rigortype 0.4.3 → 0.4.4

data/lib/rigor/analysis/runner/pool_coordinator.rb

@@ -46,7 +46,8 @@ module Rigor
                        synthetic_method_index:, project_patched_methods:,
                        analyze_file:, project_scope_seed: -> { {} }, record_dependencies: false,
                        restored_run_level_rows: nil, template_units: -> { TemplateUnits.empty },
-                       feature_sources: -> { {} }, plugin_prepare: -> { [[], []] })
+                       feature_sources: -> { {} }, plugin_prepare: -> { [[], [], []] },
+                       prepare_coordinator_plugins: -> { [] })
           @configuration = configuration
           @cache_store = cache_store
           @explain = explain
@@ -66,6 +67,12 @@ module Rigor
           # The de-duplication has to happen here, on the parent, because each fork worker owns its own
           # plugin instances and therefore its own `@run_disclosures` table.
           @collected_run_disclosures = {}
+          # Issue #1900 — the trust-policy refusals ({Analysis::WorkerSession#drain_trust_refusals}) a pool run
+          # collected from the pre-fork parent session and every worker, keyed by plugin id and summed. The
+          # coordinator-side registry, which {DiagnosticAggregator#plugin_trust_refusal_diagnostics} also
+          # reads, runs neither `#prepare` nor per-file analysis on a pooled run, so without this table a
+          # refusal recorded in `--workers 0` vanished in `--workers N`.
+          @collected_trust_refusals = {}
           @collect_stats = collect_stats
           @buffer = buffer
           @feature_sources = feature_sources
@@ -84,10 +91,15 @@ module Rigor
           # inherits the same compiled bytes.
           @template_units_reader = template_units
           @analyze_file = analyze_file
-          # Issue #1541 — `() -> [rows, disclosure records]`, a `#prepare` run on a throwaway registry. Read
-          # only by {#serve_empty_closure}: a pooled run's `#prepare` happens inside its workers, and an
-          # empty closure dispatches none.
+          # Issue #1541 — `() -> [rows, disclosure records, trust refusals]`, a `#prepare` run on a throwaway
+          # registry. Read only by {#serve_empty_closure}: a pooled run's `#prepare` happens inside its
+          # workers, and an empty closure dispatches none.
           @plugin_prepare = plugin_prepare
+          # Issue #1900 — `() -> rows`, `#prepare` run on the coordinator-side registry itself. Read only by
+          # {#analyze_files_sequentially_fallback}, which analyses on that registry: the pre-pass skips
+          # `#prepare` whenever `pool_mode?`, so without this the fallback ran every plugin unprepared.
+          @prepare_coordinator_plugins = prepare_coordinator_plugins
+          @coordinator_plugins_prepared = false
           # Issues #796 / #794 — the previous full run's run-level rows, handed down by
           # {Analysis::IncrementalSession} on a NARROWED run only (a recheck's closure, a
           # `--verify-incremental` partition). A full run leaves this nil and derives everything itself.
@@ -123,6 +135,27 @@ module Rigor
           end
         end
 
+        # Issue #1900 — the trust refusals a pool run collected, one `{plugin_id:, count:, first_path:,
+        # nearest_root:}` per plugin, in first-merge order. Empty on a sequential run, where the runner's own
+        # registry made every read.
+        def collected_trust_refusals
+          @collected_trust_refusals.values
+        end
+
+        # Issue #1900 — folds one session's / one worker payload's refusal drain in: counts add, and the
+        # first path stays the one merged first. Callers merge in the order `--workers 0` would have made the
+        # reads — the parent's (or one worker's) `#prepare`, then the files in analysis order — so the summed
+        # row names the same first path the sequential run does, except where a drain's own first path is
+        # not this merge's to choose (see {DiagnosticAggregator#plugin_trust_refusal_diagnostics}).
+        def merge_trust_refusals(records)
+          Array(records).each do |record|
+            plugin_id = record[:plugin_id]
+            existing = @collected_trust_refusals[plugin_id]
+            @collected_trust_refusals[plugin_id] =
+              existing ? existing.merge(count: existing[:count] + record[:count]) : record
+          end
+        end
+
         # ADR-15 Phase 4b — pool mode is enabled when `@workers > 0`. Editor mode (`buffer:` non-nil)
         # silently overrides pool mode to sequential: per design § "Ractor pool mode", the pool's warm-up
         # cost dominates one-file wall time, so the pool gains nothing on a per-buffer invocation. The
@@ -235,8 +268,9 @@ module Rigor
         # Issue #1541 — the pooled empty closure's `#prepare`: the rows go to the caller, the run-scoped
         # registrations into the table the workers' payloads would have filled.
         def pooled_prepare_rows
-          rows, records = @plugin_prepare.call
+          rows, records, refusals = @plugin_prepare.call
           merge_run_disclosures(records)
+          merge_trust_refusals(refusals)
           Array(rows)
         end
 
@@ -639,13 +673,15 @@ module Rigor
                 required_features: features
               )
               main = Ractor.main
-              main.send([:prepare, session.prepare_diagnostics])
+              # Issue #1900 — each message carries the refusals made since the previous one, so the coordinator
+              # can count ONE worker's `#prepare` (every worker repeats it) and sum the files in file order.
+              main.send([:prepare, session.prepare_diagnostics, session.drain_trust_refusals])
 
               loop do
                 msg = Ractor.receive
                 break if msg.nil?
 
