rigortype 0.4.0 → 0.4.2

data/lib/rigor/plugin/base.rb

@@ -882,7 +882,7 @@ module Rigor
 
         before, separator, = file.rpartition("/lib/")
         root = separator.empty? ? File.dirname(file) : before
-        relative.map { |rel| File.expand_path(rel, root) }
+        relative.map { |rel| File.absolute_path(rel, root) }
       end
 
       # ADR-28 — the path-scoped method-protocol contracts this plugin contributes. Defaults to the
@@ -940,6 +940,17 @@ module Rigor
       # changed. The producer id is auto-prefixed `plugin.<manifest.id>.` per ADR-7 § "Slice 6-C" so plugin
       # caches stay sandboxed from built-in producers.
       #
+      # #1558 — whichever way the value arrives, the boundary ends up holding every row of the producer's
+      # dependency descriptor. A hit ran no block and read nothing, so the served entry's stored rows are
+      # replayed into it ({IoBoundary#replay}); a miss read its inputs itself, and replaying the descriptor it
+      # just recorded adds the evaluated `watch:` rows, the only rows the block did not record. The boundary
+      # is per plugin and accumulates for the run, so the rows reach the ADR-45 run-result descriptor
+      # (`Runner#build_run_dependency_descriptor`) and the descriptor of every producer of this plugin
+      # computed after it, whether its block asked this one or it composes a value this one returned
+      # earlier. Without the replay a producer recomputed after a served one stored no row for the served
+      # value's inputs, and neither did the run: rigor-activerecord's `:model_index`, recomputed after a
+      # model edit while `:schema_table` hit, kept its stale columns after `db/schema.rb` changed.
+      #
       # When `services.cache_store` is `nil` (e.g. CLI `--no-cache`), the callable bypasses the cache and
       # runs the producer block every time — same semantics as the v0.0.9 cache surface for built-in
       # producers.
@@ -974,11 +985,9 @@ module Rigor
             generation_cap: producer[:generation_cap],
             params: params,
             serialize: pair_serializer(producer[:serialize]),
-            deserialize: pair_deserializer(producer[:deserialize])
-          ) do
-            value = compute.call
-            [value, producer_dependency_descriptor(producer)]
-          end
+            deserialize: pair_deserializer(producer[:deserialize]),
+            on_hit: ->(dependencies) { io_boundary.replay(dependencies) }
+          ) { computed_producer_pair(producer, compute) }
         end
       end
 
@@ -1151,7 +1160,7 @@ module Rigor
 
       def collect_glob_files(roots, patterns)
         matched = roots.flat_map do |root|
-          absolute = File.expand_path(root.to_s)
+          absolute = File.absolute_path(root.to_s)
           next [] unless File.directory?(absolute)
 
           patterns.flat_map { |pattern| Dir.glob(File.join(absolute, pattern.to_s)) }
@@ -1196,6 +1205,17 @@ module Rigor
         Cache::Descriptor.compose(auto_built, extra)
       end
 
+      # #1558 — the miss half of {#cache_for}. The block's own reads are in the boundary already, so replaying
+      # the descriptor it just recorded adds the evaluated `watch:` rows, as a hit's replay of the stored
+      # descriptor does; a producer computing around this one then records one row set whichever way this
+      # value arrived.
+      def computed_producer_pair(producer, compute)
+        value = compute.call
+        dependencies = producer_dependency_descriptor(producer)
+        io_boundary.replay(dependencies)
+        [value, dependencies]
+      end
+
       # ADR-60 WD3 — the dependency descriptor stored beside the producer's value, built AFTER the block ran
       # so every in-block `io_boundary` read is captured, plus the evaluated `watch:` glob rows.
       #
@@ -1224,7 +1244,7 @@ module Rigor
         Array(tuples).flat_map do |tuple|
           roots, *patterns = Array(tuple)
           Array(roots).flat_map do |root|
-            absolute = File.expand_path(root.to_s)
+            absolute = File.absolute_path(root.to_s)
             patterns.map { |pattern| Cache::Descriptor::GlobEntry.compute(root: absolute, pattern: pattern.to_s) }
           end
         end.uniq

