rigortype 0.3.9 → 0.4.1

data/lib/rigor/analysis/reachability/scan_cache.rb

@@ -5,6 +5,7 @@ require "fileutils"
 require "zlib"
 
 require_relative "../../version"
+require_relative "../../cache/store"
 
 module Rigor
   module Analysis
@@ -36,6 +37,7 @@ module Rigor
           File.expand_path("scan.rb", __dir__),
           File.expand_path(__FILE__)
         ].freeze
+        Ractor.make_shareable(SOURCE_FILES)
 
         # A file modified within this window of the recording instant is computed but never
         # recorded — the FileDigest racy-write guard, one tier simpler because a refused signature
@@ -93,7 +95,7 @@ module Rigor
           keep = @entries.merge(@live).select { |(_, path), _| File.exist?(path) }
           FileUtils.mkdir_p(File.dirname(@path))
           tmp = "#{@path}.#{Process.pid}.tmp"
-          File.binwrite(tmp, Zlib::Deflate.deflate(Marshal.dump([@header, keep])))
+          File.binwrite(tmp, Zlib::Deflate.deflate(Marshal.dump([@header, keep]), Cache::Store::DEFLATE_LEVEL))
           File.rename(tmp, @path)
           nil
         rescue StandardError

data/lib/rigor/analysis/rule_catalog.rb

@@ -656,6 +656,90 @@ module Rigor
           since: "0.1.2"
         ),
 
+        CheckRules::RULE_GLOBAL_WRITE_TYPE_MISMATCH => Entry.new(
+          id: CheckRules::RULE_GLOBAL_WRITE_TYPE_MISMATCH,
+          summary: "A special global is assigned a literal its setter rejects (TypeError at runtime).",
+          fires_when: [
+            "The write is `$g = literal` to a special whose setter checks the value: `$/` / `$-0`, `$,` and " \
+            "`$\\` (a String or nil), `$;` / `$-F` (a String, a Regexp, nil, or an object with `to_str`), `$~` " \
+            "(a MatchData or nil), `$0` / `$PROGRAM_NAME` (a String or an object with `to_str`), `$.` (an " \
+            "Integer, a Float, or an object with `to_int`), `$-i` (a String, nil, false, or an object with " \
+            "`to_str`), and `$stdout` / `$>` / `$stderr` (an object that responds to `write`, ADR-117 WD2).",
+            "The value is a literal node — an Integer, Float, Rational or imaginary literal, a String, Symbol " \
+            "or Regexp literal (interpolated or not), an Array or Hash literal, or `nil` / `true` / `false`, " \
+            "parenthesised or not — whose class the setter does not take: `$/ = 1`, `$/ = /x/`, `$~ = \"x\"`, " \
+            "`$0 = nil`, `$. = \"3\"`, `$stdout = 1`.",
+            "Where the setter also converts (`to_str`, `to_int`) or asks for `write`, the literal's object " \
+            "cannot answer that method: RBS gives its class neither the method nor a `method_missing` / " \
+            "`respond_to_missing?` / `respond_to?` of its own, and the program defines none of them anywhere.",
+            "The envelope is the interpreter's setter, not the global's RBS declaration: `$/ = /x/` fires " \
+            "although `$;` takes a Regexp."
+          ],
+          does_not_fire_when: [
+            "The special's setter accepts every value: `$stdin` (never checked, ADR-117 WD2), `$_`, `$VERBOSE`, " \
+            "`$DEBUG`, `$=`; nor `$@`, whose setter depends on whether `$!` is set.",
+            "The value is not a literal — a variable, a method call, a constant, a conditional — whatever its " \
+            "inferred type: a class RBS declares without `write` or `to_str` does not prove the object lacks it.",
+            "RBS gives the literal's class the method or a hatch of its own (a `sig/` reopening or `include` " \
+            "counts).",
+            "The program — any project or `pre_eval:` file — defines the method or a `method_missing` / " \
+            "`respond_to_missing?` / `respond_to?` anywhere, in any spelling (`def`, `define_method`, " \
+            "`define_singleton_method`, `alias`, `alias_method`, `attr_*`, a delegation macro, a string `eval`, " \
+            "the same through `send`) and on any receiver, or defines a method whose name no literal spells (a " \
+            "computed `define_method` or `send` name, a string `eval` whose code is not a plain literal, a name " \
