rigortype 0.4.6 → 0.4.7

data/lib/rigor/analysis/check_rules/rule_ids.rb

@@ -178,7 +178,7 @@ module Rigor
 
       # Resolves a user-supplied rule token (`undefined-method`, `call.undefined-method`, or the family wildcard
       # `call`) to the set of canonical rule identifiers it disables. Returns `nil` for `"all"` (the existing
-      # wildcard meaning "every rule"), or for unknown tokens.
+      # wildcard meaning "every rule"), and an empty array for an unknown token.
       def self.resolve_rule_token(token)
         return nil if token == "all"
         return [LEGACY_RULE_ALIASES.fetch(token)] if LEGACY_RULE_ALIASES.key?(token)

data/lib/rigor/analysis/check_rules/rule_walk.rb

@@ -10,7 +10,7 @@ module Rigor
     module CheckRules
       # ADR-53 Track B — the engine-owned AST walk that hosts CheckRules' per-node collectors, so a file is
       # traversed once for all of them instead of once per collector (the ADR-52 WD4 model applied to the
-      # built-in rules; this walk and {Plugin::NodeRuleWalk} converge in slice B4).
+      # built-in rules; {Plugin::NodeRuleWalk} drives the same collectors, ADR-53 B4).
       #
       # The walk is a single visit-before-descend DFS over `compact_child_nodes`. It threads the union of the
       # context the hosted collectors need — the per-collector hand-rolled walks each tracked some subset of
@@ -146,12 +146,14 @@ module Rigor
             qualified_prefix = extend_prefix(node, context.qualified_prefix)
             detached_ivar_facet = context.detached_ivar_facet || detached_ivar_facet?(node)
 
-            Context.new(
-              in_loop_or_block: in_loop_or_block,
-              qualified_prefix: qualified_prefix,
-              inside_def: inside_def,
-              detached_ivar_facet: detached_ivar_facet
-            )
+            # Nearly every node leaves all four fields as they were, and a {Context} is immutable, so the parent's
+            # is the child's. This runs once per node and was a top allocation site (a Data per node).
+            if in_loop_or_block == context.in_loop_or_block && inside_def == context.inside_def &&
+               qualified_prefix.equal?(context.qualified_prefix) && detached_ivar_facet == context.detached_ivar_facet
+              return context
+            end
+
+            Context.new(in_loop_or_block, qualified_prefix, inside_def, detached_ivar_facet)
           end
 
           # True for a node whose descendants write ivars to a store the enclosing class name does not name:

data/lib/rigor/analysis/check_rules/shadowed_rescue_collector.rb

@@ -123,10 +123,9 @@ module Rigor
           @scope_index[node] || @scope_index[node.statements] || @scope_index[node.rescue_clause]
         end
 
-        # Resolves one clause to `{clause:, names: [String, …]}` where `names` are the certified exception
-        # CLASS names it rescues, or nil when the clause is opaque (any entry unresolved / dynamic / splat /
-        # module — the comparisons involving it stay silent). A bare `rescue` names the implicit
-        # `StandardError`.
+        # Resolves one clause to `{clause:, names:}`, where `names` are the certified exception CLASS names it
+        # rescues, or nil when the clause is opaque (any entry unresolved / dynamic / splat / module — the
+        # comparisons involving it stay silent). A bare `rescue` names the implicit `StandardError`.
         def clause_info(clause, prefix, scope)
           exceptions = clause.exceptions
           if exceptions.empty?

data/lib/rigor/analysis/check_rules/special_global_setters.rb

@@ -9,9 +9,9 @@ module Rigor
       # the envelope `global.write-type-mismatch` and `global.readonly-write` judge a write against.
       #
       # The setter is the authority, not the RBS declaration of the global. Where the two differ, the setter wins:
-      # `$;` is declared `Regexp | String | nil`, but its setter also takes any object with `to_str`, and `$stdout` is
-      # declared `IO`, but its setter takes anything that responds to `write`. Each entry names the CRuby function
-      # that enforces it and was confirmed on Ruby 4.0.5, whose error the comment quotes.
+      # `$;` is declared as a Regexp, a String or nil, but its setter also takes any object with `to_str`, and
+      # `$stdout` is declared as an IO, but its setter takes anything that responds to `write`. Each entry names
+      # the CRuby function that enforces it and was confirmed on Ruby 4.0.5, whose error the comment quotes.
       #
       # A special whose setter accepts every value is absent, so a write to it is never checked: `$stdin`
       # (ADR-117 WD2), `$_`, `$VERBOSE` / `$-v` / `$-w`, `$DEBUG` / `$-d` and `$=`. So is `$@`, whose setter raises

