rigortype 0.3.8 → 0.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30b66e3d183999cbd85557c5af6b770ac78bf82507a2e587e5878c1a411b4326
-  data.tar.gz: 2c3cee80d75ea9769d7b965dd84ac60eb4af89c27fc63d3ec35a1cdce3b45338
+  metadata.gz: 857b76366640c2aa188649c7fe6af483d599bc05e5f185c4d8285b093c092fdd
+  data.tar.gz: 8e281f8668221704dd74c0b8d942830f6e58b252135db54142a70543bcfdf839
 SHA512:
-  metadata.gz: 9986a78b908e05fd017f772b0c26d6bc3d654e665cbf59d85cdf0176b76735403d644238ca7072268f9e47ba3937073002de47a308deda6cab77311459f6f008
-  data.tar.gz: 66df68005471dc8df33c9a1881659644fca80c4e406830b7ab9c1fe5b641e3872d13a70ab39cccdf66fba3d256e46026ab13963a70a76be1362ac86b8e823f1d
+  metadata.gz: aaea4bc6f1073c80307375365f111ba58c198cef0852a63abe5476c1ffa937754b0e45a506b69a052e685724d24fa44689f4f8bfb375f902b7e53521eea7ae4d
+  data.tar.gz: 846d488914e0046afce19772fa8295ab99b068acf8e94a04d57590f9feb7718ebca29858ca78f47435a1542e7c1c8cbf000ca983619b3ebdb684650f8c8fc7aa

data/README.md

@@ -231,7 +231,7 @@ rigor docs --list                 # list every bundled page
 
 ## Status
 
-Current release: **`v0.3.8`** (2026-09-08) — on the
+Current release: **`v0.3.9`** (2026-09-12) — on the
 `0.3.x` line, continuing the evaluation era opened by `v0.2.0`, the first
 publicly-announced (general / evaluation) release. The line publishes
 an enumerated [compatibility surface](docs/compatibility.md) as a

data/data/capability_roles/capability_roles.rbs

@@ -0,0 +1,36 @@
+# Rigor's capability-role catalog (ADR-1 § "Capability roles",
+# docs/type-specification/structural-interfaces-and-object-shapes.md).
+#
+# These are the roles Rigor itself ships, as opposed to the stdlib interfaces (`_Reader`, `_ToStr`, …)
+# it reuses from upstream RBS. They exist so a `%a{rigor:v1:conforms-to _ClosableStream}` directive
+# written by following the specification resolves in a default run instead of failing soft.
+#
+# Parameter and return types are deliberately the loosest honest reading: a role says which members a
+# value answers, and narrowing them here would reject conforming classes rather than describe them.
+
+# The specification's running example: the one-member lifetime contract.
+interface _Closable
+  def close: () -> untyped
+end
+
+interface _RewindableStream
+  def read: (*untyped) -> String?
+
+  def rewind: () -> untyped
+end
+
+interface _ClosableStream
+  def close: () -> untyped
+
+  def closed?: () -> bool
+end
+
+interface _FileDescriptorBacked
+  def fileno: () -> Integer
+end
+
+# Not generic: `_Callable[**A, R]` as ADR-1 first drafted it is not RBS grammar (`**A` has no meaning
+# in a type-parameter list). A generic form is a future extension, gated on RBS gaining the syntax.
+interface _Callable
+  def call: (*untyped) -> untyped
+end

