rigortype 0.3.8 → 0.4.0

data/lib/rigor/effects/mutation_classifier.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../inference/mutation_widening"
 require_relative "label_set"
+require_relative "local_ownership"
 
 module Rigor
   module Effects
@@ -18,7 +19,9 @@ module Rigor
     #    proven lane is worse than a missing one — the proven lane is the one a verdict may read (ADR-5).
     # 2. **Who owns the receiver?** `self` and its ivars are `mutate.self` (`mutate.static` in singleton
     #    context), a class variable is `mutate.static`, a parameter is `mutate.instance`, a frame-owned
-    #    local is `mutate.local`. **Anything else answers nil**, and the caller records an
+    #    local is `mutate.local`, and so is a receiver that is itself an allocation (`{}.compare_by_identity`,
+    #    `raw.dup.force_encoding(e)`) by the local rule's own witness ({LocalOwnership.allocation?}): each
+    #    evaluation is a new object no caller holds yet. **Anything else answers nil**, and the caller records an
     #    `unknown-ownership` taint rather than a proven bare `mutate`: Ruby's ownership is a dataflow
     #    question, and a proven parent label on a fresh-but-unproven receiver would put findings on correct
     #    code (WD14).
@@ -26,18 +29,23 @@ module Rigor
       # The only selectors a mutation may be claimed from without knowing the receiver's class.
       UNIVERSAL_MUTATORS = %i[[]=].to_set.freeze
 
-      # `String`'s receiver-mutating surface. `Array` / `Hash` reuse the hand-audited sets the widening
-      # rules already maintain, cited rather than re-derived (ADR-103 WD3).
-      STRING_MUTATORS = %i[
-        << concat replace insert prepend clear
-        upcase! downcase! capitalize! swapcase! reverse!
-        strip! lstrip! rstrip! chomp! chop! squeeze! succ! next!
-        sub! gsub! tr! tr_s! delete! slice! []=
-      ].to_set.freeze
-
       # `foo=`, and deliberately not `==` / `<=` / `!=` / `===`.
       ATTRIBUTE_WRITER = /\A[a-z_][A-Za-z0-9_]*=\z/
 
+      # Every Hash method that mutates its receiver. The widening keeps two tables because they answer two different
+      # questions of a `HashShape` — `MutationWidening::HASH_MUTATORS` changes the pair set,
+      # `HashLookupMutation::MUTATORS` changes what a read of the pairs answers — but either is a write to the
+      # receiver, and that is all this asks: `h.compare_by_identity` raises `FrozenError` on a frozen hash as
+      # `h.clear` does (unless the hash already compares by identity, when it returns before the check), and a
+      # method whose one effect was `@h.compare_by_identity` did not read as mutating while this cited the first
+      # table alone.
+      #
+      # `rehash` is in neither table because it changes no read a shape can state: a shape's keys are literals, which
+      # a rebuild never merges. It still rebuilds the receiver's table in place, and it is the one name spelt here.
+      HASH_MUTATORS = (
+        Inference::MutationWidening::HASH_MUTATORS | Inference::HashLookupMutation::MUTATORS | Set[:rehash]
+      ).freeze
+
       LABELS = {
         self_state: LabelSet.new(["mutate.self"]),
         static: LabelSet.new(["mutate.static"]),
@@ -57,10 +65,12 @@ module Rigor
         name = node.name
         return true if UNIVERSAL_MUTATORS.include?(name) || ATTRIBUTE_WRITER.match?(name.to_s)
 
+        # The per-class sets are the hand-audited ones the widening rules maintain, cited rather than re-derived
+        # (ADR-103 WD3): a list kept here drifted from the widening's, and missed `force_encoding`.
         case receiver_class
         when "Array" then Inference::MutationWidening::ARRAY_MUTATORS.include?(name)
-        when "Hash" then Inference::MutationWidening::HASH_MUTATORS.include?(name)
-        when "String" then STRING_MUTATORS.include?(name)
+        when "Hash" then HASH_MUTATORS.include?(name)
+        when "String" then Inference::StringMutation::MUTATORS.include?(name)
         else false
         end
       end
@@ -78,6 +88,7 @@ module Rigor
           @singleton ? :static : :self_state
         when Prism::ClassVariableReadNode then :static
         when Prism::LocalVariableReadNode then local_ownership(receiver.name.to_s)
+        else :local if LocalOwnership.allocation?(receiver, singleton: @singleton)
         end
       end
 

data/lib/rigor/effects/plugin_facts.rb

@@ -2,6 +2,7 @@
 
 require "digest"
 
