rigortype 0.3.9 → 0.4.0

data/lib/rigor/effects/config_envelopes.rb

@@ -113,6 +113,13 @@ module Rigor
         )
       end
 
+      # Whether one entry selects a class — by its fully-qualified name for a `namespace:` entry, by any
+      # file that defines it for a `match:` one.
+      #
+      # Public since #391: `rigor sig-gen`'s emission asks the same question this module's own
+      # {.for_classes} asks, and asks it with a defining file it already has. It was private while
+      # {.for_classes} was the only caller; a second caller with the same inputs is not a reason to
+      # reimplement the predicate.
       def selects?(entry, class_name, paths)
         return namespace_match?(entry.namespace, class_name) if entry.namespace
 
@@ -164,7 +171,7 @@ module Rigor
       def files_by_class(sources, project_root)
         root = "#{File.absolute_path(project_root.to_s).chomp('/')}/"
         sources.each_with_object({}) do |(key, paths), out|
-          owner = MethodKey.owner(key)
+          owner = MethodKey.envelope_owner(key)
           next if owner.nil?
 
           bucket = (out[owner] ||= [])
@@ -177,7 +184,7 @@ module Rigor
         absolute.start_with?(root) ? absolute[root.length..] : path.to_s
       end
 
-      private_class_method :selects?, :match_segments?, :match_deep?, :files_by_class, :relativize
+      private_class_method :match_segments?, :match_deep?, :files_by_class, :relativize
     end
   end
 end

