rigortype 0.4.0 → 0.4.1

data/lib/rigor/analysis/source_rbs_gate.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Rigor
+  module Analysis
+    # Issue #1536 (ADR-89 WD1 amendment) — what the incremental session knows about the RBS that source-RBS
+    # synthesizers derive from each file's comments. The declaration gates read a file's Ruby side only; a
+    # synthesizer's output reaches the environment as a `virtual:` buffer, and a reader of that RBS records no
+    # edge back to the file, so the session asks this gate one question before deciding a closure: did the
+    # edit move any synthesized output? A yes re-analyses the whole project.
+    #
+    # Each seed bundle carries its file's {Environment::SourceRbsSynthesis.digest} under {DIGEST_KEY}. The
+    # gate writes it ({#stamp}), not the scope indexer that builds the rest of the bundle: the digest needs a
+    # plugin registry, which discovery never sees. A stamp must describe the synthesized RBS the cached
+    # diagnostics of the file's readers were computed under; where that cannot be vouched for, it is nil, which
+    # reads as moved.
+    #
+    # The synthesizers are read from a registry the gate loads for itself, WITHOUT `#prepare`, because the
+    # closure is decided before the recheck runner (which loads and prepares its own) exists. That is exact
+    # only for a synthesizer reachable without `#prepare`, so {#verify} compares the two sets after every run:
+    # a plugin that builds its synthesizer in `#prepare` leaves the gate UNTRUSTED for the rest of the
+    # session — every stored digest reads as unknown, and every edit re-analyses the whole project.
+    class SourceRbsGate
+      DIGEST_KEY = :source_rbs_digest
+
+      # The paths {#stamp} last stored as unknown because the bytes its bundle was built from are not the
+      # bytes the closure was decided on. The session forgets their recorded content digests, so the next run
+      # detects them as changed and, reading the unknown stamp, re-analyses the project.
+      attr_reader :unbound
+
+      def initialize(configuration:, cache_store:, plugin_requirer:)
+        @configuration = configuration
+        @cache_store = cache_store
+        @plugin_requirer = plugin_requirer
+        @synthesizers = nil
+        @readings = nil
+        @unbound = Set.new.freeze
+        @untrusted = false
+      end
+
+      # True once a run's prepared registry declared a different synthesizer set from the one the gate
+      # digests with. Sticky for the session: the configuration, and so the plugin set, is fixed for its life.
+      def untrusted?
+        @untrusted
+      end
+
+      # Whether this edit moved what any synthesizer contributes: a changed file whose digest differs from
+      # the one on its snapshot bundle (or either is unknown), an added file that contributes anything, or a
+      # removed file that did. Decided from the synthesizers' output, never from which plugins `plugins:`
+      # names. The readings taken here are kept for {#stamp}.
+      def moved?(bundles, changed, added, removed)
+        return true if @untrusted && [changed, added, removed].any?(&:any?)
+
+        @readings = (changed + added).to_h { |path| [path, reading(path)] }
+        none = Environment::SourceRbsSynthesis::NO_CONTRIBUTION
+        changed.any? { |path| !unmoved?(bundles, path) } ||
+          added.any? { |path| @readings.fetch(path).last != none } ||
+          removed.any? { |path| stored(bundles, path) != none }
+      end
+
+      # Stamps every bundle that needs a digest: one the runner built this run (a baseline's all, a recheck's
+      # re-walked ones), and one carrying nil that this run can now vouch for. A bundle the runner reused keeps
+      # the digest it carries, which stays exact because a bundle is reused only for byte-identical content.
+      #
+      # A digest is vouched for only by a reading of the bytes the bundle was built from: the reading
+      # {#moved?} took when the closure was decided, or, when `whole_project` (every file was just
+      # re-analysed), one taken now. Anything else is stamped nil and listed in {#unbound}; a file saved after
+      # the closure was decided is never re-read, because its readers' cached answers predate that save. An
+      # untrusted gate stamps every bundle unknown.
+      def stamp(bundles, whole_project: false)
+        readings = @readings || {}
+        @readings = nil
+        @unbound = Set.new
+        return distrust(bundles) if @untrusted
+
+        targets = bundles.select { |path, bundle| stamp?(bundle, whole_project || readings.key?(path)) }
+        return bundles if targets.empty?
+
+        stamped = bundles.dup
+        targets.each do |path, bundle|
+          stamped[path] = bundle.merge(DIGEST_KEY => bound_digest(path, bundle, readings[path], whole_project))
+        end
+        stamped
+      end
+
+      # Compares, by plugin id and order, the synthesizers the gate digests with against those of
+      # `prepared_registry` — the registry the run's environment was built from, after `#prepare` (nil when
+      # it could not be built, which also distrusts). Runs after every run, a run that digested nothing
+      # included: a stamp written by an earlier process from the other set would otherwise be trusted. On a
+      # mismatch the gate turns untrusted and every bundle is stamped unknown. Returns the bundles to keep.
+      def verify(prepared_registry, bundles)
+        return bundles if synthesizer_ids(prepared_registry&.source_rbs_synthesizers) == synthesizer_ids(synthesizers)
+
+        @untrusted = true
+        distrust(bundles)
+      end
+
+      private
+
+      def unmoved?(bundles, path)
+        before = stored(bundles, path)
+        !before.nil? && before == @readings.fetch(path).last
+      end
+
+      def stored(bundles, path)
+        bundles[path]&.fetch(DIGEST_KEY, nil)
+      end
+
+      def distrust(bundles)
+        bundles.transform_values { |bundle| bundle.merge(DIGEST_KEY => nil) }
+      end
+
+      # A bundle without a digest always needs one; one carrying nil is re-stamped only when this run can
+      # vouch for it, so an unknown stamp left by a distrust or an unbound read clears on the file's next edit
+      # or the next whole-project run.
+      def stamp?(bundle, vouched)
+        !bundle.key?(DIGEST_KEY) || (bundle[DIGEST_KEY].nil? && vouched)
+      end
+
+      # The digest for `bundle` when a reading vouches for the bytes it was built from, else nil (and the path
+      # joins {#unbound}).
+      def bound_digest(path, bundle, reading, whole_project)
+        reading ||= reading(path) if whole_project
+        return reading.last if reading && reading.first == bundle[:digest]
+
+        @unbound << path
+        nil
+      end
+
+      # `[content SHA-256, digest]`, the SHA nil unless the file read the same before and after the digest was
+      # taken, so the pair can be matched against a bundle's content digest.
+      def reading(path)
+        before = content_sha(path)
+        digest = Environment::SourceRbsSynthesis.digest(synthesizers, path, @cache_store)
+        [before && before == content_sha(path) ? before : nil, digest]
+      end
+
+      def content_sha(path)
+        Digest::SHA256.file(path).hexdigest
+      rescue SystemCallError
+        nil
+      end
+
+      def synthesizers
+        @synthesizers ||= Runner::ProjectPrePasses.new(
+          configuration: @configuration, cache_store: @cache_store, buffer: nil,
+          plugin_requirer: @plugin_requirer, pool_mode: -> { false }
+        ).prepared_registry(prepare: false).source_rbs_synthesizers
+      end
+
+      def synthesizer_ids(pairs)
+        pairs&.map { |plugin, _| plugin.manifest.id.to_s }
+      end
+    end
+  end
+end

