rigortype 0.3.9 → 0.4.0

data/lib/rigor/plugin/manifest.rb

@@ -49,23 +49,32 @@ module Rigor
       attr_reader :target_gems
 
       attr_reader :id, :version, :description, :config_schema, :config_defaults, :produces, :consumes,
-                  :owns_receivers, :open_receivers, :type_node_resolvers, :block_as_methods,
+                  :owns_receivers, :open_receivers, :rbs_complete_ancestors, :rbs_complete_extends,
+                  :type_node_resolvers,
+                  :block_as_methods,
                   :heredoc_templates, :nested_class_templates, :trait_registries,
                   :hkt_registrations, :hkt_definitions, :signature_paths, :protocol_contracts,
                   :source_rbs_synthesizer, :additional_initializers,
                   :effect_root, :effect_labels, :effect_attributions, :effect_edges, :effect_entry_points,
                   :effect_ancestry
 
-      def initialize( # rubocop:disable Metrics/ParameterLists
+      # #392 — the project-relative globs whose files this plugin compiles into {TemplateUnit}s. Purely a
+      # CLAIM: the engine globs these, reads each match's bytes and offers them to
+      # {Base#template_units_for_file}, which is where the transform itself lives. A plugin declaring none
+      # is never asked, and a run whose plugins declare none does no extra globbing at all.
+      attr_reader :template_globs
+
+      def initialize( # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
         id:, version:,
         description: nil, config_schema: {}, target_gems: [],
-        produces: [], consumes: [], owns_receivers: [], open_receivers: [], type_node_resolvers: [],
+        produces: [], consumes: [], owns_receivers: [], open_receivers: [], rbs_complete_ancestors: [],
+        rbs_complete_extends: [], type_node_resolvers: [],
         block_as_methods: [], heredoc_templates: [], nested_class_templates: [],
         trait_registries: [],
         hkt_registrations: [], hkt_definitions: [], signature_paths: [], protocol_contracts: [],
         source_rbs_synthesizer: nil, additional_initializers: [],
         effect_root: nil, effect_labels: [], effect_attributions: [], effect_edges: [],
-        effect_entry_points: [], effect_ancestry: []
+        effect_entry_points: [], effect_ancestry: [], template_globs: []
       )
         validate_id!(id)
         validate_version!(version)
@@ -74,6 +83,8 @@ module Rigor
         validate_target_gems!(target_gems)
         validate_owns_receivers!(owns_receivers)
         validate_open_receivers!(open_receivers)
+        validate_rbs_complete_ancestors!(rbs_complete_ancestors)
+        validate_rbs_complete_extends!(rbs_complete_extends)
         validate_type_node_resolvers!(type_node_resolvers)
         validate_block_as_methods!(block_as_methods)
         validate_heredoc_templates!(heredoc_templates)
@@ -93,10 +104,11 @@ module Rigor
                       hkt_registrations, hkt_definitions, signature_paths, protocol_contracts,
                       source_rbs_synthesizer)
         assign_target_gems(target_gems)
+        assign_rbs_complete_ancestors(rbs_complete_ancestors, rbs_complete_extends)
         assign_nested_class_templates(nested_class_templates)
         assign_additional_initializers(additional_initializers)
         assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges,
-                             effect_entry_points, effect_ancestry)
+                             effect_entry_points, effect_ancestry, template_globs)
         freeze
       end
 
@@ -133,6 +145,13 @@ module Rigor
       end
       private :assign_target_gems
 
+      # ADR-43 WD4 — assigned outside assign_fields (which already carries the maximum positional arity).
+      def assign_rbs_complete_ancestors(rbs_complete_ancestors, rbs_complete_extends)
+        @rbs_complete_ancestors = rbs_complete_ancestors.map { |c| c.to_s.dup.freeze }.freeze
+        @rbs_complete_extends = rbs_complete_extends.map { |c| c.to_s.dup.freeze }.freeze
+      end
+      private :assign_rbs_complete_ancestors
+
       # Assigned outside assign_fields (which already carries the maximum positional arity) — set in
       # `initialize` before the final freeze. ADR-36 nested-class emission tier.
       def assign_nested_class_templates(nested_class_templates)
@@ -162,15 +181,27 @@ module Rigor
       private :validate_effect_fields!
 
