rigortype 0.3.3 → 0.3.4

data/lib/rigor/effects/unknown_label_report.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative "label_intent"
+
+module Rigor
+  module Effects
+    # One `effect.unknown-label` finding, rendered (ADR-103 WD1 / WD14; #384).
+    #
+    # It carries the spelling, the nearest recognised label and the retirement record, and knows how
+    # to say all three in one sentence. What it deliberately does NOT carry is where the label was
+    # written or what the surface was: an envelope in `.rbs`, an rbs-inline annotation in `.rb` and a
+    # `.rigor.yml` list all reduce to "a place named this label, and now it means nothing", so the
+    # caller supplies the `subject` and the `consequence` and this supplies the vocabulary judgment.
+    # That is the seam [#385](https://github.com/rigortype/rigor/issues/385)'s `envelopes[].effect`
+    # and `attribution:` values point at.
+    #
+    # {.for} answers `nil` unless {LabelIntent} says the spelling is evidently a label — the whole
+    # point of the diagnostic is that it fires where intent is evident and nowhere else.
+    class UnknownLabelReport < Data.define(:token, :suggestion, :retirement)
+      # @param token [String] the spelling as written.
+      # @param registry [Rigor::Effects::Registry, nil] the vocabulary after plugin load.
+      # @param siblings [Array<String>] the other tokens written alongside it.
+      # @return [UnknownLabelReport, nil]
+      def self.for(token:, registry:, siblings: [])
+        return nil unless LabelIntent.evident?(token, registry, siblings: siblings)
+
+        new(
+          token: token.to_s,
+          suggestion: registry.suggest(token.to_s),
+          retirement: Array(registry.retired(token.to_s)).map(&:to_s).freeze
+        )
+      end
+
+      # Whether the vocabulary once carried this spelling and moved it. A retirement outranks a
+      # nearest-neighbour guess: the registry KNOWS where this label went, so guessing would be
+      # strictly worse information.
+      def retired?
+        !retirement.nil? && !retirement.empty?
+      end
+
+      # The sentence a reader can act on. `subject` names the declaration ("Effect envelope on
+      # `Foo#bar`"), `consequence` says what the degradation cost ("the annotation now bounds
+      # nothing") — the fail-open reading stated out loud, because a silently-unbounded envelope is
+      # exactly what this diagnostic exists to make visible.
+      def message(subject:, consequence:)
+        "#{subject} names #{token}, which is not a known effect label#{qualifier}; #{consequence}."
+      end
+
+      private
+
+      def qualifier
+        return " (#{token} is retired; write #{retirement.join(' or ')} instead)" if retired?
+        return " (did you mean #{suggestion}?)" if suggestion
+
+        ""
+      end
+    end
+  end
+end

data/lib/rigor/effects.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "effects/label"
+require_relative "effects/label_set"
+require_relative "effects/registry"
+require_relative "effects/taint_cause"
+require_relative "effects/attribution"
+require_relative "effects/catalog"
+require_relative "effects/collector"
+require_relative "effects/config_envelopes"
+require_relative "effects/discharge"
+require_relative "effects/effect_table"
+require_relative "effects/envelope"
+require_relative "effects/envelope_check"
+require_relative "effects/envelope_index"
+require_relative "effects/file_collection"
+require_relative "effects/liskov_check"
+require_relative "effects/method_key"
+require_relative "effects/origin"
+require_relative "effects/propagator"
+require_relative "effects/summary"
+
+module Rigor
+  # The effect-label vocabulary (ADR-103; normative in
+  # `docs/type-specification/effect-labels.md`).
+  #
+  # Two layers live here. The label *language* — the grammar, the subsumption relation, the label
+  # sets a summary and an envelope are made of, the registry that says which spellings are
+  # recognised, and the closed enum of taint causes. And, on top of it, the observational machinery
+  # of #379: the {Collector} that records what the typer decided, the {Summary} / {FileCollection}
+  # values it produces, the built-in {Catalog}, and the {Propagator} that closes them into an
+  # {EffectTable}. On top of both sits the one thing here that DOES judge: an {Envelope} — an
+  # author-declared upper bound read off the project's RBS or written by convention in `.rigor.yml`
+  # ({ConfigEnvelopes}) — and the two checks that judge one: {EnvelopeCheck} compares a method against
+  # its own bound (`effect.envelope-exceeded`, #383 / #385) and {LiskovCheck} an override against the
+  # bound it inherits (`effect.liskov-widened`, #386). The same declarations are read a third way, which
+  # judges nothing: {EnvelopeIndex} resolves them per CALL SITE, so a caller reads what its callee
+  # promised as a `≤` bound. Beside them sit the project's policy
+  # surfaces: {Attribution} colours code Rigor never analysed, into the declared lane, and {Discharge}
+  # applies `effects.tolerated:` per origin at judgment time. The effect snapshot (#381) and the
+  # vocabulary diagnostic (#384) are their own slices.
+  #
+  # "Effect label", "effect summary" and "effect envelope" are trapped compounds in `CONTEXT.md`;
+  # bare "effect" still names `Rigor::FlowContribution`'s flow-effect bundle.
+  module Effects
+  end
+end

