rigortype 0.3.8 → 0.4.0

data/lib/rigor/language_server/selection_range_provider.rb

@@ -20,9 +20,9 @@ module Rigor
         @project_context = project_context
       end
 
-      # @param positions [Array<Hash>] LSP `Position[]` — each
+      # @param positions — LSP `Position[]` — each
       #   `{ line:, character: }` 0-based.
-      # @return [Array<Hash>, nil] one `SelectionRange` per
+      # @return one `SelectionRange` per
       #   position, or nil when the URI / buffer isn't resolvable.
       def provide(uri, positions)
         path, entry = buffer_for(uri)

data/lib/rigor/language_server/server.rb

@@ -42,11 +42,11 @@ module Rigor
                   :signature_help_provider, :folding_range_provider,
                   :selection_range_provider, :project_context
 
-      # @param completion_provider [Rigor::LanguageServer::CompletionProvider, nil]
+      # @param completion_provider —
       #   resolves `textDocument/completion`. Nil → `MethodNotFound`.
-      # @param signature_help_provider [Rigor::LanguageServer::SignatureHelpProvider, nil]
+      # @param signature_help_provider —
       #   resolves `textDocument/signatureHelp`. Nil → `MethodNotFound`.
-      # @param project_context [Rigor::LanguageServer::ProjectContext, nil] the per-session cache of
+      # @param project_context — the per-session cache of
       #   `Environment` + `Cache::Store` the providers read on every request. When present,
       #   `workspace/didChangeWatchedFiles` and `workspace/didChangeConfiguration` invalidate the cache; nil
       #   means "no project context": each request rebuilds env from scratch (mainly for specs and backward
@@ -69,7 +69,7 @@ module Rigor
         @project_context = project_context
       end
 
-      # @return [Boolean] true once the client has called `exit` and
+      # @return true once the client has called `exit` and
       #   the server has set its terminal exit code. The CLI loop
       #   reads this between dispatches to know when to stop.
       def exited?
@@ -78,10 +78,10 @@ module Rigor
 
       # Routes one LSP method call.
       #
-      # @param method [String] the LSP method name (e.g. "initialize").
-      # @param params [Hash, nil] the LSP `params` payload (Hash for
+      # @param method — the LSP method name (e.g. "initialize").
+      # @param params — the LSP `params` payload (Hash for
       #   request / notification methods; nil for the empty case).
-      # @return [Hash, nil] one of:
+      # @return one of:
       #   - the response result Hash for request methods,
       #   - nil for notification methods,
       #   - { error: { code:, message: } } for state / shape errors.
@@ -191,8 +191,8 @@ module Rigor
         caps
       end
 
-      # `initialized` is a notification — no response body. Slice 7 will hook this to register
-      # `workspace/didChangeWatchedFiles` if the client advertised the capability.
+      # `initialized` is a notification — no response body. Nothing is registered here yet: the server handles
+      # `workspace/didChangeWatchedFiles` when a client sends it, but does not register for it dynamically.
       def handle_initialized
         nil
       end

data/lib/rigor/language_server/signature_help_provider.rb

@@ -44,7 +44,7 @@ module Rigor
         @project_context = project_context
       end
 
-      # @return [Hash, nil] LSP `SignatureHelp` payload or nil
+      # @return LSP `SignatureHelp` payload or nil
       #   when the cursor isn't inside a resolvable method call.
       def provide(uri:, line:, character:, context: nil)
         _ = context # Trigger info accepted but not routed in v1.

data/lib/rigor/language_server/uri.rb

@@ -14,7 +14,7 @@ module Rigor
       FILE_SCHEME = "file://"
       private_constant :FILE_SCHEME
 
-      # @return [String, nil] absolute filesystem path for a
+      # @return absolute filesystem path for a
       #   `file://` URI, or nil for unsupported schemes.
       def to_path(uri)
         return nil unless uri.is_a?(String) && uri.start_with?(FILE_SCHEME)

data/lib/rigor/mcp/server.rb

@@ -94,7 +94,7 @@ module Rigor
                 type: "string",
                 enum: %w[untyped observed],
                 description: "Parameter policy: untyped (default) or observed " \
-                             "(harvests call-site argument types from spec/)"
+                             "(harvests call-site argument types from the configured test_paths)"
               },
               config: { type: "string", description: "Path to .rigor.yml (optional)" }
             }
@@ -134,6 +134,7 @@ module Rigor
           }
         }
       ].freeze
+      Ractor.make_shareable(TOOLS)
 
