rigortype 0.3.9 → 0.4.0

data/lib/rigor/effects/ancestry_recorder.rb

@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../source/constant_path"
+require_relative "file_collection"
+
+module Rigor
+  module Effects
+    # The ancestry half of a file's {FileCollection}: what each class declares above itself, what it
+    # includes, and where the scan has to admit it could not read the ancestry at all.
+    #
+    # Split out of {Scanner} because the three questions are one subject with one invariant — a name goes
+    # in **as written**, and the propagator, which is the only place the whole project is in view, decides
+    # which constant it meant. The scanner owns unit identity and delegates this; the two tables are handed
+    # back by {#superclasses} / {#includes} and go into the collection unchanged.
+    class AncestryRecorder
+      attr_reader :superclasses, :includes
+
+      def initialize
+        @superclasses = {}
+        @includes = {}
+      end
+
+      # `class Loud < Base` inside `module Tracer` names `Base`, so the candidates go in and the propagator
+      # picks the one the merged project defines.
+      #
+      # A superclass expression that is **not** a constant path — `class K < Struct.new(:a)`,
+      # `< Data.define(:a)`, `< DelegateClass(X)`, `< Sequel::Model(:t)` — records
+      # {FileCollection::OPAQUE_ANCESTOR} rather than nothing (#1039). Recording nothing made it
+      # indistinguishable from a class with no `<` at all, which is the one reading the constructor rule
+      # turns into an answer; such a class inherits a constructor built at load time, which is the
+      # opposite of an absent one.
+      def record_superclass(full_name, node, prefix)
+        return if node.superclass.nil? || opaque?(full_name)
+
+        superclass = Source::ConstantPath.qualified_name(node.superclass)
+        @superclasses[full_name] =
+          superclass ? lexical_candidates(superclass, prefix) : [FileCollection::OPAQUE_ANCESTOR]
+      end
+
+      # A class BUILT AT LOAD TIME and assigned to a constant — `Anon = Class.new(Base)`,
+      # `Point = Struct.new(:x)`, `Rec = Data.define(:x)`, `Dele = DelegateClass(X)` — records the opaque
+      # sentinel (#1039). Without it a later `class Point; def more; end; end` reopening is the only thing
+      # the scan sees: the class becomes project-known, nothing says what is above it, and the constructor
+      # rule would read that silence as "no constructor anywhere" when the constructor is precisely what
+      # the load-time call built. It is the `class K < Struct.new(:a)` case in its other spelling.
+      #
+      # Only a **call**-valued assignment qualifies. A literal cannot be a class, and a constant-path value
+      # (`Alias = Real`) is a second name for a class whose own ancestry the scan already recorded.
+      #
+      # The sentinel is **sticky**: it overwrites a spelled `< Base` and no later one displaces it, here or
+      # in {FileCollection.merge_all}. A reopening's `class Anon < Base` is not more than this says but
+      # less — `Anon = Class.new(Base) { def initialize; … end }` puts a constructor in the block, which the
+      # scan files under the enclosing namespace and cannot attribute to `Anon` at all, and the spelled
+      # superclass says nothing about it. Sticky is also what makes the answer independent of which file a
+      # run reads first.
+      #
+      # `Class.new(Base)` additionally keeps `Base` beside the sentinel. The sentinel still declines
+      # `Anon.new` itself, and the parent link is what files `Anon` under `Base` in the subclass index, so
+      # a `self.class.new` in `Base` — which the closed-world join says may construct `Anon` — sees an
+      # unreadable constructor below it and declines too.
+      def record_constant_class(node, prefix)
+        value = node.value
+        return unless value.is_a?(Prism::CallNode)
+
+        name = constant_write_name(node, prefix)
+        return if name.nil?
+
+        @superclasses[name] = [FileCollection::OPAQUE_ANCESTOR, *load_time_parent(value, prefix)]
+      end
+
+      # A receiver-less `include` / `prepend` in `class_name`'s body, its constant arguments recorded as
+      # written.
+      #
+      # Both are calls on `self`, like `define_method`, and the include table is the instance ancestry that
+      # `super` and the constructor rule walk, so a call is recorded only where `self` is the class the body
+      # opened (see {#instance_side_self?}). Inside `class << self`, or a `class_eval` / `instance_eval`
+      # block on `singleton_class`, it mixes the module into the singleton class, which is what `extend`
+      # does, and the collection is as blind to it as it is to `extend`.
+      #
+      # @param context — the {DefinitionContext} of the class-body position the call sits at
+      def record_includes(class_name, node, prefix, context)
+        return unless instance_side_self?(context)
+
+        names = node.arguments&.arguments&.filter_map { |argument| Source::ConstantPath.qualified_name(argument) }
+        candidates = (names || []).flat_map { |name| lexical_candidates(name, prefix) }
+        (@includes[class_name] ||= []).concat(candidates) unless candidates.empty?
+      end
+
