rigortype 0.3.0 → 0.3.2

data/docs/manual/06-baseline.md

@@ -4,7 +4,11 @@ A **baseline** records the diagnostics a project already has,
 so `rigor check` can stay silent about them and surface only
 what is *new*. It is the pragmatic on-ramp for adopting Rigor
 on an existing codebase: you do not have to reach zero
-diagnostics before the check becomes useful in CI.
+diagnostics before the check becomes useful in CI. It is also
+what the [`rigor-project-init` skill](08-skills.md) snapshots
+for you at onboarding
+([ADR-22](../adr/22-baseline-and-project-onboarding.md) is the
+design).
 
 ## The baseline file
 
@@ -89,6 +93,36 @@ unless you specifically need per-message discrimination, and
 expect to `regenerate` a `message`-mode baseline after upgrading
 Rigor.
 
+## The ad-hoc form — `rigor diff`
+
+A managed baseline is not the only way to fail CI on *new*
+diagnostics only. The lightweight alternative keeps a plain JSON
+snapshot in the repository and compares against it explicitly:
+
+```sh
+# Once: capture the current diagnostic surface.
+rigor check --format=json > rigor.baseline.json
+git add rigor.baseline.json
+
+# Per PR: compare against the committed snapshot.
+rigor diff rigor.baseline.json
+```
+
+[`rigor diff`](02-cli-reference.md#rigor-diff) prints a `+ NEW`
+row for every diagnostic absent from the snapshot and a
+`- FIXED` row for every one resolved since, and exits `1` when
+anything is new — so a PR that adds a violation fails while the
+recorded legacy ones stay quiet. `--format=json` is available
+for editor and dashboard integrations. Regenerate the snapshot
+with the same `rigor check --format=json` redirection whenever
+you fix a row, and the project tightens monotonically.
+
+The difference from a managed baseline is where the knowledge
+lives: `rigor diff` is a separate step your CI script has to
+run, while a `baseline:` file makes `rigor check` itself exit
+clean on recorded diagnostics. Prefer the managed form unless
+you specifically want the raw JSON snapshot.
+
 ## Working a baseline down
 
 `rigor triage` summarises a diagnostic stream — rule

data/docs/manual/08-skills.md

@@ -106,6 +106,7 @@ source checkout. The `rigor skill` command surfaces them:
 
 ```sh
 rigor skill describe        # probe the project + recommend the next skill (alias: rigor describe)
+rigor skill describe --deep # same, but run `rigor check` first and route on its result
 rigor skill --list          # name + absolute path for each bundled skill
 rigor skill <name>          # print the SKILL.md body (with a references/ header)
 rigor skill --full <name>   # the body + every references/*.md inline (complete procedure)
@@ -113,7 +114,11 @@ rigor skill --path <name>   # one-line absolute SKILL.md path, for a file-readin
 ```
 
 `rigor skill describe` is the recommendation engine driven by
-`rigor-next-steps`; `rigor skill rigor-project-init` is the
+`rigor-next-steps`. It is a presence-only probe by default — cheap and
+side-effect-free; add `--deep` when you want the recommendation to come
+from a real analysis instead
+([CLI reference](02-cli-reference.md#describe---deep)).
+`rigor skill rigor-project-init` is the
 canonical way to hand an agent the onboarding workflow without pointing
 it at the repository. The `list` / `print` / `path` verb spellings are
 deprecated (removed in v0.3.0). See [CLI reference](02-cli-reference.md#rigor-skill).

