rigortype 0.3.0 → 0.3.2

data/lib/rigor/language_server/server.rb

@@ -21,8 +21,15 @@ module Rigor
       ERROR_SERVER_NOT_INITIALIZED = -32_002
       ERROR_INVALID_REQUEST_AFTER_SHUTDOWN = -32_600
 
-      # `TextDocumentSyncKind::Full = 1`. Slice 10 (deferred) promotes to `Incremental = 2`.
-      TEXT_DOCUMENT_SYNC_FULL = 1
+      # `TextDocumentSyncKind::Incremental = 2`: `didChange` carries range edits, which `IncrementalSync`
+      # splices into the buffer the table already holds instead of re-sending — and re-parsing — the whole
+      # document on every keystroke. The full-text entry form (a `contentChanges` entry with no `range`) stays
+      # legal under this mode and is still handled.
+      TEXT_DOCUMENT_SYNC_INCREMENTAL = 2
+
+      # LSP `PositionEncodingKind`. UTF-16 is the protocol default and the encoding `IncrementalSync` does its
+      # offset arithmetic in; advertising it explicitly states the contract rather than leaving it implied.
+      POSITION_ENCODING_UTF16 = "utf-16"
 
       # Methods callable BEFORE `initialize`. Per LSP spec § 3 only `initialize` and `exit` are allowed
       # pre-initialization; every other request returns `ServerNotInitialized`. We also accept `shutdown` so a
@@ -88,6 +95,7 @@ module Rigor
         when "exit"                   then handle_exit
         when "textDocument/didOpen"   then handle_did_open(params)
         when "textDocument/didChange" then handle_did_change(params)
+        when "textDocument/didSave"   then handle_did_save(params)
         when "textDocument/didClose"  then handle_did_close(params)
         when "textDocument/hover"               then handle_hover(params)
         when "textDocument/documentSymbol"      then handle_document_symbol(params)
@@ -151,9 +159,13 @@ module Rigor
 
       def advertised_capabilities
         caps = {
+          positionEncoding: POSITION_ENCODING_UTF16,
           textDocumentSync: {
             openClose: true,
-            change: TEXT_DOCUMENT_SYNC_FULL
+            change: TEXT_DOCUMENT_SYNC_INCREMENTAL,
+            # `includeText: false` — the round reads the file the client just wrote, so the payload's copy
+            # would be redundant. See `handle_did_save`.
+            save: { includeText: false }
           }
         }
         caps[:hoverProvider] = true if @hover_provider
@@ -213,25 +225,42 @@ module Rigor
         nil
       end
 
-      # textDocument/didChange under FULL sync. Each `contentChanges` entry carries only `{ text: }`; the LAST
-      # entry is the new full document text. Per LSP spec § "FULL sync" the array MUST be exactly one entry in
-      # practice — we still take `.last` defensively for clients that pad. Triggers `publishDiagnostics`
-      # afterwards.
+      # textDocument/didChange under INCREMENTAL sync. Every `contentChanges` entry is applied in order, each
+      # against the result of the previous — an entry with a `range` splices that span, an entry without one is
+      # the full new document text. The application (and its UTF-16 offset arithmetic) lives in
+      # `IncrementalSync`; the table keeps the last known-good text and flags the URI when a change cannot be
+      # applied. Triggers `publishDiagnostics` either way: a desynchronised buffer publishes an EMPTY set,
+      # which clears the markers instead of leaving stale ones on screen.
       def handle_did_change(params)
         doc = params.fetch(:textDocument)
         changes = params.fetch(:contentChanges)
         return nil if changes.empty?
 
         uri = doc.fetch(:uri)
-        @buffer_table.change(
+        @buffer_table.apply_changes(
           uri: uri,
-          bytes: changes.last.fetch(:text),
+          changes: changes,
           version: doc.fetch(:version)
         )
         @publisher&.publish_for(uri)
         nil
       end
 