+require_relative "callee_rule"
 require_relative "entry_points"
 require_relative "label_set"
 require_relative "registry"
@@ -65,7 +66,14 @@ module Rigor
       # `discharge` is the RESOLVED grant, not the manifest's request: {.build} has already demoted a
       # non-first-party plugin's `true` to `false` and recorded a warning, so nothing downstream has to
       # re-ask who may discharge.
-      Row = Data.define(:key, :labels, :narrow, :discharge, :within, :taint, :plugin_id) do
+      # `callee` names a {CalleeRule} rule (#1048) and `responds` marks a row whose call supplies the
+      # unit's answer, so a unit rule on the same receiver stands down. `receiver` is carried because a
+      # UNIT rule has no call node to read one off. `callee_fallbacks` is the plugin's lookup-order table
+      # for the rule's answer (#1065), carried verbatim to the edge the rule records.
+      Row = Data.define(:key, :labels, :narrow, :discharge, :within, :taint, :plugin_id, :receiver,
+                        :callee, :callee_fallbacks, :responds) do
+        def initialize(receiver: nil, callee: nil, callee_fallbacks: nil, responds: false, **) = super
+
         def discharge? = discharge
       end
 
@@ -73,15 +81,18 @@ module Rigor
       # plugin pointed.
       Edge = Data.define(:target, :receiver, :selector, :plugin_id)
 
+      # The rows whose `callee:` names a {CalleeRule::UNIT_RULES} rule — applied once per unit by
+      # {UnitScan}, from the unit's own owner and key rather than from a call node.
+      attr_reader :unit_callee_rows
+
       def self.empty
         @empty ||= new(contributions: [], superclasses: NO_ROWS, includes: NO_ROWS)
       end
 
-      # @param plugin_registry [Rigor::Plugin::Registry, nil]
-      # @param superclasses [Hash{String=>String,Array<String>}] the project's as-written superclass table
+      # @param superclasses — the project's as-written superclass table
       #   (`Scope::DiscoveryIndex#discovered_superclasses`). Empty is legal and simply means no row matches
       #   through inheritance.
-      # @param includes [Hash{String=>Array<String>}] the project's as-written include / prepend table
+      # @param includes — the project's as-written include / prepend table
       #   (`Scope::DiscoveryIndex#discovered_includes`), for the frameworks whose contract is a module
       #   rather than a base class (#456).
       def self.build(plugin_registry, superclasses: NO_ROWS, includes: NO_ROWS)
@@ -111,6 +122,7 @@ module Rigor
         @self_rows = {}
         @result_rows = {}
         @edges = []
+        @unit_callee_rows = []
         @labels_by_owner = {}
         @entry_points = []
         @declared_ancestry = {}
@@ -144,13 +156,10 @@ module Rigor
 
       # The row colouring `owner`'s `selector`, found on `owner` itself or on a project ancestor of it.
       #
-      # @param owner [String, nil] the receiver's class name as the syntax or the typer named it
-      # @param singleton [Boolean] whether the call is `Owner.selector`
-      # @return [Row, nil]
+      # @param owner — the receiver's class name as the syntax or the typer named it
+      # @param singleton — whether the call is `Owner.selector`
       def class_row(owner, singleton, selector)
-        return nil if owner.nil? || @class_rows.empty?
-
-        bucket = @class_rows[singleton]
+        bucket = owner.nil? ? nil : @class_rows[singleton]
         return nil if bucket.nil?
 
         ancestry(owner).each do |candidate|
@@ -163,9 +172,7 @@ module Rigor
       # The row colouring `path`'s `selector`, where `path` is a receiver expression (`"Rails.cache"`).
       # Exact — a receiver path names one object and has no ancestry to walk.
       def path_row(path, selector)
-        return nil if path.nil? || @path_rows.empty?
-
-        @path_rows[path]&.[](selector)
+        path.nil? ? nil : @path_rows[path]&.[](selector)
       end
 
