rigortype 0.4.6 → 0.4.8

data/lib/rigor/analysis/runner.rb

@@ -5,6 +5,7 @@ require "prism"
 require "tmpdir"
 
 require_relative "../environment"
+require_relative "../run_scoped_slots"
 require_relative "../scope"
 require_relative "../cache/store"
 require_relative "../cache/rbs_descriptor"
@@ -63,8 +64,10 @@ module Rigor
 
       # ADR-89 WD2 — bounds on the persisted return summaries (per-def observed call keys, and total defs
       # summarised) so the incremental snapshot stays small. A def observed under more keys than the per-def
-      # cap keeps only the first; a def past the total cap is dropped (its symbol dependents then always
-      # re-check — the conservative direction).
+      # cap keeps none of them (issue #3116): the keys past the cap are unknown, so equal returns at the first
+      # eight prove nothing about the ninth key's reader. A def past the total cap keeps none either. Both are
+      # harvested as nil ({#return_summaries}), which the session stores as no summary at all, so the def's symbol
+      # dependents always re-check — the conservative direction.
       RETURN_SUMMARY_KEYS_PER_DEF = 8
       RETURN_SUMMARY_TOTAL_CAP = 4000
 
@@ -87,11 +90,10 @@ module Rigor
       # forbids Rigor demanding in its place) and the HKT-scan outcome (whose producer is an environment a
       # nothing-changed recheck otherwise has no reason to build). {IncrementalSession} persists what a full
       # run answers here and hands it back to the next narrowed run.
+      #
+      # Which rows those are is declared, not listed: every {RunLevelFacts} fact marked `replay`.
       def run_level_rows
-        Cache::IncrementalSnapshot::RunLevelRows.new(
-          definition_build_failures: @snapshots.definition_build_failures,
-          hkt_scan_failure: @snapshots.hkt_scan_failure
-        )
+        Cache::IncrementalSnapshot::RunLevelRows.new(**@snapshots.to_h.slice(*RunLevelFacts.replayable_names))
       end
 
       # ADR-46 — the per-file cross-file read records this run captured (empty unless
@@ -280,8 +282,7 @@ module Rigor
       # @param explain — surface fail-soft fallback events as `:info` diagnostics.
       # @param cache_store — the persistent cache the runner exposes to producers
       #   (`RbsConstantTable` and successors). Pass `nil` to disable caching for this run; the CLI's
-      #   `--no-cache` flag wires `nil` through. v0.0.9 group A slice 1 introduces the surface; later
-      #   slices route real producers through it.
+      #   `--no-cache` flag wires `nil` through.
       # @param workers — ADR-15 Phase 4b — when greater than zero, per-file analysis dispatches
       #   across a pool of N workers. Default `0` keeps the sequential code path bit-for-bit unchanged.
       #   Controlled via the `RIGOR_RACTOR_WORKERS` env var or `.rigor.yml` `parallel.workers:` (Phase 4c,
@@ -352,8 +353,8 @@ module Rigor
         @prebuilt = prebuilt
         @environment_override = environment
         # ADR-46 slice 1 — opt-in cross-file dependency recording. Off by default; when true,
-        # `analyze_file` records each file's cross-file reads into `file_dependencies` (the incremental
-        # cache, a later slice, consumes them).
+        # `analyze_file` records each file's cross-file reads into `file_dependencies`; the incremental
+        # cache consumes them.
         @record_dependencies = record_dependencies
         # ADR-24 slice 4a — opt-in unresolved-implicit-self-call recording. Off by default; when true,
         # `analyze_file` activates the engine choke-point recorder and collects each file's misses into
@@ -513,6 +514,13 @@ module Rigor
         # entry across a run boundary (LSP re-check, ADR-62 warm loop); nil until the first run so
         # runner-less probes keep the per-file fallback.
         @run_generation = nil
+        # The return memo bucket the last `run` filled, kept for {#return_summaries} once the run has released the
+        # thread's slot; nil before the first run.
+        @return_memo = nil
+        # The `[path, node_id] => Prism::DefNode` table the last `run`'s {Inference::DefNodeResolver} filled, kept for
+        # the same reader.
+        @resolved_def_nodes = nil
+        @probe_reads = {}.freeze
         build_collaborators
       end
 
@@ -526,6 +534,9 @@ module Rigor
       # errors. The Environment is built once at run start through `Environment.for_project` so all files
       # share the same RBS load.
       def run(paths = @configuration.paths)
+        # ADR-129 WD5 (#2785) — a mismatch left on the thread by typing after an earlier run (its return summaries, a
+        # language-server hover) fails here rather than reaching this run's first file as a crash row.
+        Inference::MemoAudit.raise_undrained!
         # One per-run file-digest memo spans the whole run, so a path is SHA-256'd at most once across the
         # run-diagnostics dependency descriptor, its `fresh?` validation, the RBS signature tree, and every
         # plugin producer's watched-glob validation (they overlap heavily on the warm path). The nested ADR-85
@@ -534,7 +545,17 @@ module Rigor
         # ADR-87 WD1 — `cache.validation` (or the RIGOR_STRICT_VALIDATION env, which wins) selects the
         # freshness path for this run; the `auto` default resolves strict in CI (#190), stat-first elsewhere.
         Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
-          Inference::DefNodeResolver.with_run { run_analysis(paths) }
+          Inference::DefNodeResolver.with_run do
+            run_analysis(paths)
+          ensure
+            # Issue #3160 — the memo keys an unchanged file's def on the node the resolver minted for its handle.
+            @resolved_def_nodes = Inference::DefNodeResolver.resolved_nodes
+          end
+        ensure
+          # ADR-89 WD2 — {#return_summaries} reads the return memo after the run, so the runner keeps the bucket the
+          # run filled before the thread's run-scoped slots are released (issues #2412, #2399).
+          @return_memo = Inference::ExpressionTyper.current_return_memo
+          RunScopedSlots.release
         end
       end
 
