rigortype 0.3.9 → 0.4.1

data/lib/rigor/analysis/incremental_session.rb

@@ -2,7 +2,10 @@
 
 require "digest"
 require_relative "incremental"
+require_relative "incremental_run_slot"
+require_relative "incremental_run_slot/write_guard"
 require_relative "plugin_fact_fingerprint"
+require_relative "source_rbs_gate"
 require_relative "../cache/file_digest"
 require_relative "../cache/incremental_snapshot"
 require_relative "../effects/file_collection"
@@ -22,10 +25,11 @@ module Rigor
     # only `ΔF ∪ dependents[ΔF]`, and serves every other analyzed file from the cache — the body tier.
     #
     # The invariant the verify harness (and the spec) assert: `#recheck`'s merged diagnostics are
-    # byte-identical (as a sorted set) to a full `--no-cache` re-analysis of the edited tree. This is the
-    # `--verify-incremental` acceptance gate, here without disk persistence or CLI wiring (the cache is
-    # in-process). It models the body tier only: an edit that adds / removes / moves a *file* is outside
-    # the analyzed set it maintains and falls to a fresh {#baseline} (the structural tier is a later slice).
+    # byte-identical to a full `--no-cache` re-analysis of the edited tree, in the same order (#1524; the gate
+    # itself compares sorted sets). This is the `--verify-incremental` acceptance gate, here without disk
+    # persistence or CLI wiring (the cache is in-process). It models the body tier only: an edit that adds /
+    # removes / moves a *file* is outside the analyzed set it maintains and falls to a fresh {#baseline} (the
+    # structural tier is a later slice).
     # The class-length budget is relaxed: this is one cohesive orchestrator of the incremental state
     # (per-file diagnostics cache, the file-level / symbol-level / negative dependency graphs, and the ADR-85
     # seed bundles), clearer read together than split across micro-classes that would all share the same ivars.
@@ -159,11 +163,18 @@ module Rigor
       # Full baseline analysis with recording. Returns the run's diagnostics; populates the in-process cache
       # + dependency state.
       def baseline
+        @slot_carried_from = nil # ADR-45 WD2 — see {#load_snapshot}
         runner = build_runner(record_dependencies: true)
         diagnostics = run_runner(runner).diagnostics
         @last_runner = runner # ADR-88 WD1 — the post-hoc fact-surface fingerprint reads this prepared registry.
-        @analyzed = runner.analyzed_files
-        @seed_bundles = runner.seed_bundles # ADR-85 WD2 — the freshly built bundle set for the next run.
+        # #392 — the template units are deliberately NOT in the analysed set. `Runner#target_files`
+        # re-analyses every unit on every run, so a unit must never be reused from the per-file cache and
+        # must never read as a file that VANISHED from the project on the next recheck (which is what
+        # `previous - current` would say, `current_files` being a `.rb` expansion).
+        @analyzed = runner.analyzed_files - runner.template_unit_paths
+        # ADR-85 WD2 — the freshly built bundle set for the next run, each stamped with its file's source-RBS
+        # digest (issue #1536).
+        @seed_bundles = source_rbs_gate.stamp(runner.seed_bundles, whole_project: true)
         absorb_dependency_graph(runner)
         @return_summaries = runner.return_summaries # ADR-89 WD2 — the full-run behavioural surface.
         # ADR-67 WD6c lift — the seed table the runner's own pre-pass computed ({} when the gate is off).
@@ -174,6 +185,7 @@ module Rigor
         @effects_identity = current_effects_identity
         @cache = per_file(runner.per_file_diagnostics)
         @digests = @analyzed.to_h { |path| [path, pack_digest(path)] }
+        forget_unbound_digests
         @run_level_rows = runner.run_level_rows
         diagnostics
       end
@@ -195,15 +207,16 @@ module Rigor
         param_files, param_pairs = param_seed_invalidation(fresh_params)
         affected = affected_closure(changed, added, removed, param_files, param_pairs)
         analyze_set = affected & current
+        reused = (current & previous) - affected.to_a
         # The freshly collected table is handed to the runner so the run seeds from the SAME table the diff
-        # was decided on (and the collector runs once per recheck, not twice).
+        # was decided on (and the collector runs once per recheck, not twice). The reused files' cached rows
+        # go in too, so the runner lists them in the full run's file order (#1524).
         runner = build_runner(analyze_only: analyze_set, record_dependencies: true,
                               param_inferred_types: fresh_params,
-                              restored_run_level_rows: @run_level_rows)
-        fresh = run_runner(runner).diagnostics
+                              restored_run_level_rows: @run_level_rows,
+                              served_per_file_diagnostics: @cache.slice(*reused))
+        merged = run_runner(runner).diagnostics
         @last_runner = runner # ADR-88 WD1 — the post-hoc fact-surface fingerprint reads this prepared registry.
-        reused = (current & previous) - affected.to_a
-        merged = fresh + reused.flat_map { |path| @cache[path] || [] }
         absorb(runner, current, analyze_set, removed)
         @param_table = fresh_params
         Recheck.new(diagnostics: merged, changed: changed.to_set, added: added.to_set,
@@ -231,6 +244,7 @@ module Rigor
           # stale. A full baseline is the sound answer for `--incremental`, but in editor mode it is also the
           # latency this mode exists to avoid, so decline and let the caller drop to single-file scope.
           break nil unless @plugin_fact_reusable.reusable_against?(restored.plugin_fact_digest)
+          break nil if source_rbs_unverified?(result)
 
