rigortype 0.3.8 → 0.4.0

data/lib/rigor/analysis/crash_signature.rb

@@ -87,12 +87,13 @@ module Rigor
       # user — every rule fired — but NOT a valid measurement of Rigor itself, so a harness that scores
       # Rigor's behaviour should treat one of these as a crash finding the way it treats `:check_rule`, or
       # a mutant that re-breaks the HKT scan (#776 was one) scores as a measurement over a silently degraded
-      # universe. What consults it today: `tool/mutation`'s fuzz crash detector — on the severity-resolved
-      # stream, so a `severity_overrides: rbs: off` hides the row from it. What does NOT yet: the ADR-69
-      # kill oracle (`Protection::AnalysisGuard` reads `Result#crashed?`, which excludes every
-      # `:rbs_build` row), and both harnesses still reuse one Environment across mutants, which memoises
-      # the degraded registry after the first defect. Arming the oracle, inspecting the pre-severity row,
-      # and resetting the Environment are issue #790.
+      # universe. Both Rigor-measuring harnesses consult it (#790): `tool/mutation`'s fuzz crash detector
+      # and {Protection::AnalysisGuard}, the ADR-69 kill oracles' refusal. Neither reads it alone — the row
+      # is severity-stamped like any other, so `severity_overrides:` can drop it from a run's diagnostics
+      # entirely, and each harness also reads {Rigor::Environment#hkt_scan_failure}, the pre-severity record
+      # the row is derived from. Both also replace their Environment after a defect: the registry build is
+      # memoised and the failure slot is first-write-wins, so an Environment that degraded once stays
+      # degraded for every later mutant.
       ANALYZER_DEFECT_RULES = %w[
         rbs.coverage.hkt-scan-failed
       ].freeze
@@ -103,9 +104,6 @@ module Rigor
       # into. Built here, not at either rescue site, so the two twins cannot drift (issue #665) — and so
       # the appended crash frame is derived identically on the sequential and pooled paths. Keeps the
       # {CHECK_RULE_MESSAGE_PREFIX} prefix every consumer matches on; the frame is a trailing hint.
-      #
-      # @param error [StandardError]
-      # @return [String]
       def check_rule_message(error)
         base = "#{CHECK_RULE_MESSAGE_PREFIX}: #{error.class}: #{error.message}"
         frame = crash_frame(error)
@@ -117,9 +115,6 @@ module Rigor
       # bundled or third-party plugin also lives under `lib/rigor/<plugin>/`, so a frame here says where
       # the raise was, never whose defect it is. Falls back to the raw top frame when the crash is entirely
       # inside a dependency, and to nil when there is no backtrace at all.
-      #
-      # @param error [Exception]
-      # @return [String, nil]
       def crash_frame(error)
         frames = error.backtrace
         return nil if frames.nil? || frames.empty?
@@ -132,15 +127,11 @@ module Rigor
       # (the fork pool) rather than deriving it fresh from a live `Exception` — can relativize the frame it
       # already has without re-deriving `.crash_frame`'s "which frame" choice. Nil-safe, and a no-op (`sub`
       # never matches) on a frame with no `lib/rigor/` segment at all.
-      #
-      # @param frame [String, nil]
-      # @return [String, nil]
       def relativize_frame(frame)
         frame&.sub(%r{\A.*/(lib/rigor/)}, '\1')
       end
 
-      # @param diagnostic [Rigor::Analysis::Diagnostic]
-      # @return [Symbol, nil] `:check_rule`, `:plugin`, `:rbs_build`, or nil for an ordinary diagnostic.
+      # @return `:check_rule`, `:plugin`, `:rbs_build`, or nil for an ordinary diagnostic.
       def reason(diagnostic)
         return :check_rule if diagnostic.message.to_s.start_with?(CHECK_RULE_MESSAGE_PREFIX)
         return :plugin if plugin_isolation_row?(diagnostic)
@@ -152,8 +143,6 @@ module Rigor
       # True when `diagnostic` is the rescue row that REPLACED a file's analysis — the only shape after which
       # the run's diagnostics say nothing about the code. NOT a general "something went wrong" predicate; see
       # the class doc for why `:plugin` and `:rbs_build` are excluded.
-      #
-      # @param diagnostic [Rigor::Analysis::Diagnostic]
       def discards_file_analysis?(diagnostic)
         reason(diagnostic) == DISCARDS_FILE_ANALYSIS_REASON
       end
@@ -162,17 +151,12 @@ module Rigor
       # measurement of Rigor — see {ANALYZER_DEFECT_RULES}. Orthogonal to {.discards_file_analysis?}: the
       # user-facing tier reads the run; the Rigor-measuring tier should refuse it (the mutation fuzz does,
       # the ADR-69 kill oracle does not yet — #790).
-      #
-      # @param diagnostic [Rigor::Analysis::Diagnostic]
       def analyzer_defect?(diagnostic)
         ANALYZER_DEFECT_RULES.include?(diagnostic.rule)
       end
 
