rigortype 0.3.8 → 0.4.0

data/lib/rigor/analysis/runner/pool_coordinator.rb

@@ -3,12 +3,14 @@
 require "tmpdir"
 
 require_relative "../../environment"
+require_relative "../../project_environment"
 require_relative "../diagnostic"
 require_relative "../worker_session"
 require_relative "../run_stats"
 require_relative "../../effects/signature_sources"
 require_relative "../../rbs_extended/conformance_checker"
 require_relative "../../runtime/jit"
+require_relative "../../cache/engine_source"
 
 module Rigor
   module Analysis
@@ -29,30 +31,21 @@ module Rigor
       # delegated back through an injected `analyze_file` callable so the CheckRules / recorder /
       # plugin-emission machinery stays on the {Runner}.
       class PoolCoordinator # rubocop:disable Metrics/ClassLength
-        # @param configuration [Rigor::Configuration]
-        # @param cache_store [Rigor::Cache::Store, nil]
-        # @param explain [Boolean]
-        # @param workers [Integer]
-        # @param collect_stats [Boolean]
-        # @param buffer [BufferBinding, nil]
-        # @param environment_override [Rigor::Environment, nil]
-        # @param rbs_extended_reporter [RbsExtended::Reporter]
-        # @param boundary_cross_reporter [DependencySourceInference::BoundaryCrossReporter]
-        # @param source_rbs_synthesis_reporter [Plugin::SourceRbsSynthesisReporter]
-        # @param snapshots [RunSnapshots] shared end-of-pass snapshot sink.
-        # @param plugin_registry [#call] reader for the current registry.
-        # @param dependency_source_index [#call] reader.
-        # @param synthetic_method_index [#call] reader.
-        # @param project_patched_methods [#call] reader.
-        # @param project_scope_seed [#call] reader for the cross-file pre-pass seed tables
+        # @param snapshots — shared end-of-pass snapshot sink.
+        # @param plugin_registry — reader for the current registry.
+        # @param dependency_source_index — reader.
+        # @param synthetic_method_index — reader.
+        # @param project_patched_methods — reader.
+        # @param project_scope_seed — reader for the cross-file pre-pass seed tables
         #   (`Runner#project_scope_seed_tables`).
-        # @param analyze_file [#call] `(path, environment) -> diagnostics`.
+        # @param analyze_file — `(path, environment) -> diagnostics`.
         def initialize(configuration:, cache_store:, explain:, workers:, collect_stats:, # rubocop:disable Metrics/ParameterLists
                        buffer:, environment_override:, rbs_extended_reporter:,
                        boundary_cross_reporter:, source_rbs_synthesis_reporter:,
                        snapshots:, plugin_registry:, dependency_source_index:,
                        synthetic_method_index:, project_patched_methods:,
-                       analyze_file:, project_scope_seed: -> { {} }, record_dependencies: false)
+                       analyze_file:, project_scope_seed: -> { {} }, record_dependencies: false,
+                       restored_run_level_rows: nil, template_units: -> { TemplateUnits.empty })
           @configuration = configuration
           @cache_store = cache_store
           @explain = explain
@@ -67,6 +60,11 @@ module Rigor
           # `#collected_effects`, so a pooled run's effect graph is the sequential run's graph.
           @record_effects = configuration.effects_enabled?
           @collected_effects = {}
+          # Issue #1051 — run-scoped plugin disclosures ({Plugin::Base#disclose_once}), keyed
+          # `[plugin id, key]` so the FIRST worker to register a pair wins and every later copy is dropped.
+          # The de-duplication has to happen here, on the parent, because each fork worker owns its own
+          # plugin instances and therefore its own `@run_disclosures` table.
+          @collected_run_disclosures = {}
           @collect_stats = collect_stats
           @buffer = buffer
           @environment_override = environment_override
@@ -79,7 +77,15 @@ module Rigor
           @synthetic_method_index_reader = synthetic_method_index
           @project_patched_methods_reader = project_patched_methods
           @project_scope_seed_reader = project_scope_seed
+          # #392 — read through a proc, like every other runner-owned table here: the units are synthesised
+          # on the parent during the run and handed to the ONE pre-fork {WorkerSession}, so every child
+          # inherits the same compiled bytes.
+          @template_units_reader = template_units
           @analyze_file = analyze_file
+          # Issues #796 / #794 — the previous full run's run-level rows, handed down by
+          # {Analysis::IncrementalSession} on a NARROWED run only (a recheck's closure, a
+          # `--verify-incremental` partition). A full run leaves this nil and derives everything itself.
+          @restored_run_level_rows = restored_run_level_rows
         end
 
         # ADR-46 — the per-file cross-file read records the fork pool captured this run (empty unless
@@ -92,6 +98,25 @@ module Rigor
         # these with its own sequential records before the post-pool fixpoint.
         attr_reader :collected_effects
 