           result
         end
@@ -249,7 +263,20 @@ module Rigor
       # return exactly the way a body edit does, so it reuses the same audited dependents machinery. The
       # pairs join AFTER the ADR-89 WD2 behavioural-stability pruning: that gate re-evaluates returns under
       # the snapshot's OLD seeds, which is the wrong oracle for a pair whose seeds are the thing that moved.
+      #
+      # Issue #1536 (ADR-89 WD1 amendment) — every gate in {#gated_closure} reads the RUBY side of a file. What a
+      # source-RBS synthesizer derives from its comments reaches the environment as a `virtual:` buffer, and a
+      # reader of that RBS records no edge to the file it came from (an `attr_reader :name #: String` consumer
+      # records none at all), so no dependent set can bound who read it. An edit that moved it re-analyses the
+      # whole project — what a `sig/` edit already costs through the snapshot fingerprint.
       def affected_closure(changed, added, removed, param_files = Set.new, param_pairs = Set.new)
+        return whole_project_closure(changed, added) if source_rbs_gate.moved?(@seed_bundles, changed, added, removed)
+
+        gated_closure(changed, added, removed, param_files, param_pairs)
+      end
+
+      # {#affected_closure} for an edit whose synthesized RBS is byte-identical in every file it touched.
+      def gated_closure(changed, added, removed, param_files, param_pairs)
         scan = changed + added
         # Parse the changed / added set ONCE for the per-symbol fingerprints, the class declarations, AND the
         # ADR-89 WD1 declaration signatures. They were separate `discovered_def_index_for_paths` passes over
@@ -283,12 +310,24 @@ module Rigor
         symbol_pairs = behaviourally_unstable_pairs(changed_pairs, unstable, scan_index) | param_pairs
         base = dependents_base(unstable, symbol_pairs)
         closure = base | changed.to_set | added.to_set |
-                  negative_affected(scan, removed, new_fps, new_class_decls, new_constant_decls)
+                  negative_affected(scan, removed, new_fps, new_class_decls, new_constant_decls, summary)
         closure = param_seed_closure(closure, param_files)
         removed.each { |path| closure |= @dependents[path] || Set.new }
         closure.freeze
       end
 
+      # Issue #1367 — every file whose last result holds a `global.*` diagnostic re-checks on any recheck. What
+      # exempts such a write is a fact of the whole program — an alias, or a `write` / `to_str` / `to_int` / hatch
+      # defined in any spelling on any receiver, a rewritten ancestor, a mixin — which no name-keyed edge can
+      # follow, so a stale report would outlive the edit that exempts it. Such files are rare, so this costs little.
+      # A file the census silenced is not re-checked when the exemption goes away: that stale answer misses a
+      # report, it never makes one.
+      def global_write_reporters
+        @cache.each_with_object(Set.new) do |(path, diagnostics), reporters|
+          reporters << path if diagnostics.any? { |diagnostic| diagnostic.rule.to_s.start_with?("global.") }
+        end
+      end
+
       # ADR-67 WD6c lift — the seed-invalidated callees' own contribution to the closure: the files
       # themselves, plus — on a pre-slice-4 snapshot with no symbol edges, where the pairs' symbol fan-out
       # found nothing — their file-level dependents (wider, always sound).
@@ -380,13 +419,11 @@ module Rigor
       # dependents skippable) when its current {ScopeIndexer.declaration_signature} matches the one stored in
       # the snapshot's seed bundle — i.e. its edit changed no method signature, visibility, ancestry, member
       # layout, def line, or method existence, so every cross-file DECLARATION fact its dependents consume is
-      # unchanged. Falls back to treating EVERY changed file as unstable (today's full closure) when a
-      # comment-ingesting plugin is loaded — such a plugin reads the very comments the signature ignores, so a
-      # comment edit it treats as a no-op could change a cross-file type. Sorbet sigs / dry-types includes are
-      # CODE, captured by ADR-88's plugin-fact fingerprint (WD3), so only comment-as-input plugins escape here.
+      # unchanged. The signature reads code, not comments; the other half of stability — that no source-RBS
+      # synthesizer's output for the file moved — is settled before this runs ({SourceRbsGate#moved?}), so every
+      # file reaching here has a byte-identical synthesized contribution. Sorbet sigs / dry-types includes are
+      # CODE, captured by ADR-88's plugin-fact fingerprint (WD3).
       def declaration_unstable(changed, declaration_signatures)
-        return changed if comment_ingesting_plugin_loaded?
-
         changed.reject { |path| declaration_stable?(path, declaration_signatures[path]) }
       end
 
