rigortype 0.3.9 → 0.4.0

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable.rb

@@ -123,12 +123,12 @@ module Rigor
         @protocol_contracts || manifest.protocol_contracts
       end
 
-      # File-level only: the load-error emission. Per-call broadcast validation runs over the
+      # File-level only: the load-error disclosure. Per-call broadcast validation runs over the
       # engine-owned walk via the node_rule below (ADR-37). The channel index is lazily loaded +
       # memoised by `producer_value`, shared by both surfaces.
       def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
         index = producer_value(:channel_index)
-        return [load_error_diagnostic(path)] if index.nil? && producer_error(:channel_index)
+        disclose_load_error if index.nil? && producer_error(:channel_index)
 
         []
       end
@@ -151,10 +151,14 @@ module Rigor
         "#{base}/**/*.rb"
       end
 
-      def load_error_diagnostic(path)
+      # Issue #1056 — "the channel index did not load" is a fact about the run's INPUTS, not about the file being
+      # analysed, so it is registered rather than returned: see {Plugin::Base#disclose_once} for the
+      # channel, the `(plugin id, key)` de-duplication and why the engine positions it at `.rigor.yml:1:1`.
+      # Returned from the per-file hook it carried no once-guard at all and repeated on every file.
+      def disclose_load_error
         error = producer_error(:channel_index)
-        Rigor::Analysis::Diagnostic.new(
-          path: path, line: 1, column: 1,
+        disclose_once(
+          :channel_index_load_failed,
           message: "rigor-actioncable: failed to discover channels: #{error.class}: #{error.message}",
           severity: :warning,
           rule: "load-error"

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer.rb

@@ -93,7 +93,10 @@ module Rigor
       # loaded + memoised, shared.
       def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
         index = producer_value(:mailer_index)
-        return [load_error_diagnostic(path)] if index.nil? && producer_error(:mailer_index)
+        if index.nil? && producer_error(:mailer_index)
+          disclose_load_error
+          return []
+        end
         return [] if index.nil? || index.empty?
 
         missing_view_diagnostics(path, index)
@@ -136,10 +139,16 @@ module Rigor
         File.expand_path(path)
       end
 
-      def load_error_diagnostic(path)
+      # Issue #1056 — "the mailer index did not load" is a fact about the run's INPUTS, not about the file being
+      # analysed, so it is registered rather than returned: see {Plugin::Base#disclose_once} for the
+      # channel, the `(plugin id, key)` de-duplication and why the engine positions it at `.rigor.yml:1:1`.
+      # Returned from the per-file hook it carried no once-guard at all and repeated on every file.
+      # The missing-view rows this hook still returns are NOT disclosures: they name the mailer's own
+      # source file.
+      def disclose_load_error
         error = producer_error(:mailer_index)
-        Rigor::Analysis::Diagnostic.new(
-          path: path, line: 1, column: 1,
+        disclose_once(
+          :mailer_index_load_failed,
           message: "rigor-actionmailer: failed to discover mailers: #{error.class}: #{error.message}",
           severity: :warning,
           rule: "load-error"

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/analyzer.rb

@@ -171,7 +171,6 @@ module Rigor
         # since the implicit path would false-positive on `redirect_to` / `head` / early returns.
         #
         # @param ancestors — the lexical ancestor chain
-        # @param path — file being analysed
         # @param io_boundary — the plugin's {Rigor::Plugin::IoBoundary}; #629 — every filesystem
         #   question this phase asks goes through it, so "no such template" is a recorded dependency and
         #   the run-result cache invalidates once the template appears