+        # Issue #1051 — the run-scoped disclosures a pool run collected, de-duplicated by `[plugin id, key]`
+        # and in first-registration order. Empty on a sequential run: there the runner's own plugin
+        # registry is the one that registered them, and {Runner} reads it directly.
+        def collected_run_disclosures
+          @collected_run_disclosures.values
+        end
+
+        # Issue #1051 — folds one session's / one worker payload's disclosures in, keeping the first
+        # registration of each `[plugin id, key]` pair. Nothing here inspects the message: two workers that
+        # disclose the same key with differently interpolated text still collapse to one row, which is the
+        # point — the key is the identity a plugin author controls, and an author who interpolates
+        # worker-varying text into a message has authored one disclosure, not N.
+        def merge_run_disclosures(records)
+          Array(records).each do |record|
+            identity = [record[:plugin_id], record[:key]].freeze
+            @collected_run_disclosures[identity] ||= record
+          end
+        end
+
         # ADR-15 Phase 4b — pool mode is enabled when `@workers > 0`. Editor mode (`buffer:` non-nil)
         # silently overrides pool mode to sequential: per design § "Ractor pool mode", the pool's warm-up
         # cost dominates one-file wall time, so the pool gains nothing on a per-buffer invocation. The
@@ -115,47 +140,12 @@ module Rigor
         # sources. The env stays a LOCAL variable (not an ivar) so it goes GC-eligible when the method
         # returns — holding it as long-lived state added memory pressure that surfaced as a Bus Error
         # during the spec suite under Ruby 4.0 + rbs 4.0.2.
-        # @param project_files [Array<String>, nil] issue #784 — the WHOLE project's analyzed file set
-        #   (`expansion.fetch(:files)`), independent of any `analyze_only` narrowing of `files`. Read only
-        #   when `files` is empty, to decide whether anyone could have demanded the HKT registry at all.
+        # @param project_files — issue #784 — the WHOLE project's analyzed file set
+        #   (`expansion.fetch(:files)`), independent of any `analyze_only` narrowing of `files`; see
+        #   {#serve_empty_closure} for what an empty `files` does with it.
         def analyze_files(files, environment: nil, project_files: nil)
           if files.empty?
-            # Issue #784 — an EMPTY analyze set still owes the run its HKT-scan row: the per-file cache never
-            # holds it (`IncrementalSession` caches only `Runner#per_file_diagnostics`, so every run-level row
-            # is regenerated every run), so returning here without recording flips a red project green — and
-            # the shipping `--incremental` path reaches this branch with NO environment in hand on every
-            # warm recheck that changed nothing (`CheckCommand#run_incremental_check` builds its session
-            # without one). So: an environment already in hand is consulted; otherwise one is resolved over
-            # the project's OWN file list — not `[]`, which would drop every plugin-synthesized virtual RBS
-            # (`Environment.collect_virtual_rbs` short-circuits on an empty list) and scan a different type
-            # universe from the one a full run analyses — and only when the project HAS files: with none,
-            # nobody could have demanded a registry, and an empty project keeps paying no env build. Keyed
-            # on the project's files rather than on `analyze_only`, because a recheck over an EMPTY project
-            # narrows to `Set[]`, which is non-nil.
-            env = environment || @environment_override
-            if project_files && !project_files.empty?
-              env ||= resolve_sequential_environment(source_files: project_files)
-            end
-            # #788 rounds 6 and 9 — everything the run owes from its environment that no per-file analysis
-            # produces is taken here, the way `analyze_files_sequentially` takes it: the project-signature
-            # state (`synthesized-namespace`, `quarantined-signature`, `environment-build-failed`, the
-            # conformance results), the effect-annotation carrier the residual pass reads, and the HKT-scan
-            # outcome. Now that run-level rows are never served from the per-file cache, this branch is the
-            # only producer on a warm recheck that changed nothing — leaving any of them out turned a red
-            # project green on its second `--incremental` run (the inline-only `effect.annotations-unchecked`
-            # went 1 → 0; a quarantined `signature_paths:` file went 1 → 0; a `conforms-to` class whose
-            # definition build fails went 1 → 0). Same ORDER as the sequential path, because the order is
-            # the contract: the conformance scan inside the signature-state snapshot demands the definition
-            # of every `rigor:v1:conforms-to` class — a user-authored, invocation-independent demand that
-            # #696 counts — so the definition-build failures are read AFTER it and BEFORE the HKT demand,
-            # exactly where `analyze_files_sequentially` reads them relative to its own. What this branch
-            # cannot regenerate is the part of that set the per-file ANALYSIS demanded (#796). This also
-            # retires the #441 "`.rbs` lane only when the run analyses nothing" boundary: its cost premise
-            # (no environment on this path) stopped holding the moment the branch above resolved one.
-            snapshot_project_signature_state(env)
-            snapshot_effect_annotation_carrier(env&.rbs_loader)
-            record_definition_build_failures(env&.rbs_loader&.definition_build_failures)
-            record_hkt_scan_failure(hkt_scan_outcome(env))
+            serve_empty_closure(environment, project_files)
             return []
           end
           # Issue #784 / #793 — `files` is what this run ANALYSES; `source_files` is what its environment
@@ -166,11 +156,152 @@ module Rigor
           # whose trigger lived in an excluded file's synthesized RBS fired on the full run and vanished on
           # the subset. Every environment and worker this run builds now takes the whole project.
           source_files = project_files || files
-          return dispatch_pool(files, source_files: source_files) if pool_mode?
+          result =
+            if pool_mode?
+              dispatch_pool(files, source_files: source_files)
+            else
+              analyze_files_sequentially(
+                files, environment || resolve_sequential_environment(source_files: source_files)
+              )
+            end
+          # Issues #796 / #794 — a narrowed run's own demand set is a SUBSET of the full run's, so the two
+          # rows below are folded in after it, whichever backend produced the per-file stream.
+          replayed_restored_run_level_rows?(closure: files)
+          result
+        end
 
