rigortype 0.3.6 → 0.3.7

data/lib/rigor/analysis/check_rules.rb

@@ -12,6 +12,8 @@ require_relative "dependency_recorder"
 require_relative "check_rules/rule_ids"
 require_relative "check_rules/inferred_param_guard"
 require_relative "check_rules/declaration_sourced_guard"
+require_relative "check_rules/published_constant_guard"
+require_relative "check_rules/dead_version_guard_arms"
 require_relative "check_rules/rule_walk"
 require_relative "check_rules/always_truthy_condition_collector"
 require_relative "check_rules/unreachable_clause_collector"
@@ -50,7 +52,7 @@ module Rigor
     #   resolves these to their runtime class for dispatch.
     # - receivers whose class name is NOT registered in the
     #   loader (RBS-blind environments, unknown stdlib).
-    # rubocop:disable Metrics/ModuleLength
+    # rubocop:disable-next Metrics/ModuleLength
     module CheckRules
       # ADR-87 WD4 — the canonical rule-id table lives in the light `check_rules/rule_ids.rb` (required at the
       # top of this file) so {Analysis::RuleCatalog} can read it without loading the engine.
@@ -102,6 +104,11 @@ module Rigor
         COLLECTOR_DIAGNOSTIC_BUILDERS.each do |role, builder|
           diagnostics.concat(send(builder, path, collectors[role].results))
         end
+        # ADR-47 WD5 — the dead arm of a decidable version guard (#627) reports nothing: it cannot run on
+        # the Ruby being checked with, so a diagnostic there is a false positive. Applied before
+        # `suppression.*` joins the list, which stays reportable inside a dead arm — a malformed
+        # `# rigor:disable` marker is an authoring error regardless of whether its code runs.
+        diagnostics = DeadVersionGuardArms.filter(diagnostics, root)
         # Suppression-marker validation (`suppression.*`) runs BEFORE the filter so its own diagnostics are
         # suppressible like any other rule — `# rigor:disable suppression.unknown-rule` on the offending
         # comment's line works, with no regress (the token itself is known, so it never re-fires).
@@ -649,7 +656,7 @@ module Rigor
         resolved.nil? || resolved.empty? ? [token] : resolved
       end
 
-      # rubocop:disable Metrics/ClassLength
+      # rubocop:disable-next Metrics/ClassLength
       class << self
         private
 
@@ -659,9 +666,14 @@ module Rigor
           scope = scope_index[call_node]
           return nil if scope.nil?
 
-          # ADR-67 WD6b — an inferred-parameter receiver's type is an open-call-site lower bound; firing
-          # undefined-method against it is an FP by construction. Decline.
-          return nil if inferred_param_receiver?(call_node, scope)
+          # The two exemptions that hold whatever shape the receiver has. Ahead of the receiver-shape
+          # branch below because a plugin is consulted ONCE for the whole receiver, union included, so the
+          # gate belongs where that one consult is rather than duplicated into each shape's path. On the
+          # union side that is placement, not demonstrated coverage: no fixture reaches the gate through
+          # `union_undefined_method_diagnostic` today — every plugin-typed union anyone has built carries a
+          # `Singleton` arm, which `union_arm_blocks_undefined_fire?` declines on outright.
+          # See {#call_site_exempt?}.
+          return nil if call_site_exempt?(call_node, scope)
 
           # N3 — a safe-navigation call (`recv&.m`) never dispatches on the
           # nil edge of its receiver: at runtime it short-circuits to nil.
@@ -705,7 +717,7 @@ module Rigor
           # because the real type is empty (the real `DRb` has
           # `start_service`), so enumerating it to prove a call
           # "undefined" would be a false positive.
-          return nil if unbounded_receiver_surface?(class_name, scope)
+          return nil if unenumerable_receiver?(class_name, scope)
 
           # Slice 7 phase 12 — suppress when the user has
           # declared the method in source (`def` /
@@ -730,21 +742,73 @@ module Rigor
           method_def = lookup_method(receiver_type, class_name, call_node.name, scope)
           return nil if method_def
 
-          # Module-mixin fallback (mirror of
-          # `MethodDispatcher#user_class_fallback_receiver`'s module
-          # path): an instance method on a module-mixin like
-          # `PP::ObjectMixin` observes Kernel / Object methods
-          # through every concrete includer's ancestor chain, so an
-          # unresolved `self.inspect` / `self.respond_to?` /
-          # `self.class` MUST NOT fire `undefined-method`. Retry
-          # against Object before the rule fires.
-          return nil if module_mixin_receiver?(receiver_type, scope) &&
-                        lookup_method(receiver_type, "Object", call_node.name, scope)
+          return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind)
 
