rigortype 0.1.17 → 0.1.19

data/lib/rigor/configuration/severity_profile.rb

@@ -130,14 +130,26 @@ module Rigor
       #   Keys are canonical rule ids; values are
       #   {VALID_SEVERITIES} symbols. Family-wildcard keys
       #   (`call`) match every rule under that prefix.
+      # @param bleeding_edge_overrides [Hash{String => Symbol}] the
+      #   severity map imposed by the active ADR-50 § WD2 bleeding-edge
+      #   features ({Rigor::BleedingEdge.severity_overrides_for}).
+      #   Consulted *below* the user's own `overrides` (so an explicit
+      #   `severity_overrides:` entry, exact or family wildcard, always
+      #   wins) and *above* the profile table. Exact rule ids only — the
+      #   overlay never carries family wildcards. Empty while the
+      #   overlay is unpopulated, so the default leaves resolution
+      #   bit-for-bit unchanged.
       # @return [Symbol] the resolved severity. Returns `:off` to
       #   mean "drop the diagnostic entirely".
-      def resolve(rule:, authored_severity:, profile: DEFAULT_PROFILE, overrides: {})
+      def resolve(rule:, authored_severity:, profile: DEFAULT_PROFILE, overrides: {}, bleeding_edge_overrides: {})
         return authored_severity if rule.nil?
 
         override = overrides[rule] || family_override(rule, overrides)
         return override.to_sym if override
 
+        bleeding = bleeding_edge_overrides[rule]
+        return bleeding.to_sym if bleeding
+
         profile_table = PROFILES[profile] || PROFILES.fetch(DEFAULT_PROFILE)
         profile_table.fetch(rule, authored_severity)
       end

data/lib/rigor/configuration.rb

@@ -2,6 +2,7 @@
 
 require "yaml"
 
+require_relative "bleeding_edge"
 require_relative "configuration/dependencies"
 require_relative "configuration/severity_profile"
 
@@ -70,12 +71,15 @@ module Rigor
       "fold_platform_specific_paths" => false,
       "cache" => {
         "path" => ".rigor/cache",
-        # LRU eviction cap in bytes. nil (the default) disables eviction;
-        # the cache grows until the user runs `rigor check --clear-cache`.
-        # Set to a positive integer (e.g. 536870912 for 512 MB) to keep the
-        # cache bounded — the least-recently-used entries are removed at the
-        # end of each run when the total exceeds this limit.
-        "max_bytes" => nil
+        # LRU eviction cap in bytes (ADR-54 WD3). The least-recently-used
+        # entries are removed at the end of a run when the total exceeds
+        # this limit. The 256 MB default exists to reap orphans — entries
+        # whose content key nothing references any more (an rbs gem bump,
+        # a signature change) and that no run would otherwise ever delete;
+        # a full active per-project set is ~2 MB, so the cap never touches
+        # live entries. Set explicitly to `null` to disable eviction
+        # (pre-WD3 behaviour: the cache grows until `--clear-cache`).
+        "max_bytes" => 268_435_456
       },
       "plugins_io" => {
         "network" => "disabled",
@@ -84,6 +88,15 @@ module Rigor
       },
       "severity_profile" => "balanced",
       "severity_overrides" => {},
+      # ADR-50 § WD2 — bleeding-edge overlay opt-in. Selects which of
+      # the *next major's* queued changes ({Rigor::BleedingEdge}) this
+      # project adopts early. Orthogonal to `severity_profile:`. Accepts
+      # `false` (default — adopt none), `true` (adopt the whole
+      # overlay), a list of feature ids (adopt only those), or
+      # `{ all: true, except: [ids] }` (adopt all but the named). The
+      # overlay is empty today, so every form is currently a no-op; it
+      # becomes live when the first discipline is queued for a major.
+      "bleeding_edge" => false,
       "dependencies" => {
         "source_inference" => [],
         "budget_per_gem" => Configuration::Dependencies::DEFAULT_BUDGET_PER_GEM
@@ -178,6 +191,7 @@ module Rigor
                 :plugins_io_network, :plugins_io_allowed_paths,
                 :plugins_io_allowed_url_hosts,
                 :severity_profile, :severity_overrides,
+                :bleeding_edge, :bleeding_edge_severity_overrides,
                 :dependencies, :parallel_workers,
                 :bundler_bundle_path, :bundler_auto_detect, :bundler_lockfile,
                 :rbs_collection_lockfile, :rbs_collection_auto_detect,
@@ -352,6 +366,10 @@ module Rigor
       @severity_overrides = coerce_severity_overrides(
         data.fetch("severity_overrides", DEFAULTS.fetch("severity_overrides"))
       )
+      @bleeding_edge = coerce_bleeding_edge(
+        data.fetch("bleeding_edge", DEFAULTS.fetch("bleeding_edge"))
+      )
+      @bleeding_edge_severity_overrides = BleedingEdge.severity_overrides_for(@bleeding_edge)
       @dependencies = Dependencies.from_h(
         data.fetch("dependencies", DEFAULTS.fetch("dependencies"))
       )
@@ -380,7 +398,7 @@ module Rigor
     end
     # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
 