@@ -548,6 +569,21 @@ module Rigor
       end
       private :reset_analysis_attribution
 
+      # Issue #2392 — the sequential half of the per-run reset, beside {#reset_analysis_attribution}: the
+      # dependency graph and per-file effect collections a `--workers 0` run records, and the effect-slot state a
+      # served run leaves behind. The loader is the one that matters: a served run's collections loader would
+      # otherwise feed the next analysing run the previous run's collections. Runs before any `adopt_*`, which the
+      # served lanes call later in the same run, so an adopted slot is this run's own.
+      def reset_sequential_run_tables
+        @file_dependencies = {}
+        @file_effects = {}
+        @cached_effect_sources = nil
+        @cached_effect_ancestry = nil
+        @cached_collections_loader = nil
+        @effects_served_from_cache = false
+      end
+      private :reset_sequential_run_tables
+
       def run_analysis(paths)
         Inference::MethodDispatcher::FileFolding.fold_platform_specific_paths =
           @configuration.fold_platform_specific_paths
@@ -561,6 +597,10 @@ module Rigor
         @project_discovery_expansion = project_discovery_expansion(paths, expansion)
         @discovery_widened = widen_discovery_to_project?(paths)
         @snapshots.reset_for_run
+        # Issue #2392 — the coordinator's run-accumulated tables (disclosures, trust refusals, the dependency and
+        # effect graphs) are per run too: a reused Runner must not re-emit or sum the previous run's rows.
+        @pool_coordinator.reset_for_run
+        reset_sequential_run_tables
         # Per-run reset of the deferred-discovery memo (see `#ensure_project_discovery`).
         @project_discovery_done = false
         # #392 — re-derive the template units each run: their source files can change between two runs of
@@ -762,15 +802,29 @@ module Rigor
       end
 
       # ADR-89 WD2 — the per-method observed-key return summaries the run's ADR-84 return memo just captured.
-      # For each project method with live memo entries, a bounded `{ keys:, returns:, effects: }` summary the
-      # incremental session persists: `keys` the observed `[receiver, arg_types]` type tuples, `returns` their
+      # For each project method the run observed, a bounded `{ keys:, returns:, effects:, guard_constants: }` summary
+      # the incremental session persists: `keys` the observed `[receiver, arg_types]` type tuples, `returns` their
       # `describe(:short)` descriptors, `effects` the content-mutated parameter positions (a caller-visible
-      # arg-flooring surface). Only meaningful right after a run populated the memo (baseline / recheck),
+      # arg-flooring surface), `guard_constants` the published-constant spellings its body reads ({#guard_constants}).
+      # Only meaningful right after a run populated the memo (baseline / recheck),
       # before the bucket rolls. Keys are held live here; the session Marshals them for the snapshot.
       #
-      # @return `{ [path, "Class#method" | "Class.method"] => { keys:, returns:, effects: } }`.
+      # Issue #3160 — the session reads the harvest as EVERY key the files this run analysed observed each def
+      # under, so whatever cannot be that says so instead of looking like a short key list:
+      #
+      # - a def observed under keys this run cannot list maps to nil: more keys than
+      #   {RETURN_SUMMARY_KEYS_PER_DEF} (issue #3116), a call whose result the memo refused to store, or a def
+      #   past {RETURN_SUMMARY_TOTAL_CAP};
+      # - a def absent from the result was observed by no analysed file, wherever it is defined: an unchanged
+      #   file's def is found through the node its {Inference::DefHandle} resolved to;
+      # - the whole result is nil for a pool run, whose workers typed the calls in memos this process never sees.
+      #
+      # @return the summaries keyed by `[path, "Class#method"]` (or `"Class.method"`), each holding `keys:`,
+      #   `returns:` and `effects:`, or nil; nil for a pool run.
       def return_summaries
-        memo = Inference::ExpressionTyper.harvest_return_memo
+        return nil if pool_mode?
+
+        memo = Inference::ExpressionTyper.harvest_return_memo(@return_memo)
         return {} if memo.empty?
 
         result = {}
@@ -779,37 +833,89 @@ module Rigor
                                  "#", memo, effects_evaluator)
         collect_return_summaries(result, @project_discovered_singleton_def_nodes,
                                  @project_discovered_singleton_def_sources, ".", memo, effects_evaluator)
+        # ADR-129 WD5 (#2785) — typing after the run, under `content_effects`' rescue.
+        Inference::MemoAudit.raise_undrained!
         result
       end
 
