rigortype 0.3.9 → 0.4.0

data/lib/rigor/analysis/check_rules.rb

@@ -25,6 +25,9 @@ require_relative "check_rules/ivar_write_collector"
 require_relative "check_rules/main_pass_collector"
 require_relative "check_rules/void_value_use_collector"
 require_relative "check_rules/self_closedness_scanner"
+require_relative "check_rules/source_arity"
+require_relative "check_rules/lexical_method_sites"
+require_relative "check_rules/special_global_setters"
 
 module Rigor
   module Analysis
@@ -135,24 +138,37 @@ module Rigor
       # (`diagnose`'s `Source::NodeWalker.each` `case`), now invoked by
       # {MainPassCollector} on the shared {RuleWalk}. Returns the
       # diagnostics for one node, in the same emission order as before.
-      def main_pass_node_diagnostics(path, node, scope_index)
+      def main_pass_node_diagnostics(path, node, scope_index, eval_ranges = nil, lexical_sites = nil)
         case node
         when Prism::CallNode
-          call_node_diagnostics(path, node, scope_index)
+          call_node_diagnostics(path, node, scope_index, eval_ranges, lexical_sites)
         when Prism::DefNode
           [
-            return_type_mismatch_diagnostic(path, node, scope_index),
+            refinement_aware_return_type_mismatch(path, node, scope_index, lexical_sites),
             override_visibility_diagnostic(path, node, scope_index),
             override_return_widened_diagnostic(path, node, scope_index),
             override_param_narrowed_diagnostic(path, node, scope_index)
           ].compact
         when Prism::IfNode, Prism::UnlessNode
           [unreachable_branch_diagnostic(path, node, scope_index)].compact
+        when Prism::GlobalVariableWriteNode, Prism::GlobalVariableOperatorWriteNode, Prism::MultiWriteNode
+          special_global_write_diagnostics(path, node, scope_index, lexical_sites)
         else
           []
         end
       end
 
+      # Issue #1120, maintainer ruling a′ — a `def` in a `refine X do … end` body redefines X's method by design, so
+      # X's declared return for the name is not its contract and a mismatch against it is not reported. Every other
+      # check in the body stands. The refine-body test runs only once a mismatch would report, so a file pays the
+      # {LexicalMethodSites} walk only then.
+      def refinement_aware_return_type_mismatch(path, node, scope_index, lexical_sites)
+        diagnostic = return_type_mismatch_diagnostic(path, node, scope_index)
+        return diagnostic if diagnostic.nil? || lexical_sites.nil?
+
+        lexical_sites.refinement_def?(node) ? nil : diagnostic
+      end
+
       # Constructs the fresh, unpopulated built-in collector set keyed by
       # role, including the main pass. Split out so the converged walk
       # (ADR-53 B4) can build the collectors, drive them via a
@@ -160,9 +176,12 @@ module Rigor
       # traversal, and hand the populated set back to {.diagnose} as
       # `node_collectors:`. The main pass needs `path` because its per-node
       # diagnostics carry it (ADR-53 B3c hosts it on the same walk).
-      def build_node_collectors(path, scope_index)
+      def build_node_collectors(path, scope_index, root = nil)
+        eval_ranges = receiver_eval_block_ranges(root)
+        lexical_sites = LexicalMethodSites.new(root)
+        main_pass = ->(node) { main_pass_node_diagnostics(path, node, scope_index, eval_ranges, lexical_sites) }
         {
-          main_pass: MainPassCollector.new(->(node) { main_pass_node_diagnostics(path, node, scope_index) }),
+          main_pass: MainPassCollector.new(main_pass),
           void_value_use: VoidValueUseCollector.new(scope_index),
           always_truthy: AlwaysTruthyConditionCollector.new(scope_index),
           unreachable_clauses: UnreachableClauseCollector.new(scope_index),
@@ -195,7 +214,7 @@ module Rigor
       # divergence aborts the run — the corpus-scale half of the
       # equivalence harness (the curated half is `rule_walk_equivalence_spec`).
       def run_node_collectors(path, root, scope_index)
-        collectors = build_node_collectors(path, scope_index)
+        collectors = build_node_collectors(path, scope_index, root)
         RuleWalk.run(root, collectors.values)
         shadow_verify_node_collectors(path, root, scope_index, collectors) if ENV["RIGOR_SHADOW_RULE_WALK"]
         collectors
@@ -239,8 +258,10 @@ module Rigor
       # produces them on the shared walk.
       def main_pass_oracle(path, root, scope_index)
         diagnostics = []
+        eval_ranges = receiver_eval_block_ranges(root)
+        lexical_sites = LexicalMethodSites.new(root)
         Source::NodeWalker.each(root) do |node|
-          diagnostics.concat(main_pass_node_diagnostics(path, node, scope_index))
+          diagnostics.concat(main_pass_node_diagnostics(path, node, scope_index, eval_ranges, lexical_sites))
         end
         diagnostics
       end
@@ -260,10 +281,10 @@ module Rigor
         shadow_verify_node_collectors(path, root, scope_index, collectors)
       end
 
