rigortype 0.4.5 → 0.4.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4da9b991a97cd586806b416facb6dbf6c3a3b938c7c9433e330bc44c0757fdaf
-  data.tar.gz: 1167e8d91ccbc8740ac4094f67db82937bd3b374d2488a43e514f7922c7a98b1
+  metadata.gz: 608dc6b03dfc9267330c24c6493f3f4ee2d025ac5ce01a044202828fc282e258
+  data.tar.gz: 395692680ea16ec6dc42d4187fc57c10ce00731eea4cd1d03176fcc2daa07c14
 SHA512:
-  metadata.gz: db2047e49879c399812704702d4064304bf4ac9be8fe25132cc65ac441e2962f7b8c45cf59371727dffaf52caab9accbfb7c8ea0abe1976f264a7a4506e46e6f
-  data.tar.gz: e426da15aeb714ab906df710946ae3b2c96b35509632b9c35efba289d303da519f58e3cd362a8b47c4ba8a9f883e54e657edeb3e09c1934b4cd542f119440678
+  metadata.gz: c7145aafeaf9fd22fe3759970c9b4eaafd8720796048641a387ec7a02d4e579689fde37540db686da9904b7d8419a6338b9db7caa38997d7184960c346253f5a
+  data.tar.gz: bff814da943de361c7c1e5bee99fd0e4847d16bb8a9bd3e36609e69246e8eb0e141c6c6e87b425720d709e2277195d9a14100a3018fef75670361fe2acd2160b

data/README.md

@@ -232,7 +232,7 @@ rigor docs --list                 # list every bundled page
 
 ## Status
 
-Current release: **`v0.4.5`** (2026-10-19) — on the
+Current release: **`v0.4.6`** (2026-10-23) — on the
 `0.4.x` line, continuing the evaluation era opened by `v0.2.0`, the first
 publicly-announced (general / evaluation) release. The line publishes
 an enumerated [compatibility surface](docs/compatibility.md) as a

data/docs/handbook/11-sig-gen.md

@@ -538,8 +538,17 @@ overrides the method with the other one is not reported as
 widening the return. A body that returns only `nil` keeps
 the `untyped`: it is the shape of a template method a
 subclass fills in, and `-> nil` would make every override
-that returns a value a widening. `nil` inside a union and a
-computed `Float` are proposed as they are. An `untyped` that
+that returns a value a widening. A literal inside a tuple, a
+record or a type argument is widened the same way while the
+shape stays (`-> [1, "a"]` becomes `-> [Integer, String]`,
+`-> { a: 1 }` becomes `-> { a: Integer }`); of the generic
+types, only the arguments of `Array`, `Hash`, `Set`, `Range`
+and `Enumerator` are widened. `nil` inside a union or a shape
+and a computed `Float` are proposed as they are. When the
+method also carries an inline `# @rbs` annotation for its
+parameters only, a return holding a literal that would be
+widened, nested or not, is not proposed at all and the
+`untyped` stays. An `untyped` that
 only the inline reader synthesizes for a `def` you did not
 annotate keeps the literal, as does a method no `.rbs`
 declares — the literal is still the strictest thing the body

data/docs/manual/02-cli-reference.md

@@ -28,15 +28,25 @@ rigor check [paths...]
 `paths` are files or directories; when omitted, Rigor checks
 the `paths:` list from the configuration file.
 
