rigortype 0.2.9 → 0.3.1

data/lib/rigor/analysis/runner.rb

@@ -8,6 +8,9 @@ require_relative "../environment"
 require_relative "../scope"
 require_relative "../cache/store"
 require_relative "../cache/rbs_descriptor"
+require_relative "../cache/file_digest"
+require_relative "run_cache_key"
+require_relative "path_expansion"
 require_relative "../plugin"
 require_relative "../plugin/source_rbs_synthesis_reporter"
 require_relative "../rbs_extended/reporter"
@@ -15,6 +18,7 @@ require_relative "../rbs_extended/conformance_checker"
 require_relative "../reflection"
 require_relative "../type/combinator"
 require_relative "../inference/coverage_scanner"
+require_relative "../inference/parameter_inference_collector"
 require_relative "../inference/scope_indexer"
 require_relative "../inference/synthetic_method_scanner"
 require_relative "../inference/project_patched_scanner"
@@ -40,12 +44,28 @@ require_relative "runner/diagnostic_aggregator"
 module Rigor
   module Analysis
     class Runner # rubocop:disable Metrics/ClassLength
-      RUBY_GLOB = "**/*.rb"
       DEFAULT_CACHE_ROOT = ".rigor/cache"
 
+      # ADR-89 WD2 — bounds on the persisted return summaries (per-def observed call keys, and total defs
+      # summarised) so the incremental snapshot stays small. A def observed under more keys than the per-def
+      # cap keeps only the first; a def past the total cap is dropped (its symbol dependents then always
+      # re-check — the conservative direction).
+      RETURN_SUMMARY_KEYS_PER_DEF = 8
+      RETURN_SUMMARY_TOTAL_CAP = 4000
+
       attr_reader :cache_store, :plugin_registry, :dependency_source_index,
-                  :rbs_extended_reporter, :boundary_cross_reporter, :file_dependencies,
-                  :analyzed_files, :unresolved_self_calls
+                  :rbs_extended_reporter, :boundary_cross_reporter,
+                  :analyzed_files, :unresolved_self_calls, :seed_bundles
+
+      # ADR-46 — the per-file cross-file read records this run captured (empty unless
+      # `record_dependencies: true`). Sequential analysis records into `@file_dependencies` via
+      # {#analyze_file}; the fork pool records per-worker and marshals the records into the coordinator, so a
+      # pooled `--incremental` recheck refreshes the same dependency graph a sequential recheck would. A run
+      # is either sequential OR pooled for a given file set, so the two maps never carry the same key.
+      def file_dependencies
+        pooled = @pool_coordinator.collected_dependencies
+        pooled.empty? ? @file_dependencies : @file_dependencies.merge(pooled)
+      end
 
       # @param configuration [Rigor::Configuration]
       # @param explain [Boolean] surface fail-soft fallback events as `:info` diagnostics.
@@ -79,7 +99,8 @@ module Rigor
                      cache_store: Cache::Store.new(root: DEFAULT_CACHE_ROOT),
                      plugin_requirer: nil, workers: 0, collect_stats: true,
                      buffer: nil, prebuilt: nil, environment: nil,
-                     record_dependencies: false, record_self_calls: false, analyze_only: nil)
+                     record_dependencies: false, record_self_calls: false, analyze_only: nil,
+                     seed_bundles: nil, collect_seed_bundles: false)
         @configuration = configuration
         @explain = explain
         @cache_store = enforce_read_only_cache(cache_store, buffer)
@@ -112,6 +133,13 @@ module Rigor
         # set are analyzed for diagnostics — the body tier re-analyses the affected closure and serves the
         # rest from the per-file cache. `nil` (the default) analyzes everything.
         @analyze_only = analyze_only && Set.new(analyze_only)
+        # ADR-85 WD2 — seed-bundle discovery. When `collect_seed_bundles`, the cross-file discovery pre-pass
+        # rebuilds from the prior run's per-file bundles (`@restored_seed_bundles`, re-walking only changed
+        # files) instead of parsing every file, and exposes the refreshed set via `#seed_bundles` for the
+        # session to persist. Off by default — a plain `rigor check` keeps today's parse+walk.
+        @collect_seed_bundles = collect_seed_bundles
+        @restored_seed_bundles = seed_bundles || {}
+        @seed_bundles = {}.freeze
         @file_dependencies = {}
         @plugin_registry = Plugin::Registry::EMPTY
         @dependency_source_index = DependencySourceInference::Index::EMPTY
@@ -130,6 +158,7 @@ module Rigor
         @project_discovered_def_nodes = {}.freeze
         @project_discovered_singleton_def_nodes = {}.freeze
         @project_discovered_def_sources = {}.freeze
+        @project_discovered_singleton_def_sources = {}.freeze
         @project_discovered_superclasses = {}.freeze
         @project_discovered_includes = {}.freeze
         @project_discovered_class_sources = {}.freeze
@@ -137,6 +166,16 @@ module Rigor
         @project_discovered_methods = {}.freeze
         @project_data_member_layouts = {}.freeze
         @project_struct_member_layouts = {}.freeze
+        # ADR-67 WD6a — the call-site parameter-inference table, populated by the opt-in pre-pass in
+        # `assemble_run_diagnostics` when `parameter_inference:` is enabled, then seeded onto every per-file
+        # scope (sequential + fork-worker) through `project_scope_seed_tables`. Empty by default, so the gate-off
+        # run carries no table and is byte-identical.
+        @project_param_inferred_types = {}.freeze
+        # ADR-84 WD2 — per-run identity token for the user-method return memo's bucket (see
+        # Scope::DiscoveryIndex#run_generation). Minted fresh in `run_analysis` so the memo never serves an
+        # entry across a run boundary (LSP re-check, ADR-62 warm loop); nil until the first run so
+        # runner-less probes keep the per-file fallback.
+        @run_generation = nil
         build_collaborators
       end
 
