rigortype 0.2.9 → 0.3.1

data/lib/rigor/analysis/check_rules/inferred_param_guard.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # ADR-67 WD6b — the shared "is this node rooted at an inferred parameter?" predicate.
+      #
+      # When the `parameter_inference:` gate seeds an undeclared parameter from its call-site union, that type
+      # is a *lower bound* (only the resolved call sites contribute; an unseen / dynamic caller could pass any
+      # wider value). A diagnostic decided against a lower bound is a false positive by construction — the same
+      # reasoning that keeps ADR-67 WD1 non-negotiable at the parameter boundary. So every negative in-body
+      # rule must decline when the value it reasons about is (transitively) an inferred parameter.
+      #
+      # `rooted?` walks a receiver / argument / condition-subject node down to its syntactic root and reports
+      # whether that root is a pristine inferred-parameter local. It is purely syntactic — a bounded AST walk
+      # over `.receiver` — not a value-flow provenance channel (the mark stays on the direct parameter local
+      # in the scope; this reads the chain root at the firing site). It covers:
+      #
+      # - the direct receiver / subject: `param.foo`, `case param`
+      # - an indexed element: `param[i] - x` (the `-` receiver is the `[]` call whose root is `param`)
+      # - any method chain: `param.foo.bar`, `param.foo(arg).baz`, `param.key?(:x)`
+      #
+      # Every value derived from an inferred parameter by dispatch is itself a lower bound, so firing against it
+      # is an FP by the same construction. No-op on a normal `check` run — `Scope#inferred_param?` is false
+      # unless the gate seeded the table.
+      module InferredParamGuard
+        module_function
+
+        # A defensive depth cap against a pathological receiver chain (the walk is otherwise linear in chain
+        # length, which is tiny in practice).
+        MAX_DEPTH = 64
+
+        def rooted?(node, scope, depth = 0)
+          return false if node.nil? || depth > MAX_DEPTH
+
+          case node
+          when Prism::LocalVariableReadNode then scope.inferred_param?(node.name)
+          when Prism::CallNode then rooted?(node.receiver, scope, depth + 1)
+          # Value-combining forms: the produced value is a union of the operands, so it is a lower bound when
+          # ANY operand is inferred-parameter-rooted (`cps[i] - x rescue -1`, `a && param.foo`, `param || b`).
+          # Declining on the whole expression is FP-safe by the same lower-bound argument.
+          when Prism::RescueModifierNode
+            rooted?(node.expression, scope, depth + 1) || rooted?(node.rescue_expression, scope, depth + 1)
+          when Prism::AndNode, Prism::OrNode
+            rooted?(node.left, scope, depth + 1) || rooted?(node.right, scope, depth + 1)
+          when Prism::ParenthesesNode then rooted?(last_statement(node.body), scope, depth + 1)
+          when Prism::StatementsNode then rooted?(node.body.last, scope, depth + 1)
+          else false
+          end
+        end
+
+        def last_statement(body)
+          body.is_a?(Prism::StatementsNode) ? body.body.last : body
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/ivar_write_collector.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "../../source/constant_path"
+require_relative "../../source/node_children"
 
 module Rigor
   module Analysis
@@ -78,7 +79,7 @@ module Rigor
             return
           end
 
-          node.compact_child_nodes.each { |child| walk(child, qualified_prefix) }
+          node.rigor_each_child { |child| walk(child, qualified_prefix) }
         end
 
         def collect_def_writes(def_node, qualified_prefix)
@@ -95,7 +96,7 @@ module Rigor
           record_write(node, class_name) if node.is_a?(Prism::InstanceVariableWriteNode)
           return if BARRIER_NODES.any? { |klass| node.is_a?(klass) }
 