-      def call_node_diagnostics(path, node, scope_index)
+      def call_node_diagnostics(path, node, scope_index, eval_ranges = nil, lexical_sites = nil)
         [
-          undefined_method_diagnostic(path, node, scope_index),
-          unresolved_toplevel_diagnostic(path, node, scope_index),
+          undefined_method_diagnostic(path, node, scope_index, lexical_sites),
+          unresolved_toplevel_diagnostic(path, node, scope_index, eval_ranges),
           wrong_arity_diagnostic(path, node, scope_index),
           argument_type_diagnostic(path, node, scope_index),
           nil_receiver_diagnostic(path, node, scope_index),
@@ -657,7 +678,7 @@ module Rigor
       class << self
         private
 
-        def undefined_method_diagnostic(path, call_node, scope_index) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        def undefined_method_diagnostic(path, call_node, scope_index, lexical_sites = nil) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
           return nil if call_node.receiver.nil?
 
           scope = scope_index[call_node]
@@ -665,10 +686,20 @@ module Rigor
 
           # The two exemptions that hold whatever shape the receiver has. Ahead of the receiver-shape
           # branch below because a plugin is consulted ONCE for the whole receiver, union included, so the
-          # gate belongs where that one consult is rather than duplicated into each shape's path. On the
-          # union side that is placement, not demonstrated coverage: no fixture reaches the gate through
-          # `union_undefined_method_diagnostic` today — every plugin-typed union anyone has built carries a
-          # `Singleton` arm, which `union_arm_blocks_undefined_fire?` declines on outright.
+          # gate belongs where that one consult is rather than duplicated into each shape's path.
+          #
+          # The union side of that placement IS reachable, contrary to what this comment used to say. The
+          # shape needs a non-nil union of at least two RBS-DECLARED classes — an undeclared arm is an
+          # ADR-26 open receiver and `union_arm_blocks_undefined_fire?` bails before the method lookup,
+          # which is why the earlier probes read silent and were misread as the gate being unreachable.
+          # `spec/integration/composite_receiver_plugin_typed_suppression_spec.rb` builds it. What keeps
+          # the gate from firing there today is that the dispatcher no longer records a plugin-typed call
+          # it declined (#1101), not that no such union can be built.
+          #
+          # Note what the gate would do if it were reached: the scalar `Ledger#settle` a plugin declares
+          # is exempt here, while `(Ledger | Invoice)#settle` is not, because the union rule's own
+          # `method_present_anywhere?` reads RBS and project source and never asks the registry. Closing
+          # that asymmetry is #653's union coverage, not this rule's placement.
           # See {#call_site_exempt?}.
           return nil if call_site_exempt?(call_node, scope)
 
@@ -739,7 +770,7 @@ module Rigor
           method_def = lookup_method(receiver_type, class_name, call_node.name, scope)
           return nil if method_def
 
-          return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind)
+          return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites)
 
           definition_site = project_definition_site(scope, class_name, call_node.name, kind)
           # Issue #735 — the site is evidence, and whose RBS this is decides what it is evidence OF. On a
@@ -754,9 +785,54 @@ module Rigor
           build_undefined_method_diagnostic(path, call_node, receiver_type, definition_site, class_name)
         end
 
-        # The two probes that run only once every cheaper answer has come back "absent", kept together
+        # Issue #1120 — the method exists at THIS call site but not everywhere: a refinement whose `using` is in
+        # effect here, or a `def o.m` on the receiver local in this scope. Asked from {#last_resort_surface_answers?},
+        # once every project-wide table has come back "absent", so the file walk behind {LexicalMethodSites} runs
+        # only for a call about to fire.
+        # A refinement answers instance-side receivers only: a refined singleton (`refine X.singleton_class`) names
+        # no constant target, so nothing records it.
+        def lexically_defined_method?(class_name, call_node, scope, kind, lexical_sites)
+          return false if lexical_sites.nil?
+          return true if lexical_sites.singleton_local_def?(call_node)
+          return false unless kind == :instance
+
+          # ADR-46 — the answer below is a function of every refinement of this name in the project, so the
+          # consumer depends on the name whichever way it answers; a refine body edited in another file must
+          # re-check it (`IncrementalSession#refinement_affected`).
+          DependencyRecorder.read_name(:refinement, call_node.name) if DependencyRecorder.active?
+          modules = refining_modules(scope, class_name, call_node.name)
+          !modules.nil? && lexical_sites.refinement_active?(call_node, modules)
+        end
+
+        # Issue #1120 — every module that refines `method_name` into `class_name` or one of its ancestors (a
+        # refinement of `Object` reaches a `String` receiver), or nil when none does. The table is empty on a
+        # project that refines nothing, which answers without a lookup.
+        def refining_modules(scope, class_name, method_name)
+          refinements = scope.discovered_refinements
+          return nil if refinements.empty?
+
+          modules = nil
+          refinements.each do |refined, methods|
+            names = methods[method_name]
+            next if names.nil? || !refined_receiver_class?(scope, class_name, refined)
+
+            (modules ||= []).concat(names)
+          end
+          modules
+        end
+
+        def refined_receiver_class?(scope, class_name, refined)
+          return true if class_name == refined
+
+          environment = scope.environment
+          !environment.nil? && environment.class_ordering(class_name, refined) == :subclass
+        end
+
+        # The probes that run only once every cheaper answer has come back "absent", kept together
         # because they share that position and nothing else.
         #
+        # - Issue #1120 — a method that exists at this call site only: a refinement in effect here, or a
+        #   singleton `def` on the receiver local ({#lexically_defined_method?}).
         # - Issue #739 — an instance-side MODULE receiver. A value typed as a mixin module is an instance of
         #   some class that includes it, and that class contributes an arbitrary surface: inside
         #   `module Attachable::InstanceMethods`, `self.project` is defined by the ActiveRecord model that
@@ -777,7 +853,8 @@ module Rigor
         #   it"; a project ancestor still might, and the typer has already resolved the site through
         #   exactly this walk. It is last because it is the only probe here that walks the class graph
         #   (see {#ancestry_declares_method?} for why that placement is load-bearing, not tidiness).
-        def last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind)
+        def last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites = nil)
+          return true if lexically_defined_method?(class_name, call_node, scope, kind, lexical_sites)
           return true if module_mixin_receiver?(receiver_type, scope)
           return true if mixin_self_class_receiver?(call_node, scope)
           return true if unknown_mixin_includer?(class_name, scope)
@@ -933,7 +1010,7 @@ module Rigor
         # Authored severity is `:warning`; the severity profile
         # remaps it (`strict` → `:error`, `balanced` →
         # `:warning`, `lenient` → `:off` / suppressed).
-        def unresolved_toplevel_diagnostic(path, call_node, scope_index)
+        def unresolved_toplevel_diagnostic(path, call_node, scope_index, eval_ranges = nil)
           return nil unless call_node.receiver.nil?
 
