rigortype 0.4.7 → 0.4.8

data/docs/manual/04-diagnostics.md

@@ -67,7 +67,7 @@ carries no `documentation_url`.
 | <a id="rule-flow-return-in-ensure"></a>`flow.return-in-ensure` | An explicit `return` inside an `ensure` clause — it overrides the method's in-flight return value and silently swallows any in-flight exception. A `return` in a nested `def`, lambda, or `define_method` block inside the `ensure` does not fire (it exits that inner frame). | high |
 | <a id="rule-flow-shadowed-rescue-clause"></a>`flow.shadowed-rescue-clause` | A `rescue` clause can never run because an earlier clause of the same chain already catches a superclass (or the same class) of every exception class it names. | high |
 | <a id="rule-def-return-type-mismatch"></a>`def.return-type-mismatch` | The method body's result violates its declared RBS return type. | medium |
-| <a id="rule-def-ivar-write-mismatch"></a>`def.ivar-write-mismatch` | An instance variable is written with a type disagreeing with its first write, unless its RBS declaration (`@x: T` or an `attr_*` member) admits both writes. With `rigor-actionpack` or `rigor-actionmailer` loaded, writes in two different actions of a controller or mailer are not compared, since Rails runs one action per instance. A write in a private or protected helper, `initialize` or the same action still is, and so is one in a callback target or `helper_method` that a macro in the same file names. A public method named only by a macro in another file or a concern, or reached through a lambda callback, counts as an action, and so does an action another action calls. | high |
+| <a id="rule-def-ivar-write-mismatch"></a>`def.ivar-write-mismatch` | An instance variable is written with a type disagreeing with its first write, unless its RBS declaration (`@x: T` or an `attr_*` member) admits both writes. A write in a block whose `self` is provably another object (`Other.new.instance_eval { @x = 1 }`, `Class.new { … }`, `X.class_eval { … }`, a `class << obj` body) sets that object's variable and is not compared. With `rigor-actionpack` or `rigor-actionmailer` loaded, writes in two different actions of a controller or mailer are not compared, since Rails runs one action per instance. A write in a private or protected helper, `initialize` or the same action still is, and so is one in a callback target or `helper_method` that a macro in the same file names. A public method named only by a macro in another file or a concern, or reached through a lambda callback, counts as an action, and so does an action another action calls. | high |
 | <a id="rule-def-method-visibility-mismatch"></a>`def.method-visibility-mismatch` | An explicit-receiver call reaches a private method. | high |
 | <a id="rule-def-override-visibility-reduced"></a>`def.override-visibility-reduced` | An override reduces the visibility it inherits from a project-defined ancestor. | high |
 | <a id="rule-def-override-return-widened"></a>`def.override-return-widened` | An override's declared return type widens the inherited return (covariance). | high |
@@ -75,9 +75,10 @@ carries no `documentation_url`.
 | <a id="rule-global-write-type-mismatch"></a>`global.write-type-mismatch` | A special global is assigned a literal its setter rejects, so the write raises `TypeError` every time it runs. `$/`, `$-0`, `$,` and `$\` take only a String or nil (`$/ = 1` and `$/ = /x/` report). `$;` and `$-F` take a String, a Regexp, nil, or an object with `to_str`. `$~` takes a MatchData or nil. `$0` and `$PROGRAM_NAME` take a String or an object with `to_str`, so `$0 = nil` and `$0 = :name` report. `$.` takes an Integer, a Float, or an object with `to_int`, so `$. = "3"` reports and `$. = 3r` does not. `$-i` takes a String, nil, false, or an object with `to_str`. `$stdout`, `$>` and `$stderr` take anything that responds to `write`: `$stdout = 1` reports, `$stdout = StringIO.new` does not. Ruby's setter decides, not the global's RBS type. Only a value written as a literal is judged — a number, a string, a symbol, an array, a hash or a regexp literal (interpolated or not), or `nil`, `true` or `false` — so a variable, a method call or a constant never reports, whatever its type. A literal stays silent when your program defines the method the setter asks for (`write`, `to_str`, `to_int`) or a `method_missing` / `respond_to_missing?` / `respond_to?` anywhere, in any spelling and on any class — Rigor cannot always tell which objects such a definition reaches, so it does not try — or when a top-level `include` / `extend` or an ancestor's `include` names a module Rigor has no RBS for. For `$stdout`, `$>` and `$stderr` it also stays silent where a `using` is in effect for a refinement that may add `write`. `$/`, `$-0`, `$,`, `$\` and `$~` accept only their classes, so none of that silences them. A write to `$stdin` is never checked, and a special any file aliases (`alias $stdout $out`, including a `pre_eval:` file) is exempt. `warning` under `lenient`. | high |
