rigortype 0.4.1 → 0.4.2

data/lib/rigor/analysis/reachability/scan.rb

@@ -28,8 +28,11 @@ module Rigor
 
         # One constant reference. `from` is the fully-qualified name of the innermost enclosing declaration, or
         # nil for a reference written at file level — that is what makes the graph a reachability graph rather
-        # than a reference count (ADR-102 WD2). `role` is the referring FILE's role (WD8). `rooted` is true
-        # when the constant was written with a leading `::` (#625).
+        # than a reference count (ADR-102 WD2). A reference in a declaration's own header — `class Sub < Base`,
+        # `Sub = Class.new(Base)` — is credited to that declaration, while `nesting` stays the outer scope it
+        # resolves in (#1720); that header case is the only one where `from` is not `nesting` joined. `role` is
+        # the referring FILE's role (WD8). `rooted` is true when the constant was written with a leading `::`
+        # (#625).
         Reference = Data.define(:as_written, :nesting, :from, :role, :path, :line, :rooted) do
           def initialize(rooted: false, **) = super
         end
@@ -45,31 +48,69 @@ module Rigor
         #   children (#370). `config/recurring.yml` mentioning `Admin` is not evidence about
         #   `Admin::CollectionPolicy`; treating it as such demoted 18 unrelated Mastodon rows off one
         #   Afrikaans word ("Administrasie" contains "Admin").
-        DynamicUse = Data.define(:name, :prefix, :reason, :site, :path, :line, :scope) do
-          def initialize(scope: :namespace, **) = super
+        # - `:leading` — `"V#{version}"` is the START of a name, not a namespace, so it can construct `V1_0`
+        #   and `V2_2` as well as anything beneath them: a string-prefix match (#1734).
+        #
+        # `within` is set for `Foo.const_get("Bar::#{k}")`: `prefix` is then relative to the receiver, a
+        # {Reference} that {Graph} resolves as it resolves any other before matching.
+        DynamicUse = Data.define(:name, :prefix, :reason, :site, :path, :line, :scope, :within) do
+          def initialize(scope: :namespace, within: nil, **) = super
 
           # Whether this site's evidence reaches `fqn`.
           def taints?(fqn)
             return false if prefix.nil?
             return fqn == prefix if scope == :exact
+            return fqn.start_with?(prefix) if scope == :leading
 
             fqn == prefix || fqn.start_with?("#{prefix}::")
           end
+
+          # This site with `within` resolved by the block into absolute `prefix`es. A resolution of the whole
+          # written path is the anchor. {Graph#resolve} peels an unknown `Foo::Bar` to `Foo`, though, and
+          # anchoring there alone looked for `Foo::V*` and missed `Foo::Bar::V1`; the written name is then the
+          # anchor as well as the peeled one, since an undeclared receiver may be an alias of either. A
+          # receiver that does not resolve at all keeps its written name.
+          def anchored
+            return [self] if within.nil?
+
+            written = within.as_written
+            resolved = yield(within)
+            anchors = resolved == written || resolved&.end_with?("::#{written}") ? [resolved] : [written, resolved]
+            anchors.compact.map { |anchor| with(prefix: "#{anchor}::#{prefix}", within: nil) }
+          end
         end
 
         Result = Data.define(:declarations, :references, :dynamic_uses)
 
         # Roles a referring file can have (ADR-102 WD8). A reference edge carries its referrer's role so
         # "used only by its own test" is a reportable category rather than a bucket boundary.
-        def self.role_for(path)
+        #
+        # End-to-end suites (`qa/`, `e2e/`, GitLab's QA; `features/`, cucumber) are test code too (#1751). They
+        # are matched at the project root only: `app/models/features/` is an ordinary namespace directory, and
+        # a false :test would hide a production reference. Tooling directories (`rubocop/`, `keeps/`,
+        # `tooling/`, `scripts/`) stay :production on purpose — deleting a class they use breaks the tooling.
+        #
+        # The role is decided from the path RELATIVE to `root` (the project root), never from the absolute
+        # path: `/home/me/test/app/lib/a.rb` is not test code because a directory above the project is called
+        # `test`. With no `root` the path is taken as already relative.
+        def self.role_for(path, root: nil)
+          path = relative_to(path, root)
           case path
-          when %r{(\A|/)(spec|test)/}, /_(spec|test)\.rb\z/ then :test
+          when %r{(\A|/)(spec|test)/}, /_(spec|test)\.rb\z/, %r{\A(\./)?(qa|e2e|features)/} then :test
           when /\.rake\z/, %r{(\A|/)(lib/)?tasks/} then :task
           when %r{(\A|/)config/} then :config
           else :production
           end
         end
 
