rigortype 0.4.3 → 0.4.4

data/lib/rigor/analysis/incremental_session.rb

@@ -38,7 +38,13 @@ module Rigor
       # gate) can report what was re-analyzed versus served from cache. `added` / `removed` carry the
       # structural delta so {#run_incremental} (ADR-87 WD3) can recognise a zero-change recheck and skip the
       # unconditional snapshot rewrite.
-      Recheck = Data.define(:diagnostics, :changed, :added, :removed, :affected, :reused, :templates) do
+      # `rebaselined` (#1898) is true when the recheck found its served effect collections stale and answered with a
+      # full baseline instead; see {#rebaseline_recheck}.
+      Recheck = Data.define(:diagnostics, :changed, :added, :removed, :affected, :reused, :templates, :rebaselined) do
+        def initialize(rebaselined: false, **rest)
+          super
+        end
+
         # A recheck that changed, added, and removed nothing — the session state is byte-equivalent to the
         # snapshot that was restored, so persisting it again would only rewrite identical bytes.
         def no_change?
@@ -208,6 +214,7 @@ module Rigor
         # ADR-103 WD13 / #382 — a baseline collects every file, so its collections are the whole world.
         @effect_collections = runner.effect_collections_by_path
         @effects_identity = current_effects_identity
+        @effect_plugin_digest = effect_plugin_digest_of(runner)
         @cache = per_file(runner.per_file_diagnostics)
         @digests = @analyzed.to_h { |path| [path, pack_digest(path)] }
         forget_unbound_digests
@@ -238,15 +245,13 @@ module Rigor
         # go in too, so the runner lists them in the full run's file order (#1524).
         runner = build_runner(analyze_only: analyze_set, record_dependencies: true,
                               param_inferred_types: fresh_params, **forced_target_options(forced),
-                              restored_run_level_rows: @run_level_rows,
-                              served_per_file_diagnostics: @cache.slice(*reused))
+                              restored_run_level_rows: @run_level_rows, **served_state(reused))
         merged = run_runner(runner).diagnostics
-        @last_runner = runner # ADR-88 WD1 — the post-hoc fact-surface fingerprint reads this prepared registry.
+        return rebaseline_recheck(changed, added, removed) if served_effects_stale?(runner, reused)
+
         absorb(runner, current, analyze_set, removed)
         @param_table = fresh_params
-        Recheck.new(diagnostics: merged, changed: changed.to_set, added: added.to_set,
-                    removed: removed.to_set, affected: affected, reused: reused.to_set,
-                    templates: runner.template_unit_paths.size)
+        recheck_result(merged, [changed, added, removed], affected: affected, reused: reused.to_set, runner: runner)
       end
 
       # Editor mode option B (#146) — a whole-project recheck with the editor's buffer substituted for one
@@ -271,6 +276,9 @@ module Rigor
           # latency this mode exists to avoid, so decline and let the caller drop to single-file scope.
           break nil unless @plugin_fact_reusable.reusable_against?(restored.plugin_fact_digest)
           break nil if source_rbs_unverified?(result)
+          # #1898 — a recheck that re-baselined over stale plugin effect facts ran its baseline with the buffer set,
+          # which analyses the buffer alone, so it is not a whole-project answer. Decline, as above.
+          break nil if result.rebaselined
 
           result
         end
@@ -342,6 +350,35 @@ module Rigor
         closure.freeze
       end
 
+      # Issue #1906 — a file that rewrites a constant's singleton names without declaring it
+      # (`D.singleton_class.alias_method :own, :keep`) contributes opaque singleton envelopes to the constant's bucket,
+      # but a reader's class edge names only the files that declared the constant when the reader last ran, and the
+      # class-declaration diff does not move while the constant stays in the file (`:own` becoming `:keep`, or the
+      # call becoming a `class D` reopening). So a declaration-unstable edit to such a file fires `class:<last
+      # segment>` for each constant that, before the edit, both sat in the file's singleton-source set and held a
+      # singleton envelope entry or an unpositioned singleton side the file recorded (a computed name there leaves the
+      # side unpositioned, and becoming literal reads it again). A file that only includes into a constant
+      # (`ActiveRecord::Base.include(X)`) records neither and fires nothing. A constant the edit makes the file
+      # rewrite needs no key: the class-declaration diff fires if it is new to the file, and the reader's class edge
+      # names the file if the file declared it.
+      def singleton_rewrite_affected(unstable)
+        names = unstable.flat_map { |path| singleton_rewritten_constants(@seed_bundles[path]) }.uniq
+        return Set.new if names.empty?
+
+        Incremental.negative_closure(names.map { |name| "class:#{name.split('::').last}" }, @negative_dependents)
+      end
+
+      def singleton_rewritten_constants(bundle)
+        return [] if bundle.nil?
+
+        envelopes = bundle[:parameter_envelopes] || {}
+        unpositioned = bundle[:unpositioned_mixins] || {}
+        (bundle[:singleton_class_source_names] || []).select do |name|
+          (envelopes[name] || {}).each_key.any? { |key| key.is_a?(Array) && key.first == :singleton } ||
+            unpositioned.dig(name, :extend)
+        end
+      end
+
       # Issue #1367 — every file whose last result holds a `global.*` diagnostic re-checks on any recheck. What
       # exempts such a write is a fact of the whole program — an alias, or a `write` / `to_str` / `to_int` / hatch
       # defined in any spelling on any receiver, a rewritten ancestor, a mixin — which no name-keyed edge can
@@ -365,13 +402,15 @@ module Rigor
 