-          analyze_files_sequentially(
-            files, environment || resolve_sequential_environment(source_files: source_files)
+        # Issue #784 — an EMPTY analyze set still owes the run its run-level rows: the per-file cache never
+        # holds them (`IncrementalSession` caches only `Runner#per_file_diagnostics`), so returning here
+        # without recording flips a red project green — and the shipping `--incremental` path reaches this
+        # branch with NO environment in hand on every warm recheck that changed nothing
+        # (`CheckCommand#run_incremental_check` builds its session without one).
+        #
+        # #788 rounds 6 and 9 — everything the run owes from its environment that no per-file analysis
+        # produces is taken here, the way `analyze_files_sequentially` takes it: the project-signature state
+        # (`synthesized-namespace`, `quarantined-signature`, `environment-build-failed`, the conformance
+        # results), the effect-annotation carrier the residual pass reads, and the HKT-scan outcome. Leaving
+        # any of them out turned a red project green on its second `--incremental` run. Same ORDER as the
+        # sequential path, because the order is the contract: the conformance scan inside the
+        # signature-state snapshot demands the definition of every `rigor:v1:conforms-to` class — a
+        # user-authored, invocation-independent demand that #696 counts — so the definition-build failures
+        # are read AFTER it and BEFORE the HKT outcome.
+        #
+        # Issue #794 — the environment is resolved LAZILY, by the two snapshots that need one and only when
+        # their own gates say so: a project with no `signature_paths:`, no plugin-deferred signatures and no
+        # source-RBS synthesizer now reaches the end of this branch without building an environment at all,
+        # where #788 built one unconditionally to make the HKT demand. Issue #796 — what this branch cannot
+        # derive is the part of the definition-build set the per-file ANALYSIS demanded, and #696 forbids a
+        # Rigor-owned demand from standing in for it; the previous full run's set is replayed instead.
+        # @param project_files — issue #784 — the WHOLE project's analyzed file set
+        #   (`expansion.fetch(:files)`), independent of any `analyze_only` narrowing. Read here to decide
+        #   whether anyone could have demanded anything at all: with no files, nobody could have, and an
+        #   empty project keeps paying no env build. Keyed on the project's files rather than on
+        #   `analyze_only`, because a recheck over an EMPTY project narrows to `Set[]`, which is non-nil.
+        def serve_empty_closure(environment, project_files)
+          env = environment || @environment_override
+          # Resolved over the project's OWN file list — not `[]`, which would drop every plugin-synthesized
+          # virtual RBS (`Environment.collect_virtual_rbs` short-circuits on an empty list) and scan a
+          # different type universe from the one a full run analyses.
+          resolve = lambda do
+            next env if env
+            next nil if project_files.nil? || project_files.empty?
+
+            env = resolve_sequential_environment(source_files: project_files)
+          end
+          snapshot_project_signature_state(signature_state_environment(resolve))
+          snapshot_effect_annotation_carrier(
+            annotation_carrier_environment(resolve, in_hand: !env.nil?)&.rbs_loader
           )
+          # `env` rather than `resolve.call`: read the demand the snapshots above just made when they built
+          # an environment, and force nothing when they did not.
+          record_definition_build_failures(env&.rbs_loader&.definition_build_failures)
+          return if replayed_restored_run_level_rows?
+
+          record_hkt_scan_failure(hkt_scan_outcome(resolve.call))
+        end
+
+        # Issue #794 — the signature-state snapshot's own gates, asked BEFORE an environment exists. Both
+        # answers are loader-free (the configuration and the plugin registry), and with neither gate open
+        # {#snapshot_project_signature_state} writes the same empty state a nil environment gives it.
+        def signature_state_environment(resolve)
+          plugin_signature_paths? || project_signature_paths? ? resolve.call : nil
+        end
+
+        # Issue #794 — the same, for the #441 carrier. The carrier is a filter over the loader's
+        # `virtual_rbs`, and an environment whose loader can hold none of it answers the same empty carrier
+        # a nil environment does. Two ways it can hold some: a plugin registry that declares a synthesizer
+        # (`Environment.collect_virtual_rbs` short-circuits to `[]` without one — and ADR-93 auto-wires
+        # `rigor-rbs-inline`, so this is the shape almost every project is in), or an environment ALREADY in
+        # hand, whose loader is free to read and may carry virtual buffers from a route this coordinator
+        # never saw (a restored env cache, a caller-supplied override). Only the third shape — no
+        # synthesizer AND no environment yet — declines, which is the #794 saving: nothing is built to
+        # discover an emptiness the registry already proves.
+        def annotation_carrier_environment(resolve, in_hand: false)
+          return nil if @record_effects
+          return resolve.call if in_hand
+
+          registry = plugin_registry
+          return nil unless registry.respond_to?(:source_rbs_synthesizers)
+          return nil if registry.source_rbs_synthesizers.empty?
+
+          resolve.call
+        end
+
+        # Issues #796 / #794 — fold the previous full run's run-level rows into this narrowed run's
+        # snapshots. The definition-build set is UNIONed (`#record_definition_build_failures` dedupes by
+        # class), so a class this run demanded for itself and the replayed set agree; the HKT outcome is a
+        # single tuple whoever demanded it, so `||=` keeps this run's own answer when it has one. Returns
+        # true when a replay was available, which is what tells {#serve_empty_closure} it owes no HKT demand
+        # of its own — and so no environment.
+        #
+        # @param closure — the files this run analyses; see {#stale_replayed_failure?}.
+        def replayed_restored_run_level_rows?(closure: nil)
+          rows = @restored_run_level_rows
+          return false if rows.nil?
+
+          replayable = Array(rows.definition_build_failures).reject do |failure|
+            stale_replayed_failure?(failure, closure)
+          end
+          record_definition_build_failures(replayable)
+          record_hkt_scan_failure(rows.hkt_scan_failure)
+          true
+        end
+
+        # A replayed definition-build failure the snapshot's own fingerprint cannot vouch for. The
+        # fingerprint digests the three signature sources it can read WITHOUT an environment — `sig:`,
+        # `Gemfile.lock` / `rbs_collection.lock.yaml`, and the configuration — but NOT the virtual RBS a
+        # source-RBS synthesizer derives from `.rb` files (under ADR-93's auto-wired `rigor-rbs-inline`,
+        # every `#:` annotation). So a duplicate declaration can be REMOVED from a `.rb` file without moving
+        # the fingerprint, and the replayed row would outlive its own cause: the edited file enters the
+        # closure, its analysis demands nothing that would re-derive the row, and the run reports a
+        # collision between files that no longer collide.
+        #
+        # The narrowed run cannot re-derive the row either (#696 forbids Rigor demanding a definition the
+        # analysis did not), so the honest answer is to DROP it and under-report rather than assert a
+        # diagnostic on a program that may now be correct — false positives outrank worst-case reading. The
+        # cost is bounded to the row's own conflicting buffers: a collision between two files neither of
+        # which this run touches still replays.
+        def stale_replayed_failure?(failure, closure)
+          return false if closure.nil?
+
+          buffers = failure.is_a?(Array) ? failure[3] : nil
+          return false if buffers.nil?
+
+          closure_paths = closure.to_set { |path| File.expand_path(path.to_s) }
+          Array(buffers).any? do |name|
+            path = virtual_buffer_path(name)
+            !path.nil? && closure_paths.include?(File.expand_path(path))
+          end
+        end
+
+        # The source file behind a `virtual:<plugin id>:<path>` buffer name
+        # (`Environment.collect_virtual_rbs`), or nil for any other buffer — a `sig:` file, a bundled `.rbs`
+        # — which the fingerprint does cover and which therefore never goes stale under a replay.
+        def virtual_buffer_path(name)
+          parts = name.to_s.split(":", 3)
+          return nil unless parts.length == 3 && parts.first == "virtual"
+
+          parts.last
         end
 
