rigortype 0.4.0 → 0.4.1

data/lib/rigor/analysis/incremental_run_slot.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+require_relative "diagnostic"
+require_relative "path_expansion"
+require_relative "result"
+require_relative "run_cache_key"
+require_relative "../cache/descriptor"
+require_relative "../cache/file_digest"
+require_relative "../cache/store"
+
+module Rigor
+  module Analysis
+    # ADR-45 WD2 (#1507) — the run-result slot `rigor check --incremental` writes, and the engine-free probe that
+    # serves a null run from it. The writer is {IncrementalSession#run_incremental}; the reader is the CLI, before
+    # it loads the inference engine. Both go through this module, so the key, the producer id and the stored shape
+    # have one definition.
+    #
+    # It is ADR-45's record-and-validate slot with a second writer. The value is the diagnostics the session's run
+    # printed (before the baseline filter, which the CLI applies to every answer), and the dependency descriptor
+    # validates everything that answer was computed from:
+    #
+    # - one `:stat` row per analysed file, carrying the digest the SESSION holds for it — the bytes its cached rows
+    #   were computed from — rather than a re-digest taken after the run;
+    # - the rows the run re-read itself ({Runner#incremental_slot_rows}' `observed` and `derived` rows);
+    # - the chain the {Entry} carries forward: the rows the last full run recorded for the inputs the incremental
+    #   path does not re-derive on a recheck, and the plugin reads credited to each file's analysis
+    #   ({IncrementalSession#write_run_slot}).
+    #
+    # A hit is at least as careful as the full incremental path — where that path would notice a change, a row
+    # notices it first — but it is not a cold run: a stale answer that path serves for a read reaching a file
+    # through a plugin's memo (#1553) the probe may serve too. ADR-45 WD2 states the guarantee.
+    #
+    # Kept apart from the plain run's `analysis.run-diagnostics` by its own producer id and by the roots entry its
+    # key adds, either enough alone, so neither probe can ever read the other's entry, and an incremental defect
+    # cannot leak into a default run.
+    #
+    # The key is the one {RunCacheProbe} reconstructs from configuration alone — the library list without a
+    # `rbs.virtual_rbs` slot, and no `template-units` slot — plus the analysis roots ({Target}). Neither left-out
+    # slot is needed. A virtual RBS buffer is a function of an analysed file's bytes (a row) and of the
+    # synthesising plugin's identity and configuration (the key's `configuration`, lockfile and engine slots). A
+    # template unit is a function of its template's bytes and of what its transform read (rows) and of the
+    # plugin's identity and the engine's (key slots), so a project whose plugins claim template globs is served
+    # too. The ADR-87 probe misses on one: the plain slot's key carries the `template-units` slot.
+    #
+    # `explain:` is always false: the session's runners never set it (#1533), and the CLI declines the probe under
+    # `--explain`.
+    module IncrementalRunSlot
+      module_function
+
+      PRODUCER_ID = "analysis.incremental-run-diagnostics"
+
+      # One live generation per analysed-path set, as for the plain slot. A writer that moves the path set discards
+      # the entry it carried from (see {IncrementalSession}), so the churn a file addition makes is bounded without
+      # a compaction pass — the incremental path never runs one.
+      GENERATION_CAP = RunCacheKey::GENERATION_CAP
+
+      # The stored value. `baseline` and `pinned` (each a {Cache::Descriptor}) and `reads` (`{path =>
+      # Cache::Descriptor}`) are the chain the next writer carries forward, kept apart from the rest of the
+      # dependency descriptor so it knows which rows are which; their entries are the same objects the descriptor
+      # holds, so `Marshal` writes them once. `baseline` and `pinned` hold the rows the last full run recorded for
+      # inputs the incremental path does not re-derive on a recheck (the signature tree, the
+      # discovered-not-analysed files, the `pre_eval:` files outside the analysed set), `pinned` the signature
+      # files the key identifies already ({Runner::BaselineRows}); `reads` the plugin reads credited to each
+      # analysed file. `snapshot` is the identity of
+      # the incremental snapshot file the writing run left behind, which the next writer compares against the one
+      # it restored before trusting the chain. `roots` are the analysis roots as the run was given them
+      # ({.as_written}): the key holds them as a set of paths, and the probe serves the entry only to a run that
+      # names them the same way, in the same order.
+      Entry = Data.define(:diagnostics, :roots, :baseline, :pinned, :reads, :snapshot)
+
+      # What a slot is keyed by: the analysed-path set and the analysis roots the run was given. The roots are
+      # not implied by the files — `rigor check --incremental lib extra` with `extra` missing analyses the same
+      # files as `rigor check --incremental lib`, and only the first reports `extra` as missing.
