rigortype 0.4.6 → 0.4.8

data/lib/rigor/mcp/server.rb

@@ -155,6 +155,10 @@ module Rigor
       ].freeze
       Ractor.make_shareable(TOOLS)
 
+      # The tools that read a configuration — the ones taking a `config` argument — and so report its warnings.
+      CONFIG_TOOLS = TOOLS.filter_map { |tool| tool[:name] if tool.dig(:inputSchema, :properties, :config) }.freeze
+      Ractor.make_shareable(CONFIG_TOOLS)
+
       def initialize(config_path: nil, err: $stderr)
         @config_path = config_path
         @err = err
@@ -165,7 +169,7 @@ module Rigor
         id = request["id"]
         method_name = request["method"]
 
-        # Notifications carry no `id` and require no response.
+        # A notification carries no `id` and requires no response.
         return nil if id.nil?
 
         case method_name
@@ -181,8 +185,38 @@ module Rigor
         end
       end
 
+      # ADR-126 WD4 — `rigor_type_of` and `rigor_explain` print documents whose top-level shape changes in the next
+      # minor, and their CLI says so on stderr, which `tool_result` drops once there is a document. The notice is
+      # carried to the agent as its own `text` content block, the same text the CLI printed, so the document block
+      # stays byte-for-byte what the CLI wrote. When stdout is empty the error text already is stderr.
+      SHAPE_NOTICE_TOOLS = %w[rigor_type_of rigor_explain].freeze
+
       private
 
+      def finish_tool_result(name, args, out, err, exit_code)
+        result = with_config_warnings(tool_result(out, err, exit_code), name, args, out)
+        result = with_shape_notice(result, name, out, err)
+        with_path_warnings(result, name, out, err)
+      end
+
+      # #2206 — `rigor coverage` writes its path warnings (a missing path skipped beside files it measures) to stderr,
+      # which a successful run drops. The tool carries the CLI's whole stderr (path warnings and any other warnings)
+      # as a second text block, unfiltered, so an agent sees what was skipped.
+      def with_path_warnings(result, name, out, err)
+        return result unless name == "rigor_coverage" && !out.empty? && !err.strip.empty?
+
+        result.merge(content: result.fetch(:content) + [{ type: "text", text: err }])
+      end
+
+      def with_shape_notice(result, name, out, err)
+        return result unless SHAPE_NOTICE_TOOLS.include?(name) && !out.empty?
+
+        notice = err[CLI::JsonDocument::NOTICE_PATTERN]
+        return result unless notice
+
+        result.merge(content: result.fetch(:content) + [{ type: "text", text: notice }])
+      end
+
       def handle_initialize(id)
         require_relative "../version"
         success(id, {
@@ -201,7 +235,7 @@ module Rigor
         require_relative "../cli"
         exit_code = with_captured_streams(out_io, err_io) { CLI.new(argv, out: out_io, err: err_io).run }
 
-        success(id, tool_result(out_io.string, err_io.string, exit_code))
+        success(id, finish_tool_result(name, args, out_io.string, err_io.string, exit_code))
       rescue SystemExit => e
         # Defence against any command that exits: it must not take the server down with it.
         success(id, { content: [{ type: "text", text: "Command exited (status #{e.status})" }], isError: true })
@@ -221,6 +255,43 @@ module Rigor
         { content: [{ type: "text", text: out.empty? ? err : out }], isError: is_error }
       end
 
