rigortype 0.3.3 → 0.3.5

data/lib/rigor/effects/inline_anchor.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Effects
+    # Maps a position read out of a **synthesized** RBS buffer back onto the Ruby file the author
+    # actually wrote in ([#432](https://github.com/rigortype/rigor/issues/432)).
+    #
+    # An rbs-inline annotation never reaches the envelope reader as the line the author typed. The
+    # plugin hands `RBS::Inline::Writer`'s output to the loader as a `virtual:rbs-inline:<path>.rb`
+    # buffer, and that output is a *fresh document*: bodies are gone, the members it emits are the
+    # signatures rather than the `def`s, and every annotation is re-emitted above its member on a line
+    # of the writer's choosing. The buffer name still names the `.rb`, so a location rendered straight
+    # off `RBS::Location` reads `app/models/change.rb:5` — the right file, and a line number that
+    # belongs to a document nobody has. On a file with a licence header it lands inside the copyright
+    # notice and is not even visibly wrong.
+    #
+    # ## Why the answer is the annotation's own text, matched by ordinal
+    #
+    # There is no line table to consult: upstream's writer emits text and keeps no mapping, and the
+    # synthesized buffer is what the RBS parser saw. What both documents *do* share is the author's own
+    # spelling — `%a{pure}` reaches the buffer verbatim — and their order, because the writer emits
+    # members in source order. So the k-th `%a{pure}` of the buffer is the k-th `%a{pure}` of the `.rb`,
+    # and matching on the ordinal is what keeps a file with several identically-bounded methods from
+    # pointing all of them at the first one. A plain "find the text" search cannot tell them apart, and
+    # a fixed offset would encode one fixture's licence header as if it were a rule.
+    #
+    # Two filters make the two lists comparable:
+    #
+    # - in the buffer, only a line whose own text *is* the annotation counts. The writer also echoes the
+    #   author's comment block above each member, so `# @rbs %a{pure}` appears there too and would
+    #   double every count;
+    # - in the `.rb`, only a comment line counts, so a `%a{…}` inside a string literal or a heredoc is
+    #   never mistaken for a declaration.
+    #
+    # Every step degrades to the buffer line it was given: a `.rb` that cannot be read, a spelling with
+    # no match, a writer that some day stops preserving order. A position one line off is a smaller
+    # harm than a raised exception on a run that had a real finding to report.
+    class InlineAnchor
+      RUBY_EXTENSION = ".rb"
+      private_constant :RUBY_EXTENSION
+
+      # An RBS annotation as the parser sees it: the line's own text, not a comment mentioning one.
+      ANNOTATION_PREFIX = "%a{"
+      private_constant :ANNOTATION_PREFIX
+
+      COMMENT_PREFIX = "#"
+      private_constant :COMMENT_PREFIX
+
+      SPELLING_PATTERN = /%a\{[^}]*\}/
+      private_constant :SPELLING_PATTERN
+
+      # @param path [String] the buffer's readable path, as {SignatureSources.source_path} renders it.
+      # @param buffer [String] the synthesized RBS the position was read out of.
+      # @return [InlineAnchor, nil] nil when `path` is not a Ruby file — a real `.rbs` needs no mapping,
+      #   and its own line numbers are already the ones a reader can open.
+      def self.for(path:, buffer:)
+        return nil unless path.to_s.end_with?(RUBY_EXTENSION)
+
+        new(path: path.to_s, buffer: buffer.to_s)
+      end
+
+      # One-shot form, for a caller that holds a `[path, buffer, line]` triple and no anchor.
+      #
+      # @return [Integer] the `.rb` line, or `buffer_line` unchanged when there is nothing to map.
+      def self.ruby_line(path:, buffer:, buffer_line:, spelling: nil)
+        anchor = self.for(path: path, buffer: buffer)
+        return buffer_line if anchor.nil?
+
+        anchor.line_for(buffer_line, spelling: spelling)
+      end
+
+      def initialize(path:, buffer:)
+        @path = path
+        @buffer = buffer
+        @ruby_lines = nil
+      end
+
+      # @param buffer_line [Integer] 1-based, counting into the synthesized buffer.
+      # @param spelling [String, nil] the annotation's own text (`"%a{pure}"`); read off the buffer line
+      #   when the caller does not already hold it.
+      # @return [Integer] the 1-based line of the same annotation in the Ruby file.