+      Target = Data.define(:files, :roots)
+
+      # What a probe hit hands the CLI: the answer, and the analysed-file count its banner reports.
+      Hit = Data.define(:result, :file_count)
+
+      def key(configuration:, target:)
+        base = RunCacheKey.descriptor(
+          configuration: configuration, files: target.files, explain: false,
+          rbs_config_entries: RunCacheKey.libraries_config_entries(configuration)
+        )
+        return nil if base.nil?
+
+        roots = RunCacheKey.config_entry("incremental.roots", normalize_roots(target.roots).sort.join("\n"))
+        Cache::Descriptor.new(gems: base.gems, configs: base.configs + [roots])
+      end
+
+      # The roots as absolute paths, which the KEY holds sorted: `lib`, `./lib` and `lib/` are one root there. A
+      # run that reorders its roots still finds the previous slot's chain (the snapshot fingerprint sorts them
+      # too), and one that respells them replaces the slot rather than adding one beside it.
+      def normalize_roots(roots)
+        Array(roots).map { |root| File.absolute_path(root.to_s) }
+      end
+
+      # The roots as the run was given them, which {Entry#roots} holds and {.serve} compares. A missing root is
+      # reported as written (`./extra: no such file or directory`), and `a b` lists `a`'s files before `b`'s, so
+      # neither a respelling nor a reordering may be served another's answer.
+      def as_written(roots)
+        Array(roots).map(&:to_s)
+      end
+
+      # The engine-free probe. Returns a {Hit} when the slot for this run's analysed-path set validates, or nil to
+      # decline: a miss, a stale row, an unreadable entry, a project with effect collection on (see below), or any
+      # failure at all — declining hands the run to the full path, which is always safe.
+      #
+      # Effect collection is declined here and never written by the session. Its configuration (`effects:`) is
+      # deliberately absent from `Configuration#to_h` and so from the key, and two of its rows are judged each run
+      # from state no engine-free path can rebuild (the plain probe's `envelope_lane_live?`, #428). With it off,
+      # the only effect row a run can print is `effect.annotations-unchecked`, which is a function of the
+      # signature tree and the analysed files' annotations — both validated rows — so it is served as stored.
+      def serve(configuration:, cache_root:, paths:)
+        return nil if configuration.effects_enabled?
+
+        files = PathExpansion.ruby_files(paths, configuration.exclude_patterns)
+        slot_key = key(configuration: configuration, target: Target.new(files: files, roots: paths))
+        return nil if slot_key.nil?
+
+        entry = validated_entry(configuration, cache_root, slot_key)
+        return nil unless entry.is_a?(Entry) && entry.diagnostics.is_a?(Array)
+        return nil unless entry.roots == as_written(paths)
+
+        Hit.new(result: Result.new(diagnostics: entry.diagnostics, stats: nil), file_count: files.size)
+      rescue StandardError
+        nil
+      end
+
+      # The previous slot's {Entry}, read WITHOUT validating it: it is stale by construction, since the run that
+      # is asking changed something. nil when there is no such slot, or it is not an {Entry} — the writer then
+      # skips its own write rather than guess what the files it served from cache depended on.
+      def previous_entry(store:, configuration:, target:)
+        slot_key = key(configuration: configuration, target: target)
+        return nil if slot_key.nil?
+
+        entry = store.peek_unvalidated(producer_id: PRODUCER_ID, key_descriptor: slot_key)
+        return nil unless entry.is_a?(Entry) && entry.reads.is_a?(Hash)
+        return nil unless entry.baseline.is_a?(Cache::Descriptor) && entry.pinned.is_a?(Cache::Descriptor)
+
+        entry
+      end
+
+      # Writes `entry` as the slot for `target`, validated by `dependencies` (the whole descriptor, of which the
+      # entry's chain is a part). Returns whether it wrote.
+      def write(store:, configuration:, target:, entry:, dependencies:)
+        slot_key = key(configuration: configuration, target: target)
+        return false if slot_key.nil?
+
+        store.store_validated(
+          producer_id: PRODUCER_ID, key_descriptor: slot_key, generation_cap: GENERATION_CAP,
+          value: entry, dependencies: dependencies
+        )
+      end
+
+      def discard(store:, configuration:, target:)
+        slot_key = key(configuration: configuration, target: target)
+        slot_key && store.discard(producer_id: PRODUCER_ID, key_descriptor: slot_key)
+      end
+
+      # Validation runs in its own per-run digest scope, with the configuration's `cache.validation` mode, exactly
+      # as the plain probe's does.
