rigortype 0.4.4 → 0.4.6

data/lib/rigor/lens/members.rb

@@ -14,10 +14,13 @@ module Rigor
       # @param contracts — `{[owner, scope, name] => ContractReader::Contract or nil}`
       # @param elsewhere — callable `(owner, scope, name) -> [{path, line}]`: other project files defining it
       # @param site_paths — `{site key => absolute path of its file}`, to match an inline contract's buffer
-      def initialize(sites:, omissions:, contracts:, elsewhere:, site_paths:)
+      # @param defaulted_blocks — `{[owner, scope, name] => {required, type}}`: the block a member's otherwise
+      #   defaulted inline declaration declares (ContractReader#read_defaulted_block)
+      def initialize(sites:, omissions:, contracts:, elsewhere:, site_paths:, defaulted_blocks: {})
         @sites = sites
         @omissions = omissions
         @contracts = contracts
+        @defaulted_blocks = defaulted_blocks
         @elsewhere = elsewhere
         @site_paths = site_paths
       end
@@ -115,11 +118,22 @@ module Rigor
 
         params, block, head = Parameters.read(node.parameters, yields: Parameters.yields?(node.body))
         slot = inferred_return(single, scope)
-        block_rbs = block ? " ?{ (?) -> untyped }" : ""
+        declared = !site.data["alias_of"] && @defaulted_blocks[[site.data["owner"], scope, name]]
+        block = declared || block
+        block_rbs = block_spelling(block, declared)
         { "rbs" => "#{head}#{block_rbs} -> #{return_spelling(slot)}", "params" => params, "block" => block,
           "return" => slot }
       end
 
+      # A block an otherwise defaulted declaration declares reads as declared (`{ (Integer) -> void }`); one the
+      # definition merely takes reads as `?{ (?) -> untyped }`.
+      def block_spelling(block, declared)
+        return "" if block.nil?
+        return " ?{ (?) -> untyped }" unless declared
+
+        " #{'?' unless declared['required']}{ #{declared['type']['type']} }"
+      end
+
       # An alias whose original Rigor cannot pin to one `def`: nothing about its signature is known.
       def unknown_overload
         { "rbs" => nil, "params" => nil, "block" => nil, "return" => Slot.unavailable("not_computed") }

data/lib/rigor/lens/run.rb

@@ -78,6 +78,7 @@ module Rigor
       def reset_captures
         @captured = {}
         @contracts = {}
+        @defaulted_blocks = {}
         @site_paths = {}
       end
 
@@ -145,18 +146,39 @@ module Rigor
           if published
             published_slot(published, scope.environment)
           else
-            declared_slot(site, contract_reader(scope.environment).read_constant(name, scope.environment))
+            declared_slot(site, contract_reader(scope.environment).read_constant(name, scope.environment), scope)
           end
       end
 
       # The rbs-inline plugin declares every constant of a file it reads, typing an unannotated one from its
       # literal (`[]` as `Array[untyped]`), and reads only a `#:` trailing the assignment as its type: an inline
-      # declaration is the constant's own only when that is the site's one contract comment.
-      def declared_slot(site, declared)
+      # declaration is the constant's own only when that is the site's one contract comment. Otherwise it is the
+      # plugin's default, which `check` reads all the same: that type, `inferred`. A `Class.new` / `Module.new`
+      # value is the exception, which `check` types through its own write reading, not the default `untyped`.
+      # An inline declaration from another file says nothing about this site: when the name is written in two
+      # files, the one the environment kept decides, and this site's own comment may say otherwise.
+      def declared_slot(site, declared, scope)
         return Slot.unavailable("not_computed") if declared.nil?
-        return Slot.unavailable("not_computed") if declared["provenance"] == "inline" && !trailing_type?(site)
+        return declared unless declared["provenance"] == "inline"
+        return Slot.unavailable("not_computed") unless own_inline_declaration?(site, scope)
+        return declared if trailing_type?(site)
+        return Slot.unavailable("not_computed") if anonymous_namespace?(site.node.value)
 
