rigortype 0.4.5 → 0.4.7

data/docs/manual/03-configuration.md

@@ -24,7 +24,7 @@ Relative paths in a config file resolve against that file's own directory, with
 `rigor` runs from. They match only when you run `rigor` from the directory that holds the config file, which is
 the usual case; with `--config path/to/.rigor.yml` from elsewhere, give these three as absolute paths.
 A leading `~/` (or a bare `~`) in a path setting expands to your home directory; `~name` is an ordinary
-directory called `~name`, not another user's home. This covers `paths:`, `signature_paths:`, `test_paths:`,
+directory called `~name`, not another user's home. This covers `paths:`, `signature_paths:`, `core_root:`, `test_paths:`,
 `pre_eval:`, `plugins_io.allowed_paths:`, `includes:`, `bundler.bundle_path:`, `bundler.lockfile:` and
 `rbs_collection.lockfile:`. It does not apply to `cache.path:`, `baseline:` or `effects.snapshot.path:`, which stay
 literal and relative to the working directory.
@@ -67,7 +67,7 @@ cache:
 | `target_ruby` | String | `"4.0"` | The lowest Ruby version *your* project runs on — `"X.Y"`, `"X.Y.Z"`, or `"latest"`. Independent of the Ruby Rigor itself runs on. Every value selects the syntax Rigor parses. A version you set explicitly also turns on the Ruby-deprecation rules for that version ([`call.deprecated-ruby2-keywords`](04-diagnostics.md#rule-call-deprecated-ruby2-keywords) from `"4.1"`); the default and `"latest"` never do, which is why `rigor init` writes the key commented out. |
 | `paths` | Array | `["lib"]` | Directories or files to analyse. |
 | `exclude` | Array | `[]` | Glob patterns to skip. A relative pattern is matched against the file's path relative to the directory of the config file in use (the working directory when no config file is used), so it excludes the same files whether the path came from `paths:` or from a command-line argument, and it never matches on a directory above that base (a file outside it is seen as `../…`, so `../shared/lib/gen/**` reaches a sibling directory that `paths:` names). A leading `./` is ignored, and a pattern starting with `.` (such as `.*`) also matches files outside the base, which appear as `../…`. A symlink to a file is matched only under its own name: the realpath pass resolves directories, not files. `*` and `**` also cross `/`, so `lib/*.rb` matches nested files too. An absolute pattern is matched against the absolute path. Patterns from an `includes:` file resolve against the top-level config's directory, not the included file's. `vendor/bundle`, `.bundle`, and `node_modules` are always excluded. |
-| `test_paths` | Array | `nil` | The project's test roots: the directories (or files) holding its tests. Relative entries resolve against the config file's directory. Unset auto-detects whichever of `spec/` and `test/` exist; `[]` declares none. `rigor sig-gen --params=observed` reads call sites there to type parameters, and names on stderr a declared root that does not exist. Test roots are not analysed unless `paths:` also lists them, and changing them invalidates no cache. |
+| `test_paths` | Array | `nil` | The project's test roots: the directories (or files) holding its tests. Relative entries resolve against the config file's directory. Unset auto-detects whichever of `spec/` and `test/` exist in the config file's directory, or in the working directory when the config file's directory has neither or no config file is used; `[]` declares none. `rigor sig-gen --params=observed` reads call sites there to type parameters, and names on stderr a declared root that does not exist. Test roots are not analysed unless `paths:` also lists them, and changing them invalidates no cache. |
 | `includes` | Array | `[]` | Other config files to layer underneath this one. |
 | `fold_platform_specific_paths` | Boolean | `false` | Resolve Ruby-version-conditional load paths when discovering sources. |
 | `parameter_inference` | Boolean | `false` | Opt-in call-site parameter type inference on the `check` walk ([ADR-67](../adr/67-parameter-type-inference.md) WD6). When `true`, an undeclared `def` / `initialize` / setter parameter is typed to the union of its resolved call-site argument types, sharpening downstream ivar reads, folds, and protection coverage. Precision-additive only — the negative rules never fire against an inferred parameter. Cannot be combined with `--incremental`. |
@@ -78,9 +78,39 @@ cache:
 | --- | --- | --- | --- |
 | `libraries` | Array | `[]` | Standard-library / gem names whose bundled RBS to load. |
 | `signature_paths` | Array | `nil` | Extra directories of `.rbs` files. Relative entries resolve against the config file's directory. |
+| `core_root` | String | `nil` | A directory of core `.rbs` files loaded **instead of** the `rbs` gem's own core, such as one [rbs-shifter](https://github.com/rigortype/rbs-shifter) generates for an older CRuby. A relative path resolves against the config file's directory. `nil` loads the gem's core. See [Analysing for an older Ruby](#analysing-for-an-older-ruby). |
 | `pre_eval` | Array | `[]` | Files (or globs) walked before per-file analysis, to register project monkey-patches and publish their top-level constants project-wide. The walker does not follow `require` / `require_relative`, so list the files in load order: a method declared in two files takes the last-listed one, and a file that requires a later-listed one is still read in list order. `type-of`, `type-scan`, `trace`, `annotate` and `sig-gen` read the patches too, so they type a patched method as `rigor check` does. |
 | `plugins` | Array | `[]` | Plugins to activate — see [Using plugins](07-plugins.md). |
 
+#### Analysing for an older Ruby
+
+Rigor runs on Ruby 4.0, and its bundled core signatures describe Ruby 4.0. A project that runs on an older
+Ruby can call a method that version does not have, and Rigor accepts the call. To check against the older
+API, point `core_root:` at a core signature directory written for it:
+
+```yaml
+target_ruby: "3.3"
+core_root: vendor/rbs-shifter/3.3/core
+```
+
+`core_root:` replaces the core, while `signature_paths:` only adds to it. A method that a signature directory
+omits stays declared by the default core, so `signature_paths:` cannot remove one. With the core above,
+`[1, 2].rfind { ... }` reports `call.undefined-method` and `" text ".strip(" ")` reports `call.wrong-arity`.
