rigortype 0.4.4 → 0.4.5

data/lib/rigor/analysis/check_rules/source_arity.rb

@@ -101,6 +101,19 @@ module Rigor
           # {#decline_unless_recorded_nowhere}): it settles by definitions, as an `ABSENT` read does.
           return settle_by_walk if @unknown
 
+          # Issue #1833 — a level the `:arity` resolver took to be the project's on a mark alone (a namespace
+          # candidate a marks-only file rewrites) stands only while that mark does, and no definition appearing or
+          # vanishing can overturn it. Only such levels file the edge: the walk's other mark reads would re-check
+          # the call whenever an unrelated namespace reuses an ancestor's last segment.
+          @levels.each do |level|
+            ([level.class_name] + level.modules).each do |name|
+              next if @scope.known_user_class?(name)
+              next unless Scope::DiscoveryIndex.declares_surface?(@scope.discovered_parameter_envelopes[name])
+
+              Analysis::DependencyRecorder.read_last_segment(:mark, name)
+            end
+          end
+
           @owner_entries.each do |name, kind|
             if kind == :singleton
               @scope.user_singleton_def_site_for(name, @method_name)
@@ -121,7 +134,8 @@ module Rigor
         # Stage 2, for the class {#owner_envelope} last answered.
         def authoritative?(class_name)
           !load_order_dependent?(class_name) && !object_extension_may_shadow? &&
-            @levels.all? { |level| clean_level?(level) && public_at?(level.class_name) } &&
+            @levels.all? { |level| clean_level?(level) && (@kind == :singleton || public_at?(level.class_name)) } &&
+            !(@kind == :singleton && singleton_private?(class_name)) &&
             chain_free_of_hooks?(class_name) &&
             subclasses_agree?(class_name, @envelope)
         end
@@ -245,8 +259,10 @@ module Rigor
         end
 
         # A module some method body hands to `obj.extend` sits ahead of the object's class, so if it defines
-        # the name at all, that object answers with the module's definition.
+        # the name at all, that object answers with the module's definition. Every bucket is read, so the answer
+        # records `mark:*`, which an object-extended mark appearing or vanishing anywhere fires (issue #1833).
         def object_extension_may_shadow?
+          Analysis::DependencyRecorder.read_name(:mark, "*") if Analysis::DependencyRecorder.active?
           @scope.discovered_parameter_envelopes.any? do |_name, bucket|
             bucket.key?(Scope::DiscoveryIndex::ENVELOPE_OBJECT_EXTENDED_MARK) && bucket.key?([:instance, @method_name])
           end
@@ -291,7 +307,9 @@ module Rigor
         end
 
         # A bucket of class marks alone (issue #1820: `x.singleton_class.prepend(Comparable)`) does not make a name
-        # the project's.
+        # the project's. The bucket is read directly rather than through `parameter_envelopes_of`: a `mark:<last>`
+        # edge recorded here fires on marks a correctly-fitting call does not depend on, so the dependency on
+        # a mark that could flip this resolution is kept at `settle_by_definitions` instead (issue #1833).
         def project_class?(name)
           @scope.known_user_class?(name) ||
             Scope::DiscoveryIndex.declares_surface?(@scope.discovered_parameter_envelopes[name])
@@ -348,6 +366,17 @@ module Rigor
           false
         end
 
+        # Issue #2059 — a call Ruby rejects as private on the singleton side (`private_class_method :two`, a private
+        # method of a module that extends itself) is `def.method-visibility-mismatch`'s, which reads the same definer;
+        # the arity is not checked. A read that declines leaves the arity to the other conditions.
+        def singleton_private?(class_name)
+          case Inference::DefinerResolution.resolve(@scope, class_name, @method_name, :singleton, question: :visibility)
+          in Inference::DefinerResolution::Known(answer:, owner: _owner) then answer == :private
+          in Inference::DefinerResolution::UNKNOWN then false
+          in Inference::DefinerResolution::ABSENT then false # rubocop:disable Lint/DuplicateBranch
+          end
+        end
+
         def public_at?(class_name)
           visibility = @scope.discovered_method_visibility(class_name, @method_name)
           visibility.nil? || visibility == :public