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_scan.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require "rigor/source/node_children"
+
+require "prism"
+
+module Rigor
+  module Plugin
+    class Actionpack < Rigor::Plugin::Base
+      # The syntactic controller walk two parent-side indexes share: {ViewAssigns}, which reads what a
+      # controller action ASSIGNED, and {RenderLocals} (#1047), which reads what a render site PASSED.
+      #
+      # Both run on the parent before any analysis — `#template_units_for_file` is called before the
+      # engine has indexed anything — so neither may ask the typer a question, and both need the same four
+      # answers off a Prism tree: which class declarations in this file are controllers, what their
+      # qualified names are, which view directory each one owns, and which `def`s sit directly in the body.
+      # Keeping one copy is what stops the two indexes from disagreeing about, say, whether
+      # `module Admin; class UsersController` is `admin/users` — a disagreement that would be silent, since
+      # each side would simply find nothing.
+      #
+      # It deliberately stops at the shapes {ControllerDiscoverer} already recognises. Anything a
+      # controller does at runtime — `define_method`, a concern that adds actions on include — is not read
+      # here and is not read there either.
+      module ControllerScan
+        module_function
+
+        # Yields `[class_node, enclosing_namespace_segments]` for every `ClassNode` in the tree, with the
+        # enclosing `module` chain accumulated. Mirrors {ControllerDiscoverer#walk_declarations}'s
+        # qualification reduced to the two shapes that can carry an action: `class Admin::UsersController`
+        # and `module Admin; class UsersController`.
+        def each_controller(node, namespace, &)
+          return unless node.is_a?(Prism::Node)
+
+          if node.is_a?(Prism::ClassNode) || node.is_a?(Prism::ModuleNode)
+            yield node, namespace if node.is_a?(Prism::ClassNode)
+            inner = namespace + constant_segments(node.constant_path)
+            each_controller(node.body, inner, &) if node.body
+            return
+          end
+
+          node.rigor_each_child { |child| each_controller(child, namespace, &) }
+        end
+
+        def constant_segments(path)
+          case path
+          when Prism::ConstantReadNode then [path.name.to_s]
+          when Prism::ConstantPathNode then constant_segments(path.parent) + [path.name.to_s]
+          else []
+          end
+        end
+
+        # `["Admin", "UsersController"]` → `"admin/users"`. `ApplicationController` and the other abstract
+        # bases are not excluded: an action they define really is inherited, and a template under their own
+        # path simply never exists. nil for a class whose name is not a controller's.
+        def controller_path(segments)
+          return nil unless segments.last&.end_with?("Controller")
+
+          parts = segments.map { |segment| underscore(segment) }
+          parts[-1] = parts[-1].sub(/_controller\z/, "")
+          return nil if parts[-1].empty?
+
+          parts.join("/")
+        end
+
+        # The ASCII-only inflection this needs: a controller constant is a CamelCase identifier, and
+        # nothing here has to invert an irregular plural (`ActiveSupport::Inflector` is the analysed
+        # project's, not Rigor's).
+        def underscore(segment)
+          segment.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+                 .gsub(/([a-z\d])([A-Z])/, '\1_\2')
+                 .downcase
+        end
+
+        # `{ :show => body_node }` for every `def` directly in the class body.
+        def method_bodies(node)
+          body = node.body
+          return {} if body.nil?
+
+          body.child_nodes.compact.filter_map do |child|
+            next nil unless child.is_a?(Prism::DefNode) && child.receiver.nil?
+
+            [child.name, child.body]
+          end.to_h
+        end
+
+        # Every implicit-self `render` call node under `node`, at any depth.
+        def each_render(node, &)
+          return unless node.is_a?(Prism::Node)
+
+          yield node if node.is_a?(Prism::CallNode) && node.receiver.nil? && node.name == :render
+          node.rigor_each_child { |child| each_render(child, &) }
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/effects.rb

@@ -31,6 +31,11 @@ module Rigor
       module Effects
         CONTROLLER = "ActionController::Base"
 
+        # The view context a template unit's body runs under — the `self_type:` the plugin declares on
+        # every {Rigor::Plugin::TemplateUnit}. A `render` inside a template is an implicit-self call on
+        # it, which is what lets one row colour the template → partial edge (#1048).
+        VIEW = "ActionView::Base"
+
         RESPONSE = ["mutate.self", "rails.response.write"].freeze
         SESSION_WRITE = ["mutate", "rails.session.write"].freeze
         SESSION_READ = ["io", "rails.session.read"].freeze
@@ -46,6 +51,26 @@ module Rigor
         # the one genuinely misleading row in the whole Rails layer.
         RENDERERS = %w[render render_to_string render_to_body].freeze
 
