rigortype 0.4.3 → 0.4.4

data/lib/rigor/cache/descriptor.rb

@@ -82,7 +82,12 @@ module Rigor
       # an unchanged file would fold as "no possible fact" where a cold walk records one.
       # v18: ADR-119 WD3 — the visibility walk fills `contested_discovered_method_visibilities`; a pre-18 bundle
       # carries it empty, so an unchanged file's conditional visibility would fold as certain.
-      SCHEMA_VERSION = 18
+      # v19: #1555 / #1962 — the run-result dependency descriptor now carries a `:kind` row per analysis root,
+      # `pre_eval:` entry and project signature root (configured, or the auto-detected `sig`), so one that
+      # appears, vanishes or changes kind invalidates the warm entry. A
+      # pre-19 entry carries none of them and would validate fresh across exactly those edits, so cached
+      # entries must read as misses once and rebuild carrying the rows.
+      SCHEMA_VERSION = 19
 
       # Per-slot entry value objects. Constructors validate enums / required fields and freeze the resulting
       # struct so no caller can mutate after the entry is in a Descriptor.
@@ -96,7 +101,7 @@ module Rigor
         # It MUST NOT be placed in a descriptor used as a cache KEY (its value carries machine-local,
         # per-run-nondeterministic stat data); {RbsDescriptor.build}'s env-cache `files` therefore stay
         # `:digest`, while the {Runner} run-dependency descriptor and plugin {IoBoundary} reads use `:stat`.
-        VALID_COMPARATORS = %i[digest stat mtime exists].freeze
+        VALID_COMPARATORS = %i[digest stat mtime kind exists].freeze
 
         # The two `:exists` values — `File.exist?`'s answer rendered with `to_s`, which is what
         # {Descriptor#file_entry_fresh?} compares the live answer against.
@@ -163,6 +168,32 @@ module Rigor
           new(path: path, comparator: :exists, value: PRESENT)
         end
 
+        # The four `:kind` values, in the order {Analysis::Runner}'s path expansion asks: a directory, a regular
+        # file, something else that exists (a FIFO, a socket), nothing (a missing path or a dangling symlink).
+        # Each predicate follows symlinks, as the expansion's do.
+        KIND_DIRECTORY = "directory"
+        KIND_FILE = "file"
+        KIND_OTHER = "other"
+        KIND_ABSENT = "absent"
+
+        # #1962 — the kind row: fresh while `path` is still the same kind of thing, stale once it appears,
+        # vanishes, or a directory and a file trade places. It is the row for an analysis root, whose
+        # diagnostics (`no such file or directory`, `not a Ruby file`) answer to exactly that and to nothing
+        # else about the path, and for a `pre_eval:` entry and a signature root: an existence row would read a
+        # directory replaced by a file of the same name as fresh (ADR-45 WD1b's bound), and what the path holds
+        # has rows of its own (the analysed-file set the key carries, a signature root's `.rbs` rows).
+        def self.kind(path:)
+          new(path: path, comparator: :kind, value: kind_of(path))
+        end
+
+        def self.kind_of(path)
+          if File.directory?(path) then KIND_DIRECTORY
+          elsif File.file?(path) then KIND_FILE
+          elsif File.exist?(path) then KIND_OTHER
+          else KIND_ABSENT
+          end
+        end
+
         # @return whether this row records the path as absent (see {.absent}).
         def absent?
           comparator == :exists && value == ABSENT
@@ -413,10 +444,11 @@ module Rigor
 
       # File-comparator strictness ordering. `:stat` is strictest (it carries the content digest AND a stat
       # tuple, so it validates content-authoritatively while short-circuiting on an unmoved stat); `:digest` is
-      # deterministic across machines; `:mtime` is cheaper but local; `:exists` is the weakest signal. Ranking
-      # `:stat` and `:digest` apart guarantees a path contributed under both never raises a value {Conflict}
-      # (their `value` strings differ by construction) — the stricter one wins and its value is used.
-      COMPARATOR_STRICTNESS = { stat: 3, digest: 2, mtime: 1, exists: 0 }.freeze
+      # deterministic across machines; `:mtime` is cheaper but local; `:kind` answers what the path is and
+      # `:exists` only whether it is there, the weakest signal. Ranking `:stat` and `:digest` apart guarantees a
+      # path contributed under both never raises a value {Conflict} (their `value` strings differ by
+      # construction) — the stricter one wins and its value is used.
+      COMPARATOR_STRICTNESS = { stat: 4, digest: 3, mtime: 2, kind: 1, exists: 0 }.freeze
       private_constant :COMPARATOR_STRICTNESS
 