data/data/gem_overlay/activesupport/core_ext.rbs

@@ -68,6 +68,31 @@ class Object
 
   # `core_ext/object/inclusion` — `x.in?([a, b])` / `x.in?(1..10)`.
   def in?: (untyped) -> bool
+
+  # Issue #673 — `core_ext/object/to_query`, `core_ext/object/duplicable` and
+  # `core_ext/object/instance_variables` all hang off `Object`, so every
+  # RBS-known receiver reaches them; declaring them only on `Hash` (as
+  # `to_param` / `to_query` were) or only on `NilClass` (as `duplicable?` /
+  # `instance_values` were) left `"x".to_param`, `1.duplicable?` and friends a
+  # `call.undefined-method` on ordinary Rails code.
+  #
+  # `to_param` is `to_s`; `to_query(key)` interpolates two `CGI.escape` results.
+  # `key` is `untyped` because the body only calls `to_param` on it, and both
+  # `:name` and `"user[name]"` are ordinary call sites.
+  def to_param: () -> String
+  def to_query: (untyped key) -> String
+
+  # `bool` and not `true`: `Object#duplicable?` answers true, but the
+  # `Singleton` (and, on a Ruby where methods are not duplicable, `Method` /
+  # `UnboundMethod`) overrides answer false. `-> true` on the universal
+  # receiver would make every `if x.duplicable?` an always-truthy branch —
+  # a false positive on the only shape anybody writes.
+  def duplicable?: () -> bool
+
+  # Keys without the leading `@` for `instance_values`, with it for
+  # `instance_variable_names`.
+  def instance_values: () -> Hash[String, untyped]
+  def instance_variable_names: () -> Array[String]
 end
 
 # `nil.blank?` / `nil.present?` / `nil.try` are the most frequent
@@ -80,16 +105,24 @@ class NilClass
   def try!: (*untyped) -> nil
   def duplicable?: () -> true
   def instance_values: () -> Hash[String, untyped]
+  # `core_ext/object/to_query` overrides `to_param` on the three singleton
+  # values to return `self` rather than `Object#to_param`'s `to_s`, so the
+  # `Object` row above would carry a wrong return here. `NilClass#to_query`
+  # is its own method (`CGI.escape(key.to_param)`), still a String.
+  def to_param: () -> nil
+  def to_query: (untyped key) -> String
 end
 
 class TrueClass
   def blank?: () -> false
   def present?: () -> true
+  def to_param: () -> true
 end
 
 class FalseClass
   def blank?: () -> true
   def present?: () -> false
+  def to_param: () -> false
 end
 
 # ---------------------------------------------------------------
@@ -263,6 +296,16 @@ end
 # `spec/rigor/environment/activesupport_overlay_parity_spec.rb`); every method not listed here stays
 # undeclared and silently `Dynamic` rather than guessed.
 module ActiveSupport
+  # Issue #534 item 7 — the `ActiveSupport::Concern` twin of the plugin's declaration. The plugin file
+  # carries the reasoning; the short version is that naming the module makes `extend ActiveSupport::Concern`
+  # resolve, and the three members have to come with it so that `included do … end` does not become a false
+  # `call.undefined-method` on a now-RBS-known module.
+  module Concern
+    def included: (?untyped base) ?{ (?) -> untyped } -> untyped
+    def prepended: (?untyped base) ?{ (?) -> untyped } -> untyped
+    def class_methods: () { (?) -> untyped } -> untyped
+  end
+
   class Duration
     # The `ago` family (issue #659). `since(time = ::Time.current)` and `ago(time = ::Time.current)` are
     # the only two real methods; `from_now` / `after` alias the first and `until` / `before` the second,
@@ -272,23 +315,25 @@ module ActiveSupport
     # `GEM_OVERLAY_OPEN_RECEIVERS` cannot suppress since it protects a Duration receiver, not a `Time`
     # one. #658 declared that surface and #670 the `Date` / `DateTime` twins, so the chains resolve now.
     #
-    # `Time` is the right class rather than a compromise: under a zone these answer an
-    # `ActiveSupport::TimeWithZone`, and Rails overrides `TimeWithZone#is_a?` to answer true for
-    # `::Time`. A `Time | ActiveSupport::TimeWithZone` union was measured and rejected — it types every
-    # downstream call `Dynamic[top]`. The with-an-argument form stays `untyped` because the runtime
-    # return depends on the argument's class AND on whether the duration carries a date-scale part
-    # (`(1.month).ago(Date.today)` answers a `Date`; `(30.minutes).ago(Date.today)` a `TimeWithZone`).
-    def ago: () -> Time
+    # Since #673 the no-argument form answers `ActiveSupport::TimeWithZone`, the class these really
+    # build off `::Time.current` under a zone, declared below as a `::Time` SUBCLASS. That keeps every
+    # `Time`-typed chain and parameter working while `1.hour.ago.time_zone` stops being a false
+    # `call.undefined-method`. A `Time | ActiveSupport::TimeWithZone` union was measured and rejected —
+    # it types every downstream call `Dynamic[top]`. The with-an-argument form stays `untyped` because
+    # the runtime return depends on the argument's class AND on whether the duration carries a
+    # date-scale part (`(1.month).ago(Date.today)` answers a `Date`; `(30.minutes).ago(Date.today)` a
+    # `TimeWithZone`).
+    def ago: () -> TimeWithZone
            | (untyped time) -> untyped
-    def until: () -> Time
+    def until: () -> TimeWithZone
              | (untyped time) -> untyped
-    def before: () -> Time
+    def before: () -> TimeWithZone
               | (untyped time) -> untyped
-    def since: () -> Time
+    def since: () -> TimeWithZone
              | (untyped time) -> untyped
-    def from_now: () -> Time
+    def from_now: () -> TimeWithZone
                 | (untyped time) -> untyped
-    def after: () -> Time
+    def after: () -> TimeWithZone
              | (untyped time) -> untyped
 