-    def to_h # rubocop:disable Metrics/MethodLength
+    def to_h # rubocop:disable Metrics/MethodLength, Metrics/AbcSize
       {
         "target_ruby" => target_ruby,
         "paths" => paths,
@@ -402,6 +420,7 @@ module Rigor
         },
         "severity_profile" => severity_profile.to_s,
         "severity_overrides" => severity_overrides.to_h { |k, v| [k, v.to_s] },
+        "bleeding_edge" => bleeding_edge_to_h,
         "dependencies" => dependencies.to_h,
         "parallel" => {
           "workers" => parallel_workers
@@ -563,5 +582,45 @@ module Rigor
         [k.to_s, sym]
       end.freeze
     end
+
+    # ADR-50 § WD2 — normalizes the `bleeding_edge:` selector to a
+    # canonical `{ "mode" => … }` hash (interpreted by
+    # {Rigor::BleedingEdge}). Validates *shape* only; membership against
+    # the overlay is intentionally NOT checked here (an unknown id stays
+    # inert, like an unknown `severity_overrides:` rule). Deep-frozen so
+    # the Configuration stays `Ractor.shareable?`.
+    def coerce_bleeding_edge(value)
+      case value
+      when nil, false then { "mode" => "none" }
+      when true then { "mode" => "all" }
+      when Array then { "mode" => "list", "ids" => value.map(&:to_s).freeze }
+      when Hash then coerce_bleeding_edge_hash(value)
+      else
+        raise ArgumentError,
+              "bleeding_edge must be true, false, a list of feature ids, " \
+              "or { all: true, except: [...] }, got #{value.inspect}"
+      end.freeze
+    end
+
+    def coerce_bleeding_edge_hash(value)
+      hash = value.to_h { |k, v| [k.to_s, v] }
+      if hash.fetch("all", false) == true
+        { "mode" => "all", "except" => Array(hash["except"]).map(&:to_s).freeze }
+      else
+        { "mode" => "none" }
+      end
+    end
+
+    # Renders the normalized selector back into the user-facing
+    # `bleeding_edge:` form for `#to_h` round-trips.
+    def bleeding_edge_to_h
+      case bleeding_edge["mode"]
+      when "all"
+        except = bleeding_edge["except"] || []
+        except.empty? || { "all" => true, "except" => except }
+      when "list" then bleeding_edge["ids"] || []
+      else false
+      end
+    end
   end
 end

data/lib/rigor/environment/rbs_loader.rb

@@ -88,6 +88,15 @@ module Rigor
           vendored_gem_sig_paths.each do |path|
             rbs_loader.add(path: path) if path.directory?
           end
+          # Rigor-owned core overlay — loaded LAST so an upstream
+          # declaration always wins on conflict; these reopenings only
+          # fill genuine holes (e.g. `Numeric#to_f`/`to_i`/`to_r`, which
+          # upstream RBS declares on the concrete subclasses but not on
+          # the abstract `Numeric` that Rigor's arithmetic-chain widening
+          # produces).
+          core_overlay_sig_paths.each do |path|
+            rbs_loader.add(path: path) if path.directory?
+          end
           env = RBS::Environment.from_loader(rbs_loader)
           add_virtual_rbs(env, virtual_rbs)
           synthesize_missing_namespaces(env)
@@ -298,6 +307,22 @@ module Rigor
         ).freeze
         private_constant :VENDORED_GEM_SIGS_ROOT
 
