rigortype 0.3.1 → 0.3.2

data/docs/manual/12-caching.md

@@ -28,12 +28,23 @@ on:
 - the **content** of the source and `.rbs` files that fed it,
 - the **gems** in play, by name and locked version,
 - the active **plugins**, by ID and version,
-- the relevant **configuration**.
+- the relevant **configuration**,
+- **Rigor itself**, by version.
 
 Change any of those and the dependent entries are recomputed
 automatically. A corrupt or unreadable entry is treated as a
 miss and overwritten — bad cache state cannot wedge a run.
 
+Rigor's version identifies its own code only for a released gem.
+If you run Rigor from a git checkout — a working copy you are
+patching, or `gem "rigor", github:` tracking a branch, where two
+commits share one version number — the entries that hold
+analysis results are keyed on the content of Rigor's own source
+as well, so editing the analyzer and re-running recomputes
+instead of replaying the previous answer. That costs one pass
+over Rigor's source per run (about 20 ms); an installed gem
+neither pays it nor needs it.
+
 The cache is also schema-versioned: after a Rigor upgrade that
 changes the cache format, the stale cache is purged on the
 first writable run.
@@ -157,10 +168,11 @@ affected files in parallel just as a full run does.
 
 The snapshot lives under the cache directory (`.rigor/cache`)
 and is keyed by a fingerprint of your configuration, your locked
-gems, your project's own `sig/` RBS, and the Rigor version.
-Change any of those and the snapshot is dropped and the next run
-is a full one, so an incremental run can never serve a stale
-result. (The fingerprint keys on the analysis *roots* — e.g.
+gems, your project's own `sig/` RBS, the Rigor version, and — if
+you run Rigor from a checkout — the content of Rigor's own
+source. Change any of those and the snapshot is dropped and the
+next run is a full one, so an incremental run can never serve a
+stale result. (The fingerprint keys on the analysis *roots* — e.g.
 `["lib"]` — not the expanded file list, so adding or removing a
 file *under* those roots does **not** drop the snapshot: the
 incremental session re-analyzes the added files and the

data/docs/manual/15-type-protection-coverage.md

@@ -48,6 +48,17 @@ power. `--threshold=RATIO` turns it into a CI gate (exit `1`
 below the ratio) and `--format=json` carries the structured
 fields.
 
+Some `protected` sites are typed only through call-site
+[parameter inference](03-configuration.md) (`parameter_inference:`
+— an undeclared parameter seeded from what its callers pass)
+rather than a declaration — a lower bound that can only widen, so
+none of Rigor's negative rules fire against it yet
+([ADR-67](../adr/67-parameter-type-inference.md) WD6b). The text
+report calls these out as "lower-bound-typed" when there are any,
+and the JSON form always carries the count as `lower_bound_typed`.
+It is a sub-count *within* `protected`, never subtracted from it —
+the protected ratio itself is unaffected.
+
 On a large project, `--workers=N` fork-parallelizes the scan
 (both the parameter-inference pre-pass and the per-file scan),
 with output byte-identical to a sequential run. The worker count
@@ -74,11 +85,117 @@ real "add a type here" site, surfaced with no guesswork.
 
 It runs many analyses, so it defaults to the **git-changed** `.rb`
 files (pass explicit paths to widen — whole-project is minutes) and
-is an opt-in CI deep-dive, not an interactive check. The framing is
+is an opt-in CI deep-dive, not an interactive check. `--workers=N`
+applies here too, and it is the main lever on a wide run: the
+whole-project pre-pass is paid once, then the per-file measurement —
+which is nearly all of the wall time — is fork-mapped across
+workers, byte-identically to a sequential run.
+
+The framing is
 always *effectiveness / where to add a type*, never "your code is
 broken": a surviving breakage at a `Dynamic` site is a place
 the type net does not reach.
 
