rigortype 0.4.2 → 0.4.4

data/lib/rigor/analysis/reachability/scan_cache.rb

@@ -48,11 +48,13 @@ module Rigor
         # @param cache_path — the configuration's cache root; nil or empty is an inert
         #   cache (every fetch computes, nothing persists).
         # @param target_ruby — parse-affecting configuration, part of the identity.
-        def self.open(cache_path, target_ruby: nil)
+        # `root` names the project and working directory a run reads roles and spellings from (#1760): a
+        # scan cached by a run from another directory carries another role, so it is never served here.
+        def self.open(cache_path, target_ruby: nil, root: nil)
           return new(path: nil, header: nil) if cache_path.nil? || cache_path.to_s.empty?
 
           new(path: File.join(cache_path.to_s, FILE_NAME),
-              header: "#{SCHEMA}:#{Rigor::VERSION}:#{target_ruby}:#{source_digest}")
+              header: "#{SCHEMA}:#{Rigor::VERSION}:#{target_ruby}:#{source_digest}:#{root}")
         end
 
         def self.source_digest

data/lib/rigor/analysis/rule_catalog.rb

@@ -94,7 +94,12 @@ module Rigor
           does_not_fire_when: [
             "Implicit-self calls (no receiver) — too noisy without per-method RBS for every helper.",
             "Receiver is `Dynamic[T]` / `Top` / `Union` — by definition the method set isn't enumerable.",
-            "Receiver class is in the loader but its RBS definition cannot be built (constant aliases)."
+            "Receiver class is in the loader but its RBS definition cannot be built (constant aliases).",
+            "Receiver class answers beyond any signature: a plugin-declared open receiver (ADR-26), or one " \
+            "Rigor's bundled overlays name (`OpenStruct`, whose fields are per-instance singleton methods; " \
+            "`ActiveSupport::Duration` and `ActiveSupport::Concern` when their gem overlay loads). Both sides " \
+            "of the class are open, and an inherited Object / Kernel signature no longer decides " \
+            "`call.wrong-arity` or `call.argument-type-mismatch` on it."
           ],
           suppression: "`# rigor:disable call.undefined-method` on the call line, " \
                        "or `disable: [\"call.undefined-method\"]` in `.rigor.yml`.",

data/lib/rigor/analysis/run_cache_key.rb

@@ -70,13 +70,14 @@ module Rigor
       RUN_EFFECTS_TABLE_PRODUCER_ID = "analysis.run-effects-table"
 
       # The run-result producer's declared compaction budget (`Cache::Store#evict!` pass 2). Whole-project,
-      # but unlike the `rbs.*` producers several generations can be live at once: the `paths` key slot means
-      # one entry per analyzed-path SET, so `rigor check` over the whole project, over `lib`, and over a
-      # single file are three separate live generations. 16 is a judgement call sized for that churn; it is
-      # a cap on GENERATIONS, not on correctness — over-evicting here costs a recompute, never a wrong
-      # answer. Measured 2026-07-25 against a real project's `.rigor/cache`: the cap does bind (60 distinct
-      # path-set generations observed, differing in the `paths` slot alone), with no evidence yet on how
-      # often an evicted generation is asked for again — see issue #151.
+      # but unlike the `rbs.*` producers several generations can be live at once: the `paths` and `roots` key
+      # slots mean one entry per analyzed-path SET x root list as written (#1559), so `rigor check` over the
+      # whole project, over `lib`, and over a single file are three separate live generations, and `rigor
+      # check` and `rigor check lib` are two even when `lib` is the configured `paths:`. 16 is a judgement call
+      # sized for that churn; it is a cap on GENERATIONS, not on correctness — over-evicting here costs a
+      # recompute, never a wrong answer. Measured 2026-07-25 against a real project's `.rigor/cache`: the cap
+      # does bind (60 distinct path-set generations observed, differing in the `paths` slot alone), with no
+      # evidence yet on how often an evicted generation is asked for again — see issue #151.
       GENERATION_CAP = 16
 
       # The effects sidecar's own compaction budget. One generation per (path set × effects identity), and
@@ -109,6 +110,29 @@ module Rigor
         nil
       end
 