       # A one-line "<reason> at <path>:<line>: <message>" for a failure message, so whoever reads the raise
       # sees which shape fired and where without re-deriving it.
-      #
-      # @param diagnostic [Rigor::Analysis::Diagnostic]
-      # @return [String]
       def describe(diagnostic)
         "#{reason(diagnostic) || :unknown} at #{diagnostic.path}:#{diagnostic.line}: #{diagnostic.message}"
       end

data/lib/rigor/analysis/dependency_recorder.rb

@@ -126,6 +126,29 @@ module Rigor
         [result, capture.snapshot]
       end
 
+      # Issue #992 — runs the block with its reads DETACHED from the current consumer (and from any enclosing
+      # capture) and returns `[block_result, read_set]`, so a caller that learns only afterwards whether its
+      # answer depended on those reads can {replay} them or drop them. `call.wrong-arity` reads a class's whole
+      # envelope bucket to decide a call that turns out to fit, and recording that as a file-level ancestry
+      # edge would make every correct call on a project class re-check on any edit to the class's files.
+      # Returns a nil read set when no recording is active.
+      def withhold
+        previous = Thread.current[KEY]
+        return [yield, nil] if previous.nil?
+
+        previous_captures = Thread.current[CAPTURE_KEY]
+        capture = Capture.new
+        Thread.current[KEY] = Accumulator.new(previous.consumer)
+        Thread.current[CAPTURE_KEY] = [capture]
+        begin
+          result = yield
+        ensure
+          Thread.current[KEY] = previous
+          Thread.current[CAPTURE_KEY] = previous_captures
+        end
+        [result, capture.snapshot]
+      end
+
       # ADR-84 WD2 — replays a {ReadSet} into the current consumer's accumulator as if each read happened
       # here, applying the same per-consumer self-read filter as {read_site}, and tees into every active
       # capture so an enclosing capture window stays transitive when a memo hit substitutes for a body walk.

data/lib/rigor/analysis/dependency_source_inference/boundary_cross_reporter.rb

@@ -25,7 +25,7 @@ module Rigor
           @mutex = Mutex.new
         end
 
-        # @return [Array<Entry>] frozen snapshot of the recorded boundary-cross events. Each entry is a Data
+        # @return frozen snapshot of the recorded boundary-cross events. Each entry is a Data
         #   with `class_name` (String), `method_name` (Symbol), `gem_name` (String), and `rbs_display` (String
         #   — the authoritative-side type's human-facing form, embedded into the diagnostic message).
         def entries

data/lib/rigor/analysis/dependency_source_inference/builder.rb

@@ -17,8 +17,6 @@ module Rigor
       module Builder
         module_function
 
-        # @param dependencies [Rigor::Configuration::Dependencies]
-        # @return [Index]
         def build(dependencies)
           return Index::EMPTY if dependencies.empty?
 

data/lib/rigor/analysis/dependency_source_inference/gem_resolver.rb

@@ -30,8 +30,6 @@ module Rigor
 
         module_function
 
-        # @param entry [Rigor::Configuration::Dependencies::Entry]
-        # @return [Resolved, Unresolvable]
         def resolve(entry)
           spec = locate_gem_spec(entry.gem)
           return Unresolvable.new(gem_name: entry.gem, reason: :not_in_bundle) if spec.nil?

data/lib/rigor/analysis/dependency_source_inference/index.rb

@@ -13,19 +13,19 @@ module Rigor
         attr_reader :resolved_gems, :unresolvable, :method_catalog, :budget_exceeded,
                     :class_to_gem, :budget_overrun_strategy, :gem_modes
 