     # `to_i` / its `in_seconds` alias return `@value.to_i` — always Integer.
@@ -315,6 +360,54 @@ module ActiveSupport
     # Float` is what stays honest without costing the common `parts[:days] * 2` chain anything.
     def parts: () -> Hash[Symbol, Integer | Float]
   end
+
+  # ---------------------------------------------------------------
+  # ActiveSupport::TimeWithZone — issue #673
+  # ---------------------------------------------------------------
+  #
+  # `Time.current` and the `Duration#ago` family really answer a `TimeWithZone`
+  # under a zone, and this class was not modelled at all, so the four readers a
+  # TWZ has and a `Time` does not — `time_zone`, `time`, `period`,
+  # `comparable_time` — were `call.undefined-method` on every `Time.current`
+  # receiver. Declaring them on `Time` would have been wrong: a plain `Time`
+  # genuinely lacks them.
+  #
+  # `< ::Time` rather than a `Time | TimeWithZone` union at the producers. The
+  # union was measured during #632 and rejected — it types every downstream
+  # call `Dynamic[top]`. Inheritance is the cheaper shape AND the honest one
+  # here: Rails overrides `TimeWithZone#is_a?` to answer true for `::Time`, so
+  # `Time` is the class Rails itself tells callers a TWZ is, and TWZ's
+  # `method_missing` forwards every name it does not define to the wrapped
+  # `::Time` — which is exactly what inheriting `Time`'s surface models. A TWZ
+  # therefore also satisfies every `Time`-typed parameter, and a chain through
+  # `Time.current` keeps resolving instead of collapsing.
+  #
+  # The cost, taken deliberately: `Time.current` answers a plain `Time` when
+  # `Time.zone` is nil, so `Time.current.time_zone` in a zone-less
+  # activesupport-only project is a real `NoMethodError` this now types. Rails
+  # sets `config.time_zone` ("UTC") by default, so the shape is rare, and the
+  # false positive it replaces fired on correct Rails code — which AGENTS.md
+  # ranks above the worst-case static reading.
+  class TimeWithZone < ::Time
+    # `Time`'s own `initialize` takes the `(year, month, …)` parts; inheriting
+    # it would make `TimeWithZone.new(utc, zone)` — how Rails constructs one —
+    # a `call.argument-type-mismatch`. `untyped` because the zone and period
+    # carriers (`ActiveSupport::TimeZone`, `TZInfo::TimezonePeriod`) are not
+    # declared anywhere in this overlay.
+    def initialize: (untyped utc_time, untyped time_zone, ?untyped local_time, ?untyped period) -> void
+
+    # The `attr_reader`; an `ActiveSupport::TimeZone`, undeclared here.
+    def time_zone: () -> untyped
+
+    # The wall-clock `::Time` in the zone. `utc` / `getutc` / `getgm` /
+    # `gmtime` are `Time`'s own names and stay inherited; `comparable_time` is
+    # the alias of `utc` that `Time` does not carry.
+    def time: () -> ::Time
+    def comparable_time: () -> ::Time
+
+    # A `TZInfo::TimezonePeriod`, undeclared here.
+    def period: () -> untyped
+  end
 end
 
