rigortype 0.4.2 → 0.4.4

data/lib/rigor/inference/scope_indexer.rb

@@ -101,13 +101,17 @@ module Rigor
       #   bodies from their CONVERGED bindings so per-line probes
       #   (`rigor annotate`) reflect the post-writeback state, not the
       #   cap-N intermediate constants. Off for the check path.
+      # @param widen_clauses — check-path flag (issue #1231): a rescue or
+      #   `ensure` clause records the variables the `begin` body writes as
+      #   `Dynamic[top]`. Off for every other reader, so parameter inference
+      #   and sig-gen observe the clause's plain entry.
       # @return identity-comparing
       #   table whose default value is `default_scope`.
       # The no-op re-anchoring table (#722 residue 2): shared so the overwhelmingly common
       # nothing-to-re-anchor walk allocates none.
       EMPTY_RENAMES = {}.freeze
 
-      def index(root, default_scope:, converged_loop_recording: false) # rubocop:disable Metrics/AbcSize
+      def index(root, default_scope:, converged_loop_recording: false, widen_clauses: false) # rubocop:disable Metrics/AbcSize
         # Slice A-declarations. Build the declaration overrides first so every scope handed to the StatementEvaluator
         # already carries the table; structural sharing through `Scope#with_local` / `#with_fact` / `#with_self_type`
         # propagates it across every derived scope.
@@ -194,7 +198,8 @@ module Rigor
 
         on_enter = ->(node, scope) { table[node] = scope }
         StatementEvaluator.new(scope: seeded_scope, on_enter: on_enter,
-                               converged_loop_recording: converged_loop_recording).evaluate(root)
+                               converged_loop_recording: converged_loop_recording,
+                               widen_clauses: widen_clauses).evaluate(root)
 
         propagate(root, table, seeded_scope)
         table
@@ -502,6 +507,7 @@ module Rigor
         method_assign_effects = build_method_assign_effects(root)
         walk_class_ivars(root, [], default_scope, accumulator, mutated_ivars,
                          read_before_write, init_writes, method_assign_effects)
+        exempt_class_body_writes!(init_writes, accumulator.delete(DEFINE_METHOD_WRITES) || {})
         merge_held_ivar_writes!(accumulator)
         record_aliased_ivar_mutations!(root, mutated_ivars)
         widen_mutated_ivar_entries!(accumulator, mutated_ivars)
@@ -509,6 +515,19 @@ module Rigor
         accumulator.transform_values(&:freeze).freeze
       end
 
+      # Folds the class-body writes {#collect_class_body_ivar_writes} held under {CLASS_BODY_WRITES} into the
+      # `init_writes` exemption, except for an ivar a `define_method` block of the class writes (#1768). Such an ivar
+      # had no census entry before the block's writes were counted, so the exemption never applied to it; a
+      # class-body `@x = nil` writes the class object's ivar and says nothing about whether an instance's `@x` is set,
+      # and exempting it would seed `@x` non-nil from the block's write alone (`if @x` folding always-truthy on an
+      # instance whose `@x` is unset). It keeps the read-before-write `nil` instead, which only widens.
+      def exempt_class_body_writes!(init_writes, define_method_writes)
+        (init_writes.delete(CLASS_BODY_WRITES) || {}).each do |class_name, ivars|
+          kept = ivars - (define_method_writes[class_name] || EMPTY_GUARDED_IVARS)
+          (init_writes[class_name] ||= Set.new).merge(kept)
+        end
+      end
+
       # B2.3 — finalize the read-before-write nil contribution. For each class, for each ivar where SOME method body
       # observed a read-before-write AND no `initialize` write exists for that ivar, contribute `Constant[nil]` to the
       # class-wide accumulator.
@@ -849,6 +868,7 @@ module Rigor
           owner = def_owner || qualified_prefix
           collect_initializer_block_ivars(node, owner, default_scope, accumulator, mutated_ivars, init_writes)
           record_attr_writer_ivars(node, owner, accumulator) if ATTR_WRITER_MACROS.include?(node.name)
+          collect_define_method_block_ivars(node, owner, default_scope, accumulator, mutated_ivars)
           false
         else
           walk_ivars_meta_new?(node, qualified_prefix, default_scope, accumulator,
@@ -1060,6 +1080,44 @@ module Rigor
         end
       end
 
+      # The `define_method` arm of {#walk_class_ivars} (#1768). `define_method(:m) { … }` on the implicit
+      # or `self` receiver installs its block as an instance method of `owner`, and Ruby runs the body on
+      # the instance, so its `@x = …` writes are the instance's ivars exactly as a `def m` body's are —
+      # `DefineMethodBlockSelf` narrows the block's `self` the same way when it is evaluated. Without this
+      # arm an ivar `initialize` sets to `nil` and a `define_method` block sets to a String read as `nil`
+      # in every sibling `def`. The block is typed under the instance `self`, as a def body is. Only the
+      # literal-block form counts: a `define_method(:m, callable)` or `&callable` argument is not walked.
+      # `owner` is empty in a `class << self` body (the call defines a class method there) and in an
+      # anonymous factory body, and the block contributes nothing there. A `define_method` inside a `def`
+      # body is already reached by that body's walk ({#gather_ivar_writes} enters blocks).
+      def collect_define_method_block_ivars(node, owner, default_scope, accumulator, mutated_ivars)
+        return if owner.empty?
+        return unless define_method_block_call?(node)
+
+        block = node.block
+        return unless block.body
+
+        class_name = owner.join("::")
+        body_scope = census_body_scope(default_scope, owner, Type::Combinator.nominal_of(class_name))
+        gather_ivar_writes(block.body, body_scope, class_name, accumulator, EMPTY_GUARDED_IVARS, mutated_ivars)
+        written = (accumulator[DEFINE_METHOD_WRITES] ||= {})[class_name] ||= Set.new
+        define_method_written_ivars(block.body, written)
+      end
+
+      # The ivars a `define_method` block body writes, in any write form, outside a nested `def` / `class` / `module`.
+      def define_method_written_ivars(node, acc)
+        return unless node.is_a?(Prism::Node)
+        return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
+
+        case node
+        when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode,
+             Prism::InstanceVariableAndWriteNode, Prism::InstanceVariableOperatorWriteNode,
+             Prism::InstanceVariableTargetNode
+          acc << node.name
+        end
+        node.rigor_each_child { |child| define_method_written_ivars(child, acc) }
+      end
+
       # ADR-38 block-form gate: true when a loaded plugin declares `method_name` a block-form initializer for
       # `class_name` (or an ancestor). Mirrors `additional_initializer?` but queries `covers_block_method?` instead of
       # `covers_method?`.
@@ -1151,15 +1209,21 @@ module Rigor
       # every `@x = …` write target as a class-body init. Consumed by `contribute_read_before_write_nil!` to exempt
       # ivars the author already knows might be nil (the `@x = nil` at class-body level is the canonical nullability
       # acknowledgement; the instance @x is technically a separate store, but the pragmatic intent is unambiguous).
+      #
+      # A literal `define_method` block is a method body, not class-body code (#1768): its writes reach the census as
+      # a `def` body's do, so they must not exempt the ivar from the read-before-write `nil` either. Only its receiver
+      # and arguments are walked.
       def collect_class_body_ivar_writes(node, class_name, init_writes)
         return unless node.is_a?(Prism::Node)
         return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
 