+Project signatures, plugins and `libraries:` still load on top of it. `target_ruby:` sets the syntax Rigor
+parses; it does not choose a core.
+
+A `core_root:` that does not exist, is not a directory, holds no `.rbs` file, lies inside (or contains) one of
+your `signature_paths:`, or does not build an RBS environment stops the run with exit code 64. A core class
+whose definition fails to build because of the core's own files is reported as an
+`rbs.coverage.definition-build-failed` error:
+
+```
+rigor: core_root: "/path/to/vendor/rbs-shifter/3.3/core" does not exist
+```
+
+The cache keys on the directory and on the contents of its files, so switching cores or regenerating one
+invalidates cached results, including in a running language server.
+
 ### Signature generation
 
 | Key | Type | Default | Meaning |
@@ -106,6 +136,7 @@ rigor: disable: "call.undefined-methdo" is not a recognized rule id; the suppres
 rigor: disable: "plugin_loader.load-error" names a run-level row, which `disable:` does not reach; use `severity_overrides:` or a baseline
 rigor: disable: "plugin.shoulda-matchers.unknown-column" names no plugin `plugins:` configures; the suppression has no effect
 rigor: severity_overrides: "flow.bogus" is not a recognized rule id; the override has no effect
+rigor: severity_overrides: "undefined-method" is a legacy alias of `call.undefined-method`; the override has no effect, so write `call.undefined-method`
 rigor: bundler.lockfile: "./missing/Gemfile.lock" does not exist
 ```
 
@@ -143,7 +174,10 @@ is left alone, other than the reserved run-level rows (`rbs.coverage.…`,
 those rows are the intended keys and are never flagged, while a bare plugin
 rule, `all`, or a `plugin.`-qualified key for an unconfigured plugin is. The same findings appear in the
 `--format=json` payload under `config_warnings` (each tagged with a
-`kind`), so CI can assert on them.
+`kind`), so CI can assert on them. The [language server](09-editor-integration.md)
+shows each one as a `window/showMessage` warning, and every
+[MCP tool](10-mcp-server.md#tool-reference) that takes a `config`
+argument includes them in its result.
 
 ### Diagnostics
 
@@ -193,7 +227,7 @@ project Ruby's gem home without running your toolchain. If `rigor check`'s
 `--stats` shows gems whose RBS it could not find, point it at the bundle
 explicitly with `bundler.bundle_path:`, or supply signatures another way:
 `rbs collection install` (auto-discovered) or `dependencies.source_inference:`.
-| `rbs_collection.auto_detect` | Boolean | `true` | Auto-discover `rbs_collection.lock.yaml`. |
+| `rbs_collection.auto_detect` | Boolean | `true` | Auto-discover `rbs_collection.lock.yaml`. An entry is not loaded for a gem your `Gemfile.lock` sources from a `path:` directory that is at or under one of your `paths:` entries, or contains one, and is not left out by `exclude:` (the gem is code Rigor analyses, which your `sig/` declares). |
 | `rbs_collection.lockfile` | String | `nil` | Explicit `rbs_collection.lock.yaml` path. |
 | `dependencies.source_inference` | Array | `[]` | Per-gem source-inference modes (ADR-10). |
 | `dependencies.budget_per_gem` | Integer | `5000` | Per-gem source-walk cap, counted in **method definitions** (not time): the walker stops harvesting a gem's catalog once it reaches this many `def`s, then emits `dynamic.dependency-source.budget-exceeded` and degrades the rest to `Dynamic[top]`. Range 1250–20000. |

data/docs/manual/04-diagnostics.md

@@ -67,7 +67,7 @@ carries no `documentation_url`.
