefix.join("::"), accumulator,
                            singleton_cref: child_cref)
@@ -5954,6 +6430,110 @@ module Rigor
                                   in_singleton, singleton_self, singleton_cref)
       end
 
+      # What the extends walk does with a block-carrying call: `:rebound` (its own eval / `define_method` / meta-new
+      # handling), `:skip` (the block runs on an object this walk cannot vouch for, as an instance's `synchronize`
+      # or an `on_load` hook, or may never run: `Registry.each { … }`), or `:descend` (it provably runs once with the
+      # body's `self`, #1592, and its direct statements are positioned when the call itself is).
+      def extends_block_plan(node, accumulator)
+        return :rebound if rebinding_extends_block?(node)
+        return :skip unless runs_body_block_once?(node, accumulator)
+
+        accumulator.direct_body(node.block.body) if accumulator.direct?(node)
+        :descend
+      end
+
+      # True when {#extends_block_plan} settled the block (walked as rebound, or skipped); false leaves it to the
+      # generic descent.
+      def extends_block_handled?(node, qualified_prefix, current_class, accumulator, in_singleton, singleton_self,
+                                 singleton_cref)
+        case extends_block_plan(node, accumulator)
+        when :skip then true
+        when :rebound
+          walk_extends_block_call(node, qualified_prefix, current_class, accumulator,
+                                  in_singleton, singleton_self, singleton_cref)
+          true
+        else false
+        end
+      end
+
+      ARRAY_ITERATORS = %i[each each_with_index map].freeze
+      HASH_ITERATORS = %i[each each_pair each_key each_value map].freeze
+      private_constant :ARRAY_ITERATORS, :HASH_ITERATORS
+
+      # A block that provably runs at least once with the class body's `self`: the call is a statement of the
+      # body itself (not nested in a `def` or another block) and either `tap` / `then` on a literal (they
+      # always yield once, self preserved) or an iterator over a literal that is known non-empty (a
+      # non-empty Array or Hash literal, a positive `Integer#times`, an Integer-literal Range that is not empty,
+      # `upto` / `downto` in the right order). A constant or variable receiver (`Registry.each`, a lazy `map`) may
+      # never yield, so it is not one. The walk then records the block's direct statements as positioned: the
+      # block runs where it is written, and a repeated `extend` is idempotent (#1592).
+      def runs_body_block_once?(node, accumulator)
+        return false unless accumulator.body_block?(node)
+        return literal_or_self?(node.receiver) if %i[tap then].include?(node.name)
+
+        non_empty_literal_iteration?(node.name, node.receiver, node.arguments&.arguments || [])
+      end
+
+      TAP_RECEIVERS = [Prism::IntegerNode, Prism::FloatNode, Prism::StringNode, Prism::SymbolNode, Prism::ArrayNode,
+                       Prism::HashNode, Prism::RangeNode, Prism::NilNode, Prism::TrueNode, Prism::FalseNode].freeze
+      private_constant :TAP_RECEIVERS
+
+      # `tap` / `then` yield once only on a receiver whose method nobody overrode: a literal. A constant or `self`
+      # may define its own `tap` (`def self.tap`), a promise's `then` defers, and a receiverless call may reach a
+      # class-level DSL method, so none of those is read as running.
+      def literal_or_self?(receiver)
+        TAP_RECEIVERS.any? { |kind| receiver.is_a?(kind) }
+      end
+
+      def non_empty_literal_iteration?(name, receiver, arguments)
+        case receiver
+        when Prism::ArrayNode
+          ARRAY_ITERATORS.include?(name) && !receiver.elements.empty? &&
+            receiver.elements.none?(Prism::SplatNode)
+        when Prism::HashNode
+          HASH_ITERATORS.include?(name) && !receiver.elements.empty? &&
+            receiver.elements.all?(Prism::AssocNode)
+        when Prism::IntegerNode then integer_iteration_runs?(name, receiver.value, arguments)
+        when Prism::ParenthesesNode then non_empty_range_iteration?(name, receiver, arguments)
+        else false
+        end
+      end
+
+      def integer_iteration_runs?(name, value, arguments)
+        limit = arguments.first
+        case name
+        when :times then arguments.empty? && value.positive?
+        when :upto then arguments.size == 1 && limit.is_a?(Prism::IntegerNode) && value <= limit.value
+        when :downto then arguments.size == 1 && limit.is_a?(Prism::IntegerNode) && value >= limit.value
+        else false
+        end
+      end
+
+      def positive_integer_literal?(node) = node.is_a?(Prism::IntegerNode) && node.value.positive?
+
+      # `(1..3).each` and `(1..3).map`, and `(1..3).step(2)` with a positive literal step.
+      def non_empty_range_iteration?(name, parens, arguments)
+        range = parens.body.is_a?(Prism::StatementsNode) && parens.body.body.size == 1 ? parens.body.body.first : nil
+        return false unless range.is_a?(Prism::RangeNode)
+        return false unless range.left.is_a?(Prism::IntegerNode) && range.right.is_a?(Prism::IntegerNode)
+
+        low = range.left.value
+        high = range.right.value
+        return false unless range.exclude_end? ? low < high : low <= high
+
+        case name
+        when :each, :map then arguments.empty?
+        when :step then positive_integer_literal?(arguments.first) && arguments.size == 1
+        else false
+        end
+      end
+
+      # Whether {#walk_extends_block_call} owns this block-carrying call. Any other block (`[1].each { extend M }`,
+      # `included do extend M end`) keeps the enclosing `self`, so the generic descent walks it (#1592).
+      def rebinding_extends_block?(node)
+        INSTANCE_EVAL_CALLS.include?(node.name) || node.name == :define_method || meta_new_constant_rvalue?(node)
+      end
+
       # A block whose `self` is an object this walk cannot name — a `define_method` body (its
       # self is the receiver's instance at call time) or an unnamed `Class.new { … }`-family
       # block — walks ownerless with an unnameable self, while the call's receiver and
@@ -6067,19 +6647,39 @@ module Rigor
       # `class << self; extend M; end` puts M on the singleton's OWN singleton, one level further out than
       # anything this table describes, and `module_function` in a singleton body is not the scope toggle
       # {#build_discovered_extends} over-approximates. So the two arms are disjoint rather than additive.
-      def record_extend_call(node, current_class, accumulator, in_singleton: false)
-        return unless current_class && node.receiver.nil?
+      # Inside `class << self` the instance walk is ownerless, so this walk also keeps the instance-side taints
+      # (`base.include X` in a hook written there).
+      def record_extend_call(node, qualified_prefix, current_class, accumulator, in_singleton: false)
+        return record_module_function(node, current_class, accumulator, in_singleton) if node.name == :module_function
 
-        if in_singleton
-          record_extend_targets(node, current_class, accumulator) if MIXIN_CALL_NAMES.include?(node.name)
-          return
-        end
+        taint_opaque_eval(node, current_class, accumulator)
 
-        case node.name
-        when :extend then record_extend_targets(node, current_class, accumulator)
-        when :module_function
-          (accumulator[current_class] ||= []) << current_class if bare_module_function?(node)
-        end
+        kind, _arguments, via_send = mixin_call_view(node)
+        return if kind.nil?
+
+        effects = mixin_effects(node, kind, qualified_prefix, current_class, accumulator, in_singleton: in_singleton)
+                  .select { |_owner, side| side == :extend || in_singleton }
+        return if effects.empty?
+        return if !via_send && singleton_mixin_recorded?(node, kind, current_class, accumulator, in_singleton)
+
+        effects.each { |owner, side| accumulator.taint(owner, side) }
+      end
+
+      # The bare `module_function` toggle: the module extends itself. A direct statement only.
+      def record_module_function(node, current_class, accumulator, in_singleton)
+        return unless current_class && node.receiver.nil? && !in_singleton && ModuleFunctionState.extends_self?(node)
+
+        (accumulator[current_class] ||= []) << current_class
+        accumulator.note(node, current_class, :extend, [current_class], complete: true)
+      end
+
+      # Records the singleton-side edges of a receiverless `extend` (or, inside `class << self`, `include` /
+      # `prepend`). False when it recorded nothing.
+      def singleton_mixin_recorded?(node, kind, current_class, accumulator, in_singleton)
+        return false unless current_class && node.receiver.nil?
+        return false unless in_singleton ? MIXIN_CALL_NAMES.include?(kind) : kind == :extend
+
+        !record_extend_targets(node, current_class, accumulator).empty?
       end
 
