rigortype 0.3.9 → 0.4.1

data/lib/rigor/plugin/io_boundary.rb

@@ -43,10 +43,39 @@ module Rigor
     # - `#cache_descriptor` — flushes the accumulated entries into a fresh {Cache::Descriptor} for the
     #   contribution that built it. URL fetches contribute `ConfigEntry` rows keyed `"url:#{url}"` with the
     #   response body's SHA-256 so contributions invalidate when the remote document changes.
+    # - `#replay(descriptor)` — records a {Cache::Descriptor}'s rows as though this boundary had observed
+    #   them (#1558). A producer served from its own cache ran no block and read nothing, so
+    #   {Plugin::Base#cache_for} replays the served entry's stored dependency rows here; the run-result
+    #   descriptor and any enclosing producer's descriptor then carry the served value's inputs.
     class IoBoundary
       URL_TIMEOUT_SECONDS = 10
       URL_MAX_BYTES = 10 * 1024 * 1024
 
+      ATTRIBUTION_KEY = :rigor_io_boundary_attribution
+      private_constant :ATTRIBUTION_KEY
+
+      # ADR-45 WD2 (#1507) — runs the block with `sink` (an Array) receiving every file and listing row ANY
+      # boundary records on this thread meanwhile, in addition to the boundary's own table, and returns the
+      # block's value. `Analysis::Runner` wraps each file's analysis in one when it records dependencies, so the
+      # `--incremental` session can keep the reads one file's analysis made beside that file's cached answer: a
+      # later run that serves the answer without re-analysing the file still has to validate what it read.
+      #
+      # A thread variable rather than a fiber-local, so a read a plugin makes from inside an `Enumerator` still
+      # lands in the sink. The boundary's own table is unchanged by it, including its first-existence-row-stands
+      # rule: the sink records what each read observed. Only reads are credited: a value a plugin memoised reaches
+      # later files without one, so the first file to trigger the read is the only one credited with it.
+      def self.attributing(sink)
+        previous = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, sink)
+        yield
+      ensure
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, previous)
+      end
+
+      def self.attribute(entry)
+        Thread.current.thread_variable_get(ATTRIBUTION_KEY)&.push(entry)
+      end
+
       attr_reader :policy, :plugin_id
 
       def initialize(policy:, plugin_id:, http_client: DefaultHttpClient.new)
@@ -61,7 +90,7 @@ module Rigor
         @first_refused_path = nil
       end
 
-      # Issue #959 — `TrustPolicy#allow_read?` refuses a path purely by `File.expand_path` comparison
+      # Issue #959 — `TrustPolicy#allow_read?` refuses a path purely by `File.absolute_path` comparison
       # (ADR-2's documented bound; no `File.realpath`), so a project rooted under a symlink (macOS'
       # `/tmp` → `/private/tmp` alias is the common case) can have every plugin read refused with no
       # visible cause: the boundary answered "not readable" and the plugin swallowed or surfaced only its
@@ -96,7 +125,7 @@ module Rigor
       # outcome is recorded: a path that exists but cannot be read (`EISDIR`, `EACCES`) is a failure the
       # plugin reports, not a probe of absence, and records nothing — as before.
       def read_file(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
           raise AccessDeniedError.new(
@@ -159,7 +188,7 @@ module Rigor
       # @param path — project directory; relative paths expand against the working directory
       # @return the absolute paths directly under `path` in `Dir.glob` order; empty when not a directory
       def list_directory(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         entries = Dir.glob(File.join(absolute, "*"))
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
@@ -202,8 +231,53 @@ module Rigor
         Cache::Descriptor.new(files: files, configs: configs, globs: globs)
       end
 
