rigortype 0.4.3 → 0.4.5

data/lib/rigor/inference/scope_indexer.rb

@@ -25,6 +25,7 @@ require_relative "hash_lookup_mutation"
 require_relative "in_effect_refinements"
 require_relative "refine_census"
 require_relative "refine_self"
+require_relative "reflective_ivar_write"
 require_relative "index_write_widening"
 require_relative "module_function_state"
 require_relative "multi_target_binder"
@@ -332,8 +333,10 @@ module Rigor
       # possible methods were folded already ({#seed_discovered_methods}).
       def per_file_siblings(siblings, file_def_nodes, file_siblings, file_singleton, file_visibilities)
         file_singleton_def_nodes, file_singleton_contested = file_singleton
-        siblings[:contested_discovered_method_visibilities] = fold_slot_contests(
-          siblings[:contested_discovered_method_visibilities], *file_visibilities
+        # The seed's singleton contests stay ({#fold_visibility_contests}); it already holds a disagreement between
+        # this file and another.
+        siblings[:contested_discovered_method_visibilities] = fold_visibility_contests(
+          siblings[:contested_discovered_method_visibilities], {}, *file_visibilities
         )
         siblings[:contested_discovered_def_nodes] = fold_slot_contests(
           siblings[:contested_discovered_def_nodes], file_def_nodes, file_siblings[:contested_discovered_def_nodes]
@@ -507,13 +510,30 @@ module Rigor
         method_assign_effects = build_method_assign_effects(root)
         walk_class_ivars(root, [], default_scope, accumulator, mutated_ivars,
                          read_before_write, init_writes, method_assign_effects)
+        reflective_opaque = accumulator.delete(REFLECTIVE_OPAQUE_CLASSES)
+        exempt_class_body_writes!(init_writes, accumulator.delete(DEFINE_METHOD_WRITES) || {})
         merge_held_ivar_writes!(accumulator)
         record_aliased_ivar_mutations!(root, mutated_ivars)
         widen_mutated_ivar_entries!(accumulator, mutated_ivars)
         contribute_read_before_write_nil!(accumulator, read_before_write, init_writes)
+        make_reflective_classes_gradual!(accumulator, reflective_opaque)
         accumulator.transform_values(&:freeze).freeze
       end
 
+      # Folds the class-body writes {#collect_class_body_ivar_writes} held under {CLASS_BODY_WRITES} into the
+      # `init_writes` exemption, except for an ivar a `define_method` block, or a `block_as_methods:` block bound to the
+      # receiver's instance ({#method_body_block_call?}), of the class writes (#1768). Such an ivar had no census entry
+      # before the block's writes were counted, so the exemption never applied to it; a class-body `@x = nil` writes
+      # the class object's ivar and says nothing about whether an instance's `@x` is set, and exempting it would seed
+      # `@x` non-nil from the block's write alone (`if @x` folding always-truthy on an instance whose `@x` is unset).
+      # It keeps the read-before-write `nil` instead, which only widens.
+      def exempt_class_body_writes!(init_writes, define_method_writes)
+        (init_writes.delete(CLASS_BODY_WRITES) || {}).each do |class_name, ivars|
+          kept = ivars - (define_method_writes[class_name] || EMPTY_GUARDED_IVARS)
+          (init_writes[class_name] ||= Set.new).merge(kept)
+        end
+      end
+
       # B2.3 — finalize the read-before-write nil contribution. For each class, for each ivar where SOME method body
       # observed a read-before-write AND no `initialize` write exists for that ivar, contribute `Constant[nil]` to the
       # class-wide accumulator.
@@ -853,7 +873,8 @@ module Rigor
 
           owner = def_owner || qualified_prefix
           collect_initializer_block_ivars(node, owner, default_scope, accumulator, mutated_ivars, init_writes)
-          record_attr_writer_ivars(node, owner, accumulator) if ATTR_WRITER_MACROS.include?(node.name)
+          record_attr_writer_ivars(node, owner, accumulator) if ATTR_WRITER_MACROS.include?(attr_macro(node))
+          collect_define_method_block_ivars(node, owner, default_scope, accumulator, mutated_ivars)
           false
         else
           walk_ivars_meta_new?(node, qualified_prefix, default_scope, accumulator,
@@ -1065,6 +1086,51 @@ module Rigor
         end
       end
 
+      # The `define_method` arm of {#walk_class_ivars} (#1768). `define_method(:m) { … }` on the implicit
+      # or `self` receiver installs its block as an instance method of `owner`, and Ruby runs the body on
+      # the instance, so its `@x = …` writes are the instance's ivars exactly as a `def m` body's are —
+      # `DefineMethodBlockSelf` narrows the block's `self` the same way when it is evaluated. Without this
+      # arm an ivar `initialize` sets to `nil` and a `define_method` block sets to a String read as `nil`
+      # in every sibling `def`. The block is typed under the instance `self`, as a def body is. Only the
+      # literal-block form counts: a `define_method(:m, callable)` or `&callable` argument is not walked.
+      # `owner` is empty in a `class << self` body (the call defines a class method there) and in an
+      # anonymous factory body, and the block contributes nothing there. A `define_method` inside a `def`
+      # body is already reached by that body's walk ({#gather_ivar_writes} enters blocks).
+      #
+      # An ADR-16 `block_as_methods:` call whose entry binds the receiver's instance (`get "/" do … end` in a
+      # `Sinatra::Base` subclass under rigor-sinatra) takes the same arm: the plugin declares that its block runs as an
+      # instance method of the receiver class, and `MacroBlockSelfType` narrows the block's `self` to that instance.
+      def collect_define_method_block_ivars(node, owner, default_scope, accumulator, mutated_ivars)
+        return if owner.empty?
+
+        class_name = owner.join("::")
+        return unless method_body_block_call?(node, class_name, default_scope)
+
+        block = node.block
+        return unless block.body
+
+        body_scope = census_body_scope(default_scope, owner, Type::Combinator.nominal_of(class_name))
+        gather_ivar_writes(block.body, body_scope, class_name, accumulator, EMPTY_GUARDED_IVARS, mutated_ivars)
+        written = (accumulator[DEFINE_METHOD_WRITES] ||= {})[class_name] ||= Set.new
+        define_method_written_ivars(block.body, written)
+      end
+
+      # The ivars a `define_method` block body writes, in any write form, outside a nested `def` / `class` / `module`.
+      def define_method_written_ivars(node, acc)
+        return unless node.is_a?(Prism::Node)
+        return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
+
+        case node
+        when Prism::InstanceVariableWriteNode, Prism::InstanceVariableOrWriteNode,
+             Prism::InstanceVariableAndWriteNode, Prism::InstanceVariableOperatorWriteNode,
+             Prism::InstanceVariableTargetNode
+          acc << node.name
+        end
+        reflective = ReflectiveIvarWrite.literal_name(node)
+        acc << reflective if reflective
+        node.rigor_each_child { |child| define_method_written_ivars(child, acc) }
+      end
+
       # ADR-38 block-form gate: true when a loaded plugin declares `method_name` a block-form initializer for
       # `class_name` (or an ancestor). Mirrors `additional_initializer?` but queries `covers_block_method?` instead of
       # `covers_method?`.
@@ -1156,15 +1222,21 @@ module Rigor
       # every `@x = …` write target as a class-body init. Consumed by `contribute_read_before_write_nil!` to exempt
       # ivars the author already knows might be nil (the `@x = nil` at class-body level is the canonical nullability
       # acknowledgement; the instance @x is technically a separate store, but the pragmatic intent is unambiguous).
+      #
+      # A literal `define_method` block is a method body, not class-body code (#1768): its writes reach the census as
+      # a `def` body's do, so they must not exempt the ivar from the read-before-write `nil` either. Only its receiver
+      # and arguments are walked.
       def collect_class_body_ivar_writes(node, class_name, init_writes)
         return unless node.is_a?(Prism::Node)
         return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
 
+        return collect_define_method_argument_writes(node, class_name, init_writes) if define_method_block_call?(node)
+
         if node.is_a?(Prism::InstanceVariableWriteNode) ||
            node.is_a?(Prism::InstanceVariableOrWriteNode) ||
            node.is_a?(Prism::InstanceVariableAndWriteNode) ||
            node.is_a?(Prism::InstanceVariableOperatorWriteNode)
-          (init_writes[class_name] ||= Set.new) << node.name
+          ((init_writes[CLASS_BODY_WRITES] ||= {})[class_name] ||= Set.new) << node.name
         end
 
         node.rigor_each_child do |child|
@@ -1172,6 +1244,37 @@ module Rigor
         end
       end
 
+      # The arguments of a `define_method` block call, walked by {#collect_class_body_ivar_writes} in place of the
+      # call's children so the block body stays out of the class-body init writes.
+      def collect_define_method_argument_writes(node, class_name, init_writes)
+        node.arguments&.arguments&.each { |arg| collect_class_body_ivar_writes(arg, class_name, init_writes) }
+      end
+
+      # A `define_method` call with a literal block on the implicit or `self` receiver: the block is an instance
+      # method body of the class the walk is in (#1768).
+      def define_method_block_call?(node)
+        DefineMethodBlockSelf.define_method_on_lexical_self?(node) && node.block.is_a?(Prism::BlockNode)
+      end
+
+      # A call with a literal block on the implicit or `self` receiver whose block is an instance method body of
+      # `class_name`, the class the walk is in (#1768): `define_method`, or a call an ADR-16 `block_as_methods:` entry
+      # declares runs its block as an instance method of the receiver class ({MacroBlockSelfType}). The entry is
+      # matched on `Singleton[class_name]`, the receiver such a call has in the class body, through the same
+      # receiver-ancestry match the evaluator narrows the block's `self` with, so the census counts exactly the blocks
+      # whose `self` is narrowed to the instance.
+      #
+      # The class-body walk ({#collect_class_body_ivar_writes}) still records a `block_as_methods:` block's writes as
+      # class-body writes, and {#exempt_class_body_writes!} takes back every ivar such a block writes.
+      def method_body_block_call?(node, class_name, scope)
+        return true if define_method_block_call?(node)
+        return false unless node.block.is_a?(Prism::BlockNode)
+        return false unless scope && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+
+        MacroBlockSelfType.runs_as_receiver_instance_method?(
+          scope: scope, call_node: node, receiver_type: Type::Combinator.singleton_of(class_name)
+        )
+      end
+
       def detect_read_before_write(node, seen_writes, read_first)
         return unless node.is_a?(Prism::Node)
         return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
@@ -1199,6 +1302,9 @@ module Rigor
         end
 
         seen_writes << node.name if IVAR_WRITE_NODES.any? { |klass| node.is_a?(klass) }
+        # #1931 — a literal `instance_variable_set` is a write too; its value argument, read above, runs first.
+        reflective = ReflectiveIvarWrite.literal_name(node)
+        seen_writes << reflective if reflective
       end
 
       # Records each ivar target of a `MultiWriteNode` / nested `MultiTargetNode` into `seen_writes`, and descends into
@@ -1246,6 +1352,7 @@ module Rigor
           end
         else
           record_compound_ivar_write(node, scope, class_name, accumulator)
+          record_reflective_ivar_write(node, scope, class_name, accumulator)
         end
 
