rigortype 0.4.5 → 0.4.6

data/lib/rigor/analysis/runner.rb

@@ -12,6 +12,8 @@ require_relative "../cache/file_digest"
 require_relative "../cache/incremental_snapshot"
 require_relative "run_cache_key"
 require_relative "path_expansion"
+require_relative "require_relative_closure"
+require_relative "run_disclosure_credit"
 require_relative "../plugin"
 require_relative "../plugin/source_rbs_synthesis_reporter"
 require_relative "../rbs_extended/reporter"
@@ -75,7 +77,10 @@ module Rigor
                   # this and serves reused files from it without re-stamping: a run-level row is regenerated
                   # every run wherever it is positioned, and slicing the run's full stream by path cached the
                   # file-positioned ones (`effect.annotations-unchecked`, `source-rbs-*`).
-                  :per_file_diagnostics
+                  :per_file_diagnostics,
+                  # PR #2286 review M1 — the ADR-16 index this run's pre-pass built; `IncrementalSession` digests it
+                  # to tell when a class-body DSL edit moved what a served file's dispatch read.
+                  :synthetic_method_index
 
       # Issues #796 / #794 — the two run-level rows a NARROWED run cannot re-derive from the files it
       # analyses: the `definition-build-failed` set (whose producer is the analysis's own demand, and #696
@@ -109,6 +114,13 @@ module Rigor
         pooled.empty? ? @analysis_reads : @analysis_reads.merge(pooled)
       end
 
+      # Issue #2020 — `{path => [run-disclosure record]}`, the run-scoped rows each analysed file's plugin hooks
+      # registered ({RunDisclosureCredit}), sequential and pooled alike; empty unless `record_dependencies:`.
+      def analysis_disclosures
+        pooled = @pool_coordinator.collected_analysis_disclosures
+        pooled.empty? ? @analysis_disclosures : @analysis_disclosures.merge(pooled)
+      end
+
       # ADR-103 — the run's propagated effect graph, or {Effects::EffectTable.empty} when collection did
       # not run. Reconciled from the sequential and pooled halves exactly as {#file_dependencies} is, then
       # closed by the post-pool fixpoint in {#assemble_run_diagnostics}.
@@ -294,10 +306,11 @@ module Rigor
       #   worker continues to build its own Environment.
       # @param discovery_seed — issue #260 — opt-in cross-file discovery tables, keyed by
       #   {Scope::DiscoveryIndex} slot name, seeded onto every per-file scope through
-      #   `project_scope_seed_tables`. The ONE deliberate exception to "a `prebuilt:` runner carries no
-      #   discovery tables": {Protection::DiagnosticOracle} threads the table set Tier 2's site filter already
-      #   judges anchors against, so a site admitted because a sibling-file class resolved is also a site the
-      #   oracle can kill at. nil (the default) leaves the prebuilt/LSP contract byte-identical.
+      #   `project_scope_seed_tables`. A `prebuilt:` runner computes no discovery tables of its own, so this is
+      #   how one learns the project: {Protection::DiagnosticOracle} threads the table set Tier 2's site filter
+      #   already judges anchors against, and (issue #2147, ADR-124) the LSP's per-buffer publish threads
+      #   `LanguageServer::ProjectContext#discovery_seed_for`, so a class another file declares is not an
+      #   external ancestor there. nil (the default) seeds nothing.
       # @param no_tolerated_effects — ADR-103 WD1 / #385 — `rigor check --no-tolerated-effects`.
       #   Judges effect envelopes as if `effects.tolerated:` were empty. A judgment-time switch only: the
       #   run, its collection and its cache identity are unchanged.
@@ -309,7 +322,7 @@ module Rigor
                      seed_bundles: nil, collect_seed_bundles: false, param_inferred_types: nil,
                      discovery_seed: nil, no_tolerated_effects: false,
                      restored_run_level_rows: nil, served_per_file_diagnostics: nil, served_effect_collections: nil,
-                     on_file_indexed: nil)
+                     served_run_disclosures: nil, on_file_indexed: nil)
         @configuration = configuration
         # ADR-113 WD2 — `rigor lens` reads a target's seeded index here: called with `(path, parse_result, scope,
         # index)` for every file this process indexes, after its rules ran and inside the run window, so the reader
@@ -327,6 +340,9 @@ module Rigor
         # effect graph this run closes (and the envelope pass judges) spans the whole project, not just the closure.
         # Never part of {#effect_collections_by_path}, which stays what THIS run collected. Empty on every other run.
         @served_effect_collections = served_effect_collections || {}
+        # Issue #2020 — the run-scoped plugin rows ({RunDisclosureCredit}) those unanalysed files registered when
+        # they were last analysed, emitted beside this run's own registrations. Empty on every other run.
+        @served_run_disclosures = served_run_disclosures || []
         @explain = explain
         @cache_store = enforce_read_only_cache(cache_store, buffer)
         @plugin_requirer = plugin_requirer
@@ -382,6 +398,7 @@ module Rigor
         # rows as they stood around the per-file loop; see {#incremental_slot_rows}. Recorded only by a
         # dependency-recording (incremental) run.
         @analysis_reads = {}
+        @analysis_disclosures = {}
         @pre_analysis_plugin_rows = nil
         @post_analysis_plugin_rows = nil
         # Memoised activation decision for the `call.self-undefined-method` rule (nil = not yet computed).
@@ -521,6 +538,16 @@ module Rigor
         end
       end
 
