rigortype 0.2.8 → 0.2.9

data/lib/rigor/cache/store.rb

@@ -7,6 +7,7 @@ require "monitor"
 require "securerandom"
 require "zlib"
 
+require_relative "../version"
 require_relative "descriptor"
 
 module Rigor
@@ -30,6 +31,27 @@ module Rigor
       # bytes.
       FORMAT_VERSION = 2
 
+      # Payload ABI version. Store values are mostly Marshal blobs of Rigor/RBS objects, so a Rigor release
+      # upgrade is an ABI boundary even when the byte layout and descriptor schema are unchanged. Folding the
+      # gem version into the root marker makes installed-version upgrades rebuild rather than silently reuse a
+      # blob whose class layout still happens to unmarshal.
+      PAYLOAD_ABI_VERSION = Rigor::VERSION
+
+      # Whole-project producers are content-keyed, so dependency / signature churn writes a new entry and leaves
+      # the old generation unreachable. The global 256 MB cap is intentionally generous and often never fires on
+      # one project, so these producers get a small generation cap as a second compaction axis. Per-file / plugin
+      # producers are deliberately absent from this table: many current entries under one producer id can be live.
+      GENERATION_CAP_BY_PRODUCER = {
+        "analysis.run-diagnostics" => 16,
+        "rbs.class_ancestor_table" => 2,
+        "rbs.class_type_param_names" => 2,
+        "rbs.constant_type_table" => 2,
+        "rbs.environment" => 2,
+        "rbs.known_class_names" => 2
+      }.freeze
+
+      STALE_TEMP_FILE_AGE_SECONDS = 60 * 60
+
       # Header literal: 5-byte ASCII magic, 1-byte separator, 1-byte format version.
       HEADER = "RIGOR\x00#{FORMAT_VERSION.chr}".b.freeze
 
@@ -37,17 +59,19 @@ module Rigor
 
       # @param root [String] cache root directory.
       # @param read_only [Boolean] when true, every disk-side side-effect is suppressed: `fetch_or_compute`
-      #   still reads existing entries (hits) and still runs the producer block on miss, but it does NOT
-      #   write the produced value to disk, does NOT update the `schema_version.txt` marker, and does NOT
-      #   touch the on-disk root directory. The in-process memo is still populated so repeated lookups within
-      #   the same run stay cheap. Used by editor mode so multiple buffer-mode invocations can read from the
-      #   same cache concurrently without churning it. See `docs/design/20260516-editor-mode.md` § "Cache
-      #   behaviour".
+      #   still reads existing entries (hits, gated on a current `schema_version.txt` marker — see
+      #   {#ensure_schema_version!}) and still runs the producer block on miss, but it does NOT write the
+      #   produced value to disk, does NOT update the marker, and does NOT touch the on-disk root directory.
+      #   The in-process memo is still populated so repeated lookups within the same run stay cheap. Used by
+      #   editor mode so multiple buffer-mode invocations can read from the same cache concurrently without
+      #   churning it. See `docs/design/20260516-editor-mode.md` § "Cache behaviour".
       def initialize(root:, read_only: false, max_bytes: nil)
         @root = root.to_s.dup.freeze
         @read_only = read_only
         @max_bytes = max_bytes&.then { |n| Integer(n) }
-        @schema_version_ensured = false
+        # Tri-state: nil = not yet checked, true/false = the disk tier's availability for this Store's
+        # lifetime (see {#ensure_schema_version!}).
+        @disk_available = nil
         @hits = 0
         @misses = 0
         @writes = 0
@@ -100,7 +124,7 @@ module Rigor
       # the eviction cap forever. Folding the format version into the marker routes the bump through the
       # established clear-the-root path instead.
       def self.schema_marker_value
-        "#{Descriptor::SCHEMA_VERSION}.#{FORMAT_VERSION}"
+        "#{PAYLOAD_ABI_VERSION}.#{Descriptor::SCHEMA_VERSION}.#{FORMAT_VERSION}"
       end
 
       def self.disk_inventory(root:)
@@ -154,7 +178,7 @@ module Rigor
       def fetch_or_compute(producer_id:, params:, descriptor:,
                            serialize: nil, deserialize: nil, &block)
         validate_producer_id!(producer_id)
-        ensure_schema_version!
+        disk = ensure_schema_version!
 
