rigortype 0.1.17 → 0.1.19

data/lib/rigor/analysis/worker_session.rb

@@ -39,12 +39,19 @@ module Rigor
     # - `plugin_blueprints` — Phase 3a
     #   (`Array<Plugin::Blueprint>` is `Ractor.shareable?`).
     # - `explain` — Boolean.
-    # - `synthetic_method_index` / `project_patched_methods` —
-    #   optional (default `nil`). NOT `Ractor.shareable?`, so the
-    #   Ractor pool path leaves them unset; the fork backend
+    # - `synthetic_method_index` / `project_patched_methods` /
+    #   `project_scope_seed` — optional (default `nil` / `{}`). NOT
+    #   `Ractor.shareable?` (the seed tables carry Prism def nodes),
+    #   so the Ractor pool path leaves them unset; the fork backend
     #   (ADR-15 Amendment), which builds the session pre-fork on the
     #   parent, threads the runner's project-scan results through so
     #   per-file inference matches the sequential path exactly.
+    #   `project_scope_seed` is `Runner#project_scope_seed_tables` —
+    #   the cross-file discovery tables `seed_project_scope` applies
+    #   to every per-file scope on the sequential path; without it a
+    #   worker cannot resolve calls to methods defined in OTHER
+    #   project files and emits `call.undefined-method` false
+    #   positives the sequential path does not.
     #
     # Internally the session OWNS (and never shares):
     #
@@ -97,13 +104,14 @@ module Rigor
       def initialize(configuration:, cache_store: nil, # rubocop:disable Metrics/MethodLength,Metrics/ParameterLists
                      plugin_blueprints: [], explain: false, buffer: nil,
                      synthetic_method_index: nil, project_patched_methods: nil,
-                     source_files: [])
+                     project_scope_seed: {}, source_files: [])
         @configuration = configuration
         @cache_store = cache_store
         @explain = explain
         @buffer = buffer
         @synthetic_method_index = synthetic_method_index
         @project_patched_methods = project_patched_methods
+        @project_scope_seed = project_scope_seed || {}
         # ADR-32 WD4 — full project file list (frozen
         # Array<String>) for env-build-time invocation of any
         # loaded plugin's `source_rbs_synthesizer` callable.
@@ -165,16 +173,20 @@ module Rigor
           return parse_diagnostics(path, parse_result)
         end
 
-        scope = Scope.empty(environment: @environment, source_path: path)
+        scope = seed_project_scope(Scope.empty(environment: @environment, source_path: path))
         index = Inference::ScopeIndexer.index(parse_result.value, default_scope: scope)
+        # ADR-53 B4 — built-in collectors + plugin node rules share one walk.
+        node_collectors = CheckRules.build_node_collectors(path, index)
+        node_results = node_rule_results_by_plugin(path, parse_result.value, scope, node_collectors, index)
         diagnostics = CheckRules.diagnose(
           path: path,
           root: parse_result.value,
           scope_index: index,
           comments: parse_result.comments,
-          disabled_rules: @configuration.disabled_rules
+          disabled_rules: @configuration.disabled_rules,
+          node_collectors: node_collectors
         )
-        diagnostics += plugin_emitted_diagnostics(path, parse_result.value, scope)
+        diagnostics += plugin_emitted_diagnostics(path, parse_result.value, scope, node_results)
         diagnostics + explain_diagnostics(path, parse_result.value, scope)
       rescue Errno::ENOENT => e
         [analyzer_error(path, e.message)]
@@ -200,6 +212,17 @@ module Rigor
 
       private
 
+      # Mirrors {Runner#seed_project_scope}: applies the cross-file
+      # pre-pass discovery tables the constructor received (fork
+      # backend only — see the class comment) to a fresh per-file
+      # scope, so worker-side inference resolves project-internal
+      # cross-file calls exactly like the sequential path.
+      def seed_project_scope(scope)
+        return scope if @project_scope_seed.empty?
+
+        scope.with_discovery(scope.discovery.with(**@project_scope_seed))
+      end
+
       # See {Runner#parse_source}. Same contract: if `@buffer`
       # binds `path` to a physical file, read the physical bytes
       # but stamp the parse buffer's `filepath:` as the LOGICAL
@@ -275,17 +298,43 @@ module Rigor
         )
       end
 
-      def plugin_emitted_diagnostics(path, root, scope)
+      def plugin_emitted_diagnostics(path, root, scope, node_results)
         return [] if @plugin_registry.empty?
 
