rigortype 0.4.0 → 0.4.1

data/lib/rigor/inference/singleton_hook_decline.rb

@@ -0,0 +1,253 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Inference
+    # ADR-119 WD3 (errata 2026-10-08, PR C2-a) — the singleton side's positional hook decline. A hook's edge on
+    # the singleton side is recorded on no includer, so no chain state carries it (WD3); what the read CAN say
+    # is where such an edge could land. A hook touches the singleton chain of a class `K` in two ways only:
+    #
+    # - (U1) `K.extend(X)`, `class_methods do`, a concern's `ClassMethods`: Ruby inserts `X` after `#<Class:K>`
+    #   and before `#<Class:K.superclass>`, inside `K`'s own level;
+    # - (U2) `included do def self.x end`, `define_singleton_method`, `singleton_class.class_eval`: a definition ON
+    #   `#<Class:K>`, at the level's head.
+    #
+    # So a hook at level `i` cannot move a definer at an index at or before the level's head, and a definer found
+    # at `#<Class:K_j>` itself, written in `K_j`'s own body, is immune to every hook of levels `j` and deeper. The
+    # read's last candidate gives a BOUND: its index when it is that class entry and its `def` was written in
+    # `K_j`'s body; one past it for an extended module's entry, or for a copy the extends fold put on `K_j`
+    # (the `def`'s recorded nesting does not start with `K_j`), and every entry when nothing answers. The levels
+    # tested are those that start before the bound and do not end before `from`. The read declines when a tested
+    # level's own instance level (the class, its prepends and includes with their closures) or its singleton
+    # segment (the class's singleton and its extends' closures) holds a HOOK-CAPABLE entry, or when a level
+    # deeper than the shallowest tested level is hook-capable by the same test: its `inherited` defines on
+    # every subclass's singleton, and it need not be the class's own `def`. A deeper external superclass RBS
+    # does not know counts, its `inherited` being unknown by construction.
+    #
+    # Hook-capable, for a project entry or a declared module the chain holds as external (a candidate of its
+    # spelling is a `discovered_class_sources`, `discovered_classes`, `discovered_includes` or
+    # `discovered_extends` key; an ambiguous spelling tests every declared candidate and any capable one
+    # declines): lists `"*"` on either side, records a {Scope::ResolutionChain::Relevance::HOOKS} name on
+    # either side or as an envelope key, or extends `ActiveSupport::Concern`. An undeclared external is capable
+    # unless RBS knows it (WD2(i)'s limit: an RBS-known external is clean). The dynamic mark is not a hook signal.
+    # The verdict does not depend on the name asked, so it is memoised per entry in the chain's flavor bucket
+    # with the ADR-46 edges it read (a class edge and the negative class edge on the unqualified name per tested
+    # project entry, the negative class edge on the spelling's last segment and the candidates' class edges per
+    # tested external), replayed on every call while a recording is active.
+    #
+    # Known remainders, pinned in `spec/integration/definer_resolution_witness_spec.rb`: `class << self; prepend
+    # P` is recorded as an `extend` (the chain places `P` after the singleton, so an own `def self.x` is trusted
+    # against it); a concern is capable for every name; an own `def self.x` is trusted against its own level's
+    # U2 hooks and same-class redefinitions; a `class Class; def inherited` monkeypatch is unseen; and a
+    # superclass that only `extend`s adds two forks, so every read on its subclasses declines.
+    module SingletonHookDecline
+      WILDCARD = "*"
+      CONCERN = "ActiveSupport::Concern"
+      SIDES = %i[include extend].freeze
+
+      module_function
+
+      # True when a hook may have placed a definer of `method_name` ahead of the read's last candidate on the
+      # singleton `chain` (the candidate set `hits`, read from `from`).
+      def decline?(scope, chain, method_name, from, hits)
+        bound = bound_of(scope, chain, method_name, hits.last)
+        tested = tested_levels(chain, from, bound)
+        return false if tested.empty?
+        return true if chain.truncated?
+
+        context = Context.new(scope, chain.flavor)
+        tested.any? { |level| context.level_capable?(chain, level) } || context.deeper_hook?(chain, tested.first)
+      end
+
+      def bound_of(scope, chain, method_name, hit)
+        return chain.entries.size if hit.nil?