+      # #1559 — the run-result key's analysis ROOTS, as the run was given them. The `paths` slot holds only the
+      # files the roots expand to, so `check lib extra` with `extra` missing and `check lib` shared a key while
+      # only the first prints `extra:1:1: warning: no such file or directory (skipped)`, which changes the exit
+      # code under `--fail-on=warning`. The roots are kept in the order and spelling written, not normalised: a
+      # missing root is reported as written (`./extra` is not `extra`), and the order of the roots is the order
+      # the diagnostics come out in, so two runs that differ only in either are two slots (a forgone hit, never a
+      # wrong one).
+      #
+      # Added to the DIAGNOSTICS key only. The ADR-103 effects sidecar derives its identity from {#descriptor}
+      # without it: the effect table is a function of the analysed files, and no path-error row reaches it.
+      # The `--incremental` slot builds its own, normalised, roots entry ({IncrementalRunSlot}).
+      #
+      # @param descriptor — a {#descriptor} result (nil passes through, so a disabled cache stays disabled).
+      def with_roots(descriptor, roots)
+        return nil if descriptor.nil?
+
+        entry = config_entry("roots", Marshal.dump(Array(roots).map(&:to_s)))
+        Cache::Descriptor.new(
+          gems: descriptor.gems, dependencies: descriptor.dependencies, plugins: descriptor.plugins,
+          configs: descriptor.configs + [entry]
+        )
+      end
+
       # Issue #285 — the `engine` slot above pins the engine by VERSION, which identifies the source only
       # for a released gem. A checkout (a contributor's, or a `bundle add rigor, github:` clone) gets one
       # extra slot carrying a digest of the engine's own source, so editing `lib/rigor/inference/*.rb` no

data/lib/rigor/analysis/run_cache_probe.rb

@@ -64,10 +64,12 @@ module Rigor
       #   the caller loads the engine and runs the full path. Any failure declines rather than raising: the
       #   probe must never turn a servable run into a crash.
       def serve(paths)
-        files = PathExpansion.ruby_files(paths, @configuration.exclude_patterns)
-        key = RunCacheKey.descriptor(
-          configuration: @configuration, files: files, explain: @explain,
-          rbs_config_entries: RunCacheKey.libraries_config_entries(@configuration)
+        files = PathExpansion.ruby_files(paths, @configuration.exclude_patterns, base: @configuration.exclude_base)
+        key = RunCacheKey.with_roots(
+          RunCacheKey.descriptor(
+            configuration: @configuration, files: files, explain: @explain,
+            rbs_config_entries: RunCacheKey.libraries_config_entries(@configuration)
+          ), paths
         )
         return nil if key.nil?
 

data/lib/rigor/analysis/run_stats.rb

@@ -24,18 +24,31 @@ module Rigor
     # `class_decl_paths` (a frozen `Hash<String, String>` populated once per environment by the RBS loader;
     # ~1000-2000 entries × one `String#start_with?`).
     class RunStats
-      attr_reader :wall_seconds, :peak_rss_bytes,
+      attr_reader :wall_seconds,
                   :target_files,
                   :rbs_classes_total, :rbs_classes_project_sig, :rbs_classes_bundled,
                   :gem_walk_classes, :gem_walk_gems, :rbs_attribution_available
 
-      def initialize(wall_seconds:, peak_rss_bytes:, # rubocop:disable Metrics/ParameterLists
+      # The live probe a run's summary uses: reads this process's RSS when first asked. The probe is a constant
+      # lambda, so the RunStats it rides on never captures the Runner (and its analysis state) through `Result`.
+      CURRENT_PROCESS_PEAK_RSS = Ractor.make_shareable(-> { RunStats.peak_rss_bytes })
+
+      # Issue #1529 — the peak RSS is read on the first {#peak_rss_bytes} call, not when the summary is built. A run
+      # that prints no summary (`--incremental` recheck, `--no-stats`) therefore never forks `ps` or reads `/proc`.
+      # The read stays in this process: the summary is built and printed by the process that ran the analysis.
+      #
+      # @param peak_rss_bytes — a value to report directly (specs, or a caller that already read it). Ignored when
+      #   `peak_rss_probe:` is given.
+      # @param peak_rss_probe — a zero-argument callable returning the RSS in bytes, called at most once, lazily.
+      def initialize(wall_seconds:, # rubocop:disable Metrics/ParameterLists
                      target_files:,
                      rbs_classes_total:, rbs_classes_project_sig:, rbs_classes_bundled:,
                      gem_walk_classes:, gem_walk_gems:,
-                     rbs_attribution_available: true)
+                     rbs_attribution_available: true, peak_rss_bytes: nil, peak_rss_probe: nil)
         @wall_seconds = wall_seconds
-        @peak_rss_bytes = peak_rss_bytes
+        @peak_rss_probe = peak_rss_probe || -> { peak_rss_bytes }
+        # A frozen RunStats cannot memoise into an ivar, so the first read lands in this (unfrozen) Hash.
+        @peak_rss_memo = {}
         @target_files = target_files
         @rbs_classes_total = rbs_classes_total
         @rbs_classes_project_sig = rbs_classes_project_sig
@@ -46,6 +59,15 @@ module Rigor
         freeze
       end
 
