rigortype 0.3.6 → 0.3.8

data/docs/manual/05-inspecting-types.md

@@ -63,19 +63,31 @@ syntax-highlighted for a tty — through
 colorizer; `--no-color` (and the `NO_COLOR` environment
 variable) disable the colour.
 
-## `rigor type-of` — one position
+## `rigor type-of` — exact positions or a whole line
 
-When you only need one expression's type — typically while
-chasing down why a diagnostic did or did not fire — query a
-single position:
+When you need a few expression types — typically while chasing
+down why a diagnostic did or did not fire — query the exact
+positions together so Rigor loads the project and each source
+file once:
 
 ```sh
-rigor type-of lib/example.rb:12:8
+rigor type-of lib/example.rb:12:8 lib/example.rb:12:14
 ```
 
-`--format=json` emits a machine-readable result for tooling.
-This is the same query the editor integration answers on
-hover.
+Leave off the column to avoid counting it by hand. Rigor prints
+a table of the first 40 expressions starting on the line,
+outermost first at each 1-based column, and marks a truncated
+table:
+
+```sh
+rigor type-of lib/example.rb:12
+```
+
+`--format=json` emits a machine-readable result for tooling: one
+result stays a flat object, while several results use a `results`
+array. Line queries add `line_enumerations` metadata with the
+shown and total expression counts. An exact position is the same
+query the editor integration answers on hover.
 
 ## `rigor trace` — watch the inference happen
 

data/docs/manual/07-plugins.md

@@ -49,6 +49,10 @@ each plugin's options — but the families today are:
   `rigor-factorybot`.
 - **dry-rb** — `rigor-dry-types`, `rigor-dry-schema`,
   `rigor-dry-struct`, `rigor-dry-validation`.
+- **FFI** — `rigor-ffi` and sub-plugins (`rigor-ffi-rzmq`,
+  `rigor-rbnacl`, `rigor-sassc`, `rigor-ethon`). For plugin authors,
+  `rigor-ffi` provides the `ffi_binding_recognizer` class DSL on
+  `Rigor::Plugin::Base` to recognize custom binding definitions.
 - **Other ecosystems** — `rigor-sinatra`, `rigor-hanami`,
   `rigor-devise`, `rigor-pundit`, `rigor-sidekiq`,
   `rigor-graphql`, `rigor-statesman`, `rigor-sorbet`,