+      # #1558 — records every row of `descriptor` as though this boundary had observed it. The caller is
+      # {Plugin::Base#cache_for}: a producer served from its own cache ran no block, so without the replay
+      # the value's inputs reached neither the ADR-45 run-result descriptor nor the dependency descriptor of
+      # a producer computing around it, and both went on validating fresh after those inputs changed.
+      #
+      # The rows are the ones a fresh hit just validated, so they describe the current filesystem, and they
+      # are merged by the precedence the live recorders use. A content row (`:stat` / `:digest` / `:mtime`)
+      # replaces an existence row for its path, as {#read_file} does after a probe. Any other collision
+      # keeps the row already here: an existence row never displaces one, as in {#probe}, and between two
+      # content rows or two glob rows for one slot the live row carries the newer stat tuple, which keeps
+      # the next warm run on its stat fast path. The tables are keyed by path, glob slot and URL key, so
+      # replaying the same descriptor twice adds nothing. Row order reaches no cache key, because
+      # {Cache::Descriptor#to_canonical_hash} sorts every slot.
+      #
+      # The policy is not consulted: the rows were recorded under it when the entry was written, and replay
+      # reads no file. A {Cache::Descriptor::GlobEntry} keeps its `mode`, which is part of its slot key.
+      #
+      # ADR-45 WD2 (#1507) — every replayed row is also handed to the {.attributing} sink, the ones a held row
+      # wins over included, exactly as the live recorders hand over what each read observed: a producer first
+      # asked while a file is analysed (rigor-actionpack's `:controller_index`, rigor-rails-i18n's
+      # `:locale_index`) serves that file its inputs, and the `--incremental` slot must credit them to it. On a
+      # miss the replayed descriptor is the whole boundary's ({Plugin::Base#producer_dependency_descriptor}), so
+      # the file is also credited with rows other reads recorded; that over-credits, which only ever makes the
+      # slot decline sooner.
+      #
+      # @param descriptor — a dependency descriptor; only its `files`, `configs` and `globs` slots are read,
+      #   the only slots a boundary records
+      def replay(descriptor)
+        @mutex.synchronize do
+          descriptor.files.each { |entry| replay_file_entry(entry) }
+          descriptor.configs.each { |entry| @config_entries[entry.key] ||= entry }
+          descriptor.globs.each { |entry| @glob_entries[entry.slot_key] ||= entry }
+        end
+        (descriptor.files + descriptor.globs).each { |entry| self.class.attribute(entry) }
+        nil
+      end
+
       private
 
+      # The {#replay} precedence for one file row; the caller holds `@mutex`.
+      def replay_file_entry(entry)
+        current = @file_entries[entry.path]
+        return if current && !(current.comparator == :exists && entry.comparator != :exists)
+
+        @file_entries[entry.path] = entry
+      end
+
       # ADR-45 WD1b (#613) — the shared body of {#file?} / {#directory?}.
       #
       # The probe answers TRUTHFULLY for every path, in or out of the trusted-read scope, and never raises:
@@ -222,7 +296,7 @@ module Rigor
       #   reverse) → NOTHING, the same bound `#read_file` pins for `EISDIR`: the probe observed neither a
       #   usable file nor an absence, and either row would misdescribe what the plugin saw.
       def probe(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         answer = yield(absolute)
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
@@ -247,6 +321,7 @@ module Rigor
         # A content row replaces an earlier existence row for the same path outright: the file appeared and
         # its bytes were consumed, and a content row validates existence as well as content.
         @mutex.synchronize { @file_entries[path] = entry }
+        self.class.attribute(entry)
       end
 
       # ADR-45 WD1 (#577) — the absence row for a probed-but-missing path. A content row already recorded
@@ -263,6 +338,7 @@ module Rigor
       def record_absence_entry(path)
         entry = Cache::Descriptor::FileEntry.absent(path: path)
         @mutex.synchronize { @file_entries[path] ||= entry }
+        self.class.attribute(entry)
       end
 
       # ADR-45 WD1b (#613) — the presence row: fresh while the probed path exists, stale once it is gone.
@@ -273,6 +349,7 @@ module Rigor
       def record_presence_entry(path)
         entry = Cache::Descriptor::FileEntry.present(path: path)
         @mutex.synchronize { @file_entries[path] ||= entry }
+        self.class.attribute(entry)
       end
 
       # ADR-45 WD1c (#629) — the listing row for {#list_directory}, deduplicated per (root, pattern) slot.
@@ -281,6 +358,7 @@ module Rigor
       def record_glob_entry(root, pattern)
         entry = Cache::Descriptor::GlobEntry.compute(root: root, pattern: pattern)
         @mutex.synchronize { @glob_entries[entry.slot_key] = entry }
+        self.class.attribute(entry)
       end
 