+      # `alias initialize setup` / `alias_method :initialize, :setup` makes the constructor another
+      # method's body, and the scan models no aliases at all (#1039). The opaque sentinel is the minimal
+      # honest answer: the ancestry stops being readable, the constructor rule declines, and this class's
+      # callers stay exactly as unclaimed as they were before that rule existed.
+      def record_initialize_alias(class_name)
+        (@includes[class_name] ||= []) << FileCollection::OPAQUE_ANCESTOR
+      end
+
+      # Whether this node aliases the instance-side `initialize`, in either spelling. A `CallNode` qualifies
+      # only as a receiver-less `alias_method` whose first symbol argument is the new name.
+      #
+      # `alias` works on the default definee and `alias_method` on `self`, so the two part in an
+      # `instance_eval` block, and inside `class << self` both alias the singleton class's `initialize`,
+      # a class method `new` never calls. Where the syntax does not say which class either one is, it
+      # records nothing here, as an include there does not (see {#instance_side_self?}).
+      #
+      # @param context — the {DefinitionContext} of the class-body position the node sits at
+      def alias_to_initialize?(node, context)
+        case node
+        when Prism::AliasMethodNode
+          context.definee_singleton == false && literal_name(node.new_name) == "initialize"
+        when Prism::CallNode
+          node.receiver.nil? && node.name == :alias_method && instance_side_self?(context) &&
+            literal_name(first_argument(node)) == "initialize"
+        else false
+        end
+      end
+
+      # An ancestry name is recorded AS WRITTEN — a single file cannot say which constant it resolves to.
+      # So the candidates Ruby's own lexical lookup would try go in, most-qualified first, and the
+      # propagator picks the one the merged project actually defines. Same shape as `ScopeIndexer`'s
+      # as-written superclass table, resolved at the same point: when the whole project is in view.
+      def lexical_candidates(name, prefix)
+        return [name] if prefix.empty? || name.start_with?("#{prefix.join('::')}::")
+
+        prefix.length.downto(1).map { |depth| "#{prefix.first(depth).join('::')}::#{name}" } + [name]
+      end
+
+      private
+
+      # Whether the syntax shows that a call on `self` written here works on the class the enclosing body
+      # opened, or on `Object` through `main` at the top level, so what it declares is that class's instance
+      # ancestry.
+      #
+      # It does not where `self` is the singleton class, nor where the syntax does not say what `self` is:
+      # the block of `Class.new` and its kin, an eval on another receiver, `class << obj`. The syntax does not
+      # name the class the module goes into there, and filing it under the enclosing class would put it
+      # where `super` and the constructor rule look for that class. The class Ruby does put it in misses it,
+      # as it would an `extend`, and so does `W` for a `W.class_eval { include M }` inside `class W`, which
+      # the context reads as an eval on any other receiver (#1322).
+      def instance_side_self?(context)
+        !context.self_singleton_class? && context.self_kind != :unknown
+      end
+
+      def opaque?(full_name)
+        @superclasses.fetch(full_name, []).include?(FileCollection::OPAQUE_ANCESTOR)
+      end
+
+      # The superclass a `Class.new(Base)` names, as candidates. Read from `Class.new` alone: it is the one
+      # load-time builder whose first argument IS the superclass, and inventing an ancestry edge from any
+      # other call's first constant argument would let an unrelated class's methods resolve through it.
+      def load_time_parent(value, prefix)
+        return [] unless value.name == :new && constant_receiver_name(value.receiver) == "Class"
+
+        argument = value.arguments&.arguments&.first
+        name = argument && Source::ConstantPath.qualified_name(argument)
+        name ? lexical_candidates(name, prefix) : []
+      end
+
+      def constant_receiver_name(receiver)
+        Source::ConstantPath.qualified_name(receiver) if receiver.is_a?(Prism::ConstantReadNode)
+      end
+
+      # `alias_method :initialize, :setup` and `alias_method "initialize", "setup"` are the same
+      # declaration; only an interpolated name is beyond the scan.
+      def literal_name(node)
+        node.unescaped if node.is_a?(Prism::SymbolNode) || node.is_a?(Prism::StringNode)
+      end
+
+      # The key a constant assignment declares, qualified by the nesting it is written in.
+      def constant_write_name(node, prefix)
+        case node
+        when Prism::ConstantWriteNode then [*prefix, node.name.to_s].join("::")
+        when Prism::ConstantPathWriteNode then qualified_write_name(node, prefix)
+        end
+      end
+
+      def qualified_write_name(node, prefix)
+        target = Source::ConstantPath.qualified_name(node.target)
+        return nil if target.nil?
+        return target if prefix.empty? || target.start_with?("#{prefix.join('::')}::")
+
+        [*prefix, target].join("::")
+      end
+
+      def first_argument(node)
+        node.arguments&.arguments&.first
+      end
+    end
+  end
+end