       def initialize(config_path: nil, err: $stderr)
         @config_path = config_path

data/lib/rigor/plugin/base.rb

@@ -8,6 +8,7 @@ require "prism"
 require_relative "manifest"
 require_relative "node_context"
 require_relative "../analysis/diagnostic"
+require_relative "../cache/engine_source"
 # `producer generation_cap:` defaults to (and validates against) `Cache::Store::UNBOUNDED_GENERATIONS`, and a
 # plugin class body can be evaluated before anything else pulled the cache layer in.
 require_relative "../cache/store"
@@ -40,6 +41,13 @@ module Rigor
     #
     #   Rigor::Plugin.register(MyRailsPlugin)
     class Base # rubocop:disable Metrics/ClassLength
+      # Issue #701 — the kind wrapper a `dynamic_return receivers:` entry may carry, spelled as RBS spells a
+      # class object and as the `call.undefined-method` message prints one, so an author writes the gate the
+      # way the diagnostic they are answering names the receiver. Declared on the class rather than inside
+      # `class << self` because both the load-time validator and the per-dispatch gate read it.
+      SINGLETON_RECEIVER_PATTERN = /\Asingleton\((.+)\)\z/
+      private_constant :SINGLETON_RECEIVER_PATTERN
+
       class << self
         # Declares the plugin's manifest. Called once at class definition time — the resulting {Manifest} is
         # cached on the class so {Rigor::Plugin::Loader} reads it without constructing the plugin.
@@ -241,8 +249,21 @@ module Rigor
         #   end
         #
         # `receivers:` is a non-empty Array of class names; the engine calls the block only when the call's
-        # receiver type's class equals or inherits from one of them (via `Environment#class_ordering`). It
-        # MAY be omitted — then the rule is receiver-independent and fires on `methods:` alone.
+        # receiver type's class equals or inherits from one of them (via `Environment#class_ordering`) AND
+        # is of the kind the entry names. It MAY be omitted — then the rule is receiver-independent and
+        # fires on `methods:` alone.
+        #
+        # Issue #701 — an entry carries the receiver KIND in RBS's own spelling. `"Widget"` matches an
+        # INSTANCE receiver; `"singleton(Widget)"` matches the class object itself; a rule that wants both
+        # lists both:
+        #
+        #   dynamic_return receivers: ["Widget"], methods: [:price]                  # Widget#price
+        #   dynamic_return receivers: ["singleton(Widget)"], methods: [:build]       # Widget.build
+        #   dynamic_return receivers: ["Widget", "singleton(Widget)"]                # either
+        #
+        # An instance rule that also answered on the class typed a call the plugin never modelled, and since
+        # #653 a plugin's answer suppresses `call.undefined-method` — so the class-level miss went silent on
+        # the say-so of a rule written for the instance.
         #
         # `methods:` is an Array of Symbol method names. When provided, the block is skipped unless
         # `call_node.name` is in the list — declarative and cheaper than an in-block guard (the engine
@@ -261,6 +282,9 @@ module Rigor
         #     # found; the block does the precise per-call lookup
         #   end
         #
+        # A callable's entries carry the kind the same way — `-> { names.map { "singleton(#{_1})" } }` for a
+        # discovered set of class-level receivers.
+        #
         # The callable runs through `instance_exec`, so it reads the plugin's own `#prepare`-built indexes.
         # It MUST be idempotent and post-`#prepare`-safe — reference a lazily-built / memoised index (as
         # activestorage's `attachment_index` and activerecord's `model_index` are), never a value captured at
@@ -376,11 +400,23 @@ module Rigor
           # ADR-52 slice 3 — a run-time callable is resolved per instance after `#prepare`; its shape is
           # checked at resolution time.
           return if receivers.respond_to?(:call)
-          return if receivers.is_a?(Array) && !receivers.empty? && receivers.all? { |r| r.is_a?(String) && !r.empty? }
+          return if receivers.is_a?(Array) && !receivers.empty? &&
+                    receivers.all? { |r| valid_dynamic_return_receiver?(r) }
 
