rigortype 0.2.8 → 0.3.0

data/docs/manual/03-configuration.md

@@ -22,6 +22,24 @@ discovery entirely.
 All relative paths in a config file resolve against that
 file's own directory.
 
+## Editor validation
+
+Rigor ships a JSON Schema for this file. Editors that
+understand the [`yaml-language-server`](https://github.com/redhat-developer/yaml-language-server)
+magic comment — VS Code's YAML extension, the IntelliJ
+family, Helix, Neovim with `yaml-ls` — give you
+autocomplete, hover docs, and structural validation as you
+type:
+
+```yaml
+# yaml-language-server: $schema=https://github.com/rigortype/rigor/raw/master/schemas/rigor-config.schema.json
+```
+
+`rigor init` writes that line for you. The schema is not a
+copy of this page — it is a source of truth in its own
+right, kept in step with the loader by a spec, so a key it
+rejects is a key Rigor does not accept.
+
 ## A minimal config
 
 ```yaml
@@ -44,6 +62,7 @@ cache:
 | `exclude` | Array | `[]` | Glob patterns to skip. `vendor/bundle`, `.bundle`, and `node_modules` are always excluded. |
 | `includes` | Array | `[]` | Other config files to layer underneath this one. |
 | `fold_platform_specific_paths` | Boolean | `false` | Resolve Ruby-version-conditional load paths when discovering sources. |
+| `parameter_inference` | Boolean | `false` | Opt-in call-site parameter type inference on the `check` walk ([ADR-67](../adr/67-parameter-type-inference.md) WD6). When `true`, an undeclared `def` / `initialize` / setter parameter is typed to the union of its resolved call-site argument types, sharpening downstream ivar reads, folds, and protection coverage. Precision-additive only — the negative rules never fire against an inferred parameter. Cannot be combined with `--incremental`. |
 
 ### Type sources
 
@@ -65,6 +84,7 @@ types it was meant to describe into a high-confidence
 of real type errors. The audit covers:
 
 ```
+rigor: `excludee` is not a recognized configuration key; it has no effect. Did you mean `exclude`?
 rigor: signature_paths: "/path/to/sig" does not exist (no signatures loaded from it)
 rigor: signature_paths: "/path/to/sig" matched 0 signature files
 rigor: libraries: "csb" is not an available RBS library (no signatures loaded from it)
@@ -73,6 +93,11 @@ rigor: severity_overrides: "flow.bogus" is not a recognized rule id; the overrid
 rigor: bundler.lockfile: "./missing/Gemfile.lock" does not exist
 ```
 
+The unrecognised-key check covers **top-level** keys, and skips
+the namespaces reserved for other implementations (see below).
+A typo *inside* a group — `cache: { pth: … }` — is caught by
+the JSON schema as you type rather than at check time.
+
 These are warnings, not errors — partial or optional bundles and
 forward-looking config are valid setups. The audit only fires on explicit,
 working-setup-safe signals: an unset default (auto-detected `<root>/sig`,
@@ -91,7 +116,7 @@ statically and may resolve at run time. The same findings appear in the
 | `severity_profile` | String | `"balanced"` | `lenient`, `balanced`, or `strict` — see [Diagnostics](04-diagnostics.md). |
 | `severity_overrides` | Hash | `{}` | Per-rule / per-family severity, e.g. `{ call: warning, flow.always-truthy-condition: off }`. |
 | `baseline` | String / `false` | `nil` | Path to a `.rigor-baseline.yml`, or `false` to disable an inherited one. See [Baselines](06-baseline.md). |
