rigortype 0.4.4 → 0.4.6

data/lib/rigor/analysis/incremental_session.rb

@@ -5,6 +5,7 @@ require_relative "incremental"
 require_relative "incremental_run_slot"
 require_relative "incremental_run_slot/write_guard"
 require_relative "plugin_fact_fingerprint"
+require_relative "run_disclosure_ledger"
 require_relative "source_rbs_gate"
 require_relative "../cache/file_digest"
 require_relative "../cache/incremental_snapshot"
@@ -40,15 +41,19 @@ module Rigor
       # unconditional snapshot rewrite.
       # `rebaselined` (#1898) is true when the recheck found its served effect collections stale and answered with a
       # full baseline instead; see {#rebaseline_recheck}.
-      Recheck = Data.define(:diagnostics, :changed, :added, :removed, :affected, :reused, :templates, :rebaselined) do
-        def initialize(rebaselined: false, **rest)
+      # `stale_readers` (#1553) are the files the recheck re-analysed because a plugin read one of them made went
+      # stale ({#plugin_read_affected}).
+      Recheck = Data.define(:diagnostics, :changed, :added, :removed, :affected, :reused, :templates, :rebaselined,
+                            :stale_readers) do
+        def initialize(rebaselined: false, stale_readers: Set.new, **rest)
           super
         end
 
-        # A recheck that changed, added, and removed nothing — the session state is byte-equivalent to the
-        # snapshot that was restored, so persisting it again would only rewrite identical bytes.
+        # A recheck that changed, added, and removed nothing, and found no stale plugin read — the session state is
+        # byte-equivalent to the snapshot that was restored, so persisting it again would only rewrite identical
+        # bytes. A stale reader's refreshed rows differ (#1553): unsaved, every later run would re-analyse it.
         def no_change?
-          changed.empty? && added.empty? && removed.empty?
+          changed.empty? && added.empty? && removed.empty? && stale_readers.empty?
         end
       end
 
@@ -99,6 +104,9 @@ module Rigor
         @cache = {}              # analyzed path => [Diagnostic]
         @sources = {}            # analyzed path => Set<source path it read from>
         @digests = {}            # analyzed path => ADR-87 packed stat-digest entry at last analysis
+        # Issue #1583 — discovered-not-analysed path => the same packed entry, for a run over path arguments that
+        # #684 widened to the configured `paths:`. Empty on every run over the configured paths.
+        @discovery_digests = {}
         @analyzed = []           # the project files analyzed last round
         @dependents = {}         # inverted @sources (file-level)
         # ADR-46 slice 4 — symbol-granularity tracking.
@@ -128,6 +136,13 @@ module Rigor
         # and a missing invalidation edge is impossible by construction — the reason this is a table diff
         # and not the caller→callee edge recording #204 first sketched.
         @param_table = {}
+        # Issue #1553 — analysed path => the plugin reads ({Plugin::IoBoundary.attributing}) its last analysis made:
+        # the frozen `Cache::Descriptor::FileEntry` / `GlobEntry` rows, as each read observed its input. A recheck
+        # re-analyses every file one of whose rows no longer validates ({#plugin_read_affected}).
+        @plugin_reads = {}
+        # Issue #2020 — the run-scoped plugin rows each analysed file registered, and the reads that make one stale.
+        @plugin_disclosures = RunDisclosureLedger.new
+        @stale_disclosures = Set.new
         reset_carried_state
         # ADR-88 WD1 — the plugin fact-surface digest computed for THIS invocation (nil until a
         # `#run_incremental` pass runs / a plugin-free project) and the reporting flags a caller (the CLI
@@ -151,6 +166,49 @@ module Rigor
         current_files
       end
 
+      # Issue #1583 (and #1560) — whether a file the run discovers but does not analyse was edited, added or
+      # removed since the snapshot. Such a file feeds the cross-file index the analysed files resolve against
+      # (a constant, a method, an ancestor), but no recorded edge or digest of the analysed set sees it move.
+      # A move re-baselines the session: discovery-only files are not tracked per symbol, so the closure
+      # cannot be narrowed, and the full analysis is over the argument set alone. A session over the
+      # configured `paths:` discovers nothing beyond what it analyses and pays nothing here.
+      def discovery_moved?
+        current = current_discovery_only_files
+        return true unless current.size == @discovery_digests.size
+
+        current.any? do |path|
+          entry = @discovery_digests[path]
+          entry.nil? || !Cache::FileDigest.stat_fresh?(path, entry)
+        end
+      rescue StandardError
+        true
+      end
+
+      # A baseline's freshness entries: each analysed file's, and (issue #1583) each discovered-not-analysed file's.
+      def record_baseline_digests
+        @digests = @analyzed.to_h { |path| [path, pack_digest(path)] }
+        @discovery_digests = current_discovery_only_files.to_h { |path| [path, pack_digest(path)] }
+        forget_unbound_digests
+      end
+
+      def restore_digests(payload)
+        @digests = payload.digests
+        @discovery_digests = payload.discovery_digests # Issue #1583 — `{}` in a payload built without it.
+      end
+
+      # Issue #1583 — the discovered-not-analysed files of a run over this session's paths
+      # ({Runner#discovery_only_file_set}). Asked of a runner WITHOUT the editor buffer: a buffered run does not
+      # widen, so a buffered session (editor mode option B, #146) would read an empty set against the snapshot's
+      # and re-baseline on every keystroke. Globbing without it keeps the comparison the one the snapshot's
+      # writer made, so a sibling edit still declines option B and an unchanged project still serves it.
+      def current_discovery_only_files
+        return [] if @paths.nil?
+
+        Runner.new(configuration: @configuration, cache_store: nil, environment: @environment)
+              .discovery_only_file_set(@paths)
+      end
+      private :discovery_moved?, :record_baseline_digests, :restore_digests, :current_discovery_only_files
+
       # The per-file discovery bundles of the last run, keyed by path (ADR-85 WD2).
       attr_reader :seed_bundles
 
