rigortype 0.4.4 → 0.4.6

data/lib/rigor/analysis/runner.rb

@@ -12,6 +12,8 @@ require_relative "../cache/file_digest"
 require_relative "../cache/incremental_snapshot"
 require_relative "run_cache_key"
 require_relative "path_expansion"
+require_relative "require_relative_closure"
+require_relative "run_disclosure_credit"
 require_relative "../plugin"
 require_relative "../plugin/source_rbs_synthesis_reporter"
 require_relative "../rbs_extended/reporter"
@@ -26,6 +28,7 @@ require_relative "../effects/identity"
 require_relative "../effects/propagator"
 require_relative "../inference/parameter_inference_collector"
 require_relative "../inference/pre_eval_constants"
+require_relative "../inference/project_seed_tables"
 require_relative "../inference/scope_indexer"
 require_relative "../inference/synthetic_method_scanner"
 require_relative "../inference/project_patched_scanner"
@@ -74,7 +77,10 @@ module Rigor
                   # this and serves reused files from it without re-stamping: a run-level row is regenerated
                   # every run wherever it is positioned, and slicing the run's full stream by path cached the
                   # file-positioned ones (`effect.annotations-unchecked`, `source-rbs-*`).
-                  :per_file_diagnostics
+                  :per_file_diagnostics,
+                  # PR #2286 review M1 — the ADR-16 index this run's pre-pass built; `IncrementalSession` digests it
+                  # to tell when a class-body DSL edit moved what a served file's dispatch read.
+                  :synthetic_method_index
 
       # Issues #796 / #794 — the two run-level rows a NARROWED run cannot re-derive from the files it
       # analyses: the `definition-build-failed` set (whose producer is the analysis's own demand, and #696
@@ -98,6 +104,23 @@ module Rigor
         pooled.empty? ? @file_dependencies : @file_dependencies.merge(pooled)
       end
 
+      # Issue #1553 — the plugin reads ({Plugin::IoBoundary.attributing}) each file's analysis made this run,
+      # `{path => [row]}`, reconciled from the sequential and pooled halves exactly as {#file_dependencies} is.
+      # Empty unless `record_dependencies: true`; a file whose analysis read nothing has no key. The incremental
+      # session keeps them beside each file's cached rows so a later recheck re-analyses the file once one of
+      # them goes stale.
+      def analysis_reads
+        pooled = @pool_coordinator.collected_analysis_reads
+        pooled.empty? ? @analysis_reads : @analysis_reads.merge(pooled)
+      end
+
+      # Issue #2020 — `{path => [run-disclosure record]}`, the run-scoped rows each analysed file's plugin hooks
+      # registered ({RunDisclosureCredit}), sequential and pooled alike; empty unless `record_dependencies:`.
+      def analysis_disclosures
+        pooled = @pool_coordinator.collected_analysis_disclosures
+        pooled.empty? ? @analysis_disclosures : @analysis_disclosures.merge(pooled)
+      end
+
       # ADR-103 — the run's propagated effect graph, or {Effects::EffectTable.empty} when collection did
       # not run. Reconciled from the sequential and pooled halves exactly as {#file_dependencies} is, then
       # closed by the post-pool fixpoint in {#assemble_run_diagnostics}.
@@ -283,10 +306,11 @@ module Rigor
       #   worker continues to build its own Environment.
       # @param discovery_seed — issue #260 — opt-in cross-file discovery tables, keyed by
       #   {Scope::DiscoveryIndex} slot name, seeded onto every per-file scope through
-      #   `project_scope_seed_tables`. The ONE deliberate exception to "a `prebuilt:` runner carries no
-      #   discovery tables": {Protection::DiagnosticOracle} threads the table set Tier 2's site filter already
-      #   judges anchors against, so a site admitted because a sibling-file class resolved is also a site the
-      #   oracle can kill at. nil (the default) leaves the prebuilt/LSP contract byte-identical.
+      #   `project_scope_seed_tables`. A `prebuilt:` runner computes no discovery tables of its own, so this is
+      #   how one learns the project: {Protection::DiagnosticOracle} threads the table set Tier 2's site filter
+      #   already judges anchors against, and (issue #2147, ADR-124) the LSP's per-buffer publish threads
+      #   `LanguageServer::ProjectContext#discovery_seed_for`, so a class another file declares is not an
+      #   external ancestor there. nil (the default) seeds nothing.
       # @param no_tolerated_effects — ADR-103 WD1 / #385 — `rigor check --no-tolerated-effects`.
       #   Judges effect envelopes as if `effects.tolerated:` were empty. A judgment-time switch only: the
       #   run, its collection and its cache identity are unchanged.
@@ -298,7 +322,7 @@ module Rigor
                      seed_bundles: nil, collect_seed_bundles: false, param_inferred_types: nil,
                      discovery_seed: nil, no_tolerated_effects: false,
                      restored_run_level_rows: nil, served_per_file_diagnostics: nil, served_effect_collections: nil,
-                     on_file_indexed: nil)
+                     served_run_disclosures: nil, on_file_indexed: nil)
         @configuration = configuration
         # ADR-113 WD2 — `rigor lens` reads a target's seeded index here: called with `(path, parse_result, scope,
         # index)` for every file this process indexes, after its rules ran and inside the run window, so the reader
@@ -316,6 +340,9 @@ module Rigor
         # effect graph this run closes (and the envelope pass judges) spans the whole project, not just the closure.
         # Never part of {#effect_collections_by_path}, which stays what THIS run collected. Empty on every other run.
         @served_effect_collections = served_effect_collections || {}
+        # Issue #2020 — the run-scoped plugin rows ({RunDisclosureCredit}) those unanalysed files registered when
+        # they were last analysed, emitted beside this run's own registrations. Empty on every other run.
+        @served_run_disclosures = served_run_disclosures || []
         @explain = explain
         @cache_store = enforce_read_only_cache(cache_store, buffer)
         @plugin_requirer = plugin_requirer
@@ -371,6 +398,7 @@ module Rigor
         # rows as they stood around the per-file loop; see {#incremental_slot_rows}. Recorded only by a
         # dependency-recording (incremental) run.
         @analysis_reads = {}
+        @analysis_disclosures = {}
         @pre_analysis_plugin_rows = nil
         @post_analysis_plugin_rows = nil
         # Memoised activation decision for the `call.self-undefined-method` rule (nil = not yet computed).
@@ -464,6 +492,9 @@ module Rigor
         @project_struct_member_layouts = {}.freeze
         # Issue #684 — set per run by {#project_discovery_expansion}; nil on every path that does not widen.
         @project_discovery_expansion = nil
+        # Issue #1583 — whether this run widened its discovery to the configured paths, even when the widening
+        # added no file; {#discovery_glob_entries} lists the configured roots for every such run.
+        @discovery_widened = false
         # ADR-67 WD6a — the call-site parameter-inference table, populated by the opt-in pre-pass in
         # `assemble_run_diagnostics` when `parameter_inference:` is enabled, then seeded onto every per-file
         # scope (sequential + fork-worker) through `project_scope_seed_tables`. Empty by default, so the gate-off
@@ -507,6 +538,16 @@ module Rigor
         end
       end
 
