PR A: Close the sealed Command hierarchy honestly — sealed module Command, abstract BuiltinCommand open edge, delete the sorbet-runtime ivar pokes, un-private CommandRepository

src/dev/builtins.rb

@@ -2,11 +2,12 @@
 # frozen_string_literal: true
 
 module Dev
- # One class per builtin dev command. Each exposes call(args:, context:)
- # with its collaborators constructor-injected; per-call values stay
- # method-side. The composition root (Runner) decides which builtins exist
- # for a given project (config-gated: runner-setup only with a `runner:`
- # block, provide-image/reset-container only with a build container).
+ # One class per builtin dev command, each subclassing BuiltinCommand —
+ # the sealed Command hierarchy's declared open edge — with its
+ # collaborators constructor-injected; per-call values stay method-side.
+ # The composition root (Runner) decides which builtins exist for a given
+ # project (config-gated: runner-setup only with a `runner:` block,
+ # provide-image/reset-container only with a build container).
  module Builtins; end
 end
 

src/dev/builtins/cache_command.rb

@@ -24,6 +24,7 @@ def initialize(
  cache_gc_factory: ->(lockfile) { Dev::Deps::CacheGc.new(lockfile:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @cache_gc_factory = T.let(cache_gc_factory, CacheGcFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/cd_command.rb

@@ -14,6 +14,7 @@ class CdCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Cd::Accessor).void }
  def initialize(accessor: Dev::Cd::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Cd::Accessor)
  end
 

src/dev/builtins/check_command.rb

@@ -13,6 +13,7 @@ class CheckCommand < BuiltinCommand
 
  sig { params(dependency_service: DependencyService).void }
  def initialize(dependency_service:)
+ super()
  @dependency_service = T.let(dependency_service, DependencyService)
  end
 

src/dev/builtins/clone_command.rb

@@ -14,6 +14,7 @@ class CloneCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Clone::Accessor).void }
  def initialize(accessor: Dev::Clone::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Clone::Accessor)
  end
 

src/dev/builtins/cred_command.rb

@@ -14,6 +14,7 @@ class CredCommand < BuiltinCommand
 
  sig { params(accessor: Dev::CredentialAccessor).void }
  def initialize(accessor: Dev::CredentialAccessor.new)
+ super()
  @accessor = T.let(accessor, Dev::CredentialAccessor)
  end
 

src/dev/builtins/deps_command.rb

@@ -29,6 +29,7 @@ def initialize(
  )
  }
  )
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/install_deps_command.rb

@@ -50,6 +50,7 @@ def initialize(
  gem_skill_linker_factory: ->(project_root) { Dev::Deps::GemSkillLinker.new(project_root:) },
  synchronizer: Dev::Learnings::Synchronizer.for
  )
+ super()
  @installer_factory = T.let(installer_factory, InstallerFactory)
  @gem_skill_linker_factory = T.let(gem_skill_linker_factory, GemSkillLinkerFactory)
  @synchronizer = T.let(synchronizer, T.untyped)

src/dev/builtins/learnings_command.rb

@@ -20,6 +20,7 @@ class LearningsCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Learnings::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/plan_command.rb

@@ -20,6 +20,7 @@ class PlanCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Plan::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/runner_setup_command.rb

@@ -36,6 +36,7 @@ def initialize(
  runner_setup_factory: ->(config, repo, org) { Dev::RunnerSetup.new(config:, repo:, org:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @runner_setup_factory = T.let(runner_setup_factory, RunnerSetupFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/up_command.rb

@@ -23,6 +23,7 @@ class UpCommand < BuiltinCommand
  ).void
  end
  def initialize(install_deps_command:, hook_installer: Dev::Cd::HookInstaller.new)
+ super()
  @install_deps_command = T.let(install_deps_command, InstallDepsCommand)
  @hook_installer = T.let(hook_installer, Dev::Cd::HookInstaller)
  end

src/dev/command.rb

@@ -4,20 +4,31 @@
 require_relative "execution_context"
 
 module Dev
- # Sealed command data hierarchy. A command is one of exactly three shapes:
+ # Sealed command hierarchy. A command is one of exactly three shapes:
  #
- # - BuiltinCommand: a Ruby body dev ships (abstract here; concretes live
- # under src/dev/builtins/)
+ # - BuiltinCommand: a Ruby body dev ships (an abstract class, the
+ # hierarchy's one declared open edge; subclasses live under
+ # src/dev/builtins/)
  # - ProjectCommand: pure data parsed from a dev.yml `commands:` entry
  # - OverriddenCommand: a project command occupying a builtin's slot (the
  # builtin runs first, like a hardcoded super())
  #
- # Sealing makes any other nesting unrepresentable: CommandExecutor
- # dispatches exhaustively over these three variants (case + T.absurd).
- # Sorbet requires the direct subclasses of a sealed class beside it, which
- # is why the whole hierarchy shares this file; BuiltinCommand is abstract
- # but deliberately NOT sealed, so its concretes get their own files.
- class Command
+ # Sealing makes a fourth variant unrepresentable: CommandExecutor
+ # dispatches exhaustively over these three (case + T.absurd), and Sorbet
+ # requires a sealed module's direct heirs beside it, which is why the
+ # hierarchy shares this file.
+ #
+ # Command is a module rather than a class deliberately. A sealed class's
+ # runtime `inherited` hook rides down the singleton chain to every
+ # descendant, so builtins subclassing an abstract BuiltinCommand class
+ # raise at definition time unless sorbet-runtime internals are faked open
+ # (the ivar pokes this file used to carry). A sealed module's `included`
+ # hook fires only for its direct includers — the three heirs below —
+ # because `include` never transfers singleton methods, so subclassing
+ # BuiltinCommand is an honest open edge with nothing to suppress. Descent
+ # is closed everywhere it is not explicitly declared: the two data leaves
+ # are final!.
+ module Command
  extend T::Sig
  extend T::Helpers
  abstract!
@@ -46,77 +57,80 @@ def staleness_exempt? = false
  def stamps? = false
  end
 
- # Built-in command that executes Ruby code. Concretes live under
- # src/dev/builtins/, one class per builtin, with collaborators injected
- # through their constructors; per-call values arrive through #call.
- class BuiltinCommand < Command
+ # Built-in command that executes Ruby code: the hierarchy's declared open
+ # edge. Subclasses live under src/dev/builtins/, one class per builtin,
+ # with collaborators injected through their constructors; per-call values
+ # arrive through #call. Test fakes subclass it the same way.
+ #
+ # A class rather than a module because Sorbet flattens module mixins:
+ # were this a module, every includer would gain sealed Command as a
+ # direct mixin in the symbol table and fail the same-file check
+ # statically. A superclass edge is not flattened, so subclasses inherit
+ # Command's membership without re-including it — legal statically, and
+ # invisible to the seal's runtime hooks.
+ class BuiltinCommand
  extend T::Sig
  extend T::Helpers
+ include Command
  abstract!
 
  sig { abstract.params(args: T::Array[String], context: ExecutionContext).void }
  def call(args:, context:); end
  end
 
- # Statically, `sealed!` binds only Command's direct subclasses, so
- # BuiltinCommand concretes may live in their own files — but sorbet-runtime's
- # inherited hook also rides down to BuiltinCommand's subclasses and would
- # reject them for lacking a sealed declaration. Registering an empty
- # decl-file prefix marks BuiltinCommand as the hierarchy's deliberately open
- # edge: the hook accepts subclasses from any file (src/dev/builtins/, test
- # fakes), matching the static rule.
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_decl_file, "")
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_all_subclasses, [])
-
  # Project command from a dev.yml `commands:` entry. Pure data: the run
  # string, optional description, repl flag, and container opt-out. When
  # build.container is declared, commands run inside the container by
  # default unless container: false.
- class ProjectCommand < Command
+ class ProjectCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(String) }
+ sig(:final) { returns(String) }
  attr_reader :run
 
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  attr_reader :desc
 
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :repl
 
  # Whether this command should run inside the build container (when one is
  # configured). Defaults to true; set to false via `container: false` in dev.yml.
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :container
 
- sig do
+ sig(:final) do
  params(run: String, desc: String, repl: T::Boolean, container: T::Boolean, hidden: T::Boolean).void
  end
  def initialize(run:, desc: "(no description)", repl: false, container: true, hidden: false)
+ super()
  @run = T.let(run, String)
  @desc = T.let(desc, String)
  @repl = T.let(repl, T::Boolean)
  @container = T.let(container, T::Boolean)
  @hidden = T.let(hidden, T::Boolean)
  end
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @hidden
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def ==(other)
  return false unless other.is_a?(ProjectCommand)
 
  @run == other.run && @desc == other.desc && @repl == other.repl &&
  @container == other.container && @hidden == other.hidden?
  end
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def eql?(other)
  self == other
  end
 
- sig { returns(Integer) }
+ sig(:final) { returns(Integer) }
  def hash
  [@run, @desc, @repl, @container, @hidden].hash
  end
@@ -126,36 +140,40 @@ def hash
  # dispatch: the override owns the slot, and its implementation calls
  # super() at the top — CommandExecutor runs the builtin body first, then
  # the project command.
- class OverriddenCommand < Command
+ class OverriddenCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(BuiltinCommand) }
+ sig(:final) { returns(BuiltinCommand) }
  attr_reader :builtin
 
- sig { returns(ProjectCommand) }
+ sig(:final) { returns(ProjectCommand) }
  attr_reader :project
 
- sig { params(builtin: BuiltinCommand, project: ProjectCommand).void }
+ sig(:final) { params(builtin: BuiltinCommand, project: ProjectCommand).void }
  def initialize(builtin:, project:)
+ super()
  @builtin = T.let(builtin, BuiltinCommand)
  @project = T.let(project, ProjectCommand)
  end
 
  # The override owns the slot, so its description wins — a project `up:`
  # shows its own desc in usage, not the generic builtin one.
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  def desc = @project.desc
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @project.hidden?
 
  # Guard and stamp traits belong to the slot, not the override: a project
  # `up:` still is the provisioning command, so it inherits the builtin's
  # exemption and stamping behavior.
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def staleness_exempt? = @builtin.staleness_exempt?
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def stamps? = @builtin.stamps?
  end
 end

src/dev/command_repository.rb

@@ -10,8 +10,8 @@ module Dev
  # builtin's slot — their OverriddenCommand composition. Data in, never a
  # path, never a parse.
  #
- # Onion rule: CommandService is the only production consumer; the constant
- # is private and construction is confined to the composition root.
+ # Onion rule: CommandService is the only production consumer, and
+ # construction is confined to the composition root.
  class CommandRepository
  extend T::Sig
 
@@ -77,6 +77,4 @@ def assemble(builtins, project_commands)
  commands
  end
  end
-
- private_constant :CommandRepository
 end

src/dev/runner.rb

@@ -105,10 +105,11 @@ def exit_for(error)
  end
  end
 
- # The composition root: the one place the repository (private to this
- # onion) and the builtin set are constructed. Which builtins exist is
- # config-gated here — runner-setup only with a `runner:` block,
- # provide-image/reset-container only with a build container.
+ # The composition root: the one place the repository (consumed only by
+ # CommandService, the onion rule) and the builtin set are constructed.
+ # Which builtins exist is config-gated here — runner-setup only with a
+ # `runner:` block, provide-image/reset-container only with a build
+ # container.
  #
  # @param manifest [ProjectManifest]
  # @return [CommandService]

test/dev/command_executor_test.rb

@@ -15,10 +15,10 @@ class ExecutorFakeBuiltin < Dev::BuiltinCommand
  attr_reader :calls
 
  def initialize(stamps: false, &body)
+ super()
  @stamps = stamps
  @calls = []
  @body = body
- super()
  end
 
  def desc = "a builtin"
@@ -51,7 +51,7 @@ def build_context(project_root)
  When "executing"
  executor.execute(builtin, args: ["--verbose"], context: context)
 
- Then "the body received args and context; no child process was involved"
+ Then "the builtin received args and context; no child process was involved"
  builtin.calls == [[["--verbose"], context]]
 