           scope = scope_index[call_node]
@@ -944,10 +1021,51 @@ module Rigor
           return nil if scope.top_level_def_for(name)
           return nil if source_declared_method?(scope, "Object", name, :instance)
           return nil if Rigor::Reflection.instance_method_definition("Object", name, scope: scope)
+          # `Target.class_eval { def added = 1; def use_added = added }` files the defs on Target
+          # but leaves the eval body with a nil `self_type`, so `toplevel?` still holds. An eval
+          # body is morally a class body, so ADR-34 stays silent there — including on a genuinely
+          # undefined name inside the block. Ranges are computed once per file.
+          return nil if call_inside_receiver_eval_ranges?(eval_ranges, call_node)
 
           build_unresolved_toplevel_diagnostic(path, call_node)
         end
 
+        # ScopeIndexer keeps RECEIVER_EVAL_CALLS private; this list is the same family
+        # (`class_eval` / `module_eval` / `class_exec` / `module_exec` / `instance_eval` /
+        # `instance_exec`). Used only to decline ADR-34 inside those blocks.
+        RECEIVER_EVAL_CALL_NAMES = %i[
+          class_eval module_eval class_exec module_exec instance_eval instance_exec
+        ].freeze
+        private_constant :RECEIVER_EVAL_CALL_NAMES
+        EMPTY_EVAL_RANGES = [].freeze
+        private_constant :EMPTY_EVAL_RANGES
+
+        def receiver_eval_block_ranges(root)
+          return EMPTY_EVAL_RANGES if root.nil?
+
+          ranges = []
+          Source::NodeWalker.each(root) do |node|
+            next unless node.is_a?(Prism::CallNode)
+            next unless RECEIVER_EVAL_CALL_NAMES.include?(node.name)
+
+            block = node.block
+            next unless block.is_a?(Prism::BlockNode)
+
+            loc = block.location
+            ranges << [loc.start_offset, loc.end_offset]
+          end
+          ranges
+        end
+
+        def call_inside_receiver_eval_ranges?(eval_ranges, call_node)
+          return false if eval_ranges.nil? || eval_ranges.empty?
+
+          loc = call_node.location
+          eval_ranges.any? do |start_offset, end_offset|
+            loc.start_offset >= start_offset && loc.end_offset <= end_offset
+          end
+        end
+
         def build_unresolved_toplevel_diagnostic(path, call_node)
           Diagnostic.from_message_loc(
             call_node,
@@ -1449,7 +1567,7 @@ module Rigor
         # by `undefined_method_diagnostic`; it returns nil
         # when the call's receiver / RBS coverage / call shape
         # disqualifies the rule.
-        # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
+        # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         def wrong_arity_diagnostic(path, call_node, scope_index)
           return nil if call_node.receiver.nil?
           return nil unless plain_positional_call?(call_node)
@@ -1481,25 +1599,110 @@ module Rigor
           # `.new` against the real `Struct.new(*Symbol)` signature is a
           # false positive. Skip arity-checking the chained position.
           return nil if anonymous_struct_new_call?(call_node, class_name, kind)
-          return nil if scope.discovered_method?(class_name, call_node.name, kind)
 
-          return nil unless Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
-          return nil unless definition_available?(receiver_type, class_name, scope)
-
-          method_def = trustworthy_signature(receiver_type, class_name, call_node, scope)
-          return nil if method_def.nil?
-          return nil if undeclared_constructor?(class_name, call_node, kind, method_def)
-
-          arity_envelope = compute_arity_envelope(method_def)
+          arity_envelope = arity_envelope_for(receiver_type, class_name, call_node, scope, kind)
           return nil if arity_envelope.nil?
 
           actual = (call_node.arguments&.arguments || []).size
-          min, max = arity_envelope
-          return nil if actual.between?(min, max)
+          min, max, source_arity = arity_envelope
+          if actual.between?(min, max)
+            source_arity&.settle_by_definitions
+            return nil
+          end
+          # Issue #992 — a source envelope's remaining declines can only withhold, so they run only now.
+          source_arity&.settle_by_walk
+          return nil if source_arity && !source_arity.authoritative?(class_name)
 
           build_arity_diagnostic(path, call_node, class_name, min, max, actual)
         end
 