       # The table stores search order, not call order: a later `extend` statement prepends its module
@@ -6088,11 +6688,22 @@ module Rigor
       # and consumers iterating the list forward read the same order the singleton ancestry searches.
       def record_extend_targets(node, current_class, accumulator)
         targets = []
-        node.arguments&.arguments&.each do |arg|
+        arguments = node.arguments&.arguments || []
+        arguments.each do |arg|
           target = arg.is_a?(Prism::SelfNode) ? current_class : Source::ConstantPath.qualified_name(arg)
           targets << target if target
         end
-        (accumulator[current_class] ||= []).unshift(*targets) unless targets.empty?
+        return targets if targets.empty?
+
+        list = (accumulator[current_class] ||= [])
+        # A repeated `extend` keeps the table position it always had (the later statement's: the freeze `uniq`s
+        # the nearest-first list), which is not Ruby's (Ruby skips the repeat and keeps the first, #1573), and
+        # the folded singleton tables read that order. The order is not a fact, so the singleton side is named
+        # unpositioned and the chain settles to the readers' own answer.
+        accumulator.taint(current_class, :extend) if targets.any? { |target| list.include?(target) }
+        list.unshift(*targets)
+        accumulator.note(node, current_class, :extend, targets, complete: targets.size == arguments.size)
+        targets
       end
 
       # The materialization half of #526: for every `C extends M`, M's INSTANCE defs become C's
@@ -6100,36 +6711,133 @@ module Rigor
       # call-site return inference runs with `self = Singleton[C]`, which is what Ruby binds). A name C
       # already defines on its own singleton wins (`||=`); an extend target with no discovered defs
       # contributes nothing (RBS-module extends stay on the dispatch tiers).
-      def fold_extends_into_singleton_tables(extends, def_nodes, singleton_def_nodes, methods)
+      #
+      # ADR-119 WD1 — the copy follows its siblings, which this writes (copy on write; a table the caller passed
+      # is never mutated). `unpositioned` is the project's `unpositioned_mixins`; an edge it lists, or taints
+      # with "*", is not a fact, so what it copies is `possible`:
+      #
+      # - a slot the copy WROTE is contested when the edge is listed or the source slot is contested (a slot some
+      #   other copy wrote was decided by that copy, which the `||=` lets win);
+      # - the singleton name is `possible` when the edge is listed or the source name is possible on the instance
+      #   side, unless C's singleton already answers it certainly (never `:both` from here: the instance side is
+      #   not touched);
+      # - a certain copy makes the singleton name certain, so `:singleton` leaves the name's possible kind.
+      #
+      # A contested source with a certain edge contests the slot and leaves the name certain: a value-only
+      # contest does not make the name possible.
+      def fold_extends_into_singleton_tables(extends, def_nodes, singleton_def_nodes, methods, siblings:,
+                                             unpositioned:)
+        owned = {}.compare_by_identity
         extends.each do |class_name, mods|
+          listed_mods = unpositioned.dig(class_name, :extend)
           mods.each do |mod_name|
-            source_defs = extend_source_defs(def_nodes, class_name, mod_name)
+            resolved, source_defs = extend_source_defs(def_nodes, class_name, mod_name)
             next if source_defs.nil?
 
             # An inner table inherited unchanged from a frozen seed must be thawed before the fold writes.
             target = singleton_def_nodes[class_name]
             target = singleton_def_nodes[class_name] = (target ? target.dup : {}) if target.nil? || target.frozen?
+            listed = extend_edge_listed?(listed_mods, mod_name)
             source_defs.each do |method_name, def_node|
+              wrote = target[method_name].nil?
               target[method_name] ||= def_node
+              certain_before = singleton_name_certain?(methods, siblings, class_name, method_name)
               record_method_kind(methods, class_name, method_name, :singleton)
+              follow_extend_siblings(siblings, owned, [class_name, resolved, method_name],
+                                     wrote: wrote, listed: listed, certain_before: certain_before)
             end
           end
         end
       end
 
+      # Whether `unpositioned_mixins` lists the extend edge to `mod_name` (or taints the whole side).
+      def extend_edge_listed?(listed_mods, mod_name)
+        !listed_mods.nil? && (listed_mods.include?(mod_name) || listed_mods.include?(MixinAccumulator::WILDCARD))
+      end
+
+      # Whether `class_name`'s singleton already answers `method_name` through a certain fact: the existence table
+      # covers the singleton side and the `possible` copy does not.
+      def singleton_name_certain?(methods, siblings, class_name, method_name)
+        return false unless covers_singleton?(methods.dig(class_name, method_name))
+
+        !covers_singleton?(siblings[:possible_discovered_methods].dig(class_name, method_name))
+      end
+
+      SINGLETON_KINDS = [:singleton, Scope::DiscoveryIndex::METHOD_KIND_BOTH].freeze
+      INSTANCE_KINDS = [:instance, Scope::DiscoveryIndex::METHOD_KIND_BOTH].freeze
+      private_constant :SINGLETON_KINDS, :INSTANCE_KINDS
+
+      def covers_singleton?(kind)
+        SINGLETON_KINDS.include?(kind)
+      end
+
+      # The sibling half of one copied name; see {#fold_extends_into_singleton_tables}. `names` is
+      # `[extender, resolved source module, method name]`.
+      def follow_extend_siblings(siblings, owned, names, wrote:, listed:, certain_before:)
+        class_name, resolved, method_name = names
+        contested_source = !siblings[:contested_discovered_def_nodes].empty? &&
+                           siblings[:contested_discovered_def_nodes].include?([resolved, method_name])
+        if wrote && (listed || contested_source)
+          own_sibling_table(siblings, owned, :contested_discovered_singleton_def_nodes) << [class_name, method_name]
+        end
+        if listed || source_name_possible?(siblings, resolved, method_name)
+          return if certain_before
+
+          row = (own_sibling_table(siblings, owned, :possible_discovered_methods)[class_name] ||= {})
+          row[method_name] = merge_sibling_kind(row[method_name], :singleton)
+        else
+          strip_possible_singleton(siblings, owned, class_name, method_name)
+        end
+      end
+
+      def source_name_possible?(siblings, resolved, method_name)
+        INSTANCE_KINDS.include?(siblings[:possible_discovered_methods].dig(resolved, method_name))
+      end
+
+      def merge_sibling_kind(sitting, arriving)
+        sitting.nil? || sitting == arriving ? arriving : Scope::DiscoveryIndex::METHOD_KIND_BOTH
+      end
+
+      # A certain copy: `:singleton` leaves the `possible` kind (`:both` becomes `:instance`), and an emptied row goes.
+      def strip_possible_singleton(siblings, owned, class_name, method_name)
+        return unless covers_singleton?(siblings[:possible_discovered_methods].dig(class_name, method_name))
+
+        possible = own_sibling_table(siblings, owned, :possible_discovered_methods)
+        row = possible[class_name]
+        if row[method_name] == :singleton
+          row.delete(method_name)
+          possible.delete(class_name) if row.empty?
+        else
+          row[method_name] = :instance
+        end
+      end
+
+      # The sibling `key` as a table this fold owns: the first write copies it (a Set, or a Hash of Hashes) and
+      # keeps the copy in `siblings`, so a table shared with a seed, a bundle or an empty constant is never written.
+      def own_sibling_table(siblings, owned, key)
+        table = siblings.fetch(key)
+        return table if owned.key?(table)
+
+        copy = table.is_a?(Set) ? table.dup : table.transform_values(&:dup)
+        owned[copy] = true
+        siblings[key] = copy
+      end
+
       # `extend CustomSig` inside `module Outer; class F` stores the as-written name, while
       # `def_nodes` keys the module's defs as `Outer::CustomSig`. Walk the enclosing namespaces
-      # innermost-first so the fold finds the same module Ruby constant-lookup would.
+      # innermost-first so the fold finds the same module Ruby constant-lookup would. Returns
+      # `[the key the defs were found under, the defs]`, or nil.
       def extend_source_defs(def_nodes, class_name, mod_name)
         found = def_nodes[mod_name]
-        return found if found
+        return [mod_name, found] if found
         return nil if mod_name.nil? || mod_name.start_with?("::")
 
