rigortype 0.4.4 → 0.4.6

data/lib/rigor/analysis/severity_stamp.rb

@@ -19,6 +19,9 @@ module Rigor
     # `plugin.<id>`, never to a bare id or `all`. The run-level rows outside the check-rule catalogue
     # (`rbs.coverage.*`, `dynamic.dependency-source.*`, the plugin loader, `plugin_trust.*`, `pool-degraded`) keep
     # answering to `severity_overrides:` only, by any spelling.
+    # Issue #1985 — `severity_overrides:` follows the same rule: a plugin's row answers to its qualified id or
+    # `plugin.<id>`, never to its bare rule or a family wildcard; the plugin loader's rows answer to
+    # `plugin_loader.<rule>` first and to their bare `load-error` / `runtime-error` after it.
     #
     # Extracted (ADR-87 WD4) so the miss path ({Runner::DiagnosticAggregator}) and the boot-slimming hit path
     # ({RunCacheProbe}, which never loads the aggregator) apply the IDENTICAL final filter — a warm HIT's
@@ -52,11 +55,19 @@ module Rigor
         diagnostic.source_family == Diagnostic::DEFAULT_SOURCE_FAMILY && CHECK_RULES.include?(diagnostic.rule)
       end
 
+      # `plugin.<id>` for a row a plugin emitted, nil for every other row.
+      def plugin_family(diagnostic)
+        family = diagnostic.source_family.to_s
+        family if family.start_with?(CheckRules::PLUGIN_FAMILY_PREFIX)
+      end
+
       def stamp(diagnostic, configuration)
         return diagnostic if diagnostic.rule.nil?
 
         resolved = Configuration::SeverityProfile.resolve(
           rule: diagnostic.rule,
+          qualified_rule: diagnostic.qualified_rule,
+          plugin_family: plugin_family(diagnostic),
           authored_severity: diagnostic.severity,
           profile: configuration.severity_profile,
           overrides: configuration.severity_overrides,

data/lib/rigor/analysis/worker_session.rb

@@ -20,6 +20,7 @@ require_relative "../inference/method_dispatcher/file_folding"
 require_relative "check_rules"
 require_relative "crash_signature"
 require_relative "dependency_recorder"
+require_relative "run_disclosure_credit"
 require_relative "dependency_source_inference"
 require_relative "diagnostic"
 require_relative "erb_template_detector"
@@ -170,8 +171,18 @@ module Rigor
         return analyze_with_effects(path) unless @record_dependencies
 
         diagnostics = nil
-        record = DependencyRecorder.record_for(path) { diagnostics = analyze_with_effects(path) }
+        reads = []
+        record = nil
+        # Issue #2020 — and the run-scoped rows it registered, as `Runner#analyze_file` keeps them.
+        disclosures = RunDisclosureCredit.collect do
+          record = Plugin::IoBoundary.attributing(reads) do
+            DependencyRecorder.record_for(path) { diagnostics = analyze_with_effects(path) }
+          end
+        end
         @file_dependencies[path] = record
+        # Issue #1553 — the plugin reads this file's analysis made, as `Runner#analyze_file` keeps them.
+        (@analysis_reads ||= {})[path] = reads unless reads.empty?
+        (@analysis_disclosures ||= {})[path] = disclosures unless disclosures.empty?
         diagnostics
       end
 
@@ -309,6 +320,18 @@ module Rigor
         @file_dependencies
       end
 
+      # Issue #1553 — the plugin reads ({Plugin::IoBoundary.attributing}) each `#analyze` call's file made (empty
+      # unless `record_dependencies:` was set). The rows are value objects of frozen Strings, so they marshal back.
+      def drain_analysis_reads
+        @analysis_reads || {}
+      end
+
+      # Issue #2020 — the run-scoped rows each file's analysis registered, `{path => [record]}`; see
+      # {RunDisclosureCredit}. Marshal-clean like {#drain_run_disclosures}.
+      def drain_analysis_disclosures
+        @analysis_disclosures || {}
+      end
+
       # ADR-103 WD12 — the per-file {Effects::FileCollection}s this session collected (empty unless the
       # configuration carries an `effects:` block). Marshal-clean by construction — frozen Hashes of
       # Strings, `LabelSet`s of frozen Arrays, and `Data` edges — so the fork pool ships them back to the