-          node.compact_child_nodes.each { |child| gather_writes(child, class_name) }
+          node.rigor_each_child { |child| gather_writes(child, class_name) }
         end
 
         def record_write(node, class_name)

data/lib/rigor/analysis/check_rules/return_in_ensure_collector.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../source/node_children"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # Walks a parse tree and collects every explicit `ReturnNode` that sits lexically inside the `ensure`
+      # clause of a `begin` / `def` / `class` body. In Ruby, `return` inside `ensure` silently discards
+      # both the method's in-flight return value and any in-flight exception — the classic footgun RuboCop
+      # ships as `Lint/EnsureReturn` and PHPStan as `OverwrittenExitPointByFinallyRule`.
+      #
+      # The check is purely syntactic (no type engine involved) with a frame-aware envelope so it only
+      # flags a `return` that actually belongs to the frame whose `ensure` it sits in:
+      #
+      # - A `return` inside a nested `def`, a lambda (`-> {}` / `lambda {}`), or a `define_method` block
+      #   within the ensure body is skipped — that `return` exits the inner frame, not the one whose
+      #   in-flight exception the ensure guards.
+      # - A `return` inside a *plain* block (`each do ... return ... end`) within the ensure body DOES
+      #   belong to the enclosing method and fires.
+      # - A nested `begin ... ensure ... end` *inside* an ensure body is not descended into at its own
+      #   `ensure` clause — that inner `EnsureNode` is visited separately (every `BeginNode` is), so each
+      #   offending `return` is collected exactly once.
+      class ReturnInEnsureCollector
+        # ADR-53 Track B — the node classes the shared {RuleWalk} dispatches to this collector. Prism
+        # represents every construct that can carry an `ensure` clause — `begin ... end`, a `def` body with
+        # `rescue` / `ensure`, a class / module body with them — as a `BeginNode`, so one dispatch class
+        # covers all the syntactic hosts. No context gates: the footgun is frame-relative, not
+        # position-relative, so a `begin/ensure` inside a loop, block, or lambda is checked the same way.
+        NODE_CLASSES = [Prism::BeginNode].freeze
+
+        # Receiver-less calls whose attached block opens a new return frame: a `return` inside their block
+        # exits the lambda / defined method, not the method whose `ensure` we are scanning. `proc` is
+        # deliberately absent — `return` inside a `Proc` block returns from the enclosing method, so it
+        # stays in scope for the rule.
+        FRAME_BARRIER_CALL_NAMES = %i[lambda define_method].freeze
+
+        def initialize(scope_index)
+          @scope_index = scope_index
+          @results = []
+        end
+
+        # Legacy single-collector walk — the oracle the ADR-53 Track B equivalence harness compares
+        # {RuleWalk} against.
+        def collect(root)
+          walk_for_begin_nodes(root)
+          @results.freeze
+        end
+
+        # {RuleWalk} entry point: invoked at every `BeginNode` the shared traversal reaches. The `context`
+        # is unused — this collector checks every ensure clause.
+        def visit(begin_node, _context = nil)
+          collect_ensure_returns(begin_node)
+        end
+
+        # Returns `Array<{return_node:}>` — one entry per offending `return`, frozen the same way
+        # `#collect` returns it.
+        def results
+          @results.freeze
+        end
+
+        private
+
+        def walk_for_begin_nodes(node)
+          return unless node.is_a?(Prism::Node)
+
+          collect_ensure_returns(node) if node.is_a?(Prism::BeginNode)
+          node.rigor_each_child { |child| walk_for_begin_nodes(child) }
+        end
+
+        def collect_ensure_returns(begin_node)
+          ensure_clause = begin_node.ensure_clause
+          return if ensure_clause.nil?
+
+          gather_returns(ensure_clause.statements)
+        end
+
+        def gather_returns(node)
+          return unless node.is_a?(Prism::Node)
+
+          case node
+          when Prism::ReturnNode
+            @results << { return_node: node }
