rigortype 0.4.0 → 0.4.1

data/lib/rigor/plugin/io_boundary.rb

@@ -43,10 +43,39 @@ module Rigor
     # - `#cache_descriptor` — flushes the accumulated entries into a fresh {Cache::Descriptor} for the
     #   contribution that built it. URL fetches contribute `ConfigEntry` rows keyed `"url:#{url}"` with the
     #   response body's SHA-256 so contributions invalidate when the remote document changes.
+    # - `#replay(descriptor)` — records a {Cache::Descriptor}'s rows as though this boundary had observed
+    #   them (#1558). A producer served from its own cache ran no block and read nothing, so
+    #   {Plugin::Base#cache_for} replays the served entry's stored dependency rows here; the run-result
+    #   descriptor and any enclosing producer's descriptor then carry the served value's inputs.
     class IoBoundary
       URL_TIMEOUT_SECONDS = 10
       URL_MAX_BYTES = 10 * 1024 * 1024
 
+      ATTRIBUTION_KEY = :rigor_io_boundary_attribution
+      private_constant :ATTRIBUTION_KEY
+
+      # ADR-45 WD2 (#1507) — runs the block with `sink` (an Array) receiving every file and listing row ANY
+      # boundary records on this thread meanwhile, in addition to the boundary's own table, and returns the
+      # block's value. `Analysis::Runner` wraps each file's analysis in one when it records dependencies, so the
+      # `--incremental` session can keep the reads one file's analysis made beside that file's cached answer: a
+      # later run that serves the answer without re-analysing the file still has to validate what it read.
+      #
+      # A thread variable rather than a fiber-local, so a read a plugin makes from inside an `Enumerator` still
+      # lands in the sink. The boundary's own table is unchanged by it, including its first-existence-row-stands
+      # rule: the sink records what each read observed. Only reads are credited: a value a plugin memoised reaches
+      # later files without one, so the first file to trigger the read is the only one credited with it.
+      def self.attributing(sink)
+        previous = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, sink)
+        yield
+      ensure
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, previous)
+      end
+
+      def self.attribute(entry)
+        Thread.current.thread_variable_get(ATTRIBUTION_KEY)&.push(entry)
+      end
+
       attr_reader :policy, :plugin_id
 
       def initialize(policy:, plugin_id:, http_client: DefaultHttpClient.new)
@@ -61,7 +90,7 @@ module Rigor
         @first_refused_path = nil
       end
 
-      # Issue #959 — `TrustPolicy#allow_read?` refuses a path purely by `File.expand_path` comparison
+      # Issue #959 — `TrustPolicy#allow_read?` refuses a path purely by `File.absolute_path` comparison
       # (ADR-2's documented bound; no `File.realpath`), so a project rooted under a symlink (macOS'
       # `/tmp` → `/private/tmp` alias is the common case) can have every plugin read refused with no
       # visible cause: the boundary answered "not readable" and the plugin swallowed or surfaced only its
@@ -96,7 +125,7 @@ module Rigor
       # outcome is recorded: a path that exists but cannot be read (`EISDIR`, `EACCES`) is a failure the
       # plugin reports, not a probe of absence, and records nothing — as before.
       def read_file(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
           raise AccessDeniedError.new(
@@ -159,7 +188,7 @@ module Rigor
       # @param path — project directory; relative paths expand against the working directory
       # @return the absolute paths directly under `path` in `Dir.glob` order; empty when not a directory
       def list_directory(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         entries = Dir.glob(File.join(absolute, "*"))
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
@@ -202,8 +231,53 @@ module Rigor
         Cache::Descriptor.new(files: files, configs: configs, globs: globs)
       end
 
