rigortype 0.4.4 → 0.4.5

data/lib/rigor/inference/scope_indexer.rb

@@ -25,6 +25,7 @@ require_relative "hash_lookup_mutation"
 require_relative "in_effect_refinements"
 require_relative "refine_census"
 require_relative "refine_self"
+require_relative "reflective_ivar_write"
 require_relative "index_write_widening"
 require_relative "module_function_state"
 require_relative "multi_target_binder"
@@ -332,8 +333,10 @@ module Rigor
       # possible methods were folded already ({#seed_discovered_methods}).
       def per_file_siblings(siblings, file_def_nodes, file_siblings, file_singleton, file_visibilities)
         file_singleton_def_nodes, file_singleton_contested = file_singleton
-        siblings[:contested_discovered_method_visibilities] = fold_slot_contests(
-          siblings[:contested_discovered_method_visibilities], *file_visibilities
+        # The seed's singleton contests stay ({#fold_visibility_contests}); it already holds a disagreement between
+        # this file and another.
+        siblings[:contested_discovered_method_visibilities] = fold_visibility_contests(
+          siblings[:contested_discovered_method_visibilities], {}, *file_visibilities
         )
         siblings[:contested_discovered_def_nodes] = fold_slot_contests(
           siblings[:contested_discovered_def_nodes], file_def_nodes, file_siblings[:contested_discovered_def_nodes]
@@ -507,20 +510,23 @@ module Rigor
         method_assign_effects = build_method_assign_effects(root)
         walk_class_ivars(root, [], default_scope, accumulator, mutated_ivars,
                          read_before_write, init_writes, method_assign_effects)
+        reflective_opaque = accumulator.delete(REFLECTIVE_OPAQUE_CLASSES)
         exempt_class_body_writes!(init_writes, accumulator.delete(DEFINE_METHOD_WRITES) || {})
         merge_held_ivar_writes!(accumulator)
         record_aliased_ivar_mutations!(root, mutated_ivars)
         widen_mutated_ivar_entries!(accumulator, mutated_ivars)
         contribute_read_before_write_nil!(accumulator, read_before_write, init_writes)
+        make_reflective_classes_gradual!(accumulator, reflective_opaque)
         accumulator.transform_values(&:freeze).freeze
       end
 
       # Folds the class-body writes {#collect_class_body_ivar_writes} held under {CLASS_BODY_WRITES} into the
-      # `init_writes` exemption, except for an ivar a `define_method` block of the class writes (#1768). Such an ivar
-      # had no census entry before the block's writes were counted, so the exemption never applied to it; a
-      # class-body `@x = nil` writes the class object's ivar and says nothing about whether an instance's `@x` is set,
-      # and exempting it would seed `@x` non-nil from the block's write alone (`if @x` folding always-truthy on an
-      # instance whose `@x` is unset). It keeps the read-before-write `nil` instead, which only widens.
+      # `init_writes` exemption, except for an ivar a `define_method` block, or a `block_as_methods:` block bound to the
+      # receiver's instance ({#method_body_block_call?}), of the class writes (#1768). Such an ivar had no census entry
+      # before the block's writes were counted, so the exemption never applied to it; a class-body `@x = nil` writes
+      # the class object's ivar and says nothing about whether an instance's `@x` is set, and exempting it would seed
+      # `@x` non-nil from the block's write alone (`if @x` folding always-truthy on an instance whose `@x` is unset).
+      # It keeps the read-before-write `nil` instead, which only widens.
       def exempt_class_body_writes!(init_writes, define_method_writes)
         (init_writes.delete(CLASS_BODY_WRITES) || {}).each do |class_name, ivars|
           kept = ivars - (define_method_writes[class_name] || EMPTY_GUARDED_IVARS)
@@ -867,7 +873,7 @@ module Rigor
 
           owner = def_owner || qualified_prefix
           collect_initializer_block_ivars(node, owner, default_scope, accumulator, mutated_ivars, init_writes)
-          record_attr_writer_ivars(node, owner, accumulator) if ATTR_WRITER_MACROS.include?(node.name)
+          record_attr_writer_ivars(node, owner, accumulator) if ATTR_WRITER_MACROS.include?(attr_macro(node))
           collect_define_method_block_ivars(node, owner, default_scope, accumulator, mutated_ivars)
           false
         else
@@ -1090,14 +1096,19 @@ module Rigor
       # `owner` is empty in a `class << self` body (the call defines a class method there) and in an
       # anonymous factory body, and the block contributes nothing there. A `define_method` inside a `def`
       # body is already reached by that body's walk ({#gather_ivar_writes} enters blocks).
+      #
+      # An ADR-16 `block_as_methods:` call whose entry binds the receiver's instance (`get "/" do … end` in a
+      # `Sinatra::Base` subclass under rigor-sinatra) takes the same arm: the plugin declares that its block runs as an
+      # instance method of the receiver class, and `MacroBlockSelfType` narrows the block's `self` to that instance.
       def collect_define_method_block_ivars(node, owner, default_scope, accumulator, mutated_ivars)
         return if owner.empty?
-        return unless define_method_block_call?(node)
+
+        class_name = owner.join("::")
+        return unless method_body_block_call?(node, class_name, default_scope)
 
         block = node.block
         return unless block.body
 
-        class_name = owner.join("::")
         body_scope = census_body_scope(default_scope, owner, Type::Combinator.nominal_of(class_name))
         gather_ivar_writes(block.body, body_scope, class_name, accumulator, EMPTY_GUARDED_IVARS, mutated_ivars)
         written = (accumulator[DEFINE_METHOD_WRITES] ||= {})[class_name] ||= Set.new
@@ -1115,6 +1126,8 @@ module Rigor
              Prism::InstanceVariableTargetNode
           acc << node.name
         end
+        reflective = ReflectiveIvarWrite.literal_name(node)
+        acc << reflective if reflective
         node.rigor_each_child { |child| define_method_written_ivars(child, acc) }
       end
 
@@ -1243,6 +1256,25 @@ module Rigor
         DefineMethodBlockSelf.define_method_on_lexical_self?(node) && node.block.is_a?(Prism::BlockNode)
       end
 
+      # A call with a literal block on the implicit or `self` receiver whose block is an instance method body of
+      # `class_name`, the class the walk is in (#1768): `define_method`, or a call an ADR-16 `block_as_methods:` entry
+      # declares runs its block as an instance method of the receiver class ({MacroBlockSelfType}). The entry is
+      # matched on `Singleton[class_name]`, the receiver such a call has in the class body, through the same
+      # receiver-ancestry match the evaluator narrows the block's `self` with, so the census counts exactly the blocks
+      # whose `self` is narrowed to the instance.
+      #
+      # The class-body walk ({#collect_class_body_ivar_writes}) still records a `block_as_methods:` block's writes as
+      # class-body writes, and {#exempt_class_body_writes!} takes back every ivar such a block writes.
+      def method_body_block_call?(node, class_name, scope)
+        return true if define_method_block_call?(node)
+        return false unless node.block.is_a?(Prism::BlockNode)
+        return false unless scope && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+
+        MacroBlockSelfType.runs_as_receiver_instance_method?(
+          scope: scope, call_node: node, receiver_type: Type::Combinator.singleton_of(class_name)
+        )
+      end
+
       def detect_read_before_write(node, seen_writes, read_first)
         return unless node.is_a?(Prism::Node)
         return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
@@ -1270,6 +1302,9 @@ module Rigor
         end
 
         seen_writes << node.name if IVAR_WRITE_NODES.any? { |klass| node.is_a?(klass) }
+        # #1931 — a literal `instance_variable_set` is a write too; its value argument, read above, runs first.
+        reflective = ReflectiveIvarWrite.literal_name(node)
+        seen_writes << reflective if reflective
       end
 
       # Records each ivar target of a `MultiWriteNode` / nested `MultiTargetNode` into `seen_writes`, and descends into
@@ -1317,6 +1352,7 @@ module Rigor
           end
         else
           record_compound_ivar_write(node, scope, class_name, accumulator)
+          record_reflective_ivar_write(node, scope, class_name, accumulator)
         end
 
         # N1 — parallel / multiple assignment (`old, @cb = @cb, block`, `@i, @o, @e, @thr = Open3.popen3(cmd)`). A
@@ -1344,6 +1380,32 @@ module Rigor
         end
       end
 