           raise ArgumentError,
                 "Plugin::Base.dynamic_return receivers: must be a non-empty Array of class-name Strings " \
-                "or a callable, got #{receivers.inspect}"
+                "(\"Foo\" for an instance receiver, \"singleton(Foo)\" for the class itself) or a " \
+                "callable, got #{receivers.inspect}"
+        end
+
+        # Issue #701 — the entry grammar: a non-empty class name, optionally wrapped in RBS's own
+        # `singleton(...)`. A bare `singleton()` is rejected rather than read as a class literally named
+        # that, so a typo in the kind wrapper fails at load instead of never matching.
+        def valid_dynamic_return_receiver?(entry)
+          return false unless entry.is_a?(String) && !entry.empty?
+          return SINGLETON_RECEIVER_PATTERN.match?(entry) if entry.start_with?("singleton(")
+
+          true
         end
 
         def validate_dynamic_return_methods!(methods)
@@ -397,7 +433,8 @@ module Rigor
         end
 
         private :validate_dynamic_return_gate!, :validate_dynamic_return_receivers!,
-                :validate_dynamic_return_methods!, :validate_dynamic_return_file_methods!
+                :validate_dynamic_return_methods!, :validate_dynamic_return_file_methods!,
+                :valid_dynamic_return_receiver?
 
         # ADR-37 slice 2 — declares a predicate/assertion narrowing contribution, method-gated. The narrow
         # successor to the `post_return_facts` slot of the deleted `flow_contribution_for` hook (ADR-52 WD3):
@@ -456,6 +493,10 @@ module Rigor
         @fact_cache = {}
         @producer_value_cache = {}
         @producer_errors = {}
+        # Issue #1051 — the run-scoped disclosure table ({#disclose_once}, and since #1060 {#emit_once}).
+        # Allocated here for the same reason as the three memos above: a registration is a Hash-content
+        # mutation, so it stays sound on a plugin that freezes itself in `initialize`.
+        @run_disclosures = {}
       end
 
       # Override in subclasses to wire any state the plugin needs from the injected service container.
@@ -509,6 +550,38 @@ module Rigor
         []
       end
 
+      # #392 — the **template-unit** transform: compile one non-Ruby project file into the Ruby the engine
+      # analyses (ADR-16 Tier D, revived; design note § 11.3). The engine globs the manifest's
+      # `template_globs:`, reads each match's bytes, and calls this once per match on the PARENT, before any
+      # analysis — so the transform runs exactly once per file per run and its result marshals into every
+      # fork-pool worker.
+      #
+      # Returns an `Array<Rigor::Plugin::TemplateUnit>`; an empty array declines the file, which is the
+      # right answer for a match the plugin's glob caught but its compiler cannot read. The default returns
+      # `[]`, so a plugin that declares no `template_globs:` is never asked and one that does may still
+      # decline per file.
+      #
+      # A raise isolates exactly like `#diagnostics_for_file`: the file contributes no unit and the run
+      # continues. The hook is the one place a template-unit plugin runs code — everything downstream is
+      # the frozen value object — which is what keeps the engine's analysis of a unit identical to its
+      # analysis of a `.rb` file.
+      def template_units_for_file(path:, source:) # rubocop:disable Lint/UnusedMethodArgument
+        []
+      end
+
+      # #1047 — called once at the start of every template-unit COLLECTION PASS over this plugin's claim,
+      # before any `#template_units_for_file` of that pass and whether or not the pass ends up calling it
+      # (a warm pass may carry every unit and compile none). A plugin whose transform reads state gathered
+      # ACROSS its claimed files — rigor-actionpack seeds a partial's locals from the render sites in every
+      # view — memoises that state on its instance, and a long-lived owner keeps the instance across
+      # passes; this is where such a plugin learns that the memo may now be stale. The collector's
+      # per-call order is not a substitute: a warm pass offers only the editor's buffer, so no sequence of
+      # paths can tell one pass from the next.
+      #
+      # The default does nothing. A raise is swallowed: the pass continues, and the plugin's own
+      # revalidation simply does not run for it.
+      def template_units_pass_started; end
+
       # ADR-37 slice 1 — runs the plugin's declared {.node_rule}s over one file and returns their
       # diagnostics. The engine owns the single AST walk here so plugin authors never hand-roll a traversal:
       # every node reachable from `root` is offered to each rule whose `node_type` it satisfies
@@ -545,19 +618,15 @@ module Rigor
 
       # ADR-37 slice 2 — the return type contributed by this plugin's {.dynamic_return} rules for a call, or
       # nil. The engine calls this from `MethodDispatcher`; a rule fires only when `receiver_type`'s class
-      # equals or inherits from one of its declared `receivers:`. First non-nil wins (declaration order).
-      # Failures isolate to nil.
+      # equals or inherits from one of its declared `receivers:` AND is of that entry's kind (#701). First
+      # non-nil wins (declaration order). Failures isolate to nil.
       def dynamic_return_type(call_node:, scope:, receiver_type:)
         rules = self.class.dynamic_returns
         return nil if rules.empty? || receiver_type.nil?
 