       # The dependents contributed by the declaration-unstable changed files and the behaviourally-unstable
       # symbol pairs: the ADR-46 slice-4 symbol-granular fan-out when either is present (ancestry deps of the
-      # unstable files + symbol deps of the changed pairs), else the coarse file-level fan-out.
+      # unstable files + symbol deps of the changed pairs), else the coarse file-level fan-out; plus the readers of
+      # the constants an unstable file rewrote from outside their bodies ({#singleton_rewrite_affected}).
       def dependents_base(unstable, symbol_pairs)
-        if symbol_pairs.any? || unstable.any? { |f| @ancestry_dependents[f] }
-          Incremental.affected_with_symbols(unstable, symbol_pairs, @symbol_dependents, @ancestry_dependents)
-        else
-          Incremental.affected(unstable, @dependents)
-        end
+        base = if symbol_pairs.any? || unstable.any? { |f| @ancestry_dependents[f] }
+                 Incremental.affected_with_symbols(unstable, symbol_pairs, @symbol_dependents, @ancestry_dependents)
+               else
+                 Incremental.affected(unstable, @dependents)
+               end
+        base | singleton_rewrite_affected(unstable)
       end
 
       # ADR-67 WD6c lift — the fresh whole-project inferred-param table for this recheck ({} when the gate
@@ -466,7 +505,7 @@ module Rigor
       def whole_project_closure(changed, added)
         (@analyzed.to_set | changed | added).freeze
       end
-      private :gated_closure, :whole_project_closure
+      private :gated_closure, :whole_project_closure, :singleton_rewrite_affected, :singleton_rewritten_constants
 
       # The current project file set (cheap directory expansion, no analysis), used to detect files added /
       # removed since the last run. Also where an editor buffer's binding is re-spelled onto the set, since
@@ -489,8 +528,7 @@ module Rigor
         # ADR-67 WD6c lift — seed the subset run from the baseline's own table so the verification engine
         # exercises the exact seeds the served cache entries were computed under (and skips a re-collect).
         runner = build_runner(analyze_only: affected, param_inferred_types: @param_table,
-                              restored_run_level_rows: @run_level_rows,
-                              served_per_file_diagnostics: @cache.slice(*reused))
+                              restored_run_level_rows: @run_level_rows, **served_state(reused))
         run_runner(runner).diagnostics
       end
 
@@ -534,7 +572,7 @@ module Rigor
             result = recheck
             adopt_plugin_fact_fingerprint
             fact_reusable = @plugin_fact_reusable.reusable_against?(restored.plugin_fact_digest)
-            if fact_reusable && effects_reusable && !source_rbs_unverified?(result)
+            if fact_reusable && effects_reusable && !result.rebaselined && !source_rbs_unverified?(result)
               diagnostics = keep_recheck(result)
               warm = true
               # ADR-87 WD3 — a warm recheck that changed nothing leaves the session state byte-equivalent to the
@@ -549,7 +587,8 @@ module Rigor
               # digest (from the recheck runner) is unchanged by the re-analysis, so it is kept for the save.
               # Only a genuine fact-surface reason sets the reporting flag the CLI banner reads.
               @fact_surface_invalidated = true unless fact_reusable
-              diagnostics = baseline
+              # #1898 — a recheck that already re-baselined over stale plugin effect facts is that re-analysis.
+              diagnostics = result.rebaselined ? result.diagnostics : baseline
               warm = false
               skip_save = false
             end
@@ -873,6 +912,7 @@ module Rigor
         # a partial re-collection cannot be closed into a whole-project fixpoint.
         @effects_identity  = payload.effects_identity
         @effect_collections = effect_collections_reusable?(payload) ? payload.effect_collections.dup : {}
+        @effect_plugin_digest = payload.effect_plugin_digest
         @symbol_dependents = Incremental.invert_symbols(@symbol_sources)
         @ancestry_dependents = Incremental.invert(@ancestry_sources)
         @negative_dependents = Incremental.invert(@missing)
@@ -901,7 +941,8 @@ module Rigor
           param_table: marshal_safe_param_table,
           effect_collections: marshal_safe_effect_collections,
           effects_identity: @effects_identity,
-          run_level_rows: @run_level_rows
+          run_level_rows: @run_level_rows,
+          effect_plugin_digest: @effect_plugin_digest
         )
       end
 
