rigortype 0.3.4 → 0.3.6

data/lib/rigor/effects/scanner.rb

@@ -116,12 +116,20 @@ module Rigor
       end
 
       def enter_def(node, prefix, singleton)
-        instance_method = !singleton && node.receiver.nil?
-        harvest_for(prefix)[:defs] << node.name.to_s if @harvest && instance_method && !prefix.empty?
-        add_unit(
-          class_name_for(prefix), node.name.to_s, singleton || !node.receiver.nil?,
-          node.body, node.parameters
-        )
+        own_singleton = singleton || !node.receiver.nil?
+        scan = add_unit(class_name_for(prefix), node.name.to_s, own_singleton, node.body, node.parameters)
+        harvest_def(prefix, node.name.to_s, own_singleton, scan) if @harvest && !prefix.empty?
+      end
+
+      # What the framework strategies need to know about a `def` the class body spelled out itself: that it
+      # exists, and whether it reaches `super`. `:defs` stays instance-only, because a mailer action is an
+      # instance method; `:units` is keyed by the suffix a synthetic unit key carries, so both sides of the
+      # `#` / `.` split are answerable (#440). A body the collector could not finish reads as delegating,
+      # which keeps the framework's claim — the fail-soft direction for an upper bound.
+      def harvest_def(prefix, name, singleton, scan)
+        entry = harvest_for(prefix)
+        entry[:defs] << name unless singleton
+        entry[:units]["#{singleton ? '.' : '#'}#{name}"] = scan.nil? || scan.delegates_upward?
       end
 
       # ADR-103 WD10 — a receiver-less call in a class body, recorded as `macro => [literal symbol
@@ -156,7 +164,7 @@ module Rigor
       end
 
       def harvest_for(prefix)
-        @harvest[class_name_for(prefix)] ||= { defs: [], macros: {}, uniqueness: false }
+        @harvest[class_name_for(prefix)] ||= { defs: [], units: {}, macros: {}, uniqueness: false }
       end
 
       # Files the units the framework contributes for each class this file declares. Runs after the walk,
@@ -168,7 +176,7 @@ module Rigor
         @harvest.each do |class_name, entry|
           FrameworkUnits.synthesize(
             class_name: class_name, instance_methods: entry[:defs], macros: entry[:macros],
-            uniqueness: entry[:uniqueness], plugin_facts: @plugin_facts
+            uniqueness: entry[:uniqueness], plugin_facts: @plugin_facts, own_units: entry[:units]
           ).each { |key, summary, edges| merge_unit(key, summary, edges) }
         end
       end
@@ -176,6 +184,8 @@ module Rigor
       # Scans one unit and files its summary, then recurses into the units its body declared. Fail-soft
       # per unit (ADR-103 WD13): a unit the scanner cannot finish is recorded as non-exhaustive with
       # `collector-error` and its siblings are unaffected.
+      #
+      # @return [UnitScan, nil] the finished scan, or nil when the unit failed soft
       def add_unit(class_name, method_name, singleton, body, parameters)
         key = "#{class_name}#{singleton ? '.' : '#'}#{method_name}"
         names = parameter_names(parameters)
@@ -184,15 +194,17 @@ module Rigor
           block_parameter: block_parameter_name(parameters),
           owned_locals: LocalOwnership.owned(body, names), calls: @calls,
           attribution: @attribution, envelopes: @envelopes, plugin_facts: @plugin_facts,
-          owner_class: class_name
+          owner_class: class_name, method_name: method_name
         )
         summary, edges = scan.run(body)
         merge_unit(key, summary, edges)
         scan.nested.each do |name, nested_singleton, nested_body, nested_parameters|
           add_unit(class_name, name, singleton || nested_singleton, nested_body, nested_parameters)
         end
+        scan
       rescue StandardError
         merge_unit(key, Summary.tainted("collector-error", method_name), [])
+        nil
       end
 
