rigortype 0.3.9 → 0.4.1

data/lib/rigor/analysis/runner.rb

@@ -48,6 +48,7 @@ require_relative "runner/run_snapshots"
 require_relative "runner/project_pre_passes"
 require_relative "runner/pool_coordinator"
 require_relative "runner/diagnostic_aggregator"
+require_relative "template_units"
 require_relative "runner/effect_envelope_pass"
 require_relative "runner/effect_annotation_residual_pass"
 require_relative "runner/buffer_pool_dispatcher"
@@ -107,6 +108,32 @@ module Rigor
         @effect_table || Effects::EffectTable.empty
       end
 
+      # ADR-103 WD9 (#391) — the envelope index this run resolved, for `rigor sig-gen`'s annotation
+      # emission to consult. Public for the same reason {#effect_table} is: a consumer outside the
+      # diagnostic stream needs what the run already computed, and rebuilding it from configuration
+      # alone would read a narrower set of strata — the accepted signatures and the rbs-inline virtual
+      # RBS both come from the built environment.
+      #
+      # Built on demand when the run never analysed a file. A WARM whole-run cache hit serves the
+      # propagated table from cache, so {#analyze_with_effects} — the only caller of
+      # {#effect_envelope_index} — never runs and the ivar stays nil. Returning an empty index there
+      # would silently drop sig-gen's "the author already declared a bound" gate on exactly the runs a
+      # user makes most often: the same `sig-gen` invocation would withhold on its first run and emit on
+      # its second. `@run_environment` is resolved before the cache is consulted, so the warm build reads
+      # the same strata the cold one does.
+      #
+      # `@run_environment` is nil only when the run resolved no environment at all — a run over zero
+      # project files, or one that never reached {#compute_run_diagnostics}. The build then falls back to
+      # the configuration-only strata (`sig/` annotations, class-level ones and `effects.envelopes:`,
+      # without the accepted signatures or the rbs-inline virtual RBS), which is the narrower answer but
+      # not a wrong one: a run with no environment analysed no file, so there is no candidate for the
+      # missing strata to have bounded.
+      def effect_envelopes
+        return @effect_envelope_index if @effect_envelope_index
+
+        effect_envelope_index(@run_environment)
+      end
+
       # ADR-103 WD2 / WD6 / WD10 / #387 — the loaded plugins' effect contributions, compiled once per
       # process. Memoised on first use rather than built in the constructor for two reasons: the plugin
       # registry is adopted after construction (`apply_prebuilt` / the plugin-load pre-pass), and the
@@ -270,11 +297,15 @@ module Rigor
                      record_dependencies: false, record_self_calls: false, analyze_only: nil,
                      seed_bundles: nil, collect_seed_bundles: false, param_inferred_types: nil,
                      discovery_seed: nil, no_tolerated_effects: false,
-                     restored_run_level_rows: nil)
+                     restored_run_level_rows: nil, served_per_file_diagnostics: nil)
         @configuration = configuration
         # Issues #796 / #794 — the previous full run's run-level rows, supplied only by
         # {IncrementalSession} on a narrowed run; see {PoolCoordinator#replay_restored_run_level_rows}.
         @restored_run_level_rows = restored_run_level_rows
+        # Issue #1524 — `{path => rows}` the {IncrementalSession} serves from its per-file cache for the files a
+        # narrowed run does not analyse, spliced into this run's per-file stream by
+        # {#interleave_served_diagnostics}. Empty on every other run.
+        @served_per_file_diagnostics = served_per_file_diagnostics || {}
         @explain = explain
         @cache_store = enforce_read_only_cache(cache_store, buffer)
         @plugin_requirer = plugin_requirer
@@ -314,6 +345,10 @@ module Rigor
         # check reads.
         @no_tolerated_effects = no_tolerated_effects
         @file_effects = {}
+        # #392 — the run's template units, synthesised once per run after the plugins load (see
+        # {#template_units}). nil until then; a project whose plugins declare no `template_globs:` resolves
+        # to the shared empty index and pays one `Array#empty?` for the whole run.
+        @template_units = nil
         @effect_table = nil
         @effects_served_from_cache = false
         # #482 — set only by a run served from the summary entry: the two derived tables it carries, and
@@ -322,6 +357,12 @@ module Rigor
         @cached_effect_ancestry = nil
         @cached_collections_loader = nil
         @run_dependency_descriptor = nil
+        # ADR-45 WD2 (#1507) — the plugin reads each file's analysis made (`{path => [row]}`), and the boundary
+        # rows as they stood around the per-file loop; see {#incremental_slot_rows}. Recorded only by a
+        # dependency-recording (incremental) run.
+        @analysis_reads = {}
+        @pre_analysis_plugin_rows = nil
+        @post_analysis_plugin_rows = nil
         # Memoised activation decision for the `call.self-undefined-method` rule (nil = not yet computed).
         # See `self_undefined_rule_active?`.
         @self_undefined_rule_active = nil
@@ -378,8 +419,17 @@ module Rigor
         # Issue #682 — the `Module.nesting` each class / module declaration HEADER is written in.
         @project_discovered_header_nestings = {}.freeze
         @project_discovered_includes = {}.freeze
+        # Issue #1123 — the instance-side prepend table (`prepend M`, and `Recv.prepend(M)`), in
+        # instance-ancestor SEARCH order.
+        @project_discovered_prepends = {}.freeze
         # Issue #898 — the singleton-side twin of the include table (`extend M` / `extend self`).
         @project_discovered_extends = {}.freeze
+        @project_unpositioned_mixins = {}.freeze
+        @project_discovered_deferred_ranges = {}.freeze
+        # Issue #1120 — `{refined class => {method => [refining modules]}}`, every `refine X do … end` body.
+        @project_discovered_refinements = {}.freeze
+        # Issue #1367 — the project's `Inference::GlobalWriteCensus`, which the `global.*` write rules read.
+        @project_discovered_global_write_census = Set.new.freeze
         @project_discovered_class_sources = {}.freeze
         # Issue #644 — the cross-file VALUE-constant publication table (`{qualified name => Type::Constant}`,
         # literal writes only) and its per-name write attribution. The first seeds `in_source_constants` on
@@ -390,8 +440,15 @@ module Rigor
         # ...and the raw per-(name, path) publication census the incremental producer diffs.
         @project_constant_writes = {}.freeze
         @published_constant_name_set = nil
+        @constant_writer_index = nil
+        @constant_shadower_index = nil
         @project_discovered_method_visibilities = {}.freeze
         @project_discovered_methods = {}.freeze
+        # ADR-119 WD1 — the `possible_*` / `contested_*` siblings of the paired members, ONE Hash keyed by sibling
+        # name so no adoption or seed path names a sibling and none can drop one.
+        @project_discovery_siblings = Scope::DiscoveryIndex::EMPTY_SIBLINGS
+        # Issue #992 — the cross-file parameter-envelope table `call.wrong-arity` reads for an undeclared `def`.
+        @project_discovered_parameter_envelopes = {}.freeze
         @project_data_member_layouts = {}.freeze
         @project_struct_member_layouts = {}.freeze
         # Issue #684 — set per run by {#project_discovery_expansion}; nil on every path that does not widen.
@@ -453,12 +510,21 @@ module Rigor
         @snapshots.reset_for_run
         # Per-run reset of the deferred-discovery memo (see `#ensure_project_discovery`).
         @project_discovery_done = false
+        # #392 — re-derive the template units each run: their source files can change between two runs of
+        # one long-lived Runner (the LSP's), and a unit is never served from a cache of its own. Since
+        # #1038 "re-derive" is not "recompile": a `prebuilt:` runner carries the snapshot's warm index into
+        # {#template_units}, which still re-expands every claim and revalidates every template against the
+        # filesystem, and only compiles what actually moved.
+        @template_units = nil
         # Per-run reset of the environment the cacheable path resolves, reused by the envelope pass so a
         # run never builds two.
         @run_environment = nil
         # #788 — the per-file reader is assigned only on the analysis (miss) path; reset it here so a run the
         # ADR-45 result cache serves does not answer with the previous run's rows.
         @per_file_diagnostics = [].freeze
+        @analysis_reads = {}
+        @pre_analysis_plugin_rows = nil
+        @post_analysis_plugin_rows = nil
         # ADR-84 WD2 — roll the return-memo bucket: a fresh frozen token per run makes every per-file scope
         # of THIS run share one memo bucket while entries from any earlier run in this process (stale after
         # an edit) become unreachable.
@@ -746,7 +812,10 @@ module Rigor
         @run_served_from_cache = false
         return assemble_run_diagnostics(expansion) unless run_result_cacheable?
 