+      # ADR-45 WD2 (#1507) / #2020 — the per-run reset of what each file's analysis is credited with: its plugin
+      # reads, its run-scoped plugin registrations, and the boundary rows around the per-file loop.
+      def reset_analysis_attribution
+        @analysis_reads = {}
+        @analysis_disclosures = {}
+        @pre_analysis_plugin_rows = nil
+        @post_analysis_plugin_rows = nil
+      end
+      private :reset_analysis_attribution
+
       def run_analysis(paths)
         Inference::MethodDispatcher::FileFolding.fold_platform_specific_paths =
           @configuration.fold_platform_specific_paths
@@ -548,9 +575,7 @@ module Rigor
         # #788 — the per-file reader is assigned only on the analysis (miss) path; reset it here so a run the
         # ADR-45 result cache serves does not answer with the previous run's rows.
         @per_file_diagnostics = [].freeze
-        @analysis_reads = {}
-        @pre_analysis_plugin_rows = nil
-        @post_analysis_plugin_rows = nil
+        reset_analysis_attribution
         # ADR-84 WD2 — roll the return-memo bucket: a fresh frozen token per run makes every per-file scope
         # of THIS run share one memo bucket while entries from any earlier run in this process (stale after
         # an edit) become unreachable.
@@ -1414,7 +1439,7 @@ module Rigor
       end
 
       def build_run_dependency_descriptor(expansion, rbs_descriptor)
-        entries = analyzed_file_entries(expansion) + discovery_file_entries(expansion) +
+        entries = analyzed_file_entries(expansion) + discovery_file_entries(expansion) + required_missing_entries +
                   pre_eval_file_entries + template_unit_file_entries + rbs_descriptor.files +
                   root_presence_entries(expansion)
         # #979 — the signature ROOTS' listings, one glob row each. `rbs_descriptor.files` covers only the
@@ -1509,7 +1534,8 @@ module Rigor
         IncrementalSlotRows.new(
           observed: plugin_boundary_rows,
           derived: Cache::Descriptor.new(
-            files: template_unit_file_entries + kind_entries(Array(roots) + @configuration.pre_eval),
+            files: template_unit_file_entries + kind_entries(Array(roots) + @configuration.pre_eval) +
+                   required_missing_entries,
             globs: template_unit_glob_entries
           ),
           by_file: @analysis_reads.transform_values do |reads|
@@ -1568,7 +1594,8 @@ module Rigor
         BaselineRows.new(
           owned: Cache::Descriptor.new(
             files: own.files + kind_entries(signature_root_candidates) +
-                   discovery_file_entries({ files: files }) + unanalysed_pre_eval_entries(files),
+                   discovery_file_entries({ files: files }) + required_missing_entries +
+                   unanalysed_pre_eval_entries(files),
             globs: (own.globs + discovery_glob_entries).uniq
           ),
           pinned: pinned
@@ -1808,20 +1835,19 @@ module Rigor
       end
 
       # Internal: builds the deferred cross-file discovery tables at most once per run and adopts them.
-      # Memoised on `@project_discovery_done` (reset at the start of `#run`). No-op under `@prebuilt` — the
-      # LSP path deliberately seeds an empty project scope from a snapshot that carries no discovery tables,
-      # so forcing a build there would change that contract. A caller that DOES want cross-file knowledge under
-      # `prebuilt:` supplies it explicitly through `discovery_seed:` (issue #260) rather than by re-walking the
-      # project here. Called eagerly from `#run` for the recording /
-      # subset (ADR-46) modes and lazily from `#assemble_run_diagnostics` on the analysis path, so a warm
-      # cache HIT (which never assembles) never pays the double parse.
+      # Memoised on `@project_discovery_done` (reset at the start of `#run`). No-op under `@prebuilt`: the
+      # snapshot carries no discovery tables, and a per-request re-walk of the project is what `prebuilt:` exists
+      # to avoid. A caller that wants cross-file knowledge under `prebuilt:` supplies it through `discovery_seed:`
+      # (issue #260), as the LSP publish does since issue #2147 (ADR-124). Called eagerly from `#run` for the
+      # recording / subset (ADR-46) modes and lazily from `#assemble_run_diagnostics` on the analysis path, so a
+      # warm cache HIT (which never assembles) never pays the double parse.
       def ensure_project_discovery(expansion)
         return if @prebuilt
         return if @project_discovery_done
 