+      # #1931 — `instance_variable_set` on `self` writes an ivar no write node shows ({ReflectiveIvarWrite}). A literal
+      # name (`instance_variable_set(:@k, v)`) contributes the value's type to that ivar's entry, as `@k = v` would. A
+      # name the analysis cannot read (`instance_variable_set(:"@#{k}", v)`, the options-hash constructor idiom) may
+      # write any ivar of the class, so every entry of the class turns gradual once the walk ends
+      # ({#make_reflective_classes_gradual!}): a reader in another method otherwise kept a write's literal (`@timeout =
+      # 5` read as `5`) and reported a call on it.
+      def record_reflective_ivar_write(node, scope, class_name, accumulator)
+        return unless ReflectiveIvarWrite.self_write?(node)
+
+        name = ReflectiveIvarWrite.literal_name(node)
+        if name
+          accumulate_ivar_type(accumulator, class_name, name, scope.type_of(ReflectiveIvarWrite.value_node(node)))
+        else
+          (accumulator[REFLECTIVE_OPAQUE_CLASSES] ||= Set.new) << class_name
+        end
+      end
+
+      def make_reflective_classes_gradual!(accumulator, classes)
+        classes&.each do |class_name|
+          entries = accumulator[class_name]
+          next if entries.nil?
+
+          accumulator[class_name] = entries.transform_values { Type::Combinator.untyped }
+        end
+      end
+
       # Records `@ivar.<method>(...)` calls whose method is in `MutationWidening::SHAPE_MUTATORS`.
       # The class-ivar pre-pass uses the resulting set to widen the post-collected accumulator entries (see
       # {.widen_mutated_ivar_entries!}). Always-safe to over- collect: any name that the widening primitive declines is
@@ -2087,7 +2149,9 @@ module Rigor
       # accumulator), and the class-body writes held out of `init_writes` until {#exempt_class_body_writes!}.
       DEFINE_METHOD_WRITES = :define_method_writes
       CLASS_BODY_WRITES = :class_body_writes
-      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES
+      # The classes a computed-name `instance_variable_set` may write any ivar of ({#record_reflective_ivar_write}).
+      REFLECTIVE_OPAQUE_CLASSES = :reflective_opaque_classes
+      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES, :REFLECTIVE_OPAQUE_CLASSES
 
       # Unions `type` into the class-ivar accumulator for `(class_name, ivar_name)`. Shared by the single-write and
       # multi-write (parallel-assignment) collectors.
@@ -4088,6 +4152,10 @@ module Rigor
                  (singleton_cref && owner_prefix.empty?)
             record_alias_or_undef(node, owner_prefix, in_singleton_class || defs_singleton,
                                   methods_acc.at(node))
+            if node.is_a?(Prism::AliasMethodNode) && !(in_singleton_class || defs_singleton)
+              supersede_def_nodes(Array(Source::AliasNames.keyword_names(node)&.first), owner_prefix,
+                                  def_nodes_acc, methods_acc.at(node))
+            end
           end
           return
         when Prism::SymbolNode
@@ -4102,6 +4170,9 @@ module Rigor
           end
           anonymous = record_call_node_methods(node, owner_prefix, in_singleton_class, methods_acc.at(node),
                                                source_path)
+          unless in_singleton_class
+            supersede_def_nodes(call_superseded_names(node), owner_prefix, def_nodes_acc, methods_acc.at(node))
+          end
           tables = methods_acc.at(node)
           record_singleton_prepend(node, qualified_prefix, tables,
                                    self_ok: node.name == :prepend && tables.in_block?(node))
@@ -4171,11 +4242,40 @@ module Rigor
       def record_declaration_facts(node, child_prefix, tables)
         if node.is_a?(Prism::ClassNode)
           record_meta_superclass_members(node, child_prefix, tables)
+          record_constructed_superclass(node.superclass, child_prefix.join("::"), tables)
         else
           record_surface_mark(tables, child_prefix.join("::"), Scope::DiscoveryIndex::ENVELOPE_MODULE_MARK)
         end
       end
 
+      # Issue #1979 — `class K < Data.define(:a)`, `< Struct.new(:a)` or `< Class.new(Parent)`: the superclass table
+      # records `nil` for K, so a subclass walk enumerates it under every class. Each constant the expression names
+      # (the factory's receiver, and `Class.new`'s argument, or `Object` for none) takes a
+      # `[ENVELOPE_CONSTRUCTED_KIND, name]` entry; an expression of any other shape records none.
+      def record_constructed_superclass(superclass, class_name, tables)
+        names = constructed_superclass_names(superclass)
+        names&.each do |name|
+          record_envelope(tables.envelopes, class_name, [Scope::DiscoveryIndex::ENVELOPE_CONSTRUCTED_KIND, name],
+                          Source::ParameterEnvelope::OPAQUE)
+        end
+      end
+
+      def constructed_superclass_names(node)
+        return ["Data"] if meta_call_with_name?(node, :Data, :define)
+        return ["Struct"] if meta_call_with_name?(node, :Struct, :new)
+        return nil unless class_new_call?(node)
+
+        arguments = node.arguments&.arguments || []
+        return %w[Class Object] if arguments.empty?
+        return nil unless arguments.one?
+
+        argument = arguments.first
+        inner = if argument.is_a?(Prism::ConstantReadNode) then [argument.name.to_s]
+                else constructed_superclass_names(argument)
+                end
+        inner && ["Class", *inner]
+      end
+
       # The block form of a meta-new constant write: its members, and the module mark `Module.new` earns.
       # Issue #1820 — `K = Class.new(Parent)`, with or without a block, names a class whose superclass the superclass
       # table leaves out; it takes {Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK}.
@@ -4214,7 +4314,7 @@ module Rigor
       # descent.
       def record_call_node_methods(node, qualified_prefix, in_singleton_class, methods_acc, source_path)
         record_define_method(node, qualified_prefix, in_singleton_class, methods_acc) if node.name == :define_method
-        record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc) if ATTR_MACROS.include?(node.name)
+        record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc) if attr_macro(node)
         record_module_attr_methods(node, qualified_prefix, methods_acc) if MODULE_ATTR_MACROS.key?(node.name)
         record_alias_method_call(node, qualified_prefix, in_singleton_class, methods_acc)
         record_surface_evidence(node, qualified_prefix, methods_acc)
@@ -4727,6 +4827,49 @@ module Rigor
         end
       end
 
+      # Issue #1989 — the instance method names a non-`def` definer written on the class body's self replaces:
+      # each reader (and `x=` writer) an `attr_*` call declares, a literal `define_method(:x)`, and the new name of
+      # an `alias_method :x, :y` call. A non-literal name replaces nothing Rigor can name.
+      def call_superseded_names(call_node)
+        if (macro = attr_macro(call_node))
+          names = []
+          each_attr_macro_name(call_node) do |base|
+            names << base unless macro == :attr_writer
+            names << :"#{base}=" unless macro == :attr_reader
+          end
+          names
+        elsif call_node.name == :define_method
+          define_method_superseded_name(call_node)
+        else
+          Source::AliasNames.alias_method_call_names(call_node)&.first(1) || []
+        end
+      end
+
+      def define_method_superseded_name(call_node)
+        return [] unless call_node.receiver.nil? || call_node.receiver.is_a?(Prism::SelfNode)
+
+        name = literal_method_name(call_node.arguments&.arguments&.first)
+        name.nil? ? [] : [name.to_sym]
+      end
+
+      # Issue #1989 — a definer that is not a `def` replaces the method an earlier `def` of the same name in this walk
+      # installed: `def x = 1; attr_reader :x` answers the attr reader, so the `def` body must not type the call. The
+      # slot keeps the `def` and is contested, certain definer or possible, so the readers that re-type a body
+      # decline. The slot is not emptied: the file still writes it, so a sibling file's `def` of the name (which the
+      # cross-file seed and the project fold would otherwise put there) cannot fill it. A `def` written after the
+      # definer writes the slot again and clears the contest.
+      def supersede_def_nodes(names, qualified_prefix, accumulator, tables)
+        return if names.empty?
+
+        class_name = qualified_prefix.join("::")
+        slot = accumulator[class_name]
+        return if slot.nil?
+
+        names.each do |name|
+          follow_slot_writer(tables, :contested_def_nodes, [class_name, name], false) if slot.key?(name)
+        end
+      end
+
       # #319 — a `def` inside an anonymous `Class.new` / `Module.new` body ALSO stays in the `<toplevel>` table.
       # Before the anonymous class had a name the body was walked with an empty prefix, so every such `def`
       # landed there; that is the same leniency this key already grants a `def` nested in any other DSL block
@@ -4772,6 +4915,18 @@ module Rigor
       # The singleton walk's accumulator: the `{class => {name => DefNode}}` table, plus the contested slots, which
       # follow each slot's writer ({#follow_slot_writer}'s rule).
       class SingletonDefTable < Hash
+        # Issue #1936 — contests the slots of `names` (every slot of `class_name` for `:all`) that an earlier write
+        # filled: a later non-`def` definer replaced the `def` they hold. The slot keeps the `def`, as
+        # {ScopeIndexer#supersede_def_nodes} keeps the instance one, and a later write clears the contest.
+        def supersede(class_name, names)
+          slot = self[class_name]
+          return if slot.nil?
+
+          (names == :all ? slot.keys : names).each do |name|
+            (@contested ||= Set.new) << [class_name, name] if slot.key?(name)
+          end
+        end
+
         def track(certainty)
           @certainty = certainty
           @contested = nil
@@ -4779,9 +4934,11 @@ module Rigor
         end
 
