rigortype 0.3.5 → 0.3.7

data/lib/rigor/analysis/crash_signature.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Analysis
+    # Issues #665 / #674 / #683 / #686 / #696 — the ONE definition of "an internal failure made this run
+    # report less than it should have".
+    #
+    # Every member of that family shares a defect: the run still exits 0 and its diagnostic list still
+    # looks like an answer, so an absence assertion (`not_to include(...)`, `be_empty`, `all(eq(...))`)
+    # holds on it and a comparison of two such runs (`baseline == mutant`, `recheck == full_run`) reports
+    # "no difference" — because both sides carry the same synthetic row, not because the code agreed. Four
+    # separate consumers needed to recognise these shapes, and before this module each recognised them by
+    # matching a diagnostic MESSAGE with its own string literal. A fourth copy is what this exists to stop:
+    # a reworded message silently disarms whichever copies were not updated, and nothing goes red.
+    #
+    # ## The three shapes
+    #
+    # - `:check_rule` — message begins `internal analyzer error`, `rule: nil`. Built by
+    #   `Runner#analyze_file_body` / `WorkerSession#analyze_body`'s `rescue StandardError`.
+    # - `:plugin` — `severity: :error`, `source_family: :plugin_loader`, `rule: "runtime-error"`. Built by
+    #   `Runner#collect_plugin_diagnostics` / `Runner::ProjectPrePasses#invoke_plugin_prepare`.
+    # - `:rbs_build` — `rule` in {RBS_BUILD_FAILURE_RULES}. Recorded by `Environment::RbsLoader`'s
+    #   env-build and definition-build rescues, surfaced by {Runner::DiagnosticAggregator}.
+    #
+    # The `:plugin` shape is keyed on the structured `(severity, source_family, rule)` triple rather than on
+    # the bare rule name: a plugin is free to define its OWN `"runtime-error"` (or `"load-error"`) under its
+    # own `source_family: "plugin.<id>"`, and several specs legitimately assert on one. Only the
+    # `:plugin_loader` family paired with `"runtime-error"` is the isolation envelope's own row.
+    #
+    # ## Only ONE shape discards a file's analysis
+    #
+    # {.discards_file_analysis?} answers true for `:check_rule` alone, and the distinction is not pedantry —
+    # it decides whether a consumer may still read the run's diagnostics.
+    #
+    # - `:check_rule` — `Runner#analyze_file_body` rescues around the WHOLE per-file body, so what comes
+    #   back is `[crash_row]` and every diagnostic that file would have produced is gone. Nothing is left to
+    #   read.
+    # - `:plugin` — `collect_plugin_diagnostics` replaces only the raising PLUGIN's contribution;
+    #   `CheckRules.diagnose` has already returned, and `invoke_plugin_prepare` adds one row at `.rigor.yml`
+    #   and lets the run proceed. The builtin rules ran, and their diagnostics are all still there. A
+    #   consumer that refuses the whole run over this throws away a real measurement — and because the
+    #   prepare row is appended to every sequential run, it would refuse every run for the life of the
+    #   process.
+    # - `:rbs_build` — the analysis ran to completion and every rule fired, over a type universe missing one
+    #   class (`rbs.coverage.definition-build-failed`) or all of them
+    #   (`rbs.coverage.environment-build-failed`). A degradation the user causes and the diagnostic itself
+    #   reports; a project can sit on it for a release while it fixes its `sig/`.
+    #
+    # The two consumer tiers therefore differ on purpose. The ADR-69 kill oracles arm `:check_rule` only:
+    # refusing a run they could still have measured is the same "manufactures work" error as scoring an
+    # unmeasured mutant a survivor, pointed the other way (issue #686 review). The spec harness additionally
+    # arms `:plugin`, which is suite POLICY rather than a claim about the diagnostics — no spec has a reason
+    # to want a plugin crashing under it, and `allow_plugin_crash:` is the opt-out for the handful whose
+    # subject IS the isolation envelope.
+    module CrashSignature
+      # The `rescue StandardError` in `Runner#analyze_file_body` / `WorkerSession#analyze_body` folds a
+      # raising check rule (or a plugin's node-rule contribution) into ONE diagnostic per file with this
+      # message prefix. Matched on the prefix alone, exactly as the pre-#696 guards did: adding a `rule.nil?`
+      # conjunct would NARROW the match, and the whole point of a guard against a bug is that it stays armed
+      # when the shape shifts.
+      CHECK_RULE_MESSAGE_PREFIX = "internal analyzer error"
+
+      PLUGIN_SOURCE_FAMILY = :plugin_loader
+      PLUGIN_RULE = "runtime-error"
+
+      # The `rbs.coverage.*` rules that mean declared types went missing from this run — an env-wide
+      # collapse and its per-class sibling (#696). Ordered widest consequence last, the way the two rows sit
+      # in `docs/type-specification/diagnostic-policy.md`.
+      RBS_BUILD_FAILURE_RULES = %w[
+        rbs.coverage.definition-build-failed
+        rbs.coverage.environment-build-failed
+      ].freeze
+
+      # The one reason that means a file's whole diagnostic list was replaced by a crash row. `:plugin` and
+      # `:rbs_build` both leave a readable run behind — see the class doc.
+      DISCARDS_FILE_ANALYSIS_REASON = :check_rule
+
+      module_function
+
+      # @param diagnostic [Rigor::Analysis::Diagnostic]
+      # @return [Symbol, nil] `:check_rule`, `:plugin`, `:rbs_build`, or nil for an ordinary diagnostic.
+      def reason(diagnostic)
+        return :check_rule if diagnostic.message.to_s.start_with?(CHECK_RULE_MESSAGE_PREFIX)
+        return :plugin if plugin_isolation_row?(diagnostic)
+        return :rbs_build if RBS_BUILD_FAILURE_RULES.include?(diagnostic.rule)
+
+        nil
+      end
+
+      # True when `diagnostic` is the rescue row that REPLACED a file's analysis — the only shape after which
+      # the run's diagnostics say nothing about the code. NOT a general "something went wrong" predicate; see
+      # the class doc for why `:plugin` and `:rbs_build` are excluded.
+      #
+      # @param diagnostic [Rigor::Analysis::Diagnostic]
+      def discards_file_analysis?(diagnostic)
+        reason(diagnostic) == DISCARDS_FILE_ANALYSIS_REASON
+      end
+
+      # A one-line "<reason> at <path>:<line>: <message>" for a failure message, so whoever reads the raise
+      # sees which shape fired and where without re-deriving it.
+      #
+      # @param diagnostic [Rigor::Analysis::Diagnostic]
+      # @return [String]
+      def describe(diagnostic)
+        "#{reason(diagnostic) || :unknown} at #{diagnostic.path}:#{diagnostic.line}: #{diagnostic.message}"
+      end
+
+      def plugin_isolation_row?(diagnostic)
+        diagnostic.severity == :error &&
+          diagnostic.source_family == PLUGIN_SOURCE_FAMILY &&
+          diagnostic.rule == PLUGIN_RULE
+      end
+      private_class_method :plugin_isolation_row?
+    end
+  end
+end

