rigortype 0.3.8 → 0.4.0

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable/channel_discoverer.rb

@@ -43,7 +43,6 @@ module Rigor
           @base_classes = base_classes.to_set { |name| strip_root(name.to_s) }
         end
 
-        # @return [ChannelIndex]
         def discover
           entries = []
           ruby_files_under(@search_paths).each do |path|

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable/channel_index.rb

@@ -39,8 +39,6 @@ module Rigor
         # `"::ChatChannel"`; see {ChannelDiscoverer}), while a QUERY may legitimately arrive rooted:
         # `::ChatChannel.broadcast_to(...)` renders its receiver as `"::ChatChannel"`. The root marker is
         # dropped here, once, so no caller needs a `find(name) || find("::#{name}")` retry (#621).
-        #
-        # @return [Entry, nil]
         def find(class_name)
           @by_name[strip_leading_namespace(class_name.to_s)]
         end

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable/effects.rb

@@ -29,6 +29,7 @@ module Rigor
 
         # The `_later` twins enqueue an ActiveJob that broadcasts, so they carry the enqueue meaning too.
         TURBO_LATER_SELECTORS = TURBO_SELECTORS.map { |name| "#{name.delete_suffix('_to')}_later_to" }.freeze
+        Ractor.make_shareable(TURBO_LATER_SELECTORS)
 
         LATER = (BROADCASTING + ["rails.activejob.enqueue", "job.enqueue"]).freeze
 

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable.rb

@@ -65,6 +65,7 @@ module Rigor
     class Actioncable < Rigor::Plugin::Base
       manifest(
         id: "actioncable",
+        target_gems: ["actioncable"],
         # Bumped 2026-09-02 (#621) — channel keys and base-class names are de-rooted at the producer and a
         # reopened class's actions and streams are UNIONed rather than clobbered, so a cached 0.1.0 index
         # can be missing a whole channel (`< ::ApplicationCable::Channel`) or half its stream names.
@@ -122,12 +123,12 @@ module Rigor
         @protocol_contracts || manifest.protocol_contracts
       end
 
-      # File-level only: the load-error emission. Per-call broadcast validation runs over the
+      # File-level only: the load-error disclosure. Per-call broadcast validation runs over the
       # engine-owned walk via the node_rule below (ADR-37). The channel index is lazily loaded +
       # memoised by `producer_value`, shared by both surfaces.
       def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
         index = producer_value(:channel_index)
-        return [load_error_diagnostic(path)] if index.nil? && producer_error(:channel_index)
+        disclose_load_error if index.nil? && producer_error(:channel_index)
 
         []
       end
@@ -150,10 +151,14 @@ module Rigor
         "#{base}/**/*.rb"
       end
 
-      def load_error_diagnostic(path)
+      # Issue #1056 — "the channel index did not load" is a fact about the run's INPUTS, not about the file being
+      # analysed, so it is registered rather than returned: see {Plugin::Base#disclose_once} for the
+      # channel, the `(plugin id, key)` de-duplication and why the engine positions it at `.rigor.yml:1:1`.
+      # Returned from the per-file hook it carried no once-guard at all and repeated on every file.
+      def disclose_load_error
         error = producer_error(:channel_index)
-        Rigor::Analysis::Diagnostic.new(
-          path: path, line: 1, column: 1,
+        disclose_once(
+          :channel_index_load_failed,
           message: "rigor-actioncable: failed to discover channels: #{error.class}: #{error.message}",
           severity: :warning,
           rule: "load-error"

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/analyzer.rb

@@ -42,10 +42,6 @@ module Rigor
 
         # The mailer-call violations for a single call node (0..2), or `[]` when it is not a
         # `<Mailer>.action(...)` call on a known mailer. ADR-37: the engine owns the walk.
-        #
-        # @param call_node [Prism::Node]
-        # @param mailer_index [MailerIndex]
-        # @return [Array<Violation>]
         def violations_for(call_node:, mailer_index:)
           return [] unless call_node.is_a?(Prism::CallNode) && action_call_candidate?(call_node)
 

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/mailer_discoverer.rb

@@ -38,10 +38,9 @@ module Rigor
         VIEW_FORMATS = %w[html text].freeze
         VIEW_EXTENSIONS = %w[erb haml slim].freeze
 
