rigortype 0.1.6 → 0.1.8

data/lib/rigor/configuration.rb

@@ -59,6 +59,14 @@ module Rigor
       # the dispatcher tier consuming the registry lands in
       # slice 2.
       "pre_eval" => [],
+      # ADR-22 — baseline file path. nil (default) means no
+      # baseline is loaded; the `false` literal is treated as
+      # the explicit-disable form for `.rigor.yml`-side override
+      # of an upstream `.rigor.dist.yml` `baseline:` declaration.
+      # The presence of `.rigor-baseline.yml` on disk alone does
+      # NOT activate filtering — the path must be named here
+      # (WD2 (b) of ADR-22).
+      "baseline" => nil,
       "fold_platform_specific_paths" => false,
       "cache" => {
         "path" => ".rigor/cache"
@@ -166,7 +174,7 @@ module Rigor
                 :dependencies, :parallel_workers,
                 :bundler_bundle_path, :bundler_auto_detect, :bundler_lockfile,
                 :rbs_collection_lockfile, :rbs_collection_auto_detect,
-                :pre_eval
+                :pre_eval, :baseline_path
 
     # Loads a configuration file.
     #
@@ -321,6 +329,7 @@ module Rigor
       @pre_eval = expand_pre_eval_entries(
         Array(data.fetch("pre_eval", DEFAULTS.fetch("pre_eval"))).map(&:to_s)
       )
+      @baseline_path = coerce_baseline_path(data.fetch("baseline", DEFAULTS.fetch("baseline")))
       @fold_platform_specific_paths = data.fetch(
         "fold_platform_specific_paths", DEFAULTS.fetch("fold_platform_specific_paths")
       ) == true
@@ -488,6 +497,17 @@ module Rigor
       raise ArgumentError, "parallel.workers must be a non-negative Integer, got #{value.inspect} (#{e.message})"
     end
 
+    # ADR-22 WD2 (b) — `baseline: <path>` activates the file;
+    # `baseline: false` is the explicit-disable form (useful in
+    # `.rigor.yml` to override an upstream `.rigor.dist.yml`
+    # that names a baseline). `nil` (default / absent key) is
+    # also "no baseline".
+    def coerce_baseline_path(value)
+      return nil if value.nil? || value == false
+
+      value.to_s
+    end
+
     def coerce_network_policy(value)
       sym = value.to_sym
       unless VALID_NETWORK_POLICIES.include?(sym)

data/lib/rigor/environment/rbs_coverage_report.rb

@@ -42,7 +42,7 @@ module Rigor
       # enough that hard-coding is acceptable; a directory walk
       # at every call would add stat-cost to no benefit.)
       VENDORED_GEM_NAMES = Set[
-        "bcrypt", "idn-ruby", "mysql2", "nokogiri", "pg", "prism", "redis"
+        "bcrypt", "bundler", "cgi", "did_you_mean", "idn-ruby", "mysql2", "nokogiri", "pg", "prism", "redis", "rubygems"
       ].freeze
 
       # @param locked_gems [Hash{String => LockfileResolver::LockedGem}]

data/lib/rigor/environment/rbs_loader.rb

@@ -160,6 +160,28 @@ module Rigor
                                   end
       end
 
+      # Returns true when the named RBS declaration is a Module
+      # (`RBS::AST::Declarations::Module`) rather than a Class. The
+      # `user_class_fallback_receiver` tier consults this to route
+      # `Nominal[M].some_kernel_method` (where M is a module mixin
+      # like `PP::ObjectMixin`) through the `Nominal[Object]`
+      # fallback, because every concrete includer of M sees Kernel
+      # / Object instance methods as part of its own ancestor chain.
+      #
+      # Returns false for classes, for unknown names, and when the
+      # RBS environment failed to build (fail-soft).
+      def rbs_module?(name)
+        return false if env.nil?
+
+        rbs_name = parse_type_name(name)
+        return false if rbs_name.nil?
+
+        entry = env.class_decls[rbs_name]
+        entry.is_a?(::RBS::Environment::ModuleEntry)
+      rescue ::RBS::BaseError
+        false
+      end
+
       # Yields every known class / module / alias name (top-level
       # prefixed) currently loaded into the environment. The cache
       # producer that materialises the known-name set uses this so