data/lib/rigor/cache/descriptor.rb

@@ -4,6 +4,7 @@ require "digest"
 require "json"
 require_relative "../value_semantics"
 require_relative "file_digest"
+require_relative "../rooted_glob"
 
 module Rigor
   module Cache
@@ -87,7 +88,13 @@ module Rigor
       # appears, vanishes or changes kind invalidates the warm entry. A
       # pre-19 entry carries none of them and would validate fresh across exactly those edits, so cached
       # entries must read as misses once and rebuild carrying the rows.
-      SCHEMA_VERSION = 19
+      # v20: #1977 — the `--incremental` run-result slot records a `:kind` row, not an existence row, per analysis
+      # root, `pre_eval:` entry and project signature root. A pre-20 slot's existence row validates fresh across a
+      # directory replaced by a file of the same name, so it must read as a miss once and rebuild.
+      # v21: #1984 — the visibility walk records each class's singleton slots (`[:singleton, name]`) in the seed
+      # bundles' `method_visibilities`. A pre-21 bundle carries none for an unchanged file, so cached bundles must read
+      # as misses once and rebuild carrying them.
+      SCHEMA_VERSION = 21
 
       # Per-slot entry value objects. Constructors validate enums / required fields and freeze the resulting
       # struct so no caller can mutate after the entry is in a Descriptor.
@@ -325,7 +332,12 @@ module Rigor
         # tuple moves, so a `git checkout`, a `bundle install` or a CI cache restored over a fresh checkout
         # keeps the file rows fresh while it would move every glob signature, turning every such run into a
         # full re-analysis. `:names` also reads no stat at all, so it costs a `Dir.glob` and nothing else.
-        VALID_MODES = %i[stat names].freeze
+        #
+        # `:kinds` (#1959) is `:names` plus each match's `File.lstat` file type: the set moves it, and so does a
+        # path that keeps its name and changes kind (a file `gen` replaced by a directory `gen/`, a symlinked
+        # directory replaced by a real one). It reads one `lstat` per match and no content, so a `touch` or an
+        # edit leaves it fresh.
+        VALID_MODES = %i[stat names kinds].freeze
 
         attr_reader :root, :pattern, :value
 
@@ -357,13 +369,15 @@ module Rigor
         # The aggregate signature the entry's `value` carries: SHA-256 over the sorted per-file rows. In the
         # default (`:stat`) mode a row is the file's `(path, size, mtime_ns, ctime_ns, inode)` tuple — NO
         # content read; in strict mode a row is `(path, content-sha256)`, restoring the pre-ADR-87 authority.
-        # In `:names` mode a row is the path alone, stat-free, so only the matching SET moves the signature.
+        # In `:names` mode a row is the path alone, stat-free, so only the matching SET moves the signature; in
+        # `:kinds` mode it is the path and its {.lstat_kind}.
         # Per-file stat failures (a file vanishing between the glob and the stat) drop the row — same race
         # posture as {Descriptor#file_entry_fresh?}. `Dir.glob` returns sorted entries by default so the row
         # order — and therefore the signature — is stable.
         def self.signature_for(root:, pattern:, mode: :stat)
-          paths = Dir.glob(File.join(root, pattern))
+          paths = RootedGlob.glob(root, pattern)
           return Digest::SHA256.hexdigest(paths.map { |path| "#{path}#{ROW_SEPARATOR}" }.join) if mode == :names
+          return kinds_signature(paths) if mode == :kinds
 
           strict = FileDigest.strict_validation?
           rows = paths.filter_map do |path|
@@ -382,10 +396,29 @@ module Rigor
           Digest::SHA256.hexdigest(rows.join)
         end
 