         @project_discovery_done = true
         # Issue #684 — the cross-file index spans the PROJECT even when the analysis targets a file list.
-        expansion = @project_discovery_expansion || once_each(expansion)
+        expansion = buffer_spelled(@project_discovery_expansion || once_each(expansion))
         if @collect_seed_bundles
           # ADR-85 WD2 — rebuild discovery from the prior run's bundles (re-walking only changed files) and
           # capture the refreshed bundle set for the session to persist.
@@ -1853,7 +1879,13 @@ module Rigor
       # on what else was on the command line.
       #
       # Excluded, each because its expansion is already the one it means: the LSP `prebuilt:` path (which
-      # seeds discovery from a snapshot), editor `buffer:` mode, and `run_source`'s in-memory single file.
+      # seeds discovery from a snapshot, ADR-124) and `run_source`'s in-memory single file.
+      #
+      # Issue #2165 — editor `buffer:` mode (`rigor check --tmp-file T --instead-of F F`) widens like a plain run.
+      # It was excluded on the reading that its expansion is already the one it means, but an editor passes the
+      # buffer's own path, so discovery saw that file alone: every class another file declares read as an external
+      # ancestor, and the run reported what `rigor check F` does not. The discovery pre-pass reads through the
+      # binding, so the buffer's file is walked from the buffer's bytes.
       #
       # Issue #1583 — ADR-46's `analyze_only` subset mode widens like a full run. It was excluded on the
       # reading that it "already passes the full expansion", which holds only when the incremental session
@@ -1867,15 +1899,51 @@ module Rigor
       # the pre-pass then saw two writers for every constant a file declares and withheld its publication (#644),
       # and every file was a discovered-not-analysed dependency of the run's cache entry.
       #
+      # Issue #2021 — an analysed file outside the configured paths has no project there, so the widened set also
+      # holds what it loads with a literal `require_relative` ({#required_outside_paths}). A plugin file checked on
+      # its own otherwise missed its sibling's nested `Effects` and resolved the project's `Rigor::Effects`.
+      #
       # The widening decision itself compares the paths as spelled. `exclude:` patterns apply to both spellings
       # alike (#1576), so the configured absolute `lib` and the argument `lib` exclude the same files.
       def project_discovery_expansion(paths, expansion)
         return nil unless widen_discovery_to_project?(paths)
 
         analysed = expansion.fetch(:files)
-        files = discovery_files(expand_paths(@configuration.paths | paths).fetch(:files), analysed)
+        project = expand_paths(@configuration.paths | paths).fetch(:files)
+        walked = required_outside_paths(analysed)
+        files = discovery_files(project + walked.found, analysed)
         # Overlapping arguments (`lib lib/user.rb`) name an analysed file twice; the widened set names it once.
-        files.size > analysed.uniq { |path| File.absolute_path(path) }.size ? { files: files, errors: [] } : nil
+        return nil unless files.size > analysed.uniq { |path| File.absolute_path(path) }.size || walked.missing.any?
+
+        { files: files, errors: [], uncertain: walked.found.to_set.freeze, missing: walked.missing }
+      end
+
+      # Issue #2021 — what the analysed files outside the configured `paths:` load with a literal `require_relative`,
+      # through targets that are themselves outside them ({RequireRelativeClosure}). A file under a configured path
+      # is discovered already, so the walk adds nothing for a run whose files all lie inside them. The comparison is
+      # by real path, so a symlinked spelling of a configured file does not join discovery a second time (two
+      # writers would withhold its constants, #644). `exclude:` drops a target from discovery as it drops a
+      # configured file; the walk still follows what an excluded target requires.
+      #
+      # The found files are discovered as `uncertain` ({Analysis::Runner::ProjectPrePasses#uncertain_paths}): the walk
+      # sees one entry point's load graph, and a file it does not reach may redefine what they define.
+      def required_outside_paths(analysed)
+        roots = @configuration.paths.map { |root| RequireRelativeClosure.real_path(root) }
+        covered = ->(real) { roots.any? { |root| real == root || real.start_with?(File.join(root, "")) } }
+        seeds = analysed.reject { |path| covered.call(RequireRelativeClosure.real_path(path)) }
+        return RequireRelativeClosure::Result.new(found: [], missing: []) if seeds.empty?
+
+        read = ->(path) { File.read(@buffer ? @buffer.resolve(path) : path) }
+        walked = RequireRelativeClosure.closure(seeds, covered: covered, read: read)
+        walked.with(found: PathExpansion.reject_excluded(walked.found, @configuration.exclude_patterns,
+                                                         base: @configuration.exclude_base))
+      end
+
+      # Issue #2021 — a kind row per `require_relative` target the walk named and found absent: a file appearing
+      # there joins the discovery, so it moves the answer of the run-result cache and the `--incremental` slot.
+      def required_missing_entries
+        missing = @project_discovery_expansion&.fetch(:missing, nil)
+        missing.nil? || missing.empty? ? [] : kind_entries(missing)
       end
 
