rigortype 0.2.9 → 0.3.1

data/lib/rigor/language_server/buffer_table.rb

@@ -1,13 +1,17 @@
 # frozen_string_literal: true
 
+require_relative "incremental_sync"
+
 module Rigor
   module LanguageServer
     # Per-session virtual file table. The LSP server maintains the canonical view of every open buffer here;
     # analysis (slice 4+) reads from this table instead of disk so in-flight edits are reflected immediately.
     #
-    # Keyed by `DocumentUri` (LSP `file://...` URIs). v1 ships FULL text sync (LSP
-    # `TextDocumentSyncKind::Full = 1`) so each `didChange` carries the entire buffer text — there's no
-    # incremental edit application yet. Incremental sync is slice 10 (deferred per the design doc).
+    # Keyed by `DocumentUri` (LSP `file://...` URIs). Sync is INCREMENTAL (LSP
+    # `TextDocumentSyncKind::Incremental = 2`): a `didChange` carries range edits which {#apply_changes} splices
+    # into the held text through {IncrementalSync}. The full-text form ({#change}, and a `contentChanges` entry
+    # with no `range`) stays supported — it is still legal under incremental sync and is what `didOpen` and a
+    # client-side resync send.
     class BufferTable
       # @!attribute uri      [String]  the LSP DocumentUri (e.g. `file:///abs/path/lib/foo.rb`).
       # @!attribute bytes    [String]  the current full text of the buffer.
@@ -16,23 +20,59 @@ module Rigor
 
       def initialize
         @entries = {}
+        @desynchronized = {}
       end
 
       # Records a `textDocument/didOpen` event. Replaces any existing entry (LSP clients may re-open a
-      # previously closed URI; the new version is authoritative).
+      # previously closed URI; the new version is authoritative) and clears any desynchronised mark — the
+      # payload carries the client's full text, so the two views agree again.
       def open(uri:, bytes:, version:)
+        @desynchronized.delete(uri)
         @entries[uri] = Entry.new(uri: uri, bytes: bytes, version: version)
       end
 
-      # Records a `textDocument/didChange` event under FULL sync. The full new buffer text replaces the entry.
-      # If the client sends a `didChange` for a URI that was never opened (spec violation), the entry is still
+      # Records a full-text `textDocument/didChange`. The full new buffer text replaces the entry. If the
+      # client sends a `didChange` for a URI that was never opened (spec violation), the entry is still
       # created — defensive.
       def change(uri:, bytes:, version:)
+        @desynchronized.delete(uri)
         @entries[uri] = Entry.new(uri: uri, bytes: bytes, version: version)
       end
 
+      # Applies a `textDocument/didChange` payload under INCREMENTAL sync. Each entry of `changes` is applied
+      # in order against the result of the previous one, per the LSP contract.
+      #
+      # On success the entry is replaced with the spliced text at the new version. On failure — a malformed
+      # change, or a range edit for a URI with no held buffer — the held text is left EXACTLY as it was and the
+      # URI is marked desynchronised: the server's view and the editor's view have diverged, and every position
+      # computed from the stale text would be wrong. Consumers check {#desynchronized?} and decline to answer
+      # rather than answering wrongly; the mark clears on the next `didOpen` or full-text change.
+      #
+      # @return [Boolean] true when the changes were applied.
+      def apply_changes(uri:, changes:, version:)
+        text = IncrementalSync.apply_all(@entries[uri]&.bytes, changes)
+        @desynchronized.delete(uri)
+        @entries[uri] = Entry.new(uri: uri, bytes: text, version: version)
+        true
+      rescue IncrementalSync::UnappliableChange => e
+        @desynchronized[uri] = e.message
+        false
+      end
+
+      # @return [Boolean] true when the last `didChange` for `uri` could not be applied, so the held text no
+      #   longer matches the editor's.
+      def desynchronized?(uri)
+        @desynchronized.key?(uri)
+      end
+
+      # @return [String, nil] why `uri` is desynchronised, for the log line; nil when it is in sync.
+      def desynchronization_reason(uri)
+        @desynchronized[uri]
+      end
+
       # Records a `textDocument/didClose` event. The entry is removed. Subsequent reads via `#[]` return nil.
       def close(uri:)
+        @desynchronized.delete(uri)
         @entries.delete(uri)
       end
 