+      def validated_entry(configuration, cache_root, slot_key)
+        store = Cache::Store.new(root: cache_root, max_bytes: configuration.cache_max_bytes)
+        Cache::FileDigest.with_run(strict: configuration.cache_validation_strict?) do
+          store.peek_validated(producer_id: PRODUCER_ID, key_descriptor: slot_key)
+        end
+      end
+      private_class_method :validated_entry
+    end
+  end
+end

data/lib/rigor/analysis/incremental_session.rb

@@ -2,7 +2,10 @@
 
 require "digest"
 require_relative "incremental"
+require_relative "incremental_run_slot"
+require_relative "incremental_run_slot/write_guard"
 require_relative "plugin_fact_fingerprint"
+require_relative "source_rbs_gate"
 require_relative "../cache/file_digest"
 require_relative "../cache/incremental_snapshot"
 require_relative "../effects/file_collection"
@@ -22,10 +25,11 @@ module Rigor
     # only `ΔF ∪ dependents[ΔF]`, and serves every other analyzed file from the cache — the body tier.
     #
     # The invariant the verify harness (and the spec) assert: `#recheck`'s merged diagnostics are
-    # byte-identical (as a sorted set) to a full `--no-cache` re-analysis of the edited tree. This is the
-    # `--verify-incremental` acceptance gate, here without disk persistence or CLI wiring (the cache is
-    # in-process). It models the body tier only: an edit that adds / removes / moves a *file* is outside
-    # the analyzed set it maintains and falls to a fresh {#baseline} (the structural tier is a later slice).
+    # byte-identical to a full `--no-cache` re-analysis of the edited tree, in the same order (#1524; the gate
+    # itself compares sorted sets). This is the `--verify-incremental` acceptance gate, here without disk
+    # persistence or CLI wiring (the cache is in-process). It models the body tier only: an edit that adds /
+    # removes / moves a *file* is outside the analyzed set it maintains and falls to a fresh {#baseline} (the
+    # structural tier is a later slice).
     # The class-length budget is relaxed: this is one cohesive orchestrator of the incremental state
     # (per-file diagnostics cache, the file-level / symbol-level / negative dependency graphs, and the ADR-85
     # seed bundles), clearer read together than split across micro-classes that would all share the same ivars.
@@ -159,6 +163,7 @@ module Rigor
       # Full baseline analysis with recording. Returns the run's diagnostics; populates the in-process cache
       # + dependency state.
       def baseline
+        @slot_carried_from = nil # ADR-45 WD2 — see {#load_snapshot}
         runner = build_runner(record_dependencies: true)
         diagnostics = run_runner(runner).diagnostics
         @last_runner = runner # ADR-88 WD1 — the post-hoc fact-surface fingerprint reads this prepared registry.
@@ -167,7 +172,9 @@ module Rigor
         # must never read as a file that VANISHED from the project on the next recheck (which is what
         # `previous - current` would say, `current_files` being a `.rb` expansion).
         @analyzed = runner.analyzed_files - runner.template_unit_paths
-        @seed_bundles = runner.seed_bundles # ADR-85 WD2 — the freshly built bundle set for the next run.
+        # ADR-85 WD2 — the freshly built bundle set for the next run, each stamped with its file's source-RBS
+        # digest (issue #1536).
+        @seed_bundles = source_rbs_gate.stamp(runner.seed_bundles, whole_project: true)
         absorb_dependency_graph(runner)
         @return_summaries = runner.return_summaries # ADR-89 WD2 — the full-run behavioural surface.
         # ADR-67 WD6c lift — the seed table the runner's own pre-pass computed ({} when the gate is off).
@@ -178,6 +185,7 @@ module Rigor
         @effects_identity = current_effects_identity
         @cache = per_file(runner.per_file_diagnostics)
         @digests = @analyzed.to_h { |path| [path, pack_digest(path)] }
+        forget_unbound_digests
         @run_level_rows = runner.run_level_rows
         diagnostics
       end
@@ -199,15 +207,16 @@ module Rigor
         param_files, param_pairs = param_seed_invalidation(fresh_params)
         affected = affected_closure(changed, added, removed, param_files, param_pairs)
         analyze_set = affected & current
+        reused = (current & previous) - affected.to_a
         # The freshly collected table is handed to the runner so the run seeds from the SAME table the diff
-        # was decided on (and the collector runs once per recheck, not twice).
+        # was decided on (and the collector runs once per recheck, not twice). The reused files' cached rows
+        # go in too, so the runner lists them in the full run's file order (#1524).
         runner = build_runner(analyze_only: analyze_set, record_dependencies: true,
                               param_inferred_types: fresh_params,
-                              restored_run_level_rows: @run_level_rows)
-        fresh = run_runner(runner).diagnostics
+                              restored_run_level_rows: @run_level_rows,
+                              served_per_file_diagnostics: @cache.slice(*reused))
+        merged = run_runner(runner).diagnostics
         @last_runner = runner # ADR-88 WD1 — the post-hoc fact-surface fingerprint reads this prepared registry.