data/lib/rigor/environment.rb

@@ -354,6 +354,19 @@ module Rigor
       @rbs_loader&.reflection
     end
 
+    # Returns true when the RBS environment carries the named
+    # declaration as a Module (not a Class). Used by the
+    # `user_class_fallback_receiver` tier to detect a module-mixin
+    # receiver (e.g. `PP::ObjectMixin`) so the dispatcher can route
+    # unresolved method calls through the `Nominal[Object]`
+    # fallback — every concrete includer of M honours Kernel /
+    # Object instance methods through its own ancestor chain.
+    def rbs_module?(name)
+      return false unless rbs_loader
+
+      rbs_loader.rbs_module?(name)
+    end
+
     # Compares two class/module names using analyzer-owned class data.
     # Returns `:equal`, `:subclass`, `:superclass`, `:disjoint`, or
     # `:unknown`. The static registry handles built-ins cheaply; the RBS

data/lib/rigor/flow_contribution/fact.rb

@@ -31,14 +31,20 @@ module Rigor
     #
     # ## Field set
     #
-    # - `target_kind`: `:parameter` (call-site argument) or
-    #   `:self` (receiver). Future slices may extend the set
-    #   (`:local`, `:ivar`, `:result`); the merger is agnostic
-    #   to the concrete kinds and only requires equality.
+    # - `target_kind`: `:parameter` (call-site argument), `:self`
+    #   (receiver), or `:local` (a named local in the surrounding
+    #   scope). v0.1.8 Pillar 2 Slice 1 added `:local` so plugins
+    #   recognising bespoke call shapes (`expect(x).to be_a(T)`)
+    #   can narrow a specific scope-bound local without routing
+    #   through the parameter-name lookup that requires an
+    #   authoritative RBS sig on the called method. Future slices
+    #   may extend further (`:ivar`, `:result`). The merger is
+    #   agnostic to the concrete kinds and only requires equality.
     # - `target_name`: a `Symbol`. For `:parameter` it's the
     #   declared parameter name. For `:self` it is the literal
     #   `:self` symbol so the field stays non-nil and the merge
-    #   key is well-defined.
+    #   key is well-defined. For `:local` it's the local-variable
+    #   name (e.g. `:x` for `expect(x).to be_a(T)`).
     # - `type`: a `Rigor::Type::*` (Nominal, Refined,
     #   IntegerRange, Difference, …) the fact narrows the
     #   target toward (when `negative` is false) or away from
@@ -53,7 +59,7 @@ module Rigor
     # value {Element#target} keys on, so two facts that narrow
     # the same parameter from different contribution sources
     # land in the same merge bucket.
-    FACT_VALID_TARGET_KINDS = %i[parameter self].freeze
+    FACT_VALID_TARGET_KINDS = %i[parameter self local].freeze
 
     class Fact < Data.define(:target_kind, :target_name, :type, :negative)
       def initialize(target_kind:, target_name:, type:, negative: false)
@@ -72,10 +78,14 @@ module Rigor
       end
 
       # Composite target identifier the merger keys on. `:self`
-      # for self-targeted facts; otherwise `[:parameter, name]`
-      # so two contributions that narrow the same parameter
-      # (regardless of source family) land in the same merge
-      # bucket.
+      # for self-targeted facts; otherwise `[kind, name]` so two
+      # contributions that narrow the same `(kind, name)` pair —
+      # regardless of source family — land in the same merge
+      # bucket. `:local` and `:parameter` facts that name the
+      # same symbol stay in separate buckets, which is the
+      # correct semantics: a `:local` fact narrows the surrounding
+      # scope's named local, a `:parameter` fact narrows the
+      # call-site argument matching the parameter declaration.
       def target
         target_kind == :self ? :self : [target_kind, target_name]
       end