+          when Prism::DefNode, Prism::LambdaNode, Prism::EnsureNode
+            # Def / lambda open a new return frame — a `return` below them exits the nested frame, not the
+            # one whose ensure we are scanning. A nested `begin/ensure`'s own EnsureNode is skipped for a
+            # different reason: its BeginNode is visited separately, which collects those returns once —
+            # descending here would double-collect them.
+            return
+          when Prism::CallNode
+            return gather_returns_around_barrier_block(node) if frame_barrier_call?(node)
+          end
+
+          node.rigor_each_child { |child| gather_returns(child) }
+        end
+
+        # `lambda { ... }` / `define_method(:x) { ... }`: the receiver and arguments stay in the current
+        # frame (and may themselves contain an offending `return`), only the attached block opens a new
+        # one — descend into everything except the block.
+        def gather_returns_around_barrier_block(call_node)
+          barrier_block = call_node.block
+          call_node.rigor_each_child do |child|
+            gather_returns(child) unless child.equal?(barrier_block)
+          end
+        end
+
+        def frame_barrier_call?(call_node)
+          call_node.receiver.nil? &&
+            FRAME_BARRIER_CALL_NAMES.include?(call_node.name) &&
+            call_node.block.is_a?(Prism::BlockNode)
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/rule_ids.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # Canonical identifiers for each rule. Per ADR-8 § "Diagnostic ID family hierarchy", rule names are
+      # `family.rule-name` two-segment strings; the families group diagnostics by where they originate
+      # (`call.*` for call-site rules, `flow.*` for flow-analysis proofs, `assert.*` for runtime-assertion
+      # rules, `dump.*` for debug helpers, `def.*` for method-definition rules). Used by the configuration
+      # `disable:` list and the in-source `# rigor:disable <rule>` suppression comment system; new rules MUST
+      # register here so user configuration can refer to them.
+      #
+      # ADR-87 WD4 — this pure-data constant table is split out of the (engine-heavy) `check_rules.rb` so
+      # {Analysis::RuleCatalog} — which the CLI's JSON `evidence_tier` / `documentation_url` enrichment reads
+      # — can require it WITHOUT loading the inference engine. The boot-slimming hit path stays engine-free
+      # even when it formats JSON.
+      RULE_UNDEFINED_METHOD = "call.undefined-method"
+      RULE_SELF_UNDEFINED_METHOD = "call.self-undefined-method"
+      RULE_UNRESOLVED_TOPLEVEL = "call.unresolved-toplevel"
+      RULE_WRONG_ARITY = "call.wrong-arity"
+      RULE_ARGUMENT_TYPE = "call.argument-type-mismatch"
+      RULE_NIL_RECEIVER = "call.possible-nil-receiver"
+      RULE_RAISE_NON_EXCEPTION = "call.raise-non-exception"
+      RULE_DUMP_TYPE = "dump.type"
+      RULE_ASSERT_TYPE = "assert.type-mismatch"
+      RULE_ALWAYS_RAISES = "flow.always-raises"
+      RULE_UNREACHABLE_BRANCH = "flow.unreachable-branch"
+      RULE_RETURN_TYPE = "def.return-type-mismatch"
+      RULE_VISIBILITY_MISMATCH = "def.method-visibility-mismatch"
+      RULE_OVERRIDE_VISIBILITY_REDUCED = "def.override-visibility-reduced"
+      RULE_OVERRIDE_RETURN_WIDENED = "def.override-return-widened"
+      RULE_OVERRIDE_PARAM_NARROWED = "def.override-param-narrowed"
+      RULE_IVAR_WRITE_MISMATCH = "def.ivar-write-mismatch"
+      RULE_DEAD_ASSIGNMENT = "flow.dead-assignment"
+      RULE_ALWAYS_TRUTHY_CONDITION = "flow.always-truthy-condition"
+      RULE_UNREACHABLE_CLAUSE = "flow.unreachable-clause"
+      RULE_DUPLICATE_HASH_KEY = "flow.duplicate-hash-key"
+      RULE_RETURN_IN_ENSURE = "flow.return-in-ensure"
+      RULE_SHADOWED_RESCUE_CLAUSE = "flow.shadowed-rescue-clause"
+      RULE_SUPPRESSION_UNKNOWN_RULE = "suppression.unknown-rule"
+      RULE_SUPPRESSION_EMPTY = "suppression.empty"
+      RULE_SUPPRESSION_UNKNOWN_MARKER = "suppression.unknown-marker"
+      # ADR-100 — the first `static.value-use.*` id: a value recovered from an author-declared `-> void`
+      # return, used in value context. Authored `:warning`, resolved `:off` by every profile and promoted to
+      # `:warning` only by the `use-of-void-value` bleeding-edge feature.