+        # Rigor-owned core-overlay RBS (`data/core_overlay/`). Reopens
+        # Ruby core classes to add methods upstream `ruby/rbs` omits but
+        # which every concrete value answers at runtime — loaded last so
+        # upstream always wins on conflict. Public so the cache descriptor
+        # can digest these files into the env-blob key.
+        CORE_OVERLAY_SIGS_ROOT = File.expand_path(
+          "../../../data/core_overlay",
+          __dir__
+        ).freeze
+
+        def core_overlay_sig_paths
+          return [] unless File.directory?(CORE_OVERLAY_SIGS_ROOT)
+
+          [Pathname(CORE_OVERLAY_SIGS_ROOT)]
+        end
+
         def vendored_gem_sig_paths
           return [] unless File.directory?(VENDORED_GEM_SIGS_ROOT)
 
@@ -559,29 +584,17 @@ module Rigor
       #   definition cannot be built (RBS may raise on broken hierarchies;
       #   we fail-soft and return nil so the caller can fall back).
       #
-      # When `cache_store` is set, the loader fetches the per-class
-      # definition through {Cache::RbsInstanceDefinitions.fetch} so
-      # subsequent runs (and other loaders sharing the same Store)
-      # skip the `RBS::DefinitionBuilder.build_instance` step.
-      # In-memory `@instance_definition_cache` keeps the per-process
-      # short-circuit on top.
+      # Built on demand from the (possibly cache-loaded) env; the
+      # in-memory `@instance_definition_cache` keeps the per-process
+      # short-circuit. ADR-54 WD1 retired the definitions disk blob:
+      # given a cached env, `Marshal.load`-ing every definition was
+      # measurably slower (and allocation-heavier) than rebuilding
+      # the ones a run actually touches.
       def instance_definition(class_name)
         key = class_name.to_s
         return @instance_definition_cache[key] if @instance_definition_cache.key?(key)
 
-        @instance_definition_cache[key] = if cache_store
-                                            cached_instance_definition(class_name)
-                                          else
-                                            build_instance_definition(class_name)
-                                          end
-      end
-
-      # Public uncached accessor used by the cache producer
-      # ({Rigor::Cache::RbsInstanceDefinitions}). Avoids the
-      # `private_method_called` round-trip a `loader.send(...)`
-      # callsite would require.
-      def uncached_instance_definition(class_name)
-        build_instance_definition(class_name)
+        @instance_definition_cache[key] = build_instance_definition(class_name)
       end
 
       # @return [RBS::Definition::Method, nil]
@@ -636,24 +649,14 @@ module Rigor
       #   those inherited from `Class` and `Module` for class types.
       #   Returns nil for unknown names and on RBS build errors (fail-soft).
       #
-      # When `cache_store` is set, the loader fetches the per-class
-      # singleton definition through
-      # {Cache::RbsSingletonDefinitions.fetch}; the same caching
-      # discipline as {#instance_definition}.
+      # Built on demand from the env with a per-process memo; the
+      # same on-demand discipline as {#instance_definition} (ADR-54
+      # WD1).
       def singleton_definition(class_name)
         key = class_name.to_s
         return @singleton_definition_cache[key] if @singleton_definition_cache.key?(key)
 
-        @singleton_definition_cache[key] = if cache_store
-                                             cached_singleton_definition(class_name)
-                                           else
-                                             build_singleton_definition(class_name)
-                                           end
-      end
-
-      # Public uncached accessor used by the cache producer.
-      def uncached_singleton_definition(class_name)
-        build_singleton_definition(class_name)
+        @singleton_definition_cache[key] = build_singleton_definition(class_name)
       end
 