  Cleanup

src/dev/builtins.rb

@@ -2,11 +2,12 @@
 # frozen_string_literal: true
 
 module Dev
- # One class per builtin dev command. Each exposes call(args:, context:)
- # with its collaborators constructor-injected; per-call values stay
- # method-side. The composition root (Runner) decides which builtins exist
- # for a given project (config-gated: runner-setup only with a `runner:`
- # block, provide-image/reset-container only with a build container).
+ # One class per builtin dev command, each subclassing BuiltinCommand —
+ # the sealed Command hierarchy's declared open edge — with its
+ # collaborators constructor-injected; per-call values stay method-side.
+ # The composition root (Runner) decides which builtins exist for a given
+ # project (config-gated: runner-setup only with a `runner:` block,
+ # provide-image/reset-container only with a build container).
  module Builtins; end
 end
 

src/dev/builtins/cache_command.rb

@@ -24,6 +24,7 @@ def initialize(
  cache_gc_factory: ->(lockfile) { Dev::Deps::CacheGc.new(lockfile:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @cache_gc_factory = T.let(cache_gc_factory, CacheGcFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/cd_command.rb

@@ -14,6 +14,7 @@ class CdCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Cd::Accessor).void }
  def initialize(accessor: Dev::Cd::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Cd::Accessor)
  end
 

src/dev/builtins/check_command.rb

@@ -13,6 +13,7 @@ class CheckCommand < BuiltinCommand
 
  sig { params(dependency_service: DependencyService).void }
  def initialize(dependency_service:)
+ super()
  @dependency_service = T.let(dependency_service, DependencyService)
  end
 

src/dev/builtins/clone_command.rb

@@ -14,6 +14,7 @@ class CloneCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Clone::Accessor).void }
  def initialize(accessor: Dev::Clone::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Clone::Accessor)
  end
 

src/dev/builtins/cred_command.rb

@@ -14,6 +14,7 @@ class CredCommand < BuiltinCommand
 
  sig { params(accessor: Dev::CredentialAccessor).void }
  def initialize(accessor: Dev::CredentialAccessor.new)
+ super()
  @accessor = T.let(accessor, Dev::CredentialAccessor)
  end
 

src/dev/builtins/deps_command.rb

@@ -29,6 +29,7 @@ def initialize(
  )
  }
  )
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/install_deps_command.rb

@@ -50,6 +50,7 @@ def initialize(
  gem_skill_linker_factory: ->(project_root) { Dev::Deps::GemSkillLinker.new(project_root:) },
  synchronizer: Dev::Learnings::Synchronizer.for
  )
+ super()
  @installer_factory = T.let(installer_factory, InstallerFactory)
  @gem_skill_linker_factory = T.let(gem_skill_linker_factory, GemSkillLinkerFactory)
  @synchronizer = T.let(synchronizer, T.untyped)

src/dev/builtins/learnings_command.rb

@@ -20,6 +20,7 @@ class LearningsCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Learnings::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/plan_command.rb

@@ -20,6 +20,7 @@ class PlanCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Plan::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/runner_setup_command.rb

@@ -36,6 +36,7 @@ def initialize(
  runner_setup_factory: ->(config, repo, org) { Dev::RunnerSetup.new(config:, repo:, org:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @runner_setup_factory = T.let(runner_setup_factory, RunnerSetupFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/up_command.rb

@@ -23,6 +23,7 @@ class UpCommand < BuiltinCommand
  ).void
  end
  def initialize(install_deps_command:, hook_installer: Dev::Cd::HookInstaller.new)
+ super()
  @install_deps_command = T.let(install_deps_command, InstallDepsCommand)
  @hook_installer = T.let(hook_installer, Dev::Cd::HookInstaller)
  end

src/dev/command.rb

@@ -4,20 +4,31 @@
 require_relative "execution_context"
 
 module Dev
- # Sealed command data hierarchy. A command is one of exactly three shapes:
+ # Sealed command hierarchy. A command is one of exactly three shapes:
  #
- # - BuiltinCommand: a Ruby body dev ships (abstract here; concretes live
- # under src/dev/builtins/)
+ # - BuiltinCommand: a Ruby body dev ships (an abstract class, the
+ # hierarchy's one declared open edge; subclasses live under
+ # src/dev/builtins/)
  # - ProjectCommand: pure data parsed from a dev.yml `commands:` entry
  # - OverriddenCommand: a project command occupying a builtin's slot (the
  # builtin runs first, like a hardcoded super())
  #
- # Sealing makes any other nesting unrepresentable: CommandExecutor
- # dispatches exhaustively over these three variants (case + T.absurd).
- # Sorbet requires the direct subclasses of a sealed class beside it, which
- # is why the whole hierarchy shares this file; BuiltinCommand is abstract
- # but deliberately NOT sealed, so its concretes get their own files.
- class Command
+ # Sealing makes a fourth variant unrepresentable: CommandExecutor
+ # dispatches exhaustively over these three (case + T.absurd), and Sorbet
+ # requires a sealed module's direct heirs beside it, which is why the
+ # hierarchy shares this file.
+ #
+ # Command is a module rather than a class deliberately. A sealed class's
+ # runtime `inherited` hook rides down the singleton chain to every
+ # descendant, so builtins subclassing an abstract BuiltinCommand class
+ # raise at definition time unless sorbet-runtime internals are faked open
+ # (the ivar pokes this file used to carry). A sealed module's `included`
+ # hook fires only for its direct includers — the three heirs below —
+ # because `include` never transfers singleton methods, so subclassing
+ # BuiltinCommand is an honest open edge with nothing to suppress. Descent
+ # is closed everywhere it is not explicitly declared: the two data leaves
+ # are final!.
+ module Command
  extend T::Sig
  extend T::Helpers
  abstract!
@@ -46,77 +57,80 @@ def staleness_exempt? = false
  def stamps? = false
  end
 
- # Built-in command that executes Ruby code. Concretes live under
- # src/dev/builtins/, one class per builtin, with collaborators injected
- # through their constructors; per-call values arrive through #call.
- class BuiltinCommand < Command
+ # Built-in command that executes Ruby code: the hierarchy's declared open
+ # edge. Subclasses live under src/dev/builtins/, one class per builtin,
+ # with collaborators injected through their constructors; per-call values
+ # arrive through #call. Test fakes subclass it the same way.
+ #
+ # A class rather than a module because Sorbet flattens module mixins:
+ # were this a module, every includer would gain sealed Command as a
+ # direct mixin in the symbol table and fail the same-file check
+ # statically. A superclass edge is not flattened, so subclasses inherit
+ # Command's membership without re-including it — legal statically, and
+ # invisible to the seal's runtime hooks.
+ class BuiltinCommand
  extend T::Sig
  extend T::Helpers
+ include Command
  abstract!
 
  sig { abstract.params(args: T::Array[String], context: ExecutionContext).void }
  def call(args:, context:); end
  end
 
- # Statically, `sealed!` binds only Command's direct subclasses, so
- # BuiltinCommand concretes may live in their own files — but sorbet-runtime's
- # inherited hook also rides down to BuiltinCommand's subclasses and would
- # reject them for lacking a sealed declaration. Registering an empty
- # decl-file prefix marks BuiltinCommand as the hierarchy's deliberately open
- # edge: the hook accepts subclasses from any file (src/dev/builtins/, test
- # fakes), matching the static rule.
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_decl_file, "")
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_all_subclasses, [])
-
  # Project command from a dev.yml `commands:` entry. Pure data: the run
  # string, optional description, repl flag, and container opt-out. When
  # build.container is declared, commands run inside the container by
  # default unless container: false.
- class ProjectCommand < Command
+ class ProjectCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(String) }
+ sig(:final) { returns(String) }
  attr_reader :run
 
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  attr_reader :desc
 
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :repl
 
  # Whether this command should run inside the build container (when one is
  # configured). Defaults to true; set to false via `container: false` in dev.yml.
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :container
 
- sig do
+ sig(:final) do
  params(run: String, desc: String, repl: T::Boolean, container: T::Boolean, hidden: T::Boolean).void
  end
  def initialize(run:, desc: "(no description)", repl: false, container: true, hidden: false)
+ super()
  @run = T.let(run, String)
  @desc = T.let(desc, String)
  @repl = T.let(repl, T::Boolean)
  @container = T.let(container, T::Boolean)
  @hidden = T.let(hidden, T::Boolean)
  end
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @hidden
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def ==(other)
  return false unless other.is_a?(ProjectCommand)
 
  @run == other.run && @desc == other.desc && @repl == other.repl &&
  @container == other.container && @hidden == other.hidden?
  end
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def eql?(other)
  self == other
  end
 
- sig { returns(Integer) }
+ sig(:final) { returns(Integer) }
  def hash
  [@run, @desc, @repl, @container, @hidden].hash
  end
@@ -126,36 +140,40 @@ def hash
  # dispatch: the override owns the slot, and its implementation calls
  # super() at the top — CommandExecutor runs the builtin body first, then
  # the project command.
- class OverriddenCommand < Command
+ class OverriddenCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(BuiltinCommand) }
+ sig(:final) { returns(BuiltinCommand) }
  attr_reader :builtin
 
- sig { returns(ProjectCommand) }
+ sig(:final) { returns(ProjectCommand) }
  attr_reader :project
 
- sig { params(builtin: BuiltinCommand, project: ProjectCommand).void }
+ sig(:final) { params(builtin: BuiltinCommand, project: ProjectCommand).void }
  def initialize(builtin:, project:)
+ super()
  @builtin = T.let(builtin, BuiltinCommand)
  @project = T.let(project, ProjectCommand)
  end
 
  # The override owns the slot, so its description wins — a project `up:`
  # shows its own desc in usage, not the generic builtin one.
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  def desc = @project.desc
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @project.hidden?
 
  # Guard and stamp traits belong to the slot, not the override: a project
  # `up:` still is the provisioning command, so it inherits the builtin's
  # exemption and stamping behavior.
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def staleness_exempt? = @builtin.staleness_exempt?
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def stamps? = @builtin.stamps?
  end
 end

src/dev/command_repository.rb

@@ -10,8 +10,8 @@ module Dev
  # builtin's slot — their OverriddenCommand composition. Data in, never a
  # path, never a parse.
  #
- # Onion rule: CommandService is the only production consumer; the constant
- # is private and construction is confined to the composition root.
+ # Onion rule: CommandService is the only production consumer, and
+ # construction is confined to the composition root.
  class CommandRepository
  extend T::Sig
 
@@ -77,6 +77,4 @@ def assemble(builtins, project_commands)
  commands
  end
  end
-
- private_constant :CommandRepository
 end

src/dev/runner.rb

@@ -105,10 +105,11 @@ def exit_for(error)
  end
  end
 
- # The composition root: the one place the repository (private to this
- # onion) and the builtin set are constructed. Which builtins exist is
- # config-gated here — runner-setup only with a `runner:` block,
- # provide-image/reset-container only with a build container.
+ # The composition root: the one place the repository (consumed only by
+ # CommandService, the onion rule) and the builtin set are constructed.
+ # Which builtins exist is config-gated here — runner-setup only with a
+ # `runner:` block, provide-image/reset-container only with a build
+ # container.
  #
  # @param manifest [ProjectManifest]
  # @return [CommandService]

test/dev/command_executor_test.rb

@@ -15,10 +15,10 @@ class ExecutorFakeBuiltin < Dev::BuiltinCommand
  attr_reader :calls
 
  def initialize(stamps: false, &body)
+ super()
  @stamps = stamps
  @calls = []
  @body = body
- super()
  end
 
  def desc = "a builtin"
@@ -51,7 +51,7 @@ def build_context(project_root)
  When "executing"
  executor.execute(builtin, args: ["--verbose"], context: context)
 
- Then "the body received args and context; no child process was involved"
+ Then "the builtin received args and context; no child process was involved"
  builtin.calls == [[["--verbose"], context]]
 
