rigortype 0.3.8 → 0.3.9

data/lib/rigor/analysis/check_rules/published_constant_guard.rb

@@ -50,11 +50,18 @@ module Rigor
       #   passage is the precedent for stopping at one hop rather than building a provenance channel through
       #   the return memo.
       #
-      # Deliberately NOT covered, and a separate change: a value copied into a local (`m = MODE; m == :x`),
-      # into an ivar (`@mode = MODE` in `initialize`), or through a same-file constant alias
-      # (`MODE2 = AppConfig::MODE`). Each needs flow provenance — ADR-58's `r = @x` stamping is the shape —
-      # rather than a syntactic root walk, and approximating it here is exactly the ad-hoc widening ADR-58's
-      # *Non-transitivity* passage forbids. Two hops (`live? -> prod? -> MODE`) also stay uncovered.
+      # - a value COPIED out of such a constant before the predicate reads it (issue #667) — into a local
+      #   (`m = AppConfig::MODE; m == :x`), into an ivar (`@mode = AppConfig::MODE` in `initialize`), or
+      #   through a same-file alias (`MODE2 = AppConfig::MODE`). A copy has no spelling for the root walk to
+      #   recognise, so the provenance is stamped on the value where the copy happens and travels with it:
+      #   the first two on the `Scope` flow carrier `published_constant_sourced` (dropped by any rebinding,
+      #   unioned at a join), the alias on the per-file `published_constant_alias_names` census table, which
+      #   needs no flow machinery at all because a constant write is not flow. This walk only READS those
+      #   marks — the widening ADR-58's *Non-transitivity* passage forbids is inferring one AT a consumer,
+      #   and the establishing transitions are named in
+      #   `docs/internal-spec/inference-engine.md` § "The truthiness withholding".
+      #
+      # Deliberately NOT covered: two interprocedural hops (`live? -> prod? -> MODE`).
       module PublishedConstantGuard
         # A defensive depth cap against a pathological chain (the walk is otherwise linear in chain length).
         MAX_DEPTH = 64
@@ -66,13 +73,15 @@ module Rigor
 
         module_function
 
-        # @return [Boolean] true when the rule MUST withhold its firing.
+        # @return true when the rule MUST withhold its firing.
         def rooted?(node, scope, depth = 0)
           return false if node.nil? || depth > MAX_DEPTH || scope.nil?
 
           case node
           when Prism::ConstantReadNode then scope.published_constant?(node.name.to_s)
           when Prism::ConstantPathNode then published_path?(node, scope)
+          when Prism::LocalVariableReadNode then scope.published_constant_sourced?(:local, node.name)
+          when Prism::InstanceVariableReadNode then scope.published_constant_sourced?(:ivar, node.name)
           when Prism::CallNode then rooted_call?(node, scope, depth)
           else rooted_through_composition?(node, scope, depth)
           end

data/lib/rigor/analysis/check_rules/rule_ids.rb

@@ -137,7 +137,7 @@ module Rigor
       # first segment appears here as KNOWN and stays silent: these ids are legitimate suppression /
       # `severity_overrides:` vocabulary the light rule-id table cannot enumerate (plugins load dynamically;
       # aggregator ids live in the engine-heavy runner), so under-warning is the FP-safe direction.
-      NON_CHECK_DIAGNOSTIC_FAMILIES = %w[rbs_extended dynamic rbs pre-eval plugin].freeze
+      NON_CHECK_DIAGNOSTIC_FAMILIES = %w[rbs_extended dynamic rbs pre-eval plugin plugin_trust].freeze
 
       # Bare (dot-less) diagnostic ids the engine emits outside the catalogue (see the `rule:` literals in
       # `Analysis::Runner` / `Runner::DiagnosticAggregator`). A token equal to one of these is treated as

data/lib/rigor/analysis/check_rules/rule_walk.rb

@@ -40,11 +40,26 @@ module Rigor
 
         CLASS_OR_MODULE_NODE_CLASSES = [Prism::ClassNode, Prism::ModuleNode].freeze
 
+        # Issue #909 — the receivers whose block form opens a class body that is NOT the lexically enclosing
+        # class: `Class.new do … end`, `Module.new`, `Struct.new`, `Data.define`. A `def` in such a block
+        # belongs to the anonymous class the call returns, so its ivar writes are a different store from the
+        # enclosing class's.
+        DETACHED_CLASS_FACTORIES = {
+          Class: %i[new],
+          Module: %i[new],
+          Struct: %i[new],
+          Data: %i[define]
+        }.freeze
+        private_constant :DETACHED_CLASS_FACTORIES
+
+        EMPTY_METHODS = [].freeze
+        private_constant :EMPTY_METHODS
+
         # The immutable per-node descent context. Recomputed for each child from its parent's context as the
         # walk descends; collectors read only the fields they declared a need for.
-        Context = Data.define(:in_loop_or_block, :qualified_prefix, :inside_def) do
+        Context = Data.define(:in_loop_or_block, :qualified_prefix, :inside_def, :detached_ivar_facet) do
           def self.root
-            new(in_loop_or_block: false, qualified_prefix: [], inside_def: false)
+            new(in_loop_or_block: false, qualified_prefix: [], inside_def: false, detached_ivar_facet: false)
           end
         end
 