-| `bleeding_edge` | Boolean / Array / Hash | `false` | Adopt the next major's queued diagnostic disciplines early ([ADR-50](../adr/50-release-engineering-and-stability-strategy.md) § WD2). `false` adopts none; `true` adopts the whole overlay; a list of feature ids adopts only those; `{ all: true, except: [ids] }` adopts all but the named. Orthogonal to `severity_profile`. Override it for a single run with [`rigor check --bleeding-edge[=ids]`](02-cli-reference.md#rigor-check) / `--no-bleeding-edge`. Inspect with [`rigor show-bleedingedge`](02-cli-reference.md#rigor-show-bleedingedge). The overlay is empty in this release, so every form is currently a no-op. |
+| `bleeding_edge` | Boolean / Array / Hash | `false` | Adopt the next major's queued diagnostic disciplines early ([ADR-50](../adr/50-release-engineering-and-stability-strategy.md) § WD2). `false` adopts none; `true` adopts the whole overlay; a list of feature ids adopts only those; `{ all: true, except: [ids] }` adopts all but the named. Orthogonal to `severity_profile`. Override it for a single run with [`rigor check --bleeding-edge[=ids]`](02-cli-reference.md#rigor-check) / `--no-bleeding-edge`. Inspect with [`rigor show-bleedingedge`](02-cli-reference.md#rigor-show-bleedingedge). |
 
 ### Dependency RBS discovery
 
@@ -128,11 +153,18 @@ explicitly with `bundler.bundle_path:`, or supply signatures another way:
 | --- | --- | --- | --- |
 | `cache.path` | String | `.rigor/cache` | Persistent cache directory. See [Caching](12-caching.md). |
 | `cache.max_bytes` | Integer or `null` | `268435456` (256 MB) | LRU eviction cap for the cache directory; `null` disables eviction. See [Caching § Size and eviction](12-caching.md#size-and-eviction). |
-| `parallel.workers` | Integer | `0` | Parallel worker processes for per-file analysis (fork-based pool today; ADR-15); `0` is sequential. CLI `--workers` and `RIGOR_RACTOR_WORKERS` take precedence. |
+| `cache.validation` | String | `"auto"` | How the cache checks whether a file is unchanged: `auto` behaves as `digest` when a CI environment is detected and as `stat` otherwise; `stat` compares size + nanosecond timestamps + inode and only re-hashes a file whose stat moved; `digest` re-hashes every file's content every run. Both keep the content hash as the sole change authority — `stat` just skips the hash when the stat proves a file untouched. See [Caching § How a file is checked for changes](12-caching.md#how-a-file-is-checked-for-changes). The `RIGOR_STRICT_VALIDATION=1` environment variable forces `digest` for one run and wins over this key; `RIGOR_CI_DETECT=0` disables the CI detection. |
+| `parallel.workers` | Integer | `0` | Parallel worker processes for per-file analysis (fork-based pool today; ADR-15); `0` is sequential. CLI `--workers` and `RIGOR_RACTOR_WORKERS` take precedence. Applies to `--incremental` re-checks as well as full runs. |
 | `plugins_io.network` | String | `"disabled"` | Plugin network policy — `disabled` or `allowlist`. |
 | `plugins_io.allowed_paths` | Array | `[]` | Filesystem paths plugins may read. |
 | `plugins_io.allowed_url_hosts` | Array | `[]` | URL hosts plugins may fetch from when `network: allowlist`. |
 
+### Reserved for other implementations
+
+| Key | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `rigor_rs` | Hash | — | **Reserved; this implementation skips it.** Another Rigor implementation reads keys under this namespace, so one `.rigor.yml` can serve both. Rigor validates its shape at the schema level only — it never reads the value, and an invalid one is never a runtime error here. Leave it alone unless the tool that reads it tells you otherwise. |
+
 ## A worked example
 
 ```yaml

data/docs/manual/04-diagnostics.md

@@ -41,18 +41,26 @@ carries no `documentation_url`.