  Cleanup

src/dev/builtins.rb

@@ -2,11 +2,12 @@
 # frozen_string_literal: true
 
 module Dev
- # One class per builtin dev command. Each exposes call(args:, context:)
- # with its collaborators constructor-injected; per-call values stay
- # method-side. The composition root (Runner) decides which builtins exist
- # for a given project (config-gated: runner-setup only with a `runner:`
- # block, provide-image/reset-container only with a build container).
+ # One class per builtin dev command, each subclassing BuiltinCommand —
+ # the sealed Command hierarchy's declared open edge — with its
+ # collaborators constructor-injected; per-call values stay method-side.
+ # The composition root (Runner) decides which builtins exist for a given
+ # project (config-gated: runner-setup only with a `runner:` block,
+ # provide-image/reset-container only with a build container).
  module Builtins; end
 end
 

src/dev/builtins/cache_command.rb

@@ -24,6 +24,7 @@ def initialize(
  cache_gc_factory: ->(lockfile) { Dev::Deps::CacheGc.new(lockfile:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @cache_gc_factory = T.let(cache_gc_factory, CacheGcFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/cd_command.rb

@@ -14,6 +14,7 @@ class CdCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Cd::Accessor).void }
  def initialize(accessor: Dev::Cd::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Cd::Accessor)
  end
 

src/dev/builtins/check_command.rb

@@ -13,6 +13,7 @@ class CheckCommand < BuiltinCommand
 
  sig { params(dependency_service: DependencyService).void }
  def initialize(dependency_service:)
+ super()
  @dependency_service = T.let(dependency_service, DependencyService)
  end
 

src/dev/builtins/clone_command.rb

@@ -14,6 +14,7 @@ class CloneCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Clone::Accessor).void }
  def initialize(accessor: Dev::Clone::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Clone::Accessor)
  end
 

src/dev/builtins/cred_command.rb

@@ -14,6 +14,7 @@ class CredCommand < BuiltinCommand
 
  sig { params(accessor: Dev::CredentialAccessor).void }
  def initialize(accessor: Dev::CredentialAccessor.new)
+ super()
  @accessor = T.let(accessor, Dev::CredentialAccessor)
  end
 

src/dev/builtins/deps_command.rb

@@ -29,6 +29,7 @@ def initialize(
  )
  }
  )
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/install_deps_command.rb

@@ -50,6 +50,7 @@ def initialize(
  gem_skill_linker_factory: ->(project_root) { Dev::Deps::GemSkillLinker.new(project_root:) },
  synchronizer: Dev::Learnings::Synchronizer.for
  )
+ super()
  @installer_factory = T.let(installer_factory, InstallerFactory)
  @gem_skill_linker_factory = T.let(gem_skill_linker_factory, GemSkillLinkerFactory)
  @synchronizer = T.let(synchronizer, T.untyped)

src/dev/builtins/learnings_command.rb

@@ -20,6 +20,7 @@ class LearningsCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Learnings::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/plan_command.rb

@@ -20,6 +20,7 @@ class PlanCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Plan::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/runner_setup_command.rb

@@ -36,6 +36,7 @@ def initialize(
  runner_setup_factory: ->(config, repo, org) { Dev::RunnerSetup.new(config:, repo:, org:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @runner_setup_factory = T.let(runner_setup_factory, RunnerSetupFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/up_command.rb

@@ -23,6 +23,7 @@ class UpCommand < BuiltinCommand
  ).void
  end
  def initialize(install_deps_command:, hook_installer: Dev::Cd::HookInstaller.new)
+ super()
  @install_deps_command = T.let(install_deps_command, InstallDepsCommand)
  @hook_installer = T.let(hook_installer, Dev::Cd::HookInstaller)
  end

src/dev/command.rb

@@ -4,20 +4,31 @@
 require_relative "execution_context"
 
 module Dev
- # Sealed command data hierarchy. A command is one of exactly three shapes:
+ # Sealed command hierarchy. A command is one of exactly three shapes:
  #
- # - BuiltinCommand: a Ruby body dev ships (abstract here; concretes live
- # under src/dev/builtins/)
+ # - BuiltinCommand: a Ruby body dev ships (an abstract class, the
+ # hierarchy's one declared open edge; subclasses live under
+ # src/dev/builtins/)
  # - ProjectCommand: pure data parsed from a dev.yml `commands:` entry
  # - OverriddenCommand: a project command occupying a builtin's slot (the
  # builtin runs first, like a hardcoded super())
  #
- # Sealing makes any other nesting unrepresentable: CommandExecutor
- # dispatches exhaustively over these three variants (case + T.absurd).
- # Sorbet requires the direct subclasses of a sealed class beside it, which
- # is why the whole hierarchy shares this file; BuiltinCommand is abstract
- # but deliberately NOT sealed, so its concretes get their own files.
- class Command
+ # Sealing makes a fourth variant unrepresentable: CommandExecutor
+ # dispatches exhaustively over these three (case + T.absurd), and Sorbet
+ # requires a sealed module's direct heirs beside it, which is why the
+ # hierarchy shares this file.
+ #
+ # Command is a module rather than a class deliberately. A sealed class's
+ # runtime `inherited` hook rides down the singleton chain to every
+ # descendant, so builtins subclassing an abstract BuiltinCommand class
+ # raise at definition time unless sorbet-runtime internals are faked open
+ # (the ivar pokes this file used to carry). A sealed module's `included`
+ # hook fires only for its direct includers — the three heirs below —
+ # because `include` never transfers singleton methods, so subclassing
+ # BuiltinCommand is an honest open edge with nothing to suppress. Descent
+ # is closed everywhere it is not explicitly declared: the two data leaves
+ # are final!.
+ module Command
  extend T::Sig
  extend T::Helpers
  abstract!
@@ -46,77 +57,80 @@ def staleness_exempt? = false
  def stamps? = false
  end
 
- # Built-in command that executes Ruby code. Concretes live under
- # src/dev/builtins/, one class per builtin, with collaborators injected
- # through their constructors; per-call values arrive through #call.
- class BuiltinCommand < Command
+ # Built-in command that executes Ruby code: the hierarchy's declared open
+ # edge. Subclasses live under src/dev/builtins/, one class per builtin,
+ # with collaborators injected through their constructors; per-call values
+ # arrive through #call. Test fakes subclass it the same way.
+ #
+ # A class rather than a module because Sorbet flattens module mixins:
+ # were this a module, every includer would gain sealed Command as a
+ # direct mixin in the symbol table and fail the same-file check
+ # statically. A superclass edge is not flattened, so subclasses inherit
+ # Command's membership without re-including it — legal statically, and
+ # invisible to the seal's runtime hooks.
+ class BuiltinCommand
  extend T::Sig
  extend T::Helpers
+ include Command
  abstract!
 
  sig { abstract.params(args: T::Array[String], context: ExecutionContext).void }
  def call(args:, context:); end
  end
 
- # Statically, `sealed!` binds only Command's direct subclasses, so
- # BuiltinCommand concretes may live in their own files — but sorbet-runtime's
- # inherited hook also rides down to BuiltinCommand's subclasses and would
- # reject them for lacking a sealed declaration. Registering an empty
- # decl-file prefix marks BuiltinCommand as the hierarchy's deliberately open
- # edge: the hook accepts subclasses from any file (src/dev/builtins/, test
- # fakes), matching the static rule.
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_decl_file, "")
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_all_subclasses, [])
-
  # Project command from a dev.yml `commands:` entry. Pure data: the run
  # string, optional description, repl flag, and container opt-out. When
  # build.container is declared, commands run inside the container by
  # default unless container: false.
- class ProjectCommand < Command
+ class ProjectCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(String) }
+ sig(:final) { returns(String) }
  attr_reader :run
 
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  attr_reader :desc
 
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :repl
 
  # Whether this command should run inside the build container (when one is
  # configured). Defaults to true; set to false via `container: false` in dev.yml.
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :container
 
- sig do
+ sig(:final) do
  params(run: String, desc: String, repl: T::Boolean, container: T::Boolean, hidden: T::Boolean).void
  end
  def initialize(run:, desc: "(no description)", repl: false, container: true, hidden: false)
+ super()
  @run = T.let(run, String)
  @desc = T.let(desc, String)
  @repl = T.let(repl, T::Boolean)
  @container = T.let(container, T::Boolean)
  @hidden = T.let(hidden, T::Boolean)
  end
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @hidden
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def ==(other)
  return false unless other.is_a?(ProjectCommand)
 
  @run == other.run && @desc == other.desc && @repl == other.repl &&
  @container == other.container && @hidden == other.hidden?
  end
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def eql?(other)
  self == other
  end
 
- sig { returns(Integer) }
+ sig(:final) { returns(Integer) }
  def hash
  [@run, @desc, @repl, @container, @hidden].hash
  end
@@ -126,36 +140,40 @@ def hash
  # dispatch: the override owns the slot, and its implementation calls
  # super() at the top — CommandExecutor runs the builtin body first, then
  # the project command.
- class OverriddenCommand < Command
+ class OverriddenCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(BuiltinCommand) }
+ sig(:final) { returns(BuiltinCommand) }
  attr_reader :builtin
 
- sig { returns(ProjectCommand) }
+ sig(:final) { returns(ProjectCommand) }
  attr_reader :project
 
- sig { params(builtin: BuiltinCommand, project: ProjectCommand).void }
+ sig(:final) { params(builtin: BuiltinCommand, project: ProjectCommand).void }
  def initialize(builtin:, project:)
+ super()
  @builtin = T.let(builtin, BuiltinCommand)
  @project = T.let(project, ProjectCommand)
  end
 
  # The override owns the slot, so its description wins — a project `up:`
  # shows its own desc in usage, not the generic builtin one.
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  def desc = @project.desc
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @project.hidden?
 
  # Guard and stamp traits belong to the slot, not the override: a project
  # `up:` still is the provisioning command, so it inherits the builtin's
  # exemption and stamping behavior.
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def staleness_exempt? = @builtin.staleness_exempt?
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def stamps? = @builtin.stamps?
  end
 end

src/dev/command_repository.rb

@@ -10,8 +10,8 @@ module Dev
  # builtin's slot — their OverriddenCommand composition. Data in, never a
  # path, never a parse.
  #
- # Onion rule: CommandService is the only production consumer; the constant
- # is private and construction is confined to the composition root.
+ # Onion rule: CommandService is the only production consumer, and
+ # construction is confined to the composition root.
  class CommandRepository
  extend T::Sig
 
@@ -77,6 +77,4 @@ def assemble(builtins, project_commands)
  commands
  end
  end
-
- private_constant :CommandRepository
 end

src/dev/runner.rb

@@ -105,10 +105,11 @@ def exit_for(error)
  end
  end
 
- # The composition root: the one place the repository (private to this
- # onion) and the builtin set are constructed. Which builtins exist is
- # config-gated here — runner-setup only with a `runner:` block,
- # provide-image/reset-container only with a build container.
+ # The composition root: the one place the repository (consumed only by
+ # CommandService, the onion rule) and the builtin set are constructed.
+ # Which builtins exist is config-gated here — runner-setup only with a
+ # `runner:` block, provide-image/reset-container only with a build
+ # container.
  #
  # @param manifest [ProjectManifest]
  # @return [CommandService]

test/dev/command_executor_test.rb

@@ -15,10 +15,10 @@ class ExecutorFakeBuiltin < Dev::BuiltinCommand
  attr_reader :calls
 
  def initialize(stamps: false, &body)
+ super()
  @stamps = stamps
  @calls = []
  @body = body
- super()
  end
 
  def desc = "a builtin"
@@ -51,7 +51,7 @@ def build_context(project_root)
  When "executing"
  executor.execute(builtin, args: ["--verbose"], context: context)
 
- Then "the body received args and context; no child process was involved"
+ Then "the builtin received args and context; no child process was involved"
  builtin.calls == [[["--verbose"], context]]
 