-        reused = (current & previous) - affected.to_a
-        merged = fresh + reused.flat_map { |path| @cache[path] || [] }
         absorb(runner, current, analyze_set, removed)
         @param_table = fresh_params
         Recheck.new(diagnostics: merged, changed: changed.to_set, added: added.to_set,
@@ -235,6 +244,7 @@ module Rigor
           # stale. A full baseline is the sound answer for `--incremental`, but in editor mode it is also the
           # latency this mode exists to avoid, so decline and let the caller drop to single-file scope.
           break nil unless @plugin_fact_reusable.reusable_against?(restored.plugin_fact_digest)
+          break nil if source_rbs_unverified?(result)
 
           result
         end
@@ -253,7 +263,20 @@ module Rigor
       # return exactly the way a body edit does, so it reuses the same audited dependents machinery. The
       # pairs join AFTER the ADR-89 WD2 behavioural-stability pruning: that gate re-evaluates returns under
       # the snapshot's OLD seeds, which is the wrong oracle for a pair whose seeds are the thing that moved.
+      #
+      # Issue #1536 (ADR-89 WD1 amendment) — every gate in {#gated_closure} reads the RUBY side of a file. What a
+      # source-RBS synthesizer derives from its comments reaches the environment as a `virtual:` buffer, and a
+      # reader of that RBS records no edge to the file it came from (an `attr_reader :name #: String` consumer
+      # records none at all), so no dependent set can bound who read it. An edit that moved it re-analyses the
+      # whole project — what a `sig/` edit already costs through the snapshot fingerprint.
       def affected_closure(changed, added, removed, param_files = Set.new, param_pairs = Set.new)
+        return whole_project_closure(changed, added) if source_rbs_gate.moved?(@seed_bundles, changed, added, removed)
+
+        gated_closure(changed, added, removed, param_files, param_pairs)
+      end
+
+      # {#affected_closure} for an edit whose synthesized RBS is byte-identical in every file it touched.
+      def gated_closure(changed, added, removed, param_files, param_pairs)
         scan = changed + added
         # Parse the changed / added set ONCE for the per-symbol fingerprints, the class declarations, AND the
         # ADR-89 WD1 declaration signatures. They were separate `discovered_def_index_for_paths` passes over
@@ -396,13 +419,11 @@ module Rigor
       # dependents skippable) when its current {ScopeIndexer.declaration_signature} matches the one stored in
       # the snapshot's seed bundle — i.e. its edit changed no method signature, visibility, ancestry, member
       # layout, def line, or method existence, so every cross-file DECLARATION fact its dependents consume is
-      # unchanged. Falls back to treating EVERY changed file as unstable (today's full closure) when a
-      # comment-ingesting plugin is loaded — such a plugin reads the very comments the signature ignores, so a
-      # comment edit it treats as a no-op could change a cross-file type. Sorbet sigs / dry-types includes are
-      # CODE, captured by ADR-88's plugin-fact fingerprint (WD3), so only comment-as-input plugins escape here.
+      # unchanged. The signature reads code, not comments; the other half of stability — that no source-RBS
+      # synthesizer's output for the file moved — is settled before this runs ({SourceRbsGate#moved?}), so every
+      # file reaching here has a byte-identical synthesized contribution. Sorbet sigs / dry-types includes are
+      # CODE, captured by ADR-88's plugin-fact fingerprint (WD3).
       def declaration_unstable(changed, declaration_signatures)
-        return changed if comment_ingesting_plugin_loaded?
-
         changed.reject { |path| declaration_stable?(path, declaration_signatures[path]) }
       end
 
@@ -415,14 +436,11 @@ module Rigor
         bundle[:declaration_signature] == current_declaration_signature
       end
 
-      def comment_ingesting_plugin_loaded?
-        # Mirrors the plugin loader's gem-name resolution (`ProjectPrePasses#trusted_gem_name`): a String
-        # entry IS the gem name; a Hash entry names it under `"gem"` (or the manifest `"id"`).
-        @configuration.plugins.any? do |entry|
-          name = entry.is_a?(Hash) ? (entry["gem"] || entry["id"]) : entry
-          COMMENT_INGESTING_PLUGIN_IDS.include?(name.to_s)
-        end
+      # Every file this recheck can analyse: the removed ones drop out at `affected & current`.