data/lib/rigor/inference/expression_typer.rb

@@ -196,8 +196,8 @@ module Rigor
         Prism::UntilNode => :type_of_loop,
         Prism::ForNode => :type_of_dynamic_top,
         Prism::DefinedNode => :type_of_defined,
-        Prism::NumberedReferenceReadNode => :type_of_string_or_nil,
-        Prism::BackReferenceReadNode => :type_of_string_or_nil,
+        Prism::NumberedReferenceReadNode => :type_of_numbered_reference,
+        Prism::BackReferenceReadNode => :type_of_back_reference,
         Prism::MatchPredicateNode => :type_of_match_predicate,
         Prism::MatchRequiredNode => :type_of_match_required,
         Prism::MatchWriteNode => :type_of_dynamic_top,
@@ -347,6 +347,21 @@ module Rigor
         )
       end
 
+      # `$1` / `$2` / ... — numbered match-data globals. When the
+      # narrowing tier has bound a tighter type for this number
+      # (typically `String` after a `=~`-success guard like `unless
+      # /(\d+)/ =~ s; raise; end`), prefer the scope-bound type.
+      # Falls back to the default `String | nil`.
+      def type_of_numbered_reference(node)
+        scope.global(:"$#{node.number}") || type_of_string_or_nil(node)
+      end
+
+      # `$&` / `$'` / `$\`` / `$+` — symbolic back-references. Same
+      # narrowing model as numbered references.
+      def type_of_back_reference(node)
+        scope.global(node.name) || type_of_string_or_nil(node)
+      end
+
       # `expr in pattern` — pattern-match predicate. Returns `true`
       # when the pattern matches, `false` otherwise.
       def type_of_match_predicate(_node)
@@ -1010,11 +1025,15 @@ module Rigor
         local_def = node.receiver.nil? ? scope.top_level_def_for(node.name) : nil
         if local_def
           local_inference = infer_top_level_user_method(local_def, receiver, arg_types)
-          return local_inference if local_inference
-
-          # The local def matches by name but the
-          # parameter shape is too complex for the first-
-          # iteration binder (kwargs / optionals / rest).
+          return local_inference if local_inference && adoptable_self_call_result?(local_inference)
+
+          # The local def matches by name but the inference
+          # was disqualified — either the parameter shape is
+          # too complex for the first-iteration binder
+          # (kwargs / optionals / rest), or ADR-24 slice 1's
+          # conservative gate declined the resolved return
+          # type inside a class body (see
+          # `adoptable_self_call_result?`).
           # Returning `Dynamic[Top]` is the safest answer:
           # we know RBS dispatch would be wrong (the
           # method is user-defined and shadows whatever
@@ -1054,7 +1073,11 @@ module Rigor
         # the body with the call's argument types bound and
         # return the body's last-expression type.
         user_inference = try_user_method_inference(receiver, node, arg_types)
-        return user_inference if user_inference
+        if user_inference
+          return user_inference if adoptable_self_call_result?(user_inference)
+
+          return dynamic_top
+        end
 
         # Dynamic-origin propagation: when the receiver is Dynamic[T] and
         # no positive rule resolves the call, the result inherits the
@@ -1097,10 +1120,39 @@ module Rigor
         nil
       end
 
+      # ADR-24 slice 1 — implicit-self method-call resolution.
+      # `discovered_def_nodes` is now carried into method /
+      # class body scopes (see `StatementEvaluator#build_fresh_body_scope`),
+      # so a call written with no explicit receiver inside a
+      # method body resolves against the enclosing class's own
+      # definitions and the file's top-level defs. Before
+      # slice 1 every such call typed `Dynamic[top]`.
+      #
+      # The adoption of the resolved return type is gated:
+      #
+      # - At top-level / inside a DSL block (`scope.self_type`
+      #   is nil) the result is adopted unchanged — this is
+      #   the pre-slice-1 surface (the v0.0.3 A local-`def`
+      #   shortcut) and MUST keep working.
+      # - Inside a class body / method body (`self_type` set)
+      #   the result is adopted ONLY when it is `Bot`. A `Bot`
+      #   return is an always-diverging guard helper; adopting
+      #   it can only ever enable correct terminating-branch
+      #   narrowing, never a new `undefined-method` /
+      #   argument-type false positive. A non-`Bot` resolved
+      #   return is kept as `Dynamic[top]` (WD3) — adopting
+      #   precise non-`Bot` returns project-wide awaits the
+      #   callee-return-inference precision a later slice
+      #   brings (measured: unconditional adoption regressed
+      #   `rigor check lib` by 16 diagnostics).
+      def adoptable_self_call_result?(type)
+        scope.self_type.nil? || type.is_a?(Type::Bot)
+      end
+
       def try_user_method_inference(receiver, call_node, arg_types)
         return nil unless receiver.is_a?(Type::Nominal)
 