  Cleanup

src/dev/builtins.rb

@@ -2,11 +2,12 @@
 # frozen_string_literal: true
 
 module Dev
- # One class per builtin dev command. Each exposes call(args:, context:)
- # with its collaborators constructor-injected; per-call values stay
- # method-side. The composition root (Runner) decides which builtins exist
- # for a given project (config-gated: runner-setup only with a `runner:`
- # block, provide-image/reset-container only with a build container).
+ # One class per builtin dev command, each subclassing BuiltinCommand —
+ # the sealed Command hierarchy's declared open edge — with its
+ # collaborators constructor-injected; per-call values stay method-side.
+ # The composition root (Runner) decides which builtins exist for a given
+ # project (config-gated: runner-setup only with a `runner:` block,
+ # provide-image/reset-container only with a build container).
  module Builtins; end
 end
 

src/dev/builtins/cache_command.rb

@@ -24,6 +24,7 @@ def initialize(
  cache_gc_factory: ->(lockfile) { Dev::Deps::CacheGc.new(lockfile:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @cache_gc_factory = T.let(cache_gc_factory, CacheGcFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/cd_command.rb

@@ -14,6 +14,7 @@ class CdCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Cd::Accessor).void }
  def initialize(accessor: Dev::Cd::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Cd::Accessor)
  end
 

src/dev/builtins/check_command.rb

@@ -13,6 +13,7 @@ class CheckCommand < BuiltinCommand
 
  sig { params(dependency_service: DependencyService).void }
  def initialize(dependency_service:)
+ super()
  @dependency_service = T.let(dependency_service, DependencyService)
  end
 

src/dev/builtins/clone_command.rb

@@ -14,6 +14,7 @@ class CloneCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Clone::Accessor).void }
  def initialize(accessor: Dev::Clone::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Clone::Accessor)
  end
 

src/dev/builtins/cred_command.rb

@@ -14,6 +14,7 @@ class CredCommand < BuiltinCommand
 
  sig { params(accessor: Dev::CredentialAccessor).void }
  def initialize(accessor: Dev::CredentialAccessor.new)
+ super()
  @accessor = T.let(accessor, Dev::CredentialAccessor)
  end
 

src/dev/builtins/deps_command.rb

@@ -29,6 +29,7 @@ def initialize(
  )
  }
  )
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/install_deps_command.rb

@@ -50,6 +50,7 @@ def initialize(
  gem_skill_linker_factory: ->(project_root) { Dev::Deps::GemSkillLinker.new(project_root:) },
  synchronizer: Dev::Learnings::Synchronizer.for
  )
+ super()
  @installer_factory = T.let(installer_factory, InstallerFactory)
  @gem_skill_linker_factory = T.let(gem_skill_linker_factory, GemSkillLinkerFactory)
  @synchronizer = T.let(synchronizer, T.untyped)

src/dev/builtins/learnings_command.rb

@@ -20,6 +20,7 @@ class LearningsCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Learnings::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/plan_command.rb

@@ -20,6 +20,7 @@ class PlanCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Plan::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/runner_setup_command.rb

@@ -36,6 +36,7 @@ def initialize(
  runner_setup_factory: ->(config, repo, org) { Dev::RunnerSetup.new(config:, repo:, org:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @runner_setup_factory = T.let(runner_setup_factory, RunnerSetupFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/up_command.rb

@@ -23,6 +23,7 @@ class UpCommand < BuiltinCommand
  ).void
  end
  def initialize(install_deps_command:, hook_installer: Dev::Cd::HookInstaller.new)
+ super()
  @install_deps_command = T.let(install_deps_command, InstallDepsCommand)
  @hook_installer = T.let(hook_installer, Dev::Cd::HookInstaller)
  end

src/dev/command.rb

@@ -4,20 +4,31 @@
 require_relative "execution_context"
 
 module Dev
- # Sealed command data hierarchy. A command is one of exactly three shapes:
+ # Sealed command hierarchy. A command is one of exactly three shapes:
  #
- # - BuiltinCommand: a Ruby body dev ships (abstract here; concretes live
- # under src/dev/builtins/)
+ # - BuiltinCommand: a Ruby body dev ships (an abstract class, the
+ # hierarchy's one declared open edge; subclasses live under
+ # src/dev/builtins/)
  # - ProjectCommand: pure data parsed from a dev.yml `commands:` entry
  # - OverriddenCommand: a project command occupying a builtin's slot (the
  # builtin runs first, like a hardcoded super())
  #
- # Sealing makes any other nesting unrepresentable: CommandExecutor
- # dispatches exhaustively over these three variants (case + T.absurd).
- # Sorbet requires the direct subclasses of a sealed class beside it, which
- # is why the whole hierarchy shares this file; BuiltinCommand is abstract
- # but deliberately NOT sealed, so its concretes get their own files.
- class Command
+ # Sealing makes a fourth variant unrepresentable: CommandExecutor
+ # dispatches exhaustively over these three (case + T.absurd), and Sorbet
+ # requires a sealed module's direct heirs beside it, which is why the
+ # hierarchy shares this file.
+ #
+ # Command is a module rather than a class deliberately. A sealed class's
+ # runtime `inherited` hook rides down the singleton chain to every
+ # descendant, so builtins subclassing an abstract BuiltinCommand class
+ # raise at definition time unless sorbet-runtime internals are faked open
+ # (the ivar pokes this file used to carry). A sealed module's `included`
+ # hook fires only for its direct includers — the three heirs below —
+ # because `include` never transfers singleton methods, so subclassing
+ # BuiltinCommand is an honest open edge with nothing to suppress. Descent
+ # is closed everywhere it is not explicitly declared: the two data leaves
+ # are final!.
+ module Command
  extend T::Sig
  extend T::Helpers
  abstract!
@@ -46,77 +57,80 @@ def staleness_exempt? = false
  def stamps? = false
  end
 
- # Built-in command that executes Ruby code. Concretes live under
- # src/dev/builtins/, one class per builtin, with collaborators injected
- # through their constructors; per-call values arrive through #call.
- class BuiltinCommand < Command
+ # Built-in command that executes Ruby code: the hierarchy's declared open
+ # edge. Subclasses live under src/dev/builtins/, one class per builtin,
+ # with collaborators injected through their constructors; per-call values
+ # arrive through #call. Test fakes subclass it the same way.
+ #
+ # A class rather than a module because Sorbet flattens module mixins:
+ # were this a module, every includer would gain sealed Command as a
+ # direct mixin in the symbol table and fail the same-file check
+ # statically. A superclass edge is not flattened, so subclasses inherit
+ # Command's membership without re-including it — legal statically, and
+ # invisible to the seal's runtime hooks.
+ class BuiltinCommand
  extend T::Sig
  extend T::Helpers
+ include Command
  abstract!
 
  sig { abstract.params(args: T::Array[String], context: ExecutionContext).void }
  def call(args:, context:); end
  end
 
- # Statically, `sealed!` binds only Command's direct subclasses, so
- # BuiltinCommand concretes may live in their own files — but sorbet-runtime's
- # inherited hook also rides down to BuiltinCommand's subclasses and would
- # reject them for lacking a sealed declaration. Registering an empty
- # decl-file prefix marks BuiltinCommand as the hierarchy's deliberately open
- # edge: the hook accepts subclasses from any file (src/dev/builtins/, test
- # fakes), matching the static rule.
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_decl_file, "")
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_all_subclasses, [])
-
  # Project command from a dev.yml `commands:` entry. Pure data: the run
  # string, optional description, repl flag, and container opt-out. When
  # build.container is declared, commands run inside the container by
  # default unless container: false.
- class ProjectCommand < Command
+ class ProjectCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(String) }
+ sig(:final) { returns(String) }
  attr_reader :run
 
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  attr_reader :desc
 
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :repl
 
  # Whether this command should run inside the build container (when one is
  # configured). Defaults to true; set to false via `container: false` in dev.yml.
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :container
 
- sig do
+ sig(:final) do
  params(run: String, desc: String, repl: T::Boolean, container: T::Boolean, hidden: T::Boolean).void
  end
  def initialize(run:, desc: "(no description)", repl: false, container: true, hidden: false)
+ super()
  @run = T.let(run, String)
  @desc = T.let(desc, String)
  @repl = T.let(repl, T::Boolean)
  @container = T.let(container, T::Boolean)
  @hidden = T.let(hidden, T::Boolean)
  end
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @hidden
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def ==(other)
  return false unless other.is_a?(ProjectCommand)
 
  @run == other.run && @desc == other.desc && @repl == other.repl &&
  @container == other.container && @hidden == other.hidden?
  end
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def eql?(other)
  self == other
  end
 
- sig { returns(Integer) }
+ sig(:final) { returns(Integer) }
  def hash
  [@run, @desc, @repl, @container, @hidden].hash
  end
@@ -126,36 +140,40 @@ def hash
  # dispatch: the override owns the slot, and its implementation calls
  # super() at the top — CommandExecutor runs the builtin body first, then
  # the project command.
- class OverriddenCommand < Command
+ class OverriddenCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(BuiltinCommand) }
+ sig(:final) { returns(BuiltinCommand) }
  attr_reader :builtin
 
- sig { returns(ProjectCommand) }
+ sig(:final) { returns(ProjectCommand) }
  attr_reader :project
 
- sig { params(builtin: BuiltinCommand, project: ProjectCommand).void }
+ sig(:final) { params(builtin: BuiltinCommand, project: ProjectCommand).void }
  def initialize(builtin:, project:)
+ super()
  @builtin = T.let(builtin, BuiltinCommand)
  @project = T.let(project, ProjectCommand)
  end
 
  # The override owns the slot, so its description wins — a project `up:`
  # shows its own desc in usage, not the generic builtin one.
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  def desc = @project.desc
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @project.hidden?
 
  # Guard and stamp traits belong to the slot, not the override: a project
  # `up:` still is the provisioning command, so it inherits the builtin's
  # exemption and stamping behavior.
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def staleness_exempt? = @builtin.staleness_exempt?
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def stamps? = @builtin.stamps?
  end
 end

src/dev/command_repository.rb

@@ -10,8 +10,8 @@ module Dev
  # builtin's slot — their OverriddenCommand composition. Data in, never a
  # path, never a parse.
  #
- # Onion rule: CommandService is the only production consumer; the constant
- # is private and construction is confined to the composition root.
+ # Onion rule: CommandService is the only production consumer, and
+ # construction is confined to the composition root.
  class CommandRepository
  extend T::Sig
 
@@ -77,6 +77,4 @@ def assemble(builtins, project_commands)
  commands
  end
  end
-
- private_constant :CommandRepository
 end

src/dev/runner.rb

@@ -105,10 +105,11 @@ def exit_for(error)
  end
  end
 
- # The composition root: the one place the repository (private to this
- # onion) and the builtin set are constructed. Which builtins exist is
- # config-gated here — runner-setup only with a `runner:` block,
- # provide-image/reset-container only with a build container.
+ # The composition root: the one place the repository (consumed only by
+ # CommandService, the onion rule) and the builtin set are constructed.
+ # Which builtins exist is config-gated here — runner-setup only with a
+ # `runner:` block, provide-image/reset-container only with a build
+ # container.
  #
  # @param manifest [ProjectManifest]
  # @return [CommandService]

test/dev/command_executor_test.rb

@@ -15,10 +15,10 @@ class ExecutorFakeBuiltin < Dev::BuiltinCommand
  attr_reader :calls
 
  def initialize(stamps: false, &body)
+ super()
  @stamps = stamps
  @calls = []
  @body = body
- super()
  end
 
  def desc = "a builtin"
@@ -51,7 +51,7 @@ def build_context(project_root)
  When "executing"
  executor.execute(builtin, args: ["--verbose"], context: context)
 
- Then "the body received args and context; no child process was involved"
+ Then "the builtin received args and context; no child process was involved"
  builtin.calls == [[["--verbose"], context]]
 