data/lib/rigor/analysis/dependency_recorder.rb

@@ -168,9 +168,17 @@ module Rigor
         accumulate_read(accumulator, path, symbol)
       end
 
-      # Records a cross-file lookup of `name` (kind `:method` / `:class` / `:const` / …) that resolved to
-      # nothing — a negative dependency.
-      def read_missing(kind, name)
+      # Records a NAME-KEYED cross-file dependency: this consumer's answer depends on what the project makes
+      # of `name` under `kind`, so a recheck must re-analyze it when that changes. The recorded key is
+      # inverted into `negative_dependents` and matched against the producer for its kind.
+      #
+      # For `:method` / `:class` / `:toplevel` this is recorded only on a MISS ({read_missing}) — a resolved
+      # method or class already carries a positive edge to its definition site, which covers every later
+      # change to it. Issue #644's `:constant` kind is recorded on a HIT as well, because a constant's
+      # published value is a function of the WHOLE project's write set for the name, not of the one file that
+      # currently wins: a second declarer appearing in a file the reader has no edge to must drop the name to
+      # `Dynamic` at that reader, and only a name-keyed edge can see it.
+      def read_name(kind, name)
         accumulator = Thread.current[KEY]
         return if accumulator.nil?
 
@@ -179,6 +187,13 @@ module Rigor
         accumulator.missing.add(entry)
       end
 