         key = descriptor.cache_key_for(producer_id: producer_id, params: params)
         memo_key = [producer_id, key].freeze
@@ -164,8 +188,8 @@ module Rigor
           return memoed
         end
 
-        path = entry_path(producer_id, key)
-        cached = read_entry(path, deserialize: deserialize)
+        path = disk ? entry_path(producer_id, key) : nil
+        cached = path && read_entry(path, deserialize: deserialize)
         unless cached.nil?
           @monitor.synchronize do
             record(:hits, producer_id)
@@ -175,10 +199,10 @@ module Rigor
         end
 
         value = block.call
-        write_entry(path, descriptor, value, serialize: serialize) unless @read_only
+        wrote = path && try_write_entry(path, descriptor, value, serialize: serialize)
         @monitor.synchronize do
           record(:misses, producer_id)
-          record(:writes, producer_id) unless @read_only
+          record(:writes, producer_id) if wrote
           @memo[memo_key] = value
         end
         value
@@ -195,11 +219,11 @@ module Rigor
       # validation always re-checks the filesystem — but a single run only looks up once.
       def fetch_or_validate(producer_id:, key_descriptor:, params: {}, serialize: nil, deserialize: nil)
         validate_producer_id!(producer_id)
-        ensure_schema_version!
+        disk = ensure_schema_version!
 
         key = key_descriptor.cache_key_for(producer_id: producer_id, params: params)
-        path = entry_path(producer_id, key)
-        cached = read_entry(path, deserialize: deserialize)
+        path = disk ? entry_path(producer_id, key) : nil
+        cached = path && read_entry(path, deserialize: deserialize)
         if cached && (pair = cached.value).is_a?(Array) && pair.size == 2 &&
            pair[1].is_a?(Descriptor) && pair[1].fresh?
           @monitor.synchronize { record(:hits, producer_id) }
@@ -207,17 +231,7 @@ module Rigor
         end
 
         value, dependency_descriptor = block_given? ? yield : [nil, Descriptor.new]
-        wrote = false
-        unless @read_only
-          # A cache write must never break the run. If the value is not Marshal-clean (or any disk error
-          # occurs) skip caching and return the freshly-computed value — the next run recomputes.
-          begin
-            write_entry(path, key_descriptor, [value, dependency_descriptor], serialize: serialize)
-            wrote = true
-          rescue StandardError
-            wrote = false
-          end
-        end
+        wrote = path && try_write_entry(path, key_descriptor, [value, dependency_descriptor], serialize: serialize)
         @monitor.synchronize do
           record(:misses, producer_id)
           record(:writes, producer_id) if wrote
@@ -225,27 +239,30 @@ module Rigor
         value
       end
 
-      # ADR-6 § "Eviction" — LRU pass over the on-disk cache. No-op when `max_bytes:` was not configured or
-      # the store is read-only. Walks all `.entry` files, sorts by mtime ascending (oldest = least recently
-      # used), and unlinks from the oldest until the total is at or below the cap. Touch-on-disk-read
-      # ({read_entry}) is the cross-process LRU signal: every disk hit (not in-process-memo hit) updates the
-      # mtime so recently-read entries survive the eviction pass. Any FS error is swallowed — eviction must
-      # never break a run.
+      # ADR-6 § "Eviction" — compaction pass over the on-disk cache. No-op when the store is read-only. Stale
+      # temp file cleanup and the whole-project generation cap run regardless of `max_bytes:` — they reclaim
+      # provably-dead bytes (leaked temp files, unreachable content-keyed generations) rather than enforcing a
+      # size budget, so an explicitly unbounded store (`max_bytes: nil`) still benefits from them. The
+      # size-based LRU pass below stays gated on `max_bytes:` being configured: it walks all remaining
+      # `.entry` files, sorts by mtime ascending (oldest = least recently used), and unlinks from the oldest
+      # until the total is at or below the cap. Touch-on-disk-read ({read_entry}) is the cross-process LRU
+      # signal: every disk hit (not in-process-memo hit) updates the mtime so recently-read entries survive
+      # the eviction pass. Any FS error is swallowed — eviction must never break a run.
       def evict!
-        return if @max_bytes.nil? || @read_only
+        return if @read_only
 