-        # @param method_catalog [Hash{[String, Symbol] => Symbol}] the flat
+        # @param method_catalog — => Symbol}] the flat
         #   `(class_name, method_name) → :instance | :singleton` table produced by {Walker.walk}, aggregated
         #   across every resolved gem in the run. The Index itself stays gem-agnostic — the per-gem
         #   attribution that slice 3's cache descriptor needs lives on `Resolved`, not here.
-        # @param budget_exceeded [Array<String>] gem names whose {Walker} run hit the per-gem catalog cap
+        # @param budget_exceeded — gem names whose {Walker} run hit the per-gem catalog cap
         #   (slice 4). The Runner consumes this list to emit one `dynamic.dependency-source.budget-exceeded`
         #   warning per gem.
-        # @param class_to_gem [Hash<String, String>] reverse lookup `class_name → gem_name` (slice 5b). Built
+        # @param class_to_gem — reverse lookup `class_name → gem_name` (slice 5b). Built
         #   first-write-wins: when two opt-in gems re-open the same class, the first gem owns it. The
         #   dispatcher consults this map under the `:dependency_silence` budget overrun strategy so call
         #   sites on a budget-exceeded gem's classes degrade to `Dynamic[top]` instead of falling through to
         #   the user-class fallback.
-        # @param gem_modes [Hash<String, Symbol>] per-gem mode table (`gem_name → :disabled | :when_missing |
+        # @param gem_modes — per-gem mode table (`gem_name → :disabled | :when_missing |
         #   :full`). ADR-10 slice 5c consults this through {#mode_for} to identify call sites where
         #   gem-source and RBS both contribute under `mode: :full`. The map is keyed on `gem_name` (not
         #   class) because re-opened classes belong to the first gem they appeared in per `class_to_gem`;
@@ -56,7 +56,7 @@ module Rigor
         end
         private :normalize_catalog
 
-        # @return [String, nil] the gem that owns `class_name` (first-write-wins); `nil` when the class isn't
+        # @return the gem that owns `class_name` (first-write-wins); `nil` when the class isn't
         #   in any opt-in gem's catalog.
         def gem_for(class_name)
           @class_to_gem[class_name]

data/lib/rigor/analysis/dependency_source_inference/return_type_heuristic.rb

@@ -28,8 +28,7 @@ module Rigor
       module ReturnTypeHeuristic
         module_function
 
-        # @param def_node [Prism::DefNode]
-        # @return [Rigor::Type, nil] heuristic return type, or `nil` when the body's tail expression doesn't
+        # @return heuristic return type, or `nil` when the body's tail expression doesn't
         #   match any of the recognised shapes.
         def extract(def_node)
           body = def_node.body

data/lib/rigor/analysis/dependency_source_inference/walker.rb

@@ -55,12 +55,12 @@ module Rigor
 
         module_function
 
-        # @param gem_dir [String, Pathname] absolute path to the gem's installation directory.
-        # @param roots [Array<String>] subdirectory names within the gem to walk (defaults to `["lib"]` per
+        # @param gem_dir — absolute path to the gem's installation directory.
+        # @param roots — subdirectory names within the gem to walk (defaults to `["lib"]` per
         #   `Configuration::Dependencies::Entry`).
-        # @param budget [Integer, Float] per-gem catalog cap (method-definition count). When unset, defaults
+        # @param budget — per-gem catalog cap (method-definition count). When unset, defaults
         #   to `UNBOUNDED` for backwards-compatible test paths.
-        # @return [Outcome] frozen wrapper carrying the catalog (`Hash{[class_name, method_name] =>
+        # @return frozen wrapper carrying the catalog (`Hash{[class_name, method_name] =>
         #   :instance | :singleton}`) and a `truncated?` flag set when the walker stopped harvesting because
         #   the budget was reached. Methods of identical name on the same class with different kinds (rare;
         #   private API mostly) carry the kind that wins the per-class first walk.

data/lib/rigor/analysis/effects_cache_probe.rb

@@ -52,17 +52,16 @@ module Rigor
       # otherwise rebuild (the probe loaded the plugins to key the entry, so it already knows it).
       Served = Data.define(:table, :sources, :registry, :plugin_facts)
 
-      # @param configuration [Rigor::Configuration] with effects already enabled by the caller.
-      # @param cache_root [String, nil]
+      # @param configuration — with effects already enabled by the caller.
       def initialize(configuration:, cache_root:)
         @configuration = configuration
         @cache_root = cache_root
       end
 
-      # @param paths [Array<String>] the analysed set — `configuration.paths` unioned with any path
+      # @param paths — the analysed set — `configuration.paths` unioned with any path
       #   arguments, exactly what {CLI::EffectsCommand#analyze} hands the runner, because the analysed
       #   set is part of the diagnostics key.
-      # @return [Served, nil] nil to decline, on any failure whatsoever.
+      # @return nil to decline, on any failure whatsoever.
       def serve(paths)
         return nil if @cache_root.nil? || !@configuration.effects_check?
 