       # The row colouring `path`'s `selector` for a receiver rooted at implicit self (`"self.flash.now"`),
@@ -173,11 +180,8 @@ module Rigor
       # `owner_class`'s project ancestry — a receiver-less `session` outside a controller is a different
       # `session`.
       def self_path_row(path, selector, owner_class)
-        return nil if path.nil? || @self_rows.empty?
-
-        row = @self_rows[path]&.[](selector)
-        return nil if row.nil?
-        return nil unless descends_from?(owner_class, row.within)
+        row = path.nil? ? nil : @self_rows[path]&.[](selector)
+        return nil if row.nil? || !descends_from?(owner_class, row.within)
 
         row
       end
@@ -203,9 +207,7 @@ module Rigor
 
       # Whether `class_name` is `ancestor`, or reaches it through the project's own `class … <` lines.
       def descends_from?(class_name, ancestor)
-        return false if class_name.nil?
-
-        ancestry(class_name).include?(ancestor)
+        !class_name.nil? && ancestry(class_name).include?(ancestor)
       end
 
       # `registry` extended with every plugin's `effect_labels:`, each under its own owner so
@@ -227,10 +229,10 @@ module Rigor
         note_root_demotion(contribution)
         (@labels_by_owner[contribution.owner] ||= []).concat(contribution.labels)
         contribution.attributions.each { |entry| absorb_attribution(contribution, entry) }
-        contribution.edges.each do |entry|
-          @edges << Edge.new(target: entry.target, receiver: entry.receiver, selector: entry.method,
-                             plugin_id: contribution.id)
-        end
+        @edges.concat(contribution.edges.map do |entry|
+          Edge.new(target: entry.target, receiver: entry.receiver, selector: entry.method,
+                   plugin_id: contribution.id)
+        end)
         @entry_points.concat(contribution.entry_points)
         contribution.ancestry.each { |entry| absorb_ancestry(contribution, entry) }
       end
@@ -269,8 +271,22 @@ module Rigor
       def absorb_attribution(contribution, entry)
         row = Row.new(key: entry.key, labels: LabelSet.new(entry.labels), narrow: entry.narrow,
                       discharge: discharge_granted?(contribution, entry), within: entry.within,
-                      taint: entry.taint, plugin_id: contribution.id)
+                      taint: entry.taint, plugin_id: contribution.id, receiver: entry.receiver,
+                      callee: callee_rule_for(contribution, entry), responds: entry.responds,
+                      callee_fallbacks: entry.callee_fallbacks)
         (bucket_for(entry)[entry.receiver] ||= {})[entry.method.to_s] = row
+        @unit_callee_rows << row if row.callee && CalleeRule.unit_rule?(row.callee)
+      end
+
+      # #1048 — a `callee:` naming a rule the engine does not implement is dropped with a warning rather
+      # than silently doing nothing, for the reason {#note_root_demotion} gives: a contribution that
+      # quietly evaporates reads to its author as the feature being broken.
+      def callee_rule_for(contribution, entry)
+        return entry.callee if entry.callee.nil? || CalleeRule.known?(entry.callee)
+
+        @warnings << "plugin #{contribution.id.inspect} names an unknown callee rule " \
+                     "#{entry.callee.inspect} on #{entry.key}; the row contributes no edge"
+        nil
       end
 
       # Which index a row lands in, from its receiver spelling.
@@ -353,22 +369,16 @@ module Rigor
         bucket.sort.map do |receiver, rows|
           [receiver,
            rows.sort.map do |selector, row|
-             [selector, row.labels.to_a, row.narrow, row.discharge, row.within, row.taint]
+             [selector, row.labels.to_a, row.narrow, row.discharge, row.within, row.taint,
+              row.callee, row.callee_fallbacks, row.responds]
            end]
         end
       end
 
       def finalize
-        @class_rows.each_value { |bucket| bucket.each_value(&:freeze) }
-        @class_rows.each_value(&:freeze)
-        @class_rows.freeze
-        @path_rows.each_value(&:freeze)
-        @path_rows.freeze
-        @self_rows.each_value(&:freeze)
-        @self_rows.freeze
-        @result_rows.each_value(&:freeze)
-        @result_rows.freeze
-        @edges.freeze
+        @class_rows.each_value { |bucket| bucket.each_value(&:freeze).freeze }
+        [@path_rows, @self_rows, @result_rows].each { |bucket| bucket.each_value(&:freeze).freeze }
+        [@class_rows, @edges, @unit_callee_rows].each(&:freeze)
         @labels_by_owner.each_value(&:uniq!)
         @labels_by_owner.reject! { |_, labels| labels.empty? }
         @labels_by_owner.freeze