-        entries = collect_entry_stats
-        total   = entries.sum { |e| e[:bytes] }
+        cleanup_stale_temp_files
+        entries = evict_excess_generations(collect_entry_stats)
+        return if @max_bytes.nil?
+
+        total = entries.sum { |e| e[:bytes] }
         return if total <= @max_bytes
 
         entries.sort_by! { |e| e[:mtime] }
         entries.each do |entry|
           break if total <= @max_bytes
 
-          File.unlink(entry[:path])
-          total -= entry[:bytes]
-        rescue StandardError
-          next
+          total -= entry[:bytes] if unlink_entry(entry[:path])
         end
         nil
       rescue StandardError
@@ -372,38 +389,68 @@ module Rigor
         File.open(path, File::RDWR | File::CREAT, 0o644) do |lock_fd|
           lock_fd.flock(File::LOCK_EX)
           tmp = "#{path}.tmp.#{Process.pid}.#{SecureRandom.hex(4)}"
-          File.open(tmp, "wb") do |f|
-            f.write(body)
-            f.fsync
+          begin
+            File.open(tmp, "wb") do |f|
+              f.write(body)
+              f.fsync
+            end
+            File.rename(tmp, path)
+          ensure
+            # A failed write/rename must not leak its temp file — rely on the 1-hour `cleanup_stale_temp_files`
+            # sweep only as a backstop for crashes that skip this ensure entirely.
+            unlink_entry(tmp) if File.exist?(tmp)
           end
-          File.rename(tmp, path)
+          fsync_directory(File.dirname(path))
         end
       end
 
+      # Checks (and, for a writable store, repairs) the `schema_version.txt` marker, and reports whether the
+      # disk tier is usable for the rest of this Store's lifetime. The result is memoized in `@disk_available`
+      # — one check per Store is enough; a benign double-check under a thread race would just repeat
+      # idempotent work.
+      #
+      # A writable store clears the cache root and rewrites the marker on a stale/missing marker, then reports
+      # available. A read-only store never touches the root — no mkdir, no marker write, no destructive clear
+      # — so it reports available ONLY when the on-disk marker already matches current exactly; a stale or
+      # missing marker (e.g. a Rigor upgrade with no writable run yet, as in LSP / editor mode) reports
+      # unavailable rather than risk unmarshalling a payload from a different ABI. Any filesystem failure
+      # (permission, disk full, deleted root) also reports unavailable, degrading this Store instance to
+      # in-memory-memo-only for the rest of its lifetime — the producer block still runs, its result still
+      # lands in `@memo`, and disk reads/writes are simply skipped.
+      #
+      # @return [Boolean]
       def ensure_schema_version!
-        # Read-only stores never touch the cache root — no mkdir, no marker write, no destructive clear on
-        # schema mismatch. A stale or wrong-schema marker simply yields nothing back (entries read through
-        # the version check are content-keyed, so a write under the new schema never collides with a read
-        # under the old). The next writable run will repair the cache.
-        return if @read_only
-        # The marker is process-stable; one check per Store is enough (a benign double-check under a thread
-        # race just repeats idempotent work).
-        return if @schema_version_ensured
+        return @disk_available unless @disk_available.nil?
+
+        @disk_available = @read_only ? read_only_marker_current? : repair_writable_marker!
+      end
+
+      def read_only_marker_current?
+        marker = File.join(@root, "schema_version.txt")
+        return false unless File.file?(marker)
+
+        File.read(marker).strip == self.class.schema_marker_value
+      rescue StandardError
+        false
+      end
 