+      RULE_VALUE_USE_VOID = "static.value-use.void"
+
+      ALL_RULES = [
+        RULE_UNDEFINED_METHOD,
+        RULE_SELF_UNDEFINED_METHOD,
+        RULE_UNRESOLVED_TOPLEVEL,
+        RULE_WRONG_ARITY,
+        RULE_ARGUMENT_TYPE,
+        RULE_NIL_RECEIVER,
+        RULE_RAISE_NON_EXCEPTION,
+        RULE_DUMP_TYPE,
+        RULE_ASSERT_TYPE,
+        RULE_ALWAYS_RAISES,
+        RULE_UNREACHABLE_BRANCH,
+        RULE_DEAD_ASSIGNMENT,
+        RULE_ALWAYS_TRUTHY_CONDITION,
+        RULE_UNREACHABLE_CLAUSE,
+        RULE_DUPLICATE_HASH_KEY,
+        RULE_RETURN_IN_ENSURE,
+        RULE_SHADOWED_RESCUE_CLAUSE,
+        RULE_RETURN_TYPE,
+        RULE_VISIBILITY_MISMATCH,
+        RULE_OVERRIDE_VISIBILITY_REDUCED,
+        RULE_OVERRIDE_RETURN_WIDENED,
+        RULE_OVERRIDE_PARAM_NARROWED,
+        RULE_IVAR_WRITE_MISMATCH,
+        RULE_SUPPRESSION_UNKNOWN_RULE,
+        RULE_SUPPRESSION_EMPTY,
+        RULE_SUPPRESSION_UNKNOWN_MARKER,
+        RULE_VALUE_USE_VOID
+      ].freeze
+
+      # Backward-compat alias table (ADR-8 § "Backward compatibility"). Existing user code with
+      # `# rigor:disable undefined-method` / `disable: [undefined-method]` keeps working — the legacy
+      # unprefixed identifiers map to their canonical `family.rule-name` form here. Removing the aliases is a
+      # future ADR once user code has migrated; until then, both spellings resolve identically.
+      LEGACY_RULE_ALIASES = {
+        "undefined-method" => RULE_UNDEFINED_METHOD,
+        "self-undefined-method" => RULE_SELF_UNDEFINED_METHOD,
+        "wrong-arity" => RULE_WRONG_ARITY,
+        "argument-type-mismatch" => RULE_ARGUMENT_TYPE,
+        "possible-nil-receiver" => RULE_NIL_RECEIVER,
+        "raise-non-exception" => RULE_RAISE_NON_EXCEPTION,
+        "dump-type" => RULE_DUMP_TYPE,
+        "assert-type" => RULE_ASSERT_TYPE,
+        "always-raises" => RULE_ALWAYS_RAISES,
+        "unreachable-branch" => RULE_UNREACHABLE_BRANCH,
+        "method-visibility-mismatch" => RULE_VISIBILITY_MISMATCH,
+        "ivar-write-mismatch" => RULE_IVAR_WRITE_MISMATCH,
+        "dead-assignment" => RULE_DEAD_ASSIGNMENT,
+        "always-truthy-condition" => RULE_ALWAYS_TRUTHY_CONDITION,
+        "unreachable-clause" => RULE_UNREACHABLE_CLAUSE,
+        "duplicate-hash-key" => RULE_DUPLICATE_HASH_KEY,
+        "return-in-ensure" => RULE_RETURN_IN_ENSURE,
+        "shadowed-rescue-clause" => RULE_SHADOWED_RESCUE_CLAUSE
+      }.freeze
+
+      # Family wildcard — a `<family>` token in a suppression comment or `disable:` list disables every rule
+      # whose canonical id starts with `<family>.`. Per ADR-8 § "1".
+      RULE_FAMILIES = %w[call flow assert dump def suppression static].freeze
+
+      # Families of diagnostics the engine emits OUTSIDE the CheckRules catalogue (aggregator-level and
+      # reporter-level diagnostics such as `rbs_extended.unsatisfied-conformance`,
+      # `dynamic.dependency-source.*`, `rbs.coverage.*`, `pre-eval.parse-error`), plus the `plugin.` prefix
+      # reserved for plugin-produced identifiers. `suppression.unknown-rule` treats a dotted token whose
+      # first segment appears here as KNOWN and stays silent: these ids are legitimate suppression /
+      # `severity_overrides:` vocabulary the light rule-id table cannot enumerate (plugins load dynamically;
+      # aggregator ids live in the engine-heavy runner), so under-warning is the FP-safe direction.
+      NON_CHECK_DIAGNOSTIC_FAMILIES = %w[rbs_extended dynamic rbs pre-eval plugin].freeze
+
+      # Bare (dot-less) diagnostic ids the engine emits outside the catalogue (see the `rule:` literals in
+      # `Analysis::Runner` / `Runner::DiagnosticAggregator`). A token equal to one of these is treated as
+      # known by `suppression.unknown-rule` even though it carries no family prefix; extend the list when
+      # the runner grows a new bare id.
+      NON_CHECK_DIAGNOSTIC_IDS = %w[
+        configuration-error load-error pool-degraded runtime-error source-rbs-synthesis-failed
+      ].freeze
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/rule_walk.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "../../source/constant_path"
+require_relative "../../source/node_children"
 