-        # @param io_boundary [Rigor::Plugin::IoBoundary]
-        # @param search_paths [Array<String>] absolute or project-relative paths to scan for mailers.
-        # @param base_classes [Array<String>] direct superclasses that mark a class as a mailer.
-        # @param views_root [String] absolute or project-relative path to the views directory (typically
+        # @param search_paths — absolute or project-relative paths to scan for mailers.
+        # @param base_classes — direct superclasses that mark a class as a mailer.
+        # @param views_root — absolute or project-relative path to the views directory (typically
         #   `app/views`).
         def initialize(io_boundary:, search_paths:, base_classes:, views_root: DEFAULT_VIEWS_ROOT)
           @io_boundary = io_boundary
@@ -53,7 +52,6 @@ module Rigor
           @views_root = views_root
         end
 
-        # @return [MailerIndex]
         def discover
           # Two-pass: first collect every module's defs (for the include-following step), then build
           # per-class entries that pull in actions from include'd modules. GitLab's `Notify` mailer

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/mailer_index.rb

@@ -58,8 +58,6 @@ module Rigor
         # `"::UserMailer"`; see {MailerDiscoverer}), while a QUERY may legitimately arrive rooted:
         # `::UserMailer.welcome(u)` renders its receiver as `"::UserMailer"`. The root marker is dropped
         # here, once, so no caller needs a `find(name) || find("::#{name}")` retry (#621).
-        #
-        # @return [ClassEntry, nil]
         def find(class_name)
           @by_name[strip_leading_namespace(class_name.to_s)]
         end
@@ -68,9 +66,8 @@ module Rigor
           @by_name.key?(strip_leading_namespace(class_name.to_s))
         end
 
-        # @param file_path [String] absolute path of a mailer file (canonicalised — see plugin entry's
+        # @param file_path — absolute path of a mailer file (canonicalised — see plugin entry's
         #   `harvest`)
-        # @return [ClassEntry, nil]
         def find_by_file(file_path)
           @entries.find { |entry| entry.file_path == file_path }
         end

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer.rb

@@ -43,6 +43,7 @@ module Rigor
     class Actionmailer < Rigor::Plugin::Base
       manifest(
         id: "actionmailer",
+        target_gems: ["actionmailer"],
         # Bumped 2026-05-28 — extended RESERVED_CLASS_METHODS to include `respond_to?` / `public_send` /
         # `send` / `__send__` / `method` and friends so dynamic-dispatch idioms
         # (`Mailer.respond_to?(action)` / `Mailer.public_send(action)`) stop firing `unknown-action`
@@ -92,7 +93,10 @@ module Rigor
       # loaded + memoised, shared.
       def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
         index = producer_value(:mailer_index)
-        return [load_error_diagnostic(path)] if index.nil? && producer_error(:mailer_index)
+        if index.nil? && producer_error(:mailer_index)
+          disclose_load_error
+          return []
+        end
         return [] if index.nil? || index.empty?
 
         missing_view_diagnostics(path, index)
@@ -135,10 +139,16 @@ module Rigor
         File.expand_path(path)
       end
 
-      def load_error_diagnostic(path)
+      # Issue #1056 — "the mailer index did not load" is a fact about the run's INPUTS, not about the file being
+      # analysed, so it is registered rather than returned: see {Plugin::Base#disclose_once} for the
+      # channel, the `(plugin id, key)` de-duplication and why the engine positions it at `.rigor.yml:1:1`.
+      # Returned from the per-file hook it carried no once-guard at all and repeated on every file.
+      # The missing-view rows this hook still returns are NOT disclosures: they name the mailer's own
+      # source file.
+      def disclose_load_error
         error = producer_error(:mailer_index)
-        Rigor::Analysis::Diagnostic.new(
-          path: path, line: 1, column: 1,
+        disclose_once(
+          :mailer_index_load_failed,
           message: "rigor-actionmailer: failed to discover mailers: #{error.class}: #{error.message}",
           severity: :warning,
           rule: "load-error"

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/analyzer.rb

@@ -81,10 +81,8 @@ module Rigor
         # duplicates on Mastodon and ~119 on Redmine, exactly stacked with the rails-routes diagnostics.
         # Returns `[]` for unknown / arity-mismatch shapes.
         #
-        # @param call_node [Prism::Node]
-        # @param helper_table [Hash{String => Hash}] each entry carries `name`, `arity`,
+        # @param helper_table — each entry carries `name`, `arity`,
         #   `acceptable_arities`, `path`, `http_method`, `action`.
-        # @return [Array<Violation>]
         def helper_violations_for(call_node:, helper_table:)
           return [] unless implicit_helper_call?(call_node)
 
