rigortype 0.4.6 → 0.4.8

data/lib/rigor/plugin/macro/trait_registry.rb

@@ -39,12 +39,10 @@ module Rigor
       #   lexical receiver class equals or inherits from this constraint.
       # - `method_name` — Symbol naming the DSL method (e.g. `:devise`).
       # - `symbol_arg_position` — `:rest` (all positional Symbol args are traits, slice 3a's only supported
-      #   form) or a non-negative Integer (the index of a single trait symbol — reserved for future shapes;
-      #   not yet honoured by the scanner).
-      # - `modules_by_symbol` — Hash<Symbol, String>. Maps each recognised trait symbol to a fully-qualified
-      #   module name. Symbols not in the table fall through (silent skip; the scanner emits a
-      #   `macro.tier_b.unknown-trait` `:info` provenance marker per WD9 / WD13).
-      # - `always_included` — Array<String>. Fully-qualified module names that are added to every call site
+      #   form) or a non-negative Integer (the index of a single trait symbol).
+      # - `modules_by_symbol` — Maps each recognised trait symbol to a fully-qualified module name. Symbols not
+      #   in the table are silently skipped.
+      # - `always_included` — Fully-qualified module names that are added to every call site
       #   (even when no symbols match). Mirrors Devise's `always_include` modules.
       #
       # ## Floor / ceiling per ADR-16 WD13
@@ -53,7 +51,7 @@ module Rigor
       # methods into the existing `SyntheticMethodIndex` (slice 2b primitive). The synthesised methods adopt
       # the module's authored RBS return types — Tier B is NOT subject to the Tier C `Dynamic[T]` floor
       # because the source-of-truth (the module's authored RBS) is not a manifest-declared string. Per ADR-5
-      # robustness, the substrate does not fabricate precision; it simply replays the modules's signatures.
+      # robustness, the substrate does not fabricate precision; it simply replays the module's signatures.
       #
       # **Out of scope for slice 3** (deferred follow-ups):
       # - `class_methods_module:` per-trait (Devise's `ClassMethods` extend-pattern); slice 3 covers instance
@@ -106,8 +104,7 @@ module Rigor
         end
 
         # @return fully-qualified module name for the given trait symbol, or nil when the
-        #   registry doesn't know the symbol (caller emits a tier_b.unknown-trait provenance marker and falls
-        #   through).
+        #   registry doesn't know the symbol (the caller skips it).
         def module_for(symbol)
           modules_by_symbol[symbol.to_sym]
         end

data/lib/rigor/plugin/manifest.rb

@@ -168,9 +168,8 @@ module Rigor
       end
       private :assign_additional_initializers
 
-      # ADR-103 WD2 / WD6 / WD10 / WD14 — the effect contract's five fields, assigned together and outside
-      # `assign_fields` (which already carries the maximum positional arity).
-      # The six `effect_*` fields validate together, so {#initialize} carries one call rather than six.
+      # ADR-103 WD2 / WD6 / WD10 / WD14 — the six `effect_*` fields validate together here, so {#initialize}
+      # carries one call rather than six.
       def validate_effect_fields!(effect_root, effect_labels, effect_attributions, effect_edges,
                                   effect_entry_points, effect_ancestry)
         validate_effect_root!(effect_root)
@@ -305,11 +304,15 @@ module Rigor
         FirstParty.bundled?(id)
       end
 
-      # Whether the plugin contributes anything to the effect surfaces at all. The compiled per-run tables
-      # skip a plugin that answers false, so a project whose plugins predate this contract pays nothing.
+      # Whether the manifest declares anything for the effect surfaces — a convenience predicate over the
+      # manifest-declared fields only, true exactly when a `Registry::Contribution` built from these
+      # declarations would not be empty (`Contribution#empty?` reads the same five fields,
+      # `effect_ancestry:` included). A plugin that overrides the `Base#effect_*` readers instead of
+      # declaring rows here (rigor-sidekiq) can contribute while this answers false. The compiled
+      # per-run tables filter on `Contribution#empty?` themselves; nothing consults this predicate.
       def effects?
         !effect_labels.empty? || !effect_attributions.empty? || !effect_edges.empty? ||
-          !effect_entry_points.empty?
+          !effect_entry_points.empty? || !effect_ancestry.empty?
       end
 