+        def self.relative_to(path, root)
+          return path if root.nil?
+
+          prefix = "#{root.to_s.chomp('/')}/"
+          path.start_with?(prefix) ? path.delete_prefix(prefix) : path
+        end
+        private_class_method :relative_to
+
         # A constant name is ASCII by construction, so a byte sequence that is not valid UTF-8 cannot be one.
         # Dropping it is both correct and the only safe answer: carrying it forward crashed the whole run on
         # the first `String#sub` downstream, which is how this surfaced — `rigor unused` on Rigor's own
@@ -84,9 +125,10 @@ module Rigor
         # @param path — the file's path, as the report should render it.
         # @param source — the file's bytes.
         # @param target_ruby — Prism version string, threaded from the project configuration.
+        # @param root — the project root `path` is made relative to when its role is decided.
         # @return nil when the file does not parse (a parse error is the analyzer's business, not
         #   this scan's — it simply contributes nothing rather than half a file).
-        def self.call(path:, source:, target_ruby: nil)
+        def self.call(path:, source:, target_ruby: nil, root: nil)
           parsed = if target_ruby
                      Prism.parse(source, filepath: path,
                                          version: target_ruby)
@@ -95,12 +137,66 @@ module Rigor
                    end
           return nil unless parsed.success?
 
-          walker = Walker.new(path: path, role: role_for(path))
+          walker = Walker.new(path: path, role: role_for(path, root: root))
           walker.walk(parsed.value, [])
           Result.new(declarations: walker.declarations.freeze, references: walker.references.freeze,
                      dynamic_uses: walker.dynamic_uses.freeze)
         end
 
+        # The values a local variable can hold, read off its assignments in one local scope, for a
+        # dynamic-resolution argument built a line before the call (#1734).
+        module LocalValues
+          module_function
+
+          # The assigned value nodes of `name` in `scope`, or nil when there is none or one of the assignments
+          # cannot be read off its node (`+=`, a multiple assignment, `rescue => name`).
+          def values(scope, name)
+            writes = []
+            collect_local_writes(scope, name, writes)
+            return nil if writes.empty? || writes.any? { |write| !VALUE_WRITES.include?(write.class) }
+
+            writes.map(&:value)
+          end
+
+          # The names a block's parameter list binds, block-locals included.
+          def bindings(parameters)
+            out = []
+            collect_block_bindings(parameters, out)
+            out
+          end
+
+          VALUE_WRITES = [Prism::LocalVariableWriteNode, Prism::LocalVariableOrWriteNode,
+                          Prism::LocalVariableAndWriteNode].freeze
+          private_constant :VALUE_WRITES
+
+          LOCAL_WRITES = (VALUE_WRITES + [Prism::LocalVariableOperatorWriteNode, Prism::LocalVariableTargetNode]).freeze
+          private_constant :LOCAL_WRITES
+
+          # Nodes that open a new local-variable scope. A block does not: it shares its method's locals.
+          SCOPE_GATES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode].freeze
+          private_constant :SCOPE_GATES
+
+          def collect_local_writes(node, name, out)
+            node.rigor_each_child do |child|
+              next if SCOPE_GATES.any? { |gate| child.is_a?(gate) }
+
+              out << child if LOCAL_WRITES.any? { |kind| child.is_a?(kind) } && child.name == name
+              collect_local_writes(child, name, out)
+            end
+          end
+
+          BLOCK_BINDINGS = [Prism::RequiredParameterNode, Prism::OptionalParameterNode, Prism::RestParameterNode,
+                            Prism::RequiredKeywordParameterNode, Prism::OptionalKeywordParameterNode,
+                            Prism::KeywordRestParameterNode, Prism::BlockParameterNode,
+                            Prism::BlockLocalVariableNode].freeze
+          private_constant :BLOCK_BINDINGS
+
+          def collect_block_bindings(node, out)
+            out << node.name if BLOCK_BINDINGS.any? { |kind| node.is_a?(kind) } && node.name
+            node.rigor_each_child { |child| collect_block_bindings(child, out) }
+          end
+        end
+
         # Single-pass walker. Tracks `nesting` as the stack of enclosing declaration names.
         class Walker
           attr_reader :declarations, :references, :dynamic_uses
@@ -111,6 +207,12 @@ module Rigor
             @declarations = []
             @references = []
             @dynamic_uses = []
+            # The declaration a meta-new rvalue is being walked for, or nil. See {#walk_constant_write}.
+            @owner = nil
+            # The node whose subtree holds the local variables in scope: the file, a method, or a class body.
+            @local_scope = nil
+            # Names an enclosing block's parameters or block-locals shadow within @local_scope.
+            @block_params = Set.new.freeze
           end
 