@@ -913,6 +954,7 @@ module Rigor
       def reset_effect_state
         @effect_collections = {}
         @effects_identity = nil
+        @effect_plugin_digest = nil
       end
 
       # The state this session carries ACROSS processes in the snapshot rather than deriving each run: the
@@ -1003,6 +1045,7 @@ module Rigor
       # multiple edits: the analyzed set gets fresh diagnostics + digests + dependency edges, removed files
       # are evicted from every map, and the analyzed-file list advances to `current`.
       def absorb(runner, current, analyze_set, removed)
+        @last_runner = runner # ADR-88 WD1 — the post-hoc fact-surface fingerprint reads this prepared registry.
         removed.each { |path| forget(path) }
         @analyzed = current
         # ADR-85 WD2 — the recheck's discovery folded the restored bundles and refreshed them (changed files
@@ -1036,6 +1079,7 @@ module Rigor
         @effect_collections.reject! { |path, _| analyzed.include?(path) }
         @effect_collections.merge!(runner.effect_collections_by_path)
         @effects_identity = current_effects_identity
+        @effect_plugin_digest = effect_plugin_digest_of(runner)
       end
 
       # ADR-89 WD2 — replace the behavioural summaries of every re-analyzed file with THIS run's harvest: drop
@@ -1131,7 +1175,8 @@ module Rigor
       # appeared `"ClassName#method"` to the negative-dependency key it would satisfy (`toplevel:foo` for a
       # top-level def, `method:C#m` otherwise), then unions the recorded negative-dependents of those keys.
       # Issue #1120 — plus the consumers of any refinement name the edit moved ({#refinement_affected}). Issue #1367 —
-      # and every file whose last result holds a `global.*` diagnostic ({#global_write_reporters}).
+      # and every file whose last result holds a `global.*` diagnostic ({#global_write_reporters}). Issue #1459 — and
+      # the consumers of any method name a file started or stopped defining ({#defined_name_affected}).
       def negative_affected(changed, removed, new_fingerprints, new_class_decls, new_constant_decls, summary = nil)
         appeared_methods = Incremental.appeared_symbols(changed, @symbol_fingerprints, new_fingerprints)
         # Issue #639 — a class DISAPPEARING satisfies the `class:` kind too, now that a resolved bare
@@ -1149,7 +1194,7 @@ module Rigor
         keys.concat(class_move_keys(moved_classes))
         keys.concat(moved_constants.map { |name| "constant:#{name.split('::').last}" })
         Incremental.negative_closure(keys, @negative_dependents) | refinement_affected(changed + removed, summary) |
-          global_write_reporters
+          defined_name_affected(changed + removed, summary) | global_write_reporters
       end
 
       # The negative keys a class-declaration diff fires: `class:<last segment>` for a class name, and (issue #1820)
@@ -1177,6 +1222,22 @@ module Rigor
         Incremental.negative_closure(names.map { |name| "refinement:#{name}" }, @negative_dependents)
       end
 
+      # Issue #1459 — the consumers whose answer asked whether the program defines a method name anywhere, for each
+      # name a file in `paths` started or stopped defining. The before-state is each file's seed bundle, the
+      # after-state the scan's per-file name sets. Unlike the appeared-symbol diff, it sees a name an `attr_*`,
+      # `alias` or `define_method` adds, and one that vanishes, which brings a declined reading back.
+      def defined_name_affected(paths, summary)
+        after = (summary && summary[:defined_method_names]) || {}
+        before = paths.to_h do |path|
+          bundle = @seed_bundles[path]
+          [path, bundle && Inference::ScopeIndexer.defined_method_names(bundle)]
+        end
+        names = Incremental.changed_defined_names(paths, before, after)
+        return Set.new if names.empty?
+
+        Incremental.negative_closure(names.map { |name| "defines:#{name}" }, @negative_dependents)
+      end
+
       # The qualified class/module names declared in the pre-parsed `index` (shared with
       # {#symbol_fingerprints_from_index}, so the changed set is parsed once). `{ path => Set<class name> }`.
       def class_declarations_from_index(index)
@@ -1335,6 +1396,45 @@ module Rigor
         [forced, (affected | forced) & current]
       end
 