+      # The miss-only spelling of {read_name}: a cross-file lookup of `name` (kind `:method` / `:class` /
+      # `:toplevel` / …) that resolved to nothing. Kept as the name the internal spec's negative-edge
+      # contract uses.
+      def read_missing(kind, name)
+        read_name(kind, name)
+      end
+
       # The positive-edge aggregation shared by {read_site} and {replay}.
       def accumulate_read(accumulator, path, symbol)
         accumulator.sources << path

data/lib/rigor/analysis/dependency_source_inference/walker.rb

@@ -139,7 +139,8 @@ module Rigor
         def descend_class_or_module(node, qualified_prefix, in_singleton_class, accumulator, budget)
           name = Source::ConstantPath.qualified_name_or_nil(node.constant_path)
           if name && node.body
-            walk_node(node.body, qualified_prefix + [name], in_singleton_class, accumulator, budget)
+            child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+            walk_node(node.body, child_prefix, in_singleton_class, accumulator, budget)
           else
             walk_children(node, qualified_prefix, in_singleton_class, accumulator, budget)
           end

data/lib/rigor/analysis/diagnostic.rb

@@ -134,14 +134,25 @@ module Rigor
       end
 
       # Text rendering for `rigor check`. The qualified rule identifier (per ADR-2 § "Plugin Diagnostic
-      # Provenance" — `plugin.<id>.<rule>`, `rbs_extended.<rule>`, `generated.<provider>.<rule>`) is appended
-      # in brackets whenever the diagnostic carries a non-default `source_family`, so plugin / RBS::Extended
-      # / generated provenance is visible in the standard text output without changing the layout for
-      # built-in rules. Slice 5 (v0.1.0) wires this surface.
+      # Provenance" — `call.undefined-method`, `plugin.<id>.<rule>`, `rbs_extended.<rule>`,
+      # `generated.<provider>.<rule>`) is appended in brackets.
+      #
+      # Slice 5 (v0.1.0) introduced the bracket for non-builtin families only, "without changing the layout
+      # for built-in rules" — a layout-conservatism call made when provenance was the point, not a judgment
+      # that the identifier is noise. The consequence outlived the reason (#431): the exception covers the
+      # rules `docs/manual/04-diagnostics.md` tells the reader to suppress with `# rigor:disable <id>` and
+      # to key `severity_profile:` on, so the default output was the one place the identifier could not be
+      # read. A run could not be grepped for a rule either — the effect-system walkthrough grepped
+      # `effect\.` over a whole Redmine run, got nothing, and concluded the feature was broken.
+      #
+      # The cost is bounded and was measured before the change: on Redmine every diagnostic carries an
+      # identifier, only 13 distinct ones appear across the project, and the suffix adds 14 characters to a
+      # 165-character median line.
+      #
+      # `rule` is nil for diagnostics no rule produced — parse errors, path errors, internal analyzer
+      # errors — and those stay unsuffixed, because there is nothing to suppress or configure.
       def to_s
         base = "#{path}:#{line}:#{column}: #{severity}: #{message}"
-        return base if source_family == DEFAULT_SOURCE_FAMILY
-
         qualified = qualified_rule
         return base if qualified.nil?
 