       # A receiver-less call in a class / module body that declares units or ancestry. Class bodies are

data/lib/rigor/effects/signature_sources.rb

@@ -21,10 +21,21 @@ module Rigor
       DEFAULT_ROOTS = ["sig"].freeze
 
       # A cheap text pre-filter for "does this source carry an effect annotation at all". It matches
-      # the two spellings the envelope reader honours and nothing else, so a signature tree with no
+      # the two payloads the envelope reader honours and nothing else, so a signature tree with no
       # effect annotation is answered by one regex per file and never parsed. It is a ROUTING test,
       # not the grammar — `RbsExtended.parse_effect_annotation` is still what decides meaning.
-      ANNOTATION_HINT = /%a\{\s*(?:pure\s*\}|rigor:v1:effect\b)/
+      #
+      # RBS accepts five bracket pairs for an annotation, and the reader sees only the text inside
+      # them, so the hint must accept all five too: routing on `%a{` alone made a `%a(pure)` project
+      # invisible to the run-cache probe, which then served the fast path while a bound existed —
+      # the silent-lane shape the #428 family is about. Over-matching (a mismatched closer) is safe:
+      # the cost is one declined fast path or one parsed file, never a missed bound.
+      ANNOTATION_BRACKETS = { "{" => "}", "(" => ")", "[" => "]", "|" => "|", "<" => ">" }.freeze
+      ANNOTATION_HINT = Regexp.union(
+        ANNOTATION_BRACKETS.map do |opener, closer|
+          /%a#{Regexp.escape(opener)}\s*(?:pure\s*#{Regexp.escape(closer)}|rigor:v1:effect\b)/
+        end
+      )
 
       # A `virtual:<plugin-id>:<source path>` buffer is rbs-inline's (or a plugin's) synthesized RBS for
       # a Ruby file the author actually wrote in. Naming that file is what a reader can act on, so the
@@ -58,6 +69,22 @@ module Rigor
         signature_paths.nil? || signature_paths.empty? ? DEFAULT_ROOTS : signature_paths
       end
 
+      # The FIRST annotated virtual entry, as a `collect`-shaped one-element array (or an empty one).
+      #
+      # #441 — the analysis paths use this to hand the annotations-unchecked residual the inline stratum
+      # of a run that resolved an environment but never stored it. Reduced to one entry on purpose: the
+      # residual reports one annotation per run, so the carrier a run holds past the environment's own
+      # lifetime is a single synthesized buffer rather than the project's whole virtual tree.
+      #
+      # @param virtual_rbs [Array<Array(String, String)>, nil]
+      # @return [Array<Array(String, String)>] zero or one pair.
+      def annotated_carrier(virtual_rbs)
+        Array(virtual_rbs).each do |name, content|
+          return [[name.to_s, content.to_s]] if ANNOTATION_HINT.match?(content)
+        end
+        [].freeze
+      end
+
       # The first `[name, content, line]` carrying an effect annotation, or nil. Line numbers are
       # 1-based and count into `content`, which for a `virtual:` buffer is the SYNTHESIZED text — the
       # caller re-anchors it against the Ruby file when that matters.

data/lib/rigor/effects/snapshot.rb

@@ -38,7 +38,10 @@ module Rigor
     class Snapshot
       # Bumped when the file's shape changes in a way an older reader would misread. A bump makes every
       # existing file a regeneration event rather than a silent reinterpretation.
-      SCHEMA = 1
+      # 2 — `unresolved:` became a count (#434). A schema-1 file still loads, and its only reported
+      # difference is this field, so an existing project sees one regeneration line rather than a
+      # reinterpretation.
+      SCHEMA = 2
 
       HEADER = "# .rigor-effects.yml — generated by `rigor effects update`. Commit it; review its diff."
 
