Be more strict in not widening visibility in derived classes.
diff --git a/.clang-tidy b/.clang-tidy
index c2fb7d8..4bb9cbb 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -46,6 +46,7 @@
   -readability-function-cognitive-complexity,
   -readability-identifier-length,
   -readability-implicit-bool-conversion,
+  -readability-inconsistent-ifelse-braces,
   -readability-isolate-declaration,
   -readability-magic-numbers,
   -readability-make-member-function-const,
@@ -101,3 +102,6 @@
 CheckOptions:
   - key:    misc-include-cleaner.IgnoreHeaders
     value:  .*-linter-test-utils\.h
+  - key:    misc-override-with-different-visibility.DisallowedVisibilityChange
+    value:  widening
+
diff --git a/verible/common/analysis/syntax-tree-linter.h b/verible/common/analysis/syntax-tree-linter.h
index 546393d..230b283 100644
--- a/verible/common/analysis/syntax-tree-linter.h
+++ b/verible/common/analysis/syntax-tree-linter.h
@@ -50,9 +50,6 @@
  public:
   SyntaxTreeLinter() = default;
 
-  void Visit(const SyntaxTreeLeaf &leaf) final;
-  void Visit(const SyntaxTreeNode &node) final;
-
   // Transfers ownership of rule into Linter
   void AddRule(std::unique_ptr<SyntaxTreeLintRule> rule) {
     rules_.emplace_back(std::move(rule));
@@ -64,6 +61,10 @@
   // Performs lint analysis on root
   void Lint(const Symbol &root);
 
+ protected:
+  void Visit(const SyntaxTreeLeaf &leaf) final;
+  void Visit(const SyntaxTreeNode &node) final;
+
  private:
   // List of rules that the linter is using. Rules are responsible for tracking
   // their own internal state.
diff --git a/verible/common/formatting/align_test.cc b/verible/common/formatting/align_test.cc
index f9a3e3e..5b9a96f 100644
--- a/verible/common/formatting/align_test.cc
+++ b/verible/common/formatting/align_test.cc
@@ -94,6 +94,7 @@
  public:
   TokenColumnizer() = default;
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     ColumnSchemaScanner::Visit(node);
   }
@@ -107,6 +108,7 @@
  public:
   TokenColumnizerRightFlushed() = default;
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     ColumnSchemaScanner::Visit(node);
   }
@@ -1011,6 +1013,7 @@
  public:
   SyntaxTreeColumnizer() = default;
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     ColumnPositionTree *column;
     if (!current_column_) {
diff --git a/verible/common/formatting/tree-unwrapper_test.cc b/verible/common/formatting/tree-unwrapper_test.cc
index 4166122..d7ed6a6 100644
--- a/verible/common/formatting/tree-unwrapper_test.cc
+++ b/verible/common/formatting/tree-unwrapper_test.cc
@@ -70,6 +70,12 @@
   void CollectLeadingFilteredTokens() final {}
   void CollectTrailingFilteredTokens() final {}
 
+  using TreeUnwrapper::StartNewUnwrappedLine;
+
+ protected:
+  void InterChildNodeHook(const SyntaxTreeNode &node) final {}
+
+ protected:
   // Leaf visit that adds a PreFormatToken from the leaf's TokenInfo
   // to the current_unwrapped_line_
   void Visit(const verible::SyntaxTreeLeaf &leaf) final {
@@ -83,11 +89,6 @@
     TraverseChildren(node);
   }
 
-  void InterChildNodeHook(const SyntaxTreeNode &node) final {}
-
-  using TreeUnwrapper::StartNewUnwrappedLine;
-
- protected:
   void CatchUpFilteredTokens() {
     const auto iter = CurrentFormatTokenIterator();
     SkipUnfilteredTokens(
diff --git a/verible/common/lexer/flex-lexer-adapter.h b/verible/common/lexer/flex-lexer-adapter.h
index b4c4c0d..b2c848a 100644
--- a/verible/common/lexer/flex-lexer-adapter.h
+++ b/verible/common/lexer/flex-lexer-adapter.h
@@ -90,23 +90,6 @@
     return last_token_;
   }
 
