rigortype 0.4.5 → 0.4.6

data/lib/rigor/inference/scope_indexer.rb

@@ -43,6 +43,8 @@ require_relative "scope_indexer/layered_def_nestings"
 require_relative "scope_indexer/mixin_accumulator"
 require_relative "scope_indexer/certainty"
 require_relative "scope_indexer/member_layouts_collector"
+require_relative "scope_indexer/declared_ivar_types"
+require_relative "scope_indexer/declared_param_writes"
 
 module Rigor
   module Inference
@@ -112,7 +114,17 @@ module Rigor
       # nothing-to-re-anchor walk allocates none.
       EMPTY_RENAMES = {}.freeze
 
-      def index(root, default_scope:, converged_loop_recording: false, widen_clauses: false) # rubocop:disable Metrics/AbcSize
+      # No path whose contributions are all `possible` (issue #2021), the cross-file walks' default.
+      EMPTY_PATH_SET = Set.new.freeze
+
+      # `declared_ivar_types:` — whether an RBS-declared ivar type replaces the census's join of the writes (#1406).
+      # `rigor sig-gen` passes false: it proposes what the code says, and reading a declaration back would make a row
+      # count as generated only because it is declared.
+      # `ivar_writer_scope:` — the scope whose project tables the #1154 declared-parameter credit reads to find the
+      # ivar writers outside this file ({DeclaredParamWrites}); defaults to `default_scope`. `rigor sig-gen` indexes
+      # each file under an unseeded scope, so it passes one carrying the project's tables.
+      def index(root, default_scope:, converged_loop_recording: false, widen_clauses: false, # rubocop:disable Metrics/AbcSize
+                declared_ivar_types: true, ivar_writer_scope: nil)
         # Slice A-declarations. Build the declaration overrides first so every scope handed to the StatementEvaluator
         # already carries the table; structural sharing through `Scope#with_local` / `#with_fact` / `#with_self_type`
         # propagates it across every derived scope.
@@ -134,7 +146,9 @@ module Rigor
 
         # Slice 7 phase 2. Pre-pass over every class/module body to collect the per-class ivar accumulator. Seeded after
         # declared_types so the rvalue typer in the pre-pass can see declaration overrides.
-        class_ivars = build_class_ivar_index(root, seeded_scope)
+        class_ivars = DeclaredParamWrites.with_writer_scope(ivar_writer_scope) do
+          build_class_ivar_index(root, seeded_scope, declared_ivar_types: declared_ivar_types)
+        end
         seeded_scope = seeded_scope.with_discovery(seeded_scope.discovery.with(class_ivars: class_ivars))
 
         # Slice 7 phase 6. Same pre-pass shape for cvars (per class) and globals (program-wide). Globals are also
@@ -197,15 +211,27 @@ module Rigor
         # share.
         seeded_scope = seed_struct_fold_safe(seeded_scope, root).with_match_frame(root)
 
-        on_enter = ->(node, scope) { table[node] = scope }
-        StatementEvaluator.new(scope: seeded_scope, on_enter: on_enter,
-                               converged_loop_recording: converged_loop_recording,
-                               widen_clauses: widen_clauses).evaluate(root)
+        evaluate = recording_evaluator(table, converged_loop_recording, widen_clauses)
+        evaluate.call(root, seeded_scope)
 
-        propagate(root, table, seeded_scope)
+        with_unentered_evaluator(evaluate) { propagate(root, table, seeded_scope) }
         table
       end
 
+      # The `(node, scope, excluded = nil) ->` evaluation that records every node it visits into `table`, except the
+      # nodes in `excluded`: the file's own pass, and each construct {#evaluate_unentered_flow} evaluates in the walk
+      # after it.
+      def recording_evaluator(table, converged_loop_recording, widen_clauses)
+        lambda do |node, scope, excluded = nil|
+          on_enter =
+            if excluded.nil? || excluded.empty? then ->(visited, at) { table[visited] = at }
+            else ->(visited, at) { table[visited] = at unless excluded.include?(visited) }
+            end
+          StatementEvaluator.new(scope: scope, on_enter: on_enter, converged_loop_recording: converged_loop_recording,
+                                 widen_clauses: widen_clauses).evaluate(node)
+        end
+      end
+
       # Runs the combined methods/def-nodes descent (one walk of the file), seeds the discovered-methods existence table
       # onto `seeded_scope` (merged UNDER the cross-file pre-pass seed `default_scope` carries), and returns `[scope,
       # file_def_nodes, file_envelopes]` so the caller can thread the def-node and issue #992 envelope tables into
@@ -498,7 +524,7 @@ module Rigor
       # (singleton vs instance). The rvalue is typed with NO local bindings — the pre-pass lacks statement-level
       # threading — so `@x = 1` records `Constant[1]` but `@x = some_local + 1` records `Dynamic[Top]` (since
       # `some_local` is unbound at pre-pass time). Multiple writes to the same ivar union via `Type::Combinator.union`.
-      def build_class_ivar_index(root, default_scope)
+      def build_class_ivar_index(root, default_scope, declared_ivar_types: true)
         accumulator = {}
         mutated_ivars = {}
         read_before_write = {}
@@ -517,6 +543,8 @@ module Rigor
         widen_mutated_ivar_entries!(accumulator, mutated_ivars)
         contribute_read_before_write_nil!(accumulator, read_before_write, init_writes)
         make_reflective_classes_gradual!(accumulator, reflective_opaque)
+        # #1406 — an RBS `@x: T` or `attr_* x: T` declaration replaces the census's join of the writes.
+        DeclaredIvarTypes.apply!(accumulator, default_scope) if declared_ivar_types
         accumulator.transform_values(&:freeze).freeze
       end
 
@@ -1024,8 +1052,11 @@ module Rigor
         # nodes to skip; soundness is post-domination at the top statement level, so dropping the nil never hides a real
         # runtime-nil read.
         dead_writes = dead_transient_nil_writes(def_node.body, class_name, method_assign_effects)
+        # #1154 — an `@x = x` from a declared parameter records the parameter's declared type.
+        declared = DeclaredParamWrites::EMPTY
+        declared = DeclaredParamWrites.collect(def_node, class_name, body_scope) unless singleton
         gather_ivar_writes(def_node.body, body_scope, class_name, accumulator,
-                           EMPTY_GUARDED_IVARS, mutated_ivars, dead_writes)
+                           EMPTY_GUARDED_IVARS, mutated_ivars, dead_writes, declared)
 
         # B2.3 — collect per-method evidence for the read-before- write nil contribution. The accumulator-level decision
         # ("is this ivar truly read-before-write across the class lifetime?") is finalised at
@@ -1341,14 +1372,14 @@ module Rigor
       private_constant :TAIL_VALUE_DEPTH_CAP
       private_constant :EMPTY_GUARDED_IVARS
 