+      # The peak RSS in bytes, read once on first call and memoised (nil when no route answers). The check command
+      # forces the first call straight after the analysis (#1529), before `--coverage` or any output, so the figure
+      # covers the analysis alone. On Linux it is the kernel's VmHWM high-water mark, so a later read is never below
+      # the run-end value. On macOS it is `ps`'s current RSS, so the reading is the process as it stood at that
+      # first call, not a high-water mark.
+      def peak_rss_bytes
+        @peak_rss_memo.fetch(:value) { @peak_rss_memo[:value] = @peak_rss_probe.call }
+      end
+
       # Reports the process's resident set size in bytes. Source ordering: `/proc/self/status` (Linux — reads
       # `VmHWM:`, the peak RSS the kernel records) first; otherwise `ps -o rss= -p <pid>` (macOS / BSD —
       # reports CURRENT RSS, the closest universally-available proxy). Returns nil when neither route works
@@ -146,7 +168,7 @@ module Rigor
         end
         out.puts("#{prefix}Process")
         out.puts("#{prefix}  Wall time:   #{Kernel.format('%.2fs', @wall_seconds)}")
-        out.puts("#{prefix}  Memory peak: #{format_bytes(@peak_rss_bytes)}")
+        out.puts("#{prefix}  Memory peak: #{format_bytes(peak_rss_bytes)}")
       end
 
       def to_h
@@ -159,7 +181,7 @@ module Rigor
           gem_walk_classes: @gem_walk_classes,
           gem_walk_gems: @gem_walk_gems,
           wall_seconds: @wall_seconds,
-          peak_rss_bytes: @peak_rss_bytes
+          peak_rss_bytes: peak_rss_bytes
         }
       end
 

data/lib/rigor/analysis/runner/diagnostic_aggregator.rb

@@ -57,7 +57,8 @@ module Rigor
                        quarantined_signatures_snapshot:, env_build_failure_snapshot:,
                        definition_build_failures_snapshot:, hkt_scan_failure_snapshot:,
                        conformance_results_snapshot:, signature_standdowns_snapshot: -> { [] },
-                       vendored_standdowns_snapshot: -> { [] }, pooled_run_disclosures: -> { [] })
+                       vendored_standdowns_snapshot: -> { [] }, pooled_run_disclosures: -> { [] },
+                       pooled_trust_refusals: -> { [] })
           @configuration = configuration
           @rbs_extended_reporter = rbs_extended_reporter
           @boundary_cross_reporter = boundary_cross_reporter
@@ -78,6 +79,9 @@ module Rigor
           # Issue #1051 — reader for the pool coordinator's de-duplicated run-scoped disclosure table.
           # Empty on a sequential run, where `plugin_registry`'s own instances are the ones that registered.
           @pooled_run_disclosures_reader = pooled_run_disclosures
+          # Issue #1900 — reader for the pool coordinator's summed trust-refusal table. Empty on a
+          # sequential run, where `plugin_registry`'s own boundaries made every read.
+          @pooled_trust_refusals_reader = pooled_trust_refusals
         end
 
         # Pre-file diagnostic streams that fire once per run rather than per analyzed file: plugin load /
@@ -128,7 +132,32 @@ module Rigor
               source_family: :builtin
             )
           end
-          not_found + Array(pre_eval_diagnostics_from_scanner).map { |hash| diagnostic_from_hash(hash) }
+          scanned = Array(pre_eval_diagnostics_from_scanner).map { |hash| diagnostic_from_hash(hash) }
+          suppress_pre_eval(not_found + scanned)
+        end
+
+        # The ordinary suppression pipeline for the `pre-eval.*` rows: the `# rigor:disable` /
+        # `# rigor:disable-file` comments of the file a row is positioned in (a `pre_eval:` file need not be
+        # under `paths:`, so its comments are read here rather than by per-file analysis) and the project's
+        # `disable:` list. A row positioned at `.rigor.yml` has no Ruby comments (`.yml` is skipped) and answers to
+        # `disable:` only.
+        # Stream order is the output contract, so survivors are picked out of the original sequence.
+        def suppress_pre_eval(diagnostics)
+          kept = diagnostics.group_by(&:path).flat_map do |path, group|
+            CheckRules.filter_suppressed(
+              group, comments: pre_eval_comments(path), disabled_rules: @configuration.disabled_rules
+            )
+          end
+          kept_ids = kept.to_set(&:object_id)
+          diagnostics.select { |diagnostic| kept_ids.include?(diagnostic.object_id) }
+        end
+
+        def pre_eval_comments(path)
+          return [].freeze unless File.file?(path) && !path.end_with?(".rbs", ".yml", ".yaml")
+
+          Prism.parse_file(path).comments
+        rescue StandardError
+          [].freeze
         end
 