@@ -399,14 +436,11 @@ module Rigor
         bundle[:declaration_signature] == current_declaration_signature
       end
 
-      def comment_ingesting_plugin_loaded?
-        # Mirrors the plugin loader's gem-name resolution (`ProjectPrePasses#trusted_gem_name`): a String
-        # entry IS the gem name; a Hash entry names it under `"gem"` (or the manifest `"id"`).
-        @configuration.plugins.any? do |entry|
-          name = entry.is_a?(Hash) ? (entry["gem"] || entry["id"]) : entry
-          COMMENT_INGESTING_PLUGIN_IDS.include?(name.to_s)
-        end
+      # Every file this recheck can analyse: the removed ones drop out at `affected & current`.
+      def whole_project_closure(changed, added)
+        (@analyzed.to_set | changed | added).freeze
       end
+      private :gated_closure, :whole_project_closure
 
       # The current project file set (cheap directory expansion, no analysis), used to detect files added /
       # removed since the last run. Also where an editor buffer's binding is re-spelled onto the set, since
@@ -425,13 +459,13 @@ module Rigor
       # mutating session state. Returns the merged diagnostics.
       def reanalyze_subset(subset)
         affected = subset.to_set
+        reused = @analyzed - affected.to_a
         # ADR-67 WD6c lift — seed the subset run from the baseline's own table so the verification engine
         # exercises the exact seeds the served cache entries were computed under (and skips a re-collect).
         runner = build_runner(analyze_only: affected, param_inferred_types: @param_table,
-                              restored_run_level_rows: @run_level_rows)
-        fresh = run_runner(runner).diagnostics
-        reused = @analyzed - affected.to_a
-        fresh + reused.flat_map { |path| @cache[path] || [] }
+                              restored_run_level_rows: @run_level_rows,
+                              served_per_file_diagnostics: @cache.slice(*reused))
+        run_runner(runner).diagnostics
       end
 
       # Cross-process incremental run (the `--incremental` flag's engine). With a disk `snapshot` whose
@@ -452,7 +486,7 @@ module Rigor
         # shares one digest memo across change detection and the baseline/absorb re-pack. The inner
         # `Runner#run` nests its own `with_run` for the analysis descriptors; nesting is safe (each restores).
         Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
-          restored = fingerprint && snapshot.load(fingerprint: fingerprint)
+          restored = load_snapshot(snapshot, fingerprint)
           # ADR-88 WD1 — the plugin fact-surface fingerprint gates snapshot reuse the same way the global
           # fingerprint gates the load: a plugin sig/catalog edit outside `signature_paths:` (a Sorbet `.rbi`)
           # changes the types unchanged call sites resolve, without moving any analyzed file, so the global
@@ -473,7 +507,7 @@ module Rigor
             result = recheck
             adopt_plugin_fact_fingerprint
             fact_reusable = @plugin_fact_reusable.reusable_against?(restored.plugin_fact_digest)
-            if fact_reusable && effects_reusable
+            if fact_reusable && effects_reusable && !source_rbs_unverified?(result)
               diagnostics = result.diagnostics
               warm = true
               # ADR-87 WD3 — a warm recheck that changed nothing leaves the session state byte-equivalent to the
@@ -481,9 +515,10 @@ module Rigor
               # A cold baseline always persists — there was no valid snapshot to reuse.
               skip_save = result.no_change?
             else
-              # The fact surface moved (a plugin sig/catalog edit), a plugin is opaque, or the effects
-              # identity moved: the cached-served files the recheck merged may be stale (or, for effects, a
-              # partial collection cannot be closed), so re-analyze the whole tree. The current fact-surface
+              # The fact surface moved (a plugin sig/catalog edit), a plugin is opaque, the effects identity
+              # moved, or a synthesizer the source-RBS gate could not see was loaded (#1536): the cached-served
+              # files the recheck merged may be stale (or, for effects, a partial collection cannot be closed),
+              # so re-analyze the whole tree. The current fact-surface
               # digest (from the recheck runner) is unchanged by the re-analysis, so it is kept for the save.
               # Only a genuine fact-surface reason sets the reporting flag the CLI banner reads.
               @fact_surface_invalidated = true unless fact_reusable
@@ -497,7 +532,7 @@ module Rigor
             warm = false
             skip_save = false
           end
-          snapshot.save(fingerprint: fingerprint, payload: to_payload) if persist && fingerprint && !skip_save
+          persist_run(snapshot, fingerprint, diagnostics, skip_save: skip_save) if persist && fingerprint
           [diagnostics, warm]
         end
       end
@@ -522,11 +557,41 @@ module Rigor
 