+      # textDocument/didSave notification. Marks the buffer clean — the client has written it, so the held
+      # text and the file on disk agree — and starts a whole-project publish round (#246).
+      #
+      # This is where whole-project scope lives, rather than on `didChange`: a round costs ~0.6s on a
+      # mid-sized project against a 250ms `didChange` p50 budget, and "the rest of the project catches up"
+      # is what saving means to the user. Because the saved bytes are the bytes on disk, the round needs no
+      # buffer binding at all. Design: `docs/design/20260517-language-server.md` § "Whole-project publishes
+      # on save".
+      def handle_did_save(params)
+        uri = params.fetch(:textDocument).fetch(:uri)
+        @buffer_table.save(uri: uri)
+        @publisher&.publish_project(uri)
+        nil
+      end
+
       # textDocument/hover REQUEST. Slice 5 returns either a `Hover` payload (markdown contents wrapping type
       # + erased-RBS info) or nil when no expression is at the queried position. Nil maps to `result: null`
       # per LSP spec; clients suppress the popup. Returns `MethodNotFound` when no hover_provider is wired

data/lib/rigor/language_server.rb

@@ -9,10 +9,12 @@ module Rigor
   end
 end
 
+require_relative "language_server/incremental_sync"
 require_relative "language_server/buffer_table"
 require_relative "language_server/uri"
 require_relative "language_server/project_context"
 require_relative "language_server/debouncer"
+require_relative "language_server/publish_batcher"
 require_relative "language_server/synchronized_writer"
 require_relative "language_server/diagnostic_publisher"
 require_relative "language_server/hover_renderer"

data/lib/rigor/plugin/base.rb

@@ -8,6 +8,9 @@ require "prism"
 require_relative "manifest"
 require_relative "node_context"
 require_relative "../analysis/diagnostic"
+# `producer generation_cap:` defaults to (and validates against) `Cache::Store::UNBOUNDED_GENERATIONS`, and a
+# plugin class body can be evaluated before anything else pulled the cache layer in.
+require_relative "../cache/store"
 require_relative "../source/node_walker"
 
 module Rigor
@@ -86,17 +89,40 @@ module Rigor
         #
         # Producer ids are auto-prefixed `plugin.<manifest.id>.` at the cache layer (slice 6-C) so plugin-side
         # ids cannot collide with built-in producers.
-        def producer(id, watch: nil, serialize: nil, deserialize: nil, &block)
+        #
+        # `generation_cap:` declares how many generations of this producer's entries survive
+        # `Cache::Store#evict!`'s compaction pass. The default —
+        # `Cache::Store::UNBOUNDED_GENERATIONS` — suits the usual plugin producer, which keys per file or per
+        # discovered unit and keeps many entries live at once; only the size-based LRU pass bounds it. A
+        # producer whose entries are WHOLE-PROJECT and content-keyed (each run's inputs produce a fresh key
+        # and orphan the previous one) should declare a small positive Integer instead, so the orphans are
+        # reclaimed rather than accumulating under the global byte cap.
+        def producer(id, watch: nil, serialize: nil, deserialize: nil,
+                     generation_cap: Cache::Store::UNBOUNDED_GENERATIONS, &block)
           raise ArgumentError, "Plugin::Base.producer requires a block body" if block.nil?
 
           validate_producer_watch!(watch)
+          validate_producer_generation_cap!(id, generation_cap)
           @producers ||= {}
           @producers[id.to_sym] = {
-            block: block, watch: watch, serialize: serialize, deserialize: deserialize
+            block: block, watch: watch, serialize: serialize, deserialize: deserialize,
+            generation_cap: generation_cap
           }.freeze
           id.to_sym
         end
 
+        # A bad `generation_cap:` is caught at class-definition time (plugin load) rather than at the first
+        # `cache_for` round-trip, so the plugin author sees it before any caching happens.
+        def validate_producer_generation_cap!(id, generation_cap)
+          return if generation_cap == Cache::Store::UNBOUNDED_GENERATIONS
+          return if generation_cap.is_a?(Integer) && generation_cap.positive?
+
+          raise ArgumentError,
+                "Plugin::Base.producer #{id.inspect} generation_cap: must be a positive Integer or " \
+                "#{Cache::Store::UNBOUNDED_GENERATIONS.inspect}, got #{generation_cap.inspect}"
+        end
+        private :validate_producer_generation_cap!
+
         # ADR-60 WD3 — `watch:` is nil (no glob coverage), a static tuple Array, or a Proc evaluated per
         # `cache_for` call.
         def validate_producer_watch!(watch)
@@ -728,6 +754,7 @@ module Rigor
           store.fetch_or_validate(
             producer_id: prefixed_id,
             key_descriptor: key_descriptor,
+            generation_cap: producer[:generation_cap],
             params: params,
             serialize: pair_serializer(producer[:serialize]),
             deserialize: pair_deserializer(producer[:deserialize])

