rigortype 0.3.8 → 0.4.0

data/lib/rigor/analysis/check_rules.rb

@@ -25,6 +25,9 @@ require_relative "check_rules/ivar_write_collector"
 require_relative "check_rules/main_pass_collector"
 require_relative "check_rules/void_value_use_collector"
 require_relative "check_rules/self_closedness_scanner"
+require_relative "check_rules/source_arity"
+require_relative "check_rules/lexical_method_sites"
+require_relative "check_rules/special_global_setters"
 
 module Rigor
   module Analysis
@@ -83,11 +86,8 @@ module Rigor
       # have already produced `scope_index` through
       # `Rigor::Inference::ScopeIndexer.index(root, default_scope:)`.
       #
-      # @param path [String] used to populate
+      # @param path — used to populate
       #   `Diagnostic#path`; the rule does not open files.
-      # @param root [Prism::Node]
-      # @param scope_index [Hash{Prism::Node => Rigor::Scope}]
-      # @return [Array<Rigor::Analysis::Diagnostic>]
       #
       # ADR-53 B4 — when `node_collectors` is supplied, the converged
       # {Plugin::NodeRuleWalk} traversal has already populated the built-in
@@ -138,24 +138,37 @@ module Rigor
       # (`diagnose`'s `Source::NodeWalker.each` `case`), now invoked by
       # {MainPassCollector} on the shared {RuleWalk}. Returns the
       # diagnostics for one node, in the same emission order as before.
-      def main_pass_node_diagnostics(path, node, scope_index)
+      def main_pass_node_diagnostics(path, node, scope_index, eval_ranges = nil, lexical_sites = nil)
         case node
         when Prism::CallNode
-          call_node_diagnostics(path, node, scope_index)
+          call_node_diagnostics(path, node, scope_index, eval_ranges, lexical_sites)
         when Prism::DefNode
           [
-            return_type_mismatch_diagnostic(path, node, scope_index),
+            refinement_aware_return_type_mismatch(path, node, scope_index, lexical_sites),
             override_visibility_diagnostic(path, node, scope_index),
             override_return_widened_diagnostic(path, node, scope_index),
             override_param_narrowed_diagnostic(path, node, scope_index)
           ].compact
         when Prism::IfNode, Prism::UnlessNode
           [unreachable_branch_diagnostic(path, node, scope_index)].compact
+        when Prism::GlobalVariableWriteNode, Prism::GlobalVariableOperatorWriteNode, Prism::MultiWriteNode
+          special_global_write_diagnostics(path, node, scope_index, lexical_sites)
         else
           []
         end
       end
 
+      # Issue #1120, maintainer ruling a′ — a `def` in a `refine X do … end` body redefines X's method by design, so
+      # X's declared return for the name is not its contract and a mismatch against it is not reported. Every other
+      # check in the body stands. The refine-body test runs only once a mismatch would report, so a file pays the
+      # {LexicalMethodSites} walk only then.
+      def refinement_aware_return_type_mismatch(path, node, scope_index, lexical_sites)
+        diagnostic = return_type_mismatch_diagnostic(path, node, scope_index)
+        return diagnostic if diagnostic.nil? || lexical_sites.nil?
+
+        lexical_sites.refinement_def?(node) ? nil : diagnostic
+      end
+
       # Constructs the fresh, unpopulated built-in collector set keyed by
       # role, including the main pass. Split out so the converged walk
       # (ADR-53 B4) can build the collectors, drive them via a
@@ -163,9 +176,12 @@ module Rigor
       # traversal, and hand the populated set back to {.diagnose} as
       # `node_collectors:`. The main pass needs `path` because its per-node
       # diagnostics carry it (ADR-53 B3c hosts it on the same walk).
-      def build_node_collectors(path, scope_index)
+      def build_node_collectors(path, scope_index, root = nil)
+        eval_ranges = receiver_eval_block_ranges(root)
+        lexical_sites = LexicalMethodSites.new(root)
+        main_pass = ->(node) { main_pass_node_diagnostics(path, node, scope_index, eval_ranges, lexical_sites) }
         {
-          main_pass: MainPassCollector.new(->(node) { main_pass_node_diagnostics(path, node, scope_index) }),
+          main_pass: MainPassCollector.new(main_pass),
           void_value_use: VoidValueUseCollector.new(scope_index),
           always_truthy: AlwaysTruthyConditionCollector.new(scope_index),
           unreachable_clauses: UnreachableClauseCollector.new(scope_index),
@@ -198,7 +214,7 @@ module Rigor
       # divergence aborts the run — the corpus-scale half of the
       # equivalence harness (the curated half is `rule_walk_equivalence_spec`).
       def run_node_collectors(path, root, scope_index)
-        collectors = build_node_collectors(path, scope_index)
+        collectors = build_node_collectors(path, scope_index, root)
         RuleWalk.run(root, collectors.values)
         shadow_verify_node_collectors(path, root, scope_index, collectors) if ENV["RIGOR_SHADOW_RULE_WALK"]
         collectors
@@ -242,8 +258,10 @@ module Rigor
       # produces them on the shared walk.
       def main_pass_oracle(path, root, scope_index)
         diagnostics = []
+        eval_ranges = receiver_eval_block_ranges(root)
+        lexical_sites = LexicalMethodSites.new(root)
         Source::NodeWalker.each(root) do |node|
-          diagnostics.concat(main_pass_node_diagnostics(path, node, scope_index))
+          diagnostics.concat(main_pass_node_diagnostics(path, node, scope_index, eval_ranges, lexical_sites))
         end
         diagnostics
       end
@@ -263,10 +281,10 @@ module Rigor
         shadow_verify_node_collectors(path, root, scope_index, collectors)
       end
 
-      def call_node_diagnostics(path, node, scope_index)
+      def call_node_diagnostics(path, node, scope_index, eval_ranges = nil, lexical_sites = nil)
         [
-          undefined_method_diagnostic(path, node, scope_index),
-          unresolved_toplevel_diagnostic(path, node, scope_index),
+          undefined_method_diagnostic(path, node, scope_index, lexical_sites),
+          unresolved_toplevel_diagnostic(path, node, scope_index, eval_ranges),
           wrong_arity_diagnostic(path, node, scope_index),
           argument_type_diagnostic(path, node, scope_index),
           nil_receiver_diagnostic(path, node, scope_index),
@@ -490,7 +508,7 @@ module Rigor
         /\A#\s*rigor:(?<marker>disable-(?!file(?![\w-]))[\w-]+|enable(?:-[\w-]+)?)(?![\w-])(?<rest>.*)/
       private_constant :UNKNOWN_SUPPRESSION_MARKER
 
-      # @return [Array<(Hash{Integer => Set}, Set)>] pair of
+      # @return pair of
       #   `(line_suppressions, file_suppressions)`. Line
       #   suppressions are keyed by source line number; file
       #   suppressions apply to every line.
@@ -660,7 +678,7 @@ module Rigor
       class << self
         private
 
-        def undefined_method_diagnostic(path, call_node, scope_index) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        def undefined_method_diagnostic(path, call_node, scope_index, lexical_sites = nil) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
           return nil if call_node.receiver.nil?
 