           definition_site = project_definition_site(scope, class_name, call_node.name, kind)
+          # Issue #735 — the site is evidence, and whose RBS this is decides what it is evidence OF. On a
+          # BUNDLED declaration (core / stdlib / a gem) the class is not the project's, so a project `def`
+          # on it is the ADR-17 monkey-patch this rule surfaces with the `pre_eval:` nudge. On the
+          # project's OWN sidecar `sig/` the declaration describes the source being analysed, the "patch"
+          # is just another of the project's files, and the nudge is not something a user can act on: it
+          # asks them to `pre_eval:` their own application. `rigor sig-gen --write` on redmine turned 29
+          # `call.undefined-method` into 171 through exactly this reading, 49 of them here.
+          return nil if project_sidecar_owns_method?(scope, class_name, call_node.name, kind)
+
           build_undefined_method_diagnostic(path, call_node, receiver_type, definition_site, class_name)
         end
 
+        # The two probes that run only once every cheaper answer has come back "absent", kept together
+        # because they share that position and nothing else.
+        #
+        # - Issue #739 — an instance-side MODULE receiver. A value typed as a mixin module is an instance of
+        #   some class that includes it, and that class contributes an arbitrary surface: inside
+        #   `module Attachable::InstanceMethods`, `self.project` is defined by the ActiveRecord model that
+        #   includes the module, and in RBS a parameter typed `Taggable` means "something whose class
+        #   includes Taggable", not "something whose methods are Taggable's". The surface is not
+        #   enumerable, so nothing here can prove a method absent. This probe used to RETRY against Object
+        #   — enough for `self.inspect` / `self.class`, and nothing else — which left 45 firings on
+        #   redmine's `acts_as_*` mixins the moment a `sig/` declared them.
+        #
+        #   The union twin already declines these arms outright (`union_arm_blocks_undefined_fire?`, "a
+        #   module mixin whose Object-inherited methods the per-arm lookup would miss"). The two rules
+        #   answering the same question differently about the same receiver is the fork this closes; the
+        #   union's reading is the correct one.
+        #
+        #   Singleton-side module receivers are NOT covered and must not be: `M.typo` on a namespace module
+        #   with `module_function` / `def self.` has a real, enumerable surface and keeps firing.
+        # - Issue #723 — the project's own ancestry. Everything above answered "the RBS does not have
+        #   it"; a project ancestor still might, and the typer has already resolved the site through
+        #   exactly this walk. It is last because it is the only probe here that walks the class graph
+        #   (see {#ancestry_declares_method?} for why that placement is load-bearing, not tidiness).
+        def last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind)
+          return true if module_mixin_receiver?(receiver_type, scope)
+          return true if mixin_self_class_receiver?(call_node, scope)
+          return true if unknown_mixin_includer?(class_name, scope)
+
+          ancestry_declares_method?(scope, class_name, call_node.name, kind)
+        end
+
+        # Issue #739 — the singleton twin of the module-mixin receiver, and the only shape that reaches the
+        # singleton side legitimately. `self.class` inside a mixin's instance method is the INCLUDER's class
+        # at runtime; the engine types it `Singleton[<the module>]`, one hop along from the same wrong
+        # `self`. redmine's `acts_as_*` mixins reach their configuration that way
+        # (`self.class.attachable_options`), 17 sites of it.
+        #
+        # Keyed on the call-site SYNTAX rather than on the receiver type, because `Singleton[M]` is also
+        # what a namespace module's own `M.helper` produces, and that surface is real and enumerable — a
+        # type-only test would silence every `M.typo` in the project. Here the question is narrower: was
+        # this singleton produced by `.class` on a value whose type is a mixin module?
+        def mixin_self_class_receiver?(call_node, scope)
+          receiver = call_node.receiver
+          return false unless receiver.is_a?(Prism::CallNode) && receiver.name == :class
+          return false unless receiver.arguments.nil?
+
+          inner = receiver.receiver
+          return false if inner.nil?
+
+          module_mixin_receiver?(scope.type_of(inner), scope)
+        end
+
         # ADR-17 — when the project itself defines this method on the
         # receiver class somewhere in the analyzed file set (a reopened
         # core/stdlib/gem class the dispatcher does not apply cross-
@@ -761,6 +825,38 @@ module Rigor
           scope.user_def_site_for(class_name, method_name)
         end
 
