rigortype 0.3.8 → 0.4.0

data/lib/rigor/plugin/macro/block_as_method.rb

@@ -36,9 +36,14 @@ module Rigor
       # - `method_names` — Array of Symbol method names. A call shape `<receiver_subclass>.get('/path') { ... }`
       #   matches when `:get` is in this list. (Named `verbs:` before ADR-60 WD2 normalised the macro
       #   value-object vocabulary.)
-      # - `self_type` — Symbol selecting the kind of `self`-binding the substrate applies inside the block.
-      #   Slice 1a accepts only `:receiver_instance` (the block runs as an instance method of the receiver
-      #   class). Other kinds (`:receiver_singleton`, `:dsl_recorder`) are reserved for later slices.
+      # - `self_type` — the `self`-binding the substrate applies inside the block. `:receiver_instance`
+      #   (the default) types `self` as an instance of the receiver class — the Sinatra contract. A String
+      #   binds `self` to a *named* class instead of the receiver: `"Grape::Endpoint"` binds
+      #   `Nominal[Grape::Endpoint]` (the block is `instance_eval`'d on an instance of that class, e.g. a
+      #   route body on `Grape::Endpoint`), and `"singleton(Grape::API::Instance)"` binds
+      #   `Singleton[Grape::API::Instance]` (the block is `instance_eval`'d on that *class object*, e.g.
+      #   a `namespace` body on `Grape::API::Instance`). Reserved Symbol names (`:receiver_singleton`,
+      #   `:dsl_recorder`) remain unaccepted.
       #
       # ## Ractor-shareability
       #
@@ -48,6 +53,13 @@ module Rigor
         SELF_TYPE_RECEIVER_INSTANCE = :receiver_instance
         VALID_SELF_TYPES = [SELF_TYPE_RECEIVER_INSTANCE].freeze
 
+        CLASS_NAME_PATTERN = /[A-Z]\w*(?:::[A-Z]\w*)*/
+        # `self_type: "Foo::Bar"` — the block is `instance_eval`'d on an instance of `Foo::Bar`.
+        NAMED_SELF_TYPE_PATTERN = /\A#{CLASS_NAME_PATTERN}\z/
+        # `self_type: "singleton(Foo::Bar)"` — the block is `instance_eval`'d on the `Foo::Bar` class
+        # object itself (Grape's `namespace`/`route_param` bodies run on `Grape::API::Instance`).
+        SINGLETON_SELF_TYPE_PATTERN = /\Asingleton\((#{CLASS_NAME_PATTERN})\)\z/
+
         attr_reader :receiver_constraint, :method_names, :self_type
 
         def initialize(receiver_constraint:, method_names:, self_type: SELF_TYPE_RECEIVER_INSTANCE)
@@ -57,7 +69,7 @@ module Rigor
 
           @receiver_constraint = receiver_constraint.dup.freeze
           @method_names = method_names.map(&:to_sym).freeze
-          @self_type = self_type
+          @self_type = self_type.is_a?(String) ? self_type.dup.freeze : self_type
           freeze
         end
 
@@ -81,6 +93,31 @@ module Rigor
           [receiver_constraint, method_names, self_type].hash
         end
 
+        # The class name a String `self_type` binds `self` to — `"Foo::Bar"` for both the plain and the
+        # `singleton(Foo::Bar)` form — or `nil` for `:receiver_instance`.
+        def self_type_name
+          return nil unless self_type.is_a?(String)
+
+          self_type[SINGLETON_SELF_TYPE_PATTERN, 1] || self_type
+        end
+
+        # Whether a String `self_type` binds the *class object* (`"singleton(Foo::Bar)"`) rather than an
+        # instance (`"Foo::Bar"`). Nominal-receiver call sites only match instance-binding entries —
+        # a `singleton(...)` binding exists solely for `instance_eval`-on-class contracts, which always
+        # surface as `Singleton[X]` receivers.
+        def singleton_binding?
+          self_type.is_a?(String) && self_type.match?(SINGLETON_SELF_TYPE_PATTERN)
+        end
+
+        # Whether `self_type` names a class whose *instance* the block is `instance_eval`'d on
+        # (`"Foo::Bar"`). These entries are the only ones that also match `Nominal[Y]` receivers: inside
+        # an already-narrowed `instance_eval` body (`self : Nominal[ParamsScope]`), a nested call on
+        # `self` re-enters the same context. `:receiver_instance` keeps its original Singleton-only
+        # contract — a nominal receiver calling a class-level verb is a different (unmodelled) shape.
+        def named_instance_binding?
+          self_type.is_a?(String) && !singleton_binding?
+        end
+
         private
 