         # N1 — parallel / multiple assignment (`old, @cb = @cb, block`, `@i, @o, @e, @thr = Open3.popen3(cmd)`). A
@@ -1273,6 +1380,32 @@ module Rigor
         end
       end
 
+      # #1931 — `instance_variable_set` on `self` writes an ivar no write node shows ({ReflectiveIvarWrite}). A literal
+      # name (`instance_variable_set(:@k, v)`) contributes the value's type to that ivar's entry, as `@k = v` would. A
+      # name the analysis cannot read (`instance_variable_set(:"@#{k}", v)`, the options-hash constructor idiom) may
+      # write any ivar of the class, so every entry of the class turns gradual once the walk ends
+      # ({#make_reflective_classes_gradual!}): a reader in another method otherwise kept a write's literal (`@timeout =
+      # 5` read as `5`) and reported a call on it.
+      def record_reflective_ivar_write(node, scope, class_name, accumulator)
+        return unless ReflectiveIvarWrite.self_write?(node)
+
+        name = ReflectiveIvarWrite.literal_name(node)
+        if name
+          accumulate_ivar_type(accumulator, class_name, name, scope.type_of(ReflectiveIvarWrite.value_node(node)))
+        else
+          (accumulator[REFLECTIVE_OPAQUE_CLASSES] ||= Set.new) << class_name
+        end
+      end
+
+      def make_reflective_classes_gradual!(accumulator, classes)
+        classes&.each do |class_name|
+          entries = accumulator[class_name]
+          next if entries.nil?
+
+          accumulator[class_name] = entries.transform_values { Type::Combinator.untyped }
+        end
+      end
+
       # Records `@ivar.<method>(...)` calls whose method is in `MutationWidening::SHAPE_MUTATORS`.
       # The class-ivar pre-pass uses the resulting set to widen the post-collected accumulator entries (see
       # {.widen_mutated_ivar_entries!}). Always-safe to over- collect: any name that the widening primitive declines is
@@ -2011,6 +2144,15 @@ module Rigor
       OPERATOR_WRITE_CONTRIBUTIONS = :operator_write_contributions
       private_constant :AND_WRITE_CONTRIBUTIONS, :OPERATOR_WRITE_CONTRIBUTIONS
 
+      # The same Symbol-key convention for two side tables the walk fills and {#build_class_ivar_index} removes
+      # before anything reads class names: the ivars each class's `define_method` blocks write (in the
+      # accumulator), and the class-body writes held out of `init_writes` until {#exempt_class_body_writes!}.
+      DEFINE_METHOD_WRITES = :define_method_writes
+      CLASS_BODY_WRITES = :class_body_writes
+      # The classes a computed-name `instance_variable_set` may write any ivar of ({#record_reflective_ivar_write}).
+      REFLECTIVE_OPAQUE_CLASSES = :reflective_opaque_classes
+      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES, :REFLECTIVE_OPAQUE_CLASSES
+
       # Unions `type` into the class-ivar accumulator for `(class_name, ivar_name)`. Shared by the single-write and
       # multi-write (parallel-assignment) collectors.
       def accumulate_ivar_type(accumulator, class_name, ivar_name, type)
@@ -4010,6 +4152,10 @@ module Rigor
                  (singleton_cref && owner_prefix.empty?)
             record_alias_or_undef(node, owner_prefix, in_singleton_class || defs_singleton,
                                   methods_acc.at(node))
+            if node.is_a?(Prism::AliasMethodNode) && !(in_singleton_class || defs_singleton)
+              supersede_def_nodes(Array(Source::AliasNames.keyword_names(node)&.first), owner_prefix,
+                                  def_nodes_acc, methods_acc.at(node))
+            end
           end
           return
         when Prism::SymbolNode
@@ -4024,6 +4170,9 @@ module Rigor
           end
           anonymous = record_call_node_methods(node, owner_prefix, in_singleton_class, methods_acc.at(node),
                                                source_path)
+          unless in_singleton_class
+            supersede_def_nodes(call_superseded_names(node), owner_prefix, def_nodes_acc, methods_acc.at(node))
+          end
           tables = methods_acc.at(node)
           record_singleton_prepend(node, qualified_prefix, tables,
                                    self_ok: node.name == :prepend && tables.in_block?(node))
@@ -4093,11 +4242,40 @@ module Rigor
       def record_declaration_facts(node, child_prefix, tables)
         if node.is_a?(Prism::ClassNode)
           record_meta_superclass_members(node, child_prefix, tables)
+          record_constructed_superclass(node.superclass, child_prefix.join("::"), tables)
         else
           record_surface_mark(tables, child_prefix.join("::"), Scope::DiscoveryIndex::ENVELOPE_MODULE_MARK)
         end
       end
 
+      # Issue #1979 — `class K < Data.define(:a)`, `< Struct.new(:a)` or `< Class.new(Parent)`: the superclass table
+      # records `nil` for K, so a subclass walk enumerates it under every class. Each constant the expression names
+      # (the factory's receiver, and `Class.new`'s argument, or `Object` for none) takes a
+      # `[ENVELOPE_CONSTRUCTED_KIND, name]` entry; an expression of any other shape records none.
+      def record_constructed_superclass(superclass, class_name, tables)
+        names = constructed_superclass_names(superclass)
+        names&.each do |name|
+          record_envelope(tables.envelopes, class_name, [Scope::DiscoveryIndex::ENVELOPE_CONSTRUCTED_KIND, name],
+                          Source::ParameterEnvelope::OPAQUE)
+        end
+      end
+
+      def constructed_superclass_names(node)
+        return ["Data"] if meta_call_with_name?(node, :Data, :define)
+        return ["Struct"] if meta_call_with_name?(node, :Struct, :new)
+        return nil unless class_new_call?(node)
+
+        arguments = node.arguments&.arguments || []
+        return %w[Class Object] if arguments.empty?
+        return nil unless arguments.one?
+
+        argument = arguments.first
+        inner = if argument.is_a?(Prism::ConstantReadNode) then [argument.name.to_s]
+                else constructed_superclass_names(argument)
+                end
+        inner && ["Class", *inner]
+      end
+
       # The block form of a meta-new constant write: its members, and the module mark `Module.new` earns.
       # Issue #1820 — `K = Class.new(Parent)`, with or without a block, names a class whose superclass the superclass
       # table leaves out; it takes {Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK}.
@@ -4136,7 +4314,7 @@ module Rigor
       # descent.
       def record_call_node_methods(node, qualified_prefix, in_singleton_class, methods_acc, source_path)
         record_define_method(node, qualified_prefix, in_singleton_class, methods_acc) if node.name == :define_method
-        record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc) if ATTR_MACROS.include?(node.name)
+        record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc) if attr_macro(node)
         record_module_attr_methods(node, qualified_prefix, methods_acc) if MODULE_ATTR_MACROS.key?(node.name)
         record_alias_method_call(node, qualified_prefix, in_singleton_class, methods_acc)
         record_surface_evidence(node, qualified_prefix, methods_acc)
@@ -4649,6 +4827,49 @@ module Rigor
         end
       end
 
+      # Issue #1989 — the instance method names a non-`def` definer written on the class body's self replaces:
+      # each reader (and `x=` writer) an `attr_*` call declares, a literal `define_method(:x)`, and the new name of
+      # an `alias_method :x, :y` call. A non-literal name replaces nothing Rigor can name.
+      def call_superseded_names(call_node)
+        if (macro = attr_macro(call_node))
+          names = []
+          each_attr_macro_name(call_node) do |base|
+            names << base unless macro == :attr_writer
+            names << :"#{base}=" unless macro == :attr_reader
+          end
+          names
+        elsif call_node.name == :define_method
+          define_method_superseded_name(call_node)
+        else
+          Source::AliasNames.alias_method_call_names(call_node)&.first(1) || []
+        end
+      end
+
+      def define_method_superseded_name(call_node)
+        return [] unless call_node.receiver.nil? || call_node.receiver.is_a?(Prism::SelfNode)
+
+        name = literal_method_name(call_node.arguments&.arguments&.first)
+        name.nil? ? [] : [name.to_sym]
+      end
+
+      # Issue #1989 — a definer that is not a `def` replaces the method an earlier `def` of the same name in this walk
+      # installed: `def x = 1; attr_reader :x` answers the attr reader, so the `def` body must not type the call. The
+      # slot keeps the `def` and is contested, certain definer or possible, so the readers that re-type a body
+      # decline. The slot is not emptied: the file still writes it, so a sibling file's `def` of the name (which the
+      # cross-file seed and the project fold would otherwise put there) cannot fill it. A `def` written after the
+      # definer writes the slot again and clears the contest.
+      def supersede_def_nodes(names, qualified_prefix, accumulator, tables)
+        return if names.empty?
+
+        class_name = qualified_prefix.join("::")
+        slot = accumulator[class_name]
+        return if slot.nil?
+
+        names.each do |name|
+          follow_slot_writer(tables, :contested_def_nodes, [class_name, name], false) if slot.key?(name)
+        end
+      end
+
       # #319 — a `def` inside an anonymous `Class.new` / `Module.new` body ALSO stays in the `<toplevel>` table.
       # Before the anonymous class had a name the body was walked with an empty prefix, so every such `def`
       # landed there; that is the same leniency this key already grants a `def` nested in any other DSL block
@@ -4694,6 +4915,18 @@ module Rigor
       # The singleton walk's accumulator: the `{class => {name => DefNode}}` table, plus the contested slots, which
       # follow each slot's writer ({#follow_slot_writer}'s rule).
       class SingletonDefTable < Hash
+        # Issue #1936 — contests the slots of `names` (every slot of `class_name` for `:all`) that an earlier write
+        # filled: a later non-`def` definer replaced the `def` they hold. The slot keeps the `def`, as
+        # {ScopeIndexer#supersede_def_nodes} keeps the instance one, and a later write clears the contest.
+        def supersede(class_name, names)
+          slot = self[class_name]
+          return if slot.nil?
+
+          (names == :all ? slot.keys : names).each do |name|
+            (@contested ||= Set.new) << [class_name, name] if slot.key?(name)
+          end
+        end
+
         def track(certainty)
           @certainty = certainty
           @contested = nil
@@ -4701,9 +4934,11 @@ module Rigor
         end
 
