rigortype 0.4.3 → 0.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b20cef50f4d076f1afefb8c20563cd21a95a56b01bf4db3257371adfe7c64d5d
-  data.tar.gz: 9c4f5f8825106ece96fb2ac00dc1ad4ef43f302368f1a12f87521c725530b924
+  metadata.gz: a09068aa2810a8d01758e3ce78f52dc6020f0d197bb83a561684b96969e5eddf
+  data.tar.gz: 0105753f063477bea3a85ba3dea3fe660fbe58d846d9388867eafd3b6fed1055
 SHA512:
-  metadata.gz: 4418a4a75a22d27038d0607caa5a79723470e68f9662da1aec0b79e8056a1b157f78cf85f83cb51f646aa22d2634b0d851bb9f0132a548f5104acdee2372d1d2
-  data.tar.gz: 026710fb13eebddf98776d6a9a3fb8e1738a7cc5fdd77c326afa0adb680c0760462d9e41b4aff57d1c41d1878fc05c41a8658be7b69ed4f265709aa27f6fc825
+  metadata.gz: fb111fc503dbb60810cbcdf4bfb0a717f694f771fe16bf41007ef1b9eb2728014aa19d112183e79652e4a1ae03c09d6e227ad13ebc063a9804b7a6ba916ae71b
+  data.tar.gz: 4c3d925ef588248fbd84529262632bcfa5e081eedd340c164f0de89b3a0f83abd5cdaad37be922a90571068966ec204f77e075993994db8b106abbaa8d135cd8

data/README.md

@@ -232,7 +232,7 @@ rigor docs --list                 # list every bundled page
 
 ## Status
 
-Current release: **`v0.4.3`** (2026-10-15) — on the
+Current release: **`v0.4.4`** (2026-10-16) — on the
 `0.4.x` line, continuing the evaluation era opened by `v0.2.0`, the first
 publicly-announced (general / evaluation) release. The line publishes
 an enumerated [compatibility surface](docs/compatibility.md) as a

data/data/core_overlay/ostruct.rbs

@@ -0,0 +1,40 @@
+# Rigor core overlay — supplemental core signatures.
+#
+# --- OpenStruct#method_missing (issue #1456) ---
+#
+# rbs 4.2 ships no `ostruct` signatures (since Ruby 4.0 `ostruct` is a bundled
+# gem, not a default one), and the gem ships no `sig/`. The only `OpenStruct`
+# declaration in the environment is json's add-on reopening in
+# `stdlib/json/0/json.rbs` (`json_create` / `as_json` / `to_json`), so the
+# class read as fully declared and `OpenStruct.new(name: "x").name` reported
+# `call.undefined-method`.
+#
+# Upstream: ostruct 0.6.3 `lib/ostruct.rb` defines each field as a
+# per-instance singleton method (`new_ostruct_member!` through
+# `define_singleton_method!`) and answers the rest through
+# `private def method_missing(mid, *args)`, which this file declares. It
+# defines no `respond_to_missing?` of its own (Kernel's answers, and the
+# fields are real singleton methods), so none is declared here.
+#
+# The per-field accessors cannot be declared on the class at all, so
+# `Rigor::Analysis::CheckRules::CORE_OVERLAY_OPEN_RECEIVERS` names
+# `OpenStruct` as an open receiver: an RBS `method_missing` alone does not
+# stop the undefined-method rule. That list is what quiets `rigor check`;
+# this file supplies the declaration the maintainer decision asked for.
+#
+# The declaration sits on a module the class includes, as `process.rbs`
+# does, so a project `sig/` that declares `OpenStruct#method_missing` itself
+# overrides it instead of raising `DuplicatedMethodDefinitionError`.
+#
+# Maintainer decision on #1456 (2026-10-16, option c): this narrow overlay.
+# The general rule for a class declared only by another library's partial
+# reopening is #1978.
+module RigorCoreOverlay
+  module OpenStructMissing
+    private def method_missing: (Symbol mid, *untyped args) -> untyped
+  end
+end
+
+class OpenStruct
+  include RigorCoreOverlay::OpenStructMissing
+end

data/docs/handbook/11-sig-gen.md

@@ -751,6 +751,22 @@ by side without coordination.
   every other byte of the file verbatim.
 - **Will** append a new `class Foo … end` block when the
   target file does not declare the class yet.
+- **Will** treat a method as already declared when a file
+  under the signature tree declares it on the same class
+  with a `def` or an `attr_*` of the same kind (instance or
+  singleton), in any opening of the class in that file. A
+  `def self?.` declares both kinds, and a `def self?.`
+  proposal counts as declared when either kind is. The
+  method is updated (`--overwrite`) or skipped in the file
+  that declares it instead of being added to the class's
+  first file. A replacement lands only on a `def` of the
+  proposal's own kind in the first opening of the class:
+  a `def self?.` proposal over a lone `def self.f` or
+  `def f`, a plain proposal over a `def self?.f`, or a
+  method declared in a later opening is skipped. A
+  `def f: ... | ...` overload is never replaced and never
+  counts as the file that declares `f`. An `alias` in
+  `sig/` is not yet recognised as declaring its name.
 - **Will not** touch files outside the configured signature
   tree.
 - **Will not** replace an existing method declaration