           def walk(node, nesting)
@@ -124,13 +226,21 @@ module Rigor
               # A constant path's segments are not separate references — `A::B::C` is one reference to the leaf,
               # and descending would record `A` and `A::B` as references in their own right (22 spurious
               # candidates on Rigor's own lib came from exactly that in the #345 probe).
+              #
+              # A path on a computed base is the exception: `Migration[2.2]::MigrationRecord` names no constant
+              # this reading can resolve, but its base is a call whose receiver and arguments do.
+              walk(node.parent, nesting) if node.is_a?(Prism::ConstantPathNode) &&
+                                            Source::ConstantPath.qualified_name_or_nil(node).nil?
               return
             when Prism::ConstantWriteNode
-              record_meta_new(node, nesting)
-              walk(node.value, nesting)
+              walk_constant_write(node, nesting)
               return
             when Prism::CallNode
-              record_dynamic_use(node)
+              record_dynamic_use(node, nesting)
+            when Prism::ProgramNode, Prism::DefNode, Prism::SingletonClassNode
+              return in_local_scope(node) { node.rigor_each_child { |child| walk(child, nesting) } }
+            when Prism::BlockNode, Prism::LambdaNode
+              return in_block(node) { node.rigor_each_child { |child| walk(child, nesting) } }
             end
 
             node.rigor_each_child { |child| walk(child, nesting) }
@@ -144,13 +254,27 @@ module Rigor
 
             fqn = (nesting + [name]).join("::")
             # The superclass position IS a reference — `class Sub < Base` reads `Base` — and it resolves against
-            # the OUTER nesting, not inside the body being opened.
-            record_reference(superclass, nesting) if superclass
+            # the OUTER nesting, not inside the body being opened. It is part of `Sub`'s declaration, though, so
+            # it is credited to `Sub` (#1720): crediting the enclosing scope left a base nested in a module that
+            # is never itself reached unreachable, and rooted a top-level base even when every subclass is dead.
+            #
+            # The superclass is WALKED, not only read as a name: `< DelegateClass(Foo)`, `< Struct.new(:a,
+            # Foo::X)` and `< ActiveRecord::Migration[7.1]` are calls whose receiver and arguments name
+            # constants, and reading only a constant node recorded none of them, so `Foo` was a false candidate
+            # (#1733). Its references take the credit a meta-new rvalue's do.
+            walk_owned(superclass, nesting, fqn) if superclass
             includes = node.body ? mixin_names(node.body) : []
             @declarations << Declaration.new(fqn: fqn, path: @path, line: node.location.start_line,
                                              superclass: superclass && Source::ConstantPath.qualified_name(superclass),
                                              includes: includes.freeze)
-            walk(node.body, nesting + [name]) if node.body
+            return unless node.body
+
+            # The body's nesting names the declaration itself, so a credit inherited from a meta-new rvalue
+            # this declaration sits in must not leak into it.
+            owner = @owner
+            @owner = nil
+            in_local_scope(node.body) { walk(node.body, nesting + [name]) }
+            @owner = owner
           end
 
