rigortype 0.4.5 → 0.4.7

data/lib/rigor/analysis/runner.rb

@@ -5,6 +5,7 @@ require "prism"
 require "tmpdir"
 
 require_relative "../environment"
+require_relative "../run_scoped_slots"
 require_relative "../scope"
 require_relative "../cache/store"
 require_relative "../cache/rbs_descriptor"
@@ -12,6 +13,8 @@ require_relative "../cache/file_digest"
 require_relative "../cache/incremental_snapshot"
 require_relative "run_cache_key"
 require_relative "path_expansion"
+require_relative "require_relative_closure"
+require_relative "run_disclosure_credit"
 require_relative "../plugin"
 require_relative "../plugin/source_rbs_synthesis_reporter"
 require_relative "../rbs_extended/reporter"
@@ -75,18 +78,20 @@ module Rigor
                   # this and serves reused files from it without re-stamping: a run-level row is regenerated
                   # every run wherever it is positioned, and slicing the run's full stream by path cached the
                   # file-positioned ones (`effect.annotations-unchecked`, `source-rbs-*`).
-                  :per_file_diagnostics
+                  :per_file_diagnostics,
+                  # PR #2286 review M1 — the ADR-16 index this run's pre-pass built; `IncrementalSession` digests it
+                  # to tell when a class-body DSL edit moved what a served file's dispatch read.
+                  :synthetic_method_index
 
       # Issues #796 / #794 — the two run-level rows a NARROWED run cannot re-derive from the files it
       # analyses: the `definition-build-failed` set (whose producer is the analysis's own demand, and #696
       # forbids Rigor demanding in its place) and the HKT-scan outcome (whose producer is an environment a
       # nothing-changed recheck otherwise has no reason to build). {IncrementalSession} persists what a full
       # run answers here and hands it back to the next narrowed run.
+      #
+      # Which rows those are is declared, not listed: every {RunLevelFacts} fact marked `replay`.
       def run_level_rows
-        Cache::IncrementalSnapshot::RunLevelRows.new(
-          definition_build_failures: @snapshots.definition_build_failures,
-          hkt_scan_failure: @snapshots.hkt_scan_failure
-        )
+        Cache::IncrementalSnapshot::RunLevelRows.new(**@snapshots.to_h.slice(*RunLevelFacts.replayable_names))
       end
 
       # ADR-46 — the per-file cross-file read records this run captured (empty unless
@@ -109,6 +114,13 @@ module Rigor
         pooled.empty? ? @analysis_reads : @analysis_reads.merge(pooled)
       end
 
