rigortype 0.3.9 → 0.4.1

data/lib/rigor/plugin/template_unit.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Rigor
+  module Plugin
+    # One **template unit** — a non-Ruby source file a plugin compiled into Ruby, handed to the engine to
+    # be parsed and typed like a file (ADR-16 Tier D, revived by #392 as this seam; design note
+    # `docs/design/20260816-effect-labels.md` § 11.3).
+    #
+    # ADR-16's Tier D declared `external_files:` — "files evaluated as if their body were pasted at a
+    # declared call site, with `self` typed as a declared class" — and ADR-60 WD1 removed it for want of a
+    # consumer. What Tier D lacked, and what this carries, is a **source transform with a line map** ahead
+    # of parsing: the file on disk is not Ruby, so the engine analyses `ruby_source` and reports at the
+    # template's own lines.
+    #
+    # A unit is pure data. The plugin's transform runs ONCE, on the parent, before any analysis; nothing
+    # here is a callable, so the unit survives `Marshal` into a fork-pool worker exactly as the macro
+    # substrate's value objects do.
+    #
+    # - `logical_name` — the name the unit is keyed by, independent of the handler: `users/show.html`, not
+    #   `users/show.html.erb`. Becomes the `view:<logical_name>` effect-unit key, so an ERB → Haml rewrite
+    #   is not a rename.
+    # - `path` — the template file as the user wrote it. Every diagnostic and every source trace names it.
+    # - `ruby_source` — the compiled Ruby the engine parses.
+    # - `line_map` — `{ ruby_source line => template line }`, 1-based. A line the map does not mention
+    #   anchors at the nearest mapped line before it, and at line 1 when there is none. **An EMPTY map is
+    #   the identity, not "no positions"**: every compiled line reports at its own number and the columns
+    #   pass through untouched. That is correct only for a transform that emits nothing the template did
+    #   not contain — a transform that prepends so much as one preamble line and omits the map reports
+    #   every finding off by that many lines. Omit it only for a byte-preserving transform.
+    # - `self_type` — the fully-qualified class the body's `self` is typed as, or nil for a bare body.
+    # - `locals` — `{ name => type name }`, the parameters the render site passes.
+    # - `ivar_seeds` — `{ "@name" => type name }`, the assigns the rendering action set.
+    # - `transform_id` — the compiler's identity (`"erubi-1.13"`). Joins the unit digest, so re-compiling
+    #   with a different compiler re-analyses. Defaults to the declaring plugin's `id@version`.
+    #
+    # - `suppressed_rules` — rule-id PREFIXES the engine drops for this unit's diagnostics (#393). The
+    #   per-unit rule posture: a compiled template is not code the user wrote, and a plugin that knows its
+    #   compiler's idioms is the only party that can say which families of finding are meaningful there.
+    #   `["call."]` is what an ERB plugin declares while the synthesised receivers are still coarse — the
+    #   unit still contributes its EFFECTS, which is what the view layer is analysed for first, without
+    #   the typing half costing the project a diagnostic per line. Empty means "report everything", which
+    #   is what a plugin whose synthesis it trusts should declare.
+    #
+    # A type name that resolves to nothing is not an error here: the engine falls back to `Dynamic`, which
+    # taints honestly rather than fabricating a type the plugin could not justify (ADR-5).
+    class TemplateUnit
+      # Bumped whenever the engine changes what it synthesises from a unit — the seeding rules, the
+      # scope binding, the effect-unit key spelling. It rides the unit digest, so a change here
+      # invalidates every cached run that analysed a unit, exactly as a changed transform does.
+      SYNTHESIS_VERSION = 2
+
+      # The prefix an effect-unit key carries for a template unit. Deliberately not a {Effects::MethodKey}
+      # shape: a view has no owner class and no selector, and spelling one would put a method in the
+      # snapshot that no call site can name.
+      KEY_PREFIX = "view:"
+
+      IVAR_NAME = /\A@[A-Za-z_][A-Za-z0-9_]*\z/
+      private_constant :IVAR_NAME
+
+      LOCAL_NAME = /\A[a-z_][A-Za-z0-9_]*\z/
+      private_constant :LOCAL_NAME
+
+      # A rule prefix is a dotted family (`call.`) or a whole rule id (`call.undefined-method`); the match
+      # is `String#start_with?`, so the former covers the latter. A bare `""` would suppress the unit
+      # entirely and is refused.
+      RULE_PREFIX = /\A[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*\.?\z/
+      private_constant :RULE_PREFIX
+
+      attr_reader :logical_name, :path, :ruby_source, :line_map, :self_type, :locals, :ivar_seeds,
+                  :transform_id, :suppressed_rules
+
+      # Every field is one declared property of the unit; grouping them behind a context object would only