data/lib/rigor/analysis/template_unit_paths.rb

@@ -21,13 +21,15 @@ module Rigor
       # how an LSP publish for an open `.rbx` reported `call.unresolved-toplevel` for every helper while the
       # unit sat in the index under its relative name). A path outside the root is left alone.
       def relative(path, root)
-        # `expand_path` against the root first, so `./app/views/x.rbx`, `app/views/x.rbx` and
+        # `absolute_path` against the root first, so `./app/views/x.rbx`, `app/views/x.rbx` and
         # `$ROOT/lib/../app/views/x.rbx` all reduce to the one absolute spelling before anything is
         # compared. Without it an `--instead-of=./app/views/x.rbx` matched no unit and was parsed as plain
         # Ruby — the spellings a shell and an editor produce are not the spelling `Dir.glob` returns.
-        root_dir = File.expand_path(root.to_s)
-        text = File.expand_path(path.to_s, root_dir)
-        # BOTH spellings of the root. `expand_path` does not resolve symlinks, and the root is not always
+        # `absolute_path`, not `expand_path`: a leading `~` is a directory name here (`~drafts/a.rb`), and
+        # `expand_path` reads it as a user's home and raises `ArgumentError` for a user that does not exist.
+        root_dir = File.absolute_path(root.to_s)
+        text = File.absolute_path(path.to_s, root_dir)
+        # BOTH spellings of the root. `absolute_path` does not resolve symlinks, and the root is not always
         # already resolved: `Dir.pwd` is (which is why this was latent), but a caller may pass any path.
         prefixes(root_dir).each do |prefix|
           return text.delete_prefix(prefix) if text.start_with?(prefix)