+### Re-running it is cheap
+
+Each file's measurement is cached and served back while nothing
+that could change it has moved — the file itself, any file it was
+recorded as reading from, the resolved configuration, your `sig/`,
+the gem set, the engine version, `--limit` / `--seed`, and which
+bleeding-edge features you have adopted. Edit one file and that
+file plus the files recorded as reading from it are re-measured;
+the rest are served. A one-line stderr report says what happened,
+so `--format=json` stdout stays clean:
+
+```
+coverage: mutation cache — re-measured 2 file(s), 350 served from cache.
+```
+
+The cache reads the cross-file dependency edges that a
+`rigor check --incremental` run records, so warm one once per
+project:
+
+```sh
+rigor check --incremental                    # records the edges
+rigor coverage --protection --mutation lib   # measures, then caches
+```
+
+Without that snapshot — or under `--no-cache`, or with
+`dependent-closure-kill-oracle` adopted, whose verdicts depend on
+*other* files' diagnostics and so cannot be validated per file —
+every file is re-measured and the stderr line names the reason. A
+file the snapshot does not know about is re-measured rather than
+served: the cache never guesses.
+
+### Which sites Tier 2 measures
+
+Tier 2 only mutates a site where Rigor holds a *concrete* receiver
+type — at a `Dynamic` receiver the breakage would survive by
+construction, which measures nothing. Today it decides that from
+the file alone, so a call on a project class declared in a
+**sibling** file (`Post.where`, `Account.find`) reads `Dynamic` and
+the site is left out of the denominator entirely, even though Tier
+1 counts it.
+
+The [`discovery-seeded-mutation-sites`](02-cli-reference.md#rigor-show-bleedingedge)
+bleeding-edge feature closes that gap, giving Tier 2 the same
+cross-file view Tier 1 has — on *both* halves of the measurement,
+site selection and the re-analysis that decides whether a mutation
+was caught, so an admitted site is one a breakage can really trip:
+
+```yaml
+# .rigor.yml
+bleeding_edge:
+  - discovery-seeded-mutation-sites
+```
+
+It is **off by default and opt-in on purpose**. Those sites are
+mostly ones the type net does not yet catch, so admitting them
+*lowers* the reported effectiveness ratio on unchanged code — and
+`--threshold=RATIO` exits 1 below a ratio you pin in CI. Adopt it
+when you are ready to re-baseline that number; it is the intended
+default at a future major.
+
+### Where a catch is allowed to land
+
+Deciding whether a breakage was caught is a separate question from
+which sites are measured, and it has the same blind spot in the
+opposite direction. Tier 2 re-analyses the mutated file and looks
+at *that file's* diagnostics — so the most valuable catch Rigor
+delivers is scored as a miss. Change what a method returns and the
+error appears in its **callers**, which is exactly the cross-file
+reach the analyzer exists for.
+
+The [`dependent-closure-kill-oracle`](02-cli-reference.md#rigor-show-bleedingedge)
+bleeding-edge feature re-analyses the mutated file **and the files
+that depend on it**, and counts the breakage as caught when a new
+diagnostic appears anywhere in that set:
+
+```yaml
+# .rigor.yml
+bleeding_edge:
+  - dependent-closure-kill-oracle
+```
+
+It composes with the site seed above — one decides what is
+measured, the other where a catch may land — and either can be
+adopted alone. The mutated file's verdict is unchanged, so this can
+only **add** kills: the ratio moves up or not at all, and it cannot
+turn a `--threshold` build red. A number recorded under it is still
+not comparable with one recorded without it.
+
+It costs more: each surviving breakage is re-analysed once per
+dependent file (the caught ones stop at the mutated file), and the
+dependency graph itself is one extra whole-project pass per run —
+about a third more wall time on Rigor's own `lib`.
+
+Worth knowing before you pay that: on the two codebases measured so
+far (Rigor's own `lib`, redmine's `app/models`) it added **no**
+kills. A breakage that survives there is one the analyzer reports
+*nowhere* — not one it reports in a caller — which is a statement
+about where the type net has teeth, and exactly what the
+unprotected-site list is telling you.
+
 What *does* reach it is your tests.
 
 ## The fused view — types **and** tests (`--with-tests`)
@@ -236,6 +353,10 @@ them as a deep-dive, not a per-keystroke check:
   (suite runtime)`. A fast, well-scoped test command is the biggest
   lever.
 - **Cap with `--limit`** on `--include-dynamic` or large files.
+- **Spread with `--workers=N`** on `--mutation` (and Tier 1). The
+  fused `--with-tests` tier stays sequential — the suite hook shells
+  out, and concurrent runs would race — so widen it with scope and
+  `--limit` instead.
 