 # ---------------------------------------------------------------
@@ -322,7 +415,10 @@ end
 # ---------------------------------------------------------------
 
 class Time
-  def self.current: () -> Time
+  # `Time.zone ? Time.zone.now : Time.now` — an `ActiveSupport::TimeWithZone` under a zone, which
+  # since #673 is declared as a `::Time` subclass so the four TWZ-only readers resolve without the
+  # rest of the chain losing its `Time` typing. See the class's own note for the zone-less cost.
+  def self.current: () -> ActiveSupport::TimeWithZone
   def self.zone: () -> untyped # ActiveSupport::TimeZone | nil
   def self.zone=: (String | Symbol | untyped) -> untyped
 

data/docs/handbook/02-everyday-types.md

@@ -25,7 +25,7 @@ n = ARGV.size
 ```
 
 A vanilla checker says: `n: Integer`. Rigor says:
-`n: int<0, max>` (a non-negative integer — `Array#size` cannot
+`n: Integer[0..]` (a non-negative integer — `Array#size` cannot
 return a negative count).
 
 The reason this matters: most diagnostics Rigor wants to fire
@@ -40,7 +40,7 @@ or narrow (`Constant<3>`, `non-empty-string`). The rest of
 this chapter is the carrier zoo.
 
 One note on notation before the zoo: angle brackets hold a
-concrete value or bound — `Constant<3>`, `int<0, max>` —
+concrete value or bound — `Constant<3>`, `Integer[0..]` —
 while square brackets hold type parameters, exactly as in RBS
 — `Nominal[String]`, `Hash[K, V]`, `Dynamic[top]`. A type
 parameter names the type of a *part*: `Hash[K, V]` is a Hash
@@ -124,27 +124,30 @@ nominal carrier or `Dynamic[top]`.
 
 Some integer-valued expressions produce a known range without
 producing a single literal value. Rigor describes those with
-`Type::IntegerRange`, displayed as `int<min, max>`:
+`Type::IntegerRange`, displayed as `Integer[…]` around the Ruby
+range literal that covers the values, `Integer[1..10]`:
 