+            "whose bytes are not valid in its encoding). " \
+            "This is blanket: no census of where a definition lands can be complete, so the literal of every " \
+            "class declines, whatever the definition's owner.",
+            "An ancestor's surface is rewritten from outside (`Integer.include(M)`, `Object.include(M)`, a string " \
+            "`class_eval`), or a top-level `include` / `prepend` / `extend`, or an ancestor's `include`, names a " \
+            "module RBS does not rule out.",
+            "For `$stdout` / `$>` / `$stderr`, a refinement that may add `write`, to any class, and a `using` in " \
+            "effect at the write. Which class it refines is not followed. The `to_str` / `to_int` conversions, and a " \
+            "refined `respond_to_missing?` / `respond_to?`, ignore refinements, so those still fire.",
+            "Any project or `pre_eval:` file aliases the special (`alias $stdout $out`, on either side).",
+            "The write is `$g op= v`, `$g ||= v`, `$g &&= v`, a multiple-assignment target, a `for` index, or a " \
+            "`rescue => $g` reference: their value is not type-checked.",
+            "The write sits in the dead arm of a decidable version guard. Other code that never runs (`if " \
+            "false`, after `return`) is not recognised, and a write there still fires."
+          ],
+          suppression: "`# rigor:disable global.write-type-mismatch` on the write.",
+          severity_authored: :error,
+          severity_by_profile: { lenient: :warning, balanced: :error, strict: :error },
+          # A literal's class is exact, the setter's envelope is the running interpreter's, and every way a program can
+          # give the object the method the setter asks for declines; the write then raises every time it runs.
+          evidence_tier: :high,
+          since: "0.4.0"
+        ),
+
+        CheckRules::RULE_GLOBAL_READONLY_WRITE => Entry.new(
+          id: CheckRules::RULE_GLOBAL_READONLY_WRITE,
+          summary: "A read-only special global is written (NameError at runtime).",
+          fires_when: [
+            "The write is `$g = value`, `$g op= value`, or a target of a multiple assignment (`$g, x = ...`, " \
+            "`*$g`) — forms that always write — to a special Ruby defines read-only: `$!`, `$$`, `$?`, `$<`, " \
+            "`$FILENAME`, `$*`, `$:` / `$LOAD_PATH` / `$-I`, `$\"` / `$LOADED_FEATURES`, `$-W`, `$-p`, `$-l`, " \
+            "`$-a`.",
+            "Whatever the value: the setter raises `NameError` (`$! is a read-only variable`) before it " \
+            "looks at it."
+          ],
+          does_not_fire_when: [
+            "The write is `$g ||= v` or `$g &&= v`, which writes only when the current value is falsy " \
+            "(truthy): `$LOAD_PATH ||= []` never writes.",
+            "The write is a `for` index or a `rescue => $g` reference.",
+            "Any project or `pre_eval:` file aliases the special (`alias $! $err`, on either side), which can " \
+            "make the name another variable.",
+            "Mutating the value is not a write: `$LOAD_PATH << dir` and `$LOADED_FEATURES.delete(f)` stay silent.",
+            "The write sits in the dead arm of a decidable version guard. Other code that never runs is not " \
+            "recognised, and a write there still fires."
+          ],
+          suppression: "`# rigor:disable global.readonly-write` on the write.",
+          severity_authored: :error,
+          severity_by_profile: { lenient: :error, balanced: :error, strict: :error },
+          # Syntactic: the name alone decides it, and the write raises every time it runs.
+          evidence_tier: :high,
+          since: "0.4.0"
+        ),
+
         CheckRules::RULE_SUPPRESSION_UNKNOWN_RULE => Entry.new(
           id: CheckRules::RULE_SUPPRESSION_UNKNOWN_RULE,
           summary: "A `# rigor:disable[-file]` comment names a rule that does not exist.",
@@ -896,6 +980,48 @@ module Rigor
           since: "0.3.4"
         ),
 
