rigortype 0.4.3 → 0.4.5

data/lib/rigor/plugin/io_boundary.rb

@@ -3,6 +3,7 @@
 require "digest"
 
 require_relative "access_denied_error"
+require_relative "../rooted_glob"
 
 module Rigor
   module Plugin
@@ -33,6 +34,8 @@ module Rigor
     #   for a plugin that asks "which of these N candidate files exists here?" — rigor-actionpack tries
     #   nine template extensions per `render` call — where N per-path probe rows would put thousands of
     #   validations on every warm run and one listing row puts one per directory.
+    # - `#list_directory_kinds(path)` — the KIND-aware listing (#1959): each entry with its `lstat` kind, and one
+    #   `:kinds` row that moves when an entry appears, vanishes or changes kind under the same name.
     # - `#open_url(url)` — fetches the URL when the policy permits it (`network_policy: :allowlist` plus an
     #   `allowed_url_hosts` match) and raises {AccessDeniedError} otherwise. v0.1.2 ships the allowlist
     #   surface; the default project policy still has `network_policy: :disabled` so plugins that want network
@@ -189,7 +192,7 @@ module Rigor
       # @return the absolute paths directly under `path` in `Dir.glob` order; empty when not a directory
       def list_directory(path)
         absolute = File.absolute_path(path.to_s)
-        entries = Dir.glob(File.join(absolute, "*"))
+        entries = RootedGlob.glob(absolute, "*")
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
           return entries
@@ -199,6 +202,34 @@ module Rigor
         entries
       end
 
+      # Issue #1959 — the KIND-aware listing. Returns each entry directly under `path` with what it is, a symlink
+      # not followed ({Cache::Descriptor::GlobEntry.lstat_kind}: `:file`, `:directory`, `:symlink` or `:other`, and
+      # `:absent` for an entry that vanished between the listing and its `lstat`),
+      # and records one `:kinds` {Cache::Descriptor::GlobEntry} over `path/*`. The row reads stale when an entry
+      # appears, disappears, or keeps its name and changes kind; NOT when an entry's bytes or stat tuple move, nor
+      # when anything below a subdirectory changes. It is the row for a walk that decides per top-level entry
+      # whether to descend: rigor-ffi skips `vendor/` and does not follow a symlinked directory, so a file `gen`
+      # replaced by a directory `gen/`, or a symlink replaced by a real directory, changes what it reads while
+      # every name stays put. {#list_directory}'s `:stat` row leaves directories out, and {#glob}'s `:names` row
+      # reads names alone.
+      #
+      # Like {#list_directory}, dot entries are not listed, and an out-of-policy directory is listed truthfully
+      # and contributes no row.
+      #
+      # @param path — project directory; relative paths expand against the working directory
+      # @return a Hash from each absolute entry path, in `Dir.glob` order, to its kind; empty when not a directory
+      def list_directory_kinds(path)
+        absolute = File.absolute_path(path.to_s)
+        entries = RootedGlob.glob(absolute, "*").to_h { |entry| [entry, Cache::Descriptor::GlobEntry.lstat_kind(entry)] }
+        unless @policy.allow_read?(absolute)
+          record_refusal(absolute)
+          return entries
+        end
+
+        record_glob_entry(absolute, "*", mode: :kinds)
+        entries
+      end
+
       # Issue #1652 — the MEMBERSHIP fingerprint of a `Dir.glob` pattern under `root`, `**` included. Returns the
       # matching paths and records one `:names` {Cache::Descriptor::GlobEntry} over `root` and `pattern`: the row
       # reads stale when a match appears or disappears, in a subdirectory created after the read too, and NOT
@@ -209,8 +240,13 @@ module Rigor
       #
       # The pattern must stay under `root`, since the policy is checked against `root` alone: a `..` segment, a
       # brace (`{..,x}`) or a backslash escape (`.\\./`) raises {AccessDeniedError} (`:read_outside_scope`).
-      # The last two are refused outright because `Dir.glob` can spell `..` with them. Out of policy, `root` is
-      # globbed truthfully and contributes no row, as in {#list_directory}.
+      # The last two are refused outright because `Dir.glob` can spell `..` with them. A leading `/` is read under
+      # `root`, as the joined spelling always read it (`/lib/**/*.rb` is `root/lib/**/*.rb`). Out of policy, `root`
+      # is globbed truthfully and contributes no row, as in {#list_directory}.
+      #
+      # `root` is read literally (#1959): {RootedGlob} escapes its glob metacharacters before the join, so a root
+      # spelled `fx[1]` or a directory named `{..,zz}` neither matches a sibling nor leaves itself.
+      # {#list_directory} lists the same way, and {Cache::Descriptor::GlobEntry} re-globs the row the same way.
       #
       # @param root — project directory; relative paths expand against the working directory
       # @param pattern — a `Dir.glob` pattern relative to `root`, such as `"ext/**/extconf.rb"`
@@ -227,7 +263,7 @@ module Rigor
           )
         end
 