-      def gather_ivar_writes(node, scope, class_name, accumulator, guarded_ivars = EMPTY_GUARDED_IVARS,
-                             mutated_ivars = nil, dead_writes = nil)
+      def gather_ivar_writes(node, scope, class_name, accumulator, guarded_ivars = EMPTY_GUARDED_IVARS, # rubocop:disable Metrics/ParameterLists
+                             mutated_ivars = nil, dead_writes = nil, declared = DeclaredParamWrites::EMPTY)
         return unless node.is_a?(Prism::Node)
 
         if node.is_a?(Prism::InstanceVariableWriteNode)
           unless dead_writes&.include?(node.object_id)
             record_ivar_write(node, scope, class_name, accumulator,
-                              guarded: guarded_ivars.include?(node.name))
+                              guarded: guarded_ivars.include?(node.name), declared: declared[node])
           end
         else
           record_compound_ivar_write(node, scope, class_name, accumulator)
@@ -1371,12 +1402,12 @@ module Rigor
 
         if node.is_a?(Prism::IfNode) || node.is_a?(Prism::UnlessNode)
           walk_conditional_ivar_writes(node, scope, class_name, accumulator, guarded_ivars,
-                                       mutated_ivars, dead_writes)
+                                       mutated_ivars, dead_writes, declared)
           return
         end
 
         node.rigor_each_child do |c|
-          gather_ivar_writes(c, scope, class_name, accumulator, guarded_ivars, mutated_ivars, dead_writes)
+          gather_ivar_writes(c, scope, class_name, accumulator, guarded_ivars, mutated_ivars, dead_writes, declared)
         end
       end
 
@@ -1452,22 +1483,22 @@ module Rigor
       # init; end` would otherwise be marked too — but that pattern (write @x in the else of `if @x`) is a separate
       # idiom whose surrounding reads of `@x` would then surface a nil-receiver FP. The ELSE branch is left ungarded so
       # those reads continue to type as they did before this fix.
-      def walk_conditional_ivar_writes(node, scope, class_name, accumulator, guarded_ivars,
-                                       mutated_ivars = nil, dead_writes = nil)
+      def walk_conditional_ivar_writes(node, scope, class_name, accumulator, guarded_ivars, # rubocop:disable Metrics/ParameterLists
+                                       mutated_ivars = nil, dead_writes = nil, declared = DeclaredParamWrites::EMPTY)
         then_guards = then_body_guarded_ivars(node)
         then_guarded = then_guards.empty? ? guarded_ivars : (guarded_ivars | then_guards)
 
         gather_ivar_writes(node.predicate, scope, class_name, accumulator, guarded_ivars,
-                           mutated_ivars, dead_writes)
+                           mutated_ivars, dead_writes, declared)
         if node.statements
           gather_ivar_writes(node.statements, scope, class_name, accumulator, then_guarded,
-                             mutated_ivars, dead_writes)
+                             mutated_ivars, dead_writes, declared)
         end
         branch = node.is_a?(Prism::IfNode) ? node.subsequent : node.else_clause
         return unless branch
 
         gather_ivar_writes(branch, scope, class_name, accumulator, guarded_ivars,
-                           mutated_ivars, dead_writes)
+                           mutated_ivars, dead_writes, declared)
       end
 
       # Returns the set of ivar names that, in the THEN body of this conditional, are statically known to be in a nil /
@@ -1944,8 +1975,8 @@ module Rigor
         assigns.include?(target)
       end
 
-      def record_ivar_write(node, scope, class_name, accumulator, guarded: false)
-        rvalue_type = scope.type_of(node.value)
+      def record_ivar_write(node, scope, class_name, accumulator, guarded: false, declared: nil)
+        rvalue_type = declared || scope.type_of(node.value)
 
         # `@x = nil unless @x` / `@y = false unless @y` — follow-up to the polarity-aware defensive-init guard fix
         # (ROADMAP § Future cycles — "Defensive ivar-init with nil / false rvalue"). When the rvalue is itself a falsey
@@ -3433,7 +3464,17 @@ module Rigor
       # walk worked out for it ({#refine_context}).
       MethodTables = Struct.new(:existence, :envelopes, :refinements, :certainty, :certain, :possible,
                                 :contested_envelopes, :contested_def_nodes, :root, :in_effect, :census,
-                                :refine_text, :literal_seen, :source_bytes, :loose_constants, :block_spans) do
+                                :refine_text, :literal_seen, :source_bytes, :loose_constants, :block_spans,
+                                :definer_history) do
+        # Issue #2006 — records, in walk order, that a definer other than an alias wrote the instance method `name`
+        # of `class_name` at `node`: `def_node` for a `def`, nil for a `define_method(:x)` or an `attr_*` reader or
+        # writer, and whether the write is {#certain}. {ScopeIndexer#apply_alias_def_nodes} reads the history to copy
+        # what an alias's old name held at the alias, and to tell an alias a later definer replaced.
+        def wrote_definer(class_name, name, node, def_node)
+          entry = [node.location.start_offset, def_node, certain ? true : false].freeze
+          ((self.definer_history ||= {})[[class_name, name]] ||= []) << entry
+        end
+
         # {ScopeIndexer.module_refine_target} against this tree's {InEffectRefinements}.
         def refine_target_of(node)
           return nil if ScopeIndexer.refine_target(node).nil?
@@ -4171,7 +4212,9 @@ module Rigor
           anonymous = record_call_node_methods(node, owner_prefix, in_singleton_class, methods_acc.at(node),
                                                source_path)
           unless in_singleton_class
-            supersede_def_nodes(call_superseded_names(node), owner_prefix, def_nodes_acc, methods_acc.at(node))
+            superseded = call_superseded_names(node)
+            supersede_def_nodes(superseded, owner_prefix, def_nodes_acc, methods_acc.at(node))
+            note_call_definers(node, superseded, owner_prefix, methods_acc.at(node))
           end
           tables = methods_acc.at(node)
           record_singleton_prepend(node, qualified_prefix, tables,
@@ -4811,6 +4854,7 @@ module Rigor
         accumulator[class_name] ||= {}
         accumulator[class_name][def_node.name] = def_node
         follow_slot_writer(tables, :contested_def_nodes, [class_name, def_node.name], tables.nil? || tables.certain)
+        tables&.wrote_definer(class_name, def_node.name, def_node, def_node)
         record_anonymous_body_def_as_toplevel(def_node, qualified_prefix, accumulator, tables)
       end
 
@@ -4870,6 +4914,16 @@ module Rigor
         end
       end
 
+      # Issue #2006 — a `define_method(:x)` or `attr_*` call is a definer the alias pass reads in source order
+      # ({#apply_alias_def_nodes}). An `alias_method` call, whose new name {#call_superseded_names} also lists, is
+      # itself an alias: the pass records its copy, so the history must not hold it as a definer with no `def`.
+      def note_call_definers(call_node, names, qualified_prefix, tables)
+        return if names.empty? || qualified_prefix.empty? || call_node.name == :alias_method
+
+        class_name = qualified_prefix.join("::")
+        names.each { |name| tables.wrote_definer(class_name, name, call_node, nil) }
+      end
+
       # #319 — a `def` inside an anonymous `Class.new` / `Module.new` body ALSO stays in the `<toplevel>` table.
       # Before the anonymous class had a name the body was walked with an empty prefix, so every such `def`
       # landed there; that is the same leniency this key already grants a `def` nested in any other DSL block
@@ -5035,7 +5089,7 @@ module Rigor
       # nested `def` or block inside its body is still a range the containment half needs.
       # `def_owner_prefix` is the eval-body override described on {#walk_methods_and_def_nodes}:
       # an explicit owner for def rows while declarations stay lexical (`[]` = ownerless).
-      def walk_deferred_ranges(node, qualified_prefix, in_singleton_class, inside_deferred, # rubocop:disable Metrics/ParameterLists
+      def walk_deferred_ranges(node, qualified_prefix, in_singleton_class, inside_deferred, # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
                                mf_offsets, ranges, def_owner_prefix = nil, singleton_cref: false,
                                defs_singleton: false)
         return unless node.is_a?(Prism::Node)
@@ -5071,11 +5125,34 @@ module Rigor
                                       singleton_cref: singleton_cref)
         end
 