 ```ruby
-n = ARGV.size               #=> dump_type: int<0, max>
-m = n + 1                   #=> dump_type: int<1, max>
-double = n * 2              #=> dump_type: int<0, max>
+n = ARGV.size               #=> dump_type: Integer[0..]
+m = n + 1                   #=> dump_type: Integer[1..]
+double = n * 2              #=> dump_type: Integer[0..]
 ```
 
-`max` here means "positive infinity" — the upper bound is
-unbounded; `min`, which appears in the table below, is its
-mirror, "negative infinity." Multiplication preserves the
-floor, so `n * 2` stays `int<0, max>`.
+The literal means what it means in Ruby: `Integer[0..]` is
+every integer `(0..).cover?` accepts, an endless range is
+unbounded above, a beginless one (`Integer[..-1]`) is unbounded
+below, and `Integer[1...10]` is written back as `Integer[1..9]`
+because for integers the two are the same set. Multiplication
+preserves the floor, so `n * 2` stays `Integer[0..]`.
 
 A handful of common ranges have shorter names:
 
 | Spelling | Meaning |
 | --- | --- |
-| `positive-int` | `int<1, max>` |
-| `non-negative-int` | `int<0, max>` |
-| `negative-int` | `int<min, -1>` |
-| `non-positive-int` | `int<min, 0>` |
+| `positive-int` | `Integer[1..]` |
+| `non-negative-int` | `Integer[0..]` |
+| `negative-int` | `Integer[..-1]` |
+| `non-positive-int` | `Integer[..0]` |
 
 `Array#size`, `Array#length`, `Hash#size`, `String#size`, …
 all carry `non-negative-int`. `Array#count` does too. Adding

data/docs/handbook/03-narrowing.md

@@ -107,7 +107,7 @@ matched member:
 ```ruby
 case n
 when 0      then :zero        # Constant<0>
-when 1..9   then :small       # int<1, 9>
+when 1..9   then :small       # Integer[1..9]
 when 10     then :ten         # Constant<10>
 else             :large       # everything else
 end
@@ -153,7 +153,7 @@ end
 ```
 
 The `is_a?` narrowed `x` to `Integer`, then the integer
-comparison narrowed it further to `int<1, max>`.
+comparison narrowed it further to `Integer[1..]`.
 
 ## Integer comparisons
 
@@ -165,7 +165,7 @@ integer ranges:
 def safe_index(arr, n)
   return :empty if arr.empty?
   return :out_of_range if n < 0 || n >= arr.size
-  # n: int<0, arr.size - 1>  (in practice: int<0, max>
+  # n: Integer[0..arr.size - 1]  (in practice: Integer[0..]
   # tightened against `n >= arr.size`)
   arr.fetch(n)
 end
@@ -176,10 +176,43 @@ Range comparisons compose with literals:
 ```ruby
 n = some_input
 if n.between?(1, 9)
-  # n: int<1, 9>
+  # n: Integer[1..9]
 end
 ```
 
+## Float comparisons
+
+A `Float` narrows on the *true* edge only. `x > 0.0` is false for
+`NaN`, so the values that pass are a range, `Float[0.0..]`, but the
+values that fail are everything else *plus* `NaN`, which no range
+spells, so the else branch keeps `Float`:
+
+```ruby
+x = Float(input)
+if x > 0.0
+  # x: Float[0.0..]
+else
+  # x: Float
+end
+if x < 1.0
+  # x: Float[...1.0]   (Ruby's exclusive end)
+end
+if x.between?(0.0, 1.0)
+  # x: Float[0.0..1.0]
+end
+```
+
+`x.nan?` narrows its *false* edge to `non-nan-float`, and
+`x.finite?` its *true* edge to `finite-float`. The range is the
+one Ruby's `Range#cover?` would accept, so `Float[0.0..]` contains
+`Float::INFINITY` and never `Float::NAN`.
+
+Some calls produce a bounded Float on their own: `rand(0.0...1.0)`
+and `Random.rand(1.0..2.0)` are the range they name, `Math.sqrt(n)` of a `non-negative-int` is
+`Float[0.0..]`, and `x.clamp(0.0, 1.0)` or `x.clamp(0.0..1.0)` on a
+bounded `x` is the bracket. A bounded Float knows it is not `NaN`,
+so `u.nan?` folds to `false` and `u.round` to an integer range.
+
 ## Predicate methods on refinements
 
 Rigor recognises a small set of "type-carrier predicate

data/docs/handbook/05-methods-and-blocks.md

@@ -21,7 +21,7 @@ first one that produces a result:
 2. **Shape dispatch.** The receiver carries a `Tuple` /
    `HashShape` / `IntegerRange` / refinement and the method
    has a per-shape rule. `Tuple[A, B, C].size` →
-   `Constant<3>`; `int<0, max>.zero?` → `Constant<true> |
+   `Constant<3>`; `Integer[0..].zero?` → `Constant<true> |
    Constant<false>`.
 3. **RBS dispatch.** The class has an RBS sig for the method.
    Argument types are checked against the parameter contract

data/docs/handbook/06-classes.md

@@ -113,11 +113,11 @@ class Counter
   end
 
   def bump
-    @count += 1   # @count rebound to int<1, max>
+    @count += 1   # @count rebound to Integer[1..]
   end
 
   def value
-    @count        # int<0, max>  (union of seen writes)
+    @count        # Integer[0..]  (union of seen writes)
   end
 end
 ```

data/docs/handbook/07-rbs-and-extended.md

@@ -128,7 +128,8 @@ A short reference:
 | Family | Names |
 | --- | --- |
 | Empty / non-empty | `non-empty-string`, `non-empty-array[T]`, `non-empty-hash[K, V]` |
-| Integer ranges | `positive-int`, `non-negative-int`, `negative-int`, `non-positive-int`, `non-zero-int`, `int<min, max>` |
+| Integer ranges | `positive-int`, `non-negative-int`, `negative-int`, `non-positive-int`, `non-zero-int`, `Integer[min..max]` |
+| Float ranges | `Float[0.0..1.0]`, `Float[0.0...1.0]`, `Float[0.0..]`, `non-nan-float`, `finite-float` |
 | String predicates | `lowercase-string`, `uppercase-string`, `numeric-string`, `decimal-int-string`, `octal-int-string`, `hex-int-string`, `literal-string` |
 | Paired complements | `non-lowercase-string`, `non-uppercase-string`, `non-numeric-string` |
 | Composed | `non-empty-lowercase-string`, `non-empty-uppercase-string`, `non-empty-literal-string` |
@@ -465,6 +466,18 @@ Notes:
   `source-rbs-synthesis-failed` `:info` diagnostic; the file
   falls back to no inline-RBS contribution and analysis
   continues.
+- When a method is declared **both** in `sig/` and by an
+  inline annotation, the `.rbs` wins for that one method and
+  the inline signature is dropped — reported as a
+  `source-rbs-annotation-not-honoured` `:info` naming both
+  files. Only the overlapping member stands down; every other
+  annotation in the file still binds, and the class keeps its
+  method surface. This matters while migrating in either
+  direction: rbs and Steep merge the two sources without
+  ranking them, so left to collide they fail the class's
+  definition build and every call on it — real methods and
+  typos alike — reads `Dynamic[top]`. Delete one of the two
+  declarations to make the inline one take effect.
 