data/docs/manual/02-cli-reference.md

@@ -913,10 +913,11 @@ rigor mcp [--transport=stdio] [--config=PATH]
 ```
 
 `stdio` is the only transport. The server is a pure-Ruby
-JSON-RPC 2.0 implementation exposing seven read-only tools:
-`rigor_check`, `rigor_type_of`, `rigor_triage`,
+JSON-RPC 2.0 implementation exposing eight read-only tools:
+`rigor_check`, `rigor_type_of`, `rigor_triage`, `rigor_lens`,
 `rigor_annotate`, `rigor_sig_gen`, `rigor_explain`,
-`rigor_coverage`.
+`rigor_coverage`. `rigor_lens` writes only the incremental
+cache `rigor check --incremental` writes.
 
 ## `rigor lsp` vs `rigor mcp`
 

data/docs/manual/03-configuration.md

@@ -78,7 +78,7 @@ cache:
 | --- | --- | --- | --- |
 | `libraries` | Array | `[]` | Standard-library / gem names whose bundled RBS to load. |
 | `signature_paths` | Array | `nil` | Extra directories of `.rbs` files. Relative entries resolve against the config file's directory. |
-| `pre_eval` | Array | `[]` | Files (or globs) walked before per-file analysis, to register project monkey-patches and publish their top-level constants project-wide. The walker does not follow `require` / `require_relative`, so list the files in load order: a method declared in two files takes the last-listed one, and a file that requires a later-listed one is still read in list order. |
+| `pre_eval` | Array | `[]` | Files (or globs) walked before per-file analysis, to register project monkey-patches and publish their top-level constants project-wide. The walker does not follow `require` / `require_relative`, so list the files in load order: a method declared in two files takes the last-listed one, and a file that requires a later-listed one is still read in list order. `type-of`, `type-scan`, `trace`, `annotate` and `sig-gen` read the patches too, so they type a patched method as `rigor check` does. |
 | `plugins` | Array | `[]` | Plugins to activate — see [Using plugins](07-plugins.md). |
 
 ### Signature generation
@@ -103,6 +103,8 @@ rigor: signature_paths: "/path/to/sig" does not exist (no signatures loaded from
 rigor: signature_paths: "/path/to/sig" matched 0 signature files
 rigor: libraries: "csb" is not an available RBS library (no signatures loaded from it)
 rigor: disable: "call.undefined-methdo" is not a recognized rule id; the suppression has no effect
+rigor: disable: "plugin_loader.load-error" names a run-level row, which `disable:` does not reach; use `severity_overrides:` or a baseline
+rigor: disable: "plugin.shoulda-matchers.unknown-column" names no plugin `plugins:` configures; the suppression has no effect
 rigor: severity_overrides: "flow.bogus" is not a recognized rule id; the override has no effect
 rigor: bundler.lockfile: "./missing/Gemfile.lock" does not exist
 ```
@@ -125,10 +127,19 @@ the JSON schema as you type rather than at check time.
 These are warnings, not errors — partial or optional bundles and
 forward-looking config are valid setups. The audit only fires on explicit,
 working-setup-safe signals: an unset default (auto-detected `<root>/sig`,
-auto-detected bundle) is never warned about, and a `disable:` /
-`severity_overrides:` token under a *plugin* family (`rspec.…`,
+auto-detected bundle) is never warned about, and a
+`severity_overrides:` key under a non-built-in family (`rspec.…`,
 `rbs_extended.…`) is left alone, since its rule id cannot be enumerated
-statically and may resolve at run time. The same findings appear in the
+statically and may resolve at run time. `disable:` is checked more
+closely, because what it can reach is known: a plugin's rule counts
+only in its qualified `plugin.<id>.<rule>` form, so a bare plugin rule
+(`rspec.let-binding`) is warned about. A qualified token is checked
+against `plugins:` only when every entry's plugin ID is known without
+loading it — an explicit `id:`, or a bundled plugin's gem name minus
+`rigor-`; one third-party gem listed without `id:` turns that check
+off. A token under `rbs_extended.…`, `rbs.…` or `dynamic.…` is left
+alone, other than the reserved run-level rows (`rbs.coverage.…`,
+`dynamic.dependency-source.…`), which are flagged. The same findings appear in the
 `--format=json` payload under `config_warnings` (each tagged with a
 `kind`), so CI can assert on them.
 