+        # Rails' own name for the implicit render — what `ActionController::Base` calls when an action
+        # returns without having answered. The project never writes it, which is exactly the point: the
+        # row exists so the engine's unit-level {Rigor::Effects::CalleeRule} has a declaration to read,
+        # and it carries no labels because an action that implicitly renders has already been coloured by
+        # nothing at all and must not be coloured by a guess (see `why:`).
+        IMPLICIT_RENDER = "default_render"
+
+        # Action View's own format lookup order for a template-side render, as DATA the engine's
+        # `rails_render_partial` rule copies onto the edge (#1065). While a `.js.erb` template renders, the
+        # lookup context holds `[:js, :html]` — `LookupContext#formats=` appends `:html` to a lone `:js` —
+        # so `render "watchers"` runs `_watchers.js.erb` where it exists and `_watchers.html.erb`
+        # otherwise. The propagator takes the first key a unit answers.
+        #
+        # `js` is the only entry, because it is the only fallback Action View itself hard-codes. What a
+        # `.json`, `.xml` or `.turbo_stream` template falls back to is whatever the REQUEST's formats
+        # happened to be (`prepend_formats` puts the template's format in front of them) — an `Accept`
+        # header the source never states, Turbo's included — so those keep their taint rather than guess.
+        FORMAT_FALLBACKS = { "js" => ["html"] }.freeze
+        Ractor.make_shareable(FORMAT_FALLBACKS)
+
         # The cookie jars a Rails app writes through.
         COOKIE_JARS = ["self.cookies", "self.cookies.signed", "self.cookies.encrypted",
                        "self.cookies.permanent"].freeze
@@ -59,35 +84,67 @@ module Rigor
         def response_rows
           RESPONSE_WRITERS.map do |selector|
             EffectAttribution.new(
-              receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true,
+              receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true, responds: true,
               why: "sets the response on the controller instance — Rack writes the socket later, outside " \
                    "any project method, so this is `mutate.self` and deliberately not `io`"
             )
-          end + render_rows
+          end + render_rows + [implicit_render_row]
         end
 
+        # `render` and its two `*_to_string` twins. Each carries a `callee:` so the render site edges to
+        # the template's own effect unit (#1048), and each keeps the `template-not-analysed` taint — which
+        # now rides the edge: a render whose template produced a unit discharges it, and one whose
+        # template the plugin declined (a layout, #1047) or whose target is computed keeps it.
+        #
+        # Only `render` sets `responds:`. `render_to_string` builds a string and leaves the response
+        # unanswered, so an action that calls it and returns still takes Rails' implicit render.
         def render_rows
           RENDERERS.map do |selector|
             EffectAttribution.new(
               receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true,
-              taint: "template-not-analysed",
+              taint: "template-not-analysed", callee: "rails_render", responds: selector == "render",
               why: "sets the response body from a template. The controller half is fully stated; the " \
-                   "template's own effects are unknown until views become effect units, and the taint " \
-                   "is how the summary says so rather than reading exhaustive"
+                   "template's own effects reach it through the `rails_render` callee edge, and the " \
+                   "taint survives on the edge for a target the rule cannot resolve"
             )
-          end
+          end + [
+            EffectAttribution.new(
+              receiver: VIEW, method: :render, labels: [], discharge: true,
+              taint: "template-not-analysed", callee: "rails_render_partial",
+              callee_fallbacks: FORMAT_FALLBACKS,
+              why: "a `render` inside a template runs another template. The edge is the whole " \
+                   "contribution — what a partial render DOES is what the partial does, and the row " \
+                   "reaches it now — while a target the rule cannot resolve keeps the taint. In a view " \
+                   "a bare argument names a PARTIAL and `layout:` names one too, which is why this is a " \
+                   "separate rule from the controller's"
+            )
+          ]
+        end
+
+        # The implicit render, as an EDGE and nothing else. An action that never answered still renders
+        # `<controller>/<action>`, so its summary must include that template's effects — but the fact is
+        # the absence of a call, so there is no site to colour, and inventing a `rails.response.write`
+        # here would put it on every private helper a controller defines as well.
+        def implicit_render_row
+          EffectAttribution.new(
+            receiver: CONTROLLER, method: IMPLICIT_RENDER, labels: [], discharge: true,
+            callee: "rails_implicit_render",
+            why: "Rails renders `<controller>/<action>` for an action that answered nothing. The edge " \
+                 "is the whole contribution: no label, because an implicit render is observed from a " \
+                 "body that made no call, and a label read off an absence would colour every helper"
+          )
         end
 