@@ -150,6 +189,19 @@ module Rigor
       # errors. The Environment is built once at run start through `Environment.for_project` so all files
       # share the same RBS load.
       def run(paths = @configuration.paths)
+        # One per-run file-digest memo spans the whole run, so a path is SHA-256'd at most once across the
+        # run-diagnostics dependency descriptor, its `fresh?` validation, the RBS signature tree, and every
+        # plugin producer's watched-glob validation (they overlap heavily on the warm path). The nested ADR-85
+        # WD3 memo yields one stable `Prism::DefNode` per resolved bundle handle for the run (both are no-ops
+        # outside their respective consumers — an empty thread-local table).
+        # ADR-87 WD1 — `cache.validation` (or the RIGOR_STRICT_VALIDATION env, which wins) selects the
+        # freshness path for this run; the `auto` default resolves strict in CI (#190), stat-first elsewhere.
+        Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
+          Inference::DefNodeResolver.with_run { run_analysis(paths) }
+        end
+      end
+
+      def run_analysis(paths)
         Inference::MethodDispatcher::FileFolding.fold_platform_specific_paths =
           @configuration.fold_platform_specific_paths
 
@@ -160,6 +212,12 @@ module Rigor
 
         expansion = expand_paths(paths)
         @snapshots.reset_for_run
+        # Per-run reset of the deferred-discovery memo (see `#ensure_project_discovery`).
+        @project_discovery_done = false
+        # ADR-84 WD2 — roll the return-memo bucket: a fresh frozen token per run makes every per-file scope
+        # of THIS run share one memo bucket while entries from any earlier run in this process (stale after
+        # an edit) become unreachable.
+        @run_generation = Object.new.freeze
 
         if @prebuilt
           adopt_prebuilt_project_scan(@prebuilt)
@@ -167,6 +225,11 @@ module Rigor
           run_project_pre_passes(expansion: expansion)
         end
 
+        # The recording / subset (ADR-46) modes read the discovery tables outside the analysis assembly, so
+        # they force the build eagerly here (matching pre-slice-1 timing); every other mode defers it to the
+        # miss path so a warm cache HIT skips the two whole-project parse passes entirely.
+        ensure_project_discovery(expansion) if force_eager_discovery?
+
         diagnostics = compute_run_diagnostics(expansion)
 
         Result.new(
@@ -207,7 +270,7 @@ module Rigor
       # edges are NOT inverted here: they feed the structural tier (slice 3), which re-checks a consumer
       # when a name it looked up and did not resolve later appears.
       def file_dependents
-        Incremental.invert(@file_dependencies.transform_values(&:sources))
+        Incremental.invert(file_dependencies.transform_values(&:sources))
       end
 
       # ADR-46 slice 4 — per-symbol body fingerprints, computed from the project pre-pass def index. Returns
@@ -219,18 +282,35 @@ module Rigor
       # frozen hash before the first run.
       def symbol_fingerprints
         result = Hash.new { |h, k| h[k] = {} }
-        @project_discovered_def_sources.each do |class_name, methods|
+        collect_symbol_fingerprints(result, @project_discovered_def_sources, @project_discovered_def_nodes, "#")
+        # ADR-46 slice 4 (singleton) — class/singleton-method bodies live in the parallel singleton tables the
+        # instance loop never read (recon S5). Fingerprint them under a `"Class.method"` key (the format the
+        # `singleton_def_for` dependency edge uses) so a `def self.x` body edit produces a changed pair.
+        collect_symbol_fingerprints(result, @project_discovered_singleton_def_sources,
+                                    @project_discovered_singleton_def_nodes, ".")
+        result.transform_values(&:freeze).freeze
+      end
+
+      # Folds one def-source/def-node table pair into the per-file fingerprint map under `separator` (`#`
+      # instance, `.` singleton). `sources` supplies the `"path:line"` (a `Prism::Location` hides its file);
+      # the node supplies the body fingerprint.
+      def collect_symbol_fingerprints(result, sources, nodes, separator)
+        sources.each do |class_name, methods|
           methods.each do |method_sym, path_line|
             path = path_line.split(":", 2).first
-            node = @project_discovered_def_nodes.dig(class_name, method_sym)
+            node = nodes.dig(class_name, method_sym)
             next unless node
 