data/lib/rigor/analysis/effects_cache_probe.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require_relative "path_expansion"
+require_relative "run_cache_key"
+require_relative "../cache/store"
+require_relative "../cache/file_digest"
+require_relative "../effects/identity"
+require_relative "../effects/plugin_facts"
+require_relative "../effects/registry"
+require_relative "../plugin"
+require_relative "../plugin/loader"
+require_relative "../plugin/services"
+require_relative "../reflection"
+require_relative "../type/combinator"
+
+module Rigor
+  module Analysis
+    # ADR-104 — the boot-slimming probe for the effects surfaces, the shape ADR-87 WD4's
+    # {RunCacheProbe} gave `rigor check`.
+    #
+    # A warm `rigor effects` had almost no work left after #475 and #482 and still cost 2–2.5× a warm
+    # `rigor check`, because it loaded the inference engine to compute two cache keys and adopt two
+    # cached values. This serves the report from the #482 summary entry — the propagated table and the
+    # unit sources — loading configuration, the cache, the plugin loader and the `effects/*` value
+    # layer, and never `rigor/inference`.
+    #
+    # ## What makes an engine-free key possible
+    #
+    # The effects identity ({Effects::Identity.descriptor}) is the run's diagnostics key descriptor plus
+    # the vocabulary version, the catalogue identity, the `effects:` digest and {Effects::PluginFacts}'
+    # own digest. The first is what {RunCacheProbe} already computes without a loader; the rest are pure
+    # functions of shipped data, configuration, and the plugins' class-level declarations — a plugin's
+    # contributions are fixed by `init`, which the loader runs, so `#prepare` (the expensive half) is
+    # not needed. `PluginFacts#digest` is computed before the project's superclass table is even
+    # assigned to it, so the discovery tables a probe cannot build do not participate.
+    #
+    # ## Why a decline is always safe
+    #
+    # Every reason to decline — a key this path cannot reproduce, a miss, a stale dependency — ends in
+    # the caller running the full `Analysis::Runner`, which answers exactly as it does today. The one
+    # reproducibility gap is deliberate and inherited: a project whose plugins synthesise virtual RBS
+    # gets a key without the `rbs.virtual_rbs` slot the runner writes, so it misses here rather than
+    # matching something it should not.
+    #
+    # The rule the surfaces are held to (ADR-104's criterion): a probe may serve a surface only when
+    # every answer that surface can give is reproducible from stored values and declarations alone.
+    # `rigor effects` and the snapshot verbs qualify because their output is a pure function of the
+    # table, the sources, the configuration and the vocabulary — the envelope diagnostics the full path
+    # also computes are discarded by every one of them.
+    class EffectsCacheProbe
+      # What a served run hands back: the two cached tables, plus the vocabulary the caller would
+      # otherwise rebuild (the probe loaded the plugins to key the entry, so it already knows it).
+      Served = Data.define(:table, :sources, :registry, :plugin_facts)
+
+      # @param configuration [Rigor::Configuration] with effects already enabled by the caller.
+      # @param cache_root [String, nil]
+      def initialize(configuration:, cache_root:)
+        @configuration = configuration
+        @cache_root = cache_root
+      end
+
+      # @param paths [Array<String>] the analysed set — `configuration.paths` unioned with any path
+      #   arguments, exactly what {CLI::EffectsCommand#analyze} hands the runner, because the analysed
+      #   set is part of the diagnostics key.
+      # @return [Served, nil] nil to decline, on any failure whatsoever.
+      def serve(paths)
+        return nil if @cache_root.nil? || !@configuration.effects_check?
+
+        descriptor = effects_descriptor(paths)
+        return nil if descriptor.nil?
+
+        summary = validated_summary(descriptor)
+        return nil if summary.nil?
+
+        table, sources, = summary
+        Served.new(table: table, sources: sources, registry: registry, plugin_facts: plugin_facts)
+      rescue StandardError
+        nil
+      end
+
+      private
+
+      def effects_descriptor(paths)
+        files = PathExpansion.ruby_files(paths, @configuration.exclude_patterns)
+        base = RunCacheKey.descriptor(
+          configuration: @configuration, files: files, explain: false,
+          rbs_config_entries: RunCacheKey.libraries_config_entries(@configuration)
+        )
+        return nil if base.nil?
+
+        Effects::Identity.descriptor(base: base, configuration: @configuration, registry: registry,
+                                     plugin_facts: plugin_facts)
+      end
+
+      # The same shape guard the runner's own read half applies, for the same reason: a miss, a stale
+      # dependency, a corrupt entry and a value of the wrong shape all mean "run it properly".
+      def validated_summary(descriptor)
+        store = Cache::Store.new(root: @cache_root, max_bytes: @configuration.cache_max_bytes)
+        cached = Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
+          store.peek_validated(
+            producer_id: RunCacheKey::RUN_EFFECTS_TABLE_PRODUCER_ID, key_descriptor: descriptor
+          )
+        end
+        return nil unless cached.is_a?(Array) && cached.length == 3
+        return nil unless cached[0].is_a?(Effects::EffectTable) && cached[1].is_a?(Hash)
+
+        cached
+      end
+
+      # Loaded once, and shared by the key and the answer. `#prepare` is deliberately not run: a
+      # plugin's effect contributions are fixed by `init`, and `#prepare` is the half that parses
+      # routes and walks worker trees — the cost this probe exists to skip.
+      def plugin_facts
+        return @plugin_facts if defined?(@plugin_facts)
+
+        @plugin_facts = Effects::PluginFacts.build(plugin_registry)
+      end
+
+      def plugin_registry
+        services = Plugin::Services.new(reflection: Reflection, type: Type::Combinator,
+                                        configuration: @configuration, cache_store: nil)
+        Plugin::Loader.load(configuration: @configuration, services: services)
+      rescue StandardError, ScriptError
+        nil
+      end
+
+      def registry
+        @registry ||= Effects::Registry.for_configuration(@configuration, plugin_facts: plugin_facts)
+      end
+    end
+  end
+end

