rigortype 0.4.4 → 0.4.6

data/lib/rigor/inference/scope_indexer.rb

@@ -25,6 +25,7 @@ require_relative "hash_lookup_mutation"
 require_relative "in_effect_refinements"
 require_relative "refine_census"
 require_relative "refine_self"
+require_relative "reflective_ivar_write"
 require_relative "index_write_widening"
 require_relative "module_function_state"
 require_relative "multi_target_binder"
@@ -42,6 +43,8 @@ require_relative "scope_indexer/layered_def_nestings"
 require_relative "scope_indexer/mixin_accumulator"
 require_relative "scope_indexer/certainty"
 require_relative "scope_indexer/member_layouts_collector"
+require_relative "scope_indexer/declared_ivar_types"
+require_relative "scope_indexer/declared_param_writes"
 
 module Rigor
   module Inference
@@ -111,7 +114,17 @@ module Rigor
       # nothing-to-re-anchor walk allocates none.
       EMPTY_RENAMES = {}.freeze
 
-      def index(root, default_scope:, converged_loop_recording: false, widen_clauses: false) # rubocop:disable Metrics/AbcSize
+      # No path whose contributions are all `possible` (issue #2021), the cross-file walks' default.
+      EMPTY_PATH_SET = Set.new.freeze
+
+      # `declared_ivar_types:` — whether an RBS-declared ivar type replaces the census's join of the writes (#1406).
+      # `rigor sig-gen` passes false: it proposes what the code says, and reading a declaration back would make a row
+      # count as generated only because it is declared.
+      # `ivar_writer_scope:` — the scope whose project tables the #1154 declared-parameter credit reads to find the
+      # ivar writers outside this file ({DeclaredParamWrites}); defaults to `default_scope`. `rigor sig-gen` indexes
+      # each file under an unseeded scope, so it passes one carrying the project's tables.
+      def index(root, default_scope:, converged_loop_recording: false, widen_clauses: false, # rubocop:disable Metrics/AbcSize
+                declared_ivar_types: true, ivar_writer_scope: nil)
         # Slice A-declarations. Build the declaration overrides first so every scope handed to the StatementEvaluator
         # already carries the table; structural sharing through `Scope#with_local` / `#with_fact` / `#with_self_type`
         # propagates it across every derived scope.
@@ -133,7 +146,9 @@ module Rigor
 
         # Slice 7 phase 2. Pre-pass over every class/module body to collect the per-class ivar accumulator. Seeded after
         # declared_types so the rvalue typer in the pre-pass can see declaration overrides.
-        class_ivars = build_class_ivar_index(root, seeded_scope)
+        class_ivars = DeclaredParamWrites.with_writer_scope(ivar_writer_scope) do
+          build_class_ivar_index(root, seeded_scope, declared_ivar_types: declared_ivar_types)
+        end
         seeded_scope = seeded_scope.with_discovery(seeded_scope.discovery.with(class_ivars: class_ivars))
 
         # Slice 7 phase 6. Same pre-pass shape for cvars (per class) and globals (program-wide). Globals are also
@@ -196,15 +211,27 @@ module Rigor
         # share.
         seeded_scope = seed_struct_fold_safe(seeded_scope, root).with_match_frame(root)
 
-        on_enter = ->(node, scope) { table[node] = scope }
-        StatementEvaluator.new(scope: seeded_scope, on_enter: on_enter,
-                               converged_loop_recording: converged_loop_recording,
-                               widen_clauses: widen_clauses).evaluate(root)
+        evaluate = recording_evaluator(table, converged_loop_recording, widen_clauses)
+        evaluate.call(root, seeded_scope)
 
-        propagate(root, table, seeded_scope)
+        with_unentered_evaluator(evaluate) { propagate(root, table, seeded_scope) }
         table
       end
 
+      # The `(node, scope, excluded = nil) ->` evaluation that records every node it visits into `table`, except the
+      # nodes in `excluded`: the file's own pass, and each construct {#evaluate_unentered_flow} evaluates in the walk
+      # after it.
+      def recording_evaluator(table, converged_loop_recording, widen_clauses)
+        lambda do |node, scope, excluded = nil|
+          on_enter =
+            if excluded.nil? || excluded.empty? then ->(visited, at) { table[visited] = at }
+            else ->(visited, at) { table[visited] = at unless excluded.include?(visited) }
+            end
+          StatementEvaluator.new(scope: scope, on_enter: on_enter, converged_loop_recording: converged_loop_recording,
+                                 widen_clauses: widen_clauses).evaluate(node)
+        end
+      end
+
       # Runs the combined methods/def-nodes descent (one walk of the file), seeds the discovered-methods existence table
       # onto `seeded_scope` (merged UNDER the cross-file pre-pass seed `default_scope` carries), and returns `[scope,
       # file_def_nodes, file_envelopes]` so the caller can thread the def-node and issue #992 envelope tables into
@@ -332,8 +359,10 @@ module Rigor
       # possible methods were folded already ({#seed_discovered_methods}).
       def per_file_siblings(siblings, file_def_nodes, file_siblings, file_singleton, file_visibilities)
         file_singleton_def_nodes, file_singleton_contested = file_singleton
-        siblings[:contested_discovered_method_visibilities] = fold_slot_contests(
-          siblings[:contested_discovered_method_visibilities], *file_visibilities
+        # The seed's singleton contests stay ({#fold_visibility_contests}); it already holds a disagreement between
+        # this file and another.
+        siblings[:contested_discovered_method_visibilities] = fold_visibility_contests(
+          siblings[:contested_discovered_method_visibilities], {}, *file_visibilities
         )
         siblings[:contested_discovered_def_nodes] = fold_slot_contests(
           siblings[:contested_discovered_def_nodes], file_def_nodes, file_siblings[:contested_discovered_def_nodes]
@@ -495,7 +524,7 @@ module Rigor
       # (singleton vs instance). The rvalue is typed with NO local bindings — the pre-pass lacks statement-level
       # threading — so `@x = 1` records `Constant[1]` but `@x = some_local + 1` records `Dynamic[Top]` (since
       # `some_local` is unbound at pre-pass time). Multiple writes to the same ivar union via `Type::Combinator.union`.
-      def build_class_ivar_index(root, default_scope)
+      def build_class_ivar_index(root, default_scope, declared_ivar_types: true)
         accumulator = {}
         mutated_ivars = {}
         read_before_write = {}
@@ -507,20 +536,25 @@ module Rigor
         method_assign_effects = build_method_assign_effects(root)
         walk_class_ivars(root, [], default_scope, accumulator, mutated_ivars,
                          read_before_write, init_writes, method_assign_effects)
+        reflective_opaque = accumulator.delete(REFLECTIVE_OPAQUE_CLASSES)
         exempt_class_body_writes!(init_writes, accumulator.delete(DEFINE_METHOD_WRITES) || {})
         merge_held_ivar_writes!(accumulator)
         record_aliased_ivar_mutations!(root, mutated_ivars)
         widen_mutated_ivar_entries!(accumulator, mutated_ivars)
         contribute_read_before_write_nil!(accumulator, read_before_write, init_writes)
+        make_reflective_classes_gradual!(accumulator, reflective_opaque)
+        # #1406 — an RBS `@x: T` or `attr_* x: T` declaration replaces the census's join of the writes.
+        DeclaredIvarTypes.apply!(accumulator, default_scope) if declared_ivar_types
         accumulator.transform_values(&:freeze).freeze
       end
 
       # Folds the class-body writes {#collect_class_body_ivar_writes} held under {CLASS_BODY_WRITES} into the
-      # `init_writes` exemption, except for an ivar a `define_method` block of the class writes (#1768). Such an ivar
-      # had no census entry before the block's writes were counted, so the exemption never applied to it; a
-      # class-body `@x = nil` writes the class object's ivar and says nothing about whether an instance's `@x` is set,
-      # and exempting it would seed `@x` non-nil from the block's write alone (`if @x` folding always-truthy on an
-      # instance whose `@x` is unset). It keeps the read-before-write `nil` instead, which only widens.
+      # `init_writes` exemption, except for an ivar a `define_method` block, or a `block_as_methods:` block bound to the
+      # receiver's instance ({#method_body_block_call?}), of the class writes (#1768). Such an ivar had no census entry
+      # before the block's writes were counted, so the exemption never applied to it; a class-body `@x = nil` writes
+      # the class object's ivar and says nothing about whether an instance's `@x` is set, and exempting it would seed
+      # `@x` non-nil from the block's write alone (`if @x` folding always-truthy on an instance whose `@x` is unset).
+      # It keeps the read-before-write `nil` instead, which only widens.
       def exempt_class_body_writes!(init_writes, define_method_writes)
         (init_writes.delete(CLASS_BODY_WRITES) || {}).each do |class_name, ivars|
           kept = ivars - (define_method_writes[class_name] || EMPTY_GUARDED_IVARS)
@@ -867,7 +901,7 @@ module Rigor
 
           owner = def_owner || qualified_prefix
           collect_initializer_block_ivars(node, owner, default_scope, accumulator, mutated_ivars, init_writes)
-          record_attr_writer_ivars(node, owner, accumulator) if ATTR_WRITER_MACROS.include?(node.name)
+          record_attr_writer_ivars(node, owner, accumulator) if ATTR_WRITER_MACROS.include?(attr_macro(node))
           collect_define_method_block_ivars(node, owner, default_scope, accumulator, mutated_ivars)
           false
         else
@@ -1018,8 +1052,11 @@ module Rigor
         # nodes to skip; soundness is post-domination at the top statement level, so dropping the nil never hides a real
         # runtime-nil read.
         dead_writes = dead_transient_nil_writes(def_node.body, class_name, method_assign_effects)
+        # #1154 — an `@x = x` from a declared parameter records the parameter's declared type.
+        declared = DeclaredParamWrites::EMPTY
+        declared = DeclaredParamWrites.collect(def_node, class_name, body_scope) unless singleton
         gather_ivar_writes(def_node.body, body_scope, class_name, accumulator,
-                           EMPTY_GUARDED_IVARS, mutated_ivars, dead_writes)
+                           EMPTY_GUARDED_IVARS, mutated_ivars, dead_writes, declared)
 
         # B2.3 — collect per-method evidence for the read-before- write nil contribution. The accumulator-level decision
         # ("is this ivar truly read-before-write across the class lifetime?") is finalised at
@@ -1090,14 +1127,19 @@ module Rigor
       # `owner` is empty in a `class << self` body (the call defines a class method there) and in an
       # anonymous factory body, and the block contributes nothing there. A `define_method` inside a `def`
       # body is already reached by that body's walk ({#gather_ivar_writes} enters blocks).
+      #
+      # An ADR-16 `block_as_methods:` call whose entry binds the receiver's instance (`get "/" do … end` in a
+      # `Sinatra::Base` subclass under rigor-sinatra) takes the same arm: the plugin declares that its block runs as an
+      # instance method of the receiver class, and `MacroBlockSelfType` narrows the block's `self` to that instance.
       def collect_define_method_block_ivars(node, owner, default_scope, accumulator, mutated_ivars)
         return if owner.empty?
-        return unless define_method_block_call?(node)
+
+        class_name = owner.join("::")
+        return unless method_body_block_call?(node, class_name, default_scope)
 
         block = node.block
         return unless block.body
 
-        class_name = owner.join("::")
         body_scope = census_body_scope(default_scope, owner, Type::Combinator.nominal_of(class_name))
         gather_ivar_writes(block.body, body_scope, class_name, accumulator, EMPTY_GUARDED_IVARS, mutated_ivars)
         written = (accumulator[DEFINE_METHOD_WRITES] ||= {})[class_name] ||= Set.new
@@ -1115,6 +1157,8 @@ module Rigor
              Prism::InstanceVariableTargetNode
           acc << node.name
         end
+        reflective = ReflectiveIvarWrite.literal_name(node)
+        acc << reflective if reflective
         node.rigor_each_child { |child| define_method_written_ivars(child, acc) }
       end
 
@@ -1243,6 +1287,25 @@ module Rigor
         DefineMethodBlockSelf.define_method_on_lexical_self?(node) && node.block.is_a?(Prism::BlockNode)
       end
 
+      # A call with a literal block on the implicit or `self` receiver whose block is an instance method body of
+      # `class_name`, the class the walk is in (#1768): `define_method`, or a call an ADR-16 `block_as_methods:` entry
+      # declares runs its block as an instance method of the receiver class ({MacroBlockSelfType}). The entry is
+      # matched on `Singleton[class_name]`, the receiver such a call has in the class body, through the same
+      # receiver-ancestry match the evaluator narrows the block's `self` with, so the census counts exactly the blocks
+      # whose `self` is narrowed to the instance.
+      #
+      # The class-body walk ({#collect_class_body_ivar_writes}) still records a `block_as_methods:` block's writes as
+      # class-body writes, and {#exempt_class_body_writes!} takes back every ivar such a block writes.
+      def method_body_block_call?(node, class_name, scope)
+        return true if define_method_block_call?(node)
+        return false unless node.block.is_a?(Prism::BlockNode)
+        return false unless scope && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+
+        MacroBlockSelfType.runs_as_receiver_instance_method?(
+          scope: scope, call_node: node, receiver_type: Type::Combinator.singleton_of(class_name)
+        )
+      end
+
       def detect_read_before_write(node, seen_writes, read_first)
         return unless node.is_a?(Prism::Node)
         return if IVAR_BARRIER_NODES.any? { |klass| node.is_a?(klass) }
@@ -1270,6 +1333,9 @@ module Rigor
         end
 
         seen_writes << node.name if IVAR_WRITE_NODES.any? { |klass| node.is_a?(klass) }
+        # #1931 — a literal `instance_variable_set` is a write too; its value argument, read above, runs first.
+        reflective = ReflectiveIvarWrite.literal_name(node)
+        seen_writes << reflective if reflective
       end
 
       # Records each ivar target of a `MultiWriteNode` / nested `MultiTargetNode` into `seen_writes`, and descends into
@@ -1306,17 +1372,18 @@ module Rigor
       private_constant :TAIL_VALUE_DEPTH_CAP
       private_constant :EMPTY_GUARDED_IVARS
 
-      def gather_ivar_writes(node, scope, class_name, accumulator, guarded_ivars = EMPTY_GUARDED_IVARS,
-                             mutated_ivars = nil, dead_writes = nil)
+      def gather_ivar_writes(node, scope, class_name, accumulator, guarded_ivars = EMPTY_GUARDED_IVARS, # rubocop:disable Metrics/ParameterLists
+                             mutated_ivars = nil, dead_writes = nil, declared = DeclaredParamWrites::EMPTY)
         return unless node.is_a?(Prism::Node)
 
         if node.is_a?(Prism::InstanceVariableWriteNode)
           unless dead_writes&.include?(node.object_id)
             record_ivar_write(node, scope, class_name, accumulator,
-                              guarded: guarded_ivars.include?(node.name))
+                              guarded: guarded_ivars.include?(node.name), declared: declared[node])
           end
         else
           record_compound_ivar_write(node, scope, class_name, accumulator)
+          record_reflective_ivar_write(node, scope, class_name, accumulator)
         end
 