-            result[path]["#{class_name}##{method_sym}"] =
-              Digest::SHA256.hexdigest(node.location.slice)
+            # ADR-85 WD3 — on the incremental warm path an unchanged file's def is a `DefHandle` carrying the
+            # slice fingerprint captured when its bundle was built (no re-parse); a live node (cold / re-walked
+            # file) is sliced as before. This is the only value-deref consumer of the def-node table besides the
+            # three accessor choke points.
+            result[path]["#{class_name}#{separator}#{method_sym}"] =
+              node.is_a?(Inference::DefHandle) ? node.fingerprint : Digest::SHA256.hexdigest(node.location.slice)
           end
         end
-        result.transform_values(&:freeze).freeze
       end
+      private :collect_symbol_fingerprints
 
       # ADR-46 slice 3 — per-file set of the qualified class/module names declared in that file. Used to
       # detect a class that *appeared* in an edit so a subclass whose ancestor was previously undefined
@@ -244,6 +324,113 @@ module Rigor
         result.transform_values(&:freeze).freeze
       end
 
+      # ADR-89 WD2 — the per-method observed-key return summaries the run's ADR-84 return memo just captured.
+      # For each project method with live memo entries, a bounded `{ keys:, returns:, effects: }` summary the
+      # incremental session persists: `keys` the observed `[receiver, arg_types]` type tuples, `returns` their
+      # `describe(:short)` descriptors, `effects` the content-mutated parameter positions (a caller-visible
+      # arg-flooring surface). Only meaningful right after a run populated the memo (baseline / recheck),
+      # before the bucket rolls. Keys are held live here; the session Marshals them for the snapshot.
+      #
+      # @return [Hash] `{ [path, "Class#method" | "Class.method"] => { keys:, returns:, effects: } }`.
+      def return_summaries
+        memo = Inference::ExpressionTyper.harvest_return_memo
+        return {} if memo.empty?
+
+        result = {}
+        effects_evaluator = Inference::StatementEvaluator.new(scope: Scope.empty)
+        collect_return_summaries(result, @project_discovered_def_nodes, @project_discovered_def_sources,
+                                 "#", memo, effects_evaluator)
+        collect_return_summaries(result, @project_discovered_singleton_def_nodes,
+                                 @project_discovered_singleton_def_sources, ".", memo, effects_evaluator)
+        result
+      end
+
+      # Folds one def-node/def-source table pair's memo entries into the return-summary result under
+      # `separator`. A live def node (a cold / re-walked file) is the identity every cross-file caller
+      # resolved through, so `memo[node]` holds those callers' observed keys; a {DefHandle} (an unchanged
+      # file on the warm path) never keyed a memo entry, so it is skipped (its summary is carried over from
+      # the snapshot). Bounded per def and in total so the snapshot stays small.
+      def collect_return_summaries(result, nodes, sources, separator, memo, effects_evaluator)
+        nodes.each do |class_name, methods|
+          methods.each do |method_name, node|
+            next if node.is_a?(Inference::DefHandle)
+
+            entries = memo[node]
+            next if entries.nil? || entries.empty?
+
+            path_line = sources.dig(class_name, method_name)
+            next if path_line.nil?
+
+            break if result.size >= RETURN_SUMMARY_TOTAL_CAP
+
+            capped = entries.first(RETURN_SUMMARY_KEYS_PER_DEF)
+            result[[path_line.split(":", 2).first, "#{class_name}#{separator}#{method_name}"]] = {
+              keys: capped.map { |entry| [entry.receiver, entry.arg_types] },
+              returns: capped.map { |entry| entry.result.describe(:short) },
+              effects: content_effects(effects_evaluator, node)
+            }
+          end
+        end
+      end
+
+      # The content-mutated parameter positions of `node`, or `[]` if the computation raises (defensive: the
+      # effects surface only routes attention, never soundness — a missing set reads as "no floor").
+      def content_effects(effects_evaluator, node)
+        effects_evaluator.content_mutated_parameter_positions(node)
+      rescue StandardError
+        []
+      end
+
+      # ADR-89 WD2 — re-evaluate the return type of specific project methods at previously-observed call keys,
