rigortype 0.2.9 → 0.3.1

data/lib/rigor/reflection.rb

@@ -93,6 +93,11 @@ module Rigor
     # Returns the type of the named constant. Joins in-source constants (recorded by
     # `ScopeIndexer`) and RBS-side constants. In-source wins on collision because the user's
     # source is the authoritative declaration.
+    #
+    # This is the flat lookup keyed on the literal `constant_name`. Callers that need Ruby's
+    # lexical constant resolution (walking the enclosing class path, and folding in registry
+    # classes / source-discovered classes as `Singleton` / class types) use
+    # {.resolve_constant_type} instead.
     def constant_type_for(constant_name, scope: Scope.empty)
       key = constant_name.to_s
       in_source = scope.in_source_constants[key]
@@ -101,6 +106,65 @@ module Rigor
       scope.environment.constant_for_name(constant_name)
     end
 
+    # Resolves a constant *reference* to its type through Ruby's lexical constant lookup: the
+    # most-qualified candidate first (the enclosing class path joined to `name`), then
+    # progressively less-qualified, then the bare `name`. Each candidate consults, in order,
+    # the class registry (yielding a `Singleton[C]`), source-discovered classes, in-source
+    # value constants, and finally RBS-side constants — in-source value constants winning over
+    # RBS because the user's source is authoritative for its own constants. Returns the matched
+    # `Rigor::Type`, or nil when no source knows the constant.
+    #
+    # This is the shared owner of the lexical-constant resolution: `Inference::ExpressionTyper`
+    # reads it to type a constant read, and `Inference::Narrowing` reads it to recognise a
+    # value-pinned `Constant[Regexp]` match-predicate operand.
+    def resolve_constant_type(name, scope: Scope.empty)
+      env = scope.environment
+      discovered = scope.discovered_classes
+      in_source = scope.in_source_constants
+      lexical_constant_candidates(name, scope: scope).each do |candidate|
+        singleton = env.singleton_for_name(candidate)
+        return singleton if singleton
+
+        in_source_class = discovered[candidate]
+        return in_source_class if in_source_class
+
+        # In-source value-bearing constants take precedence over RBS constant decls because
+        # user code is the authoritative source for its own constants.
+        in_source_value = in_source[candidate]
+        return in_source_value if in_source_value
+
+        value = env.constant_for_name(candidate)
+        return value if value
+      end
+      nil
+    end
+
+    # The candidate qualified names to try, in Ruby's lexical order: most-qualified first (the
+    # enclosing class path joined to `name`), then progressively less-qualified, then the bare
+    # `name`. A top-level scope (no `self_type`) yields only `[name]`.
+    def lexical_constant_candidates(name, scope: Scope.empty)
+      prefix = enclosing_class_path(scope)
+      candidates = []
+      while prefix && !prefix.empty?
+        candidates << "#{prefix}::#{name}"
+        idx = prefix.rindex("::")
+        prefix = idx ? prefix[0, idx] : nil
+      end
+      candidates << name
+      candidates
+    end
+    private_class_method :lexical_constant_candidates
+
+    # Pulls the enclosing qualified class name out of `scope.self_type` when one is set.
+    # `Nominal[T]` and `Singleton[T]` both expose `class_name`. Returns nil at the top level.
+    def enclosing_class_path(scope)
+      st = scope.self_type
+      case st
+      when Type::Nominal, Type::Singleton then st.class_name
+      end
+    end
+    private_class_method :enclosing_class_path
+
     # Returns the RBS `RBS::Definition::Method` for the instance method, or nil when the
     # class or method is not in RBS. The source-side discovered-method facts are reachable
     # through {.discovered_method?}; a future slice will unify the two under a

