rigortype 0.4.7 → 0.4.8

data/lib/rigor/analysis/incremental_session.rb

@@ -124,9 +124,13 @@ module Rigor
         # Diffed on a recheck to find every constant whose PUBLISHED answer could have moved, which satisfies
         # the `constant:` edges a reader records at every reference, resolved or not.
         @constant_decls = {}
-        # ADR-89 WD2 — per-def observed-key return summaries: [path, symbol] => { keys:, returns:, effects: }.
+        # ADR-89 WD2 — per-def observed-key return summaries: [path, symbol] => { keys:, returns:, effects:,
+        # guard_constants: }.
         # Harvested from the ADR-84 return memo after each run; drives the behavioural-stability gate.
         @return_summaries = {}
+        # Issue #3180 — what the ADR-89 WD2 gate's probe read for the pairs it passed, from the closure decision
+        # until {#absorb} folds it into the skipped readers; nil when no pair passed.
+        @gate_observations = nil
         # ADR-67 WD6c lift — the `parameter_inference:` seed table the cached diagnostics were computed
         # under (`{}` when the gate is off — the gate state is constant across a snapshot's lifetime because
         # the configuration is part of the global fingerprint). A recheck recomputes the table fresh and
@@ -263,7 +267,7 @@ module Rigor
         # digest (issue #1536).
         @seed_bundles = source_rbs_gate.stamp(runner.seed_bundles, whole_project: true)
         absorb_dependency_graph(runner)
-        @return_summaries = runner.return_summaries # ADR-89 WD2 — the full-run behavioural surface.
+        @return_summaries = baseline_return_summaries(runner)
         # ADR-67 WD6c lift — the seed table the runner's own pre-pass computed ({} when the gate is off).
         # Reading it back, rather than computing it here, keeps the baseline single-collect.
         @param_table = runner.param_inferred_types
@@ -391,6 +395,8 @@ module Rigor
       # whole project — what a `sig/` edit already costs through the snapshot fingerprint.
       def affected_closure(changed, added, removed, param_files = Set.new, param_pairs = Set.new)
         @stale_plugin_readers = plugin_read_affected | disclosure_refreshers(removed)
+        # Issue #3180 — a recheck that passed the gate and then re-baselined absorbed nothing: start without it.
+        @gate_observations = nil
         return whole_project_closure(changed, added) if source_rbs_gate.moved?(@seed_bundles, changed, added, removed)
 
         (gated_closure(changed, added, removed, param_files, param_pairs) | @stale_plugin_readers).freeze
@@ -577,8 +583,10 @@ module Rigor
       # surfaces are its return type and its content-mutation effects (no instance/class variable write, no
       # `yield`, no implicit-self call whose transitive effect a caller could observe). For a candidate the
       # session compares its content-mutation effects (pure AST) then re-evaluates its return at every
-      # persisted key (a runner probe); a pair passes only when BOTH are unchanged. Any missing summary,
-      # ineligible def, changed effect, changed return, or uncomputable key keeps the pair — the conservative
+      # persisted key (a runner probe), with the published-constant spellings its body reads (issue #3186,
+      # {#guard_constants_unmoved?}); a pair passes only when all three are unchanged. Any missing summary (which is
+      # also how a def whose keys could not all be recorded is stored, issues #3116 and #3160), ineligible def,
+      # changed effect, changed return, or uncomputable key keeps the pair — the conservative
       # direction the `--verify-incremental` and byte-identical recheck specs backstop.
       def behaviourally_unstable_pairs(changed_pairs, unstable, scan_index)
         return changed_pairs if @return_summaries.empty? || scan_index.nil?
@@ -1236,10 +1244,79 @@ module Rigor
         # with anything its closure demanded for itself, so this is the same union the next run replays.
         @run_level_rows = runner.run_level_rows
         @synthetic_surface_digest = synthetic_surface_digest_of(runner)
-        refresh_return_summaries(runner, analyze_set)
+        refresh_gated_state(runner, analyze_set)
         refresh_effect_collections(runner, analyze_set)
       end
 