data/lib/rigor/language_server/completion_provider.rb

@@ -8,6 +8,7 @@ require_relative "../environment"
 require_relative "../reflection"
 require_relative "../scope"
 require_relative "../source/node_locator"
+require_relative "../source/node_children"
 require_relative "../inference/scope_indexer"
 require_relative "../type/nominal"
 require_relative "../type/singleton"
@@ -187,7 +188,7 @@ module Rigor
              n.location.start_offset <= symbol_offset && symbol_offset <= n.location.end_offset
             result = n
           end
-          n.compact_child_nodes.each(&walk)
+          n.rigor_each_child(&walk)
         end
         walk.call(root)
         result

data/lib/rigor/language_server/diagnostic_publisher.rb

@@ -80,6 +80,10 @@ module Rigor
         # The buffer may have been closed during the debounce window — drop the publish; the empty
         # notification from didClose already cleared the markers.
         return if entry.nil?
+        # An incremental change the table could not apply: the held text no longer matches the editor's, so
+        # every span we could compute from it would be misplaced. Clear the markers and stay silent until a
+        # full-text change or a re-open re-establishes the buffer.
+        return notify(uri, []) if @buffer_table.desynchronized?(uri)
 
         diagnostics = run_analysis(path: path, bytes: entry.bytes)
         notify(uri, diagnostics)

data/lib/rigor/language_server/document_symbol_provider.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "uri"
 require_relative "buffer_resolution"
+require_relative "../source/node_children"
 
 module Rigor
   module LanguageServer
@@ -67,7 +68,7 @@ module Rigor
         when Prism::DefNode
           block.call(def_symbol(node, in_namespace: in_namespace))
         else
-          node.compact_child_nodes.each do |child|
+          node.rigor_each_child do |child|
             each_decl(child, in_namespace: in_namespace, &block)
           end
         end

data/lib/rigor/language_server/folding_range_provider.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "uri"
 require_relative "buffer_resolution"
+require_relative "../source/node_children"
 
 module Rigor
   module LanguageServer
@@ -48,7 +49,7 @@ module Rigor
              Prism::BlockNode
           add_range(node, ranges)
         end
-        node.compact_child_nodes.each { |child| walk(child, ranges) }
+        node.rigor_each_child { |child| walk(child, ranges) }
       end
 
       def add_range(node, ranges)

