rigortype 0.4.6 → 0.4.7

data/docs/manual/06-baseline.md

@@ -77,7 +77,9 @@ a diagnostic another layer has already suppressed.
 | `rigor baseline drift` | Show how buckets have moved — `--only=over` for buckets that grew, `reducible` for ones you have already improved past, `cleared` for empty ones. |
 | `rigor baseline prune` | Drop buckets that match nothing any more. `--dry-run` previews. |
 
-`generate` and `regenerate` analyse with your loaded configuration unchanged except that `baseline:` is off, so options such as `bleeding_edge`, `target_ruby` or `severity_overrides` shape the recorded set exactly as they shape `rigor check`.
+`generate` and `regenerate` analyse with your loaded configuration unchanged except that `baseline:` is off, so options such as `bleeding_edge`, `target_ruby` or `severity_overrides` shape the recorded set exactly as they shape `rigor check`. They analyse the configured `paths:` only: a positional path argument is rejected with a usage error (exit `64`), since a baseline over a subset of files would silently drop the entries of every other file. The other three subcommands reject a positional path the same way.
+
+The summary counts only the diagnostics the written buckets cover. A diagnostic with no rule — a **parse error** in a file Rigor could not parse, a missing `paths:` entry, or an internal error — or no path cannot be keyed, so it never enters the baseline. The command prints a second line saying how many, why, and which files. The exit status stays 0, but the next `rigor check` with `baseline:` wired still reports them and exits non-zero until you fix those files, exclude them, or remove a bad `paths:` entry.
 
 `generate` and `regenerate` take `--match-mode=rule` (the
 default — one bucket per file × rule) or `--match-mode=message`
@@ -103,11 +105,11 @@ snapshot in the repository and compares against it explicitly:
 
 ```sh
 # Once: capture the current diagnostic surface.
-rigor check --format=json > rigor.baseline.json
-git add rigor.baseline.json
+rigor check --format=json > rigor-check.json
+git add rigor-check.json
 
 # Per PR: compare against the committed snapshot.
-rigor diff rigor.baseline.json
+rigor diff rigor-check.json
 ```
 
 [`rigor diff`](02-cli-reference.md#rigor-diff) prints a `+ NEW`

data/docs/manual/09-editor-integration.md

@@ -25,6 +25,7 @@ design + capability matrix lives in
 | `textDocument/documentSymbol` | Outline tree from Prism AST: `class` / `module` / `def` with nesting. |
 | `workspace/didChangeWatchedFiles` | Invalidates the per-session `Environment` + `Cache::Store` cache so saved files repropagate. |
 | `workspace/didChangeConfiguration` | Same — re-reads `.rigor.yml` / `Gemfile.lock` etc. |
+| `window/showMessage` | One warning per [configuration warning](03-configuration.md) — the lines `rigor check` prints on STDERR, such as a key that has no effect or a `disable:` token that names no rule. Sent on `initialized`, and again after a save only when re-reading `.rigor.yml` changed the set of warnings. |
 
 ## Prerequisites
 
@@ -51,8 +52,10 @@ rigor lsp [--transport=stdio] [--log=PATH] [--config=PATH]
 
 - `--transport=stdio` — default; only value accepted in v1. TCP /
   Unix-socket transports are queued.
-- `--log=PATH` — wire log + server debug to a file. Without it,
-  server-side logs go to stderr.
+- `--log=PATH` — append the wire log (each message in and out, one
+  line each) and the server's debug output from the start of the loop to
+  a file. Output before the loop starts still goes to stderr. Without
+  it, no wire log is written and server-side logs go to stderr.
 - `--config=PATH` — mirrors `rigor check --config=PATH`. Without
   it, `Configuration.discover` walks `.rigor.yml` / `.rigor.dist.yml`
   from the project root.
@@ -194,6 +197,14 @@ For a legacy bundler-based install, swap the connection list to
   there, the LSP should too. If `rigor check` fails, fix that
   first.
 
+**A rule still fires although `.rigor.yml` turns it off.**
+
+- Look for a `rigor:` warning the server showed when it started (or
+  after the save that changed `.rigor.yml`): a misspelt key such as
+  `undefined-method: "off"` at the top level, or a `disable:` token
+  that names no rule, has no effect, and the server says so once.
+  The same warnings appear on STDERR from `rigor check`.
+
 **Completion popup is empty.**
 
 - Completion only fires on a node with a known type. Receivers

data/docs/manual/10-mcp-server.md

@@ -193,6 +193,28 @@ All messages except `notifications/*` require a response.
 