data/lib/rigor/effects/attribution.rb

@@ -26,8 +26,12 @@ module Rigor
       EMPTY_ROWS = {}.freeze
       private_constant :EMPTY_ROWS
 
-      def self.empty
-        @empty ||= new({})
+      # The run's empty table. Eagerly built on the main Ractor at load time (bottom of the class body)
+      # rather than memoised on first use: `@empty ||= new({})` is a class-ivar WRITE, which a non-main
+      # Ractor may not perform, and every project that configures no attribution reaches it — including
+      # from inside {Analysis::WorkerSession#initialize}, which is where a Ractor-pool worker runs (#1055).
+      class << self
+        attr_reader :empty
       end
 
       # @param table — `Configuration#effects_attribution` — method key to
@@ -69,6 +73,11 @@ module Rigor
           out[key.to_s] = set unless set.empty?
         end.freeze
       end
+
+      # Populates the `@empty` singleton on the main Ractor at load time. `Ractor.make_shareable` rather
+      # than `freeze` so a worker's READ of the class ivar is legal too: a non-main Ractor may read a
+      # class/module ivar only when the value is deeply shareable.
+      @empty = Ractor.make_shareable(new({}))
     end
   end
 end

data/lib/rigor/effects/callee_rule.rb

@@ -0,0 +1,368 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Effects
+    # Callee resolution for plugin attribution rows (#1048; ADR-103 WD10 / WD13; design note § 11.2).
+    #
+    # A framework method can be an **edge** as well as a label. `render :show` inside `UsersController`
+    # runs `app/views/users/show.html.erb`, synchronously and in-process, and since #393 that template is
+    # an effect unit keyed `view:users/show.html` sitting in the very same summaries table. Nothing
+    # produced the edge, because the only plugin-facing edge surface ({Plugin::EffectEdge}) names a
+    # receiver *class* and mints units on a class body, and {Plugin::EffectAttribution} carried labels but
+    # no callee.
+    #
+    # This module is the missing half, and it is deliberately shaped exactly like {Narrowing}: the plugin
+    # writes a **rule name** on its row (`callee: "rails_render"`) and the engine owns the strategy. A
+    # block would have to run inside the per-file effect scan — the one place ADR-103 WD13 forbids
+    # anything that resolves, walks or types — and would not survive the fork-pool / Ractor boundary. A
+    # name is a String: declarative, Marshal-clean, and reviewable in the plugin's manifest.
+    #
+    # ## What a rule may read
+    #
+    # **The call's own argument literals, the unit's owner class, and the unit's own key.** No dataflow,
+    # no typer question, no filesystem. A rule that needed to know whether `app/views/users/show.html.erb`
+    # exists would make a plugin row's meaning a function of the view tree, which the scan does not have
+    # and must not read; instead an unresolvable answer is `nil` and a resolvable-looking one that no unit
+    # answers is **dropped by the propagator**, which restores the row's taint from
+    # {FileCollection::Edge#taint_if_unresolved}. So "the template is not in the table" and "the argument
+    # was computed" both keep the `template-not-analysed` taint, and only a render that reached a real
+    # unit clears it.
+    #
+    # ## Two kinds of rule
+    #
+    # - a **site rule** ({SITE_RULES}) answers for one call node — `render :show`, `render partial: "card"`;
+    # - a **unit rule** ({UNIT_RULES}) answers for a whole unit and reads no node at all. Rails' *implicit*
+    #   render is the case that needs one: an action that falls off its end without rendering still renders
+    #   `<controller>/<action>`, and the fact that produces the edge is the **absence** of a call. Only the
+    #   unit scan can observe that, which is why the rule is applied there rather than in
+    #   {FrameworkUnits} — a class body cannot see which of its methods responded.
+    #
+    #   A unit rule contributes an **edge and nothing else**: no labels, no taint. That is what keeps it