+      # move the same list into a second value class.
+      def initialize(logical_name:, path:, ruby_source:, line_map: {}, self_type: nil, locals: {}, # rubocop:disable Metrics/ParameterLists
+                     ivar_seeds: {}, transform_id: nil, suppressed_rules: [])
+        @logical_name = validate_string!("logical_name", logical_name)
+        @path = validate_string!("path", path)
+        @ruby_source = validate_source!(ruby_source)
+        @line_map = validate_line_map!(line_map)
+        @self_type = self_type.nil? ? nil : validate_string!("self_type", self_type)
+        @locals = validate_bindings!("locals", locals, LOCAL_NAME)
+        @ivar_seeds = validate_bindings!("ivar_seeds", ivar_seeds, IVAR_NAME)
+        @transform_id = transform_id.nil? ? nil : validate_string!("transform_id", transform_id)
+        @suppressed_rules = validate_rule_prefixes!(suppressed_rules)
+        freeze
+      end
+
+      # The effect-unit key and the snapshot key: `view:users/show.html`.
+      def unit_key
+        "#{KEY_PREFIX}#{@logical_name}"
+      end
+
+      # The unit's cache identity — **source bytes + transform id + synthesis version**, the triple
+      # `docs/internal-spec/cache.md` § computed-value keys asks a synthesised input to carry. The
+      # template's own bytes are deliberately NOT in it: the engine analyses `ruby_source`, and two
+      # templates that compile to the same Ruby have the same answer.
+      #
+      # @param fallback_transform_id — the declaring plugin's `id@version`, used when the unit
+      #   named no transform of its own.
+      def digest(fallback_transform_id = nil)
+        Digest::SHA256.hexdigest(
+          [
+            "source:#{@ruby_source}",
+            "transform:#{@transform_id || fallback_transform_id || 'unknown'}",
+            "suppressed:#{@suppressed_rules.join(',')}",
+            "synthesis:#{SYNTHESIS_VERSION}"
+          ].join("\x00")
+        )
+      end
+
+      # The template line a `ruby_source` line reports at. Falls back to the nearest mapped line before it
+      # — a synthesised prologue or a buffer-append the compiler emitted between two template lines still
+      # points into the template rather than past its end — and to line 1 when the map says nothing at all.
+      def template_line(ruby_line)
+        return ruby_line if @line_map.empty?
+        return @line_map[ruby_line] if @line_map.key?(ruby_line)
+
+        before = @line_map.keys.select { |line| line < ruby_line }
+        before.empty? ? 1 : @line_map[before.max]
+      end
+
+      def to_h
+        {
+          "logical_name" => @logical_name, "path" => @path, "ruby_source" => @ruby_source,
+          "line_map" => @line_map, "self_type" => @self_type, "locals" => @locals,
+          "ivar_seeds" => @ivar_seeds, "transform_id" => @transform_id,
+          "suppressed_rules" => @suppressed_rules
+        }
+      end
+
+      def ==(other)
+        other.is_a?(TemplateUnit) && other.to_h == to_h
+      end
+      alias eql? ==
+
+      def hash
+        [self.class, to_h].hash
+      end
+
+      private
+
+      def validate_string!(field, value)
+        text = value.to_s
+        raise ArgumentError, "TemplateUnit #{field} must be a non-empty String" if text.empty?
+
+        text.dup.freeze
+      end
+
+      def validate_source!(value)
+        raise ArgumentError, "TemplateUnit ruby_source must be a String" unless value.is_a?(String)
+
+        value.dup.freeze
+      end
+
+      # 1-based on both sides. A zero or negative line is a compiler bug the engine would turn into a
+      # diagnostic positioned off the top of the file, so it is refused at construction.
+      def validate_line_map!(value)
+        raise ArgumentError, "TemplateUnit line_map must be a Hash" unless value.is_a?(Hash)
+
+        value.to_h do |from, to|
+          unless from.is_a?(Integer) && to.is_a?(Integer) && from.positive? && to.positive?
+            raise ArgumentError, "TemplateUnit line_map must map positive Integer to positive Integer"
+          end
+
+          [from, to]
+        end.freeze
+      end
+
+      def validate_rule_prefixes!(value)
+        raise ArgumentError, "TemplateUnit suppressed_rules must be an Array" unless value.is_a?(Array)
+
+        value.map do |prefix|
+          text = prefix.to_s
+          unless text.match?(RULE_PREFIX)
+            raise ArgumentError, "TemplateUnit suppressed_rules entry #{text.inspect} is malformed"
+          end
+
+          text.dup.freeze
+        end.uniq.freeze
+      end
+
+      def validate_bindings!(field, value, pattern)
+        raise ArgumentError, "TemplateUnit #{field} must be a Hash" unless value.is_a?(Hash)
+
+        value.to_h do |name, type_name|
+          key = name.to_s
+          raise ArgumentError, "TemplateUnit #{field} key #{key.inspect} is malformed" unless key.match?(pattern)
+
+          [key.dup.freeze, validate_string!("#{field} value", type_name)]
+        end.freeze
+      end
+    end
+  end
+end