           scope = scope_index[call_node]
@@ -668,10 +686,20 @@ module Rigor
 
           # The two exemptions that hold whatever shape the receiver has. Ahead of the receiver-shape
           # branch below because a plugin is consulted ONCE for the whole receiver, union included, so the
-          # gate belongs where that one consult is rather than duplicated into each shape's path. On the
-          # union side that is placement, not demonstrated coverage: no fixture reaches the gate through
-          # `union_undefined_method_diagnostic` today — every plugin-typed union anyone has built carries a
-          # `Singleton` arm, which `union_arm_blocks_undefined_fire?` declines on outright.
+          # gate belongs where that one consult is rather than duplicated into each shape's path.
+          #
+          # The union side of that placement IS reachable, contrary to what this comment used to say. The
+          # shape needs a non-nil union of at least two RBS-DECLARED classes — an undeclared arm is an
+          # ADR-26 open receiver and `union_arm_blocks_undefined_fire?` bails before the method lookup,
+          # which is why the earlier probes read silent and were misread as the gate being unreachable.
+          # `spec/integration/composite_receiver_plugin_typed_suppression_spec.rb` builds it. What keeps
+          # the gate from firing there today is that the dispatcher no longer records a plugin-typed call
+          # it declined (#1101), not that no such union can be built.
+          #
+          # Note what the gate would do if it were reached: the scalar `Ledger#settle` a plugin declares
+          # is exempt here, while `(Ledger | Invoice)#settle` is not, because the union rule's own
+          # `method_present_anywhere?` reads RBS and project source and never asks the registry. Closing
+          # that asymmetry is #653's union coverage, not this rule's placement.
           # See {#call_site_exempt?}.
           return nil if call_site_exempt?(call_node, scope)
 
@@ -717,7 +745,7 @@ module Rigor
           # because the real type is empty (the real `DRb` has
           # `start_service`), so enumerating it to prove a call
           # "undefined" would be a false positive.
-          return nil if unenumerable_receiver?(class_name, scope)
+          return nil if unenumerable_receiver?(receiver_type, class_name, scope)
 
           # Slice 7 phase 12 — suppress when the user has
           # declared the method in source (`def` /
@@ -742,7 +770,7 @@ module Rigor
           method_def = lookup_method(receiver_type, class_name, call_node.name, scope)
           return nil if method_def
 
-          return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind)
+          return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites)
 
           definition_site = project_definition_site(scope, class_name, call_node.name, kind)
           # Issue #735 — the site is evidence, and whose RBS this is decides what it is evidence OF. On a
@@ -757,9 +785,54 @@ module Rigor
           build_undefined_method_diagnostic(path, call_node, receiver_type, definition_site, class_name)
         end
 
-        # The two probes that run only once every cheaper answer has come back "absent", kept together
+        # Issue #1120 — the method exists at THIS call site but not everywhere: a refinement whose `using` is in
+        # effect here, or a `def o.m` on the receiver local in this scope. Asked from {#last_resort_surface_answers?},
+        # once every project-wide table has come back "absent", so the file walk behind {LexicalMethodSites} runs
+        # only for a call about to fire.
+        # A refinement answers instance-side receivers only: a refined singleton (`refine X.singleton_class`) names
+        # no constant target, so nothing records it.
+        def lexically_defined_method?(class_name, call_node, scope, kind, lexical_sites)
+          return false if lexical_sites.nil?
+          return true if lexical_sites.singleton_local_def?(call_node)
+          return false unless kind == :instance
+
+          # ADR-46 — the answer below is a function of every refinement of this name in the project, so the
+          # consumer depends on the name whichever way it answers; a refine body edited in another file must
+          # re-check it (`IncrementalSession#refinement_affected`).
+          DependencyRecorder.read_name(:refinement, call_node.name) if DependencyRecorder.active?
+          modules = refining_modules(scope, class_name, call_node.name)
+          !modules.nil? && lexical_sites.refinement_active?(call_node, modules)
+        end
+
+        # Issue #1120 — every module that refines `method_name` into `class_name` or one of its ancestors (a
+        # refinement of `Object` reaches a `String` receiver), or nil when none does. The table is empty on a
+        # project that refines nothing, which answers without a lookup.
+        def refining_modules(scope, class_name, method_name)
+          refinements = scope.discovered_refinements
+          return nil if refinements.empty?
+
+          modules = nil
+          refinements.each do |refined, methods|
+            names = methods[method_name]
+            next if names.nil? || !refined_receiver_class?(scope, class_name, refined)
+
+            (modules ||= []).concat(names)
+          end
+          modules
+        end
+
+        def refined_receiver_class?(scope, class_name, refined)
+          return true if class_name == refined
+
+          environment = scope.environment
+          !environment.nil? && environment.class_ordering(class_name, refined) == :subclass
+        end
+
+        # The probes that run only once every cheaper answer has come back "absent", kept together
         # because they share that position and nothing else.
         #
+        # - Issue #1120 — a method that exists at this call site only: a refinement in effect here, or a
+        #   singleton `def` on the receiver local ({#lexically_defined_method?}).
         # - Issue #739 — an instance-side MODULE receiver. A value typed as a mixin module is an instance of
         #   some class that includes it, and that class contributes an arbitrary surface: inside
         #   `module Attachable::InstanceMethods`, `self.project` is defined by the ActiveRecord model that
@@ -780,7 +853,8 @@ module Rigor
         #   it"; a project ancestor still might, and the typer has already resolved the site through
         #   exactly this walk. It is last because it is the only probe here that walks the class graph
         #   (see {#ancestry_declares_method?} for why that placement is load-bearing, not tidiness).
-        def last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind)
+        def last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites = nil)
+          return true if lexically_defined_method?(class_name, call_node, scope, kind, lexical_sites)
           return true if module_mixin_receiver?(receiver_type, scope)
           return true if mixin_self_class_receiver?(call_node, scope)
           return true if unknown_mixin_includer?(class_name, scope)
@@ -936,7 +1010,7 @@ module Rigor
         # Authored severity is `:warning`; the severity profile
         # remaps it (`strict` → `:error`, `balanced` →
         # `:warning`, `lenient` → `:off` / suppressed).
-        def unresolved_toplevel_diagnostic(path, call_node, scope_index)
+        def unresolved_toplevel_diagnostic(path, call_node, scope_index, eval_ranges = nil)
           return nil unless call_node.receiver.nil?
 
           scope = scope_index[call_node]
@@ -947,10 +1021,51 @@ module Rigor
           return nil if scope.top_level_def_for(name)
           return nil if source_declared_method?(scope, "Object", name, :instance)
           return nil if Rigor::Reflection.instance_method_definition("Object", name, scope: scope)
+          # `Target.class_eval { def added = 1; def use_added = added }` files the defs on Target
+          # but leaves the eval body with a nil `self_type`, so `toplevel?` still holds. An eval
+          # body is morally a class body, so ADR-34 stays silent there — including on a genuinely
+          # undefined name inside the block. Ranges are computed once per file.
+          return nil if call_inside_receiver_eval_ranges?(eval_ranges, call_node)
 