data/lib/rigor/environment/rbs_loader.rb

@@ -1256,6 +1256,40 @@ module Rigor
         end
       end
 
+      # ADR-103 WD6 / #386 — yields `[class name, RBS::AST::Members::MethodDefinition]` for every method
+      # member in the built environment that carries at least one annotation.
+      #
+      # The one reason this walk lives here rather than in its caller: `#env` is private, and it stays
+      # private. The effect-envelope reader needs the *annotations* a gem's shipped signatures and
+      # Rigor's bundled overlays declare — the accepted stratum of ADR-103 WD6, which discharges a call
+      # site's taint because the same trust is already extended to those files' types — and nothing more
+      # of the environment. Handing out the environment to get at them would trade a several-MB mutable
+      # object for a read the loader can perform itself.
+      #
+      # Nested declarations are not descended into: `RBS::Environment` already flattens a nested
+      # `class Foo::Bar` into its own `class_decls` entry, so a descent would key one member twice.
+      #
+      # Fail-soft, like every other query here: no environment (a build failure) yields nothing.
+      def each_annotated_method_member
+        environment = env
+        return if environment.nil?
+
+        environment.class_decls.each do |type_name, entry|
+          class_name = type_name.to_s.sub(/\A::/, "")
+          self.class.entry_declarations(entry).each do |decl|
+            members = decl.respond_to?(:members) ? decl.members : nil
+            next if members.nil?
+
+            members.each do |member|
+              next unless member.is_a?(::RBS::AST::Members::MethodDefinition)
+              next if member.annotations.nil? || member.annotations.empty?
+
+              yield class_name, member
+            end
+          end
+        end
+      end
+
       private
 
       # The `::`-stripped names of every class/module entry whose declarations ALL originated from the given

data/lib/rigor/environment.rb

@@ -311,11 +311,18 @@ module Rigor
       # activesupport, the Rack status table) can then require the analyzed project's own locked gems when
       # Rigor's host gem environment does not carry them — the standalone `gem install rigortype` case,
       # where activesupport is deliberately not a runtime dependency.
+      # The hand-off is a module ivar, which a non-main Ractor may not write (`Ractor::IsolationError`) —
+      # and every Ractor-pool worker builds its Environment inside its own Ractor, so an unguarded write
+      # killed the whole backend at `WorkerSession#initialize` (#414). The resolution is deterministic per
+      # configuration and `Runner`'s pre-passes already perform it on the main Ractor before the pool
+      # spawns, so a worker reads the value the main set (a frozen String, hence shareable) and skips the
+      # write. The local return value is unaffected, so the missing-gem constant index still gets its root
+      # even when the write is skipped.
       def resolve_target_bundle_root(bundle_path:, project_root:, auto_detect:)
         bundle_root = BundleSigDiscovery.resolve_bundle_path(
           bundle_path: bundle_path, project_root: project_root, auto_detect: auto_detect
         )&.to_s
-        Plugin::Isolation.target_bundle_root = bundle_root
+        Plugin::Isolation.target_bundle_root = bundle_root if Ractor.current == Ractor.main
         bundle_root
       end
 