         def analyze_files_sequentially(files, environment)
@@ -206,6 +337,13 @@ module Rigor
         # `.rigor/cache` on a bare `--no-stats` run. The loader has already memoised each answer, so reading
         # them here is free.
         def snapshot_project_signature_state(environment)
+          # Issue #610 — NOT behind the `signature_paths:` gate below: the source a bundled plugin's `sig/`
+          # stands down against is typically an `rbs collection install` the configuration never lists
+          # there. Gated instead on a loaded plugin contributing signatures at all — the registry answers
+          # that without touching the env, and it is exactly the set the loader defers — so a project with
+          # no such plugin reads nothing off its loader here, as before.
+          @snapshots.signature_standdowns =
+            plugin_signature_paths? ? signature_standdowns_for(environment&.rbs_loader) : []
           unless project_signature_paths?
             @snapshots.synthesized_namespaces = []
             @snapshots.quarantined_signatures = []
@@ -279,7 +417,7 @@ module Rigor
         # An effects run (ADR-103 WD13) is pinned for exactly the same reason — the Ractor messages carry
         # no side-table channel — and degrades the same way. The degrade is sound rather than merely safe:
         # the sequential fallback still collects, so the effect graph is complete either way.
-        # @param source_files [Array<String>] the file list every worker's / the fallback's environment is
+        # @param source_files — the file list every worker's / the fallback's environment is
         #   built over — the whole project (issue #793), defaulting to `files` for direct callers.
         def dispatch_pool(files, source_files: files)
           if @record_dependencies || @record_effects
@@ -318,11 +456,7 @@ module Rigor
             rbs_extended_reporter: @rbs_extended_reporter,
             boundary_cross_reporter: @boundary_cross_reporter,
             source_rbs_synthesis_reporter: @source_rbs_synthesis_reporter,
-            bundler_bundle_path: @configuration.bundler_bundle_path,
-            bundler_auto_detect: @configuration.bundler_auto_detect,
-            bundler_lockfile: @configuration.bundler_lockfile,
-            rbs_collection_lockfile: @configuration.rbs_collection_lockfile,
-            rbs_collection_auto_detect: @configuration.rbs_collection_auto_detect,
+            **ProjectEnvironment.dependency_discovery_options(@configuration),
             synthetic_method_index: synthetic_method_index,
             project_patched_methods: project_patched_methods,
             source_files: source_files
@@ -369,6 +503,20 @@ module Rigor
           # (shareable) registry into the class-ivar cache before any worker reads.
           Environment::ClassRegistry.default
 