 | <a id="rule-global-readonly-write"></a>`global.readonly-write` | A read-only special global is written — `$!`, `$$`, `$?`, `$<`, `$FILENAME`, `$*`, `$:` / `$LOAD_PATH` / `$-I`, `$"` / `$LOADED_FEATURES`, `$-W`, `$-p`, `$-l` or `$-a` — which raises `NameError` whatever the value. Covers `$g = value`, `$g += value` and a multiple-assignment target. `$LOAD_PATH ||= []` never writes and `$LOAD_PATH << dir` is a method call, so neither fires. A special any file aliases (`alias $! $err`) is exempt. An error in every profile. | high |
 | <a id="rule-static-value-use-void"></a>`static.value-use.void` | A value recovered from an author-declared `-> void` return is used in value context (an assignment right-hand side, a call receiver, or a call argument). Off by default; reaches a run only through the `use-of-void-value` bleeding-edge feature (ADR-100). A bare-statement `void` call and a legitimate `top` value both stay silent. | high |
+| <a id="rule-plugin-api-surface"></a>`plugin.api-surface` | Plugin code (inside a class that inherits `Rigor::Plugin::Base`) calls a member that a `Rigor::Plugin` interface (`_Scope`, `_Environment`, `_Services`, `_FactStore`, `_Configuration`) does not declare, on a value that interface types: a hook's `scope`, `scope.environment`, and so on. The engine object answers the call today, but it is outside the plugin API Rigor promises to keep, so call a member the interface declares (`sig/rigor/plugin/interfaces.rbs`) or a public namespace instead. Off by default; reaches a run through the `plugin-api-surface` bleeding-edge feature (ADR-128), or a `severity_overrides:` key naming `plugin.api-surface` itself (a bare `plugin` key does not reach it). Calls of members every object has (`nil?`, `respond_to?`) and values that lost the interface type (a helper parameter with no signature, a join with an untyped value) stay silent; a call a `respond_to?` guard protects still reports. | high |
 | <a id="rule-effect-envelope-exceeded"></a>`effect.envelope-exceeded` | A method performs an effect its declared envelope does not admit — its proven effect labels (its own body plus everything it calls) are not covered by the `%a{pure}` or `%a{rigor:v1:effect …}` bound written on it or on its class. Opt-in twice over: it needs an `effects:` block in `.rigor.yml` and an envelope you wrote. Positioned at the Ruby `def`. Unproven ("and possibly more") effects never fire, and `mutate.local` is tolerated by every envelope. | high |
 | <a id="rule-effect-liskov-widened"></a>`effect.liskov-widened` | An override escapes the envelope written on the method it overrides. A `PgRepo` is usable wherever a `Repo` is, so a `%a{rigor:v1:effect io.db}` on `Repo#find` binds `PgRepo#find` too: an implementation may be purer than the bound it inherits, never less pure. Either what the override *does* exceeds the inherited bound, or the envelope the override *declares for itself* is wider than it. Both sides must be authored — nothing fires unless someone wrote an envelope on the ancestor — and only subclassing counts, not `include`. Positioned at the override's `def`. Needs an `effects:` block. | high |
-| <a id="rule-effect-unknown-label"></a>`effect.unknown-label` | An effect declaration names a label the registry does not know — a typo in an envelope (`%a{rigor:v1:effect io.bd}`), or a member of `effects.tolerated:`. The whole tag then reads as unbounded, so the declaration quietly stops doing anything; this says so. Positioned at the declaration: the `.rbs` line, the `.rb` line for an rbs-inline annotation, or `.rigor.yml` for a config value. `# rigor:disable` comments are not read out of `.rbs` or `.rigor.yml`, so use `disable:` or the baseline there. Only fires where the spelling is evidently meant to be a label (close to a known one, next to a known one, dotted, or retired) — a word nothing resembles stays silent, because you may be opening your own vocabulary. Needs an `effects:` block. | high |
+| <a id="rule-effect-unknown-label"></a>`effect.unknown-label` | An effect declaration names a label the registry does not know — a typo in an envelope (`%a{rigor:v1:effect io.bd}`), or a member of `effects.tolerated:`. The whole tag then reads as unbounded, so the declaration quietly stops doing anything; this says so. Positioned at the declaration: the `.rbs` line, the `.rb` line for an rbs-inline annotation, or the loaded configuration file (`.rigor.yml` when none was loaded) for a config value. `# rigor:disable` comments are not read out of `.rbs` or `.rigor.yml`, so use `disable:` or the baseline there. Only fires where the spelling is evidently meant to be a label (close to a known one, next to a known one, dotted, or retired) — a word nothing resembles stays silent, because you may be opening your own vocabulary. Needs an `effects:` block. | high |