+        return collect_define_method_argument_writes(node, class_name, init_writes) if define_method_block_call?(node)
+
         if node.is_a?(Prism::InstanceVariableWriteNode) ||
            node.is_a?(Prism::InstanceVariableOrWriteNode) ||
            node.is_a?(Prism::InstanceVariableAndWriteNode) ||
            node.is_a?(Prism::InstanceVariableOperatorWriteNode)
-          (init_writes[class_name] ||= Set.new) << node.name
+          ((init_writes[CLASS_BODY_WRITES] ||= {})[class_name] ||= Set.new) << node.name
         end
 
         node.rigor_each_child do |child|
@@ -1167,6 +1231,18 @@ module Rigor
         end
       end
 
+      # The arguments of a `define_method` block call, walked by {#collect_class_body_ivar_writes} in place of the
+      # call's children so the block body stays out of the class-body init writes.
+      def collect_define_method_argument_writes(node, class_name, init_writes)
+        node.arguments&.arguments&.each { |arg| collect_class_body_ivar_writes(arg, class_name, init_writes) }
+      end
+
+      # A `define_method` call with a literal block on the implicit or `self` receiver: the block is an instance
+      # method body of the class the walk is in (#1768).
+      def define_method_block_call?(node)
+        DefineMethodBlockSelf.define_method_on_lexical_self?(node) && node.block.is_a?(Prism::BlockNode)
+      end
+
       def detect_read_before_write(node, seen_writes, read_first)
         return unless node.is_a?(Prism::Node)
         return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
@@ -2006,6 +2082,13 @@ module Rigor
       OPERATOR_WRITE_CONTRIBUTIONS = :operator_write_contributions
       private_constant :AND_WRITE_CONTRIBUTIONS, :OPERATOR_WRITE_CONTRIBUTIONS
 
+      # The same Symbol-key convention for two side tables the walk fills and {#build_class_ivar_index} removes
+      # before anything reads class names: the ivars each class's `define_method` blocks write (in the
+      # accumulator), and the class-body writes held out of `init_writes` until {#exempt_class_body_writes!}.
+      DEFINE_METHOD_WRITES = :define_method_writes
+      CLASS_BODY_WRITES = :class_body_writes
+      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES
+
       # Unions `type` into the class-ivar accumulator for `(class_name, ivar_name)`. Shared by the single-write and
       # multi-write (parallel-assignment) collectors.
       def accumulate_ivar_type(accumulator, class_name, ivar_name, type)
@@ -3990,6 +4073,7 @@ module Rigor
           if methods_acc.mentions_refine? && methods_acc.refine_in?(location.start_offset, location.end_offset)
             node.rigor_each_child { |child| census_scan(child, qualified_prefix, methods_acc) }
           end
+          record_foreign_singleton_def(node, qualified_prefix, owner_prefix, methods_acc.at(node))
           unless def_owner_prefix&.empty? || defs_singleton == :unnameable ||
                  (singleton_cref && owner_prefix.empty?)
             singleton_def = in_singleton_class || defs_singleton
@@ -4729,6 +4813,50 @@ module Rigor
         acc[:deferred_ranges][path] = build_deferred_ranges(root)
         record_class_sources(acc[:class_sources], path, root, superclasses, includes, file_def_nodes,
                              acc[:compact_headers])
+        record_singleton_class_sources(acc[:singleton_class_sources], path, root)
+      end
+
+      # `{name => Set[path]}` for a bundle's name list (a bundle written before the list existed has none).
+      def bundle_path_sets(names, path) = (names || []).to_h { |name| [name, Set[path]] }
+
+      # Issue #1752 — the constants a `class << Const` body opens in this file, and those whose singleton side a call
+      # there may rewrite ({#singleton_side_call?}). Such a body records facts about
+      # `Const`'s singleton class (a `remove_method`, a `def`) without declaring `Const`, so it stays out of
+      # `class_sources` (whose readers take a name there as one the project declares) and joins only the per-file
+      # class-declaration sets the incremental `class:` edges diff (`Runner#class_declarations`).
+      def record_singleton_class_sources(sources, path, root)
+        collect_singleton_class_targets(root, []) { |name| (sources[name] ||= Set.new) << path }
+      end
+
+      def collect_singleton_class_targets(node, lexical_prefix, &)
+        case node
+        when Prism::ClassNode, Prism::ModuleNode
+          prefix = Source::ConstantPath.declaration_prefix(lexical_prefix, node.constant_path)
+          node.body && prefix && collect_singleton_class_targets(node.body, prefix, &)
+          return
+        when Prism::SingletonClassNode
+          rendered = singleton_receiver_constant_name(node.expression)
+          yield eval_constant_receiver_prefix(node, node.expression, rendered, lexical_prefix).join("::") if rendered
+        when Prism::CallNode
+          yield_singleton_side_constant(node, node.receiver, lexical_prefix, &) if singleton_side_call?(node)
+        end
+        node.rigor_each_child { |child| collect_singleton_class_targets(child, lexical_prefix, &) }
+      end
+
+      # A call on a constant that may rewrite its singleton side (`Const.singleton_class`,
+      # `Const.define_singleton_method`, `Const.extend(M)`, `Const.instance_eval { … }`) records facts about `Const`'s
+      # singleton methods the refinement walk reads from a file that need not declare `Const`, so the file joins the
+      # constant's set too. Written inside `Const`'s own body, the name is in the file's set already; a `def Const.x`
+      # files its own `method:` key.
+      def singleton_side_call?(node)
+        node.name == :singleton_class || surface_rewriting_call?(node)
+      end
+
+      def yield_singleton_side_constant(node, receiver, lexical_prefix)
+        return unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+
+        rendered = singleton_receiver_constant_name(receiver)
+        yield eval_constant_receiver_prefix(node, receiver, rendered, lexical_prefix).join("::") if rendered
       end
 