         def diagnostic_from_hash(hash)
@@ -588,9 +617,18 @@ module Rigor
         # culprit and reads the same on a cache hit, where every `RBS::Location` has been dumped to a
         # sentinel. The error class is attributed to that first failure explicitly rather than to all of
         # them: the per-class memo keeps only the first reason, and one run can mix error classes.
+        #
+        # Issue #1902 — "first" is first by CLASS NAME, not first recorded. The snapshot arrives in demand
+        # order, and that order is a property of the invocation, not of the project: an `--incremental`
+        # recheck records the classes its closure demanded before it unions in the replayed set, and a worker
+        # pool unions per-worker lists in drain order. So the classes are sorted by name and the files
+        # sorted and deduplicated here. Which tuple each class carries is fixed upstream
+        # ({Environment::RbsLoader.definition_build_detail_order}), not here.
         def build_rbs_definition_build_failed_diagnostic(failures)
+          failures = failures.sort_by { |failure| failure.first.to_s }
           sample_size = 5
-          files = failures.flat_map { |failure| Array(failure[3]) }.uniq.map { |name| relative_signature_path(name) }
+          files = failures.flat_map { |failure| Array(failure[3]) }
+                          .map { |name| relative_signature_path(name) }.uniq.sort
           Diagnostic.new(
             path: ".rigor.yml",
             line: 1,
@@ -1059,16 +1097,22 @@ module Rigor
         # cache"). It is also never routed through `IncrementalSession`'s per-file cache (`#788`): that cache
         # holds only `Runner#per_file_diagnostics`, and this row is not part of that stream.
         #
-        # Scope: `plugin_registry` here is the coordinator-side registry, which only actually RUNS `#prepare`
-        # / per-file analysis in sequential mode (`--workers` unset, the default) — a pooled run (`--workers
-        # N`) prepares and analyses on per-worker `WorkerSession` registries this reader never sees, so a
-        # refusal confined to a pooled worker's slice is not reported. Left out deliberately: draining it
-        # needs a fourth marshalled channel beside `drain_reporters` / `drain_dependencies` / `drain_effects`
-        # in `Runner::PoolCoordinator`, and the default (unpooled) path already covers the reported bug.
+        # Two sources (issue #1900), summed per plugin: the coordinator-side registry's own boundaries — where
+        # a sequential run, and the pool's no-worker fallback, made every read — and `pooled_trust_refusals`,
+        # what a pooled run drained from its pre-fork parent session and every worker
+        # ({Runner::PoolCoordinator#merge_trust_refusals}). The count is per refused ATTEMPT, as
+        # `--workers 0` always counted it; the pool drains the parent's `#prepare` refusals before forking and
+        # each worker reports only what it added, so the workers, which inherit the parent's boundaries, do
+        # not count them again. Rows follow registry
+        # (plugin load) order, which every mode shares.
         def plugin_trust_refusal_diagnostics
           return [] if plugin_registry.empty?
 
-          plugin_registry.plugins.filter_map { |plugin| plugin_trust_refusal_diagnostic(plugin) }
+          pooled = Array(pooled_trust_refusals).to_h { |record| [record[:plugin_id], record] }
+          plugin_registry.plugins.filter_map do |plugin|
+            summary = combined_refusal_summary(pooled[disclosure_plugin_id(plugin)], plugin)
+            plugin_trust_refusal_diagnostic(plugin, summary) if summary
+          end
         end
 
         # Issue #1051 — the run-scoped plugin disclosures ({Plugin::Base#disclose_once}), the run's
@@ -1168,10 +1212,23 @@ module Rigor
           plugin.class.to_s
         end
 
-        def plugin_trust_refusal_diagnostic(plugin)
-          summary = plugin.io_boundary.refusal_summary
-          return nil if summary.nil?
+        # The coordinator's own record first when it has one: on a pooled run it holds the `#init` reads
+        # (every registry runs `#init`; the workers' drains start after it), which `--workers 0` makes before
+        # `#prepare` and before any file, so its first path is the one a sequential run names. Not so after a
+        # Ractor-backend degrade, where this record also holds the re-analysed files' refusals and is named
+        # ahead of a worker's `#prepare` path; the count is right either way.
+        def combined_refusal_summary(pooled, plugin)
+          local = begin
+            plugin.io_boundary.refusal_summary
+          rescue StandardError
+            nil
+          end
+          return local || pooled if pooled.nil? || local.nil?
 