+          # #1055 — the same treatment for the engine-source digest. Every worker's `Environment.for_project`
+          # reaches `Cache::EngineSource.key_config_entries` whenever a source-RBS synthesizer is wired (the
+          # ADR-93 `rigor-rbs-inline` auto-wire, on by default and off throughout the spec suite), and the
+          # memo behind it is a 90 ms tree walk that cannot be eager-loaded at require time. Warming it here
+          # is what makes the worker's access a READ of a frozen String rather than a forbidden class-ivar
+          # write. `Unavailable` is left to the worker: it raises rather than assigning, so it costs the pool
+          # no more than it costs a sequential run, and swallowing it here would hide a tree the engine
+          # cannot identify.
+          begin
+            Cache::EngineSource.process_identity
+          rescue Cache::EngineSource::Unavailable
+            nil
+          end
+
           # ADR-15 Phase 4b.x — pre-warm the RBS cache so workers serve every reflection query from the
           # Marshal blob on disk. Without this, the first cache MISS inside a worker falls through to
           # `RBS::EnvironmentLoader.new`, which reads a chain of non-`Ractor.shareable?` RubyGems / RBS
@@ -389,15 +537,33 @@ module Rigor
           # finds. `#prewarm_rbs_cache_for_pool` already builds and fully loads exactly this
           # coordinator-side environment (to warm the cache before any worker spawns); it now hands it
           # back so its RBS state can be read the same way the fork pool reads its pre-fork session
-          # environment. The conformance scan inside the snapshot demands the definition of every
-          # `rigor:v1:conforms-to` class — a demand no Ractor worker shares memory with — so a resulting
-          # definition-build failure is recorded explicitly right after, exactly as the empty-closure
-          # branch reads its own environment's demand (#788). No matching explicit call for the HKT-scan
-          # outcome: every worker already demands it from its OWN environment in `#drain_reporters`, and
-          # the scan has one outcome whoever demands it, so a worker's report already says what the
-          # coordinator's own demand would.
-          warm_env = prewarm_rbs_cache_for_pool
+          # environment. The effect-annotation carrier (#441 — the inline stratum of
+          # `effect.annotations-unchecked`, read by the residual pass after this environment is gone) is
+          # taken off the same environment, in the same ORDER as the fork pool and the sequential path
+          # take theirs: it had no producer here either, so an annotation living only in an rbs-inline
+          # comment lost its row under this backend alone. That read is only as good as the environment's
+          # virtual RBS, which is why the prewarm is built the way the workers build theirs (see
+          # {#prewarm_rbs_cache_for_pool}). The conformance scan inside the signature-state snapshot
+          # demands the definition of every `rigor:v1:conforms-to` class — a demand no Ractor worker
+          # shares memory with — so a resulting definition-build failure is recorded explicitly right
+          # after, exactly as the empty-closure branch reads its own environment's demand (#788). No
+          # matching explicit call for the HKT-scan outcome: every worker already demands it from its OWN
+          # environment in `#drain_reporters`, and the scan has one outcome whoever demands it, so a
+          # worker's report already says what the coordinator's own demand would.
+          # #1064 — the lockfile is resolved HERE, once, and travels to every worker as frozen data the way
+          # `source_files` does: Bundler's parser reads RubyGems module state a non-main Ractor may not touch,
+          # so a worker resolving its own raised `Ractor::IsolationError`, printed a "malformed Gemfile.lock"
+          # warning per worker, and analysed with the project's gem signatures silently missing.
+          locked_gems = Ractor.make_shareable(
+            Environment::LockfileResolver.locked_gems(
+              lockfile_path: @configuration.bundler_lockfile,
+              project_root: Dir.pwd,
+              auto_detect: @configuration.bundler_auto_detect
+            )
+          )
+          warm_env = prewarm_rbs_cache_for_pool(source_files: source_files, locked_gems: locked_gems)
           snapshot_project_signature_state(warm_env)
+          snapshot_effect_annotation_carrier(warm_env&.rbs_loader)
           record_definition_build_failures(warm_env&.rbs_loader&.definition_build_failures)
 
           configuration = @configuration
@@ -411,14 +577,15 @@ module Rigor
           shareable_source_files = source_files.map { |path| path.to_s.dup.freeze }.freeze
 