@@ -47,8 +50,16 @@ module Rigor
 
       # One row of either table.
       #
-      # `effects` and `declared` are sorted label arrays; `unresolved` is the sorted list of taint-cause
-      # renderings behind a false `exhaustive`, and is empty when the row is exhaustive.
+      # `effects` and `declared` are sorted label arrays; `unresolved` is HOW MANY taint causes sit behind
+      # a false `exhaustive`, and is zero when the row is exhaustive.
+      #
+      # A count rather than the causes themselves (#434). On redmine the cause renderings were 144,771 of
+      # the file's 293,276 bytes, on lines up to 821 characters — simultaneously the half a reviewer
+      # cannot read and the half that churns when an unrelated call moves. This file already makes that
+      # argument about origins ("a record keyed by them would churn on every refactor"); the causes are
+      # the same class of thing and were the one place it was not applied. What a reviewer needs from the
+      # record is the stable fact that the row is not exhaustive and by how much, which is what a count
+      # is; `rigor effects explain` names the causes on demand, against the live table.
       class Entry < Data.define(:key, :effects, :declared, :exhaustive, :unresolved)
         def exhaustive?
           exhaustive
@@ -61,7 +72,7 @@ module Rigor
           row = { "effects" => effects }
           row["declared"] = declared unless declared.empty?
           row["exhaustive"] = false unless exhaustive
-          row["unresolved"] = unresolved unless unresolved.empty?
+          row["unresolved"] = unresolved unless unresolved.zero?
           row
         end
 
@@ -73,10 +84,23 @@ module Rigor
             effects: string_list(row["effects"], key, "effects"),
             declared: string_list(row["declared"], key, "declared"),
             exhaustive: row.fetch("exhaustive", true) != false,
-            unresolved: string_list(row["unresolved"], key, "unresolved")
+            unresolved: unresolved_count(row["unresolved"], key)
           )
         end
 
+        # Tolerant of the schema-1 spelling, which was the list itself: the field's whole point now is a
+        # stable number, and a schema-1 file must LOAD so the header's own mismatch can be reported as
+        # the one regeneration event it is. Refusing to parse it would turn a migration into an error.
+        def self.unresolved_count(value, key)
+          case value
+          when nil then 0
+          when Integer then value
+          when Array then value.length
+          else raise ParseError, "#{key.inspect} unresolved: expected a count, got #{value.class}"
+          end
+        end
+        private_class_method :unresolved_count
+
         def self.string_list(value, key, field)
           return [].freeze if value.nil?
           raise ParseError, "#{key.inspect} #{field}: expected a list, got #{value.class}" unless value.is_a?(Array)
@@ -164,11 +188,7 @@ module Rigor
           entries.flat_map do |entry|
             next [entry] if EntryPoints.glob?(entry)
 
-            EntryPoints.globs_for(entry) ||
-              raise(EntryPoints::Error,
-                    "effects.snapshot.reach names no registered entry-point preset: #{entry.inspect} " \
-                    "(registered: #{EntryPoints.names.inspect}; a preset is named by the plugin that " \
-                    "models the framework, so listing that plugin is what registers it)")
+            EntryPoints.resolve!(entry)
           end.uniq.sort.freeze
         end
 
@@ -189,6 +209,29 @@ module Rigor
           parse(File.read(path, encoding: "UTF-8"))
         end
 
+        # A path as a reader sees it: project-relative when it is under the root, absolute when it is not.
+        #
+        # Public for the same reason {.render_causes} is — `reach:`'s entry-point globs and a drift row's
+        # source suffix (#435) must agree about what a project-relative path is, and a report that leaked
+        # `/private/tmp/nix-shell.../loud.rb` into a reviewer's terminal would be answering with this
+        # machine's layout rather than with the project's.
+        def relativize(path, project_root)
+          absolute = File.absolute_path(path.to_s)
+          root = "#{File.absolute_path(project_root.to_s).chomp('/')}/"
+          absolute.start_with?(root) ? absolute[root.length..] : absolute
+        end
+
+        # The taint causes as a reviewer reads them, from the closed enum of
+        # `docs/type-specification/effect-labels.md` — `dynamic-send`, `unresolved-self-call(save!)`.
+        #
+        # Public because two surfaces render the same causes and must not disagree about what one IS:
+        # a row's `unresolved:` count is the length of this list, and `rigor effects explain` prints the
+        # list itself for an `exhaustive → not` drift row (#434 / #435). One implementation, as WD3 asks.
+        def render_causes(causes)
+          causes.map { |cause, detail| detail.nil? || detail.empty? ? cause : "#{cause}(#{detail})" }
+                .uniq.sort.freeze
+        end
+
         private
 