         # Writes the slot; `node` and `other` are the contributions the write rests on, possible when either is.
-        def write(class_name, name, def_node, node, other = nil)
+        # `possible` says the write rests on a fact the contributions do not carry (a module_function copy after a
+        # reset that may not run, #1968).
+        def write(class_name, name, def_node, node, other = nil, possible: false)
           (self[class_name] ||= {})[name] = def_node
-          if Certainty.possible?(@certainty, node) || (other && Certainty.possible?(@certainty, other))
+          if possible || Certainty.possible?(@certainty, node) || (other && Certainty.possible?(@certainty, other))
             (@contested ||= Set.new) << [class_name, name]
           else
             @contested&.delete([class_name, name])
@@ -4824,6 +4981,12 @@ module Rigor
       # `Const`'s singleton class (a `remove_method`, a `def`) without declaring `Const`, so it stays out of
       # `class_sources` (whose readers take a name there as one the project declares) and joins only the per-file
       # class-declaration sets the incremental `class:` edges diff (`Runner#class_declarations`).
+      #
+      # Issue #1941 — so does a `def Const.x` (`def D.own`, or `def E.x` inside `module M`, resolved as a `class << E`
+      # receiver is): it adds to `Const`'s singleton side from a file the reader's class edge need not name. In the set,
+      # the declaration diff fires `class:` when the file gains or loses one, and
+      # `IncrementalSession#singleton_rewrite_affected` fires it when one is renamed. `def (M::E).x` records no
+      # singleton `def` at all, so it joins nothing.
       def record_singleton_class_sources(sources, path, root)
         collect_singleton_class_targets(root, []) { |name| (sources[name] ||= Set.new) << path }
       end
@@ -4839,6 +5002,8 @@ module Rigor
           yield eval_constant_receiver_prefix(node, node.expression, rendered, lexical_prefix).join("::") if rendered
         when Prism::CallNode
           yield_singleton_side_constant(node, node.receiver, lexical_prefix, &) if singleton_side_call?(node)
+        when Prism::DefNode
+          yield_singleton_side_constant(node, node.receiver, lexical_prefix, &)
         end
         node.rigor_each_child { |child| collect_singleton_class_targets(child, lexical_prefix, &) }
       end
@@ -4846,8 +5011,7 @@ module Rigor
       # A call on a constant that may rewrite its singleton side (`Const.singleton_class`,
       # `Const.define_singleton_method`, `Const.extend(M)`, `Const.instance_eval { … }`) records facts about `Const`'s
       # singleton methods the refinement walk reads from a file that need not declare `Const`, so the file joins the
-      # constant's set too. Written inside `Const`'s own body, the name is in the file's set already; a `def Const.x`
-      # files its own `method:` key.
+      # constant's set too. Written inside `Const`'s own body, the name is in the file's set already.
       def singleton_side_call?(node)
         node.name == :singleton_class || surface_rewriting_call?(node)
       end
@@ -5062,7 +5226,7 @@ module Rigor
       # own `def` leaves additionally split on {INSTANCE_EVAL_CALLS}, whose `def`s bind on the
       # receiver's singleton rather than the receiver.
       def receiver_eval_call?(node)
-        node.block.is_a?(Prism::BlockNode) && RECEIVER_EVAL_CALLS.include?(node.name)
+        node.is_a?(Prism::CallNode) && node.block.is_a?(Prism::BlockNode) && RECEIVER_EVAL_CALLS.include?(node.name)
       end
 
       # A `class_eval` / `module_eval` / `class_exec` / `module_exec` block is NOT deferred: it runs
@@ -5445,7 +5609,10 @@ module Rigor
                                    def_owner_prefix = nil, singleton_cref: false,
                                    defs_singleton: false)
         return unless node.is_a?(Prism::Node)
-        if node.is_a?(Prism::CallNode) && receiver_eval_call?(node)
+
+        supersede_singleton_def_nodes(node, qualified_prefix, in_singleton_class, defs_singleton, accumulator,
+                                      def_owner_prefix)
+        if receiver_eval_call?(node)
           return walk_eval_singleton_defs(node, qualified_prefix, in_singleton_class, accumulator,
                                           def_owner_prefix, singleton_cref: singleton_cref,
                                                             defs_singleton: defs_singleton)
@@ -5736,7 +5903,8 @@ module Rigor
                               defs_singleton: false)
         owner_prefix = def_owner_prefix || qualified_prefix
         statements = statements_of(body)
-        ModuleFunctionState.each_singleton_sibling(statements) do |stmt, module_function_on, named_call|
+        conditional = ModuleFunctionState.conditional_clause_statements(body)
+        ModuleFunctionState.each_singleton_sibling(statements, conditional) do |stmt, module_function_on, named_call|
           if named_call
             # `:unnameable` — the named defs the call copies live on the metaclass,
             # which this table cannot name either.
@@ -5786,19 +5954,96 @@ module Rigor
         statements
       end
 