           # `Const = Class.new` / `Module.new` / `Data.define(...)` / `Struct.new(...)` declare a class under a
@@ -160,6 +284,26 @@ module Rigor
           META_NEW = { "Class" => :new, "Module" => :new, "Data" => :define, "Struct" => :new }.freeze
           private_constant :META_NEW
 
+          # A meta-new rvalue — `Class.new(Base) { ... }`, `Struct.new(:a) do ... end` — is the declaration's
+          # header and body, so the references in it are credited to the declared constant, exactly as a
+          # `class Sub < Base` superclass is (#1720). Its lexical nesting is unchanged: a block opens no cref.
+          def walk_constant_write(node, nesting)
+            fqn = record_meta_new(node, nesting)
+            return walk(node.value, nesting) if fqn.nil?
+
+            walk_owned(node.value, nesting, fqn)
+          end
+
+          # Walks a declaration's header expression in the outer `nesting` it is evaluated in, crediting the
+          # references in it to the declared `fqn`.
+          def walk_owned(node, nesting, fqn)
+            owner = @owner
+            @owner = fqn
+            walk(node, nesting)
+            @owner = owner
+          end
+
+          # @return the declared FQN, or nil when the rvalue is not a meta-new form.
           def record_meta_new(node, nesting)
             call = node.value
             return unless call.is_a?(Prism::CallNode)
@@ -167,8 +311,10 @@ module Rigor
             recv = call.receiver
             return unless recv.is_a?(Prism::ConstantReadNode) && META_NEW[recv.name.to_s] == call.name
 
-            @declarations << Declaration.new(fqn: (nesting + [node.name.to_s]).join("::"), path: @path,
+            fqn = (nesting + [node.name.to_s]).join("::")
+            @declarations << Declaration.new(fqn: fqn, path: @path,
                                              line: node.location.start_line, superclass: nil, includes: [].freeze)
+            fqn
           end
 
           # `include` / `prepend` / `extend` argument names written directly in the declaration body. Only the
@@ -189,6 +335,10 @@ module Rigor
           DYNAMIC_RESOLVERS = %i[constantize safe_constantize const_get].freeze
           private_constant :DYNAMIC_RESOLVERS
 
+          # The anchor of a lookup that starts at the top level.
+          TOP_LEVEL = ""
+          private_constant :TOP_LEVEL
+
           SUBJECT_SHAPES = {
             Prism::StringNode => "a literal string",
             Prism::SymbolNode => "a literal symbol",
@@ -198,59 +348,163 @@ module Rigor
 
           # Rigor knows the argument's shape, which is the whole reason this can be tiered rather than treated
           # as a blanket namespace poison: a literal argument names the exact constant and is as good as a
-          # written reference, while an interpolated one can only bound the namespace it reaches into.
-          def record_dynamic_use(node)
+          # written reference, while an interpolated one can only bound the names its literal head reaches.
+          #
+          # A local variable argument is read through its assignments in the same local scope, because the
+          # name is usually built one line up: GitLab's `Migration[2.2]` is `name = "V#{...}"` followed by
+          # `const_get(name, false)` (#1734).
+          def record_dynamic_use(node, nesting)
             return unless DYNAMIC_RESOLVERS.include?(node.name)
 
             subject = node.name == :const_get ? node.arguments&.arguments&.first : node.receiver
             return if subject.nil?
 
-            name, prefix = dynamic_target(subject)
+            anchors = node.name == :const_get ? const_get_anchors(node, nesting) : [TOP_LEVEL]
+            subjects(subject).each { |value| record_dynamic_subject(node, value, anchors) }
+          end
+
+          def record_dynamic_subject(node, subject, anchors)
+            name, head = dynamic_target(subject)
             # A literal whose bytes are not valid UTF-8 cannot name a constant; dropping it is the only safe
             # answer, and carrying it forward crashed the whole run downstream.
             return if subject.is_a?(Prism::StringNode) && name.nil?
             return if subject.is_a?(Prism::SymbolNode) && name.nil?
 