       def build_deferred_ranges(root)
@@ -6954,7 +7082,9 @@ module Rigor
       def extends_block_handled?(node, qualified_prefix, current_class, accumulator, in_singleton, singleton_self,
                                  singleton_cref)
         case extends_block_plan(node, accumulator)
-        when :skip then true
+        when :skip
+          taint_skipped_singleton_rewrites(node.block, qualified_prefix, current_class, accumulator)
+          true
         when :rebound
           walk_extends_block_call(node, qualified_prefix, current_class, accumulator,
                                   in_singleton, singleton_self, singleton_cref)
@@ -6963,6 +7093,31 @@ module Rigor
         end
       end
 
+      # Issue #1906 — a block the extends walk skips may still run, and a `singleton_class` call in it, or in a `def`
+      # it holds (`[1].each { D.singleton_class.alias_method :own, :other }` in a method body,
+      # `to_prepare do def helper = D.singleton_class.alias_method(...) end`), reaches no mark the methods walk records
+      # there. Every such call taints the side it may rewrite, as {#singleton_class_rewrite_tainted?} does for one the
+      # walk visits; a constant receiver taints every name it can denote from here.
+      def taint_skipped_singleton_rewrites(node, qualified_prefix, current_class, accumulator)
+        return unless node.is_a?(Prism::Node)
+
+        if node.is_a?(Prism::CallNode) && singleton_class_of_receiver?(node.receiver) && surface_rewriting_call?(node)
+          skipped_rewrite_owners(node.receiver.receiver, qualified_prefix, current_class).each do |owner|
+            accumulator.taint(owner, :extend)
+          end
+        end
+        node.rigor_each_child do |child|
+          taint_skipped_singleton_rewrites(child, qualified_prefix, current_class, accumulator)
+        end
+      end
+
+      def skipped_rewrite_owners(object, qualified_prefix, current_class)
+        return [current_class].compact if object.nil? || object.is_a?(Prism::SelfNode)
+        return [] unless object.is_a?(Prism::ConstantReadNode) || object.is_a?(Prism::ConstantPathNode)
+
+        constant_receiver_candidates(object, qualified_prefix)
+      end
+
       ARRAY_ITERATORS = %i[each each_with_index map].freeze
       HASH_ITERATORS = %i[each each_pair each_key each_value map].freeze
       private_constant :ARRAY_ITERATORS, :HASH_ITERATORS
@@ -7160,6 +7315,7 @@ module Rigor
         return record_module_function(node, current_class, accumulator, in_singleton) if node.name == :module_function
 
         taint_opaque_eval(node, current_class, accumulator)
+        return if singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator)
 
         kind, _arguments, via_send = mixin_call_view(node)
         return if kind.nil?
@@ -7172,6 +7328,76 @@ module Rigor
         effects.each { |owner, side| accumulator.taint(owner, side) }
       end
 
+      # Issue #1752 — a call that rewrites a singleton class reached through `singleton_class` (`singleton_class.
+      # class_eval { def x }`, `singleton_class.send(:define_method, :x)`, `Const.singleton_class.prepend(M)`,
+      # `Const.singleton_class.send(:include, M)`) puts methods or modules on that singleton class that no edge
+      # records, so its singleton side is unpositioned: the owner is the enclosing class for a bare or `self.`
+      # receiver, else the constant. True when it tainted.
+      #
+      # Issue #1906 — a naming call with literal names ({#singleton_class_named_call?}) marks only its names instead,
+      # but only where it is a direct statement (a top-level statement, or one of a direct declaration body or of a
+      # block that runs there once): there the methods walk records those marks under the same owner. In a method
+      # body, a hook or a conditional it may run on a receiver or at a time the marks cannot place, so it still taints.
+      def singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator)
+        receiver = node.receiver
+        return false unless singleton_class_of_receiver?(receiver) && surface_rewriting_call?(node)
+        return false if singleton_class_named_call?(node) && accumulator.direct?(node)
+
+        owner = singleton_class_owner(node, receiver.receiver, qualified_prefix, current_class)
+        return false if owner.nil?
+
+        accumulator.taint(owner, :extend)
+        true
+      end
+
+      # A bare, `self.` or constant receiver's `singleton_class` call.
+      def singleton_class_of_receiver?(receiver)
+        receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class && receiver.arguments.nil?
+      end
+
+      # An `attr_*`, `alias_method`, `define_method` or `remove_method` on a singleton class
+      # (`singleton_class.attr_accessor :conf`, `singleton_class.alias_method :o2, :own`) rewrites only the names it
+      # spells, so it makes those names' singleton envelopes opaque and contested ({#record_singleton_class_names}) and
+      # leaves the rest of the singleton side readable. One whose rewritten name is not a literal Symbol or String
+      # (`attr_accessor(*KEYS)`, `alias_method name, :own`, `define_method(sym)`), and any other surface call there
+      # (`class_eval`, `send`, `prepend`), still taints the side: the own-definer read would otherwise answer the body
+      # Ruby replaced (`definer_resolution_witness_spec.rb`).
+      def singleton_class_named_call?(node)
+        !singleton_class_rewritten_names(node).nil?
+      end
+
+      # Issue #1906 — the names a singleton-class call rewrites, or nil where it is not one of the naming forms or
+      # does not spell every rewritten name as a literal. `alias_method` rewrites its new name (the aliased one keeps
+      # its body), `define_method` its first argument, `remove_method` and `attr_*` every argument.
+      def singleton_class_rewritten_names(node)
+        arguments = node.arguments&.arguments || []
+        rewritten = case node.name
+                    when :alias_method, :define_method then arguments.first(1)
+                    when :remove_method then arguments
+                    else ATTR_MACROS.include?(node.name) && arguments
+                    end
+        return nil if !rewritten || arguments.empty? || !arguments.all? { |argument| literal_argument?(node, argument) }
+
+        rewritten.map { |argument| literal_method_name(argument) }
+      end
+
+      # `define_method(:x, body)` takes a body that is not a name; every other argument must be a literal name.
+      def literal_argument?(node, argument)
+        return true if node.name == :define_method && !argument.equal?(node.arguments.arguments.first)
+
+        !literal_method_name(argument).nil?
+      end
+
+      def singleton_class_owner(node, object, qualified_prefix, current_class)
+        return current_class if object.nil? || object.is_a?(Prism::SelfNode)
+
+        rendered = Source::ConstantPath.qualified_name_or_nil(object)
+        return nil if rendered.nil?
+        return rendered if Source::ConstantPath.rooted?(object) || qualified_prefix.empty?
+
+        eval_constant_receiver_prefix(node, object, rendered, qualified_prefix).join("::")
+      end
+
       # The bare `module_function` toggle: the module extends itself. A direct statement only.
       def record_module_function(node, current_class, accumulator, in_singleton)
         return unless current_class && node.receiver.nil? && !in_singleton && ModuleFunctionState.extends_self?(node)
@@ -7353,19 +7579,15 @@ module Rigor
 