         def validate_receiver_constraint!(value)
@@ -108,10 +145,12 @@ module Rigor
 
         def validate_self_type!(self_type)
           return if VALID_SELF_TYPES.include?(self_type)
+          return if self_type.is_a?(String) &&
+                    (self_type.match?(NAMED_SELF_TYPE_PATTERN) || self_type.match?(SINGLETON_SELF_TYPE_PATTERN))
 
           raise ArgumentError,
-                "Plugin::Macro::BlockAsMethod#self_type must be one of #{VALID_SELF_TYPES.inspect}, " \
-                "got #{self_type.inspect}"
+                "Plugin::Macro::BlockAsMethod#self_type must be one of #{VALID_SELF_TYPES.inspect} " \
+                "or a class-name String ('Foo::Bar' / 'singleton(Foo::Bar)'), got #{self_type.inspect}"
         end
       end
     end

data/lib/rigor/plugin/macro/heredoc_template.rb

@@ -152,7 +152,7 @@ module Rigor
         class ReturnsFromArg
           attr_reader :position, :plugin_id, :fact
 
-          # @return [ReturnsFromArg, nil] coerced value class for a Hash / nil / ReturnsFromArg input. Raises
+          # @return coerced value class for a Hash / nil / ReturnsFromArg input. Raises
           #   on any other shape so manifest authoring failures surface at construction time.
           def self.coerce(value)
             return nil if value.nil?

data/lib/rigor/plugin/macro/trait_registry.rb

@@ -105,7 +105,7 @@ module Rigor
           to_h.hash
         end
 
-        # @return [String, nil] fully-qualified module name for the given trait symbol, or nil when the
+        # @return fully-qualified module name for the given trait symbol, or nil when the
         #   registry doesn't know the symbol (caller emits a tier_b.unknown-trait provenance marker and falls
         #   through).
         def module_for(symbol)

data/lib/rigor/plugin/manifest.rb

@@ -42,31 +42,49 @@ module Rigor
       # {Rigor::Effects::Label} accepts as a root.
       VALID_EFFECT_ROOT = /\A[a-z][a-z0-9_]*\z/
 
+      # ADR-96 WD1 — the gems a plugin models, spelled exactly as `Gemfile.lock` names them. Not derivable
+      # from the plugin id (`rigor-factorybot` models `factory_bot`, `rigor-rspec` models `rspec-core`), which
+      # is what makes it a declared field; an empty list is the meaningful answer for a plugin that models no
+      # gem at all.
+      attr_reader :target_gems
+
       attr_reader :id, :version, :description, :config_schema, :config_defaults, :produces, :consumes,
-                  :owns_receivers, :open_receivers, :type_node_resolvers, :block_as_methods,
+                  :owns_receivers, :open_receivers, :rbs_complete_ancestors, :rbs_complete_extends,
+                  :type_node_resolvers,
+                  :block_as_methods,
                   :heredoc_templates, :nested_class_templates, :trait_registries,
                   :hkt_registrations, :hkt_definitions, :signature_paths, :protocol_contracts,
                   :source_rbs_synthesizer, :additional_initializers,
                   :effect_root, :effect_labels, :effect_attributions, :effect_edges, :effect_entry_points,
                   :effect_ancestry
 
