rigortype 0.3.8 → 0.4.0

data/lib/rigor/configuration/severity_profile.rb

@@ -54,6 +54,11 @@ module Rigor
           "def.override-return-widened" => :off,
           "def.override-param-narrowed" => :off,
           "def.ivar-write-mismatch" => :warning,
+          # Issue #1367 — both report a write its setter rejects, so it raises on every run. The type check rests on
+          # an inferred value type, so it follows `call.argument-type-mismatch` (warning under lenient); the
+          # read-only write needs no type at all, so it is an error in every profile.
+          "global.write-type-mismatch" => :warning,
+          "global.readonly-write" => :error,
           # ADR-8 companion (PHPStan IgnoreParseErrorRule-modelled): a broken suppression comment is
           # equally bad in every profile — it silently fails to do what the author believes it does — so
           # both rules stay :warning across all three profiles (including strict).
@@ -80,7 +85,12 @@ module Rigor
           # Opt-in author assertion: you only see it if you wrote a
           # `conforms-to` directive, so it stays a :warning even in
           # lenient — it is never unsolicited noise.
-          "rbs_extended.unsatisfied-conformance" => :warning
+          "rbs_extended.unsatisfied-conformance" => :warning,
+          # ADR-112 WD5 / #1075 — an error in every profile, lenient included. The rule guards its
+          # false-positive rate through its narrow definition of a contradiction, and ADR-112 WD5 rules
+          # out lowering the severity instead; only a proven disagreement between two declarations the
+          # project wrote itself can fire.
+          "rbs.contradicting-signature" => :error
         }.freeze,
         balanced: {
           "call.undefined-method" => :error,
@@ -110,6 +120,8 @@ module Rigor
           "def.override-return-widened" => :warning,
           "def.override-param-narrowed" => :warning,
           "def.ivar-write-mismatch" => :warning,
+          "global.write-type-mismatch" => :error,
+          "global.readonly-write" => :error,
           "suppression.unknown-rule" => :warning,
           "suppression.empty" => :warning,
           "suppression.unknown-marker" => :warning,
@@ -118,7 +130,8 @@ module Rigor
           "effect.liskov-widened" => :warning,
           "effect.unknown-label" => :info,
           "effect.annotations-unchecked" => :info,
-          "rbs_extended.unsatisfied-conformance" => :warning
+          "rbs_extended.unsatisfied-conformance" => :warning,
+          "rbs.contradicting-signature" => :error
         }.freeze,
         strict: {
           "call.undefined-method" => :error,
@@ -147,6 +160,8 @@ module Rigor
           "def.override-return-widened" => :error,
           "def.override-param-narrowed" => :error,
           "def.ivar-write-mismatch" => :error,
+          "global.write-type-mismatch" => :error,
+          "global.readonly-write" => :error,
           "suppression.unknown-rule" => :warning,
           "suppression.empty" => :warning,
           "suppression.unknown-marker" => :warning,
@@ -158,7 +173,8 @@ module Rigor
           # `:info` even under strict: a residual that failed a build would punish the project for
           # carrying an annotation it has not opted into checking, which is the opposite of the point.
           "effect.annotations-unchecked" => :info,
-          "rbs_extended.unsatisfied-conformance" => :error
+          "rbs_extended.unsatisfied-conformance" => :error,
+          "rbs.contradicting-signature" => :error
         }.freeze
       }.freeze
 