@@ -215,9 +273,11 @@ module Rigor
         @effect_collections = runner.effect_collections_by_path
         @effects_identity = current_effects_identity
         @effect_plugin_digest = effect_plugin_digest_of(runner)
+        @synthetic_surface_digest = synthetic_surface_digest_of(runner)
         @cache = per_file(runner.per_file_diagnostics)
-        @digests = @analyzed.to_h { |path| [path, pack_digest(path)] }
-        forget_unbound_digests
+        @plugin_reads = plugin_reads_of(runner, @analyzed)
+        @plugin_disclosures = RunDisclosureLedger.from(runner.analysis_disclosures.slice(*@analyzed))
+        record_baseline_digests
         @run_level_rows = runner.run_level_rows
         diagnostics
       end
@@ -231,6 +291,8 @@ module Rigor
         added = current - previous
         removed = previous - current
         changed = changed_paths(current & previous)
+        return rebaseline_recheck(changed, added, removed) if discovery_moved?
+
         # ADR-67 WD6c lift — recompute the whole-project inferred-param table BEFORE deciding the closure,
         # and diff it against the snapshot's copy: an entry that moved (because a caller's argument type
         # changed, a caller appeared, or one vanished) invalidates the CALLEE's file and its symbol
@@ -238,21 +300,47 @@ module Rigor
         fresh_params = fresh_param_table(current, changed, added, removed)
         param_files, param_pairs = param_seed_invalidation(fresh_params)
         affected = affected_closure(changed, added, removed, param_files, param_pairs)
+        affected, analyze_set, runner, merged, reused =
+          run_settled_closure(affected, [current, previous, removed], fresh_params)
+        if served_effects_stale?(runner, reused) || synthetic_surface_moved?(runner, reused)
+          return rebaseline_recheck(changed, added, removed)
+        end
+
+        absorb(runner, current, analyze_set, removed)
+        @param_table = fresh_params
+        recheck_result(merged, [changed, added, removed], affected: affected, reused: reused.to_set, runner: runner,
+                                                          stale_readers: @stale_plugin_readers)
+      end
+
+      # {#recheck}'s narrowed run. Issue #2020 — a stale run-scoped key whose chosen refresher registered nothing (a
+      # parse error, a plugin that raised, an edit that took the notice out of its text) is decided by its other
+      # holders, so they join the closure and it runs again. Returns `[affected, analyze_set, runner, merged, reused]`.
+      def run_settled_closure(affected, (current, previous, removed), fresh_params)
+        forced, analyze_set = forced_analyze_set(affected, current)
+        runner, merged, reused = run_closure(analyze_set, current, previous, forced, fresh_params)
+        fallback = @plugin_disclosures.unresolved_holders(runner.analysis_disclosures, analyze_set, @stale_disclosures,
+                                                          removed.to_set)
+        return [affected, analyze_set, runner, merged, reused] if fallback.empty?
+
+        affected = (affected | fallback).freeze
+        @stale_plugin_readers |= fallback
         forced, analyze_set = forced_analyze_set(affected, current)
+        [affected, analyze_set, *run_closure(analyze_set, current, previous, forced, fresh_params)]
+      end
+      private :run_settled_closure
+
+      # One narrowed run of {#recheck}'s closure: the runner, its merged rows, and the files it served. The freshly
+      # collected table is handed to the runner so the run seeds from the SAME table the diff was decided on (and the
+      # collector runs once per recheck, not twice). The reused files' cached rows go in too, so the runner lists them
+      # in the full run's file order (#1524).
+      def run_closure(analyze_set, current, previous, forced, fresh_params)
         reused = (current & previous) - analyze_set.to_a
-        # The freshly collected table is handed to the runner so the run seeds from the SAME table the diff
-        # was decided on (and the collector runs once per recheck, not twice). The reused files' cached rows
-        # go in too, so the runner lists them in the full run's file order (#1524).
         runner = build_runner(analyze_only: analyze_set, record_dependencies: true,
                               param_inferred_types: fresh_params, **forced_target_options(forced),
                               restored_run_level_rows: @run_level_rows, **served_state(reused))
-        merged = run_runner(runner).diagnostics
-        return rebaseline_recheck(changed, added, removed) if served_effects_stale?(runner, reused)
-
-        absorb(runner, current, analyze_set, removed)
-        @param_table = fresh_params
-        recheck_result(merged, [changed, added, removed], affected: affected, reused: reused.to_set, runner: runner)
+        [runner, run_runner(runner).diagnostics, reused]
       end
+      private :run_closure
 