data/lib/rigor/language_server/incremental_sync.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require "strscan"
+
+module Rigor
+  module LanguageServer
+    # Applies LSP `TextDocumentContentChangeEvent`s to a held buffer under `TextDocumentSyncKind::Incremental`.
+    #
+    # ## Why the offsets need care
+    #
+    # An LSP `Position#character` counts **UTF-16 code units** (`positionEncoding: "utf-16"`, the protocol
+    # default and the only encoding every client supports), while a Ruby String indexes by **codepoint**. The
+    # two agree for every character in the Basic Multilingual Plane — all of ASCII, Latin-1, Greek, Cyrillic,
+    # kana and common kanji — and disagree above U+FFFF, where an emoji or a CJK-extension ideograph is ONE
+    # Ruby character and TWO UTF-16 code units. Reading one as the other shifts every subsequent edit on the
+    # line, and a shifted edit desynchronises the server's text from what the editor shows for the rest of the
+    # session: every diagnostic after that point lands on the wrong span, silently.
+    #
+    # So the conversion is explicit. {.utf16_offset_to_index} walks the line one character at a time, charging
+    # 2 code units for a codepoint above U+FFFF and 1 for everything else, and stops when the requested count
+    # is spent. An all-ASCII line short-circuits the walk, since there the offset IS the index — that is the
+    # keystroke path, and `String#ascii_only?` answers it from the cached coderange.
+    #
+    # ## Failure is a resync, never a guess
+    #
+    # A change whose shape cannot be applied confidently raises {UnappliableChange} rather than producing a
+    # best-effort buffer: {BufferTable#apply_changes} then keeps the last known-good text and marks the URI
+    # desynchronised, which suppresses diagnostics until a full-text change or a re-open re-establishes the
+    # buffer. A stale-but-flagged buffer is recoverable; a silently wrong one is not.
+    module IncrementalSync
+      # Raised when a `contentChanges` entry cannot be applied to the held text: a malformed payload, a
+      # position that is not a non-negative Integer pair, or a range edit against a buffer the server never
+      # received a `didOpen` / full-text change for.
+      class UnappliableChange < StandardError; end
+
+      # LSP considers a line delimited by `\n`, `\r\n`, or a lone `\r`. Ruby's own line splitting only knows
+      # `\n`, so the scan is explicit.
+      LINE_TERMINATOR = /\r\n|\n|\r/
+
+      # UTF-8 encodes exactly the codepoints above the BMP — the ones UTF-16 must encode as a surrogate pair —
+      # in four bytes. So a character's UTF-8 byte length answers "one code unit or two?" without decoding it.
+      SURROGATE_PAIR_BYTES = 4
+
+      module_function
+
+      # Applies every change in order, each against the result of the previous — the LSP contract for a
+      # multi-change `didChange` notification.
+      #
+      # @param text [String, nil] the held buffer text; nil when no buffer is open for the URI.
+      # @param changes [Array<Hash>] the `contentChanges` array.
+      # @return [String] the new buffer text.
+      # @raise [UnappliableChange] if any change cannot be applied.
+      def apply_all(text, changes)
+        raise UnappliableChange, "contentChanges must be an Array, got #{changes.class}" unless changes.is_a?(Array)
+
+        changes.reduce(text) { |acc, change| apply(acc, change) }
+      end
+
+      # Applies one `TextDocumentContentChangeEvent`.
+      #
+      # Two shapes are legal under incremental sync. Without `range` the entry is the full new document text
+      # (clients fall back to it for a paste, an undo, or a file reload, and it stays legal under
+      # `Incremental`); with `range` it replaces the spanned text. `rangeLength` is the deprecated pre-3.16
+      # companion to `range` and is accepted-but-ignored: it is redundant with `range`, historically ambiguous
+      # about its units, and `range` is the authoritative field.
+      #
+      # @raise [UnappliableChange]
+      def apply(text, change)
+        raise UnappliableChange, "contentChanges entry must be a Hash, got #{change.class}" unless change.is_a?(Hash)
+
+        replacement = change[:text]
+        raise UnappliableChange, "contentChanges entry has no `text`" unless replacement.is_a?(String)
+
+        range = change[:range]
+        return replacement.dup if range.nil?
+        raise UnappliableChange, "`range` must be a Hash, got #{range.class}" unless range.is_a?(Hash)
+        raise UnappliableChange, "range edit for a URI with no open buffer" if text.nil?
+
+        splice(text, range, replacement)
+      end
+
+      # Replaces the `range` span of `text` with `replacement`.
+      #
+      # Text that is not valid UTF-8 makes the line scan itself raise. That is not a buffer JSON transport can
+      # deliver, but if one appears there is no offset arithmetic to be confident about, so it becomes a
+      # resync like any other unappliable shape.
+      def splice(text, range, replacement)
+        spans = line_spans(text)
+        from = char_offset(text, spans, range[:start])
+        # A client that inverts the range — or an `end` rounded below `start` off a mid-surrogate
+        # position — would otherwise slice backwards; collapse to an insertion at `from` instead.
+        to = char_offset(text, spans, range[:end]).clamp(from, text.length)
+        "#{text[0, from]}#{replacement}#{text[to..]}"
+      rescue ArgumentError, Encoding::CompatibilityError => e
+        raise UnappliableChange, "held text is not valid UTF-8: #{e.message}"
+      end
+
+      # @return [Array<Array(Integer, Integer)>] one `[content_start, content_end]` pair per line, in Ruby
+      #   character indices. `content_end` excludes the line terminator, so it doubles as the clamp target for
+      #   an over-long `character`. A trailing terminator yields a final empty span — the virtual last line an
+      #   editor puts the cursor on, and the anchor for an end-of-document insert.
+      def line_spans(text)
+        spans = []
+        scanner = StringScanner.new(text)
+        start = 0
+        while scanner.skip_until(LINE_TERMINATOR)
+          stop = scanner.charpos
+          spans << [start, stop - scanner.matched.length]
+          start = stop
+        end
+        spans << [start, text.length]
+        spans
+      end
+
+      # Converts an LSP `Position` into a Ruby character index into `text`.
+      #
+      # A `line` past the last line clamps to the end of the document rather than raising: clients do address
+      # the position one past the final line, and the clamp is what the protocol's own end-of-document
+      # convention implies.
+      def char_offset(text, spans, position)
+        line = position_field(position, :line)
+        character = position_field(position, :character)
+        return text.length if line >= spans.length
+
+        start, stop = spans[line]
+        start + utf16_offset_to_index(text[start...stop], character)
+      end
+
+      # Converts a UTF-16 code-unit offset into `line` to a Ruby character index into the same line.
+      #
+      # Clamps an offset past the end of the line to the line length, per LSP's rule that a `character`
+      # greater than the line length defaults back to the line length.
+      def utf16_offset_to_index(line, units)
+        # Fast path: on an all-ASCII line one UTF-16 code unit is one Ruby character, so the offset is the
+        # index. This is the keystroke case, and `ascii_only?` reads the string's cached coderange.
+        return units.clamp(0, line.length) if line.ascii_only?
+
+        index = 0
+        remaining = units
+        line.each_char do |char|
+          break if remaining <= 0
+
+          remaining -= char.bytesize == SURROGATE_PAIR_BYTES ? 2 : 1
+          index += 1
+        end
+        # `remaining` below zero means the offset addressed the low half of a surrogate pair — a position no
+        # conforming client sends. Round DOWN to the character boundary; splitting the pair is not an option.
+        remaining.negative? ? index - 1 : index
+      end
+
+      def position_field(position, key)
+        value = position.is_a?(Hash) ? position[key] : nil
+        return value if value.is_a?(Integer) && !value.negative?
+
+        raise UnappliableChange, "position `#{key}` must be a non-negative Integer, got #{value.inspect}"
+      end
+    end
+  end
+end

