rigortype 0.4.7 → 0.4.8

data/lib/rigor/inference/precision_scanner.rb

@@ -168,7 +168,7 @@ module Rigor
       end
 
       def classify_dynamic(type)
-        type.static_facet.is_a?(Type::Top) ? :dynamic_top : :dynamic_specific
+        Type::Combinator.untyped?(type) ? :dynamic_top : :dynamic_specific
       end
 
       def worst_of(members)

data/lib/rigor/inference/project_method_ownership.rb

@@ -2,7 +2,8 @@
 
 require_relative "../type"
 require_relative "external_ancestor_resolution"
-require_relative "../run_scoped_slots"
+require_relative "../typing_state"
+require_relative "../memo_audit"
 
 module Rigor
   module Inference
@@ -20,8 +21,14 @@ module Rigor
       NO_TARGETS = [].freeze
       private_constant :NO_TARGETS
 
-      MEMO_KEY = RunScopedSlots.register(:__rigor_project_method_ownership_memo__)
-      private_constant :MEMO_KEY
+      # ADR-129 WD1 — a run-scoped Memo keyed on the identity of the discovery index and the environment, the only
+      # inputs the buckets' answers read.
+      MEMO = TypingState.memo(
+        :project_method_ownership,
+        run_scoped: true, audit: ["project method defines", "block runs", "ancestry non-escaping"],
+        reason: "answer buckets keyed on the discovery index and environment identities"
+      )
+      private_constant :MEMO
 
       module_function
 
@@ -62,9 +69,15 @@ module Rigor
         return false if scope.nil?
 
         by_method = (memo(scope)[kind][class_name] ||= {})
-        return by_method[method_sym] if by_method.key?(method_sym)
+        if by_method.key?(method_sym)
+          return MemoAudit.check("project method defines", by_method[method_sym], class_name, method_sym) do
+            compute_defines?(class_name, method_sym, kind, scope)
+          end
+        end
 
-        by_method[method_sym] = compute_defines?(class_name, method_sym, kind, scope)
+        by_method[method_sym] = MemoAudit.key_audit("project method defines") do
+          compute_defines?(class_name, method_sym, kind, scope)
+        end
       end
 
       # One slot per thread, keyed on the identity of the scope's frozen discovery index and its environment —
@@ -72,17 +85,19 @@ module Rigor
       # changes: the shape of `ExpressionTyper#class_graph_buckets`, whose rationale applies unchanged. A
       # `Scope` merges each file's discovery with the project pre-pass, so the slot turns over per file, and
       # an ADR-46 dependency the first lookup recorded belongs to the file every later hit serves. Pool
-      # workers are separate processes, and a Ractor has its own `Thread.current`. The `:ancestry` bucket
+      # workers are separate processes, and a Ractor has its own {TypingState}. The `:ancestry` bucket
       # belongs to {ClosureEscapeAnalyzer}'s ancestry step. The `:block_runs` bucket belongs to
       # {BlockRunCount}.
       def memo(scope)
+        return new_buckets if MemoAudit.enabled? && MemoAudit.suspended?
+
         discovery = scope.discovery
         environment = scope.environment
-        slot = Thread.current[MEMO_KEY]
+        state = TypingState.current
+        slot = state[MEMO]
         unless slot && slot[0].equal?(discovery) && slot[1].equal?(environment)
-          buckets = { instance: {}, singleton: {}, ancestry: {}, block_runs: {}.compare_by_identity }
-          slot = [discovery, environment, buckets]
-          Thread.current[MEMO_KEY] = slot
+          slot = [discovery, environment, new_buckets]
+          state[MEMO] = slot
         end
         slot[2]
       end
@@ -90,6 +105,9 @@ module Rigor
       class << self
         private
 
