rigortype 0.4.4 → 0.4.6

data/lib/rigor/analysis/require_relative_closure.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Analysis
+    # Issue #2021 — the files a run analyses outside the configured `paths:` load through `require_relative`.
+    #
+    # A run over path arguments widens its discovery to the configured paths (#684), which is the whole project for
+    # a file inside them. A file outside them has no such project: `rigor check plugins/x/lib/rigor/plugin/x.rb`
+    # in a repository whose `paths:` is `lib` discovered `x.rb` and `lib` alone. The plugin's nested `Effects`,
+    # declared in the sibling `x/effects.rb`, was then invisible, the lexical lookup fell through to the
+    # project's `Rigor::Effects`, and every call on it drew a false `call.undefined-method` that checking the
+    # plugin's `lib` did not.
+    #
+    # The file names its siblings itself: Ruby loads what it `require_relative`s before any of its code runs, so
+    # those declarations are in scope at runtime. {.closure} follows that graph from the out-of-paths files,
+    # through each target that is itself outside the configured paths. A target under a configured path is
+    # already discovered and stops the walk there, so the files inside `paths:` are discovered exactly as a run
+    # over the configured paths discovers them. Only a string literal counts (`require_relative "a/b"`, with or
+    # without the `.rb`); a computed name, `require`, `load` and `autoload` are not followed, so a gem's own
+    # files and a Zeitwerk-loaded tree are not reached this way.
+    #
+    # The walk sees one entry point's load graph, and a file it does not reach may redefine what a walked file
+    # defines. The runner therefore discovers the walked files as uncertain: their declarations resolve constants
+    # and their methods exist, but no return type, arity or visibility is read from them.
+    module RequireRelativeClosure
+      # The walk's answer: the existing targets it reached, and the targets it named that are not files (each an
+      # input of the answer too, since one appearing would join the discovery).
+      Result = Data.define(:found, :missing)
+
+      module_function
+
+      # @param seeds — the analysed files outside the configured paths, as spelled by the run.
+      # @param covered — `->(real_path) { Boolean }`, whether a target lies under a configured path, where discovery
+      #   holds it already. The walk neither adds nor follows such a target. Paths are compared as real paths, so a
+      #   symlinked spelling of a configured file is covered too.
+      # @param read — `->(path) { String }`, the source of a file (an editor buffer's bytes for its file).
+      # @return a {Result}; `found` holds absolute paths in walk order, each file once, and never a seed.
+      def closure(seeds, covered:, read:)
+        seen = seeds.to_set { |path| real_path(path) }
+        queue = seeds.dup
+        found = []
+        missing = []
+        until queue.empty?
+          targets_of(queue.shift, read).each do |target|
+            next missing << target unless File.file?(target)
+
+            real = real_path(target)
+            next if covered.call(real) || !seen.add?(real)
+
+            found << target
+            queue << target
+          end
+        end
+        Result.new(found: found, missing: missing.uniq)
+      end
+
+      def real_path(path)
+        File.realpath(path)
+      rescue SystemCallError
+        File.absolute_path(path)
+      end
+
+      # The `.rb` paths `path` names with a literal `require_relative`, absolute, whether or not they exist.
+      def targets_of(path, read)
+        source = read.call(path)
+        return [] if source.nil?
+
+        base = File.dirname(File.absolute_path(path))
+        literal_features(Prism.parse(source).value).map do |feature|
+          File.expand_path(feature.end_with?(".rb") ? feature : "#{feature}.rb", base)
+        end
+      rescue StandardError
+        []
+      end
+
+      # In source order, so discovery meets the targets in the order Ruby loads them.
+      def literal_features(root)
+        calls = []
+        stack = [root]
+        until stack.empty?
+          node = stack.pop
+          calls << node if literal_feature(node)
+          stack.concat(node.compact_child_nodes)
+        end
+        calls.sort_by { |call| call.location.start_offset }.filter_map { |call| literal_feature(call) }
+      end
+
+      def literal_feature(node)
+        return nil unless node.is_a?(Prism::CallNode) && node.name == :require_relative && node.receiver.nil?
+
+        arguments = node.arguments&.arguments
+        return nil unless arguments&.size == 1 && arguments.first.is_a?(Prism::StringNode)
+
+        arguments.first.unescaped
+      end
+    end
+  end
+end