data/lib/rigor/analysis/erb_template_detector.rb

@@ -19,8 +19,7 @@ module Rigor
 
       module_function
 
-      # @param parse_result [Prism::ParseResult]
-      # @return [Boolean] true when the parsed source looks like an ERB template (parse errors expected;
+      # @return true when the parsed source looks like an ERB template (parse errors expected;
       #   analysis should skip).
       def template?(parse_result)
         source = parse_result.source.source

data/lib/rigor/analysis/fact_store.rb

@@ -18,9 +18,23 @@ module Rigor
       ].freeze
 
       class Target < Data.define(:kind, :name)
+        # #775 — a target is an immutable value keyed by its name, and the local target is built on every
+        # binding (`Scope#with_local` invalidates through it) and every local-fact read: ~350k times on
+        # the lib self-check for a few thousand distinct names. One shared instance per name.
+        #
+        # #1055 — the table is a class ivar holding an unshareable Hash, and a non-main Ractor may neither
+        # write one nor read one. A pool worker therefore pays the allocation instead of sharing the
+        # instance: the interning is a per-process ALLOCATION saving, never an identity contract (`Target`
+        # is a `Data` value and compares by value), so declining it changes nothing a caller can observe.
+        # The guard is a C-level predicate on the hot path, which is what keeps the sequential run's
+        # saving intact.
         def self.local(name)
-          new(kind: :local, name: name.to_sym)
+          name = name.to_sym
+          return new(kind: :local, name: name) unless Ractor.main?
+
+          @local_targets[name] ||= new(kind: :local, name: name)
         end
+        @local_targets = {}
 
         def initialize(kind:, name:)
           super(kind: kind.to_sym, name: name)

data/lib/rigor/analysis/incremental.rb

@@ -120,6 +120,48 @@ module Rigor
         appeared.freeze
       end
 
+      # Issue #1120 — the method names whose refinements moved in this edit: a `[refined class, method, refining
+      # module]` entry that appeared in, or vanished from, any file in `paths`. A consumer whose
+      # `call.undefined-method` answer consulted the refinement table recorded a `refinement:<method>` edge
+      # whichever way it answered, because the answer is a function of the whole project's refinements of that
+      # name. `paths` MUST include removed files, whose whole before-table vanished. `before` / `after` map a
+      # path to that file's `{refined class => {method => [modules]}}` table (nil when it refines nothing).
+      def changed_refinement_names(paths, before, after)
+        moved = Set.new
+        paths.each do |path|
+          entries_before = refinement_entries(before[path])
+          entries_after = refinement_entries(after[path])
+          (entries_before ^ entries_after).each { |(_refined, method_name, _module)| moved << method_name }
+        end
+        moved.freeze
+      end
+
+      def refinement_entries(table)
+        entries = Set.new
+        table&.each do |refined, methods|
+          methods.each do |method_name, modules|
+            modules.each { |refining| entries << [refined, method_name, refining] }
+          end
+        end
+        entries
+      end
+
+      # Issue #639 — the SYMMETRIC reading of {appeared_classes}: the names whose declaration in a file
+      # appeared OR VANISHED. Appearance alone answered the miss side, which was the only side recording a
+      # `class:` edge; a bare reference that RESOLVED now records one too, and what invalidates it is the
+      # declaration going away. `paths` MUST therefore include REMOVED files — a removed file has no
+      # after-state, so its whole before-set vanished — which is the same reason
+      # {changed_constant_publications} diffs over `changed + removed`.
+      def changed_class_declarations(paths, decls_before, decls_after)
+        moved = Set.new
+        paths.each do |path|
+          before = decls_before[path] || Set.new
+          after  = decls_after[path]  || Set.new
+          moved.merge(after ^ before)
+        end
+        moved.freeze
+      end
+
       # Issue #644 — the qualified constant names whose PUBLICATION could have moved in this edit: the names
       # whose per-file census descriptor differs between the before- and after-state of any file in `paths`.
       # The value-constant twin of {appeared_classes}, and deliberately NOT its analogue — a class either