       # Folds one def-node/def-source table pair's memo entries into the return-summary result under
-      # `separator`. A live def node (a cold / re-walked file) is the identity every cross-file caller
-      # resolved through, so `memo[node]` holds those callers' observed keys; a {DefHandle} (an unchanged
-      # file on the warm path) never keyed a memo entry, so it is skipped (its summary is carried over from
-      # the snapshot). Bounded per def and in total so the snapshot stays small.
+      # `separator`. The node the memo keyed is the identity every cross-file caller resolved through: the live
+      # def node of a cold / re-walked file, or the one the resolver minted for an unchanged file's
+      # {Inference::DefHandle} ({#observed_def_node}).
       def collect_return_summaries(result, nodes, sources, separator, memo, effects_evaluator)
+        summarised = result.count { |_pair, summary| summary }
         nodes.each do |class_name, methods|
-          methods.each do |method_name, node|
-            next if node.is_a?(Inference::DefHandle)
-
-            entries = memo[node]
-            next if entries.nil? || entries.empty?
+          methods.each do |method_name, slot|
+            node = observed_def_node(slot)
+            next unless memo.key?(node)
 
             path_line = sources.dig(class_name, method_name)
             next if path_line.nil?
 
-            break if result.size >= RETURN_SUMMARY_TOTAL_CAP
-
-            capped = entries.first(RETURN_SUMMARY_KEYS_PER_DEF)
-            result[[path_line.split(":", 2).first, "#{class_name}#{separator}#{method_name}"]] = {
-              keys: capped.map { |entry| [entry.receiver, entry.arg_types] },
-              returns: capped.map { |entry| entry.result.describe(:short) },
-              effects: content_effects(effects_evaluator, node)
-            }
+            summary = summarised < RETURN_SUMMARY_TOTAL_CAP ? return_summary(memo[node], effects_evaluator, node) : nil
+            summarised += 1 if summary
+            result[[path_line.split(":", 2).first, "#{class_name}#{separator}#{method_name}"]] = summary
           end
         end
       end
 
+      # The node the run's return memo keyed `slot`'s def on, or nil when no call resolved it: the live node, or the
+      # one the run's resolver minted for a {Inference::DefHandle}.
+      def observed_def_node(slot)
+        return slot unless slot.is_a?(Inference::DefHandle)
+
+        @resolved_def_nodes&.[]([slot.path, slot.node_id])
+      end
+
+      # One def's summary, or nil when `entries` are not every key it was observed under: the memo refused to store
+      # a call of it (so `entries` may be empty), or there are more than {RETURN_SUMMARY_KEYS_PER_DEF} (issue
+      # #3116). A splat call's key (issue #1237) is an entry like any other and counts toward the cap.
+      def return_summary(entries, effects_evaluator, node)
+        return nil if entries.empty? || entries.size > RETURN_SUMMARY_KEYS_PER_DEF
+        return nil if Inference::ExpressionTyper.return_memo_refused?(@return_memo, node)
+
+        { keys: entries.map { |entry| return_summary_key(entry) },
+          returns: entries.map { |entry| entry.result.describe(:short) },
+          effects: content_effects(effects_evaluator, node),
+          guard_constants: guard_constants(node) }
+      end
+
+      # Issue #3186 — the constant spellings in `node`'s body that the truthiness rule's one interprocedural hop
+      # ({CheckRules::PublishedConstantGuard}) could answer true for, or nil when they cannot be listed. A reader's
+      # `flow.always-truthy-condition` withholds when a def it calls reads a constant another file published,
+      # whatever the def returns, so the ADR-89 WD2 gate compares these as well as the returns; nil never compares
+      # equal, so it keeps the def's readers.
+      #
+      # The hop asks `Scope#published_constant?`, which answers true only for a spelling whose last segment the
+      # project publishes or the reader's own file assigns from a published constant, and each of those is a segment
+      # some project file writes. So the spellings whose last segment no file writes (a class name, as a rule) are
+      # left out: they answer false for every reader, and keeping them would fail the gate on every edit that adds a
+      # callee. The filter is this run's write census, so a census that moved fails the comparison.
+      def guard_constants(node)
+        written = constant_write_segments
+        CheckRules::PublishedConstantGuard.body_constant_spellings(node.body).select do |spelling|
+          written.include?(spelling.split("::").last)
+        end
+      rescue StandardError
+        nil
+      end
+
+      # The last segments of every constant name the run's write census holds, a wildcard key's included.
+      def constant_write_segments
+        unless @constant_write_segments_of.equal?(@project_constant_writes)
+          @constant_write_segments_of = @project_constant_writes
+          @constant_write_segments = @project_constant_writes.each_key.to_set { |name| name.split("::").last }
+        end
+        @constant_write_segments
+      end
+
+      # One observed call key: `[receiver, arg_types]`, or, for an entry a splat call stored (issue #1237),
+      # `[receiver, arg_types, true]`, which {#evaluate_spec_returns} re-drives with no positional correspondence.
+      def return_summary_key(entry)
+        key = [entry.receiver, entry.arg_types]
+        entry.positionals_unknown ? key << true : key
+      end
+
       # The content-mutated parameter positions of `node`, or `[]` if the computation raises (defensive: the
       # effects surface only routes attention, never soundness — a missing set reads as "no floor").
       def content_effects(effects_evaluator, node)
@@ -828,15 +934,49 @@ module Rigor
       #
       # @param paths — analysis roots (nil → the configuration's `paths:`).
       # @param specs — each `{ class_name:, method_name:, singleton:, keys: [[receiver, args], …] }`.
-      # @return `{ [class_name, method_name, singleton] => [return_descriptor_or_nil, …] }`.
+      # @return the re-evaluated return descriptors, one per key, keyed by `[class_name, method_name, singleton]`.
       def evaluate_return_types(paths, specs)
         return {} if specs.empty?
 
