rigortype 0.4.5 → 0.4.7

data/lib/rigor/analysis/self_call_resolution_recorder.rb

@@ -18,7 +18,7 @@ module Rigor
     # recompute" lesson applied to self-calls.
     #
     # ADR-24 slice 4 (`call.self-undefined-method`) consumes the recorded misses behind a confidently-closed-class
-    # gate (see `CheckRules` L775). The rule ships `:off` by default — {active?} is false on a normal run, so
+    # gate (see `CheckRules`). The rule ships `:off` by default — {active?} is false on a normal run, so
     # the instrumented choke-point pays a single integer read and records nothing. Recording is purely
     # observational; it never changes a diagnostic.
     #

data/lib/rigor/analysis/template_unit_positions.rb

@@ -173,9 +173,8 @@ module Rigor
       # copies one tag body once, and the second `@author` is the same copy seen from the other end, not a
       # second reading. Only a node OUTSIDE the winning run's own compiled span counts, which is what keeps
       # the busy lines of a real view answerable while the cross-tag repeat (`<%= v %> <%= v.to_s %>`, or
-      # `<%= v %><%= "v" %>` probed at the STRING's `v`) still declines — the family a plugin-exported tag
-      # span would answer instead
-      # (see the PR), and the follow-up this rule is deliberately conservative ahead of.
+      # `<%= v %><%= "v" %>` probed at the STRING's `v`) still declines. That family is what a plugin-exported
+      # tag span would answer instead, and it is the follow-up this rule is deliberately conservative ahead of.
       #
       # `spill` is the nearest NON-BLANK compiled line above this template line's own, where a hoisted
       # leading-text literal lives. Only a string literal the run does NOT contain counts there. A code

data/lib/rigor/analysis/template_units.rb

@@ -189,6 +189,15 @@ module Rigor
         @entries.keys.sort
       end
 
+      # Issue #2233 — whether a plugin claims `path` by one of its `template_globs:`, in any spelling a caller holds it
+      # (absolute, `./`-prefixed, relative). A claimed template is analysed as a unit, never as a plain `.rb` file, so
+      # the runner keeps the buffer's logical path out of the `.rb` targets, so it is not analysed twice.
+      def claims?(path)
+        return false if @claimed_globs.empty?
+
+        TemplateUnitPaths.claims?(@claimed_globs, TemplateUnitPaths.relative(path, @root))
+      end
+
       def [](path)
         entry_for(path)
       end
@@ -293,7 +302,6 @@ module Rigor
         [entry.locals.keys.map(&:to_sym)]
       end
 
-      # The `view:<logical_name>` effect-unit key for a path, or nil.
       # The file whose bytes a unit's path was READ from: the editor's buffer when one is bound to it, the
       # project file otherwise. Read by the run's dependency descriptor, so it digests what the run read.
       def physical_path(path, buffer)

data/lib/rigor/analysis/worker_session.rb

@@ -20,10 +20,12 @@ require_relative "../inference/method_dispatcher/file_folding"
 require_relative "check_rules"
 require_relative "crash_signature"
 require_relative "dependency_recorder"
+require_relative "run_disclosure_credit"
 require_relative "dependency_source_inference"
 require_relative "diagnostic"
 require_relative "erb_template_detector"
 require_relative "template_units"
+require_relative "runner/run_level_facts"
 
 module Rigor
   module Analysis
@@ -38,8 +40,8 @@ module Rigor
     # - `configuration` — Phase 2a ({Rigor::Configuration} is `Ractor.shareable?`).
     # - `cache_store` — the fork backend passes the parent runner's pre-built Store (`cache_store:
     #   @cache_store` in PoolCoordinator); workers share it rather than building their own at `cache_root`.
-    # - `plugin_blueprints` — Phase 3a (`Array<Plugin::Blueprint>` is `Ractor.shareable?`).
-    # - `explain` — Boolean.
+    # - `plugin_blueprints` — Phase 3a (a list of `Plugin::Blueprint` is `Ractor.shareable?`).
+    # - `explain` — a flag.
     # - `synthetic_method_index` / `project_patched_methods` / `project_scope_seed` — optional (default `nil`
     #   / `{}`). NOT `Ractor.shareable?` (the seed tables carry Prism def nodes), so the Ractor pool path
     #   leaves them unset; the fork backend (ADR-15 Amendment), which builds the session pre-fork on the
@@ -108,7 +110,7 @@ module Rigor
         # above: a worker and the parent agree without a flag to keep in sync.
         @effect_attribution = Effects::Attribution.build(configuration.effects_attribution)
         @file_effects = {}
-        # ADR-32 WD4 — full project file list (frozen Array<String>) for env-build-time invocation of any
+        # ADR-32 WD4 — full project file list (frozen) for env-build-time invocation of any
         # loaded plugin's `source_rbs_synthesizer` callable.
         @source_files = source_files
         # #392 — the run's template units, synthesised on the PARENT before the fork and inherited here as
@@ -161,7 +163,7 @@ module Rigor
       end
 