+      # The summaries, then the skipped readers' edges, in that order ({#refresh_return_summaries}), with what the
+      # gate's probe observed for this recheck taken and cleared. The clear is a guard no spec pins:
+      # {#affected_closure} resets the slot before every {#absorb}, so nothing reads it again. It only keeps a
+      # consumed observation from outliving its recheck, should absorb gain another caller.
+      def refresh_gated_state(runner, analyze_set)
+        observations = @gate_observations
+        @gate_observations = nil
+        refresh_return_summaries(runner, analyze_set, observations)
+        absorb_gate_reads(observations, analyze_set)
+      end
+
+      # Issue #3180 — give every reader the ADR-89 WD2 gate skipped the edges its probe recorded for the pair it
+      # passed ({#gate_observations}): the reader reaches those defs, classes and names through the edited def now,
+      # and no analysis of the reader will record that until something else re-analyses it. The probe evaluated the
+      # def at all of its stored keys and a reader observes it under some of them, so the reader may gain an edge it
+      # does not need; that costs a re-analysis, never an answer. Runs after {#refresh_return_summaries}, which reads
+      # the dependents as they stood before these edges. Independent of the summaries: a pooled recheck over
+      # summaries a sequential run stored can pass the gate too, and its skipped readers need the edges as much.
+      def absorb_gate_reads(observations, analyze_set)
+        return if observations.nil?
+
+        analyzed = analyze_set.to_set
+        skipped = observations.reads.keys.to_h do |pair|
+          [pair, ((@symbol_dependents[pair] || Set.new) - analyzed).to_a]
+        end
+        return if skipped.each_value.all?(&:empty?)
+
+        credit_probe_plugin_rows(observations, skipped)
+        skipped.each { |pair, readers| readers.each { |reader| add_recorded_reads(reader, observations.reads[pair]) } }
+        invert_dependency_graph
+      end
+
+      # Issue #3187 — the plugin reads the probe made while evaluating a passed pair's def, credited to each reader of
+      # the pair it skipped, as an analysis of that reader would have credited them: a later edit of what the plugin
+      # read re-analyses the reader ({#plugin_read_affected}). Like the edges, a reader may gain a row it does not
+      # need, which costs a re-analysis. Run-scoped registrations are not credited: a pair whose probe registered one
+      # does not pass ({#readers_hold_disclosures?}).
+      def credit_probe_plugin_rows(observations, skipped)
+        skipped.each do |pair, readers|
+          rows = observations.plugin_reads[pair]
+          next if rows.nil?
+
+          readers.each { |reader| @plugin_reads[reader] = ((@plugin_reads[reader] || []) | rows).freeze }
+        end
+      end
+
+      # `record`'s reads added to `reader`'s, less the reads of `reader`'s own file (a file records no edge to
+      # itself). Builds new sets: a restored snapshot's are not this session's to mutate. The self-filter on the
+      # ancestry edges is a guard no spec pins: it mirrors the two that are pinned, and no row was built in which
+      # the edited def comes to read the ancestry of a class its skipped reader's file declares.
+      def add_recorded_reads(reader, record)
+        symbols = (@symbol_sources[reader] || {}).dup
+        record.symbol_sources.each do |path, names|
+          symbols[path] = (symbols[path] || Set.new) | names unless path == reader
+        end
+        @symbol_sources[reader] = symbols
+        @ancestry_sources[reader] = (@ancestry_sources[reader] || Set.new) | (record.ancestry_sources - [reader])
+        @sources[reader] = (@sources[reader] || Set.new) | (record.sources - [reader])
+        @missing[reader] = (@missing[reader] || Set.new) | record.missing
+      end
+
+      # The inverted indexes of the four per-consumer edge tables.
+      def invert_dependency_graph
+        @dependents          = Incremental.invert(@sources)
+        @symbol_dependents   = Incremental.invert_symbols(@symbol_sources)
+        @ancestry_dependents = Incremental.invert(@ancestry_sources)
+        @negative_dependents = Incremental.invert(@missing)
+      end
+
       # ADR-103 WD13 / #382 — the effects analogue of {#refresh_return_summaries}, and the same soundness
       # order: drop every re-analyzed file's collection first, then fold this run's harvest in. A file the
       # recheck did NOT analyze keeps the collection the snapshot carried, which is exactly the reuse the
@@ -1255,21 +1332,97 @@ module Rigor
         @effect_plugin_digest = effect_plugin_digest_of(runner)
       end
 