 module Rigor
   module Analysis
@@ -145,7 +146,7 @@ module Rigor
 
             dispatch(node, hooks, context)
             child_context = descend(node, context)
-            node.compact_child_nodes.each { |child| walk(child, hooks, child_context) }
+            node.rigor_each_child { |child| walk(child, hooks, child_context) }
           end
 
           def dispatch(node, hooks, context)

data/lib/rigor/analysis/check_rules/self_closedness_scanner.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "../../source/constant_path"
+require_relative "../../source/node_children"
 
 module Rigor
   module Analysis
@@ -52,7 +53,7 @@ module Rigor
             names << child_prefix.join("::") if name && class_surface_open?(node)
             walk(node.body, child_prefix, names) if node.body
           else
-            node.compact_child_nodes.each { |child| walk(child, prefix, names) }
+            node.rigor_each_child { |child| walk(child, prefix, names) }
           end
         end
 

data/lib/rigor/analysis/check_rules/shadowed_rescue_collector.rb

@@ -0,0 +1,283 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../reflection"
+require_relative "../../source/constant_path"
+require_relative "../../source/node_children"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # `flow.shadowed-rescue-clause` — a `rescue` clause that can never run because an EARLIER clause of the
+      # same `begin` / `def` rescue chain already catches a superclass (or the same class) of every exception
+      # class the later clause names (`rescue StandardError => e … rescue ArgumentError => e` — the
+      # ArgumentError arm is dead; a bare `rescue` counts as `StandardError` on either side). Modeled on the
+      # shadowed-arm half of PHPStan's `CatchWithUnthrownExceptionRule`; the never-thrown half is deliberately
+      # out of scope (unprovable in Ruby).
+      #
+      # The false-positive envelope is ancestry-certainty, not flow analysis — the rule is purely syntactic
+      # plus class-hierarchy lookups, so it fires ONLY when:
+      #
+      # - every exception reference in BOTH the earlier and the later clause is a constant path that resolves
+      #   (against the clause's lexical namespace) to a CLASS with known ancestry — an RBS / registry core
+      #   class, or a project class whose `class Foo < Bar` superclass chain is discovered. Any unresolved
+      #   constant, dynamic expression (`rescue klass_var`), or splat (`rescue *ERRORS`) makes its clause
+      #   opaque: an opaque earlier clause contributes no coverage, an opaque later clause never fires.
+      # - no reference resolves to a MODULE (the `rescue MyGem::Error` module-tag mixin pattern — module
+      #   `===` semantics are custom, so any clause naming one stays out of every comparison). A
+      #   project-discovered constant is certified as a class only via the `class Foo < Bar` superclass
+      #   table; a plain `class Foo` / `module Foo` declaration is indistinguishable in the discovery table
+      #   and stays silent.
+      # - a multi-class arm (`rescue A, B => e`) is shadowed only when EVERY class it names is covered by
+      #   some earlier comparable clause — one diagnostic per clause, naming the covering earlier clause(s).
+      #
+      # A later clause naming a SUPERCLASS of an earlier one is the normal narrow-to-wide rescue order and
+      # never fires. `retry` in an earlier arm does not un-shadow (the re-raise re-enters from the top).
+      # Nested `begin` / `rescue` inside a rescue body compares only clauses of its OWN `BeginNode` — the
+      # walk dispatches per `BeginNode` and never crosses into another chain.
+      class ShadowedRescueCollector
+        # One shadowed clause. `clause` is the dead `Prism::RescueNode`; `clause_source` its rendered
+        # `rescue A, B` condition list (`"rescue"` for a bare rescue); `earlier_sources` /
+        # `earlier_lines` name the earlier clause(s) whose classes cover it.
+        Result = Data.define(:clause, :clause_source, :earlier_sources, :earlier_lines)
+
+        NODE_CLASSES = [Prism::BeginNode].freeze
+
+        # Cycle / depth bound for the project `class Foo < Bar` superclass-chain walk.
+        SUPERCLASS_WALK_LIMIT = 32
+
+        # The implicit class of a bare `rescue` / `rescue => e`.
+        IMPLICIT_RESCUE_CLASS = "StandardError"
+
+        def initialize(scope_index)
+          @scope_index = scope_index
+          @results = []
+        end
+
+        # Legacy single-collector walk — the oracle the shadow harness (`RIGOR_SHADOW_RULE_WALK=1`) compares
+        # the shared {RuleWalk} traversal against. Tracks the lexical class / module prefix itself, exactly