       # Equivalent of {Rigor::Analysis::Runner#analyze_file} + `plugin_emitted_diagnostics` +
-      # `explain_diagnostics`. Returns a flat `Array<Diagnostic>` for the file. Severity profile re-stamping
+      # `explain_diagnostics`. Returns a flat list of diagnostics for the file. Severity profile re-stamping
       # is intentionally NOT applied — that is a per-run aggregate concern handled by the caller. When
       # `record_dependencies:` was set, wraps the analysis in a {DependencyRecorder} window (ADR-46) so the
       # worker captures the file's cross-file reads for {#drain_dependencies}; the recorder's own disabled
@@ -171,12 +173,17 @@ module Rigor
 
         diagnostics = nil
         reads = []
-        record = Plugin::IoBoundary.attributing(reads) do
-          DependencyRecorder.record_for(path) { diagnostics = analyze_with_effects(path) }
+        record = nil
+        # Issue #2020 — and the run-scoped rows it registered, as `Runner#analyze_file` keeps them.
+        disclosures = RunDisclosureCredit.collect do
+          record = Plugin::IoBoundary.attributing(reads) do
+            DependencyRecorder.record_for(path) { diagnostics = analyze_with_effects(path) }
+          end
         end
         @file_dependencies[path] = record
         # Issue #1553 — the plugin reads this file's analysis made, as `Runner#analyze_file` keeps them.
         (@analysis_reads ||= {})[path] = reads unless reads.empty?
+        (@analysis_disclosures ||= {})[path] = disclosures unless disclosures.empty?
         diagnostics
       end
 
@@ -265,7 +272,7 @@ module Rigor
       # definition and never enters the failing build; a diagnostic wired off the parent's loader would
       # appear at `--workers=0` and vanish at `--workers=N`, which is the same "reports less depending on
       # how you ran it" defect the diagnostic exists to end. Draining it out of the workers is what makes
-      # the two paths say the same thing. The payload is `[String, String, String, Array<String>]` tuples —
+      # the two paths say the same thing. The payload is a list of plain tuples —
       # Marshal-clean for the fork backend and shareable for the Ractor one.
       #
       # Issue #784 — `hkt_scan_failure` rides the same channel for the same reason: the PARENT's own
@@ -278,33 +285,25 @@ module Rigor
       # project whose `sig/` produced a single such event killed each worker HERE — after its files were
       # analysed — and the run degraded to in-process re-analysis with a `pool-degraded` row. All three
       # streams now carry `(path, line, column)` primitives.
+      #
+      # ADR-116 WD3 (#1195) — both halves are declared rather than listed here: each reporter snapshots its
+      # own streams ({Runner::RunLevelFacts::REPORTERS}), and the `:analysis` facts come from
+      # {Runner::RunLevelFacts.drain}, the same read the coordinator makes of an environment it analysed on.
+      # The facts are read first: their HKT demand (#784, made once per worker so a worker whose share of
+      # files demanded nothing still reports the run's outcome) is what fills the hkt-directive stream (#785).
+      # On a worker that analysed a file the demand is a memoised read; the fork backend never hands a worker
+      # an empty slice, so no idle worker pays the env load.
       def drain_reporters
-        # Issue #784 — demand the registry once per worker before reading the slot, so a worker whose share
-        # of files happened to contain no `Klass.method` call still reports the run's outcome (the same
-        # reason `PoolCoordinator#hkt_scan_outcome` demands it on the sequential path). The Environment
-        # object is built in the constructor, but its RBS env is lazy: on a worker that analysed a file this
-        # is a memoised read; on one that demanded nothing it is the same cache-served env load that file
-        # would have paid. The fork backend never hands a worker an empty slice, so no idle worker pays it.
-        @environment&.hkt_registry
-        {
-          rbs_extended: {
-            unresolved_payloads: @rbs_extended_reporter.unresolved_payloads,
-            lossy_projections: @rbs_extended_reporter.lossy_projections,
-            # Issue #785 — the HKT directive stream rides the same channel for the same reason
-            # `hkt_scan_failure` does: the directives are read by the registry scan, and under the pool the
-            # PARENT never demands that scan, so a diagnostic wired off the parent's reporter would appear
-            # at `--workers=0` and vanish at `--workers=N`. The demand above is what fills this.
-            hkt_directive_errors: @rbs_extended_reporter.hkt_directive_errors,
-            # ADR-109 WD3 — the deprecated-form stream rides the same channel: the payload is read where
-            # the annotated method is dispatched, which under the pool is only ever inside a worker.
-            deprecated_forms: @rbs_extended_reporter.deprecated_forms
-          },
-          boundary_cross: @boundary_cross_reporter.entries,
-          source_rbs_synthesis: @source_rbs_synthesis_reporter.entries,
-          definition_build_failures: @environment&.rbs_loader&.definition_build_failures || [],
-          hkt_scan_failure: @environment&.hkt_scan_failure
-        }
+        facts = Runner::RunLevelFacts.drain(@environment)
+        Runner::RunLevelFacts.snapshot_reporters(reporters).merge(facts)
+      end
+
+      # The per-worker reporter accumulators, by {Runner::RunLevelFacts::REPORTERS} key.
+      def reporters
+        { rbs_extended: @rbs_extended_reporter, boundary_cross: @boundary_cross_reporter,
+          source_rbs_synthesis: @source_rbs_synthesis_reporter }
       end
+      private :reporters
 