+      def line_for(buffer_line, spelling: nil)
+        spelling = normalize(spelling) || spelling_at(buffer_line)
+        return buffer_line if spelling.nil?
+
+        candidates = ruby_lines.filter_map { |number, text| number if text.include?(spelling) }
+        return buffer_line if candidates.empty?
+
+        candidates[ordinal_of(buffer_line, spelling)] || candidates.first
+      end
+
+      private
+
+      # The spelling as it appears in both documents. Callers hold it as `"%a{#{annotation.string}}"`,
+      # which is already that form; anything else is read for its annotation text or dropped.
+      def normalize(spelling)
+        spelling.to_s[SPELLING_PATTERN]
+      end
+
+      def spelling_at(buffer_line)
+        @buffer.each_line.with_index(1) do |text, number|
+          return text[SPELLING_PATTERN] if number == buffer_line
+        end
+        nil
+      end
+
+      # How many annotations of the same spelling the buffer declares before `buffer_line`. Comment
+      # lines are skipped: the writer echoes the author's `# @rbs %a{…}` above the annotation it
+      # generates, and counting both would land every lookup one match too far down the file.
+      def ordinal_of(buffer_line, spelling)
+        seen = 0
+        @buffer.each_line.with_index(1) do |text, number|
+          break if number >= buffer_line
+
+          stripped = text.lstrip
+          seen += 1 if stripped.start_with?(ANNOTATION_PREFIX) && stripped.include?(spelling)
+        end
+        seen
+      end
+
+      # The Ruby file's comment lines, as `[line number, text]`. Read once, and only for a position that
+      # is already going to be rendered.
+      def ruby_lines
+        @ruby_lines ||= begin
+          File.foreach(@path).with_index(1).filter_map do |text, number|
+            [number, text] if text.lstrip.start_with?(COMMENT_PREFIX)
+          end
+        rescue StandardError
+          [].freeze
+        end
+      end
+    end
+  end
+end

data/lib/rigor/effects/label.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Effects
+    # The effect-label grammar and the subsumption relation over it (ADR-103 WD1; normative in
+    # `docs/type-specification/effect-labels.md`).
+    #
+    # A label is a dot-path of lowercase segments — `io`, `io.net.http`, `nondet.time`. The relation
+    # that matters is **segment-aware prefix subsumption**: `io` admits `io.net.http` and rejects
+    # `iota`. Every method here is pure and total; a malformed input is answered, never raised on,
+    # so a caller can ask `valid?` and the rest in either order.
+    module Label
+      # `label = segment { "." segment }`, `segment = [a-z][a-z0-9]*`. Deliberately narrow: no
+      # underscores, no hyphens, no uppercase, no empty segment, no trailing dot. The same grammar
+      # is the RFC's `label` production, so a label spells identically in Steins and Rigor.
+      PATTERN = /\A[a-z][a-z0-9]*(?:\.[a-z][a-z0-9]*)*\z/
+
+      SEPARATOR = "."
+      private_constant :SEPARATOR
+
+      module_function
+
+      # Whether `str` is a well-formed label. Anything that is not a String is not.
+      def valid?(str)
+        str.is_a?(String) && PATTERN.match?(str)
+      end
+
+      # The label's segments, outermost first: `"io.net.http"` -> `["io", "net", "http"]`.
+      # A malformed label yields an empty array rather than a partial parse.
+      def segments(label)
+        return [].freeze unless valid?(label)
+
+        label.split(SEPARATOR).freeze
+      end
+
+      # Whether `bound` admits `label` under segment-aware prefix subsumption. A label subsumes
+      # itself; `io` subsumes `io.net.http`; `io` does NOT subsume `iota`, because the match is on
+      # segment boundaries and not on characters.
+      def subsumes?(bound, label)
+        return false unless valid?(bound) && valid?(label)
+        return true if bound == label
+
+        label.start_with?("#{bound}#{SEPARATOR}")
+      end
+
+      # The label one segment shallower, or `nil` for a root (and for a malformed label).
+      def parent(label)
+        return nil unless valid?(label)
+
+        index = label.rindex(SEPARATOR)
+        return nil unless index
+
+        label[0, index]
+      end
+
+      # The label's proper ancestors, outermost first and excluding the label itself:
+      # `"io.net.http"` -> `["io", "io.net"]`. A root has no ancestors.