+        # #1959 — what `path` itself is, a symlink not followed: `:file`, `:directory`, `:symlink` or `:other`, and
+        # `:absent` for a path that vanished between the glob and the `lstat`.
+        def self.lstat_kind(path)
+          case File.lstat(path).ftype
+          when "file" then :file
+          when "directory" then :directory
+          when "link" then :symlink
+          else :other
+          end
+        rescue SystemCallError
+          :absent
+        end
+
+        def self.kinds_signature(paths)
+          rows = paths.map { |path| "#{path}#{FIELD_SEPARATOR}#{lstat_kind(path)}#{ROW_SEPARATOR}" }
+          Digest::SHA256.hexdigest(rows.join)
+        end
+        private_class_method :kinds_signature
+
         # ADR-87 WD2 — fresh iff re-globbing + re-stat-ing reproduces the recorded signature. Zero file-content
-        # bytes are read in the default mode, and no stat at all in `:names`. Any failure reads as stale
-        # (recompute), never a crash. A stored signature recorded under the opposite validation mode simply
-        # mismatches and recomputes.
+        # bytes are read in the default mode, no stat at all in `:names`, and one `lstat` per match in `:kinds`.
+        # Any failure reads as stale (recompute), never a crash. A stored signature recorded under the opposite
+        # validation mode simply mismatches and recomputes.
         def self.fresh?(entry)
           signature_for(root: entry.root, pattern: entry.pattern, mode: entry.mode) == entry.value
         rescue StandardError

data/lib/rigor/cache/engine_source.rb

@@ -4,6 +4,7 @@ require "digest"
 
 require_relative "../version"
 require_relative "descriptor"
+require_relative "../rooted_glob"
 
 module Rigor
   module Cache
@@ -195,8 +196,8 @@ module Rigor
       # Sorted, de-duplicated absolute paths of every engine `.rb` file and {DATA_GLOBS} data file, across
       # the directories that exist. `plugins/*/sig/**/*.rbs` overlaps nothing else but is de-duplicated anyway.
       def source_files(root)
-        sources = SOURCE_DIRECTORIES.flat_map { |relative| Dir.glob(File.join(root, relative, "**", "*.rb")) }
-        data = DATA_GLOBS.flat_map { |pattern| Dir.glob(File.join(root, pattern)) }
+        sources = SOURCE_DIRECTORIES.flat_map { |relative| RootedGlob.glob(root, File.join(relative, "**", "*.rb")) }
+        data = DATA_GLOBS.flat_map { |pattern| RootedGlob.glob(root, pattern) }
         (sources + data).uniq.sort
       end
     end

data/lib/rigor/cache/incremental_snapshot.rb

@@ -10,6 +10,7 @@ require_relative "../analysis/shadow_harness"
 require_relative "../analysis/run_cache_key"
 require_relative "../environment"
 require_relative "../analysis/path_expansion"
+require_relative "../rooted_glob"
 
 module Rigor
   module Cache
@@ -172,7 +173,29 @@ module Rigor
       # 38: issue #1898 — the payload gains `effect_plugin_digest`, the plugin effect-fact digest the collections were
       # stamped under, which a recheck now checks before its served collections reach the envelope pass. A pre-38
       # blob carries none, so the gate rejects it and the next run is cold.
-      SCHEMA = 38
+      # 39: issue #1984 — the visibility walk records the singleton slots (`[:singleton, name]`) and contests the ones
+      # two files disagree on, which a pre-39 bundle carries none of, so a warm run would answer a singleton call a
+      # cold run reports.
+      # 40: issue #1553 — the payload gains `plugin_reads`, the plugin reads each analysed file's last analysis made,
+      # which a recheck validates to put a reader of a changed input into the closure. A pre-40 blob carries none,
+      # so its readers would be served stale; the gate rejects it and the next run is cold.
+      # 41: issue #1583 — the payload gains `discovery_digests`, the packed digest of each file a run over path
+      # arguments discovered without analysing, which a recheck compares to re-baseline when one moved. A pre-41
+      # blob carries none; the gate rejects it and the next run is cold.
+      # 42: issue #2184 — a `deferred_ranges` row for a `def` inside a block now carries the method's name, and a
+      # literal-named `define_method` / `define_singleton_method` call adds a row. A pre-42 bundle carries neither,
+      # so a warm run would report a top-level block call that a cold run declines.
+      # 43: issue #2020 — the payload gains `plugin_disclosures`, the run-scoped plugin rows each analysed file's
+      # last analysis registered, which a recheck replays for the files it serves. A pre-43 blob carries none, so
+      # its rechecks would drop every such row; the gate rejects it and the next run is cold.
+      # 44: PR #2286 review M1 — the payload gains `synthetic_surface_digest`, the ADR-16 synthetic-method index's
+      # {Rigor::Inference::SyntheticMethodIndex#surface_digest} at the run the cache was built under, which a recheck
+      # compares to re-baseline when a class-body DSL edit moved it. A pre-44 blob carries none; the gate rejects it
+      # and the next run is cold.
+      # 45: issue #1154 — each seed bundle's `global_write_census` also records the ivar writers the declared-parameter
+      # credit reads (`[:ivar_set, name]`, `[:ivar_set_class, class]`, `[:own_write, class, name, path]`), which a
+      # pre-45 bundle carries none of, so a warm run would credit an ivar write a cold run declines.
+      SCHEMA = 45
 