data/lib/rigor/effects/definition_context.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Effects
+    # Which side of its class a definition written at some point lands on, and what `self` its body runs
+    # on, or that the syntax does not say. The scanner keys a unit `Class.m` or `Class#m` from the first, and
+    # scans the body with the second (the singleton bit {MutationClassifier} and
+    # {LocalOwnership.constructor?} read).
+    #
+    # Ruby answers the two from different places, which is why one bit carried down the walk got both
+    # wrong in turn:
+    #
+    # - a receiver-less `def` lands on the **default definee**: the class the lexically enclosing body
+    #   opened, which is the singleton class inside `class << self`. A method body does not move it, so
+    #   `def inner` inside `def self.outer` defines `Foo#inner`, while inside a `def` in `class << self` it
+    #   defines `Foo.inner`.
+    # - `define_method` and the `attr_*` macros are calls on **`self`**, so they define instance methods of
+    #   the module `self` is: `Foo#x` inside `def self.setup`, where `self` is `Foo`, and `Foo.x` inside
+    #   `class << self`, where it is `Foo`'s singleton class.
+    #
+    # Only the spellings that name the new `self` move either answer: `class << self`, and a block given to
+    # `class_eval` / `instance_eval` (or an `_exec` / `module_` alias) on `self` or on `singleton_class`.
+    # Where the syntax cannot say, the answer is **unknown** and a definition there is no unit. That covers
+    # the block of `Class.new` and its kin, an eval on any other receiver, `class << obj`, and a method
+    # defined on one object or on a singleton class's own singleton class. Filed under the enclosing class,
+    # such a definition would join that class's real method of the same name, and a `Class.new(self)`
+    # override shares its name by design.
+    #
+    # `self_kind` is `:instance`, `:class` (the class the enclosing namespace opened), `:singleton_class`
+    # (that class's singleton class) or `:unknown`, and `definee_singleton` is true, false, or nil when
+    # unknown. Every context is allocated once.
+    class DefinitionContext < Data.define(:self_kind, :definee_singleton)
+      CLASS_EVAL_CALLS = %i[class_eval class_exec module_eval module_exec].to_set.freeze
+      INSTANCE_EVAL_CALLS = %i[instance_eval instance_exec].to_set.freeze
+      # The builders whose block defines into a class or module the call itself creates.
+      ANONYMOUS_BUILDERS = { Class: :new, Module: :new, Struct: :new, Data: :define }.freeze
+      # The `self_kind`s that are a class object.
+      CLASS_SELVES = %i[class singleton_class].to_set.freeze
+      private_constant :CLASS_EVAL_CALLS, :INSTANCE_EVAL_CALLS, :ANONYMOUS_BUILDERS, :CLASS_SELVES
+
+      CONTEXTS = %i[instance class singleton_class unknown].to_h do |self_kind|
+        [self_kind, [false, true, nil].to_h do |definee|
+          [definee, new(self_kind: self_kind, definee_singleton: definee)]
+        end.freeze]
+      end.freeze
+      private_constant :CONTEXTS
+
+      def self.of(self_kind, definee_singleton)
+        CONTEXTS.fetch(self_kind).fetch(definee_singleton)
+      end
+
+      # Whether a child of `node` may run under another context than `node` does: a call's block, or a
+      # `class <<` body. Only these need {#for_child}, and asking once per node rather than once per child
+      # keeps the walks from paying a call for every element of a large literal.
+      def self.rebinds?(node)
+        node.is_a?(Prism::SingletonClassNode) || (node.is_a?(Prism::CallNode) && node.block.is_a?(Prism::BlockNode))
+      end
+
+      # A class body.
+      CLASS_BODY = of(:class, false)
+      # A `class << self` body: `self` and the definee are both the singleton class.
+      SINGLETON_CLASS_BODY = of(:singleton_class, true)
+      # The body of an instance method of the class.
+      INSTANCE_METHOD_BODY = of(:instance, false)
+      # The top level, where `self` is `main`, an instance of `Object`, and a `def` defines `Object#m`.
+      TOP_LEVEL = INSTANCE_METHOD_BODY
+      # Where the syntax says neither what `self` is nor where a `def` lands. Every block inside stays here.
+      UNKNOWN = of(:unknown, nil)
+
+      # Whether `self` is a class object here — the singleton bit a unit's body is scanned with.
+      def singleton?
+        CLASS_SELVES.include?(self_kind)
+      end
+
+      # Whether `self` is the singleton class here, so a call on it (`define_method`, an `attr_*` macro,
+      # `include`, `prepend`, `alias_method`) works on the singleton class rather than the class.
+      def self_singleton_class?
+        self_kind == :singleton_class
+      end
+
+      # The context the body of `def` node `node` runs under, or nil where no key names the method. The
+      # unit is keyed singleton exactly when that context is {#singleton?}. The body keeps this default
+      # definee: a `def` nested in it lands where one written beside it would.
+      #
+      # `def self.x` defines a singleton method only where `self` is the class. In an instance method it
+      # defines a method on one object, and in `class << self` one on the singleton class's own singleton
+      # class. `def Const.x` keeps the reading it has always had, a method of the class the unit is keyed
+      # under; any other receiver is an object no key names.
+      def def_body(node)
+        case node.receiver
+        when nil
+          DefinitionContext.of(definee_singleton ? :class : :instance, definee_singleton) unless definee_singleton.nil?
+        when Prism::SelfNode
+          self if self_kind == :class
+        when Prism::ConstantReadNode, Prism::ConstantPathNode
+          DefinitionContext.of(:class, definee_singleton) unless self_kind == :unknown
+        end
+      end
+
+      # The context the block of a literal-name `define_method` written here runs under, or nil where no key
+      # names the method; an `attr_*` macro here defines on the same side. Both are calls on `self`, which
+      # only a class and its singleton class answer, and the block keeps the definee it closed over.
+      def module_call_body
+        case self_kind
+        when :class then DefinitionContext.of(:instance, definee_singleton)
+        when :singleton_class then DefinitionContext.of(:class, definee_singleton)
+        end
+      end
+
+      # The context `child` runs under as a child of `node`, a node {.rebinds?} accepts. A call's block and a
+      # `class <<` body may rebind `self`; every other child keeps this context. (A block is a call's only
+      # `BlockNode` child.)
+      def for_child(node, child)
+        case node
+        when Prism::CallNode then child.is_a?(Prism::BlockNode) ? block(node) : self
+        when Prism::SingletonClassNode then child.equal?(node.body) ? singleton_class_body(node.expression) : self
+        else self
+        end
+      end
+
+      private
+
+      # `class << self` on the class opens its singleton class; any other `class << …` opens one no key names.
+      def singleton_class_body(expression)
+        self_kind == :class && expression.is_a?(Prism::SelfNode) ? SINGLETON_CLASS_BODY : UNKNOWN
+      end
+
+      def block(call)
+        name = call.name
+        if CLASS_EVAL_CALLS.include?(name) then class_eval_block(call.receiver)
+        elsif INSTANCE_EVAL_CALLS.include?(name) then instance_eval_block(call.receiver)
+        elsif anonymous_builder?(call) then UNKNOWN
+        else self
+        end
+      end
+
+      # `class_eval` makes its receiver both `self` and the definee.
+      def class_eval_block(receiver)
+        if self_receiver?(receiver) && singleton? then DefinitionContext.of(self_kind, self_kind == :singleton_class)
+        elsif singleton_class_receiver?(receiver) then SINGLETON_CLASS_BODY
+        else UNKNOWN
+        end
+      end
+
+      # `instance_eval` makes its receiver `self` and the receiver's singleton class the definee. On the
+      # class that is the singleton class. On the singleton class it is that class's own singleton class,
+      # which no key names, so a `define_method` there is keyed and a `def` is not.
+      def instance_eval_block(receiver)
+        if self_receiver?(receiver) && self_kind == :class then DefinitionContext.of(:class, true)
+        elsif (self_receiver?(receiver) && self_kind == :singleton_class) || singleton_class_receiver?(receiver)
+          DefinitionContext.of(:singleton_class, nil)
+        else UNKNOWN
+        end
+      end
+
+      def self_receiver?(receiver)
+        receiver.nil? || receiver.is_a?(Prism::SelfNode)
+      end
+
+      # `singleton_class` called on the class.
+      def singleton_class_receiver?(receiver)
+        self_kind == :class && receiver.is_a?(Prism::CallNode) && receiver.name == :singleton_class &&
+          self_receiver?(receiver.receiver) && receiver.arguments.nil? && receiver.block.nil?
+      end
+
+      # `Class.new { … }` and its kin, spelled on the core constant.
+      def anonymous_builder?(call)
+        receiver = call.receiver
+        name = case receiver
+               when Prism::ConstantReadNode then receiver.name
+               when Prism::ConstantPathNode then receiver.name if receiver.parent.nil?
+               end
+        !name.nil? && ANONYMOUS_BUILDERS[name] == call.name
+      end
+    end
+  end
+end