data/lib/rigor/plugin/trust_policy.rb

@@ -36,7 +36,7 @@ module Rigor
 
         @trusted_gems = trusted_gems.map { |g| g.to_s.dup.freeze }.uniq.sort.freeze
         @allowed_read_roots = allowed_read_roots
-                              .map { |path| File.expand_path(path).freeze }
+                              .map { |path| File.absolute_path(path).freeze }
                               .uniq
                               .sort
                               .freeze
@@ -46,10 +46,10 @@ module Rigor
       end
 
       # @return true when the absolute path falls inside any allowed read root. Symlinks are
-      #   resolved through `File.expand_path` only (no `realpath`); plugins with adversarial intent are out of
+      #   resolved through `File.absolute_path` only (no `realpath`); plugins with adversarial intent are out of
       #   scope per ADR-2.
       def allow_read?(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         @allowed_read_roots.any? { |root| inside?(absolute, root) }
       end
 

data/lib/rigor/plugin.rb

@@ -2,6 +2,7 @@
 
 require_relative "plugin/type_node_resolver"
 require_relative "plugin/macro"
+require_relative "plugin/template_unit"
 require_relative "plugin/manifest"
 require_relative "plugin/access_denied_error"
 require_relative "plugin/trust_policy"

data/lib/rigor/protection/discovery_seed.rb

@@ -17,8 +17,8 @@ module Rigor
     #
     # The answer (issue #260's recorded decision) is one table set, built once, threaded to both sides: the
     # {Mutator} base scope and {DiagnosticOracle}'s runner seam. This module builds that table set — the FULL
-    # discovery bundle (`discovered_def_nodes`, `discovered_methods`, superclasses, includes, …), not just the
-    # class-identity slice site selection needed, because resolving `find` on `singleton(Account)` is what makes
+    # discovery bundle (`discovered_def_nodes`, `discovered_methods`, superclasses, includes, extends, …), not just
+    # the class-identity slice site selection needed, because resolving `find` on `singleton(Account)` is what makes
     # the site killable.
     #
     # The shape is a plain Hash of {Scope::DiscoveryIndex} slot names, which is exactly what both consumers take:
@@ -84,9 +84,10 @@ module Rigor
       # collectors driven over the same tree) that {Analysis::Runner::ProjectPrePasses#discover} uses. Empty
       # tables are dropped so an empty seed stays `{}` and every consumer's "seed nothing" branch keeps working.
       #
-      # `discovered_class_sources` is deliberately NOT carried: the runner itself seeds it only under dependency
-      # recording (it is read by the ancestry accessors solely to record cross-file edges), and Tier 2 never
-      # records.
+      # `discovered_class_sources` is carried as the runner carries it on every run: Tier 2 never records edges,
+      # but an ancestor-order reader asks whether a class is declared in more than one file. The mixin tables
+      # (`discovered_includes`, `discovered_prepends`, `discovered_extends`) ride the same fold, so a singleton
+      # `extend` reads the same from a per-file scope under coverage and protection as it does under `check`.
       def discovery_tables(paths)