data/lib/rigor/flow_contribution/element.rb

@@ -21,6 +21,7 @@ module Rigor
       invalidation
       exception
       role
+      effects
     ].freeze
 
     class Element < Data.define(:target, :edge, :kind, :payload, :provenance)

data/lib/rigor/flow_contribution/merge_result.rb

@@ -13,13 +13,13 @@ module Rigor
     # for the slice-3 normative description.
     class MergeResult
       attr_reader :return_type, :truthy_facts, :falsey_facts, :post_return_facts,
-                  :mutations, :invalidations, :exceptional, :role_conformance,
+                  :mutations, :invalidations, :exceptional, :role_conformance, :effects,
                   :provenances, :conflicts
 
       # rubocop:disable Metrics/ParameterLists
       def initialize(return_type: nil, truthy_facts: [], falsey_facts: [],
                      post_return_facts: [], mutations: [], invalidations: [],
-                     exceptional: nil, role_conformance: [],
+                     exceptional: nil, role_conformance: [], effects: nil,
                      provenances: [], conflicts: [])
         # rubocop:enable Metrics/ParameterLists
         @return_type = return_type
@@ -30,6 +30,7 @@ module Rigor
         @invalidations = invalidations.dup.freeze
         @exceptional = exceptional
         @role_conformance = role_conformance.dup.freeze
+        @effects = effects
         @provenances = provenances.dup.freeze
         @conflicts = conflicts.dup.freeze
         freeze
@@ -42,7 +43,7 @@ module Rigor
       def empty?
         @return_type.nil? && @truthy_facts.empty? && @falsey_facts.empty? &&
           @post_return_facts.empty? && @mutations.empty? && @invalidations.empty? &&
-          @exceptional.nil? && @role_conformance.empty?
+          @exceptional.nil? && @role_conformance.empty? && @effects.nil?
       end
 
       def to_h
@@ -55,6 +56,7 @@ module Rigor
           "invalidations" => invalidations,
           "exceptional" => exceptional,
           "role_conformance" => role_conformance,
+          "effects" => effects,
           "provenances" => provenances.map { |p| p.respond_to?(:to_h) ? p.to_h : p },
           "conflicts" => conflicts.map(&:to_h)
         }

data/lib/rigor/flow_contribution/merger.rb

@@ -99,6 +99,7 @@ module Rigor
           fold_effects(state, contribution)
           fold_exceptional(state, contribution, tier)
           fold_role_conformance(state, contribution)
+          fold_effect_labels(state, contribution)
         end
 
         def fold_return_type(state, contribution, tier)
@@ -182,6 +183,18 @@ module Rigor
           accumulate(state.role_conformance, contribution.role_conformance)
         end
 
+        # ADR-103 WD5 — the `effects` slot merges by UNION, unconditionally and across every authority
+        # tier. A label set is an upper bound on what a call does, and two sources that each name part of
+        # a footprint together name more of it; there is no reading under which one source's claim
+        # cancels another's, so there is no conflict to report either. `nil` ("says nothing") stays nil
+        # until some contribution speaks.
+        def fold_effect_labels(state, contribution)
+          incoming = contribution.effects
+          return if incoming.nil?
+
+          state.effects = state.effects.nil? ? incoming : state.effects.join(incoming)
+        end
+
         def accumulate(target, incoming)
           Array(incoming).each do |item|
             target << item unless target.include?(item)
@@ -217,7 +230,7 @@ module Rigor
       # {MergeResult} at the end via {#to_result}.
       class MergeState
         attr_accessor :return_type, :return_type_tier, :return_type_provenance,
-                      :exceptional, :exceptional_tier, :exceptional_provenance
+                      :exceptional, :exceptional_tier, :exceptional_provenance, :effects
         attr_reader :truthy_facts, :falsey_facts, :post_return_facts,
                     :mutations, :invalidations, :role_conformance,
                     :provenances, :conflicts
@@ -235,6 +248,7 @@ module Rigor
           @exceptional_tier = nil
           @exceptional_provenance = nil
           @role_conformance = []
+          @effects = nil
           @provenances = []
           @conflicts = []
         end
@@ -253,6 +267,7 @@ module Rigor
             invalidations: @invalidations,
             exceptional: @exceptional,
             role_conformance: @role_conformance,
+            effects: @effects,
             provenances: @provenances,
             conflicts: @conflicts
           )