       # Composes any number of descriptors into a single descriptor whose slots are the union of the inputs'
@@ -505,6 +537,8 @@ module Rigor
           FileDigest.stat_fresh?(entry.path, entry.value)
         when :mtime
           File.exist?(entry.path) && File.mtime(entry.path).to_i.to_s == entry.value
+        when :kind
+          FileEntry.kind_of(entry.path) == entry.value
         when :exists
           File.exist?(entry.path).to_s == entry.value
         else

data/lib/rigor/cache/incremental_snapshot.rb

@@ -169,7 +169,10 @@ module Rigor
       # file's conditional `def` as certain and a warm run would answer a definer a cold run declines.
       # 37: ADR-119 WD3 — the visibility walk fills `contested_discovered_method_visibilities`, which a pre-37 bundle
       # carries empty.
-      SCHEMA = 37
+      # 38: issue #1898 — the payload gains `effect_plugin_digest`, the plugin effect-fact digest the collections were
+      # stamped under, which a recheck now checks before its served collections reach the envelope pass. A pre-38
+      # blob carries none, so the gate rejects it and the next run is cold.
+      SCHEMA = 38
 
       # The persisted per-file state.
       # `cache` maps an analyzed file to its diagnostics.
@@ -224,11 +227,22 @@ module Rigor
       # Issues #796 / #794 — the run-level rows a narrowed run replays instead of re-deriving; see
       # docs/internal-spec/cache.md § "Run-level rows the snapshot carries" for why exactly these two are
       # fresh under the fingerprint and why no other `.rigor.yml`-level row may join them.
+      # Issue #1898 — `effect_plugin_digest` is {Rigor::Effects::PluginFacts#digest} at the run that collected
+      # `effect_collections` (nil when collection was off). A plugin stamps its attributions and edges into a file's
+      # collection, and `effects_identity` is plugin-blind (it is compared before any plugin loads), so the session
+      # compares this one after the recheck has loaded them.
       Payload = Data.define(:cache, :sources, :digests, :analyzed,
                             :symbol_sources, :ancestry_sources, :symbol_fingerprints,
                             :missing, :class_decls, :constant_decls, :seed_bundles, :plugin_fact_digest,
                             :return_summaries, :param_table,
-                            :effect_collections, :effects_identity, :run_level_rows)
+                            :effect_collections, :effects_identity, :run_level_rows,
+                            :effect_plugin_digest) do
+        # Defaults to nil so a payload built without it (an older caller, a spec fixture) reads as "unknown",
+        # which the session treats as moved.
+        def initialize(effect_plugin_digest: nil, **rest)
+          super
+        end
+      end
 
       # Issues #796 / #794 — the two run-level rows the snapshot carries. `definition_build_failures` is the
       # reported per-class detail list ({Environment::RbsLoader#definition_build_failures}); `hkt_scan_failure`
@@ -434,7 +448,8 @@ module Rigor
           param_table: data[:param_table] || {},
           effect_collections: data[:effect_collections] || {},
           effects_identity: data[:effects_identity],
-          run_level_rows: data[:run_level_rows]
+          run_level_rows: data[:run_level_rows],
+          effect_plugin_digest: data[:effect_plugin_digest]
         )
       end
       private :payload_from
@@ -459,7 +474,8 @@ module Rigor
           param_table: payload.param_table,
           effect_collections: payload.effect_collections,
           effects_identity: payload.effects_identity,
-          run_level_rows: payload.run_level_rows
+          run_level_rows: payload.run_level_rows,
+          effect_plugin_digest: payload.effect_plugin_digest
         )
         # #1507 — every `--incremental` run that analysed anything rewrites this whole blob, so its deflate is
         # on the edit path; see {Store::DEFLATE_LEVEL}.