data/docs/manual/plugins/rigor-actionpack.md

@@ -56,6 +56,43 @@ plugins:
       view_search_paths: ["app/views"]               # default
 ```
 
+## What it types
+
+Inside a controller, `params`, `request`, `session`, `flash` and
+`cookies` type as their Action Pack classes, and so do the chains
+built on them:
+
+```ruby
+request.post?          # bool — and so do get? / put? / patch? / delete? /
+                       # head? / options? / trace? / link? / unlink? /
+                       # xhr? / xml_http_request? / ssl? / local? / form_data?
+flash.now              # ActionDispatch::Flash::FlashNow
+flash.keep             # ActionDispatch::Flash::FlashHash
+flash[:notice] = "hi"  # "hi" — an assignment is its right-hand side
+```
+
+Rigor ships **no signature** for these Action Pack classes, on
+purpose: the receiver becomes concrete (so `rigor coverage
+--protection` counts the site) while the method surface stays
+lenient, so `request.headers`, `flash.now[:alert] = x` and anything
+else the framework adds resolve without a diagnostic. A partial
+signature would be worse than none — every member it omitted would
+become a false `call.undefined-method`.
+
+The predicates are typed `bool` — the union of `true` and `false` —
+which is both the real contract (every one of them is an `==`,
+`match?` or `include?` in Rails or Rack) and the reason they are safe
+to type at all: a condition that folds needs to prove *one* constant,
+and a union of both never does. `return unless request.post?` and
+`mode = request.get? ? :a : :b` read exactly as they did before.
+
+`request.format` is **not** typed. That inertness argument is
+narrower than it looks — it holds for a union of the two boolean
+constants, not for a union of ordinary classes, which is nil-free and
+so *can* fold a condition — and `Mime::NullType`, the value `format`
+returns when there is no format, answers `nil?` with `true` while
+being a real object. Typing it needs a nil-aware answer.
+
 ## Limitations
 
 - **Implicit-self helpers only.** `*_path` / `*_url` calls with an
@@ -69,6 +106,30 @@ plugins:
   knows what `rigor-rails-routes` published, and `permit`
   validation only what `rigor-activerecord` published — enabling
   those producers widens what this plugin can check.
+- **`params[:key]` stays untyped.** Inside a controller, `params`
+  types as `ActionController::Parameters`, and so does the result
+  of every builder method that always returns one — `require`,
+  `permit`, `permit!`, `expect`, `slice`, `slice!`, `except`,
+  `without`, `extract!`, `merge`, `merge!`, `reverse_merge`,
+  `reverse_merge!`, `with_defaults`, `with_defaults!`, `compact`,
+  `compact_blank`, `deep_dup` — so a chain built from them keeps a
+  concrete receiver throughout. A subscript read is deliberately
+  left untyped: `params[:missing]` is `nil` at runtime, and a type
+  that says otherwise would let the flow rules fold live
+  conditions (`if params[:q]`, `url.nil?`) to a constant and report
+  working code. Methods whose result depends on the call — `dig`,
+  `fetch`, `compact!`, and the block-less `select` / `reject` /
+  `transform_keys` / `transform_values` — are untyped for the same
+  reason.
+- **`flash[:key]` and `session[:key]` stay untyped too**, for that
+  same reason and measured the same way. Both are leaf reads that
+  return whatever was stored — or `nil` for a key that is not set.
+  A non-nil type folds `mode = flash[:notice] ? … : …` to one arm and
+  reports the live guard after it; a nullable one puts
+  `call.possible-nil-receiver` on `note = flash[:notice];
+  note.upcase`. Writing through them is unaffected: `flash[:k] = v`
+  is `v` because that is what an assignment expression means in Ruby,
+  with no rule needed.
 
 ## Plugin internals
 

data/docs/manual/plugins/rigor-activerecord.md

@@ -30,7 +30,8 @@ errors_demo.rb:24:1: error: `User.find` expects at least 1 argument, got 0 [plug
 | Recognised `Model.find` / `Model.find_by` / `Model.where` call | `:info` | `plugin.activerecord.model-call` |
 | `Model.find_by(unknown: ...)` / `Model.where(unknown: ...)` | `:error` | `plugin.activerecord.unknown-column` |
 | `Model.find` with 0 args | `:error` | `plugin.activerecord.wrong-arity` |
-| No schema source (`db/schema.rb` or `db/structure.sql`) readable | `:warning` | `plugin.activerecord.load-error` |
+| No schema source (`db/schema.rb` or `db/structure.sql`) present — reduced mode | `:info` | `plugin.activerecord.load-error` |
+| A schema source that exists but cannot be read or parsed | `:warning` | `plugin.activerecord.load-error` |
 
 Did-you-mean suggestions use `DidYouMean` fuzzy matching against
 the resolved table's column names.
@@ -75,18 +76,90 @@ Chained query methods keep the element type, and iteration
 scope invoked on a typed relation (`User.where(...).published`)
 never surfaces a false `call.undefined-method`.
 
+`User.table_name` types as `String`, and as the exact string
+only when your source says the name: a literal
+`self.table_name = "people"` on the class or on an STI ancestor,
+with nothing in that chain computing the name at runtime (a
+`def self.table_name`, a `class << self` version of it, or an
+interpolated assignment all count as computing it). Every other
+name — anything the plugin derived by pluralizing the class name —
+stays plain `String`.
+
+That includes names that look confirmed. A `users` table in your
+schema is not evidence that it is `User`'s table: with a