       def ==(other)
@@ -475,10 +478,9 @@ module Rigor
         end
       end
 
-      # ADR-13 slice 2 — `type_node_resolvers:` declares the plugin-supplied `TypeNodeResolver` instances the
-      # parser consults (in slice 3) when an RBS::Extended payload's named- or generic-type head misses the
-      # built-in registry. Slice 2 carries the declarations on the manifest and the registry exposes them in
-      # registration order; the parser integration that actually drives the chain lands in slice 3.
+      # ADR-13 — `type_node_resolvers:` declares the plugin-supplied `TypeNodeResolver` instances the parser
+      # consults when an RBS::Extended payload's named- or generic-type head misses the built-in registry. The
+      # registry exposes them in registration order, and `Environment#build_name_scope` builds the chain.
       def validate_type_node_resolvers!(resolvers)
         validate_array_of!("type_node_resolvers", resolvers, "Rigor::Plugin::TypeNodeResolver instances") do |r|
           r.is_a?(TypeNodeResolver)
@@ -486,8 +488,7 @@ module Rigor
       end
 
       # ADR-16 slice 1a — `block_as_methods:` declares the Tier A substrate entries the plugin contributes.
-      # Slice 1a carries the declarations on the manifest; the engine hook that actually narrows
-      # `Scope#self_type` for matching blocks arrives in a subsequent slice.
+      # The engine hook that narrows `Scope#self_type` for matching blocks is `Inference::MacroBlockSelfType`.
       def validate_block_as_methods!(entries)
         validate_array_of!("block_as_methods", entries, "Rigor::Plugin::Macro::BlockAsMethod instances") do |e|
           e.is_a?(Macro::BlockAsMethod)
@@ -495,8 +496,7 @@ module Rigor
       end
 
       # ADR-16 slice 2a — `heredoc_templates:` declares the Tier C substrate entries (heredoc-template
-      # synthesis on class-level DSL calls). Slice 2a carries the declarations on the manifest; the pre-pass +
-      # `SyntheticMethodIndex` that actually emit synthetic methods arrive in slice 2b.
+      # synthesis on class-level DSL calls). `Inference::SyntheticMethodScanner` emits the synthetic methods.
       def validate_heredoc_templates!(entries)
         validate_array_of!("heredoc_templates", entries, "Rigor::Plugin::Macro::HeredocTemplate instances") do |e|
           e.is_a?(Macro::HeredocTemplate)
@@ -515,8 +515,8 @@ module Rigor
       end
 
       # ADR-16 slice 3a — `trait_registries:` declares the Tier B substrate entries (trait-inlining via
-      # bundled module registry). Slice 3a carries the declarations on the manifest; the scanner + per-method
-      # explosion through `SyntheticMethodIndex` (slice 2b primitive) arrives in slice 3b.
+      # bundled module registry). `Inference::SyntheticMethodScanner#collect_trait_registries` explodes them
+      # per method through `SyntheticMethodIndex`.
       def validate_trait_registries!(entries)
         validate_array_of!("trait_registries", entries, "Rigor::Plugin::Macro::TraitRegistry instances") do |e|
           e.is_a?(Macro::TraitRegistry)

data/lib/rigor/plugin/registry.rb

@@ -4,6 +4,7 @@ require_relative "blueprint"
 # Issue #806 — {Registry#guarded_manifest} constructs one. `Rigor::Plugin::LoadError` MUST be defined by
 # then: an unresolved bare `LoadError` in this lexical scope silently falls back to Ruby's own ::LoadError.
 require_relative "load_error"
+require_relative "../typing_state"
 