-      def initialize( # rubocop:disable Metrics/ParameterLists
+      # #392 — the project-relative globs whose files this plugin compiles into {TemplateUnit}s. Purely a
+      # CLAIM: the engine globs these, reads each match's bytes and offers them to
+      # {Base#template_units_for_file}, which is where the transform itself lives. A plugin declaring none
+      # is never asked, and a run whose plugins declare none does no extra globbing at all.
+      attr_reader :template_globs
+
+      def initialize( # rubocop:disable Metrics/ParameterLists, Metrics/MethodLength
         id:, version:,
-        description: nil, config_schema: {},
-        produces: [], consumes: [], owns_receivers: [], open_receivers: [], type_node_resolvers: [],
+        description: nil, config_schema: {}, target_gems: [],
+        produces: [], consumes: [], owns_receivers: [], open_receivers: [], rbs_complete_ancestors: [],
+        rbs_complete_extends: [], type_node_resolvers: [],
         block_as_methods: [], heredoc_templates: [], nested_class_templates: [],
         trait_registries: [],
         hkt_registrations: [], hkt_definitions: [], signature_paths: [], protocol_contracts: [],
         source_rbs_synthesizer: nil, additional_initializers: [],
         effect_root: nil, effect_labels: [], effect_attributions: [], effect_edges: [],
-        effect_entry_points: [], effect_ancestry: []
+        effect_entry_points: [], effect_ancestry: [], template_globs: []
       )
         validate_id!(id)
         validate_version!(version)
         validate_config_schema!(config_schema)
         validate_produces!(produces)
+        validate_target_gems!(target_gems)
         validate_owns_receivers!(owns_receivers)
         validate_open_receivers!(open_receivers)
+        validate_rbs_complete_ancestors!(rbs_complete_ancestors)
+        validate_rbs_complete_extends!(rbs_complete_extends)
         validate_type_node_resolvers!(type_node_resolvers)
         validate_block_as_methods!(block_as_methods)
         validate_heredoc_templates!(heredoc_templates)
@@ -85,10 +103,12 @@ module Rigor
                       open_receivers, type_node_resolvers, block_as_methods, heredoc_templates, trait_registries,
                       hkt_registrations, hkt_definitions, signature_paths, protocol_contracts,
                       source_rbs_synthesizer)
+        assign_target_gems(target_gems)
+        assign_rbs_complete_ancestors(rbs_complete_ancestors, rbs_complete_extends)
         assign_nested_class_templates(nested_class_templates)
         assign_additional_initializers(additional_initializers)
         assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges,
-                             effect_entry_points, effect_ancestry)
+                             effect_entry_points, effect_ancestry, template_globs)
         freeze
       end
 
@@ -119,6 +139,19 @@ module Rigor
         @source_rbs_synthesizer = source_rbs_synthesizer
       end
 
+      # ADR-96 WD1 — assigned outside assign_fields, which already carries the maximum positional arity.
+      def assign_target_gems(target_gems)
+        @target_gems = target_gems.map { |g| g.to_s.dup.freeze }.uniq.freeze
+      end
+      private :assign_target_gems
+
+      # ADR-43 WD4 — assigned outside assign_fields (which already carries the maximum positional arity).
+      def assign_rbs_complete_ancestors(rbs_complete_ancestors, rbs_complete_extends)
+        @rbs_complete_ancestors = rbs_complete_ancestors.map { |c| c.to_s.dup.freeze }.freeze
+        @rbs_complete_extends = rbs_complete_extends.map { |c| c.to_s.dup.freeze }.freeze
+      end
+      private :assign_rbs_complete_ancestors
+
       # Assigned outside assign_fields (which already carries the maximum positional arity) — set in
       # `initialize` before the final freeze. ADR-36 nested-class emission tier.
       def assign_nested_class_templates(nested_class_templates)
@@ -148,15 +181,27 @@ module Rigor
       private :validate_effect_fields!
 
       def assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges,
-                               effect_entry_points, effect_ancestry)
+                               effect_entry_points, effect_ancestry, template_globs)
         @effect_root = effect_root.nil? ? nil : effect_root.to_s.dup.freeze
         @effect_labels = effect_labels.map { |label| label.to_s.dup.freeze }.uniq.sort.freeze
         @effect_attributions = effect_attributions.dup.freeze
         @effect_edges = effect_edges.dup.freeze
         @effect_entry_points = effect_entry_points.dup.freeze
         @effect_ancestry = effect_ancestry.dup.freeze
+        assign_template_globs(template_globs)
       end
       private :assign_effect_fields
+
+      # #392 — a glob is a String, and an absolute one is refused: a template unit is a project file, and
+      # a plugin reaching outside the project root is the trust boundary ADR-2 § "Plugin Trust and I/O
+      # Policy" draws. Validated and assigned in one call, because `#initialize` is at its line budget.
+      def assign_template_globs(globs)
+        validate_array_of!("template_globs", globs, "non-empty relative glob Strings") do |glob|
+          glob.is_a?(String) && !glob.empty? && !glob.start_with?("/") && !glob.include?("..")
+        end
+        @template_globs = globs.map { |glob| glob.to_s.dup.freeze }.uniq.freeze
+      end
+      private :assign_template_globs
       # rubocop:enable Metrics/ParameterLists, Metrics/AbcSize
 