data/lib/rigor/effects/propagator.rb

@@ -45,16 +45,18 @@ module Rigor
 
       module_function
 
-      # @param collection [FileCollection] the run's merged per-file collections
-      # @param discharge [Discharge] the `effects.tolerated:` policy the undischarged lane is computed
+      # @param collection — the run's merged per-file collections
+      # @param discharge — the `effects.tolerated:` policy the undischarged lane is computed
       #   under; {Discharge.none} makes the two lanes equal.
-      # @return [EffectTable]
-      def propagate(collection, discharge: Discharge.none)
+      # @param declined_unit_keys — unit keys the run KNOWS a source file for and has no summary for
+      #   (#1065): a template a plugin claimed and declined. An edge's fallback list is not tried past one
+      #   of them, because the file the framework runs is the one that produced nothing.
+      def propagate(collection, discharge: Discharge.none, declined_unit_keys: nil)
         return EffectTable.empty if collection.summaries.empty?
 
         summaries = collection.summaries
         state = seed(summaries, discharge)
-        edges = resolve_edges(collection, state)
+        edges = resolve_edges(collection, state, declined_unit_keys)
         iterate(state, edges)
         EffectTable.new(build_entries(summaries, edges, state))
       rescue StandardError
@@ -63,12 +65,14 @@ module Rigor
 
       # `{caller_key => [callee_key]}`, sorted and de-duplicated. Seeds the `unresolved-super` taint in
       # the same pass, because whether a `super` resolved is exactly what this resolution answers.
-      def resolve_edges(collection, state)
-        index = Index.new(collection)
+      def resolve_edges(collection, state, declined_unit_keys = nil)
+        index = Index.new(collection, declined_unit_keys: declined_unit_keys)
         collection.edges.each_with_object({}) do |(caller_key, list), out|
           targets = list.flat_map do |edge|
-            resolved = index.targets_for(edge)
+            resolved = index.resolve(edge)
             taint_unresolved_super(state, caller_key, edge) if edge.super_call && resolved.empty?
+            taint_unresolved_callee(state, caller_key, edge) if edge.taint_if_unresolved && resolved.empty?
+            mark_unclaimed(state, caller_key) if edge.unclaimed && !edge.super_call && !index.owner_resolved?(edge)
             resolved
           end.uniq.sort
           out[caller_key] = targets.freeze unless targets.empty?
@@ -96,6 +100,47 @@ module Rigor
         entry[:causes] << ["unresolved-super", edge.selector].freeze
       end
 
+      # #1048 — a `callee:` edge a plugin's row produced, whose named unit is not in the table: the
+      # template the render site pointed at was never analysed, so the row's `template-not-analysed` cause
+      # is seeded here after all.
+      #
+      # The taint is ADDED on failure rather than subtracted on success, which is what keeps the fixpoint
+      # monotone and the answer independent of visit order. It is also why a row whose rule declined
+      # outright — a computed `render foo`, a `render json:` — never reaches this: {UnitScan} tainted that
+      # site directly and recorded no edge, so nothing about an unresolvable render changed.
+      def taint_unresolved_callee(state, caller_key, edge)
+        entry = state[caller_key]
+        return if entry.nil?
+
+        entry[:exhaustive] = false
+        # Frozen here rather than trusted from the edge: `Marshal.load` of a `Data` bypasses
+        # `initialize`, so a pooled worker's collection restores the pair unfrozen while a sequential
+        # one has the scan's frozen original. A cause travels into a `Set` shared by the whole fixpoint,
+        # and the two paths must hand it the same value. `#freeze` on an already-frozen array is free.
+        entry[:causes] << edge.taint_if_unresolved.freeze
+      end
+
+      # #391 — an edge nothing bounded whose receiver's OWN ancestry holds no project definition: the
+      # callee's footprint was described by nobody, so the closure is "what the analyzer read", not
+      # "what the method does".
+      #
+      # The question is deliberately {Index#owner_resolved?} and NOT "did this edge resolve to nothing".
+      # An ordinary edge also joins every project subclass override of the selector (the closed-world
+      # join of ADR-103 WD4), so a receiver typed as a gem class a project subclass happens to override
+      # resolves non-empty while the receiver's own dispatch target is still undescribed — `B.run` on a
+      # `Base2 < Vendor::Client` reaches `Vendor::Client#run` at run time whatever `Sub2#run` does.
+      #
+      # Decided HERE for the same reason the `super` taint is: only the merged ancestry can say whether
+      # the edge resolves. Unlike that taint it is not a cause and does not touch exhaustiveness — every
+      # existing consumer reads exactly what it read before. Its one reader is sig-gen's emission, which
+      # must not write `%a{pure}` about a callee nobody described.
+      def mark_unclaimed(state, caller_key)
+        entry = state[caller_key]
+        return if entry.nil?
+
+        entry[:unclaimed] = true
+      end
+
       # Causes are carried as a Set through the fixpoint and flattened back to a sorted Array in
       # {build_entries}. A Set is what {absorb} needs: unioning one along an edge must cost the source's
       # size and allocate NOTHING when it adds nothing, and the array-concat-and-uniq it replaces
@@ -106,7 +151,8 @@ module Rigor
             proven: summary.proven,
             undischarged: discharge.inert? ? summary.proven : discharge.undischarged(summary.bundles),
             declared: summary.declared,
-            exhaustive: summary.exhaustive?, causes: Set.new(summary.causes)
+            exhaustive: summary.exhaustive?, causes: Set.new(summary.causes),
+            unclaimed: summary.unclaimed?
           }
         end
       end
@@ -165,6 +211,10 @@ module Rigor
           target[:exhaustive] = false
           changed = true
         end
+        if !target[:unclaimed] && source[:unclaimed]
+          target[:unclaimed] = true
+          changed = true
+        end
         causes = target[:causes]
         source[:causes].each { |cause| changed = true if causes.add?(cause) }
         changed
@@ -191,25 +241,31 @@ module Rigor
             declared: closed[:declared],
             exhaustive: closed[:exhaustive],
             causes: closed[:causes].sort_by { |cause, detail| [cause, detail.to_s] }.freeze,
-            edges: edges.fetch(key, NO_EDGES)
+            edges: edges.fetch(key, NO_EDGES),
+            unclaimed: closed[:unclaimed]
           )
         end
       end
 