+      # WITHOUT analyzing any file. The incremental session calls this session-side (before dispatching the
+      # recheck) to prove a declaration-stable, changed callee returns the same type at every key its baseline
+      # callers used, so those callers' re-analysis can be skipped. Builds the cross-file discovery index (the
+      # ADR-85 seed-bundle fold, re-walking only edited files) and the RBS environment (served from the cache
+      # store) exactly as a real run's setup does, then re-drives each spec's def through the ADR-84 return
+      # memo. Off any hot path — invoked only when declaration-stable changed pairs carry a persisted summary.
+      #
+      # @param paths [Array<String>, nil] analysis roots (nil → the configuration's `paths:`).
+      # @param specs [Array<Hash>] each `{ class_name:, method_name:, singleton:, keys: [[receiver, args], …] }`.
+      # @return [Hash] `{ [class_name, method_name, singleton] => [return_descriptor_or_nil, …] }`.
+      def evaluate_return_types(paths, specs)
+        return {} if specs.empty?
+
+        Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
+          Inference::DefNodeResolver.with_run { evaluate_return_types_setup(paths, specs) }
+        end
+      end
+
+      # Builds the discovery index + environment (a real run's prologue, minus per-file analysis) and
+      # re-evaluates each spec's def. Extracted so {#evaluate_return_types}'s `with_run` wrappers stay thin.
+      def evaluate_return_types_setup(paths, specs)
+        expansion = expand_paths(paths || @configuration.paths)
+        @project_discovery_done = false
+        @run_generation = Object.new.freeze
+        run_project_pre_passes(expansion: expansion)
+        ensure_project_discovery(expansion)
+        environment = @pool_coordinator.resolve_sequential_environment(source_files: target_files(expansion))
+        specs.to_h do |spec|
+          [[spec[:class_name], spec[:method_name], spec[:singleton]], evaluate_spec_returns(spec, environment)]
+        end
+      end
+
+      # Re-evaluates one spec's def at each of its observed keys. Locates the (live) def node in the discovery
+      # index, builds a project-seeded scope, and returns one return descriptor per key (nil when the def is
+      # missing / bodyless or the memo refuses a transient result — the caller reads either as "not provably
+      # stable" and keeps the dependents).
+      def evaluate_spec_returns(spec, environment)
+        table = spec[:singleton] ? @project_discovered_singleton_def_nodes : @project_discovered_def_nodes
+        node = table.dig(spec[:class_name], spec[:method_name])
+        node = Inference::DefNodeResolver.resolve(node) if node.is_a?(Inference::DefHandle)
+        return spec[:keys].map { nil } if node.nil?
+
+        scope = seed_project_scope(Scope.empty(environment: environment, source_path: spec[:path]))
+        spec[:keys].map do |(receiver, arg_types)|
+          result = scope.user_method_return(node, receiver, arg_types)
+          result&.describe(:short)
+        end
+      end
+
       # ADR-45 — unchanged-project fast path. Serves the whole run's (pre-severity-profile) diagnostics
       # from one record-and-validate cache entry when every file the previous run read is unchanged,
       # skipping the dominant per-file inference. The dependency set is collected AFTER the run (so it
@@ -255,13 +442,20 @@ module Rigor
         return assemble_run_diagnostics(expansion) unless run_result_cacheable?
 
         environment = @pool_coordinator.resolve_sequential_environment(source_files: target_files(expansion))
-        rbs_descriptor = environment&.rbs_loader ? Cache::RbsDescriptor.build(environment.rbs_loader) : Cache::Descriptor.new
+        # Lazy-files descriptor: the cache KEY reads only `gems` + `configs`; the RBS signature-tree `files`
+        # are digested solely by `run_dependency_descriptor` on a MISS, so a warm HIT never walks the tree.
+        rbs_descriptor = if environment&.rbs_loader
+                           Cache::RbsDescriptor.build_run(environment.rbs_loader)
+                         else
+                           Cache::Descriptor.new
+                         end
         key_descriptor = run_key_descriptor(expansion, rbs_descriptor)
         return assemble_run_diagnostics(expansion, environment: environment) if key_descriptor.nil?
 