+      # `module_function_on` is {ModuleFunctionState.each_singleton_sibling}'s: `:uncertain` writes the module
+      # function's copy as possible, so the slot holds the later def, contested, rather than the def the
+      # slot held before (#1968).
       def record_singleton_def_node(def_node, qualified_prefix, in_singleton_class, module_function_on, accumulator)
-        singleton = def_singleton?(def_node, qualified_prefix, in_singleton_class) || module_function_on
-        return unless singleton
+        declared = def_singleton?(def_node, qualified_prefix, in_singleton_class)
+        return unless declared || module_function_on
         return if qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        write_singleton_slot(accumulator, class_name, def_node.name, def_node, def_node)
+        write_singleton_slot(accumulator, class_name, def_node.name, def_node, def_node,
+                             possible: !declared && module_function_on == :uncertain)
+      end
+
+      # Issue #1936 — the singleton twin of {#supersede_def_nodes}: a definer that is not a `def` replaces the
+      # singleton method an earlier `def self.x` of the walk installed, so the slot is contested and the typing read
+      # declines instead of re-typing the replaced body. The definers, each written on the class's own singleton
+      # class: `singleton_class.alias_method` / `define_method` / `remove_method` / `undef_method` / `attr_*` and its
+      # `class_eval` family and `send` (bare, `self.` or a constant's `singleton_class`), `define_singleton_method`,
+      # and in a `class << self` body the receiverless calls of the same names with `alias` and `undef`. Certain or
+      # possible alike; a call whose rewritten names are not all literal contests every slot the owner holds so far.
+      # Under an `instance_eval` split (`defs_singleton`) only `alias` and `undef` bind on the singleton; its calls
+      # stay instance-side.
+      def supersede_singleton_def_nodes(node, qualified_prefix, in_singleton_class, defs_singleton, accumulator,
+                                        def_owner_prefix)
+        return unless accumulator.is_a?(SingletonDefTable) && defs_singleton != :unnameable
+
+        owner_prefix = def_owner_prefix || qualified_prefix
+        current = owner_prefix.empty? ? nil : owner_prefix.join("::")
+        owner, names =
+          case node
+          when Prism::AliasMethodNode, Prism::UndefNode
+            [current, singleton_keyword_names(node)] if in_singleton_class || defs_singleton == true
+          when Prism::CallNode
+            singleton_call_target(node, qualified_prefix, current, in_singleton_class)
+          end
+        accumulator.supersede(owner, names) if owner && names
+      end
+
+      def singleton_keyword_names(node)
+        return literal_names_or_all(node.names) if node.is_a?(Prism::UndefNode)
+
+        names = Source::AliasNames.keyword_names(node)
+        names ? names.first(1) : :all
+      end
+
+      # `[owner, names]` for a singleton definer call {#supersede_singleton_def_nodes} reads, or nil.
+      def singleton_call_target(node, qualified_prefix, current, in_singleton_class)
+        receiver = node.receiver
+        if !in_singleton_class && singleton_class_of_receiver?(receiver)
+          [singleton_class_owner(node, receiver.receiver, qualified_prefix, current), singleton_naming_call_names(node)]
+        elsif receiver.nil? || receiver.is_a?(Prism::SelfNode)
+          [current, in_singleton_class ? singleton_naming_call_names(node) : define_singleton_method_names(node)]
+        end
+      end
+
+      # The singleton names a naming call on the singleton class replaces, `:all` where they are not all literal,
+      # or nil for another call. `attr_writer` replaces only `x=`, `attr_reader` only `x`. A `class_eval`-family or
+      # `send` call may replace any name, so it is `:all`.
+      def singleton_naming_call_names(node)
+        arguments = node.arguments&.arguments || []
+        case node.name
+        when *SURFACE_EVAL_CALLS, *SURFACE_SEND_CALLS then :all
+        when :alias_method then literal_names_or_all(arguments.first(1))
+        when :define_method then define_singleton_method_names(node, :define_method)
+        when :remove_method, :undef_method then literal_names_or_all(arguments)
+        when *ATTR_MACROS
+          names = literal_names_or_all(arguments)
+          return names if names == :all
+
+          names.flat_map do |base|
+            [(base unless node.name == :attr_writer), (:"#{base}=" unless node.name == :attr_reader)].compact
+          end
+        end
+      end
+
+      def define_singleton_method_names(node, call = :define_singleton_method)
+        return nil unless node.name == call
+
+        literal_names_or_all(node.arguments&.arguments&.first(1) || [])
+      end
+
+      def literal_names_or_all(arguments)
+        names = arguments.map { |argument| literal_method_name(argument) }
+        names.empty? || names.any?(&:nil?) ? :all : names
       end
 
       # One singleton slot write, through {SingletonDefTable#write} when the walk tracks certainty.
-      def write_singleton_slot(accumulator, class_name, name, def_node, node, other = nil)
+      def write_singleton_slot(accumulator, class_name, name, def_node, node, other = nil, possible: false)
         if accumulator.is_a?(SingletonDefTable)
-          accumulator.write(class_name, name, def_node, node, other)
+          accumulator.write(class_name, name, def_node, node, other, possible: possible)
         else
           (accumulator[class_name] ||= {})[name] = def_node
         end
@@ -6695,32 +6940,34 @@ module Rigor
       # differently for the two spellings of one edge.
       def record_mixin_call(node, qualified_prefix, current_class, accumulator)
         taint_opaque_eval(node, current_class, accumulator)
-        kind, _arguments, via_send = mixin_call_view(node)
-        return if kind.nil?
+        view = mixin_call_view(node)
+        return if view.nil? || view.first.nil?
 
+        kind = view.first
         current_class ||= toplevel_include_owner(node, qualified_prefix, current_class, accumulator)
         effects = mixin_effects(node, kind, qualified_prefix, current_class, accumulator, in_singleton: false)
                   .select { |_owner, side| side == :include }
         return if effects.empty?
-        return if !via_send && instance_mixin_recorded?(node, qualified_prefix, current_class, accumulator)
+        return if instance_mixin_recorded?(node, view, qualified_prefix, current_class, accumulator)
 
         # A mixin call the tables cannot hold still reshapes the ancestry: taint the whole owner side.
         effects.each { |owner, side| accumulator.taint(owner, side) }
       end
 
       # Records the instance-side edges of a call {#mixin_call_recorded?} accepts. False when it recorded
-      # nothing — the caller then taints the owner instead.
-      def instance_mixin_recorded?(node, qualified_prefix, current_class, accumulator)
-        return false unless mixin_call_recorded?(node, current_class)
+      # nothing — the caller then taints the owner instead. `view` is {#mixin_call_view}'s, so
+      # `Integer.send(:include, Ext)` records `Ext` as `Integer.include(Ext)` does (issue #1722).
+      def instance_mixin_recorded?(node, view, qualified_prefix, current_class, accumulator)
+        kind, arguments, via_send = view
+        return false unless mixin_call_recorded?(node, kind, via_send, current_class)
 
-        arguments = node.arguments&.arguments || []
         targets = arguments.filter_map { |arg| Source::ConstantPath.qualified_name(arg) }
         return false if targets.empty?
 
         owner = node.receiver.nil? ? current_class : prepend_call_receiver(node, qualified_prefix)
         return false if owner.nil?
 
-        write_mixin_targets(accumulator, owner, targets, prepend: node.name == :prepend)
+        write_mixin_targets(accumulator, owner, targets, prepend: kind == :prepend)
         accumulator.note(node, owner, :include, targets, complete: targets.size == arguments.size)
         true
       end
@@ -6868,15 +7115,17 @@ module Rigor
       end
 
       # Whether a mixin call contributes to the tables at all: a receiverless `include` / `prepend` needs an
-      # enclosing declaration to file the edge under, and the RECEIVER form is recorded for `prepend` only
-      # — `Base.include(Loud)` is deliberately still unrecorded. Nothing needs it (this issue orders
-      # `prepend`, and the receiver form of `include` has no ordering question to answer) while recording
-      # it would widen what every consumer says about a class, which is scope this change does not own.
-      def mixin_call_recorded?(node, current_class)
-        return false unless MIXIN_CALL_NAMES.include?(node.name)
-        return !current_class.nil? if node.receiver.nil?
+      # enclosing declaration to file the edge under, and the RECEIVER form (`Base.prepend(Loud)`, issue #1123;
+      # `Integer.include(Ext)` and `Integer.send(:include, Ext)`, issue #1722) files it under the class the
+      # receiver names. A receiver-form edge is unpositioned wherever it is written ({MixinAccumulator#note}), so
+      # a reader that depends on ORDER declines on it, while the set-shaped readers (undefined-method
+      # suppression, arity, visibility) see the module as they see an in-body `include`. A receiverless `send`
+      # stays a taint: the walk does not resolve its `self`.
+      def mixin_call_recorded?(node, kind, via_send, current_class)
+        return false unless MIXIN_CALL_NAMES.include?(kind)
+        return !via_send && !current_class.nil? if node.receiver.nil?
 
-        node.name == :prepend
+        true
       end
 
       # Issue #1697 — a receiverless `include M` written as a statement of the file's own top level is
@@ -7589,6 +7838,8 @@ module Rigor
       # - **Wrap-around form** (#1911, #1819, #1633): `private def foo` and `private attr_reader :foo` record the
       #   members with the call's visibility and leave the default alone.
       #
+      # A `module_function` call takes each form as `private` does (#1569): Ruby makes the instance copy private.
+      #
       # Top-level (no surrounding class) defs do not contribute — Ruby's top-level visibility nuances (private at
       # top-level marks the method on `Object`) are out of scope for v0.1.2.
       def build_discovered_method_visibilities(root)
@@ -7605,8 +7856,8 @@ module Rigor
       end
 
       # The bare calls that set the running default visibility of the body they run in: the modifiers and
-      # `module_function`, which {#walk_method_visibilities} does not track as a value (#1569) but which moves the
-      # default all the same.
+      # `module_function`, which {#walk_method_visibilities} applies as `private` on the instance side
+      # ({ModuleFunctionState.instance_visibility}, #1569).
       VISIBILITY_TOGGLES = (VISIBILITY_MODIFIERS + %i[module_function]).freeze
 
       # The `{class => {name => visibility}}` accumulator of {#walk_method_visibilities}, which also carries the
@@ -7650,9 +7901,22 @@ module Rigor
           (@contested ||= Set.new) << [class_name, name].freeze
         end
 