-      # ADR-89 WD2 — replace the behavioural summaries of every re-analyzed file with THIS run's harvest: drop
-      # the analyzed files' old summaries first, then fold the fresh ones. Dropping first is the soundness
-      # invariant — a summary for a file is valid only if it came from a run that analyzed that file. On the
-      # sequential path (the default + `--verify-incremental`) the harvest is complete, so a re-analyzed def's
-      # summary is simply refreshed. On a pooled recheck the callee bodies are evaluated in worker processes,
-      # so the main-process memo harvest is sparse; dropping first means a re-analyzed file with no fresh
-      # summary loses its stale one (WD2 then conservatively re-checks its dependents) rather than comparing a
-      # later edit against a pre-edit summary. Files NOT re-analyzed keep their (unchanged, valid) summaries.
-      # A def whose symbol dependents WD2 skipped is observed under fewer keys, so its refreshed summary may
-      # shrink — sound (fewer keys = more conservative) and self-correcting (an empty summary stops the gate
-      # firing, so the callers re-analyse and repopulate).
-      def refresh_return_summaries(runner, analyze_set)
+      # ADR-89 WD2 / issues #3160, #3180 — bring the behavioural summaries up to date with THIS run. The invariant
+      # the gate reads them under: a pair's summary holds every key under which a CURRENT symbol dependent of the
+      # def observes it, directly or through other defs, each with the def's current return; and every file that
+      # observes the def is one of its symbol dependents. A summary that cannot be shown to is deleted, and a pair
+      # with no summary keeps its dependents, so every doubt below resolves to "no summary".
+      #
+      # A run's harvest ({Runner#return_summaries}) is what the files it analysed observed. The keys the gate's
+      # probe observed for the pairs it passed (`observations`, {#gate_observations}) count as this run's too: they
+      # are what the readers the gate skipped observe through the edited def. So per pair:
+      #
+      # - the run cannot list the keys it observed (a pool run, a def past the per-def or total cap, a call the
+      #   memo refused to store): delete;
+      # - every dependent was analysed: the harvest is the whole key set, and replaces the summary (deleting it
+      #   when no analysed file observed the def, which is where a def with no dependent left ends up);
+      # - otherwise the summary keeps the keys of the dependents that were not analysed, and gains this run's
+      #   ({#merged_return_summary}), which are none when no dependent was analysed. The kept returns are current:
+      #   a dependent stays out of the closure of its callee's edit only when the gate proved the returns unmoved
+      #   at every kept key, or when the def's own text did not change. With no summary to keep, the other
+      #   dependents' keys are unknown.
+      #
+      # Fewer keys are never the conservative direction: each key protects the readers that observe the def under
+      # it, so a summary missing one skips a reader whose answer the edit moved.
+      #
+      # "Every dependent" is read off the edges as they stood BEFORE {#absorb_gate_reads} adds the probe's. A
+      # skipped reader that gains its first edge to a def there observes it only through the pair the gate passed,
+      # so the probe's keys are all of its keys; one that already held an edge was not analysed, and the pair keeps
+      # its stored keys.
+      def refresh_return_summaries(runner, analyze_set, observations = nil)
+        harvest = harvest_with_gate_summaries(runner.return_summaries, observations&.summaries)
         analyzed = analyze_set.to_set
-        @return_summaries.reject! { |(path, _symbol), _| analyzed.include?(path) }
-        @return_summaries.merge!(runner.return_summaries)
+        (@return_summaries.keys | (harvest || {}).keys).each do |pair|
+          dependents = @symbol_dependents[pair] || Set.new
+          summary = refreshed_return_summary(pair, harvest, dependents.subset?(analyzed))
+          summary.nil? ? @return_summaries.delete(pair) : @return_summaries[pair] = summary
+        end
+        @return_summaries = capped_return_summaries(@return_summaries)
+      end
+
+      # Issue #3180 — `harvest` (this run's) with the keys the gate's probe observed (`probed`, see
+      # {#gate_observations}) counted as observed by this run: they are what the readers the gate skipped observe
+      # through the def it passed, each with the callee's current return. A def either side cannot list the keys
+      # of has none, and so has one whose keys together pass the per-def cap. A run with no harvest stays without.
+      def harvest_with_gate_summaries(harvest, probed)
+        return harvest if harvest.nil? || probed.nil? || probed.empty?
+
+        probed.each_with_object(harvest.dup) do |(pair, summary), merged|
+          mine = merged.fetch(pair, summary)
+          merged[pair] = mine.nil? || summary.nil? ? nil : merged_return_summary(mine, summary)
+        end
+      end
+
+      # ADR-89 WD2 — the full-run behavioural surface: every file was analysed, so the harvest is every reader's.
+      # A def the run could not list the keys of (nil in the harvest) and a pool run (no harvest) record nothing.
+      def baseline_return_summaries(runner)
+        capped_return_summaries((runner.return_summaries || {}).compact)
+      end
+
+      # `pair`'s summary after a run whose harvest is `harvest` (nil for a run that has none), or nil for none.
+      # `complete` says every dependent of the def was analysed by that run.
+      def refreshed_return_summary(pair, harvest, complete)
+        return nil if harvest.nil?
+
+        fresh = harvest[pair]
+        return nil if fresh.nil? && harvest.key?(pair)
+        return fresh if complete
+
+        merged_return_summary(@return_summaries[pair], fresh)
+      end
+
+      # Issue #3160 — `kept` (the summary of a def some of whose dependents this run did not analyse) with the
+      # keys `fresh` (this run's harvest for the def, or nil) adds. A kept key stays unless `fresh` holds the same
+      # key with the same return; one whose return differs stays beside it, which no re-evaluation can satisfy, so
+      # the gate keeps the def's dependents. nil when there is nothing to keep or the keys pass the per-def cap.
+      def merged_return_summary(kept, fresh)
+        return nil if kept.nil?
+        return kept if fresh.nil?
+
+        rows = fresh[:keys].zip(fresh[:returns])
+        rows += kept[:keys].zip(kept[:returns]).reject { |row| rows.include?(row) }
+        return nil if rows.size > Runner::RETURN_SUMMARY_KEYS_PER_DEF
+
+        { keys: rows.map(&:first), returns: rows.map(&:last), effects: fresh[:effects],
+          guard_constants: fresh[:guard_constants] }
+      end
+
+      # The first {Runner::RETURN_SUMMARY_TOTAL_CAP} of `summaries`, so the snapshot stays small however many runs
+      # fed it. A def past the cap has no summary, which keeps its dependents.
+      def capped_return_summaries(summaries)
+        return summaries if summaries.size <= Runner::RETURN_SUMMARY_TOTAL_CAP
+
+        summaries.first(Runner::RETURN_SUMMARY_TOTAL_CAP).to_h
       end
 
