rigortype 0.4.5 → 0.4.7

data/lib/rigor/analysis/check_rules/unreachable_clause_collector.rb

@@ -53,6 +53,24 @@ module Rigor
         # `else`-only.
         DEFENSIVE_EXIT_CALLS = %i[raise fail throw abort exit].freeze
 
+        # Issue #2071 — core classes whose idiomatic stand-ins are not their subclasses: a `StringIO` answers the
+        # IO protocol without being an `IO`, and a `Tempfile` delegates to a `File` without being one (or an `IO`).
+        # A subject Rigor types as one of these classes (`$stdout` by idiom, ADR-117) may hold such a stand-in,
+        # which no `when IO` / `in File` matches, so the `else` still runs for it.
+        DUCK_STAND_INS = {
+          "IO" => %w[StringIO Tempfile].freeze,
+          "File" => %w[Tempfile].freeze
+        }.freeze
+
+        # Each stand-in's ancestors as Ruby 4.0.5 has them (`StringIO.ancestors`, `Tempfile.ancestors` without the
+        # anonymous `DelegateClass` entries): a clause naming one matches the stand-in. Written out rather than read
+        # from RBS, which declares `class Tempfile < File`; a `Tempfile` is a `Delegator`, so neither `Object` nor
+        # `Kernel` matches it.
+        STAND_IN_ANCESTORS = {
+          "StringIO" => %w[StringIO Enumerable Object Kernel BasicObject].freeze,
+          "Tempfile" => %w[Tempfile Delegator BasicObject].freeze
+        }.freeze
+
         # @!attribute kind
         #   @return `:disjoint` (this clause's type is disjoint
         #     from the still-possible subject), `:prior_exhaustion` (an
@@ -137,9 +155,42 @@ module Rigor
             end
             coverage.record(clause)
           end
+          return if stand_in_reaches_else?(node, entry_type)
+
           collect_else(node.else_clause, subject.name, keyword)
         end
 
+        # Issue #2071 — whether the subject, as the `case` binds it, has a `Nominal` member of a {DUCK_STAND_INS}
+        # class with a stand-in no clause names an ancestor of ({STAND_IN_ANCESTORS}). `io = STDOUT; case io when IO
+        # then … else … end` runs the `else` for a `StringIO`, which the type `IO` stands for in idiomatic Ruby; a
+        # literal subject is a `Constant`, not a `Nominal`, and keeps its verdict. Asked of the `else` only: a dead
+        # `when` has its own evidence rules (#1429, #1485).
+        def stand_in_reaches_else?(node, entry_type)
+          members = entry_type.is_a?(Type::Union) ? entry_type.members : [entry_type]
+          stand_ins = members.flat_map do |member|
+            member.is_a?(Type::Nominal) ? DUCK_STAND_INS.fetch(member.class_name.delete_prefix("::"), []) : []
+          end
+          return false if stand_ins.empty?
+
+          named = clause_class_names(node)
+          stand_ins.any? { |stand_in| named.none? { |name| STAND_IN_ANCESTORS.fetch(stand_in).include?(name) } }
+        end
+
+        # The classes the clauses name as bare constants (`when A, B`, `in A`, `in A => x`).
+        def clause_class_names(node)
+          node.conditions.flat_map do |clause|
+            patterns = clause.is_a?(Prism::WhenNode) ? clause.conditions : [bare_pattern(clause.pattern)]
+            patterns.filter_map do |pattern|
+              entry = @scope_index[pattern]
+              entry && Inference::Narrowing.lexical_class_name(pattern, entry)
+            end
+          end
+        end
+
+        def bare_pattern(pattern)
+          pattern.is_a?(Prism::CapturePatternNode) ? pattern.value : pattern
+        end
+
         def entry_subject_type(case_node, subject_name)
           scope = @scope_index[case_node]
           scope&.local(subject_name)
@@ -229,8 +280,8 @@ module Rigor
 
         # The trailing `else` is dead when every subject value is covered by the `when` clauses — the final
         # falsey scope (recorded on the `else` node) narrows the subject to `bot`. Defensive `else` bodies (a
-        # bare `raise` / `fail` / `throw`) are deliberate guards, not removable dead code, so they are
-        # skipped.
+        # bare `raise` / `fail` / `throw` / `abort` / `exit`) are deliberate guards, not removable dead code, so
+        # they are skipped.
         def collect_else(else_clause, subject_name, keyword)
           return if else_clause.nil? || else_clause.statements.nil?
           return if defensive_else?(else_clause)