 | <a id="rule-call-wrong-arity"></a>`call.wrong-arity` | The positional-argument count matches no signature. | high |
 | <a id="rule-call-argument-type-mismatch"></a>`call.argument-type-mismatch` | An argument's type provably violates the parameter contract. | high |
 | <a id="rule-call-possible-nil-receiver"></a>`call.possible-nil-receiver` | The receiver is `T \| nil` and the method is not defined on `NilClass`. | high |
+| <a id="rule-call-raise-non-exception"></a>`call.raise-non-exception` | A `raise` / `fail` argument's concrete type is provably not an Exception class, an Exception instance, a String, or an object defining `#exception` — a runtime `TypeError`. | high |
 | <a id="rule-call-unresolved-toplevel"></a>`call.unresolved-toplevel` | A top-level implicit-self call resolves against no same-file `def`, `pre_eval:` patch, or `Kernel` / `Object` method. | low |
 | <a id="rule-flow-always-raises"></a>`flow.always-raises` | The expression provably raises on every reachable path. | high |
 | <a id="rule-flow-unreachable-branch"></a>`flow.unreachable-branch` | An `if` / `unless` / ternary branch is statically dead. | high |
 | <a id="rule-flow-always-truthy-condition"></a>`flow.always-truthy-condition` | A condition is provably always truthy or always falsey. | medium |
 | <a id="rule-flow-dead-assignment"></a>`flow.dead-assignment` | A local is written but never read in the same method. | medium |
 | <a id="rule-flow-unreachable-clause"></a>`flow.unreachable-clause` | A `case`/`when` or `case`/`in` clause is statically dead — its subject type is disjoint with the pattern, or a prior clause already exhausted the subject. | medium |
+| <a id="rule-flow-duplicate-hash-key"></a>`flow.duplicate-hash-key` | A Hash literal repeats a literal key (symbol, plain string, integer, float, `true`/`false`/`nil`) — the last entry silently overwrites the earlier one at runtime. Literal keys only; symbol vs string and `1` vs `1.0` never collide, and interpolated / constant / computed keys are never compared. A `**splat` between two identical literal keys does not rescue the pair. | high |
+| <a id="rule-flow-return-in-ensure"></a>`flow.return-in-ensure` | An explicit `return` inside an `ensure` clause — it overrides the method's in-flight return value and silently swallows any in-flight exception. A `return` in a nested `def`, lambda, or `define_method` block inside the `ensure` does not fire (it exits that inner frame). | high |
+| <a id="rule-flow-shadowed-rescue-clause"></a>`flow.shadowed-rescue-clause` | A `rescue` clause can never run because an earlier clause of the same chain already catches a superclass (or the same class) of every exception class it names. | high |
 | <a id="rule-def-return-type-mismatch"></a>`def.return-type-mismatch` | The method body's result violates its declared RBS return type. | medium |
 | <a id="rule-def-ivar-write-mismatch"></a>`def.ivar-write-mismatch` | An instance variable is written with a type disagreeing with its first write. | high |
 | <a id="rule-def-method-visibility-mismatch"></a>`def.method-visibility-mismatch` | An explicit-receiver call reaches a private method. | high |
 | <a id="rule-def-override-visibility-reduced"></a>`def.override-visibility-reduced` | An override reduces the visibility it inherits from a project-defined ancestor. | high |
 | <a id="rule-def-override-return-widened"></a>`def.override-return-widened` | An override's declared return type widens the inherited return (covariance). | high |
 | <a id="rule-def-override-param-narrowed"></a>`def.override-param-narrowed` | An override narrows an inherited parameter type (contravariance). | high |
+| <a id="rule-static-value-use-void"></a>`static.value-use.void` | A value recovered from an author-declared `-> void` return is used in value context (an assignment right-hand side, a call receiver, or a call argument). Off by default; reaches a run only through the `use-of-void-value` bleeding-edge feature (ADR-100). A bare-statement `void` call and a legitimate `top` value both stay silent. | high |
+| <a id="rule-suppression-unknown-rule"></a>`suppression.unknown-rule` | A `# rigor:disable[-file]` comment names a rule that does not exist (typically a typo), so the suppression silently does nothing. `plugin.`-prefixed tokens are never flagged. | high |
+| <a id="rule-suppression-empty"></a>`suppression.empty` | A `# rigor:disable[-file]` comment lists no rules, so it suppresses nothing. | high |
+| <a id="rule-suppression-unknown-marker"></a>`suppression.unknown-marker` | A comment uses a suppression marker Rigor does not recognise — typically the RuboCop reflex `# rigor:disable-next-line <rule>` or `# rigor:enable <rule>`. Rigor's only markers are `# rigor:disable <rules>` (suppresses on its own line) and `# rigor:disable-file <rules>`, so the comment suppresses nothing. | high |
 | <a id="rule-rbs_extended-unsatisfied-conformance"></a>`rbs_extended.unsatisfied-conformance` | A class declares `%a{rigor:v1:conforms-to _Interface}` in its RBS but is missing a method the interface requires. Presence-based: only definitively-absent required methods fire. | — |
 | <a id="rule-assert-type-mismatch"></a>`assert.type-mismatch` | An `assert_type` expectation does not match the inferred type. | high |
 | <a id="rule-dump-type"></a>`dump.type` | A `dump_type` call — informational, prints the inferred type. | — |
@@ -192,6 +200,21 @@ config.merge(extra)  # rigor:disable call.undefined-method
 It accepts qualified IDs, family wildcards (`call`), a
 comma- or space-separated list, or `all`.