 ## Tool reference
 
+Every tool that takes a `config` argument reports the configuration's
+warnings — the ones `rigor check` prints on STDERR, such as a key that
+has no effect or a `disable:` token that names no rule. `rigor_check`
+carries them in its own document; every other such tool appends a
+second `text` content block holding one JSON object, after the tool's
+own output, which is left unchanged:
+
+```json
+{"config_warnings": [{"kind": "unknown_key", "message": "`undefined-method` is not a recognized configuration key; it has no effect.", "key": "undefined-method", "suggestion": null}]}
+```
+
+Each entry has the shape of `rigor check --format json`'s
+`config_warnings` entries. There is no such block when the
+configuration has no warnings, or when it fails to load (the tool
+reports that error itself).
+
+`rigor_type_of` and `rigor_explain` print JSON whose top-level shape changes
+in the next minor release (`{ "schema_version": 1, "results" | "rules" |
+"skip_reasons": [...] }`). Until then, a successful call carries a final
+`text` content block, after any `config_warnings` block, with the one-line
+notice the CLI prints on STDERR. The tool's own document is left unchanged.
+
 ### rigor_check
 
 Analyze one or more Ruby files or directories for type errors,
@@ -222,9 +244,16 @@ undefined methods, arity mismatches, and nil-receiver risks.
 }
 ```
 
+When `.rigor.yml` has [configuration warnings](03-configuration.md)
+(a key or a `disable:` token that has no effect), the document carries
+them under `config_warnings`, as `rigor check --format json` does.
+
 `isError` is `false` when the run completes normally, even if
-diagnostics were found. `isError: true` signals a configuration or
-runtime failure (bad path, unreadable config, etc.).
+diagnostics were found. `isError: true` signals a usage or runtime
+failure: an unreadable `config`, or a `rigor_coverage` call whose
+`paths` leave nothing to measure. A missing path given to `rigor_check`
+is not one of these: it is reported in the diagnostics, and the call
+returns `isError: false`.
 
 **Typical agent use:** call `rigor_check` on the files an agent is
 about to edit, record the baseline, apply the edit, call again, diff
@@ -484,6 +513,13 @@ as `Constant` / `Nominal` / shaped / refined (precise) versus
 
 **Returns:** JSON — the same as `rigor coverage --format json`.
 
+A `paths` entry that is missing, or is not a Ruby file, is reported as
+`rigor coverage` reports it. Beside files that are measured it is skipped. The result
+then carries a second text block with the CLI's stderr, unfiltered: path
+warnings such as `missing.rb:1:1: warning: no such file or directory (skipped)`,
+and any other warnings. When no entry holds a Ruby file, the call is
+`isError: true` and the block says so.
+
 ```json
 {
   "summary": {

data/docs/manual/12-caching.md

@@ -190,9 +190,10 @@ unchanged tree, so it cannot see an edit that fails to re-check a
 file it affects. `--verify-incremental-edits=N` also edits `N`
 files one at a time, in memory and not on disk, and compares each
 warm recheck with a full analysis of the edited tree. Each file is
-edited twice: once emptied, and once reduced to its `class` /
-`module` declarations with every body dropped. It replays only
-those two removals, never an addition or any other edit.
+edited up to four times: once emptied, once reduced to its
+`class` / `module` declarations with every body dropped, and up
+to twice with one statement of a `class` / `module` body removed
+and the rest kept. It replays only removals, never an addition.
 
 Rigor is also precise about *what* an edit changed. Re-checking a
 file that many others depend on — a base class, a widely-used