-            @dynamic_uses << DynamicUse.new(
-              name: name, prefix: prefix, site: site(node), path: @path, line: node.location.start_line,
-              reason: "#{node.name} on #{SUBJECT_SHAPES.fetch(subject.class, 'a computed value')}"
-            )
+            reason = "#{node.name} on #{SUBJECT_SHAPES.fetch(subject.class, 'a computed value')}"
+            bounds = head ? anchors.filter_map { |anchor| bound(head, anchor) }.uniq : []
+            bounds = [[nil, :namespace, nil]] if bounds.empty?
+            bounds.each do |prefix, scope, within|
+              @dynamic_uses << DynamicUse.new(name: name, prefix: prefix, scope: scope, within: within,
+                                              site: site(node), path: @path, line: node.location.start_line,
+                                              reason: reason)
+            end
+          end
+
+          # Where a `const_get` looks a name up, as the namespaces its interpolated argument is bounded by. The
+          # receiver's namespace comes first: an implicit receiver, `self` or `self.class` is the enclosing
+          # declaration, and a constant receiver is resolved by {Graph} as any reference is (`within`). With
+          # the default `inherit = true` the lookup also falls through to the top level, which is all the
+          # reading had before, so that stays tainted too; an explicit `false` confines it to the receiver. An
+          # unknown receiver bounds nothing beyond the top level.
+          def const_get_anchors(node, nesting)
+            receiver = node.receiver
+            namespaces =
+              if self_receiver?(receiver)
+                # Inside a meta-new rvalue `self` is the declared class in its block but the outer scope in its
+                # arguments; the walk does not tell the two apart, so both are taken.
+                [@owner, nesting.join("::")].compact.uniq - [TOP_LEVEL]
+              elsif constant_receiver?(receiver)
+                [receiver_reference(receiver, nesting)]
+              else
+                []
+              end
+            return [TOP_LEVEL] if namespaces.empty?
+
+            inherit = node.arguments.arguments[1]
+            inherit.is_a?(Prism::FalseNode) ? namespaces : namespaces + [TOP_LEVEL]
+          end
+
+          def self_receiver?(receiver)
+            receiver.nil? || receiver.is_a?(Prism::SelfNode) ||
+              (receiver.is_a?(Prism::CallNode) && receiver.name == :class && receiver.receiver.is_a?(Prism::SelfNode))
           end
 