       def assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges,
-                               effect_entry_points, effect_ancestry)
+                               effect_entry_points, effect_ancestry, template_globs)
         @effect_root = effect_root.nil? ? nil : effect_root.to_s.dup.freeze
         @effect_labels = effect_labels.map { |label| label.to_s.dup.freeze }.uniq.sort.freeze
         @effect_attributions = effect_attributions.dup.freeze
         @effect_edges = effect_edges.dup.freeze
         @effect_entry_points = effect_entry_points.dup.freeze
         @effect_ancestry = effect_ancestry.dup.freeze
+        assign_template_globs(template_globs)
       end
       private :assign_effect_fields
+
+      # #392 — a glob is a String, and an absolute one is refused: a template unit is a project file, and
+      # a plugin reaching outside the project root is the trust boundary ADR-2 § "Plugin Trust and I/O
+      # Policy" draws. Validated and assigned in one call, because `#initialize` is at its line budget.
+      def assign_template_globs(globs)
+        validate_array_of!("template_globs", globs, "non-empty relative glob Strings") do |glob|
+          glob.is_a?(String) && !glob.empty? && !glob.start_with?("/") && !glob.include?("..")
+        end
+        @template_globs = globs.map { |glob| glob.to_s.dup.freeze }.uniq.freeze
+      end
+      private :assign_template_globs
       # rubocop:enable Metrics/ParameterLists, Metrics/AbcSize
 
       public
@@ -196,7 +227,7 @@ module Rigor
         errors
       end
 
-      def to_h # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      def to_h # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/MethodLength
         {
           "id" => id,
           "version" => version,
@@ -208,6 +239,8 @@ module Rigor
           "consumes" => consumes.map { |c| consumption_hash(c) },
           "owns_receivers" => owns_receivers,
           "open_receivers" => open_receivers,
+          "rbs_complete_ancestors" => rbs_complete_ancestors,
+          "rbs_complete_extends" => rbs_complete_extends,
           "type_node_resolvers" => type_node_resolvers.map { |r| r.class.name },
           "block_as_methods" => block_as_methods.map(&:to_h),
           "heredoc_templates" => heredoc_templates.map(&:to_h),
@@ -224,7 +257,8 @@ module Rigor
           "effect_attributions" => effect_attributions.map(&:to_h),
           "effect_edges" => effect_edges.map(&:to_h),
           "effect_entry_points" => effect_entry_points.map(&:to_h),
-          "effect_ancestry" => effect_ancestry.map(&:to_h)
+          "effect_ancestry" => effect_ancestry.map(&:to_h),
+          "template_globs" => template_globs
         }
       end
 
@@ -233,10 +267,11 @@ module Rigor
       # otherwise. A third-party plugin's `effect_root:` is ignored here (and warned about by the registry),
       # so it opens only the root named after itself.
       def effect_owner
-        return id if effect_root.nil?
+        root = effect_root
+        return id if root.nil?
         return id unless FirstParty.bundled?(id)
 
-        effect_root
+        root
       end
 
       # Whether this plugin's `effect_attributions:` may carry `discharge: true` (ADR-103 WD6).
@@ -388,6 +423,32 @@ module Rigor
         validate_array_of!("open_receivers", open_receivers, "non-empty String") { |c| c.is_a?(String) && !c.empty? }
       end
 