       # ADR-88 WD1 — capture this invocation's fact-surface fingerprint (from the last analysis runner) onto the
       # reporting ivars + the `@plugin_fact_reusable` decision object.
+      #
+      # Issue #1536 — the same prepared registry settles whether the synthesizers the session digested with
+      # are the ones the run's environment was built from ({SourceRbsGate#verify}). A plugin that builds its
+      # synthesizer in `#prepare` leaves the gate untrusted, and every stored digest is stamped unknown before
+      # the snapshot is saved.
       def adopt_plugin_fact_fingerprint
-        fact = compute_plugin_fact_fingerprint
+        registry = prepared_plugin_registry
+        fact = compute_plugin_fact_fingerprint(registry)
         @plugin_fact_digest = fact.digest
         @opaque_plugin_ids = fact.opaque_plugin_ids
         @plugin_fact_reusable = fact
+        @seed_bundles = source_rbs_gate.verify(registry, @seed_bundles)
+      end
+
+      # Issue #1536 — a recheck of an edit whose closure left some file out may have under-read a synthesizer
+      # the gate could not see. {#run_incremental} re-analyses the project and {#run_buffer_recheck} declines,
+      # the way each treats a moved plugin fact surface. A run that changed nothing is exempt: under an
+      # untrusted gate every earlier edit already re-analysed the whole project, so the snapshot it serves is
+      # whole, and a null run stays one.
+      def source_rbs_unverified?(result)
+        source_rbs_gate.untrusted? && !result.no_change? && !result.reused.empty?
+      end
+
+      # Issue #1536 — a file the gate could not stamp because it was saved after the closure was decided (its
+      # readers' cached answers predate that save) must read as changed on the next run, where its unknown
+      # stamp sends the edit to the whole project. Recording its post-save content digest would hide it.
+      def forget_unbound_digests
+        source_rbs_gate.unbound.each { |path| @digests.delete(path) }
+      end
+
+      # Issue #1536 — decides whether an edit moved synthesized RBS, and stamps each seed bundle's digest. One
+      # per session: its untrusted state must outlive every run the session makes.
+      def source_rbs_gate
+        @source_rbs_gate ||= SourceRbsGate.new(configuration: @configuration, cache_store: @cache_store,
+                                               plugin_requirer: @plugin_requirer)
       end
 