 | <a id="rule-effect-annotations-unchecked"></a>`effect.annotations-unchecked` | Your signatures carry `%a{pure}` / `%a{rigor:v1:effect …}` but `.rigor.yml` has no `effects:` block, so nothing checks them. One `:info` per run, positioned at the first annotation. An annotation never turns effect collection on by itself — that would make one line in one file more expensive for every run — so this is how it tells you instead. Add `effects: {}` to opt in, or `disable:` it to keep the annotations documentary. Reads both annotation lanes — `sig/*.rbs` and rbs-inline comments — on every run, a warm `--incremental` with nothing changed included. | — |
 | <a id="rule-rbs-contradicting-signature"></a>`rbs.contradicting-signature` | A method is declared both in your `sig/` and by an inline `# @rbs` / `#:` annotation, and the two provably contradict — no value or call satisfies both: in the return or a parameter every call must pass, the two types share no value (`::String` against `::Integer`). Only absolutely written Ruby core or stdlib classes count: a module such as `Comparable`, a class your project declares, a gem's class, or a relative name like plain `String` never does, or two keyword-free declarations accept positional counts that cannot meet, or one requires a keyword the other cannot take in any form. Overloads are paired by correspondence, not order. Also fires when a member-level `%a{rigor:v1:return: …}` / `%a{rigor:v1:param: …}` refinement shares no value with the type its own member declares. Positioned at the `.rbs` member; Rigor reads that declaration. A stale generated signature is the usual cause: regenerate it, or fix the annotation. Two declarations where one refines the other merge to the more precise one without a word, and a pair Rigor cannot rank drops the inline side with a `source-rbs-annotation-not-honoured` `:info` instead ([Precedence](plugins/rigor-rbs-inline.md#precedence)). An error in every profile. | high |
 | <a id="rule-suppression-unknown-rule"></a>`suppression.unknown-rule` | A `# rigor:disable[-file]` comment names a rule that does not exist (typically a typo), so the suppression silently does nothing. `plugin.`-prefixed tokens are never flagged. | high |
@@ -130,7 +131,7 @@ re-stamps it for the run. Three profiles, set with the
 | --- | --- |
 | `lenient` | Only proven diagnostics are errors; uncertain ones drop to `warning` / `info`. For incremental adoption on legacy code. |
 | `balanced` *(default)* | Most rules `error`; `dump.type` `info`; uncertain rules `warning`. |
-| `strict` | Nearly every rule is an `error`. The exceptions: `call.self-undefined-method` and `static.value-use.void` stay `off` (both opt-in only), `flow.unreachable-clause` stays `warning` pending its false-positive gate, and the three `suppression.*` rules stay `warning` — a stale suppression comment is worth telling you about, but it is not a reason to fail a build. CI-friendly. |
+| `strict` | Nearly every rule is an `error`. The exceptions: `call.self-undefined-method`, `static.value-use.void` and `plugin.api-surface` stay `off` (all three opt-in only), `flow.unreachable-clause` stays `warning` pending its false-positive gate, and the three `suppression.*` rules stay `warning` — a stale suppression comment is worth telling you about, but it is not a reason to fail a build. CI-friendly. |
 
 Under `balanced`, the rules that do **not** emit as `error`
 are:
@@ -139,7 +140,7 @@ are:
 | --- | --- |
 | `warning` | `call.unresolved-toplevel`, `def.ivar-write-mismatch`, `def.return-type-mismatch`, `def.override-visibility-reduced`, `def.override-return-widened`, `def.override-param-narrowed`, `flow.unreachable-branch`, `flow.always-truthy-condition`, `flow.dead-assignment`, `flow.duplicate-hash-key`, `flow.return-in-ensure`, `flow.shadowed-rescue-clause`, `suppression.unknown-rule`, `suppression.empty`, `suppression.unknown-marker`, `effect.envelope-exceeded`, `effect.liskov-widened` |
 | `info` | `flow.unreachable-clause`, `dump.type`, `effect.unknown-label`, `effect.annotations-unchecked` |
-| `off` | `call.self-undefined-method`, `static.value-use.void` |
+| `off` | `call.self-undefined-method`, `static.value-use.void`, `plugin.api-surface` |
 
 Everything else emits as `error`. For one rule under all three
 profiles, `rigor explain <rule>` prints `Authored severity:` and

data/docs/manual/08-skills.md

@@ -80,6 +80,17 @@ is not repeated here.)