+        # as {RuleWalk} threads `qualified_prefix`.
+        # @return [Array<Result>] one entry per provably-shadowed rescue clause.
+        def collect(root)
+          walk(root, [])
+          @results.freeze
+        end
+
+        # {RuleWalk} entry point. `context.qualified_prefix` carries the enclosing class / module names the
+        # exception constants resolve against.
+        def visit(node, context = nil)
+          prefix = context.respond_to?(:qualified_prefix) ? context.qualified_prefix : []
+          collect_begin(node, prefix)
+        end
+
+        def results
+          @results.freeze
+        end
+
+        private
+
+        def walk(node, prefix)
+          return unless node.is_a?(Prism::Node)
+
+          collect_begin(node, prefix) if node.is_a?(Prism::BeginNode)
+          child_prefix = extend_prefix(node, prefix)
+          node.rigor_each_child { |child| walk(child, child_prefix) }
+        end
+
+        def extend_prefix(node, prefix)
+          return prefix unless node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode)
+
+          name = Source::ConstantPath.qualified_name(node.constant_path)
+          name ? prefix + [name] : prefix
+        end
+
+        def collect_begin(node, prefix)
+          clauses = rescue_chain(node.rescue_clause)
+          return if clauses.size < 2
+
+          scope = scope_for(node)
+          return if scope.nil?
+
+          infos = clauses.map { |clause| clause_info(clause, prefix, scope) }
+          infos.each_with_index do |info, index|
+            next if index.zero? || info.nil?
+
+            check_shadowed(info, infos.first(index), scope)
+          end
+        end
+
+        # The ordered `rescue` clauses of one `begin` node (the `subsequent` chain).
+        def rescue_chain(clause)
+          chain = []
+          while clause
+            chain << clause
+            clause = clause.subsequent
+          end
+          chain
+        end
+
+        # A `Scope` for the environment / discovery lookups. Every scope of the file shares the discovery
+        # index and environment, so any scope recorded on the begin node's neighbourhood serves; nil (no
+        # scope recorded) keeps the whole chain silent.
+        def scope_for(node)
+          @scope_index[node] || @scope_index[node.statements] || @scope_index[node.rescue_clause]
+        end
+
+        # Resolves one clause to `{clause:, names: [String, …]}` where `names` are the certified exception
+        # CLASS names it rescues, or nil when the clause is opaque (any entry unresolved / dynamic / splat /
+        # module — the comparisons involving it stay silent). A bare `rescue` names the implicit
+        # `StandardError`.
+        def clause_info(clause, prefix, scope)
+          exceptions = clause.exceptions
+          if exceptions.empty?
+            return unless certified_class?(IMPLICIT_RESCUE_CLASS, scope)
+
+            return { clause: clause, names: [IMPLICIT_RESCUE_CLASS] }
+          end
+
+          names = exceptions.map { |exc| certified_exception_class(exc, prefix, scope) }
+          return if names.any?(&:nil?)
+
+          { clause: clause, names: names }
+        end
+
+        # The resolved, certified class name for one exception reference, or nil (opaque). Only constant
+        # reads / constant paths participate; the name must resolve lexically and certify as a class with
+        # known ancestry.
+        def certified_exception_class(node, prefix, scope)
+          name = resolve_constant(node, prefix, scope)
+          return nil if name.nil?
+
+          certified_class?(name, scope) ? name : nil
+        end
+
+        # Lexical constant resolution: innermost enclosing namespace first, then outward, then top-level —
+        # first candidate any knowledge source (project discovery or RBS / registry) recognises wins. An
+        # absolute path (`::Foo`) skips the lexical ladder. Returns nil for a non-constant node or a path
+        # with a dynamic base.
+        def resolve_constant(node, prefix, scope)
+          name = Source::ConstantPath.qualified_name_or_nil(node)
+          return nil if name.nil?
+
+          return name if absolute_path?(node)
+
+          candidates = []
+          prefix.size.downto(1) { |i| candidates << (prefix.first(i) + [name]).join("::") }
+          candidates << name
+          candidates.find { |candidate| known_name?(candidate, scope) }
+        end
+
+        def absolute_path?(node)
+          return false unless node.is_a?(Prism::ConstantPathNode)
+
+          parent = node.parent
+          return true if parent.nil? # `::Foo`
+
+          parent.is_a?(Prism::ConstantPathNode) && absolute_path?(parent)