+      # ADR-45 WD2 (#1507) / #2020 — the per-run reset of what each file's analysis is credited with: its plugin
+      # reads, its run-scoped plugin registrations, and the boundary rows around the per-file loop.
+      def reset_analysis_attribution
+        @analysis_reads = {}
+        @analysis_disclosures = {}
+        @pre_analysis_plugin_rows = nil
+        @post_analysis_plugin_rows = nil
+      end
+      private :reset_analysis_attribution
+
       def run_analysis(paths)
         Inference::MethodDispatcher::FileFolding.fold_platform_specific_paths =
           @configuration.fold_platform_specific_paths
@@ -518,6 +559,7 @@ module Rigor
 
         expansion = expand_paths(paths)
         @project_discovery_expansion = project_discovery_expansion(paths, expansion)
+        @discovery_widened = widen_discovery_to_project?(paths)
         @snapshots.reset_for_run
         # Per-run reset of the deferred-discovery memo (see `#ensure_project_discovery`).
         @project_discovery_done = false
@@ -533,9 +575,7 @@ module Rigor
         # #788 — the per-file reader is assigned only on the analysis (miss) path; reset it here so a run the
         # ADR-45 result cache serves does not answer with the previous run's rows.
         @per_file_diagnostics = [].freeze
-        @analysis_reads = {}
-        @pre_analysis_plugin_rows = nil
-        @post_analysis_plugin_rows = nil
+        reset_analysis_attribution
         # ADR-84 WD2 — roll the return-memo bucket: a fresh frozen token per run makes every per-file scope
         # of THIS run share one memo bucket while entries from any earlier run in this process (stale after
         # an edit) become unreachable.
@@ -599,6 +639,19 @@ module Rigor
         expand_paths(paths).fetch(:files)
       end
 