-      private_class_method :resolve_edges, :taint_unresolved_super, :seed, :iterate, :reverse_edges,
-                           :absorb, :join_lane, :build_entries
+      private_class_method :resolve_edges, :taint_unresolved_super, :taint_unresolved_callee,
+                           :mark_unclaimed, :seed, :iterate,
+                           :reverse_edges, :absorb, :join_lane, :build_entries
 
       # The class graph a run's collections describe, and the edge resolution over it. Built once per
       # propagation; every lookup is a Hash read.
       class Index
-        def initialize(collection)
+        def initialize(collection, declined_unit_keys: nil)
           @summaries = collection.summaries
+          @declined = declined_unit_keys.nil? || declined_unit_keys.empty? ? nil : declined_unit_keys.to_a.to_set
           @superclasses = collection.superclasses
           @includes = collection.includes
           @classes = build_classes(collection)
           @descendants = build_descendants(collection.superclasses)
           @descendant_closures = {}
           @targets = {}
+          # #391 — `{memo key => whether the receiver's own ancestry answered}`, filled by
+          # {#call_targets} so {#owner_resolved?} costs a Hash read rather than a second ancestor walk.
+          @owner_resolved = {}
         end
 
         # Every project method key `edge` may reach: the definition its ancestry resolves to, plus every
@@ -219,17 +275,237 @@ module Rigor
         # one such tuple is asked for once per call site in the project. `ApplicationRecord#save` alone is
         # thousands of sites on a Rails app, each of which used to re-walk the whole subclass forest.
         def targets_for(edge)
-          @targets[[edge.receiver_class, edge.kind, edge.selector, edge.super_call]] ||= begin
+          @targets[memo_key(edge)] ||= begin
             separator = edge.kind == :singleton ? "." : "#"
-            edge.super_call ? super_targets(edge, separator) : call_targets(edge, separator)
+            key = memo_key(edge)
+            if edge.super_call
+              super_targets(edge, separator)
+            else
+              constructor_targets(edge, key) || call_targets(edge, key, separator)
+            end
           end
         end
 