+      def whole_project_closure(changed, added)
+        (@analyzed.to_set | changed | added).freeze
       end
+      private :gated_closure, :whole_project_closure
 
       # The current project file set (cheap directory expansion, no analysis), used to detect files added /
       # removed since the last run. Also where an editor buffer's binding is re-spelled onto the set, since
@@ -441,13 +459,13 @@ module Rigor
       # mutating session state. Returns the merged diagnostics.
       def reanalyze_subset(subset)
         affected = subset.to_set
+        reused = @analyzed - affected.to_a
         # ADR-67 WD6c lift — seed the subset run from the baseline's own table so the verification engine
         # exercises the exact seeds the served cache entries were computed under (and skips a re-collect).
         runner = build_runner(analyze_only: affected, param_inferred_types: @param_table,
-                              restored_run_level_rows: @run_level_rows)
-        fresh = run_runner(runner).diagnostics
-        reused = @analyzed - affected.to_a
-        fresh + reused.flat_map { |path| @cache[path] || [] }
+                              restored_run_level_rows: @run_level_rows,
+                              served_per_file_diagnostics: @cache.slice(*reused))
+        run_runner(runner).diagnostics
       end
 
       # Cross-process incremental run (the `--incremental` flag's engine). With a disk `snapshot` whose
@@ -468,7 +486,7 @@ module Rigor
         # shares one digest memo across change detection and the baseline/absorb re-pack. The inner
         # `Runner#run` nests its own `with_run` for the analysis descriptors; nesting is safe (each restores).
         Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
-          restored = fingerprint && snapshot.load(fingerprint: fingerprint)
+          restored = load_snapshot(snapshot, fingerprint)
           # ADR-88 WD1 — the plugin fact-surface fingerprint gates snapshot reuse the same way the global
           # fingerprint gates the load: a plugin sig/catalog edit outside `signature_paths:` (a Sorbet `.rbi`)
           # changes the types unchanged call sites resolve, without moving any analyzed file, so the global
@@ -489,7 +507,7 @@ module Rigor
             result = recheck
             adopt_plugin_fact_fingerprint
             fact_reusable = @plugin_fact_reusable.reusable_against?(restored.plugin_fact_digest)
-            if fact_reusable && effects_reusable
+            if fact_reusable && effects_reusable && !source_rbs_unverified?(result)
               diagnostics = result.diagnostics
               warm = true
               # ADR-87 WD3 — a warm recheck that changed nothing leaves the session state byte-equivalent to the
@@ -497,9 +515,10 @@ module Rigor
               # A cold baseline always persists — there was no valid snapshot to reuse.
               skip_save = result.no_change?
             else
-              # The fact surface moved (a plugin sig/catalog edit), a plugin is opaque, or the effects
-              # identity moved: the cached-served files the recheck merged may be stale (or, for effects, a
-              # partial collection cannot be closed), so re-analyze the whole tree. The current fact-surface
+              # The fact surface moved (a plugin sig/catalog edit), a plugin is opaque, the effects identity
+              # moved, or a synthesizer the source-RBS gate could not see was loaded (#1536): the cached-served
+              # files the recheck merged may be stale (or, for effects, a partial collection cannot be closed),
+              # so re-analyze the whole tree. The current fact-surface
               # digest (from the recheck runner) is unchanged by the re-analysis, so it is kept for the save.
               # Only a genuine fact-surface reason sets the reporting flag the CLI banner reads.
               @fact_surface_invalidated = true unless fact_reusable
@@ -513,7 +532,7 @@ module Rigor
             warm = false
             skip_save = false
           end
-          snapshot.save(fingerprint: fingerprint, payload: to_payload) if persist && fingerprint && !skip_save
+          persist_run(snapshot, fingerprint, diagnostics, skip_save: skip_save) if persist && fingerprint
           [diagnostics, warm]
         end
       end
@@ -538,11 +557,41 @@ module Rigor
 
       # ADR-88 WD1 — capture this invocation's fact-surface fingerprint (from the last analysis runner) onto the
       # reporting ivars + the `@plugin_fact_reusable` decision object.
+      #
+      # Issue #1536 — the same prepared registry settles whether the synthesizers the session digested with
+      # are the ones the run's environment was built from ({SourceRbsGate#verify}). A plugin that builds its
+      # synthesizer in `#prepare` leaves the gate untrusted, and every stored digest is stamped unknown before
+      # the snapshot is saved.
       def adopt_plugin_fact_fingerprint
-        fact = compute_plugin_fact_fingerprint
+        registry = prepared_plugin_registry
+        fact = compute_plugin_fact_fingerprint(registry)
         @plugin_fact_digest = fact.digest
         @opaque_plugin_ids = fact.opaque_plugin_ids
         @plugin_fact_reusable = fact
+        @seed_bundles = source_rbs_gate.verify(registry, @seed_bundles)
+      end
+
+      # Issue #1536 — a recheck of an edit whose closure left some file out may have under-read a synthesizer
+      # the gate could not see. {#run_incremental} re-analyses the project and {#run_buffer_recheck} declines,
+      # the way each treats a moved plugin fact surface. A run that changed nothing is exempt: under an
+      # untrusted gate every earlier edit already re-analysed the whole project, so the snapshot it serves is
+      # whole, and a null run stays one.