+      # Issue #1583 — the project files a run over `paths` would DISCOVER without analysing them (#684's
+      # widening), by globbing only. Empty whenever the run would not widen, which includes every run over
+      # the configured `paths:`. {IncrementalSession} digests them, because an edit to one moves the
+      # diagnostics of the files it does analyse.
+      def discovery_only_file_set(paths = @configuration.paths)
+        expansion = expand_paths(paths)
+        widened = project_discovery_expansion(paths, expansion)
+        return [] if widened.nil?
+
+        analysed = expansion.fetch(:files).to_set
+        widened.fetch(:files).reject { |path| analysed.include?(path) }
+      end
+
       # ADR-46 §2 — inverts {#file_dependencies} into the reverse edge the incremental step walks:
       # `dependents[X] = { A : A read a declaration / body from X }`. On an edit to X, the body tier
       # (slice 2) re-analyses `{X} ∪ dependents[X]` and serves every other file from the per-file cache.
@@ -791,6 +844,7 @@ module Rigor
         @project_discovery_done = false
         # This entry point supplies its own expansion; it never widens (see {#project_discovery_expansion}).
         @project_discovery_expansion = nil
+        @discovery_widened = false
         @run_generation = Object.new.freeze
         run_project_pre_passes(expansion: expansion)
         ensure_project_discovery(expansion)
@@ -1385,13 +1439,13 @@ module Rigor
       end
 
       def build_run_dependency_descriptor(expansion, rbs_descriptor)
-        entries = analyzed_file_entries(expansion) + discovery_file_entries(expansion) +
+        entries = analyzed_file_entries(expansion) + discovery_file_entries(expansion) + required_missing_entries +
                   pre_eval_file_entries + template_unit_file_entries + rbs_descriptor.files +
                   root_presence_entries(expansion)
         # #979 — the signature ROOTS' listings, one glob row each. `rbs_descriptor.files` covers only the
         # `.rbs` files that existed while the run read them, so without these a signature file written after
         # the run left the slot validating fresh and the warm run answered without it.
-        globs = rbs_descriptor.globs + template_unit_glob_entries
+        globs = rbs_descriptor.globs + template_unit_glob_entries + discovery_glob_entries
         boundary = plugin_boundary_rows
         entries.concat(boundary.files)
         globs.concat(boundary.globs).concat(producer_watch_glob_entries)
@@ -1406,7 +1460,7 @@ module Rigor
       # auto-detected `sig`: the loader reads a directory and a file differently, and #979's listing rows cover a
       # file appearing under a root that existed, not the root appearing. A kind row rather than an existence row,
       # because a directory replaced by a file of the same name leaves an existence row fresh. The `--incremental`
-      # slot records existence rows for the same paths ({#incremental_slot_rows}, {#baseline_dependency_rows}).
+      # slot records kind rows for the same paths ({#incremental_slot_rows}, {#baseline_dependency_rows}, #1977).
       def root_presence_entries(expansion)
         (expansion.fetch(:roots) + @configuration.pre_eval + signature_root_candidates)
           .uniq.map { |path| Cache::Descriptor::FileEntry.kind(path: path) }
@@ -1452,11 +1506,11 @@ module Rigor
       #   globs, which a producer replays into its boundary whether it computed or was served (#1558). A save
       #   after the read leaves the row stale, so no guard is needed.
       # - `derived` — rows taken when the run ENDS: the template files and their claimed globs (#392, re-analysed
-      #   every run), and one existence row per analysis root and per `pre_eval:` entry. A run's path errors (`no
-      #   such file or directory`, `pre-eval.file-not-found`) answer to those last rows; the plain slot records
-      #   neither, and the incremental path regenerates the errors every run, so a slot that served one past the
-      #   edit that retracts it would print what no run of that tree prints. Existence rows carry ADR-45 WD1b's
-      #   bound: a directory replaced by a file of the same name stays fresh.
+      #   every run), and one `:kind` row per analysis root and per `pre_eval:` entry. A run's path errors (`no
+      #   such file or directory`, `not a Ruby file`, `pre-eval.file-not-found`) answer to those last rows, and the
+      #   incremental path regenerates the errors every run, so a slot that served one past the edit that retracts
+      #   it would print what no run of that tree prints. A kind row rather than an existence row (#1977): an
+      #   existence row reads a directory replaced by a file of the same name as fresh, ADR-45 WD1b's bound.
       # - `by_file` — `{path => Descriptor}`, the plugin reads each file's analysis made
       #   ({Plugin::IoBoundary.attributing}). A narrowed run analyses only its closure, so the session carries the
       #   other files' reads forward from the previous slot.
@@ -1480,7 +1534,8 @@ module Rigor
         IncrementalSlotRows.new(
           observed: plugin_boundary_rows,
           derived: Cache::Descriptor.new(
-            files: template_unit_file_entries + existence_entries(Array(roots) + @configuration.pre_eval),
+            files: template_unit_file_entries + kind_entries(Array(roots) + @configuration.pre_eval) +
+                   required_missing_entries,
             globs: template_unit_glob_entries
           ),
           by_file: @analysis_reads.transform_values do |reads|
@@ -1507,13 +1562,14 @@ module Rigor
       # which the session therefore carries unchanged from the full run that recorded them to every later slot:
       #
       # - the signature tree the plain slot records (`RbsDescriptor.file_entries` / `.glob_entries` over the loader
-      #   roots this run's analysis resolved), and an existence row per signature root, configured or the
-      #   auto-detected `sig` — a recheck rebuilds no environment unless its closure is non-empty, and the snapshot
-      #   fingerprint digests the same roots (configured, or the auto-detected `sig`), so a change to one drops the
-      #   snapshot and forces a full run rather than reaching a recheck;
+      #   roots this run's analysis resolved), and a `:kind` row per signature root, configured or the
+      #   auto-detected `sig` — a recheck rebuilds no environment unless its closure is non-empty. The snapshot
+      #   fingerprint digests the same roots, so a change to one makes the next full-path run a full run rather
+      #   than a recheck, but the engine-free slot probe serves before any fingerprint is consulted: a root that
+      #   turns from a file into a directory (or back) is declined there by this `:kind` row alone (#1977);
       # - the discovered-not-analysed files (#684) and a listing row per discovery root — a narrowed recheck does
       #   not widen discovery at all;
-      # - every `pre_eval:` file outside `files` (a stat row, or an absence row) — the session tracks only analysed
+      # - every `pre_eval:` file outside `files` (a stat row, or a kind row) — the session tracks only analysed
       #   files, and one that is analysed is guarded by its own row.
       #
       # Recomputing any of these on a recheck would vouch for the tree the recheck saw while its answer still
@@ -1537,8 +1593,9 @@ module Rigor
         own, pinned = signature_rows
         BaselineRows.new(
           owned: Cache::Descriptor.new(
-            files: own.files + existence_entries(signature_root_candidates) +
-                   discovery_file_entries({ files: files }) + unanalysed_pre_eval_entries(files),
+            files: own.files + kind_entries(signature_root_candidates) +
+                   discovery_file_entries({ files: files }) + required_missing_entries +
+                   unanalysed_pre_eval_entries(files),
             globs: (own.globs + discovery_glob_entries).uniq
           ),
           pinned: pinned
@@ -1563,16 +1620,18 @@ module Rigor
 
