rigortype 0.3.8 → 0.4.0

data/lib/rigor/effects/definition_lines.rb

@@ -3,6 +3,7 @@
 require "prism"
 
 require_relative "method_key"
+require_relative "../source/constant_path"
 
 module Rigor
   module Effects
@@ -30,9 +31,9 @@ module Rigor
       NO_LINES = {}.freeze
       private_constant :NO_LINES
 
-      # @param key [String] an effect unit key — `Tracer::Loud#emit`, `Net::HTTP.get`.
-      # @param path [String] the file the key was traced to.
-      # @return [Integer, nil] the `def`'s line, or nil when this file does not spell that key with a
+      # @param key — an effect unit key — `Tracer::Loud#emit`, `Net::HTTP.get`.
+      # @param path — the file the key was traced to.
+      # @return the `def`'s line, or nil when this file does not spell that key with a
       #   `def` — an unreadable file, a syntax error, and a synthesized method all land here.
       def for(key:, path:)
         index_for(path)[key]
@@ -62,10 +63,10 @@ module Rigor
       def walk(node, nesting, singleton:, index:)
         case node
         when Prism::ModuleNode, Prism::ClassNode
-          name = constant_name(node.constant_path)
-          return if name.nil?
+          inner = header_nesting(nesting, node.constant_path)
+          return if inner.nil?
 
-          walk_children(node.body, nesting + [name], singleton: false, index: index)
+          walk_children(node.body, inner, singleton: false, index: index)
         when Prism::SingletonClassNode
           walk_children(node.body, nesting, singleton: true, index: index)
         when Prism::DefNode
@@ -76,6 +77,24 @@ module Rigor
         end
       end
 
+      # A ROOTED header is the one case that needs no resolution to place: `::` re-anchors the declaration at
+      # the top level wherever it is written, exactly as `Source::ConstantPath.declaration_prefix` reads it
+      # for the engine's own walks. Prism's `full_name` KEEPS the `::`, so `class ::Rooted` inside
+      # `module Outer` was indexed under `Outer::::Rooted#m` — a key no caller spells, which cost the row
+      # its line while every unrooted sibling in the same file kept one
+      # ([#722](https://github.com/rigortype/rigor/issues/722) residue 4).
+      #
+      # nil propagates the refusal {#constant_name} makes, so a header naming no constant leaves the subtree
+      # unindexed rather than under a guessed name.
+      def header_nesting(nesting, constant_path)
+        name = constant_name(constant_path)
+        return nil if name.nil?
+
+        return nesting + [name] unless Source::ConstantPath.rooted?(constant_path)
+
+        [name.delete_prefix("::")]
+      end
+
       def walk_children(node, nesting, singleton:, index:)
         node&.compact_child_nodes&.each { |child| walk(child, nesting, singleton: singleton, index: index) }
       end

data/lib/rigor/effects/effect_table.rb

@@ -29,11 +29,19 @@ module Rigor
       # The lanes are kept **raw** here — a declared label a proven one already subsumes is dropped where
       # output is rendered ({LabelSet#excluding_subsumed_by}), never in the table, because a further join
       # has to see what was actually declared.
+      # `unclaimed` is the transitive reading of {Summary#unclaimed?}: true when this method, or anything
+      # it reaches, called something nothing described (#391). It is not a label, not a taint, and is read
+      # by `rigor sig-gen`'s annotation emission alone — not by the report, the snapshot, or any
+      # diagnostic.
       class Entry < Data.define(:key, :direct, :proven, :undischarged, :declared, :exhaustive, :causes,
-                                :edges)
-        def initialize(undischarged: nil, declared: nil, **rest)
+                                :edges, :unclaimed)
+        def initialize(undischarged: nil, declared: nil, unclaimed: false, **rest)
           super(undischarged: undischarged || rest.fetch(:proven), declared: declared || LabelSet::EMPTY,
-                **rest)
+                unclaimed: unclaimed ? true : false, **rest)
+        end
+
+        def unclaimed?
+          unclaimed
         end
 