           build_unresolved_toplevel_diagnostic(path, call_node)
         end
 
+        # ScopeIndexer keeps RECEIVER_EVAL_CALLS private; this list is the same family
+        # (`class_eval` / `module_eval` / `class_exec` / `module_exec` / `instance_eval` /
+        # `instance_exec`). Used only to decline ADR-34 inside those blocks.
+        RECEIVER_EVAL_CALL_NAMES = %i[
+          class_eval module_eval class_exec module_exec instance_eval instance_exec
+        ].freeze
+        private_constant :RECEIVER_EVAL_CALL_NAMES
+        EMPTY_EVAL_RANGES = [].freeze
+        private_constant :EMPTY_EVAL_RANGES
+
+        def receiver_eval_block_ranges(root)
+          return EMPTY_EVAL_RANGES if root.nil?
+
+          ranges = []
+          Source::NodeWalker.each(root) do |node|
+            next unless node.is_a?(Prism::CallNode)
+            next unless RECEIVER_EVAL_CALL_NAMES.include?(node.name)
+
+            block = node.block
+            next unless block.is_a?(Prism::BlockNode)
+
+            loc = block.location
+            ranges << [loc.start_offset, loc.end_offset]
+          end
+          ranges
+        end
+
+        def call_inside_receiver_eval_ranges?(eval_ranges, call_node)
+          return false if eval_ranges.nil? || eval_ranges.empty?
+
+          loc = call_node.location
+          eval_ranges.any? do |start_offset, end_offset|
+            loc.start_offset >= start_offset && loc.end_offset <= end_offset
+          end
+        end
+
         def build_unresolved_toplevel_diagnostic(path, call_node)
           Diagnostic.from_message_loc(
             call_node,
@@ -976,10 +1091,32 @@ module Rigor
         # the scalar rule enumerated `Module`'s own RBS instead and reported them.
         #
         # Kept beside `unbounded_receiver_surface?` rather than folded into it: that predicate has eight
-        # other callers (arity, the `raise` verdicts), and widening all of them is a separate change with
-        # its own evidence to gather.
-        def unenumerable_receiver?(class_name, scope)
-          METACLASS_ARMS.include?(class_name) || unbounded_receiver_surface?(class_name, scope)
+        # other callers, and #742 had no evidence that any of them spoke on these receivers.
+        #
+        # Issue #879 supplied it for exactly one — `call.wrong-arity`, which decided `v.hexdigest(1, 2, 3)`
+        # against `Digest::Instance`'s declaration on the same run where `v.no_such_method_zzz` was declined
+        # as unenumerable. One receiver, one run, two answers about whether that surface can be read. The
+        # reporter could make no other caller speak: `raise` on a module- or `Class`-typed operand is silent,
+        # and `Class`-typed `.new` with a wrong arity is silent too, so the other seven stay on
+        # `unbounded_receiver_surface?` until something demonstrates otherwise.
+        #
+        # Arity takes {#unenumerable_receiver_shape?}, not this whole predicate: ADR-26's open receivers are
+        # handled for the signature-reading rules by {#unauthoritative_inherited_signature?}, which is
+        # deliberately narrower — a method the open class DECLARES itself keeps its arity check.
+        def unenumerable_receiver?(receiver_type, class_name, scope)
+          unenumerable_receiver_shape?(receiver_type, class_name, scope) ||
+            unbounded_receiver_surface?(class_name, scope)
+        end
+
+        # The receiver shapes whose method surface cannot be enumerated at all, whatever the environment
+        # declares: a generic metaclass value, and an instance-side mixin-module type — an instance of some
+        # unknown class that includes the module, which may declare the name with any arity of its own
+        # (#739's reasoning, applied to the signature rather than to the method's existence).
+        #
+        # Instance-side only, for #739's reason: `Singleton[M]` on a namespace module is a real, enumerable
+        # surface, and `M.helper(1, 2, 3)` must keep firing.
+        def unenumerable_receiver_shape?(receiver_type, class_name, scope)
+          METACLASS_ARMS.include?(class_name) || module_mixin_receiver?(receiver_type, scope)
         end
 
         # Issue #746 — a class that includes a module the environment does not know. `SudoMode::Form`
@@ -1030,7 +1167,7 @@ module Rigor
           # about it instead of bailing. `Type::Refined` carries string-family
           # refinements (`lowercase-string`, …) over an explicit `.base`;
           # `Type::IntegerRange` carries the bounded-int refinements
-          # (`non-negative-int`, `positive-int`, `int<1,5>`), every one an
+          # (`non-negative-int`, `positive-int`, `Integer[1..5]`), every one an
           # Integer; `Type::Difference` (`A - B`) carries the non-empty /
           # non-zero refinements (`non-empty-string` = `String - ""`,
           # `non-empty-array` = `Array - []`, `non-zero-int` = `Integer - 0`)
@@ -1038,6 +1175,7 @@ module Rigor
           # base (minuend) class dispatches.
           when Type::Refined, Type::Difference then concrete_class_name(type.base)
           when Type::IntegerRange then "Integer"
+          when Type::FloatRange then "Float"
           end
         end
 
@@ -1097,7 +1235,11 @@ module Rigor
         # audit), so declaring even its reader surface makes it RBS-known — and, without this, every member
         # the declaration omits would become a false `call.undefined-method` for every project that locks
         # activesupport, the overwhelming majority of which never opt into the plugin at all.
-        GEM_OVERLAY_OPEN_RECEIVERS = Set["ActiveSupport::Duration"].freeze
+        # `ActiveSupport::Concern` joined it in #534 item 7. `class_methods do … end` synthesizes a
+        # `ClassMethods` constant and `append_features` / `prepend_features` are part of the real surface,
+        # none of which the two-line declaration enumerates — and a concern module is the receiver of that
+        # surface in every Rails app, so the same argument applies with the same force.
+        GEM_OVERLAY_OPEN_RECEIVERS = Set["ActiveSupport::Duration", "ActiveSupport::Concern"].freeze
         private_constant :GEM_OVERLAY_OPEN_RECEIVERS
 
         # ADR-26 — whether `class_name` is declared "open" by a
@@ -1425,7 +1567,7 @@ module Rigor
         # by `undefined_method_diagnostic`; it returns nil
         # when the call's receiver / RBS coverage / call shape
         # disqualifies the rule.
-        # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
+        # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         def wrong_arity_diagnostic(path, call_node, scope_index)
           return nil if call_node.receiver.nil?
           return nil unless plain_positional_call?(call_node)
@@ -1441,6 +1583,12 @@ module Rigor
           class_name = concrete_class_name(receiver_type)
           return nil if class_name.nil?
 
+          # Issue #879 — the receiver whose surface `call.undefined-method` already refuses to enumerate.
+          # Deciding an arity against a declaration this rule cannot prove the receiver actually runs is the
+          # same unsoundness in signature form: the includer may declare the name with a wider arity, and
+          # then the call is correct code.
+          return nil if unenumerable_receiver_shape?(receiver_type, class_name, scope)
+
           kind = receiver_type.is_a?(Type::Singleton) ? :singleton : :instance
           # `Struct.new(:a, :b).new(...)` chained: the inner
           # `Struct.new(...)` is an anonymous Struct *subclass* whose
@@ -1451,24 +1599,129 @@ module Rigor
           # `.new` against the real `Struct.new(*Symbol)` signature is a
           # false positive. Skip arity-checking the chained position.
           return nil if anonymous_struct_new_call?(call_node, class_name, kind)
-          return nil if scope.discovered_method?(class_name, call_node.name, kind)
-
-          return nil unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
-          return nil unless definition_available?(receiver_type, class_name, scope)
 
-          method_def = trustworthy_signature(receiver_type, class_name, call_node, scope)
-          return nil if method_def.nil?
-
-          arity_envelope = compute_arity_envelope(method_def)
+          arity_envelope = arity_envelope_for(receiver_type, class_name, call_node, scope, kind)
           return nil if arity_envelope.nil?
 
           actual = (call_node.arguments&.arguments || []).size
-          min, max = arity_envelope
-          return nil if actual.between?(min, max)
+          min, max, source_arity = arity_envelope
+          if actual.between?(min, max)
+            source_arity&.settle_by_definitions
+            return nil
+          end
+          # Issue #992 — a source envelope's remaining declines can only withhold, so they run only now.
+          source_arity&.settle_by_walk
+          return nil if source_arity && !source_arity.authoritative?(class_name)
 
           build_arity_diagnostic(path, call_node, class_name, min, max, actual)
         end
 