 Full plugin documentation, configuration options (including
 the `require_magic_comment: false` host-context override the

data/docs/handbook/11-sig-gen.md

@@ -90,7 +90,7 @@ states:
 | `new-file` | No RBS file declares the receiver class at all. |
 | `new-method` | RBS file declares the class but not this method. |
 | `tighter-return` | RBS file declares the method, but the inferred return is a strict subtype of the declared return. |
-| `equivalent` | The inferred return is not a strict subtype of the declared one — identical, wider, or unrelated — so there is nothing to tighten. Silently skipped. |
+| `equivalent` | Nothing for `sig-gen` to propose: the inferred return is identical, wider or unrelated, or it is a narrowing the generator declines (a literal under a wider declaration, anything under a declared `void`). Silently skipped. |
 | `skipped` | Disqualified for one of the reasons below. |
 
 The `sig.skipped.*` reasons are:
@@ -129,6 +129,77 @@ its reason next to the rows that did emit. In text mode a
 one-line stderr summary counts the skipped methods per
 reason instead; stdout stays paste-clean.
 
+## Recording a gap the generator cannot close
+
+`sig-gen --diff` answers "is this declaration what the
+implementation proves?" for every method it can type. The
+answers it cannot give are the interesting ones: a
+`tighter-return` you decided not to apply, a method it
+skipped, a declaration with no `def` behind it at all. Each
+of those is a hand-written type, and a hand-written type
+that nobody wrote down a reason for is indistinguishable
+from one nobody has looked at since.
+
+The convention Rigor uses on its own `sig/` is a line in the
+member's RBS comment:
+
+```rbs
+class Registry
+  # sig-gen gap: #1234 — sig-gen types the body `untyped`
+  # (the ivar has no inferred field type yet), so this
+  # return is hand-written until it can prove one.
+  def resolve: (String name) -> Entry
+end
+```
+
+A `void` return needs no marker. `sig-gen` never proposes a
+value for one: `void` says the return is not part of the
+contract, and no inference synthesizes it, so a `void`
+declaration is authored intent the way a parameter type is
+([ADR-14](../adr/14-rbs-sig-generation.md) § "The
+inference-vs-RBS contradiction rule").
+
+Neither does a declaration the body proves as a literal.
+`sig-gen` will not propose `"bot"` for a `def describe: ()
+-> String` whose body is the string `"bot"`: the declared
+type is your abstraction over that body, and pinning the
+literal would rewrite a contract every sibling class shares.
+A method no `.rbs` declares is unaffected — the literal is
+still the strictest thing the body proves, and that is what
+gets written.
+
+A comment rather than a `%a{…}` annotation, for three
+reasons: it stays out of the `rigor:v1:` directive namespace
+(`docs/type-specification/rbs-extended.md`), no engine path
+reads it, and `RBS::Parser` binds it to the member, so a
+check can find it on the AST instead of scanning lines. The
+issue number is the load-bearing half — it points at the
+engine work that would let the generator answer, which is
+the [ADR-14](../adr/14-rbs-sig-generation.md) rule that a
+gap pushing you toward hand-written RBS is the more valuable
+signal.
+
+Nothing in the CLI requires this. It is a convention you can
+gate in your own suite: parse `sig/**/*.rbs`, run the
+generator, and fail on a declaration that is neither
+generated-equivalent nor marked. Rigor's own gate is
+`spec/rigor/sig_gen/provenance_spec.rb`
+([ADR-107](../adr/107-checked-types-and-typeless-comments.md)
+G3).
+
+One case in that list is not a marker case at all. A
+declaration with no `def` behind it may simply describe a
+method Ruby generates — an `attr_*`, a `Data` member, one a
+class macro defines at load — or it may be left over from a
+`def` that was deleted or renamed, which nothing catches,
+because `rigor check` and Steep both ask whether the
+implementation matches `sig/` and never the converse.
+Rigor's gate separates the two by asking its own
+project index and then the loaded tree
+([#839](https://github.com/rigortype/rigor/issues/839)).
+That check requires the code under `sig/`, so it stays a
+repository gate: `sig-gen` in your project is unchanged.
+
 ## What method shapes the generator covers
 