       # Editor mode option B (#146) — a whole-project recheck with the editor's buffer substituted for one
       # file, for the CLI's `--incremental --tmp-file=X --instead-of=Y`. Returns the {Recheck} when the
@@ -304,9 +392,10 @@ module Rigor
       # records none at all), so no dependent set can bound who read it. An edit that moved it re-analyses the
       # whole project — what a `sig/` edit already costs through the snapshot fingerprint.
       def affected_closure(changed, added, removed, param_files = Set.new, param_pairs = Set.new)
+        @stale_plugin_readers = plugin_read_affected | disclosure_refreshers(removed)
         return whole_project_closure(changed, added) if source_rbs_gate.moved?(@seed_bundles, changed, added, removed)
 
-        gated_closure(changed, added, removed, param_files, param_pairs)
+        (gated_closure(changed, added, removed, param_files, param_pairs) | @stale_plugin_readers).freeze
       end
 
       # {#affected_closure} for an edit whose synthesized RBS is byte-identical in every file it touched.
@@ -350,17 +439,47 @@ module Rigor
         closure.freeze
       end
 
+      # Issue #1553 — every analysed file whose last analysis made a plugin read that no longer validates: a file
+      # read through {Plugin::IoBoundary#read_file} or probed through `#file?` / `#directory?` was edited,
+      # removed, or created after a read that found it absent, or a `#list_directory` / `#glob` listing moved.
+      # The ADR-46 edges record type and declaration reads only, so none of these moves a reader into the
+      # closure, and its cached rows were computed from the input as it was. The reader's own text is unchanged,
+      # so it joins the closure alone: a plugin read made while analysing a dependent is credited to that
+      # dependent. Each distinct row is validated once however many files made it (one `File.stat` for a
+      # content row whose stat tuple did not move, one re-glob for a listing row).
+      def plugin_read_affected
+        verdicts = {}
+        @plugin_reads.each_with_object(Set.new) do |(path, rows), stale|
+          next unless rows.any? { |row| !verdicts.fetch(row) { verdicts[row] = plugin_read_fresh?(row) } }
+
+          stale << path
+        end
+      end
+
+      def plugin_read_fresh?(row)
+        if row.is_a?(Cache::Descriptor::GlobEntry)
+          Cache::Descriptor::GlobEntry.fresh?(row)
+        else
+          Cache::Descriptor.new(files: [row]).fresh?
+        end
+      end
+
+      # Issue #1553 — `runner`'s per-file plugin reads for `paths`, each file's rows de-duplicated and frozen.
+      def plugin_reads_of(runner, paths)
+        runner.analysis_reads.slice(*paths).transform_values { |rows| rows.uniq.freeze }
+      end
+
       # Issue #1906 — a file that rewrites a constant's singleton names without declaring it
-      # (`D.singleton_class.alias_method :own, :keep`) contributes opaque singleton envelopes to the constant's bucket,
-      # but a reader's class edge names only the files that declared the constant when the reader last ran, and the
-      # class-declaration diff does not move while the constant stays in the file (`:own` becoming `:keep`, or the
-      # call becoming a `class D` reopening). So a declaration-unstable edit to such a file fires `class:<last
-      # segment>` for each constant that, before the edit, both sat in the file's singleton-source set and held a
-      # singleton envelope entry or an unpositioned singleton side the file recorded (a computed name there leaves the
-      # side unpositioned, and becoming literal reads it again). A file that only includes into a constant
-      # (`ActiveRecord::Base.include(X)`) records neither and fires nothing. A constant the edit makes the file
-      # rewrite needs no key: the class-declaration diff fires if it is new to the file, and the reader's class edge
-      # names the file if the file declared it.
+      # (`D.singleton_class.alias_method :own, :keep`, or, since #1941, `def D.own`) contributes opaque singleton
+      # envelopes to the constant's bucket, but a reader's class edge names only the files that declared the constant
+      # when the reader last ran, and the class-declaration diff does not move while the constant stays in the file
+      # (`:own` becoming `:keep`, or the call becoming a `class D` reopening). So a declaration-unstable edit to such a
+      # file fires `class:<last segment>` for each constant that, before the edit, both sat in the file's
+      # singleton-source set and held a singleton envelope entry or an unpositioned singleton side the file recorded (a
+      # computed name there leaves the side unpositioned, and becoming literal reads it again). A file that only
+      # includes into a constant (`ActiveRecord::Base.include(X)`) records neither and fires nothing. A constant the
+      # edit makes the file rewrite needs no key: the class-declaration diff fires if it is new to the file, and the
+      # reader's class edge names the file if the file declared it.
       def singleton_rewrite_affected(unstable)
         names = unstable.flat_map { |path| singleton_rewritten_constants(@seed_bundles[path]) }.uniq
         return Set.new if names.empty?
@@ -383,8 +502,8 @@ module Rigor
       # exempts such a write is a fact of the whole program — an alias, or a `write` / `to_str` / `to_int` / hatch
       # defined in any spelling on any receiver, a rewritten ancestor, a mixin — which no name-keyed edge can
       # follow, so a stale report would outlive the edit that exempts it. Such files are rare, so this costs little.
-      # A file the census silenced is not re-checked when the exemption goes away: that stale answer misses a
-      # report, it never makes one.
+      # A file the census silenced is re-checked through the `global_census:` keys its rule recorded
+      # ({#global_census_affected}, issue #2158).
       def global_write_reporters
         @cache.each_with_object(Set.new) do |(path, diagnostics), reporters|
           reporters << path if diagnostics.any? { |diagnostic| diagnostic.rule.to_s.start_with?("global.") }
@@ -532,6 +651,32 @@ module Rigor
         run_runner(runner).diagnostics
       end
 