+        # The `[min, max]` the call is checked against — a declared signature's, or (issue #992) the project
+        # `def`'s own when no signature declares the method, with the {SourceArity} that found it as a third
+        # element — or nil when neither may be trusted.
+        #
+        # Issue #991 — `discovered_method?` used to exempt the call outright before ever asking for a
+        # declaration. `trustworthy_signature` is the same lookup `argument_type_diagnostic` treats as
+        # authoritative over a source `def` (see its own comment beside that call), and the two rules must agree
+        # on whose contract binds, so a declared method is checked against its declaration.
+        def arity_envelope_for(receiver_type, class_name, call_node, scope, kind)
+          if Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
+            return nil unless definition_available?(receiver_type, class_name, scope)
+
+            method_def = trustworthy_signature(receiver_type, class_name, call_node, scope)
+            if method_def && !Rigor::RbsExtended.inferred_signature?(method_def)
+              return nil if undeclared_constructor?(class_name, call_node, kind, method_def)
+
+              return compute_arity_envelope(method_def)
+            end
+            return nil unless source_lane_open?(method_def, receiver_type, class_name, call_node, scope)
+          end
+
+          source_arity_envelope(class_name, call_node, scope, kind)
+        end
+
+        # Issue #992 — whether a class RBS knows may still be checked against its project `def`. Two lanes:
+        #
+        # - the member resolved and carries `%a{rigor:v1:inferred-signature}`: under ADR-93 the bundled
+        #   `rigor-rbs-inline` plugin emits a full skeleton for EVERY `def` in a file carrying at least one
+        #   annotation (#823), with every type slot defaulted, so nobody asserted anything about it. Its arity
+        #   is NOT read here — the `def`'s envelope is, through the same {SourceArity} walk as a method with no
+        #   member at all, so one `def` is never judged by two readings of its parameter list;
+        # - no member resolved, and the class's declaration is the project's own `sig/`
+        #   (`project_declared_class?`): a partial sidecar of a project class whose `def` lives in source.
+        #
+        # Everything else declines. A bundled declaration (core / stdlib / gem) describes a class the project
+        # does not own, so a project `def` on it is an ADR-17 monkey-patch that another library may patch too;
+        # a lookup that raised, or a name an open receiver only inherited (`trustworthy_signature` answered
+        # nil for those while a raw lookup does not), is not "no member".
+        def source_lane_open?(method_def, receiver_type, class_name, call_node, scope)
+          return true if method_def
+
+          lookup_method(receiver_type, class_name, call_node.name, scope).nil? &&
+            Rigor::Reflection.project_declared_class?(class_name, scope: scope)
+        end
+
+        # Issue #992 — stage 1 of {SourceArity}: the nearest project definition's envelope, after the
+        # receiver-level declines that need no walk. Stage 2 (`SourceArity#authoritative?`) runs only once the
+        # count is known to fall outside it.
+        def source_arity_envelope(class_name, call_node, scope, kind)
+          return nil unless scope.discovered_parameter_envelopes.key?(Scope::DiscoveryIndex::ENVELOPE_PROJECT_WIDE)
+          return nil if unbounded_receiver_surface?(class_name, scope)
+          return nil if plugin_typed_call?(call_node, scope)
+          # An instance of a project module is an instance of whatever includes it (#739's reasoning, which
+          # `module_mixin_receiver?` can only apply to a module RBS declares).
+          return nil if kind == :instance && project_module?(class_name, scope)
+          return nil if project_module_class_receiver?(call_node, scope)
+
+          arity = SourceArity.new(scope, call_node.name, kind)
+          envelope = arity.owner_envelope(class_name)
+          if envelope.nil? || envelope[2]
+            envelope.nil? && arity.ambiguous? ? arity.settle_by_walk : arity.settle_by_definitions
+            return nil
+          end
+
+          [envelope[0], envelope[1] || Float::INFINITY, arity]
+        end
+
+        # `self.class.f(1)` inside a project module's instance method: the engine types `self.class` as the
+        # module's singleton, but at runtime it is the includer's class, whose class methods are its own. The
+        # source-lane twin of {#mixin_self_class_receiver?}, which can only see a module RBS declares.
+        def project_module_class_receiver?(call_node, scope)
+          receiver = call_node.receiver
+          return false unless receiver.is_a?(Prism::CallNode) && receiver.name == :class && receiver.arguments.nil?
+          return false if receiver.receiver.nil?
+
+          inner = concrete_class_name(scope.type_of(receiver.receiver))
+          !inner.nil? && project_module?(inner, scope)
+        end
+
+        # Read off the table directly rather than through `Scope#parameter_envelopes_of`: a class does not turn
+        # into a module without its declaration (and so the receiver's own typing) changing, so this answer
+        # needs no ADR-46 class edge of its own.
+        def project_module?(class_name, scope)
+          bucket = scope.discovered_parameter_envelopes[class_name.to_s]
+          !bucket.nil? && bucket.key?(Scope::DiscoveryIndex::ENVELOPE_MODULE_MARK)
+        end
+
+        # Issue #917 — no loaded RBS declares a constructor for this class. The definition builder
+        # synthesizes `.new` from the nearest `initialize` in the ancestry, and when nothing declares
+        # one that is `BasicObject#initialize: () -> void`, so `.new` derives a nullary envelope that
+        # is an artifact of the fallback rather than a statement about the class. `Gem::Specification`
+        # is declared in full by the vendored rubygems sigs except for its constructor, and every
+        # argument at the real one was reported. The rule needs "this class declares a nullary
+        # constructor", and only a `defined_in` naming a class other than `BasicObject` is that
+        # evidence — except on `BasicObject` and `Object` themselves, where the declaration is their
+        # own and `.new` really does take no arguments.
+        def undeclared_constructor?(class_name, call_node, kind, method_def)
+          return false unless kind == :singleton && call_node.name == :new
+          return false unless method_def.respond_to?(:defined_in)
+
+          defined_in = method_def.defined_in
+          return false unless defined_in.nil? || strip_root(defined_in.to_s) == "BasicObject"
+
+          !%w[BasicObject Object].include?(strip_root(class_name))
+        end
+
         # True for the outer `.new` of a chained `Struct.new(...).new`:
         # `class_name`/`kind` already pin the receiver to
         # `Singleton[Struct]`, and the receiver node is itself a
@@ -1590,7 +1843,10 @@ module Rigor
           # {DeclarationSourcedGuard} exactly what it asked before — but it
           # now asks it through the predicate the argument-type gates share
           # (issue #324), which is what keeps the two rules from drifting.
-          return nil if DeclarationSourcedGuard.marked?(call_node.receiver, scope)
+          #
+          # Issue #1362 — a local copied from a global still on its declared seed (`sep = $/`) is asked against the
+          # file's writes to that global instead: its declared `nil` is withheld, and one the file writes still fires.
+          return nil if DeclarationSourcedGuard.withholds_nil?(call_node.receiver, scope)
 
           # ADR-67 WD6b — an inferred-parameter receiver's type (incl. any nil constituent unioned in from a
           # nil call site) is an open-call-site lower bound; a possible-nil firing against it is an FP by
@@ -2115,6 +2371,200 @@ module Rigor
           )
         end
 