data/lib/rigor/analysis/check_rules/unreachable_clause_collector.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../../source/node_children"
 require_relative "../../inference/narrowing"
 require_relative "inferred_param_guard"
+require_relative "clause_coverage"
 
 module Rigor
   module Analysis
@@ -36,6 +37,10 @@ module Rigor
       # is code evidence that the subject can hold such an object (`io = STDOUT; case io when StringIO`), and Rigor's
       # reading of the subject's type is what the evidence contradicts. The body scope stays `Bot`, so no call on the
       # subject in it is checked. A subject that is a literal carrier (`x = 1; case x when String`) is still reported.
+      #
+      # Issue #1485 — the same holds for a `:prior_exhaustion` clause: on a subject that is not a literal carrier it is
+      # reported only when every class it names is at or below a class an earlier clause names ({ClauseCoverage}), so
+      # `io = STDOUT; case io when IO … when StringIO` is quiet and `when IO … when File` still reports.
       class UnreachableClauseCollector
         LOOP_OR_BLOCK_NODE_CLASSES = [
           Prism::WhileNode, Prism::UntilNode, Prism::ForNode, Prism::BlockNode
@@ -124,11 +129,13 @@ module Rigor
           return if entry_type.nil? || entry_type.is_a?(Type::Bot) || entry_type.is_a?(Type::Dynamic)
 
           keyword = node.is_a?(Prism::CaseMatchNode) ? "in" : "when"
+          coverage = ClauseCoverage.new(scope, entry_type)
           node.conditions.each do |clause|
             case clause
-            when Prism::WhenNode then collect_when(clause, subject.name)
-            when Prism::InNode then collect_in(clause, subject.name)
+            when Prism::WhenNode then collect_when(clause, subject.name, coverage)
+            when Prism::InNode then collect_in(clause, subject.name, coverage)
             end
+            coverage.record(clause)
           end
           collect_else(node.else_clause, subject.name, keyword)
         end
@@ -138,7 +145,7 @@ module Rigor
           scope&.local(subject_name)
         end
 
-        def collect_when(clause, subject_name)
+        def collect_when(clause, subject_name, coverage)
           return if clause.statements.nil? # empty body → no useful location
           return unless all_constant_conditions?(clause)
 
@@ -149,6 +156,7 @@ module Rigor
           kind = when_clause_kind(clause, subject_name)
           return if kind == :disjoint &&
                     disjoint_nominal_subject?(@scope_index[clause.conditions.first], subject_name, clause.conditions)
+          return if kind == :prior_exhaustion && !coverage.proven?(clause)
 
           @results << Result.new(
             clause: clause, body: clause.statements, subject_name: subject_name,
@@ -187,7 +195,7 @@ module Rigor
         # (prior-exhaustion — true for ANY pattern downstream of a covering set). Non-bare patterns are not
         # narrowed, so their body is `bot` ONLY under prior-exhaustion; they never produce a spurious
         # `:disjoint`.
-        def collect_in(clause, subject_name)
+        def collect_in(clause, subject_name, coverage)
           return if clause.statements.nil?
 
           scope = @scope_index[clause]
@@ -196,6 +204,7 @@ module Rigor
 
           kind = in_clause_kind(clause, subject_name)
           return if kind == :disjoint && disjoint_nominal_pattern?(clause, subject_name)
+          return if kind == :prior_exhaustion && !coverage.proven?(clause)
 
           @results << Result.new(
             clause: clause, body: clause.statements, subject_name: subject_name,

data/lib/rigor/analysis/check_rules.rb

@@ -29,6 +29,7 @@ require_relative "check_rules/void_value_use_collector"
 require_relative "check_rules/self_closedness_scanner"
 require_relative "check_rules/source_arity"
 require_relative "check_rules/lexical_method_sites"
+require_relative "check_rules/rbs_receiver_surface"
 require_relative "check_rules/special_global_setters"
 require_relative "check_rules/ruby_deprecations"
 