+      # Issue #1967 — the edit replay of `--verify-incremental-edits`: a warm recheck of this session's baseline with
+      # `buffer` standing in for one file, the way editor mode option B (#146) rechecks an unsaved edit. The baseline is
+      # handed over as a Marshal copy of the snapshot a `--incremental` run would save, through a fresh session that
+      # never persists, so this session's own state is untouched and each replay starts from the same baseline. Unlike
+      # {#reanalyze_subset}, whose tree is the baseline's, the edit moves what the served files' rows were computed
+      # from, so a dependent the recheck fails to re-analyse is served stale and the comparison sees it. Returns the
+      # {Recheck}, or nil when the recheck declined as option B does (the plugin fact surface moved, an unverified
+      # source-RBS gate, a re-baseline), where the answer would be a full analysis and there is nothing to compare.
+      def replay_edit(buffer)
+        adopt_plugin_fact_fingerprint if @plugin_fact_reusable.nil?
+        replay = IncrementalSession.new(
+          configuration: @configuration, paths: @paths, environment: @environment, cache_store: @cache_store,
+          plugin_requirer: @plugin_requirer, buffer: buffer, explain: @explain
+        )
+        replay.run_buffer_recheck(snapshot: ReplaySnapshot.new(blob: Marshal.dump(to_payload)), fingerprint: :replay)
+      end
+
+      # The in-memory stand-in for {Cache::IncrementalSnapshot} {#replay_edit} hands its replay session: every load is a
+      # fresh copy, as a load from disk is.
+      ReplaySnapshot = Data.define(:blob) do
+        def load(fingerprint:) # rubocop:disable Lint/UnusedMethodArgument
+          Marshal.load(blob) # rubocop:disable Security/MarshalLoad
+        end
+      end
+      private_constant :ReplaySnapshot
+
       # Cross-process incremental run (the `--incremental` flag's engine). With a disk `snapshot` whose
       # `fingerprint` matches, restore the prior per-file state and `#recheck` (re-analyze only the changed
       # closure, serve the rest from the restored cache); otherwise run a full `#baseline`. Either way,
@@ -669,7 +814,7 @@ module Rigor
       # the gate could not see. {#run_incremental} re-analyses the project and {#run_buffer_recheck} declines,
       # the way each treats a moved plugin fact surface. A run that changed nothing is exempt: under an
       # untrusted gate every earlier edit already re-analysed the whole project, so the snapshot it serves is
-      # whole, and a null run stays one.
+      # whole, and a null run stays one. A recheck that found a stale plugin read (#1553) is a change.
       def source_rbs_unverified?(result)
         source_rbs_gate.untrusted? && !result.no_change? && !result.reused.empty?
       end
@@ -889,7 +1034,7 @@ module Rigor
         @analyzed = payload.analyzed
         @cache = payload.cache
         @sources = payload.sources
-        @digests = payload.digests
+        restore_digests(payload)
         # ADR-85 WD2 — restore the per-file discovery bundles if present (absent in a pre-#85 snapshot → empty,
         # so the recheck's discovery re-walks every file: a cold-quality index, always sound). The SCHEMA bump
         # makes a genuinely stale-shaped bundle unreadable rather than mis-folded.
@@ -903,6 +1048,7 @@ module Rigor
         restore_structural_declarations(payload)
         @return_summaries  = payload.return_summaries || {}
         @param_table       = payload.param_table || {} # ADR-67 WD6c lift — the seeds the cache was built under.
+        restore_plugin_records(payload)
         # Issues #796 / #794 — absent (nil) in a snapshot written before schema 22 is impossible (the SCHEMA
         # gate rejects one), so nil here means the writing run genuinely had nothing to say.
         @run_level_rows    = payload.run_level_rows
@@ -918,6 +1064,14 @@ module Rigor
         @negative_dependents = Incremental.invert(@missing)
       end
 