-        entries = Dir.glob(File.join(absolute, pattern))
+        entries = RootedGlob.glob(absolute, pattern)
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
           return entries
@@ -390,8 +426,8 @@ module Rigor
         self.class.attribute(entry)
       end
 
-      # ADR-45 WD1c (#629) — the listing row for {#list_directory} (and the `:names` row for {#glob}),
-      # deduplicated per (root, pattern, mode) slot.
+      # ADR-45 WD1c (#629) — the listing row for {#list_directory} (and the `:names` row for {#glob} and the
+      # `:kinds` row for {#list_directory_kinds}), deduplicated per (root, pattern, mode) slot.
       # Recomputed on each call rather than `||=`d, so a directory listed again after a mid-run mutation
       # carries the signature of the state the LAST reader saw.
       def record_glob_entry(root, pattern, mode: :stat)

data/lib/rigor/plugin/isolation.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "box"
+require_relative "../rooted_glob"
 
 module Rigor
   module Plugin
@@ -74,8 +75,8 @@ module Rigor
       # requiring the gem, which is what the caller is about to do.
       def bundle_require_paths(bundle_root)
         bundle_gem_dirs(bundle_root).flat_map do |gem_home|
-          specs = Dir.glob(File.join(gem_home, "specifications", "*.gemspec"))
-                     .filter_map { |file| Gem::Specification.load(file) }
+          specs = RootedGlob.glob(gem_home, "specifications/*.gemspec")
+                            .filter_map { |file| Gem::Specification.load(file) }
           specs.group_by(&:name)
                .flat_map { |_, versions| versions.max_by(&:version).full_require_paths }
         end
@@ -88,7 +89,7 @@ module Rigor
         return [] if bundle_root.nil? || bundle_root.to_s.empty?
 
         root = bundle_root.to_s
-        (Dir.glob(File.join(root, "ruby", "*")) + [root])
+        (RootedGlob.glob(root, "ruby/*") + [root])
           .select { |dir| File.directory?(File.join(dir, "specifications")) }
       end
 

data/lib/rigor/project_environment.rb

@@ -56,9 +56,12 @@ module Rigor
     #   `source_rbs_synthesizer` runs over them at env-build time; an empty list contributes no synthesized RBS.
     # @param feature_sources — path => source text the required-feature scan reads in place of that file (an
     #   editor buffer bound with `--tmp-file` / `--instead-of`).
-    # @param project_patched_methods — the `pre_eval:` registry (see {.project_patched_methods}); nil keeps
-    #   the unpatched universe.
-    def build(configuration:, source_files:, feature_sources: {}, project_patched_methods: nil)
+    # @param project_patched_methods — the `pre_eval:` registry. Defaults to the configuration's own (see
+    #   {.project_patched_methods}), so every probe command (`type-scan`, `trace`, `annotate`, `sig-gen`) types a
+    #   patched method as `rigor check` does (issue #1895); `type-of` passes its buffer-aware one. An explicit
+    #   nil keeps the unpatched universe.
+    def build(configuration:, source_files:, feature_sources: {},
+              project_patched_methods: ProjectEnvironment.project_patched_methods(configuration))
       features = required_features(configuration, source_files, sources: feature_sources)
       Environment.for_project(
         project_patched_methods: project_patched_methods,

data/lib/rigor/protection/discovery_seed.rb

@@ -2,6 +2,7 @@
 
 require_relative "../inference/parameter_inference_collector"
 require_relative "../inference/scope_indexer"
+require_relative "../inference/project_seed_tables"
 
 module Rigor
   module Protection
@@ -80,47 +81,19 @@ module Rigor
         seed_tables(index).freeze
       end
 