+        # Empty buckets: a new slot's, and a throwaway set while an audit recomputation bypasses the memo.
+        def new_buckets = { instance: {}, singleton: {}, ancestry: {}, block_runs: {}.compare_by_identity }
+
         def class_target(class_name, kind)
           class_name.nil? ? nil : [[class_name.to_s, kind]]
         end

data/lib/rigor/inference/project_patched_methods.rb

@@ -36,6 +36,9 @@ module Rigor
       # `farther` is set only on an entry {#lookup_through_ancestors} returns: the other definers of the name farther
       # on the walk (entries, or {SOURCE_DEFINER} for a project-source `def`), which {#callable?} reads before it
       # refuses the call.
+      #
+      # `kind` stays truthful on a copy {#singleton_copy_entry} returns: the `module_function` singleton copy is a
+      # `:singleton` method even though the body it copied is an instance `def`.
       Entry = Data.define(:class_name, :method_name, :kind, :source_path, :source_line, :return_type, :alias_of,
                           :visibility, :farther) do
         def initialize(class_name:, method_name:, kind:, source_path:, source_line:, return_type: nil, alias_of: nil,
@@ -49,7 +52,7 @@ module Rigor
       # written, with no lexical resolution, as a patch's class name is.
       Mixin = Data.define(:owner, :module_name, :kind)
 
-      attr_reader :by_key, :write_census, :mixins, :overrides
+      attr_reader :by_key, :write_census, :mixins, :overrides, :singleton_copies
 
       # Each owner's prepended and included modules, the most recent first.
       def self.mixins_by_owner(mixins)
@@ -69,7 +72,12 @@ module Rigor
       # @param overrides — issue #1708: `[class_name, method_name, kind] => visibility` for a named visibility call
       #   (`public :kp` in `class Integer`) on a method the class inherits rather than binds, which Ruby copies onto
       #   the class with that visibility.
-      def initialize(entries: [], write_census: GlobalWriteCensus::EMPTY, mixins: [], overrides: {})
+      # @param singleton_copies — issue #2108: `[class_name, method_name]` pairs a `module_function :x` wrote for a
+      #   name the class inherits rather than binds — Ruby's public singleton copy of the instance method the name
+      #   resolves to. {#lookup_through_ancestors} answers a singleton-side call for one through
+      #   {#singleton_copy_entry}.
+      def initialize(entries: [], write_census: GlobalWriteCensus::EMPTY, mixins: [], overrides: {},
+                     singleton_copies: [])
         @by_key = entries.each_with_object({}) do |entry, acc|
           key = [entry.class_name, entry.method_name, entry.kind]
           acc[key] = entry
@@ -78,6 +86,7 @@ module Rigor
         @mixins = mixins.dup.freeze
         @mixins_of = ProjectPatchedMethods.mixins_by_owner(@mixins)
         @overrides = overrides.dup.freeze
+        @singleton_copies = singleton_copies.to_set.freeze
         freeze
       end
 
@@ -121,10 +130,18 @@ module Rigor
           end
 
           entry = @by_key[[owner, method_name, side]]
+          if entry.nil? && found.nil? && side == :singleton
+            copy = singleton_copy_entry(owner, method_name, rbs_loader, source_defines)
+            # Issue #2108 — a singleton copy is a real method on `#<Class:owner>` at this exact ancestor
+            # position: Ruby's lookup ends there, so nothing farther on the walk can answer `owner.x`.
+            # Return it now — collecting `farther` would only make {#callable?} decline the refusal Ruby
+            # makes of a private or protected copy.
+            return apply_override(copy, override) if copy
+          end
           if found
             farther << entry if entry
           elsif entry
-            found = override ? entry.with(class_name: override.first, visibility: override.last) : entry
+            found = apply_override(entry, override)
           elsif (visibility = @overrides[[owner, method_name, side]])
             override ||= [owner, visibility]
           end
@@ -137,9 +154,12 @@ module Rigor
 