+      # Issue #1553 — the plugin reads each file's last analysis made, and (#2020) the run-scoped plugin rows it
+      # registered; `{}` in a payload built without them. Extracted to keep {#restore} under its ABC budget.
+      def restore_plugin_records(payload)
+        @plugin_reads = payload.plugin_reads
+        @plugin_disclosures = RunDisclosureLedger.load(payload.plugin_disclosures)
+        @synthetic_surface_digest = payload.synthetic_surface_digest # the plugin-built ADR-16 index (PR #2286 M1)
+      end
+
       # ADR-46 slice 3 / issue #644 — the structural tier's negative-edge state: the per-consumer missed
       # lookups plus the two per-file DECLARATION sets (`class_decls`, `constant_decls`) whose diff says what
       # APPEARED in an edit. Absent in an older snapshot → empty, which only loses the appeared-symbol
@@ -942,7 +1096,11 @@ module Rigor
           effect_collections: marshal_safe_effect_collections,
           effects_identity: @effects_identity,
           run_level_rows: @run_level_rows,
-          effect_plugin_digest: @effect_plugin_digest
+          effect_plugin_digest: @effect_plugin_digest,
+          synthetic_surface_digest: @synthetic_surface_digest,
+          plugin_reads: @plugin_reads,
+          plugin_disclosures: @plugin_disclosures.to_h,
+          discovery_digests: @discovery_digests
         )
       end
 