         # N1 — parallel / multiple assignment (`old, @cb = @cb, block`, `@i, @o, @e, @thr = Open3.popen3(cmd)`). A
@@ -1335,12 +1402,38 @@ module Rigor
 
         if node.is_a?(Prism::IfNode) || node.is_a?(Prism::UnlessNode)
           walk_conditional_ivar_writes(node, scope, class_name, accumulator, guarded_ivars,
-                                       mutated_ivars, dead_writes)
+                                       mutated_ivars, dead_writes, declared)
           return
         end
 
         node.rigor_each_child do |c|
-          gather_ivar_writes(c, scope, class_name, accumulator, guarded_ivars, mutated_ivars, dead_writes)
+          gather_ivar_writes(c, scope, class_name, accumulator, guarded_ivars, mutated_ivars, dead_writes, declared)
+        end
+      end
+
+      # #1931 — `instance_variable_set` on `self` writes an ivar no write node shows ({ReflectiveIvarWrite}). A literal
+      # name (`instance_variable_set(:@k, v)`) contributes the value's type to that ivar's entry, as `@k = v` would. A
+      # name the analysis cannot read (`instance_variable_set(:"@#{k}", v)`, the options-hash constructor idiom) may
+      # write any ivar of the class, so every entry of the class turns gradual once the walk ends
+      # ({#make_reflective_classes_gradual!}): a reader in another method otherwise kept a write's literal (`@timeout =
+      # 5` read as `5`) and reported a call on it.
+      def record_reflective_ivar_write(node, scope, class_name, accumulator)
+        return unless ReflectiveIvarWrite.self_write?(node)
+
+        name = ReflectiveIvarWrite.literal_name(node)
+        if name
+          accumulate_ivar_type(accumulator, class_name, name, scope.type_of(ReflectiveIvarWrite.value_node(node)))
+        else
+          (accumulator[REFLECTIVE_OPAQUE_CLASSES] ||= Set.new) << class_name
+        end
+      end
+
+      def make_reflective_classes_gradual!(accumulator, classes)
+        classes&.each do |class_name|
+          entries = accumulator[class_name]
+          next if entries.nil?
+
+          accumulator[class_name] = entries.transform_values { Type::Combinator.untyped }
         end
       end
 
@@ -1390,22 +1483,22 @@ module Rigor
       # init; end` would otherwise be marked too — but that pattern (write @x in the else of `if @x`) is a separate
       # idiom whose surrounding reads of `@x` would then surface a nil-receiver FP. The ELSE branch is left ungarded so
       # those reads continue to type as they did before this fix.
-      def walk_conditional_ivar_writes(node, scope, class_name, accumulator, guarded_ivars,
-                                       mutated_ivars = nil, dead_writes = nil)
+      def walk_conditional_ivar_writes(node, scope, class_name, accumulator, guarded_ivars, # rubocop:disable Metrics/ParameterLists
+                                       mutated_ivars = nil, dead_writes = nil, declared = DeclaredParamWrites::EMPTY)
         then_guards = then_body_guarded_ivars(node)
         then_guarded = then_guards.empty? ? guarded_ivars : (guarded_ivars | then_guards)
 
         gather_ivar_writes(node.predicate, scope, class_name, accumulator, guarded_ivars,
-                           mutated_ivars, dead_writes)
+                           mutated_ivars, dead_writes, declared)
         if node.statements
           gather_ivar_writes(node.statements, scope, class_name, accumulator, then_guarded,
-                             mutated_ivars, dead_writes)
+                             mutated_ivars, dead_writes, declared)
         end
         branch = node.is_a?(Prism::IfNode) ? node.subsequent : node.else_clause
         return unless branch
 
         gather_ivar_writes(branch, scope, class_name, accumulator, guarded_ivars,
-                           mutated_ivars, dead_writes)
+                           mutated_ivars, dead_writes, declared)
       end
 
       # Returns the set of ivar names that, in the THEN body of this conditional, are statically known to be in a nil /
@@ -1882,8 +1975,8 @@ module Rigor
         assigns.include?(target)
       end
 
-      def record_ivar_write(node, scope, class_name, accumulator, guarded: false)
-        rvalue_type = scope.type_of(node.value)
+      def record_ivar_write(node, scope, class_name, accumulator, guarded: false, declared: nil)
+        rvalue_type = declared || scope.type_of(node.value)
 
         # `@x = nil unless @x` / `@y = false unless @y` — follow-up to the polarity-aware defensive-init guard fix
         # (ROADMAP § Future cycles — "Defensive ivar-init with nil / false rvalue"). When the rvalue is itself a falsey
@@ -2087,7 +2180,9 @@ module Rigor
       # accumulator), and the class-body writes held out of `init_writes` until {#exempt_class_body_writes!}.
       DEFINE_METHOD_WRITES = :define_method_writes
       CLASS_BODY_WRITES = :class_body_writes
-      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES
+      # The classes a computed-name `instance_variable_set` may write any ivar of ({#record_reflective_ivar_write}).
+      REFLECTIVE_OPAQUE_CLASSES = :reflective_opaque_classes
+      private_constant :DEFINE_METHOD_WRITES, :CLASS_BODY_WRITES, :REFLECTIVE_OPAQUE_CLASSES
 
       # Unions `type` into the class-ivar accumulator for `(class_name, ivar_name)`. Shared by the single-write and
       # multi-write (parallel-assignment) collectors.
@@ -3369,7 +3464,17 @@ module Rigor
       # walk worked out for it ({#refine_context}).
       MethodTables = Struct.new(:existence, :envelopes, :refinements, :certainty, :certain, :possible,
                                 :contested_envelopes, :contested_def_nodes, :root, :in_effect, :census,
-                                :refine_text, :literal_seen, :source_bytes, :loose_constants, :block_spans) do
+                                :refine_text, :literal_seen, :source_bytes, :loose_constants, :block_spans,
+                                :definer_history) do
+        # Issue #2006 — records, in walk order, that a definer other than an alias wrote the instance method `name`
+        # of `class_name` at `node`: `def_node` for a `def`, nil for a `define_method(:x)` or an `attr_*` reader or
+        # writer, and whether the write is {#certain}. {ScopeIndexer#apply_alias_def_nodes} reads the history to copy
+        # what an alias's old name held at the alias, and to tell an alias a later definer replaced.
+        def wrote_definer(class_name, name, node, def_node)
+          entry = [node.location.start_offset, def_node, certain ? true : false].freeze
+          ((self.definer_history ||= {})[[class_name, name]] ||= []) << entry
+        end
+
         # {ScopeIndexer.module_refine_target} against this tree's {InEffectRefinements}.
         def refine_target_of(node)
           return nil if ScopeIndexer.refine_target(node).nil?
@@ -4088,6 +4193,10 @@ module Rigor
                  (singleton_cref && owner_prefix.empty?)
             record_alias_or_undef(node, owner_prefix, in_singleton_class || defs_singleton,
                                   methods_acc.at(node))
+            if node.is_a?(Prism::AliasMethodNode) && !(in_singleton_class || defs_singleton)
+              supersede_def_nodes(Array(Source::AliasNames.keyword_names(node)&.first), owner_prefix,
+                                  def_nodes_acc, methods_acc.at(node))
+            end
           end
           return
         when Prism::SymbolNode
@@ -4102,6 +4211,11 @@ module Rigor
           end
           anonymous = record_call_node_methods(node, owner_prefix, in_singleton_class, methods_acc.at(node),
                                                source_path)
+          unless in_singleton_class
+            superseded = call_superseded_names(node)
+            supersede_def_nodes(superseded, owner_prefix, def_nodes_acc, methods_acc.at(node))
+            note_call_definers(node, superseded, owner_prefix, methods_acc.at(node))
+          end
           tables = methods_acc.at(node)
           record_singleton_prepend(node, qualified_prefix, tables,
                                    self_ok: node.name == :prepend && tables.in_block?(node))
@@ -4171,11 +4285,40 @@ module Rigor
       def record_declaration_facts(node, child_prefix, tables)
         if node.is_a?(Prism::ClassNode)
           record_meta_superclass_members(node, child_prefix, tables)
+          record_constructed_superclass(node.superclass, child_prefix.join("::"), tables)
         else
           record_surface_mark(tables, child_prefix.join("::"), Scope::DiscoveryIndex::ENVELOPE_MODULE_MARK)
         end
       end
 
+      # Issue #1979 — `class K < Data.define(:a)`, `< Struct.new(:a)` or `< Class.new(Parent)`: the superclass table
+      # records `nil` for K, so a subclass walk enumerates it under every class. Each constant the expression names
+      # (the factory's receiver, and `Class.new`'s argument, or `Object` for none) takes a
+      # `[ENVELOPE_CONSTRUCTED_KIND, name]` entry; an expression of any other shape records none.
+      def record_constructed_superclass(superclass, class_name, tables)
+        names = constructed_superclass_names(superclass)
+        names&.each do |name|
+          record_envelope(tables.envelopes, class_name, [Scope::DiscoveryIndex::ENVELOPE_CONSTRUCTED_KIND, name],
+                          Source::ParameterEnvelope::OPAQUE)
+        end
+      end
+
+      def constructed_superclass_names(node)
+        return ["Data"] if meta_call_with_name?(node, :Data, :define)
+        return ["Struct"] if meta_call_with_name?(node, :Struct, :new)
+        return nil unless class_new_call?(node)
+
+        arguments = node.arguments&.arguments || []
+        return %w[Class Object] if arguments.empty?
+        return nil unless arguments.one?
+
+        argument = arguments.first
+        inner = if argument.is_a?(Prism::ConstantReadNode) then [argument.name.to_s]
+                else constructed_superclass_names(argument)
+                end
+        inner && ["Class", *inner]
+      end
+
       # The block form of a meta-new constant write: its members, and the module mark `Module.new` earns.
       # Issue #1820 — `K = Class.new(Parent)`, with or without a block, names a class whose superclass the superclass
       # table leaves out; it takes {Scope::DiscoveryIndex::ENVELOPE_META_SUPERCLASS_MARK}.
@@ -4214,7 +4357,7 @@ module Rigor
       # descent.
       def record_call_node_methods(node, qualified_prefix, in_singleton_class, methods_acc, source_path)
         record_define_method(node, qualified_prefix, in_singleton_class, methods_acc) if node.name == :define_method
-        record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc) if ATTR_MACROS.include?(node.name)
+        record_attr_methods(node, qualified_prefix, in_singleton_class, methods_acc) if attr_macro(node)
         record_module_attr_methods(node, qualified_prefix, methods_acc) if MODULE_ATTR_MACROS.key?(node.name)
         record_alias_method_call(node, qualified_prefix, in_singleton_class, methods_acc)
         record_surface_evidence(node, qualified_prefix, methods_acc)
@@ -4711,6 +4854,7 @@ module Rigor
         accumulator[class_name] ||= {}
         accumulator[class_name][def_node.name] = def_node
         follow_slot_writer(tables, :contested_def_nodes, [class_name, def_node.name], tables.nil? || tables.certain)
+        tables&.wrote_definer(class_name, def_node.name, def_node, def_node)
         record_anonymous_body_def_as_toplevel(def_node, qualified_prefix, accumulator, tables)
       end
 
@@ -4727,6 +4871,59 @@ module Rigor
         end
       end
 
+      # Issue #1989 — the instance method names a non-`def` definer written on the class body's self replaces:
+      # each reader (and `x=` writer) an `attr_*` call declares, a literal `define_method(:x)`, and the new name of
+      # an `alias_method :x, :y` call. A non-literal name replaces nothing Rigor can name.
+      def call_superseded_names(call_node)
+        if (macro = attr_macro(call_node))
+          names = []
+          each_attr_macro_name(call_node) do |base|
+            names << base unless macro == :attr_writer
+            names << :"#{base}=" unless macro == :attr_reader
+          end
+          names
+        elsif call_node.name == :define_method
+          define_method_superseded_name(call_node)
+        else
+          Source::AliasNames.alias_method_call_names(call_node)&.first(1) || []
+        end
+      end
+
+      def define_method_superseded_name(call_node)
+        return [] unless call_node.receiver.nil? || call_node.receiver.is_a?(Prism::SelfNode)
+
+        name = literal_method_name(call_node.arguments&.arguments&.first)
+        name.nil? ? [] : [name.to_sym]
+      end
+
+      # Issue #1989 — a definer that is not a `def` replaces the method an earlier `def` of the same name in this walk
+      # installed: `def x = 1; attr_reader :x` answers the attr reader, so the `def` body must not type the call. The
+      # slot keeps the `def` and is contested, certain definer or possible, so the readers that re-type a body
+      # decline. The slot is not emptied: the file still writes it, so a sibling file's `def` of the name (which the
+      # cross-file seed and the project fold would otherwise put there) cannot fill it. A `def` written after the
+      # definer writes the slot again and clears the contest.
+      def supersede_def_nodes(names, qualified_prefix, accumulator, tables)
+        return if names.empty?
+
+        class_name = qualified_prefix.join("::")
+        slot = accumulator[class_name]
+        return if slot.nil?
+
+        names.each do |name|
+          follow_slot_writer(tables, :contested_def_nodes, [class_name, name], false) if slot.key?(name)
+        end
+      end
+
+      # Issue #2006 — a `define_method(:x)` or `attr_*` call is a definer the alias pass reads in source order
+      # ({#apply_alias_def_nodes}). An `alias_method` call, whose new name {#call_superseded_names} also lists, is
+      # itself an alias: the pass records its copy, so the history must not hold it as a definer with no `def`.
+      def note_call_definers(call_node, names, qualified_prefix, tables)
+        return if names.empty? || qualified_prefix.empty? || call_node.name == :alias_method
+
+        class_name = qualified_prefix.join("::")
+        names.each { |name| tables.wrote_definer(class_name, name, call_node, nil) }
+      end
+
       # #319 — a `def` inside an anonymous `Class.new` / `Module.new` body ALSO stays in the `<toplevel>` table.
       # Before the anonymous class had a name the body was walked with an empty prefix, so every such `def`
       # landed there; that is the same leniency this key already grants a `def` nested in any other DSL block
@@ -4772,6 +4969,18 @@ module Rigor
       # The singleton walk's accumulator: the `{class => {name => DefNode}}` table, plus the contested slots, which
       # follow each slot's writer ({#follow_slot_writer}'s rule).
       class SingletonDefTable < Hash
+        # Issue #1936 — contests the slots of `names` (every slot of `class_name` for `:all`) that an earlier write
+        # filled: a later non-`def` definer replaced the `def` they hold. The slot keeps the `def`, as
+        # {ScopeIndexer#supersede_def_nodes} keeps the instance one, and a later write clears the contest.
+        def supersede(class_name, names)
+          slot = self[class_name]
+          return if slot.nil?
+
+          (names == :all ? slot.keys : names).each do |name|
+            (@contested ||= Set.new) << [class_name, name] if slot.key?(name)
+          end
+        end
+
         def track(certainty)
           @certainty = certainty
           @contested = nil
@@ -4779,9 +4988,11 @@ module Rigor
         end
 