@@ -801,7 +802,7 @@ module Rigor
           # rule must not surface a false `undefined-method`
           # for them.
           kind = receiver_type.is_a?(Type::Singleton) ? :singleton : :instance
-          return nil if source_declared_method?(scope, class_name, call_node.name, kind)
+          return nil if source_declared_method?(scope, class_name, call_node.name, kind, call_node: call_node)
 
           return nil unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
 
@@ -817,6 +818,8 @@ module Rigor
           return nil if method_def
 
           return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites)
+          return nil if subclass_instance_may_answer?(rendered_receiver, class_name, call_node.name, scope,
+                                                      call_node.receiver)
 
           definition_site = project_definition_site(scope, class_name, call_node.name, kind)
           # Issue #735 — the site is evidence, and whose RBS this is decides what it is evidence OF. On a
@@ -951,12 +954,51 @@ module Rigor
         #   (see {#ancestry_declares_method?} for why that placement is load-bearing, not tidiness).
         def last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites = nil)
           return true if lexically_defined_method?(class_name, call_node, scope, kind, lexical_sites)
+          return true if project_patched_through_ancestors?(scope, class_name, call_node.name, kind,
+                                                            call_node: call_node)
           return true if module_mixin_receiver?(receiver_type, scope)
           return true if mixin_self_class_receiver?(call_node, scope)
           return true if unknown_mixin_includer?(class_name, scope)
           return true if object_mixin_may_define?(receiver_type, class_name, call_node.name, scope)
+          return true if ancestry_declares_method?(scope, class_name, call_node.name, kind)
 
-          ancestry_declares_method?(scope, class_name, call_node.name, kind)
+          rbs_ancestor_may_answer?(class_name, call_node.name, scope, kind)
+        end
+
+        # Issue #1722 — a `method_missing`, or a project mixin, on one of the class's RBS ancestors
+        # ({RbsReceiverSurface}). Last for {#ancestry_declares_method?}'s reason: it walks the class graph.
+        def rbs_ancestor_may_answer?(class_name, method_name, scope, kind)
+          if kind == :singleton
+            RbsReceiverSurface.singleton_hook?(scope, class_name)
+          else
+            RbsReceiverSurface.ancestor_may_answer?(scope, class_name, method_name)
+          end
+        end
+
+        # Issue #1722 — a receiver typed by its class's name, rather than by a literal, may hold an instance of a
+        # subclass (a `#: () -> String` signature admits a `MyStr < String`), so a method a project subclass
+        # defines, or a subclass's `method_missing`, may be the one that runs. A value the engine built from a
+        # literal is exactly its class and keeps firing: a literal type (`"a"`, `1`, a union of them), a shape
+        # carrier (`{a: 1}`, `[1, 2]`, `{}`, `[]`, and what folds to one), or a receiver written as a literal
+        # (`"a#{x}b"`, which types as plain `String`). A local holding an interpolated String types as plain
+        # `String` with no origin, so it still declines. Instance side only.
+        def subclass_instance_may_answer?(receiver_type, class_name, method_name, scope, receiver_node = nil)
+          return false if receiver_type.is_a?(Type::Singleton)
+          return false if exact_literal_receiver?(receiver_type) || LITERAL_RECEIVER_NODES.include?(receiver_node.class)
+
+          RbsReceiverSurface.subclass_may_define?(scope, class_name, method_name)
+        end
+
+        EXACT_TYPES = [Type::Constant, Type::Tuple, Type::HashShape].freeze
+        LITERAL_RECEIVER_NODES = [
+          Prism::StringNode, Prism::InterpolatedStringNode, Prism::XStringNode, Prism::InterpolatedXStringNode,
+          Prism::ArrayNode, Prism::HashNode, Prism::RegularExpressionNode, Prism::InterpolatedRegularExpressionNode
+        ].to_set.freeze
+        private_constant :EXACT_TYPES, :LITERAL_RECEIVER_NODES
+
+        def exact_literal_receiver?(receiver_type)
+          members = receiver_type.is_a?(Type::Union) ? receiver_type.members : [receiver_type]
+          members.all? { |member| EXACT_TYPES.any? { |kind| member.is_a?(kind) } }
         end
 