data/lib/rigor/analysis/incremental.rb

@@ -120,6 +120,34 @@ module Rigor
         appeared.freeze
       end
 
+      # Issue #644 — the qualified constant names whose PUBLICATION could have moved in this edit: the names
+      # whose per-file census descriptor differs between the before- and after-state of any file in `paths`.
+      # The value-constant twin of {appeared_classes}, and deliberately NOT its analogue — a class either
+      # exists or does not, whereas a constant's published answer is a function of the whole project's write
+      # set for the name, so a *name* diff is the wrong question. All four ways the answer moves are a
+      # descriptor change and none of them is an appearance:
+      #
+      # - the value edited (`[50]` -> `[7]`),
+      # - the write becoming unpublishable or publishable again (`[50]` <-> `:unpublishable`),
+      # - a SECOND declarer appearing, which drops the name to `Dynamic` (`{}` -> `{NAME => …}` in that file),
+      # - a second declarer going away, which restores the precise answer.
+      #
+      # `paths` MUST therefore include removed files as well as changed and added ones; a removed file's
+      # after-state is simply absent, so its whole before-census counts as changed. Returns a frozen Set of
+      # qualified-name Strings. `before` / `after` map a path to `{name => descriptor}`.
+      def changed_constant_publications(paths, before, after)
+        moved = Set.new
+        paths.each do |path|
+          was = before[path] || {}
+          now = after[path]  || {}
+          # `eql?`, not `==`: `[1] == [1.0]` is TRUE, so `LIMIT = 1` becoming `LIMIT = 1.0` would move the
+          # published type (`Constant[1]` -> `Constant[1.0]`) while this diff called it unchanged. The
+          # declaration signature backstops that case today; the producer must not depend on it.
+          (was.keys | now.keys).each { |name| moved << name unless was[name].eql?(now[name]) }
+        end
+        moved.freeze
+      end
+
       # ADR-46 slice 3 — the consumers to re-check because a name they looked up and *missed* (a negative
       # dependency) now resolves. `keys` is the set of negative-dependency keys (`"toplevel:foo"` /
       # `"method:C#m"`) the appeared symbols would satisfy; `negative_dependents` maps each key to the Set of

data/lib/rigor/analysis/incremental_session.rb

@@ -98,6 +98,10 @@ module Rigor
         @missing = {}              # consumer => Set<"kind:name"> it looked up and missed
         @negative_dependents = {}  # "kind:name" => Set<consumer> (inverted @missing)
         @class_decls = {}          # path => Set<qualified class name declared in the file>
+        # Issue #644 — the value-constant twin: path => { qualified constant name => publication descriptor }.
+        # Diffed on a recheck to find every constant whose PUBLISHED answer could have moved, which satisfies
+        # the `constant:` edges a reader records at every reference, resolved or not.
+        @constant_decls = {}
         # ADR-89 WD2 — per-def observed-key return summaries: [path, symbol] => { keys:, returns:, effects: }.
         # Harvested from the ADR-84 return memo after each run; drives the behavioural-stability gate.
         @return_summaries = {}
@@ -259,6 +263,7 @@ module Rigor
         declaration_signatures = (summary && summary[:declaration_signatures]) || {}
         new_fps = symbol_fingerprints_from_index(scan_index)
         new_class_decls = class_declarations_from_index(scan_index)
+        new_constant_decls = constant_declarations_from_index(scan_index)
         changed_pairs = Incremental.changed_symbol_pairs(changed, @symbol_fingerprints, new_fps)
         # ADR-89 WD1 — a changed file whose DECLARATION signature (per-def parameter shape / visibility /
         # ancestry / member layout / def line, bodies excluded) is byte-identical to the snapshot is
@@ -275,7 +280,8 @@ module Rigor
         # minus those stable pairs, and only it (not `changed_pairs`) drives the symbol-dependent fan-out.
         symbol_pairs = behaviourally_unstable_pairs(changed_pairs, unstable, scan_index) | param_pairs
         base = dependents_base(unstable, symbol_pairs)
-        closure = base | changed.to_set | added.to_set | negative_affected(scan, new_fps, new_class_decls)
+        closure = base | changed.to_set | added.to_set |
+                  negative_affected(scan, removed, new_fps, new_class_decls, new_constant_decls)
         closure = param_seed_closure(closure, param_files)
         removed.each { |path| closure |= @dependents[path] || Set.new }
         closure.freeze
@@ -550,12 +556,7 @@ module Rigor
         @symbol_sources    = payload.symbol_sources    || {}
         @ancestry_sources  = payload.ancestry_sources  || {}
         @symbol_fingerprints = payload.symbol_fingerprints || {}
-        # ADR-46 slice 3 — restore negative edges if present (absent in pre-slice-3 snapshots → empty, which
-        # only loses the appeared-symbol re-check refinement; such a snapshot is never loaded by a slice-3+
-        # engine because the engine version + schema is part of the snapshot fingerprint, and
-        # `--verify-incremental` backstops any residual under-capture, so it is never unsound).
-        @missing           = payload.missing || {}
-        @class_decls       = payload.class_decls || {}
+        restore_structural_declarations(payload)
         @return_summaries  = payload.return_summaries || {}
         @param_table       = payload.param_table || {} # ADR-67 WD6c lift — the seeds the cache was built under.
         # ADR-103 WD13 / #382 — the effects sidecar rides its own identity, so a snapshot whose summaries
@@ -569,12 +570,24 @@ module Rigor
         @negative_dependents = Incremental.invert(@missing)
       end
 