       # The expansion with each file once, first spelling kept: overlapping arguments (`lib ./lib`) that do not
@@ -1887,6 +1955,23 @@ module Rigor
         unique.size == files.size ? expansion : expansion.merge(files: unique)
       end
 
+      # Issue #2165 — the discovery set with the buffer's file under the binding's own spelling, once. The binding
+      # substitutes bytes only for a path spelled exactly as its logical path, while the file can reach discovery as
+      # the argument's spelling, the configured one, or through a symlink; each of those read it from disk, and a
+      # second spelling made it a second declarer. Every member whose real path is the buffer's file is replaced by
+      # the logical path, and the duplicates that leaves are dropped (`IncrementalSession#rebind_buffer` is option
+      # B's counterpart).
+      def buffer_spelled(expansion)
+        return expansion if @buffer.nil?
+
+        target = Analysis::BufferBinding.real_path(@buffer.logical_path)
+        files = expansion.fetch(:files)
+        spelled = files.map do |path|
+          Analysis::BufferBinding.real_path(path) == target ? @buffer.logical_path : path
+        end.uniq
+        spelled == files ? expansion : expansion.merge(files: spelled)
+      end
+
       # Each file once, in project order, under the spelling the analysis uses when it is analysed.
       def discovery_files(project_files, analysed_files)
         spelling = analysed_files.to_h { |path| [File.absolute_path(path), path] }
@@ -1898,7 +1983,7 @@ module Rigor
       end
 
       def widen_discovery_to_project?(paths)
-        @prebuilt.nil? && @buffer.nil? && @in_memory_sources.nil? && paths != @configuration.paths
+        @prebuilt.nil? && @in_memory_sources.nil? && paths != @configuration.paths
       end
 
       # ADR-46 — the dependency-recording and subset-analysis modes read the discovery tables OUTSIDE the
@@ -1912,7 +1997,8 @@ module Rigor
 
       private :run_project_pre_passes, :adopt_prebuilt_project_scan, :apply_pre_passes_result,
               :apply_discovery_result, :ensure_project_discovery, :force_eager_discovery?,
-              :project_discovery_expansion, :discovery_files, :once_each, :widen_discovery_to_project?
+              :project_discovery_expansion, :discovery_files, :once_each, :widen_discovery_to_project?,
+              :required_outside_paths, :required_missing_entries
 
       # Ruby versions probed (ascending) to discover the lowest one this Prism build accepts for
       # `version:`. Prism exposes no version list, so the floor is found empirically — only when a
@@ -2102,6 +2188,7 @@ module Rigor
           hkt_scan_failure_snapshot: -> { @snapshots.hkt_scan_failure },
           conformance_results_snapshot: -> { @snapshots.conformance_results },
           pooled_run_disclosures: -> { @pool_coordinator.collected_run_disclosures },
+          served_run_disclosures: -> { @served_run_disclosures },
           pooled_trust_refusals: -> { @pool_coordinator.collected_trust_refusals }
         )
       end
@@ -2249,10 +2336,8 @@ module Rigor
           # client editing a brand-new file.
           elsif accept_as_ruby_file?(path)
             files << path
-          elsif File.exist?(path)
-            bad << [path, "not a Ruby file (expected `.rb` or a directory)"]
           else
-            bad << [path, "no such file or directory"]
+            bad << [path, PathExpansion.unusable_message(path)]
           end
         end
         { files: files, roots: Array(paths).map(&:to_s), errors: path_expansion_errors(bad, any_files: files.any?) }
@@ -2262,27 +2347,24 @@ module Rigor
       # app lib` with no `lib/` (the 20260620 field trial's strap case) analyses `app` instead of aborting
       # on exit 1. A bad path that leaves NOTHING to analyse stays an error so a lone typo (`rigor check
       # typo.rb`) is not silently masked (the regression the path-error check was added to catch in the
-      # first place).
+      # first place). The wording and grading live in {PathExpansion.diagnostics}, shared with `sig-gen` (#1991).
       def path_expansion_errors(bad, any_files:)
-        severity = any_files ? :warning : :error
-        suffix = any_files ? " (skipped)" : ""
-        bad.map { |path, message| path_error(path, "#{message}#{suffix}", severity: severity) }
+        PathExpansion.diagnostics(bad, any_files: any_files)
       end
 