+      # What the session serves a narrowed run for the files it does not analyse: their cached per-file rows (#1524),
+      # and (#1898) their effect collections, so the run closes its effect graph over the whole project.
+      def served_state(reused)
+        { served_per_file_diagnostics: @cache.slice(*reused),
+          served_effect_collections: @effect_collections.slice(*reused) }
+      end
+
+      # Issue #1898 — the plugin effect-fact digest a run's collections were stamped under. A plugin writes its
+      # attributions and edges into a file's collection when the file is collected, and what it contributes can
+      # follow project state no file digest sees (rigor-activejob reads `config.active_job.queue_adapter`), so a
+      # served collection is current only while this digest is. nil when collection is off.
+      def effect_plugin_digest_of(runner)
+        @configuration.effects_enabled? ? runner.effect_plugin_facts.digest : nil
+      end
+
+      # Whether `runner` judged envelopes over served collections stamped under a different plugin effect-fact
+      # digest, or an unknown one. The comparison waits for the run because the plugins load inside it.
+      def served_effects_stale?(runner, reused)
+        return false if reused.empty? || @effect_collections.empty?
+
+        effect_plugin_digest_of(runner) != @effect_plugin_digest
+      end
+
+      # The answer {#recheck} gives when {#served_effects_stale?}: a full baseline, reported as a recheck that
+      # re-analysed every file. {#run_incremental} reads `rebaselined` so it neither runs a second baseline
+      # nor reports the run as warm.
+      def rebaseline_recheck(changed, added, removed)
+        diagnostics = baseline
+        recheck_result(diagnostics, [changed, added, removed],
+                       affected: @analyzed.to_set, reused: Set.new, runner: @last_runner, rebaselined: true)
+      end
+
+      # A {Recheck} over `deltas` (`[changed, added, removed]`), counting `runner`'s template units.
+      def recheck_result(diagnostics, deltas, affected:, reused:, runner:, rebaselined: false)
+        changed, added, removed = deltas.map(&:to_set)
+        Recheck.new(diagnostics: diagnostics, changed: changed, added: added, removed: removed, affected: affected,
+                    reused: reused, templates: runner.template_unit_paths.size, rebaselined: rebaselined)
+      end
+
       # A recheck that forces targets analyses in this process, so the index callback reaches them.
       def forced_target_options(forced)
         forced.empty? ? {} : { workers: 0 }

data/lib/rigor/analysis/reachability/graph.rb

@@ -50,11 +50,31 @@ module Rigor
           return [nil] if receiver.nil?
 
           local = @shadows[use.path]
+          runtime = use.receiver_open ? runtime_targets(receiver, name, use.inherit, local) : []
           own = declared_member(receiver, name, local)
-          return [own] if own
-          return [] unless use.inherit
+          return [own, *runtime].uniq if own
+          return runtime unless use.inherit
 
-          plausible_ancestors(receiver).filter_map { |scope| declared_member(scope, name, local) }.uniq + [nil]
+          (plausible_ancestors(receiver).filter_map { |scope| declared_member(scope, name, local) } + runtime)
+            .uniq + [nil]
+        end
+
+        # The declarations a descendant of `receiver` holding `name` adds (#1878): a `self` standing for the
+        # enclosing declaration is whichever subclass, includer, prepender or extender the method runs on, and
+        # Ruby looks the name up there first. Each descendant is searched with its own ancestors unless the call
+        # passes `inherit = false`. The descendants are over-approximated as {#plausible_ancestors} is.
+        def runtime_targets(receiver, name, inherit, local)
+          descendants_of(receiver).flat_map do |descendant|
+            scopes = inherit ? [descendant, *plausible_ancestors(descendant)] : [descendant]
+            scopes.filter_map { |scope| declared_member(scope, name, local) }
+          end.uniq
+        end
+
+        def descendants_of(fqn)
+          @plausible_descendants ||= @by_fqn.keys.each_with_object(Hash.new { |h, k| h[k] = [] }) do |declared, out|
+            plausible_ancestors(declared).each { |ancestor| out[ancestor] << declared }
+          end
+          @plausible_descendants.fetch(fqn, [])
         end
 
         # `scope::name`, or the longest declared prefix of it, when one is declared.

data/lib/rigor/analysis/reachability/scan.rb

@@ -57,8 +57,16 @@ module Rigor
         # matching. A literal `name` keeps `within` too, and {Graph} looks it up from there (#1761). `inherit`
         # is false when the call passes `inherit = false`, which confines the lookup to the receiver itself;
         # otherwise the receiver's ancestors are searched as well. `role` is the referring file's (WD8).
-        DynamicUse = Data.define(:name, :prefix, :reason, :site, :path, :line, :scope, :within, :inherit, :role) do
-          def initialize(scope: :namespace, within: nil, inherit: true, role: :production, **) = super
+        #
+        # `receiver_open` is true when `within` is the enclosing declaration standing for a runtime `self` that
+        # may be one of its descendants (#1878): a `def self.x = const_get(:X)` runs on whichever subclass it
+        # is called on, and a module's method on whichever class includes, prepends or extends it. {Graph}
+        # then looks the literal name up in those descendants as well.
+        DynamicUse = Data.define(:name, :prefix, :reason, :site, :path, :line, :scope, :within, :inherit, :role,
+                                 :receiver_open) do
+          def initialize(scope: :namespace, within: nil, inherit: true, role: :production, receiver_open: false, **)
+            super
+          end
 