@@ -58,9 +73,13 @@ module Rigor
         # - `:inside_def` (`inside_def`) — lexically inside a `DefNode`; IvarWrite collects only at a `def`
         #   that sits directly in a class / module body (its legacy walk `return`s at the first `def` it
         #   meets, so a nested def is never reached).
+        # - `:detached_ivar_facet` (`detached_ivar_facet`) — under a `class << self` body or an
+        #   anonymous-class factory block, where the enclosing class name does not name the ivar store the
+        #   body writes to.
         GATE_CONTEXT_PREDICATES = {
           loop_or_block: :in_loop_or_block,
-          inside_def: :inside_def
+          inside_def: :inside_def,
+          detached_ivar_facet: :detached_ivar_facet
         }.freeze
 
         # A per-node driver over a fixed collector set: holds the compiled `node_class => [[collector,
@@ -124,14 +143,30 @@ module Rigor
                                LOOP_OR_BLOCK_NODE_CLASSES.any? { |klass| node.is_a?(klass) }
             inside_def = context.inside_def || node.is_a?(Prism::DefNode)
             qualified_prefix = extend_prefix(node, context.qualified_prefix)
+            detached_ivar_facet = context.detached_ivar_facet || detached_ivar_facet?(node)
 
             Context.new(
               in_loop_or_block: in_loop_or_block,
               qualified_prefix: qualified_prefix,
-              inside_def: inside_def
+              inside_def: inside_def,
+              detached_ivar_facet: detached_ivar_facet
             )
           end
 
+          # True for a node whose descendants write ivars to a store the enclosing class name does not name:
+          # a `class << self` body (the class object's own ivars) or a call that builds an anonymous class
+          # from a block. Every singleton-class body counts, `class << Konstant` included: whichever object's
+          # singleton it opens, it is not the instance facet the enclosing prefix names.
+          def detached_ivar_facet?(node)
+            return true if node.is_a?(Prism::SingletonClassNode)
+            return false unless node.is_a?(Prism::CallNode) && node.block.is_a?(Prism::BlockNode)
+
+            receiver = node.receiver
+            return false unless receiver.is_a?(Prism::ConstantReadNode)
+
+            DETACHED_CLASS_FACTORIES.fetch(receiver.name, EMPTY_METHODS).include?(node.name)
+          end
+
           private
 
           def collector_gates(collector)

data/lib/rigor/analysis/check_rules/self_closedness_scanner.rb

@@ -29,7 +29,7 @@ module Rigor
           @root = root
         end
 
-        # @return [Set<String>] qualified names to exclude from the rule.
+        # @return qualified names to exclude from the rule.
         def open_class_names
           names = Set.new
           walk(@root, [], names)

data/lib/rigor/analysis/check_rules/shadowed_rescue_collector.rb

@@ -58,7 +58,7 @@ module Rigor
         # Legacy single-collector walk — the oracle the shadow harness (`RIGOR_SHADOW_RULE_WALK=1`) compares
         # the shared {RuleWalk} traversal against. Tracks the lexical class / module prefix itself, exactly
         # as {RuleWalk} threads `qualified_prefix`.
-        # @return [Array<Result>] one entry per provably-shadowed rescue clause.
+        # @return one entry per provably-shadowed rescue clause.
         def collect(root)
           walk(root, [])
           @results.freeze

data/lib/rigor/analysis/check_rules/unreachable_clause_collector.rb

@@ -42,7 +42,7 @@ module Rigor
         DEFENSIVE_EXIT_CALLS = %i[raise fail throw abort exit].freeze
 
         # @!attribute kind
-        #   @return [Symbol] `:disjoint` (this clause's type is disjoint
+        #   @return `:disjoint` (this clause's type is disjoint
         #     from the still-possible subject), `:prior_exhaustion` (an
         #     earlier clause already covered the subject), or
         #     `:exhausted_else` (every subject value is covered, so the
@@ -63,7 +63,7 @@ module Rigor
 