 module Rigor
   module Plugin
@@ -20,6 +21,10 @@ module Rigor
     # exactly the order the ungated walk produced — diagnostics stay byte-identical. The receiver-class
     # ancestry match for `dynamic_return` still happens per-dispatch inside `Plugin::Base#dynamic_return_type`.
     class ContributionIndex
+      TypingState.memo_field(self, :@owns_receiver_memo,
+                             reason: "keyed on the environment's identity and the class name; the plugins' " \
+                                     "owns_receivers set is fixed at construction")
+
       # Ordered (registry-order) subsets relevant to each collector, and the membership sets used to gate the
       # paths within a plugin. `for_file_diagnostics` is the subset the runner's per-file diagnostic loop
       # visits: plugins overriding `#diagnostics_for_file` or declaring at least one `node_rule`.
@@ -103,8 +108,8 @@ module Rigor
       # The categorisation sets + the ordered per-collector subsets.
       def compile_memberships(plugins)
         plugins.each { |p| reject_legacy_flow_hook!(p) }
-        @dynamic = plugins.reject { |p| p.class.dynamic_returns.empty? }.to_set
-        @narrowing_facts = plugins.reject { |p| p.class.narrowing_facts_rules.empty? }.to_set
+        @dynamic = plugins.reject { |p| p.class.dynamic_returns.empty? }.to_set.freeze
+        @narrowing_facts = plugins.reject { |p| p.class.narrowing_facts_rules.empty? }.to_set.freeze
         compile_collector_subsets(plugins)
       end
 
@@ -214,10 +219,16 @@ module Rigor
     # tie-breaker.
     #
     # ADR-15 Phase 3 — alongside the instantiated `plugins`, the registry carries `blueprints`: a frozen,
-    # Ractor-shareable `Array<Blueprint>` that records how to re-instantiate the same plugin set in a worker
+    # Ractor-shareable list of {Blueprint} that records how to re-instantiate the same plugin set in a worker
     # Ractor. The eventual Phase 4 pool ships `blueprints` across the boundary and calls {.materialize}
     # per-Ractor; the live `plugins` carriage on the coordinator registry stays unchanged.
     class Registry
+      TypingState.memo_field(self, :@contracts_by_path, :@effect_memo,
+                             reason: "keyed on the path, and on the one effect-contribution compile; the contract " \
+                                     "set, glob semantics and plugin set are fixed for the run (ADR-52 WD1), and the " \
+                                     "compile, which may read project facts across the I/O boundary, rests on the " \
+                                     "run's stable-filesystem premise, as FileDigest's run tables do")
+
       attr_reader :plugins, :load_errors, :blueprints, :contribution_index, :resolved_gem_paths
 
       # @param plugins — instantiated plugin instances in deterministic order.
@@ -556,8 +567,8 @@ module Rigor
       # Issue #806 — {#safe_manifest} with a receipt. The construction-time aggregates degraded silently
       # when a manifest read raised, so a plugin that contributed nothing looked identical to a plugin that
       # was never asked; the load-error channel is where "a plugin could not be loaded" already lives, and
-      # `Analysis::Runner` turns each entry into one `plugin_loader.load-error` row naming the plugin. The
-      # plugin ref is the CLASS, not `manifest.id`: the manifest is the surface that just failed.
+      # `Analysis::Runner` turns each entry into one `load-error` row (source family `plugin_loader`) naming
+      # the plugin. The plugin ref is the CLASS, not `manifest.id`: the manifest is the surface that just failed.
       def guarded_manifest(plugin, errors)
         plugin.manifest
       rescue StandardError => e

data/lib/rigor/plugin/services.rb

@@ -25,9 +25,8 @@ module Rigor
     # documents the trust model the boundary enforces.
     #
     # ADR-9 slice 2 adds `fact_store`: the per-run cross-plugin `Plugin::FactStore`. Producer plugins publish
-    # their facts in `#prepare(services)` (slice 3); consumer plugins read in `#diagnostics_for_file` via
-    # `services.fact_store.read(...)`. A fresh `FactStore` instance is constructed per Services when none is
-    # supplied — the runner threads its own instance in once slice 3 wires `#prepare` invocation.
+    # their facts in `#prepare(services)`; consumer plugins read in `#diagnostics_for_file` via
+    # `services.fact_store.read(...)`. A fresh `FactStore` is constructed when none is supplied.
     class Services
       attr_reader :reflection, :type, :configuration, :cache_store, :trust_policy, :fact_store
 

data/lib/rigor/plugin/source_rbs_synthesis_reporter.rb

@@ -61,6 +61,17 @@ module Rigor
       def empty?
         @entries.empty?
       end
+
+      # The pool drain ({Rigor::Analysis::WorkerSession#drain_reporters}): the frozen entries.
+      def snapshot
+        entries
+      end
+
+      # Replays one worker's {#snapshot}, `kind:` (#824) and `line:` (#1075) included; the dedup above
+      # collapses every worker's copy. Nil records nothing.
+      def absorb(snapshot)
+        Array(snapshot).each { |entry| record(**entry.to_h) }
+      end
     end
   end
 end