data/lib/rigor/analysis/template_units.rb

@@ -190,11 +190,11 @@ module Rigor
       end
 
       def [](path)
-        @entries[normalize(path)]
+        entry_for(path)
       end
 
       def key?(path)
-        @entries.key?(normalize(path))
+        !entry_for(path).nil?
       end
 
       # `{ path => ruby_source }` — what {Runner#parse_source} and {WorkerSession#parse_source} read
@@ -287,7 +287,7 @@ module Rigor
       # it compiles a partial's locals into the method's parameters, and it is what makes `locals:` mean
       # anything.
       def parse_scopes(path)
-        entry = @entries[normalize(path)]
+        entry = entry_for(path)
         return nil if entry.nil? || entry.locals.empty?
 
         [entry.locals.keys.map(&:to_sym)]
@@ -301,7 +301,7 @@ module Rigor
       end
 
       def unit_key_for(path)
-        @entries[normalize(path)]&.unit_key
+        entry_for(path)&.unit_key
       end
 
       # Binds the declared `self`, locals and ivar seeds onto the per-file scope, so the unit's body types
@@ -315,7 +315,7 @@ module Rigor
       # the honest reading of "a receiver is declared and the analyzer cannot see it" (ADR-5), and it is
       # silent.
       def seed(scope, path)
-        entry = @entries[normalize(path)]
+        entry = entry_for(path)
         return scope if entry.nil?
 
         scope = bind_self(scope, entry)
@@ -369,6 +369,16 @@ module Rigor
 
       private
 
+      # The unit `path` names, or nil. A run with no units answers before reducing the path: the reduction
+      # realpaths the root on every call, and every analysed file is looked up at least twice, which made 922
+      # `File.realpath` calls on a template-free `rigor check` of the v0.3.9 `lib`
+      # ([#1507](https://github.com/rigortype/rigor/issues/1507)).
+      def entry_for(path)
+        return nil if @entries.empty?
+
+        @entries[normalize(path)]
+      end
+
       def normalize(path)
         TemplateUnitPaths.relative(path, @root)
       end

data/lib/rigor/analysis/worker_session.rb

@@ -6,6 +6,7 @@ require_relative "../environment"
 require_relative "../project_environment"
 require_relative "../scope"
 require_relative "../cache/store"
+require_relative "shadow_harness"
 require_relative "../plugin"
 require_relative "../rbs_extended/reporter"
 require_relative "../reflection"
@@ -364,12 +365,12 @@ module Rigor
       def build_trust_policy
         trusted_gems = @configuration.plugins.map { |entry| trusted_gem_name(entry) }.uniq
         roots = [Dir.pwd]
-        Array(@configuration.signature_paths).each { |sp| roots << File.expand_path(sp) }
+        Array(@configuration.signature_paths).each { |sp| roots << File.absolute_path(sp) }
         trusted_gems.each do |gem_name|
           path = trusted_gem_root(gem_name)
           roots << path if path
         end
-        @configuration.plugins_io_allowed_paths.each { |p| roots << File.expand_path(p) }
+        @configuration.plugins_io_allowed_paths.each { |p| roots << File.absolute_path(p) }
 