         computed = false
         diagnostics = @cache_store.fetch_or_validate(
-          producer_id: "analysis.run-diagnostics", key_descriptor: key_descriptor
+          producer_id: RunCacheKey::RUN_DIAGNOSTICS_PRODUCER_ID, key_descriptor: key_descriptor,
+          generation_cap: RunCacheKey::GENERATION_CAP
         ) do
           computed = true
           diags = assemble_run_diagnostics(expansion, environment: environment)
@@ -277,6 +471,17 @@ module Rigor
       end
 
       def assemble_run_diagnostics(expansion, environment: nil)
+        # Force the deferred cross-file discovery pre-pass on the analysis (miss) path. Memoised, so the
+        # eager force in `#run` (recording / subset modes) makes this a no-op. A warm cache HIT never calls
+        # `assemble_run_diagnostics`, so it never runs the two whole-project parse passes. Runs over the FULL
+        # expansion — subset (`analyze_only`) mode still needs the complete cross-file index (ADR-46 §2).
+        ensure_project_discovery(expansion)
+        # ADR-67 WD6a — the opt-in call-site parameter-inference pre-pass. Runs on the parent BEFORE the pool
+        # split (so every worker sees the same frozen table — the seed-before-fork determinism the discovery
+        # tables use) and only on the analysis (miss / non-cacheable) path (a warm ADR-45 cache HIT never
+        # assembles). Gate off → no-op, and `environment` is left untouched so its lazy build timing is
+        # unchanged. Returns the resolved environment so the sequential dispatch reuses it (no double build).
+        environment = seed_parameter_inference(expansion, environment)
         diagnostics = @diagnostic_aggregator.pre_file_diagnostics(expansion)
         # ADR-46 — record which project files this run actually analyzed (the `analyze_only` subset, or
         # all of them). The incremental orchestrator serves every analyzed-but-not-affected file from the
@@ -284,6 +489,8 @@ module Rigor
         targets = target_files(expansion)
         @analyzed_files = targets
         diagnostics += @pool_coordinator.analyze_files(targets, environment: environment)
+        diagnostics += @diagnostic_aggregator.rbs_quarantined_signature_diagnostics
+        diagnostics += @diagnostic_aggregator.rbs_environment_build_failed_diagnostics
         diagnostics += @diagnostic_aggregator.rbs_synthesized_namespace_diagnostics
         diagnostics += @diagnostic_aggregator.conforms_to_diagnostics
         diagnostics += @diagnostic_aggregator.rbs_extended_reporter_diagnostics
@@ -291,6 +498,31 @@ module Rigor
         diagnostics + @diagnostic_aggregator.source_rbs_synthesis_diagnostics
       end
 
+      # ADR-67 WD6a — the check-walk parameter-inference pre-pass. Populates `@project_param_inferred_types`
+      # (read by `project_scope_seed_tables`) with the call-site union of every undeclared parameter, running
+      # ONE round (a single hop of call-site → param typing; the protection scan's three-round fixpoint stays a
+      # protection-surface luxury until measured). No-op unless `parameter_inference:` is enabled, so the
+      # default run pays exactly nothing here and `environment` passes through unchanged (preserving the lazy
+      # env-build timing). When enabled, it resolves the environment once — the collector types call-site
+      # arguments against the same RBS / plugin surface the check uses — and returns it so the sequential
+      # dispatch reuses that build. The whole-project file set (not the `analyze_only` subset) is scanned: the
+      # inference is cross-file (a call site in one file types a parameter in another). Fails soft — a collector
+      # error must never break a run, so the table stays empty and the run proceeds unseeded.
+      def seed_parameter_inference(expansion, environment)
+        return environment unless @configuration.parameter_inference
+
+        files = expansion.fetch(:files)
+        environment ||= @pool_coordinator.resolve_sequential_environment(source_files: files)
+        @project_param_inferred_types = Inference::ParameterInferenceCollector.collect(
+          files: files, environment: environment,
+          target_ruby: @configuration.target_ruby, max_rounds: 1, workers: @workers
+        )
+        environment
+      rescue StandardError
+        @project_param_inferred_types = {}.freeze
+        environment
+      end
+
       # A cache hit skipped the analysis, so the per-run stats (wall split, RBS-class counts, …) were never
       # gathered — report none rather than the stale snapshot defaults.
       def stats_for_run(wall_started_at:, expansion:)
@@ -303,9 +535,18 @@ module Rigor
       # Cacheable only for a full sequential project run with a writable cache and no per-buffer /
       # prebuilt override — every other mode has a different result identity (pool workers read in
       # separate processes; editor mode is per-buffer; prebuilt is the LSP path).
+      #
+      # The ADR-46 incremental modes are excluded too, now that they carry a real cache store (ADR-85
+      # WD1): a `record_dependencies` run MUST perform per-file analysis to capture the dependency
+      # graph (a cache-served run records nothing, leaving the next recheck's dependents empty —
+      # unsound), and an `analyze_only` subset run produces intentionally partial diagnostics that
+      # share the full run's result key (`run_key_descriptor` keys on the whole expansion, not the
+      # subset), so serving one as the other would manufacture a wrong result. Both instead use the
+      # store for the RBS-env + plugin-producer tiers, where the incremental win actually lives.
       def run_result_cacheable?
         !@cache_store.nil? && !@cache_store.read_only? &&
-          @buffer.nil? && @prebuilt.nil? && !pool_mode?
+          @buffer.nil? && @prebuilt.nil? && !pool_mode? &&
+          !@record_dependencies && @analyze_only.nil?
       end
 