+      # Issue #2231 — `rigor check` puts {ConfigAudit} warnings in its JSON `config_warnings`; the other tools read the
+      # same configuration and said nothing about it, so an agent saw `call.undefined-method` on a project whose
+      # `.rigor.yml` misspelt the key meant to silence it and got no hint why. Every tool that takes a `config`
+      # argument now carries them: a second `text` content block holding `{"config_warnings": [...]}`, each entry the
+      # shape check's JSON uses. The tool's own document is left byte-for-byte as its CLI printed it, and an output
+      # that already carries the key (check's) gets no second copy. Nothing is added when there is nothing to say,
+      # nor when the configuration does not load — the CLI has already reported that.
+      def with_config_warnings(result, name, args, out)
+        return result unless CONFIG_TOOLS.include?(name)
+
+        warnings = config_warnings(present_config(args["config"]) || @config_path)
+        return result if warnings.empty? || carries_config_warnings?(out)
+
+        block = { type: "text", text: JSON.generate({ "config_warnings" => warnings.map(&:to_h) }) }
+        result.merge(content: result.fetch(:content) + [block])
+      end
+
+      # Only a configuration that does not load is "no warnings to show": the CLI has already reported that error.
+      # A failure in ConfigAudit itself is a bug and surfaces as an internal error rather than reading as clean.
+      def config_warnings(config_path)
+        require_relative "../configuration"
+        require_relative "../config_audit"
+        begin
+          configuration = Configuration.load(config_path)
+        rescue ConfigurationError
+          return []
+        end
+        ConfigAudit.warnings(configuration)
+      end
+
+      def carries_config_warnings?(out)
+        document = JSON.parse(out)
+        document.is_a?(Hash) && document.key?("config_warnings")
+      rescue JSON::ParserError
+        false
+      end
+
       # The JSON-RPC channel is the process's stdout, so nothing a command writes past its `out:` (an option
       # parser's `--help`, a stray `puts`) may reach it while the command runs.
       def with_captured_streams(out_io, err_io)

data/lib/rigor/mcp.rb

@@ -4,7 +4,7 @@ module Rigor
   # The MCP (Model Context Protocol) server subsystem. See `docs/adr/33-mcp-server.md` for the design.
   #
   # Entry point: `rigor mcp --transport stdio`. The server exposes Rigor's analysis tools (check, type-of, triage,
-  # annotate, sig-gen, explain, coverage) as MCP tool calls over a newline-delimited JSON-RPC 2.0 stdio stream.
+  # lens, annotate, sig-gen, explain, coverage) as MCP tool calls over a newline-delimited JSON-RPC 2.0 stdio stream.
   module MCP
   end
 end