+        CheckRules::RULE_CONTRADICTING_SIGNATURE => Entry.new(
+          id: CheckRules::RULE_CONTRADICTING_SIGNATURE,
+          summary: "Two declarations of one method provably contradict: no value or call satisfies both.",
+          fires_when: [
+            "A method is declared both in the project's `sig/` and by an inline `# @rbs` / `#:` " \
+            "annotation, and the return or a parameter every call must pass holds two proven-disjoint " \
+            "types — distinct literals, a literal outside such a class, or two classes written absolutely " \
+            "whose RBS comes from Ruby core or the stdlib, neither an RBS ancestor of the other " \
+            "(`::String` against `::Integer`) — or the two keyword-free declarations accept " \
+            "positional counts that cannot meet, or one requires a keyword the other cannot take in any " \
+            "form. Several overloads are paired by correspondence, never by order. Positioned at the " \
+            "`.rbs` member; Rigor reads that declaration.",
+            "A member-level `%a{rigor:v1:return: …}` or `%a{rigor:v1:param: …}` refinement is proven " \
+            "disjoint from the type its own member declares, in every overload it applies to " \
+            "(`rigor:v1:return: positive-int` on `-> String`)."
+          ],
+          does_not_fire_when: [
+            "One declaration refines the other (`String` against `non-empty-string`, `Symbol` against " \
+            "`:asc | :desc`, `bool` against `TrueClass`): the two merge to the more precise one, silently.",
+            "Either side is `untyped`, `void` or `top` in that position — consistent with everything.",
+            "Rigor cannot prove the two contradict: a module or interface on either side, a class the " \
+            "project declares (in `sig/`, inline or only in Ruby), a gem's class, any relative class name, " \
+            "two element types of one generic class, a type alias, `self`, a type variable, a proc, an " \
+            "optional or rest position, any block position, overloads that do not pair one to one, or " \
+            "differently shaped parameter lists that still overlap. The " \
+            "inline signature is then dropped and reported as `source-rbs-annotation-not-honoured` (info).",
+            "A refinement is written on one overload rather than on the member: call sites do not honour it.",
+            "Two `.rbs` files declare the same method (that fails the class's definition build, " \
+            "`rbs.coverage.definition-build-failed`), or a project `.rbs` collides with bundled RBS " \
+            "(the file is quarantined, `rbs.coverage.quarantined-signature`)."
+          ],
+          suppression: "`disable: [\"rbs.contradicting-signature\"]` in `.rigor.yml`, or a baseline entry. A " \
+                       "`# rigor:disable` comment does not reach a row positioned in a `.rbs` file. The real " \
+                       "fix is to regenerate the stale signature or correct the annotation.",
+          severity_authored: :error,
+          severity_by_profile: { lenient: :error, balanced: :error, strict: :error },
+          # Both sides are authored declarations, and a firing needs a proof that no value or call satisfies
+          # both — the ADR-35 both-sides-authored construction, with every doubt routed to the `:info` row.
+          evidence_tier: :high,
+          since: "0.4.0"
+        ),
+
         CheckRules::RULE_SUPPRESSION_UNKNOWN_MARKER => Entry.new(
           id: CheckRules::RULE_SUPPRESSION_UNKNOWN_MARKER,
           summary: "A comment uses a suppression marker Rigor does not recognise " \
@@ -925,6 +1051,7 @@ module Rigor
           since: "0.3.0"
         )
       }.freeze
+      Ractor.make_shareable(ENTRIES)
 
       module_function
 

data/lib/rigor/analysis/run_cache_key.rb

@@ -21,6 +21,7 @@ require_relative "../environment/default_libraries"
 # lockfile paths without loading `rigor/environment` or the RBS machinery.
 require_relative "../environment/lockfile_resolver"
 require_relative "../environment/rbs_collection_discovery"
+require_relative "shadow_harness"
 