-        # Contests every slot of `class_name` recorded so far (`private(*names)` may name any of them).
-        def contest_class(class_name)
-          self[class_name]&.each_key { |name| contest_slot(class_name, name) }
+        # Contests every slot of `class_name` on `side` recorded so far (`private(*names)` may name any of them).
+        # Issue #1984 — on the singleton side it also contests the class's wildcard slot
+        # ({ScopeIndexer::SINGLETON_WILDCARD_SLOT}): the names may be ones another file records.
+        def contest_class(class_name, side = :instance)
+          self[class_name]&.each_key do |slot|
+            contest_slot(class_name, slot) if slot.is_a?(Array) == (side == :singleton)
+          end
+          contest_slot(class_name, SINGLETON_WILDCARD_SLOT) if side == :singleton
+        end
+
+        # Issue #1984 — records `visibility` in the slot of `name` on `side` ({ScopeIndexer.visibility_slot}) and
+        # settles its contest as {#wrote} does.
+        def write(class_name, name, side, visibility, node, toggled:)
+          slot = ScopeIndexer.visibility_slot(name, side)
+          (self[class_name] ||= {})[slot] = visibility
+          wrote(class_name, slot, node, toggled: toggled)
         end
 
         # Runs the block with the running default uncertain, so a `def` it records is contested.
@@ -7769,10 +8033,12 @@ module Rigor
             return current_visibility
           end
         when Prism::DefNode
-          record_def_visibility(node, owner_prefix, in_singleton_class || defs_singleton,
+          contest_foreign_singleton_visibility(node, qualified_prefix, owner_prefix, in_singleton_class, accumulator)
+          record_def_visibility(node, owner_prefix, visibility_side(in_singleton_class, defs_singleton),
                                 current_visibility, accumulator)
           return current_visibility
         when Prism::CallNode
+          record_constant_class_method_calls(node, qualified_prefix, accumulator)
           if receiver_eval_call?(node)
             walk_eval_visibilities(node, qualified_prefix, in_singleton_class, current_visibility,
                                    accumulator, def_owner_prefix, singleton_cref: singleton_cref,
@@ -7787,23 +8053,50 @@ module Rigor
           end
           if (parts = visibility_call_parts(node))
             accumulator.toggles += 1 if visibility_toggle_arguments?(parts.last)
-            # The visibility table is instance-side only — `private :x` inside `class <<`
-            # (or a receiver-eval body that re-evaluates a singleton self) marks the
-            # SINGLETON method, which this table cannot express. The `owner_prefix` check is a
-            # guard: an ownerless body (the top level, an anonymous factory block) records nothing,
-            # and its calls walk as any other call.
-            if !in_singleton_class && !owner_prefix.empty? && VISIBILITY_MODIFIERS.include?(parts.first)
-              return apply_visibility_call(node, *parts, owner_prefix, current_visibility, accumulator,
-                                           defs_singleton: defs_singleton) do |argument|
+            # A `module_function` call is applied as a `private` one (#1569): it makes the instance copy private.
+            visibility = parts.first
+            visibility = ModuleFunctionState.instance_visibility unless VISIBILITY_MODIFIERS.include?(visibility)
+            # Issue #1984 — inside `class << self` (or a `class_eval` on the singleton class) the call marks the
+            # SINGLETON methods, recorded under their `[:singleton, name]` slots. `module_function` is no method of
+            # a singleton class, so it is walked as any other call there. The `owner_prefix` check is a guard: an
+            # ownerless body (the top level, an anonymous factory block) records nothing, and its calls walk as
+            # any other call.
+            # An `instance_eval` body's call (`:eval`) runs on the receiver as a module: the instance side.
+            side = visibility_side(in_singleton_class, defs_singleton)
+            side = :instance if side == :eval
+            if side && !owner_prefix.empty? && (side == :instance || VISIBILITY_MODIFIERS.include?(parts.first))
+              return apply_visibility_call(node, visibility, parts.last, owner_prefix, current_visibility, accumulator,
+                                           side: side, defs_singleton: defs_singleton) do |argument|
                 walk_method_visibilities(argument, qualified_prefix, in_singleton_class, current_visibility,
                                          accumulator, def_owner_prefix, singleton_cref: singleton_cref,
                                                                         defs_singleton: defs_singleton)
               end
             end
           end
-          unless in_singleton_class || defs_singleton
-            record_attr_visibility(node, owner_prefix, current_visibility, accumulator, toggled: true)
+          if !in_singleton_class && !owner_prefix.empty?
+            class_method_parts = class_method_visibility_parts(node)
+            if class_method_parts
+              apply_class_method_visibility(node, *class_method_parts, owner_prefix, accumulator) do |argument|
+                walk_method_visibilities(argument, qualified_prefix, in_singleton_class, current_visibility,
+                                         accumulator, def_owner_prefix, singleton_cref: singleton_cref,
+                                                                        defs_singleton: defs_singleton)
+              end
+              return current_visibility
+            end
+            contest_singleton_rewrites(node, owner_prefix, accumulator)
+          end
+          side = visibility_side(in_singleton_class, defs_singleton)
+          if %i[instance singleton].include?(side)
+            record_attr_visibility(node, owner_prefix, current_visibility, accumulator, toggled: true, side: side)
+            contest_replaced_visibility(replaced_by_call(node), owner_prefix, accumulator, side: side)
           end
+        when Prism::AliasMethodNode
+          side = visibility_side(in_singleton_class, defs_singleton)
+          if %i[instance singleton].include?(side)
+            contest_replaced_visibility(Array(Source::AliasNames.keyword_names(node)&.first), owner_prefix,
+                                        accumulator, side: side)
+          end
+          return current_visibility
         end
 
         # Statement-position StatementsNode preserves left-to-right visibility flow; everything else recurses with the
@@ -7887,6 +8180,9 @@ module Rigor
                                    singleton_cref: singleton_cref,
                                    defs_singleton: defs_singleton)
         end
+        return if singleton_class_eval_walked?(node, qualified_prefix, in_singleton_class, accumulator,
+                                               def_owner_prefix, singleton_cref, defs_singleton)
+
         node.arguments&.arguments&.each do |arg|
           walk_method_visibilities(arg, qualified_prefix, in_singleton_class, current_visibility,
                                    accumulator, def_owner_prefix, singleton_cref: singleton_cref,
@@ -7911,63 +8207,185 @@ module Rigor
         end
       end
 