+Only the files you name are reported on, but Rigor reads the
+declarations in the configured `paths:` too, so a file resolves a
+class or constant that another file declares. A file outside
+`paths:` also reads the files it loads with a literal
+`require_relative "..."`, and the files those load in turn. Their
+classes, modules and constants resolve and their methods count as
+defined, but Rigor does not infer what those methods return or
+check their arity, since another file may redefine them.
+
 | Option | Effect |
 | --- | --- |
-| `--config=PATH` | Use a specific config file instead of auto-discovery. |
+| `--config=PATH` | Use a specific config file instead of auto-discovery. A path that does not exist is an error (exit 64), not a run with the defaults. |
 | `--format=FORMAT` | Output format. Default `text`. Also `json` (structured stream), plus the CI-native renderings `sarif`, `github`, `gitlab`, `checkstyle`, `junit`, and `teamcity` — see [Running Rigor in CI](11-ci.md). |
 | `--no-ci-detect` | Disable CI auto-detection — by default `text` output also emits the running CI's native annotations / hint (`RIGOR_CI_DETECT=0` does the same). See [Running Rigor in CI § auto-detection](11-ci.md). |
 | `--explain` | Surface fail-soft fallback events as `info` diagnostics. |
 | `--no-cache` | Skip the persistent cache for this run. With `--incremental` it is a cold full analysis: the incremental snapshot and the run-result cache are neither read nor written, so the next plain `--incremental` run still uses the snapshot it had before. |
 | `--incremental` | Re-analyse only the files changed since the last run plus the files that depend on them, serving the rest from a cross-process disk snapshot (ADR-46). Diagnostics are identical to a full run; a config / gem / version change (or a file added or removed) transparently forces a full re-analysis. A run with nothing changed is answered from the cache without starting the analyzer. See [Caching](12-caching.md). |
-| `--verify-incremental` | Acceptance gate: run the incremental analyzer against a full `--no-cache` run and assert the diagnostics agree as a set and in the same order, then exit (0 on match, 1 on mismatch: the differing diagnostics for a set mismatch, or the first index where the order diverges for a same-set, different-order mismatch). Used in CI to guarantee `--incremental` never serves a stale result. |
+| `--verify-incremental` | Acceptance gate: run the incremental analyzer against a full `--no-cache` run and assert the diagnostics agree as a set and in the same order, then exit (0 on match, 1 on mismatch: the differing diagnostics for a set mismatch, or the first index where the order diverges for a same-set, different-order mismatch). It re-analyses half of an unchanged tree and serves the other half from cache, so it checks the cache-merge path but not that an edit re-checks every file it affects; `--verify-incremental-edits` adds that. |
+| `--verify-incremental-edits=N` | With `--verify-incremental` (and implying it): after the check above, replay two edits on each of `N` files spread over the analysed list, through an editor buffer, never on disk: the file emptied, then the file reduced to its `class` / `module` declarations with every body dropped (skipped when that is the file itself, or holds no declaration). After each edit, the warm recheck of the baseline must equal a full analysis of the edited tree, or the run fails naming the edit and the file. Each replay costs a recheck and a full analysis. A replay the recheck declines (it would have been a full analysis) is counted in the OK line, and the run fails if every replay declined. Only these two removals are replayed, never an addition. Default 0. |
 | `--clear-cache` | Delete the cache directory before running. |
 | `--cache-stats` | Print the on-disk cache inventory when finished — on stdout under `--format text`, on stderr under every other format, so machine-readable output stays a parseable document. `--clear-cache`'s and `--verify-incremental`'s notes follow the same rule. |
 | `--[no-]stats` | Print a run summary (files, classes, memory, wall time) to stderr. Default on. |
@@ -60,7 +70,9 @@ that want the stricter reading.
 ### Editor mode scope
 
 `--tmp-file` / `--instead-of` on their own analyse **only** the
-buffer's file: fast, and blind to what the unsaved edit does to the
+buffer's file. It still reads the rest of the project's declarations
+(the classes and methods other files define), as `rigor check FILE`
+does, but it reports nothing about what the unsaved edit does to the
 rest of the project.
 
 Adding `--incremental` analyses the **whole project with the buffer
@@ -138,6 +150,19 @@ truncation explicit. `--trace` records fail-soft fallbacks,
 after the rows of a line table in text output. The editor-mode
 `--tmp-file` / `--instead-of` pair is accepted as on `check`.
 