         # Writes the slot; `node` and `other` are the contributions the write rests on, possible when either is.
-        def write(class_name, name, def_node, node, other = nil)
+        # `possible` says the write rests on a fact the contributions do not carry (a module_function copy after a
+        # reset that may not run, #1968).
+        def write(class_name, name, def_node, node, other = nil, possible: false)
           (self[class_name] ||= {})[name] = def_node
-          if Certainty.possible?(@certainty, node) || (other && Certainty.possible?(@certainty, other))
+          if possible || Certainty.possible?(@certainty, node) || (other && Certainty.possible?(@certainty, other))
             (@contested ||= Set.new) << [class_name, name]
           else
             @contested&.delete([class_name, name])
@@ -4824,6 +5035,12 @@ module Rigor
       # `Const`'s singleton class (a `remove_method`, a `def`) without declaring `Const`, so it stays out of
       # `class_sources` (whose readers take a name there as one the project declares) and joins only the per-file
       # class-declaration sets the incremental `class:` edges diff (`Runner#class_declarations`).
+      #
+      # Issue #1941 — so does a `def Const.x` (`def D.own`, or `def E.x` inside `module M`, resolved as a `class << E`
+      # receiver is): it adds to `Const`'s singleton side from a file the reader's class edge need not name. In the set,
+      # the declaration diff fires `class:` when the file gains or loses one, and
+      # `IncrementalSession#singleton_rewrite_affected` fires it when one is renamed. `def (M::E).x` records no
+      # singleton `def` at all, so it joins nothing.
       def record_singleton_class_sources(sources, path, root)
         collect_singleton_class_targets(root, []) { |name| (sources[name] ||= Set.new) << path }
       end
@@ -4839,6 +5056,8 @@ module Rigor
           yield eval_constant_receiver_prefix(node, node.expression, rendered, lexical_prefix).join("::") if rendered
         when Prism::CallNode
           yield_singleton_side_constant(node, node.receiver, lexical_prefix, &) if singleton_side_call?(node)
+        when Prism::DefNode
+          yield_singleton_side_constant(node, node.receiver, lexical_prefix, &)
         end
         node.rigor_each_child { |child| collect_singleton_class_targets(child, lexical_prefix, &) }
       end
@@ -4846,8 +5065,7 @@ module Rigor
       # A call on a constant that may rewrite its singleton side (`Const.singleton_class`,
       # `Const.define_singleton_method`, `Const.extend(M)`, `Const.instance_eval { … }`) records facts about `Const`'s
       # singleton methods the refinement walk reads from a file that need not declare `Const`, so the file joins the
-      # constant's set too. Written inside `Const`'s own body, the name is in the file's set already; a `def Const.x`
-      # files its own `method:` key.
+      # constant's set too. Written inside `Const`'s own body, the name is in the file's set already.
       def singleton_side_call?(node)
         node.name == :singleton_class || surface_rewriting_call?(node)
       end
@@ -4871,7 +5089,7 @@ module Rigor
       # nested `def` or block inside its body is still a range the containment half needs.
       # `def_owner_prefix` is the eval-body override described on {#walk_methods_and_def_nodes}:
       # an explicit owner for def rows while declarations stay lexical (`[]` = ownerless).
-      def walk_deferred_ranges(node, qualified_prefix, in_singleton_class, inside_deferred, # rubocop:disable Metrics/ParameterLists
+      def walk_deferred_ranges(node, qualified_prefix, in_singleton_class, inside_deferred, # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
                                mf_offsets, ranges, def_owner_prefix = nil, singleton_cref: false,
                                defs_singleton: false)
         return unless node.is_a?(Prism::Node)
@@ -4907,11 +5125,34 @@ module Rigor
                                       singleton_cref: singleton_cref)
         end
 
+        record_definer_name_row(node, ranges) if node.is_a?(Prism::CallNode)
         walk_deferred_children(node, qualified_prefix, in_singleton_class, inside_deferred,
                                mf_offsets, ranges, def_owner_prefix, singleton_cref: singleton_cref,
                                                                      defs_singleton: defs_singleton)
       end
 
+      DEFINER_NAME_CALLS = Set[:define_method, :define_singleton_method, :alias_method].freeze
+      DEFINER_SEND_CALLS = Set[:send, :__send__, :public_send].freeze
+      private_constant :DEFINER_NAME_CALLS, :DEFINER_SEND_CALLS
+
+      # Issue #2184 — a `define_method` / `define_singleton_method` / `alias_method` call with a literal (new) name,
+      # on any receiver and through `send` too, records an ownerless, kindless row over the name literal: no owner or
+      # side is claimed, so no ordering scan matches it and the literal contains no call. It only tells a by-name
+      # reader that the project gives the name a body no def table holds. A computed name records nothing.
+      def record_definer_name_row(node, ranges)
+        arguments = node.arguments&.arguments || []
+        if DEFINER_SEND_CALLS.include?(node.name)
+          return unless DEFINER_NAME_CALLS.include?(literal_method_name(arguments.first))
+
+          arguments = arguments.drop(1)
+        end
+        return unless DEFINER_NAME_CALLS.include?(node.name) || DEFINER_SEND_CALLS.include?(node.name)
+
+        argument = arguments.first
+        name = literal_method_name(argument)
+        ranges << [argument.location.start_offset, argument.location.end_offset, name, nil, nil] if name
+      end
+
       # The `def` arm of {#walk_deferred_ranges}: records the range row — singleton-side when the
       # def sits in a `class <<` body or an `instance_eval` block (`defs_singleton`) — then walks
       # the body as a deferred range.
@@ -5062,7 +5303,7 @@ module Rigor
       # own `def` leaves additionally split on {INSTANCE_EVAL_CALLS}, whose `def`s bind on the
       # receiver's singleton rather than the receiver.
       def receiver_eval_call?(node)
-        node.block.is_a?(Prism::BlockNode) && RECEIVER_EVAL_CALLS.include?(node.name)
+        node.is_a?(Prism::CallNode) && node.block.is_a?(Prism::BlockNode) && RECEIVER_EVAL_CALLS.include?(node.name)
       end
 
       # A `class_eval` / `module_eval` / `class_exec` / `module_exec` block is NOT deferred: it runs
@@ -5422,7 +5663,9 @@ module Rigor
                               mf_offsets, ranges)
         start = def_node.location.start_offset
         if inside_deferred
-          ranges << [start, def_node.location.end_offset, nil, nil, nil]
+          # Issue #2184 — the def installs at invocation under a `self` the walk does not know, so the row names the
+          # method but claims no owner or side.
+          ranges << [start, def_node.location.end_offset, def_node.name, nil, nil]
           return
         end
 
@@ -5445,7 +5688,10 @@ module Rigor
                                    def_owner_prefix = nil, singleton_cref: false,
                                    defs_singleton: false)
         return unless node.is_a?(Prism::Node)
-        if node.is_a?(Prism::CallNode) && receiver_eval_call?(node)
+
+        supersede_singleton_def_nodes(node, qualified_prefix, in_singleton_class, defs_singleton, accumulator,
+                                      def_owner_prefix)
+        if receiver_eval_call?(node)
           return walk_eval_singleton_defs(node, qualified_prefix, in_singleton_class, accumulator,
                                           def_owner_prefix, singleton_cref: singleton_cref,
                                                             defs_singleton: defs_singleton)
@@ -5736,7 +5982,8 @@ module Rigor
                               defs_singleton: false)
         owner_prefix = def_owner_prefix || qualified_prefix
         statements = statements_of(body)
-        ModuleFunctionState.each_singleton_sibling(statements) do |stmt, module_function_on, named_call|
+        conditional = ModuleFunctionState.conditional_clause_statements(body)
+        ModuleFunctionState.each_singleton_sibling(statements, conditional) do |stmt, module_function_on, named_call|
           if named_call
             # `:unnameable` — the named defs the call copies live on the metaclass,
             # which this table cannot name either.
@@ -5786,19 +6033,96 @@ module Rigor
         statements
       end
 
+      # `module_function_on` is {ModuleFunctionState.each_singleton_sibling}'s: `:uncertain` writes the module
+      # function's copy as possible, so the slot holds the later def, contested, rather than the def the
+      # slot held before (#1968).
       def record_singleton_def_node(def_node, qualified_prefix, in_singleton_class, module_function_on, accumulator)
-        singleton = def_singleton?(def_node, qualified_prefix, in_singleton_class) || module_function_on
-        return unless singleton
+        declared = def_singleton?(def_node, qualified_prefix, in_singleton_class)
+        return unless declared || module_function_on
         return if qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        write_singleton_slot(accumulator, class_name, def_node.name, def_node, def_node)
+        write_singleton_slot(accumulator, class_name, def_node.name, def_node, def_node,
+                             possible: !declared && module_function_on == :uncertain)
+      end
+
+      # Issue #1936 — the singleton twin of {#supersede_def_nodes}: a definer that is not a `def` replaces the
+      # singleton method an earlier `def self.x` of the walk installed, so the slot is contested and the typing read
+      # declines instead of re-typing the replaced body. The definers, each written on the class's own singleton
+      # class: `singleton_class.alias_method` / `define_method` / `remove_method` / `undef_method` / `attr_*` and its
+      # `class_eval` family and `send` (bare, `self.` or a constant's `singleton_class`), `define_singleton_method`,
+      # and in a `class << self` body the receiverless calls of the same names with `alias` and `undef`. Certain or
+      # possible alike; a call whose rewritten names are not all literal contests every slot the owner holds so far.
+      # Under an `instance_eval` split (`defs_singleton`) only `alias` and `undef` bind on the singleton; its calls
+      # stay instance-side.
+      def supersede_singleton_def_nodes(node, qualified_prefix, in_singleton_class, defs_singleton, accumulator,
+                                        def_owner_prefix)
+        return unless accumulator.is_a?(SingletonDefTable) && defs_singleton != :unnameable
+
+        owner_prefix = def_owner_prefix || qualified_prefix
+        current = owner_prefix.empty? ? nil : owner_prefix.join("::")
+        owner, names =
+          case node
+          when Prism::AliasMethodNode, Prism::UndefNode
+            [current, singleton_keyword_names(node)] if in_singleton_class || defs_singleton == true
+          when Prism::CallNode
+            singleton_call_target(node, qualified_prefix, current, in_singleton_class)
+          end
+        accumulator.supersede(owner, names) if owner && names
+      end
+
+      def singleton_keyword_names(node)
+        return literal_names_or_all(node.names) if node.is_a?(Prism::UndefNode)
+
+        names = Source::AliasNames.keyword_names(node)
+        names ? names.first(1) : :all
+      end
+
+      # `[owner, names]` for a singleton definer call {#supersede_singleton_def_nodes} reads, or nil.
+      def singleton_call_target(node, qualified_prefix, current, in_singleton_class)
+        receiver = node.receiver
+        if !in_singleton_class && singleton_class_of_receiver?(receiver)
+          [singleton_class_owner(node, receiver.receiver, qualified_prefix, current), singleton_naming_call_names(node)]
+        elsif receiver.nil? || receiver.is_a?(Prism::SelfNode)
+          [current, in_singleton_class ? singleton_naming_call_names(node) : define_singleton_method_names(node)]
+        end
+      end
+
+      # The singleton names a naming call on the singleton class replaces, `:all` where they are not all literal,
+      # or nil for another call. `attr_writer` replaces only `x=`, `attr_reader` only `x`. A `class_eval`-family or
+      # `send` call may replace any name, so it is `:all`.
+      def singleton_naming_call_names(node)
+        arguments = node.arguments&.arguments || []
+        case node.name
+        when *SURFACE_EVAL_CALLS, *SURFACE_SEND_CALLS then :all
+        when :alias_method then literal_names_or_all(arguments.first(1))
+        when :define_method then define_singleton_method_names(node, :define_method)
+        when :remove_method, :undef_method then literal_names_or_all(arguments)
+        when *ATTR_MACROS
+          names = literal_names_or_all(arguments)
+          return names if names == :all
+
+          names.flat_map do |base|
+            [(base unless node.name == :attr_writer), (:"#{base}=" unless node.name == :attr_reader)].compact
+          end
+        end
+      end
+
+      def define_singleton_method_names(node, call = :define_singleton_method)
+        return nil unless node.name == call
+
+        literal_names_or_all(node.arguments&.arguments&.first(1) || [])
+      end
+
+      def literal_names_or_all(arguments)
+        names = arguments.map { |argument| literal_method_name(argument) }
+        names.empty? || names.any?(&:nil?) ? :all : names
       end
 
       # One singleton slot write, through {SingletonDefTable#write} when the walk tracks certainty.
-      def write_singleton_slot(accumulator, class_name, name, def_node, node, other = nil)
+      def write_singleton_slot(accumulator, class_name, name, def_node, node, other = nil, possible: false)
         if accumulator.is_a?(SingletonDefTable)
-          accumulator.write(class_name, name, def_node, node, other)
+          accumulator.write(class_name, name, def_node, node, other, possible: possible)
         else
           (accumulator[class_name] ||= {})[name] = def_node
         end
@@ -6695,32 +7019,34 @@ module Rigor
       # differently for the two spellings of one edge.
       def record_mixin_call(node, qualified_prefix, current_class, accumulator)
         taint_opaque_eval(node, current_class, accumulator)
-        kind, _arguments, via_send = mixin_call_view(node)
-        return if kind.nil?
+        view = mixin_call_view(node)
+        return if view.nil? || view.first.nil?
 
+        kind = view.first
         current_class ||= toplevel_include_owner(node, qualified_prefix, current_class, accumulator)
         effects = mixin_effects(node, kind, qualified_prefix, current_class, accumulator, in_singleton: false)
                   .select { |_owner, side| side == :include }
         return if effects.empty?
-        return if !via_send && instance_mixin_recorded?(node, qualified_prefix, current_class, accumulator)
+        return if instance_mixin_recorded?(node, view, qualified_prefix, current_class, accumulator)
 
         # A mixin call the tables cannot hold still reshapes the ancestry: taint the whole owner side.
         effects.each { |owner, side| accumulator.taint(owner, side) }
       end
 
       # Records the instance-side edges of a call {#mixin_call_recorded?} accepts. False when it recorded
-      # nothing — the caller then taints the owner instead.
-      def instance_mixin_recorded?(node, qualified_prefix, current_class, accumulator)
-        return false unless mixin_call_recorded?(node, current_class)
+      # nothing — the caller then taints the owner instead. `view` is {#mixin_call_view}'s, so
+      # `Integer.send(:include, Ext)` records `Ext` as `Integer.include(Ext)` does (issue #1722).
+      def instance_mixin_recorded?(node, view, qualified_prefix, current_class, accumulator)
+        kind, arguments, via_send = view
+        return false unless mixin_call_recorded?(node, kind, via_send, current_class)
 
-        arguments = node.arguments&.arguments || []
         targets = arguments.filter_map { |arg| Source::ConstantPath.qualified_name(arg) }
         return false if targets.empty?
 
         owner = node.receiver.nil? ? current_class : prepend_call_receiver(node, qualified_prefix)
         return false if owner.nil?
 