+`self.table_name_prefix` on the base class, `User` really reads
+`app_users`, and a `users` table belonging to some other model
+would "confirm" the wrong guess. A wrong exact string is worse
+than an honest `String` — code comparing `User.table_name` would
+quietly take the wrong branch — so the plugin pins only what you
+wrote down. `User.quoted_table_name` is always `String`; the
+quoting is up to the database adapter.
+
+A model declared inside a Ruby module or class (`Blog::Post`)
+resolves its table the way Rails does for the cases below: the
+namespace is dropped, not flattened into the name, so `Blog::Post`
+reads `posts`, not `blog_posts`. A `table_name_prefix` /
+`table_name_suffix` the enclosing namespace declares as a literal
+(`def self.table_name_prefix = "blog_"`, `class << self` with the
+same, or `mattr_accessor :table_name_prefix, default: "blog_"`) is
+applied on top, so the same model reads `blog_posts` once `Blog`
+sets that. `mattr_writer` does not count — it defines no reader, so
+Rails never actually reads the value back, and neither does the
+plugin.
+
+`Blog::Post.table_name` still reads as the plain demodulized name
+(`posts`) when `Blog`'s prefix/suffix is declared in a shape the
+plugin cannot read as a literal (a computed value, two disagreeing
+declarations) — but that string is informational only in this case.
+The plugin does not trust it enough to look up columns against it:
+guessing a bare name is the guess most likely to hit an unrelated
+REAL table in a namespaced app, and a wrong corroboration is worse
+than none, so `Blog::Post`'s column, alias and association checks
+stand down entirely rather than run against a table that might not
+be the real one.
+
 ## Limitations
 
 - **Direct-superclass match only.** `class Admin < User` where
   `User < ApplicationRecord` is not discovered. Either add `User`
   to `model_base_classes`, or list every concrete model
   explicitly.
+- **A model nested inside ANOTHER non-abstract model class stands down rather
+  than guesses.** `Post::Comment` where `Post < ApplicationRecord` and `Post`
+  is not abstract hits a different Rails naming rule entirely — the parent's own
+  table name is spliced into the middle of the child's, not a
+  prefix/suffix — so the plugin recognises the shape and stands
+  `Comment`'s column / alias / association checks down instead of
+  computing (or guessing at) the real name. (A model nested inside
+  an *abstract* parent class, such as `Base::Comment` where `Base` declares
+  `self.abstract_class = true` or `primary_abstract_class`, correctly resolves
+  its plain demodulized table name with full column checks.)
+- **External `table_name_prefix` / `table_name_suffix` declarations and
+  engines.** Declarations outside `model_search_paths` (e.g. in `lib/` or an
+  engine's `isolate_namespace`) are detected across the project and cause
+  affected models to safely stand down with an empty column set, rather than
+  guessing an incorrect table name. Within `model_search_paths`, model-level
+  and base-class `table_name_prefix` declarations (literal or computed) are
+  resolved directly.
 - **PostgreSQL `db/structure.sql` fallback.** When `db/schema.rb` is
   absent, the plugin parses `db/structure.sql` (the `schema_format =
   :sql` dump) for the same column/type table. It reads PostgreSQL DDL
   only; a column whose SQL type has no Ruby mapping (a custom enum,
   `tsvector`, `ltree`) degrades to `Object` (never dropped), and
   non-`public`-schema partition tables are skipped.
+- **No committed schema — reduced mode.** A project that ships raw
+  migrations and gitignores `db/schema.rb` (the DB-agnostic Rails
+  pattern) still gets table names, finders, scopes and associations:
+  those are read from your model source, not from the schema. Only
+  the column-dependent half stands down — column readers stay
+  untyped and `where(col:)` keys are not validated, exactly as they
+  are for a table the schema does not describe. The plugin says so
+  once per run at `:info`. Committing a schema dump (or pointing
+  `schema_file` / `structure_sql_file` at one) turns the column half
+  back on from the next cold run — a warm cache keeps serving the
+  reduced index until it is invalidated, so use `rigor check
+  --no-cache` (or `make cache-clean`) if you want to see the change
+  immediately.
 - **Column reads, not setters.** The plugin types instance-side
   column *reads* (`user.name`, `user.admin?`) and singular
   associations, but not the `name=` setter or the dirty-tracking

data/docs/manual/plugins/rigor-activesupport-core-ext.md

@@ -44,7 +44,9 @@ Roughly the top ~40 selectors plus their close neighbours, across:
   `#constantize`, `#pluralize`, …), filters (`#squish`, `#truncate`),
   `#html_safe`, `#starts_with?` / `#ends_with?`, conversions.
 - **Time / Date / DateTime** — `.current`, `.zone`, `#yesterday`,
-  `#tomorrow`, `#beginning_of_*` / `#end_of_*`, `#ago`, `#since`.
+  `#tomorrow`, `#beginning_of_*` / `#end_of_*`, `#ago`, `#since`. `Time`
+  additionally carries its **whole** Rails instance surface (see below);
+  `Date` and `DateTime` carry the same subset they always did.
 - **Array** — `.wrap`, `#to_sentence`, `#in_groups_of`, `#second` …
   `#fifth`, `#compact_blank`, `#exclude?`.
 - **Hash** — `#symbolize_keys` / `#stringify_keys` (+ deep / bang),
@@ -57,25 +59,125 @@ Roughly the top ~40 selectors plus their close neighbours, across:
 Time.current     # without the bundle: call.undefined-method Time.current
 ```
 