+A class or constant that another project file declares reads as
+`rigor check` types it (`singleton(User)`) when a bare
+`rigor check --incremental` has left a snapshot for the project:
+`type-of` folds the cross-file declarations from that snapshot's
+per-file bundles, re-reading any file whose bytes changed since,
+and never writes it. With no reusable snapshot (none yet, or one a
+change made unusable, for example a changed configuration, lockfile, `sig/`, `pre_eval:`
+file or required feature, an engine upgrade, or a snapshot written
+for other roots) the probe types the one file on its own, so such a name reads
+`Dynamic[top]`, and it prints nothing about it. Only those
+declarations are shared: the types `check` infers for an unannotated
+parameter are not.
+
 A template a plugin compiles into Ruby (an ERB view under
 `rigor-actionpack`) is probed the way `rigor check` analyses
 it: the compiled Ruby is typed under the view's declared
@@ -162,7 +187,9 @@ and is probed as plain Ruby, parse error included.
 
 The four probe commands — `type-of`, `type-scan`, `trace` and
 `annotate` — build their environment fresh on every invocation
-and never read or write the persistent cache. That is why none
+and never read or write the persistent cache (apart from the
+read-only snapshot lookup `type-of` makes for the project's
+declarations, above). That is why none
 of them takes `--no-cache`: the flag would have nothing to skip.
 A probe therefore types against the environment `rigor check
 --no-cache` analyses with. The environment a cached (default)
@@ -532,6 +559,12 @@ rigor sig-gen [paths]
 | `--no-cache` | Do not read or write the analysis cache. Only effect collection uses it. |
 | `--format=text\|json` | Output format. |
 
+A `paths` argument that does not exist, or is neither a directory nor a `.rb` file, is reported the way
+`rigor check` reports it: on stderr as `path:1:1: error: …`, or under `diagnostics` in `--print` and `--diff`
+JSON output. When no argument is readable this exits `1`, under every mode, `--write` and `--check` included.
+The configured default `paths:` count too, so `paths: [lib]` with no `lib/` directory exits `1`. A `--config`
+that names no file, is a directory, or is empty is a usage error and exits `64`.
+
 `--print`, `--diff`, `--write` and `--check` are mutually exclusive.
 `--check` fails exactly when `--write` would create, change or
 refuse a file, so a tighter return `--write` declines without
@@ -640,7 +673,7 @@ rigor triage [paths]
 
 `--top=N` sets the hotspot count (default 10); `--hints-only`,
 `--selectors-only`, and `--no-hints` select which sections print.
-`triage` is advisory and always exits `0` — it never gates a build.
+`triage` is advisory and exits `0` once it runs — it never gates a build; a usage error exits `64`.
 
 By default the distribution, selectors, and hotspots sections count
 only the **actionable** diagnostics (`error` + `warning`). `info`
@@ -946,6 +979,11 @@ loaded from (a `path:` line in text, a `"path"` key in JSON), so
 if a stale installed gem is shadowing a newer checkout's bundled
 plugin copy the mismatch is visible at a glance.
 
+A plugin that declares `per_invocation_classes:` or
+`per_invocation_non_action_macros:` ([ADR-125](../adr/125-per-invocation-classes.md))
+also gets a line for each in text, and a key in JSON (an empty
+array when it declares none).
+
 ```sh
 rigor plugins [--format=text|json] [--strict] [--capabilities] [--config=PATH]
 ```
@@ -1268,8 +1306,9 @@ diagnostics about Rigor's own inference cutoffs and memory — see
 | `64` | Usage error — unknown command, bad flag, malformed argument, or a value in `.rigor.yml` the loader cannot proceed on. |
 | `70` | Internal fatal error — `SystemStackError` or `NoMemoryError` inside the analysis; Rigor could not finish the run, so its report on disk is empty rather than clean. |
 
-`rigor triage` is the exception: it is advisory and always
-exits `0`.
+`rigor triage` is the exception: it is advisory and exits `0`
+whenever it runs to completion. A usage error, such as a
+`--config` that names no file, still exits `64`.
 