       # Stable cache key inputs — known before the run: a digest of the resolved configuration, the engine
@@ -313,16 +554,13 @@ module Rigor
       # editing one is caught by dependency validation). nil disables the cache for this run rather than
       # risking a malformed key.
       def run_key_descriptor(expansion, rbs_descriptor)
-        Cache::Descriptor.new(
-          gems: rbs_descriptor.gems,
-          configs: rbs_descriptor.configs + [
-            config_hash_entry("configuration", Marshal.dump(@configuration.to_h)),
-            config_hash_entry("engine", "#{Rigor::VERSION}:#{Cache::Descriptor::SCHEMA_VERSION}:#{@explain}"),
-            config_hash_entry("paths", expansion.fetch(:files).sort.join("\n"))
-          ]
+        # ADR-87 WD4 — the key is built through the shared {RunCacheKey} builder the boot-slimming probe also
+        # uses, so the miss path (here, passing the loader's `rbs_descriptor.configs`) and the hit path (which
+        # reconstructs `rbs.libraries` from config) can never drift out of key agreement.
+        RunCacheKey.descriptor(
+          configuration: @configuration, files: expansion.fetch(:files),
+          explain: @explain, rbs_config_entries: rbs_descriptor.configs
         )
-      rescue StandardError
-        nil
       end
 
       # Files the run actually depended on, collected AFTER it ran: every analyzed file, every RBS `sig`
@@ -343,16 +581,12 @@ module Rigor
       def analyzed_file_entries(expansion)
         expansion.fetch(:files).map do |path|
           physical = @buffer ? @buffer.resolve(path) : path
-          Cache::Descriptor::FileEntry.new(
-            path: physical, comparator: :digest, value: Digest::SHA256.file(physical).hexdigest
-          )
+          # ADR-87 WD1 — validation-only dependency descriptor, so the stat-then-digest `:stat` comparator
+          # applies (the env-cache KEY files stay `:digest`).
+          Cache::Descriptor::FileEntry.stat(path: physical, digest: Cache::FileDigest.hexdigest(physical))
         end
       end
 
-      def config_hash_entry(key, payload)
-        Cache::Descriptor::ConfigEntry.new(key: key, value_hash: Digest::SHA256.hexdigest(payload))
-      end
-
       # Runs every project-wide pre-pass (`load_plugins` +
       # `plugin#prepare` + dependency-source builder +
       # synthetic-method scanner + project-patched scanner)
@@ -399,35 +633,73 @@ module Rigor
         apply_pre_passes_result(@pre_passes.adopt_prebuilt(scan))
       end
 
