rigortype 0.4.1 → 0.4.3

data/lib/rigor/cli/unused_command.rb

@@ -49,9 +49,9 @@ module Rigor
 
         configuration = Configuration.load(options.fetch(:config))
         paths = @argv.empty? ? configuration.paths : @argv
-        scan_cache = Analysis::Reachability::ScanCache.open(configuration.cache_path,
-                                                            target_ruby: configuration.target_ruby)
-        declarations, references, dynamic_uses = scan(paths, configuration, scan_cache)
+        establish_root(configuration)
+        scan_cache = open_scan_cache(configuration)
+        declarations, references, dynamic_uses, shadows = scan(paths, configuration, scan_cache)
         references.concat(signature_references(configuration))
         dynamic_uses.concat(template_mentions(declarations, scan_cache))
 
@@ -59,7 +59,8 @@ module Rigor
                                                                    cache_store: cache_store(configuration))
         references.concat(plugin_references(contribution.references))
         graph = build_graph(configuration, options, contribution,
-                            declarations: declarations, references: references, dynamic_uses: dynamic_uses)
+                            declarations: declarations, references: references, dynamic_uses: dynamic_uses,
+                            shadows: shadows)
         emit(graph.report, options, supply: root_supply(contribution.roots, declarations))
         scan_cache.save
         0
@@ -67,9 +68,50 @@ module Rigor
 
       private
 
-      def build_graph(configuration, options, contribution, declarations:, references:, dynamic_uses:)
+      # A scan's role and the spelling it records depend on the root and the working directory (#1760): a role
+      # reads every spelling below either ({#role_of}), and a relative path argument is recorded as written
+      # relative to the working directory.
+      def open_scan_cache(configuration)
+        cwd = canonical(Dir.pwd)
+        spelled = cwd == @root ? "" : ":#{cwd}"
+        Analysis::Reachability::ScanCache.open(configuration.cache_path, target_ruby: configuration.target_ruby,
+                                                                         root: "#{@root}#{spelled}")
+      end
+
+      # The root, and its spellings: the realpath and the logical directory it was named by.
+      def establish_root(configuration)
+        @root = project_root(configuration)
+        logical = @root == canonical(Dir.pwd) ? Dir.pwd : configuration.exclude_base
+        @root_spellings = [@root, File.absolute_path(logical)].uniq
+      end
+
+      # The project root (#1760), realpath'd: the config file's directory, unless the config sits below the
+      # working directory (`--config=ci/rigor.yml` from the project root), where the working directory is the
+      # project. Run from a subdirectory, or from a directory unrelated to the config, it is the config's.
+      # The root never rises above the config's directory or the working directory, so the role rules, which
+      # anchor `qa/`, `e2e/` and `features/` at the root, keep reading the project; an analysed path outside
+      # it reads as `../…`.
+      def project_root(configuration)
+        base = canonical(configuration.exclude_base)
+        cwd = canonical(Dir.pwd)
+        inside?(base, cwd) && base != cwd ? cwd : base
+      end
+
+      def inside?(path, dir)
+        path.start_with?("#{dir.chomp('/')}/")
+      end
+
+      # The directories the wider corpus is read from: the root, and the working directory when it lies
+      # outside the root. Reading the working directory too keeps the corpus no narrower than it was when
+      # the working directory alone was read; a reference only ever makes a declaration more reachable.
+      def corpus_dirs
+        cwd = canonical(Dir.pwd)
+        cwd == @root || inside?(cwd, @root) ? [@root] : [@root, cwd]
+      end
+
+      def build_graph(configuration, options, contribution, declarations:, references:, dynamic_uses:, shadows:)
         Analysis::Reachability::Graph.new(
-          declarations: declarations, references: references, dynamic_uses: dynamic_uses,
+          declarations: declarations, references: references, dynamic_uses: dynamic_uses, shadows: shadows,
           root_fqns: root_fqns(declarations, options.fetch(:entry_points)) + contribution.roots,
           foreign: foreign_predicate(configuration)
         )
@@ -106,22 +148,56 @@ module Rigor
       end
 