         # The declared labels worth printing beside `proven` — the rendering rule, in one place so the
@@ -61,7 +69,6 @@ module Rigor
         @empty ||= new(EMPTY_ENTRIES)
       end
 
-      # @param entries [Hash{String => Entry}]
       def initialize(entries)
         @entries = entries.sort_by { |key, _| key }.to_h.freeze
         freeze

data/lib/rigor/effects/entry_points.rb

@@ -117,8 +117,6 @@ module Rigor
         # one message: the unregistered-preset error (#433) and the note `rigor effects update` prints
         # when `reach:` is empty (#436) have to give the same answer, and neither can hard-code a list
         # that moves with `plugins:`.
-        #
-        # @return [String]
         def availability
           if @presets.empty?
             return "no plugin in this project registers an entry-point preset — a preset is named by the " \

data/lib/rigor/effects/envelope_check.rb

@@ -61,7 +61,7 @@ module Rigor
         # It lives on the value rather than in {EnvelopeCheck} because {LiskovCheck} positions its
         # findings identically, and two spellings of "where the fix goes" would eventually disagree.
         #
-        # @return [Array(String, Integer)] `[path, line]`; `[nil, 1]` for a key with no owner.
+        # @return `[path, line]`; `[nil, 1]` for a key with no owner.
         def for(key)
           class_name, separator, selector = MethodKey.split(key)
           return [nil, 1] if class_name.nil?
@@ -103,17 +103,17 @@ module Rigor
 
       module_function
 
-      # @param table [EffectTable] the run's propagated graph.
-      # @param method_envelopes [Hash{String => Envelope}] per-method envelopes, as written.
-      # @param class_envelopes [Hash{String => Envelope}] class- / module-level envelopes, to distribute.
-      # @param config_envelopes [Hash{String => Envelope}] `effects.envelopes:` entries already resolved
+      # @param table — the run's propagated graph.
+      # @param method_envelopes — per-method envelopes, as written.
+      # @param class_envelopes — class- / module-level envelopes, to distribute.
+      # @param config_envelopes — `effects.envelopes:` entries already resolved
       #   to the classes they select ({ConfigEnvelopes.for_classes}), to distribute at the lowest precedence.
-      # @param positions [Positions, DeferredPositions] the discovery tables a finding's `def`
+      # @param positions — the discovery tables a finding's `def`
       #   position is read from — consulted only when a finding is built, so a deferred value's
       #   discovery force is reached exactly as often as a finding exists.
-      # @param apply_tolerated [Boolean] false judges against the undischarged-by-policy `proven` lane —
+      # @param apply_tolerated — false judges against the undischarged-by-policy `proven` lane —
       #   the `--no-tolerated-effects` audit switch.
-      # @return [Array<Finding>] sorted by position then key then label, so a run explains identically twice.
+      # @return sorted by position then key then label, so a run explains identically twice.
       def run(table:, method_envelopes:, class_envelopes:, config_envelopes: {},
               positions: Positions.empty, apply_tolerated: true)
         envelopes = distribute(table, method_envelopes, class_envelopes, config_envelopes)
@@ -157,7 +157,7 @@ module Rigor
       # synthesized `attr_*` / `define_method` members the effects scanner adds.
       def keys_by_class(table)
         table.keys.each_with_object({}) do |key, out|
-          owner = MethodKey.owner(key)
+          owner = MethodKey.envelope_owner(key)
           next if owner.nil?
 