         # Issue #1697 — a module the project mixes into `Object` (a top-level `include M`, or `include M` in
@@ -1058,10 +1100,13 @@ module Rigor
         # Both paths sit at the same dispatcher precedence; the
         # check must hold them together so neither rule fires a
         # false positive.
-        def source_declared_method?(scope, class_name, method_name, kind)
+        #
+        # `call_node:` (issue #1708), when given, is the call asking: a private or protected `pre_eval:` patch
+        # it may not reach does not count ({#patch_callable?}).
+        def source_declared_method?(scope, class_name, method_name, kind, call_node: nil)
           return true if scope.discovered_method?(class_name, method_name, kind)
 
-          project_patched_method?(scope, class_name, method_name, kind)
+          project_patched_method?(scope, class_name, method_name, kind, call_node: call_node)
         end
 
         # Issue #723 — the same question as {#source_declared_method?}, asked through the project's own
@@ -1087,12 +1132,42 @@ module Rigor
         # inference (between plugins and dependency-source).
         # Returns false when the environment carries no registry
         # (legacy path) or the lookup misses.
-        def project_patched_method?(scope, class_name, method_name, kind)
+        def project_patched_method?(scope, class_name, method_name, kind, call_node: nil)
           environment = scope.environment
           registry = environment&.project_patched_methods
           return false if registry.nil? || registry.empty?
 
-          !registry.lookup(class_name: class_name.to_s, method_name: method_name.to_sym, kind: kind).nil?
+          entry = registry.lookup(class_name: class_name.to_s, method_name: method_name.to_sym, kind: kind)
+          !entry.nil? && patch_callable?(registry, entry, scope, call_node)
+        end
+
+        # Issue #1708 — {#project_patched_method?} asked through the receiver's ancestors: a `pre_eval:` patch on
+        # `Object`, `Numeric` or `Enumerable` gives an `Integer` or `Array` the method. Asked only once the
+        # receiver's RBS has come back without the method, so a nearer class's own declaration still decides arity
+        # and argument types; {#source_declared_method?} stays exact for the rules that read it for those.
+        #
+        # `call_node:` as {#source_declared_method?} reads it.
+        def project_patched_through_ancestors?(scope, class_name, method_name, kind, call_node: nil)
+          environment = scope.environment
+          registry = environment&.project_patched_methods
+          return false if registry.nil? || registry.empty?
+
+          entry = registry.lookup_through_ancestors(class_name: class_name.to_s, method_name: method_name.to_sym,
+                                                    kind: kind, rbs_loader: environment.rbs_loader)
+          !entry.nil? && patch_callable?(registry, entry, scope, call_node)
+        end
+
+        # Issue #1708 — whether `call_node` may reach the patch `entry`: Ruby raises NoMethodError for a private
+        # patch called with an explicit receiver other than `self` (`1.kp` on `module Kernel; private def kp`), and
+        # for a protected one called from outside its owner's instances. No call node, and a declined verdict (another
+        # definer the call may reach, {Inference::ProjectPatchedMethods#callable?}), are the permissive answer.
+        def patch_callable?(registry, entry, scope, call_node)
+          return true if call_node.nil?
+
+          receiver = call_node.receiver
+          verdict = registry.callable?(entry, explicit: !receiver.nil? && !receiver.is_a?(Prism::SelfNode),
+                                              self_type: scope.self_type, rbs_loader: scope.environment.rbs_loader)
+          verdict != false
         end
 
         # ADR-34 — `call.unresolved-toplevel`. Fires on an
@@ -1141,6 +1216,8 @@ module Rigor
           return nil if scope.top_level_def_for(name)
           return nil if source_declared_method?(scope, "Object", name, :instance)
           return nil if Rigor::Reflection.instance_method_definition("Object", name, scope: scope)
+          # Issue #1708 — `main` is an Object, so a `pre_eval:` patch on `Kernel` or `BasicObject` defines the name too.
+          return nil if project_patched_through_ancestors?(scope, "Object", name, :instance)
           return nil if main_singleton_method?(name, scope)
           return nil if Inference::ObjectMixins.may_define?(scope, name, receiver: :implicit)
           # `Target.class_eval { def added = 1; def use_added = added }` files the defs on Target
@@ -2143,6 +2220,7 @@ module Rigor
           return true unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
           return true unless definition_available?(member, class_name, scope)
           return true if lookup_method(member, class_name, method_name, scope)
+          return true if project_patched_through_ancestors?(scope, class_name, method_name, :instance)
 