+        # Issue #735 — the site is evidence, and whose RBS the class has decides what it is evidence OF. On
+        # a BUNDLED declaration (core / stdlib / a gem) the class is not the project's, so a project `def`
+        # on it is the ADR-17 monkey-patch this rule surfaces with the `pre_eval:` nudge. On the project's
+        # OWN sidecar `sig/` the declaration describes the source being analysed, the "patch" is just
+        # another of the project's files, and the nudge is not something a user can act on: it asks them to
+        # `pre_eval:` their own application. `rigor sig-gen --write` on redmine turned 29
+        # `call.undefined-method` into 171 through exactly this reading, 49 of them here.
+        def project_sidecar_owns_method?(scope, class_name, method_name, kind)
+          Rigor::Reflection.project_declared_class?(class_name, scope: scope) &&
+            project_defines_method?(scope, class_name, method_name, kind)
+        end
+
+        # Issue #735 — "does the project define this method, on either side, somewhere in its own files".
+        # Distinct from {#project_definition_site}, which answers the narrower question the ADR-17 MESSAGE
+        # asks (instance-side only, because that is the monkey-patch shape whose `pre_eval:` advice applies).
+        # The suppression needs both sides: `def self.available_search_types` in one file and its call in
+        # another is the same "second file of my own class" shape as the instance case, and on redmine it is
+        # the larger half — modules with class-method surfaces are how that codebase is organised.
+        def project_defines_method?(scope, class_name, method_name, kind)
+          if kind == :singleton
+            # The singleton side has no ancestor walk to ask (#731); it answers for the receiver's own name.
+            !scope.user_singleton_def_site_for(class_name, method_name).nil?
+          else
+            # Through the project's ancestry, not the receiver's name alone: a base class defining a helper
+            # its subclasses call is ordinary Ruby, and a sidecar `sig/` that declares the SUBCLASS without
+            # that helper was reporting it (`AbstractAdapter#url`, called from `FilesystemAdapter#target`).
+            # The def-node walk is what has to answer here — `discovered_methods` deliberately withholds a
+            # plain cross-file `def` (`ScopeIndexer#finalize_def_index`), which is exactly this shape.
+            !scope.user_def_through_ancestors(class_name, method_name).first.nil?
+          end
+        end
+
         def module_mixin_receiver?(receiver_type, scope)
           return false unless receiver_type.is_a?(Type::Nominal)
           return false if scope.environment.nil?
@@ -783,6 +879,22 @@ module Rigor
           project_patched_method?(scope, class_name, method_name, kind)
         end
 
+        # Issue #723 — the same question as {#source_declared_method?}, asked through the project's own
+        # ANCESTRY rather than the receiver's name alone. A class whose `sig/` declares it without its
+        # project superclass typed `:admin_val` under `dump_type` and drew `undefined method 'admin_val'`
+        # at the same column of the same run: the probe read a name-keyed table while the typer resolved
+        # the call through the class graph.
+        #
+        # It is deliberately NOT folded into `source_declared_method?`, which every `call.*` rule consults
+        # early on its hot path. The walk reads `Scope#superclass_of` / `#includes_of`, and those record an
+        # ADR-46 file-level ancestry edge; running it for every call would have made `Widget.new` — a call
+        # RBS answers, that never reaches a verdict — record an ancestry dependency on `Widget`'s
+        # declaring file, coarsening incremental invalidation for the whole project. Asked HERE, one step
+        # before the diagnostic is built, the edge is recorded exactly where the answer depended on it.
+        def ancestry_declares_method?(scope, class_name, method_name, kind)
+          scope.discovered_method_through_ancestors?(class_name, method_name, kind)
+        end
+
         # ADR-17 § "Inference contract" — consults
         # `Environment#project_patched_methods` so a `def` declared
         # in a `pre_eval:` file suppresses the diagnostic at the
@@ -853,6 +965,52 @@ module Rigor
           )
         end
 
+        # Issue #742 — the receivers whose method surface this rule cannot enumerate, in one question.
+        #
+        # {#unbounded_receiver_surface?} covers the ADR-26 open receivers and Rigor's own synthesized stubs.
+        # The generic metaclasses join it here: a value typed `Class` or `Module` is SOME class or module
+        # object, and its singleton methods cannot be read off the metaclass — `def self.included(base)`
+        # receives the includer, so `base.class_attribute :main_menu` and `base.main_menu = true` are calls
+        # on whatever included the module. The union twin has declined these arms since it was written
+        # (`METACLASS_ARMS`, "a `plugin_class : Class` really holds a `Plugin` subclass with `.manifest`");
+        # the scalar rule enumerated `Module`'s own RBS instead and reported them.
+        #
+        # Kept beside `unbounded_receiver_surface?` rather than folded into it: that predicate has eight
+        # other callers (arity, the `raise` verdicts), and widening all of them is a separate change with
+        # its own evidence to gather.
+        def unenumerable_receiver?(class_name, scope)
+          METACLASS_ARMS.include?(class_name) || unbounded_receiver_surface?(class_name, scope)
+        end
+
+        # Issue #746 — a class that includes a module the environment does not know. `SudoMode::Form`
+        # includes `ActiveModel::Validations`, which no RBS in redmine's environment declares, and `valid?`
+        # comes from it: the ancestors are not fully known, so the method table is not enumerable and a
+        # verdict read off the part we can see is unsound. Same reasoning `unbounded_receiver_surface?`
+        # already applies to an ADR-26 open receiver and to Rigor's own synthesized stubs.
+        #
+        # Asked LATE, with {#ancestry_declares_method?} and for the same reason: `Scope#includes_of` records
+        # an ADR-46 file-level ancestry edge, so running it on the hot path made `Widget.new` — a call RBS
+        # answers, that never reaches a verdict — depend on `Widget`'s declaring file.
+        # `dependency_recorder_spec` caught it here exactly as it caught #723's walk.
+        #
+        # The receiver's OWN includes only. A project ancestor's unknown include makes the surface just as
+        # unknown; walking the chain is a deliberate deferral rather than an oversight.
+        def unknown_mixin_includer?(class_name, scope)
+          includes = scope.includes_of(class_name)
+          return false if includes.empty?
+
+          includes.any? { |raw| !known_mixin?(raw, class_name, scope) }
+        end
+
+        def known_mixin?(raw_name, class_name, scope)
+          scope.ancestor_name_candidates(class_name, raw_name).any? do |candidate|
+            next true if scope.discovered_classes.key?(candidate)
+
+            Rigor::Reflection.rbs_class_known?(candidate, scope: scope) &&
+              !synthesized_stub_receiver?(candidate, scope)
+          end
+        end
+
         # Returns a qualified class name for the in-scope check.
         # Nominal / Singleton carry a single-class identity
         # directly. Constant projects to its value's class.
@@ -918,16 +1076,43 @@ module Rigor
           nil
         end
 