data/lib/rigor/runtime/jit.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+module Rigor
+  # Process-level runtime concerns that sit beside the analyzer rather than
+  # inside it. Currently just deferred YJIT enablement.
+  module Runtime
+    # Deferred YJIT enablement for the long-running analysis commands.
+    #
+    # Ruby 3.3+ ships YJIT but leaves it off unless the process opts in
+    # (`--yjit`, `RUBY_YJIT_ENABLE=1`, or `RubyVM::YJIT.enable`). Enabling it
+    # unconditionally at boot is a net LOSS on short `rigor check` / `coverage`
+    # runs: the JIT compile cost is paid up front, but a run that finishes in a
+    # couple of seconds ends before it amortizes. Measured cold A/B (2026-07-13,
+    # Ruby 4.0.5): mastodon `app/models` 4.0s -> 5.0s (0.80x), kramdown `lib`
+    # 1.7s -> 2.55s (0.66x), dependabot 1.6s -> 2.34s (0.68x). Long runs win big
+    # in the same measurement: mastodon `app`+`lib` 25.2s -> 14.9s (1.69x),
+    # redmine `app/models` 8.6s -> 5.5s (1.56x). Allocations and diagnostics are
+    # byte-identical under YJIT — the tradeoff is purely wall-time.
+    #
+    # The resolution is to enable YJIT only once a run has proven long enough to
+    # amortize the compile cost. {enable_after} spawns one daemon thread that
+    # sleeps the deadline then enables: a run that finishes before the deadline
+    # never pays JIT compile (the sub-deadline penalty zone is avoided by
+    # construction), while a long run enables mid-flight and JITs the remaining
+    # — dominant — work. Long-lived servers (`rigor lsp` / `rigor mcp`) instead
+    # enable at boot via {enable_now}, since they always run long.
+    #
+    # Opt-out: `RIGOR_DISABLE_YJIT=1` makes every entry point a no-op (the pin
+    # the byte-identical-diagnostics gate uses). If YJIT is already enabled (the
+    # user passed `--yjit` / `RUBY_YJIT_ENABLE=1`) or is unavailable (a build
+    # without YJIT, or a non-MRI Ruby), both entry points are no-ops too.
+    module Jit
+      # Opt-out switch: `RIGOR_DISABLE_YJIT=1` disables both entry points.
+      DISABLE_ENV = "RIGOR_DISABLE_YJIT"
+
+      # Advanced / calibration override of the {enable_after} deadline, in
+      # float seconds. Unset (or unparseable / negative) falls back to
+      # {DEFAULT_DEADLINE_SECONDS}. Exposed so the deadline can be swept during
+      # calibration and tuned per-project without an engine change.
+      DEADLINE_ENV = "RIGOR_YJIT_DEADLINE"
+
+      # The amortization deadline for {enable_after}, in seconds.
+      #
+      # Calibrated by interleaved cold A/B measurement on 2026-07-13 (Ruby
+      # 4.0.5, arm64-darwin25). Enabling YJIT mid-run costs a ~1s compile burst,
+      # so a run whose length is only ~0-1s longer than the deadline pays the
+      # burst without time to amortize and LOSES (measured: `app/models` at a
+      # 3.0s deadline regressed 4.14s -> 4.68s). The short-run cases cluster at
+      # <=1.7s (kramdown / dependabot) and ~4.0-4.9s (mastodon `app/models` ~4.1s,
+      # mail ~4.9s), with the next case at redmine ~7s. 5.0s parks that danger
+      # zone in the empty 5-6s gap: every case <=4.9s finishes before the
+      # deadline fires (guaranteed no-YJIT parity — the sleeping thread is killed
+      # at exit), while runs long enough to pay off (>=~15s: gitlab, mastodon
+      # `app`+`lib`) enable mid-flight and JIT their dominant tail — the mastodon
+      # `app`+`lib` win is preserved ~100% (25.4s -> 15.1s, vs 15.1s always-on).
+      DEFAULT_DEADLINE_SECONDS = 5.0
+
+      module_function
+
+      # Enables YJIT now, unless opted out, already enabled, or unavailable.
+      #
+      # An imperative command, not a query — the boolean reports whether this
+      # call is what enabled YJIT (so the `?`-suffix predicate convention does
+      # not apply; hence the Naming/PredicateMethod exemption).
+      #
+      # @return [Boolean] true if this call enabled YJIT; false if it was a
+      #   no-op (unavailable / opted out / already enabled).
+      def enable_now # rubocop:disable Naming/PredicateMethod
+        return false unless available?
+        return false if disabled?
+        return false if RubyVM::YJIT.enabled?
+
+        RubyVM::YJIT.enable
+        true
+      end
+
+      # Spawns one background thread that sleeps `seconds` then calls
+      # {enable_now}. The thread is a daemon in effect — Ruby kills all live
+      # threads when the main thread exits — so a run that finishes before the
+      # deadline simply never enables YJIT, which is the point.
+      #
+      # Returns nil (and spawns no thread) when the feature is already a no-op
+      # up front (unavailable / opted out / already enabled), so callers never
+      # pay for a thread that could only no-op.
+      #
+      # @param seconds [Numeric] the amortization deadline.
+      # @return [Thread, nil] the deadline thread, or nil when no-op up front.
+      def enable_after(seconds)
+        return nil unless available?
+        return nil if disabled?
+        return nil if RubyVM::YJIT.enabled?
+
+        thread = Thread.new do
+          sleep(seconds)
+          enable_now
+        end
+        # A background perf optimization must never spill a backtrace onto the
+        # run's stderr; on any unexpected failure, stay silent and leave YJIT
+        # off. The deadline sleep gives ample time to set this before the body
+        # could raise.
+        thread.report_on_exception = false
+        thread
+      end
+
+      # The resolved {enable_after} deadline: {DEADLINE_ENV} when it parses to a
+      # non-negative float, else {DEFAULT_DEADLINE_SECONDS}.
+      #
+      # @return [Numeric]
+      def deadline_seconds
+        raw = ENV.fetch(DEADLINE_ENV, nil)
+        return DEFAULT_DEADLINE_SECONDS if raw.nil? || raw.empty?
+
+        value = Float(raw, exception: false)
+        value && value >= 0 ? value : DEFAULT_DEADLINE_SECONDS
+      end
+
+      # @return [Boolean] whether this Ruby exposes `RubyVM::YJIT.enable`.
+      def available?
+        defined?(RubyVM::YJIT.enable) ? true : false
+      end
+
+      # @return [Boolean] whether the opt-out env switch is set.
+      def disabled?
+        ENV[DISABLE_ENV] == "1"
+      end
+    end
+  end
+end