+        # The `[min, max]` the call is checked against — a declared signature's, or (issue #992) the project
+        # `def`'s own when no signature declares the method, with the {SourceArity} that found it as a third
+        # element — or nil when neither may be trusted.
+        #
+        # Issue #991 — `discovered_method?` used to exempt the call outright before ever asking for a
+        # declaration. `trustworthy_signature` is the same lookup `argument_type_diagnostic` treats as
+        # authoritative over a source `def` (see its own comment beside that call), and the two rules must agree
+        # on whose contract binds, so a declared method is checked against its declaration.
+        def arity_envelope_for(receiver_type, class_name, call_node, scope, kind)
+          if Rigor::Reflection.rbs_class_known?(class_name, scope: scope)
+            return nil unless definition_available?(receiver_type, class_name, scope)
+
+            method_def = trustworthy_signature(receiver_type, class_name, call_node, scope)
+            if method_def && !Rigor::RbsExtended.inferred_signature?(method_def)
+              return nil if undeclared_constructor?(class_name, call_node, kind, method_def)
+
+              return compute_arity_envelope(method_def)
+            end
+            return nil unless source_lane_open?(method_def, receiver_type, class_name, call_node, scope)
+          end
+
+          source_arity_envelope(class_name, call_node, scope, kind)
+        end
+
+        # Issue #992 — whether a class RBS knows may still be checked against its project `def`. Two lanes:
+        #
+        # - the member resolved and carries `%a{rigor:v1:inferred-signature}`: under ADR-93 the bundled
+        #   `rigor-rbs-inline` plugin emits a full skeleton for EVERY `def` in a file carrying at least one
+        #   annotation (#823), with every type slot defaulted, so nobody asserted anything about it. Its arity
+        #   is NOT read here — the `def`'s envelope is, through the same {SourceArity} walk as a method with no
+        #   member at all, so one `def` is never judged by two readings of its parameter list;
+        # - no member resolved, and the class's declaration is the project's own `sig/`
+        #   (`project_declared_class?`): a partial sidecar of a project class whose `def` lives in source.
+        #
+        # Everything else declines. A bundled declaration (core / stdlib / gem) describes a class the project
+        # does not own, so a project `def` on it is an ADR-17 monkey-patch that another library may patch too;
+        # a lookup that raised, or a name an open receiver only inherited (`trustworthy_signature` answered
+        # nil for those while a raw lookup does not), is not "no member".
+        def source_lane_open?(method_def, receiver_type, class_name, call_node, scope)
+          return true if method_def
+
+          lookup_method(receiver_type, class_name, call_node.name, scope).nil? &&
+            Rigor::Reflection.project_declared_class?(class_name, scope: scope)
+        end
+
+        # Issue #992 — stage 1 of {SourceArity}: the nearest project definition's envelope, after the
+        # receiver-level declines that need no walk. Stage 2 (`SourceArity#authoritative?`) runs only once the
+        # count is known to fall outside it.
+        def source_arity_envelope(class_name, call_node, scope, kind)
+          return nil unless scope.discovered_parameter_envelopes.key?(Scope::DiscoveryIndex::ENVELOPE_PROJECT_WIDE)
+          return nil if unbounded_receiver_surface?(class_name, scope)
+          return nil if plugin_typed_call?(call_node, scope)
+          # An instance of a project module is an instance of whatever includes it (#739's reasoning, which
+          # `module_mixin_receiver?` can only apply to a module RBS declares).
+          return nil if kind == :instance && project_module?(class_name, scope)
+          return nil if project_module_class_receiver?(call_node, scope)
+
+          arity = SourceArity.new(scope, call_node.name, kind)
+          envelope = arity.owner_envelope(class_name)
+          if envelope.nil? || envelope[2]
+            envelope.nil? && arity.ambiguous? ? arity.settle_by_walk : arity.settle_by_definitions
+            return nil
+          end
+
+          [envelope[0], envelope[1] || Float::INFINITY, arity]
+        end
+
+        # `self.class.f(1)` inside a project module's instance method: the engine types `self.class` as the
+        # module's singleton, but at runtime it is the includer's class, whose class methods are its own. The
+        # source-lane twin of {#mixin_self_class_receiver?}, which can only see a module RBS declares.
+        def project_module_class_receiver?(call_node, scope)
+          receiver = call_node.receiver
+          return false unless receiver.is_a?(Prism::CallNode) && receiver.name == :class && receiver.arguments.nil?
+          return false if receiver.receiver.nil?
+
+          inner = concrete_class_name(scope.type_of(receiver.receiver))
+          !inner.nil? && project_module?(inner, scope)
+        end
+
+        # Read off the table directly rather than through `Scope#parameter_envelopes_of`: a class does not turn
+        # into a module without its declaration (and so the receiver's own typing) changing, so this answer
+        # needs no ADR-46 class edge of its own.
+        def project_module?(class_name, scope)
+          bucket = scope.discovered_parameter_envelopes[class_name.to_s]
+          !bucket.nil? && bucket.key?(Scope::DiscoveryIndex::ENVELOPE_MODULE_MARK)
+        end
+
         # Issue #917 — no loaded RBS declares a constructor for this class. The definition builder
         # synthesizes `.new` from the nearest `initialize` in the ancestry, and when nothing declares
         # one that is `BasicObject#initialize: () -> void`, so `.new` derives a nullary envelope that
@@ -1640,7 +1843,10 @@ module Rigor
           # {DeclarationSourcedGuard} exactly what it asked before — but it
           # now asks it through the predicate the argument-type gates share
           # (issue #324), which is what keeps the two rules from drifting.
-          return nil if DeclarationSourcedGuard.marked?(call_node.receiver, scope)
+          #
+          # Issue #1362 — a local copied from a global still on its declared seed (`sep = $/`) is asked against the
+          # file's writes to that global instead: its declared `nil` is withheld, and one the file writes still fires.
+          return nil if DeclarationSourcedGuard.withholds_nil?(call_node.receiver, scope)
 