+        # ADR-26's own counterpart, not a use of it — issue #660 tracks whether this deserves a first-class
+        # mechanism of its own rather than living here as a constant. `open_receivers:` (the manifest field,
+        # below) only takes effect once a project LOADS the plugin that names it, but a gem overlay
+        # (`data/gem_overlay/`, ADR-72) is auto-applied to every project that locks the gem WITHOUT opting
+        # into a plugin — there is no manifest in that path for an `open_receivers:` entry to live on. This
+        # is that path's counterpart: the class names a BUNDLED overlay declares knowing the declaration is
+        # partial, protected independent of any plugin manifest.
+        #
+        # MEMBERSHIP ALONE is not enough, though: `unbounded_receiver_surface?` (below) also requires the
+        # overlay directory that made the entry true to have actually LOADED this run — otherwise a project
+        # that never locks the gem, and happens to own a class of the same name itself, would silently lose
+        # `call.undefined-method` (and inherited-name `wrong-arity`) on that class, the exact regression this
+        # gate exists to avoid (ADR-26 WD1: the protection is active exactly when the RBS it protects is).
+        #
+        # `ActiveSupport::Duration` is the first (and, as of #632, only) member: it forwards any method its
+        # own class doesn't define to the wrapped numeric via `method_missing` (audited against
+        # ActiveSupport 8.1.3.1's `lib/active_support/duration.rb` — see
+        # `data/gem_overlay/activesupport/core_ext.rbs`'s `ActiveSupport::Duration` comment for the full
+        # audit), so declaring even its reader surface makes it RBS-known — and, without this, every member
+        # the declaration omits would become a false `call.undefined-method` for every project that locks
+        # activesupport, the overwhelming majority of which never opt into the plugin at all.
+        GEM_OVERLAY_OPEN_RECEIVERS = Set["ActiveSupport::Duration"].freeze
+        private_constant :GEM_OVERLAY_OPEN_RECEIVERS
+
         # ADR-26 — whether `class_name` is declared "open" by a
         # loaded plugin (manifest `open_receivers:`). An open
         # class responds beyond its RBS surface, so the
         # `call.undefined-method` rule must not fire for it.
         # True when the receiver class responds beyond an enumerable
         # RBS method table, so proving a call "undefined" against it is
-        # unsound: a plugin-declared open receiver, or a Rigor-
-        # synthesized stub type (see `RbsLoader#synthesized_type_names`).
+        # unsound: a plugin-declared open receiver, a Rigor-bundled-
+        # overlay open receiver ({GEM_OVERLAY_OPEN_RECEIVERS}) whose
+        # bundled directory this run actually loaded, or a
+        # Rigor-synthesized stub type (see `RbsLoader#synthesized_type_names`).
         def unbounded_receiver_surface?(class_name, scope)
-          open_receiver?(class_name, scope) || synthesized_stub_receiver?(class_name, scope)
+          open_receiver?(class_name, scope) || synthesized_stub_receiver?(class_name, scope) ||
+            (GEM_OVERLAY_OPEN_RECEIVERS.include?(class_name.to_s.sub(/\A::/, "")) && gem_overlay_loaded?(scope))
         end
 
         def open_receiver?(class_name, scope)
@@ -937,6 +1122,79 @@ module Rigor
           registry.open_receiver?(class_name)
         end
 