       # The persisted per-file state.
       # `cache` maps an analyzed file to its diagnostics.
@@ -227,19 +250,31 @@ module Rigor
       # Issues #796 / #794 — the run-level rows a narrowed run replays instead of re-deriving; see
       # docs/internal-spec/cache.md § "Run-level rows the snapshot carries" for why exactly these two are
       # fresh under the fingerprint and why no other `.rigor.yml`-level row may join them.
+      # Issue #1583 — `discovery_digests` maps each file a run over path arguments discovered but did not analyse
+      # (#684's widening to the configured `paths:`) to its ADR-87 packed stat-digest entry; `{}` on a run over
+      # the configured paths. A recheck that finds one moved, or the set changed, re-baselines.
       # Issue #1898 — `effect_plugin_digest` is {Rigor::Effects::PluginFacts#digest} at the run that collected
       # `effect_collections` (nil when collection was off). A plugin stamps its attributions and edges into a file's
       # collection, and `effects_identity` is plugin-blind (it is compared before any plugin loads), so the session
       # compares this one after the recheck has loaded them.
+      # Issue #2020 — `plugin_disclosures` is {Analysis::RunDisclosureLedger#to_h}: `files`, each analysed file's
+      # run-scoped plugin rows ({Plugin::Base#disclose_once} / {Plugin::Base#emit_once}) from its last analysis, which a
+      # recheck replays for the files it serves, and `reads`, the boundary rows per `[plugin id, key]` that make one
+      # stale.
       Payload = Data.define(:cache, :sources, :digests, :analyzed,
                             :symbol_sources, :ancestry_sources, :symbol_fingerprints,
                             :missing, :class_decls, :constant_decls, :seed_bundles, :plugin_fact_digest,
                             :return_summaries, :param_table,
                             :effect_collections, :effects_identity, :run_level_rows,
-                            :effect_plugin_digest) do
-        # Defaults to nil so a payload built without it (an older caller, a spec fixture) reads as "unknown",
-        # which the session treats as moved.
-        def initialize(effect_plugin_digest: nil, **rest)
+                            :effect_plugin_digest, :plugin_reads, :discovery_digests, :plugin_disclosures,
+                            :synthetic_surface_digest) do
+        # `effect_plugin_digest` defaults to nil so a payload built without it (an older caller, a spec fixture)
+        # reads as "unknown", which the session treats as moved. `plugin_reads` defaults to no reads, and
+        # `discovery_digests` to no discovery-only files, and `plugin_disclosures` (#2020) to no replayed rows.
+        # `synthetic_surface_digest` defaults to nil, the empty index's digest: a run that builds a non-empty one
+        # reads it as moved.
+        def initialize(effect_plugin_digest: nil, plugin_reads: {}, discovery_digests: {}, plugin_disclosures: {},
+                       synthetic_surface_digest: nil, **rest)
           super
         end
       end
@@ -367,7 +402,7 @@ module Rigor
       # checkouts.
       def self.digest_signature_paths(signature_paths)
         globbed = Array(signature_paths).flat_map do |entry|
-          File.directory?(entry) ? Dir.glob(File.join(entry, "**", "*.rbs")) : [entry]
+          File.directory?(entry) ? RootedGlob.glob(entry, "**/*.rbs") : [entry]
         end
         files = globbed.select { |path| File.file?(path) }.sort
         digest = Digest::SHA256.new
@@ -449,7 +484,11 @@ module Rigor
           effect_collections: data[:effect_collections] || {},
           effects_identity: data[:effects_identity],
           run_level_rows: data[:run_level_rows],
-          effect_plugin_digest: data[:effect_plugin_digest]
+          effect_plugin_digest: data[:effect_plugin_digest],
+          plugin_reads: data[:plugin_reads] || {},
+          plugin_disclosures: data.fetch(:plugin_disclosures, {}),
+          discovery_digests: data.fetch(:discovery_digests, {}),
+          synthetic_surface_digest: data[:synthetic_surface_digest]
         )
       end
       private :payload_from
@@ -475,7 +514,9 @@ module Rigor
           effect_collections: payload.effect_collections,
           effects_identity: payload.effects_identity,
           run_level_rows: payload.run_level_rows,
-          effect_plugin_digest: payload.effect_plugin_digest
+          effect_plugin_digest: payload.effect_plugin_digest,
+          plugin_reads: payload.plugin_reads, plugin_disclosures: payload.plugin_disclosures,
+          discovery_digests: payload.discovery_digests, synthetic_surface_digest: payload.synthetic_surface_digest
         )
         # #1507 — every `--incremental` run that analysed anything rewrites this whole blob, so its deflate is
         # on the edit path; see {Store::DEFLATE_LEVEL}.