       public
@@ -182,17 +227,20 @@ module Rigor
         errors
       end
 
-      def to_h # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      def to_h # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/MethodLength
         {
           "id" => id,
           "version" => version,
           "description" => description,
           "config_schema" => config_schema.to_h { |k, v| [k, v.to_s] },
           "config_defaults" => config_defaults,
+          "target_gems" => target_gems,
           "produces" => produces.map(&:to_s),
           "consumes" => consumes.map { |c| consumption_hash(c) },
           "owns_receivers" => owns_receivers,
           "open_receivers" => open_receivers,
+          "rbs_complete_ancestors" => rbs_complete_ancestors,
+          "rbs_complete_extends" => rbs_complete_extends,
           "type_node_resolvers" => type_node_resolvers.map { |r| r.class.name },
           "block_as_methods" => block_as_methods.map(&:to_h),
           "heredoc_templates" => heredoc_templates.map(&:to_h),
@@ -209,7 +257,8 @@ module Rigor
           "effect_attributions" => effect_attributions.map(&:to_h),
           "effect_edges" => effect_edges.map(&:to_h),
           "effect_entry_points" => effect_entry_points.map(&:to_h),
-          "effect_ancestry" => effect_ancestry.map(&:to_h)
+          "effect_ancestry" => effect_ancestry.map(&:to_h),
+          "template_globs" => template_globs
         }
       end
 
@@ -218,10 +267,11 @@ module Rigor
       # otherwise. A third-party plugin's `effect_root:` is ignored here (and warned about by the registry),
       # so it opens only the root named after itself.
       def effect_owner
-        return id if effect_root.nil?
+        root = effect_root
+        return id if root.nil?
         return id unless FirstParty.bundled?(id)
 
-        effect_root
+        root
       end
 
       # Whether this plugin's `effect_attributions:` may carry `discharge: true` (ADR-103 WD6).
@@ -344,6 +394,13 @@ module Rigor
         raise ArgumentError, "plugin manifest #{field} must be an Array of #{label}, got #{value.inspect}"
       end
 
+      # ADR-96 WD1 — every entry is a gem name as `Gemfile.lock` spells it. The uniform Array-of-String check
+      # is all the manifest can do: whether the named gem exists is a fact about RubyGems, not about the
+      # manifest, and a typo surfaces as an advisory that never fires rather than as a load failure.
+      def validate_target_gems!(target_gems)
+        validate_array_of!("target_gems", target_gems, "non-empty String") { |g| g.is_a?(String) && !g.empty? }
+      end
+
       def validate_produces!(produces)
         validate_array_of!("produces", produces, "Symbol/String") { |p| p.is_a?(Symbol) || p.is_a?(String) }
       end
@@ -366,6 +423,32 @@ module Rigor
         validate_array_of!("open_receivers", open_receivers, "non-empty String") { |c| c.is_a?(String) && !c.empty? }
       end
 