-        def_node = scope.user_def_for(receiver.class_name, call_node.name)
+        def_node = resolve_user_def_through_ancestors(receiver.class_name, call_node.name)
         return nil if def_node.nil?
 
         infer_user_method_return(def_node, receiver, arg_types)
@@ -1108,6 +1160,81 @@ module Rigor
         nil
       end
 
+      # ADR-24 slice 2 — resolves `method_name` against
+      # `class_name`'s own `def`s, then walks the user-class
+      # ancestor chain: included / prepended modules (transitive)
+      # and the superclass chain. RBS-known ancestors are NOT
+      # walked here — the `MethodDispatcher` RBS tier runs before
+      # `try_user_method_inference` and already covers them; an
+      # ancestor name that resolves to no project-discovered
+      # class/module ends that branch. Cross-file: the chain is
+      # followed through `Scope#discovered_superclasses` /
+      # `#discovered_includes` / `#discovered_def_nodes`, which
+      # the runner seeds from the project-wide pre-pass. The walk
+      # is breadth-first, cycle-guarded, and node-count-capped.
+      ANCESTOR_WALK_LIMIT = 100
+      private_constant :ANCESTOR_WALK_LIMIT
+
+      def resolve_user_def_through_ancestors(class_name, method_name)
+        queue = [class_name.to_s]
+        seen = {}
+        visited = 0
+        until queue.empty?
+          current = queue.shift
+          next if current.nil? || seen[current]
+
+          seen[current] = true
+          visited += 1
+          return nil if visited > ANCESTOR_WALK_LIMIT
+
+          found = scope.user_def_for(current, method_name)
+          return found if found
+
+          enqueue_ancestors(current, queue)
+        end
+        nil
+      end
+
+      # Pushes `current`'s direct ancestors onto the BFS queue:
+      # included / prepended modules first (Ruby places mixins
+      # nearer than the superclass), then the superclass. Each
+      # as-written name is resolved against `current`'s lexical
+      # nesting; names that resolve to no project class/module
+      # are dropped (RBS-known / third-party ancestors).
+      def enqueue_ancestors(current, queue)
+        scope.includes_of(current).each do |raw|
+          resolved = resolve_ancestor_class_name(current, raw)
+          queue.push(resolved) if resolved
+        end
+        raw_super = scope.superclass_of(current)
+        return if raw_super.nil?
+
+        resolved_super = resolve_ancestor_class_name(current, raw_super)
+        queue.push(resolved_super) if resolved_super
+      end
+
+      # Resolves a superclass name AS WRITTEN (`"Base"`, or a
+      # qualified `"A::B"`) to a project-discovered class,
+      # following Ruby's `Module.nesting` constant lookup: try
+      # the raw name under each enclosing namespace of the
+      # subclass, innermost first, then bare. Returns nil when
+      # no candidate names a discovered user class (e.g. the
+      # superclass is an RBS-known or third-party class).
+      def resolve_ancestor_class_name(subclass_qualified, raw_superclass)
+        segments = subclass_qualified.split("::")
+        (segments.length - 1).downto(0) do |i|
+          candidate = (segments[0, i] + [raw_superclass]).join("::")
+          return candidate if known_user_class?(candidate)
+        end
+        nil
+      end
+
+      def known_user_class?(name)
+        scope.discovered_superclasses.key?(name) ||
+          scope.discovered_def_nodes.key?(name) ||
+          scope.discovered_includes.key?(name)
+      end
+
       INFERENCE_GUARD_KEY = :__rigor_user_method_inference_stack__
       private_constant :INFERENCE_GUARD_KEY
 
@@ -1117,11 +1244,20 @@ module Rigor
         body_scope = build_user_method_body_scope(def_node, receiver, arg_types)
         return nil if body_scope.nil?
 