+
+        index = hit.index
+        entry = chain.entries[index]
+        # A singleton project entry on a singleton chain is always a level's class entry.
+        own = !entry.external? && entry.side == :singleton && def_head(scope, entry.name, method_name) == entry.name
+        own ? index : index + 1
+      end
+
+      # What a class entry's answer is when its `def` was written in another module's body: `:copy` when that
+      # module is on the same level's singleton segment (the extends fold copied it there; the copy is not where
+      # Ruby finds the method — the module's own entry is, and an entry between them may answer first — so the
+      # read asks again past it), `:stray` when it is not (the fold and the chain resolved the `extend`'s name to
+      # different modules, `extend X` inside `module A` with both `X` and `A::X` declared; or the `def` is not the
+      # node that module's instance table holds, a `def C.x` written in its body: the read declines), and
+      # nil otherwise (the class's own `def`, no `def`, or one with no recorded nesting).
+      def copy_kind(scope, chain, method_name, hit)
+        entry = chain.entries[hit.index]
+        return nil if entry.external? || entry.side != :singleton
+
+        head = def_head(scope, entry.name, method_name)
+        return nil if head.nil? || head == entry.name
+
+        level = chain.level_starts.rindex { |start| start <= hit.index }
+        return :stray if level.nil? || level >= chain.level_count
+
+        found = chain.level_entries(level).any? { |candidate| candidate.side == :instance && candidate.name == head }
+        found && copied_from?(scope, head, method_name, entry.name) ? :copy : :stray
+      end
+
+      # Whether the class's singleton `def` is the very node `head`'s instance table holds, the one the fold
+      # copied: a receiverless `def`. A `def C.x` or `class << C; def x; end` written inside `head`'s body has the
+      # same nesting head and is the class's own, not a copy. (The walk records a `def C.x` written in `module X`
+      # as `X#x` too, so identity alone does not tell it from a copy; its receiver does.)
+      def copied_from?(scope, head, method_name, owner)
+        node = scope.singleton_def_for(owner, method_name)
+        return false if node.nil? || !node.receiver.nil?
+
+        scope.user_def_for(head, method_name).equal?(node)
+      end
+
+      # The innermost `Module.nesting` entry `owner`'s singleton `def` of the name was written in, or nil.
+      def def_head(scope, owner, method_name)
+        node = scope.singleton_def_for(owner, method_name)
+        return nil if node.nil?
+
+        nesting = scope.discovery.discovered_def_nestings[node] || DefNodeResolver.rehydrated_nesting(node)
+        nesting&.first
+      end
+
+      def tested_levels(chain, from, bound)
+        starts = chain.level_starts
+        size = chain.entries.size
+        (0...chain.level_count).select { |level| starts[level] < bound && (starts[level + 1] || size) >= from }
+      end
+
+      # The verdicts' working state: the scope, the flavor and the memo the verdicts share.
+      class Context
+        def initialize(scope, flavor)
+          @scope = scope
+          @flavor = flavor
+          @memo = Scope::ResolutionChain.hook_memo(scope, flavor)
+          @recording = Analysis::DependencyRecorder.active?
+        end
+
+        # A tested level: its singleton segment, and its class's own instance level.
+        def level_capable?(chain, level)
+          return true if chain.level_entries(level).any? { |entry| capable?(entry) }
+
+          class_name = chain.level_classes[level]
+          !class_name.nil? && instance_level_capable?(class_name)
+        end
+
+        # A level deeper than `level` whose `inherited` can define on every subclass's singleton: one that is
+        # hook-capable as a tested level is. Its class records `inherited` (own, folded, or a literal
+        # `define_method`), or an entry of its own instance level or singleton segment can define it unseen (a
+        # concern's `class_methods do def inherited`, a hook that extends the class with a module defining it),
+        # or it is an external superclass that is hook-capable.
+        def deeper_hook?(chain, level)
+          ((level + 1)...chain.level_count).any? { |deeper| level_capable?(chain, deeper) }
+        end
+
+        def capable?(entry)
+          return verdict(:project, entry.name) { project_capable?(entry.name) } unless entry.external?