@@ -108,10 +106,7 @@ module Rigor
         # each filter name reference is validated against it. Calls outside a known controller
         # contribute nothing.
         #
-        # @param call_node [Prism::Node]
-        # @param ancestors [Array<Prism::Node>] the lexical ancestor chain
-        # @param controller_index [ControllerIndex]
-        # @return [Array<Violation>]
+        # @param ancestors — the lexical ancestor chain
         def filter_violations_for(call_node:, ancestors:, controller_index:)
           return [] unless filter_call?(call_node)
 
@@ -144,10 +139,6 @@ module Rigor
         # AR model's column list (looked up via the model_index fact published by `rigor-activerecord`).
         # Calls whose `:require` argument is a non-literal Symbol are passed through; namespaced models
         # (`params.require(:admin_user)` → `Admin::User`) are deferred.
-        #
-        # @param call_node [Prism::Node]
-        # @param model_index [Hash{String => Hash}]
-        # @return [Array<Violation>]
         def permit_violations_for(call_node:, model_index:)
           return [] unless permit_chain?(call_node)
 
@@ -179,13 +170,12 @@ module Rigor
         # method that doesn't call `render`) is also skipped — Phase 3 validates explicit renders only,
         # since the implicit path would false-positive on `redirect_to` / `head` / early returns.
         #
-        # @param call_node [Prism::Node]
-        # @param ancestors [Array<Prism::Node>] the lexical ancestor chain
-        # @param path [String] file being analysed
-        # @param view_search_roots [Array<String>]
-        # @param controller_index [ControllerIndex, nil]
-        # @return [Array<Violation>]
-        def render_violations_for(call_node:, ancestors:, path:, view_search_roots:, controller_index: nil)
+        # @param ancestors — the lexical ancestor chain
+        # @param io_boundary — the plugin's {Rigor::Plugin::IoBoundary}; #629 — every filesystem
+        #   question this phase asks goes through it, so "no such template" is a recorded dependency and
+        #   the run-result cache invalidates once the template appears
+        def render_violations_for(call_node:, ancestors:, path:, view_search_roots:, io_boundary:,
+                                  controller_index: nil)
           return [] unless render_call?(call_node)
 
           class_name = enclosing_controller_name(ancestors)
@@ -217,12 +207,12 @@ module Rigor
           # `app/views/admin/settings/` holds about/, appearance/, … but no top-level templates). Skip
           # render checks for these — the diagnostic would be a false positive against intentional Rails
           # abstract-base layouts.
-          return [] if abstract_base_controller?(class_name, controller_path, view_search_roots)
+          return [] if abstract_base_controller?(class_name, controller_path, view_search_roots, io_boundary)
 
           target = render_target_for(call_node, controller_path)
           return [] if target.nil?
 
-          violation = render_violation(call_node, target, view_search_roots)
+          violation = render_violation(call_node, target, view_search_roots, io_boundary)
           violation ? [violation] : []
         end
 
@@ -406,15 +396,16 @@ module Rigor
         #       controllers.
         # Deliberately NOT triggered by "no view directory at all" because that fires the diagnostic we
         # DO want for genuinely-missing views (the typo / forgot-to-create case).
-        def abstract_base_controller?(class_name, controller_path, view_search_roots)
+        def abstract_base_controller?(class_name, controller_path, view_search_roots, io_boundary)
           return true if class_name.end_with?("BaseController")
 
           view_search_roots.any? do |root|
             dir = File.join(root, controller_path)
-            next false unless File.directory?(dir)
-
-            entries = Dir.children(dir)
-            entries.any? && entries.all? { |e| File.directory?(File.join(dir, e)) }
+            # #629 — the listing row this records is the same one {#locate_template} needs, and the
+            # boundary deduplicates it per directory, so the whole render phase costs one glob
+            # validation per consulted view directory on a warm run.
+            entries = io_boundary.list_directory(dir)
+            entries.any? && entries.all? { |e| File.directory?(e) }
           end
         end
 