+      # ADR-43 WD4 — `rbs_complete_ancestors:` declares the class names this plugin's bundled RBS covers
+      # COMPLETELY: a method call the signature does not declare is genuinely absent at runtime. A
+      # Ruby-source subclass of a listed class may then bridge inherited calls to the ancestor's RBS
+      # (the ADR-43 allow-list's manifest-declared half). The dual of `open_receivers:` — that field
+      # marks a class open to suppress diagnostics on an unbounded surface; this one marks a class
+      # closed to ENABLE them on subclasses. Listing a class whose signature is partial would turn
+      # every omitted inherited method into a `call.undefined-method` false positive on subclass
+      # receivers, so only classes the plugin's `signature_paths:` declares exhaustively belong here.
+      def validate_rbs_complete_ancestors!(rbs_complete_ancestors)
+        validate_array_of!("rbs_complete_ancestors", rbs_complete_ancestors, "non-empty String") do |c|
+          c.is_a?(String) && !c.empty?
+        end
+      end
+
+      # `rbs_complete_extends:` is the extend-edge twin of `rbs_complete_ancestors:` (ADR-43 WD4): it names
+      # the MODULES whose bundled RBS instance surface is complete, so a project `extend M` in a class or
+      # module body lets singleton-side calls on that class resolve M's declared instance methods
+      # (`class F; extend T::Sig; sig { ... }; end` reaching `T::Sig#sig`). Same completeness rule: a
+      # module whose declared surface is partial does not belong here — the extend edge would misreport
+      # real calls as `call.undefined-method`.
+      def validate_rbs_complete_extends!(rbs_complete_extends)
+        validate_array_of!("rbs_complete_extends", rbs_complete_extends, "non-empty String") do |c|
+          c.is_a?(String) && !c.empty?
+        end
+      end
+
       # ADR-13 slice 2 — `type_node_resolvers:` declares the plugin-supplied `TypeNodeResolver` instances the
       # parser consults (in slice 3) when an RBS::Extended payload's named- or generic-type head misses the
       # built-in registry. Slice 2 carries the declarations on the manifest and the registry exposes them in

data/lib/rigor/plugin/registry.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require_relative "blueprint"
+# Issue #806 — {Registry#guarded_manifest} constructs one. `Rigor::Plugin::LoadError` MUST be defined by
+# then: an unresolved bare `LoadError` in this lexical scope silently falls back to Ruby's own ::LoadError.
+require_relative "load_error"
 
 module Rigor
   module Plugin
@@ -217,23 +220,26 @@ module Rigor
     class Registry
       attr_reader :plugins, :load_errors, :blueprints, :contribution_index, :resolved_gem_paths
 
-      # @param plugins [Array<Rigor::Plugin::Base>] instantiated plugin instances in deterministic order.
-      # @param load_errors [Array<Rigor::Plugin::LoadError>] failures surfaced during loading. Each error is
+      # @param plugins — instantiated plugin instances in deterministic order.
+      # @param load_errors — failures surfaced during loading. Each error is
       #   also turned into a diagnostic by the runner.
-      # @param blueprints [Array<Rigor::Plugin::Blueprint>] frozen, Ractor-shareable replay descriptors
+      # @param blueprints — frozen, Ractor-shareable replay descriptors
       #   aligned 1:1 with `plugins`. The loader fills this in; callers that construct Registry manually MAY
       #   pass `[]` and accept that {.materialize} cannot replay the set.
-      # @param resolved_gem_paths [Hash{String=>String,nil}] #194 slice 1 — `gem name => resolved file path`
+      # @param resolved_gem_paths — #194 slice 1 — `gem name => resolved file path`
       #   for each successfully required plugin gem, so `rigor plugins` can print where a loaded (and
       #   possibly frozen) plugin actually loaded from. Defaults to empty; a worker registry built by
       #   {.materialize} carries none (the provenance surface runs only on the coordinator).
       def initialize(plugins: [], load_errors: [], blueprints: [], resolved_gem_paths: {})
         @plugins = plugins.dup.freeze
-        @load_errors = load_errors.dup.freeze
         @blueprints = blueprints.dup.freeze
         @resolved_gem_paths = resolved_gem_paths.dup.freeze
         @contribution_index = ContributionIndex.new(@plugins)
-        compile_aggregates
+        # Issue #806 — every manifest the construction-time aggregates need is read ONCE here, behind a
+        # per-plugin rescue, and a plugin that raises joins `load_errors` instead of taking the run down.
+        manifest_errors = []
+        compile_aggregates(@plugins.map { |plugin| guarded_manifest(plugin, manifest_errors) })
+        @load_errors = (load_errors + manifest_errors).freeze
         # ADR-52 WD4 — the single engine-owned node-rule walk, compiled once per run from the node-rule
         # plugin subset (registry order). The runner reuses it for every file; it builds fresh per-file
         # state internally, so it is safe to freeze and share.
@@ -306,9 +312,14 @@ module Rigor
       # in plugin registration order. `Environment#build_name_scope` builds a `TypeNode::ResolverChain` from
       # this list (environment.rb). The first non-nil `#resolve(node, scope)` return wins per ADR-13 WD3 /
       # WD5 — registration order is the user's lever.
-      def type_node_resolvers
-        plugins.flat_map { |plugin| plugin.manifest.type_node_resolvers }
-      end
+      #
+      # Issue #806 — compiled at construction alongside its `compile_aggregates` siblings, and for a second
+      # reason beyond theirs: `Environment#build_name_scope` demands it during Environment CONSTRUCTION, so
+      # the previous per-call `plugin.manifest` read had no rescue above it anywhere — a plugin raising here
+      # aborted every `Environment.for_project`, i.e. the whole run, before any seam could record it. The
+      # guard has to sit at registry construction because that is the last point at which a failure can still
+      # join `load_errors` (the registry freezes immediately after).
+      attr_reader :type_node_resolvers
 