+      # #2191 — the buffer's logical path is accepted under any spelling that names the same file (relative, absolute,
+      # or through a symlinked root), since the discovery set respells it to the logical path (`buffer_spelled`).
       def accept_as_ruby_file?(path)
         (File.file?(path) && path.end_with?(".rb")) ||
-          (@buffer && path == @buffer.logical_path) ||
+          buffer_path?(path) ||
           @in_memory_sources&.key?(path)
       end
 
-      def path_error(path, message, severity: :error)
-        Diagnostic.new(
-          path: path,
-          line: 1,
-          column: 1,
-          message: message,
-          severity: severity
-        )
+      def buffer_path?(path)
+        return false if @buffer.nil?
+
+        path == @buffer.logical_path ||
+          Analysis::BufferBinding.real_path(path) == Analysis::BufferBinding.real_path(@buffer.logical_path)
       end
 
       # Reads + parses the source at `path`. Under editor mode (`@buffer` set) reads bytes from
@@ -2481,12 +2563,31 @@ module Rigor
       # widener erases it to the class, and listing a file under `pre_eval:` must never LOSE precision. The
       # per-file table still wins over both (`ScopeIndexer.index`'s merge) — same-file stays the most
       # specific authority.
+      #
+      # ADR-124 — a `prebuilt:` runner computes no literal table of its own; a `discovery_seed:` (the editor
+      # publish, ADR-124) brings the project's, which then plays the same part.
       def merged_seed_constants
         pre_eval = publishable_pre_eval_constants
-        return @project_constant_values if pre_eval.empty?
-        return pre_eval if @project_constant_values.empty?
+        literal = literal_seed_constants
+        return literal if pre_eval.empty?
+        return pre_eval if literal.empty?
+
+        pre_eval.merge(literal).freeze
+      end
+
+      # The project's literal constant table: this run's, or the one a `discovery_seed:` carries (ADR-124).
+      def literal_seed_constants
+        return @project_constant_values unless @project_constant_values.empty? && @discovery_seed
+
+        @discovery_seed.fetch(:in_source_constants, @project_constant_values)
+      end
+
+      # The per-name writer paths the #663 retraction reads: this run's census, or the one a `discovery_seed:` carries
+      # (ADR-124).
+      def constant_writer_sources
+        return @project_constant_sources unless @project_constant_sources.empty? && @discovery_seed
 
-        pre_eval.merge(@project_constant_values).freeze
+        @discovery_seed.fetch(:constant_sources, @project_constant_sources)
       end
 
       # Issue #663 — the `pre_eval:` publication with every name an UNLISTED file also assigns retracted.
@@ -2515,8 +2616,9 @@ module Rigor
       # name of its own for the wildcard's paths to have been folded into.
       def unlisted_constant_writer?(name, listed)
         segment = name.split("::").last
-        writers = @project_constant_sources[name]
-        wildcard = @project_constant_sources["#{Inference::ScopeIndexer::DYNAMIC_TARGET_PREFIX}#{segment}"]
+        sources = constant_writer_sources
+        writers = sources[name]
+        wildcard = sources["#{Inference::ScopeIndexer::DYNAMIC_TARGET_PREFIX}#{segment}"]
         [writers, wildcard].any? do |paths|
           paths&.any? { |path| !listed.include?(File.absolute_path(path)) }
         end
@@ -2560,13 +2662,18 @@ module Rigor
         @pre_analysis_plugin_rows ||= plugin_boundary_rows
         reads = []
         diagnostics = nil
-        record = Plugin::IoBoundary.attributing(reads) do
-          DependencyRecorder.record_for(path) do
-            diagnostics = analyze_with_effects(path, environment)
+        record = nil
+        # Issue #2020 — and every run-scoped row its analysis registered, with the registering plugins' reads.
+        disclosures = RunDisclosureCredit.collect do
+          record = Plugin::IoBoundary.attributing(reads) do
+            DependencyRecorder.record_for(path) do
+              diagnostics = analyze_with_effects(path, environment)
+            end
           end
         end
         @file_dependencies[path] = record
         @analysis_reads[path] = reads unless reads.empty?
+        @analysis_disclosures[path] = disclosures unless disclosures.empty?
         diagnostics
       end
 