@@ -136,7 +147,7 @@ statically and may resolve at run time. The same findings appear in the
 
 | Key | Type | Default | Meaning |
 | --- | --- | --- | --- |
-| `disable` | Array | `[]` | Rule IDs or families to suppress project-wide. |
+| `disable` | Array | `[]` | Rule IDs or families to suppress project-wide; `all` suppresses every built-in check rule. A plugin's diagnostics are named by qualified ID (`plugin.<id>.<rule>`, or `plugin.<id>` for the whole plugin); a bare ID or `all` does not reach them. The run-level `.rigor.yml` rows (`plugin_loader.*`, `dynamic.dependency-source.*`, `rbs.coverage.*`, `plugin_trust.*`, `pool-degraded`) are not reached by any spelling; use `severity_overrides:` for those. See [Diagnostics](04-diagnostics.md#suppressing-a-diagnostic). |
 | `severity_profile` | String | `"balanced"` | `lenient`, `balanced`, or `strict` — see [Diagnostics](04-diagnostics.md). |
 | `severity_overrides` | Hash | `{}` | Per-rule / per-family severity, e.g. `{ call: warning, flow.always-truthy-condition: off }`. |
 | `baseline` | String / `false` | `nil` | Path to a `.rigor-baseline.yml`, or `false` to disable an inherited one. See [Baselines](06-baseline.md). |

data/docs/manual/04-diagnostics.md

@@ -253,7 +253,12 @@ config.merge(extra)  # rigor:disable call.undefined-method
 ```
 
 It accepts qualified IDs, family wildcards (`call`), a
-comma- or space-separated list, or `all`. The comment must sit
+comma- or space-separated list, or `all`. A plugin's diagnostic
+is reached only by its qualified ID as printed in brackets
+(`plugin.shoulda-matchers.unknown-column`) or by the plugin's
+whole family (`plugin.shoulda-matchers`); its bare rule
+(`unknown-column`) and `all` leave it alone, because several
+plugins share bare rules. The comment must sit
 on the line the diagnostic points at; there is no
 `disable-block` form, so an expression spread over several
 lines needs the comment on each line that fires.
@@ -283,7 +288,8 @@ suppressible like any other rule.
 
 **In-source, whole file.** `# rigor:disable-file <rules>`
 anywhere in a file suppresses those rules for every line;
-`# rigor:disable-file all` silences the file. Convention is to
+`# rigor:disable-file all` silences every built-in rule in the file
+(a plugin's diagnostics need their qualified ID, as above). Convention is to
 put it near the top — typically on a generated file, a fixture,
 or a vendored snippet — but every comment in the file is
 scanned, so any placement works.
@@ -300,6 +306,42 @@ disable:
   - flow.dead-assignment
 ```
 
+`disable: [all]` turns off every built-in check rule, including
+`effect.annotations-unchecked`, which is reported at a signature
+file.
+
+A plugin's own diagnostics are turned off by their qualified ID —
+`plugin.<id>.<rule>` for one rule, `plugin.<id>` for every rule
+of that plugin:
+
+```yaml
+disable:
+  - plugin.shoulda-matchers.unknown-column
+  - plugin.rails-i18n
+```
+
+A bare rule (`unknown-column`, `load-error`) and `all` do not
+reach them, so one plugin's suppression never hides another
+plugin's finding of the same name.
+
+The list does not reach the run-level rows reported at
+`.rigor.yml` — a plugin that failed to load or raised in
+`prepare` (`plugin_loader.*`), a `dependencies.source_inference:`
+gem that did not resolve (`dynamic.dependency-source.*`), the
+`rbs.coverage.*` notices, `plugin_trust.*`, `pool-degraded` —
+under any spelling, `plugin_loader.load-error` included. Turn
+those off with [`severity_overrides:`](#severity-profiles) set
+to `off`, or record them in a [baseline](06-baseline.md).
+`severity_overrides:` matches the row's rule ID without the
+source prefix, so the plugin loader's rows are `load-error` and
+`runtime-error` there — and that key also re-stamps any plugin
+diagnostic whose bare rule is the same. `rigor check` warns when a
+`disable:` entry names one of these rows, names no rule at all,
+or names a plugin `plugins:` does not configure (see
+[Config validation warnings](03-configuration.md#config-validation-warnings)).
+A path or parse error, which has no rule ID, is always
+reported.
+
 For a *known backlog* you want to keep visible but not fail
 on, prefer a [baseline](06-baseline.md) over a blanket
 `disable:` — `disable:` also hides any new occurrences.