data/lib/rigor/language_server/selection_range_provider.rb

@@ -4,6 +4,7 @@ require "prism"
 
 require_relative "uri"
 require_relative "buffer_resolution"
+require_relative "../source/node_children"
 
 module Rigor
   module LanguageServer
@@ -48,7 +49,7 @@ module Rigor
         return chain unless node.location && offset_in?(node.location, offset)
 
         chain << node
-        node.compact_child_nodes.each { |child| ancestor_chain(child, offset, chain) }
+        node.rigor_each_child { |child| ancestor_chain(child, offset, chain) }
         chain
       end
 

data/lib/rigor/language_server/server.rb

@@ -21,8 +21,15 @@ module Rigor
       ERROR_SERVER_NOT_INITIALIZED = -32_002
       ERROR_INVALID_REQUEST_AFTER_SHUTDOWN = -32_600
 
-      # `TextDocumentSyncKind::Full = 1`. Slice 10 (deferred) promotes to `Incremental = 2`.
-      TEXT_DOCUMENT_SYNC_FULL = 1
+      # `TextDocumentSyncKind::Incremental = 2`: `didChange` carries range edits, which `IncrementalSync`
+      # splices into the buffer the table already holds instead of re-sending — and re-parsing — the whole
+      # document on every keystroke. The full-text entry form (a `contentChanges` entry with no `range`) stays
+      # legal under this mode and is still handled.
+      TEXT_DOCUMENT_SYNC_INCREMENTAL = 2
+
+      # LSP `PositionEncodingKind`. UTF-16 is the protocol default and the encoding `IncrementalSync` does its
+      # offset arithmetic in; advertising it explicitly states the contract rather than leaving it implied.
+      POSITION_ENCODING_UTF16 = "utf-16"
 