 A configuration mistake prints one `rigor:` line naming the key
 and nothing else — no backtrace, on every command:

data/docs/manual/03-configuration.md

@@ -67,7 +67,7 @@ cache:
 | `target_ruby` | String | `"4.0"` | The lowest Ruby version *your* project runs on — `"X.Y"`, `"X.Y.Z"`, or `"latest"`. Independent of the Ruby Rigor itself runs on. Every value selects the syntax Rigor parses. A version you set explicitly also turns on the Ruby-deprecation rules for that version ([`call.deprecated-ruby2-keywords`](04-diagnostics.md#rule-call-deprecated-ruby2-keywords) from `"4.1"`); the default and `"latest"` never do, which is why `rigor init` writes the key commented out. |
 | `paths` | Array | `["lib"]` | Directories or files to analyse. |
 | `exclude` | Array | `[]` | Glob patterns to skip. A relative pattern is matched against the file's path relative to the directory of the config file in use (the working directory when no config file is used), so it excludes the same files whether the path came from `paths:` or from a command-line argument, and it never matches on a directory above that base (a file outside it is seen as `../…`, so `../shared/lib/gen/**` reaches a sibling directory that `paths:` names). A leading `./` is ignored, and a pattern starting with `.` (such as `.*`) also matches files outside the base, which appear as `../…`. A symlink to a file is matched only under its own name: the realpath pass resolves directories, not files. `*` and `**` also cross `/`, so `lib/*.rb` matches nested files too. An absolute pattern is matched against the absolute path. Patterns from an `includes:` file resolve against the top-level config's directory, not the included file's. `vendor/bundle`, `.bundle`, and `node_modules` are always excluded. |
-| `test_paths` | Array | `nil` | The project's test roots: the directories (or files) holding its tests. Relative entries resolve against the config file's directory. Unset auto-detects whichever of `spec/` and `test/` exist; `[]` declares none. `rigor sig-gen --params=observed` reads call sites there to type parameters, and names on stderr a declared root that does not exist. Test roots are not analysed unless `paths:` also lists them, and changing them invalidates no cache. |
+| `test_paths` | Array | `nil` | The project's test roots: the directories (or files) holding its tests. Relative entries resolve against the config file's directory. Unset auto-detects whichever of `spec/` and `test/` exist in the config file's directory, or in the working directory when the config file's directory has neither or no config file is used; `[]` declares none. `rigor sig-gen --params=observed` reads call sites there to type parameters, and names on stderr a declared root that does not exist. Test roots are not analysed unless `paths:` also lists them, and changing them invalidates no cache. |
 | `includes` | Array | `[]` | Other config files to layer underneath this one. |
 | `fold_platform_specific_paths` | Boolean | `false` | Resolve Ruby-version-conditional load paths when discovering sources. |
 | `parameter_inference` | Boolean | `false` | Opt-in call-site parameter type inference on the `check` walk ([ADR-67](../adr/67-parameter-type-inference.md) WD6). When `true`, an undeclared `def` / `initialize` / setter parameter is typed to the union of its resolved call-site argument types, sharpening downstream ivar reads, folds, and protection coverage. Precision-additive only — the negative rules never fire against an inferred parameter. Cannot be combined with `--incremental`. |
@@ -106,6 +106,7 @@ rigor: disable: "call.undefined-methdo" is not a recognized rule id; the suppres
 rigor: disable: "plugin_loader.load-error" names a run-level row, which `disable:` does not reach; use `severity_overrides:` or a baseline
 rigor: disable: "plugin.shoulda-matchers.unknown-column" names no plugin `plugins:` configures; the suppression has no effect
 rigor: severity_overrides: "flow.bogus" is not a recognized rule id; the override has no effect