data/lib/rigor/memo_audit.rb

@@ -0,0 +1,282 @@
+# frozen_string_literal: true
+
+require_relative "typing_state"
+
+module Rigor
+  # ADR-127 WD3 — the memo audit. A memo hit is correct only when the key holds every input the value
+  # was computed from, and a key that misses one answers a caller with another caller's value (#2516, #2524). With the
+  # audit on, every hit in the callee floor's memos (`resolved_census`, the unrecorded hand-off memo, the successor
+  # store and `def_census`) recomputes the value and raises {Mismatch} when it differs from the stored one, so a key
+  # defect fails on the first hit instead of waiting for an order that exposes it.
+  #
+  # Like {BudgetTrace}, a switch for specs and CI (`RIGOR_MEMO_AUDIT=1` in the environment, read once at load, or
+  # {enable!}): off by default, a single boolean check when off. A recomputation
+  # runs with the audit suspended on its thread and the memos bypassed ({suspended?}), so it reads nothing stored.
+  #
+  # A mismatch raises, and is also kept on this thread's list until {drain} takes it (ADR-129 WD5, #2785): the
+  # typing path rescues `StandardError` in many places, and a raise one of them swallows would turn the defect into
+  # an ordinary fallback answer. The runner drains the list after each file and reports what it holds the way it
+  # reports a mismatch no rescue caught, and {raise_undrained!} fails the run on what a file never drained.
+  #
+  # **The key audit** (ADR-129 WD1) checks the other half at every miss: a Memo, or a Table a computation fills (the
+  # ADR-84 return memo), whose miss computation reads a Frame must key on the state id or on that Frame's value.
+  # {key_audit} runs a miss computation with its Frame reads noted ({TypingState::KeyAudit}) and compares them with
+  # the Frame terms the key read through {TypingState::State#key_frame} when {key} built it. A read Frame the key
+  # does not carry, and that neither the computation installed itself nor the site declared ({key_declaration}), is a
+  # {KeyMismatch}: kept on this thread's list like a raised mismatch, and not raised, since the computation's answer
+  # is correct for this caller.
+  module MemoAudit
+    # A memo hit whose stored value differs from a fresh computation.
+    class Mismatch < StandardError; end
+
+    # A memo miss whose computation read a Frame its key does not carry (ADR-129 WD1's key audit).
+    class KeyMismatch < Mismatch; end
+
+    # What a miss site declares beside its key terms (ADR-129 WD1), by Frame slot name:
+    # - `forced`: Frames the memo installs at a constant (or a value derived from its key) before the key is built,
+    #   so the computation reads that form rather than the caller's;
+    # - `gaps`: `slot name => reason` naming the issue of a known key gap, read without a key term and reported as a
+    #   named exception rather than a mismatch;
+    # - `carried`: `slot name => reason` for Frames another key term carries (a run-level flag, fixed while the run
+    #   generation the memo's bucket keys on is), counted as key terms.
+    KeyDeclaration = Data.define(:forced, :gaps, :carried)
+
+    # ADR-129 WD1 — a Frame, installed around a recomputation. `@enabled` is a process switch, outside the typing
+    # state (WD5). G1′ witness: a recomputation types a callee body, and the memo hits inside it read the flag.
+    SUSPENDED = TypingState.frame(
+      :memo_audit_suspended, reason: "set around an audit recomputation, which bypasses every memo",
+                             witness: "spec/fixtures/typing_state_witnesses/memo_audit_suspended.rb"
+    )
+    private_constant :SUSPENDED
+
+    # ADR-129 WD1 — a Resource: the mismatches raised on this thread and not drained yet. Typing never reads it; an
+    # append refuses every open capture, which only an audited run reaches.
+    MISMATCHES = TypingState.resource(
+      :memo_audit_mismatches,
+      run_scoped: true,
+      reason: "the audit's mismatches on this thread, appended where raised, drained per file, never read by typing"
+    )
+    private_constant :MISMATCHES
+
+    EMPTY = [].freeze
+    private_constant :EMPTY
+
+    # ADR-129 WD1 — the Frames every key audit names as exceptions rather than mismatches, with their reasons: the
+    # audit's own switch and the process switches whose installed recorders a computation may file into.
+    KEY_AUDIT_SWITCHES = {
+      memo_audit_suspended: "the audit's own switch: a nested hit's check reads it",
+      flow_tracer: "a process switch (WD5): the tracer is an output, and the type_of memo is shut under one (WD4)",
+      effects_collector: "a process switch (WD5): recording into its contents touches a Resource",
+      dependency_recorder: "a process switch (WD5): the recorder files ADR-46 dependency edges, which no type reads",
+      self_call_resolution_recorder: "a process switch (WD5): its records are a journaled Table, never read back"