       # ADR-88 WD1 — the plugin fact-surface fingerprint for this invocation. For a SEQUENTIAL run it is read
@@ -535,17 +600,195 @@ module Rigor
       # published facts — there it falls back to the always-sequential probe. Both paths compute the identical
       # digest for a given fact surface, so the reuse decision is worker-count-independent (the parity spec
       # asserts this).
-      def compute_plugin_fact_fingerprint
+      def compute_plugin_fact_fingerprint(registry = prepared_plugin_registry)
+        PluginFactFingerprint.from_registry(registry)
+      end
+
+      # The registry the run's environment was built from, after `#prepare`: the analysis runner's own on a
+      # sequential run, the always-sequential probe's on a pooled one (nil when the probe fails).
+      def prepared_plugin_registry
         registry = @last_runner&.plugin_registry
-        if @workers.zero? && registry && !registry.empty?
-          PluginFactFingerprint.from_registry(registry)
-        else
-          PluginFactFingerprint.compute(
-            configuration: @configuration, cache_store: @cache_store, plugin_requirer: @plugin_requirer
-          )
+        return registry if @workers.zero? && registry && !registry.empty?
+
+        PluginFactFingerprint.prepared_registry(
+          configuration: @configuration, cache_store: @cache_store, plugin_requirer: @plugin_requirer
+        )
+      end
+
+      # Loads the snapshot, noting (ADR-45 WD2) which write of the file it read: the identity is kept only when
+      # the file was the same before and after the read, since a rewrite in between leaves no telling which one
+      # the payload came from.
+      def load_snapshot(snapshot, fingerprint)
+        @slot_guard = start_slot_guard(fingerprint)
+        before = snapshot_identity(snapshot)
+        restored = fingerprint && snapshot.load(fingerprint: fingerprint)
+        @restored_snapshot_identity = restored && before == snapshot_identity(snapshot) ? before : nil
+        # The path set the previous run-result slot is keyed by, for a recheck to carry its chain from; a
+        # {#baseline} clears it, since a full run starts a chain of its own.
+        @slot_carried_from = restored&.analyzed
+        restored
+      end
+
+      # ADR-87 WD3 — a warm recheck that changed nothing skips the snapshot rewrite: the file it restored is still
+      # the one on disk, which is what the run-result slot records as its snapshot.
+      def persist_run(snapshot, fingerprint, diagnostics, skip_save:)
+        written = if skip_save
+                    @restored_snapshot_identity
+                  elsif snapshot.save(fingerprint: fingerprint, payload: to_payload)
+                    snapshot_identity(snapshot)
+                  end
+        write_run_slot(diagnostics, written_identity: written)
+      end
+
+      # ADR-45 WD2 (#1507) — records this run's answer as the run-result slot a later `rigor check --incremental`
+      # serves without loading the engine ({IncrementalRunSlot}). The slot's dependency descriptor must validate
+      # what the answer was computed from, and after a narrowed recheck most of the answer was computed by earlier
+      # runs, so it is assembled from three sources:
+      #
+      # - the analysed files, at the digest this session holds for each: the bytes its cached or fresh rows were
+      #   computed from, never a re-digest taken after the fact;
+      # - what this run read and re-derives every run ({Runner#incremental_slot_rows}' `observed` and `derived`
+      #   rows);
+      # - the CHAIN: the rows the last full run recorded for inputs a recheck does not re-derive
+      #   ({Runner#baseline_dependency_rows}), and the plugin reads credited to each file's analysis. A full run
+      #   starts a chain; a recheck takes the previous slot's, replaces the reads of every file it re-analysed with
+      #   this run's, and drops the removed files'.
+      #
+      # A recheck writes only when the previous slot exists and was written against the very snapshot file it
+      # restored: otherwise some run in between — a pool run, `--no-cache`, a write that failed — analysed files
+      # without recording their reads, and the chain cannot vouch for them. It then writes nothing, and the next
+      # full run starts a fresh chain. Declining to write is always safe; it only leaves the next null run on the
+      # full path.
+      #
+      # Every row not recorded as a plugin read it must still describe the tree the run read
+      # ({IncrementalRunSlot::WriteGuard}): the analysed files' (whose session digest a full run takes after its
+      # analysis), the `derived` rows, and the chain's baseline, taken now or carried ({#guarded_rows}).
+      #
+      # @param written_identity — the snapshot file as this run leaves it, recorded for the next writer's check.
+      def write_run_slot(diagnostics, written_identity:)
+        return unless run_slot_writable?
+
+        roots = @paths || @configuration.paths
+        rows = @last_runner.incremental_slot_rows(roots: roots)
+        chain = rows && (@slot_carried_from ? carry_chain(rows, roots) : start_chain(rows))
+        analysed = chain && analysed_file_rows
+        return if analysed.nil?
+
+        baseline, pinned, reads = chain
+        return unless @slot_guard&.admits?(guarded_rows(analysed, rows.derived, baseline), pinned: pinned)
+
+        # A save the run read after the mark's tick must not hide behind an unmoved stat tuple.
+        reads = reads.transform_values { |descriptor| @slot_guard.mark_racy(descriptor) }
+
+        entry = IncrementalRunSlot::Entry.new(
+          diagnostics: diagnostics, roots: IncrementalRunSlot.as_written(roots),
+          baseline: baseline, pinned: pinned, reads: reads, snapshot: written_identity
+        )
+        dependencies = @slot_guard.mark_racy(run_slot_dependencies(analysed, rows, [baseline, pinned], reads.values))
+        wrote = IncrementalRunSlot.write(
+          store: @cache_store, configuration: @configuration, entry: entry, dependencies: dependencies,
+          target: IncrementalRunSlot::Target.new(files: @analyzed, roots: roots)
+        )
+        discard_previous_slot(roots) if wrote
+      rescue StandardError
+        nil
+      end
+
+      # The previous slot is keyed by the previous path set; once this run's stands, nothing asks for it again.
+      def discard_previous_slot(roots)
+        return if @slot_carried_from.nil? || @slot_carried_from.sort == @analyzed.sort
+
+        IncrementalRunSlot.discard(
+          store: @cache_store, configuration: @configuration,
+          target: IncrementalRunSlot::Target.new(files: @slot_carried_from, roots: roots)
+        )
+      end
+
+      # ADR-45 WD2 — the mark {IncrementalRunSlot::WriteGuard#admits?} checks the slot's rows against, taken before
+      # the run reads anything. nil (no slot this run) for a store no slot is written to, or no fingerprint.
+      def start_slot_guard(fingerprint)
+        return nil if fingerprint.nil? || @cache_store.nil? || @cache_store.read_only? || !@buffer.nil?
+        # Known before the run: none of these can be written afterwards, so the stamp and the recomputed
+        # fingerprint would be spent for nothing.
+        return nil unless @workers.zero? && !@configuration.effects_enabled?
+
+        IncrementalRunSlot::WriteGuard.start(
+          configuration: @configuration, roots: @paths || @configuration.paths, cache_root: @cache_store.root,
+          fingerprint: fingerprint
+        )
+      end
+
+      # The runs whose answer the slot may hold: a writable store, no editor buffer (whose bytes exist only in
+      # the editor), a sequential run (a pool worker's plugin reads never reach this process), effect collection
+      # off ({IncrementalRunSlot.serve} declines it), and no opaque plugin — the next full-path run would then be
+      # cold, not the warm run the probe stands in for.
+      def run_slot_writable?
+        !@cache_store.nil? && !@cache_store.read_only? && @buffer.nil? && @workers.zero? &&
+          !@configuration.effects_enabled? && @opaque_plugin_ids.empty? && !@last_runner.nil?
+      end
+
+      def start_chain(rows)
+        baseline = @last_runner.baseline_dependency_rows(files: @analyzed)
+        baseline && [baseline.owned, baseline.pinned, rows.by_file.slice(*@analyzed)]
+      end
+
+      def carry_chain(rows, roots)
+        return nil if @restored_snapshot_identity.nil?
+
+        previous = IncrementalRunSlot.previous_entry(
+          store: @cache_store, configuration: @configuration,
+          target: IncrementalRunSlot::Target.new(files: @slot_carried_from, roots: roots)
+        )
+        return nil if previous.nil? || previous.snapshot != @restored_snapshot_identity
+
+        served = previous.reads.except(*@last_runner.analyzed_files)
+        [previous.baseline, previous.pinned, served.merge(rows.by_file).slice(*@analyzed)]
+      end
+
+      # One `:stat` row per analysed file, from the entry this session recorded for it (`#pack_digest`), re-packed
+      # against the file's current stat when the bytes still hash to the recorded digest but the tuple moved (a
+      # `touch`, a checkout): the snapshot keeps the old tuple, and a row carrying it would cost every later probe
+      # a re-hash of the file. nil when any file has no usable entry (it could not be read): no row could say what
+      # its answer was computed from.
+      def analysed_file_rows
+        @analyzed.map do |path|
+          packed = Cache::FileDigest.refresh_stat(path, @digests[path])
+          return nil if packed.nil?
+
+          Cache::Descriptor::FileEntry.new(path: path, comparator: :stat, value: packed)
         end
       end
 