         @plugin_registry.plugins.flat_map do |plugin|
-          collect_plugin_diagnostics(plugin, path, root, scope)
+          collect_plugin_diagnostics(plugin, path, root, scope, node_results[plugin])
         end
       end
 
-      def collect_plugin_diagnostics(plugin, path, root, scope)
+      # ADR-52 WD4 + ADR-53 B4 — single engine-owned walk per file drives
+      # both the plugin node rules (bucketed per plugin in registry order,
+      # plugin-major emission) and the built-in node collectors
+      # (`node_collectors`, populated in place). Runs even with no node-rule
+      # plugins so the collectors still get driven (converged path).
+      def node_rule_results_by_plugin(path, root, scope, node_collectors, scope_index)
+        walk = @plugin_registry.node_rule_walk
+        driver = node_collectors && CheckRules.node_collector_driver(node_collectors)
+        return {}.compare_by_identity if walk.empty? && driver.nil?
+
+        results = walk.diagnostics_for_file(
+          path: path, scope: scope, root: root, collector_driver: driver
+        )
+        if ENV["RIGOR_SHADOW_RULE_WALK"]
+          CheckRules.shadow_verify_converged_collectors(path, root, scope_index, node_collectors)
+        end
+        results.each_with_object({}.compare_by_identity) do |result, by_plugin|
+          by_plugin[result.plugin] = result
+        end
+      end
+
+      def collect_plugin_diagnostics(plugin, path, root, scope, node_result)
         raw = Array(plugin.diagnostics_for_file(path: path, scope: scope, root: root))
-        raw += plugin.node_rule_diagnostics(path: path, scope: scope, root: root)
+        # A node-rule context/rule raise isolates the whole plugin's
+        # node-rule contribution, matching the old combined per-plugin
+        # rescue (which discarded `diagnostics_for_file` output too).
+        raise node_result.error if node_result&.error
+
+        raw += node_result.diagnostics if node_result
         raw.map { |diagnostic| stamp_plugin_diagnostic(diagnostic, plugin.manifest.id) }
       rescue StandardError => e
         [plugin_runtime_error_diagnostic(path, plugin, e)]

data/lib/rigor/bleeding_edge.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+module Rigor
+  # ADR-50 § WD2 — the bleeding-edge overlay.
+  #
+  # A Rigor-maintained set of the *next major's* queued changes —
+  # severity-map promotions and new-discipline rule enablements — that a
+  # user can adopt early, before they become default-on at a major
+  # (ADR-50 § WD7). It is orthogonal to `severity_profile:` (how loud
+  # *today's* rules are) and is versioned with the gem, NOT a
+  # user-supplied file: the inspectable counterpart to PHPStan's
+  # `bleedingEdge` include.
+  #
+  # The overlay is **empty today** — no discipline has yet been queued
+  # for the next major. This module is the WD2 *foundation* (the v0.1.19
+  # slice): the surface (`bleeding_edge:` config, the
+  # `rigor show-bleedingedge` command, the severity-composition hook in
+  # {Configuration::SeverityProfile.resolve}) exists and is wired
+  # end-to-end, so the first real feature lands as a single {FEATURES}
+  # entry with no engine plumbing.
+  #
+  # Each feature carries a **stable feature id** — part of the ADR-50
+  # WD1 contract vocabulary: the config, the `show` command, and the
+  # eventual CHANGELOG migration note all name the same id, and a
+  # feature graduates to default-on at a major by being removed from
+  # {FEATURES}.
+  module BleedingEdge
+    # One queued change.
+    #
+    # @!attribute id
+    #   @return [String] the stable feature id (contract vocabulary).
+    # @!attribute summary
+    #   @return [String] a one-line description of what it changes.
+    # @!attribute severity_overrides
+    #   @return [Hash{String => Symbol}] canonical rule id → the
+    #     severity this feature imposes. Composed *below* the user's own
+    #     `severity_overrides:` and *above* the active `severity_profile`
+    #     (see {Configuration::SeverityProfile.resolve}).
+    Feature = Data.define(:id, :summary, :severity_overrides) do
+      def to_h
+        {
+          "id" => id,
+          "summary" => summary,
+          "severity_overrides" => severity_overrides.transform_values(&:to_s)
+        }
+      end
+    end
+
+    # The overlay. Empty until the first next-major discipline is
+    # queued; add a {Feature} here (with a stable id) when one is.
+    FEATURES = [].freeze
+
+    module_function
+
+    # @return [Array<Feature>] the whole overlay.
+    def features
+      FEATURES
+    end
+
+    # @return [Array<String>] every feature id in the overlay.
+    def feature_ids
+      FEATURES.map(&:id)
+    end
+
+    # @param id [String]
+    # @return [Feature, nil]
+    def feature(id)
+      FEATURES.find { |f| f.id == id }
+    end
+
+    # Resolves a normalized `bleeding_edge:` selector (see
+    # {Configuration#bleeding_edge}) to the active {Feature} list.
+    # Unknown ids in a `list` / `except` selector are simply absent from
+    # the overlay and contribute nothing — symmetric with how
+    # `severity_overrides:` keeps an unknown rule id inert until it
+    # lands (robust across gem versions).
+    #
+    # @param selector [Hash] `{ "mode" => "none" }`,
+    #   `{ "mode" => "all" }`, `{ "mode" => "all", "except" => [ids] }`,
+    #   or `{ "mode" => "list", "ids" => [ids] }`.
+    # @return [Array<Feature>]
+    def active_features(selector)
+      case selector["mode"]
+      when "all"
+        except = selector["except"] || []
+        FEATURES.reject { |f| except.include?(f.id) }
+      when "list"
+        ids = selector["ids"] || []
+        FEATURES.select { |f| ids.include?(f.id) }
+      else
+        []
+      end
+    end
+
+    # The merged severity-override map the active features impose for a
+    # selector. Frozen so the result is `Ractor.shareable?`.
+    #
+    # @param selector [Hash] see {#active_features}.
+    # @return [Hash{String => Symbol}]
+    def severity_overrides_for(selector)
+      active_features(selector).each_with_object({}) do |feature, acc|
+        acc.merge!(feature.severity_overrides)
+      end.freeze
+    end
+
+    # Feature ids named by a selector that are NOT in the overlay
+    # (typo / graduated / from a newer gem). Surfaced by
+    # `rigor show-bleedingedge` as a hint; never an error.
+    #
+    # @param selector [Hash] see {#active_features}.
+    # @return [Array<String>]
+    def unknown_selected_ids(selector)
+      named =
+        case selector["mode"]
+        when "list" then selector["ids"] || []
+        when "all"  then selector["except"] || []
+        else []
+        end
+      known = feature_ids
+      named.reject { |id| known.include?(id) }
+    end
+  end
+end