data/lib/rigor/analysis/check_rules/void_value_use_collector.rb

@@ -29,7 +29,7 @@ module Rigor
       class VoidValueUseCollector
         # The assignment forms whose `value` slot is a value position. `MultiWriteNode` (destructuring) is
         # intentionally excluded — its `value` is a container the void call would have to be spread through,
-        # not a direct use, so it is out of this slice's FP-narrow scope.
+        # not a direct use, so it is outside the FP-narrow scope.
         WRITE_NODE_CLASSES = [
           Prism::LocalVariableWriteNode, Prism::InstanceVariableWriteNode,
           Prism::ClassVariableWriteNode, Prism::GlobalVariableWriteNode,

data/lib/rigor/analysis/check_rules.rb

@@ -29,9 +29,11 @@ require_relative "check_rules/void_value_use_collector"
 require_relative "check_rules/self_closedness_scanner"
 require_relative "check_rules/source_arity"
 require_relative "check_rules/lexical_method_sites"
+require_relative "check_rules/rebinding_block_callees"
 require_relative "check_rules/rbs_receiver_surface"
 require_relative "check_rules/special_global_setters"
 require_relative "check_rules/ruby_deprecations"
+require_relative "../run_scoped_slots"
 
 module Rigor
   module Analysis
@@ -52,7 +54,7 @@ module Rigor
     #
     # - implicit-self calls (no `node.receiver`) — too noisy
     #   without per-method RBS for every helper in the class.
-    # - dynamic / unknown receivers (`Dynamic[T]`, `Top`, `Union`)
+    # - dynamic / unknown receivers (`Dynamic[T]`, `Top`)
     #   — by definition we cannot enumerate the method set.
     # - shape carriers: `Tuple` → "Array", `HashShape` → "Hash",
     #   `Constant` → the constant's class — `concrete_class_name`
@@ -85,9 +87,8 @@ module Rigor
 
       module_function
 
-      # Yields diagnostics for every unrecognised method call on
-      # a typed receiver in `root`'s subtree. The caller MUST
-      # have already produced `scope_index` through
+      # Returns the diagnostics for `root`'s subtree across the rule
+      # catalogue. The caller MUST have already produced `scope_index` through
       # `Rigor::Inference::ScopeIndexer.index(root, default_scope:)`.
       #
       # @param path — used to populate
@@ -450,11 +451,31 @@ module Rigor
           other_class = ivar_class_for(write[:type])
           next nil if other_class.nil? || other_class == "NilClass" || other_class == first_class
           next nil if declaration_admits?(write[:declared], canonical[:type], write[:type])
+          next nil if separate_invocations?(write, other_class, writes)
 
           build_ivar_write_mismatch_diagnostic(path, write[:node], class_name, ivar_name, first_class, other_class)
         end
       end
 
+      # ADR-125 — a divergent write is never live together with the writes it conflicts with when the class
+      # serves one entry point per instance (a plugin-declared per-invocation class, e.g. a Rails controller:
+      # one action per request) and every conflicting write — non-nil, of a concrete class other than this
+      # write's — sits in a DIFFERENT action of the same class. An action is a public method no declared
+      # non-action macro names (`before_action :x`, `helper_method :y`); {IvarWriteCollector} decides it. A
+      # conflicting write in a private or protected helper, a callback target, a `helper_method`,
+      # `initialize`, or the same method keeps the finding. Which helper each action reaches is not proved
+      # here.
+      def separate_invocations?(write, write_class, writes)
+        return false unless write[:action]
+
+        writes.all? do |other|
+          other_class = ivar_class_for(other[:type])
+          next true if other_class.nil? || other_class == "NilClass" || other_class == write_class
+
+          other[:action] && other[:method_name] != write[:method_name]
+        end
+      end
+
       def declaration_admits?(declared, *write_types)
         return false if declared.nil?
 
@@ -729,7 +750,7 @@ module Rigor
           # branch below because a plugin is consulted ONCE for the whole receiver, union included, so the
           # gate belongs where that one consult is rather than duplicated into each shape's path.
           #
-          # The union side of that placement IS reachable, contrary to what this comment used to say. The
+          # The union side of that placement is reachable. The
           # shape needs a non-nil union of at least two RBS-DECLARED classes — an undeclared arm is an
           # ADR-26 open receiver and `union_arm_blocks_undefined_fire?` bails before the method lookup,
           # which is why the earlier probes read silent and were misread as the gate being unreachable.
@@ -776,13 +797,6 @@ module Rigor
             return union_undefined_method_diagnostic(path, call_node, receiver_type, scope, lexical_sites)
           end
 