+          local.merge(count: local[:count] + pooled[:count])
+        end
+
+        def plugin_trust_refusal_diagnostic(plugin, summary)
           plugin_id = plugin.manifest.id
           Diagnostic.new(
             path: ".rigor.yml", line: 1, column: 1,
@@ -1258,6 +1315,10 @@ module Rigor
           @pooled_run_disclosures_reader.call
         end
 
+        def pooled_trust_refusals
+          @pooled_trust_refusals_reader.call
+        end
+
         def pre_eval_diagnostics_from_scanner
           @pre_eval_diagnostics_from_scanner_reader.call
         end

data/lib/rigor/analysis/runner/pool_coordinator.rb

@@ -46,7 +46,8 @@ module Rigor
                        synthetic_method_index:, project_patched_methods:,
                        analyze_file:, project_scope_seed: -> { {} }, record_dependencies: false,
                        restored_run_level_rows: nil, template_units: -> { TemplateUnits.empty },
-                       feature_sources: -> { {} })
+                       feature_sources: -> { {} }, plugin_prepare: -> { [[], [], []] },
+                       prepare_coordinator_plugins: -> { [] })
           @configuration = configuration
           @cache_store = cache_store
           @explain = explain
@@ -66,6 +67,12 @@ module Rigor
           # The de-duplication has to happen here, on the parent, because each fork worker owns its own
           # plugin instances and therefore its own `@run_disclosures` table.
           @collected_run_disclosures = {}
+          # Issue #1900 — the trust-policy refusals ({Analysis::WorkerSession#drain_trust_refusals}) a pool run
+          # collected from the pre-fork parent session and every worker, keyed by plugin id and summed. The
+          # coordinator-side registry, which {DiagnosticAggregator#plugin_trust_refusal_diagnostics} also
+          # reads, runs neither `#prepare` nor per-file analysis on a pooled run, so without this table a
+          # refusal recorded in `--workers 0` vanished in `--workers N`.
+          @collected_trust_refusals = {}
           @collect_stats = collect_stats
           @buffer = buffer
           @feature_sources = feature_sources
@@ -84,6 +91,15 @@ module Rigor
           # inherits the same compiled bytes.
           @template_units_reader = template_units
           @analyze_file = analyze_file
+          # Issue #1541 — `() -> [rows, disclosure records, trust refusals]`, a `#prepare` run on a throwaway
+          # registry. Read only by {#serve_empty_closure}: a pooled run's `#prepare` happens inside its
+          # workers, and an empty closure dispatches none.
+          @plugin_prepare = plugin_prepare
+          # Issue #1900 — `() -> rows`, `#prepare` run on the coordinator-side registry itself. Read only by
+          # {#analyze_files_sequentially_fallback}, which analyses on that registry: the pre-pass skips
+          # `#prepare` whenever `pool_mode?`, so without this the fallback ran every plugin unprepared.
+          @prepare_coordinator_plugins = prepare_coordinator_plugins
+          @coordinator_plugins_prepared = false
           # Issues #796 / #794 — the previous full run's run-level rows, handed down by
           # {Analysis::IncrementalSession} on a NARROWED run only (a recheck's closure, a
           # `--verify-incremental` partition). A full run leaves this nil and derives everything itself.
@@ -119,6 +135,27 @@ module Rigor
           end
         end
 