@@ -167,20 +183,20 @@ module Rigor
       # Resolves the configured severity for a diagnostic given the active profile and any per-rule
       # overrides.
       #
-      # @param rule [String, nil] canonical rule id (`call.undefined-method`).
-      # @param authored_severity [Symbol] severity the rule emitted the diagnostic with (`:error`, `:warning`,
+      # @param rule — canonical rule id (`call.undefined-method`).
+      # @param authored_severity — severity the rule emitted the diagnostic with (`:error`, `:warning`,
       #   `:info`).
-      # @param profile [Symbol] one of {VALID_PROFILES}; falls back to {DEFAULT_PROFILE} for unknown values.
-      # @param overrides [Hash{String => Symbol}] per-rule severity overrides from `.rigor.yml`'s
+      # @param profile — one of {VALID_PROFILES}; falls back to {DEFAULT_PROFILE} for unknown values.
+      # @param overrides — per-rule severity overrides from `.rigor.yml`'s
       #   `severity_overrides:` map. Keys are canonical rule ids; values are {VALID_SEVERITIES} symbols.
       #   Family-wildcard keys (`call`) match every rule under that prefix.
-      # @param bleeding_edge_overrides [Hash{String => Symbol}] the severity map imposed by the active ADR-50
+      # @param bleeding_edge_overrides — the severity map imposed by the active ADR-50
       #   § WD2 bleeding-edge features ({Rigor::BleedingEdge.severity_overrides_for}). Consulted *below* the
       #   user's own `overrides` (so an explicit `severity_overrides:` entry, exact or family wildcard,
       #   always wins) and *above* the profile table. Exact rule ids only — the overlay never carries family
       #   wildcards. Empty while the overlay is unpopulated, so the default leaves resolution bit-for-bit
       #   unchanged.
-      # @return [Symbol] the resolved severity. Returns `:off` to mean "drop the diagnostic entirely".
+      # @return the resolved severity. Returns `:off` to mean "drop the diagnostic entirely".
       def resolve(rule:, authored_severity:, profile: DEFAULT_PROFILE, overrides: {}, bleeding_edge_overrides: {})
         return authored_severity if rule.nil?
 

data/lib/rigor/configuration.rb

@@ -49,6 +49,9 @@ module Rigor
       **/node_modules/**
     ].freeze
 
+    # The conventional test roots `test_paths: nil` auto-detects, in this order.
+    CONVENTIONAL_TEST_PATHS = %w[spec test].freeze
+
     DEFAULTS = {
       "target_ruby" => "4.0",
       "paths" => ["lib"],
@@ -57,6 +60,20 @@ module Rigor
       "disable" => [],
       "libraries" => [],
       "signature_paths" => nil,
+      # The project's test roots: the directories (or files) holding its tests. `nil` (the default) auto-detects
+      # whichever of `spec/` and `test/` exist, the same way `signature_paths: nil` auto-detects `sig/`; `[]`
+      # declares that the project has none. `rigor sig-gen --params=observed` harvests call-site observations
+      # from them when no `--observe=PATH` is given. See {#resolved_test_paths}.
+      "test_paths" => nil,
+      # ADR-112 WD4 — `rigor sig-gen` settings. `inline_declared:` decides what happens to a method the inline
+      # reader (`rigor-rbs-inline`) already declares from `# @rbs` / `#:`. `write` (the default) copies the
+      # inline declaration into `sig/`, so the generated signature is the complete contract a gem ships;
+      # `skip` leaves every member that reader declares out of `sig/`, for a project whose Steep reads the
+      # same annotations (`inline: true` beside `signature "sig"`), where the copy would be a second
+      # declaration of one method (`DuplicatedMethodDefinition`). See {#sig_gen_inline_declared}.
+      "sig_gen" => {
+        "inline_declared" => "write"
+      },
       # ADR-17 — project-side monkey-patch pre-evaluation. Empty by default; users opt in by listing explicit
       # files that the analyzer walks before per-file inference so patched-method declarations are visible
       # across the project (e.g. `lib/core_ext/string_extensions.rb`). Slice 1 plumbing only — listed files
@@ -117,6 +134,16 @@ module Rigor
         # `"stat"` (or `RIGOR_CI_DETECT=0`).
         "validation" => "auto"
       },
+      # ADR-39 slice 5 / #911 — the plugin-isolation strategy for target-library invocation. `nil` (the
+      # default) names nothing, leaving the choice to `RIGOR_PLUGIN_ISOLATION` and then to
+      # `Plugin::Isolation::DEFAULT`. The environment variable WINS over this key: it is the
+      # one-invocation operator override (`RIGOR_PLUGIN_ISOLATION=none rigor check` on a platform where
+      # the fork worker misbehaves), and an override a committed file can veto is not an override.
+      # Only `none` and `process` are selectable here — `ruby_box` needs `RUBY_BOX=1` set before Ruby
+      # boots, which is what `exe/rigor` re-execs for, and the launcher deliberately does not parse YAML
+      # before that re-exec (ADR-87 / ADR-104 boot-slim), so naming it here raises instead of silently
+      # resolving to a different strategy.
+      "plugins_isolation" => nil,
       "plugins_io" => {
         "network" => "disabled",
         "allowed_paths" => [],
@@ -192,11 +219,12 @@ module Rigor
         "auto_detect" => true
       }
     }.freeze
+    Ractor.make_shareable(DEFAULTS)
 