+      # @param chained — the chain's baseline descriptors, owned and pinned
+      def run_slot_dependencies(analysed, rows, chained, reads)
+        carried = chained + reads
+        Cache::Descriptor.new(
+          files: analysed + rows.derived.files + rows.observed.files + carried.flat_map(&:files),
+          globs: (rows.derived.globs + rows.observed.globs + carried.flat_map(&:globs)).uniq
+        )
+      end
+
+      # What the write guard asks about besides the pinned baseline: every row the key does not pin that was not
+      # recorded as a plugin read it. A recheck's carried baseline is among them. The run that took it vouched for
+      # the tree it saw, but this run reads those inputs again (a recheck with a non-empty closure rebuilds its
+      # environment from the signature tree), and a save it read that is reverted before the run ends leaves every
+      # carried row fresh while the answer came from the saved bytes.
+      def guarded_rows(analysed, derived, baseline)
+        Cache::Descriptor.new(files: analysed + derived.files + baseline.files, globs: derived.globs + baseline.globs)
+      end
+
+      # The snapshot file's `(size, mtime_ns, ctime_ns, inode)`: which write of it a run restored, or left behind.
+      # A rewrite renames a new file into place, so any write moves it. nil when there is no file to stat.
+      def snapshot_identity(snapshot)
+        path = snapshot.respond_to?(:path) ? snapshot.path : nil
+        return nil if path.nil?
+
+        stat = File.stat(path)
+        [stat.size, Cache::FileDigest.ns_of(stat.mtime), Cache::FileDigest.ns_of(stat.ctime), stat.ino]
+      rescue SystemCallError
+        nil
+      end
+
       # Adopt a persisted snapshot's per-file state as this session's baseline (the warm-start path).
       def restore(payload)
         @analyzed = payload.analyzed
@@ -707,13 +950,16 @@ module Rigor
         removed.each { |path| forget(path) }
         @analyzed = current
         # ADR-85 WD2 — the recheck's discovery folded the restored bundles and refreshed them (changed files
-        # re-walked, removed files dropped, added files built), so adopt the runner's current set wholesale.
-        @seed_bundles = runner.seed_bundles
+        # re-walked, removed files dropped, added files built), so adopt the runner's current set wholesale,
+        # stamping the re-walked ones with their source-RBS digest (issue #1536).
+        whole_project = current.all? { |path| analyze_set.include?(path) }
+        @seed_bundles = source_rbs_gate.stamp(runner.seed_bundles, whole_project: whole_project)
         fresh_by_file = per_file(runner.per_file_diagnostics)
         analyze_set.each do |path|
           @cache[path] = fresh_by_file[path] || []
           @digests[path] = pack_digest(path)
         end
+        forget_unbound_digests
         absorb_dependency_graph(runner)
         # Issues #796 / #794 — the recheck's own snapshots already carry the replayed rows folded together
         # with anything its closure demanded for itself, so this is the same union the next run replays.
@@ -828,7 +1074,9 @@ module Rigor
       # a prior missed lookup, and (issue #639) because a class DECLARATION appeared or vanished. Maps each
       # appeared `"ClassName#method"` to the negative-dependency key it would satisfy (`toplevel:foo` for a
       # top-level def, `method:C#m` otherwise), then unions the recorded negative-dependents of those keys.
-      def negative_affected(changed, removed, new_fingerprints, new_class_decls, new_constant_decls)
+      # Issue #1120 — plus the consumers of any refinement name the edit moved ({#refinement_affected}). Issue #1367 —
+      # and every file whose last result holds a `global.*` diagnostic ({#global_write_reporters}).
+      def negative_affected(changed, removed, new_fingerprints, new_class_decls, new_constant_decls, summary = nil)
         appeared_methods = Incremental.appeared_symbols(changed, @symbol_fingerprints, new_fingerprints)
         # Issue #639 — a class DISAPPEARING satisfies the `class:` kind too, now that a resolved bare
         # reference records the edge and not only a failed one; removed files join the diff for it.
@@ -844,7 +1092,21 @@ module Rigor
         keys = appeared_methods.map { |symbol| negative_key_for(symbol) }
         keys.concat(moved_classes.map { |klass| "class:#{klass.split('::').last}" })
         keys.concat(moved_constants.map { |name| "constant:#{name.split('::').last}" })
-        Incremental.negative_closure(keys, @negative_dependents)
+        Incremental.negative_closure(keys, @negative_dependents) | refinement_affected(changed + removed, summary) |
+          global_write_reporters
+      end
+
+      # Issue #1120 — the consumers whose `call.undefined-method` answer read the refinement table for a method
+      # name whose refinements moved in this edit. The before-state is each file's seed bundle (the per-file
+      # table the last run recorded), the after-state the scan's per-file tables. A refine body is not a class's
+      # method, so neither the symbol fingerprints nor the appeared-symbol diff above sees it.
+      def refinement_affected(paths, summary)
+        after = (summary && summary[:refinements]) || {}
+        before = paths.to_h { |path| [path, @seed_bundles.dig(path, :refinements)] }
+        names = Incremental.changed_refinement_names(paths, before, after)
+        return Set.new if names.empty?
+
+        Incremental.negative_closure(names.map { |name| "refinement:#{name}" }, @negative_dependents)
       end
 