         # `send_file` streams from disk; `send_data` does not.
         def file_rows
           [
             EffectAttribution.new(
-              receiver: CONTROLLER, method: :send_data, labels: RESPONSE, discharge: true,
+              receiver: CONTROLLER, method: :send_data, labels: RESPONSE, discharge: true, responds: true,
               why: "sets the response body from an in-memory string"
             ),
             EffectAttribution.new(
               receiver: CONTROLLER, method: :send_file, labels: RESPONSE + ["io.fs.read"], discharge: true,
-              why: "sets the response AND reads the named file off disk"
+              responds: true, why: "sets the response AND reads the named file off disk"
             )
           ]
         end

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/erb_compiler.rb

@@ -0,0 +1,270 @@
+# frozen_string_literal: true
+
+require "erb"
+
+require "rigor/plugin"
+require "rigor/plugin/isolation"
+
+module Rigor
+  module Plugin
+    class Actionpack < Rigor::Plugin::Base
+      # #393 — ERB → Ruby, with the line map the template-unit seam (#392) reports through.
+      #
+      # ## Which compiler
+      #
+      # [ADR-90](../../../../../../docs/adr/90-target-library-resolution-from-project-bundle.md): Erubi is
+      # **never bundled** — it is not a Rigor dependency and nothing here adds it to a Gemfile — but it is
+      # what Rails itself compiles with, so it is used when it resolves in the ANALYSED project's bundle,
+      # through the same `Isolation.require_with_target_bundle` path `Inflector` takes. Stdlib `ERB` is the
+      # fallback, and it is always there. Whichever ran is reported as the unit's `transform_id`
+      # (`erubi-1.13.1` / `erb-6.0.1.1`), which rides the unit digest — so a project that installs Erubi
+      # between two runs re-analyses rather than replaying the stdlib answer.
+      #
+      # ## The line map is measured, never assumed
+      #
+      # Both compilers are line-preserving: a tag's text is rewritten in place and the newlines between
+      # tags are emitted verbatim, which is why a Rails backtrace can name `show.html.erb:12`. What differs
+      # is the **prologue** — stdlib ERB emits a `#coding:` magic comment above the body, Erubi emits its
+      # buffer initialiser — and neither documents its height as API.
+      #
+      # So the height is measured rather than hardcoded: {.line_offset} compiles a probe template of marked
+      # lines once per compiler and reads back which compiled line the first marker landed on, checking at
+      # the same time that the following markers step by exactly one. A compiler that fails that check is
+      # refused (the caller declines the file) rather than trusted, because the failure mode of a wrong
+      # offset is every finding in every template reported at the wrong line — silent, and worse than no
+      # unit at all.
+      module ErbCompiler
+        # A compiler whose probe did not step line-for-line. Caught by {Actionpack#template_units_for_file},
+        # which declines the file.
+        class Unmappable < StandardError; end
+
+        # Three marked lines, each a STATEMENT tag. A tag's Ruby is emitted verbatim, so the marker is
+        # findable in the compiled source and each one is forced onto its own compiled line.
+        #
+        # Plain text would not do: consecutive text lines are one chunk and are emitted as ONE append
+        # carrying the newlines escaped inside the literal — the compiler then pads the missing lines out
+        # BELOW it, so a text probe reads as a collapse when the line numbering is in fact intact. That
+        # padding is exactly the property being measured, and a tag probe measures it without tripping
+        # over how the padding is spelled.
+        PROBE = (1..3).map { |n| "<% RIGOR_ERB_PROBE_#{n} %>\n" }.join.freeze
+        private_constant :PROBE
+
+        # An output tag whose Ruby OPENS A BLOCK: `<%= form_with(model: @user) do |f| %>`, the single most