       # @return [RBS::Definition::Method, nil] the class method on
@@ -762,18 +765,20 @@ module Rigor
       end
 
       # ADR-15 Phase 4b.x — eagerly drives every cached
-      # producer so a subsequent worker Ractor can serve all
-      # of its RBS queries from the Marshal blob on disk
-      # without ever calling `RBS::EnvironmentLoader.new`.
+      # producer (plus the eager definitions tables, computed
+      # from the cached env since ADR-54 WD1) so a subsequent
+      # worker Ractor can serve all of its RBS queries without
+      # ever calling `RBS::EnvironmentLoader.new`.
       # The loader path that calls `EnvironmentLoader.new`
       # transitively reads a chain of non-`Ractor.shareable?`
       # module constants
       # (`RBS::EnvironmentLoader::DEFAULT_CORE_ROOT`,
       # `RBS::Repository::DEFAULT_STDLIB_ROOT`,
       # `Gem::Requirement::DefaultRequirement`, …) and trips
-      # `Ractor::IsolationError`. Pre-warming the cache on
-      # the main Ractor and letting workers consult ONLY the
-      # Marshal-loaded blob sidesteps the whole chain.
+      # `Ractor::IsolationError`. Pre-warming on the main
+      # Ractor — env blob loaded, derived tables built — keeps
+      # workers off that chain (`RBS::DefinitionBuilder` over
+      # an already-built env does not touch it).
       #
       # No-op when `cache_store` is nil — without a Store the
       # worker has no choice but to build env via the loader,
@@ -793,6 +798,20 @@ module Rigor
         self
       end
 
+      # ADR-54 WD4 — the shared cache descriptor for every RBS-derived
+      # producer consulting this loader. Building it digests every
+      # `.rbs` file under `signature_paths` + the vendored gem sigs,
+      # and the result is identical across producers, so one build is
+      # memoised per loader (on `@state`, alongside `:env` — the env
+      # itself is loader-lifetime-memoised, so this adds no new
+      # staleness class).
+      def rbs_cache_descriptor
+        @state[:rbs_cache_descriptor] ||= begin
+          require_relative "../cache/rbs_descriptor"
+          Cache::RbsDescriptor.build(self)
+        end
+      end
+
       # ADR-15 Phase 2b — return the loader's read-only
       # query surface as a frozen, `Ractor.shareable?`
       # {Reflection} value object. Built lazily on first
@@ -969,43 +988,34 @@ module Rigor
         Cache::RbsEnvironment.fetch(loader: self, store: cache_store)
       end
 
-      # Per-process Hash<String, RBS::Definition> for the instance
-      # side. Loaded once on first miss through the
-      # {Cache::RbsInstanceDefinitions} producer (single Marshal
-      # blob); subsequent calls are pure Hash lookups. Cold runs
-      # build every known class once and persist; warm runs (and
-      # other loaders sharing the same Store) skip the
-      # `RBS::DefinitionBuilder.build_instance` work entirely.
-      def cached_instance_definition(class_name)
-        instance_definitions_table[normalise_class_key(class_name)]
-      end
-
+      # Full `Hash<String, RBS::Definition>` tables for the
+      # {#prewarm} / {#reflection} consumers (ADR-15 Phase 2b/4b.x),
+      # which need every definition materialised up front. Built
+      # from the (cached) env via `RBS::DefinitionBuilder` — ADR-54
+      # WD1 retired the disk blobs these used to `Marshal.load`
+      # (building all definitions from a cached env is faster), so
+      # the eager-table cost is now a compute, not a load. Keys stay
+      # in `RBS::TypeName#to_s` form (top-level prefixed `"::Hash"`)
+      # — the shape {Environment::Reflection} documents.
       def instance_definitions_table
-        @state[:instance_definitions_table] ||= begin
-          require_relative "../cache/rbs_instance_definitions"
-          fetch_or_compute_producer(Cache::RbsInstanceDefinitions)
+        @state[:instance_definitions_table] ||= build_definitions_table do |name|
+          build_instance_definition(name)
         end
       end
 
-      def cached_singleton_definition(class_name)
-        singleton_definitions_table[normalise_class_key(class_name)]
-      end
-
       def singleton_definitions_table
-        @state[:singleton_definitions_table] ||= begin
-          require_relative "../cache/rbs_instance_definitions"
-          fetch_or_compute_producer(Cache::RbsSingletonDefinitions)
+        @state[:singleton_definitions_table] ||= build_definitions_table do |name|
+          build_singleton_definition(name)
         end
       end
 