+      def source_rbs_unverified?(result)
+        source_rbs_gate.untrusted? && !result.no_change? && !result.reused.empty?
+      end
+
+      # Issue #1536 — a file the gate could not stamp because it was saved after the closure was decided (its
+      # readers' cached answers predate that save) must read as changed on the next run, where its unknown
+      # stamp sends the edit to the whole project. Recording its post-save content digest would hide it.
+      def forget_unbound_digests
+        source_rbs_gate.unbound.each { |path| @digests.delete(path) }
+      end
+
+      # Issue #1536 — decides whether an edit moved synthesized RBS, and stamps each seed bundle's digest. One
+      # per session: its untrusted state must outlive every run the session makes.
+      def source_rbs_gate
+        @source_rbs_gate ||= SourceRbsGate.new(configuration: @configuration, cache_store: @cache_store,
+                                               plugin_requirer: @plugin_requirer)
       end
 
       # ADR-88 WD1 — the plugin fact-surface fingerprint for this invocation. For a SEQUENTIAL run it is read
@@ -551,17 +600,195 @@ module Rigor
       # published facts — there it falls back to the always-sequential probe. Both paths compute the identical
       # digest for a given fact surface, so the reuse decision is worker-count-independent (the parity spec
       # asserts this).
-      def compute_plugin_fact_fingerprint
+      def compute_plugin_fact_fingerprint(registry = prepared_plugin_registry)
+        PluginFactFingerprint.from_registry(registry)
+      end
+
+      # The registry the run's environment was built from, after `#prepare`: the analysis runner's own on a
+      # sequential run, the always-sequential probe's on a pooled one (nil when the probe fails).
+      def prepared_plugin_registry
         registry = @last_runner&.plugin_registry
-        if @workers.zero? && registry && !registry.empty?
-          PluginFactFingerprint.from_registry(registry)
-        else
-          PluginFactFingerprint.compute(
-            configuration: @configuration, cache_store: @cache_store, plugin_requirer: @plugin_requirer
-          )
+        return registry if @workers.zero? && registry && !registry.empty?
+
+        PluginFactFingerprint.prepared_registry(
+          configuration: @configuration, cache_store: @cache_store, plugin_requirer: @plugin_requirer
+        )
+      end
+
+      # Loads the snapshot, noting (ADR-45 WD2) which write of the file it read: the identity is kept only when
+      # the file was the same before and after the read, since a rewrite in between leaves no telling which one
+      # the payload came from.
+      def load_snapshot(snapshot, fingerprint)
+        @slot_guard = start_slot_guard(fingerprint)
+        before = snapshot_identity(snapshot)
+        restored = fingerprint && snapshot.load(fingerprint: fingerprint)
+        @restored_snapshot_identity = restored && before == snapshot_identity(snapshot) ? before : nil
+        # The path set the previous run-result slot is keyed by, for a recheck to carry its chain from; a
+        # {#baseline} clears it, since a full run starts a chain of its own.
+        @slot_carried_from = restored&.analyzed
+        restored
+      end
+
+      # ADR-87 WD3 — a warm recheck that changed nothing skips the snapshot rewrite: the file it restored is still
+      # the one on disk, which is what the run-result slot records as its snapshot.
+      def persist_run(snapshot, fingerprint, diagnostics, skip_save:)
+        written = if skip_save
+                    @restored_snapshot_identity
+                  elsif snapshot.save(fingerprint: fingerprint, payload: to_payload)
+                    snapshot_identity(snapshot)
+                  end
+        write_run_slot(diagnostics, written_identity: written)
+      end
+
+      # ADR-45 WD2 (#1507) — records this run's answer as the run-result slot a later `rigor check --incremental`
+      # serves without loading the engine ({IncrementalRunSlot}). The slot's dependency descriptor must validate
+      # what the answer was computed from, and after a narrowed recheck most of the answer was computed by earlier
+      # runs, so it is assembled from three sources:
+      #
+      # - the analysed files, at the digest this session holds for each: the bytes its cached or fresh rows were
+      #   computed from, never a re-digest taken after the fact;
+      # - what this run read and re-derives every run ({Runner#incremental_slot_rows}' `observed` and `derived`
+      #   rows);
+      # - the CHAIN: the rows the last full run recorded for inputs a recheck does not re-derive
+      #   ({Runner#baseline_dependency_rows}), and the plugin reads credited to each file's analysis. A full run
+      #   starts a chain; a recheck takes the previous slot's, replaces the reads of every file it re-analysed with
+      #   this run's, and drops the removed files'.