+        # common shape in a real Rails view. Neither compiler handles it — both emit
+        # `_buf << (form_with(…) do |f|).to_s`, which is a syntax error, so every template using a form
+        # helper produced two parse diagnostics and no unit at all (431 of them on redmine, measured).
+        #
+        # Rails does not hit this because its own ERB handler carries exactly this rule
+        # (`ActionView::Template::Handlers::ERB::BLOCK_EXPR`) and emits `@output_buffer.append= expr`
+        # unwrapped for a matching tag. The same rule is applied here one step earlier, as a rewrite of
+        # the TEMPLATE rather than of a compiler's output: `<%=` becomes `<%` for such a tag, which is a
+        # same-width, same-line edit both compilers then handle, and the discarded value is the buffer
+        # append the design note says is not an origin anyway.
+        BLOCK_EXPR = /\s*((\s+|\))do|\{)(\s*\|[^|]*\|)?\s*\z/
+        private_constant :BLOCK_EXPR
+
+        # The Erubi/Rails trim markers, which stdlib ERB only understands under a `trim_mode:` that also
+        # changes how it emits newlines. They are blanked instead — `<%-` → `<% `, `-%>` → ` %>` — which
+        # is the same-width, same-line rewrite {BLOCK_EXPR} uses and keeps the line map out of the
+        # compiler's trim rules entirely. Left in place under `trim_mode: nil` they parse as Ruby's unary
+        # minus and cost the template its unit (87 of redmine's 506, measured after the block-expression
+        # fix and before this one).
+        TRIM_OPEN = /<%-/
+        private_constant :TRIM_OPEN
+
+        TRIM_CLOSE = /-%>/
+        private_constant :TRIM_CLOSE
+
+        # #1047 — a LAYOUT's `yield`. `<%= yield %>`, `<%= yield :sidebar %>` and `<% if content_for?(:x) %>`
+        # are what a layout is made of, and the first two are legal ERB and illegal Ruby anywhere outside a
+        # method body — so every layout's compiled source failed to parse and the file was declined (four of
+        # redmine's 506 templates, two of mastodon's 46; `docs/notes/20260917-erb-template-units.md` § 3).
+        #
+        # The seam deliberately does NOT wrap a unit's body in a synthesised method
+        # (`docs/internal-spec/macro-substrate.md` § Positions: wrapping would shift every line and compose
+        # a second line map onto the plugin's), so the fix is a rewrite of the TEMPLATE, in the same pre-pass
+        # {BLOCK_EXPR} and {TRIM_OPEN} live in: the `yield` KEYWORD inside an ERB tag becomes a call to
+        # {YIELD_METHOD}, an ordinary implicit-self method on the synthesised view context, declared in
+        # `sig/action_view.rbs` as returning `String`.
+        #
+        # Unlike the other two rewrites this one is NOT width-preserving, and it does not have to be: a unit
+        # whose `line_map` is non-empty reports at column 1 by construction
+        # ({Analysis::TemplateUnits#remap} — "the template's lines and the compiled Ruby's columns do not
+        # correspond"), so only the LINE count is load-bearing, and the replacement contains no newline.
+        #
+        # What the rewrite deliberately does not do is give the call a TYPE beyond `String`. Rails' `yield`
+        # returns whatever the inner template's buffer holds, and `yield :sidebar` returns the `content_for`
+        # buffer — an empty `SafeBuffer` when nothing was provided, never nil. A lenient `String` is the
+        # widest honest reading, and inventing anything narrower would be the `Parameters#[]` trap one
+        # layer up.
+        YIELD_METHOD = "__rigor_yield"
+
+        # The `yield` keyword, and only the keyword: not `foo.yield`, not `:yield`, not `@yield`, not
+        # `yielding`. A `yield` inside a STRING literal in a tag (`<%= t("yield") %>`) is rewritten too —
+        # the pre-pass is a Regexp over the tag, not a Ruby lexer — which changes a literal's bytes in a
+        # body that is never executed and that no rule reads the contents of. Recorded rather than guarded,