-        # `class_name` is nil for a receiver carrier with no nominal class (a refinement dimension, an
-        # inferred shape) — fine for a receiver-less (methods-only) rule (ADR-52 WD2), which gates on the
-        # method name alone and reads the receiver shape inside its own block.
-        class_name = dynamic_return_receiver_class_name(receiver_type)
         environment = scope&.environment
         rules.each do |rule|
-          next unless dynamic_return_rule_applies?(rule, call_node, class_name, environment, scope)
+          next unless dynamic_return_rule_applies?(rule, call_node, receiver_type, environment, scope)
 
           result = instance_exec(call_node, scope, &rule[:block])
           return result if result
@@ -587,6 +656,27 @@ module Rigor
         []
       end
 
+      # ADR-113 WD4 (#1082) — enumerates the members this plugin synthesizes on `class_name`, for the
+      # `rigor lens` declaration map. A `dynamic_return` rule answers a TYPE for one call site at a time;
+      # nothing on that path can say "`User` has `email`, `name`, …", which is the fact grep can never
+      # find on a DSL-generated member. This hook is that per-class enumeration.
+      #
+      # Returns an `Array` of `{name:, kind:, type:}` Hashes. `name` is the member name as a caller spells
+      # it (String); `kind` is a Symbol grouping same-shaped members (`:column_reader`) — the lens
+      # collapses a group into one line; `type` is the `Rigor::Type` the plugin commits to for the member
+      # itself, or nil where it does not commit to one. It is the member-level answer, not the best a
+      # typed call site can do: a plugin that narrows `user.name` to `String` on a written receiver but
+      # declines to type the bare `name` read reports `Dynamic[top]` here. A member the plugin claims
+      # but deliberately leaves dynamic carries `Rigor::Type::Combinator.untyped` — the explicit
+      # `Dynamic[top]` answer, distinct from nil's "no answer".
+      #
+      # The hook is off the `check` hot path (ADR-52): `rigor lens` invokes it, `check` never does. It may
+      # read state `#prepare` built. The default returns `[]` — a plugin that synthesizes no enumerable
+      # members has nothing to declare.
+      def declared_members(class_name) # rubocop:disable Lint/UnusedMethodArgument
+        []
+      end
+
       # Builds a `Rigor::Analysis::Diagnostic` positioned at a Prism `node` for return from
       # `#diagnostics_for_file`. Internalises the 1-based `line` / `start_column + 1` convention every plugin
       # otherwise re-derives by hand, so authors pass the node and the message/severity/rule rather than
@@ -654,12 +744,108 @@ module Rigor
       end
 
       # ADR-60 WD4 — the `StandardError` a prior {#producer_value} call rescued for `id`, or nil when it
-      # succeeded or was never called. Plugins surface it as a load-error diagnostic from
-      # `#diagnostics_for_file`.
+      # succeeded or was never called. Plugins surface it as a run-scoped `load-error` disclosure through
+      # {#disclose_once} (#1056) — a failed index is a fact about the run's inputs, not about a file.
       def producer_error(id)
         @producer_errors[id.to_sym]
       end
 