 module Rigor
   module Analysis
@@ -82,15 +83,23 @@ module Rigor
 
       # @param rbs_config_entries — the RBS-derived config slots
       #   (`rbs.libraries` [+ `rbs.virtual_rbs`]). nil on any failure so a malformed key disables the cache.
-      def descriptor(configuration:, files:, explain:, rbs_config_entries:)
+      # @param template_units_digest — #392 — the run's template-unit identity
+      #   ({Analysis::TemplateUnits#digest}: every unit's source bytes + transform id + synthesis version).
+      #   nil for a project whose plugins declare no `template_globs:`, which is every project today, and a
+      #   nil contributes NO slot — so no existing key moves. A project that DOES have units produces a key
+      #   the ADR-87 boot-slim probe (which loads no plugin and so passes nil) cannot reconstruct: the probe
+      #   simply misses and the full path takes over, the same forgone-fast-lane trade the `rbs.virtual_rbs`
+      #   slot already makes, and never a wrong hit.
+      def descriptor(configuration:, files:, explain:, rbs_config_entries:, template_units_digest: nil)
         Cache::Descriptor.new(
           gems: [Cache::RbsDescriptor.rbs_gem_entry],
-          configs: rbs_config_entries + engine_source_entries + lockfile_entries(configuration) + [
-            config_entry("configuration", Marshal.dump(configuration.to_h)),
-            config_entry("engine",
-                         "#{Rigor::VERSION}:#{Cache::Descriptor::SCHEMA_VERSION}:#{explain}"),
-            config_entry("paths", files.sort.join("\n"))
-          ]
+          configs: rbs_config_entries + engine_source_entries + lockfile_entries(configuration) +
+                   template_unit_entries(template_units_digest) + shadow_harness_entries + [
+                     config_entry("configuration", Marshal.dump(configuration.to_h)),
+                     config_entry("engine",
+                                  "#{Rigor::VERSION}:#{Cache::Descriptor::SCHEMA_VERSION}:#{explain}"),
+                     config_entry("paths", files.sort.join("\n"))
+                   ]
         )
       rescue StandardError
         nil
@@ -104,11 +113,21 @@ module Rigor
       #
       # {Cache::EngineSource::Unavailable} is left to propagate into `descriptor`'s rescue, which disables
       # the cache for the run: an engine we cannot identify must not be keyed by its version alone.
-      def engine_source_entries
-        identity = Cache::EngineSource.process_identity
-        return [] if identity.nil?
+      def template_unit_entries(digest)
+        digest.nil? ? [] : [config_entry("template-units", digest)]
+      end
 
-        [config_entry("engine-source", identity)]
+      # ADR-116 WD5 — a run under `RIGOR_SHADOW_RULE_WALK` compares every table and rule collector with its
+      # legacy oracle, and a divergence is a row of the result. Keying on it keeps a warm hit from answering
+      # for a run the harness never checked, and a divergence row from replaying into a run without it. No
+      # slot with the harness off, so no existing key moves.
+      def shadow_harness_entries
+        identity = ShadowHarness.cache_identity
+        identity.nil? ? [] : [config_entry("shadow-harness", identity)]
+      end
+
+      def engine_source_entries
+        Cache::EngineSource.key_config_entries
       end
 
       # Issue #564 — the two dependency lockfiles, BY CONTENT. Both are inputs to the run's diagnostics and
@@ -128,16 +147,25 @@ module Rigor
       # Content-only — the resolved PATH is deliberately not in the payload, so a checkout that moves (a CI
       # runner's workspace, a renamed directory) still hits with an identical lockfile.
       def lockfile_entries(configuration)
-        bundler = Environment::LockfileResolver.resolve_lockfile_path(
-          lockfile_path: configuration.bundler_lockfile, auto_detect: configuration.bundler_auto_detect
-        )
-        collection = Environment::RbsCollectionDiscovery.resolve_lockfile_path(
-          lockfile_path: configuration.rbs_collection_lockfile,
-          auto_detect: configuration.rbs_collection_auto_detect
-        )
+        bundler, collection = resolved_lockfile_paths(configuration)
         [lockfile_entry("bundler.lockfile", bundler), lockfile_entry("rbs_collection.lockfile", collection)]
       end
 