 ## In CI
 

data/docs/manual/plugins/rigor-rbs-inline.md

@@ -45,6 +45,28 @@ plugin id/version + config), so an unchanged second run skips the parse.
 | Rule | Severity | Fires when |
 | --- | --- | --- |
 | `plugin.rbs-inline.source-rbs-synthesis-failed` | info | rbs-inline could not parse a file; analysis falls back to no inline-RBS contribution and the diagnostic carries the upstream error |
+| `plugin.rbs-inline.source-rbs-annotation-not-honoured` | info | an annotation parsed successfully but contributed nothing — the file's other annotations still apply. Today this means the `# @rbs module-self: Foo` spelling; see below |
+
+## Which inline-RBS dialect Rigor reads
+
+There are two implementations of inline RBS: the
+[`rbs-inline` gem](https://github.com/soutaro/rbs-inline), which this plugin
+runs, and the `RBS::InlineParser` built into `rbs` 4.x. **Rigor reads the
+gem's dialect** ([ADR-32](../../adr/32-rbs-inline-comment-ingestion.md) WD11).
+They overlap almost entirely — `#:`, `@rbs` method types, `def self.`,
+instance-variable annotations, `@rbs skip` all behave identically — but they
+are not the same grammar, and one difference bites in practice:
+
+| you write | Rigor honours it |
+| --- | --- |
+| `# @rbs module-self Comparable` | yes |
+| `# @rbs module-self: Comparable` | **no** — this is the spelling in rbs's own `docs/inline.md` |
+
+Rigor reports the second form as
+`plugin.rbs-inline.source-rbs-annotation-not-honoured` rather than dropping it
+in silence. Constructs the gem supports and the built-in parser does not —
+`@rbs generic T`, `@rbs!` embedded RBS blocks, `@rbs inherits`, method
+visibility — all work here.
 
 ## Configuration
 

data/lib/rigor/analysis/check_rules/rule_ids.rb

@@ -119,6 +119,7 @@ module Rigor
       # the runner grows a new bare id.
       NON_CHECK_DIAGNOSTIC_IDS = %w[
         configuration-error load-error pool-degraded runtime-error source-rbs-synthesis-failed
+        source-rbs-annotation-not-honoured
       ].freeze
     end
   end

data/lib/rigor/analysis/check_rules.rb

@@ -1271,13 +1271,23 @@ module Rigor
           # presence checks below cannot rule out a sound call.
           return nil unless Rigor::Reflection.rbs_class_known?("NilClass", scope: scope)
 
-          return nil unless union_contains_nil?(receiver_type)
-          return nil unless union_method_present_on_non_nil?(receiver_type, call_node.name, scope)
-          return nil if nil_class_has_method?(call_node.name, scope)
+          return nil unless nil_bearing_union_witnesses?(receiver_type, call_node.name, scope)
 
           build_nil_receiver_diagnostic(path, call_node)
         end
 
+        # The receiver-type half of the rule, factored out of the node-shape
+        # guards above: the union must carry nil, must carry a non-nil arm the
+        # presence question can be asked of, must support the method on every
+        # non-nil arm (so the call is only wrong on the nil path), and the
+        # method must be absent from `NilClass` (so the nil path really raises).
+        def nil_bearing_union_witnesses?(receiver_type, method_name, scope)
+          union_contains_nil?(receiver_type) &&
+            union_has_nameable_non_nil_arm?(receiver_type) &&
+            union_method_present_on_non_nil?(receiver_type, method_name, scope) &&
+            !nil_class_has_method?(method_name, scope)
+        end
+
         def union_contains_nil?(union)
           union.members.any? { |member| nil_member?(member) }
         end
@@ -1302,6 +1312,23 @@ module Rigor
             (member.is_a?(Type::Nominal) && member.class_name == "NilClass")
         end
 