data/docs/manual/09-editor-integration.md

@@ -18,6 +18,7 @@ design + capability matrix lives in
 
 | LSP method | Behaviour |
 |---|---|
+| `textDocument/didOpen` / `didChange` / `didClose` | Incremental sync (`TextDocumentSyncKind::Incremental`): a `didChange` carries range edits, which are spliced into the buffer the server already holds instead of re-sending and re-parsing the whole document on every keystroke. Positions are read as UTF-16 code-unit offsets (`positionEncoding: "utf-16"`), so an emoji or other non-BMP character counts as two. The full-text change form stays supported. |
 | `textDocument/publishDiagnostics` | Pushed on every `didChange`, 200ms debounced. Severity / rule / source map directly to Rigor's diagnostic taxonomy. |
 | `textDocument/hover` | Type-aware markdown. Per-node-class dispatch surfaces receiver type + RBS signature for method calls, FQN + singleton type + defined-in path for constants, narrowed type + bound-at for locals, canonical refinement names (`non-empty-string`, …) for `Refined` / `Difference` carriers. |
 | `textDocument/completion` | Method completion after `.` (driven by inferred receiver type), constant-path completion after `::`. Composite receivers (Union → intersection of methods, Tuple / HashShape → ancestor nominal, Refined → underlying nominal) handled. Parse-recovery sentinel makes mid-edit `obj.` / `Foo::` buffers work. |
@@ -234,8 +235,8 @@ Cold start is dominated by RBS environment build; warm starts
 
 LSP v1 + v2 landed in v0.1.6 and ship in the `0.1.x` line. Queued
 follow-ups (`textDocument/signatureHelp`, hash-key completion,
-`textDocument/definition`, incremental `didChange` sync, Ractor
-pool dispatch, codeAction / rename / semanticTokens / inlayHint)
+`textDocument/definition`, Ractor pool dispatch,
+codeAction / rename / semanticTokens / inlayHint)
 are demand-driven; the current queue is the open
 [`area:editor` issues](https://github.com/rigortype/rigor/issues?q=is%3Aissue+is%3Aopen+label%3Aarea%3Aeditor).
 

data/docs/manual/12-caching.md

@@ -28,12 +28,23 @@ on:
 - the **content** of the source and `.rbs` files that fed it,
 - the **gems** in play, by name and locked version,
 - the active **plugins**, by ID and version,
-- the relevant **configuration**.
+- the relevant **configuration**,
+- **Rigor itself**, by version.
 
 Change any of those and the dependent entries are recomputed
 automatically. A corrupt or unreadable entry is treated as a
 miss and overwritten — bad cache state cannot wedge a run.
 
+Rigor's version identifies its own code only for a released gem.
+If you run Rigor from a git checkout — a working copy you are
+patching, or `gem "rigor", github:` tracking a branch, where two
+commits share one version number — the entries that hold
+analysis results are keyed on the content of Rigor's own source
+as well, so editing the analyzer and re-running recomputes
+instead of replaying the previous answer. That costs one pass
+over Rigor's source per run (about 20 ms); an installed gem
+neither pays it nor needs it.
+
 The cache is also schema-versioned: after a Rigor upgrade that
 changes the cache format, the stale cache is purged on the
 first writable run.
@@ -157,10 +168,11 @@ affected files in parallel just as a full run does.
 
 The snapshot lives under the cache directory (`.rigor/cache`)
 and is keyed by a fingerprint of your configuration, your locked
-gems, your project's own `sig/` RBS, and the Rigor version.
-Change any of those and the snapshot is dropped and the next run
-is a full one, so an incremental run can never serve a stale
-result. (The fingerprint keys on the analysis *roots* — e.g.
+gems, your project's own `sig/` RBS, the Rigor version, and — if
+you run Rigor from a checkout — the content of Rigor's own
+source. Change any of those and the snapshot is dropped and the
+next run is a full one, so an incremental run can never serve a
+stale result. (The fingerprint keys on the analysis *roots* — e.g.
 `["lib"]` — not the expanded file list, so adding or removing a
 file *under* those roots does **not** drop the snapshot: the
 incremental session re-analyzes the added files and the

data/docs/manual/15-type-protection-coverage.md

@@ -48,6 +48,17 @@ power. `--threshold=RATIO` turns it into a CI gate (exit `1`
 below the ratio) and `--format=json` carries the structured
 fields.
 