- protected:
-  // Must be called by subclasses to update location of the current token.
-  void UpdateLocation() { last_token_.AdvanceText(this->YYLeng()); }
-
-  // EOF needs special handling because yyleng is set to include a terminating
-  // \0 (NUL) character.  Once EOF is encountered it is also not possible to
-  // yyless-rewind the window -- doing so messes up the internal state machine,
-  // and causes (flex) errors like:
-  // "fatal flex scanner internal error--end of buffer missed"
-  // We advance the token text without spanning the NUL character.
-  // This should only be needed in lexer states that need to explicitly
-  // handle <<EOF>>.
-  void UpdateLocationEOF() {
-    last_token_.AdvanceText(this->YYLeng() - 1);
-    at_eof_ = true;
-  }
-
   // Restart lexer by pointing to new input stream, and reset all state.
   void Restart(std::string_view code) override {  // not yet final
     at_eof_ = false;
@@ -128,6 +111,23 @@
     }
   }
 
+ protected:
+  // Must be called by subclasses to update location of the current token.
+  void UpdateLocation() { last_token_.AdvanceText(this->YYLeng()); }
+
+  // EOF needs special handling because yyleng is set to include a terminating
+  // \0 (NUL) character.  Once EOF is encountered it is also not possible to
+  // yyless-rewind the window -- doing so messes up the internal state machine,
+  // and causes (flex) errors like:
+  // "fatal flex scanner internal error--end of buffer missed"
+  // We advance the token text without spanning the NUL character.
+  // This should only be needed in lexer states that need to explicitly
+  // handle <<EOF>>.
+  void UpdateLocationEOF() {
+    last_token_.AdvanceText(this->YYLeng() - 1);
+    at_eof_ = true;
+  }
+
   // Overrides yyFlexLexer's implementation to handle unrecognized chars.
   void LexerOutput(const char *buf, int size) final {
     VLOG(1) << "LexerOutput: rejected text: \"" << std::string(buf, size)
diff --git a/verible/common/text/tree-context-visitor_test.cc b/verible/common/text/tree-context-visitor_test.cc
index 496c531..82bf8c3 100644
--- a/verible/common/text/tree-context-visitor_test.cc
+++ b/verible/common/text/tree-context-visitor_test.cc
@@ -44,15 +44,6 @@
 template <class BaseVisitor>
 class ContextRecorder : public BaseVisitor {
  public:
-  void Visit(const SyntaxTreeLeaf &leaf) final {
-    context_history_.push_back(BaseVisitor::Context());
-  }
-
-  void Visit(const SyntaxTreeNode &node) final {
-    context_history_.push_back(BaseVisitor::Context());
-    BaseVisitor::Visit(node);
-  }
-
   std::vector<std::vector<int>> ContextTagHistory() const {
     std::vector<std::vector<int>> result;
     result.reserve(context_history_.size());
@@ -62,6 +53,16 @@
     return result;
   }
 
+ protected:
+  void Visit(const SyntaxTreeLeaf &leaf) final {
+    context_history_.push_back(BaseVisitor::Context());
+  }
+
+  void Visit(const SyntaxTreeNode &node) final {
+    context_history_.push_back(BaseVisitor::Context());
+    BaseVisitor::Visit(node);
+  }
+
  private:
   std::vector<SyntaxTreeContext> context_history_;
 };
@@ -148,6 +149,11 @@
 // Test class demonstrating visitation and path tracking
 class PathRecorder : public TreeContextPathVisitor {
  public:
+  const std::vector<SyntaxTreePath> &PathTagHistory() const {
+    return path_history_;
+  }
+
+ protected:
   void Visit(const SyntaxTreeLeaf &leaf) final {
     path_history_.push_back(Path());
   }
@@ -157,10 +163,6 @@
     TreeContextPathVisitor::Visit(node);
   }
 