+      # #1558 — records every row of `descriptor` as though this boundary had observed it. The caller is
+      # {Plugin::Base#cache_for}: a producer served from its own cache ran no block, so without the replay
+      # the value's inputs reached neither the ADR-45 run-result descriptor nor the dependency descriptor of
+      # a producer computing around it, and both went on validating fresh after those inputs changed.
+      #
+      # The rows are the ones a fresh hit just validated, so they describe the current filesystem, and they
+      # are merged by the precedence the live recorders use. A content row (`:stat` / `:digest` / `:mtime`)
+      # replaces an existence row for its path, as {#read_file} does after a probe. Any other collision
+      # keeps the row already here: an existence row never displaces one, as in {#probe}, and between two
+      # content rows or two glob rows for one slot the live row carries the newer stat tuple, which keeps
+      # the next warm run on its stat fast path. The tables are keyed by path, glob slot and URL key, so
+      # replaying the same descriptor twice adds nothing. Row order reaches no cache key, because
+      # {Cache::Descriptor#to_canonical_hash} sorts every slot.
+      #
+      # The policy is not consulted: the rows were recorded under it when the entry was written, and replay
+      # reads no file. A {Cache::Descriptor::GlobEntry} keeps its `mode`, which is part of its slot key.
+      #
+      # ADR-45 WD2 (#1507) — every replayed row is also handed to the {.attributing} sink, the ones a held row
+      # wins over included, exactly as the live recorders hand over what each read observed: a producer first
+      # asked while a file is analysed (rigor-actionpack's `:controller_index`, rigor-rails-i18n's
+      # `:locale_index`) serves that file its inputs, and the `--incremental` slot must credit them to it. On a
+      # miss the replayed descriptor is the whole boundary's ({Plugin::Base#producer_dependency_descriptor}), so
+      # the file is also credited with rows other reads recorded; that over-credits, which only ever makes the
+      # slot decline sooner.
+      #
+      # @param descriptor — a dependency descriptor; only its `files`, `configs` and `globs` slots are read,
+      #   the only slots a boundary records
+      def replay(descriptor)
+        @mutex.synchronize do
+          descriptor.files.each { |entry| replay_file_entry(entry) }
+          descriptor.configs.each { |entry| @config_entries[entry.key] ||= entry }
+          descriptor.globs.each { |entry| @glob_entries[entry.slot_key] ||= entry }
+        end
+        (descriptor.files + descriptor.globs).each { |entry| self.class.attribute(entry) }
+        nil
+      end
+
       private
 
+      # The {#replay} precedence for one file row; the caller holds `@mutex`.
+      def replay_file_entry(entry)
+        current = @file_entries[entry.path]
+        return if current && !(current.comparator == :exists && entry.comparator != :exists)
+
+        @file_entries[entry.path] = entry
+      end
+
       # ADR-45 WD1b (#613) — the shared body of {#file?} / {#directory?}.
       #
       # The probe answers TRUTHFULLY for every path, in or out of the trusted-read scope, and never raises:
@@ -222,7 +296,7 @@ module Rigor
       #   reverse) → NOTHING, the same bound `#read_file` pins for `EISDIR`: the probe observed neither a
       #   usable file nor an absence, and either row would misdescribe what the plugin saw.
       def probe(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         answer = yield(absolute)
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
@@ -247,6 +321,7 @@ module Rigor
         # A content row replaces an earlier existence row for the same path outright: the file appeared and
         # its bytes were consumed, and a content row validates existence as well as content.
         @mutex.synchronize { @file_entries[path] = entry }
+        self.class.attribute(entry)
       end
 
       # ADR-45 WD1 (#577) — the absence row for a probed-but-missing path. A content row already recorded
@@ -263,6 +338,7 @@ module Rigor
       def record_absence_entry(path)
         entry = Cache::Descriptor::FileEntry.absent(path: path)
         @mutex.synchronize { @file_entries[path] ||= entry }
+        self.class.attribute(entry)
       end
 
       # ADR-45 WD1b (#613) — the presence row: fresh while the probed path exists, stale once it is gone.
@@ -273,6 +349,7 @@ module Rigor
       def record_presence_entry(path)
         entry = Cache::Descriptor::FileEntry.present(path: path)
         @mutex.synchronize { @file_entries[path] ||= entry }
+        self.class.attribute(entry)
       end
 