+        # Possible-nil may witness only where the presence question below is
+        # ANSWERABLE. `method_present_anywhere?` reports "present" for a
+        # nameless arm (Dynamic / Top / Bot) — the permissive polarity the
+        # union-undefined-method rule's FP safety rests on — so a union whose
+        # non-nil arms are ALL nameless satisfied that gate vacuously and fired
+        # on every method name, including names defined on no class anywhere.
+        # That inverted the intent: the gate suppressed exactly where knowledge
+        # exists (`String | nil` calling a nonexistent method stays silent) and
+        # permitted exactly where none does. Requiring one nameable concrete
+        # arm restores the polarity without touching the shared helper:
+        # `String | nil` keeps firing, and so does `Dynamic | String | nil` —
+        # the nameless arm stays permissive inside the all-arms check, which is
+        # only about the arms' method surface.
+        def union_has_nameable_non_nil_arm?(union)
+          union.members.any? { |m| !nil_member?(m) && !concrete_class_name(m).nil? }
+        end
+
         # The non-nil members must collectively support the
         # method (i.e. for every non-nil member, the method
         # exists on its class via RBS or in-source discovery).
@@ -2075,13 +2102,25 @@ module Rigor
           param_overrides = Rigor::RbsExtended.param_type_override_map(method_def, environment: scope.environment)
           mismatch = argument_mismatch(method_def.method_types, call_node, scope, param_overrides)
           return nil if mismatch.nil?
-          # ADR-67 WD6b — the mismatching argument is an inferred-parameter local, whose type is an
-          # open-call-site lower bound; firing argument-type-mismatch against it is an FP by construction.
-          return nil if inferred_param_argument?(mismatch[:node], scope)
+          return nil if inferred_param_mismatch_verdict?(call_node, mismatch, scope)
 
           build_argument_type_diagnostic(path, call_node, class_name, mismatch)
         end
 
+        # ADR-67 WD6b — an argument-type-mismatch verdict resting on an open-call-site lower bound, on
+        # either side of the call. The ARGUMENT side: the mismatching argument is an inferred-parameter
+        # local, so firing against it is an FP by construction. The RECEIVER side: when the receiver roots
+        # at an inferred parameter, the method whose parameter contract the argument was checked against
+        # was itself resolved through a lower-bound type, so the whole verdict is speculative. The 2026-07-30
+        # self-check surfaced the receiver half as a guard hole: seeding `env : RBS::Environment` activated
+        # this rule on `env.unload(culprits)` and flagged a correct Array argument against `unload`'s
+        # declared `Set[Pathname]` — an upstream signature stricter than its implementation, exactly the FP
+        # class WD6b exists to suppress. The other guarded rules already declined on a param-rooted
+        # receiver; this brings argument-type-mismatch in line.
+        def inferred_param_mismatch_verdict?(call_node, mismatch, scope)
+          inferred_param_argument?(mismatch[:node], scope) || inferred_param_receiver?(call_node, scope)
+        end
+
         # Single overload → the exact per-argument acceptance (unchanged).
         # Multiple overloads → the nil channel (a pure-`nil` argument every
         # overload rejects) plus, on non-coerce methods, the non-nil channel