+## Durations are typed
+
+`1.day`, `5.minutes`, `2.5.hours` and every other multiplier type as
+`ActiveSupport::Duration`, and the arithmetic around them keeps its
+meaning:
+
+```ruby
+1.day                     # ActiveSupport::Duration
+Time.current - 30.minutes # Time
+2 * 1.day                 # ActiveSupport::Duration
+1.day + 1.hour            # ActiveSupport::Duration
+Date.today - 1.week       # Date | Time
+```
+
+`Date ± duration` is a union because that is what Rails does: a
+date-part duration gives you back a `Date`, a sub-day one gives you a
+`Time`.
+
+Rigor ships a **partial** signature for `ActiveSupport::Duration`: the
+reader surface — `#to_i` / `#in_seconds`, `#to_f`, `#in_minutes` /
+`#in_hours` / `#in_days` / `#in_weeks` / `#in_months` / `#in_years`,
+`#iso8601`, `#parts` — is typed, so `3.hours.in_minutes` is `Float` and
+`1.day.to_i * 2` is `Integer`. `#ago` / `#until` / `#before` / `#since`
+/ `#from_now` / `#after` are NOT part of that surface — they default
+to `Time.current`, and typing them was blocked on Rails' `Time`
+instance extensions being declared first, which the section below now
+does; the multipliers themselves are tracked separately. Every
+other member — the arithmetic operators above aside, `==`, and
+anything else Duration forwards through `method_missing` — resolves
+without a diagnostic too, while the site still counts as a concrete
+receiver for `rigor coverage --protection`. Naming
+`ActiveSupport::Duration` at all would normally be the wrong move — a
+partial signature on a class whose real surface forwards to
+`method_missing` turns every omitted member into a false
+`call.undefined-method` — so the plugin lists it under
+`open_receivers:`, the same exemption `rigor-activerecord` gives
+`ActiveRecord::Relation`.
+
+The multiplier only fires on a receiver Rigor has proven numeric, so
+`created_at.day`, `Date.today.year` and your own object's `#days` keep
+the answers they always had.
+
+## The Rails `Time` instance surface is declared, not sampled
+
+`Time` is a core Ruby class, so RBS knows it fully and it is **closed**:
+a name the signatures do not declare is reported
+`call.undefined-method`. That makes an omission on `Time` just as much
+of a false positive as a wrong return type, with no gradual middle, so
+this bundle declares the surface ActiveSupport adds by audit against the
+gem's own sources rather than by a "top selectors" sample.
+
+```ruby
+Time.current.to_fs(:db)             # String
+Time.current.formatted_offset       # String
+Time.current.past?                  # bool
+Time.current.at_beginning_of_hour   # Time
+Time.current.days_ago(3).all_week   # Range[Time]
+Time.current.in_time_zone("Hawaii") # untyped (ActiveSupport::TimeWithZone)
+Time.current.definitely_not_here    # still call.undefined-method
+```
+
+That is the predicates (`#past?`, `#future?`, `#today?`, `#on_weekend?`,
+…), the whole `#days_ago` / `#months_since` / `#next_occurring` family,
+the quarter and `at_`-prefixed spellings, the `#all_week` / `#all_month`
+/ `#all_quarter` / `#all_year` ranges, `#to_fs` / `#to_formatted_s` /
+`#formatted_offset` / `#rfc3339`, `#in_time_zone`, and the `Time.`
+singletons `.days_in_month`, `.days_in_year`, `.rfc3339`, `.use_zone`,
+`.find_zone` / `.find_zone!` and `.zone_default`.
+
+Where a return cannot honestly be named it is widened rather than
+guessed: `#in_time_zone` answers an `ActiveSupport::TimeWithZone`, which
+this bundle does not model, so it reads `untyped`.
+
+What is left out is twelve names, measured against a real
+`require "active_support/all"`: ten instance and two singleton, every one
+an `alias_method` artefact of ActiveSupport's own `+` / `-` / `<=>` /
+`eql?` / `Time.at` overrides — the `plus_with{,out}_duration`,
+`minus_with{,out}_duration`, `minus_with{,out}_coercion`,
+`compare_with{,out}_coercion`, `eql_with{,out}_coercion` and
+`Time.at_with{,out}_coercion` pairs. They are public at runtime and
+`:nodoc:` in the source, and nothing outside ActiveSupport calls them;
+code that does will see them reported.
+
+`Date` and `DateTime` are extended by the same ActiveSupport modules and
+do **not** carry this yet — `Date.current.past?` still reports.
+
 ## No diagnostics, no config
 