       # ADR-45 WD1c (#629) — the listing row for {#list_directory}, deduplicated per (root, pattern) slot.
@@ -281,6 +358,7 @@ module Rigor
       def record_glob_entry(root, pattern)
         entry = Cache::Descriptor::GlobEntry.compute(root: root, pattern: pattern)
         @mutex.synchronize { @glob_entries[entry.slot_key] = entry }
+        self.class.attribute(entry)
       end
 
       # Issue #959 — records that `path` fell outside every {TrustPolicy} read root, for {#refusal_summary}.

data/lib/rigor/plugin/isolation.rb

@@ -47,7 +47,7 @@ module Rigor
       # build resolves the same root and skips the write — #414), and reading an unshareable value out of
       # a module ivar from a non-main Ractor is the same `Ractor::IsolationError` as writing one.
       def target_bundle_root=(root)
-        @target_bundle_root = root.nil? ? nil : File.expand_path(root.to_s).freeze
+        @target_bundle_root = root.nil? ? nil : File.absolute_path(root.to_s).freeze
       end
 
       # Requires `feature`, falling back to the analyzed project's bundler install tree. The fallback

data/lib/rigor/plugin/trust_policy.rb

@@ -36,7 +36,7 @@ module Rigor
 
         @trusted_gems = trusted_gems.map { |g| g.to_s.dup.freeze }.uniq.sort.freeze
         @allowed_read_roots = allowed_read_roots
-                              .map { |path| File.expand_path(path).freeze }
+                              .map { |path| File.absolute_path(path).freeze }
                               .uniq
                               .sort
                               .freeze
@@ -46,10 +46,10 @@ module Rigor
       end
 
       # @return true when the absolute path falls inside any allowed read root. Symlinks are
-      #   resolved through `File.expand_path` only (no `realpath`); plugins with adversarial intent are out of
+      #   resolved through `File.absolute_path` only (no `realpath`); plugins with adversarial intent are out of
       #   scope per ADR-2.
       def allow_read?(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         @allowed_read_roots.any? { |root| inside?(absolute, root) }
       end
 

data/lib/rigor/protection/discovery_seed.rb

@@ -17,8 +17,8 @@ module Rigor
     #
     # The answer (issue #260's recorded decision) is one table set, built once, threaded to both sides: the
     # {Mutator} base scope and {DiagnosticOracle}'s runner seam. This module builds that table set — the FULL
-    # discovery bundle (`discovered_def_nodes`, `discovered_methods`, superclasses, includes, …), not just the
-    # class-identity slice site selection needed, because resolving `find` on `singleton(Account)` is what makes
+    # discovery bundle (`discovered_def_nodes`, `discovered_methods`, superclasses, includes, extends, …), not just
+    # the class-identity slice site selection needed, because resolving `find` on `singleton(Account)` is what makes
     # the site killable.
     #
     # The shape is a plain Hash of {Scope::DiscoveryIndex} slot names, which is exactly what both consumers take:
@@ -84,9 +84,10 @@ module Rigor
       # collectors driven over the same tree) that {Analysis::Runner::ProjectPrePasses#discover} uses. Empty
       # tables are dropped so an empty seed stays `{}` and every consumer's "seed nothing" branch keeps working.
       #
-      # `discovered_class_sources` is deliberately NOT carried: the runner itself seeds it only under dependency
-      # recording (it is read by the ancestry accessors solely to record cross-file edges), and Tier 2 never
-      # records.
+      # `discovered_class_sources` is carried as the runner carries it on every run: Tier 2 never records edges,
+      # but an ancestor-order reader asks whether a class is declared in more than one file. The mixin tables
+      # (`discovered_includes`, `discovered_prepends`, `discovered_extends`) ride the same fold, so a singleton
+      # `extend` reads the same from a per-file scope under coverage and protection as it does under `check`.
       def discovery_tables(paths)
         seed_tables(Inference::ScopeIndexer.discovered_project_index_for_paths(paths))
       end
@@ -99,19 +100,27 @@ module Rigor
         tables = { discovered_classes: index.fetch(:classes) }
         %i[
           def_nodes def_nestings singleton_def_nodes def_sources singleton_def_sources superclasses includes
-          prepends
+          extends prepends unpositioned_mixins class_sources
           method_visibilities methods parameter_envelopes data_member_layouts struct_member_layouts
           deferred_ranges refinements global_write_census
         ].each do |slot|
           tables[seed_key(slot)] = def_index.fetch(slot)
         end
-        tables.reject { |_, table| table.nil? || table.empty? }
+        # ADR-119 WD1 — the pairs travel as one: an unpaired empty table is dropped here, a pair only when both
+        # halves are empty (`compact_pairs`), so a non-empty sibling is never stranded by an empty member.
+        tables.merge!(def_index.fetch(:siblings))
+        Scope::DiscoveryIndex.compact_pairs(
+          tables.reject { |name, table| !Scope::DiscoveryIndex.paired?(name) && (table.nil? || table.empty?) }
+        )
       end
 