       # Evict a removed file from every per-file map so its stale diagnostics are never served and it drops
@@ -1302,10 +1455,7 @@ module Rigor
           @ancestry_sources[path] = record.ancestry_sources.dup
           @missing[path]          = record.missing.dup
         end
-        @dependents          = Incremental.invert(@sources)
-        @symbol_dependents   = Incremental.invert_symbols(@symbol_sources)
-        @ancestry_dependents = Incremental.invert(@ancestry_sources)
-        @negative_dependents = Incremental.invert(@missing)
+        invert_dependency_graph
         @symbol_fingerprints.merge!(runner.symbol_fingerprints)
         # Wholesale replace (the subset runner's pre-pass is complete): a file that lost its last class must
         # drop out of the map so a later re-add registers as an appearance.
@@ -1394,6 +1544,11 @@ module Rigor
       # (`ResolutionChain#record_hooks`), so a new file that taints `Comparable` with `include(*MODS)` re-checks the
       # readers of a chain through it. It is not `mark:`, which a plain reopening of a module moves (the bucket's
       # module mark) and which would re-check every reader of `Kernel` on any `module Kernel` reopening.
+      #
+      # Issue #3005 — a moved {Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK} fires the owner's `mixin:` keys too: a new
+      # file whose body-level `send(:then)` marks an external `Comparable` makes a reader of a chain through it decline,
+      # and that reader filed `mixin:Comparable`, not `mark:Comparable`. The mark moves only with such a call, not on a
+      # plain reopening.
       def mark_affected(paths, summary)
         def_index = summary && summary[:def_index]
         before = paths.map { |path| @seed_bundles.dig(path, :parameter_envelopes) }
@@ -1401,7 +1556,7 @@ module Rigor
         tainted = Incremental.changed_unpositioned_owners(
           paths.map { |path| @seed_bundles.dig(path, :unpositioned_mixins) },
           [def_index && def_index[:unpositioned_mixins]]
-        )
+        ) | dynamic_owners(moved)
         return Set.new if moved.empty? && tainted.empty?
 
         keys = moved.map { |(class_name, _mark)| "mark:#{class_name.split('::').last}" }.uniq
@@ -1412,6 +1567,11 @@ module Rigor
         Incremental.negative_closure(keys, @negative_dependents)
       end
 
+      def dynamic_owners(moved)
+        dynamic = Scope::DiscoveryIndex::ENVELOPE_DYNAMIC_MARK
+        moved.filter_map { |(class_name, mark)| class_name if mark == dynamic }
+      end
+
       # Issue #1661 — the `mixin:` keys an owner of a moved unpositioned edge fires. The table keys a receiver-form
       # owner by the spelling written (`class File; Constants.include(*MODS); end` is `"Constants"`), not the constant
       # Ruby resolves it to, while the chain files the qualified candidate (`mixin:File::Constants`). The table does
@@ -1556,7 +1716,9 @@ module Rigor
 
       # ADR-89 WD2 — true when the ONLY cross-file body surfaces of `node` a symbol dependent can consume are
       # its return type and its content-mutation effects — so comparing exactly those two is a COMPLETE
-      # behavioural check. A def qualifies when its body writes no instance / class variable (an ivar
+      # behavioural check. (Issue #3186: the truthiness rule's one-hop body scan reads a third, the published
+      # constants the body names, which the probe compares too; no node kind makes a def ineligible for it.)
+      # A def qualifies when its body writes no instance / class variable (an ivar
       # definite-assignment a same-class caller consumes), does not `yield` (a block-parameter surface a
       # caller passing a block consumes), and makes no implicit-self call (which could carry a transitive
       # shared-state write). Deliberately conservative + purely syntactic: a def with a self-call or a
@@ -1608,29 +1770,104 @@ module Rigor
       end
 
       def content_effects_for(node)
-        (@effects_evaluator ||= Inference::StatementEvaluator.new(scope: Scope.empty))
-          .content_mutated_parameter_positions(node)
+        effects_evaluator.content_mutated_parameter_positions(node)
       rescue StandardError
         nil
       end
 