       # Declarations come from the analysed paths; references additionally from the wider corpus (WD7).
+      # A wider-corpus file's own declarations come back as shadows: never nodes, only what that file's own
+      # references resolve to first (#1732).
       # Every file is consulted every run — an unchanged one contributes its cached scan, so the
       # whole-project completeness the `--incremental` refusal protects is unaffected.
+      #
+      # A file is parsed once however it is spelled (#1760), but every spelling of it keeps what it referred
+      # to under its own path and role, exactly as when each spelling was scanned separately: dropping a
+      # spelling lost its role, and with it a production reference a `spec/` symlink to the same file would
+      # otherwise have hidden. Only the declarations are taken once, from the first analysed spelling, which
+      # is the one the report prints; any other spelling's declarations are shadows, as a wider-corpus
+      # file's are (#1732).
       def scan(paths, configuration, cache)
-        declaration_files = Analysis::PathExpansion.ruby_files(paths, configuration.exclude_patterns).to_set
-        declarations = []
-        references = []
-        dynamic_uses = []
-        (declaration_files + reference_files(paths, configuration)).sort.each do |file|
-          result = cache.serve(:scan, file) { read_and_scan(file, configuration) }
+        out = { declarations: [], references: [], dynamic_uses: [], shadows: [] }
+        file_spellings(paths, configuration).sort.each do |real, list|
+          primary, analysed = list.find { |_, declared| declared } || list.first
+          result = cache.serve(:scan, primary) { read_and_scan(primary, real, configuration) }
           next if result.nil?
 
-          declarations.concat(result.declarations) if declaration_files.include?(file)
-          references.concat(result.references)
-          dynamic_uses.concat(result.dynamic_uses)
+          out[analysed ? :declarations : :shadows].concat(result.declarations)
+          list.map(&:first).each { |file| add_spelling(out, result, file, real, primary) }
         end
-        [declarations, references, dynamic_uses]
+        out.values_at(:declarations, :references, :dynamic_uses, :shadows)
+      end
+
+      def add_spelling(out, result, file, real, primary)
+        out[:shadows].concat(result.declarations.map { |d| d.with(path: file) }) unless file == primary
+        role = role_of(file, real)
+        out[:references].concat(result.references.map { |r| r.with(path: file, role: role) })
+        out[:dynamic_uses].concat(result.dynamic_uses.map { |u| respelled(u, file, role) })
+      end
+
+      # `{realpath => [[spelling, analysed?], ...]}`: the analysed spellings first, in `paths:` order, then
+      # the wider corpus's.
+      def file_spellings(paths, configuration)
+        analysed = Analysis::PathExpansion.ruby_files(paths, configuration.exclude_patterns,
+                                                      base: configuration.exclude_base)
+        spellings = Hash.new { |hash, real| hash[real] = [] }
+        analysed.each { |file| spellings[canonical(file)] << [file, true] }
+        reference_files(paths, configuration).each { |file| spellings[canonical(file)] << [file, false] }
+        spellings = spellings.transform_values { |list| list.uniq(&:first) }
+        @analysed_spellings = spellings.transform_values do |list|
+          list.filter_map do |file, analysed|
+            file if analysed
+          end
+        end
+        spellings
+      end
+
+      def respelled(use, file, role)
+        use.with(path: file, role: role, site: use.site && "#{file}:#{use.line}")
       end
 
       # The reference corpus is the PROJECT, not the analysed paths. A constant declared in `lib/` is commonly
@@ -129,20 +205,80 @@ module Rigor
       # treating those as absent is what manufactured artifacts on two of three corpus targets in #345.
       # Widening the *declaration* set the same way would cancel the gain (measured: +1 / −3 / +2 candidates,
       # ADR-102 WD2), which is exactly why the two corpora are separated rather than both widened.
+      #
+      # The files are read from every {#corpus_dirs} entry (#1760): running from a subdirectory or through a
+      # symlinked spelling reads the same project.
       def reference_files(_paths, configuration)
-        relative = Analysis::Reachability::ProjectFiles.own(Dir.glob(REFERENCE_GLOB, base: Dir.pwd), Dir.pwd)
-        absolute = relative.map { |rel| File.absolute_path(rel) }
-        Analysis::PathExpansion.reject_excluded(absolute, configuration.exclude_patterns).to_set
+        absolute = project_files(REFERENCE_GLOB)
+        Analysis::PathExpansion.reject_excluded(absolute, configuration.exclude_patterns,
+                                                base: configuration.exclude_base)
       end
 