     # Top-level keys whose values are file/directory paths that MUST be resolved relative to the config
     # file's directory. `exclude:` is intentionally NOT in this list — its entries are glob patterns
     # (`**/vendor/**`), not paths.
-    PATH_KEYS = %w[paths signature_paths pre_eval].freeze
+    PATH_KEYS = %w[paths signature_paths test_paths pre_eval].freeze
     private_constant :PATH_KEYS
 
     # Top-level keys this implementation DECLARES but never reads — see `docs/internal-spec/config.md`
@@ -212,6 +240,10 @@ module Rigor
     # reservation FINDABLE by the next person adding config validation (#166 is exactly that), and to
     # give the schema-parity spec something to key on: a reserved namespace is by definition absent
     # from DEFAULTS, so the DEFAULTS-driven schema gate can never see it.
+    # The isolation strategies a `.rigor.yml` may name (ADR-39 slice 5 / #911). `ruby_box` is
+    # deliberately absent: it is a boot-time decision the config file is read too late to make.
+    CONFIGURABLE_PLUGIN_ISOLATIONS = %w[none process].freeze
+
     RESERVED_NAMESPACES = %w[rigor_rs].freeze
 
     # Every top-level key a conforming `.rigor.yml` may carry: the keys this implementation owns, plus
@@ -237,7 +269,8 @@ module Rigor
 
     attr_reader :target_ruby, :paths, :exclude_patterns, :plugins, :cache_path, :cache_max_bytes,
                 :cache_validation, :disabled_rules,
-                :libraries, :signature_paths, :fold_platform_specific_paths, :parameter_inference,
+                :libraries, :signature_paths, :test_paths, :fold_platform_specific_paths, :parameter_inference,
+                :plugins_isolation,
                 :plugins_io_network, :plugins_io_allowed_paths,
                 :plugins_io_allowed_url_hosts,
                 :severity_profile, :severity_overrides,
@@ -245,7 +278,7 @@ module Rigor
                 :dependencies, :parallel_workers,
                 :bundler_bundle_path, :bundler_auto_detect, :bundler_lockfile,
                 :rbs_collection_lockfile, :rbs_collection_auto_detect,
-                :pre_eval, :baseline_path, :effects,
+                :pre_eval, :baseline_path, :effects, :sig_gen_inline_declared,
                 :effects_snapshot_path, :effects_snapshot_reach, :effects_snapshot_gate, :effects_tolerated,
                 :effects_labels, :effects_attribution, :effects_envelopes
 
@@ -267,6 +300,16 @@ module Rigor
       @effects_check
     end
 
+    # The test roots a run uses: the declared `test_paths:` as written (already resolved against the
+    # config file's directory by {.load}), or — when the key is unset — whichever of
+    # {CONVENTIONAL_TEST_PATHS} is a directory under `root`, as absolute paths. `root` is the directory
+    # the run treats as the project root (the CLI's CWD), as for `signature_paths:` auto-detection.
+    def resolved_test_paths(root: Dir.pwd)
+      return test_paths unless test_paths.nil?
+
+      CONVENTIONAL_TEST_PATHS.map { |dir| File.expand_path(dir, root) }.select { |dir| File.directory?(dir) }
+    end
+
     # Loads a configuration file.
     #
     # `path == nil` triggers auto-discovery against {DISCOVERY_ORDER}. The first present file in that list is
@@ -466,7 +509,7 @@ module Rigor
 
     # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
     #
-    # @param effects_key_present [Boolean] ADR-103 WD15 — whether the file this `data` came from carried an
+    # @param effects_key_present — ADR-103 WD15 — whether the file this `data` came from carried an
     #   `effects:` key at all, independent of its value. Defaults to `data.key?("effects")`, which is the
     #   right answer for a caller that passes a raw (non-`DEFAULTS`-merged) hash directly — the common shape
     #   in specs — but is always `true` once `data` has been through `DEFAULTS.merge`, because `DEFAULTS`
@@ -494,6 +537,9 @@ module Rigor
       @libraries = Array(data.fetch("libraries", DEFAULTS.fetch("libraries"))).map(&:to_s).freeze
       sig_paths = data.fetch("signature_paths", DEFAULTS.fetch("signature_paths"))
       @signature_paths = sig_paths.nil? ? nil : Array(sig_paths).map(&:to_s).freeze
+      test_paths = data.fetch("test_paths", DEFAULTS.fetch("test_paths"))
+      @test_paths = test_paths.nil? ? nil : Array(test_paths).map(&:to_s).freeze
+      @sig_gen_inline_declared = coerce_sig_gen_inline_declared(data.fetch("sig_gen", nil))
       @pre_eval = expand_pre_eval_entries(
         Array(data.fetch("pre_eval", DEFAULTS.fetch("pre_eval"))).map(&:to_s)
       )
@@ -520,6 +566,9 @@ module Rigor
       raw_max = cache.fetch("max_bytes")
       @cache_max_bytes = raw_max.nil? ? nil : Integer(raw_max)
       @cache_validation = coerce_cache_validation(cache.fetch("validation", "auto"))
+      @plugins_isolation = coerce_plugins_isolation(
+        data.fetch("plugins_isolation", DEFAULTS.fetch("plugins_isolation"))
+      )
       @plugins_io_network = coerce_network_policy(plugins_io.fetch("network"))
       @plugins_io_allowed_paths = Array(plugins_io.fetch("allowed_paths")).map(&:to_s).freeze
       @plugins_io_allowed_url_hosts = Array(plugins_io.fetch("allowed_url_hosts")).map(&:to_s).freeze
@@ -575,6 +624,9 @@ module Rigor
         "disable" => disabled_rules,
         "libraries" => libraries,
         "signature_paths" => signature_paths,
+        # `test_paths:` is deliberately absent, as `effects:` is: `to_h` feeds the run cache key and the
+        # incremental-snapshot fingerprint, and the test roots change no diagnostic, so editing them must not
+        # invalidate either. `sig_gen:` is absent for the same reason: only `rigor sig-gen` reads it.
         "pre_eval" => pre_eval,
         "fold_platform_specific_paths" => fold_platform_specific_paths,
         "parameter_inference" => parameter_inference,
@@ -583,6 +635,7 @@ module Rigor
           "max_bytes" => cache_max_bytes,
           "validation" => cache_validation
         },
+        "plugins_isolation" => plugins_isolation,
         "plugins_io" => {
           "network" => plugins_io_network.to_s,
           "allowed_paths" => plugins_io_allowed_paths,
@@ -626,9 +679,8 @@ module Rigor
     #   the same checkout: a typo is a bug, and reading it as `false` would ship the feature permanently off
     #   with no signal.
     #
-    # @param id [String] a feature id from {BleedingEdge::FEATURES} or {BleedingEdge::GRADUATED}.
-    # @return [Boolean]
-    # @raise [ArgumentError] if `id` names no known feature.
+    # @param id — a feature id from {BleedingEdge::FEATURES} or {BleedingEdge::GRADUATED}.
+    # @raise ArgumentError — if `id` names no known feature.
     def bleeding_edge_active?(id)
       return true if BleedingEdge.graduated?(id)
       unless BleedingEdge.known_id?(id)
@@ -962,11 +1014,61 @@ module Rigor
     VALID_CACHE_VALIDATIONS = %w[auto stat digest].freeze
     private_constant :VALID_CACHE_VALIDATIONS
 
+    # The `sig_gen.inline_declared:` values, as the Symbols {#sig_gen_inline_declared} answers.
+    VALID_SIG_GEN_INLINE_DECLARED = %w[write skip].freeze
+    private_constant :VALID_SIG_GEN_INLINE_DECLARED
+
+    # Rejects rather than fails soft: an unrecognised value read as `write` would put a second declaration of
+    # every inline-annotated method into `sig/` for exactly the project that asked for none. A `sig_gen:`
+    # block that omits the key, or is written empty, keeps the default.
+    def coerce_sig_gen_inline_declared(section)
+      section = {} if section.nil?
+      raise ConfigurationError, "sig_gen must be a mapping, got #{section.inspect}" unless section.is_a?(Hash)
+
+      # The schema closes this object (`additionalProperties: false`); a misspelled key here would otherwise
+      # load as the default and write exactly what `inline_declare: skip` was meant to prevent.
+      unknown = section.keys.map(&:to_s) - DEFAULTS.fetch("sig_gen").keys
+      unless unknown.empty?
+        raise ConfigurationError,
+              "sig_gen has unknown key(s) #{unknown.inspect}; known keys: #{DEFAULTS.fetch('sig_gen').keys.inspect}"
+      end
+
+      value = section.fetch("inline_declared", DEFAULTS.dig("sig_gen", "inline_declared")).to_s
+      unless VALID_SIG_GEN_INLINE_DECLARED.include?(value)
+        raise ConfigurationError,
+              "sig_gen.inline_declared must be one of #{VALID_SIG_GEN_INLINE_DECLARED.inspect}, " \
+              "got #{section['inline_declared'].inspect}"
+      end
+
+      value.to_sym
+    end
+
     def coerce_cache_validation(value)
       str = value.to_s
       VALID_CACHE_VALIDATIONS.include?(str) ? str : "auto"
     end
 