   minimal hand-RBS residual, under a double gate (the site becomes
   protected *and* `rigor check` gains no new diagnostic). See
   [Type-protection coverage](15-type-protection-coverage.md).
+- **`rigor-rbs-contract`** — audits, repairs, and extends RBS
+  declarations as *contracts*: a gem's own `sig/`, an application's
+  `sig/`, or an entry contributed to `ruby/gem_rbs_collection`. It finds
+  where a declaration and the code disagree (`rigor check`'s
+  `def.return-type-mismatch`, `rigor sig-gen --diff`, use-site checks,
+  the library's documentation), changes a declaration only on cited
+  evidence, keeps a declared `void` unless the library documents a
+  value, and proves each change with a use-site test. On your own code
+  it asks you the contract questions the evidence leaves open; on a gem
+  you do not own, the gem's documentation decides. See
+  [ADR-131](../adr/131-declarations-are-contracts.md).
 - **`rigor-baseline-reduce`** — works an existing `.rigor-baseline.yml`
   down rule by rule. It prioritises with `rigor triage`, classifies each
   site as a real bug / safe stylistic finding / false positive, and

data/docs/manual/09-editor-integration.md

@@ -35,6 +35,14 @@ install channels in [Installing Rigor](01-installation.md) provide it;
 `mise` is the recommended one because its shims make `rigor` available
 to GUI-launched editors that do not inherit your shell environment.
 
+The [VS Code extension](../../editors/vscode/README.md) also finds a
+mise or asdf shim when `rigor` is not on `PATH`. When it finds no
+`rigor` at all, it offers to install a **managed Rigor** into its own
+storage with a Ruby 4.0 already on the machine, and uses it as its
+last resort; a project that pins `rigortype` in `Gemfile.lock`,
+`mise.toml` or `.tool-versions` is never served by it. See the
+extension README's *Server discovery*.
+
 Do **not** add `rigortype` to your project's `Gemfile`. Rigor is a
 tool, not a library — installing it standalone keeps its Ruby version
 and its dependencies out of your application's resolution. See

data/docs/manual/14-rails-quickstart.md

@@ -61,7 +61,7 @@ mise use gem:rigortype
 ```
 
 `mise use` records the chosen versions in a `mise.toml` in the
-current directory and installs them in one step. Verify:
+current directory and installs them in one step. Rails projects with Steep or `rbs_rails` list `rbs` in the bundle, and the `rbs` that `gem:rigortype` puts on `PATH` can shadow it; see the [install guide's note on `rbs` shadowing](../install.md#case-a--mise-is-available-recommended) before running `bundle exec rbs`. Verify:
 
 ```sh
 rigor --version

data/docs/manual/19-effect-labels.md

@@ -108,10 +108,9 @@ annotations and no block gets told so, once per run:
 sig/slug.rbs:2:1: info: Effect annotations (`%a{pure}` / `%a{rigor:v1:effect …}`) are present in your project's signatures, but `.rigor.yml` carries no `effects:` block, so effect collection never runs and nothing checks them — they are documentation, not a contract. Add `effects: {}` to have Rigor prove what your methods do and check these bounds against it (ADR-103); an annotation alone never turns collection on, because that would make one line in one signature file more expensive for every run of the project.
 ```
 
-From **v0.4.0** collection is the default: a config with no `effects:` key at
-all behaves as `effects: {}`, and `effects: false` is how you opt out. On the
-`0.3.x` line you can preview that with
-`bleeding_edge: [effects-on-by-default]`.
+From **v0.5.0** collection is the default: a config with no `effects:` key at
+all behaves as `effects: {}`, and `effects: false` is how you opt out. Until
+then you can preview that with `bleeding_edge: [effects-on-by-default]`.