+      # ADR-43 WD4 — `rbs_complete_ancestors:` declares the class names this plugin's bundled RBS covers
+      # COMPLETELY: a method call the signature does not declare is genuinely absent at runtime. A
+      # Ruby-source subclass of a listed class may then bridge inherited calls to the ancestor's RBS
+      # (the ADR-43 allow-list's manifest-declared half). The dual of `open_receivers:` — that field
+      # marks a class open to suppress diagnostics on an unbounded surface; this one marks a class
+      # closed to ENABLE them on subclasses. Listing a class whose signature is partial would turn
+      # every omitted inherited method into a `call.undefined-method` false positive on subclass
+      # receivers, so only classes the plugin's `signature_paths:` declares exhaustively belong here.
+      def validate_rbs_complete_ancestors!(rbs_complete_ancestors)
+        validate_array_of!("rbs_complete_ancestors", rbs_complete_ancestors, "non-empty String") do |c|
+          c.is_a?(String) && !c.empty?
+        end
+      end
+
+      # `rbs_complete_extends:` is the extend-edge twin of `rbs_complete_ancestors:` (ADR-43 WD4): it names
+      # the MODULES whose bundled RBS instance surface is complete, so a project `extend M` in a class or
+      # module body lets singleton-side calls on that class resolve M's declared instance methods
+      # (`class F; extend T::Sig; sig { ... }; end` reaching `T::Sig#sig`). Same completeness rule: a
+      # module whose declared surface is partial does not belong here — the extend edge would misreport
+      # real calls as `call.undefined-method`.
+      def validate_rbs_complete_extends!(rbs_complete_extends)
+        validate_array_of!("rbs_complete_extends", rbs_complete_extends, "non-empty String") do |c|
+          c.is_a?(String) && !c.empty?
+        end
+      end
+
       # ADR-13 slice 2 — `type_node_resolvers:` declares the plugin-supplied `TypeNodeResolver` instances the
       # parser consults (in slice 3) when an RBS::Extended payload's named- or generic-type head misses the
       # built-in registry. Slice 2 carries the declarations on the manifest and the registry exposes them in

data/lib/rigor/plugin/registry.rb

@@ -373,6 +373,30 @@ module Rigor
         @open_receivers_set.include?(class_name.to_s)
       end
 
+      # ADR-43 WD4 — the aggregate set of "RBS-complete ancestor" class names declared across loaded
+      # plugins (manifest `rbs_complete_ancestors:`). `RbsDispatch`'s inherited-call bridge consults it
+      # alongside the engine's own allow-list: a Ruby-source subclass of a listed class resolves
+      # inherited calls against the ancestor's RBS, and the signature-reading rules apply to them.
+      attr_reader :rbs_complete_ancestors
+
+      def rbs_complete_ancestor?(class_name)
+        return false if class_name.nil?
+
+        @rbs_complete_ancestors_set.include?(class_name.to_s)
+      end
+
+      # The extend-edge twin of `rbs_complete_ancestors` — the aggregate set of module names declared via
+      # manifest `rbs_complete_extends:`. `RbsDispatch`'s singleton bridge consults it for `extend M`
+      # edges in project source: `class F; extend T::Sig; sig { ... }; end` resolves `sig` through
+      # `T::Sig`'s bundled RBS instance surface.
+      attr_reader :rbs_complete_extends
+
+      def rbs_complete_extends?(class_name)
+        return false if class_name.nil?
+
+        @rbs_complete_extends_set.include?(class_name.to_s)
+      end
+
       # ADR-28 — flat, ordered list of every loaded plugin's path-scoped method-protocol contracts, in
       # plugin registration order. Read from each plugin's `#protocol_contracts` (which the manifest backs
       # by default but a plugin MAY override to fold in per-project config). Consumed by
@@ -435,14 +459,24 @@ module Rigor
       #   nil where {#guarded_manifest} caught a raising manifest read.
       def compile_aggregates(manifests)
         @additional_initializers = manifests.flat_map { |m| m&.additional_initializers || [] }.freeze
-        @open_receivers = manifests.flat_map { |m| (m&.open_receivers || []).map(&:to_s) }.uniq.freeze
+        @open_receivers = aggregate_class_names(manifests, :open_receivers)
         @open_receivers_set = @open_receivers.to_set.freeze
+        @rbs_complete_ancestors = aggregate_class_names(manifests, :rbs_complete_ancestors)
+        @rbs_complete_ancestors_set = @rbs_complete_ancestors.to_set.freeze
+        @rbs_complete_extends = aggregate_class_names(manifests, :rbs_complete_extends)
+        @rbs_complete_extends_set = @rbs_complete_extends.to_set.freeze
         @type_node_resolvers = manifests.flat_map { |m| m&.type_node_resolvers || [] }.freeze
         @protocol_contracts = @plugins.flat_map { |p| safe_protocol_contracts(p) }.freeze
         @contracts_by_path = {}
         @effect_memo = {}
       end
 