+      # Issue #1051 — records a PROJECT-GLOBAL disclosure: a notice about the run's inputs ("the schema file
+      # is not there, so column checks are off") rather than about a line of a file. Registering the same
+      # `key` again — on this instance or on any other instance of this plugin in the same run — is a no-op,
+      # so the run emits the row exactly once however many workers, files or call sites reached it.
+      #
+      #     disclose_once(:missing_schema,
+      #                   message: "rigor-activerecord: schema file `db/schema.rb` not found; …",
+      #                   severity: :info, rule: "load-error")
+      #
+      # Callable from any hook — `#prepare` (the usual place: the disclosure is a fact about the project,
+      # known before a single file is read), `#diagnostics_for_file`, or a `node_rule` block. It returns
+      # `nil` and emits NOTHING itself: the engine harvests the table after analysis, de-duplicates it by
+      # `(plugin id, key)` across the coordinator and every pool worker, and emits one row per surviving
+      # pair at `.rigor.yml:1:1` — the position every other run-level plugin row already uses (plugin load
+      # errors, `#prepare` raises, `plugin_trust.read-refused`).
+      #
+      # That position is the point of the facility. The pre-#1051 idiom was an `@emitted` flag consulted from
+      # `#diagnostics_for_file`, which positions the row at whichever file the plugin instance happened to
+      # see first — per WORKER under `--workers N`, so the row was duplicated, and after #393 the file it
+      # landed on could be a template unit's `.erb` path, reading as a claim about a view. A disclosure has
+      # no source position to be right about; `.rigor.yml` is where the user configured the input it is
+      # about.
+      #
+      # `severity:` defaults to `:info`, the grade plugins use for "here is what I recognised"; pass
+      # `:warning` for "I could not run". `key` is any object with a stable `#to_s` (a Symbol reads best) and
+      # is never shown to the user — it is the de-duplication identity, so it must not interpolate anything
+      # that differs between workers.
+      def disclose_once(key, message:, severity: :info, rule: "load-error")
+        id = key.to_s
+        return nil if run_registration_taken?(id, batch: false)
+
+        @run_disclosures[id] = {
+          key: id, message: message.to_s, severity: severity.to_sym, rule: rule.to_s
+        }.freeze
+        nil
+      end
+
+      # Issue #1060 — the POSITIONED sibling of {#disclose_once}: registers a whole batch of fully built
+      # diagnostics under `key`, emitted once per run however many plugin instances (fork-pool workers)
+      # register it. Each row keeps its own `path` / `line` / `column` — use this when a project-wide scan
+      # produces rows that are right about a position (a view template's line) but no single analysed file
+      # owns them, so returning them from `#diagnostics_for_file` would repeat them once per worker.
+      #
+      #     emit_once(:view_diagnostics, scan_view_files(index))
+      #
+      # The question that chooses between the two channels is whether the row has a position it could be
+      # right about: a notice about the run's inputs has none and goes through {#disclose_once}
+      # (`.rigor.yml:1:1`); a row naming a real file and line comes here and keeps it.
+      #
+      # De-duplication is by `key` alone and the first registration wins: a later batch under the same key
+      # is dropped whole, on this instance or on any other instance in the run, never merged row by row.
+      # Every worker scans the same project, so a row-wise union could only add a worker's partial or
+      # divergent view. `key` shares one namespace per plugin with {#disclose_once} — the two channels are
+      # one registration table — but a key keeps the kind it was first registered as: repeating a key on the
+      # same channel is a no-op, and reusing it on the OTHER channel (either order) raises `ArgumentError`
+      # rather than silently dropping a genuine batch or disclosure.
+      #
+      # Callable from `#prepare`, `#diagnostics_for_file`, or a `node_rule` block; returns `nil` and emits
+      # nothing itself. The engine stamps `source_family: "plugin.<id>"` exactly as it does for a per-file
+      # row, so the qualified rule and the position a baseline keys on are the ones `#diagnostics_for_file`
+      # would have produced. Each row is copied and frozen on registration so the batch rides the fork
+      # payload and the Ractor `:done` message unchanged; a non-{Rigor::Analysis::Diagnostic} element
+      # raises `ArgumentError`, which the engine reports as this plugin's `runtime-error`.
+      def emit_once(key, diagnostics)
+        id = key.to_s
+        return nil if run_registration_taken?(id, batch: true)
+
+        batch = Array(diagnostics).map do |row|
+          next row.dup.freeze if row.is_a?(Rigor::Analysis::Diagnostic)
+
+          raise ArgumentError, "emit_once expects Rigor::Analysis::Diagnostic rows, got #{row.class}"
+        end
+        @run_disclosures[id] = { key: id, diagnostics: batch.freeze }.freeze
+        nil
+      end
+
+      # Engine-facing reader for {#disclose_once} and {#emit_once}: this instance's registrations in
+      # registration order; a positioned batch is the record carrying `:diagnostics`. Plugin authors never
+      # call it — {Rigor::Analysis::Runner} and {Rigor::Analysis::WorkerSession} drain it, and the
+      # de-duplication across instances happens there.
+      def run_disclosure_records
+        @run_disclosures.values
+      end
+
+      # #1060 — true when `id` is already registered on the same channel (the repeat is a no-op); raises when
+      # it is registered on the other one, because either answer there would drop a genuine registration.
+      def run_registration_taken?(id, batch:)
+        existing = @run_disclosures[id]
+        return false if existing.nil?
+        return true if existing.key?(:diagnostics) == batch
+
+        taken = batch ? "a #disclose_once disclosure" : "an #emit_once batch"
+        raise ArgumentError, "run-scoped key #{id.inspect} is already registered as #{taken}; use a distinct key"
+      end
+      private :run_registration_taken?
+
       # Boilerplate-reduction helper (review §1.3): the "did you mean …?" suggestion every
       # diagnostic-emitting plugin otherwise hand-rolls. Returns the closest of `candidates` to `name` via
       # `DidYouMean::SpellChecker` (the same engine Ruby's own `NoMethodError` hints use), or `nil` when
@@ -673,7 +859,6 @@ module Rigor
         DidYouMean::SpellChecker.new(dictionary: dictionary).correct(name.to_s).first
       end
 