       # The project's own signature roots, whether or not they exist: the configured `signature_paths:`, or the
       # `sig` directory `Environment.default_signature_paths` auto-detects when none are configured. The
-      # signature rows' listing rows cover a file appearing under a root that existed; only an existence row
-      # covers the root itself appearing.
+      # signature rows' listing rows cover a file appearing under a root that existed; only a row for the root
+      # itself covers it appearing.
       def signature_root_candidates
         @configuration.signature_paths || ["sig"]
       end
 
       # One names-mode listing row per directory the discovery widening globbed, so a file appearing there is seen
-      # as well as an edit to one that existed.
+      # as well as an edit to one that existed. Issue #1583 — keyed on the widening decision, not on what it
+      # added: a run over `lib/b.rb` alone in `lib` widens to nothing, and a `lib/a.rb` created afterwards must
+      # still move the answer of the run-result cache and the `--incremental` slot.
       def discovery_glob_entries
-        return [] if @project_discovery_expansion.nil?
+        return [] unless @discovery_widened
 
         @configuration.paths.select { |root| File.directory?(root) }.map do |root|
           Cache::Descriptor::GlobEntry.compute(root: root, pattern: PathExpansion::RUBY_GLOB, mode: :names)
@@ -1586,22 +1645,18 @@ module Rigor
           if File.file?(path)
             Cache::Descriptor::FileEntry.stat(path: path, digest: Cache::FileDigest.hexdigest(path))
           else
-            existence_entries([path]).first
+            kind_entries([path]).first
           end
         end
       end
 
-      def existence_entries(paths)
+      # #1977 — one `:kind` row per path, the row {#root_presence_entries} records in the plain slot.
+      def kind_entries(paths)
         paths.uniq.map do |path|
-          physical = @buffer ? @buffer.resolve(path) : path
-          if File.exist?(physical)
-            Cache::Descriptor::FileEntry.present(path: physical)
-          else
-            Cache::Descriptor::FileEntry.absent(path: physical)
-          end
+          Cache::Descriptor::FileEntry.kind(path: @buffer ? @buffer.resolve(path) : path)
         end
       end
-      private :plugin_boundary_rows, :producer_watch_glob_entries, :existence_entries, :root_presence_entries,
+      private :plugin_boundary_rows, :producer_watch_glob_entries, :kind_entries, :root_presence_entries,
               :analysis_reads_attributed?, :signature_root_candidates, :discovery_glob_entries,
               :unanalysed_pre_eval_entries, :signature_rows, :within?
 