data/lib/rigor/analysis/incremental_session.rb

@@ -62,9 +62,14 @@ module Rigor
       #   pool records each worker's cross-file reads and marshals them back (PoolCoordinator), so the
       #   dependency graph a pooled recheck rebuilds equals the sequential one.
       def initialize(configuration:, paths: nil, environment: nil, cache_store: nil, plugin_requirer: nil,
-                     workers: 0)
+                     workers: 0, buffer: nil)
         @configuration = configuration
         @paths = paths
+        # Editor mode option B (#146) — the in-flight buffer, threaded into every internal Runner so the
+        # pre-passes and the closure re-analysis read the editor's bytes at the logical path. A session
+        # holding one MUST NOT persist its snapshot: its `@digests` and `@cache` describe bytes that exist
+        # only in the editor. {#run_buffer_recheck} is the only entry that honours that.
+        @buffer = buffer
         @environment = environment
         @cache_store = cache_store
         @plugin_requirer = plugin_requirer
@@ -93,6 +98,13 @@ module Rigor
         # ADR-89 WD2 — per-def observed-key return summaries: [path, symbol] => { keys:, returns:, effects: }.
         # Harvested from the ADR-84 return memo after each run; drives the behavioural-stability gate.
         @return_summaries = {}
+        # ADR-67 WD6c lift — the `parameter_inference:` seed table the cached diagnostics were computed
+        # under (`{}` when the gate is off — the gate state is constant across a snapshot's lifetime because
+        # the configuration is part of the global fingerprint). A recheck recomputes the table fresh and
+        # diffs it against this: the pre-pass is whole-project by design, so the fresh table is ground truth
+        # and a missing invalidation edge is impossible by construction — the reason this is a table diff
+        # and not the caller→callee edge recording #204 first sketched.
+        @param_table = {}
         # ADR-88 WD1 — the plugin fact-surface digest computed for THIS invocation (nil until a
         # `#run_incremental` pass runs / a plugin-free project) and the reporting flags a caller (the CLI
         # banner + `--cache-stats`) reads after `#run_incremental`. `@last_runner` is the analysis runner the
@@ -120,6 +132,9 @@ module Rigor
         @seed_bundles = runner.seed_bundles # ADR-85 WD2 — the freshly built bundle set for the next run.
         absorb_dependency_graph(runner)
         @return_summaries = runner.return_summaries # ADR-89 WD2 — the full-run behavioural surface.
+        # ADR-67 WD6c lift — the seed table the runner's own pre-pass computed ({} when the gate is off).
+        # Reading it back, rather than computing it here, keeps the baseline single-collect.
+        @param_table = runner.param_inferred_types
         @cache = per_file(diagnostics)
         @digests = @analyzed.to_h { |path| [path, pack_digest(path)] }
         diagnostics
@@ -134,30 +149,79 @@ module Rigor
         added = current - previous
         removed = previous - current
         changed = changed_paths(current & previous)
-        affected = affected_closure(changed, added, removed)
+        # ADR-67 WD6c lift — recompute the whole-project inferred-param table BEFORE deciding the closure,
+        # and diff it against the snapshot's copy: an entry that moved (because a caller's argument type
+        # changed, a caller appeared, or one vanished) invalidates the CALLEE's file and its symbol
+        # dependents, none of which the file-digest tier can see (the callee's text is unchanged).
+        fresh_params = fresh_param_table(current, changed, added, removed)
+        param_files, param_pairs = param_seed_invalidation(fresh_params)
+        affected = affected_closure(changed, added, removed, param_files, param_pairs)
         analyze_set = affected & current
-        runner = build_runner(analyze_only: analyze_set, record_dependencies: true)
+        # The freshly collected table is handed to the runner so the run seeds from the SAME table the diff
+        # was decided on (and the collector runs once per recheck, not twice).
+        runner = build_runner(analyze_only: analyze_set, record_dependencies: true,
+                              param_inferred_types: fresh_params)
         fresh = run_runner(runner).diagnostics
         @last_runner = runner # ADR-88 WD1 — the post-hoc fact-surface fingerprint reads this prepared registry.
         reused = (current & previous) - affected.to_a
         merged = fresh + reused.flat_map { |path| @cache[path] || [] }
         absorb(runner, fresh, current, analyze_set, removed)
+        @param_table = fresh_params
         Recheck.new(diagnostics: merged, changed: changed.to_set, added: added.to_set,
                     removed: removed.to_set, affected: affected, reused: reused.to_set)
       end
 