data/docs/manual/plugins/rigor-actionpack.md

@@ -397,21 +397,29 @@ diff — not a policy scoped to `app/views/**/*`. See
   knows what `rigor-rails-routes` published, and `permit`
   validation only what `rigor-activerecord` published — enabling
   those producers widens what this plugin can check.
-- **`params[:key]` stays untyped.** Inside a controller, `params`
-  types as `ActionController::Parameters`, and so does the result
-  of every builder method that always returns one — `require`,
+- **`params[:key]` is a gradual carrier.** Inside a controller,
+  `params` types as `ActionController::Parameters`, and so does the
+  result of every builder method that always returns one — `require`,
   `permit`, `permit!`, `expect`, `slice`, `slice!`, `except`,
   `without`, `extract!`, `merge`, `merge!`, `reverse_merge`,
   `reverse_merge!`, `with_defaults`, `with_defaults!`, `compact`,
   `compact_blank`, `deep_dup` — so a chain built from them keeps a
-  concrete receiver throughout. A subscript read is deliberately
-  left untyped: `params[:missing]` is `nil` at runtime, and a type
-  that says otherwise would let the flow rules fold live
-  conditions (`if params[:q]`, `url.nil?`) to a constant and report
-  working code. Methods whose result depends on the call — `dig`,
-  `fetch`, `compact!`, and the block-less `select` / `reject` /
-  `transform_keys` / `transform_values` — are untyped for the same
-  reason.
+  concrete receiver throughout. A subscript read answers
+  `Dynamic[ActionController::Parameters | nil]` (#2430): the static
+  facet is the nilable `Parameters`, so `params[:user][:name]` and
+  `params[:user].permit(:name)` keep dispatching on that facet, and
+  the `Dynamic` wrapper lets the value cross a declared boundary such
+  as a `String` parameter, as a scalar param does at runtime. The
+  facet is nilable rather than the non-nil nominal on purpose:
+  `params[:missing]` is `nil` at runtime, and a non-nil type would
+  let the flow rules fold live conditions (`if params[:q]`,
+  `url.nil?`) to a constant and report working code. Methods on the
+  carrier outside the chain (`params[:q].to_s`) answer `Dynamic[top]`,
+  because the engine dispatches a `Dynamic` receiver without projecting
+  its facet: a loss of precision, not a false positive. Methods whose
+  result depends on the call — `dig`, `fetch`, `compact!`, and the
+  block-less `select` / `reject` / `transform_keys` /
+  `transform_values` — are untyped for the same reason.
 - **`flash[:key]` and `session[:key]` stay untyped too**, for that
   same reason and measured the same way. Both are leaf reads that
   return whatever was stored — or `nil` for a key that is not set.

data/docs/manual/plugins/rigor-activesupport-core-ext.md

@@ -32,6 +32,17 @@ path, no vendoring, no `signature_paths:` wiring.
 > surface. When it is loaded, the auto overlay stands down so the two
 > never double-declare.
 
+If the project also runs `rbs collection install` for `activesupport`,
+some methods are declared twice — `Object#acts_like?`,
+`Object#html_safe?`, `Time#to_fs` among them. Rigor merges the two:
+the plugin's signatures are tried first and the collection's still
+apply, so a call either one accepts type-checks. When your own `sig/`
+or inline RBS declares one of the plugin's methods, yours is used
+instead and the plugin's stands down; the run reports one
+`rbs.coverage.plugin-signature-stood-down` info row for the plugin's
+file, naming those methods and the file whose declaration is used for
+each.
+
 ## What it covers
 
 Roughly the top ~40 selectors plus their close neighbours, across:
@@ -55,7 +66,15 @@ Roughly the top ~40 selectors plus their close neighbours, across:
 - **Hash** — `#symbolize_keys` / `#stringify_keys` (+ deep / bang) and
   their `#to_options` alias, `#deep_merge`, `#reverse_merge` /
   `#with_defaults` (+ bang), `#with_indifferent_access`, `#except!`,
-  `#extract!`.
+  `#extract!`. `#symbolize_keys` / `#to_options` map the key type per
+  member, as ActiveSupport does (`key.to_sym rescue key`): a `String` or
+  `Symbol` key reads as `Symbol`, and every other key (an `Integer`, a
+  `Float`, a project class) reads as `untyped`, because a mixin or a
+  project file can give any class a `to_sym`. So
+  `Hash[String, Integer]` gives `Hash[Symbol, Integer]` and
+  `Hash[Integer, Integer]` gives `Hash[untyped, Integer]`. Without the
+  plugin, on the activesupport overlay alone, the key reads `untyped`.
+  The bang forms answer the receiver's own type.
 - **Range** — `#overlaps?`, `#to_fs` / `#to_formatted_s`.
 - **Enumerable** — `#index_by`, `#index_with`, `#pluck`, `#exclude?`.
 

data/lib/rigor/analysis/baseline.rb

@@ -97,6 +97,13 @@ module Rigor
           new(buckets, project_root: project_root)
         end
 
+        # The diagnostics a baseline cannot address: no rule (a Prism parse error, a path or internal error) or no path.
+        # `#filter` passes these through and `from_diagnostics` leaves them out of every bucket; this is the one
+        # definition of both.
+        def unkeyable(diagnostics)
+          diagnostics.reject { |d| d.qualified_rule && d.path }
+        end
+
         private
 
         def parse_loaded(raw, path:, project_root:)
@@ -138,17 +145,12 @@ module Rigor
           raise LoadError, "#{path}: ignored[#{index}] `message:` is not a valid Regexp: #{e.message}"
         end
 
