rigortype 0.4.7 → 0.4.8

data/lib/rigor/memo_audit.rb

@@ -0,0 +1,282 @@
+# frozen_string_literal: true
+
+require_relative "typing_state"
+
+module Rigor
+  # ADR-127 WD3 — the memo audit. A memo hit is correct only when the key holds every input the value
+  # was computed from, and a key that misses one answers a caller with another caller's value (#2516, #2524). With the
+  # audit on, every hit in the callee floor's memos (`resolved_census`, the unrecorded hand-off memo, the successor
+  # store and `def_census`) recomputes the value and raises {Mismatch} when it differs from the stored one, so a key
+  # defect fails on the first hit instead of waiting for an order that exposes it.
+  #
+  # Like {BudgetTrace}, a switch for specs and CI (`RIGOR_MEMO_AUDIT=1` in the environment, read once at load, or
+  # {enable!}): off by default, a single boolean check when off. A recomputation
+  # runs with the audit suspended on its thread and the memos bypassed ({suspended?}), so it reads nothing stored.
+  #
+  # A mismatch raises, and is also kept on this thread's list until {drain} takes it (ADR-129 WD5, #2785): the
+  # typing path rescues `StandardError` in many places, and a raise one of them swallows would turn the defect into
+  # an ordinary fallback answer. The runner drains the list after each file and reports what it holds the way it
+  # reports a mismatch no rescue caught, and {raise_undrained!} fails the run on what a file never drained.
+  #
+  # **The key audit** (ADR-129 WD1) checks the other half at every miss: a Memo, or a Table a computation fills (the
+  # ADR-84 return memo), whose miss computation reads a Frame must key on the state id or on that Frame's value.
+  # {key_audit} runs a miss computation with its Frame reads noted ({TypingState::KeyAudit}) and compares them with
+  # the Frame terms the key read through {TypingState::State#key_frame} when {key} built it. A read Frame the key
+  # does not carry, and that neither the computation installed itself nor the site declared ({key_declaration}), is a
+  # {KeyMismatch}: kept on this thread's list like a raised mismatch, and not raised, since the computation's answer
+  # is correct for this caller.
+  module MemoAudit
+    # A memo hit whose stored value differs from a fresh computation.
+    class Mismatch < StandardError; end
+
+    # A memo miss whose computation read a Frame its key does not carry (ADR-129 WD1's key audit).
+    class KeyMismatch < Mismatch; end
+
+    # What a miss site declares beside its key terms (ADR-129 WD1), by Frame slot name:
+    # - `forced`: Frames the memo installs at a constant (or a value derived from its key) before the key is built,
+    #   so the computation reads that form rather than the caller's;
+    # - `gaps`: `slot name => reason` naming the issue of a known key gap, read without a key term and reported as a
+    #   named exception rather than a mismatch;
+    # - `carried`: `slot name => reason` for Frames another key term carries (a run-level flag, fixed while the run
+    #   generation the memo's bucket keys on is), counted as key terms.
+    KeyDeclaration = Data.define(:forced, :gaps, :carried)
+
+    # ADR-129 WD1 — a Frame, installed around a recomputation. `@enabled` is a process switch, outside the typing
+    # state (WD5). G1′ witness: a recomputation types a callee body, and the memo hits inside it read the flag.
+    SUSPENDED = TypingState.frame(
+      :memo_audit_suspended, reason: "set around an audit recomputation, which bypasses every memo",
+                             witness: "spec/fixtures/typing_state_witnesses/memo_audit_suspended.rb"
+    )
+    private_constant :SUSPENDED
+
+    # ADR-129 WD1 — a Resource: the mismatches raised on this thread and not drained yet. Typing never reads it; an
+    # append refuses every open capture, which only an audited run reaches.
+    MISMATCHES = TypingState.resource(
+      :memo_audit_mismatches,
+      run_scoped: true,
+      reason: "the audit's mismatches on this thread, appended where raised, drained per file, never read by typing"
+    )
+    private_constant :MISMATCHES
+
+    EMPTY = [].freeze
+    private_constant :EMPTY
+
+    # ADR-129 WD1 — the Frames every key audit names as exceptions rather than mismatches, with their reasons: the
+    # audit's own switch and the process switches whose installed recorders a computation may file into.
+    KEY_AUDIT_SWITCHES = {
+      memo_audit_suspended: "the audit's own switch: a nested hit's check reads it",
+      flow_tracer: "a process switch (WD5): the tracer is an output, and the type_of memo is shut under one (WD4)",
+      effects_collector: "a process switch (WD5): recording into its contents touches a Resource",
+      dependency_recorder: "a process switch (WD5): the recorder files ADR-46 dependency edges, which no type reads",
+      self_call_resolution_recorder: "a process switch (WD5): its records are a journaled Table, never read back"