+        # Whether THIS run's RBS environment actually includes one of Rigor's OWN partial declarations of the
+        # overlaid gem — {GEM_OVERLAY_OPEN_RECEIVERS} membership alone must not grant the exemption (see that
+        # constant's comment). `RbsLoader#signature_paths` is the same list `Environment.for_project` builds
+        # from `resolved_paths + plugin_sig_paths + gem_sig_paths + collection_paths + overlay_paths`, and
+        # two of its members can carry that declaration:
+        #
+        # - a `data/gem_overlay/<gem>/` directory, which is a member if and only if `gem_overlay_paths`
+        #   picked it (the gem is locked, `:missing` coverage, and its plugin twin is NOT reachable —
+        #   ADR-72), so the `RbsLoader.under_gem_overlay_root?` prefix match is exact: no other signature
+        #   source lives under that root;
+        # - the bundled plugin twin's own `sig/`, when a project wires it through `signature_paths:` instead
+        #   of `plugins:`. Before #672 that route loaded BOTH halves and `Duration` collapsed outright, so
+        #   nothing fired and nothing needed protecting; now the overlay stands down and the twin's
+        #   declaration is the one that loads — with no manifest behind it, so `open_receiver?` above stays
+        #   false and this is the only thing standing between a real `Duration` receiver and a false
+        #   `call.undefined-method` on every member the declaration omits.
+        #
+        # When the PLUGIN itself is loaded the first arm goes false (the overlay stands down) and the second
+        # goes true — its `sig/` rides in as a plugin signature path — but nothing here decides that case:
+        # `open_receiver?`'s manifest-driven check short-circuits above it. The two answers agree, which is
+        # the point; this predicate asks only whether a Rigor-authored partial declaration is in the
+        # environment, never how the project asked for it.
+        #
+        # The two arms are asked in that order, over the WHOLE list each time, rather than interleaved per
+        # path: the overlay arm is a string prefix and the twin arm canonicalises paths on the filesystem,
+        # so the overwhelmingly common overlay-only run never reaches a syscall here.
+        def gem_overlay_loaded?(scope)
+          loader = scope.environment&.rbs_loader
+          return false if loader.nil? || !loader.respond_to?(:signature_paths)
+
+          paths = loader.signature_paths
+          paths.any? { |path| Rigor::Environment::RbsLoader.under_gem_overlay_root?(path) } ||
+            Rigor::Environment::RbsLoader.gem_overlay_twin_signatures_loaded?(paths)
+        end
+
+        # The `call.undefined-method` exemptions that depend only on the CALL SITE, never on the receiver's
+        # type or class — so they are decided before the rule looks at the receiver at all:
+        #
+        # - ADR-67 WD6b — an inferred-parameter receiver's type is an open-call-site lower bound, so firing
+        #   undefined-method against it is a false positive by construction.
+        # - Issue #653 — a plugin answered this call site ({#plugin_typed_call?}).
+        def call_site_exempt?(call_node, scope)
+          inferred_param_receiver?(call_node, scope) || plugin_typed_call?(call_node, scope)
+        end
+
+        # Issue #653 — true when a plugin's `dynamic_return` supplied the return type for THIS call node
+        # (recorded by `MethodDispatcher` on `Scope#plugin_typed_calls` during the typing pass, exactly the
+        # way `Scope#void_origins` is recorded and consumed).
+        #
+        # Why the rule declines. The plugin tier sits ABOVE `RbsDispatch` in `MethodDispatcher#resolve`, so
+        # a plugin answer means the RBS never dispatched the call: the type at the site is the plugin's.
+        # Reading that same receiver's RBS afterwards to prove the call undefined puts the two subsystems in
+        # direct contradiction on one line of one run — the plugin says `Rails.logger` is an
+        # `ActiveSupport::BroadcastLogger`, the rule says `logger` does not exist. Under ADR-5 a
+        # partially-declared receiver is not a closed world, and incompleteness is exactly what a plugin is
+        # loaded to cover, so the plugin's answer is the honest one. Without this, adding a four-line
+        # partial `sig/` for a class a plugin already covered turned every covered call site into an error
+        # — writing more RBS made a project's diagnostics worse.
+        #
+        # Deliberately NOT scoped to "the RBS is silent about this method": the precedence recorded here is
+        # the dispatcher's own, and the dispatcher does not consult the RBS before letting a plugin answer.
+        # For THIS rule the two readings coincide anyway — a method the RBS declares is found by
+        # `lookup_method` below and never reaches the diagnostic — so the broader statement costs no
+        # diagnostic and keeps the contract stated in one direction. `docs/internal-spec/plugin.md` §
+        # "Return-type and narrowing contributions" is where it binds.
+        #
+        # Unlike {#unbounded_receiver_surface?} this is per CALL SITE, not per receiver class: a plugin
+        # answering `Rails.logger` exempts that call and nothing else, so `Rails.no_such_reader` on the same
+        # receiver still fires.
+        def plugin_typed_call?(call_node, scope)
+          scope.plugin_typed_call?(call_node)
+        end
+
         def synthesized_stub_receiver?(class_name, scope)
           loader = scope.environment&.rbs_loader
           return false if loader.nil? || !loader.respond_to?(:synthesized_type_names)
@@ -944,6 +1202,49 @@ module Rigor
           loader.synthesized_type_names.include?(class_name.to_s.sub(/\A::/, ""))
         end
 