+      # The one resolution of the two dependency lockfiles — `[bundler, rbs_collection]`, each a Pathname or nil
+      # — shared by this key and by {Cache::IncrementalSnapshot.fingerprint} so the two caches identify the gem
+      # set by the same files (issue #1532): `bundler.lockfile:` / `rbs_collection.lockfile:` and auto-detection.
+      def resolved_lockfile_paths(configuration)
+        [
+          Environment::LockfileResolver.resolve_lockfile_path(
+            lockfile_path: configuration.bundler_lockfile, auto_detect: configuration.bundler_auto_detect
+          ),
+          Environment::RbsCollectionDiscovery.resolve_lockfile_path(
+            lockfile_path: configuration.rbs_collection_lockfile,
+            auto_detect: configuration.rbs_collection_auto_detect
+          )
+        ]
+      end
+
       # `nil` — no lockfile resolves — is itself part of the identity, so it carries its own sentinel rather
       # than dropping the slot: "absent" and "present but empty" must not key the same.
       ABSENT_LOCKFILE = "\0absent"

data/lib/rigor/analysis/run_stats.rb

@@ -95,12 +95,12 @@ module Rigor
       # with any of the signature path prefixes (after expansion to absolute paths); `bundled` is the
       # remainder.
       def self.partition_classes(class_decl_paths:, signature_paths:)
-        prefixes = Array(signature_paths).map { |p| File.expand_path(p.to_s) }
+        prefixes = Array(signature_paths).map { |p| File.absolute_path(p.to_s) }
         return [0, class_decl_paths.size] if prefixes.empty?
 
         project = 0
         class_decl_paths.each_value do |path|
-          expanded = File.expand_path(path)
+          expanded = File.absolute_path(path)
           project += 1 if prefixes.any? { |prefix| expanded.start_with?("#{prefix}/") || expanded == prefix }
         end
         [project, class_decl_paths.size - project]

data/lib/rigor/analysis/runner/diagnostic_aggregator.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "../check_rules/rule_ids"
 require_relative "../crash_signature"
 require_relative "../diagnostic"
 require_relative "../severity_stamp"
@@ -39,7 +40,9 @@ module Rigor
         #   (`[error_class, first_error_line, conflicting_buffer_names]`) or nil when the env built.
         # @param definition_build_failures_snapshot — issue #696 — reader returning the per-class
         #   `RBS::DefinitionBuilder` failures the run observed, as `[class_name, error_class, member,
-        #   conflicting_buffer_names]` tuples. Empty for a healthy sig set.
+        #   conflicting_buffer_names, unresolved_type_name_detail]` tuples (issue #997 added the fifth
+        #   element — `[token, location, refinement_hint]`, `nil` unless `error_class` is
+        #   `RBS::NoTypeFoundError`). Empty for a healthy sig set.
         # @param hkt_scan_failure_snapshot — issue #784 — reader returning the `[error_class_name,
         #   first_message_line, raw_frame_or_nil, stage]` tuple whichever stage of the HKT-registry build
         #   raised, or nil when both built (or were never demanded). `stage` is `:scan` (the RBS `type`-alias
@@ -51,7 +54,8 @@ module Rigor
                        pre_eval_diagnostics_from_scanner:, synthesized_namespaces_snapshot:,
                        quarantined_signatures_snapshot:, env_build_failure_snapshot:,
                        definition_build_failures_snapshot:, hkt_scan_failure_snapshot:,
-                       conformance_results_snapshot:, signature_standdowns_snapshot: -> { [] })
+                       conformance_results_snapshot:, signature_standdowns_snapshot: -> { [] },
+                       pooled_run_disclosures: -> { [] })
           @configuration = configuration
           @rbs_extended_reporter = rbs_extended_reporter
           @boundary_cross_reporter = boundary_cross_reporter
@@ -68,6 +72,9 @@ module Rigor
           @definition_build_failures_snapshot_reader = definition_build_failures_snapshot
           @hkt_scan_failure_snapshot_reader = hkt_scan_failure_snapshot
           @conformance_results_snapshot_reader = conformance_results_snapshot
+          # Issue #1051 — reader for the pool coordinator's de-duplicated run-scoped disclosure table.
+          # Empty on a sequential run, where `plugin_registry`'s own instances are the ones that registered.
+          @pooled_run_disclosures_reader = pooled_run_disclosures
         end
 