       # The qualified class/module names declared in the pre-parsed `index` (shared with
@@ -985,12 +1247,6 @@ module Rigor
       TOP_LEVEL_KEY = Inference::ScopeIndexer::TOP_LEVEL_DEF_KEY
       private_constant :TOP_LEVEL_KEY
 
-      # B1 — plugin require-names that ingest COMMENT content as semantic input (inline-RBS reads `# @rbs` /
-      # `#:` annotations). B1's code fingerprint ignores comments, so a project configuring one of these opts
-      # OUT of the bundle-equality skip (a comment edit could change a cross-file type it contributes).
-      COMMENT_INGESTING_PLUGIN_IDS = %w[rigor-rbs-inline].freeze
-      private_constant :COMMENT_INGESTING_PLUGIN_IDS
-
       def negative_key_for(symbol)
         class_name, method = symbol.split("#", 2)
         class_name == TOP_LEVEL_KEY ? "toplevel:#{method}" : "method:#{symbol}"

data/lib/rigor/analysis/plugin_fact_fingerprint.rb

@@ -2,6 +2,7 @@
 
 require "digest"
 require_relative "runner"
+require_relative "../cache/value_digest"
 
 module Rigor
   module Analysis
@@ -98,9 +99,9 @@ module Rigor
       def digest_registry(registry)
         return Result.new(digest: nil, opaque_plugin_ids: [].freeze) if registry.nil? || registry.empty?
 