data/lib/rigor/effects/effect_table.rb

@@ -29,11 +29,19 @@ module Rigor
       # The lanes are kept **raw** here — a declared label a proven one already subsumes is dropped where
       # output is rendered ({LabelSet#excluding_subsumed_by}), never in the table, because a further join
       # has to see what was actually declared.
+      # `unclaimed` is the transitive reading of {Summary#unclaimed?}: true when this method, or anything
+      # it reaches, called something nothing described (#391). It is not a label, not a taint, and is read
+      # by `rigor sig-gen`'s annotation emission alone — not by the report, the snapshot, or any
+      # diagnostic.
       class Entry < Data.define(:key, :direct, :proven, :undischarged, :declared, :exhaustive, :causes,
-                                :edges)
-        def initialize(undischarged: nil, declared: nil, **rest)
+                                :edges, :unclaimed)
+        def initialize(undischarged: nil, declared: nil, unclaimed: false, **rest)
           super(undischarged: undischarged || rest.fetch(:proven), declared: declared || LabelSet::EMPTY,
-                **rest)
+                unclaimed: unclaimed ? true : false, **rest)
+        end
+
+        def unclaimed?
+          unclaimed
         end
 
         # The declared labels worth printing beside `proven` — the rendering rule, in one place so the

data/lib/rigor/effects/envelope_check.rb

@@ -157,7 +157,7 @@ module Rigor
       # synthesized `attr_*` / `define_method` members the effects scanner adds.
       def keys_by_class(table)
         table.keys.each_with_object({}) do |key, out|
-          owner = MethodKey.owner(key)
+          owner = MethodKey.envelope_owner(key)
           next if owner.nil?
 