@@ -1780,20 +1835,19 @@ module Rigor
       end
 
       # Internal: builds the deferred cross-file discovery tables at most once per run and adopts them.
-      # Memoised on `@project_discovery_done` (reset at the start of `#run`). No-op under `@prebuilt` — the
-      # LSP path deliberately seeds an empty project scope from a snapshot that carries no discovery tables,
-      # so forcing a build there would change that contract. A caller that DOES want cross-file knowledge under
-      # `prebuilt:` supplies it explicitly through `discovery_seed:` (issue #260) rather than by re-walking the
-      # project here. Called eagerly from `#run` for the recording /
-      # subset (ADR-46) modes and lazily from `#assemble_run_diagnostics` on the analysis path, so a warm
-      # cache HIT (which never assembles) never pays the double parse.
+      # Memoised on `@project_discovery_done` (reset at the start of `#run`). No-op under `@prebuilt`: the
+      # snapshot carries no discovery tables, and a per-request re-walk of the project is what `prebuilt:` exists
+      # to avoid. A caller that wants cross-file knowledge under `prebuilt:` supplies it through `discovery_seed:`
+      # (issue #260), as the LSP publish does since issue #2147 (ADR-124). Called eagerly from `#run` for the
+      # recording / subset (ADR-46) modes and lazily from `#assemble_run_diagnostics` on the analysis path, so a
+      # warm cache HIT (which never assembles) never pays the double parse.
       def ensure_project_discovery(expansion)
         return if @prebuilt
         return if @project_discovery_done
 
         @project_discovery_done = true
         # Issue #684 — the cross-file index spans the PROJECT even when the analysis targets a file list.
-        expansion = @project_discovery_expansion || once_each(expansion)
+        expansion = buffer_spelled(@project_discovery_expansion || once_each(expansion))
         if @collect_seed_bundles
           # ADR-85 WD2 — rebuild discovery from the prior run's bundles (re-walking only changed files) and
           # capture the refreshed bundle set for the session to persist.
@@ -1825,23 +1879,71 @@ module Rigor
       # on what else was on the command line.
       #
       # Excluded, each because its expansion is already the one it means: the LSP `prebuilt:` path (which
-      # seeds discovery from a snapshot), editor `buffer:` mode, `run_source`'s in-memory single file, and
-      # ADR-46's `analyze_only` subset mode (which already passes the full expansion and filters later).
+      # seeds discovery from a snapshot, ADR-124) and `run_source`'s in-memory single file.
+      #
+      # Issue #2165 — editor `buffer:` mode (`rigor check --tmp-file T --instead-of F F`) widens like a plain run.
+      # It was excluded on the reading that its expansion is already the one it means, but an editor passes the
+      # buffer's own path, so discovery saw that file alone: every class another file declares read as an external
+      # ancestor, and the run reported what `rigor check F` does not. The discovery pre-pass reads through the
+      # binding, so the buffer's file is walked from the buffer's bytes.
+      #
+      # Issue #1583 — ADR-46's `analyze_only` subset mode widens like a full run. It was excluded on the
+      # reading that it "already passes the full expansion", which holds only when the incremental session
+      # runs over the configured `paths:`. `rigor check --incremental lib/b.rb` passes the argument's
+      # expansion, so its rechecks (and `--verify-incremental`'s partitions) discovered the argument alone
+      # while its baseline discovered the project, and `lib/b.rb`'s report on a sibling's constant came and
+      # went with the run kind.
       #
       # Issue #1556 — the widened set holds each FILE once. `.rigor.yml`'s `paths:` load as absolute paths and a
       # path argument usually does not, so `rigor check lib` widened discovery over both spellings of every file:
       # the pre-pass then saw two writers for every constant a file declares and withheld its publication (#644),
       # and every file was a discovered-not-analysed dependency of the run's cache entry.
       #
+      # Issue #2021 — an analysed file outside the configured paths has no project there, so the widened set also
+      # holds what it loads with a literal `require_relative` ({#required_outside_paths}). A plugin file checked on
+      # its own otherwise missed its sibling's nested `Effects` and resolved the project's `Rigor::Effects`.
+      #
       # The widening decision itself compares the paths as spelled. `exclude:` patterns apply to both spellings
       # alike (#1576), so the configured absolute `lib` and the argument `lib` exclude the same files.
       def project_discovery_expansion(paths, expansion)
         return nil unless widen_discovery_to_project?(paths)
 