data/lib/rigor/plugin/inflector.rb

@@ -54,7 +54,7 @@ module Rigor
       # by `rigor plugins` (ADR-90) to probe {available?} at activation time — so a standalone install
       # where inflection silently degrades reports the degradation instead of an unqualified `[OK]`. When
       # a new plugin adopts the helper, add its manifest id here.
-      CONSUMER_PLUGIN_IDS = %w[actionmailer actionpack activerecord factorybot rails-routes].freeze
+      CONSUMER_PLUGIN_IDS = %w[actionmailer actionpack activerecord alba factorybot rails-routes].freeze
 
       # Raised when `ActiveSupport::Inflector` is required for an inflection but cannot be loaded. Caught by
       # the per-plugin isolation boundary, so it surfaces as "this plugin produced no diagnostics" rather than

data/lib/rigor/plugin/io_boundary.rb

@@ -43,10 +43,39 @@ module Rigor
     # - `#cache_descriptor` — flushes the accumulated entries into a fresh {Cache::Descriptor} for the
     #   contribution that built it. URL fetches contribute `ConfigEntry` rows keyed `"url:#{url}"` with the
     #   response body's SHA-256 so contributions invalidate when the remote document changes.
+    # - `#replay(descriptor)` — records a {Cache::Descriptor}'s rows as though this boundary had observed
+    #   them (#1558). A producer served from its own cache ran no block and read nothing, so
+    #   {Plugin::Base#cache_for} replays the served entry's stored dependency rows here; the run-result
+    #   descriptor and any enclosing producer's descriptor then carry the served value's inputs.
     class IoBoundary
       URL_TIMEOUT_SECONDS = 10
       URL_MAX_BYTES = 10 * 1024 * 1024
 
+      ATTRIBUTION_KEY = :rigor_io_boundary_attribution
+      private_constant :ATTRIBUTION_KEY
+
+      # ADR-45 WD2 (#1507) — runs the block with `sink` (an Array) receiving every file and listing row ANY
+      # boundary records on this thread meanwhile, in addition to the boundary's own table, and returns the
+      # block's value. `Analysis::Runner` wraps each file's analysis in one when it records dependencies, so the
+      # `--incremental` session can keep the reads one file's analysis made beside that file's cached answer: a
+      # later run that serves the answer without re-analysing the file still has to validate what it read.
+      #
+      # A thread variable rather than a fiber-local, so a read a plugin makes from inside an `Enumerator` still
+      # lands in the sink. The boundary's own table is unchanged by it, including its first-existence-row-stands
+      # rule: the sink records what each read observed. Only reads are credited: a value a plugin memoised reaches
+      # later files without one, so the first file to trigger the read is the only one credited with it.
+      def self.attributing(sink)
+        previous = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, sink)
+        yield
+      ensure
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, previous)
+      end
+
+      def self.attribute(entry)
+        Thread.current.thread_variable_get(ATTRIBUTION_KEY)&.push(entry)
+      end
+
       attr_reader :policy, :plugin_id
 
       def initialize(policy:, plugin_id:, http_client: DefaultHttpClient.new)
@@ -61,7 +90,7 @@ module Rigor
         @first_refused_path = nil
       end
 
-      # Issue #959 — `TrustPolicy#allow_read?` refuses a path purely by `File.expand_path` comparison
+      # Issue #959 — `TrustPolicy#allow_read?` refuses a path purely by `File.absolute_path` comparison
       # (ADR-2's documented bound; no `File.realpath`), so a project rooted under a symlink (macOS'
       # `/tmp` → `/private/tmp` alias is the common case) can have every plugin read refused with no
       # visible cause: the boundary answered "not readable" and the plugin swallowed or surfaced only its
@@ -96,7 +125,7 @@ module Rigor
       # outcome is recorded: a path that exists but cannot be read (`EISDIR`, `EACCES`) is a failure the
       # plugin reports, not a probe of absence, and records nothing — as before.
       def read_file(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
           raise AccessDeniedError.new(
@@ -159,7 +188,7 @@ module Rigor
       # @param path — project directory; relative paths expand against the working directory
       # @return the absolute paths directly under `path` in `Dir.glob` order; empty when not a directory
       def list_directory(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         entries = Dir.glob(File.join(absolute, "*"))
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
@@ -170,6 +199,44 @@ module Rigor
         entries
       end
 