           (out[owner] ||= []) << key

data/lib/rigor/effects/envelope_index.rb

@@ -135,6 +135,21 @@ module Rigor
         envelope
       end
 
+      # Whether ANY stratum carries an annotation for this key — ⊤ envelopes included.
+      #
+      # {#[]} is the import question and rightly refuses a ⊤ envelope: a bound that bounds nothing is not
+      # a bound. `rigor sig-gen`'s emission asks the other one (#391): an author who wrote
+      # `%a{rigor:v1:effect bogus.nonsense}` has still written about this method, and replacing their
+      # typo with an inferred `%a{pure}` would delete the only evidence that they meant to bound it — the
+      # `effect.unknown-label` report points at the annotation, and there would no longer be one.
+      def annotated?(owner, singleton, selector)
+        return false if owner.nil? || empty?
+
+        key = "#{owner}#{singleton ? '.' : '#'}#{selector}"
+        !(@method_envelopes[key] || @class_envelopes[owner] || config_envelope(owner) ||
+          @accepted[key]).nil?
+      end
+
       private
 
       # The first `namespace:` entry selecting `owner`, memoised per class name — one call site's owner

data/lib/rigor/effects/file_collection.rb

@@ -35,12 +35,59 @@ module Rigor
       # selector rather than a receiver's, and the propagator resolves it against the ancestry *above* that
       # class with no closed-world override join — a different question from every other edge, which is why
       # it is a field rather than a convention over the other three.
-      Edge = Data.define(:receiver_class, :kind, :selector, :self_call, :super_call) do
+      #
+      # `constant_receiver` marks a call whose receiver the author wrote as a **constant path** (#1039).
+      # The collector keys an edge on the receiver's TYPE, so `self.class.new` inside `Base`, `klass.new`
+      # on a `Singleton[Base]` local and a receiver-less `new` in a singleton body all produce the very
+      # same tuple as a literal `Base.new` — and the first three really do construct a subclass. Only the
+      # constructor rule reads it, and only to DROP the closed-world subclass join a written constant
+      # cannot reach.
+      #
+      # `unclaimed` marks a site NOTHING bounded: no catalogue row, no plugin row, no imported envelope
+      # (#391). It is not a taint and never becomes one — an unresolved edge here is overwhelmingly an
+      # inherited or gem call the catalogue simply has no row for, which is why the model drops it — but
+      # it IS the difference between "the analyzer read every callee" and "the analyzer read the callees
+      # it had something to read". Only sig-gen's annotation emission consults it, through
+      # {EffectTable::Entry#unclaimed?}: writing `%a{pure}` is a claim about a callee nobody described,
+      # and the emitter must decline rather than invent one.
+      # `taint_if_unresolved` is #1048's inversion of a taint. A `render :show` whose {CalleeRule} named
+      # `view:users/show.html` may or may not reach a unit — only the merged table knows, exactly as only
+      # the merged ancestry knows whether a `super` resolves — so the row's `template-not-analysed` cause
+      # travels ON the edge as a frozen `[cause, detail]` pair and {Propagator} seeds it only where the
+      # edge landed on nothing. Adding a cause where the walk failed rather than subtracting one where it
+      # succeeded keeps every step of the fixpoint monotone, and it is the same shape
+      # {Propagator.taint_unresolved_super} already has.
+      #
+      # `fallback_selectors` is #1065's lookup order: the selectors the propagator retries, in order, when
+      # `selector` resolves to nothing — `["html"]` on a `view:watchers/_watchers` + `js` edge, because a
+      # `.js.erb` template's lookup context is `[:js, :html]`. The FIRST that resolves is the edge's
+      # target and the taint stays unseeded; only when every one fails is `taint_if_unresolved` seeded.
+      # One ordered list rather than one edge per candidate, because two edges would join BOTH units
+      # where both exist, and only one of them runs.
+      Edge = Data.define(:receiver_class, :kind, :selector, :self_call, :super_call, :unclaimed,
+                         :constant_receiver, :taint_if_unresolved, :fallback_selectors) do
         # Defaulted because every producer but the `super` one records an ordinary call, and an ordinary
-        # call is not a `super`.
-        def initialize(super_call: false, **) = super
+        # call is not a `super`, and because a producer that says nothing about `unclaimed` /
+        # `constant_receiver` means the safe value of each.
+        #
+        # The defaults do NOT rescue a cache written before a member existed: `Marshal.load` of a `Data`
+        # whose member list has grown raises `TypeError: struct size differs`, which the store reads as a
+        # miss. That is the right outcome and not the one relied on — the cache identity carries a schema
+        # component ({Identity}, `schema:5`), so such an entry is never offered in the first place.
+        def initialize(super_call: false, unclaimed: false, constant_receiver: false,
+                       taint_if_unresolved: nil, fallback_selectors: nil, **)
+          super
+        end
       end
 