 
+A marker that cannot work is flagged rather than silently
+ignored: a token that names no known rule (a typo like
+`call.undefined-metod`) fires
+[`suppression.unknown-rule`](#rule-suppression-unknown-rule),
+a bare marker with no rules at all fires
+[`suppression.empty`](#rule-suppression-empty), and a marker
+word outside Rigor's grammar (the RuboCop reflex
+`# rigor:disable-next-line <rule>`, or `# rigor:enable`)
+fires
+[`suppression.unknown-marker`](#rule-suppression-unknown-marker)
+— all `:warning` in every profile. Tokens under the `plugin.`
+prefix are never flagged (plugin rule vocabularies load
+dynamically), and the surveillance diagnostics are themselves
+suppressible like any other rule.
+
 **In-source, whole file.** `# rigor:disable-file <rules>`
 anywhere in a file suppresses those rules for every line;
 `# rigor:disable-file all` silences the file.

data/docs/manual/07-plugins.md

@@ -27,7 +27,7 @@ configuration takes the object form:
 plugins:
   - gem: rigor-activerecord
     config:
-      schema: db/schema.rb
+      schema_file: db/schema.rb
 ```
 
 ## Available plugins
@@ -40,10 +40,10 @@ each plugin's options — but the families today are:
 - **Rails** — `rigor-activerecord`, `rigor-actionpack`,
   `rigor-rails-routes`, `rigor-rails-i18n`,
   `rigor-actionmailer`, `rigor-activejob`,
-  `rigor-activestorage`, `rigor-actioncable`. The
-  `rigor-rails` meta-gem bundles the Rails set for Gemfile
-  convenience; you still enumerate the individual plugins you
-  want under `plugins:`.
+  `rigor-activestorage`, `rigor-actioncable`. Enumerate the ones
+  you want under `plugins:` — there is no umbrella entry that
+  turns on the Rails set as a group
+  ([ADR-96](../adr/96-plugin-target-gems.md) WD3 proposes one).
 - **Testing** — `rigor-rspec`, `rigor-rspec-rails`,
   `rigor-minitest`, `rigor-shoulda-matchers`,
   `rigor-factorybot`.

data/docs/manual/09-editor-integration.md

@@ -201,8 +201,8 @@ For a legacy bundler-based install, swap the connection list to
   analyzer assigns the receiver.
 - Mid-edit buffer support is best-effort. If parse fails AND the
   cursor isn't right after `.` / `::`, the v1 LSP returns no
-  completions; deeper recovery is queued (see ROADMAP §
-  "Editor / IDE integration").
+  completions; deeper recovery is queued (see the open
+  [`area:editor` issues](https://github.com/rigortype/rigor/issues?q=is%3Aissue+is%3Aopen+label%3Aarea%3Aeditor)).
 
 **Hover shows `untyped` everywhere.**
 
@@ -236,8 +236,8 @@ LSP v1 + v2 landed in v0.1.6 and ship in the `0.1.x` line. Queued
 follow-ups (`textDocument/signatureHelp`, hash-key completion,
 `textDocument/definition`, incremental `didChange` sync, Ractor
 pool dispatch, codeAction / rename / semanticTokens / inlayHint)
-are demand-driven; see ROADMAP § "Editor / IDE integration" for
-the current queue.
+are demand-driven; the current queue is the open
+[`area:editor` issues](https://github.com/rigortype/rigor/issues?q=is%3Aissue+is%3Aopen+label%3Aarea%3Aeditor).