       # ADR-20 slice 6 — aggregate every loaded plugin's manifest-declared HKT registrations + definitions
       # into a single `Inference::HktRegistry` overlay that `Environment#hkt_registry` merges on top of the
@@ -362,6 +373,30 @@ module Rigor
         @open_receivers_set.include?(class_name.to_s)
       end
 
+      # ADR-43 WD4 — the aggregate set of "RBS-complete ancestor" class names declared across loaded
+      # plugins (manifest `rbs_complete_ancestors:`). `RbsDispatch`'s inherited-call bridge consults it
+      # alongside the engine's own allow-list: a Ruby-source subclass of a listed class resolves
+      # inherited calls against the ancestor's RBS, and the signature-reading rules apply to them.
+      attr_reader :rbs_complete_ancestors
+
+      def rbs_complete_ancestor?(class_name)
+        return false if class_name.nil?
+
+        @rbs_complete_ancestors_set.include?(class_name.to_s)
+      end
+
+      # The extend-edge twin of `rbs_complete_ancestors` — the aggregate set of module names declared via
+      # manifest `rbs_complete_extends:`. `RbsDispatch`'s singleton bridge consults it for `extend M`
+      # edges in project source: `class F; extend T::Sig; sig { ... }; end` resolves `sig` through
+      # `T::Sig`'s bundled RBS instance surface.
+      attr_reader :rbs_complete_extends
+
+      def rbs_complete_extends?(class_name)
+        return false if class_name.nil?
+
+        @rbs_complete_extends_set.include?(class_name.to_s)
+      end
+
       # ADR-28 — flat, ordered list of every loaded plugin's path-scoped method-protocol contracts, in
       # plugin registration order. Read from each plugin's `#protocol_contracts` (which the manifest backs
       # by default but a plugin MAY override to fold in per-project config). Consumed by
@@ -419,15 +454,29 @@ module Rigor
       # compiled once at construction (the registry is frozen, so the flat_map-on-every-call versions
       # re-derived an invariant). `@contracts_by_path` is a mutable per-path memo inside the frozen registry
       # — safe because the contract set and the glob semantics are fixed for the lifetime of the run.
-      def compile_aggregates
-        @additional_initializers = @plugins.flat_map { |p| safe_manifest(p)&.additional_initializers || [] }.freeze
-        @open_receivers = @plugins.flat_map { |p| (safe_manifest(p)&.open_receivers || []).map(&:to_s) }.uniq.freeze
+      #
+      # @param manifests — one entry per plugin, positionally aligned with `@plugins`;
+      #   nil where {#guarded_manifest} caught a raising manifest read.
+      def compile_aggregates(manifests)
+        @additional_initializers = manifests.flat_map { |m| m&.additional_initializers || [] }.freeze
+        @open_receivers = aggregate_class_names(manifests, :open_receivers)
         @open_receivers_set = @open_receivers.to_set.freeze
+        @rbs_complete_ancestors = aggregate_class_names(manifests, :rbs_complete_ancestors)
+        @rbs_complete_ancestors_set = @rbs_complete_ancestors.to_set.freeze
+        @rbs_complete_extends = aggregate_class_names(manifests, :rbs_complete_extends)
+        @rbs_complete_extends_set = @rbs_complete_extends.to_set.freeze
+        @type_node_resolvers = manifests.flat_map { |m| m&.type_node_resolvers || [] }.freeze
         @protocol_contracts = @plugins.flat_map { |p| safe_protocol_contracts(p) }.freeze
         @contracts_by_path = {}
         @effect_memo = {}
       end
 