       # ADR-46 — the per-file {DependencyRecorder::Record}s captured by this session's `#analyze` calls (empty
       # unless `record_dependencies:` was set). Marshal-clean (Data of frozen Sets / String Hashes), so the
@@ -320,6 +319,12 @@ module Rigor
         @analysis_reads || {}
       end
 
+      # Issue #2020 — the run-scoped rows each file's analysis registered, `{path => [record]}`; see
+      # {RunDisclosureCredit}. Marshal-clean like {#drain_run_disclosures}.
+      def drain_analysis_disclosures
+        @analysis_disclosures || {}
+      end
+
       # ADR-103 WD12 — the per-file {Effects::FileCollection}s this session collected (empty unless the
       # configuration carries an `effects:` block). Marshal-clean by construction — frozen Hashes of
       # Strings, `LabelSet`s of frozen Arrays, and `Data` edges — so the fork pool ships them back to the
@@ -445,7 +450,7 @@ module Rigor
         return nil if gem_name.nil? || gem_name.empty?
 
         spec = Gem.loaded_specs[gem_name]
-        spec&.full_gem_path # rigor:disable undefined-method
+        spec&.full_gem_path
       rescue StandardError
         nil
       end

data/lib/rigor/bleeding_edge.rb

@@ -9,11 +9,9 @@ module Rigor
   # *today's* rules are) and is versioned with the gem, NOT a user-supplied file: the
   # inspectable counterpart to PHPStan's `bleedingEdge` include.
   #
-  # The WD2 foundation slice wired the surface end-to-end (`bleeding_edge:` config, the
-  # `rigor show-bleedingedge` command, the severity-composition hook in
-  # {Configuration::SeverityProfile.resolve}), so a *severity* discipline lands as a single
-  # {FEATURES} entry with no engine plumbing — as the first one,
-  # `reject-unparseable-signatures`, does.
+  # The surface is wired end-to-end (`bleeding_edge:` config, `rigor show-bleedingedge`, the
+  # severity-composition hook in {Configuration::SeverityProfile.resolve}), so a *severity*
+  # discipline is a single {FEATURES} entry with no engine plumbing.
   #
   # A queued change whose effect is not a severity move — a measurement, an algorithm, or a
   # default that changes while every rule keeps its severity — is a `:behaviour` feature
@@ -40,7 +38,6 @@ module Rigor
     # {Configuration#bleeding_edge_active?}.
     KINDS = %i[severity behaviour].freeze
 
-    # The severity map a `:behaviour` feature carries: none.
     NO_SEVERITY_OVERRIDES = {}.freeze
 
     # One queued change.

data/lib/rigor/builtins/imported_refinements.rb

@@ -113,9 +113,8 @@ module Rigor
         },
         # ADR-13 § "Canonical type-function additions" — five shape-projection type functions
         # that the `rigor-typescript-utility-types` plugin (and any other plugin that ships a
-        # shape-projection vocabulary) maps onto. Phase A handles `HashShape` carriers;
-        # non-shape inputs return the input unchanged (the lossy-projection diagnostic lands
-        # in slice 5).
+        # shape-projection vocabulary) maps onto. Non-shape inputs return the input unchanged;
+        # the Resolver records `dynamic.shape.lossy-projection` for them.
         "pick_of" => lambda { |args|
           return nil unless args.size == 2
 