  Cleanup

src/dev/builtins.rb

@@ -2,11 +2,12 @@
 # frozen_string_literal: true
 
 module Dev
- # One class per builtin dev command. Each exposes call(args:, context:)
- # with its collaborators constructor-injected; per-call values stay
- # method-side. The composition root (Runner) decides which builtins exist
- # for a given project (config-gated: runner-setup only with a `runner:`
- # block, provide-image/reset-container only with a build container).
+ # One class per builtin dev command, each subclassing BuiltinCommand —
+ # the sealed Command hierarchy's declared open edge — with its
+ # collaborators constructor-injected; per-call values stay method-side.
+ # The composition root (Runner) decides which builtins exist for a given
+ # project (config-gated: runner-setup only with a `runner:` block,
+ # provide-image/reset-container only with a build container).
  module Builtins; end
 end
 

src/dev/builtins/cache_command.rb

@@ -24,6 +24,7 @@ def initialize(
  cache_gc_factory: ->(lockfile) { Dev::Deps::CacheGc.new(lockfile:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @cache_gc_factory = T.let(cache_gc_factory, CacheGcFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/cd_command.rb

@@ -14,6 +14,7 @@ class CdCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Cd::Accessor).void }
  def initialize(accessor: Dev::Cd::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Cd::Accessor)
  end
 

src/dev/builtins/check_command.rb

@@ -13,6 +13,7 @@ class CheckCommand < BuiltinCommand
 
  sig { params(dependency_service: DependencyService).void }
  def initialize(dependency_service:)
+ super()
  @dependency_service = T.let(dependency_service, DependencyService)
  end
 

src/dev/builtins/clone_command.rb

@@ -14,6 +14,7 @@ class CloneCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Clone::Accessor).void }
  def initialize(accessor: Dev::Clone::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Clone::Accessor)
  end
 

src/dev/builtins/cred_command.rb

@@ -14,6 +14,7 @@ class CredCommand < BuiltinCommand
 
  sig { params(accessor: Dev::CredentialAccessor).void }
  def initialize(accessor: Dev::CredentialAccessor.new)
+ super()
  @accessor = T.let(accessor, Dev::CredentialAccessor)
  end
 

src/dev/builtins/deps_command.rb

@@ -29,6 +29,7 @@ def initialize(
  )
  }
  )
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/install_deps_command.rb

@@ -50,6 +50,7 @@ def initialize(
  gem_skill_linker_factory: ->(project_root) { Dev::Deps::GemSkillLinker.new(project_root:) },
  synchronizer: Dev::Learnings::Synchronizer.for
  )
+ super()
  @installer_factory = T.let(installer_factory, InstallerFactory)
  @gem_skill_linker_factory = T.let(gem_skill_linker_factory, GemSkillLinkerFactory)
  @synchronizer = T.let(synchronizer, T.untyped)

src/dev/builtins/learnings_command.rb

@@ -20,6 +20,7 @@ class LearningsCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Learnings::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/plan_command.rb

@@ -20,6 +20,7 @@ class PlanCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Plan::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/runner_setup_command.rb

@@ -36,6 +36,7 @@ def initialize(
  runner_setup_factory: ->(config, repo, org) { Dev::RunnerSetup.new(config:, repo:, org:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @runner_setup_factory = T.let(runner_setup_factory, RunnerSetupFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/up_command.rb

@@ -23,6 +23,7 @@ class UpCommand < BuiltinCommand
  ).void
  end
  def initialize(install_deps_command:, hook_installer: Dev::Cd::HookInstaller.new)
+ super()
  @install_deps_command = T.let(install_deps_command, InstallDepsCommand)
  @hook_installer = T.let(hook_installer, Dev::Cd::HookInstaller)
  end

src/dev/command.rb

@@ -4,20 +4,31 @@
 require_relative "execution_context"
 
 module Dev
- # Sealed command data hierarchy. A command is one of exactly three shapes:
+ # Sealed command hierarchy. A command is one of exactly three shapes:
  #
- # - BuiltinCommand: a Ruby body dev ships (abstract here; concretes live
- # under src/dev/builtins/)
+ # - BuiltinCommand: a Ruby body dev ships (an abstract class, the
+ # hierarchy's one declared open edge; subclasses live under
+ # src/dev/builtins/)
  # - ProjectCommand: pure data parsed from a dev.yml `commands:` entry
  # - OverriddenCommand: a project command occupying a builtin's slot (the
  # builtin runs first, like a hardcoded super())
  #
- # Sealing makes any other nesting unrepresentable: CommandExecutor
- # dispatches exhaustively over these three variants (case + T.absurd).
- # Sorbet requires the direct subclasses of a sealed class beside it, which
- # is why the whole hierarchy shares this file; BuiltinCommand is abstract
- # but deliberately NOT sealed, so its concretes get their own files.
- class Command
+ # Sealing makes a fourth variant unrepresentable: CommandExecutor
+ # dispatches exhaustively over these three (case + T.absurd), and Sorbet
+ # requires a sealed module's direct heirs beside it, which is why the
+ # hierarchy shares this file.
+ #
+ # Command is a module rather than a class deliberately. A sealed class's
+ # runtime `inherited` hook rides down the singleton chain to every
+ # descendant, so builtins subclassing an abstract BuiltinCommand class
+ # raise at definition time unless sorbet-runtime internals are faked open
+ # (the ivar pokes this file used to carry). A sealed module's `included`
+ # hook fires only for its direct includers — the three heirs below —
+ # because `include` never transfers singleton methods, so subclassing
+ # BuiltinCommand is an honest open edge with nothing to suppress. Descent
+ # is closed everywhere it is not explicitly declared: the two data leaves
+ # are final!.
+ module Command
  extend T::Sig
  extend T::Helpers
  abstract!
@@ -46,77 +57,80 @@ def staleness_exempt? = false
  def stamps? = false
  end
 
- # Built-in command that executes Ruby code. Concretes live under
- # src/dev/builtins/, one class per builtin, with collaborators injected
- # through their constructors; per-call values arrive through #call.
- class BuiltinCommand < Command
+ # Built-in command that executes Ruby code: the hierarchy's declared open
+ # edge. Subclasses live under src/dev/builtins/, one class per builtin,
+ # with collaborators injected through their constructors; per-call values
+ # arrive through #call. Test fakes subclass it the same way.
+ #
+ # A class rather than a module because Sorbet flattens module mixins:
+ # were this a module, every includer would gain sealed Command as a
+ # direct mixin in the symbol table and fail the same-file check
+ # statically. A superclass edge is not flattened, so subclasses inherit
+ # Command's membership without re-including it — legal statically, and
+ # invisible to the seal's runtime hooks.
+ class BuiltinCommand
  extend T::Sig
  extend T::Helpers
+ include Command
  abstract!
 
  sig { abstract.params(args: T::Array[String], context: ExecutionContext).void }
  def call(args:, context:); end
  end
 
- # Statically, `sealed!` binds only Command's direct subclasses, so
- # BuiltinCommand concretes may live in their own files — but sorbet-runtime's
- # inherited hook also rides down to BuiltinCommand's subclasses and would
- # reject them for lacking a sealed declaration. Registering an empty
- # decl-file prefix marks BuiltinCommand as the hierarchy's deliberately open
- # edge: the hook accepts subclasses from any file (src/dev/builtins/, test
- # fakes), matching the static rule.
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_decl_file, "")
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_all_subclasses, [])
-
  # Project command from a dev.yml `commands:` entry. Pure data: the run
  # string, optional description, repl flag, and container opt-out. When
  # build.container is declared, commands run inside the container by
  # default unless container: false.
- class ProjectCommand < Command
+ class ProjectCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(String) }
+ sig(:final) { returns(String) }
  attr_reader :run
 
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  attr_reader :desc
 
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :repl
 
  # Whether this command should run inside the build container (when one is
  # configured). Defaults to true; set to false via `container: false` in dev.yml.
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :container
 
- sig do
+ sig(:final) do
  params(run: String, desc: String, repl: T::Boolean, container: T::Boolean, hidden: T::Boolean).void
  end
  def initialize(run:, desc: "(no description)", repl: false, container: true, hidden: false)
+ super()
  @run = T.let(run, String)
  @desc = T.let(desc, String)
  @repl = T.let(repl, T::Boolean)
  @container = T.let(container, T::Boolean)
  @hidden = T.let(hidden, T::Boolean)
  end
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @hidden
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def ==(other)
  return false unless other.is_a?(ProjectCommand)
 
  @run == other.run && @desc == other.desc && @repl == other.repl &&
  @container == other.container && @hidden == other.hidden?
  end
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def eql?(other)
  self == other
  end
 
- sig { returns(Integer) }
+ sig(:final) { returns(Integer) }
  def hash
  [@run, @desc, @repl, @container, @hidden].hash
  end
@@ -126,36 +140,40 @@ def hash
  # dispatch: the override owns the slot, and its implementation calls
  # super() at the top — CommandExecutor runs the builtin body first, then
  # the project command.
- class OverriddenCommand < Command
+ class OverriddenCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(BuiltinCommand) }
+ sig(:final) { returns(BuiltinCommand) }
  attr_reader :builtin
 
- sig { returns(ProjectCommand) }
+ sig(:final) { returns(ProjectCommand) }
  attr_reader :project
 
- sig { params(builtin: BuiltinCommand, project: ProjectCommand).void }
+ sig(:final) { params(builtin: BuiltinCommand, project: ProjectCommand).void }
  def initialize(builtin:, project:)
+ super()
  @builtin = T.let(builtin, BuiltinCommand)
  @project = T.let(project, ProjectCommand)
  end
 
  # The override owns the slot, so its description wins — a project `up:`
  # shows its own desc in usage, not the generic builtin one.
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  def desc = @project.desc
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @project.hidden?
 
  # Guard and stamp traits belong to the slot, not the override: a project
  # `up:` still is the provisioning command, so it inherits the builtin's
  # exemption and stamping behavior.
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def staleness_exempt? = @builtin.staleness_exempt?
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def stamps? = @builtin.stamps?
  end
 end

src/dev/command_repository.rb

@@ -10,8 +10,8 @@ module Dev
  # builtin's slot — their OverriddenCommand composition. Data in, never a
  # path, never a parse.
  #
- # Onion rule: CommandService is the only production consumer; the constant
- # is private and construction is confined to the composition root.
+ # Onion rule: CommandService is the only production consumer, and
+ # construction is confined to the composition root.
  class CommandRepository
  extend T::Sig
 
@@ -77,6 +77,4 @@ def assemble(builtins, project_commands)
  commands
  end
  end
-
- private_constant :CommandRepository
 end

src/dev/runner.rb

@@ -105,10 +105,11 @@ def exit_for(error)
  end
  end
 
- # The composition root: the one place the repository (private to this
- # onion) and the builtin set are constructed. Which builtins exist is
- # config-gated here — runner-setup only with a `runner:` block,
- # provide-image/reset-container only with a build container.
+ # The composition root: the one place the repository (consumed only by
+ # CommandService, the onion rule) and the builtin set are constructed.
+ # Which builtins exist is config-gated here — runner-setup only with a
+ # `runner:` block, provide-image/reset-container only with a build
+ # container.
  #
  # @param manifest [ProjectManifest]
  # @return [CommandService]

test/dev/command_executor_test.rb

@@ -15,10 +15,10 @@ class ExecutorFakeBuiltin < Dev::BuiltinCommand
  attr_reader :calls
 
  def initialize(stamps: false, &body)
+ super()
  @stamps = stamps
  @calls = []
  @body = body
- super()
  end
 
  def desc = "a builtin"
@@ -51,7 +51,7 @@ def build_context(project_root)
  When "executing"
  executor.execute(builtin, args: ["--verbose"], context: context)
 
- Then "the body received args and context; no child process was involved"
+ Then "the builtin received args and context; no child process was involved"
  builtin.calls == [[["--verbose"], context]]
 
  Cleanup

src/dev/builtins.rb

@@ -2,11 +2,12 @@
 # frozen_string_literal: true
 
 module Dev
- # One class per builtin dev command. Each exposes call(args:, context:)
- # with its collaborators constructor-injected; per-call values stay
- # method-side. The composition root (Runner) decides which builtins exist
- # for a given project (config-gated: runner-setup only with a `runner:`
- # block, provide-image/reset-container only with a build container).
+ # One class per builtin dev command, each subclassing BuiltinCommand —
+ # the sealed Command hierarchy's declared open edge — with its
+ # collaborators constructor-injected; per-call values stay method-side.
+ # The composition root (Runner) decides which builtins exist for a given
+ # project (config-gated: runner-setup only with a `runner:` block,
+ # provide-image/reset-container only with a build container).
  module Builtins; end
 end
 

src/dev/builtins/cache_command.rb

@@ -24,6 +24,7 @@ def initialize(
  cache_gc_factory: ->(lockfile) { Dev::Deps::CacheGc.new(lockfile:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @cache_gc_factory = T.let(cache_gc_factory, CacheGcFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/cd_command.rb