data/docs/manual/07-plugins.md

@@ -95,7 +95,7 @@ with the `plugins_isolation:` configuration key or the
 | --- | --- |
 | `process` (default) | Run the call in a forked, crash-contained worker, so the target library's monkey-patches and any crash never contaminate Rigor. Falls back to `none` where `fork` is unavailable (Windows / JRuby). |
 | `none` | Load the library into Rigor's own process and call it directly. |
-| `ruby_box` | Run inside an experimental `Ruby::Box` sandbox. This needs the `RUBY_BOX=1` start flag, so the `rigor` launcher re-execs itself with it set when you select this strategy. It also needs a Ruby that fixes [Ruby Bug #22260](https://bugs.ruby-lang.org/issues/22260), which no release up to 4.0.7 does. The launcher checks for the fix first, and without it prints a warning and uses the configured strategy instead. **Environment variable only** — the configuration file is read long after Ruby has booted, so `plugins_isolation: ruby_box` is reported as a configuration error instead. |
+| `ruby_box` | Run inside an experimental `Ruby::Box` sandbox. This needs the `RUBY_BOX=1` start flag, so the `rigor` launcher re-execs itself with it set when you select this strategy. It also needs a Ruby that fixes [Ruby Bug #22260](https://bugs.ruby-lang.org/issues/22260), which no release up to 4.0.7 does. The launcher checks for the fix first, and without it prints a warning and uses the configured strategy instead. The same check runs when `RUBY_BOX=1` is already in your environment: without the fix, the launcher prints a notice and restarts itself without `RUBY_BOX`, so the run completes but plugins are not boxed. The check result is cached per Ruby build under `$XDG_CACHE_HOME/rigor` (or `~/.cache/rigor`) and never expires, so if you rebuild a Ruby in place with the fix, delete `$XDG_CACHE_HOME/rigor/ruby-box-probe` (or `~/.cache/rigor/ruby-box-probe`). A check that times out is not cached, so it costs up to ten seconds on every run. **Environment variable only** — the configuration file is read long after Ruby has booted, so `plugins_isolation: ruby_box` is reported as a configuration error instead. |
 
 The environment variable wins over `plugins_isolation:`, so you can
 override a project's committed choice for one invocation. The legacy

data/docs/manual/10-mcp-server.md

@@ -33,6 +33,7 @@ There is no conflict in running both simultaneously.
 | `rigor_check` | `rigor check --format json` | JSON diagnostic report |
 | `rigor_type_of` | `rigor type-of --format json` | JSON type at `FILE:LINE:COL` |
 | `rigor_triage` | `rigor triage --format json` | JSON distribution + class/method selectors + hotspots + hints |
+| `rigor_lens` | `rigor lens --format json` | JSON `lens/v0` declaration map (experimental) |
 | `rigor_annotate` | `rigor annotate --no-color` | Annotated Ruby source |
 | `rigor_sig_gen` | `rigor sig-gen --print --format json` | JSON RBS skeleton candidates |
 | `rigor_explain` | `rigor explain --format json` | JSON rule catalog entries |
@@ -320,6 +321,34 @@ by `count` for the highest-leverage class/method, or filter by
 
 ---
 
+### rigor_lens
+
+Map the classes, modules, methods and attributes the given files declare,
+with the type `rigor check` gives each one and where it came from. The
+document is the experimental `lens/v0` format
+([specification](../internal-spec/lens.md)); see
+[Inspecting inferred types](05-inspecting-types.md) for the command.
+
+**Input:**
+
+| Argument | Type | Required |
+|---|---|---|
+| `files` | `string[]` | yes |
+| `config` | `string` | no |
+
+**Returns:** JSON. Each file carries its `status`, `sites`, `omissions`
+and `diagnostics`; `members` holds the signatures.
+
+**Typical agent use:** learn what a file or class offers, and the
+contracts its methods already have, before editing it or writing a type.
+Pass every file in one call: each call runs one analysis, and the first
+call on a project costs a full `rigor check`. Paths, site keys and the cache are
+relative to the directory the server was started in, so start it from the
+project root; `--config` fixes which files belong to the project, not how
+paths are written.
+
+---
+
 ### rigor_annotate
 
 Return the given Ruby source file with each line's last-expression
@@ -482,7 +511,7 @@ You should get a JSON response. If you get nothing or a shell error,
 `rigor` is not on your `PATH` — fix the install path first (see
 [Installing Rigor](01-installation.md)).
 
-**`rigor_check` / `rigor_triage` return an empty diagnostics array on a project that has errors.**
+**`rigor_check` / `rigor_triage` return an empty diagnostics array on a project that has errors, or `rigor_lens` reports every file `outside_project`.**
 
 The tool uses `Configuration.discover` from the working directory the
 MCP server was started in. If the client launches `rigor mcp` from a
@@ -517,8 +546,8 @@ warmed by a prior `rigor check` run reduces it significantly.
 