       # Issue #1708 — whether Ruby lets a call reach `entry`. A public method answers any call; a private one only a
       # call with no receiver or with `self` as it (`explicit` is false for those); a protected one also a call from
-      # a method whose `self` is an instance of the entry's owner. `self_type` is the caller's `self` (`nil` at the
-      # top level, where it is `main`, an Object); a `self` this cannot name (the default) may be one, so a
-      # protected entry answers it.
+      # a method whose `self` is an instance of the entry's owner — for a `:singleton` entry, the owner itself or a
+      # class whose singleton chain holds it (`Kernel.a1` under `class << self; protected :a1` is refused from
+      # `main`, an Object, and from another class's singleton method, and answered from Kernel's own and from a
+      # `module_function` def of Kernel's, whose self is typed as an instance of Kernel though the copy runs with
+      # self = Kernel). `self_type` is the caller's `self` (`nil` at the top level, where it is `main`, an Object);
+      # a `self` this cannot name (the default) may be one, so a protected entry answers it.
       #
       # It never refuses a call some other definer of the name may answer: the walk's order is an approximation
       # (a module two owners mix in is spliced at the nearer one, where Ruby keeps the first include and skips the
@@ -152,7 +172,7 @@ module Rigor
         allowed =
           case entry.visibility
           when :private, :module_function then false
-          when :protected then self_kind_of?(self_type, entry.class_name, rbs_loader)
+          when :protected then self_kind_of?(self_type, entry.class_name, entry.kind, rbs_loader)
           else true
           end
         return true if allowed
@@ -171,18 +191,50 @@ module Rigor
 
       private
 
-      # Whether `self_type` may be an instance of `owner`: false only when the ancestors of a class RBS knows,
-      # with the patches' mixins, do not hold it.
-      def self_kind_of?(self_type, owner, rbs_loader)
-        name, kind =
+      # Whether `self_type` may reach `owner`'s `entry_kind` method: false only when the ancestors of a class RBS
+      # knows, with the patches' mixins, do not hold `[owner, entry_kind]` — an instance of the owner for an
+      # instance method, the owner itself or a class whose singleton chain holds it for a singleton one. For a
+      # singleton entry a self whose class IS the owner answers too: a `module_function` / `extend self` def is
+      # typed `Nominal[owner]` though its singleton copy runs with self = owner, so `name == owner` may be the
+      # owner object itself (issue #3056).
+      def self_kind_of?(self_type, owner, entry_kind, rbs_loader)
+        name, side =
           if self_type.nil? then ["Object", :instance]
           elsif self_type.respond_to?(:class_name) && self_type.class_name
             [self_type.class_name.to_s, self_type.is_a?(Type::Singleton) ? :singleton : :instance]
           end
         return true if name.nil? || rbs_loader.nil?
 
-        keys = ancestor_keys(name, kind, rbs_loader)
-        keys == [[name, kind]] || keys.include?([owner, :instance])
+        keys = ancestor_keys(name, side, rbs_loader)
+        keys == [[name, side]] || keys.include?([owner, entry_kind]) ||
+          (entry_kind == :singleton && side == :instance && name == owner)
+      end
+
+      # `entry` as the walk's recorded `override` ([owner, visibility], from a nearer row's named
+      # visibility call) leaves it: the override's owner as `class_name` and its visibility — or `entry`
+      # itself when the walk passed no override on the way.
+      def apply_override(entry, override)
+        override ? entry.with(class_name: override.first, visibility: override.last) : entry
+      end
+
+      # Issue #2108 — the entry a `module_function :x` on a name `owner` inherits answers `owner.x` with. Ruby
+      # copies the instance method the name resolves to onto the owner's singleton as a public method, so the
+      # copy is the entry this walk finds for the name on the owner's INSTANCE ancestors, re-attributed to the
+      # owner, re-kinded `:singleton` and made public — unless a later named visibility call (`private_class_method
+      # :x`, or `private :x` in `class << self`) recorded the pair's singleton-side override, which Ruby applies to
+      # the copy. The instance walk's `farther` definers are dropped: the copy is a real method on
+      # `#<Class:owner>` that ends the singleton-side lookup, so no instance-chain definer can answer `owner.x`,
+      # and keeping them would only make {#callable?} decline a refusal Ruby makes. nil when no copy is
+      # recorded for `[owner, method_name]`, or when the instance walk finds no patch entry — an RBS or
+      # project-source method the registry does not hold, where the singleton walk then answers whatever else
+      # it reaches, as before.
+      def singleton_copy_entry(owner, method_name, rbs_loader, source_defines)
+        return nil unless @singleton_copies.include?([owner, method_name])
+
+        copy = lookup_through_ancestors(class_name: owner, method_name: method_name, kind: :instance,
+                                        rbs_loader: rbs_loader, source_defines: source_defines)
+        copy&.with(class_name: owner, kind: :singleton, farther: nil,
+                   visibility: @overrides[[owner, method_name, :singleton]] || :public)
       end
 
       def ancestor_keys(class_name, kind, rbs_loader)

data/lib/rigor/inference/project_patched_scanner.rb

@@ -2,6 +2,7 @@
 
 require "prism"
 