+      # Issue #1652 — the MEMBERSHIP fingerprint of a `Dir.glob` pattern under `root`, `**` included. Returns the
+      # matching paths and records one `:names` {Cache::Descriptor::GlobEntry} over `root` and `pattern`: the row
+      # reads stale when a match appears or disappears, in a subdirectory created after the read too, and NOT
+      # when a match's bytes or stat tuple move. A caller whose answer depends on a match's content MUST
+      # {#read_file} each match it reads; that row carries the edit. A stat signature here would read stale on
+      # every `touch`, checkout or restored CI cache, though the content the caller read is unchanged (#979's
+      # reasoning). {#list_directory} keeps its `:stat` listing row.
+      #
+      # The pattern must stay under `root`, since the policy is checked against `root` alone: a `..` segment, a
+      # brace (`{..,x}`) or a backslash escape (`.\\./`) raises {AccessDeniedError} (`:read_outside_scope`).
+      # The last two are refused outright because `Dir.glob` can spell `..` with them. Out of policy, `root` is
+      # globbed truthfully and contributes no row, as in {#list_directory}.
+      #
+      # @param root — project directory; relative paths expand against the working directory
+      # @param pattern — a `Dir.glob` pattern relative to `root`, such as `"ext/**/extconf.rb"`
+      # @return the absolute matching paths in `Dir.glob` order
+      def glob(root, pattern)
+        absolute = File.absolute_path(root.to_s)
+        pattern = pattern.to_s
+        if pattern.match?(/[{\\]/) || pattern.split("/").include?("..")
+          raise AccessDeniedError.new(
+            "plugin #{@plugin_id.inspect} cannot glob #{pattern.inspect} under #{absolute.inspect}: " \
+            "a `..` segment, a brace or a backslash can leave the root the trusted-read scope was checked against",
+            reason: :read_outside_scope,
+            resource: File.join(absolute, pattern)
+          )
+        end
+
+        entries = Dir.glob(File.join(absolute, pattern))
+        unless @policy.allow_read?(absolute)
+          record_refusal(absolute)
+          return entries
+        end
+
+        record_glob_entry(absolute, pattern, mode: :names)
+        entries
+      end
+
       # Fetches the URL when the policy permits it. Returns the response body. Raises {AccessDeniedError} when
       # the policy is `:disabled`, the URL scheme is not `https`, the host is not on the allowlist, the
       # response is non-2xx, the body exceeds {URL_MAX_BYTES}, or the request times out
@@ -202,8 +269,53 @@ module Rigor
         Cache::Descriptor.new(files: files, configs: configs, globs: globs)
       end
 