-        facts_by_plugin = facts_by_plugin(registry.plugins.first&.services&.fact_store)
-        parts = fact_parts(facts_by_plugin)
         opaque = []
+        facts_by_plugin = facts_by_plugin(registry, opaque)
+        parts = fact_parts(facts_by_plugin)
         registry.plugins.each { |plugin| collect_plugin_parts(plugin, facts_by_plugin, parts, opaque) }
         # Sort the parts so the digest is independent of plugin registration / iteration order.
         Result.new(
@@ -129,16 +130,25 @@ module Rigor
 
       # `{ plugin_id => ["name=digest", ...] }` for every ADR-9 published fact (channel a). A plugin that
       # published nothing does not appear.
-      def facts_by_plugin(fact_store)
+      #
+      # A fact the fingerprint cannot digest is an input it cannot see, so its publisher is opaque, whether or
+      # not the publisher contributes a type itself: other plugins read its facts. A fact store that cannot be
+      # read at all makes every plugin opaque. Both force the full run; dropping the facts instead would let a
+      # plugin with another surface reuse a snapshot its facts no longer match.
+      def facts_by_plugin(registry, opaque)
         result = Hash.new { |hash, key| hash[key] = [] }
-        return result if fact_store.nil?
-
-        fact_store.each_fact do |fact|
-          result[fact.plugin_id.to_s] << "#{fact.name}=#{digest_value(fact.value)}"
+        fact_store = registry.plugins.first&.services&.fact_store
+        fact_store&.each_fact do |fact|
+          plugin_id = fact.plugin_id.to_s
+          begin
+            result[plugin_id] << "#{fact.name}=#{digest_value(fact.value)}"
+          rescue StandardError
+            opaque << plugin_id
+          end
         end
         result
       rescue StandardError
-        # An unreadable fact store contributes nothing; opacity for contributing plugins is decided below.
+        registry.plugins.each { |plugin| opaque << safe_id(plugin) }
         Hash.new { |hash, key| hash[key] = [] }
       end
 
@@ -175,12 +185,13 @@ module Rigor
         true
       end
 
-      # A stable content digest of an arbitrary fact / producer value. Producer values are Marshal-clean by
-      # contract (the ADR-45 disk cache serialises them the same way), so this is the same round-trip the cache
-      # already relies on. A Marshal failure raises to the caller, which marks the plugin opaque (never a
-      # silent wrong-value digest).
+      # A digest of a fact / producer / hook value that depends on the value alone (issue #1574). A producer's
+      # value is computed on one run and served from its ADR-45 cache entry on the next; the two are equal but
+      # do not share the same objects, so a digest of their `Marshal.dump` bytes differed and invalidated the
+      # snapshot on every such switch. {Cache::ValueDigest} reads no identity. A value it cannot digest raises
+      # to the caller, which marks the plugin opaque (never a silent wrong-value digest).
       def digest_value(value)
-        Digest::SHA256.hexdigest(Marshal.dump(value))
+        Cache::ValueDigest.hexdigest(value)
       end
 
       def contributes_types?(plugin)

data/lib/rigor/analysis/project_scan.rb

@@ -16,13 +16,23 @@ module Rigor
     # are NOT visible until the owner invalidates the scan — typically via `workspace/didChangeWatchedFiles`.
     # This is the same trade-off the LSP made when slice 7 cached only the `Environment`; extending the cache
     # to the pre-pass outputs preserves the contract.
+    #
+    # `template_units` (#1038) is the one slot a consumer does not adopt verbatim. The rest of the snapshot
+    # is reused as it stands until the owner invalidates it; the template index is handed to
+    # `TemplateUnits.collect(previous:)`, which re-expands the claimed globs and revalidates each template
+    # against the filesystem, so a template edited, added or deleted on disk is seen on the next publish
+    # even though the snapshot itself did not move. What the carry saves is the plugin transform — for ERB
+    # (#393) an Erubi compile of every view in the project, otherwise paid per keystroke. The index is
+    # always built WITHOUT a buffer binding, so the shared snapshot never holds a unit compiled from an
+    # editor's in-flight bytes.
     ProjectScan = Data.define(
       :plugin_registry,
       :dependency_source_index,
       :synthetic_method_index,
       :project_patched_methods,
       :plugin_prepare_diagnostics,
-      :pre_eval_diagnostics
+      :pre_eval_diagnostics,
+      :template_units
     )
   end
 end

data/lib/rigor/analysis/reachability/plugin_roots.rb

@@ -83,7 +83,6 @@ module Rigor
         # Loads the project's configured plugins, runs every `#prepare`, and returns the union of every
         # published `:reachability_roots` and `:reachability_references` fact.
         #
-        # @param configuration — the loaded project configuration.
         # @param plugin_requirer — how a plugin gem is brought into the process, called with the gem name. The
         #   same seam `Analysis::Runner` exposes, so a spec can register a plugin class without publishing a
         #   gem.