+      # Issue #2020 — `{path => [run-disclosure record]}`, the run-scoped rows each analysed file's plugin hooks
+      # registered ({RunDisclosureCredit}), sequential and pooled alike; empty unless `record_dependencies:`.
+      def analysis_disclosures
+        pooled = @pool_coordinator.collected_analysis_disclosures
+        pooled.empty? ? @analysis_disclosures : @analysis_disclosures.merge(pooled)
+      end
+
       # ADR-103 — the run's propagated effect graph, or {Effects::EffectTable.empty} when collection did
       # not run. Reconciled from the sequential and pooled halves exactly as {#file_dependencies} is, then
       # closed by the post-pool fixpoint in {#assemble_run_diagnostics}.
@@ -268,8 +280,7 @@ module Rigor
       # @param explain — surface fail-soft fallback events as `:info` diagnostics.
       # @param cache_store — the persistent cache the runner exposes to producers
       #   (`RbsConstantTable` and successors). Pass `nil` to disable caching for this run; the CLI's
-      #   `--no-cache` flag wires `nil` through. v0.0.9 group A slice 1 introduces the surface; later
-      #   slices route real producers through it.
+      #   `--no-cache` flag wires `nil` through.
       # @param workers — ADR-15 Phase 4b — when greater than zero, per-file analysis dispatches
       #   across a pool of N workers. Default `0` keeps the sequential code path bit-for-bit unchanged.
       #   Controlled via the `RIGOR_RACTOR_WORKERS` env var or `.rigor.yml` `parallel.workers:` (Phase 4c,
@@ -294,10 +305,11 @@ module Rigor
       #   worker continues to build its own Environment.
       # @param discovery_seed — issue #260 — opt-in cross-file discovery tables, keyed by
       #   {Scope::DiscoveryIndex} slot name, seeded onto every per-file scope through
-      #   `project_scope_seed_tables`. The ONE deliberate exception to "a `prebuilt:` runner carries no
-      #   discovery tables": {Protection::DiagnosticOracle} threads the table set Tier 2's site filter already
-      #   judges anchors against, so a site admitted because a sibling-file class resolved is also a site the
-      #   oracle can kill at. nil (the default) leaves the prebuilt/LSP contract byte-identical.
+      #   `project_scope_seed_tables`. A `prebuilt:` runner computes no discovery tables of its own, so this is
+      #   how one learns the project: {Protection::DiagnosticOracle} threads the table set Tier 2's site filter
+      #   already judges anchors against, and (issue #2147, ADR-124) the LSP's per-buffer publish threads
+      #   `LanguageServer::ProjectContext#discovery_seed_for`, so a class another file declares is not an
+      #   external ancestor there. nil (the default) seeds nothing.
       # @param no_tolerated_effects — ADR-103 WD1 / #385 — `rigor check --no-tolerated-effects`.
       #   Judges effect envelopes as if `effects.tolerated:` were empty. A judgment-time switch only: the
       #   run, its collection and its cache identity are unchanged.
@@ -309,7 +321,7 @@ module Rigor
                      seed_bundles: nil, collect_seed_bundles: false, param_inferred_types: nil,
                      discovery_seed: nil, no_tolerated_effects: false,
                      restored_run_level_rows: nil, served_per_file_diagnostics: nil, served_effect_collections: nil,
-                     on_file_indexed: nil)
+                     served_run_disclosures: nil, on_file_indexed: nil)
         @configuration = configuration
         # ADR-113 WD2 — `rigor lens` reads a target's seeded index here: called with `(path, parse_result, scope,
         # index)` for every file this process indexes, after its rules ran and inside the run window, so the reader
@@ -327,6 +339,9 @@ module Rigor
         # effect graph this run closes (and the envelope pass judges) spans the whole project, not just the closure.
         # Never part of {#effect_collections_by_path}, which stays what THIS run collected. Empty on every other run.
         @served_effect_collections = served_effect_collections || {}
+        # Issue #2020 — the run-scoped plugin rows ({RunDisclosureCredit}) those unanalysed files registered when
+        # they were last analysed, emitted beside this run's own registrations. Empty on every other run.
+        @served_run_disclosures = served_run_disclosures || []
         @explain = explain
         @cache_store = enforce_read_only_cache(cache_store, buffer)
         @plugin_requirer = plugin_requirer
@@ -336,8 +351,8 @@ module Rigor
         @prebuilt = prebuilt
         @environment_override = environment
         # ADR-46 slice 1 — opt-in cross-file dependency recording. Off by default; when true,
-        # `analyze_file` records each file's cross-file reads into `file_dependencies` (the incremental
-        # cache, a later slice, consumes them).
+        # `analyze_file` records each file's cross-file reads into `file_dependencies`; the incremental
+        # cache consumes them.
         @record_dependencies = record_dependencies
         # ADR-24 slice 4a — opt-in unresolved-implicit-self-call recording. Off by default; when true,
         # `analyze_file` activates the engine choke-point recorder and collects each file's misses into
@@ -382,6 +397,7 @@ module Rigor
         # rows as they stood around the per-file loop; see {#incremental_slot_rows}. Recorded only by a
         # dependency-recording (incremental) run.
         @analysis_reads = {}
+        @analysis_disclosures = {}
         @pre_analysis_plugin_rows = nil
         @post_analysis_plugin_rows = nil
         # Memoised activation decision for the `call.self-undefined-method` rule (nil = not yet computed).
@@ -496,6 +512,9 @@ module Rigor
         # entry across a run boundary (LSP re-check, ADR-62 warm loop); nil until the first run so
         # runner-less probes keep the per-file fallback.
         @run_generation = nil
+        # The return memo bucket the last `run` filled, kept for {#return_summaries} once the run has released the
+        # thread's slot; nil before the first run.
+        @return_memo = nil
         build_collaborators
       end
 
@@ -518,9 +537,39 @@ module Rigor
         # freshness path for this run; the `auto` default resolves strict in CI (#190), stat-first elsewhere.
         Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
           Inference::DefNodeResolver.with_run { run_analysis(paths) }
+        ensure
+          # ADR-89 WD2 — {#return_summaries} reads the return memo after the run, so the runner keeps the bucket the
+          # run filled before the thread's run-scoped slots are released (issues #2412, #2399).
+          @return_memo = Inference::ExpressionTyper.current_return_memo
+          RunScopedSlots.release
         end
       end
 