-      def read_and_scan(file, configuration)
+      # The role is read from the file's realpath relative to the project root (#1760), so `test/helper.rb`
+      # is test code whichever directory the command runs from. A file outside the root reads as `../…`,
+      # which names no directory above the root.
+      def read_and_scan(file, real, configuration)
         Analysis::Reachability::Scan.call(path: file, source: File.read(file),
-                                          target_ruby: configuration.target_ruby)
+                                          target_ruby: configuration.target_ruby,
+                                          role: role_of(file, real))
       rescue SystemCallError
         nil
       end
 
-      # A glob is matched against the declaration's path AND its path relative to the working directory:
+      # Absolute paths of the project's own files matching `glob`, under every corpus directory.
+      def project_files(glob)
+        corpus_dirs.flat_map do |dir|
+          Analysis::Reachability::ProjectFiles.own(Dir.glob(glob, base: dir), dir).map { |rel| File.join(dir, rel) }
+        end.uniq
+      end
+
+      def canonical(path)
+        File.realpath(path)
+      rescue SystemCallError
+        File.absolute_path(path)
+      end
+
+      # A file's role (#1760), read from its spellings as written below the project root or the working
+      # directory: the first one below the root decides, and any of them reading as test code makes it test
+      # code, so a `features/` tree below a subdirectory run's working directory stays test code as it was when
+      # the working directory was the only root. The realpath is read only when no written spelling lies below
+      # either: a symlink whose target runs through a `test/` directory must not turn the production files
+      # reached through it into test code.
+      def role_of(file, real)
+        spellings = below(file, @root_spellings) + below(file, cwd_spellings)
+        spellings = below(real, @root_spellings) + below(real, cwd_spellings) if spellings.empty?
+        role_for = Analysis::Reachability::Scan.method(:role_for)
+        return :test if spellings.uniq.any? { |path| role_for.call(path) == :test }
+
+        role_for.call(spellings.first || relative_to_root(real))
+      end
+
+      # `path` relative to every directory in `dirs` it lies below.
+      def below(path, dirs)
+        absolute = File.absolute_path(path)
+        dirs.filter_map { |dir| absolute.delete_prefix("#{dir.chomp('/')}/") if inside?(absolute, dir) }.uniq
+      end
+
+      # The working directory as its realpath and, when the shell's `PWD` names it, as that logical spelling.
+      def cwd_spellings
+        @cwd_spellings ||= begin
+          logical = ENV.fetch("PWD", nil)
+          real = canonical(Dir.pwd)
+          logical && canonical(logical) == real ? [real, Dir.pwd, logical].uniq : [real, Dir.pwd].uniq
+        end
+      end
+
+      def relative_to_root(real)
+        prefix = "#{@root.chomp('/')}/"
+        return real.delete_prefix(prefix) if real.start_with?(prefix)
+
+        Pathname.new(real).relative_path_from(Pathname.new(@root)).to_s
+      rescue ArgumentError
+        real
+      end
+
+      # A glob is matched against every analysed spelling of the declaration's file, and each of them and its
+      # realpath relative to the project root (#1760) and to the working directory:
       # `configuration.paths` are expanded to absolute, so a user-written `--entry-point=lib/entry.rb` would
       # otherwise never match anything and silently produce a root set of zero.
       # A constant named only from the project's own `sig/` is referenced — the #345 probe reported exactly this
@@ -176,8 +312,8 @@ module Rigor
         names = declarations.map(&:fqn)
         return [] if names.empty?
 
-        Analysis::Reachability::ProjectFiles.own(Dir.glob(TEMPLATE_GLOB, base: Dir.pwd), Dir.pwd).flat_map do |rel|
-          absolute = File.absolute_path(rel)
+        project_files(TEMPLATE_GLOB).flat_map do |absolute|
+          rel = relative_to_root(absolute)
           haystack = cache.serve(:runs, absolute) { constant_bearing_text(File.read(absolute).scrub) }
           names.filter_map do |fqn|
             next unless haystack.include?(fqn)
@@ -208,10 +344,12 @@ module Rigor
         return [] if globs.empty?
 