@@ -14,6 +14,7 @@ class CdCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Cd::Accessor).void }
  def initialize(accessor: Dev::Cd::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Cd::Accessor)
  end
 

src/dev/builtins/check_command.rb

@@ -13,6 +13,7 @@ class CheckCommand < BuiltinCommand
 
  sig { params(dependency_service: DependencyService).void }
  def initialize(dependency_service:)
+ super()
  @dependency_service = T.let(dependency_service, DependencyService)
  end
 

src/dev/builtins/clone_command.rb

@@ -14,6 +14,7 @@ class CloneCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Clone::Accessor).void }
  def initialize(accessor: Dev::Clone::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Clone::Accessor)
  end
 

src/dev/builtins/cred_command.rb

@@ -14,6 +14,7 @@ class CredCommand < BuiltinCommand
 
  sig { params(accessor: Dev::CredentialAccessor).void }
  def initialize(accessor: Dev::CredentialAccessor.new)
+ super()
  @accessor = T.let(accessor, Dev::CredentialAccessor)
  end
 

src/dev/builtins/deps_command.rb

@@ -29,6 +29,7 @@ def initialize(
  )
  }
  )
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/install_deps_command.rb

@@ -50,6 +50,7 @@ def initialize(
  gem_skill_linker_factory: ->(project_root) { Dev::Deps::GemSkillLinker.new(project_root:) },
  synchronizer: Dev::Learnings::Synchronizer.for
  )
+ super()
  @installer_factory = T.let(installer_factory, InstallerFactory)
  @gem_skill_linker_factory = T.let(gem_skill_linker_factory, GemSkillLinkerFactory)
  @synchronizer = T.let(synchronizer, T.untyped)

src/dev/builtins/learnings_command.rb

@@ -20,6 +20,7 @@ class LearningsCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Learnings::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/plan_command.rb

@@ -20,6 +20,7 @@ class PlanCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Plan::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/runner_setup_command.rb

@@ -36,6 +36,7 @@ def initialize(
  runner_setup_factory: ->(config, repo, org) { Dev::RunnerSetup.new(config:, repo:, org:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @runner_setup_factory = T.let(runner_setup_factory, RunnerSetupFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/up_command.rb

@@ -23,6 +23,7 @@ class UpCommand < BuiltinCommand
  ).void
  end
  def initialize(install_deps_command:, hook_installer: Dev::Cd::HookInstaller.new)
+ super()
  @install_deps_command = T.let(install_deps_command, InstallDepsCommand)
  @hook_installer = T.let(hook_installer, Dev::Cd::HookInstaller)
  end

src/dev/command.rb

@@ -4,20 +4,31 @@
 require_relative "execution_context"
 
 module Dev
- # Sealed command data hierarchy. A command is one of exactly three shapes:
+ # Sealed command hierarchy. A command is one of exactly three shapes:
  #
- # - BuiltinCommand: a Ruby body dev ships (abstract here; concretes live
- # under src/dev/builtins/)
+ # - BuiltinCommand: a Ruby body dev ships (an abstract class, the
+ # hierarchy's one declared open edge; subclasses live under
+ # src/dev/builtins/)
  # - ProjectCommand: pure data parsed from a dev.yml `commands:` entry
  # - OverriddenCommand: a project command occupying a builtin's slot (the
  # builtin runs first, like a hardcoded super())
  #
- # Sealing makes any other nesting unrepresentable: CommandExecutor
- # dispatches exhaustively over these three variants (case + T.absurd).
- # Sorbet requires the direct subclasses of a sealed class beside it, which
- # is why the whole hierarchy shares this file; BuiltinCommand is abstract
- # but deliberately NOT sealed, so its concretes get their own files.
- class Command
+ # Sealing makes a fourth variant unrepresentable: CommandExecutor
+ # dispatches exhaustively over these three (case + T.absurd), and Sorbet
+ # requires a sealed module's direct heirs beside it, which is why the
+ # hierarchy shares this file.
+ #
+ # Command is a module rather than a class deliberately. A sealed class's
+ # runtime `inherited` hook rides down the singleton chain to every
+ # descendant, so builtins subclassing an abstract BuiltinCommand class
+ # raise at definition time unless sorbet-runtime internals are faked open
+ # (the ivar pokes this file used to carry). A sealed module's `included`
+ # hook fires only for its direct includers — the three heirs below —
+ # because `include` never transfers singleton methods, so subclassing
+ # BuiltinCommand is an honest open edge with nothing to suppress. Descent
+ # is closed everywhere it is not explicitly declared: the two data leaves
+ # are final!.
+ module Command
  extend T::Sig
  extend T::Helpers
  abstract!
@@ -46,77 +57,80 @@ def staleness_exempt? = false
  def stamps? = false
  end
 
- # Built-in command that executes Ruby code. Concretes live under
- # src/dev/builtins/, one class per builtin, with collaborators injected
- # through their constructors; per-call values arrive through #call.
- class BuiltinCommand < Command
+ # Built-in command that executes Ruby code: the hierarchy's declared open
+ # edge. Subclasses live under src/dev/builtins/, one class per builtin,
+ # with collaborators injected through their constructors; per-call values
+ # arrive through #call. Test fakes subclass it the same way.
+ #
+ # A class rather than a module because Sorbet flattens module mixins:
+ # were this a module, every includer would gain sealed Command as a
+ # direct mixin in the symbol table and fail the same-file check
+ # statically. A superclass edge is not flattened, so subclasses inherit
+ # Command's membership without re-including it — legal statically, and
+ # invisible to the seal's runtime hooks.
+ class BuiltinCommand
  extend T::Sig
  extend T::Helpers
+ include Command
  abstract!
 
  sig { abstract.params(args: T::Array[String], context: ExecutionContext).void }
  def call(args:, context:); end
  end
 
- # Statically, `sealed!` binds only Command's direct subclasses, so
- # BuiltinCommand concretes may live in their own files — but sorbet-runtime's
- # inherited hook also rides down to BuiltinCommand's subclasses and would
- # reject them for lacking a sealed declaration. Registering an empty
- # decl-file prefix marks BuiltinCommand as the hierarchy's deliberately open
- # edge: the hook accepts subclasses from any file (src/dev/builtins/, test
- # fakes), matching the static rule.
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_decl_file, "")
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_all_subclasses, [])
-
  # Project command from a dev.yml `commands:` entry. Pure data: the run
  # string, optional description, repl flag, and container opt-out. When
  # build.container is declared, commands run inside the container by
  # default unless container: false.
- class ProjectCommand < Command
+ class ProjectCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(String) }
+ sig(:final) { returns(String) }
  attr_reader :run
 
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  attr_reader :desc
 
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :repl
 
  # Whether this command should run inside the build container (when one is
  # configured). Defaults to true; set to false via `container: false` in dev.yml.
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :container
 
- sig do
+ sig(:final) do
  params(run: String, desc: String, repl: T::Boolean, container: T::Boolean, hidden: T::Boolean).void
  end
  def initialize(run:, desc: "(no description)", repl: false, container: true, hidden: false)
+ super()
  @run = T.let(run, String)
  @desc = T.let(desc, String)
  @repl = T.let(repl, T::Boolean)
  @container = T.let(container, T::Boolean)
  @hidden = T.let(hidden, T::Boolean)
  end
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @hidden
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def ==(other)
  return false unless other.is_a?(ProjectCommand)
 
  @run == other.run && @desc == other.desc && @repl == other.repl &&
  @container == other.container && @hidden == other.hidden?
  end
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def eql?(other)
  self == other
  end
 
- sig { returns(Integer) }
+ sig(:final) { returns(Integer) }
  def hash
  [@run, @desc, @repl, @container, @hidden].hash
  end
@@ -126,36 +140,40 @@ def hash
  # dispatch: the override owns the slot, and its implementation calls
  # super() at the top — CommandExecutor runs the builtin body first, then
  # the project command.
- class OverriddenCommand < Command
+ class OverriddenCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(BuiltinCommand) }
+ sig(:final) { returns(BuiltinCommand) }
  attr_reader :builtin
 
- sig { returns(ProjectCommand) }
+ sig(:final) { returns(ProjectCommand) }
  attr_reader :project
 
- sig { params(builtin: BuiltinCommand, project: ProjectCommand).void }
+ sig(:final) { params(builtin: BuiltinCommand, project: ProjectCommand).void }
  def initialize(builtin:, project:)
+ super()
  @builtin = T.let(builtin, BuiltinCommand)
  @project = T.let(project, ProjectCommand)
  end
 
  # The override owns the slot, so its description wins — a project `up:`
  # shows its own desc in usage, not the generic builtin one.
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  def desc = @project.desc
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @project.hidden?
 
  # Guard and stamp traits belong to the slot, not the override: a project
  # `up:` still is the provisioning command, so it inherits the builtin's
  # exemption and stamping behavior.
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def staleness_exempt? = @builtin.staleness_exempt?
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def stamps? = @builtin.stamps?
  end
 end

src/dev/command_repository.rb

@@ -10,8 +10,8 @@ module Dev
  # builtin's slot — their OverriddenCommand composition. Data in, never a
  # path, never a parse.
  #
- # Onion rule: CommandService is the only production consumer; the constant
- # is private and construction is confined to the composition root.
+ # Onion rule: CommandService is the only production consumer, and
+ # construction is confined to the composition root.
  class CommandRepository
  extend T::Sig
 
@@ -77,6 +77,4 @@ def assemble(builtins, project_commands)
  commands
  end
  end
-
- private_constant :CommandRepository
 end

src/dev/runner.rb

@@ -105,10 +105,11 @@ def exit_for(error)
  end
  end
 
- # The composition root: the one place the repository (private to this
- # onion) and the builtin set are constructed. Which builtins exist is
- # config-gated here — runner-setup only with a `runner:` block,
- # provide-image/reset-container only with a build container.
+ # The composition root: the one place the repository (consumed only by
+ # CommandService, the onion rule) and the builtin set are constructed.
+ # Which builtins exist is config-gated here — runner-setup only with a
+ # `runner:` block, provide-image/reset-container only with a build
+ # container.
  #
  # @param manifest [ProjectManifest]
  # @return [CommandService]

test/dev/command_executor_test.rb

@@ -15,10 +15,10 @@ class ExecutorFakeBuiltin < Dev::BuiltinCommand
  attr_reader :calls
 
  def initialize(stamps: false, &body)
+ super()
  @stamps = stamps
  @calls = []
  @body = body
- super()
  end
 
  def desc = "a builtin"
@@ -51,7 +51,7 @@ def build_context(project_root)
  When "executing"
  executor.execute(builtin, args: ["--verbose"], context: context)
 
- Then "the body received args and context; no child process was involved"
+ Then "the builtin received args and context; no child process was involved"
  builtin.calls == [[["--verbose"], context]]
 
  Cleanup

src/dev/builtins.rb

@@ -2,11 +2,12 @@
 # frozen_string_literal: true
 
 module Dev
- # One class per builtin dev command. Each exposes call(args:, context:)
- # with its collaborators constructor-injected; per-call values stay
- # method-side. The composition root (Runner) decides which builtins exist
- # for a given project (config-gated: runner-setup only with a `runner:`
- # block, provide-image/reset-container only with a build container).
+ # One class per builtin dev command, each subclassing BuiltinCommand —
+ # the sealed Command hierarchy's declared open edge — with its
+ # collaborators constructor-injected; per-call values stay method-side.
+ # The composition root (Runner) decides which builtins exist for a given
+ # project (config-gated: runner-setup only with a `runner:` block,
+ # provide-image/reset-container only with a build container).
  module Builtins; end
 end
 

src/dev/builtins/cache_command.rb

@@ -24,6 +24,7 @@ def initialize(
  cache_gc_factory: ->(lockfile) { Dev::Deps::CacheGc.new(lockfile:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @cache_gc_factory = T.let(cache_gc_factory, CacheGcFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/cd_command.rb