@@ -1054,15 +1212,20 @@ module Rigor
         whole_project = current.all? { |path| analyze_set.include?(path) }
         @seed_bundles = source_rbs_gate.stamp(runner.seed_bundles, whole_project: whole_project)
         fresh_by_file = per_file(runner.per_file_diagnostics)
+        # Issue #1553 — a re-analysed file's reads are this run's: a read it no longer makes stops guarding it.
+        fresh_reads = plugin_reads_of(runner, analyze_set)
         analyze_set.each do |path|
           @cache[path] = fresh_by_file[path] || []
           @digests[path] = pack_digest(path)
+          fresh_reads.key?(path) ? @plugin_reads[path] = fresh_reads[path] : @plugin_reads.delete(path)
         end
+        absorb_disclosures(runner, analyze_set)
         forget_unbound_digests
         absorb_dependency_graph(runner)
         # Issues #796 / #794 — the recheck's own snapshots already carry the replayed rows folded together
         # with anything its closure demanded for itself, so this is the same union the next run replays.
         @run_level_rows = runner.run_level_rows
+        @synthetic_surface_digest = synthetic_surface_digest_of(runner)
         refresh_return_summaries(runner, analyze_set)
         refresh_effect_collections(runner, analyze_set)
       end
@@ -1105,6 +1268,8 @@ module Rigor
         @cache.delete(path)
         @digests.delete(path)
         @sources.delete(path)
+        @plugin_reads.delete(path)
+        @plugin_disclosures.forget(path) # Unpinned hygiene: a removed file is never served, so never replayed.
         @symbol_sources.delete(path)
         @ancestry_sources.delete(path)
         @missing.delete(path)
@@ -1176,7 +1341,8 @@ module Rigor
       # top-level def, `method:C#m` otherwise), then unions the recorded negative-dependents of those keys.
       # Issue #1120 — plus the consumers of any refinement name the edit moved ({#refinement_affected}). Issue #1367 —
       # and every file whose last result holds a `global.*` diagnostic ({#global_write_reporters}). Issue #1459 — and
-      # the consumers of any method name a file started or stopped defining ({#defined_name_affected}).
+      # the consumers of any method name a file started or stopped defining ({#defined_name_affected}). Issue #2134 —
+      # and the consumers of any visibility slot a file moved ({#visibility_name_affected}).
       def negative_affected(changed, removed, new_fingerprints, new_class_decls, new_constant_decls, summary = nil)
         appeared_methods = Incremental.appeared_symbols(changed, @symbol_fingerprints, new_fingerprints)
         # Issue #639 — a class DISAPPEARING satisfies the `class:` kind too, now that a resolved bare
@@ -1193,8 +1359,61 @@ module Rigor
         keys = appeared_methods.map { |symbol| negative_key_for(symbol) }
         keys.concat(class_move_keys(moved_classes))
         keys.concat(moved_constants.map { |name| "constant:#{name.split('::').last}" })
-        Incremental.negative_closure(keys, @negative_dependents) | refinement_affected(changed + removed, summary) |
-          defined_name_affected(changed + removed, summary) | global_write_reporters
+        Incremental.negative_closure(keys, @negative_dependents) | table_diff_affected(changed + removed, summary) |
+          global_write_reporters
+      end
+
+      # The consumers of the name-keyed edges whose producers diff a per-file table between each file's seed bundle
+      # and the scan.
+      def table_diff_affected(paths, summary)
+        refinement_affected(paths, summary) | defined_name_affected(paths, summary) |
+          visibility_name_affected(paths, summary) | mark_affected(paths, summary) |
+          global_census_affected(paths, summary) | ivar_set_affected(paths, summary)
+      end
+
+      # Issue #1833 — the consumers whose answer read a class mark that moved in this edit. A reader of a class's
+      # envelope bucket records `mark:<last segment>` (`Scope#parameter_envelopes_of`), whichever way it answered, so
+      # a file that adds or drops only a mark (`x.singleton_class.prepend(Comparable)`, `o.extend(Helper)` in a
+      # method body, a `refine` block's refined mark) re-checks it although the file declares nothing it read. A
+      # reader that scans every bucket for an object-extended module (`SourceArity#object_extension_may_shadow?`)
+      # records `mark:*`, which fires when an object-extended mark moves. The before-state is each touched file's
+      # seed bundle, the after-state the scan's merged table.
+      #
+      # Issue #1661 — and `mixin:<qualified name>` for a class or module whose unpositioned mixin edges moved
+      # ({Incremental.changed_unpositioned_owners}): an external chain entry records it for each name it can denote
+      # (`ResolutionChain#record_hooks`), so a new file that taints `Comparable` with `include(*MODS)` re-checks the
+      # readers of a chain through it. It is not `mark:`, which a plain reopening of a module moves (the bucket's
+      # module mark) and which would re-check every reader of `Kernel` on any `module Kernel` reopening.
+      def mark_affected(paths, summary)
+        def_index = summary && summary[:def_index]
+        before = paths.map { |path| @seed_bundles.dig(path, :parameter_envelopes) }
+        moved = Incremental.changed_class_marks(before, [def_index && def_index[:parameter_envelopes]])
+        tainted = Incremental.changed_unpositioned_owners(
+          paths.map { |path| @seed_bundles.dig(path, :unpositioned_mixins) },
+          [def_index && def_index[:unpositioned_mixins]]
+        )
+        return Set.new if moved.empty? && tainted.empty?
+
+        keys = moved.map { |(class_name, _mark)| "mark:#{class_name.split('::').last}" }.uniq
+        keys.concat(mixin_keys(tainted))
+        extended = Scope::DiscoveryIndex::ENVELOPE_OBJECT_EXTENDED_MARK
+        keys << "mark:*" if moved.any? { |(_class_name, mark)| mark == extended }
+        Incremental.negative_closure(keys, @negative_dependents)
+      end
+
+      # Issue #1661 — the `mixin:` keys an owner of a moved unpositioned edge fires. The table keys a receiver-form
+      # owner by the spelling written (`class File; Constants.include(*MODS); end` is `"Constants"`), not the constant
+      # Ruby resolves it to, while the chain files the qualified candidate (`mixin:File::Constants`). The table does
+      # not carry the nesting, and every lexical-prefix candidate of the owner ends in `::<owner>`, so the owner fires
+      # its own key and every recorded `mixin:` key ending in `::<owner>`. A relative spelling over-fires to the
+      # readers of every module sharing its trailing segments; a qualified one fires only its suffix matches.
+      def mixin_keys(owners)
+        keys = owners.map { |name| "mixin:#{name}" }
+        suffixes = owners.map { |name| "::#{name}" }
+        @negative_dependents.each_key do |key|
+          keys << key if key.start_with?("mixin:") && suffixes.any? { |suffix| key.end_with?(suffix) }
+        end
+        keys.uniq
       end
 
       # The negative keys a class-declaration diff fires: `class:<last segment>` for a class name, and (issue #1820)
@@ -1238,6 +1457,53 @@ module Rigor
         Incremental.negative_closure(names.map { |name| "defines:#{name}" }, @negative_dependents)
       end
 