-      # The cache producers persist class names in
-      # `RBS::TypeName#to_s` form (top-level prefixed
-      # `"::Hash"`); plain-name lookups (`"Hash"`) normalise
-      # before the Hash query so callers stay agnostic to the
-      # prefix.
-      def normalise_class_key(class_name)
-        s = class_name.to_s
-        s.start_with?("::") ? s : "::#{s}"
+      def build_definitions_table
+        table = {}
+        each_known_class_name do |name|
+          definition = yield(name)
+          table[name] = definition if definition
+        end
+        table
       end
 
       def builder

data/lib/rigor/environment.rb

@@ -77,7 +77,7 @@ module Rigor
     # @param plugin_registry [Rigor::Plugin::Registry, nil] v0.1.1
     #   Track 2 slice 7. The per-run plugin registry the
     #   inference engine consults at call sites for plugin
-    #   `#flow_contribution_for` overrides. When nil (the
+    #   `dynamic_return` rules. When nil (the
     #   default), no plugin-level return-type contribution
     #   participates — useful for tests, the `Environment.default`
     #   facade, and analyses that don't load plugins.

data/lib/rigor/inference/acceptance.rb

@@ -243,6 +243,12 @@ module Rigor
           when Type::HashShape
             accepts(self_type, project_hash_shape_to_nominal(other_type), mode: mode)
               .with_reason("projected HashShape to Nominal[Hash]")
+          when Type::DataInstance
+            # ADR-48: a class-tagged member instance is exactly one value of
+            # its tagging class, so it projects to that class's nominal (the
+            # anonymous local-bound form projects to `Data` itself).
+            accepts(self_type, project_data_instance_to_nominal(other_type), mode: mode)
+              .with_reason("projected DataInstance to Nominal[#{other_type.class_name || 'Data'}]")
           when Type::Difference, Type::Refined
             # A refinement carrier's value set is a subset of its
             # base. So if `self` (Nominal) accepts the base, it
@@ -376,6 +382,10 @@ module Rigor
           end
         end
 
+        def project_data_instance_to_nominal(instance)
+          Type::Combinator.nominal_of(instance.class_name || "Data")
+        end
+
         def project_hash_shape_to_nominal(shape)
           return Type::Combinator.nominal_of(Hash) if shape.pairs.empty?
 

data/lib/rigor/inference/body_fixpoint.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require_relative "../type"
+require_relative "budget_trace"
+
+module Rigor
+  module Inference
+    # ADR-56 WD3 — the single capped-fixpoint mechanism shared by the
+    # non-escaping block captured-local write-back (slice A) and the
+    # loop-body fixpoint (slice B). Computes the continuation binding of a
+    # set of locals that a body (a block body or a loop body) may rebind
+    # across an unknown number (0..N) of iterations.
+    #
+    # The body may run zero times, so the seed (pre-state) binding is kept
+    # as a join constituent throughout; it may compound (`a = [a]`), so the
+    # join is iterated to a fixed point under a hard cap (ADR-41 WD4). On
+    # the final permitted iteration value-pinned constituents are widened to
+    # their nominal base to force convergence; a local that still moves is
+    # collapsed to `Dynamic[top]` — the established escaping-block floor —
+    # and a {BudgetTrace::BLOCK_WRITEBACK_CAP} hit is recorded.
+    #
+    # The mechanism is parameterized over an `evaluate_body` callable so
+    # slice B can reuse it: given the current per-name bindings it returns
+    # the per-name exit bindings produced by one body evaluation from those
+    # bindings (names the body leaves unwritten in a given pass simply do
+    # not appear in the returned hash).
+    module BodyFixpoint
+      # One body evaluation per iteration; ADR-55's shape (cap 3).
+      CAP = 3
+
+      module_function
+
+      # @param names [Array<Symbol>] the outer locals the body can rebind.
+      # @param seed_bindings [Hash{Symbol=>Type}] pre-state binding per name.
+      # @param widen [#call] value-pinned widener (Constant -> Nominal).
+      # @param evaluate_body [#call] `bindings -> exit_bindings` — evaluates
+      #   the body once from `bindings` (the per-name current assumption) and
+      #   returns the per-name exit binding it produced.
+      # @return [Hash{Symbol=>Type}] the continuation binding per name.
+      def converge(names:, seed_bindings:, widen:, evaluate_body:)
+        return {} if names.empty?
+
+        # Running assumption per name; seeded with the pre-state binding,
+        # which stays a join constituent throughout (0-iteration soundness).
+        assumption = seed_bindings.dup
+
+        (0...CAP).each do |iteration|
+          last_iteration = iteration == CAP - 1
+          exit_bindings = evaluate_body.call(assumption)
+
+          stable = true
+          names.each do |name|
+            exit_type = exit_bindings[name]
+            next if exit_type.nil? # body did not write it this pass
+
+            if last_iteration
+              # On the final permitted iteration widen BOTH the running
+              # assumption and the fresh exit type to their nominal bases
+              # before joining: Rigor's `union` keeps `Constant[1]` and
+              # `Nominal[Integer]` as distinct members, so an accumulator
+              # (`+=`/`*=`) producing a fresh constant per pass would never
+              # converge without collapsing both sides first. If the join
+              # is still wider than the widened assumption (structural
+              # compounding, `a = [a]`), the local floors to `Dynamic[top]`.
+              base = widen.call(assumption[name])
+              joined = Type::Combinator.union(base, widen.call(exit_type))
+              if joined == base
+                assumption[name] = joined
+              else
+                BudgetTrace.hit(BudgetTrace::BLOCK_WRITEBACK_CAP)
+                assumption[name] = Type::Combinator.untyped
+              end
+            else
+              joined = Type::Combinator.union(assumption[name], exit_type)
+              next if joined == assumption[name]
+
+              stable = false
+              assumption[name] = joined
+            end
+          end
+
+          break if stable
+        end
+
+        assumption
+      end
+    end
+  end
+end