+      def ancestors(label)
+        parts = segments(label)
+        return [].freeze if parts.length <= 1
+
+        result = []
+        prefix = nil
+        parts[0...-1].each do |segment|
+          prefix = prefix ? "#{prefix}#{SEPARATOR}#{segment}" : segment
+          result << prefix
+        end
+        result.freeze
+      end
+
+      # The label's outermost segment — the root whose ownership the registry checks.
+      def root(label)
+        segments(label).first
+      end
+    end
+  end
+end

data/lib/rigor/effects/label_intent.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require_relative "label"
+
+module Rigor
+  module Effects
+    # Whether an unrecognised effect label is evidence of a **typo** rather than of a word that was
+    # never meant to be a label at all (ADR-103 WD1; normative in
+    # `docs/type-specification/effect-labels.md` § Unknown labels).
+    #
+    # The degradation an unknown label causes is silent by construction — the tag reads ⊤ and stops
+    # bounding anything — so a paired diagnostic is the only thing that keeps the fail-open rule
+    # honest. But the diagnostic cannot fire on every unrecognised spelling: a vocabulary is open by
+    # design (`effects.labels:`, a plugin's own root), so an unknown word is as likely to be a label
+    # this project has not registered yet as it is to be a misspelling. Reporting both would put a
+    # finding on correct-by-intent code, which is the direction the false-positive budget is not
+    # allowed to run ([ADR-5](../../../docs/adr/5-robustness-principle.md)).
+    #
+    # Intent is therefore read off four signals, any one of which is enough:
+    #
+    # 1. **A near miss** — the spelling is within {Registry::SUGGESTION_DISTANCE_CAP} edits of a
+    #    label the registry knows (`io.bd` against `io.db`).
+    # 2. **A known sibling** — another member of the same comma-separated list is recognised, so the
+    #    list as a whole is demonstrably written in this vocabulary.
+    # 3. **A dotted path** — the token carries two or more segments (`io.netw`). Nothing but a label
+    #    is spelled that way; a project opening its own root writes a bare word first.
+    # 4. **A retired spelling** — the registry's `retired:` table names it, so the author wrote a
+    #    label that WAS correct and a vocabulary bump moved it.
+    #
+    # A lone far-off word (`%a{rigor:v1:effect database}`) matches none of them and stays silent
+    # everywhere. It still degrades the tag to ⊤ — the reading never depends on this module.
+    module LabelIntent
+      # How many dot-separated segments make a token unmistakably label-shaped (signal 3).
+      MULTI_SEGMENT_ARITY = 2
+
+      module_function
+
+      # Whether reporting `token` as an unknown label is justified.
+      #
+      # @param token [String] the spelling as written.
+      # @param registry [Rigor::Effects::Registry, nil] the vocabulary AFTER plugin load; `nil` (no
+      #   vocabulary at all) makes every token unjudgeable and therefore silent.
+      # @param siblings [Array<String>] the other tokens of the same list / the same config value.
+      # @return [Boolean]
+      def evident?(token, registry, siblings: [])
+        return false if registry.nil?
+        return false unless Label.valid?(token)
+        return false if registry.known?(token)
+
+        retired?(token, registry) || near_miss?(token, registry) ||
+          multi_segment?(token) || known_sibling?(token, registry, siblings)
+      end
+
+      def retired?(token, registry)
+        !Array(registry.retired(token)).empty?
+      end
+
+      def near_miss?(token, registry)
+        !registry.suggest(token).nil?
+      end
+
+      def multi_segment?(token)
+        Label.segments(token).length >= MULTI_SEGMENT_ARITY
+      end
+
+      def known_sibling?(token, registry, siblings)
+        Array(siblings).any? { |sibling| sibling != token && registry.known?(sibling.to_s) }
+      end
+
+      private_class_method :retired?, :near_miss?, :multi_segment?, :known_sibling?
+    end
+  end
+end

data/lib/rigor/effects/label_set.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require_relative "label"
+
+module Rigor
+  module Effects
+    # An immutable, sorted, de-duplicated set of effect labels — the carrier of a summary lane and
+    # of an envelope's bound (ADR-103 WD1).
+    #
+    # Two sentinels bracket the lattice. {EMPTY} is the empty set: "no effects", the reading of
+    # `%a{pure}` modulo `mutate.local`. {TOP} is the unbounded / unspecified reading: it admits
+    # every label, it absorbs every join, and it is what a tag carrying an unknown label degrades
+    # to (the fail-open rule). {TOP} is NOT the set of all registered labels and is deliberately
+    # not enumerable — `top?` is the only way to tell it from {EMPTY} through `to_a`.