data/lib/rigor/cache/descriptor.rb

@@ -13,8 +13,8 @@ module Rigor
     # ([`Rigor::Cache::Store`](store.rb), v0.0.8 slice 2) consumes
     # descriptors but does not extend them.
     #
-    # The descriptor has four slots (`files`, `gems`, `plugins`,
-    # `configs`); every slot is an array of typed entries; an empty
+    # The descriptor has six slots (`files`, `gems`, `plugins`,
+    # `configs`, `dependencies`, `globs`); every slot is an array of typed entries; an empty
     # array means "no dependency in this slot". Composition unions
     # by key per slot; conflicts on the comparison fields raise
     # {Conflict}.
@@ -32,7 +32,12 @@ module Rigor
       # references but never declares, so the marshalled RBS env
       # cached by an older Rigor (which would leave those signatures
       # inert) MUST be rebuilt for the synthesis to take effect.
-      SCHEMA_VERSION = 3
+      # v4: ADR-60 WD3 added the `globs` slot ({GlobEntry}) for the
+      # record-and-validate plugin-producer cache; the new slot
+      # changes `#to_canonical_hash` (and is Marshal-dumped inside
+      # `fetch_or_validate` entry pairs), so entries written by an
+      # older Rigor must read as misses.
+      SCHEMA_VERSION = 4
 
       # Per-slot entry value objects. Constructors validate enums /
       # required fields and freeze the resulting struct so no caller
@@ -160,6 +165,62 @@ module Rigor
         end
       end
 