+    }.freeze
+
+    # ADR-129 WD1 — a Resource: the named exceptions key audits on this thread met, `[label, slot name] => reason`.
+    # Typing never reads it.
+    KEY_EXCEPTIONS = TypingState.resource(
+      :memo_audit_key_exceptions,
+      run_scoped: true,
+      reason: "the key audit's named exceptions met on this thread, for specs and reports; never read by typing"
+    )
+    private_constant :KEY_EXCEPTIONS
+
+    NO_DECLARATION = KeyDeclaration.new(forced: EMPTY, gaps: {}.freeze, carried: {}.freeze)
+    private_constant :NO_DECLARATION
+
+    @enabled = %w[1 true].include?(ENV["RIGOR_MEMO_AUDIT"].to_s.downcase)
+
+    module_function
+
+    def enabled? = @enabled
+
+    # True while an audit recomputation runs on this thread. The callee floor's memos are then bypassed (read and
+    # write), so the recomputation reads no stored entry of another memo: a defect shared across a table (a stale
+    # `resolved_census(:edges)` entry) would otherwise make the recomputed value match the stored one.
+    def suspended? = TypingState.current[SUSPENDED]
+
+    def enable! = (@enabled = true)
+
+    def disable! = (@enabled = false)
+
+    # `stored`, after checking it against `yield` when the audit is on. `label` and the key parts (`key`, `key2`) name
+    # the memo entry in the failure; they are passed apart so an audit that is off allocates nothing.
+    def check(label, stored, key, key2 = nil, &)
+      return stored unless @enabled && !TypingState.current[SUSPENDED]
+
+      fresh = suspended(&)
+      return stored if fresh == stored
+
+      mismatch = Mismatch.new(
+        "#{label} memo hit differs from a fresh computation for #{[key, key2].inspect[0, 120]}: " \
+        "stored #{stored.inspect[0, 200]}, fresh #{fresh.inspect[0, 200]}"
+      )
+      state = TypingState.current
+      state.append(MISMATCHES, mismatch)
+      raise mismatch
+    end
+
+    # ADR-129 G1′ — a `type_of` begins on this thread, for the matching {leave_type_of}; the caller guards on
+    # {enabled?}, so an audit that is off costs one boolean check. Fails (as a {Mismatch} on the list, not raised) on an
+    # installed `typing_unreachable` Frame ({TypingState::FrameAudit}).
+    def enter_type_of
+      state = TypingState.current
+      state.extend(TypingState::FrameAudit) unless state.is_a?(TypingState::FrameAudit)
+      state.enter_type_of
+    end
+
+    # ADR-129 G1′ — the `type_of` memo's shadow reached its table on `state`; the caller guards on {enabled?}. Fails (as
+    # a {Mismatch} on the list, not raised) on an installed `memo_shut_while_installed` Frame.
+    def note_memo_lookup(state)
+      state.extend(TypingState::FrameAudit) unless state.is_a?(TypingState::FrameAudit)
+      state.note_memo_lookup
+    end
+
+    # ADR-129 G1′ — the `type_of` {enter_type_of} tracked ends.
+    def leave_type_of
+      TypingState.current.leave_type_of
+    end
+
+    # Keeps one {Mismatch} per message on the list until it is drained: a Frame declaration that does not hold is
+    # reported at every `type_of` it meets.
+    def report_frame_declaration(state, message)
+      pending = state.read(MISMATCHES)
+      return if pending&.any? { |mismatch| mismatch.message == message }
+
+      mismatch = Mismatch.new(message)
+      mismatch.set_backtrace(caller.drop_while { |frame| frame.include?("/typing_state.rb:") })
+      state.append(MISMATCHES, mismatch)
+    end
+
+    # The mismatches raised on this thread since the last drain, oldest first, and an empty list for the next file.
+    # Each has been raised, so it carries the backtrace a crash row is built from.
+    def drain
+      state = TypingState.current
+      mismatches = state.read(MISMATCHES)
+      return EMPTY if mismatches.nil? || mismatches.empty?
+
+      state.write(MISMATCHES, nil)
+      mismatches
+    end
+
+    # ADR-129 WD1 — checks a `carried:` claim at the install of a run-level flag (`flag`, ADR-130's erasure or
+    # dispatch-off frame). The return memo counts the flag as carried by its bucket's run-generation key, which holds
+    # only while the flag is installed around a whole run: with the audit on, an install that finds the return memo
+    # holding entries (a run in progress, or one that was not released) raises instead of silently mixing answers
+    # computed under both values.
+    def check_run_level_install(flag)
+      return unless @enabled
+
+      held = TypingState.current[TypingState.slot(:user_method_return_memo).index]
+      return if held.nil? || held[1].empty?
+
+      raise Mismatch, "#{flag} installed while the return memo holds entries: the memo's key carries it only as a " \
+                      "flag installed around a whole run (ADR-129 WD1 key audit)"
+    end
+
+    # Raises the first mismatch no file drained (one raised outside every file's analysis), so a run that ends with