-        environment = @pool_coordinator.resolve_sequential_environment(source_files: target_files(expansion))
+        # #392 — `source_files:` is what a plugin's `source_rbs_synthesizer` is offered at env-build time,
+        # and a template unit is not Ruby the synthesiser can read (rbs-inline would be handed `.rbx`
+        # bytes). The `.rb` expansion is the right set here; the units join the ANALYSED set only.
+        environment = @pool_coordinator.resolve_sequential_environment(source_files: expansion.fetch(:files))
         # Lazy-files descriptor: the cache KEY reads only `gems` + `configs`; the RBS signature-tree `files`
         # are digested solely by `run_dependency_descriptor` on a MISS, so a warm HIT never walks the tree.
         rbs_descriptor = if environment&.rbs_loader
@@ -776,6 +845,11 @@ module Rigor
         # then hit — the stats it would otherwise suppress were all gathered.
         @run_served_from_cache = !computed && analysis.nil?
         diagnostics
+      rescue Inference::DeclarationWalk::ContractError
+        # A broken walk contract in the project pre-pass (a shadow-harness divergence, an unknown variant) is
+        # not a cache failure: the fallback below would re-run the analysis with the pre-pass marked done and
+        # no project index, and report the resulting false positives instead of the failure.
+        raise
       rescue StandardError
         # The result cache must never break a run. If anything in the cache path fails, fall back to a
         # direct, uncached analysis.
@@ -998,7 +1072,14 @@ module Rigor
       def close_effect_graph
         return unless @record_effects
 
-        @effect_table = Effects::Propagator.propagate(effect_collection, discharge: effect_discharge)
+        # `declined_unit_keys:` — #1065. The templates a plugin claimed and produced no unit for; a render
+        # edge's format fallback must not resolve past one of them, because the file exists and the
+        # framework runs it, so the other format's effects are not what that render produces.
+        @effect_table = Effects::Propagator.propagate(
+          effect_collection,
+          discharge: effect_discharge,
+          declined_unit_keys: template_units.declined_unit_keys
+        )
       rescue StandardError
         @effect_table = Effects::EffectTable.empty
       end
@@ -1029,6 +1110,11 @@ module Rigor
         # untouched so its lazy build timing is unchanged.
         environment = seed_pre_eval_constants(expansion, environment)
         diagnostics = @diagnostic_aggregator.pre_file_diagnostics(expansion)
+        # #392 — a template transform that raised, a template that could not be read, or a unit naming a
+        # file it was not offered. Reported through the same `:plugin_loader` `runtime-error` envelope a
+        # raise from `#diagnostics_for_file` uses (ADR-2 § "Plugin Trust and I/O Policy"), rather than
+        # dropped in silence: a plugin author whose view stopped being analysed has nothing else to read.
+        diagnostics += template_unit_failure_diagnostics
         # ADR-46 — record which project files this run actually analyzed (the `analyze_only` subset, or
         # all of them). The incremental orchestrator serves every analyzed-but-not-affected file from the
         # per-file cache, so it needs the full analyzed set to subtract the affected closure from.
@@ -1045,6 +1131,11 @@ module Rigor
         # override re-stamps it; and a pool backend folds `.rigor.yml`-positioned prepare / pool-degraded rows
         # into the same return, which the slice drops. The run's own stream is stamped once, at the end.
         diagnostics += analyze_targets(targets, environment: environment, project_files: expansion.fetch(:files))
+        # Issue #1060 — the positioned batches plugins registered through `Plugin::Base#emit_once`, read once
+        # every worker payload has been merged. Kept beside the per-file stream (their rows name files and
+        # lines) but outside `#per_file_diagnostics`, which `analyze_targets` has already sliced, so no one
+        # file's incremental cache entry carries a project-wide batch.
+        diagnostics += @diagnostic_aggregator.plugin_run_emission_diagnostics
         # ADR-103 WD12 — the effect fixpoint, in the post-pool aggregation slot beside the conformance
         # results. Graph-only over a finite lattice, so it is a plain worklist to a true fixpoint; it
         # contributes NO diagnostics and its result leaves through `#effect_table`, never through the
@@ -1053,6 +1144,18 @@ module Rigor
         diagnostics + post_analysis_diagnostic_streams
       end
 