@@ -473,9 +464,9 @@ module Rigor
           Rigor::Plugin::Inflector.underscore(stripped)
         end
 
-        def render_violation(call_node, target, view_search_roots)
+        def render_violation(call_node, target, view_search_roots, io_boundary)
           kind, relative = target
-          existing = locate_template(relative, view_search_roots)
+          existing = locate_template(relative, view_search_roots, io_boundary)
           if existing
             render_target_violation(call_node, kind, relative, existing)
           else
@@ -483,11 +474,22 @@ module Rigor
           end
         end
 
-        def locate_template(relative, view_search_roots)
+        # #629 — resolved from the DIRECTORY LISTING, not from a probe per candidate path. The old shape
+        # asked `File.file?` up to `extensions × roots` times per `render` call and recorded nothing, so a
+        # cached run kept reporting `plugin.actionpack.missing-template` after the template was written.
+        # One {Rigor::Plugin::IoBoundary#list_directory} row per `app/views/<controller>` directory carries
+        # the dependency instead: any file added or removed there invalidates the run, and the warm-run
+        # validation count is the number of view directories the run consulted rather than the number of
+        # candidate paths it tried.
+        def locate_template(relative, view_search_roots, io_boundary)
+          basename = File.basename(relative)
           view_search_roots.each do |root|
+            # Names, not paths: the boundary answers in absolute paths while `root` may be the relative
+            # `app/views` the user configured, and the reported candidate keeps the configured spelling.
+            listing = io_boundary.list_directory(File.join(root, File.dirname(relative)))
+            names = listing.map { |entry| File.basename(entry) }
             RENDER_TEMPLATE_EXTENSIONS.each do |ext|
-              candidate = File.join(root, "#{relative}#{ext}")
-              return candidate if File.file?(candidate)
+              return File.join(root, "#{relative}#{ext}") if names.include?("#{basename}#{ext}")
             end
           end
           nil

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_discoverer.rb

@@ -42,7 +42,6 @@ module Rigor
           @search_paths = search_paths
         end
 
-        # @return [ControllerIndex]
         def discover
           entries = {}
           ruby_files_under(@search_paths).each do |path|

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_index.rb

@@ -42,8 +42,6 @@ module Rigor
         # `"Admin::AccountsController"` — never `"::AccountsController"`; see {ControllerDiscoverer}),
         # while a QUERY may legitimately arrive rooted. The root marker is dropped at every lookup entry
         # point, once, so no caller needs a `find(name) || find("::#{name}")` retry (#621).
-        #
-        # @return [Entry, nil]
         def find(class_name)
           @entries[strip_leading_namespace(class_name)]
         end
@@ -84,7 +82,7 @@ module Rigor
           methods.uniq.freeze
         end
 
-        # @return [Boolean] true when the class has at least one include OR parent class we couldn't
+        # @return true when the class has at least one include OR parent class we couldn't
         #   resolve in the index (typically a gem-shipped concern such as Devise's
         #   `Devise::Controllers::Helpers`, or a gem-shipped parent controller such as
         #   `Devise::ConfirmationsController` or `Doorkeeper::AuthorizedApplicationsController`). Phase