+      # #1558 — records every row of `descriptor` as though this boundary had observed it. The caller is
+      # {Plugin::Base#cache_for}: a producer served from its own cache ran no block, so without the replay
+      # the value's inputs reached neither the ADR-45 run-result descriptor nor the dependency descriptor of
+      # a producer computing around it, and both went on validating fresh after those inputs changed.
+      #
+      # The rows are the ones a fresh hit just validated, so they describe the current filesystem, and they
+      # are merged by the precedence the live recorders use. A content row (`:stat` / `:digest` / `:mtime`)
+      # replaces an existence row for its path, as {#read_file} does after a probe. Any other collision
+      # keeps the row already here: an existence row never displaces one, as in {#probe}, and between two
+      # content rows or two glob rows for one slot the live row carries the newer stat tuple, which keeps
+      # the next warm run on its stat fast path. The tables are keyed by path, glob slot and URL key, so
+      # replaying the same descriptor twice adds nothing. Row order reaches no cache key, because
+      # {Cache::Descriptor#to_canonical_hash} sorts every slot.
+      #
+      # The policy is not consulted: the rows were recorded under it when the entry was written, and replay
+      # reads no file. A {Cache::Descriptor::GlobEntry} keeps its `mode`, which is part of its slot key.
+      #
+      # ADR-45 WD2 (#1507) — every replayed row is also handed to the {.attributing} sink, the ones a held row
+      # wins over included, exactly as the live recorders hand over what each read observed: a producer first
+      # asked while a file is analysed (rigor-actionpack's `:controller_index`, rigor-rails-i18n's
+      # `:locale_index`) serves that file its inputs, and the `--incremental` slot must credit them to it. On a
+      # miss the replayed descriptor is the whole boundary's ({Plugin::Base#producer_dependency_descriptor}), so
+      # the file is also credited with rows other reads recorded; that over-credits, which only ever makes the
+      # slot decline sooner.
+      #
+      # @param descriptor — a dependency descriptor; only its `files`, `configs` and `globs` slots are read,
+      #   the only slots a boundary records
+      def replay(descriptor)
+        @mutex.synchronize do
+          descriptor.files.each { |entry| replay_file_entry(entry) }
+          descriptor.configs.each { |entry| @config_entries[entry.key] ||= entry }
+          descriptor.globs.each { |entry| @glob_entries[entry.slot_key] ||= entry }
+        end
+        (descriptor.files + descriptor.globs).each { |entry| self.class.attribute(entry) }
+        nil
+      end
+
       private
 
+      # The {#replay} precedence for one file row; the caller holds `@mutex`.
+      def replay_file_entry(entry)
+        current = @file_entries[entry.path]
+        return if current && !(current.comparator == :exists && entry.comparator != :exists)
+
+        @file_entries[entry.path] = entry
+      end
+
       # ADR-45 WD1b (#613) — the shared body of {#file?} / {#directory?}.
       #
       # The probe answers TRUTHFULLY for every path, in or out of the trusted-read scope, and never raises:
@@ -222,7 +334,7 @@ module Rigor
       #   reverse) → NOTHING, the same bound `#read_file` pins for `EISDIR`: the probe observed neither a
       #   usable file nor an absence, and either row would misdescribe what the plugin saw.
       def probe(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         answer = yield(absolute)
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
@@ -247,6 +359,7 @@ module Rigor
         # A content row replaces an earlier existence row for the same path outright: the file appeared and
         # its bytes were consumed, and a content row validates existence as well as content.
         @mutex.synchronize { @file_entries[path] = entry }
+        self.class.attribute(entry)
       end
 
       # ADR-45 WD1 (#577) — the absence row for a probed-but-missing path. A content row already recorded
@@ -263,6 +376,7 @@ module Rigor
       def record_absence_entry(path)
         entry = Cache::Descriptor::FileEntry.absent(path: path)
         @mutex.synchronize { @file_entries[path] ||= entry }
+        self.class.attribute(entry)
       end
 
       # ADR-45 WD1b (#613) — the presence row: fresh while the probed path exists, stale once it is gone.
@@ -273,14 +387,17 @@ module Rigor
       def record_presence_entry(path)
         entry = Cache::Descriptor::FileEntry.present(path: path)
         @mutex.synchronize { @file_entries[path] ||= entry }
+        self.class.attribute(entry)
       end
 
-      # ADR-45 WD1c (#629) — the listing row for {#list_directory}, deduplicated per (root, pattern) slot.
+      # ADR-45 WD1c (#629) — the listing row for {#list_directory} (and the `:names` row for {#glob}),
+      # deduplicated per (root, pattern, mode) slot.
       # Recomputed on each call rather than `||=`d, so a directory listed again after a mid-run mutation
       # carries the signature of the state the LAST reader saw.
-      def record_glob_entry(root, pattern)
-        entry = Cache::Descriptor::GlobEntry.compute(root: root, pattern: pattern)
+      def record_glob_entry(root, pattern, mode: :stat)
+        entry = Cache::Descriptor::GlobEntry.compute(root: root, pattern: pattern, mode: mode)
         @mutex.synchronize { @glob_entries[entry.slot_key] = entry }
+        self.class.attribute(entry)
       end
 