data/lib/rigor/cli/mcp_command.rb

@@ -12,7 +12,7 @@ module Rigor
     # Starts a long-running MCP (Model Context Protocol) server over stdio. The server exposes Rigor's analysis tools as
     # MCP tool calls over a newline-delimited JSON-RPC 2.0 stream. See ADR-33.
     #
-    # Slice 1 ships the stdio transport with seven read-only tools: rigor_check, rigor_type_of, rigor_triage,
+    # The stdio transport serves eight read-only tools: rigor_check, rigor_type_of, rigor_triage, rigor_lens,
     # rigor_annotate, rigor_sig_gen, rigor_explain, rigor_coverage.
     class McpCommand < Command
       USAGE = "Usage: rigor mcp [options]"

data/lib/rigor/config_audit.rb

@@ -26,11 +26,12 @@ module Rigor
   #
   # Every check is held to the same bar that {SignaturePathAudit} set: it mirrors the
   # loader's own acceptance test, so a warning means the loader really did load nothing, and
-  # it never fires on a setup that works. In particular the rule-token check only flags a
-  # token under a built-in family (`call`, `flow`, …) — a plugin- or `rbs_extended.*` rule id
-  # (whose family Rigor cannot statically enumerate, since a `node_rule` block emits any
-  # `rule:` string it likes) is left alone, so disabling a plugin rule is never mistaken for
-  # a typo.
+  # it never fires on a setup that works. In particular the `severity_overrides:` check only
+  # flags a key under a built-in family (`call`, `flow`, …) — a plugin- or `rbs_extended.*`
+  # rule id (whose family Rigor cannot statically enumerate, since a `node_rule` block emits
+  # any `rule:` string it likes) is left alone. The `disable:` check goes further because the
+  # list's reach is enumerable (issue #1953): a plugin's row answers only to its qualified
+  # `plugin.<id>.<rule>` id, so a bare plugin rule there is inert (see {.disable_token_warning}).
   module ConfigAudit
     # One config-level finding. `kind` discriminates the source key (`:signature_path`,
     # `:bundled_plugin_signature_path`, `:library`, `:disabled_rule`, `:severity_override`,
@@ -146,18 +147,13 @@ module Rigor
       []
     end
 
-    # `disable:` tokens and `severity_overrides:` keys that name no rule. Restricted to
-    # tokens under a built-in family so a plugin rule id is never mis-flagged (see the module
-    # docstring).
+    # `disable:` tokens that reach no row ({.disable_token_warning}) and `severity_overrides:` keys
+    # that name no rule. An override key is flagged only under a built-in family, so a plugin
+    # rule id is never mis-flagged (see the module docstring).
     def self.rule_token_warnings(configuration)
+      plugin_ids = configured_plugin_ids(configuration.plugins)
       disable = Array(configuration.disabled_rules).filter_map do |token|
-        next unless inert_builtin_token?(token.to_s)
-
-        Warning.new(
-          kind: :disabled_rule,
-          message: "disable: #{token.to_s.inspect} is not a recognized rule id; the suppression has no effect",
-          fields: { "token" => token.to_s }
-        )
+        disable_token_warning(token.to_s, plugin_ids)
       end
       overrides = configuration.severity_overrides.keys.filter_map do |key|
         next unless inert_builtin_token?(key.to_s)
@@ -171,6 +167,106 @@ module Rigor
       disable + overrides
     end
 