-          # ADR-26 — a plugin may declare a class "open": one
-          # known to respond beyond its RBS-declared method
-          # surface (e.g. `ActiveRecord::Relation`, which
-          # delegates an unbounded set of user-defined scopes to
-          # its model). Flagging an undefined method on a class
-          # with an open dynamic surface is unsound, so the rule
-          # skips it.
           # An unbounded receiver surface: either a plugin-declared
           # open receiver (ADR-26 — e.g. `ActiveRecord::Relation`), or
           # a type Rigor synthesized (a missing-namespace module / a
@@ -818,6 +832,7 @@ module Rigor
           return nil if method_def
 
           return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites)
+          return nil if open_project_singleton?(receiver_type, class_name, call_node, scope)
           return nil if subclass_instance_may_answer?(rendered_receiver, class_name, call_node.name, scope,
                                                       call_node.receiver)
 
@@ -969,7 +984,8 @@ module Rigor
         # ({RbsReceiverSurface}). Last for {#ancestry_declares_method?}'s reason: it walks the class graph.
         def rbs_ancestor_may_answer?(class_name, method_name, scope, kind)
           if kind == :singleton
-            RbsReceiverSurface.singleton_hook?(scope, class_name)
+            RbsReceiverSurface.singleton_hook?(scope, class_name) ||
+              RbsReceiverSurface.singleton_mixin_may_answer?(scope, class_name, method_name)
           else
             RbsReceiverSurface.ancestor_may_answer?(scope, class_name, method_name)
           end
@@ -1225,12 +1241,22 @@ module Rigor
           # body is morally a class body, so ADR-34 stays silent there — including on a genuinely
           # undefined name inside the block. Ranges are computed once per file.
           return nil if call_inside_receiver_eval_ranges?(eval_ranges, call_node)
-          # ADR-121 WD7 — a refinement of `Object` (or one Rigor cannot read) in effect here may define the name.
-          return nil if refined_method_in_effect?("Object", call_node, scope, :instance, lexical_sites)
+          return nil if lexically_declined_toplevel_call?(call_node, scope, lexical_sites, scope_index)
 
           build_unresolved_toplevel_diagnostic(path, call_node)
         end
 
+        # The `call.unresolved-toplevel` declines that read the file's syntax, asked last because they walk it.
+        def lexically_declined_toplevel_call?(call_node, scope, lexical_sites, scope_index = nil)
+          # ADR-121 WD7 — a refinement of `Object` (or one Rigor cannot read) in effect here may define the name.
+          return true if refined_method_in_effect?("Object", call_node, scope, :instance, lexical_sites)
+          return false if lexical_sites.nil?
+
+          # Issue #1817 — a block handed to a project method that may `module_eval` / `instance_exec` it runs under
+          # another `self`, so a call in it is not a top-level one ({RebindingBlockCallees}).
+          RebindingBlockCallees.inside_rebound_block?(call_node, scope, lexical_sites.block_calls, scope_index)
+        end
+
         # Issue #1383 — RBS core declares `main`'s private singleton methods on
         # `RBS::Unnamed::TopLevelSelfClass`, so the set follows RBS rather than a hand-kept
         # list. CRuby 4.0's `main` also has `ruby2_keywords`, which RBS does not declare.
@@ -1310,14 +1336,14 @@ module Rigor
         # (`METACLASS_ARMS`, "a `plugin_class : Class` really holds a `Plugin` subclass with `.manifest`");
         # the scalar rule enumerated `Module`'s own RBS instead and reported them.
         #
-        # Kept beside `unbounded_receiver_surface?` rather than folded into it: that predicate has eight
-        # other callers, and #742 had no evidence that any of them spoke on these receivers.
+        # Kept beside `unbounded_receiver_surface?` rather than folded into it: that predicate has other
+        # callers, and #742 had no evidence that any of them spoke on these receivers.
         #
         # Issue #879 supplied it for exactly one — `call.wrong-arity`, which decided `v.hexdigest(1, 2, 3)`
         # against `Digest::Instance`'s declaration on the same run where `v.no_such_method_zzz` was declined
         # as unenumerable. One receiver, one run, two answers about whether that surface can be read. The
         # reporter could make no other caller speak: `raise` on a module- or `Class`-typed operand is silent,
-        # and `Class`-typed `.new` with a wrong arity is silent too, so the other seven stay on
+        # and `Class`-typed `.new` with a wrong arity is silent too, so the other callers stay on
         # `unbounded_receiver_surface?` until something demonstrates otherwise.
         #
         # Arity takes {#unenumerable_receiver_shape?}, not this whole predicate: ADR-26's open receivers are
@@ -1419,14 +1445,16 @@ module Rigor
         end
 