+    # one fails instead of releasing it with the run's other slots.
+    def raise_undrained!
+      return unless @enabled
+
+      mismatches = drain
+      raise mismatches.first unless mismatches.empty?
+    end
+
+    def suspended(&)
+      TypingState.current.with(SUSPENDED, true, &)
+    end
+
+    # A frozen {KeyDeclaration} for a miss site, built once into a constant so an audit that is off allocates nothing.
+    def key_declaration(forced: EMPTY, gaps: {}, carried: {})
+      KeyDeclaration.new(forced: forced.map(&:to_sym).freeze, gaps: gaps.transform_keys(&:to_sym).freeze,
+                         carried: carried.transform_keys(&:to_sym).freeze)
+    end
+
+    # The key the block builds. When the audit is on, the Frames the block reads through
+    # {TypingState::State#key_frame} are remembered as the key's terms for the {key_audit} of the miss that follows.
+    def key(&)
+      return yield unless @enabled
+
+      auditing_state.collect_key_terms(&)
+    end
+
+    # The block's value: a memo's miss computation, run under ADR-129 WD1's Memo rule
+    # ({TypingState::State#memo_miss}: a miss that writes a Table while a capture is open touches), keyed by `key`
+    # ({key}, or nil for a key that reads no Frame) and declared by `declaration` ({key_declaration}). When the audit
+    # is on, a Frame the computation reads that the key does not carry is a {KeyMismatch} on this thread's list, named
+    # by `label` (the slot's `audit:` or `computed:` label), unless it is internal, forced, carried, a declared gap or
+    # a {KEY_AUDIT_SWITCHES} switch.
+    #
+    # A computation that raises or throws is not judged, and its audit is closed on the way out. A computation that
+    # returns is judged whether or not its memo then stores it (the return memo's WD3 bracket may refuse it), which
+    # only reports more. An audit recomputation ({suspended?}) is not judged either, but it still opens the site's
+    # declaration, so a gap it declares reaches the audits around it as it does on a miss: the verdict of an enclosing
+    # miss does not depend on whether this memo hit.
+    def key_audit(label, declaration = nil, key = nil, &)
+      return TypingState.current.memo_miss(&) unless @enabled
+
+      state = auditing_state
+      declaration ||= NO_DECLARATION
+      judged = !state[SUSPENDED]
+      terms = state.key_terms_for(key) if judged
+      state.open_key_audit(label, declaration.gaps)
+      begin
+        value = state.memo_miss(&)
+      ensure
+        reads = state.close_key_audit
+      end
+      judge_key_audit(state, label, declaration, terms, reads) if judged
+      value
+    end
+
+    # The named exceptions key audits on this thread have met since the run began, `[label, slot name] => reason`.
+    def key_exceptions
+      TypingState.current.read(KEY_EXCEPTIONS) || {}
+    end
+
+    def auditing_state
+      state = TypingState.current
+      state.extend(TypingState::KeyAudit) unless state.is_a?(TypingState::KeyAudit)
+      state
+    end
+
+    def judge_key_audit(state, label, declaration, terms, reads)
+      return if reads.empty? || terms.include?(TypingState::KeyAudit::STATE_ID)
+
+      reads.each do |slot, via|
+        name = TypingState.slots[slot].name
+        next note_key_exception(state, label, name, "through the #{via[0]} miss: #{via[1]}") unless via == true
+        next if terms.include?(slot) || declaration.forced.include?(name) || declaration.carried.key?(name)
+
+        reason = key_exception_reason(declaration, name)
+        reason ? note_key_exception(state, label, name, reason) : report_key_mismatch(state, label, name)
+      end
+    end
+
+    # Why a miss may read the Frame `name` without a key term, or nil: a gap its site declares, or a switch.
+    def key_exception_reason(declaration, name) = declaration.gaps[name] || KEY_AUDIT_SWITCHES[name]
+
+    def note_key_exception(state, label, name, reason)
+      seen = state.acquire(KEY_EXCEPTIONS) { {} }
+      seen[[label, name]] ||= reason
+    end
+
+    # Keeps one {KeyMismatch} per message on the list until it is drained: a key defect repeats at every miss.
+    def report_key_mismatch(state, label, name)
+      message = "key audit: the #{label} miss read the Frame #{name}, which its key does not carry"
+      pending = state.read(MISMATCHES)
+      return if pending&.any? { |mismatch| mismatch.message == message }
+
+      mismatch = KeyMismatch.new(message)
+      mismatch.set_backtrace(caller.drop_while { |frame| frame.include?("/memo_audit.rb:") })
+      state.append(MISMATCHES, mismatch)
+    end
+  end
+
+  # The engine reaches the audit as `Inference::MemoAudit`; it lives at `lib/rigor/memo_audit.rb` so the value layer
+  # (`Reflection`, `Scope`) can load it without loading an `inference/` file (ADR-104's warm effects probe budget), as
+  # `TypingState` does (#2796).
+  module Inference
+    MemoAudit = Rigor::MemoAudit
+  end
+end