+    }.freeze
+
+    # ADR-129 WD1 — a Resource: the named exceptions key audits on this thread met, `[label, slot name] => reason`.
+    # Typing never reads it.
+    KEY_EXCEPTIONS = TypingState.resource(
+      :memo_audit_key_exceptions,
+      run_scoped: true,
+      reason: "the key audit's named exceptions met on this thread, for specs and reports; never read by typing"
+    )
+    private_constant :KEY_EXCEPTIONS
+
+    NO_DECLARATION = KeyDeclaration.new(forced: EMPTY, gaps: {}.freeze, carried: {}.freeze)
+    private_constant :NO_DECLARATION
+
+    @enabled = %w[1 true].include?(ENV["RIGOR_MEMO_AUDIT"].to_s.downcase)
+
+    module_function
+
+    def enabled? = @enabled
+
+    # True while an audit recomputation runs on this thread. The callee floor's memos are then bypassed (read and
+    # write), so the recomputation reads no stored entry of another memo: a defect shared across a table (a stale
+    # `resolved_census(:edges)` entry) would otherwise make the recomputed value match the stored one.
+    def suspended? = TypingState.current[SUSPENDED]
+
+    def enable! = (@enabled = true)
+
+    def disable! = (@enabled = false)
+
+    # `stored`, after checking it against `yield` when the audit is on. `label` and the key parts (`key`, `key2`) name
+    # the memo entry in the failure; they are passed apart so an audit that is off allocates nothing.
+    def check(label, stored, key, key2 = nil, &)
+      return stored unless @enabled && !TypingState.current[SUSPENDED]
+
+      fresh = suspended(&)
+      return stored if fresh == stored
+
+      mismatch = Mismatch.new(
+        "#{label} memo hit differs from a fresh computation for #{[key, key2].inspect[0, 120]}: " \
+        "stored #{stored.inspect[0, 200]}, fresh #{fresh.inspect[0, 200]}"
+      )
+      state = TypingState.current
+      state.append(MISMATCHES, mismatch)
+      raise mismatch
+    end
+
+    # ADR-129 G1′ — a `type_of` begins on this thread, for the matching {leave_type_of}; the caller guards on
+    # {enabled?}, so an audit that is off costs one boolean check. Fails (as a {Mismatch} on the list, not raised) on an
+    # installed `typing_unreachable` Frame ({TypingState::FrameAudit}).
+    def enter_type_of
+      state = TypingState.current
+      state.extend(TypingState::FrameAudit) unless state.is_a?(TypingState::FrameAudit)
+      state.enter_type_of
+    end
+
+    # ADR-129 G1′ — the `type_of` memo's shadow reached its table on `state`; the caller guards on {enabled?}. Fails (as
+    # a {Mismatch} on the list, not raised) on an installed `memo_shut_while_installed` Frame.
+    def note_memo_lookup(state)
+      state.extend(TypingState::FrameAudit) unless state.is_a?(TypingState::FrameAudit)
+      state.note_memo_lookup
+    end
+
+    # ADR-129 G1′ — the `type_of` {enter_type_of} tracked ends.
+    def leave_type_of
+      TypingState.current.leave_type_of
+    end
+
+    # Keeps one {Mismatch} per message on the list until it is drained: a Frame declaration that does not hold is
+    # reported at every `type_of` it meets.
+    def report_frame_declaration(state, message)
+      pending = state.read(MISMATCHES)
+      return if pending&.any? { |mismatch| mismatch.message == message }
+
+      mismatch = Mismatch.new(message)
+      mismatch.set_backtrace(caller.drop_while { |frame| frame.include?("/typing_state.rb:") })
+      state.append(MISMATCHES, mismatch)
+    end
+
+    # The mismatches raised on this thread since the last drain, oldest first, and an empty list for the next file.
+    # Each has been raised, so it carries the backtrace a crash row is built from.
+    def drain
+      state = TypingState.current
+      mismatches = state.read(MISMATCHES)
+      return EMPTY if mismatches.nil? || mismatches.empty?
+
+      state.write(MISMATCHES, nil)
+      mismatches
+    end
+
+    # ADR-129 WD1 — checks a `carried:` claim at the install of a run-level flag (`flag`, ADR-130's erasure or
+    # dispatch-off frame). The return memo counts the flag as carried by its bucket's run-generation key, which holds
+    # only while the flag is installed around a whole run: with the audit on, an install that finds the return memo
+    # holding entries (a run in progress, or one that was not released) raises instead of silently mixing answers
+    # computed under both values.
+    def check_run_level_install(flag)
+      return unless @enabled
+
+      held = TypingState.current[TypingState.slot(:user_method_return_memo).index]
+      return if held.nil? || held[1].empty?
+
+      raise Mismatch, "#{flag} installed while the return memo holds entries: the memo's key carries it only as a " \
+                      "flag installed around a whole run (ADR-129 WD1 key audit)"
+    end
+
+    # Raises the first mismatch no file drained (one raised outside every file's analysis), so a run that ends with