           (out[owner] ||= []) << key

data/lib/rigor/effects/envelope_index.rb

@@ -56,15 +56,13 @@ module Rigor
 
       # Reads every stratum this index serves, once per process.
       #
-      # @param configuration [Rigor::Configuration]
-      # @param plugin_facts [Rigor::Effects::PluginFacts, nil] the loaded plugins' effect contributions
+      # @param plugin_facts — the loaded plugins' effect contributions
       #   (#387); their `effect_labels:` join the vocabulary an annotation is read against, so a gem's
       #   `%a{rigor:v1:effect rails.activejob.enqueue}` resolves rather than reading as unknown.
-      # @param environment [Rigor::Environment, nil] the run's environment. Its loader supplies the
+      # @param environment — the run's environment. Its loader supplies the
       #   rbs-inline / plugin `virtual_rbs` buffers and the built RBS environment the accepted stratum is
       #   read from; without one, both are simply absent (the fail-quiet direction — a missing `≤` bound
       #   costs precision, never a finding).
-      # @return [EnvelopeIndex]
       def self.build(configuration:, environment: nil, plugin_facts: nil)
         # Required here rather than at the top of the file: the reader pulls in the whole
         # `RbsExtended` surface, and this build runs only under an `effects:` block.
@@ -122,10 +120,9 @@ module Rigor
 
       # The envelope bounding `owner`'s `selector`, or nil.
       #
-      # @param owner [String] the receiver's static class name, as the typer projected it
-      # @param singleton [Boolean] whether the call is `Owner.selector` rather than `Owner#selector`
-      # @param selector [String]
-      # @return [Envelope, nil] never a ⊤ envelope: a bound that bounds nothing is not a bound, and
+      # @param owner — the receiver's static class name, as the typer projected it
+      # @param singleton — whether the call is `Owner.selector` rather than `Owner#selector`
+      # @return never a ⊤ envelope: a bound that bounds nothing is not a bound, and
       #   importing it would both add nothing and discharge a taint on the strength of a typo.
       def [](owner, singleton, selector)
         return nil if owner.nil? || empty?
@@ -138,6 +135,21 @@ module Rigor
         envelope
       end
 
+      # Whether ANY stratum carries an annotation for this key — ⊤ envelopes included.
+      #
+      # {#[]} is the import question and rightly refuses a ⊤ envelope: a bound that bounds nothing is not
+      # a bound. `rigor sig-gen`'s emission asks the other one (#391): an author who wrote
+      # `%a{rigor:v1:effect bogus.nonsense}` has still written about this method, and replacing their
+      # typo with an inferred `%a{pure}` would delete the only evidence that they meant to bound it — the
+      # `effect.unknown-label` report points at the annotation, and there would no longer be one.
+      def annotated?(owner, singleton, selector)
+        return false if owner.nil? || empty?
+
+        key = "#{owner}#{singleton ? '.' : '#'}#{selector}"
+        !(@method_envelopes[key] || @class_envelopes[owner] || config_envelope(owner) ||
+          @accepted[key]).nil?
+      end
+
       private
 