+      # ADR-45 WD2 (#1507) / #2020 — the per-run reset of what each file's analysis is credited with: its plugin
+      # reads, its run-scoped plugin registrations, and the boundary rows around the per-file loop.
+      def reset_analysis_attribution
+        @analysis_reads = {}
+        @analysis_disclosures = {}
+        @pre_analysis_plugin_rows = nil
+        @post_analysis_plugin_rows = nil
+      end
+      private :reset_analysis_attribution
+
+      # Issue #2392 — the sequential half of the per-run reset, beside {#reset_analysis_attribution}: the
+      # dependency graph and per-file effect collections a `--workers 0` run records, and the effect-slot state a
+      # served run leaves behind. The loader is the one that matters: a served run's collections loader would
+      # otherwise feed the next analysing run the previous run's collections. Runs before any `adopt_*`, which the
+      # served lanes call later in the same run, so an adopted slot is this run's own.
+      def reset_sequential_run_tables
+        @file_dependencies = {}
+        @file_effects = {}
+        @cached_effect_sources = nil
+        @cached_effect_ancestry = nil
+        @cached_collections_loader = nil
+        @effects_served_from_cache = false
+      end
+      private :reset_sequential_run_tables
+
       def run_analysis(paths)
         Inference::MethodDispatcher::FileFolding.fold_platform_specific_paths =
           @configuration.fold_platform_specific_paths
@@ -534,6 +583,10 @@ module Rigor
         @project_discovery_expansion = project_discovery_expansion(paths, expansion)
         @discovery_widened = widen_discovery_to_project?(paths)
         @snapshots.reset_for_run
+        # Issue #2392 — the coordinator's run-accumulated tables (disclosures, trust refusals, the dependency and
+        # effect graphs) are per run too: a reused Runner must not re-emit or sum the previous run's rows.
+        @pool_coordinator.reset_for_run
+        reset_sequential_run_tables
         # Per-run reset of the deferred-discovery memo (see `#ensure_project_discovery`).
         @project_discovery_done = false
         # #392 — re-derive the template units each run: their source files can change between two runs of
@@ -548,9 +601,7 @@ module Rigor
         # #788 — the per-file reader is assigned only on the analysis (miss) path; reset it here so a run the
         # ADR-45 result cache serves does not answer with the previous run's rows.
         @per_file_diagnostics = [].freeze
-        @analysis_reads = {}
-        @pre_analysis_plugin_rows = nil
-        @post_analysis_plugin_rows = nil
+        reset_analysis_attribution
         # ADR-84 WD2 — roll the return-memo bucket: a fresh frozen token per run makes every per-file scope
         # of THIS run share one memo bucket while entries from any earlier run in this process (stale after
         # an edit) become unreachable.
@@ -743,9 +794,10 @@ module Rigor
       # arg-flooring surface). Only meaningful right after a run populated the memo (baseline / recheck),
       # before the bucket rolls. Keys are held live here; the session Marshals them for the snapshot.
       #
-      # @return `{ [path, "Class#method" | "Class.method"] => { keys:, returns:, effects: } }`.
+      # @return the summaries keyed by `[path, "Class#method"]` (or `"Class.method"`), each holding `keys:`,
+      #   `returns:` and `effects:`.
       def return_summaries
-        memo = Inference::ExpressionTyper.harvest_return_memo
+        memo = Inference::ExpressionTyper.harvest_return_memo(@return_memo)
         return {} if memo.empty?
 
         result = {}
@@ -803,13 +855,15 @@ module Rigor
       #
       # @param paths — analysis roots (nil → the configuration's `paths:`).
       # @param specs — each `{ class_name:, method_name:, singleton:, keys: [[receiver, args], …] }`.
-      # @return `{ [class_name, method_name, singleton] => [return_descriptor_or_nil, …] }`.
+      # @return the re-evaluated return descriptors, one per key, keyed by `[class_name, method_name, singleton]`.
       def evaluate_return_types(paths, specs)
         return {} if specs.empty?
 
         Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
           Inference::DefNodeResolver.with_run { evaluate_return_types_setup(paths, specs) }
         end
+      ensure
+        RunScopedSlots.release
       end
 
       # Builds the discovery index + environment (a real run's prologue, minus per-file analysis) and
@@ -996,17 +1050,12 @@ module Rigor
         nil
       end
 
-      # The write half, run only after a miss, so the block never recomputes anything: it hands over the
-      # collections the analysis just produced — and the table the analysis already closed over them, so
-      # a warm hit re-runs neither the merge nor the fixpoint — validated against the same post-run
-      # dependency descriptor the diagnostics slot records. Fail-soft — a collection that will not
-      # Marshal (which nothing in {Effects::FileCollection} should be, and the fork pool already proves
-      # per file) costs the next run its warm start and nothing else.
-      # The write half, run only after a miss, so neither block recomputes anything. Two entries under one
+      # The write half, run only after a miss, so nothing here recomputes anything. Two entries under one
       # key descriptor and one dependency descriptor (#482): the summary a warm run serves from, and the
       # collections the incremental and fail-soft paths read. The summary is written LAST, so a run
       # interrupted between the two leaves a collections entry that the next run's summary miss simply
-      # re-collects — never a summary whose collections are absent.
+      # re-collects — never a summary whose collections are absent. A collection that will not Marshal
+      # costs the next run its warm start and nothing else.
       def store_effect_collections(descriptor, expansion, rbs_descriptor)
         return if descriptor.nil?
 
@@ -1208,40 +1257,13 @@ module Rigor
       end
       private :template_unit_failure_diagnostics
 