         # Legacy single-collector walk — kept as the oracle the ADR-53 Track B equivalence harness compares
         # {RuleWalk} against; deleted when Track B completes.
-        # @return [Array<Result>] one entry per provably-dead `when` clause.
+        # @return one entry per provably-dead `when` clause.
         def collect(root)
           walk(root, in_loop_or_block: false)
           @results.freeze

data/lib/rigor/analysis/check_rules/void_value_use_collector.rb

@@ -52,7 +52,6 @@ module Rigor
         # Legacy single-collector walk — kept as the oracle the ADR-53 Track B equivalence harness compares
         # {RuleWalk} against. Walks the whole subtree once, checking each consumer node's value slots.
         # Returns one {Result} per value-context use of a recovered-`void` call.
-        # @return [Array<Result>]
         def collect(root)
           walk(root)
           @results.freeze

data/lib/rigor/analysis/check_rules.rb

@@ -83,11 +83,8 @@ module Rigor
       # have already produced `scope_index` through
       # `Rigor::Inference::ScopeIndexer.index(root, default_scope:)`.
       #
-      # @param path [String] used to populate
+      # @param path — used to populate
       #   `Diagnostic#path`; the rule does not open files.
-      # @param root [Prism::Node]
-      # @param scope_index [Hash{Prism::Node => Rigor::Scope}]
-      # @return [Array<Rigor::Analysis::Diagnostic>]
       #
       # ADR-53 B4 — when `node_collectors` is supplied, the converged
       # {Plugin::NodeRuleWalk} traversal has already populated the built-in
@@ -490,7 +487,7 @@ module Rigor
         /\A#\s*rigor:(?<marker>disable-(?!file(?![\w-]))[\w-]+|enable(?:-[\w-]+)?)(?![\w-])(?<rest>.*)/
       private_constant :UNKNOWN_SUPPRESSION_MARKER
 
-      # @return [Array<(Hash{Integer => Set}, Set)>] pair of
+      # @return pair of
       #   `(line_suppressions, file_suppressions)`. Line
       #   suppressions are keyed by source line number; file
       #   suppressions apply to every line.
@@ -717,7 +714,7 @@ module Rigor
           # because the real type is empty (the real `DRb` has
           # `start_service`), so enumerating it to prove a call
           # "undefined" would be a false positive.
-          return nil if unenumerable_receiver?(class_name, scope)
+          return nil if unenumerable_receiver?(receiver_type, class_name, scope)
 
           # Slice 7 phase 12 — suppress when the user has
           # declared the method in source (`def` /
@@ -976,10 +973,32 @@ module Rigor
         # the scalar rule enumerated `Module`'s own RBS instead and reported them.
         #
         # Kept beside `unbounded_receiver_surface?` rather than folded into it: that predicate has eight
-        # other callers (arity, the `raise` verdicts), and widening all of them is a separate change with
-        # its own evidence to gather.
-        def unenumerable_receiver?(class_name, scope)
-          METACLASS_ARMS.include?(class_name) || unbounded_receiver_surface?(class_name, scope)
+        # other callers, and #742 had no evidence that any of them spoke on these receivers.
+        #
+        # Issue #879 supplied it for exactly one — `call.wrong-arity`, which decided `v.hexdigest(1, 2, 3)`
+        # against `Digest::Instance`'s declaration on the same run where `v.no_such_method_zzz` was declined
+        # as unenumerable. One receiver, one run, two answers about whether that surface can be read. The
+        # reporter could make no other caller speak: `raise` on a module- or `Class`-typed operand is silent,
+        # and `Class`-typed `.new` with a wrong arity is silent too, so the other seven stay on
+        # `unbounded_receiver_surface?` until something demonstrates otherwise.
+        #
+        # Arity takes {#unenumerable_receiver_shape?}, not this whole predicate: ADR-26's open receivers are
+        # handled for the signature-reading rules by {#unauthoritative_inherited_signature?}, which is
+        # deliberately narrower — a method the open class DECLARES itself keeps its arity check.
+        def unenumerable_receiver?(receiver_type, class_name, scope)
+          unenumerable_receiver_shape?(receiver_type, class_name, scope) ||
+            unbounded_receiver_surface?(class_name, scope)
+        end
+
+        # The receiver shapes whose method surface cannot be enumerated at all, whatever the environment
+        # declares: a generic metaclass value, and an instance-side mixin-module type — an instance of some
+        # unknown class that includes the module, which may declare the name with any arity of its own
+        # (#739's reasoning, applied to the signature rather than to the method's existence).
+        #
+        # Instance-side only, for #739's reason: `Singleton[M]` on a namespace module is a real, enumerable
+        # surface, and `M.helper(1, 2, 3)` must keep firing.
+        def unenumerable_receiver_shape?(receiver_type, class_name, scope)
+          METACLASS_ARMS.include?(class_name) || module_mixin_receiver?(receiver_type, scope)
         end
 