-        write_mixin_targets(accumulator, owner, targets, prepend: node.name == :prepend)
+        write_mixin_targets(accumulator, owner, targets, prepend: kind == :prepend)
         accumulator.note(node, owner, :include, targets, complete: targets.size == arguments.size)
         true
       end
@@ -6868,15 +7194,17 @@ module Rigor
       end
 
       # Whether a mixin call contributes to the tables at all: a receiverless `include` / `prepend` needs an
-      # enclosing declaration to file the edge under, and the RECEIVER form is recorded for `prepend` only
-      # — `Base.include(Loud)` is deliberately still unrecorded. Nothing needs it (this issue orders
-      # `prepend`, and the receiver form of `include` has no ordering question to answer) while recording
-      # it would widen what every consumer says about a class, which is scope this change does not own.
-      def mixin_call_recorded?(node, current_class)
-        return false unless MIXIN_CALL_NAMES.include?(node.name)
-        return !current_class.nil? if node.receiver.nil?
+      # enclosing declaration to file the edge under, and the RECEIVER form (`Base.prepend(Loud)`, issue #1123;
+      # `Integer.include(Ext)` and `Integer.send(:include, Ext)`, issue #1722) files it under the class the
+      # receiver names. A receiver-form edge is unpositioned wherever it is written ({MixinAccumulator#note}), so
+      # a reader that depends on ORDER declines on it, while the set-shaped readers (undefined-method
+      # suppression, arity, visibility) see the module as they see an in-body `include`. A receiverless `send`
+      # stays a taint: the walk does not resolve its `self`.
+      def mixin_call_recorded?(node, kind, via_send, current_class)
+        return false unless MIXIN_CALL_NAMES.include?(kind)
+        return !via_send && !current_class.nil? if node.receiver.nil?
 
-        node.name == :prepend
+        true
       end
 
       # Issue #1697 — a receiverless `include M` written as a statement of the file's own top level is
@@ -7315,7 +7643,8 @@ module Rigor
         return record_module_function(node, current_class, accumulator, in_singleton) if node.name == :module_function
 
         taint_opaque_eval(node, current_class, accumulator)
-        return if singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator)
+        return if singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator,
+                                                   in_singleton: in_singleton)
 
         kind, _arguments, via_send = mixin_call_view(node)
         return if kind.nil?
@@ -7323,7 +7652,8 @@ module Rigor
         effects = mixin_effects(node, kind, qualified_prefix, current_class, accumulator, in_singleton: in_singleton)
                   .select { |_owner, side| side == :extend || in_singleton }
         return if effects.empty?
-        return if !via_send && singleton_mixin_recorded?(node, kind, current_class, accumulator, in_singleton)
+        return if !via_send && singleton_mixin_recorded?(node, kind, qualified_prefix, current_class, accumulator,
+                                                         in_singleton)
 
         effects.each { |owner, side| accumulator.taint(owner, side) }
       end
@@ -7338,7 +7668,7 @@ module Rigor
       # but only where it is a direct statement (a top-level statement, or one of a direct declaration body or of a
       # block that runs there once): there the methods walk records those marks under the same owner. In a method
       # body, a hook or a conditional it may run on a receiver or at a time the marks cannot place, so it still taints.
-      def singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator)
+      def singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator, in_singleton: false)
         receiver = node.receiver
         return false unless singleton_class_of_receiver?(receiver) && surface_rewriting_call?(node)
         return false if singleton_class_named_call?(node) && accumulator.direct?(node)
@@ -7346,10 +7676,33 @@ module Rigor
         owner = singleton_class_owner(node, receiver.receiver, qualified_prefix, current_class)
         return false if owner.nil?
 
+        # Inside `class << self` a bare `singleton_class` is the singleton's own singleton, one level up from the
+        # owner's extend side, so that call stays a taint.
+        up_level = in_singleton && lexical_self_receiver?(receiver.receiver)
+        return true if !up_level && singleton_class_include_recorded?(node, owner, accumulator)
+
         accumulator.taint(owner, :extend)
         true
       end
 
+      # Issue #2094 — `Float.singleton_class.include(Ext)` (or `prepend`, which the extend table cannot order, so the
+      # edge is unpositioned as every receiver-form edge is) puts `Ext` on the singleton side as `Float.extend(Ext)`
+      # does, the fold #915 gives `class << self; include M`. A `send` spelling or an argument that is not a constant
+      # stays a taint.
+      def singleton_class_include_recorded?(node, owner, accumulator)
+        return false unless %i[include prepend].include?(node.name)
+
+        arguments = node.arguments&.arguments || []
+        return false if arguments.empty? || arguments.any? { |arg| Source::ConstantPath.qualified_name(arg).nil? }
+
+        !record_extend_targets(node, owner, accumulator).empty?
+      end
+
+      # A bare or `self.` receiver: the lexical `self`.
+      def lexical_self_receiver?(receiver)
+        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+      end
+
       # A bare, `self.` or constant receiver's `singleton_class` call.
       def singleton_class_of_receiver?(receiver)
         receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class && receiver.arguments.nil?
@@ -7408,13 +7761,29 @@ module Rigor
 
       # Records the singleton-side edges of a receiverless `extend` (or, inside `class << self`, `include` /
       # `prepend`). False when it recorded nothing.
-      def singleton_mixin_recorded?(node, kind, current_class, accumulator, in_singleton)
-        return false unless current_class && node.receiver.nil?
+      def singleton_mixin_recorded?(node, kind, qualified_prefix, current_class, accumulator, in_singleton)
+        return receiver_extend_recorded?(node, kind, qualified_prefix, accumulator) if node.receiver
+        return false unless current_class
         return false unless in_singleton ? MIXIN_CALL_NAMES.include?(kind) : kind == :extend
 
         !record_extend_targets(node, current_class, accumulator).empty?
       end
 
+      # Issue #2094 — the receiver form, `Float.extend(Ext)`: the singleton twin of #1722's `Integer.include(Ext)`,
+      # filed under the class the constant receiver names ({#prepend_call_receiver}) and, like that form,
+      # unpositioned wherever it is written ({MixinAccumulator#note}). A `self` argument names the receiver, not the
+      # enclosing class, so a call with one stays a taint. A constant receiver names the same class inside
+      # `class << self`, so the walk's singleton flag does not matter here.
+      def receiver_extend_recorded?(node, kind, qualified_prefix, accumulator)
+        return false if kind != :extend
+        return false if (node.arguments&.arguments || []).any?(Prism::SelfNode)
+
+        owner = prepend_call_receiver(node, qualified_prefix)
+        return false if owner.nil?
+
+        !record_extend_targets(node, owner, accumulator).empty?
+      end
+
       # The table stores search order, not call order: a later `extend` statement prepends its module
       # (`extend A; extend B` → singleton ancestors `[B, A]`) while the arguments of a single
       # `extend A, B` keep call order (`[A, B]`). Prepending each call's argument list preserves both,
@@ -7589,6 +7958,8 @@ module Rigor
       # - **Wrap-around form** (#1911, #1819, #1633): `private def foo` and `private attr_reader :foo` record the
       #   members with the call's visibility and leave the default alone.
       #
+      # A `module_function` call takes each form as `private` does (#1569): Ruby makes the instance copy private.
+      #
       # Top-level (no surrounding class) defs do not contribute — Ruby's top-level visibility nuances (private at
       # top-level marks the method on `Object`) are out of scope for v0.1.2.
       def build_discovered_method_visibilities(root)
@@ -7605,8 +7976,8 @@ module Rigor
       end
 
       # The bare calls that set the running default visibility of the body they run in: the modifiers and
-      # `module_function`, which {#walk_method_visibilities} does not track as a value (#1569) but which moves the
-      # default all the same.
+      # `module_function`, which {#walk_method_visibilities} applies as `private` on the instance side
+      # ({ModuleFunctionState.instance_visibility}, #1569).
       VISIBILITY_TOGGLES = (VISIBILITY_MODIFIERS + %i[module_function]).freeze
 
       # The `{class => {name => visibility}}` accumulator of {#walk_method_visibilities}, which also carries the
@@ -7644,15 +8015,38 @@ module Rigor
           end
         end
 
+        # Issue #2013 — contests the instance slot of `name`, recorded or not, and marks the contest as a
+        # replacement's ({ScopeIndexer.replaced_visibility_mark}): a `define_method(:name)` or an alias gave the name
+        # a visibility the walk does not read, and another file may record the slot. A later certain write in this
+        # walk clears the contest ({#wrote}) and leaves the mark, which then only keeps a contest another file puts on
+        # the slot: the fold declines more, never reports more, and file order is not load order there either.
+        def contest_replaced(class_name, name)
+          contest_slot(class_name, name)
+          contest_slot(class_name, ScopeIndexer.replaced_visibility_mark(name))
+        end
+
         # Contests the `[class_name, name]` slot, recorded or not: a visibility call changed it in a way the walk
         # cannot read (`private def self.x` reaching an instance `x`).
         def contest_slot(class_name, name)
           (@contested ||= Set.new) << [class_name, name].freeze
         end
 
-        # Contests every slot of `class_name` recorded so far (`private(*names)` may name any of them).
-        def contest_class(class_name)
-          self[class_name]&.each_key { |name| contest_slot(class_name, name) }
+        # Contests every slot of `class_name` on `side` recorded so far (`private(*names)` may name any of them).
+        # Issue #1984 — on the singleton side it also contests the class's wildcard slot
+        # ({ScopeIndexer::SINGLETON_WILDCARD_SLOT}): the names may be ones another file records.
+        def contest_class(class_name, side = :instance)
+          self[class_name]&.each_key do |slot|
+            contest_slot(class_name, slot) if slot.is_a?(Array) == (side == :singleton)
+          end
+          contest_slot(class_name, SINGLETON_WILDCARD_SLOT) if side == :singleton
+        end
+
+        # Issue #1984 — records `visibility` in the slot of `name` on `side` ({ScopeIndexer.visibility_slot}) and
+        # settles its contest as {#wrote} does.
+        def write(class_name, name, side, visibility, node, toggled:)
+          slot = ScopeIndexer.visibility_slot(name, side)
+          (self[class_name] ||= {})[slot] = visibility
+          wrote(class_name, slot, node, toggled: toggled)
         end
 
         # Runs the block with the running default uncertain, so a `def` it records is contested.
@@ -7769,10 +8163,12 @@ module Rigor
             return current_visibility
           end
         when Prism::DefNode
-          record_def_visibility(node, owner_prefix, in_singleton_class || defs_singleton,
+          contest_foreign_singleton_visibility(node, qualified_prefix, owner_prefix, in_singleton_class, accumulator)
+          record_def_visibility(node, owner_prefix, visibility_side(in_singleton_class, defs_singleton),
                                 current_visibility, accumulator)
           return current_visibility
         when Prism::CallNode
+          record_constant_class_method_calls(node, qualified_prefix, accumulator)
           if receiver_eval_call?(node)
             walk_eval_visibilities(node, qualified_prefix, in_singleton_class, current_visibility,
                                    accumulator, def_owner_prefix, singleton_cref: singleton_cref,
@@ -7787,23 +8183,50 @@ module Rigor
           end
           if (parts = visibility_call_parts(node))
             accumulator.toggles += 1 if visibility_toggle_arguments?(parts.last)
-            # The visibility table is instance-side only — `private :x` inside `class <<`
-            # (or a receiver-eval body that re-evaluates a singleton self) marks the
-            # SINGLETON method, which this table cannot express. The `owner_prefix` check is a
-            # guard: an ownerless body (the top level, an anonymous factory block) records nothing,
-            # and its calls walk as any other call.
-            if !in_singleton_class && !owner_prefix.empty? && VISIBILITY_MODIFIERS.include?(parts.first)
-              return apply_visibility_call(node, *parts, owner_prefix, current_visibility, accumulator,
-                                           defs_singleton: defs_singleton) do |argument|
+            # A `module_function` call is applied as a `private` one (#1569): it makes the instance copy private.
+            visibility = parts.first
+            visibility = ModuleFunctionState.instance_visibility unless VISIBILITY_MODIFIERS.include?(visibility)
+            # Issue #1984 — inside `class << self` (or a `class_eval` on the singleton class) the call marks the
+            # SINGLETON methods, recorded under their `[:singleton, name]` slots. `module_function` is no method of
+            # a singleton class, so it is walked as any other call there. The `owner_prefix` check is a guard: an
+            # ownerless body (the top level, an anonymous factory block) records nothing, and its calls walk as
+            # any other call.
+            # An `instance_eval` body's call (`:eval`) runs on the receiver as a module: the instance side.
+            side = visibility_side(in_singleton_class, defs_singleton)
+            side = :instance if side == :eval
+            if side && !owner_prefix.empty? && (side == :instance || VISIBILITY_MODIFIERS.include?(parts.first))
+              return apply_visibility_call(node, visibility, parts.last, owner_prefix, current_visibility, accumulator,
+                                           side: side, defs_singleton: defs_singleton) do |argument|
+                walk_method_visibilities(argument, qualified_prefix, in_singleton_class, current_visibility,
+                                         accumulator, def_owner_prefix, singleton_cref: singleton_cref,
+                                                                        defs_singleton: defs_singleton)
+              end
+            end
+          end
+          if !in_singleton_class && !owner_prefix.empty?
+            class_method_parts = class_method_visibility_parts(node)
+            if class_method_parts
+              apply_class_method_visibility(node, *class_method_parts, owner_prefix, accumulator) do |argument|
                 walk_method_visibilities(argument, qualified_prefix, in_singleton_class, current_visibility,
                                          accumulator, def_owner_prefix, singleton_cref: singleton_cref,
                                                                         defs_singleton: defs_singleton)
               end
+              return current_visibility
             end
+            contest_singleton_rewrites(node, owner_prefix, accumulator)
           end
-          unless in_singleton_class || defs_singleton
-            record_attr_visibility(node, owner_prefix, current_visibility, accumulator, toggled: true)
+          side = visibility_side(in_singleton_class, defs_singleton)
+          if %i[instance singleton].include?(side)
+            record_attr_visibility(node, owner_prefix, current_visibility, accumulator, toggled: true, side: side)
+            contest_replaced_visibility(replaced_by_call(node), owner_prefix, accumulator, side: side)
           end
+        when Prism::AliasMethodNode
+          side = visibility_side(in_singleton_class, defs_singleton)
+          if %i[instance singleton].include?(side)
+            contest_replaced_visibility(Array(Source::AliasNames.keyword_names(node)&.first), owner_prefix,
+                                        accumulator, side: side)
+          end
+          return current_visibility
         end
 
         # Statement-position StatementsNode preserves left-to-right visibility flow; everything else recurses with the
@@ -7887,6 +8310,9 @@ module Rigor
                                    singleton_cref: singleton_cref,
                                    defs_singleton: defs_singleton)
         end
+        return if singleton_class_eval_walked?(node, qualified_prefix, in_singleton_class, accumulator,
+                                               def_owner_prefix, singleton_cref, defs_singleton)
+
         node.arguments&.arguments&.each do |arg|
           walk_method_visibilities(arg, qualified_prefix, in_singleton_class, current_visibility,
                                    accumulator, def_owner_prefix, singleton_cref: singleton_cref,
@@ -7911,63 +8337,191 @@ module Rigor
         end
       end
 