         seed_tables(Inference::ScopeIndexer.discovered_project_index_for_paths(paths))
       end
@@ -99,17 +100,27 @@ module Rigor
         tables = { discovered_classes: index.fetch(:classes) }
         %i[
           def_nodes def_nestings singleton_def_nodes def_sources singleton_def_sources superclasses includes
-          method_visibilities methods data_member_layouts struct_member_layouts
+          extends prepends unpositioned_mixins class_sources
+          method_visibilities methods parameter_envelopes data_member_layouts struct_member_layouts
+          deferred_ranges refinements global_write_census
         ].each do |slot|
           tables[seed_key(slot)] = def_index.fetch(slot)
         end
-        tables.reject { |_, table| table.nil? || table.empty? }
+        # ADR-119 WD1 — the pairs travel as one: an unpaired empty table is dropped here, a pair only when both
+        # halves are empty (`compact_pairs`), so a non-empty sibling is never stranded by an empty member.
+        tables.merge!(def_index.fetch(:siblings))
+        Scope::DiscoveryIndex.compact_pairs(
+          tables.reject { |name, table| !Scope::DiscoveryIndex.paired?(name) && (table.nil? || table.empty?) }
+        )
       end
 
+      UNPREFIXED_SLOTS = %i[data_member_layouts struct_member_layouts unpositioned_mixins].freeze
+      private_constant :UNPREFIXED_SLOTS
+
       # The def-index slot names match the {Scope::DiscoveryIndex} ones under a `discovered_` prefix, except the
-      # two member-layout tables, which carry the same name on both sides.
+      # two member-layout tables and the unpositioned-mixin table, which carry the same name on both sides.
       def seed_key(slot)
-        slot.to_s.end_with?("member_layouts") ? slot : :"discovered_#{slot}"
+        UNPREFIXED_SLOTS.include?(slot) ? slot : :"discovered_#{slot}"
       end
     end
   end

data/lib/rigor/protection/kill_signature.rb

@@ -20,7 +20,6 @@ module Rigor
         [diagnostic.rule, diagnostic.path, diagnostic.line, diagnostic.column, diagnostic.message]
       end
 
-      # @return the signature set of `diagnostics`.
       def signatures_of(diagnostics)
         diagnostics.to_set { |diagnostic| of(diagnostic) }
       end

data/lib/rigor/protection/mutation_cache.rb

@@ -140,7 +140,7 @@ module Rigor
         end
 
         def snapshot_root_candidates(roots, configured)
-          [roots, Array(roots).map { |path| File.expand_path(path) },
+          [roots, Array(roots).map { |path| File.absolute_path(path) },
            configured, Array(configured).map { |path| relative_to_pwd(path) }]
             .compact.reject(&:empty?).uniq
         end
@@ -148,8 +148,8 @@ module Rigor
         # `path` rendered relative to the working directory when it lies underneath it; unchanged otherwise.
         # Shared by the root-candidate list and the per-file snapshot lookup, which face the same skew.
         def relative_to_pwd(path)
-          absolute = File.expand_path(path)
-          prefix = "#{File.expand_path(Dir.pwd)}#{File::SEPARATOR}"
+          absolute = File.absolute_path(path)
+          prefix = "#{File.absolute_path(Dir.pwd)}#{File::SEPARATOR}"
           absolute.start_with?(prefix) ? absolute.delete_prefix(prefix) : path.to_s
         end
 