+      # Issue #2158 — the consumers whose `global.*` write rule read a census entry that a file in `paths` started or
+      # stopped writing. The before-state is each file's seed bundle, the after-state the scan's per-file census. The
+      # write the census silenced reports nothing, so {#global_write_reporters} does not reach it.
+      def global_census_affected(paths, summary)
+        after = (summary && summary[:global_write_census]) || {}
+        before = paths.to_h { |path| [path, @seed_bundles.dig(path, :global_write_census)] }
+        keys = Incremental.changed_global_census_keys(paths, before, after)
+        return Set.new if keys.empty?
+
+        Incremental.negative_closure(keys, @negative_dependents)
+      end
+
+      # Issue #1154 — the consumers whose declared-parameter ivar credit read an ivar writer entry a file in `paths`
+      # started or stopped recording ({GlobalWriteCensus.ivar_key}: `ivar_set:@x`, `ivar_set_class:K`,
+      # `own_write:K#@x`). The before-state is each file's seed bundle, the after-state the scan's per-file census. The
+      # write sits in a method body, so neither the declaration signature nor the symbol fingerprints move with it.
+      def ivar_set_affected(paths, summary)
+        after = (summary && summary[:global_write_census]) || {}
+        keys = Set.new
+        paths.each do |path|
+          census = @seed_bundles.dig(path, :global_write_census) || Inference::GlobalWriteCensus::EMPTY
+          before = Inference::GlobalWriteCensus.ivar_set_entries(census)
+          now = Inference::GlobalWriteCensus.ivar_set_entries(after[path] || Inference::GlobalWriteCensus::EMPTY)
+          (before ^ now).each { |entry| keys << Inference::GlobalWriteCensus.ivar_key(entry) }
+        end
+        return Set.new if keys.empty?
+
+        Incremental.negative_closure(keys.to_a, @negative_dependents)
+      end
+
+      # Issue #2134 — the consumers whose answer read a class's visibility slot for a method, or its contest, for each
+      # slot whose entries a file in `paths` added, dropped or changed (`Scope#discovered_method_visibility`). The
+      # before-state is each file's seed bundle, the after-state the scan's per-file entries. A `private :foo` in a
+      # reopening or a `class_eval` block moves no `def`, so neither the symbol fingerprints nor the defined-name diff
+      # sees it.
+      def visibility_name_affected(paths, summary)
+        after = (summary && summary[:visibility_entries]) || {}
+        before = paths.to_h do |path|
+          bundle = @seed_bundles[path]
+          [path, bundle && Inference::ScopeIndexer.visibility_entries(bundle)]
+        end
+        slots = Incremental.changed_visibility_slots(paths, before, after)
+        return Set.new if slots.empty?
+
+        Incremental.negative_closure(slots.map { |slot| "visibility:#{slot}" }, @negative_dependents)
+      end
+
       # The qualified class/module names declared in the pre-parsed `index` (shared with
       # {#symbol_fingerprints_from_index}, so the changed set is parsed once). `{ path => Set<class name> }`.
       def class_declarations_from_index(index)
@@ -1400,7 +1666,22 @@ module Rigor
       # and (#1898) their effect collections, so the run closes its effect graph over the whole project.
       def served_state(reused)
         { served_per_file_diagnostics: @cache.slice(*reused),
-          served_effect_collections: @effect_collections.slice(*reused) }
+          served_effect_collections: @effect_collections.slice(*reused),
+          served_run_disclosures: @plugin_disclosures.served(reused, @stale_disclosures) }
+      end
+
+      # Issue #2020 — folds the run's run-scoped registrations into the ledger, refreshing the keys this recheck found
+      # stale. Extracted to keep {#absorb} under its ABC budget.
+      def absorb_disclosures(runner, analyze_set)
+        @plugin_disclosures.absorb(runner.analysis_disclosures, analyze_set, @stale_disclosures)
+        @stale_disclosures = Set.new
+      end
+
+      # Issue #2020 — the run-scoped plugin rows whose reads went stale ({RunDisclosureLedger}): one registering file
+      # each joins the closure, and their replays are withheld until {#absorb} refreshes them from that file.
+      def disclosure_refreshers(removed)
+        @stale_disclosures = @plugin_disclosures.stale_identities { |row| plugin_read_fresh?(row) }
+        @plugin_disclosures.refreshers(@stale_disclosures, removed.to_set)
       end
 
       # Issue #1898 — the plugin effect-fact digest a run's collections were stamped under. A plugin writes its
@@ -1419,6 +1700,21 @@ module Rigor
         effect_plugin_digest_of(runner) != @effect_plugin_digest
       end
 
+      # PR #2286 review M1 — whether the ADR-16 synthetic-method index `runner` built differs from the one the
+      # served files were analysed under. The index comes from class-body DSL calls (`devise :confirmable`,
+      # a Tier C `attribute`), which no declaration signature records and no dependency edge names, so a file
+      # that dispatched through a synthesised member is not in the closure of the edit that removed it. The
+      # comparison waits for the run because the index is built by its pre-pass; a move re-analyses the project.
+      def synthetic_surface_moved?(runner, reused)
+        return false if reused.empty?
+
+        synthetic_surface_digest_of(runner) != @synthetic_surface_digest
+      end
+
+      def synthetic_surface_digest_of(runner)
+        runner.synthetic_method_index&.surface_digest
+      end
+
       # The answer {#recheck} gives when {#served_effects_stale?}: a full baseline, reported as a recheck that
       # re-analysed every file. {#run_incremental} reads `rebaselined` so it neither runs a second baseline
       # nor reports the run as warm.
@@ -1429,9 +1725,10 @@ module Rigor
       end
 