+    # Issue #1953 — the run-level rows the diagnostic policy keeps on `severity_overrides:` and the
+    # baseline. `disable:` does not reach them by any spelling, so naming one there is inert.
+    RESERVED_RUN_LEVEL_FAMILIES = %w[plugin_loader plugin_trust rbs.coverage dynamic.dependency-source].freeze
+    RESERVED_RUN_LEVEL_IDS = %w[load-error runtime-error pool-degraded].freeze
+    private_constant :RESERVED_RUN_LEVEL_FAMILIES, :RESERVED_RUN_LEVEL_IDS
+
+    # A warning for a `disable:` token that can reach no row, or nil. Since issue #1953 the list's
+    # reach is exactly enumerable for three shapes, and those are what this flags:
+    #
+    # - a token naming a reserved run-level row ({RESERVED_RUN_LEVEL_FAMILIES} /
+    #   {RESERVED_RUN_LEVEL_IDS}), which the list never reaches;
+    # - a `plugin.`-qualified token naming no plugin `plugins:` configures — checked only when
+    #   every entry's manifest id is known without loading it ({.configured_plugin_ids});
+    # - any other token that is not `all`, a family, a legacy alias or a catalogue / `pre-eval.*`
+    #   id. A bare id never reaches a plugin's row, so a plugin's bare rule is inert here too.
+    #
+    # A token under a non-check engine family (`rbs_extended.*`, `rbs.*`, `dynamic.*`) or a known
+    # non-catalogue engine id stays unflagged: under-warning is this module's FP-safe direction.
+    def self.disable_token_warning(token, plugin_ids)
+      return nil if effective_disable_token?(token)
+
+      reason = disable_token_problem(token, plugin_ids)
+      return nil if reason.nil?
+
+      Warning.new(kind: :disabled_rule, message: "disable: #{token.inspect} #{reason}",
+                  fields: { "token" => token })
+    end
+
+    def self.disable_token_problem(token, plugin_ids)
+      if reserved_run_level_token?(token)
+        "names a run-level row, which `disable:` does not reach; use `severity_overrides:` or a baseline"
+      elsif token.start_with?(Analysis::CheckRules::PLUGIN_FAMILY_PREFIX)
+        unless plugin_ids.nil? || plausible_plugin_token?(token, plugin_ids)
+          "names no plugin `plugins:` configures; the suppression has no effect"
+        end
+      elsif inert_builtin_token?(token)
+        "is not a recognized rule id; the suppression has no effect"
+      elsif !non_check_engine_token?(token)
+        "is not a recognized rule id; the suppression has no effect " \
+          "(if this is a plugin's rule, write it as `plugin.<id>.<rule>`)"
+      end
+    end
+    private_class_method :disable_token_problem
+
+    def self.effective_disable_token?(token)
+      return true if token == "all"
+
+      !Array(Analysis::CheckRules.resolve_rule_token(token)).empty?
+    end
+    private_class_method :effective_disable_token?
+
+    def self.reserved_run_level_token?(token)
+      RESERVED_RUN_LEVEL_IDS.include?(token) ||
+        RESERVED_RUN_LEVEL_FAMILIES.any? { |family| token == family || token.start_with?("#{family}.") }
+    end
+    private_class_method :reserved_run_level_token?
+
+    def self.non_check_engine_token?(token)
+      Analysis::CheckRules::NON_CHECK_DIAGNOSTIC_IDS.include?(token) ||
+        Analysis::CheckRules::NON_CHECK_DIAGNOSTIC_FAMILIES.include?(token.split(".").first)
+    end
+    private_class_method :non_check_engine_token?
+
+    # `plugin.<id>` or `plugin.<id>.<rule>` for a configured id. A manifest id may itself hold a
+    # dot, so the token is matched against each id rather than split.
+    def self.plausible_plugin_token?(token, plugin_ids)
+      rest = token.delete_prefix(Analysis::CheckRules::PLUGIN_FAMILY_PREFIX)
+      plugin_ids.any? { |id| rest == id || rest.start_with?("#{id}.") }
+    end
+    private_class_method :plausible_plugin_token?
+
+    # The manifest id of every `plugins:` entry, or nil when one cannot be known without loading
+    # the plugin. An explicit `id:` is the id; a bundled plugin's id is its gem name minus the
+    # `rigor-` prefix ({Plugin::FirstParty}); a third-party gem named without `id:` may register
+    # any id, so its presence turns the plugin-token check off. An `enabled: false` entry counts:
+    # the user has found the plugin, and under-warning is the FP-safe direction.
+    def self.configured_plugin_ids(plugins)
+      Array(plugins).each_with_object(Set.new) do |raw, ids|
+        entry = raw.is_a?(Hash) ? raw.to_h { |key, value| [key.to_s, value] } : { "gem" => raw.to_s }
+        if entry["id"]
+          ids << entry["id"].to_s
+        elsif bundled_plugin_gem?(entry["gem"].to_s)
+          ids << entry["gem"].to_s.delete_prefix(BUNDLED_GEM_PREFIX)
+        else
+          return nil
+        end
+      end
+    end
+    private_class_method :configured_plugin_ids
+
+    BUNDLED_GEM_PREFIX = "rigor-"
+    private_constant :BUNDLED_GEM_PREFIX
+
+    def self.bundled_plugin_gem?(gem)
+      return false unless gem.start_with?(BUNDLED_GEM_PREFIX)
+
+      File.file?(File.join(SignaturePathAudit::BUNDLED_PLUGINS_ROOT, gem, "lib", "#{gem}.rb"))
+    end
+    private_class_method :bundled_plugin_gem?
+
     # True when `token` looks like a built-in rule id but matches none — its first segment
     # is a built-in family yet it is neither a bare family wildcard nor a known canonical id.
     # A token whose family is not built-in (a plugin / `rbs_extended.*` rule, or a bare