       # Methods callable BEFORE `initialize`. Per LSP spec § 3 only `initialize` and `exit` are allowed
       # pre-initialization; every other request returns `ServerNotInitialized`. We also accept `shutdown` so a
@@ -151,9 +158,10 @@ module Rigor
 
       def advertised_capabilities
         caps = {
+          positionEncoding: POSITION_ENCODING_UTF16,
           textDocumentSync: {
             openClose: true,
-            change: TEXT_DOCUMENT_SYNC_FULL
+            change: TEXT_DOCUMENT_SYNC_INCREMENTAL
           }
         }
         caps[:hoverProvider] = true if @hover_provider
@@ -213,19 +221,21 @@ module Rigor
         nil
       end
 
-      # textDocument/didChange under FULL sync. Each `contentChanges` entry carries only `{ text: }`; the LAST
-      # entry is the new full document text. Per LSP spec § "FULL sync" the array MUST be exactly one entry in
-      # practice — we still take `.last` defensively for clients that pad. Triggers `publishDiagnostics`
-      # afterwards.
+      # textDocument/didChange under INCREMENTAL sync. Every `contentChanges` entry is applied in order, each
+      # against the result of the previous — an entry with a `range` splices that span, an entry without one is
+      # the full new document text. The application (and its UTF-16 offset arithmetic) lives in
+      # `IncrementalSync`; the table keeps the last known-good text and flags the URI when a change cannot be
+      # applied. Triggers `publishDiagnostics` either way: a desynchronised buffer publishes an EMPTY set,
+      # which clears the markers instead of leaving stale ones on screen.
       def handle_did_change(params)
         doc = params.fetch(:textDocument)
         changes = params.fetch(:contentChanges)
         return nil if changes.empty?
 
         uri = doc.fetch(:uri)
-        @buffer_table.change(
+        @buffer_table.apply_changes(
           uri: uri,
-          bytes: changes.last.fetch(:text),
+          changes: changes,
           version: doc.fetch(:version)
         )
         @publisher&.publish_for(uri)

data/lib/rigor/language_server/signature_help_provider.rb

@@ -8,6 +8,7 @@ require_relative "../environment"
 require_relative "../reflection"
 require_relative "../scope"
 require_relative "../source/node_locator"
+require_relative "../source/node_children"
 require_relative "../inference/scope_indexer"
 require_relative "../type/nominal"
 require_relative "../type/singleton"
@@ -99,7 +100,7 @@ module Rigor
           if n.is_a?(Prism::CallNode) && n.arguments && offset_in?(n.arguments.location, cursor_offset)
             result = n # Innermost-wins because we keep walking children.
           end
-          n.compact_child_nodes.each(&walk)
+          n.rigor_each_child(&walk)
         end
         walk.call(root)
         result

data/lib/rigor/language_server.rb

@@ -9,6 +9,7 @@ module Rigor
   end
 end
 
+require_relative "language_server/incremental_sync"
 require_relative "language_server/buffer_table"
 require_relative "language_server/uri"
 require_relative "language_server/project_context"

data/lib/rigor/plugin/base.rb

@@ -8,6 +8,9 @@ require "prism"
 require_relative "manifest"
 require_relative "node_context"
 require_relative "../analysis/diagnostic"
+# `producer generation_cap:` defaults to (and validates against) `Cache::Store::UNBOUNDED_GENERATIONS`, and a
+# plugin class body can be evaluated before anything else pulled the cache layer in.
+require_relative "../cache/store"
 require_relative "../source/node_walker"
 
 module Rigor
@@ -86,17 +89,40 @@ module Rigor
         #
         # Producer ids are auto-prefixed `plugin.<manifest.id>.` at the cache layer (slice 6-C) so plugin-side
         # ids cannot collide with built-in producers.
-        def producer(id, watch: nil, serialize: nil, deserialize: nil, &block)
+        #
+        # `generation_cap:` declares how many generations of this producer's entries survive
+        # `Cache::Store#evict!`'s compaction pass. The default —
+        # `Cache::Store::UNBOUNDED_GENERATIONS` — suits the usual plugin producer, which keys per file or per
+        # discovered unit and keeps many entries live at once; only the size-based LRU pass bounds it. A
+        # producer whose entries are WHOLE-PROJECT and content-keyed (each run's inputs produce a fresh key
+        # and orphan the previous one) should declare a small positive Integer instead, so the orphans are
+        # reclaimed rather than accumulating under the global byte cap.
+        def producer(id, watch: nil, serialize: nil, deserialize: nil,
+                     generation_cap: Cache::Store::UNBOUNDED_GENERATIONS, &block)
           raise ArgumentError, "Plugin::Base.producer requires a block body" if block.nil?
 
