rigortype 0.4.3 → 0.4.5

data/lib/rigor/analysis/check_rules.rb

@@ -29,6 +29,7 @@ require_relative "check_rules/void_value_use_collector"
 require_relative "check_rules/self_closedness_scanner"
 require_relative "check_rules/source_arity"
 require_relative "check_rules/lexical_method_sites"
+require_relative "check_rules/rbs_receiver_surface"
 require_relative "check_rules/special_global_setters"
 require_relative "check_rules/ruby_deprecations"
 
@@ -79,19 +80,8 @@ module Rigor
       # runtime one and `def.override-visibility-reduced` cannot prove a reduction.
       IMPLICITLY_PRIVATE_METHODS = (LIFECYCLE_HOOKS + %i[respond_to_missing?]).freeze
 
-      # Resolves a user-supplied rule token (`undefined-method`,
-      # `call.undefined-method`, or the family wildcard `call`)
-      # to the set of canonical rule identifiers it disables.
-      # Returns `nil` for `"all"` (the existing wildcard meaning
-      # "every rule"), or for unknown tokens.
-      def self.resolve_rule_token(token)
-        return nil if token == "all"
-        return [LEGACY_RULE_ALIASES.fetch(token)] if LEGACY_RULE_ALIASES.key?(token)
-        return PRE_EVAL_RULES if token == "pre-eval"
-        return ALL_RULES.select { |r| r.start_with?("#{token}.") } if RULE_FAMILIES.include?(token)
-
-        ALL_RULES.include?(token) ? [token] : []
-      end
+      # The token expansion (`resolve_rule_token` / `expand_rule_tokens` / `expand_token`) lives in the light
+      # `check_rules/rule_ids.rb`, so {SeverityStamp} can apply the `disable:` list on the engine-free hit path.
 
       module_function
 
@@ -480,7 +470,7 @@ module Rigor
       # - **File-level** (v0.1.2): `# rigor:disable-file <rule1>,
       #   <rule2>` anywhere in the file suppresses the matching
       #   diagnostic for every line. `# rigor:disable-file all`
-      #   suppresses every rule across the file. Convention is
+      #   suppresses every built-in rule across the file. Convention is
       #   to put the comment near the top, but Rigor accepts it
       #   anywhere — the comment scope is "this file" regardless
       #   of position.
@@ -488,7 +478,8 @@ module Rigor
       #   on the same line as the offending expression
       #   suppresses the matching diagnostic for that line
       #   only. `# rigor:disable all` on a line suppresses
-      #   every rule on that line.
+      #   every built-in rule on that line. A plugin's rows are
+      #   not passed here; see {.filter_plugin_suppressed}.
       #
       # Both in-source forms are recognised only when the
       # marker is the FIRST thing in the comment, so a
@@ -507,7 +498,7 @@ module Rigor
         diagnostics.reject do |diagnostic|
           rule = diagnostic.rule
           next false if rule.nil?
-          next true if disabled.include?(rule)
+          next true if config_disabled?(rule, disabled)
           next true if file_suppressions.include?("all") || file_suppressions.include?(rule)
 
           line_rules = line_suppressions[diagnostic.line]
@@ -515,6 +506,26 @@ module Rigor
         end
       end
 
+      # Issue #1953 — the in-source markers over the rows a plugin emitted while `path` was analysed
+      # (`#diagnostics_for_file` and node rules). A row answers to a `plugin.<id>.<rule>` or `plugin.<id>` token
+      # only ({.plugin_row_disabled?}); a bare id and `all` keep reaching built-in rows alone. `comments` are
+      # `path`'s, so a row the plugin positioned in another file is left to the `disable:` list and the baseline.
+      # The `disable:` list itself is applied to these rows by {SeverityStamp}, on every run shape.
+      def filter_plugin_suppressed(diagnostics, path:, comments:)
+        return diagnostics if diagnostics.empty?
+
+        line_suppressions, file_suppressions = parse_suppression_comments(comments)
+        return diagnostics if line_suppressions.empty? && file_suppressions.empty?
+
+        diagnostics.reject do |diagnostic|
+          next false unless diagnostic.path == path
+          next true if plugin_row_disabled?(diagnostic, file_suppressions)
+
+          line_rules = line_suppressions.fetch(diagnostic.line, nil)
+          !line_rules.nil? && plugin_row_disabled?(diagnostic, line_rules)
+        end
+      end
+
       # Every suppression-recognition pattern below is anchored with `\A` against the COMMENT SLICE —
       # Prism hands us a slice that starts at the `#`, so `\A#` means "the marker is the first thing in
       # the comment". A real directive always has that shape, in both the whole-line form and the
@@ -704,24 +715,6 @@ module Rigor
         )
       end
 