+Some `protected` sites are typed only through call-site
+[parameter inference](03-configuration.md) (`parameter_inference:`
+— an undeclared parameter seeded from what its callers pass)
+rather than a declaration — a lower bound that can only widen, so
+none of Rigor's negative rules fire against it yet
+([ADR-67](../adr/67-parameter-type-inference.md) WD6b). The text
+report calls these out as "lower-bound-typed" when there are any,
+and the JSON form always carries the count as `lower_bound_typed`.
+It is a sub-count *within* `protected`, never subtracted from it —
+the protected ratio itself is unaffected.
+
 On a large project, `--workers=N` fork-parallelizes the scan
 (both the parameter-inference pre-pass and the per-file scan),
 with output byte-identical to a sequential run. The worker count
@@ -74,11 +85,117 @@ real "add a type here" site, surfaced with no guesswork.
 
 It runs many analyses, so it defaults to the **git-changed** `.rb`
 files (pass explicit paths to widen — whole-project is minutes) and
-is an opt-in CI deep-dive, not an interactive check. The framing is
+is an opt-in CI deep-dive, not an interactive check. `--workers=N`
+applies here too, and it is the main lever on a wide run: the
+whole-project pre-pass is paid once, then the per-file measurement —
+which is nearly all of the wall time — is fork-mapped across
+workers, byte-identically to a sequential run.
+
+The framing is
 always *effectiveness / where to add a type*, never "your code is
 broken": a surviving breakage at a `Dynamic` site is a place
 the type net does not reach.
 
+### Re-running it is cheap
+
+Each file's measurement is cached and served back while nothing
+that could change it has moved — the file itself, any file it was
+recorded as reading from, the resolved configuration, your `sig/`,
+the gem set, the engine version, `--limit` / `--seed`, and which
+bleeding-edge features you have adopted. Edit one file and that
+file plus the files recorded as reading from it are re-measured;
+the rest are served. A one-line stderr report says what happened,
+so `--format=json` stdout stays clean:
+
+```
+coverage: mutation cache — re-measured 2 file(s), 350 served from cache.
+```
+
+The cache reads the cross-file dependency edges that a
+`rigor check --incremental` run records, so warm one once per
+project:
+
+```sh
+rigor check --incremental                    # records the edges
+rigor coverage --protection --mutation lib   # measures, then caches
+```
+
+Without that snapshot — or under `--no-cache`, or with
+`dependent-closure-kill-oracle` adopted, whose verdicts depend on
+*other* files' diagnostics and so cannot be validated per file —
+every file is re-measured and the stderr line names the reason. A
+file the snapshot does not know about is re-measured rather than
+served: the cache never guesses.
+
+### Which sites Tier 2 measures
+
+Tier 2 only mutates a site where Rigor holds a *concrete* receiver
+type — at a `Dynamic` receiver the breakage would survive by
+construction, which measures nothing. Today it decides that from
+the file alone, so a call on a project class declared in a
+**sibling** file (`Post.where`, `Account.find`) reads `Dynamic` and
+the site is left out of the denominator entirely, even though Tier
+1 counts it.
+
+The [`discovery-seeded-mutation-sites`](02-cli-reference.md#rigor-show-bleedingedge)
+bleeding-edge feature closes that gap, giving Tier 2 the same
+cross-file view Tier 1 has — on *both* halves of the measurement,
+site selection and the re-analysis that decides whether a mutation
+was caught, so an admitted site is one a breakage can really trip:
+
+```yaml
+# .rigor.yml
+bleeding_edge:
+  - discovery-seeded-mutation-sites
+```
+
+It is **off by default and opt-in on purpose**. Those sites are
+mostly ones the type net does not yet catch, so admitting them
+*lowers* the reported effectiveness ratio on unchanged code — and
+`--threshold=RATIO` exits 1 below a ratio you pin in CI. Adopt it
+when you are ready to re-baseline that number; it is the intended
+default at a future major.
+
+### Where a catch is allowed to land
+
+Deciding whether a breakage was caught is a separate question from
+which sites are measured, and it has the same blind spot in the
+opposite direction. Tier 2 re-analyses the mutated file and looks
+at *that file's* diagnostics — so the most valuable catch Rigor
+delivers is scored as a miss. Change what a method returns and the
+error appears in its **callers**, which is exactly the cross-file
+reach the analyzer exists for.
+
+The [`dependent-closure-kill-oracle`](02-cli-reference.md#rigor-show-bleedingedge)
+bleeding-edge feature re-analyses the mutated file **and the files
+that depend on it**, and counts the breakage as caught when a new
+diagnostic appears anywhere in that set:
+
+```yaml
+# .rigor.yml
+bleeding_edge:
+  - dependent-closure-kill-oracle
+```
+
+It composes with the site seed above — one decides what is
+measured, the other where a catch may land — and either can be
+adopted alone. The mutated file's verdict is unchanged, so this can
+only **add** kills: the ratio moves up or not at all, and it cannot
+turn a `--threshold` build red. A number recorded under it is still
+not comparable with one recorded without it.
+
+It costs more: each surviving breakage is re-analysed once per
+dependent file (the caught ones stop at the mutated file), and the
+dependency graph itself is one extra whole-project pass per run —
+about a third more wall time on Rigor's own `lib`.
+
+Worth knowing before you pay that: on the two codebases measured so
+far (Rigor's own `lib`, redmine's `app/models`) it added **no**
+kills. A breakage that survives there is one the analyzer reports
+*nowhere* — not one it reports in a caller — which is a statement
+about where the type net has teeth, and exactly what the
+unprotected-site list is telling you.
+
 What *does* reach it is your tests.
 