data/lib/rigor/plugin/base.rb

@@ -945,6 +945,14 @@ module Rigor
         @io_boundary ||= services.io_boundary_for(manifest.id)
       end
 
+      # The boundary {#io_boundary} has built, or nil when this plugin never asked for one, without building it: a
+      # plugin that never built one read nothing through it. Engine-internal ({Analysis::RunDisclosureCredit} sends it,
+      # being outside the class), so it is private and part of no plugin-facing contract.
+      #
+      # @api private
+      def built_io_boundary = @io_boundary
+      private :built_io_boundary
+
       # ADR-7 § "Slice 6-A" / ADR-60 WD3 — returns a callable that performs a `Cache::Store#fetch_or_validate`
       # round-trip for the named producer (the ADR-45 record-and-validate path). The entry is KEYED on the
       # stable identity inputs — the plugin's `PluginEntry` template (id, version, config_hash) composed with
@@ -1064,14 +1072,19 @@ module Rigor
       # The gate for one `dynamic_return` rule. Method-name gate first — a Symbol-array probe vs the receiver
       # ancestry resolution below (ADR-52 WD1); both are pure predicates, so order only affects cost. A
       # receiver-less rule (ADR-52 WD2) skips the ancestry check entirely and fires on the method name alone.
+      # The engine also offers the nameless nodes of #2717 (the `&:sym` BlockArgumentNode, the compound
+      # write nodes) to a plugin `build_name_gates` left ungated; only `CallNode` answers `name`, so a
+      # name-gated rule declines them (`include?(nil)` is false) rather than raising past the later rules
+      # (#2764).
       def dynamic_return_rule_applies?(rule, call_node, receiver_type, environment, scope)
-        return false if rule[:methods] && !resolved_dynamic_return_methods(rule).include?(call_node.name)
+        name = call_node.respond_to?(:name) ? call_node.name : nil
+        return false if rule[:methods] && !resolved_dynamic_return_methods(rule).include?(name)
 
         if rule[:file_methods]
           # The path is read here, not in `dynamic_return_type`, so a spec-double scope without
           # `source_path` only affects `file_methods:` rules (other gate forms never touch it).
           path = scope.respond_to?(:source_path) ? scope.source_path : nil
-          return false unless resolved_dynamic_return_file_methods(rule, path).include?(call_node.name)
+          return false unless resolved_dynamic_return_file_methods(rule, path).include?(name)
         end
 
         entries = resolved_dynamic_return_receiver_entries(rule)

data/lib/rigor/plugin/io_boundary.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "digest"
+require_relative "../typing_state"
 
 require_relative "access_denied_error"
 require_relative "../rooted_glob"
@@ -52,11 +53,20 @@ module Rigor
     #   descriptor and any enclosing producer's descriptor then carry the served value's inputs.
     class IoBoundary
       URL_TIMEOUT_SECONDS = 10
-      URL_MAX_BYTES = 10 * 1024 * 1024
+      URL_MAX_BYTES = 10_485_760 # 10 MiB
 