@@ -148,7 +147,7 @@ module Rigor
       # `Class[range]` — a numeric class head bounded by a Ruby range literal (ADR-109). The
       # builder receives the `Range` value and returns the carrier, or `nil` when the range is
       # empty or its endpoints are not literals of the head class; `nil` surfaces as the ordinary
-      # unresolved-payload diagnostic. `Float` joins this table with the `FloatRange` carrier.
+      # unresolved-payload diagnostic. `Float` builds a `FloatRange` carrier.
       RANGE_HEAD_BUILDERS = {
         "Integer" => lambda { |range|
           lo = range.begin
@@ -186,8 +185,7 @@ module Rigor
       # `Array<Integer>` and returns a `Rigor::Type` (or `nil`). Bounds are signed integer
       # literals. A reversed pair (`min` > `max`) is declined as `nil` like every other shape
       # mismatch, so the caller surfaces `dynamic.rbs-extended.unresolved` at the annotation;
-      # `Type::IntegerRange` raises on it instead, and that `ArgumentError` used to escape as an
-      # `internal analyzer error` that abandoned the whole Ruby file.
+      # `Type::IntegerRange` would raise on it instead, which must not escape the analyzer.
       PARAMETERISED_INT_BUILDERS = {
         "int" => lambda { |bounds|
           return nil unless bounds.size == 2
@@ -276,14 +274,14 @@ module Rigor
       # grammar:
       #
       #   type        := simple_name | parametric
-      #   simple_name := /[a-z][a-z0-9-]*/
+      #   simple_name := /[a-z][a-z0-9_-]*/
       #   parametric  := simple_name '[' type_arg_list ']'
       #                | simple_name '<' int_bound_list '>'
       #   type_arg_list := type_arg (',' type_arg)*
       #   type_arg    := range_literal | type | class_name
       #   class_name  := /[A-Z][A-Za-z0-9_]*(?:::[A-Z][A-Za-z0-9_]*)*/
       #   range_literal := endpoint? ('..' | '...') endpoint?     (at least one side written)
-      #   endpoint    := signed_int | 'nil'
+      #   endpoint    := signed_int | float_literal | 'nil' | 'Float::INFINITY' | 'Float::MAX'
       #   int_bound_list := signed_int (',' signed_int)*
       #   signed_int  := /-?\d+/
       #

data/lib/rigor/builtins/predefined_constant_refinements.rb

@@ -62,7 +62,7 @@ module Rigor
     # `RBS::VERSION` while Rigor checks itself, rubygems and Bundler internals while it checks
     # CRuby's `lib/` — and that is worse than no answer: identical source would type differently
     # depending on how the analyzer was installed. Removing an ad hoc `Object.const_get` from an
-    # analysis path is the same move ADR-4 § 330 already made for predicate narrowing.
+    # analysis path is the same move ADR-4 already made for predicate narrowing.
     #
     # This module is consulted by `Environment#constant_for_name` BEFORE the RBS
     # constant-type table (widest types) but AFTER in-source constant writes (the user's own

data/lib/rigor/builtins/regex_refinement.rb

@@ -8,13 +8,11 @@ module Rigor
     # carriers Rigor already ships (`decimal-int-string`, `hex-int-string`,
     # `octal-int-string`, `lowercase-string`, `uppercase-string`, `numeric-string`). See
     # `docs/type-specification/imported-built-in-types.md` for the registry the refinements
-    # come from and `docs/ROADMAP.md` § "v0.1.1 — Planned" Track 1 slice 1 for the binding
-    # scope of this recogniser.
+    # come from.
     #
-    # The intended consumer is `Inference::Narrowing.analyse_match_write`: given `if
-    # /(?<year>\d+)/ =~ str; year; end`, the v0.1.0 baseline narrows `year` to plain `String`;
-    # v0.1.1 introspects the regex source and narrows further to `decimal-int-string`
-    # whenever the named-capture body matches one of the rows in {RULES}.
+    # The consumer is `Inference::Narrowing.analyse_match_write`: given `if /(?<year>\d+)/ =~ str;
+    # year; end`, `year` narrows to `decimal-int-string` when the named-capture body matches a row
+    # in {RULES}, and stays plain `String` otherwise.
     #
     # Recognised body shapes (each row admits the `+` quantifier and the bounded `{n}` /
     # `{n,m}` forms with `n >= 1`):

data/lib/rigor/cache/descriptor.rb

@@ -10,7 +10,8 @@ module Rigor
   module Cache
     # Cache invalidation descriptor — the typed-slot schema fixed by
     # [`docs/design/20260505-cache-slice-taxonomy.md`](../../../docs/design/20260505-cache-slice-taxonomy.md).
-    # Pure value object: no I/O, no global state, fully immutable after construction. The storage layer
+    # Value object, fully immutable after construction. Filesystem reads happen only in the `FileEntry.stat`,
+    # `FileEntry.kind` and `GlobEntry.compute` builders and in {#fresh?}. The storage layer
     # ([`Rigor::Cache::Store`](store.rb), v0.0.8 slice 2) consumes descriptors but does not extend them.
     #
     # The descriptor has six slots (`files`, `gems`, `plugins`, `configs`, `dependencies`, `globs`); every slot is
@@ -462,10 +463,10 @@ module Rigor
 
       # ADR-45 — re-validates this descriptor's recorded {FileEntry}s against the current filesystem. Used by
       # the record-and-validate run-result cache: a value cached alongside its dependency descriptor is fresh
-      # iff every recorded file still matches. Only `files` are checked — non-file inputs (config / gems /
+      # iff every recorded file still matches. Only `files` and `globs` are checked — non-file inputs (config / gems /
       # version) belong in the cache *key*, not the validated dependency set — so a descriptor carrying any
       # non-file slot is never considered fresh (it was built wrong for this use). ADR-60 WD3 adds `globs`
-      # alongside `files` as a re-validatable slot: a {GlobEntry} is fresh when re-globbing + re-digesting
+      # alongside `files` as a re-validatable slot: a {GlobEntry} is fresh when re-globbing
       # reproduces its recorded value. ADR-45 WD1 (#577): an absence row ({FileEntry.absent}) is fresh
       # while its path is still missing — the negative half of the dependency set.
       def fresh?
@@ -581,8 +582,8 @@ module Rigor
         false
       end
 