 
 One exception to all of this: `rigor effects` — the bare report — runs under an
 implicit empty block whether or not you configured one, so you can look before

data/docs/manual/plugins/rigor-actionpack.md

@@ -399,12 +399,21 @@ diff — not a policy scoped to `app/views/**/*`. See
   those producers widens what this plugin can check.
 - **`params[:key]` is a gradual carrier.** Inside a controller,
   `params` types as `ActionController::Parameters`, and so does the
-  result of every builder method that always returns one — `require`,
-  `permit`, `permit!`, `expect`, `slice`, `slice!`, `except`,
-  `without`, `extract!`, `merge`, `merge!`, `reverse_merge`,
-  `reverse_merge!`, `with_defaults`, `with_defaults!`, `compact`,
-  `compact_blank`, `deep_dup` — so a chain built from them keeps a
-  concrete receiver throughout. A subscript read answers
+  result of every builder method that always returns one — `permit`,
+  `permit!`, `slice`, `slice!`, `except`, `without`, `extract!`,
+  `merge`, `merge!`, `reverse_merge`, `reverse_merge!`,
+  `with_defaults`, `with_defaults!`, `compact`, `compact_blank`,
+  `deep_dup` — when the receiver is `params` itself. A carrier
+  (`params[:tags]`) may hold an Array or a String at runtime, so a
+  builder call on one answers the carrier too, except `permit` and
+  `permit!`, which no core class defines and which answer `Parameters`.
+  `require`
+  and `expect` are different: Rails returns the value itself, which
+  can be a scalar (`params.require(:id).to_sym`), so they answer the
+  same `Dynamic[ActionController::Parameters]` carrier (#2947). A
+  `permit` or `permit!` after one (`params.require(:user).permit(:name)`)
+  still types as `Parameters`; other chain methods off a carrier stay
+  the carrier. A subscript read answers
   `Dynamic[ActionController::Parameters | nil]` (#2430): the static
   facet is the nilable `Parameters`, so `params[:user][:name]` and
   `params[:user].permit(:name)` keep dispatching on that facet, and

data/docs/manual/plugins/rigor-activesupport-core-ext.md

@@ -53,6 +53,9 @@ Roughly the top ~40 selectors plus their close neighbours, across:
   `TrueClass` / `FalseClass`).
 - **Integer / Float** — Duration multipliers (`#days`, `#hours`,
   `#minutes`, …) and Bytes multipliers (`#megabytes`, `#gigabytes`, …).
+- **Integer / Float / BigDecimal** — `#to_fs` / `#to_formatted_s`
+  (`NumericWithFormat`: a Symbol format, an Integer radix or a String
+  format, and the no-argument `to_s` form).
 - **String** — inflections (`#underscore`, `#camelize`, `#classify`,
   `#constantize`, `#pluralize`, …), filters (`#squish`, `#truncate`),
   `#html_safe`, `#starts_with?` / `#ends_with?` (also on **Symbol**),

data/docs/manual/plugins/rigor-sorbet.md

@@ -61,9 +61,23 @@ The plugin also types the annotation DSL's own expressions
 `T::Struct` subclass still needs the subclass's own `extend T::Sig`,
 matching the runtime) through a bundled
 `sorbet-runtime` RBS surface — so the sig DSL no longer reads as
-`Dynamic[top]` on a Sorbet codebase. What it does not model:
-`T::Struct` does not synthesise `prop`-declared readers (a
-`Doc#name` accessor still reads opaque), `include T::Props` does
+`Dynamic[top]` on a Sorbet codebase.
+
+On a `T::Struct`, `T::InexactStruct` or `T::ImmutableStruct`
+subclass, `prop :name, Type` and `const :name, Type` at the top
+level of the class body give `obj.name` the translated `Type`
+(`T.nilable(String)` reads `String?`; a form outside the table
+reads `Dynamic[top]`), and `prop` also answers `obj.name = v`.
+A relative constant in `Type` resolves from the class body's
+namespaces outward, and one that names no known class reads
+`Dynamic[top]`.
+A `const` has no writer, so `obj.name = v` still reports.
+Subclasses inherit the accessors, a `def` of the same name in
+the class body wins over the macro, and a `prop` nested under an
+`if` or a block reads `Dynamic[top]`. A `prop` call in a class
+outside the struct family defines nothing.