       # The first `namespace:` entry selecting `owner`, memoised per class name — one call site's owner

data/lib/rigor/effects/file_collection.rb

@@ -35,12 +35,59 @@ module Rigor
       # selector rather than a receiver's, and the propagator resolves it against the ancestry *above* that
       # class with no closed-world override join — a different question from every other edge, which is why
       # it is a field rather than a convention over the other three.
-      Edge = Data.define(:receiver_class, :kind, :selector, :self_call, :super_call) do
+      #
+      # `constant_receiver` marks a call whose receiver the author wrote as a **constant path** (#1039).
+      # The collector keys an edge on the receiver's TYPE, so `self.class.new` inside `Base`, `klass.new`
+      # on a `Singleton[Base]` local and a receiver-less `new` in a singleton body all produce the very
+      # same tuple as a literal `Base.new` — and the first three really do construct a subclass. Only the
+      # constructor rule reads it, and only to DROP the closed-world subclass join a written constant
+      # cannot reach.
+      #
+      # `unclaimed` marks a site NOTHING bounded: no catalogue row, no plugin row, no imported envelope
+      # (#391). It is not a taint and never becomes one — an unresolved edge here is overwhelmingly an
+      # inherited or gem call the catalogue simply has no row for, which is why the model drops it — but
+      # it IS the difference between "the analyzer read every callee" and "the analyzer read the callees
+      # it had something to read". Only sig-gen's annotation emission consults it, through
+      # {EffectTable::Entry#unclaimed?}: writing `%a{pure}` is a claim about a callee nobody described,
+      # and the emitter must decline rather than invent one.
+      # `taint_if_unresolved` is #1048's inversion of a taint. A `render :show` whose {CalleeRule} named
+      # `view:users/show.html` may or may not reach a unit — only the merged table knows, exactly as only
+      # the merged ancestry knows whether a `super` resolves — so the row's `template-not-analysed` cause
+      # travels ON the edge as a frozen `[cause, detail]` pair and {Propagator} seeds it only where the
+      # edge landed on nothing. Adding a cause where the walk failed rather than subtracting one where it
+      # succeeded keeps every step of the fixpoint monotone, and it is the same shape
+      # {Propagator.taint_unresolved_super} already has.
+      #
+      # `fallback_selectors` is #1065's lookup order: the selectors the propagator retries, in order, when
+      # `selector` resolves to nothing — `["html"]` on a `view:watchers/_watchers` + `js` edge, because a
+      # `.js.erb` template's lookup context is `[:js, :html]`. The FIRST that resolves is the edge's
+      # target and the taint stays unseeded; only when every one fails is `taint_if_unresolved` seeded.
+      # One ordered list rather than one edge per candidate, because two edges would join BOTH units
+      # where both exist, and only one of them runs.
+      Edge = Data.define(:receiver_class, :kind, :selector, :self_call, :super_call, :unclaimed,
+                         :constant_receiver, :taint_if_unresolved, :fallback_selectors) do
         # Defaulted because every producer but the `super` one records an ordinary call, and an ordinary
-        # call is not a `super`.
-        def initialize(super_call: false, **) = super
+        # call is not a `super`, and because a producer that says nothing about `unclaimed` /
+        # `constant_receiver` means the safe value of each.
+        #
+        # The defaults do NOT rescue a cache written before a member existed: `Marshal.load` of a `Data`
+        # whose member list has grown raises `TypeError: struct size differs`, which the store reads as a
+        # miss. That is the right outcome and not the one relied on — the cache identity carries a schema
+        # component ({Identity}, `schema:5`), so such an entry is never offered in the first place.
+        def initialize(super_call: false, unclaimed: false, constant_receiver: false,
+                       taint_if_unresolved: nil, fallback_selectors: nil, **)
+          super
+        end
       end
 
+      # An ancestry entry that names nothing and can never resolve. The scanner records it where a class
+      # body says its ancestry or its constructor is not readable from the source — a superclass
+      # expression that is not a constant path (`class K < Struct.new(:a)`), or an `alias` / `alias_method`
+      # that makes `initialize` some other method (#1039). It matches no summary key, so every existing
+      # walk steps over it; the constructor rule asks for it by name, because "unreadable" is exactly what
+      # that rule must not read as "empty".
+      OPAQUE_ANCESTOR = "<opaque>"
+
       NO_TABLE = {}.freeze
       private_constant :NO_TABLE
 
@@ -107,7 +154,12 @@ module Rigor
 
           fold_summaries(summaries, collection.summaries)
           fold_lists(edges, collection.edges)
-          superclasses.update(collection.superclasses)
+          # The opaque sentinel is sticky across files as well as within one: a class whose constructor one
+          # file says is unreadable does not become readable because another file spells its `<`, and the
+          # fold must not depend on which file the run reads first.
+          superclasses.update(collection.superclasses) do |_key, mine, theirs|
+            mine.include?(OPAQUE_ANCESTOR) ? mine : theirs
+          end
           fold_lists(includes, collection.includes)
         end
 