+      #
+      # A recheck writes only when the previous slot exists and was written against the very snapshot file it
+      # restored: otherwise some run in between — a pool run, `--no-cache`, a write that failed — analysed files
+      # without recording their reads, and the chain cannot vouch for them. It then writes nothing, and the next
+      # full run starts a fresh chain. Declining to write is always safe; it only leaves the next null run on the
+      # full path.
+      #
+      # Every row not recorded as a plugin read it must still describe the tree the run read
+      # ({IncrementalRunSlot::WriteGuard}): the analysed files' (whose session digest a full run takes after its
+      # analysis), the `derived` rows, and the chain's baseline, taken now or carried ({#guarded_rows}).
+      #
+      # @param written_identity — the snapshot file as this run leaves it, recorded for the next writer's check.
+      def write_run_slot(diagnostics, written_identity:)
+        return unless run_slot_writable?
+
+        roots = @paths || @configuration.paths
+        rows = @last_runner.incremental_slot_rows(roots: roots)
+        chain = rows && (@slot_carried_from ? carry_chain(rows, roots) : start_chain(rows))
+        analysed = chain && analysed_file_rows
+        return if analysed.nil?
+
+        baseline, pinned, reads = chain
+        return unless @slot_guard&.admits?(guarded_rows(analysed, rows.derived, baseline), pinned: pinned)
+
+        # A save the run read after the mark's tick must not hide behind an unmoved stat tuple.
+        reads = reads.transform_values { |descriptor| @slot_guard.mark_racy(descriptor) }
+
+        entry = IncrementalRunSlot::Entry.new(
+          diagnostics: diagnostics, roots: IncrementalRunSlot.as_written(roots),
+          baseline: baseline, pinned: pinned, reads: reads, snapshot: written_identity
+        )
+        dependencies = @slot_guard.mark_racy(run_slot_dependencies(analysed, rows, [baseline, pinned], reads.values))
+        wrote = IncrementalRunSlot.write(
+          store: @cache_store, configuration: @configuration, entry: entry, dependencies: dependencies,
+          target: IncrementalRunSlot::Target.new(files: @analyzed, roots: roots)
+        )
+        discard_previous_slot(roots) if wrote
+      rescue StandardError
+        nil
+      end
+
+      # The previous slot is keyed by the previous path set; once this run's stands, nothing asks for it again.
+      def discard_previous_slot(roots)
+        return if @slot_carried_from.nil? || @slot_carried_from.sort == @analyzed.sort
+
+        IncrementalRunSlot.discard(
+          store: @cache_store, configuration: @configuration,
+          target: IncrementalRunSlot::Target.new(files: @slot_carried_from, roots: roots)
+        )
+      end
+
+      # ADR-45 WD2 — the mark {IncrementalRunSlot::WriteGuard#admits?} checks the slot's rows against, taken before
+      # the run reads anything. nil (no slot this run) for a store no slot is written to, or no fingerprint.
+      def start_slot_guard(fingerprint)
+        return nil if fingerprint.nil? || @cache_store.nil? || @cache_store.read_only? || !@buffer.nil?
+        # Known before the run: none of these can be written afterwards, so the stamp and the recomputed
+        # fingerprint would be spent for nothing.
+        return nil unless @workers.zero? && !@configuration.effects_enabled?
+
+        IncrementalRunSlot::WriteGuard.start(
+          configuration: @configuration, roots: @paths || @configuration.paths, cache_root: @cache_store.root,
+          fingerprint: fingerprint
+        )
+      end
+
+      # The runs whose answer the slot may hold: a writable store, no editor buffer (whose bytes exist only in
+      # the editor), a sequential run (a pool worker's plugin reads never reach this process), effect collection
+      # off ({IncrementalRunSlot.serve} declines it), and no opaque plugin — the next full-path run would then be
+      # cold, not the warm run the probe stands in for.
+      def run_slot_writable?
+        !@cache_store.nil? && !@cache_store.read_only? && @buffer.nil? && @workers.zero? &&
+          !@configuration.effects_enabled? && @opaque_plugin_ids.empty? && !@last_runner.nil?
+      end
+
+      def start_chain(rows)
+        baseline = @last_runner.baseline_dependency_rows(files: @analyzed)
+        baseline && [baseline.owned, baseline.pinned, rows.by_file.slice(*@analyzed)]
+      end
+
+      def carry_chain(rows, roots)
+        return nil if @restored_snapshot_identity.nil?