+
+What it does not model: `include T::Props` does
 not confer the `ClassMethods` surface (only the `< T::Struct`
 subclass path does), and the deeper type-member machinery
 (`T.attached_class` variance, `type_member` bounds) is not

data/lib/rigor/analysis/check_rules/always_raises_shield.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../reflection"
+require_relative "../../source/node_children"
+require_relative "../../type"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # Issue #3036 — answers, for a call node `flow.always-raises` proved raises, whether an enclosing
+      # `begin` (or `def … rescue … end`, which Prism wraps in the same `BeginNode`) catches the raise
+      # before it escapes. When a rescue clause may catch the raised class the exception flows to the
+      # handler, so the rule stays silent.
+      #
+      # The check is deliberately conservative in BOTH directions:
+      #
+      # - it suppresses only when a clause NAMES a class the raised class orders at-or-below
+      #   (`rescue ZeroDivisionError`, `rescue StandardError`, `rescue Exception`, or a bare `rescue`,
+      #   which is `StandardError`), resolved through the typer so lexical constant lookup applies. An
+      #   exception reference that is not a constant (`rescue *ERRORS`, `rescue klass`) contributes no
+      #   coverage, and an unresolvable / `:unknown` ordering keeps the diagnostic — a wrong silence is
+      #   worse than a kept finding.
+      # - it never crosses a body boundary ({BODY_BOUNDARIES}): a `def`, `->`, or block body runs when
+      #   called, not while the `begin` body evaluates, and `BEGIN` / `END` blocks run on their own
+      #   schedule, so an outer rescue cannot be proven to see their raise. Class / module bodies are
+      #   NOT boundaries — they evaluate inline, so their raises DO reach the enclosing rescue.
+      #
+      # Prism nodes carry no parent pointers, so ancestry is answered from a `node => parent` table
+      # built lazily on the first query: a file with no zero-division candidate never pays for it.
+      class AlwaysRaisesShield
+        # The exception class the rule proves today — Integer `/# % div modulo divmod` by a literal
+        # zero divisor. A rescue catches it when the clause names the class itself or an ancestor.
+        RAISED_CLASS = "ZeroDivisionError"
+
+        # The implicit class of a bare `rescue` / `rescue => e`.
+        BARE_RESCUE_CLASS = "StandardError"
+
+        # Node classes whose bodies do not execute inside the enclosing `begin` — see the class
+        # comment. Mirrors the deferred-body set `Inference::ScopeIndexer` already tracks.
+        BODY_BOUNDARIES = [
+          Prism::DefNode, Prism::LambdaNode, Prism::BlockNode,
+          Prism::PreExecutionNode, Prism::PostExecutionNode
+        ].freeze
+
+        def initialize(root)
+          @root = root
+          @parent_map = nil
+        end
+
+        # True when `node` sits in the protected body of a `begin` whose rescue chain may catch
+        # {RAISED_CLASS}. `scope` is the scope recorded for `node`; it resolves the clause's exception
+        # constants lexically. A nil scope or a node outside `root`'s subtree answers false.
+        def rescued?(node, scope)
+          return false if scope.nil?
+
+          parents = parent_map
+          child = node
+          current = parents[node]
+          while current
+            return true if protected_body?(current, child, scope)
+            return false if BODY_BOUNDARIES.any? { |klass| current.is_a?(klass) }
+
+            child = current
+            current = parents[current]
+          end
+          false
+        end
+
+        private
+
+        # True when `node` is a `begin` whose protected body (`statements`) contains `child` — the
+        # ascent arrived through the body rather than through a rescue / else / ensure clause, whose
+        # raises this `begin` does not catch — and whose rescue chain may catch {RAISED_CLASS}. When
+        # the chain does NOT catch, the ascent continues: an outer `begin` may still.
+        def protected_body?(node, child, scope)
+          return false unless node.is_a?(Prism::BeginNode)
+          return false unless child.equal?(node.statements)
+          return false if node.rescue_clause.nil?
+
+          rescue_chain_catches?(node.rescue_clause, scope)
+        end
+
+        # Any clause of the `rescue … rescue …` chain may catch — clauses are tried in order and the
+        # first match wins, so one catching clause is enough.
+        def rescue_chain_catches?(clause, scope)
+          while clause
+            return true if rescue_clause_catches?(clause, scope)
+
+            clause = clause.subsequent
+          end
+          false
+        end
+
+        # One `rescue` clause catches {RAISED_CLASS} when any class it names orders at-or-above the
+        # raised class. A bare `rescue` names {BARE_RESCUE_CLASS}.