-        @schema_version_ensured = true
+      def repair_writable_marker!
         FileUtils.mkdir_p(@root)
         marker = File.join(@root, "schema_version.txt")
         current = self.class.schema_marker_value
 
         if File.file?(marker)
           on_disk = File.read(marker).strip
-          return if on_disk == current
+          return true if on_disk == current
 
           clear_cache_root!
         end
 
         FileUtils.mkdir_p(@root)
         File.write(marker, "#{current}\n")
+        true
+      rescue StandardError
+        false
       end
 
       def clear_cache_root!
@@ -412,6 +459,27 @@ module Rigor
         end
       end
 
+      # Shared write path for both {#fetch_or_compute} and {#fetch_or_validate}. A cache write must never
+      # break the run: filesystem-side failures (permission, disk full, deleted root, read-only mount) are
+      # swallowed and read as "did not write". Programmer errors — a custom serializer that doesn't return a
+      # `String`, or any other producer contract violation — still raise so the bug is visible.
+      def try_write_entry(path, descriptor, value, serialize: nil)
+        return false if @read_only
+
+        write_entry(path, descriptor, value, serialize: serialize)
+        true
+      rescue SystemCallError, IOError
+        false
+      end
+
+      # Best-effort durability for the rename itself. Some platforms cannot fsync directories (or do not need to),
+      # so failures are ignored; the entry envelope still turns any lost/partial write into a miss.
+      def fsync_directory(dir)
+        File.open(dir, File::RDONLY, &:fsync)
+      rescue StandardError
+        nil
+      end
+
       # LEB128 unsigned varint encoder/decoder. Lengths fit easily in five bytes (cap at 2^35); the cache
       # layer never writes a value larger than that in practice.
       def write_varint(bytes, value)
@@ -437,17 +505,66 @@ module Rigor
         nil
       end
 
-      # Returns an array of `{ path:, mtime:, bytes: }` hashes for every `.entry` file under the cache root,
-      # skipping unreadable entries.
+      def cleanup_stale_temp_files
+        cutoff = Time.now - STALE_TEMP_FILE_AGE_SECONDS
+        Dir.glob(File.join(@root, "**", "*.tmp.*")).each do |path|
+          next unless File.file?(path)
+          next if File.mtime(path) > cutoff
+
+          unlink_entry(path)
+        rescue StandardError
+          next
+        end
+      rescue StandardError
+        nil
+      end
+
+      def evict_excess_generations(entries)
+        removed = {}
+        entries.group_by { |entry| entry[:producer] }.each do |producer, producer_entries|
+          cap = GENERATION_CAP_BY_PRODUCER[producer]
+          next if cap.nil? || producer_entries.size <= cap
+
+          producer_entries.sort_by { |entry| [entry[:mtime], entry[:path]] }
+                          .first(producer_entries.size - cap)
+                          .each do |entry|
+            removed[entry[:path]] = true if unlink_entry(entry[:path])
+          end
+        end
+        return entries if removed.empty?
+
+        entries.reject { |entry| removed[entry[:path]] }
+      end
+
+      def unlink_entry(path)
+        File.unlink(path)
+        true
+      rescue StandardError
+        false
+      end
+
+      # Returns an array of `{ path:, producer:, mtime:, bytes: }` hashes for every `.entry` file under the
+      # cache root, skipping unreadable entries.
       def collect_entry_stats
         Dir.glob(File.join(@root, "**", "*.entry")).filter_map do |path|
           stat = File.stat(path)
-          { path: path, mtime: stat.mtime, bytes: stat.size }
+          producer = producer_id_for_entry(path)
+          next nil if producer.nil?
+
+          { path: path, producer: producer, mtime: stat.mtime, bytes: stat.size }
         rescue StandardError
           nil
         end
       end
 