         matcher = Analysis::Reachability::ProjectFiles.method(:entry_point_match?)
-        cwd = "#{File.absolute_path(Dir.pwd)}/"
         declarations.filter_map do |d|
-          relative = d.path.delete_prefix(cwd)
-          d.fqn if globs.any? { |g| matcher.call(g, d.path) || matcher.call(g, relative) }
+          real = canonical(d.path)
+          dirs = @root_spellings + cwd_spellings
+          written = @analysed_spellings.fetch(real, [d.path]) | [d.path]
+          spellings = [*written, relative_to_root(real), *written.flat_map { |w| below(w, dirs) }, *below(real, dirs)]
+          d.fqn if globs.any? { |g| spellings.any? { |path| matcher.call(g, path) } }
         end
       end
 
@@ -235,6 +373,7 @@ module Rigor
       def foreign_predicate(configuration)
         env = Environment.for_project(libraries: configuration.libraries, signature_paths: [],
                                       cache_store: cache_store(configuration),
+                                      required_features: ProjectEnvironment.required_features(configuration),
                                       **ProjectEnvironment.dependency_discovery_options(configuration))
         ->(fqn) { !env.singleton_for_name(fqn).nil? }
       rescue StandardError

data/lib/rigor/cli.rb

@@ -51,6 +51,7 @@ module Rigor
       "init" => :run_init,
       "annotate" => :run_annotate,
       "type-of" => :run_type_of,
+      "lens" => :run_lens,
       "trace" => :run_trace,
       "type-scan" => :run_type_scan,
       "effects" => :run_effects,
@@ -281,20 +282,46 @@ module Rigor
         # tempfile, uri, logger, date, prism, rbs). Adding a
         # `sig/<gem>.rbs` file under `sig/` is the simplest way
         # to extend type coverage today.
+        #
+        # `target_ruby` is left commented: the default only picks the syntax Rigor parses. Set it to the lowest
+        # Ruby your project runs on, and Rigor also reports what that Ruby deprecates.
+        # target_ruby: #{Configuration::DEFAULTS.fetch('target_ruby').dump}
         #{YAML.dump(init_settings(path)).sub(/\A---\n/, '')}
       YAML
     end
 
     # The settings `rigor init` writes: the defaults, with `test_paths:` spelled out as the test roots found now, so
     # the project's config says where its tests are rather than leaving it to auto-detection. The roots are written
-    # relative to the config file's directory, which is what {Configuration.load} resolves them against.
+    # relative to the config file's directory, which is what {Configuration.load} resolves them against. `paths:`
+    # is written the same way: the default `lib` is resolved against the physical cwd, so a config written to
+    # `config/rigor.yml` must say `../lib`, or it loads back as `config/lib` (#1399).
+    #
+    # `target_ruby` is left out (the template writes it commented): a written key is a statement about the runtime
+    # (#1692), and the starter must not make one the user never chose.
     def init_settings(path)
+      config_dir = config_dir_of(path)
+      settings = Configuration::DEFAULTS.except("target_ruby")
+      settings = settings.merge("paths" => roots_relative_to(settings.fetch("paths"), config_dir))
       test_paths = Configuration.new.resolved_test_paths
-      return Configuration::DEFAULTS if test_paths.empty?
+      return settings if test_paths.empty?
 
-      config_dir = Pathname(File.absolute_path(File.dirname(path)))
-      relative = test_paths.map { |root| Pathname(root).relative_path_from(config_dir).to_s }
-      Configuration::DEFAULTS.merge("test_paths" => relative)
+      settings.merge("test_paths" => roots_relative_to(test_paths, config_dir))
+    end
+
+    # The directory the config file's roots are written relative to. An absolute `--path` is taken through its
+    # physical directory: the roots are resolved against the physical cwd (`Dir.pwd` is getcwd), so a logical
+    # spelling through a symlink makes the lexical `..` climb a different tree than the kernel does (#1399 review).
+    # A relative `--path` stays lexical, as {Configuration.load} resolves it.
+    def config_dir_of(path)
+      dir = File.dirname(path)
+      Pathname(Pathname(path).absolute? ? File.realdirpath(dir) : File.absolute_path(dir))
+    end
+
+    # Each root is resolved against the physical cwd (where `rigor` reads it from), then written relative to the config
+    # dir. With the config at the project root, both sides are the same physical directory, so the roots come out as
+    # they are spelled from it (`lib`, `spec`), which is master's output for the default config.
+    def roots_relative_to(roots, config_dir)
+      roots.map { |root| Pathname(File.absolute_path(root)).relative_path_from(config_dir).to_s }
     end
 
     def run_annotate
@@ -309,6 +336,12 @@ module Rigor
       TypeOfCommand.new(argv: @argv, out: @out, err: @err).run
     end
 