       # Issue #959 — records that `path` fell outside every {TrustPolicy} read root, for {#refusal_summary}.

data/lib/rigor/plugin/isolation.rb

@@ -47,7 +47,7 @@ module Rigor
       # build resolves the same root and skips the write — #414), and reading an unshareable value out of
       # a module ivar from a non-main Ractor is the same `Ractor::IsolationError` as writing one.
       def target_bundle_root=(root)
-        @target_bundle_root = root.nil? ? nil : File.expand_path(root.to_s).freeze
+        @target_bundle_root = root.nil? ? nil : File.absolute_path(root.to_s).freeze
       end
 
       # Requires `feature`, falling back to the analyzed project's bundler install tree. The fallback

data/lib/rigor/plugin/loader.rb

@@ -35,13 +35,14 @@ module Rigor
         suffix = "/#{gem_name}.rb"
         $LOADED_FEATURES.rfind { |feature| feature.end_with?(suffix) }
       end
+      Ractor.make_shareable(FEATURE_RESOLVER)
 
       # #194 slice 2 (ADR-93 WD5) — the engine's own root, anchored from THIS file's location: the loader
       # lives at `<root>/lib/rigor/plugin/loader.rb`, so three levels up is the engine root. It resolves
       # identically in a git checkout and inside an installed `rigortype` gem, because the gem packages the
       # `plugins/` tree at the same relative path — which is exactly what makes it a trustworthy anchor for
       # the engine's own bundled plugin copies.
-      ENGINE_ROOT = File.expand_path("../../..", __dir__)
+      ENGINE_ROOT = File.expand_path("../../..", __dir__).freeze
 
       # @param requirer — takes a gem name OR an absolute file path (#194 slice 2 — a bundled plugin is
       #   required by its {.bundled_plugin_path}) and returns truthy on successful require. Defaulted to

data/lib/rigor/plugin/macro/block_as_method.rb

@@ -36,9 +36,14 @@ module Rigor
       # - `method_names` — Array of Symbol method names. A call shape `<receiver_subclass>.get('/path') { ... }`
       #   matches when `:get` is in this list. (Named `verbs:` before ADR-60 WD2 normalised the macro
       #   value-object vocabulary.)
-      # - `self_type` — Symbol selecting the kind of `self`-binding the substrate applies inside the block.
-      #   Slice 1a accepts only `:receiver_instance` (the block runs as an instance method of the receiver
-      #   class). Other kinds (`:receiver_singleton`, `:dsl_recorder`) are reserved for later slices.
+      # - `self_type` — the `self`-binding the substrate applies inside the block. `:receiver_instance`
+      #   (the default) types `self` as an instance of the receiver class — the Sinatra contract. A String
+      #   binds `self` to a *named* class instead of the receiver: `"Grape::Endpoint"` binds
+      #   `Nominal[Grape::Endpoint]` (the block is `instance_eval`'d on an instance of that class, e.g. a
+      #   route body on `Grape::Endpoint`), and `"singleton(Grape::API::Instance)"` binds
+      #   `Singleton[Grape::API::Instance]` (the block is `instance_eval`'d on that *class object*, e.g.
+      #   a `namespace` body on `Grape::API::Instance`). Reserved Symbol names (`:receiver_singleton`,
+      #   `:dsl_recorder`) remain unaccepted.
       #
       # ## Ractor-shareability
       #
@@ -48,6 +53,13 @@ module Rigor
         SELF_TYPE_RECEIVER_INSTANCE = :receiver_instance
         VALID_SELF_TYPES = [SELF_TYPE_RECEIVER_INSTANCE].freeze
 
+        CLASS_NAME_PATTERN = /[A-Z]\w*(?:::[A-Z]\w*)*/
+        # `self_type: "Foo::Bar"` — the block is `instance_eval`'d on an instance of `Foo::Bar`.
+        NAMED_SELF_TYPE_PATTERN = /\A#{CLASS_NAME_PATTERN}\z/
+        # `self_type: "singleton(Foo::Bar)"` — the block is `instance_eval`'d on the `Foo::Bar` class
+        # object itself (Grape's `namespace`/`route_param` bodies run on `Grape::API::Instance`).
+        SINGLETON_SELF_TYPE_PATTERN = /\Asingleton\((#{CLASS_NAME_PATTERN})\)\z/
+
         attr_reader :receiver_constraint, :method_names, :self_type
 
         def initialize(receiver_constraint:, method_names:, self_type: SELF_TYPE_RECEIVER_INSTANCE)
@@ -57,7 +69,7 @@ module Rigor
 