+      def template_unit_failure_diagnostics
+        template_units.failures.map do |failure|
+          Diagnostic.new(
+            path: failure.path, line: 1, column: 1,
+            message: "plugin #{failure.plugin_id.inspect} produced no template unit for " \
+                     "#{failure.path}: #{failure.message}",
+            severity: :error, rule: "runtime-error", source_family: :plugin_loader
+          )
+        end
+      end
+      private :template_unit_failure_diagnostics
+
       # The rbs-coverage build-failure ladder plus every remaining post-analysis stream
       # `#assemble_run_diagnostics` appends, in their fixed contract order (see the comments at each call
       # below and at the streams' own definitions). Split out of `#assemble_run_diagnostics` so that
@@ -1077,6 +1180,11 @@ module Rigor
         diagnostics += @diagnostic_aggregator.rbs_extended_reporter_diagnostics
         diagnostics += @diagnostic_aggregator.boundary_cross_diagnostics
         diagnostics += @diagnostic_aggregator.source_rbs_synthesis_diagnostics
+        # Issue #1051 — read after `analyze_targets` for the same reason the refusal stream below is: a
+        # plugin may register a disclosure from `#prepare` (the usual case) or while analysing a file, and
+        # both have to be in before the table is harvested. Ordered before the refusals so the run-level
+        # plugin rows read plugin-authored notice first, engine-authored envelope second.
+        diagnostics += @diagnostic_aggregator.plugin_run_disclosure_diagnostics
         # Issue #959 — read LAST (after `analyze_targets`, which already ran before this method is called),
         # so every per-file plugin call has had its chance to record a refusal on its (per-plugin-instance
         # memoised) `IoBoundary`, alongside the prepare-time refusals the same boundary instance may
@@ -1089,17 +1197,55 @@ module Rigor
       # `#per_file_diagnostics`: the `analyze_files` return, stamped with the same severity profile the run's
       # own stream gets (`SeverityStamp` drops `:off` rows and re-stamps overrides, and the per-file cache never
       # re-stamps), sliced to the rows positioned at the targets. Returns the RAW return for the run's stream,
-      # which is stamped once, at the end of `#run_analysis`.
+      # which is stamped once, at the end of `#run_analysis` — on a narrowed incremental run with the served
+      # files' rows spliced in (#1524), which `#per_file_diagnostics` never carries.
       def analyze_targets(targets, environment:, project_files:)
-        raw = @pool_coordinator.analyze_files(targets, environment: environment, project_files: project_files)
+        raw = template_units.remap(
+          @pool_coordinator.analyze_files(targets, environment: environment, project_files: project_files)
+        )
+        # ADR-45 WD2 (#1507) — the boundaries as the per-file loop left them; with the snapshot the first
+        # analysed file took, the rows {#incremental_slot_rows} checks every analysis-time read against.
+        @post_analysis_plugin_rows = plugin_boundary_rows if @record_dependencies
         analysed = targets.to_set
         @per_file_diagnostics = @diagnostic_aggregator.apply_severity_profile(raw)
                                                       .select { |diagnostic| analysed.include?(diagnostic.path) }
                                                       .freeze
-        raw
+        interleave_served_diagnostics(raw, analysed, project_files | targets)
       end
       private :analyze_targets
 
+      # Issue #1524 — splices the rows {IncrementalSession} serves from its per-file cache into this narrowed
+      # run's per-file stream, each file's rows where a full run of the same tree lists them. A full run
+      # analyses `order` (the project's files, then any buffer and template-unit targets) one file after
+      # another and a narrowed run a subsequence of it, so a served file's rows go just before the first row
+      # positioned at an analysed file later in `order`, or at the end when there is none. Only such a row
+      # marks a place, so the rows this run produced keep their relative order and a pool backend's
+      # `.rigor.yml` rows stay at the head. Splicing here rather than into the finished result keeps the
+      # run-level streams on either side of the per-file stream, where a full run has them. The served rows
+      # are already severity-resolved and the run's final stamp leaves them unchanged: a resolved severity
+      # resolves to itself, and a row the profile turns `:off` is never cached.
+      def interleave_served_diagnostics(raw, analysed, order)
+        served = @served_per_file_diagnostics
+        return raw if served.empty?
+
+        rank = order.each_with_index.to_h
+        # A served path the expansion no longer lists (a file deleted between the session's listing and this
+        # run) keeps its rows, after every other file's, as the concatenation this replaced did.
+        known, unknown = served.keys.partition { |path| rank.key?(path) }
+        pending = known.sort_by { |path| rank.fetch(path) }
+        merged = []
+        raw.each do |diagnostic|
+          # `order` lists every target, so an analysed path always has a rank; one that did not would only
+          # mark no place, since a misplaced row must never abort the run (ADR-5).
+          position = analysed.include?(diagnostic.path) ? rank.fetch(diagnostic.path, -1) : -1
+          merged.concat(served.fetch(pending.shift)) while pending.any? && rank.fetch(pending.first) < position
+          merged << diagnostic
+        end
+        (pending + unknown).each { |path| merged.concat(served.fetch(path)) }
+        merged
+      end
+      private :interleave_served_diagnostics
+
       # ADR-67 WD6a — the check-walk parameter-inference pre-pass. Populates `@project_param_inferred_types`
       # (read by `project_scope_seed_tables`) with the call-site union of every undeclared parameter, running
       # ONE round (a single hop of call-site → param typing; the protection scan's three-round fixpoint stays a
@@ -1199,7 +1345,8 @@ module Rigor
         # reconstructs `rbs.libraries` from config) can never drift out of key agreement.
         RunCacheKey.descriptor(
           configuration: @configuration, files: expansion.fetch(:files),
-          explain: @explain, rbs_config_entries: rbs_descriptor.configs
+          explain: @explain, rbs_config_entries: rbs_descriptor.configs,
+          template_units_digest: template_units.digest
         )
       end
 