 | <a id="rule-flow-return-in-ensure"></a>`flow.return-in-ensure` | An explicit `return` inside an `ensure` clause — it overrides the method's in-flight return value and silently swallows any in-flight exception. A `return` in a nested `def`, lambda, or `define_method` block inside the `ensure` does not fire (it exits that inner frame). | high |
 | <a id="rule-flow-shadowed-rescue-clause"></a>`flow.shadowed-rescue-clause` | A `rescue` clause can never run because an earlier clause of the same chain already catches a superclass (or the same class) of every exception class it names. | high |
 | <a id="rule-def-return-type-mismatch"></a>`def.return-type-mismatch` | The method body's result violates its declared RBS return type. | medium |
-| <a id="rule-def-ivar-write-mismatch"></a>`def.ivar-write-mismatch` | An instance variable is written with a type disagreeing with its first write, unless its RBS declaration (`@x: T` or an `attr_*` member) admits both writes. | high |
+| <a id="rule-def-ivar-write-mismatch"></a>`def.ivar-write-mismatch` | An instance variable is written with a type disagreeing with its first write, unless its RBS declaration (`@x: T` or an `attr_*` member) admits both writes. With `rigor-actionpack` or `rigor-actionmailer` loaded, writes in two different actions of a controller or mailer are not compared, since Rails runs one action per instance. A write in a private or protected helper, `initialize` or the same action still is, and so is one in a callback target or `helper_method` that a macro in the same file names. A public method named only by a macro in another file or a concern, or reached through a lambda callback, counts as an action, and so does an action another action calls. | high |
 | <a id="rule-def-method-visibility-mismatch"></a>`def.method-visibility-mismatch` | An explicit-receiver call reaches a private method. | high |
 | <a id="rule-def-override-visibility-reduced"></a>`def.override-visibility-reduced` | An override reduces the visibility it inherits from a project-defined ancestor. | high |
 | <a id="rule-def-override-return-widened"></a>`def.override-return-widened` | An override's declared return type widens the inherited return (covariance). | high |

data/docs/manual/06-baseline.md

@@ -77,7 +77,9 @@ a diagnostic another layer has already suppressed.
 | `rigor baseline drift` | Show how buckets have moved — `--only=over` for buckets that grew, `reducible` for ones you have already improved past, `cleared` for empty ones. |
 | `rigor baseline prune` | Drop buckets that match nothing any more. `--dry-run` previews. |
 
-`generate` and `regenerate` analyse with your loaded configuration unchanged except that `baseline:` is off, so options such as `bleeding_edge`, `target_ruby` or `severity_overrides` shape the recorded set exactly as they shape `rigor check`.
+`generate` and `regenerate` analyse with your loaded configuration unchanged except that `baseline:` is off, so options such as `bleeding_edge`, `target_ruby` or `severity_overrides` shape the recorded set exactly as they shape `rigor check`. They analyse the configured `paths:` only: a positional path argument is rejected with a usage error (exit `64`), since a baseline over a subset of files would silently drop the entries of every other file. The other three subcommands reject a positional path the same way.
+
+The summary counts only the diagnostics the written buckets cover. A diagnostic with no rule — a **parse error** in a file Rigor could not parse, a missing `paths:` entry, or an internal error — or no path cannot be keyed, so it never enters the baseline. The command prints a second line saying how many, why, and which files. The exit status stays 0, but the next `rigor check` with `baseline:` wired still reports them and exits non-zero until you fix those files, exclude them, or remove a bad `paths:` entry.
 
 `generate` and `regenerate` take `--match-mode=rule` (the
 default — one bucket per file × rule) or `--match-mode=message`
@@ -103,11 +105,11 @@ snapshot in the repository and compares against it explicitly:
 
 ```sh
 # Once: capture the current diagnostic surface.
-rigor check --format=json > rigor.baseline.json
-git add rigor.baseline.json
+rigor check --format=json > rigor-check.json
+git add rigor-check.json
 
 # Per PR: compare against the committed snapshot.
-rigor diff rigor.baseline.json
+rigor diff rigor-check.json
 ```
 
 [`rigor diff`](02-cli-reference.md#rigor-diff) prints a `+ NEW`

data/docs/manual/09-editor-integration.md

@@ -25,6 +25,7 @@ design + capability matrix lives in
 | `textDocument/documentSymbol` | Outline tree from Prism AST: `class` / `module` / `def` with nesting. |
 | `workspace/didChangeWatchedFiles` | Invalidates the per-session `Environment` + `Cache::Store` cache so saved files repropagate. |
 | `workspace/didChangeConfiguration` | Same — re-reads `.rigor.yml` / `Gemfile.lock` etc. |
+| `window/showMessage` | One warning per [configuration warning](03-configuration.md) — the lines `rigor check` prints on STDERR, such as a key that has no effect or a `disable:` token that names no rule. Sent on `initialized`, and again after a save only when re-reading `.rigor.yml` changed the set of warnings. |
 
 ## Prerequisites
 
@@ -51,8 +52,10 @@ rigor lsp [--transport=stdio] [--log=PATH] [--config=PATH]
 
 - `--transport=stdio` — default; only value accepted in v1. TCP /
   Unix-socket transports are queued.
-- `--log=PATH` — wire log + server debug to a file. Without it,
-  server-side logs go to stderr.
+- `--log=PATH` — append the wire log (each message in and out, one
+  line each) and the server's debug output from the start of the loop to
+  a file. Output before the loop starts still goes to stderr. Without
+  it, no wire log is written and server-side logs go to stderr.
 - `--config=PATH` — mirrors `rigor check --config=PATH`. Without
   it, `Configuration.discover` walks `.rigor.yml` / `.rigor.dist.yml`
   from the project root.
@@ -194,6 +197,14 @@ For a legacy bundler-based install, swap the connection list to
   there, the LSP should too. If `rigor check` fails, fix that
   first.