data/lib/rigor/plugin/source_rbs_synthesis_reporter.rb

@@ -16,17 +16,23 @@ module Rigor
     # single reporter across the run; entries are appended one at a time during env build (before any per-file
     # analysis runs), so no locking is needed.
     class SourceRbsSynthesisReporter
-      Entry = Data.define(:plugin_id, :path, :message)
+      # `kind` separates the two outcomes the Runner reports differently (ADR-32 WD12): `:failed` is a
+      # synthesis that raised or could not parse, `:not_honoured` a synthesis that SUCCEEDED while silently
+      # dropping an annotation it parsed. They are not the same news — the first says the file contributed
+      # nothing, the second that it contributed all but one thing — so they carry distinct diagnostic ids.
+      # Defaults to `:failed`, the pre-WD12 meaning, so an older caller records what it always did.
+      Entry = Data.define(:plugin_id, :path, :message, :kind)
 
       def initialize
         @entries = []
       end
 
-      def record(plugin_id:, path:, message:)
+      def record(plugin_id:, path:, message:, kind: :failed)
         @entries << Entry.new(
           plugin_id: plugin_id.to_s.dup.freeze,
           path: path.to_s.dup.freeze,
-          message: message.to_s.dup.freeze
+          message: message.to_s.dup.freeze,
+          kind: kind
         )
         nil
       end