+      # Editor mode option B (#146) — a whole-project recheck with the editor's buffer substituted for one
+      # file, for the CLI's `--incremental --tmp-file=X --instead-of=Y`. Returns the {Recheck} when the
+      # snapshot could be reused, or nil when it could not — the caller then falls back to option A
+      # (single-file scope) rather than paying a full baseline, because that baseline would repeat on every
+      # keystroke: this session MUST NOT save, so nothing it computes can warm the next invocation.
+      #
+      # Not saving is the whole safety story. `@digests` and `@cache` here describe the buffer's bytes, which
+      # exist only in the editor; persisting them would make the next `rigor check --incremental` believe the
+      # on-disk file was already analysed in a state it was never in.
+      def run_buffer_recheck(snapshot:, fingerprint:)
+        Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
+          restored = fingerprint && snapshot.load(fingerprint: fingerprint)
+          break nil unless restored
+
+          restore(restored)
+          result = recheck
+          adopt_plugin_fact_fingerprint
+          # The ADR-88 gate applies unchanged: if the plugin fact surface moved, the cache-served files may be
+          # stale. A full baseline is the sound answer for `--incremental`, but in editor mode it is also the
+          # latency this mode exists to avoid, so decline and let the caller drop to single-file scope.
+          break nil unless @plugin_fact_reusable.reusable_against?(restored.plugin_fact_digest)
+
+          result
+        end
+      end
+
       # The frozen set of files a #recheck must re-analyse: the symbol/ancestry-granularity closure of the
       # changed files (slice 4), the added files themselves, the consumers of any symbol / class that
       # *appeared* in a changed OR added file (slice 3 — a now-defined `call.unresolved-toplevel` target or
       # `def.override-*` ancestor), and the consumers of every removed file (which now miss what it
       # provided). An added file has no before-state, so all its symbols / classes appear.
-      def affected_closure(changed, added, removed)
+      #
+      # ADR-67 WD6c lift — `param_files` / `param_pairs` are the callee files (and their `[file, symbol]`
+      # pairs) whose inferred-param seeds moved since the snapshot. Their text is unchanged, so they enter
+      # the closure here: the files themselves re-analyse (their in-body diagnostics were computed under the
+      # old seeds), and their pairs join the SYMBOL fan-out — a seed change shifts the callee's inferred
+      # return exactly the way a body edit does, so it reuses the same audited dependents machinery. The
+      # pairs join AFTER the ADR-89 WD2 behavioural-stability pruning: that gate re-evaluates returns under
+      # the snapshot's OLD seeds, which is the wrong oracle for a pair whose seeds are the thing that moved.
+      def affected_closure(changed, added, removed, param_files = Set.new, param_pairs = Set.new)
         scan = changed + added
         # Parse the changed / added set ONCE for the per-symbol fingerprints, the class declarations, AND the
         # ADR-89 WD1 declaration signatures. They were separate `discovered_def_index_for_paths` passes over
         # the same `scan` set — a duplicate re-parse of every changed file each recheck (recon §2 / the P6
         # recheck-floor audit).
-        summary = scan.empty? ? nil : Inference::ScopeIndexer.scan_summary_for_paths(scan)
+        # `buffer:` is load-bearing for editor mode option B (#146), not an optimisation: this scan decides
+        # the closure, so reading the buffer's logical path from DISK would compare the snapshot's symbol
+        # fingerprints against bytes the user has already edited away — every dependent of the unsaved change
+        # would then be served from cache, which is the stale answer whole-project editor scope exists to
+        # avoid. `ScopeIndexer.scan_summary_for_paths` resolves each path through the binding.
+        summary = scan.empty? ? nil : Inference::ScopeIndexer.scan_summary_for_paths(scan, buffer: @buffer)
         scan_index = summary && summary[:def_index]
         declaration_signatures = (summary && summary[:declaration_signatures]) || {}
         new_fps = symbol_fingerprints_from_index(scan_index)
@@ -176,13 +240,23 @@ module Rigor
         # previously-observed call key + content-mutation effects) is unchanged is behaviourally stable: its
         # symbol dependents' cached diagnostics stay valid, so drop them. `symbol_pairs` is `changed_pairs`
         # minus those stable pairs, and only it (not `changed_pairs`) drives the symbol-dependent fan-out.
-        symbol_pairs = behaviourally_unstable_pairs(changed_pairs, unstable, scan_index)
+        symbol_pairs = behaviourally_unstable_pairs(changed_pairs, unstable, scan_index) | param_pairs
         base = dependents_base(unstable, symbol_pairs)
         closure = base | changed.to_set | added.to_set | negative_affected(scan, new_fps, new_class_decls)
+        closure = param_seed_closure(closure, param_files)
         removed.each { |path| closure |= @dependents[path] || Set.new }
         closure.freeze
       end
 
+      # ADR-67 WD6c lift — the seed-invalidated callees' own contribution to the closure: the files
+      # themselves, plus — on a pre-slice-4 snapshot with no symbol edges, where the pairs' symbol fan-out
+      # found nothing — their file-level dependents (wider, always sound).
+      def param_seed_closure(closure, param_files)
+        closure |= param_files
+        param_files.each { |path| closure |= @dependents[path] || Set.new } if @symbol_sources.empty?
+        closure
+      end
+
       # The dependents contributed by the declaration-unstable changed files and the behaviourally-unstable
       # symbol pairs: the ADR-46 slice-4 symbol-granular fan-out when either is present (ancestry deps of the
       # unstable files + symbol deps of the changed pairs), else the coarse file-level fan-out.
@@ -194,6 +268,47 @@ module Rigor
         end
       end
 