 
+**A rule still fires although `.rigor.yml` turns it off.**
+
+- Look for a `rigor:` warning the server showed when it started (or
+  after the save that changed `.rigor.yml`): a misspelt key such as
+  `undefined-method: "off"` at the top level, or a `disable:` token
+  that names no rule, has no effect, and the server says so once.
+  The same warnings appear on STDERR from `rigor check`.
+
 **Completion popup is empty.**
 
 - Completion only fires on a node with a known type. Receivers

data/docs/manual/10-mcp-server.md

@@ -66,7 +66,9 @@ rigor mcp [--transport=stdio] [--config=PATH]
   transport is queued for v2.
 - `--config=PATH` — session-level default config path. Individual tool
   calls may supply their own `config` argument, which takes precedence.
-  Without either, `Configuration.discover` walks `.rigor.yml` /
+  A path that names no file is an error, not a silent switch to the
+  defaults, for the session default and for a per-call `config` alike:
+  the call returns `isError: true`. Without either, `Configuration.discover` walks `.rigor.yml` /
   `.rigor.dist.yml` from the working directory.
 
 Exit codes: 0 (clean shutdown — stdin EOF), 64 (unknown
@@ -191,6 +193,28 @@ All messages except `notifications/*` require a response.
 
 ## Tool reference
 
+Every tool that takes a `config` argument reports the configuration's
+warnings — the ones `rigor check` prints on STDERR, such as a key that
+has no effect or a `disable:` token that names no rule. `rigor_check`
+carries them in its own document; every other such tool appends a
+second `text` content block holding one JSON object, after the tool's
+own output, which is left unchanged:
+
+```json
+{"config_warnings": [{"kind": "unknown_key", "message": "`undefined-method` is not a recognized configuration key; it has no effect.", "key": "undefined-method", "suggestion": null}]}
+```
+
+Each entry has the shape of `rigor check --format json`'s
+`config_warnings` entries. There is no such block when the
+configuration has no warnings, or when it fails to load (the tool
+reports that error itself).
+
+`rigor_type_of` and `rigor_explain` print JSON whose top-level shape changes
+in the next minor release (`{ "schema_version": 1, "results" | "rules" |
+"skip_reasons": [...] }`). Until then, a successful call carries a final
+`text` content block, after any `config_warnings` block, with the one-line
+notice the CLI prints on STDERR. The tool's own document is left unchanged.
+
 ### rigor_check
 
 Analyze one or more Ruby files or directories for type errors,
@@ -220,9 +244,16 @@ undefined methods, arity mismatches, and nil-receiver risks.
 }
 ```
 
+When `.rigor.yml` has [configuration warnings](03-configuration.md)
+(a key or a `disable:` token that has no effect), the document carries
+them under `config_warnings`, as `rigor check --format json` does.
+
 `isError` is `false` when the run completes normally, even if
-diagnostics were found. `isError: true` signals a configuration or
-runtime failure (bad path, unreadable config, etc.).
+diagnostics were found. `isError: true` signals a usage or runtime
+failure: an unreadable `config`, or a `rigor_coverage` call whose
+`paths` leave nothing to measure. A missing path given to `rigor_check`
+is not one of these: it is reported in the diagnostics, and the call
+returns `isError: false`.
 
 **Typical agent use:** call `rigor_check` on the files an agent is
 about to edit, record the baseline, apply the edit, call again, diff
@@ -417,6 +448,12 @@ The key is absent under the default `untyped` policy.
 Classifications: `new-file`, `new-method`, `tighter-return`,
 `equivalent`, `skipped`.
 
+A `paths` entry that is neither a directory nor a `.rb` file is reported
+under a top-level `diagnostics` array, in the shape `rigor_check` uses
+(`"message": "no such file or directory"`). It is a warning beside
+paths that were read, and an error when none was. An empty `candidates`
+list with no `diagnostics` means nothing was found to generate.
+
 **Typical agent use:** call `rigor_sig_gen` to see which methods have
 precise enough returns to be worth writing into `sig/`, then generate
 and insert the RBS. The agent should NOT write signatures
@@ -476,6 +513,13 @@ as `Constant` / `Nominal` / shaped / refined (precise) versus
 
 **Returns:** JSON — the same as `rigor coverage --format json`.
 
+A `paths` entry that is missing, or is not a Ruby file, is reported as
+`rigor coverage` reports it. Beside files that are measured it is skipped. The result
+then carries a second text block with the CLI's stderr, unfiltered: path
+warnings such as `missing.rb:1:1: warning: no such file or directory (skipped)`,
+and any other warnings. When no entry holds a Ruby file, the call is
+`isError: true` and the block says so.
+
 ```json
 {
   "summary": {

data/docs/manual/12-caching.md

@@ -185,7 +185,15 @@ exactly which files an edit can affect. A continuous-integration
 gate, `rigor check --verify-incremental`, asserts this on every
 build: it runs the incremental analyzer and a full analysis and
 fails if they disagree on a single diagnostic, or list the same
-diagnostics in a different order.