         analysed = expansion.fetch(:files)
-        files = discovery_files(expand_paths(@configuration.paths | paths).fetch(:files), analysed)
+        project = expand_paths(@configuration.paths | paths).fetch(:files)
+        walked = required_outside_paths(analysed)
+        files = discovery_files(project + walked.found, analysed)
         # Overlapping arguments (`lib lib/user.rb`) name an analysed file twice; the widened set names it once.
-        files.size > analysed.uniq { |path| File.absolute_path(path) }.size ? { files: files, errors: [] } : nil
+        return nil unless files.size > analysed.uniq { |path| File.absolute_path(path) }.size || walked.missing.any?
+
+        { files: files, errors: [], uncertain: walked.found.to_set.freeze, missing: walked.missing }
+      end
+
+      # Issue #2021 — what the analysed files outside the configured `paths:` load with a literal `require_relative`,
+      # through targets that are themselves outside them ({RequireRelativeClosure}). A file under a configured path
+      # is discovered already, so the walk adds nothing for a run whose files all lie inside them. The comparison is
+      # by real path, so a symlinked spelling of a configured file does not join discovery a second time (two
+      # writers would withhold its constants, #644). `exclude:` drops a target from discovery as it drops a
+      # configured file; the walk still follows what an excluded target requires.
+      #
+      # The found files are discovered as `uncertain` ({Analysis::Runner::ProjectPrePasses#uncertain_paths}): the walk
+      # sees one entry point's load graph, and a file it does not reach may redefine what they define.
+      def required_outside_paths(analysed)
+        roots = @configuration.paths.map { |root| RequireRelativeClosure.real_path(root) }
+        covered = ->(real) { roots.any? { |root| real == root || real.start_with?(File.join(root, "")) } }
+        seeds = analysed.reject { |path| covered.call(RequireRelativeClosure.real_path(path)) }
+        return RequireRelativeClosure::Result.new(found: [], missing: []) if seeds.empty?
+
+        read = ->(path) { File.read(@buffer ? @buffer.resolve(path) : path) }
+        walked = RequireRelativeClosure.closure(seeds, covered: covered, read: read)
+        walked.with(found: PathExpansion.reject_excluded(walked.found, @configuration.exclude_patterns,
+                                                         base: @configuration.exclude_base))
+      end
+
+      # Issue #2021 — a kind row per `require_relative` target the walk named and found absent: a file appearing
+      # there joins the discovery, so it moves the answer of the run-result cache and the `--incremental` slot.
+      def required_missing_entries
+        missing = @project_discovery_expansion&.fetch(:missing, nil)
+        missing.nil? || missing.empty? ? [] : kind_entries(missing)
       end
 
       # The expansion with each file once, first spelling kept: overlapping arguments (`lib ./lib`) that do not
@@ -1853,6 +1955,23 @@ module Rigor
         unique.size == files.size ? expansion : expansion.merge(files: unique)
       end
 
+      # Issue #2165 — the discovery set with the buffer's file under the binding's own spelling, once. The binding
+      # substitutes bytes only for a path spelled exactly as its logical path, while the file can reach discovery as
+      # the argument's spelling, the configured one, or through a symlink; each of those read it from disk, and a
+      # second spelling made it a second declarer. Every member whose real path is the buffer's file is replaced by
+      # the logical path, and the duplicates that leaves are dropped (`IncrementalSession#rebind_buffer` is option
+      # B's counterpart).
+      def buffer_spelled(expansion)
+        return expansion if @buffer.nil?
+
+        target = Analysis::BufferBinding.real_path(@buffer.logical_path)
+        files = expansion.fetch(:files)
+        spelled = files.map do |path|
+          Analysis::BufferBinding.real_path(path) == target ? @buffer.logical_path : path
+        end.uniq
+        spelled == files ? expansion : expansion.merge(files: spelled)
+      end
+
       # Each file once, in project order, under the spelling the analysis uses when it is analysed.
       def discovery_files(project_files, analysed_files)
         spelling = analysed_files.to_h { |path| [File.absolute_path(path), path] }
@@ -1864,8 +1983,7 @@ module Rigor
       end
 
       def widen_discovery_to_project?(paths)
-        @prebuilt.nil? && @buffer.nil? && @in_memory_sources.nil? && @analyze_only.nil? &&
-          paths != @configuration.paths
+        @prebuilt.nil? && @in_memory_sources.nil? && paths != @configuration.paths
       end
 
       # ADR-46 — the dependency-recording and subset-analysis modes read the discovery tables OUTSIDE the
@@ -1879,7 +1997,8 @@ module Rigor
 
       private :run_project_pre_passes, :adopt_prebuilt_project_scan, :apply_pre_passes_result,
               :apply_discovery_result, :ensure_project_discovery, :force_eager_discovery?,
-              :project_discovery_expansion, :discovery_files, :once_each, :widen_discovery_to_project?
+              :project_discovery_expansion, :discovery_files, :once_each, :widen_discovery_to_project?,
+              :required_outside_paths, :required_missing_entries
 