+      # The shared shape of `open_receivers:` / `rbs_complete_ancestors:` — a flat uniq'd class-name list
+      # aggregated across manifests, each entry normalised to String.
+      def aggregate_class_names(manifests, field)
+        manifests.flat_map { |m| (m&.public_send(field) || []).map(&:to_s) }.uniq.freeze
+      end
+
       # Fail-soft per plugin: a plugin whose `effect_attributions:` override raises (a missing
       # `config/application.rb`, an unreadable path) contributes nothing rather than taking the run down.
       # An effect contribution is an enrichment; ADR-2 isolates plugin failures at the analyzer boundary
@@ -466,6 +515,21 @@ module Rigor
         nil
       end
 
+      # Issue #806 — {#safe_manifest} with a receipt. The construction-time aggregates degraded silently
+      # when a manifest read raised, so a plugin that contributed nothing looked identical to a plugin that
+      # was never asked; the load-error channel is where "a plugin could not be loaded" already lives, and
+      # `Analysis::Runner` turns each entry into one `plugin_loader.load-error` row naming the plugin. The
+      # plugin ref is the CLASS, not `manifest.id`: the manifest is the surface that just failed.
+      def guarded_manifest(plugin, errors)
+        plugin.manifest
+      rescue StandardError => e
+        errors << LoadError.new(
+          "plugin #{plugin.class} raised while reading its manifest: #{e.class}: #{e.message}",
+          plugin_ref: plugin.class.to_s, cause: e
+        )
+        nil
+      end
+
       def safe_protocol_contracts(plugin)
         plugin.protocol_contracts || []
       rescue StandardError

data/lib/rigor/plugin/source_rbs_synthesis_reporter.rb

@@ -21,19 +21,36 @@ module Rigor
       # dropping an annotation it parsed. They are not the same news — the first says the file contributed
       # nothing, the second that it contributed all but one thing — so they carry distinct diagnostic ids.
       # Defaults to `:failed`, the pre-WD12 meaning, so an older caller records what it always did.
-      Entry = Data.define(:plugin_id, :path, :message, :kind)
+      #
+      # `:contradiction` (ADR-112 WD5, issue #1075) is the consistency rule's error: a member two sources
+      # declare in ways that contradict, or a refinement outside its own declared type. It is the one kind
+      # positioned at a real line (`line`, nil for every other kind), because it usually sits in a `.rbs`
+      # file whose positions are exact; the others are file-level rows at line 1.
+      Entry = Data.define(:plugin_id, :path, :message, :kind, :line)
 
       def initialize
         @entries = []
+        @seen = {}
       end
 
-      def record(plugin_id:, path:, message:, kind: :failed)
-        @entries << Entry.new(
+      # Identical entries are collapsed. Each becomes one `:info` row, and two rows saying the same thing
+      # about the same file carry nothing the first does not: the synthesizer's own per-file notices are
+      # already `uniq`, but a worker pool re-runs the whole env build in EVERY worker over the same project
+      # file list and then drains each worker's stream into this one reporter, so without the dedup a
+      # `--workers N` run printed N copies of a row a `--workers=0` run printed once. The same collapse the
+      # {RbsExtended::Reporter} drain documents, for the same reason.
+      def record(plugin_id:, path:, message:, kind: :failed, line: nil)
+        entry = Entry.new(
           plugin_id: plugin_id.to_s.dup.freeze,
           path: path.to_s.dup.freeze,
           message: message.to_s.dup.freeze,
-          kind: kind
+          kind: kind,
+          line: line
         )
+        return nil if @seen.key?(entry)
+
+        @seen[entry] = true
+        @entries << entry
         nil
       end