           # Whether this site's evidence reaches `fqn`.
           def taints?(fqn)
@@ -251,10 +259,21 @@ module Rigor
                               module_exec instance_eval instance_exec].freeze
           private_constant :SELF_REBINDING
 
+          # The `*_eval` / `*_exec` family: on a constant receiver, the block's `self` IS that constant (#1878).
+          EVAL_FAMILY = %i[class_eval module_eval class_exec module_exec instance_eval instance_exec].freeze
+          private_constant :EVAL_FAMILY
+
           # A call is a dynamic-resolution site, and its block may run with another `self` ({#rebinds_self?}).
           def record_call(node, nesting)
             record_dynamic_use(node, nesting)
-            @rebinding_blocks << node.block if node.block.is_a?(Prism::BlockNode) && rebinds_self?(node)
+            return unless node.block.is_a?(Prism::BlockNode) && rebinds_self?(node)
+
+            @rebinding_blocks << node.block
+            @eval_receivers[node.block] = receiver_reference(node.receiver, nesting) if eval_on_constant?(node)
+          end
+
+          def eval_on_constant?(call)
+            EVAL_FAMILY.include?(call.name) && constant_receiver?(call.receiver)
           end
 
           # Rigor knows the argument's shape, which is the whole reason this can be tiered rather than treated
@@ -290,6 +309,7 @@ module Rigor
             bounds.each do |prefix, scope, within|
               @dynamic_uses << DynamicUse.new(name: name, prefix: prefix, scope: scope, within: within,
                                               inherit: anchors.include?(TOP_LEVEL), role: @role,
+                                              receiver_open: !within.nil? && runtime_self?(node),
                                               site: site(node), path: @path, line: node.location.start_line,
                                               reason: reason)
             end
@@ -318,12 +338,21 @@ module Rigor
             end
           end
 
+          # Whether a `const_get` on `self` can run on a descendant of the enclosing declaration (#1878): in a
+          # method, or a block that rebinds `self`, `self` is whichever subclass or includer the method was
+          # called on. Directly in a class body, or inside `Other.class_eval { }`, it is the declaration itself.
+          def runtime_self?(node)
+            node.name == :const_get && self_receiver?(node.receiver) && @eval_receiver.nil? &&
+              !(@self_kind == :declaration && !@in_block && !@self_rebound)
+          end
+
           # Where a `const_get` on `self` (implicit, `self`, or `self.class`) looks its name up: `:declaration`
           # when `self` is the enclosing class or module, `:top_level` when it is `Class` or a singleton class,
           # `:unknown` otherwise. A block's `self` is unknown — `included do`, `class_eval` and an instance-
           # evaluated DSL block (`configure { }`, an RSpec `describe` body) all rebind it, and the walk cannot
           # tell those from an `each` block. So is the `self` of a `def Other.x` or of a `class << Other` body.
           def self_lookup(receiver)
+            return :declaration if @eval_receiver && !receiver.is_a?(Prism::CallNode)
             return :unknown if @in_block || @self_rebound
 
             class_of_self = receiver.is_a?(Prism::CallNode)
@@ -345,7 +374,7 @@ module Rigor
             receiver = node.receiver
             namespaces =
               if self_receiver?(receiver)
-                self_references(node, nesting)
+                eval_self_references(receiver) || self_references(node, nesting)
               elsif constant_receiver?(receiver)
                 [receiver_reference(receiver, nesting)]
               else
@@ -357,6 +386,11 @@ module Rigor
             inherit.is_a?(Prism::FalseNode) ? namespaces : namespaces + [TOP_LEVEL]
           end
 