+        def rescue_clause_catches?(clause, scope)
+          exceptions = clause.exceptions
+          return class_catches?(BARE_RESCUE_CLASS, scope) if exceptions.empty?
+
+          exceptions.any? do |exception|
+            class_name = exception_class_name(exception, scope)
+            class_name && class_catches?(class_name, scope)
+          end
+        end
+
+        # The class a rescue exception reference names, or nil when it is not a constant path (a splat,
+        # a dynamic expression) or does not resolve to a class object. Only `Type::Singleton` counts:
+        # the rescue operand is the class itself, and an instance-typed constant cannot be proven to
+        # match.
+        def exception_class_name(node, scope)
+          return nil unless node.is_a?(Prism::ConstantReadNode) || node.is_a?(Prism::ConstantPathNode)
+
+          type = scope.type_of(node)
+          type.class_name if type.is_a?(Type::Singleton)
+        end
+
+        # `class_ordering(raised, rescued)`: `:equal` / `:subclass` mean the rescued class IS the raised
+        # class or an ancestor of it — the clause catches. `:superclass`, `:disjoint`, and `:unknown`
+        # all keep the diagnostic.
+        def class_catches?(rescued_class, scope)
+          %i[equal subclass].include?(
+            Rigor::Reflection.class_ordering(RAISED_CLASS, rescued_class, scope: scope)
+          )
+        end
+
+        # `node => parent` for every descendant of `root`, built on first use. Iterative so a deeply
+        # nested file cannot overflow the stack the way a recursive walk could.
+        def parent_map
+          @parent_map ||= begin
+            parents = {}
+            stack = [@root]
+            until stack.empty?
+              node = stack.pop
+              node.rigor_each_child do |child|
+                parents[child] = node
+                stack << child
+              end
+            end
+            parents
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/call_facts.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # Issue #2786 — what the per-call-node rules ({CheckRules.call_node_diagnostics}) each derived on their own:
+      # the call node's index scope, the type of its receiver under that scope, and the RBS signature the call
+      # resolves to on that receiver. One object per call node is built before the rules run and handed to every
+      # rule that reads them.
+      #
+      # The receiver type is computed lazily, on the first rule that asks, from the same `(scope, node)` pair each
+      # rule typed before: `scope_index[call_node]` and `call_node.receiver`. Every later rule reads that value
+      # instead of re-typing the receiver chain. This is not a memo over `type_of`: nothing is served across call
+      # nodes or across scopes, and no fact is computed anywhere but at the first point a rule computed it before.
+      # It rests on the `Scope#type_of` contract that one `(scope, node)` pair types structurally equal within a run
+      # *under the same ambient inputs* (`docs/internal-spec/inference-engine.md`), which holds here because of
+      # an invariant of the rule list: between the first rule that types the receiver and the last that reads it, no
+      # frame is installed and nothing types a node inside the receiver's subtree under another state or adds an
+      # `optimistic_origins` mark there. The other typings in that window are the call's arguments (outside the
+      # subtree), `receiver.receiver` under the same scope (which rewrites what the receiver's typing already
+      # wrote), and the key-presence re-walk, which runs on `with_isolated_side_tables`. A rule inserted between
+      # two readers that breaks this must type the receiver itself.
+      #
+      # Of the typing, only the receiver is shared. A rule that types a sub-expression (`receiver.receiver`), an
+      # argument, or any node under a scope other than the call's keeps its own `type_of` call: arguments are typed
+      # from their own index entry by `call.argument-type-mismatch` and from the call's by `flow.always-raises`, and
+      # the two meet only on a divisor.
+      class CallFacts
+        attr_reader :call_node, :scope_index, :scope
+
+        def initialize(call_node, scope_index)
+          @call_node = call_node
+          @scope_index = scope_index
+          @scope = scope_index[call_node]
+          @receiver_type = nil
+          @receiver_signature = nil
+          @receiver_signature_resolved = false
+        end
+
+        # `scope.type_of(call_node.receiver)`, computed once. Callers check that the call has a receiver and that
+        # {#scope} is not nil first, as they did before sharing it.
+        def receiver_type
+          @receiver_type ||= @scope.type_of(@call_node.receiver)
+        end
+
+        # The signature `CheckRules.receiver_signature` resolves, its block run on the first ask only. A nil answer
+        # is remembered too. A block that raises leaves it unresolved, so the next ask raises as it did before.