 ## The fused view — types **and** tests (`--with-tests`)
@@ -236,6 +353,10 @@ them as a deep-dive, not a per-keystroke check:
   (suite runtime)`. A fast, well-scoped test command is the biggest
   lever.
 - **Cap with `--limit`** on `--include-dynamic` or large files.
+- **Spread with `--workers=N`** on `--mutation` (and Tier 1). The
+  fused `--with-tests` tier stays sequential — the suite hook shells
+  out, and concurrent runs would race — so widen it with scope and
+  `--limit` instead.
 
 ## In CI
 

data/docs/manual/plugins/rigor-actioncable.md

@@ -44,6 +44,30 @@ or `stream_for record`) — the absence of a literal match doesn't prove
 the stream is invalid. Non-`Channel` receivers and non-literal stream
 arguments pass through silently.
 
+## `#receive(data)` parameter typing
+
+The plugin also carries an [ADR-28](../../adr/28-path-scoped-protocol-contracts.md)
+path-scoped protocol contract: inside any `#receive(data)` defined
+under `channel_search_paths`, `data` types as `Hash` instead of
+`Dynamic[Top]`. `#receive` is ActionCable's framework-dispatched
+catch-all action — invoked with the decoded JSON payload when an
+incoming message carries no `"action"` key — so the parameter shape is
+uniform across every channel.
+
+```ruby
+# app/channels/chat_channel.rb
+class ChatChannel < ApplicationCable::Channel
+  def receive(data)
+    data["body"]           # data: Hash
+    data.no_such_method    # error: call.undefined-method
+  end
+end
+```
+
+Custom action methods (`def speak(data)`) are not covered — their
+names are project-chosen, and a protocol contract names a single fixed
+method. Only `#receive` is a reserved, uniformly-shaped hook.
+
 ## Configuration
 
 ```yaml
@@ -54,6 +78,11 @@ plugins:
       channel_base_classes: ["ApplicationCable::Channel", "ActionCable::Channel::Base"] # default
 ```
 