           validate_producer_watch!(watch)
+          validate_producer_generation_cap!(id, generation_cap)
           @producers ||= {}
           @producers[id.to_sym] = {
-            block: block, watch: watch, serialize: serialize, deserialize: deserialize
+            block: block, watch: watch, serialize: serialize, deserialize: deserialize,
+            generation_cap: generation_cap
           }.freeze
           id.to_sym
         end
 
+        # A bad `generation_cap:` is caught at class-definition time (plugin load) rather than at the first
+        # `cache_for` round-trip, so the plugin author sees it before any caching happens.
+        def validate_producer_generation_cap!(id, generation_cap)
+          return if generation_cap == Cache::Store::UNBOUNDED_GENERATIONS
+          return if generation_cap.is_a?(Integer) && generation_cap.positive?
+
+          raise ArgumentError,
+                "Plugin::Base.producer #{id.inspect} generation_cap: must be a positive Integer or " \
+                "#{Cache::Store::UNBOUNDED_GENERATIONS.inspect}, got #{generation_cap.inspect}"
+        end
+        private :validate_producer_generation_cap!
+
         # ADR-60 WD3 — `watch:` is nil (no glob coverage), a static tuple Array, or a Proc evaluated per
         # `cache_for` call.
         def validate_producer_watch!(watch)
@@ -390,8 +416,8 @@ module Rigor
         # the fact slot.
         #
         # Renamed from `type_specifier` (ADR-80): the old name read as a parallel to `dynamic_return` (a
-        # type) when it actually returns facts. {.type_specifier} survives as a deprecating alias through
-        # 0.2.x and is removed in 0.3.0.
+        # type) when it actually returns facts. The old verb was a deprecating alias through 0.2.x and is
+        # gone in 0.3.0 — `narrowing_facts` is the only spelling.
         def narrowing_facts(methods:, &block)
           raise ArgumentError, "Plugin::Base.narrowing_facts requires a block body" if block.nil?
           unless methods.is_a?(Array) && !methods.empty? &&
@@ -401,30 +427,17 @@ module Rigor
                   "got #{methods.inspect}"
           end
 
-          @type_specifiers ||= []
-          @type_specifiers << { methods: methods.map(&:to_sym).freeze, block: block }.freeze
+          @narrowing_facts_rules ||= []
+          @narrowing_facts_rules << { methods: methods.map(&:to_sym).freeze, block: block }.freeze
           nil
         end
 
-        # DEPRECATED (ADR-80) — renamed to {.narrowing_facts}. This hook supplies post-return narrowing
-        # *facts*, not a type; the old name misleads by parallel with {.dynamic_return}. Retained as a
-        # warning-emitting alias through 0.2.x; REMOVED in 0.3.0. Migrate `type_specifier methods: …` →
-        # `narrowing_facts methods: …`.
-        def type_specifier(methods:, &)
-          unless @type_specifier_deprecation_warned
-            @type_specifier_deprecation_warned = true
-            warn("[rigor] Plugin::Base.type_specifier is deprecated (ADR-80) and will be " \
-                 "removed in Rigor 0.3.0; rename it to `narrowing_facts`. (#{name})")
-          end
-          narrowing_facts(methods:, &)
-        end
-
-        # Frozen snapshot of the declared type-specifier rules. Memoised for the same reason as
+        # Frozen snapshot of the declared narrowing-facts rules. Memoised for the same reason as
         # {dynamic_returns} — consulted per plugin per dispatch, over an array fixed at class-definition
         # time.
         # rubocop:disable Naming/MemoizedInstanceVariableName -- see dynamic_returns
-        def type_specifiers
-          @type_specifiers_snapshot ||= (@type_specifiers || []).dup.freeze
+        def narrowing_facts_rules
+          @narrowing_facts_rules_snapshot ||= (@narrowing_facts_rules || []).dup.freeze
         end
         # rubocop:enable Naming/MemoizedInstanceVariableName
       end
@@ -558,8 +571,8 @@ module Rigor
       # ADR-37 slice 2 — the post-return narrowing facts contributed by this plugin's {.narrowing_facts}
       # rules for a call. The engine calls this from `StatementEvaluator`; a rule fires only when
       # `call_node.name` is one of its declared `methods:`. Failures isolate to [].
-      def type_specifier_facts(call_node:, scope:)
-        rules = self.class.type_specifiers
+      def narrowing_facts_for(call_node:, scope:)
+        rules = self.class.narrowing_facts_rules
         return [] if rules.empty? || !call_node.respond_to?(:name)
 