+
+        previous = IncrementalRunSlot.previous_entry(
+          store: @cache_store, configuration: @configuration,
+          target: IncrementalRunSlot::Target.new(files: @slot_carried_from, roots: roots)
+        )
+        return nil if previous.nil? || previous.snapshot != @restored_snapshot_identity
+
+        served = previous.reads.except(*@last_runner.analyzed_files)
+        [previous.baseline, previous.pinned, served.merge(rows.by_file).slice(*@analyzed)]
+      end
+
+      # One `:stat` row per analysed file, from the entry this session recorded for it (`#pack_digest`), re-packed
+      # against the file's current stat when the bytes still hash to the recorded digest but the tuple moved (a
+      # `touch`, a checkout): the snapshot keeps the old tuple, and a row carrying it would cost every later probe
+      # a re-hash of the file. nil when any file has no usable entry (it could not be read): no row could say what
+      # its answer was computed from.
+      def analysed_file_rows
+        @analyzed.map do |path|
+          packed = Cache::FileDigest.refresh_stat(path, @digests[path])
+          return nil if packed.nil?
+
+          Cache::Descriptor::FileEntry.new(path: path, comparator: :stat, value: packed)
         end
       end
 
+      # @param chained — the chain's baseline descriptors, owned and pinned
+      def run_slot_dependencies(analysed, rows, chained, reads)
+        carried = chained + reads
+        Cache::Descriptor.new(
+          files: analysed + rows.derived.files + rows.observed.files + carried.flat_map(&:files),
+          globs: (rows.derived.globs + rows.observed.globs + carried.flat_map(&:globs)).uniq
+        )
+      end
+
+      # What the write guard asks about besides the pinned baseline: every row the key does not pin that was not
+      # recorded as a plugin read it. A recheck's carried baseline is among them. The run that took it vouched for
+      # the tree it saw, but this run reads those inputs again (a recheck with a non-empty closure rebuilds its
+      # environment from the signature tree), and a save it read that is reverted before the run ends leaves every
+      # carried row fresh while the answer came from the saved bytes.
+      def guarded_rows(analysed, derived, baseline)
+        Cache::Descriptor.new(files: analysed + derived.files + baseline.files, globs: derived.globs + baseline.globs)
+      end
+
+      # The snapshot file's `(size, mtime_ns, ctime_ns, inode)`: which write of it a run restored, or left behind.
+      # A rewrite renames a new file into place, so any write moves it. nil when there is no file to stat.
+      def snapshot_identity(snapshot)
+        path = snapshot.respond_to?(:path) ? snapshot.path : nil
+        return nil if path.nil?
+
+        stat = File.stat(path)
+        [stat.size, Cache::FileDigest.ns_of(stat.mtime), Cache::FileDigest.ns_of(stat.ctime), stat.ino]
+      rescue SystemCallError
+        nil
+      end
+
       # Adopt a persisted snapshot's per-file state as this session's baseline (the warm-start path).
       def restore(payload)
         @analyzed = payload.analyzed
@@ -723,13 +950,16 @@ module Rigor
         removed.each { |path| forget(path) }
         @analyzed = current
         # ADR-85 WD2 — the recheck's discovery folded the restored bundles and refreshed them (changed files
-        # re-walked, removed files dropped, added files built), so adopt the runner's current set wholesale.
-        @seed_bundles = runner.seed_bundles
+        # re-walked, removed files dropped, added files built), so adopt the runner's current set wholesale,
+        # stamping the re-walked ones with their source-RBS digest (issue #1536).
+        whole_project = current.all? { |path| analyze_set.include?(path) }
+        @seed_bundles = source_rbs_gate.stamp(runner.seed_bundles, whole_project: whole_project)
         fresh_by_file = per_file(runner.per_file_diagnostics)
         analyze_set.each do |path|
           @cache[path] = fresh_by_file[path] || []
           @digests[path] = pack_digest(path)
         end
+        forget_unbound_digests
         absorb_dependency_graph(runner)
         # Issues #796 / #794 — the recheck's own snapshots already carry the replayed rows folded together
         # with anything its closure demanded for itself, so this is the same union the next run replays.
@@ -1017,12 +1247,6 @@ module Rigor
       TOP_LEVEL_KEY = Inference::ScopeIndexer::TOP_LEVEL_DEF_KEY
       private_constant :TOP_LEVEL_KEY
 
-      # B1 — plugin require-names that ingest COMMENT content as semantic input (inline-RBS reads `# @rbs` /
-      # `#:` annotations). B1's code fingerprint ignores comments, so a project configuring one of these opts
-      # OUT of the bundle-equality skip (a comment edit could change a cross-file type it contributes).
-      COMMENT_INGESTING_PLUGIN_IDS = %w[rigor-rbs-inline].freeze
-      private_constant :COMMENT_INGESTING_PLUGIN_IDS
-
       def negative_key_for(symbol)
         class_name, method = symbol.split("#", 2)
         class_name == TOP_LEVEL_KEY ? "toplevel:#{method}" : "method:#{symbol}"