-        # Returns Hash{[file, rule, regex_or_nil] => Array<Diagnostic>}.
-        # In message mode, each unique message gets its own bucket;
-        # in rule mode, every diagnostic for a (file, rule) pair
-        # contributes to a single bucket regardless of message.
-        # File paths are normalised to relative before keying.
+        # Groups diagnostics by [file, rule, regex_or_nil]. In message mode, each unique message gets its own
+        # bucket; in rule mode, every diagnostic for a (file, rule) pair contributes to a single bucket regardless
+        # of message. File paths are normalised to relative before keying.
         def group_for_baseline(diagnostics, match_mode, project_root)
           root = Pathname.new(project_root)
-          diagnostics.each_with_object({}) do |diag, into|
-            next if diag.qualified_rule.nil?
-            next if diag.path.nil?
-
+          (diagnostics - unkeyable(diagnostics)).each_with_object({}) do |diag, into|
             rel = relative_path(diag.path, root)
             key = case match_mode
                   when :rule
@@ -160,18 +162,18 @@ module Rigor
           end
         end
 
+        def relative_path(path, root_pathname)
+          Pathname.new(path).relative_path_from(root_pathname).to_s
+        rescue ArgumentError
+          path # different drive letter on Windows or non-child path
+        end
+
         # Generates a Regexp source string for the baseline row. The string is `Regexp.escape`d so the YAML
         # round-trip produces a regex that matches the literal message. Users hand-editing the row can replace
         # the escaped form with a pattern.
         def message_pattern_for(message)
           Regexp.new(Regexp.escape(message.to_s))
         end
-
-        def relative_path(path, root_pathname)
-          Pathname.new(path).relative_path_from(root_pathname).to_s
-        rescue ArgumentError
-          path # different drive letter on Windows or non-child path
-        end
       end
 
       class LoadError < StandardError; end
@@ -181,11 +183,8 @@ module Rigor
       def initialize(buckets, project_root: Dir.pwd)
         @project_root = Pathname.new(project_root)
         @buckets = buckets.freeze
-        # For each (file, qualified_rule) pair, two arrays:
-        # - rule-ID rows (message_regex == nil)
-        # - message-pattern rows (message_regex != nil)
-        # The matcher walks message-pattern rows first (tighter match takes precedence); diagnostics that
-        # don't match any message row fall through to the rule-ID row if one exists.
+        # Buckets grouped by (file, rule). `claim_bucket_for` splits each group into message-pattern rows, tried
+        # first as the tighter match, and the rule-ID row (message_regex == nil) as the fallback.
         @by_pair = buckets.group_by { |b| [b.file, b.rule] }.freeze
         freeze
       end
@@ -216,7 +215,7 @@ module Rigor
 
         # Diagnostics that lacked a rule or a path bypass the baseline entirely (the baseline can't address
         # them).
-        unkeyable = diagnostics.reject { |d| d.qualified_rule && d.path }
+        unkeyable = self.class.unkeyable(diagnostics)
         [surfaced + unkeyable, silenced_count]
       end
 
@@ -225,7 +224,7 @@ module Rigor
       # - `:within`    — `actual <= count` (silenced by the filter).
       # - `:over`      — `actual > count` (over threshold; surfaced in the regular `rigor check` output).
       # - `:cleared`   — `actual == 0` (the bucket can be pruned).
-      # - `:reducible` — `0 < actual < count` (the bucket's count can be tightened; future `regenerate` slice 5
+      # - `:reducible` — `0 < actual < count` (the bucket's count can be tightened; `rigor baseline regenerate`
       #                  handles this).
       DriftRow = Struct.new(:bucket, :actual_count, :status, keyword_init: true) do
         def delta
@@ -254,8 +253,8 @@ module Rigor
         end
       end
 
-      # Returns a new Baseline with the given buckets dropped. Used by `rigor baseline prune` (slice 2) to
-      # remove cleared buckets (`actual == 0`) from the on-disk file.
+      # Returns a new Baseline with the given buckets dropped. Used by `rigor baseline prune` to remove cleared
+      # buckets (`actual == 0`) from the on-disk file.
       def without(buckets_to_drop)
         dropset = buckets_to_drop.to_set
         self.class.new(buckets.reject { |b| dropset.include?(b) }, project_root: @project_root)
@@ -311,9 +310,7 @@ module Rigor
         # over rule-ID rows because they're more specific. A diagnostic that matches no row goes into a
         # synthetic "no-bucket" bin keyed by (file, rule).
         bins = {}
-        diagnostics.each do |diag|
-          next if diag.qualified_rule.nil? || diag.path.nil?
-
+        (diagnostics - self.class.unkeyable(diagnostics)).each do |diag|
           bucket = claim_bucket_for(diag)
           key = if bucket
                   [bucket.file, bucket.rule,