-          # `[exact name, bounded namespace]` for a dynamic-resolution subject. A literal names its constant
-          # exactly; an interpolation can only bound the namespace its literal head names; anything else bounds
-          # nothing.
+          # `Object.const_get` is the top level, which every lookup already reaches.
+          def constant_receiver?(receiver)
+            return false unless receiver.is_a?(Prism::ConstantReadNode) || receiver.is_a?(Prism::ConstantPathNode)
+
+            as_written = Source::ConstantPath.qualified_name_or_nil(receiver)
+            !as_written.nil? && as_written.delete_prefix("::") != "Object"
+          end
+
+          def receiver_reference(receiver, nesting)
+            Reference.new(as_written: Source::ConstantPath.qualified_name_or_nil(receiver),
+                          nesting: nesting.dup.freeze, from: nil, role: @role, path: @path,
+                          line: receiver.location.start_line, rooted: Source::ConstantPath.rooted?(receiver))
+          end
+
+          # `[prefix, scope, within]` for a literal head under one anchor. A head ending in `::` names a
+          # namespace and reaches everything beneath it; any other head is the start of a name, so
+          # `"V#{version}"` reaches `V1_0` and `V2_2` alike, and only a string-prefix match says that. A rooted
+          # head ignores the receiver. `within` carries a constant receiver for {Graph} to resolve.
+          def bound(head, anchor)
+            anchor = TOP_LEVEL if head.start_with?("::")
+            head = head.delete_prefix("::")
+            scope = head.end_with?("::") ? :namespace : :leading
+            head = head.delete_suffix("::")
+            return nil if head.empty?
+
+            case anchor
+            when Reference then [head, scope, anchor]
+            when TOP_LEVEL then [head, scope, nil]
+            else ["#{anchor}::#{head}", scope, nil]
+            end
+          end
+
+          # The values a dynamic-resolution subject can hold: the subject itself, or for a local variable every
+          # value assigned to it in the enclosing local scope. A local with an assignment whose value cannot be
+          # read off the node (`+=`, a multiple assignment, `rescue => name`) stays a computed value.
+          #
+          # A name an enclosing block binds as a parameter or block-local (`|name|`, `|x; name|`) is that
+          # block's value, not the method's: reading it through the method's assignments named a literal the
+          # block never sees, and a constant only that literal named was hidden from the report.
+          def subjects(subject)
+            return [subject] unless subject.is_a?(Prism::LocalVariableReadNode) && @local_scope
+            return [subject] if @block_params.include?(subject.name)
+
+            LocalValues.values(@local_scope, subject.name) || [subject]
+          end
+
+          def in_local_scope(scope)
+            saved = [@local_scope, @block_params]
+            @local_scope = scope
+            @block_params = Set.new.freeze
+            yield
+          ensure
+            @local_scope, @block_params = saved
+          end
+
+          def in_block(block)
+            saved = @block_params
+            names = block.parameters ? LocalValues.bindings(block.parameters) : []
+            @block_params = (@block_params | names).freeze unless names.empty?
+            yield
+          ensure
+            @block_params = saved
+          end
+
+          # `[exact name, literal head]` for a dynamic-resolution subject. A literal names its constant exactly;
+          # an interpolation can only bound the names its literal head starts; anything else bounds nothing.
           def dynamic_target(subject)
             case subject
             when Prism::StringNode, Prism::SymbolNode then [Scan.usable_name(subject.unescaped), nil]
-            when Prism::InterpolatedStringNode then [nil, literal_prefix(subject)]
+            when Prism::InterpolatedStringNode then [nil, literal_head(subject)]
             else [nil, nil]
             end
           end
 
-          # The literal head of an interpolated name: `"Foo::Bar::#{k}"` bounds the reach to `Foo::Bar`. Returns
-          # nil when the interpolation starts the string, which bounds nothing.
           def site(node)
             "#{@path}:#{node.location.start_line}"
           end
 
-          def literal_prefix(node)
+          # The literal head of an interpolated name, as written: `"Foo::Bar::#{k}"` gives `Foo::Bar::`. Returns
+          # nil when the interpolation starts the string, which bounds nothing.
+          def literal_head(node)
             head = node.parts.first
             return nil unless head.is_a?(Prism::StringNode)
 
             literal = Scan.usable_name(head.unescaped)
-            return nil if literal.nil?
-
-            trimmed = literal.sub(/::\z/, "")
-            trimmed.empty? ? nil : trimmed
+            literal.nil? || literal.empty? ? nil : literal
           end
 
-          def record_reference(node, nesting)
+          # `from` defaults to the innermost enclosing declaration; a declaration's own header (its superclass,
+          # its meta-new rvalue) is credited to that declaration instead.
+          def record_reference(node, nesting, from: @owner)
             as_written = Source::ConstantPath.qualified_name_or_nil(node)
             return if as_written.nil?
 
-            @references << Reference.new(as_written: as_written, nesting: nesting.dup.freeze,
-                                         from: nesting.empty? ? nil : nesting.join("::"),
+            from ||= nesting.empty? ? nil : nesting.join("::")
+            @references << Reference.new(as_written: as_written, nesting: nesting.dup.freeze, from: from,
                                          role: @role, path: @path, line: node.location.start_line,
                                          rooted: Source::ConstantPath.rooted?(node))
           end