+      UNPREFIXED_SLOTS = %i[data_member_layouts struct_member_layouts unpositioned_mixins].freeze
+      private_constant :UNPREFIXED_SLOTS
+
       # The def-index slot names match the {Scope::DiscoveryIndex} ones under a `discovered_` prefix, except the
-      # two member-layout tables, which carry the same name on both sides.
+      # two member-layout tables and the unpositioned-mixin table, which carry the same name on both sides.
       def seed_key(slot)
-        slot.to_s.end_with?("member_layouts") ? slot : :"discovered_#{slot}"
+        UNPREFIXED_SLOTS.include?(slot) ? slot : :"discovered_#{slot}"
       end
     end
   end

data/lib/rigor/protection/mutation_cache.rb

@@ -140,7 +140,7 @@ module Rigor
         end
 
         def snapshot_root_candidates(roots, configured)
-          [roots, Array(roots).map { |path| File.expand_path(path) },
+          [roots, Array(roots).map { |path| File.absolute_path(path) },
            configured, Array(configured).map { |path| relative_to_pwd(path) }]
             .compact.reject(&:empty?).uniq
         end
@@ -148,8 +148,8 @@ module Rigor
         # `path` rendered relative to the working directory when it lies underneath it; unchanged otherwise.
         # Shared by the root-candidate list and the per-file snapshot lookup, which face the same skew.
         def relative_to_pwd(path)
-          absolute = File.expand_path(path)
-          prefix = "#{File.expand_path(Dir.pwd)}#{File::SEPARATOR}"
+          absolute = File.absolute_path(path)
+          prefix = "#{File.absolute_path(Dir.pwd)}#{File::SEPARATOR}"
           absolute.start_with?(prefix) ? absolute.delete_prefix(prefix) : path.to_s
         end
 

data/lib/rigor/reflection/constant_ancestors.rb

@@ -11,18 +11,27 @@ module Rigor
     ANCESTOR_SCOPES_KEY = :__rigor_ancestor_constant_scopes__
     private_constant :ANCESTOR_SCOPES_KEY
 
+    # The recording run's slot. See {.recorded_ancestor_constant_scopes}.
+    RECORDED_ANCESTOR_SCOPES_KEY = :__rigor_recorded_ancestor_constant_scopes__
+    private_constant :RECORDED_ANCESTOR_SCOPES_KEY
+
     module_function
 