data/lib/rigor/cache/rbs_descriptor.rb

@@ -5,6 +5,7 @@ require "digest"
 require_relative "descriptor"
 require_relative "engine_source"
 require_relative "file_digest"
+require_relative "../rooted_glob"
 
 module Rigor
   module Cache
@@ -110,7 +111,7 @@ module Rigor
         roots.flat_map do |root|
           next [] unless root.directory?
 
-          Dir.glob(root.join("**", "*.rbs")).map do |path|
+          RootedGlob.glob(root, "**/*.rbs").map do |path|
             digest = FileDigest.hexdigest(path)
             if comparator == :stat
               Descriptor::FileEntry.stat(path: path, digest: digest)

data/lib/rigor/cache/store.rb

@@ -9,6 +9,7 @@ require "zlib"
 
 require_relative "../version"
 require_relative "descriptor"
+require_relative "../rooted_glob"
 
 module Rigor
   module Cache
@@ -176,7 +177,7 @@ module Rigor
           subdir = File.join(root, child)
           next nil unless File.directory?(subdir)
 
-          entries = Dir.glob(File.join(subdir, "**", "*.entry"))
+          entries = RootedGlob.glob(subdir, "**/*.entry")
           next nil if entries.empty?
 
           { id: child, entries: entries.size, bytes: entries.sum { |e| File.size(e) } }
@@ -709,7 +710,7 @@ module Rigor
 
       def cleanup_stale_temp_files
         cutoff = Time.now - STALE_TEMP_FILE_AGE_SECONDS
-        Dir.glob(File.join(@root, "**", "*.tmp.*")).each do |path|
+        RootedGlob.glob(@root, "**/*.tmp.*").each do |path|
           next unless File.file?(path)
           next if File.mtime(path) > cutoff
 
@@ -771,7 +772,7 @@ module Rigor
       # Returns an array of `{ path:, producer:, mtime:, bytes: }` hashes for every `.entry` file under the
       # cache root, skipping unreadable entries.
       def collect_entry_stats
-        Dir.glob(File.join(@root, "**", "*.entry")).filter_map do |path|
+        RootedGlob.glob(@root, "**/*.entry").filter_map do |path|
           stat = File.stat(path)
           producer = producer_id_for_entry(path)
           next nil if producer.nil?