           # ADR-67 WD6b — an inferred-parameter receiver's type (incl. any nil constituent unioned in from a
           # nil call site) is an open-call-site lower bound; a possible-nil firing against it is an FP by
@@ -2165,6 +2371,200 @@ module Rigor
           )
         end
 
+        # Issue #1367 (ADR-117 Decision point 1, WD2) — `global.write-type-mismatch` and `global.readonly-write`: a
+        # write to a special global that the interpreter's setter rejects, so the write raises every time it runs.
+        # The envelope is {SpecialGlobalSetters}: the setter, not the global's RBS declaration.
+        #
+        # - `global.readonly-write` needs no type. `$g = v`, `$g op= v` and a target of a multiple assignment
+        #   (`$g, x = …`, `*$g`) always write, so a write to a read-only special raises.
+        # - `global.write-type-mismatch` checks `$g = v` only when `v` is a literal node
+        #   ({SpecialGlobalSetters.literal_class}), whose class the syntax fixes. Any other value is never reported,
+        #   whatever its inferred type: a class RBS declares without `write` or `to_str` does not prove the object
+        #   lacks it (a singleton `def`, an `extend`, or a run-time `alias to_str to_s`, as URI has).
+        # - `$g ||= v` and `$g &&= v` write only when the current value is falsy (truthy), so neither rule checks
+        #   them, nor a `for` index or a `rescue => $g` reference.
+        # - A special that any project file aliases (`alias $stdout $out`, either side) is exempt from both.
+        def special_global_write_diagnostics(path, node, scope_index, lexical_sites)
+          case node
+          when Prism::GlobalVariableWriteNode
+            [readonly_global_write_diagnostic(path, node, scope_index) ||
+              global_write_type_diagnostic(path, node, scope_index, lexical_sites)].compact
+          when Prism::GlobalVariableOperatorWriteNode
+            [readonly_global_write_diagnostic(path, node, scope_index)].compact
+          when Prism::MultiWriteNode
+            multi_write_global_targets(node).filter_map do |target|
+              readonly_global_write_diagnostic(path, target, scope_index)
+            end
+          else
+            []
+          end
+        end
+
+        # The `GlobalVariableTargetNode`s a multiple assignment writes, through a splat (`*$g`) and nested
+        # destructuring (`(a, $g), b = …`).
+        def multi_write_global_targets(node)
+          [*node.lefts, node.rest, *node.rights].flat_map do |target|
+            case target
+            when Prism::GlobalVariableTargetNode then [target]
+            when Prism::SplatNode
+              target.expression.is_a?(Prism::GlobalVariableTargetNode) ? [target.expression] : []
+            when Prism::MultiTargetNode then multi_write_global_targets(target)
+            else []
+            end
+          end
+        end
+
+        def readonly_global_write_diagnostic(path, node, scope_index)
+          return nil unless SpecialGlobalSetters.read_only?(node.name)
+
+          scope = scope_index[node]
+          return nil if scope.nil? || global_aliased?(scope, node.name)
+
+          location = node.respond_to?(:name_loc) ? node.name_loc : node.location
+          Diagnostic.from_location(
+            location,
+            rule: RULE_GLOBAL_READONLY_WRITE,
+            path: path,
+            message: "`#{node.name}' is a read-only variable; this write raises NameError at runtime",
+            severity: :error
+          )
+        end
+
+        def global_write_type_diagnostic(path, node, scope_index, lexical_sites)
+          contract = SpecialGlobalSetters.contract_for(node.name)
+          return nil if contract.nil?
+
+          class_name = SpecialGlobalSetters.literal_class(node.value)
+          return nil if class_name.nil?
+
+          scope = scope_index[node]
+          return nil if scope.nil?
+          return nil unless literal_rejected?(class_name, contract, node, scope, lexical_sites)
+          return nil if global_aliased?(scope, node.name)
+
+          build_global_write_type_diagnostic(path, node, contract, class_name)
+        end
+
+        # The project's {Inference::GlobalWriteCensus} with the `pre_eval:` files' own.
+        def global_write_census(scope)
+          census = scope.discovered_global_write_census
+          pre_eval = scope.environment&.project_patched_methods&.write_census
+          pre_eval.nil? || pre_eval.empty? ? census : census | pre_eval
+        end
+
+        # Whether any project or `pre_eval:` file aliases `name`, on either side, which can make it another variable.
+        def global_aliased?(scope, name)
+          Inference::GlobalWriteCensus.aliased?(global_write_census(scope), name)
+        end
+
+        # A literal is rejected when its class is none the setter takes and, for a setter that also converts
+        # (`to_str`, `to_int`) or asks for `write`, the literal's object cannot answer that method.
+        def literal_rejected?(class_name, contract, node, scope, lexical_sites)
+          return false if contract.accepts_class?(class_name)
+          return true if contract.conversion.nil?
+
+          !literal_may_answer?(class_name, contract.conversion, node, scope, lexical_sites)
+        end
+
+        # The escape hatches through which an object answers a method its class does not define: the setter's
+        # `respond_to?` and implicit conversion both consult them.
+        GLOBAL_WRITE_HATCHES = %i[method_missing respond_to_missing? respond_to?].freeze
+        private_constant :GLOBAL_WRITE_HATCHES
+
+        # Where RBS core declares the hatches every object inherits unchanged.