         def parse_header(data)
@@ -245,12 +288,6 @@ module Rigor
           end
         end
 
-        def relativize(path, project_root)
-          absolute = File.absolute_path(path.to_s)
-          root = "#{File.absolute_path(project_root.to_s).chomp('/')}/"
-          absolute.start_with?(root) ? absolute[root.length..] : absolute
-        end
-
         # Each table takes the lanes at ITS own reading: `methods:` records the direct summary, so its
         # `declared:` is what this method's own body claims, and `reach:` records the transitive one, so
         # its `declared:` is the fixpoint's — a controller reaching an attributed gem call through two
@@ -265,19 +302,10 @@ module Rigor
             effects: proven.to_a,
             declared: declared.excluding_subsumed_by(proven).to_a,
             exhaustive: exhaustive,
-            unresolved: exhaustive ? [].freeze : render_causes(causes)
+            unresolved: exhaustive ? 0 : render_causes(causes).length
           )
         end
 
-        # `unresolved:` says why the row is not exhaustive, from the closed taint-cause enum of
-        # `docs/type-specification/effect-labels.md` — `dynamic-send`, `unresolved-self-call(save!)`. The
-        # design note sketched this field as "call names"; the collector keeps causes rather than names,
-        # and for the causes that have one the detail already IS the call name.
-        def render_causes(causes)
-          causes.map { |cause, detail| detail.nil? || detail.empty? ? cause : "#{cause}(#{detail})" }
-                .uniq.sort.freeze
-        end
-
         # A synthesised default summary — an `attr_*` writer's `mutate.self`, and the `Struct` / `Data`
         # accessors that join it when discovery synthesises them — carries no information a reviewer acts
         # on: it restates the `attr_accessor` line. Recognised by its origins being exactly the synthesised
@@ -335,6 +363,25 @@ module Rigor
       # Renders the file. Hand-rolled rather than `YAML.dump`ed so the leading comment, the key order and
       # the flow sequences are ours: two runs over one tree must be byte-identical, and a snapshot written
       # by a pooled run must equal the sequential one bit for bit.
+      # The hint goes in the artefact, not only in the run's output (#436): `reach:` is the half of the
+      # snapshot that answers what an entry point *causes*, and a project that never configured one
+      # commits the less interesting half with no way to know it. The run also names the presets its own
+      # plugin set registered, which this file cannot — a committed artefact must not carry a list that
+      # goes stale when the plugin list changes.
+      EMPTY_REACH_NOTE = [
+        "",
+        "# `reach:` is empty. It records the TRANSITIVE footprint at your entry points — what a",
+        "# controller action or a job causes, rather than what its own body does — and it is the half of",
+        "# this file most worth reviewing. Fill it in by naming entry points in `.rigor.yml`:",
+        "#",
+        "#   effects:",
+        "#     snapshot:",
+        "#       reach: [rails]          # a preset a plugin registered, or a project-relative file glob",
+        "#",
+        "# `rigor effects update` prints the presets this project's plugins actually register."
+      ].freeze
+      private_constant :EMPTY_REACH_NOTE
+
       def to_yaml
         lines = [HEADER]
         lines << "schema: #{@header.fetch('schema')}"
@@ -342,6 +389,7 @@ module Rigor
         lines << "vocabulary: #{@header.fetch('vocabulary')}"
         lines << "config_digest: #{scalar(@header.fetch('config_digest'))}"
         render_table(lines, "methods", @methods)
+        lines.concat(EMPTY_REACH_NOTE) if @reach.empty?
         render_table(lines, "reach", @reach)
         "#{lines.join("\n")}\n"
       end