+require_relative "../typing_state"
 require_relative "project_patched_methods"
 require_relative "project_patched_definedness_guard"
 require_relative "project_patched_visibility"
@@ -45,6 +46,38 @@ module Rigor
       end
       private_constant :GuardedDef
 
+      # A `module_function` singleton copy a `def`-form produced (`module_function def x`, or a `def` under a
+      # bare `module_function`): `entry` is the copy to bind and `def_entry` the instance entry it was copied
+      # from, so {resolve_aliases} records which def the singleton binding answers — a later named
+      # `module_function :x` keeps the copy only while that def is proved unchanged (issue #3056).
+      SingletonCopy = Data.define(:entry, :def_entry) do
+        def source_path = entry.source_path
+      end
+      private_constant :SingletonCopy
+
+      # A statement the walk does not read that may rebind a method: any call other than a visibility call, a
+      # literal-named `alias_method`, or a receiverless `include` / `extend`, plus an `alias` with a computed
+      # name and an `undef`. `define_method(:x)`, `class_eval "def x"`, `send(:define_method, ...)` and
+      # `attr_reader :x` all make Ruby's next `module_function :x` copy a fresh public body, so after one
+      # {resolve_aliases} no longer assumes a copy is unchanged (issue #3056).
+      Unread = Data.define(:source_path)
+      private_constant :Unread
+
+      # The receiverless calls the walk reads as not rebinding a method of the body's own class.
+      MIXIN_CALLS = %i[include extend].freeze
+      private_constant :MIXIN_CALLS
+
+      # ADR-129 WD1 — the two per-file inputs of the walk, each a Frame {.walk_file} installs for the file's walk and
+      # restores on the way out: the `def`s on the undefined side of a definedness guard, and each `def`'s visibility.
+      # Both are frozen once built and read only by {.walk_node}'s callees.
+      #
+      # G1′: the walk is a Prism traversal that never types, so no `type_of` runs while either is installed.
+      GUARDED_DEFS = TypingState.frame(:patched_scanner_guarded_defs, reason: "installed per scanned file's walk",
+                                                                      typing_unreachable: true)
+      DEF_VISIBILITIES = TypingState.frame(:patched_scanner_def_visibilities, reason: "installed per scanned file",
+                                                                              typing_unreachable: true)
+      private_constant :GUARDED_DEFS, :DEF_VISIBILITIES
+
       module_function
 