data/lib/rigor/analysis/incremental_session.rb

@@ -42,22 +42,22 @@ module Rigor
         end
       end
 
-      # @param paths [Array<String>, nil] explicit analysis roots; nil (the default) uses the configuration's
+      # @param paths — explicit analysis roots; nil (the default) uses the configuration's
       #   `paths:`.
-      # @param environment [Rigor::Environment, nil] optional shared environment to thread into each internal
+      # @param environment — optional shared environment to thread into each internal
       #   Runner. Long-lived callers and specs can use this to avoid rebuilding the same RBS universe for
       #   every baseline / recheck / oracle run.
-      # @param cache_store [Rigor::Cache::Store, nil] ADR-85 WD1 — the persistent cache each internal Runner
+      # @param cache_store — ADR-85 WD1 — the persistent cache each internal Runner
       #   exposes to the RBS-env and plugin-producer tiers. A cross-process `--incremental` recheck otherwise
       #   rebuilt a fresh runner with no store, so every plugin `#prepare` producer (the ADR-9/#74/ADR-60 WD3
       #   record-and-validate caches) recomputed per invocation — 86% of a Rails warm incremental. Threading
       #   the store lets those producers serve from disk. `nil` (the default) preserves the pre-#85 behaviour
       #   the specs assert; the whole-run ADR-45 result cache stays disabled on these runs
       #   (`Runner#run_result_cacheable?` excludes `record_dependencies` / `analyze_only`).
-      # @param plugin_requirer [#call, nil] optional gem-require hook threaded into each internal Runner
+      # @param plugin_requirer — optional gem-require hook threaded into each internal Runner
       #   (mirrors {Runner}'s parameter). nil (the default, and what the CLI passes) uses `Kernel.require`;
       #   embedders and specs inject a fake so a test plugin registers without touching the real load path.
-      # @param workers [Integer] ADR-46 — the resolved fork-pool worker count threaded into every internal
+      # @param workers — ADR-46 — the resolved fork-pool worker count threaded into every internal
       #   analyzer, so a `--incremental` recheck's closure re-analysis parallelises exactly like the standard
       #   `check` path (the recon's audit: `--workers` / `RIGOR_RACTOR_WORKERS` / `parallel.workers:` were
       #   silently ignored because `build_runner` passed no `workers:`). 0 (the default, and what the specs and
@@ -112,7 +112,7 @@ module Rigor
         # and a missing invalidation edge is impossible by construction — the reason this is a table diff
         # and not the caller→callee edge recording #204 first sketched.
         @param_table = {}
-        reset_effect_state
+        reset_carried_state
         # ADR-88 WD1 — the plugin fact-surface digest computed for THIS invocation (nil until a
         # `#run_incremental` pass runs / a plugin-free project) and the reporting flags a caller (the CLI
         # banner + `--cache-stats`) reads after `#run_incremental`. `@last_runner` is the analysis runner the
@@ -162,7 +162,11 @@ module Rigor
         runner = build_runner(record_dependencies: true)
         diagnostics = run_runner(runner).diagnostics
         @last_runner = runner # ADR-88 WD1 — the post-hoc fact-surface fingerprint reads this prepared registry.
-        @analyzed = runner.analyzed_files
+        # #392 — the template units are deliberately NOT in the analysed set. `Runner#target_files`
+        # re-analyses every unit on every run, so a unit must never be reused from the per-file cache and
+        # must never read as a file that VANISHED from the project on the next recheck (which is what
+        # `previous - current` would say, `current_files` being a `.rb` expansion).
+        @analyzed = runner.analyzed_files - runner.template_unit_paths
         @seed_bundles = runner.seed_bundles # ADR-85 WD2 — the freshly built bundle set for the next run.
         absorb_dependency_graph(runner)
         @return_summaries = runner.return_summaries # ADR-89 WD2 — the full-run behavioural surface.
@@ -174,6 +178,7 @@ module Rigor
         @effects_identity = current_effects_identity
         @cache = per_file(runner.per_file_diagnostics)
         @digests = @analyzed.to_h { |path| [path, pack_digest(path)] }
+        @run_level_rows = runner.run_level_rows
         diagnostics
       end
 
@@ -197,7 +202,8 @@ module Rigor
         # The freshly collected table is handed to the runner so the run seeds from the SAME table the diff
         # was decided on (and the collector runs once per recheck, not twice).
         runner = build_runner(analyze_only: analyze_set, record_dependencies: true,
-                              param_inferred_types: fresh_params)
+                              param_inferred_types: fresh_params,
+                              restored_run_level_rows: @run_level_rows)
         fresh = run_runner(runner).diagnostics
         @last_runner = runner # ADR-88 WD1 — the post-hoc fact-surface fingerprint reads this prepared registry.
         reused = (current & previous) - affected.to_a
@@ -281,12 +287,24 @@ module Rigor
         symbol_pairs = behaviourally_unstable_pairs(changed_pairs, unstable, scan_index) | param_pairs
         base = dependents_base(unstable, symbol_pairs)
         closure = base | changed.to_set | added.to_set |
-                  negative_affected(scan, removed, new_fps, new_class_decls, new_constant_decls)
+                  negative_affected(scan, removed, new_fps, new_class_decls, new_constant_decls, summary)
         closure = param_seed_closure(closure, param_files)
         removed.each { |path| closure |= @dependents[path] || Set.new }
         closure.freeze
       end
 