+    #   FP-safe on the private helper a controller also defines — `def load_user` gets an edge to
+    #   `view:users/load_user.html`, no unit answers it, and the unit is exactly as it was.
+    module CalleeRule
+      # The callee an applied rule names, as the two halves {FileCollection::Edge} carries. The key the
+      # propagator reconstructs is `"#{receiver}.#{selector}"` — `view:users/show` + `html`.
+      #
+      # `fallbacks` is the ordered list of selectors the propagator retries when `selector` resolves to
+      # nothing (#1065), or nil for none. The rule only COPIES it off the plugin's table: whether
+      # `view:users/_row.js` exists is a question about the merged table, which the scan cannot ask.
+      Callee = Data.define(:receiver, :selector, :fallbacks) do
+        def initialize(fallbacks: nil, **) = super
+      end
+
+      # Must agree with {MethodKey::TEMPLATE_UNIT_PREFIX} and `Plugin::TemplateUnit::KEY_PREFIX`; pinned
+      # equal by spec.
+      TEMPLATE_PREFIX = "view:"
+
+      # The format a controller action renders absent a `formats:` override — Rails' own default, and the
+      # only one a `render :show` with no other evidence may be read as.
+      DEFAULT_FORMAT = "html"
+
+      # Rules that answer for one call node.
+      SITE_RULES = %w[rails_render rails_render_partial].freeze
+
+      # Rules that answer for a whole unit, from its owner and its own key. A UNIT rule may additionally
+      # be applied **per format arm** of a `respond_to` block (#1071): the arm is the unit's own body, and
+      # the arm's format is a literal the unit scan read, so it travels as data the same way the unit's key
+      # does.
+      UNIT_RULES = %w[rails_implicit_render].freeze
+
+      RULES = (SITE_RULES + UNIT_RULES).freeze
+
+      # `render json:` / `plain:` / `inline:` and friends render no template. They are listed so the rule
+      # can decline rather than read a `partial:` that is not there — declining keeps the row's taint,
+      # which is the conservative answer for a shape this rule does not model.
+      NON_TEMPLATE_OPTIONS = %w[json xml plain text html body js inline file nothing].freeze
+
+      # Template handlers, which a logical name never carries: `Plugin::TemplateUnit#logical_name` is
+      # `users/show.html`, not `users/show.html.erb`. An author may still write the handler out —
+      # `render template: "users/show.html.erb"` is legal Rails — so it is stripped rather than left to
+      # build a key no unit could ever answer.
+      HANDLERS = %w[erb haml slim jbuilder builder rabl ruby].freeze
+
+      module_function
+
+      def known?(name)
+        RULES.include?(name.to_s)
+      end
+
+      def site_rule?(name)
+        SITE_RULES.include?(name.to_s)
+      end
+
+      def unit_rule?(name)
+        UNIT_RULES.include?(name.to_s)
+      end
+
+      # Applies a site rule to one call node.
+      #
+      # @param name — the row's `callee:`
+      # @param node — the `Prism::CallNode` the row matched
+      # @param owner_class — the unit's owner (`"UsersController"`, `"ActionView::Base"`)
+      # @param unit_key — the unit's own key: a selector for a method, `view:users/show.html` for a
+      #   template unit
+      # @param fallbacks — the row's `callee_fallbacks:` table (#1065). Only a rule whose selector the
+      #   CONTEXT supplied consults it; see {rails_render_partial}.
+      # @return the {Callee} the rule named, or nil whenever it cannot settle the target from
+      #   literals alone
+      def site(name, node, owner_class:, unit_key: nil, fallbacks: nil)
+        case name.to_s
+        when "rails_render" then rails_render(node, owner_class)
+        when "rails_render_partial" then rails_render_partial(node, unit_key, fallbacks)
+        end
+      end
+
+      # Applies a unit rule. Reads no node; a `format:` from a `respond_to` arm (#1071) narrows the
+      # template the rule names from the default to that arm's own. Nil, or absent (`DEFAULT_FORMAT`).