-      # Convenience accessor — `manifest` on the instance returns the class-level manifest declaration.
       def manifest
         self.class.manifest
       end
@@ -776,7 +961,12 @@ module Rigor
         return compute unless store
 
         prefixed_id = "plugin.#{manifest.id}.#{producer_id}"
-        key_descriptor = compose_key_descriptor(descriptor)
+        begin
+          key_descriptor = compose_key_descriptor(descriptor)
+        rescue Cache::EngineSource::Unavailable
+          # An unidentifiable engine runs the producer uncached rather than keyed without it (issue #1009).
+          return compute
+        end
         lambda do
           store.fetch_or_validate(
             producer_id: prefixed_id,
@@ -803,10 +993,9 @@ module Rigor
       # survives only as the building block for the rare producer that needs `FileEntry` rows directly;
       # plugin code calls `watch:`.
       #
-      # @param roots    [Array<String>] search roots (relative to the project root, or absolute paths)
-      # @param patterns [Array<String>] glob suffixes joined under each root via `File.join(root, pattern)`.
+      # @param roots — search roots (relative to the project root, or absolute paths)
+      # @param patterns — glob suffixes joined under each root via `File.join(root, pattern)`.
       #   Multiple patterns union into one descriptor (`"**/*.erb", "**/*.html"` etc.).
-      # @return [Rigor::Cache::Descriptor]
       def glob_descriptor(roots, *patterns)
         files = collect_glob_files(Array(roots), patterns)
         entries = files.map do |path|
@@ -836,7 +1025,9 @@ module Rigor
 
       # ADR-37 slice 2 — the class name to match a `dynamic_return` `receivers:` entry against, from a
       # receiver `Type`. Covers the instance (`Nominal[X]`) and class (`Singleton[X]`) shapes; other carriers
-      # decline (nil → no match).
+      # decline (nil → no match). Which of the two KINDS the name is then matched as is
+      # {#dynamic_return_receiver_matches?}'s question — the `Result` / `Maybe` carriers are instances of
+      # their class, like `Nominal`.
       def dynamic_return_receiver_class_name(receiver_type)
         case receiver_type
         when Rigor::Type::Nominal, Rigor::Type::Singleton then receiver_type.class_name
@@ -848,7 +1039,7 @@ module Rigor
       # The gate for one `dynamic_return` rule. Method-name gate first — a Symbol-array probe vs the receiver
       # ancestry resolution below (ADR-52 WD1); both are pure predicates, so order only affects cost. A
       # receiver-less rule (ADR-52 WD2) skips the ancestry check entirely and fires on the method name alone.
-      def dynamic_return_rule_applies?(rule, call_node, class_name, environment, scope)
+      def dynamic_return_rule_applies?(rule, call_node, receiver_type, environment, scope)
         return false if rule[:methods] && !resolved_dynamic_return_methods(rule).include?(call_node.name)
 
         if rule[:file_methods]
@@ -858,11 +1049,29 @@ module Rigor
           return false unless resolved_dynamic_return_file_methods(rule, path).include?(call_node.name)
         end
 