+      # The evaluator {#content_effects_for} asks, kept for as long as the calling thread's {TypingState} is the one it
+      # was built under. An evaluator caches that state, and the owner evaluators it builds cache theirs, so one kept
+      # across the language server's save rounds, each on a thread of its own, would keep writing its run-scoped memos
+      # into a finished round's state, which that round's release has already emptied (ADR-129).
+      def effects_evaluator
+        state = TypingState.current
+        unless @effects_state.equal?(state)
+          @effects_state = state
+          @effects_evaluator = Inference::StatementEvaluator.new(scope: Scope.empty)
+        end
+        @effects_evaluator
+      end
+
       # ADR-89 WD2 — the subset of `pairs` whose (edited) def re-evaluates to the SAME return descriptor at
       # every persisted key. Runs one runner probe (`evaluate_return_types` — builds the discovery + env once,
       # no file analysis) over all candidate defs, then keeps a pair only when every key's re-evaluated
       # descriptor is present (not a memo refusal) and equal to the persisted one. A probe failure yields an
       # empty set (keep everything).
       def return_stable_pairs(pairs, scan_index)
-        specs = pairs.filter_map { |pair| return_spec_for(pair, scan_index) }
+        specs = pairs.reject { |pair| readers_hold_disclosures?(pair) }.filter_map do |pair|
+          return_spec_for(pair, scan_index)
+        end
         return Set.new if specs.empty?
 
-        results = probe_return_types(specs)
-        specs.each_with_object(Set.new) do |spec, stable|
-          descriptors = results[[spec[:class_name], spec[:method_name], spec[:singleton]]]
-          expected = @return_summaries[spec[:pair]][:returns]
-          next if descriptors.nil? || descriptors.length != expected.length
-          next unless descriptors.each_with_index.all? { |d, i| !d.nil? && d == expected[i] }
+        runner, results = probe_return_types(specs)
+        passed = specs.each_with_object({}) do |spec, pairs|
+          triple = [spec[:class_name], spec[:method_name], spec[:singleton]]
+          next unless returns_unmoved?(spec[:pair], results[triple])
+          next unless guard_constants_unmoved?(spec[:pair], runner.probe_guard_constants[triple])
+          # Issue #3187 — a run-scoped row the probe registered keeps the readers ({#readers_hold_disclosures?}).
+          next if runner.probe_disclosures.key?(triple)
 
-          stable << spec[:pair]
+          pairs[spec[:pair]] = triple
+        end
+        @gate_observations = gate_observations(runner, passed) unless passed.empty?
+        passed.keys.to_set
+      end
+
+      # Issue #3187 — whether a symbol dependent of `pair` holds a run-scoped plugin row ({RunDisclosureLedger}), which
+      # keeps the pair's readers, as a probe that registers one does. A skipped reader replays the rows its last
+      # analysis registered, and which of them came through the edited def, under which key, is not recorded; nor
+      # can rows the probe registers be credited to a reader without that key, or ever be retracted once its def
+      # stops registering them. So a reader holding any row is re-analysed, which settles its rows afresh.
+      def readers_hold_disclosures?(pair)
+        (@symbol_dependents[pair] || Set.new).any? { |reader| @plugin_disclosures.files.key?(reader) }
+      end
+
+      # Issue #3186 — whether the probe's `current` constant spellings ({Runner#guard_constants}) are `pair`'s stored
+      # ones. A reader's `flow.always-truthy-condition` withholds when a def it calls reads a constant another file
+      # published, whatever the def returns, so a return-preserving edit that adds or drops such a read moves the
+      # reader's diagnostics. nil on either side (a list the runner could not make, a summary stored before the list
+      # existed) reads as moved.
+      def guard_constants_unmoved?(pair, current)
+        stored = @return_summaries[pair][:guard_constants]
+        !current.nil? && !stored.nil? && current == stored
+      end
+
+      # Whether the probe's `descriptors` are `pair`'s stored returns, key for key, none of them a memo refusal.
+      def returns_unmoved?(pair, descriptors)
+        expected = @return_summaries[pair][:returns]
+        return false if descriptors.nil? || descriptors.length != expected.length
+
+        descriptors.each_with_index.all? { |descriptor, index| !descriptor.nil? && descriptor == expected[index] }
+      end
+
+      # Issue #3180 — what the gate's probe observed for the pairs it passed. A reader the gate skips is not
+      # re-analysed, yet it now reaches whatever the edited def reaches: a callee the def did not call before, or
+      # one it calls under another key. The probe evaluated the def at every key its readers observe it under, so
+      # its reads are a superset of theirs through this def, and its memo holds every key those evaluations put to
+      # another def. `reads` is each passing pair's {DependencyRecorder::Record}; `summaries` is the probe's own
+      # harvest ({Runner#return_summaries}: nil for a def it cannot list the keys of, nil as a whole in pool mode),
+      # cut down to the defs a passing pair read. A failing pair's observations are left out: its readers are all
+      # re-analysed, and the run's harvest speaks for them. Issue #3187 — `plugin_reads` is each passing pair's plugin
+      # boundary rows ({Runner#probe_plugin_reads}); a pair whose evaluation read none has no key.
+      GateObservations = Data.define(:reads, :summaries, :plugin_reads)
+      private_constant :GateObservations
+
+      # `passed` maps each passing pair to its spec triple. The probe recorded reads for every def it evaluated, and
+      # it evaluated each of these: a summary holds at least one key, so a def the probe could not find answered nil
+      # and did not pass.
+      def gate_observations(runner, passed)
+        reads = passed.transform_values { |triple| runner.probe_reads[triple] }
+        observed = reads.each_value.with_object(Set.new) do |record, pairs|
+          record.symbol_sources.each { |path, symbols| symbols.each { |symbol| pairs << [path, symbol] } }
+        end
+        GateObservations.new(reads: reads, summaries: runner.return_summaries&.slice(*observed),
+                             plugin_reads: probe_rows(passed, runner.probe_plugin_reads))
+      end
+
+      # `table` (spec triple => rows) re-keyed by each passing pair, leaving out a pair with no rows.
+      def probe_rows(passed, table)
+        passed.each_with_object({}) do |(pair, triple), rows|
+          rows[pair] = table[triple] if table.key?(triple)
         end
       end
 