data/lib/rigor/analysis/rule_catalog.rb

@@ -99,7 +99,12 @@ module Rigor
             "Rigor's bundled overlays name (`OpenStruct`, whose fields are per-instance singleton methods; " \
             "`ActiveSupport::Duration` and `ActiveSupport::Concern` when their gem overlay loads). Both sides " \
             "of the class are open, and an inherited Object / Kernel signature no longer decides " \
-            "`call.wrong-arity` or `call.argument-type-mismatch` on it."
+            "`call.wrong-arity` or `call.argument-type-mismatch` on it.",
+            "The program may answer the call another way (#1722): a `method_missing` on the receiver's class or an " \
+            "ancestor; a module mixed into either that defines the method (`Integer.include(Ext)` counts wherever " \
+            "it is written); singleton methods given to the receiver local (`s.extend(M)`, " \
+            "`define_singleton_method`, `class << s`); or, for a receiver typed by its class's name rather than a " \
+            "literal, a project subclass that defines the method."
           ],
           suppression: "`# rigor:disable call.undefined-method` on the call line, " \
                        "or `disable: [\"call.undefined-method\"]` in `.rigor.yml`.",
@@ -561,14 +566,22 @@ module Rigor
           summary: "Explicit-receiver call to a method declared `private` in source.",
           fires_when: [
             "Call is `receiver.method(...)` with explicit non-self receiver.",
-            "Receiver type resolves to `Type::Nominal[X]`.",
-            "X is a user-defined class whose source carries the method under `private`."
+            "Receiver type resolves to `Type::Nominal[X]`, or to the class object `singleton(X)`.",
+            "X is a user-defined class whose source carries the method under `private`; for a class object, " \
+            "the singleton method the call reaches is private (`private_class_method`, `class << self` with " \
+            "`private`, or a private method of a module X extends)."
           ],
           does_not_fire_when: [
             "Implicit-self call (no receiver) — always allowed for private.",
             "Receiver is `self` (Ruby 2.7+ permits `self.private_method`).",
             "Receiver class is RBS-known but not user-source-defined (RBS-side visibility is deferred).",
-            "Method is `:protected` (subclass tracking is deferred)."
+            "Method is `:protected` (subclass tracking is deferred).",
+            "A `method_missing` or `respond_to_missing?` on the receiver's chain, on the side the call reaches, " \
+            "may answer the call (Ruby sends a private call to `method_missing`).",
+            "The visibility rests on a statement that may not run, or on files that disagree about it.",
+            "On a class object: the receiver is not a constant (`self.class.x` may be a subclass that " \
+            "re-publicises the name), or the call is not inside a `def` (load-time code may run before the " \
+            "method is made private)."
           ],
           suppression: "`# rigor:disable method-visibility-mismatch`.",
           severity_authored: :error,
@@ -693,7 +706,11 @@ module Rigor
             "Writes are in a singleton body — `def self.foo` or a `class << self` def — those track " \
             "separately.",
             "Writes are in a `def` inside an anonymous-class factory block (`Class.new do … end`, " \
-            "`Module.new`, `Struct.new`, `Data.define`): that body defines another class."
+            "`Module.new`, `Struct.new`, `Data.define`): that body defines another class.",
+            "The class descends from a plugin-declared per-invocation class (ADR-125; rigor-actionpack declares " \
+            "`ActionController::Base` / `ActionController::API`, rigor-actionmailer `ActionMailer::Base`), and the " \
+            "write and every conflicting write sit in different actions: public methods no callback macro or " \
+            "`helper_method` names. One action runs per instance."
           ],
           suppression: "`# rigor:disable ivar-write-mismatch` on the offending write.",
           severity_authored: :error,