-      # `toggled` when the def reads the running default (a statement), false for one a visibility call wraps.
-      def record_def_visibility(def_node, qualified_prefix, in_singleton_class, current_visibility, accumulator,
-                                toggled: true)
-        return if def_node.receiver.is_a?(Prism::SelfNode) || in_singleton_class
-        return if qualified_prefix.empty?
+      # Issue #1984 — `singleton_class.class_eval do … end` in a class body (or `module_eval` / `class_exec` /
+      # `module_exec`) runs its block as a `class << self` body does: its `def`s and visibility calls land on the
+      # class's singleton slots. True when it walked the block so.
+      def singleton_class_eval_walked?(node, qualified_prefix, in_singleton_class, accumulator,
+                                       def_owner_prefix, singleton_cref, defs_singleton)
+        return false if in_singleton_class || defs_singleton || INSTANCE_EVAL_CALLS.include?(node.name)
+        return false unless own_singleton_class?(node.receiver) && node.arguments.nil?
+
+        owner_prefix = def_owner_prefix || qualified_prefix
+        return false if owner_prefix.empty?
+
+        if node.block.body
+          accumulator.body do
+            walk_method_visibilities(node.block.body, qualified_prefix, true, :public, accumulator, owner_prefix,
+                                     singleton_cref: singleton_cref)
+          end
+        end
+        true
+      end
+
+      # Issue #1984 — the slot a contest stands on for every singleton name of a class: a call that may make any of
+      # them public (`K.public_class_method(*names)`, `K.singleton_class.class_eval { … }`).
+      SINGLETON_WILDCARD_SLOT = %i[singleton *].freeze
+
+      # Issue #1984 — a class method visibility call written on a constant (`K.public_class_method(:x)`,
+      # `K.send(:public_class_method, :x)`), anywhere: each literal name is recorded public on every class the
+      # constant may name, so a reopening's or another file's `private_class_method` disagrees with it and is
+      # contested. A `K.private_class_method` is not read (the rule only declines more where it is missing). Any call
+      # on `K.singleton_class` (`send(:public, :x)`, `class_eval { … }`), or a `public_class_method` whose names are
+      # not literal, contests every singleton name of the class.
+      def record_constant_class_method_calls(node, qualified_prefix, accumulator)
+        receiver = node.receiver
+        if singleton_class_of_receiver?(receiver) && constant_receiver?(receiver.receiver)
+          each_constant_class(receiver.receiver, qualified_prefix) do |class_name|
+            accumulator.contest_class(class_name, :singleton)
+          end
+          return
+        end
+        names = constant_public_class_method_names(node)
+        return if names.nil?
+
+        each_constant_class(receiver, qualified_prefix) do |class_name|
+          next accumulator.contest_class(class_name, :singleton) if names.any?(&:nil?)
+
+          names.each do |method_name|
+            accumulator.write(class_name, method_name, :singleton, :public, node, toggled: false)
+          end
+        end
+      end
+
+      # The names a `K.public_class_method(…)` (or `K.send(:public_class_method, …)`) call on a constant names, a nil
+      # for each one that is not a literal; nil for any other call.
+      def constant_public_class_method_names(node)
+        return nil unless constant_receiver?(node.receiver)
+
+        name = node.name
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        if VISIBILITY_SEND_CALLS.include?(name) || name == :public_send
+          name = Source::Literals.symbol_or_string(arguments.first)
+          arguments = arguments.drop(1)
+        end
+        return nil unless name == :public_class_method
+
+        arguments.flat_map { |arg| arg.is_a?(Prism::ArrayNode) ? arg.elements : [arg] }
+                 .map { |arg| Source::Literals.symbol_or_string(arg) }
+      end
+
+      def constant_receiver?(node)
+        node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+      end
+
+      def each_constant_class(receiver, qualified_prefix, &)
+        constant_receiver_candidates(receiver, qualified_prefix).each(&)
+      end
+
+      # Issue #1984 — the side a body's members land on: `:singleton` in a `class << self` body or a `class_eval` on
+      # the singleton class, `:eval` in an `instance_eval` body on a class (its `def`s are singleton methods, its
+      # visibility calls instance-side), `:instance` in a class body, and nil where the singleton cannot be named.
+      def visibility_side(in_singleton_class, defs_singleton)
+        return defs_singleton == :unnameable ? nil : :singleton if in_singleton_class
+        return :eval if defs_singleton
+
+        :instance
+      end
+
+      # Issue #1984 — the key of `name`'s slot in a class's visibility table: the name on the instance side,
+      # `[:singleton, name]` on the singleton side (the envelope table's spelling).
+      def visibility_slot(name, side)
+        side == :singleton ? [:singleton, name].freeze : name
+      end
+
+      # Records the visibility a `def` gets ({#visibility_side} `side`):
+      #
+      # - a receiverless `def` takes `current_visibility` on its side; `toggled` when that is the running default
+      #   (a statement), false for one a visibility call wraps;
+      # - issue #1984 — `def self.x` (or `def K.x` in `K`'s body) is a public singleton method whatever the running
+      #   default is (`private; def self.x` is public), and writes nothing in a singleton body (it defines a method
+      #   of the singleton's singleton);
+      # - an `instance_eval` body's `def` (`:eval`) replaces a singleton method with a visibility the walk does not
+      #   read, so its singleton slot is contested.
+      def record_def_visibility(def_node, qualified_prefix, side, current_visibility, accumulator, toggled: true)
+        return if side.nil? || qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        accumulator[class_name] ||= {}
-        accumulator[class_name][def_node.name] = current_visibility
-        accumulator.wrote(class_name, def_node.name, def_node, toggled: toggled)
+        if side == :eval
+          accumulator.contest_slot(class_name, visibility_slot(def_node.name, :singleton))
+        elsif def_node.receiver.nil?
+          accumulator.write(class_name, def_node.name, side, current_visibility, def_node, toggled: toggled)
+        elsif side == :instance && self_singleton_def?(def_node, qualified_prefix)
+          accumulator.write(class_name, def_node.name, :singleton, :public, def_node, toggled: false)
+        end
+      end
+
+      def self_singleton_def?(def_node, qualified_prefix)
+        def_node.receiver.is_a?(Prism::SelfNode) || def_receiver_targets_lexical_self?(def_node.receiver,
+                                                                                       qualified_prefix)
+      end
+
+      # Issue #1984 — `def Other.x` whose receiver is not the lexical self (`def_owner`) makes `Other.x` public in
+      # whatever order the files load, so each class the constant may name has its singleton slot contested.
+      def contest_foreign_singleton_visibility(def_node, qualified_prefix, def_owner, in_singleton_class, accumulator)
+        receiver = def_node.receiver
+        return unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+        return if !in_singleton_class && def_receiver_targets_lexical_self?(receiver, def_owner)
+
+        constant_receiver_candidates(receiver, qualified_prefix).each do |name|
+          accumulator.contest_slot(name, visibility_slot(def_node.name, :singleton))
+        end
       end
 
       # Applies one `private` / `protected` / `public` call ({#visibility_call_parts}) written on the body's self
-      # and returns the running default after it:
+      # and returns the running default after it. `side` is the side its names land on: `:singleton` in a
+      # `class << self` body (issue #1984), `:instance` elsewhere.
       #
       # - no arguments — the call's visibility becomes the default for subsequent defs.
       # - `private :foo, :bar`, `private %i[foo bar]` — back-patch the named methods in the accumulator; the
       #   default does NOT change for this form.
       # - Issues #1911, #1819, #1633 — `private def foo` (endless or not) and `private attr_reader :foo` define
       #   the members with the call's visibility, whatever the running default is (`private; public def foo` is
-      #   public); `private def self.foo` changes the instance method `foo`, if one exists, so its slot is
-      #   contested.
-      # - a splat (`private(*names)`) may name any member or none (a bare toggle), so the class's slots this file
-      #   wrote so far are contested, and the statement loop reads the default after it as uncertain
+      #   public); `private def self.foo` changes the method `foo` of the side, if one exists, so its slot is
+      #   contested, and defines a public singleton `foo` (a singleton-singleton one in a `class << self` body).
+      # - a splat (`private(*names)`) may name any member or none (a bare toggle), so the class's slots on the side
+      #   this file wrote so far are contested, and the statement loop reads the default after it as uncertain
       #   ({#visibility_toggle_arguments?}).
       # - any other argument (`private memoize def foo`, `private delegate(...)`) is walked with the default
       #   uncertain, so a `def` under it is contested: the call's visibility reaches it through a return value
       #   the walk does not read.
       #
       # `walk` walks an argument the call does not consume itself.
-      def apply_visibility_call(call_node, name, args, qualified_prefix, current_visibility, accumulator,
-                                defs_singleton: false, &walk)
+      def apply_visibility_call(call_node, name, args, qualified_prefix, current_visibility, accumulator, # rubocop:disable Metrics/ParameterLists
+                                side: :instance, defs_singleton: false, &walk)
         return name if args.empty?
 
         class_name = qualified_prefix.join("::")
-        accumulator.contest_class(class_name) if args.any?(Prism::SplatNode)
+        accumulator.contest_class(class_name, side) if args.any?(Prism::SplatNode)
         args.each do |arg|
           apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator,
-                                    defs_singleton: defs_singleton, &walk)
+                                    side: side, defs_singleton: defs_singleton, &walk)
         end
         current_visibility
       end
 
-      def apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator, defs_singleton:, &walk)
+      def apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator, side:, defs_singleton:, &walk)
         case arg
         when Prism::DefNode
           if arg.receiver.nil?
-            record_def_visibility(arg, qualified_prefix, defs_singleton, name, accumulator, toggled: false)
+            def_side = side == :instance && defs_singleton ? :eval : side
+            record_def_visibility(arg, qualified_prefix, def_side, name, accumulator, toggled: false)
           else
-            accumulator.contest_slot(qualified_prefix.join("::"), arg.name)
+            accumulator.contest_slot(qualified_prefix.join("::"), visibility_slot(arg.name, side))
+            record_def_visibility(arg, qualified_prefix, defs_singleton ? :eval : side, name, accumulator,
+                                  toggled: false)
           end
         when Prism::SymbolNode, Prism::StringNode, Prism::ArrayNode
-          apply_named_visibility(arg, name, qualified_prefix, call_node, accumulator, &walk)
+          apply_named_visibility(arg, name, qualified_prefix, call_node, accumulator, side: side, &walk)
         else
           # An `instance_eval` body's wrapped attr is walked like any other argument and records nothing.
           if !defs_singleton && attr_visibility_call?(arg)
-            record_attr_visibility(arg, qualified_prefix, name, accumulator, toggled: false)
+            record_attr_visibility(arg, qualified_prefix, name, accumulator, toggled: false, side: side)
           else
             accumulator.uncertainly { walk.call(arg) }
           end
@@ -7976,16 +8394,14 @@ module Rigor
 
       # `private :foo` / `private "foo"` / `private %i[foo bar]`: each literal name the call's visibility. An array
       # element that is not a literal name is walked like any other argument.
-      def apply_named_visibility(arg, visibility, qualified_prefix, call_node, accumulator, &walk)
+      def apply_named_visibility(arg, visibility, qualified_prefix, call_node, accumulator, side: :instance, &walk)
         elements = arg.is_a?(Prism::ArrayNode) ? arg.elements : [arg]
         class_name = qualified_prefix.join("::")
         elements.each do |element|
           name = visibility_target_name(element)
           next accumulator.uncertainly { walk.call(element) } if name.nil?
 