     # #354 — the project classes and modules whose own constants `class_name` inherits, in Ruby's
-    # ancestor order: included / prepended modules before the superclass (Ruby places mixins nearer),
-    # transitively, breadth-first. `class_name` itself is excluded — step 1 already covered it.
+    # ancestor order: the entries of `class_name`'s `Scope::ResolutionChain` — prepended modules, then
+    # included ones, then the superclass's chain likewise — each once. `class_name` itself is excluded:
+    # step 1 already covered it.
+    #
+    # Issue #1571 — this was a breadth-first walk of its own, which is not Ruby's order: `class C < Base;
+    # include A` with `A` including `M` reached `Base::X` (depth 1) before `M::X` (depth 2), while Ruby's
+    # ancestors are `[C, A, M, Base]`. It reads the chain's `:constants` flavor, whose predicate for a
+    # project class also admits a module that holds only constants.
     #
-    # Only PROJECT ancestors appear. `Scope#superclass_of` / `#includes_of` carry as-written names
-    # from the discovery pre-pass, and an as-written name that resolves to no discovered class or
-    # module is dropped — so a `class Foo < ActiveRecord::Base` contributes nothing and a constant
-    # owned by an RBS-known ancestor still resolves only if the bare name reaches it at step 3. That
-    # gap is deliberate for this slice: widening to the RBS ancestor graph is a separate question
-    # with its own FP surface.
+    # Only PROJECT ancestors appear: an as-written name that resolves to no discovered class or module
+    # is an external entry on the chain and contributes nothing here, so a `class Foo <
+    # ActiveRecord::Base` adds no candidate and a constant owned by an RBS-known ancestor still resolves
+    # only if the bare name reaches it at step 3. That gap is deliberate for this slice: widening to the
+    # RBS ancestor graph is a separate question with its own FP surface.
     #
     # Memoised per run because step 2 runs on every constant reference whose lexical candidates all
     # miss — which is the common case for a core-class reference (`String` inside `class Foo`). The
@@ -30,11 +39,49 @@ module Rigor
     # back to the per-file discovery table for runner-less scopes, so a re-run in one process (LSP,
     # ADR-62 warm loop) cannot hit stale entries.
     def ancestor_constant_scopes(class_name, scope)
-      # ADR-46: `superclass_of` / `includes_of` record a cross-file class dependency per consumer
-      # file, and the memo is run-scoped rather than file-scoped — a hit would skip the recording and
-      # under-record the edge for every later file. Recording runs are rare (incremental only), so
-      # they simply bypass the memo rather than complicate its key.
-      return compute_ancestor_constant_scopes(class_name, scope) if Analysis::DependencyRecorder.active?
+      ancestor_constant_worlds(class_name, scope).first
+    end
+    private_class_method :ancestor_constant_scopes
+
+    # ADR-24 / #1570 — the first ancestor that owns a constant, asked as {.ancestor_constant_scopes} orders
+    # them and settled by `Scope::ResolutionChain#settle`: the block's first truthy answer where the chain
+    # stands, and otherwise the answer of the breadth-first order this rung used before the chain
+    # (`Scope::ResolutionChain::MasterOrder`) — where a skipped `include` would put a different owner first,
+    # which constant Ruby reads depends on the order the bodies ran.
+    def agreed_ancestor_hit(class_name, scope, &)
+      scopes, chain = ancestor_constant_worlds(class_name, scope)
+      owner, hit = first_ancestor_hit(scopes, &)
+      verdict = chain.settle(scope, owner, owner: owner) do |retro|
+        first_ancestor_hit(constant_scopes_of(retro, class_name), &)&.first
+      end
+      return hit if verdict == :chain
+
+      first_ancestor_hit(master_constant_scopes(class_name, scope), &)&.last
+    end
+    private_class_method :agreed_ancestor_hit
+
+    def master_constant_scopes(class_name, scope)
+      Scope::ResolutionChain::MasterOrder.breadth_first(scope, class_name.to_s, :constants)
+    end
+    private_class_method :master_constant_scopes
+
+    def first_ancestor_hit(entries)
+      entries.each do |entry|
+        hit = yield entry
+        return [entry, hit] if hit
+      end
+      nil
+    end
+    private_class_method :first_ancestor_hit
+
+    # `[scopes, chain]` — {.ancestor_constant_scopes} and the chain they were read from, which settles the
+    # answer.
+    def ancestor_constant_worlds(class_name, scope)
+      # ADR-46: the answer depends on every class on the chain, and the memo is run-scoped rather than
+      # file-scoped — a hit would skip the recording and under-record the edge for every later file. A
+      # recording run reads the chain, which is memoised per discovery index, and files its edges on
+      # every call.
+      return recorded_ancestor_constant_scopes(class_name, scope) if Analysis::DependencyRecorder.active?
 