+      # The shared shape of `open_receivers:` / `rbs_complete_ancestors:` — a flat uniq'd class-name list
+      # aggregated across manifests, each entry normalised to String.
+      def aggregate_class_names(manifests, field)
+        manifests.flat_map { |m| (m&.public_send(field) || []).map(&:to_s) }.uniq.freeze
+      end
+
       # Fail-soft per plugin: a plugin whose `effect_attributions:` override raises (a missing
       # `config/application.rb`, an unreadable path) contributes nothing rather than taking the run down.
       # An effect contribution is an enrichment; ADR-2 isolates plugin failures at the analyzer boundary

data/lib/rigor/plugin/source_rbs_synthesis_reporter.rb

@@ -21,7 +21,12 @@ module Rigor
       # dropping an annotation it parsed. They are not the same news — the first says the file contributed
       # nothing, the second that it contributed all but one thing — so they carry distinct diagnostic ids.
       # Defaults to `:failed`, the pre-WD12 meaning, so an older caller records what it always did.
-      Entry = Data.define(:plugin_id, :path, :message, :kind)
+      #
+      # `:contradiction` (ADR-112 WD5, issue #1075) is the consistency rule's error: a member two sources
+      # declare in ways that contradict, or a refinement outside its own declared type. It is the one kind
+      # positioned at a real line (`line`, nil for every other kind), because it usually sits in a `.rbs`
+      # file whose positions are exact; the others are file-level rows at line 1.
+      Entry = Data.define(:plugin_id, :path, :message, :kind, :line)
 
       def initialize
         @entries = []
@@ -34,12 +39,13 @@ module Rigor
       # file list and then drains each worker's stream into this one reporter, so without the dedup a
       # `--workers N` run printed N copies of a row a `--workers=0` run printed once. The same collapse the
       # {RbsExtended::Reporter} drain documents, for the same reason.
-      def record(plugin_id:, path:, message:, kind: :failed)
+      def record(plugin_id:, path:, message:, kind: :failed, line: nil)
         entry = Entry.new(
           plugin_id: plugin_id.to_s.dup.freeze,
           path: path.to_s.dup.freeze,
           message: message.to_s.dup.freeze,
-          kind: kind
+          kind: kind,
+          line: line
         )
         return nil if @seen.key?(entry)
 