+diagnostics in a different order. That gate re-analyses an
+unchanged tree, so it cannot see an edit that fails to re-check a
+file it affects. `--verify-incremental-edits=N` also edits `N`
+files one at a time, in memory and not on disk, and compares each
+warm recheck with a full analysis of the edited tree. Each file is
+edited up to four times: once emptied, once reduced to its
+`class` / `module` declarations with every body dropped, and up
+to twice with one statement of a `class` / `module` body removed
+and the rest kept. It replays only removals, never an addition.
 
 Rigor is also precise about *what* an edit changed. Re-checking a
 file that many others depend on — a base class, a widely-used

data/docs/manual/plugins/rigor-actionmailer.md

@@ -77,6 +77,36 @@ plugins:
   `--fail-on=warning` run — regenerate with `rigor baseline
   regenerate`.
 
+## Instance variable writes across actions
+
+The plugin tells the engine that a mailer runs one action per instance
+([ADR-125](../../adr/125-per-invocation-classes.md)). Its manifest lists
+`ActionMailer::Base` in `per_invocation_classes:`, and the callback macros
+(`before_action` and the rest) and `helper_method` in
+`per_invocation_non_action_macros:`, so a method those name is not an action.
+
+So [`def.ivar-write-mismatch`](../04-diagnostics.md#rule-def-ivar-write-mismatch)
+stays silent when `welcome` assigns `@items = [1, 2]` and `digest` assigns
+`@items = { a: 1 }`. It still reports two divergent writes in the same action,
+and a divergence that involves a private or protected helper, `initialize`, or a
+callback target or `helper_method` that a macro in the same file names.
+
+The callback macros include `before_deliver`, `after_deliver` and
+`around_deliver`, which run on the action's own instance.
+
+Two shapes stay silent because their macros are not listed: a public
+method named by `rescue_from X, with: :handler` or by `layout :method_name`
+counts as an action, as does one a lambda callback
+(`before_action -> { load_roles }`) reaches ([#2320](https://github.com/rigortype/rigor/issues/2320) tracks the fix).
+
+Visibility is read in source order, as Rails builds `action_methods` from the
+public instance methods. A method that ends up protected or private is not an
+action: it follows a bare `protected` or `private`, is named by `private :x` or
+`protected :x`, or is defined inline (`private def x`). `public :x` or
+`public def x` makes it one again. So it is no longer checked for a view
+template, and calling it (`UserMailer.helper`) reports `unknown-action` at
+error severity, as Rails raises `NoMethodError` for it.
+
 ## Plugin internals
 
 The mailer/concern discoverer, the cached `:mailer_index` producer,

data/docs/manual/plugins/rigor-actionpack.md

@@ -41,6 +41,36 @@ no-op rather than erroring.
 | `plugin.actionpack.permit-call` | info | a `params.require(:m).permit(:key, …)` chain resolved to a known model; keys matched against its columns |
 | `plugin.actionpack.unknown-permit-key` | error | a literal `permit(:key)` is a near-miss (edit distance ≤ 2) of a real column but not one — a likely typo (with a did-you-mean). A key nothing like any column (a legitimate virtual attribute) does not fire |
 
+The plugin also tells the engine that a controller runs one action
+per instance ([ADR-125](../../adr/125-per-invocation-classes.md)).
+Its manifest lists `ActionController::Base` and
+`ActionController::API` in `per_invocation_classes:`. It also lists
+the callback macros (`before_action` and the rest) and
+`helper_method` in `per_invocation_non_action_macros:`, so a method
+those name is not an action.
+
+So `def.ivar-write-mismatch` stays silent when `index` assigns
+`@roles = Role.sorted.to_a` and `permissions` assigns
+`@roles = Role.sorted`. It still reports a divergence that involves
+a private or protected helper, `initialize`, or two writes in the
+same action. It also still reports one that involves a callback
+target or `helper_method`, when the macro naming it sits in the same
+file as the method. Actions defined in a concern module and
+`ActionController::Metal` controllers keep reporting too.
+
+Two shapes stay silent because their macros are not listed: a public
+method named by `rescue_from X, with: :handler` or by `layout :method_name`
+counts as an action, as does one a lambda callback
+(`before_action -> { load_roles }`) reaches ([#2320](https://github.com/rigortype/rigor/issues/2320) tracks the fix).
+
+These shapes stay silent:
+
+- a public method named only by a macro in another file or a
+  concern, such as `ApplicationController`;
+- a public method a lambda callback reaches
+  (`before_action -> { load_roles }`);
+- an action that calls another action.
+
 Filter and render resolution honours nested-module controller
 qualification (`module Admin; class WidgetsController` resolves
 views under `admin/widgets/…`) and silences gem-shipped parent
@@ -367,21 +397,29 @@ diff — not a policy scoped to `app/views/**/*`. See
   knows what `rigor-rails-routes` published, and `permit`
   validation only what `rigor-activerecord` published — enabling
   those producers widens what this plugin can check.