data/lib/rigor/analysis/check_rules/unreachable_clause_collector.rb

@@ -280,8 +280,8 @@ module Rigor
 
         # The trailing `else` is dead when every subject value is covered by the `when` clauses — the final
         # falsey scope (recorded on the `else` node) narrows the subject to `bot`. Defensive `else` bodies (a
-        # bare `raise` / `fail` / `throw`) are deliberate guards, not removable dead code, so they are
-        # skipped.
+        # bare `raise` / `fail` / `throw` / `abort` / `exit`) are deliberate guards, not removable dead code, so
+        # they are skipped.
         def collect_else(else_clause, subject_name, keyword)
           return if else_clause.nil? || else_clause.statements.nil?
           return if defensive_else?(else_clause)

data/lib/rigor/analysis/check_rules/void_value_use_collector.rb

@@ -29,7 +29,7 @@ module Rigor
       class VoidValueUseCollector
         # The assignment forms whose `value` slot is a value position. `MultiWriteNode` (destructuring) is
         # intentionally excluded — its `value` is a container the void call would have to be spread through,
-        # not a direct use, so it is out of this slice's FP-narrow scope.
+        # not a direct use, so it is outside the FP-narrow scope.
         WRITE_NODE_CLASSES = [
           Prism::LocalVariableWriteNode, Prism::InstanceVariableWriteNode,
           Prism::ClassVariableWriteNode, Prism::GlobalVariableWriteNode,

data/lib/rigor/analysis/check_rules.rb

@@ -33,6 +33,7 @@ require_relative "check_rules/rebinding_block_callees"
 require_relative "check_rules/rbs_receiver_surface"
 require_relative "check_rules/special_global_setters"
 require_relative "check_rules/ruby_deprecations"
+require_relative "../run_scoped_slots"
 
 module Rigor
   module Analysis
@@ -53,7 +54,7 @@ module Rigor
     #
     # - implicit-self calls (no `node.receiver`) — too noisy
     #   without per-method RBS for every helper in the class.
-    # - dynamic / unknown receivers (`Dynamic[T]`, `Top`, `Union`)
+    # - dynamic / unknown receivers (`Dynamic[T]`, `Top`)
     #   — by definition we cannot enumerate the method set.
     # - shape carriers: `Tuple` → "Array", `HashShape` → "Hash",
     #   `Constant` → the constant's class — `concrete_class_name`
@@ -86,9 +87,8 @@ module Rigor
 
       module_function
 
-      # Yields diagnostics for every unrecognised method call on
-      # a typed receiver in `root`'s subtree. The caller MUST
-      # have already produced `scope_index` through
+      # Returns the diagnostics for `root`'s subtree across the rule
+      # catalogue. The caller MUST have already produced `scope_index` through
       # `Rigor::Inference::ScopeIndexer.index(root, default_scope:)`.
       #
       # @param path — used to populate
@@ -750,7 +750,7 @@ module Rigor
           # branch below because a plugin is consulted ONCE for the whole receiver, union included, so the
           # gate belongs where that one consult is rather than duplicated into each shape's path.
           #
-          # The union side of that placement IS reachable, contrary to what this comment used to say. The
+          # The union side of that placement is reachable. The
           # shape needs a non-nil union of at least two RBS-DECLARED classes — an undeclared arm is an
           # ADR-26 open receiver and `union_arm_blocks_undefined_fire?` bails before the method lookup,
           # which is why the earlier probes read silent and were misread as the gate being unreachable.
@@ -797,13 +797,6 @@ module Rigor
             return union_undefined_method_diagnostic(path, call_node, receiver_type, scope, lexical_sites)
           end
 
-          # ADR-26 — a plugin may declare a class "open": one
-          # known to respond beyond its RBS-declared method
-          # surface (e.g. `ActiveRecord::Relation`, which
-          # delegates an unbounded set of user-defined scopes to
-          # its model). Flagging an undefined method on a class
-          # with an open dynamic surface is unsound, so the rule
-          # skips it.
           # An unbounded receiver surface: either a plugin-declared
           # open receiver (ADR-26 — e.g. `ActiveRecord::Relation`), or
           # a type Rigor synthesized (a missing-namespace module / a
@@ -839,6 +832,7 @@ module Rigor
           return nil if method_def
 
           return nil if last_resort_surface_answers?(receiver_type, class_name, call_node, scope, kind, lexical_sites)
+          return nil if open_project_singleton?(receiver_type, class_name, call_node, scope)
           return nil if subclass_instance_may_answer?(rendered_receiver, class_name, call_node.name, scope,
                                                       call_node.receiver)
 