+        # Issue #1900 — the trust refusals a pool run collected, one `{plugin_id:, count:, first_path:,
+        # nearest_root:}` per plugin, in first-merge order. Empty on a sequential run, where the runner's own
+        # registry made every read.
+        def collected_trust_refusals
+          @collected_trust_refusals.values
+        end
+
+        # Issue #1900 — folds one session's / one worker payload's refusal drain in: counts add, and the
+        # first path stays the one merged first. Callers merge in the order `--workers 0` would have made the
+        # reads — the parent's (or one worker's) `#prepare`, then the files in analysis order — so the summed
+        # row names the same first path the sequential run does, except where a drain's own first path is
+        # not this merge's to choose (see {DiagnosticAggregator#plugin_trust_refusal_diagnostics}).
+        def merge_trust_refusals(records)
+          Array(records).each do |record|
+            plugin_id = record[:plugin_id]
+            existing = @collected_trust_refusals[plugin_id]
+            @collected_trust_refusals[plugin_id] =
+              existing ? existing.merge(count: existing[:count] + record[:count]) : record
+          end
+        end
+
         # ADR-15 Phase 4b — pool mode is enabled when `@workers > 0`. Editor mode (`buffer:` non-nil)
         # silently overrides pool mode to sequential: per design § "Ractor pool mode", the pool's warm-up
         # cost dominates one-file wall time, so the pool gains nothing on a per-buffer invocation. The
@@ -146,10 +183,8 @@ module Rigor
         #   (`expansion.fetch(:files)`), independent of any `analyze_only` narrowing of `files`; see
         #   {#serve_empty_closure} for what an empty `files` does with it.
         def analyze_files(files, environment: nil, project_files: nil)
-          if files.empty?
-            serve_empty_closure(environment, project_files)
-            return []
-          end
+          return serve_empty_closure(environment, project_files) if files.empty?
+
           # Issue #784 / #793 — `files` is what this run ANALYSES; `source_files` is what its environment
           # is BUILT over, and the two are the same only on a full run. A narrowed run (`analyze_only`: an
           # incremental closure, a `--verify-incremental` partition) used to build its environment over the
@@ -199,7 +234,16 @@ module Rigor
         #   whether anyone could have demanded anything at all: with no files, nobody could have, and an
         #   empty project keeps paying no env build. Keyed on the project's files rather than on
         #   `analyze_only`, because a recheck over an EMPTY project narrows to `Set[]`, which is non-nil.
+        #
+        # Issue #1541 — and, in pool mode, its `prepare` rows. A pooled run's `#prepare` happens inside the
+        # workers and its rows reach the stream through their first payload, so the coordinator-side
+        # pre-pass skips it ({ProjectPrePasses#run}) and {DiagnosticAggregator#pre_file_diagnostics} omits
+        # the cached rows; with no worker dispatched the row appeared nowhere, and a plugin whose `#prepare`
+        # raises turned a red project green on a nothing-changed `--incremental --workers N` recheck. They
+        # are returned as the run's per-file stream head, where the pool path puts them (`.rigor.yml`).
+        # Sequential, whose pre-pass already ran `#prepare`, returns no rows here.
         def serve_empty_closure(environment, project_files)
+          prepare_rows = pool_mode? ? pooled_prepare_rows : []
           env = environment || @environment_override
           # Resolved over the project's OWN file list — not `[]`, which would drop every plugin-synthesized
           # virtual RBS (`Environment.collect_virtual_rbs` short-circuits on an empty list) and scan a
@@ -217,9 +261,17 @@ module Rigor
           # `env` rather than `resolve.call`: read the demand the snapshots above just made when they built
           # an environment, and force nothing when they did not.
           record_definition_build_failures(env&.rbs_loader&.definition_build_failures)
-          return if replayed_restored_run_level_rows?
+          record_hkt_scan_failure(hkt_scan_outcome(resolve.call)) unless replayed_restored_run_level_rows?
+          prepare_rows
+        end
 
-          record_hkt_scan_failure(hkt_scan_outcome(resolve.call))
+        # Issue #1541 — the pooled empty closure's `#prepare`: the rows go to the caller, the run-scoped
+        # registrations into the table the workers' payloads would have filled.
+        def pooled_prepare_rows
+          rows, records, refusals = @plugin_prepare.call
+          merge_run_disclosures(records)
+          merge_trust_refusals(refusals)
+          Array(rows)
         end
 
         # Issue #794 — the signature-state snapshot's own gates, asked BEFORE an environment exists. Every
@@ -621,13 +673,15 @@ module Rigor
                 required_features: features
               )
               main = Ractor.main
-              main.send([:prepare, session.prepare_diagnostics])
+              # Issue #1900 — each message carries the refusals made since the previous one, so the coordinator
+              # can count ONE worker's `#prepare` (every worker repeats it) and sum the files in file order.
+              main.send([:prepare, session.prepare_diagnostics, session.drain_trust_refusals])
 
               loop do
                 msg = Ractor.receive
                 break if msg.nil?
 
-                main.send([:file, msg, session.analyze(msg)])
+                main.send([:file, msg, session.analyze(msg), session.drain_trust_refusals])
               end
 
               # Issue #1051 — sent with `:done`, not with `:prepare`: this backend builds no parent session,
@@ -646,6 +700,8 @@ module Rigor
           pool.each { |worker| worker.send(nil) }
 
           prepare_diagnostics = nil
+          prepare_refusals = nil
+          refusals_by_path = {}
           results_by_path = {}
           terminated = 0
 
@@ -663,9 +719,11 @@ module Rigor
 
             case message.first
             when :prepare
-              prepare_diagnostics ||= message.last
+              prepare_diagnostics ||= message[1]
+              prepare_refusals ||= message[2]
             when :file
               results_by_path[message[1]] = message[2]
+              refusals_by_path[message[1]] = message[3]
             when :done
               merge_worker_reporters(message[1])
               merge_run_disclosures(message[2])
@@ -684,6 +742,8 @@ module Rigor
           # it did. Re-analysed in process, exactly as the fork backend re-analyses a dead child's slice.
           degraded = files.reject { |path| results_by_path.key?(path) }
           reanalyze_degraded_in_process(degraded, results_by_path, source_files: source_files)
+          merge_trust_refusals(prepare_refusals)
+          files.each { |path| merge_trust_refusals(refusals_by_path[path]) }
 