+        record_definer_name_row(node, ranges) if node.is_a?(Prism::CallNode)
         walk_deferred_children(node, qualified_prefix, in_singleton_class, inside_deferred,
                                mf_offsets, ranges, def_owner_prefix, singleton_cref: singleton_cref,
                                                                      defs_singleton: defs_singleton)
       end
 
+      DEFINER_NAME_CALLS = Set[:define_method, :define_singleton_method, :alias_method].freeze
+      DEFINER_SEND_CALLS = Set[:send, :__send__, :public_send].freeze
+      private_constant :DEFINER_NAME_CALLS, :DEFINER_SEND_CALLS
+
+      # Issue #2184 — a `define_method` / `define_singleton_method` / `alias_method` call with a literal (new) name,
+      # on any receiver and through `send` too, records an ownerless, kindless row over the name literal: no owner or
+      # side is claimed, so no ordering scan matches it and the literal contains no call. It only tells a by-name
+      # reader that the project gives the name a body no def table holds. A computed name records nothing.
+      def record_definer_name_row(node, ranges)
+        arguments = node.arguments&.arguments || []
+        if DEFINER_SEND_CALLS.include?(node.name)
+          return unless DEFINER_NAME_CALLS.include?(literal_method_name(arguments.first))
+
+          arguments = arguments.drop(1)
+        end
+        return unless DEFINER_NAME_CALLS.include?(node.name) || DEFINER_SEND_CALLS.include?(node.name)
+
+        argument = arguments.first
+        name = literal_method_name(argument)
+        ranges << [argument.location.start_offset, argument.location.end_offset, name, nil, nil] if name
+      end
+
       # The `def` arm of {#walk_deferred_ranges}: records the range row — singleton-side when the
       # def sits in a `class <<` body or an `instance_eval` block (`defs_singleton`) — then walks
       # the body as a deferred range.
@@ -5586,7 +5663,9 @@ module Rigor
                               mf_offsets, ranges)
         start = def_node.location.start_offset
         if inside_deferred
-          ranges << [start, def_node.location.end_offset, nil, nil, nil]
+          # Issue #2184 — the def installs at invocation under a `self` the walk does not know, so the row names the
+          # method but claims no owner or side.
+          ranges << [start, def_node.location.end_offset, def_node.name, nil, nil]
           return
         end
 
@@ -7564,7 +7643,8 @@ module Rigor
         return record_module_function(node, current_class, accumulator, in_singleton) if node.name == :module_function
 
         taint_opaque_eval(node, current_class, accumulator)
-        return if singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator)
+        return if singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator,
+                                                   in_singleton: in_singleton)
 
         kind, _arguments, via_send = mixin_call_view(node)
         return if kind.nil?
@@ -7572,7 +7652,8 @@ module Rigor
         effects = mixin_effects(node, kind, qualified_prefix, current_class, accumulator, in_singleton: in_singleton)
                   .select { |_owner, side| side == :extend || in_singleton }
         return if effects.empty?
-        return if !via_send && singleton_mixin_recorded?(node, kind, current_class, accumulator, in_singleton)
+        return if !via_send && singleton_mixin_recorded?(node, kind, qualified_prefix, current_class, accumulator,
+                                                         in_singleton)
 
         effects.each { |owner, side| accumulator.taint(owner, side) }
       end
@@ -7587,7 +7668,7 @@ module Rigor
       # but only where it is a direct statement (a top-level statement, or one of a direct declaration body or of a
       # block that runs there once): there the methods walk records those marks under the same owner. In a method
       # body, a hook or a conditional it may run on a receiver or at a time the marks cannot place, so it still taints.
-      def singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator)
+      def singleton_class_rewrite_tainted?(node, qualified_prefix, current_class, accumulator, in_singleton: false)
         receiver = node.receiver
         return false unless singleton_class_of_receiver?(receiver) && surface_rewriting_call?(node)
         return false if singleton_class_named_call?(node) && accumulator.direct?(node)
@@ -7595,10 +7676,33 @@ module Rigor
         owner = singleton_class_owner(node, receiver.receiver, qualified_prefix, current_class)
         return false if owner.nil?
 
+        # Inside `class << self` a bare `singleton_class` is the singleton's own singleton, one level up from the
+        # owner's extend side, so that call stays a taint.
+        up_level = in_singleton && lexical_self_receiver?(receiver.receiver)
+        return true if !up_level && singleton_class_include_recorded?(node, owner, accumulator)
+
         accumulator.taint(owner, :extend)
         true
       end
 
+      # Issue #2094 — `Float.singleton_class.include(Ext)` (or `prepend`, which the extend table cannot order, so the
+      # edge is unpositioned as every receiver-form edge is) puts `Ext` on the singleton side as `Float.extend(Ext)`
+      # does, the fold #915 gives `class << self; include M`. A `send` spelling or an argument that is not a constant
+      # stays a taint.
+      def singleton_class_include_recorded?(node, owner, accumulator)
+        return false unless %i[include prepend].include?(node.name)
+
+        arguments = node.arguments&.arguments || []
+        return false if arguments.empty? || arguments.any? { |arg| Source::ConstantPath.qualified_name(arg).nil? }
+
+        !record_extend_targets(node, owner, accumulator).empty?
+      end
+
+      # A bare or `self.` receiver: the lexical `self`.
+      def lexical_self_receiver?(receiver)
+        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+      end
+
       # A bare, `self.` or constant receiver's `singleton_class` call.
       def singleton_class_of_receiver?(receiver)
         receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class && receiver.arguments.nil?
@@ -7657,13 +7761,29 @@ module Rigor
 
       # Records the singleton-side edges of a receiverless `extend` (or, inside `class << self`, `include` /
       # `prepend`). False when it recorded nothing.
-      def singleton_mixin_recorded?(node, kind, current_class, accumulator, in_singleton)
-        return false unless current_class && node.receiver.nil?
+      def singleton_mixin_recorded?(node, kind, qualified_prefix, current_class, accumulator, in_singleton)
+        return receiver_extend_recorded?(node, kind, qualified_prefix, accumulator) if node.receiver
+        return false unless current_class
         return false unless in_singleton ? MIXIN_CALL_NAMES.include?(kind) : kind == :extend
 
         !record_extend_targets(node, current_class, accumulator).empty?
       end
 
+      # Issue #2094 — the receiver form, `Float.extend(Ext)`: the singleton twin of #1722's `Integer.include(Ext)`,
+      # filed under the class the constant receiver names ({#prepend_call_receiver}) and, like that form,
+      # unpositioned wherever it is written ({MixinAccumulator#note}). A `self` argument names the receiver, not the
+      # enclosing class, so a call with one stays a taint. A constant receiver names the same class inside
+      # `class << self`, so the walk's singleton flag does not matter here.
+      def receiver_extend_recorded?(node, kind, qualified_prefix, accumulator)
+        return false if kind != :extend
+        return false if (node.arguments&.arguments || []).any?(Prism::SelfNode)
+
+        owner = prepend_call_receiver(node, qualified_prefix)
+        return false if owner.nil?
+
+        !record_extend_targets(node, owner, accumulator).empty?
+      end
+
       # The table stores search order, not call order: a later `extend` statement prepends its module
       # (`extend A; extend B` → singleton ancestors `[B, A]`) while the arguments of a single
       # `extend A, B` keep call order (`[A, B]`). Prepending each call's argument list preserves both,
@@ -7895,6 +8015,16 @@ module Rigor
           end
         end
 