-      # The whole-project discovery tables, from the single-walk combined pass (one parse per file, both
-      # collectors driven over the same tree) that {Analysis::Runner::ProjectPrePasses#discover} uses. Empty
-      # tables are dropped so an empty seed stays `{}` and every consumer's "seed nothing" branch keeps working.
-      #
-      # `discovered_class_sources` is carried as the runner carries it on every run: Tier 2 never records edges,
-      # but an ancestor-order reader asks whether a class is declared in more than one file. The mixin tables
-      # (`discovered_includes`, `discovered_prepends`, `discovered_extends`) ride the same fold, so a singleton
-      # `extend` reads the same from a per-file scope under coverage and protection as it does under `check`.
+      # The whole-project discovery tables, from the single-walk combined pass (one parse per file) that
+      # {Analysis::Runner::ProjectPrePasses#discover} uses, mapped by the one list {Inference::ProjectSeedTables}
+      # keeps (issue #1614). Empty tables are dropped so an empty seed stays `{}` and every consumer's "seed nothing"
+      # branch keeps working.
       def discovery_tables(paths)
         seed_tables(Inference::ScopeIndexer.discovered_project_index_for_paths(paths))
       end
 
-      # Maps a `{ classes:, def_index: }` discovery index onto the {Scope::DiscoveryIndex} slot names both
-      # consumers take. Shared by the whole-walk ({#discovery_tables}) and bundle-fold ({#tables_for_buffer})
-      # producers so a mutant's seed and the parent's seed can never disagree about shape.
+      # Maps a `{ classes:, def_index: }` discovery index onto the {Scope::DiscoveryIndex} slot names both consumers
+      # take. Shared by the whole-walk ({#discovery_tables}) and bundle-fold ({#tables_for_buffer}) producers so a
+      # mutant's seed and the parent's seed can never disagree about shape.
       def seed_tables(index)
-        def_index = index.fetch(:def_index)
-        tables = { discovered_classes: index.fetch(:classes) }
-        %i[
-          def_nodes def_nestings singleton_def_nodes def_sources singleton_def_sources superclasses includes
-          extends prepends unpositioned_mixins class_sources
-          method_visibilities methods parameter_envelopes data_member_layouts struct_member_layouts
-          deferred_ranges refinements global_write_census
-        ].each do |slot|
-          tables[seed_key(slot)] = def_index.fetch(slot)
-        end
-        # ADR-119 WD1 — the pairs travel as one: an unpaired empty table is dropped here, a pair only when both
-        # halves are empty (`compact_pairs`), so a non-empty sibling is never stranded by an empty member.
-        tables.merge!(def_index.fetch(:siblings))
-        Scope::DiscoveryIndex.compact_pairs(
-          tables.reject { |name, table| !Scope::DiscoveryIndex.paired?(name) && (table.nil? || table.empty?) }
-        )
-      end
-
-      UNPREFIXED_SLOTS = %i[data_member_layouts struct_member_layouts unpositioned_mixins].freeze
-      private_constant :UNPREFIXED_SLOTS
-
-      # The def-index slot names match the {Scope::DiscoveryIndex} ones under a `discovered_` prefix, except the
-      # two member-layout tables and the unpositioned-mixin table, which carry the same name on both sides.
-      def seed_key(slot)
-        UNPREFIXED_SLOTS.include?(slot) ? slot : :"discovered_#{slot}"
+        Inference::ProjectSeedTables.from_index(index)
       end
     end
   end

data/lib/rigor/protection/mutation_cache.rb

@@ -209,7 +209,13 @@ module Rigor
         def table_digest(project_scan)
           payload = {
             "synthetic" => project_scan.synthetic_method_index.to_h,
-            "patched" => patched_rows(project_scan.project_patched_methods)
+            "patched" => patched_rows(project_scan.project_patched_methods),
+            "patched_mixins" => project_scan.project_patched_methods.mixins.map do |mixin|
+              mixin.to_h.values.map(&:to_s)
+            end,
+            "patched_overrides" => project_scan.project_patched_methods.overrides.map do |key, visibility|
+              [*key, visibility].map(&:to_s)
+            end
           }
           Digest::SHA256.hexdigest(JSON.generate(payload))
         rescue StandardError
@@ -221,7 +227,7 @@ module Rigor
         def patched_rows(patched)
           patched.by_key.map do |(class_name, method_name, kind), entry|
             [class_name.to_s, method_name.to_s, kind.to_s, entry.source_path.to_s, entry.source_line,
-             entry.return_type&.describe(:short).to_s, entry.alias_of.to_s]
+             entry.return_type&.describe(:short).to_s, entry.alias_of.to_s, entry.visibility.to_s]
           end.sort
         end
 