         # ADR-67 WD6b — the argument-position analogue: true when `arg` is rooted at an inferred-parameter
-        # local. The argument-type-mismatch rule declines on it for the same lower-bound reason.
+        # local. The argument-type-mismatch rule declines on it for the same lower-bound reason. `scope` is the
+        # call's, and the receiver and any earlier argument run before `arg` and may rebind what a conditional's
+        # predicate in it reads (`m((c = false; 1), c ? param : "x")`), so a predicate there is never folded.
         def inferred_param_argument?(arg, scope)
-          inferred_param_rooted?(arg, scope)
+          inferred_param_rooted?(arg, scope, fold: false)
         end
 
         # ADR-67 WD6b — see {CheckRules::InferredParamGuard} for the shared root-walk contract.
-        def inferred_param_rooted?(node, scope)
-          InferredParamGuard.rooted?(node, scope)
+        def inferred_param_rooted?(node, scope, fold: true)
+          InferredParamGuard.rooted?(node, scope, fold: fold)
         end
 
         def constant_class_name(value)
@@ -1487,12 +1515,118 @@ module Rigor
         # overlay open receiver ({GEM_OVERLAY_OPEN_RECEIVERS}) whose
         # bundled directory this run actually loaded, a core-overlay
         # open receiver ({CORE_OVERLAY_OPEN_RECEIVERS}), or a
-        # Rigor-synthesized stub type (see `RbsLoader#synthesized_type_names`).
+        # Rigor-synthesized stub type (see `RbsLoader#synthesized_type_names`),
+        # or a project-only reopen of a Ruby library class whose own RBS
+        # did not load ({#ruby_library_reopen?}).
         def unbounded_receiver_surface?(class_name, scope)
           bare_name = class_name.to_s.sub(/\A::/, "")
           open_receiver?(class_name, scope) || synthesized_stub_receiver?(class_name, scope) ||
             CORE_OVERLAY_OPEN_RECEIVERS.include?(bare_name) ||
-            (GEM_OVERLAY_OPEN_RECEIVERS.include?(bare_name) && gem_overlay_loaded?(scope))
+            (GEM_OVERLAY_OPEN_RECEIVERS.include?(bare_name) && gem_overlay_loaded?(scope)) ||
+            ruby_library_reopen?(class_name, scope)
+        end
+
+        # Issue #2438 — a class-method call on a class the project's own signatures name but whose source leaves
+        # the singleton surface open. Before `rigor sig-gen --write` such a class was source-only and an
+        # unresolved call on it was silent; the sidecar must not turn the same call into a finding. Two shapes:
+        #
+        # - `C.instance` where `C`, or a project class up its superclass chain, `include`s the stdlib `Singleton`:
+        #   the answer is `SingletonMixinDispatch.answers?`, the predicate the typer itself uses, so the rule never
+        #   reports a call the engine typed. The class's other members are irrelevant: the mixin's hook defines
+        #   `instance`.
+        # - every project declaration of `C` is member-less (`RbsLoader#memberless_project_class?`) AND the source
+        #   leaves `C` open ({#open_source_class?}). A member-less declaration does not describe the class's
+        #   surface, but a class whose whole definition Rigor can see in `paths:` is still closed, so a typo on it
+        #   keeps firing. Instance-side calls keep being checked; declaring any member re-closes the class.
+        def open_project_singleton?(receiver_type, class_name, call_node, scope)
+          return false unless receiver_type.is_a?(Type::Singleton)
+          return true if Inference::MethodDispatcher::SingletonMixinDispatch.answers?(
+            scope, receiver_type, call_node.name, call_node.arguments.nil?
+          )
+
+          loader = scope.environment&.rbs_loader
+          return false if loader.nil? || !loader.respond_to?(:memberless_project_class?)
+
+          loader.memberless_project_class?(class_name) && open_source_class?(class_name, scope, loader)
+        end
+
+        OPENING_HOOKS = %i[inherited included extended prepended method_missing respond_to_missing?].freeze
+        private_constant :OPENING_HOOKS
+
+        CLOSED_ROOTS = Set["Object", "BasicObject"].freeze
+        private_constant :CLOSED_ROOTS
+
+        # Issue #2438 — whether a class's singleton surface may hold methods its source in `paths:` does not show,
+        # read off `Scope::ResolutionChain` (`:constants` flavor, so a project module that holds only constants is
+        # still a project entry). Open when the class, or a project class up its superclass chain:
+        #
+        # 1. `extend`s a module (any singleton-side entry beyond the classes' own singletons), or records an
+        #    `inherited` / `included` / `extended` / `prepended` hook or `method_missing` / `respond_to_missing?`.
+        #    A plain `include` or `prepend` adds instance methods only, so it leaves the singleton side closed;
+        # 2. has no `class` / `module` body of its own inside `paths:` (`class Ext::Foo` names `Ext` without one);
+        # 3. or the chain reaches a class the project does not define, other than `Object` / `BasicObject`: an
+        #    external superclass (`ApplicationRecord < ActiveRecord::Base`, `MyError < StandardError`), a
+        #    superclass written as an expression, or — where the source writes no superclass for the last class —
+        #    the superclass its member-less declaration writes, unless that is a project class.
+        #
+        # A definition or reopening in a file outside `paths:` cannot be seen, so a class whose body is inside
+        # `paths:` and whose methods live only outside it counts as closed.
+        def open_source_class?(class_name, scope, loader)
+          name = class_name.to_s.delete_prefix("::")
+          instance = Scope::ResolutionChain.for(scope, name, :instance, :constants)
+          singleton = Scope::ResolutionChain.for(scope, name, :singleton, :constants)
+          [instance, singleton].each { |chain| chain.record(scope) }
+          classes = instance.level_classes.compact
+          return true if classes.empty? || instance.truncated?
+
+          sources = scope.discovered_class_sources
+          return true if classes.any? { |klass| (sources[klass] || []).empty? || opening_hook?(klass, scope) }
+          return true if opening_entry?(instance, classes, mixins: false) ||
+                         opening_entry?(singleton, classes, mixins: true)
+
+          open_tail?(instance, classes.last, scope, loader)
+        end
+
+        # An external superclass other than `Object` / `BasicObject` opens either side; a module entry opens the
+        # chain only where `mixins` is set (the singleton side, where it is an `extend`).
+        def opening_entry?(chain, classes, mixins:)
+          chain.entries.any? do |entry|
+            if entry.external? && entry.superclass_edge
+              !CLOSED_ROOTS.include?(entry.raw.to_s.delete_prefix("::"))
+            else
+              mixins && !classes.include?(entry.name)
+            end
+          end
+        end
+
+        def opening_hook?(klass, scope)
+          OPENING_HOOKS.any? do |hook|
+            scope.discovered_method?(klass, hook, :singleton) || scope.discovered_method?(klass, hook, :instance)
+          end
+        end
+
+        # The last class's own superclass, which the chain does not name: an expression the tables cannot resolve,
+        # or one only the member-less declaration writes (the chain ends at the implicit `Object` exactly when
+        # the source writes none).
+        def open_tail?(chain, last, scope, loader)
+          return true if chain.opaque_tail?(scope)
+
+          raw = loader.memberless_project_superclass(last)
+          return false if raw.nil? || CLOSED_ROOTS.include?(raw.delete_prefix("::"))
+
+          !scope.discovered_classes.key?(raw.delete_prefix("::"))
+        end
+
+        # Issue #2174 — `class Matrix` reopened with one `#:`-annotated method, and no `matrix` signatures
+        # loaded, gives Matrix a declaration holding only that method ({RbsLoader#ruby_library_reopen?}).
+        # `Matrix.identity(2)` is correct Ruby, so the class's surface is treated as open: `call.undefined-method`
+        # declines on it, and a signature it only inherits (`Object#initialize` for `Matrix.new(rows)`) stops
+        # deciding arity and argument types. Methods the project's own declaration lists stay checked.
+        def ruby_library_reopen?(class_name, scope)
+          loader = scope.environment&.rbs_loader
+          return false if loader.nil? || !loader.respond_to?(:ruby_library_reopen?)
+
+          loader.ruby_library_reopen?(class_name)
         end
 