-      # Expands a list of user-supplied rule tokens into the
-      # canonical-id set per ADR-8 § "Backward compatibility".
-      # `disabled_rules` accepts unprefixed legacy names
-      # (`undefined-method`), canonical names
-      # (`call.undefined-method`), and family wildcards (`call`).
-      def expand_rule_tokens(tokens)
-        Array(tokens).each_with_object(Set.new) do |token, set|
-          set.merge(expand_token(token.to_s))
-        end
-      end
-
-      def expand_token(token)
-        return ["all"] if token == "all"
-
-        resolved = resolve_rule_token(token)
-        resolved.nil? || resolved.empty? ? [token] : resolved
-      end
-
       # rubocop:disable-next Metrics/ClassLength
       class << self
         private
@@ -809,7 +802,7 @@ module Rigor
           # rule must not surface a false `undefined-method`
           # for them.
           kind = receiver_type.is_a?(Type::Singleton) ? :singleton : :instance
-          return nil if source_declared_method?(scope, class_name, call_node.name, kind)
+          return nil if source_declared_method?(scope, class_name, call_node.name, kind, call_node: call_node)
 
           return nil unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
 
@@ -825,6 +818,8 @@ module Rigor
           return nil if method_def
 
           return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites)
+          return nil if subclass_instance_may_answer?(rendered_receiver, class_name, call_node.name, scope,
+                                                      call_node.receiver)
 
           definition_site = project_definition_site(scope, class_name, call_node.name, kind)
           # Issue #735 — the site is evidence, and whose RBS this is decides what it is evidence OF. On a
@@ -959,12 +954,51 @@ module Rigor
         #   (see {#ancestry_declares_method?} for why that placement is load-bearing, not tidiness).
         def last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites = nil)
           return true if lexically_defined_method?(class_name, call_node, scope, kind, lexical_sites)
+          return true if project_patched_through_ancestors?(scope, class_name, call_node.name, kind,
+                                                            call_node: call_node)
           return true if module_mixin_receiver?(receiver_type, scope)
           return true if mixin_self_class_receiver?(call_node, scope)
           return true if unknown_mixin_includer?(class_name, scope)
           return true if object_mixin_may_define?(receiver_type, class_name, call_node.name, scope)
+          return true if ancestry_declares_method?(scope, class_name, call_node.name, kind)
 
-          ancestry_declares_method?(scope, class_name, call_node.name, kind)
+          rbs_ancestor_may_answer?(class_name, call_node.name, scope, kind)
+        end
+
+        # Issue #1722 — a `method_missing`, or a project mixin, on one of the class's RBS ancestors
+        # ({RbsReceiverSurface}). Last for {#ancestry_declares_method?}'s reason: it walks the class graph.
+        def rbs_ancestor_may_answer?(class_name, method_name, scope, kind)
+          if kind == :singleton
+            RbsReceiverSurface.singleton_hook?(scope, class_name)
+          else
+            RbsReceiverSurface.ancestor_may_answer?(scope, class_name, method_name)
+          end
+        end
+
+        # Issue #1722 — a receiver typed by its class's name, rather than by a literal, may hold an instance of a
+        # subclass (a `#: () -> String` signature admits a `MyStr < String`), so a method a project subclass
+        # defines, or a subclass's `method_missing`, may be the one that runs. A value the engine built from a
+        # literal is exactly its class and keeps firing: a literal type (`"a"`, `1`, a union of them), a shape
+        # carrier (`{a: 1}`, `[1, 2]`, `{}`, `[]`, and what folds to one), or a receiver written as a literal
+        # (`"a#{x}b"`, which types as plain `String`). A local holding an interpolated String types as plain
+        # `String` with no origin, so it still declines. Instance side only.
+        def subclass_instance_may_answer?(receiver_type, class_name, method_name, scope, receiver_node = nil)
+          return false if receiver_type.is_a?(Type::Singleton)
+          return false if exact_literal_receiver?(receiver_type) || LITERAL_RECEIVER_NODES.include?(receiver_node.class)
+
+          RbsReceiverSurface.subclass_may_define?(scope, class_name, method_name)
+        end
+
+        EXACT_TYPES = [Type::Constant, Type::Tuple, Type::HashShape].freeze
+        LITERAL_RECEIVER_NODES = [
+          Prism::StringNode, Prism::InterpolatedStringNode, Prism::XStringNode, Prism::InterpolatedXStringNode,
+          Prism::ArrayNode, Prism::HashNode, Prism::RegularExpressionNode, Prism::InterpolatedRegularExpressionNode
+        ].to_set.freeze
+        private_constant :EXACT_TYPES, :LITERAL_RECEIVER_NODES
+
+        def exact_literal_receiver?(receiver_type)
+          members = receiver_type.is_a?(Type::Union) ? receiver_type.members : [receiver_type]
+          members.all? { |member| EXACT_TYPES.any? { |kind| member.is_a?(kind) } }
         end
 