-          accumulator[class_name] ||= {}
-          accumulator[class_name][name] = visibility
-          accumulator.wrote(class_name, name, call_node, toggled: false)
+          accumulator.write(class_name, name, side, visibility, call_node, toggled: false)
         end
       end
 
@@ -7993,30 +8409,133 @@ module Rigor
         Source::Literals.symbol_or_string(arg)
       end
 
+      CLASS_METHOD_VISIBILITIES = { private_class_method: :private, public_class_method: :public }.freeze
+      private_constant :CLASS_METHOD_VISIBILITIES
+
+      # Issue #1984 — `[visibility, arguments]` for a `private_class_method` / `public_class_method` call written on
+      # the body's self, in the spellings {#visibility_call_parts} reads (receiverless, `self.`, `send` with a
+      # literal name); nil for any other call.
+      def class_method_visibility_parts(node)
+        return nil unless node.is_a?(Prism::CallNode)
+        return nil unless node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+        name = node.name
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        if VISIBILITY_SEND_CALLS.include?(name)
+          name = Source::Literals.symbol_or_string(arguments.first)
+          arguments = arguments.drop(1)
+        end
+        visibility = CLASS_METHOD_VISIBILITIES[name]
+        visibility && [visibility, arguments]
+      end
+
+      # Issue #1984 — applies `private_class_method` / `public_class_method` to the class's singleton slots. It sets
+      # no running default (with no arguments it does nothing). A literal name (`:x`, `"x"`, `[:x]`) and a wrapped
+      # `def self.x` take the call's visibility; a wrapped receiverless `def x` defines an instance method (walked as
+      # a statement) and names the singleton `x` the walk does not see, as does any other receiver, so that slot is
+      # contested; a splat or any other argument may name any singleton method, so every singleton slot the file
+      # wrote so far for the class is contested, and the argument is walked.
+      def apply_class_method_visibility(call_node, visibility, args, qualified_prefix, accumulator, &walk)
+        class_name = qualified_prefix.join("::")
+        args.each do |arg|
+          case arg
+          when Prism::DefNode
+            if arg.receiver && self_singleton_def?(arg, qualified_prefix)
+              accumulator.write(class_name, arg.name, :singleton, visibility, call_node, toggled: false)
+            else
+              walk.call(arg)
+              accumulator.contest_slot(class_name, visibility_slot(arg.name, :singleton))
+            end
+          when Prism::SymbolNode, Prism::StringNode, Prism::ArrayNode
+            apply_named_visibility(arg, visibility, qualified_prefix, call_node, accumulator, side: :singleton) do |el|
+              accumulator.contest_class(class_name, :singleton)
+              walk.call(el)
+            end
+          else
+            accumulator.contest_class(class_name, :singleton)
+            walk.call(arg)
+          end
+        end
+      end
+
+      SINGLETON_DEFINING_CALLS = %i[define_singleton_method].freeze
+      private_constant :SINGLETON_DEFINING_CALLS
+
+      # Issue #1984 — calls in a class body that change a singleton method's visibility in a way the walk does not
+      # read, so the singleton slots they may reach are contested: `define_singleton_method(:x)` (a fresh public
+      # method; a computed name contests every singleton slot of the class), and any call on `singleton_class`
+      # (`singleton_class.send(:public, :x)`, `singleton_class.define_method(:x)`), whose literal arguments name
+      # the slots and whose other arguments may name any.
+      def contest_singleton_rewrites(node, qualified_prefix, accumulator)
+        on_singleton_class = own_singleton_class?(node.receiver)
+        return unless on_singleton_class || node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+        return unless on_singleton_class || SINGLETON_DEFINING_CALLS.include?(node.name)
+
+        class_name = qualified_prefix.join("::")
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        arguments = arguments.first(1) if SINGLETON_DEFINING_CALLS.include?(node.name)
+        arguments.each do |argument|
+          name = Source::Literals.symbol_or_string(argument)
+          if name
+            accumulator.contest_slot(class_name, visibility_slot(name, :singleton))
+          else
+            accumulator.contest_class(class_name, :singleton)
+          end
+        end
+      end
+
+      # `singleton_class` or `self.singleton_class`: the body's own singleton class.
+      def own_singleton_class?(receiver)
+        singleton_class_of_receiver?(receiver) && (receiver.receiver.nil? || receiver.receiver.is_a?(Prism::SelfNode))
+      end
+
       # Issue #1911 — an `attr_reader` / `attr_writer` / `attr_accessor` call written on the body's self records
       # each member it defines (`x`, `x=`) with `visibility`: the running default for a statement (`toggled`), the
       # wrapping call's for `private attr_accessor :x`, which Ruby applies to the `[:x, :x=]` the macro returns.
       # A non-literal name (`attr_reader(*FIELDS)`) records nothing; a call that is no such macro records nothing.
-      def record_attr_visibility(call_node, qualified_prefix, visibility, accumulator, toggled:)
-        return unless attr_visibility_call?(call_node)
-        return if qualified_prefix.empty?
+      # Issue #1989 — the names a `define_method(:x)` or an `alias_method :x, :y` call replaces. An `attr_*` call is
+      # not among them: it writes its members' slots itself ({#record_attr_visibility}).
+      def replaced_by_call(call_node)
+        return define_method_superseded_name(call_node) if call_node.name == :define_method
+
+        Source::AliasNames.alias_method_call_names(call_node)&.first(1) || []
+      end
+
+      # Issue #1989 — a `define_method` or an alias that replaces a method whose visibility slot this walk recorded
+      # gives the name a visibility the walk does not read (the running default for `define_method`, the old
+      # name's for an alias), so the slot is contested rather than left asserting the replaced `def`'s. Issue #1984
+      # — on the singleton side the slot is contested whether or not this file recorded it, since another file may
+      # have.
+      def contest_replaced_visibility(names, qualified_prefix, accumulator, side: :instance)
+        return if names.empty? || qualified_prefix.empty?
+
+        class_name = qualified_prefix.join("::")
+        recorded = accumulator[class_name]
+        names.each do |name|
+          slot = visibility_slot(name, side)
+          accumulator.contest_slot(class_name, slot) if side == :singleton || recorded&.key?(slot)
+        end
+      end
+
+      def record_attr_visibility(call_node, qualified_prefix, visibility, accumulator, toggled:, side: :instance)
+        macro = attr_macro(call_node)
+        return if macro.nil? || qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
         each_attr_macro_name(call_node) do |base|
           members = []
-          members << base unless call_node.name == :attr_writer
-          members << :"#{base}=" unless call_node.name == :attr_reader
+          members << base unless macro == :attr_writer
+          members << :"#{base}=" unless macro == :attr_reader
           members.each do |member|
-            accumulator[class_name] ||= {}
-            accumulator[class_name][member] = visibility
-            accumulator.wrote(class_name, member, call_node, toggled: toggled)
+            accumulator.write(class_name, member, side, visibility, call_node, toggled: toggled)
           end
         end
       end
 