-        declared
+        published_slot(scope.environment.constant_for_name(site.data["name"]), scope.environment)
+      end
+
+      def own_inline_declaration?(site, scope)
+        buffer = scope.environment.rbs_loader&.constant_declaration(site.data["name"])&.last
+        path = @site_paths.fetch(site.data["key"])
+        buffer&.end_with?(":#{path}") || false
+      end
+
+      def anonymous_namespace?(node)
+        return false unless node.is_a?(Prism::Node)
+        return true if node.is_a?(Prism::CallNode) && node.name == :new && node.receiver &&
+                       %w[Class Module].include?(node.receiver.slice.delete_prefix("::"))
+
+        node.compact_child_nodes.any? { |child| anonymous_namespace?(child) }
       end
 
       def trailing_type?(site)
@@ -166,6 +188,7 @@ module Rigor
       end
 
       def published_slot(type, environment)
+        return Slot.unavailable("not_computed") if type.nil?
         return Slot.dynamic("inferred", nil) if type.is_a?(Type::Dynamic)
 
         spelled = speller(environment).call(type, nil)
@@ -178,7 +201,11 @@ module Rigor
         key = [owner, member_scope, name]
         return if @contracts.key?(key)
 
-        @contracts[key] = contract_reader(scope.environment).read(owner, member_scope.to_sym, name, scope)
+        reader = contract_reader(scope.environment)
+        @contracts[key] = reader.read(owner, member_scope.to_sym, name, scope)
+        return if @contracts[key]
+
+        @defaulted_blocks[key] = reader.read_defaulted_block(owner, member_scope.to_sym, name, scope)
       end
 
       def target(entry, diagnostics, session)
@@ -229,7 +256,7 @@ module Rigor
         sites = readers.values.flat_map(&:sites)
         omissions = readers.values.flat_map(&:omissions)
         requested = readers.keys.to_set
-        Members.new(sites: sites, omissions: omissions, contracts: @contracts,
+        Members.new(sites: sites, omissions: omissions, contracts: @contracts, defaulted_blocks: @defaulted_blocks,
                     elsewhere: elsewhere(session, requested), site_paths: @site_paths).build
       end
 

data/lib/rigor/mcp/server.rb

@@ -128,8 +128,8 @@ module Rigor
             properties: {
               rule: {
                 type: "string",
-                description: "Rule ID, legacy alias, or family prefix (call, flow, assert, dump, def). " \
-                             "Omit to list every rule."
+                description: "Rule ID, legacy alias, or family prefix (call, flow, def, assert, dump, global, " \
+                             "suppression, static, effect). Omit to list every rule."
               }
             }
           }
@@ -235,7 +235,7 @@ module Rigor
       end
 
       def build_argv(name, args) # rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/AbcSize,Metrics/PerceivedComplexity
-        effective_config = args["config"] || @config_path
+        effective_config = present_config(args["config"]) || @config_path
 
         case name
         when "rigor_check"
@@ -290,6 +290,14 @@ module Rigor
         end
       end
 
+      # A per-call `config` that is blank names no file, so the session default applies rather than `--config=`
+      # reaching the CLI as an empty path (which the CLI refuses).
+      def present_config(value)
+        return value unless value.is_a?(String) && value.strip.empty?
+
+        nil
+      end
+
       def success(id, result)
         { "jsonrpc" => "2.0", "id" => id, "result" => result }
       end

data/lib/rigor/plugin/base.rb

@@ -8,11 +8,13 @@ require "prism"
 require_relative "manifest"
 require_relative "node_context"
 require_relative "../analysis/diagnostic"
+require_relative "../analysis/run_disclosure_credit"
 require_relative "../cache/engine_source"
 # `producer generation_cap:` defaults to (and validates against) `Cache::Store::UNBOUNDED_GENERATIONS`, and a
 # plugin class body can be evaluated before anything else pulled the cache layer in.
 require_relative "../cache/store"
 require_relative "../source/node_walker"
+require_relative "../rooted_glob"
 
 module Rigor
   module Plugin
@@ -779,11 +781,12 @@ module Rigor
       # that differs between workers.
       def disclose_once(key, message:, severity: :info, rule: "load-error")
         id = key.to_s
-        return nil if run_registration_taken?(id, batch: false)
-
-        @run_disclosures[id] = {
-          key: id, message: message.to_s, severity: severity.to_sym, rule: rule.to_s
-        }.freeze
+        unless run_registration_taken?(id, batch: false)
+          @run_disclosures[id] = {
+            key: id, message: message.to_s, severity: severity.to_sym, rule: rule.to_s
+          }.freeze
+        end
+        attribute_run_registration(id)
         nil
       end
 