data/lib/rigor/scope/discovery_index.rb

@@ -21,13 +21,15 @@ module Rigor
       :discovered_def_nodes,
       :discovered_singleton_def_nodes,
       :discovered_def_sources,
+      :discovered_singleton_def_sources,
       :discovered_method_visibilities,
       :discovered_superclasses,
       :discovered_includes,
       :discovered_class_sources,
       :data_member_layouts,
       :struct_member_layouts,
-      :param_inferred_types
+      :param_inferred_types,
+      :run_generation
     )
 
     class DiscoveryIndex
@@ -48,6 +50,7 @@ module Rigor
         discovered_def_nodes: EMPTY_TABLE,
         discovered_singleton_def_nodes: EMPTY_TABLE,
         discovered_def_sources: EMPTY_TABLE,
+        discovered_singleton_def_sources: EMPTY_TABLE,
         discovered_method_visibilities: EMPTY_TABLE,
         discovered_superclasses: EMPTY_TABLE,
         discovered_includes: EMPTY_TABLE,
@@ -60,7 +63,14 @@ module Rigor
         # `{param_name(Symbol) => Rigor::Type}` map of the union of resolved call-site argument types. Empty on
         # every normal run; only the `coverage --protection` collection pass populates it today, so a `check` run
         # leaves it empty and seeds nothing (byte-identical).
-        param_inferred_types: EMPTY_TABLE
+        param_inferred_types: EMPTY_TABLE,
+        # ADR-84 WD2 — the run-scope identity token `Analysis::Runner#run_analysis` mints per run (a frozen
+        # bare Object) and seeds through `project_scope_seed_tables`. The user-method return memo keys its
+        # bucket on this token's identity so hits cross consumer-file boundaries within one run but never
+        # cross a run boundary (LSP / ADR-62 warm-loop re-runs land in a fresh bucket). Nil on scopes that
+        # never see the runner seed (single-file probes, `run_source` before the seed applies): the memo
+        # falls back to today's per-file `discovered_def_nodes` identity for those.
+        run_generation: nil
       )
     end
   end

data/lib/rigor/scope.rb

@@ -8,6 +8,7 @@ require_relative "analysis/dependency_recorder"
 require_relative "inference/expression_typer"
 require_relative "inference/flow_tracer"
 require_relative "inference/statement_evaluator"
+require_relative "inference/def_node_resolver"
 
 module Rigor
   # Immutable analyzer scope: holds local-variable bindings and a reference to the surrounding Environment. State
@@ -22,7 +23,8 @@ module Rigor
                 :indexed_narrowings, :method_chain_narrowings,
                 :declaration_sourced,
                 :source_path, :discovery, :struct_fold_safe_locals,
-                :dynamic_origins, :local_origins, :ivar_origins
+                :dynamic_origins, :local_origins, :ivar_origins,
+                :void_origins
 