-        # Recursion-guard signature. Uses `describe(:short)`
-        # so non-Nominal receivers (e.g. the implicit
-        # `Object` carrier used for top-level / DSL-block
-        # defs in v0.0.3 A) can participate without raising.
-        signature = [receiver.describe(:short), def_node.name, arg_types.map { |t| t.describe(:short) }]
+        # Recursion-guard signature. Keyed on `(receiver,
+        # method)` only — NOT the argument types. ADR-24 WD5:
+        # a method whose summary is still being computed
+        # resolves to `Dynamic[top]` for that cycle. Keying on
+        # arg types would let mutual recursion through a
+        # `module_function` module (`Acceptance#accepts` →
+        # `accepts_one` → `accepts_dynamic` → `accepts`)
+        # recurse unboundedly whenever the carried argument
+        # types differ at each level — observed as a
+        # `SystemStackError` once implicit-self calls began
+        # resolving during the main walk. `describe(:short)`
+        # keeps non-Nominal receivers (the implicit `Object`
+        # carrier for top-level / DSL-block defs) printable.
+        signature = [receiver.describe(:short), def_node.name]
         stack = (Thread.current[INFERENCE_GUARD_KEY] ||= [])
         return Type::Combinator.untyped if stack.include?(signature)
 
@@ -1159,6 +1295,8 @@ module Rigor
                      .with_program_globals(scope.program_globals)
                      .with_discovered_methods(scope.discovered_methods)
                      .with_discovered_def_nodes(scope.discovered_def_nodes)
+                     .with_discovered_superclasses(scope.discovered_superclasses)
+                     .with_discovered_includes(scope.discovered_includes)
                      .with_self_type(receiver)
 
         required.each_with_index do |param, index|

data/lib/rigor/inference/method_dispatcher/rbs_dispatch.rb

@@ -74,10 +74,28 @@ module Rigor
         #   and binds the method-level type parameter that the
         #   block's return type references to `block_type` (Slice 6
         #   phase C sub-phase 2).
+        # @param self_type_override [Rigor::Type, nil] when set,
+        #   the substitution for `Bases::Self` in the method's
+        #   return type. Used by `MethodDispatcher#try_user_class_fallback`
+        #   to preserve the ORIGINAL receiver as the substitute
+        #   for `self` even though the dispatch is routed through
+        #   `Nominal[Object]` — so that `Bundler::URI::Generic.dup`
+        #   (which resolves through the `Object` fallback because
+        #   `Bundler::URI::Generic` lacks RBS) returns
+        #   `Bundler::URI::Generic` per `Kernel#dup: () -> self`
+        #   rather than `Object`. Defaults to nil (compute self
+        #   from the resolved class_name as before).
+        # @param public_only [Boolean] when true, a method whose RBS
+        #   accessibility is `:private` does not resolve (the call
+        #   yields `nil`, i.e. "no rule"). Set by the explicit-
+        #   non-`self`-receiver user-class fallback so a call like
+        #   `Favourite.select(...)` does not adopt the private
+        #   `Kernel#select` signature.
         # @return [Rigor::Type, nil] inferred return type, or `nil`
         #   when no rule resolves (no class name, no method, dispatch
         #   on a Top/Dynamic[Top] receiver, etc.).
-        def try_dispatch(receiver:, method_name:, args:, environment:, block_type: nil)
+        def try_dispatch(receiver:, method_name:, args:, environment:, block_type: nil, self_type_override: nil,
+                         public_only: false)
           return nil if environment.nil?
           return nil unless environment.rbs_loader
 