           @receiver_constraint = receiver_constraint.dup.freeze
           @method_names = method_names.map(&:to_sym).freeze
-          @self_type = self_type
+          @self_type = self_type.is_a?(String) ? self_type.dup.freeze : self_type
           freeze
         end
 
@@ -81,6 +93,31 @@ module Rigor
           [receiver_constraint, method_names, self_type].hash
         end
 
+        # The class name a String `self_type` binds `self` to — `"Foo::Bar"` for both the plain and the
+        # `singleton(Foo::Bar)` form — or `nil` for `:receiver_instance`.
+        def self_type_name
+          return nil unless self_type.is_a?(String)
+
+          self_type[SINGLETON_SELF_TYPE_PATTERN, 1] || self_type
+        end
+
+        # Whether a String `self_type` binds the *class object* (`"singleton(Foo::Bar)"`) rather than an
+        # instance (`"Foo::Bar"`). Nominal-receiver call sites only match instance-binding entries —
+        # a `singleton(...)` binding exists solely for `instance_eval`-on-class contracts, which always
+        # surface as `Singleton[X]` receivers.
+        def singleton_binding?
+          self_type.is_a?(String) && self_type.match?(SINGLETON_SELF_TYPE_PATTERN)
+        end
+
+        # Whether `self_type` names a class whose *instance* the block is `instance_eval`'d on
+        # (`"Foo::Bar"`). These entries are the only ones that also match `Nominal[Y]` receivers: inside
+        # an already-narrowed `instance_eval` body (`self : Nominal[ParamsScope]`), a nested call on
+        # `self` re-enters the same context. `:receiver_instance` keeps its original Singleton-only
+        # contract — a nominal receiver calling a class-level verb is a different (unmodelled) shape.
+        def named_instance_binding?
+          self_type.is_a?(String) && !singleton_binding?
+        end
+
         private
 
         def validate_receiver_constraint!(value)
@@ -108,10 +145,12 @@ module Rigor
 
         def validate_self_type!(self_type)
           return if VALID_SELF_TYPES.include?(self_type)
+          return if self_type.is_a?(String) &&
+                    (self_type.match?(NAMED_SELF_TYPE_PATTERN) || self_type.match?(SINGLETON_SELF_TYPE_PATTERN))
 
           raise ArgumentError,
-                "Plugin::Macro::BlockAsMethod#self_type must be one of #{VALID_SELF_TYPES.inspect}, " \
-                "got #{self_type.inspect}"
+                "Plugin::Macro::BlockAsMethod#self_type must be one of #{VALID_SELF_TYPES.inspect} " \
+                "or a class-name String ('Foo::Bar' / 'singleton(Foo::Bar)'), got #{self_type.inspect}"
         end
       end
     end

data/lib/rigor/plugin/manifest.rb

@@ -49,23 +49,32 @@ module Rigor
       attr_reader :target_gems
 
       attr_reader :id, :version, :description, :config_schema, :config_defaults, :produces, :consumes,
-                  :owns_receivers, :open_receivers, :type_node_resolvers, :block_as_methods,
+                  :owns_receivers, :open_receivers, :rbs_complete_ancestors, :rbs_complete_extends,
+                  :type_node_resolvers,
+                  :block_as_methods,
                   :heredoc_templates, :nested_class_templates, :trait_registries,
                   :hkt_registrations, :hkt_definitions, :signature_paths, :protocol_contracts,
                   :source_rbs_synthesizer, :additional_initializers,
                   :effect_root, :effect_labels, :effect_attributions, :effect_edges, :effect_entry_points,
                   :effect_ancestry
 