-      # The rbs-coverage build-failure ladder plus every remaining post-analysis stream
-      # `#assemble_run_diagnostics` appends, in their fixed contract order (see the comments at each call
-      # below and at the streams' own definitions). Split out of `#assemble_run_diagnostics` so that
-      # method's `Metrics/AbcSize` stays under budget — every stream here is a plain `DiagnosticAggregator`
-      # reader with no branching of its own, so the split changes nothing about WHEN or in WHAT order they
-      # run.
+      # Every remaining post-analysis stream `#assemble_run_diagnostics` appends — the `rbs.coverage.*`
+      # build-failure ladder (widest consequence first: quarantine, env build, definition build #696, HKT scan
+      # #784), its notices, the conformance rows, the reporter streams, the plugin run disclosures (#1051)
+      # and, last, the trust-refusal envelope (#959) — in the contract order ADR-116 WD3's
+      # {RunLevelFacts} declares. Read after `analyze_targets`, so every worker payload has been merged.
       def post_analysis_diagnostic_streams
-        diagnostics = @diagnostic_aggregator.rbs_quarantined_signature_diagnostics
-        diagnostics += @diagnostic_aggregator.rbs_environment_build_failed_diagnostics
-        # Issue #696 — after its env-wide twin and before the synthesized-namespace notice: the four
-        # `rbs.coverage.*` build conditions surface widest-consequence first, and their relative order is
-        # the diagnostic output contract.
-        diagnostics += @diagnostic_aggregator.rbs_definition_build_failed_diagnostics
-        # Issue #784 — last of the four, deliberately: it loses only the IMPLICIT HKT registrations a
-        # `type` alias would have contributed, never a class's own declared method surface, so it is the
-        # narrowest-consequence rung on the same ladder.
-        diagnostics += @diagnostic_aggregator.rbs_hkt_scan_failed_diagnostics
-        # The synthesized-namespace notice, then (#610) the plugin-signature stand-down: the outcome that
-        # AVOIDED a definition-build failure, so the quietest row on that ladder.
-        diagnostics += @diagnostic_aggregator.rbs_coverage_notice_diagnostics
-        diagnostics += @diagnostic_aggregator.conforms_to_diagnostics
-        diagnostics += @diagnostic_aggregator.rbs_extended_reporter_diagnostics
-        diagnostics += @diagnostic_aggregator.boundary_cross_diagnostics
-        diagnostics += @diagnostic_aggregator.source_rbs_synthesis_diagnostics
-        # Issue #1051 — read after `analyze_targets` for the same reason the refusal stream below is: a
-        # plugin may register a disclosure from `#prepare` (the usual case) or while analysing a file, and
-        # both have to be in before the table is harvested. Ordered before the refusals so the run-level
-        # plugin rows read plugin-authored notice first, engine-authored envelope second.
-        diagnostics += @diagnostic_aggregator.plugin_run_disclosure_diagnostics
-        # Issue #959 — read LAST (after `analyze_targets`, which already ran before this method is called),
-        # so every per-file plugin call has had its chance to record a refusal on its (per-plugin-instance
-        # memoised) `IoBoundary`, alongside the prepare-time refusals the same boundary instance may
-        # already carry.
-        diagnostics + @diagnostic_aggregator.plugin_trust_refusal_diagnostics
+        @diagnostic_aggregator.run_level_diagnostics
       end
       private :post_analysis_diagnostic_streams
 
@@ -1414,7 +1436,7 @@ module Rigor
       end
 
       def build_run_dependency_descriptor(expansion, rbs_descriptor)
-        entries = analyzed_file_entries(expansion) + discovery_file_entries(expansion) +
+        entries = analyzed_file_entries(expansion) + discovery_file_entries(expansion) + required_missing_entries +
                   pre_eval_file_entries + template_unit_file_entries + rbs_descriptor.files +
                   root_presence_entries(expansion)
         # #979 — the signature ROOTS' listings, one glob row each. `rbs_descriptor.files` covers only the
@@ -1509,7 +1531,8 @@ module Rigor
         IncrementalSlotRows.new(
           observed: plugin_boundary_rows,
           derived: Cache::Descriptor.new(
-            files: template_unit_file_entries + kind_entries(Array(roots) + @configuration.pre_eval),
+            files: template_unit_file_entries + kind_entries(Array(roots) + @configuration.pre_eval) +
+                   required_missing_entries,
             globs: template_unit_glob_entries
           ),
           by_file: @analysis_reads.transform_values do |reads|
@@ -1557,7 +1580,9 @@ module Rigor
       # change time it cannot read, and passes over a `pinned` one.
       BaselineRows = Data.define(:owned, :pinned)
 
-      SignatureRoots = Struct.new(:signature_paths)
+      # A loader's two readers {Cache::RbsDescriptor} takes signature roots from. `core_root` (issue #2517) is the
+      # selected core, which the slot key names by path only, so its files are `owned` rows like the project's own.
+      SignatureRoots = Struct.new(:signature_paths, :core_root)
       private_constant :SignatureRoots
 
       # @param files — the run's analysed-path set.
@@ -1568,7 +1593,8 @@ module Rigor
         BaselineRows.new(
           owned: Cache::Descriptor.new(
             files: own.files + kind_entries(signature_root_candidates) +
-                   discovery_file_entries({ files: files }) + unanalysed_pre_eval_entries(files),
+                   discovery_file_entries({ files: files }) + required_missing_entries +
+                   unanalysed_pre_eval_entries(files),
             globs: (own.globs + discovery_glob_entries).uniq
           ),
           pinned: pinned
@@ -1577,8 +1603,9 @@ module Rigor
 