@@ -815,14 +818,15 @@ module Rigor
       # raises `ArgumentError`, which the engine reports as this plugin's `runtime-error`.
       def emit_once(key, diagnostics)
         id = key.to_s
-        return nil if run_registration_taken?(id, batch: true)
-
-        batch = Array(diagnostics).map do |row|
-          next row.dup.freeze if row.is_a?(Rigor::Analysis::Diagnostic)
+        unless run_registration_taken?(id, batch: true)
+          batch = Array(diagnostics).map do |row|
+            next row.dup.freeze if row.is_a?(Rigor::Analysis::Diagnostic)
 
-          raise ArgumentError, "emit_once expects Rigor::Analysis::Diagnostic rows, got #{row.class}"
+            raise ArgumentError, "emit_once expects Rigor::Analysis::Diagnostic rows, got #{row.class}"
+          end
+          @run_disclosures[id] = { key: id, diagnostics: batch.freeze }.freeze
         end
-        @run_disclosures[id] = { key: id, diagnostics: batch.freeze }.freeze
+        attribute_run_registration(id)
         nil
       end
 
@@ -846,6 +850,18 @@ module Rigor
       end
       private :run_registration_taken?
 
+      # Issue #2020 — hands every call, a repeat of a key already registered included, to the engine's per-file
+      # attribution ({Analysis::RunDisclosureCredit}), so an `--incremental` recheck can replay the row for a file
+      # it serves from cache. A repeat counts because a discloser memoises the input its notice is about and
+      # re-registers the notice from each file's hook. A batch registered empty adds nothing to replay.
+      def attribute_run_registration(id)
+        record = @run_disclosures[id]
+        return if record.nil? || record[:diagnostics]&.empty?
+
+        Analysis::RunDisclosureCredit.attribute(self, record)
+      end
+      private :attribute_run_registration
+
       # Boilerplate-reduction helper (review §1.3): the "did you mean …?" suggestion every
       # diagnostic-emitting plugin otherwise hand-rolls. Returns the closest of `candidates` to `name` via
       # `DidYouMean::SpellChecker` (the same engine Ruby's own `NoMethodError` hints use), or `nil` when
@@ -1003,7 +1019,7 @@ module Rigor
       # plugin code calls `watch:`.
       #
       # @param roots — search roots (relative to the project root, or absolute paths)
-      # @param patterns — glob suffixes joined under each root via `File.join(root, pattern)`.
+      # @param patterns — glob suffixes matched under each root, the root read literally (#1956).
       #   Multiple patterns union into one descriptor (`"**/*.erb", "**/*.html"` etc.).
       def glob_descriptor(roots, *patterns)
         files = collect_glob_files(Array(roots), patterns)
@@ -1163,7 +1179,7 @@ module Rigor
           absolute = File.absolute_path(root.to_s)
           next [] unless File.directory?(absolute)
 
-          patterns.flat_map { |pattern| Dir.glob(File.join(absolute, pattern.to_s)) }
+          patterns.flat_map { |pattern| RootedGlob.glob(absolute, pattern) }
         end
         matched.uniq.sort.select { |path| File.file?(path) }
       end

data/lib/rigor/plugin/io_boundary.rb

@@ -3,6 +3,7 @@
 require "digest"
 
 require_relative "access_denied_error"
+require_relative "../rooted_glob"
 