data/lib/rigor/analysis/run_disclosure_credit.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Analysis
+    # Issue #2020 — what one file's analysis contributed to the run-scoped plugin tables ({Plugin::Base#disclose_once}
+    # and {Plugin::Base#emit_once}), kept beside the file's cached answer so an `--incremental` recheck that serves
+    # the file without analysing it can still report the rows a cold run reports.
+    #
+    # A replayed row must go stale with the inputs it is about, and the reads those inputs came from are credited to
+    # one file at most: a plugin memoises the input (a locale index, a routes table), so the first file to trigger
+    # the read is the only one credited with it, and a read in `#prepare` is credited to none. So each record also
+    # carries, under `:reads`, every row the registering plugin's boundary holds once the file is analysed,
+    # `#prepare`'s included. {IncrementalSession} keeps those rows per `[plugin id, key]`, not per file: when one goes
+    # stale it re-analyses one registering file and drops the key's replays, rather than re-analysing every file that
+    # registered it. Only inputs read through the boundary are covered.
+    module RunDisclosureCredit
+      ATTRIBUTION_KEY = :rigor_run_disclosure_attribution
+      private_constant :ATTRIBUTION_KEY
+
+      module_function
+
+      # Runs the block with run-scoped registrations attributed and returns the file's records — each a run-disclosure
+      # record tagged with its `plugin_id` and carrying the registering plugin's boundary rows as `:reads`, one per
+      # `[plugin id, key]` — frozen and Marshal-clean. A thread variable, as {Plugin::IoBoundary.attributing} uses, so a
+      # registration from inside an `Enumerator` still lands.
+      def collect
+        registrations = []
+        previous = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, registrations)
+        begin
+          yield
+        ensure
+          Thread.current.thread_variable_set(ATTRIBUTION_KEY, previous)
+        end
+        credit(registrations)
+      end
+
+      # Called by {Plugin::Base#disclose_once} and {Plugin::Base#emit_once} for every call, a repeat included.
+      def attribute(plugin, record)
+        Thread.current.thread_variable_get(ATTRIBUTION_KEY)&.push([plugin, record])
+        nil
+      end
+
+      def credit(registrations)
+        return [].freeze if registrations.empty?
+
+        reads = {}.compare_by_identity
+        records = registrations.map do |plugin, record|
+          rows = reads[plugin] ||= boundary_rows(plugin).freeze
+          record.merge(plugin_id: plugin_id(plugin), reads: rows).freeze
+        end
+        records.uniq { |record| identity(record) }.freeze
+      end
+
+      # The de-duplication identity a record shares with every other registration of its key.
+      def identity(record)
+        [record[:plugin_id], record[:key]]
+      end
+
+      # The record as the aggregator replays it, without the rows that decide whether it is stale.
+      def replayable(record)
+        record.except(:reads).freeze
+      end
+
+      # The boundary's file and listing rows, read without triggering its lazy initializer: a plugin that never
+      # built one read nothing through it.
+      def boundary_rows(plugin)
+        boundary = plugin.instance_variable_get(:@io_boundary) or return []
+        descriptor = boundary.cache_descriptor
+        descriptor.files + descriptor.globs
+      end
+
+      def plugin_id(plugin)
+        plugin.manifest.id
+      rescue StandardError
+        plugin.class.to_s
+      end
+    end
+  end
+end