+
+          verdict(:external, entry) { external_capable?(entry) }
+        end
+
+        private
+
+        def instance_level_capable?(class_name)
+          verdict(:instance_level, class_name) do |edges|
+            chain = Scope::ResolutionChain.for(@scope, class_name, :instance, @flavor)
+            next true if chain.truncated?
+
+            entries = chain.level_count.zero? ? chain.entries : chain.level_entries(0)
+            entries.any? do |entry|
+              edges.concat(entry_edges(entry))
+              capable?(entry)
+            end
+          end
+        end
+
+        # The memoised `[verdict, edges]` of one test, its edges replayed while a recording is active.
+        def verdict(kind, key)
+          verdict, edges = @memo[[kind, key]] ||= begin
+            edges = []
+            value = yield(edges)
+            [value ? true : false, edges.concat(own_edges(kind, key)).uniq.freeze].freeze
+          end
+          replay(edges) if @recording
+          verdict
+        end
+
+        def own_edges(kind, key)
+          return entry_edges(key) if kind == :external
+          return EMPTY_EDGES if kind == :instance_level
+
+          [[:class, key], [:missing, key.to_s.split("::").last]]
+        end
+
+        def entry_edges(entry)
+          return [[:class, entry.name], [:missing, entry.last_segment]] unless entry.external?
+
+          entry.candidates.map { |candidate| [:class, candidate] } << [:missing, entry.raw.to_s.split("::").last]
+        end
+
+        def replay(edges)
+          edges.each do |kind, value|
+            case kind
+            when :class then Scope::ResolutionChain.record_class(@scope, value)
+            when :missing then Analysis::DependencyRecorder.read_missing(:class, value)
+            end
+          end
+        end
+
+        def project_capable?(name)
+          sides = @scope.discovery.unpositioned_mixins[name]
+          return true if sides && SIDES.any? { |side| sides[side]&.include?(WILDCARD) }
+
+          return true if records_hook?(name)
+
+          extends_concern?(name)
+        end
+
+        # Whether `name` records a hook name on either side, or in its envelope table: a `def self.inherited`, a
+        # module's instance `def inherited` (a hook once extended), `singleton_class.define_method(:inherited)`
+        # (recorded as an instance method) and `define_singleton_method(:inherited)` (recorded only as an opaque
+        # envelope, the name-literal evidence `ScopeIndexer#record_surface_evidence` files).
+        def records_hook?(name)
+          envelopes = @scope.parameter_envelopes_of(name)
+          Scope::ResolutionChain::Relevance::HOOKS.any? do |hook|
+            @scope.discovered_method?(name, hook, :singleton) || @scope.discovered_method?(name, hook, :instance) ||
+              envelopes.key?([:singleton, hook]) || envelopes.key?([:instance, hook])
+          end
+        end
+
+        # Whether `name`'s own singleton segment (its `extend`s, as the chain places them) holds
+        # `ActiveSupport::Concern` — the concern shape's only signal, a framework name the follow-up ADR moves
+        # behind the plugin API (WD3, Q11).
+        def extends_concern?(name)
+          chain = Scope::ResolutionChain.for(@scope, name, :singleton, @flavor)
+          entries = chain.level_count.zero? ? chain.entries : chain.level_entries(0)
+          entries.any? do |entry|
+            entry.external? ? entry.candidates.include?(CONCERN) : entry.name == CONCERN
+          end
+        end
+
+        # A declared module the chain holds as external is tested as that module; an undeclared one is capable
+        # unless RBS knows it.
+        def external_capable?(entry)
+          declared = entry.candidates.select { |candidate| declared?(candidate) }
+          return declared.any? { |name| verdict(:project, name) { project_capable?(name) } } unless declared.empty?
+
+          entry.candidates.none? { |candidate| Rigor::Reflection.rbs_class_known?(candidate, scope: @scope) }
+        rescue StandardError
+          true
+        end
+
+        def declared?(name)
+          discovery = @scope.discovery
+          discovery.discovered_class_sources.key?(name) || discovery.discovered_classes.key?(name) ||
+            discovery.discovered_includes.key?(name) || discovery.discovered_extends.key?(name)
+        end
+      end
+      private_constant :Context
+
+      EMPTY_EDGES = [].freeze
+      private_constant :EMPTY_EDGES
+    end
+  end
+end