@@ -86,7 +104,9 @@ module Rigor
             method_name: method_name,
             args: args,
             environment: environment,
-            block_type: block_type
+            block_type: block_type,
+            self_type_override: self_type_override,
+            public_only: public_only
           )
         end
 
@@ -128,32 +148,39 @@ module Rigor
         class << self
           private
 
-          def dispatch_for(receiver:, method_name:, args:, environment:, block_type:)
+          def dispatch_for(receiver:, method_name:, args:, environment:, block_type:, self_type_override: nil,
+                           public_only: false)
             args ||= []
             case receiver
             when Type::Union
-              dispatch_union(receiver, method_name, args, environment, block_type)
+              dispatch_union(receiver, method_name, args, environment, block_type, self_type_override,
+                             public_only: public_only)
             else
-              dispatch_one(receiver, method_name, args, environment, block_type)
+              dispatch_one(receiver, method_name, args, environment, block_type, self_type_override,
+                           public_only: public_only)
             end
           end
 
-          def dispatch_union(receiver, method_name, args, environment, block_type)
+          def dispatch_union(receiver, method_name, args, environment, block_type, self_type_override = nil,
+                             public_only: false)
             results = receiver.members.map do |member|
-              dispatch_one(member, method_name, args, environment, block_type)
+              dispatch_one(member, method_name, args, environment, block_type, self_type_override,
+                           public_only: public_only)
             end
             return nil if results.any?(&:nil?)
 
             Type::Combinator.union(*results)
           end
 
-          def dispatch_one(receiver, method_name, args, environment, block_type)
+          def dispatch_one(receiver, method_name, args, environment, block_type, self_type_override = nil,
+                           public_only: false)
             descriptor = receiver_descriptor(receiver)
             return nil unless descriptor
 
             class_name, kind, receiver_args = descriptor
             method_definition = lookup_method(environment, class_name, kind, method_name)
             return nil unless method_definition
+            return nil if public_only && method_private?(method_definition)
 
             type_vars = build_type_vars(environment, class_name, receiver_args)
             translate_return_type(
@@ -163,7 +190,8 @@ module Rigor
               args: args,
               type_vars: type_vars,
               block_type: block_type,
-              environment: environment
+              environment: environment,
+              self_type_override: self_type_override
             )
           rescue StandardError
             # Defensive: if RBS' definition builder raises on a broken
@@ -229,6 +257,16 @@ module Rigor
             ]
           end
 
+          # True when the RBS method definition is `private`. A call
+          # with an explicit, non-`self` receiver cannot reach a
+          # private method (Ruby raises `NoMethodError`), so the
+          # explicit-receiver user-class fallback uses this to reject
+          # private signatures rather than return a wrong type.
+          def method_private?(method_definition)
+            method_definition.respond_to?(:accessibility) &&
+              method_definition.accessibility == :private
+          end
+
           def lookup_method(environment, class_name, kind, method_name)
             case kind
             when :instance
@@ -254,8 +292,10 @@ module Rigor
             param_names.zip(receiver_args).to_h
           end
 
+          # rubocop:disable Metrics/ParameterLists
           def translate_return_type(method_definition, class_name:, kind:, args:, type_vars:, block_type:,
-                                    environment: nil)
+                                    environment: nil, self_type_override: nil)
+            # rubocop:enable Metrics/ParameterLists
             # Slice 4b-3 (ADR-7 § "Slice 4-A/4-B") — read the
             # return-type override through the merger so future
             # plugin / `:rbs_extended` bundles that also assert a
@@ -266,11 +306,17 @@ module Rigor
             return override if override
 
             instance_type = Type::Combinator.nominal_of(class_name)
-            self_type =
+            resolved_self_type =
               case kind
               when :singleton then Type::Combinator.singleton_of(class_name)
               else                 instance_type
               end
+            # `self_type_override` lets the user-class fallback
+            # path preserve the ORIGINAL receiver as the substitute
+            # for `Bases::Self` — so `Kernel#dup: () -> self`
+            # resolved through the Object fallback returns the
+            # caller's type, not Object.
+            self_type = self_type_override || resolved_self_type
 
             method_type = OverloadSelector.select(
               method_definition,

data/lib/rigor/inference/method_dispatcher.rb

@@ -191,7 +191,7 @@ module Rigor
         # introspection (`attr_reader`, `private`, ...) on
         # user classes without requiring the user to author
         # their own RBS.
-        try_user_class_fallback(receiver_type, method_name, arg_types, environment, block_type)
+        try_user_class_fallback(receiver_type, method_name, arg_types, environment, block_type, call_node)
       end
 