+        # Issue #2013 — contests the instance slot of `name`, recorded or not, and marks the contest as a
+        # replacement's ({ScopeIndexer.replaced_visibility_mark}): a `define_method(:name)` or an alias gave the name
+        # a visibility the walk does not read, and another file may record the slot. A later certain write in this
+        # walk clears the contest ({#wrote}) and leaves the mark, which then only keeps a contest another file puts on
+        # the slot: the fold declines more, never reports more, and file order is not load order there either.
+        def contest_replaced(class_name, name)
+          contest_slot(class_name, name)
+          contest_slot(class_name, ScopeIndexer.replaced_visibility_mark(name))
+        end
+
         # Contests the `[class_name, name]` slot, recorded or not: a visibility call changed it in a way the walk
         # cannot read (`private def self.x` reaching an instance `x`).
         def contest_slot(class_name, name)
@@ -8231,6 +8361,12 @@ module Rigor
       # them public (`K.public_class_method(*names)`, `K.singleton_class.class_eval { … }`).
       SINGLETON_WILDCARD_SLOT = %i[singleton *].freeze
 
+      # Issue #2013 — the mark a contested instance slot `name` carries in `contested_discovered_method_visibilities`
+      # when a `define_method(:name)` or an alias replaced the method: `[:replaced, name]`. No reader asks for it; it
+      # keeps the slot's contest when another file's write of the slot folds later ({#fold_visibility_contests}),
+      # since file order is not load order.
+      def self.replaced_visibility_mark(name) = [:replaced, name].freeze
+
       # Issue #1984 — a class method visibility call written on a constant (`K.public_class_method(:x)`,
       # `K.send(:public_class_method, :x)`), anywhere: each literal name is recorded public on every class the
       # constant may name, so a reopening's or another file's `private_class_method` disagrees with it and is
@@ -8501,19 +8637,21 @@ module Rigor
         Source::AliasNames.alias_method_call_names(call_node)&.first(1) || []
       end
 
-      # Issue #1989 — a `define_method` or an alias that replaces a method whose visibility slot this walk recorded
-      # gives the name a visibility the walk does not read (the running default for `define_method`, the old
-      # name's for an alias), so the slot is contested rather than left asserting the replaced `def`'s. Issue #1984
-      # — on the singleton side the slot is contested whether or not this file recorded it, since another file may
-      # have.
+      # Issue #1989 — a `define_method` or an alias that replaces a method gives the name a visibility the walk
+      # does not read (the running default for `define_method`, the old name's for an alias), so the slot is
+      # contested rather than left asserting the replaced `def`'s. Issue #1984 — the slot is contested whether or
+      # not this file recorded it, since another file may have; issue #2013 — on the instance side too, with the
+      # mark that keeps the contest when that file's write folds later ({VisibilityTable#contest_replaced}).
       def contest_replaced_visibility(names, qualified_prefix, accumulator, side: :instance)
         return if names.empty? || qualified_prefix.empty?
 
         class_name = qualified_prefix.join("::")
-        recorded = accumulator[class_name]
         names.each do |name|
-          slot = visibility_slot(name, side)
-          accumulator.contest_slot(class_name, slot) if side == :singleton || recorded&.key?(slot)
+          if side == :singleton
+            accumulator.contest_slot(class_name, visibility_slot(name, side))
+          else
+            accumulator.contest_replaced(class_name, name)
+          end
         end
       end
 
@@ -8754,48 +8892,76 @@ module Rigor
       #
       # ADR-119 WD3 — the alias is the slot's writer: the new name's slot is contested when the alias is possible
       # or the slot it copies is contested, and cleared otherwise.
-      def apply_alias_def_nodes(root, accumulator, tables = nil)
-        alias_map = collect_class_alias_map(root, [], AliasMap.new.track(tables&.certainty))
-        alias_map.each do |class_name, aliases|
-          class_defs = accumulator[class_name]
-          next unless class_defs
-
-          aliases.each do |new_name, old_name|
-            def_node = class_defs[old_name]
-            next unless def_node.is_a?(Prism::DefNode)
-
-            (accumulator[class_name] ||= {})[new_name] = def_node
-            next if tables.nil?
-
-            certain = !alias_map.possible?(class_name, new_name) &&
-                      !tables.contested_def_nodes&.include?([class_name, old_name])
-            follow_slot_writer(tables, :contested_def_nodes, [class_name, new_name], certain)
-          end
+      #
+      # Issue #2006 — in source order. An alias copies what its old name held AT the alias, read from the walk's
+      # definer history ({MethodTables#wrote_definer}) and the copies earlier aliases made: a `def` of the old name
+      # written after the alias (`alias old_x x; def x = 1`) is not what `old_x` runs, and nothing before the alias
+      # copies nothing. The new name's slot then follows its last writer: a later `def` keeps the slot the walk
+      # gave it, and a later `define_method` / `attr_*` leaves the copy contested, as {#supersede_def_nodes} leaves
+      # a replaced `def`.
+      def apply_alias_def_nodes(root, accumulator, tables)
+        alias_map = collect_class_alias_map(root, [], AliasMap.new.track(tables.certainty))
+        history = (tables.definer_history || {}).transform_values(&:dup)
+        alias_map.copy_into(history).each { |key| settle_alias_slot(accumulator, tables, key, history[key]) }
+      end
+
+      # Writes the new name's slot from its last writer `writes.last` ({#apply_alias_def_nodes}): an alias copy or a
+      # later `def` writes its `def` with its certainty (for the `def`, what the walk wrote already). A last writer
+      # with no `def` this file holds — a later `define_method` / `attr_*`, or an alias that copies nothing this file
+      # defines (an inherited or core method, an attr reader, a name it cannot read) — contests the slot, which keeps
+      # what it holds or else the latest copy, so no sibling file's `def` fills it.
+      def settle_alias_slot(accumulator, tables, (class_name, new_name), writes)
+        last = writes.last
+        slot = (accumulator[class_name] ||= {})
+        if last[1]
+          slot[new_name] = last[1]
+          follow_slot_writer(tables, :contested_def_nodes, [class_name, new_name], last[2])
+        else
+          copy = writes.rfind { |write| write[1] }
+          slot[new_name] ||= copy[1] if copy
+          follow_slot_writer(tables, :contested_def_nodes, [class_name, new_name], false)
         end
       end
 
-      # The `{class => {new name => old name}}` map {#collect_class_alias_map} fills, which also remembers, per
-      # entry, whether the alias that wrote it last is possible ({Certainty}).
+      # The `{class => {new name => old name}}` map {#collect_class_alias_map} fills, which also lists every alias it
+      # met as an event `[class, new name, old name, start offset, possible?]` ({Certainty}).
       class AliasMap < Hash
+        attr_reader :events
+
         def track(certainty)
           @certainty = certainty || Certainty::EMPTY
-          @possible = nil
+          @events = []
           self
         end
 
-        # Records that `node` wrote the `[class_name, new_name]` entry.
-        def wrote(class_name, new_name, node)
+        # Records that `node` wrote the `[class_name, new_name]` entry, aliasing `old_name`.
+        def wrote(class_name, new_name, old_name, node)
           return if @certainty.nil?
 