       generation = scope.run_generation || scope.discovered_superclasses
       slot = Thread.current[ANCESTOR_SCOPES_KEY]
@@ -45,48 +92,50 @@ module Rigor
       bucket = slot[1]
       bucket.fetch(class_name) { bucket[class_name] = compute_ancestor_constant_scopes(class_name, scope) }
     end
-    private_class_method :ancestor_constant_scopes
-
-    def compute_ancestor_constant_scopes(class_name, scope)
-      queue = [class_name]
-      seen = { class_name => true }
-      out = []
-      until queue.empty?
-        current = queue.shift
-        # Mixins first, then the superclass — Ruby's ancestor order.
-        scope.includes_of(current).each do |raw|
-          resolved = resolve_ancestor_name(current, raw, scope)
-          next if resolved.nil? || seen[resolved]
+    private_class_method :ancestor_constant_worlds
 
-          seen[resolved] = true
-          out << resolved
-          queue << resolved
-        end
-        raw_super = scope.superclass_of(current)
-        next if raw_super.nil?
+    # The recording run's memo. The answer is every project entry of the chain, so its edges are the
+    # root's and every entry's — what `Scope::ResolutionChain#record` files, which a computation does and a
+    # hit replays, in the same order. One slot keyed on the discovery index: the answer and the edges are
+    # both read from it, so the key is exact, and the slot never pins more than the index it serves.
+    def recorded_ancestor_constant_scopes(class_name, scope)
+      discovery = scope.discovery
+      slot = Thread.current[RECORDED_ANCESTOR_SCOPES_KEY]
+      unless slot && slot[0].equal?(discovery)
+        slot = [discovery, {}]
+        Thread.current[RECORDED_ANCESTOR_SCOPES_KEY] = slot
+      end
+      bucket = slot[1]
+      worlds = bucket[class_name]
+      return bucket[class_name] = compute_ancestor_constant_scopes(class_name, scope) if worlds.nil?
 
-        resolved_super = resolve_ancestor_name(current, raw_super, scope)
-        next if resolved_super.nil? || seen[resolved_super]
+      Scope::ResolutionChain.for(scope, class_name.to_s, :instance, :constants).record(scope)
+      worlds
+    end
+    private_class_method :recorded_ancestor_constant_scopes
 
-        seen[resolved_super] = true
-        out << resolved_super
-        queue << resolved_super
-      end
-      out.freeze
+    # Reads the chain whole, so a recording run files every class on it (a no-op otherwise).
+    def compute_ancestor_constant_scopes(class_name, scope)
+      chain = Scope::ResolutionChain.for(scope, class_name.to_s, :instance, :constants)
+      chain.record(scope)
+      scopes = constant_scopes_of(chain, class_name)
+      [scopes, chain].freeze
     end
     private_class_method :compute_ancestor_constant_scopes
 
-    # Resolves an ancestor name AS WRITTEN (`"Base"`, or a qualified `"A::B"`) against the nesting in
-    # force where the subclass's header is written — `Scope#ancestor_name_candidates`, the single
-    # owner of that order, which `Scope#enqueue_ancestors` reads for method lookup and the
-    # override-visibility rule reads for its own walk. Returns nil when no candidate names a
-    # discovered project class or module.
-    def resolve_ancestor_name(subclass_qualified, raw, scope)
-      scope.ancestor_name_candidates(subclass_qualified, raw)
-           .find { |candidate| known_project_namespace?(candidate, scope) }
+    # The chain's project entries in order, each once, without `class_name` itself.
+    def constant_scopes_of(chain, class_name)
+      out = []
+      chain.entries.each do |entry|
+        name = entry.name
+        out << name unless name.nil? || name == class_name || out.include?(name)
+      end
+      out.freeze
     end
-    private_class_method :resolve_ancestor_name
+    private_class_method :constant_scopes_of
 