         parts = class_name.to_s.split("::")
         while parts.size > 1
           parts.pop
-          found = def_nodes["#{parts.join('::')}::#{mod_name}"]
-          return found if found
+          key = "#{parts.join('::')}::#{mod_name}"
+          found = def_nodes[key]
+          return [key, found] if found
         end
         nil
       end
@@ -6155,9 +6863,83 @@ module Rigor
       # Top-level (no surrounding class) defs do not contribute — Ruby's top-level visibility nuances (private at
       # top-level marks the method on `Object`) are out of scope for v0.1.2.
       def build_discovered_method_visibilities(root)
-        accumulator = {}
+        build_method_visibility_tables(root).first
+      end
+
+      # ADR-119 WD3 — the visibility table and its `contested_discovered_method_visibilities` sibling, from ONE walk
+      # over the file's {Certainty} classification `certainty`: `[table, contested key paths]`. The recorded values
+      # are {#build_discovered_method_visibilities}'s; a slot is contested when its last writer is ({VisibilityTable}).
+      def build_method_visibility_tables(root, certainty: Certainty.possible_nodes(root))
+        accumulator = VisibilityTable.new.track(certainty)
         walk_method_visibilities(root, [], false, :public, accumulator)
-        accumulator.transform_values(&:freeze).freeze
+        [accumulator.transform_values(&:freeze).freeze, accumulator.contested_paths]
+      end
+
+      # The bare calls that set the running default visibility of the body they run in: the modifiers and
+      # `module_function`, which {#walk_method_visibilities} does not track as a value (#1569) but which moves the
+      # default all the same.
+      VISIBILITY_TOGGLES = (VISIBILITY_MODIFIERS + %i[module_function]).freeze
+
+      # The `{class => {name => visibility}}` accumulator of {#walk_method_visibilities}, which also carries the
+      # ADR-119 WD3 state of the slots it writes. A slot is contested when the write that holds it is possible: a
+      # `def` or a named target (`private :x`) the {Certainty} classification reads as possible, or a `def` written
+      # after an UNCERTAIN bare toggle of its body. A toggle is uncertain when it is possible itself or when the walk
+      # does not carry it into the body's running default: one under any child of the body that is not its
+      # statement list (`if c then private end`, `begin private end`, a block, `(private)`), since Ruby applies a
+      # bare toggle there to the body's later `def`s while the walk keeps the default it had. A certain toggle
+      # written directly in the body settles the default again. A named target does not read the running default,
+      # so a toggle does not contest it. A certain write clears the slot's contest.
+      class VisibilityTable < Hash
+        # The bare toggles the walk has met so far; a body's statement loop compares it around each child.
+        attr_accessor :toggles
+        # Whether the running default of the body being walked rests on an uncertain toggle.
+        attr_accessor :uncertain
+        # The file's {Certainty} answer.
+        attr_reader :certainty
+
+        def track(certainty)
+          @certainty = certainty
+          @contested = nil
+          @toggles = 0
+          @uncertain = false
+          self
+        end
+
+        # Records that `node` wrote the `[class_name, name]` slot; `toggled` when the write reads the running
+        # default (a `def`).
+        def wrote(class_name, name, node, toggled:)
+          if Certainty.possible?(@certainty, node) || (toggled && @uncertain)
+            (@contested ||= Set.new) << [class_name, name].freeze
+          else
+            @contested&.delete([class_name, name])
+          end
+        end
+
+        # Runs the block as a fresh body (a class or module, `class << self`, a meta-new or eval block), whose
+        # default starts certain and whose toggles do not reach the enclosing body.
+        def body
+          saved_toggles = @toggles
+          saved_uncertain = @uncertain
+          @uncertain = false
+          yield
+        ensure
+          @toggles = saved_toggles
+          @uncertain = saved_uncertain
+        end
+
+        def contested_paths
+          contested = @contested
+          return Scope::DiscoveryIndex::EMPTY_SIBLINGS[:contested_discovered_method_visibilities] if contested.nil?
+          return Scope::DiscoveryIndex::EMPTY_SIBLINGS[:contested_discovered_method_visibilities] if contested.empty?
+
+          contested.freeze
+        end
+      end
+
+      # A bare toggle ({VISIBILITY_TOGGLES}): receiverless, with no arguments.
+      def bare_visibility_toggle?(node)
+        node.is_a?(Prism::CallNode) && node.receiver.nil? && VISIBILITY_TOGGLES.include?(node.name) &&
+          (node.arguments.nil? || node.arguments.arguments.empty?) && node.block.nil?
       end
 
       # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity, Metrics/AbcSize
@@ -6179,8 +6961,10 @@ module Rigor
             child_cref = unnameable_decl?(node, self_decl, singleton_cref)
             body_prefix = child_cref ? [] : child_prefix
             if node.body
-              walk_method_visibilities(node.body, body_prefix, false, :public,
-                                       accumulator, nil, singleton_cref: child_cref)
+              accumulator.body do
+                walk_method_visibilities(node.body, body_prefix, false, :public,
+                                         accumulator, nil, singleton_cref: child_cref)
+              end
             end
             return current_visibility
           end
@@ -6200,9 +6984,11 @@ module Rigor
                                        defs_singleton: defs_singleton)
             end
             if body
-              walk_method_visibilities(body, qualified_prefix, false, :public,
-                                       accumulator, body_self,
-                                       singleton_cref: singleton_cref)
+              accumulator.body do
+                walk_method_visibilities(body, qualified_prefix, false, :public,
+                                         accumulator, body_self,
+                                         singleton_cref: singleton_cref)
+              end
             end
             return current_visibility
           end
@@ -6217,6 +7003,7 @@ module Rigor
                                                                   defs_singleton: defs_singleton)
             return current_visibility
           end
+          accumulator.toggles += 1 if bare_visibility_toggle?(node)
           # The visibility table is instance-side only — `private :x` inside `class <<`
           # (or a receiver-eval body that re-evaluates a singleton self) marks the
           # SINGLETON method, which this table cannot express.
@@ -6230,13 +7017,23 @@ module Rigor
 
         # Statement-position StatementsNode preserves left-to-right visibility flow; everything else recurses with the
         # entry visibility unchanged.
+        #
+        # ADR-119 WD3 — the statement loop also settles whether the running default is uncertain
+        # ({VisibilityTable}): a bare toggle written here sets it from its own certainty, and any other statement
+        # under which the walk met a toggle makes it uncertain.
         if node.is_a?(Prism::StatementsNode)
           local_visibility = current_visibility
           node.rigor_each_child do |child|
+            toggles = accumulator.toggles
             local_visibility = walk_method_visibilities(child, qualified_prefix, in_singleton_class,
                                                         local_visibility, accumulator, def_owner_prefix,
                                                         singleton_cref: singleton_cref,
                                                         defs_singleton: defs_singleton)
+            if bare_visibility_toggle?(child)
+              accumulator.uncertain = Certainty.possible?(accumulator.certainty, child)
+            elsif accumulator.toggles != toggles
+              accumulator.uncertain = true
+            end
           end
         else
           node.rigor_each_child do |child|
@@ -6263,8 +7060,10 @@ module Rigor
                                  defs_singleton: defs_singleton)
         return unless node.body
 
-        walk_method_visibilities(node.body, qualified_prefix, true, :public, accumulator,
-                                 singleton_prefix, singleton_cref: true)
+        accumulator.body do
+          walk_method_visibilities(node.body, qualified_prefix, true, :public, accumulator,
+                                   singleton_prefix, singleton_cref: true)
+        end
       end
 