+        @probe_reads = {}
+        @probe_plugin_reads = {}
+        @probe_disclosures = {}
+        @probe_guard_constants = {}
         Cache::FileDigest.with_run(strict: @configuration.cache_validation_strict?) do
-          Inference::DefNodeResolver.with_run { evaluate_return_types_setup(paths, specs) }
+          Inference::DefNodeResolver.with_run do
+            evaluate_return_types_setup(paths, specs)
+          ensure
+            @resolved_def_nodes = Inference::DefNodeResolver.resolved_nodes
+          end
         end
+      ensure
+        # Issue #3180 — as {#run} does: {#return_summaries} then answers for what the probe observed.
+        @return_memo = Inference::ExpressionTyper.current_return_memo
+        RunScopedSlots.release
       end
 
+      # Issue #3180 — what the last {#evaluate_return_types} read while re-evaluating each spec's def at its keys: the
+      # spec triple => a {DependencyRecorder::Record} of every def, class and name the evaluation read, the def's own
+      # file included (nothing is filtered as a self-read). The incremental session gives these edges to the readers
+      # a passing gate skips, since they now reach whatever the edited def reaches. Empty before the first probe.
+      attr_reader :probe_reads
+
+      # Issue #3187 — what the plugins did while the last {#evaluate_return_types} re-evaluated each spec's def, as
+      # {#analysis_reads} and {#analysis_disclosures} hold for an analysed file: the spec triple => the boundary rows
+      # its evaluation read ({Plugin::IoBoundary.attributing}), and => the run-scoped rows it registered
+      # ({RunDisclosureCredit}). A triple whose evaluation read or registered nothing has no key. The incremental
+      # session credits the reads to the readers a passing gate skips, as it does {#probe_reads}; a registration
+      # keeps the def's readers instead, since no skipped reader could be credited with it, or have it retracted.
+      attr_reader :probe_plugin_reads, :probe_disclosures
+
+      # Issue #3186 — the spec triple => {#guard_constants} of the def the last {#evaluate_return_types} re-evaluated,
+      # under that probe's write census. A triple whose def the probe did not find has no key.
+      attr_reader :probe_guard_constants
+
+      # The consumer {#evaluate_spec_returns} records under. It is no file's path, so no read is dropped as a self-read.
+      PROBE_CONSUMER = ""
+      private_constant :PROBE_CONSUMER
+
       # Builds the discovery index + environment (a real run's prologue, minus per-file analysis) and
       # re-evaluates each spec's def. Extracted so {#evaluate_return_types}'s `with_run` wrappers stay thin.
       def evaluate_return_types_setup(paths, specs)
@@ -872,10 +1012,43 @@ module Rigor
         return spec[:keys].map { nil } if node.nil?
 
         scope = seed_project_scope(Scope.empty(environment: environment, source_path: spec[:path]))
-        spec[:keys].map do |(receiver, arg_types)|
-          result = scope.user_method_return(node, receiver, arg_types)
-          result&.describe(:short)
+        triple = [spec[:class_name], spec[:method_name], spec[:singleton]]
+        @probe_guard_constants[triple] = guard_constants(node)
+        returns = nil
+        attributed_probe(triple) do
+          record_guard_spelling_edges(node)
+          returns = spec[:keys].map do |(receiver, arg_types, positionals_unknown)|
+            result = scope.user_method_return(node, receiver, arg_types,
+                                              positionals_unknown: positionals_unknown || false)
+            result&.describe(:short)
+          end
+        end
+        returns
+      end
+
+      # Issue #3199 — the `constant:` edge for every spelling the truthiness guard's hop would scan in `node`'s body,
+      # recorded into the probe's reads, which every reader the gate skips receives. {#guard_constants} leaves out a
+      # spelling whose last segment no file writes, so an edit that starts probing one (`defined?(B::X)` before any
+      # file assigns `B::X`) passes the gate; the skipped reader's guard never asks about it, and without this edge a
+      # file that later publishes the constant would re-check nobody.
+      def record_guard_spelling_edges(node)
+        CheckRules::PublishedConstantGuard.body_constant_spellings(node.body).each do |spelling|
+          DependencyRecorder.read_last_segment(:constant, spelling)
+        end
+      end
+
+      # Runs one spec's evaluation with its dependency reads recorded ({#probe_reads}) and its plugin reads and
+      # run-scoped registrations attributed to it ({#probe_plugin_reads}, {#probe_disclosures}), as
+      # {#analyze_file_attributed} does for a file.
+      def attributed_probe(triple, &)
+        reads = []
+        disclosures = RunDisclosureCredit.collect do
+          @probe_reads[triple] = Plugin::IoBoundary.attributing(reads) do
+            DependencyRecorder.record_for(PROBE_CONSUMER, &)
+          end
         end
+        @probe_plugin_reads[triple] = reads.uniq.freeze unless reads.empty?
+        @probe_disclosures[triple] = disclosures unless disclosures.empty?
       end
 