 module Rigor
   module Plugin
@@ -33,6 +34,8 @@ module Rigor
     #   for a plugin that asks "which of these N candidate files exists here?" — rigor-actionpack tries
     #   nine template extensions per `render` call — where N per-path probe rows would put thousands of
     #   validations on every warm run and one listing row puts one per directory.
+    # - `#list_directory_kinds(path)` — the KIND-aware listing (#1959): each entry with its `lstat` kind, and one
+    #   `:kinds` row that moves when an entry appears, vanishes or changes kind under the same name.
     # - `#open_url(url)` — fetches the URL when the policy permits it (`network_policy: :allowlist` plus an
     #   `allowed_url_hosts` match) and raises {AccessDeniedError} otherwise. v0.1.2 ships the allowlist
     #   surface; the default project policy still has `network_policy: :disabled` so plugins that want network
@@ -189,7 +192,7 @@ module Rigor
       # @return the absolute paths directly under `path` in `Dir.glob` order; empty when not a directory
       def list_directory(path)
         absolute = File.absolute_path(path.to_s)
-        entries = Dir.glob(File.join(absolute, "*"))
+        entries = RootedGlob.glob(absolute, "*")
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
           return entries
@@ -199,6 +202,34 @@ module Rigor
         entries
       end
 
+      # Issue #1959 — the KIND-aware listing. Returns each entry directly under `path` with what it is, a symlink
+      # not followed ({Cache::Descriptor::GlobEntry.lstat_kind}: `:file`, `:directory`, `:symlink` or `:other`, and
+      # `:absent` for an entry that vanished between the listing and its `lstat`),
+      # and records one `:kinds` {Cache::Descriptor::GlobEntry} over `path/*`. The row reads stale when an entry
+      # appears, disappears, or keeps its name and changes kind; NOT when an entry's bytes or stat tuple move, nor
+      # when anything below a subdirectory changes. It is the row for a walk that decides per top-level entry
+      # whether to descend: rigor-ffi skips `vendor/` and does not follow a symlinked directory, so a file `gen`
+      # replaced by a directory `gen/`, or a symlink replaced by a real directory, changes what it reads while
+      # every name stays put. {#list_directory}'s `:stat` row leaves directories out, and {#glob}'s `:names` row
+      # reads names alone.
+      #
+      # Like {#list_directory}, dot entries are not listed, and an out-of-policy directory is listed truthfully
+      # and contributes no row.
+      #
+      # @param path — project directory; relative paths expand against the working directory
+      # @return a Hash from each absolute entry path, in `Dir.glob` order, to its kind; empty when not a directory
+      def list_directory_kinds(path)
+        absolute = File.absolute_path(path.to_s)
+        entries = RootedGlob.glob(absolute, "*").to_h { |entry| [entry, Cache::Descriptor::GlobEntry.lstat_kind(entry)] }
+        unless @policy.allow_read?(absolute)
+          record_refusal(absolute)
+          return entries
+        end
+
+        record_glob_entry(absolute, "*", mode: :kinds)
+        entries
+      end
+
       # Issue #1652 — the MEMBERSHIP fingerprint of a `Dir.glob` pattern under `root`, `**` included. Returns the
       # matching paths and records one `:names` {Cache::Descriptor::GlobEntry} over `root` and `pattern`: the row
       # reads stale when a match appears or disappears, in a subdirectory created after the read too, and NOT
@@ -209,8 +240,13 @@ module Rigor
       #
       # The pattern must stay under `root`, since the policy is checked against `root` alone: a `..` segment, a
       # brace (`{..,x}`) or a backslash escape (`.\\./`) raises {AccessDeniedError} (`:read_outside_scope`).
-      # The last two are refused outright because `Dir.glob` can spell `..` with them. Out of policy, `root` is
-      # globbed truthfully and contributes no row, as in {#list_directory}.
+      # The last two are refused outright because `Dir.glob` can spell `..` with them. A leading `/` is read under
+      # `root`, as the joined spelling always read it (`/lib/**/*.rb` is `root/lib/**/*.rb`). Out of policy, `root`
+      # is globbed truthfully and contributes no row, as in {#list_directory}.
+      #
+      # `root` is read literally (#1959): {RootedGlob} escapes its glob metacharacters before the join, so a root
+      # spelled `fx[1]` or a directory named `{..,zz}` neither matches a sibling nor leaves itself.
+      # {#list_directory} lists the same way, and {Cache::Descriptor::GlobEntry} re-globs the row the same way.
       #
       # @param root — project directory; relative paths expand against the working directory
       # @param pattern — a `Dir.glob` pattern relative to `root`, such as `"ext/**/extconf.rb"`
@@ -227,7 +263,7 @@ module Rigor
           )
         end
 