-The plugin is RBS-only — it emits no diagnostics and has no
-configuration knobs. It contributes its signatures unconditionally when
-listed under `plugins:`.
+The plugin emits no diagnostics and has no configuration knobs. It
+contributes its signatures — and the Duration typing above —
+unconditionally when listed under `plugins:`.
 
 ## Limitations
 
-- **Conservative return types.** `Integer#days` really returns
-  `ActiveSupport::Duration`, but the bundle types it `untyped` because
-  the analysis environment usually lacks the Duration class — the goal
-  is to silence undefined-method, not to give precise returns. Likewise
-  `#html_safe` is typed `String` (not `SafeBuffer`) and `#try` / `#try!`
-  return `untyped`.
+- **Conservative return types.** `#html_safe` is typed `String` (not
+  `SafeBuffer`) and `#try` / `#try!` return `untyped` — the goal for
+  those is to silence undefined-method, not to give precise returns.
+  (The Duration multipliers are one exception: they are declared
+  `untyped` in the bundle and then typed by the plugin instead — not
+  because the bundle can't name `ActiveSupport::Duration` (it does,
+  described above), but because moving the multiplier return itself
+  into RBS to match hasn't happened yet. `ActiveSupport::Duration`'s
+  own reader surface is the other exception, described above.)
+- **`duration / x` is not typed.** `1.day / 2` is a Duration but
+  `1.day / 1.hour` is a plain `24`; the answer depends on the operand,
+  so Rigor declines rather than guessing.
+- **`duration + Time` is not typed either.** `30.minutes + Time.now`
+  raises at runtime — `Duration#+` cannot coerce a Time, and `-`, `*`,
+  and a `Date` or `DateTime` on the right fail the same way — so Rigor
+  claims nothing for it. `Time.now + 30.minutes` is the form that has a
+  value, and it is typed `Time`.
 - **Project-private monkey-patches are not covered** — only real
   ActiveSupport extensions. For your own core-class patches see the
   `pre_eval:` mechanism ([ADR-17](../../adr/17-monkey-patch-pre-evaluation.md)).
-- **Top ~40 selectors, not exhaustive.** ActiveSupport ships hundreds of
-  extensions; this covers the head of the real-world distribution.
+- **Top ~40 selectors, not exhaustive** — except on `Time`, where the
+  closed-core-class argument above makes a sample unsound and the audit
+  is exhaustive but for the twelve `:nodoc:` alias-chain artefacts named
+  there. Elsewhere ActiveSupport ships hundreds of extensions and this
+  covers the head of the real-world distribution.
 