data/lib/rigor/analysis/run_disclosure_ledger.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+require_relative "run_disclosure_credit"
+
+module Rigor
+  module Analysis
+    # Issue #2020 — the `--incremental` session's record of the run-scoped plugin rows ({Plugin::Base#disclose_once},
+    # {Plugin::Base#emit_once}) each analysed file's hooks registered, so a recheck can replay them for the files it
+    # serves from cache.
+    #
+    # - `files` maps a path to its records as the aggregator replays them, one per `[plugin id, key]` identity.
+    # - `reads` maps an identity to the registering plugin's boundary rows when it was last registered
+    #   ({RunDisclosureCredit}), `#prepare`'s reads included.
+    #
+    # Staleness is per identity, not per file. A plugin memoises the input a notice is about and re-registers the
+    # notice from every file's hook, so crediting the rows to every registering file would re-analyse all of them on
+    # any edit to an input the plugin read (one view edit re-analysed 400 of 400 files in an app with one i18n view
+    # row). Instead a recheck finds the identities whose rows went stale, re-analyses ONE live registering file for
+    # each (the first by path), and withholds those identities' replays. When that file registers the identity, every
+    # other holder takes its record. When it registers nothing — the edit took the notice out of its text, it no
+    # longer parses, the plugin raised — the recheck cannot tell whether the identity is gone, so it runs again with
+    # every other live holder of the identity analysed ({#unresolved_holders}), and the identity is dropped only if
+    # none of them registers it either.
+    #
+    # One shape stays unsound: a key whose registration or record depends both on an input the plugin read and on the
+    # registering file's own text. When the input changes and the chosen file still registers the key, the other
+    # holders take its record even where, re-analysed, they would register another record or none, until each is
+    # re-analysed itself. {Plugin::Base#disclose_once} asks a key not to vary between workers, which rules it out for a
+    # plugin that keeps the contract. Only inputs read through the plugin's boundary are tracked; state a plugin carries
+    # across files, or an input it reads around the boundary (`ENV`, a direct `File.read`), can leave a replayed row
+    # that never clears.
+    class RunDisclosureLedger
+      attr_reader :files, :reads
+
+      def initialize(files: {}, reads: {})
+        @files = files
+        @reads = reads
+      end
+
+      # The ledger a baseline builds from `fresh` (`{path => [record with :reads]}`, `Runner#analysis_disclosures`).
+      def self.from(fresh)
+        new.tap { |ledger| ledger.absorb(fresh, fresh.keys, Set.new) }
+      end
+
+      def self.load(data)
+        data.is_a?(Hash) ? new(files: data.fetch(:files, {}), reads: data.fetch(:reads, {})) : new
+      end
+
+      def to_h
+        { files: @files, reads: @reads }
+      end
+
+      # The identities with a boundary row that no longer validates under `fresh_row` (a row → Boolean predicate).
+      def stale_identities(&fresh_row)
+        verdicts = {}
+        @reads.each_with_object(Set.new) do |(identity, rows), stale|
+          stale << identity if rows.any? { |row| !verdicts.fetch(row) { verdicts[row] = fresh_row.call(row) } }
+        end
+      end
+
+      # One live registering file per stale identity, the first by path, skipping `removed`.
+      def refreshers(stale, removed)
+        return Set.new if stale.empty?
+
+        holders = {}
+        @files.each do |path, records|
+          next if removed.include?(path)
+
+          records.each do |record|
+            identity = RunDisclosureCredit.identity(record)
+            holders[identity] = [holders[identity], path].compact.min if stale.include?(identity)
+          end
+        end
+        holders.values.to_set
+      end
+
+      # The live holders, outside `analyzed`, of every `stale` identity no file in `analyzed` registered in `fresh`:
+      # the files that must be analysed when the chosen refresher registered nothing. Analysing every one of them
+      # settles the identity, since every holder has then decided it afresh.
+      def unresolved_holders(fresh, analyzed, stale, removed)
+        return Set.new if stale.empty?
+
+        registered = analyzed.flat_map do |path|
+          Array(fresh[path]).map { |record| RunDisclosureCredit.identity(record) }
+        end
+        unresolved = stale - registered
+        return Set.new if unresolved.empty?
+
+        @files.each_with_object(Set.new) do |(path, records), holders|
+          next if removed.include?(path) || analyzed.include?(path)
+
+          holders << path if records.any? { |record| unresolved.include?(RunDisclosureCredit.identity(record)) }
+        end
+      end
+
+      # The records to replay for `paths`, without the `stale` identities. Unpinned defence: a stale identity's replay
+      # cannot reach the output today, since a refresher that registers it wins over the replay and one that does not
+      # sends every holder into the second pass.
+      def served(paths, stale = Set.new)
+        @files.values_at(*paths).compact.flatten(1).reject do |record|
+          stale.include?(RunDisclosureCredit.identity(record))
+        end
+      end
+
+      # Folds a run's registrations in: every path in `analyzed` takes this run's records (or none), every identity
+      # this run registered takes this run's rows, and each `stale` identity is refreshed or dropped in the files the
+      # run did not analyse. Identities no file holds any more lose their rows.
+      def absorb(fresh, analyzed, stale)
+        registered = {}
+        analyzed.each do |path|
+          records = Array(fresh[path])
+          records.each { |record| registered[RunDisclosureCredit.identity(record)] ||= record }
+          store(path, records.map { |record| RunDisclosureCredit.replayable(record) })
+        end
+        registered.each { |identity, record| @reads[identity] = record[:reads] }
+        refresh_unanalysed(stale, registered, analyzed.to_set)
+        prune
+      end
+
+      def forget(path)
+        @files.delete(path)
+      end
+
+      private
+
+      def refresh_unanalysed(stale, registered, analyzed)
+        return if stale.empty?
+
+        @files.each_key.to_a.each do |path|
+          next if analyzed.include?(path)
+
+          store(path, @files[path].filter_map do |record|
+            identity = RunDisclosureCredit.identity(record)
+            next record unless stale.include?(identity)
+
+            registered[identity] && RunDisclosureCredit.replayable(registered[identity])
+          end)
+        end
+      end
+
+      def store(path, records)
+        records.empty? ? @files.delete(path) : @files[path] = records.freeze
+      end
+
+      # Unpinned hygiene: an identity no file holds is never replayed, so keeping its rows changes no answer; pruning
+      # them keeps a stale row from re-analysing a file for nothing and the snapshot from growing.
+      def prune
+        held = @files.each_value.flat_map do |records|
+          records.map { |record| RunDisclosureCredit.identity(record) }
+        end.to_set
+        @reads.select! { |identity, _| held.include?(identity) }
+      end
+    end
+  end
+end