@@ -182,8 +182,7 @@ module Rigor
         # `Unavailable` rescue above and disables the cache, which is the only sound reading of a key slot
         # that could not be computed.
         def engine_source_entries
-          identity = Cache::EngineSource.process_identity
-          identity.nil? ? [] : [config_entry("engine-source", identity)]
+          Cache::EngineSource.key_config_entries
         end
 
         # Probed BEFORE the snapshot load, for the reason string rather than for soundness. Since #289

data/lib/rigor/rbs_extended.rb

@@ -106,6 +106,12 @@ module Rigor
     # `docs/type-specification/rbs-extended.md`.
     INFERRED_RETURN_DIRECTIVE = "rigor:v1:inferred-return"
 
+    # `%a{rigor:v1:inferred-signature}` — every type slot on the member, parameters and return alike,
+    # is a placeholder: the author's comment block asserted nothing about this member's own contract.
+    # Strictly narrower than {INFERRED_RETURN_DIRECTIVE}, which also covers a member with an authored
+    # parameter and no authored return. Normative in `docs/type-specification/rbs-extended.md`.
+    INFERRED_SIGNATURE_DIRECTIVE = "rigor:v1:inferred-signature"
+
     module_function
 
     # Whether `method_def` declares its return type inferred rather than contracted (issue #823).
@@ -131,6 +137,27 @@ module Rigor
       annotations.any? { |annotation| annotation.string.to_s.strip == INFERRED_RETURN_DIRECTIVE }
     end
 
+    # Whether `method_def` declares its ENTIRE signature inferred — every parameter and the return alike
+    # — rather than only its return (issue #991).
+    #
+    # `inferred_return?` alone cannot separate a fully bare `def` from one whose parameters ARE declared
+    # (`# @rbs num: Float`) and only its return defaulted: both trip the same return-only provenance,
+    # because no equivalent per-parameter survivor exists to tell them apart. This reads the plugin's
+    # narrower, member-level fact instead: true only when nothing at all was asserted about the member.
+    # `call.wrong-arity` declines on this rather than on {inferred_return?}, since a parameter the author
+    # DID annotate is an assertion about the parameter list, and the parameter list is exactly what arity
+    # is a question about (see the rule's own comment).
+    #
+    # @param method_def — an `RBS::Definition::Method`, or anything else answering `#annotations`.
+    def inferred_signature?(method_def)
+      return false if method_def.nil?
+
+      annotations = method_def.annotations
+      return false if annotations.nil? || annotations.empty?
+
+      annotations.any? { |annotation| annotation.string.to_s.strip == INFERRED_SIGNATURE_DIRECTIVE }
+    end
+
     # Reads RBS::Extended predicate effects off `RBS::Definition::Method#annotations`. Returns the effects in
     # source order; duplicates and unrecognised `rigor:v1:` directives are dropped. Returns an empty array (NEVER
     # `nil`) for a method with no recognised annotations so callers can iterate unconditionally.