+        # {#targets_for}, then — only where that answered nothing — the first of the edge's
+        # `fallback_selectors` that resolves (#1065), spelled as the same edge with that selector. A unit
+        # under the requested key therefore always wins and a fallback never joins a second target beside
+        # it: the lookup runs ONE template, and an edge to both would put a label on the caller that no
+        # execution of the render produces. Empty when every candidate fails, which is what lets the
+        # caller seed `taint_if_unresolved` exactly as before.
+        # A requested key the run **declined** — a template whose file exists and whose plugin produced no
+        # unit — stops there. "No unit answers" and "no such template" are different facts, and only the
+        # second licenses the framework's next candidate: an `_x.js.haml` beside an `_x.html.erb` is run by
+        # Action View as Haml, so joining the ERB unit would be a label no execution produces.
+        def resolve(edge)
+          resolved = targets_for(edge)
+          return resolved unless resolved.empty? && edge.fallback_selectors
+          return NO_TARGETS if declined?(edge)
+
+          fallback_targets(edge)
+        end
+
+        # Whether the receiver's OWN ancestry holds a project definition of the selector — the half of
+        # {#targets_for} the closed-world subclass join hides (#391).
+        #
+        # `targets_for` answers "which project bodies may this edge reach", and for an effect closure the
+        # join is right: Ruby has no `final`, so a subclass override really can run. It is the wrong
+        # question for "is this callee described at all". A receiver typed as a class the project only
+        # subclasses dispatches into that class's own implementation, which lives in a gem or in core;
+        # that a project subclass overrides the same selector says nothing about it. Only emission asks
+        # this, and only to decline.
+        def owner_resolved?(edge)
+          targets_for(edge)
+          @owner_resolved.fetch(memo_key(edge), false)
+        end
+
         private
 