data/lib/rigor/protection/closure_kill_oracle.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+require "tempfile"
+
+require_relative "../analysis/buffer_binding"
+require_relative "../analysis/runner"
+require_relative "diagnostic_oracle"
+require_relative "discovery_seed"
+require_relative "kill_signature"
+
+module Rigor
+  module Protection
+    # Issue #254 — the ADR-69 Seam 1 kill oracle that judges a mutant by the WHOLE dependent closure.
+    #
+    # {DiagnosticOracle} re-analyses the mutated file alone, so the most valuable catch Rigor delivers is
+    # scored as a miss: change what a method returns and the diagnostic lands in its *callers*, which is
+    # exactly the cross-file reach the analyzer exists for. This oracle counts a kill when a new diagnostic
+    # (against the clean baseline of the same file set) appears anywhere in `{mutated} ∪ dependents[mutated]`
+    # — the ADR-46 reverse edge, supplied by {DependencyClosure}.
+    #
+    # **It is strictly additive, by construction.** The mutated file's verdict is delegated to a real
+    # {DiagnosticOracle}, built with exactly the knowledge the shipped oracle would have had (the
+    # `discovery-seeded-mutation-sites` seed when that feature is adopted, nothing when it is not), and only
+    # when that says "survived" is the closure consulted. So this feature moves `killed` in ONE direction and
+    # cannot silently re-decide a mutant the current oracle already kills. That separation is deliberate: what
+    # the oracle KNOWS is #253/#260's axis, and mixing the two here made the measurement uninterpretable —
+    # on redmine `app/models` an early build lost 11 kills to the richer knowledge while gaining none from the
+    # closure, and the two effects were indistinguishable in the total.
+    #
+    # **The mutant's bytes are never on the measured file's disk.** For the closure half they are written to a
+    # process-private temp file and bound to the measured path through {Analysis::BufferBinding} — the #146
+    # editor seam, whose whole purpose is "analyse THESE bytes at THAT logical path". The binding reaches three
+    # places that would otherwise read the file as it sits on disk:
+    #
+    # 1. the per-file parse (`Runner#parse_source` resolves through the binding);
+    # 2. the discovery tables the dependents resolve the mutated `def`s through
+    #    ({DiscoverySeed.tables_for_buffer} — the change-detection half: the mutated path's digest is the
+    #    mutant's, so its bundle is invalidated and re-walked);
+    # 3. diagnostic locations, which stay on the LOGICAL path, so a signature computed against a mutant is
+    #    comparable with the baseline's.
+    #
+    # Miss any of them and every dependent reads the clean bytes, no diagnostic ever appears outside the
+    # mutated file, and the run reports a plausible number that measured nothing new.
+    #
+    # Cost. The closure is consulted only for the mutants the mutated file did not already kill (≈30% of them
+    # on Rigor's own `lib`), and each costs one analysis per dependent (mean 1.85 there) plus a ≈15ms seed
+    # re-fold. Every per-mutant analysis keeps `cache_store: nil`: a `--threshold` CI gate must never be
+    # handed a stale clean hit.
+    class ClosureKillOracle
+      # The clean baseline of one measured file, kept as TWO sets rather than their union. The mutated file's
+      # half must be compared against exactly what the single-file oracle would compare against — a diagnostic
+      # the closure baseline happens to carry at the mutated path (it analyses that file under cross-file
+      # knowledge the single-file run does not have) must not mask a kill the shipped oracle would report.
+      Baseline = Data.define(:own, :dependents)
+
+      # @param configuration [Rigor::Configuration]
+      # @param environment [Rigor::Environment] built once by the caller.
+      # @param project_scan [Rigor::Analysis::ProjectScan] built once by the caller; adopted per analysis
+      #   through `prebuilt:`, exactly as {DiagnosticOracle} does.
+      # @param paths [Array<String>] the measured file set, in canonical order (the seed's span: a class
+      #   declared outside it stays unknown, as it does for Tier 1's seed and for {DiscoverySeed}).
+      # @param dependents [Hash{String => Array<String>}] {DependencyClosure} map, restricted to `paths`.
+      # @param seed_bundles [Hash{String => Hash}] {DiscoverySeed.bundles} over the same `paths`.
+      # @param discovery_seed [Hash, nil] the `discovery-seeded-mutation-sites` seed when that feature is also
+      #   adopted, nil otherwise. It goes to the delegated {DiagnosticOracle} verbatim, so the mutated file's
+      #   verdict is byte-for-byte the verdict that feature combination produces without this one; its
+      #   `param_inferred_types` slot additionally rides the per-mutant closure seed, so an admitted site is
+      #   judged with the knowledge that admitted it (issue #260's amended decision). The table is not
+      #   refreshed per mutant — the collector is a whole-project pre-pass, and one mutated method body does
+      #   not justify re-running it thousands of times.
+      def initialize(configuration:, environment:, project_scan:, paths:, dependents:, seed_bundles:,
+                     discovery_seed: nil)
+        @configuration = configuration
+        @environment = environment
+        @project_scan = project_scan
+        @paths = paths
+        @dependents = dependents
+        @seed_bundles = seed_bundles
+        @discovery_seed = discovery_seed
+        @param_inferred_types = discovery_seed && discovery_seed[:param_inferred_types]
+        @single = DiagnosticOracle.new(
+          configuration: configuration, environment: environment, project_scan: project_scan,
+          discovery_seed: discovery_seed
+        )
+      end
+
+      # The clean baselines a mutant must add a diagnostic to: the mutated file's (the shipped oracle's own,
+      # unchanged) and the dependents'. Computed once per measured file by the caller ({MutationScanner}),
+      # never per mutant. The dependents' half is bound through the same buffer machinery a mutant is, so the
+      # clean and mutant runs of the closure differ in exactly one input — the bytes.
+      def baseline(source:, path:)
+        Baseline.new(
+          own: @single.baseline(source: source, path: path),
+          dependents: dependents_signatures(source, path)
+        )
+      end
+
+      # Killed iff the mutant introduces a diagnostic the baseline did not carry — in the mutated file (the
+      # shipped verdict), or, failing that, in any dependent of it (what this feature adds).
+      def killed?(mutant_source:, path:, baseline:)
+        return true if @single.killed?(mutant_source: mutant_source, path: path, baseline: baseline.own)
+
+        dependents = @dependents[path] || []
+        return false if dependents.empty?
+
+        dependents_signatures(mutant_source, path).any? { |sig| !baseline.dependents.include?(sig) }
+      end
+
+      # The file set a kill is looked for in: the mutated file plus its measured dependents.
+      def closure_for(path)
+        [path, *(@dependents[path] || [])]
+      end
+
+      private
+
+      # The diagnostic signatures the dependents of `path` report while `source` stands in for it. Empty (and
+      # analysis-free) when nothing depends on the file — 120 of Rigor's own 349 `lib` files.
+      def dependents_signatures(source, path)
+        dependents = @dependents[path] || []
+        return Set.new if dependents.empty?
+
+        with_mutant(source, path) do |buffer, seed|
+          KillSignature.signatures_of(analyse(dependents, buffer, seed))
+        end
+      end
+
+      # Binds `source` to `path` for the duration of the block, yielding the binding and the seed tables
+      # rebuilt against it. One temp file per process (never per mutant): the digest that invalidates the
+      # mutated file's bundle is taken over the file's CONTENT, and the per-run digest memo is not installed
+      # out here, so rewriting one path in place cannot serve a stale answer.
+      def with_mutant(source, path)
+        File.binwrite(mutant_file.path, source)
+        buffer = Analysis::BufferBinding.new(logical_path: path, physical_path: mutant_file.path)
+        yield(buffer, seed_for(buffer))
+      end
+
+      # The process-private mutant file. Created lazily, and re-created after a fork ({CLI::MutationForkScan}
+      # workers must not share one path), which the pid guard detects.
+      def mutant_file
+        return @mutant_file if @mutant_file && @mutant_pid == Process.pid
+
+        @mutant_pid = Process.pid
+        @mutant_file = Tempfile.new(["rigor-mutant-", ".rb"])
+      end
+
+      def seed_for(buffer)
+        tables = DiscoverySeed.tables_for_buffer(paths: @paths, bundles: @seed_bundles, buffer: buffer)
+        return tables if @param_inferred_types.nil? || @param_inferred_types.empty?
+
+        tables.merge(param_inferred_types: @param_inferred_types).freeze
+      end
+
+      # One analysis of `paths` with the mutant bound. `prebuilt:` keeps the RBS environment + whole-project
+      # pre-pass the caller paid for once; `discovery_seed:` (issue #260's runner seam) is what carries the
+      # cross-file knowledge into a prebuilt run, and here it is the MUTANT-refreshed table set — without it a
+      # dependent resolves the `def` still on disk and no mutation could ever be visible to it.
+      #
+      # `analyze_only:` is load-bearing, not an optimisation. A `buffer:` alone selects editor-mode option A,
+      # whose analysed set IS the buffer's single logical path — every other file is read by the pre-passes
+      # and emits nothing. A closure oracle built that way would report zero cross-file kills and look
+      # entirely plausible doing it. Passing both selects option B (#146), where the closure wins and the
+      # buffer is one member of it.
+      def analyse(paths, buffer, seed)
+        Analysis::Runner.new(
+          configuration: @configuration, environment: @environment, prebuilt: @project_scan,
+          cache_store: nil, collect_stats: false, buffer: buffer, discovery_seed: seed, analyze_only: paths
+        ).run(paths).diagnostics
+      end
+    end
+  end
+end