+        # Issue #1367 (ADR-117 Decision point 1, WD2) — `global.write-type-mismatch` and `global.readonly-write`: a
+        # write to a special global that the interpreter's setter rejects, so the write raises every time it runs.
+        # The envelope is {SpecialGlobalSetters}: the setter, not the global's RBS declaration.
+        #
+        # - `global.readonly-write` needs no type. `$g = v`, `$g op= v` and a target of a multiple assignment
+        #   (`$g, x = …`, `*$g`) always write, so a write to a read-only special raises.
+        # - `global.write-type-mismatch` checks `$g = v` only when `v` is a literal node
+        #   ({SpecialGlobalSetters.literal_class}), whose class the syntax fixes. Any other value is never reported,
+        #   whatever its inferred type: a class RBS declares without `write` or `to_str` does not prove the object
+        #   lacks it (a singleton `def`, an `extend`, or a run-time `alias to_str to_s`, as URI has).
+        # - `$g ||= v` and `$g &&= v` write only when the current value is falsy (truthy), so neither rule checks
+        #   them, nor a `for` index or a `rescue => $g` reference.
+        # - A special that any project file aliases (`alias $stdout $out`, either side) is exempt from both.
+        def special_global_write_diagnostics(path, node, scope_index, lexical_sites)
+          case node
+          when Prism::GlobalVariableWriteNode
+            [readonly_global_write_diagnostic(path, node, scope_index) ||
+              global_write_type_diagnostic(path, node, scope_index, lexical_sites)].compact
+          when Prism::GlobalVariableOperatorWriteNode
+            [readonly_global_write_diagnostic(path, node, scope_index)].compact
+          when Prism::MultiWriteNode
+            multi_write_global_targets(node).filter_map do |target|
+              readonly_global_write_diagnostic(path, target, scope_index)
+            end
+          else
+            []
+          end
+        end
+
+        # The `GlobalVariableTargetNode`s a multiple assignment writes, through a splat (`*$g`) and nested
+        # destructuring (`(a, $g), b = …`).
+        def multi_write_global_targets(node)
+          [*node.lefts, node.rest, *node.rights].flat_map do |target|
+            case target
+            when Prism::GlobalVariableTargetNode then [target]
+            when Prism::SplatNode
+              target.expression.is_a?(Prism::GlobalVariableTargetNode) ? [target.expression] : []
+            when Prism::MultiTargetNode then multi_write_global_targets(target)
+            else []
+            end
+          end
+        end
+
+        def readonly_global_write_diagnostic(path, node, scope_index)
+          return nil unless SpecialGlobalSetters.read_only?(node.name)
+
+          scope = scope_index[node]
+          return nil if scope.nil? || global_aliased?(scope, node.name)
+
+          location = node.respond_to?(:name_loc) ? node.name_loc : node.location
+          Diagnostic.from_location(
+            location,
+            rule: RULE_GLOBAL_READONLY_WRITE,
+            path: path,
+            message: "`#{node.name}' is a read-only variable; this write raises NameError at runtime",
+            severity: :error
+          )
+        end
+
+        def global_write_type_diagnostic(path, node, scope_index, lexical_sites)
+          contract = SpecialGlobalSetters.contract_for(node.name)
+          return nil if contract.nil?
+
+          class_name = SpecialGlobalSetters.literal_class(node.value)
+          return nil if class_name.nil?
+
+          scope = scope_index[node]
+          return nil if scope.nil?
+          return nil unless literal_rejected?(class_name, contract, node, scope, lexical_sites)
+          return nil if global_aliased?(scope, node.name)
+
+          build_global_write_type_diagnostic(path, node, contract, class_name)
+        end
+
+        # The project's {Inference::GlobalWriteCensus} with the `pre_eval:` files' own.
+        def global_write_census(scope)
+          census = scope.discovered_global_write_census
+          pre_eval = scope.environment&.project_patched_methods&.write_census
+          pre_eval.nil? || pre_eval.empty? ? census : census | pre_eval
+        end
+
+        # Whether any project or `pre_eval:` file aliases `name`, on either side, which can make it another variable.
+        def global_aliased?(scope, name)
+          Inference::GlobalWriteCensus.aliased?(global_write_census(scope), name)
+        end
+
+        # A literal is rejected when its class is none the setter takes and, for a setter that also converts
+        # (`to_str`, `to_int`) or asks for `write`, the literal's object cannot answer that method.
+        def literal_rejected?(class_name, contract, node, scope, lexical_sites)
+          return false if contract.accepts_class?(class_name)
+          return true if contract.conversion.nil?
+
+          !literal_may_answer?(class_name, contract.conversion, node, scope, lexical_sites)
+        end
+
+        # The escape hatches through which an object answers a method its class does not define: the setter's
+        # `respond_to?` and implicit conversion both consult them.
+        GLOBAL_WRITE_HATCHES = %i[method_missing respond_to_missing? respond_to?].freeze
+        private_constant :GLOBAL_WRITE_HATCHES
+
+        # Where RBS core declares the hatches every object inherits unchanged.
+        DEFAULT_HATCH_OWNERS = %w[::BasicObject ::Kernel ::Object].freeze
+        private_constant :DEFAULT_HATCH_OWNERS
+
+        # Whether the literal's object may answer `method_name` after all:
+        #
+        # - RBS gives its class the method, or a hatch of its own (a project `sig/` reopening or `include` counts);
+        # - the program defines the method or a hatch anywhere, in any spelling, on any receiver
+        #   ({Inference::GlobalWriteCensus}): no census of where a definition lands can be complete
+        #   (`class << nil`, `K = Integer; class K`, `[Integer].each { |k| k.define_method(:write) }`);
+        # - an ancestor's surface is rewritten from outside (`Integer.include(M)`, `Object.include(M)`, a string
+        #   `class_eval`: the `ENVELOPE_DYNAMIC_MARK`), or it or `Object` mixes in a module RBS does not rule out;
+        # - for `write` only, a refinement that may add it is in effect at the write ({#refined_writer_in_effect?}).
+        def literal_may_answer?(class_name, method_name, node, scope, lexical_sites)
+          definition = Rigor::Reflection.instance_definition(class_name, scope: scope)
+          return true if definition.nil?
+          return true if definition.methods.key?(method_name) || overridden_hatch?(definition)
+
+          ancestors = definition.ancestors.ancestors.to_set { |ancestor| ancestor.name.to_s.delete_prefix("::") }
+          names = [method_name, *GLOBAL_WRITE_HATCHES]
+          census = global_write_census(scope)
+          program_may_answer?(ancestors, names, census, scope) ||
+            (method_name == :write && refined_writer_in_effect?(census, node, lexical_sites))
+        end
+
+        def overridden_hatch?(definition)
+          GLOBAL_WRITE_HATCHES.any? do |name|
+            method = definition.methods[name]
+            method && !DEFAULT_HATCH_OWNERS.include?(method.defined_in.to_s)
+          end
+        end
+
+        def program_may_answer?(ancestors, names, census, scope)
+          return true if Inference::GlobalWriteCensus.defines_any_of?(census, names)
+
+          dynamic_mark = Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK
+          return true if ancestors.any? { |owner| scope.parameter_envelopes_of(owner).key?(dynamic_mark) }
+
+          main_mixins = Inference::GlobalWriteCensus.main_mixins(census)
+          main_mixins.any? { |mixin| rbs_mixin_may_answer?(mixin, names, scope) } ||
+            mixin_may_answer?(ancestors, names, scope)
+        end
+
+        # A module an ancestor of the literal's class mixes in through a class body (`class Integer; include
+        # Writable; end`), followed through the modules it mixes in in turn. A project module answers when its
+        # surface is rewritten beyond literal names (a `send(:include, …)`, a non-constant mixin); its literal
+        # definitions are the census's. Any other module answers when RBS does not know it or declares one of
+        # `names`.
+        def mixin_may_answer?(ancestors, names, scope)
+          queue = ancestors.flat_map { |owner| scope.includes_of(owner) }
+          seen = Set.new
+          until queue.empty?
+            mixin = queue.shift
+            next unless seen.add?(mixin)
+
+            bucket = scope.parameter_envelopes_of(mixin)
+            if bucket.key?(Scope::DiscoveryIndex::ENVELOPE_MODULE_MARK)
+              return true if bucket.key?(Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK)
+
+              queue.concat(scope.includes_of(mixin))
+            elsif rbs_mixin_may_answer?(mixin, names, scope)
+              return true
+            end
+          end
+          false
+        end
+
+        def rbs_mixin_may_answer?(mixin, names, scope)
+          definition = Rigor::Reflection.instance_definition(mixin, scope: scope)
+          definition.nil? || definition.methods.key?(names.first) || overridden_hatch?(definition)
+        end
+
+        # For `write` only: some refinement may add `write` (a `def`, `define_method` or `alias_method` in a `refine`
+        # block, or an `import_methods`), and a `using` is in effect at the write. Which class it refines is not asked:
+        # the target may be computed (`[Array].each { |k| refine(k) { … } }`) or a constant alias (`T = Array;
+        # refine(T)`), so a refined `write` on any class declines every literal. `respond_to?(:write)` honours an
+        # active refinement on Ruby 4.0.5; a refined `respond_to_missing?` or `respond_to?`, and every implicit
+        # conversion, do not, so a refinement that adds only those leaves the write reported.
+        def refined_writer_in_effect?(census, node, lexical_sites)
+          Inference::GlobalWriteCensus.refines_write?(census) &&
+            (lexical_sites.nil? || lexical_sites.using_in_effect?(node))
+        end
+
+        def build_global_write_type_diagnostic(path, node, contract, class_name)
+          Diagnostic.from_name_loc(
+            node,
+            rule: RULE_GLOBAL_WRITE_TYPE_MISMATCH,
+            path: path,
+            message: "`#{node.name}' accepts only #{contract.accepts}; this write assigns " \
+                     "#{SpecialGlobalSetters.literal_description(class_name)}, which raises TypeError at runtime",
+            severity: :error
+          )
+        end
+
         # v0.1.2 — `flow.unreachable-branch`. Fires when an `IfNode` / `UnlessNode` whose predicate is a
         # literal `true` / `false` / `nil` (or a literal numeric / string / symbol whose Ruby truthiness is
         # known at-a-glance) has an observable dead branch. The diagnostic points at the dead branch (not
@@ -2385,8 +2835,10 @@ module Rigor
         #   overload requires the dispatcher's full
         #   acceptance plumbing.
         # - The selected overload must have NO
-        #   rest_positionals, NO required keywords, NO
-        #   trailing positionals.
+        #   rest_positionals and NO trailing positionals —
+        #   the two shapes under which argument N no longer
+        #   binds to positional parameter N. Keyword
+        #   parameters do not disqualify it (#673).
         # - The call must use plain positional arguments
         #   (no splat / kw / block-pass / forwarded).
         # - Per-argument: skip when EITHER side is `Dynamic`
@@ -2451,7 +2903,7 @@ module Rigor
           return nil if method_def.nil?
 