data/lib/rigor/inference/statement_evaluator.rb

@@ -9,6 +9,7 @@ require_relative "../source/node_walker"
 require_relative "../source/node_children"
 require_relative "../source/constant_path"
 require_relative "anonymous_meta_class"
+require_relative "definer_resolution"
 require_relative "block_repetition"
 require_relative "block_parameter_binder"
 require_relative "body_fixpoint"
@@ -272,10 +273,16 @@ module Rigor
       #   {OperandWalk} rooted inside an operand still records its later operands ({#walk_recorder}).
       # @param operand_types — the later operands' own values ({OperandWalk#types}) for the evaluator that runs a
       #   call from the scope its operands left, read by {#type_operand}.
+      # @param opaque_class — true while the walk is inside the body of a class nothing names (issue #1518:
+      #   a declined `class self::X`, a parse-error header), where `class_context` is empty without the code
+      #   being at the top level. A `def` (or `class << self`) there runs under an untyped `self` instead of
+      #   the top level's nil one, so its implicit-self calls answer `Dynamic` and no top-level rule fires.
       def initialize(scope:, tracer: nil, on_enter: nil, class_context: [].freeze, # rubocop:disable Metrics/ParameterLists
                      lexical_nesting: EMPTY_NESTING, converged_loop_recording: false, next_scope_sink: nil,
-                     operand_scope: nil, in_operand: false, operand_recorder: nil, operand_types: nil)
+                     operand_scope: nil, in_operand: false, operand_recorder: nil, operand_types: nil,
+                     opaque_class: false)
         @scope = scope
+        @opaque_class = opaque_class
         @tracer = tracer
         @on_enter = on_enter
         @class_context = class_context.freeze
@@ -625,7 +632,8 @@ module Rigor
       # lands.
       def eval_ivar_write(node)
         rhs_type, post_rhs = sub_eval(node.value, scope)
-        bound = post_rhs.with_ivar(node.name, rhs_type)
+        # Issue #1446 — a write ends a class guard's narrowing of the variable, as it does a global's.
+        bound = post_rhs.with_ivar(node.name, rhs_type).without_ivar_guard(node.name)
         bound = bound.with_ivar_origin(node.name, rhs_origin(node.value, post_rhs, rhs_type))
         cause = optimistic_rhs_origin(node.value, post_rhs)
         bound = bound.with_optimistic_ivar(node.name, cause, miss: optimistic_rhs_miss(node.value, post_rhs)) if cause
@@ -806,7 +814,8 @@ module Rigor
       end
 
       def rebind_variable(target_scope, kind, name, type)
-        target_scope.public_send(VAR_KIND_BUILDERS.fetch(kind), name, type)
+        bound = target_scope.public_send(VAR_KIND_BUILDERS.fetch(kind), name, type)
+        kind == :ivar ? bound.without_ivar_guard(name) : bound
       end
 
       def compound_result_type(current, rhs, operator)
@@ -2431,6 +2440,12 @@ module Rigor
         case index_node
         when Prism::LocalVariableTargetNode
           scope.with_local(index_node.name, element_type)
+        when Prism::InstanceVariableTargetNode
+          # Issue #1446 — `for @io in xs` writes the ivar each iteration, which ends a class guard's narrowing of it,
+          # and `for $out in xs` the global, which ends any guard's narrowing of it.
+          scope.with_ivar(index_node.name, element_type).without_ivar_guard(index_node.name)
+        when Prism::GlobalVariableTargetNode
+          scope.with_global(index_node.name, element_type)
         when Prism::IndexTargetNode
           widen_index_target(index_node, element_type, scope, type_scope: scope)
         when Prism::MultiTargetNode
@@ -2698,13 +2713,31 @@ module Rigor
       # that half rather than this one deriving it from the frames.
       def eval_class_or_module(node)
         path = node.constant_path
-        frame = ClassFrame.new(name: Source::ConstantPath.qualified_name(path), singleton: false)
+        name = Source::ConstantPath.qualified_name(path)
+        # A header Prism recovered without a constant (`class foo`, a parse error) names no class: its body
+        # runs under an untyped `self` and no class frame, so nothing is filed under an empty name.
+        return eval_unnameable_class_body(node) if name.nil?
+        # `class self::X` the indexer declined (opaque `self`, e.g. `REGISTRY.first.class_eval`) is not the
+        # lexical `X` that `qualified_name` renders; a nameable `self::` header is in the identity table.
+        return eval_unnameable_class_body(node) if declined_self_header?(path)
+
+        frame = ClassFrame.new(name: name, singleton: false)
         new_context = Source::ConstantPath.rooted?(path) ? [frame] : @class_context + [frame]
         body_type, _body_scope = eval_class_body(node, new_context,
                                                  Source::ConstantPath.pushed_nesting(@lexical_nesting, path))
         [body_type, scope]
       end
 