@@ -1342,14 +1336,14 @@ module Rigor
         # (`METACLASS_ARMS`, "a `plugin_class : Class` really holds a `Plugin` subclass with `.manifest`");
         # the scalar rule enumerated `Module`'s own RBS instead and reported them.
         #
-        # Kept beside `unbounded_receiver_surface?` rather than folded into it: that predicate has eight
-        # other callers, and #742 had no evidence that any of them spoke on these receivers.
+        # Kept beside `unbounded_receiver_surface?` rather than folded into it: that predicate has other
+        # callers, and #742 had no evidence that any of them spoke on these receivers.
         #
         # Issue #879 supplied it for exactly one — `call.wrong-arity`, which decided `v.hexdigest(1, 2, 3)`
         # against `Digest::Instance`'s declaration on the same run where `v.no_such_method_zzz` was declined
         # as unenumerable. One receiver, one run, two answers about whether that surface can be read. The
         # reporter could make no other caller speak: `raise` on a module- or `Class`-typed operand is silent,
-        # and `Class`-typed `.new` with a wrong arity is silent too, so the other seven stay on
+        # and `Class`-typed `.new` with a wrong arity is silent too, so the other callers stay on
         # `unbounded_receiver_surface?` until something demonstrates otherwise.
         #
         # Arity takes {#unenumerable_receiver_shape?}, not this whole predicate: ADR-26's open receivers are
@@ -1451,14 +1445,16 @@ module Rigor
         end
 
         # ADR-67 WD6b — the argument-position analogue: true when `arg` is rooted at an inferred-parameter
-        # local. The argument-type-mismatch rule declines on it for the same lower-bound reason.
+        # local. The argument-type-mismatch rule declines on it for the same lower-bound reason. `scope` is the
+        # call's, and the receiver and any earlier argument run before `arg` and may rebind what a conditional's
+        # predicate in it reads (`m((c = false; 1), c ? param : "x")`), so a predicate there is never folded.
         def inferred_param_argument?(arg, scope)
-          inferred_param_rooted?(arg, scope)
+          inferred_param_rooted?(arg, scope, fold: false)
         end
 
         # ADR-67 WD6b — see {CheckRules::InferredParamGuard} for the shared root-walk contract.
-        def inferred_param_rooted?(node, scope)
-          InferredParamGuard.rooted?(node, scope)
+        def inferred_param_rooted?(node, scope, fold: true)
+          InferredParamGuard.rooted?(node, scope, fold: fold)
         end
 
         def constant_class_name(value)
@@ -1530,6 +1526,97 @@ module Rigor
             ruby_library_reopen?(class_name, scope)
         end
 