data/lib/rigor/rooted_glob.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Rigor
+  # `Dir.glob(File.join(root, pattern))` with `root` read as a literal path (#1956, #1959).
+  #
+  # Joining a directory into the pattern makes `Dir.glob` read the directory's own characters as glob syntax:
+  # a project at `ds [x]` or `ds{a}` matches nothing, `ds*` matches its siblings, `fx[1]` matches `fx1`, and
+  # a directory literally named `{..,zz}` expands into the parent tree. Each glob metacharacter of `root` is
+  # backslash-escaped before the join, so `root` matches only itself while `pattern` keeps exactly the meaning the
+  # joined spelling gave it: a leading `/` collapses into the join (`/etc/*` reads `root/etc/*`), and so does one
+  # inside a brace alternative (`{/etc,lib}/*` reads `root/etc/*` and `root/lib/*`). `Dir.glob(pattern, base:)`
+  # would not do that: it reads an absolute pattern, or an absolute alternative, outside `base`. A root without
+  # metacharacters is joined unchanged, so the results are the joined glob's strings in its order, `root` kept as
+  # given (relative, symlinked or with a trailing `/`).
+  module RootedGlob
+    METACHARACTERS = /[\[\]{}*?\\]/
+
+    module_function
+
+    # @param root — a directory path (String or Pathname), taken literally
+    # @param pattern — a `Dir.glob` pattern relative to `root`
+    # @return the matches spelled under `root`, in `Dir.glob` order; empty when `root` is not a directory
+    def glob(root, pattern)
+      Dir.glob(File.join(root.to_s.gsub(METACHARACTERS, "\\\\\\0"), pattern.to_s))
+    end
+  end
+end

data/lib/rigor/scope/discovery_index.rb

@@ -231,6 +231,11 @@ module Rigor
       # (the meta-new walk does not route `Parent` through ancestor discovery), so a reader that must place `K` in a
       # hierarchy reads its superclass as unknown, as it reads the `nil` the table records for `class K < <expr>`.
       ENVELOPE_META_SUPERCLASS_MARK = :"<meta-superclass>"
+      # Issue #1979 — the kind of a `[ENVELOPE_CONSTRUCTED_KIND, constant_name]` bucket entry: `class K < <expr>` whose
+      # superclass expression is a core constructor call (`Data.define(...)`, `Struct.new(...)`, `Class.new(...)`)
+      # naming that constant, as the receiver or as `Class.new`'s single bare-constant argument (`Object` for none).
+      # Read only by the #1596 proof's subclass walk (`RefinedDispatch::OwnMethod.each_subclass`).
+      ENVELOPE_CONSTRUCTED_KIND = :constructed_from
       ENVELOPE_MODULE_MARK = :"<module>"
       ENVELOPE_DYNAMIC_MARK = :"<dynamic>"
       ENVELOPE_OBJECT_EXTENDED_MARK = :"<object-extended>"

data/lib/rigor/scope/resolution_chain/relevance.rb

@@ -84,6 +84,20 @@ module Rigor
           false
         end
 
+        # {.external_lacks?} on the side an entry stands for: an external superclass on a singleton chain
+        # (`:singleton`, its whole tail) is asked for a singleton method, an extended module (`:instance`) and every
+        # instance-side entry for an instance method.
+        def external_lacks_on?(scope, candidates, side, name)
+          return external_lacks?(scope, candidates, name) if side == :instance
+
+          known = candidates.find { |candidate| Rigor::Reflection.rbs_class_known?(candidate, scope: scope) }
+          return false if known.nil?
+
+          Rigor::Reflection.singleton_method_definition(known, name, scope: scope).nil?
+        rescue StandardError
+          false
+        end
+
         # One verdict's working state: the scope, the resolver, and the edges the tests read.
         class Context
           attr_reader :mark, :edges