       # v0.1.2 — per-class method-visibility table for the `def.method-visibility-mismatch` CheckRule.
       #
-      # Tracks two visibility-changing forms:
+      # Tracks three visibility-changing forms ({#apply_visibility_call}):
       #
-      # - **Modifier blocks**: a bare `private` / `protected` /
-      #   `public` call inside a class body switches the
-      #   "current default" visibility for every subsequent
-      #   `def` until another modifier flips it again.
-      # - **Named-argument form**: `private :foo, :bar` (or
-      #   the same with `protected` / `public`) marks specific
-      #   names already-recorded under the class. Symbol-only
-      #   args are recognised; `private def foo; end` (the
-      #   wrap-around form) is not yet — it would need
-      #   tracking the def-call's return-value visibility,
-      #   which is a separate slice.
+      # - **Modifier blocks**: a bare `private` / `protected` / `public` call inside a class body (also written
+      #   `self.private`, `send(:private)` or with a block) switches the "current default" visibility for every
+      #   subsequent `def` and `attr_*` member until another modifier flips it again.
+      # - **Named-argument form**: `private :foo, :bar` or `private %i[foo bar]` (or the same with `protected` /
+      #   `public`) marks specific names already recorded under the class.
+      # - **Wrap-around form** (#1911, #1819, #1633): `private def foo` and `private attr_reader :foo` record the
+      #   members with the call's visibility and leave the default alone.
       #
       # Top-level (no surrounding class) defs do not contribute — Ruby's top-level visibility nuances (private at
       # top-level marks the method on `Object`) are out of scope for v0.1.2.
@@ -7422,6 +7644,26 @@ module Rigor
           end
         end
 
+        # Contests the `[class_name, name]` slot, recorded or not: a visibility call changed it in a way the walk
+        # cannot read (`private def self.x` reaching an instance `x`).
+        def contest_slot(class_name, name)
+          (@contested ||= Set.new) << [class_name, name].freeze
+        end
+
+        # Contests every slot of `class_name` recorded so far (`private(*names)` may name any of them).
+        def contest_class(class_name)
+          self[class_name]&.each_key { |name| contest_slot(class_name, name) }
+        end
+
+        # Runs the block with the running default uncertain, so a `def` it records is contested.
+        def uncertainly
+          saved = @uncertain
+          @uncertain = true
+          yield
+        ensure
+          @uncertain = saved
+        end
+
         # Runs the block as a fresh body (a class or module, `class << self`, a meta-new or eval block), whose
         # default starts certain and whose toggles do not reach the enclosing body.
         def body
@@ -7443,10 +7685,37 @@ module Rigor
         end
       end
 
-      # A bare toggle ({VISIBILITY_TOGGLES}): receiverless, with no arguments.
+      # A bare toggle ({VISIBILITY_TOGGLES}): a visibility call ({#visibility_call_parts}) with no arguments.
       def bare_visibility_toggle?(node)
-        node.is_a?(Prism::CallNode) && node.receiver.nil? && VISIBILITY_TOGGLES.include?(node.name) &&
-          (node.arguments.nil? || node.arguments.arguments.empty?) && node.block.nil?
+        parts = visibility_call_parts(node)
+        !parts.nil? && parts.last.empty?
+      end
+
+      # Whether a visibility call with these arguments may set the running default: none at all, or a splat that
+      # may expand to none (`private(*[])` is a bare `private`).
+      def visibility_toggle_arguments?(arguments)
+        arguments.empty? || arguments.any?(Prism::SplatNode)
+      end
+
+      VISIBILITY_SEND_CALLS = %i[send __send__].freeze
+      EMPTY_VISIBILITY_ARGUMENTS = [].freeze
+      private_constant :VISIBILITY_SEND_CALLS, :EMPTY_VISIBILITY_ARGUMENTS
+
+      # Issue #1633 — `[name, arguments]` for a call Ruby runs as one of {VISIBILITY_TOGGLES} on the body's self:
+      # written receiverless or on `self` (`self.private`), or sent with a literal name (`send(:private, :x)`,
+      # `__send__(:private)`). A block is ignored, as `Module#private` ignores it (`private {}` is a bare
+      # `private`). nil for any other call.
+      def visibility_call_parts(node)
+        return nil unless node.is_a?(Prism::CallNode)
+        return nil unless node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+        name = node.name
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        if VISIBILITY_SEND_CALLS.include?(name)
+          name = Source::Literals.symbol_or_string(arguments.first)
+          arguments = arguments.drop(1)
+        end
+        VISIBILITY_TOGGLES.include?(name) ? [name, arguments] : nil
       end
 
       # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity, Metrics/AbcSize
@@ -7510,16 +7779,31 @@ module Rigor
                                                                   defs_singleton: defs_singleton)
             return current_visibility
           end
-          accumulator.toggles += 1 if bare_visibility_toggle?(node)
-          # The visibility table is instance-side only — `private :x` inside `class <<`
-          # (or a receiver-eval body that re-evaluates a singleton self) marks the
-          # SINGLETON method, which this table cannot express.
-          updated = if in_singleton_class
-                      current_visibility
-                    else
-                      apply_visibility_call(node, owner_prefix, current_visibility, accumulator)
-                    end
-          return updated unless updated.equal?(current_visibility)
+          if AnonymousMetaClass.block_form_receiver(node)
+            walk_anonymous_meta_visibilities(node, qualified_prefix, in_singleton_class, current_visibility,
+                                             accumulator, def_owner_prefix, singleton_cref: singleton_cref,
+                                                                            defs_singleton: defs_singleton)
+            return current_visibility
+          end
+          if (parts = visibility_call_parts(node))
+            accumulator.toggles += 1 if visibility_toggle_arguments?(parts.last)
+            # The visibility table is instance-side only — `private :x` inside `class <<`
+            # (or a receiver-eval body that re-evaluates a singleton self) marks the
+            # SINGLETON method, which this table cannot express. The `owner_prefix` check is a
+            # guard: an ownerless body (the top level, an anonymous factory block) records nothing,
+            # and its calls walk as any other call.
+            if !in_singleton_class && !owner_prefix.empty? && VISIBILITY_MODIFIERS.include?(parts.first)
+              return apply_visibility_call(node, *parts, owner_prefix, current_visibility, accumulator,
+                                           defs_singleton: defs_singleton) do |argument|
+                walk_method_visibilities(argument, qualified_prefix, in_singleton_class, current_visibility,
+                                         accumulator, def_owner_prefix, singleton_cref: singleton_cref,
+                                                                        defs_singleton: defs_singleton)
+              end
+            end
+          end
+          unless in_singleton_class || defs_singleton
+            record_attr_visibility(node, owner_prefix, current_visibility, accumulator, toggled: true)
+          end
         end
 
         # Statement-position StatementsNode preserves left-to-right visibility flow; everything else recurses with the
@@ -7573,6 +7857,23 @@ module Rigor
         end
       end
 
+      # A `Class.new` / `Module.new` / `Struct.new` / `Data.define` block no constant write names
+      # ({#meta_new_block_split} takes the named ones): `klass = Class.new do … end`, `@k = Struct.new(:a) do … end`,
+      # `register(Class.new do … end)` or a bare `Data.define(:a) do … end`. Its body is the anonymous class's, so
+      # it walks as a fresh body with no owner and records nothing for the enclosing class; the receiver and the
+      # arguments are walked where they stand.
+      def walk_anonymous_meta_visibilities(node, qualified_prefix, in_singleton_class, current_visibility,
+                                           accumulator, def_owner_prefix, singleton_cref:, defs_singleton:) # rubocop:disable Metrics/ParameterLists
+        [node.receiver, *node.arguments&.arguments].each do |part|
+          walk_method_visibilities(part, qualified_prefix, in_singleton_class, current_visibility, accumulator,
+                                   def_owner_prefix, singleton_cref: singleton_cref, defs_singleton: defs_singleton)
+        end
+        accumulator.body do
+          walk_method_visibilities(node.block.body, qualified_prefix, false, :public, accumulator,
+                                   EMPTY_PREFIX, singleton_cref: singleton_cref)
+        end
+      end
+
       # The eval-block arm of {#walk_method_visibilities}: the block is a fresh class body under
       # the receiver's def-owner — visibility starts at `:public`, and nothing inside it leaks
       # back to this body's modifier state. An unnameable receiver walks the body ownerless;
@@ -7610,47 +7911,80 @@ module Rigor
         end
       end
 
-      def record_def_visibility(def_node, qualified_prefix, in_singleton_class, current_visibility, accumulator)
+      # `toggled` when the def reads the running default (a statement), false for one a visibility call wraps.
+      def record_def_visibility(def_node, qualified_prefix, in_singleton_class, current_visibility, accumulator,
+                                toggled: true)
         return if def_node.receiver.is_a?(Prism::SelfNode) || in_singleton_class
         return if qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
         accumulator[class_name] ||= {}
         accumulator[class_name][def_node.name] = current_visibility
-        accumulator.wrote(class_name, def_node.name, def_node, toggled: true)
-      end
+        accumulator.wrote(class_name, def_node.name, def_node, toggled: toggled)
+      end
+
+      # Applies one `private` / `protected` / `public` call ({#visibility_call_parts}) written on the body's self
+      # and returns the running default after it:
+      #
+      # - no arguments — the call's visibility becomes the default for subsequent defs.
+      # - `private :foo, :bar`, `private %i[foo bar]` — back-patch the named methods in the accumulator; the
+      #   default does NOT change for this form.
+      # - Issues #1911, #1819, #1633 — `private def foo` (endless or not) and `private attr_reader :foo` define
+      #   the members with the call's visibility, whatever the running default is (`private; public def foo` is
+      #   public); `private def self.foo` changes the instance method `foo`, if one exists, so its slot is
+      #   contested.
+      # - a splat (`private(*names)`) may name any member or none (a bare toggle), so the class's slots this file
+      #   wrote so far are contested, and the statement loop reads the default after it as uncertain
+      #   ({#visibility_toggle_arguments?}).
+      # - any other argument (`private memoize def foo`, `private delegate(...)`) is walked with the default
+      #   uncertain, so a `def` under it is contested: the call's visibility reaches it through a return value
+      #   the walk does not read.
+      #
+      # `walk` walks an argument the call does not consume itself.
+      def apply_visibility_call(call_node, name, args, qualified_prefix, current_visibility, accumulator,
+                                defs_singleton: false, &walk)
+        return name if args.empty?
 