+      # An ancestry entry that names nothing and can never resolve. The scanner records it where a class
+      # body says its ancestry or its constructor is not readable from the source — a superclass
+      # expression that is not a constant path (`class K < Struct.new(:a)`), or an `alias` / `alias_method`
+      # that makes `initialize` some other method (#1039). It matches no summary key, so every existing
+      # walk steps over it; the constructor rule asks for it by name, because "unreadable" is exactly what
+      # that rule must not read as "empty".
+      OPAQUE_ANCESTOR = "<opaque>"
+
       NO_TABLE = {}.freeze
       private_constant :NO_TABLE
 
@@ -107,7 +154,12 @@ module Rigor
 
           fold_summaries(summaries, collection.summaries)
           fold_lists(edges, collection.edges)
-          superclasses.update(collection.superclasses)
+          # The opaque sentinel is sticky across files as well as within one: a class whose constructor one
+          # file says is unreadable does not become readable because another file spells its `<`, and the
+          # fold must not depend on which file the run reads first.
+          superclasses.update(collection.superclasses) do |_key, mine, theirs|
+            mine.include?(OPAQUE_ANCESTOR) ? mine : theirs
+          end
           fold_lists(includes, collection.includes)
         end
 
@@ -167,7 +219,9 @@ module Rigor
       end
 
       def edge_order(edge)
-        [edge.receiver_class.to_s, edge.kind.to_s, edge.selector, edge.self_call ? 1 : 0, edge.super_call ? 1 : 0]
+        [edge.receiver_class.to_s, edge.kind.to_s, edge.selector, edge.self_call ? 1 : 0,
+         edge.super_call ? 1 : 0, edge.constant_receiver ? 1 : 0,
+         Array(edge.taint_if_unresolved).join("\x00"), Array(edge.fallback_selectors).join("\x00")]
       end
     end
   end

data/lib/rigor/effects/framework_units.rb

@@ -196,7 +196,7 @@ module Rigor
       end
 
       # The uniqueness validator's own query. It rides the DECLARED lane with no taint, exactly as every
-      # other first-party plugin contribution does (ADR-103 WD6): the plugin read the app's own
+      # other first-party plugin contribution does (ADR-103 WD6 / WD17): the plugin read the app's own
       # `validates … uniqueness: true` and knows what Rails does with it, but the analyzer did not read a
       # body, so this is a trusted claim rather than a proof.
       def uniqueness_summary(class_name)