           diagnostics = Array(prepare_diagnostics) + files.flat_map { |path| results_by_path.fetch(path, []) }
           degraded.empty? ? diagnostics : diagnostics.unshift(pool_degraded_diagnostic(degraded.size, "ractor"))
@@ -700,8 +760,9 @@ module Rigor
         # Issue #1051, known exception: run-scoped disclosures a plugin registered from `#prepare` are NOT
         # recovered here — nor, since #1060, a positioned `#emit_once` batch registered there, which rides
         # the same table. There is no session to drain — this backend builds none on the coordinator — and
-        # `#prepare` deliberately does not run on the coordinator-side registry under pool mode, so a
-        # prepare-time disclosure lives only inside the Ractor that died with it. A disclosure registered
+        # `#prepare` does not run on the coordinator-side registry under pool mode (only an empty closure
+        # runs it, on a throwaway registry; see {#serve_empty_closure}), so a prepare-time disclosure lives
+        # only inside the Ractor that died with it. A disclosure registered
         # from `#diagnostics_for_file` IS recovered, because the re-analysis below runs the coordinator-side
         # plugin instances that {DiagnosticAggregator#plugin_run_disclosure_diagnostics} reads directly.
         # Left as is: recovering the rest means running `#prepare` on the coordinator registry, which would
@@ -776,23 +837,34 @@ module Rigor
           # `merge_run_disclosures` drops it as a duplicate; only a disclosure a worker registers while
           # analysing its own slice adds anything.
           merge_run_disclosures(session.drain_run_disclosures)
+          # Issue #1900 — the parent's `#prepare` refusals, drained BEFORE the fork: every child inherits the
+          # session's record of what it already reported and drains only its own slice's, so the prepare-time
+          # refusal is counted once, as `--workers 0` counts it, rather than once per worker.
+          merge_trust_refusals(session.drain_trust_refusals)
           snapshot_fork_pool_stats(session) if @collect_stats
 
           worker_count = [@workers, files.size].min
           slices = files.each_slice((files.size.to_f / worker_count).ceil).to_a
           results_by_path = {}
+          # Issue #1900 — each surviving child's refusal drain by slice index, and each re-analysed file's by
+          # path, merged below in file order so the first refused path is the one `--workers 0` names.
+          refusals_by_slice = {}
+          refusals_by_path = {}
 
           degraded = Dir.mktmpdir("rigor-fork-pool") do |tmpdir|
             children = slices.each_with_index.map do |slice, index|
               out_path = File.join(tmpdir, "worker-#{index}")
               { pid: fork { run_fork_worker(session, slice, out_path) },
-                slice: slice, out_path: out_path }
+                slice: slice, out_path: out_path, index: index }
             end
-            collect_fork_results(children, results_by_path)
+            collect_fork_results(children, results_by_path, refusals_by_slice: refusals_by_slice)
           end
 
           unless degraded.empty?
-            degraded.each { |path| results_by_path[path] = session.analyze(path) }
+            degraded.each do |path|
+              results_by_path[path] = session.analyze(path)
+              refusals_by_path[path] = session.drain_trust_refusals
+            end
             merge_worker_reporters(session.drain_reporters)
             # The degraded slice ran on the parent session, so a disclosure it registered lives there.
             merge_run_disclosures(session.drain_run_disclosures)
@@ -802,11 +874,25 @@ module Rigor
             @collected_effects.merge!(session.drain_effects) if @record_effects
           end
 
+          merge_slice_refusals(slices, refusals_by_slice, refusals_by_path)
           diagnostics = Array(session.prepare_diagnostics) +
                         files.flat_map { |path| results_by_path.fetch(path, []) }
           degraded.empty? ? diagnostics : diagnostics.unshift(pool_degraded_diagnostic(degraded.size, "fork"))
         end
 
+        # Issue #1900 — a surviving child's drain covers its whole slice; a degraded slice was re-analysed on
+        # the parent and drained file by file. Slices are contiguous runs of `files`, so walking them in index
+        # order merges every refusal in the order the sequential run made it.
+        def merge_slice_refusals(slices, refusals_by_slice, refusals_by_path)
+          slices.each_with_index do |slice, index|
+            if refusals_by_slice.key?(index)
+              merge_trust_refusals(refusals_by_slice[index])
+            else
+              slice.each { |path| merge_trust_refusals(refusals_by_path[path]) }
+            end
+          end
+        end
+
         # Child-process body for {#analyze_files_in_fork_pool}. Analyses the slice with the
         # copy-on-write-inherited session and writes the Marshal'd payload to `out_path`. `exit!` skips
         # `at_exit` / stdio flush — the payload is already durable on disk by then.
@@ -821,7 +907,8 @@ module Rigor
           results = slice.to_h { |path| [path, session.analyze(path)] }
           payload = { results: results, reporters: session.drain_reporters,
                       dependencies: session.drain_dependencies,
-                      disclosures: session.drain_run_disclosures }
+                      disclosures: session.drain_run_disclosures,
+                      refusals: session.drain_trust_refusals }
           # ADR-103 WD13 — the effects slot exists only on a collecting run, so a normal `--workers N` run
           # marshals exactly the payload it marshalled before the feature existed.
           payload[:effects] = session.drain_effects if @record_effects
@@ -845,7 +932,9 @@ module Rigor
 