       ATTRIBUTION_KEY = :rigor_io_boundary_attribution
       private_constant :ATTRIBUTION_KEY
 
+      # ADR-129 WD3 / #2814 — the attribution sink is a Resource: a `type_of` memo hit that served an answer without
+      # re-running the plugin read would not append what the miss appended, so every {.attribute} refuses each open
+      # capture. Its storage stays the thread variable above (ADR-129 WD5 shape 2); this slot declares its kind.
+      SINK = TypingState.resource(
+        :io_boundary_attribution,
+        reason: "every plugin boundary read appends to the attributing sink, which a memo hit would not replay"
+      )
+      private_constant :SINK
+
       # ADR-45 WD2 (#1507) — runs the block with `sink` (an Array) receiving every file and listing row ANY
       # boundary records on this thread meanwhile, in addition to the boundary's own table, and returns the
       # block's value. `Analysis::Runner` wraps each file's analysis in one when it records dependencies, so the
@@ -67,16 +77,28 @@ module Rigor
       # lands in the sink. The boundary's own table is unchanged by it, including its first-existence-row-stands
       # rule: the sink records what each read observed. Only reads are credited: a value a plugin memoised reaches
       # later files without one, so the first file to trigger the read is the only one credited with it.
+      #
+      # The installing fiber's typing state rides with the sink, so a read from inside an `Enumerator` refuses the
+      # captures open where the analysis runs, not only those of the `Enumerator`'s own fiber ({.attribute}).
       def self.attributing(sink)
         previous = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
-        Thread.current.thread_variable_set(ATTRIBUTION_KEY, sink)
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, [sink, TypingState.current].freeze)
         yield
       ensure
         Thread.current.thread_variable_set(ATTRIBUTION_KEY, previous)
       end
 
+      # Records `entry` in the attributing sink, if one is installed, and touches {SINK} on the calling fiber's typing
+      # state and on the installing fiber's (ADR-129 WD3, #2814).
       def self.attribute(entry)
-        Thread.current.thread_variable_get(ATTRIBUTION_KEY)&.push(entry)
+        state = TypingState.current
+        state.touch(SINK)
+        sink, owner = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
+        return nil if sink.nil?
+
+        owner.touch(SINK)
+        sink.push(entry)
+        nil
       end
 
       attr_reader :policy, :plugin_id

data/lib/rigor/plugin/manifest.rb

@@ -304,11 +304,15 @@ module Rigor
         FirstParty.bundled?(id)
       end
 
-      # Whether the plugin contributes anything to the effect surfaces at all. The compiled per-run tables
-      # skip a plugin that answers false, so a project whose plugins predate this contract pays nothing.
+      # Whether the manifest declares anything for the effect surfaces — a convenience predicate over the
+      # manifest-declared fields only, true exactly when a `Registry::Contribution` built from these
+      # declarations would not be empty (`Contribution#empty?` reads the same five fields,
+      # `effect_ancestry:` included). A plugin that overrides the `Base#effect_*` readers instead of
+      # declaring rows here (rigor-sidekiq) can contribute while this answers false. The compiled
+      # per-run tables filter on `Contribution#empty?` themselves; nothing consults this predicate.
       def effects?
         !effect_labels.empty? || !effect_attributions.empty? || !effect_edges.empty? ||
-          !effect_entry_points.empty?
+          !effect_entry_points.empty? || !effect_ancestry.empty?
       end
 
       def ==(other)

data/lib/rigor/plugin/registry.rb

@@ -4,6 +4,7 @@ require_relative "blueprint"
 # Issue #806 — {Registry#guarded_manifest} constructs one. `Rigor::Plugin::LoadError` MUST be defined by
 # then: an unresolved bare `LoadError` in this lexical scope silently falls back to Ruby's own ::LoadError.
 require_relative "load_error"
+require_relative "../typing_state"
 