-      # Internal: copies a {ProjectPrePasses::Result} bundle onto the runner's ivars in the assignment
-      # order the original inline pre-pass body used, so every downstream reader (per-file analysis seed,
-      # pool environment build, diagnostic aggregator) sees the same ivar surface. The prebuilt path leaves
-      # the discovery tables at their frozen-empty constructor defaults (the bundle carries `nil` for them,
-      # matching the original adopt path that never touched them).
-      def apply_pre_passes_result(result) # rubocop:disable Metrics/AbcSize
+      # Internal: copies a {ProjectPrePasses::Result} bundle's EAGER (env-input) slots onto the runner's
+      # ivars, so every downstream reader (pool environment build, diagnostic aggregator) sees the same ivar
+      # surface. The cross-file discovery tables are NOT carried here — `#run` (prebuilt-less) and
+      # `adopt_prebuilt` both leave them at their frozen-empty constructor defaults, and the analysis path
+      # fills them lazily via {#ensure_project_discovery}. The prebuilt (LSP) path never fills them, matching
+      # the original adopt behaviour that seeded an empty project scope.
+      def apply_pre_passes_result(result)
         @plugin_registry = result.plugin_registry
         @dependency_source_index = result.dependency_source_index
         @cached_plugin_prepare_diagnostics = result.cached_plugin_prepare_diagnostics
         @synthetic_method_index = result.synthetic_method_index
         @project_patched_methods = result.project_patched_methods
         @pre_eval_diagnostics_from_scanner = result.pre_eval_diagnostics_from_scanner
-        @project_discovered_classes = result.discovered_classes if result.discovered_classes
-        @project_discovered_def_nodes = result.discovered_def_nodes if result.discovered_def_nodes
-        if result.discovered_singleton_def_nodes
-          @project_discovered_singleton_def_nodes = result.discovered_singleton_def_nodes
-        end
-        @project_discovered_def_sources = result.discovered_def_sources if result.discovered_def_sources
-        @project_discovered_superclasses = result.discovered_superclasses if result.discovered_superclasses
-        @project_discovered_includes = result.discovered_includes if result.discovered_includes
-        @project_discovered_class_sources = result.discovered_class_sources if result.discovered_class_sources
-        if result.discovered_method_visibilities
-          @project_discovered_method_visibilities = result.discovered_method_visibilities
+      end
+
+      # Internal: adopts a {ProjectPrePasses::Discovery} bundle (the two whole-project discovery passes)
+      # onto the runner's discovery ivars, in the same assignment order the original inline pre-pass used.
+      # Called only from {#ensure_project_discovery}.
+      def apply_discovery_result(discovery)
+        @project_discovered_classes = discovery.discovered_classes
+        @project_discovered_def_nodes = discovery.discovered_def_nodes
+        @project_discovered_singleton_def_nodes = discovery.discovered_singleton_def_nodes
+        @project_discovered_def_sources = discovery.discovered_def_sources
+        @project_discovered_singleton_def_sources = discovery.discovered_singleton_def_sources
+        @project_discovered_superclasses = discovery.discovered_superclasses
+        @project_discovered_includes = discovery.discovered_includes
+        @project_discovered_class_sources = discovery.discovered_class_sources
+        @project_discovered_method_visibilities = discovery.discovered_method_visibilities
+        @project_discovered_methods = discovery.discovered_methods
+        @project_data_member_layouts = discovery.data_member_layouts
+        @project_struct_member_layouts = discovery.struct_member_layouts
+      end
+
+      # Internal: builds the deferred cross-file discovery tables at most once per run and adopts them.
+      # Memoised on `@project_discovery_done` (reset at the start of `#run`). No-op under `@prebuilt` — the
+      # LSP path deliberately seeds an empty project scope from a snapshot that carries no discovery tables,
+      # so forcing a build there would change that contract. Called eagerly from `#run` for the recording /
+      # subset (ADR-46) modes and lazily from `#assemble_run_diagnostics` on the analysis path, so a warm
+      # cache HIT (which never assembles) never pays the double parse.
+      def ensure_project_discovery(expansion)
+        return if @prebuilt
+        return if @project_discovery_done
+
+        @project_discovery_done = true
+        if @collect_seed_bundles
+          # ADR-85 WD2 — rebuild discovery from the prior run's bundles (re-walking only changed files) and
+          # capture the refreshed bundle set for the session to persist.
+          discovery, @seed_bundles = @pre_passes.discover_from_bundles(
+            expansion: expansion, seed_bundles: @restored_seed_bundles
+          )
+          apply_discovery_result(discovery)
+        else
+          apply_discovery_result(@pre_passes.discover(expansion: expansion))
         end
-        @project_discovered_methods = result.discovered_methods if result.discovered_methods
-        @project_data_member_layouts = result.data_member_layouts if result.data_member_layouts
-        @project_struct_member_layouts = result.struct_member_layouts if result.struct_member_layouts
       end
-      private :run_project_pre_passes, :adopt_prebuilt_project_scan, :apply_pre_passes_result
+
+      # ADR-46 — the dependency-recording and subset-analysis modes read the discovery tables OUTSIDE the
+      # analysis assembly (`Runner#symbol_fingerprints` / `#class_declarations`, consumed by
+      # {IncrementalSession} after the run), so they force the build eagerly — matching the pre-slice-1
+      # timing where discovery always ran before `compute_run_diagnostics`. Every other mode defers to the
+      # lazy build inside `#assemble_run_diagnostics`.
+      def force_eager_discovery?
+        @record_dependencies || !@analyze_only.nil?
+      end
+
+      private :run_project_pre_passes, :adopt_prebuilt_project_scan, :apply_pre_passes_result,
+              :apply_discovery_result, :ensure_project_discovery, :force_eager_discovery?
 