 
 To request a queued feature or report an LSP issue, open a GitHub
 issue with: the editor + version, the Rigor version

data/docs/manual/11-ci.md

@@ -246,6 +246,57 @@ updates:
 extra files — but Dependabot does not see a version inside a `run:`
 step, so updates to the pin are manual.
 
+## Persisting the analysis cache across runs
+
+By default each CI run starts cold and re-analyses everything. The
+templates leave it that way on purpose — cold runs are simple,
+deterministic, and fast enough for most projects. When the Rigor
+job's runtime starts to matter (a large codebase, many plugins),
+persist [the analysis cache](12-caching.md) between runs.
+
+**Restore and save the cache directory** with your CI's cache
+facility, keyed on anything that changes the analysis wholesale
+(the Rigor version / lockfile). That is the whole setup: Rigor
+detects CI and switches its cache freshness check from stat
+metadata (which a fresh checkout regenerates, and which would
+otherwise force parts of the restored cache to recompute every
+run) to content hashes, which are identical across checkouts.
+Details: [How a file is checked for changes](12-caching.md#how-a-file-is-checked-for-changes).
+
+GitHub Actions:
+
+```yaml
+      - uses: actions/cache@v4
+        with:
+          path: .rigor/cache
+          key: rigor-cache-${{ runner.os }}-${{ hashFiles('.github/rigor/Gemfile.lock') }}-${{ github.sha }}
+          restore-keys: rigor-cache-${{ runner.os }}-${{ hashFiles('.github/rigor/Gemfile.lock') }}-
+      - run: bundle exec rigor check
+```
+
+GitLab CI:
+
+```yaml
+rigor:
+  cache:
+    key: rigor-cache
+    paths:
+      - .rigor/cache
+```
+
+Two refinements:
+
+- A **self-hosted runner that reuses its workspace** keeps stable
+  stat metadata, so the faster stat check works there — opt back
+  into it with `cache.validation: stat`.
+- On Rigor versions before the `auto` default, set
+  `RIGOR_STRICT_VALIDATION: "1"` on the job explicitly.
+
+The cache is content-keyed and self-invalidating — a stale or
+corrupt restore degrades to a recompute, never a wrong result. If
+you would rather guarantee every run is independent, pass
+`--no-cache` instead and skip this section.
+
 ## Container image
 
 A standalone image is published to GHCR with Ruby 4.0 and Rigor

data/docs/manual/12-caching.md

@@ -38,6 +38,49 @@ The cache is also schema-versioned: after a Rigor upgrade that
 changes the cache format, the stale cache is purged on the
 first writable run.
 
+## How a file is checked for changes
+
+To decide whether a cached entry is still valid, Rigor needs to
+know which of your files changed since the entry was written. By
+default it checks each file's **stat metadata** first — size,
+nanosecond modification and change timestamps, and inode — and
+only re-hashes a file's content when that metadata moved. On a
+large project an unchanged run then reads *zero* content bytes to
+validate the cache, instead of re-hashing every file.
+
+The content hash stays the sole authority on whether a file
+actually changed: the stat check only decides whether the hash
+needs recomputing. A file that was merely `touch`ed (new
+timestamp, identical content) is re-hashed once and correctly
+found unchanged. Editing a file always moves its timestamps, so
+an edit is never missed.
+
+The stat check is skipped where it cannot work: the default
+setting is `validation: auto`, which behaves as `stat` on your
+machine and switches to hashing every file (`digest`) when a CI
+environment is detected. CI is the common case of untrustworthy
+stat metadata — a fresh checkout regenerates every timestamp and
+inode, so a cache restored across CI runs (for example with
+`actions/cache`) never passes the stat check, and parts of it
+(plugin watch-glob entries, which are stat-signature only) would
+be recomputed on every run. Content hashes are identical across
+checkouts, so under `digest` the restored cache simply hits.
+
+The setting can be forced either way:
+
+```yaml
+cache:
+  validation: digest    # hash always — for any filesystem whose
+                        # timestamps or inodes cannot be trusted
+  # validation: stat    # stat always — e.g. a self-hosted CI
+                        # runner that reuses its workspace, where
+                        # stat metadata IS stable across runs
+```
+
+For a single run, `RIGOR_STRICT_VALIDATION=1` forces `digest`
+and wins over the config key; `RIGOR_CI_DETECT=0` turns off the
+CI detection that `auto` relies on.