-        def call_targets(edge, separator)
+        def declined?(edge)
+          !@declined.nil? && @declined.include?("#{edge.receiver_class}.#{edge.selector}")
+        end
+
+        def fallback_targets(edge)
+          edge.fallback_selectors.each do |selector|
+            resolved = targets_for(edge.with(selector: selector, fallback_selectors: nil))
+            return resolved unless resolved.empty?
+          end
+          NO_TARGETS
+        end
+
+        def memo_key(edge)
+          [edge.receiver_class, edge.kind, edge.selector, edge.super_call, edge.constant_receiver]
+        end
+
+        NEW_SELECTOR = "new"
+        INITIALIZE_SELECTOR = "initialize"
+        private_constant :NEW_SELECTOR, :INITIALIZE_SELECTOR
+
+        # Class objects whose `new` is Ruby's own reflective constructor rather than a project class's
+        # (#1039). `Class.new` allocates an anonymous class and runs `Class#initialize`, NOT the
+        # `#initialize` of whatever the project happens to have named `Class`; the same holds for
+        # `Module.new`, and for `Struct.new` / `Data.define`, which build a class rather than an instance.
+        # Listed by name rather than left to the project-known guard below, because a project that reopens
+        # `Class` at all would otherwise turn every `Class.new` in it into a call on that reopening.
+        RESERVED_CONSTRUCTOR_OWNERS = %w[Class Module Struct Data].freeze
+        private_constant :RESERVED_CONSTRUCTOR_OWNERS
+
+        # Superclass spellings whose `#initialize` is Ruby's own and empty. A project chain that ends here
+        # — or ends implicitly, with no `<` at all — has no constructor body anywhere, which is what
+        # {#empty_constructor?} has to establish before it may say ∅ rather than "undescribed".
+        EMPTY_CONSTRUCTOR_ROOTS = %w[Object BasicObject].freeze
+        private_constant :EMPTY_CONSTRUCTOR_ROOTS
+
+        # #1039 — `Const.new` on a class the project defines, resolved to that class's `#initialize`.
+        #
+        # The collector records the call as `(Const, :singleton, "new")`, because that is what the typer
+        # saw; nothing in the project defines `Const.new`, so the edge resolved to nothing and every
+        # constructor body stayed out of its caller's closure. `new` is the one selector in Ruby whose
+        # dispatch target is spelled under a different key, and this is the rewrite: the same ancestor walk
+        # {#resolve_owner} performs, on the instance side, for `initialize`.
+        #
+        # Three boundaries, and each of them can only narrow:
+        #
+        # - a project `def self.new` **wins**. It is the definition `Const.new` actually reaches, and a
+        #   constructor that overrides `new` is the case where `#initialize` is not the answer. Resolved
+        #   through the singleton ancestry, so an inherited `self.new` wins too.
+        # - the receiver must be a class the project defines, and must not be one of
+        #   {RESERVED_CONSTRUCTOR_OWNERS}. `Class.new { … }` is not a constructor call on a project class
+        #   and must never reach a project `#initialize`; a gem class the project only calls `new` on is
+        #   undescribed exactly as it was, and stays unclaimed.
+        # - the closed-world subclass join is **dropped for a written constant receiver, and only for one**.
+        #   `Base.new` names the class object it constructs, so `Sub#initialize` cannot run and joining it
+        #   would put a proven label on the caller that no execution of that site can produce — the `super`
+        #   argument (see {#super_targets}) rather than the ordinary-call one. But the edge is keyed on the
+        #   receiver's TYPE, and `self.class.new`, a `Singleton[Base]` local's `.new` and a receiver-less
+        #   `new` in a singleton body produce the identical tuple while genuinely constructing a subclass.
+        #   {FileCollection::Edge#constant_receiver} is what tells them apart, and every shape that is not
+        #   a written constant keeps the join — over `Sub#initialize` and over a subclass `Sub.new` alike.
+        # - an ancestry the scanner could not read ({FileCollection::OPAQUE_ANCESTOR} — a non-constant
+        #   superclass expression, an aliased `initialize`) declines, leaving the caller as unclaimed as it
+        #   was before this rule existed.
+        #
+        # @return the targets, or `nil` when the rewrite does not apply and ordinary resolution should run
+        def constructor_targets(edge, memo_key)
+          return nil unless constructor_edge?(edge)
+
+          owner = resolve_owner(edge.receiver_class, "#", INITIALIZE_SELECTOR)
+          return nil unless owner || empty_constructor?(edge.receiver_class)
+
+          @owner_resolved[memo_key] = true
+          targets = owner ? [owner] : []
+          targets.concat(subclass_constructors(edge.receiver_class)) unless edge.constant_receiver
+          targets.uniq.freeze
+        end
+
+        # Whether the `new` rewrite applies to this edge at all — the guards of {#constructor_targets},
+        # each of which can only decline: a singleton `new` on a project class that is not one of Ruby's
+        # own class builders, whose singleton ancestry defines no `new` of its own, and whose constructor
+        # the scan could read both above it and (where the join applies) below it.
+        def constructor_edge?(edge)
+          edge.kind == :singleton && edge.selector == NEW_SELECTOR &&
+            !RESERVED_CONSTRUCTOR_OWNERS.include?(edge.receiver_class) &&
+            project_class?(edge.receiver_class) &&
+            resolve_owner(edge.receiver_class, ".", NEW_SELECTOR).nil? &&
+            !opaque_ancestry?(edge.receiver_class) &&
+            (edge.constant_receiver || !opaque_descendant?(edge.receiver_class))
+        end
+
+        # Every constructor a subclass of `class_name` supplies — its own `#initialize`, and its own
+        # `.new` where it overrides one. The closed-world join of step 2, spelled for the two keys a
+        # constructor can live under.
+        def subclass_constructors(class_name)
+          descendant_closure(class_name).each_with_object([]) do |subclass, keys|
+            keys << "#{subclass}##{INITIALIZE_SELECTOR}" if @summaries.key?("#{subclass}##{INITIALIZE_SELECTOR}")
+            keys << "#{subclass}.#{NEW_SELECTOR}" if @summaries.key?("#{subclass}.#{NEW_SELECTOR}")
+          end
+        end
+
+        # The same question DOWNWARD, and only where the closed-world join applies. A subclass whose own
+        # constructor is unreadable — `class AliasedChild < Parent; alias initialize setup` — is reached by
+        # `self.class.new` in `Parent`, and {#subclass_constructors} would find no `AliasedChild#initialize`
+        # key and say nothing. The join is the whole reason this edge may construct a subclass at all, so an
+        # unreadable one in the closure declines the edge instead.
+        def opaque_descendant?(class_name)
+          descendant_closure(class_name).any? do |subclass|
+            @includes.fetch(subclass, []).include?(FileCollection::OPAQUE_ANCESTOR) ||
+              @superclasses.fetch(subclass, []).include?(FileCollection::OPAQUE_ANCESTOR)
+          end
+        end
+
+        # Whether anything in `class_name`'s ancestry told the scanner its constructor is not readable from
+        # the source (#1039): a superclass expression that is not a constant path, or an `alias` that makes
+        # `initialize` another method. The sentinel rides the ancestry tables, so one walk finds it wherever
+        # in the chain it was recorded.
+        def opaque_ancestry?(class_name)
+          queue = [class_name]
+          seen = Set.new
+          until queue.empty?
+            current = queue.shift
+            next unless seen.add?(current)
+            return true if current == FileCollection::OPAQUE_ANCESTOR
+
+            queue.concat(@includes.fetch(current, []))
+            queue.concat(@superclasses.fetch(current, []))
+          end
+          false
+        end
+
+        # Whether `class_name`'s constructor is *known* to be `BasicObject#initialize`, whose footprint is
+        # ∅ (#1039).
+        #
+        # This is the design choice in the rewrite. "No `#initialize` in the ancestry" has two readings —
+        # the project defines none and none exists (a plain `class Bare; end`, constructed by Ruby's own
+        # empty constructor), or the project defines none and a gem's base class does. The first resolves
+        # to a known-empty definition: the edge contributes nothing AND leaves its caller claimed, because
+        # the callee was read — there is simply nothing in it. The second is undescribed and must keep
+        # marking its caller unclaimed. Only an ancestry that closes inside the project can tell them
+        # apart, so that is what this walks, and it answers `false` the moment the walk leaves.
+        #
+        # No summary row is invented for `BasicObject#initialize`. A row would be a *method of the
+        # project* in every table that lists them — the snapshot, `rigor effects`, the pure report — for a
+        # definition the project does not contain; the answer belongs to the edge, and the edge is already
+        # the thing {#owner_resolved?} is asked about.
+        #
+        # An `include` anywhere in the chain ends the walk conservatively. The collection's include table
+        # is a flat list of as-written *candidate spellings* (`include Foo` inside `module A` records both
+        # `A::Foo` and `Foo`), so it cannot say whether a class includes one project module or one gem
+        # module the project cannot see — and a module is free to define `initialize`. Such a class keeps
+        # exactly today's behaviour: its `new` edge resolves to nothing and its callers stay unclaimed.
+        # The table holds instance-side includes only. A module mixed into the singleton class, by
+        # `extend` or by an `include` inside `class << self`, is not in it, so a `new` such a module
+        # supplies is not seen, and the walk can answer `true` for a class whose `new` does work.
+        def empty_constructor?(class_name)
+          queue = [class_name]
+          seen = Set.new
+          until queue.empty?
+            current = queue.shift
+            next unless seen.add?(current)
+            return false unless project_class?(current)
+            return false unless @includes.fetch(current, []).empty?
+
+            parents = @superclasses.fetch(current, [])
+            next if parents.empty?
+
+            known = parents.find { |candidate| project_class?(candidate) }
+            return false if known.nil? && parents.none? { |candidate| EMPTY_CONSTRUCTOR_ROOTS.include?(candidate) }
+
+            queue << known if known
+          end
+          true
+        end
+
+        # Whether the project defines this class at all: it defines a method on it, declares its
+        # superclass, or declares what it includes. Any one of the three is a `class` body the scanner
+        # read, which is what licenses reading its silence about `initialize` as an answer.
+        def project_class?(class_name)
+          !class_name.nil? &&
+            (@classes.include?(class_name) || @superclasses.key?(class_name) || @includes.key?(class_name))
+        end
+
+        def call_targets(edge, memo_key, separator)
           targets = []
           owner = resolve_owner(edge.receiver_class, separator, edge.selector)
+          @owner_resolved[memo_key] = !owner.nil?
           targets << owner if owner
           descendant_closure(edge.receiver_class).each do |subclass|
             key = "#{subclass}#{separator}#{edge.selector}"
@@ -260,7 +536,7 @@ module Rigor
 