       # @param paths — absolute paths to the pre-eval files. The runner has already
@@ -61,11 +94,13 @@ module Rigor
         paths.each { |path| scan_file(path, collected, diagnostics, buffer, census) }
         pending_mixins, collected = collected.partition { |item| item.is_a?(Mixins::Pending) }
         overrides = {}
-        entries = resolve_aliases(collected, overrides)
+        singleton_copies = Set.new
+        entries = resolve_aliases(collected, overrides, singleton_copies)
         diagnostics.concat(duplicate_declaration_diagnostics(entries))
         Result.new(
           registry: ProjectPatchedMethods.new(entries: entries, write_census: census.freeze, overrides: overrides,
-                                              mixins: Mixins.resolve(pending_mixins, entries)),
+                                              mixins: Mixins.resolve(pending_mixins, entries),
+                                              singleton_copies: singleton_copies),
           diagnostics: diagnostics
         )
       end
@@ -114,23 +149,37 @@ module Rigor
       # A {Visibility::Pending} (issue #1708) changes the visibility of the binding its name has when it runs, in the
       # file that bound it, so it is not a second declaration; a name no earlier patch binds on the class is one it
       # inherits, recorded in `overrides` ({Visibility.apply}). `module_function :x` also binds the public singleton
-      # copy.
-      def resolve_aliases(collected, overrides = {})
+      # copy: an entry {.applied} yields for a bound name, or a `[class_name, name]` pair in `singleton_copies`
+      # (issue #2108) for an inherited one, whose body the scan cannot name.
+      #
+      # `bound_defs` holds each key's def / alias-produced entry — the def identity a visibility change does not
+      # move — and `copy_sources` each singleton key's `module_function` copy source, the pair
+      # {Visibility.apply} reads to keep a repeated `module_function :x` from re-publicing a copy
+      # `private_class_method` made private (issue #3056).
+      def resolve_aliases(collected, overrides = {}, singleton_copies = Set.new)
         bound = {}
         homes = {}
+        bound_defs = {}
+        copy_sources = {}
         per_file = collected.group_by(&:source_path).values.map do |items|
           final = {}
           items.each do |item|
             if item.is_a?(Visibility::Pending)
-              next Visibility.apply(item, bound, homes, overrides) { |copy| bind(copy, bound, homes, final) }
+              next Visibility.apply(item, bound, homes, overrides, singleton_copies, bound_defs, copy_sources) do |copy|
+                bind(copy, bound, homes, final)
+              end
             end
+            next if copy_provenance_item?(item, bound, homes, final, copy_sources)
 
             entry = item.is_a?(PendingAlias) ? alias_entry(item, bound) : item
             entry = entry.entry if entry.is_a?(GuardedDef)
             key = [entry.class_name, entry.method_name, entry.kind]
-            next if item.is_a?(GuardedDef) && bound.key?(key)
+            # A guarded def dropped here may still run (`method_defined?` ignores a private method), so the
+            # copy it would rebind is no longer known to be unchanged.
+            next copy_sources.delete([key[0], key[1], :singleton]) if item.is_a?(GuardedDef) && bound.key?(key)
 
             bind(entry, bound, homes, final)
+            record_binding(key, entry, bound_defs, copy_sources)
           end
           final
         end
@@ -138,6 +187,33 @@ module Rigor
       end
       private_class_method :resolve_aliases
 
+      # The bookkeeping {resolve_aliases} keeps beside `bound`: `bound_defs` holds the def / alias
+      # entry `key` binds — the def identity a visibility change does not move, which
+      # {Visibility.apply}'s `module_function` re-copy check compares — and a singleton-side binding
+      # clears the copy provenance, since a `def self.x` between two `module_function :x` calls makes
+      # the next copy fresh (issue #3056).
+      def record_binding(key, entry, bound_defs, copy_sources)
+        bound_defs[key] = entry
+        copy_sources.delete([entry.class_name, entry.method_name, :singleton]) if entry.kind == :singleton
+      end
+      private_class_method :record_binding
+
+      # The two items that only move the `module_function` copy provenance {Visibility.apply}'s re-copy
+      # check compares (issue #3056), handled here and answered true: a {SingletonCopy} binds the copy and
+      # records which instance def entry it was made from, and an {Unread} statement forgets every record,
+      # since it may have rebound any name.
+      def copy_provenance_item?(item, bound, homes, final, copy_sources)
+        case item
+        when SingletonCopy
+          bind(item.entry, bound, homes, final)
+          copy_sources[[item.entry.class_name, item.entry.method_name, :singleton]] = item.def_entry
+        when Unread then copy_sources.clear
+        else return false
+        end
+        true
+      end
+      private_class_method :copy_provenance_item?
+
       def bind(entry, bound, homes, final)
         key = [entry.class_name, entry.method_name, entry.kind]
         bound[key] = entry
@@ -184,18 +260,16 @@ module Rigor
                    "#{e.class}: #{e.message}. Pre-evaluation skipped for this file; " \
                    "the rest of the run proceeds."
         )
-      ensure
-        Thread.current[:rigor_guarded_defs] = nil
-        Thread.current[:rigor_def_visibilities] = nil
       end
       private_class_method :scan_file
 