+    # Rejects rather than fails soft — a strategy that silently resolves to a different one is exactly
+    # the failure #911 exists to close, and the run's isolation is not a detail the user can be assumed
+    # not to have meant.
+    def coerce_plugins_isolation(value)
+      return nil if value.nil?
+
+      str = value.to_s
+      return str if CONFIGURABLE_PLUGIN_ISOLATIONS.include?(str)
+
+      if str == "ruby_box"
+        raise ConfigurationError,
+              "plugins_isolation: ruby_box cannot be selected from the configuration file — `Ruby::Box` " \
+              "must be active before Ruby boots. Run rigor with RIGOR_PLUGIN_ISOLATION=ruby_box instead " \
+              "(the launcher re-execs itself with RUBY_BOX=1 set)."
+      end
+
+      raise ConfigurationError,
+            "plugins_isolation must be one of #{CONFIGURABLE_PLUGIN_ISOLATIONS.inspect} " \
+            "(`ruby_box` is environment-only), got #{value.inspect}"
+    end
+
     def coerce_network_policy(value)
       sym = value.to_sym
       unless VALID_NETWORK_POLICIES.include?(sym)

data/lib/rigor/effects/ancestry_recorder.rb

@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../source/constant_path"
+require_relative "file_collection"
+
+module Rigor
+  module Effects
+    # The ancestry half of a file's {FileCollection}: what each class declares above itself, what it
+    # includes, and where the scan has to admit it could not read the ancestry at all.
+    #
+    # Split out of {Scanner} because the three questions are one subject with one invariant — a name goes
+    # in **as written**, and the propagator, which is the only place the whole project is in view, decides
+    # which constant it meant. The scanner owns unit identity and delegates this; the two tables are handed
+    # back by {#superclasses} / {#includes} and go into the collection unchanged.
+    class AncestryRecorder
+      attr_reader :superclasses, :includes
+
+      def initialize
+        @superclasses = {}
+        @includes = {}
+      end
+
+      # `class Loud < Base` inside `module Tracer` names `Base`, so the candidates go in and the propagator
+      # picks the one the merged project defines.
+      #
+      # A superclass expression that is **not** a constant path — `class K < Struct.new(:a)`,
+      # `< Data.define(:a)`, `< DelegateClass(X)`, `< Sequel::Model(:t)` — records
+      # {FileCollection::OPAQUE_ANCESTOR} rather than nothing (#1039). Recording nothing made it
+      # indistinguishable from a class with no `<` at all, which is the one reading the constructor rule
+      # turns into an answer; such a class inherits a constructor built at load time, which is the
+      # opposite of an absent one.
+      def record_superclass(full_name, node, prefix)
+        return if node.superclass.nil? || opaque?(full_name)
+
+        superclass = Source::ConstantPath.qualified_name(node.superclass)
+        @superclasses[full_name] =
+          superclass ? lexical_candidates(superclass, prefix) : [FileCollection::OPAQUE_ANCESTOR]
+      end
+
+      # A class BUILT AT LOAD TIME and assigned to a constant — `Anon = Class.new(Base)`,
+      # `Point = Struct.new(:x)`, `Rec = Data.define(:x)`, `Dele = DelegateClass(X)` — records the opaque
+      # sentinel (#1039). Without it a later `class Point; def more; end; end` reopening is the only thing
+      # the scan sees: the class becomes project-known, nothing says what is above it, and the constructor
+      # rule would read that silence as "no constructor anywhere" when the constructor is precisely what
+      # the load-time call built. It is the `class K < Struct.new(:a)` case in its other spelling.
+      #
+      # Only a **call**-valued assignment qualifies. A literal cannot be a class, and a constant-path value
+      # (`Alias = Real`) is a second name for a class whose own ancestry the scan already recorded.
+      #
+      # The sentinel is **sticky**: it overwrites a spelled `< Base` and no later one displaces it, here or
+      # in {FileCollection.merge_all}. A reopening's `class Anon < Base` is not more than this says but
+      # less — `Anon = Class.new(Base) { def initialize; … end }` puts a constructor in the block, which the
+      # scan files under the enclosing namespace and cannot attribute to `Anon` at all, and the spelled
+      # superclass says nothing about it. Sticky is also what makes the answer independent of which file a
+      # run reads first.
+      #
+      # `Class.new(Base)` additionally keeps `Base` beside the sentinel. The sentinel still declines
+      # `Anon.new` itself, and the parent link is what files `Anon` under `Base` in the subclass index, so
+      # a `self.class.new` in `Base` — which the closed-world join says may construct `Anon` — sees an
+      # unreadable constructor below it and declines too.
+      def record_constant_class(node, prefix)
+        value = node.value
+        return unless value.is_a?(Prism::CallNode)
+
+        name = constant_write_name(node, prefix)
+        return if name.nil?
+
+        @superclasses[name] = [FileCollection::OPAQUE_ANCESTOR, *load_time_parent(value, prefix)]
+      end
+
+      # A receiver-less `include` / `prepend` in `class_name`'s body, its constant arguments recorded as
+      # written.
+      #
+      # Both are calls on `self`, like `define_method`, and the include table is the instance ancestry that
+      # `super` and the constructor rule walk, so a call is recorded only where `self` is the class the body
+      # opened (see {#instance_side_self?}). Inside `class << self`, or a `class_eval` / `instance_eval`
+      # block on `singleton_class`, it mixes the module into the singleton class, which is what `extend`
+      # does, and the collection is as blind to it as it is to `extend`.