 Slice-by-slice (each shipped via a CHANGELOG entry — this

data/docs/handbook/README.md

@@ -105,7 +105,7 @@ choices.
   conditional / mapped types do not have a Rigor analogue.
 - [**Coming from PHPStan**](appendix-phpstan.md) — the
   closest peer in spirit. Identical refinement vocabulary
-  (`non-empty-string`, `int<min, max>`, `numeric-string`,
+  (`non-empty-string`, `Integer[min..max]`, `numeric-string`,
   `literal-string`), `@phpstan-assert*` ↔ `RBS::Extended`,
   Type-Specifying Extensions ↔ plugins, baseline diffing.
 - [**Coming from mypy / Pyright**](appendix-mypy.md) — gradual

data/docs/handbook/appendix-elixir.md

@@ -224,7 +224,7 @@ end
 | --- | --- | --- |
 | `positive-int` | `when n > 0` | Rigor names and carries the result. |
 | `non-empty-string` | `when s != ""` / `byte_size(s) > 0` | Rigor produces it from `unless s.empty?`. |
-| `int<1, 9>` | `when x in 1..9` | Rigor's range carrier handles arbitrary bounds. |
+| `Integer[1..9]` | `when x in 1..9` | Rigor's range carrier handles arbitrary bounds. |
 | `non-empty-array[T]` | `when xs != []` | Rigor produces it from `unless arr.empty?`. |
 | `numeric-string` | `Integer.parse/1` + match | No direct Elixir analogue. |
 
@@ -283,7 +283,7 @@ The other direction:
   and Elixir's types do not fold call results to singleton
   types this way.
 - **Named refinement carriers.** `non-empty-string`,
-  `positive-int`, `int<1, 9>`, `numeric-string` — first-class,
+  `positive-int`, `Integer[1..9]`, `numeric-string` — first-class,
   named, and flowed onward from a guard.
 - **Inferred object shapes and capability roles.** Beyond
   behaviours and protocols, Rigor infers anonymous structural

data/docs/handbook/appendix-go.md

@@ -243,7 +243,7 @@ carriers that encode an invariant on the value.
 | --- | --- | --- |
 | `non-empty-string` | runtime `if len(s) == 0` check | Rigor produces it from `unless s.empty?`. |
 | `positive-int` | runtime `if n <= 0` check | Rigor narrows from `n > 0`. |
-| `int<1, 9>` | runtime range check | Rigor's range carrier handles arbitrary bounds. |
+| `Integer[1..9]` | runtime range check | Rigor's range carrier handles arbitrary bounds. |
 | `numeric-string` | `strconv.Atoi` + error check | No type-level analogue in Go. |
 | `non-empty-array[T]` | runtime `len(xs) == 0` check | Rigor produces it from `unless arr.empty?`. |
 
@@ -311,7 +311,7 @@ is deliberately minimal:
 - **Constant folding through method calls.** `"foo".upcase` is
   `Constant<"FOO">`, not `string`.
 - **Refinements.** `non-empty-string`, `positive-int`,
-  `int<1, 9>` — invariants on the value, no runtime check needed
+  `Integer[1..9]` — invariants on the value, no runtime check needed
   to know them statically.
 - **Inferred shapes beyond interfaces.** Rigor infers anonymous
   object shapes and capability roles, not just satisfaction of a

data/docs/handbook/appendix-java-csharp.md

@@ -292,7 +292,7 @@ class refinement carriers, produced automatically by narrowing.
 | --- | --- | --- |
 | `non-empty-string` | a `NonEmptyString` value class wrapping validation | Rigor produces it from `unless s.empty?`, no wrapper type. |
 | `positive-int` | a `PositiveInt` value object, or a runtime guard | Rigor narrows from `n > 0`. |
-| `int<1, 9>` | an `enum` of nine constants, or a range check | Rigor's range carrier handles arbitrary bounds without enumerating them. |
+| `Integer[1..9]` | an `enum` of nine constants, or a range check | Rigor's range carrier handles arbitrary bounds without enumerating them. |
 | `numeric-string` | `string` + `int.TryParse` discipline | No type-level analogue in either language. |
 | `non-empty-array[T]` | a non-empty-collection value class | Rigor produces it from `unless arr.empty?`. |
 