+`channel_search_paths` also retargets the `#receive` protocol
+contract's glob — including for multiple configured roots — so a
+custom channel directory gets the same `data: Hash` typing as the
+default.
+
 ## Limitations
 
 - **Direct-superclass match only.** An indirect chain (`AdminChannel <
@@ -68,6 +97,9 @@ plugins:
   than directly in the channel body) is out of scope.
 - **Bare `broadcast(...)`** without an explicit `ActionCable.server`
   receiver is skipped to avoid false positives on unrelated methods.
+- **The `#receive` contract is path-scoped, not class-scoped** (ADR-28):
+  any `def receive(data)` defined anywhere under `channel_search_paths`
+  is typed, even on a class that isn't an ActionCable channel.
 
 ## Plugin internals
 

data/docs/manual/plugins/rigor-devise.md

@@ -64,7 +64,9 @@ The macro manifest (the trait registry mapping each strategy to its
 module), the concern re-targeting walk, the demo, and the
 contract surfaces this plugin exercises are in the
 [plugin's README](../../../plugins/rigor-devise/README.md);
-[handbook chapter 9](../../handbook/09-plugins.md) covers the Tier B
-macro substrate generally. To write a plugin, see
+[`docs/internal-spec/macro-substrate.md`](../../internal-spec/macro-substrate.md)
+specifies the Tier B trait registry generally, and
+[handbook chapter 9](../../handbook/09-plugins.md) is the
+orientation. To write a plugin, see
 [`examples/`](../../../examples/README.md) and the
 [`rigor-plugin-author`](../08-skills.md) skill.

data/docs/manual/plugins/rigor-rbs-inline.md

@@ -45,6 +45,28 @@ plugin id/version + config), so an unchanged second run skips the parse.
 | Rule | Severity | Fires when |
 | --- | --- | --- |
 | `plugin.rbs-inline.source-rbs-synthesis-failed` | info | rbs-inline could not parse a file; analysis falls back to no inline-RBS contribution and the diagnostic carries the upstream error |
+| `plugin.rbs-inline.source-rbs-annotation-not-honoured` | info | an annotation parsed successfully but contributed nothing — the file's other annotations still apply. Today this means the `# @rbs module-self: Foo` spelling; see below |
+
+## Which inline-RBS dialect Rigor reads
+
+There are two implementations of inline RBS: the
+[`rbs-inline` gem](https://github.com/soutaro/rbs-inline), which this plugin
+runs, and the `RBS::InlineParser` built into `rbs` 4.x. **Rigor reads the
+gem's dialect** ([ADR-32](../../adr/32-rbs-inline-comment-ingestion.md) WD11).
+They overlap almost entirely — `#:`, `@rbs` method types, `def self.`,
+instance-variable annotations, `@rbs skip` all behave identically — but they
+are not the same grammar, and one difference bites in practice:
+
+| you write | Rigor honours it |
+| --- | --- |
+| `# @rbs module-self Comparable` | yes |
+| `# @rbs module-self: Comparable` | **no** — this is the spelling in rbs's own `docs/inline.md` |
+
+Rigor reports the second form as
+`plugin.rbs-inline.source-rbs-annotation-not-honoured` rather than dropping it
+in silence. Constructs the gem supports and the built-in parser does not —
+`@rbs generic T`, `@rbs!` embedded RBS blocks, `@rbs inherits`, method
+visibility — all work here.
 
 ## Configuration
 

data/lib/rigor/analysis/check_rules/rule_ids.rb

@@ -119,6 +119,7 @@ module Rigor
       # the runner grows a new bare id.
       NON_CHECK_DIAGNOSTIC_IDS = %w[
         configuration-error load-error pool-degraded runtime-error source-rbs-synthesis-failed
+        source-rbs-annotation-not-honoured
       ].freeze
     end
   end

data/lib/rigor/analysis/check_rules/void_value_use_collector.rb

@@ -36,6 +36,12 @@ module Rigor
           Prism::ConstantWriteNode, Prism::ConstantPathWriteNode
         ].freeze
 