-      # `toggled` when the def reads the running default (a statement), false for one a visibility call wraps.
-      def record_def_visibility(def_node, qualified_prefix, in_singleton_class, current_visibility, accumulator,
-                                toggled: true)
-        return if def_node.receiver.is_a?(Prism::SelfNode) || in_singleton_class
-        return if qualified_prefix.empty?
+      # Issue #1984 — `singleton_class.class_eval do … end` in a class body (or `module_eval` / `class_exec` /
+      # `module_exec`) runs its block as a `class << self` body does: its `def`s and visibility calls land on the
+      # class's singleton slots. True when it walked the block so.
+      def singleton_class_eval_walked?(node, qualified_prefix, in_singleton_class, accumulator,
+                                       def_owner_prefix, singleton_cref, defs_singleton)
+        return false if in_singleton_class || defs_singleton || INSTANCE_EVAL_CALLS.include?(node.name)
+        return false unless own_singleton_class?(node.receiver) && node.arguments.nil?
+
+        owner_prefix = def_owner_prefix || qualified_prefix
+        return false if owner_prefix.empty?
+
+        if node.block.body
+          accumulator.body do
+            walk_method_visibilities(node.block.body, qualified_prefix, true, :public, accumulator, owner_prefix,
+                                     singleton_cref: singleton_cref)
+          end
+        end
+        true
+      end
+
+      # Issue #1984 — the slot a contest stands on for every singleton name of a class: a call that may make any of
+      # them public (`K.public_class_method(*names)`, `K.singleton_class.class_eval { … }`).
+      SINGLETON_WILDCARD_SLOT = %i[singleton *].freeze
+
+      # Issue #2013 — the mark a contested instance slot `name` carries in `contested_discovered_method_visibilities`
+      # when a `define_method(:name)` or an alias replaced the method: `[:replaced, name]`. No reader asks for it; it
+      # keeps the slot's contest when another file's write of the slot folds later ({#fold_visibility_contests}),
+      # since file order is not load order.
+      def self.replaced_visibility_mark(name) = [:replaced, name].freeze
+
+      # Issue #1984 — a class method visibility call written on a constant (`K.public_class_method(:x)`,
+      # `K.send(:public_class_method, :x)`), anywhere: each literal name is recorded public on every class the
+      # constant may name, so a reopening's or another file's `private_class_method` disagrees with it and is
+      # contested. A `K.private_class_method` is not read (the rule only declines more where it is missing). Any call
+      # on `K.singleton_class` (`send(:public, :x)`, `class_eval { … }`), or a `public_class_method` whose names are
+      # not literal, contests every singleton name of the class.
+      def record_constant_class_method_calls(node, qualified_prefix, accumulator)
+        receiver = node.receiver
+        if singleton_class_of_receiver?(receiver) && constant_receiver?(receiver.receiver)
+          each_constant_class(receiver.receiver, qualified_prefix) do |class_name|
+            accumulator.contest_class(class_name, :singleton)
+          end
+          return
+        end
+        names = constant_public_class_method_names(node)
+        return if names.nil?
+
+        each_constant_class(receiver, qualified_prefix) do |class_name|
+          next accumulator.contest_class(class_name, :singleton) if names.any?(&:nil?)
+
+          names.each do |method_name|
+            accumulator.write(class_name, method_name, :singleton, :public, node, toggled: false)
+          end
+        end
+      end
+
+      # The names a `K.public_class_method(…)` (or `K.send(:public_class_method, …)`) call on a constant names, a nil
+      # for each one that is not a literal; nil for any other call.
+      def constant_public_class_method_names(node)
+        return nil unless constant_receiver?(node.receiver)
+
+        name = node.name
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        if VISIBILITY_SEND_CALLS.include?(name) || name == :public_send
+          name = Source::Literals.symbol_or_string(arguments.first)
+          arguments = arguments.drop(1)
+        end
+        return nil unless name == :public_class_method
+
+        arguments.flat_map { |arg| arg.is_a?(Prism::ArrayNode) ? arg.elements : [arg] }
+                 .map { |arg| Source::Literals.symbol_or_string(arg) }
+      end
+
+      def constant_receiver?(node)
+        node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+      end
+
+      def each_constant_class(receiver, qualified_prefix, &)
+        constant_receiver_candidates(receiver, qualified_prefix).each(&)
+      end
+
+      # Issue #1984 — the side a body's members land on: `:singleton` in a `class << self` body or a `class_eval` on
+      # the singleton class, `:eval` in an `instance_eval` body on a class (its `def`s are singleton methods, its
+      # visibility calls instance-side), `:instance` in a class body, and nil where the singleton cannot be named.
+      def visibility_side(in_singleton_class, defs_singleton)
+        return defs_singleton == :unnameable ? nil : :singleton if in_singleton_class
+        return :eval if defs_singleton
+
+        :instance
+      end
+
+      # Issue #1984 — the key of `name`'s slot in a class's visibility table: the name on the instance side,
+      # `[:singleton, name]` on the singleton side (the envelope table's spelling).
+      def visibility_slot(name, side)
+        side == :singleton ? [:singleton, name].freeze : name
+      end
+
+      # Records the visibility a `def` gets ({#visibility_side} `side`):
+      #
+      # - a receiverless `def` takes `current_visibility` on its side; `toggled` when that is the running default
+      #   (a statement), false for one a visibility call wraps;
+      # - issue #1984 — `def self.x` (or `def K.x` in `K`'s body) is a public singleton method whatever the running
+      #   default is (`private; def self.x` is public), and writes nothing in a singleton body (it defines a method
+      #   of the singleton's singleton);
+      # - an `instance_eval` body's `def` (`:eval`) replaces a singleton method with a visibility the walk does not
+      #   read, so its singleton slot is contested.
+      def record_def_visibility(def_node, qualified_prefix, side, current_visibility, accumulator, toggled: true)
+        return if side.nil? || qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        accumulator[class_name] ||= {}
-        accumulator[class_name][def_node.name] = current_visibility
-        accumulator.wrote(class_name, def_node.name, def_node, toggled: toggled)
+        if side == :eval
+          accumulator.contest_slot(class_name, visibility_slot(def_node.name, :singleton))
+        elsif def_node.receiver.nil?
+          accumulator.write(class_name, def_node.name, side, current_visibility, def_node, toggled: toggled)
+        elsif side == :instance && self_singleton_def?(def_node, qualified_prefix)
+          accumulator.write(class_name, def_node.name, :singleton, :public, def_node, toggled: false)
+        end
+      end
+
+      def self_singleton_def?(def_node, qualified_prefix)
+        def_node.receiver.is_a?(Prism::SelfNode) || def_receiver_targets_lexical_self?(def_node.receiver,
+                                                                                       qualified_prefix)
+      end
+
+      # Issue #1984 — `def Other.x` whose receiver is not the lexical self (`def_owner`) makes `Other.x` public in
+      # whatever order the files load, so each class the constant may name has its singleton slot contested.
+      def contest_foreign_singleton_visibility(def_node, qualified_prefix, def_owner, in_singleton_class, accumulator)
+        receiver = def_node.receiver
+        return unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+        return if !in_singleton_class && def_receiver_targets_lexical_self?(receiver, def_owner)
+
+        constant_receiver_candidates(receiver, qualified_prefix).each do |name|
+          accumulator.contest_slot(name, visibility_slot(def_node.name, :singleton))
+        end
       end
 
       # Applies one `private` / `protected` / `public` call ({#visibility_call_parts}) written on the body's self
-      # and returns the running default after it:
+      # and returns the running default after it. `side` is the side its names land on: `:singleton` in a
+      # `class << self` body (issue #1984), `:instance` elsewhere.
       #
       # - no arguments — the call's visibility becomes the default for subsequent defs.
       # - `private :foo, :bar`, `private %i[foo bar]` — back-patch the named methods in the accumulator; the
       #   default does NOT change for this form.
       # - Issues #1911, #1819, #1633 — `private def foo` (endless or not) and `private attr_reader :foo` define
       #   the members with the call's visibility, whatever the running default is (`private; public def foo` is
-      #   public); `private def self.foo` changes the instance method `foo`, if one exists, so its slot is
-      #   contested.
-      # - a splat (`private(*names)`) may name any member or none (a bare toggle), so the class's slots this file
-      #   wrote so far are contested, and the statement loop reads the default after it as uncertain
+      #   public); `private def self.foo` changes the method `foo` of the side, if one exists, so its slot is
+      #   contested, and defines a public singleton `foo` (a singleton-singleton one in a `class << self` body).
+      # - a splat (`private(*names)`) may name any member or none (a bare toggle), so the class's slots on the side
+      #   this file wrote so far are contested, and the statement loop reads the default after it as uncertain
       #   ({#visibility_toggle_arguments?}).
       # - any other argument (`private memoize def foo`, `private delegate(...)`) is walked with the default
       #   uncertain, so a `def` under it is contested: the call's visibility reaches it through a return value
       #   the walk does not read.
       #
       # `walk` walks an argument the call does not consume itself.
-      def apply_visibility_call(call_node, name, args, qualified_prefix, current_visibility, accumulator,
-                                defs_singleton: false, &walk)
+      def apply_visibility_call(call_node, name, args, qualified_prefix, current_visibility, accumulator, # rubocop:disable Metrics/ParameterLists
+                                side: :instance, defs_singleton: false, &walk)
         return name if args.empty?
 
         class_name = qualified_prefix.join("::")
-        accumulator.contest_class(class_name) if args.any?(Prism::SplatNode)
+        accumulator.contest_class(class_name, side) if args.any?(Prism::SplatNode)
         args.each do |arg|
           apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator,
-                                    defs_singleton: defs_singleton, &walk)
+                                    side: side, defs_singleton: defs_singleton, &walk)
         end
         current_visibility
       end
 
-      def apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator, defs_singleton:, &walk)
+      def apply_visibility_argument(arg, name, call_node, qualified_prefix, accumulator, side:, defs_singleton:, &walk)
         case arg
         when Prism::DefNode
           if arg.receiver.nil?
-            record_def_visibility(arg, qualified_prefix, defs_singleton, name, accumulator, toggled: false)
+            def_side = side == :instance && defs_singleton ? :eval : side
+            record_def_visibility(arg, qualified_prefix, def_side, name, accumulator, toggled: false)
           else
-            accumulator.contest_slot(qualified_prefix.join("::"), arg.name)
+            accumulator.contest_slot(qualified_prefix.join("::"), visibility_slot(arg.name, side))
+            record_def_visibility(arg, qualified_prefix, defs_singleton ? :eval : side, name, accumulator,
+                                  toggled: false)
           end
         when Prism::SymbolNode, Prism::StringNode, Prism::ArrayNode
-          apply_named_visibility(arg, name, qualified_prefix, call_node, accumulator, &walk)
+          apply_named_visibility(arg, name, qualified_prefix, call_node, accumulator, side: side, &walk)
         else
           # An `instance_eval` body's wrapped attr is walked like any other argument and records nothing.
           if !defs_singleton && attr_visibility_call?(arg)
-            record_attr_visibility(arg, qualified_prefix, name, accumulator, toggled: false)
+            record_attr_visibility(arg, qualified_prefix, name, accumulator, toggled: false, side: side)
           else
             accumulator.uncertainly { walk.call(arg) }
           end
@@ -7976,16 +8530,14 @@ module Rigor
 
       # `private :foo` / `private "foo"` / `private %i[foo bar]`: each literal name the call's visibility. An array
       # element that is not a literal name is walked like any other argument.
-      def apply_named_visibility(arg, visibility, qualified_prefix, call_node, accumulator, &walk)
+      def apply_named_visibility(arg, visibility, qualified_prefix, call_node, accumulator, side: :instance, &walk)
         elements = arg.is_a?(Prism::ArrayNode) ? arg.elements : [arg]
         class_name = qualified_prefix.join("::")
         elements.each do |element|
           name = visibility_target_name(element)
           next accumulator.uncertainly { walk.call(element) } if name.nil?
 
-          accumulator[class_name] ||= {}
-          accumulator[class_name][name] = visibility
-          accumulator.wrote(class_name, name, call_node, toggled: false)
+          accumulator.write(class_name, name, side, visibility, call_node, toggled: false)
         end
       end
 
@@ -7993,30 +8545,135 @@ module Rigor
         Source::Literals.symbol_or_string(arg)
       end
 