       # Issue #959 — records that `path` fell outside every {TrustPolicy} read root, for {#refusal_summary}.

data/lib/rigor/plugin/isolation.rb

@@ -47,7 +47,7 @@ module Rigor
       # build resolves the same root and skips the write — #414), and reading an unshareable value out of
       # a module ivar from a non-main Ractor is the same `Ractor::IsolationError` as writing one.
       def target_bundle_root=(root)
-        @target_bundle_root = root.nil? ? nil : File.expand_path(root.to_s).freeze
+        @target_bundle_root = root.nil? ? nil : File.absolute_path(root.to_s).freeze
       end
 
       # Requires `feature`, falling back to the analyzed project's bundler install tree. The fallback

data/lib/rigor/plugin/macro/block_as_method.rb

@@ -42,8 +42,20 @@ module Rigor
       #   `Nominal[Grape::Endpoint]` (the block is `instance_eval`'d on an instance of that class, e.g. a
       #   route body on `Grape::Endpoint`), and `"singleton(Grape::API::Instance)"` binds
       #   `Singleton[Grape::API::Instance]` (the block is `instance_eval`'d on that *class object*, e.g.
-      #   a `namespace` body on `Grape::API::Instance`). Reserved Symbol names (`:receiver_singleton`,
-      #   `:dsl_recorder`) remain unaccepted.
+      #   a `namespace` body on `Grape::API::Instance`). `:lexical` (issue #1667) leaves `self` as the caller's:
+      #   the method runs the block where it was written (`block.refined(M).call`), so the entry only declares
+      #   `refinements:`. Reserved Symbol names (`:receiver_singleton`, `:dsl_recorder`) remain unaccepted.
+      # - `refinements` — Array of fully-qualified module-name Strings (default `[]`, issue #1667, ADR-121 WD5).
+      #   The method runs the block under `Proc#refined` with these modules (`instance_exec(&block.refined(M))`),
+      #   so they are appended to the block body's in-effect refinements after its lexical list, in the declared
+      #   order (the last one wins). Nested blocks inherit them. A module that refines nothing the project or a
+      #   gem's source inference makes visible contributes nothing.
+      #
+      # ## Matching
+      #
+      # A `:receiver_instance` or `singleton(...)` entry matches `Singleton[X]` receivers only (a class-level DSL
+      # call). A named instance binding (`"Foo::Bar"`) and a `:lexical` entry also match `Nominal[X]` receivers:
+      # a `:lexical` method is as often an instance method (`ActiveRecord::Relation#where`) as a class-level one.
       #
       # ## Ractor-shareability
       #
@@ -51,7 +63,8 @@ module Rigor
       # mutable array does not leak into the value. `Ractor.shareable?` returns true after `#initialize`.
       class BlockAsMethod
         SELF_TYPE_RECEIVER_INSTANCE = :receiver_instance
-        VALID_SELF_TYPES = [SELF_TYPE_RECEIVER_INSTANCE].freeze
+        SELF_TYPE_LEXICAL = :lexical
+        VALID_SELF_TYPES = [SELF_TYPE_RECEIVER_INSTANCE, SELF_TYPE_LEXICAL].freeze
 
         CLASS_NAME_PATTERN = /[A-Z]\w*(?:::[A-Z]\w*)*/
         # `self_type: "Foo::Bar"` — the block is `instance_eval`'d on an instance of `Foo::Bar`.
@@ -60,16 +73,18 @@ module Rigor
         # object itself (Grape's `namespace`/`route_param` bodies run on `Grape::API::Instance`).
         SINGLETON_SELF_TYPE_PATTERN = /\Asingleton\((#{CLASS_NAME_PATTERN})\)\z/
 
-        attr_reader :receiver_constraint, :method_names, :self_type
+        attr_reader :receiver_constraint, :method_names, :self_type, :refinements
 
-        def initialize(receiver_constraint:, method_names:, self_type: SELF_TYPE_RECEIVER_INSTANCE)
+        def initialize(receiver_constraint:, method_names:, self_type: SELF_TYPE_RECEIVER_INSTANCE, refinements: [])
           validate_receiver_constraint!(receiver_constraint)
           validate_method_names!(method_names)
           validate_self_type!(self_type)
+          validate_refinements!(refinements)
 