+      #
+      # @return the {Callee} the rule named, or nil.
+      def unit(name, owner_class:, unit_key: nil, format: nil)
+        case name.to_s
+        when "rails_implicit_render" then rails_implicit_render(owner_class, unit_key, format: format)
+        end
+      end
+
+      # `render` inside a controller. The positional form names an **action template**
+      # (`render :show` → `users/show`), which is the one place a controller and a view disagree about
+      # what a bare string means.
+      #
+      # Never consults a format fallback (#1065). The format here is either one the author wrote, or
+      # Rails' `html` default standing in for a REQUEST format the rule cannot see — and the lookup order
+      # a controller-side render follows is derived from that request (`request.formats`, an `Accept`
+      # header), not from anything in the source.
+      def rails_render(node, owner_class)
+        directory = controller_directory(owner_class)
+        return nil if directory.nil?
+
+        format = format_for(node, DEFAULT_FORMAT)
+        return nil if format.nil?
+
+        name = template_name(node, directory) || partial_name(node, directory, layout: false)
+        name.nil? ? nil : template_callee(name, format)
+      end
+
+      # `render` inside a template. A bare positional argument is a **partial** here, and so is `layout:`
+      # — in a view `render layout: "shared/wrapper"` names `shared/_wrapper`, not an `app/views/layouts`
+      # file, because `RenderingHelper#render` rewrites `layout:` to `partial:` when a block is given.
+      # Since #1047 a layout compiles to a unit like any other template, so such an edge resolves where
+      # the named partial exists and keeps its taint where it does not.
+      #
+      # **The format fallback (#1065).** The format travels from the enclosing unit, and while a `.js.erb`
+      # template is rendering Rails' lookup context holds `[:js, :html]` — `LookupContext#formats=` appends
+      # `:html` to a lone `:js`, and `AbstractRenderer#prepend_formats` puts the template's own format in
+      # front of the request's. So `render partial: "watchers"` from `_set_watcher.js.erb` runs
+      # `_watchers.js.erb` where one exists and `_watchers.html.erb` otherwise. The rule copies the row's
+      # table for the inherited format onto the callee, and the propagator takes the first key that
+      # resolves.
+      #
+      # The table is consulted only for an INHERITED format. A `formats:` / `format:` keyword or a format
+      # spelled into the name is the author's word, and the fallback stands down: that is the direction
+      # that keeps a taint rather than guessing at a lookup the call overrode.
+      def rails_render_partial(node, unit_key, fallbacks)
+        directory, inherited = template_context(unit_key)
+        return nil if directory.nil?
+
+        format = format_for(node, inherited)
+        return nil if format.nil?
+
+        retry_formats = format_keyword?(node) ? nil : fallbacks&.fetch(format, nil)
+        explicit = keyword_name(node, "template")
+        return template_callee(qualify(explicit, directory), format, retry_formats) if explicit
+
+        name = partial_name(node, directory) || positional_partial(node, directory)
+        name.nil? ? nil : template_callee(name, format, retry_formats)
+      end
+
+      # Rails' implicit render: an action that never rendered still renders `<controller>/<action>`. A
+      # `respond_to` arm (#1071) is the same convention per format: `format.js` with no responding block
+      # renders `<controller>/<action>.js`, so the rule narrows the format it answers for, and an arm that
+      # IS answered outright is not applied at all (the unit scan decides that half and calls with the
+      # arm's format only for arms that still fall through).
+      def rails_implicit_render(owner_class, unit_key, format: nil)
+        directory = controller_directory(owner_class)