-      # Recognises modifier calls on the implicit-self receiver inside a class body. Returns the (possibly updated)
-      # current visibility:
-      #
-      # - `private` / `public` / `protected` (no args) —
-      #   switch the running default for subsequent defs.
-      # - `private :foo, :bar` — back-patch the named methods
-      #   in the accumulator. Returns `current_visibility`
-      #   unchanged because the running default does NOT
-      #   change for this form.
-      def apply_visibility_call(call_node, qualified_prefix, current_visibility, accumulator)
-        return current_visibility unless call_node.receiver.nil?
-        return current_visibility unless VISIBILITY_MODIFIERS.include?(call_node.name)
-        return current_visibility if qualified_prefix.empty?
+        class_name = qualified_prefix.join("::")
+        accumulator.contest_class(class_name) if args.any?(Prism::SplatNode)
+        args.each do |arg|
+          apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator,
+                                    defs_singleton: defs_singleton, &walk)
+        end
+        current_visibility
+      end
 
-        args = call_node.arguments&.arguments || []
-        if args.empty?
-          call_node.name
+      def apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator, defs_singleton:, &walk)
+        case arg
+        when Prism::DefNode
+          if arg.receiver.nil?
+            record_def_visibility(arg, qualified_prefix, defs_singleton, name, accumulator, toggled: false)
+          else
+            accumulator.contest_slot(qualified_prefix.join("::"), arg.name)
+          end
+        when Prism::SymbolNode, Prism::StringNode, Prism::ArrayNode
+          apply_named_visibility(arg, name, qualified_prefix, call_node, accumulator, &walk)
         else
-          apply_named_visibility(args, qualified_prefix, call_node, accumulator)
-          current_visibility
+          # An `instance_eval` body's wrapped attr is walked like any other argument and records nothing.
+          if !defs_singleton && attr_visibility_call?(arg)
+            record_attr_visibility(arg, qualified_prefix, name, accumulator, toggled: false)
+          else
+            accumulator.uncertainly { walk.call(arg) }
+          end
         end
       end
 
-      def apply_named_visibility(args, qualified_prefix, call_node, accumulator)
+      # `private :foo` / `private "foo"` / `private %i[foo bar]`: each literal name the call's visibility. An array
+      # element that is not a literal name is walked like any other argument.
+      def apply_named_visibility(arg, visibility, qualified_prefix, call_node, accumulator, &walk)
+        elements = arg.is_a?(Prism::ArrayNode) ? arg.elements : [arg]
         class_name = qualified_prefix.join("::")
-        args.each do |arg|
-          name = visibility_target_name(arg)
-          next if name.nil?
+        elements.each do |element|
+          name = visibility_target_name(element)
+          next accumulator.uncertainly { walk.call(element) } if name.nil?
 
           accumulator[class_name] ||= {}
-          accumulator[class_name][name] = call_node.name
+          accumulator[class_name][name] = visibility
           accumulator.wrote(class_name, name, call_node, toggled: false)
         end
       end
@@ -7659,6 +7993,32 @@ module Rigor
         Source::Literals.symbol_or_string(arg)
       end
 
+      # Issue #1911 — an `attr_reader` / `attr_writer` / `attr_accessor` call written on the body's self records
+      # each member it defines (`x`, `x=`) with `visibility`: the running default for a statement (`toggled`), the
+      # wrapping call's for `private attr_accessor :x`, which Ruby applies to the `[:x, :x=]` the macro returns.
+      # A non-literal name (`attr_reader(*FIELDS)`) records nothing; a call that is no such macro records nothing.
+      def record_attr_visibility(call_node, qualified_prefix, visibility, accumulator, toggled:)
+        return unless attr_visibility_call?(call_node)
+        return if qualified_prefix.empty?
+
+        class_name = qualified_prefix.join("::")
+        each_attr_macro_name(call_node) do |base|
+          members = []
+          members << base unless call_node.name == :attr_writer
+          members << :"#{base}=" unless call_node.name == :attr_reader
+          members.each do |member|
+            accumulator[class_name] ||= {}
+            accumulator[class_name][member] = visibility
+            accumulator.wrote(class_name, member, call_node, toggled: toggled)
+          end
+        end
+      end
+
+      # A receiverless `attr_reader` / `attr_writer` / `attr_accessor` call ({#record_attr_visibility}).
+      def attr_visibility_call?(node)
+        node.is_a?(Prism::CallNode) && node.receiver.nil? && ATTR_MACROS.include?(node.name)
+      end
+
       # Registers the alias name in the `discovered_methods` table so `undefined-method` diagnostics are not emitted for
       # calls to the aliased name. The kind mirrors the surrounding class context (instance inside a regular class body,
       # singleton inside `class << self`).
@@ -7758,6 +8118,41 @@ module Rigor
           constant_receiver_candidates(receiver, qualified_prefix).each do |name|
             record_surface_mark(tables, name, Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK)
           end
+        elsif singleton_class_of_receiver?(receiver) && singleton_class_named_call?(node)
+          record_singleton_class_names(node, receiver.receiver, qualified_prefix, tables)
+        end
+      end
+
+      # Issue #1752 — the names a {#singleton_class_named_call?} rewrites on its singleton class's owner, each
+      # singleton envelope opaque and contested: the evidence the refinement typer reads as a rewritten singleton name.
+      def record_singleton_class_names(node, object, qualified_prefix, tables)
+        current_class = qualified_prefix.empty? ? nil : qualified_prefix.join("::")
+        owner = singleton_class_owner(node, object, qualified_prefix, current_class)
+        return if owner.nil?
+
+        singleton_class_rewritten_names(node).each do |method_name|
+          names = [method_name]
+          names << :"#{method_name}=" if %i[attr_writer attr_accessor].include?(node.name)
+          names.each do |name|
+            record_envelope(tables.envelopes, owner, [:singleton, name], Source::ParameterEnvelope::OPAQUE)
+            # Contested even where the call is certain: the slot's `def` is not the body Ruby runs, so the
+            # own-definer read declines on the name rather than answering it.
+            contest_envelope(tables, owner, [:singleton, name])
+          end
+        end
+      end
+
+      # Issue #1752 — `def Const.x` whose receiver is not the lexical `self` (written at the top level or in another
+      # class's body) defines `Const`'s singleton method, which no table files under `Const`: its singleton name's
+      # envelope turns opaque, the evidence the refinement typer reads as a rewritten singleton name.
+      def record_foreign_singleton_def(node, qualified_prefix, owner_prefix, tables)
+        receiver = node.receiver
+        return unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+        return if def_receiver_targets_lexical_self?(receiver, owner_prefix)
+
+        constant_receiver_candidates(receiver, qualified_prefix).each do |name|
+          record_envelope(tables.envelopes, name, [:singleton, node.name], Source::ParameterEnvelope::OPAQUE)
+          contest_envelope(tables, name, [:singleton, node.name]) unless tables.certain
         end
       end
 