@@ -1216,30 +1363,210 @@ module Rigor
 
       def build_run_dependency_descriptor(expansion, rbs_descriptor)
         entries = analyzed_file_entries(expansion) + discovery_file_entries(expansion) +
-                  pre_eval_file_entries + rbs_descriptor.files
+                  pre_eval_file_entries + template_unit_file_entries + rbs_descriptor.files
         # #979 — the signature ROOTS' listings, one glob row each. `rbs_descriptor.files` covers only the
         # `.rbs` files that existed while the run read them, so without these a signature file written after
         # the run left the slot validating fresh and the warm run answered without it.
-        globs = rbs_descriptor.globs.dup
+        globs = rbs_descriptor.globs + template_unit_glob_entries
+        boundary = plugin_boundary_rows
+        entries.concat(boundary.files)
+        globs.concat(boundary.globs).concat(producer_watch_glob_entries)
+        Cache::Descriptor.new(files: entries, globs: globs.uniq)
+      end
+
+      # Every file a plugin read or probed through its `IoBoundary` (#577 / #613), and every directory it listed
+      # (#954), as the boundaries stand when asked.
+      def plugin_boundary_rows
+        files = []
+        globs = []
         @plugin_registry.plugins.each do |plugin|
           # Read the boundary WITHOUT triggering its lazy `@io_boundary ||=` initializer: plugin instances
           # are frozen after the run, and a plugin that never built a boundary read no files through it,
           # so it contributes no dependencies.
           boundary = plugin.instance_variable_get(:@io_boundary)
-          if boundary
-            # #629 — a boundary carries GlobEntry listing rows too (`IoBoundary#list_directory`), and they
-            # are the only edge back to a file the run decided was ABSENT from a directory it consulted.
-            boundary_descriptor = boundary.cache_descriptor
-            entries.concat(boundary_descriptor.files)
-            globs.concat(boundary_descriptor.globs)
+          next unless boundary
+
+          # #629 — a boundary carries GlobEntry listing rows too (`IoBoundary#list_directory`), and they
+          # are the only edge back to a file the run decided was ABSENT from a directory it consulted.
+          boundary_descriptor = boundary.cache_descriptor
+          files.concat(boundary_descriptor.files)
+          globs.concat(boundary_descriptor.globs)
+        end
+        Cache::Descriptor.new(files: files, globs: globs)
+      end
+
+      # One glob row per producer `watch:` pattern (ADR-60 WD3), recomputed against the tree as it stands.
+      def producer_watch_glob_entries
+        @plugin_registry.plugins.flat_map do |plugin|
+          plugin.class.producers.each_value.flat_map do |prod|
+            prod[:watch] ? plugin.send(:watch_glob_entries, prod[:watch]) : []
           end
-          plugin.class.producers.each_value do |prod|
-            globs.concat(plugin.send(:watch_glob_entries, prod[:watch])) if prod[:watch]
+        end
+      end
+
+      # ADR-45 WD2 (#1507) — the rows `rigor check --incremental`'s run-result slot records beside the analysed
+      # files (whose digests {IncrementalSession} holds itself). Every run reads these inputs again and re-derives
+      # its answer from them; they are split by when the row was taken, which decides whether the session's
+      # {IncrementalRunSlot::WriteGuard} must vouch for it:
+      #
+      # - `observed` — every plugin row (`#prepare`, producers, template synthesis, and this run's per-file reads
+      #   too), recorded by the {Plugin::IoBoundary} as the plugin read. It includes each producer's `watch:`
+      #   globs, which a producer replays into its boundary whether it computed or was served (#1558). A save
+      #   after the read leaves the row stale, so no guard is needed.
+      # - `derived` — rows taken when the run ENDS: the template files and their claimed globs (#392, re-analysed
+      #   every run), and one existence row per analysis root and per `pre_eval:` entry. A run's path errors (`no
+      #   such file or directory`, `pre-eval.file-not-found`) answer to those last rows; the plain slot records
+      #   neither, and the incremental path regenerates the errors every run, so a slot that served one past the
+      #   edit that retracts it would print what no run of that tree prints. Existence rows carry ADR-45 WD1b's
+      #   bound: a directory replaced by a file of the same name stays fresh.
+      # - `by_file` — `{path => Descriptor}`, the plugin reads each file's analysis made
+      #   ({Plugin::IoBoundary.attributing}). A narrowed run analyses only its closure, so the session carries the
+      #   other files' reads forward from the previous slot.
+      #
+      # The template rows stand in for the `template-units` slot the plain key carries, which only a run can
+      # compute. That digest is a function of each unit's compiled Ruby (the template's bytes, and whatever else
+      # the transform read, through its boundary), its transform (the plugin, whose identity and configuration
+      # the key carries) and the synthesis version (the engine's): each of those has a row or a key slot.
+      #
+      # The inputs a recheck does NOT re-derive are {#baseline_dependency_rows}. nil when this run cannot vouch for
+      # its rows — a pool run, whose workers' reads never reach this process; a run that recorded no dependencies,
+      # whose analysis no session owns; or a run in which a boundary row changed during the per-file loop that no
+      # file's analysis was credited with, such as a read from a thread the plugin started.
+      IncrementalSlotRows = Data.define(:observed, :derived, :by_file)
+
+      # @param roots — the analysis roots the run was given.
+      def incremental_slot_rows(roots:)
+        return nil if pool_mode? || !@record_dependencies
+        return nil unless analysis_reads_attributed?
+
+        IncrementalSlotRows.new(
+          observed: plugin_boundary_rows,
+          derived: Cache::Descriptor.new(
+            files: template_unit_file_entries + existence_entries(Array(roots) + @configuration.pre_eval),
+            globs: template_unit_glob_entries
+          ),
+          by_file: @analysis_reads.transform_values do |reads|
+            Cache::Descriptor.new(
+              files: reads.grep(Cache::Descriptor::FileEntry).uniq,
+              globs: reads.grep(Cache::Descriptor::GlobEntry).uniq
+            )
+          end
+        )
+      end
+
+      # Whether every boundary row that appeared or changed during the per-file loop is one some file's analysis
+      # was credited with. A row outside every file's attribution would ride this run's `run` rows only, and the
+      # next narrowed run — which does not repeat the read — would drop it.
+      def analysis_reads_attributed?
+        post = @post_analysis_plugin_rows || plugin_boundary_rows
+        pre = @pre_analysis_plugin_rows || post
+        credited = @analysis_reads.each_value.flat_map(&:itself).to_set
+        (post.files - pre.files).all? { |row| credited.include?(row) } &&
+          (post.globs - pre.globs).all? { |row| credited.include?(row) }
+      end
+
+      # ADR-45 WD2 (#1507) — the rows a FULL run records for the inputs an incremental recheck does not re-derive,
+      # which the session therefore carries unchanged from the full run that recorded them to every later slot:
+      #
+      # - the signature tree the plain slot records (`RbsDescriptor.file_entries` / `.glob_entries` over the loader
+      #   roots this run's analysis resolved), and an existence row per signature root, configured or the
+      #   auto-detected `sig` — a recheck rebuilds no environment unless its closure is non-empty, and the snapshot
+      #   fingerprint digests the same roots (configured, or the auto-detected `sig`), so a change to one drops the
+      #   snapshot and forces a full run rather than reaching a recheck;
+      # - the discovered-not-analysed files (#684) and a listing row per discovery root — a narrowed recheck does
+      #   not widen discovery at all;
+      # - every `pre_eval:` file outside `files` (a stat row, or an absence row) — the session tracks only analysed
+      #   files, and one that is analysed is guarded by its own row.
+      #
+      # Recomputing any of these on a recheck would vouch for the tree the recheck saw while its answer still
+      # carries rows computed before the change, so a change to one keeps the probe declining until the next full
+      # run. nil when this process analysed no file itself — a pool run, or a run with no files.
+      #
+      # Split by what identifies the input. `pinned` holds the signature files outside the project's own signature
+      # roots, which the slot's key identifies already: the engine's own (`data/`, a bundled plugin's `sig/`, a
+      # gem overlay) by the engine slot, a gem's `sig/` and an `rbs collection` directory by the lockfiles. `owned`
+      # holds the rest, which only their rows identify. The session's write guard refuses an `owned` row whose
+      # change time it cannot read, and passes over a `pinned` one.
+      BaselineRows = Data.define(:owned, :pinned)
+
+      SignatureRoots = Struct.new(:signature_paths)
+      private_constant :SignatureRoots
+
+      # @param files — the run's analysed-path set.
+      def baseline_dependency_rows(files:)
+        return nil if pool_mode? || !@collect_stats || @analyzed_files.empty?
+
+        own, pinned = signature_rows
+        BaselineRows.new(
+          owned: Cache::Descriptor.new(
+            files: own.files + existence_entries(signature_root_candidates) +
+                   discovery_file_entries({ files: files }) + unanalysed_pre_eval_entries(files),
+            globs: (own.globs + discovery_glob_entries).uniq
+          ),
+          pinned: pinned
+        )
+      end
+
+      # The signature tree's rows, the project's own and the rest.
+      def signature_rows
+        roots = SignatureRoots.new(@snapshots.signature_paths)
+        own = signature_root_candidates.map { |root| File.join(File.absolute_path(root.to_s), "") }
+        own_files, other_files = Cache::RbsDescriptor.file_entries(roots, comparator: :stat)
+                                                     .partition { |row| within?(row.path, own) }
+        own_globs, other_globs = Cache::RbsDescriptor.glob_entries(roots).partition { |row| within?(row.root, own) }
+        [Cache::Descriptor.new(files: own_files, globs: own_globs.uniq),
+         Cache::Descriptor.new(files: other_files, globs: other_globs.uniq)]
+      end
+
+      def within?(path, roots)
+        directory = File.join(File.absolute_path(path.to_s), "")
+        roots.any? { |root| directory.start_with?(root) }
+      end
+
+      # The project's own signature roots, whether or not they exist: the configured `signature_paths:`, or the
+      # `sig` directory `Environment.default_signature_paths` auto-detects when none are configured. The
+      # signature rows' listing rows cover a file appearing under a root that existed; only an existence row
+      # covers the root itself appearing.
+      def signature_root_candidates
+        @configuration.signature_paths || ["sig"]
+      end
+
+      # One names-mode listing row per directory the discovery widening globbed, so a file appearing there is seen
+      # as well as an edit to one that existed.
+      def discovery_glob_entries
+        return [] if @project_discovery_expansion.nil?
+
+        @configuration.paths.select { |root| File.directory?(root) }.map do |root|
+          Cache::Descriptor::GlobEntry.compute(root: root, pattern: PathExpansion::RUBY_GLOB, mode: :names)
+        end
+      end
+
+      def unanalysed_pre_eval_entries(files)
+        analysed = files.to_set { |path| File.absolute_path(path) }
+        outside = @configuration.pre_eval.reject { |path| analysed.include?(File.absolute_path(path)) }
+        outside.map do |path|
+          if File.file?(path)
+            Cache::Descriptor::FileEntry.stat(path: path, digest: Cache::FileDigest.hexdigest(path))
+          else
+            existence_entries([path]).first
           end
         end
-        Cache::Descriptor.new(files: entries, globs: globs.uniq)
       end
 