@@ -167,7 +219,9 @@ module Rigor
       end
 
       def edge_order(edge)
-        [edge.receiver_class.to_s, edge.kind.to_s, edge.selector, edge.self_call ? 1 : 0, edge.super_call ? 1 : 0]
+        [edge.receiver_class.to_s, edge.kind.to_s, edge.selector, edge.self_call ? 1 : 0,
+         edge.super_call ? 1 : 0, edge.constant_receiver ? 1 : 0,
+         Array(edge.taint_if_unresolved).join("\x00"), Array(edge.fallback_selectors).join("\x00")]
       end
     end
   end

data/lib/rigor/effects/framework_units.rb

@@ -76,13 +76,11 @@ module Rigor
 
       # Every synthetic unit `class_name` earns, as `[key, Summary, edges]` triples.
       #
-      # @param class_name [String]
-      # @param instance_methods [Array<String>] the instance methods the class body defines, in source order
-      # @param macros [Hash{String=>Array<String>}] receiver-less class-body calls to their literal symbol
+      # @param instance_methods — the instance methods the class body defines, in source order
+      # @param macros — receiver-less class-body calls to their literal symbol
       #   arguments, as the scanner harvested them
-      # @param uniqueness [Boolean] whether the class body declares a uniqueness validator
-      # @param plugin_facts [PluginFacts]
-      # @param own_units [Hash{String=>Boolean}] the units the class body itself defines, keyed by the
+      # @param uniqueness — whether the class body declares a uniqueness validator
+      # @param own_units — the units the class body itself defines, keyed by the
       #   suffix a synthetic key carries (`"#save"`, `".create"`), each mapped to whether that body
       #   reaches `super`. Read by {.framework_row} and by nothing else.
       def synthesize(class_name:, instance_methods:, macros:, uniqueness:, plugin_facts:, own_units: {})
@@ -198,7 +196,7 @@ module Rigor
       end
 
       # The uniqueness validator's own query. It rides the DECLARED lane with no taint, exactly as every
-      # other first-party plugin contribution does (ADR-103 WD6): the plugin read the app's own
+      # other first-party plugin contribution does (ADR-103 WD6 / WD17): the plugin read the app's own
       # `validates … uniqueness: true` and knows what Rails does with it, but the analyzer did not read a
       # body, so this is a trusted claim rather than a proof.
       def uniqueness_summary(class_name)

data/lib/rigor/effects/identity.rb

@@ -45,13 +45,28 @@ module Rigor
       # The effects identity as a hex digest — the form a store with no descriptor of its own (the ADR-46
       # incremental snapshot) carries alongside its payload, and compares verbatim on restore.
       #
-      # @param configuration [Rigor::Configuration]
-      # @param registry [Registry] the vocabulary whose version participates
-      # @param catalog [Catalog] the catalogue whose identity participates
-      # @return [String] hex SHA-256
+      # @param registry — the vocabulary whose version participates
+      # @param catalog — the catalogue whose identity participates
+      # @return hex SHA-256
       def digest(configuration:, registry: Registry.default, catalog: Catalog.default, plugin_facts: nil)
         Digest::SHA256.hexdigest(
           [
+            # #391 — the summary schema itself. A cached collection written before {Summary#unclaimed?}
+            # existed restores with the bit false, which is the direction sig-gen's emission must never
+            # guess, so such an entry must not be served rather than merely read carefully.
+            #
+            # schema:3 — #1039 moved edge RESOLUTION: a singleton `new` edge on a project class now
+            # reaches that class's `#initialize`. The warm lanes serve a propagated `EffectTable` (and its
+            # `unclaimed` bits) rather than re-resolving, so an entry written under the old rule would
+            # answer the old closure for source nothing changed.
+            #
+            # schema:4 — #1048 added {FileCollection::Edge#taint_if_unresolved}, so a marshalled edge
+            # written under schema:3 no longer restores at all (`Data` with a grown member list raises
+            # `TypeError`), and a warm entry would otherwise be offered and then read as a miss.
+            #
+            # schema:5 — #1065 added {FileCollection::Edge#fallback_selectors}, which both grows the
+            # marshalled member list again and changes which unit a cached `view:` edge resolves to.
+            "schema:5",
             "vocabulary:#{registry.vocabulary_version}",
             "catalog:#{catalog.identity}",
             "effects:#{config_digest(configuration)}",
@@ -66,8 +81,7 @@ module Rigor
       # the analyzed-path set — for free, so "the effects identity is the diagnostics identity plus three
       # things" is a property of the code rather than a claim about it.
       #
-      # @param base [Cache::Descriptor] the run's diagnostics key descriptor
-      # @return [Cache::Descriptor]
+      # @param base — the run's diagnostics key descriptor
       def descriptor(base:, configuration:, registry: Registry.default, catalog: Catalog.default,
                      plugin_facts: nil)
         Cache::Descriptor.compose(