+    #
+    # Instances are frozen on construction and hold a frozen array, so they cross a Ractor boundary
+    # and go into a cache entry as they are.
+    class LabelSet
+      NO_LABELS = [].freeze
+      private_constant :NO_LABELS
+
+      # Build a set from any enumerable of label strings. Members are normalised (de-duplicated and
+      # sorted) so equality is structural and a snapshot rendering is deterministic.
+      #
+      # Raises `ArgumentError` on a member that does not satisfy {Label::PATTERN}: a LabelSet is a
+      # value object over the grammar, and the fail-open handling of an unrecognised *spelling* is
+      # the reader's job (it yields {TOP}), not this constructor's.
+      #
+      # `top:` is internal — it exists to build {TOP} and is not part of the surface later slices
+      # build on.
+      def initialize(labels = NO_LABELS, top: false)
+        @top = top
+        @labels = NO_LABELS
+        unless top
+          members = labels.to_a
+          members.each do |label|
+            raise ArgumentError, "not a well-formed effect label: #{label.inspect}" unless Label.valid?(label)
+          end
+          @labels = members.uniq.sort.freeze
+        end
+        freeze
+      end
+
+      # The unbounded set. Everything is subsumed by it; joining it with anything yields it.
+      TOP = new(NO_LABELS, top: true)
+
+      # The empty set — no effects at all.
+      EMPTY = new(NO_LABELS)
+
+      # Whether this is the unbounded sentinel {TOP}.
+      def top?
+        @top
+      end
+
+      # Whether this set records no labels. {TOP} is not empty: it records nothing because it
+      # stands for everything.
+      def empty?
+        !@top && @labels.empty?
+      end
+
+      # The members, sorted, as a frozen array. {TOP} yields `[]` — consult {top?} first.
+      def to_a
+        @labels
+      end
+
+      # Exact membership among the recorded labels. `LabelSet.new(["io"]).include?("io.net")` is
+      # false — that question is {admits?}. {TOP} records no members, so it includes none.
+      def include?(label)
+        @labels.include?(label)
+      end
+
+      # Whether some member of this set subsumes `label`. {TOP} admits every well-formed label.
+      def admits?(label)
+        return Label.valid?(label) if @top
+
+        @labels.any? { |member| Label.subsumes?(member, label) }
+      end
+
+      # Union. {TOP} absorbs: a join involving it is {TOP}.
+      #
+      # A join that adds nothing returns `self` **without allocating**. That is the common case wherever
+      # sets are joined in a loop — the propagator's fixpoint re-joins every edge on every visit — and the
+      # sets are single-digit-sized, so the containment scan is cheaper than the construction it avoids.
+      def join(other)
+        return TOP if @top || other.top?
+        return other if @labels.empty?
+
+        others = other.to_a
+        return self if others.empty?
+        return self if others.all? { |label| @labels.include?(label) }
+
+        self.class.new(@labels + others)
+      end
+
+      # The members `other` does not already admit — the **declared lane's rendering rule**. A declared
+      # `io.net.http` beside a proven `io.net` says nothing the proven lane did not already say more
+      # strongly, so a renderer drops it rather than printing `[io.net] ≤ [io.net.http]`, which reads as
+      # two facts where there is one. Applied where output is produced, never to the table: the lanes
+      # themselves stay raw, because a later join has to see what was actually declared.
+      def excluding_subsumed_by(other)
+        return self if @top || other.empty?
+
+        kept = @labels.reject { |label| other.admits?(label) }
+        return self if kept.length == @labels.length
+
+        kept.empty? ? EMPTY : self.class.new(kept)
+      end
+
+      # Whether every member of this set is admitted by `bound_set` — the envelope check, modulo
+      # the policy discharge that happens at judgment time. {TOP} is bounded only by {TOP}.
+      def subsumed_by?(bound_set)
+        return true if bound_set.top?