         # Issue #1697 — a module the project mixes into `Object` (a top-level `include M`, or `include M` in
@@ -1066,10 +1100,13 @@ module Rigor
         # Both paths sit at the same dispatcher precedence; the
         # check must hold them together so neither rule fires a
         # false positive.
-        def source_declared_method?(scope, class_name, method_name, kind)
+        #
+        # `call_node:` (issue #1708), when given, is the call asking: a private or protected `pre_eval:` patch
+        # it may not reach does not count ({#patch_callable?}).
+        def source_declared_method?(scope, class_name, method_name, kind, call_node: nil)
           return true if scope.discovered_method?(class_name, method_name, kind)
 
-          project_patched_method?(scope, class_name, method_name, kind)
+          project_patched_method?(scope, class_name, method_name, kind, call_node: call_node)
         end
 
         # Issue #723 — the same question as {#source_declared_method?}, asked through the project's own
@@ -1095,12 +1132,42 @@ module Rigor
         # inference (between plugins and dependency-source).
         # Returns false when the environment carries no registry
         # (legacy path) or the lookup misses.
-        def project_patched_method?(scope, class_name, method_name, kind)
+        def project_patched_method?(scope, class_name, method_name, kind, call_node: nil)
           environment = scope.environment
           registry = environment&.project_patched_methods
           return false if registry.nil? || registry.empty?
 
-          !registry.lookup(class_name: class_name.to_s, method_name: method_name.to_sym, kind: kind).nil?
+          entry = registry.lookup(class_name: class_name.to_s, method_name: method_name.to_sym, kind: kind)
+          !entry.nil? && patch_callable?(registry, entry, scope, call_node)
+        end
+
+        # Issue #1708 — {#project_patched_method?} asked through the receiver's ancestors: a `pre_eval:` patch on
+        # `Object`, `Numeric` or `Enumerable` gives an `Integer` or `Array` the method. Asked only once the
+        # receiver's RBS has come back without the method, so a nearer class's own declaration still decides arity
+        # and argument types; {#source_declared_method?} stays exact for the rules that read it for those.
+        #
+        # `call_node:` as {#source_declared_method?} reads it.
+        def project_patched_through_ancestors?(scope, class_name, method_name, kind, call_node: nil)
+          environment = scope.environment
+          registry = environment&.project_patched_methods
+          return false if registry.nil? || registry.empty?
+
+          entry = registry.lookup_through_ancestors(class_name: class_name.to_s, method_name: method_name.to_sym,
+                                                    kind: kind, rbs_loader: environment.rbs_loader)
+          !entry.nil? && patch_callable?(registry, entry, scope, call_node)
+        end
+
+        # Issue #1708 — whether `call_node` may reach the patch `entry`: Ruby raises NoMethodError for a private
+        # patch called with an explicit receiver other than `self` (`1.kp` on `module Kernel; private def kp`), and
+        # for a protected one called from outside its owner's instances. No call node, and a declined verdict (another
+        # definer the call may reach, {Inference::ProjectPatchedMethods#callable?}), are the permissive answer.
+        def patch_callable?(registry, entry, scope, call_node)
+          return true if call_node.nil?
+
+          receiver = call_node.receiver
+          verdict = registry.callable?(entry, explicit: !receiver.nil? && !receiver.is_a?(Prism::SelfNode),
+                                              self_type: scope.self_type, rbs_loader: scope.environment.rbs_loader)
+          verdict != false
         end
 