         def open_receiver?(class_name, scope)
@@ -1798,16 +1932,15 @@ module Rigor
         # Slice 7 phase 11 — wrong-arity diagnostic. Fires when
         # an explicit-receiver `Prism::CallNode` resolves to a
         # method whose declared overloads do not admit the
-        # supplied positional argument count. The rule applies
-        # ONLY to the simplest overload shape (single overload,
-        # no `rest_positionals`, no keyword parameters, no
-        # block-required positionals); calls with `*splat`
-        # arguments, keyword arguments, or block-pass arguments
-        # are silently skipped to avoid false positives. The
-        # check piggybacks on the same scope-index lookup used
-        # by `undefined_method_diagnostic`; it returns nil
-        # when the call's receiver / RBS coverage / call shape
-        # disqualifies the rule.
+        # supplied positional argument count (across all
+        # overloads, see {#compute_arity_envelope}). One overload
+        # with required keyword arguments or trailing positionals
+        # leaves the whole method unchecked; calls with `*splat`, keyword, or
+        # block-pass arguments are silently skipped to avoid
+        # false positives. The check piggybacks on the same
+        # scope-index lookup used by `undefined_method_diagnostic`;
+        # it returns nil when the call's receiver / RBS coverage /
+        # call shape disqualifies the rule.
         # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         def wrong_arity_diagnostic(path, call_node, scope_index, lexical_sites = nil)
           return nil if call_node.receiver.nil?
@@ -2780,9 +2913,37 @@ module Rigor
 