data/lib/rigor/analysis/runner/buffer_pool_dispatcher.rb

@@ -79,6 +79,8 @@ module Rigor
         #   (`ProjectContext#environment`) every job's Runner reuses instead of rebuilding.
         # @param prebuilt — the warm, shared pre-pass snapshot
         #   (`ProjectContext#project_scan`) every job's Runner adopts instead of re-scanning.
+        # @param discovery_seed_for — issue #2147 — a callable returning the cross-file discovery seed for one
+        #   binding (`ProjectContext#discovery_seed_for`), or nil for none.
         # @param workers — pool size. `#analyze` degrades to sequential in-process execution — one
         #   job at a time, no `fork` — when fewer than 2 bindings are submitted, fewer than `min_batch_size`
         #   bindings are submitted, `workers` is not positive, `fork` is unavailable on this platform, or
@@ -88,12 +90,13 @@ module Rigor
         # @param min_batch_size — see {DEFAULT_MIN_BATCH_SIZE}. Exposed as a constructor param
         #   (rather than read from the env internally) purely for spec control; production callers get the
         #   resolved default.
-        def initialize(configuration:, cache_store:, environment:, prebuilt:, workers:,
+        def initialize(configuration:, cache_store:, environment:, prebuilt:, workers:, discovery_seed_for: nil,
                        min_batch_size: self.class.resolve_min_batch_size)
           @configuration = configuration
           @cache_store = cache_store
           @environment = environment
           @prebuilt = prebuilt
+          @discovery_seed_for = discovery_seed_for
           @workers = workers
           @min_batch_size = min_batch_size
         end
@@ -123,7 +126,8 @@ module Rigor
         def run_one(binding)
           Runner.new(
             configuration: @configuration, cache_store: @cache_store, collect_stats: false,
-            buffer: binding, prebuilt: @prebuilt, environment: @environment
+            buffer: binding, prebuilt: @prebuilt, environment: @environment,
+            discovery_seed: @discovery_seed_for&.call(binding)
           ).run([binding.logical_path]).diagnostics
         end
 