           param_overrides = Rigor::RbsExtended.param_type_override_map(method_def, environment: scope.environment)
-          mismatch = argument_mismatch(method_def.method_types, call_node, scope, param_overrides)
+          mismatch = argument_mismatch(method_def.method_types, call_node, scope, param_overrides, scope_index)
           return nil if mismatch.nil?
           return nil if inferred_param_mismatch_verdict?(call_node, mismatch, scope)
 
@@ -2477,14 +2929,50 @@ module Rigor
         # overload rejects) plus, on non-coerce methods, the non-nil channel
         # (a single-concrete-class argument every overload rejects). See
         # {#multi_overload_argument_mismatch}.
-        def argument_mismatch(method_types, call_node, scope, param_overrides)
-          if method_types.size == 1
-            first_argument_mismatch(method_types.first, call_node, scope, param_overrides)
-          else
-            multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides)
+        #
+        # Each argument is typed from its own index entry, which is the call's unless an earlier operand moved
+        # the scope it was entered from (issue #1256): `(k = 0; 5)[k]` checks `k` as the `0` it holds there.
+        def argument_mismatch(method_types, call_node, scope, param_overrides, scope_index)
+          mismatch =
+            if method_types.size == 1
+              first_argument_mismatch(method_types.first, call_node, scope, param_overrides, scope_index)
+            else
+              multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides, scope_index)
+            end
+          return nil if mismatch && keyword_bearing?(method_types) && nil_tainted?(mismatch[:actual])
+
+          mismatch
+        end
+
+        # Issue #673 widened {#argument_check_eligible?} to admit keyword-bearing signatures, whose
+        # POSITIONAL arguments had gone unchecked. The widening is staged, and this is the half held
+        # back: on such a signature only an argument refuted on its CLASS fires; one carrying `nil`
+        # does not.
+        #
+        # Measured, not assumed. Across redmine, mastodon, tdiary-core, faraday, liquid and
+        # rubocop-ast the widening produced exactly two new verdicts, both on correct code and both
+        # resting on nullability: `Addrinfo.foreach(host, nil, nil, :STREAM)` (redmine — a nil service
+        # is legal at runtime; rbs declares the parameter `String | ::Integer`) and
+        # `Nokogiri::HTML5(html)` guarded by `return if html.nil?` one line above (mastodon — the guard
+        # is on a method call, so the type stays `Dynamic[top]?`). Zero class-refuted new verdicts were
+        # false. Nullability is the property a hand-written signature most often over-declares, so it
+        # stays behind the old envelope until it has evidence of its own.
+        #
+        # Signatures WITHOUT keywords are untouched: `"a" + nil` fires exactly as before.
+        def keyword_bearing?(method_types)
+          method_types.any? do |method_type|
+            function = method_type.type
+            next false unless function.respond_to?(:required_keywords)
+
+            !function.required_keywords.empty? || !function.optional_keywords.empty? ||
+              !function.rest_keywords.nil?
           end
         end
 
+        def nil_tainted?(actual)
+          nil_member?(actual) || (actual.is_a?(Type::Union) && union_contains_nil?(actual))
+        end
+
         # Multi-overload argument-type-mismatch. The dispatcher's per-overload
         # acceptance plumbing is not run here; instead the FP-safe shape mirrors
         # the "absent on every arm" union-undefined-method rule: an argument is
@@ -2501,32 +2989,52 @@ module Rigor
         #   stays deferred), and decides acceptance on the RBS param type
         #   ({#param_accepts_arg_class?}) so it sees through the `int` / `string`
         #   interface-aliases the translator degrades.
-        def multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides)
+        def multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides, scope_index)
           functions = method_types.map(&:type)
           return nil unless functions.all? { |function| argument_check_eligible?(function) }
 
           coerce_method = COERCE_DISPATCH_METHODS.include?(call_node.name)
           arguments = call_node.arguments&.arguments || []
           arguments.each_with_index do |arg, index|
-            arg_type = scope.type_of(arg)
-            params = overload_positional_params(method_types, index)
-            next if params.nil? # arity divergence — some overload lacks a param here
-
-            mismatch =
-              if nil_member?(arg_type) # pure nil only — not a `T | nil` union
-                nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
-              elsif !coerce_method
-                non_nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
-              end
+            params = checkable_overload_params(method_types, index, param_overrides, scope)
+            next if params.nil?
+
+            mismatch = overload_argument_mismatch(arg, params, param_overrides,
+                                                  argument_scope(arg, scope, scope_index), coerce_method)
             return mismatch if mismatch
           end
           nil
         end
 