           @receiver_constraint = receiver_constraint.dup.freeze
           @method_names = method_names.map(&:to_sym).freeze
           @self_type = self_type.is_a?(String) ? self_type.dup.freeze : self_type
+          @refinements = refinements.map { |name| name.dup.freeze }.freeze
           freeze
         end
 
@@ -77,7 +92,8 @@ module Rigor
           {
             "receiver_constraint" => receiver_constraint,
             "method_names" => method_names.map(&:to_s),
-            "self_type" => self_type.to_s
+            "self_type" => self_type.to_s,
+            "refinements" => refinements
           }
         end
 
@@ -85,12 +101,18 @@ module Rigor
           other.is_a?(BlockAsMethod) &&
             receiver_constraint == other.receiver_constraint &&
             method_names == other.method_names &&
-            self_type == other.self_type
+            self_type == other.self_type &&
+            refinements == other.refinements
         end
         alias eql? ==
 
         def hash
-          [receiver_constraint, method_names, self_type].hash
+          [receiver_constraint, method_names, self_type, refinements].hash
+        end
+
+        # Whether the block keeps the caller's `self` (`self_type: :lexical`).
+        def lexical_self?
+          self_type == SELF_TYPE_LEXICAL
         end
 
         # The class name a String `self_type` binds `self` to — `"Foo::Bar"` for both the plain and the
@@ -118,6 +140,12 @@ module Rigor
           self_type.is_a?(String) && !singleton_binding?
         end
 
+        # Whether `Nominal[X]` receivers match, beside `Singleton[X]` ones: a named instance binding, or a
+        # `:lexical` entry.
+        def matches_instance_receivers?
+          named_instance_binding? || lexical_self?
+        end
+
         private
 
         def validate_receiver_constraint!(value)
@@ -143,6 +171,21 @@ module Rigor
           end
         end
 
+        def validate_refinements!(refinements)
+          unless refinements.is_a?(Array)
+            raise ArgumentError,
+                  "Plugin::Macro::BlockAsMethod#refinements must be an Array, got #{refinements.inspect}"
+          end
+
+          refinements.each do |name|
+            next if name.is_a?(String) && name.match?(NAMED_SELF_TYPE_PATTERN)
+
+            raise ArgumentError,
+                  "Plugin::Macro::BlockAsMethod#refinements entries must be module-name Strings ('Foo::Bar'), " \
+                  "got #{name.inspect}"
+          end
+        end
+
         def validate_self_type!(self_type)
           return if VALID_SELF_TYPES.include?(self_type)
           return if self_type.is_a?(String) &&

data/lib/rigor/plugin/trust_policy.rb

@@ -36,7 +36,7 @@ module Rigor
 
         @trusted_gems = trusted_gems.map { |g| g.to_s.dup.freeze }.uniq.sort.freeze
         @allowed_read_roots = allowed_read_roots
-                              .map { |path| File.expand_path(path).freeze }
+                              .map { |path| File.absolute_path(path).freeze }
                               .uniq
                               .sort
                               .freeze
@@ -46,10 +46,10 @@ module Rigor
       end
 
       # @return true when the absolute path falls inside any allowed read root. Symlinks are
-      #   resolved through `File.expand_path` only (no `realpath`); plugins with adversarial intent are out of
+      #   resolved through `File.absolute_path` only (no `realpath`); plugins with adversarial intent are out of
       #   scope per ADR-2.
       def allow_read?(path)
-        absolute = File.expand_path(path.to_s)
+        absolute = File.absolute_path(path.to_s)
         @allowed_read_roots.any? { |root| inside?(absolute, root) }
       end
 