+        DEFAULT_HATCH_OWNERS = %w[::BasicObject ::Kernel ::Object].freeze
+        private_constant :DEFAULT_HATCH_OWNERS
+
+        # Whether the literal's object may answer `method_name` after all:
+        #
+        # - RBS gives its class the method, or a hatch of its own (a project `sig/` reopening or `include` counts);
+        # - the program defines the method or a hatch anywhere, in any spelling, on any receiver
+        #   ({Inference::GlobalWriteCensus}): no census of where a definition lands can be complete
+        #   (`class << nil`, `K = Integer; class K`, `[Integer].each { |k| k.define_method(:write) }`);
+        # - an ancestor's surface is rewritten from outside (`Integer.include(M)`, `Object.include(M)`, a string
+        #   `class_eval`: the `ENVELOPE_DYNAMIC_MARK`), or it or `Object` mixes in a module RBS does not rule out;
+        # - for `write` only, a refinement that may add it is in effect at the write ({#refined_writer_in_effect?}).
+        def literal_may_answer?(class_name, method_name, node, scope, lexical_sites)
+          definition = Rigor::Reflection.instance_definition(class_name, scope: scope)
+          return true if definition.nil?
+          return true if definition.methods.key?(method_name) || overridden_hatch?(definition)
+
+          ancestors = definition.ancestors.ancestors.to_set { |ancestor| ancestor.name.to_s.delete_prefix("::") }
+          names = [method_name, *GLOBAL_WRITE_HATCHES]
+          census = global_write_census(scope)
+          program_may_answer?(ancestors, names, census, scope) ||
+            (method_name == :write && refined_writer_in_effect?(census, node, lexical_sites))
+        end
+
+        def overridden_hatch?(definition)
+          GLOBAL_WRITE_HATCHES.any? do |name|
+            method = definition.methods[name]
+            method && !DEFAULT_HATCH_OWNERS.include?(method.defined_in.to_s)
+          end
+        end
+
+        def program_may_answer?(ancestors, names, census, scope)
+          return true if Inference::GlobalWriteCensus.defines_any_of?(census, names)
+
+          dynamic_mark = Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK
+          return true if ancestors.any? { |owner| scope.parameter_envelopes_of(owner).key?(dynamic_mark) }
+
+          main_mixins = Inference::GlobalWriteCensus.main_mixins(census)
+          main_mixins.any? { |mixin| rbs_mixin_may_answer?(mixin, names, scope) } ||
+            mixin_may_answer?(ancestors, names, scope)
+        end
+
+        # A module an ancestor of the literal's class mixes in through a class body (`class Integer; include
+        # Writable; end`), followed through the modules it mixes in in turn. A project module answers when its
+        # surface is rewritten beyond literal names (a `send(:include, …)`, a non-constant mixin); its literal
+        # definitions are the census's. Any other module answers when RBS does not know it or declares one of
+        # `names`.
+        def mixin_may_answer?(ancestors, names, scope)
+          queue = ancestors.flat_map { |owner| scope.includes_of(owner) }
+          seen = Set.new
+          until queue.empty?
+            mixin = queue.shift
+            next unless seen.add?(mixin)
+
+            bucket = scope.parameter_envelopes_of(mixin)
+            if bucket.key?(Scope::DiscoveryIndex::ENVELOPE_MODULE_MARK)
+              return true if bucket.key?(Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK)
+
+              queue.concat(scope.includes_of(mixin))
+            elsif rbs_mixin_may_answer?(mixin, names, scope)
+              return true
+            end
+          end
+          false
+        end
+
+        def rbs_mixin_may_answer?(mixin, names, scope)
+          definition = Rigor::Reflection.instance_definition(mixin, scope: scope)
+          definition.nil? || definition.methods.key?(names.first) || overridden_hatch?(definition)
+        end
+
+        # For `write` only: some refinement may add `write` (a `def`, `define_method` or `alias_method` in a `refine`
+        # block, or an `import_methods`), and a `using` is in effect at the write. Which class it refines is not asked:
+        # the target may be computed (`[Array].each { |k| refine(k) { … } }`) or a constant alias (`T = Array;
+        # refine(T)`), so a refined `write` on any class declines every literal. `respond_to?(:write)` honours an
+        # active refinement on Ruby 4.0.5; a refined `respond_to_missing?` or `respond_to?`, and every implicit
+        # conversion, do not, so a refinement that adds only those leaves the write reported.
+        def refined_writer_in_effect?(census, node, lexical_sites)
+          Inference::GlobalWriteCensus.refines_write?(census) &&
+            (lexical_sites.nil? || lexical_sites.using_in_effect?(node))
+        end
+
+        def build_global_write_type_diagnostic(path, node, contract, class_name)
+          Diagnostic.from_name_loc(
+            node,
+            rule: RULE_GLOBAL_WRITE_TYPE_MISMATCH,
+            path: path,
+            message: "`#{node.name}' accepts only #{contract.accepts}; this write assigns " \
+                     "#{SpecialGlobalSetters.literal_description(class_name)}, which raises TypeError at runtime",
+            severity: :error
+          )
+        end
+
         # v0.1.2 — `flow.unreachable-branch`. Fires when an `IfNode` / `UnlessNode` whose predicate is a
         # literal `true` / `false` / `nil` (or a literal numeric / string / symbol whose Ruby truthiness is
         # known at-a-glance) has an observable dead branch. The diagnostic points at the dead branch (not
@@ -2503,7 +2903,7 @@ module Rigor
           return nil if method_def.nil?
 