data/lib/rigor/protection/dependency_closure.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative "../analysis/runner"
+
+module Rigor
+  module Protection
+    # Issue #254 — the **dependent closure** the Tier-2 kill oracle re-analyses: for each measured file, the
+    # measured files that read a declaration or a method body from it.
+    #
+    # ADR-46 already records exactly this edge, but only under `record_dependencies: true` — an ordinary
+    # analysis (and every per-mutant analysis) records nothing. So the map is built ONCE, by one recording
+    # pass over the measured paths, and then read for every mutant. This is the one place ADR-46's REVERSE
+    # index is the right tool (the forward edge is a cache-key input; #134 needs that one).
+    #
+    # Cost, measured on Rigor's own `lib` (349 files, 8 workers, warm cache): ≈4.3s for the recording pass —
+    # roughly one extra `rigor check` next to a multi-minute mutation run, paid once. The pass CANNOT reuse
+    # the caller's `prebuilt:` {Analysis::ProjectScan}: `Runner#ensure_project_discovery` is a no-op under
+    # `prebuilt:`, so a prebuilt recording run would resolve nothing cross-file and record an empty graph —
+    # a silently empty closure, which is precisely the failure mode this feature exists to remove. It
+    # therefore runs its own pre-passes, sharing only the environment and the (read-only) cache store.
+    #
+    # Not fail-soft on purpose: an exception here aborts the run rather than degrading the measurement to
+    # "no dependents", which would look exactly like a plausible effectiveness number.
+    module DependencyClosure
+      module_function
+
+      # @param paths [Array<String>] the measured file set, in caller order.
+      # @param configuration [Rigor::Configuration]
+      # @param environment [Rigor::Environment] built once by the caller.
+      # @param cache_store [Rigor::Cache::Store, nil] threaded to the recording run only (its RBS-env and
+      #   plugin-producer tiers); the per-mutant analyses stay `cache_store: nil` regardless.
+      # @param workers [Integer] fork-pool workers for the recording pass (the pool records per worker and
+      #   marshals the records back, so a pooled graph equals the sequential one).
+      # @return [Hash{String => Array<String>}] frozen `path => sorted dependents`, restricted to `paths`.
+      def build(paths:, configuration:, environment:, cache_store: nil, workers: 0)
+        runner = Analysis::Runner.new(
+          configuration: configuration, environment: environment, cache_store: cache_store,
+          collect_stats: false, record_dependencies: true, workers: workers
+        )
+        runner.run(paths)
+        index(runner.file_dependents, paths)
+      end
+
+      # Restricts a raw {Analysis::Runner#file_dependents} map to the measured set: a dependent outside it is
+      # not being measured, so re-analysing it would report a diagnostic against a file the run never
+      # baselined. Self-edges are dropped (the mutated file is the closure's own head), and each list is
+      # sorted so a `--threshold` gate reads the same number whatever order the recording pass finished in.
+      #
+      # @return [Hash{String => Array<String>}]
+      def index(dependents, paths)
+        measured = Set.new(paths)
+        paths.to_h do |path|
+          list = (dependents[path] || []).select { |dep| measured.include?(dep) && dep != path }
+          [path, list.sort.freeze]
+        end.freeze
+      end
+    end
+  end
+end