         # Writes the slot; `node` and `other` are the contributions the write rests on, possible when either is.
-        def write(class_name, name, def_node, node, other = nil)
+        # `possible` says the write rests on a fact the contributions do not carry (a module_function copy after a
+        # reset that may not run, #1968).
+        def write(class_name, name, def_node, node, other = nil, possible: false)
           (self[class_name] ||= {})[name] = def_node
-          if Certainty.possible?(@certainty, node) || (other && Certainty.possible?(@certainty, other))
+          if possible || Certainty.possible?(@certainty, node) || (other && Certainty.possible?(@certainty, other))
             (@contested ||= Set.new) << [class_name, name]
           else
             @contested&.delete([class_name, name])
@@ -4746,6 +4981,12 @@ module Rigor
       # `Const`'s singleton class (a `remove_method`, a `def`) without declaring `Const`, so it stays out of
       # `class_sources` (whose readers take a name there as one the project declares) and joins only the per-file
       # class-declaration sets the incremental `class:` edges diff (`Runner#class_declarations`).
+      #
+      # Issue #1941 — so does a `def Const.x` (`def D.own`, or `def E.x` inside `module M`, resolved as a `class << E`
+      # receiver is): it adds to `Const`'s singleton side from a file the reader's class edge need not name. In the set,
+      # the declaration diff fires `class:` when the file gains or loses one, and
+      # `IncrementalSession#singleton_rewrite_affected` fires it when one is renamed. `def (M::E).x` records no
+      # singleton `def` at all, so it joins nothing.
       def record_singleton_class_sources(sources, path, root)
         collect_singleton_class_targets(root, []) { |name| (sources[name] ||= Set.new) << path }
       end
@@ -4761,6 +5002,8 @@ module Rigor
           yield eval_constant_receiver_prefix(node, node.expression, rendered, lexical_prefix).join("::") if rendered
         when Prism::CallNode
           yield_singleton_side_constant(node, node.receiver, lexical_prefix, &) if singleton_side_call?(node)
+        when Prism::DefNode
+          yield_singleton_side_constant(node, node.receiver, lexical_prefix, &)
         end
         node.rigor_each_child { |child| collect_singleton_class_targets(child, lexical_prefix, &) }
       end
@@ -4768,8 +5011,7 @@ module Rigor
       # A call on a constant that may rewrite its singleton side (`Const.singleton_class`,
       # `Const.define_singleton_method`, `Const.extend(M)`, `Const.instance_eval { … }`) records facts about `Const`'s
       # singleton methods the refinement walk reads from a file that need not declare `Const`, so the file joins the
-      # constant's set too. Written inside `Const`'s own body, the name is in the file's set already; a `def Const.x`
-      # files its own `method:` key.
+      # constant's set too. Written inside `Const`'s own body, the name is in the file's set already.
       def singleton_side_call?(node)
         node.name == :singleton_class || surface_rewriting_call?(node)
       end
@@ -4984,7 +5226,7 @@ module Rigor
       # own `def` leaves additionally split on {INSTANCE_EVAL_CALLS}, whose `def`s bind on the
       # receiver's singleton rather than the receiver.
       def receiver_eval_call?(node)
-        node.block.is_a?(Prism::BlockNode) && RECEIVER_EVAL_CALLS.include?(node.name)
+        node.is_a?(Prism::CallNode) && node.block.is_a?(Prism::BlockNode) && RECEIVER_EVAL_CALLS.include?(node.name)
       end
 
       # A `class_eval` / `module_eval` / `class_exec` / `module_exec` block is NOT deferred: it runs
@@ -5367,7 +5609,10 @@ module Rigor
                                    def_owner_prefix = nil, singleton_cref: false,
                                    defs_singleton: false)
         return unless node.is_a?(Prism::Node)
-        if node.is_a?(Prism::CallNode) && receiver_eval_call?(node)
+
+        supersede_singleton_def_nodes(node, qualified_prefix, in_singleton_class, defs_singleton, accumulator,
+                                      def_owner_prefix)
+        if receiver_eval_call?(node)
           return walk_eval_singleton_defs(node, qualified_prefix, in_singleton_class, accumulator,
                                           def_owner_prefix, singleton_cref: singleton_cref,
                                                             defs_singleton: defs_singleton)
@@ -5658,7 +5903,8 @@ module Rigor
                               defs_singleton: false)
         owner_prefix = def_owner_prefix || qualified_prefix
         statements = statements_of(body)
-        ModuleFunctionState.each_singleton_sibling(statements) do |stmt, module_function_on, named_call|
+        conditional = ModuleFunctionState.conditional_clause_statements(body)
+        ModuleFunctionState.each_singleton_sibling(statements, conditional) do |stmt, module_function_on, named_call|
           if named_call
             # `:unnameable` — the named defs the call copies live on the metaclass,
             # which this table cannot name either.
@@ -5708,19 +5954,96 @@ module Rigor
         statements
       end
 
+      # `module_function_on` is {ModuleFunctionState.each_singleton_sibling}'s: `:uncertain` writes the module
+      # function's copy as possible, so the slot holds the later def, contested, rather than the def the
+      # slot held before (#1968).
       def record_singleton_def_node(def_node, qualified_prefix, in_singleton_class, module_function_on, accumulator)
-        singleton = def_singleton?(def_node, qualified_prefix, in_singleton_class) || module_function_on
-        return unless singleton
+        declared = def_singleton?(def_node, qualified_prefix, in_singleton_class)
+        return unless declared || module_function_on
         return if qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        write_singleton_slot(accumulator, class_name, def_node.name, def_node, def_node)
+        write_singleton_slot(accumulator, class_name, def_node.name, def_node, def_node,
+                             possible: !declared && module_function_on == :uncertain)
+      end
+
+      # Issue #1936 — the singleton twin of {#supersede_def_nodes}: a definer that is not a `def` replaces the
+      # singleton method an earlier `def self.x` of the walk installed, so the slot is contested and the typing read
+      # declines instead of re-typing the replaced body. The definers, each written on the class's own singleton
+      # class: `singleton_class.alias_method` / `define_method` / `remove_method` / `undef_method` / `attr_*` and its
+      # `class_eval` family and `send` (bare, `self.` or a constant's `singleton_class`), `define_singleton_method`,
+      # and in a `class << self` body the receiverless calls of the same names with `alias` and `undef`. Certain or
+      # possible alike; a call whose rewritten names are not all literal contests every slot the owner holds so far.
+      # Under an `instance_eval` split (`defs_singleton`) only `alias` and `undef` bind on the singleton; its calls
+      # stay instance-side.
+      def supersede_singleton_def_nodes(node, qualified_prefix, in_singleton_class, defs_singleton, accumulator,
+                                        def_owner_prefix)
+        return unless accumulator.is_a?(SingletonDefTable) && defs_singleton != :unnameable
+
+        owner_prefix = def_owner_prefix || qualified_prefix
+        current = owner_prefix.empty? ? nil : owner_prefix.join("::")
+        owner, names =
+          case node
+          when Prism::AliasMethodNode, Prism::UndefNode
+            [current, singleton_keyword_names(node)] if in_singleton_class || defs_singleton == true
+          when Prism::CallNode
+            singleton_call_target(node, qualified_prefix, current, in_singleton_class)
+          end
+        accumulator.supersede(owner, names) if owner && names
+      end
+
+      def singleton_keyword_names(node)
+        return literal_names_or_all(node.names) if node.is_a?(Prism::UndefNode)
+
+        names = Source::AliasNames.keyword_names(node)
+        names ? names.first(1) : :all
+      end
+
+      # `[owner, names]` for a singleton definer call {#supersede_singleton_def_nodes} reads, or nil.
+      def singleton_call_target(node, qualified_prefix, current, in_singleton_class)
+        receiver = node.receiver
+        if !in_singleton_class && singleton_class_of_receiver?(receiver)
+          [singleton_class_owner(node, receiver.receiver, qualified_prefix, current), singleton_naming_call_names(node)]
+        elsif receiver.nil? || receiver.is_a?(Prism::SelfNode)
+          [current, in_singleton_class ? singleton_naming_call_names(node) : define_singleton_method_names(node)]
+        end
+      end
+
+      # The singleton names a naming call on the singleton class replaces, `:all` where they are not all literal,
+      # or nil for another call. `attr_writer` replaces only `x=`, `attr_reader` only `x`. A `class_eval`-family or
+      # `send` call may replace any name, so it is `:all`.
+      def singleton_naming_call_names(node)
+        arguments = node.arguments&.arguments || []
+        case node.name
+        when *SURFACE_EVAL_CALLS, *SURFACE_SEND_CALLS then :all
+        when :alias_method then literal_names_or_all(arguments.first(1))
+        when :define_method then define_singleton_method_names(node, :define_method)
+        when :remove_method, :undef_method then literal_names_or_all(arguments)
+        when *ATTR_MACROS
+          names = literal_names_or_all(arguments)
+          return names if names == :all
+
+          names.flat_map do |base|
+            [(base unless node.name == :attr_writer), (:"#{base}=" unless node.name == :attr_reader)].compact
+          end
+        end
+      end
+
+      def define_singleton_method_names(node, call = :define_singleton_method)
+        return nil unless node.name == call
+
+        literal_names_or_all(node.arguments&.arguments&.first(1) || [])
+      end
+
+      def literal_names_or_all(arguments)
+        names = arguments.map { |argument| literal_method_name(argument) }
+        names.empty? || names.any?(&:nil?) ? :all : names
       end
 
       # One singleton slot write, through {SingletonDefTable#write} when the walk tracks certainty.
-      def write_singleton_slot(accumulator, class_name, name, def_node, node, other = nil)
+      def write_singleton_slot(accumulator, class_name, name, def_node, node, other = nil, possible: false)
         if accumulator.is_a?(SingletonDefTable)
-          accumulator.write(class_name, name, def_node, node, other)
+          accumulator.write(class_name, name, def_node, node, other, possible: possible)
         else
           (accumulator[class_name] ||= {})[name] = def_node
         end
@@ -6617,32 +6940,34 @@ module Rigor
       # differently for the two spellings of one edge.
       def record_mixin_call(node, qualified_prefix, current_class, accumulator)
         taint_opaque_eval(node, current_class, accumulator)
-        kind, _arguments, via_send = mixin_call_view(node)
-        return if kind.nil?
+        view = mixin_call_view(node)
+        return if view.nil? || view.first.nil?
 
+        kind = view.first
         current_class ||= toplevel_include_owner(node, qualified_prefix, current_class, accumulator)
         effects = mixin_effects(node, kind, qualified_prefix, current_class, accumulator, in_singleton: false)
                   .select { |_owner, side| side == :include }
         return if effects.empty?
-        return if !via_send && instance_mixin_recorded?(node, qualified_prefix, current_class, accumulator)
+        return if instance_mixin_recorded?(node, view, qualified_prefix, current_class, accumulator)
 
         # A mixin call the tables cannot hold still reshapes the ancestry: taint the whole owner side.
         effects.each { |owner, side| accumulator.taint(owner, side) }
       end
 
       # Records the instance-side edges of a call {#mixin_call_recorded?} accepts. False when it recorded
-      # nothing — the caller then taints the owner instead.
-      def instance_mixin_recorded?(node, qualified_prefix, current_class, accumulator)
-        return false unless mixin_call_recorded?(node, current_class)
+      # nothing — the caller then taints the owner instead. `view` is {#mixin_call_view}'s, so
+      # `Integer.send(:include, Ext)` records `Ext` as `Integer.include(Ext)` does (issue #1722).
+      def instance_mixin_recorded?(node, view, qualified_prefix, current_class, accumulator)
+        kind, arguments, via_send = view
+        return false unless mixin_call_recorded?(node, kind, via_send, current_class)
 
-        arguments = node.arguments&.arguments || []
         targets = arguments.filter_map { |arg| Source::ConstantPath.qualified_name(arg) }
         return false if targets.empty?
 
         owner = node.receiver.nil? ? current_class : prepend_call_receiver(node, qualified_prefix)
         return false if owner.nil?
 