         # Whether any project or `pre_eval:` file aliases `name`, on either side, which can make it another variable.
         def global_aliased?(scope, name)
+          record_global_census(Inference::GlobalWriteCensus.alias_entry(name))
           Inference::GlobalWriteCensus.aliased?(global_write_census(scope), name)
         end
 
+        # Issue #2158 — a read of the whole-program census records the `global_census:` key of each entry it asks
+        # about ({Inference::GlobalWriteCensus.dependency_key}): a file that starts or stops writing the entry (a `def
+        # write`, an `alias $stdout $x`, a computed `define_method`) re-checks the write. A `pre_eval:` file moves the
+        # snapshot's own fingerprint.
+        def record_global_census(*entries)
+          return unless DependencyRecorder.active?
+
+          entries.each do |entry|
+            DependencyRecorder.read_name(:global_census, Inference::GlobalWriteCensus.dependency_key(entry))
+          end
+        end
+
+        # Whether the census holds any of `entries`, recording only what can flip the answer: the entries present
+        # when it holds one (the answer stays true until every one of them vanishes, and another appearing changes
+        # nothing), every entry when it holds none.
+        #
+        # This rests on an invariant: every census entry can only move a write toward being silenced, and a reported
+        # write is always re-checked through `IncrementalSession#global_write_reporters`, so recording only the
+        # present entries on a yes is sound. A future census entry that makes a write reported would break it, and
+        # its reader would have to record every entry. Recording every entry on a no is defence in depth, since the
+        # write that answer leaves reported re-checks through `global_write_reporters` anyway.
+        def census_holds_any?(census, entries)
+          present = entries.select { |entry| census.include?(entry) }
+          record_global_census(*(present.empty? ? entries : present))
+          !present.empty?
+        end
+
         # A literal is rejected when its class is none the setter takes and, for a setter that also converts
         # (`to_str`, `to_int`) or asks for `write`, the literal's object cannot answer that method.
         def literal_rejected?(class_name, contract, node, scope, lexical_sites)
@@ -2830,11 +2991,15 @@ module Rigor
         end
 
         def program_may_answer?(ancestors, names, census, scope)
-          return true if Inference::GlobalWriteCensus.defines_any_of?(census, names)
+          defines = [Inference::GlobalWriteCensus::DEFINES_ANY, *names.map { |name| [:defines, name] }]
+          return true if census_holds_any?(census, defines)
 
           dynamic_mark = Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK
           return true if ancestors.any? { |owner| scope.parameter_envelopes_of(owner).key?(dynamic_mark) }
 
+          # One key for every top-level mixin, a deliberate trade-off: the reader asks about each, so a mixin
+          # appearing or vanishing anywhere re-checks every write that reached this step.
+          record_global_census(%i[main_mixin *])
           main_mixins = Inference::GlobalWriteCensus.main_mixins(census)
           main_mixins.any? { |mixin| rbs_mixin_may_answer?(mixin, names, scope) } ||
             mixin_may_answer?(ancestors, names, scope)
@@ -2876,7 +3041,7 @@ module Rigor
         # active refinement on Ruby 4.0.5; a refined `respond_to_missing?` or `respond_to?`, and every implicit
         # conversion, do not, so a refinement that adds only those leaves the write reported.
         def refined_writer_in_effect?(census, node, scope, lexical_sites)
-          Inference::GlobalWriteCensus.refines_write?(census) &&
+          census_holds_any?(census, [Inference::GlobalWriteCensus::REFINES_ANY, %i[refines write]]) &&
             (lexical_sites.nil? || !scope.declared_refinements.empty? ||
               lexical_sites.refinements.any_at?(node.location.start_offset))
         end
@@ -2911,8 +3076,7 @@ module Rigor
         # - Elsif chains (`subsequent` is itself an `IfNode`) ARE flagged — the entire downstream chain is
         #   unreachable when the outer predicate is a constant literal.
         #
-        # Broadening to inferred-constant predicates is queued for a later v0.1.x release once the loop /
-        # mutation gaps named above are closed.
+        # Inferred-constant predicates are the `flow.always-truthy-condition` rule's ({AlwaysTruthyConditionCollector}).
         def unreachable_branch_diagnostic(path, node, scope_index)
           scope = scope_index[node]
           return nil if scope.nil?
@@ -3023,7 +3187,7 @@ module Rigor
           build_visibility_mismatch_diagnostic(path, call_node, "singleton(#{class_name})")
         end
 