-      def initialize( # rubocop:disable Metrics/ParameterLists
+      # #392 — the project-relative globs whose files this plugin compiles into {TemplateUnit}s. Purely a
+      # CLAIM: the engine globs these, reads each match's bytes and offers them to
+      # {Base#template_units_for_file}, which is where the transform itself lives. A plugin declaring none
+      # is never asked, and a run whose plugins declare none does no extra globbing at all.
+      attr_reader :template_globs
+
+      def initialize( # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
         id:, version:,
         description: nil, config_schema: {}, target_gems: [],
-        produces: [], consumes: [], owns_receivers: [], open_receivers: [], type_node_resolvers: [],
+        produces: [], consumes: [], owns_receivers: [], open_receivers: [], rbs_complete_ancestors: [],
+        rbs_complete_extends: [], type_node_resolvers: [],
         block_as_methods: [], heredoc_templates: [], nested_class_templates: [],
         trait_registries: [],
         hkt_registrations: [], hkt_definitions: [], signature_paths: [], protocol_contracts: [],
         source_rbs_synthesizer: nil, additional_initializers: [],
         effect_root: nil, effect_labels: [], effect_attributions: [], effect_edges: [],
-        effect_entry_points: [], effect_ancestry: []
+        effect_entry_points: [], effect_ancestry: [], template_globs: []
       )
         validate_id!(id)
         validate_version!(version)
@@ -74,6 +83,8 @@ module Rigor
         validate_target_gems!(target_gems)
         validate_owns_receivers!(owns_receivers)
         validate_open_receivers!(open_receivers)
+        validate_rbs_complete_ancestors!(rbs_complete_ancestors)
+        validate_rbs_complete_extends!(rbs_complete_extends)
         validate_type_node_resolvers!(type_node_resolvers)
         validate_block_as_methods!(block_as_methods)
         validate_heredoc_templates!(heredoc_templates)
@@ -93,10 +104,11 @@ module Rigor
                       hkt_registrations, hkt_definitions, signature_paths, protocol_contracts,
                       source_rbs_synthesizer)
         assign_target_gems(target_gems)
+        assign_rbs_complete_ancestors(rbs_complete_ancestors, rbs_complete_extends)
         assign_nested_class_templates(nested_class_templates)
         assign_additional_initializers(additional_initializers)
         assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges,
-                             effect_entry_points, effect_ancestry)
+                             effect_entry_points, effect_ancestry, template_globs)
         freeze
       end
 
@@ -133,6 +145,13 @@ module Rigor
       end
       private :assign_target_gems
 
+      # ADR-43 WD4 — assigned outside assign_fields (which already carries the maximum positional arity).
+      def assign_rbs_complete_ancestors(rbs_complete_ancestors, rbs_complete_extends)
+        @rbs_complete_ancestors = rbs_complete_ancestors.map { |c| c.to_s.dup.freeze }.freeze
+        @rbs_complete_extends = rbs_complete_extends.map { |c| c.to_s.dup.freeze }.freeze
+      end
+      private :assign_rbs_complete_ancestors
+
       # Assigned outside assign_fields (which already carries the maximum positional arity) — set in
       # `initialize` before the final freeze. ADR-36 nested-class emission tier.
       def assign_nested_class_templates(nested_class_templates)
@@ -162,15 +181,27 @@ module Rigor
       private :validate_effect_fields!
 
       def assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges,
-                               effect_entry_points, effect_ancestry)
+                               effect_entry_points, effect_ancestry, template_globs)
         @effect_root = effect_root.nil? ? nil : effect_root.to_s.dup.freeze
         @effect_labels = effect_labels.map { |label| label.to_s.dup.freeze }.uniq.sort.freeze
         @effect_attributions = effect_attributions.dup.freeze
         @effect_edges = effect_edges.dup.freeze
         @effect_entry_points = effect_entry_points.dup.freeze
         @effect_ancestry = effect_ancestry.dup.freeze
+        assign_template_globs(template_globs)
       end
       private :assign_effect_fields
+
+      # #392 — a glob is a String, and an absolute one is refused: a template unit is a project file, and
+      # a plugin reaching outside the project root is the trust boundary ADR-2 § "Plugin Trust and I/O
+      # Policy" draws. Validated and assigned in one call, because `#initialize` is at its line budget.
+      def assign_template_globs(globs)
+        validate_array_of!("template_globs", globs, "non-empty relative glob Strings") do |glob|
+          glob.is_a?(String) && !glob.empty? && !glob.start_with?("/") && !glob.include?("..")
+        end
+        @template_globs = globs.map { |glob| glob.to_s.dup.freeze }.uniq.freeze
+      end
+      private :assign_template_globs
       # rubocop:enable Metrics/ParameterLists, Metrics/AbcSize
 