data/lib/rigor/analysis/worker_session.rb

@@ -20,6 +20,7 @@ require_relative "../inference/method_dispatcher/file_folding"
 require_relative "check_rules"
 require_relative "crash_signature"
 require_relative "dependency_recorder"
+require_relative "run_disclosure_credit"
 require_relative "dependency_source_inference"
 require_relative "diagnostic"
 require_relative "erb_template_detector"
@@ -171,12 +172,17 @@ module Rigor
 
         diagnostics = nil
         reads = []
-        record = Plugin::IoBoundary.attributing(reads) do
-          DependencyRecorder.record_for(path) { diagnostics = analyze_with_effects(path) }
+        record = nil
+        # Issue #2020 — and the run-scoped rows it registered, as `Runner#analyze_file` keeps them.
+        disclosures = RunDisclosureCredit.collect do
+          record = Plugin::IoBoundary.attributing(reads) do
+            DependencyRecorder.record_for(path) { diagnostics = analyze_with_effects(path) }
+          end
         end
         @file_dependencies[path] = record
         # Issue #1553 — the plugin reads this file's analysis made, as `Runner#analyze_file` keeps them.
         (@analysis_reads ||= {})[path] = reads unless reads.empty?
+        (@analysis_disclosures ||= {})[path] = disclosures unless disclosures.empty?
         diagnostics
       end
 
@@ -320,6 +326,12 @@ module Rigor
         @analysis_reads || {}
       end
 
+      # Issue #2020 — the run-scoped rows each file's analysis registered, `{path => [record]}`; see
+      # {RunDisclosureCredit}. Marshal-clean like {#drain_run_disclosures}.
+      def drain_analysis_disclosures
+        @analysis_disclosures || {}
+      end
+
       # ADR-103 WD12 — the per-file {Effects::FileCollection}s this session collected (empty unless the
       # configuration carries an `effects:` block). Marshal-clean by construction — frozen Hashes of
       # Strings, `LabelSet`s of frozen Arrays, and `Data` edges — so the fork pool ships them back to the

data/lib/rigor/cache/incremental_snapshot.rb

@@ -182,7 +182,20 @@ module Rigor
       # 41: issue #1583 — the payload gains `discovery_digests`, the packed digest of each file a run over path
       # arguments discovered without analysing, which a recheck compares to re-baseline when one moved. A pre-41
       # blob carries none; the gate rejects it and the next run is cold.
-      SCHEMA = 41
+      # 42: issue #2184 — a `deferred_ranges` row for a `def` inside a block now carries the method's name, and a
+      # literal-named `define_method` / `define_singleton_method` call adds a row. A pre-42 bundle carries neither,
+      # so a warm run would report a top-level block call that a cold run declines.
+      # 43: issue #2020 — the payload gains `plugin_disclosures`, the run-scoped plugin rows each analysed file's
+      # last analysis registered, which a recheck replays for the files it serves. A pre-43 blob carries none, so
+      # its rechecks would drop every such row; the gate rejects it and the next run is cold.
+      # 44: PR #2286 review M1 — the payload gains `synthetic_surface_digest`, the ADR-16 synthetic-method index's
+      # {Rigor::Inference::SyntheticMethodIndex#surface_digest} at the run the cache was built under, which a recheck
+      # compares to re-baseline when a class-body DSL edit moved it. A pre-44 blob carries none; the gate rejects it
+      # and the next run is cold.
+      # 45: issue #1154 — each seed bundle's `global_write_census` also records the ivar writers the declared-parameter
+      # credit reads (`[:ivar_set, name]`, `[:ivar_set_class, class]`, `[:own_write, class, name, path]`), which a
+      # pre-45 bundle carries none of, so a warm run would credit an ivar write a cold run declines.
+      SCHEMA = 45
 