+    # one fails instead of releasing it with the run's other slots.
+    def raise_undrained!
+      return unless @enabled
+
+      mismatches = drain
+      raise mismatches.first unless mismatches.empty?
+    end
+
+    def suspended(&)
+      TypingState.current.with(SUSPENDED, true, &)
+    end
+
+    # A frozen {KeyDeclaration} for a miss site, built once into a constant so an audit that is off allocates nothing.
+    def key_declaration(forced: EMPTY, gaps: {}, carried: {})
+      KeyDeclaration.new(forced: forced.map(&:to_sym).freeze, gaps: gaps.transform_keys(&:to_sym).freeze,
+                         carried: carried.transform_keys(&:to_sym).freeze)
+    end
+
+    # The key the block builds. When the audit is on, the Frames the block reads through
+    # {TypingState::State#key_frame} are remembered as the key's terms for the {key_audit} of the miss that follows.
+    def key(&)
+      return yield unless @enabled
+
+      auditing_state.collect_key_terms(&)
+    end
+
+    # The block's value: a memo's miss computation, run under ADR-129 WD1's Memo rule
+    # ({TypingState::State#memo_miss}: a miss that writes a Table while a capture is open touches), keyed by `key`
+    # ({key}, or nil for a key that reads no Frame) and declared by `declaration` ({key_declaration}). When the audit
+    # is on, a Frame the computation reads that the key does not carry is a {KeyMismatch} on this thread's list, named
+    # by `label` (the slot's `audit:` or `computed:` label), unless it is internal, forced, carried, a declared gap or
+    # a {KEY_AUDIT_SWITCHES} switch.
+    #
+    # A computation that raises or throws is not judged, and its audit is closed on the way out. A computation that
+    # returns is judged whether or not its memo then stores it (the return memo's WD3 bracket may refuse it), which
+    # only reports more. An audit recomputation ({suspended?}) is not judged either, but it still opens the site's
+    # declaration, so a gap it declares reaches the audits around it as it does on a miss: the verdict of an enclosing
+    # miss does not depend on whether this memo hit.
+    def key_audit(label, declaration = nil, key = nil, &)
+      return TypingState.current.memo_miss(&) unless @enabled
+
+      state = auditing_state
+      declaration ||= NO_DECLARATION
+      judged = !state[SUSPENDED]
+      terms = state.key_terms_for(key) if judged
+      state.open_key_audit(label, declaration.gaps)
+      begin
+        value = state.memo_miss(&)
+      ensure
+        reads = state.close_key_audit
+      end
+      judge_key_audit(state, label, declaration, terms, reads) if judged
+      value
+    end
+
+    # The named exceptions key audits on this thread have met since the run began, `[label, slot name] => reason`.
+    def key_exceptions
+      TypingState.current.read(KEY_EXCEPTIONS) || {}
+    end
+
+    def auditing_state
+      state = TypingState.current
+      state.extend(TypingState::KeyAudit) unless state.is_a?(TypingState::KeyAudit)
+      state
+    end
+
+    def judge_key_audit(state, label, declaration, terms, reads)
+      return if reads.empty? || terms.include?(TypingState::KeyAudit::STATE_ID)
+
+      reads.each do |slot, via|
+        name = TypingState.slots[slot].name
+        next note_key_exception(state, label, name, "through the #{via[0]} miss: #{via[1]}") unless via == true
+        next if terms.include?(slot) || declaration.forced.include?(name) || declaration.carried.key?(name)
+
+        reason = key_exception_reason(declaration, name)
+        reason ? note_key_exception(state, label, name, reason) : report_key_mismatch(state, label, name)
+      end
+    end
+
+    # Why a miss may read the Frame `name` without a key term, or nil: a gap its site declares, or a switch.
+    def key_exception_reason(declaration, name) = declaration.gaps[name] || KEY_AUDIT_SWITCHES[name]
+
+    def note_key_exception(state, label, name, reason)
+      seen = state.acquire(KEY_EXCEPTIONS) { {} }
+      seen[[label, name]] ||= reason
+    end
+
+    # Keeps one {KeyMismatch} per message on the list until it is drained: a key defect repeats at every miss.
+    def report_key_mismatch(state, label, name)
+      message = "key audit: the #{label} miss read the Frame #{name}, which its key does not carry"
+      pending = state.read(MISMATCHES)
+      return if pending&.any? { |mismatch| mismatch.message == message }
+
+      mismatch = KeyMismatch.new(message)
+      mismatch.set_backtrace(caller.drop_while { |frame| frame.include?("/memo_audit.rb:") })
+      state.append(MISMATCHES, mismatch)
+    end
+  end
+
+  # The engine reaches the audit as `Inference::MemoAudit`; it lives at `lib/rigor/memo_audit.rb` so the value layer
+  # (`Reflection`, `Scope`) can load it without loading an `inference/` file (ADR-104's warm effects probe budget), as
+  # `TypingState` does (#2796).
+  module Inference
+    MemoAudit = Rigor::MemoAudit
+  end
+end