         # Waits for every forked child, merges each successful payload into `results_by_path`, and returns
         # the file paths whose worker exited abnormally (for in-process degrade).
-        def collect_fork_results(children, results_by_path)
+        # @param refusals_by_slice — issue #1900 — receives each successful payload's trust-refusal drain
+        #   under the child's slice index, for the caller to merge in file order; nil merges it at once.
+        def collect_fork_results(children, results_by_path, refusals_by_slice: nil)
           degraded = []
           children.each do |child|
             _, status = Process.waitpid2(child[:pid])
@@ -854,6 +943,8 @@ module Rigor
               results_by_path.merge!(payload.fetch(:results))
               merge_worker_reporters(payload.fetch(:reporters))
               merge_run_disclosures(payload.fetch(:disclosures, []))
+              refusals = payload.fetch(:refusals, [])
+              refusals_by_slice ? refusals_by_slice[child[:index]] = refusals : merge_trust_refusals(refusals)
               @collected_dependencies.merge!(payload.fetch(:dependencies, {})) if @record_dependencies
               @collected_effects.merge!(payload.fetch(:effects, {})) if @record_effects
             else
@@ -938,7 +1029,15 @@ module Rigor
         # @param source_files — issue #793 — the whole project, so this path's environment
         #   carries the same plugin-synthesized RBS the pool workers' would. It used to build over `[]`,
         #   i.e. with no synthesized RBS at all, even on a full run.
+        #
+        # Issue #1900 — it also runs `#prepare` on the coordinator-side registry it analyses with, BEFORE the
+        # environment build as the sequential pre-pass does. A pooled run's pre-pass skips `#prepare` (the
+        # workers run it), and this path has no workers, so every plugin used to analyse unprepared and its
+        # prepare rows and prepare-time trust refusals were lost. The rows head the stream, where the pool
+        # backends put their workers' prepare rows; the refusals land on the coordinator's own
+        # {Plugin::IoBoundary}s, which {DiagnosticAggregator#plugin_trust_refusal_diagnostics} reads.
         def analyze_files_sequentially_fallback(files, reason:, source_files: files)
+          prepare_rows = prepare_coordinator_plugins_once
           environment = build_runner_environment(source_files: source_files)
           # Same set, same ORDER as `#analyze_files_sequentially`. The signature state used to be hand-copied
           # here slot by slot, which dropped `synthesized-namespace` and every conformance row. The conformance
@@ -946,7 +1045,7 @@ module Rigor
           # BEFORE the definition-build failures are read below, or a failure only that scan reaches is lost.
           snapshot_project_signature_state(environment)
           snapshot_effect_annotation_carrier(environment.rbs_loader)
-          diagnostics = files.flat_map { |path| @analyze_file.call(path, environment) }
+          diagnostics = prepare_rows + files.flat_map { |path| @analyze_file.call(path, environment) }
           loader = environment.rbs_loader
           # Issue #696 — this path analyses on the coordinator, so its loader IS the one that reached the
           # failing build, and it must snapshot the same slot the two real paths do. Reached whenever
@@ -968,6 +1067,15 @@ module Rigor
           )
         end
 
+        # Issue #1900 — `#prepare` on the coordinator-side registry, at most once per run: a second call would
+        # re-publish every cross-plugin fact into the shared fact store.
+        def prepare_coordinator_plugins_once
+          return [] if @coordinator_plugins_prepared
+
+          @coordinator_plugins_prepared = true
+          Array(@prepare_coordinator_plugins.call)
+        end
+
         def merge_worker_reporters(drained)
           merge_rbs_extended_reporter(drained.fetch(:rbs_extended))
           drained.fetch(:boundary_cross).each do |entry|
@@ -1062,8 +1170,14 @@ module Rigor
         def record_definition_build_failures(failures)
           return if failures.nil? || failures.empty?
 
+          # Issue #1902 — one tuple per class, chosen by {Environment::RbsLoader.definition_build_detail_order}
+          # rather than by arrival: a fresh record and a replayed one (or two workers' records) for the same
+          # class can name different failures, and the earlier one used to win.
           @snapshots.definition_build_failures =
-            (@snapshots.definition_build_failures + failures).uniq(&:first).freeze
+            (@snapshots.definition_build_failures + failures)
+            .group_by(&:first)
+            .map { |_, candidates| candidates.min_by { |c| Environment::RbsLoader.definition_build_detail_order(c) } }
+            .freeze
         end
 
         # Issue #784 — first-wins, unlike {#record_definition_build_failures}'s accumulate-and-dedup. That