-        write_mixin_targets(accumulator, owner, targets, prepend: node.name == :prepend)
+        write_mixin_targets(accumulator, owner, targets, prepend: kind == :prepend)
         accumulator.note(node, owner, :include, targets, complete: targets.size == arguments.size)
         true
       end
@@ -6790,15 +7115,17 @@ module Rigor
       end
 
       # Whether a mixin call contributes to the tables at all: a receiverless `include` / `prepend` needs an
-      # enclosing declaration to file the edge under, and the RECEIVER form is recorded for `prepend` only
-      # — `Base.include(Loud)` is deliberately still unrecorded. Nothing needs it (this issue orders
-      # `prepend`, and the receiver form of `include` has no ordering question to answer) while recording
-      # it would widen what every consumer says about a class, which is scope this change does not own.
-      def mixin_call_recorded?(node, current_class)
-        return false unless MIXIN_CALL_NAMES.include?(node.name)
-        return !current_class.nil? if node.receiver.nil?
+      # enclosing declaration to file the edge under, and the RECEIVER form (`Base.prepend(Loud)`, issue #1123;
+      # `Integer.include(Ext)` and `Integer.send(:include, Ext)`, issue #1722) files it under the class the
+      # receiver names. A receiver-form edge is unpositioned wherever it is written ({MixinAccumulator#note}), so
+      # a reader that depends on ORDER declines on it, while the set-shaped readers (undefined-method
+      # suppression, arity, visibility) see the module as they see an in-body `include`. A receiverless `send`
+      # stays a taint: the walk does not resolve its `self`.
+      def mixin_call_recorded?(node, kind, via_send, current_class)
+        return false unless MIXIN_CALL_NAMES.include?(kind)
+        return !via_send && !current_class.nil? if node.receiver.nil?
 
-        node.name == :prepend
+        true
       end
 
       # Issue #1697 — a receiverless `include M` written as a statement of the file's own top level is
@@ -7004,7 +7331,9 @@ module Rigor
       def extends_block_handled?(node, qualified_prefix, current_class, accumulator, in_singleton, singleton_self,
                                  singleton_cref)
         case extends_block_plan(node, accumulator)
-        when :skip then true
+        when :skip
+          taint_skipped_singleton_rewrites(node.block, qualified_prefix, current_class, accumulator)
+          true
         when :rebound
           walk_extends_block_call(node, qualified_prefix, current_class, accumulator,
                                   in_singleton, singleton_self, singleton_cref)
@@ -7013,6 +7342,31 @@ module Rigor
         end
       end
 
+      # Issue #1906 — a block the extends walk skips may still run, and a `singleton_class` call in it, or in a `def`
+      # it holds (`[1].each { D.singleton_class.alias_method :own, :other }` in a method body,
+      # `to_prepare do def helper = D.singleton_class.alias_method(...) end`), reaches no mark the methods walk records
+      # there. Every such call taints the side it may rewrite, as {#singleton_class_rewrite_tainted?} does for one the
+      # walk visits; a constant receiver taints every name it can denote from here.
+      def taint_skipped_singleton_rewrites(node, qualified_prefix, current_class, accumulator)
+        return unless node.is_a?(Prism::Node)
+
+        if node.is_a?(Prism::CallNode) && singleton_class_of_receiver?(node.receiver) && surface_rewriting_call?(node)
+          skipped_rewrite_owners(node.receiver.receiver, qualified_prefix, current_class).each do |owner|
+            accumulator.taint(owner, :extend)
+          end
+        end
+        node.rigor_each_child do |child|
+          taint_skipped_singleton_rewrites(child, qualified_prefix, current_class, accumulator)
+        end
+      end
+
+      def skipped_rewrite_owners(object, qualified_prefix, current_class)
+        return [current_class].compact if object.nil? || object.is_a?(Prism::SelfNode)
+        return [] unless object.is_a?(Prism::ConstantReadNode) || object.is_a?(Prism::ConstantPathNode)
+
+        constant_receiver_candidates(object, qualified_prefix)
+      end
+
       ARRAY_ITERATORS = %i[each each_with_index map].freeze
       HASH_ITERATORS = %i[each each_pair each_key each_value map].freeze
       private_constant :ARRAY_ITERATORS, :HASH_ITERATORS
@@ -7228,10 +7582,15 @@ module Rigor
       # `Const.singleton_class.send(:include, M)`) puts methods or modules on that singleton class that no edge
       # records, so its singleton side is unpositioned: the owner is the enclosing class for a bare or `self.`
       # receiver, else the constant. True when it tainted.
+      #
+      # Issue #1906 — a naming call with literal names ({#singleton_class_named_call?}) marks only its names instead,
+      # but only where it is a direct statement (a top-level statement, or one of a direct declaration body or of a
+      # block that runs there once): there the methods walk records those marks under the same owner. In a method
+      # body, a hook or a conditional it may run on a receiver or at a time the marks cannot place, so it still taints.
       def singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator)
         receiver = node.receiver
         return false unless singleton_class_of_receiver?(receiver) && surface_rewriting_call?(node)
-        return false if singleton_class_named_call?(node)
+        return false if singleton_class_named_call?(node) && accumulator.direct?(node)
 
         owner = singleton_class_owner(node, receiver.receiver, qualified_prefix, current_class)
         return false if owner.nil?
@@ -7245,15 +7604,37 @@ module Rigor
         receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class && receiver.arguments.nil?
       end
 
-      # An `attr_*` on a singleton class (`singleton_class.attr_accessor :conf`) rewrites only the names it spells, so
-      # it makes those names' singleton envelopes opaque ({#record_singleton_class_names}) and leaves the rest of the
-      # singleton side readable. An `attr_*` with a name it does not spell as a literal (`attr_accessor(*KEYS)`, a
-      # block's variable), and an `alias_method` or `define_method` there, still taint the side: the own-definer read
-      # would otherwise answer the body Ruby replaced (`definer_resolution_witness_spec.rb`).
+      # An `attr_*`, `alias_method`, `define_method` or `remove_method` on a singleton class
+      # (`singleton_class.attr_accessor :conf`, `singleton_class.alias_method :o2, :own`) rewrites only the names it
+      # spells, so it makes those names' singleton envelopes opaque and contested ({#record_singleton_class_names}) and
+      # leaves the rest of the singleton side readable. One whose rewritten name is not a literal Symbol or String
+      # (`attr_accessor(*KEYS)`, `alias_method name, :own`, `define_method(sym)`), and any other surface call there
+      # (`class_eval`, `send`, `prepend`), still taints the side: the own-definer read would otherwise answer the body
+      # Ruby replaced (`definer_resolution_witness_spec.rb`).
       def singleton_class_named_call?(node)
+        !singleton_class_rewritten_names(node).nil?
+      end
+
+      # Issue #1906 — the names a singleton-class call rewrites, or nil where it is not one of the naming forms or
+      # does not spell every rewritten name as a literal. `alias_method` rewrites its new name (the aliased one keeps
+      # its body), `define_method` its first argument, `remove_method` and `attr_*` every argument.
+      def singleton_class_rewritten_names(node)
         arguments = node.arguments&.arguments || []
-        ATTR_MACROS.include?(node.name) && !arguments.empty? &&
-          arguments.all? { |argument| literal_method_name(argument) }
+        rewritten = case node.name
+                    when :alias_method, :define_method then arguments.first(1)
+                    when :remove_method then arguments
+                    else ATTR_MACROS.include?(node.name) && arguments
+                    end
+        return nil if !rewritten || arguments.empty? || !arguments.all? { |argument| literal_argument?(node, argument) }
+
+        rewritten.map { |argument| literal_method_name(argument) }
+      end
+
+      # `define_method(:x, body)` takes a body that is not a name; every other argument must be a literal name.
+      def literal_argument?(node, argument)
+        return true if node.name == :define_method && !argument.equal?(node.arguments.arguments.first)
+
+        !literal_method_name(argument).nil?
       end
 
       def singleton_class_owner(node, object, qualified_prefix, current_class)
@@ -7447,19 +7828,17 @@ module Rigor
 
       # v0.1.2 — per-class method-visibility table for the `def.method-visibility-mismatch` CheckRule.
       #
-      # Tracks two visibility-changing forms:
+      # Tracks three visibility-changing forms ({#apply_visibility_call}):
+      #
+      # - **Modifier blocks**: a bare `private` / `protected` / `public` call inside a class body (also written
+      #   `self.private`, `send(:private)` or with a block) switches the "current default" visibility for every
+      #   subsequent `def` and `attr_*` member until another modifier flips it again.
+      # - **Named-argument form**: `private :foo, :bar` or `private %i[foo bar]` (or the same with `protected` /
+      #   `public`) marks specific names already recorded under the class.
+      # - **Wrap-around form** (#1911, #1819, #1633): `private def foo` and `private attr_reader :foo` record the
+      #   members with the call's visibility and leave the default alone.
       #
-      # - **Modifier blocks**: a bare `private` / `protected` /
-      #   `public` call inside a class body switches the
-      #   "current default" visibility for every subsequent
-      #   `def` until another modifier flips it again.
-      # - **Named-argument form**: `private :foo, :bar` (or
-      #   the same with `protected` / `public`) marks specific
-      #   names already-recorded under the class. Symbol-only
-      #   args are recognised; `private def foo; end` (the
-      #   wrap-around form) is not yet — it would need
-      #   tracking the def-call's return-value visibility,
-      #   which is a separate slice.
+      # A `module_function` call takes each form as `private` does (#1569): Ruby makes the instance copy private.
       #
       # Top-level (no surrounding class) defs do not contribute — Ruby's top-level visibility nuances (private at
       # top-level marks the method on `Object`) are out of scope for v0.1.2.
@@ -7477,8 +7856,8 @@ module Rigor
       end
 
       # The bare calls that set the running default visibility of the body they run in: the modifiers and
-      # `module_function`, which {#walk_method_visibilities} does not track as a value (#1569) but which moves the
-      # default all the same.
+      # `module_function`, which {#walk_method_visibilities} applies as `private` on the instance side
+      # ({ModuleFunctionState.instance_visibility}, #1569).
       VISIBILITY_TOGGLES = (VISIBILITY_MODIFIERS + %i[module_function]).freeze
 
       # The `{class => {name => visibility}}` accumulator of {#walk_method_visibilities}, which also carries the
@@ -7516,6 +7895,39 @@ module Rigor
           end
         end
 