       # The eval-block arm of {#walk_method_visibilities}: the block is a fresh class body under
@@ -6295,10 +7094,12 @@ module Rigor
         # receiver-as-module and stay instance-side (`in_singleton_class` off) for a class
         # receiver.
         call_singleton, defs_flag = eval_body_def_context(node, in_singleton_class)
-        node.block.rigor_each_child do |child|
-          walk_method_visibilities(child, qualified_prefix, call_singleton, :public, accumulator,
-                                   eval_prefix, singleton_cref: singleton_cref,
-                                                defs_singleton: defs_flag)
+        accumulator.body do
+          node.block.rigor_each_child do |child|
+            walk_method_visibilities(child, qualified_prefix, call_singleton, :public, accumulator,
+                                     eval_prefix, singleton_cref: singleton_cref,
+                                                  defs_singleton: defs_flag)
+          end
         end
       end
 
@@ -6309,6 +7110,7 @@ module Rigor
         class_name = qualified_prefix.join("::")
         accumulator[class_name] ||= {}
         accumulator[class_name][def_node.name] = current_visibility
+        accumulator.wrote(class_name, def_node.name, def_node, toggled: true)
       end
 
       # Recognises modifier calls on the implicit-self receiver inside a class body. Returns the (possibly updated)
@@ -6329,19 +7131,20 @@ module Rigor
         if args.empty?
           call_node.name
         else
-          apply_named_visibility(args, qualified_prefix, call_node.name, accumulator)
+          apply_named_visibility(args, qualified_prefix, call_node, accumulator)
           current_visibility
         end
       end
 
-      def apply_named_visibility(args, qualified_prefix, visibility, accumulator)
+      def apply_named_visibility(args, qualified_prefix, call_node, accumulator)
         class_name = qualified_prefix.join("::")
         args.each do |arg|
           name = visibility_target_name(arg)
           next if name.nil?
 
           accumulator[class_name] ||= {}
-          accumulator[class_name][name] = visibility
+          accumulator[class_name][name] = call_node.name
+          accumulator.wrote(class_name, name, call_node, toggled: false)
         end
       end
 
@@ -6385,6 +7188,7 @@ module Rigor
       def record_method_envelope_opaque(tables, class_name, method_name)
         %i[instance singleton].each do |kind|
           record_envelope(tables.envelopes, class_name, [kind, method_name], Source::ParameterEnvelope::OPAQUE)
+          contest_envelope(tables, class_name, [kind, method_name]) unless tables.certain
         end
       end
 
@@ -6505,8 +7309,11 @@ module Rigor
       # Post-pass over the `def_nodes` accumulator: for every `alias` declaration inside a class body, if the original
       # method name maps to a `Prism::DefNode`, register the new name pointing to the same node so inter-procedural
       # return-type inference works for the aliased name.
-      def apply_alias_def_nodes(root, accumulator)
-        alias_map = collect_class_alias_map(root, [], {})
+      #
+      # ADR-119 WD3 — the alias is the slot's writer: the new name's slot is contested when the alias is possible
+      # or the slot it copies is contested, and cleared otherwise.
+      def apply_alias_def_nodes(root, accumulator, tables = nil)
+        alias_map = collect_class_alias_map(root, [], AliasMap.new.track(tables&.certainty))
         alias_map.each do |class_name, aliases|
           class_defs = accumulator[class_name]
           next unless class_defs
@@ -6516,10 +7323,40 @@ module Rigor
             next unless def_node.is_a?(Prism::DefNode)
 
             (accumulator[class_name] ||= {})[new_name] = def_node
+            next if tables.nil?
+
+            certain = !alias_map.possible?(class_name, new_name) &&
+                      !tables.contested_def_nodes&.include?([class_name, old_name])
+            follow_slot_writer(tables, :contested_def_nodes, [class_name, new_name], certain)
           end
         end
       end
 
+      # The `{class => {new name => old name}}` map {#collect_class_alias_map} fills, which also remembers, per
+      # entry, whether the alias that wrote it last is possible ({Certainty}).
+      class AliasMap < Hash
+        def track(certainty)
+          @certainty = certainty || Certainty::EMPTY
+          @possible = nil
+          self
+        end
+
+        # Records that `node` wrote the `[class_name, new_name]` entry.
+        def wrote(class_name, new_name, node)
+          return if @certainty.nil?
+
+          if Certainty.possible?(@certainty, node)
+            (@possible ||= Set.new) << [class_name, new_name]
+          else
+            @possible&.delete([class_name, new_name])
+          end
+        end
+
+        def possible?(class_name, new_name)
+          !@possible.nil? && @possible.include?([class_name, new_name])
+        end
+      end
+
       # Builds a map `{class_name => {new_name_sym => old_name_sym}}` by walking the tree for `AliasMethodNode` nodes
       # inside class bodies. `leaf_owner` is the meta-new override: inside `K = Class.new { … }` the
       # block's aliases bind on the class the write names — it overrides `qualified_prefix`, which
@@ -6579,7 +7416,7 @@ module Rigor
         # class bodies (`Class.new do … end`), so the walk continues below it either way.
         names = alias_method_call_names(node)
         if names && !rec_prefix.empty? && !(singleton_cref && leaf_owner.nil?)
-          (accumulator[rec_prefix.join("::")] ||= {})[names.first] = names.last
+          record_alias_call_entry(accumulator, rec_prefix.join("::"), names, node)
         end
         false
       end
@@ -6688,6 +7525,11 @@ module Rigor
         accumulator
       end
 
+      def record_alias_call_entry(accumulator, class_name, names, node)
+        (accumulator[class_name] ||= {})[names.first] = names.last
+        accumulator.wrote(class_name, names.first, node) if accumulator.is_a?(AliasMap)
+      end
+
       def record_alias_map_entry(alias_node, qualified_prefix, accumulator)
         return if qualified_prefix.empty?
         return unless alias_node.new_name.is_a?(Prism::SymbolNode) && alias_node.old_name.is_a?(Prism::SymbolNode)
@@ -6696,6 +7538,7 @@ module Rigor
         new_name = alias_node.new_name.unescaped.to_sym
         old_name = alias_node.old_name.unescaped.to_sym
         (accumulator[class_name] ||= {})[new_name] = old_name
+        accumulator.wrote(class_name, new_name, alias_node) if accumulator.is_a?(AliasMap)
       end
 
       def record_define_method(call_node, qualified_prefix, in_singleton_class, accumulator)
@@ -6848,6 +7691,8 @@ module Rigor
           physical = buffer ? buffer.resolve(path) : path
           root = Prism.parse(File.read(physical), filepath: path).value
           accumulate_project_index(acc, path, root)
+        rescue DeclarationWalk::ContractError
+          raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
           # Skip files that fail to parse or read; the per-file analyzer surfaces the parse error separately.
           next
@@ -6880,6 +7725,8 @@ module Rigor
           code_fingerprints[path] = code_fingerprint(source, parsed.comments)
           declaration_signatures[path] = declaration_signature(file_index)
           refinements[path] = file_index[:refinements] if file_index[:refinements]
+        rescue DeclarationWalk::ContractError
+          raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
           next
         end
@@ -6910,9 +7757,29 @@ module Rigor
         append_def_signatures(parts, file_index[:def_nodes], "#")
         append_def_signatures(parts, file_index[:singleton_def_nodes], ".")
         append_envelope_signature(parts, file_index[:parameter_envelopes] || {})
+        append_certainty_signature(parts, file_index[:siblings] || {})
         Digest::SHA256.hexdigest(parts.join("\x00"))
       end
 
+      # ADR-119 WD3 — which of the file's contributions are possible is a declaration surface too: a `… end if X`
+      # modifier, or moving a `def` into a block, keeps every def line and envelope and moves only this, while a
+      # dependent's candidate-set read now declines where it answered.
+      def append_certainty_signature(parts, siblings)
+        certainty = []
+        siblings.each do |name, table|
+          next if table.empty?
+
+          if name == :possible_discovered_methods
+            table.each do |class_name, row|
+              row.each { |method_name, kind| certainty << "P:#{class_name}##{method_name}=#{kind}" }
+            end
+          else
+            table.each { |path| certainty << "C:#{name}:#{path.inspect}" }
+          end
+        end
+        parts.concat(certainty.sort)
+      end
+
       # Issue #992 — the joined envelope table is a declaration surface the per-def signatures above cannot
       # reconstruct: they keep the LAST `def` of a name, and they see neither a second `def` with another
       # shape nor a `memoize :f` beside it, either of which moves a dependent's `call.wrong-arity` verdict.
@@ -6950,13 +7817,26 @@ module Rigor
       def append_ancestry_signature(parts, file_index)
         parts.concat(file_index[:class_sources].keys.sort_by(&:to_s).map { |cn| "c:#{cn}" })
         parts.concat(sorted_by_class(file_index[:superclasses]).map { |cn, sc| "s:#{cn}<#{sc}" })
-        parts.concat(sorted_by_class(file_index[:includes]).map do |cn, mods|
-          "i:#{cn}=#{Array(mods).map(&:to_s).sort.join(',')}"
-        end)
+        append_mixin_signature(parts, file_index)
         parts.concat(sorted_by_class(file_index[:data_member_layouts]).map { |cn, l| "d:#{cn}=#{l.inspect}" })
         parts.concat(sorted_by_class(file_index[:struct_member_layouts]).map { |cn, l| "t:#{cn}=#{l.inspect}" })
       end
 