data/lib/rigor/analysis/runner/diagnostic_aggregator.rb

@@ -58,7 +58,7 @@ module Rigor
                        definition_build_failures_snapshot:, hkt_scan_failure_snapshot:,
                        conformance_results_snapshot:, signature_standdowns_snapshot: -> { [] },
                        vendored_standdowns_snapshot: -> { [] }, pooled_run_disclosures: -> { [] },
-                       pooled_trust_refusals: -> { [] })
+                       served_run_disclosures: -> { [] }, pooled_trust_refusals: -> { [] })
           @configuration = configuration
           @rbs_extended_reporter = rbs_extended_reporter
           @boundary_cross_reporter = boundary_cross_reporter
@@ -79,6 +79,8 @@ module Rigor
           # Issue #1051 — reader for the pool coordinator's de-duplicated run-scoped disclosure table.
           # Empty on a sequential run, where `plugin_registry`'s own instances are the ones that registered.
           @pooled_run_disclosures_reader = pooled_run_disclosures
+          # Issue #2020 — reader for the rows an incremental recheck replays for the files it served unanalysed.
+          @served_run_disclosures_reader = served_run_disclosures
           # Issue #1900 — reader for the pool coordinator's summed trust-refusal table. Empty on a
           # sequential run, where `plugin_registry`'s own boundaries made every read.
           @pooled_trust_refusals_reader = pooled_trust_refusals
@@ -1116,12 +1118,14 @@ module Rigor
         end
 
         # Issue #1051 — the run-scoped plugin disclosures ({Plugin::Base#disclose_once}), the run's
-        # project-global notices about its own inputs. Two sources feed one table:
+        # project-global notices about its own inputs. Three sources feed one table:
         #
         # - the coordinator-side registry, which is where a SEQUENTIAL run's `#prepare` and per-file hooks
         #   ran; and
         # - `pooled_run_disclosures`, the pool coordinator's already-de-duplicated collection from the
-        #   pre-fork parent session and every worker payload.
+        #   pre-fork parent session and every worker payload; and
+        # - `served_run_disclosures` (#2020), the rows an incremental recheck replays for the files it served
+        #   from cache, since their per-file hooks did not run.
         #
         # Both are keyed `[plugin id, key]` and the first registration of a pair wins, so a run emits one
         # row per pair no matter how many plugin instances (workers) reached it — the #1051 bug, where a
@@ -1183,6 +1187,10 @@ module Rigor
           rescue StandardError
             next
           end
+          # Issue #2020 — last, so a row this run registered afresh wins over the replay of the same key.
+          Array(@served_run_disclosures_reader.call).each do |record|
+            records[[record[:plugin_id], record[:key]]] ||= record
+          end
           records.values
         end
 

data/lib/rigor/analysis/runner/pool_coordinator.rb

@@ -111,6 +111,19 @@ module Rigor
         # so the incremental session's dependency graph is refreshed whether analysis ran sequential or pooled.
         attr_reader :collected_dependencies
 
+        # Issue #1553 — the per-file plugin reads the fork pool's workers recorded this run (empty unless
+        # `record_dependencies:` and a pool run occurred), folded into `Runner#analysis_reads`. Each worker's are
+        # marshalled back beside its dependency records.
+        def collected_analysis_reads
+          @collected_analysis_reads ||= {}
+        end
+
+        # Issue #2020 — the per-file run-scoped registrations the fork pool's workers recorded, folded into
+        # `Runner#analysis_disclosures` beside {#collected_analysis_reads}.
+        def collected_analysis_disclosures
+          @collected_analysis_disclosures ||= {}
+        end
+
         # ADR-103 WD12 — the per-file {Effects::FileCollection}s the fork pool captured this run (empty
         # unless the configuration carries an `effects:` block and a pool run occurred). The runner merges
         # these with its own sequential records before the post-pool fixpoint.
@@ -197,13 +210,17 @@ module Rigor
             if pool_mode?
               dispatch_pool(files, source_files: source_files)
             else
-              analyze_files_sequentially(
-                files, environment || resolve_sequential_environment(source_files: source_files)
-              )
+              environment ||= resolve_sequential_environment(source_files: source_files)
+              analyze_files_sequentially(files, environment)
             end
           # Issues #796 / #794 — a narrowed run's own demand set is a SUBSET of the full run's, so the two
-          # rows below are folded in after it, whichever backend produced the per-file stream.
-          replayed_restored_run_level_rows?(closure: files)
+          # rows below are folded in after it, whichever backend produced the per-file stream. Issue #1929 —
+          # the sequential run's environment re-derives a stale replayed failure; a pool run has none on
+          # this side and resolves one only when a stale failure needs it.
+          redemand_env = lambda do
+            environment ||= resolve_sequential_environment(source_files: source_files)
+          end
+          replayed_restored_run_level_rows?(closure: files, redemand_env: redemand_env)
           result
         end
 