+          # Inside `Other.class_eval { }` an implicit or `self` receiver is `Other` (#1878).
+          def eval_self_references(receiver)
+            [@eval_receiver] if @eval_receiver && !receiver.is_a?(Prism::CallNode)
+          end
+
           # The enclosing declaration as a rooted {Reference}, so {Graph} anchors it as it anchors a constant
           # receiver and can search its ancestors. Inside a meta-new rvalue `self` is the declared class in its
           # block but the outer scope in its arguments; the walk does not tell the two apart, so both are taken.
@@ -478,6 +512,10 @@ module Rigor
             # `class_eval` or anonymous `Class.new` block. See {#rebinds_self?}.
             @self_rebound = false
             @rebinding_blocks = Set.new.compare_by_identity
+            # The constant receiver of each `*_eval` block, and the one the walk is inside (nil when `self` is not
+            # such a constant). See {#eval_on_constant?}.
+            @eval_receivers = {}.compare_by_identity
+            @eval_receiver = nil
             # What `self` is here, for {#self_lookup}: `:declaration` in a class or module body (and at the top
             # level), `:singleton_method` in a `def self.x` or a def in a `class << self` body,
             # `:instance_method` in any other def, `:singleton_class` in a `class << self` body outside its
@@ -602,13 +640,14 @@ module Rigor
           end
 
           def in_local_scope(scope, self_kind = self_kind_in(scope))
-            saved = [@local_scope, @block_params, @self_kind]
+            saved = [@local_scope, @block_params, @self_kind, @eval_receiver]
+            @eval_receiver = nil
             @local_scope = scope
             @block_params = Set.new.freeze
             @self_kind = self_kind
             yield
           ensure
-            @local_scope, @block_params, @self_kind = saved
+            @local_scope, @block_params, @self_kind, @eval_receiver = saved
           end
 
           # The {#self_lookup} kind inside `scope`, from the kind around it. Only a receiver-less def or a `def
@@ -642,14 +681,17 @@ module Rigor
           end
 
           def in_block(block)
-            saved = [@block_params, @self_rebound, @in_block]
+            saved = [@block_params, @self_rebound, @in_block, @eval_receiver]
             names = block.parameters ? LocalValues.bindings(block.parameters) : []
             @block_params = (@block_params | names).freeze unless names.empty?
-            @self_rebound ||= @rebinding_blocks.include?(block)
+            if @rebinding_blocks.include?(block)
+              @self_rebound = true
+              @eval_receiver = @eval_receivers[block]
+            end
             @in_block = true
             yield
           ensure
-            @block_params, @self_rebound, @in_block = saved
+            @block_params, @self_rebound, @in_block, @eval_receiver = saved
           end
 
           def site(node)

data/lib/rigor/analysis/rule_catalog.rb

@@ -94,7 +94,12 @@ module Rigor
           does_not_fire_when: [
             "Implicit-self calls (no receiver) — too noisy without per-method RBS for every helper.",
             "Receiver is `Dynamic[T]` / `Top` / `Union` — by definition the method set isn't enumerable.",
-            "Receiver class is in the loader but its RBS definition cannot be built (constant aliases)."
+            "Receiver class is in the loader but its RBS definition cannot be built (constant aliases).",
+            "Receiver class answers beyond any signature: a plugin-declared open receiver (ADR-26), or one " \
+            "Rigor's bundled overlays name (`OpenStruct`, whose fields are per-instance singleton methods; " \
+            "`ActiveSupport::Duration` and `ActiveSupport::Concern` when their gem overlay loads). Both sides " \
+            "of the class are open, and an inherited Object / Kernel signature no longer decides " \
+            "`call.wrong-arity` or `call.argument-type-mismatch` on it."
           ],
           suppression: "`# rigor:disable call.undefined-method` on the call line, " \
                        "or `disable: [\"call.undefined-method\"]` in `.rigor.yml`.",

data/lib/rigor/analysis/run_cache_key.rb

@@ -70,13 +70,14 @@ module Rigor
       RUN_EFFECTS_TABLE_PRODUCER_ID = "analysis.run-effects-table"
 
       # The run-result producer's declared compaction budget (`Cache::Store#evict!` pass 2). Whole-project,
-      # but unlike the `rbs.*` producers several generations can be live at once: the `paths` key slot means
-      # one entry per analyzed-path SET, so `rigor check` over the whole project, over `lib`, and over a
-      # single file are three separate live generations. 16 is a judgement call sized for that churn; it is
-      # a cap on GENERATIONS, not on correctness — over-evicting here costs a recompute, never a wrong
-      # answer. Measured 2026-07-25 against a real project's `.rigor/cache`: the cap does bind (60 distinct
-      # path-set generations observed, differing in the `paths` slot alone), with no evidence yet on how
-      # often an evicted generation is asked for again — see issue #151.
+      # but unlike the `rbs.*` producers several generations can be live at once: the `paths` and `roots` key
+      # slots mean one entry per analyzed-path SET x root list as written (#1559), so `rigor check` over the
+      # whole project, over `lib`, and over a single file are three separate live generations, and `rigor
+      # check` and `rigor check lib` are two even when `lib` is the configured `paths:`. 16 is a judgement call
+      # sized for that churn; it is a cap on GENERATIONS, not on correctness — over-evicting here costs a
+      # recompute, never a wrong answer. Measured 2026-07-25 against a real project's `.rigor/cache`: the cap
+      # does bind (60 distinct path-set generations observed, differing in the `paths` slot alone), with no
+      # evidence yet on how often an evicted generation is asked for again — see issue #151.
       GENERATION_CAP = 16
 