     # ADR-53 Track A — the seed-time discovery tables live on the {DiscoveryIndex} the scope carries by a single
     # reference; the per-table readers stay on Scope so engine call sites and plugins are unaffected by the
@@ -41,6 +43,7 @@ module Rigor
     def discovered_def_nodes = @discovery.discovered_def_nodes
     def discovered_singleton_def_nodes = @discovery.discovered_singleton_def_nodes
     def discovered_def_sources = @discovery.discovered_def_sources
+    def discovered_singleton_def_sources = @discovery.discovered_singleton_def_sources
     def discovered_method_visibilities = @discovery.discovered_method_visibilities
     def discovered_superclasses = @discovery.discovered_superclasses
     def discovered_includes = @discovery.discovered_includes
@@ -52,6 +55,9 @@ module Rigor
     # call-site argument types (precision-additive; an RBS-declared parameter always wins). Empty unless a
     # collection pass seeded it.
     def param_inferred_types = @discovery.param_inferred_types
+    # ADR-84 WD2 — the per-run identity token the user-method return memo buckets on (nil outside runner-seeded
+    # scopes; the memo then falls back to the per-file `discovered_def_nodes` identity).
+    def run_generation = @discovery.run_generation
 
     # Narrowing key for an indexed read `receiver[key]` where both the receiver and the key are stable enough to
     # address. The value of the map at this key is the narrowed type the next read at the same address MUST
@@ -117,6 +123,16 @@ module Rigor
       self
     end
 
+    # ADR-100 WD3 — records that the value introduced at `node` (a call node) is a `top` recovered from an
+    # author-declared `-> void` return, keyed by the origin site (`origin`, an {Inference::VoidOrigin}). The
+    # value-context check rule `static.value-use.void` consumes this table. Mirrors {#record_dynamic_origin}
+    # exactly: identity-keyed advisory metadata, mutated in place on the shared table (threaded by reference
+    # through `#join` / `#rebuild`), excluded from `==` / `hash`, so it never forks a flow-dedup or cache key.
+    def record_void_origin(node, origin)
+      @void_origins[node] = origin
+      self
+    end
+
     def initialize(
       environment:, locals:,
       fact_store: Analysis::FactStore.empty,
@@ -132,7 +148,8 @@ module Rigor
       struct_fold_safe_locals: EMPTY_FOLD_SAFE,
       dynamic_origins: {}.compare_by_identity,
       local_origins: EMPTY_ORIGINS,
-      ivar_origins: EMPTY_ORIGINS
+      ivar_origins: EMPTY_ORIGINS,
+      void_origins: {}.compare_by_identity
     )
       @environment = environment
       @locals = locals
@@ -150,6 +167,7 @@ module Rigor
       @dynamic_origins = dynamic_origins
       @local_origins = local_origins
       @ivar_origins = ivar_origins
+      @void_origins = void_origins
       freeze
     end
 
@@ -294,6 +312,39 @@ module Rigor
       @declaration_sourced.include?([kind.to_sym, name.to_sym])
     end
 