-          if Certainty.possible?(@certainty, node)
-            (@possible ||= Set.new) << [class_name, new_name]
-          else
-            @possible&.delete([class_name, new_name])
-          end
+          @events << [class_name, new_name, old_name, node.location.start_offset, Certainty.possible?(@certainty, node)]
+        end
+
+        # Issue #2006 — adds every alias to `history` (`{[class, name] => [[offset, def node or nil, certain,
+        # (:alias)], ...]}`, ascending), in source order. An alias whose old name held a `def` at the alias copies it,
+        # certain when that write and the alias are. Any other alias — an old name with no `def` of this file before
+        # it (inherited, core, an attr reader, a sibling file's), or one it cannot read — adds a write with no `def`,
+        # which leaves the slot contested ({ScopeIndexer#settle_alias_slot}). An alias whose new name it cannot read
+        # adds one to every name of the class written before it. Returns the `[class, name]` keys it wrote.
+        def copy_into(history)
+          @events.sort_by { |event| event[3] }.flat_map do |class_name, new_name, old_name, at, possible|
+            source = old_name && history[[class_name, old_name]]&.rfind { |write| write.first < at }
+            write = if source&.[](1) then [at, source[1], source[2] && !possible, :alias].freeze
+                    else [at, nil, false, :alias].freeze
+                    end
+            keys = new_name ? [[class_name, new_name]] : names_before(history, class_name, at)
+            keys.each { |key| (history[key] ||= []).push(write).sort_by!(&:first) }
+          end.uniq
         end
 
-        def possible?(class_name, new_name)
-          !@possible.nil? && @possible.include?([class_name, new_name])
+        private
+
+        def names_before(history, class_name, at)
+          history.filter_map { |key, writes| key if key.first == class_name && writes.first.first < at }
         end
       end
 
@@ -8857,12 +9023,19 @@ module Rigor
         # `t` alias was the corpus case). Unlike AliasMethodNode a call's children can carry further
         # class bodies (`Class.new do … end`), so the walk continues below it either way.
         names = Source::AliasNames.alias_method_call_names(node)
-        if names && !rec_prefix.empty? && !(singleton_cref && leaf_owner.nil?)
+        if (names || unread_alias_method?(node)) && !rec_prefix.empty? && !(singleton_cref && leaf_owner.nil?)
           record_alias_call_entry(accumulator, rec_prefix.join("::"), names, node)
         end
         false
       end
 
+      # Issue #2006 — an `alias_method` call on no receiver or `self` whose names {Source::AliasNames} cannot read
+      # (`alias_method n, :to_s`, `self.alias_method :x, :y`, a splat): it still replaces a method, which
+      # {AliasMap#copy_into} contests.
+      def unread_alias_method?(node)
+        node.name == :alias_method && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
+      end
+
       # The rebinding-block call arm of {#collect_class_alias_map}: an anonymous meta-new call
       # (`Class.new { … }` no write names) files its block's aliases nowhere, and an eval-family
       # call binds them on the receiver — a nameable receiver re-anchors the owner while a
@@ -8953,20 +9126,32 @@ module Rigor
       end
 
       def record_alias_call_entry(accumulator, class_name, names, node)
+        if names.nil?
+          # Issue #2006 — an unread `alias_method` maps nothing, but still replaces a method ({AliasMap#copy_into}).
+          new_name = Source::AliasNames.literal_name(node.arguments&.arguments&.first)
+          accumulator.wrote(class_name, new_name, nil, node) if accumulator.is_a?(AliasMap)
+          return
+        end
+
         (accumulator[class_name] ||= {})[names.first] = names.last
-        accumulator.wrote(class_name, names.first, node) if accumulator.is_a?(AliasMap)
+        accumulator.wrote(class_name, names.first, names.last, node) if accumulator.is_a?(AliasMap)
       end
 
       def record_alias_map_entry(alias_node, qualified_prefix, accumulator)
         return if qualified_prefix.empty?
 
         names = Source::AliasNames.keyword_names(alias_node)
-        return if names.nil?
-
         class_name = qualified_prefix.join("::")
+        if names.nil?
+          # Issue #2006 — an `alias` whose names are not plain symbols still replaces a method ({AliasMap#copy_into}).
+          new_name = Source::AliasNames.symbol_name(alias_node.new_name)
+          accumulator.wrote(class_name, new_name, nil, alias_node) if accumulator.is_a?(AliasMap)
+          return
+        end
+
         new_name, old_name = names
         (accumulator[class_name] ||= {})[new_name] = old_name
-        accumulator.wrote(class_name, new_name, alias_node) if accumulator.is_a?(AliasMap)
+        accumulator.wrote(class_name, new_name, old_name, alias_node) if accumulator.is_a?(AliasMap)
       end
 
       def record_define_method(call_node, qualified_prefix, in_singleton_class, accumulator)
@@ -9153,14 +9338,15 @@ module Rigor
       # {#discovered_project_index_incremental}'s changed-file branch) yields the live def nodes the signature
       # reads their parameter structure from. Issue #1120 — and each file's own refinement table, which the merged
       # def-index cannot attribute back to a file, so the session can diff it against the file's seed bundle.
-      # Issue #1459 — and each file's {#defined_method_names}, diffed the same way.
-      # @return `{ def_index:, code_fingerprints:, declaration_signatures:, refinements:, defined_method_names: }`.
+      # Issue #1459 — and each file's {#defined_method_names}, diffed the same way. Issue #2134 — and each file's
+      # {#visibility_entries}. Issue #2158 — and each file's `global_write_census`.
+      # @return `{ def_index:, code_fingerprints:, declaration_signatures:, refinements:, defined_method_names:,
+      #   visibility_entries:, global_write_census: }`.
       def scan_summary_for_paths(paths, buffer: nil)
         acc = new_def_index_accumulator
         code_fingerprints = {}
         declaration_signatures = {}
-        refinements = {}
-        defined_method_names = {}
+        per_file = { refinements: {}, defined_method_names: {}, visibility_entries: {}, global_write_census: {} }
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           source = File.read(physical)
@@ -9169,16 +9355,21 @@ module Rigor
           fold_file_index(acc, file_index)
           code_fingerprints[path] = code_fingerprint(source, parsed.comments)
           declaration_signatures[path] = declaration_signature(file_index)
-          refinements[path] = file_index[:refinements] if file_index[:refinements]
-          defined_method_names[path] = defined_method_names(file_index)
+          file_summary(file_index).each { |key, table| per_file[key][path] = table unless table.nil? }
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
           next
         end
         { def_index: finalize_def_index(acc), code_fingerprints: code_fingerprints,
-          declaration_signatures: declaration_signatures, refinements: refinements,
-          defined_method_names: defined_method_names }
+          declaration_signatures: declaration_signatures, **per_file }
+      end
+
+      # One file's tables {#scan_summary_for_paths} hands the session to diff against the file's seed bundle (nil for
+      # a table the file does not have).
+      def file_summary(file_index)
+        { refinements: file_index[:refinements], defined_method_names: defined_method_names(file_index),
+          visibility_entries: visibility_entries(file_index), global_write_census: file_index[:global_write_census] }
       end
 
       # Issue #1459 — every method name one file's index defines, on any class or module and either side: the keys of
@@ -9192,9 +9383,39 @@ module Rigor
         %i[methods def_nodes singleton_def_nodes].each do |key|
           file_index[key]&.each_value { |table| names.merge(table.keys) }
         end
+        # Issue #2184 — a named deferred-range row with no side (a `def` in a block, a `define_singleton_method`) is a
+        # definition no table above holds.
+        file_index[:deferred_ranges]&.each_value { |rows| rows.each { |row| names << row[2] if row[2] && row[3].nil? } }
         names.freeze
       end
 