           # Issue #723 — the arm's own RBS does not have it; its project ancestry still might. Last, for
           # the reason {#ancestry_declares_method?} carries: this is the probe that walks the class graph.
@@ -2196,12 +2274,30 @@ module Rigor
           # `compose_codepoints` typed `Hash | Hash` for an `Array`, flagging
           # `.pack`). Require at least two distinct arm classes.
           return nil if members.map { |member| concrete_class_name(member) }.uniq.size < 2
-          return nil if members.any? { |member| method_present_anywhere?(member, call_node.name, scope) }
-          return nil if refined_on_some_arm?(members, call_node, scope, lexical_sites)
+          return nil if union_may_answer?(members, call_node, scope, lexical_sites)
 
           build_undefined_method_diagnostic(path, call_node, receiver_type)
         end
 
+        # Whether some arm of a non-nil union of classes may answer the call, which keeps the union rule silent.
+        def union_may_answer?(members, call_node, scope, lexical_sites)
+          return true if members.any? { |member| method_present_anywhere?(member, call_node.name, scope) }
+          return true if members.any? { |member| arm_surface_may_answer?(member, call_node.name, scope) }
+          # Issue #1722 — `def o.m`, `o.extend(M)` and their kin give the one object the method, whatever its class.
+          return true if lexical_sites&.singleton_local_def?(call_node)
+
+          refined_on_some_arm?(members, call_node, scope, lexical_sites)
+        end
+
+        # Issue #1722 — the scalar rule's RBS-ancestor and subclass declines, asked of one arm. Kept out of
+        # {#method_present_anywhere?}, which `call.possible-nil-receiver` also asks: there a "present" answer is
+        # what lets the rule fire, and a `method_missing` on `Object` answers on the `nil` arm too.
+        def arm_surface_may_answer?(member, method_name, scope)
+          class_name = concrete_class_name(member)
+          rbs_ancestor_may_answer?(class_name, method_name, scope, :instance) ||
+            subclass_instance_may_answer?(member, class_name, method_name, scope)
+        end
+
         # ADR-121 WD7 — a refinement in effect (or one Rigor cannot read) may define the name on one arm's class.
         def refined_on_some_arm?(members, call_node, scope, lexical_sites)
           members.any? do |member|
@@ -2865,6 +2961,13 @@ module Rigor
         # - Issue #1568 — a module the class PREPENDS sits ahead of it in Ruby's order, so a definition there
         #   is what the call reaches; the class's own private `def` answers only when nothing prepended
         #   defines the name ({#reached_definer_visibility}).
+        # - Issue #1984 — a class-object receiver (`Type::Singleton`, `K.x`) is checked against the singleton side:
+        #   the definition the call reaches on `K`'s singleton chain (its own singleton methods, its extended
+        #   modules' instance methods, then the superclass's singleton chain) must be recorded `:private`
+        #   (`private_class_method`, `class << self` with `private`, a private method of an extended module).
+        # - Issue #1984 — Ruby hands a private call to `method_missing`, so a `method_missing` or
+        #   `respond_to_missing?` a project entry on the receiver's chain records, on the side the call reaches,
+        #   declines the rule ({#missing_hook_on_chain?}).
         def visibility_mismatch_diagnostic(path, call_node, scope_index, lexical_sites = nil)
           return nil unless explicit_non_self_receiver?(call_node.receiver)
 
@@ -2876,18 +2979,125 @@ module Rigor
           return nil if inferred_param_receiver?(call_node, scope)
 
           receiver_type = scope.type_of(call_node.receiver)
-          return nil unless receiver_type.is_a?(Type::Nominal)
+          case receiver_type
+          when Type::Nominal then instance_visibility_mismatch(path, call_node, scope, receiver_type, lexical_sites)
+          when Type::Singleton then singleton_visibility_mismatch(path, call_node, scope, receiver_type, lexical_sites)
+          end
+        end
 