data/lib/rigor/plugin/template_unit.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Rigor
+  module Plugin
+    # One **template unit** — a non-Ruby source file a plugin compiled into Ruby, handed to the engine to
+    # be parsed and typed like a file (ADR-16 Tier D, revived by #392 as this seam; design note
+    # `docs/design/20260816-effect-labels.md` § 11.3).
+    #
+    # ADR-16's Tier D declared `external_files:` — "files evaluated as if their body were pasted at a
+    # declared call site, with `self` typed as a declared class" — and ADR-60 WD1 removed it for want of a
+    # consumer. What Tier D lacked, and what this carries, is a **source transform with a line map** ahead
+    # of parsing: the file on disk is not Ruby, so the engine analyses `ruby_source` and reports at the
+    # template's own lines.
+    #
+    # A unit is pure data. The plugin's transform runs ONCE, on the parent, before any analysis; nothing
+    # here is a callable, so the unit survives `Marshal` into a fork-pool worker exactly as the macro
+    # substrate's value objects do.
+    #
+    # - `logical_name` — the name the unit is keyed by, independent of the handler: `users/show.html`, not
+    #   `users/show.html.erb`. Becomes the `view:<logical_name>` effect-unit key, so an ERB → Haml rewrite
+    #   is not a rename.
+    # - `path` — the template file as the user wrote it. Every diagnostic and every source trace names it.
+    # - `ruby_source` — the compiled Ruby the engine parses.
+    # - `line_map` — `{ ruby_source line => template line }`, 1-based. A line the map does not mention
+    #   anchors at the nearest mapped line before it, and at line 1 when there is none. **An EMPTY map is
+    #   the identity, not "no positions"**: every compiled line reports at its own number and the columns
+    #   pass through untouched. That is correct only for a transform that emits nothing the template did
+    #   not contain — a transform that prepends so much as one preamble line and omits the map reports
+    #   every finding off by that many lines. Omit it only for a byte-preserving transform.
+    # - `self_type` — the fully-qualified class the body's `self` is typed as, or nil for a bare body.
+    # - `locals` — `{ name => type name }`, the parameters the render site passes.
+    # - `ivar_seeds` — `{ "@name" => type name }`, the assigns the rendering action set.
+    # - `transform_id` — the compiler's identity (`"erubi-1.13"`). Joins the unit digest, so re-compiling
+    #   with a different compiler re-analyses. Defaults to the declaring plugin's `id@version`.
+    #
+    # - `suppressed_rules` — rule-id PREFIXES the engine drops for this unit's diagnostics (#393). The
+    #   per-unit rule posture: a compiled template is not code the user wrote, and a plugin that knows its
+    #   compiler's idioms is the only party that can say which families of finding are meaningful there.
+    #   `["call."]` is what an ERB plugin declares while the synthesised receivers are still coarse — the
+    #   unit still contributes its EFFECTS, which is what the view layer is analysed for first, without
+    #   the typing half costing the project a diagnostic per line. Empty means "report everything", which
+    #   is what a plugin whose synthesis it trusts should declare.
+    #
+    # A type name that resolves to nothing is not an error here: the engine falls back to `Dynamic`, which
+    # taints honestly rather than fabricating a type the plugin could not justify (ADR-5).
+    class TemplateUnit
+      # Bumped whenever the engine changes what it synthesises from a unit — the seeding rules, the
+      # scope binding, the effect-unit key spelling. It rides the unit digest, so a change here
+      # invalidates every cached run that analysed a unit, exactly as a changed transform does.
+      SYNTHESIS_VERSION = 2
+
+      # The prefix an effect-unit key carries for a template unit. Deliberately not a {Effects::MethodKey}
+      # shape: a view has no owner class and no selector, and spelling one would put a method in the
+      # snapshot that no call site can name.
+      KEY_PREFIX = "view:"
+
+      IVAR_NAME = /\A@[A-Za-z_][A-Za-z0-9_]*\z/
+      private_constant :IVAR_NAME
+
+      LOCAL_NAME = /\A[a-z_][A-Za-z0-9_]*\z/
+      private_constant :LOCAL_NAME
+
+      # A rule prefix is a dotted family (`call.`) or a whole rule id (`call.undefined-method`); the match
+      # is `String#start_with?`, so the former covers the latter. A bare `""` would suppress the unit
+      # entirely and is refused.
+      RULE_PREFIX = /\A[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*\.?\z/
+      private_constant :RULE_PREFIX
+
+      attr_reader :logical_name, :path, :ruby_source, :line_map, :self_type, :locals, :ivar_seeds,
+                  :transform_id, :suppressed_rules
+
+      # Every field is one declared property of the unit; grouping them behind a context object would only
+      # move the same list into a second value class.