+      # Issue #2134 — one file's contributions to the visibility table and its contested sibling, as a Set of
+      # `[class, slot, visibility]` entries and `[:contested, class, slot]` contests, where a slot is a method name or
+      # `[:singleton, name]`. Takes a live file index or a seed bundle, which hold the same keys.
+      #
+      # Issue #2161 — and a `[:module_function, owner, name]` entry for each of the file's deferred-range rows that
+      # `DefinerResolution.module_function_row?` counts (a named def row whose kind is not `:instance`): a module
+      # function's singleton copy is public whatever its instance slot says, so the row is a visibility fact the
+      # table itself does not hold.
+      def visibility_entries(file_index)
+        entries = Set.new
+        file_index[:method_visibilities]&.each do |class_name, table|
+          table.each { |slot, visibility| entries << [class_name, slot, visibility] }
+        end
+        contested = (file_index[:siblings] || {})[:contested_discovered_method_visibilities]
+        contested&.each { |(class_name, slot)| entries << [:contested, class_name, slot] }
+        add_module_function_entries(file_index[:deferred_ranges], entries)
+        entries.freeze
+      end
+
+      def add_module_function_entries(deferred_ranges, entries)
+        deferred_ranges&.each_value do |rows|
+          rows.each do |(_start, _finish, name, kind, owner)|
+            entries << [:module_function, owner, name] if name && owner && kind != :instance
+          end
+        end
+      end
+
       # ADR-89 WD1 — a per-file digest of every cross-file DECLARATION surface an ancestry / file-level
       # dependent consumes, EXCLUDING method bodies (which only symbol dependents consume, via the ADR-46
       # symbol edges the change-detection already fingerprints per method). A body edit that touches no
@@ -9412,14 +9633,21 @@ module Rigor
       # Error degradation is identical to the two independent loops it replaces: a read / parse failure (the
       # rescue's real target) contributes nothing to either table. The subset-scoped callers
       # ({IncrementalSession}, `coverage --protection`) keep calling the individual methods unchanged.
-      def discovered_project_index_for_paths(paths, buffer: nil)
+      #
+      # @param uncertain — issue #2021: the paths whose every method contribution is `possible`
+      #   ({Certainty.every_contribution}).
+      def discovered_project_index_for_paths(paths, buffer: nil, uncertain: EMPTY_PATH_SET)
         classes = {}
         acc = new_def_index_accumulator
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           root = Prism.parse(File.read(physical), filepath: path).value
           collect_class_decls(root, [], classes)
-          accumulate_project_index(acc, path, root)
+          if uncertain.include?(path)
+            fold_file_index(acc, without_written_slots(build_file_index(path, root, uncertain: true), acc))
+          else
+            accumulate_project_index(acc, path, root)
+          end
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
         rescue StandardError
@@ -9467,14 +9695,19 @@ module Rigor
       # @param paths — project file paths, in canonical order.
       # @param seed_bundles — the prior run's per-file bundles, keyed by logical path.
       # @return `{ classes:, def_index:, bundles: }`.
-      def discovered_project_index_incremental(paths, seed_bundles:, buffer: nil)
+      # @param uncertain — issue #2021: as {#discovered_project_index_for_paths}. Such a file is always re-walked and
+      #   keeps no bundle, since a bundle does not record that its contributions were all possible.
+      def discovered_project_index_incremental(paths, seed_bundles:, buffer: nil, uncertain: EMPTY_PATH_SET) # rubocop:disable Metrics/AbcSize
         classes = {}
         acc = new_def_index_accumulator
         bundles = {}
         paths.each do |path|
           physical = buffer ? buffer.resolve(path) : path
           digest = Cache::FileDigest.hexdigest(physical)
-          cached = seed_bundles[path]
+          walked = uncertain.include?(path)
+          # A walked file neither reuses nor stores a bundle. Both are guards no spec separates: no bundle is ever
+          # stored for a walked file, so the reuse guard matters only if a path changes role within one session.
+          cached = walked ? nil : seed_bundles[path]
           if cached && cached[:digest] == digest
             bundles[path] = cached
             classes.merge!(cached[:classes])
@@ -9483,13 +9716,13 @@ module Rigor
             source = File.read(physical)
             parsed = Prism.parse(source, filepath: path)
             root = parsed.value
-            file_index = build_file_index(path, root)
+            file_index = build_file_index(path, root, uncertain: walked)
             file_classes = {}
             collect_class_decls(root, [], file_classes)
-            bundles[path] = build_seed_bundle(file_index, file_classes, digest,
-                                              code_fingerprint(source, parsed.comments))
+            fingerprint = code_fingerprint(source, parsed.comments)
+            bundles[path] = build_seed_bundle(file_index, file_classes, digest, fingerprint) unless walked
             classes.merge!(file_classes)
-            fold_file_index(acc, file_index)
+            fold_file_index(acc, walked ? without_written_slots(file_index, acc) : file_index)
           end
         rescue DeclarationWalk::ContractError
           raise # a broken walk contract, not an unreadable file: skipping it would hide the failure
@@ -9503,12 +9736,43 @@ module Rigor
       # Builds ONE file's isolated def-index contribution (live `Prism::DefNode`s) by folding it into a fresh
       # accumulator — recon Q2(a)'s "constructible in isolation" property. Shared by the cold-baseline bundle
       # build and the incremental changed-file re-walk.
-      def build_file_index(path, root)
+      def build_file_index(path, root, uncertain: false)
         file_acc = new_def_index_accumulator
-        accumulate_project_index(file_acc, path, root)
+        accumulate_project_index(file_acc, path, root, uncertain: uncertain)
         file_acc
       end
 
+      # Issue #2021 — the single-valued slot tables an `uncertain` file writes, each with its contest sibling.
+      UNCERTAIN_SLOT_TABLES = {
+        def_nodes: :contested_discovered_def_nodes,
+        singleton_def_nodes: :contested_discovered_singleton_def_nodes,
+        method_visibilities: :contested_discovered_method_visibilities,
+        parameter_envelopes: :contested_discovered_parameter_envelopes
+      }.freeze
+
+      # Issue #2021 — an `uncertain` file's isolated index without the slots `acc` already holds. The walked files fold
+      # after every other discovered file, so `acc` holds what the configured (certain) files wrote: a walked reopening
+      # of such a class adds the names it defines (existence) and leaves each written def node, visibility and
+      # envelope, and its contest, as the certain writer left it. Without this, the walked file's possible write was
+      # the slot's last and contested it, and `rigor check lib/user.rb plug/x.rb` withheld what `rigor check
+      # lib/user.rb` reports. A slot no earlier file wrote is taken, contested.
+      def without_written_slots(file_index, acc)
+        siblings = (file_index[:siblings] || {}).dup
+        tables = UNCERTAIN_SLOT_TABLES.to_h do |table, sibling|
+          written = acc[table]
+          kept = {}
+          (file_index[table] || {}).each do |class_name, entries|
+            sitting = written[class_name]
+            entries = entries.reject { |key, _| sitting.key?(key) } if sitting
+            kept[class_name] = entries unless entries.empty?
+          end
+          contests = siblings[sibling]
+          siblings[sibling] = contests.select { |class_name, key| kept[class_name]&.key?(key) }.to_set if contests
+          [table, kept]
+        end
+        file_index.merge(tables).merge(siblings: siblings)
+      end
+
       # ADR-85 WD2 — folds a single file's isolated def-index contribution into the cross-file accumulator,
       # applying EXACTLY the merge semantics {#accumulate_project_index} applies incrementally (def_nodes
       # later-wins, def_sources first-wins, includes / class_sources accumulate, everything else later-wins).
@@ -9645,9 +9909,14 @@ module Rigor
       # Issue #1984 — a singleton slot (`[:singleton, name]`) does not follow its writer: file order is not load
       # order, so two files that give it different visibilities (`private_class_method :x` here,
       # `class << self; public :x; end` in a reopening) leave it contested, and a contest on it stays whichever
-      # file folds later. The instance slots fold as before.
+      # file folds later. The instance slots fold as before, except (issue #2013) one whose contest carries a
+      # replacement's mark ({ScopeIndexer.replaced_visibility_mark}): a `define_method` or an alias in one file and a
+      # `private def` in another leave the visibility to load order, so that contest stays too.
       def fold_visibility_contests(sitting, recorded, file_slots, file_contested)
-        stale = sitting.select { |class_name, name| !name.is_a?(Array) && file_slots[class_name]&.key?(name) }
+        stale = sitting.select do |class_name, name|
+          !name.is_a?(Array) && file_slots[class_name]&.key?(name) &&
+            !sitting.include?([class_name, ScopeIndexer.replaced_visibility_mark(name)])
+        end
         disagreeing = singleton_visibility_disagreements(recorded, file_slots)
         return sitting if stale.empty? && file_contested.empty? && disagreeing.empty?
 