data/lib/rigor/effects/inline_anchor.rb

@@ -49,9 +49,9 @@ module Rigor
       SPELLING_PATTERN = /%a\{[^}]*\}/
       private_constant :SPELLING_PATTERN
 
-      # @param path [String] the buffer's readable path, as {SignatureSources.source_path} renders it.
-      # @param buffer [String] the synthesized RBS the position was read out of.
-      # @return [InlineAnchor, nil] nil when `path` is not a Ruby file — a real `.rbs` needs no mapping,
+      # @param path — the buffer's readable path, as {SignatureSources.source_path} renders it.
+      # @param buffer — the synthesized RBS the position was read out of.
+      # @return nil when `path` is not a Ruby file — a real `.rbs` needs no mapping,
       #   and its own line numbers are already the ones a reader can open.
       def self.for(path:, buffer:)
         return nil unless path.to_s.end_with?(RUBY_EXTENSION)
@@ -61,7 +61,7 @@ module Rigor
 
       # One-shot form, for a caller that holds a `[path, buffer, line]` triple and no anchor.
       #
-      # @return [Integer] the `.rb` line, or `buffer_line` unchanged when there is nothing to map.
+      # @return the `.rb` line, or `buffer_line` unchanged when there is nothing to map.
       def self.ruby_line(path:, buffer:, buffer_line:, spelling: nil)
         anchor = self.for(path: path, buffer: buffer)
         return buffer_line if anchor.nil?
@@ -75,10 +75,10 @@ module Rigor
         @ruby_lines = nil
       end
 
-      # @param buffer_line [Integer] 1-based, counting into the synthesized buffer.
-      # @param spelling [String, nil] the annotation's own text (`"%a{pure}"`); read off the buffer line
+      # @param buffer_line — 1-based, counting into the synthesized buffer.
+      # @param spelling — the annotation's own text (`"%a{pure}"`); read off the buffer line
       #   when the caller does not already hold it.
-      # @return [Integer] the 1-based line of the same annotation in the Ruby file.
+      # @return the 1-based line of the same annotation in the Ruby file.
       def line_for(buffer_line, spelling: nil)
         spelling = normalize(spelling) || spelling_at(buffer_line)
         return buffer_line if spelling.nil?

data/lib/rigor/effects/label_intent.rb

@@ -37,11 +37,10 @@ module Rigor
 
       # Whether reporting `token` as an unknown label is justified.
       #
-      # @param token [String] the spelling as written.
-      # @param registry [Rigor::Effects::Registry, nil] the vocabulary AFTER plugin load; `nil` (no
+      # @param token — the spelling as written.
+      # @param registry — the vocabulary AFTER plugin load; `nil` (no
       #   vocabulary at all) makes every token unjudgeable and therefore silent.
-      # @param siblings [Array<String>] the other tokens of the same list / the same config value.
-      # @return [Boolean]
+      # @param siblings — the other tokens of the same list / the same config value.
       def evident?(token, registry, siblings: [])
         return false if registry.nil?
         return false unless Label.valid?(token)