+        # The mismatch (or nil) for one argument against the parameter every overload has at its position. Issue
+        # #1362 — a builtin global's seed, or its copy, is judged by the file's writes to the global.
+        def overload_argument_mismatch(arg, params, param_overrides, arg_scope, coerce_method)
+          written = DeclarationSourcedGuard.written_type(arg, arg_scope)
+          arg_type = written || arg_scope.type_of(arg)
+          if nil_member?(arg_type) # pure nil only — not a `T | nil` union
+            nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, arg_scope, written: !written.nil?)
+          elsif !coerce_method
+            non_nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, arg_scope)
+          end
+        end
+
+        # The parameter set at `index` that a verdict may rest on, or nil when there is none — the two
+        # reasons being arity divergence (an overload with no param there, which is `call.wrong-arity`'s
+        # concern) and an overload whose param names a class carrying no definition ({#stub_typed_param?},
+        # issue #661). Both channels below fire only when EVERY overload rejects, so either one is enough
+        # to unseat that premise.
+        def checkable_overload_params(method_types, index, param_overrides, scope)
+          params = overload_positional_params(method_types, index)
+          return nil if params.nil?
+          return nil if params.any? { |param| stub_typed_param?(param, param_overrides, scope) }
+
+          params
+        end
+
         # The nil channel: a pure `nil` argument no overload admits (ADR-58
         # parity excuses a declaration-sourced ivar nil).
-        def nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
-          return nil if declaration_sourced_nil_argument?(arg, scope)
+        def nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope, written: false)
+          return nil if !written && declaration_sourced_nil_argument?(arg, scope)
           return nil if params.any? { |param| param_admits_nil?(param, param_overrides, scope) }
 
           { node: arg, name: nil, expected: overload_param_expected_label(params), actual: arg_type }
@@ -2568,6 +3076,53 @@ module Rigor
           param.map_type { |type| type.sub(substitution) }
         end
 
+        # ADR-26 WD8's PARAMETER-side twin (issue #661). `sig/app.rbs` declaring
+        # `(ActiveSupport::TimeWithZone) -> void` in a project that never brings ActiveSupport's RBS in
+        # names a class that carries no definition anywhere in the environment. Rigor still refuted
+        # `App.take_twz(Time.now)` against it — `expected ActiveSupport::TimeWithZone, got Time` on a call
+        # that works — because the acceptance walk compares nominals and `Time`'s ancestry does not list a
+        # name nothing declares.
+        #
+        # WD8 already declines the two signature rules on such a RECEIVER, on the ground that there is
+        # nothing authoritative to check the call against. It is the same one position over: with no
+        # ancestry there is no fact that could make an argument satisfy the parameter either, so the
+        # rejection is the missing signature restated as an error rather than a finding about the program.
+        # Under AGENTS.md's false-positives-outrank-worst-case rule the honest answer is to decline, and
+        # the report it costs is one the analyzer never had evidence for.
+        #
+        # Both shapes the missing name arrives in are covered, deliberately as ONE criterion. A name an
+        # INSTANCE-method signature references is minted as an empty stub so the class builds
+        # ({Environment::RbsLoader.stub_missing_referenced_types}) and reads back as RBS-known; the same
+        # name in a SINGLETON signature is not, because that pass mirrors rbs's own membership test and
+        # `validate_type_params` never reaches singleton members. That asymmetry is an artifact of which
+        # pass ran, not of what is knowable, and the issue's own repro is the singleton half.
+        #
+        # A `rigor:v1:param` override is a real Rigor type the author wrote against the call site's own
+        # method, so it is consulted first and checked normally.
+        def stub_typed_param?(param, param_overrides, scope)
+          return false if param_overrides[param.name]
+
+          undefined_param_class?(param.type, scope)
+        end
+
+        # Only the arms a verdict can rest on directly: a union member, an optional's inner type, an
+        # expanded alias, and the class instance / singleton itself. Deliberately NOT recursive into type
+        # ARGUMENTS — `Array[Missing]` is still refuted by an `Integer` argument on the `Array` alone, and
+        # declining there would be a lost report bought for nothing.
+        def undefined_param_class?(rbs_type, scope)
+          case rbs_type
+          when RBS::Types::Union then rbs_type.types.any? { |member| undefined_param_class?(member, scope) }
+          when RBS::Types::Optional then undefined_param_class?(rbs_type.type, scope)
+          when RBS::Types::Alias
+            expanded = scope.environment&.rbs_loader&.expand_type_alias(rbs_type)
+            !expanded.nil? && undefined_param_class?(expanded, scope)
+          when RBS::Types::ClassInstance, RBS::Types::ClassSingleton
+            name = rbs_type.name
+            synthesized_stub_receiver?(name, scope) || !Rigor::Reflection.rbs_class_known?(name.to_s, scope: scope)
+          else false
+          end
+        end
+
         # The class names whose instances `nil` IS — `NilClass` and every
         # ancestor. A parameter typed as any other class instance rejects nil.
         NIL_COMPATIBLE_CLASS_NAMES = %w[NilClass Object BasicObject Kernel].to_set.freeze
@@ -2746,7 +3301,7 @@ module Rigor
           DeclarationSourcedGuard.marked?(arg, scope)
         end
 
-        def first_argument_mismatch(method_type, call_node, scope, param_overrides)
+        def first_argument_mismatch(method_type, call_node, scope, param_overrides, scope_index)
           function = method_type.type
           return nil unless argument_check_eligible?(function)
 
@@ -2756,12 +3311,17 @@ module Rigor
             param = params[index]
             next if param.nil? # arity mismatch is the wrong-arity rule's concern.
 
-            mismatch = single_argument_mismatch(param, arg, scope, param_overrides)
+            mismatch = single_argument_mismatch(param, arg, argument_scope(arg, scope, scope_index), param_overrides)
             return mismatch if mismatch
           end
           nil
         end
 
+        # The scope `arg` is checked from: its own index entry ({#argument_mismatch}), else the call's.
+        def argument_scope(arg, call_scope, scope_index)
+          scope_index[arg] || call_scope
+        end
+
         # The mismatch (or nil) for one positional argument against one
         # parameter. The nil channel decides a pure `nil` argument on the RBS
         # parameter type — seeing through the `string` / `int` interface-alias
@@ -2770,6 +3330,19 @@ module Rigor
         # the original translated-acceptance check, with a `rigor:v1:param`
         # override taking precedence over the RBS-declared type.
         def single_argument_mismatch(param, arg, scope, param_overrides)
+          return nil if stub_typed_param?(param, param_overrides, scope)
+
+          # Issue #1362 (ADR-58 parity, ADR-117 Decision point 2) — a read of a builtin global still on its declared
+          # seed, or a local copied from one, is judged by the file's writes to the global, as the argument was
+          # before the join: the declared members are not diagnostic fuel.
+          written = DeclarationSourcedGuard.written_type(arg, scope)
+          return written_argument_mismatch(param, arg, written, scope, param_overrides) if written
+
+          read_argument_mismatch(param, arg, scope, param_overrides)
+        end
+
+        # {#single_argument_mismatch} for an argument that reads no builtin global's seed directly.
+        def read_argument_mismatch(param, arg, scope, param_overrides)
           arg_type = scope.type_of(arg)
 
           if nil_member?(arg_type)
@@ -2783,10 +3356,42 @@ module Rigor
           return nil if param_type.is_a?(Type::Dynamic) || param_type.is_a?(Type::Top)
           return nil if arg_type.is_a?(Type::Dynamic) || arg_type.is_a?(Type::Top)
           return nil unless argument_genuinely_mismatches?(arg, arg_type, param_type, scope)
+          # Issue #1362 — a value that mixes such a global with something else (`c ? $stdout : StringIO.new`) is judged
+          # without the declared members the file never writes, as it was before the join.
+          return nil if DeclarationSourcedGuard.declared_only_rejection?(arg_type, param_type, scope) do |stripped|
+            !plain_argument_rejects?(param, stripped, scope, param_overrides)
+          end
 