+
 ## Controlling the cache
 
 | Flag | Effect |
@@ -90,6 +133,28 @@ gate, `rigor check --verify-incremental`, asserts this on every
 build: it runs the incremental analyzer and a full analysis and
 fails if they disagree on a single diagnostic.
 
+Rigor is also precise about *what* an edit changed. Re-checking a
+file that many others depend on — a base class, a widely-used
+concern, a shared utility — used to re-check every dependent.
+Now, if your edit did not change the file's declaration shape
+(the signatures of its methods, its superclass and includes) or
+the types its methods return, the files that only depend on those
+things are left untouched: a comment, a formatting change, or an
+internal refactor that preserves every method's return type stops
+at the edited file. An edit that *does* change a return type or a
+signature still propagates to the dependents that consume it, so
+the result stays identical to a full run.
+
+Types contributed by plugins (a Sorbet signature, an
+ActiveRecord column type, a dry-types alias) are validated too:
+if a plugin's cross-file contributions change between runs, the
+snapshot is dropped and the next run is a full one, so a plugin
+edit can never leave a dependent stale.
+
+An `--incremental` re-check honours `--workers=N` (and
+`RIGOR_RACTOR_WORKERS` / `parallel.workers:`), analysing the
+affected files in parallel just as a full run does.
+
 The snapshot lives under the cache directory (`.rigor/cache`)
 and is keyed by a fingerprint of your configuration, your locked
 gems, your project's own `sig/` RBS, and the Rigor version.

data/docs/manual/14-rails-quickstart.md

@@ -27,7 +27,7 @@ You need:
 - **`mise` wired into your shell** — add
   `eval "$(mise activate zsh)"` (or the equivalent for your
   shell) to your shell rc so that `rigor` reaches your `PATH`.
-  See [Installing Rigor § Putting rigor on your PATH](01-installation.md)
+  See [Installing Rigor § Putting rigor on your PATH](01-installation.md#putting-rigor-on-your-path)
   for detail.
 - **An existing Rails project** at a known path.
 
@@ -156,7 +156,9 @@ source-of-truth copy is
 
 If your first `rigor check` reports more than ~100 diagnostics,
 acknowledge mode is the natural starting point. You can tighten
-it later.
+it later. In `.rigor.dist.yml` (Step 3) the mode maps to a
+`severity_profile:` — acknowledge → `lenient`, strict → `strict`
+(omit the key for the default `balanced`).
 
 ### Step 3 — Write .rigor.dist.yml
 

data/docs/manual/15-type-protection-coverage.md

@@ -48,6 +48,14 @@ power. `--threshold=RATIO` turns it into a CI gate (exit `1`
 below the ratio) and `--format=json` carries the structured
 fields.
 
+On a large project, `--workers=N` fork-parallelizes the scan
+(both the parameter-inference pre-pass and the per-file scan),
+with output byte-identical to a sequential run. The worker count
+resolves the same way `rigor check` does — `--workers` ›
+`RIGOR_RACTOR_WORKERS` › [`parallel.workers:`](03-configuration.md)
+› `0` (sequential default) — so a project already configured for
+parallel `check` gets parallel coverage for free.
+
 This is the everyday number. When you want the truth behind it,
 move to Tier 2.
 
@@ -200,6 +208,19 @@ the "Add a type here" header, and the JSON carries the same totals as
 `tractability_summary`. Start with the `add_rbs` holes — they are the
 ones a type actually catches.
 
+> **`external_gem_without_rbs` needs your gems installed where Rigor
+> can read them.** To tell whether an unresolved constant belongs to
+> a gem, Rigor reads that gem's source — so it must find the gem on
+> disk. It looks in the project's Bundler install tree (a
+> `vendor/bundle`, or a path set with `bundler.bundle_path:`; see
+> [Configuration](03-configuration.md)). A project whose gems live in
+> the active Ruby's default gem home — the common `rbenv` / `mise`
+> case with no `--path` set — is invisible to the isolated analyzer by
+> design ([ADR-27](https://github.com/rigortype/rigor/blob/master/docs/adr/27-tool-distribution-model.md)):
+> point Rigor at it with `bundler.bundle_path:`. Until you do, these
+> holes keep the generic `engine_gap` cause instead of `add_rbs` —
+> the label is missing, never wrong.