data/lib/rigor/analysis/rule_catalog.rb

@@ -292,6 +292,38 @@ module Rigor
           since: "0.0.1"
         ),
 
+        CheckRules::RULE_DEPRECATED_RUBY2_KEYWORDS => Entry.new(
+          id: CheckRules::RULE_DEPRECATED_RUBY2_KEYWORDS,
+          summary: "A call to the ruby2_keywords family Ruby 4.1 deprecates, under an explicit target_ruby >= 4.1.",
+          fires_when: [
+            "`.rigor.yml` sets `target_ruby` explicitly to \"4.1\" or later.",
+            "The call reaches `Module#ruby2_keywords` (no receiver or `self` in a class / module body, a " \
+            "`class << self` body or a singleton method), top-level `ruby2_keywords` (at the top level, outside " \
+            "any block), or `Proc#ruby2_keywords` (a receiver typed `Proc`): removed in Ruby 4.4.",
+            "The call reaches `Hash.ruby2_keywords_hash?` or `Hash.ruby2_keywords_hash` (on `Hash` or a subclass " \
+            "RBS knows): removed in Ruby 4.5.",
+            "The same names through `send` / `__send__` with a literal Symbol."
+          ],
+          does_not_fire_when: [
+            "`target_ruby` is absent, is the default, is below 4.1, or is \"latest\" (which names a parser, " \
+            "not a runtime).",
+            "A project or `pre_eval:` file defines a method by the same name anywhere.",
+            "The call sits in a block at the top level, in an `instance_eval` / `instance_exec` block, in an " \
+            "instance method of a class or module, or on an explicit receiver that is not `Proc` / `Hash`.",
+            "The call sits in a version-guard arm that cannot run on the stated Ruby, under a guard on " \
+            "`RUBY_VERSION` that cannot be decided, or after a guard that returns or raises."
+          ],
+          suppression: "`# rigor:disable call.deprecated-ruby2-keywords` on the call line. To fix it instead, " \
+                       "rewrite the delegation the flag serves to `(...)` or `(*args, **kwargs, &block)` first, then " \
+                       "drop the `ruby2_keywords` call: removing it alone breaks keyword pass-through.",
+          severity_authored: :warning,
+          severity_by_profile: { lenient: :info, balanced: :warning, strict: :error },
+          # Each call names a known core method on a receiver whose class the syntax or the scope fixes, and a
+          # project definition of the name silences it. A file loaded only on an older Ruby is the residual.
+          evidence_tier: :high,
+          since: "0.4.2"
+        ),
+
         CheckRules::RULE_ALWAYS_RAISES => Entry.new(
           id: CheckRules::RULE_ALWAYS_RAISES,
           summary: "Call provably raises (today: Integer division-by-zero).",
@@ -552,6 +584,9 @@ module Rigor
           ],
           does_not_fire_when: [
             "Override raises or preserves visibility (only reductions break substitutability).",
+            "The method is one Ruby makes private wherever it is defined (`initialize`, " \
+            "`initialize_copy` / `_dup` / `_clone`, `respond_to_missing?`), so its section is not its " \
+            "runtime visibility (ADR-35 WD10).",
             "The shadowed method lives on an RBS-known / third-party ancestor (RBS models only " \
             "public/private; RBS-parent visibility is a deferred follow-on).",
             "`def self.foo` singleton methods (visibility is instance-side only).",
@@ -578,6 +613,9 @@ module Rigor
           does_not_fire_when: [
             "Either side lacks an authored RBS signature (WD1 both-sides-authored gate).",
             "The override narrows or preserves the return (covariant-safe).",
+            "`initialize` and the `initialize_copy` / `_dup` / `_clone` hooks: `Class#new` / `dup` / " \
+            "`clone` reach them on the receiver's own class and discard their return, outside " \
+            "substitutability (ADR-35 WD10).",
             "The ancestor's return is `untyped` / `self` / an unbound generic (degrades to " \
             "`Dynamic[Top]`, which accepts everything — FP-safe).",
             "The subtype relationship between the two return types is not resolvable from loaded " \
@@ -609,6 +647,9 @@ module Rigor
           does_not_fire_when: [
             "Either side lacks an authored RBS signature (WD1 both-sides-authored gate).",
             "The override widens or preserves the parameter (contravariant-safe).",
+            "`initialize` and the `initialize_copy` / `_dup` / `_clone` hooks: `Class#new` / `dup` / " \
+            "`clone` reach them only on the receiver's own class, so no parent-typed caller passes the " \
+            "parent's arguments (ADR-35 WD10).",
             "Either side is overloaded (more than one method type — arm mapping is ambiguous).",
             "The ancestor's parameter is `untyped` / an unbound generic / an interface (degrades " \
             "to `Dynamic[Top]`, which is passable to anything — FP-safe).",
@@ -640,6 +681,8 @@ module Rigor
           ],
           does_not_fire_when: [
             "Later write is `nil` — the `@cache = nil` clear-idiom is allowlisted.",
+            "The class's RBS declares the ivar (`@var: T`, or the slot an `attr_*` member implies, own or " \
+            "inherited) and that type accepts both the first write and the later one.",
             "Either side is Union / Dynamic / IntegerRange / a shape-varied carrier.",
             "Writes live in different classes that happen to share an ivar name.",
             "Writes are in a singleton body — `def self.foo` or a `class << self` def — those track " \