+        # Issue #2438 — a class-method call on a class the project's own signatures name but whose source leaves
+        # the singleton surface open. Before `rigor sig-gen --write` such a class was source-only and an
+        # unresolved call on it was silent; the sidecar must not turn the same call into a finding. Two shapes:
+        #
+        # - `C.instance` where `C`, or a project class up its superclass chain, `include`s the stdlib `Singleton`:
+        #   the answer is `SingletonMixinDispatch.answers?`, the predicate the typer itself uses, so the rule never
+        #   reports a call the engine typed. The class's other members are irrelevant: the mixin's hook defines
+        #   `instance`.
+        # - every project declaration of `C` is member-less (`RbsLoader#memberless_project_class?`) AND the source
+        #   leaves `C` open ({#open_source_class?}). A member-less declaration does not describe the class's
+        #   surface, but a class whose whole definition Rigor can see in `paths:` is still closed, so a typo on it
+        #   keeps firing. Instance-side calls keep being checked; declaring any member re-closes the class.
+        def open_project_singleton?(receiver_type, class_name, call_node, scope)
+          return false unless receiver_type.is_a?(Type::Singleton)
+          return true if Inference::MethodDispatcher::SingletonMixinDispatch.answers?(
+            scope, receiver_type, call_node.name, call_node.arguments.nil?
+          )
+
+          loader = scope.environment&.rbs_loader
+          return false if loader.nil? || !loader.respond_to?(:memberless_project_class?)
+
+          loader.memberless_project_class?(class_name) && open_source_class?(class_name, scope, loader)
+        end
+
+        OPENING_HOOKS = %i[inherited included extended prepended method_missing respond_to_missing?].freeze
+        private_constant :OPENING_HOOKS
+
+        CLOSED_ROOTS = Set["Object", "BasicObject"].freeze
+        private_constant :CLOSED_ROOTS
+
+        # Issue #2438 — whether a class's singleton surface may hold methods its source in `paths:` does not show,
+        # read off `Scope::ResolutionChain` (`:constants` flavor, so a project module that holds only constants is
+        # still a project entry). Open when the class, or a project class up its superclass chain:
+        #
+        # 1. `extend`s a module (any singleton-side entry beyond the classes' own singletons), or records an
+        #    `inherited` / `included` / `extended` / `prepended` hook or `method_missing` / `respond_to_missing?`.
+        #    A plain `include` or `prepend` adds instance methods only, so it leaves the singleton side closed;
+        # 2. has no `class` / `module` body of its own inside `paths:` (`class Ext::Foo` names `Ext` without one);
+        # 3. or the chain reaches a class the project does not define, other than `Object` / `BasicObject`: an
+        #    external superclass (`ApplicationRecord < ActiveRecord::Base`, `MyError < StandardError`), a
+        #    superclass written as an expression, or — where the source writes no superclass for the last class —
+        #    the superclass its member-less declaration writes, unless that is a project class.
+        #
+        # A definition or reopening in a file outside `paths:` cannot be seen, so a class whose body is inside
+        # `paths:` and whose methods live only outside it counts as closed.
+        def open_source_class?(class_name, scope, loader)
+          name = class_name.to_s.delete_prefix("::")
+          instance = Scope::ResolutionChain.for(scope, name, :instance, :constants)
+          singleton = Scope::ResolutionChain.for(scope, name, :singleton, :constants)
+          [instance, singleton].each { |chain| chain.record(scope) }
+          classes = instance.level_classes.compact
+          return true if classes.empty? || instance.truncated?
+
+          sources = scope.discovered_class_sources
+          return true if classes.any? { |klass| (sources[klass] || []).empty? || opening_hook?(klass, scope) }
+          return true if opening_entry?(instance, classes, mixins: false) ||
+                         opening_entry?(singleton, classes, mixins: true)
+
+          open_tail?(instance, classes.last, scope, loader)
+        end
+
+        # An external superclass other than `Object` / `BasicObject` opens either side; a module entry opens the
+        # chain only where `mixins` is set (the singleton side, where it is an `extend`).
+        def opening_entry?(chain, classes, mixins:)
+          chain.entries.any? do |entry|
+            if entry.external? && entry.superclass_edge
+              !CLOSED_ROOTS.include?(entry.raw.to_s.delete_prefix("::"))
+            else
+              mixins && !classes.include?(entry.name)
+            end
+          end
+        end
+
+        def opening_hook?(klass, scope)
+          OPENING_HOOKS.any? do |hook|
+            scope.discovered_method?(klass, hook, :singleton) || scope.discovered_method?(klass, hook, :instance)
+          end
+        end
+
+        # The last class's own superclass, which the chain does not name: an expression the tables cannot resolve,
+        # or one only the member-less declaration writes (the chain ends at the implicit `Object` exactly when
+        # the source writes none).
+        def open_tail?(chain, last, scope, loader)
+          return true if chain.opaque_tail?(scope)
+
+          raw = loader.memberless_project_superclass(last)
+          return false if raw.nil? || CLOSED_ROOTS.include?(raw.delete_prefix("::"))
+
+          !scope.discovered_classes.key?(raw.delete_prefix("::"))
+        end
+
         # Issue #2174 — `class Matrix` reopened with one `#:`-annotated method, and no `matrix` signatures
         # loaded, gives Matrix a declaration holding only that method ({RbsLoader#ruby_library_reopen?}).
         # `Matrix.identity(2)` is correct Ruby, so the class's surface is treated as open: `call.undefined-method`
@@ -1845,16 +1932,15 @@ module Rigor
         # Slice 7 phase 11 — wrong-arity diagnostic. Fires when
         # an explicit-receiver `Prism::CallNode` resolves to a
         # method whose declared overloads do not admit the
-        # supplied positional argument count. The rule applies
-        # ONLY to the simplest overload shape (single overload,
-        # no `rest_positionals`, no keyword parameters, no
-        # block-required positionals); calls with `*splat`
-        # arguments, keyword arguments, or block-pass arguments
-        # are silently skipped to avoid false positives. The
-        # check piggybacks on the same scope-index lookup used
-        # by `undefined_method_diagnostic`; it returns nil
-        # when the call's receiver / RBS coverage / call shape
-        # disqualifies the rule.
+        # supplied positional argument count (across all
+        # overloads, see {#compute_arity_envelope}). One overload
+        # with required keyword arguments or trailing positionals
+        # leaves the whole method unchecked; calls with `*splat`, keyword, or
+        # block-pass arguments are silently skipped to avoid
+        # false positives. The check piggybacks on the same
+        # scope-index lookup used by `undefined_method_diagnostic`;
+        # it returns nil when the call's receiver / RBS coverage /
+        # call shape disqualifies the rule.
         # rubocop:disable-next Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         def wrong_arity_diagnostic(path, call_node, scope_index, lexical_sites = nil)
           return nil if call_node.receiver.nil?
@@ -2990,8 +3076,7 @@ module Rigor
         # - Elsif chains (`subsequent` is itself an `IfNode`) ARE flagged — the entire downstream chain is
         #   unreachable when the outer predicate is a constant literal.
         #
-        # Broadening to inferred-constant predicates is queued for a later v0.1.x release once the loop /
-        # mutation gaps named above are closed.
+        # Inferred-constant predicates are the `flow.always-truthy-condition` rule's ({AlwaysTruthyConditionCollector}).
         def unreachable_branch_diagnostic(path, node, scope_index)
           scope = scope_index[node]
           return nil if scope.nil?
@@ -3102,7 +3187,7 @@ module Rigor
           build_visibility_mismatch_diagnostic(path, call_node, "singleton(#{class_name})")
         end
 