data/lib/rigor/reflection/constant_ancestors.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+module Rigor
+  # {Reflection}'s constant-ancestor walk ([#354](https://github.com/rigortype/rigor/issues/354)), split out for
+  # the reader rather than for the loader: the whole-spelling ladder's step 2 (`reflection.rb`) and the
+  # segment-wise path walk (`reflection/constant_path.rb`) both ask which project classes and modules a
+  # name's owner inherits constants from, and this file answers that once for both. Reopening the module
+  # keeps the walk behind the facade its callers already read.
+  module Reflection
+    # #354 — thread-local slot for the per-run ancestor-scope memo. See {.ancestor_constant_scopes}.
+    ANCESTOR_SCOPES_KEY = :__rigor_ancestor_constant_scopes__
+    private_constant :ANCESTOR_SCOPES_KEY
+
+    # The recording run's slot. See {.recorded_ancestor_constant_scopes}.
+    RECORDED_ANCESTOR_SCOPES_KEY = :__rigor_recorded_ancestor_constant_scopes__
+    private_constant :RECORDED_ANCESTOR_SCOPES_KEY
+
+    module_function
+
+    # #354 — the project classes and modules whose own constants `class_name` inherits, in Ruby's
+    # ancestor order: the entries of `class_name`'s `Scope::ResolutionChain` — prepended modules, then
+    # included ones, then the superclass's chain likewise — each once. `class_name` itself is excluded:
+    # step 1 already covered it.
+    #
+    # Issue #1571 — this was a breadth-first walk of its own, which is not Ruby's order: `class C < Base;
+    # include A` with `A` including `M` reached `Base::X` (depth 1) before `M::X` (depth 2), while Ruby's
+    # ancestors are `[C, A, M, Base]`. It reads the chain's `:constants` flavor, whose predicate for a
+    # project class also admits a module that holds only constants.
+    #
+    # Only PROJECT ancestors appear: an as-written name that resolves to no discovered class or module
+    # is an external entry on the chain and contributes nothing here, so a `class Foo <
+    # ActiveRecord::Base` adds no candidate and a constant owned by an RBS-known ancestor still resolves
+    # only if the bare name reaches it at step 3. That gap is deliberate for this slice: widening to the
+    # RBS ancestor graph is a separate question with its own FP surface.
+    #
+    # Memoised per run because step 2 runs on every constant reference whose lexical candidates all
+    # miss — which is the common case for a core-class reference (`String` inside `class Foo`). The
+    # bucket keys on the identity of the runner-seeded run-generation token (ADR-84 WD2), falling
+    # back to the per-file discovery table for runner-less scopes, so a re-run in one process (LSP,
+    # ADR-62 warm loop) cannot hit stale entries.
+    def ancestor_constant_scopes(class_name, scope)
+      ancestor_constant_worlds(class_name, scope).first
+    end
+    private_class_method :ancestor_constant_scopes
+
+    # ADR-24 / #1570 — the first ancestor that owns a constant, asked as {.ancestor_constant_scopes} orders
+    # them and settled by `Scope::ResolutionChain#settle`: the block's first truthy answer where the chain
+    # stands, and otherwise the answer of the breadth-first order this rung used before the chain
+    # (`Scope::ResolutionChain::MasterOrder`) — where a skipped `include` would put a different owner first,
+    # which constant Ruby reads depends on the order the bodies ran.
+    def agreed_ancestor_hit(class_name, scope, &)
+      scopes, chain = ancestor_constant_worlds(class_name, scope)
+      owner, hit = first_ancestor_hit(scopes, &)
+      verdict = chain.settle(scope, owner, owner: owner) do |retro|
+        first_ancestor_hit(constant_scopes_of(retro, class_name), &)&.first
+      end
+      return hit if verdict == :chain
+
+      first_ancestor_hit(master_constant_scopes(class_name, scope), &)&.last
+    end