+      def initialize(logical_name:, path:, ruby_source:, line_map: {}, self_type: nil, locals: {}, # rubocop:disable Metrics/ParameterLists
+                     ivar_seeds: {}, transform_id: nil, suppressed_rules: [])
+        @logical_name = validate_string!("logical_name", logical_name)
+        @path = validate_string!("path", path)
+        @ruby_source = validate_source!(ruby_source)
+        @line_map = validate_line_map!(line_map)
+        @self_type = self_type.nil? ? nil : validate_string!("self_type", self_type)
+        @locals = validate_bindings!("locals", locals, LOCAL_NAME)
+        @ivar_seeds = validate_bindings!("ivar_seeds", ivar_seeds, IVAR_NAME)
+        @transform_id = transform_id.nil? ? nil : validate_string!("transform_id", transform_id)
+        @suppressed_rules = validate_rule_prefixes!(suppressed_rules)
+        freeze
+      end
+
+      # The effect-unit key and the snapshot key: `view:users/show.html`.
+      def unit_key
+        "#{KEY_PREFIX}#{@logical_name}"
+      end
+
+      # The unit's cache identity — **source bytes + transform id + synthesis version**, the triple
+      # `docs/internal-spec/cache.md` § computed-value keys asks a synthesised input to carry. The
+      # template's own bytes are deliberately NOT in it: the engine analyses `ruby_source`, and two
+      # templates that compile to the same Ruby have the same answer.
+      #
+      # @param fallback_transform_id — the declaring plugin's `id@version`, used when the unit
+      #   named no transform of its own.
+      def digest(fallback_transform_id = nil)
+        Digest::SHA256.hexdigest(
+          [
+            "source:#{@ruby_source}",
+            "transform:#{@transform_id || fallback_transform_id || 'unknown'}",
+            "suppressed:#{@suppressed_rules.join(',')}",
+            "synthesis:#{SYNTHESIS_VERSION}"
+          ].join("\x00")
+        )
+      end
+
+      # The template line a `ruby_source` line reports at. Falls back to the nearest mapped line before it
+      # — a synthesised prologue or a buffer-append the compiler emitted between two template lines still
+      # points into the template rather than past its end — and to line 1 when the map says nothing at all.
+      def template_line(ruby_line)
+        return ruby_line if @line_map.empty?
+        return @line_map[ruby_line] if @line_map.key?(ruby_line)
+
+        before = @line_map.keys.select { |line| line < ruby_line }
+        before.empty? ? 1 : @line_map[before.max]
+      end
+
+      def to_h
+        {
+          "logical_name" => @logical_name, "path" => @path, "ruby_source" => @ruby_source,
+          "line_map" => @line_map, "self_type" => @self_type, "locals" => @locals,
+          "ivar_seeds" => @ivar_seeds, "transform_id" => @transform_id,
+          "suppressed_rules" => @suppressed_rules
+        }
+      end
+
+      def ==(other)
+        other.is_a?(TemplateUnit) && other.to_h == to_h
+      end
+      alias eql? ==
+
+      def hash
+        [self.class, to_h].hash
+      end
+
+      private
+
+      def validate_string!(field, value)
+        text = value.to_s
+        raise ArgumentError, "TemplateUnit #{field} must be a non-empty String" if text.empty?
+
+        text.dup.freeze
+      end
+
+      def validate_source!(value)
+        raise ArgumentError, "TemplateUnit ruby_source must be a String" unless value.is_a?(String)
+
+        value.dup.freeze
+      end
+
+      # 1-based on both sides. A zero or negative line is a compiler bug the engine would turn into a
+      # diagnostic positioned off the top of the file, so it is refused at construction.
+      def validate_line_map!(value)
+        raise ArgumentError, "TemplateUnit line_map must be a Hash" unless value.is_a?(Hash)
+
+        value.to_h do |from, to|
+          unless from.is_a?(Integer) && to.is_a?(Integer) && from.positive? && to.positive?
+            raise ArgumentError, "TemplateUnit line_map must map positive Integer to positive Integer"
+          end
+
+          [from, to]
+        end.freeze
+      end
+
+      def validate_rule_prefixes!(value)
+        raise ArgumentError, "TemplateUnit suppressed_rules must be an Array" unless value.is_a?(Array)
+
+        value.map do |prefix|
+          text = prefix.to_s
+          unless text.match?(RULE_PREFIX)
+            raise ArgumentError, "TemplateUnit suppressed_rules entry #{text.inspect} is malformed"
+          end
+
+          text.dup.freeze
+        end.uniq.freeze
+      end
+
+      def validate_bindings!(field, value, pattern)
+        raise ArgumentError, "TemplateUnit #{field} must be a Hash" unless value.is_a?(Hash)
+
+        value.to_h do |name, type_name|
+          key = name.to_s
+          raise ArgumentError, "TemplateUnit #{field} key #{key.inspect} is malformed" unless key.match?(pattern)
+
+          [key.dup.freeze, validate_string!("#{field} value", type_name)]
+        end.freeze
+      end
+    end
+  end
+end