+      def existence_entries(paths)
+        paths.uniq.map do |path|
+          physical = @buffer ? @buffer.resolve(path) : path
+          if File.exist?(physical)
+            Cache::Descriptor::FileEntry.present(path: physical)
+          else
+            Cache::Descriptor::FileEntry.absent(path: physical)
+          end
+        end
+      end
+      private :plugin_boundary_rows, :producer_watch_glob_entries, :existence_entries,
+              :analysis_reads_attributed?, :signature_root_candidates, :discovery_glob_entries,
+              :unanalysed_pre_eval_entries, :signature_rows, :within?
+
       # Issue #684 — the project files this run DISCOVERED but did not analyse. A widened run's diagnostics
       # are a function of them (that is the entire point: the method whose absence would have been reported
       # is defined in one of them), so the run-result cache must invalidate when one changes. Empty on every
@@ -1268,6 +1595,30 @@ module Rigor
       # expansion — so without this entry, editing one would leave the run-result cache serving diagnostics
       # computed against the previous version. The common case (a `lib/core_ext/` file that is also under
       # `paths:`) contributes a duplicate entry, which the descriptor's per-path validation absorbs.
+      # #392 — the TEMPLATE files behind the run's units. The key slot carries the compiled Ruby's digest
+      # (`template_units_digest`), which is what decides whether a cached answer describes this source; these
+      # entries are the validation half, so a template edited between two runs re-globs and re-digests here
+      # exactly as an analysed `.rb` file does. Both are needed: a transform that compiles two different
+      # templates to the same Ruby must still not resurrect the wrong PATH in a diagnostic.
+      # #392 — one `:names` row per claimed `template_globs:` pattern, whether or not it matched. The file
+      # rows below cover edits to templates that EXIST; only a glob row notices one appearing or vanishing,
+      # which is what let a project's first template stay invisible to every warm run.
+      def template_unit_glob_entries
+        template_units.glob_entries
+      end
+
+      # Every template the run READ, successes and failures alike: a `plugin_loader` row produced by a
+      # template that would not compile must not outlive the edit that fixes it, and a buffer-bound path is
+      # digested at the bytes the run actually read.
+      def template_unit_file_entries
+        template_units.source_paths.filter_map do |path|
+          physical = template_units.physical_path(path, @buffer)
+          next unless File.file?(physical)
+
+          Cache::Descriptor::FileEntry.stat(path: physical, digest: Cache::FileDigest.hexdigest(physical))
+        end
+      end
+
       def pre_eval_file_entries
         @configuration.pre_eval.filter_map do |path|
           physical = @buffer ? @buffer.resolve(path) : path
@@ -1352,19 +1703,42 @@ module Rigor
         @project_discovered_singleton_def_sources = discovery.discovered_singleton_def_sources
         @project_discovered_superclasses = discovery.discovered_superclasses
         @project_discovered_header_nestings = discovery.discovered_header_nestings
-        @project_discovered_includes = discovery.discovered_includes
-        @project_discovered_extends = discovery.discovered_extends
+        apply_discovery_mixin_tables(discovery)
+        @project_discovered_deferred_ranges = discovery.discovered_deferred_ranges
+        apply_discovery_call_surface_tables(discovery)
         @project_discovered_class_sources = discovery.discovered_class_sources
         @project_constant_values = discovery.constant_values
         @published_constant_name_set = nil
+        @constant_writer_index = nil
+        @constant_shadower_index = nil
         @project_constant_sources = discovery.constant_sources
         @project_constant_writes = discovery.constant_writes
         @project_discovered_method_visibilities = discovery.discovered_method_visibilities
         @project_discovered_methods = discovery.discovered_methods
+        @project_discovered_parameter_envelopes = discovery.discovered_parameter_envelopes
         @project_data_member_layouts = discovery.data_member_layouts
         @project_struct_member_layouts = discovery.struct_member_layouts
       end
 
+      # The tables only check rules read beyond dispatch — the issue #1120 refinements and the issue #1367
+      # global-write census — and the ADR-119 WD1 siblings of the paired members. Extracted to keep
+      # {#apply_discovery_result} under its ABC budget.
+      def apply_discovery_call_surface_tables(discovery)
+        @project_discovery_siblings = discovery.siblings
+        @project_discovered_refinements = discovery.discovered_refinements
+        @project_discovered_global_write_census = discovery.discovered_global_write_census
+      end
+
+      # The three mixin tables the discovery pass carries — the ADR-24 `include` map, its issue #1123
+      # `prepend` twin, and the #898 `extend` table. Extracted to keep {#apply_discovery_result} under its
+      # ABC budget.
+      def apply_discovery_mixin_tables(discovery)
+        @project_discovered_includes = discovery.discovered_includes
+        @project_discovered_prepends = discovery.discovered_prepends
+        @project_discovered_extends = discovery.discovered_extends
+        @project_unpositioned_mixins = discovery.unpositioned_mixins
+      end
+
       # Internal: builds the deferred cross-file discovery tables at most once per run and adopts them.
       # Memoised on `@project_discovery_done` (reset at the start of `#run`). No-op under `@prebuilt` — the
       # LSP path deliberately seeds an empty project scope from a snapshot that carries no discovery tables,
@@ -1379,7 +1753,7 @@ module Rigor
 