+      #
+      # @param context — the {DefinitionContext} of the class-body position the call sits at
+      def record_includes(class_name, node, prefix, context)
+        return unless instance_side_self?(context)
+
+        names = node.arguments&.arguments&.filter_map { |argument| Source::ConstantPath.qualified_name(argument) }
+        candidates = (names || []).flat_map { |name| lexical_candidates(name, prefix) }
+        (@includes[class_name] ||= []).concat(candidates) unless candidates.empty?
+      end
+
+      # `alias initialize setup` / `alias_method :initialize, :setup` makes the constructor another
+      # method's body, and the scan models no aliases at all (#1039). The opaque sentinel is the minimal
+      # honest answer: the ancestry stops being readable, the constructor rule declines, and this class's
+      # callers stay exactly as unclaimed as they were before that rule existed.
+      def record_initialize_alias(class_name)
+        (@includes[class_name] ||= []) << FileCollection::OPAQUE_ANCESTOR
+      end
+
+      # Whether this node aliases the instance-side `initialize`, in either spelling. A `CallNode` qualifies
+      # only as a receiver-less `alias_method` whose first symbol argument is the new name.
+      #
+      # `alias` works on the default definee and `alias_method` on `self`, so the two part in an
+      # `instance_eval` block, and inside `class << self` both alias the singleton class's `initialize`,
+      # a class method `new` never calls. Where the syntax does not say which class either one is, it
+      # records nothing here, as an include there does not (see {#instance_side_self?}).
+      #
+      # @param context — the {DefinitionContext} of the class-body position the node sits at
+      def alias_to_initialize?(node, context)
+        case node
+        when Prism::AliasMethodNode
+          context.definee_singleton == false && literal_name(node.new_name) == "initialize"
+        when Prism::CallNode
+          node.receiver.nil? && node.name == :alias_method && instance_side_self?(context) &&
+            literal_name(first_argument(node)) == "initialize"
+        else false
+        end
+      end
+
+      # An ancestry name is recorded AS WRITTEN — a single file cannot say which constant it resolves to.
+      # So the candidates Ruby's own lexical lookup would try go in, most-qualified first, and the
+      # propagator picks the one the merged project actually defines. Same shape as `ScopeIndexer`'s
+      # as-written superclass table, resolved at the same point: when the whole project is in view.
+      def lexical_candidates(name, prefix)
+        return [name] if prefix.empty? || name.start_with?("#{prefix.join('::')}::")
+
+        prefix.length.downto(1).map { |depth| "#{prefix.first(depth).join('::')}::#{name}" } + [name]
+      end
+
+      private
+
+      # Whether the syntax shows that a call on `self` written here works on the class the enclosing body
+      # opened, or on `Object` through `main` at the top level, so what it declares is that class's instance
+      # ancestry.
+      #
+      # It does not where `self` is the singleton class, nor where the syntax does not say what `self` is:
+      # the block of `Class.new` and its kin, an eval on another receiver, `class << obj`. The syntax does not
+      # name the class the module goes into there, and filing it under the enclosing class would put it
+      # where `super` and the constructor rule look for that class. The class Ruby does put it in misses it,
+      # as it would an `extend`, and so does `W` for a `W.class_eval { include M }` inside `class W`, which
+      # the context reads as an eval on any other receiver (#1322).
+      def instance_side_self?(context)
+        !context.self_singleton_class? && context.self_kind != :unknown
+      end
+
+      def opaque?(full_name)
+        @superclasses.fetch(full_name, []).include?(FileCollection::OPAQUE_ANCESTOR)
+      end
+
+      # The superclass a `Class.new(Base)` names, as candidates. Read from `Class.new` alone: it is the one
+      # load-time builder whose first argument IS the superclass, and inventing an ancestry edge from any
+      # other call's first constant argument would let an unrelated class's methods resolve through it.
+      def load_time_parent(value, prefix)
+        return [] unless value.name == :new && constant_receiver_name(value.receiver) == "Class"
+
+        argument = value.arguments&.arguments&.first
+        name = argument && Source::ConstantPath.qualified_name(argument)
+        name ? lexical_candidates(name, prefix) : []
+      end
+
+      def constant_receiver_name(receiver)
+        Source::ConstantPath.qualified_name(receiver) if receiver.is_a?(Prism::ConstantReadNode)
+      end
+
+      # `alias_method :initialize, :setup` and `alias_method "initialize", "setup"` are the same
+      # declaration; only an interpolated name is beyond the scan.
+      def literal_name(node)
+        node.unescaped if node.is_a?(Prism::SymbolNode) || node.is_a?(Prism::StringNode)
+      end
+
+      # The key a constant assignment declares, qualified by the nesting it is written in.
+      def constant_write_name(node, prefix)
+        case node
+        when Prism::ConstantWriteNode then [*prefix, node.name.to_s].join("::")
+        when Prism::ConstantPathWriteNode then qualified_write_name(node, prefix)
+        end
+      end
+
+      def qualified_write_name(node, prefix)
+        target = Source::ConstantPath.qualified_name(node.target)
+        return nil if target.nil?
+        return target if prefix.empty? || target.start_with?("#{prefix.join('::')}::")
+
+        [*prefix, target].join("::")
+      end
+
+      def first_argument(node)
+        node.arguments&.arguments&.first
+      end
+    end
+  end
+end