data/lib/rigor/plugin.rb

@@ -2,6 +2,7 @@
 
 require_relative "plugin/type_node_resolver"
 require_relative "plugin/macro"
+require_relative "plugin/template_unit"
 require_relative "plugin/manifest"
 require_relative "plugin/access_denied_error"
 require_relative "plugin/trust_policy"

data/lib/rigor/protection/discovery_seed.rb

@@ -99,7 +99,9 @@ module Rigor
         tables = { discovered_classes: index.fetch(:classes) }
         %i[
           def_nodes def_nestings singleton_def_nodes def_sources singleton_def_sources superclasses includes
-          method_visibilities methods data_member_layouts struct_member_layouts
+          prepends
+          method_visibilities methods parameter_envelopes data_member_layouts struct_member_layouts
+          deferred_ranges refinements global_write_census
         ].each do |slot|
           tables[seed_key(slot)] = def_index.fetch(slot)
         end

data/lib/rigor/protection/kill_signature.rb

@@ -20,7 +20,6 @@ module Rigor
         [diagnostic.rule, diagnostic.path, diagnostic.line, diagnostic.column, diagnostic.message]
       end
 
-      # @return the signature set of `diagnostics`.
       def signatures_of(diagnostics)
         diagnostics.to_set { |diagnostic| of(diagnostic) }
       end

data/lib/rigor/protection/mutation_cache.rb

@@ -182,8 +182,7 @@ module Rigor
         # `Unavailable` rescue above and disables the cache, which is the only sound reading of a key slot
         # that could not be computed.
         def engine_source_entries
-          identity = Cache::EngineSource.process_identity
-          identity.nil? ? [] : [config_entry("engine-source", identity)]
+          Cache::EngineSource.key_config_entries
         end
 
         # Probed BEFORE the snapshot load, for the reason string rather than for soundness. Since #289

data/lib/rigor/rbs_extended.rb

@@ -106,6 +106,12 @@ module Rigor
     # `docs/type-specification/rbs-extended.md`.
     INFERRED_RETURN_DIRECTIVE = "rigor:v1:inferred-return"
 
+    # `%a{rigor:v1:inferred-signature}` — every type slot on the member, parameters and return alike,
+    # is a placeholder: the author's comment block asserted nothing about this member's own contract.
+    # Strictly narrower than {INFERRED_RETURN_DIRECTIVE}, which also covers a member with an authored
+    # parameter and no authored return. Normative in `docs/type-specification/rbs-extended.md`.
+    INFERRED_SIGNATURE_DIRECTIVE = "rigor:v1:inferred-signature"
+
     module_function
 
     # Whether `method_def` declares its return type inferred rather than contracted (issue #823).
@@ -131,6 +137,27 @@ module Rigor
       annotations.any? { |annotation| annotation.string.to_s.strip == INFERRED_RETURN_DIRECTIVE }
     end
 
+    # Whether `method_def` declares its ENTIRE signature inferred — every parameter and the return alike
+    # — rather than only its return (issue #991).
+    #
+    # `inferred_return?` alone cannot separate a fully bare `def` from one whose parameters ARE declared
+    # (`# @rbs num: Float`) and only its return defaulted: both trip the same return-only provenance,
+    # because no equivalent per-parameter survivor exists to tell them apart. This reads the plugin's
+    # narrower, member-level fact instead: true only when nothing at all was asserted about the member.
+    # `call.wrong-arity` declines on this rather than on {inferred_return?}, since a parameter the author
+    # DID annotate is an assertion about the parameter list, and the parameter list is exactly what arity
+    # is a question about (see the rule's own comment).
+    #
+    # @param method_def — an `RBS::Definition::Method`, or anything else answering `#annotations`.
+    def inferred_signature?(method_def)
+      return false if method_def.nil?
+
+      annotations = method_def.annotations
+      return false if annotations.nil? || annotations.empty?
+
+      annotations.any? { |annotation| annotation.string.to_s.strip == INFERRED_SIGNATURE_DIRECTIVE }
+    end
+
     # Reads RBS::Extended predicate effects off `RBS::Definition::Method#annotations`. Returns the effects in
     # source order; duplicates and unrecognised `rigor:v1:` directives are dropped. Returns an empty array (NEVER
     # `nil`) for a method with no recognised annotations so callers can iterate unconditionally.