data/lib/rigor/effects/liskov_check.rb

@@ -56,16 +56,16 @@ module Rigor
 
       module_function
 
-      # @param table [EffectTable] the run's propagated graph.
-      # @param superclasses [Hash{String => Array<String>}] the collector's as-written superclass
+      # @param table — the run's propagated graph.
+      # @param superclasses — the collector's as-written superclass
       #   candidate lists (`FileCollection#superclasses`).
-      # @param method_envelopes [Hash{String => Envelope}] per-method envelopes, as written.
-      # @param class_envelopes [Hash{String => Envelope}] class- / module-level envelopes, to distribute.
-      # @param config_envelopes [Hash{String => Envelope}] `effects.envelopes:` entries already resolved
+      # @param method_envelopes — per-method envelopes, as written.
+      # @param class_envelopes — class- / module-level envelopes, to distribute.
+      # @param config_envelopes — `effects.envelopes:` entries already resolved
       #   to the classes they select.
-      # @param positions [EnvelopeCheck::Positions] where the override's `def` is.
-      # @param apply_tolerated [Boolean] false judges against `proven` — `--no-tolerated-effects`.
-      # @return [Array<Finding>] sorted by position then key then label.
+      # @param positions — where the override's `def` is.
+      # @param apply_tolerated — false judges against `proven` — `--no-tolerated-effects`.
+      # @return sorted by position then key then label.
       def run(table:, superclasses:, method_envelopes:, class_envelopes:, config_envelopes: {},
               positions: EnvelopeCheck::Positions.empty, apply_tolerated: true)
         # The distributed strata, over a base of the raw per-method annotations: a base class whose method

data/lib/rigor/effects/local_ownership.rb

@@ -11,8 +11,8 @@ module Rigor
     #
     # Ruby has no by-ref parameters, so `mutate.local` cannot mean "a write into an out-parameter" as it
     # does in PHP. It means the mutated receiver is invisible to the caller, and that is an ownership
-    # question: a local whose every assignment allocates (`[]`, `{}`, `""`, `.new`, `.dup`) and which never
-    # escapes the body is one no caller can observe being mutated.
+    # question: a local whose every assignment allocates (`[]`, `{}`, `""`, `Foo.new`, `.dup`) and which
+    # never escapes the body is one no caller can observe being mutated.
     #
     # The analysis is deliberately **flow-insensitive and whole-body**: a local that escapes anywhere
     # disqualifies, even if the escape happens after the mutation. That is strictly more conservative than
@@ -23,16 +23,17 @@ module Rigor
     # This is the tracer slice's approximation, not the eventual answer. `ClosureEscapeAnalyzer` answers a
     # different question (fact retention, not "does the code contain") and is deliberately left alone.
     module LocalOwnership
-      # Assignment right-hand sides that witness a fresh allocation. `.new` and `.dup` / `.clone` follow
+      # Assignment right-hand sides that witness a fresh allocation. `.dup` / `.clone` follow
       # [ADR-76](../adr/76-effect-modeling-freeze-dup-shape-preservation.md)'s reading of `dup` as the
-      # allocation witness.
-      ALLOCATING_SELECTORS = %i[new dup clone].to_set.freeze
+      # allocation witness; `.new` is {constructor?}'s, because only a class object's `new` is `Class#new`.
+      COPYING_SELECTORS = %i[dup clone].to_set.freeze
 
       module_function
 
       # The set of frame-owned local names in `body`, given the method's parameter names (a parameter is
-      # never frame-owned — the caller holds the same object, so mutating it is `mutate.instance`).
-      def owned(body, parameter_names)
+      # never frame-owned — the caller holds the same object, so mutating it is `mutate.instance`) and
+      # whether `self` is a class there ({constructor?}).
+      def owned(body, parameter_names, singleton:)
         return Set.new if body.nil?
 
         assignments = {}
@@ -42,23 +43,48 @@ module Rigor
         assignments.filter_map do |name, values|
           next if escaped.include?(name) || parameter_names.include?(name)
 
-          name if values.all? { |value| allocation?(value) }
+          name if values.all? { |value| allocation?(value, singleton: singleton) }
         end.to_set
       end
 