data/lib/rigor/effects/snapshot_diff.rb

@@ -107,6 +107,7 @@ module Rigor
         @undischarged = undischarged
         @added_symbols = 0
         @removed_symbols = 0
+        @suppressed = 0
         @events = build_events.freeze
         freeze
       end
@@ -123,9 +124,16 @@ module Rigor
       end
 
       # Renames are a removal plus an addition and are never reported as a lost effect; the footer is
-      # where the reviewer sees that the two counts balance.
+      # where the reviewer sees that the two counts balance. `suppressed` is the per-symbol events a
+      # regeneration event withheld — zero on an ordinary comparison.
       def footer
-        { added_symbols: @added_symbols, removed_symbols: @removed_symbols }
+        { added_symbols: @added_symbols, removed_symbols: @removed_symbols, suppressed: @suppressed }
+      end
+
+      # Whether the two sides were computed under different rules (#434). The per-symbol comparison is
+      # then meaningless rather than merely noisy, which is why {#build_events} withholds it.
+      def regeneration?
+        @events.any? { |event| event.category == REGENERATION }
       end
 
       def events_for(table)
@@ -145,10 +153,25 @@ module Rigor
         ADDITIVE_CATEGORIES.include?(event.category)
       end
 
+      # A regeneration event withholds the per-symbol comparison rather than printing it (#434).
+      #
+      # The header says the record was written under different rules, so the two sides are not
+      # comparable — a claim this class already makes in its own documentation and then contradicted by
+      # emitting every row anyway. On redmine a moved `config_digest:` produced one regeneration line
+      # followed by 482 `-symbol` lines, none of which was a review signal: they say the recorded set was
+      # computed differently, which the header already said once.
+      #
+      # The table comparison still RUNS, because its per-symbol counters are what tell the reader the
+      # scale of what is withheld. Only the events are dropped.
       def build_events
         return [missing_snapshot_event] if @recorded.nil?
 
-        header_events + TABLES.flat_map { |table| table_events(table) }
+        header = header_events
+        table = TABLES.flat_map { |name| table_events(name) }
+        return table if header.empty?
+
+        @suppressed = table.length
+        header
       end
 
       def missing_snapshot_event

data/lib/rigor/effects/taint_cause.rb

@@ -18,6 +18,7 @@ module Rigor
         dynamic-send
         method-missing
         unresolved-self-call
+        unresolved-super
         opaque-callable
         unknown-ownership
         plugin-attribution

data/lib/rigor/effects/unit_scan.rb

@@ -110,9 +110,12 @@ module Rigor
       # @param plugin_facts [PluginFacts] the loaded plugins' `effect_attributions:` (#387)
       # @param owner_class [String, nil] the class this unit is defined on — the carrier an
       #   implicit-self call's envelope is looked up under, since the syntax spells `Kernel#name`
+      # @param method_name [String, nil] this unit's own selector — what a `super` in its body names as
+      #   the target the propagator resolves above `owner_class` (#446). With no name to state, a `super`
+      #   taints instead.
       def initialize(singleton:, parameters:, block_parameter:, owned_locals:, calls:, # rubocop:disable Metrics/ParameterLists
                      attribution: Attribution.empty, envelopes: EnvelopeIndex.empty,
-                     plugin_facts: PluginFacts.empty, owner_class: nil)
+                     plugin_facts: PluginFacts.empty, owner_class: nil, method_name: nil)
         @singleton = singleton
         @block_parameter = block_parameter
         @calls = calls
@@ -120,6 +123,7 @@ module Rigor
         @envelopes = envelopes
         @plugin_facts = plugin_facts
         @owner_class = owner_class
+        @method_name = method_name
         @mutation = MutationClassifier.new(
           singleton: singleton, parameters: parameters, owned_locals: owned_locals
         )
@@ -128,12 +132,24 @@ module Rigor
         @causes = []
         @edges = []
         @nested = []
+        @delegates_upward = false
       end
 