 ## Status and roadmap
 
-`rigor mcp` shipped in v0.1.10 with all seven tools and stdio
-transport. Queued follow-ups are demand-driven:
+`rigor mcp` shipped in v0.1.10 with seven tools and stdio
+transport; `rigor_lens` joined them in v0.4.4. Queued follow-ups are demand-driven:
 
 - **HTTP transport** (slice 2) — `--transport=http` for CI / remote
   agent use; a minimal Rack endpoint.

data/docs/manual/18-removing-dead-code.md

@@ -265,7 +265,17 @@ under them are. `const_get` looks the name up from its receiver, so
 and mixins and at the top level as well, unless the call passes `false`
 as its second argument. A literal `const_get("Handler")` is a reference
 looked up in the same order, so it names `Migration::Handler` when
-that exists rather than a top-level `Handler`. A name built into a
+that exists rather than a top-level `Handler`. When the receiver is
+implicit, `self` or `self.class` inside a method (or a block in a class
+body, such as a lambda or `define_method`), the call may run on a
+subclass or on an includer, so a `Handler` declared in a descendant is
+kept reachable too. Descendants are the classes written `class D < Base`
+and the declarations whose body has a plain `include`, `prepend` or
+`extend` of the module; `K.include(Mix)`, `K.send(:include, Mix)`,
+`K.extend(Ext)` and `K = Class.new(Base)` are not followed yet. A call
+written directly in a class body is not widened. Inside
+`Other.instance_eval { }` (or `class_eval`, `module_eval` and their
+`_exec` forms) the receiver is `Other`. A name built into a
 local variable first (`name = "V#{version}"; const_get(name)`) is read
 the same way. A
 class name appearing as a string in a `.yml`, `.json` or template file

data/docs/manual/plugins/rigor-rails-routes.md

@@ -127,8 +127,8 @@ routed. Helper-name recognition for all three is unaffected.
   metaprogramming the parser can't unfold (routes built in a loop
   over runtime data, helpers injected by an engine the parser
   doesn't model) may not register, which can surface a false
-  `unknown-helper`. Record those in a baseline, or
-  `# rigor:disable` the line.
+  `unknown-helper`. Record those in a baseline, or add
+  `# rigor:disable plugin.rails-routes.unknown-helper` to the line.
 - **The "routes file did not load" warning is run-scoped.** It is a
   fact about your configuration, not about any one source file, so
   it is reported once per run on `.rigor.yml` rather than on the

data/docs/manual/plugins/rigor-shoulda-matchers.md

@@ -48,7 +48,10 @@ expected kind: `belong_to` / `have_one` (singular), `have_many` /
 
 Suppress with the qualified rule, e.g.
 `# rigor:disable plugin.shoulda-matchers.unknown-column`, or silence
-the whole family with `# rigor:disable plugin.shoulda-matchers`.
+the whole family with `# rigor:disable plugin.shoulda-matchers`. The
+same spellings work project-wide in `.rigor.yml`'s `disable:`. The
+bare rule (`# rigor:disable unknown-column`) does not reach these
+diagnostics.
 
 ## No configuration
 

data/exe/rigor

@@ -6,8 +6,7 @@
 # (`RUBY_BOX=1`, not toggleable at runtime). When a project selects that
 # strategy (`RIGOR_PLUGIN_ISOLATION=ruby_box`, or the legacy `RIGOR_BOX`
 # alias) we re-exec the same command with the flag set before anything
-# else loads. The `RUBY_BOX` guard prevents an infinite re-exec, and the
-# inherited environment (RUBYOPT / BUNDLE_*) preserves the Bundler
+# else loads. The inherited environment (RUBYOPT / BUNDLE_*) preserves the Bundler
 # context across the exec. The `none` and `process` (default) strategies
 # need no flag, so this is a no-op for them — behaviour is unchanged
 # unless a project opts into `ruby_box`.
@@ -17,22 +16,18 @@
 # Rubies through 4.0.7 segfault on Ruby Bug #22260). When it cannot,
 # the request is dropped with a warning and the run proceeds under the
 # configured strategy (`process` by default) instead of crashing.
-rigor_isolation = ENV["RIGOR_PLUGIN_ISOLATION"].to_s
-rigor_wants_box = rigor_isolation == "ruby_box" || !ENV["RIGOR_BOX"].to_s.empty?
-if rigor_wants_box && ENV["RUBY_BOX"].to_s.empty?
+#
+# When `RUBY_BOX` is already set (by hand or by a wrapper), this process
+# booted inside the box before any Rigor code ran, so the same probe
+# runs here too, and a refused Ruby is re-exec'ed with `RUBY_BOX`
+# removed. The probe's verdict is cached per Ruby build, and the
+# re-exec is marked so the child neither probes nor re-execs again.
+# Nothing above `require "rigor/cli"` may define a Ractor-shareable
+# lambda: that is what crashes inside the box.
+if !ENV["RUBY_BOX"].to_s.empty? || ENV["RIGOR_PLUGIN_ISOLATION"].to_s == "ruby_box" ||
+   !ENV["RIGOR_BOX"].to_s.empty? || ENV.key?("RIGOR_BOX_PROBED")
   require_relative "../lib/rigor/plugin/box_probe"
-  if (rigor_box_unsupported = Rigor::Plugin::BoxProbe.unsupported_reason)
-    rigor_box_warning = "rigor: ruby_box plugin isolation is unavailable: #{rigor_box_unsupported}. " \
-                        "Falling back to the configured plugins_isolation strategy (default: process)."
-    # `$stderr.puts`, not `warn`: `-W0` silences `warn`, and this fallback must never be silent.
-    $stderr.puts rigor_box_warning # rubocop:disable Style/StderrPuts
-    ENV.delete("RIGOR_PLUGIN_ISOLATION") if rigor_isolation == "ruby_box"
-    ENV.delete("RIGOR_BOX")
-  else
-    ENV["RUBY_BOX"] = "1"
-    ENV["RIGOR_PLUGIN_ISOLATION"] = "ruby_box" if rigor_isolation.empty?
-    exec(RbConfig.ruby, __FILE__, *ARGV)
-  end
+  exec(RbConfig.ruby, __FILE__, *ARGV) if Rigor::Plugin::BoxProbe.needs_reexec?(ENV)
 end
 