       # Whether `node` is an expression that allocates a fresh object this frame is the sole holder of.
-      def allocation?(node)
+      # `singleton` is whether the enclosing unit's `self` is a class, as {constructor?} reads it.
+      def allocation?(node, singleton:)
         case node
         when Prism::ArrayNode, Prism::HashNode, Prism::StringNode, Prism::InterpolatedStringNode,
              Prism::LambdaNode
           true
         when Prism::CallNode
-          ALLOCATING_SELECTORS.include?(node.name) || unary_plus_string?(node)
+          COPYING_SELECTORS.include?(node.name) || constructor?(node, singleton: singleton) ||
+            unary_plus_string?(node)
         else
           false
         end
       end
 
+      # A `new` whose receiver the author wrote as a class object: a constant path, a `class` call
+      # (`self.class`, `other.class`), or `self` — explicit or implicit — in a singleton-method body. Any
+      # other receiver may be an object whose `new` only shares the name: an ActiveRecord association's
+      # `new` builds a record into the association's own target, where the caller can reach it, and a
+      # gem's method gives no edge that would carry that to the caller. `self` in an instance method is
+      # such a receiver too — an association extension's `new` is the association's.
+      def constructor?(node, singleton:)
+        return false unless node.name == :new
+
+        receiver = node.receiver
+        case receiver
+        when nil, Prism::SelfNode then singleton
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then true
+        when Prism::CallNode then class_call?(receiver)
+        else false
+        end
+      end
+
+      # `x.class` — `Kernel#class` answers the receiver's class, unless the receiver overrides it.
+      def class_call?(node)
+        node.name == :class && node.arguments.nil? && node.block.nil?
+      end
+
       # `+""` — the frozen-string-literal era's spelling of "a fresh mutable String".
       def unary_plus_string?(node)
         node.name == :+@ && node.receiver.is_a?(Prism::StringNode)
@@ -125,8 +151,8 @@ module Rigor
         last.is_a?(Prism::LocalVariableReadNode) ? [last.name.to_s] : []
       end
 
-      private_class_method :collect, :record_assignment, :record_escapes, :stored_value, :note_read,
-                           :trailing_reads
+      private_class_method :class_call?, :collect, :record_assignment, :record_escapes, :stored_value,
+                           :note_read, :trailing_reads
     end
   end
 end

data/lib/rigor/effects/method_key.rb

@@ -12,9 +12,14 @@ module Rigor
     # key, and `effects.attribution:` in `.rigor.yml` names one. A key the loader accepts and the scanner
     # would never produce is a table that silently matches nothing.
     module MethodKey
+      # #393 — the prefix a template unit's key carries (`Plugin::TemplateUnit::KEY_PREFIX`, repeated here
+      # rather than required so the effects layer keeps no dependency on the plugin layer; the two are
+      # pinned equal by a spec).
+      TEMPLATE_UNIT_PREFIX = "view:"
+
       module_function
 
-      # @return [Array(String, String, String), nil] `[owner, separator, selector]`, or nil when `key` is
+      # @return `[owner, separator, selector]`, or nil when `key` is
       #   not a method key at all.
       def split(key)
         text = key.to_s
@@ -35,6 +40,22 @@ module Rigor
       def owner(key)
         split(key)&.first
       end
+
+      # #393 — a template unit's key: `view:users/show.html`. Deliberately NOT a method key — a view has
+      # no owner class and no selector — but {.split} cannot tell, because the format segment gives the
+      # string a dot: `owner("view:users/show.html")` answers `"view:users/show"`, a class name no run
+      # ever produced. Anything grouping keys by their envelope-bearing owner has to ask this first.
+      def template_unit?(key)
+        key.to_s.start_with?(TEMPLATE_UNIT_PREFIX)
+      end
+
+      # The name an `effects.envelopes:` entry selects a key by: the owner class for a method key, and the
+      # unit key ITSELF for a template unit. A view is its own envelope subject — there is no class to
+      # hang the bound on, and `Runner#effect_sources` already knows which file the key came from, which
+      # is what a `match:` entry needs.
+      def envelope_owner(key)
+        template_unit?(key) ? key.to_s : owner(key)
+      end
     end
   end
 end