@@ -1645,10 +1882,15 @@ module Rigor
           singleton: singleton, keys: @return_summaries[pair][:keys] }
       end
 
+      # The probe's runner and its `spec triple => descriptors` answer ({} when the probe failed).
       def probe_return_types(specs)
-        build_runner.evaluate_return_types(@paths, specs)
+        runner = build_runner
+        [runner, runner.evaluate_return_types(@paths, specs)]
+      rescue Inference::MemoAudit::Mismatch
+        # ADR-129 WD5 (#2785) — the audit's mismatch (raised by the run's release) fails the session, not the probe.
+        raise
       rescue StandardError
-        {}
+        [runner, {}]
       end
 
       TOP_LEVEL_KEY = Inference::ScopeIndexer::TOP_LEVEL_DEF_KEY

data/lib/rigor/analysis/reachability/plugin_roots.rb

@@ -3,6 +3,7 @@
 require_relative "../../plugin"
 require_relative "../../plugin/loader"
 require_relative "../../plugin/services"
+require_relative "../../plugin/trust_policy"
 require_relative "../../reflection"
 require_relative "../../type/combinator"
 
@@ -107,14 +108,16 @@ module Rigor
         end
 
         # Mirrors `Analysis::WorkerSession`'s services: the shared fact store plus whatever cache store the
-        # caller holds. Holding the `Services` is what gives access to the fact store the loaded plugins
-        # share — the loader hands the same instance to every plugin.
+        # caller holds, and the run's trust policy — `rigor unused`'s plugin roots read the same scope
+        # `rigor check` does (#2586). Holding the `Services` is what gives access to the fact store the
+        # loaded plugins share — the loader hands the same instance to every plugin.
         def build_services(configuration, cache_store)
           Plugin::Services.new(
             reflection: Reflection,
             type: Type::Combinator,
             configuration: configuration,
-            cache_store: cache_store
+            cache_store: cache_store,
+            trust_policy: Plugin::TrustPolicy.for_configuration(configuration)
           )
         end
 

data/lib/rigor/analysis/rule_catalog.rb

@@ -101,7 +101,9 @@ module Rigor
             "of the class are open, and an inherited Object / Kernel signature no longer decides " \
             "`call.wrong-arity` or `call.argument-type-mismatch` on it.",
             "The program may answer the call another way (#1722): a `method_missing` on the receiver's class or an " \
-            "ancestor; a module mixed into either that defines the method (`Integer.include(Ext)` counts wherever " \
+            "ancestor, in source or in RBS (#2792; an RBS `method_missing` on `BasicObject`, `Object` or " \
+            "`Kernel` does not count); " \
+            "a module mixed into either that defines the method (`Integer.include(Ext)` counts wherever " \
             "it is written); singleton methods given to the receiver local (`s.extend(M)`, " \
             "`define_singleton_method`, `class << s`); or, for a receiver typed by its class's name rather than a " \
             "literal, a project subclass that defines the method."
@@ -1087,6 +1089,40 @@ module Rigor
           since: "0.4.0"
         ),
 