+        def receiver_signature
+          return @receiver_signature if @receiver_signature_resolved
+
+          signature = yield
+          @receiver_signature_resolved = true
+          @receiver_signature = signature
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/declaration_sourced_guard.rb

@@ -59,6 +59,14 @@ module Rigor
           end
         end
 
+        # Issue #2656 — true when `node` reads a local a class guard narrowed from a `Dynamic` value
+        # ({Scope#with_gradual_narrowing_mark}). `call.argument-type-mismatch` judges such an argument by its class
+        # rather than against the parameter's literals (`CheckRules#gradual_narrowing_accepted?`); the other rules
+        # read the narrowed `Nominal` as before.
+        def gradual_narrowed?(node, scope)
+          node.is_a?(Prism::LocalVariableReadNode) && scope.gradual_narrowing?(node.name)
+        end
+
         # The globals whose declared seeds `node` still reads, empty for none: a read of a marked global, or of a
         # local copied from one or more (`sep = $/`, `Scope#declaration_sourced_global_copies`), bare or in
         # parentheses (`($stdout)`).

data/lib/rigor/analysis/check_rules/ivar_write_collector.rb

@@ -6,6 +6,7 @@ require_relative "rule_walk"
 require_relative "../../scope/resolution_chain"
 require_relative "../../source/constant_path"
 require_relative "../../source/node_children"
+require_relative "../../inference/census_foreign_block"
 
 module Rigor
   module Analysis
@@ -28,6 +29,9 @@ module Rigor
       #   doesn't yet model.
       # - Nested classes / modules / defs inside a method body are barriers, mirroring the indexer's
       #   `IVAR_BARRIER_NODES` policy.
+      # - Issue #2943: a write directly in a block or `class << obj` body whose `self` is provably not an instance
+      #   of the class (`Other.new.instance_eval { @r = 1 }`), by the class-ivar census's rule
+      #   ({Inference::CensusForeignBlock}).
       class IvarWriteCollector
         BARRIER_NODES = [Prism::DefNode, Prism::ClassNode, Prism::ModuleNode].freeze
         private_constant :BARRIER_NODES
@@ -156,7 +160,8 @@ module Rigor
 
         def collect_def_writes(def_node, qualified_prefix)
           return if def_node.body.nil? || qualified_prefix.empty?
-          return if def_node.receiver.is_a?(Prism::SelfNode)
+          # A def with a receiver writes the ivars of another object than an instance (#3155).
+          return if def_node.receiver
 
           class_name = qualified_prefix.join("::")
           gather_writes(def_node.body, class_name, def_node.name)
@@ -168,7 +173,13 @@ module Rigor
           record_write(node, class_name, method_name) if node.is_a?(Prism::InstanceVariableWriteNode)
           return if BARRIER_NODES.any? { |klass| node.is_a?(klass) }
 
-          node.rigor_each_child { |child| gather_writes(child, class_name, method_name) }
+          # #2943 — a block or `class <<` body whose `self` is provably another object writes that object's ivars, as
+          # the class-ivar census reads it ({Inference::CensusForeignBlock}); a `define_method` block nested in it that
+          # runs on an instance again still counts. A `def` it reenters stays a barrier here.
+          children = Inference::CensusForeignBlock.census_children(node, class_name)
+          return node.rigor_each_child { |child| gather_writes(child, class_name, method_name) } unless children
+
+          children.each { |child| gather_writes(child, class_name, method_name) }
         end
 
         def record_write(node, class_name, method_name)

data/lib/rigor/analysis/check_rules/lexical_method_sites.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../../inference/scope_indexer"
 require_relative "../../source/node_children"
 require_relative "rebinding_block_callees"
+require_relative "replaced_singleton_defs"
 
 module Rigor
   module Analysis
@@ -42,6 +43,11 @@ module Rigor
 
         def refinements = (@refinements ||= Inference::InEffectRefinements.new(@root))
 
+        # Issue #3155 — the file's singleton defs a later certain def replaces, for `def.return-type-mismatch`.
+        def replaced_singleton_defs(scope_index)
+          @replaced_singleton_defs ||= ReplacedSingletonDefs.new(@root, scope_index)
+        end
+
         # Issue #1817 — the file's block-passing calls, for `call.unresolved-toplevel`'s rebinding-callee decline.
         def block_calls = (@block_calls ||= RebindingBlockCallees::Sites.new(@root))