+    private_class_method :agreed_ancestor_hit
+
+    def master_constant_scopes(class_name, scope)
+      Scope::ResolutionChain::MasterOrder.breadth_first(scope, class_name.to_s, :constants)
+    end
+    private_class_method :master_constant_scopes
+
+    def first_ancestor_hit(entries)
+      entries.each do |entry|
+        hit = yield entry
+        return [entry, hit] if hit
+      end
+      nil
+    end
+    private_class_method :first_ancestor_hit
+
+    # `[scopes, chain]` — {.ancestor_constant_scopes} and the chain they were read from, which settles the
+    # answer.
+    def ancestor_constant_worlds(class_name, scope)
+      # ADR-46: the answer depends on every class on the chain, and the memo is run-scoped rather than
+      # file-scoped — a hit would skip the recording and under-record the edge for every later file. A
+      # recording run reads the chain, which is memoised per discovery index, and files its edges on
+      # every call.
+      return recorded_ancestor_constant_scopes(class_name, scope) if Analysis::DependencyRecorder.active?
+
+      generation = scope.run_generation || scope.discovered_superclasses
+      slot = Thread.current[ANCESTOR_SCOPES_KEY]
+      unless slot && slot[0].equal?(generation)
+        slot = [generation, {}]
+        Thread.current[ANCESTOR_SCOPES_KEY] = slot
+      end
+      bucket = slot[1]
+      bucket.fetch(class_name) { bucket[class_name] = compute_ancestor_constant_scopes(class_name, scope) }
+    end
+    private_class_method :ancestor_constant_worlds
+
+    # The recording run's memo. The answer is every project entry of the chain, so its edges are the
+    # root's and every entry's — what `Scope::ResolutionChain#record` files, which a computation does and a
+    # hit replays, in the same order. One slot keyed on the discovery index: the answer and the edges are
+    # both read from it, so the key is exact, and the slot never pins more than the index it serves.
+    def recorded_ancestor_constant_scopes(class_name, scope)
+      discovery = scope.discovery
+      slot = Thread.current[RECORDED_ANCESTOR_SCOPES_KEY]
+      unless slot && slot[0].equal?(discovery)
+        slot = [discovery, {}]
+        Thread.current[RECORDED_ANCESTOR_SCOPES_KEY] = slot
+      end
+      bucket = slot[1]
+      worlds = bucket[class_name]
+      return bucket[class_name] = compute_ancestor_constant_scopes(class_name, scope) if worlds.nil?
+
+      Scope::ResolutionChain.for(scope, class_name.to_s, :instance, :constants).record(scope)
+      worlds
+    end
+    private_class_method :recorded_ancestor_constant_scopes
+
+    # Reads the chain whole, so a recording run files every class on it (a no-op otherwise).
+    def compute_ancestor_constant_scopes(class_name, scope)
+      chain = Scope::ResolutionChain.for(scope, class_name.to_s, :instance, :constants)
+      chain.record(scope)
+      scopes = constant_scopes_of(chain, class_name)
+      [scopes, chain].freeze
+    end
+    private_class_method :compute_ancestor_constant_scopes
+
+    # The chain's project entries in order, each once, without `class_name` itself.
+    def constant_scopes_of(chain, class_name)
+      out = []
+      chain.entries.each do |entry|
+        name = entry.name
+        out << name unless name.nil? || name == class_name || out.include?(name)
+      end
+      out.freeze
+    end
+    private_class_method :constant_scopes_of
+
+    # Whether `name` is a namespace the project declares — the predicate the chain's `:constants` flavor
+    # resolves ancestor names with, and the path walk's (`reflection/constant_path.rb`) test for a head.
+    def known_project_namespace?(name, scope)
+      scope.discovered_superclasses.key?(name) ||
+        scope.discovered_includes.key?(name) ||
+        scope.discovered_classes.key?(name)
+    end
+    private_class_method :known_project_namespace?
+  end
+end