data/lib/rigor/plugin/access_denied_error.rb

@@ -6,8 +6,7 @@ module Rigor
     # analyzer can convert the exception into a `:plugin_loader` diagnostic without crashing `rigor check`.
     #
     # The policy is documented in [ADR-2 § "Plugin Trust and I/O Policy"](../../../docs/adr/2-extension-api.md).
-    # Slice 2's surface lists `:read_outside_scope` and `:network_disabled` as the two reason codes; future slices
-    # may extend the set.
+    # `reason:` is one of `:read_outside_scope`, `:network_disabled`, `:url_fetch_failed` or `:url_body_too_large`.
     class AccessDeniedError < StandardError
       attr_reader :reason, :resource
 

data/lib/rigor/plugin/base.rb

@@ -945,6 +945,14 @@ module Rigor
         @io_boundary ||= services.io_boundary_for(manifest.id)
       end
 
+      # The boundary {#io_boundary} has built, or nil when this plugin never asked for one, without building it: a
+      # plugin that never built one read nothing through it. Engine-internal ({Analysis::RunDisclosureCredit} sends it,
+      # being outside the class), so it is private and part of no plugin-facing contract.
+      #
+      # @api private
+      def built_io_boundary = @io_boundary
+      private :built_io_boundary
+
       # ADR-7 § "Slice 6-A" / ADR-60 WD3 — returns a callable that performs a `Cache::Store#fetch_or_validate`
       # round-trip for the named producer (the ADR-45 record-and-validate path). The entry is KEYED on the
       # stable identity inputs — the plugin's `PluginEntry` template (id, version, config_hash) composed with
@@ -1064,14 +1072,19 @@ module Rigor
       # The gate for one `dynamic_return` rule. Method-name gate first — a Symbol-array probe vs the receiver
       # ancestry resolution below (ADR-52 WD1); both are pure predicates, so order only affects cost. A
       # receiver-less rule (ADR-52 WD2) skips the ancestry check entirely and fires on the method name alone.
+      # The engine also offers the nameless nodes of #2717 (the `&:sym` BlockArgumentNode, the compound
+      # write nodes) to a plugin `build_name_gates` left ungated; only `CallNode` answers `name`, so a
+      # name-gated rule declines them (`include?(nil)` is false) rather than raising past the later rules
+      # (#2764).
       def dynamic_return_rule_applies?(rule, call_node, receiver_type, environment, scope)
-        return false if rule[:methods] && !resolved_dynamic_return_methods(rule).include?(call_node.name)
+        name = call_node.respond_to?(:name) ? call_node.name : nil
+        return false if rule[:methods] && !resolved_dynamic_return_methods(rule).include?(name)
 
         if rule[:file_methods]
           # The path is read here, not in `dynamic_return_type`, so a spec-double scope without
           # `source_path` only affects `file_methods:` rules (other gate forms never touch it).
           path = scope.respond_to?(:source_path) ? scope.source_path : nil
-          return false unless resolved_dynamic_return_file_methods(rule, path).include?(call_node.name)
+          return false unless resolved_dynamic_return_file_methods(rule, path).include?(name)
         end
 
         entries = resolved_dynamic_return_receiver_entries(rule)

data/lib/rigor/plugin/bundled_catalog.rb

@@ -127,7 +127,7 @@ module Rigor
         def require_bundled_plugins
           return {} unless File.directory?(BUNDLED_PLUGINS_ROOT)
 
-          add_bundled_lib_dirs
+          Loader.add_bundled_lib_dirs
           Dir.children(BUNDLED_PLUGINS_ROOT).sort.each_with_object({}) do |gem_name, resolved|
             path = Loader.bundled_plugin_path(gem_name)
             next if path.nil?
@@ -137,17 +137,6 @@ module Rigor
           end
         end
 
-        # A bundled plugin's entry file requires its own tree by bare feature name (`require
-        # "rigor/plugin/activestorage"`), which resolves only with that plugin's `lib` on the load path — the
-        # loader gets it from the bundle, and this catalogue has to arrange it itself. Prepending the engine's
-        # own copies matches ADR-93 WD5's anti-skew rule, where the bundled copy always wins.
-        def add_bundled_lib_dirs
-          Dir.children(BUNDLED_PLUGINS_ROOT).sort.each do |gem_name|
-            dir = File.join(BUNDLED_PLUGINS_ROOT, gem_name, "lib")
-            $LOAD_PATH.unshift(dir) if File.directory?(dir) && !$LOAD_PATH.include?(dir)
-          end
-        end
-
         # A plugin gem that fails to load is skipped rather than fatal: the catalogue exists to *advise*, and
         # a broken bundled copy is already reported by `rigor doctor`'s plugin checks for the plugins the
         # project actually enabled. The failure is recorded in {load_failures} so a missing entry stays

data/lib/rigor/plugin/io_boundary.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "digest"
+require_relative "../typing_state"
 
 require_relative "access_denied_error"
 require_relative "../rooted_glob"
@@ -17,7 +18,7 @@ module Rigor
     # scope and feed the cache descriptor; contributions built on top of out-of-scope reads will not
     # invalidate correctly.
     #
-    # Slice 2 ships a minimal surface:
+    # The surface:
     #
     # - `#read_file(path)` — validates against the policy, returns the file's contents, and adds a
     #   digest-keyed {Cache::Descriptor::FileEntry} to the boundary's accumulated descriptor. A read that
@@ -52,11 +53,20 @@ module Rigor
     #   descriptor and any enclosing producer's descriptor then carry the served value's inputs.
     class IoBoundary
       URL_TIMEOUT_SECONDS = 10
-      URL_MAX_BYTES = 10 * 1024 * 1024
+      URL_MAX_BYTES = 10_485_760 # 10 MiB
 