         Plugin::TrustPolicy.new(
           trusted_gems: trusted_gems,
@@ -440,7 +441,7 @@ module Rigor
         results = walk.diagnostics_for_file(
           path: path, scope: scope, root: root, collector_driver: driver
         )
-        if ENV["RIGOR_SHADOW_RULE_WALK"]
+        if ShadowHarness.enabled?
           CheckRules.shadow_verify_converged_collectors(path, root, scope_index, node_collectors)
         end
         results.each_with_object({}.compare_by_identity) do |result, by_plugin|

data/lib/rigor/cache/descriptor.rb

@@ -58,7 +58,31 @@ module Rigor
       # searches ahead of a class's own `def`s. A pre-10 bundle would silently contribute no prepends for an
       # unchanged file, so that file's consumers would keep answering with the pre-fix MRO — cached bundles
       # must read as misses once and rebuild carrying the slot.
-      SCHEMA_VERSION = 10
+      # v11: #1558 — a plugin producer served from its own cache now replays its entry's dependency rows into
+      # the plugin's IoBoundary, so the run-result entry and the entry of any producer computed after it carry
+      # the served value's inputs. A pre-11 entry written while a producer hit lacks those rows and would
+      # validate fresh across exactly the edit they exist to catch. A checkout's source digest already moved
+      # every such key, and a release clears the root through `Store::PAYLOAD_ABI_VERSION`; the bump closes
+      # the remaining window, a same-`VERSION` build installed as `gems/rigortype-<VERSION>`, which
+      # {EngineSource} treats as version-pinned (#285) and so keys on the version alone.
+      # v12: the def-index seed bundles gain the `:unpositioned_mixins` table, the mixin edges whose order is
+      # not a fact, which an ancestor-order reader declines on. A pre-12 bundle would silently contribute no
+      # such edge for an unchanged file, so cached bundles must read as misses once and rebuild carrying it.
+      # v13/v14: #1587 — the prepend table keeps every statement (a repeated `prepend` is no longer collapsed at
+      # the freeze) and a module written to both the include and the prepend table, or a repeated `extend`, is
+      # named unpositioned. A pre-14 bundle would hold the collapsed prepend list and miss the taint for an
+      # unchanged file, so cached bundles must read as misses once and rebuild.
+      # v15: #1592 — an `extend` (or a `class << self` include) written inside a block the walk used to skip is
+      # now recorded and named unpositioned. A pre-15 bundle would hold neither for an unchanged file.
+      # v16: ADR-119 WD1 — the def-index seed bundles gain the `:siblings` Hash (the `possible_*` / `contested_*`
+      # halves of the discovery pairs). A pre-16 bundle would contribute no sibling for an unchanged file, so cached
+      # bundles must read as misses once and rebuild carrying it.
+      # v17: ADR-119 WD3 — the def-contribution producers fill the siblings (a conditional `def`'s name possible, its
+      # def-node slot and envelope contested). A pre-17 bundle carries the empty siblings of the walk before them, so
+      # an unchanged file would fold as "no possible fact" where a cold walk records one.
+      # v18: ADR-119 WD3 — the visibility walk fills `contested_discovered_method_visibilities`; a pre-18 bundle
+      # carries it empty, so an unchanged file's conditional visibility would fold as certain.
+      SCHEMA_VERSION = 18
 
       # Per-slot entry value objects. Constructors validate enums / required fields and freeze the resulting
       # struct so no caller can mutate after the entry is in a Descriptor.
@@ -105,6 +129,21 @@ module Rigor
           new(path: path, comparator: :stat, value: packed)
         end
 
+        # A `:stat` row whose recording instant is no later than `limit_ns`: any file whose recorded mtime is at or
+        # after `limit_ns` is then racy, and validation re-hashes it instead of trusting its stat tuple. Any other
+        # row, and one whose instant is already earlier, is returned as is.
+        def with_recording_instant_at_most(limit_ns)
+          return self unless comparator == :stat
+
+          parts = value.split
+          return self unless parts.size == 6 && Integer(parts[5], 10) > limit_ns
+
+          parts[5] = limit_ns.to_s
+          self.class.new(path: path, comparator: comparator, value: parts.join(" "))
+        rescue ArgumentError
+          self
+        end
+
         # ADR-45 WD1 (#577) — the absence row: fresh while `path` does not exist, stale the moment anything
         # (a file, a directory, a symlink) comes into existence there. {Plugin::IoBoundary#read_file}
         # records one when a read fails because the path is missing, so a value computed on "X is absent"