-  const std::vector<SyntaxTreePath> &PathTagHistory() const {
-    return path_history_;
-  }
-
  private:
   std::vector<SyntaxTreePath> path_history_;
 };
diff --git a/verible/verilog/formatting/align.cc b/verible/verilog/formatting/align.cc
index a19565f..d19fa2c 100644
--- a/verible/verilog/formatting/align.cc
+++ b/verible/verilog/formatting/align.cc
@@ -307,6 +307,7 @@
   explicit ActualNamedParameterColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -338,6 +339,7 @@
   explicit ActualNamedPortColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -369,6 +371,7 @@
   explicit PortDeclarationColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -545,6 +548,7 @@
   explicit StructUnionMemberColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -759,6 +763,7 @@
   explicit DataDeclarationColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -906,6 +911,7 @@
   explicit ClassPropertyColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -982,6 +988,7 @@
   explicit ParameterDeclarationColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -1123,6 +1130,7 @@
          NodeEnum::kGenerateCaseItem, NodeEnum::kDefaultItem});
   }
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -1184,6 +1192,7 @@
   explicit AssignmentColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -1242,6 +1251,7 @@
   explicit EnumWithAssignmentsColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     auto tag = NodeEnum(node.Tag().tag);
     VLOG(2) << __FUNCTION__ << ", node: " << tag << " at "
@@ -1286,6 +1296,7 @@
   explicit DistItemColumnSchemaScanner(const FormatStyle &style)
       : VerilogColumnSchemaScanner(style) {}
 
+ protected:
   void Visit(const SyntaxTreeNode &node) final {
     const auto tag = NodeEnum(node.Tag().tag);
     switch (tag) {
diff --git a/verible/verilog/parser/verilog-lexer.h b/verible/verilog/parser/verilog-lexer.h
index 28d4b66..a6920bf 100644
--- a/verible/verilog/parser/verilog-lexer.h
+++ b/verible/verilog/parser/verilog-lexer.h
@@ -43,15 +43,15 @@
  public:
   explicit VerilogLexer(std::string_view code);
 
+  // Filter predicate that can be used for testing and parsing.
+  static bool KeepSyntaxTreeTokens(const verible::TokenInfo &);
+
   // Restart lexer with new input stream.
   void Restart(std::string_view) final;
 
   // Returns true if token is invalid.
   bool TokenIsError(const verible::TokenInfo &) const final;
 
-  // Filter predicate that can be used for testing and parsing.
-  static bool KeepSyntaxTreeTokens(const verible::TokenInfo &);
-
  private:
   // Main lexing function. Will be defined by Flex.
   int yylex() final;
diff --git a/verible/verilog/tools/kythe/indexing-facts-tree-extractor.cc b/verible/verilog/tools/kythe/indexing-facts-tree-extractor.cc
index c516858..ad633fd 100644
--- a/verible/verilog/tools/kythe/indexing-facts-tree-extractor.cc
+++ b/verible/verilog/tools/kythe/indexing-facts-tree-extractor.cc
@@ -93,12 +93,13 @@
         Anchor(base));
   }
 
-  void Visit(const SyntaxTreeLeaf &leaf) final;
-  void Visit(const SyntaxTreeNode &node) final;
-
   const IndexingFactNode &Root() const { return root_; }
   IndexingFactNode TakeRoot() { return std::move(root_); }
 
+ protected:
+  void Visit(const SyntaxTreeLeaf &leaf) final;
+  void Visit(const SyntaxTreeNode &node) final;
+
  private:  // methods
   // Extracts facts from module, intraface and program declarations.
   void ExtractModuleOrInterfaceOrProgram(const SyntaxTreeNode &declaration_node,