+      CLASS_METHOD_VISIBILITIES = { private_class_method: :private, public_class_method: :public }.freeze
+      private_constant :CLASS_METHOD_VISIBILITIES
+
+      # Issue #1984 — `[visibility, arguments]` for a `private_class_method` / `public_class_method` call written on
+      # the body's self, in the spellings {#visibility_call_parts} reads (receiverless, `self.`, `send` with a
+      # literal name); nil for any other call.
+      def class_method_visibility_parts(node)
+        return nil unless node.is_a?(Prism::CallNode)
+        return nil unless node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+
+        name = node.name
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        if VISIBILITY_SEND_CALLS.include?(name)
+          name = Source::Literals.symbol_or_string(arguments.first)
+          arguments = arguments.drop(1)
+        end
+        visibility = CLASS_METHOD_VISIBILITIES[name]
+        visibility && [visibility, arguments]
+      end
+
+      # Issue #1984 — applies `private_class_method` / `public_class_method` to the class's singleton slots. It sets
+      # no running default (with no arguments it does nothing). A literal name (`:x`, `"x"`, `[:x]`) and a wrapped
+      # `def self.x` take the call's visibility; a wrapped receiverless `def x` defines an instance method (walked as
+      # a statement) and names the singleton `x` the walk does not see, as does any other receiver, so that slot is
+      # contested; a splat or any other argument may name any singleton method, so every singleton slot the file
+      # wrote so far for the class is contested, and the argument is walked.
+      def apply_class_method_visibility(call_node, visibility, args, qualified_prefix, accumulator, &walk)
+        class_name = qualified_prefix.join("::")
+        args.each do |arg|
+          case arg
+          when Prism::DefNode
+            if arg.receiver && self_singleton_def?(arg, qualified_prefix)
+              accumulator.write(class_name, arg.name, :singleton, visibility, call_node, toggled: false)
+            else
+              walk.call(arg)
+              accumulator.contest_slot(class_name, visibility_slot(arg.name, :singleton))
+            end
+          when Prism::SymbolNode, Prism::StringNode, Prism::ArrayNode
+            apply_named_visibility(arg, visibility, qualified_prefix, call_node, accumulator, side: :singleton) do |el|
+              accumulator.contest_class(class_name, :singleton)
+              walk.call(el)
+            end
+          else
+            accumulator.contest_class(class_name, :singleton)
+            walk.call(arg)
+          end
+        end
+      end
+
+      SINGLETON_DEFINING_CALLS = %i[define_singleton_method].freeze
+      private_constant :SINGLETON_DEFINING_CALLS
+
+      # Issue #1984 — calls in a class body that change a singleton method's visibility in a way the walk does not
+      # read, so the singleton slots they may reach are contested: `define_singleton_method(:x)` (a fresh public
+      # method; a computed name contests every singleton slot of the class), and any call on `singleton_class`
+      # (`singleton_class.send(:public, :x)`, `singleton_class.define_method(:x)`), whose literal arguments name
+      # the slots and whose other arguments may name any.
+      def contest_singleton_rewrites(node, qualified_prefix, accumulator)
+        on_singleton_class = own_singleton_class?(node.receiver)
+        return unless on_singleton_class || node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)
+        return unless on_singleton_class || SINGLETON_DEFINING_CALLS.include?(node.name)
+
+        class_name = qualified_prefix.join("::")
+        arguments = node.arguments&.arguments || EMPTY_VISIBILITY_ARGUMENTS
+        arguments = arguments.first(1) if SINGLETON_DEFINING_CALLS.include?(node.name)
+        arguments.each do |argument|
+          name = Source::Literals.symbol_or_string(argument)
+          if name
+            accumulator.contest_slot(class_name, visibility_slot(name, :singleton))
+          else
+            accumulator.contest_class(class_name, :singleton)
+          end
+        end
+      end
+
+      # `singleton_class` or `self.singleton_class`: the body's own singleton class.
+      def own_singleton_class?(receiver)
+        singleton_class_of_receiver?(receiver) && (receiver.receiver.nil? || receiver.receiver.is_a?(Prism::SelfNode))
+      end
+
       # Issue #1911 — an `attr_reader` / `attr_writer` / `attr_accessor` call written on the body's self records
       # each member it defines (`x`, `x=`) with `visibility`: the running default for a statement (`toggled`), the
       # wrapping call's for `private attr_accessor :x`, which Ruby applies to the `[:x, :x=]` the macro returns.
       # A non-literal name (`attr_reader(*FIELDS)`) records nothing; a call that is no such macro records nothing.
-      def record_attr_visibility(call_node, qualified_prefix, visibility, accumulator, toggled:)
-        return unless attr_visibility_call?(call_node)
-        return if qualified_prefix.empty?
+      # Issue #1989 — the names a `define_method(:x)` or an `alias_method :x, :y` call replaces. An `attr_*` call is
+      # not among them: it writes its members' slots itself ({#record_attr_visibility}).
+      def replaced_by_call(call_node)
+        return define_method_superseded_name(call_node) if call_node.name == :define_method
+
+        Source::AliasNames.alias_method_call_names(call_node)&.first(1) || []
+      end
+
+      # Issue #1989 — a `define_method` or an alias that replaces a method gives the name a visibility the walk
+      # does not read (the running default for `define_method`, the old name's for an alias), so the slot is
+      # contested rather than left asserting the replaced `def`'s. Issue #1984 — the slot is contested whether or
+      # not this file recorded it, since another file may have; issue #2013 — on the instance side too, with the
+      # mark that keeps the contest when that file's write folds later ({VisibilityTable#contest_replaced}).
+      def contest_replaced_visibility(names, qualified_prefix, accumulator, side: :instance)
+        return if names.empty? || qualified_prefix.empty?
+
+        class_name = qualified_prefix.join("::")
+        names.each do |name|
+          if side == :singleton
+            accumulator.contest_slot(class_name, visibility_slot(name, side))
+          else
+            accumulator.contest_replaced(class_name, name)
+          end
+        end
+      end
+
+      def record_attr_visibility(call_node, qualified_prefix, visibility, accumulator, toggled:, side: :instance)
+        macro = attr_macro(call_node)
+        return if macro.nil? || qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
         each_attr_macro_name(call_node) do |base|
           members = []
-          members << base unless call_node.name == :attr_writer
-          members << :"#{base}=" unless call_node.name == :attr_reader
+          members << base unless macro == :attr_writer
+          members << :"#{base}=" unless macro == :attr_reader
           members.each do |member|
-            accumulator[class_name] ||= {}
-            accumulator[class_name][member] = visibility
-            accumulator.wrote(class_name, member, call_node, toggled: toggled)
+            accumulator.write(class_name, member, side, visibility, call_node, toggled: toggled)
           end
         end
       end
 
-      # A receiverless `attr_reader` / `attr_writer` / `attr_accessor` call ({#record_attr_visibility}).
+      # An `attr_reader` / `attr_writer` / `attr_accessor` call on the body's self ({#attr_macro},
+      # {#record_attr_visibility}). Ruby 4.0.5 gives every spelling the running default visibility.
       def attr_visibility_call?(node)
-        node.is_a?(Prism::CallNode) && node.receiver.nil? && ATTR_MACROS.include?(node.name)
+        !attr_macro(node).nil?
       end
 
       # Registers the alias name in the `discovered_methods` table so `undefined-method` diagnostics are not emitted for
@@ -8131,7 +8788,8 @@ module Rigor
         return if owner.nil?
 
         singleton_class_rewritten_names(node).each do |method_name|
-          names = [method_name]
+          # `attr_writer :x` defines `x=` alone (#1936), so `x` keeps its own `def`.
+          names = node.name == :attr_writer ? [] : [method_name]
           names << :"#{method_name}=" if %i[attr_writer attr_accessor].include?(node.name)
           names.each do |name|
             record_envelope(tables.envelopes, owner, [:singleton, name], Source::ParameterEnvelope::OPAQUE)
@@ -8234,48 +8892,76 @@ module Rigor
       #
       # ADR-119 WD3 — the alias is the slot's writer: the new name's slot is contested when the alias is possible
       # or the slot it copies is contested, and cleared otherwise.
-      def apply_alias_def_nodes(root, accumulator, tables = nil)
-        alias_map = collect_class_alias_map(root, [], AliasMap.new.track(tables&.certainty))
-        alias_map.each do |class_name, aliases|
-          class_defs = accumulator[class_name]
-          next unless class_defs
-
-          aliases.each do |new_name, old_name|
-            def_node = class_defs[old_name]
-            next unless def_node.is_a?(Prism::DefNode)
-
-            (accumulator[class_name] ||= {})[new_name] = def_node
-            next if tables.nil?
-
-            certain = !alias_map.possible?(class_name, new_name) &&
-                      !tables.contested_def_nodes&.include?([class_name, old_name])
-            follow_slot_writer(tables, :contested_def_nodes, [class_name, new_name], certain)
-          end
+      #
+      # Issue #2006 — in source order. An alias copies what its old name held AT the alias, read from the walk's
+      # definer history ({MethodTables#wrote_definer}) and the copies earlier aliases made: a `def` of the old name
+      # written after the alias (`alias old_x x; def x = 1`) is not what `old_x` runs, and nothing before the alias
+      # copies nothing. The new name's slot then follows its last writer: a later `def` keeps the slot the walk
+      # gave it, and a later `define_method` / `attr_*` leaves the copy contested, as {#supersede_def_nodes} leaves
+      # a replaced `def`.
+      def apply_alias_def_nodes(root, accumulator, tables)
+        alias_map = collect_class_alias_map(root, [], AliasMap.new.track(tables.certainty))
+        history = (tables.definer_history || {}).transform_values(&:dup)
+        alias_map.copy_into(history).each { |key| settle_alias_slot(accumulator, tables, key, history[key]) }
+      end
+
+      # Writes the new name's slot from its last writer `writes.last` ({#apply_alias_def_nodes}): an alias copy or a
+      # later `def` writes its `def` with its certainty (for the `def`, what the walk wrote already). A last writer
+      # with no `def` this file holds — a later `define_method` / `attr_*`, or an alias that copies nothing this file
+      # defines (an inherited or core method, an attr reader, a name it cannot read) — contests the slot, which keeps
+      # what it holds or else the latest copy, so no sibling file's `def` fills it.
+      def settle_alias_slot(accumulator, tables, (class_name, new_name), writes)
+        last = writes.last
+        slot = (accumulator[class_name] ||= {})
+        if last[1]
+          slot[new_name] = last[1]
+          follow_slot_writer(tables, :contested_def_nodes, [class_name, new_name], last[2])
+        else
+          copy = writes.rfind { |write| write[1] }
+          slot[new_name] ||= copy[1] if copy
+          follow_slot_writer(tables, :contested_def_nodes, [class_name, new_name], false)
         end
       end
 
-      # The `{class => {new name => old name}}` map {#collect_class_alias_map} fills, which also remembers, per
-      # entry, whether the alias that wrote it last is possible ({Certainty}).
+      # The `{class => {new name => old name}}` map {#collect_class_alias_map} fills, which also lists every alias it
+      # met as an event `[class, new name, old name, start offset, possible?]` ({Certainty}).
       class AliasMap < Hash
+        attr_reader :events
+
         def track(certainty)
           @certainty = certainty || Certainty::EMPTY
-          @possible = nil
+          @events = []
           self
         end
 
-        # Records that `node` wrote the `[class_name, new_name]` entry.
-        def wrote(class_name, new_name, node)
+        # Records that `node` wrote the `[class_name, new_name]` entry, aliasing `old_name`.
+        def wrote(class_name, new_name, old_name, node)
           return if @certainty.nil?
 
-          if Certainty.possible?(@certainty, node)
-            (@possible ||= Set.new) << [class_name, new_name]
-          else
-            @possible&.delete([class_name, new_name])
-          end
+          @events << [class_name, new_name, old_name, node.location.start_offset, Certainty.possible?(@certainty, node)]
+        end
+
+        # Issue #2006 — adds every alias to `history` (`{[class, name] => [[offset, def node or nil, certain,
+        # (:alias)], ...]}`, ascending), in source order. An alias whose old name held a `def` at the alias copies it,
+        # certain when that write and the alias are. Any other alias — an old name with no `def` of this file before
+        # it (inherited, core, an attr reader, a sibling file's), or one it cannot read — adds a write with no `def`,
+        # which leaves the slot contested ({ScopeIndexer#settle_alias_slot}). An alias whose new name it cannot read
+        # adds one to every name of the class written before it. Returns the `[class, name]` keys it wrote.
+        def copy_into(history)
+          @events.sort_by { |event| event[3] }.flat_map do |class_name, new_name, old_name, at, possible|
+            source = old_name && history[[class_name, old_name]]&.rfind { |write| write.first < at }
+            write = if source&.[](1) then [at, source[1], source[2] && !possible, :alias].freeze
+                    else [at, nil, false, :alias].freeze
+                    end
+            keys = new_name ? [[class_name, new_name]] : names_before(history, class_name, at)
+            keys.each { |key| (history[key] ||= []).push(write).sort_by!(&:first) }
+          end.uniq
         end
 
-        def possible?(class_name, new_name)
-          !@possible.nil? && @possible.include?([class_name, new_name])
+        private
+
+        def names_before(history, class_name, at)
+          history.filter_map { |key, writes| key if key.first == class_name && writes.first.first < at }
         end
       end
 
@@ -8337,12 +9023,19 @@ module Rigor
         # `t` alias was the corpus case). Unlike AliasMethodNode a call's children can carry further
         # class bodies (`Class.new do … end`), so the walk continues below it either way.
         names = Source::AliasNames.alias_method_call_names(node)
-        if names && !rec_prefix.empty? && !(singleton_cref && leaf_owner.nil?)
+        if (names || unread_alias_method?(node)) && !rec_prefix.empty? && !(singleton_cref && leaf_owner.nil?)
           record_alias_call_entry(accumulator, rec_prefix.join("::"), names, node)
         end
         false
       end
 
+      # Issue #2006 — an `alias_method` call on no receiver or `self` whose names {Source::AliasNames} cannot read
+      # (`alias_method n, :to_s`, `self.alias_method :x, :y`, a splat): it still replaces a method, which
+      # {AliasMap#copy_into} contests.
+      def unread_alias_method?(node)
+        node.name == :alias_method && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+      end
+
       # The rebinding-block call arm of {#collect_class_alias_map}: an anonymous meta-new call
       # (`Class.new { … }` no write names) files its block's aliases nowhere, and an eval-family
       # call binds them on the receiver — a nameable receiver re-anchors the owner while a
@@ -8433,20 +9126,32 @@ module Rigor
       end
 
       def record_alias_call_entry(accumulator, class_name, names, node)
+        if names.nil?
+          # Issue #2006 — an unread `alias_method` maps nothing, but still replaces a method ({AliasMap#copy_into}).
+          new_name = Source::AliasNames.literal_name(node.arguments&.arguments&.first)
+          accumulator.wrote(class_name, new_name, nil, node) if accumulator.is_a?(AliasMap)
+          return
+        end
+
         (accumulator[class_name] ||= {})[names.first] = names.last
-        accumulator.wrote(class_name, names.first, node) if accumulator.is_a?(AliasMap)
+        accumulator.wrote(class_name, names.first, names.last, node) if accumulator.is_a?(AliasMap)
       end
 
       def record_alias_map_entry(alias_node, qualified_prefix, accumulator)
         return if qualified_prefix.empty?
 
         names = Source::AliasNames.keyword_names(alias_node)
-        return if names.nil?
-
         class_name = qualified_prefix.join("::")
+        if names.nil?
+          # Issue #2006 — an `alias` whose names are not plain symbols still replaces a method ({AliasMap#copy_into}).
+          new_name = Source::AliasNames.symbol_name(alias_node.new_name)
+          accumulator.wrote(class_name, new_name, nil, alias_node) if accumulator.is_a?(AliasMap)
+          return
+        end
+
         new_name, old_name = names
         (accumulator[class_name] ||= {})[new_name] = old_name
-        accumulator.wrote(class_name, new_name, alias_node) if accumulator.is_a?(AliasMap)
+        accumulator.wrote(class_name, new_name, old_name, alias_node) if accumulator.is_a?(AliasMap)
       end
 
       def record_define_method(call_node, qualified_prefix, in_singleton_class, accumulator)
@@ -8474,8 +9179,9 @@ module Rigor
         return if qualified_prefix.empty?
 
         kind = in_singleton_class ? :singleton : :instance
-        reader = call_node.name != :attr_writer
-        writer = call_node.name != :attr_reader
+        macro = attr_macro(call_node)
+        reader = macro != :attr_writer
+        writer = macro != :attr_reader
         class_name = qualified_prefix.join("::")
         each_attr_macro_name(call_node) do |base|
           record_method(accumulator, class_name, base, kind) if reader
@@ -8483,18 +9189,34 @@ module Rigor
         end
       end
 
-      # Yields each name an `attr_*` call declares: a Symbol or String literal argument. A non-literal one
-      # (`attr_writer(*names)`) names nothing Rigor can read.
+      # Yields each name an `attr_*` call declares ({#attr_macro}): a Symbol or String literal argument. A
+      # non-literal one (`attr_writer(*names)`, `send(:attr_writer, name)`) names nothing Rigor can read.
       def each_attr_macro_name(call_node)
-        return unless call_node.receiver.nil? # only the implicit-self macro defines on the lexical class
-        return if call_node.arguments.nil?
+        return if attr_macro(call_node).nil? || call_node.arguments.nil?
 