           { node: arg, name: param.name, expected: param_type, actual: arg_type }
         end
 
+        # The mismatch for an argument judged by `written`, the file's writes to the builtin globals it reads the
+        # seeds of, through the channels {#single_argument_mismatch} runs, without the ADR-58 withholding: before
+        # the join the global carried no mark.
+        def written_argument_mismatch(param, arg, written, scope, param_overrides)
+          return nil unless plain_argument_rejects?(param, written, scope, param_overrides)
+
+          expected =
+            if nil_member?(written)
+              overload_param_expected_label([param])
+            else
+              param_overrides[param.name] || translate_param_type(param.type, scope.environment)
+            end
+          { node: arg, name: param.name, expected: expected, actual: written }
+        end
+
+        # True when `param` rejects an argument of type `type` on the terms of {#single_argument_mismatch}'s nil and
+        # non-nil channels, without the ADR-58 withholding.
+        def plain_argument_rejects?(param, type, scope, param_overrides)
+          return !param_admits_nil?(param, param_overrides, scope) if nil_member?(type)
+
+          param_type = param_overrides[param.name] || translate_param_type(param.type, scope.environment)
+          return false if param_type.is_a?(Type::Dynamic) || param_type.is_a?(Type::Top)
+          return false if type.is_a?(Type::Dynamic) || type.is_a?(Type::Top)
+
+          Inference::Acceptance.accepts(param_type, type, mode: :gradual).no?
+        end
+
         # The parameter rejects the argument AND the rejection is not a
         # withheld declaration-sourced-nil case.
         def argument_genuinely_mismatches?(arg, arg_type, param_type, scope)
@@ -2824,17 +3429,29 @@ module Rigor
           Inference::Acceptance.accepts(param_type, non_nil, mode: :gradual).yes?
         end
 
+        # What this rule needs is that argument N binds to positional
+        # parameter N, so the only disqualifiers are the two shapes that
+        # break that mapping: a rest positional (arguments past it belong
+        # to the rest, not to a later parameter) and trailing positionals
+        # (the last arguments bind backwards from the end).
+        #
+        # Issue #673 — a keyword parameter used to disqualify the whole
+        # signature, which silently unchecked the POSITIONAL arguments of
+        # every keyword-bearing signature in the bundle:
+        # `time.beginning_of_week("monday")` fired while
+        # `time.next_week("monday")`, `(?Symbol, ?same_time: bool)`, did not,
+        # though both raise the same way at runtime. Keywords cannot shift a
+        # positional argument's index, and a call that PASSES keywords never
+        # reaches here at all — `plain_positional_call?` rejects a
+        # `KeywordHashNode` argument (`**opts` included) before the signature
+        # is consulted.
         def argument_check_eligible?(function)
           # See `arity_eligible?`: `UntypedFunction` lacks
           # the per-arity accessors. Treat it as ineligible
           # for argument-type-mismatch diagnostics.
           return false unless function.respond_to?(:required_keywords)
 
-          function.rest_positionals.nil? &&
-            function.required_keywords.empty? &&
-            function.optional_keywords.empty? &&
-            function.rest_keywords.nil? &&
-            function.trailing_positionals.empty?
+          function.rest_positionals.nil? && function.trailing_positionals.empty?
         end
 
         def translate_param_type(rbs_type, environment)
@@ -2911,6 +3528,14 @@ module Rigor
         #
         # - Skips methods without an RBS declaration. The rule has no contract to compare against for
         #   source-only methods.
+        # - Skips a `def` whose only declaration was resolved through an ANCESTOR. `Reflection`'s lookup
+        #   reads the fully resolved method table, so a signature written about a base class answers for
+        #   every subclass that inherits the name; comparing an override's body against it reports the
+        #   override wrong for disagreeing with a contract that was never written about it (#744, and
+        #   the four redmine sites in #856). ADR-35 already specifies this rule as comparing a method's
+        #   OWN declared return, and the sibling override rules gate on `defined_on?` — this one did not.
+        #   The inherited-declaration signal belongs to the ADR-35 family, which requires both sides
+        #   authored. Decided in ADR-110 WD3.
         # - Skips methods whose enclosing class isn't a `Type::Singleton` self_type that we can name
         #   (top-level / module-level methods land outside the rule).
         # - Skips methods whose body's last expression is absent or types as `Dynamic[top]` (the
@@ -2933,15 +3558,28 @@ module Rigor
           declared = declared_return_type(def_node, scope_index)
           return nil if declared.nil?
 
-          inferred = inner_scope.type_of(last_expr)
+          # Issue #1362 — a body that ends on a builtin global still on its declared seed, or on a local copied from
+          # one, is judged by the file's writes to the global, as for an argument ({#single_argument_mismatch}).
+          inferred = DeclarationSourcedGuard.written_type(last_expr, inner_scope) || inner_scope.type_of(last_expr)
           return nil if dynamic_top?(inferred)
 
           severity = compare_return(declared, inferred)
           return nil if severity.nil?
+          return nil if declared_only_return?(last_expr, inferred, declared, inner_scope)
 
           build_return_type_mismatch_diagnostic(path, def_node, declared, inferred, severity)
         end
 
+        # Issue #1362 — a body that ends on a value mixing a builtin global's seed with something else is judged
+        # without the declared members the file never writes, as for an argument.
+        def declared_only_return?(last_expr, inferred, declared, scope)
+          return false unless DeclarationSourcedGuard.global_sources(last_expr, scope).empty?
+
+          DeclarationSourcedGuard.declared_only_rejection?(inferred, declared, scope) do |stripped|
+            compare_return(declared, stripped).nil?
+          end
+        end
+
         # The body of a `def` is the last `Prism::StatementsNode` child (or a single expression for
         # one-liner defs). Take the last statement; that's the implicit return.
         def body_last_expression(body)
@@ -2978,6 +3616,7 @@ module Rigor
               Reflection.singleton_method_definition(self_type.class_name, def_node.name, scope: scope)
             end
           return nil if method_def.nil?
+          return nil unless defined_on?(method_def, self_type.class_name)
 
           override = Rigor::RbsExtended.read_return_type_override(method_def, environment: scope.environment)
           return override if override
@@ -3156,9 +3795,15 @@ module Rigor
           names
         end
 
+        # Issue #732 — the predicate is asked of the SCOPE, not re-implemented here. This rule kept its own
+        # three-table copy until #723 widened the scope's with `discovered_methods` and left this one behind,
+        # so the two disagreed about exactly one shape (a project class with no instance def, no superclass
+        # and no include — `class Base; def self.build = :built; end`) with nothing observing the fork. #682
+        # made `Scope` the single owner of the candidate ORDER; this makes it the single owner of the
+        # predicate that filters those candidates too.
         def resolve_override_ancestor_name(scope, subclass_qualified, raw_ancestor)
           resolved = scope.ancestor_name_candidates(subclass_qualified, raw_ancestor)
-                          .find { |candidate| known_user_class?(scope, candidate) }
+                          .find { |candidate| scope.known_user_class?(candidate) }
           return resolved if resolved
 
           # ADR-46 slice 3 — the override checker reads the class graph
@@ -3172,12 +3817,6 @@ module Rigor
           nil
         end
 
-        def known_user_class?(scope, name)
-          scope.discovered_superclasses.key?(name) ||
-            scope.discovered_def_nodes.key?(name) ||
-            scope.discovered_includes.key?(name)
-        end
-
         def build_override_visibility_diagnostic(path, def_node, parent_class, parent_visibility, override_visibility)
           Diagnostic.from_name_loc(
             def_node,