         # ADR-34 — `call.unresolved-toplevel`. Fires on an
@@ -1149,6 +1216,8 @@ module Rigor
           return nil if scope.top_level_def_for(name)
           return nil if source_declared_method?(scope, "Object", name, :instance)
           return nil if Rigor::Reflection.instance_method_definition("Object", name, scope: scope)
+          # Issue #1708 — `main` is an Object, so a `pre_eval:` patch on `Kernel` or `BasicObject` defines the name too.
+          return nil if project_patched_through_ancestors?(scope, "Object", name, :instance)
           return nil if main_singleton_method?(name, scope)
           return nil if Inference::ObjectMixins.may_define?(scope, name, receiver: :implicit)
           # `Target.class_eval { def added = 1; def use_added = added }` files the defs on Target
@@ -1393,6 +1462,21 @@ module Rigor
         GEM_OVERLAY_OPEN_RECEIVERS = Set["ActiveSupport::Duration", "ActiveSupport::Concern"].freeze
         private_constant :GEM_OVERLAY_OPEN_RECEIVERS
 
+        # Issue #1456 — the `data/core_overlay/` twin of {GEM_OVERLAY_OPEN_RECEIVERS}. `OpenStruct` defines each field
+        # as a per-instance singleton method and answers the rest through a private `method_missing` (ostruct 0.6), so
+        # no signature can enumerate its surface. The only other declaration in the environment is json's add-on
+        # reopening (`json_create` / `as_json` / `to_json`), which made the class read as fully declared and every
+        # field access a `call.undefined-method`. `data/core_overlay/ostruct.rbs` declares that `method_missing`, and
+        # an RBS-declared `method_missing` does not by itself open a receiver here, so the class is named. No load
+        # gate is needed: the core overlay loads into every environment that has RBS at all, so the list is active
+        # whenever the declaration it protects is. Both sides of the class are open, as with
+        # {GEM_OVERLAY_OPEN_RECEIVERS}, and an inherited Object / Kernel signature stops deciding `call.wrong-arity`
+        # and `call.argument-type-mismatch` ({#unauthoritative_inherited_signature?}): lost true positives,
+        # accepted. The general rule — a class declared only by another library's partial reopening — is #1978, not
+        # this list.
+        CORE_OVERLAY_OPEN_RECEIVERS = Set["OpenStruct"].freeze
+        private_constant :CORE_OVERLAY_OPEN_RECEIVERS
+
         # ADR-26 — whether `class_name` is declared "open" by a
         # loaded plugin (manifest `open_receivers:`). An open
         # class responds beyond its RBS surface, so the
@@ -1401,11 +1485,14 @@ module Rigor
         # RBS method table, so proving a call "undefined" against it is
         # unsound: a plugin-declared open receiver, a Rigor-bundled-
         # overlay open receiver ({GEM_OVERLAY_OPEN_RECEIVERS}) whose
-        # bundled directory this run actually loaded, or a
+        # bundled directory this run actually loaded, a core-overlay
+        # open receiver ({CORE_OVERLAY_OPEN_RECEIVERS}), or a
         # Rigor-synthesized stub type (see `RbsLoader#synthesized_type_names`).
         def unbounded_receiver_surface?(class_name, scope)
+          bare_name = class_name.to_s.sub(/\A::/, "")
           open_receiver?(class_name, scope) || synthesized_stub_receiver?(class_name, scope) ||
-            (GEM_OVERLAY_OPEN_RECEIVERS.include?(class_name.to_s.sub(/\A::/, "")) && gem_overlay_loaded?(scope))
+            CORE_OVERLAY_OPEN_RECEIVERS.include?(bare_name) ||
+            (GEM_OVERLAY_OPEN_RECEIVERS.include?(bare_name) && gem_overlay_loaded?(scope))
         end
 
         def open_receiver?(class_name, scope)
@@ -2133,6 +2220,7 @@ module Rigor
           return true unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
           return true unless definition_available?(member, class_name, scope)
           return true if lookup_method(member, class_name, method_name, scope)
+          return true if project_patched_through_ancestors?(scope, class_name, method_name, :instance)
 