 ## Plugin internals
 

data/docs/manual/plugins/rigor-sidekiq.md

@@ -42,6 +42,28 @@ arguments.
 | `plugin.sidekiq.missing-schedule` | error | `perform_in()` / `perform_at()` called with zero arguments (the schedule is required even when `#perform` takes none) |
 | `plugin.sidekiq.load-error` | warning | worker discovery failed (parse/read error) — once per file |
 
+## What it types
+
+`perform_async` / `perform_in` / `perform_at` on a **discovered**
+worker return the job id, so the value you assign is a `String`:
+
+```ruby
+jid = WelcomeEmailWorker.perform_async(123)
+jid.upcase                # String — resolved, and checked
+OtherThing.perform_async  # untouched: not a discovered worker
+```
+
+`perform_inline` is not typed — it runs the job in-process and returns
+whatever your `#perform` returns.
+
+The type is plain `String`, not `String?`, even though
+`Sidekiq::Client#push` returns nil when a client middleware halts the
+chain. That path needs a middleware in your own app that returns false
+from `#call` — rare, deliberate, and code that already knows to check —
+whereas typing it nullable puts a `call.possible-nil-receiver` error on
+the ordinary `jid = W.perform_async(id); jid.length`. Rigor takes the
+answer that is silent on the common code.
+
 ## Configuration
 
 ```yaml

data/lib/rigor/analysis/check_rules/always_truthy_condition_collector.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../../source/node_children"
 require_relative "../../inference/optimistic_origin"
 require_relative "inferred_param_guard"
+require_relative "published_constant_guard"
 
 module Rigor
   module Analysis
@@ -119,6 +120,17 @@ module Rigor
           predicate_type = scope.type_of(predicate)
           return unless predicate_type.is_a?(Type::Constant)
 
+          # Issue #644 — a predicate whose constancy rests on a value constant declared in ANOTHER file is
+          # not a logic error the reader's author can see: `if MODE == :production` folds only because the
+          # project-wide table published `MODE`, and a configuration constant read in ten files would put
+          # this warning in all ten. The value stays published (dispatch and argument typing keep it); only
+          # the firing is withheld, which is the direction the carrier discipline allows.
+          #
+          # LAST of the gates on purpose. It is the only one that can resolve a def and walk its body, and a
+          # predicate that does not fold to a `Type::Constant` was never going to fire — so the fold check
+          # above is what keeps the hop off every ordinary `if` in a project that publishes anything at all.
+          return if PublishedConstantGuard.rooted?(predicate, scope)
+
           polarity = predicate_type.value.nil? || predicate_type.value == false ? :falsey : :truthy
           @results << Result.new(node: predicate, polarity: polarity)
         end

data/lib/rigor/analysis/check_rules/dead_version_guard_arms.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../inference/version_guard"
+require_relative "../../source/node_children"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # ADR-47 WD5 — drops the diagnostics that land inside the **dead arm of a decidable version guard**
+      # (issue #627).
+      #
+      # {Inference::StatementEvaluator} already skips evaluating that arm, so its writes never join into the
+      # post-`if` scope. Skipping the evaluation is not by itself enough to silence the arm, though: the
+      # rule walk visits every node of the file whether or not the evaluator typed it, so a call whose
+      # receiver is typeable on its own — a constant, a literal — still reports. `mail/lib/mail/yaml.rb`'s
+      #
+      #     ::YAML.safe_load(yaml, permitted_classes)   # the Psych < 3.1 positional form
+      #
+      # is exactly that shape: honest against the Ruby 4 Psych signature, and unreachable on the Ruby the
+      # user is checking with. This is the second half of the fix — the arm stops producing diagnostics.