@@ -10070,12 +10339,12 @@ module Rigor
       # Folds one file's class-keyed indexes into the cross-file accumulator. `method_visibilities` (ADR-35) is
       # collected here so the override-visibility-reduced rule can read an ancestor's visibility declared in a sibling
       # file.
-      def accumulate_project_index(acc, path, root)
+      def accumulate_project_index(acc, path, root, uncertain: false)
         # One combined descent yields both the methods existence table and the def-node table; the latter is also
         # consumed by `record_class_sources`, so a def-dense file is walked once here instead of three times (methods +
         # def-nodes ×2). See {#build_methods_and_def_nodes}.
         file_methods, file_def_nodes, file_envelopes, file_refinements, file_singleton_def_nodes, certainty =
-          walk_def_contributions(acc, path, root)
+          walk_def_contributions(acc, path, root, uncertain: uncertain)
         merge_discovered_defs(acc[:def_nodes], acc[:def_sources], path, file_def_nodes)
         fold_parameter_envelopes(acc, file_envelopes)
         fold_refinements(acc, file_refinements)
@@ -10102,8 +10371,8 @@ module Rigor
       # file's siblings folded into the accumulator BEFORE its members join it (ADR-119 WD3: the `possible` rule
       # reads the accumulator's member as it stood). Returns `[methods, def_nodes, envelopes, refinements,
       # singleton_def_nodes, certainty]`, the classification passed on for the visibility walk.
-      def walk_def_contributions(acc, path, root)
-        certainty = Certainty.possible_nodes(root)
+      def walk_def_contributions(acc, path, root, uncertain: false)
+        certainty = uncertain ? Certainty.every_contribution(root) : Certainty.possible_nodes(root)
         file_methods, file_def_nodes, file_envelopes, file_refinements, file_siblings =
           build_methods_and_def_nodes(root, path, certainty: certainty)
         file_singleton_def_nodes, file_singleton_contested = build_singleton_def_tables(root, certainty: certainty)
@@ -10149,7 +10418,15 @@ module Rigor
         census.writes.each do |name, descriptor|
           (acc[:constant_writes][name] ||= {})[path] = descriptor
         end
-        acc[:global_write_census].merge(census.write_census.census)
+        acc[:global_write_census].merge(attribute_own_writes(census.write_census.census, path))
+      end
+
+      # #1154 — tags each `[:own_write, class, ivar]` entry with the file that records it, so a reader of the merged
+      # census can tell a second file writing the same ivar of the same class (`UnseenIvarWriters`).
+      def attribute_own_writes(census, path)
+        return census unless census.any? { |entry| entry.first == :own_write }
+
+        census.to_set { |entry| entry.first == :own_write ? [*entry, path].freeze : entry }
       end
 
       # Folds one file's Data + Struct member-layout tables into the cross-file accumulator (kept out of
@@ -10272,8 +10549,12 @@ module Rigor
                                      singleton_cref: false)
         return unless node.is_a?(Prism::Node)
 
+        # #1154 — the class whose instance `def`s the ivar-writer census credits; none under `class << self`.
+        ivar_owner = census_ivar_owner(qualified_prefix, self_owner, singleton_cref)
         case node
         when Prism::SingletonClassNode
+          # #1154 — a `class << self` inside an instance `def` opens the instance's singleton class.
+          tables.write_census.visit(node, top_level: qualified_prefix.empty?, owner: ivar_owner)
           return walk_census_singleton_class(node, qualified_prefix, tables, self_owner,
                                              meta_owner, singleton_cref)
         when Prism::ClassNode, Prism::ModuleNode
@@ -10281,7 +10562,7 @@ module Rigor
                                          singleton_cref)
         else
           census_constant_write(node, qualified_prefix, tables, self_owner, singleton_cref: singleton_cref)
-          tables.write_census.visit(node, top_level: qualified_prefix.empty?)
+          tables.write_census.visit(node, top_level: qualified_prefix.empty?, owner: ivar_owner)
         end
 
         rebound = rebound_block_self(node, qualified_prefix, nil, meta_owner, self_owner)
@@ -10313,6 +10594,16 @@ module Rigor
         end
       end
 
+      # #1154 — the class whose instance `def`s the ivar-writer census credits: the class a `Struct.new` /
+      # `Data.define` / `Class.new` constant or a `K.class_eval` block opens (`self_owner`), else the lexical class;
+      # none under `class << self` or an opaque block. The prefix Array is joined only when an entry is recorded.
+      def census_ivar_owner(qualified_prefix, self_owner, singleton_cref)
+        return self_owner if self_owner.is_a?(String)
+        return nil if self_owner || singleton_cref || qualified_prefix.empty?
+
+        qualified_prefix
+      end
+
       # Under an unnameable cref a bare/`self::` header pushes `#<singleton>::Name` — still
       # unnameable — so the body keeps the OPAQUE self and the cref flag; nameable
       # headers re-anchor at a real cref.
@@ -11400,6 +11691,7 @@ module Rigor
             table[node] = parent_scope
             parent_scope
           end
+        evaluate_unentered_flow(node, table, current_scope)
 
         case node
         when Prism::IfNode
@@ -11415,7 +11707,7 @@ module Rigor
           child_scope = entered ? current_scope : closure_scope(node, current_scope)
           node.rigor_each_child { |child| propagate(child, table, child_scope) }
         when Prism::CallNode
-          propagate_call(node, table, current_scope)
+          propagate_call(node, table, current_scope, recorded: recorded)
         when Prism::RescueNode, Prism::EnsureNode
           # Issue #1360 — a clause the evaluator did not enter (a `begin` in a value position) reads `$!`, `$@` and
           # `$?` unbound, not the enclosing clause's; one it entered keeps what it recorded.
@@ -11429,6 +11721,84 @@ module Rigor
         end
       end
 