-- **`params[:key]` stays untyped.** Inside a controller, `params`
-  types as `ActionController::Parameters`, and so does the result
-  of every builder method that always returns one — `require`,
+- **`params[:key]` is a gradual carrier.** Inside a controller,
+  `params` types as `ActionController::Parameters`, and so does the
+  result of every builder method that always returns one — `require`,
   `permit`, `permit!`, `expect`, `slice`, `slice!`, `except`,
   `without`, `extract!`, `merge`, `merge!`, `reverse_merge`,
   `reverse_merge!`, `with_defaults`, `with_defaults!`, `compact`,
   `compact_blank`, `deep_dup` — so a chain built from them keeps a
-  concrete receiver throughout. A subscript read is deliberately
-  left untyped: `params[:missing]` is `nil` at runtime, and a type
-  that says otherwise would let the flow rules fold live
-  conditions (`if params[:q]`, `url.nil?`) to a constant and report
-  working code. Methods whose result depends on the call — `dig`,
-  `fetch`, `compact!`, and the block-less `select` / `reject` /
-  `transform_keys` / `transform_values` — are untyped for the same
-  reason.
+  concrete receiver throughout. A subscript read answers
+  `Dynamic[ActionController::Parameters | nil]` (#2430): the static
+  facet is the nilable `Parameters`, so `params[:user][:name]` and
+  `params[:user].permit(:name)` keep dispatching on that facet, and
+  the `Dynamic` wrapper lets the value cross a declared boundary such
+  as a `String` parameter, as a scalar param does at runtime. The
+  facet is nilable rather than the non-nil nominal on purpose:
+  `params[:missing]` is `nil` at runtime, and a non-nil type would
+  let the flow rules fold live conditions (`if params[:q]`,
+  `url.nil?`) to a constant and report working code. Methods on the
+  carrier outside the chain (`params[:q].to_s`) answer `Dynamic[top]`,
+  because the engine dispatches a `Dynamic` receiver without projecting
+  its facet: a loss of precision, not a false positive. Methods whose
+  result depends on the call — `dig`, `fetch`, `compact!`, and the
+  block-less `select` / `reject` / `transform_keys` /
+  `transform_values` — are untyped for the same reason.
 - **`flash[:key]` and `session[:key]` stay untyped too**, for that
   same reason and measured the same way. Both are leaf reads that
   return whatever was stored — or `nil` for a key that is not set.

data/docs/manual/plugins/rigor-activesupport-core-ext.md

@@ -32,6 +32,17 @@ path, no vendoring, no `signature_paths:` wiring.
 > surface. When it is loaded, the auto overlay stands down so the two
 > never double-declare.
 
+If the project also runs `rbs collection install` for `activesupport`,
+some methods are declared twice — `Object#acts_like?`,
+`Object#html_safe?`, `Time#to_fs` among them. Rigor merges the two:
+the plugin's signatures are tried first and the collection's still
+apply, so a call either one accepts type-checks. When your own `sig/`
+or inline RBS declares one of the plugin's methods, yours is used
+instead and the plugin's stands down; the run reports one
+`rbs.coverage.plugin-signature-stood-down` info row for the plugin's
+file, naming those methods and the file whose declaration is used for
+each.
+
 ## What it covers
 
 Roughly the top ~40 selectors plus their close neighbours, across:
@@ -55,7 +66,15 @@ Roughly the top ~40 selectors plus their close neighbours, across:
 - **Hash** — `#symbolize_keys` / `#stringify_keys` (+ deep / bang) and
   their `#to_options` alias, `#deep_merge`, `#reverse_merge` /
   `#with_defaults` (+ bang), `#with_indifferent_access`, `#except!`,
-  `#extract!`.
+  `#extract!`. `#symbolize_keys` / `#to_options` map the key type per
+  member, as ActiveSupport does (`key.to_sym rescue key`): a `String` or
+  `Symbol` key reads as `Symbol`, and every other key (an `Integer`, a
+  `Float`, a project class) reads as `untyped`, because a mixin or a
+  project file can give any class a `to_sym`. So
+  `Hash[String, Integer]` gives `Hash[Symbol, Integer]` and
+  `Hash[Integer, Integer]` gives `Hash[untyped, Integer]`. Without the
+  plugin, on the activesupport overlay alone, the key reads `untyped`.
+  The bang forms answer the receiver's own type.
 - **Range** — `#overlaps?`, `#to_fs` / `#to_formatted_s`.
 - **Enumerable** — `#index_by`, `#index_with`, `#pluck`, `#exclude?`.
 

data/docs/manual/plugins/rigor-devise.md

@@ -48,6 +48,21 @@ whatever class includes the concern.
 
 ## Limitations
 
+- **Needs RBS for the Devise modules.** The methods come from the
+  strategy modules' signatures (`Devise::Models::DatabaseAuthenticatable`
+  and the rest), which Rigor does not bundle and the `devise` gem does
+  not ship. Supply them through `signature_paths:` (or a
+  `rbs collection`); a strategy module with no signature contributes
+  nothing, and the model's `valid_password?` and friends stay as they
+  were. `plugins/rigor-devise/demo/sig/devise.rbs` is a minimal
+  example.
+- **Your own definitions win.** A method the model defines itself
+  (`def`, `alias_method`, `attr_*`, `define_method`, `delegate`), or
+  that a module of your project it includes or prepends defines, is
+  left to that definition rather than typed from the Devise module.
+  This holds even for a module included before the `devise` call,
+  which Devise's module would override at runtime. Only the module's
+  own public methods are contributed.