data/lib/rigor/plugin/trust_policy.rb

@@ -19,8 +19,8 @@ module Rigor
     # - `trusted_gems`: gem names the user has authorised. Derived from the `plugins:` section of `.rigor.yml`
     #   plus any gems they reach transitively. Used today for documentation and future trust diagnostics.
     # - `allowed_read_roots`: absolute paths plugin code may read from through the {IoBoundary}. The default
-    #   set covers the project root, the project's `signature_paths`, the active `Gemfile.lock`, and each
-    #   trusted gem's `Gem::Specification#full_gem_path`. The user extends this with `.rigor.yml`'s
+    #   set covers the project root, the project's `signature_paths`, and each trusted
+    #   gem's `Gem::Specification#full_gem_path`. The user extends this with `.rigor.yml`'s
     #   `plugins_io.allowed_paths:`.
     # - `network_policy`: one of {VALID_NETWORK_POLICIES}. `:disabled` (default) makes
     #   {IoBoundary#open_url} always raise. `:allowlist` (v0.1.2) consults `allowed_url_hosts` on every fetch —
@@ -45,6 +45,52 @@ module Rigor
         freeze
       end
 
+      # Builds the run's policy from the project configuration — the one derivation `rigor check`
+      # ({Analysis::Runner}), pooled workers ({Analysis::WorkerSession}) and `rigor unused`'s plugin roots
+      # ({Analysis::Reachability::PluginRoots}) share, so every `Plugin::Services` container enforces the
+      # same scope (#2586).
+      #
+      # `trusted_gems` is the gem-name half of every `Configuration#plugins` entry. `allowed_read_roots`
+      # is the project root (CWD), every `signature_paths` entry, each trusted gem's
+      # `Gem.loaded_specs` `full_gem_path` (silently skipped when the gem has no loaded spec), and every
+      # `plugins_io.allowed_paths` entry. `network_policy` / `allowed_url_hosts` come from
+      # `plugins_io.network` / `plugins_io.allowed_url_hosts`.
+      def self.for_configuration(configuration)
+        trusted_gems = configuration.plugins.map { |entry| trusted_gem_name(entry) }.uniq
+        roots = [Dir.pwd]
+        Array(configuration.signature_paths).each { |sp| roots << File.absolute_path(sp) }
+        trusted_gems.each do |gem_name|
+          path = trusted_gem_root(gem_name)
+          roots << path if path
+        end
+        configuration.plugins_io_allowed_paths.each { |p| roots << File.absolute_path(p) }
+
+        new(
+          trusted_gems: trusted_gems,
+          allowed_read_roots: roots,
+          network_policy: configuration.plugins_io_network,
+          allowed_url_hosts: configuration.plugins_io_allowed_url_hosts
+        )
+      end
+
+      def self.trusted_gem_name(entry)
+        case entry
+        when String then entry
+        when Hash then entry["gem"] || entry["id"]
+        end
+      end
+      private_class_method :trusted_gem_name
+
+      def self.trusted_gem_root(gem_name)
+        return nil if gem_name.nil? || gem_name.empty?
+
+        spec = Gem.loaded_specs[gem_name]
+        spec&.full_gem_path
+      rescue StandardError
+        nil
+      end
+      private_class_method :trusted_gem_root
+
       # @return true when the absolute path falls inside any allowed read root. Symlinks are
       #   resolved through `File.absolute_path` only (no `realpath`); plugins with adversarial intent are out of
       #   scope per ADR-2.

data/lib/rigor/plugin/type_node_resolver.rb

@@ -28,10 +28,8 @@ module Rigor
     # Resolvers SHOULD be stateless and re-entrant; the registry builds the chain once per
     # `Analysis::Runner.run` and may consult any resolver multiple times for the same node.
     class TypeNodeResolver
-      # @param node — the parser-emitted node the chain is
-      #   asking about.
-      # @param scope — companion value object (slice 3); slice 2 invocations MAY pass
-      #   `nil` because the chain doesn't exist yet.
+      # @param node — the parser-emitted node the chain is asking about.
+      # @param scope — the scope the chain was invoked with.
       # @return resolved type, or `nil` to fall through.
       def resolve(node, scope) # rubocop:disable Lint/UnusedMethodArgument
         nil