         # Ancestry order mirrors the engine's: the class itself, the modules it includes, then its
         # superclass, recursively. Cycle-guarded, because a project may declare one. Ancestry names
-        # arrive as as-written candidate lists (see `Scanner#lexical_candidates`); every candidate is
+        # arrive as as-written candidate lists (see `AncestryRecorder#lexical_candidates`); every candidate is
         # enqueued and the most-qualified one comes first, so the right constant wins the race and a
         # spelling that names nothing simply matches no key.
         def resolve_owner(class_name, separator, selector)
@@ -273,8 +549,10 @@ module Rigor
         #
         # The includes are instance-side only. `include M` puts `M#m` between the class and its
         # superclass, which is exactly where `super` looks, while `M.m` is a singleton method `include`
-        # never contributes; a singleton `super` that really does reach a module went through `extend` or
-        # a `class << self` include, neither of which is collected, so it resolves to nothing and taints.
+        # never contributes. A singleton `super` that really does reach a module went through `extend` or
+        # a `class << self` include, neither of which is collected, so the walk steps over the module: it
+        # reaches the superclass chain's definition when there is one, without the module's labels, and
+        # resolves to nothing and taints when there is not.
         def resolve_super(class_name, separator, selector)
           queue = separator == "#" ? @includes.fetch(class_name, []).dup : []
           queue.concat(@superclasses.fetch(class_name, []))