data/lib/rigor/configuration/dependencies.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../configuration_error"
+
 module Rigor
   class Configuration
     # Parsed `dependencies:` section of `.rigor.yml`. Per
@@ -56,7 +58,7 @@ module Rigor
       # Hash with `source_inference:` and / or `budget_per_gem:` / `budget_overrun_strategy:` present.
       def self.from_h(data)
         return new([]) if data.nil?
-        raise ArgumentError, "dependencies: must be a Hash, got #{data.inspect}" unless data.is_a?(Hash)
+        raise ConfigurationError, "dependencies: must be a Hash, got #{data.inspect}" unless data.is_a?(Hash)
 
         raw_entries = coerce_source_inference(data["source_inference"])
         entries, warnings = dedupe_entries(raw_entries)
@@ -139,7 +141,7 @@ module Rigor
           return [] if value.nil? || value == false
 
           unless value.is_a?(Array)
-            raise ArgumentError,
+            raise ConfigurationError,
                   "dependencies.source_inference: must be a list of entries " \
                   "(or false / omitted to disable), got #{value.inspect}"
           end
@@ -149,7 +151,7 @@ module Rigor
 
         def coerce_entry(raw)
           unless raw.is_a?(Hash)
-            raise ArgumentError,
+            raise ConfigurationError,
                   "dependencies.source_inference[] entry must be a Hash, got #{raw.inspect}"
           end
 
@@ -162,7 +164,7 @@ module Rigor
 
         def coerce_gem(value)
           unless value.is_a?(String) && !value.empty?
-            raise ArgumentError,
+            raise ConfigurationError,
                   "dependencies.source_inference[].gem must be a non-empty String, got #{value.inspect}"
           end
 
@@ -170,28 +172,34 @@ module Rigor
         end
 
         def coerce_mode(value)
-          mode = (value || "when_missing").to_sym
+          mode = config_symbol(value || "when_missing")
           return mode if VALID_MODES.include?(mode)
 
-          raise ArgumentError,
+          raise ConfigurationError,
                 "dependencies.source_inference[].mode must be one of " \
                 "#{VALID_MODES.inspect}, got #{value.inspect}"
         end
 
+        # The Symbol a String / Symbol value names, or nil for any other YAML shape (a number, a list, a mapping), which
+        # the caller then reports as not one of its valid values rather than crashing on `#to_sym`.
+        def config_symbol(value)
+          value.to_sym if value.is_a?(String) || value.is_a?(Symbol)
+        end
+
         def coerce_roots(raw)
           roots = Array(raw.fetch("roots", DEFAULT_ROOTS)).map(&:to_s).freeze
           return roots unless roots.empty?
 
-          raise ArgumentError,
+          raise ConfigurationError,
                 "dependencies.source_inference[].roots must not be empty when supplied " \
                 "(omit the key to fall back to the default #{DEFAULT_ROOTS.inspect})"
         end
 
         def coerce_budget_overrun_strategy(value)
-          symbol = value.to_sym
+          symbol = config_symbol(value)
           return symbol if VALID_BUDGET_OVERRUN_STRATEGIES.include?(symbol)
 
-          raise ArgumentError,
+          raise ConfigurationError,
                 "dependencies.budget_overrun_strategy must be one of " \
                 "#{VALID_BUDGET_OVERRUN_STRATEGIES.inspect}, got #{value.inspect}"
         end
@@ -201,13 +209,13 @@ module Rigor
         # MIN_BUDGET_PER_GEM .. MAX_BUDGET_PER_GEM (i.e. 0.25× – 4× of the default).
         def coerce_budget_per_gem(value)
           unless value.is_a?(Integer)
-            raise ArgumentError,
+            raise ConfigurationError,
                   "dependencies.budget_per_gem must be an Integer, " \
                   "got #{value.inspect}"
           end
 
           unless value.between?(MIN_BUDGET_PER_GEM, MAX_BUDGET_PER_GEM)
-            raise ArgumentError,
+            raise ConfigurationError,
                   "dependencies.budget_per_gem must be in the range " \
                   "#{MIN_BUDGET_PER_GEM}..#{MAX_BUDGET_PER_GEM}, " \
                   "got #{value.inspect}"

data/lib/rigor/environment/rbs_loader.rb

@@ -66,6 +66,15 @@ module Rigor
       QUARANTINE_WARN_LIMIT = 10
 
       class << self
+        # Issue #1902 — the fixed total order that picks ONE detail tuple for a class out of several: its two
+        # sides in {#report_definition_build_failure}, or a fresh and a replayed record in
+        # {Analysis::Runner::PoolCoordinator}. Content-only (the tuple carries no side), so both places choose
+        # the same tuple from the same candidates, whatever order those candidates arrived in.
+        def definition_build_detail_order(detail)
+          _, error_class, member, buffers, unresolved = detail
+          [error_class.to_s, member.to_s, Array(buffers).map(&:to_s), Array(unresolved).map(&:to_s)]
+        end
+
         def default
           @default ||= new.freeze
         end
@@ -2471,6 +2480,18 @@ module Rigor
         # fail-soft: a broken RBS environment yields no entries.
       end
 