           # Issue #723 — the arm's own RBS does not have it; its project ancestry still might. Last, for
           # the reason {#ancestry_declares_method?} carries: this is the probe that walks the class graph.
@@ -2186,12 +2274,30 @@ module Rigor
           # `compose_codepoints` typed `Hash | Hash` for an `Array`, flagging
           # `.pack`). Require at least two distinct arm classes.
           return nil if members.map { |member| concrete_class_name(member) }.uniq.size < 2
-          return nil if members.any? { |member| method_present_anywhere?(member, call_node.name, scope) }
-          return nil if refined_on_some_arm?(members, call_node, scope, lexical_sites)
+          return nil if union_may_answer?(members, call_node, scope, lexical_sites)
 
           build_undefined_method_diagnostic(path, call_node, receiver_type)
         end
 
+        # Whether some arm of a non-nil union of classes may answer the call, which keeps the union rule silent.
+        def union_may_answer?(members, call_node, scope, lexical_sites)
+          return true if members.any? { |member| method_present_anywhere?(member, call_node.name, scope) }
+          return true if members.any? { |member| arm_surface_may_answer?(member, call_node.name, scope) }
+          # Issue #1722 — `def o.m`, `o.extend(M)` and their kin give the one object the method, whatever its class.
+          return true if lexical_sites&.singleton_local_def?(call_node)
+
+          refined_on_some_arm?(members, call_node, scope, lexical_sites)
+        end
+
+        # Issue #1722 — the scalar rule's RBS-ancestor and subclass declines, asked of one arm. Kept out of
+        # {#method_present_anywhere?}, which `call.possible-nil-receiver` also asks: there a "present" answer is
+        # what lets the rule fire, and a `method_missing` on `Object` answers on the `nil` arm too.
+        def arm_surface_may_answer?(member, method_name, scope)
+          class_name = concrete_class_name(member)
+          rbs_ancestor_may_answer?(class_name, method_name, scope, :instance) ||
+            subclass_instance_may_answer?(member, class_name, method_name, scope)
+        end
+
         # ADR-121 WD7 — a refinement in effect (or one Rigor cannot read) may define the name on one arm's class.
         def refined_on_some_arm?(members, call_node, scope, lexical_sites)
           members.any? do |member|
@@ -2855,6 +2961,13 @@ module Rigor
         # - Issue #1568 — a module the class PREPENDS sits ahead of it in Ruby's order, so a definition there
         #   is what the call reaches; the class's own private `def` answers only when nothing prepended
         #   defines the name ({#reached_definer_visibility}).
+        # - Issue #1984 — a class-object receiver (`Type::Singleton`, `K.x`) is checked against the singleton side:
+        #   the definition the call reaches on `K`'s singleton chain (its own singleton methods, its extended
+        #   modules' instance methods, then the superclass's singleton chain) must be recorded `:private`
+        #   (`private_class_method`, `class << self` with `private`, a private method of an extended module).
+        # - Issue #1984 — Ruby hands a private call to `method_missing`, so a `method_missing` or
+        #   `respond_to_missing?` a project entry on the receiver's chain records, on the side the call reaches,
+        #   declines the rule ({#missing_hook_on_chain?}).
         def visibility_mismatch_diagnostic(path, call_node, scope_index, lexical_sites = nil)
           return nil unless explicit_non_self_receiver?(call_node.receiver)
 
@@ -2866,18 +2979,125 @@ module Rigor
           return nil if inferred_param_receiver?(call_node, scope)
 
           receiver_type = scope.type_of(call_node.receiver)
-          return nil unless receiver_type.is_a?(Type::Nominal)
+          case receiver_type
+          when Type::Nominal then instance_visibility_mismatch(path, call_node, scope, receiver_type, lexical_sites)
+          when Type::Singleton then singleton_visibility_mismatch(path, call_node, scope, receiver_type, lexical_sites)
+          end
+        end
 
+        def instance_visibility_mismatch(path, call_node, scope, receiver_type, lexical_sites)
           visibility = scope.discovered_method_visibility(receiver_type.class_name, call_node.name)
           return nil unless visibility == :private
 
           reached = reached_definer_visibility(scope, receiver_type.class_name, call_node.name)
           return nil if reached == :undecided
           return nil unless reached.nil? || reached == :private
+          return nil if missing_hook_on_chain?(scope, receiver_type.class_name, :instance)
           # ADR-121 WD7 — a refinement in effect (or one Rigor cannot read) may redefine the method, public.
           return nil if refined_method_in_effect?(receiver_type.class_name, call_node, scope, :instance, lexical_sites)
 