+      # The mixin surface of {#append_ancestry_signature}. The lists keep SOURCE order: this is one file's own
+      # index, so the order is deterministic, and it is a fact an ancestor-order reader consumes, so an edit
+      # that only reorders an `include` must move the signature. The unpositioned table is there for the same
+      # reason: guarding an `include` changes no name and no order, only whether the order is known.
+      def append_mixin_signature(parts, file_index)
+        { "i" => :includes, "p" => :prepends, "x" => :extends }.each do |tag, key|
+          sorted_by_class(file_index[key] || {}).each { |cn, mods| parts << "#{tag}:#{cn}=#{Array(mods).join(',')}" }
+        end
+        sorted_by_class(file_index[:unpositioned_mixins] || {}).each do |cn, sides|
+          sides.sort_by { |side, _| side.to_s }.each do |side, names|
+            parts << "u:#{cn}.#{side}=#{names.sort.join(',')}"
+          end
+        end
+      end
+
       # A class-keyed table's pairs sorted by class name (stringified) for a deterministic signature.
       def sorted_by_class(table)
         table.sort_by { |cn, _| cn.to_s }
@@ -7079,6 +7959,8 @@ module Rigor
           root = Prism.parse(File.read(physical), filepath: path).value
           collect_class_decls(root, [], classes)
           accumulate_project_index(acc, path, root)
+        rescue DeclarationWalk::ContractError
+          raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
           # Skip files that fail to parse or read; the per-file analyzer surfaces the parse error separately.
           next
@@ -7148,6 +8030,8 @@ module Rigor
             classes.merge!(file_classes)
             fold_file_index(acc, file_index)
           end
+        rescue DeclarationWalk::ContractError
+          raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
           # Skip files that fail to parse / read; the per-file analyzer surfaces the parse error separately.
           next
@@ -7170,6 +8054,7 @@ module Rigor
       # Polymorphic over the def-node value: a re-walked file's `file_index` carries live nodes; a cached
       # bundle's carries {DefHandle}s. The merges never deref the value, so both fold identically.
       def fold_file_index(acc, file_index)
+        fold_siblings(acc, file_index)
         fold_def_tables(acc, file_index)
         # Issue #992 — a pre-23 seed bundle carries no envelopes; the SCHEMA bump makes such a blob a cold
         # rebuild, and an absent table only ever withholds a check.
@@ -7190,6 +8075,168 @@ module Rigor
         fold_constant_tables(acc, file_index)
       end
 
+      # ADR-119 WD1 — the `possible_*` / `contested_*` siblings of {Scope::DiscoveryIndex::SIBLINGS}, carried as ONE
+      # `{sibling name => table}` Hash (`acc[:siblings]`) through the accumulator, the fold, the compact-header
+      # rename, the finalize and the seed bundle, so no copy path names a sibling and none can drop one. A pre-36
+      # bundle carries the empty siblings of the walk before WD3's producers, and the SCHEMA bump makes such a blob
+      # a cold rebuild. Called BEFORE the file's members fold, because the `possible` rule reads the accumulator's
+      # member as it stood ({#fold_file_siblings}).
+      def fold_siblings(acc, file_index)
+        fold_file_siblings(acc, file_index[:siblings] || {},
+                           methods: file_index[:methods], def_nodes: file_index[:def_nodes],
+                           singleton_def_nodes: file_index[:singleton_def_nodes],
+                           method_visibilities: file_index[:method_visibilities])
+      end
+
+      # ADR-119 WD3 — folds one file's siblings into the accumulator under each member's own fold, so the result is
+      # the same in any file order and a bundle-served file folds as its live walk would:
+      #
+      # - `possible_discovered_methods` by {#fold_possible_methods} against `acc[:methods]` before this file's
+      #   `methods` join it;
+      # - the def-node and visibility slots follow their writer, as the members fold later-wins: the file's contests
+      #   replace the accumulator's on every key the file writes ({#fold_slot_contests});
+      # - every other sibling (the joined envelopes' contests among them) by union.
+      def fold_file_siblings(acc, siblings, methods:, def_nodes:, singleton_def_nodes:, method_visibilities: {})
+        target = acc[:siblings]
+        siblings.each do |name, table|
+          target[name] =
+            case name
+            when :possible_discovered_methods
+              fold_possible_methods(target.fetch(name), acc[:methods], table, methods)
+            when :contested_discovered_def_nodes then fold_slot_contests(target.fetch(name), def_nodes, table)
+            when :contested_discovered_singleton_def_nodes
+              fold_slot_contests(target.fetch(name), singleton_def_nodes, table)
+            when :contested_discovered_method_visibilities
+              fold_slot_contests(target.fetch(name), method_visibilities, table)
+            else union_sibling_value(target.fetch(name), table)
+            end
+        end
+      end
+
+      # ADR-119 WD3 — the `possible_discovered_methods` fold, per name and side: `P' = (P − C_f) ∪ (P_f − C)`,
+      # where `C = member − P` is what the accumulator (or seed) answers certainly and `C_f = member_f − P_f` what
+      # the file does. A side some contribution supplies certainly is never possible, whatever the order the files
+      # fold in. Returns `possible` itself when nothing changes; otherwise a copy (the rows are copied once).
+      def fold_possible_methods(possible, members, file_possible, file_members)
+        result = strip_file_certain(possible, file_possible, file_members)
+        add_file_possible(result, possible, members, file_possible)
+      end
+
+      # `P − C_f`: `possible` less the sides the file answers certainly; `possible` itself when nothing goes.
+      def strip_file_certain(possible, file_possible, file_members)
+        result = possible
+        possible.each do |class_name, row|
+          file_row = file_members[class_name]
+          next if file_row.nil?
+
+          row.each do |method_name, kind|
+            certain = kind_minus(file_row[method_name], file_possible.dig(class_name, method_name))
+            remaining = kind_minus(kind, certain)
+            next if remaining == kind
+
+            result = possible.transform_values(&:dup) if result.equal?(possible)
+            remaining.nil? ? result[class_name].delete(method_name) : (result[class_name][method_name] = remaining)
+          end
+          result.delete(class_name) if result[class_name].empty?
+        end
+        result
+      end
+
+      # `∪ (P_f − C)`: the file's possible sides the accumulator (`members` less `possible`) does not answer
+      # certainly. Copies `result` first when it is still `possible`.
+      def add_file_possible(result, possible, members, file_possible)
+        file_possible.each do |class_name, row|
+          row.each do |method_name, kind|
+            added = kind_minus(kind, kind_minus(members.dig(class_name, method_name),
+                                                possible.dig(class_name, method_name)))
+            next if added.nil?
+
+            merged = merge_sibling_kind(result.dig(class_name, method_name), added)
+            next if merged == result.dig(class_name, method_name)
+
+            result = possible.transform_values(&:dup) if result.equal?(possible)
+            (result[class_name] ||= {})[method_name] = merged
+          end
+        end
+        result
+      end
+
+      # The sides of `kind` that `removed` does not cover (nil when none); either may be nil.
+      def kind_minus(kind, removed)
+        return kind if removed.nil? || kind.nil?
+        return nil if removed == Scope::DiscoveryIndex::METHOD_KIND_BOTH || removed == kind
+
+        kind == Scope::DiscoveryIndex::METHOD_KIND_BOTH ? without_kind(kind, removed) : kind
+      end
+
+      # ADR-119 WD3 — a single-valued slot's contests after a later-wins fold: the slots the file writes take the
+      # file's contests (`file_contested`), every other key keeps the accumulator's (`sitting`). `file_slots` is the
+      # file's `{class => {name => value}}` table. Returns `sitting` itself when nothing changes.
+      def fold_slot_contests(sitting, file_slots, file_contested)
+        stale = sitting.empty? ? nil : sitting.select { |class_name, name| file_slots[class_name]&.key?(name) }
+        return sitting if (stale.nil? || stale.empty?) && file_contested.empty?
+
+        result = stale.nil? || stale.empty? ? sitting.dup : sitting - stale
+        result.merge(file_contested)
+      end
+
+      def union_paths(sitting, arriving)
+        return sitting if arriving.empty?
+        return arriving if sitting.empty?
+
+        sitting | arriving
+      end
+
+      # The union of two sibling tables or entries. A Hash merges per key and a Set or Array unions; two scalars
+      # that disagree are a `discovered_methods`-style kind and combine to `:both`, as {#merge_method_kinds} does.
+      def union_sibling_value(sitting, arriving)
+        return arriving if sitting.nil? || sitting.empty?
+        return sitting if arriving.nil? || arriving.empty?
+
+        case sitting
+        when Hash then sitting.merge(arriving) { |_key, left, right| union_sibling_value(left, right) }
+        when Set, Array then sitting | arriving
+        else sitting == arriving ? sitting : Scope::DiscoveryIndex::METHOD_KIND_BOTH
+        end
+      end
+
+      # The sibling tables keyed by file path rather than by class name, which a compact-header rename leaves alone
+      # exactly as it leaves the `deferred_ranges` member alone.
+      SIBLINGS_KEYED_BY_PATH = %i[possible_discovered_deferred_ranges].freeze
+      private_constant :SIBLINGS_KEYED_BY_PATH
+
+      # {#apply_compact_header_renames!} for the siblings: a class-keyed Hash re-keys (colliding keys union), and a
+      # Set of key paths renames each path's first element, the class.
+      def rename_siblings(siblings, renames)
+        siblings.to_h do |name, table|
+          next [name, table] if SIBLINGS_KEYED_BY_PATH.include?(name) || table.empty?
+
+          renamed = case table
+                    when Set then table.to_set { |path| [rename_compact_name(renames, path.first), *path.drop(1)] }
+                    else rename_sibling_hash(table, renames)
+                    end
+          [name, renamed]
+        end
+      end
+
+      def rename_sibling_hash(table, renames)
+        table.each_with_object({}) do |(class_name, entry), out|
+          renamed = rename_compact_name(renames, class_name)
+          out[renamed] = out.key?(renamed) ? union_sibling_value(out[renamed], entry) : entry
+        end
+      end
+
+      def freeze_siblings(siblings)
+        siblings.each_value { |table| freeze_sibling_table(table) }
+        siblings.freeze
+      end
+
+      def freeze_sibling_table(table)
+        table.each_value { |entry| freeze_sibling_table(entry) } if table.is_a?(Hash)
+        table.each { |entry| entry.freeze if entry.is_a?(Array) } if table.is_a?(Set)
+        table.freeze
+      end
+
       # Issue #1120 — a union, so the fold is order-independent and a bundle-served file folds exactly as its live
       # walk would. The slot stays nil until some file refines something (see {#finalize_def_index}).
       def fold_refinements(acc, file_refinements)
@@ -7264,6 +8311,7 @@ module Rigor
         # resolves the class as it did before the ordering fix, which is this table's empty state.
         accumulate_prepend_lists(acc[:prepends], file_index[:prepends] || {})
         accumulate_extend_lists(acc[:extends], file_index[:extends] || {})
+        accumulate_unpositioned(acc[:unpositioned_mixins], file_index[:unpositioned_mixins] || {})
       end
 