+        # ADR-26 — the SIGNATURE half of the open-receiver policy. `call.undefined-method` already declines
+        # on an unbounded surface: a plugin vouches that the class answers names its RBS cannot enumerate
+        # (an `ActiveRecord::Relation` delegates every user-declared `scope` to its model). The rules that
+        # read a RESOLVED SIGNATURE — wrong-arity and argument-type-mismatch — must decline on the same
+        # ground, but only where the name resolved through an ANCESTOR rather than the open class itself.
+        #
+        # The failure it closes: `Issue.visible.open` is a declared scope taking `*args`, but `open` is also
+        # `Kernel#open`, so resolution walks the Relation's ancestry, finds the IO opener and checks the
+        # call against `(String, ...)` — `wrong number of arguments (given 0, expected 1..3)` on correct
+        # code, plus `argument type mismatch: expected String, got false` on `open(false)`. The collision
+        # set is every Object/Kernel name, so any project whose scope is called `open`, `select`, `test`,
+        # `format`, `p`, `system`, … inherits the error the moment the first hop types. That is a wrong
+        # signature applied to a method the receiver does not actually run — not a strict reading of a real
+        # one — and it fires on code that works.
+        #
+        # A method the open class DECLARES stays checked: `Relation#limit` is in the plugin's own bundled
+        # RBS, so `relation.limit` with no arguments still fires. The suppression is therefore bounded to
+        # names the open class inherited, where the resolution was never authoritative to begin with.
+        # The RBS method definition this call may be validated against, or nil when there is none worth
+        # trusting: the lookup found nothing, it returned {#lookup_method}'s defensive `true` sentinel, or
+        # the name is one an open receiver INHERITED rather than declared. Shared by the two rules that read
+        # a resolved signature — `call.wrong-arity` and `call.argument-type-mismatch` — so they cannot drift
+        # on which signatures are authoritative.
+        def trustworthy_signature(receiver_type, class_name, call_node, scope)
+          method_def = lookup_method(receiver_type, class_name, call_node.name, scope)
+          return nil if method_def.nil? || method_def == true
+          return nil if unauthoritative_inherited_signature?(class_name, method_def, scope)
+
+          method_def
+        end
+
+        def unauthoritative_inherited_signature?(class_name, method_def, scope)
+          return false unless unbounded_receiver_surface?(class_name, scope)
+          return true unless method_def.respond_to?(:defined_in)
+
+          defined_in = method_def.defined_in
+          return true if defined_in.nil?
+
+          strip_root(defined_in.to_s) != strip_root(class_name)
+        end
+
+        def strip_root(name) = name.to_s.sub(/\A::/, "")
+
         def definition_available?(receiver_type, class_name, scope)
           if receiver_type.is_a?(Type::Singleton)
             !Rigor::Reflection.singleton_definition(class_name, scope: scope).nil?
@@ -1026,6 +1327,10 @@ module Rigor
         # an unrelated namespace.
         def parent_matches?(child, parent, class_name)
           parent_name = parent.to_s
+          # Issue #722 residue 1 — a rooted parent (`< ::Base`) names the top level, so the namespace walk
+          # below must not run for it. This peel is one of the two that predate
+          # `Scope#ancestor_name_candidates` and resolve their own pair.
+          return parent_name.delete_prefix("::") == class_name if parent_name.start_with?("::")
           return true if parent_name == class_name
 
           segments = child.to_s.split("::")[0...-1]
@@ -1120,7 +1425,7 @@ module Rigor
         # by `undefined_method_diagnostic`; it returns nil
         # when the call's receiver / RBS coverage / call shape
         # disqualifies the rule.
-        # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
+        # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
         def wrong_arity_diagnostic(path, call_node, scope_index)
           return nil if call_node.receiver.nil?
           return nil unless plain_positional_call?(call_node)
@@ -1151,8 +1456,8 @@ module Rigor
           return nil unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
           return nil unless definition_available?(receiver_type, class_name, scope)
 
-          method_def = lookup_method(receiver_type, class_name, call_node.name, scope)
-          return nil if method_def.nil? || method_def == true
+          method_def = trustworthy_signature(receiver_type, class_name, call_node, scope)
+          return nil if method_def.nil?
 
           arity_envelope = compute_arity_envelope(method_def)
           return nil if arity_envelope.nil?
@@ -1163,7 +1468,6 @@ module Rigor
 
           build_arity_diagnostic(path, call_node, class_name, min, max, actual)
         end
-        # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
 