+      # Issues #2196 and #2056 — the constructs whose parts run under a narrowing their own condition or left operand
+      # makes, keyed to the part {StatementEvaluator} records first when it enters one. Issue #2214 — a `&&=` on a
+      # variable runs its value under the variable's truthy narrowing (`[c &&= c + 1]`).
+      UNENTERED_FLOW_ENTRY = {
+        Prism::AndNode => :left, Prism::OrNode => :left,
+        Prism::IfNode => :predicate, Prism::UnlessNode => :predicate,
+        Prism::WhileNode => :predicate, Prism::UntilNode => :predicate,
+        Prism::LocalVariableAndWriteNode => :value, Prism::InstanceVariableAndWriteNode => :value,
+        Prism::ClassVariableAndWriteNode => :value, Prism::GlobalVariableAndWriteNode => :value,
+        Prism::CaseNode => :predicate
+      }.freeze
+      private_constant :UNENTERED_FLOW_ENTRY
+
+      UNENTERED_EVALUATOR_KEY = :rigor_scope_index_unentered_evaluator
+      private_constant :UNENTERED_EVALUATOR_KEY
+
+      # Issues #2196 and #2056 — an `&&` / `||` / `and` / `or`, an `if` / `unless` / ternary or a `while` / `until`
+      # in a value position (an array element, a hash value, a call argument, an interpolation, a multi-value
+      # `return`) is typed by `ExpressionTyper` and never entered, so no part of it was recorded and this walk handed
+      # every part one scope. A walk that narrows by the condition's edges cannot follow a write inside the narrowed
+      # part (`[c && (c = c.size; c.even?)]`, `[x || (set!; @x.upcase)]`) nor one inside a block in an earlier
+      # conjunct (`[x.nil? && [1].each { x = "d" } && x.upcase]`). Such a construct is evaluated here instead, from
+      # the scope this walk reached it with, under the index's own recorder, so each part is recorded with the scope
+      # the statement form records it with. What it does not visit (a dead arm) is walked as before.
+      def evaluate_unentered_flow(node, table, current_scope)
+        entry = UNENTERED_FLOW_ENTRY[node.class]
+        return if entry.nil?
+
+        # An entered construct is already recorded; skipping it is a performance guard, not a behaviour. A `case`
+        # without a subject records its first `when` test first.
+        part = node.public_send(entry) || (node.conditions.first&.conditions&.first if node.is_a?(Prism::CaseNode))
+        return if part.nil? || table.key?(part)
+
+        evaluate = Thread.current[UNENTERED_EVALUATOR_KEY]
+        evaluate&.call(node, current_scope, code_body_nodes(node, current_scope.source_path))
+      end
+
+      # The evaluation of an unentered construct starts with no class frame and no lexical nesting, which only a code
+      # body observes: a `def`, a `class` / `module` / `class << …` body, and the block of a class-creating call
+      # (`Class.new { … }`, `Struct.new`, `Data.define`, `Module.new`) or of a `refine`, whose `def`s and constants
+      # resolve against the class the walk tracks and the evaluation does not. Every node in one is left out of the
+      # recording, so the walk reaches it unrecorded and handles it as it did before #2196 ({#unentered_block_entry},
+      # {#record_class_body_defs}).
+      # Answers nil, allocating nothing, for a construct holding no code body: the common case.
+      def code_body_nodes(node, source_path, acc = nil, inside: false)
+        inside ||= CODE_BODY_NODES.include?(node.class)
+        (acc ||= Set.new.compare_by_identity) << node if inside
+        if !inside && node.is_a?(Prism::CallNode) && class_body_block_call?(node, source_path)
+          acc = code_body_nodes(node.block, source_path, acc, inside: true)
+          node.rigor_each_child do |child|
+            acc = code_body_nodes(child, source_path, acc) unless child.equal?(node.block)
+          end
+          return acc
+        end
+        node.rigor_each_child { |child| acc = code_body_nodes(child, source_path, acc, inside: inside) }
+        acc
+      end
+
+      CODE_BODY_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+      private_constant :CODE_BODY_NODES
+
+      def class_body_block_call?(node, source_path)
+        node.block.is_a?(Prism::BlockNode) &&
+          (!AnonymousMetaClass.name_for(node, source_path).nil? || !refine_target(node).nil?)
+      end
+
+      # The evaluation {#evaluate_unentered_flow} runs for the walk of one {#index}, installed for that walk only.
+      # Index walks nest (a rule may re-index a file while another file's walk is suspended), so the outer one is
+      # restored on exit. A `propagate` called directly while an outer index walk is running would record into the
+      # OUTER index's table through it; nothing outside {#index} calls `propagate`.
+      def with_unentered_evaluator(evaluate)
+        outer = Thread.current[UNENTERED_EVALUATOR_KEY]
+        Thread.current[UNENTERED_EVALUATOR_KEY] = evaluate
+        yield
+      ensure
+        Thread.current[UNENTERED_EVALUATOR_KEY] = outer
+      end
+
       SELF_OPENING_BODIES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
       private_constant :SELF_OPENING_BODIES
 
@@ -11463,11 +11833,11 @@ module Rigor
       # argument one scope and threads none, so arguments that write keep the call's: an earlier one may rebind the
       # receiver a later one reads (`return y&.concat((y = nil).to_s, y.upcase)`, where the evaluator threads no
       # operand).
-      def propagate_call(node, table, current_scope)
+      def propagate_call(node, table, current_scope, recorded: false)
         block = node.block
         operands =
           OperandEffects.any?(node.arguments) ? current_scope : Narrowing.safe_navigation_scope(node, current_scope)
-        entry = unentered_block_entry(node, block, table, current_scope)
+        entry = unentered_block_entry(node, block, table, current_scope, call_recorded: recorded)
         if entry.equal?(current_scope) && operands.equal?(current_scope)
           node.rigor_each_child { |child| propagate(child, table, current_scope) }
           return
@@ -11491,7 +11861,7 @@ module Rigor
         node.rigor_each_child { |child| propagate(child, table, child_scope) }
       end
 
-      def unentered_block_entry(node, block, table, current_scope)
+      def unentered_block_entry(node, block, table, current_scope, call_recorded: false)
         return current_scope unless block.is_a?(Prism::BlockNode) && !table.key?(block)
 
         narrowing = unentered_block_narrowing(node, current_scope)
@@ -11504,6 +11874,12 @@ module Rigor
           else
             LastLine.block_entry(FreshFrameBlocks.closure_entry(current_scope, block, node), block, node)
           end
+        # Issue #2196 — a class-body block whose call the evaluator recorded but did not enter (one inside a construct
+        # {#evaluate_unentered_flow} evaluated, or a later operand) starts from the scope the call was evaluated in,
+        # which may narrow a captured local the body writes; this walk runs the body's statements from one scope, so
+        # such a local reads `Dynamic[top]` in it: `[c && Class.new { c = c.size; c.even? }]`. A block whose call was
+        # not recorded keeps the enclosing scope as before.
+        entry = widen_condition_writes(block, entry) if call_recorded && class_body_block_call?(node, entry.source_path)
         anonymous = AnonymousMetaClass.name_for(node, current_scope.source_path)
         return unentered_meta_class_body_entry(block, entry, anonymous, table) if anonymous
 
@@ -11690,7 +12066,8 @@ module Rigor
       # A test that calls a method may rebind an instance-variable or global subject before the body reads it
       # (`when String then 1 when reset! then @x.upcase`, where `reset!` writes `@x`), and the walk cannot tell. From
       # the first such test on, the subject reads `Dynamic[top]` on both edges ({#forget_called_subject}). The
-      # evaluator keeps the narrowing there (a separate defect); the walk declines it rather than add a report.
+      # evaluator forgets a global subject there too (issue #2211). A `case` / `when` the evaluator did not enter is
+      # evaluated ({#evaluate_unentered_flow}); this walk handles only a clause that evaluation does not visit.
       def propagate_subject_case(node, table, current_scope)
         subject = node.predicate
         propagate(subject, table, current_scope)