+      # Issue #1367 — every file whose last result holds a `global.*` diagnostic re-checks on any recheck. What
+      # exempts such a write is a fact of the whole program — an alias, or a `write` / `to_str` / `to_int` / hatch
+      # defined in any spelling on any receiver, a rewritten ancestor, a mixin — which no name-keyed edge can
+      # follow, so a stale report would outlive the edit that exempts it. Such files are rare, so this costs little.
+      # A file the census silenced is not re-checked when the exemption goes away: that stale answer misses a
+      # report, it never makes one.
+      def global_write_reporters
+        @cache.each_with_object(Set.new) do |(path, diagnostics), reporters|
+          reporters << path if diagnostics.any? { |diagnostic| diagnostic.rule.to_s.start_with?("global.") }
+        end
+      end
+
       # ADR-67 WD6c lift — the seed-invalidated callees' own contribution to the closure: the files
       # themselves, plus — on a pre-slice-4 snapshot with no symbol edges, where the pairs' symbol fan-out
       # found nothing — their file-level dependents (wider, always sound).
@@ -407,10 +425,13 @@ module Rigor
       end
 
       # The current project file set (cheap directory expansion, no analysis), used to detect files added /
-      # removed since the last run.
+      # removed since the last run. Also where an editor buffer's binding is re-spelled onto the set, since
+      # this is where the run first learns how it spells its own members.
       def current_files
         runner = build_runner
-        @paths ? runner.analysis_file_set(@paths) : runner.analysis_file_set
+        files = @paths ? runner.analysis_file_set(@paths) : runner.analysis_file_set
+        rebind_buffer(files)
+        files
       end
 
       # Verification engine (the `--verify-incremental` gate): with NO source edit, re-analyze `subset` fresh
@@ -422,7 +443,8 @@ module Rigor
         affected = subset.to_set
         # ADR-67 WD6c lift — seed the subset run from the baseline's own table so the verification engine
         # exercises the exact seeds the served cache entries were computed under (and skips a re-collect).
-        runner = build_runner(analyze_only: affected, param_inferred_types: @param_table)
+        runner = build_runner(analyze_only: affected, param_inferred_types: @param_table,
+                              restored_run_level_rows: @run_level_rows)
         fresh = run_runner(runner).diagnostics
         reused = @analyzed - affected.to_a
         fresh + reused.flat_map { |path| @cache[path] || [] }
@@ -559,6 +581,9 @@ module Rigor
         restore_structural_declarations(payload)
         @return_summaries  = payload.return_summaries || {}
         @param_table       = payload.param_table || {} # ADR-67 WD6c lift — the seeds the cache was built under.
+        # Issues #796 / #794 — absent (nil) in a snapshot written before schema 22 is impossible (the SCHEMA
+        # gate rejects one), so nil here means the writing run genuinely had nothing to say.
+        @run_level_rows    = payload.run_level_rows
         # ADR-103 WD13 / #382 — the effects sidecar rides its own identity, so a snapshot whose summaries
         # were collected under a different vocabulary / catalogue / `effects:` block restores as EMPTY
         # rather than as stale rows. {#run_incremental} turns that emptiness into a full baseline, because
@@ -592,7 +617,8 @@ module Rigor
           return_summaries: marshal_safe_return_summaries,
           param_table: marshal_safe_param_table,
           effect_collections: marshal_safe_effect_collections,
-          effects_identity: @effects_identity
+          effects_identity: @effects_identity,
+          run_level_rows: @run_level_rows
         )
       end
 