+rigor: severity_overrides: "undefined-method" is a legacy alias of `call.undefined-method`; the override has no effect, so write `call.undefined-method`
 rigor: bundler.lockfile: "./missing/Gemfile.lock" does not exist
 ```
 

data/docs/manual/04-diagnostics.md

@@ -67,7 +67,7 @@ carries no `documentation_url`.
 | <a id="rule-flow-return-in-ensure"></a>`flow.return-in-ensure` | An explicit `return` inside an `ensure` clause — it overrides the method's in-flight return value and silently swallows any in-flight exception. A `return` in a nested `def`, lambda, or `define_method` block inside the `ensure` does not fire (it exits that inner frame). | high |
 | <a id="rule-flow-shadowed-rescue-clause"></a>`flow.shadowed-rescue-clause` | A `rescue` clause can never run because an earlier clause of the same chain already catches a superclass (or the same class) of every exception class it names. | high |
 | <a id="rule-def-return-type-mismatch"></a>`def.return-type-mismatch` | The method body's result violates its declared RBS return type. | medium |
-| <a id="rule-def-ivar-write-mismatch"></a>`def.ivar-write-mismatch` | An instance variable is written with a type disagreeing with its first write, unless its RBS declaration (`@x: T` or an `attr_*` member) admits both writes. | high |
+| <a id="rule-def-ivar-write-mismatch"></a>`def.ivar-write-mismatch` | An instance variable is written with a type disagreeing with its first write, unless its RBS declaration (`@x: T` or an `attr_*` member) admits both writes. With `rigor-actionpack` or `rigor-actionmailer` loaded, writes in two different actions of a controller or mailer are not compared, since Rails runs one action per instance. A write in a private or protected helper, `initialize` or the same action still is, and so is one in a callback target or `helper_method` that a macro in the same file names. A public method named only by a macro in another file or a concern, or reached through a lambda callback, counts as an action, and so does an action another action calls. | high |
 | <a id="rule-def-method-visibility-mismatch"></a>`def.method-visibility-mismatch` | An explicit-receiver call reaches a private method. | high |
 | <a id="rule-def-override-visibility-reduced"></a>`def.override-visibility-reduced` | An override reduces the visibility it inherits from a project-defined ancestor. | high |
 | <a id="rule-def-override-return-widened"></a>`def.override-return-widened` | An override's declared return type widens the inherited return (covariance). | high |

data/docs/manual/10-mcp-server.md

@@ -66,7 +66,9 @@ rigor mcp [--transport=stdio] [--config=PATH]
   transport is queued for v2.
 - `--config=PATH` — session-level default config path. Individual tool
   calls may supply their own `config` argument, which takes precedence.
-  Without either, `Configuration.discover` walks `.rigor.yml` /
+  A path that names no file is an error, not a silent switch to the
+  defaults, for the session default and for a per-call `config` alike:
+  the call returns `isError: true`. Without either, `Configuration.discover` walks `.rigor.yml` /
   `.rigor.dist.yml` from the working directory.
 
 Exit codes: 0 (clean shutdown — stdin EOF), 64 (unknown
@@ -417,6 +419,12 @@ The key is absent under the default `untyped` policy.
 Classifications: `new-file`, `new-method`, `tighter-return`,
 `equivalent`, `skipped`.
 
+A `paths` entry that is neither a directory nor a `.rb` file is reported
+under a top-level `diagnostics` array, in the shape `rigor_check` uses
+(`"message": "no such file or directory"`). It is a warning beside
+paths that were read, and an error when none was. An empty `candidates`
+list with no `diagnostics` means nothing was found to generate.
+
 **Typical agent use:** call `rigor_sig_gen` to see which methods have
 precise enough returns to be worth writing into `sig/`, then generate
 and insert the RBS. The agent should NOT write signatures

data/docs/manual/12-caching.md

@@ -185,7 +185,14 @@ exactly which files an edit can affect. A continuous-integration
 gate, `rigor check --verify-incremental`, asserts this on every
 build: it runs the incremental analyzer and a full analysis and