-      # ADR-60 WD3 / ADR-87 WD2 — stat-validates the entry's per-file table against the live tree, re-hashing
-      # only stat-moved files. Any failure reads as stale (recompute), never a crash.
+      # ADR-60 WD3 / ADR-87 WD2 — recomputes the entry's signature over the live tree and compares it. Any
+      # failure reads as stale (recompute), never a crash.
       def glob_entry_fresh?(entry)
         GlobEntry.fresh?(entry)
       end

data/lib/rigor/cache/incremental_snapshot.rb

@@ -8,6 +8,7 @@ require_relative "engine_source"
 require_relative "store"
 require_relative "../analysis/shadow_harness"
 require_relative "../analysis/run_cache_key"
+require_relative "../analysis/runner/run_level_facts"
 require_relative "../environment"
 require_relative "../analysis/path_expansion"
 require_relative "../rooted_glob"
@@ -182,20 +183,39 @@ module Rigor
       # 41: issue #1583 — the payload gains `discovery_digests`, the packed digest of each file a run over path
       # arguments discovered without analysing, which a recheck compares to re-baseline when one moved. A pre-41
       # blob carries none; the gate rejects it and the next run is cold.
-      SCHEMA = 41
+      # 42: issue #2184 — a `deferred_ranges` row for a `def` inside a block now carries the method's name, and a
+      # literal-named `define_method` / `define_singleton_method` call adds a row. A pre-42 bundle carries neither,
+      # so a warm run would report a top-level block call that a cold run declines.
+      # 43: issue #2020 — the payload gains `plugin_disclosures`, the run-scoped plugin rows each analysed file's
+      # last analysis registered, which a recheck replays for the files it serves. A pre-43 blob carries none, so
+      # its rechecks would drop every such row; the gate rejects it and the next run is cold.
+      # 44: PR #2286 review M1 — the payload gains `synthetic_surface_digest`, the ADR-16 synthetic-method index's
+      # {Rigor::Inference::SyntheticMethodIndex#surface_digest} at the run the cache was built under, which a recheck
+      # compares to re-baseline when a class-body DSL edit moved it. A pre-44 blob carries none; the gate rejects it
+      # and the next run is cold.
+      # 45: issue #1154 — each seed bundle's `global_write_census` also records the ivar writers the declared-parameter
+      # credit reads (`[:ivar_set, name]`, `[:ivar_set_class, class]`, `[:own_write, class, name, path]`), which a
+      # pre-45 bundle carries none of, so a warm run would credit an ivar write a cold run declines.
+      # 46: issue #2314 — each seed bundle's `global_write_census` also records the global writers
+      # (`[:global_writer, name, method]`) the statement walk reads past a call; a pre-46 bundle carries none, so a
+      # warm run would keep a global's binding a cold run forgets.
+      # 47: issues #2079 / #2170 — each seed bundle's `global_write_census` also records each instance-side ivar
+      # write's coarse value (`[:own_write_type, class, name, value, path]`), which the class-ivar census joins across
+      # files and along the chain; a pre-47 bundle carries none, so a warm run would keep a seed a cold run widens.
+      SCHEMA = 47
 