-        call_node.arguments.arguments.each do |arg|
+        arguments = call_node.arguments.arguments
+        arguments = arguments.drop(1) if SURFACE_SEND_CALLS.include?(call_node.name)
+        arguments.each do |arg|
           base = literal_method_name(arg)
           yield base unless base.nil?
         end
       end
 
+      # Issue #2097 — the {ATTR_MACROS} entry a call declares members with on the lexical class, or nil. The
+      # call is on the body's self, implicitly or as `self.` (`self.attr_accessor :x`), and names the macro
+      # directly or as the literal first argument of `send` / `public_send` / `__send__`
+      # (`send(:attr_accessor, :x)`); the same spellings `SigGen::Generator#attr_writer_names` reads. Any
+      # other receiver defines on another object.
+      def attr_macro(call_node)
+        return nil unless call_node.is_a?(Prism::CallNode)
+        return nil unless call_node.receiver.nil? || call_node.receiver.is_a?(Prism::SelfNode)
+        return call_node.name if ATTR_MACROS.include?(call_node.name)
+        return nil unless SURFACE_SEND_CALLS.include?(call_node.name)
+
+        macro = literal_method_name(call_node.arguments&.arguments&.first)
+        macro if ATTR_MACROS.include?(macro)
+      end
+
       # Issue #736 — the module-level accessor macros, which introduce methods on BOTH sides of the class.
       # ActiveSupport defines them on `Module`, so every class and module body can use them, and Rails codebases
       # do: `mattr_accessor` / `cattr_accessor` (an alias of it) and `class_attribute` account for 92 false
@@ -8616,14 +9338,15 @@ module Rigor
       # {#discovered_project_index_incremental}'s changed-file branch) yields the live def nodes the signature
       # reads their parameter structure from. Issue #1120 — and each file's own refinement table, which the merged
       # def-index cannot attribute back to a file, so the session can diff it against the file's seed bundle.
-      # Issue #1459 — and each file's {#defined_method_names}, diffed the same way.
-      # @return `{ def_index:, code_fingerprints:, declaration_signatures:, refinements:, defined_method_names: }`.
+      # Issue #1459 — and each file's {#defined_method_names}, diffed the same way. Issue #2134 — and each file's
+      # {#visibility_entries}. Issue #2158 — and each file's `global_write_census`.
+      # @return `{ def_index:, code_fingerprints:, declaration_signatures:, refinements:, defined_method_names:,
+      #   visibility_entries:, global_write_census: }`.
       def scan_summary_for_paths(paths, buffer: nil)
         acc = new_def_index_accumulator
         code_fingerprints = {}
         declaration_signatures = {}
-        refinements = {}
-        defined_method_names = {}
+        per_file = { refinements: {}, defined_method_names: {}, visibility_entries: {}, global_write_census: {} }
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           source = File.read(physical)
@@ -8632,16 +9355,21 @@ module Rigor
           fold_file_index(acc, file_index)
           code_fingerprints[path] = code_fingerprint(source, parsed.comments)
           declaration_signatures[path] = declaration_signature(file_index)
-          refinements[path] = file_index[:refinements] if file_index[:refinements]
-          defined_method_names[path] = defined_method_names(file_index)
+          file_summary(file_index).each { |key, table| per_file[key][path] = table unless table.nil? }
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
           next
         end
         { def_index: finalize_def_index(acc), code_fingerprints: code_fingerprints,
-          declaration_signatures: declaration_signatures, refinements: refinements,
-          defined_method_names: defined_method_names }
+          declaration_signatures: declaration_signatures, **per_file }
+      end
+
+      # One file's tables {#scan_summary_for_paths} hands the session to diff against the file's seed bundle (nil for
+      # a table the file does not have).
+      def file_summary(file_index)
+        { refinements: file_index[:refinements], defined_method_names: defined_method_names(file_index),
+          visibility_entries: visibility_entries(file_index), global_write_census: file_index[:global_write_census] }
       end
 
       # Issue #1459 — every method name one file's index defines, on any class or module and either side: the keys of
@@ -8655,9 +9383,39 @@ module Rigor
         %i[methods def_nodes singleton_def_nodes].each do |key|
           file_index[key]&.each_value { |table| names.merge(table.keys) }
         end
+        # Issue #2184 — a named deferred-range row with no side (a `def` in a block, a `define_singleton_method`) is a
+        # definition no table above holds.
+        file_index[:deferred_ranges]&.each_value { |rows| rows.each { |row| names << row[2] if row[2] && row[3].nil? } }
         names.freeze
       end
 
+      # Issue #2134 — one file's contributions to the visibility table and its contested sibling, as a Set of
+      # `[class, slot, visibility]` entries and `[:contested, class, slot]` contests, where a slot is a method name or
+      # `[:singleton, name]`. Takes a live file index or a seed bundle, which hold the same keys.
+      #
+      # Issue #2161 — and a `[:module_function, owner, name]` entry for each of the file's deferred-range rows that
+      # `DefinerResolution.module_function_row?` counts (a named def row whose kind is not `:instance`): a module
+      # function's singleton copy is public whatever its instance slot says, so the row is a visibility fact the
+      # table itself does not hold.
+      def visibility_entries(file_index)
+        entries = Set.new
+        file_index[:method_visibilities]&.each do |class_name, table|
+          table.each { |slot, visibility| entries << [class_name, slot, visibility] }
+        end
+        contested = (file_index[:siblings] || {})[:contested_discovered_method_visibilities]
+        contested&.each { |(class_name, slot)| entries << [:contested, class_name, slot] }
+        add_module_function_entries(file_index[:deferred_ranges], entries)
+        entries.freeze
+      end
+
+      def add_module_function_entries(deferred_ranges, entries)
+        deferred_ranges&.each_value do |rows|
+          rows.each do |(_start, _finish, name, kind, owner)|
+            entries << [:module_function, owner, name] if name && owner && kind != :instance
+          end
+        end
+      end
+
       # ADR-89 WD1 — a per-file digest of every cross-file DECLARATION surface an ancestry / file-level
       # dependent consumes, EXCLUDING method bodies (which only symbol dependents consume, via the ADR-46
       # symbol edges the change-detection already fingerprints per method). A body edit that touches no
@@ -8875,14 +9633,21 @@ module Rigor
       # Error degradation is identical to the two independent loops it replaces: a read / parse failure (the
       # rescue's real target) contributes nothing to either table. The subset-scoped callers
       # ({IncrementalSession}, `coverage --protection`) keep calling the individual methods unchanged.
-      def discovered_project_index_for_paths(paths, buffer: nil)
+      #
+      # @param uncertain — issue #2021: the paths whose every method contribution is `possible`
+      #   ({Certainty.every_contribution}).
+      def discovered_project_index_for_paths(paths, buffer: nil, uncertain: EMPTY_PATH_SET)
         classes = {}
         acc = new_def_index_accumulator
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           root = Prism.parse(File.read(physical), filepath: path).value
           collect_class_decls(root, [], classes)
-          accumulate_project_index(acc, path, root)
+          if uncertain.include?(path)
+            fold_file_index(acc, without_written_slots(build_file_index(path, root, uncertain: true), acc))
+          else
+            accumulate_project_index(acc, path, root)
+          end
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
@@ -8930,14 +9695,19 @@ module Rigor
       # @param paths — project file paths, in canonical order.
       # @param seed_bundles — the prior run's per-file bundles, keyed by logical path.
       # @return `{ classes:, def_index:, bundles: }`.
-      def discovered_project_index_incremental(paths, seed_bundles:, buffer: nil)
+      # @param uncertain — issue #2021: as {#discovered_project_index_for_paths}. Such a file is always re-walked and
+      #   keeps no bundle, since a bundle does not record that its contributions were all possible.
+      def discovered_project_index_incremental(paths, seed_bundles:, buffer: nil, uncertain: EMPTY_PATH_SET) # rubocop:disable Metrics/AbcSize
         classes = {}
         acc = new_def_index_accumulator
         bundles = {}
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           digest = Cache::FileDigest.hexdigest(physical)
-          cached = seed_bundles[path]
+          walked = uncertain.include?(path)
+          # A walked file neither reuses nor stores a bundle. Both are guards no spec separates: no bundle is ever
+          # stored for a walked file, so the reuse guard matters only if a path changes role within one session.
+          cached = walked ? nil : seed_bundles[path]
           if cached && cached[:digest] == digest
             bundles[path] = cached
             classes.merge!(cached[:classes])
@@ -8946,13 +9716,13 @@ module Rigor
             source = File.read(physical)
             parsed = Prism.parse(source, filepath: path)
             root = parsed.value
-            file_index = build_file_index(path, root)
+            file_index = build_file_index(path, root, uncertain: walked)
             file_classes = {}
             collect_class_decls(root, [], file_classes)
-            bundles[path] = build_seed_bundle(file_index, file_classes, digest,
-                                              code_fingerprint(source, parsed.comments))
+            fingerprint = code_fingerprint(source, parsed.comments)
+            bundles[path] = build_seed_bundle(file_index, file_classes, digest, fingerprint) unless walked
             classes.merge!(file_classes)
-            fold_file_index(acc, file_index)
+            fold_file_index(acc, walked ? without_written_slots(file_index, acc) : file_index)
           end
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
@@ -8966,12 +9736,43 @@ module Rigor
       # Builds ONE file's isolated def-index contribution (live `Prism::DefNode`s) by folding it into a fresh
       # accumulator — recon Q2(a)'s "constructible in isolation" property. Shared by the cold-baseline bundle
       # build and the incremental changed-file re-walk.
-      def build_file_index(path, root)
+      def build_file_index(path, root, uncertain: false)
         file_acc = new_def_index_accumulator
-        accumulate_project_index(file_acc, path, root)
+        accumulate_project_index(file_acc, path, root, uncertain: uncertain)
         file_acc
       end
 
+      # Issue #2021 — the single-valued slot tables an `uncertain` file writes, each with its contest sibling.
+      UNCERTAIN_SLOT_TABLES = {
+        def_nodes: :contested_discovered_def_nodes,
+        singleton_def_nodes: :contested_discovered_singleton_def_nodes,
+        method_visibilities: :contested_discovered_method_visibilities,
+        parameter_envelopes: :contested_discovered_parameter_envelopes
+      }.freeze
+
+      # Issue #2021 — an `uncertain` file's isolated index without the slots `acc` already holds. The walked files fold
+      # after every other discovered file, so `acc` holds what the configured (certain) files wrote: a walked reopening
+      # of such a class adds the names it defines (existence) and leaves each written def node, visibility and
+      # envelope, and its contest, as the certain writer left it. Without this, the walked file's possible write was
+      # the slot's last and contested it, and `rigor check lib/user.rb plug/x.rb` withheld what `rigor check
+      # lib/user.rb` reports. A slot no earlier file wrote is taken, contested.
+      def without_written_slots(file_index, acc)
+        siblings = (file_index[:siblings] || {}).dup
+        tables = UNCERTAIN_SLOT_TABLES.to_h do |table, sibling|
+          written = acc[table]
+          kept = {}
+          (file_index[table] || {}).each do |class_name, entries|
+            sitting = written[class_name]
+            entries = entries.reject { |key, _| sitting.key?(key) } if sitting
+            kept[class_name] = entries unless entries.empty?
+          end
+          contests = siblings[sibling]
+          siblings[sibling] = contests.select { |class_name, key| kept[class_name]&.key?(key) }.to_set if contests
+          [table, kept]
+        end
+        file_index.merge(tables).merge(siblings: siblings)
+      end
+
       # ADR-85 WD2 — folds a single file's isolated def-index contribution into the cross-file accumulator,
       # applying EXACTLY the merge semantics {#accumulate_project_index} applies incrementally (def_nodes
       # later-wins, def_sources first-wins, includes / class_sources accumulate, everything else later-wins).
@@ -9031,7 +9832,7 @@ module Rigor
             when :contested_discovered_singleton_def_nodes
               fold_slot_contests(target.fetch(name), singleton_def_nodes, table)
             when :contested_discovered_method_visibilities
-              fold_slot_contests(target.fetch(name), method_visibilities, table)
+              fold_visibility_contests(target.fetch(name), acc[:method_visibilities], method_visibilities, table)
             else union_sibling_value(target.fetch(name), table)
             end
         end
@@ -9104,6 +9905,35 @@ module Rigor
         result.merge(file_contested)
       end
 
+      # The visibility table's {#fold_slot_contests}, where `recorded` is the table the file folds into as it stood.
+      # Issue #1984 — a singleton slot (`[:singleton, name]`) does not follow its writer: file order is not load
+      # order, so two files that give it different visibilities (`private_class_method :x` here,
+      # `class << self; public :x; end` in a reopening) leave it contested, and a contest on it stays whichever
+      # file folds later. The instance slots fold as before, except (issue #2013) one whose contest carries a
+      # replacement's mark ({ScopeIndexer.replaced_visibility_mark}): a `define_method` or an alias in one file and a
+      # `private def` in another leave the visibility to load order, so that contest stays too.
+      def fold_visibility_contests(sitting, recorded, file_slots, file_contested)
+        stale = sitting.select do |class_name, name|
+          !name.is_a?(Array) && file_slots[class_name]&.key?(name) &&
+            !sitting.include?([class_name, ScopeIndexer.replaced_visibility_mark(name)])
+        end
+        disagreeing = singleton_visibility_disagreements(recorded, file_slots)
+        return sitting if stale.empty? && file_contested.empty? && disagreeing.empty?
+
+        (sitting - stale).merge(file_contested).merge(disagreeing)
+      end
+
+      def singleton_visibility_disagreements(recorded, file_slots)
+        file_slots.flat_map do |class_name, table|
+          sitting = recorded[class_name]
+          next [] if sitting.nil?
+
+          table.filter_map do |slot, visibility|
+            [class_name, slot] if slot.is_a?(Array) && sitting.key?(slot) && sitting[slot] != visibility
+          end
+        end
+      end
+
       def union_paths(sitting, arriving)
         return sitting if arriving.empty?
         return arriving if sitting.empty?
@@ -9509,12 +10339,12 @@ module Rigor
       # Folds one file's class-keyed indexes into the cross-file accumulator. `method_visibilities` (ADR-35) is
       # collected here so the override-visibility-reduced rule can read an ancestor's visibility declared in a sibling
       # file.
-      def accumulate_project_index(acc, path, root)
+      def accumulate_project_index(acc, path, root, uncertain: false)
         # One combined descent yields both the methods existence table and the def-node table; the latter is also
         # consumed by `record_class_sources`, so a def-dense file is walked once here instead of three times (methods +
         # def-nodes ×2). See {#build_methods_and_def_nodes}.
         file_methods, file_def_nodes, file_envelopes, file_refinements, file_singleton_def_nodes, certainty =
-          walk_def_contributions(acc, path, root)
+          walk_def_contributions(acc, path, root, uncertain: uncertain)
         merge_discovered_defs(acc[:def_nodes], acc[:def_sources], path, file_def_nodes)
         fold_parameter_envelopes(acc, file_envelopes)
         fold_refinements(acc, file_refinements)
@@ -9541,8 +10371,8 @@ module Rigor
       # file's siblings folded into the accumulator BEFORE its members join it (ADR-119 WD3: the `possible` rule
       # reads the accumulator's member as it stood). Returns `[methods, def_nodes, envelopes, refinements,
       # singleton_def_nodes, certainty]`, the classification passed on for the visibility walk.
-      def walk_def_contributions(acc, path, root)
-        certainty = Certainty.possible_nodes(root)
+      def walk_def_contributions(acc, path, root, uncertain: false)
+        certainty = uncertain ? Certainty.every_contribution(root) : Certainty.possible_nodes(root)
         file_methods, file_def_nodes, file_envelopes, file_refinements, file_siblings =
           build_methods_and_def_nodes(root, path, certainty: certainty)
         file_singleton_def_nodes, file_singleton_contested = build_singleton_def_tables(root, certainty: certainty)
@@ -9588,7 +10418,15 @@ module Rigor
         census.writes.each do |name, descriptor|
           (acc[:constant_writes][name] ||= {})[path] = descriptor
         end
-        acc[:global_write_census].merge(census.write_census.census)
+        acc[:global_write_census].merge(attribute_own_writes(census.write_census.census, path))
+      end
+
+      # #1154 — tags each `[:own_write, class, ivar]` entry with the file that records it, so a reader of the merged
+      # census can tell a second file writing the same ivar of the same class (`UnseenIvarWriters`).
+      def attribute_own_writes(census, path)
+        return census unless census.any? { |entry| entry.first == :own_write }
+
+        census.to_set { |entry| entry.first == :own_write ? [*entry, path].freeze : entry }
       end
 