+        CheckRules::RULE_PLUGIN_API_SURFACE => Entry.new(
+          id: CheckRules::RULE_PLUGIN_API_SURFACE,
+          summary: "Plugin code calls a member a `Rigor::Plugin` interface does not declare.",
+          fires_when: [
+            "The call's receiver is typed by a `Rigor::Plugin` interface (`_Scope`, `_Environment`, " \
+            "`_Services`, `_FactStore`, `_Configuration`), possibly with `nil`: a hook's `scope`, " \
+            "`scope.environment`, `services.fact_store`, and so on.",
+            "The interface does not declare the called method, and neither does `Object` (with `Kernel` and " \
+            "`BasicObject`).",
+            "The call sits inside a class whose superclass chain reaches `Rigor::Plugin::Base`.",
+            "The `plugin-api-surface` bleeding-edge feature is enabled, or a `severity_overrides:` key names " \
+            "`plugin.api-surface` (the rule resolves `:off` otherwise; a dot-free `plugin` key does not reach it)."
+          ],
+          does_not_fire_when: [
+            "The interface declares the method (`scope.type_of(node)`), or every object answers it " \
+            "(`scope.nil?`, `scope.respond_to?(...)`). A call that a `respond_to?` guard protects still fires.",
+            "The value lost its interface type: a join with an untyped value, a helper parameter with no " \
+            "signature, or the result of a `&.` call on a value that may be nil. It reads as `untyped` there.",
+            "The call is outside a `Rigor::Plugin::Base` subclass, or inside `Rigor::Plugin::Base` itself.",
+            "The `plugin-api-surface` bleeding-edge feature is not enabled (the default)."
+          ],
+          suppression: "`# rigor:disable plugin.api-surface` on the call line, or " \
+                       "`disable: [\"plugin.api-surface\"]` in `.rigor.yml`. The fix is to call a member the " \
+                       "interface declares or a public namespace (`Rigor::Reflection`, ...).",
+          severity_authored: :warning,
+          severity_by_profile: { lenient: :off, balanced: :off, strict: :off },
+          # The receiver's interface type comes from Rigor's own signatures and the member list is the
+          # interface's declaration, so a firing is a call outside the declared surface. It ships `:off`
+          # behind `bleeding_edge:` because it is a new discipline (ADR-50 Decision 3), not for lack of
+          # confidence.
+          evidence_tier: :high,
+          since: "0.4.8"
+        ),
+
         CheckRules::RULE_SUPPRESSION_UNKNOWN_MARKER => Entry.new(
           id: CheckRules::RULE_SUPPRESSION_UNKNOWN_MARKER,
           summary: "A comment uses a suppression marker Rigor does not recognise " \

data/lib/rigor/analysis/run_cache_key.rb

@@ -99,7 +99,8 @@ module Rigor
           gems: [Cache::RbsDescriptor.rbs_gem_entry],
           dependencies: dependency_source_entries(configuration),
           configs: rbs_config_entries + engine_source_entries + lockfile_entries(configuration) +
-                   template_unit_entries(template_units_digest) + shadow_harness_entries + [
+                   collection_setup_hint_entries(configuration) + template_unit_entries(template_units_digest) +
+                   shadow_harness_entries + [
                      config_entry("configuration", Marshal.dump(configuration.to_h)),
                      config_entry("engine",
                                   "#{Rigor::VERSION}:#{Cache::Descriptor::SCHEMA_VERSION}:#{explain}"),
@@ -179,6 +180,24 @@ module Rigor
         [lockfile_entry("bundler.lockfile", bundler), lockfile_entry("rbs_collection.lockfile", collection)]
       end
 
+      # Issue #3030 — the `rbs.coverage.collection-not-installed` hint is a run-level row read off the working
+      # directory (an `rbs_collection.yaml`, a gem_rbs_collection `_test/` layout), which neither the lockfile slot
+      # nor the configuration covers: without this slot a warm run replayed the hint after the file went, or
+      # missed it after the file came. No slot when there is no hint, so every other project keeps its key.
+      def collection_setup_hint_entries(configuration)
+        hint = collection_setup_hint(configuration)
+        hint.nil? ? [] : [config_entry("rbs_collection.setup_hint", hint.to_s)]
+      end
+
+      # The hint {Analysis::Runner::DiagnosticAggregator} reports, read the same way. Shared with
+      # {Cache::IncrementalSnapshot.fingerprint}.
+      def collection_setup_hint(configuration)
+        Environment::RbsCollectionDiscovery.missing_lockfile_hint(
+          lockfile_path: configuration.rbs_collection_lockfile,
+          auto_detect: configuration.rbs_collection_auto_detect
+        )
+      end
+
       # ADR-10 slice 3, issue #1814 — the `dependencies.source_inference` gems' `(name, version, mode)` rows, which the
       # walker's output depends on and no lockfile digest covers when the project has none or the gem sits beside the
       # bundle. Shared by this key and by {Cache::IncrementalSnapshot.fingerprint}, as the lockfiles are. A project
@@ -216,12 +235,17 @@ module Rigor
 