+
 Provenance is precision-additive only: it never changes a type, fires
 no diagnostic, and never affects severity or the protection ratio.
 

data/docs/manual/plugins/rigor-actionpack.md

@@ -39,7 +39,7 @@ no-op rather than erroring.
 | `plugin.actionpack.render-target` | info | an explicit `render :symbol` / `"string"` / `partial:` resolved to a view template |
 | `plugin.actionpack.missing-template` | error | an explicit `render` resolved to a view path that doesn't exist under any `view_search_paths` |
 | `plugin.actionpack.permit-call` | info | a `params.require(:m).permit(:key, …)` chain resolved to a known model; keys matched against its columns |
-| `plugin.actionpack.unknown-permit-key` | error | a literal `permit(:key)` isn't a column on the model (with a did-you-mean) |
+| `plugin.actionpack.unknown-permit-key` | error | a literal `permit(:key)` is a near-miss (edit distance ≤ 2) of a real column but not one — a likely typo (with a did-you-mean). A key nothing like any column (a legitimate virtual attribute) does not fire |
 
 Filter and render resolution honours nested-module controller
 qualification (`module Admin; class WidgetsController` resolves

data/docs/manual/plugins/rigor-activerecord.md

@@ -30,9 +30,9 @@ errors_demo.rb:25:1: error: `User.find` expects at least 1 argument, got 0 [plug
 | Recognised `Model.find` / `Model.find_by` / `Model.where` call | `:info` | `plugin.activerecord.model-call` |
 | `Model.find_by(unknown: ...)` / `Model.where(unknown: ...)` | `:error` | `plugin.activerecord.unknown-column` |
 | `Model.find` with 0 args | `:error` | `plugin.activerecord.wrong-arity` |
-| `db/schema.rb` not readable | `:warning` | `plugin.activerecord.load-error` |
+| No schema source (`db/schema.rb` or `db/structure.sql`) readable | `:warning` | `plugin.activerecord.load-error` |
 
-Did-you-mean suggestions use Levenshtein distance ≤ 3 against
+Did-you-mean suggestions use `DidYouMean` fuzzy matching against
 the resolved table's column names.
 
 ## Configuration
@@ -42,13 +42,16 @@ plugins:
   - gem: rigor-activerecord
     config:
       schema_file: "db/schema.rb"                                  # default
+      structure_sql_file: "db/structure.sql"                       # default (fallback when schema_file is absent)
       model_search_paths: ["app/models"]                           # default
       model_base_classes: ["ApplicationRecord", "ActiveRecord::Base"]  # default
 ```
 
-All three keys are optional. Tweak them when:
+All keys are optional. Tweak them when:
 
 - the schema lives elsewhere (`schema_file: "shared/db/schema.rb"`);
+- the project uses `schema_format = :sql` and its dump is not at the
+  default path (`structure_sql_file: "db/structure.sql"`);
 - models are in a non-standard directory
   (`model_search_paths: ["domain/models", "engines/billing/app/models"]`);
 - the base class is custom
@@ -78,8 +81,12 @@ never surfaces a false `call.undefined-method`.
   `User < ApplicationRecord` is not discovered. Either add `User`
   to `model_base_classes`, or list every concrete model
   explicitly.
-- **`db/schema.rb` only.** `db/structure.sql` (raw SQL dumps) is
-  not supported in this iteration.
+- **PostgreSQL `db/structure.sql` fallback.** When `db/schema.rb` is
+  absent, the plugin parses `db/structure.sql` (the `schema_format =
+  :sql` dump) for the same column/type table. It reads PostgreSQL DDL
+  only; a column whose SQL type has no Ruby mapping (a custom enum,
+  `tsvector`, `ltree`) degrades to `Object` (never dropped), and
+  non-`public`-schema partition tables are skipped.