       # Units discovered inside this one — a nested `def`, or a `define_method` with a literal name whose
       # block becomes that method's body. Each is `[name, singleton, body_node, parameters_node]`.
       attr_reader :nested
 
+      # Whether this body reaches `super` — an override that delegates upward still runs whatever the
+      # superclass does. Nested `def`s are unit boundaries, so a `super` counted here is this unit's.
+      #
+      # A separate reading of the same node from the edge {#visit_super} records: what this bit answers is
+      # whether a framework's claim about the selector survives the class having written a body for it
+      # ({FrameworkUnits.replaced?}, #440), which is a question about the *class*, not about what the
+      # parent implementation does.
+      def delegates_upward?
+        @delegates_upward
+      end
+
       # Walks `body` and returns `[Summary, edges]`.
       def run(body)
         walk(body)
@@ -214,9 +230,31 @@ module Rigor
         when Prism::IndexOperatorWriteNode, Prism::IndexOrWriteNode, Prism::IndexAndWriteNode,
              Prism::CallOperatorWriteNode, Prism::CallOrWriteNode, Prism::CallAndWriteNode
           classify_mutation(node.receiver)
+        when Prism::SuperNode, Prism::ForwardingSuperNode
+          visit_super
         end
       end
 
+      # `super` in every shape — bare, `super()`, `super(args)`, and each of those inside a block or a
+      # rescue, since the walk descends into both (#446).
+      #
+      # It is a dispatch and must contribute like one. What the scan can settle from the syntax is the
+      # *identity* of the target — this unit's own class and selector — and nothing more: which definition
+      # sits above the class is a question about the whole project, so it goes out as an edge and the
+      # propagator resolves it against the merged ancestry, tainting when nothing there answers.
+      #
+      # A unit with no class or no name has no target to state. That is not a shape the scanner produces,
+      # and the taint is what a "cannot say" must read as rather than a silently dropped call.
+      def visit_super
+        @delegates_upward = true
+        return taint("unresolved-super", @method_name) if @owner_class.nil? || @method_name.nil?
+
+        @edges << FileCollection::Edge.new(
+          receiver_class: @owner_class, kind: @singleton ? :singleton : :instance,
+          selector: @method_name, self_call: true, super_call: true
+        )
+      end
+
       def visit_call(node)
         record = @calls[node]
         attribute(node, record)
@@ -285,14 +323,30 @@ module Rigor
 
       # The class whose call produced this receiver, for an `on_result:` row: the constant in
       # `UserMailer.welcome(u).deliver_now`, the receiver class the typer had otherwise. Nil unless the
-      # receiver is itself a call with a receiver — a bare local variable says nothing about what made it.
+      # receiver is itself a call — a bare local variable says nothing about what made it.
+      #
+      # Two shapes beyond the constant, because between them they are how mail is actually sent (#456):
+      #
+      # - **an implicit-self producing call** — `issue_add(user, issue).deliver_later`, which is what a
+      #   mailer's own `def self.deliver_issue_add` wrapper looks like in Redmine, 97 call sites of it.
+      #   The producer is the unit's own class, which is exactly what an unqualified name resolves
+      #   against;
+      # - **a builder one link further out** — `AdminMailer.with(recipient: a).new_trends(…).deliver_later!`,
+      #   ActionMailer's parameterized form and the spelling Mastodon uses. `with` returns a lazy
+      #   `Parameterized::Mailer` no project declares a type for, so the constant is two calls away rather
+      #   than one, and stopping at the first link found nothing.
+      #
+      # The walk is the same heuristic the `on_result:` row already is — "the class that produced this" —
+      # applied transitively rather than once. A row still has to match the producer's ancestry AND the
+      # selector, so a chain that ends somewhere unrelated contributes nothing rather than a wrong label.
       def producer_class(receiver)
         return nil unless receiver.is_a?(Prism::CallNode)
 
         inner = receiver.receiver
-        return nil if inner.nil?
+        return @owner_class if inner.nil?
 