       # The signature tree's rows, the project's own and the rest.
       def signature_rows
-        roots = SignatureRoots.new(@snapshots.signature_paths)
-        own = signature_root_candidates.map { |root| File.join(File.absolute_path(root.to_s), "") }
+        roots = SignatureRoots.new(@snapshots.signature_paths, @configuration.core_root)
+        own = (signature_root_candidates + [@configuration.core_root].compact)
+              .map { |root| File.join(File.absolute_path(root.to_s), "") }
         own_files, other_files = Cache::RbsDescriptor.file_entries(roots, comparator: :stat)
                                                      .partition { |row| within?(row.path, own) }
         own_globs, other_globs = Cache::RbsDescriptor.glob_entries(roots).partition { |row| within?(row.root, own) }
@@ -1808,20 +1835,19 @@ module Rigor
       end
 
       # Internal: builds the deferred cross-file discovery tables at most once per run and adopts them.
-      # Memoised on `@project_discovery_done` (reset at the start of `#run`). No-op under `@prebuilt` — the
-      # LSP path deliberately seeds an empty project scope from a snapshot that carries no discovery tables,
-      # so forcing a build there would change that contract. A caller that DOES want cross-file knowledge under
-      # `prebuilt:` supplies it explicitly through `discovery_seed:` (issue #260) rather than by re-walking the
-      # project here. Called eagerly from `#run` for the recording /
-      # subset (ADR-46) modes and lazily from `#assemble_run_diagnostics` on the analysis path, so a warm
-      # cache HIT (which never assembles) never pays the double parse.
+      # Memoised on `@project_discovery_done` (reset at the start of `#run`). No-op under `@prebuilt`: the
+      # snapshot carries no discovery tables, and a per-request re-walk of the project is what `prebuilt:` exists
+      # to avoid. A caller that wants cross-file knowledge under `prebuilt:` supplies it through `discovery_seed:`
+      # (issue #260), as the LSP publish does since issue #2147 (ADR-124). Called eagerly from `#run` for the
+      # recording / subset (ADR-46) modes and lazily from `#assemble_run_diagnostics` on the analysis path, so a
+      # warm cache HIT (which never assembles) never pays the double parse.
       def ensure_project_discovery(expansion)
         return if @prebuilt
         return if @project_discovery_done
 
         @project_discovery_done = true
         # Issue #684 — the cross-file index spans the PROJECT even when the analysis targets a file list.
-        expansion = @project_discovery_expansion || once_each(expansion)
+        expansion = buffer_spelled(@project_discovery_expansion || once_each(expansion))
         if @collect_seed_bundles
           # ADR-85 WD2 — rebuild discovery from the prior run's bundles (re-walking only changed files) and
           # capture the refreshed bundle set for the session to persist.
@@ -1853,7 +1879,13 @@ module Rigor
       # on what else was on the command line.
       #
       # Excluded, each because its expansion is already the one it means: the LSP `prebuilt:` path (which
-      # seeds discovery from a snapshot), editor `buffer:` mode, and `run_source`'s in-memory single file.
+      # seeds discovery from a snapshot, ADR-124) and `run_source`'s in-memory single file.
+      #
+      # Issue #2165 — editor `buffer:` mode (`rigor check --tmp-file T --instead-of F F`) widens like a plain run.
+      # It was excluded on the reading that its expansion is already the one it means, but an editor passes the
+      # buffer's own path, so discovery saw that file alone: every class another file declares read as an external
+      # ancestor, and the run reported what `rigor check F` does not. The discovery pre-pass reads through the
+      # binding, so the buffer's file is walked from the buffer's bytes.
       #
       # Issue #1583 — ADR-46's `analyze_only` subset mode widens like a full run. It was excluded on the
       # reading that it "already passes the full expansion", which holds only when the incremental session
@@ -1867,15 +1899,51 @@ module Rigor
       # the pre-pass then saw two writers for every constant a file declares and withheld its publication (#644),
       # and every file was a discovered-not-analysed dependency of the run's cache entry.
       #
+      # Issue #2021 — an analysed file outside the configured paths has no project there, so the widened set also
+      # holds what it loads with a literal `require_relative` ({#required_outside_paths}). A plugin file checked on
+      # its own otherwise missed its sibling's nested `Effects` and resolved the project's `Rigor::Effects`.
+      #
       # The widening decision itself compares the paths as spelled. `exclude:` patterns apply to both spellings
       # alike (#1576), so the configured absolute `lib` and the argument `lib` exclude the same files.
       def project_discovery_expansion(paths, expansion)
         return nil unless widen_discovery_to_project?(paths)
 