+      # ADR-113 — the RBS declaration of the constant `name` (qualified) as `[type, buffer name]`, or nil when no
+      # signature declares it. `rigor lens` reports the declared type with the provenance the buffer names.
+      def constant_declaration(name)
+        rbs_name = parse_type_name(name)
+        entry = rbs_name && env&.constant_decls&.[](rbs_name)
+        return nil unless entry
+
+        [entry.decl.type.to_s, entry.decl.location&.buffer&.name.to_s]
+      rescue ::RBS::BaseError
+        nil
+      end
+
       # Slice A constant-value lookup. Returns the translated `Rigor::Type` for a non-class constant
       # declaration (`BUCKETS: Array[Symbol]`, `DEFAULT_PATH: String`, ...) or `nil` when no constant entry
       # exists for `name` in the loaded RBS environment. Callers MUST treat the return value as authoritative
@@ -2904,15 +2925,16 @@ module Rigor
       #
       # So the rescue only remembers, keyed by the `::`-stripped name (the eager walk spells it `::Acme`,
       # a dispatch site spells it `Acme`, and they are one class — the {#synthesized_namespaces}
-      # convention), and {#report_definition_build_failure} decides. First writer wins: the instance and
-      # singleton sides fail for the same underlying collision, and the first is the one a caller hit.
+      # convention), and {#report_definition_build_failure} decides. Every side's detail is kept, not the
+      # first one written (issue #1902): the instance and singleton sides can fail for DIFFERENT reasons
+      # (a duplicated `def self.s` and a duplicated `def i` on one class), and which side a run demands first
+      # depends on which files it analysed, so first-writer-wins made the reported tuple — and with it the
+      # message's "First failure", advice and file list — differ between a cold run and a warm recheck.
       def store_definition_build_detail(class_name, error)
         key = class_name.to_s.delete_prefix("::")
-        details = (@state[:definition_build_details] ||= {})
-        return if details.key?(key)
-
-        details[key] = [key, error.class.name.to_s, definition_build_member(error),
-                        definition_build_conflict_buffers(error), unresolved_type_name_detail(error)].freeze
+        details = ((@state[:definition_build_details] ||= {})[key] ||= [])
+        details << [key, error.class.name.to_s, definition_build_member(error),
+                    definition_build_conflict_buffers(error), unresolved_type_name_detail(error)].freeze
       end
 
       # Issue #997 — the `RBS::NoTypeFoundError` twin of {#definition_build_member}: `nil` for every other
@@ -2987,14 +3009,28 @@ module Rigor
         return if details.nil?
 
         key = class_name.to_s.delete_prefix("::")
-        detail = details[key]
-        return if detail.nil?
+        return if details[key].nil?
 
         reported = (@state[:definition_build_reported] ||= {})
         return if reported[key]
 
         reported[key] = true
-        (@state[:definition_build_failures] ||= []) << detail
+        attempt_both_definition_sides(class_name)
+        canonical = details[key].min_by { |candidate| self.class.definition_build_detail_order(candidate) }
+        (@state[:definition_build_failures] ||= []) << canonical
+      end
+
+      # Issue #1902 — a reported class's tuple is chosen from BOTH sides' failures, so the side this demand
+      # did not ask for is built here too. Without it, the candidate set would be whatever sides the run
+      # happened to demand, and a recheck whose closure touches only `Berry.s` would report the singleton
+      # side's reason where the full run, which also demanded `Berry.new.i`, reported the instance side's.
+      # An internal demand: it decides WHICH reason is shown for a class the analysis already demanded, never
+      # WHETHER a class is reported, so the set #696 binds to the analysis's own demand is unchanged.
+      def attempt_both_definition_sides(class_name)
+        during_internal_demand do
+          instance_definition(class_name)
+          singleton_definition(class_name)
+        end
       end
 