data/lib/rigor/scope/resolution_chain.rb

@@ -300,17 +300,24 @@ module Rigor
       # `Kernel` or `Enumerable` on any reopening. So each candidate name files the negative method edge of every
       # {Relevance::HOOKS} name on its singleton side (`method:Comparable.included`, the key a new `def
       # self.included` satisfies); a file adding any other method to the module re-checks nothing, and once the
-      # module is declared its sites carry later edits and the removal. The edges are a function of the chain alone,
-      # so a consumer files them once per chain ({Analysis::DependencyRecorder.file_chain_once}, #1590). A hook
-      # written another way — an instance `def included` in a module extended onto the external, a
-      # `define_singleton_method(:included)` — satisfies no such key and is not seen.
+      # module is declared its sites carry later edits and the removal. #1661 — each name also files `mixin:<name>`,
+      # which `IncrementalSession#mark_affected` fires when the module's unpositioned mixin edges move: a new file
+      # that taints it (`module Comparable; include(*MODS); end`) without a hook. The key is the qualified candidate,
+      # the spelling the chain resolves a project entry by. The unpositioned table may key the owner by a relative
+      # spelling (`Constants` inside `class File`), so the producer also fires every recorded `mixin:` key ending in
+      # `::<owner>` (`IncrementalSession#mixin_keys`); a taint on a project `Foo::Base` still re-checks no reader of
+      # an external `Lib::Base`. An ambiguous spelling has no candidate and files none: no project module can resolve
+      # it, so no taint can mark it. The edges are a function of the chain alone, so a consumer files them once per
+      # chain ({Analysis::DependencyRecorder.file_chain_once}, #1590). A hook written another way — an instance `def
+      # included` in a module extended onto the external, a `define_singleton_method(:included)` — satisfies no such
+      # key and is not seen.
       def record_hooks(scope)
         externals = (@memo[:externals] ||= @entries.select(&:external?).freeze)
         return if externals.empty?
 
         Analysis::DependencyRecorder.file_chain_once(self, :hooks, scope.discovery) do
           externals.each do |entry|
-            entry.candidates.each { |name| Analysis::DependencyRecorder.read_keys(ResolutionChain.hook_keys(name)) }
+            entry.candidates.each { |name| Analysis::DependencyRecorder.read_keys(ResolutionChain.external_keys(name)) }
           end
         end
       end
@@ -393,12 +400,18 @@ module Rigor
       end
 
       @hook_keys = {}
+      @external_keys = {}
 
       # The frozen `method:Name.hook` negative keys of `name`'s {Relevance::HOOKS}, built once per name.
       def self.hook_keys(name)
         @hook_keys[name] ||= Relevance::HOOKS.map { |hook| "method:#{name}.#{hook}".freeze }.freeze
       end
 
+      # {hook_keys} plus the `mixin:<name>` key an external entry files for its unpositioned mixins (#1661).
+      def self.external_keys(name)
+        @external_keys[name] ||= (hook_keys(name) + ["mixin:#{name}".freeze]).freeze
+      end
+
       def record_head(scope, start, side)
         ResolutionChain.record_class(scope, @root) unless start.zero? && @entries.first&.name == @root
         start.times { |index| ResolutionChain.record_entry(scope, @entries[index], side) }
@@ -440,6 +453,28 @@ module Rigor
         @entries[@level_starts[index]...finish]
       end
 
+      # Issue #1624 — whether the chain's last class has a superclass the tables cannot name, so ancestors the chain
+      # does not list follow it where a chain otherwise ends in the implicit `Object`: a superclass written as an
+      # expression (`class K < Struct.new(:a)`, `< Data.define(:a)`, `< Class.new(Base)`, `< pick_base`), which the
+      # superclass table records as `nil`, or a class a constant write creates (`K = Class.new(Base)`,
+      # `K = Struct.new(:a)`, `K = Data.define(:a)`), which has no superclass entry. The constructor's methods
+      # (`members`, the member readers, a block's `def`s) and everything it inherits live in that unlisted part.
+      # Every fact read here is filed under the last class's class edge, which a read reaching the tail has passed.
+      def opaque_tail?(scope)
+        @memo.fetch(:opaque_tail) do
+          last = level_count.positive? ? @level_classes[level_count - 1] : nil
+          @memo[:opaque_tail] = !last.nil? && ResolutionChain.opaque_superclass?(scope, last)
+        end
+      end
+
+      def self.opaque_superclass?(scope, name)
+        superclasses = scope.discovery.discovered_superclasses
+        return superclasses[name].nil? if superclasses.key?(name)
+
+        scope.discovery.discovered_parameter_envelopes[name]&.key?(DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK) ||
+          !(scope.struct_member_layout(name) || scope.data_member_layout(name)).nil?
+      end
+
       # Each complete level up to the first superclass the project does not declare, as `[class_name,
       # modules, externals]`: the level's class, the project modules around it (each once), and the candidate
       # lists of the ancestors in it the project does not declare — the shape `call.wrong-arity` reads.