       # Ruby versions probed (ascending) to discover the lowest one this Prism build accepts for
       # `version:`. Prism exposes no version list, so the floor is found empirically — only when a
@@ -2069,6 +2188,7 @@ module Rigor
           hkt_scan_failure_snapshot: -> { @snapshots.hkt_scan_failure },
           conformance_results_snapshot: -> { @snapshots.conformance_results },
           pooled_run_disclosures: -> { @pool_coordinator.collected_run_disclosures },
+          served_run_disclosures: -> { @served_run_disclosures },
           pooled_trust_refusals: -> { @pool_coordinator.collected_trust_refusals }
         )
       end
@@ -2216,10 +2336,8 @@ module Rigor
           # client editing a brand-new file.
           elsif accept_as_ruby_file?(path)
             files << path
-          elsif File.exist?(path)
-            bad << [path, "not a Ruby file (expected `.rb` or a directory)"]
           else
-            bad << [path, "no such file or directory"]
+            bad << [path, PathExpansion.unusable_message(path)]
           end
         end
         { files: files, roots: Array(paths).map(&:to_s), errors: path_expansion_errors(bad, any_files: files.any?) }
@@ -2229,27 +2347,24 @@ module Rigor
       # app lib` with no `lib/` (the 20260620 field trial's strap case) analyses `app` instead of aborting
       # on exit 1. A bad path that leaves NOTHING to analyse stays an error so a lone typo (`rigor check
       # typo.rb`) is not silently masked (the regression the path-error check was added to catch in the
-      # first place).
+      # first place). The wording and grading live in {PathExpansion.diagnostics}, shared with `sig-gen` (#1991).
       def path_expansion_errors(bad, any_files:)
-        severity = any_files ? :warning : :error
-        suffix = any_files ? " (skipped)" : ""
-        bad.map { |path, message| path_error(path, "#{message}#{suffix}", severity: severity) }
+        PathExpansion.diagnostics(bad, any_files: any_files)
       end
 
+      # #2191 — the buffer's logical path is accepted under any spelling that names the same file (relative, absolute,
+      # or through a symlinked root), since the discovery set respells it to the logical path (`buffer_spelled`).
       def accept_as_ruby_file?(path)
         (File.file?(path) && path.end_with?(".rb")) ||
-          (@buffer && path == @buffer.logical_path) ||
+          buffer_path?(path) ||
           @in_memory_sources&.key?(path)
       end
 
-      def path_error(path, message, severity: :error)
-        Diagnostic.new(
-          path: path,
-          line: 1,
-          column: 1,
-          message: message,
-          severity: severity
-        )
+      def buffer_path?(path)
+        return false if @buffer.nil?
+
+        path == @buffer.logical_path ||
+          Analysis::BufferBinding.real_path(path) == Analysis::BufferBinding.real_path(@buffer.logical_path)
       end
 
       # Reads + parses the source at `path`. Under editor mode (`@buffer` set) reads bytes from
@@ -2425,50 +2540,21 @@ module Rigor
         tables[:published_constant_names] = names unless names.empty?
       end
 
-      # Issue #617 — the censused names that bind, grouped by last segment (`Scope#bound_constant_names`). A
-      # name some write other than a memo `||=` touches always binds. A memo-only name binds once memos of its
-      # segment span two files: either may load first and set the constant the other then reads, so only a
-      # memo no other file shares keeps the idiom's reading. Files are counted expanded, because discovery can
-      # walk one file under two spellings (`lib/b.rb`, `./lib/b.rb`).
+      # Issue #617 / #1290 — the binding and shadowing constant names, by last segment; derived by
+      # {Inference::ProjectSeedTables}, which the seed paths that run no `check` share.
       def constant_writer_index
-        @constant_writer_index ||= begin
-          memo_files = memo_files_by_segment
-          @project_constant_writes.each_with_object({}) do |(name, by_path), index|
-            segment = name.split("::").last
-            next if memo_only?(by_path) && memo_files.fetch(segment).size < 2
-
-            (index[segment] ||= []) << name
-          end.each_value(&:freeze).freeze
-        end
+        @constant_writer_index ||= Inference::ProjectSeedTables.constant_writers(@project_constant_writes)
       end
 
-      # Issue #1290 — the censused names some write other than a memo `||=` assigns, grouped by last segment
-      # (`Scope#shadowing_constant_names`): the ones that exist whether or not an outer constant of the name
-      # does, and so stop the lexical ladder above it. A memo-only name is left out however many files memoize
-      # it, unlike in {#constant_writer_index}: `X ||= v` resolves `X` through the very lookup whose lower rung
-      # the stop would replace, so wherever that rung answers, the memo finds it and never creates the name.
       def constant_shadower_index
-        @constant_shadower_index ||= @project_constant_writes.each_with_object({}) do |(name, by_path), index|
-          (index[name.split("::").last] ||= []) << name unless memo_only?(by_path)
-        end.each_value(&:freeze).freeze
+        @constant_shadower_index ||= Inference::ProjectSeedTables.constant_shadowers(@project_constant_writes)
       end
 