         # True for the outer `.new` of a chained `Struct.new(...).new`:
         # `class_name`/`kind` already pin the receiver to
@@ -1313,7 +1617,7 @@ module Rigor
         # method must be absent from `NilClass` (so the nil path really raises).
         def nil_bearing_union_witnesses?(receiver_type, method_name, scope)
           union_contains_nil?(receiver_type) &&
-            union_has_nameable_non_nil_arm?(receiver_type) &&
+            union_has_nameable_non_nil_arm?(receiver_type, scope) &&
             union_method_present_on_non_nil?(receiver_type, method_name, scope) &&
             !nil_class_has_method?(method_name, scope)
         end
@@ -1355,8 +1659,22 @@ module Rigor
         # `String | nil` keeps firing, and so does `Dynamic | String | nil` —
         # the nameless arm stays permissive inside the all-arms check, which is
         # only about the arms' method surface.
-        def union_has_nameable_non_nil_arm?(union)
-          union.members.any? { |m| !nil_member?(m) && !concrete_class_name(m).nil? }
+        def union_has_nameable_non_nil_arm?(union, scope)
+          union.members.any? do |m|
+            next false if nil_member?(m)
+
+            class_name = concrete_class_name(m)
+            next false if class_name.nil?
+
+            # Issue #574 — nameable is not the same as ANSWERABLE. `method_present_anywhere?` reports
+            # "present" for a named arm nothing knows the surface of, purely because nothing is known —
+            # which is the same vacuity this gate's docstring says it exists to prevent, one level in. A
+            # plugin-minted nominal like `ActionController::Parameters` ships no RBS and has no project
+            # source, so it counted as a full witness and `q = params[:q]; q.strip` fired at ERROR severity
+            # on correct Rails code.
+            Rigor::Reflection.rbs_class_known?(class_name, scope: scope) ||
+              scope.discovered_classes.key?(class_name)
+          end
         end
 
         # The non-nil members must collectively support the
@@ -1379,8 +1697,11 @@ module Rigor
           return true if scope.discovered_method?(class_name, method_name, :instance)
           return true unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
           return true unless definition_available?(member, class_name, scope)
+          return true if lookup_method(member, class_name, method_name, scope)
 
-          !lookup_method(member, class_name, method_name, scope).nil?
+          # Issue #723 — the arm's own RBS does not have it; its project ancestry still might. Last, for
+          # the reason {#ancestry_declares_method?} carries: this is the probe that walks the class graph.
+          ancestry_declares_method?(scope, class_name, method_name, :instance)
         end
 
         def nil_class_has_method?(method_name, scope)
@@ -2126,8 +2447,8 @@ module Rigor
           return nil unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
           return nil unless definition_available?(receiver_type, class_name, scope)
 
-          method_def = lookup_method(receiver_type, class_name, call_node.name, scope)
-          return nil if method_def.nil? || method_def == true
+          method_def = trustworthy_signature(receiver_type, class_name, call_node, scope)
+          return nil if method_def.nil?
 
           param_overrides = Rigor::RbsExtended.param_type_override_map(method_def, environment: scope.environment)
           mismatch = argument_mismatch(method_def.method_types, call_node, scope, param_overrides)
@@ -2516,8 +2837,8 @@ module Rigor
             function.trailing_positionals.empty?
         end
 
-        def translate_param_type(rbs_type, _environment)
-          Inference::RbsTypeTranslator.translate(rbs_type)
+        def translate_param_type(rbs_type, environment)
+          Inference::RbsTypeTranslator.translate(rbs_type, alias_expander: environment&.rbs_loader)
         rescue StandardError
           Type::Combinator.untyped
         end
@@ -2651,7 +2972,7 @@ module Rigor
           return nil unless self_type.respond_to?(:class_name)
 
           method_def =
-            if def_node.receiver.nil?
+            if def_node.receiver.nil? && !singleton_context_def?(scope, self_type.class_name, def_node.name)
               Reflection.instance_method_definition(self_type.class_name, def_node.name, scope: scope)
             else
               Reflection.singleton_method_definition(self_type.class_name, def_node.name, scope: scope)
@@ -2664,16 +2985,27 @@ module Rigor
           declared_return_union(method_def, scope.environment)
         end
 