+    # Whether `name` is a namespace the project declares — the predicate the chain's `:constants` flavor
+    # resolves ancestor names with, and the path walk's (`reflection/constant_path.rb`) test for a head.
     def known_project_namespace?(name, scope)
       scope.discovered_superclasses.key?(name) ||
         scope.discovered_includes.key?(name) ||

data/lib/rigor/reflection/constant_path.rb

@@ -81,7 +81,10 @@ module Rigor
 
       prefix = caller_derived ? enclosing_class_path(scope) : nil
       unless prefix.nil? || prefix.empty?
-        hit = first_namespace_hit(bounded_ancestor_scopes(prefix, scope), head, scope)
+        hit = bounded_agreed_hit(prefix, scope) do |entry|
+          candidate = "#{entry}::#{head}"
+          candidate if namespace_known?(candidate, scope)
+        end
         return hit if hit
       end
 
@@ -106,28 +109,40 @@ module Rigor
       candidate = "#{owner}::#{segment}"
       return candidate if yield(candidate)
 
-      bounded_ancestor_scopes(owner, scope).each do |ancestor|
+      bounded_agreed_hit(owner, scope) do |ancestor|
         inherited = "#{ancestor}::#{segment}"
-        return inherited if yield(inherited)
+        inherited if yield(inherited)
       end
-      nil
     end
     private_class_method :constant_in_namespace
 
+    # {.agreed_ancestor_hit} over the budget-bounded scope lists: the first answer where
+    # `Scope::ResolutionChain#settle` lets the chain stand, and otherwise the breadth-first order's.
+    def bounded_agreed_hit(class_name, scope, &)
+      scopes, chain = ancestor_constant_worlds(class_name, scope)
+      owner, hit = first_ancestor_hit(bounded(scopes), &)
+      verdict = chain.settle(scope, owner, owner: owner) do |retro|
+        first_ancestor_hit(bounded(constant_scopes_of(retro, class_name)), &)&.first
+      end
+      return hit if verdict == :chain
+
+      first_ancestor_hit(bounded(master_constant_scopes(class_name, scope)), &)&.last
+    end
+    private_class_method :bounded_agreed_hit
+
     # How many of {.ancestor_constant_scopes}' entries one segment may consult, under
     # `Scope::ANCESTOR_WALK_LIMIT` — the budget `Scope`'s method lookup already spends on this same
     # graph, reused rather than re-chosen so one pathological ancestry costs one bound. The list
     # itself is the memoised one step 2 builds, so this bounds the per-segment consultation the walk
     # adds and not the graph. Reported through the shared counter, so a truncated walk is visible in a
     # budget trace instead of looking like a plain miss.
-    def bounded_ancestor_scopes(class_name, scope)
-      scopes = ancestor_constant_scopes(class_name, scope)
+    def bounded(scopes)
       return scopes if scopes.size <= Scope::ANCESTOR_WALK_LIMIT
 
       Inference::BudgetTrace.hit(Inference::BudgetTrace::ANCESTOR_WALK_LIMIT)
       scopes.first(Scope::ANCESTOR_WALK_LIMIT)
     end
-    private_class_method :bounded_ancestor_scopes
+    private_class_method :bounded
 
     # Whether `name` can OWN a constant. `class_known?` covers the RBS and registry classes and modules;
     # the project tables cover a namespace the project declares with no RBS for it.

data/lib/rigor/reflection.rb

@@ -220,7 +220,7 @@ module Rigor
     def ancestor_constant_type(name, scope, prefix, shadows)
       return nil if prefix.nil? || prefix.empty?
 
-      first_constant_hit(ancestor_constant_scopes(prefix, scope), name, scope, shadows)
+      agreed_ancestor_hit(prefix, scope) { |entry| constant_type_at("#{entry}::#{name}", scope, shadows) }
     end
     private_class_method :ancestor_constant_type
 
@@ -322,8 +322,7 @@ module Rigor
     # ({Analysis::Incremental.changed_constant_publications}). Gated by the caller on the recorder being
     # active, so an ordinary run pays one integer read.
     def record_constant_reference(name)
-      segment = name.delete_prefix("::").split("::").last
-      Analysis::DependencyRecorder.read_name(:constant, segment) if segment
+      Analysis::DependencyRecorder.read_last_segment(:constant, name)
     end
     private_class_method :record_constant_reference