-        Source::ConstantPath.qualified_name(inner) || @calls[receiver]&.receiver_class
+        Source::ConstantPath.qualified_name(inner) || producer_class(inner) ||
+          @calls[receiver]&.receiver_class
       end
 
       # The receiver expression as the syntax spells it — `"Rails.cache"`, `"self.flash.now"` — or nil when
@@ -379,12 +433,12 @@ module Rigor
       # receiver mutation; `Time#localtime` is both). A **posture** states nothing about this selector,
       # so the uncatalogued path's own mutation rule applies to it unchanged.
       def claimed_by_catalogue?(node, record)
-        owner, singleton, implicit = catalog_target(node, record)
+        owner, singleton, implicit, named = catalog_target(node, record)
         return false if owner.nil?
 
         entry = Catalog.default.lookup(
           owner, node.name.to_s, singleton: singleton, call_node: node,
-                                 posture: posture_allowed?(node, record, implicit)
+                                 posture: posture_allowed?(node, record, implicit, named)
         )
         return false if entry.nil?
 
@@ -426,8 +480,26 @@ module Rigor
       #   it would be a proven label with nothing proving it (the `dynamic-receiver` taint is the right
       #   answer, and the uncatalogued path records it);
       # - `send` / `call`, whose own taints are the more specific reading ({DEFERRED_SELECTORS}).
-      def posture_allowed?(node, record, implicit)
-        !implicit && !record&.dynamic && !DEFERRED_SELECTORS.include?(node.name)
+      #
+      # **Unless the syntax named the class** (#463). The `Dynamic` exclusion exists because a projected
+      # receiver class is a guess; a written constant path is not one, and {#catalog_target} already
+      # trusts it for the row lookup. Refusing the posture there made the catalogue's reach a function of
+      # whether the bundled rbs happens to ship a signature for the constant: `Net::HTTP.get` proves
+      # `io.net.http` and `Net::IMAP.new` proved nothing, because rbs ships `net-http` and not
+      # `net-imap`. That is why the `Net::FTP` row has never once fired, and why Redmine's IMAP and POP3
+      # pollers proved no network at all.
+      #
+      # The site is then **claimed**, and so discharges, like every other catalogue answer. That is not a
+      # softening of the `dynamic-receiver` rule but its premise failing: the taint says the class the
+      # typer projected is a guess, and on a constant path there is no projection — the receiver of
+      # `Net::IMAP.new` is that constant, exactly. What the posture asserts on top is the hand-audited
+      # claim the catalogue is made of, the same one `Socket#connect` rests on when the typer did name
+      # the receiver. `implicit` and {DEFERRED_SELECTORS} keep their exclusions, which are about what the
+      # syntax means rather than about what the typer knew.
+      def posture_allowed?(node, record, implicit, named)
+        return false if implicit || DEFERRED_SELECTORS.include?(node.name)
+
+        named || !record&.dynamic
       end
 
       def visit_uncatalogued(node, record, bound = nil)
@@ -550,18 +622,21 @@ module Rigor
       # The class the catalogue would look this call up under, as `[owner, singleton, implicit_self]`.
       # Spelled from the syntax where the syntax settles it and from the typer's receiver otherwise;
       # `[nil, …]` when neither does.
+      # `[owner, singleton, implicit, named]`. `named` says the owner came from a **constant path the
+      # author wrote**, which is what licenses the posture on a receiver the typer could not resolve
+      # ({#posture_allowed?}).
       def catalog_target(node, record)
         receiver = node.receiver
-        return ["Kernel", false, true] if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+        return ["Kernel", false, true, false] if receiver.nil? || receiver.is_a?(Prism::SelfNode)
 
         constant = Source::ConstantPath.qualified_name(receiver)
-        return [constant, !Catalog.default.object_constant?(constant), false] if constant
+        return [constant, !Catalog.default.object_constant?(constant), false, true] if constant
         return NO_TARGET if record.nil? || record.receiver_class.nil?
 