data/lib/rigor/effects/identity.rb

@@ -51,6 +51,22 @@ module Rigor
       def digest(configuration:, registry: Registry.default, catalog: Catalog.default, plugin_facts: nil)
         Digest::SHA256.hexdigest(
           [
+            # #391 — the summary schema itself. A cached collection written before {Summary#unclaimed?}
+            # existed restores with the bit false, which is the direction sig-gen's emission must never
+            # guess, so such an entry must not be served rather than merely read carefully.
+            #
+            # schema:3 — #1039 moved edge RESOLUTION: a singleton `new` edge on a project class now
+            # reaches that class's `#initialize`. The warm lanes serve a propagated `EffectTable` (and its
+            # `unclaimed` bits) rather than re-resolving, so an entry written under the old rule would
+            # answer the old closure for source nothing changed.
+            #
+            # schema:4 — #1048 added {FileCollection::Edge#taint_if_unresolved}, so a marshalled edge
+            # written under schema:3 no longer restores at all (`Data` with a grown member list raises
+            # `TypeError`), and a warm entry would otherwise be offered and then read as a miss.
+            #
+            # schema:5 — #1065 added {FileCollection::Edge#fallback_selectors}, which both grows the
+            # marshalled member list again and changes which unit a cached `view:` edge resolves to.
+            "schema:5",
             "vocabulary:#{registry.vocabulary_version}",
             "catalog:#{catalog.identity}",
             "effects:#{config_digest(configuration)}",

data/lib/rigor/effects/local_ownership.rb

@@ -11,8 +11,8 @@ module Rigor
     #
     # Ruby has no by-ref parameters, so `mutate.local` cannot mean "a write into an out-parameter" as it
     # does in PHP. It means the mutated receiver is invisible to the caller, and that is an ownership
-    # question: a local whose every assignment allocates (`[]`, `{}`, `""`, `.new`, `.dup`) and which never
-    # escapes the body is one no caller can observe being mutated.
+    # question: a local whose every assignment allocates (`[]`, `{}`, `""`, `Foo.new`, `.dup`) and which
+    # never escapes the body is one no caller can observe being mutated.
     #
     # The analysis is deliberately **flow-insensitive and whole-body**: a local that escapes anywhere
     # disqualifies, even if the escape happens after the mutation. That is strictly more conservative than
@@ -23,16 +23,17 @@ module Rigor
     # This is the tracer slice's approximation, not the eventual answer. `ClosureEscapeAnalyzer` answers a
     # different question (fact retention, not "does the code contain") and is deliberately left alone.
     module LocalOwnership
-      # Assignment right-hand sides that witness a fresh allocation. `.new` and `.dup` / `.clone` follow
+      # Assignment right-hand sides that witness a fresh allocation. `.dup` / `.clone` follow
       # [ADR-76](../adr/76-effect-modeling-freeze-dup-shape-preservation.md)'s reading of `dup` as the
-      # allocation witness.
-      ALLOCATING_SELECTORS = %i[new dup clone].to_set.freeze
+      # allocation witness; `.new` is {constructor?}'s, because only a class object's `new` is `Class#new`.
+      COPYING_SELECTORS = %i[dup clone].to_set.freeze
 
       module_function
 
       # The set of frame-owned local names in `body`, given the method's parameter names (a parameter is
-      # never frame-owned — the caller holds the same object, so mutating it is `mutate.instance`).
-      def owned(body, parameter_names)
+      # never frame-owned — the caller holds the same object, so mutating it is `mutate.instance`) and
+      # whether `self` is a class there ({constructor?}).
+      def owned(body, parameter_names, singleton:)
         return Set.new if body.nil?
 
         assignments = {}
@@ -42,23 +43,48 @@ module Rigor
         assignments.filter_map do |name, values|
           next if escaped.include?(name) || parameter_names.include?(name)
 
-          name if values.all? { |value| allocation?(value) }
+          name if values.all? { |value| allocation?(value, singleton: singleton) }
         end.to_set
       end
 
       # Whether `node` is an expression that allocates a fresh object this frame is the sole holder of.
-      def allocation?(node)
+      # `singleton` is whether the enclosing unit's `self` is a class, as {constructor?} reads it.
+      def allocation?(node, singleton:)
         case node
         when Prism::ArrayNode, Prism::HashNode, Prism::StringNode, Prism::InterpolatedStringNode,
              Prism::LambdaNode
           true
         when Prism::CallNode
-          ALLOCATING_SELECTORS.include?(node.name) || unary_plus_string?(node)
+          COPYING_SELECTORS.include?(node.name) || constructor?(node, singleton: singleton) ||
+            unary_plus_string?(node)
         else
           false
         end
       end
 