           param_overrides = Rigor::RbsExtended.param_type_override_map(method_def, environment: scope.environment)
-          mismatch = argument_mismatch(method_def.method_types, call_node, scope, param_overrides)
+          mismatch = argument_mismatch(method_def.method_types, call_node, scope, param_overrides, scope_index)
           return nil if mismatch.nil?
           return nil if inferred_param_mismatch_verdict?(call_node, mismatch, scope)
 
@@ -2529,12 +2929,15 @@ module Rigor
         # overload rejects) plus, on non-coerce methods, the non-nil channel
         # (a single-concrete-class argument every overload rejects). See
         # {#multi_overload_argument_mismatch}.
-        def argument_mismatch(method_types, call_node, scope, param_overrides)
+        #
+        # Each argument is typed from its own index entry, which is the call's unless an earlier operand moved
+        # the scope it was entered from (issue #1256): `(k = 0; 5)[k]` checks `k` as the `0` it holds there.
+        def argument_mismatch(method_types, call_node, scope, param_overrides, scope_index)
           mismatch =
             if method_types.size == 1
-              first_argument_mismatch(method_types.first, call_node, scope, param_overrides)
+              first_argument_mismatch(method_types.first, call_node, scope, param_overrides, scope_index)
             else
-              multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides)
+              multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides, scope_index)
             end
           return nil if mismatch && keyword_bearing?(method_types) && nil_tainted?(mismatch[:actual])
 
@@ -2586,28 +2989,35 @@ module Rigor
         #   stays deferred), and decides acceptance on the RBS param type
         #   ({#param_accepts_arg_class?}) so it sees through the `int` / `string`
         #   interface-aliases the translator degrades.
-        def multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides)
+        def multi_overload_argument_mismatch(method_types, call_node, scope, param_overrides, scope_index)
           functions = method_types.map(&:type)
           return nil unless functions.all? { |function| argument_check_eligible?(function) }
 
           coerce_method = COERCE_DISPATCH_METHODS.include?(call_node.name)
           arguments = call_node.arguments&.arguments || []
           arguments.each_with_index do |arg, index|
-            arg_type = scope.type_of(arg)
             params = checkable_overload_params(method_types, index, param_overrides, scope)
             next if params.nil?
 
-            mismatch =
-              if nil_member?(arg_type) # pure nil only — not a `T | nil` union
-                nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
-              elsif !coerce_method
-                non_nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
-              end
+            mismatch = overload_argument_mismatch(arg, params, param_overrides,
+                                                  argument_scope(arg, scope, scope_index), coerce_method)
             return mismatch if mismatch
           end
           nil
         end
 
+        # The mismatch (or nil) for one argument against the parameter every overload has at its position. Issue
+        # #1362 — a builtin global's seed, or its copy, is judged by the file's writes to the global.
+        def overload_argument_mismatch(arg, params, param_overrides, arg_scope, coerce_method)
+          written = DeclarationSourcedGuard.written_type(arg, arg_scope)
+          arg_type = written || arg_scope.type_of(arg)
+          if nil_member?(arg_type) # pure nil only — not a `T | nil` union
+            nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, arg_scope, written: !written.nil?)
+          elsif !coerce_method
+            non_nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, arg_scope)
+          end
+        end
+
         # The parameter set at `index` that a verdict may rest on, or nil when there is none — the two
         # reasons being arity divergence (an overload with no param there, which is `call.wrong-arity`'s
         # concern) and an overload whose param names a class carrying no definition ({#stub_typed_param?},
@@ -2623,8 +3033,8 @@ module Rigor
 
         # The nil channel: a pure `nil` argument no overload admits (ADR-58
         # parity excuses a declaration-sourced ivar nil).
-        def nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope)
-          return nil if declaration_sourced_nil_argument?(arg, scope)
+        def nil_arg_overload_mismatch(arg, arg_type, params, param_overrides, scope, written: false)
+          return nil if !written && declaration_sourced_nil_argument?(arg, scope)
           return nil if params.any? { |param| param_admits_nil?(param, param_overrides, scope) }
 
           { node: arg, name: nil, expected: overload_param_expected_label(params), actual: arg_type }
@@ -2891,7 +3301,7 @@ module Rigor
           DeclarationSourcedGuard.marked?(arg, scope)
         end
 
-        def first_argument_mismatch(method_type, call_node, scope, param_overrides)
+        def first_argument_mismatch(method_type, call_node, scope, param_overrides, scope_index)
           function = method_type.type
           return nil unless argument_check_eligible?(function)
 
@@ -2901,12 +3311,17 @@ module Rigor
             param = params[index]
             next if param.nil? # arity mismatch is the wrong-arity rule's concern.
 