+        def instance_visibility_mismatch(path, call_node, scope, receiver_type, lexical_sites)
           visibility = scope.discovered_method_visibility(receiver_type.class_name, call_node.name)
           return nil unless visibility == :private
 
           reached = reached_definer_visibility(scope, receiver_type.class_name, call_node.name)
           return nil if reached == :undecided
           return nil unless reached.nil? || reached == :private
+          return nil if missing_hook_on_chain?(scope, receiver_type.class_name, :instance)
           # ADR-121 WD7 — a refinement in effect (or one Rigor cannot read) may redefine the method, public.
           return nil if refined_method_in_effect?(receiver_type.class_name, call_node, scope, :instance, lexical_sites)
 
-          build_visibility_mismatch_diagnostic(path, call_node, receiver_type)
+          build_visibility_mismatch_diagnostic(path, call_node, receiver_type.class_name)
+        end
+
+        # Issue #1984 — the singleton side reads only the reached definer: a private singleton method may be inherited
+        # (`private_class_method :new` on a superclass) or come from an extended module, so there is no own-table
+        # gate as on the instance side. It reports only:
+        #
+        # - a constant receiver (`K.x`, `A::K.x`): `self.class.x` or a local may hold a subclass that makes the name
+        #   public again (`public_class_method :new`, a template-method `def self.x`);
+        # - a call inside a `def` ({#load_time_call?}): code that runs while the files load (a class body's
+        #   `ALL = [K.new]` before its `private_class_method :new`) may run before the call is private;
+        # - no class on the chain may have had every singleton name made public (`K.public_class_method(*names)`,
+        #   `K.singleton_class.class_eval { … }`; {#singleton_wildcard_contested?}).
+        def singleton_visibility_mismatch(path, call_node, scope, receiver_type, lexical_sites)
+          class_name = receiver_type.class_name
+          return nil unless call_node.receiver.is_a?(Prism::ConstantReadNode) ||
+                            call_node.receiver.is_a?(Prism::ConstantPathNode)
+          return nil unless private_singleton_candidate?(scope, call_node.name)
+          return nil if load_time_call?(scope, call_node)
+          return nil unless reached_definer_visibility(scope, class_name, call_node.name, :singleton) == :private
+          return nil if missing_hook_on_chain?(scope, class_name, :singleton)
+          return nil if singleton_wildcard_contested?(scope, class_name)
+          return nil if refined_method_in_effect?(class_name, call_node, scope, :singleton, lexical_sites)
+
+          build_visibility_mismatch_diagnostic(path, call_node, "singleton(#{class_name})")
+        end
+
+        PRIVATE_NAMES_MEMO = :rigor_check_rules_private_singleton_names
+        private_constant :PRIVATE_NAMES_MEMO
+
+        # Issue #1984 — the table-only gate the singleton side asks before it reads a chain, as the instance side asks
+        # its own table first: whether any class records `name` private, on its singleton side or on its instance
+        # side (an extended module's private method is private on the extender's singleton). Without it every
+        # `Widget.new` would read, and file the dependency edges of, the whole singleton chain. The set is memoised per
+        # discovery index.
+        def private_singleton_candidate?(scope, name)
+          discovery = scope.discovery
+          slot = Thread.current[PRIVATE_NAMES_MEMO]
+          unless slot && slot[0].equal?(discovery)
+            slot = [discovery, private_recorded_names(discovery.discovered_method_visibilities)]
+            Thread.current[PRIVATE_NAMES_MEMO] = slot
+          end
+          slot[1].include?(name.to_sym)
+        end
+
+        def private_recorded_names(tables)
+          tables.each_value.with_object(Set.new) do |table, names|
+            table.each { |slot, visibility| names << (slot.is_a?(Array) ? slot.last : slot) if visibility == :private }
+          end
+        end
+
+        # Issue #1984 — whether the call is outside every `def` the file's deferred ranges name. A `def` is named
+        # wherever it is written in a class body, at the top level or in a `class_eval` block, so a call in it is not
+        # load time and may be reported. The top level, class bodies, and blocks and lambdas that are not such a `def`
+        # (a `map { … }` or `define_method` block, a `-> { }`) are load time and decline: such code may run while the
+        # files load, before a later `private_class_method` or in a load order where the private declaration has not
+        # run yet.
+        def load_time_call?(scope, call_node)
+          rows = scope.discovered_deferred_ranges[scope.source_path]
+          return true if rows.nil?
+
+          offset = call_node.location.start_offset
+          rows.none? { |(start, finish, name, _kind, _owner)| !name.nil? && start <= offset && offset < finish }
+        end
+
+        SINGLETON_WILDCARD_SLOT = %i[singleton *].freeze
+        private_constant :SINGLETON_WILDCARD_SLOT
+
+        # Issue #1984 — whether a project class on `class_name`'s singleton chain has its wildcard singleton slot
+        # contested: a call the walk saw may have made any of its singleton methods public.
+        def singleton_wildcard_contested?(scope, class_name)
+          discovery = scope.discovery
+          chain = Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods)
+          chain.entries.any? do |entry|
+            !entry.external? && discovery.contested?(:discovered_method_visibilities,
+                                                     [entry.name, SINGLETON_WILDCARD_SLOT])
+          end
+        end
+
+        VISIBILITY_MISSING_HOOKS = %i[method_missing respond_to_missing?].freeze
+        private_constant :VISIBILITY_MISSING_HOOKS
+
+        # Issue #1984 — whether a project entry on `class_name`'s chain for `side` records a `method_missing` or
+        # `respond_to_missing?` on the side that entry stands for (a singleton entry's singleton methods, a mixin's
+        # instance methods), or the chain cannot be read whole. Ruby sends a private call to `method_missing`, so
+        # such a hook may answer it.
+        def missing_hook_on_chain?(scope, class_name, side)
+          chain = Scope::ResolutionChain.for(scope, class_name.to_s, side, :methods)
+          return true if chain.truncated?
+
+          chain.entries.any? do |entry|
+            next false if entry.external?
+
+            kind = entry.side == :singleton ? :singleton : :instance
+            VISIBILITY_MISSING_HOOKS.any? { |hook| records_hook?(scope, entry.name, hook, kind) }
+          end
+        end
+
+        def records_hook?(scope, owner, hook, kind)
+          return true if scope.discovered_method?(owner, hook, kind)
+
+          !(kind == :singleton ? scope.singleton_def_for(owner, hook) : scope.user_def_for(owner, hook)).nil?
         end
 