+      # ADR-67 WD6c lift — the fresh whole-project inferred-param table for this recheck ({} when the gate
+      # is off). When NO file moved, the collector's inputs are unchanged — the project files are identical,
+      # and the env-side inputs (configuration, `sig/`, the gem set, the engine version) are constant under
+      # a matched snapshot fingerprint — so the stored table is provably identical and the whole-project
+      # re-collect is skipped (the ADR-87 null-recheck fast path stays collect-free).
+      def fresh_param_table(current, changed, added, removed)
+        return {} unless @configuration.parameter_inference
+        return @param_table if changed.empty? && added.empty? && removed.empty?
+
+        build_runner.collect_param_inference_table(current)
+      end
+
+      # ADR-67 WD6c lift — the `[files, pairs]` the fresh table invalidates. For every `[class, method,
+      # kind]` entry that differs from the snapshot's copy (added, removed, or value-changed — `Type#==`
+      # structural equality, the same comparison the collector's own fixpoint termination uses, already
+      # exercised across Marshal round-trips by its fork workers), every snapshot file defining that symbol
+      # re-analyses and its `[file, symbol]` pair joins the symbol fan-out. An entry attributable to NO
+      # snapshot file is a def that first appeared in this edit: its file is in the changed/added set (so it
+      # re-analyses anyway) and its prior callers are the negative-dependency closure's job — nothing is
+      # lost by skipping it here. The restored types are compared and then DISCARDED (the run seeds from the
+      # fresh table), so a cache-carried stale memo ivar can never poison a live lookup.
+      def param_seed_invalidation(fresh_params)
+        return [Set.new, Set.new] if fresh_params.equal?(@param_table) || @param_table == fresh_params
+
+        files = Set.new
+        pairs = Set.new
+        (@param_table.keys | fresh_params.keys).each do |key|
+          next if @param_table[key] == fresh_params[key]
+
+          class_name, method_name, kind = key
+          symbol = "#{class_name}#{kind == :singleton ? '.' : '#'}#{method_name}"
+          @symbol_fingerprints.each do |path, symbols|
+            next unless symbols.key?(symbol)
+
+            files << path
+            pairs << [path, symbol]
+          end
+        end
+        [files, pairs]
+      end
+
       # ADR-89 WD2 — `changed_pairs` minus the behaviourally-STABLE pairs whose symbol dependents may be
       # skipped. A pair `[path, "Class#method"]` is a candidate when its file is declaration-stable (WD1), it
       # carries a persisted return summary, and the (edited) def is GATE-ELIGIBLE — its only cross-file body
@@ -266,7 +381,9 @@ module Rigor
       # mutating session state. Returns the merged diagnostics.
       def reanalyze_subset(subset)
         affected = subset.to_set
-        runner = build_runner(analyze_only: affected)
+        # ADR-67 WD6c lift — seed the subset run from the baseline's own table so the verification engine
+        # exercises the exact seeds the served cache entries were computed under (and skips a re-collect).
+        runner = build_runner(analyze_only: affected, param_inferred_types: @param_table)
         fresh = run_runner(runner).diagnostics
         reused = @analyzed - affected.to_a
         fresh + reused.flat_map { |path| @cache[path] || [] }
@@ -278,7 +395,12 @@ module Rigor
       # persist the updated snapshot for the next process. Returns `[diagnostics, warm]` — `warm` is true
       # when a snapshot was restored. A nil `fingerprint` (uncomputable inputs) disables persistence: a
       # plain full run.
-      def run_incremental(snapshot:, fingerprint:)
+      # `persist: false` runs the same restore / recheck / baseline decision without writing the snapshot
+      # back. The language server (#246) needs exactly that: it keeps its session in memory for the life of
+      # the process, and writing shared state would race the way its read-only cache store already declines
+      # to. Every soundness gate below — the fingerprint, the ADR-88 fact surface — is unchanged, so the
+      # decision to reuse is made identically whether or not the result is saved.
+      def run_incremental(snapshot:, fingerprint:, persist: true)
         # ADR-87 WD1 — install the per-run digest table + recording instant + strict flag for the whole
         # invocation so change-detection's stat-then-digest freshness (`#pack_digest` / `#stat_fresh?`) honours
         # `cache.validation: digest` (and `RIGOR_STRICT_VALIDATION`, which the env-only path already sees) and
@@ -320,7 +442,7 @@ module Rigor
             warm = false
             skip_save = false
           end
-          snapshot.save(fingerprint: fingerprint, payload: to_payload) if fingerprint && !skip_save
+          snapshot.save(fingerprint: fingerprint, payload: to_payload) if persist && fingerprint && !skip_save
           [diagnostics, warm]
         end
       end
@@ -386,6 +508,7 @@ module Rigor
         @missing           = payload.missing || {}
         @class_decls       = payload.class_decls || {}
         @return_summaries  = payload.return_summaries || {}
+        @param_table       = payload.param_table || {} # ADR-67 WD6c lift — the seeds the cache was built under.
         @symbol_dependents = Incremental.invert_symbols(@symbol_sources)
         @ancestry_dependents = Incremental.invert(@ancestry_sources)
         @negative_dependents = Incremental.invert(@missing)
@@ -398,7 +521,8 @@ module Rigor
           symbol_fingerprints: @symbol_fingerprints, missing: @missing,
           class_decls: @class_decls, seed_bundles: @seed_bundles,
           plugin_fact_digest: @plugin_fact_digest,
-          return_summaries: marshal_safe_return_summaries
+          return_summaries: marshal_safe_return_summaries,
+          param_table: marshal_safe_param_table
         )
       end
 