-        PRIVATE_NAMES_MEMO = :rigor_check_rules_private_singleton_names
+        PRIVATE_NAMES_MEMO = RunScopedSlots.register(:rigor_check_rules_private_singleton_names)
         private_constant :PRIVATE_NAMES_MEMO
 
         # Issue #1984 — the table-only gate the singleton side asks before it reads a chain, as the instance side asks
@@ -3381,12 +3466,9 @@ module Rigor
         # - Receiver must be Nominal / Singleton / Constant
         #   (the same `concrete_class_name` test).
         # - Method must be in RBS.
-        # - Method must have exactly ONE method type
-        #   (overload). Multi-overload checking is left for
-        #   a follow-up because picking the "intended"
-        #   overload requires the dispatcher's full
-        #   acceptance plumbing.
-        # - The selected overload must have NO
+        # - Overloads: a single method type is checked exactly; with several, an argument is a mismatch only
+        #   when every overload rejects it ({#multi_overload_argument_mismatch}).
+        # - The overload checked must have NO
         #   rest_positionals and NO trailing positionals —
         #   the two shapes under which argument N no longer
         #   binds to positional parameter N. Keyword
@@ -4096,16 +4178,14 @@ module Rigor
         #   OWN declared return, and the sibling override rules gate on `defined_on?` — this one did not.
         #   The inherited-declaration signal belongs to the ADR-35 family, which requires both sides
         #   authored. Decided in ADR-110 WD3.
-        # - Skips methods whose enclosing class isn't a `Type::Singleton` self_type that we can name
-        #   (top-level / module-level methods land outside the rule).
+        # - Skips methods whose enclosing `self` names no class (top-level methods land outside the rule).
         # - Skips methods whose body's last expression is absent or types as `Dynamic[top]` (the
         #   analyzer's fail-soft fallback) — emitting on `Dynamic[top]` would be noise.
         # - Compares the inferred body type against the declared return via `accepts?`:
         #     :yes   → silent
         #     :no    → emit at :error (severity_profile may re-stamp; default `balanced` keeps the
         #              authored severity).
-        #     :maybe → emit at :warning. Promoted to :error under `severity_profile: strict` per ADR-8 §
-        #              "Severity profile".
+        #     :maybe → silent (see {#compare_return}; ADR-8's `strict` promotion is deferred).
         def return_type_mismatch_diagnostic(path, def_node, scope_index)
           return nil if def_node.body.nil?
 
@@ -4241,9 +4321,9 @@ module Rigor
         # precision improvements.
         def compare_return(declared, inferred)
           result = declared.accepts(inferred)
-          return :error if result.no?
+          return nil unless result.no?
 