@@ -379,7 +379,7 @@ longer than you might expect, because neither has literal types:
   `Constant<"FOO">`, not `String`. Rigor catalogues which
   built-in methods are pure and folds through them.
 - **First-class refinements.** `non-empty-string`, `positive-int`,
-  `int<1, 9>`, `numeric-string` — invariants on ordinary types,
+  `Integer[1..9]`, `numeric-string` — invariants on ordinary types,
   no value-class wrapper.
 - **Structural facets without a declaration.** A Ruby object that
   has the right methods satisfies an RBS `interface` (a

data/docs/handbook/appendix-mypy.md

@@ -71,7 +71,7 @@ features one at a time (`Literal`, `LiteralString`, `TypeIs`,
 | `non-empty-string` | (no built-in; PEP 675's `LiteralString` is closest in spirit but different in semantics) |
 | `literal-string` | `LiteralString` (PEP 675) — provably built from source-code literals. **Direct match.** |
 | `positive-int` | (no built-in; convention is `Annotated[int, Gt(0)]` with third-party validators) |
-| `int<min, max>` | (no built-in; same `Annotated[int, Range(...)]` convention) |
+| `Integer[min..max]` | (no built-in; same `Annotated[int, Range(...)]` convention) |
 | `numeric-string` | (no built-in) |
 | `non-empty-array[T]` | (no built-in; some libraries use `tuple[T, *tuple[T, ...]]`) |
 | `Constant<42>` | `Literal[42]` |
@@ -286,7 +286,7 @@ draws the distinction in full.
   `Hash`.
 - **First-class refinement carriers with narrowing.**
   `non-empty-string`, `positive-int`, `numeric-string`,
-  `int<min, max>` — values restricted by predicate, narrowed
+  `Integer[min..max]` — values restricted by predicate, narrowed
   by the corresponding Ruby predicate methods.
 - **No-false-positives stance.** mypy will warn about dynamic
   code unless `--no-warn-unused-ignores` or `--ignore-missing-imports`

data/docs/handbook/appendix-phpstan.md

@@ -53,7 +53,7 @@ is the closest match of any peer.
 | `numeric-string` | `numeric-string` | Identical. |
 | `lowercase-string` | `lowercase-string` | Identical. |
 | `class-string` | `Singleton[T]` | Equivalent shape. |
-| `int<1, 9>` | `int<1, 9>` | **Identical syntax.** |
+| `int<1, 9>` | `Integer[1..9]` | Same carrier; Rigor spells the bound as the Ruby range literal `Range#cover?` reads (`Integer[1..]`, `Integer[..9]`). |
 | `positive-int` | `positive-int` | Identical. |
 | `negative-int` | `negative-int` | Identical. |
 | `non-zero-int` | `non-zero-int` | Identical. |

data/docs/handbook/appendix-rust.md

@@ -274,7 +274,7 @@ by narrowing.
 | --- | --- | --- |
 | `non-empty-string` | `struct NonEmptyString(String)` newtype | Rigor produces it from `unless s.empty?`, no wrapper. |
 | `positive-int` | `struct PositiveInt(u32)` newtype | Rigor narrows from `n > 0`. |
-| `int<1, 9>` | newtype + range check, or const generics gymnastics | Rigor's range carrier handles arbitrary bounds directly. |
+| `Integer[1..9]` | newtype + range check, or const generics gymnastics | Rigor's range carrier handles arbitrary bounds directly. |
 | `numeric-string` | newtype wrapping validated parse | No type-level analogue. |
 | `non-empty-array[T]` | newtype over `Vec<T>` | Rigor produces it from `unless arr.empty?`. |