data/lib/rigor/cache/file_digest.rb

@@ -112,6 +112,34 @@ module Rigor
         hexdigest(path) == digest
       end
 
+      # ADR-45 WD2 (#1507) — `packed` re-packed against `path`'s current stat, for a writer about to record it
+      # again: when the tuple moved (a `touch`, a checkout) or the entry is racy, but the file still hashes to the
+      # recorded digest, the new pack carries the current tuple and this run's recording instant, so the next
+      # validation is one `File::Stat` again rather than a re-hash every time.
+      #
+      # The hash is taken fresh, never from the per-run memo: a memoised digest describes the bytes as they were
+      # when change detection read them, and pairing it with a later stat would vouch for bytes written since. And
+      # the re-pack is kept only when the tuple it packed, taken after the hash, is the one taken before it: a
+      # write landing while the file is hashed moves the change time, and leaves `packed` as it was.
+      #
+      # `packed` comes back unchanged when its tuple still matches and it is not racy, and whenever the bytes no
+      # longer match the digest: a row that must stay stale is never refreshed into a fresh one. nil when `packed`
+      # is not a stat pack. A stat failure (the file is gone) returns `packed` unchanged, which then validates as
+      # stale.
+      def self.refresh_stat(path, packed)
+        parsed = parse_stat(packed)
+        return nil if parsed.nil?
+
+        before = File.stat(path)
+        return packed if !racy?(parsed) && tuple_matches?(before, parsed)
+        return packed unless Digest::SHA256.file(path).hexdigest == parsed[0]
+
+        repacked = pack_stat(path, parsed[0])
+        repacked && tuple_matches?(before, parse_stat(repacked)) ? repacked : packed
+      rescue SystemCallError
+        packed
+      end
+
       # The content-digest field of a packed `:stat` entry ({.pack_stat}); nil when the entry is absent or not
       # well-formed. Exposed for the caller that must compare the recorded digest against bytes it hashes
       # itself rather than against the file on disk — the incremental session's editor-mode freshness check,

data/lib/rigor/cache/incremental_snapshot.rb

@@ -5,6 +5,10 @@ require "digest"
 require "zlib"
 
 require_relative "engine_source"
+require_relative "store"
+require_relative "../analysis/shadow_harness"
+require_relative "../analysis/run_cache_key"
+require_relative "../environment"
 
 module Rigor
   module Cache
@@ -138,7 +142,33 @@ module Rigor
       # the `write` / `to_str` / `to_int` / hatch definitions and top-level mixins it holds, which the `global.*`
       # write rules decline on project-wide. A pre-29 bundle would fold as "none of those", and a warm run would
       # report a write a cold run exempts.
-      SCHEMA = 29
+      # 30: issue #1536 gives each seed bundle a `source_rbs_digest` — the digest of what every loaded source-RBS
+      # synthesizer contributes for the file — which ADR-89 WD1 now compares beside `declaration_signature`
+      # in place of switching the gate off whenever `rigor-rbs-inline` is configured. A pre-30 bundle
+      # carries none, which the session reads as "unknown" and so as moved: sound, but every first edit to
+      # each file would re-analyse the whole project, so the gate rejects the blob and the next run is cold.
+      # 31: issue #1574 digests `plugin_fact_digest` and a seed bundle's `source_rbs_digest` with
+      # {ValueDigest} instead of over `Marshal.dump` bytes, so the same value digests alike whether a producer
+      # computed it or its cache entry served it. A pre-31 digest is in the old form and would never match, so
+      # the next run would go cold anyway; the bump makes that a clean miss instead of a "plugin fact surface
+      # changed" note that nothing changed.
+      # 32: each seed bundle gains an `unpositioned_mixins` table — the file's mixin edges whose order is not a
+      # fact (`Scope::DiscoveryIndex#unpositioned_mixins`), which an ancestor-order reader declines on. A pre-32
+      # bundle would fold as "every edge positioned", and a warm run would answer an order a cold run declines.
+      # 33: the mixin producers change what a seed bundle holds (#1587 — the prepend table keeps every statement,
+      # and a both-kind module or a repeated `extend` is named unpositioned), so a pre-33 bundle folds as the
+      # collapsed, positioned table and a warm run would answer an order a cold run declines.
+      # 34: #1592 — an `extend` or a `class << self` include inside a block the extends walk used to skip is now
+      # recorded and named unpositioned, so a pre-34 bundle folds as if the edge did not exist.
+      # 35: ADR-119 WD1 — each seed bundle gains a `siblings` Hash, the `possible_*` / `contested_*` siblings of the
+      # `Scope::DiscoveryIndex` members that may admit a possible fact. Every sibling is empty until a producer
+      # fills one, so a pre-35 bundle folds as "no possible fact", which is what it would hold today; the bump keeps
+      # that true once one does.
+      # 36: ADR-119 WD3 — the def-contribution producers fill those siblings, so a pre-36 bundle folds an unchanged
+      # file's conditional `def` as certain and a warm run would answer a definer a cold run declines.
+      # 37: ADR-119 WD3 — the visibility walk fills `contested_discovered_method_visibilities`, which a pre-37 bundle
+      # carries empty.
+      SCHEMA = 37
 