-        receivers = resolved_dynamic_return_receivers(rule)
-        return true if receivers.nil?
+        entries = resolved_dynamic_return_receiver_entries(rule)
+        return true if entries.nil?
+
+        dynamic_return_receiver_matches?(entries, receiver_type, environment)
+      end
+
+      # Issue #701 — the receiver gate, kind included. An entry written for an instance (`"Widget"`) must not
+      # answer for the class object: the block was never given the class-level call to model, and since #653
+      # its answer would suppress that call's `call.undefined-method`, hiding a genuine miss on the plugin's
+      # say-so. A rule that wants the class object declares `"singleton(Widget)"`, and one that wants both
+      # lists both.
+      #
+      # A nil class name is a carrier with no nominal class (a refinement dimension, an inferred shape); a
+      # receiver-gated rule cannot speak about it and declines. A receiver-less rule (ADR-52 WD2) never
+      # reaches here.
+      def dynamic_return_receiver_matches?(entries, receiver_type, environment)
+        class_name = dynamic_return_receiver_class_name(receiver_type)
         return false if class_name.nil?
 
-        receivers.any? { |c| class_matches_receiver?(class_name, c, environment) }
+        singleton = receiver_type.is_a?(Rigor::Type::Singleton)
+        entries.any? do |name, singleton_entry|
+          singleton_entry == singleton && class_matches_receiver?(class_name, name, environment)
+        end
       end
 
       # ADR-52 slice 4 — the rule's method-name set. A static Array is returned as-is (`#include?` over
@@ -910,6 +1119,24 @@ module Rigor
           Array(instance_exec(&receivers)).map { |c| c.to_s.dup.freeze }.freeze
       end
 
+      # Issue #701 — the resolved `receivers:` entries as `[class_name, singleton?]` pairs, or nil for a
+      # receiver-less rule. Memoised per rule beside the callable resolution above, so the kind is parsed
+      # once per run rather than once per dispatch (this sits on the per-dispatch plugin path).
+      def resolved_dynamic_return_receiver_entries(rule)
+        receivers = resolved_dynamic_return_receivers(rule)
+        return nil if receivers.nil?
+
+        (@dynamic_return_runtime_cache ||= {})[[:receiver_entries, rule]] ||=
+          receivers.map { |entry| parse_dynamic_return_receiver(entry) }.freeze
+      end
+
+      def parse_dynamic_return_receiver(entry)
+        match = SINGLETON_RECEIVER_PATTERN.match(entry)
+        return [match[1].freeze, true].freeze if match
+
+        [entry, false].freeze
+      end
+
       # True when `class_name` equals or inherits from `constraint`, matched through
       # `Environment#class_ordering` (the mechanism `MacroBlockSelfType` / `additional_initializers` use).
       # Degrades to "no match" on any resolution failure (false-positive-safe).
@@ -957,8 +1184,13 @@ module Rigor
       # plugin-author-supplied extension carrying IDENTITY inputs (gem-version pins, `ConfigEntry` rows,
       # configuration-file digests). The IoBoundary read history deliberately does NOT enter the key — it is
       # recorded post-compute into the dependency descriptor instead (see {#producer_dependency_descriptor}).
+      #
+      # Issue #1009 — the engine's source identity rides in the auto-built half. The manifest version is the
+      # plugin author's promise, and a checkout editing a bundled plugin (or the engine API a producer computes
+      # through) keeps it, so without the identity the next session served the previous build's value into a
+      # run the run-result key had correctly re-analysed.
       def compose_key_descriptor(extra)
-        auto_built = Cache::Descriptor.new(plugins: [plugin_entry])
+        auto_built = Cache::Descriptor.new(plugins: [plugin_entry], configs: Cache::EngineSource.key_config_entries)
         return auto_built if extra.nil?
 
         Cache::Descriptor.compose(auto_built, extra)
@@ -976,7 +1208,7 @@ module Rigor
         Cache::Descriptor.new(
           files: boundary.files,
           configs: boundary.configs,
-          globs: watch_glob_entries(producer[:watch])
+          globs: (watch_glob_entries(producer[:watch]) + boundary.globs).uniq
         )
       end
 