@@ -14,6 +14,7 @@ class CdCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Cd::Accessor).void }
  def initialize(accessor: Dev::Cd::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Cd::Accessor)
  end
 

src/dev/builtins/check_command.rb

@@ -13,6 +13,7 @@ class CheckCommand < BuiltinCommand
 
  sig { params(dependency_service: DependencyService).void }
  def initialize(dependency_service:)
+ super()
  @dependency_service = T.let(dependency_service, DependencyService)
  end
 

src/dev/builtins/clone_command.rb

@@ -14,6 +14,7 @@ class CloneCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Clone::Accessor).void }
  def initialize(accessor: Dev::Clone::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Clone::Accessor)
  end
 

src/dev/builtins/cred_command.rb

@@ -14,6 +14,7 @@ class CredCommand < BuiltinCommand
 
  sig { params(accessor: Dev::CredentialAccessor).void }
  def initialize(accessor: Dev::CredentialAccessor.new)
+ super()
  @accessor = T.let(accessor, Dev::CredentialAccessor)
  end
 

src/dev/builtins/deps_command.rb

@@ -29,6 +29,7 @@ def initialize(
  )
  }
  )
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/install_deps_command.rb

@@ -50,6 +50,7 @@ def initialize(
  gem_skill_linker_factory: ->(project_root) { Dev::Deps::GemSkillLinker.new(project_root:) },
  synchronizer: Dev::Learnings::Synchronizer.for
  )
+ super()
  @installer_factory = T.let(installer_factory, InstallerFactory)
  @gem_skill_linker_factory = T.let(gem_skill_linker_factory, GemSkillLinkerFactory)
  @synchronizer = T.let(synchronizer, T.untyped)

src/dev/builtins/learnings_command.rb

@@ -20,6 +20,7 @@ class LearningsCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Learnings::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/plan_command.rb

@@ -20,6 +20,7 @@ class PlanCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Plan::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/runner_setup_command.rb

@@ -36,6 +36,7 @@ def initialize(
  runner_setup_factory: ->(config, repo, org) { Dev::RunnerSetup.new(config:, repo:, org:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @runner_setup_factory = T.let(runner_setup_factory, RunnerSetupFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/up_command.rb

@@ -23,6 +23,7 @@ class UpCommand < BuiltinCommand
  ).void
  end
  def initialize(install_deps_command:, hook_installer: Dev::Cd::HookInstaller.new)
+ super()
  @install_deps_command = T.let(install_deps_command, InstallDepsCommand)
  @hook_installer = T.let(hook_installer, Dev::Cd::HookInstaller)
  end

src/dev/command.rb

@@ -4,20 +4,31 @@
 require_relative "execution_context"
 
 module Dev
- # Sealed command data hierarchy. A command is one of exactly three shapes:
+ # Sealed command hierarchy. A command is one of exactly three shapes:
  #
- # - BuiltinCommand: a Ruby body dev ships (abstract here; concretes live
- # under src/dev/builtins/)
+ # - BuiltinCommand: a Ruby body dev ships (an abstract class, the
+ # hierarchy's one declared open edge; subclasses live under
+ # src/dev/builtins/)
  # - ProjectCommand: pure data parsed from a dev.yml `commands:` entry
  # - OverriddenCommand: a project command occupying a builtin's slot (the
  # builtin runs first, like a hardcoded super())
  #
- # Sealing makes any other nesting unrepresentable: CommandExecutor
- # dispatches exhaustively over these three variants (case + T.absurd).
- # Sorbet requires the direct subclasses of a sealed class beside it, which
- # is why the whole hierarchy shares this file; BuiltinCommand is abstract
- # but deliberately NOT sealed, so its concretes get their own files.
- class Command
+ # Sealing makes a fourth variant unrepresentable: CommandExecutor
+ # dispatches exhaustively over these three (case + T.absurd), and Sorbet
+ # requires a sealed module's direct heirs beside it, which is why the
+ # hierarchy shares this file.
+ #
+ # Command is a module rather than a class deliberately. A sealed class's
+ # runtime `inherited` hook rides down the singleton chain to every
+ # descendant, so builtins subclassing an abstract BuiltinCommand class
+ # raise at definition time unless sorbet-runtime internals are faked open
+ # (the ivar pokes this file used to carry). A sealed module's `included`
+ # hook fires only for its direct includers — the three heirs below —
+ # because `include` never transfers singleton methods, so subclassing
+ # BuiltinCommand is an honest open edge with nothing to suppress. Descent
+ # is closed everywhere it is not explicitly declared: the two data leaves
+ # are final!.
+ module Command
  extend T::Sig
  extend T::Helpers
  abstract!
@@ -46,77 +57,80 @@ def staleness_exempt? = false
  def stamps? = false
  end
 
- # Built-in command that executes Ruby code. Concretes live under
- # src/dev/builtins/, one class per builtin, with collaborators injected
- # through their constructors; per-call values arrive through #call.
- class BuiltinCommand < Command
+ # Built-in command that executes Ruby code: the hierarchy's declared open
+ # edge. Subclasses live under src/dev/builtins/, one class per builtin,
+ # with collaborators injected through their constructors; per-call values
+ # arrive through #call. Test fakes subclass it the same way.
+ #
+ # A class rather than a module because Sorbet flattens module mixins:
+ # were this a module, every includer would gain sealed Command as a
+ # direct mixin in the symbol table and fail the same-file check
+ # statically. A superclass edge is not flattened, so subclasses inherit
+ # Command's membership without re-including it — legal statically, and
+ # invisible to the seal's runtime hooks.
+ class BuiltinCommand
  extend T::Sig
  extend T::Helpers
+ include Command
  abstract!
 
  sig { abstract.params(args: T::Array[String], context: ExecutionContext).void }
  def call(args:, context:); end
  end
 
- # Statically, `sealed!` binds only Command's direct subclasses, so
- # BuiltinCommand concretes may live in their own files — but sorbet-runtime's
- # inherited hook also rides down to BuiltinCommand's subclasses and would
- # reject them for lacking a sealed declaration. Registering an empty
- # decl-file prefix marks BuiltinCommand as the hierarchy's deliberately open
- # edge: the hook accepts subclasses from any file (src/dev/builtins/, test
- # fakes), matching the static rule.
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_decl_file, "")
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_all_subclasses, [])
-
  # Project command from a dev.yml `commands:` entry. Pure data: the run
  # string, optional description, repl flag, and container opt-out. When
  # build.container is declared, commands run inside the container by
  # default unless container: false.
- class ProjectCommand < Command
+ class ProjectCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(String) }
+ sig(:final) { returns(String) }
  attr_reader :run
 
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  attr_reader :desc
 
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :repl
 
  # Whether this command should run inside the build container (when one is
  # configured). Defaults to true; set to false via `container: false` in dev.yml.
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :container
 
- sig do
+ sig(:final) do
  params(run: String, desc: String, repl: T::Boolean, container: T::Boolean, hidden: T::Boolean).void
  end
  def initialize(run:, desc: "(no description)", repl: false, container: true, hidden: false)
+ super()
  @run = T.let(run, String)
  @desc = T.let(desc, String)
  @repl = T.let(repl, T::Boolean)
  @container = T.let(container, T::Boolean)
  @hidden = T.let(hidden, T::Boolean)
  end
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @hidden
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def ==(other)
  return false unless other.is_a?(ProjectCommand)
 
  @run == other.run && @desc == other.desc && @repl == other.repl &&
  @container == other.container && @hidden == other.hidden?
  end
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def eql?(other)
  self == other
  end
 
- sig { returns(Integer) }
+ sig(:final) { returns(Integer) }
  def hash
  [@run, @desc, @repl, @container, @hidden].hash
  end
@@ -126,36 +140,40 @@ def hash
  # dispatch: the override owns the slot, and its implementation calls
  # super() at the top — CommandExecutor runs the builtin body first, then
  # the project command.
- class OverriddenCommand < Command
+ class OverriddenCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(BuiltinCommand) }
+ sig(:final) { returns(BuiltinCommand) }
  attr_reader :builtin
 
- sig { returns(ProjectCommand) }
+ sig(:final) { returns(ProjectCommand) }
  attr_reader :project
 
- sig { params(builtin: BuiltinCommand, project: ProjectCommand).void }
+ sig(:final) { params(builtin: BuiltinCommand, project: ProjectCommand).void }
  def initialize(builtin:, project:)
+ super()
  @builtin = T.let(builtin, BuiltinCommand)
  @project = T.let(project, ProjectCommand)
  end
 
  # The override owns the slot, so its description wins — a project `up:`
  # shows its own desc in usage, not the generic builtin one.
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  def desc = @project.desc
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @project.hidden?
 
  # Guard and stamp traits belong to the slot, not the override: a project
  # `up:` still is the provisioning command, so it inherits the builtin's
  # exemption and stamping behavior.
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def staleness_exempt? = @builtin.staleness_exempt?
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def stamps? = @builtin.stamps?
  end
 end

src/dev/command_repository.rb

@@ -10,8 +10,8 @@ module Dev
  # builtin's slot — their OverriddenCommand composition. Data in, never a
  # path, never a parse.
  #
- # Onion rule: CommandService is the only production consumer; the constant
- # is private and construction is confined to the composition root.
+ # Onion rule: CommandService is the only production consumer, and
+ # construction is confined to the composition root.
  class CommandRepository
  extend T::Sig
 
@@ -77,6 +77,4 @@ def assemble(builtins, project_commands)
  commands
  end
  end
-
- private_constant :CommandRepository
 end

src/dev/runner.rb

@@ -105,10 +105,11 @@ def exit_for(error)
  end
  end
 
- # The composition root: the one place the repository (private to this
- # onion) and the builtin set are constructed. Which builtins exist is
- # config-gated here — runner-setup only with a `runner:` block,
- # provide-image/reset-container only with a build container.
+ # The composition root: the one place the repository (consumed only by
+ # CommandService, the onion rule) and the builtin set are constructed.
+ # Which builtins exist is config-gated here — runner-setup only with a
+ # `runner:` block, provide-image/reset-container only with a build
+ # container.
  #
  # @param manifest [ProjectManifest]
  # @return [CommandService]

test/dev/command_executor_test.rb

@@ -15,10 +15,10 @@ class ExecutorFakeBuiltin < Dev::BuiltinCommand
  attr_reader :calls
 
  def initialize(stamps: false, &body)
+ super()
  @stamps = stamps
  @calls = []
  @body = body
- super()
  end
 
  def desc = "a builtin"
@@ -51,7 +51,7 @@ def build_context(project_root)
  When "executing"
  executor.execute(builtin, args: ["--verbose"], context: context)
 
- Then "the body received args and context; no child process was involved"
+ Then "the builtin received args and context; no child process was involved"
  builtin.calls == [[["--verbose"], context]]
 
  Cleanup

src/dev/builtins.rb

@@ -2,11 +2,12 @@
 # frozen_string_literal: true
 
 module Dev
- # One class per builtin dev command. Each exposes call(args:, context:)
- # with its collaborators constructor-injected; per-call values stay
- # method-side. The composition root (Runner) decides which builtins exist
- # for a given project (config-gated: runner-setup only with a `runner:`
- # block, provide-image/reset-container only with a build container).
+ # One class per builtin dev command, each subclassing BuiltinCommand —
+ # the sealed Command hierarchy's declared open edge — with its
+ # collaborators constructor-injected; per-call values stay method-side.
+ # The composition root (Runner) decides which builtins exist for a given
+ # project (config-gated: runner-setup only with a `runner:` block,
+ # provide-image/reset-container only with a build container).
  module Builtins; end
 end
 

src/dev/builtins/cache_command.rb

@@ -24,6 +24,7 @@ def initialize(
  cache_gc_factory: ->(lockfile) { Dev::Deps::CacheGc.new(lockfile:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @cache_gc_factory = T.let(cache_gc_factory, CacheGcFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/cd_command.rb