         analysed = expansion.fetch(:files)
-        files = discovery_files(expand_paths(@configuration.paths | paths).fetch(:files), analysed)
+        project = expand_paths(@configuration.paths | paths).fetch(:files)
+        walked = required_outside_paths(analysed)
+        files = discovery_files(project + walked.found, analysed)
         # Overlapping arguments (`lib lib/user.rb`) name an analysed file twice; the widened set names it once.
-        files.size > analysed.uniq { |path| File.absolute_path(path) }.size ? { files: files, errors: [] } : nil
+        return nil unless files.size > analysed.uniq { |path| File.absolute_path(path) }.size || walked.missing.any?
+
+        { files: files, errors: [], uncertain: walked.found.to_set.freeze, missing: walked.missing }
+      end
+
+      # Issue #2021 — what the analysed files outside the configured `paths:` load with a literal `require_relative`,
+      # through targets that are themselves outside them ({RequireRelativeClosure}). A file under a configured path
+      # is discovered already, so the walk adds nothing for a run whose files all lie inside them. The comparison is
+      # by real path, so a symlinked spelling of a configured file does not join discovery a second time (two
+      # writers would withhold its constants, #644). `exclude:` drops a target from discovery as it drops a
+      # configured file; the walk still follows what an excluded target requires.
+      #
+      # The found files are discovered as `uncertain` ({Analysis::Runner::ProjectPrePasses#uncertain_paths}): the walk
+      # sees one entry point's load graph, and a file it does not reach may redefine what they define.
+      def required_outside_paths(analysed)
+        roots = @configuration.paths.map { |root| RequireRelativeClosure.real_path(root) }
+        covered = ->(real) { roots.any? { |root| real == root || real.start_with?(File.join(root, "")) } }
+        seeds = analysed.reject { |path| covered.call(RequireRelativeClosure.real_path(path)) }
+        return RequireRelativeClosure::Result.new(found: [], missing: []) if seeds.empty?
+
+        read = ->(path) { File.read(@buffer ? @buffer.resolve(path) : path) }
+        walked = RequireRelativeClosure.closure(seeds, covered: covered, read: read)
+        walked.with(found: PathExpansion.reject_excluded(walked.found, @configuration.exclude_patterns,
+                                                         base: @configuration.exclude_base))
+      end
+
+      # Issue #2021 — a kind row per `require_relative` target the walk named and found absent: a file appearing
+      # there joins the discovery, so it moves the answer of the run-result cache and the `--incremental` slot.
+      def required_missing_entries
+        missing = @project_discovery_expansion&.fetch(:missing, nil)
+        missing.nil? || missing.empty? ? [] : kind_entries(missing)
       end
 
       # The expansion with each file once, first spelling kept: overlapping arguments (`lib ./lib`) that do not
@@ -1887,6 +1955,23 @@ module Rigor
         unique.size == files.size ? expansion : expansion.merge(files: unique)
       end
 
+      # Issue #2165 — the discovery set with the buffer's file under the binding's own spelling, once. The binding
+      # substitutes bytes only for a path spelled exactly as its logical path, while the file can reach discovery as
+      # the argument's spelling, the configured one, or through a symlink; each of those read it from disk, and a
+      # second spelling made it a second declarer. Every member whose real path is the buffer's file is replaced by
+      # the logical path, and the duplicates that leaves are dropped (`IncrementalSession#rebind_buffer` is option
+      # B's counterpart).
+      def buffer_spelled(expansion)
+        return expansion if @buffer.nil?
+
+        target = Analysis::BufferBinding.real_path(@buffer.logical_path)
+        files = expansion.fetch(:files)
+        spelled = files.map do |path|
+          Analysis::BufferBinding.real_path(path) == target ? @buffer.logical_path : path
+        end.uniq
+        spelled == files ? expansion : expansion.merge(files: spelled)
+      end
+
       # Each file once, in project order, under the spelling the analysis uses when it is analysed.
       def discovery_files(project_files, analysed_files)
         spelling = analysed_files.to_h { |path| [File.absolute_path(path), path] }
@@ -1898,7 +1983,7 @@ module Rigor
       end
 
       def widen_discovery_to_project?(paths)
-        @prebuilt.nil? && @buffer.nil? && @in_memory_sources.nil? && paths != @configuration.paths
+        @prebuilt.nil? && @in_memory_sources.nil? && paths != @configuration.paths
       end
 
       # ADR-46 — the dependency-recording and subset-analysis modes read the discovery tables OUTSIDE the
@@ -1912,7 +1997,8 @@ module Rigor
 
       private :run_project_pre_passes, :adopt_prebuilt_project_scan, :apply_pre_passes_result,
               :apply_discovery_result, :ensure_project_discovery, :force_eager_discovery?,
-              :project_discovery_expansion, :discovery_files, :once_each, :widen_discovery_to_project?
+              :project_discovery_expansion, :discovery_files, :once_each, :widen_discovery_to_project?,
+              :required_outside_paths, :required_missing_entries
 