       # v0.1.3 — discovered-method dispatch tier. `scope` carries
@@ -651,27 +651,72 @@ module Rigor
           )
       end
 
-      def try_user_class_fallback(receiver_type, method_name, arg_types, environment, block_type)
+      def try_user_class_fallback(receiver_type, method_name, arg_types, environment, block_type, call_node = nil)
         return nil if environment.nil?
 
         fallback_receiver = user_class_fallback_receiver(receiver_type, environment)
         return nil if fallback_receiver.nil?
 
+        # Preserve the ORIGINAL receiver type as the `self`
+        # substitution so `Kernel#dup: () -> self` and other
+        # `self`-returning methods route through Object's RBS
+        # while still returning the caller's type rather than
+        # `Object`. Without this, `base = self.dup` inside a
+        # `Bundler::URI::Generic` instance method types `base`
+        # as `Object` because `Bundler::URI::Generic` is not in
+        # RBS and the fallback's `self` resolves to Object.
+        #
+        # `public_only:` — when the call has an EXPLICIT, non-`self`
+        # receiver (`Favourite.select(...)`), suppress the private
+        # `Object`/`Kernel`/`Class` methods the fallback would
+        # otherwise resolve. Ruby raises `NoMethodError` for a
+        # private method called with an explicit receiver, so
+        # resolving `Favourite.select` to the private `Kernel#select`
+        # (`-> Array[String]`) is a confidently-wrong type. Implicit-
+        # self / `self.`-receiver calls (`puts`, `raise`, `require`)
+        # keep resolving — those are the fallback's intended targets.
         RbsDispatch.try_dispatch(
           receiver: fallback_receiver,
           method_name: method_name,
           args: arg_types,
           environment: environment,
-          block_type: block_type
+          block_type: block_type,
+          self_type_override: receiver_type,
+          public_only: explicit_non_self_receiver?(call_node)
         )
       end
 
+      # True when the call node carries an explicit receiver that is
+      # not the literal `self`. Such a call cannot legally dispatch to
+      # a private method, so the user-class fallback must skip private
+      # signatures rather than return a confidently-wrong type. Returns
+      # false for implicit-self calls and `self.`-receiver calls (both
+      # may legally reach a private method in modern Ruby), and false
+      # when no `call_node` is supplied (internal dispatcher callers).
+      def explicit_non_self_receiver?(call_node)
+        return false if call_node.nil?
+        return false unless call_node.respond_to?(:receiver)
+
+        receiver = call_node.receiver
+        return false if receiver.nil?
+
+        !receiver.is_a?(Prism::SelfNode)
+      end
+
       def user_class_fallback_receiver(receiver_type, environment)
         case receiver_type
         when Type::Nominal
-          return nil if Rigor::Reflection.rbs_class_known?(receiver_type.class_name, environment: environment)
+          # Modules: even when RBS knows the module, an instance
+          # method on a mixin-only module (e.g. `PP::ObjectMixin`)
+          # observes Kernel / Object methods through every concrete
+          # includer's ancestor chain. Route through the
+          # `Nominal[Object]` fallback so `self.inspect` /
+          # `self.respond_to?` / `self.class` resolve cleanly when
+          # the module itself does not declare them.
+          known = Rigor::Reflection.rbs_class_known?(receiver_type.class_name, environment: environment)
+          return environment.nominal_for_name("Object") if !known || environment.rbs_module?(receiver_type.class_name)
 
-          environment.nominal_for_name("Object")
+          nil
         when Type::Singleton
           return nil if Rigor::Reflection.rbs_class_known?(receiver_type.class_name, environment: environment)