       # The persisted per-file state.
       # `cache` maps an analyzed file to its diagnostics.
-      # `sources` maps a consumer to the Set of source files it read from.
+      # `sources` maps a consumer to the source files it read from.
       # `digests` maps a file to its content digest at analysis time.
       # `analyzed` is the ordered analyzed-file list.
       # ADR-46 slice 4:
-      # `symbol_sources` maps a consumer to { source_path → Set<"ClassName#method"> }.
-      # `ancestry_sources` maps a consumer to Set<source_path> (class-ancestry deps).
+      # `symbol_sources` maps a consumer to { source_path → the "ClassName#method" names it read }.
+      # `ancestry_sources` maps a consumer to the source paths it read for class ancestry.
       # `symbol_fingerprints` maps a path to { "ClassName#method" => sha256_hex }.
       # ADR-46 slice 3:
-      # `missing` maps a consumer to Set<"kind:name"> it looked up and missed.
-      # `class_decls` maps a path to Set<qualified class name> it declares.
+      # `missing` maps a consumer to the "kind:name" keys it looked up and missed.
+      # `class_decls` maps a path to the qualified class names it declares.
       # Issue #644:
       # `constant_decls` maps a path to that file's constant PUBLICATION CENSUS,
       # `{qualified name => [literal] | :unpublishable}`. The descriptor is what the recheck diffs: a name's
@@ -244,26 +264,36 @@ module Rigor
       # `effect_collections` (nil when collection was off). A plugin stamps its attributions and edges into a file's
       # collection, and `effects_identity` is plugin-blind (it is compared before any plugin loads), so the session
       # compares this one after the recheck has loaded them.
+      # Issue #2020 — `plugin_disclosures` is {Analysis::RunDisclosureLedger#to_h}: `files`, each analysed file's
+      # run-scoped plugin rows ({Plugin::Base#disclose_once} / {Plugin::Base#emit_once}) from its last analysis, which a
+      # recheck replays for the files it serves, and `reads`, the boundary rows per `[plugin id, key]` that make one
+      # stale.
       Payload = Data.define(:cache, :sources, :digests, :analyzed,
                             :symbol_sources, :ancestry_sources, :symbol_fingerprints,
                             :missing, :class_decls, :constant_decls, :seed_bundles, :plugin_fact_digest,
                             :return_summaries, :param_table,
                             :effect_collections, :effects_identity, :run_level_rows,
-                            :effect_plugin_digest, :plugin_reads, :discovery_digests) do
+                            :effect_plugin_digest, :plugin_reads, :discovery_digests, :plugin_disclosures,
+                            :synthetic_surface_digest) do
         # `effect_plugin_digest` defaults to nil so a payload built without it (an older caller, a spec fixture)
         # reads as "unknown", which the session treats as moved. `plugin_reads` defaults to no reads, and
-        # `discovery_digests` to no discovery-only files.
-        def initialize(effect_plugin_digest: nil, plugin_reads: {}, discovery_digests: {}, **rest)
+        # `discovery_digests` to no discovery-only files, and `plugin_disclosures` (#2020) to no replayed rows.
+        # `synthetic_surface_digest` defaults to nil, the empty index's digest: a run that builds a non-empty one
+        # reads it as moved.
+        def initialize(effect_plugin_digest: nil, plugin_reads: {}, discovery_digests: {}, plugin_disclosures: {},
+                       synthetic_surface_digest: nil, **rest)
           super
         end
       end
 
-      # Issues #796 / #794 — the two run-level rows the snapshot carries. `definition_build_failures` is the
-      # reported per-class detail list ({Environment::RbsLoader#definition_build_failures}); `hkt_scan_failure`
-      # is the `[error_class, first_line, frame, stage]` tuple ({Rigor::Environment#hkt_scan_failure}), nil
-      # when the scan succeeded — which is why the presence of this object, not the tuple, is what says a
-      # replay is available.
-      RunLevelRows = Data.define(:definition_build_failures, :hkt_scan_failure)
+      # Issues #796 / #794 — the run-level rows the snapshot carries: one member per run-level fact declared
+      # `replay` ({Analysis::Runner::RunLevelFacts}, ADR-116 WD3). Today that is `definition_build_failures`,
+      # the reported per-class detail list ({Environment::RbsLoader#definition_build_failures}), and
+      # `hkt_scan_failure`, the `[error_class, first_line, frame, stage]` tuple
+      # ({Rigor::Environment#hkt_scan_failure}), nil when the scan succeeded — which is why the presence of
+      # this object, not the tuple, is what says a replay is available. Declaring another fact `replay`
+      # changes this shape, so it bumps {SCHEMA}.
+      RunLevelRows = Data.define(*Analysis::Runner::RunLevelFacts.replayable_names)
 
       # The global fingerprint that gates a snapshot load: a digest of the inputs whose change requires a full
       # rebuild — the engine version + schema, the engine's own SOURCE when the version does not pin it, the
@@ -303,6 +333,7 @@ module Rigor
           "sig:#{digest_signature_paths(project_sig_roots(configuration))}",
           "pre_eval:#{digest_pre_eval(configuration.pre_eval)}"
         ]
+        parts.concat(core_root_parts(configuration))
         parts.concat(dependency_source_parts(configuration))
         identity = EngineSource.process_identity
         parts << "engine-source:#{identity}" if identity
@@ -326,6 +357,15 @@ module Rigor
         nil
       end
 
+      # Issue #2517 — a selected core is read like the project's own `sig/`, so an edit in place to one of its files
+      # must drop the snapshot (and the language server's session, which keys on this fingerprint). No part for the
+      # default core, so every other project's fingerprint is as it was.
+      def self.core_root_parts(configuration)
+        core_root = configuration.core_root
+        core_root.nil? ? [] : ["core:#{digest_signature_paths([core_root])}"]
+      end
+      private_class_method :core_root_parts
+
       def self.required_features(configuration, roots)
         files = Analysis::PathExpansion.ruby_files(roots, configuration.exclude_patterns,
                                                    base: configuration.exclude_base)
@@ -465,7 +505,9 @@ module Rigor
           run_level_rows: data[:run_level_rows],
           effect_plugin_digest: data[:effect_plugin_digest],
           plugin_reads: data[:plugin_reads] || {},
-          discovery_digests: data.fetch(:discovery_digests, {})
+          plugin_disclosures: data.fetch(:plugin_disclosures, {}),
+          discovery_digests: data.fetch(:discovery_digests, {}),
+          synthetic_surface_digest: data[:synthetic_surface_digest]
         )
       end
       private :payload_from
@@ -492,8 +534,8 @@ module Rigor
           effects_identity: payload.effects_identity,
           run_level_rows: payload.run_level_rows,
           effect_plugin_digest: payload.effect_plugin_digest,
-          plugin_reads: payload.plugin_reads,
-          discovery_digests: payload.discovery_digests
+          plugin_reads: payload.plugin_reads, plugin_disclosures: payload.plugin_disclosures,
+          discovery_digests: payload.discovery_digests, synthetic_surface_digest: payload.synthetic_surface_digest
         )
         # #1507 — every `--incremental` run that analysed anything rewrites this whole blob, so its deflate is
         # on the edit path; see {Store::DEFLATE_LEVEL}.