 lib = File.expand_path("../lib", __dir__)

data/lib/rigor/analysis/check_rules/rule_ids.rb

@@ -173,6 +173,63 @@ module Rigor
         configuration-error load-error pool-degraded runtime-error source-rbs-synthesis-failed
         source-rbs-annotation-not-honoured
       ].freeze
+
+      # Resolves a user-supplied rule token (`undefined-method`, `call.undefined-method`, or the family wildcard
+      # `call`) to the set of canonical rule identifiers it disables. Returns `nil` for `"all"` (the existing
+      # wildcard meaning "every rule"), or for unknown tokens.
+      def self.resolve_rule_token(token)
+        return nil if token == "all"
+        return [LEGACY_RULE_ALIASES.fetch(token)] if LEGACY_RULE_ALIASES.key?(token)
+        return PRE_EVAL_RULES if token == "pre-eval"
+        return ALL_RULES.select { |r| r.start_with?("#{token}.") } if RULE_FAMILIES.include?(token)
+
+        ALL_RULES.include?(token) ? [token] : []
+      end
+
+      # Expands a list of user-supplied rule tokens into the canonical-id set per ADR-8 § "Backward
+      # compatibility". `disabled_rules` accepts unprefixed legacy names (`undefined-method`), canonical names
+      # (`call.undefined-method`), family wildcards (`call`) and the `all` sentinel.
+      def self.expand_rule_tokens(tokens)
+        Array(tokens).each_with_object(Set.new) do |token, set|
+          set.merge(expand_token(token.to_s))
+        end
+      end
+
+      def self.expand_token(token)
+        return ["all"] if token == "all"
+
+        resolved = resolve_rule_token(token)
+        resolved.nil? || resolved.empty? ? [token] : resolved
+      end
+
+      # Whether the `.rigor.yml` `disable:` list, expanded by {.expand_rule_tokens}, drops a diagnostic whose rule
+      # id is `rule`: the `all` sentinel drops every rule-bearing row, any other entry its exact id. A nil rule (a
+      # parse, path or internal error) is never dropped.
+      def self.config_disabled?(rule, disabled)
+        return false if rule.nil?
+
+        disabled.include?("all") || disabled.include?(rule)
+      end
+
+      # The source-family prefix the runner stamps on every plugin-emitted row (`plugin.<id>`).
+      PLUGIN_FAMILY_PREFIX = "plugin."
+
+      # Issue #1953 — whether a suppression token set drops a plugin's own row. Such a row answers only to its
+      # qualified id: the exact `plugin.<id>.<rule>` (its `qualified_rule`) or the whole plugin's `plugin.<id>`
+      # (its `source_family`). Both compare whole strings against the row's own fields, so `plugin.<id>` never
+      # reaches a plugin whose id merely starts with `<id>.`. Ids and rules may both hold dots, so plugin `a` with
+      # rule `b.c` and plugin `a.b` with rule `c` share `plugin.a.b.c`, and that exact token drops both. A bare rule
+      # and `all` do not reach these rows: many plugins share a bare rule (`load-error`, `unknown-column`), and a
+      # bare match would hide another plugin's findings. Every other row (built-in, `plugin_loader`, `plugin_trust`)
+      # answers false.
+      def self.plugin_row_disabled?(diagnostic, tokens)
+        return false if diagnostic.rule.nil?
+
+        family = diagnostic.source_family.to_s
+        return false unless family.start_with?(PLUGIN_FAMILY_PREFIX)
+
+        tokens.include?(family) || tokens.include?(diagnostic.qualified_rule)
+      end
     end
   end
 end

data/lib/rigor/analysis/check_rules.rb

@@ -79,19 +79,8 @@ module Rigor
       # runtime one and `def.override-visibility-reduced` cannot prove a reduction.
       IMPLICITLY_PRIVATE_METHODS = (LIFECYCLE_HOOKS + %i[respond_to_missing?]).freeze
 