         # Pre-file diagnostic streams that fire once per run rather than per analyzed file: plugin load /
@@ -441,8 +448,9 @@ module Rigor
         # "Explicit conformance directive"). A class that declares `conforms-to _Interface` but is missing
         # a required interface method surfaces as `rbs_extended.unsatisfied-conformance`; an unresolvable
         # interface name surfaces as `dynamic.rbs-extended.unresolved` `:info` (the same fail-soft channel
-        # the other directive parsers use). Empty for a project with no directive, a well-formed
-        # conformance, or a non-sequential pool run (the snapshot mirrors `synthesized_namespaces`).
+        # the other directive parsers use). Empty for a project with no directive or a well-formed
+        # conformance; every analysis path, pooled or degraded, takes the snapshot `synthesized_namespaces`
+        # comes from.
         def conforms_to_diagnostics
           results = conformance_results_snapshot
           return [] if results.nil? || results.empty?
@@ -585,22 +593,50 @@ module Rigor
         end
 
         # The closing advice follows the FIRST failure's error class: `GenericParameterMismatchError` is two
-        # declarations of one CLASS at different generic arity (#610), and "remove the duplicate member"
-        # sends its reader after a member that does not exist.
+        # declarations of one CLASS at different generic arity (#610); `NoTypeFoundError` (issue #997) is
+        # ONE declaration naming a type that does not exist, which "remove the duplicate declaration" sends
+        # its reader after a duplicate that is not there — the fifth tuple element
+        # ({RbsLoader#unresolved_type_name_detail}) is non-nil for exactly that case. Every other error class
+        # (the two duplicated-definition errors, `RecursiveAncestorError`, …) keeps the duplicate-declaration
+        # wording, which is accurate for them.
         def definition_build_advice(failure)
-          _, error_class, = failure
+          _, error_class, _member, _buffers, unresolved = failure
           if error_class.to_s.end_with?("GenericParameterMismatchError")
             "Two signature sources declare the class with a different number of type parameters; make " \
               "the declarations agree (`rbs validate`) to restore type coverage."
+          elsif unresolved
+            unresolved_type_name_advice(unresolved)
           else
             "Two signature sources declare the same member; remove the duplicate declaration " \
               "(`rbs validate`) to restore type coverage."
           end
         end
 
-        # `[class_name, error_class, member, buffers]`. The member is nil for the error classes that carry no
-        # name at all (`RecursiveAncestorError`), and the clause then names the error class alone rather than
-        # inventing a member.
+        # Issue #997 — `unresolved` is {RbsLoader#unresolved_type_name_detail}'s `[token, location,
+        # refinement_hint]`. `refinement_hint` turns the message into a fix: the token is not a typo to
+        # chase down but the start of a Rigor refinement name that is not valid in an RBS type position, and
+        # the reader is told the spelling that IS valid today. Without a hint, the token is named with its
+        # position and the reader is left with the same "not a duplicate" correction plus a typo/missing-load
+        # check — still narrower than the duplicate-declaration wording it replaces.
+        def unresolved_type_name_advice(unresolved)
+          token, location, refinement_hint = unresolved
+          position = location ? " at `#{location}`" : ""
+          if refinement_hint
+            "`#{token}`#{position} does not name a type RBS can resolve; it is the start of the Rigor " \
+              "refinement `#{refinement_hint}`, which is not valid in an RBS type position. Write it as " \
+              "an `%a{rigor:v1:param: name is #{refinement_hint}}` (or `return:` / `assert`) annotation " \
+              "alongside the plain RBS type instead — see docs/manual/16-rbs-extended-annotations.md — " \
+              "to restore type coverage."
+          else
+            "One signature source names `#{token}`#{position}, which is not a type RBS can resolve; fix " \
+              "the typo, or if it names a class, confirm it is loaded (`rbs validate`) to restore type " \
+              "coverage."
+          end
+        end
+
+        # `[class_name, error_class, member, buffers, unresolved_type_name_detail]`. The member is nil for
+        # the error classes that carry no name at all (`RecursiveAncestorError`), and the clause then names
+        # the error class alone rather than inventing a member.
         def first_failure_clause(failure)
           _, error_class, member, = failure
           return " First failure: #{error_class}." if member.nil? || member.empty?
@@ -849,10 +885,29 @@ module Rigor
           return [] if @source_rbs_synthesis_reporter.empty?
 