-          build_visibility_mismatch_diagnostic(path, call_node, receiver_type)
+          build_visibility_mismatch_diagnostic(path, call_node, receiver_type.class_name)
+        end
+
+        # Issue #1984 — the singleton side reads only the reached definer: a private singleton method may be inherited
+        # (`private_class_method :new` on a superclass) or come from an extended module, so there is no own-table
+        # gate as on the instance side. It reports only:
+        #
+        # - a constant receiver (`K.x`, `A::K.x`): `self.class.x` or a local may hold a subclass that makes the name
+        #   public again (`public_class_method :new`, a template-method `def self.x`);
+        # - a call inside a `def` ({#load_time_call?}): code that runs while the files load (a class body's
+        #   `ALL = [K.new]` before its `private_class_method :new`) may run before the call is private;
+        # - no class on the chain may have had every singleton name made public (`K.public_class_method(*names)`,
+        #   `K.singleton_class.class_eval { … }`; {#singleton_wildcard_contested?}).
+        def singleton_visibility_mismatch(path, call_node, scope, receiver_type, lexical_sites)
+          class_name = receiver_type.class_name
+          return nil unless call_node.receiver.is_a?(Prism::ConstantReadNode) ||
+                            call_node.receiver.is_a?(Prism::ConstantPathNode)
+          return nil unless private_singleton_candidate?(scope, call_node.name)
+          return nil if load_time_call?(scope, call_node)
+          return nil unless reached_definer_visibility(scope, class_name, call_node.name, :singleton) == :private
+          return nil if missing_hook_on_chain?(scope, class_name, :singleton)
+          return nil if singleton_wildcard_contested?(scope, class_name)
+          return nil if refined_method_in_effect?(class_name, call_node, scope, :singleton, lexical_sites)
+
+          build_visibility_mismatch_diagnostic(path, call_node, "singleton(#{class_name})")
+        end
+
+        PRIVATE_NAMES_MEMO = :rigor_check_rules_private_singleton_names
+        private_constant :PRIVATE_NAMES_MEMO
+
+        # Issue #1984 — the table-only gate the singleton side asks before it reads a chain, as the instance side asks
+        # its own table first: whether any class records `name` private, on its singleton side or on its instance
+        # side (an extended module's private method is private on the extender's singleton). Without it every
+        # `Widget.new` would read, and file the dependency edges of, the whole singleton chain. The set is memoised per
+        # discovery index.
+        def private_singleton_candidate?(scope, name)
+          discovery = scope.discovery
+          slot = Thread.current[PRIVATE_NAMES_MEMO]
+          unless slot && slot[0].equal?(discovery)
+            slot = [discovery, private_recorded_names(discovery.discovered_method_visibilities)]
+            Thread.current[PRIVATE_NAMES_MEMO] = slot
+          end
+          slot[1].include?(name.to_sym)
+        end
+
+        def private_recorded_names(tables)
+          tables.each_value.with_object(Set.new) do |table, names|
+            table.each { |slot, visibility| names << (slot.is_a?(Array) ? slot.last : slot) if visibility == :private }
+          end
+        end
+
+        # Issue #1984 — whether the call is outside every `def` the file's deferred ranges name. A `def` is named
+        # wherever it is written in a class body, at the top level or in a `class_eval` block, so a call in it is not
+        # load time and may be reported. The top level, class bodies, and blocks and lambdas that are not such a `def`
+        # (a `map { … }` or `define_method` block, a `-> { }`) are load time and decline: such code may run while the
+        # files load, before a later `private_class_method` or in a load order where the private declaration has not
+        # run yet.
+        def load_time_call?(scope, call_node)
+          rows = scope.discovered_deferred_ranges[scope.source_path]
+          return true if rows.nil?
+
+          offset = call_node.location.start_offset
+          rows.none? { |(start, finish, name, _kind, _owner)| !name.nil? && start <= offset && offset < finish }
+        end
+
+        SINGLETON_WILDCARD_SLOT = %i[singleton *].freeze
+        private_constant :SINGLETON_WILDCARD_SLOT
+
+        # Issue #1984 — whether a project class on `class_name`'s singleton chain has its wildcard singleton slot
+        # contested: a call the walk saw may have made any of its singleton methods public.
+        def singleton_wildcard_contested?(scope, class_name)
+          discovery = scope.discovery
+          chain = Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods)
+          chain.entries.any? do |entry|
+            !entry.external? && discovery.contested?(:discovered_method_visibilities,
+                                                     [entry.name, SINGLETON_WILDCARD_SLOT])
+          end
+        end
+
+        VISIBILITY_MISSING_HOOKS = %i[method_missing respond_to_missing?].freeze
+        private_constant :VISIBILITY_MISSING_HOOKS
+
+        # Issue #1984 — whether a project entry on `class_name`'s chain for `side` records a `method_missing` or
+        # `respond_to_missing?` on the side that entry stands for (a singleton entry's singleton methods, a mixin's
+        # instance methods), or the chain cannot be read whole. Ruby sends a private call to `method_missing`, so
+        # such a hook may answer it.
+        def missing_hook_on_chain?(scope, class_name, side)
+          chain = Scope::ResolutionChain.for(scope, class_name.to_s, side, :methods)
+          return true if chain.truncated?
+
+          chain.entries.any? do |entry|
+            next false if entry.external?
+
+            kind = entry.side == :singleton ? :singleton : :instance
+            VISIBILITY_MISSING_HOOKS.any? { |hook| records_hook?(scope, entry.name, hook, kind) }
+          end
+        end
+
+        def records_hook?(scope, owner, hook, kind)
+          return true if scope.discovered_method?(owner, hook, kind)
+
+          !(kind == :singleton ? scope.singleton_def_for(owner, hook) : scope.user_def_for(owner, hook)).nil?
         end
 