         @project_discovery_done = true
         # Issue #684 — the cross-file index spans the PROJECT even when the analysis targets a file list.
-        expansion = @project_discovery_expansion || expansion
+        expansion = @project_discovery_expansion || once_each(expansion)
         if @collect_seed_bundles
           # ADR-85 WD2 — rebuild discovery from the prior run's bundles (re-walking only changed files) and
           # capture the refreshed bundle set for the session to persist.
@@ -1413,11 +1787,42 @@ module Rigor
       # Excluded, each because its expansion is already the one it means: the LSP `prebuilt:` path (which
       # seeds discovery from a snapshot), editor `buffer:` mode, `run_source`'s in-memory single file, and
       # ADR-46's `analyze_only` subset mode (which already passes the full expansion and filters later).
+      #
+      # Issue #1556 — the widened set holds each FILE once. `.rigor.yml`'s `paths:` load as absolute paths and a
+      # path argument usually does not, so `rigor check lib` widened discovery over both spellings of every file:
+      # the pre-pass then saw two writers for every constant a file declares and withheld its publication (#644),
+      # and every file was a discovered-not-analysed dependency of the run's cache entry.
+      #
+      # The widening decision itself still compares the paths as spelled. `exclude:` patterns match a path as it
+      # is spelled, so until #1576 is fixed the configured absolute `lib` can discover files the argument `lib`
+      # excludes (a relative `lib/gen/**` pattern never matches `/abs/lib/gen/x.rb`), and treating the two as the
+      # same root would drop those files from discovery.
       def project_discovery_expansion(paths, expansion)
         return nil unless widen_discovery_to_project?(paths)
 
-        widened = expand_paths(@configuration.paths | paths)
-        widened.fetch(:files).size > expansion.fetch(:files).size ? widened : nil
+        analysed = expansion.fetch(:files)
+        files = discovery_files(expand_paths(@configuration.paths | paths).fetch(:files), analysed)
+        # Overlapping arguments (`lib lib/user.rb`) name an analysed file twice; the widened set names it once.
+        files.size > analysed.uniq { |path| File.absolute_path(path) }.size ? { files: files, errors: [] } : nil
+      end
+
+      # The expansion with each file once, first spelling kept: overlapping arguments (`lib ./lib`) that do not
+      # widen discovery still name a file twice, and the pre-pass would take every constant in it for one written
+      # twice (#1556). Symlinked aliases (`src -> lib`) are not folded; that needs a realpath and stays out of scope.
+      def once_each(expansion)
+        files = expansion.fetch(:files)
+        unique = files.uniq { |path| File.absolute_path(path) }
+        unique.size == files.size ? expansion : expansion.merge(files: unique)
+      end
+
+      # Each file once, in project order, under the spelling the analysis uses when it is analysed.
+      def discovery_files(project_files, analysed_files)
+        spelling = analysed_files.to_h { |path| [File.absolute_path(path), path] }
+        seen = Set.new
+        project_files.filter_map do |path|
+          absolute = File.absolute_path(path)
+          spelling.fetch(absolute, path) if seen.add?(absolute)
+        end
       end
 
       def widen_discovery_to_project?(paths)
@@ -1436,7 +1841,7 @@ module Rigor
 
       private :run_project_pre_passes, :adopt_prebuilt_project_scan, :apply_pre_passes_result,
               :apply_discovery_result, :ensure_project_discovery, :force_eager_discovery?,
-              :project_discovery_expansion, :widen_discovery_to_project?
+              :project_discovery_expansion, :discovery_files, :once_each, :widen_discovery_to_project?
 
       # Ruby versions probed (ascending) to discover the lowest one this Prism build accepts for
       # `version:`. Prism exposes no version list, so the floor is found empirically — only when a
@@ -1498,6 +1903,25 @@ module Rigor
       # The buffer's logical path is added to the file list even if it's not under `paths:` — per design §
       # "Failure envelope": "--instead-of=Y with Y not under any paths: directory → treated as a valid
       # logical identity for the buffer".
+      # #392 — the run's template units. Built once per run, on the parent, AFTER the plugin pre-pass has
+      # loaded the registry; a run whose plugins declare no `template_globs:` never globs and never calls a
+      # plugin.
+      #
+      # #1038 — a runner built with `prebuilt:` hands the snapshot's warm index to `collect(previous:)`, so
+      # a per-buffer publish against a long-lived {LanguageServer::ProjectContext} re-runs the transform
+      # only for a template that actually moved on disk (and for the buffer's own, always). The globs are
+      # still re-expanded and every surviving template is still revalidated, so an added, deleted or edited
+      # template is seen on the next publish without the owner invalidating anything. A runner with no
+      # `prebuilt:` — every CLI run — passes no `previous:` and builds the index exactly as before.
+      def template_units
+        @template_units ||= if @plugin_registry.nil?
+                              TemplateUnits.empty
+                            else
+                              TemplateUnits.collect(registry: @plugin_registry, buffer: @buffer,
+                                                    previous: @prebuilt&.template_units)
+                            end
+      end
+
       def target_files(expansion)
         files = expansion.fetch(:files)
         # ADR-46 slice 2 — restrict the analyzed set to the affected closure while the pre-pass (run
@@ -1508,14 +1932,41 @@ module Rigor
           # the same allowance option A makes below.
           files = files.select { |path| @analyze_only.include?(path) }
           files |= [@buffer.logical_path] if @buffer && @analyze_only.include?(@buffer.logical_path)
-          return files
+          return template_unit_targets(files)
         end
-        return files if @buffer.nil?
+        return template_unit_targets(files) if @buffer.nil?
 
-        # Editor mode option A — no closure, so the buffer's single logical path IS the analyzed set.
+        # Editor mode option A — no closure, so the buffer's single logical path IS the analyzed set. The
+        # template units deliberately do NOT join it: a per-buffer publish answers about the buffer the
+        # editor is showing, and appending every view would publish diagnostics for files the editor did
+        # not ask about (and re-parse them on every keystroke).
         [@buffer.logical_path]
       end
 
+      # #392 — the template units join the analysed set AFTER any narrowing, so an `--incremental` recheck
+      # re-analyses every unit even when its closure is one `.rb` file. Nothing in the ADR-46 dependency
+      # graph names a synthesised file, so there is no edge that could put a unit in a closure — narrowing
+      # first and appending second is what makes "always re-analysed" true rather than a comment. The cost
+      # is one parse per template on the warm path; the alternative silently drops every template
+      # diagnostic from the second run onwards.
+      #
+      # Appended rather than merged in sorted order so the `.rb` expansion's own order — and every output
+      # that follows it — is byte-identical for a project with no units.
+      def template_unit_targets(files)
+        return files if template_units.empty?
+
+        files + (template_units.paths - files)
+      end
+      private :template_unit_targets
+
+      # #392 — the unit paths this run synthesised. Read by {IncrementalSession}, which keeps them OUT of
+      # its analysed-file set: a unit is never served from the per-file cache and never counts as a file
+      # that was removed from the project, because `#target_files` re-analyses it every run.
+      def template_unit_paths
+        template_units.paths
+      end
+      public :template_unit_paths
+
       # Editor mode (`buffer:` non-nil) auto-flips the cache store to `read_only: true` so multiple
       # debounced editor invocations against the same project don't churn the on-disk cache or race on
       # schema-version writes. Cache reads continue unchanged; misses still run the producer block but the
@@ -1552,6 +2003,7 @@ module Rigor
           synthetic_method_index: -> { @synthetic_method_index },
           project_patched_methods: -> { @project_patched_methods },
           project_scope_seed: -> { project_scope_seed_tables },
+          template_units: -> { template_units },
           analyze_file: ->(path, environment) { analyze_file(path, environment) },
           restored_run_level_rows: @restored_run_level_rows
         )
@@ -1571,7 +2023,8 @@ module Rigor
           env_build_failure_snapshot: -> { @snapshots.env_build_failure },
           definition_build_failures_snapshot: -> { @snapshots.definition_build_failures },
           hkt_scan_failure_snapshot: -> { @snapshots.hkt_scan_failure },
-          conformance_results_snapshot: -> { @snapshots.conformance_results }
+          conformance_results_snapshot: -> { @snapshots.conformance_results },
+          pooled_run_disclosures: -> { @pool_coordinator.collected_run_disclosures }
         )
       end
 