+    # ADR-67 WD6b — stamp the "inferred, not declared" provenance mark on a parameter local seeded from the
+    # call-site parameter-inference table ({Inference::ParameterInferenceCollector}). Rides the ADR-58 WD1
+    # declaration-sourced side-mark machinery under a distinct `:inferred_param` kind (never a carrier field,
+    # so the displayed type is unchanged) so the negative in-body rules can decline on a receiver / argument
+    # whose type is an open-call-site *lower bound* — firing against a lower bound is a false positive by
+    # construction (the ADR-67 WD1 reasoning at the parameter boundary, carried one hop into the body). The
+    # distinct kind keeps the inferred-param sites separable from ADR-58's ivar-copy `:local` mark, which a
+    # later un-guarding slice (WD6b) needs. `with_local` drops it on any flow-live rewrite of the local
+    # (`drop_local_declaration_marks`), so only the pristine parameter binding carries it.
+    def with_inferred_param_mark(name)
+      rebuild(declaration_sourced: add_declaration_sourced(:inferred_param, name))
+    end
+
+    # ADR-67 WD6b — explicitly clear the inferred-parameter taint on `name`. The mark is deliberately STICKY:
+    # `with_local` (used by both narrowing and reassignment) does NOT drop it, so it survives the narrowing /
+    # join transitions between a lower-bound value's definition and its use (`v = param[i]-1; if 0<=v and v<n`
+    # — the `and` narrows `v` between the two comparisons). It is cleared only at a genuine source-level local
+    # write whose RHS does not derive from an inferred parameter ({StatementEvaluator#eval_local_write}), so a
+    # local rebound to an independent value stops being treated as a lower bound. Over-retention (a mark that
+    # outlives a rebind the write-path did not catch) only ever suppresses a diagnostic — the FP-safe
+    # direction — so stickiness is the conservative choice. Zero-alloc when no mark is present.
+    def without_inferred_param_mark(name)
+      dropped = drop_declaration_sourced_for(:inferred_param, name)
+      dropped.equal?(@declaration_sourced) ? self : rebuild(declaration_sourced: dropped)
+    end
+
+    # ADR-67 WD6b — true when `name`'s local binding is a pristine inferred parameter (the call-site union
+    # seeded at method entry, untouched by a flow-live write). The guard predicate the negative in-body rules
+    # consult.
+    def inferred_param?(name)
+      @declaration_sourced.include?([:inferred_param, name.to_sym])
+    end
+
     def with_cvar(name, type)
       rebuild(cvars: @cvars.merge(name.to_sym => type).freeze)
     end
@@ -366,9 +417,12 @@ module Rigor
     # inter-procedural return-type inference when the receiver class is user-defined and has no RBS sig.
     def user_def_for(class_name, method_name)
       table = @discovery.discovered_def_nodes[class_name.to_s]
-      node = table && table[method_name.to_sym]
-      record_cross_file_method(class_name, method_name, node) if Analysis::DependencyRecorder.active?
-      node
+      # ADR-85 WD3 — the value is either a live `Prism::DefNode` (cold / re-walked file) or a `DefHandle`
+      # (unchanged file, bundle-rebuilt index). Dependency recording keys on the table's PRESENCE (both are
+      # truthy), so it is sound regardless of resolution; only the returned node is resolved lazily.
+      entry = table && table[method_name.to_sym]
+      record_cross_file_method(class_name, method_name, entry) if Analysis::DependencyRecorder.active?
+      Inference::DefNodeResolver.resolve(entry)
     end
 
     # Module-singleton call resolution (ADR-57 follow-up) — companion of {#user_def_for} for SINGLETON-side defs
@@ -379,25 +433,28 @@ module Rigor
     # the same cross-file dependency edge as the instance path (ADR-46).
     def singleton_def_for(class_name, method_name)
       table = @discovery.discovered_singleton_def_nodes[class_name.to_s]
-      node = table && table[method_name.to_sym]
-      record_cross_file_method(class_name, method_name, node) if Analysis::DependencyRecorder.active?
-      node
+      entry = table && table[method_name.to_sym] # live node or DefHandle (ADR-85 WD3)
+      record_cross_file_method(class_name, method_name, entry, singleton: true) if Analysis::DependencyRecorder.active?
+      Inference::DefNodeResolver.resolve(entry)
     end
 