 fails if they disagree on a single diagnostic, or list the same
-diagnostics in a different order.
+diagnostics in a different order. That gate re-analyses an
+unchanged tree, so it cannot see an edit that fails to re-check a
+file it affects. `--verify-incremental-edits=N` also edits `N`
+files one at a time, in memory and not on disk, and compares each
+warm recheck with a full analysis of the edited tree. Each file is
+edited twice: once emptied, and once reduced to its `class` /
+`module` declarations with every body dropped. It replays only
+those two removals, never an addition or any other edit.
 
 Rigor is also precise about *what* an edit changed. Re-checking a
 file that many others depend on — a base class, a widely-used

data/docs/manual/plugins/rigor-actionmailer.md

@@ -77,6 +77,36 @@ plugins:
   `--fail-on=warning` run — regenerate with `rigor baseline
   regenerate`.
 
+## Instance variable writes across actions
+
+The plugin tells the engine that a mailer runs one action per instance
+([ADR-125](../../adr/125-per-invocation-classes.md)). Its manifest lists
+`ActionMailer::Base` in `per_invocation_classes:`, and the callback macros
+(`before_action` and the rest) and `helper_method` in
+`per_invocation_non_action_macros:`, so a method those name is not an action.
+
+So [`def.ivar-write-mismatch`](../04-diagnostics.md#rule-def-ivar-write-mismatch)
+stays silent when `welcome` assigns `@items = [1, 2]` and `digest` assigns
+`@items = { a: 1 }`. It still reports two divergent writes in the same action,
+and a divergence that involves a private or protected helper, `initialize`, or a
+callback target or `helper_method` that a macro in the same file names.
+
+The callback macros include `before_deliver`, `after_deliver` and
+`around_deliver`, which run on the action's own instance.
+
+Two shapes stay silent because their macros are not listed: a public
+method named by `rescue_from X, with: :handler` or by `layout :method_name`
+counts as an action, as does one a lambda callback
+(`before_action -> { load_roles }`) reaches ([#2320](https://github.com/rigortype/rigor/issues/2320) tracks the fix).
+
+Visibility is read in source order, as Rails builds `action_methods` from the
+public instance methods. A method that ends up protected or private is not an
+action: it follows a bare `protected` or `private`, is named by `private :x` or
+`protected :x`, or is defined inline (`private def x`). `public :x` or
+`public def x` makes it one again. So it is no longer checked for a view
+template, and calling it (`UserMailer.helper`) reports `unknown-action` at
+error severity, as Rails raises `NoMethodError` for it.
+
 ## Plugin internals
 
 The mailer/concern discoverer, the cached `:mailer_index` producer,

data/docs/manual/plugins/rigor-actionpack.md

@@ -41,6 +41,36 @@ no-op rather than erroring.
 | `plugin.actionpack.permit-call` | info | a `params.require(:m).permit(:key, …)` chain resolved to a known model; keys matched against its columns |
 | `plugin.actionpack.unknown-permit-key` | error | a literal `permit(:key)` is a near-miss (edit distance ≤ 2) of a real column but not one — a likely typo (with a did-you-mean). A key nothing like any column (a legitimate virtual attribute) does not fire |
 
+The plugin also tells the engine that a controller runs one action
+per instance ([ADR-125](../../adr/125-per-invocation-classes.md)).
+Its manifest lists `ActionController::Base` and
+`ActionController::API` in `per_invocation_classes:`. It also lists
+the callback macros (`before_action` and the rest) and
+`helper_method` in `per_invocation_non_action_macros:`, so a method
+those name is not an action.
+
+So `def.ivar-write-mismatch` stays silent when `index` assigns
+`@roles = Role.sorted.to_a` and `permissions` assigns
+`@roles = Role.sorted`. It still reports a divergence that involves
+a private or protected helper, `initialize`, or two writes in the
+same action. It also still reports one that involves a callback
+target or `helper_method`, when the macro naming it sits in the same