data/lib/rigor/plugin.rb

@@ -21,14 +21,12 @@ require_relative "plugin/first_party"
 module Rigor
   module Plugin
     @registered = {}
-    # ADR-88 WD4b — process-global map `gem name (String) => [registered plugin id, ...]`, recorded by the
-    # loader the FIRST time a gem's `require` runs its body and registers plugins. A second in-process
-    # `Loader.load` of the same bare-string (`id:`-less) entry sees `require` return false (the gem is already
-    # loaded, so its `Rigor::Plugin.register` calls do not re-run) and an empty newly-registered delta — the
-    # loader recovers the gem's plugin id(s) from this memo instead of failing with "did not register any
-    # plugin". Populated by {.record_gem_registration}, read by {.ids_for_gem}. This is what makes a second
-    # in-process analysis (the `--verify-incremental` full-run oracle, the incremental session's subset
-    # re-analysis, the LSP's re-loads) load the same plugins the first run did.
+    # ADR-88 WD4b — process-global map `gem name (String) => [plugin id, ...]`, recorded by the loader on a gem's
+    # first `require`. A second in-process `Loader.load` of the same bare-string entry sees `require` return false
+    # and an empty newly-registered delta; the loader then recovers the ids from this memo instead of failing with
+    # "did not register any plugin". Populated by {.record_gem_registration}, read by {.ids_for_gem}. This is what
+    # lets a second in-process analysis (the `--verify-incremental` oracle, the incremental subset re-analysis,
+    # the LSP's re-loads) load the same plugins the first run did.
     @gem_registrations = {}
     @mutex = Mutex.new
 

data/lib/rigor/plugin_gap_advisory.rb

@@ -26,7 +26,11 @@ module Rigor
       "rails" => %w[
         actioncable actionmailer actionpack actiontext actionview activejob activemodel
         activerecord activestorage activesupport railties
-      ].freeze
+      ].freeze,
+      # `rspec` and `rspec-rails` are the same shape: a project names the umbrella and never `rspec-core`, the
+      # gem rigor-rspec targets. rspec-rails depends on the three rspec gems listed here.
+      "rspec" => %w[rspec-core rspec-expectations rspec-mocks].freeze,
+      "rspec-rails" => %w[rspec-core rspec-expectations rspec-mocks].freeze
     }.freeze
 
     class << self

data/lib/rigor/project_environment.rb

@@ -72,6 +72,9 @@ module Rigor
         required_features: features,
         **dependency_discovery_options(configuration)
       )
+    rescue Environment::CoreRootError
+      # Issue #2517 — an unusable selected core is the user's to fix, never a reason to type against the default.
+      raise
     rescue StandardError
       bare(configuration, features)
     end
@@ -111,8 +114,15 @@ module Rigor
     # The dependency-discovery axes `check` reads off the configuration, as a keyword hash. Extracted so the
     # list lives in one place: every command that types against the project's real dependencies passes exactly
     # these, and adding an axis to `Environment.for_project` means adding it here once.
+    #
+    # Issue #2517 — `core_root:` rides here too although it is not discovered: it is the other half of the RBS
+    # universe `check` reads off the configuration, and every site that builds one already passes this hash.
     def dependency_discovery_options(configuration)
       {
+        core_root: configuration.core_root,
+        paths: configuration.paths,
+        exclude_patterns: configuration.exclude_patterns,
+        exclude_base: configuration.exclude_base,
         bundler_bundle_path: configuration.bundler_bundle_path,
         bundler_auto_detect: configuration.bundler_auto_detect,
         bundler_lockfile: configuration.bundler_lockfile,
@@ -166,17 +176,21 @@ module Rigor
         required_features: features,
         **dependency_discovery_options(configuration)
       )
+    rescue Environment::CoreRootError
+      raise
     rescue StandardError
       minimal(configuration, features)
     end
 