-          nil
+          :error
         end
 
         def build_return_type_mismatch_diagnostic(path, def_node, declared, inferred, severity)

data/lib/rigor/analysis/crash_signature.rb

@@ -149,8 +149,8 @@ module Rigor
 
       # True when `diagnostic` reports a failure inside Rigor that left the run readable but invalid as a
       # measurement of Rigor — see {ANALYZER_DEFECT_RULES}. Orthogonal to {.discards_file_analysis?}: the
-      # user-facing tier reads the run; the Rigor-measuring tier should refuse it (the mutation fuzz does,
-      # the ADR-69 kill oracle does not yet — #790).
+      # user-facing tier reads the run; the Rigor-measuring tier should refuse it (the mutation fuzz and the
+      # ADR-69 kill oracle both do, #790).
       def analyzer_defect?(diagnostic)
         ANALYZER_DEFECT_RULES.include?(diagnostic.rule)
       end

data/lib/rigor/analysis/dependency_recorder.rb

@@ -74,8 +74,8 @@ module Rigor
           @sources = Set.new
           @missing = Set.new
           # ADR-46 slice 4 — symbol-granularity tracking.
-          # `symbol_sources`: source_path → Set<"ClassName#method"> for method-call deps.
-          # `ancestry_sources`: Set<source_path> for class-ancestry (superclass / include) deps —
+          # `symbol_sources`: source_path → the "ClassName#method" names read from it, for method-call deps.
+          # `ancestry_sources`: the source paths read for class-ancestry (superclass / include) deps —
           # file-granularity by nature (a superclass edge touches the whole class).
           @symbol_sources = Hash.new { |h, k| h[k] = Set.new }
           @ancestry_sources = Set.new
@@ -103,8 +103,8 @@ module Rigor
       end
 
       # Frozen record of one file's cross-file reads.
-      # `symbol_sources`: source_path → frozen Set<"ClassName#method"> (method-call edges).
-      # `ancestry_sources`: frozen Set<source_path> (class-ancestry edges, file-granularity).
+      # `symbol_sources`: source_path → frozen set of "ClassName#method" names (method-call edges).
+      # `ancestry_sources`: frozen set of source paths (class-ancestry edges, file-granularity).
       Record = Data.define(:consumer, :sources, :missing, :symbol_sources, :ancestry_sources)
 
       # ADR-84 WD2 — a replayable, consumer-independent read-set: `reads` is a frozen Set of frozen

data/lib/rigor/analysis/dependency_source_inference/boundary_cross_reporter.rb

@@ -25,9 +25,9 @@ module Rigor
           @mutex = Mutex.new
         end
 
-        # @return frozen snapshot of the recorded boundary-cross events. Each entry is a Data
-        #   with `class_name` (String), `method_name` (Symbol), `gem_name` (String), and `rbs_display` (String
-        #   — the authoritative-side type's human-facing form, embedded into the diagnostic message).
+        # @return frozen snapshot of the recorded boundary-cross events. Each entry is a Data with `class_name`,
+        #   `method_name`, `gem_name`, and `rbs_display` (the authoritative-side type's human-facing form, embedded
+        #   into the diagnostic message).
         def entries
           @mutex.synchronize { @entries.dup.freeze }
         end
@@ -50,6 +50,17 @@ module Rigor
           end
         end
 
+        # The pool drain ({Rigor::Analysis::WorkerSession#drain_reporters}): the frozen entries.
+        def snapshot
+          entries
+        end
+
+        # Replays one worker's {#snapshot}; the record-time dedup collapses every worker's copy. Nil records
+        # nothing.
+        def absorb(snapshot)
+          Array(snapshot).each { |entry| record(**entry.to_h) }
+        end
+
         private
 
         def same_key?(existing, entry)

data/lib/rigor/analysis/dependency_source_inference/gem_resolver.rb

@@ -44,7 +44,7 @@ module Rigor
           Resolved.new(
             gem_name: entry.gem,
             version: spec.version.to_s,
-            gem_dir: spec.full_gem_path, # rigor:disable undefined-method
+            gem_dir: spec.full_gem_path,
             mode: entry.mode,
             roots: entry.roots
           )

data/lib/rigor/analysis/dependency_source_inference/index.rb

@@ -15,10 +15,9 @@ module Rigor
                     :class_to_gem, :budget_overrun_strategy, :gem_modes, :refinements, :bound_constants,
                     :bound_segments
 