+file as the method. Actions defined in a concern module and
+`ActionController::Metal` controllers keep reporting too.
+
+Two shapes stay silent because their macros are not listed: a public
+method named by `rescue_from X, with: :handler` or by `layout :method_name`
+counts as an action, as does one a lambda callback
+(`before_action -> { load_roles }`) reaches ([#2320](https://github.com/rigortype/rigor/issues/2320) tracks the fix).
+
+These shapes stay silent:
+
+- a public method named only by a macro in another file or a
+  concern, such as `ApplicationController`;
+- a public method a lambda callback reaches
+  (`before_action -> { load_roles }`);
+- an action that calls another action.
+
 Filter and render resolution honours nested-module controller
 qualification (`module Admin; class WidgetsController` resolves
 views under `admin/widgets/…`) and silences gem-shipped parent

data/docs/manual/plugins/rigor-devise.md

@@ -48,6 +48,21 @@ whatever class includes the concern.
 
 ## Limitations
 
+- **Needs RBS for the Devise modules.** The methods come from the
+  strategy modules' signatures (`Devise::Models::DatabaseAuthenticatable`
+  and the rest), which Rigor does not bundle and the `devise` gem does
+  not ship. Supply them through `signature_paths:` (or a
+  `rbs collection`); a strategy module with no signature contributes
+  nothing, and the model's `valid_password?` and friends stay as they
+  were. `plugins/rigor-devise/demo/sig/devise.rbs` is a minimal
+  example.
+- **Your own definitions win.** A method the model defines itself
+  (`def`, `alias_method`, `attr_*`, `define_method`, `delegate`), or
+  that a module of your project it includes or prepends defines, is
+  left to that definition rather than typed from the Devise module.
+  This holds even for a module included before the `devise` call,
+  which Devise's module would override at runtime. Only the module's
+  own public methods are contributed.
 - **Instance methods only.** Per-module `ClassMethods` (e.g.
   `User.reset_password_by_token`) are not yet synthesised.
 - **Controller helpers deferred.** `current_user` /

data/docs/manual/plugins/rigor-rspec.md

@@ -73,10 +73,11 @@ end
 | `eq(literal)` / `eql(literal)` | meet with `Constant<literal>` (see below) |
 | `be_a(T)` / `be_kind_of(T)` / `be_instance_of(T)` / `be_an_instance_of(T)` | meet with `T` |
 | `be_nil` | narrow to `Constant<nil>` |
-| `match(/regex/)` | narrow to `String` |
+| `match(/regex/)` | keep the `String` and `Symbol` members, read an `Object`, `BasicObject` or module member as `String \| Symbol`, and remove `nil`, `true`, `false` and numeric members (unless the project defines `match`, `to_str` or `==` on them); unchanged when a member may be anything else |
 | `not_to be_nil` / `to_not be_nil` | narrow away from `nil` |
 | `not_to be_a(T)` / `not_to be_kind_of(T)` / `not_to be_instance_of(T)` / `not_to be_an_instance_of(T)` | narrow away from `T` |
 | `not_to eq(literal)` / `not_to eql(literal)` (and `to_not`) | unchanged (see below) |
+| `not_to match(/regex/)` (and `to_not`) | unchanged: a `String` that does not match passes |
 
 Other matchers emit nothing. `be_truthy` is not narrowed, nor is
 `expect { ... }.to raise_error(...)` (the block form), nor an

data/lib/rigor/analysis/buffer_binding.rb

@@ -24,6 +24,20 @@ module Rigor
       def display_path(path)
         path == physical_path ? logical_path : path
       end
+
+      # The file's identity for comparing two spellings of one path: its real path, resolved through its directory
+      # when the file is absent from disk (a new buffer's file), so a symlinked root or parent spells it as it spells
+      # an existing file. Two accepted limits: a missing name is compared as written, so a name that differs only in
+      # case is not matched; and a `..` in a missing path is resolved textually, not through the filesystem.
+      def self.real_path(path)
+        File.realpath(path)
+      rescue SystemCallError
+        absolute = File.absolute_path(path)
+        parent = File.dirname(absolute)
+        return absolute if parent == absolute