@@ -1598,7 +2051,9 @@ module Rigor
         RunStats.new(
           wall_seconds: Process.clock_gettime(Process::CLOCK_MONOTONIC) - wall_started_at,
           peak_rss_bytes: RunStats.peak_rss_bytes,
-          target_files: expansion.fetch(:files).size,
+          # #392 — the template units count too: they are files this run parsed and typed, and a stats line
+          # that omitted them would under-report exactly the work a views-heavy project added.
+          target_files: expansion.fetch(:files).size + template_units.paths.size,
           rbs_classes_total: snapshot.size,
           rbs_classes_project_sig: project_sig,
           rbs_classes_bundled: bundled,
@@ -1649,7 +2104,7 @@ module Rigor
       end
 
       def shadow_rule_walk?
-        ENV.fetch("RIGOR_SHADOW_RULE_WALK", nil)
+        ShadowHarness.enabled?
       end
 
       def collect_plugin_diagnostics(plugin, path, root, scope, node_result)
@@ -1755,6 +2210,12 @@ module Rigor
       # so Prism's location data carries the LOGICAL path. Non-binding paths go through the cheaper
       # `Prism.parse_file` codepath unchanged.
       def parse_source(path)
+        entry = template_units[path]
+        if entry
+          return Prism.parse(entry.source, filepath: path, version: @configuration.target_ruby,
+                                           scopes: template_units.parse_scopes(path))
+        end
+
         if @in_memory_sources&.key?(path)
           return Prism.parse(@in_memory_sources[path], filepath: path, version: @configuration.target_ruby)
         end
@@ -1788,13 +2249,9 @@ module Rigor
         # bucket identically to the sequential path.
         tables[:run_generation] = @run_generation if @run_generation
         tables[:discovered_classes] = @project_discovered_classes unless @project_discovered_classes.empty?
-        tables[:discovered_def_nodes] = @project_discovered_def_nodes unless @project_discovered_def_nodes.empty?
         unless @project_discovered_def_nestings.empty?
           tables[:discovered_def_nestings] = @project_discovered_def_nestings
         end
-        unless @project_discovered_singleton_def_nodes.empty?
-          tables[:discovered_singleton_def_nodes] = @project_discovered_singleton_def_nodes
-        end
         seed_def_source_tables(tables)
         unless @project_discovered_superclasses.empty?
           tables[:discovered_superclasses] = @project_discovered_superclasses
@@ -1803,33 +2260,77 @@ module Rigor
           tables[:discovered_header_nestings] = @project_discovered_header_nestings
         end
         seed_mixin_tables(tables)
-        unless @project_discovered_method_visibilities.empty?
-          tables[:discovered_method_visibilities] = @project_discovered_method_visibilities
-        end
-        tables[:discovered_methods] = @project_discovered_methods unless @project_discovered_methods.empty?
+        seed_paired_tables(tables)
+        seed_call_surface_tables(tables)
         seed_opt_in_pre_pass_tables(tables)
         seed_member_layout_tables(tables)
         seed_dependency_attribution_tables(tables)
-        tables
+        # Only a base seed can bring in half a pair (`seed_paired_tables` writes both halves), so a run without
+        # one skips the copy this costs per file.
+        @discovery_seed ? Scope::DiscoveryIndex.compact_pairs(tables) : tables
+      end
+
+      # ADR-119 WD1 — the members `Scope::DiscoveryIndex::SIBLINGS` pairs, each with its sibling. A pair rides the
+      # seed when either half is non-empty and is left out when both are, which keeps an `discovery_seed:` base's
+      # table for a pair this run computed nothing for. {Scope::DiscoveryIndex#with} takes the two together, and
+      # `compact_pairs` completes a half pair a base seed brought in.
+      PAIRED_MEMBER_IVARS = Scope::DiscoveryIndex::SIBLINGS.keys.to_h do |member|
+        [member, :"@project_#{member}"]
+      end.freeze
+      private_constant :PAIRED_MEMBER_IVARS
+
+      def seed_paired_tables(tables)
+        PAIRED_MEMBER_IVARS.each do |member, ivar|
+          sibling = Scope::DiscoveryIndex::SIBLINGS.fetch(member)
+          table = instance_variable_get(ivar)
+          own = @project_discovery_siblings.fetch(sibling)
+          next if table.empty? && own.empty?
+
+          tables[member] = table
+          tables[sibling] = own
+        end
+      end
+
+      # The tables only check rules read: the issue #1120 refinements (`call.undefined-method`) and the issue #1367
+      # global-write census (the `global.*` write rules); the issue #992 envelopes ride {#seed_paired_tables}. Split
+      # out of {#project_scope_seed_tables} to keep it under the complexity budget.
+      def seed_call_surface_tables(tables)
+        tables[:discovered_refinements] = @project_discovered_refinements unless @project_discovered_refinements.empty?
+        # Issue #1367 — read by the `global.*` write rules.
+        return if @project_discovered_global_write_census.empty?
+
+        tables[:discovered_global_write_census] = @project_discovered_global_write_census
       end
 
-      # The two mixin tables: the ADR-24 instance-side `include` / `prepend` map and its #898 singleton-side
-      # `extend` twin. Paired here because they are read as one picture of a class's ancestry, and split out
-      # of {#project_scope_seed_tables} to keep it under the complexity budget.
+      # The three mixin tables: the ADR-24 instance-side `include` map, its issue #1123 `prepend` twin
+      # (which carries the instance-ancestor order the include table's set-shaped value cannot), and the
+      # #898 singleton-side `extend` table. Grouped here because they are read as one picture of a class's
+      # ancestry, and split out of {#project_scope_seed_tables} to keep it under the complexity budget.
       def seed_mixin_tables(tables)
         tables[:discovered_includes] = @project_discovered_includes unless @project_discovered_includes.empty?
+        tables[:discovered_prepends] = @project_discovered_prepends unless @project_discovered_prepends.empty?
         tables[:discovered_extends] = @project_discovered_extends unless @project_discovered_extends.empty?
+        tables[:unpositioned_mixins] = @project_unpositioned_mixins unless @project_unpositioned_mixins.empty?
       end
 