data/lib/rigor/cache/rbs_cache_producer.rb

@@ -6,8 +6,8 @@ module Rigor
   module Cache
     # Base for the RBS-derived cache producers.
     #
-    # Every producer (`RbsKnownClassNames`, `RbsConstantTable`, `RbsEnvironment`, the ancestor / type-param /
-    # definition tables, …) repeated the identical `fetch` wiring: build the RBS descriptor, then
+    # Every producer (`RbsKnownClassNames`, `RbsConstantTable`, `RbsEnvironment`, the ancestor / type-param
+    # tables, …) repeated the identical `fetch` wiring: build the RBS descriptor, then
     # `store.fetch_or_compute` under the producer's id, yielding to the producer's `compute`. Only the
     # `PRODUCER_ID` constant and the `compute(loader)` body actually differ between producers.
     #

data/lib/rigor/cache/rbs_class_ancestor_table.rb

@@ -6,7 +6,7 @@ require_relative "rbs_cache_producer"
 module Rigor
   module Cache
     # Cache producer that materialises the RBS-declared ancestor chain of every loaded class / module into a
-    # Marshal-clean `Hash<String, Array<String>>`. Ancestor names are top-level-stripped (e.g. `"Integer"` not
+    # Marshal-clean table. Ancestor names are top-level-stripped (e.g. `"Integer"` not
     # `"::Integer"`) to match `Environment::RbsHierarchy#normalize_name`.
     #
     # The hierarchy is the substrate behind every `class_ordering` query, which is itself a hot path on the

data/lib/rigor/cache/rbs_class_type_param_names.rb

@@ -6,8 +6,8 @@ require_relative "rbs_cache_producer"
 module Rigor
   module Cache
     # Cache producer that materialises every loaded class's RBS-declared type-parameter names as a
-    # Marshal-clean `Hash<String, Array<Symbol>>` keyed by top-level-stripped class name (e.g. `"Array"` →
-    # `[:Elem]`, `"Hash"` → `[:K, :V]`). Producer id `"rbs.class_type_param_names"`.
+    # Marshal-clean table keyed by top-level-stripped class name (e.g. `"Array"` →
+    # `[:Elem]`, `"Hash"` → `[:K, :V]`).
     #
     # The dispatcher reads type-parameter names every time it builds a substitution map from a receiver's
     # `type_args` into a method's return type — it is one of the hottest reflection lookups during analysis.

data/lib/rigor/cache/rbs_constant_table.rb

@@ -6,7 +6,7 @@ require_relative "rbs_cache_producer"
 module Rigor
   module Cache
     # Cache producer that materialises every RBS-declared constant to its translated `Rigor::Type` form and
-    # stores the result as a `Hash<String, Rigor::Type>` keyed by canonical constant name. This is the v0.0.8
+    # stores the result as a table keyed by canonical constant name. This is the v0.0.8
     # first cached producer per ADR-6 § 7; it caches a post-translation artefact so the cache value is
     # `Marshal`-clean (RBS-native objects carry `RBS::Location`, which lacks `_dump_data`).
     #

data/lib/rigor/cache/rbs_descriptor.rb

@@ -77,9 +77,57 @@ module Rigor
       # reconstructs {.config_entries} without loading a plugin, so an entry there that it cannot rebuild
       # would turn the warm fast lane into a permanent miss on every project that enables a bundled plugin.
       def self.env_only_config_entries(loader)
-        [deferred_signature_paths_entry(loader)].compact
+        [deferred_signature_paths_entry(loader), project_signature_paths_entry(loader), core_root_entry(loader)].compact
       end
 