+      # ADR-60 WD3 — one glob's-worth of watched files, digested as a
+      # single value so the entry covers content change, addition,
+      # AND removal in one row: the digest is the SHA-256 over the
+      # sorted `"<path>\0<sha256-of-content>\n"` rows of every file
+      # matching `File.join(root, pattern)`. A new file adds a row, a
+      # deleted file drops one, an edit changes one — all three move
+      # the digest. {Descriptor#fresh?} re-runs the same computation
+      # and compares.
+      class GlobEntry
+        include Rigor::ValueSemantics
+
+        attr_reader :root, :pattern, :value
+
+        value_fields :root, :pattern, :value
+
+        def initialize(root:, pattern:, value:)
+          @root = root.to_s.dup.freeze
+          @pattern = pattern.to_s.dup.freeze
+          @value = value.to_s.dup.freeze
+          freeze
+        end
+
+        # Builds the entry for the glob's CURRENT filesystem state.
+        def self.compute(root:, pattern:)
+          new(root: root, pattern: pattern, value: digest_for(root: root, pattern: pattern))
+        end
+
+        # The digest the entry's `value` carries. Per-file read
+        # failures (a file vanishing between the glob and the
+        # digest) are treated as the file being absent — same
+        # race posture as {Descriptor#file_entry_fresh?}.
+        def self.digest_for(root:, pattern:)
+          # Dir.glob returns sorted entries by default (sort: true),
+          # so the row order — and therefore the digest — is stable.
+          rows = Dir.glob(File.join(root, pattern)).filter_map do |path|
+            next nil unless File.file?(path)
+
+            "#{path}\0#{Digest::SHA256.file(path).hexdigest}\n"
+          rescue StandardError
+            nil
+          end
+          Digest::SHA256.hexdigest(rows.join)
+        end
+
+        # Composition key — {.compose} unions per (root, pattern)
+        # slot; two contributions for the same slot must agree on
+        # the digest or {Conflict} is raised.
+        def slot_key
+          "#{root}\0#{pattern}"
+        end
+
+        def to_h
+          { "root" => root, "pattern" => pattern, "value" => value }
+        end
+      end
+
       # Raised when {.compose} encounters incompatible entries
       # under the same key (file digest mismatch, gem-locked
       # disagreement, …). Callers handle the exception by
@@ -167,14 +228,15 @@ module Rigor
       # contribution silently.
       class Conflict < StandardError; end
 
-      attr_reader :files, :gems, :plugins, :configs, :dependencies
+      attr_reader :files, :gems, :plugins, :configs, :dependencies, :globs
 
-      def initialize(files: [], gems: [], plugins: [], configs: [], dependencies: [])
+      def initialize(files: [], gems: [], plugins: [], configs: [], dependencies: [], globs: [])
         @files = files.dup.freeze
         @gems = gems.dup.freeze
         @plugins = plugins.dup.freeze
         @configs = configs.dup.freeze
         @dependencies = dependencies.dup.freeze
+        @globs = globs.dup.freeze
         freeze
       end
 
@@ -185,11 +247,15 @@ module Rigor
       # `files` are checked — non-file inputs (config / gems / version)
       # belong in the cache *key*, not the validated dependency set — so
       # a descriptor carrying any non-file slot is never considered fresh
-      # (it was built wrong for this use).
+      # (it was built wrong for this use). ADR-60 WD3 adds `globs`
+      # alongside `files` as a re-validatable slot: a {GlobEntry} is
+      # fresh when re-globbing + re-digesting reproduces its recorded
+      # value.
       def fresh?
         return false unless gems.empty? && plugins.empty? && configs.empty? && dependencies.empty?
 
-        files.all? { |entry| file_entry_fresh?(entry) }
+        files.all? { |entry| file_entry_fresh?(entry) } &&
+          globs.all? { |entry| glob_entry_fresh?(entry) }
       end
 
       # File-comparator strictness ordering. `:digest` is strictest
@@ -212,7 +278,9 @@ module Rigor
         plugins = compose_by_key(descriptors.flat_map(&:plugins), :id)
         configs = compose_by_key(descriptors.flat_map(&:configs), :key)
         dependencies = compose_by_key(descriptors.flat_map(&:dependencies), :gem_name)
-        new(files: files, gems: gems, plugins: plugins, configs: configs, dependencies: dependencies)
+        globs = compose_by_key(descriptors.flat_map(&:globs), :slot_key)
+        new(files: files, gems: gems, plugins: plugins, configs: configs,
+            dependencies: dependencies, globs: globs)
       end
 
       # @param producer_id [String]
@@ -241,6 +309,7 @@ module Rigor
           "dependencies" => sort_entries(dependencies, "gem_name").map(&:to_h),
           "files" => sort_entries(files, "path").map(&:to_h),
           "gems" => sort_entries(gems, "name").map(&:to_h),
+          "globs" => globs.sort_by { |e| [e.root, e.pattern] }.map(&:to_h),
           "plugins" => sort_entries(plugins, "id").map(&:to_h)
         }
       end
@@ -291,6 +360,15 @@ module Rigor
         false
       end
 