         # Issue #1568, ADR-119 C1c — the recorded visibility of the definition a call on `class_name` reaches: the
@@ -2899,8 +3109,8 @@ module Rigor
         # producers contest is not alone (`DefinerResolution` asks the next candidate too), so it is `:undecided`
         # there without a read of the table here. nil is nothing recording the name at all, and the class's own
         # visibility stands. An ancestor the project does not declare is passed over, as the method lookup passes it.
-        def reached_definer_visibility(scope, class_name, method_name)
-          case Inference::DefinerResolution.resolve(scope, class_name, method_name, :instance, question: :visibility)
+        def reached_definer_visibility(scope, class_name, method_name, side = :instance)
+          case Inference::DefinerResolution.resolve(scope, class_name, method_name, side, question: :visibility)
           in Inference::DefinerResolution::Known(answer:)
             answer
           in Inference::DefinerResolution::UNKNOWN
@@ -2917,14 +3127,14 @@ module Rigor
           true
         end
 
-        def build_visibility_mismatch_diagnostic(path, call_node, receiver_type)
+        def build_visibility_mismatch_diagnostic(path, call_node, receiver_name)
           Diagnostic.from_message_loc(
             call_node,
             rule: RULE_VISIBILITY_MISMATCH,
             path: path,
-            message: "private method `#{call_node.name}' called on #{receiver_type.class_name} receiver",
+            message: "private method `#{call_node.name}' called on #{receiver_name} receiver",
             severity: :error,
-            receiver_type: receiver_type.class_name,
+            receiver_type: receiver_name,
             method_name: call_node.name.to_s
           )
         end
@@ -4001,6 +4211,9 @@ module Rigor
           # prove a reduction, stay silent.
           return nil if parent_visibility.nil?
           return nil unless visibility_reduced?(parent_visibility, override_visibility)
+          # Issue #1569 — a module function's instance copy is private because `module_function` made it so; the
+          # author's intent is the public singleton copy, so that reduction is not reported.
+          return nil if scope.module_function_def?(class_name, def_node)
 