       # The `extends` half stores singleton-ancestor search order ({#record_extend_targets}), so a file
@@ -7288,14 +8336,14 @@ module Rigor
       # class. Shared with {#accumulate_extend_lists}' shape deliberately — the two tables answer the
       # `prepend` question on the two sides of the class object, and both fold nearest-first.
       def accumulate_prepend_lists(target, additions)
-        additions.each { |cn, mods| target[cn] = (mods + (target[cn] || [])).uniq }
+        additions.each { |cn, mods| target[cn] = (mods + (target[cn] || [])) }
       end
 
       # ADR-85 WD2 — converts a file's live single-file index + its class table into a Marshal-clean seed
       # bundle: the plain-data tables verbatim, the def-node tables re-expressed as `[node_id, name,
       # fingerprint]` triples (the path is the bundle key), the class-source names (path implicit), and the
       # content digest that gates the bundle's reuse.
-      def build_seed_bundle(file_index, file_classes, digest, code_fingerprint)
+      def build_seed_bundle(file_index, file_classes, digest, code_fingerprint) # rubocop:disable Metrics/AbcSize -- one read per bundle slot
         {
           digest: digest,
           # B1 — the comment-stripped code fingerprint, so a recheck can prove this file's edit was
@@ -7324,6 +8372,9 @@ module Rigor
           # the bundle stays Marshal-clean and a warm incremental file orders its prepends the way a cold
           # walk of it does.
           prepends: file_index[:prepends],
+          # The mixin edges whose order is not a fact — plain `{class name => Array[String]}` data, so the
+          # bundle stays Marshal-clean and a warm file flags the edges its cold walk flags.
+          unpositioned_mixins: file_index[:unpositioned_mixins],
           method_visibilities: file_index[:method_visibilities],
           methods: file_index[:methods],
           # Issue #992 — plain `{class name => {[kind, name] => [min, max, required_keywords] | :opaque}}`
@@ -7345,14 +8396,16 @@ module Rigor
           # nothing), so the bundle stays Marshal-clean.
           refinements: file_index[:refinements],
           # Issue #1367 — the file's {GlobalWriteCensus}, a Set of frozen Arrays, which Marshal round-trips.
-          global_write_census: file_index[:global_write_census]
+          global_write_census: file_index[:global_write_census],
+          # ADR-119 WD1 — `{sibling name => table}`, plain Hashes, Sets and rows, so the bundle stays Marshal-clean.
+          siblings: file_index[:siblings]
         }
       end
 
       # ADR-85 WD2 — reconstitutes a cached bundle into a single-file index {#fold_file_index} folds: the
       # def-node triples become {DefHandle}s bound to this file's `path`, and the class-source names become a
       # `{name => Set[path]}` table (the shape `accumulate_project_index` produces).
-      def bundle_to_file_index(bundle, path)
+      def bundle_to_file_index(bundle, path) # rubocop:disable Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity -- one read per bundle slot
         {
           def_nodes: bundle_defs_to_handles(bundle[:def_nodes], path),
           singleton_def_nodes: bundle_defs_to_handles(bundle[:singleton_def_nodes], path),
@@ -7368,6 +8421,8 @@ module Rigor
           prepends: bundle[:prepends] || {},
           # #526 — pre-extends bundles lack the key; default `{}` keeps the fold total.
           extends: bundle[:extends] || {},
+          # A pre-32 bundle lacks the key; the SCHEMA bump rebuilds it cold, and the fold defaults it anyway.
+          unpositioned_mixins: bundle[:unpositioned_mixins],
           method_visibilities: bundle[:method_visibilities],
           methods: bundle[:methods],
           parameter_envelopes: bundle[:parameter_envelopes] || {},
@@ -7384,7 +8439,9 @@ module Rigor
           # Issue #1120 — absent from a pre-28 bundle, which the SCHEMA bump rebuilds cold.
           refinements: bundle[:refinements],
           # Issue #1367 — absent from a pre-29 bundle, which the SCHEMA bump rebuilds cold.
-          global_write_census: bundle[:global_write_census] || GlobalWriteCensus::EMPTY
+          global_write_census: bundle[:global_write_census] || GlobalWriteCensus::EMPTY,
+          # ADR-119 WD1 — absent from a pre-35 bundle, which the SCHEMA bump rebuilds cold.
+          siblings: bundle[:siblings] || Scope::DiscoveryIndex::EMPTY_SIBLINGS
         }
       end
 