+        # because a lexer here would be a second Ruby parser to keep honest.
+        YIELD_KEYWORD = /(?<![A-Za-z0-9_.:@$])yield(?![A-Za-z0-9_?!])/
+        private_constant :YIELD_KEYWORD
+
+        # Any ERB tag, non-greedy and multi-line — the region {YIELD_KEYWORD} is applied inside, so a
+        # `yield` in the template's HTML text is left exactly as it was written. A `<%%` opener is ERB's
+        # escape for a LITERAL `<%` in the output, so what follows it is text too and is skipped.
+        ANY_TAG = /<%.*?%>/m
+        private_constant :ANY_TAG
+
+        # `<%= … %>` and `<%== … %>`, non-greedy and multi-line. No capture group: the block below reads
+        # the tag it was handed rather than `Regexp.last_match`, whose group is `String?` however sure
+        # the pattern makes it — and a rewrite that depends on global match state is the harder one to
+        # read anyway.
+        OUTPUT_TAG = /<%={1,2}(?!=).*?%>/m
+        private_constant :OUTPUT_TAG
+
+        # The `<%=` / `<%==` opener of a matched tag, which is all that gets rewritten.
+        OUTPUT_OPENER = /\A<%=+/
+        private_constant :OUTPUT_OPENER
+
+        module_function
+
+        # `[ruby_source, line_map, transform_id]` for one template's bytes. `text` must already be valid
+        # UTF-8 — {.scrub} is the caller's, because more than one thing reads the template and every one
+        # of them has to read the SAME bytes.
+        #
+        # `line_map` is `{ compiled line => template line }` for every template line, explicitly — NOT the
+        # empty "identity" map, even when the offset is zero. An empty map tells the engine the transform
+        # was byte-preserving and lets the compiled Ruby's COLUMNS through, and an ERB column names
+        # nothing in the template (`macro-substrate.md` § Positions).
+        def compile(text)
+          offset = line_offset
+          raise Unmappable, "#{transform_id} does not emit template lines one per compiled line" if offset.nil?
+
+          compiled = compile_source(normalize(text))
+          map = (1..template_line_count(text)).to_h { |line| [line + offset, line] }
+          [compiled, map, transform_id]
+        end
+
+        # A template's bytes as valid UTF-8. A `.erb` file is whatever the project committed, and an
+        # invalid byte is not a reason to refuse it: `ERB`, `Regexp#match?` and Prism all raise on one,
+        # so every reader has to be handed the same scrubbed String or they disagree about the file.
+        def scrub(source)
+          text = source.to_s.dup.force_encoding(Encoding::UTF_8)
+          return text if text.valid_encoding?
+
+          text.encode(Encoding::UTF_8, invalid: :replace, undef: :replace)
+        end
+
+        # The compiled Ruby for one template, through whichever compiler resolved.
+        def compile_source(text)
+          if erubi?
+            ::Erubi::Engine.new(text).src
+          else
+            ::ERB.new(text, trim_mode: nil).src
+          end
+        end
+
+        # Rewrites every block-opening output tag into a statement tag; see {BLOCK_EXPR}. Line- and
+        # width-preserving by construction: only the tag's `=` characters are replaced, by spaces.
+        def normalize(text)
+          normalize_block_expressions(normalize_yields(text.gsub(TRIM_OPEN, "<% ").gsub(TRIM_CLOSE, " %>")))
+        end
+
+        # Rewrites the `yield` keyword inside every ERB tag into a call on the view context; see
+        # {YIELD_METHOD}. Runs BEFORE {#normalize_block_expressions} so that pass reads the tag bodies it
+        # will actually hand to the compiler.
+        def normalize_yields(text)
+          return text unless text.match?(YIELD_KEYWORD)
+
+          text.gsub(ANY_TAG) { |tag| tag.start_with?("<%%") ? tag : tag.gsub(YIELD_KEYWORD, YIELD_METHOD) }
+        end
+
+        def normalize_block_expressions(text)
+          text.gsub(OUTPUT_TAG) do |tag|
+            opener = tag[OUTPUT_OPENER]