           pool = Array.new(@workers) do
-            Ractor.new(configuration, cache_root, blueprints, explain, shareable_source_files) do |configuration, cache_root, blueprints, explain, shareable_source_files| # rubocop:disable Layout/LineLength
+            Ractor.new(configuration, cache_root, blueprints, explain, shareable_source_files, locked_gems) do |configuration, cache_root, blueprints, explain, shareable_source_files, locked_gems| # rubocop:disable Layout/LineLength
               cache_store = cache_root ? Rigor::Cache::Store.new(root: cache_root) : nil
               session = Rigor::Analysis::WorkerSession.new(
                 configuration: configuration,
                 cache_store: cache_store,
                 plugin_blueprints: blueprints,
                 explain: explain,
-                source_files: shareable_source_files
+                source_files: shareable_source_files,
+                locked_gems: locked_gems
               )
               main = Ractor.main
               main.send([:prepare, session.prepare_diagnostics])
@@ -430,7 +597,10 @@ module Rigor
                 main.send([:file, msg, session.analyze(msg)])
               end
 
-              main.send([:done, session.drain_reporters])
+              # Issue #1051 — sent with `:done`, not with `:prepare`: this backend builds no parent session,
+              # so the worker's own table is the only place a disclosure exists, and it is complete only
+              # once the worker has finished its files.
+              main.send([:done, session.drain_reporters, session.drain_run_disclosures])
             end
           end
 
@@ -464,7 +634,8 @@ module Rigor
             when :file
               results_by_path[message[1]] = message[2]
             when :done
-              merge_worker_reporters(message.last)
+              merge_worker_reporters(message[1])
+              merge_run_disclosures(message[2])
             end
           end
 
@@ -492,6 +663,18 @@ module Rigor
         # definition-build failures the re-analysis demanded (#696) and the HKT-scan outcome, demanded
         # once more by the run itself (#784 — a rescued scan failure otherwise vanished with the worker).
         # The fork backend needs none of this: it re-analyses on the parent {WorkerSession} and drains it.
+        #
+        # Issue #1051, known exception: run-scoped disclosures a plugin registered from `#prepare` are NOT
+        # recovered here — nor, since #1060, a positioned `#emit_once` batch registered there, which rides
+        # the same table. There is no session to drain — this backend builds none on the coordinator — and
+        # `#prepare` deliberately does not run on the coordinator-side registry under pool mode, so a
+        # prepare-time disclosure lives only inside the Ractor that died with it. A disclosure registered
+        # from `#diagnostics_for_file` IS recovered, because the re-analysis below runs the coordinator-side
+        # plugin instances that {DiagnosticAggregator#plugin_run_disclosure_diagnostics} reads directly.
+        # Left as is: recovering the rest means running `#prepare` on the coordinator registry, which would
+        # re-publish every cross-plugin fact for a degrade, and this backend is off by default. Since #1055
+        # the path is also rare rather than universal — it used to be taken on every run, because every
+        # worker died in its constructor on a class-ivar memo.
         def reanalyze_degraded_in_process(degraded, results_by_path, source_files:)
           return if degraded.empty?
 
@@ -529,7 +712,8 @@ module Rigor
             project_patched_methods: project_patched_methods,
             project_scope_seed: project_scope_seed,
             source_files: source_files,
-            record_dependencies: @record_dependencies
+            record_dependencies: @record_dependencies,
+            template_units: template_units
           )
           # Force the full RBS load on the parent so children copy-on-write inherit a warm Environment
           # rather than each rebuilding it after the fork.
@@ -550,6 +734,14 @@ module Rigor
           # same project).
           snapshot_project_signature_state(session.environment)
           snapshot_effect_annotation_carrier(session.environment.rbs_loader)
+          # Issue #1051 — taken BEFORE the fork, for the same reason and with the same effect as the two
+          # snapshots above: `#prepare` ran on the parent when the session was built, so every disclosure a
+          # plugin registers there (the normal case — a disclosure is a fact about the project's inputs,
+          # known before a file is read) is already in this table, in the same order the sequential path
+          # would produce. Each child inherits the identical table and re-offers it in its payload, where
+          # `merge_run_disclosures` drops it as a duplicate; only a disclosure a worker registers while
+          # analysing its own slice adds anything.
+          merge_run_disclosures(session.drain_run_disclosures)
           snapshot_fork_pool_stats(session) if @collect_stats
 