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_scan.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require "rigor/source/node_children"
+
+require "prism"
+
+module Rigor
+  module Plugin
+    class Actionpack < Rigor::Plugin::Base
+      # The syntactic controller walk two parent-side indexes share: {ViewAssigns}, which reads what a
+      # controller action ASSIGNED, and {RenderLocals} (#1047), which reads what a render site PASSED.
+      #
+      # Both run on the parent before any analysis — `#template_units_for_file` is called before the
+      # engine has indexed anything — so neither may ask the typer a question, and both need the same four
+      # answers off a Prism tree: which class declarations in this file are controllers, what their
+      # qualified names are, which view directory each one owns, and which `def`s sit directly in the body.
+      # Keeping one copy is what stops the two indexes from disagreeing about, say, whether
+      # `module Admin; class UsersController` is `admin/users` — a disagreement that would be silent, since
+      # each side would simply find nothing.
+      #
+      # It deliberately stops at the shapes {ControllerDiscoverer} already recognises. Anything a
+      # controller does at runtime — `define_method`, a concern that adds actions on include — is not read
+      # here and is not read there either.
+      module ControllerScan
+        module_function
+
+        # Yields `[class_node, enclosing_namespace_segments]` for every `ClassNode` in the tree, with the
+        # enclosing `module` chain accumulated. Mirrors {ControllerDiscoverer#walk_declarations}'s
+        # qualification reduced to the two shapes that can carry an action: `class Admin::UsersController`
+        # and `module Admin; class UsersController`.
+        def each_controller(node, namespace, &)
+          return unless node.is_a?(Prism::Node)
+
+          if node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode)
+            yield node, namespace if node.is_a?(Prism::ClassNode)
+            inner = namespace + constant_segments(node.constant_path)
+            each_controller(node.body, inner, &) if node.body
+            return
+          end
+
+          node.rigor_each_child { |child| each_controller(child, namespace, &) }
+        end
+
+        def constant_segments(path)
+          case path
+          when Prism::ConstantReadNode then [path.name.to_s]
+          when Prism::ConstantPathNode then constant_segments(path.parent) + [path.name.to_s]
+          else []
+          end
+        end
+
+        # `["Admin", "UsersController"]` → `"admin/users"`. `ApplicationController` and the other abstract
+        # bases are not excluded: an action they define really is inherited, and a template under their own
+        # path simply never exists. nil for a class whose name is not a controller's.
+        def controller_path(segments)
+          return nil unless segments.last&.end_with?("Controller")
+
+          parts = segments.map { |segment| underscore(segment) }
+          parts[-1] = parts[-1].sub(/_controller\z/, "")
+          return nil if parts[-1].empty?
+
+          parts.join("/")
+        end
+
+        # The ASCII-only inflection this needs: a controller constant is a CamelCase identifier, and
+        # nothing here has to invert an irregular plural (`ActiveSupport::Inflector` is the analysed
+        # project's, not Rigor's).
+        def underscore(segment)
+          segment.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+                 .gsub(/([a-z\d])([A-Z])/, '\1_\2')
+                 .downcase
+        end
+
+        # `{ :show => body_node }` for every `def` directly in the class body.
+        def method_bodies(node)
+          body = node.body
+          return {} if body.nil?
+
+          body.child_nodes.compact.filter_map do |child|
+            next nil unless child.is_a?(Prism::DefNode) && child.receiver.nil?
+
+            [child.name, child.body]
+          end.to_h
+        end
+
+        # Every implicit-self `render` call node under `node`, at any depth.
+        def each_render(node, &)
+          return unless node.is_a?(Prism::Node)
+
+          yield node if node.is_a?(Prism::CallNode) && node.receiver.nil? && node.name == :render
+          node.rigor_each_child { |child| each_render(child, &) }
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/effects.rb

@@ -31,6 +31,11 @@ module Rigor
       module Effects
         CONTROLLER = "ActionController::Base"
 
+        # The view context a template unit's body runs under — the `self_type:` the plugin declares on
+        # every {Rigor::Plugin::TemplateUnit}. A `render` inside a template is an implicit-self call on
+        # it, which is what lets one row colour the template → partial edge (#1048).
+        VIEW = "ActionView::Base"
+
         RESPONSE = ["mutate.self", "rails.response.write"].freeze
         SESSION_WRITE = ["mutate", "rails.session.write"].freeze
         SESSION_READ = ["io", "rails.session.read"].freeze
@@ -46,6 +51,26 @@ module Rigor
         # the one genuinely misleading row in the whole Rails layer.
         RENDERERS = %w[render render_to_string render_to_body].freeze
 