data/lib/rigor/project_environment.rb

@@ -53,16 +53,37 @@ module Rigor
     #   ADR-93 auto-wired `rigor-rbs-inline` entry when the library is resolvable).
     # @param source_files — the file(s) the command inspects. Threaded so each loaded plugin's
     #   `source_rbs_synthesizer` runs over them at env-build time; an empty list contributes no synthesized RBS.
-    def build(configuration:, source_files:)
+    # @param feature_sources — path => source text the required-feature scan reads in place of that file (an
+    #   editor buffer bound with `--tmp-file` / `--instead-of`).
+    def build(configuration:, source_files:, feature_sources: {})
+      features = required_features(configuration, source_files, sources: feature_sources)
       Environment.for_project(
         libraries: configuration.libraries,
         signature_paths: configuration.signature_paths,
         plugin_registry: load_plugin_registry(configuration),
         source_files: source_files,
+        required_features: features,
         **dependency_discovery_options(configuration)
       )
     rescue StandardError
-      bare(configuration)
+      bare(configuration, features)
+    end
+
+    # Issue #1700 — the {Environment::RequiredFeatures} the environment gates on: the configured paths plus
+    # `extra_files` (the file a probe inspects, which may lie outside them), the same set `rigor check` scans
+    # whichever files it is given, so a position types as `rigor check` types it.
+    def required_features(configuration, extra_files = [], sources: {})
+      Environment::RequiredFeatures.for_configuration(configuration, extra_files, sources: sources)
+    end
+
+    # The required-feature scan's view of an editor buffer (`--tmp-file` / `--instead-of`): its logical path
+    # read from its physical file. Empty without a buffer or when the file cannot be read.
+    def buffer_sources(buffer)
+      return {} if buffer.nil?
+
+      { buffer.logical_path => File.binread(buffer.physical_path) }
+    rescue SystemCallError
+      {}
     end
 
     # The dependency-discovery axes `check` reads off the configuration, as a keyword hash. Extracted so the
@@ -116,22 +137,24 @@ module Rigor
 
     # The first fail-soft floor: no plugin tier and no synthesized RBS, but still the project's own dependency
     # sources — dropping those is what issue #821 was, so a plugin-loading failure must not cost them.
-    def bare(configuration)
+    def bare(configuration, features = required_features(configuration))
       Environment.for_project(
         libraries: configuration.libraries,
         signature_paths: configuration.signature_paths,
+        required_features: features,
         **dependency_discovery_options(configuration)
       )
     rescue StandardError
-      minimal(configuration)
+      minimal(configuration, features)
     end
 
     # The last floor: RBS core plus the project's own signature paths, which cannot fail on anything outside
     # the project itself.
-    def minimal(configuration)
+    def minimal(configuration, features = [])
       Environment.for_project(
         libraries: configuration.libraries,
-        signature_paths: configuration.signature_paths
+        signature_paths: configuration.signature_paths,
+        required_features: features
       )
     end
   end