       # ADR-45 — unchanged-project fast path. Serves the whole run's (pre-severity-profile) diagnostics
@@ -891,7 +1064,10 @@ module Rigor
         # #392 — `source_files:` is what a plugin's `source_rbs_synthesizer` is offered at env-build time,
         # and a template unit is not Ruby the synthesiser can read (rbs-inline would be handed `.rbx`
         # bytes). The `.rb` expansion is the right set here; the units join the ANALYSED set only.
-        environment = @pool_coordinator.resolve_sequential_environment(source_files: expansion.fetch(:files))
+        # Issue #2883 — not eager: a warm result-cache HIT never types, so it must not build the RBS environment;
+        # {#assemble_run_diagnostics} builds it on the analysis path.
+        environment = @pool_coordinator.resolve_sequential_environment(source_files: expansion.fetch(:files),
+                                                                       eager: false)
         # Lazy-files descriptor: the cache KEY reads only `gems` + `configs`; the RBS signature-tree `files`
         # are digested solely by `run_dependency_descriptor` on a MISS, so a warm HIT never walks the tree.
         rbs_descriptor = if environment&.rbs_loader
@@ -1021,17 +1197,12 @@ module Rigor
         nil
       end
 
-      # The write half, run only after a miss, so the block never recomputes anything: it hands over the
-      # collections the analysis just produced — and the table the analysis already closed over them, so
-      # a warm hit re-runs neither the merge nor the fixpoint — validated against the same post-run
-      # dependency descriptor the diagnostics slot records. Fail-soft — a collection that will not
-      # Marshal (which nothing in {Effects::FileCollection} should be, and the fork pool already proves
-      # per file) costs the next run its warm start and nothing else.
-      # The write half, run only after a miss, so neither block recomputes anything. Two entries under one
+      # The write half, run only after a miss, so nothing here recomputes anything. Two entries under one
       # key descriptor and one dependency descriptor (#482): the summary a warm run serves from, and the
       # collections the incremental and fail-soft paths read. The summary is written LAST, so a run
       # interrupted between the two leaves a collections entry that the next run's summary miss simply
-      # re-collects — never a summary whose collections are absent.
+      # re-collects — never a summary whose collections are absent. A collection that will not Marshal
+      # costs the next run its warm start and nothing else.
       def store_effect_collections(descriptor, expansion, rbs_descriptor)
         return if descriptor.nil?
 
@@ -1170,6 +1341,8 @@ module Rigor
       end
 
       def assemble_run_diagnostics(expansion, environment: nil)
+        # Issue #2883 — the analysis path builds the RBS environment before anything types (ADR-129 G1').
+        environment&.prepare_for_typing!
         # Force the deferred cross-file discovery pre-pass on the analysis (miss) path. Memoised, so the
         # eager force in `#run` (recording / subset modes) makes this a no-op. A warm cache HIT never calls
         # `assemble_run_diagnostics`, so it never runs the two whole-project parse passes. Runs over the FULL
@@ -1233,40 +1406,13 @@ module Rigor
       end
       private :template_unit_failure_diagnostics
 