       # The `rbs.libraries` config slot reconstructed from configuration alone — byte-identical to the
       # loader's `RbsDescriptor.libraries_entry(loader.libraries)` because `Environment.for_project` merges
-      # exactly `DEFAULT_LIBRARIES + config.libraries` (uniq) into `loader.libraries`, plus the
+      # exactly {Environment::BaseLibraries.resolve} — `DEFAULT_LIBRARIES + config.libraries` + the collection lockfile
+      # stdlib entries (issue #2946), uniq — into `loader.libraries`, plus the
       # `Environment::RequiredFeatures` tokens the run's source activates (issue #1700). Those are left out
       # here: reading every source file would cost the boot-slimming probe the time it exists to save, and a
       # project that requires a gated feature then only misses this probe, never hits a wrong slot.
       def libraries_config_entries(configuration)
-        merged = (Environment::DEFAULT_LIBRARIES + configuration.libraries.map(&:to_s)).uniq
+        merged = Environment::BaseLibraries.resolve(
+          configuration.libraries,
+          rbs_collection_lockfile: configuration.rbs_collection_lockfile,
+          rbs_collection_auto_detect: configuration.rbs_collection_auto_detect
+        )
         [Cache::RbsDescriptor.libraries_entry(merged)]
       end
     end

data/lib/rigor/analysis/run_disclosure_credit.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../typing_state"
+
 module Rigor
   module Analysis
     # Issue #2020 — what one file's analysis contributed to the run-scoped plugin tables ({Plugin::Base#disclose_once}
@@ -17,16 +19,27 @@ module Rigor
       ATTRIBUTION_KEY = :rigor_run_disclosure_attribution
       private_constant :ATTRIBUTION_KEY
 
+      # ADR-129 WD3 / #2814 — the registrations sink is a Resource: a `type_of` memo hit that served an answer without
+      # re-running the plugin hook would not append the registration the miss appended, so every {.attribute} refuses
+      # each open capture. Its storage stays the thread variable above (ADR-129 WD5 shape 2); this slot declares its
+      # kind.
+      SINK = TypingState.resource(
+        :run_disclosure_attribution,
+        reason: "every run-scoped plugin registration appends to the collecting sink, which a memo hit would not replay"
+      )
+      private_constant :SINK
+
       module_function
 
       # Runs the block with run-scoped registrations attributed and returns the file's records — each a run-disclosure
       # record tagged with its `plugin_id` and carrying the registering plugin's boundary rows as `:reads`, one per
       # `[plugin id, key]` — frozen and Marshal-clean. A thread variable, as {Plugin::IoBoundary.attributing} uses, so a
-      # registration from inside an `Enumerator` still lands.
+      # registration from inside an `Enumerator` still lands, carrying the installing fiber's typing state as
+      # {Plugin::IoBoundary.attributing} does.
       def collect
         registrations = []
         previous = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
-        Thread.current.thread_variable_set(ATTRIBUTION_KEY, registrations)
+        Thread.current.thread_variable_set(ATTRIBUTION_KEY, [registrations, TypingState.current].freeze)
         begin
           yield
         ensure
@@ -35,9 +48,16 @@ module Rigor
         credit(registrations)
       end
 
-      # Called by {Plugin::Base#disclose_once} and {Plugin::Base#emit_once} for every call, a repeat included.
+      # Called by {Plugin::Base#disclose_once} and {Plugin::Base#emit_once} for every call, a repeat included. Touches
+      # {SINK} on the calling fiber's typing state and on the installing fiber's (ADR-129 WD3, #2814).
       def attribute(plugin, record)
-        Thread.current.thread_variable_get(ATTRIBUTION_KEY)&.push([plugin, record])
+        state = TypingState.current
+        state.touch(SINK)
+        registrations, owner = Thread.current.thread_variable_get(ATTRIBUTION_KEY)
+        return nil if registrations.nil?
+
+        owner.touch(SINK)
+        registrations.push([plugin, record])
         nil
       end
 
@@ -63,9 +83,9 @@ module Rigor
       end
 
       # The boundary's file and listing rows, read without triggering its lazy initializer: a plugin that never
-      # built one read nothing through it.
+      # built one read nothing through it. {Plugin::Base#built_io_boundary} is private to the engine, so it is sent.
       def boundary_rows(plugin)
-        boundary = plugin.instance_variable_get(:@io_boundary) or return []
+        boundary = plugin.__send__(:built_io_boundary) or return []
         descriptor = boundary.cache_descriptor
         descriptor.files + descriptor.globs
       end