           @source_rbs_synthesis_reporter.entries.map do |entry|
-            entry.kind == :not_honoured ? not_honoured_diagnostic(entry) : synthesis_failed_diagnostic(entry)
+            case entry.kind
+            when :not_honoured then not_honoured_diagnostic(entry)
+            when :contradiction then contradicting_signature_diagnostic(entry)
+            else synthesis_failed_diagnostic(entry)
+            end
           end
         end
 
+        # ADR-112 WD5 / issue #1075 — a member whose two declarations contradict, or whose refinement is
+        # outside its own declared type. An error in every profile: the false-positive discipline is carried
+        # by the rule's narrow definition of a contradiction, never by the severity (ADR-112 WD5). The message
+        # is composed where the record is read ({Environment.record_member_consistency}), since only there
+        # are both sources' paths at hand.
+        def contradicting_signature_diagnostic(entry)
+          Diagnostic.new(
+            path: entry.path, line: entry.line || 1, column: 1,
+            message: entry.message,
+            severity: :error,
+            rule: CheckRules::RULE_CONTRADICTING_SIGNATURE,
+            source_family: :builtin
+          )
+        end
+
         def synthesis_failed_diagnostic(entry)
           Diagnostic.new(
             path: entry.path, line: 1, column: 1,
@@ -910,7 +965,7 @@ module Rigor
 
         # Issue #959 — surfaces the {Plugin::IoBoundary} refusal history each loaded plugin accumulated over
         # the whole run (prepare AND every per-file call: `#io_boundary` is memoised per plugin instance, so
-        # one boundary sees both). `TrustPolicy#allow_read?` stays `File.expand_path`-only per ADR-2 — a
+        # one boundary sees both). `TrustPolicy#allow_read?` stays `File.absolute_path`-only per ADR-2 — a
         # project rooted under a symlink (macOS' `/tmp` → `/private/tmp` is the common case) can have every
         # plugin read fall outside its own read roots with nothing said about it. One `:info` row per plugin
         # that hit this, never one per path, naming the count and the first path so the row stays legible on
@@ -938,6 +993,103 @@ module Rigor
           plugin_registry.plugins.filter_map { |plugin| plugin_trust_refusal_diagnostic(plugin) }
         end
 