+      # Issue #2517 — which directory the env loaded core from. The selected core's files are digested by
+      # {.file_entries} too, so this row is the identity of the choice and those rows its contents: switching
+      # between two roots with byte-identical files still re-keys. Absent for the default core, whose identity
+      # is the `rbs` gem row, so every project without the setting keeps its key.
+      def self.core_root_entry(loader)
+        core_root = selected_core_root(loader)
+        return nil if core_root.nil?
+
+        Descriptor::ConfigEntry.new(key: "rbs.core_root", value_hash: Digest::SHA256.hexdigest(core_root.to_s))
+      end
+
+      private_class_method :core_root_entry
+
+      # The loader's issue #2517 core root as a Pathname, or nil for the default core.
+      def self.selected_core_root(loader)
+        core_root = loader.respond_to?(:core_root) ? loader.core_root : nil
+        core_root.nil? ? nil : Pathname(core_root)
+      end
+
+      private_class_method :selected_core_root
+
+      # {.selected_core_root} as the signature roots it adds: none for the default core.
+      def self.core_root_dirs(loader)
+        core_root = selected_core_root(loader)
+        core_root.nil? ? [] : [core_root]
+      end
+
+      private_class_method :core_root_dirs
+
+      # Issue #2422 — which of the loader's `signature_paths:` are the project's own changes the env built from
+      # byte-identical files: a bundled plugin's method composes with another source's as an overload, but stands
+      # down to the project's own. Only read when a plugin defers signatures, so a project without one keeps its
+      # key.
+      def self.project_signature_paths_entry(loader)
+        return nil unless loader.respond_to?(:project_signature_paths) && loader.respond_to?(:deferred_signature_paths)
+        return nil if Array(loader.deferred_signature_paths).empty?
+
+        own = Array(loader.project_signature_paths).map(&:to_s).sort
+        return nil if own.empty?
+
+        Descriptor::ConfigEntry.new(
+          key: "rbs.project_signature_paths",
+          value_hash: Digest::SHA256.hexdigest(own.join("\n"))
+        )
+      end
+
+      private_class_method :project_signature_paths_entry
+
       def self.deferred_signature_paths_entry(loader)
         return nil unless loader.respond_to?(:deferred_signature_paths)
 
@@ -104,7 +152,9 @@ module Rigor
       #   value must be deterministic; `:stat` (ADR-87 WD1) for the validation-only run-dependency descriptor
       #   ({RunDescriptor#files}), where the stat tier short-circuits the SHA-256 on an unmoved file.
       def self.file_entries(loader, comparator: :digest)
-        roots = loader.signature_paths +
+        # Issue #2517 — a selected core is project input like `signature_paths:`, not the engine-versioned `rbs`
+        # gem tree, so an edit in place must move the key.
+        roots = core_root_dirs(loader) + loader.signature_paths +
                 Rigor::Environment::RbsLoader.vendored_gem_sig_paths +
                 Rigor::Environment::RbsLoader.core_overlay_sig_paths +
                 Rigor::Environment::RbsLoader.capability_role_sig_paths
@@ -149,7 +199,8 @@ module Rigor
       def self.glob_entries(loader)
         # Deduplicated by path: a root reachable twice (an explicit `signature_paths:` entry that is also a
         # bundled plugin's `sig/`, #610) would otherwise contribute two rows whose stat signatures race.
-        loader.signature_paths.uniq(&:to_s).filter_map do |root|
+        # Issue #2517 — and the selected core's root, where a file appearing is as much a new input.
+        (core_root_dirs(loader) + loader.signature_paths).uniq(&:to_s).filter_map do |root|
           next unless root.directory?
 
           Descriptor::GlobEntry.compute(root: root.to_s, pattern: File.join("**", "*.rbs"), mode: :names)

data/lib/rigor/cache/rbs_environment.rb

@@ -33,7 +33,10 @@ module Rigor
           signature_paths: loader.signature_paths,
           virtual_rbs: loader.respond_to?(:virtual_rbs) ? loader.virtual_rbs : [],
           deferred_signature_paths:
-            loader.respond_to?(:deferred_signature_paths) ? loader.deferred_signature_paths : []
+            loader.respond_to?(:deferred_signature_paths) ? loader.deferred_signature_paths : [],
+          project_signature_paths:
+            loader.respond_to?(:project_signature_paths) ? loader.project_signature_paths : [],
+          core_root: loader.respond_to?(:core_root) ? loader.core_root : nil
         )
       end
 

data/lib/rigor/cache/rbs_environment_marshal_patch.rb

@@ -53,8 +53,8 @@ require_relative "annotation_location"
 #   differently, and only the latter reaches `marshal_load`), so without the bump a stale blob would keep
 #   reporting the moved position indefinitely.
 #
-# Idempotent: the guard checks `method_defined?(:_dump)` so requiring this file twice (or against an upstream
-# rbs that adds Marshal hooks itself) is a no-op.
+# Idempotent: each hook is defined only when `method_defined?` reports it missing, so requiring this file twice
+# (or against an upstream rbs that adds Marshal hooks itself) is a no-op.
 #
 # `RBS::TypeName` / `RBS::Namespace` carry a second, subtler Marshal hazard, introduced by rbs 4.1's
 # flyweight interning (ruby/rbs#2957): both memoise their `#hash` into an `@hash` ivar, and that value is