data/lib/rigor/analysis/check_rules/always_truthy_condition_collector.rb

@@ -23,10 +23,11 @@ module Rigor
       #   `BlockNode` ancestors. Mutation tracking through loop bodies is incomplete (`shift = 0; loop {
       #   shift += 7 }` keeps `shift` at `Constant<7>` per the analyzer), so a `Constant<bool>` predicate
       #   inside the loop body is suspect.
-      # - **Defensive predicate calls**: `.nil?` / `.empty?` / `.zero?` / `.any?` / `.none?` / `.all?`. These
-      #   read like the user explicitly checking for a runtime condition that the type system already proves
-      #   can't happen — Rigor's strict-on-returns RBS often disagrees with the user's defensive check (e.g.
-      #   `Module#name` returns `String` per RBS but anonymous classes really do return `nil`). Skipping
+      # - **Defensive predicate calls**: `.nil?` / `.empty?` / `.zero?` / `.any?` / `.none?` / `.all?` /
+      #   `.respond_to?`. These read like the user explicitly checking for a runtime condition that the type
+      #   system already proves can't happen — Rigor's strict-on-returns RBS often disagrees with the user's
+      #   defensive check (e.g. `Module#name` returns `String` per RBS but anonymous classes really do return
+      #   `nil`). Skipping
       #   these forms keeps the rule useful for genuine logic errors without faulting defensive code.
       #
       # Also skipped (so the literal-only `unreachable-branch` rule doesn't double-fire alongside this one):
@@ -53,8 +54,6 @@ module Rigor
         NODE_CLASSES = [Prism::IfNode, Prism::UnlessNode].freeze
         RULE_WALK_GATES = [:loop_or_block].freeze
 
-        # @return one entry per qualifying predicate. Empty when the tree carries no firing
-        #   predicates.
         def initialize(scope_index)
           @scope_index = scope_index
           @results = []

data/lib/rigor/analysis/check_rules/dead_assignment_collector.rb

@@ -35,8 +35,8 @@ module Rigor
         # exactly like the legacy walk.
         NODE_CLASSES = [Prism::DefNode].freeze
 
-        # Returns `Array<{def_class:, def_name:, write_node:}>` — one entry per dead-assignment write. Empty
-        # when the tree has no qualifying writes.
+        # One entry per dead-assignment write, as `{def_node:, write_node:}`. Empty when the tree has no
+        # qualifying writes.
         def initialize(scope_index)
           @scope_index = scope_index
           @results = []

data/lib/rigor/analysis/check_rules/declaration_sourced_guard.rb

@@ -24,10 +24,10 @@ module Rigor
       # currently declaration-sourced ivar*, so a second hop (`c = @count; d = c`) and an `||=` rewrite land on
       # the plain `with_local` path and carry no mark.
       #
-      # A branch join is NOT one of those cases, contrary to what this comment claimed when it landed: both
-      # arms of `if c then r = @count else r = @count end` stamp `(:local, :r)`, and `join_declaration_sourced`
-      # INTERSECTS, so the mark survives. Only an *asymmetric* join drops it, and by that intersection rather
-      # than by reaching `with_local`. The normative statement — establishment, drop, join and the full list of
+      # A branch join keeps the mark when both arms stamp it: `if c then r = @count else r = @count end` stamps
+      # `(:local, :r)` on each arm, and `join_declaration_sourced` INTERSECTS, so the mark survives. Only an
+      # *asymmetric* join drops it, by that intersection rather than by reaching `with_local`. The normative
+      # statement — establishment, drop, join and the full list of
       # unmarked shapes, each verified against the implementation — is
       # `docs/internal-spec/inference-engine.md` § "Declaration-sourced provenance mark (ADR-58)"; keep this
       # comment subordinate to it.

data/lib/rigor/analysis/check_rules/duplicate_hash_key_collector.rb

@@ -36,8 +36,8 @@ module Rigor
         # a Hash literal, loops and blocks included.
         NODE_CLASSES = [Prism::HashNode, Prism::KeywordHashNode].freeze
 