 - **Instance methods only.** Per-module `ClassMethods` (e.g.
   `User.reset_password_by_token`) are not yet synthesised.
 - **Controller helpers deferred.** `current_user` /

data/docs/manual/plugins/rigor-rspec.md

@@ -73,10 +73,11 @@ end
 | `eq(literal)` / `eql(literal)` | meet with `Constant<literal>` (see below) |
 | `be_a(T)` / `be_kind_of(T)` / `be_instance_of(T)` / `be_an_instance_of(T)` | meet with `T` |
 | `be_nil` | narrow to `Constant<nil>` |
-| `match(/regex/)` | narrow to `String` |
+| `match(/regex/)` | keep the `String` and `Symbol` members, read an `Object`, `BasicObject` or module member as `String \| Symbol`, and remove `nil`, `true`, `false` and numeric members (unless the project defines `match`, `to_str` or `==` on them); unchanged when a member may be anything else |
 | `not_to be_nil` / `to_not be_nil` | narrow away from `nil` |
 | `not_to be_a(T)` / `not_to be_kind_of(T)` / `not_to be_instance_of(T)` / `not_to be_an_instance_of(T)` | narrow away from `T` |
 | `not_to eq(literal)` / `not_to eql(literal)` (and `to_not`) | unchanged (see below) |
+| `not_to match(/regex/)` (and `to_not`) | unchanged: a `String` that does not match passes |
 
 Other matchers emit nothing. `be_truthy` is not narrowed, nor is
 `expect { ... }.to raise_error(...)` (the block form), nor an

data/lib/rigor/analysis/baseline.rb

@@ -97,6 +97,13 @@ module Rigor
           new(buckets, project_root: project_root)
         end
 
+        # The diagnostics a baseline cannot address: no rule (a Prism parse error, a path or internal error) or no path.
+        # `#filter` passes these through and `from_diagnostics` leaves them out of every bucket; this is the one
+        # definition of both.
+        def unkeyable(diagnostics)
+          diagnostics.reject { |d| d.qualified_rule && d.path }
+        end
+
         private
 
         def parse_loaded(raw, path:, project_root:)
@@ -138,17 +145,12 @@ module Rigor
           raise LoadError, "#{path}: ignored[#{index}] `message:` is not a valid Regexp: #{e.message}"
         end
 
-        # Returns Hash{[file, rule, regex_or_nil] => Array<Diagnostic>}.
-        # In message mode, each unique message gets its own bucket;
-        # in rule mode, every diagnostic for a (file, rule) pair
-        # contributes to a single bucket regardless of message.
-        # File paths are normalised to relative before keying.
+        # Groups diagnostics by [file, rule, regex_or_nil]. In message mode, each unique message gets its own
+        # bucket; in rule mode, every diagnostic for a (file, rule) pair contributes to a single bucket regardless
+        # of message. File paths are normalised to relative before keying.
         def group_for_baseline(diagnostics, match_mode, project_root)
           root = Pathname.new(project_root)
-          diagnostics.each_with_object({}) do |diag, into|
-            next if diag.qualified_rule.nil?
-            next if diag.path.nil?
-
+          (diagnostics - unkeyable(diagnostics)).each_with_object({}) do |diag, into|
             rel = relative_path(diag.path, root)
             key = case match_mode
                   when :rule
@@ -160,18 +162,18 @@ module Rigor
           end
         end
 
+        def relative_path(path, root_pathname)
+          Pathname.new(path).relative_path_from(root_pathname).to_s
+        rescue ArgumentError
+          path # different drive letter on Windows or non-child path
+        end
+
         # Generates a Regexp source string for the baseline row. The string is `Regexp.escape`d so the YAML
         # round-trip produces a regex that matches the literal message. Users hand-editing the row can replace
         # the escaped form with a pattern.
         def message_pattern_for(message)
           Regexp.new(Regexp.escape(message.to_s))
         end
-
-        def relative_path(path, root_pathname)
-          Pathname.new(path).relative_path_from(root_pathname).to_s
-        rescue ArgumentError
-          path # different drive letter on Windows or non-child path
-        end
       end
 
       class LoadError < StandardError; end
@@ -181,11 +183,8 @@ module Rigor
       def initialize(buckets, project_root: Dir.pwd)
         @project_root = Pathname.new(project_root)
         @buckets = buckets.freeze
-        # For each (file, qualified_rule) pair, two arrays:
-        # - rule-ID rows (message_regex == nil)
-        # - message-pattern rows (message_regex != nil)
-        # The matcher walks message-pattern rows first (tighter match takes precedence); diagnostics that
-        # don't match any message row fall through to the rule-ID row if one exists.
+        # Buckets grouped by (file, rule). `claim_bucket_for` splits each group into message-pattern rows, tried
+        # first as the tighter match, and the rule-ID row (message_regex == nil) as the fallback.