 module Rigor
   module Plugin
@@ -20,6 +21,10 @@ module Rigor
     # exactly the order the ungated walk produced — diagnostics stay byte-identical. The receiver-class
     # ancestry match for `dynamic_return` still happens per-dispatch inside `Plugin::Base#dynamic_return_type`.
     class ContributionIndex
+      TypingState.memo_field(self, :@owns_receiver_memo,
+                             reason: "keyed on the environment's identity and the class name; the plugins' " \
+                                     "owns_receivers set is fixed at construction")
+
       # Ordered (registry-order) subsets relevant to each collector, and the membership sets used to gate the
       # paths within a plugin. `for_file_diagnostics` is the subset the runner's per-file diagnostic loop
       # visits: plugins overriding `#diagnostics_for_file` or declaring at least one `node_rule`.
@@ -103,8 +108,8 @@ module Rigor
       # The categorisation sets + the ordered per-collector subsets.
       def compile_memberships(plugins)
         plugins.each { |p| reject_legacy_flow_hook!(p) }
-        @dynamic = plugins.reject { |p| p.class.dynamic_returns.empty? }.to_set
-        @narrowing_facts = plugins.reject { |p| p.class.narrowing_facts_rules.empty? }.to_set
+        @dynamic = plugins.reject { |p| p.class.dynamic_returns.empty? }.to_set.freeze
+        @narrowing_facts = plugins.reject { |p| p.class.narrowing_facts_rules.empty? }.to_set.freeze
         compile_collector_subsets(plugins)
       end
 
@@ -218,6 +223,12 @@ module Rigor
     # Ractor. The eventual Phase 4 pool ships `blueprints` across the boundary and calls {.materialize}
     # per-Ractor; the live `plugins` carriage on the coordinator registry stays unchanged.
     class Registry
+      TypingState.memo_field(self, :@contracts_by_path, :@effect_memo,
+                             reason: "keyed on the path, and on the one effect-contribution compile; the contract " \
+                                     "set, glob semantics and plugin set are fixed for the run (ADR-52 WD1), and the " \
+                                     "compile, which may read project facts across the I/O boundary, rests on the " \
+                                     "run's stable-filesystem premise, as FileDigest's run tables do")
+
       attr_reader :plugins, :load_errors, :blueprints, :contribution_index, :resolved_gem_paths
 
       # @param plugins — instantiated plugin instances in deterministic order.

data/lib/rigor/plugin/trust_policy.rb

@@ -45,6 +45,52 @@ module Rigor
         freeze
       end
 
+      # Builds the run's policy from the project configuration — the one derivation `rigor check`
+      # ({Analysis::Runner}), pooled workers ({Analysis::WorkerSession}) and `rigor unused`'s plugin roots
+      # ({Analysis::Reachability::PluginRoots}) share, so every `Plugin::Services` container enforces the
+      # same scope (#2586).
+      #
+      # `trusted_gems` is the gem-name half of every `Configuration#plugins` entry. `allowed_read_roots`
+      # is the project root (CWD), every `signature_paths` entry, each trusted gem's
+      # `Gem.loaded_specs` `full_gem_path` (silently skipped when the gem has no loaded spec), and every
+      # `plugins_io.allowed_paths` entry. `network_policy` / `allowed_url_hosts` come from
+      # `plugins_io.network` / `plugins_io.allowed_url_hosts`.
+      def self.for_configuration(configuration)
+        trusted_gems = configuration.plugins.map { |entry| trusted_gem_name(entry) }.uniq
+        roots = [Dir.pwd]
+        Array(configuration.signature_paths).each { |sp| roots << File.absolute_path(sp) }
+        trusted_gems.each do |gem_name|
+          path = trusted_gem_root(gem_name)
+          roots << path if path
+        end
+        configuration.plugins_io_allowed_paths.each { |p| roots << File.absolute_path(p) }
+
+        new(
+          trusted_gems: trusted_gems,
+          allowed_read_roots: roots,
+          network_policy: configuration.plugins_io_network,
+          allowed_url_hosts: configuration.plugins_io_allowed_url_hosts
+        )
+      end
+
+      def self.trusted_gem_name(entry)
+        case entry
+        when String then entry
+        when Hash then entry["gem"] || entry["id"]
+        end
+      end
+      private_class_method :trusted_gem_name
+
+      def self.trusted_gem_root(gem_name)
+        return nil if gem_name.nil? || gem_name.empty?
+
+        spec = Gem.loaded_specs[gem_name]
+        spec&.full_gem_path
+      rescue StandardError
+        nil
+      end
+      private_class_method :trusted_gem_root
+
       # @return true when the absolute path falls inside any allowed read root. Symlinks are
       #   resolved through `File.absolute_path` only (no `realpath`); plugins with adversarial intent are out of
       #   scope per ADR-2.