-      # Resolves a user-supplied rule token (`undefined-method`,
-      # `call.undefined-method`, or the family wildcard `call`)
-      # to the set of canonical rule identifiers it disables.
-      # Returns `nil` for `"all"` (the existing wildcard meaning
-      # "every rule"), or for unknown tokens.
-      def self.resolve_rule_token(token)
-        return nil if token == "all"
-        return [LEGACY_RULE_ALIASES.fetch(token)] if LEGACY_RULE_ALIASES.key?(token)
-        return PRE_EVAL_RULES if token == "pre-eval"
-        return ALL_RULES.select { |r| r.start_with?("#{token}.") } if RULE_FAMILIES.include?(token)
-
-        ALL_RULES.include?(token) ? [token] : []
-      end
+      # The token expansion (`resolve_rule_token` / `expand_rule_tokens` / `expand_token`) lives in the light
+      # `check_rules/rule_ids.rb`, so {SeverityStamp} can apply the `disable:` list on the engine-free hit path.
 
       module_function
 
@@ -480,7 +469,7 @@ module Rigor
       # - **File-level** (v0.1.2): `# rigor:disable-file <rule1>,
       #   <rule2>` anywhere in the file suppresses the matching
       #   diagnostic for every line. `# rigor:disable-file all`
-      #   suppresses every rule across the file. Convention is
+      #   suppresses every built-in rule across the file. Convention is
       #   to put the comment near the top, but Rigor accepts it
       #   anywhere — the comment scope is "this file" regardless
       #   of position.
@@ -488,7 +477,8 @@ module Rigor
       #   on the same line as the offending expression
       #   suppresses the matching diagnostic for that line
       #   only. `# rigor:disable all` on a line suppresses
-      #   every rule on that line.
+      #   every built-in rule on that line. A plugin's rows are
+      #   not passed here; see {.filter_plugin_suppressed}.
       #
       # Both in-source forms are recognised only when the
       # marker is the FIRST thing in the comment, so a
@@ -507,7 +497,7 @@ module Rigor
         diagnostics.reject do |diagnostic|
           rule = diagnostic.rule
           next false if rule.nil?
-          next true if disabled.include?(rule)
+          next true if config_disabled?(rule, disabled)
           next true if file_suppressions.include?("all") || file_suppressions.include?(rule)
 
           line_rules = line_suppressions[diagnostic.line]
@@ -515,6 +505,26 @@ module Rigor
         end
       end
 
+      # Issue #1953 — the in-source markers over the rows a plugin emitted while `path` was analysed
+      # (`#diagnostics_for_file` and node rules). A row answers to a `plugin.<id>.<rule>` or `plugin.<id>` token
+      # only ({.plugin_row_disabled?}); a bare id and `all` keep reaching built-in rows alone. `comments` are
+      # `path`'s, so a row the plugin positioned in another file is left to the `disable:` list and the baseline.
+      # The `disable:` list itself is applied to these rows by {SeverityStamp}, on every run shape.
+      def filter_plugin_suppressed(diagnostics, path:, comments:)
+        return diagnostics if diagnostics.empty?
+
+        line_suppressions, file_suppressions = parse_suppression_comments(comments)
+        return diagnostics if line_suppressions.empty? && file_suppressions.empty?
+
+        diagnostics.reject do |diagnostic|
+          next false unless diagnostic.path == path
+          next true if plugin_row_disabled?(diagnostic, file_suppressions)
+
+          line_rules = line_suppressions.fetch(diagnostic.line, nil)
+          !line_rules.nil? && plugin_row_disabled?(diagnostic, line_rules)
+        end
+      end
+
       # Every suppression-recognition pattern below is anchored with `\A` against the COMMENT SLICE —
       # Prism hands us a slice that starts at the `#`, so `\A#` means "the marker is the first thing in
       # the comment". A real directive always has that shape, in both the whole-line form and the
@@ -704,24 +714,6 @@ module Rigor
         )
       end
 