       public
@@ -196,7 +227,7 @@ module Rigor
         errors
       end
 
-      def to_h # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      def to_h # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/MethodLength
         {
           "id" => id,
           "version" => version,
@@ -208,6 +239,8 @@ module Rigor
           "consumes" => consumes.map { |c| consumption_hash(c) },
           "owns_receivers" => owns_receivers,
           "open_receivers" => open_receivers,
+          "rbs_complete_ancestors" => rbs_complete_ancestors,
+          "rbs_complete_extends" => rbs_complete_extends,
           "type_node_resolvers" => type_node_resolvers.map { |r| r.class.name },
           "block_as_methods" => block_as_methods.map(&:to_h),
           "heredoc_templates" => heredoc_templates.map(&:to_h),
@@ -224,7 +257,8 @@ module Rigor
           "effect_attributions" => effect_attributions.map(&:to_h),
           "effect_edges" => effect_edges.map(&:to_h),
           "effect_entry_points" => effect_entry_points.map(&:to_h),
-          "effect_ancestry" => effect_ancestry.map(&:to_h)
+          "effect_ancestry" => effect_ancestry.map(&:to_h),
+          "template_globs" => template_globs
         }
       end
 
@@ -233,10 +267,11 @@ module Rigor
       # otherwise. A third-party plugin's `effect_root:` is ignored here (and warned about by the registry),
       # so it opens only the root named after itself.
       def effect_owner
-        return id if effect_root.nil?
+        root = effect_root
+        return id if root.nil?
         return id unless FirstParty.bundled?(id)
 
-        effect_root
+        root
       end
 
       # Whether this plugin's `effect_attributions:` may carry `discharge: true` (ADR-103 WD6).
@@ -388,6 +423,32 @@ module Rigor
         validate_array_of!("open_receivers", open_receivers, "non-empty String") { |c| c.is_a?(String) && !c.empty? }
       end
 
+      # ADR-43 WD4 — `rbs_complete_ancestors:` declares the class names this plugin's bundled RBS covers
+      # COMPLETELY: a method call the signature does not declare is genuinely absent at runtime. A
+      # Ruby-source subclass of a listed class may then bridge inherited calls to the ancestor's RBS
+      # (the ADR-43 allow-list's manifest-declared half). The dual of `open_receivers:` — that field
+      # marks a class open to suppress diagnostics on an unbounded surface; this one marks a class
+      # closed to ENABLE them on subclasses. Listing a class whose signature is partial would turn
+      # every omitted inherited method into a `call.undefined-method` false positive on subclass
+      # receivers, so only classes the plugin's `signature_paths:` declares exhaustively belong here.
+      def validate_rbs_complete_ancestors!(rbs_complete_ancestors)
+        validate_array_of!("rbs_complete_ancestors", rbs_complete_ancestors, "non-empty String") do |c|
+          c.is_a?(String) && !c.empty?
+        end
+      end
+
+      # `rbs_complete_extends:` is the extend-edge twin of `rbs_complete_ancestors:` (ADR-43 WD4): it names
+      # the MODULES whose bundled RBS instance surface is complete, so a project `extend M` in a class or
+      # module body lets singleton-side calls on that class resolve M's declared instance methods
+      # (`class F; extend T::Sig; sig { ... }; end` reaching `T::Sig#sig`). Same completeness rule: a
+      # module whose declared surface is partial does not belong here — the extend edge would misreport
+      # real calls as `call.undefined-method`.
+      def validate_rbs_complete_extends!(rbs_complete_extends)
+        validate_array_of!("rbs_complete_extends", rbs_complete_extends, "non-empty String") do |c|
+          c.is_a?(String) && !c.empty?
+        end
+      end
+
       # ADR-13 slice 2 — `type_node_resolvers:` declares the plugin-supplied `TypeNodeResolver` instances the
       # parser consults (in slice 3) when an RBS::Extended payload's named- or generic-type head misses the
       # built-in registry. Slice 2 carries the declarations on the manifest and the registry exposes them in

data/lib/rigor/plugin/registry.rb

@@ -373,6 +373,30 @@ module Rigor
         @open_receivers_set.include?(class_name.to_s)
       end
 