+        # Contests the `[class_name, name]` slot, recorded or not: a visibility call changed it in a way the walk
+        # cannot read (`private def self.x` reaching an instance `x`).
+        def contest_slot(class_name, name)
+          (@contested ||= Set.new) << [class_name, name].freeze
+        end
+
+        # Contests every slot of `class_name` on `side` recorded so far (`private(*names)` may name any of them).
+        # Issue #1984 — on the singleton side it also contests the class's wildcard slot
+        # ({ScopeIndexer::SINGLETON_WILDCARD_SLOT}): the names may be ones another file records.
+        def contest_class(class_name, side = :instance)
+          self[class_name]&.each_key do |slot|
+            contest_slot(class_name, slot) if slot.is_a?(Array) == (side == :singleton)
+          end
+          contest_slot(class_name, SINGLETON_WILDCARD_SLOT) if side == :singleton
+        end
+
+        # Issue #1984 — records `visibility` in the slot of `name` on `side` ({ScopeIndexer.visibility_slot}) and
+        # settles its contest as {#wrote} does.
+        def write(class_name, name, side, visibility, node, toggled:)
+          slot = ScopeIndexer.visibility_slot(name, side)
+          (self[class_name] ||= {})[slot] = visibility
+          wrote(class_name, slot, node, toggled: toggled)
+        end
+
+        # Runs the block with the running default uncertain, so a `def` it records is contested.
+        def uncertainly
+          saved = @uncertain
+          @uncertain = true
+          yield
+        ensure
+          @uncertain = saved
+        end
+
         # Runs the block as a fresh body (a class or module, `class << self`, a meta-new or eval block), whose
         # default starts certain and whose toggles do not reach the enclosing body.
         def body
@@ -7537,10 +7949,37 @@ module Rigor
         end
       end
 
-      # A bare toggle ({VISIBILITY_TOGGLES}): receiverless, with no arguments.
+      # A bare toggle ({VISIBILITY_TOGGLES}): a visibility call ({#visibility_call_parts}) with no arguments.
       def bare_visibility_toggle?(node)
-        node.is_a?(Prism::CallNode) && node.receiver.nil? && VISIBILITY_TOGGLES.include?(node.name) &&
-          (node.arguments.nil? || node.arguments.arguments.empty?) && node.block.nil?
+        parts = visibility_call_parts(node)
+        !parts.nil? && parts.last.empty?
+      end
+
+      # Whether a visibility call with these arguments may set the running default: none at all, or a splat that
+      # may expand to none (`private(*[])` is a bare `private`).
+      def visibility_toggle_arguments?(arguments)
+        arguments.empty? || arguments.any?(Prism::SplatNode)
+      end
+
+      VISIBILITY_SEND_CALLS = %i[send __send__].freeze
+      EMPTY_VISIBILITY_ARGUMENTS = [].freeze
+      private_constant :VISIBILITY_SEND_CALLS, :EMPTY_VISIBILITY_ARGUMENTS
+
+      # Issue #1633 — `[name, arguments]` for a call Ruby runs as one of {VISIBILITY_TOGGLES} on the body's self:
+      # written receiverless or on `self` (`self.private`), or sent with a literal name (`send(:private, :x)`,
+      # `__send__(:private)`). A block is ignored, as `Module#private` ignores it (`private {}` is a bare
+      # `private`). nil for any other call.
+      def visibility_call_parts(node)
+        return nil unless node.is_a?(Prism::CallNode)
+        return nil unless node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+        name = node.name
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        if VISIBILITY_SEND_CALLS.include?(name)
+          name = Source::Literals.symbol_or_string(arguments.first)
+          arguments = arguments.drop(1)
+        end
+        VISIBILITY_TOGGLES.include?(name) ? [name, arguments] : nil
       end
 
       # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity, Metrics/AbcSize
@@ -7594,26 +8033,70 @@ module Rigor
             return current_visibility
           end
         when Prism::DefNode
-          record_def_visibility(node, owner_prefix, in_singleton_class || defs_singleton,
+          contest_foreign_singleton_visibility(node, qualified_prefix, owner_prefix, in_singleton_class, accumulator)
+          record_def_visibility(node, owner_prefix, visibility_side(in_singleton_class, defs_singleton),
                                 current_visibility, accumulator)
           return current_visibility
         when Prism::CallNode
+          record_constant_class_method_calls(node, qualified_prefix, accumulator)
           if receiver_eval_call?(node)
             walk_eval_visibilities(node, qualified_prefix, in_singleton_class, current_visibility,
                                    accumulator, def_owner_prefix, singleton_cref: singleton_cref,
                                                                   defs_singleton: defs_singleton)
             return current_visibility
           end
-          accumulator.toggles += 1 if bare_visibility_toggle?(node)
-          # The visibility table is instance-side only — `private :x` inside `class <<`
-          # (or a receiver-eval body that re-evaluates a singleton self) marks the
-          # SINGLETON method, which this table cannot express.
-          updated = if in_singleton_class
-                      current_visibility
-                    else
-                      apply_visibility_call(node, owner_prefix, current_visibility, accumulator)
-                    end
-          return updated unless updated.equal?(current_visibility)
+          if AnonymousMetaClass.block_form_receiver(node)
+            walk_anonymous_meta_visibilities(node, qualified_prefix, in_singleton_class, current_visibility,
+                                             accumulator, def_owner_prefix, singleton_cref: singleton_cref,
+                                                                            defs_singleton: defs_singleton)
+            return current_visibility
+          end
+          if (parts = visibility_call_parts(node))
+            accumulator.toggles += 1 if visibility_toggle_arguments?(parts.last)
+            # A `module_function` call is applied as a `private` one (#1569): it makes the instance copy private.
+            visibility = parts.first
+            visibility = ModuleFunctionState.instance_visibility unless VISIBILITY_MODIFIERS.include?(visibility)
+            # Issue #1984 — inside `class << self` (or a `class_eval` on the singleton class) the call marks the
+            # SINGLETON methods, recorded under their `[:singleton, name]` slots. `module_function` is no method of
+            # a singleton class, so it is walked as any other call there. The `owner_prefix` check is a guard: an
+            # ownerless body (the top level, an anonymous factory block) records nothing, and its calls walk as
+            # any other call.
+            # An `instance_eval` body's call (`:eval`) runs on the receiver as a module: the instance side.
+            side = visibility_side(in_singleton_class, defs_singleton)
+            side = :instance if side == :eval
+            if side && !owner_prefix.empty? && (side == :instance || VISIBILITY_MODIFIERS.include?(parts.first))
+              return apply_visibility_call(node, visibility, parts.last, owner_prefix, current_visibility, accumulator,
+                                           side: side, defs_singleton: defs_singleton) do |argument|
+                walk_method_visibilities(argument, qualified_prefix, in_singleton_class, current_visibility,
+                                         accumulator, def_owner_prefix, singleton_cref: singleton_cref,
+                                                                        defs_singleton: defs_singleton)
+              end
+            end
+          end
+          if !in_singleton_class && !owner_prefix.empty?
+            class_method_parts = class_method_visibility_parts(node)
+            if class_method_parts
+              apply_class_method_visibility(node, *class_method_parts, owner_prefix, accumulator) do |argument|
+                walk_method_visibilities(argument, qualified_prefix, in_singleton_class, current_visibility,
+                                         accumulator, def_owner_prefix, singleton_cref: singleton_cref,
+                                                                        defs_singleton: defs_singleton)
+              end
+              return current_visibility
+            end
+            contest_singleton_rewrites(node, owner_prefix, accumulator)
+          end
+          side = visibility_side(in_singleton_class, defs_singleton)
+          if %i[instance singleton].include?(side)
+            record_attr_visibility(node, owner_prefix, current_visibility, accumulator, toggled: true, side: side)
+            contest_replaced_visibility(replaced_by_call(node), owner_prefix, accumulator, side: side)
+          end
+        when Prism::AliasMethodNode
+          side = visibility_side(in_singleton_class, defs_singleton)
+          if %i[instance singleton].include?(side)
+            contest_replaced_visibility(Array(Source::AliasNames.keyword_names(node)&.first), owner_prefix,
+                                        accumulator, side: side)
+          end
+          return current_visibility
         end
 
         # Statement-position StatementsNode preserves left-to-right visibility flow; everything else recurses with the
@@ -7667,6 +8150,23 @@ module Rigor
         end
       end
 
+      # A `Class.new` / `Module.new` / `Struct.new` / `Data.define` block no constant write names
+      # ({#meta_new_block_split} takes the named ones): `klass = Class.new do … end`, `@k = Struct.new(:a) do … end`,
+      # `register(Class.new do … end)` or a bare `Data.define(:a) do … end`. Its body is the anonymous class's, so
+      # it walks as a fresh body with no owner and records nothing for the enclosing class; the receiver and the
+      # arguments are walked where they stand.
+      def walk_anonymous_meta_visibilities(node, qualified_prefix, in_singleton_class, current_visibility,
+                                           accumulator, def_owner_prefix, singleton_cref:, defs_singleton:) # rubocop:disable Metrics/ParameterLists
+        [node.receiver, *node.arguments&.arguments].each do |part|
+          walk_method_visibilities(part, qualified_prefix, in_singleton_class, current_visibility, accumulator,
+                                   def_owner_prefix, singleton_cref: singleton_cref, defs_singleton: defs_singleton)
+        end
+        accumulator.body do
+          walk_method_visibilities(node.block.body, qualified_prefix, false, :public, accumulator,
+                                   EMPTY_PREFIX, singleton_cref: singleton_cref)
+        end
+      end
+
       # The eval-block arm of {#walk_method_visibilities}: the block is a fresh class body under
       # the receiver's def-owner — visibility starts at `:public`, and nothing inside it leaks
       # back to this body's modifier state. An unnameable receiver walks the body ownerless;
@@ -7680,6 +8180,9 @@ module Rigor
                                    singleton_cref: singleton_cref,
                                    defs_singleton: defs_singleton)
         end
+        return if singleton_class_eval_walked?(node, qualified_prefix, in_singleton_class, accumulator,
+                                               def_owner_prefix, singleton_cref, defs_singleton)
+
         node.arguments&.arguments&.each do |arg|
           walk_method_visibilities(arg, qualified_prefix, in_singleton_class, current_visibility,
                                    accumulator, def_owner_prefix, singleton_cref: singleton_cref,
@@ -7704,48 +8207,201 @@ module Rigor
         end
       end
 