       # Ruby versions probed (ascending) to discover the lowest one this Prism build accepts for
       # `version:`. Prism exposes no version list, so the floor is found empirically — only when a
@@ -1970,8 +2056,7 @@ module Rigor
       # Editor mode § "Scope choice — option A". Under `buffer:` non-nil the per-file analysis emits
       # diagnostics ONLY for the buffer's logical path; the rest of `paths:` is consumed by the
       # project-wide pre-passes (synthetic methods, project-patched methods, plugin facts) but contributes
-      # no per-file diagnostics. This is the v1 cut before a per-file diagnostic cache exists; option B
-      # (full project + incremental cache) is queued.
+      # no per-file diagnostics. Option B (#146) narrows to the closure instead; see {#target_files}.
       #
       # The buffer's logical path is added to the file list even if it's not under `paths:` — per design §
       # "Failure envelope": "--instead-of=Y with Y not under any paths: directory → treated as a valid
@@ -2004,7 +2089,13 @@ module Rigor
           # The logical path joins even when it is not on disk under `paths:` (design § "Failure envelope"),
           # the same allowance option A makes below.
           files = files.select { |path| @analyze_only.include?(path) }
-          files |= [@buffer.logical_path] if @buffer && @analyze_only.include?(@buffer.logical_path)
+          # Issue #2233 — a buffer that is a claimed template joins as its unit, appended by
+          # {#template_unit_targets}, never as a `.rb` file: the logical path in its absolute spelling would
+          # otherwise analyse the same template twice. The registry is loaded by now, which is why the test is here
+          # and not in the incremental session, where it is not.
+          if @buffer && @analyze_only.include?(@buffer.logical_path) && !template_path?(@buffer.logical_path)
+            files |= [@buffer.logical_path]
+          end
           return template_unit_targets(files)
         end
         return template_unit_targets(files) if @buffer.nil?
@@ -2040,6 +2131,14 @@ module Rigor
       end
       public :template_unit_paths
 
+      # Issue #2233 — whether `path` is a template of this run: a claimed glob matches it, or it names a unit. The
+      # runner keeps the buffer's logical path out of the targets when this is true, so a template buffer is
+      # analysed once, as a unit ({#template_unit_targets} appends it), and never also as a plain `.rb` file.
+      def template_path?(path)
+        template_units.claims?(path) ||
+          template_unit_paths.include?(Analysis::TemplateUnitPaths.relative(path, Dir.pwd))
+      end
+
       # Editor mode (`buffer:` non-nil) auto-flips the cache store to `read_only: true` so multiple
       # debounced editor invocations against the same project don't churn the on-disk cache or race on
       # schema-version writes. Cache reads continue unchanged; misses still run the producer block but the
@@ -2093,15 +2192,9 @@ module Rigor
           pool_mode: -> { pool_mode? },
           cached_plugin_prepare_diagnostics: -> { @cached_plugin_prepare_diagnostics },
           pre_eval_diagnostics_from_scanner: -> { @pre_eval_diagnostics_from_scanner },
-          synthesized_namespaces_snapshot: -> { @snapshots.synthesized_namespaces },
-          quarantined_signatures_snapshot: -> { @snapshots.quarantined_signatures },
-          signature_standdowns_snapshot: -> { @snapshots.signature_standdowns },
-          vendored_standdowns_snapshot: -> { @snapshots.vendored_standdowns },
-          env_build_failure_snapshot: -> { @snapshots.env_build_failure },
-          definition_build_failures_snapshot: -> { @snapshots.definition_build_failures },
-          hkt_scan_failure_snapshot: -> { @snapshots.hkt_scan_failure },
-          conformance_results_snapshot: -> { @snapshots.conformance_results },
+          snapshots: @snapshots,
           pooled_run_disclosures: -> { @pool_coordinator.collected_run_disclosures },
+          served_run_disclosures: -> { @served_run_disclosures },
           pooled_trust_refusals: -> { @pool_coordinator.collected_trust_refusals }
         )
       end
@@ -2249,10 +2342,8 @@ module Rigor
           # client editing a brand-new file.
           elsif accept_as_ruby_file?(path)
             files << path
-          elsif File.exist?(path)
-            bad << [path, "not a Ruby file (expected `.rb` or a directory)"]
           else
-            bad << [path, "no such file or directory"]
+            bad << [path, PathExpansion.unusable_message(path)]
           end
         end
         { files: files, roots: Array(paths).map(&:to_s), errors: path_expansion_errors(bad, any_files: files.any?) }
@@ -2262,27 +2353,24 @@ module Rigor
       # app lib` with no `lib/` (the 20260620 field trial's strap case) analyses `app` instead of aborting
       # on exit 1. A bad path that leaves NOTHING to analyse stays an error so a lone typo (`rigor check
       # typo.rb`) is not silently masked (the regression the path-error check was added to catch in the
-      # first place).
+      # first place). The wording and grading live in {PathExpansion.diagnostics}, shared with `sig-gen` (#1991).
       def path_expansion_errors(bad, any_files:)
-        severity = any_files ? :warning : :error
-        suffix = any_files ? " (skipped)" : ""
-        bad.map { |path, message| path_error(path, "#{message}#{suffix}", severity: severity) }
+        PathExpansion.diagnostics(bad, any_files: any_files)
       end
 
+      # #2191 — the buffer's logical path is accepted under any spelling that names the same file (relative, absolute,
+      # or through a symlinked root), since the discovery set respells it to the logical path (`buffer_spelled`).
       def accept_as_ruby_file?(path)
         (File.file?(path) && path.end_with?(".rb")) ||
-          (@buffer && path == @buffer.logical_path) ||
+          buffer_path?(path) ||
           @in_memory_sources&.key?(path)
       end
 