@@ -606,6 +632,15 @@ module Rigor
         @effects_identity = nil
       end
 
+      # The state this session carries ACROSS processes in the snapshot rather than deriving each run: the
+      # effects sidecar above, and (issues #796 / #794) the run-level rows the last FULL run answered — the
+      # `definition-build-failed` set and the HKT-scan outcome, nil until a full run has produced them, and
+      # handed to every narrowed run this session builds, none of which can derive them from its own files.
+      def reset_carried_state
+        reset_effect_state
+        @run_level_rows = nil
+      end
+
       # Whether the effects half of a restored snapshot permits reuse. Collection off is vacuously true —
       # the session keeps no collections, writes none, and the pre-#382 reuse decision stands unchanged.
       def effects_reuse_permitted?(payload)
@@ -696,6 +731,9 @@ module Rigor
           @digests[path] = pack_digest(path)
         end
         absorb_dependency_graph(runner)
+        # Issues #796 / #794 — the recheck's own snapshots already carry the replayed rows folded together
+        # with anything its closure demanded for itself, so this is the same union the next run replays.
+        @run_level_rows = runner.run_level_rows
         refresh_return_summaries(runner, analyze_set)
         refresh_effect_collections(runner, analyze_set)
       end
@@ -803,22 +841,42 @@ module Rigor
       end
 
       # ADR-46 slice 3 — the consumers to re-check because a symbol that appeared in a changed file resolves
-      # a prior missed lookup. Maps each appeared `"ClassName#method"` to the negative-dependency key it
-      # would satisfy (`toplevel:foo` for a top-level def, `method:C#m` otherwise), then unions the recorded
-      # negative-dependents of those keys.
-      def negative_affected(changed, removed, new_fingerprints, new_class_decls, new_constant_decls)
+      # a prior missed lookup, and (issue #639) because a class DECLARATION appeared or vanished. Maps each
+      # appeared `"ClassName#method"` to the negative-dependency key it would satisfy (`toplevel:foo` for a
+      # top-level def, `method:C#m` otherwise), then unions the recorded negative-dependents of those keys.
+      # Issue #1120 — plus the consumers of any refinement name the edit moved ({#refinement_affected}). Issue #1367 —
+      # and every file whose last result holds a `global.*` diagnostic ({#global_write_reporters}).
+      def negative_affected(changed, removed, new_fingerprints, new_class_decls, new_constant_decls, summary = nil)
         appeared_methods = Incremental.appeared_symbols(changed, @symbol_fingerprints, new_fingerprints)
-        appeared_classes = Incremental.appeared_classes(changed, @class_decls, new_class_decls)
+        # Issue #639 — a class DISAPPEARING satisfies the `class:` kind too, now that a resolved bare
+        # reference records the edge and not only a failed one; removed files join the diff for it.
+        moved_classes = Incremental.changed_class_declarations(
+          changed + removed, @class_decls, new_class_decls
+        )
         # Issue #644 — a constant whose PUBLICATION moved satisfies the `constant:` kind, keyed on the same
-        # last segment the consumer recorded. REMOVED files join the diff here and nowhere else: deleting a
-        # second declarer restores the precise answer, and no other producer input can see that.
+        # last segment the consumer recorded. Removed files join this diff (as they do the class one above):
+        # deleting a second declarer restores the precise answer, and no other producer input can see that.
         moved_constants = Incremental.changed_constant_publications(
           changed + removed, @constant_decls, new_constant_decls
         )
         keys = appeared_methods.map { |symbol| negative_key_for(symbol) }
-        keys.concat(appeared_classes.map { |klass| "class:#{klass.split('::').last}" })
+        keys.concat(moved_classes.map { |klass| "class:#{klass.split('::').last}" })
         keys.concat(moved_constants.map { |name| "constant:#{name.split('::').last}" })
-        Incremental.negative_closure(keys, @negative_dependents)
+        Incremental.negative_closure(keys, @negative_dependents) | refinement_affected(changed + removed, summary) |
+          global_write_reporters
+      end
+
+      # Issue #1120 — the consumers whose `call.undefined-method` answer read the refinement table for a method
+      # name whose refinements moved in this edit. The before-state is each file's seed bundle (the per-file
+      # table the last run recorded), the after-state the scan's per-file tables. A refine body is not a class's
+      # method, so neither the symbol fingerprints nor the appeared-symbol diff above sees it.
+      def refinement_affected(paths, summary)
+        after = (summary && summary[:refinements]) || {}
+        before = paths.to_h { |path| [path, @seed_bundles.dig(path, :refinements)] }
+        names = Incremental.changed_refinement_names(paths, before, after)
+        return Set.new if names.empty?
+
+        Incremental.negative_closure(names.map { |name| "refinement:#{name}" }, @negative_dependents)
       end
 