         @by_pair = buckets.group_by { |b| [b.file, b.rule] }.freeze
         freeze
       end
@@ -216,7 +215,7 @@ module Rigor
 
         # Diagnostics that lacked a rule or a path bypass the baseline entirely (the baseline can't address
         # them).
-        unkeyable = diagnostics.reject { |d| d.qualified_rule && d.path }
+        unkeyable = self.class.unkeyable(diagnostics)
         [surfaced + unkeyable, silenced_count]
       end
 
@@ -225,7 +224,7 @@ module Rigor
       # - `:within`    — `actual <= count` (silenced by the filter).
       # - `:over`      — `actual > count` (over threshold; surfaced in the regular `rigor check` output).
       # - `:cleared`   — `actual == 0` (the bucket can be pruned).
-      # - `:reducible` — `0 < actual < count` (the bucket's count can be tightened; future `regenerate` slice 5
+      # - `:reducible` — `0 < actual < count` (the bucket's count can be tightened; `rigor baseline regenerate`
       #                  handles this).
       DriftRow = Struct.new(:bucket, :actual_count, :status, keyword_init: true) do
         def delta
@@ -254,8 +253,8 @@ module Rigor
         end
       end
 
-      # Returns a new Baseline with the given buckets dropped. Used by `rigor baseline prune` (slice 2) to
-      # remove cleared buckets (`actual == 0`) from the on-disk file.
+      # Returns a new Baseline with the given buckets dropped. Used by `rigor baseline prune` to remove cleared
+      # buckets (`actual == 0`) from the on-disk file.
       def without(buckets_to_drop)
         dropset = buckets_to_drop.to_set
         self.class.new(buckets.reject { |b| dropset.include?(b) }, project_root: @project_root)
@@ -311,9 +310,7 @@ module Rigor
         # over rule-ID rows because they're more specific. A diagnostic that matches no row goes into a
         # synthetic "no-bucket" bin keyed by (file, rule).
         bins = {}
-        diagnostics.each do |diag|
-          next if diag.qualified_rule.nil? || diag.path.nil?
-
+        (diagnostics - self.class.unkeyable(diagnostics)).each do |diag|
           bucket = claim_bucket_for(diag)
           key = if bucket
                   [bucket.file, bucket.rule,

data/lib/rigor/analysis/buffer_binding.rb

@@ -24,6 +24,20 @@ module Rigor
       def display_path(path)
         path == physical_path ? logical_path : path
       end
+
+      # The file's identity for comparing two spellings of one path: its real path, resolved through its directory
+      # when the file is absent from disk (a new buffer's file), so a symlinked root or parent spells it as it spells
+      # an existing file. Two accepted limits: a missing name is compared as written, so a name that differs only in
+      # case is not matched; and a `..` in a missing path is resolved textually, not through the filesystem.
+      def self.real_path(path)
+        File.realpath(path)
+      rescue SystemCallError
+        absolute = File.absolute_path(path)
+        parent = File.dirname(absolute)
+        return absolute if parent == absolute
+
+        File.join(real_path(parent), File.basename(absolute))
+      end
     end
   end
 end

data/lib/rigor/analysis/check_rules/always_truthy_condition_collector.rb

@@ -23,10 +23,11 @@ module Rigor
       #   `BlockNode` ancestors. Mutation tracking through loop bodies is incomplete (`shift = 0; loop {
       #   shift += 7 }` keeps `shift` at `Constant<7>` per the analyzer), so a `Constant<bool>` predicate
       #   inside the loop body is suspect.
-      # - **Defensive predicate calls**: `.nil?` / `.empty?` / `.zero?` / `.any?` / `.none?` / `.all?`. These
-      #   read like the user explicitly checking for a runtime condition that the type system already proves
-      #   can't happen — Rigor's strict-on-returns RBS often disagrees with the user's defensive check (e.g.
-      #   `Module#name` returns `String` per RBS but anonymous classes really do return `nil`). Skipping
+      # - **Defensive predicate calls**: `.nil?` / `.empty?` / `.zero?` / `.any?` / `.none?` / `.all?` /
+      #   `.respond_to?`. These read like the user explicitly checking for a runtime condition that the type
+      #   system already proves can't happen — Rigor's strict-on-returns RBS often disagrees with the user's
+      #   defensive check (e.g. `Module#name` returns `String` per RBS but anonymous classes really do return
+      #   `nil`). Skipping
       #   these forms keeps the rule useful for genuine logic errors without faulting defensive code.
       #
       # Also skipped (so the literal-only `unreachable-branch` rule doesn't double-fire alongside this one):
@@ -53,8 +54,6 @@ module Rigor
         NODE_CLASSES = [Prism::IfNode, Prism::UnlessNode].freeze
         RULE_WALK_GATES = [:loop_or_block].freeze
 
-        # @return one entry per qualifying predicate. Empty when the tree carries no firing
-        #   predicates.
         def initialize(scope_index)
           @scope_index = scope_index
           @results = []

data/lib/rigor/analysis/check_rules/dead_assignment_collector.rb

@@ -35,8 +35,8 @@ module Rigor
         # exactly like the legacy walk.
         NODE_CLASSES = [Prism::DefNode].freeze
 
-        # Returns `Array<{def_class:, def_name:, write_node:}>` — one entry per dead-assignment write. Empty
-        # when the tree has no qualifying writes.
+        # One entry per dead-assignment write, as `{def_node:, write_node:}`. Empty when the tree has no
+        # qualifying writes.
         def initialize(scope_index)
           @scope_index = scope_index
           @results = []