       # Marks a definition demand that is RIGOR'S OWN, not the analysed program's, so

data/lib/rigor/inference/block_call_timing.rb

@@ -165,7 +165,12 @@ module Rigor
       # nothing for names this rare, and the block-return pass is no independent check here: it types a
       # self-call to an overridden `raise` as Kernel's `bot` too, so a missed override is a wrong `bot`.
       # {LastLine.reads_line?} declines on it the same way for `gets` and `readline`.
+      #
+      # Issue #1459 — the answer reads every project file's tables whole, so it records a `defines:<name>` edge
+      # whichever way it answers: an edit that makes a file start or stop defining the name re-checks the reader
+      # (`Incremental.changed_defined_names`). A `pre_eval:` patch moves the snapshot's own fingerprint.
       def project_defines_anywhere?(method_name, scope)
+        Analysis::DependencyRecorder.read_missing(:defines, method_name) if Analysis::DependencyRecorder.active?
         return true if scope.top_level_def_for(method_name)
         # `discovered_methods` withholds a plain cross-file `def` (the ADR-17 monkey-patch contract); the
         # def-node tables still carry it, on both sides.

data/lib/rigor/inference/captured_locals.rb

@@ -9,6 +9,7 @@ require_relative "index_write_widening"
 require_relative "mutation_widening"
 require_relative "optimistic_origin"
 require_relative "receiver_alias"
+require_relative "reflective_ivar_write"
 require_relative "unknown_store_widening"
 
 module Rigor
@@ -129,6 +130,9 @@ module Rigor
             if LOCAL_WRITE_NODES.include?(descendant.class)
               captured_local_write(descendant, ancestors, base_scope) { introduced ||= introduced_locals(block_node) }
             elsif outliving
+              if ReflectiveIvarWrite.unknown_target?(descendant)
+                (names ||= []).concat(reflective_unknown_ivars(base_scope))
+              end
               rebindable_outliving_write(descendant, base_scope, non_locals)
             end
           (names ||= []) << name if name
@@ -136,6 +140,13 @@ module Rigor
         names ? names.uniq : NO_NAMES
       end
 
+      # Issue #1889 — every ivar `base_scope` binds: an `instance_variable_set` on `self` whose target no literal
+      # names ({ReflectiveIvarWrite.unknown_target?}) may write any of them. One on its ADR-58 declaration seed
+      # counts too, since the census behind the seed sees no reflective write; {.bind} keeps its mark.
+      def reflective_unknown_ivars(base_scope)
+        base_scope.ivars.keys
+      end
+
       def rebindable_outliving_write(node, base_scope, non_locals)
         name = outliving_write_name(node, non_locals)
         name if name && rebindable_non_local?(base_scope, name)
@@ -151,8 +162,12 @@ module Rigor
         yield.include?(name) ? nil : name
       end
 
-      # The non-local `node` rebinds under `non_locals:` — or, without it, the instance variable only.
+      # The non-local `node` rebinds under `non_locals:` — or, without it, the instance variable only. A literal-name
+      # `instance_variable_set` on `self` ({ReflectiveIvarWrite.literal_name}) is a write of that ivar under either.
       def outliving_write_name(node, non_locals)
+        reflective = ReflectiveIvarWrite.literal_name(node)
+        return reflective if reflective
+
         name = non_local_write_name(node)
         non_locals || (name && ivar_name?(name) && NON_LOCAL_WRITE_NODES.include?(node.class)) ? name : nil
       end
@@ -201,13 +216,21 @@ module Rigor
       # it the miss answer the mark records (issue #1302).
       def bind(scope, name, type, optimistic: nil)
         case variable_kind(name)
-        when :ivar then OptimisticOrigin.carry_ivar_mark(scope, scope.with_ivar(name, type), name, optimistic)
+        when :ivar then bind_ivar(scope, name, type, optimistic)
         when :cvar then scope.with_cvar(name, type)
         when :global then scope.with_global(name, type)
         else OptimisticOrigin.carry_local_mark(scope, scope.with_local(name, type), name, optimistic)
         end
       end
 
+      # An ivar on its ADR-58 declaration seed reaches {.bind} through {.reflective_unknown_ivars}, and through
+      # `ExpressionTyper#prefix_answered_scope`; rebinding it re-stamps the declaration mark, as
+      # `ReflectiveIvarWrite.apply` does, so a nil in the seed fuels no nil-receiver diagnostic.
+      def bind_ivar(scope, name, type, optimistic)
+        bound = OptimisticOrigin.carry_ivar_mark(scope, scope.with_ivar(name, type), name, optimistic)
+        scope.declaration_sourced?(:ivar, name) ? bound.seed_declaration_sourced_ivar(name, type) : bound
+      end
+
       # The optimistic nil-freeness mark `scope` holds for a name from {.writes}, or nil.
       def optimistic_mark(scope, name)
         case variable_kind(name)
@@ -290,7 +313,7 @@ module Rigor
         receiver = node.receiver
         return true if receiver && MutationWidening::SHAPE_MUTATORS.include?(node.name)
 