+      # ADR-46 slice 3 / issue #644 — the structural tier's negative-edge state: the per-consumer missed
+      # lookups plus the two per-file DECLARATION sets (`class_decls`, `constant_decls`) whose diff says what
+      # APPEARED in an edit. Absent in an older snapshot → empty, which only loses the appeared-symbol
+      # refinement; such a snapshot is never loaded by a newer engine (the version + SCHEMA are part of the
+      # fingerprint) and `--verify-incremental` backstops any residual under-capture. Extracted to keep
+      # {#restore} under its ABC budget.
+      def restore_structural_declarations(payload)
+        @missing        = payload.missing || {}
+        @class_decls    = payload.class_decls || {}
+        @constant_decls = payload.constant_decls || {}
+      end
+
       def to_payload
         Cache::IncrementalSnapshot::Payload.new(
           cache: @cache, sources: @sources, digests: @digests, analyzed: @analyzed,
           symbol_sources: @symbol_sources, ancestry_sources: @ancestry_sources,
           symbol_fingerprints: @symbol_fingerprints, missing: @missing,
-          class_decls: @class_decls, seed_bundles: @seed_bundles,
+          class_decls: @class_decls, constant_decls: @constant_decls, seed_bundles: @seed_bundles,
           plugin_fact_digest: @plugin_fact_digest,
           return_summaries: marshal_safe_return_summaries,
           param_table: marshal_safe_param_table,
@@ -754,6 +767,7 @@ module Rigor
         # Wholesale replace (the subset runner's pre-pass is complete): a file that lost its last class must
         # drop out of the map so a later re-add registers as an appearance.
         @class_decls = runner.class_declarations
+        @constant_decls = runner.constant_declarations
       end
 
       # Per-symbol body fingerprints from the pre-parsed `index` (the shared scan-summary def-index — Prism
@@ -792,11 +806,18 @@ module Rigor
       # a prior missed lookup. Maps each appeared `"ClassName#method"` to the negative-dependency key it
       # would satisfy (`toplevel:foo` for a top-level def, `method:C#m` otherwise), then unions the recorded
       # negative-dependents of those keys.
-      def negative_affected(changed, new_fingerprints, new_class_decls)
+      def negative_affected(changed, removed, new_fingerprints, new_class_decls, new_constant_decls)
         appeared_methods = Incremental.appeared_symbols(changed, @symbol_fingerprints, new_fingerprints)
         appeared_classes = Incremental.appeared_classes(changed, @class_decls, new_class_decls)
+        # Issue #644 — a constant whose PUBLICATION moved satisfies the `constant:` kind, keyed on the same
+        # last segment the consumer recorded. REMOVED files join the diff here and nowhere else: deleting a
+        # second declarer restores the precise answer, and no other producer input can see that.
+        moved_constants = Incremental.changed_constant_publications(
+          changed + removed, @constant_decls, new_constant_decls
+        )
         keys = appeared_methods.map { |symbol| negative_key_for(symbol) }
         keys.concat(appeared_classes.map { |klass| "class:#{klass.split('::').last}" })
+        keys.concat(moved_constants.map { |name| "constant:#{name.split('::').last}" })
         Incremental.negative_closure(keys, @negative_dependents)
       end
 
@@ -812,6 +833,20 @@ module Rigor
         result.transform_values(&:freeze).freeze
       end
 
+      # Issue #644 — the per-file PUBLICATION CENSUS of the pre-parsed `index`:
+      # `{ path => { constant name => descriptor } }`, the twin of {#class_declarations_from_index}. The
+      # descriptor is what the diff compares — see {Incremental.changed_constant_publications} for why a bare
+      # name set cannot answer the question.
+      def constant_declarations_from_index(index)
+        return {} if index.nil?
+
+        result = Hash.new { |hash, key| hash[key] = {} }
+        index[:constant_writes].each do |name, by_path|
+          by_path.each { |path, descriptor| result[path][name] = descriptor }
+        end
+        result.transform_values(&:freeze).freeze
+      end
+
       # ADR-89 WD2 — the (live, freshly parsed) def node for a `"Class#method"` / `"Class.method"` symbol in
       # the changed-set scan index, or nil. Instance methods live under `def_nodes`, singleton under
       # `singleton_def_nodes`, both keyed by class name then method Symbol.