data/lib/rigor/protection/mutation_cache.rb

@@ -215,7 +215,10 @@ module Rigor
             end,
             "patched_overrides" => project_scan.project_patched_methods.overrides.map do |key, visibility|
               [*key, visibility].map(&:to_s)
-            end
+            end,
+            "patched_singleton_copies" => project_scan.project_patched_methods.singleton_copies.map do |owner, name|
+              [owner.to_s, name.to_s]
+            end.sort
           }
           Digest::SHA256.hexdigest(JSON.generate(payload))
         rescue StandardError

data/lib/rigor/reflection/constant_ancestors.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require_relative "../run_scoped_slots"
+require_relative "../typing_state"
+require_relative "../memo_audit"
 
 module Rigor
   # {Reflection}'s constant-ancestor walk ([#354](https://github.com/rigortype/rigor/issues/354)), split out for
@@ -9,13 +10,23 @@ module Rigor
   # name's owner inherits constants from, and this file answers that once for both. Reopening the module
   # keeps the walk behind the facade its callers already read.
   module Reflection
-    # #354 — thread-local slot for the per-run ancestor-scope memo. See {.ancestor_constant_scopes}.
-    ANCESTOR_SCOPES_KEY = RunScopedSlots.register(:__rigor_ancestor_constant_scopes__)
-    private_constant :ANCESTOR_SCOPES_KEY
-
-    # The recording run's slot. See {.recorded_ancestor_constant_scopes}.
-    RECORDED_ANCESTOR_SCOPES_KEY = RunScopedSlots.register(:__rigor_recorded_ancestor_constant_scopes__)
-    private_constant :RECORDED_ANCESTOR_SCOPES_KEY
+    # #354 — the per-run ancestor-scope memo. See {.ancestor_constant_scopes}. ADR-129 WD1 — a run-scoped Memo.
+    ANCESTOR_SCOPES = TypingState.memo(
+      :ancestor_constant_scopes,
+      run_scoped: true, audit: "ancestor constant scopes",
+      reason: "one [discovery, scopes by class name] slot keyed on the discovery index's identity, as the " \
+              "resolution chain the scopes are read from is (#2848)"
+    )
+    private_constant :ANCESTOR_SCOPES
+
+    # The recording run's slot. See {.recorded_ancestor_constant_scopes}. ADR-129 WD1 — a run-scoped Memo.
+    RECORDED_ANCESTOR_SCOPES = TypingState.memo(
+      :recorded_ancestor_constant_scopes,
+      run_scoped: true, audit: "recorded ancestor constant scopes",
+      reason: "one [discovery, scopes by class name] slot keyed on the discovery index's identity; a hit replays " \
+              "the chain's edges, so the key is exact"
+    )
+    private_constant :RECORDED_ANCESTOR_SCOPES
 
     module_function
 
@@ -37,11 +48,13 @@ module Rigor
     # constant it owns resolves only if the bare name reaches it at step 3: widening to the superclass's
     # RBS graph is a separate question with its own FP surface. See {.external_constant_owner}.
     #
-    # Memoised per run because step 2 runs on every constant reference whose lexical candidates all
-    # miss — which is the common case for a core-class reference (`String` inside `class Foo`). The
-    # bucket keys on the identity of the runner-seeded run-generation token (ADR-84 WD2), falling
-    # back to the per-file discovery table for runner-less scopes, so a re-run in one process (LSP,
-    # ADR-62 warm loop) cannot hit stale entries.
+    # Memoised because step 2 runs on every constant reference whose lexical candidates all miss — which
+    # is the common case for a core-class reference (`String` inside `class Foo`). The bucket keys on the
+    # identity of the discovery index, as the `Scope::ResolutionChain` memo it reads does: the chain's
+    # order depends on the analysing file's own view of the include order (a class declared in two files
+    # orders its `include`s from the reader's file first), so a run-generation key served one file's
+    # order to another (#2848). A re-run in one process (LSP, ADR-62 warm loop) builds a new index, so it
+    # cannot hit stale entries either.
     def ancestor_constant_scopes(class_name, scope)
       ancestor_constant_worlds(class_name, scope).first
     end
@@ -87,32 +100,76 @@ module Rigor
       # every call.
       return recorded_ancestor_constant_scopes(class_name, scope) if Analysis::DependencyRecorder.active?
 