       # Folds one file's Data + Struct member-layout tables into the cross-file accumulator (kept out of
@@ -9607,8 +10445,9 @@ module Rigor
       def merge_class_keyed_index_tables(acc, root, file_methods, certainty)
         file_visibilities, file_contested = build_method_visibility_tables(root, certainty: certainty)
         siblings = acc[:siblings]
-        siblings[:contested_discovered_method_visibilities] = fold_slot_contests(
-          siblings[:contested_discovered_method_visibilities], file_visibilities, file_contested
+        siblings[:contested_discovered_method_visibilities] = fold_visibility_contests(
+          siblings[:contested_discovered_method_visibilities], acc[:method_visibilities], file_visibilities,
+          file_contested
         )
         file_visibilities.each do |class_name, table|
           (acc[:method_visibilities][class_name] ||= {}).merge!(table)
@@ -9710,8 +10549,12 @@ module Rigor
                                      singleton_cref: false)
         return unless node.is_a?(Prism::Node)
 
+        # #1154 — the class whose instance `def`s the ivar-writer census credits; none under `class << self`.
+        ivar_owner = census_ivar_owner(qualified_prefix, self_owner, singleton_cref)
         case node
         when Prism::SingletonClassNode
+          # #1154 — a `class << self` inside an instance `def` opens the instance's singleton class.
+          tables.write_census.visit(node, top_level: qualified_prefix.empty?, owner: ivar_owner)
           return walk_census_singleton_class(node, qualified_prefix, tables, self_owner,
                                              meta_owner, singleton_cref)
         when Prism::ClassNode, Prism::ModuleNode
@@ -9719,7 +10562,7 @@ module Rigor
                                          singleton_cref)
         else
           census_constant_write(node, qualified_prefix, tables, self_owner, singleton_cref: singleton_cref)
-          tables.write_census.visit(node, top_level: qualified_prefix.empty?)
+          tables.write_census.visit(node, top_level: qualified_prefix.empty?, owner: ivar_owner)
         end
 
         rebound = rebound_block_self(node, qualified_prefix, nil, meta_owner, self_owner)
@@ -9751,6 +10594,16 @@ module Rigor
         end
       end
 
+      # #1154 — the class whose instance `def`s the ivar-writer census credits: the class a `Struct.new` /
+      # `Data.define` / `Class.new` constant or a `K.class_eval` block opens (`self_owner`), else the lexical class;
+      # none under `class << self` or an opaque block. The prefix Array is joined only when an entry is recorded.
+      def census_ivar_owner(qualified_prefix, self_owner, singleton_cref)
+        return self_owner if self_owner.is_a?(String)
+        return nil if self_owner || singleton_cref || qualified_prefix.empty?
+
+        qualified_prefix
+      end
+
       # Under an unnameable cref a bare/`self::` header pushes `#<singleton>::Name` — still
       # unnameable — so the body keeps the OPAQUE self and the cref flag; nameable
       # headers re-anchor at a real cref.
@@ -10838,6 +11691,7 @@ module Rigor
             table[node] = parent_scope
             parent_scope
           end
+        evaluate_unentered_flow(node, table, current_scope)
 
         case node
         when Prism::IfNode
@@ -10853,7 +11707,7 @@ module Rigor
           child_scope = entered ? current_scope : closure_scope(node, current_scope)
           node.rigor_each_child { |child| propagate(child, table, child_scope) }
         when Prism::CallNode
-          propagate_call(node, table, current_scope)
+          propagate_call(node, table, current_scope, recorded: recorded)
         when Prism::RescueNode, Prism::EnsureNode
           # Issue #1360 — a clause the evaluator did not enter (a `begin` in a value position) reads `$!`, `$@` and
           # `$?` unbound, not the enclosing clause's; one it entered keeps what it recorded.
@@ -10867,6 +11721,84 @@ module Rigor
         end
       end
 
+      # Issues #2196 and #2056 — the constructs whose parts run under a narrowing their own condition or left operand
+      # makes, keyed to the part {StatementEvaluator} records first when it enters one. Issue #2214 — a `&&=` on a
+      # variable runs its value under the variable's truthy narrowing (`[c &&= c + 1]`).
+      UNENTERED_FLOW_ENTRY = {
+        Prism::AndNode => :left, Prism::OrNode => :left,
+        Prism::IfNode => :predicate, Prism::UnlessNode => :predicate,
+        Prism::WhileNode => :predicate, Prism::UntilNode => :predicate,
+        Prism::LocalVariableAndWriteNode => :value, Prism::InstanceVariableAndWriteNode => :value,
+        Prism::ClassVariableAndWriteNode => :value, Prism::GlobalVariableAndWriteNode => :value,
+        Prism::CaseNode => :predicate
+      }.freeze
+      private_constant :UNENTERED_FLOW_ENTRY
+
+      UNENTERED_EVALUATOR_KEY = :rigor_scope_index_unentered_evaluator
+      private_constant :UNENTERED_EVALUATOR_KEY
+
+      # Issues #2196 and #2056 — an `&&` / `||` / `and` / `or`, an `if` / `unless` / ternary or a `while` / `until`
+      # in a value position (an array element, a hash value, a call argument, an interpolation, a multi-value
+      # `return`) is typed by `ExpressionTyper` and never entered, so no part of it was recorded and this walk handed
+      # every part one scope. A walk that narrows by the condition's edges cannot follow a write inside the narrowed
+      # part (`[c && (c = c.size; c.even?)]`, `[x || (set!; @x.upcase)]`) nor one inside a block in an earlier
+      # conjunct (`[x.nil? && [1].each { x = "d" } && x.upcase]`). Such a construct is evaluated here instead, from
+      # the scope this walk reached it with, under the index's own recorder, so each part is recorded with the scope
+      # the statement form records it with. What it does not visit (a dead arm) is walked as before.
+      def evaluate_unentered_flow(node, table, current_scope)
+        entry = UNENTERED_FLOW_ENTRY[node.class]
+        return if entry.nil?
+
+        # An entered construct is already recorded; skipping it is a performance guard, not a behaviour. A `case`
+        # without a subject records its first `when` test first.
+        part = node.public_send(entry) || (node.conditions.first&.conditions&.first if node.is_a?(Prism::CaseNode))
+        return if part.nil? || table.key?(part)
+
+        evaluate = Thread.current[UNENTERED_EVALUATOR_KEY]
+        evaluate&.call(node, current_scope, code_body_nodes(node, current_scope.source_path))
+      end
+
+      # The evaluation of an unentered construct starts with no class frame and no lexical nesting, which only a code
+      # body observes: a `def`, a `class` / `module` / `class << …` body, and the block of a class-creating call
+      # (`Class.new { … }`, `Struct.new`, `Data.define`, `Module.new`) or of a `refine`, whose `def`s and constants
+      # resolve against the class the walk tracks and the evaluation does not. Every node in one is left out of the
+      # recording, so the walk reaches it unrecorded and handles it as it did before #2196 ({#unentered_block_entry},
+      # {#record_class_body_defs}).
+      # Answers nil, allocating nothing, for a construct holding no code body: the common case.
+      def code_body_nodes(node, source_path, acc = nil, inside: false)
+        inside ||= CODE_BODY_NODES.include?(node.class)
+        (acc ||= Set.new.compare_by_identity) << node if inside
+        if !inside && node.is_a?(Prism::CallNode) && class_body_block_call?(node, source_path)
+          acc = code_body_nodes(node.block, source_path, acc, inside: true)
+          node.rigor_each_child do |child|
+            acc = code_body_nodes(child, source_path, acc) unless child.equal?(node.block)
+          end
+          return acc
+        end
+        node.rigor_each_child { |child| acc = code_body_nodes(child, source_path, acc, inside: inside) }
+        acc
+      end
+
+      CODE_BODY_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      private_constant :CODE_BODY_NODES
+
+      def class_body_block_call?(node, source_path)
+        node.block.is_a?(Prism::BlockNode) &&
+          (!AnonymousMetaClass.name_for(node, source_path).nil? || !refine_target(node).nil?)
+      end
+
+      # The evaluation {#evaluate_unentered_flow} runs for the walk of one {#index}, installed for that walk only.
+      # Index walks nest (a rule may re-index a file while another file's walk is suspended), so the outer one is
+      # restored on exit. A `propagate` called directly while an outer index walk is running would record into the
+      # OUTER index's table through it; nothing outside {#index} calls `propagate`.
+      def with_unentered_evaluator(evaluate)
+        outer = Thread.current[UNENTERED_EVALUATOR_KEY]
+        Thread.current[UNENTERED_EVALUATOR_KEY] = evaluate
+        yield
+      ensure
+        Thread.current[UNENTERED_EVALUATOR_KEY] = outer
+      end
+
       SELF_OPENING_BODIES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
       private_constant :SELF_OPENING_BODIES
 
@@ -10901,11 +11833,11 @@ module Rigor
       # argument one scope and threads none, so arguments that write keep the call's: an earlier one may rebind the
       # receiver a later one reads (`return y&.concat((y = nil).to_s, y.upcase)`, where the evaluator threads no
       # operand).
-      def propagate_call(node, table, current_scope)
+      def propagate_call(node, table, current_scope, recorded: false)
         block = node.block
         operands =
           OperandEffects.any?(node.arguments) ? current_scope : Narrowing.safe_navigation_scope(node, current_scope)
-        entry = unentered_block_entry(node, block, table, current_scope)
+        entry = unentered_block_entry(node, block, table, current_scope, call_recorded: recorded)
         if entry.equal?(current_scope) && operands.equal?(current_scope)
           node.rigor_each_child { |child| propagate(child, table, current_scope) }
           return
@@ -10929,7 +11861,7 @@ module Rigor
         node.rigor_each_child { |child| propagate(child, table, child_scope) }
       end
 
-      def unentered_block_entry(node, block, table, current_scope)
+      def unentered_block_entry(node, block, table, current_scope, call_recorded: false)
         return current_scope unless block.is_a?(Prism::BlockNode) && !table.key?(block)
 
         narrowing = unentered_block_narrowing(node, current_scope)
@@ -10942,6 +11874,12 @@ module Rigor
           else
             LastLine.block_entry(FreshFrameBlocks.closure_entry(current_scope, block, node), block, node)
           end
+        # Issue #2196 — a class-body block whose call the evaluator recorded but did not enter (one inside a construct
+        # {#evaluate_unentered_flow} evaluated, or a later operand) starts from the scope the call was evaluated in,
+        # which may narrow a captured local the body writes; this walk runs the body's statements from one scope, so
+        # such a local reads `Dynamic[top]` in it: `[c && Class.new { c = c.size; c.even? }]`. A block whose call was
+        # not recorded keeps the enclosing scope as before.
+        entry = widen_condition_writes(block, entry) if call_recorded && class_body_block_call?(node, entry.source_path)
         anonymous = AnonymousMetaClass.name_for(node, current_scope.source_path)
         return unentered_meta_class_body_entry(block, entry, anonymous, table) if anonymous
 
@@ -11073,20 +12011,28 @@ module Rigor
         scope.local(name).nil? ? scope : scope.with_local(name, Type::Combinator.untyped)
       end
 
+      # Issue #1924 — an `if` / `elsif` / `unless` / ternary the evaluator did not enter (`[if (x ||= "d").empty?
+      # then 0 else x.upcase end]`) applies no write its condition makes, so its edges are taken from a scope where
+      # every bound local the condition writes reads `Dynamic[top]` ({#widen_condition_writes}), as
+      # {#propagate_subjectless_case} takes a `when` condition's. The condition itself reads the scope before it.
       def propagate_if_branches(node, table, current_scope)
-        truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, current_scope)
+        truthy_scope, falsey_scope = conditional_edges(node.predicate, current_scope)
         propagate(node.predicate, table, current_scope) if node.predicate
         propagate(node.statements, table, truthy_scope) if node.statements
         propagate(node.subsequent, table, falsey_scope) if node.subsequent
       end
 
       def propagate_unless_branches(node, table, current_scope)
-        truthy_scope, falsey_scope = Narrowing.predicate_scopes(node.predicate, current_scope)
+        truthy_scope, falsey_scope = conditional_edges(node.predicate, current_scope)
         propagate(node.predicate, table, current_scope) if node.predicate
         propagate(node.statements, table, falsey_scope) if node.statements
         propagate(node.else_clause, table, truthy_scope) if node.else_clause
       end
 
+      def conditional_edges(predicate, scope)
+        Narrowing.predicate_scopes(predicate, widen_condition_writes(predicate, scope))
+      end
+
       # Issue #1495 — a `case` without a subject the evaluator did not enter (`[case; when x.nil? then 0; else x.size
       # end]`) narrows by its conditions' edges, as {StatementEvaluator#subjectless_when_scopes} does: each condition
       # under the falsey edges of the conditions before it, each clause under the join of its conditions' truthy edges,
@@ -11120,7 +12066,8 @@ module Rigor
       # A test that calls a method may rebind an instance-variable or global subject before the body reads it
       # (`when String then 1 when reset! then @x.upcase`, where `reset!` writes `@x`), and the walk cannot tell. From
       # the first such test on, the subject reads `Dynamic[top]` on both edges ({#forget_called_subject}). The
-      # evaluator keeps the narrowing there (a separate defect); the walk declines it rather than add a report.
+      # evaluator forgets a global subject there too (issue #2211). A `case` / `when` the evaluator did not enter is
+      # evaluated ({#evaluate_unentered_flow}); this walk handles only a clause that evaluation does not visit.
       def propagate_subject_case(node, table, current_scope)
         subject = node.predicate
         propagate(subject, table, current_scope)