+    def run_lens
+      require_relative "cli/lens_command"
+
+      LensCommand.new(argv: @argv, out: @out, err: @err).run
+    end
+
     def run_trace
       require_relative "cli/trace_command"
 
@@ -455,6 +488,7 @@ module Rigor
           init       Create a starter .rigor.yml
           annotate   Print FILE with each line's last-expression type
           type-of    Print inferred types at FILE:LINE[:COL] positions
+          lens       Map a file's declarations with their types and provenance (experimental)
           trace      Replay how the engine typed FILE as a terminal animation
           type-scan  Report Scope#type_of coverage across PATHs
           effects    Report each method's effect labels, and the committed effect snapshot

data/lib/rigor/configuration/severity_profile.rb

@@ -38,6 +38,10 @@ module Rigor
           "call.argument-type-mismatch" => :warning,
           "call.possible-nil-receiver" => :warning,
           "call.raise-non-exception" => :warning,
+          # Issue #1692 — the code runs on the stated Ruby (it warns, and breaks only at the removal version), so the
+          # rule takes the slot of the rules that report working-but-wrong code: `flow.unreachable-branch`'s
+          # info / warning / error. It runs only under an explicit `target_ruby` of 4.1 or later.
+          "call.deprecated-ruby2-keywords" => :info,
           "flow.always-raises" => :warning,
           "flow.unreachable-branch" => :info,
           "flow.dead-assignment" => :info,
@@ -100,6 +104,7 @@ module Rigor
           "call.argument-type-mismatch" => :error,
           "call.possible-nil-receiver" => :error,
           "call.raise-non-exception" => :error,
+          "call.deprecated-ruby2-keywords" => :warning,
           "flow.always-raises" => :error,
           "flow.unreachable-branch" => :warning,
           "flow.dead-assignment" => :warning,
@@ -141,6 +146,7 @@ module Rigor
           "call.argument-type-mismatch" => :error,
           "call.possible-nil-receiver" => :error,
           "call.raise-non-exception" => :error,
+          "call.deprecated-ruby2-keywords" => :error,
           "flow.always-raises" => :error,
           "flow.unreachable-branch" => :error,
           "flow.dead-assignment" => :error,

data/lib/rigor/configuration.rb

@@ -283,6 +283,23 @@ module Rigor
                 :effects_snapshot_path, :effects_snapshot_reach, :effects_snapshot_gate, :effects_tolerated,
                 :effects_labels, :effects_attribution, :effects_envelopes
 
+    # ADR-47 WD5 amendment (#1692) — whether `.rigor.yml` (or its `includes:` chain) set `target_ruby:` itself.
+    # The default `"4.0"` is a parse version, not something the user said about the Ruby the project runs on.
+    def target_ruby_explicit?
+      @target_ruby_explicit
+    end
+
+    # ADR-47 WD5 amendment (#1692) — `target_ruby` read as a user statement about the runtime: the configured
+    # version when the user set it explicitly, nil when it is the default or `"latest"`. `"latest"` names the
+    # newest syntax this Prism build parses, which moves with a Rigor upgrade, so it states no runtime. Only the
+    # Ruby-deprecation rules read this; `Inference::VersionGuard` keeps the analyzer's own `RUBY_VERSION`.
+    def stated_runtime_ruby
+      return nil unless target_ruby_explicit?
+      return nil if target_ruby == "latest"
+
+      target_ruby
+    end
+
     # ADR-103 WD13 — whether effect collection runs. True exactly when the loaded configuration carried an
     # `effects:` block, whatever its body; `rigor effects` enables it for its own run by loading an
     # implicit `effects: {}` instead of by consulting anything else. Nothing else — no annotation, no
@@ -327,6 +344,7 @@ module Rigor
       if resolved.nil? || !File.exist?(resolved)
         data = DEFAULTS
         effects_key_present = false
+        target_ruby_key_present = false
       else
         # ADR-103 WD15 — captured from the RAW, pre-`DEFAULTS.merge` file (+ its `includes:` chain) because
         # `DEFAULTS` itself carries an `"effects" => false` entry: once merged, "the file never wrote
@@ -334,9 +352,17 @@ module Rigor
         # indistinguishable to {#initialize}. This is the only place that distinction still exists.
         raw = load_with_includes(resolved)
         effects_key_present = raw.key?("effects")
+        target_ruby_key_present = raw.key?("target_ruby")
         data = DEFAULTS.merge(raw)
       end
-      new(autowire_default_plugins(data), effects_key_present)
+      new(autowire_default_plugins(data), effects_key_present, target_ruby_key_present || false)
+        .with_exclude_base(resolved && File.exist?(resolved) ? File.dirname(resolved) : nil)
+    end
+
+    # #1576 — the directory relative `exclude:` patterns are matched against: the directory of the config file in
+    # use (the base `paths:` resolve against), or the working directory when no config file is used.
+    def exclude_base
+      @base_dir || Dir.pwd
     end
 