data/lib/rigor/analysis/run_cache_key.rb

@@ -21,6 +21,9 @@ require_relative "../environment/default_libraries"
 # lockfile paths without loading `rigor/environment` or the RBS machinery.
 require_relative "../environment/lockfile_resolver"
 require_relative "../environment/rbs_collection_discovery"
+# A leaf file (it loads only the cache descriptor), unlike `dependency_source_inference`, whose walker loads the
+# inference engine the boot-slimming probe exists to avoid.
+require_relative "dependency_source_inference/gem_resolver"
 require_relative "shadow_harness"
 
 module Rigor
@@ -93,6 +96,7 @@ module Rigor
       def descriptor(configuration:, files:, explain:, rbs_config_entries:, template_units_digest: nil)
         Cache::Descriptor.new(
           gems: [Cache::RbsDescriptor.rbs_gem_entry],
+          dependencies: dependency_source_entries(configuration),
           configs: rbs_config_entries + engine_source_entries + lockfile_entries(configuration) +
                    template_unit_entries(template_units_digest) + shadow_harness_entries + [
                      config_entry("configuration", Marshal.dump(configuration.to_h)),
@@ -151,6 +155,14 @@ module Rigor
         [lockfile_entry("bundler.lockfile", bundler), lockfile_entry("rbs_collection.lockfile", collection)]
       end
 
+      # ADR-10 slice 3, issue #1814 — the `dependencies.source_inference` gems' `(name, version, mode)` rows, which the
+      # walker's output depends on and no lockfile digest covers when the project has none or the gem sits beside the
+      # bundle. Shared by this key and by {Cache::IncrementalSnapshot.fingerprint}, as the lockfiles are. A project
+      # that lists no gem adds no row, so its key is what it was.
+      def dependency_source_entries(configuration)
+        DependencySourceInference::GemResolver.dependency_entries(configuration.dependencies)
+      end
+
       # The one resolution of the two dependency lockfiles — `[bundler, rbs_collection]`, each a Pathname or nil
       # — shared by this key and by {Cache::IncrementalSnapshot.fingerprint} so the two caches identify the gem
       # set by the same files (issue #1532): `bundler.lockfile:` / `rbs_collection.lockfile:` and auto-detection.
@@ -180,7 +192,10 @@ module Rigor
 
       # The `rbs.libraries` config slot reconstructed from configuration alone — byte-identical to the
       # loader's `RbsDescriptor.libraries_entry(loader.libraries)` because `Environment.for_project` merges
-      # exactly `DEFAULT_LIBRARIES + config.libraries` (uniq) into `loader.libraries`.
+      # exactly `DEFAULT_LIBRARIES + config.libraries` (uniq) into `loader.libraries`, plus the
+      # `Environment::RequiredFeatures` tokens the run's source activates (issue #1700). Those are left out
+      # here: reading every source file would cost the boot-slimming probe the time it exists to save, and a
+      # project that requires a gated feature then only misses this probe, never hits a wrong slot.
       def libraries_config_entries(configuration)
         merged = (Environment::DEFAULT_LIBRARIES + configuration.libraries.map(&:to_s)).uniq
         [Cache::RbsDescriptor.libraries_entry(merged)]