       ATTRIBUTION_KEY = :rigor_io_boundary_attribution
       private_constant :ATTRIBUTION_KEY
 
+      # ADR-129 WD3 / #2814 — the attribution sink is a Resource: a `type_of` memo hit that served an answer without
+      # re-running the plugin read would not append what the miss appended, so every {.attribute} refuses each open
+      # capture. Its storage stays the thread variable above (ADR-129 WD5 shape 2); this slot declares its kind.
+      SINK = TypingState.resource(
+        :io_boundary_attribution,
+        reason: "every plugin boundary read appends to the attributing sink, which a memo hit would not replay"
+      )
+      private_constant :SINK
+
       # ADR-45 WD2 (#1507) — runs the block with `sink` (an Array) receiving every file and listing row ANY
       # boundary records on this thread meanwhile, in addition to the boundary's own table, and returns the
       # block's value. `Analysis::Runner` wraps each file's analysis in one when it records dependencies, so the
@@ -67,16 +77,28 @@ module Rigor
       # lands in the sink. The boundary's own table is unchanged by it, including its first-existence-row-stands
       # rule: the sink records what each read observed. Only reads are credited: a value a plugin memoised reaches
       # later files without one, so the first file to trigger the read is the only one credited with it.
+      #
+      # The installing fiber's typing state rides with the sink, so a read from inside an `Enumerator` refuses the
+      # captures open where the analysis runs, not only those of the `Enumerator`'s own fiber ({.attribute}).
       def self.attributing(sink)
         previous = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
-        Thread.current.thread_variable_set(ATTRIBUTION_KEY, sink)
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, [sink, TypingState.current].freeze)
         yield
       ensure
         Thread.current.thread_variable_set(ATTRIBUTION_KEY, previous)
       end
 
+      # Records `entry` in the attributing sink, if one is installed, and touches {SINK} on the calling fiber's typing
+      # state and on the installing fiber's (ADR-129 WD3, #2814).
       def self.attribute(entry)
-        Thread.current.thread_variable_get(ATTRIBUTION_KEY)&.push(entry)
+        state = TypingState.current
+        state.touch(SINK)
+        sink, owner = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
+        return nil if sink.nil?
+
+        owner.touch(SINK)
+        sink.push(entry)
+        nil
       end
 
       attr_reader :policy, :plugin_id

data/lib/rigor/plugin/loader.rb

@@ -90,6 +90,20 @@ module Rigor
         File.directory?(path) ? path : nil
       end
 
+      # Puts every bundled plugin's `lib` on `$LOAD_PATH`, so a bundled plugin that requires another by gem
+      # name (`require "rigor-ffi"` from `rigor-ethon`, `rigor-sassc`, `rigor-ffi-rzmq` and `rigor-rbnacl`)
+      # resolves without a bundle. The engine's own copies go first, which matches ADR-93 WD5's anti-skew
+      # rule: the bundled copy always wins. Idempotent; a trimmed packaging with no `plugins/` tree adds none.
+      def self.add_bundled_lib_dirs
+        root = File.join(ENGINE_ROOT, "plugins")
+        return unless File.directory?(root)
+
+        Dir.children(root).sort.each do |gem_name|
+          dir = File.join(root, gem_name, "lib")
+          $LOAD_PATH.unshift(dir) if File.directory?(dir) && !$LOAD_PATH.include?(dir)
+        end
+      end
+
       # @param entries — the raw `plugins:` list from the configuration.
       def load(entries)
         plugins = []
@@ -233,7 +247,13 @@ module Rigor
       # `feature_resolver` is unaffected: an absolute-path require's `$LOADED_FEATURES` entry still ends in
       # `/<gem>.rb`, the suffix {FEATURE_RESOLVER} matches.
       def require_gem!(entry)
-        @requirer.call(self.class.bundled_plugin_path(entry[:gem]) || entry[:gem])
+        path = self.class.bundled_plugin_path(entry[:gem])
+        if path
+          self.class.add_bundled_lib_dirs
+          @requirer.call(path)
+        else
+          @requirer.call(entry[:gem])
+        end
       rescue ::LoadError => e
         raise LoadError.new(
           "could not load plugin gem #{entry[:gem].inspect}: #{e.message}",
@@ -272,13 +292,10 @@ module Rigor
         end
       end
 