data/lib/rigor/scope.rb

@@ -876,13 +876,18 @@ module Rigor
     STDOUT_ALIASES = { :$stdout => :$>, :$> => :$stdout }.freeze
     private_constant :STDOUT_ALIASES
 
-    # Issue #1429 — {#forget_guard_narrowings} for the one name `[kind, name]`.
+    # Issue #1429 — {#forget_guard_narrowings} for the one name `[kind, name]`. Issue #1596 — an `:ivar` kind too,
+    # for a self-call proven to write only some instance variables.
     def forget_guard_narrowing_of(kind, name)
       key = [kind, name]
       pre_guard = @guard_records[key]
       return self if pre_guard.nil?
 
-      if kind == :global
+      if kind == :ivar
+        current = @ivars[name]
+        ivars = current ? @ivars.merge(name => Type::Combinator.union(pre_guard, current)).freeze : @ivars
+        rebuild(ivars: ivars, guard_records: @guard_records.except(key).freeze)
+      elsif kind == :global
         current = @globals[name]
         globals = current ? @globals.merge(name => Type::Combinator.union(pre_guard, current)).freeze : @globals
         rebuild(globals: globals, guard_records: @guard_records.except(key).freeze)
@@ -1208,13 +1213,28 @@ module Rigor
     # wrong-arity rules consult this map to suppress diagnostics for methods the user has defined dynamically,
     # even when no RBS sig describes them.
     # A name defined on both sides of one class records {DiscoveryIndex::METHOD_KIND_BOTH} and matches either kind.
+    #
+    # Issue #2121 — a hit is an ADR-46 read. The table carries what no `def` symbol edge covers — an `attr_*`, an
+    # `alias` or a `define_method` (a cross-file `def` is withheld from it) — so an answer that read a hit records
+    # the class edge to the files declaring `class_name` and the name edge `defines:<method_name>`: deleting the
+    # `attr_accessor` re-checks the caller it silenced, whether or not the deleting file declares the class. A miss
+    # records nothing here; the readers that act on one record their own negative edges.
     def discovered_method?(class_name, method_name, kind)
       table = @discovery.discovered_methods[class_name.to_s]
       return false unless table
 
       recorded = table[method_name.to_sym]
-      recorded == kind || recorded == DiscoveryIndex::METHOD_KIND_BOTH
+      return false unless recorded == kind || recorded == DiscoveryIndex::METHOD_KIND_BOTH
+
+      record_discovered_method(class_name, method_name) if Analysis::DependencyRecorder.active?
+      true
+    end
+
+    def record_discovered_method(class_name, method_name)
+      record_class_dependency(class_name)
+      Analysis::DependencyRecorder.read_name(:defines, method_name)
     end
+    private :record_discovered_method
 
     # ADR-34 § "Decision" — predicate identifying a toplevel-shaped scope (no enclosing `class` / `module` body).
     # True at the top of a file AND inside a top-level `def` body (since toplevel defs leave `self_type` nil per
@@ -1405,6 +1425,27 @@ module Rigor
                         call_node)
     end
 