+      # ADR-60 WD3 — re-runs the entry's glob + digest and compares
+      # against the recorded value. Any failure reads as stale
+      # (recompute), never a crash.
+      def glob_entry_fresh?(entry)
+        GlobEntry.digest_for(root: entry.root, pattern: entry.pattern) == entry.value
+      rescue StandardError
+        false
+      end
+
       def sort_entries(entries, key)
         entries.sort_by { |e| e.to_h.fetch(key).to_s }
       end

data/lib/rigor/cache/incremental_snapshot.rb

@@ -2,6 +2,7 @@
 
 require "fileutils"
 require "digest"
+require "zlib"
 
 module Rigor
   module Cache
@@ -28,8 +29,12 @@ module Rigor
     # is cold). A cache must never break a run (the ADR-45 invariant).
     class IncrementalSnapshot
       # Bump when the on-disk shape changes so stale snapshots are ignored
-      # rather than mis-deserialized.
-      SCHEMA = 4
+      # rather than mis-deserialized. 5: the blob is zlib-deflated
+      # (ADR-54 WD2 parity with `Store` entries — the snapshot is the
+      # one cache artefact that does not go through `Store`); a raw
+      # pre-5 blob fails the inflate and loads as nil, the usual
+      # fault-tolerant cold-run path.
+      SCHEMA = 5
 
       # The persisted per-file state.
       # `cache` maps an analyzed file to its diagnostics.
@@ -103,7 +108,7 @@ module Rigor
       # The stored {Payload}, or nil when absent / unreadable / schema or
       # fingerprint mismatch / corrupt. Never raises.
       def load(fingerprint:)
-        data = Marshal.load(File.binread(@path)) # rubocop:disable Security/MarshalLoad
+        data = Marshal.load(Zlib::Inflate.inflate(File.binread(@path))) # rubocop:disable Security/MarshalLoad
         return nil unless data.is_a?(Hash) && data[:schema] == SCHEMA && data[:fingerprint] == fingerprint
 
         Payload.new(
@@ -125,7 +130,7 @@ module Rigor
       # raises).
       def save(fingerprint:, payload:)
         FileUtils.mkdir_p(File.dirname(@path))
-        blob = Marshal.dump(
+        raw = Marshal.dump(
           schema: SCHEMA, fingerprint: fingerprint,
           cache: payload.cache, sources: payload.sources,
           digests: payload.digests, analyzed: payload.analyzed,
@@ -135,6 +140,7 @@ module Rigor
           missing: payload.missing,
           class_decls: payload.class_decls
         )
+        blob = Zlib::Deflate.deflate(raw)
         tmp = "#{@path}.#{Process.pid}.tmp"
         File.binwrite(tmp, blob)
         File.rename(tmp, @path)

data/lib/rigor/cache/rbs_cache_producer.rb

@@ -20,7 +20,11 @@ module Rigor
     # structural contract.
     class RbsCacheProducer
       def self.fetch(loader:, store:)
-        descriptor = RbsDescriptor.build(loader)
+        # ADR-54 WD4 — the descriptor is identical for every producer
+        # consulting the same loader (same sig files, same libraries),
+        # so the loader memoises one build per process instead of
+        # re-digesting every .rbs file once per producer.
+        descriptor = loader.rbs_cache_descriptor
         store.fetch_or_compute(producer_id: self::PRODUCER_ID, params: {}, descriptor: descriptor) do
           compute(loader)
         end

data/lib/rigor/cache/rbs_descriptor.rb

@@ -29,7 +29,8 @@ module Rigor
 
       def self.file_entries(loader)
         roots = loader.signature_paths +
-                Rigor::Environment::RbsLoader.vendored_gem_sig_paths
+                Rigor::Environment::RbsLoader.vendored_gem_sig_paths +
+                Rigor::Environment::RbsLoader.core_overlay_sig_paths
         roots.flat_map do |root|
           next [] unless root.directory?
 

data/lib/rigor/cache/store.rb

@@ -5,6 +5,7 @@ require "fileutils"
 require "json"
 require "monitor"
 require "securerandom"
+require "zlib"
 
 require_relative "descriptor"
 