-        entries = Dir.glob(File.join(absolute, pattern))
+        entries = RootedGlob.glob(absolute, pattern)
         unless @policy.allow_read?(absolute)
           record_refusal(absolute)
           return entries
@@ -390,8 +426,8 @@ module Rigor
         self.class.attribute(entry)
       end
 
-      # ADR-45 WD1c (#629) — the listing row for {#list_directory} (and the `:names` row for {#glob}),
-      # deduplicated per (root, pattern, mode) slot.
+      # ADR-45 WD1c (#629) — the listing row for {#list_directory} (and the `:names` row for {#glob} and the
+      # `:kinds` row for {#list_directory_kinds}), deduplicated per (root, pattern, mode) slot.
       # Recomputed on each call rather than `||=`d, so a directory listed again after a mid-run mutation
       # carries the signature of the state the LAST reader saw.
       def record_glob_entry(root, pattern, mode: :stat)

data/lib/rigor/plugin/isolation.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "box"
+require_relative "../rooted_glob"
 
 module Rigor
   module Plugin
@@ -74,8 +75,8 @@ module Rigor
       # requiring the gem, which is what the caller is about to do.
       def bundle_require_paths(bundle_root)
         bundle_gem_dirs(bundle_root).flat_map do |gem_home|
-          specs = Dir.glob(File.join(gem_home, "specifications", "*.gemspec"))
-                     .filter_map { |file| Gem::Specification.load(file) }
+          specs = RootedGlob.glob(gem_home, "specifications/*.gemspec")
+                            .filter_map { |file| Gem::Specification.load(file) }
           specs.group_by(&:name)
                .flat_map { |_, versions| versions.max_by(&:version).full_require_paths }
         end
@@ -88,7 +89,7 @@ module Rigor
         return [] if bundle_root.nil? || bundle_root.to_s.empty?
 
         root = bundle_root.to_s
-        (Dir.glob(File.join(root, "ruby", "*")) + [root])
+        (RootedGlob.glob(root, "ruby/*") + [root])
           .select { |dir| File.directory?(File.join(dir, "specifications")) }
       end
 

data/lib/rigor/plugin/manifest.rb

@@ -56,7 +56,7 @@ module Rigor
                   :hkt_registrations, :hkt_definitions, :signature_paths, :protocol_contracts,
                   :source_rbs_synthesizer, :additional_initializers,
                   :effect_root, :effect_labels, :effect_attributions, :effect_edges, :effect_entry_points,
-                  :effect_ancestry
+                  :effect_ancestry, :per_invocation_classes, :per_invocation_non_action_macros
 
       # #392 — the project-relative globs whose files this plugin compiles into {TemplateUnit}s. Purely a
       # CLAIM: the engine globs these, reads each match's bytes and offers them to
@@ -74,7 +74,8 @@ module Rigor
         hkt_registrations: [], hkt_definitions: [], signature_paths: [], protocol_contracts: [],
         source_rbs_synthesizer: nil, additional_initializers: [],
         effect_root: nil, effect_labels: [], effect_attributions: [], effect_edges: [],
-        effect_entry_points: [], effect_ancestry: [], template_globs: []
+        effect_entry_points: [], effect_ancestry: [], template_globs: [], per_invocation_classes: [],
+        per_invocation_non_action_macros: []
       )
         validate_id!(id)
         validate_version!(version)
@@ -109,6 +110,7 @@ module Rigor
         assign_additional_initializers(additional_initializers)
         assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges,
                              effect_entry_points, effect_ancestry, template_globs)
+        assign_per_invocation_classes(per_invocation_classes, per_invocation_non_action_macros)
         freeze
       end
 