data/lib/rigor/plugin/box_probe.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+
+module Rigor
+  module Plugin
+    # Decides, before `exe/rigor` re-execs itself under `RUBY_BOX=1`, whether the running Ruby can host
+    # Rigor inside `Ruby::Box` at all. A released Ruby up to and including 4.0.7 cannot: `env_copy()` drops
+    # the box a class/module-body proc carries when `Ractor.make_shareable` isolates it, so the first
+    # method call inside such a proc dereferences a NULL box and the VM segfaults (Ruby Bug #22260, fixed on
+    # CRuby master by `a4ad8e461a`). Rigor defines Ractor-shareable lambdas at module scope as a standing
+    # pattern, so on an affected Ruby the `ruby_box` strategy crashes the whole run rather than declining.
+    #
+    # The check is behavioural, not a version comparison: a child Ruby runs the bug's minimal reproducer
+    # under `RUBY_BOX=1` and must print the right answer. That admits a 4.1.0dev build with the fix and a
+    # future 4.0.x that backports it, and refuses a development build cut before the fix — none of which a
+    # `RUBY_VERSION` bound gets right. The probe costs one short-lived `ruby --disable-gems` process, paid
+    # only when a run opts into `ruby_box`.
+    #
+    # Loaded by `exe/rigor` before anything else, so this file requires nothing from Rigor.
+    module BoxProbe
+      # A class-body lambda isolated by `Ractor.make_shareable`, then a method dispatch inside it — the
+      # four ingredients the crash needs. Exits 2 when `Ruby::Box` is not active (a Ruby without the
+      # feature ignores `RUBY_BOX=1`), so a missing feature is told apart from a crash.
+      SCRIPT = <<~PROBE
+        exit 2 unless defined?(Ruby::Box) && Ruby::Box.respond_to?(:enabled?) && Ruby::Box.enabled?
+        module RigorBoxProbe
+          RATIONAL = Ractor.make_shareable(lambda { |*args| Rational(*args) })
+        end
+        print RigorBoxProbe::RATIONAL.call(3, 4).inspect
+      PROBE
+
+      EXPECTED_OUTPUT = "(3/4)"
+
+      # The reproducer answers in well under a second; a child still running after this is killed and
+      # counted as a failure, so a wedged probe cannot hang the launcher (or `rigor lsp` behind it).
+      DEADLINE_SECONDS = 10
+
+      module_function
+
+      # nil when `ruby` can run Rigor under `RUBY_BOX=1`; otherwise a short reason for the launcher's
+      # warning. Only a child killed by a signal is blamed on the bug; any other failure to answer is
+      # reported as the probe failing, never as a pass.
+      def unsupported_reason(ruby = RbConfig.ruby)
+        output, status = run(ruby)
+        return "the Ruby::Box probe could not run #{ruby}" if status.nil?
+        return nil if status.success? && output == EXPECTED_OUTPUT
+        return "Ruby::Box is not available in Ruby #{RUBY_VERSION}" if status.exitstatus == 2
+        return "the Ruby::Box probe failed (#{status})" unless status.signaled?
+
+        "Ruby #{RUBY_VERSION} crashes running Ractor-shareable procs inside Ruby::Box " \
+          "(Ruby Bug #22260; a Ruby carrying its fix is needed)"
+      end
+
+      # `RUBYOPT` is cleared so a `-r` of the caller's (bootsnap, a debugger, a coverage hook) cannot fail
+      # to load under `--disable-gems` and be mistaken for the crash; the probe needs nothing but core.
+      def run(ruby)
+        reader, writer = IO.pipe
+        pid = ::Process.spawn({ "RUBY_BOX" => "1", "RUBYOPT" => nil }, ruby, "--disable-gems", "-e", SCRIPT,
+                              in: File::NULL, out: writer, err: File::NULL)
+        writer.close
+        output = read_until_eof(reader)
+        return [output, ::Process.wait2(pid).last] if output
+
+        ::Process.kill(:KILL, pid)
+        ::Process.wait(pid)
+        [nil, nil]
+      rescue ::SystemCallError
+        [nil, nil]
+      ensure
+        writer&.close unless writer&.closed?
+        reader&.close
+      end
+
+      # The child's whole stdout, or nil when it has not closed it by the deadline.
+      def read_until_eof(reader)
+        deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + DEADLINE_SECONDS
+        output = +""
+        loop do
+          remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+          return nil unless remaining.positive? && reader.wait_readable(remaining)
+
+          chunk = reader.read_nonblock(4096, exception: false)
+          return output if chunk.nil?
+
+          output << chunk if chunk.is_a?(String)
+        end
+      end
+    end
+  end
+end