+    # Issue #1569 — whether `def_node`, written in this file, is a module function of `class_name`: a `:both`
+    # deferred-range row over the def (a bare `module_function` before it, or `module_function def x`;
+    # `ModuleFunctionState.prescan_deferred`), or a `:singleton` row for the name after the def
+    # (`module_function :x`) whose singleton copy is this def (`ModuleFunctionState.each_singleton_copy`).
+    def module_function_def?(class_name, def_node)
+      path = source_path
+      return false if path.nil?
+
+      ranges = discovered_deferred_ranges[path]
+      return false if ranges.nil?
+
+      start = def_node.location.start_offset
+      ranges.any? do |(row_start, _finish, name, kind, owner)|
+        next false unless name == def_node.name && owner == class_name.to_s
+
+        (kind == :both && row_start == start) ||
+          (kind == :singleton && row_start > start &&
+           singleton_def_for(class_name, name)&.location&.start_offset == start)
+      end
+    end
+
     # Shared ordering half of the two `*_def_shadows_call?` predicates, over this file's
     # `discovered_deferred_ranges` (issue #1097). `exists` — a recorded `"path:line"` site or the
     # method-existence table — says a def of `method_name`/`kind` on `class_name` is known at all; a
@@ -1912,8 +1953,15 @@ module Rigor
     # Issue #992 — one class's `discovered_parameter_envelopes` bucket (`{[kind, method_name] => envelope}` plus
     # the class-wide marks), or an empty Hash. Records the ADR-46 class edge first: a verdict read off the
     # bucket depends on every file that declares the class, and a `memoize :f` added to one of them moves it.
+    #
+    # Issue #1833 — and the name edge `mark:<last segment>`: a file that does not declare the class may still mark it
+    # (`x.singleton_class.prepend(Comparable)`, `o.extend(Helper)` in a method body, a `refine` block), and
+    # `IncrementalSession#mark_affected` fires the key when such a mark appears or vanishes.
     def parameter_envelopes_of(class_name)
-      record_class_dependency(class_name) if Analysis::DependencyRecorder.active?
+      if Analysis::DependencyRecorder.active?
+        record_class_dependency(class_name)
+        Analysis::DependencyRecorder.read_last_segment(:mark, class_name.to_s)
+      end
       @discovery.discovered_parameter_envelopes[class_name.to_s] || EMPTY_PARAMETER_ENVELOPES
     end
 
@@ -1921,10 +1969,10 @@ module Rigor
     private_constant :EMPTY_PARAMETER_ENVELOPES
 
     # v0.1.2 — per-class table mapping `method_name (Symbol) → :public | :private | :protected`. Populated by
-    # `ScopeIndexer` for every `def` it sees inside a class body, with the visibility taken from the surrounding
-    # `private` / `protected` / `public` modifier state plus any post-hoc `private :name, ...` named-argument
-    # calls. Consumed by the `def.method-visibility-mismatch` rule so explicit-non-self calls to a private method
-    # surface a diagnostic.
+    # `ScopeIndexer` for every `def` and `attr_*` member it sees inside a class body, with the visibility taken from
+    # a wrapping `private def` / `private attr_reader` call, else the surrounding `private` / `protected` / `public`
+    # modifier state, plus any post-hoc `private :name, ...` named-argument calls. Consumed by the
+    # `def.method-visibility-mismatch` rule so explicit-non-self calls to a private method surface a diagnostic.
     def discovered_method_visibility(class_name, method_name)
       table = @discovery.discovered_method_visibilities[class_name.to_s]
       return nil unless table

data/lib/rigor/sig_gen/alias_index.rb

@@ -2,6 +2,7 @@
 
 require_relative "../inference/rbs_type_translator"
 require_relative "type_elaborator"
+require_relative "../rooted_glob"
 
 module Rigor
   module SigGen
@@ -101,7 +102,7 @@ module Rigor
           dir = path.is_a?(Pathname) ? path : Pathname(path.to_s)
           next [] unless dir.directory?
 
-          Dir.glob(dir.join("**", "*.rbs").to_s).map { |p| File.expand_path(p) }
+          RootedGlob.glob(dir, "**/*.rbs").map { |p| File.expand_path(p) }
         end.to_set
       end
 

data/lib/rigor/sig_gen/classification.rb

@@ -60,7 +60,10 @@ module Rigor
         inline_differs: "sig.skipped.inline-differs",
         # #1676 — a plain top-level `def` defines a private `Object` method and has no class to write a
         # declaration under, so it is reported rather than silently dropped. Whether to emit it stays open.
-        top_level_def: "sig.skipped.top-level-def"
+        top_level_def: "sig.skipped.top-level-def",
+        # #1968 — a bare `public` / `private` / `protected` that may not run (in control flow or a block) sits
+        # between a bare `module_function` and the def, so whether the def is a module function is unknown.
+        uncertain_module_function: "sig.skipped.uncertain-module-function"
       }.freeze
     end
   end