     # ADR-46 slice 1 — note the cross-file dependency this resolution creates: the file defining
     # `class_name#method_name` (the consumer's analysis reads its body via `infer_user_method_return`), or, when
     # unresolved, a negative edge so a later definition re-checks the consumer. Gated on the recorder being
-    # active — no-op on a normal run.
-    def record_cross_file_method(class_name, method_name, node)
+    # active — no-op on a normal run. `singleton:` selects the singleton-side source table + a `"Class.method"`
+    # symbol key (vs the instance `"Class#method"`), so a class/singleton-method body edit produces a changed
+    # symbol pair and scopes to the method's call sites the same way an instance-method edit does — the source
+    # site is read from `discovered_singleton_def_sources`, the mirror the ScopeIndexer now records (ADR-46
+    # slice 4 singleton extension). Both keys share the format `Runner#symbol_fingerprints` emits.
+    def record_cross_file_method(class_name, method_name, node, singleton: false)
+      symbol = "#{class_name}#{singleton ? '.' : '#'}#{method_name}"
       if node
         # ADR-46 slice 4 — pass the symbol so the recorder tracks this as a method-call (symbol-granularity) edge
         # rather than a file-level edge.
-        Analysis::DependencyRecorder.read_site(
-          @discovery.discovered_def_sources.dig(class_name.to_s, method_name.to_sym),
-          "#{class_name}##{method_name}"
-        )
+        source_table = singleton ? @discovery.discovered_singleton_def_sources : @discovery.discovered_def_sources
+        Analysis::DependencyRecorder.read_site(source_table.dig(class_name.to_s, method_name.to_sym), symbol)
       else
-        Analysis::DependencyRecorder.read_missing(:method, "#{class_name}##{method_name}")
+        Analysis::DependencyRecorder.read_missing(:method, symbol)
       end
     end
     private :record_cross_file_method
@@ -408,9 +465,9 @@ module Rigor
     # implementation detail and go through this accessor.
     def top_level_def_for(method_name)
       table = @discovery.discovered_def_nodes[Inference::ScopeIndexer::TOP_LEVEL_DEF_KEY]
-      node = table && table[method_name.to_sym]
-      record_cross_file_toplevel(method_name, node) if Analysis::DependencyRecorder.active?
-      node
+      entry = table && table[method_name.to_sym] # live node or DefHandle (ADR-85 WD3)
+      record_cross_file_toplevel(method_name, entry) if Analysis::DependencyRecorder.active?
+      Inference::DefNodeResolver.resolve(entry)
     end
 
     # ADR-46 slice 3 — a top-level (`def helper` outside any class) call has NO class ancestry to walk, so unlike
@@ -440,9 +497,16 @@ module Rigor
     # can point at `pre_eval:` (ADR-17) instead of reading as a bare unresolved call.
     def user_def_site_for(class_name, method_name)
       table = @discovery.discovered_def_sources[class_name.to_s]
-      return nil unless table
-
-      table[method_name.to_sym]
+      site = table && table[method_name.to_sym]
+      # ADR-88 WD3 — record the SAME instance-side cross-file method edge {#user_def_for} records at :378, so a
+      # move / body-edit of `class_name#method_name`'s definition re-checks the consumer that named the
+      # defining file. `CheckRules#undefined_method_diagnostic` reads this to set `project_definition_site`
+      # (`"path:line"`) on a `call.undefined-method` for a project monkey-patch; without the edge, a line-shift
+      # in the defining file left the cached diagnostic pointing at a stale line (the ADR-46 symbol-granularity
+      # closure never re-checked the caller). Recording keys on the source-entry PRESENCE (truthy `site`),
+      # sound whether or not the caller also went through {#user_def_for}.
+      record_cross_file_method(class_name, method_name, site) if Analysis::DependencyRecorder.active?
+      site
     end
 
     # ADR-24 slice 2 — per-class table mapping a fully qualified user-class name to its superclass name AS WRITTEN
@@ -592,6 +656,14 @@ module Rigor
       Inference::ExpressionTyper.new(scope: self, tracer: tracer).type_of(node)
     end
 
+    # ADR-89 WD2 — the inferred return type of `def_node` called with `receiver` / `arg_types`, computed
+    # against THIS scope's discovery index (so cross-file dispatches in the body resolve). The incremental
+    # session re-drives a declaration-stable changed callee at each previously-observed call key to prove its
+    # return is unchanged before skipping its symbol dependents.
+    def user_method_return(def_node, receiver, arg_types)
+      Inference::ExpressionTyper.new(scope: self).return_type_for(def_node, receiver, arg_types)
+    end
+
     # Statement-level evaluation: returns the pair `[type, scope']` where `type` is what the node produces and
     # `scope'` is the scope observable after the node has run. The receiver scope is never mutated. See
     # {Rigor::Inference::StatementEvaluator} for the catalogue of nodes that thread scope; everything else defers
@@ -651,7 +723,8 @@ module Rigor
       struct_fold_safe_locals: @struct_fold_safe_locals,
       dynamic_origins: @dynamic_origins,
       local_origins: @local_origins,
-      ivar_origins: @ivar_origins
+      ivar_origins: @ivar_origins,
+      void_origins: @void_origins
     )
       self.class.new(
         environment: environment, locals: locals,
@@ -665,7 +738,8 @@ module Rigor
         struct_fold_safe_locals: struct_fold_safe_locals,
         dynamic_origins: dynamic_origins,
         local_origins: local_origins,
-        ivar_origins: ivar_origins
+        ivar_origins: ivar_origins,
+        void_origins: void_origins
       )
     end
 