+      def declined_self_header?(path)
+        path.is_a?(Prism::ConstantPathNode) && path.parent.is_a?(Prism::SelfNode) &&
+          !scope.declared_types.key?(path)
+      end
+
+      def eval_unnameable_class_body(node)
+        body_type, _body_scope = eval_class_body(node, [], @lexical_nesting, opaque_self: true)
+        [body_type, scope]
+      end
+
       # `class << expr; body; end`. When `expr` is `self`, the body defines class methods on the immediate enclosing
       # class — the innermost frame flips to `singleton: true` so a nested `def foo` resolves through `singleton_method`
       # rather than `instance_method`. For non-`self` expressions we cannot statically resolve the receiver, so we keep
@@ -5175,7 +5208,7 @@ module Rigor
 
       # ----- def/class helpers -----
 
-      def eval_class_body(node, new_context, new_nesting = @lexical_nesting)
+      def eval_class_body(node, new_context, new_nesting = @lexical_nesting, opaque_self: false)
         return [Type::Combinator.constant_of(nil), scope] if node.body.nil?
 
         # Class/module bodies run in a fresh scope: the outer scope's locals are NOT visible inside `class Foo; ...
@@ -5183,7 +5216,10 @@ module Rigor
         # A-engine: `self` inside a class body is the class object itself, so we set `self_type` to
         # `Singleton[<qualified>]`.
         fresh = build_fresh_body_scope
-        body_self = self_type_for_class_body(new_context)
+        # Issue #1518 — `class << self` inside an unnameable class body keeps that body's opacity: it opens the
+        # singleton of a class nothing names, and its empty frame stack is not the top level.
+        opaque_self ||= node.is_a?(Prism::SingletonClassNode) && @opaque_class && new_context.empty?
+        body_self = opaque_self ? Type::Combinator.untyped : self_type_for_class_body(new_context)
         fresh = fresh.with_self_type(body_self) if body_self
         # Issue #963 — `self` in a `class << ...` body is the SINGLETON class, which shares the `Singleton[X]`
         # carrier a `class X` body gets. The mark is the only thing that tells the two apart downstream, and a
@@ -5191,7 +5227,7 @@ module Rigor
         fresh = fresh.with_singleton_class_body(node.is_a?(Prism::SingletonClassNode))
         fresh = fresh.with_match_frame(node.body)
         fresh = stamp_nesting(fresh, new_nesting)
-        sub_eval(node.body, fresh, class_context: new_context, lexical_nesting: new_nesting)
+        sub_eval(node.body, fresh, class_context: new_context, lexical_nesting: new_nesting, opaque_class: opaque_self)
       end
 
       def build_method_entry_scope(def_node) # rubocop:disable Metrics/AbcSize
@@ -5410,7 +5446,9 @@ module Rigor
       # Returns nil for top-level defs that have no enclosing class.
       def self_type_for_method_body(singleton:)
         path = current_class_path
-        return nil if path.nil?
+        # Issue #1518 — a `def` in a class nothing names has a receiver, just not one Rigor can type; nil would
+        # read its body as the top level and its implicit-self calls as unresolved top-level calls.
+        return (Type::Combinator.untyped if @opaque_class) if path.nil?
 