@@ -202,6 +204,28 @@ module Rigor
         @template_globs = globs.map { |glob| glob.to_s.dup.freeze }.uniq.freeze
       end
       private :assign_template_globs
+
+      # ADR-125 — `per_invocation_classes:` names the framework classes whose every instance serves exactly one
+      # entry point, so ivar writes in two distinct entry points of a descendant are never live together.
+      # `per_invocation_non_action_macros:` names the class-body macros whose Symbol, String or inline-`def`
+      # arguments name a public method that is NOT an entry point (`before_action :load`, `helper_method
+      # :current_user`); they apply to this manifest's own `per_invocation_classes:`, so a list without classes
+      # is refused. Validated and assigned in one call, because `#initialize` is at its line budget.
+      def assign_per_invocation_classes(names, macros)
+        validate_array_of!("per_invocation_classes", names, "non-empty String") do |name|
+          name.is_a?(String) && !name.empty?
+        end
+        validate_array_of!("per_invocation_non_action_macros", macros, "Symbol/non-empty String") do |macro|
+          macro.is_a?(Symbol) || (macro.is_a?(String) && !macro.empty?)
+        end
+        if names.empty? && !macros.empty?
+          raise ArgumentError, "per_invocation_non_action_macros needs per_invocation_classes to apply to"
+        end
+
+        @per_invocation_classes = names.map { |name| name.to_s.delete_prefix("::").dup.freeze }.uniq.freeze
+        @per_invocation_non_action_macros = macros.map(&:to_sym).uniq.freeze
+      end
+      private :assign_per_invocation_classes
       # rubocop:enable Metrics/ParameterLists, Metrics/AbcSize
 
       public
@@ -258,7 +282,9 @@ module Rigor
           "effect_edges" => effect_edges.map(&:to_h),
           "effect_entry_points" => effect_entry_points.map(&:to_h),
           "effect_ancestry" => effect_ancestry.map(&:to_h),
-          "template_globs" => template_globs
+          "template_globs" => template_globs,
+          "per_invocation_classes" => per_invocation_classes,
+          "per_invocation_non_action_macros" => per_invocation_non_action_macros.map(&:to_s)
         }
       end
 

data/lib/rigor/plugin/registry.rb

@@ -397,6 +397,28 @@ module Rigor
         @rbs_complete_extends_set.include?(class_name.to_s)
       end
 
+      # ADR-125 — the aggregate class names declared across loaded plugins as per-invocation (manifest
+      # `per_invocation_classes:`): each instance of a descendant serves exactly one public-method entry point.
+      # `per_invocation_class?` is the exact-name membership predicate; `def.ivar-write-mismatch` walks a
+      # class's ancestry and asks it of each ancestor.
+      attr_reader :per_invocation_classes
+
+      def per_invocation_class?(class_name)
+        return false if class_name.nil?
+
+        @per_invocation_classes_set.include?(class_name.to_s.delete_prefix("::"))
+      end
+
+      # ADR-125 — the macros whose arguments name a non-entry-point method on a descendant of the declared
+      # per-invocation class `class_name`: the union of `per_invocation_non_action_macros:` over the manifests
+      # that declare that class. An empty Set for a class no manifest declares.
+      def per_invocation_non_action_macros(class_name)
+        @per_invocation_macros.fetch(class_name.to_s.delete_prefix("::"), EMPTY_MACROS)
+      end
+
+      EMPTY_MACROS = Set.new.freeze
+      private_constant :EMPTY_MACROS
+
       # ADR-28 — flat, ordered list of every loaded plugin's path-scoped method-protocol contracts, in
       # plugin registration order. Read from each plugin's `#protocol_contracts` (which the manifest backs
       # by default but a plugin MAY override to fold in per-project config). Consumed by
@@ -465,12 +487,28 @@ module Rigor
         @rbs_complete_ancestors_set = @rbs_complete_ancestors.to_set.freeze
         @rbs_complete_extends = aggregate_class_names(manifests, :rbs_complete_extends)
         @rbs_complete_extends_set = @rbs_complete_extends.to_set.freeze
+        @per_invocation_classes = aggregate_class_names(manifests, :per_invocation_classes)
+        @per_invocation_classes_set = @per_invocation_classes.to_set.freeze
+        @per_invocation_macros = compile_per_invocation_macros(manifests)
         @type_node_resolvers = manifests.flat_map { |m| m&.type_node_resolvers || [] }.freeze
         @protocol_contracts = @plugins.flat_map { |p| safe_protocol_contracts(p) }.freeze
         @contracts_by_path = {}
         @effect_memo = {}
       end
 