+        # ADR-53 Track B — the node classes the shared {RuleWalk} dispatches to this collector: the consumer
+        # nodes whose slots are value positions. Prism node classes are leaves, so class-equality dispatch
+        # matches the legacy walk's `case`. No context gate — a value-context void use is a use wherever the
+        # DFS reaches it, loops and blocks included.
+        NODE_CLASSES = [Prism::CallNode, *WRITE_NODE_CLASSES].freeze
+
         Result = Data.define(:void_node, :origin)
 
         def initialize(scope_index)
@@ -43,14 +49,27 @@ module Rigor
           @results = []
         end
 
-        # Walk the whole subtree once, checking each consumer node's value slots. Returns one {Result} per
-        # value-context use of a recovered-`void` call.
+        # Legacy single-collector walk — kept as the oracle the ADR-53 Track B equivalence harness compares
+        # {RuleWalk} against. Walks the whole subtree once, checking each consumer node's value slots.
+        # Returns one {Result} per value-context use of a recovered-`void` call.
         # @return [Array<Result>]
         def collect(root)
           walk(root)
           @results.freeze
         end
 
+        # {RuleWalk} entry point: the legacy walk's per-node slot inspection, invoked at every consumer node
+        # under the shared traversal contract. The `context` is unused — every consumer node is inspected.
+        def visit(node, _context = nil)
+          inspect_consumer(node)
+        end
+
+        # The accumulated result, frozen the same way `#collect` returns it — used by {RuleWalk}-driven
+        # callers after the walk completes.
+        def results
+          @results.freeze
+        end
+
         private
 
         def walk(node)

data/lib/rigor/analysis/check_rules.rb

@@ -97,7 +97,6 @@ module Rigor
         collectors = node_collectors || run_node_collectors(path, root, scope_index)
         diagnostics = collectors[:main_pass].results.dup
         diagnostics.concat(self_undefined_method_diagnostics(path, self_call_misses, root, scope_index))
-        diagnostics.concat(void_value_use_diagnostics(path, root, scope_index))
         COLLECTOR_DIAGNOSTIC_BUILDERS.each do |role, builder|
           diagnostics.concat(send(builder, path, collectors[role].results))
         end
@@ -109,10 +108,13 @@ module Rigor
       end
 
       # The per-collector diagnostic builders {.diagnose} folds over, in the historical emission order
-      # (always-truthy → unreachable-clause → shadowed-rescue → ivar-write → dead-assignment →
-      # duplicate-hash-key → return-in-ensure). Keys match {.build_node_collectors}' roles; each value is a
-      # `(path, results)` module_function on this module.
+      # (value-use-void → always-truthy → unreachable-clause → shadowed-rescue → ivar-write →
+      # dead-assignment → duplicate-hash-key → return-in-ensure). Keys match {.build_node_collectors}'
+      # roles; each value is a `(path, results)` module_function on this module. `void_value_use` leads
+      # because its standalone walk used to run before this fold, and the emission order is byte-identical
+      # output, not an implementation detail.
       COLLECTOR_DIAGNOSTIC_BUILDERS = {
+        void_value_use: :void_value_use_diagnostics,
         always_truthy: :always_truthy_condition_diagnostics,
         unreachable_clauses: :unreachable_clause_diagnostics,
         shadowed_rescues: :shadowed_rescue_diagnostics,
@@ -155,6 +157,7 @@ module Rigor
       def build_node_collectors(path, scope_index)
         {
           main_pass: MainPassCollector.new(->(node) { main_pass_node_diagnostics(path, node, scope_index) }),
+          void_value_use: VoidValueUseCollector.new(scope_index),
           always_truthy: AlwaysTruthyConditionCollector.new(scope_index),
           unreachable_clauses: UnreachableClauseCollector.new(scope_index),
           shadowed_rescues: ShadowedRescueCollector.new(scope_index),
@@ -354,12 +357,11 @@ module Rigor
         end
       end
 