+        # Rails' own name for the implicit render — what `ActionController::Base` calls when an action
+        # returns without having answered. The project never writes it, which is exactly the point: the
+        # row exists so the engine's unit-level {Rigor::Effects::CalleeRule} has a declaration to read,
+        # and it carries no labels because an action that implicitly renders has already been coloured by
+        # nothing at all and must not be coloured by a guess (see `why:`).
+        IMPLICIT_RENDER = "default_render"
+
+        # Action View's own format lookup order for a template-side render, as DATA the engine's
+        # `rails_render_partial` rule copies onto the edge (#1065). While a `.js.erb` template renders, the
+        # lookup context holds `[:js, :html]` — `LookupContext#formats=` appends `:html` to a lone `:js` —
+        # so `render "watchers"` runs `_watchers.js.erb` where it exists and `_watchers.html.erb`
+        # otherwise. The propagator takes the first key a unit answers.
+        #
+        # `js` is the only entry, because it is the only fallback Action View itself hard-codes. What a
+        # `.json`, `.xml` or `.turbo_stream` template falls back to is whatever the REQUEST's formats
+        # happened to be (`prepend_formats` puts the template's format in front of them) — an `Accept`
+        # header the source never states, Turbo's included — so those keep their taint rather than guess.
+        FORMAT_FALLBACKS = { "js" => ["html"] }.freeze
+        Ractor.make_shareable(FORMAT_FALLBACKS)
+
         # The cookie jars a Rails app writes through.
         COOKIE_JARS = ["self.cookies", "self.cookies.signed", "self.cookies.encrypted",
                        "self.cookies.permanent"].freeze
@@ -59,35 +84,67 @@ module Rigor
         def response_rows
           RESPONSE_WRITERS.map do |selector|
             EffectAttribution.new(
-              receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true,
+              receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true, responds: true,
               why: "sets the response on the controller instance — Rack writes the socket later, outside " \
                    "any project method, so this is `mutate.self` and deliberately not `io`"
             )
-          end + render_rows
+          end + render_rows + [implicit_render_row]
         end
 
+        # `render` and its two `*_to_string` twins. Each carries a `callee:` so the render site edges to
+        # the template's own effect unit (#1048), and each keeps the `template-not-analysed` taint — which
+        # now rides the edge: a render whose template produced a unit discharges it, and one whose
+        # template the plugin declined (a layout, #1047) or whose target is computed keeps it.
+        #
+        # Only `render` sets `responds:`. `render_to_string` builds a string and leaves the response
+        # unanswered, so an action that calls it and returns still takes Rails' implicit render.
         def render_rows
           RENDERERS.map do |selector|
             EffectAttribution.new(
               receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true,
-              taint: "template-not-analysed",
+              taint: "template-not-analysed", callee: "rails_render", responds: selector == "render",
               why: "sets the response body from a template. The controller half is fully stated; the " \
-                   "template's own effects are unknown until views become effect units, and the taint " \
-                   "is how the summary says so rather than reading exhaustive"
+                   "template's own effects reach it through the `rails_render` callee edge, and the " \
+                   "taint survives on the edge for a target the rule cannot resolve"
             )
-          end
+          end + [
+            EffectAttribution.new(
+              receiver: VIEW, method: :render, labels: [], discharge: true,
+              taint: "template-not-analysed", callee: "rails_render_partial",
+              callee_fallbacks: FORMAT_FALLBACKS,
+              why: "a `render` inside a template runs another template. The edge is the whole " \
+                   "contribution — what a partial render DOES is what the partial does, and the row " \
+                   "reaches it now — while a target the rule cannot resolve keeps the taint. In a view " \
+                   "a bare argument names a PARTIAL and `layout:` names one too, which is why this is a " \
+                   "separate rule from the controller's"
+            )
+          ]
+        end
+
+        # The implicit render, as an EDGE and nothing else. An action that never answered still renders
+        # `<controller>/<action>`, so its summary must include that template's effects — but the fact is
+        # the absence of a call, so there is no site to colour, and inventing a `rails.response.write`
+        # here would put it on every private helper a controller defines as well.
+        def implicit_render_row
+          EffectAttribution.new(
+            receiver: CONTROLLER, method: IMPLICIT_RENDER, labels: [], discharge: true,
+            callee: "rails_implicit_render",
+            why: "Rails renders `<controller>/<action>` for an action that answered nothing. The edge " \
+                 "is the whole contribution: no label, because an implicit render is observed from a " \
+                 "body that made no call, and a label read off an absence would colour every helper"
+          )
         end
 
         # `send_file` streams from disk; `send_data` does not.
         def file_rows
           [
             EffectAttribution.new(
-              receiver: CONTROLLER, method: :send_data, labels: RESPONSE, discharge: true,
+              receiver: CONTROLLER, method: :send_data, labels: RESPONSE, discharge: true, responds: true,
               why: "sets the response body from an in-memory string"
             ),
             EffectAttribution.new(
               receiver: CONTROLLER, method: :send_file, labels: RESPONSE + ["io.fs.read"], discharge: true,
-              why: "sets the response AND reads the named file off disk"
+              responds: true, why: "sets the response AND reads the named file off disk"
             )
           ]
         end