           build_override_visibility_diagnostic(
             path, def_node, parent_class, parent_visibility, override_visibility

data/lib/rigor/analysis/dependency_source_inference/walker.rb

@@ -6,6 +6,7 @@ require_relative "return_type_heuristic"
 require_relative "../../source/constant_path"
 require_relative "../../source/node_children"
 require_relative "../../inference/scope_indexer"
+require_relative "../../rooted_glob"
 
 module Rigor
   module Analysis
@@ -127,7 +128,7 @@ module Rigor
         def walk_root(root_dir, harvest, budget) # rubocop:disable Naming/PredicateMethod
           return false unless File.directory?(root_dir)
 
-          Dir.glob(File.join(root_dir, "**", "*.rb")).each do |path|
+          RootedGlob.glob(root_dir, "**/*.rb").each do |path|
             harvest_file(path, harvest, budget)
             return true if harvest.catalog.size >= budget
           end

data/lib/rigor/analysis/incremental.rb

@@ -194,6 +194,55 @@ module Rigor
         moved.freeze
       end
 
+      # Issue #1833 — the `[class name, mark]` pairs that appeared in or vanished from the class marks of the files an
+      # edit touched: a Symbol key of a `discovered_parameter_envelopes` bucket (the class-wide marks of
+      # `Scope::DiscoveryIndex`) or a `[ENVELOPE_REMOVED_KIND, name]` entry. A file may mark a class it does not declare
+      # (`x.singleton_class.prepend(Comparable)`, `o.extend(Helper)` in a method body), so neither the class-declaration
+      # diff nor a reader's edge to the declaring files sees such a mark appear or vanish.
+      #
+      # `before` and `after` are lists of envelope tables (`{class name => bucket}`): the touched files' seed-bundle
+      # tables before the edit, and the merged table of the re-parsed files after it. The diff is of their unions, which
+      # moves whenever the project's union of marks moves (the untouched files contribute the same marks to both).
+      # Returns a frozen Set of frozen `[class name, mark]` pairs.
+      def changed_class_marks(before, after)
+        (class_marks(before) ^ class_marks(after)).freeze
+      end
+
+      def class_marks(tables)
+        marks = Set.new
+        tables.each do |table|
+          table&.each do |class_name, bucket|
+            bucket.each_key { |key| marks << [class_name, key].freeze if class_mark?(key) }
+          end
+        end
+        marks
+      end
+
+      def class_mark?(key)
+        key.is_a?(Symbol) || (key.is_a?(Array) && key.first == Scope::DiscoveryIndex::ENVELOPE_REMOVED_KIND)
+      end
+
+      # Issue #1661 — the names of the classes and modules whose unpositioned mixin edges
+      # (`Scope::DiscoveryIndex#unpositioned_mixins`, `"*"` included) appeared or vanished in the files an edit
+      # touched. A file can taint a module it does not otherwise change the chain of (`module Comparable;
+      # include(*MODS); end`, `Comparable.include(x) if c`), and an external chain entry has no declaring file
+      # for a reader's edge to name. `before` and `after` are lists of `{class => {side => [names]}}` tables,
+      # diffed as unions like {changed_class_marks}. Returns a frozen Set of class names.
+      def changed_unpositioned_owners(before, after)
+        moved = unpositioned_edges(before) ^ unpositioned_edges(after)
+        moved.to_set { |(owner, _side, _name)| owner }.freeze
+      end
+
+      def unpositioned_edges(tables)
+        edges = Set.new
+        tables.each do |table|
+          table&.each do |owner, sides|
+            sides.each { |side, names| names.each { |name| edges << [owner, side, name].freeze } }
+          end
+        end
+        edges
+      end
+
       # Issue #644 — the qualified constant names whose PUBLICATION could have moved in this edit: the names
       # whose per-file census descriptor differs between the before- and after-state of any file in `paths`.
       # The value-constant twin of {appeared_classes}, and deliberately NOT its analogue — a class either