-      # ADR-100 WD2 — `static.value-use.void`. Runs a standalone walk (like `self_undefined_method_diagnostics`)
-      # over `root`, so its value-context slot inspection stays independent of the shared per-node
-      # {RuleWalk}. Each result is a value-context use of a call whose author-declared `-> void` return the
-      # engine recovered to `top`.
-      def void_value_use_diagnostics(path, root, scope_index)
-        VoidValueUseCollector.new(scope_index).collect(root).map do |result|
+      # ADR-100 WD2 — `static.value-use.void`. Its value-context slot inspection rides the shared per-node
+      # {RuleWalk} like the other collectors, so the file is not re-traversed for it. Each result is a
+      # value-context use of a call whose author-declared `-> void` return the engine recovered to `top`.
+      def void_value_use_diagnostics(path, results)
+        results.map do |result|
           build_void_value_use_diagnostic(path, result)
         end
       end
@@ -1269,13 +1271,23 @@ module Rigor
           # presence checks below cannot rule out a sound call.
           return nil unless Rigor::Reflection.rbs_class_known?("NilClass", scope: scope)
 
-          return nil unless union_contains_nil?(receiver_type)
-          return nil unless union_method_present_on_non_nil?(receiver_type, call_node.name, scope)
-          return nil if nil_class_has_method?(call_node.name, scope)
+          return nil unless nil_bearing_union_witnesses?(receiver_type, call_node.name, scope)
 
           build_nil_receiver_diagnostic(path, call_node)
         end
 
+        # The receiver-type half of the rule, factored out of the node-shape
+        # guards above: the union must carry nil, must carry a non-nil arm the
+        # presence question can be asked of, must support the method on every
+        # non-nil arm (so the call is only wrong on the nil path), and the
+        # method must be absent from `NilClass` (so the nil path really raises).
+        def nil_bearing_union_witnesses?(receiver_type, method_name, scope)
+          union_contains_nil?(receiver_type) &&
+            union_has_nameable_non_nil_arm?(receiver_type) &&
+            union_method_present_on_non_nil?(receiver_type, method_name, scope) &&
+            !nil_class_has_method?(method_name, scope)
+        end
+
         def union_contains_nil?(union)
           union.members.any? { |member| nil_member?(member) }
         end
@@ -1300,6 +1312,23 @@ module Rigor
             (member.is_a?(Type::Nominal) && member.class_name == "NilClass")
         end
 
+        # Possible-nil may witness only where the presence question below is
+        # ANSWERABLE. `method_present_anywhere?` reports "present" for a
+        # nameless arm (Dynamic / Top / Bot) — the permissive polarity the
+        # union-undefined-method rule's FP safety rests on — so a union whose
+        # non-nil arms are ALL nameless satisfied that gate vacuously and fired
+        # on every method name, including names defined on no class anywhere.
+        # That inverted the intent: the gate suppressed exactly where knowledge
+        # exists (`String | nil` calling a nonexistent method stays silent) and
+        # permitted exactly where none does. Requiring one nameable concrete
+        # arm restores the polarity without touching the shared helper:
+        # `String | nil` keeps firing, and so does `Dynamic | String | nil` —
+        # the nameless arm stays permissive inside the all-arms check, which is
+        # only about the arms' method surface.
+        def union_has_nameable_non_nil_arm?(union)
+          union.members.any? { |m| !nil_member?(m) && !concrete_class_name(m).nil? }
+        end
+
         # The non-nil members must collectively support the
         # method (i.e. for every non-nil member, the method
         # exists on its class via RBS or in-source discovery).
@@ -2073,13 +2102,25 @@ module Rigor
           param_overrides = Rigor::RbsExtended.param_type_override_map(method_def, environment: scope.environment)
           mismatch = argument_mismatch(method_def.method_types, call_node, scope, param_overrides)
           return nil if mismatch.nil?
-          # ADR-67 WD6b — the mismatching argument is an inferred-parameter local, whose type is an
-          # open-call-site lower bound; firing argument-type-mismatch against it is an FP by construction.
-          return nil if inferred_param_argument?(mismatch[:node], scope)
+          return nil if inferred_param_mismatch_verdict?(call_node, mismatch, scope)
 
           build_argument_type_diagnostic(path, call_node, class_name, mismatch)
         end
 