 - **Column reads, not setters.** The plugin types instance-side
   column *reads* (`user.name`, `user.admin?`) and singular
   associations, but not the `name=` setter or the dirty-tracking

data/docs/manual/plugins/rigor-rails-routes.md

@@ -59,6 +59,8 @@ plugins:
       routes_file: "config/routes.rb"   # default
       helper_paths: ["app"]             # default; dirs scanned for
                                         # project-defined *_path / *_url methods
+      grape_api_paths: ["lib/api", "app/api"]
+                                        # default; dirs scanned for Grape API classes
 ```
 
 `helper_paths` lets the plugin also register URL builders you
@@ -66,6 +68,15 @@ define yourself (e.g. a private `def callback_url` under
 `app/controllers` or `app/lib`), so calls to them are not flagged
 as unknown helpers.
 
+`grape_api_paths` is where the plugin looks for Grape API classes.
+If you mount one, the `grape-path-helpers` gem generates helpers
+named after each route's path (`api_v4_groups_badges_path`) from
+grape's *runtime* route table, which no static parser can
+enumerate. The plugin reads your API's `prefix` and `version`
+declarations instead and treats the namespace they open as
+unknowable-but-valid, so those calls are never flagged. The `_url`
+form still is: `grape-path-helpers` defines only `_path` helpers.
+
 ## What it provides
 
 The parsed helper table is published as the `:helper_table`

data/lib/rigor/analysis/check_rules/always_truthy_condition_collector.rb

@@ -2,6 +2,9 @@
 
 require "prism"
 
+require_relative "../../source/node_children"
+require_relative "inferred_param_guard"
+
 module Rigor
   module Analysis
     module CheckRules
@@ -81,7 +84,7 @@ module Rigor
           visit(node) if conditional_node?(node) && !in_loop_or_block
 
           child_in_loop_or_block = in_loop_or_block || enters_loop_or_block?(node)
-          node.compact_child_nodes.each { |child| walk(child, in_loop_or_block: child_in_loop_or_block) }
+          node.rigor_each_child { |child| walk(child, in_loop_or_block: child_in_loop_or_block) }
         end
 
         def conditional_node?(node)
@@ -100,6 +103,11 @@ module Rigor
           scope = @scope_index[node]
           return if scope.nil?
 
+          # ADR-67 WD6b — a predicate rooted at an inferred parameter (`opts.key?(:x)`) folds to a constant only
+          # because the seed's lower-bound type pinned it; a wider real caller would not. Declining preserves
+          # the precision-additive contract.
+          return if InferredParamGuard.rooted?(predicate, scope)
+
           predicate_type = scope.type_of(predicate)
           return unless predicate_type.is_a?(Type::Constant)
 

data/lib/rigor/analysis/check_rules/dead_assignment_collector.rb

@@ -2,6 +2,8 @@
 
 require "prism"
 
+require_relative "../../source/node_children"
+
 module Rigor
   module Analysis
     module CheckRules
@@ -65,7 +67,7 @@ module Rigor
           return unless node.is_a?(Prism::Node)
 
           collect_def_assignments(node) if node.is_a?(Prism::DefNode)
-          node.compact_child_nodes.each { |child| walk_for_def_nodes(child) }
+          node.rigor_each_child { |child| walk_for_def_nodes(child) }
         end
 
         def collect_def_assignments(def_node)
@@ -92,7 +94,7 @@ module Rigor
           # / similar shapes don't trip the rule.
           accumulator << node.name if reading_assignment?(node)
 
-          node.compact_child_nodes.each { |child| gather_read_names(child, accumulator) }
+          node.rigor_each_child { |child| gather_read_names(child, accumulator) }
           accumulator
         end
 
@@ -110,7 +112,7 @@ module Rigor
           # outer walker visits them separately.
           return accumulator if node.is_a?(Prism::DefNode) && !accumulator.last.equal?(node)
 
-          node.compact_child_nodes.each { |child| gather_write_nodes(child, accumulator) }
+          node.rigor_each_child { |child| gather_write_nodes(child, accumulator) }
           accumulator
         end