data/lib/rigor/inference/budget_trace.rb

@@ -20,6 +20,12 @@ module Rigor
     #   hit the 100-node BFS cap and gave up resolving the self-call.
     # - {HKT_FUEL_EXHAUSTED} — `HktReducer` ran out of its reduction
     #   fuel budget and unwound to `app.bound`.
+    # - {RECURSION_UNROLL_FUEL} — the constant-arg recursion unroll
+    #   (ADR-55 slice 1) exhausted its per-entry fuel and fell back to
+    #   the plain `(receiver, method)` guard (in-cycle call → `Dynamic[top]`).
+    # - {RECURSION_FIXPOINT_CAP} — the fixpoint return-summary iteration
+    #   (ADR-55 slice 2) hit its 3-evaluation cap without converging and
+    #   collapsed the summary to `untyped` (today's behaviour).
     #
     # Enabled only when `RIGOR_BUDGET_TRACE` is set (to any non-empty
     # value) in the environment, or via {enable!} in tests. When
@@ -34,8 +40,29 @@ module Rigor
       RECURSION_GUARD = :recursion_guard
       ANCESTOR_WALK_LIMIT = :ancestor_walk_limit
       HKT_FUEL_EXHAUSTED = :hkt_fuel_exhausted
-
-      CATEGORIES = [RECURSION_GUARD, ANCESTOR_WALK_LIMIT, HKT_FUEL_EXHAUSTED].freeze
+      # `ExpressionTyper#infer_user_method_return` exhausted its
+      # constant-arg unroll fuel (ADR-55 slice 1) and fell back to the
+      # plain `(receiver, method)` recursion guard — i.e. the in-cycle
+      # call widened to `Dynamic[top]` exactly as it does without the
+      # unroll.
+      RECURSION_UNROLL_FUEL = :recursion_unroll_fuel
+      # `ExpressionTyper#infer_user_method_return` ran the fixpoint
+      # return-summary iteration (ADR-55 slice 2) to its 3-evaluation cap
+      # without reaching convergence and collapsed the summary to
+      # `untyped` — the in-cycle result widens to `Dynamic[top]` exactly
+      # as it does without the fixpoint.
+      RECURSION_FIXPOINT_CAP = :recursion_fixpoint_cap
+      # `BodyFixpoint#converge` (ADR-56 slice A — non-escaping block
+      # captured-local write-back) ran its 3-evaluation cap without the
+      # written local's join converging and collapsed that local to
+      # `Dynamic[top]` (the escaping-block floor). Shared by slice B's
+      # loop-body fixpoint.
+      BLOCK_WRITEBACK_CAP = :block_writeback_cap
+
+      CATEGORIES = [
+        RECURSION_GUARD, ANCESTOR_WALK_LIMIT, HKT_FUEL_EXHAUSTED, RECURSION_UNROLL_FUEL,
+        RECURSION_FIXPOINT_CAP, BLOCK_WRITEBACK_CAP
+      ].freeze
 
       # Distribution (histogram) categories — read-only observations of
       # a value's size at a site, used to choose budget defaults from an