+        # Issue #1051 — the run-scoped plugin disclosures ({Plugin::Base#disclose_once}), the run's
+        # project-global notices about its own inputs. Two sources feed one table:
+        #
+        # - the coordinator-side registry, which is where a SEQUENTIAL run's `#prepare` and per-file hooks
+        #   ran; and
+        # - `pooled_run_disclosures`, the pool coordinator's already-de-duplicated collection from the
+        #   pre-fork parent session and every worker payload.
+        #
+        # Both are keyed `[plugin id, key]` and the first registration of a pair wins, so a run emits one
+        # row per pair no matter how many plugin instances (workers) reached it — the #1051 bug, where a
+        # per-instance `@emitted` flag produced one row per WORKER.
+        #
+        # The emitted order is `(registry position, key)`, NOT registration order: a worker's slice
+        # determines which instance registers a key first, so registration order is a function of
+        # `--workers N` and would make a pooled run's stream differ from a sequential one's even with the
+        # duplicates gone. Registry position is the plugin load order (topological by `consumes:`), which
+        # both modes share.
+        #
+        # Position is `.rigor.yml:1:1` for every row; see {Plugin::Base#disclose_once} for why that and not
+        # the first analysed file. A positioned batch ({Plugin::Base#emit_once}) shares the table but not
+        # this stream — see {#plugin_run_emission_diagnostics}.
+        def plugin_run_disclosure_diagnostics
+          ordered_run_disclosure_records
+            .reject { |record| record.key?(:diagnostics) }
+            .map { |record| run_disclosure_diagnostic(record) }
+        end
+
+        # Issue #1060 — the positioned batches ({Plugin::Base#emit_once}) from the same table, de-duplicated
+        # by the same `[plugin id, key]` identity over the same sources, so the first registration of a key
+        # wins whole and a batch is never merged row by row across workers. Unlike a disclosure, every row
+        # keeps the position the plugin gave it; the engine only stamps `source_family: "plugin.<id>"`, the
+        # same stamp a `#diagnostics_for_file` row gets, so a baseline keyed to the row's own file and
+        # qualified rule matches it before and after a plugin moves onto this channel.
+        #
+        # Order is `(registry position, key)` and then the batch's own row order — the same
+        # `--workers`-independent order the disclosure stream uses. The runner appends this stream right
+        # after the per-file stream rather than into the run-level block: these rows are about files, and
+        # the files they name are usually not among the analysed targets (a view template), so there is no
+        # file slot to splice them into.
+        def plugin_run_emission_diagnostics
+          ordered_run_disclosure_records
+            .select { |record| record.key?(:diagnostics) }
+            .flat_map { |record| record[:diagnostics].map { |row| run_emission_diagnostic(row, record[:plugin_id]) } }
+        end
+
+        def ordered_run_disclosure_records
+          registry = plugin_registry
+          return [] if registry.empty?
+
+          positions = {}
+          registry.plugins.each_with_index { |plugin, index| positions[disclosure_plugin_id(plugin)] ||= index }
+          collect_run_disclosure_records(registry)
+            .sort_by { |record| [positions.fetch(record[:plugin_id], positions.size), record[:key].to_s] }
+        end
+
+        def collect_run_disclosure_records(registry)
+          records = {}
+          Array(pooled_run_disclosures).each do |record|
+            records[[record[:plugin_id], record[:key]]] ||= record
+          end
+          registry.plugins.each do |plugin|
+            plugin_id = disclosure_plugin_id(plugin)
+            Array(plugin.run_disclosure_records).each do |record|
+              records[[plugin_id, record[:key]]] ||= record.merge(plugin_id: plugin_id)
+            end
+          rescue StandardError
+            next
+          end
+          records.values
+        end
+
+        def run_disclosure_diagnostic(record)
+          Diagnostic.new(
+            path: ".rigor.yml", line: 1, column: 1,
+            message: record.fetch(:message),
+            severity: record.fetch(:severity),
+            rule: record.fetch(:rule),
+            source_family: "plugin.#{record[:plugin_id]}"
+          )
+        end
+
+        def run_emission_diagnostic(row, plugin_id)
+          Diagnostic.new(
+            path: row.path, line: row.line, column: row.column,
+            message: row.message,
+            severity: row.severity,
+            rule: row.rule,
+            source_family: "plugin.#{plugin_id}"
+          )
+        end
+
+        def disclosure_plugin_id(plugin)
+          plugin.manifest.id
+        rescue StandardError
+          plugin.class.to_s
+        end
+
         def plugin_trust_refusal_diagnostic(plugin)
           summary = plugin.io_boundary.refusal_summary
           return nil if summary.nil?
@@ -1024,6 +1176,10 @@ module Rigor
           @cached_plugin_prepare_diagnostics_reader.call
         end
 
+        def pooled_run_disclosures
+          @pooled_run_disclosures_reader.call
+        end
+
         def pre_eval_diagnostics_from_scanner
           @pre_eval_diagnostics_from_scanner_reader.call
         end

data/lib/rigor/analysis/runner/effect_envelope_pass.rb

@@ -250,9 +250,7 @@ module Rigor
           )
         end
 
-        def table_class_names
-          @effect_table.keys.filter_map { |key| Effects::MethodKey.owner(key) }.uniq
-        end
+        def table_class_names = @effect_table.keys.filter_map { |k| Effects::MethodKey.envelope_owner(k) }.uniq
 
         def judge(scan)
           Effects::EnvelopeCheck.run(
@@ -301,7 +299,7 @@ module Rigor
 
         def build_diagnostic(finding)
           Diagnostic.new(
-            path: finding.path || ".rigor.yml",
+            path: finding.path || unit_source_path(finding.key) || ".rigor.yml",
             line: finding.line,
             column: 1,
             message: message_for(finding),
@@ -312,6 +310,13 @@ module Rigor
           )
         end
 
+        # #393 — a template unit has no `def` for {Effects::EnvelopeCheck::Positions} to find, so a view
+        # finding would land on `.rigor.yml` — the config file, not the template the reviewer has to open.
+        # `Runner#effect_sources` already records the file every unit key came from; the line stays at the
+        # finding's own (1 for a whole-file unit), because the bound is exceeded by the unit, not by one
+        # line of it, and the explanation chain names the origin site.
+        def unit_source_path(key) = Effects::MethodKey.template_unit?(key) ? @unit_sources[key.to_s]&.first : nil
+
         def message_for(finding)
           EnvelopeMessages.exceeded(finding)
         end