-      # ADR-46 slice 1 / issue #644 — the two SOURCE-ATTRIBUTION tables, read only by the recording accessors
+      # ADR-46 slice 1 / issue #644 — the two SOURCE-ATTRIBUTION tables, read by the recording accessors
       # (`Scope#record_class_dependency` for the class-declaration map, `Scope#record_constant_dependency`
-      # for the constant-write map). A normal run carries neither. Extracted to keep
-      # {#project_scope_seed_tables} under the complexity budget.
+      # for the constant-write map). The class-declaration map rides every run: an ancestor-order reader also
+      # asks whether a class is declared in more than one file. The constant-write map rides only a recording
+      # run. Extracted to keep {#project_scope_seed_tables} under the complexity budget.
+      #
+      # Issue #617 — the census's binding writes, grouped by last segment, ride every run instead: a constant
+      # compound write whose plain read resolves nothing reads its binding off them, a TYPE rather than an edge.
+      # Issue #1290's shadowing writes ride beside them for the lexical ladder, for the same reason.
       def seed_dependency_attribution_tables(tables)
-        return unless @record_dependencies
-
+        writers = constant_writer_index
+        tables[:constant_writers] = writers unless writers.empty?
+        shadowers = constant_shadower_index
+        tables[:constant_shadowers] = shadowers unless shadowers.empty?
         tables[:discovered_class_sources] = @project_discovered_class_sources unless
           @project_discovered_class_sources.empty?
+        return unless @record_dependencies
+
         tables[:constant_sources] = @project_constant_sources unless @project_constant_sources.empty?
       end
 
@@ -1860,6 +2361,44 @@ module Rigor
         tables[:published_constant_names] = names unless names.empty?
       end
 
+      # Issue #617 — the censused names that bind, grouped by last segment (`Scope#bound_constant_names`). A
+      # name some write other than a memo `||=` touches always binds. A memo-only name binds once memos of its
+      # segment span two files: either may load first and set the constant the other then reads, so only a
+      # memo no other file shares keeps the idiom's reading. Files are counted expanded, because discovery can
+      # walk one file under two spellings (`lib/b.rb`, `./lib/b.rb`).
+      def constant_writer_index
+        @constant_writer_index ||= begin
+          memo_files = memo_files_by_segment
+          @project_constant_writes.each_with_object({}) do |(name, by_path), index|
+            segment = name.split("::").last
+            next if memo_only?(by_path) && memo_files.fetch(segment).size < 2
+
+            (index[segment] ||= []) << name
+          end.each_value(&:freeze).freeze
+        end
+      end
+
+      # Issue #1290 — the censused names some write other than a memo `||=` assigns, grouped by last segment
+      # (`Scope#shadowing_constant_names`): the ones that exist whether or not an outer constant of the name
+      # does, and so stop the lexical ladder above it. A memo-only name is left out however many files memoize
+      # it, unlike in {#constant_writer_index}: `X ||= v` resolves `X` through the very lookup whose lower rung
+      # the stop would replace, so wherever that rung answers, the memo finds it and never creates the name.
+      def constant_shadower_index
+        @constant_shadower_index ||= @project_constant_writes.each_with_object({}) do |(name, by_path), index|
+          (index[name.split("::").last] ||= []) << name unless memo_only?(by_path)
+        end.each_value(&:freeze).freeze
+      end
+
+      def memo_files_by_segment
+        @project_constant_writes.each_with_object({}) do |(name, by_path), files|
+          set = (files[name.split("::").last] ||= Set.new)
+          by_path.each { |path, descriptor| set << File.absolute_path(path) if memo_descriptor?(descriptor) }
+        end
+      end
+
+      def memo_only?(by_path) = by_path.each_value.all? { |descriptor| memo_descriptor?(descriptor) }
+      def memo_descriptor?(descriptor) = descriptor == Inference::ScopeIndexer::CONSTANT_MEMO
+
       # Issue #644 — the LAST SEGMENTS of the published table, the run-wide half of
       # `Scope#published_constant?`. Seeded on EVERY run (unlike `constant_sources`, which only a recording
       # run needs) because {CheckRules::PublishedConstantGuard} asks the question on every `if` / `unless`.
@@ -1911,14 +2450,14 @@ module Rigor
         writers = @project_constant_sources[name]
         wildcard = @project_constant_sources["#{Inference::ScopeIndexer::DYNAMIC_TARGET_PREFIX}#{segment}"]
         [writers, wildcard].any? do |paths|
-          paths&.any? { |path| !listed.include?(File.expand_path(path)) }
+          paths&.any? { |path| !listed.include?(File.absolute_path(path)) }
         end
       end
 
       # The listed `pre_eval:` files, expanded so a census path and a configured one compare as the same
       # file whichever spelling each arrived in.
       def pre_eval_path_set
-        @pre_eval_path_set ||= @configuration.pre_eval.to_set { |path| File.expand_path(path) }
+        @pre_eval_path_set ||= @configuration.pre_eval.to_set { |path| File.absolute_path(path) }
       end
 
       # ADR-46 — seed the instance + singleton `"path:line"` def-source tables (each only when non-empty).
@@ -1948,11 +2487,18 @@ module Rigor
       def analyze_file(path, environment)
         return analyze_with_effects(path, environment) unless @record_dependencies
 
+        # ADR-45 WD2 (#1507) — every plugin read this file's analysis makes is attributed to it, so the
+        # incremental session can validate them on a later run that serves this file's answer from cache.
+        @pre_analysis_plugin_rows ||= plugin_boundary_rows
+        reads = []
         diagnostics = nil
-        record = DependencyRecorder.record_for(path) do
-          diagnostics = analyze_with_effects(path, environment)
+        record = Plugin::IoBoundary.attributing(reads) do
+          DependencyRecorder.record_for(path) do
+            diagnostics = analyze_with_effects(path, environment)
+          end
         end
         @file_dependencies[path] = record
+        @analysis_reads[path] = reads unless reads.empty?
         diagnostics
       end
 
@@ -1963,10 +2509,11 @@ module Rigor
       def analyze_with_effects(path, environment)
         return analyze_file_body(path, environment) unless @record_effects
 
+        entry = template_units[path]
         diagnostics = nil
         collection = Effects::Collector.collect_for(
           path, attribution: @effect_attribution, envelopes: effect_envelope_index(environment),
-                plugin_facts: effect_plugin_facts
+                plugin_facts: effect_plugin_facts, unit_key: entry&.unit_key, unit_owner: entry&.self_type
         ) do
           diagnostics = analyze_file_body(path, environment)
         end
@@ -2005,7 +2552,9 @@ module Rigor
         # is a per-FILE site, so one `Thread.current` read is already nothing. The per-dispatch site in
         # `ExpressionTyper#call_type_for` is the one that pays for the integer fast path.
         Effects::Collector.record_root(parse_result.value)
-        scope = seed_project_scope(Scope.empty(environment: environment, source_path: path))
+        scope = template_units.seed(
+          seed_project_scope(Scope.empty(environment: environment, source_path: path)), path
+        )
         # ADR-24 slice 4a/4 — record unresolved implicit-self calls during the typing pass ONLY (not
         # CheckRules, whose own `type_of` queries would otherwise re-trigger the choke-point).
         # `self_call_misses` feeds the `call.self-undefined-method` collector; the recorder is inert unless
@@ -2045,7 +2594,7 @@ module Rigor
       # output and the plugin diagnostics are then built from that single walk's results.
       def rule_and_plugin_diagnostics(path, parse_result, scope, index, self_call_misses)
         root = parse_result.value
-        node_collectors = CheckRules.build_node_collectors(path, index)
+        node_collectors = CheckRules.build_node_collectors(path, index, root)
         node_results = node_rule_results_by_plugin(path, root, scope, node_collectors, index)
         diagnostics = CheckRules.diagnose(
           path: path,