     # ADR-93 WD2 — the one bundled plugin default-wired without a `plugins:` entry. `rigor-rbs-inline` is the
@@ -519,7 +545,13 @@ module Rigor
     #   `"key" => value` hash literal — this class's usual call shape, all over the spec suite — is coerced
     #   into keyword arguments by Ruby whenever the method declares ANY keyword parameter, which would break
     #   every `Configuration.new("some_key" => value)` call site with an "unknown keyword" `ArgumentError`.
-    def initialize(data = DEFAULTS, effects_key_present = data.key?("effects"))
+    # @param target_ruby_key_present — ADR-47 WD5 amendment (#1692) — whether the file set `target_ruby:` itself,
+    #   captured before `DEFAULTS.merge` for the same reason as `effects_key_present` and positional for the same
+    #   reason. See {#stated_runtime_ruby}. The default reads the key off `data`, which is right only for a hash that
+    #   has not been through `DEFAULTS.merge` (DEFAULTS carries the key); a caller that merges passes it explicitly.
+    #   The bare `Configuration.new` is not explicit.
+    def initialize(data = DEFAULTS, effects_key_present = data.key?("effects"),
+                   target_ruby_key_present = data.key?("target_ruby") && !data.equal?(DEFAULTS))
       # Record before the per-key fetches below discard the evidence. Top level only, deliberately —
       # see {ConfigAudit.unknown_key_warnings} for why a nested check cannot key on DEFAULTS.
       @unknown_keys = (data.keys.map(&:to_s) - KNOWN_KEYS).sort.freeze
@@ -528,6 +560,7 @@ module Rigor
       plugins_io = DEFAULTS.fetch("plugins_io").merge(data.fetch("plugins_io", {}))
 
       @target_ruby = coerce_target_ruby(data.fetch("target_ruby", DEFAULTS.fetch("target_ruby")))
+      @target_ruby_explicit = target_ruby_key_present ? true : false
       @paths = Array(data.fetch("paths", DEFAULTS.fetch("paths"))).map(&:to_s).freeze
       user_excludes = Array(data.fetch("exclude", DEFAULTS.fetch("exclude"))).map(&:to_s)
       @exclude_patterns = (BUILTIN_EXCLUDES + user_excludes).uniq.freeze
@@ -619,6 +652,9 @@ module Rigor
     def to_h # rubocop:disable Metrics/MethodLength, Metrics/AbcSize
       {
         "target_ruby" => target_ruby,
+        # A stated `target_ruby` turns on the deprecation rules a defaulted one leaves off (#1692), so the run cache
+        # key and the incremental fingerprint must tell the two apart even where the value matches.
+        "target_ruby_explicit" => target_ruby_explicit?,
         "paths" => paths,
         "exclude" => exclude_patterns - BUILTIN_EXCLUDES,
         "plugins" => plugins,
@@ -717,6 +753,29 @@ module Rigor
       copy.freeze
     end
 