-        PRIVATE_NAMES_MEMO = :rigor_check_rules_private_singleton_names
+        PRIVATE_NAMES_MEMO = RunScopedSlots.register(:rigor_check_rules_private_singleton_names)
         private_constant :PRIVATE_NAMES_MEMO
 
         # Issue #1984 — the table-only gate the singleton side asks before it reads a chain, as the instance side asks
@@ -3032,6 +3196,7 @@ module Rigor
         # `Widget.new` would read, and file the dependency edges of, the whole singleton chain. The set is memoised per
         # discovery index.
         def private_singleton_candidate?(scope, name)
+          DependencyRecorder.read_visibility("*", name) if DependencyRecorder.active?
           discovery = scope.discovery
           slot = Thread.current[PRIVATE_NAMES_MEMO]
           unless slot && slot[0].equal?(discovery)
@@ -3058,7 +3223,8 @@ module Rigor
           return true if rows.nil?
 
           offset = call_node.location.start_offset
-          rows.none? { |(start, finish, name, _kind, _owner)| !name.nil? && start <= offset && offset < finish }
+          # A row with no side (a `def` in a block, a `define_method` name) is a block's range or no range at all.
+          rows.none? { |(start, finish, _name, kind, _owner)| !kind.nil? && start <= offset && offset < finish }
         end
 
         SINGLETON_WILDCARD_SLOT = %i[singleton *].freeze
@@ -3070,6 +3236,7 @@ module Rigor
           discovery = scope.discovery
           chain = Scope::ResolutionChain.for(scope, class_name.to_s, :singleton, :methods)
           chain.entries.any? do |entry|
+            DependencyRecorder.read_visibility(entry.name, SINGLETON_WILDCARD_SLOT.last) unless entry.external?
             !entry.external? && discovery.contested?(:discovered_method_visibilities,
                                                      [entry.name, SINGLETON_WILDCARD_SLOT])
           end
@@ -3299,12 +3466,9 @@ module Rigor
         # - Receiver must be Nominal / Singleton / Constant
         #   (the same `concrete_class_name` test).
         # - Method must be in RBS.
-        # - Method must have exactly ONE method type
-        #   (overload). Multi-overload checking is left for
-        #   a follow-up because picking the "intended"
-        #   overload requires the dispatcher's full
-        #   acceptance plumbing.
-        # - The selected overload must have NO
+        # - Overloads: a single method type is checked exactly; with several, an argument is a mismatch only
+        #   when every overload rejects it ({#multi_overload_argument_mismatch}).
+        # - The overload checked must have NO
         #   rest_positionals and NO trailing positionals —
         #   the two shapes under which argument N no longer
         #   binds to positional parameter N. Keyword
@@ -4014,16 +4178,14 @@ module Rigor
         #   OWN declared return, and the sibling override rules gate on `defined_on?` — this one did not.
         #   The inherited-declaration signal belongs to the ADR-35 family, which requires both sides
         #   authored. Decided in ADR-110 WD3.
-        # - Skips methods whose enclosing class isn't a `Type::Singleton` self_type that we can name
-        #   (top-level / module-level methods land outside the rule).
+        # - Skips methods whose enclosing `self` names no class (top-level methods land outside the rule).
         # - Skips methods whose body's last expression is absent or types as `Dynamic[top]` (the
         #   analyzer's fail-soft fallback) — emitting on `Dynamic[top]` would be noise.
         # - Compares the inferred body type against the declared return via `accepts?`:
         #     :yes   → silent
         #     :no    → emit at :error (severity_profile may re-stamp; default `balanced` keeps the
         #              authored severity).
-        #     :maybe → emit at :warning. Promoted to :error under `severity_profile: strict` per ADR-8 §
-        #              "Severity profile".
+        #     :maybe → silent (see {#compare_return}; ADR-8's `strict` promotion is deferred).
         def return_type_mismatch_diagnostic(path, def_node, scope_index)
           return nil if def_node.body.nil?
 
@@ -4159,9 +4321,9 @@ module Rigor
         # precision improvements.
         def compare_return(declared, inferred)
           result = declared.accepts(inferred)
-          return :error if result.no?
+          return nil unless result.no?
 