           worker_count = [@workers, files.size].min
@@ -568,6 +760,8 @@ module Rigor
           unless degraded.empty?
             degraded.each { |path| results_by_path[path] = session.analyze(path) }
             merge_worker_reporters(session.drain_reporters)
+            # The degraded slice ran on the parent session, so a disclosure it registered lives there.
+            merge_run_disclosures(session.drain_run_disclosures)
             # The degraded slice was re-analysed on the parent session, so its dependency records live there,
             # not in a child payload — fold them in alongside the successful children's.
             @collected_dependencies.merge!(session.drain_dependencies) if @record_dependencies
@@ -592,7 +786,8 @@ module Rigor
           Runtime::Jit.rearm_after_fork
           results = slice.to_h { |path| [path, session.analyze(path)] }
           payload = { results: results, reporters: session.drain_reporters,
-                      dependencies: session.drain_dependencies }
+                      dependencies: session.drain_dependencies,
+                      disclosures: session.drain_run_disclosures }
           # ADR-103 WD13 — the effects slot exists only on a collecting run, so a normal `--workers N` run
           # marshals exactly the payload it marshalled before the feature existed.
           payload[:effects] = session.drain_effects if @record_effects
@@ -624,6 +819,7 @@ module Rigor
             if payload
               results_by_path.merge!(payload.fetch(:results))
               merge_worker_reporters(payload.fetch(:reporters))
+              merge_run_disclosures(payload.fetch(:disclosures, []))
               @collected_dependencies.merge!(payload.fetch(:dependencies, {})) if @record_dependencies
               @collected_effects.merge!(payload.fetch(:effects, {})) if @record_effects
             else
@@ -633,7 +829,7 @@ module Rigor
           degraded
         end
 
-        # @return [Hash, nil] the child's `{results:, reporters:}` payload, or nil when the child exited
+        # @return the child's `{results:, reporters:}` payload, or nil when the child exited
         #   abnormally or wrote no readable payload. `Marshal.load` is safe here: the blob was written by
         #   our own forked child to a temp file we created.
         def fork_worker_payload(status, out_path)
@@ -658,19 +854,43 @@ module Rigor
         # ADR-15 Phase 4b.x — drives every cached RBS producer on the main Ractor so each worker can serve
         # all reflection queries from disk (Marshal-load only). Builds a single coordinator-side
         # {Environment} for this purpose and returns it fully loaded — issue #798: the caller also reads
-        # the project-signature state off it, since it is the only environment this backend's coordinator
-        # ever holds. Workers still build their OWN `Environment.for_project` inside the Ractor body, which
-        # then routes through `cached_env` instead of `RBS::EnvironmentLoader.new`.
-        def prewarm_rbs_cache_for_pool
+        # the project-signature state and the effect-annotation carrier off it, since it is the only
+        # environment this backend's coordinator ever holds. Workers still build their OWN
+        # `Environment.for_project` inside the Ractor body, which then routes through `cached_env` instead
+        # of `RBS::EnvironmentLoader.new`.
+        #
+        # Built with the loaded plugin registry over the project's WHOLE file list (#793's rule), exactly
+        # as each worker builds its own. `Environment.for_project` collects plugin-synthesized virtual RBS
+        # only when handed BOTH (`collect_virtual_rbs` short-circuits on a nil registry and on an empty
+        # list), and this used to pass neither: its loader's `virtual_rbs` read empty on every project, so
+        # a carrier snapshotted off it would have been `[]` whatever the rbs-inline comments said — the
+        # method called, the row still missing. Two more things follow from building the environment the
+        # workers build: the env-cache descriptor digests the same signature roots (a plugin's
+        # `signature_paths:`) and the same virtual set, so the slot this warms is the slot the workers
+        # read; and each synthesizer runs once here and is memoised through the cache store (ADR-32 WD5)
+        # instead of once per worker.
+        #
+        # Deliberately NOT {#build_runner_environment}: that hands the environment the run's own reporter
+        # accumulators, and an environment BUILD writes to one of them — `collect_virtual_rbs` records a
+        # synthesizer's parse failures and unhonoured annotations on the `source_rbs_synthesis` reporter.
+        # Every Ractor worker builds this same environment with reporters of its own and drains them back
+        # through {#merge_worker_reporters}, whose replay of that stream appends without dedup, so a
+        # coordinator-side reporter here would count each entry once more than the drains already do. The
+        # other two are written only by demands this environment never receives (the HKT scan, per-file
+        # dispatch); all three are withheld together so the no-double-count holds by construction rather
+        # than by which reads happen to be made. The dispatch-only per-run state (the dependency-source
+        # index, the synthetic-method / project-patched indexes) is withheld for the same reason: nothing
+        # here dispatches.
+        # @param source_files — the WHOLE project's file list, never the analyzed subset.
+        def prewarm_rbs_cache_for_pool(source_files:, locked_gems: nil)
           warm_env = Environment.for_project(
             libraries: @configuration.libraries,
             signature_paths: @configuration.signature_paths,
             cache_store: @cache_store,
-            bundler_bundle_path: @configuration.bundler_bundle_path,
-            bundler_auto_detect: @configuration.bundler_auto_detect,
-            bundler_lockfile: @configuration.bundler_lockfile,
-            rbs_collection_lockfile: @configuration.rbs_collection_lockfile,
-            rbs_collection_auto_detect: @configuration.rbs_collection_auto_detect
+            plugin_registry: plugin_registry,
+            source_files: source_files,
+            locked_gems: locked_gems,
+            **ProjectEnvironment.dependency_discovery_options(@configuration)
           )
           warm_env.rbs_loader&.prewarm
           warm_env
@@ -680,11 +900,16 @@ module Rigor
         # (currently: `--no-cache` would force workers through `EnvironmentLoader.new`), degrade to
         # sequential analysis with a `:warning` `pool-degraded` diagnostic at run start. The actual
         # per-file analysis runs on the coordinator, identical to the default sequential path.
-        # @param source_files [Array<String>] issue #793 — the whole project, so this path's environment
+        # @param source_files — issue #793 — the whole project, so this path's environment
         #   carries the same plugin-synthesized RBS the pool workers' would. It used to build over `[]`,
         #   i.e. with no synthesized RBS at all, even on a full run.
         def analyze_files_sequentially_fallback(files, reason:, source_files: files)
           environment = build_runner_environment(source_files: source_files)
+          # Same set, same ORDER as `#analyze_files_sequentially`. The signature state used to be hand-copied
+          # here slot by slot, which dropped `synthesized-namespace` and every conformance row. The conformance
+          # scan inside it demands the definition of every `rigor:v1:conforms-to` class, so it has to run
+          # BEFORE the definition-build failures are read below, or a failure only that scan reaches is lost.
+          snapshot_project_signature_state(environment)
           snapshot_effect_annotation_carrier(environment.rbs_loader)
           diagnostics = files.flat_map { |path| @analyze_file.call(path, environment) }
           loader = environment.rbs_loader
@@ -699,9 +924,6 @@ module Rigor
           record_hkt_scan_failure(hkt_scan_outcome(environment))
           @snapshots.class_decl_paths = loader&.class_decl_paths || {}.freeze
           @snapshots.signature_paths = loader&.signature_paths || [].freeze
-          @snapshots.quarantined_signatures =
-            project_signature_paths? ? (loader&.quarantined_signatures || []) : []
-          @snapshots.env_build_failure = project_signature_paths? ? loader&.env_build_failure : nil
           diagnostics.unshift(
             Diagnostic.new(
               path: ".rigor.yml", line: 1, column: 1,
@@ -723,9 +945,17 @@ module Rigor
           end
           # ADR-32 WD6 — merge per-worker synthesizer failures back into the coordinator's reporter. Fetched
           # with a default empty array so older drains (pre-slice-2) remain compatible.
+          #
+          # `kind:` rides along (issue #824): without it every drained entry replayed as WD6's default
+          # `:failed`, so under `--workers N` a WD12 "parsed but not honoured" row came back as
+          # `source-rbs-synthesis-failed` — a different id, and a message telling the user the file
+          # contributed nothing when all but one of its annotations bound. Every worker reads the same
+          # sources and so hands over the same entries; the reporter's own dedup collapses them. `line:` rides
+          # along for the same reason (#1075): a consistency error is positioned at its `.rbs` member.
           Array(drained[:source_rbs_synthesis]).each do |entry|
             @source_rbs_synthesis_reporter.record(
-              plugin_id: entry.plugin_id, path: entry.path, message: entry.message
+              plugin_id: entry.plugin_id, path: entry.path, message: entry.message, kind: entry.kind,
+              line: entry.line
             )
           end
           # Issue #696. Fetched with a default so an older drain stays compatible, exactly as the line above.
@@ -764,6 +994,18 @@ module Rigor
               message: entry.message, path: entry.path, line: entry.line, column: entry.column
             )
           end
+          replay_deprecated_forms(rbs)
+        end
+
+        # ADR-109 WD3 — the fourth stream, read with the nil default like the hkt one so an older drain
+        # shape records nothing.
+        def replay_deprecated_forms(rbs)
+          Array(rbs[:deprecated_forms]).each do |entry|
+            @rbs_extended_reporter.record_deprecated_form(
+              payload: entry.payload, replacement: entry.replacement,
+              path: entry.path, line: entry.line, column: entry.column
+            )
+          end
         end
 