+        return nil if directory.nil? || unit_key.nil?
+
+        action = unit_key.to_s
+        return nil unless /\A[a-z_][A-Za-z0-9_]*[?!=]?\z/.match?(action)
+        return nil if action.end_with?("?", "!", "=")
+
+        template_callee("#{directory}/#{action}", format || DEFAULT_FORMAT)
+      end
+
+      # `UsersController` → `users`; `Admin::UsersController` → `admin/users`. A class whose name does not
+      # end in `Controller` is not one this rule can read a view directory off, and answers nil.
+      def controller_directory(owner_class)
+        return nil if owner_class.nil?
+
+        segments = owner_class.to_s.split("::")
+        last = segments.pop
+        return nil unless last&.end_with?("Controller") && last != "Controller"
+
+        segments.push(last.delete_suffix("Controller"))
+        segments.map { |segment| underscore(segment) }.join("/")
+      end
+
+      # `[directory, format]` for a template unit's own key — `view:users/show.html` → `["users", "html"]`.
+      # A partial rendered from a `.json` template is a `.json` partial, which is why the format travels.
+      def template_context(unit_key)
+        key = unit_key.to_s
+        return [nil, nil] unless key.start_with?(TEMPLATE_PREFIX)
+
+        logical = key.delete_prefix(TEMPLATE_PREFIX)
+        name, _, format = logical.rpartition(".")
+        return [nil, nil] if name.empty?
+
+        directory = name.include?("/") ? name[0...name.rindex("/")] : ""
+        [directory, format]
+      end
+
+      # The explicit template spellings: `template: "users/show"` and `action: :edit`.
+      def template_name(node, directory)
+        explicit = keyword_name(node, "template")
+        return qualify(explicit, directory) if explicit
+
+        action = keyword_name(node, "action")
+        return "#{directory}/#{action}" if action && !action.include?("/")
+        return action if action
+
+        positional_template(node, directory)
+      end
+
+      # `render :show` / `render "show"` / `render "admin/form"`, but only when no option keyword the rule
+      # does not model is present.
+      def positional_template(node, directory)
+        name = literal_name(positional(node).first)
+        return nil if name.nil?
+
+        qualify(name, directory)
+      end
+
+      # `render "card"` inside a template — the same literal, read as a partial.
+      def positional_partial(node, directory)
+        name = literal_name(positional(node).first)
+        name.nil? ? nil : partialize(qualify(name, directory))
+      end
+
+      # `partial: "card"` / `partial: "users/card"`, and the view-side `layout:`. `collection:` changes
+      # how many times the partial runs and not which one, so it is read and ignored on purpose: an
+      # effect summary is an upper bound over the body, not a count.
+      def partial_name(node, directory, layout: true)
+        name = keyword_name(node, "partial") || (layout ? keyword_name(node, "layout") : nil)
+        name.nil? ? nil : partialize(qualify(name, directory))
+      end
+
+      # The requested format, or nil to decline. Absent is `fallback`; a literal narrows; anything
+      # computed is genuinely unknown and must not be guessed at `html`.
+      def format_for(node, fallback)
+        return nil if non_template?(node)
+
+        value = keyword_argument(node, "formats") || keyword_argument(node, "format")
+        return fallback if value.nil?
+
+        literal = literal_name(value) || literal_name(array_head(value))
+        literal&.split(".")&.last
+      end
+
+      def format_keyword?(node)
+        !(keyword_argument(node, "formats") || keyword_argument(node, "format")).nil?
+      end
+
+      def non_template?(node)
+        NON_TEMPLATE_OPTIONS.any? { |option| keyword_argument(node, option) }
+      end
+
+      def array_head(node)
+        node.elements.first if node.is_a?(Prism::ArrayNode)
+      end
+
+      # `fallbacks` survives only when the name spelled no format of its own: `render "row.json"` from a