@@ -17,17 +18,27 @@ module Rigor
     # and nothing else.
     #
     # Read failures (missing file, bad magic, format-version mismatch,
-    # corrupt SHA-256 trailer, unmarshal-able payload) are silently
-    # treated as cache misses; the producer block reruns and the
-    # next write replaces the bad entry. The trailing SHA-256 catches
-    # accidental corruption (partial writes, FS errors); it is **not**
-    # a security boundary, per ADR-2's trusted-gem trust model.
+    # corrupt SHA-256 trailer, un-inflatable or unmarshal-able payload)
+    # are silently treated as cache misses; the producer block reruns
+    # and the next write replaces the bad entry. The trailing SHA-256
+    # catches accidental corruption (partial writes, FS errors); it is
+    # **not** a security boundary, per ADR-2's trusted-gem trust model.
     class Store # rubocop:disable Metrics/ClassLength
+      # On-disk byte-layout version. Bumped on incompatible format
+      # changes (independent of {Descriptor::SCHEMA_VERSION}, which
+      # covers the descriptor schema rather than the byte layout).
+      # v2 (ADR-54 WD2): the value payload is zlib-deflated on write
+      # and inflated on read — Marshal blobs compress to 13–16 % at
+      # an inflate cost an order of magnitude below their
+      # `Marshal.load`. v1 entries fail the header check and read as
+      # silent misses; the `schema_version.txt` marker additionally
+      # carries this version, so the first writable run after a bump
+      # clears the root and reclaims the unreadable bytes.
+      FORMAT_VERSION = 2
+
       # Header literal: 5-byte ASCII magic, 1-byte separator, 1-byte
-      # format version. Bumped on incompatible on-disk format changes
-      # (independent of {Descriptor::SCHEMA_VERSION}, which covers
-      # the descriptor schema rather than the byte layout).
-      HEADER = "RIGOR\x00\x01".b.freeze
+      # format version.
+      HEADER = "RIGOR\x00#{FORMAT_VERSION.chr}".b.freeze
 
       VALID_PRODUCER_ID = /\A[a-z][a-z0-9._-]*\z/
 
@@ -48,6 +59,7 @@ module Rigor
         @root = root.to_s.dup.freeze
         @read_only = read_only
         @max_bytes = max_bytes&.then { |n| Integer(n) }
+        @schema_version_ensured = false
         @hits = 0
         @misses = 0
         @writes = 0
@@ -107,6 +119,18 @@ module Rigor
       #   When the root does not exist or has no schema-version
       #   marker, `schema_version` is nil and the producer list is
       #   empty.
+      # The `schema_version.txt` marker content. Covers BOTH
+      # invalidation axes: the descriptor schema and the on-disk byte
+      # layout ({FORMAT_VERSION}, ADR-54). A format bump leaves the
+      # old entries permanently unreadable (header mismatch → miss)
+      # but, alone, would never reclaim their bytes — they can sit
+      # below the eviction cap forever. Folding the format version
+      # into the marker routes the bump through the established
+      # clear-the-root path instead.
+      def self.schema_marker_value
+        "#{Descriptor::SCHEMA_VERSION}.#{FORMAT_VERSION}"
+      end
+
       def self.disk_inventory(root:)
         root_s = root.to_s
         marker = File.join(root_s, "schema_version.txt")
@@ -348,11 +372,15 @@ module Rigor
       LOAD_FAILED = Object.new.freeze
       private_constant :LOAD_FAILED
 
+      # Inflates the stored value payload (ADR-54 WD2), then hands the
+      # raw bytes to the deserialiser. Any failure — corrupt deflate
+      # stream included — reads as a miss.
       def safe_load(bytes, deserialize)
+        raw = Zlib::Inflate.inflate(bytes)
         if deserialize
-          deserialize.call(bytes)
+          deserialize.call(raw)
         else
-          Marshal.load(bytes) # rubocop:disable Security/MarshalLoad
+          Marshal.load(raw) # rubocop:disable Security/MarshalLoad
         end
       rescue StandardError
         LOAD_FAILED
@@ -362,7 +390,7 @@ module Rigor
         FileUtils.mkdir_p(File.dirname(path))
 
         descriptor_bytes = descriptor.to_canonical_bytes
-        value_bytes = serialize_value(value, serialize)
+        value_bytes = Zlib::Deflate.deflate(serialize_value(value, serialize))
 
         body = +"".b
         body << HEADER
@@ -408,10 +436,15 @@ module Rigor
         # never collides with a read under the old). The next
         # writable run will repair the cache.
         return if @read_only
+        # The marker is process-stable; one check per Store is
+        # enough (a benign double-check under a thread race just
+        # repeats idempotent work).
+        return if @schema_version_ensured
 
+        @schema_version_ensured = true
         FileUtils.mkdir_p(@root)
         marker = File.join(@root, "schema_version.txt")
-        current = Descriptor::SCHEMA_VERSION.to_s
+        current = self.class.schema_marker_value
 
         if File.file?(marker)
           on_disk = File.read(marker).strip