         if singleton
           Type::Combinator.singleton_of(path)
@@ -5549,10 +5587,14 @@ module Rigor
       # `on_enter: nil` evaluates without recording into the per-node scope index — for a pass whose scopes are not
       # the ones the index should keep. `next_scope_sink:` is replaced only by {#evaluate_invocation} and
       # {#loop_iteration}.
-      def sub_eval(node, with_scope, class_context: @class_context, lexical_nesting: @lexical_nesting,
-                   on_enter: @on_enter, next_scope_sink: @next_scope_sink, operand_recorder: @operand_recorder)
+      # `opaque_class:` survives only while the frame stack stays empty: a named class opened inside an
+      # unnameable body gets a frame, and its `def`s a nominal `self`, as they did before #1518.
+      def sub_eval(node, with_scope, class_context: @class_context, lexical_nesting: @lexical_nesting, # rubocop:disable Metrics/ParameterLists
+                   on_enter: @on_enter, next_scope_sink: @next_scope_sink, operand_recorder: @operand_recorder,
+                   opaque_class: @opaque_class && class_context.empty?)
         evaluator_at(with_scope, class_context: class_context, lexical_nesting: lexical_nesting, on_enter: on_enter,
-                                 next_scope_sink: next_scope_sink, operand_recorder: operand_recorder).evaluate(node)
+                                 next_scope_sink: next_scope_sink, operand_recorder: operand_recorder,
+                                 opaque_class: opaque_class).evaluate(node)
       end
 
       # An evaluator over `with_scope` that inherits everything else from this one. `operand_scope:` and
@@ -5560,7 +5602,8 @@ module Rigor
       # operands left.
       def evaluator_at(with_scope, class_context: @class_context, lexical_nesting: @lexical_nesting, # rubocop:disable Metrics/ParameterLists
                        on_enter: @on_enter, next_scope_sink: @next_scope_sink, operand_scope: nil,
-                       in_operand: @in_operand, operand_recorder: @operand_recorder, operand_types: nil)
+                       in_operand: @in_operand, operand_recorder: @operand_recorder, operand_types: nil,
+                       opaque_class: @opaque_class)
         StatementEvaluator.new(
           scope: with_scope,
           tracer: tracer,
@@ -5572,7 +5615,8 @@ module Rigor
           operand_scope: operand_scope,
           in_operand: in_operand,
           operand_recorder: operand_recorder,
-          operand_types: operand_types
+          operand_types: operand_types,
+          opaque_class: opaque_class
         )
       end
 
@@ -5675,6 +5719,12 @@ module Rigor
         case ref
         when Prism::LocalVariableTargetNode
           scope.with_local(ref.name, exception_type)
+        when Prism::InstanceVariableTargetNode
+          # Issue #1446 — `rescue => @io` writes the ivar, which ends a class guard's narrowing of it, and `rescue =>
+          # $out` the global, which ends any guard's narrowing of it.
+          scope.with_ivar(ref.name, exception_type).without_ivar_guard(ref.name)
+        when Prism::GlobalVariableTargetNode
+          scope.with_global(ref.name, exception_type)
         when Prism::IndexTargetNode
           widen_index_target(ref, exception_type, scope, type_scope: scope)
         else
@@ -5818,7 +5868,7 @@ module Rigor
       def source_decomposition_projection(subject_type, method_name, arg_types, scope)
         return nil unless subject_type.is_a?(Type::Nominal)
 
-        def_node = scope.discovered_def_nodes[subject_type.class_name]&.[](method_name)
+        def_node = own_definer_node(scope, subject_type.class_name, method_name)
         return nil if def_node.nil?
 
         result = scope.user_method_return(def_node, subject_type, arg_types)
@@ -5827,6 +5877,22 @@ module Rigor
         result
       end
 
+      # The `def` node the receiver's OWN class defines `method_name` with, or nil. ADR-119 C2-e (#1615): asked of
+      # `DefinerResolution`, so a slot rebuilt from an ADR-85 seed bundle is resolved to a node and the read files
+      # its ADR-46 edge. UNKNOWN answers nil: an unsettled or forked chain, or a contested slot once ADR-119 C1d
+      # fills the siblings. Conditional or reopened defs are not contested until C1d. A definer further up the
+      # chain (a prepended or included module, a superclass) is not the own class's, so the owner check declines it.
+      def own_definer_node(scope, class_name, method_name)
+        case DefinerResolution.resolve(scope, class_name, method_name, :instance, question: :definer)
+        in DefinerResolution::Known(answer: [node, owner])
+          owner == class_name ? node : nil
+        in DefinerResolution::UNKNOWN # the case/in contract needs one arm per answer
+          nil
+        in DefinerResolution::ABSENT # rubocop:disable Lint/DuplicateBranch -- see above
+          nil
+        end
+      end
+
       # A `StructInstance`'s own projection — `Tuple` of its member values for `deconstruct`, `HashShape` of
       # its members for `deconstruct_keys` — or nil when the subject is another carrier or the projection would
       # be unsound.