data/lib/rigor/protection/diagnostic_oracle.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../analysis/runner"
+require_relative "kill_signature"
 
 module Rigor
   module Protection
@@ -15,21 +16,28 @@ module Rigor
     # disk write). Passing `prebuilt:` disables the run-result cache (whose key digests the *disk* file), so a
     # mutant is never served a stale clean hit.
     class DiagnosticOracle
-      def initialize(configuration:, environment:, project_scan:)
+      # @param discovery_seed [Hash, nil] issue #260 — the cross-file discovery tables (see {DiscoverySeed})
+      #   the per-mutant analysis is seeded with, threaded through to `Runner.new(discovery_seed:)`. Without
+      #   it the runner's `prebuilt:` path carries frozen-empty discovery tables, so a receiver whose class is
+      #   declared in a *sibling* file reads `Dynamic` and NO mutation at that site can produce a diagnostic —
+      #   a site the caller's site filter may nonetheless have admitted, and then measured as an unkillable
+      #   survivor. nil (the default) keeps the shipped single-file oracle.
+      def initialize(configuration:, environment:, project_scan:, discovery_seed: nil)
         @configuration = configuration
         @environment = environment
         @project_scan = project_scan
+        @discovery_seed = discovery_seed
       end
 
       # The clean per-file baseline: the diagnostic signatures a mutant must add to count as killed. Computed
       # once per file by the caller.
       def baseline(source:, path:)
-        analyse(source, path).to_set { |d| sig(d) }
+        KillSignature.signatures_of(analyse(source, path))
       end
 
       # Killed iff the mutant introduces a diagnostic not in `baseline`.
       def killed?(mutant_source:, path:, baseline:)
-        analyse(mutant_source, path).any? { |d| !baseline.include?(sig(d)) }
+        analyse(mutant_source, path).any? { |d| !baseline.include?(KillSignature.of(d)) }
       end
 
       private
@@ -37,13 +45,9 @@ module Rigor
       def analyse(source, path)
         Rigor::Analysis::Runner.new(
           configuration: @configuration, environment: @environment, prebuilt: @project_scan,
-          cache_store: nil, collect_stats: false
+          cache_store: nil, collect_stats: false, discovery_seed: @discovery_seed
         ).run_source(source: source, path: path).diagnostics
       end
-
-      def sig(diagnostic)
-        [diagnostic.rule, diagnostic.path, diagnostic.line, diagnostic.column, diagnostic.message]
-      end
     end
   end
 end