+        # A receiverless `def` inside `class << self` is a singleton def; the def NODE alone cannot say
+        # so, but the discovery walk recorded it under the singleton kind (and not the instance kind).
+        # Without this, `class << self; def load` compared its body against `Kernel#load: -> bool` — the
+        # inherited INSTANCE method — instead of its own `def self.load` signature. A name defined on
+        # both facets stays on the instance lookup (the pre-existing conservative reading).
+        def singleton_context_def?(scope, class_name, method_name)
+          scope.discovered_method?(class_name, method_name, :singleton) &&
+            !scope.discovered_method?(class_name, method_name, :instance)
+        end
+
         # `type_vars:` — ADR-35 WD9 tier 1. When the caller supplies a generic-instantiation
         # substitution map (parent-side, keyed by the parent class's declared type-parameter names),
         # a `-> T` return is translated at its instantiated type (`-> Integer`) rather than degrading
         # to `Dynamic[Top]`. The default empty map is the pre-WD9 behaviour, under which any type
         # variable degrades to `Dynamic[Top]` and the rule stays silent.
-        def declared_return_union(method_def, _environment, type_vars: {})
+        def declared_return_union(method_def, environment, type_vars: {})
           translated = method_def.method_types.filter_map do |mt|
             Inference::RbsTypeTranslator.translate(
               mt.type.return_type,
-              self_type: nil, instance_type: nil, type_vars: type_vars
+              self_type: nil, instance_type: nil, type_vars: type_vars,
+              alias_expander: environment&.rbs_loader
             )
           rescue StandardError
             nil
@@ -2807,8 +3139,9 @@ module Rigor
         end
 
         # Direct ancestors of `class_name` as project-discovered, qualified names: included / prepended
-        # modules first, then the superclass. As-written names are resolved against the subclass's lexical
-        # nesting; names that resolve to no project class/module (RBS-known / third-party) are dropped.
+        # modules first, then the superclass. As-written names are resolved against the nesting the
+        # subclass's declaration header is written in (`Scope#ancestor_name_candidates`, the single owner of
+        # that order); names that resolve to no project class/module (RBS-known / third-party) are dropped.
         def ancestor_class_names(scope, class_name)
           names = []
           scope.includes_of(class_name).each do |raw|
@@ -2824,11 +3157,10 @@ module Rigor
         end
 
         def resolve_override_ancestor_name(scope, subclass_qualified, raw_ancestor)
-          segments = subclass_qualified.to_s.split("::")
-          (segments.length - 1).downto(0) do |i|
-            candidate = (segments[0, i] + [raw_ancestor]).join("::")
-            return candidate if known_user_class?(scope, candidate)
-          end
+          resolved = scope.ancestor_name_candidates(subclass_qualified, raw_ancestor)
+                          .find { |candidate| known_user_class?(scope, candidate) }
+          return resolved if resolved
+
           # ADR-46 slice 3 — the override checker reads the class graph
           # directly (not through the recorder's `Scope` choke points), and
           # short-circuits when the ancestor resolves to no project class, so
@@ -2971,7 +3303,10 @@ module Rigor
           return {} if param_names.empty? || param_names.size != args.size
 
           translated = args.map do |arg|
-            Inference::RbsTypeTranslator.translate(arg, self_type: nil, instance_type: nil, type_vars: {})
+            Inference::RbsTypeTranslator.translate(
+              arg, self_type: nil, instance_type: nil, type_vars: {},
+                   alias_expander: scope.environment&.rbs_loader
+            )
           rescue StandardError
             nil
           end
@@ -3028,8 +3363,9 @@ module Rigor
 
           scope, override_method, parent_class, parent_method = resolved
           parent_type_vars = ancestor_instantiation_type_vars(scope, parent_class)
-          override_params = positional_param_types(override_method)
-          parent_params = positional_param_types(parent_method, type_vars: parent_type_vars)
+          override_params = positional_param_types(override_method, environment: scope.environment)
+          parent_params = positional_param_types(parent_method, type_vars: parent_type_vars,
+                                                                environment: scope.environment)
           return nil if override_params.nil? || parent_params.nil?
 
           index = first_narrowed_param_index(override_params, parent_params)
@@ -3049,7 +3385,7 @@ module Rigor
         # map (parent class's type params → the subclass's instantiation) so a parent `(T)` parameter
         # is compared at its instantiated type. Empty (the default, and the override side) keeps the
         # pre-WD9 degrade-to-`Dynamic[Top]` behaviour.
-        def positional_param_types(method_def, type_vars: {})
+        def positional_param_types(method_def, type_vars: {}, environment: nil)
           method_types = method_def.method_types
           return nil unless method_types.size == 1
 
@@ -3058,7 +3394,8 @@ module Rigor
 
           (func.required_positionals + func.optional_positionals).map do |param|
             Inference::RbsTypeTranslator.translate(
-              param.type, self_type: nil, instance_type: nil, type_vars: type_vars
+              param.type, self_type: nil, instance_type: nil, type_vars: type_vars,
+                          alias_expander: environment&.rbs_loader
             )
           rescue StandardError
             nil
@@ -3096,8 +3433,6 @@ module Rigor
           )
         end
       end
-      # rubocop:enable Metrics/ClassLength
     end
-    # rubocop:enable Metrics/ModuleLength
   end
 end