+        # ADR-67 WD6b — an argument-type-mismatch verdict resting on an open-call-site lower bound, on
+        # either side of the call. The ARGUMENT side: the mismatching argument is an inferred-parameter
+        # local, so firing against it is an FP by construction. The RECEIVER side: when the receiver roots
+        # at an inferred parameter, the method whose parameter contract the argument was checked against
+        # was itself resolved through a lower-bound type, so the whole verdict is speculative. The 2026-07-30
+        # self-check surfaced the receiver half as a guard hole: seeding `env : RBS::Environment` activated
+        # this rule on `env.unload(culprits)` and flagged a correct Array argument against `unload`'s
+        # declared `Set[Pathname]` — an upstream signature stricter than its implementation, exactly the FP
+        # class WD6b exists to suppress. The other guarded rules already declined on a param-rooted
+        # receiver; this brings argument-type-mismatch in line.
+        def inferred_param_mismatch_verdict?(call_node, mismatch, scope)
+          inferred_param_argument?(mismatch[:node], scope) || inferred_param_receiver?(call_node, scope)
+        end
+
         # Single overload → the exact per-argument acceptance (unchanged).
         # Multiple overloads → the nil channel (a pure-`nil` argument every
         # overload rejects) plus, on non-coerce methods, the non-nil channel
@@ -2117,7 +2158,7 @@ module Rigor
           arguments = call_node.arguments&.arguments || []
           arguments.each_with_index do |arg, index|
             arg_type = scope.type_of(arg)
-            params = overload_positional_params(functions, index)
+            params = overload_positional_params(method_types, index)
             next if params.nil? # arity divergence — some overload lacks a param here
 
             mismatch =
@@ -2152,11 +2193,30 @@ module Rigor
         # The matching positional RBS param across every overload, or nil when
         # any overload has no param at `index` (arity divergence — the
         # wrong-arity rule's concern, not this one's).
-        def overload_positional_params(functions, index)
-          params = functions.map { |function| (function.required_positionals + function.optional_positionals)[index] }
+        def overload_positional_params(method_types, index)
+          params = method_types.map do |method_type|
+            function = method_type.type
+            param = (function.required_positionals + function.optional_positionals)[index]
+            param && resolve_param_bounds(param, method_type)
+          end
           params.any?(&:nil?) ? nil : params
         end
 
+        # Substitutes each bounded method-level type parameter for its bound, so
+        # `[I < _ToInt] (I index) -> …` is walked as `(_ToInt index) -> …`. A bare
+        # `Variable` is undecidable to the acceptance walk and admits everything,
+        # which silently disables both channels for the whole overload; the bound
+        # constrains the argument exactly as an ordinary param of that type would.
+        # Load-bearing since rbs 4.1 rewrote core signatures into this form
+        # (`Array#fetch`'s block overload is `[I < _ToInt, T] (I index) { … }`).
+        def resolve_param_bounds(param, method_type)
+          bounded = method_type.type_params.select(&:upper_bound)
+          return param if bounded.empty?
+
+          substitution = RBS::Substitution.build(bounded.map(&:name), bounded.map(&:upper_bound))
+          param.map_type { |type| type.sub(substitution) }
+        end
+
         # The class names whose instances `nil` IS — `NilClass` and every
         # ancestor. A parameter typed as any other class instance rejects nil.
         NIL_COMPATIBLE_CLASS_NAMES = %w[NilClass Object BasicObject Kernel].to_set.freeze