-        # @param method_catalog — => Symbol}] the flat
-        #   `(class_name, method_name) → :instance | :singleton` table produced by {Walker.walk}, aggregated
-        #   across every resolved gem in the run. The Index itself stays gem-agnostic — the per-gem
-        #   attribution that slice 3's cache descriptor needs lives on `Resolved`, not here.
+        # @param method_catalog — the flat `(class_name, method_name) → CatalogEntry` table produced by
+        #   {Walker.walk}, aggregated across every resolved gem in the run. The Index itself stays gem-agnostic —
+        #   the per-gem attribution that slice 3's cache descriptor needs lives on `Resolved`, not here.
         # @param budget_exceeded — gem names whose {Walker} run hit the per-gem catalog cap
         #   (slice 4). The Runner consumes this list to emit one `dynamic.dependency-source.budget-exceeded`
         #   warning per gem.
@@ -110,10 +109,9 @@ module Rigor
           mode_for(class_name) == :full
         end
 
-        # Looks up the recorded method kind for a `(class_name, method_name)` pair. Returns `:instance` /
-        # `:singleton` when the walker observed a definition under one of the resolved gems' `roots:`, or
-        # `nil` otherwise. Slice 2b-ii enriches this with the inferred return type so the dispatcher tier can
-        # build a `Type::Dynamic` directly from the lookup result.
+        # Looks up the `CatalogEntry` (kind, and the heuristic return type) for a `(class_name, method_name)` pair.
+        # Returns it when the walker observed a definition under one of the resolved gems' `roots:`, or `nil`
+        # otherwise.
         def contribution_for(class_name:, method_name:)
           @method_catalog[[class_name, method_name]]
         end

data/lib/rigor/analysis/dependency_source_inference/walker.rb

@@ -99,10 +99,10 @@ module Rigor
         #   `Configuration::Dependencies::Entry`).
         # @param budget — per-gem catalog cap (method-definition count). When unset, defaults
         #   to `UNBOUNDED` for backwards-compatible test paths.
-        # @return frozen wrapper carrying the catalog (`Hash{[class_name, method_name] =>
-        #   :instance | :singleton}`) and a `truncated?` flag set when the walker stopped harvesting because
-        #   the budget was reached. Methods of identical name on the same class with different kinds (rare;
-        #   private API mostly) carry the kind that wins the per-class first walk.
+        # @return frozen wrapper carrying the catalog (keyed by `[class_name, method_name]`, valued by
+        #   {CatalogEntry}) and a `truncated?` flag set when the walker stopped harvesting because the budget was
+        #   reached. Methods of identical name on the same class with different kinds (rare; private API mostly)
+        #   carry the kind that wins the per-class first walk.
         def walk(gem_dir:, roots:, budget: UNBOUNDED)
           harvest = Harvest.new({}, {}, nil, nil, Set.new, Set.new)
           truncated = false

data/lib/rigor/analysis/edit_replay.rb

@@ -15,22 +15,108 @@ module Rigor
     #   into the closure. Emptying alone does not exercise that one: the broader key it fires re-checks the reader
     #   anyway. Not every finer edge is reached: dropping a body still moves a broader key for some of them. A
     #   `visibility:` edge is one (#2161's `module_function :two` to `private :two` swap passes both edits with the
-    #   edge removed), and only an edit that changes a body while keeping it (#2277) would test it.
+    #   edge removed), and only an edit that changes a body while keeping it would test it.
+    # - `dropped` (#2277) — the file with ONE statement of a `class` / `module` body removed and everything else kept,
+    #   so the declarations, the other definitions and every broader key stay as they were and a finer edge is the
+    #   only thing that re-checks a reader. At most {MAX_DROPS} statements per file: the visibility-changing calls
+    #   (`private`, `module_function`, ... {VISIBILITY_CALLS}) first, a body's own statements before those of the bodies
+    #   nested in it, since those are what finer edges such as #2161's `visibility:` read; then the other statements,
+    #   spread evenly over the file. A drop whose remainder does not parse (a heredoc body left behind) gives way to the
+    #   next candidate. Statements of a `class << self` body are never candidates.
     #
-    # Neither replays an addition or a body-changing edit. A skeleton identical to the file, or with no declaration
-    # (the emptied file again, or a file that does not parse), is not replayed.
+    # No edit is an addition. An edit identical to the file or to an earlier edit, or a file that does not parse
+    # (or, for the skeleton, declares nothing), is not replayed.
     module EditReplay
       Edit = Data.define(:label, :source)
 
+      # The most body-statement drops replayed per file; each is a recheck plus a full analysis.
+      MAX_DROPS = 2
+
+      VISIBILITY_CALLS = %i[
+        private public protected module_function private_class_method public_class_method
+        private_constant public_constant
+      ].freeze
+
       module_function
 