@@ -7415,7 +8472,8 @@ module Rigor
       def new_def_index_accumulator
         { def_nodes: {}, def_nestings: {}.compare_by_identity,
           singleton_def_nodes: {}, def_sources: {}, singleton_def_sources: {},
-          superclasses: {}, header_nestings: {}, includes: {}, prepends: {}, extends: {}, method_visibilities: {},
+          superclasses: {}, header_nestings: {}, includes: {}, prepends: {}, extends: {}, unpositioned_mixins: {},
+          method_visibilities: {},
           methods: {},
           deferred_ranges: {},
           parameter_envelopes: {}, class_sources: {},
@@ -7424,7 +8482,9 @@ module Rigor
           constant_writes: {},
           data_member_layouts: {}, struct_member_layouts: {},
           # Issue #1367 — the project's {GlobalWriteCensus}.
-          global_write_census: Set.new }
+          global_write_census: Set.new,
+          # ADR-119 WD1 — the pair siblings, `{sibling name => table}` (see {#fold_siblings}).
+          siblings: Scope::DiscoveryIndex::EMPTY_SIBLINGS.dup }
       end
 
       # Post-processes and freezes a fully-folded def-index accumulator.
@@ -7437,27 +8497,42 @@ module Rigor
         # Issue #644 — resolve the cross-file constant-reassignment rule here, where the whole project's
         # write census is known, and turn the surviving literals into their published `Type::Constant`.
         acc[:constant_values], acc[:constant_sources] = finalize_constant_writes(acc[:constant_writes])
-        fold_extends_into_singleton_tables(acc[:extends], acc[:def_nodes], acc[:singleton_def_nodes], acc[:methods])
+        # ADR-119 WD1 — the two passes below rewrite `def_nodes`, `singleton_def_nodes` and `methods`, and each carries
+        # its sibling along. `subtract_def_methods` drops `def`-declared names from `methods`, and
+        # {#subtract_sibling_methods!} applies the same drop to `possible_discovered_methods`. The extends fold copies
+        # an extended module's instance defs onto the extender's singleton, and follows the siblings the same way (a
+        # copy is possible or contested when its edge is listed in `unpositioned_mixins` or its source was).
+        # Until a producer fills a sibling and an edge is listed, there is nothing for either pass to follow.
+        fold_project_extends(acc)
         # Cross-file method suppression is for the project's OWN accessors (attr_* / define_method / alias) — NOT for
         # plain `def`s. A cross-file `def` on a class is exactly the ADR-17 monkey-patch case the undefined-method rule
         # deliberately surfaces (fire + def-site annotation, nudging `pre_eval:`), so dropping the `def`-declared names
         # keeps that contract intact while still letting `attr_reader :x` in one file suppress a false undefined-method
         # for `obj.x` in another.
         acc[:methods] = subtract_def_methods(acc[:methods], acc[:def_nodes])
+        subtract_sibling_methods!(acc)
         finalize_call_surface_tables(acc)
-        %i[def_nodes singleton_def_nodes def_sources singleton_def_sources includes prepends method_visibilities
-           methods parameter_envelopes class_sources constant_sources deferred_ranges].each do |key|
+        %i[def_nodes singleton_def_nodes def_sources singleton_def_sources includes prepends
+           method_visibilities methods parameter_envelopes class_sources constant_sources deferred_ranges].each do |key|
           acc[key].each_value(&:freeze)
         end
         acc.transform_values(&:freeze)
       end
 
+      # The project-wide extends fold over the accumulator's tables and siblings.
+      def fold_project_extends(acc)
+        fold_extends_into_singleton_tables(acc[:extends], acc[:def_nodes], acc[:singleton_def_nodes], acc[:methods],
+                                           siblings: acc[:siblings], unpositioned: acc[:unpositioned_mixins])
+      end
+
       # The two whole-project tables only call rules read: the issue #992 envelope table gains its project-wide
       # key, and the issue #1120 refinement table, nil until some file refines something, settles to a frozen one.
       def finalize_call_surface_tables(acc)
         acc[:parameter_envelopes][Scope::DiscoveryIndex::ENVELOPE_PROJECT_WIDE] ||= {}
         acc[:refinements] = freeze_refinements(acc[:refinements])
         acc[:global_write_census] = acc[:global_write_census].freeze
+        acc[:unpositioned_mixins].each_value { |sides| sides.each_value(&:freeze).freeze }
+        freeze_siblings(acc[:siblings])
       end
 
       # Removes, per class, the method names that have a project `def` node, leaving only
@@ -7478,6 +8553,30 @@ module Rigor
         end
       end
 
+      # ADR-119 WD1 — the `possible` copy of `methods` loses the INSTANCE half of a name that has a project `def`
+      # (`:instance` goes, `:both` becomes `:singleton`), so `possible_discovered_methods` stays a subset of its
+      # member after the rule above. A `:singleton` entry stays: the `def` is the instance side, and the member
+      # keeps the name's singleton half. Only that sibling is rewritten.
+      def subtract_sibling_methods!(acc)
+        possible = acc[:siblings][:possible_discovered_methods]
+        return if possible.nil?
+
+        acc[:siblings] =
+          acc[:siblings].merge(possible_discovered_methods: subtract_sibling_instance_defs(possible, acc[:def_nodes]))
+      end
+
+      def subtract_sibling_instance_defs(possible, def_nodes)
+        possible.each_with_object({}) do |(class_name, table), out|
+          defs = def_nodes[class_name] || {}
+          kept = table.each_with_object({}) do |(method_name, kind), acc|
+            next acc[method_name] = kind unless defs.key?(method_name)
+
+            acc[method_name] = :singleton unless kind == :instance
+          end
+          out[class_name] = kept unless kept.empty?
+        end
+      end
+
       # Folds one file's class-keyed indexes into the cross-file accumulator. `method_visibilities` (ADR-35) is
       # collected here so the override-visibility-reduced rule can read an ancestor's visibility declared in a sibling
       # file.
@@ -7485,26 +8584,43 @@ module Rigor
         # One combined descent yields both the methods existence table and the def-node table; the latter is also
         # consumed by `record_class_sources`, so a def-dense file is walked once here instead of three times (methods +
         # def-nodes ×2). See {#build_methods_and_def_nodes}.
-        file_methods, file_def_nodes, file_envelopes, file_refinements = build_methods_and_def_nodes(root, path)
+        file_methods, file_def_nodes, file_envelopes, file_refinements, file_singleton_def_nodes, certainty =
+          walk_def_contributions(acc, path, root)
         merge_discovered_defs(acc[:def_nodes], acc[:def_sources], path, file_def_nodes)
         fold_parameter_envelopes(acc, file_envelopes)
         fold_refinements(acc, file_refinements)
         # Issue #681 — node-identity keyed, so this is a flat union: no two files can contribute the same key.
-        acc[:def_nestings].merge!(build_def_nestings(root))
+        walked = declaration_walk_tables(root, path)
+        acc[:def_nestings].merge!(walked.fetch(:def_nestings))
         # ADR-46 slice 4 (singleton) — record the singleton-side `"path:line"` sources alongside the nodes,
         # the exact mirror of the instance-side `merge_discovered_defs`, so a class/singleton-method body edit
         # produces a changed `"Class.method"` fingerprint pair (and its call sites a symbol edge) instead of
         # silently degrading to the file's full ancestry closure.
         merge_discovered_defs(acc[:singleton_def_nodes], acc[:singleton_def_sources], path,
-                              build_discovered_singleton_def_nodes(root))
-        superclasses, header_nestings = build_superclass_tables(root, path)
+                              file_singleton_def_nodes)
+        superclasses = walked.fetch(:superclasses)
         acc[:superclasses].merge!(superclasses)
-        merge_header_nestings(acc[:header_nestings], header_nestings)
+        merge_header_nestings(acc[:header_nestings], walked.fetch(:header_nestings))
         ancestry_keys = fold_file_mixin_tables(acc, root)
         record_file_positions(acc, path, root, superclasses, ancestry_keys, file_def_nodes)
         merge_constant_literal_tables(acc, root, path)
-        merge_class_keyed_index_tables(acc, root, file_methods)
-        merge_member_layout_tables(acc, root)
+        merge_class_keyed_index_tables(acc, root, file_methods, certainty)
+        merge_member_layout_tables(acc, walked)
+      end
+
+      # The two def-contribution walks of {#accumulate_project_index}, over ONE {Certainty} classification, with the
+      # file's siblings folded into the accumulator BEFORE its members join it (ADR-119 WD3: the `possible` rule
+      # reads the accumulator's member as it stood). Returns `[methods, def_nodes, envelopes, refinements,
+      # singleton_def_nodes, certainty]`, the classification passed on for the visibility walk.
+      def walk_def_contributions(acc, path, root)
+        certainty = Certainty.possible_nodes(root)
+        file_methods, file_def_nodes, file_envelopes, file_refinements, file_siblings =
+          build_methods_and_def_nodes(root, path, certainty: certainty)
+        file_singleton_def_nodes, file_singleton_contested = build_singleton_def_tables(root, certainty: certainty)
+        fold_file_siblings(acc, file_siblings.merge(contested_discovered_singleton_def_nodes: file_singleton_contested),
+                           methods: file_methods, def_nodes: file_def_nodes,
+                           singleton_def_nodes: file_singleton_def_nodes)
+        [file_methods, file_def_nodes, file_envelopes, file_refinements, file_singleton_def_nodes, certainty]
       end
 