+      def producer_id_for_entry(path)
+        root_prefix = @root.end_with?(File::SEPARATOR) ? @root : "#{@root}#{File::SEPARATOR}"
+        return nil unless path.start_with?(root_prefix)
+
+        producer = path.delete_prefix(root_prefix).split(File::SEPARATOR, 2).first
+        producer.empty? ? nil : producer
+      end
+
       def read_varint(bytes, offset)
         result = 0
         shift = 0

data/lib/rigor/cli/coverage_command.rb

@@ -25,6 +25,8 @@ require_relative "mutation_protection_renderer"
 require_relative "fused_protection_report"
 require_relative "fused_protection_renderer"
 require_relative "coverage_mutation"
+require_relative "protection_fork_scan"
+require_relative "check_runner_factory"
 require_relative "command"
 
 module Rigor
@@ -58,23 +60,32 @@ module Rigor
         return include_dynamic_misuse_error if options[:include_dynamic] && !options[:with_tests]
         return run_mutation_protection(options) if options[:mutation]
 
-        paths = collect_paths(@argv, command_name: "coverage")
+        configuration = Configuration.load(options.fetch(:config))
+        paths = resolve_paths(configuration)
         return CLI::EXIT_USAGE if paths.nil?
         return usage_error if paths.empty?
 
-        return run_protection(paths, options) if options[:protection]
+        return run_protection(paths, options, configuration) if options[:protection]
 
-        report = scan_paths(paths, options)
+        report = scan_paths(paths, configuration)
         CoverageRenderer.new(out: @out).render(report, format: options.fetch(:format))
         determine_exit(report, options)
       end
 
       private
 
+      # Like `rigor check`, fall back to the configured `paths:` when no path is given on the command line
+      # (`coverage` previously required an explicit path — operational friction the two commands should not
+      # differ on). The mutation mode keeps its own git-changed-files default and returns before this.
+      def resolve_paths(configuration)
+        args = @argv.empty? ? configuration.paths : @argv
+        collect_paths(args, command_name: "coverage")
+      end
+
       def parse_options
         options = { format: "text", threshold: nil, config: nil, protection: false, mutation: false,
                     with_tests: false, test_command: DEFAULT_TEST_COMMAND, include_dynamic: false,
-                    limit: nil, seed: 1 }
+                    limit: nil, seed: 1, workers: nil }
         OptionParser.new { |opts| define_options(opts, options) }.parse!(@argv)
         options
       end
@@ -87,6 +98,10 @@ module Rigor
           options[:protection] = true
         end
         define_mutation_options(opts, options)
+        opts.on("--workers=N", Integer, "With --protection: fork N workers over the scanned files " \
+                                        "(default: config parallel.workers / RIGOR_RACTOR_WORKERS / 0)") do |v|
+          options[:workers] = v
+        end
         opts.on("--threshold=RATIO", Float, "Exit 1 when the precision (or, with --protection, " \
                                             "protection/effectiveness) ratio is below RATIO (0.0–1.0)") do |v|
           options[:threshold] = v
@@ -135,23 +150,39 @@ module Rigor
         CLI::EXIT_USAGE
       end
 
-      def run_protection(paths, options)
-        report = scan_protection(paths, options)
+      def run_protection(paths, options, configuration)
+        report = scan_protection(paths, options, configuration)
         ProtectionRenderer.new(out: @out).render(report, format: options.fetch(:format))
         determine_protection_exit(report, options)
       end
 
-      def scan_protection(paths, options)
-        configuration = Configuration.load(options.fetch(:config))
+      # Builds the plugin-aware environment and the seeded scope ONCE on the parent, then fork-pools the
+      # per-file scan across the resolved worker count (P3-10). The scan is pure-read and each file is
+      # independent, so this is a fork-map + ordered reduce: {ProtectionForkScan} returns `{path => result}`
+      # and the parent absorbs in `paths` order so the report is byte-identical to a sequential run.
+      def scan_protection(paths, options, configuration)
         environment = plugin_aware_environment(configuration)
-        scope = scope_with_inferred_params(paths, configuration, environment)
+        workers = CheckRunnerFactory.resolve_workers(options, configuration)
+        scope = scope_with_inferred_params(paths, configuration, environment, workers)
         scanner = Inference::ProtectionScanner.new(scope: scope)
         accumulator = ProtectionAccumulator.new
 