         # Issue #1568, ADR-119 C1c — the recorded visibility of the definition a call on `class_name` reaches: the
@@ -2889,8 +3109,8 @@ module Rigor
         # producers contest is not alone (`DefinerResolution` asks the next candidate too), so it is `:undecided`
         # there without a read of the table here. nil is nothing recording the name at all, and the class's own
         # visibility stands. An ancestor the project does not declare is passed over, as the method lookup passes it.
-        def reached_definer_visibility(scope, class_name, method_name)
-          case Inference::DefinerResolution.resolve(scope, class_name, method_name, :instance, question: :visibility)
+        def reached_definer_visibility(scope, class_name, method_name, side = :instance)
+          case Inference::DefinerResolution.resolve(scope, class_name, method_name, side, question: :visibility)
           in Inference::DefinerResolution::Known(answer:)
             answer
           in Inference::DefinerResolution::UNKNOWN
@@ -2907,14 +3127,14 @@ module Rigor
           true
         end
 
-        def build_visibility_mismatch_diagnostic(path, call_node, receiver_type)
+        def build_visibility_mismatch_diagnostic(path, call_node, receiver_name)
           Diagnostic.from_message_loc(
             call_node,
             rule: RULE_VISIBILITY_MISMATCH,
             path: path,
-            message: "private method `#{call_node.name}' called on #{receiver_type.class_name} receiver",
+            message: "private method `#{call_node.name}' called on #{receiver_name} receiver",
             severity: :error,
-            receiver_type: receiver_type.class_name,
+            receiver_type: receiver_name,
             method_name: call_node.name.to_s
           )
         end
@@ -3991,6 +4211,9 @@ module Rigor
           # prove a reduction, stay silent.
           return nil if parent_visibility.nil?
           return nil unless visibility_reduced?(parent_visibility, override_visibility)
+          # Issue #1569 — a module function's instance copy is private because `module_function` made it so; the
+          # author's intent is the public singleton copy, so that reduction is not reported.
+          return nil if scope.module_function_def?(class_name, def_node)
 
           build_override_visibility_diagnostic(
             path, def_node, parent_class, parent_visibility, override_visibility

data/lib/rigor/analysis/dependency_source_inference/walker.rb

@@ -6,6 +6,7 @@ require_relative "return_type_heuristic"
 require_relative "../../source/constant_path"
 require_relative "../../source/node_children"
 require_relative "../../inference/scope_indexer"
+require_relative "../../rooted_glob"
 
 module Rigor
   module Analysis
@@ -127,7 +128,7 @@ module Rigor
         def walk_root(root_dir, harvest, budget) # rubocop:disable Naming/PredicateMethod
           return false unless File.directory?(root_dir)
 