-      def path_error(path, message, severity: :error)
-        Diagnostic.new(
-          path: path,
-          line: 1,
-          column: 1,
-          message: message,
-          severity: severity
-        )
+      def buffer_path?(path)
+        return false if @buffer.nil?
+
+        path == @buffer.logical_path ||
+          Analysis::BufferBinding.real_path(path) == Analysis::BufferBinding.real_path(@buffer.logical_path)
       end
 
       # Reads + parses the source at `path`. Under editor mode (`@buffer` set) reads bytes from
@@ -2438,14 +2526,14 @@ module Rigor
         @discovery_seed ? @discovery_seed.dup : {}
       end
 
-      # Seeds the two OPT-IN pre-pass tables — the ones an ordinary run leaves empty, so they are absent from
-      # the seed entirely unless the project asked for them. Both ride this seed so a pooled `WorkerSession`
-      # scope resolves identically to the sequential path (ADR-15 sequential equivalence).
+      # Seeds the parameter-inference and constant-publication tables, so a pooled `WorkerSession` scope resolves
+      # identically to the sequential path (ADR-15 sequential equivalence). The parameter-inference table is absent
+      # unless its opt-in ran; the constant tables are seeded whenever the run has project constants.
       #
       # - ADR-67 WD6a `param_inferred_types`: the call-site parameter-inference table, populated only when the
       #   `parameter_inference:` gate ran the pre-pass.
-      # - Issue #352 `in_source_constants`: the `pre_eval:` constant publication, populated only when the
-      #   project lists `pre_eval:` files that declare publishable constants.
+      # - Issue #352 `in_source_constants`: the `pre_eval:` constant publication, merged with the project's
+      #   literal constant table (#644, see {#merged_seed_constants}).
       #
       # Extracted to keep {#project_scope_seed_tables} under the complexity budget.
       def seed_opt_in_pre_pass_tables(tables)
@@ -2481,12 +2569,31 @@ module Rigor
       # widener erases it to the class, and listing a file under `pre_eval:` must never LOSE precision. The
       # per-file table still wins over both (`ScopeIndexer.index`'s merge) — same-file stays the most
       # specific authority.
+      #
+      # ADR-124 — a `prebuilt:` runner computes no literal table of its own; a `discovery_seed:` (the editor
+      # publish, ADR-124) brings the project's, which then plays the same part.
       def merged_seed_constants
         pre_eval = publishable_pre_eval_constants
-        return @project_constant_values if pre_eval.empty?
-        return pre_eval if @project_constant_values.empty?
+        literal = literal_seed_constants
+        return literal if pre_eval.empty?
+        return pre_eval if literal.empty?
+
+        pre_eval.merge(literal).freeze
+      end
+
+      # The project's literal constant table: this run's, or the one a `discovery_seed:` carries (ADR-124).
+      def literal_seed_constants
+        return @project_constant_values unless @project_constant_values.empty? && @discovery_seed
+
+        @discovery_seed.fetch(:in_source_constants, @project_constant_values)
+      end
+
+      # The per-name writer paths the #663 retraction reads: this run's census, or the one a `discovery_seed:` carries
+      # (ADR-124).
+      def constant_writer_sources
+        return @project_constant_sources unless @project_constant_sources.empty? && @discovery_seed
 
-        pre_eval.merge(@project_constant_values).freeze
+        @discovery_seed.fetch(:constant_sources, @project_constant_sources)
       end
 
       # Issue #663 — the `pre_eval:` publication with every name an UNLISTED file also assigns retracted.
@@ -2515,8 +2622,9 @@ module Rigor
       # name of its own for the wildcard's paths to have been folded into.
       def unlisted_constant_writer?(name, listed)
         segment = name.split("::").last
-        writers = @project_constant_sources[name]
-        wildcard = @project_constant_sources["#{Inference::ScopeIndexer::DYNAMIC_TARGET_PREFIX}#{segment}"]
+        sources = constant_writer_sources
+        writers = sources[name]
+        wildcard = sources["#{Inference::ScopeIndexer::DYNAMIC_TARGET_PREFIX}#{segment}"]
         [writers, wildcard].any? do |paths|
           paths&.any? { |path| !listed.include?(File.absolute_path(path)) }
         end
@@ -2560,13 +2668,18 @@ module Rigor
         @pre_analysis_plugin_rows ||= plugin_boundary_rows
         reads = []
         diagnostics = nil
-        record = Plugin::IoBoundary.attributing(reads) do
-          DependencyRecorder.record_for(path) do
-            diagnostics = analyze_with_effects(path, environment)
+        record = nil
+        # Issue #2020 — and every run-scoped row its analysis registered, with the registering plugins' reads.
+        disclosures = RunDisclosureCredit.collect do
+          record = Plugin::IoBoundary.attributing(reads) do
+            DependencyRecorder.record_for(path) do
+              diagnostics = analyze_with_effects(path, environment)
+            end
           end
         end
         @file_dependencies[path] = record
         @analysis_reads[path] = reads unless reads.empty?
+        @analysis_disclosures[path] = disclosures unless disclosures.empty?
         diagnostics
       end