+      #
+      # The dead arms are found by re-asking {Inference::VersionGuard}, which is a pure function of the AST,
+      # so this filter and the evaluator's arm elision cannot disagree about which arm is dead.
+      #
+      # Applied to the type / flow rules only, and BEFORE `suppression.*` joins the list: a malformed
+      # `# rigor:disable` marker inside a dead arm is still a real authoring error — the marker's own
+      # well-formedness does not depend on whether the code around it runs.
+      module DeadVersionGuardArms
+        module_function
+
+        # @param diagnostics [Array<Rigor::Analysis::Diagnostic>]
+        # @param root [Prism::Node]
+        # @return [Array<Rigor::Analysis::Diagnostic>]
+        def filter(diagnostics, root)
+          # The scan is a whole-file walk, so it is paid only when there is something to drop. A file with
+          # no diagnostics — the overwhelming majority — never walks.
+          return diagnostics if diagnostics.empty?
+
+          arms = scan(root)
+          return diagnostics if arms.empty?
+
+          diagnostics.reject { |diagnostic| arms.any? { |arm| covers?(arm, diagnostic) } }
+        end
+
+        # @param root [Prism::Node]
+        # @return [Array<Prism::Location>] the source ranges of every dead version-guard arm
+        def scan(root)
+          arms = []
+          collect(root, arms)
+          arms
+        end
+
+        def collect(node, arms)
+          return unless node.is_a?(Prism::Node)
+
+          dead = dead_arm(node)
+          arms << dead.location if dead
+          # Nothing inside a dead arm can produce a surviving diagnostic, so the walk does not descend into
+          # it — a nested guard there would only add a range already covered.
+          node.rigor_each_child { |child| collect(child, arms) unless dead && child.equal?(dead) }
+        end
+        private_class_method :collect
+
+        # The arm that cannot run, or nil when the guard is undecidable (both arms live — the pre-existing
+        # behaviour) or the dead arm is absent (`foo if RUBY_VERSION >= "3.1"` has no `else`).
+        def dead_arm(node)
+          case node
+          when Prism::IfNode
+            case Inference::VersionGuard.verdict(node.predicate)
+            when :truthy then node.subsequent
+            when :falsey then node.statements
+            end
+          when Prism::UnlessNode
+            # `unless` runs its body on the FALSEY edge, so the arms are swapped.
+            case Inference::VersionGuard.verdict(node.predicate)
+            when :truthy then node.statements
+            when :falsey then node.else_clause
+            end
+          end
+        end
+        private_class_method :dead_arm
+
+        # Prism columns are 0-based and `Diagnostic#column` is 1-based; the location's end is exclusive.
+        # Compared as `[line, column]` pairs rather than by line alone so a one-line guard
+        # (`RUBY_VERSION >= "3.1" ? a(1) : a(1, 2)`) drops only the dead half.
+        def covers?(location, diagnostic)
+          position = [diagnostic.line, diagnostic.column - 1]
+          return false if (position <=> [location.start_line, location.start_column]).negative?
+
+          (position <=> [location.end_line, location.end_column]).negative?
+        end
+        private_class_method :covers?
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/ivar_write_collector.rb

@@ -69,9 +69,9 @@ module Rigor
 
           case node
           when Prism::ClassNode, Prism::ModuleNode
-            name = Source::ConstantPath.qualified_name(node.constant_path)
-            if name
-              walk(node.body, qualified_prefix + [name]) if node.body
+            child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+            if child_prefix
+              walk(node.body, child_prefix) if node.body
               return
             end
           when Prism::DefNode