data/lib/rigor/protection/discovery_seed.rb

@@ -17,8 +17,8 @@ module Rigor
     #
     # The answer (issue #260's recorded decision) is one table set, built once, threaded to both sides: the
     # {Mutator} base scope and {DiagnosticOracle}'s runner seam. This module builds that table set — the FULL
-    # discovery bundle (`discovered_def_nodes`, `discovered_methods`, superclasses, includes, …), not just the
-    # class-identity slice site selection needed, because resolving `find` on `singleton(Account)` is what makes
+    # discovery bundle (`discovered_def_nodes`, `discovered_methods`, superclasses, includes, extends, …), not just
+    # the class-identity slice site selection needed, because resolving `find` on `singleton(Account)` is what makes
     # the site killable.
     #
     # The shape is a plain Hash of {Scope::DiscoveryIndex} slot names, which is exactly what both consumers take:
@@ -84,9 +84,10 @@ module Rigor
       # collectors driven over the same tree) that {Analysis::Runner::ProjectPrePasses#discover} uses. Empty
       # tables are dropped so an empty seed stays `{}` and every consumer's "seed nothing" branch keeps working.
       #
-      # `discovered_class_sources` is deliberately NOT carried: the runner itself seeds it only under dependency
-      # recording (it is read by the ancestry accessors solely to record cross-file edges), and Tier 2 never
-      # records.
+      # `discovered_class_sources` is carried as the runner carries it on every run: Tier 2 never records edges,
+      # but an ancestor-order reader asks whether a class is declared in more than one file. The mixin tables
+      # (`discovered_includes`, `discovered_prepends`, `discovered_extends`) ride the same fold, so a singleton
+      # `extend` reads the same from a per-file scope under coverage and protection as it does under `check`.
       def discovery_tables(paths)
         seed_tables(Inference::ScopeIndexer.discovered_project_index_for_paths(paths))
       end
@@ -99,19 +100,27 @@ module Rigor
         tables = { discovered_classes: index.fetch(:classes) }
         %i[
           def_nodes def_nestings singleton_def_nodes def_sources singleton_def_sources superclasses includes
-          prepends
+          extends prepends unpositioned_mixins class_sources
           method_visibilities methods parameter_envelopes data_member_layouts struct_member_layouts
           deferred_ranges refinements global_write_census
         ].each do |slot|
           tables[seed_key(slot)] = def_index.fetch(slot)
         end
-        tables.reject { |_, table| table.nil? || table.empty? }
+        # ADR-119 WD1 — the pairs travel as one: an unpaired empty table is dropped here, a pair only when both
+        # halves are empty (`compact_pairs`), so a non-empty sibling is never stranded by an empty member.
+        tables.merge!(def_index.fetch(:siblings))
+        Scope::DiscoveryIndex.compact_pairs(
+          tables.reject { |name, table| !Scope::DiscoveryIndex.paired?(name) && (table.nil? || table.empty?) }
+        )
       end
 
+      UNPREFIXED_SLOTS = %i[data_member_layouts struct_member_layouts unpositioned_mixins].freeze
+      private_constant :UNPREFIXED_SLOTS
+
       # The def-index slot names match the {Scope::DiscoveryIndex} ones under a `discovered_` prefix, except the
-      # two member-layout tables, which carry the same name on both sides.
+      # two member-layout tables and the unpositioned-mixin table, which carry the same name on both sides.
       def seed_key(slot)
-        slot.to_s.end_with?("member_layouts") ? slot : :"discovered_#{slot}"
+        UNPREFIXED_SLOTS.include?(slot) ? slot : :"discovered_#{slot}"
       end
     end
   end

data/lib/rigor/protection/mutation_cache.rb

@@ -140,7 +140,7 @@ module Rigor
         end
 
         def snapshot_root_candidates(roots, configured)
-          [roots, Array(roots).map { |path| File.expand_path(path) },
+          [roots, Array(roots).map { |path| File.absolute_path(path) },
            configured, Array(configured).map { |path| relative_to_pwd(path) }]
             .compact.reject(&:empty?).uniq
         end
@@ -148,8 +148,8 @@ module Rigor
         # `path` rendered relative to the working directory when it lies underneath it; unchanged otherwise.
         # Shared by the root-candidate list and the per-file snapshot lookup, which face the same skew.
         def relative_to_pwd(path)
-          absolute = File.expand_path(path)
-          prefix = "#{File.expand_path(Dir.pwd)}#{File::SEPARATOR}"
+          absolute = File.absolute_path(path)
+          prefix = "#{File.absolute_path(Dir.pwd)}#{File::SEPARATOR}"
           absolute.start_with?(prefix) ? absolute.delete_prefix(prefix) : path.to_s
         end
 
@@ -220,7 +220,7 @@ module Rigor
         def patched_rows(patched)
           patched.by_key.map do |(class_name, method_name, kind), entry|
             [class_name.to_s, method_name.to_s, kind.to_s, entry.source_path.to_s, entry.source_line,
-             entry.return_type&.describe(:short).to_s]
+             entry.return_type&.describe(:short).to_s, entry.alias_of.to_s]
           end.sort
         end
 

data/lib/rigor/protection/mutator.rb

@@ -366,7 +366,7 @@ module Rigor
       end
 
       def snippet(loc)
-        text = loc.slice.gsub(/\s+/, " ")
+        text = loc.slice.scrub.gsub(/\s+/, " ")
         text.length > 30 ? "#{text[0, 27]}..." : text
       end
     end