data/lib/rigor/flow_contribution.rb

@@ -9,7 +9,7 @@ module Rigor
   # [ADR-2 § "Plugin Contribution Merging"](../../docs/adr/2-extension-api.md) rather than letting any one
   # source override another silently.
   #
-  # Eight content slots plus a {Provenance} block. A slot left as `nil` (or, for collection-shaped slots, an
+  # Nine content slots plus a {Provenance} block. A slot left as `nil` (or, for collection-shaped slots, an
   # empty collection) means the contribution does not assert anything in that dimension; the merge policy
   # treats it as absent.
   #
@@ -38,8 +38,15 @@ module Rigor
       invalidations
       exceptional
       role_conformance
+      effects
     ].freeze
 
+    # `effects` is scalar-shaped like `return_type` and `exceptional`: only `nil` means "asserts
+    # nothing". An EMPTY {Rigor::Effects::LabelSet} is the positive claim that the call performs no
+    # effects — the reading of `%a{pure}` — so it must not be mistaken for an unset slot the way an
+    # empty fact Array is.
+    SCALAR_SLOTS = %i[return_type exceptional effects].freeze
+
     attr_reader(*SLOT_NAMES, :provenance)
 
     # @param return_type [Object, nil] normal-edge return type. Use `nil` when the contribution does not
@@ -54,12 +61,17 @@ module Rigor
     #   imply.
     # @param exceptional [Object, nil] non-returning, raising, or unreachable effect.
     # @param role_conformance [Array, nil] capability-role conformance facts the contribution provides.
+    # @param effects [Rigor::Effects::LabelSet, nil] ADR-103 WD5 — the effect labels this call edge
+    #   attributes to its callee, as an upper bound. `nil` means "says nothing about effects", which is
+    #   NOT the same as the empty set (which asserts the call performs none). Merged by union, the
+    #   conservative direction: two sources that each name part of a call's footprint together name
+    #   more of it, and neither can shrink the other's claim.
     # @param provenance [Provenance] source-family, plugin-id, node, and cache-descriptor metadata. Defaults
     #   to `Provenance.builtin`.
     # rubocop:disable Metrics/ParameterLists
     def initialize(return_type: nil, truthy_facts: nil, falsey_facts: nil,
                    post_return_facts: nil, mutations: nil, invalidations: nil,
-                   exceptional: nil, role_conformance: nil,
+                   exceptional: nil, role_conformance: nil, effects: nil,
                    provenance: Provenance.builtin)
       # rubocop:enable Metrics/ParameterLists
       @return_type = return_type
@@ -70,6 +82,7 @@ module Rigor
       @invalidations = freeze_collection(invalidations)
       @exceptional = exceptional
       @role_conformance = freeze_collection(role_conformance)
+      @effects = effects
       @provenance = provenance
       freeze
     end
@@ -77,7 +90,7 @@ module Rigor
     # @return [Boolean] true when every content slot is unset (nil or an empty collection). Provenance does
     #   not count toward emptiness — an empty bundle still carries source attribution.
     def empty?
-      SLOT_NAMES.all? { |slot| slot_empty?(public_send(slot)) }
+      SLOT_NAMES.all? { |slot| slot_empty?(slot, public_send(slot)) }
     end
 
     def to_h
@@ -102,6 +115,7 @@ module Rigor
     # | invalidations       | normal        | invalidation        | (per-fact target)       |
     # | exceptional         | exceptional   | exception           | :raise                  |
     # | role_conformance    | normal        | role                | (per-role target)       |
+    # | effects             | normal        | effects             | :effects                |
     #
     # @return [Array<Element>]
     def to_element_list # rubocop:disable Metrics/AbcSize
@@ -116,6 +130,7 @@ module Rigor
       Array(invalidations).each { |i| elements << element_for(fact_target(i), :normal, :invalidation, i) }
       elements << element_for(:raise, :exceptional, :exception, exceptional) unless exceptional.nil?
       Array(role_conformance).each { |r| elements << element_for(fact_target(r), :normal, :role, r) }
+      elements << element_for(:effects, :normal, :effects, effects) unless effects.nil?
       elements.freeze
     end
 