         # Issue #746 — a class that includes a module the environment does not know. `SudoMode::Form`
@@ -1030,7 +1049,7 @@ module Rigor
           # about it instead of bailing. `Type::Refined` carries string-family
           # refinements (`lowercase-string`, …) over an explicit `.base`;
           # `Type::IntegerRange` carries the bounded-int refinements
-          # (`non-negative-int`, `positive-int`, `int<1,5>`), every one an
+          # (`non-negative-int`, `positive-int`, `Integer[1..5]`), every one an
           # Integer; `Type::Difference` (`A - B`) carries the non-empty /
           # non-zero refinements (`non-empty-string` = `String - ""`,
           # `non-empty-array` = `Array - []`, `non-zero-int` = `Integer - 0`)
@@ -1038,6 +1057,7 @@ module Rigor
           # base (minuend) class dispatches.
           when Type::Refined, Type::Difference then concrete_class_name(type.base)
           when Type::IntegerRange then "Integer"
+          when Type::FloatRange then "Float"
           end
         end
 
@@ -1097,7 +1117,11 @@ module Rigor
         # audit), so declaring even its reader surface makes it RBS-known — and, without this, every member
         # the declaration omits would become a false `call.undefined-method` for every project that locks
         # activesupport, the overwhelming majority of which never opt into the plugin at all.
-        GEM_OVERLAY_OPEN_RECEIVERS = Set["ActiveSupport::Duration"].freeze
+        # `ActiveSupport::Concern` joined it in #534 item 7. `class_methods do … end` synthesizes a
+        # `ClassMethods` constant and `append_features` / `prepend_features` are part of the real surface,
+        # none of which the two-line declaration enumerates — and a concern module is the receiver of that
+        # surface in every Rails app, so the same argument applies with the same force.
+        GEM_OVERLAY_OPEN_RECEIVERS = Set["ActiveSupport::Duration", "ActiveSupport::Concern"].freeze
         private_constant :GEM_OVERLAY_OPEN_RECEIVERS
 
         # ADR-26 — whether `class_name` is declared "open" by a
@@ -1441,6 +1465,12 @@ module Rigor
           class_name = concrete_class_name(receiver_type)
           return nil if class_name.nil?
 
+          # Issue #879 — the receiver whose surface `call.undefined-method` already refuses to enumerate.
+          # Deciding an arity against a declaration this rule cannot prove the receiver actually runs is the
+          # same unsoundness in signature form: the includer may declare the name with a wider arity, and
+          # then the call is correct code.
+          return nil if unenumerable_receiver_shape?(receiver_type, class_name, scope)
+
           kind = receiver_type.is_a?(Type::Singleton) ? :singleton : :instance
           # `Struct.new(:a, :b).new(...)` chained: the inner
           # `Struct.new(...)` is an anonymous Struct *subclass* whose
@@ -1458,6 +1488,7 @@ module Rigor
 
           method_def = trustworthy_signature(receiver_type, class_name, call_node, scope)
           return nil if method_def.nil?
+          return nil if undeclared_constructor?(class_name, call_node, kind, method_def)
 
           arity_envelope = compute_arity_envelope(method_def)
           return nil if arity_envelope.nil?
@@ -1469,6 +1500,25 @@ module Rigor
           build_arity_diagnostic(path, call_node, class_name, min, max, actual)
         end
 