data/lib/rigor/cli/check_command.rb

@@ -3,6 +3,7 @@
 require "fileutils"
 require "json"
 require "optionparser"
+require "tempfile"
 
 require_relative "../configuration"
 require_relative "../config_audit"
@@ -11,6 +12,7 @@ require_relative "../analysis/rule_catalog"
 # The baseline filter runs on EVERY exit path — including the ADR-87 WD4 cache-HIT fast path, which skips
 # `load_check_dependencies` — so it must be a load-time require. It pulls only YAML, never the engine.
 require_relative "../analysis/baseline"
+require_relative "../analysis/edit_replay"
 require_relative "command"
 require_relative "options"
 require_relative "diagnostic_formats"
@@ -272,8 +274,83 @@ module Rigor
         incremental = session.reanalyze_subset(subset).map(&:to_h)
         full = verify_full_diagnostics(configuration, paths, collect_stats: options.fetch(:stats)).map(&:to_h)
 
-        report_verify_incremental(incremental, full, subset_size: subset.size, total: analyzed.size,
-                                                     format: options.fetch(:format))
+        status = report_verify_incremental(incremental, full, subset_size: subset.size, total: analyzed.size,
+                                                              format: options.fetch(:format))
+        return status unless status.zero? && options.fetch(:verify_incremental_edits).positive?
+
+        verify_edit_replays(session, configuration, paths, options)
+      end
+
+      # Issue #1967 — the partition check above re-analyses an unchanged tree, so every served row is still right and a
+      # missing invalidation edge goes unseen. Here each of `--verify-incremental-edits` sampled files is edited through
+      # an editor buffer (never on disk) by each of {Analysis::EditReplay.edits} — emptied, then reduced to its
+      # `class` / `module` skeleton — and the warm recheck of the baseline ({IncrementalSession#replay_edit}) must equal
+      # a full analysis of the edited tree: a dependent the recheck failed to re-analyse is served from the baseline and
+      # differs. A run in which every replay declined compared nothing, so it fails rather than report OK.
+      def verify_edit_replays(session, configuration, paths, options)
+        sample = edit_replay_sample(session.analyzed_files, options.fetch(:verify_incremental_edits))
+        replayed = 0
+        declined = 0
+        sample.each do |path|
+          Analysis::EditReplay.edits(File.read(path)).each do |edit|
+            incremental, full = replay_edit(session, configuration, paths, path, edit)
+            next declined += 1 if incremental.nil?
+
+            replayed += 1
+            next if incremental == full
+
+            return report_edit_replay_mismatch(path, edit, incremental, full)
+          end
+        end
+        report_edit_replays(replayed, declined, options.fetch(:format))
+      end
+
+      def report_edit_replay_mismatch(path, edit, incremental, full)
+        @err.puts("rigor: --verify-incremental FAILED — the recheck after #{edit.label} #{path} " \
+                  "differs from a full run.")
+        return report_verify_order_mismatch(incremental, full) if incremental.tally == full.tally
+
+        report_verify_set_mismatch(incremental, full, header: false)
+      end
+
+      # `count` files spread evenly over the analysed list, so a small count still reaches both ends of it.
+      def edit_replay_sample(analyzed, count)
+        return analyzed if count >= analyzed.size
+
+        Array.new(count) { |index| analyzed[index * analyzed.size / count] }
+      end
+
+      # The warm recheck's rows and a full run's, both with `path` replaced by `edit`; `[nil, nil]` when the recheck
+      # declined.
+      def replay_edit(session, configuration, paths, path, edit)
+        Tempfile.create(["rigor-verify-edit-", ".rb"]) do |file|
+          file.write(edit.source)
+          file.close
+          buffer = Analysis::BufferBinding.new(logical_path: path, physical_path: file.path)
+          recheck = session.replay_edit(buffer)
+          return [nil, nil] if recheck.nil?
+
+          # `analyze_only:` with the buffer selects editor mode option B, a whole-project run reading the buffer at
+          # its logical path; the buffer alone would analyse that one file.
+          runner = Analysis::Runner.new(configuration: configuration, cache_store: nil, collect_stats: false,
+                                        buffer: buffer, analyze_only: session.analyzed_files.to_set)
+          full = paths ? runner.run(paths) : runner.run
+          [recheck.diagnostics.map(&:to_h), full.diagnostics.map(&:to_h)]
+        end
+      end
+
+      def report_edit_replays(replayed, declined, format)
+        if replayed.zero? && declined.positive?
+          @err.puts("rigor: --verify-incremental FAILED — every edit replay (#{declined}) declined, " \
+                    "since the recheck would have been a full analysis, so no edit was compared.")
+          return 1
+        end
+
+        line = "rigor: --verify-incremental OK — #{replayed} edits replayed (files emptied and reduced to their " \
+               "class/module skeleton), every recheck matches full"
+        line = "#{line}; #{declined} declined (the recheck would have been a full analysis)" if declined.positive?
+        side_output(format).puts(line)
+        0
       end
 