       # The persisted per-file state.
       # `cache` maps an analyzed file to its diagnostics.
@@ -210,8 +240,13 @@ module Rigor
       # rebuild — the engine version + schema, the engine's own SOURCE when the version does not pin it, the
       # resolved configuration, the analysis **roots** (the path arguments, e.g. `["lib"]`, NOT the expanded
       # file list — so a snapshot is keyed to an invocation's roots but adding / removing a file under them is
-      # handled incrementally by the session, not a full rebuild), the resolved gem set (`Gemfile.lock` /
-      # `rbs_collection`), and the project's own RBS (`signature_paths` file contents). Built WITHOUT
+      # handled incrementally by the session, not a full rebuild), the resolved gem set (the lockfiles
+      # {Analysis::RunCacheKey.resolved_lockfile_paths} resolves — `bundler.lockfile:` / `rbs_collection.lockfile:`,
+      # else `./Gemfile.lock` / `./rbs_collection.lock.yaml` — the same files the run-result key digests), the
+      # project's own RBS (the `sig/` roots the environment actually loads: the explicit
+      # `signature_paths`, or the auto-detected `<root>/sig` when `signature_paths` is nil), and the contents of
+      # every `pre_eval:` file (its PATH is in the configuration, but an edit to a file outside the analysed
+      # paths changes no analysed file, so it needs its own part). Built WITHOUT
       # constructing the RBS environment so the warm path can gate the load cheaply, before the costly env
       # build. The `--verify-incremental` gate is the safety net for any under-capture (it would surface as an
       # incremental-vs-full mismatch). Returns nil on any error → the caller falls back to a non-persisted run.
@@ -225,16 +260,22 @@ module Rigor
       # part, so a released gem's fingerprint is byte-identical to the pre-#289 one and its warm snapshots
       # survive the upgrade untouched.
       def self.fingerprint(configuration:, roots:)
+        bundler_lock, collection_lock = Analysis::RunCacheKey.resolved_lockfile_paths(configuration)
         parts = [
           "engine:#{Rigor::VERSION}:#{SCHEMA}",
           "config:#{Digest::SHA256.hexdigest(Marshal.dump(configuration.to_h))}",
           "roots:#{Array(roots).map(&:to_s).sort.join("\n")}",
-          "gems:#{digest_file_if_present('Gemfile.lock')}",
-          "rbs_collection:#{digest_file_if_present('rbs_collection.lock.yaml')}",
-          "sig:#{digest_signature_paths(configuration.signature_paths)}"
+          "gems:#{digest_file_if_present(bundler_lock)}",
+          "rbs_collection:#{digest_file_if_present(collection_lock)}",
+          "sig:#{digest_signature_paths(project_sig_roots(configuration))}",
+          "pre_eval:#{digest_pre_eval(configuration.pre_eval)}"
         ]
         identity = EngineSource.process_identity
         parts << "engine-source:#{identity}" if identity
+        # ADR-116 WD5 — the snapshot's per-file rows and seed bundles are only as checked as the run that
+        # wrote them ({Inference::DeclarationWalk::Shadow}); nil with the harness off adds no part.
+        shadow = Analysis::ShadowHarness.cache_identity
+        parts << "shadow-harness:#{shadow}" if shadow
         Digest::SHA256.hexdigest(parts.join("\x00"))
       rescue StandardError
         # {EngineSource::Unavailable} lands here too, and nil is the answer it requires rather than one it
@@ -246,10 +287,29 @@ module Rigor
       end
 
       def self.digest_file_if_present(path)
-        File.file?(path) ? Digest::SHA256.file(path).hexdigest : "absent"
+        path = path&.to_s
+        path && File.file?(path) ? Digest::SHA256.file(path).hexdigest : "absent"
       end
       private_class_method :digest_file_if_present
 