+        # Issue #917 — no loaded RBS declares a constructor for this class. The definition builder
+        # synthesizes `.new` from the nearest `initialize` in the ancestry, and when nothing declares
+        # one that is `BasicObject#initialize: () -> void`, so `.new` derives a nullary envelope that
+        # is an artifact of the fallback rather than a statement about the class. `Gem::Specification`
+        # is declared in full by the vendored rubygems sigs except for its constructor, and every
+        # argument at the real one was reported. The rule needs "this class declares a nullary
+        # constructor", and only a `defined_in` naming a class other than `BasicObject` is that
+        # evidence — except on `BasicObject` and `Object` themselves, where the declaration is their
+        # own and `.new` really does take no arguments.
+        def undeclared_constructor?(class_name, call_node, kind, method_def)
+          return false unless kind == :singleton && call_node.name == :new
+          return false unless method_def.respond_to?(:defined_in)
+
+          defined_in = method_def.defined_in
+          return false unless defined_in.nil? || strip_root(defined_in.to_s) == "BasicObject"
+
+          !%w[BasicObject Object].include?(strip_root(class_name))
+        end
+
         # True for the outer `.new` of a chained `Struct.new(...).new`:
         # `class_name`/`kind` already pin the receiver to
         # `Singleton[Struct]`, and the receiver node is itself a
@@ -2385,8 +2435,10 @@ module Rigor
         #   overload requires the dispatcher's full
         #   acceptance plumbing.
         # - The selected overload must have NO
-        #   rest_positionals, NO required keywords, NO
-        #   trailing positionals.
+        #   rest_positionals and NO trailing positionals —
+        #   the two shapes under which argument N no longer
+        #   binds to positional parameter N. Keyword
+        #   parameters do not disqualify it (#673).
         # - The call must use plain positional arguments
         #   (no splat / kw / block-pass / forwarded).
         # - Per-argument: skip when EITHER side is `Dynamic`
@@ -2478,13 +2530,46 @@ module Rigor
         # (a single-concrete-class argument every overload rejects). See
         # {#multi_overload_argument_mismatch}.
         def argument_mismatch(method_types, call_node, scope, param_overrides)
-          if method_types.size == 1
-            first_argument_mismatch(method_types.first, call_node, scope, param_overrides)
-          else
-            multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides)
+          mismatch =
+            if method_types.size == 1
+              first_argument_mismatch(method_types.first, call_node, scope, param_overrides)
+            else
+              multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides)
+            end
+          return nil if mismatch && keyword_bearing?(method_types) && nil_tainted?(mismatch[:actual])
+
+          mismatch
+        end
+
+        # Issue #673 widened {#argument_check_eligible?} to admit keyword-bearing signatures, whose
+        # POSITIONAL arguments had gone unchecked. The widening is staged, and this is the half held
+        # back: on such a signature only an argument refuted on its CLASS fires; one carrying `nil`
+        # does not.
+        #
+        # Measured, not assumed. Across redmine, mastodon, tdiary-core, faraday, liquid and
+        # rubocop-ast the widening produced exactly two new verdicts, both on correct code and both
+        # resting on nullability: `Addrinfo.foreach(host, nil, nil, :STREAM)` (redmine — a nil service
+        # is legal at runtime; rbs declares the parameter `String | ::Integer`) and
+        # `Nokogiri::HTML5(html)` guarded by `return if html.nil?` one line above (mastodon — the guard
+        # is on a method call, so the type stays `Dynamic[top]?`). Zero class-refuted new verdicts were
+        # false. Nullability is the property a hand-written signature most often over-declares, so it
+        # stays behind the old envelope until it has evidence of its own.
+        #
+        # Signatures WITHOUT keywords are untouched: `"a" + nil` fires exactly as before.
+        def keyword_bearing?(method_types)
+          method_types.any? do |method_type|
+            function = method_type.type
+            next false unless function.respond_to?(:required_keywords)
+
+            !function.required_keywords.empty? || !function.optional_keywords.empty? ||
+              !function.rest_keywords.nil?
           end
         end
 
+        def nil_tainted?(actual)
+          nil_member?(actual) || (actual.is_a?(Type::Union) && union_contains_nil?(actual))
+        end
+
         # Multi-overload argument-type-mismatch. The dispatcher's per-overload
         # acceptance plumbing is not run here; instead the FP-safe shape mirrors
         # the "absent on every arm" union-undefined-method rule: an argument is
@@ -2509,8 +2594,8 @@ module Rigor
           arguments = call_node.arguments&.arguments || []
           arguments.each_with_index do |arg, index|
             arg_type = scope.type_of(arg)
-            params = overload_positional_params(method_types, index)
-            next if params.nil? # arity divergence — some overload lacks a param here
+            params = checkable_overload_params(method_types, index, param_overrides, scope)
+            next if params.nil?
 
             mismatch =
               if nil_member?(arg_type) # pure nil only — not a `T | nil` union
@@ -2523,6 +2608,19 @@ module Rigor
           nil
         end
 
+        # The parameter set at `index` that a verdict may rest on, or nil when there is none — the two
+        # reasons being arity divergence (an overload with no param there, which is `call.wrong-arity`'s
+        # concern) and an overload whose param names a class carrying no definition ({#stub_typed_param?},
+        # issue #661). Both channels below fire only when EVERY overload rejects, so either one is enough
+        # to unseat that premise.
+        def checkable_overload_params(method_types, index, param_overrides, scope)
+          params = overload_positional_params(method_types, index)
+          return nil if params.nil?
+          return nil if params.any? { |param| stub_typed_param?(param, param_overrides, scope) }
+
+          params
+        end
+
         # The nil channel: a pure `nil` argument no overload admits (ADR-58
         # parity excuses a declaration-sourced ivar nil).
         def nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
@@ -2568,6 +2666,53 @@ module Rigor
           param.map_type { |type| type.sub(substitution) }
         end
 