         name = call_node.name
@@ -741,6 +754,7 @@ module Rigor
           store.fetch_or_validate(
             producer_id: prefixed_id,
             key_descriptor: key_descriptor,
+            generation_cap: producer[:generation_cap],
             params: params,
             serialize: pair_serializer(producer[:serialize]),
             deserialize: pair_deserializer(producer[:deserialize])

data/lib/rigor/plugin/inflector.rb

@@ -18,9 +18,12 @@ module Rigor
     # rules are ingested by *statically parsing* `config/initializers/inflections.rb` in a later slice, never
     # by executing it.)
     #
-    # **Absence is silence, never a guess.** When `ActiveSupport::Inflector` cannot be loaded (a
-    # misconfiguration — the consuming plugins declare it as a dependency, so it is present in practice), the
-    # inflection methods raise {Unavailable} rather than approximate. That raise propagates to the caller's
+    # **Absence is silence, never a guess.** ActiveSupport is resolved from Rigor's host gem environment
+    # first, then from the analyzed project's own bundler install tree ({Isolation.target_bundle_root},
+    # ADR-90) — a Rails project always carries its locked activesupport on disk, and that copy is the
+    # higher-fidelity source of inflection rules anyway. When neither resolves (a standalone install
+    # analyzing a project whose bundle is not installed), the inflection methods raise {Unavailable}
+    # rather than approximate. That raise propagates to the caller's
     # per-plugin rescue boundary, so the inflection-dependent check degrades to **no diagnostics** — reduced
     # coverage, never a wrong fact. A consumer that wants to fail cleanly up front can gate on {available?}
     # and emit a single load-error.
@@ -39,6 +42,12 @@ module Rigor
       FEATURE = "active_support/inflector"
       RECEIVER = "ActiveSupport::Inflector"
 
+      # The bundled plugins whose checks consume this helper (each README documents the dependency). Used
+      # by `rigor plugins` (ADR-90) to probe {available?} at activation time — so a standalone install
+      # where inflection silently degrades reports the degradation instead of an unqualified `[OK]`. When
+      # a new plugin adopts the helper, add its manifest id here.
+      CONSUMER_PLUGIN_IDS = %w[actionmailer actionpack activerecord factorybot rails-routes].freeze
+
       # Raised when `ActiveSupport::Inflector` is required for an inflection but cannot be loaded. Caught by
       # the per-plugin isolation boundary, so it surfaces as "this plugin produced no diagnostics" rather than
       # a wrong inflection.

data/lib/rigor/plugin/io_boundary.rb

@@ -97,8 +97,12 @@ module Rigor
       private
 
       def record_file_entry(path, contents)
+        # ADR-87 WD1 — the boundary descriptor is validation-only (it never keys a cache), so a plugin-read
+        # file rides the stat-then-digest `:stat` tier: a warm run stat-checks the (on a Rails monorepo,
+        # 30k+ file) plugin-read set instead of re-hashing it. The digest is taken from the in-memory content
+        # we just read; `FileEntry.stat` stats the same path to pack the tuple.
         digest = Digest::SHA256.hexdigest(contents)
-        entry = Cache::Descriptor::FileEntry.new(path: path, comparator: :digest, value: digest)
+        entry = Cache::Descriptor::FileEntry.stat(path: path, digest: digest)
         @mutex.synchronize { @file_entries[path] = entry }
       end