@@ -702,7 +776,8 @@ module Rigor
         source_path: source_path,
         dynamic_origins: @dynamic_origins,
         local_origins: join_origins(@local_origins, other.local_origins),
-        ivar_origins: join_origins(@ivar_origins, other.ivar_origins)
+        ivar_origins: join_origins(@ivar_origins, other.ivar_origins),
+        void_origins: @void_origins
       )
     end
 
@@ -724,11 +799,30 @@ module Rigor
       origins.key?(key) ? origins.reject { |k, _| k == key }.freeze : origins
     end
 
+    # Two kinds of mark share this Set with opposite join semantics:
+    #
+    # - ADR-58 WD1 declaration-sourced optionality (`:ivar` / `:local`) joins by **intersection** — a nil is
+    #   assumed a cross-method invariant only when BOTH branches agree its optionality is declaration-sourced.
+    # - ADR-67 WD6b inferred-parameter taint (`:inferred_param`) joins by **union** — a local is a lower-bound
+    #   value on the branch where it derives from an inferred parameter, so if EITHER branch taints it, a
+    #   downstream use could observe the lower-bound value and firing on it is an FP (`x = param else x = 5;
+    #   x.foo`). Intersecting would lose the taint at the merge and re-surface the false positive.
     def join_declaration_sourced(other)
-      return @declaration_sourced if @declaration_sourced.equal?(other.declaration_sourced)
-      return EMPTY_DECLARATION_SOURCED if @declaration_sourced.empty? || other.declaration_sourced.empty?
-
-      (@declaration_sourced & other.declaration_sourced).freeze
+      mine = @declaration_sourced
+      theirs = other.declaration_sourced
+      return mine if mine.equal?(theirs)
+
+      inferred = Set.new
+      mine.each { |ref| inferred << ref if ref[0] == :inferred_param }
+      theirs.each { |ref| inferred << ref if ref[0] == :inferred_param }
+      intersected =
+        if mine.empty? || theirs.empty?
+          EMPTY_DECLARATION_SOURCED
+        else
+          mine.select { |ref| ref[0] != :inferred_param && theirs.include?(ref) }
+        end
+      merged = inferred.merge(intersected)
+      merged.empty? ? EMPTY_DECLARATION_SOURCED : merged.freeze
     end
 
     def indexed_key(receiver_kind, receiver_name, key)

data/lib/rigor/sig_gen/classification.rb

@@ -25,7 +25,11 @@ module Rigor
       SKIP_DIAGNOSTIC_IDS = {
         complex_shape: "sig.skipped.complex-shape",
         user_authored: "sig.skipped.user-authored",
-        untyped_return: "sig.skipped.untyped-return"
+        untyped_return: "sig.skipped.untyped-return",
+        # The generator rendered a line `rbs` itself rejects. Skipping the method keeps sig-gen useful on a
+        # project with one pathological def, where failing the command outright would deny the user every other
+        # signature; the count is reported so the defect is not silent. See {SigGen::RbsValidity}.
+        unrenderable_rbs: "sig.skipped.unrenderable-rbs"
       }.freeze
     end
   end

data/lib/rigor/sig_gen/generator.rb

@@ -8,9 +8,11 @@ require_relative "../scope"
 require_relative "../reflection"
 require_relative "../type"
 require_relative "../source/literals"
+require_relative "../source/node_children"
 require_relative "../inference/def_return_typer"
 require_relative "../inference/scope_indexer"
 require_relative "../inference/rbs_type_translator"
+require_relative "rbs_validity"
 