@@ -149,8 +164,9 @@ module Rigor
       value.dup.freeze
     end
 
-    def slot_empty?(value)
+    def slot_empty?(slot, value)
       return true if value.nil?
+      return false if SCALAR_SLOTS.include?(slot)
       return value.empty? if value.respond_to?(:empty?)
 
       false

data/lib/rigor/inference/expression_typer.rb

@@ -13,6 +13,7 @@ require_relative "body_fixpoint"
 require_relative "budget_trace"
 require_relative "dynamic_origin"
 require_relative "origin_lookup"
+require_relative "../effects/collector"
 require_relative "fallback"
 require_relative "flow_tracer"
 require_relative "indexed_narrowing"
@@ -1134,6 +1135,11 @@ module Rigor
         arg_types = call_arg_types(node)
         block_type = block_return_type_for(node, receiver, arg_types)
 
+        # ADR-103 WD13 — the effect collector's one hot-path site. Purely observational: it reads the
+        # receiver type the typer has just computed and the `dynamic_origins` cause already recorded, and
+        # asks nothing further of dispatch. Off (the default) this is one integer read.
+        Effects::Collector.record_call(node, receiver, scope) if Effects::Collector.active?
+
         local_def_result = try_local_def_dispatch(node, receiver, arg_types)
         return local_def_result if local_def_result
 
@@ -1181,11 +1187,19 @@ module Rigor
         # semantic outcome, not a fail-soft compromise, so it MUST NOT record a tracer event.
         return inherit_receiver_origin(node) if receiver.is_a?(Type::Dynamic)
 
-        # ADR-24 slice 4a — this is the engine choke-point where an implicit-self call has exhausted every
-        # resolution tier (RBS dispatch + user-class ancestor walk) and falls through to `Dynamic[top]`. When
-        # the slice-4 recorder is active, capture the miss so a later slice's closed-class gate can flag it.
-        # Off by default: `active?` is a plain integer read.
+        unresolved_call_result(node, receiver)
+      end
+
+      # The engine choke-point where a call has exhausted every resolution tier (RBS dispatch + user-class
+      # ancestor walk) and falls through to `Dynamic[top]`. Two observational recorders read it, both a
+      # plain integer read when inactive, and neither changes the answer:
+      #
+      # - ADR-24 slice 4a captures an implicit-self miss so a later slice's closed-class gate can flag it;
+      # - ADR-103 WD13 retracts the effect collector's optimistic `resolved: true`, which is what separates
+      #   an implicit-self call the closed world has no definition for from an ordinary inherited one.
+      def unresolved_call_result(node, receiver)
         record_unresolved_self_call(node, receiver) if Analysis::SelfCallResolutionRecorder.active?
+        Effects::Collector.record_unresolved(node, scope.source_path) if Effects::Collector.active?
 