-        paths.each { |path| scan_one(path, scanner, accumulator, configuration) }
+        results = ProtectionForkScan.run(
+          paths: paths, scanner: scanner, environment: environment,
+          configuration: configuration, workers: workers
+        )
+        paths.each { |path| absorb_protection_result(accumulator, path, results.fetch(path)) }
         accumulator.to_report
       end
 
+      def absorb_protection_result(accumulator, path, result)
+        if result.is_a?(ProtectionForkScan::ParseError)
+          accumulator.record_parse_error_count(path, result.count)
+        else
+          accumulator.absorb(path, result)
+        end
+      end
+
       # Seed the protection scan's scope with the same cross-file facts `rigor check` resolves against, so a receiver
       # reads the type it actually has rather than a stripped-scope `Dynamic`:
       #
@@ -168,7 +199,7 @@ module Rigor
       #
       # Both span the scanned `paths` only (no whole-project pre-pass) — a site that gains neither is classified exactly
       # as before.
-      def scope_with_inferred_params(paths, configuration, environment)
+      def scope_with_inferred_params(paths, configuration, environment, workers)
         base = Scope.empty(environment: environment)
         seed = {}
 
@@ -176,7 +207,7 @@ module Rigor
         seed[:discovered_classes] = discovered unless discovered.empty?
 
         table = Inference::ParameterInferenceCollector.collect(
-          files: paths, environment: environment, target_ruby: configuration.target_ruby
+          files: paths, environment: environment, target_ruby: configuration.target_ruby, workers: workers
         )
         seed[:param_inferred_types] = table unless table.empty?
 
@@ -200,31 +231,21 @@ module Rigor
         CLI::EXIT_USAGE
       end
 
-      def scan_paths(paths, options)
-        CoverageScan.precision_report(files: paths, configuration: Configuration.load(options.fetch(:config)))
-      end
-
-      # Delegated to the shared scan module (see {CoverageScan}); the protection path below reuses both, and `rigor
-      # check --coverage` reuses `precision_report` over the same machinery.
-      def project_environment(configuration)
-        CoverageScan.project_environment(configuration)
+      def scan_paths(paths, configuration)
+        CoverageScan.precision_report(files: paths, configuration: configuration)
       end
 
       # The protection scan must see the same receiver types `rigor check` does — including plugin-contributed
       # `dynamic_return` types (a controller's `params` → `ActionController::Parameters`, a `Model.where` →
-      # `ActiveRecord::Relation[Model]`). The bare `project_environment` carries only the RBS environment (no plugin
-      # registry), so every plugin-typed receiver reads `Dynamic` and its dispatch site is miscounted as *unprotected* —
-      # a systematic undercount of what Rigor actually types on a plugin-using project. `ProjectContext` builds the
-      # plugin-aware environment (registry materialised + the per-run prepare pass that primes producers like the
-      # controller / model index) exactly as the LSP and the runner do.
+      # `ActiveRecord::Relation[Model]`). The bare `CoverageScan.project_environment` carries only the RBS environment
+      # (no plugin registry), so every plugin-typed receiver reads `Dynamic` and its dispatch site is miscounted as
+      # *unprotected* — a systematic undercount of what Rigor actually types on a plugin-using project.
+      # `ProjectContext` builds the plugin-aware environment (registry materialised + the per-run prepare pass that
+      # primes producers like the controller / model index) exactly as the LSP and the runner do.
       def plugin_aware_environment(configuration)
         LanguageServer::ProjectContext.new(configuration: configuration).environment
       end
 
-      def scan_one(path, scanner, accumulator, configuration)
-        CoverageScan.scan_into(path, scanner, accumulator, configuration)
-      end
-
       def determine_exit(report, options)
         return 1 unless report.parse_errors.empty?
 