@@ -14,6 +14,7 @@ class CdCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Cd::Accessor).void }
  def initialize(accessor: Dev::Cd::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Cd::Accessor)
  end
 

src/dev/builtins/check_command.rb

@@ -13,6 +13,7 @@ class CheckCommand < BuiltinCommand
 
  sig { params(dependency_service: DependencyService).void }
  def initialize(dependency_service:)
+ super()
  @dependency_service = T.let(dependency_service, DependencyService)
  end
 

src/dev/builtins/clone_command.rb

@@ -14,6 +14,7 @@ class CloneCommand < BuiltinCommand
 
  sig { params(accessor: Dev::Clone::Accessor).void }
  def initialize(accessor: Dev::Clone::Accessor.new)
+ super()
  @accessor = T.let(accessor, Dev::Clone::Accessor)
  end
 

src/dev/builtins/cred_command.rb

@@ -14,6 +14,7 @@ class CredCommand < BuiltinCommand
 
  sig { params(accessor: Dev::CredentialAccessor).void }
  def initialize(accessor: Dev::CredentialAccessor.new)
+ super()
  @accessor = T.let(accessor, Dev::CredentialAccessor)
  end
 

src/dev/builtins/deps_command.rb

@@ -29,6 +29,7 @@ def initialize(
  )
  }
  )
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/install_deps_command.rb

@@ -50,6 +50,7 @@ def initialize(
  gem_skill_linker_factory: ->(project_root) { Dev::Deps::GemSkillLinker.new(project_root:) },
  synchronizer: Dev::Learnings::Synchronizer.for
  )
+ super()
  @installer_factory = T.let(installer_factory, InstallerFactory)
  @gem_skill_linker_factory = T.let(gem_skill_linker_factory, GemSkillLinkerFactory)
  @synchronizer = T.let(synchronizer, T.untyped)

src/dev/builtins/learnings_command.rb

@@ -20,6 +20,7 @@ class LearningsCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Learnings::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/plan_command.rb

@@ -20,6 +20,7 @@ class PlanCommand < BuiltinCommand
 
  sig { params(accessor_factory: AccessorFactory).void }
  def initialize(accessor_factory: ->(project_root) { Dev::Plan::Accessor.new(project_root:) })
+ super()
  @accessor_factory = T.let(accessor_factory, AccessorFactory)
  end
 

src/dev/builtins/runner_setup_command.rb

@@ -36,6 +36,7 @@ def initialize(
  runner_setup_factory: ->(config, repo, org) { Dev::RunnerSetup.new(config:, repo:, org:) },
  flag_parser: Cli::FlagParser.new
  )
+ super()
  @runner_setup_factory = T.let(runner_setup_factory, RunnerSetupFactory)
  @flag_parser = T.let(flag_parser, Cli::FlagParser)
  end

src/dev/builtins/up_command.rb

@@ -23,6 +23,7 @@ class UpCommand < BuiltinCommand
  ).void
  end
  def initialize(install_deps_command:, hook_installer: Dev::Cd::HookInstaller.new)
+ super()
  @install_deps_command = T.let(install_deps_command, InstallDepsCommand)
  @hook_installer = T.let(hook_installer, Dev::Cd::HookInstaller)
  end

src/dev/command.rb

@@ -4,20 +4,31 @@
 require_relative "execution_context"
 
 module Dev
- # Sealed command data hierarchy. A command is one of exactly three shapes:
+ # Sealed command hierarchy. A command is one of exactly three shapes:
  #
- # - BuiltinCommand: a Ruby body dev ships (abstract here; concretes live
- # under src/dev/builtins/)
+ # - BuiltinCommand: a Ruby body dev ships (an abstract class, the
+ # hierarchy's one declared open edge; subclasses live under
+ # src/dev/builtins/)
  # - ProjectCommand: pure data parsed from a dev.yml `commands:` entry
  # - OverriddenCommand: a project command occupying a builtin's slot (the
  # builtin runs first, like a hardcoded super())
  #
- # Sealing makes any other nesting unrepresentable: CommandExecutor
- # dispatches exhaustively over these three variants (case + T.absurd).
- # Sorbet requires the direct subclasses of a sealed class beside it, which
- # is why the whole hierarchy shares this file; BuiltinCommand is abstract
- # but deliberately NOT sealed, so its concretes get their own files.
- class Command
+ # Sealing makes a fourth variant unrepresentable: CommandExecutor
+ # dispatches exhaustively over these three (case + T.absurd), and Sorbet
+ # requires a sealed module's direct heirs beside it, which is why the
+ # hierarchy shares this file.
+ #
+ # Command is a module rather than a class deliberately. A sealed class's
+ # runtime `inherited` hook rides down the singleton chain to every
+ # descendant, so builtins subclassing an abstract BuiltinCommand class
+ # raise at definition time unless sorbet-runtime internals are faked open
+ # (the ivar pokes this file used to carry). A sealed module's `included`
+ # hook fires only for its direct includers — the three heirs below —
+ # because `include` never transfers singleton methods, so subclassing
+ # BuiltinCommand is an honest open edge with nothing to suppress. Descent
+ # is closed everywhere it is not explicitly declared: the two data leaves
+ # are final!.
+ module Command
  extend T::Sig
  extend T::Helpers
  abstract!
@@ -46,77 +57,80 @@ def staleness_exempt? = false
  def stamps? = false
  end
 
- # Built-in command that executes Ruby code. Concretes live under
- # src/dev/builtins/, one class per builtin, with collaborators injected
- # through their constructors; per-call values arrive through #call.
- class BuiltinCommand < Command
+ # Built-in command that executes Ruby code: the hierarchy's declared open
+ # edge. Subclasses live under src/dev/builtins/, one class per builtin,
+ # with collaborators injected through their constructors; per-call values
+ # arrive through #call. Test fakes subclass it the same way.
+ #
+ # A class rather than a module because Sorbet flattens module mixins:
+ # were this a module, every includer would gain sealed Command as a
+ # direct mixin in the symbol table and fail the same-file check
+ # statically. A superclass edge is not flattened, so subclasses inherit
+ # Command's membership without re-including it — legal statically, and
+ # invisible to the seal's runtime hooks.
+ class BuiltinCommand
  extend T::Sig
  extend T::Helpers
+ include Command
  abstract!
 
  sig { abstract.params(args: T::Array[String], context: ExecutionContext).void }
  def call(args:, context:); end
  end
 
- # Statically, `sealed!` binds only Command's direct subclasses, so
- # BuiltinCommand concretes may live in their own files — but sorbet-runtime's
- # inherited hook also rides down to BuiltinCommand's subclasses and would
- # reject them for lacking a sealed declaration. Registering an empty
- # decl-file prefix marks BuiltinCommand as the hierarchy's deliberately open
- # edge: the hook accepts subclasses from any file (src/dev/builtins/, test
- # fakes), matching the static rule.
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_decl_file, "")
- BuiltinCommand.instance_variable_set(:@sorbet_sealed_module_all_subclasses, [])
-
  # Project command from a dev.yml `commands:` entry. Pure data: the run
  # string, optional description, repl flag, and container opt-out. When
  # build.container is declared, commands run inside the container by
  # default unless container: false.
- class ProjectCommand < Command
+ class ProjectCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(String) }
+ sig(:final) { returns(String) }
  attr_reader :run
 
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  attr_reader :desc
 
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :repl
 
  # Whether this command should run inside the build container (when one is
  # configured). Defaults to true; set to false via `container: false` in dev.yml.
- sig { returns(T::Boolean) }
+ sig(:final) { returns(T::Boolean) }
  attr_reader :container
 
- sig do
+ sig(:final) do
  params(run: String, desc: String, repl: T::Boolean, container: T::Boolean, hidden: T::Boolean).void
  end
  def initialize(run:, desc: "(no description)", repl: false, container: true, hidden: false)
+ super()
  @run = T.let(run, String)
  @desc = T.let(desc, String)
  @repl = T.let(repl, T::Boolean)
  @container = T.let(container, T::Boolean)
  @hidden = T.let(hidden, T::Boolean)
  end
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @hidden
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def ==(other)
  return false unless other.is_a?(ProjectCommand)
 
  @run == other.run && @desc == other.desc && @repl == other.repl &&
  @container == other.container && @hidden == other.hidden?
  end
 
- sig { params(other: Object).returns(T::Boolean) }
+ sig(:final) { params(other: Object).returns(T::Boolean) }
  def eql?(other)
  self == other
  end
 
- sig { returns(Integer) }
+ sig(:final) { returns(Integer) }
  def hash
  [@run, @desc, @repl, @container, @hidden].hash
  end
@@ -126,36 +140,40 @@ def hash
  # dispatch: the override owns the slot, and its implementation calls
  # super() at the top — CommandExecutor runs the builtin body first, then
  # the project command.
- class OverriddenCommand < Command
+ class OverriddenCommand
  extend T::Sig
+ extend T::Helpers
+ include Command
+ final!
 
- sig { returns(BuiltinCommand) }
+ sig(:final) { returns(BuiltinCommand) }
  attr_reader :builtin
 
- sig { returns(ProjectCommand) }
+ sig(:final) { returns(ProjectCommand) }
  attr_reader :project
 
- sig { params(builtin: BuiltinCommand, project: ProjectCommand).void }
+ sig(:final) { params(builtin: BuiltinCommand, project: ProjectCommand).void }
  def initialize(builtin:, project:)
+ super()
  @builtin = T.let(builtin, BuiltinCommand)
  @project = T.let(project, ProjectCommand)
  end
 
  # The override owns the slot, so its description wins — a project `up:`
  # shows its own desc in usage, not the generic builtin one.
- sig { override.returns(String) }
+ sig(:final) { override.returns(String) }
  def desc = @project.desc
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def hidden? = @project.hidden?
 
  # Guard and stamp traits belong to the slot, not the override: a project
  # `up:` still is the provisioning command, so it inherits the builtin's
  # exemption and stamping behavior.
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def staleness_exempt? = @builtin.staleness_exempt?
 
- sig { override.returns(T::Boolean) }
+ sig(:final) { override.returns(T::Boolean) }
  def stamps? = @builtin.stamps?
  end
 end

src/dev/command_repository.rb

@@ -10,8 +10,8 @@ module Dev
  # builtin's slot — their OverriddenCommand composition. Data in, never a
  # path, never a parse.
  #
- # Onion rule: CommandService is the only production consumer; the constant
- # is private and construction is confined to the composition root.
+ # Onion rule: CommandService is the only production consumer, and
+ # construction is confined to the composition root.
  class CommandRepository
  extend T::Sig
 
@@ -77,6 +77,4 @@ def assemble(builtins, project_commands)
  commands
  end
  end
-
- private_constant :CommandRepository
 end

src/dev/runner.rb

@@ -105,10 +105,11 @@ def exit_for(error)
  end
  end
 
- # The composition root: the one place the repository (private to this
- # onion) and the builtin set are constructed. Which builtins exist is
- # config-gated here — runner-setup only with a `runner:` block,
- # provide-image/reset-container only with a build container.
+ # The composition root: the one place the repository (consumed only by
+ # CommandService, the onion rule) and the builtin set are constructed.
+ # Which builtins exist is config-gated here — runner-setup only with a
+ # `runner:` block, provide-image/reset-container only with a build
+ # container.
  #
  # @param manifest [ProjectManifest]
  # @return [CommandService]

test/dev/command_executor_test.rb

@@ -15,10 +15,10 @@ class ExecutorFakeBuiltin < Dev::BuiltinCommand
  attr_reader :calls
 
  def initialize(stamps: false, &body)
+ super()
  @stamps = stamps
  @calls = []
  @body = body
- super()
  end
 
  def desc = "a builtin"
@@ -51,7 +51,7 @@ def build_context(project_root)
  When "executing"
  executor.execute(builtin, args: ["--verbose"], context: context)
 
- Then "the body received args and context; no child process was involved"
+ Then "the builtin received args and context; no child process was involved"
  builtin.calls == [[["--verbose"], context]]
 
  Cleanup