@@ -416,6 +540,18 @@ module Rigor
         end
       end
 
+      # ADR-67 WD6c lift — the param table filtered to Marshal-clean entries, the same guard (and reason) as
+      # {#marshal_safe_return_summaries} above. A dropped entry re-appears as "added" in the next recheck's
+      # diff, so its callee re-checks — the conservative direction.
+      def marshal_safe_param_table
+        @param_table.each_with_object({}) do |(key, params), safe|
+          Marshal.dump(params)
+          safe[key] = params
+        rescue StandardError
+          next
+        end
+      end
+
       # Fold a #recheck's fresh results back into the cache + graph so the session is correct across
       # multiple edits: the analyzed set gets fresh diagnostics + digests + dependency edges, removed files
       # are evicted from every map, and the analyzed-file list advances to `current`.
@@ -669,7 +805,7 @@ module Rigor
         Runner.new(
           configuration: @configuration, cache_store: @cache_store, environment: @environment,
           plugin_requirer: @plugin_requirer, seed_bundles: @seed_bundles, collect_seed_bundles: true,
-          workers: @workers, **
+          workers: @workers, buffer: @buffer, **
         )
       end
 
@@ -696,10 +832,19 @@ module Rigor
         candidates.reject { |path| stat_fresh?(path) }
       end
 
+      # A bound buffer's logical path is never fresh: the bytes to analyse live in the editor's temp file, and
+      # the recorded entry describes the file on disk. Re-analysing it when the two happen to agree costs one
+      # file; trusting the stat tuple would serve the editor its own stale diagnostics.
+      def buffer_path?(path)
+        !@buffer.nil? && path == @buffer.logical_path
+      end
+
       # True when `path`'s recorded stat entry proves it unchanged since the last analysis. Any stat / parse
       # failure (missing entry, unreadable / vanished file) reads as NOT fresh (→ re-analyse), preserving the
       # prior `digest(path) != recorded` "changed" semantics for a file that cannot be validated.
       def stat_fresh?(path)
+        return false if buffer_path?(path)
+
         entry = @digests[path]
         return false if entry.nil?
 

data/lib/rigor/analysis/plugin_fact_fingerprint.rb

@@ -71,6 +71,20 @@ module Rigor
         new.digest_registry(registry)
       end
 
+      # The fact surface reduced to the one String a cache KEY can carry, or nil when the surface cannot be
+      # seen at all (an opaque plugin — one that contributes call-site types while declaring none of the three
+      # fingerprint channels). A nil obliges the caller to decline caching entirely, which is the same
+      # conservative direction {Result#reusable_against?} takes for the incremental snapshot: a key that
+      # silently omitted an invisible input would serve a stale value rather than miss.
+      #
+      # Keeping the opaque decision here, rather than at each cache's call site, means a new consumer cannot
+      # key on `digest` while forgetting that an opaque surface makes it meaningless.
+      # @return [String, nil]
+      def self.key_digest(registry)
+        result = from_registry(registry)
+        result.opaque? ? nil : result.digest.to_s
+      end
+
       # Loads the plugins and runs every `#prepare` hook sequentially, returning the prepared registry (nil on
       # any failure → the caller treats it as "no fact surface").
       def self.prepared_registry(configuration:, cache_store:, plugin_requirer:)