data/lib/rigor/protection/discovery_seed.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require_relative "../inference/parameter_inference_collector"
+require_relative "../inference/scope_indexer"
+
+module Rigor
+  module Protection
+    # Issue #260 — the cross-file knowledge Tier 2 hands to BOTH halves of a mutation measurement.
+    #
+    # Site selection and the kill oracle used to disagree by construction: the site filter judged a receiver
+    # against a scope seeded with `discovered_classes`, so `Account.find` (with `Account` declared in a sibling
+    # file) entered the denominator — while the oracle re-analysed each mutant through
+    # `Runner.new(prebuilt:)#run_source`, whose cross-file discovery tables stay frozen-empty, so the same
+    # receiver read `Dynamic` and NO mutation at that site could ever produce a diagnostic. Every admitted
+    # cross-file site was therefore a guaranteed survivor: on Rigor's own `lib`, +2,183 sites bought +2,187
+    # survivors and moved `killed` by −4.
+    #
+    # The answer (issue #260's recorded decision) is one table set, built once, threaded to both sides: the
+    # {Mutator} base scope and {DiagnosticOracle}'s runner seam. This module builds that table set — the FULL
+    # discovery bundle (`discovered_def_nodes`, `discovered_methods`, superclasses, includes, …), not just the
+    # class-identity slice site selection needed, because resolving `find` on `singleton(Account)` is what makes
+    # the site killable.
+    #
+    # The shape is a plain Hash of {Scope::DiscoveryIndex} slot names, which is exactly what both consumers take:
+    # `scope.discovery.with(**tables)` on one side, `Runner#project_scope_seed_tables` on the other.
+    #
+    # Built ONCE on the parent, before {CLI::MutationForkScan} forks, so children copy-on-write inherit it.
+    # Nothing here crosses the marshal boundary (only per-file results do) — which matters, because the def-node
+    # tables hold live `Prism::Node`s.
+    module DiscoverySeed
+      module_function
+
+      # @param paths [Array<String>] the measured file set; the seed spans these files only, exactly as Tier 1's
+      #   seed does. A class declared outside them stays unknown.
+      # @param environment [Rigor::Environment] the plugin-aware environment, built once by the caller.
+      # @param target_ruby [String] Prism parse version for the parameter-inference pre-pass.
+      # @param workers [Integer] worker count for that pre-pass (0 keeps it sequential).
+      # @return [Hash{Symbol => Object}] frozen seed tables; empty when the paths yield nothing.
+      def build(paths:, environment:, target_ruby:, workers: 0)
+        tables = discovery_tables(paths)
+        params = Inference::ParameterInferenceCollector.collect(
+          files: paths, environment: environment, target_ruby: target_ruby, workers: workers
+        )
+        tables[:param_inferred_types] = params unless params.empty?
+        tables.freeze
+      end
+
+      # Issue #254 — the per-file discovery *bundles* (ADR-85 WD2) the closure kill oracle re-folds once per
+      # mutant. A bundle is one file's isolated contribution to the tables above, plus the content digest that
+      # decides whether it is still valid; folding the whole set reconstructs exactly what {#discovery_tables}
+      # builds. Built ONCE on the parent (before {CLI::MutationForkScan} forks, so children copy-on-write
+      # inherit it), and cheap: ≈0.36s over Rigor's own 349-file `lib`.
+      #
+      # @param paths [Array<String>] the measured file set, in canonical (caller) order.
+      # @return [Hash{String => Hash}] per-path bundles, the input {#tables_for_buffer} re-folds.
+      def bundles(paths:)
+        Inference::ScopeIndexer.discovered_project_index_incremental(paths, seed_bundles: {}).fetch(:bundles)
+      end
+
+      # Issue #254 — the seed tables for ONE mutant: every measured file's bundle folded back unchanged
+      # EXCEPT the file `buffer` binds, which is re-walked from the buffer's bytes.
+      #
+      # This is where the substitution reaches change detection rather than only the analysis. The
+      # incremental pass digests each path through the binding, so the mutated file's digest is the MUTANT's
+      # and never matches its cached bundle — it is re-walked, and every dependent then reads the mutated
+      # `def` bodies out of the seed instead of the ones still on disk. Without it a closure re-analysis
+      # would resolve the clean method, produce no new diagnostic anywhere but the mutated file itself, and
+      # report a plausible-looking effectiveness number that measured nothing new.
+      #
+      # ≈15ms over 349 files (one re-walk plus a whole-set fold), against ≈210ms for one mutant's analysis.
+      #
+      # @param paths [Array<String>] the measured file set, in the same order {#bundles} was built from.
+      # @param bundles [Hash{String => Hash}] that bundle set.
+      # @param buffer [Rigor::Analysis::BufferBinding] the mutant binding (logical path → mutant bytes).
+      # @return [Hash{Symbol => Object}] frozen seed tables.
+      def tables_for_buffer(paths:, bundles:, buffer:)
+        index = Inference::ScopeIndexer.discovered_project_index_incremental(
+          paths, seed_bundles: bundles, buffer: buffer
+        )
+        seed_tables(index).freeze
+      end
+
+      # The whole-project discovery tables, from the single-walk combined pass (one parse per file, both
+      # collectors driven over the same tree) that {Analysis::Runner::ProjectPrePasses#discover} uses. Empty
+      # tables are dropped so an empty seed stays `{}` and every consumer's "seed nothing" branch keeps working.
+      #
+      # `discovered_class_sources` is deliberately NOT carried: the runner itself seeds it only under dependency
+      # recording (it is read by the ancestry accessors solely to record cross-file edges), and Tier 2 never
+      # records.
+      def discovery_tables(paths)
+        seed_tables(Inference::ScopeIndexer.discovered_project_index_for_paths(paths))
+      end
+
+      # Maps a `{ classes:, def_index: }` discovery index onto the {Scope::DiscoveryIndex} slot names both
+      # consumers take. Shared by the whole-walk ({#discovery_tables}) and bundle-fold ({#tables_for_buffer})
+      # producers so a mutant's seed and the parent's seed can never disagree about shape.
+      def seed_tables(index)
+        def_index = index.fetch(:def_index)
+        tables = { discovered_classes: index.fetch(:classes) }
+        %i[
+          def_nodes singleton_def_nodes def_sources singleton_def_sources superclasses includes
+          method_visibilities methods data_member_layouts struct_member_layouts
+        ].each do |slot|
+          tables[seed_key(slot)] = def_index.fetch(slot)
+        end
+        tables.reject { |_, table| table.nil? || table.empty? }
+      end
+
+      # The def-index slot names match the {Scope::DiscoveryIndex} ones under a `discovered_` prefix, except the
+      # two member-layout tables, which carry the same name on both sides.
+      def seed_key(slot)
+        slot.to_s.end_with?("member_layouts") ? slot : :"discovered_#{slot}"
+      end
+    end
+  end
+end