-      # A gem that registers more than one plugin is a meta-gem only when NONE of the ids is its own. The
-      # FFI family (`rigor-sassc`, `rigor-ethon`, `rigor-ffi-rzmq`, `rigor-rbnacl`) each `require "rigor-ffi"`
-      # for the shared binding analyzer, so listing one of them ALONE registered two plugins — its own and
-      # `ffi` — and the meta-gem branch rejected the entry, telling the user to list `rigor-ffi` instead,
-      # which activates the wrong plugin. The failure was load-order dependent (listing `rigor-ffi` first
-      # made the nested require a no-op and the entry loaded), so it never showed up in the suite, where
-      # some earlier example has always loaded `rigor-ffi`.
+      # A gem that registers several plugins is a meta-gem only when NONE of the ids is its own. The FFI family
+      # (`rigor-sassc`, `rigor-ethon`, `rigor-ffi-rzmq`, `rigor-rbnacl`) each `require "rigor-ffi"`, so listing
+      # one alone registered `ffi` too and was wrongly rejected as a meta-gem. The bug was load-order dependent
+      # and hid in the suite, where an earlier example always loaded `rigor-ffi`.
       #
       # `rigor-rails` stays a meta-gem under this rule: it registers eight ids and none of them is `rails`.
       def own_id_among(gem_name, ids)

data/lib/rigor/plugin/macro/heredoc_template.rb

@@ -48,11 +48,11 @@ module Rigor
       #
       # Slice 2 ships at the **floor**: each emit row's `name:` is the source of truth for the synthetic
       # method's name (a single `"\#{name}"` placeholder gets interpolated with the literal symbol argument at
-      # `symbol_arg_position`). The `returns:` strings are **recorded in the manifest but not resolved**; the
-      # engine emits synthetic methods with `Dynamic[T]` returns plus a `macro.tier_c.unresolved-return`
-      # provenance marker. Precise return-type resolution via ADR-13's `Plugin::TypeNodeResolver` is the
-      # **ceiling**, deferred to a later slice — the `returns:` declarations cost nothing to write today and
-      # unlock precision then.
+      # `symbol_arg_position`). The synthetic method's return type is the `returns_from_arg:` lookup when it
+      # resolves, else a non-empty `returns:` string (`SyntheticMethodScanner#resolve_emit_return_type`); the
+      # dispatcher turns it into a nominal type through `MethodDispatcher#promote_via_return_type` when the
+      # environment knows the class. With neither, an `"untyped"` / `"void"` placeholder, or an unknown class, the
+      # method answers `Dynamic[Top]`. Resolution through ADR-13's `Plugin::TypeNodeResolver` is not wired.
       #
       # Engine wiring: `Inference::SyntheticMethodScanner` (slice 2b, `synthetic_method_scanner.rb`) consumes
       # `manifest.heredoc_templates`. Worked consumers: `plugins/rigor-dry-struct/` and
@@ -98,7 +98,7 @@ module Rigor
         # `\#{name}` with the call-site literal symbol) and its declared return type. The return type can be
         # a static String (resolved via `Environment#nominal_for_name` per ADR-16 slice 6b) or a
         # per-call-site lookup ({ReturnsFromArg}) — see
-        # [ADR-18](../../../../../docs/adr/18-substrate-per-call-site-return-type.md). When both are nil, the
+        # [ADR-18](../../../../docs/adr/18-substrate-per-call-site-return-type.md). When both are nil, the
         # synthesised method's return type falls back to `Dynamic[Top]`.
         class Emit
           attr_reader :name, :returns, :returns_from_arg
@@ -147,8 +147,7 @@ module Rigor
         #       lookup_via: { plugin_id: "dry-types", fact: :dry_type_aliases }
         #     }
         #
-        # Slice 1 (this file) ships the value class + validation only. The scanner-side arg-position
-        # extraction + fact-store lookup land in slice 2 / 3.
+        # The scanner's `resolve_emit_return_type` does the arg-position extraction and fact-store lookup.
         class ReturnsFromArg
           attr_reader :position, :plugin_id, :fact