-        # Returns `Array<{hash_node:, key_node:, first_key_node:, key_label:}>` — one entry per LATER
-        # occurrence of a repeated literal key (`key_node` is the repeat the diagnostic points at;
+        # One entry per LATER occurrence of a repeated literal key, carrying `hash_node`, `key_node`,
+        # `first_key_node` and `key_label` (`key_node` is the repeat the diagnostic points at;
         # `first_key_node` is the earliest occurrence its message references). Empty when the tree has no
         # qualifying duplicates.
         def initialize(scope_index)

data/lib/rigor/analysis/check_rules/inferred_param_guard.rb

@@ -29,6 +29,13 @@ module Rigor
       #   under the ivar's `@`-prefixed name, which no local can spell — because the write and the read are
       #   separate statements. The mark is method-local: the class-ivar census that seeds a sibling method's
       #   ivars types the write's RHS without the inference seed, so a cross-method read is not a lower bound.
+      # - `Array(param)` (issue #2280): the conversion passes the parameter's elements through, so
+      #   `Array(param).first.upcase` reads the lower bound back.
+      # - an `if` / `unless` / ternary whose value is the parameter (issue #2280): `(c ? param : param).upcase`.
+      #   Unlike `&&` / `||`, a branch that does not hold the parameter keeps its diagnostic: the form is rooted
+      #   when every branch that can run is. A predicate the engine folds to one arm (the same certainty
+      #   `StatementEvaluator#eval_if` elides the dead arm on) leaves only that arm to decide, so
+      #   `(c ? param : 1).upcase` declines when `c` folds truthy and reports `Integer` when it folds falsey.
       #
       # Every value derived from an inferred parameter by dispatch is itself a lower bound, so firing against it
       # is an FP by the same construction. No-op on a normal `check` run — `Scope#inferred_param?` is false
@@ -40,40 +47,105 @@ module Rigor
         # length, which is tiny in practice).
         MAX_DEPTH = 64
 
-        def rooted?(node, scope, depth = 0)
+        # `fold` is whether `scope` is still the scope the walked node is evaluated in. The callers pass the scope
+        # at the start of the expression; once the walk passes something evaluated earlier inside it (a leading
+        # statement, the left operand of `&&`, an earlier literal element, a conditional's predicate), that
+        # earlier code may have rebound what a nested predicate reads (`(c = false; c ? param : 1)`), so a
+        # conditional below no longer folds its predicate in `scope`.
+        def rooted?(node, scope, depth = 0, fold: true)
           return false if node.nil? || depth > MAX_DEPTH
 
           case node
           when Prism::LocalVariableReadNode, Prism::InstanceVariableReadNode then scope.inferred_param?(node.name)
-          when Prism::CallNode then rooted?(node.receiver, scope, depth + 1)
+          when Prism::CallNode then call_rooted?(node, scope, depth + 1, fold)
           when Prism::ArrayNode, Prism::HashNode, Prism::KeywordHashNode, Prism::AssocNode
-            literal_rooted?(node, scope, depth + 1)
-          else combining_rooted?(node, scope, depth + 1)
+            literal_rooted?(node, scope, depth + 1, fold)
+          else combining_rooted?(node, scope, depth + 1, fold)
+          end
+        end
+
+        def call_rooted?(node, scope, depth, fold)
+          return rooted?(node.receiver, scope, depth, fold: fold) unless array_conversion?(node, scope)
+
+          rooted?(node.arguments.arguments.first, scope, depth, fold: fold)
+        end
+
+        # A receiverless `Array(x)` reaching Kernel#Array: exactly one plain argument, no block, and no project
+        # `Array` on `self`'s class or its project ancestors to bind ahead of Kernel's.
+        def array_conversion?(node, scope)
+          node.receiver.nil? && node.name == :Array && node.block.nil? &&
+            node.arguments&.arguments&.size == 1 && !project_array_method?(scope)
+        end
+
+        def project_array_method?(scope)
+          self_type = scope.self_type
+          case self_type
+          when Type::Nominal then scope.discovered_method_through_ancestors?(self_type.class_name, :Array, :instance)
+          when Type::Singleton
+            scope.discovered_method_through_ancestors?(self_type.class_name, :Array, :singleton)
+          else false
           end
         end
 
         # An array or hash literal is rooted when any element is: the engine reads the element back precisely.
-        def literal_rooted?(node, scope, depth)
+        def literal_rooted?(node, scope, depth, fold)
           parts = node.is_a?(Prism::AssocNode) ? [node.key, node.value] : node.elements
-          parts.any? { |part| rooted?(part, scope, depth) }
+          parts.each_with_index.any? { |part, index| rooted?(part, scope, depth, fold: fold && index.zero?) }
         end
 