+      # ADR-43 WD4 — the aggregate set of "RBS-complete ancestor" class names declared across loaded
+      # plugins (manifest `rbs_complete_ancestors:`). `RbsDispatch`'s inherited-call bridge consults it
+      # alongside the engine's own allow-list: a Ruby-source subclass of a listed class resolves
+      # inherited calls against the ancestor's RBS, and the signature-reading rules apply to them.
+      attr_reader :rbs_complete_ancestors
+
+      def rbs_complete_ancestor?(class_name)
+        return false if class_name.nil?
+
+        @rbs_complete_ancestors_set.include?(class_name.to_s)
+      end
+
+      # The extend-edge twin of `rbs_complete_ancestors` — the aggregate set of module names declared via
+      # manifest `rbs_complete_extends:`. `RbsDispatch`'s singleton bridge consults it for `extend M`
+      # edges in project source: `class F; extend T::Sig; sig { ... }; end` resolves `sig` through
+      # `T::Sig`'s bundled RBS instance surface.
+      attr_reader :rbs_complete_extends
+
+      def rbs_complete_extends?(class_name)
+        return false if class_name.nil?
+
+        @rbs_complete_extends_set.include?(class_name.to_s)
+      end
+
       # ADR-28 — flat, ordered list of every loaded plugin's path-scoped method-protocol contracts, in
       # plugin registration order. Read from each plugin's `#protocol_contracts` (which the manifest backs
       # by default but a plugin MAY override to fold in per-project config). Consumed by
@@ -435,14 +459,24 @@ module Rigor
       #   nil where {#guarded_manifest} caught a raising manifest read.
       def compile_aggregates(manifests)
         @additional_initializers = manifests.flat_map { |m| m&.additional_initializers || [] }.freeze
-        @open_receivers = manifests.flat_map { |m| (m&.open_receivers || []).map(&:to_s) }.uniq.freeze
+        @open_receivers = aggregate_class_names(manifests, :open_receivers)
         @open_receivers_set = @open_receivers.to_set.freeze
+        @rbs_complete_ancestors = aggregate_class_names(manifests, :rbs_complete_ancestors)
+        @rbs_complete_ancestors_set = @rbs_complete_ancestors.to_set.freeze
+        @rbs_complete_extends = aggregate_class_names(manifests, :rbs_complete_extends)
+        @rbs_complete_extends_set = @rbs_complete_extends.to_set.freeze
         @type_node_resolvers = manifests.flat_map { |m| m&.type_node_resolvers || [] }.freeze
         @protocol_contracts = @plugins.flat_map { |p| safe_protocol_contracts(p) }.freeze
         @contracts_by_path = {}
         @effect_memo = {}
       end
 
+      # The shared shape of `open_receivers:` / `rbs_complete_ancestors:` — a flat uniq'd class-name list
+      # aggregated across manifests, each entry normalised to String.
+      def aggregate_class_names(manifests, field)
+        manifests.flat_map { |m| (m&.public_send(field) || []).map(&:to_s) }.uniq.freeze
+      end
+
       # Fail-soft per plugin: a plugin whose `effect_attributions:` override raises (a missing
       # `config/application.rb`, an unreadable path) contributes nothing rather than taking the run down.
       # An effect contribution is an enrichment; ADR-2 isolates plugin failures at the analyzer boundary

data/lib/rigor/plugin/source_rbs_synthesis_reporter.rb

@@ -21,7 +21,12 @@ module Rigor
       # dropping an annotation it parsed. They are not the same news — the first says the file contributed
       # nothing, the second that it contributed all but one thing — so they carry distinct diagnostic ids.
       # Defaults to `:failed`, the pre-WD12 meaning, so an older caller records what it always did.
-      Entry = Data.define(:plugin_id, :path, :message, :kind)
+      #
+      # `:contradiction` (ADR-112 WD5, issue #1075) is the consistency rule's error: a member two sources
+      # declare in ways that contradict, or a refinement outside its own declared type. It is the one kind
+      # positioned at a real line (`line`, nil for every other kind), because it usually sits in a `.rbs`
+      # file whose positions are exact; the others are file-level rows at line 1.
+      Entry = Data.define(:plugin_id, :path, :message, :kind, :line)
 
       def initialize
         @entries = []
@@ -34,12 +39,13 @@ module Rigor
       # file list and then drains each worker's stream into this one reporter, so without the dedup a
       # `--workers N` run printed N copies of a row a `--workers=0` run printed once. The same collapse the
       # {RbsExtended::Reporter} drain documents, for the same reason.
-      def record(plugin_id:, path:, message:, kind: :failed)
+      def record(plugin_id:, path:, message:, kind: :failed, line: nil)
         entry = Entry.new(
           plugin_id: plugin_id.to_s.dup.freeze,
           path: path.to_s.dup.freeze,
           message: message.to_s.dup.freeze,
-          kind: kind
+          kind: kind,
+          line: line
         )
         return nil if @seen.key?(entry)