-        callee_call?(node)
+        ReflectiveIvarWrite.self_write?(node) || callee_call?(node)
       end
 
       # Issue #1412 — {.content_mutations} for a `while` / `until` / `for` body: the locals bound in `base_scope`

data/lib/rigor/inference/definer_resolution.rb

@@ -39,6 +39,9 @@ module Rigor
       Hit = Data.define(:answer, :owner, :index, :side)
 
       QUESTIONS = %i[definer visibility arity override own_side].freeze
+      # The questions whose answer reads a recorded visibility: only they treat a contested visibility slot as a
+      # possible definer ({#possible?}).
+      VISIBILITY_QUESTIONS = %i[visibility override].freeze
       NONE = :rigor_definer_resolution_none
       STRAY = :rigor_definer_resolution_stray
       private_constant :NONE, :STRAY
@@ -58,12 +61,13 @@ module Rigor
         flavor = question == :arity ? :arity : :methods
         chain = Scope::ResolutionChain.for(scope, class_name.to_s, side, flavor)
 
-        hits = candidates(scope, chain, method_name, from, answer_in)
+        reads_visibility = VISIBILITY_QUESTIONS.include?(question)
+        hits = candidates(scope, chain, method_name, from, answer_in, reads_visibility)
         return UNKNOWN if hits.nil?
 
         verdict = chain.settle(scope, outcomes(hits), owner: hits.first&.owner, unknown_for: method_name) do |retro|
           retro_from = retro_position(chain, retro, from)
-          outcomes(retro_from && candidates(scope, retro, method_name, retro_from, answer_in))
+          outcomes(retro_from && candidates(scope, retro, method_name, retro_from, answer_in, reads_visibility))
         end
         return UNKNOWN unless verdict == :chain
         return UNKNOWN if side == :singleton && SingletonHookDecline.decline?(scope, chain, method_name, from, hits)
@@ -101,7 +105,7 @@ module Rigor
       # follows (the absent candidate). A cut chain, and a chain on which an external ancestor ahead of the
       # candidate (or, with no candidate, the implicit `Object`) may define the name, is a decline, answered by
       # nil instead of a set.
-      def candidates(scope, chain, method_name, from, answer_in)
+      def candidates(scope, chain, method_name, from, answer_in, reads_visibility)
         hits = []
         position = from
         loop do
@@ -113,7 +117,9 @@ module Rigor
           return nil if hit.nil? && chain.truncated?
 
           hits << hit
-          return decided(scope, chain, method_name, from, hits) if hit.nil? || !possible?(scope, hit, method_name)
+          if hit.nil? || !possible?(scope, hit, method_name, reads_visibility)
+            return decided(scope, chain, method_name, from, hits)
+          end
 
           position = hit.index + 1
         end
@@ -188,15 +194,18 @@ module Rigor
       end
 
       # A definer that rests on a fact the walk could not prove executes: the member's `possible` sibling, or a
-      # contested slot of one of the single-valued members.
-      def possible?(scope, hit, method_name)
+      # contested slot of one of the single-valued members. A contested visibility slot counts only for a question
+      # that reads the visibility (`reads_visibility`): a slot is contested there for a visibility call the walk
+      # cannot place (an uncertain toggle, `private(*names)`, `private def self.x`), which leaves the definer and its
+      # `def` certain; a possible `def` or `attr_*` call contests its def-node slot or its name's `possible` side too.
+      def possible?(scope, hit, method_name, reads_visibility)
         discovery = scope.discovery
         owner = hit.owner
         kind = hit.side == :singleton ? :singleton : :instance
         nodes = kind == :singleton ? :discovered_singleton_def_nodes : :discovered_def_nodes
         discovery.possible_method?(owner, method_name, kind) ||
           discovery.contested?(nodes, [owner, method_name.to_sym]) ||
-          discovery.contested?(:discovered_method_visibilities, [owner, method_name.to_sym]) ||
+          (reads_visibility && discovery.contested?(:discovered_method_visibilities, [owner, method_name.to_sym])) ||
           discovery.contested?(:discovered_parameter_envelopes, [owner, [kind, method_name.to_sym]])
       end