data/lib/rigor/effects/attribution.rb

@@ -26,11 +26,15 @@ module Rigor
       EMPTY_ROWS = {}.freeze
       private_constant :EMPTY_ROWS
 
-      def self.empty
-        @empty ||= new({})
+      # The run's empty table. Eagerly built on the main Ractor at load time (bottom of the class body)
+      # rather than memoised on first use: `@empty ||= new({})` is a class-ivar WRITE, which a non-main
+      # Ractor may not perform, and every project that configures no attribution reaches it — including
+      # from inside {Analysis::WorkerSession#initialize}, which is where a Ractor-pool worker runs (#1055).
+      class << self
+        attr_reader :empty
       end
 
-      # @param table [Hash{String => Array<String>}] `Configuration#effects_attribution` — method key to
+      # @param table — `Configuration#effects_attribution` — method key to
       #   label list, both already shape-validated at load (tier 2).
       def self.build(table)
         return empty if table.nil? || table.empty?
@@ -49,8 +53,6 @@ module Rigor
 
       # The labels attributed to a method key (`Net::HTTP.get`), or nil when the table says nothing about
       # it. The key is spelled by the caller, which already builds the same string for the catalogue.
-      #
-      # @return [LabelSet, nil]
       def [](key)
         @rows[key]
       end
@@ -71,6 +73,11 @@ module Rigor
           out[key.to_s] = set unless set.empty?
         end.freeze
       end
+
+      # Populates the `@empty` singleton on the main Ractor at load time. `Ractor.make_shareable` rather
+      # than `freeze` so a worker's READ of the class ivar is legal too: a non-main Ractor may read a
+      # class/module ivar only when the value is deeply shareable.
+      @empty = Ractor.make_shareable(new({}))
     end
   end
 end