+      # Content-digest every `pre_eval:` file in configuration order, so an edit to one invalidates the snapshot
+      # even when it lies outside the analysed paths. A missing file digests as "absent", so creating it counts too.
+      def self.digest_pre_eval(paths)
+        digest = Digest::SHA256.new
+        Array(paths).each do |path|
+          digest << path.to_s << "\0" << digest_file_if_present(path.to_s) << "\0"
+        end
+        digest.hexdigest
+      end
+      private_class_method :digest_pre_eval
+
+      # The `sig/` roots the environment loads for this configuration: the configured `signature_paths`, or the
+      # auto-detected `<root>/sig` when those are nil ({Environment.project_signature_roots}).
+      def self.project_sig_roots(configuration)
+        Environment.project_signature_roots(configuration.signature_paths).map(&:to_s)
+      end
+      private_class_method :project_sig_roots
+
       # Content-digest every `.rbs` under the configured signature paths (sorted for determinism) so a project
       # RBS edit invalidates the snapshot. Sig trees are small; content (not mtime) keeps it stable across
       # checkouts.
@@ -351,7 +411,9 @@ module Rigor
           effects_identity: payload.effects_identity,
           run_level_rows: payload.run_level_rows
         )
-        blob = Zlib::Deflate.deflate(raw)
+        # #1507 — every `--incremental` run that analysed anything rewrites this whole blob, so its deflate is
+        # on the edit path; see {Store::DEFLATE_LEVEL}.
+        blob = Zlib::Deflate.deflate(raw, Store::DEFLATE_LEVEL)
         tmp = "#{@path}.#{Process.pid}.tmp"
         File.binwrite(tmp, blob)
         File.rename(tmp, @path)

data/lib/rigor/cache/store.rb

@@ -25,7 +25,8 @@ module Rigor
       # On-disk byte-layout version. Bumped on incompatible format changes (independent of
       # {Descriptor::SCHEMA_VERSION}, which covers the descriptor schema rather than the byte layout). v2
       # (ADR-54 WD2): the value payload is zlib-deflated on write and inflated on read — Marshal blobs
-      # compress to 13–16 % at an inflate cost an order of magnitude below their `Marshal.load`. v1 entries
+      # compressed to 13–16 % at zlib's default level (now {DEFLATE_LEVEL}) at an inflate cost an order of
+      # magnitude below their `Marshal.load`. v1 entries
       # fail the header check and read as silent misses; the `schema_version.txt` marker additionally carries
       # this version, so the first writable run after a bump clears the root and reclaims the unreadable
       # bytes.
@@ -60,6 +61,14 @@ module Rigor
 
       STALE_TEMP_FILE_AGE_SECONDS = 60 * 60
 
+      # #1507 — the zlib level for everything written under the cache root: these value payloads (ADR-54 WD2),
+      # the incremental snapshot, and `rigor unused`'s scan bundle. The snapshot and the scan bundle are
+      # rewritten whole whenever a run changed anything, so their deflate is on the edit path. On Mastodon the
+      # default level took 122 ms for the snapshot (9.5 MB raw) and 131 ms for `rbs.environment` (22.8 MB raw);
+      # `BEST_SPEED` takes 38 ms and 49 ms, for a cache about a quarter larger. Inflate reads any level, so the
+      # level is not part of the format.
+      DEFLATE_LEVEL = Zlib::BEST_SPEED
+
       # Header literal: 5-byte ASCII magic, 1-byte separator, 1-byte format version.
       HEADER = "RIGOR\x00#{FORMAT_VERSION.chr}".b.freeze
 