@@ -261,7 +278,9 @@ module Rigor
           # `env` rather than `resolve.call`: read the demand the snapshots above just made when they built
           # an environment, and force nothing when they did not.
           record_definition_build_failures(env&.rbs_loader&.definition_build_failures)
-          record_hkt_scan_failure(hkt_scan_outcome(resolve.call)) unless replayed_restored_run_level_rows?
+          # An empty closure analyses no file, so only a deleted file's buffer can make a tuple stale here.
+          replayed = replayed_restored_run_level_rows?(closure: [], redemand_env: resolve)
+          record_hkt_scan_failure(hkt_scan_outcome(resolve.call)) unless replayed
           prepare_rows
         end
 
@@ -319,18 +338,46 @@ module Rigor
         # of its own — and so no environment.
         #
         # @param closure — the files this run analyses; see {#stale_replayed_failure?}.
-        def replayed_restored_run_level_rows?(closure: nil)
+        # @param redemand_env — resolves the environment {#redemand_stale_failures} re-derives a stale
+        #   failure in; nil (the empty closure, which has no stale failure) re-derives nothing.
+        def replayed_restored_run_level_rows?(closure: nil, redemand_env: nil)
           rows = @restored_run_level_rows
           return false if rows.nil?
 
-          replayable = Array(rows.definition_build_failures).reject do |failure|
+          stale, replayable = Array(rows.definition_build_failures).partition do |failure|
             stale_replayed_failure?(failure, closure)
           end
           record_definition_build_failures(replayable)
+          redemand_stale_failures(stale, redemand_env)
           record_hkt_scan_failure(rows.hkt_scan_failure)
           true
         end
 
+        # Issue #1929 — a stale replayed failure is RE-DERIVED, not dropped. Dropping it was right for the
+        # class whose collision the edit removed, and wrong for every class the edit left failing: the file
+        # that demanded such a class usually sits outside the recheck's closure (the edited file only
+        # contributes a conflicting buffer, such as a missing superclass every subclass inherits), so
+        # nothing in the recheck asks for it again, and the row lost classes a cold run reports. The class
+        # is asked for again in this run's environment ({Environment::RbsLoader#redemand_definition}), so
+        # it is reported exactly when it still fails, with the tuple the current signatures give it.
+        #
+        # A class this run's own analysis already reported is skipped; its tuple is current. The residue:
+        # a class whose only demand was in an edited file that no longer makes it, and which still fails,
+        # stays reported until a full run. The failure itself is real, unlike the dropped-collision case
+        # this replaced.
+        def redemand_stale_failures(stale, redemand_env)
+          return if stale.empty? || redemand_env.nil?
+
+          reported = @snapshots.definition_build_failures.to_set(&:first)
+          pending = stale.map(&:first).reject { |name| reported.include?(name) }
+          return if pending.empty?
+
+          loader = redemand_env.call&.rbs_loader
+          return if loader.nil?
+
+          record_definition_build_failures(pending.filter_map { |name| loader.redemand_definition(name) })
+        end
+
         # A replayed definition-build failure the snapshot's own fingerprint cannot vouch for. The
         # fingerprint digests the three signature sources it can read WITHOUT an environment — `sig:`,
         # `Gemfile.lock` / `rbs_collection.lock.yaml`, and the configuration — but NOT the virtual RBS a
@@ -340,11 +387,11 @@ module Rigor
         # closure, its analysis demands nothing that would re-derive the row, and the run reports a
         # collision between files that no longer collide.
         #
-        # The narrowed run cannot re-derive the row either (#696 forbids Rigor demanding a definition the
-        # analysis did not), so the honest answer is to DROP it and under-report rather than assert a
-        # diagnostic on a program that may now be correct — false positives outrank worst-case reading. The
-        # cost is bounded to the row's own conflicting buffers: a collision between two files neither of
-        # which this run touches still replays.
+        # Such a failure is not replayed as it stands; {#redemand_stale_failures} re-derives it instead
+        # (#1929), so the row asserts no collision the current signatures do not have. A failure whose
+        # buffers name no file this run touches still replays. A buffer whose file no longer exists is stale
+        # too: deleting an inline source a tuple names would otherwise replay the deleted declaration's
+        # failure, where a full run reports what the remaining signatures give.
         def stale_replayed_failure?(failure, closure)
           return false if closure.nil?
 