         fallback_for(node, family: :prism)
       end

data/lib/rigor/inference/pre_eval_constants.rb

@@ -0,0 +1,189 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../scope"
+require_relative "../type"
+require_relative "scope_indexer"
+
+module Rigor
+  module Inference
+    # Issue #352 / [ADR-17](../../../docs/adr/17-monkey-patch-pre-evaluation.md) — the constant half of the
+    # `pre_eval:` publication surface.
+    #
+    # ADR-17 slice 2 gave `pre_eval:` a project-wide **method** registry ({ProjectPatchedMethods}). A
+    # constant declared in the same file stayed invisible across the file boundary: `Scope#in_source_constants`
+    # is per-file and is deliberately not part of `Runner#project_scope_seed_tables`, so only class-shaped
+    # constants (a `class` / `module` declaration, or one of the four meta-new forms `ScopeIndexer`'s
+    # `record_class_new_constant_decl` promotes) ever crossed. `TIMEOUT = 30` in a listed file read as
+    # `Dynamic[top]` everywhere else.
+    #
+    # This collector closes that half. It walks the `pre_eval:` files with the SAME constant pre-pass the
+    # per-file path uses ({ScopeIndexer.build_in_source_constants}) and publishes the result — widened — into
+    # the project seed. Files not listed under `pre_eval:` are untouched, so the feature is opt-in by
+    # construction and its cost stays proportional to the listed file count (ADR-17 WD1's cost-bounded
+    # argument, which is also why slice 5's full-project two-pass stayed rejectable).
+    #
+    # ## The widening rule — why the published type is not the same-file type
+    #
+    # Same-file constant propagation is **value-pinned**: `42`, `"hello"`, a `Tuple`, a `HashShape`. Carrying
+    # that verbatim across a file boundary would land diagnostics in files whose author never opened the
+    # constant's definition — `CONFIG = { a: 1 }` arriving as a closed `HashShape` makes `CONFIG.fetch(:b)`
+    # fire, `ARR = [1, 2]` arriving as a `Tuple` routes through `ShapeDispatch` instead of the RBS overload a
+    # call site relied on. Today's cross-file `Dynamic[top]` is false-positive-free *by construction*, so
+    # precision here can only spend that budget; AGENTS.md § "Implementation Guidelines" ranks false positives
+    # above worst-case static reading, so this slice spends as little of it as possible.
+    #
+    # {.widen} therefore publishes the **erased class**, never the value:
+    #
+    # | Declared | Same file | Published cross-file |
+    # | --- | --- | --- |
+    # | `INT_LIT = 42` | `42` | `Integer` |
+    # | `STR_LIT = "hello"` | `"hello"` | `String` |
+    # | `ARR_LIT = [1, 2]` | `[1, 2]` (Tuple) | `Array` (raw, elements dropped) |
+    # | `HSH_LIT = { a: 1 }` | `{ a: 1 }` (HashShape) | `Hash` (raw, keys dropped) |
+    # | `ALIAS_CLS = String` | `singleton(String)` | `singleton(String)` |
+    # | `Nest::NESTED_INT = 7` | `7` | `Integer` |
+    #
+    # Anything the rule does not recognise **declines** — the name is simply not published and reads exactly
+    # as it does today. Declining is always the safe answer here, which is why the `else` arm is `nil` rather
+    # than a fallback. `Constant[nil]` declines on purpose: a `X = nil` at declaration position is a
+    # placeholder for a value assigned at runtime far more often than it is a genuine `NilClass`, and
+    # publishing `NilClass` project-wide would make every use of it a diagnostic.
+    #
+    # Value-pinning a *provably* frozen single-write literal cross-file is a strictly later question; it needs
+    # its own FP measurement and is deliberately not attempted here.
+    #
+    # ## The multi-file write rule — widen on conflict, all the way to `Dynamic[top]`
+    #
+    # Within one file, `ScopeIndexer#record_constant_write` unions repeated writes; that union is widened as a
+    # whole (`X = 1; X = "a"` in one file publishes `Integer | String`). ACROSS files the same union would be
+    # a type neither author can see, so the rule is **widen on conflict**: when two listed files publish the
+    # same qualified name with different widened types, the name is dropped from the table entirely and reads
+    # as `Dynamic[top]` — the widest type there is, and the one the name already had. Agreeing writes (`X = 1`
+    # here, `X = 2` there — both `Integer`) are not a conflict at all, which is the point of widening first:
+    # `1 | 2` is never produced.
+    #
+    # ## Ordering
+    #
+    # The published table seeds `Scope#in_source_constants`, which `Reflection.constant_type_at` consults
+    # AFTER the class registry and `discovered_classes`. A published entry can therefore never mask a
+    # class-shaped constant that already crossed, and the per-file table always wins over the seed (see
+    # {ScopeIndexer.index}'s merge) — same-file remains the most specific authority.
+    module PreEvalConstants
+      EMPTY = {}.freeze
+
+      module_function
+
+      # Collects and widens the constants every `pre_eval:` file declares.
+      #
+      # @param paths [Array<String>] absolute paths to the `pre_eval:` files that exist on disk.
+      # @param scope_builder [#call] `path -> Rigor::Scope`; the caller supplies a project-seeded, environment-