+        # ADR-26 WD8's PARAMETER-side twin (issue #661). `sig/app.rbs` declaring
+        # `(ActiveSupport::TimeWithZone) -> void` in a project that never brings ActiveSupport's RBS in
+        # names a class that carries no definition anywhere in the environment. Rigor still refuted
+        # `App.take_twz(Time.now)` against it — `expected ActiveSupport::TimeWithZone, got Time` on a call
+        # that works — because the acceptance walk compares nominals and `Time`'s ancestry does not list a
+        # name nothing declares.
+        #
+        # WD8 already declines the two signature rules on such a RECEIVER, on the ground that there is
+        # nothing authoritative to check the call against. It is the same one position over: with no
+        # ancestry there is no fact that could make an argument satisfy the parameter either, so the
+        # rejection is the missing signature restated as an error rather than a finding about the program.
+        # Under AGENTS.md's false-positives-outrank-worst-case rule the honest answer is to decline, and
+        # the report it costs is one the analyzer never had evidence for.
+        #
+        # Both shapes the missing name arrives in are covered, deliberately as ONE criterion. A name an
+        # INSTANCE-method signature references is minted as an empty stub so the class builds
+        # ({Environment::RbsLoader.stub_missing_referenced_types}) and reads back as RBS-known; the same
+        # name in a SINGLETON signature is not, because that pass mirrors rbs's own membership test and
+        # `validate_type_params` never reaches singleton members. That asymmetry is an artifact of which
+        # pass ran, not of what is knowable, and the issue's own repro is the singleton half.
+        #
+        # A `rigor:v1:param` override is a real Rigor type the author wrote against the call site's own
+        # method, so it is consulted first and checked normally.
+        def stub_typed_param?(param, param_overrides, scope)
+          return false if param_overrides[param.name]
+
+          undefined_param_class?(param.type, scope)
+        end
+
+        # Only the arms a verdict can rest on directly: a union member, an optional's inner type, an
+        # expanded alias, and the class instance / singleton itself. Deliberately NOT recursive into type
+        # ARGUMENTS — `Array[Missing]` is still refuted by an `Integer` argument on the `Array` alone, and
+        # declining there would be a lost report bought for nothing.
+        def undefined_param_class?(rbs_type, scope)
+          case rbs_type
+          when RBS::Types::Union then rbs_type.types.any? { |member| undefined_param_class?(member, scope) }
+          when RBS::Types::Optional then undefined_param_class?(rbs_type.type, scope)
+          when RBS::Types::Alias
+            expanded = scope.environment&.rbs_loader&.expand_type_alias(rbs_type)
+            !expanded.nil? && undefined_param_class?(expanded, scope)
+          when RBS::Types::ClassInstance, RBS::Types::ClassSingleton
+            name = rbs_type.name
+            synthesized_stub_receiver?(name, scope) || !Rigor::Reflection.rbs_class_known?(name.to_s, scope: scope)
+          else false
+          end
+        end
+
         # The class names whose instances `nil` IS — `NilClass` and every
         # ancestor. A parameter typed as any other class instance rejects nil.
         NIL_COMPATIBLE_CLASS_NAMES = %w[NilClass Object BasicObject Kernel].to_set.freeze
@@ -2770,6 +2915,8 @@ module Rigor
         # the original translated-acceptance check, with a `rigor:v1:param`
         # override taking precedence over the RBS-declared type.
         def single_argument_mismatch(param, arg, scope, param_overrides)
+          return nil if stub_typed_param?(param, param_overrides, scope)
+
           arg_type = scope.type_of(arg)
 
           if nil_member?(arg_type)
@@ -2824,17 +2971,29 @@ module Rigor
           Inference::Acceptance.accepts(param_type, non_nil, mode: :gradual).yes?
         end
 