         # Value-combining forms: the produced value is a union of the operands, so it is a lower bound when ANY
         # operand is inferred-parameter-rooted (`cps[i] - x rescue -1`, `a && param.foo`, `param || b`). Declining
         # on the whole expression is FP-safe by the same lower-bound argument.
-        def combining_rooted?(node, scope, depth)
+        def combining_rooted?(node, scope, depth, fold)
           case node
           when Prism::RescueModifierNode
-            rooted?(node.expression, scope, depth) || rooted?(node.rescue_expression, scope, depth)
-          when Prism::AndNode, Prism::OrNode then rooted?(node.left, scope, depth) || rooted?(node.right, scope, depth)
-          when Prism::ParenthesesNode then rooted?(last_statement(node.body), scope, depth)
-          when Prism::StatementsNode then rooted?(node.body.last, scope, depth)
+            rooted?(node.expression, scope, depth, fold: fold) ||
+              rooted?(node.rescue_expression, scope, depth, fold: false)
+          when Prism::AndNode, Prism::OrNode
+            rooted?(node.left, scope, depth, fold: fold) || rooted?(node.right, scope, depth, fold: false)
+          when Prism::ParenthesesNode then body_rooted?(node.body, scope, depth, fold)
+          when Prism::StatementsNode then body_rooted?(node, scope, depth, fold)
+          when Prism::IfNode, Prism::UnlessNode then conditional_rooted?(node, scope, depth, fold)
+          when Prism::ElseNode then rooted?(node.statements, scope, depth, fold: fold)
+          else false
+          end
+        end
+
+        # A body's value is its last statement; any statement before it runs first.
+        def body_rooted?(body, scope, depth, fold)
+          return rooted?(body, scope, depth, fold: fold) unless body.is_a?(Prism::StatementsNode)
+
+          rooted?(body.body.last, scope, depth, fold: fold && body.body.size == 1)
+        end
+
+        # Every branch that can run must be rooted; an absent branch is `nil`, never rooted. The predicate is
+        # typed only when the branches disagree, so a conditional that never mentions a parameter costs nothing.
+        # An arm runs after the predicate, so a conditional nested in one never folds.
+        def conditional_rooted?(node, scope, depth, fold)
+          truthy_rooted, falsey_rooted = arms(node).map { |arm| rooted?(arm, scope, depth, fold: false) }
+          return truthy_rooted if truthy_rooted == falsey_rooted
+          return false unless fold
+
+          case predicate_certainty(node.predicate, scope)
+          when :truthy then truthy_rooted
+          when :falsey then falsey_rooted
           else false
           end
         end
 
-        def last_statement(body)
-          body.is_a?(Prism::StatementsNode) ? body.body.last : body
+        # `[runs when the predicate is truthy, runs when it is falsey]`.
+        def arms(node)
+          node.is_a?(Prism::IfNode) ? [node.statements, node.subsequent] : [node.else_clause, node.statements]
+        end
+
+        # The arm certainty `StatementEvaluator#branch_certainty` elides on: a decidable version guard, else the
+        # predicate's folded truthiness unless an optimistic carrier props it up.
+        def predicate_certainty(predicate, scope)
+          guard = Inference::VersionGuard.verdict(predicate)
+          return guard if guard
+          return nil unless Inference::OptimisticOrigin.resolve(predicate, scope).nil?
+
+          Inference::Narrowing.predicate_certainty(scope.type_of(predicate))
         end
       end
     end

data/lib/rigor/analysis/check_rules/ivar_write_collector.rb

@@ -44,8 +44,9 @@ module Rigor
         NODE_CLASSES = [Prism::DefNode, Prism::CallNode].freeze
         RULE_WALK_GATES = %i[inside_def detached_ivar_facet].freeze
 
-        # Returns `Hash[class_name (String) => Hash[ivar_name (Symbol) => Array<{node:, type:, declared:,
-        # method_name:, visibility:, per_invocation:, action:}>]]`. Empty when the tree has no qualifying writes.
+        # Groups the writes by class qualified name, then by ivar name. Each write carries `node`, `type`,
+        # `declared`, `method_name`, `visibility`, `per_invocation` and `action`. Empty when the tree has no
+        # qualifying writes.
         # `declared` is the translated type of the class's RBS declaration of the ivar — an `@x: T` member or
         # the slot an `attr_*` member implies, own or inherited — and nil when the RBS declares none.
         #

data/lib/rigor/analysis/check_rules/lexical_method_sites.rb

@@ -152,7 +152,6 @@ module Rigor
           end
         end
 
-        # `o.singleton_class`.
         def singleton_class_of_local?(node)
           node.is_a?(Prism::CallNode) && node.name == :singleton_class && node.arguments.nil? &&
             node.receiver.is_a?(Prism::LocalVariableReadNode)