data/lib/rigor/cli/diagnostic_formats.rb

@@ -33,7 +33,9 @@ module Rigor
         FORMATS.include?(format)
       end
 
-      # Renders `result` in the named CI format. Callers gate on {.supports?} first; an unrecognised format returns nil.
+      # Renders `result` in the named CI format. Callers gate on {.supports?} first, so an unrecognised format means
+      # {FORMATS} and the dispatch below have drifted apart — raise rather than return nil, which every caller would
+      # then have to guard.
       def render(result, format)
         case format
         when "sarif" then Sarif.new(result).render
@@ -42,6 +44,7 @@ module Rigor
         when "checkstyle" then Checkstyle.new(result).render
         when "junit" then Junit.new(result).render
         when "teamcity" then Teamcity.new(result).render
+        else raise ArgumentError, "unsupported format: #{format}"
         end
       end
 

data/lib/rigor/cli/protection_fork_scan.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../inference/fork_map"
+
+module Rigor
+  class CLI
+    # Fork-pool for the `rigor coverage --protection` scan (P3-10). The plugin-aware environment and the
+    # seeded scope are built ONCE on the parent — the expensive part: RBS env, plugin registry, and the
+    # cross-file discovery + parameter-inference seed — and children copy-on-write inherit them (via
+    # {Inference::ForkMap}), each analysing a contiguous slice of paths and returning per-path results the
+    # parent merges in original path order.
+    #
+    # The scan is pure-read (no reporter drains, no plugin-emission merge, no prepare diagnostics), so a
+    # slice payload is just `{path => result}`. Determinism: the parent merges slice payloads in slice order
+    # and the accumulator absorbs in `paths` order, so the fused report is byte-identical to a sequential run
+    # regardless of which worker produced which file.
+    module ProtectionForkScan
+      module_function
+
+      # A parse failure for one file, carrying only the marshalable error count (Prism error objects are not
+      # reliably marshalable, and the accumulator only needs the count).
+      ParseError = Data.define(:count)
+
+      # @param paths [Array<String>] the files to scan, in caller order.
+      # @param scanner [Inference::ProtectionScanner] built on the parent; COW-inherited by workers.
+      # @param environment [Rigor::Environment] the scanner's environment, prewarmed here before forking.
+      # @param configuration [Rigor::Configuration] for the Prism `target_ruby` version.
+      # @param workers [Integer] resolved worker count (≤1 → sequential).
+      # @return [Hash{String => Inference::ProtectionScanner::FileResult, ParseError}] one entry per path.
+      def run(paths:, scanner:, environment:, configuration:, workers:)
+        # Force the full RBS load on the parent so children copy-on-write inherit a warm environment rather
+        # than each rebuilding it after the fork (mirrors the check fork pool's parent-side prewarm). A
+        # no-op on the sequential path but cheap.
+        environment.rbs_loader&.prewarm if Inference::ForkMap.parallel?([workers, paths.size].min)
+
+        payloads = Inference::ForkMap.call(items: paths, workers: workers) do |slice|
+          slice.to_h { |path| [path, scan_path(path, scanner, configuration)] }
+        end
+        payloads.each_with_object({}) { |slice_results, merged| merged.merge!(slice_results) }
+      end
+
+      # Parses one file and returns the scanner's {Inference::ProtectionScanner::FileResult}, or a
+      # {ParseError} when the source does not parse.
+      def scan_path(path, scanner, configuration)
+        source = File.read(path)
+        parse_result = Prism.parse(source, filepath: path, version: configuration.target_ruby)
+        return ParseError.new(count: parse_result.errors.size) if parse_result.errors.any?
+
+        scanner.scan(parse_result.value)
+      end
+    end
+  end
+end

data/lib/rigor/cli/protection_report.rb

@@ -86,7 +86,13 @@ module Rigor
       end
 
       def record_parse_error(path, errors)
-        @parse_errors << { "path" => path, "errors" => errors.size }
+        record_parse_error_count(path, errors.size)
+      end
+
+      # Count-based variant for the fork-pool path, where a worker carries only the marshalable error count
+      # (see {ProtectionForkScan::ParseError}), not the Prism error objects.
+      def record_parse_error_count(path, count)
+        @parse_errors << { "path" => path, "errors" => count }
       end
 
       def to_report