+
+        File.join(real_path(parent), File.basename(absolute))
+      end
     end
   end
 end

data/lib/rigor/analysis/check_rules/inferred_param_guard.rb

@@ -21,6 +21,14 @@ module Rigor
       # - the direct receiver / subject: `param.foo`, `case param`
       # - an indexed element: `param[i] - x` (the `-` receiver is the `[]` call whose root is `param`)
       # - any method chain: `param.foo.bar`, `param.foo(arg).baz`, `param.key?(:x)`
+      # - an array or hash literal holding the parameter (issue #2189): `[param].first.upcase`,
+      #   `{a: param}[:a].upcase`. The engine reads such an element back precisely, so the read is the
+      #   parameter's lower bound again; any other call on the literal declines too, the FP-safe direction.
+      # - an instance variable the same method wrote from such a value (issue #2189): `@x = param; @x.upcase`.
+      #   This one IS a scope mark — {Inference::StatementEvaluator#eval_ivar_write} stamps `:inferred_param`
+      #   under the ivar's `@`-prefixed name, which no local can spell — because the write and the read are
+      #   separate statements. The mark is method-local: the class-ivar census that seeds a sibling method's
+      #   ivars types the write's RHS without the inference seed, so a cross-method read is not a lower bound.
       #
       # Every value derived from an inferred parameter by dispatch is itself a lower bound, so firing against it
       # is an FP by the same construction. No-op on a normal `check` run — `Scope#inferred_param?` is false
@@ -36,17 +44,30 @@ module Rigor
           return false if node.nil? || depth > MAX_DEPTH
 
           case node
-          when Prism::LocalVariableReadNode then scope.inferred_param?(node.name)
+          when Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode then scope.inferred_param?(node.name)
           when Prism::CallNode then rooted?(node.receiver, scope, depth + 1)
-          # Value-combining forms: the produced value is a union of the operands, so it is a lower bound when
-          # ANY operand is inferred-parameter-rooted (`cps[i] - x rescue -1`, `a && param.foo`, `param || b`).
-          # Declining on the whole expression is FP-safe by the same lower-bound argument.
+          when Prism::ArrayNode, Prism::HashNode, Prism::KeywordHashNode, Prism::AssocNode
+            literal_rooted?(node, scope, depth + 1)
+          else combining_rooted?(node, scope, depth + 1)
+          end
+        end
+
+        # An array or hash literal is rooted when any element is: the engine reads the element back precisely.
+        def literal_rooted?(node, scope, depth)
+          parts = node.is_a?(Prism::AssocNode) ? [node.key, node.value] : node.elements
+          parts.any? { |part| rooted?(part, scope, depth) }
+        end
+
+        # Value-combining forms: the produced value is a union of the operands, so it is a lower bound when ANY
+        # operand is inferred-parameter-rooted (`cps[i] - x rescue -1`, `a && param.foo`, `param || b`). Declining
+        # on the whole expression is FP-safe by the same lower-bound argument.
+        def combining_rooted?(node, scope, depth)
+          case node
           when Prism::RescueModifierNode
-            rooted?(node.expression, scope, depth + 1) || rooted?(node.rescue_expression, scope, depth + 1)
-          when Prism::AndNode, Prism::OrNode
-            rooted?(node.left, scope, depth + 1) || rooted?(node.right, scope, depth + 1)
-          when Prism::ParenthesesNode then rooted?(last_statement(node.body), scope, depth + 1)
-          when Prism::StatementsNode then rooted?(node.body.last, scope, depth + 1)
+            rooted?(node.expression, scope, depth) || rooted?(node.rescue_expression, scope, depth)
+          when Prism::AndNode, Prism::OrNode then rooted?(node.left, scope, depth) || rooted?(node.right, scope, depth)
+          when Prism::ParenthesesNode then rooted?(last_statement(node.body), scope, depth)
+          when Prism::StatementsNode then rooted?(node.body.last, scope, depth)
           else false
           end
         end