+      #   bound scope so the rvalue typer resolves cross-file classes exactly as per-file analysis would.
+      # @param target_ruby [String, nil] the Prism parse version (`Configuration#target_ruby`).
+      # @param buffer [Rigor::Analysis::BufferBinding, nil] editor-mode binding; when set, a listed file that
+      #   matches the in-flight buffer is read from its physical bytes.
+      # @return [Hash{String => Rigor::Type}] frozen qualified-name -> published type table.
+      def collect(paths:, scope_builder:, target_ruby: nil, buffer: nil)
+        published = {}
+        conflicted = {}
+        paths.each do |path|
+          file_constants(path, scope_builder: scope_builder, target_ruby: target_ruby, buffer: buffer)
+            .each { |name, type| merge_publication(published, conflicted, name, type) }
+        end
+        published.freeze
+      end
+
+      # Folds one declaration into the accumulator under the widen-on-conflict rule. A name that has already
+      # conflicted stays out for the rest of the collection — a later agreeing write must not resurrect it.
+      def merge_publication(published, conflicted, name, type)
+        return if conflicted.key?(name)
+
+        widened = widen(type)
+        return if widened.nil?
+
+        existing = published[name]
+        return published[name] = widened if existing.nil?
+        return if existing == widened
+
+        published.delete(name)
+        conflicted[name] = true
+      end
+      private_class_method :merge_publication
+
+      # The per-file constant table, typed through the same pre-pass the per-file path runs. Deliberately NOT
+      # a full `ScopeIndexer.index`: ADR-17 WD4 keeps the pre-eval pass a discovery walk, and the constant
+      # pre-pass (plus the declaration artifacts it needs to resolve in-file class references) is exactly the
+      # discovery facet this feature consumes. Fails soft to the empty table — a pre-eval file that cannot be
+      # read or parsed already surfaces a `pre-eval.parse-error` warning from {ProjectPatchedScanner}, and it
+      # must never break the run.
+      def file_constants(path, scope_builder:, target_ruby: nil, buffer: nil)
+        physical = buffer ? buffer.resolve(path) : path
+        parse_result = Prism.parse(File.read(physical), filepath: path, version: target_ruby)
+        return EMPTY unless parse_result.errors.empty?
+
+        root = parse_result.value
+        ScopeIndexer.build_in_source_constants(root, declaration_seeded_scope(root, scope_builder.call(path)))
+      rescue StandardError
+        EMPTY
+      end
+      private_class_method :file_constants
+
+      # Mirrors the head of {ScopeIndexer.index}: seed the file's own declaration overrides and discovered
+      # classes onto the project-seeded scope so a `CONST = SomeClassDefinedRightHere.new` rvalue types the
+      # same way it does during real analysis.
+      def declaration_seeded_scope(root, scope)
+        declared_types, discovered_classes = ScopeIndexer.build_declaration_artifacts(root)
+        scope.with_discovery(
+          scope.discovery.with(
+            declared_types: declared_types,
+            discovered_classes: scope.discovered_classes.merge(discovered_classes)
+          )
+        )
+      end
+      private_class_method :declaration_seeded_scope
+
+      # The publication widening. Returns the type to publish, or `nil` to decline (the name keeps today's
+      # `Dynamic[top]` cross-file reading). See the module doc for why declining is the safe default.
+      def widen(type)
+        case type
+        when Type::Constant then widen_constant(type)
+        when Type::Refined then widen(type.base)
+        when Type::IntegerRange then Type::Combinator.nominal_of("Integer")
+        when Type::Tuple then Type::Combinator.nominal_of("Array")
+        when Type::HashShape then Type::Combinator.nominal_of("Hash")
+        when Type::Nominal then type.type_args.empty? ? type : Type::Combinator.nominal_of(type.class_name)
+        when Type::Singleton then type
+        when Type::DataInstance, Type::StructInstance then nominal_for_class_name(type.class_name)
+        when Type::Union then widen_union(type)
+        end
+      end
+
+      # `Constant[v]` publishes `v`'s class. `nil` declines (see the module doc); so does a value whose class
+      # is anonymous, which has no name to publish under.
+      def widen_constant(type)
+        return nil if type.value.nil?
+
+        nominal_for_class_name(type.value.class.name)
+      end
+      private_class_method :widen_constant
+
+      def nominal_for_class_name(class_name)
+        return nil unless class_name.is_a?(String) && !class_name.empty?
+
+        Type::Combinator.nominal_of(class_name)
+      end
+      private_class_method :nominal_for_class_name
+
+      # A union publishes only when EVERY member widens: one unrecognised arm means the union's real extent is
+      # unknown, and a partial union would be narrower than the truth — the false-positive direction.
+      def widen_union(type)
+        widened = type.members.map { |member| widen(member) }
+        return nil if widened.any?(&:nil?)
+
+        Type::Combinator.union(*widened)
+      end
+      private_class_method :widen_union
+    end
+  end
+end