       # A {Recheck} over `deltas` (`[changed, added, removed]`), counting `runner`'s template units.
-      def recheck_result(diagnostics, deltas, affected:, reused:, runner:, rebaselined: false)
+      def recheck_result(diagnostics, deltas, affected:, reused:, runner:, rebaselined: false, stale_readers: Set.new)
         changed, added, removed = deltas.map(&:to_set)
         Recheck.new(diagnostics: diagnostics, changed: changed, added: added, removed: removed, affected: affected,
+                    stale_readers: stale_readers,
                     reused: reused, templates: runner.template_unit_paths.size, rebaselined: rebaselined)
       end
 
@@ -1502,19 +1799,12 @@ module Rigor
       def rebind_buffer(files)
         return if @buffer.nil? || files.include?(@buffer.logical_path)
 
-        target = real_path(@buffer.logical_path)
-        return if target.nil?
+        target = BufferBinding.real_path(@buffer.logical_path)
 
-        match = files.find { |path| real_path(path) == target }
+        match = files.find { |path| BufferBinding.real_path(path) == target }
         @buffer = BufferBinding.new(logical_path: match, physical_path: @buffer.physical_path) if match
       end
 
-      def real_path(path)
-        File.realpath(path)
-      rescue StandardError
-        nil
-      end
-
       # True when `path`'s recorded stat entry proves it unchanged since the last analysis. Any stat / parse
       # failure (missing entry, unreadable / vanished file) reads as NOT fresh (→ re-analyse), preserving the
       # prior `digest(path) != recorded` "changed" semantics for a file that cannot be validated.

data/lib/rigor/analysis/path_expansion.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require_relative "../rooted_glob"
+require_relative "diagnostic"
+
 module Rigor
   module Analysis
     # ADR-87 WD4 — project file-set expansion shared by the {Analysis::Runner} (miss path) and the
@@ -8,8 +11,13 @@ module Rigor
     # is taken verbatim; anything else contributes no files here (the Runner layers its own path-error
     # diagnostics and buffer / in-memory handling on top — none of which add or remove files for an ordinary
     # on-disk check, so the two file sets agree).
+    #
+    # #1991 — also the one place a path that names neither a directory nor a `.rb` file is worded and
+    # severity-graded, so `rigor check` and `rigor sig-gen` report the same path error the same way.
     module PathExpansion
       RUBY_GLOB = "**/*.rb"
+      NO_SUCH_PATH = "no such file or directory"
+      NOT_A_RUBY_FILE = "not a Ruby file (expected `.rb` or a directory)"
 
       module_function
 
@@ -26,8 +34,43 @@ module Rigor
         end
       end
 
+      # The `[path, message]` pairs for each of `paths` that names neither a directory nor a `.rb` file,
+      # worded as `rigor check` words them.
+      def unusable(paths)
+        Array(paths).each_with_object([]) do |path, bad|
+          next if File.directory?(path) || (File.file?(path) && path.end_with?(".rb"))
+
+          bad << [path, unusable_message(path)]
+        end
+      end
+
+      def unusable_message(path)
+        File.exist?(path) ? NOT_A_RUBY_FILE : NO_SUCH_PATH
+      end
+
+      # The error diagnostics for `bad` (from {unusable}). A bad path among valid ones is a warning that it was
+      # skipped; a bad path that leaves nothing to analyse is an error, so a lone typo is not masked.
+      def diagnostics(bad, any_files:)
+        severity = any_files ? :warning : :error
+        suffix = any_files ? " (skipped)" : ""
+        bad.map do |path, message|
+          Diagnostic.new(path: path, line: 1, column: 1, message: "#{message}#{suffix}", severity: severity)
+        end
+      end
+
       def directory_files(dir, exclude_patterns, base: Dir.pwd)
-        reject_excluded(Dir.glob(File.join(dir, RUBY_GLOB)), exclude_patterns, base: base)
+        reject_excluded(RootedGlob.glob(dir, RUBY_GLOB), exclude_patterns, base: base)
+      end
+
+      # The configured project files, expanded as `rigor check` expands its configured paths: a directory globs,
+      # any other entry (a file, or a path that does not exist) is kept verbatim and left to the reader to skip.
+      # The file list a cross-file discovery seed is folded over ({Protection::DiscoverySeed}).
+      def configured_files(configuration)
+        Array(configuration.paths).flat_map do |path|
+          next [path] unless File.directory?(path)
+
+          directory_files(path, configuration.exclude_patterns, base: configuration.exclude_base)
+        end
       end
 
       # `exclude_patterns` are matched with `File.fnmatch?` WITHOUT `FNM_PATHNAME`, so `**`/`*` span separators