@@ -8221,12 +8616,14 @@ module Rigor
       # {#discovered_project_index_incremental}'s changed-file branch) yields the live def nodes the signature
       # reads their parameter structure from. Issue #1120 — and each file's own refinement table, which the merged
       # def-index cannot attribute back to a file, so the session can diff it against the file's seed bundle.
-      # @return `{ def_index:, code_fingerprints:, declaration_signatures:, refinements: }`.
+      # Issue #1459 — and each file's {#defined_method_names}, diffed the same way.
+      # @return `{ def_index:, code_fingerprints:, declaration_signatures:, refinements:, defined_method_names: }`.
       def scan_summary_for_paths(paths, buffer: nil)
         acc = new_def_index_accumulator
         code_fingerprints = {}
         declaration_signatures = {}
         refinements = {}
+        defined_method_names = {}
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           source = File.read(physical)
@@ -8236,13 +8633,29 @@ module Rigor
           code_fingerprints[path] = code_fingerprint(source, parsed.comments)
           declaration_signatures[path] = declaration_signature(file_index)
           refinements[path] = file_index[:refinements] if file_index[:refinements]
+          defined_method_names[path] = defined_method_names(file_index)
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
           next
         end
         { def_index: finalize_def_index(acc), code_fingerprints: code_fingerprints,
-          declaration_signatures: declaration_signatures, refinements: refinements }
+          declaration_signatures: declaration_signatures, refinements: refinements,
+          defined_method_names: defined_method_names }
+      end
+
+      # Issue #1459 — every method name one file's index defines, on any class or module and either side: the keys of
+      # `methods` (which also carries an `attr_*`, `alias` or `define_method` name) and of the instance and singleton
+      # def-node tables. A single file's `methods` already holds its `def` names, since `subtract_def_methods` runs only
+      # on the merged accumulator; the def-node tables are read as well so the census reads exactly the tables
+      # `BlockCallTiming.project_defines_anywhere?` reads. Takes a live file index or a seed bundle, which hold the
+      # same three keys.
+      def defined_method_names(file_index)
+        names = Set.new
+        %i[methods def_nodes singleton_def_nodes].each do |key|
+          file_index[key]&.each_value { |table| names.merge(table.keys) }
+        end
+        names.freeze
       end
 
       # ADR-89 WD1 — a per-file digest of every cross-file DECLARATION surface an ancestry / file-level
@@ -8804,6 +9217,9 @@ module Rigor
         merge_header_nestings(acc[:header_nestings], file_index[:header_nestings] || {})
         fold_mixin_lists(acc, file_index)
         file_index[:class_sources].each { |cn, files| (acc[:class_sources][cn] ||= Set.new).merge(files) }
+        (file_index[:singleton_class_sources] || {}).each do |cn, files|
+          (acc[:singleton_class_sources][cn] ||= Set.new).merge(files)
+        end
         # Issue #722 residue 2 — a pre-#722 seed bundle carries no candidates; the SCHEMA bump makes such a
         # blob a cold rebuild, but default so any in-flight fold stays total.
         acc[:compact_headers].merge!(file_index[:compact_headers] || {})
@@ -8892,6 +9308,7 @@ module Rigor
           # data, so the bundle stays Marshal-clean and a warm file joins the envelopes its cold walk records.
           parameter_envelopes: file_index[:parameter_envelopes],
           class_source_names: file_index[:class_sources].keys,
+          singleton_class_source_names: (file_index[:singleton_class_sources] || {}).keys,
           # Issue #722 residue 2 — plain data, so the bundle stays Marshal-clean and a warm incremental file
           # re-anchors its compact headers the way a cold walk of it does.
           compact_headers: file_index[:compact_headers],
@@ -8916,7 +9333,7 @@ module Rigor
       # ADR-85 WD2 — reconstitutes a cached bundle into a single-file index {#fold_file_index} folds: the
       # def-node triples become {DefHandle}s bound to this file's `path`, and the class-source names become a
       # `{name => Set[path]}` table (the shape `accumulate_project_index` produces).
-      def bundle_to_file_index(bundle, path) # rubocop:disable Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity -- one read per bundle slot
+      def bundle_to_file_index(bundle, path) # rubocop:disable Metrics/AbcSize -- one read per bundle slot
         {
           def_nodes: bundle_defs_to_handles(bundle[:def_nodes], path),
           singleton_def_nodes: bundle_defs_to_handles(bundle[:singleton_def_nodes], path),
@@ -8937,7 +9354,8 @@ module Rigor
           method_visibilities: bundle[:method_visibilities],
           methods: bundle[:methods],
           parameter_envelopes: bundle[:parameter_envelopes] || {},
-          class_sources: bundle[:class_source_names].to_h { |name| [name, Set[path]] },
+          class_sources: bundle_path_sets(bundle[:class_source_names], path),
+          singleton_class_sources: bundle_path_sets(bundle[:singleton_class_source_names], path),
           compact_headers: bundle[:compact_headers] || {},
           # Issue #644 — a pre-#644 bundle carries no census; the SCHEMA bump makes such a blob a cold
           # rebuild, but default so any in-flight fold stays total.
@@ -8987,7 +9405,7 @@ module Rigor
           method_visibilities: {},
           methods: {},
           deferred_ranges: {},
-          parameter_envelopes: {}, class_sources: {},
+          parameter_envelopes: {}, class_sources: {}, singleton_class_sources: {},
           # Issue #722 residue 2 — compact-header re-anchor candidates, adjudicated in {#finalize_def_index}.
           compact_headers: {},
           constant_writes: {},
@@ -10454,8 +10872,15 @@ module Rigor
 