       # ADR-46 — cross-process incremental analysis (`--incremental`). Derives the global fingerprint cheaply (no RBS
@@ -490,10 +567,10 @@ module Rigor
         end
       end
 
-      def report_verify_set_mismatch(incremental, full)
+      def report_verify_set_mismatch(incremental, full, header: true)
         only_incremental = multiset_difference(incremental, full)
         only_full = multiset_difference(full, incremental)
-        @err.puts("rigor: --verify-incremental FAILED — incremental and full diagnostics differ.")
+        @err.puts("rigor: --verify-incremental FAILED — incremental and full diagnostics differ.") if header
         @err.puts("  incremental-only: #{only_incremental.size}, full-only: #{only_full.size}")
         (only_incremental + only_full).first(10).each do |hash|
           @err.puts("    #{diagnostic_location(hash)}")
@@ -643,6 +720,9 @@ module Rigor
           # the rest from the per-file cache, and asserts the merged diagnostics are byte-identical to a full
           # `--no-cache` run. Exits non-zero on any mismatch. Off by default.
           verify_incremental: false,
+          # Issue #1967 — the number of files `--verify-incremental` replays an edit on (each emptied through an editor
+          # buffer) after the partition check. 0 replays none.
+          verify_incremental_edits: 0,
           # ADR-46 — cross-process incremental analysis. With a disk snapshot of the prior run's per-file diagnostics +
           # dependency graph, re-analyzes only the changed closure and serves the rest from the snapshot. Off by
           # default.
@@ -720,6 +800,15 @@ module Rigor
                   "assert incremental analysis matches a full run, then exit") do
             options[:verify_incremental] = true
           end
+          opts.on("--verify-incremental-edits=N", Integer,
+                  "with --verify-incremental, also replay 2 edits (empty, class/module skeleton) on N files") do |value|
+            if value.negative?
+              raise OptionParser::InvalidArgument, "--verify-incremental-edits=#{value} (must be 0 or more)"
+            end
+
+            options[:verify_incremental] = true
+            options[:verify_incremental_edits] = value
+          end
           opts.on("--incremental",
                   "re-analyze only files changed since the last run (cross-process cache)") do
             options[:incremental] = true

data/lib/rigor/cli/command.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../rooted_glob"
+
 module Rigor
   class CLI
     # Base class for the `rigor <subcommand>` command objects.
@@ -26,7 +28,7 @@ module Rigor
         paths = []
         args.each do |arg|
           if File.directory?(arg)
-            paths.concat(Dir.glob(File.join(arg, "**/*.rb")))
+            paths.concat(RootedGlob.glob(arg, "**/*.rb"))
           elsif File.file?(arg)
             paths << arg
           else

data/lib/rigor/cli/diff_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "command"
+require_relative "options"
 
 require "json"
 require "optionparser"
@@ -63,7 +64,7 @@ module Rigor
             options[:current_path] = path
           end
           opt.on("--config=PATH", "Path to .rigor.yml. Forwarded to the implicit `rigor check` run.") do |path|
-            options[:config] = path
+            options[:config] = Options.config_path(path)
           end
         end.parse!(@argv)
         options