data/lib/rigor/analysis/check_rules/main_pass_collector.rb

@@ -12,16 +12,13 @@ module Rigor
       # decides, with NO loop / block suppression and NO threaded context — so the collector declares no
       # `RULE_WALK_GATES` and ignores the walk's `context`.
       #
-      # The per-node dispatch itself stays in `CheckRules` (the verbatim `case` from `diagnose`'s former inline
-      # walk — only the traversal moved, ADR-53 WD4) and is handed in as a callable built in the `CheckRules`
-      # module context, so its calls to the private diagnostic builders remain implicit-self. The collector
-      # only owns the traversal hook and accumulation. Unlike the fact collectors its `#results` are the
-      # accumulated {Diagnostic}s, in the same emission order the inline `NodeWalker.each` produced them (the
-      # shared walk is the same visit-before-descend DFS over `compact_child_nodes`).
+      # The per-node dispatch stays in `CheckRules` (ADR-53 WD4) and is handed in as a callable built in the
+      # `CheckRules` module context, so its calls to the private diagnostic builders remain implicit-self. The
+      # collector only owns the traversal hook and accumulation; `#results` are the accumulated {Diagnostic}s in
+      # the walk's emission order.
       class MainPassCollector
         # The node classes the main pass branches on. A plain `Prism::IfNode` covers ternaries and postfix `if`
-        # too (the legacy `when Prism::IfNode, Prism::UnlessNode` arm did the same). The three global-write
-        # classes carry issue #1367's `global.*` rules.
+        # too. The global-write classes and `MultiWriteNode` carry issue #1367's `global.*` rules.
         NODE_CLASSES = [
           Prism::CallNode, Prism::DefNode, Prism::IfNode, Prism::UnlessNode,
           Prism::GlobalVariableWriteNode, Prism::GlobalVariableOperatorWriteNode, Prism::MultiWriteNode

data/lib/rigor/analysis/check_rules/published_constant_guard.rb

@@ -19,7 +19,7 @@ module Rigor
       # branched on, whose declaration the reader's author never opened. A configuration constant read in ten
       # files would put a warning in all ten.
       #
-      # This is [ADR-58](../../../../docs/adr/58-declaration-sourced-ivar-typing.md)'s discipline applied to a
+      # This is [ADR-58](../../../../docs/adr/58-ivar-field-typing.md)'s discipline applied to a
       # different carrier: "a consumer may only ever *withhold* a firing it would otherwise make, so the mark
       # can lose precision but can never manufacture a false positive"
       # (`docs/internal-spec/inference-engine.md` § "Carrier and discipline"). The carrier is deliberately NOT

data/lib/rigor/analysis/check_rules/rebinding_block_callees.rb

@@ -39,8 +39,8 @@ module Rigor
         SEND_CALLS = %i[send __send__ public_send].freeze
         # Reading the block through these runs it with its own `self`, or does not run it.
         PLAIN_PROC_CALLS = %i[call yield [] === ! arity lambda? parameters nil?].freeze
-        # Calls, on any receiver, that can reach a local by name: a `Binding`, a string `eval`, and the string forms of
-        # the `*_eval` family (with an argument), whose code runs in the caller's scope.
+        # Calls, on any receiver, that can reach a local by name: `binding`, `eval`, `local_variable_get`. The string
+        # forms of the `*_eval` family (`STRING_EVAL_CALLS`, with an argument) run in the caller's scope too.
         BINDING_CALLS = %i[binding eval local_variable_get].freeze
         STRING_EVAL_CALLS = %i[instance_eval class_eval module_eval].freeze
         private_constant :STRING_EVAL_CALLS
@@ -96,7 +96,7 @@ module Rigor
             found
           end
 
-          # `{name => {[owner, side] => rows}}` over the project's named `def` rows, built once per file.
+          # The project's named `def` row counts, keyed by method name and then by owner and side; built once per file.
           def def_rows(scope)
             @def_rows ||= RebindingBlockCallees.def_row_counts(scope)
           end

data/lib/rigor/analysis/check_rules/return_in_ensure_collector.rb

@@ -55,8 +55,7 @@ module Rigor
           collect_ensure_returns(begin_node)
         end
 
-        # Returns `Array<{return_node:}>` — one entry per offending `return`, frozen the same way
-        # `#collect` returns it.
+        # One `{return_node:}` entry per offending `return`, frozen the same way `#collect` returns them.
         def results
           @results.freeze
         end