     # The last floor: RBS core plus the project's own signature paths, which cannot fail on anything outside
-    # the project itself.
+    # the project itself. The core is still the selected one (issue #2517): a floor that dropped it would type
+    # the project against APIs its Ruby does not have.
     def minimal(configuration, features = [])
       Environment.for_project(
         libraries: configuration.libraries,
         signature_paths: configuration.signature_paths,
-        required_features: features
+        required_features: features,
+        core_root: configuration.core_root
       )
     end
   end

data/lib/rigor/protection/analysis_guard.rb

@@ -8,7 +8,7 @@ module Rigor
     # nothing about the code that was analysed.
     #
     # A named class, not a bare RuntimeError: {MutationScanner#classify} already folds a per-mutant
-    # `StandardError` into the `:harness_error` bucket, and the scanner's file-level rescue must catch THIS
+    # `StandardError` into the `harness_errors` bucket, and the scanner's file-level rescue must catch THIS
     # and nothing else, so the two failure modes stay distinguishable at every site that handles either.
     #
     # Issue #790 — it says WHICH of the two refusals below fired, because they want different recovery. A

data/lib/rigor/protection/discovery_seed.rb

@@ -4,6 +4,7 @@ require_relative "../inference/parameter_inference_collector"
 require_relative "../inference/scope_indexer"
 require_relative "../inference/project_seed_tables"
 require_relative "../cache/incremental_snapshot"
+require_relative "../cache/file_digest"
 require_relative "../analysis/path_expansion"
 require_relative "../analysis/buffer_binding"
 
@@ -107,11 +108,40 @@ module Rigor
         paths = Analysis::PathExpansion.configured_files(configuration)
         return nil if paths.empty?
 
-        bundles = snapshot_bundles(configuration)
+        payload = snapshot_payload(configuration)
+        bundles = payload&.seed_bundles
         return nil if bundles.nil? || bundles.empty?
 
-        tables_for_buffer(paths: respell_for_buffer(paths, buffer), bundles: bundles, buffer: buffer,
-                          constant_sources: true)
+        spelled = respell_for_buffer(paths, buffer)
+        tables = tables_for_buffer(paths: spelled, bundles: bundles, buffer: buffer, constant_sources: true)
+        with_snapshot_param_table(tables, payload.param_table, configuration,
+                                  paths: spelled, bundles: bundles, buffer: buffer)
+      end
+
+      # Issue #2282 — under `parameter_inference: true` the snapshot also carries the call-site parameter table the
+      # writing run seeded its analysis from (`param_table`, ADR-67 WD6c), so a probe reads `@v = v` as `check`
+      # does. The table is whole-project (a callee's parameter type comes from callers in other files), so it is
+      # only as fresh as every file: it rides along ONLY when the fold re-walked nothing, that is, every path is a
+      # snapshot bundle with an unchanged digest and no path was added, removed or replaced by the editor buffer.
+      # Otherwise it is dropped, as {Analysis::IncrementalSession#fresh_param_table} recomputes rather than reuses
+      # it. Absent when the gate is off or the table is empty, which keeps the bundle-only seed.
+      def with_snapshot_param_table(tables, param_table, configuration, paths:, bundles:, buffer:)
+        return tables unless configuration.parameter_inference
+        return tables if param_table.nil? || param_table.empty?
+        return tables unless snapshot_current?(paths, bundles, buffer)
+
+        tables.merge(param_inferred_types: param_table).freeze
+      end
+
+      def snapshot_current?(paths, bundles, buffer)
+        return false unless paths.size == bundles.size
+
+        paths.all? do |path|
+          cached = bundles[path]
+          cached && cached[:digest] == Cache::FileDigest.hexdigest(buffer ? buffer.resolve(path) : path)
+        end
+      rescue SystemCallError
+        false
       end
 
       # The configured file list with the entry that reaches `buffer`'s file respelled as the buffer's logical
@@ -128,12 +158,21 @@ module Rigor
         end
       end
 
-      def snapshot_bundles(configuration)
+      # The bare single-file scope, or that scope with `seed`'s tables folded in. The one place `rigor type-of` and the
+      # language server's editor queries (#2282) fold a seed into a scope.
+      def seeded_scope(environment:, seed:)
+        base = Scope.empty(environment: environment)
+        return base if seed.nil? || seed.empty?
+
+        base.with_discovery(base.discovery.with(**seed))
+      end
+
+      def snapshot_payload(configuration)
         fingerprint = Cache::IncrementalSnapshot.fingerprint(configuration: configuration, roots: configuration.paths)
         return nil if fingerprint.nil?
 
         loaded = Cache::IncrementalSnapshot.new(root: configuration.cache_path).load_any(fingerprints: [fingerprint])
-        loaded&.last&.seed_bundles
+        loaded&.last
       end
 