-      def record_def_visibility(def_node, qualified_prefix, in_singleton_class, current_visibility, accumulator)
-        return if def_node.receiver.is_a?(Prism::SelfNode) || in_singleton_class
-        return if qualified_prefix.empty?
+      # Issue #1984 — `singleton_class.class_eval do … end` in a class body (or `module_eval` / `class_exec` /
+      # `module_exec`) runs its block as a `class << self` body does: its `def`s and visibility calls land on the
+      # class's singleton slots. True when it walked the block so.
+      def singleton_class_eval_walked?(node, qualified_prefix, in_singleton_class, accumulator,
+                                       def_owner_prefix, singleton_cref, defs_singleton)
+        return false if in_singleton_class || defs_singleton || INSTANCE_EVAL_CALLS.include?(node.name)
+        return false unless own_singleton_class?(node.receiver) && node.arguments.nil?
+
+        owner_prefix = def_owner_prefix || qualified_prefix
+        return false if owner_prefix.empty?
+
+        if node.block.body
+          accumulator.body do
+            walk_method_visibilities(node.block.body, qualified_prefix, true, :public, accumulator, owner_prefix,
+                                     singleton_cref: singleton_cref)
+          end
+        end
+        true
+      end
+
+      # Issue #1984 — the slot a contest stands on for every singleton name of a class: a call that may make any of
+      # them public (`K.public_class_method(*names)`, `K.singleton_class.class_eval { … }`).
+      SINGLETON_WILDCARD_SLOT = %i[singleton *].freeze
+
+      # Issue #1984 — a class method visibility call written on a constant (`K.public_class_method(:x)`,
+      # `K.send(:public_class_method, :x)`), anywhere: each literal name is recorded public on every class the
+      # constant may name, so a reopening's or another file's `private_class_method` disagrees with it and is
+      # contested. A `K.private_class_method` is not read (the rule only declines more where it is missing). Any call
+      # on `K.singleton_class` (`send(:public, :x)`, `class_eval { … }`), or a `public_class_method` whose names are
+      # not literal, contests every singleton name of the class.
+      def record_constant_class_method_calls(node, qualified_prefix, accumulator)
+        receiver = node.receiver
+        if singleton_class_of_receiver?(receiver) && constant_receiver?(receiver.receiver)
+          each_constant_class(receiver.receiver, qualified_prefix) do |class_name|
+            accumulator.contest_class(class_name, :singleton)
+          end
+          return
+        end
+        names = constant_public_class_method_names(node)
+        return if names.nil?
+
+        each_constant_class(receiver, qualified_prefix) do |class_name|
+          next accumulator.contest_class(class_name, :singleton) if names.any?(&:nil?)
+
+          names.each do |method_name|
+            accumulator.write(class_name, method_name, :singleton, :public, node, toggled: false)
+          end
+        end
+      end
+
+      # The names a `K.public_class_method(…)` (or `K.send(:public_class_method, …)`) call on a constant names, a nil
+      # for each one that is not a literal; nil for any other call.
+      def constant_public_class_method_names(node)
+        return nil unless constant_receiver?(node.receiver)
+
+        name = node.name
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        if VISIBILITY_SEND_CALLS.include?(name) || name == :public_send
+          name = Source::Literals.symbol_or_string(arguments.first)
+          arguments = arguments.drop(1)
+        end
+        return nil unless name == :public_class_method
+
+        arguments.flat_map { |arg| arg.is_a?(Prism::ArrayNode) ? arg.elements : [arg] }
+                 .map { |arg| Source::Literals.symbol_or_string(arg) }
+      end
+
+      def constant_receiver?(node)
+        node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+      end
+
+      def each_constant_class(receiver, qualified_prefix, &)
+        constant_receiver_candidates(receiver, qualified_prefix).each(&)
+      end
+
+      # Issue #1984 — the side a body's members land on: `:singleton` in a `class << self` body or a `class_eval` on
+      # the singleton class, `:eval` in an `instance_eval` body on a class (its `def`s are singleton methods, its
+      # visibility calls instance-side), `:instance` in a class body, and nil where the singleton cannot be named.
+      def visibility_side(in_singleton_class, defs_singleton)
+        return defs_singleton == :unnameable ? nil : :singleton if in_singleton_class
+        return :eval if defs_singleton
+
+        :instance
+      end
+
+      # Issue #1984 — the key of `name`'s slot in a class's visibility table: the name on the instance side,
+      # `[:singleton, name]` on the singleton side (the envelope table's spelling).
+      def visibility_slot(name, side)
+        side == :singleton ? [:singleton, name].freeze : name
+      end
+
+      # Records the visibility a `def` gets ({#visibility_side} `side`):
+      #
+      # - a receiverless `def` takes `current_visibility` on its side; `toggled` when that is the running default
+      #   (a statement), false for one a visibility call wraps;
+      # - issue #1984 — `def self.x` (or `def K.x` in `K`'s body) is a public singleton method whatever the running
+      #   default is (`private; def self.x` is public), and writes nothing in a singleton body (it defines a method
+      #   of the singleton's singleton);
+      # - an `instance_eval` body's `def` (`:eval`) replaces a singleton method with a visibility the walk does not
+      #   read, so its singleton slot is contested.
+      def record_def_visibility(def_node, qualified_prefix, side, current_visibility, accumulator, toggled: true)
+        return if side.nil? || qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        accumulator[class_name] ||= {}
-        accumulator[class_name][def_node.name] = current_visibility
-        accumulator.wrote(class_name, def_node.name, def_node, toggled: true)
+        if side == :eval
+          accumulator.contest_slot(class_name, visibility_slot(def_node.name, :singleton))
+        elsif def_node.receiver.nil?
+          accumulator.write(class_name, def_node.name, side, current_visibility, def_node, toggled: toggled)
+        elsif side == :instance && self_singleton_def?(def_node, qualified_prefix)
+          accumulator.write(class_name, def_node.name, :singleton, :public, def_node, toggled: false)
+        end
       end
 
-      # Recognises modifier calls on the implicit-self receiver inside a class body. Returns the (possibly updated)
-      # current visibility:
+      def self_singleton_def?(def_node, qualified_prefix)
+        def_node.receiver.is_a?(Prism::SelfNode) || def_receiver_targets_lexical_self?(def_node.receiver,
+                                                                                       qualified_prefix)
+      end
+
+      # Issue #1984 — `def Other.x` whose receiver is not the lexical self (`def_owner`) makes `Other.x` public in
+      # whatever order the files load, so each class the constant may name has its singleton slot contested.
+      def contest_foreign_singleton_visibility(def_node, qualified_prefix, def_owner, in_singleton_class, accumulator)
+        receiver = def_node.receiver
+        return unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+        return if !in_singleton_class && def_receiver_targets_lexical_self?(receiver, def_owner)
+
+        constant_receiver_candidates(receiver, qualified_prefix).each do |name|
+          accumulator.contest_slot(name, visibility_slot(def_node.name, :singleton))
+        end
+      end
+
+      # Applies one `private` / `protected` / `public` call ({#visibility_call_parts}) written on the body's self
+      # and returns the running default after it. `side` is the side its names land on: `:singleton` in a
+      # `class << self` body (issue #1984), `:instance` elsewhere.
       #
-      # - `private` / `public` / `protected` (no args) —
-      #   switch the running default for subsequent defs.
-      # - `private :foo, :bar` — back-patch the named methods
-      #   in the accumulator. Returns `current_visibility`
-      #   unchanged because the running default does NOT
-      #   change for this form.
-      def apply_visibility_call(call_node, qualified_prefix, current_visibility, accumulator)
-        return current_visibility unless call_node.receiver.nil?
-        return current_visibility unless VISIBILITY_MODIFIERS.include?(call_node.name)
-        return current_visibility if qualified_prefix.empty?
+      # - no arguments — the call's visibility becomes the default for subsequent defs.
+      # - `private :foo, :bar`, `private %i[foo bar]` — back-patch the named methods in the accumulator; the
+      #   default does NOT change for this form.
+      # - Issues #1911, #1819, #1633 — `private def foo` (endless or not) and `private attr_reader :foo` define
+      #   the members with the call's visibility, whatever the running default is (`private; public def foo` is
+      #   public); `private def self.foo` changes the method `foo` of the side, if one exists, so its slot is
+      #   contested, and defines a public singleton `foo` (a singleton-singleton one in a `class << self` body).
+      # - a splat (`private(*names)`) may name any member or none (a bare toggle), so the class's slots on the side
+      #   this file wrote so far are contested, and the statement loop reads the default after it as uncertain
+      #   ({#visibility_toggle_arguments?}).
+      # - any other argument (`private memoize def foo`, `private delegate(...)`) is walked with the default
+      #   uncertain, so a `def` under it is contested: the call's visibility reaches it through a return value
+      #   the walk does not read.
+      #
+      # `walk` walks an argument the call does not consume itself.
+      def apply_visibility_call(call_node, name, args, qualified_prefix, current_visibility, accumulator, # rubocop:disable Metrics/ParameterLists
+                                side: :instance, defs_singleton: false, &walk)
+        return name if args.empty?
 
-        args = call_node.arguments&.arguments || []
-        if args.empty?
-          call_node.name
+        class_name = qualified_prefix.join("::")
+        accumulator.contest_class(class_name, side) if args.any?(Prism::SplatNode)
+        args.each do |arg|
+          apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator,
+                                    side: side, defs_singleton: defs_singleton, &walk)
+        end
+        current_visibility
+      end
+
+      def apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator, side:, defs_singleton:, &walk)
+        case arg
+        when Prism::DefNode
+          if arg.receiver.nil?
+            def_side = side == :instance && defs_singleton ? :eval : side
+            record_def_visibility(arg, qualified_prefix, def_side, name, accumulator, toggled: false)
+          else
+            accumulator.contest_slot(qualified_prefix.join("::"), visibility_slot(arg.name, side))
+            record_def_visibility(arg, qualified_prefix, defs_singleton ? :eval : side, name, accumulator,
+                                  toggled: false)
+          end
+        when Prism::SymbolNode, Prism::StringNode, Prism::ArrayNode
+          apply_named_visibility(arg, name, qualified_prefix, call_node, accumulator, side: side, &walk)
         else
-          apply_named_visibility(args, qualified_prefix, call_node, accumulator)
-          current_visibility
+          # An `instance_eval` body's wrapped attr is walked like any other argument and records nothing.
+          if !defs_singleton && attr_visibility_call?(arg)
+            record_attr_visibility(arg, qualified_prefix, name, accumulator, toggled: false, side: side)
+          else
+            accumulator.uncertainly { walk.call(arg) }
+          end
         end
       end
 
-      def apply_named_visibility(args, qualified_prefix, call_node, accumulator)
+      # `private :foo` / `private "foo"` / `private %i[foo bar]`: each literal name the call's visibility. An array
+      # element that is not a literal name is walked like any other argument.
+      def apply_named_visibility(arg, visibility, qualified_prefix, call_node, accumulator, side: :instance, &walk)
+        elements = arg.is_a?(Prism::ArrayNode) ? arg.elements : [arg]
         class_name = qualified_prefix.join("::")
-        args.each do |arg|
-          name = visibility_target_name(arg)
-          next if name.nil?
+        elements.each do |element|
+          name = visibility_target_name(element)
+          next accumulator.uncertainly { walk.call(element) } if name.nil?
 