       # Issue #1123 — this file's three instance- / singleton-side module lists, folded into the
@@ -7516,12 +8632,24 @@ module Rigor
       # {#accumulate_project_index} to hold its ABC budget.
       def fold_file_mixin_tables(acc, root)
         mixin = mixin_tables(root)
+        extend_side = extend_tables(root)
         accumulate_include_lists(acc[:includes], mixin[:includes])
         accumulate_prepend_lists(acc[:prepends], mixin[:prepends])
-        accumulate_extend_lists(acc[:extends], build_discovered_extends(root))
+        accumulate_extend_lists(acc[:extends], extend_side[:extends])
+        accumulate_unpositioned(acc[:unpositioned_mixins], mixin[:unpositioned])
+        accumulate_unpositioned(acc[:unpositioned_mixins], extend_side[:unpositioned])
         mixin[:includes].merge(mixin[:prepends]) { |_cn, included_mods, _prepends| included_mods }
       end
 
+      # {Scope::DiscoveryIndex#unpositioned_mixins} folds by union, so the fold is order-independent and a
+      # bundle-served file folds exactly as its live walk would.
+      def accumulate_unpositioned(target, additions)
+        additions.each do |class_name, sides|
+          sitting = (target[class_name] ||= {})
+          sides.each { |side, names| sitting[side] = sitting.key?(side) ? (sitting[side] | names) : names.dup }
+        end
+      end
+
       # Issue #644 — folds one file's publication census into the cross-file accumulator, keyed by
       # (name, path) (kept out of {#accumulate_project_index} to hold its ABC budget). The conflict rule that
       # makes the fold order irrelevant runs at {#finalize_constant_writes}. Issue #1367 — the same walk carries the
@@ -7536,16 +8664,24 @@ module Rigor
 
       # Folds one file's Data + Struct member-layout tables into the cross-file accumulator (kept out of
       # {#accumulate_project_index} to hold its ABC budget).
-      def merge_member_layout_tables(acc, root)
-        acc[:data_member_layouts].merge!(build_data_member_layouts(root))
-        acc[:struct_member_layouts].merge!(build_struct_member_layouts(root))
+      def merge_member_layout_tables(acc, walked)
+        acc[:data_member_layouts].merge!(walked.fetch(:data_member_layouts))
+        acc[:struct_member_layouts].merge!(walked.fetch(:struct_member_layouts))
       end
 
       # Folds the per-class method-visibility and method-existence tables of one file into the cross-file accumulator
       # (kept out of {#accumulate_project_index} to hold its ABC budget). `file_methods` is the existence table from the
       # combined methods/def-nodes descent.
-      def merge_class_keyed_index_tables(acc, root, file_methods)
-        build_discovered_method_visibilities(root).each do |class_name, table|
+      #
+      # ADR-119 WD3 — the visibility slots fold later-wins, so their contests follow the file that wrote them
+      # ({#fold_slot_contests}), as the def-node slots' do.
+      def merge_class_keyed_index_tables(acc, root, file_methods, certainty)
+        file_visibilities, file_contested = build_method_visibility_tables(root, certainty: certainty)
+        siblings = acc[:siblings]
+        siblings[:contested_discovered_method_visibilities] = fold_slot_contests(
+          siblings[:contested_discovered_method_visibilities], file_visibilities, file_contested
+        )
+        file_visibilities.each do |class_name, table|
           (acc[:method_visibilities][class_name] ||= {}).merge!(table)
         end
         file_methods.each do |class_name, table|
@@ -7657,8 +8793,7 @@ module Rigor
           tables.write_census.visit(node, top_level: qualified_prefix.empty?)
         end
 
-        rebound = rebound_block_self(node, qualified_prefix, nil, meta_owner,
-                                     rebound_self_base(self_owner))
+        rebound = rebound_block_self(node, qualified_prefix, nil, meta_owner, self_owner)
         # A `ConstantWriteNode`'s only child is its rvalue, so this reaches exactly the call whose block the
         # constant names — and nil everywhere else, leaving every other descent as it was.
         #
@@ -8181,6 +9316,16 @@ module Rigor
         end
       end
 
+      # {#rekey_class_table} for `unpositioned_mixins`: two bodies landing on one key keep BOTH sides' names,
+      # where the Hash arm of {#combine_rekeyed_entries} would replace one side's list with the other's.
+      def rekey_unpositioned(table, renames)
+        table.each_with_object({}) do |(name, sides), out|
+          out.merge!(rename_compact_name(renames, name) => sides) do |_key, sitting, arriving|
+            sitting.merge(arriving) { |_side, a, b| a | b }
+          end
+        end
+      end
+
       def rekey_parameter_envelopes(table, renames)
         table.each_with_object({}) do |(name, entries), out|
           out.merge!(rename_compact_name(renames, name) => entries) do |_key, sitting, arriving|
@@ -8221,7 +9366,7 @@ module Rigor
       # definition — the pre-#728 answer for a name no site recorded — so it keeps unioning. A KEYED entry is
       # the cref of the site that wrote that exact name, and the two sides are two different sites, so
       # unioning their chains would hand each site's ancestor the other's namespace: `Wrap::Mixin` sorts
-      # ahead of `::Mixin`, and `Scope#compute_ancestor_class_name` takes the first known class as the sole
+      # ahead of `::Mixin`, and the ancestor-name resolution takes the first known class as the sole
       # resolution, so the top-level site's `include Mixin` silently became the `Wrap` one. That is not just
       # a wrong class, it is a FALSE POSITIVE source — the two modules' same-named methods can differ in
       # arity, and `call.wrong-arity` then fires on a correct program.
@@ -8309,6 +9454,8 @@ module Rigor
            struct_member_layouts constant_writes].each do |key|
           acc[key] = rekey_class_table(acc[key], renames)
         end
+        acc[:unpositioned_mixins] = rekey_unpositioned(acc[:unpositioned_mixins], renames)
+        acc[:siblings] = rename_siblings(acc[:siblings], renames)
         # Issue #992 — the envelope table cannot take {#combine_rekeyed_entries}' later-wins Hash merge: two
         # bodies of one class landing on the same key are exactly the reopening whose disagreement must
         # make a name opaque.
@@ -8486,10 +9633,11 @@ module Rigor
                        Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
         return false unless child_prefix
 
-        if singleton_cref && !decl_nameable_under_cref?(node) && !self_decl&.any?
+        if self_decl&.empty? || (singleton_cref && !decl_nameable_under_cref?(node) && !self_decl&.any?)
           # `class D` below `class <<` opens `#<singleton>::D` — a real class nothing can
           # name — so nothing is registered; the body still walks so nameable headers
-          # below it re-anchor at a real cref.
+          # below it re-anchor at a real cref. The same holds for `class self::D` where
+          # `self` is opaque (`REGISTRY.first.class_eval { … }`): `self_decl` is `[]`.
           if node.body
             record_declarations(node.body, [], identity_table, discovered, renames,
                                 nil, singleton_cref: true)