-      # The rbs-coverage build-failure ladder plus every remaining post-analysis stream
-      # `#assemble_run_diagnostics` appends, in their fixed contract order (see the comments at each call
-      # below and at the streams' own definitions). Split out of `#assemble_run_diagnostics` so that
-      # method's `Metrics/AbcSize` stays under budget — every stream here is a plain `DiagnosticAggregator`
-      # reader with no branching of its own, so the split changes nothing about WHEN or in WHAT order they
-      # run.
+      # Every remaining post-analysis stream `#assemble_run_diagnostics` appends — the `rbs.coverage.*`
+      # build-failure ladder (widest consequence first: quarantine, env build, definition build #696, HKT scan
+      # #784), its notices, the conformance rows, the reporter streams, the plugin run disclosures (#1051)
+      # and, last, the trust-refusal envelope (#959) — in the contract order ADR-116 WD3's
+      # {RunLevelFacts} declares. Read after `analyze_targets`, so every worker payload has been merged.
       def post_analysis_diagnostic_streams
-        diagnostics = @diagnostic_aggregator.rbs_quarantined_signature_diagnostics
-        diagnostics += @diagnostic_aggregator.rbs_environment_build_failed_diagnostics
-        # Issue #696 — after its env-wide twin and before the synthesized-namespace notice: the four
-        # `rbs.coverage.*` build conditions surface widest-consequence first, and their relative order is
-        # the diagnostic output contract.
-        diagnostics += @diagnostic_aggregator.rbs_definition_build_failed_diagnostics
-        # Issue #784 — last of the four, deliberately: it loses only the IMPLICIT HKT registrations a
-        # `type` alias would have contributed, never a class's own declared method surface, so it is the
-        # narrowest-consequence rung on the same ladder.
-        diagnostics += @diagnostic_aggregator.rbs_hkt_scan_failed_diagnostics
-        # The synthesized-namespace notice, then (#610) the plugin-signature stand-down: the outcome that
-        # AVOIDED a definition-build failure, so the quietest row on that ladder.
-        diagnostics += @diagnostic_aggregator.rbs_coverage_notice_diagnostics
-        diagnostics += @diagnostic_aggregator.conforms_to_diagnostics
-        diagnostics += @diagnostic_aggregator.rbs_extended_reporter_diagnostics
-        diagnostics += @diagnostic_aggregator.boundary_cross_diagnostics
-        diagnostics += @diagnostic_aggregator.source_rbs_synthesis_diagnostics
-        # Issue #1051 — read after `analyze_targets` for the same reason the refusal stream below is: a
-        # plugin may register a disclosure from `#prepare` (the usual case) or while analysing a file, and
-        # both have to be in before the table is harvested. Ordered before the refusals so the run-level
-        # plugin rows read plugin-authored notice first, engine-authored envelope second.
-        diagnostics += @diagnostic_aggregator.plugin_run_disclosure_diagnostics
-        # Issue #959 — read LAST (after `analyze_targets`, which already ran before this method is called),
-        # so every per-file plugin call has had its chance to record a refusal on its (per-plugin-instance
-        # memoised) `IoBoundary`, alongside the prepare-time refusals the same boundary instance may
-        # already carry.
-        diagnostics + @diagnostic_aggregator.plugin_trust_refusal_diagnostics
+        @diagnostic_aggregator.run_level_diagnostics
       end
       private :post_analysis_diagnostic_streams
 
@@ -1445,7 +1591,7 @@ module Rigor
         # #979 — the signature ROOTS' listings, one glob row each. `rbs_descriptor.files` covers only the
         # `.rbs` files that existed while the run read them, so without these a signature file written after
         # the run left the slot validating fresh and the warm run answered without it.
-        globs = rbs_descriptor.globs + template_unit_glob_entries + discovery_glob_entries
+        globs = rbs_descriptor.globs + template_unit_glob_entries + discovery_glob_entries + bundle_sig_glob_entries
         boundary = plugin_boundary_rows
         entries.concat(boundary.files)
         globs.concat(boundary.globs).concat(producer_watch_glob_entries)
@@ -1583,7 +1729,9 @@ module Rigor
       # change time it cannot read, and passes over a `pinned` one.
       BaselineRows = Data.define(:owned, :pinned)
 
-      SignatureRoots = Struct.new(:signature_paths)
+      # A loader's two readers {Cache::RbsDescriptor} takes signature roots from. `core_root` (issue #2517) is the
+      # selected core, which the slot key names by path only, so its files are `owned` rows like the project's own.
+      SignatureRoots = Struct.new(:signature_paths, :core_root)
       private_constant :SignatureRoots
 
       # @param files — the run's analysed-path set.
@@ -1591,6 +1739,9 @@ module Rigor
         return nil if pool_mode? || !@collect_stats || @analyzed_files.empty?
 
         own, pinned = signature_rows
+        # Issue #2987 — the bundle's `sig/` listing is identified by the gems' directory, outside the project, so a
+        # `pinned` row: the write guard passes over it where it would refuse an `owned` one it cannot stat.
+        pinned = Cache::Descriptor.new(files: pinned.files, globs: (pinned.globs + bundle_sig_glob_entries).uniq)
         BaselineRows.new(
           owned: Cache::Descriptor.new(
             files: own.files + kind_entries(signature_root_candidates) +
@@ -1604,8 +1755,9 @@ module Rigor
 
       # The signature tree's rows, the project's own and the rest.
       def signature_rows
-        roots = SignatureRoots.new(@snapshots.signature_paths)
-        own = signature_root_candidates.map { |root| File.join(File.absolute_path(root.to_s), "") }
+        roots = SignatureRoots.new(@snapshots.signature_paths, @configuration.core_root)
+        own = (signature_root_candidates + [@configuration.core_root].compact)
+              .map { |root| File.join(File.absolute_path(root.to_s), "") }
         own_files, other_files = Cache::RbsDescriptor.file_entries(roots, comparator: :stat)
                                                      .partition { |row| within?(row.path, own) }
         own_globs, other_globs = Cache::RbsDescriptor.glob_entries(roots).partition { |row| within?(row.root, own) }
@@ -1618,12 +1770,12 @@ module Rigor
         roots.any? { |root| directory.start_with?(root) }
       end
 
-      # The project's own signature roots, whether or not they exist: the configured `signature_paths:`, or the
-      # `sig` directory `Environment.default_signature_paths` auto-detects when none are configured. The
-      # signature rows' listing rows cover a file appearing under a root that existed; only a row for the root
-      # itself covers it appearing.
+      # The project's own signature roots, whether or not they exist:
+      # {Environment.project_signature_root_candidates} — the configured `signature_paths:`, or the `sig`
+      # directory it defaults to when none are configured (issue #1619). The signature rows' listing rows
+      # cover a file appearing under a root that existed; only a row for the root itself covers it appearing.
       def signature_root_candidates
-        @configuration.signature_paths || ["sig"]
+        Environment.project_signature_root_candidates(@configuration.signature_paths)
       end
 