data/lib/rigor/reflection/constant_path.rb

@@ -35,10 +35,17 @@ module Rigor
     # silent wrong answer for a silent absent one at no gain (the same reasoning as
     # {.toplevel_first_constant_type}'s caller-derived rungs).
     def resolve_constant_path_name(name, scope, &known)
+      walk_constant_path(name, scope, known, caller_derived: true)
+    end
+
+    # {.resolve_constant_path_name}'s walk. `caller_derived: false` is {.resolve_constant_type}'s flag: the
+    # head skips the enclosing class's ancestors — the one step a recorded top-level body takes from its
+    # caller — while every later segment still walks its owner's ancestors, as Ruby does.
+    def walk_constant_path(name, scope, known, caller_derived:)
       segments = name.to_s.split("::")
       return nil unless segments.size > 1
 
-      owner = path_head_owner(segments.first, scope)
+      owner = path_head_owner(segments.first, scope, caller_derived)
       last = segments.size - 1
       segments.each_with_index do |segment, index|
         next if index.zero?
@@ -50,25 +57,34 @@ module Rigor
       end
       owner
     end
+    private_class_method :walk_constant_path
 
     # Step 2.5's rung as a type: the segment-wise name, then that name looked up like any other
     # candidate so the answer comes from the same source-precedence order as every other rung.
-    def constant_path_type(name, scope)
-      qualified = resolve_constant_path_name(name, scope) { |candidate| constant_type_at(candidate, scope) }
-      qualified && constant_type_at(qualified, scope)
+    #
+    # Issue #1290 — the final segment's candidates are looked up with the reference's `shadows` names
+    # ({.constant_type_at}), so an owner's own `B` another file writes stops the walk before the owner's
+    # superclass answers with its published `B`.
+    def constant_path_type(name, scope, shadows:, caller_derived: true)
+      known = ->(candidate) { constant_type_at(candidate, scope, shadows) }
+      qualified = walk_constant_path(name, scope, known, caller_derived: caller_derived)
+      qualified && constant_type_at(qualified, scope, shadows)
     end
     private_class_method :constant_path_type
 
     # The namespace a path's FIRST segment names — the bare-name ladder, restricted to answers that can
     # OWN the segments that follow. A value constant is not one of them, so it declines here rather
     # than producing a namespace prefix no source knows.
-    def path_head_owner(head, scope)
+    def path_head_owner(head, scope, caller_derived)
       hit = first_namespace_hit(lexical_nesting_chain(scope), head, scope)
       return hit if hit
 
-      prefix = enclosing_class_path(scope)
+      prefix = caller_derived ? enclosing_class_path(scope) : nil
       unless prefix.nil? || prefix.empty?
-        hit = first_namespace_hit(bounded_ancestor_scopes(prefix, scope), head, scope)
+        hit = bounded_agreed_hit(prefix, scope) do |entry|
+          candidate = "#{entry}::#{head}"
+          candidate if namespace_known?(candidate, scope)
+        end
         return hit if hit
       end
 
@@ -93,28 +109,40 @@ module Rigor
       candidate = "#{owner}::#{segment}"
       return candidate if yield(candidate)
 
-      bounded_ancestor_scopes(owner, scope).each do |ancestor|
+      bounded_agreed_hit(owner, scope) do |ancestor|
         inherited = "#{ancestor}::#{segment}"
-        return inherited if yield(inherited)
+        inherited if yield(inherited)
       end
-      nil
     end
     private_class_method :constant_in_namespace
 
+    # {.agreed_ancestor_hit} over the budget-bounded scope lists: the first answer where
+    # `Scope::ResolutionChain#settle` lets the chain stand, and otherwise the breadth-first order's.
+    def bounded_agreed_hit(class_name, scope, &)
+      scopes, chain = ancestor_constant_worlds(class_name, scope)
+      owner, hit = first_ancestor_hit(bounded(scopes), &)
+      verdict = chain.settle(scope, owner, owner: owner) do |retro|
+        first_ancestor_hit(bounded(constant_scopes_of(retro, class_name)), &)&.first
+      end
+      return hit if verdict == :chain
+
+      first_ancestor_hit(bounded(master_constant_scopes(class_name, scope)), &)&.last
+    end
+    private_class_method :bounded_agreed_hit
+
     # How many of {.ancestor_constant_scopes}' entries one segment may consult, under
     # `Scope::ANCESTOR_WALK_LIMIT` — the budget `Scope`'s method lookup already spends on this same
     # graph, reused rather than re-chosen so one pathological ancestry costs one bound. The list
     # itself is the memoised one step 2 builds, so this bounds the per-segment consultation the walk
     # adds and not the graph. Reported through the shared counter, so a truncated walk is visible in a
     # budget trace instead of looking like a plain miss.
-    def bounded_ancestor_scopes(class_name, scope)
-      scopes = ancestor_constant_scopes(class_name, scope)
+    def bounded(scopes)
       return scopes if scopes.size <= Scope::ANCESTOR_WALK_LIMIT
 
       Inference::BudgetTrace.hit(Inference::BudgetTrace::ANCESTOR_WALK_LIMIT)
       scopes.first(Scope::ANCESTOR_WALK_LIMIT)
     end
-    private_class_method :bounded_ancestor_scopes
+    private_class_method :bounded
 
     # Whether `name` can OWN a constant. `class_known?` covers the RBS and registry classes and modules;
     # the project tables cover a namespace the project declares with no RBS for it.