       # The qualified class/module names declared in the pre-parsed `index` (shared with
@@ -1013,18 +1071,51 @@ module Rigor
         candidates.reject { |path| stat_fresh?(path) }
       end
 
-      # A bound buffer's logical path is never fresh: the bytes to analyse live in the editor's temp file, and
-      # the recorded entry describes the file on disk. Re-analysing it when the two happen to agree costs one
-      # file; trusting the stat tuple would serve the editor its own stale diagnostics.
       def buffer_path?(path)
         !@buffer.nil? && path == @buffer.logical_path
       end
 
+      # Editor mode (#146) — the bound buffer's logical path is fresh exactly when the EDITOR's bytes still
+      # hash to the digest the snapshot recorded for the file they stand in for. The recorded stat tuple
+      # describes the file on disk, which an edit in the editor never moves, so validating through it serves
+      # the editor its own pre-buffer answers (#960); hashing the buffer makes the substituted file changed
+      # whenever it differs, and keeps an untouched buffer out of the closure. Anything unreadable or
+      # unrecorded reads as changed, the conservative direction the rest of this tier takes.
+      def buffer_fresh?(path)
+        recorded = Cache::FileDigest.content_digest(@digests[path])
+        return false if recorded.nil?
+
+        Cache::FileDigest.hexdigest(@buffer.resolve(path)) == recorded
+      rescue StandardError
+        false
+      end
+
+      # Editor mode (#146 / #960) — `--instead-of` is spelled the way the editor spells it (absolute, or
+      # `./`-prefixed), while the analysed set is spelled the way the run's path arguments produce. A binding
+      # whose logical path matches no member of that set substitutes nothing at all: every reader keeps
+      # reading the file on disk and the run answers as if no buffer had been passed. Re-spell the binding
+      # onto the set's own member, identified by real path, once the set is known.
+      def rebind_buffer(files)
+        return if @buffer.nil? || files.include?(@buffer.logical_path)
+
+        target = real_path(@buffer.logical_path)
+        return if target.nil?
+
+        match = files.find { |path| real_path(path) == target }
+        @buffer = BufferBinding.new(logical_path: match, physical_path: @buffer.physical_path) if match
+      end
+
+      def real_path(path)
+        File.realpath(path)
+      rescue StandardError
+        nil
+      end
+
       # True when `path`'s recorded stat entry proves it unchanged since the last analysis. Any stat / parse
       # failure (missing entry, unreadable / vanished file) reads as NOT fresh (→ re-analyse), preserving the
       # prior `digest(path) != recorded` "changed" semantics for a file that cannot be validated.
       def stat_fresh?(path)
-        return false if buffer_path?(path)
+        return buffer_fresh?(path) if buffer_path?(path)
 
         entry = @digests[path]
         return false if entry.nil?

data/lib/rigor/analysis/plugin_fact_fingerprint.rb

@@ -79,7 +79,6 @@ module Rigor
       #
       # Keeping the opaque decision here, rather than at each cache's call site, means a new consumer cannot
       # key on `digest` while forgetting that an opaque surface makes it meaningless.
-      # @return [String, nil]
       def self.key_digest(registry)
         result = from_registry(registry)
         result.opaque? ? nil : result.digest.to_s

data/lib/rigor/analysis/project_scan.rb

@@ -16,13 +16,23 @@ module Rigor
     # are NOT visible until the owner invalidates the scan — typically via `workspace/didChangeWatchedFiles`.
     # This is the same trade-off the LSP made when slice 7 cached only the `Environment`; extending the cache
     # to the pre-pass outputs preserves the contract.
+    #
+    # `template_units` (#1038) is the one slot a consumer does not adopt verbatim. The rest of the snapshot
+    # is reused as it stands until the owner invalidates it; the template index is handed to
+    # `TemplateUnits.collect(previous:)`, which re-expands the claimed globs and revalidates each template
+    # against the filesystem, so a template edited, added or deleted on disk is seen on the next publish
+    # even though the snapshot itself did not move. What the carry saves is the plugin transform — for ERB
+    # (#393) an Erubi compile of every view in the project, otherwise paid per keystroke. The index is
+    # always built WITHOUT a buffer binding, so the shared snapshot never holds a unit compiled from an
+    # editor's in-flight bytes.
     ProjectScan = Data.define(
       :plugin_registry,
       :dependency_source_index,
       :synthetic_method_index,
       :project_patched_methods,
       :plugin_prepare_diagnostics,
-      :pre_eval_diagnostics
+      :pre_eval_diagnostics,
+      :template_units
     )
   end
 end