data/lib/rigor/protection/kill_signature.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Protection
+    # ADR-69 Seam 1 — the identity a *kill* is judged by, shared by every diagnostic-based oracle.
+    #
+    # A mutant is killed when re-analysis produces a diagnostic the clean baseline did not carry, so the
+    # comparison needs an identity that is stable across two runs of the same code and distinct for two
+    # genuinely different reports. `path` is part of it deliberately: the closure oracle (issue #254) pools
+    # the baseline of several files into one set, and the same rule firing at the same line of a *different*
+    # file must not be mistaken for the baseline's.
+    #
+    # Lifted out of {DiagnosticOracle} when {ClosureKillOracle} arrived: two oracles disagreeing about what
+    # "the same diagnostic" means would show up only as an unexplained kill-count delta between them.
+    module KillSignature
+      module_function
+
+      # @param diagnostic [Rigor::Analysis::Diagnostic]
+      # @return [Array] the comparison key.
+      def of(diagnostic)
+        [diagnostic.rule, diagnostic.path, diagnostic.line, diagnostic.column, diagnostic.message]
+      end
+
+      # @param diagnostics [Enumerable<Rigor::Analysis::Diagnostic>]
+      # @return [Set<Array>] the signature set of `diagnostics`.
+      def signatures_of(diagnostics)
+        diagnostics.to_set { |diagnostic| of(diagnostic) }
+      end
+    end
+  end
+end