       # Walks one parsed file with its definedness guards and `def` visibilities (issue #1708) in reach of
       # {record_def_node}.
       def walk_file(root, path, entries)
-        Thread.current[:rigor_guarded_defs] = DefinednessGuard.defs(root)
-        Thread.current[:rigor_def_visibilities] = Visibility.defs(root)
-        walk_node(root, [], false, path, entries)
+        TypingState.current.with_pair(GUARDED_DEFS, DefinednessGuard.defs(root).freeze,
+                                      DEF_VISIBILITIES, Visibility.defs(root).freeze) do
+          walk_node(root, [], false, path, entries)
+        end
       end
       private_class_method :walk_file
 
@@ -231,17 +305,10 @@ module Rigor
           descend_singleton_class(node, qualified_prefix, source_path, entries)
         when Prism::DefNode
           record_def_node(node, qualified_prefix, in_singleton_class, source_path, entries)
-        when Prism::AliasMethodNode
-          record_alias(node, Source::AliasNames.keyword_names(node), qualified_prefix, in_singleton_class,
-                       source_path, entries)
+        when Prism::AliasMethodNode, Prism::UndefNode
+          record_keyword(node, qualified_prefix, in_singleton_class, source_path, entries)
         when Prism::CallNode
-          record_alias(node, Source::AliasNames.alias_method_call_names(node), qualified_prefix,
-                       in_singleton_class, source_path, entries)
-          if Thread.current[:rigor_def_visibilities]&.[](node).equal?(Visibility::STATEMENT)
-            pending = Visibility.pending(node, qualified_prefix, in_singleton_class, source_path)
-            entries << pending if pending
-            entries.concat(Mixins.pending(node, qualified_prefix, in_singleton_class))
-          end
+          record_call(node, qualified_prefix, in_singleton_class, source_path, entries)
           walk_children(node, qualified_prefix, in_singleton_class, source_path, entries)
         else
           walk_children(node, qualified_prefix, in_singleton_class, source_path, entries)
@@ -249,6 +316,34 @@ module Rigor
       end
       private_class_method :walk_node
 
+      # An `alias` with literal names binds as {record_alias} reads it; a computed-name `alias` or an `undef`
+      # is {Unread}.
+      def record_keyword(node, qualified_prefix, in_singleton_class, source_path, entries)
+        names = node.is_a?(Prism::AliasMethodNode) ? Source::AliasNames.keyword_names(node) : nil
+        entries << Unread.new(source_path: source_path) if names.nil?
+        record_alias(node, names, qualified_prefix, in_singleton_class, source_path, entries)
+      end
+      private_class_method :record_keyword
+
+      def record_call(node, qualified_prefix, in_singleton_class, source_path, entries)
+        names = Source::AliasNames.alias_method_call_names(node)
+        entries << Unread.new(source_path: source_path) if names.nil? && unread_call?(node)
+        record_alias(node, names, qualified_prefix, in_singleton_class, source_path, entries)
+        return unless TypingState.current[DEF_VISIBILITIES]&.[](node).equal?(Visibility::STATEMENT)
+
+        pending = Visibility.pending(node, qualified_prefix, in_singleton_class, source_path)
+        entries << pending if pending
+        entries.concat(Mixins.pending(node, qualified_prefix, in_singleton_class))
+      end
+      private_class_method :record_call
+
+      def unread_call?(node)
+        return false if Visibility.call(node)
+
+        !(MIXIN_CALLS.include?(node.name) && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)))
+      end
+      private_class_method :unread_call?
+
       def walk_children(node, qualified_prefix, in_singleton_class, source_path, entries)
         node.rigor_each_child do |child|
           walk_node(child, qualified_prefix, in_singleton_class, source_path, entries)
@@ -288,9 +383,9 @@ module Rigor
           source_path: source_path, source_line: line,
           return_type: return_type
         )
-        entry, *copies = Visibility.applied(entry, Thread.current[:rigor_def_visibilities]&.[](node) || :public)
-        entries << (Thread.current[:rigor_guarded_defs]&.key?(node) ? GuardedDef.new(entry: entry) : entry)
-        entries.concat(copies)
+        entry, *copies = Visibility.applied(entry, TypingState.current[DEF_VISIBILITIES]&.[](node) || :public)
+        entries << (TypingState.current[GUARDED_DEFS]&.key?(node) ? GuardedDef.new(entry: entry) : entry)
+        entries.concat(copies.map { |copy| SingletonCopy.new(entry: copy, def_entry: entry) })
       end
       private_class_method :record_def_node
 