+    # #1576 — a sibling Configuration whose relative `exclude:` patterns match against `dir` (nil: the working
+    # directory). {Configuration.load} sets it to the loaded config file's directory.
+    def with_exclude_base(dir)
+      copy = dup
+      copy.instance_variable_set(:@base_dir, dir && File.absolute_path(dir).freeze)
+      copy.freeze
+    end
+
+    # #1777 — a sibling Configuration with only `baseline:` unset, every other field (including the
+    # explicitness of `target_ruby`) shared with the receiver. `rigor baseline generate` analyses with
+    # this so the generating run sees exactly the configuration `rigor check` will, minus the filter it
+    # is about to replace; rebuilding from a key list let each unlisted key revert to its default.
+    #
+    # Same frozen `dup` shape as {#with_bleeding_edge}. `@baseline_path` is the only ivar
+    # `#initialize` derives from the `baseline:` key.
+    def without_baseline
+      return self if baseline_path.nil?
+
+      copy = dup
+      copy.instance_variable_set(:@baseline_path, nil)
+      copy.freeze
+    end
+
     # ADR-103 WD14 — the ad-hoc opt-in `rigor effects` uses when the project's configuration carries no
     # `effects:` block: a sibling Configuration with an implicit empty block, every other field shared.
     # A configuration that already enables effects is returned unchanged, so a project's own settings

data/lib/rigor/environment/bundle_sig_discovery.rb

@@ -118,15 +118,19 @@ module Rigor
       # `{name => LockedGem}` → set of canonical bundler gem directory basenames. Pure-Ruby gems install as
       # `<name>-<version>`; platform-specific gems install as `<name>-<version>-<platform>` (e.g.
       # `ffi-1.17.4-aarch64-linux-gnu`). Lockfile platform `"ruby"` is the pure-Ruby case; any other value is
-      # treated as a platform tag.
+      # treated as a platform tag. Every locked variant contributes a directory (#1844): the set only selects
+      # among directories that are actually installed, so admitting another platform's name costs nothing,
+      # while dropping the host's would discard its `sig/`.
       def self.expected_gem_dirs(locked_gems)
         locked_gems.each_value.with_object(Set.new) do |locked, set|
-          base = "#{locked.name}-#{locked.version}"
-          set << if locked.platform == "ruby" || locked.platform.empty?
-                   base
-                 else
-                   "#{base}-#{locked.platform}"
-                 end
+          locked.variants.each do |version, platform|
+            base = "#{locked.name}-#{version}"
+            set << if platform == "ruby" || platform.empty?
+                     base
+                   else
+                     "#{base}-#{platform}"
+                   end
+          end
         end
       end
       private_class_method :expected_gem_dirs

data/lib/rigor/environment/gated_signature_guard.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "rbs"
+
+module Rigor
+  class Environment
+    # Issue #1700 — the type names a {RequiredFeatures}-gated vendored directory declares, which
+    # `RbsLoader.gated_trouble` builds in its trial to decide whether the directory may stay in an environment.
+    # Read off the vendored files themselves: a nested `class Prime; class EratosthenesGenerator` names
+    # `Prime::EratosthenesGenerator`, and a reopened core class (`class Integer`) is named too, since a clash
+    # there fails `Integer`'s own definition.
+    module GatedSignatureGuard
+      module_function
+
+      # @param dir — the vendored directory (Pathname).
+      # @return the absolute-less names (`"Prime::PseudoPrimeGenerator"`) of every class and module it declares.
+      def type_names(dir)
+        Dir.glob(File.join(dir.to_s, "*.rbs")).flat_map do |file|
+          _, _, decls = RBS::Parser.parse_signature(File.read(file))
+          names(decls, nil)
+        rescue RBS::BaseError, SystemCallError
+          []
+        end.uniq
+      end
+
+      def names(decls, namespace)
+        decls.flat_map do |decl|
+          next [] unless decl.is_a?(RBS::AST::Declarations::Class) || decl.is_a?(RBS::AST::Declarations::Module)
+
+          name = qualify(namespace, decl.name)
+          [name] + names(decl.members, name)
+        end
+      end
+
+      def qualify(namespace, type_name)
+        text = type_name.to_s
+        return text.delete_prefix("::") if text.start_with?("::") || namespace.nil?
+
+        "#{namespace}::#{text}"
+      end
+    end
+  end
+end