data/lib/rigor/cli/docs_command.rb

@@ -2,6 +2,7 @@
 
 require_relative "command"
 require_relative "doc_links"
+require_relative "../rooted_glob"
 
 module Rigor
   class CLI
@@ -186,8 +187,8 @@ module Rigor
       # `install.md` sits at the docs root (category `guide`); the rest are manual / handbook chapters.
       def discover_docs
         paths = [File.join(DOCS_ROOT, "install.md")]
-        paths += Dir.glob(File.join(MANUAL_ROOT, "**", "*.md")) # Dir.glob is already sorted
-        paths += Dir.glob(File.join(HANDBOOK_ROOT, "**", "*.md"))
+        paths += RootedGlob.glob(MANUAL_ROOT, "**/*.md") # Dir.glob is already sorted
+        paths += RootedGlob.glob(HANDBOOK_ROOT, "**/*.md")
         paths.select { |path| File.file?(path) }.map { |path| doc_entry(path) }
       end
 

data/lib/rigor/cli/doctor_command.rb

@@ -364,7 +364,7 @@ module Rigor
           status: :warn,
           message: "#{gap.locked_gems.join(', ')} #{gap.locked_gems.one? ? 'is a dependency' : 'are dependencies'} " \
                    "of this project and #{gap.plugin_gem} models it, but it is not enabled",
-          hint: "Add `#{gap.plugin_gem}` to `.rigor.yml` `plugins:`, or leave it out deliberately."
+          hint: "Add `#{gap.plugin_gem}` to `.rigor.yml` `plugins:`, or decline it with an `enabled: false` entry."
         }
       end
 

data/lib/rigor/cli/explain_command.rb

@@ -10,7 +10,7 @@ require_relative "command"
 module Rigor
   class CLI
     # Executes `rigor explain <rule>`. Prints the catalog entry for one canonical rule id, a legacy alias, or a family
-    # wildcard (`call`, `flow`, `assert`, `dump`, `def`).
+    # wildcard (`call`, `flow`, `def`, `assert`, `dump`, `global`, `suppression`, `static`, `effect`).
     #
     # Without arguments lists every rule's id and one-line summary.
     #
@@ -74,7 +74,8 @@ module Rigor
         end
         @out.puts("")
         @out.puts("Run `rigor explain <rule>` for the full description.")
-        @out.puts("Family wildcards (`call`, `flow`, `assert`, `dump`, `def`) print every rule under that prefix.")
+        @out.puts("Family wildcards (#{Analysis::CheckRules::RULE_FAMILIES.map { |f| "`#{f}`" }.join(', ')}) " \
+                  "print every rule under that prefix.")
         @out.puts("")
         @out.puts("`rigor sig-gen` skip reasons:")
         @out.puts("")

data/lib/rigor/cli/lens_command.rb

@@ -22,11 +22,6 @@ module Rigor
         return CLI::EXIT_USAGE if options.nil?
 
         config = options.fetch(:config)
-        if config && !File.file?(config)
-          usage_error("no configuration file at #{config}")
-          return CLI::EXIT_USAGE
-        end
-
         configuration = Configuration.load(config)
         config_path = options.fetch(:config) || Configuration.discover
         # The working directory: Rigor auto-detects sig/ and the lockfiles there (lens.md § Serialization).
@@ -56,6 +51,11 @@ module Rigor
         options
       rescue OptionParser::ParseError => e
         usage_error(e.message)
+      rescue Rigor::ConfigurationError => e
+        # The shared --config check (CLI::Options.config_path). Mapped here the way Rigor::CLI#run maps it, so a
+        # direct LensCommand run exits with the usage code too.
+        @err.puts("rigor: #{e.message}")
+        nil
       end
 
       def usage_error(message)

data/lib/rigor/cli/mcp_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "command"
+require_relative "options"
 require_relative "../runtime/jit"
 
 require "optionparser"
@@ -54,7 +55,7 @@ module Rigor
           end
           opts.on("--config=PATH",
                   "Session-level default config path (individual tool calls may override)") do |value|
-            options[:config] = value
+            options[:config] = Options.config_path(value)
           end
         end
         parser.parse!(@argv)