       # The whole-project discovery tables, from the single-walk combined pass (one parse per file) that

data/lib/rigor/protection/mutation_cache.rb

@@ -215,7 +215,10 @@ module Rigor
             end,
             "patched_overrides" => project_scan.project_patched_methods.overrides.map do |key, visibility|
               [*key, visibility].map(&:to_s)
-            end
+            end,
+            "patched_singleton_copies" => project_scan.project_patched_methods.singleton_copies.map do |owner, name|
+              [owner.to_s, name.to_s]
+            end.sort
           }
           Digest::SHA256.hexdigest(JSON.generate(payload))
         rescue StandardError

data/lib/rigor/protection/mutator.rb

@@ -138,7 +138,7 @@ module Rigor
       QUOTES = ['"', "'"].freeze
       # Mutating an argument to a universal-equality method is always an equivalent mutant: Ruby's `==` / `<=>`
       # family returns false / nil on a type mismatch rather than raising, so the engine exempts them
-      # (`UNIVERSAL_EQUALITY_METHODS`). Skip them to keep survivors meaningful.
+      # (`CheckRules::UNIVERSAL_EQUALITY_METHODS`; keep the two in step). Skip them to keep survivors meaningful.
       UNIVERSAL_EQUALITY = %w[== != eql? equal? <=>].freeze
 
       # Every operator the mutator knows. Each maps to the diagnostic rule family it is *engineered* to trip when

data/lib/rigor/rbs_extended/envelope_scanner.rb

@@ -52,11 +52,9 @@ module Rigor
       #   `.rbs` files, plus the virtual entries rbs-inline and plugin `source_rbs` synthesis contribute.
       # @param registry — the vocabulary an unknown label is judged against.
       #
-      # The `ANNOTATION_HINT` routing test runs here, before any parse: a source with no honoured
-      # payload can contribute neither an envelope nor an unresolved report, so a signature tree with
-      # no effect annotation is answered by one regex per file — which is what that hint's own
-      # documentation promises, and what every warm envelope-lane run was paying a full
-      # `RBS::Parser.parse_signature` per file for.
+      # A source with no honoured payload can contribute neither an envelope nor an unresolved report, so the
+      # `ANNOTATION_HINT` test skips it before any parse: one regex per file, not a full
+      # `RBS::Parser.parse_signature`.
       def scan(sources:, registry:)
         reporter = Reporter.new
         methods = {}
@@ -128,7 +126,7 @@ module Rigor
       def walk(decl, prefix, methods, classes, registry, reporter)
         return unless decl.is_a?(::RBS::AST::Declarations::Class) || decl.is_a?(::RBS::AST::Declarations::Module)
 
-        nested = prefix + [decl.name.to_s.sub(/\A::/, "")]
+        nested = ::Rigor::Environment::RbsLoader.declared_class_path(decl, prefix)
         class_name = nested.join("::")
         envelope = RbsExtended.read_effect_envelope(
           decl.annotations, owner_key: class_name, source: :class_annotation,

data/lib/rigor/rbs_extended/hkt_directives.rb

@@ -287,17 +287,13 @@ module Rigor
         source_location.respond_to?(:start_line) ? source_location.start_line : nil
       end
 
-      # Issue #785 — routes a declined directive to the per-run reporter. The FIRST arm is the one that
-      # matters: the production reporter is {RbsExtended::Reporter}, whose surface is `record_unresolved` /
-      # `record_lossy_projection` / `record_hkt_error` — it has neither `#record` nor `#<<`, so before this
-      # arm existed every call here fell off the end of the `if` and every malformed HKT directive was
-      # dropped in every real run, while the doc comments claimed an `:info` entry was recorded. The
-      # position is flattened at record time through {RbsExtended::Reporter.position_of}, the one place
-      # every stream flattens through since #805, because the entry has to reach the pool drain channel as
-      # primitives (see {RbsExtended::Reporter}).
+      # Issue #785 — routes a declined directive to the per-run reporter. The first arm matters: the production
+      # {RbsExtended::Reporter} has `record_hkt_error` and neither `#record` nor `#<<`, so before this arm existed
+      # every malformed HKT directive was dropped in real runs. The position is flattened at record time through
+      # {RbsExtended::Reporter.position_of} (see {RbsExtended::Reporter} on why the entry carries primitives).
       #
-      # The `#record` / `#<<` arms stay for the collecting doubles the directive specs and plugin authors
-      # use, which is the contract `scan_rbs_loader`'s `@param reporter [#record, nil]` documents.
+      # The `#record` / `#<<` arms serve the collecting doubles the directive specs and plugin authors use; the
+      # contract is the one `scan_rbs_loader` documents for its `reporter` parameter.
       def record_hkt_error(reporter, message, source_location)
         return if reporter.nil?
 