data/lib/rigor/reflection/constant_ancestors.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module Rigor
+  # {Reflection}'s constant-ancestor walk ([#354](https://github.com/rigortype/rigor/issues/354)), split out for
+  # the reader rather than for the loader: the whole-spelling ladder's step 2 (`reflection.rb`) and the
+  # segment-wise path walk (`reflection/constant_path.rb`) both ask which project classes and modules a
+  # name's owner inherits constants from, and this file answers that once for both. Reopening the module
+  # keeps the walk behind the facade its callers already read.
+  module Reflection
+    # #354 — thread-local slot for the per-run ancestor-scope memo. See {.ancestor_constant_scopes}.
+    ANCESTOR_SCOPES_KEY = :__rigor_ancestor_constant_scopes__
+    private_constant :ANCESTOR_SCOPES_KEY
+
+    module_function
+
+    # #354 — the project classes and modules whose own constants `class_name` inherits, in Ruby's
+    # ancestor order: included / prepended modules before the superclass (Ruby places mixins nearer),
+    # transitively, breadth-first. `class_name` itself is excluded — step 1 already covered it.
+    #
+    # Only PROJECT ancestors appear. `Scope#superclass_of` / `#includes_of` carry as-written names
+    # from the discovery pre-pass, and an as-written name that resolves to no discovered class or
+    # module is dropped — so a `class Foo < ActiveRecord::Base` contributes nothing and a constant
+    # owned by an RBS-known ancestor still resolves only if the bare name reaches it at step 3. That
+    # gap is deliberate for this slice: widening to the RBS ancestor graph is a separate question
+    # with its own FP surface.
+    #
+    # Memoised per run because step 2 runs on every constant reference whose lexical candidates all
+    # miss — which is the common case for a core-class reference (`String` inside `class Foo`). The
+    # bucket keys on the identity of the runner-seeded run-generation token (ADR-84 WD2), falling
+    # back to the per-file discovery table for runner-less scopes, so a re-run in one process (LSP,
+    # ADR-62 warm loop) cannot hit stale entries.
+    def ancestor_constant_scopes(class_name, scope)
+      # ADR-46: `superclass_of` / `includes_of` record a cross-file class dependency per consumer
+      # file, and the memo is run-scoped rather than file-scoped — a hit would skip the recording and
+      # under-record the edge for every later file. Recording runs are rare (incremental only), so
+      # they simply bypass the memo rather than complicate its key.
+      return compute_ancestor_constant_scopes(class_name, scope) if Analysis::DependencyRecorder.active?
+
+      generation = scope.run_generation || scope.discovered_superclasses
+      slot = Thread.current[ANCESTOR_SCOPES_KEY]
+      unless slot && slot[0].equal?(generation)
+        slot = [generation, {}]
+        Thread.current[ANCESTOR_SCOPES_KEY] = slot
+      end
+      bucket = slot[1]
+      bucket.fetch(class_name) { bucket[class_name] = compute_ancestor_constant_scopes(class_name, scope) }
+    end
+    private_class_method :ancestor_constant_scopes
+
+    def compute_ancestor_constant_scopes(class_name, scope)
+      queue = [class_name]
+      seen = { class_name => true }
+      out = []
+      until queue.empty?
+        current = queue.shift
+        # Mixins first, then the superclass — Ruby's ancestor order.
+        scope.includes_of(current).each do |raw|
+          resolved = resolve_ancestor_name(current, raw, scope)
+          next if resolved.nil? || seen[resolved]
+
+          seen[resolved] = true
+          out << resolved
+          queue << resolved
+        end
+        raw_super = scope.superclass_of(current)
+        next if raw_super.nil?
+
+        resolved_super = resolve_ancestor_name(current, raw_super, scope)
+        next if resolved_super.nil? || seen[resolved_super]
+
+        seen[resolved_super] = true
+        out << resolved_super
+        queue << resolved_super
+      end
+      out.freeze
+    end
+    private_class_method :compute_ancestor_constant_scopes
+
+    # Resolves an ancestor name AS WRITTEN (`"Base"`, or a qualified `"A::B"`) against the nesting in
+    # force where the subclass's header is written — `Scope#ancestor_name_candidates`, the single
+    # owner of that order, which `Scope#enqueue_ancestors` reads for method lookup and the
+    # override-visibility rule reads for its own walk. Returns nil when no candidate names a
+    # discovered project class or module.
+    def resolve_ancestor_name(subclass_qualified, raw, scope)
+      scope.ancestor_name_candidates(subclass_qualified, raw)
+           .find { |candidate| known_project_namespace?(candidate, scope) }
+    end
+    private_class_method :resolve_ancestor_name
+
+    def known_project_namespace?(name, scope)
+      scope.discovered_superclasses.key?(name) ||
+        scope.discovered_includes.key?(name) ||
+        scope.discovered_classes.key?(name)
+    end
+    private_class_method :known_project_namespace?
+  end
+end