-            mismatch = single_argument_mismatch(param, arg, scope, param_overrides)
+            mismatch = single_argument_mismatch(param, arg, argument_scope(arg, scope, scope_index), param_overrides)
             return mismatch if mismatch
           end
           nil
         end
 
+        # The scope `arg` is checked from: its own index entry ({#argument_mismatch}), else the call's.
+        def argument_scope(arg, call_scope, scope_index)
+          scope_index[arg] || call_scope
+        end
+
         # The mismatch (or nil) for one positional argument against one
         # parameter. The nil channel decides a pure `nil` argument on the RBS
         # parameter type — seeing through the `string` / `int` interface-alias
@@ -2917,6 +3332,17 @@ module Rigor
         def single_argument_mismatch(param, arg, scope, param_overrides)
           return nil if stub_typed_param?(param, param_overrides, scope)
 
+          # Issue #1362 (ADR-58 parity, ADR-117 Decision point 2) — a read of a builtin global still on its declared
+          # seed, or a local copied from one, is judged by the file's writes to the global, as the argument was
+          # before the join: the declared members are not diagnostic fuel.
+          written = DeclarationSourcedGuard.written_type(arg, scope)
+          return written_argument_mismatch(param, arg, written, scope, param_overrides) if written
+
+          read_argument_mismatch(param, arg, scope, param_overrides)
+        end
+
+        # {#single_argument_mismatch} for an argument that reads no builtin global's seed directly.
+        def read_argument_mismatch(param, arg, scope, param_overrides)
           arg_type = scope.type_of(arg)
 
           if nil_member?(arg_type)
@@ -2930,10 +3356,42 @@ module Rigor
           return nil if param_type.is_a?(Type::Dynamic) || param_type.is_a?(Type::Top)
           return nil if arg_type.is_a?(Type::Dynamic) || arg_type.is_a?(Type::Top)
           return nil unless argument_genuinely_mismatches?(arg, arg_type, param_type, scope)
+          # Issue #1362 — a value that mixes such a global with something else (`c ? $stdout : StringIO.new`) is judged
+          # without the declared members the file never writes, as it was before the join.
+          return nil if DeclarationSourcedGuard.declared_only_rejection?(arg_type, param_type, scope) do |stripped|
+            !plain_argument_rejects?(param, stripped, scope, param_overrides)
+          end
 
           { node: arg, name: param.name, expected: param_type, actual: arg_type }
         end
 
+        # The mismatch for an argument judged by `written`, the file's writes to the builtin globals it reads the
+        # seeds of, through the channels {#single_argument_mismatch} runs, without the ADR-58 withholding: before
+        # the join the global carried no mark.
+        def written_argument_mismatch(param, arg, written, scope, param_overrides)
+          return nil unless plain_argument_rejects?(param, written, scope, param_overrides)
+
+          expected =
+            if nil_member?(written)
+              overload_param_expected_label([param])
+            else
+              param_overrides[param.name] || translate_param_type(param.type, scope.environment)
+            end
+          { node: arg, name: param.name, expected: expected, actual: written }
+        end
+
+        # True when `param` rejects an argument of type `type` on the terms of {#single_argument_mismatch}'s nil and
+        # non-nil channels, without the ADR-58 withholding.
+        def plain_argument_rejects?(param, type, scope, param_overrides)
+          return !param_admits_nil?(param, param_overrides, scope) if nil_member?(type)
+
+          param_type = param_overrides[param.name] || translate_param_type(param.type, scope.environment)
+          return false if param_type.is_a?(Type::Dynamic) || param_type.is_a?(Type::Top)
+          return false if type.is_a?(Type::Dynamic) || type.is_a?(Type::Top)
+
+          Inference::Acceptance.accepts(param_type, type, mode: :gradual).no?
+        end
+
         # The parameter rejects the argument AND the rejection is not a
         # withheld declaration-sourced-nil case.
         def argument_genuinely_mismatches?(arg, arg_type, param_type, scope)
@@ -3100,15 +3558,28 @@ module Rigor
           declared = declared_return_type(def_node, scope_index)
           return nil if declared.nil?
 
-          inferred = inner_scope.type_of(last_expr)
+          # Issue #1362 — a body that ends on a builtin global still on its declared seed, or on a local copied from
+          # one, is judged by the file's writes to the global, as for an argument ({#single_argument_mismatch}).
+          inferred = DeclarationSourcedGuard.written_type(last_expr, inner_scope) || inner_scope.type_of(last_expr)
           return nil if dynamic_top?(inferred)
 
           severity = compare_return(declared, inferred)
           return nil if severity.nil?
+          return nil if declared_only_return?(last_expr, inferred, declared, inner_scope)
 
           build_return_type_mismatch_diagnostic(path, def_node, declared, inferred, severity)
         end
 
+        # Issue #1362 — a body that ends on a value mixing a builtin global's seed with something else is judged
+        # without the declared members the file never writes, as for an argument.
+        def declared_only_return?(last_expr, inferred, declared, scope)
+          return false unless DeclarationSourcedGuard.global_sources(last_expr, scope).empty?
+
+          DeclarationSourcedGuard.declared_only_rejection?(inferred, declared, scope) do |stripped|
+            compare_return(declared, stripped).nil?
+          end
+        end
+
         # The body of a `def` is the last `Prism::StatementsNode` child (or a single expression for
         # one-liner defs). Take the last statement; that's the implicit return.
         def body_last_expression(body)