+        # What this rule needs is that argument N binds to positional
+        # parameter N, so the only disqualifiers are the two shapes that
+        # break that mapping: a rest positional (arguments past it belong
+        # to the rest, not to a later parameter) and trailing positionals
+        # (the last arguments bind backwards from the end).
+        #
+        # Issue #673 — a keyword parameter used to disqualify the whole
+        # signature, which silently unchecked the POSITIONAL arguments of
+        # every keyword-bearing signature in the bundle:
+        # `time.beginning_of_week("monday")` fired while
+        # `time.next_week("monday")`, `(?Symbol, ?same_time: bool)`, did not,
+        # though both raise the same way at runtime. Keywords cannot shift a
+        # positional argument's index, and a call that PASSES keywords never
+        # reaches here at all — `plain_positional_call?` rejects a
+        # `KeywordHashNode` argument (`**opts` included) before the signature
+        # is consulted.
         def argument_check_eligible?(function)
           # See `arity_eligible?`: `UntypedFunction` lacks
           # the per-arity accessors. Treat it as ineligible
           # for argument-type-mismatch diagnostics.
           return false unless function.respond_to?(:required_keywords)
 
-          function.rest_positionals.nil? &&
-            function.required_keywords.empty? &&
-            function.optional_keywords.empty? &&
-            function.rest_keywords.nil? &&
-            function.trailing_positionals.empty?
+          function.rest_positionals.nil? && function.trailing_positionals.empty?
         end
 
         def translate_param_type(rbs_type, environment)
@@ -2911,6 +3070,14 @@ module Rigor
         #
         # - Skips methods without an RBS declaration. The rule has no contract to compare against for
         #   source-only methods.
+        # - Skips a `def` whose only declaration was resolved through an ANCESTOR. `Reflection`'s lookup
+        #   reads the fully resolved method table, so a signature written about a base class answers for
+        #   every subclass that inherits the name; comparing an override's body against it reports the
+        #   override wrong for disagreeing with a contract that was never written about it (#744, and
+        #   the four redmine sites in #856). ADR-35 already specifies this rule as comparing a method's
+        #   OWN declared return, and the sibling override rules gate on `defined_on?` — this one did not.
+        #   The inherited-declaration signal belongs to the ADR-35 family, which requires both sides
+        #   authored. Decided in ADR-110 WD3.
         # - Skips methods whose enclosing class isn't a `Type::Singleton` self_type that we can name
         #   (top-level / module-level methods land outside the rule).
         # - Skips methods whose body's last expression is absent or types as `Dynamic[top]` (the
@@ -2978,6 +3145,7 @@ module Rigor
               Reflection.singleton_method_definition(self_type.class_name, def_node.name, scope: scope)
             end
           return nil if method_def.nil?
+          return nil unless defined_on?(method_def, self_type.class_name)
 
           override = Rigor::RbsExtended.read_return_type_override(method_def, environment: scope.environment)
           return override if override
@@ -3156,9 +3324,15 @@ module Rigor
           names
         end
 
+        # Issue #732 — the predicate is asked of the SCOPE, not re-implemented here. This rule kept its own
+        # three-table copy until #723 widened the scope's with `discovered_methods` and left this one behind,
+        # so the two disagreed about exactly one shape (a project class with no instance def, no superclass
+        # and no include — `class Base; def self.build = :built; end`) with nothing observing the fork. #682
+        # made `Scope` the single owner of the candidate ORDER; this makes it the single owner of the
+        # predicate that filters those candidates too.
         def resolve_override_ancestor_name(scope, subclass_qualified, raw_ancestor)
           resolved = scope.ancestor_name_candidates(subclass_qualified, raw_ancestor)
-                          .find { |candidate| known_user_class?(scope, candidate) }
+                          .find { |candidate| scope.known_user_class?(candidate) }
           return resolved if resolved
 
           # ADR-46 slice 3 — the override checker reads the class graph
@@ -3172,12 +3346,6 @@ module Rigor
           nil
         end
 
-        def known_user_class?(scope, name)
-          scope.discovered_superclasses.key?(name) ||
-            scope.discovered_def_nodes.key?(name) ||
-            scope.discovered_includes.key?(name)
-        end
-
         def build_override_visibility_diagnostic(path, def_node, parent_class, parent_visibility, override_visibility)
           Diagnostic.from_name_loc(
             def_node,