+      # `.js` template is the author naming `json`, and a `js` table has nothing to say about it.
+      def template_callee(name, format, fallbacks = nil)
+        spelled = split_suffixes(name, nil).last
+        name, format = split_suffixes(name, format)
+        return nil if name.nil? || name.empty? || format.nil? || format.empty?
+        return nil if name.include?(" ") || format.include?(" ") || format.include?(".")
+
+        fallbacks = nil unless spelled.nil? && fallbacks && !fallbacks.empty?
+        Callee.new(receiver: "#{TEMPLATE_PREFIX}#{name}", selector: format, fallbacks: fallbacks)
+      end
+
+      # Splits a written handler and format off the name's last segment, so `render "show.json"` names
+      # `view:users/show` + `json` and `render template: "users/show.html.erb"` names
+      # `view:users/show` + `html` rather than the impossible `view:users/show.html.erb.html`. A name
+      # that spells a format wins over the rule's default, because the author said so; a name that
+      # spells only a handler keeps the default.
+      def split_suffixes(name, format)
+        return [name, format] if name.nil?
+
+        directory, separator, base = name.rpartition("/")
+        segments = base.split(".")
+        return [name, format] if segments.length <= 1
+
+        stem = segments.shift
+        segments.reject! { |segment| HANDLERS.include?(segment) }
+        ["#{directory}#{separator}#{stem}", segments.first || format]
+      end
+
+      # `"card"` in `users` → `"users/_card"`; `"admin/card"` → `"admin/_card"`. A name already spelled
+      # with the underscore keeps it, because that is what Rails accepts too.
+      def partialize(name)
+        return nil if name.nil?
+
+        directory, separator, base = name.rpartition("/")
+        return base.start_with?("_") ? name : "_#{name}" if separator.empty?
+
+        base.start_with?("_") ? name : "#{directory}/_#{base}"
+      end
+
+      # A name with a `/` is rooted at the views directory; a bare one is relative to the rendering
+      # unit's own directory.
+      def qualify(name, directory)
+        return nil if name.nil? || name.empty?
+        return name if name.include?("/") || directory.nil? || directory.empty?
+
+        "#{directory}/#{name}"
+      end
+
+      def keyword_name(node, key)
+        literal_name(keyword_argument(node, key))
+      end
+
+      def literal_name(value)
+        case value
+        when Prism::SymbolNode, Prism::StringNode then value.unescaped
+        end
+      end
+
+      def positional(node)
+        node.arguments&.arguments&.grep_v(Prism::KeywordHashNode) || []
+      end
+
+      def keyword_argument(node, name)
+        hash = node.arguments&.arguments&.find { |argument| argument.is_a?(Prism::KeywordHashNode) }
+        pair = hash&.elements&.find do |element|
+          element.is_a?(Prism::AssocNode) && element.key.is_a?(Prism::SymbolNode) &&
+            element.key.unescaped == name
+        end
+        pair&.value
+      end
+
+      # `ActiveStorage` → `active_storage`. The engine's own reading of a constant segment; deliberately
+      # not an inflector call, because a rule may read nothing outside the strings it was given.
+      def underscore(segment)
+        segment.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2').gsub(/([a-z\d])([A-Z])/, '\1_\2').downcase
+      end
+
+      private_class_method :rails_render, :rails_render_partial, :rails_implicit_render,
+                           :controller_directory, :template_context, :template_name,
+                           :positional_template, :positional_partial, :partial_name,
+                           :format_for, :format_keyword?, :non_template?, :array_head, :template_callee,
+                           :split_suffixes, :partialize,
+                           :qualify, :keyword_name, :literal_name, :positional, :keyword_argument,
+                           :underscore
+    end
+  end
+end