-      # Expands a list of user-supplied rule tokens into the
-      # canonical-id set per ADR-8 § "Backward compatibility".
-      # `disabled_rules` accepts unprefixed legacy names
-      # (`undefined-method`), canonical names
-      # (`call.undefined-method`), and family wildcards (`call`).
-      def expand_rule_tokens(tokens)
-        Array(tokens).each_with_object(Set.new) do |token, set|
-          set.merge(expand_token(token.to_s))
-        end
-      end
-
-      def expand_token(token)
-        return ["all"] if token == "all"
-
-        resolved = resolve_rule_token(token)
-        resolved.nil? || resolved.empty? ? [token] : resolved
-      end
-
       # rubocop:disable-next Metrics/ClassLength
       class << self
         private
@@ -1393,6 +1385,21 @@ module Rigor
         GEM_OVERLAY_OPEN_RECEIVERS = Set["ActiveSupport::Duration", "ActiveSupport::Concern"].freeze
         private_constant :GEM_OVERLAY_OPEN_RECEIVERS
 
+        # Issue #1456 — the `data/core_overlay/` twin of {GEM_OVERLAY_OPEN_RECEIVERS}. `OpenStruct` defines each field
+        # as a per-instance singleton method and answers the rest through a private `method_missing` (ostruct 0.6), so
+        # no signature can enumerate its surface. The only other declaration in the environment is json's add-on
+        # reopening (`json_create` / `as_json` / `to_json`), which made the class read as fully declared and every
+        # field access a `call.undefined-method`. `data/core_overlay/ostruct.rbs` declares that `method_missing`, and
+        # an RBS-declared `method_missing` does not by itself open a receiver here, so the class is named. No load
+        # gate is needed: the core overlay loads into every environment that has RBS at all, so the list is active
+        # whenever the declaration it protects is. Both sides of the class are open, as with
+        # {GEM_OVERLAY_OPEN_RECEIVERS}, and an inherited Object / Kernel signature stops deciding `call.wrong-arity`
+        # and `call.argument-type-mismatch` ({#unauthoritative_inherited_signature?}): lost true positives,
+        # accepted. The general rule — a class declared only by another library's partial reopening — is #1978, not
+        # this list.
+        CORE_OVERLAY_OPEN_RECEIVERS = Set["OpenStruct"].freeze
+        private_constant :CORE_OVERLAY_OPEN_RECEIVERS
+
         # ADR-26 — whether `class_name` is declared "open" by a
         # loaded plugin (manifest `open_receivers:`). An open
         # class responds beyond its RBS surface, so the
@@ -1401,11 +1408,14 @@ module Rigor
         # RBS method table, so proving a call "undefined" against it is
         # unsound: a plugin-declared open receiver, a Rigor-bundled-
         # overlay open receiver ({GEM_OVERLAY_OPEN_RECEIVERS}) whose
-        # bundled directory this run actually loaded, or a
+        # bundled directory this run actually loaded, a core-overlay
+        # open receiver ({CORE_OVERLAY_OPEN_RECEIVERS}), or a
         # Rigor-synthesized stub type (see `RbsLoader#synthesized_type_names`).
         def unbounded_receiver_surface?(class_name, scope)
+          bare_name = class_name.to_s.sub(/\A::/, "")
           open_receiver?(class_name, scope) || synthesized_stub_receiver?(class_name, scope) ||
-            (GEM_OVERLAY_OPEN_RECEIVERS.include?(class_name.to_s.sub(/\A::/, "")) && gem_overlay_loaded?(scope))
+            CORE_OVERLAY_OPEN_RECEIVERS.include?(bare_name) ||
+            (GEM_OVERLAY_OPEN_RECEIVERS.include?(bare_name) && gem_overlay_loaded?(scope))
         end
 
         def open_receiver?(class_name, scope)

data/lib/rigor/analysis/incremental.rb

@@ -120,6 +120,18 @@ module Rigor
         appeared.freeze
       end
 
+      # Issue #1459 — the method names some file in `paths` started or stopped defining in this edit, on any class or
+      # side. A consumer whose answer asked whether the program defines a name anywhere
+      # (`Inference::BlockCallTiming.project_defines_anywhere?`) recorded a `defines:<name>` edge whichever way it
+      # answered. `paths` MUST include removed files, whose every name vanished. `before` / `after` map a path to the
+      # Set of names it defines (`Inference::ScopeIndexer.defined_method_names`); a path absent from either side
+      # defines nothing there.
+      def changed_defined_names(paths, before, after)
+        moved = Set.new
+        paths.each { |path| moved.merge((before[path] || Set.new) ^ (after[path] || Set.new)) }
+        moved.freeze
+      end
+
       # Issue #1120 — the method names whose refinements moved in this edit. A consumer whose answer consulted the
       # refinement table recorded a `refinement:<method>` edge whichever way it answered, because the answer is a
       # function of the whole project's refinements of that name. `paths` MUST include removed files, whose whole