+            next tag if opener.nil?
+
+            body = tag[opener.length...-2].to_s
+            next tag unless body.match?(BLOCK_EXPR)
+
+            "<%#{' ' * (opener.length - 2)}#{body}%>"
+          end
+        end
+
+        # A template's last line may lack its newline; `String#lines` already counts it, and an EMPTY
+        # template has no lines at all and needs no rows.
+        def template_line_count(text)
+          text.lines.length
+        end
+
+        # How many compiled lines sit above the template's first line. Measured once per process per
+        # compiler — the answer cannot change under a loaded compiler, and the probe compile is cheap
+        # enough that memoising it is about tidiness rather than cost.
+        def line_offset
+          return @line_offset if defined?(@line_offset) && @line_offset
+
+          @line_offset = probe_offset
+        end
+
+        # `nil` when the loaded compiler does not step line-for-line.
+        def probe_offset
+          lines = compile_source(PROBE).lines
+          first = lines.index { |line| line.include?("RIGOR_ERB_PROBE_1") }
+          return nil if first.nil?
+
+          (2..3).each do |marker|
+            return nil unless lines[first + marker - 1]&.include?("RIGOR_ERB_PROBE_#{marker}")
+          end
+          first
+        end
+
+        # `erubi-1.13.1` / `erb-6.0.1.1` — the compiler's identity, which rides the unit digest.
+        def transform_id
+          @transform_id ||= if erubi?
+                              "erubi-#{::Erubi::VERSION}"
+                            else
+                              "erb-#{::ERB.const_defined?(:VERSION) ? ::ERB::VERSION : 'stdlib'}"
+                            end
+        end
+
+        # True once Erubi has been loaded out of the analysed project's bundle AND its line numbering has
+        # been measured. Resolved ONCE per process: a failed resolution is as memoised as a successful
+        # one, so a project without Erubi does not pay a `$LOAD_PATH` walk per template.
+        #
+        # `Isolation.require_with_target_bundle` is [ADR-90](../../../../../../docs/adr/90-target-library-resolution-from-project-bundle.md)'s
+        # path — Rigor's own gem env first, then the analysed project's bundle, `$LOAD_PATH` appended and
+        # only on a failed require. Erubi is not a Rigor dependency and is never added to one. Any load
+        # failure is equally "no Erubi here"; stdlib `ERB` answers the same question, so nothing is
+        # reported and nothing degrades but the compiler's name.
+        #
+        # A resolved Erubi that does NOT step line-for-line is **demoted** rather than trusted. Erubi pads
+        # its output to the template's line count deliberately (it is why a Rails backtrace can name
+        # `show.html.erb:12`), so the demotion is not expected to fire — but a compiler whose numbering
+        # the probe cannot confirm would silently report every finding in every template at the wrong
+        # line, and stdlib ERB is right here and always present.
+        def erubi?
+          return @erubi if defined?(@erubi)
+
+          @erubi = load_erubi
+          return @erubi unless @erubi
+          return true unless probe_offset.nil?
+
+          @erubi = false
+        end
+
+        def load_erubi
+          Isolation.require_with_target_bundle("erubi", Isolation.target_bundle_root)
+          defined?(::Erubi::Engine) ? true : false
+        rescue ::StandardError, ::LoadError
+          false
+        end
+
+        # Test seam: forget the probed offset, the resolved compiler and its id, so one process can measure
+        # both compilers. Never called by the plugin itself.
+        def reset!
+          remove_instance_variable(:@line_offset) if defined?(@line_offset)
+          remove_instance_variable(:@transform_id) if defined?(@transform_id)
+          remove_instance_variable(:@erubi) if defined?(@erubi)
+        end
+      end
+    end
+  end
+end