+        return false if @top
+
+        @labels.all? { |label| bound_set.admits?(label) }
+      end
+
+      def ==(other)
+        return true if equal?(other)
+
+        other.is_a?(LabelSet) && other.top? == @top && other.to_a == @labels
+      end
+      alias eql? ==
+
+      def hash
+        [self.class, @top, @labels].hash
+      end
+
+      def inspect
+        return "#<Rigor::Effects::LabelSet TOP>" if @top
+
+        "#<Rigor::Effects::LabelSet #{@labels.join(', ')}>"
+      end
+    end
+  end
+end

data/lib/rigor/effects/liskov_check.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+
+require_relative "envelope"
+require_relative "envelope_check"
+require_relative "method_key"
+require_relative "path_finder"
+
+module Rigor
+  module Effects
+    # Judges an override against the envelope it inherits (ADR-103 WD1 / WD14; #386). The one place
+    # `effect.liskov-widened` is decided.
+    #
+    # An envelope is a contract about a method, and Ruby's `class PgRepo < Repo` says a `PgRepo` is
+    # usable wherever a `Repo` is. So a bound written on `Repo#find` binds `PgRepo#find` too:
+    # **implementations may be purer than the bound they inherit, never less pure.** That is Liskov
+    # inclusion applied to the second dimension, and it is what makes the declared lane's nominal carrier
+    # (#386, {EnvelopeIndex}) honest — a caller that imports `≤ io.db` from a `Repo`-typed receiver is
+    # entitled to that bound whichever subclass actually arrives.
+    #
+    # Two comparisons, and an override is subject to exactly one of them:
+    #
+    # - **Proven against the inherited bound** — the override declares nothing of its own, so what it
+    #   *does* is what the ancestor's bound has to admit. It reads the same lane
+    #   {EnvelopeCheck} reads, for the same reasons: the proven closure, undischarged per policy,
+    #   `mutate.local` tolerated, taint ignored.
+    # - **Declared against the inherited bound** — the override declares its own envelope, and a bound
+    #   wider than the one it inherits is a Liskov violation in the *declaration*, before any body is
+    #   consulted. Two authored bounds compared by subsumption; nothing proven enters it.
+    #
+    # The split is exclusive on purpose. An override that declares its own envelope is already held to
+    # that envelope by `effect.envelope-exceeded`, so running the proven comparison too would put two
+    # diagnostics on one line for one label. What the author asserted is the thing Liskov has to judge;
+    # whether the body honours the assertion is the other rule's question.
+    #
+    # Both-sides-authored, in the [ADR-35](../../../docs/adr/35-override-signature-compatibility.md)
+    # sense: nothing fires unless an author wrote an envelope on the ancestor. That is the accepted
+    # construction the false-positive budget is spent under — a firing is never unsolicited.
+    #
+    # **Nominal subclassing only.** An included module's method is not an override in this slice: Ruby's
+    # ancestry puts an includer's own `def` *ahead* of the module's rather than under it, and the
+    # substitutability argument that licenses the check is the subclass one. The `superclasses` table is
+    # the collector's own, as-written and resolved here exactly as {Propagator} resolves it, so the
+    # relation the check reads and the closed world the proven lane travels can never disagree.
+    module LiskovCheck
+      # One (override, exceeding label) pair.
+      #
+      # `own_envelope` is the override's own bound when there is one, which is also what selects the
+      # message variant: present means the declaration-level comparison produced this finding, nil means
+      # the proven one. `chain` / `origin` explain the proven variant and are nil for the other, which
+      # has no path to walk — a declaration is not proved by anything.
+      Finding = Data.define(:key, :label, :ancestor_key, :ancestor_envelope, :own_envelope, :path, :line,
+                            :chain, :origin)
+
+      NO_FINDINGS = [].freeze
+      private_constant :NO_FINDINGS
+
+      module_function
+
+      # @param table [EffectTable] the run's propagated graph.
+      # @param superclasses [Hash{String => Array<String>}] the collector's as-written superclass
+      #   candidate lists (`FileCollection#superclasses`).
+      # @param method_envelopes [Hash{String => Envelope}] per-method envelopes, as written.
+      # @param class_envelopes [Hash{String => Envelope}] class- / module-level envelopes, to distribute.
+      # @param config_envelopes [Hash{String => Envelope}] `effects.envelopes:` entries already resolved
+      #   to the classes they select.
+      # @param positions [EnvelopeCheck::Positions] where the override's `def` is.
+      # @param apply_tolerated [Boolean] false judges against `proven` — `--no-tolerated-effects`.
+      # @return [Array<Finding>] sorted by position then key then label.