       # One names-mode listing row per directory the discovery widening globbed, so a file appearing there is seen
@@ -1638,6 +1790,22 @@ module Rigor
         end
       end
 
+      # Issue #2987 — one names-mode listing row per bundle `sig/` layout ({Environment::BundleSigDiscovery.discover}'s
+      # two globs). The signature rows list only the directories the loader read, so a gem that GAINS a `sig/`
+      # (or loses it) while its version and lock entry stand still sits in none of them, and the run-result
+      # slot kept serving the environment built without (or with) it.
+      def bundle_sig_glob_entries
+        root = Environment::BundleSigDiscovery.resolve_bundle_path(
+          bundle_path: @configuration.bundler_bundle_path, project_root: Dir.pwd,
+          auto_detect: @configuration.bundler_auto_detect
+        )
+        return [] if root.nil?
+
+        Environment::BundleSigDiscovery::SIG_GLOBS.map do |pattern|
+          Cache::Descriptor::GlobEntry.compute(root: root.to_s, pattern: pattern, mode: :names)
+        end
+      end
+
       def unanalysed_pre_eval_entries(files)
         analysed = files.to_set { |path| File.absolute_path(path) }
         outside = @configuration.pre_eval.reject { |path| analysed.include?(File.absolute_path(path)) }
@@ -1658,6 +1826,7 @@ module Rigor
       end
       private :plugin_boundary_rows, :producer_watch_glob_entries, :kind_entries, :root_presence_entries,
               :analysis_reads_attributed?, :signature_root_candidates, :discovery_glob_entries,
+              :bundle_sig_glob_entries,
               :unanalysed_pre_eval_entries, :signature_rows, :within?
 
       # Issue #684 — the project files this run DISCOVERED but did not analyse. A widened run's diagnostics
@@ -2031,7 +2200,7 @@ module Rigor
       rescue ArgumentError => e
         floor = self.class.prism_supported_floor
         Diagnostic.new(
-          path: ".rigor.yml", line: 1, column: 1,
+          path: @configuration.config_display_path, line: 1, column: 1,
           message: "target_ruby #{@configuration.target_ruby.inspect} is not supported by this Rigor build " \
                    "(Prism accepts #{floor} and newer). Set target_ruby to your project's Ruby version " \
                    "(>= #{floor}) — read it from Gemfile.lock's `RUBY VERSION` or .ruby-version. " \
@@ -2056,8 +2225,7 @@ module Rigor
       # Editor mode § "Scope choice — option A". Under `buffer:` non-nil the per-file analysis emits
       # diagnostics ONLY for the buffer's logical path; the rest of `paths:` is consumed by the
       # project-wide pre-passes (synthetic methods, project-patched methods, plugin facts) but contributes
-      # no per-file diagnostics. This is the v1 cut before a per-file diagnostic cache exists; option B
-      # (full project + incremental cache) is queued.
+      # no per-file diagnostics. Option B (#146) narrows to the closure instead; see {#target_files}.
       #
       # The buffer's logical path is added to the file list even if it's not under `paths:` — per design §
       # "Failure envelope": "--instead-of=Y with Y not under any paths: directory → treated as a valid
@@ -2090,7 +2258,13 @@ module Rigor
           # The logical path joins even when it is not on disk under `paths:` (design § "Failure envelope"),
           # the same allowance option A makes below.
           files = files.select { |path| @analyze_only.include?(path) }
-          files |= [@buffer.logical_path] if @buffer && @analyze_only.include?(@buffer.logical_path)
+          # Issue #2233 — a buffer that is a claimed template joins as its unit, appended by
+          # {#template_unit_targets}, never as a `.rb` file: the logical path in its absolute spelling would
+          # otherwise analyse the same template twice. The registry is loaded by now, which is why the test is here
+          # and not in the incremental session, where it is not.
+          if @buffer && @analyze_only.include?(@buffer.logical_path) && !template_path?(@buffer.logical_path)
+            files |= [@buffer.logical_path]
+          end
           return template_unit_targets(files)
         end
         return template_unit_targets(files) if @buffer.nil?
@@ -2126,6 +2300,14 @@ module Rigor
       end
       public :template_unit_paths
 