 module Rigor
   module SigGen
@@ -33,6 +35,13 @@ module Rigor
     #   strictly accepts the inferred one (acceptance check under the engine's current `:gradual` mode; ADR-14
     #   reserves the eventual `:strict` mode).
     class Generator # rubocop:disable Metrics/ClassLength
+      # Methods the generator rendered into RBS that `rbs` itself rejects. Populated by {#build_candidate}; each
+      # one is a Rigor rendering DEFECT, not a property of the user's code, so the CLI reports them as such.
+      UnrenderableMethod = Data.define(:path, :class_name, :method_name, :rbs, :error)
+
+      # @return [Array<UnrenderableMethod>] empty on a healthy run; read after {#run}.
+      attr_reader :unrenderable
+
       # @param configuration [Rigor::Configuration]
       # @param paths [Array<String>] files / directories to scan.
       # @param observations [Hash{[String, Symbol] => Array<Array<Rigor::Type>>}]
@@ -52,6 +61,8 @@ module Rigor
         @module_function_methods = Set.new
         @class_shells = Set.new
         @class_superclasses = {}
+        # Whole-run, NOT per-file: a rendering defect is reported once at the end of the run.
+        @unrenderable = []
       end
 
       # Lifts legacy plain-`Array[Type]` observation entries into {ObservedCall} carriers. Specs from the
@@ -159,7 +170,7 @@ module Rigor
           return
         end
 
-        node.compact_child_nodes.each do |child|
+        node.rigor_each_child do |child|
           walk_defs(child, prefix, in_singleton_class, module_function_active, out)
         end
       end
@@ -264,12 +275,33 @@ module Rigor
       # Wraps `MethodCandidate.new` so every candidate carries the per-file `@namespace_kinds` map AND the
       # `@class_shells` set — the Writer's nested-syntax emission consults both to pick `module` vs `class` for
       # each segment and to emit empty `Const = Data.define(...)` declarations.
-      def build_candidate(**)
+      #
+      # It is also where every rendered line is PARSED before it can leave the generator (see
+      # {SigGen::RbsValidity}). This is the one construction point all candidates pass through, so guarding it
+      # covers every mode — `--print`, `--diff`, `--write`, and the MCP surface — rather than each emit site
+      # separately. A line `rbs` rejects demotes the candidate to `:skipped` instead of being emitted: a
+      # signature we cannot parse is worse than no signature, because it takes the whole FILE down with it
+      # (the consumer quarantines it, so every other type in that file vanishes too).
+      def build_candidate(**fields)
+        fields = demote_unrenderable(fields)
         MethodCandidate.new(
           namespace_kinds: @namespace_kinds,
           class_shells: @class_shells.to_a,
           class_superclasses: @class_superclasses,
-          **
+          **fields
+        )
+      end
+
+      def demote_unrenderable(fields)
+        error = RbsValidity.method_line_error(fields[:rbs])
+        return fields if error.nil?
+
+        @unrenderable << UnrenderableMethod.new(
+          path: fields[:path], class_name: fields[:class_name],
+          method_name: fields[:method_name], rbs: fields[:rbs], error: error
+        )
+        fields.merge(
+          classification: Classification::SKIPPED, skip_reason: :unrenderable_rbs, rbs: nil
         )
       end
 
@@ -796,7 +828,7 @@ module Rigor
           collect_attr_call(node, prefix, in_singleton_class, ctx)
         end
 
-        node.compact_child_nodes.each { |child| walk_attr_calls(child, prefix, in_singleton_class, ctx) }
+        node.rigor_each_child { |child| walk_attr_calls(child, prefix, in_singleton_class, ctx) }
       end
 
       def collect_attr_call(call_node, prefix, in_singleton_class, ctx)
@@ -872,7 +904,7 @@ module Rigor
           return
         end
 
-        node.compact_child_nodes.each { |c| collect_init_ivar_obs(c, prefix, result) }
+        node.rigor_each_child { |c| collect_init_ivar_obs(c, prefix, result) }
       end
 
       # Derive { attr_name_sym => Type } for a single `def initialize` by matching `@ivar = param_name`
@@ -950,7 +982,7 @@ module Rigor
                   node.is_a?(Prism::ClassNode) ||
                   node.is_a?(Prism::ModuleNode)
 
-        node.compact_child_nodes.each { |c| scan_ivar_param_assignments(c, param_names, result) }
+        node.rigor_each_child { |c| scan_ivar_param_assignments(c, param_names, result) }
       end
 
       def build_attr_candidates(call_name, class_name, attr_name, ivar_type, ctx)