+        end
+
+        # Presence check used to pick the lexical candidate — deliberately broader than certification, so a
+        # name that resolves to a project module is FOUND here and then rejected by {#certified_class?}
+        # (rather than mis-resolving outward to a same-named core class).
+        def known_name?(name, scope)
+          scope.discovered_superclasses.key?(name) ||
+            scope.discovered_classes.key?(name) ||
+            scope.environment.class_known?(name)
+        end
+
+        # A name is a certified exception-comparable class when it is either a project class with a
+        # discovered `class Foo < Bar` superclass entry, or an RBS / registry class that is not a module.
+        # A project-discovered name WITHOUT a superclass entry cannot be told apart from a module (the
+        # discovery table records both), so it stays uncertified — conservative, per the FP discipline.
+        def certified_class?(name, scope)
+          return true if scope.discovered_superclasses.key?(name)
+          return false if scope.discovered_classes.key?(name)
+
+          environment = scope.environment
+          environment.class_known?(name) && !environment.rbs_module?(name)
+        end
+
+        # Fires when EVERY class the later clause names is covered by some earlier comparable clause.
+        def check_shadowed(info, earlier_infos, scope)
+          comparable_earlier = earlier_infos.compact
+          return if comparable_earlier.empty?
+
+          covering = info[:names].map do |name|
+            comparable_earlier.find { |earlier| earlier[:names].any? { |e| covered_by?(name, e, scope) } }
+          end
+          return if covering.any?(&:nil?)
+
+          clauses = covering.uniq
+          @results << Result.new(
+            clause: info[:clause],
+            clause_source: clause_source(info[:clause]),
+            earlier_sources: clauses.map { |c| clause_source(c[:clause]) },
+            earlier_lines: clauses.map { |c| c[:clause].location.start_line }
+          )
+        end
+
+        def clause_source(clause)
+          exceptions = clause.exceptions
+          return "rescue" if exceptions.empty?
+
+          "rescue #{exceptions.map(&:slice).join(', ')}"
+        end
+
+        # Is `later` the same class as, or a subclass of, `earlier`? RBS / registry ancestry answers first;
+        # `:unknown` (a project-defined class on either side) falls through to the discovered
+        # `class Foo < Bar` superclass-chain walk. `:superclass` / `:disjoint` are definitive "no".
+        def covered_by?(later, earlier, scope)
+          return true if later == earlier
+
+          case Reflection.class_ordering(later, earlier, scope: scope)
+          when :equal, :subclass then true
+          when :unknown then project_chain_covered?(later, earlier, scope)
+          else false
+          end
+        end
+
+        # Walks `later`'s discovered superclass chain (each parent recorded AS WRITTEN at its
+        # `class Foo < Bar` site, resolved against the child's namespace) looking for `earlier` — directly,
+        # or through an RBS-known ancestor that orders at-or-below `earlier`. Cycle-guarded and depth-capped;
+        # a chain that leaves both knowledge sources stays silent.
+        def project_chain_covered?(later, earlier, scope)
+          supers = scope.discovered_superclasses
+          current = later
+          seen = {}
+          SUPERCLASS_WALK_LIMIT.times do
+            parent = supers[current.to_s]
+            return false if parent.nil?
+
+            resolved = resolve_parent(current, parent.to_s, scope)
+            return false if seen[resolved]
+
+            seen[resolved] = true
+            return true if resolved == earlier
+
+            case Reflection.class_ordering(resolved, earlier, scope: scope)
+            when :equal, :subclass then return true
+            when :unknown then current = resolved
+            else return false
+            end
+          end
+          false
+        end
+
+        # Resolves a superclass name as written (`Error`) against the child's namespace (`Mail::POP3` →
+        # `Mail::Error`), longest prefix first; falls back to the as-written name (which RBS may know, e.g.
+        # `StandardError`).
+        def resolve_parent(child, parent, scope)
+          segments = child.to_s.split("::")[0...-1]
+          until segments.empty?
+            candidate = "#{segments.join('::')}::#{parent}"
+            return candidate if known_name?(candidate, scope)
+
+            segments.pop
+          end
+          parent
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/unreachable_clause_collector.rb