       # The edits to replay for `source`, in order.
       def edits(source)
         emptied = Edit.new(label: "emptying", source: "")
         reduced = skeleton(source)
-        return [emptied] if reduced.empty? || reduced == source
+        edits = [emptied]
+        edits << Edit.new(label: "reducing to its class/module skeleton", source: reduced) unless reduced.empty?
+        edits.concat(drops(source))
+        edits.reject { |edit| edit.source == source }.uniq(&:source)
+      end
+
+      # Up to {MAX_DROPS} edits, each `source` less one statement of a class / module body, in source order. A drop that
+      # leaves text that does not parse is never returned: the next candidate takes its place.
+      def drops(source)
+        result = Prism.parse(source)
+        return [] unless result.success?
+
+        picked = []
+        preferred(drop_candidates(result.value.statements.body)).each do |node|
+          edit = drop_edit(source, node)
+          picked << [node, edit] if edit
+          break if picked.size == MAX_DROPS
+        end
+        picked.sort_by { |node, _| node.location.start_offset }.map(&:last)
+      end
+
+      # `source` less `node`, or nil when what is left does not parse. The range runs to the furthest heredoc body
+      # inside the node, which sits after the node's own location.
+      def drop_edit(source, node)
+        location = node.location
+        from, to = whole_lines(source, location.start_offset, [location.end_offset, heredoc_end(node)].max)
+        dropped = source.byteslice(0, from) + source.byteslice(to..)
+        return nil unless Prism.parse(dropped).success?
+
+        Edit.new(label: "dropping the statement at line #{location.start_line} of", source: dropped)
+      end
+
+      # The end offset of the furthest heredoc terminator inside `node` (0 when it holds none).
+      def heredoc_end(node)
+        own = node.respond_to?(:closing_loc) && node.respond_to?(:opening_loc) &&
+              node.opening_loc&.slice&.start_with?("<<")
+        ends = node.compact_child_nodes.map { |child| heredoc_end(child) }
+        ends << node.closing_loc.end_offset if own && node.closing_loc
+        ends.max || 0
+      end
+
+      # The byte range of `start...finish` widened to the lines it alone occupies, so no blank line is left behind.
+      def whole_lines(source, start, finish)
+        head = source.byteslice(0, start)[/(?<=\A|\n)[ \t]*\z/]
+        tail = finish.positive? && source.getbyte(finish - 1) == 10 ? "" : source.byteslice(finish..)[/\A[ \t]*\n/]
+        head.nil? || tail.nil? ? [start, finish] : [start - head.bytesize, finish + tail.bytesize]
+      end
+
+      # Every statement directly in a `class` / `module` body of `nodes`, nested bodies included, in the order a body's
+      # own statements come before those of the bodies nested in it (a nested declaration is itself a candidate,
+      # dropped whole). A `class << self` body is never searched: its statements are not candidates.
+      def drop_candidates(nodes)
+        nodes.flat_map do |node|
+          next [] unless (node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode)) &&
+                         node.body.is_a?(Prism::StatementsNode)
+
+          body = node.body.body
+          [*body, *drop_candidates(body)]
+        end
+      end
+
+      # The candidates in the order to try them: the visibility calls, then the other statements from the evenly spread
+      # picks outward, then the rest of the other statements.
+      def preferred(candidates)
+        visibility, others = candidates.partition { |node| visibility_call?(node) }
+        spread = Array.new(others.empty? ? 0 : MAX_DROPS) do |index|
+          others[(((index * 2) + 1) * others.size) / (MAX_DROPS * 2)]
+        end
+        [*visibility, *spread, *others].uniq(&:object_id)
+      end
 
-        [emptied, Edit.new(label: "reducing to its class/module skeleton", source: reduced)]
+      def visibility_call?(node)
+        node.is_a?(Prism::CallNode) && VISIBILITY_CALLS.include?(node.name) &&
+          (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode))
       end
 
       # `source`'s `class` / `module` declarations, nested, with their bodies dropped; "" when it does not parse or
@@ -61,7 +147,8 @@ module Rigor
         superclass = node.superclass
         superclass ? "class #{node.constant_path.slice} < #{superclass.slice}" : "class #{node.constant_path.slice}"
       end
-      private_class_method :declarations, :header_of
+      private_class_method :declarations, :header_of, :drop_candidates, :whole_lines, :drop_edit, :heredoc_end,
+                           :preferred, :visibility_call?
     end
   end
 end