data/lib/rigor/rbs_extended/reporter.rb

@@ -48,6 +48,16 @@ module Rigor
       HktDirectiveEntry = Data.define(:message, :path, :line, :column)
       DeprecatedFormEntry = Data.define(:payload, :replacement, :path, :line, :column)
 
+      # Every stream, by its reader, with the record method that replays one of its entries: an entry's
+      # members are that method's keywords. {#snapshot} and {#absorb} walk this table, so a new stream is
+      # declared here and nowhere else in the pool drain (ADR-116 WD3).
+      STREAMS = {
+        unresolved_payloads: :record_unresolved,
+        lossy_projections: :record_lossy_projection,
+        hkt_directive_errors: :record_hkt_error,
+        deprecated_forms: :record_deprecated_form
+      }.freeze
+
       # Flattens an `RBS::Location` (or anything answering the same readers) to the `(path, line, column)`
       # triple every entry carries. `column` is 1-based, since `RBS::Location#start_column` is 0-based and
       # diagnostics are not. Each component is `nil` when the location cannot supply it, and the diagnostic
@@ -160,9 +170,23 @@ module Rigor
       # True when no events have accumulated. Used by callers that want to skip the diagnostic-emission pass
       # entirely on the common no-event path.
       def empty?
-        @mutex.synchronize do
-          @unresolved_payloads.empty? && @lossy_projections.empty? && @hkt_directive_errors.empty? &&
-            @deprecated_forms.empty?
+        STREAMS.each_key.all? { |stream| public_send(stream).empty? }
+      end
+
+      # The drain a pool worker hands back: every stream's frozen entries by reader name. Marshal-clean and
+      # shareable, since each entry carries `(path, line, column)` primitives (#785, #805).
+      def snapshot
+        STREAMS.each_key.to_h { |stream| [stream, public_send(stream)] }
+      end
+
+      # Replays one worker's {#snapshot} through the record methods, whose dedup collapses the copies every
+      # worker hands over to the single row a `--workers=0` run prints. A missing stream (an older drain
+      # shape) or a nil snapshot records nothing.
+      def absorb(snapshot)
+        return if snapshot.nil?
+
+        STREAMS.each do |stream, record|
+          Array(snapshot[stream]).each { |entry| public_send(record, **entry.to_h) }
         end
       end
 

data/lib/rigor/rbs_extended.rb

@@ -513,7 +513,7 @@ module Rigor
       Type::Nominal.new(normalized)
     end
 
-    # Returned for `rigor:v1:param: <name> <refinement>`. The parameter name is a Ruby identifier (Symbol); the
+    # Returned for `rigor:v1:param: <name> <refinement>`. The parameter name is a Ruby identifier; the
     # type is any `Rigor::Type` the refinement parser resolves (bare kebab-case name, parameterised form, or
     # `Integer[a..b]` range, or the deprecated `int<a, b>` — the same grammar the `return:` directive accepts).
     ParamOverride = Data.define(:param_name, :type)
@@ -554,7 +554,7 @@ module Rigor
     end
 
     # Convenience reader for call sites that want to look up a single override by parameter name. Returns a
-    # frozen Hash<Symbol, Rigor::Type>; missing keys mean "use the RBS-declared type". Callers MUST treat the
+    # frozen map from parameter name to type; missing keys mean "use the RBS-declared type". Callers MUST treat the
     # hash as read-only.
     def param_type_override_map(method_def, environment: nil)
       overrides = read_param_type_overrides(method_def, environment: environment)
@@ -728,7 +728,6 @@ module Rigor
     NO_EFFECT_LABELS = [].freeze
     private_constant :NO_EFFECT_LABELS
 
-    # Whether `string` is the bare `%a{pure}` annotation.
     def pure_annotation?(string)
       !string.nil? && PURE_ANNOTATION_PATTERN.match?(string)
     end