@@ -2,6 +2,9 @@
 
 require "prism"
 
+require_relative "../../source/node_children"
+require_relative "inferred_param_guard"
+
 module Rigor
   module Analysis
     module CheckRules
@@ -85,7 +88,7 @@ module Rigor
           visit(node) if case_like?(node) && !in_loop_or_block
 
           child_in_loop_or_block = in_loop_or_block || enters_loop_or_block?(node)
-          node.compact_child_nodes.each { |child| walk(child, in_loop_or_block: child_in_loop_or_block) }
+          node.rigor_each_child { |child| walk(child, in_loop_or_block: child_in_loop_or_block) }
         end
 
         # `case/when` is a `CaseNode`; `case/in` is a `CaseMatchNode`. Both carry `predicate` + `conditions`
@@ -102,6 +105,12 @@ module Rigor
           subject = node.predicate
           return unless subject.is_a?(Prism::LocalVariableReadNode)
 
+          # ADR-67 WD6b — a `case` subject that is an inferred parameter narrows to `Bot` in the non-matching
+          # clauses only because its seeded type is a lower bound; a wider real caller could match them. Decline
+          # the whole case so no clause fires unreachable.
+          scope = @scope_index[node]
+          return if scope && InferredParamGuard.rooted?(subject, scope)
+
           entry_type = entry_subject_type(node, subject.name)
           # Only meaningful for a concrete subject type: a `Dynamic` subject can never be proven disjoint
           # (the gradual guarantee), and an already-`Bot` subject is dead code, not a clause-ordering error.