       # The persisted per-file state.
       # `cache` maps an analyzed file to its diagnostics.
@@ -244,16 +257,24 @@ module Rigor
       # `effect_collections` (nil when collection was off). A plugin stamps its attributions and edges into a file's
       # collection, and `effects_identity` is plugin-blind (it is compared before any plugin loads), so the session
       # compares this one after the recheck has loaded them.
+      # Issue #2020 — `plugin_disclosures` is {Analysis::RunDisclosureLedger#to_h}: `files`, each analysed file's
+      # run-scoped plugin rows ({Plugin::Base#disclose_once} / {Plugin::Base#emit_once}) from its last analysis, which a
+      # recheck replays for the files it serves, and `reads`, the boundary rows per `[plugin id, key]` that make one
+      # stale.
       Payload = Data.define(:cache, :sources, :digests, :analyzed,
                             :symbol_sources, :ancestry_sources, :symbol_fingerprints,
                             :missing, :class_decls, :constant_decls, :seed_bundles, :plugin_fact_digest,
                             :return_summaries, :param_table,
                             :effect_collections, :effects_identity, :run_level_rows,
-                            :effect_plugin_digest, :plugin_reads, :discovery_digests) do
+                            :effect_plugin_digest, :plugin_reads, :discovery_digests, :plugin_disclosures,
+                            :synthetic_surface_digest) do
         # `effect_plugin_digest` defaults to nil so a payload built without it (an older caller, a spec fixture)
         # reads as "unknown", which the session treats as moved. `plugin_reads` defaults to no reads, and
-        # `discovery_digests` to no discovery-only files.
-        def initialize(effect_plugin_digest: nil, plugin_reads: {}, discovery_digests: {}, **rest)
+        # `discovery_digests` to no discovery-only files, and `plugin_disclosures` (#2020) to no replayed rows.
+        # `synthetic_surface_digest` defaults to nil, the empty index's digest: a run that builds a non-empty one
+        # reads it as moved.
+        def initialize(effect_plugin_digest: nil, plugin_reads: {}, discovery_digests: {}, plugin_disclosures: {},
+                       synthetic_surface_digest: nil, **rest)
           super
         end
       end
@@ -465,7 +486,9 @@ module Rigor
           run_level_rows: data[:run_level_rows],
           effect_plugin_digest: data[:effect_plugin_digest],
           plugin_reads: data[:plugin_reads] || {},
-          discovery_digests: data.fetch(:discovery_digests, {})
+          plugin_disclosures: data.fetch(:plugin_disclosures, {}),
+          discovery_digests: data.fetch(:discovery_digests, {}),
+          synthetic_surface_digest: data[:synthetic_surface_digest]
         )
       end
       private :payload_from
@@ -492,8 +515,8 @@ module Rigor
           effects_identity: payload.effects_identity,
           run_level_rows: payload.run_level_rows,
           effect_plugin_digest: payload.effect_plugin_digest,
-          plugin_reads: payload.plugin_reads,
-          discovery_digests: payload.discovery_digests
+          plugin_reads: payload.plugin_reads, plugin_disclosures: payload.plugin_disclosures,
+          discovery_digests: payload.discovery_digests, synthetic_surface_digest: payload.synthetic_surface_digest
         )
         # #1507 — every `--incremental` run that analysed anything rewrites this whole blob, so its deflate is
         # on the edit path; see {Store::DEFLATE_LEVEL}.

data/lib/rigor/cli/check_command.rb

@@ -3,6 +3,7 @@
 require "fileutils"
 require "json"
 require "optionparser"
+require "tempfile"
 
 require_relative "../configuration"
 require_relative "../config_audit"
@@ -11,6 +12,7 @@ require_relative "../analysis/rule_catalog"
 # The baseline filter runs on EVERY exit path — including the ADR-87 WD4 cache-HIT fast path, which skips
 # `load_check_dependencies` — so it must be a load-time require. It pulls only YAML, never the engine.
 require_relative "../analysis/baseline"
+require_relative "../analysis/edit_replay"
 require_relative "command"
 require_relative "options"
 require_relative "diagnostic_formats"
@@ -272,8 +274,83 @@ module Rigor
         incremental = session.reanalyze_subset(subset).map(&:to_h)
         full = verify_full_diagnostics(configuration, paths, collect_stats: options.fetch(:stats)).map(&:to_h)
 