data/lib/rigor/effects/catalog.rb

@@ -36,14 +36,17 @@ module Rigor
       class Error < StandardError
       end
 
-      DATA_PATH = File.expand_path("../../../data/effects/core.yml", __dir__)
+      DATA_PATH = File.expand_path("../../../data/effects/core.yml", __dir__).freeze
 
       # The mutator sets a value class may name, by reference. Adding a name here is the only way a
-      # class gets one — the data file may not spell a selector list of its own.
+      # class gets one — the data file may not spell a selector list of its own. Each is the set
+      # {MutationClassifier#mutating?} reads for that class, so a posture's answer and the classifier's
+      # cannot disagree: `hash` is the classifier's union of the widening's two Hash tables, because
+      # `compare_by_identity` mutates the receiver although the widening keeps it off `HASH_MUTATORS`.
       MUTATOR_SETS = {
         "array" => Inference::MutationWidening::ARRAY_MUTATORS,
-        "hash" => Inference::MutationWidening::HASH_MUTATORS,
-        "string" => MutationClassifier::STRING_MUTATORS
+        "hash" => MutationClassifier::HASH_MUTATORS,
+        "string" => Inference::StringMutation::MUTATORS
       }.freeze
 
       NO_MUTATORS = Set[].freeze

data/lib/rigor/effects/collector.rb

@@ -39,12 +39,16 @@ module Rigor
 
       # Per-file, per-thread accumulator. Not frozen and never shared: it lives for one `analyze_file`.
       class Accumulator
-        attr_reader :path, :calls, :attribution, :envelopes, :plugin_facts
+        attr_reader :path, :calls, :attribution, :envelopes, :plugin_facts, :unit_key, :unit_owner
         attr_accessor :root
 
         def initialize(path, attribution: Attribution.empty, envelopes: EnvelopeIndex.empty,
-                       plugin_facts: PluginFacts.empty)
+                       plugin_facts: PluginFacts.empty, unit_key: nil, unit_owner: nil)
           @path = path
+          # #392 — set for a template unit, where the whole file is ONE effect unit keyed
+          # `view:<logical_name>` under the plugin's declared `self`.
+          @unit_key = unit_key
+          @unit_owner = unit_owner
           @attribution = attribution
           @envelopes = envelopes
           @plugin_facts = plugin_facts
@@ -92,10 +96,11 @@ module Rigor
       # {EnvelopeIndex} of #386, carried the same way and for the same reason — the declared lane a call
       # site imports must not depend on which process typed the file.
       def collect_for(path, attribution: Attribution.empty, envelopes: EnvelopeIndex.empty,
-                      plugin_facts: PluginFacts.empty)
+                      plugin_facts: PluginFacts.empty, unit_key: nil, unit_owner: nil)
         previous = Thread.current[KEY]
         accumulator = Accumulator.new(path.to_s, attribution: attribution, envelopes: envelopes,
-                                                 plugin_facts: plugin_facts)
+                                                 plugin_facts: plugin_facts, unit_key: unit_key,
+                                                 unit_owner: unit_owner)
         Thread.current[KEY] = accumulator
         @mutex.synchronize { @active_count += 1 }
         yield
@@ -207,7 +212,8 @@ module Rigor
         Scanner.scan(
           root: accumulator.root, path: accumulator.path, calls: accumulator.calls,
           attribution: accumulator.attribution, envelopes: accumulator.envelopes,
-          plugin_facts: accumulator.plugin_facts
+          plugin_facts: accumulator.plugin_facts, unit_key: accumulator.unit_key,
+          unit_owner: accumulator.unit_owner
         )
       rescue StandardError
         FileCollection.new(path: accumulator.path, failed: true)