data/lib/rigor/analysis/plugin_fact_fingerprint.rb

@@ -151,7 +151,7 @@ module Rigor
       # value actually moves (a new action, a changed sig), which is what a cached diagnostic can depend on;
       # a value-preserving edit keeps the recheck incremental. Returns true when the plugin declared at least
       # one producer (a surface); a producer whose value cannot be digested marks the plugin opaque.
-      # rubocop:disable Naming/PredicateMethod -- reports has-surface AND appends parts (a side-effecting builder)
+      # rubocop:disable-next Naming/PredicateMethod -- reports has-surface AND appends parts (a side-effecting builder)
       def collect_producer_parts(plugin, id, parts, opaque)
         producer_ids = plugin.class.producers.keys
         return false if producer_ids.empty?
@@ -163,7 +163,6 @@ module Rigor
         end
         true
       end
-      # rubocop:enable Naming/PredicateMethod
 
       # Channel (c): the optional {Plugin::Base#incremental_state_fingerprint} hook. Returns true when the
       # plugin defines it (it has a surface).

data/lib/rigor/analysis/reachability/graph.rb

@@ -54,16 +54,25 @@ module Rigor
           reachable = walk(edges, seeds: production_seeds | test_seeds, roles: %i[production task config test])
           unreached = @owned - reachable
           namespaces = namespace_only(unreached, reachable)
-          undecidable = tainted(unreached - namespaces)
+          # The data-file demotion applies to BOTH buckets it can speak to, which is what the tier
+          # contract says and what the implementation had narrowed (#370). See {#tainted}.
+          test_only = reachable - production
+          undecidable = tainted(unreached - namespaces).merge(tainted(test_only))
+          build_report(edges: edges, reachable: reachable, unreached: unreached, namespaces: namespaces,
+                       test_only: test_only, undecidable: undecidable)
+        end
+
+        private
+
+        def build_report(edges:, reachable:, unreached:, namespaces:, test_only:, undecidable:)
+          demoted = undecidable.keys.to_set
           Report.new(declared: @owned.size, reachable: reachable.size,
-                     candidates: rows(unreached - namespaces - undecidable.keys.to_set),
+                     candidates: rows(unreached - namespaces - demoted),
                      undecidable: undecidable.map { |fqn, reason| undecidable_row(fqn, reason) }.freeze,
-                     test_only: rows(reachable - production),
+                     test_only: rows(test_only - demoted),
                      namespaces: namespaces.size, roots: production_seeds.size, edges: edges.size)
         end
 
-        private
-
         # A literal-argument `"Foo::Bar".constantize` names its constant exactly, so it is a REFERENCE, not an
         # unknown. Keeping this distinct from the taint below is what stops the tier being a blanket namespace
         # poison — Rigor knows the argument's shape, and a type-free indexer does not.
@@ -72,21 +81,32 @@ module Rigor
             next if use.name.nil?
 
             Scan::Reference.new(as_written: use.name.sub(/\A::/, ""), nesting: [].freeze, from: nil,
-                                role: :production, path: use.path, line: use.line)
+                                role: :production, path: use.path, line: use.line,
+                                rooted: use.name.start_with?("::"))
           end
         end
 
-        # `{fqn => reason}` for every unreached declaration a dynamic site could still be naming. A site with a
+        # `{fqn => reason}` for every declaration in `fqns` a dynamic site could still be naming. A site with a
         # literal prefix taints that namespace and everything under it; a site with no prefix at all cannot be
         # bounded, so it taints nothing rather than everything — poisoning the whole project would empty the
         # report and teach the reader that the tier means nothing.
-        def tainted(unreached)
-          prefixes = @dynamic_uses.filter_map { |use| [use.prefix, use] if use.name.nil? && use.prefix }
+        #
+        # Asked of the unreached AND of the test-only set (#370). The tier contract says a name appearing in a
+        # data file "MUST demote to this tier"; the implementation had asked only about the unreached, so a
+        # declaration a spec references AND `config/recurring.yml` names kept its data-file evidence discarded
+        # and landed under "live test, dead production path". That heading is an assertion about production,
+        # and a scheduler entry is evidence against it — the reported case runs every three minutes.
+        #
+        # Both buckets ask a different question of the same ambiguity ("is this dead?" against "is the
+        # production path dead?"), and the answer for both is that this reading cannot settle it. The reason
+        # string is what tells the two apart for a reader, so it names the evidence rather than the bucket.
+        def tainted(fqns)
+          sites = @dynamic_uses.select { |use| use.name.nil? && use.prefix }
 
-          return {} if prefixes.empty?
+          return {} if sites.empty?
 