+      # ADR-125 — declared class name => frozen Set of the non-action macros its declaring manifests list.
+      def compile_per_invocation_macros(manifests)
+        table = Hash.new { |hash, key| hash[key] = Set.new }
+        manifests.each do |manifest|
+          next if manifest.nil?
+
+          manifest.per_invocation_classes.each do |name|
+            table[name].merge(manifest.per_invocation_non_action_macros)
+          end
+        end
+        table.to_h { |name, macros| [name, macros.freeze] }.freeze
+      end
+
       # The shared shape of `open_receivers:` / `rbs_complete_ancestors:` — a flat uniq'd class-name list
       # aggregated across manifests, each entry normalised to String.
       def aggregate_class_names(manifests, field)

data/lib/rigor/protection/discovery_seed.rb

@@ -2,6 +2,10 @@
 
 require_relative "../inference/parameter_inference_collector"
 require_relative "../inference/scope_indexer"
+require_relative "../inference/project_seed_tables"
+require_relative "../cache/incremental_snapshot"
+require_relative "../analysis/path_expansion"
+require_relative "../analysis/buffer_binding"
 
 module Rigor
   module Protection
@@ -72,55 +76,79 @@ module Rigor
       # @param paths — the measured file set, in the same order {#bundles} was built from.
       # @param bundles — that bundle set.
       # @param buffer — the mutant binding (logical path → mutant bytes).
+      # @param constant_sources — ADR-124 — also carry the per-name writer paths (`constant_sources`), which a
+      #   `prebuilt:` runner needs to retract a `pre_eval:` constant another file also assigns (#663).
       # @return frozen seed tables.
-      def tables_for_buffer(paths:, bundles:, buffer:)
+      def tables_for_buffer(paths:, bundles:, buffer:, constant_sources: false)
         index = Inference::ScopeIndexer.discovered_project_index_incremental(
           paths, seed_bundles: bundles, buffer: buffer
         )
-        seed_tables(index).freeze
+        tables = seed_tables(index)
+        sources = index.fetch(:def_index).fetch(:constant_sources)
+        tables = tables.merge(constant_sources: sources) if constant_sources && !sources.empty?
+        tables.freeze
       end
 
-      # The whole-project discovery tables, from the single-walk combined pass (one parse per file, both
-      # collectors driven over the same tree) that {Analysis::Runner::ProjectPrePasses#discover} uses. Empty
-      # tables are dropped so an empty seed stays `{}` and every consumer's "seed nothing" branch keeps working.
+      # Issue #512 — the seed a one-shot probe (`rigor type-of`) can afford: the cross-file discovery tables for
+      # the configured paths, folded from the per-file bundles a prior `rigor check --incremental` left in the
+      # persistent snapshot, with `buffer`'s file (and any file whose bytes moved since) re-walked. A probe has
+      # no business re-parsing the project — that is what made the first attempt cost twice a single-file probe —
+      # so when there is no reusable snapshot this answers nil and the caller keeps its single-file scope. It
+      # never writes the snapshot.
       #
-      # `discovered_class_sources` is carried as the runner carries it on every run: Tier 2 never records edges,
-      # but an ancestor-order reader asks whether a class is declared in more than one file. The mixin tables
-      # (`discovered_includes`, `discovered_prepends`, `discovered_extends`) ride the same fold, so a singleton
-      # `extend` reads the same from a per-file scope under coverage and protection as it does under `check`.
-      def discovery_tables(paths)
-        seed_tables(Inference::ScopeIndexer.discovered_project_index_for_paths(paths))
+      # The snapshot is reused only under the fingerprint a bare `rigor check --incremental` writes (roots = the
+      # configured paths, the plain run mode): any other fingerprint, a different engine, configuration,
+      # lockfile or `sig/` included, is a miss.
+      #
+      # @param configuration — the probe's loaded configuration.
+      # @param buffer — the editor binding, or nil.
+      # @return frozen seed tables, or nil when the snapshot cannot seed this project.
+      def from_snapshot(configuration:, buffer: nil)
+        paths = Analysis::PathExpansion.configured_files(configuration)
+        return nil if paths.empty?
+
+        bundles = snapshot_bundles(configuration)
+        return nil if bundles.nil? || bundles.empty?
+
+        tables_for_buffer(paths: respell_for_buffer(paths, buffer), bundles: bundles, buffer: buffer,
+                          constant_sources: true)
       end
 