       # The effects sidecar's own compaction budget. One generation per (path set × effects identity), and
@@ -109,6 +110,29 @@ module Rigor
         nil
       end
 
+      # #1559 — the run-result key's analysis ROOTS, as the run was given them. The `paths` slot holds only the
+      # files the roots expand to, so `check lib extra` with `extra` missing and `check lib` shared a key while
+      # only the first prints `extra:1:1: warning: no such file or directory (skipped)`, which changes the exit
+      # code under `--fail-on=warning`. The roots are kept in the order and spelling written, not normalised: a
+      # missing root is reported as written (`./extra` is not `extra`), and the order of the roots is the order
+      # the diagnostics come out in, so two runs that differ only in either are two slots (a forgone hit, never a
+      # wrong one).
+      #
+      # Added to the DIAGNOSTICS key only. The ADR-103 effects sidecar derives its identity from {#descriptor}
+      # without it: the effect table is a function of the analysed files, and no path-error row reaches it.
+      # The `--incremental` slot builds its own, normalised, roots entry ({IncrementalRunSlot}).
+      #
+      # @param descriptor — a {#descriptor} result (nil passes through, so a disabled cache stays disabled).
+      def with_roots(descriptor, roots)
+        return nil if descriptor.nil?
+
+        entry = config_entry("roots", Marshal.dump(Array(roots).map(&:to_s)))
+        Cache::Descriptor.new(
+          gems: descriptor.gems, dependencies: descriptor.dependencies, plugins: descriptor.plugins,
+          configs: descriptor.configs + [entry]
+        )
+      end
+
       # Issue #285 — the `engine` slot above pins the engine by VERSION, which identifies the source only
       # for a released gem. A checkout (a contributor's, or a `bundle add rigor, github:` clone) gets one
       # extra slot carrying a digest of the engine's own source, so editing `lib/rigor/inference/*.rb` no

data/lib/rigor/analysis/run_cache_probe.rb

@@ -65,9 +65,11 @@ module Rigor
       #   probe must never turn a servable run into a crash.
       def serve(paths)
         files = PathExpansion.ruby_files(paths, @configuration.exclude_patterns, base: @configuration.exclude_base)
-        key = RunCacheKey.descriptor(
-          configuration: @configuration, files: files, explain: @explain,
-          rbs_config_entries: RunCacheKey.libraries_config_entries(@configuration)
+        key = RunCacheKey.with_roots(
+          RunCacheKey.descriptor(
+            configuration: @configuration, files: files, explain: @explain,
+            rbs_config_entries: RunCacheKey.libraries_config_entries(@configuration)
+          ), paths
         )
         return nil if key.nil?
 

data/lib/rigor/analysis/runner/diagnostic_aggregator.rb

@@ -57,7 +57,8 @@ module Rigor
                        quarantined_signatures_snapshot:, env_build_failure_snapshot:,
                        definition_build_failures_snapshot:, hkt_scan_failure_snapshot:,
                        conformance_results_snapshot:, signature_standdowns_snapshot: -> { [] },
-                       vendored_standdowns_snapshot: -> { [] }, pooled_run_disclosures: -> { [] })
+                       vendored_standdowns_snapshot: -> { [] }, pooled_run_disclosures: -> { [] },
+                       pooled_trust_refusals: -> { [] })
           @configuration = configuration
           @rbs_extended_reporter = rbs_extended_reporter
           @boundary_cross_reporter = boundary_cross_reporter
@@ -78,6 +79,9 @@ module Rigor
           # Issue #1051 — reader for the pool coordinator's de-duplicated run-scoped disclosure table.
           # Empty on a sequential run, where `plugin_registry`'s own instances are the ones that registered.
           @pooled_run_disclosures_reader = pooled_run_disclosures
+          # Issue #1900 — reader for the pool coordinator's summed trust-refusal table. Empty on a
+          # sequential run, where `plugin_registry`'s own boundaries made every read.
+          @pooled_trust_refusals_reader = pooled_trust_refusals
         end
 