-      generation = scope.run_generation || scope.discovered_superclasses
-      slot = Thread.current[ANCESTOR_SCOPES_KEY]
-      unless slot && slot[0].equal?(generation)
-        slot = [generation, {}]
-        Thread.current[ANCESTOR_SCOPES_KEY] = slot
+      # ADR-129 G2 — an audit recomputation bypasses the memo (neither read nor written).
+      if Inference::MemoAudit.enabled? && Inference::MemoAudit.suspended?
+        return compute_ancestor_constant_scopes(class_name, scope)
+      end
+
+      discovery = scope.discovery
+      state = TypingState.current
+      slot = state[ANCESTOR_SCOPES]
+      unless slot && slot[0].equal?(discovery)
+        slot = [discovery, {}]
+        state[ANCESTOR_SCOPES] = slot
       end
       bucket = slot[1]
-      bucket.fetch(class_name) { bucket[class_name] = compute_ancestor_constant_scopes(class_name, scope) }
+      worlds = bucket[class_name]
+      if worlds.nil?
+        return bucket[class_name] = Inference::MemoAudit.key_audit("ancestor constant scopes") do
+          compute_ancestor_constant_scopes(class_name, scope)
+        end
+      end
+      return worlds unless Inference::MemoAudit.enabled?
+
+      Inference::MemoAudit.check("ancestor constant scopes", audit_view(worlds), class_name) do
+        audit_view(compute_ancestor_constant_scopes(class_name, scope))
+      end
+      worlds
     end
     private_class_method :ancestor_constant_worlds
 
+    # `[scopes, chain]` compared by content: a recomputation builds a new chain object, equal to the stored one
+    # entry for entry when the key holds every input.
+    def audit_view(worlds) = [worlds[0], worlds[1].audit_signature]
+    private_class_method :audit_view
+
+    # A recomputation for the audit, its dependency reads withheld: the hit it checks files its own edges, so the
+    # recorded set stays what an unaudited run records.
+    def fresh_ancestor_constant_scopes(class_name, scope)
+      Analysis::DependencyRecorder.withhold { compute_ancestor_constant_scopes(class_name, scope) }.first
+    end
+    private_class_method :fresh_ancestor_constant_scopes
+
     # The recording run's memo. The answer is every project entry of the chain, so its edges are the
     # root's and every entry's — what `Scope::ResolutionChain#record` files, which a computation does and a
     # hit replays, in the same order. One slot keyed on the discovery index: the answer and the edges are
     # both read from it, so the key is exact, and the slot never pins more than the index it serves.
     def recorded_ancestor_constant_scopes(class_name, scope)
+      # ADR-129 G2 — an audit recomputation bypasses the memo (neither read nor written).
+      if Inference::MemoAudit.enabled? && Inference::MemoAudit.suspended?
+        return compute_ancestor_constant_scopes(class_name, scope)
+      end
+
       discovery = scope.discovery
-      slot = Thread.current[RECORDED_ANCESTOR_SCOPES_KEY]
+      state = TypingState.current
+      slot = state[RECORDED_ANCESTOR_SCOPES]
       unless slot && slot[0].equal?(discovery)
         slot = [discovery, {}]
-        Thread.current[RECORDED_ANCESTOR_SCOPES_KEY] = slot
+        state[RECORDED_ANCESTOR_SCOPES] = slot
       end
       bucket = slot[1]
       worlds = bucket[class_name]
-      return bucket[class_name] = compute_ancestor_constant_scopes(class_name, scope) if worlds.nil?
+      if worlds.nil?
+        return bucket[class_name] = Inference::MemoAudit.key_audit("recorded ancestor constant scopes") do
+          compute_ancestor_constant_scopes(class_name, scope)
+        end
+      end
 
+      if Inference::MemoAudit.enabled?
+        Inference::MemoAudit.check("recorded ancestor constant scopes", audit_view(worlds), class_name) do
+          audit_view(fresh_ancestor_constant_scopes(class_name, scope))
+        end
+      end
       chain = Scope::ResolutionChain.for(scope, class_name.to_s, :instance, :constants)
       chain.record(scope)
       record_external_owner_edges(chain)