-      # Maps a `{ classes:, def_index: }` discovery index onto the {Scope::DiscoveryIndex} slot names both
-      # consumers take. Shared by the whole-walk ({#discovery_tables}) and bundle-fold ({#tables_for_buffer})
-      # producers so a mutant's seed and the parent's seed can never disagree about shape.
-      def seed_tables(index)
-        def_index = index.fetch(:def_index)
-        tables = { discovered_classes: index.fetch(:classes) }
-        %i[
-          def_nodes def_nestings singleton_def_nodes def_sources singleton_def_sources superclasses includes
-          extends prepends unpositioned_mixins class_sources
-          method_visibilities methods parameter_envelopes data_member_layouts struct_member_layouts
-          deferred_ranges refinements global_write_census
-        ].each do |slot|
-          tables[seed_key(slot)] = def_index.fetch(slot)
+      # The configured file list with the entry that reaches `buffer`'s file respelled as the buffer's logical
+      # path: the binding substitutes bytes only for a path spelled exactly as its logical path, while the
+      # configured paths may be relative or reach the file through a symlink. `real_paths` is the memoised
+      # `BufferBinding.real_path` of each entry when the caller keeps one.
+      def respell_for_buffer(paths, buffer, real_paths: nil)
+        return paths if buffer.nil?
+
+        real = Analysis::BufferBinding.real_path(buffer.logical_path)
+        paths.each_with_index.map do |path, index|
+          entry_real = real_paths ? real_paths[index] : Analysis::BufferBinding.real_path(path)
+          entry_real == real ? buffer.logical_path : path
         end
-        # ADR-119 WD1 — the pairs travel as one: an unpaired empty table is dropped here, a pair only when both
-        # halves are empty (`compact_pairs`), so a non-empty sibling is never stranded by an empty member.
-        tables.merge!(def_index.fetch(:siblings))
-        Scope::DiscoveryIndex.compact_pairs(
-          tables.reject { |name, table| !Scope::DiscoveryIndex.paired?(name) && (table.nil? || table.empty?) }
-        )
       end
 
-      UNPREFIXED_SLOTS = %i[data_member_layouts struct_member_layouts unpositioned_mixins].freeze
-      private_constant :UNPREFIXED_SLOTS
+      def snapshot_bundles(configuration)
+        fingerprint = Cache::IncrementalSnapshot.fingerprint(configuration: configuration, roots: configuration.paths)
+        return nil if fingerprint.nil?
+
+        loaded = Cache::IncrementalSnapshot.new(root: configuration.cache_path).load_any(fingerprints: [fingerprint])
+        loaded&.last&.seed_bundles
+      end
+
+      # The whole-project discovery tables, from the single-walk combined pass (one parse per file) that
+      # {Analysis::Runner::ProjectPrePasses#discover} uses, mapped by the one list {Inference::ProjectSeedTables}
+      # keeps (issue #1614). Empty tables are dropped so an empty seed stays `{}` and every consumer's "seed nothing"
+      # branch keeps working.
+      def discovery_tables(paths)
+        seed_tables(Inference::ScopeIndexer.discovered_project_index_for_paths(paths))
+      end
 
-      # The def-index slot names match the {Scope::DiscoveryIndex} ones under a `discovered_` prefix, except the
-      # two member-layout tables and the unpositioned-mixin table, which carry the same name on both sides.
-      def seed_key(slot)
-        UNPREFIXED_SLOTS.include?(slot) ? slot : :"discovered_#{slot}"
+      # Maps a `{ classes:, def_index: }` discovery index onto the {Scope::DiscoveryIndex} slot names both consumers
+      # take. Shared by the whole-walk ({#discovery_tables}) and bundle-fold ({#tables_for_buffer}) producers so a
+      # mutant's seed and the parent's seed can never disagree about shape.
+      def seed_tables(index)
+        Inference::ProjectSeedTables.from_index(index)
       end
     end
   end