@@ -354,7 +401,10 @@ module Rigor
           closure_paths = closure.to_set { |path| File.absolute_path(path.to_s) }
           Array(buffers).any? do |name|
             path = virtual_buffer_path(name)
-            !path.nil? && closure_paths.include?(File.absolute_path(path))
+            next false if path.nil?
+
+            absolute = File.absolute_path(path)
+            closure_paths.include?(absolute) || !File.exist?(absolute)
           end
         end
 
@@ -870,7 +920,10 @@ module Rigor
             merge_run_disclosures(session.drain_run_disclosures)
             # The degraded slice was re-analysed on the parent session, so its dependency records live there,
             # not in a child payload — fold them in alongside the successful children's.
-            @collected_dependencies.merge!(session.drain_dependencies) if @record_dependencies
+            if @record_dependencies
+              collect_dependencies(session.drain_dependencies, session.drain_analysis_reads,
+                                   session.drain_analysis_disclosures)
+            end
             @collected_effects.merge!(session.drain_effects) if @record_effects
           end
 
@@ -907,6 +960,8 @@ module Rigor
           results = slice.to_h { |path| [path, session.analyze(path)] }
           payload = { results: results, reporters: session.drain_reporters,
                       dependencies: session.drain_dependencies,
+                      analysis_reads: session.drain_analysis_reads,
+                      analysis_disclosures: session.drain_analysis_disclosures,
                       disclosures: session.drain_run_disclosures,
                       refusals: session.drain_trust_refusals }
           # ADR-103 WD13 — the effects slot exists only on a collecting run, so a normal `--workers N` run
@@ -945,7 +1000,10 @@ module Rigor
               merge_run_disclosures(payload.fetch(:disclosures, []))
               refusals = payload.fetch(:refusals, [])
               refusals_by_slice ? refusals_by_slice[child[:index]] = refusals : merge_trust_refusals(refusals)
-              @collected_dependencies.merge!(payload.fetch(:dependencies, {})) if @record_dependencies
+              if @record_dependencies
+                collect_dependencies(payload.fetch(:dependencies, {}), payload.fetch(:analysis_reads, {}),
+                                     payload.fetch(:analysis_disclosures, {}))
+              end
               @collected_effects.merge!(payload.fetch(:effects, {})) if @record_effects
             else
               degraded.concat(child[:slice])
@@ -954,6 +1012,14 @@ module Rigor
           degraded
         end
 
+        # ADR-46 / issues #1553, #2020 — fold one worker's dependency records, per-file plugin reads and per-file
+        # run-scoped registrations.
+        def collect_dependencies(dependencies, analysis_reads, analysis_disclosures)
+          @collected_dependencies.merge!(dependencies)
+          collected_analysis_reads.merge!(analysis_reads)
+          collected_analysis_disclosures.merge!(analysis_disclosures)
+        end
+
         # @return the child's `{results:, reporters:}` payload, or nil when the child exited
         #   abnormally or wrote no readable payload. `Marshal.load` is safe here: the blob was written by
         #   our own forked child to a temp file we created.