data/lib/rigor/inference/project_patched_visibility.rb

@@ -98,20 +98,56 @@ module Rigor
         # second declaration. A name the class does not bind is one it inherits (`public :kp` in `class Integer` over
         # `module Kernel; private def kp`), which Ruby copies onto the class with the new visibility: `overrides` gets
         # `key => visibility` for {ProjectPatchedMethods#lookup_through_ancestors} to apply to the body it finds farther
-        # on. Yields each copy that binds (`module_function :x`'s singleton), at the call's line, for the caller to
+        # on. `module_function :x` also binds the public singleton copy: for a name the class binds, {.applied} yields
+        # it to bind here; for an inherited one (issue #2108) `singleton_copies` records `[class_name, name]`, which
+        # {ProjectPatchedMethods#singleton_copy_entry} resolves through the owner's instance ancestors at call time
+        # (an approximation: Ruby snapshots the body when module_function runs)
+        # — the copy's body is whichever method the name reaches there, which the scan cannot name.
+        # Yields each copy that binds (`module_function :x`'s singleton), at the call's line, for the caller to
         # bind.
-        def apply(pending, bound, homes, overrides)
+        #
+        # `bound_defs` maps each bound key to the entry a `def` / `alias` last produced for it — the def
+        # identity a visibility change (`private :x`) does not move — and `copy_sources` maps a singleton key
+        # to the instance def entry its `module_function` copy was made from. Ruby re-copies the instance
+        # method onto the singleton only when that def changed since the last copy (issue #3056): a
+        # `private_class_method :x` between two `module_function :x` calls keeps the copy private, while a
+        # `def x` redefinition, or any statement the scan does not read, makes the next copy public again.
+        def apply(pending, bound, homes, overrides, singleton_copies, bound_defs, copy_sources)
           pending.names.each do |name|
             key = [pending.class_name, name, pending.kind]
             entry = bound[key]
-            next overrides[key] = pending.visibility if entry.nil?
+            if entry.nil?
+              overrides[key] = pending.visibility
+              singleton_copies << [pending.class_name, name] if pending.visibility == :module_function
+              next
+            end
 
             changed, *copies = applied(entry, pending.visibility)
+            copies = [] if unchanged_module_function_copy?(pending, key, bound_defs, copy_sources)
             bound[key] = homes[key][key] = changed
             copies.each { |copy| yield copy.with(source_path: pending.source_path, source_line: pending.source_line) }
           end
         end
 
+        # Issue #3056 — true only when `pending` is a `module_function` named call whose singleton copy is
+        # proved to answer the same instance def: the copy's recorded source is still the def / alias
+        # binding `key` has. `resolve_aliases` drops that record whenever something may have rebound the
+        # name (a singleton-side `def`, a guarded def it dropped, or any statement the walk does not read),
+        # and then Ruby's re-copy is public, the reading that refuses no call Ruby runs. `bound_defs[key]` is
+        # the def entry `key` binds — a visibility change does not move it — and `copy_sources[skey]` the
+        # instance def entry the singleton's current copy was made from; either way the source is
+        # (re)recorded for the next call.
+        def unchanged_module_function_copy?(pending, key, bound_defs, copy_sources)
+          return false unless pending.visibility == :module_function
+
+          skey = [key[0], key[1], :singleton]
+          def_entry = bound_defs[key]
+          source = copy_sources[skey]
+          copy_sources[skey] = def_entry
+          !source.nil? && source.equal?(def_entry)
+        end
+        private_class_method :unchanged_module_function_copy?
+
         # `entry` as `visibility` leaves it, then any copy that binds: `module_function` makes an instance method
         # private and binds a public singleton copy, as Ruby does.
         def applied(entry, visibility)