-          nil
+          :error
         end
 
         def build_return_type_mismatch_diagnostic(path, def_node, declared, inferred, severity)
@@ -4202,6 +4364,9 @@ module Rigor
 
           override_visibility = scope.discovered_method_visibility(class_name, method_name)
           return nil if override_visibility.nil?
+          # Issue #2013 — a contested slot (a later `define_method` or alias gave the name another visibility, or a
+          # write the walk cannot place) proves no reduction.
+          return nil if scope.discovery.contested?(:discovered_method_visibilities, [class_name, method_name])
 
           parent = nearest_ancestor_visibility(scope, class_name, method_name)
           return nil if parent.nil?

data/lib/rigor/analysis/crash_signature.rb

@@ -149,8 +149,8 @@ module Rigor
 
       # True when `diagnostic` reports a failure inside Rigor that left the run readable but invalid as a
       # measurement of Rigor — see {ANALYZER_DEFECT_RULES}. Orthogonal to {.discards_file_analysis?}: the
-      # user-facing tier reads the run; the Rigor-measuring tier should refuse it (the mutation fuzz does,
-      # the ADR-69 kill oracle does not yet — #790).
+      # user-facing tier reads the run; the Rigor-measuring tier should refuse it (the mutation fuzz and the
+      # ADR-69 kill oracle both do, #790).
       def analyzer_defect?(diagnostic)
         ANALYZER_DEFECT_RULES.include?(diagnostic.rule)
       end

data/lib/rigor/analysis/dependency_recorder.rb

@@ -74,8 +74,8 @@ module Rigor
           @sources = Set.new
           @missing = Set.new
           # ADR-46 slice 4 — symbol-granularity tracking.
-          # `symbol_sources`: source_path → Set<"ClassName#method"> for method-call deps.
-          # `ancestry_sources`: Set<source_path> for class-ancestry (superclass / include) deps —
+          # `symbol_sources`: source_path → the "ClassName#method" names read from it, for method-call deps.
+          # `ancestry_sources`: the source paths read for class-ancestry (superclass / include) deps —
           # file-granularity by nature (a superclass edge touches the whole class).
           @symbol_sources = Hash.new { |h, k| h[k] = Set.new }
           @ancestry_sources = Set.new
@@ -103,8 +103,8 @@ module Rigor
       end
 
       # Frozen record of one file's cross-file reads.
-      # `symbol_sources`: source_path → frozen Set<"ClassName#method"> (method-call edges).
-      # `ancestry_sources`: frozen Set<source_path> (class-ancestry edges, file-granularity).
+      # `symbol_sources`: source_path → frozen set of "ClassName#method" names (method-call edges).
+      # `ancestry_sources`: frozen set of source paths (class-ancestry edges, file-granularity).
       Record = Data.define(:consumer, :sources, :missing, :symbol_sources, :ancestry_sources)
 
       # ADR-84 WD2 — a replayable, consumer-independent read-set: `reads` is a frozen Set of frozen
@@ -406,6 +406,17 @@ module Rigor
         end
       end
 
+      # Issue #2134 — {read_name} for a read of `class_name`'s visibility slots for `method_name`, on either side, or
+      # of their contest: `visibility:<class>#<method>`. `IncrementalSession#visibility_name_affected` fires the key
+      # when a file's visibility entry or contest for the slot moves. A reader that asks whether ANY class records
+      # the name private passes `"*"` as the class; the key fires when any entry of the name moves. A wildcard
+      # slot (`[:singleton, :*]`) is `*` as the method name.
+      def read_visibility(class_name, method_name)
+        return if Thread.current[KEY].nil?
+
+        read_name(:visibility, "#{class_name}##{method_name}")
+      end
+
       # The miss-only spelling of {read_name}: a cross-file lookup of `name` (kind `:method` / `:class` /
       # `:toplevel` / …) that resolved to nothing. Kept as the name the internal spec's negative-edge
       # contract uses.

data/lib/rigor/analysis/dependency_source_inference/boundary_cross_reporter.rb

@@ -25,9 +25,9 @@ module Rigor
           @mutex = Mutex.new
         end
 
-        # @return frozen snapshot of the recorded boundary-cross events. Each entry is a Data
-        #   with `class_name` (String), `method_name` (Symbol), `gem_name` (String), and `rbs_display` (String
-        #   — the authoritative-side type's human-facing form, embedded into the diagnostic message).
+        # @return frozen snapshot of the recorded boundary-cross events. Each entry is a Data with `class_name`,
+        #   `method_name`, `gem_name`, and `rbs_display` (the authoritative-side type's human-facing form, embedded
+        #   into the diagnostic message).
         def entries
           @mutex.synchronize { @entries.dup.freeze }
         end
@@ -50,6 +50,17 @@ module Rigor
           end
         end
 
+        # The pool drain ({Rigor::Analysis::WorkerSession#drain_reporters}): the frozen entries.
+        def snapshot
+          entries
+        end
+
+        # Replays one worker's {#snapshot}; the record-time dedup collapses every worker's copy. Nil records
+        # nothing.
+        def absorb(snapshot)
+          Array(snapshot).each { |entry| record(**entry.to_h) }
+        end
+
         private
 
         def same_key?(existing, entry)