       # Issue #1717 — a `def` / `class` / `module` body opens its own `self`, so an enclosing unentered block's
       # unknown-`self` mark ({Scope#block_self_unknown?}) stops at it, as the evaluator's fresh body scope does.
-      # Every other node hands its children the scope as is.
+      # A `case` narrows its clauses ({#propagate_subjectless_case}, {#propagate_subject_case}). Every other node
+      # hands its children the scope as is.
       def propagate_children(node, table, current_scope)
+        if node.is_a?(Prism::CaseNode) || node.is_a?(Prism::CaseMatchNode)
+          return propagate_subjectless_case(node, table, current_scope) if node.predicate.nil?
+
+          return propagate_subject_case(node, table, current_scope)
+        end
+
         child_scope =
           SELF_OPENING_BODIES.include?(node.class) ? current_scope.with_block_self_unknown(false) : current_scope
         node.rigor_each_child { |child| propagate(child, table, child_scope) }
@@ -10661,6 +11086,85 @@ module Rigor
         propagate(node.statements, table, falsey_scope) if node.statements
         propagate(node.else_clause, table, truthy_scope) if node.else_clause
       end
+
+      # Issue #1495 — a `case` without a subject the evaluator did not enter (`[case; when x.nil? then 0; else x.size
+      # end]`) narrows by its conditions' edges, as {StatementEvaluator#subjectless_when_scopes} does: each condition
+      # under the falsey edges of the conditions before it, each clause under the join of its conditions' truthy edges,
+      # and the `else` under the last falsey edge. Like the walk of an `if`, it applies no write a condition makes, so
+      # the edges are taken from a scope where every bound local the condition writes reads `Dynamic[top]`
+      # ({#widen_condition_writes}): neither the local's old type nor an earlier condition's narrowing of it reaches
+      # them, as `when (x = s ? String(s) : nil) then x.upcase` after `x = 1` would.
+      def propagate_subjectless_case(node, table, current_scope)
+        falsey = current_scope
+        node.conditions.each do |when_node|
+          truthy_edges = when_node.conditions.map do |condition|
+            propagate(condition, table, falsey)
+            truthy, falsey = Narrowing.predicate_scopes(condition, widen_condition_writes(condition, falsey))
+            truthy
+          end
+          propagate(when_node, table, truthy_edges.reduce(:join))
+        end
+        propagate(node.else_clause, table, falsey) if node.else_clause
+      end
+
+      # Issue #1484 — a `case` with a subject the evaluator did not enter (`[case io when StringIO then io.string
+      # end]`, `[case io in StringIO then io.string else nil end]`) narrows each clause as the evaluator does
+      # ({Narrowing.case_clause_scopes}): the body under the clause's narrowed edge, the next clause and the `else`
+      # under its falsey edge. The walk applies no write the subject, a `when` condition or an `in` pattern makes, so
+      # every bound local one of them writes reads `Dynamic[top]` from that point on ({#widen_condition_writes}).
+      # Nor does it run the evaluator's per-clause `LastLine.forget_if_set`: the statement holding the `case`
+      # already forgets a `$_` any of its tests may set. A clause's tests are recorded under the scope the earlier
+      # clauses' falsey edges left, where the evaluator's `when` tests read the post-subject scope: a test reading
+      # the subject sees what the earlier clauses ruled out (`when NilClass then 0 when v.succ`).
+      #
+      # A test that calls a method may rebind an instance-variable or global subject before the body reads it
+      # (`when String then 1 when reset! then @x.upcase`, where `reset!` writes `@x`), and the walk cannot tell. From
+      # the first such test on, the subject reads `Dynamic[top]` on both edges ({#forget_called_subject}). The
+      # evaluator keeps the narrowing there (a separate defect); the walk declines it rather than add a report.
+      def propagate_subject_case(node, table, current_scope)
+        subject = node.predicate
+        propagate(subject, table, current_scope)
+        falsey = widen_condition_writes(subject, current_scope)
+        called = false
+        node.conditions.each do |clause|
+          tests = clause.is_a?(Prism::WhenNode) ? clause.conditions : [clause.pattern]
+          tests.each { |test| propagate(test, table, falsey) }
+          falsey = tests.reduce(falsey) { |acc, test| widen_condition_writes(test, acc) }
+          called ||= tests.any? { |test| runs_call?(test) }
+          body, falsey = Narrowing.case_clause_scopes(subject, clause, falsey)
+          body, falsey = [body, falsey].map { |scope| forget_called_subject(subject, scope) } if called
+          propagate(clause, table, body)
+        end
+        propagate(node.else_clause, table, falsey) if node.else_clause
+      end
+
+      CODE_RUNNING_NODES = [Prism::CallNode, Prism::SuperNode, Prism::ForwardingSuperNode, Prism::YieldNode].freeze
+      private_constant :CODE_RUNNING_NODES
+
+      # Whether `node` holds a method call, `super` or `yield` anywhere, a lambda body's included.
+      def runs_call?(node)
+        return false unless node.is_a?(Prism::Node)
+        return true if CODE_RUNNING_NODES.include?(node.class)
+
+        node.rigor_each_child { |child| return true if runs_call?(child) }
+        false
+      end
+
+      # `scope` with an instance-variable or global `subject` rebound to `Dynamic[top]`; any other subject as is.
+      def forget_called_subject(subject, scope)
+        case subject
+        when Prism::InstanceVariableReadNode then scope.with_ivar(subject.name, Type::Combinator.untyped)
+        when Prism::GlobalVariableReadNode then scope.with_global(subject.name, Type::Combinator.untyped)
+        else scope
+        end
+      end
+
+      # `scope` with every bound local `condition` writes rebound to `Dynamic[top]`.
+      def widen_condition_writes(condition, scope)
+        OperandEffects.written_variables(condition).reduce(scope) do |acc, name|
+          acc.local(name) ? acc.with_local(name, Type::Combinator.untyped) : acc
+        end
+      end
     end
   end
 end