+      def run(table:, superclasses:, method_envelopes:, class_envelopes:, config_envelopes: {},
+              positions: EnvelopeCheck::Positions.empty, apply_tolerated: true)
+        # The distributed strata, over a base of the raw per-method annotations: a base class whose method
+        # exists only in `.rbs` — an abstract `def find: (Integer) -> User` with no Ruby body — has no
+        # key in the table and so no distributed entry, and its bound is exactly the one an override
+        # inherits. Distribution wins on collision, which is the same value for a key that has both.
+        envelopes = method_envelopes.merge(
+          EnvelopeCheck.distribute(table, method_envelopes, class_envelopes, config_envelopes)
+        )
+        return NO_FINDINGS if envelopes.empty?
+
+        parents = parent_map(table, superclasses)
+        return NO_FINDINGS if parents.empty?
+
+        findings = []
+        keys = table.keys
+        keys.each { |key| collect(findings, table, key, envelopes, parents, positions, apply_tolerated) }
+        findings.sort_by { |f| [f.path.to_s, f.line, f.key, f.label] }.freeze
+      end
+
+      # `{child class => parent class}`, one parent per child.
+      #
+      # An ancestry name is recorded as written, so `class Loud < Base` inside `module Tracer` arrives as
+      # the candidate list Ruby's own lexical lookup would try, most-qualified first. The most-qualified
+      # candidate the project actually defines wins — the same rule {Propagator::Index#build_descendants}
+      # applies, and for the same reason: without it `A::Base` and `B::Base` would share the bare spelling
+      # `Base` and an unrelated class's envelope would bind an override that never inherited it.
+      def parent_map(table, superclasses)
+        return {} if superclasses.nil? || superclasses.empty?
+
+        known = table.keys.filter_map { |key| MethodKey.owner(key) }.to_set
+        superclasses.each_with_object({}) do |(child, candidates), out|
+          parent = Array(candidates).find { |candidate| known.include?(candidate) }
+          out[child] = parent if parent && parent != child
+        end
+      end
+
+      def collect(findings, table, key, envelopes, parents, positions, apply_tolerated)
+        class_name, separator, selector = MethodKey.split(key)
+        return if class_name.nil?
+
+        ancestor_key = inherited_key(class_name, separator, selector, envelopes, parents)
+        return if ancestor_key.nil?
+
+        inherited = envelopes.fetch(ancestor_key)
+        own = envelopes[key]
+        position = positions.for(key)
+        if own && !own.top?
+          collect_declared(findings, key, ancestor_key, inherited, own, position)
+        else
+          collect_proven(findings, table, key, ancestor_key, inherited, position, apply_tolerated)
+        end
+      end
+
+      # The nearest ancestor whose own method key carries an envelope. Nearest wins for the same reason
+      # it does among strata: a bound written closer to the override is the more specific statement about
+      # it, and a grandparent's bound is already binding on the parent that sits between them.
+      def inherited_key(class_name, separator, selector, envelopes, parents)
+        seen = Set.new([class_name])
+        current = parents[class_name]
+        while current && seen.add?(current)
+          candidate = "#{current}#{separator}#{selector}"
+          return candidate if envelopes.key?(candidate) && !envelopes.fetch(candidate).top?
+
+          current = parents[current]
+        end
+        nil
+      end
+
+      def collect_proven(findings, table, key, ancestor_key, inherited, position, apply_tolerated)
+        entry = table[key]
+        return if entry.nil?
+
+        exceeding = inherited.exceeded_by(apply_tolerated ? entry.undischarged : entry.proven)
+        exceeding.each do |label|
+          trail = PathFinder.shortest(table, symbol: key, label: label)
+          findings << Finding.new(
+            key: key, label: label, ancestor_key: ancestor_key, ancestor_envelope: inherited,
+            own_envelope: nil, path: position.first, line: position.last,
+            chain: trail&.chain || [key].freeze, origin: trail&.origin
+          )
+        end
+      end
+
+      # Two authored bounds, compared by subsumption alone. `mutate.local` is tolerated here as it is
+      # everywhere, so declaring it under an inherited `%a{pure}` is not a widening.
+      def collect_declared(findings, key, ancestor_key, inherited, own, position)
+        own.bound.to_a.reject { |label| inherited.tolerates?(label) }.each do |label|
+          findings << Finding.new(
+            key: key, label: label, ancestor_key: ancestor_key, ancestor_envelope: inherited,
+            own_envelope: own, path: position.first, line: position.last, chain: nil, origin: nil
+          )
+        end
+      end
+
+      private_class_method :parent_map, :collect, :inherited_key, :collect_proven, :collect_declared
+    end
+  end
+end