-          Dir.glob(File.join(root_dir, "**", "*.rb")).each do |path|
+          RootedGlob.glob(root_dir, "**/*.rb").each do |path|
             harvest_file(path, harvest, budget)
             return true if harvest.catalog.size >= budget
           end

data/lib/rigor/analysis/incremental.rb

@@ -120,6 +120,18 @@ module Rigor
         appeared.freeze
       end
 
+      # Issue #1459 — the method names some file in `paths` started or stopped defining in this edit, on any class or
+      # side. A consumer whose answer asked whether the program defines a name anywhere
+      # (`Inference::BlockCallTiming.project_defines_anywhere?`) recorded a `defines:<name>` edge whichever way it
+      # answered. `paths` MUST include removed files, whose every name vanished. `before` / `after` map a path to the
+      # Set of names it defines (`Inference::ScopeIndexer.defined_method_names`); a path absent from either side
+      # defines nothing there.
+      def changed_defined_names(paths, before, after)
+        moved = Set.new
+        paths.each { |path| moved.merge((before[path] || Set.new) ^ (after[path] || Set.new)) }
+        moved.freeze
+      end
+
       # Issue #1120 — the method names whose refinements moved in this edit. A consumer whose answer consulted the
       # refinement table recorded a `refinement:<method>` edge whichever way it answered, because the answer is a
       # function of the whole project's refinements of that name. `paths` MUST include removed files, whose whole
@@ -182,6 +194,55 @@ module Rigor
         moved.freeze
       end
 
+      # Issue #1833 — the `[class name, mark]` pairs that appeared in or vanished from the class marks of the files an
+      # edit touched: a Symbol key of a `discovered_parameter_envelopes` bucket (the class-wide marks of
+      # `Scope::DiscoveryIndex`) or a `[ENVELOPE_REMOVED_KIND, name]` entry. A file may mark a class it does not declare
+      # (`x.singleton_class.prepend(Comparable)`, `o.extend(Helper)` in a method body), so neither the class-declaration
+      # diff nor a reader's edge to the declaring files sees such a mark appear or vanish.
+      #
+      # `before` and `after` are lists of envelope tables (`{class name => bucket}`): the touched files' seed-bundle
+      # tables before the edit, and the merged table of the re-parsed files after it. The diff is of their unions, which
+      # moves whenever the project's union of marks moves (the untouched files contribute the same marks to both).
+      # Returns a frozen Set of frozen `[class name, mark]` pairs.
+      def changed_class_marks(before, after)
+        (class_marks(before) ^ class_marks(after)).freeze
+      end
+
+      def class_marks(tables)
+        marks = Set.new
+        tables.each do |table|
+          table&.each do |class_name, bucket|
+            bucket.each_key { |key| marks << [class_name, key].freeze if class_mark?(key) }
+          end
+        end
+        marks
+      end
+
+      def class_mark?(key)
+        key.is_a?(Symbol) || (key.is_a?(Array) && key.first == Scope::DiscoveryIndex::ENVELOPE_REMOVED_KIND)
+      end
+
+      # Issue #1661 — the names of the classes and modules whose unpositioned mixin edges
+      # (`Scope::DiscoveryIndex#unpositioned_mixins`, `"*"` included) appeared or vanished in the files an edit
+      # touched. A file can taint a module it does not otherwise change the chain of (`module Comparable;
+      # include(*MODS); end`, `Comparable.include(x) if c`), and an external chain entry has no declaring file
+      # for a reader's edge to name. `before` and `after` are lists of `{class => {side => [names]}}` tables,
+      # diffed as unions like {changed_class_marks}. Returns a frozen Set of class names.
+      def changed_unpositioned_owners(before, after)
+        moved = unpositioned_edges(before) ^ unpositioned_edges(after)
+        moved.to_set { |(owner, _side, _name)| owner }.freeze
+      end
+
+      def unpositioned_edges(tables)
+        edges = Set.new
+        tables.each do |table|
+          table&.each do |owner, sides|
+            sides.each { |side, names| names.each { |name| edges << [owner, side, name].freeze } }
+          end
+        end
+        edges
+      end
+
       # Issue #644 — the qualified constant names whose PUBLICATION could have moved in this edit: the names
       # whose per-file census descriptor differs between the before- and after-state of any file in `paths`.
       # The value-constant twin of {appeared_classes}, and deliberately NOT its analogue — a class either