-        [record.receiver_class, record.kind == :singleton, false]
+        [record.receiver_class, record.kind == :singleton, false, false]
       end
 
-      NO_TARGET = [nil, false, false].freeze
+      NO_TARGET = [nil, false, false, false].freeze
       private_constant :NO_TARGET
 
       def positional_arity(node)

data/lib/rigor/inference/synthetic_method_scanner.rb

@@ -65,6 +65,13 @@ module Rigor
         registries = collect_trait_registries(plugin_registry)
         nested_templates = collect_nested_class_templates(plugin_registry)
         return SyntheticMethodIndex::EMPTY if templates.empty? && registries.empty? && nested_templates.empty?
+        # Tier B alone cannot emit without an environment: every trait entry — the direct route and the
+        # concern-re-targeted one — funnels through `module_instance_method_names`, whose first line
+        # answers `[]` for a nil environment. The production pre-pass passes `environment: nil` (#476),
+        # so a project whose only contributing plugin registers trait registries (rigor-devise on a
+        # Rails app) would otherwise pay a whole-project parse to build a provably empty index. This
+        # gate mirrors that nil guard and MUST be removed in the change that threads a real environment.
+        return SyntheticMethodIndex::EMPTY if environment.nil? && templates.empty? && nested_templates.empty?
 
         asts = parse_paths(paths, buffer: buffer)
         hierarchy = build_hierarchy(asts)

data/lib/rigor/plugin/base.rb

@@ -734,6 +734,10 @@ module Rigor
         manifest.effect_entry_points
       end
 
+      def effect_ancestry
+        manifest.effect_ancestry
+      end
+
       # ADR-7 § "Slice 6-A/6-B" — per-plugin {IoBoundary}. Memoised so the boundary's accumulated `FileEntry`
       # rows persist across producer invocations within the same plugin instance and feed cache invalidation
       # via `cache_for`.

data/lib/rigor/plugin/box.rb

@@ -32,14 +32,30 @@ module Rigor
       # Requires `feature` into the shared box exactly once. Returns true when the feature is available in the
       # box, false when it could not be loaded (the caller then declines — never falls back to loading into the
       # main space, which would defeat the boundary).
+      #
+      # The rescue is `::`-qualified and covers `::ScriptError`, matching {Isolation::Process.run_worker_loop}:
+      # a failed box require raises `::LoadError` — a ScriptError, not a StandardError — and a plain
+      # `rescue StandardError` lets it escape and abort the whole run instead of the clean decline.
       def require_feature(feature)
         @required ||= {}
         return @required[feature] if @required.key?(feature)
 
         shared.require(feature)
         @required[feature] = true
-      rescue StandardError
-        @required[feature] = false
+      rescue ::StandardError, ::ScriptError
+        @required[feature] = eval_require(feature)
+      end
+
+      # The gem-resolving fallback: `Ruby::Box#require` resolves against the raw `$LOAD_PATH` only (it
+      # calls the C-level require directly), so a target library installed as a gem is reachable only
+      # through the box's own RubyGems — the `Kernel#require` *inside* the box. `feature` is a fixed,
+      # plugin-declared name rendered via `String#inspect` (a safe Ruby literal), so the eval carries no
+      # free input. Returns false when the box cannot load the feature either way (the caller declines).
+      def eval_require(feature)
+        shared.eval("require #{feature.inspect}") # require "active_support/inflector"
+        true
+      rescue ::StandardError, ::ScriptError
+        false
       end
 
       # Evaluates `code` inside the shared box and returns the result across the box boundary. The caller MUST