         # Pre-file diagnostic streams that fire once per run rather than per analyzed file: plugin load /
@@ -613,9 +617,18 @@ module Rigor
         # culprit and reads the same on a cache hit, where every `RBS::Location` has been dumped to a
         # sentinel. The error class is attributed to that first failure explicitly rather than to all of
         # them: the per-class memo keeps only the first reason, and one run can mix error classes.
+        #
+        # Issue #1902 — "first" is first by CLASS NAME, not first recorded. The snapshot arrives in demand
+        # order, and that order is a property of the invocation, not of the project: an `--incremental`
+        # recheck records the classes its closure demanded before it unions in the replayed set, and a worker
+        # pool unions per-worker lists in drain order. So the classes are sorted by name and the files
+        # sorted and deduplicated here. Which tuple each class carries is fixed upstream
+        # ({Environment::RbsLoader.definition_build_detail_order}), not here.
         def build_rbs_definition_build_failed_diagnostic(failures)
+          failures = failures.sort_by { |failure| failure.first.to_s }
           sample_size = 5
-          files = failures.flat_map { |failure| Array(failure[3]) }.uniq.map { |name| relative_signature_path(name) }
+          files = failures.flat_map { |failure| Array(failure[3]) }
+                          .map { |name| relative_signature_path(name) }.uniq.sort
           Diagnostic.new(
             path: ".rigor.yml",
             line: 1,
@@ -1084,16 +1097,22 @@ module Rigor
         # cache"). It is also never routed through `IncrementalSession`'s per-file cache (`#788`): that cache
         # holds only `Runner#per_file_diagnostics`, and this row is not part of that stream.
         #
-        # Scope: `plugin_registry` here is the coordinator-side registry, which only actually RUNS `#prepare`
-        # / per-file analysis in sequential mode (`--workers` unset, the default) — a pooled run (`--workers
-        # N`) prepares and analyses on per-worker `WorkerSession` registries this reader never sees, so a
-        # refusal confined to a pooled worker's slice is not reported. Left out deliberately: draining it
-        # needs a fourth marshalled channel beside `drain_reporters` / `drain_dependencies` / `drain_effects`
-        # in `Runner::PoolCoordinator`, and the default (unpooled) path already covers the reported bug.
+        # Two sources (issue #1900), summed per plugin: the coordinator-side registry's own boundaries — where
+        # a sequential run, and the pool's no-worker fallback, made every read — and `pooled_trust_refusals`,
+        # what a pooled run drained from its pre-fork parent session and every worker
+        # ({Runner::PoolCoordinator#merge_trust_refusals}). The count is per refused ATTEMPT, as
+        # `--workers 0` always counted it; the pool drains the parent's `#prepare` refusals before forking and
+        # each worker reports only what it added, so the workers, which inherit the parent's boundaries, do
+        # not count them again. Rows follow registry
+        # (plugin load) order, which every mode shares.
         def plugin_trust_refusal_diagnostics
           return [] if plugin_registry.empty?
 
-          plugin_registry.plugins.filter_map { |plugin| plugin_trust_refusal_diagnostic(plugin) }
+          pooled = Array(pooled_trust_refusals).to_h { |record| [record[:plugin_id], record] }
+          plugin_registry.plugins.filter_map do |plugin|
+            summary = combined_refusal_summary(pooled[disclosure_plugin_id(plugin)], plugin)
+            plugin_trust_refusal_diagnostic(plugin, summary) if summary
+          end
         end
 
         # Issue #1051 — the run-scoped plugin disclosures ({Plugin::Base#disclose_once}), the run's
@@ -1193,10 +1212,23 @@ module Rigor
           plugin.class.to_s
         end
 
-        def plugin_trust_refusal_diagnostic(plugin)
-          summary = plugin.io_boundary.refusal_summary
-          return nil if summary.nil?
+        # The coordinator's own record first when it has one: on a pooled run it holds the `#init` reads
+        # (every registry runs `#init`; the workers' drains start after it), which `--workers 0` makes before
+        # `#prepare` and before any file, so its first path is the one a sequential run names. Not so after a
+        # Ractor-backend degrade, where this record also holds the re-analysed files' refusals and is named
+        # ahead of a worker's `#prepare` path; the count is right either way.
+        def combined_refusal_summary(pooled, plugin)
+          local = begin
+            plugin.io_boundary.refusal_summary
+          rescue StandardError
+            nil
+          end
+          return local || pooled if pooled.nil? || local.nil?
+
+          local.merge(count: local[:count] + pooled[:count])
+        end
 
+        def plugin_trust_refusal_diagnostic(plugin, summary)
           plugin_id = plugin.manifest.id
           Diagnostic.new(
             path: ".rigor.yml", line: 1, column: 1,
@@ -1283,6 +1315,10 @@ module Rigor
           @pooled_run_disclosures_reader.call
         end
 
+        def pooled_trust_refusals
+          @pooled_trust_refusals_reader.call
+        end
+
         def pre_eval_diagnostics_from_scanner
           @pre_eval_diagnostics_from_scanner_reader.call
         end