         # Issue #696 — accumulate the per-class `RBS::DefinitionBuilder` failures this run observed, deduped
@@ -822,8 +1064,7 @@ module Rigor
         # build on a project with no files (see {#analyze_files}). Memoised, so on a reused Environment
         # this is a hash read.
         #
-        # @param environment [Rigor::Environment, nil]
-        # @return [Array, nil] the recorded tuple, or nil (no environment, or the scan built)
+        # @return the recorded tuple, or nil (no environment, or the scan built)
         def hkt_scan_outcome(environment)
           return nil if environment.nil?
 
@@ -838,6 +1079,21 @@ module Rigor
           !(paths.nil? || paths.empty?)
         end
 
+        # Issue #610 — see {#snapshot_project_signature_state}. The registry's `signature_paths` is what
+        # `Environment.for_project` defers, so this is the loader-free form of "is anything deferred?".
+        def plugin_signature_paths?
+          registry = plugin_registry
+          registry.respond_to?(:signature_paths) && !registry.signature_paths.empty?
+        end
+
+        # Empty for a loader with nothing deferred, without touching its env.
+        def signature_standdowns_for(loader)
+          return [] if loader.nil? || !loader.respond_to?(:deferred_signature_paths)
+          return [] if loader.deferred_signature_paths.empty?
+
+          loader.signature_standdowns
+        end
+
         def plugin_registry
           @plugin_registry_reader.call
         end
@@ -854,6 +1110,10 @@ module Rigor
           @project_patched_methods_reader.call
         end
 
+        def template_units
+          @template_units_reader.call
+        end
+
         def project_scope_seed
           @project_scope_seed_reader.call
         end