+      # A `new` whose receiver the author wrote as a class object: a constant path, a `class` call
+      # (`self.class`, `other.class`), or `self` — explicit or implicit — in a singleton-method body. Any
+      # other receiver may be an object whose `new` only shares the name: an ActiveRecord association's
+      # `new` builds a record into the association's own target, where the caller can reach it, and a
+      # gem's method gives no edge that would carry that to the caller. `self` in an instance method is
+      # such a receiver too — an association extension's `new` is the association's.
+      def constructor?(node, singleton:)
+        return false unless node.name == :new
+
+        receiver = node.receiver
+        case receiver
+        when nil, Prism::SelfNode then singleton
+        when Prism::ConstantReadNode, Prism::ConstantPathNode then true
+        when Prism::CallNode then class_call?(receiver)
+        else false
+        end
+      end
+
+      # `x.class` — `Kernel#class` answers the receiver's class, unless the receiver overrides it.
+      def class_call?(node)
+        node.name == :class && node.arguments.nil? && node.block.nil?
+      end
+
       # `+""` — the frozen-string-literal era's spelling of "a fresh mutable String".
       def unary_plus_string?(node)
         node.name == :+@ && node.receiver.is_a?(Prism::StringNode)
@@ -125,8 +151,8 @@ module Rigor
         last.is_a?(Prism::LocalVariableReadNode) ? [last.name.to_s] : []
       end
 
-      private_class_method :collect, :record_assignment, :record_escapes, :stored_value, :note_read,
-                           :trailing_reads
+      private_class_method :class_call?, :collect, :record_assignment, :record_escapes, :stored_value,
+                           :note_read, :trailing_reads
     end
   end
 end

data/lib/rigor/effects/method_key.rb

@@ -12,6 +12,11 @@ module Rigor
     # key, and `effects.attribution:` in `.rigor.yml` names one. A key the loader accepts and the scanner
     # would never produce is a table that silently matches nothing.
     module MethodKey
+      # #393 — the prefix a template unit's key carries (`Plugin::TemplateUnit::KEY_PREFIX`, repeated here
+      # rather than required so the effects layer keeps no dependency on the plugin layer; the two are
+      # pinned equal by a spec).
+      TEMPLATE_UNIT_PREFIX = "view:"
+
       module_function
 
       # @return `[owner, separator, selector]`, or nil when `key` is
@@ -35,6 +40,22 @@ module Rigor
       def owner(key)
         split(key)&.first
       end
+
+      # #393 — a template unit's key: `view:users/show.html`. Deliberately NOT a method key — a view has
+      # no owner class and no selector — but {.split} cannot tell, because the format segment gives the
+      # string a dot: `owner("view:users/show.html")` answers `"view:users/show"`, a class name no run
+      # ever produced. Anything grouping keys by their envelope-bearing owner has to ask this first.
+      def template_unit?(key)
+        key.to_s.start_with?(TEMPLATE_UNIT_PREFIX)
+      end
+
+      # The name an `effects.envelopes:` entry selects a key by: the owner class for a method key, and the
+      # unit key ITSELF for a template unit. A view is its own envelope subject — there is no class to
+      # hang the bound on, and `Runner#effect_sources` already knows which file the key came from, which
+      # is what a `match:` entry needs.
+      def envelope_owner(key)
+        template_unit?(key) ? key.to_s : owner(key)
+      end
     end
   end
 end

data/lib/rigor/effects/mutation_classifier.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "../inference/mutation_widening"
 require_relative "label_set"
+require_relative "local_ownership"
 