-        report_verify_incremental(incremental, full, subset_size: subset.size, total: analyzed.size,
-                                                     format: options.fetch(:format))
+        status = report_verify_incremental(incremental, full, subset_size: subset.size, total: analyzed.size,
+                                                              format: options.fetch(:format))
+        return status unless status.zero? && options.fetch(:verify_incremental_edits).positive?
+
+        verify_edit_replays(session, configuration, paths, options)
+      end
+
+      # Issue #1967 — the partition check above re-analyses an unchanged tree, so every served row is still right and a
+      # missing invalidation edge goes unseen. Here each of `--verify-incremental-edits` sampled files is edited through
+      # an editor buffer (never on disk) by each of {Analysis::EditReplay.edits} — emptied, then reduced to its
+      # `class` / `module` skeleton — and the warm recheck of the baseline ({IncrementalSession#replay_edit}) must equal
+      # a full analysis of the edited tree: a dependent the recheck failed to re-analyse is served from the baseline and
+      # differs. A run in which every replay declined compared nothing, so it fails rather than report OK.
+      def verify_edit_replays(session, configuration, paths, options)
+        sample = edit_replay_sample(session.analyzed_files, options.fetch(:verify_incremental_edits))
+        replayed = 0
+        declined = 0
+        sample.each do |path|
+          Analysis::EditReplay.edits(File.read(path)).each do |edit|
+            incremental, full = replay_edit(session, configuration, paths, path, edit)
+            next declined += 1 if incremental.nil?
+
+            replayed += 1
+            next if incremental == full
+
+            return report_edit_replay_mismatch(path, edit, incremental, full)
+          end
+        end
+        report_edit_replays(replayed, declined, options.fetch(:format))
+      end
+
+      def report_edit_replay_mismatch(path, edit, incremental, full)
+        @err.puts("rigor: --verify-incremental FAILED — the recheck after #{edit.label} #{path} " \
+                  "differs from a full run.")
+        return report_verify_order_mismatch(incremental, full) if incremental.tally == full.tally
+
+        report_verify_set_mismatch(incremental, full, header: false)
+      end
+
+      # `count` files spread evenly over the analysed list, so a small count still reaches both ends of it.
+      def edit_replay_sample(analyzed, count)
+        return analyzed if count >= analyzed.size
+
+        Array.new(count) { |index| analyzed[index * analyzed.size / count] }
+      end
+
+      # The warm recheck's rows and a full run's, both with `path` replaced by `edit`; `[nil, nil]` when the recheck
+      # declined.
+      def replay_edit(session, configuration, paths, path, edit)
+        Tempfile.create(["rigor-verify-edit-", ".rb"]) do |file|
+          file.write(edit.source)
+          file.close
+          buffer = Analysis::BufferBinding.new(logical_path: path, physical_path: file.path)
+          recheck = session.replay_edit(buffer)
+          return [nil, nil] if recheck.nil?
+
+          # `analyze_only:` with the buffer selects editor mode option B, a whole-project run reading the buffer at
+          # its logical path; the buffer alone would analyse that one file.
+          runner = Analysis::Runner.new(configuration: configuration, cache_store: nil, collect_stats: false,
+                                        buffer: buffer, analyze_only: session.analyzed_files.to_set)
+          full = paths ? runner.run(paths) : runner.run
+          [recheck.diagnostics.map(&:to_h), full.diagnostics.map(&:to_h)]
+        end
+      end
+
+      def report_edit_replays(replayed, declined, format)
+        if replayed.zero? && declined.positive?
+          @err.puts("rigor: --verify-incremental FAILED — every edit replay (#{declined}) declined, " \
+                    "since the recheck would have been a full analysis, so no edit was compared.")
+          return 1
+        end
+
+        line = "rigor: --verify-incremental OK — #{replayed} edits replayed (files emptied and reduced to their " \
+               "class/module skeleton), every recheck matches full"
+        line = "#{line}; #{declined} declined (the recheck would have been a full analysis)" if declined.positive?
+        side_output(format).puts(line)
+        0
       end
 
       # ADR-46 — cross-process incremental analysis (`--incremental`). Derives the global fingerprint cheaply (no RBS
@@ -490,10 +567,10 @@ module Rigor
         end
       end
 
-      def report_verify_set_mismatch(incremental, full)
+      def report_verify_set_mismatch(incremental, full, header: true)
         only_incremental = multiset_difference(incremental, full)
         only_full = multiset_difference(full, incremental)
-        @err.puts("rigor: --verify-incremental FAILED — incremental and full diagnostics differ.")
+        @err.puts("rigor: --verify-incremental FAILED — incremental and full diagnostics differ.") if header
         @err.puts("  incremental-only: #{only_incremental.size}, full-only: #{only_full.size}")
         (only_incremental + only_full).first(10).each do |hash|
           @err.puts("    #{diagnostic_location(hash)}")
@@ -643,6 +720,9 @@ module Rigor
           # the rest from the per-file cache, and asserts the merged diagnostics are byte-identical to a full
           # `--no-cache` run. Exits non-zero on any mismatch. Off by default.
           verify_incremental: false,
+          # Issue #1967 — the number of files `--verify-incremental` replays an edit on (each emptied through an editor
+          # buffer) after the partition check. 0 replays none.
+          verify_incremental_edits: 0,
           # ADR-46 — cross-process incremental analysis. With a disk snapshot of the prior run's per-file diagnostics +
           # dependency graph, re-analyzes only the changed closure and serves the rest from the snapshot. Off by
           # default.
@@ -720,6 +800,15 @@ module Rigor
                   "assert incremental analysis matches a full run, then exit") do
             options[:verify_incremental] = true
           end
+          opts.on("--verify-incremental-edits=N", Integer,
+                  "with --verify-incremental, also replay 2 edits (empty, class/module skeleton) on N files") do |value|
+            if value.negative?
+              raise OptionParser::InvalidArgument, "--verify-incremental-edits=#{value} (must be 0 or more)"
+            end
+
+            options[:verify_incremental] = true
+            options[:verify_incremental_edits] = value
+          end
           opts.on("--incremental",
                   "re-analyze only files changed since the last run (cross-process cache)") do
             options[:incremental] = true