+      # Issue #2233 — whether `path` is a template of this run: a claimed glob matches it, or it names a unit. The
+      # runner keeps the buffer's logical path out of the targets when this is true, so a template buffer is
+      # analysed once, as a unit ({#template_unit_targets} appends it), and never also as a plain `.rb` file.
+      def template_path?(path)
+        template_units.claims?(path) ||
+          template_unit_paths.include?(Analysis::TemplateUnitPaths.relative(path, Dir.pwd))
+      end
+
       # Editor mode (`buffer:` non-nil) auto-flips the cache store to `read_only: true` so multiple
       # debounced editor invocations against the same project don't churn the on-disk cache or race on
       # schema-version writes. Cache reads continue unchanged; misses still run the producer block but the
@@ -2179,14 +2361,7 @@ module Rigor
           pool_mode: -> { pool_mode? },
           cached_plugin_prepare_diagnostics: -> { @cached_plugin_prepare_diagnostics },
           pre_eval_diagnostics_from_scanner: -> { @pre_eval_diagnostics_from_scanner },
-          synthesized_namespaces_snapshot: -> { @snapshots.synthesized_namespaces },
-          quarantined_signatures_snapshot: -> { @snapshots.quarantined_signatures },
-          signature_standdowns_snapshot: -> { @snapshots.signature_standdowns },
-          vendored_standdowns_snapshot: -> { @snapshots.vendored_standdowns },
-          env_build_failure_snapshot: -> { @snapshots.env_build_failure },
-          definition_build_failures_snapshot: -> { @snapshots.definition_build_failures },
-          hkt_scan_failure_snapshot: -> { @snapshots.hkt_scan_failure },
-          conformance_results_snapshot: -> { @snapshots.conformance_results },
+          snapshots: @snapshots,
           pooled_run_disclosures: -> { @pool_coordinator.collected_run_disclosures },
           served_run_disclosures: -> { @served_run_disclosures },
           pooled_trust_refusals: -> { @pool_coordinator.collected_trust_refusals }
@@ -2520,14 +2695,14 @@ module Rigor
         @discovery_seed ? @discovery_seed.dup : {}
       end
 
-      # Seeds the two OPT-IN pre-pass tables — the ones an ordinary run leaves empty, so they are absent from
-      # the seed entirely unless the project asked for them. Both ride this seed so a pooled `WorkerSession`
-      # scope resolves identically to the sequential path (ADR-15 sequential equivalence).
+      # Seeds the parameter-inference and constant-publication tables, so a pooled `WorkerSession` scope resolves
+      # identically to the sequential path (ADR-15 sequential equivalence). The parameter-inference table is absent
+      # unless its opt-in ran; the constant tables are seeded whenever the run has project constants.
       #
       # - ADR-67 WD6a `param_inferred_types`: the call-site parameter-inference table, populated only when the
       #   `parameter_inference:` gate ran the pre-pass.
-      # - Issue #352 `in_source_constants`: the `pre_eval:` constant publication, populated only when the
-      #   project lists `pre_eval:` files that declare publishable constants.
+      # - Issue #352 `in_source_constants`: the `pre_eval:` constant publication, merged with the project's
+      #   literal constant table (#644, see {#merged_seed_constants}).
       #
       # Extracted to keep {#project_scope_seed_tables} under the complexity budget.
       def seed_opt_in_pre_pass_tables(tables)
@@ -2655,6 +2830,14 @@ module Rigor
       # `DependencyRecorder.active? == false`. Recording is observational, so diagnostics are byte-identical
       # either way.
       def analyze_file(path, environment)
+        diagnostics = analyze_file_attributed(path, environment)
+        return diagnostics unless Inference::MemoAudit.enabled?
+
+        # ADR-129 WD5 (#2785) — the audit's mismatches this file raised, a swallowed one included.
+        CrashSignature.with_swallowed(path, diagnostics, Inference::MemoAudit.drain)
+      end
+
+      def analyze_file_attributed(path, environment)
         return analyze_with_effects(path, environment) unless @record_dependencies
 
         # ADR-45 WD2 (#1507) — every plugin read this file's analysis makes is attributed to it, so the
@@ -2735,9 +2918,11 @@ module Rigor
         # `self_call_misses` feeds the `call.self-undefined-method` collector; the recorder is inert unless
         # the rule is active or `record_self_calls:` opted in.
         index = nil
+        TypeOfMemo.begin_file
         self_call_record = with_self_call_recording(path) do
           index = Inference::ScopeIndexer.index(parse_result.value, default_scope: scope, widen_clauses: true)
         end
+        TypeOfMemo.phase!(:rule)
         self_call_misses = self_call_record ? self_call_record.calls : []
         diagnostics = rule_and_plugin_diagnostics(path, parse_result, scope, index, self_call_misses)
         notify_file_indexed(path, parse_result, scope, index)
@@ -2752,16 +2937,18 @@ module Rigor
             severity: :error
           )
         ]
-      rescue StandardError => e
+      rescue StandardError, SystemStackError => e
         [
           Diagnostic.new(
             path: path,
             line: 1,
             column: 1,
-            message: CrashSignature.check_rule_message(e),
+            message: CrashSignature.contained_message!(e, parse_result),
             severity: :error
           )
         ]
+      ensure
+        TypeOfMemo.end_file
       end
 
       # ADR-113 WD2 — the `on_file_indexed` observer. It reads; an error inside it never changes this file's
@@ -2778,7 +2965,9 @@ module Rigor
       # output and the plugin diagnostics are then built from that single walk's results.
       def rule_and_plugin_diagnostics(path, parse_result, scope, index, self_call_misses)
         root = parse_result.value
-        node_collectors = CheckRules.build_node_collectors(path, index, root)
+        node_collectors = CheckRules.build_node_collectors(
+          path, index, root, plugin_api_surface: CheckRules::PluginApiSurface.active?(@configuration)
+        )
         node_results = node_rule_results_by_plugin(path, root, scope, node_collectors, index)
         diagnostics = CheckRules.diagnose(
           path: path,