-          unreached.each_with_object({}) do |fqn, out|
-            _, use = prefixes.find { |prefix, _| fqn == prefix || fqn.start_with?("#{prefix}::") }
+          fqns.each_with_object({}) do |fqn, out|
+            use = sites.find { |site| site.taints?(fqn) }
             out[fqn] = use.site.nil? ? use.reason : "#{use.reason} (#{use.site})" if use
           end
         end
@@ -129,7 +149,7 @@ module Rigor
           @references.each do |ref|
             next unless yield(ref)
 
-            target = resolve(ref.as_written, ref.nesting)
+            target = resolve(ref.as_written, ref.nesting, rooted: ref.rooted)
             set << target if target && @owned.include?(target)
           end
           set
@@ -138,7 +158,7 @@ module Rigor
         # `[from_fqn_or_nil, to_fqn, role]` for every reference that resolves to an owned declaration.
         def resolved_edges
           @resolved_edges ||= @references.filter_map do |ref|
-            target = resolve(ref.as_written, ref.nesting)
+            target = resolve(ref.as_written, ref.nesting, rooted: ref.rooted)
             next unless target && @owned.include?(target)
             next if ref.from == target # a declaration referencing itself is not evidence of use
 
@@ -178,8 +198,16 @@ module Rigor
         end
 
         # Ruby's constant lookup at name granularity: `Module.nesting` innermost first, then the ancestors of
-        # the innermost cresting scope (#354), then the bare name.
-        def resolve(as_written, nesting)
+        # the innermost cresting scope (#354), then the bare name. When `rooted: true`, lexical nesting and
+        # ancestors are skipped, answering the top-level declaration directly (#625).
+        def resolve(as_written, nesting, rooted: false)
+          if rooted
+            return as_written if @by_fqn.key?(as_written)
+
+            idx = as_written.rindex("::")
+            return idx ? resolve(as_written[0, idx], nesting, rooted: true) : nil
+          end
+
           walker = nesting.dup
           until walker.empty?
             candidate = (walker + [as_written]).join("::")

data/lib/rigor/analysis/reachability/plugin_roots.rb

@@ -86,12 +86,16 @@ module Rigor
         # @param configuration [Rigor::Configuration] the loaded project configuration.
         # @param plugin_requirer [#call] how a plugin gem is brought into the process. The same seam
         #   `Analysis::Runner` exposes, so a spec can register a plugin class without publishing a gem.
+        # @param cache_store [Rigor::Cache::Store, nil] when given, each plugin's `#prepare` producers read
+        #   and write the same ADR-60 record-and-validate slots they use under `rigor check`, instead of
+        #   recomputing from scratch — a routes parse or a factory discovery is a validated cache read on
+        #   every invocation after the first. Nil keeps the historical recompute-always behaviour.
         # @return [Contribution] sorted and de-duplicated. Empty whenever the project declares no plugins, no
         #   plugin contributes anything, or anything at all goes wrong.
-        def collect(configuration:, plugin_requirer: ->(name) { require name })
+        def collect(configuration:, plugin_requirer: ->(name) { require name }, cache_store: nil)
           return Contribution.empty if configuration.plugins.empty?
 
-          services = build_services(configuration)
+          services = build_services(configuration, cache_store)
           registry = Plugin::Loader.load(configuration: configuration, services: services,
                                          requirer: plugin_requirer)
           return Contribution.empty if registry.nil? || registry.empty?
@@ -102,16 +106,15 @@ module Rigor
           Contribution.empty
         end
 
-        # Mirrors `CLI::ProbeEnvironment.load_plugin_registry`: a `Plugin::Services` with no cache store
-        # (this is a one-shot report, so a producer recomputes rather than reading and writing cache slots)
-        # driving `Plugin::Loader.load`. Holding the `Services` is what gives access to the fact store the
-        # loaded plugins share — the loader hands the same instance to every plugin.
-        def build_services(configuration)
+        # Mirrors `Analysis::WorkerSession`'s services: the shared fact store plus whatever cache store the
+        # caller holds. Holding the `Services` is what gives access to the fact store the loaded plugins
+        # share — the loader hands the same instance to every plugin.
+        def build_services(configuration, cache_store)
           Plugin::Services.new(
             reflection: Reflection,
             type: Type::Combinator,
             configuration: configuration,
-            cache_store: nil
+            cache_store: cache_store
           )
         end