@@ -241,8 +250,13 @@ module Rigor
       # validation always re-checks the filesystem — but a single run only looks up once.
       #
       # `generation_cap:` carries the same producer-declared compaction budget as {#fetch_or_compute}.
+      #
+      # `on_hit:` is called with the entry's stored dependency descriptor on a fresh hit, before the value
+      # is returned, and never on a miss. A caller whose own dependency record must carry a served value's
+      # inputs replays them from it (#1558, {Plugin::Base#cache_for}): a hit runs no block, so nothing else
+      # reports what the value was computed from.
       def fetch_or_validate(producer_id:, key_descriptor:, generation_cap:, params: {},
-                            serialize: nil, deserialize: nil)
+                            serialize: nil, deserialize: nil, on_hit: nil)
         validate_producer_id!(producer_id)
         declare_generation_cap(producer_id, generation_cap)
         disk = ensure_schema_version!
@@ -252,6 +266,7 @@ module Rigor
         cached = path && read_entry(path, deserialize: deserialize)
         if (validated = fresh_pair_value(cached))
           @monitor.synchronize { record(:hits, producer_id) }
+          on_hit&.call(validated[1])
           return validated[0]
         end
 
@@ -285,6 +300,51 @@ module Rigor
         validated[0]
       end
 
+      # ADR-45 WD2 (#1507) — a record-and-validate entry's value WITHOUT validating its dependencies. The
+      # `--incremental` session reads the previous run-result slot to carry forward the rows a narrowed run
+      # cannot re-derive, and that slot is expected to be stale: the edit that started this run is in it. So
+      # the answer here is never served — only rows are taken from it, and they are validated again, with
+      # everything else, the next time the slot is read. nil on a miss, a malformed entry or an unavailable
+      # disk tier. Records neither a hit nor a miss, since nothing was looked up to be served.
+      def peek_unvalidated(producer_id:, key_descriptor:, params: {})
+        validate_producer_id!(producer_id)
+        return nil unless ensure_schema_version!
+
+        key = key_descriptor.cache_key_for(producer_id: producer_id, params: params)
+        pair = read_entry(entry_path(producer_id, key))&.value
+        return nil unless pair.is_a?(Array) && pair.size == 2 && pair[1].is_a?(Descriptor)
+
+        pair[0]
+      end
+
+      # ADR-45 WD2 (#1507) — the write half of {#fetch_or_validate} on its own, and unconditional. That method
+      # writes only after it failed to validate what is there; a writer that has just computed an answer of its
+      # own must store THAT answer even when the entry already on disk still validates, because it is the one
+      # the run printed. Same entry format and the same failure contract as {#fetch_or_validate}'s write: a
+      # disk-side failure is swallowed, a value `Marshal` cannot dump raises. Returns whether it wrote.
+      def store_validated(producer_id:, key_descriptor:, generation_cap:, value:, dependencies:, params: {})
+        validate_producer_id!(producer_id)
+        declare_generation_cap(producer_id, generation_cap)
+        return false unless ensure_schema_version!
+
+        key = key_descriptor.cache_key_for(producer_id: producer_id, params: params)
+        wrote = try_write_entry(entry_path(producer_id, key), key_descriptor, [value, dependencies])
+        @monitor.synchronize { record(:writes, producer_id) } if wrote
+        wrote
+      end
+
+      # ADR-45 WD2 (#1507) — removes one entry, for a writer that has just superseded it under another key and
+      # knows nothing will ask for it again. Best-effort like every other unlink here; a no-op on a read-only
+      # store.
+      def discard(producer_id:, key_descriptor:, params: {})
+        validate_producer_id!(producer_id)
+        return if @read_only || !ensure_schema_version!
+
+        path = entry_path(producer_id, key_descriptor.cache_key_for(producer_id: producer_id, params: params))
+        unlink_entry_and_shard?(path) if File.file?(path)
+        nil
+      end
+
       # ADR-6 § "Eviction" — compaction pass over the on-disk cache. No-op when the store is read-only.
       #
       # The generation cap of pass 2 comes from what the producers themselves declared through this Store's
@@ -469,7 +529,7 @@ module Rigor
         FileUtils.mkdir_p(File.dirname(path))
 
         descriptor_bytes = descriptor.to_canonical_bytes
-        value_bytes = Zlib::Deflate.deflate(serialize_value(value, serialize))
+        value_bytes = Zlib::Deflate.deflate(serialize_value(value, serialize), DEFLATE_LEVEL)
 
         body = +"".b
         body << HEADER