-      # A receiverless `attr_reader` / `attr_writer` / `attr_accessor` call ({#record_attr_visibility}).
+      # An `attr_reader` / `attr_writer` / `attr_accessor` call on the body's self ({#attr_macro},
+      # {#record_attr_visibility}). Ruby 4.0.5 gives every spelling the running default visibility.
       def attr_visibility_call?(node)
-        node.is_a?(Prism::CallNode) && node.receiver.nil? && ATTR_MACROS.include?(node.name)
+        !attr_macro(node).nil?
       end
 
       # Registers the alias name in the `discovered_methods` table so `undefined-method` diagnostics are not emitted for
@@ -8131,7 +8650,8 @@ module Rigor
         return if owner.nil?
 
         singleton_class_rewritten_names(node).each do |method_name|
-          names = [method_name]
+          # `attr_writer :x` defines `x=` alone (#1936), so `x` keeps its own `def`.
+          names = node.name == :attr_writer ? [] : [method_name]
           names << :"#{method_name}=" if %i[attr_writer attr_accessor].include?(node.name)
           names.each do |name|
             record_envelope(tables.envelopes, owner, [:singleton, name], Source::ParameterEnvelope::OPAQUE)
@@ -8474,8 +8994,9 @@ module Rigor
         return if qualified_prefix.empty?
 
         kind = in_singleton_class ? :singleton : :instance
-        reader = call_node.name != :attr_writer
-        writer = call_node.name != :attr_reader
+        macro = attr_macro(call_node)
+        reader = macro != :attr_writer
+        writer = macro != :attr_reader
         class_name = qualified_prefix.join("::")
         each_attr_macro_name(call_node) do |base|
           record_method(accumulator, class_name, base, kind) if reader
@@ -8483,18 +9004,34 @@ module Rigor
         end
       end
 
-      # Yields each name an `attr_*` call declares: a Symbol or String literal argument. A non-literal one
-      # (`attr_writer(*names)`) names nothing Rigor can read.
+      # Yields each name an `attr_*` call declares ({#attr_macro}): a Symbol or String literal argument. A
+      # non-literal one (`attr_writer(*names)`, `send(:attr_writer, name)`) names nothing Rigor can read.
       def each_attr_macro_name(call_node)
-        return unless call_node.receiver.nil? # only the implicit-self macro defines on the lexical class
-        return if call_node.arguments.nil?
+        return if attr_macro(call_node).nil? || call_node.arguments.nil?
 
-        call_node.arguments.arguments.each do |arg|
+        arguments = call_node.arguments.arguments
+        arguments = arguments.drop(1) if SURFACE_SEND_CALLS.include?(call_node.name)
+        arguments.each do |arg|
           base = literal_method_name(arg)
           yield base unless base.nil?
         end
       end
 
+      # Issue #2097 — the {ATTR_MACROS} entry a call declares members with on the lexical class, or nil. The
+      # call is on the body's self, implicitly or as `self.` (`self.attr_accessor :x`), and names the macro
+      # directly or as the literal first argument of `send` / `public_send` / `__send__`
+      # (`send(:attr_accessor, :x)`); the same spellings `SigGen::Generator#attr_writer_names` reads. Any
+      # other receiver defines on another object.
+      def attr_macro(call_node)
+        return nil unless call_node.is_a?(Prism::CallNode)
+        return nil unless call_node.receiver.nil? || call_node.receiver.is_a?(Prism::SelfNode)
+        return call_node.name if ATTR_MACROS.include?(call_node.name)
+        return nil unless SURFACE_SEND_CALLS.include?(call_node.name)
+
+        macro = literal_method_name(call_node.arguments&.arguments&.first)
+        macro if ATTR_MACROS.include?(macro)
+      end
+
       # Issue #736 — the module-level accessor macros, which introduce methods on BOTH sides of the class.
       # ActiveSupport defines them on `Module`, so every class and module body can use them, and Rails codebases
       # do: `mattr_accessor` / `cattr_accessor` (an alias of it) and `class_attribute` account for 92 false
@@ -9031,7 +9568,7 @@ module Rigor
             when :contested_discovered_singleton_def_nodes
               fold_slot_contests(target.fetch(name), singleton_def_nodes, table)
             when :contested_discovered_method_visibilities
-              fold_slot_contests(target.fetch(name), method_visibilities, table)
+              fold_visibility_contests(target.fetch(name), acc[:method_visibilities], method_visibilities, table)
             else union_sibling_value(target.fetch(name), table)
             end
         end
@@ -9104,6 +9641,30 @@ module Rigor
         result.merge(file_contested)
       end
 
+      # The visibility table's {#fold_slot_contests}, where `recorded` is the table the file folds into as it stood.
+      # Issue #1984 — a singleton slot (`[:singleton, name]`) does not follow its writer: file order is not load
+      # order, so two files that give it different visibilities (`private_class_method :x` here,
+      # `class << self; public :x; end` in a reopening) leave it contested, and a contest on it stays whichever
+      # file folds later. The instance slots fold as before.
+      def fold_visibility_contests(sitting, recorded, file_slots, file_contested)
+        stale = sitting.select { |class_name, name| !name.is_a?(Array) && file_slots[class_name]&.key?(name) }
+        disagreeing = singleton_visibility_disagreements(recorded, file_slots)
+        return sitting if stale.empty? && file_contested.empty? && disagreeing.empty?
+
+        (sitting - stale).merge(file_contested).merge(disagreeing)
+      end
+
+      def singleton_visibility_disagreements(recorded, file_slots)
+        file_slots.flat_map do |class_name, table|
+          sitting = recorded[class_name]
+          next [] if sitting.nil?
+
+          table.filter_map do |slot, visibility|
+            [class_name, slot] if slot.is_a?(Array) && sitting.key?(slot) && sitting[slot] != visibility
+          end
+        end
+      end
+
       def union_paths(sitting, arriving)
         return sitting if arriving.empty?
         return arriving if sitting.empty?
@@ -9607,8 +10168,9 @@ module Rigor
       def merge_class_keyed_index_tables(acc, root, file_methods, certainty)
         file_visibilities, file_contested = build_method_visibility_tables(root, certainty: certainty)
         siblings = acc[:siblings]
-        siblings[:contested_discovered_method_visibilities] = fold_slot_contests(
-          siblings[:contested_discovered_method_visibilities], file_visibilities, file_contested
+        siblings[:contested_discovered_method_visibilities] = fold_visibility_contests(
+          siblings[:contested_discovered_method_visibilities], acc[:method_visibilities], file_visibilities,
+          file_contested
         )
         file_visibilities.each do |class_name, table|
           (acc[:method_visibilities][class_name] ||= {}).merge!(table)
@@ -11073,20 +11635,28 @@ module Rigor
         scope.local(name).nil? ? scope : scope.with_local(name, Type::Combinator.untyped)
       end
 
+      # Issue #1924 — an `if` / `elsif` / `unless` / ternary the evaluator did not enter (`[if (x ||= "d").empty?
+      # then 0 else x.upcase end]`) applies no write its condition makes, so its edges are taken from a scope where
+      # every bound local the condition writes reads `Dynamic[top]` ({#widen_condition_writes}), as
+      # {#propagate_subjectless_case} takes a `when` condition's. The condition itself reads the scope before it.
       def propagate_if_branches(node, table, current_scope)
-        truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, current_scope)
+        truthy_scope, falsey_scope = conditional_edges(node.predicate, current_scope)
         propagate(node.predicate, table, current_scope) if node.predicate
         propagate(node.statements, table, truthy_scope) if node.statements
         propagate(node.subsequent, table, falsey_scope) if node.subsequent
       end
 
       def propagate_unless_branches(node, table, current_scope)
-        truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, current_scope)
+        truthy_scope, falsey_scope = conditional_edges(node.predicate, current_scope)
         propagate(node.predicate, table, current_scope) if node.predicate
         propagate(node.statements, table, falsey_scope) if node.statements
         propagate(node.else_clause, table, truthy_scope) if node.else_clause
       end
 
+      def conditional_edges(predicate, scope)
+        Narrowing.predicate_scopes(predicate, widen_condition_writes(predicate, scope))
+      end
+
       # Issue #1495 — a `case` without a subject the evaluator did not enter (`[case; when x.nil? then 0; else x.size
       # end]`) narrows by its conditions' edges, as {StatementEvaluator#subjectless_when_scopes} does: each condition
       # under the falsey edges of the conditions before it, each clause under the join of its conditions' truthy edges,