       # Ruby versions probed (ascending) to discover the lowest one this Prism build accepts for
       # `version:`. Prism exposes no version list, so the floor is found empirically — only when a
@@ -518,6 +790,7 @@ module Rigor
         @pool_coordinator = PoolCoordinator.new(
           configuration: @configuration, cache_store: @cache_store, explain: @explain,
           workers: @workers, collect_stats: @collect_stats, buffer: @buffer,
+          record_dependencies: @record_dependencies,
           environment_override: @environment_override,
           rbs_extended_reporter: @rbs_extended_reporter,
           boundary_cross_reporter: @boundary_cross_reporter,
@@ -541,6 +814,8 @@ module Rigor
           cached_plugin_prepare_diagnostics: -> { @cached_plugin_prepare_diagnostics },
           pre_eval_diagnostics_from_scanner: -> { @pre_eval_diagnostics_from_scanner },
           synthesized_namespaces_snapshot: -> { @snapshots.synthesized_namespaces },
+          quarantined_signatures_snapshot: -> { @snapshots.quarantined_signatures },
+          env_build_failure_snapshot: -> { @snapshots.env_build_failure },
           conformance_results_snapshot: -> { @snapshots.conformance_results }
         )
       end
@@ -678,7 +953,7 @@ module Rigor
         bad = []
         Array(paths).each do |path|
           if File.directory?(path)
-            files.concat(reject_excluded(Dir.glob(File.join(path, RUBY_GLOB))))
+            files.concat(PathExpansion.directory_files(path, @configuration.exclude_patterns))
           # Editor-mode bypass: the buffer's logical path is treated as a real `.rb` file regardless of
           # on-disk presence — `parse_source` reads bytes from the buffer's physical path. Common case: LSP
           # client editing a brand-new file.
@@ -710,22 +985,6 @@ module Rigor
           @in_memory_sources&.key?(path)
       end
 
-      # `Configuration#exclude_patterns` is a list of glob patterns checked against each globbed path via
-      # `File.fnmatch?` (without `FNM_PATHNAME`, so `**` and `*` both span path separators — the patterns
-      # behave like substring globs). Built-in defaults exclude `vendor/bundle`, `.bundle`, `node_modules`,
-      # and `tmp` so the analyser never walks into vendored deps or build artefacts. User-supplied entries
-      # (`.rigor.yml` `exclude:`) layer on top. Explicit file arguments to the CLI bypass this filter — only
-      # the directory-glob expansion is filtered.
-      def reject_excluded(file_list)
-        return file_list if @configuration.exclude_patterns.empty?
-
-        file_list.reject { |path| excluded?(path) }
-      end
-
-      def excluded?(path)
-        @configuration.exclude_patterns.any? { |pattern| File.fnmatch?(pattern, path) }
-      end
-
       def path_error(path, message, severity: :error)
         Diagnostic.new(
           path: path,
@@ -766,12 +1025,15 @@ module Rigor
       # cross-file def — ADR-15 sequential-equivalence contract).
       def project_scope_seed_tables
         tables = {}
+        # ADR-84 WD2 — the run-scope token rides the same seed so the fork/Ractor `WorkerSession` scopes
+        # bucket identically to the sequential path.
+        tables[:run_generation] = @run_generation if @run_generation
         tables[:discovered_classes] = @project_discovered_classes unless @project_discovered_classes.empty?
         tables[:discovered_def_nodes] = @project_discovered_def_nodes unless @project_discovered_def_nodes.empty?
         unless @project_discovered_singleton_def_nodes.empty?
           tables[:discovered_singleton_def_nodes] = @project_discovered_singleton_def_nodes
         end
-        tables[:discovered_def_sources] = @project_discovered_def_sources unless @project_discovered_def_sources.empty?
+        seed_def_source_tables(tables)
         unless @project_discovered_superclasses.empty?
           tables[:discovered_superclasses] = @project_discovered_superclasses
         end
@@ -780,6 +1042,10 @@ module Rigor
           tables[:discovered_method_visibilities] = @project_discovered_method_visibilities
         end
         tables[:discovered_methods] = @project_discovered_methods unless @project_discovered_methods.empty?
+        # ADR-67 WD6a — the call-site parameter-inference table rides the same seed so a pooled `WorkerSession`
+        # scope seeds inferred parameters identically to the sequential path. Empty (and absent) unless the
+        # `parameter_inference:` gate ran the pre-pass.
+        tables[:param_inferred_types] = @project_param_inferred_types unless @project_param_inferred_types.empty?
         seed_member_layout_tables(tables)
         # ADR-46 slice 1 — the class-declaration source map is read only by the ancestry accessors during
         # dependency recording, so seed it only when recording is on; a normal run never carries it.
@@ -789,6 +1055,16 @@ module Rigor
         tables
       end
 
+      # ADR-46 — seed the instance + singleton `"path:line"` def-source tables (each only when non-empty).
+      # Extracted to keep {#project_scope_seed_tables} under the complexity budget. The singleton table (slice 4
+      # extension) rides the same seed so a pooled `WorkerSession` records singleton symbol edges identically.
+      def seed_def_source_tables(tables)
+        tables[:discovered_def_sources] = @project_discovered_def_sources unless @project_discovered_def_sources.empty?
+        return if @project_discovered_singleton_def_sources.empty?
+
+        tables[:discovered_singleton_def_sources] = @project_discovered_singleton_def_sources
+      end
+
       # ADR-48 — seed the Data + Struct member-layout tables (each only when non-empty). Extracted to keep
       # {#project_scope_seed_tables} under the complexity budget.
       def seed_member_layout_tables(tables)