-          accumulator[class_name] ||= {}
-          accumulator[class_name][name] = call_node.name
-          accumulator.wrote(class_name, name, call_node, toggled: false)
+          accumulator.write(class_name, name, side, visibility, call_node, toggled: false)
         end
       end
 
@@ -7753,6 +8409,135 @@ module Rigor
         Source::Literals.symbol_or_string(arg)
       end
 
+      CLASS_METHOD_VISIBILITIES = { private_class_method: :private, public_class_method: :public }.freeze
+      private_constant :CLASS_METHOD_VISIBILITIES
+
+      # Issue #1984 — `[visibility, arguments]` for a `private_class_method` / `public_class_method` call written on
+      # the body's self, in the spellings {#visibility_call_parts} reads (receiverless, `self.`, `send` with a
+      # literal name); nil for any other call.
+      def class_method_visibility_parts(node)
+        return nil unless node.is_a?(Prism::CallNode)
+        return nil unless node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+        name = node.name
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        if VISIBILITY_SEND_CALLS.include?(name)
+          name = Source::Literals.symbol_or_string(arguments.first)
+          arguments = arguments.drop(1)
+        end
+        visibility = CLASS_METHOD_VISIBILITIES[name]
+        visibility && [visibility, arguments]
+      end
+
+      # Issue #1984 — applies `private_class_method` / `public_class_method` to the class's singleton slots. It sets
+      # no running default (with no arguments it does nothing). A literal name (`:x`, `"x"`, `[:x]`) and a wrapped
+      # `def self.x` take the call's visibility; a wrapped receiverless `def x` defines an instance method (walked as
+      # a statement) and names the singleton `x` the walk does not see, as does any other receiver, so that slot is
+      # contested; a splat or any other argument may name any singleton method, so every singleton slot the file
+      # wrote so far for the class is contested, and the argument is walked.
+      def apply_class_method_visibility(call_node, visibility, args, qualified_prefix, accumulator, &walk)
+        class_name = qualified_prefix.join("::")
+        args.each do |arg|
+          case arg
+          when Prism::DefNode
+            if arg.receiver && self_singleton_def?(arg, qualified_prefix)
+              accumulator.write(class_name, arg.name, :singleton, visibility, call_node, toggled: false)
+            else
+              walk.call(arg)
+              accumulator.contest_slot(class_name, visibility_slot(arg.name, :singleton))
+            end
+          when Prism::SymbolNode, Prism::StringNode, Prism::ArrayNode
+            apply_named_visibility(arg, visibility, qualified_prefix, call_node, accumulator, side: :singleton) do |el|
+              accumulator.contest_class(class_name, :singleton)
+              walk.call(el)
+            end
+          else
+            accumulator.contest_class(class_name, :singleton)
+            walk.call(arg)
+          end
+        end
+      end
+
+      SINGLETON_DEFINING_CALLS = %i[define_singleton_method].freeze
+      private_constant :SINGLETON_DEFINING_CALLS
+
+      # Issue #1984 — calls in a class body that change a singleton method's visibility in a way the walk does not
+      # read, so the singleton slots they may reach are contested: `define_singleton_method(:x)` (a fresh public
+      # method; a computed name contests every singleton slot of the class), and any call on `singleton_class`
+      # (`singleton_class.send(:public, :x)`, `singleton_class.define_method(:x)`), whose literal arguments name
+      # the slots and whose other arguments may name any.
+      def contest_singleton_rewrites(node, qualified_prefix, accumulator)
+        on_singleton_class = own_singleton_class?(node.receiver)
+        return unless on_singleton_class || node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+        return unless on_singleton_class || SINGLETON_DEFINING_CALLS.include?(node.name)
+
+        class_name = qualified_prefix.join("::")
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        arguments = arguments.first(1) if SINGLETON_DEFINING_CALLS.include?(node.name)
+        arguments.each do |argument|
+          name = Source::Literals.symbol_or_string(argument)
+          if name
+            accumulator.contest_slot(class_name, visibility_slot(name, :singleton))
+          else
+            accumulator.contest_class(class_name, :singleton)
+          end
+        end
+      end
+
+      # `singleton_class` or `self.singleton_class`: the body's own singleton class.
+      def own_singleton_class?(receiver)
+        singleton_class_of_receiver?(receiver) && (receiver.receiver.nil? || receiver.receiver.is_a?(Prism::SelfNode))
+      end
+
+      # Issue #1911 — an `attr_reader` / `attr_writer` / `attr_accessor` call written on the body's self records
+      # each member it defines (`x`, `x=`) with `visibility`: the running default for a statement (`toggled`), the
+      # wrapping call's for `private attr_accessor :x`, which Ruby applies to the `[:x, :x=]` the macro returns.
+      # A non-literal name (`attr_reader(*FIELDS)`) records nothing; a call that is no such macro records nothing.
+      # Issue #1989 — the names a `define_method(:x)` or an `alias_method :x, :y` call replaces. An `attr_*` call is
+      # not among them: it writes its members' slots itself ({#record_attr_visibility}).
+      def replaced_by_call(call_node)
+        return define_method_superseded_name(call_node) if call_node.name == :define_method
+
+        Source::AliasNames.alias_method_call_names(call_node)&.first(1) || []
+      end
+
+      # Issue #1989 — a `define_method` or an alias that replaces a method whose visibility slot this walk recorded
+      # gives the name a visibility the walk does not read (the running default for `define_method`, the old
+      # name's for an alias), so the slot is contested rather than left asserting the replaced `def`'s. Issue #1984
+      # — on the singleton side the slot is contested whether or not this file recorded it, since another file may
+      # have.
+      def contest_replaced_visibility(names, qualified_prefix, accumulator, side: :instance)
+        return if names.empty? || qualified_prefix.empty?
+
+        class_name = qualified_prefix.join("::")
+        recorded = accumulator[class_name]
+        names.each do |name|
+          slot = visibility_slot(name, side)
+          accumulator.contest_slot(class_name, slot) if side == :singleton || recorded&.key?(slot)
+        end
+      end
+
+      def record_attr_visibility(call_node, qualified_prefix, visibility, accumulator, toggled:, side: :instance)
+        macro = attr_macro(call_node)
+        return if macro.nil? || qualified_prefix.empty?
+
+        class_name = qualified_prefix.join("::")
+        each_attr_macro_name(call_node) do |base|
+          members = []
+          members << base unless macro == :attr_writer
+          members << :"#{base}=" unless macro == :attr_reader
+          members.each do |member|
+            accumulator.write(class_name, member, side, visibility, call_node, toggled: toggled)
+          end
+        end
+      end
+
+      # An `attr_reader` / `attr_writer` / `attr_accessor` call on the body's self ({#attr_macro},
+      # {#record_attr_visibility}). Ruby 4.0.5 gives every spelling the running default visibility.
+      def attr_visibility_call?(node)
+        !attr_macro(node).nil?
+      end
+
       # Registers the alias name in the `discovered_methods` table so `undefined-method` diagnostics are not emitted for
       # calls to the aliased name. The kind mirrors the surrounding class context (instance inside a regular class body,
       # singleton inside `class << self`).
@@ -7858,21 +8643,21 @@ module Rigor
       end
 
       # Issue #1752 — the names a {#singleton_class_named_call?} rewrites on its singleton class's owner, each
-      # singleton envelope opaque: the evidence the refinement typer reads as a rewritten singleton name.
+      # singleton envelope opaque and contested: the evidence the refinement typer reads as a rewritten singleton name.
       def record_singleton_class_names(node, object, qualified_prefix, tables)
         current_class = qualified_prefix.empty? ? nil : qualified_prefix.join("::")
         owner = singleton_class_owner(node, object, qualified_prefix, current_class)
         return if owner.nil?
 
-        (node.arguments&.arguments || []).each do |argument|
-          method_name = literal_method_name(argument)
-          next unless method_name
-
-          names = [method_name]
+        singleton_class_rewritten_names(node).each do |method_name|
+          # `attr_writer :x` defines `x=` alone (#1936), so `x` keeps its own `def`.
+          names = node.name == :attr_writer ? [] : [method_name]
           names << :"#{method_name}=" if %i[attr_writer attr_accessor].include?(node.name)
           names.each do |name|
             record_envelope(tables.envelopes, owner, [:singleton, name], Source::ParameterEnvelope::OPAQUE)
-            contest_envelope(tables, owner, [:singleton, name]) unless tables.certain
+            # Contested even where the call is certain: the slot's `def` is not the body Ruby runs, so the
+            # own-definer read declines on the name rather than answering it.
+            contest_envelope(tables, owner, [:singleton, name])
           end
         end
       end
@@ -8209,8 +8994,9 @@ module Rigor
         return if qualified_prefix.empty?
 
         kind = in_singleton_class ? :singleton : :instance
-        reader = call_node.name != :attr_writer
-        writer = call_node.name != :attr_reader
+        macro = attr_macro(call_node)
+        reader = macro != :attr_writer
+        writer = macro != :attr_reader
         class_name = qualified_prefix.join("::")
         each_attr_macro_name(call_node) do |base|
           record_method(accumulator, class_name, base, kind) if reader
@@ -8218,18 +9004,34 @@ module Rigor
         end
       end
 
-      # Yields each name an `attr_*` call declares: a Symbol or String literal argument. A non-literal one
-      # (`attr_writer(*names)`) names nothing Rigor can read.
+      # Yields each name an `attr_*` call declares ({#attr_macro}): a Symbol or String literal argument. A
+      # non-literal one (`attr_writer(*names)`, `send(:attr_writer, name)`) names nothing Rigor can read.
       def each_attr_macro_name(call_node)
-        return unless call_node.receiver.nil? # only the implicit-self macro defines on the lexical class
-        return if call_node.arguments.nil?
+        return if attr_macro(call_node).nil? || call_node.arguments.nil?
 
-        call_node.arguments.arguments.each do |arg|
+        arguments = call_node.arguments.arguments
+        arguments = arguments.drop(1) if SURFACE_SEND_CALLS.include?(call_node.name)
+        arguments.each do |arg|
           base = literal_method_name(arg)
           yield base unless base.nil?
         end
       end
 
+      # Issue #2097 — the {ATTR_MACROS} entry a call declares members with on the lexical class, or nil. The
+      # call is on the body's self, implicitly or as `self.` (`self.attr_accessor :x`), and names the macro
+      # directly or as the literal first argument of `send` / `public_send` / `__send__`
+      # (`send(:attr_accessor, :x)`); the same spellings `SigGen::Generator#attr_writer_names` reads. Any
+      # other receiver defines on another object.
+      def attr_macro(call_node)
+        return nil unless call_node.is_a?(Prism::CallNode)
+        return nil unless call_node.receiver.nil? || call_node.receiver.is_a?(Prism::SelfNode)
+        return call_node.name if ATTR_MACROS.include?(call_node.name)
+        return nil unless SURFACE_SEND_CALLS.include?(call_node.name)
+
+        macro = literal_method_name(call_node.arguments&.arguments&.first)
+        macro if ATTR_MACROS.include?(macro)
+      end
+
       # Issue #736 — the module-level accessor macros, which introduce methods on BOTH sides of the class.
       # ActiveSupport defines them on `Module`, so every class and module body can use them, and Rails codebases
       # do: `mattr_accessor` / `cattr_accessor` (an alias of it) and `class_attribute` account for 92 false
@@ -8351,12 +9153,14 @@ module Rigor
       # {#discovered_project_index_incremental}'s changed-file branch) yields the live def nodes the signature
       # reads their parameter structure from. Issue #1120 — and each file's own refinement table, which the merged
       # def-index cannot attribute back to a file, so the session can diff it against the file's seed bundle.
-      # @return `{ def_index:, code_fingerprints:, declaration_signatures:, refinements: }`.
+      # Issue #1459 — and each file's {#defined_method_names}, diffed the same way.
+      # @return `{ def_index:, code_fingerprints:, declaration_signatures:, refinements:, defined_method_names: }`.
       def scan_summary_for_paths(paths, buffer: nil)
         acc = new_def_index_accumulator
         code_fingerprints = {}
         declaration_signatures = {}
         refinements = {}
+        defined_method_names = {}
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           source = File.read(physical)
@@ -8366,13 +9170,29 @@ module Rigor
           code_fingerprints[path] = code_fingerprint(source, parsed.comments)
           declaration_signatures[path] = declaration_signature(file_index)
           refinements[path] = file_index[:refinements] if file_index[:refinements]
+          defined_method_names[path] = defined_method_names(file_index)
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
           next
         end
         { def_index: finalize_def_index(acc), code_fingerprints: code_fingerprints,
-          declaration_signatures: declaration_signatures, refinements: refinements }
+          declaration_signatures: declaration_signatures, refinements: refinements,
+          defined_method_names: defined_method_names }
+      end
+
+      # Issue #1459 — every method name one file's index defines, on any class or module and either side: the keys of
+      # `methods` (which also carries an `attr_*`, `alias` or `define_method` name) and of the instance and singleton
+      # def-node tables. A single file's `methods` already holds its `def` names, since `subtract_def_methods` runs only
+      # on the merged accumulator; the def-node tables are read as well so the census reads exactly the tables
+      # `BlockCallTiming.project_defines_anywhere?` reads. Takes a live file index or a seed bundle, which hold the
+      # same three keys.
+      def defined_method_names(file_index)
+        names = Set.new
+        %i[methods def_nodes singleton_def_nodes].each do |key|
+          file_index[key]&.each_value { |table| names.merge(table.keys) }
+        end
+        names.freeze
       end
 