data/lib/rigor/inference/scope_indexer.rb

@@ -88,10 +88,13 @@ module Rigor
         # program and types its rvalue under a scope that carries the surrounding qualified prefix as `self_type`, so
         # the rvalue typer sees in-class references resolve correctly. Multiple writes to the same qualified name union
         # via `Type::Combinator.union`.
+        # Issue #352 — the per-file table merges OVER whatever the base scope already published (the
+        # `pre_eval:` constant seed `Runner#project_scope_seed_tables` applies). Same-file declarations are the
+        # most specific authority, exactly as `merged_classes` above resolves the same collision. Without the
+        # merge, the assignment below would silently drop the project seed on every file.
         in_source_constants = build_in_source_constants(root, seeded_scope)
-        seeded_scope = seeded_scope.with_discovery(
-          seeded_scope.discovery.with(in_source_constants: in_source_constants)
-        )
+        merged_constants = merge_seeded_constants(default_scope.in_source_constants, in_source_constants)
+        seeded_scope = seeded_scope.with_discovery(seeded_scope.discovery.with(in_source_constants: merged_constants))
 
         # Slice 7 phase 12. In-source method discovery. Walks every class/module body for `Prism::DefNode` and
         # recognised `define_method` calls and records the introduced method names. `rigor check` consults the table to
@@ -1206,6 +1209,15 @@ module Rigor
         accumulator.freeze
       end
 
+      # Issue #352 — folds the project-wide `pre_eval:` constant seed under this file's own table. Returns the
+      # per-file table unchanged (same frozen object) when nothing was seeded, so a run without `pre_eval:`
+      # constants allocates and compares exactly what it did before.
+      def merge_seeded_constants(seeded, per_file)
+        return per_file if seeded.nil? || seeded.empty?
+
+        seeded.merge(per_file).freeze
+      end
+
       def walk_constant_writes(node, qualified_prefix, default_scope, accumulator)
         return unless node.is_a?(Prism::Node)
 

data/lib/rigor/plugin/base.rb

@@ -710,6 +710,30 @@ module Rigor
         manifest.protocol_contracts
       end
 
+      # ADR-103 WD6 / WD10 (#387) — the plugin's effect contributions. Each defaults to the manifest field
+      # and each MAY be overridden to fold in per-project facts, exactly as {#protocol_contracts} may.
+      #
+      # {#effect_attributions} is the one that needs it: a Rails app's ActiveJob transport is whatever
+      # `config.active_job.queue_adapter` names, so rigor-activejob answers `io.db.write` for Solid Queue
+      # and `io.net` for Sidekiq by reading the project's own configuration. That read is a plugin-side I/O
+      # boundary read and must not happen on a run with effects off — {Registry#effect_contributions} is
+      # lazy for exactly that reason, and nothing asks unless the project has an `effects:` block.
+      def effect_attributions
+        manifest.effect_attributions
+      end
+
+      def effect_edges
+        manifest.effect_edges
+      end
+
+      def effect_labels
+        manifest.effect_labels
+      end
+
+      def effect_entry_points
+        manifest.effect_entry_points
+      end
+
       # ADR-7 § "Slice 6-A/6-B" — per-plugin {IoBoundary}. Memoised so the boundary's accumulated `FileEntry`
       # rows persist across producer invocations within the same plugin instance and feed cache invalidation
       # via `cache_for`.