 module Rigor
   module Effects
@@ -18,7 +19,9 @@ module Rigor
     #    proven lane is worse than a missing one — the proven lane is the one a verdict may read (ADR-5).
     # 2. **Who owns the receiver?** `self` and its ivars are `mutate.self` (`mutate.static` in singleton
     #    context), a class variable is `mutate.static`, a parameter is `mutate.instance`, a frame-owned
-    #    local is `mutate.local`. **Anything else answers nil**, and the caller records an
+    #    local is `mutate.local`, and so is a receiver that is itself an allocation (`{}.compare_by_identity`,
+    #    `raw.dup.force_encoding(e)`) by the local rule's own witness ({LocalOwnership.allocation?}): each
+    #    evaluation is a new object no caller holds yet. **Anything else answers nil**, and the caller records an
     #    `unknown-ownership` taint rather than a proven bare `mutate`: Ruby's ownership is a dataflow
     #    question, and a proven parent label on a fresh-but-unproven receiver would put findings on correct
     #    code (WD14).
@@ -26,18 +29,23 @@ module Rigor
       # The only selectors a mutation may be claimed from without knowing the receiver's class.
       UNIVERSAL_MUTATORS = %i[[]=].to_set.freeze
 
-      # `String`'s receiver-mutating surface. `Array` / `Hash` reuse the hand-audited sets the widening
-      # rules already maintain, cited rather than re-derived (ADR-103 WD3).
-      STRING_MUTATORS = %i[
-        << concat replace insert prepend clear
-        upcase! downcase! capitalize! swapcase! reverse!
-        strip! lstrip! rstrip! chomp! chop! squeeze! succ! next!
-        sub! gsub! tr! tr_s! delete! slice! []=
-      ].to_set.freeze
-
       # `foo=`, and deliberately not `==` / `<=` / `!=` / `===`.
       ATTRIBUTE_WRITER = /\A[a-z_][A-Za-z0-9_]*=\z/
 
+      # Every Hash method that mutates its receiver. The widening keeps two tables because they answer two different
+      # questions of a `HashShape` — `MutationWidening::HASH_MUTATORS` changes the pair set,
+      # `HashLookupMutation::MUTATORS` changes what a read of the pairs answers — but either is a write to the
+      # receiver, and that is all this asks: `h.compare_by_identity` raises `FrozenError` on a frozen hash as
+      # `h.clear` does (unless the hash already compares by identity, when it returns before the check), and a
+      # method whose one effect was `@h.compare_by_identity` did not read as mutating while this cited the first
+      # table alone.
+      #
+      # `rehash` is in neither table because it changes no read a shape can state: a shape's keys are literals, which
+      # a rebuild never merges. It still rebuilds the receiver's table in place, and it is the one name spelt here.
+      HASH_MUTATORS = (
+        Inference::MutationWidening::HASH_MUTATORS | Inference::HashLookupMutation::MUTATORS | Set[:rehash]
+      ).freeze
+
       LABELS = {
         self_state: LabelSet.new(["mutate.self"]),
         static: LabelSet.new(["mutate.static"]),
@@ -57,10 +65,12 @@ module Rigor
         name = node.name
         return true if UNIVERSAL_MUTATORS.include?(name) || ATTRIBUTE_WRITER.match?(name.to_s)
 
+        # The per-class sets are the hand-audited ones the widening rules maintain, cited rather than re-derived
+        # (ADR-103 WD3): a list kept here drifted from the widening's, and missed `force_encoding`.
         case receiver_class
         when "Array" then Inference::MutationWidening::ARRAY_MUTATORS.include?(name)
-        when "Hash" then Inference::MutationWidening::HASH_MUTATORS.include?(name)
-        when "String" then STRING_MUTATORS.include?(name)
+        when "Hash" then HASH_MUTATORS.include?(name)
+        when "String" then Inference::StringMutation::MUTATORS.include?(name)
         else false
         end
       end
@@ -78,6 +88,7 @@ module Rigor
           @singleton ? :static : :self_state
         when Prism::ClassVariableReadNode then :static
         when Prism::LocalVariableReadNode then local_ownership(receiver.name.to_s)
+        else :local if LocalOwnership.allocation?(receiver, singleton: @singleton)
         end
       end