       # ADR-89 WD1 — a per-file digest of every cross-file DECLARATION surface an ancestry / file-level
@@ -8748,7 +9568,7 @@ module Rigor
             when :contested_discovered_singleton_def_nodes
               fold_slot_contests(target.fetch(name), singleton_def_nodes, table)
             when :contested_discovered_method_visibilities
-              fold_slot_contests(target.fetch(name), method_visibilities, table)
+              fold_visibility_contests(target.fetch(name), acc[:method_visibilities], method_visibilities, table)
             else union_sibling_value(target.fetch(name), table)
             end
         end
@@ -8821,6 +9641,30 @@ module Rigor
         result.merge(file_contested)
       end
 
+      # The visibility table's {#fold_slot_contests}, where `recorded` is the table the file folds into as it stood.
+      # Issue #1984 — a singleton slot (`[:singleton, name]`) does not follow its writer: file order is not load
+      # order, so two files that give it different visibilities (`private_class_method :x` here,
+      # `class << self; public :x; end` in a reopening) leave it contested, and a contest on it stays whichever
+      # file folds later. The instance slots fold as before.
+      def fold_visibility_contests(sitting, recorded, file_slots, file_contested)
+        stale = sitting.select { |class_name, name| !name.is_a?(Array) && file_slots[class_name]&.key?(name) }
+        disagreeing = singleton_visibility_disagreements(recorded, file_slots)
+        return sitting if stale.empty? && file_contested.empty? && disagreeing.empty?
+
+        (sitting - stale).merge(file_contested).merge(disagreeing)
+      end
+
+      def singleton_visibility_disagreements(recorded, file_slots)
+        file_slots.flat_map do |class_name, table|
+          sitting = recorded[class_name]
+          next [] if sitting.nil?
+
+          table.filter_map do |slot, visibility|
+            [class_name, slot] if slot.is_a?(Array) && sitting.key?(slot) && sitting[slot] != visibility
+          end
+        end
+      end
+
       def union_paths(sitting, arriving)
         return sitting if arriving.empty?
         return arriving if sitting.empty?
@@ -9324,8 +10168,9 @@ module Rigor
       def merge_class_keyed_index_tables(acc, root, file_methods, certainty)
         file_visibilities, file_contested = build_method_visibility_tables(root, certainty: certainty)
         siblings = acc[:siblings]
-        siblings[:contested_discovered_method_visibilities] = fold_slot_contests(
-          siblings[:contested_discovered_method_visibilities], file_visibilities, file_contested
+        siblings[:contested_discovered_method_visibilities] = fold_visibility_contests(
+          siblings[:contested_discovered_method_visibilities], acc[:method_visibilities], file_visibilities,
+          file_contested
         )
         file_visibilities.each do |class_name, table|
           (acc[:method_visibilities][class_name] ||= {}).merge!(table)
@@ -10589,8 +11434,15 @@ module Rigor
 
       # Issue #1717 — a `def` / `class` / `module` body opens its own `self`, so an enclosing unentered block's
       # unknown-`self` mark ({Scope#block_self_unknown?}) stops at it, as the evaluator's fresh body scope does.
-      # Every other node hands its children the scope as is.
+      # A `case` narrows its clauses ({#propagate_subjectless_case}, {#propagate_subject_case}). Every other node
+      # hands its children the scope as is.
       def propagate_children(node, table, current_scope)
+        if node.is_a?(Prism::CaseNode) || node.is_a?(Prism::CaseMatchNode)
+          return propagate_subjectless_case(node, table, current_scope) if node.predicate.nil?
+
+          return propagate_subject_case(node, table, current_scope)
+        end
+
         child_scope =
           SELF_OPENING_BODIES.include?(node.class) ? current_scope.with_block_self_unknown(false) : current_scope
         node.rigor_each_child { |child| propagate(child, table, child_scope) }
@@ -10783,19 +11635,106 @@ module Rigor
         scope.local(name).nil? ? scope : scope.with_local(name, Type::Combinator.untyped)
       end
 
+      # Issue #1924 — an `if` / `elsif` / `unless` / ternary the evaluator did not enter (`[if (x ||= "d").empty?
+      # then 0 else x.upcase end]`) applies no write its condition makes, so its edges are taken from a scope where
+      # every bound local the condition writes reads `Dynamic[top]` ({#widen_condition_writes}), as
+      # {#propagate_subjectless_case} takes a `when` condition's. The condition itself reads the scope before it.
       def propagate_if_branches(node, table, current_scope)
-        truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, current_scope)
+        truthy_scope, falsey_scope = conditional_edges(node.predicate, current_scope)
         propagate(node.predicate, table, current_scope) if node.predicate
         propagate(node.statements, table, truthy_scope) if node.statements
         propagate(node.subsequent, table, falsey_scope) if node.subsequent
       end
 
       def propagate_unless_branches(node, table, current_scope)
-        truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, current_scope)
+        truthy_scope, falsey_scope = conditional_edges(node.predicate, current_scope)
         propagate(node.predicate, table, current_scope) if node.predicate
         propagate(node.statements, table, falsey_scope) if node.statements
         propagate(node.else_clause, table, truthy_scope) if node.else_clause
       end
+
+      def conditional_edges(predicate, scope)
+        Narrowing.predicate_scopes(predicate, widen_condition_writes(predicate, scope))
+      end
+
+      # Issue #1495 — a `case` without a subject the evaluator did not enter (`[case; when x.nil? then 0; else x.size
+      # end]`) narrows by its conditions' edges, as {StatementEvaluator#subjectless_when_scopes} does: each condition
+      # under the falsey edges of the conditions before it, each clause under the join of its conditions' truthy edges,
+      # and the `else` under the last falsey edge. Like the walk of an `if`, it applies no write a condition makes, so
+      # the edges are taken from a scope where every bound local the condition writes reads `Dynamic[top]`
+      # ({#widen_condition_writes}): neither the local's old type nor an earlier condition's narrowing of it reaches
+      # them, as `when (x = s ? String(s) : nil) then x.upcase` after `x = 1` would.
+      def propagate_subjectless_case(node, table, current_scope)
+        falsey = current_scope
+        node.conditions.each do |when_node|
+          truthy_edges = when_node.conditions.map do |condition|
+            propagate(condition, table, falsey)
+            truthy, falsey = Narrowing.predicate_scopes(condition, widen_condition_writes(condition, falsey))
+            truthy
+          end
+          propagate(when_node, table, truthy_edges.reduce(:join))
+        end
+        propagate(node.else_clause, table, falsey) if node.else_clause
+      end
+
+      # Issue #1484 — a `case` with a subject the evaluator did not enter (`[case io when StringIO then io.string
+      # end]`, `[case io in StringIO then io.string else nil end]`) narrows each clause as the evaluator does
+      # ({Narrowing.case_clause_scopes}): the body under the clause's narrowed edge, the next clause and the `else`
+      # under its falsey edge. The walk applies no write the subject, a `when` condition or an `in` pattern makes, so
+      # every bound local one of them writes reads `Dynamic[top]` from that point on ({#widen_condition_writes}).
+      # Nor does it run the evaluator's per-clause `LastLine.forget_if_set`: the statement holding the `case`
+      # already forgets a `$_` any of its tests may set. A clause's tests are recorded under the scope the earlier
+      # clauses' falsey edges left, where the evaluator's `when` tests read the post-subject scope: a test reading
+      # the subject sees what the earlier clauses ruled out (`when NilClass then 0 when v.succ`).
+      #
+      # A test that calls a method may rebind an instance-variable or global subject before the body reads it
+      # (`when String then 1 when reset! then @x.upcase`, where `reset!` writes `@x`), and the walk cannot tell. From
+      # the first such test on, the subject reads `Dynamic[top]` on both edges ({#forget_called_subject}). The
+      # evaluator keeps the narrowing there (a separate defect); the walk declines it rather than add a report.
+      def propagate_subject_case(node, table, current_scope)
+        subject = node.predicate
+        propagate(subject, table, current_scope)
+        falsey = widen_condition_writes(subject, current_scope)
+        called = false
+        node.conditions.each do |clause|
+          tests = clause.is_a?(Prism::WhenNode) ? clause.conditions : [clause.pattern]
+          tests.each { |test| propagate(test, table, falsey) }
+          falsey = tests.reduce(falsey) { |acc, test| widen_condition_writes(test, acc) }
+          called ||= tests.any? { |test| runs_call?(test) }
+          body, falsey = Narrowing.case_clause_scopes(subject, clause, falsey)
+          body, falsey = [body, falsey].map { |scope| forget_called_subject(subject, scope) } if called
+          propagate(clause, table, body)
+        end
+        propagate(node.else_clause, table, falsey) if node.else_clause
+      end
+
+      CODE_RUNNING_NODES = [Prism::CallNode, Prism::SuperNode, Prism::ForwardingSuperNode, Prism::YieldNode].freeze
+      private_constant :CODE_RUNNING_NODES
+
+      # Whether `node` holds a method call, `super` or `yield` anywhere, a lambda body's included.
+      def runs_call?(node)
+        return false unless node.is_a?(Prism::Node)
+        return true if CODE_RUNNING_NODES.include?(node.class)
+
+        node.rigor_each_child { |child| return true if runs_call?(child) }
+        false
+      end
+
+      # `scope` with an instance-variable or global `subject` rebound to `Dynamic[top]`; any other subject as is.
+      def forget_called_subject(subject, scope)
+        case subject
+        when Prism::InstanceVariableReadNode then scope.with_ivar(subject.name, Type::Combinator.untyped)
+        when Prism::GlobalVariableReadNode then scope.with_global(subject.name, Type::Combinator.untyped)
+        else scope
+        end
+      end
+
+      # `scope` with every bound local `condition` writes rebound to `Dynamic[top]`.
+      def widen_condition_writes(condition, scope)
+        OperandEffects.written_variables(condition).reduce(scope) do |acc, name|
+          acc.local(name) ? acc.with_local(name, Type::Combinator.untyped) : acc
+        end
+      end
     end
   end
 end