data/lib/rigor/plugin/base.rb

@@ -882,7 +882,7 @@ module Rigor
 
         before, separator, = file.rpartition("/lib/")
         root = separator.empty? ? File.dirname(file) : before
-        relative.map { |rel| File.expand_path(rel, root) }
+        relative.map { |rel| File.absolute_path(rel, root) }
       end
 
       # ADR-28 — the path-scoped method-protocol contracts this plugin contributes. Defaults to the
@@ -940,6 +940,17 @@ module Rigor
       # changed. The producer id is auto-prefixed `plugin.<manifest.id>.` per ADR-7 § "Slice 6-C" so plugin
       # caches stay sandboxed from built-in producers.
       #
+      # #1558 — whichever way the value arrives, the boundary ends up holding every row of the producer's
+      # dependency descriptor. A hit ran no block and read nothing, so the served entry's stored rows are
+      # replayed into it ({IoBoundary#replay}); a miss read its inputs itself, and replaying the descriptor it
+      # just recorded adds the evaluated `watch:` rows, the only rows the block did not record. The boundary
+      # is per plugin and accumulates for the run, so the rows reach the ADR-45 run-result descriptor
+      # (`Runner#build_run_dependency_descriptor`) and the descriptor of every producer of this plugin
+      # computed after it, whether its block asked this one or it composes a value this one returned
+      # earlier. Without the replay a producer recomputed after a served one stored no row for the served
+      # value's inputs, and neither did the run: rigor-activerecord's `:model_index`, recomputed after a
+      # model edit while `:schema_table` hit, kept its stale columns after `db/schema.rb` changed.
+      #
       # When `services.cache_store` is `nil` (e.g. CLI `--no-cache`), the callable bypasses the cache and
       # runs the producer block every time — same semantics as the v0.0.9 cache surface for built-in
       # producers.
@@ -974,11 +985,9 @@ module Rigor
             generation_cap: producer[:generation_cap],
             params: params,
             serialize: pair_serializer(producer[:serialize]),
-            deserialize: pair_deserializer(producer[:deserialize])
-          ) do
-            value = compute.call
-            [value, producer_dependency_descriptor(producer)]
-          end
+            deserialize: pair_deserializer(producer[:deserialize]),
+            on_hit: ->(dependencies) { io_boundary.replay(dependencies) }
+          ) { computed_producer_pair(producer, compute) }
         end
       end
 
@@ -1151,7 +1160,7 @@ module Rigor
 
       def collect_glob_files(roots, patterns)
         matched = roots.flat_map do |root|
-          absolute = File.expand_path(root.to_s)
+          absolute = File.absolute_path(root.to_s)
           next [] unless File.directory?(absolute)
 
           patterns.flat_map { |pattern| Dir.glob(File.join(absolute, pattern.to_s)) }
@@ -1196,6 +1205,17 @@ module Rigor
         Cache::Descriptor.compose(auto_built, extra)
       end
 
+      # #1558 — the miss half of {#cache_for}. The block's own reads are in the boundary already, so replaying
+      # the descriptor it just recorded adds the evaluated `watch:` rows, as a hit's replay of the stored
+      # descriptor does; a producer computing around this one then records one row set whichever way this
+      # value arrived.
+      def computed_producer_pair(producer, compute)
+        value = compute.call
+        dependencies = producer_dependency_descriptor(producer)
+        io_boundary.replay(dependencies)
+        [value, dependencies]
+      end
+
       # ADR-60 WD3 — the dependency descriptor stored beside the producer's value, built AFTER the block ran
       # so every in-block `io_boundary` read is captured, plus the evaluated `watch:` glob rows.
       #
@@ -1224,7 +1244,7 @@ module Rigor
         Array(tuples).flat_map do |tuple|
           roots, *patterns = Array(tuple)
           Array(roots).flat_map do |root|
-            absolute = File.expand_path(root.to_s)
+            absolute = File.absolute_path(root.to_s)
             patterns.map { |pattern| Cache::Descriptor::GlobEntry.compute(root: absolute, pattern: pattern.to_s) }
           end
         end.uniq