data/lib/rigor/analysis/crash_signature.rb

@@ -87,12 +87,13 @@ module Rigor
       # user — every rule fired — but NOT a valid measurement of Rigor itself, so a harness that scores
       # Rigor's behaviour should treat one of these as a crash finding the way it treats `:check_rule`, or
       # a mutant that re-breaks the HKT scan (#776 was one) scores as a measurement over a silently degraded
-      # universe. What consults it today: `tool/mutation`'s fuzz crash detector — on the severity-resolved
-      # stream, so a `severity_overrides: rbs: off` hides the row from it. What does NOT yet: the ADR-69
-      # kill oracle (`Protection::AnalysisGuard` reads `Result#crashed?`, which excludes every
-      # `:rbs_build` row), and both harnesses still reuse one Environment across mutants, which memoises
-      # the degraded registry after the first defect. Arming the oracle, inspecting the pre-severity row,
-      # and resetting the Environment are issue #790.
+      # universe. Both Rigor-measuring harnesses consult it (#790): `tool/mutation`'s fuzz crash detector
+      # and {Protection::AnalysisGuard}, the ADR-69 kill oracles' refusal. Neither reads it alone — the row
+      # is severity-stamped like any other, so `severity_overrides:` can drop it from a run's diagnostics
+      # entirely, and each harness also reads {Rigor::Environment#hkt_scan_failure}, the pre-severity record
+      # the row is derived from. Both also replace their Environment after a defect: the registry build is
+      # memoised and the failure slot is first-write-wins, so an Environment that degraded once stays
+      # degraded for every later mutant.
       ANALYZER_DEFECT_RULES = %w[
         rbs.coverage.hkt-scan-failed
       ].freeze
@@ -103,9 +104,6 @@ module Rigor
       # into. Built here, not at either rescue site, so the two twins cannot drift (issue #665) — and so
       # the appended crash frame is derived identically on the sequential and pooled paths. Keeps the
       # {CHECK_RULE_MESSAGE_PREFIX} prefix every consumer matches on; the frame is a trailing hint.
-      #
-      # @param error [StandardError]
-      # @return [String]
       def check_rule_message(error)
         base = "#{CHECK_RULE_MESSAGE_PREFIX}: #{error.class}: #{error.message}"
         frame = crash_frame(error)
@@ -117,9 +115,6 @@ module Rigor
       # bundled or third-party plugin also lives under `lib/rigor/<plugin>/`, so a frame here says where
       # the raise was, never whose defect it is. Falls back to the raw top frame when the crash is entirely
       # inside a dependency, and to nil when there is no backtrace at all.
-      #
-      # @param error [Exception]
-      # @return [String, nil]
       def crash_frame(error)
         frames = error.backtrace
         return nil if frames.nil? || frames.empty?
@@ -132,15 +127,11 @@ module Rigor
       # (the fork pool) rather than deriving it fresh from a live `Exception` — can relativize the frame it
       # already has without re-deriving `.crash_frame`'s "which frame" choice. Nil-safe, and a no-op (`sub`
       # never matches) on a frame with no `lib/rigor/` segment at all.
-      #
-      # @param frame [String, nil]
-      # @return [String, nil]
       def relativize_frame(frame)
         frame&.sub(%r{\A.*/(lib/rigor/)}, '\1')
       end
 
-      # @param diagnostic [Rigor::Analysis::Diagnostic]
-      # @return [Symbol, nil] `:check_rule`, `:plugin`, `:rbs_build`, or nil for an ordinary diagnostic.
+      # @return `:check_rule`, `:plugin`, `:rbs_build`, or nil for an ordinary diagnostic.
       def reason(diagnostic)
         return :check_rule if diagnostic.message.to_s.start_with?(CHECK_RULE_MESSAGE_PREFIX)
         return :plugin if plugin_isolation_row?(diagnostic)
@@ -152,8 +143,6 @@ module Rigor
       # True when `diagnostic` is the rescue row that REPLACED a file's analysis — the only shape after which
       # the run's diagnostics say nothing about the code. NOT a general "something went wrong" predicate; see
       # the class doc for why `:plugin` and `:rbs_build` are excluded.
-      #
-      # @param diagnostic [Rigor::Analysis::Diagnostic]
       def discards_file_analysis?(diagnostic)
         reason(diagnostic) == DISCARDS_FILE_ANALYSIS_REASON
       end
@@ -162,17 +151,12 @@ module Rigor
       # measurement of Rigor — see {ANALYZER_DEFECT_RULES}. Orthogonal to {.discards_file_analysis?}: the
       # user-facing tier reads the run; the Rigor-measuring tier should refuse it (the mutation fuzz does,
       # the ADR-69 kill oracle does not yet — #790).
-      #
-      # @param diagnostic [Rigor::Analysis::Diagnostic]
       def analyzer_defect?(diagnostic)
         ANALYZER_DEFECT_RULES.include?(diagnostic.rule)
       end
 
       # A one-line "<reason> at <path>:<line>: <message>" for a failure message, so whoever reads the raise
       # sees which shape fired and where without re-deriving it.
-      #
-      # @param diagnostic [Rigor::Analysis::Diagnostic]
-      # @return [String]
       def describe(diagnostic)
         "#{reason(diagnostic) || :unknown} at #{diagnostic.path}:#{diagnostic.line}: #{diagnostic.message}"
       end