-      def memo_files_by_segment
-        @project_constant_writes.each_with_object({}) do |(name, by_path), files|
-          set = (files[name.split("::").last] ||= Set.new)
-          by_path.each { |path, descriptor| set << File.absolute_path(path) if memo_descriptor?(descriptor) }
-        end
-      end
-
-      def memo_only?(by_path) = by_path.each_value.all? { |descriptor| memo_descriptor?(descriptor) }
-      def memo_descriptor?(descriptor) = descriptor == Inference::ScopeIndexer::CONSTANT_MEMO
-
       # Issue #644 — the LAST SEGMENTS of the published table, the run-wide half of
       # `Scope#published_constant?`. Seeded on EVERY run (unlike `constant_sources`, which only a recording
       # run needs) because {CheckRules::PublishedConstantGuard} asks the question on every `if` / `unless`.
       def published_constant_name_set
-        @published_constant_name_set ||=
-          @project_constant_values.keys.to_set { |name| name.split("::").last }.freeze
+        @published_constant_name_set ||= Inference::ProjectSeedTables.published_constant_names(@project_constant_values)
       end
 
       # Issue #644 — the seeded `in_source_constants` table, joining the two cross-file constant producers.
@@ -2477,12 +2563,31 @@ module Rigor
       # widener erases it to the class, and listing a file under `pre_eval:` must never LOSE precision. The
       # per-file table still wins over both (`ScopeIndexer.index`'s merge) — same-file stays the most
       # specific authority.
+      #
+      # ADR-124 — a `prebuilt:` runner computes no literal table of its own; a `discovery_seed:` (the editor
+      # publish, ADR-124) brings the project's, which then plays the same part.
       def merged_seed_constants
         pre_eval = publishable_pre_eval_constants
-        return @project_constant_values if pre_eval.empty?
-        return pre_eval if @project_constant_values.empty?
+        literal = literal_seed_constants
+        return literal if pre_eval.empty?
+        return pre_eval if literal.empty?
+
+        pre_eval.merge(literal).freeze
+      end
+
+      # The project's literal constant table: this run's, or the one a `discovery_seed:` carries (ADR-124).
+      def literal_seed_constants
+        return @project_constant_values unless @project_constant_values.empty? && @discovery_seed
+
+        @discovery_seed.fetch(:in_source_constants, @project_constant_values)
+      end
+
+      # The per-name writer paths the #663 retraction reads: this run's census, or the one a `discovery_seed:` carries
+      # (ADR-124).
+      def constant_writer_sources
+        return @project_constant_sources unless @project_constant_sources.empty? && @discovery_seed
 
-        pre_eval.merge(@project_constant_values).freeze
+        @discovery_seed.fetch(:constant_sources, @project_constant_sources)
       end
 
       # Issue #663 — the `pre_eval:` publication with every name an UNLISTED file also assigns retracted.
@@ -2511,8 +2616,9 @@ module Rigor
       # name of its own for the wildcard's paths to have been folded into.
       def unlisted_constant_writer?(name, listed)
         segment = name.split("::").last
-        writers = @project_constant_sources[name]
-        wildcard = @project_constant_sources["#{Inference::ScopeIndexer::DYNAMIC_TARGET_PREFIX}#{segment}"]
+        sources = constant_writer_sources
+        writers = sources[name]
+        wildcard = sources["#{Inference::ScopeIndexer::DYNAMIC_TARGET_PREFIX}#{segment}"]
         [writers, wildcard].any? do |paths|
           paths&.any? { |path| !listed.include?(File.absolute_path(path)) }
         end
@@ -2556,13 +2662,18 @@ module Rigor
         @pre_analysis_plugin_rows ||= plugin_boundary_rows
         reads = []
         diagnostics = nil
-        record = Plugin::IoBoundary.attributing(reads) do
-          DependencyRecorder.record_for(path) do
-            diagnostics = analyze_with_effects(path, environment)
+        record = nil
+        # Issue #2020 — and every run-scoped row its analysis registered, with the registering plugins' reads.
+        disclosures = RunDisclosureCredit.collect do
+          record = Plugin::IoBoundary.attributing(reads) do
+            DependencyRecorder.record_for(path) do
+              diagnostics = analyze_with_effects(path, environment)
+            end
           end
         end
         @file_dependencies[path] = record
         @analysis_reads[path] = reads unless reads.empty?
+        @analysis_disclosures[path] = disclosures unless disclosures.empty?
         diagnostics
       end