-                main.send([:file, msg, session.analyze(msg)])
+                main.send([:file, msg, session.analyze(msg), session.drain_trust_refusals])
               end
 
               # Issue #1051 — sent with `:done`, not with `:prepare`: this backend builds no parent session,
@@ -664,6 +700,8 @@ module Rigor
           pool.each { |worker| worker.send(nil) }
 
           prepare_diagnostics = nil
+          prepare_refusals = nil
+          refusals_by_path = {}
           results_by_path = {}
           terminated = 0
 
@@ -681,9 +719,11 @@ module Rigor
 
             case message.first
             when :prepare
-              prepare_diagnostics ||= message.last
+              prepare_diagnostics ||= message[1]
+              prepare_refusals ||= message[2]
             when :file
               results_by_path[message[1]] = message[2]
+              refusals_by_path[message[1]] = message[3]
             when :done
               merge_worker_reporters(message[1])
               merge_run_disclosures(message[2])
@@ -702,6 +742,8 @@ module Rigor
           # it did. Re-analysed in process, exactly as the fork backend re-analyses a dead child's slice.
           degraded = files.reject { |path| results_by_path.key?(path) }
           reanalyze_degraded_in_process(degraded, results_by_path, source_files: source_files)
+          merge_trust_refusals(prepare_refusals)
+          files.each { |path| merge_trust_refusals(refusals_by_path[path]) }
 
           diagnostics = Array(prepare_diagnostics) + files.flat_map { |path| results_by_path.fetch(path, []) }
           degraded.empty? ? diagnostics : diagnostics.unshift(pool_degraded_diagnostic(degraded.size, "ractor"))
@@ -795,23 +837,34 @@ module Rigor
           # `merge_run_disclosures` drops it as a duplicate; only a disclosure a worker registers while
           # analysing its own slice adds anything.
           merge_run_disclosures(session.drain_run_disclosures)
+          # Issue #1900 — the parent's `#prepare` refusals, drained BEFORE the fork: every child inherits the
+          # session's record of what it already reported and drains only its own slice's, so the prepare-time
+          # refusal is counted once, as `--workers 0` counts it, rather than once per worker.
+          merge_trust_refusals(session.drain_trust_refusals)
           snapshot_fork_pool_stats(session) if @collect_stats
 
           worker_count = [@workers, files.size].min
           slices = files.each_slice((files.size.to_f / worker_count).ceil).to_a
           results_by_path = {}
+          # Issue #1900 — each surviving child's refusal drain by slice index, and each re-analysed file's by
+          # path, merged below in file order so the first refused path is the one `--workers 0` names.
+          refusals_by_slice = {}
+          refusals_by_path = {}
 
           degraded = Dir.mktmpdir("rigor-fork-pool") do |tmpdir|
             children = slices.each_with_index.map do |slice, index|
               out_path = File.join(tmpdir, "worker-#{index}")
               { pid: fork { run_fork_worker(session, slice, out_path) },
-                slice: slice, out_path: out_path }
+                slice: slice, out_path: out_path, index: index }
             end
-            collect_fork_results(children, results_by_path)
+            collect_fork_results(children, results_by_path, refusals_by_slice: refusals_by_slice)
           end
 
           unless degraded.empty?
-            degraded.each { |path| results_by_path[path] = session.analyze(path) }
+            degraded.each do |path|
+              results_by_path[path] = session.analyze(path)
+              refusals_by_path[path] = session.drain_trust_refusals
+            end
             merge_worker_reporters(session.drain_reporters)
             # The degraded slice ran on the parent session, so a disclosure it registered lives there.
             merge_run_disclosures(session.drain_run_disclosures)
@@ -821,11 +874,25 @@ module Rigor
             @collected_effects.merge!(session.drain_effects) if @record_effects
           end
 
+          merge_slice_refusals(slices, refusals_by_slice, refusals_by_path)
           diagnostics = Array(session.prepare_diagnostics) +
                         files.flat_map { |path| results_by_path.fetch(path, []) }
           degraded.empty? ? diagnostics : diagnostics.unshift(pool_degraded_diagnostic(degraded.size, "fork"))
         end
 
+        # Issue #1900 — a surviving child's drain covers its whole slice; a degraded slice was re-analysed on
+        # the parent and drained file by file. Slices are contiguous runs of `files`, so walking them in index
+        # order merges every refusal in the order the sequential run made it.
+        def merge_slice_refusals(slices, refusals_by_slice, refusals_by_path)
+          slices.each_with_index do |slice, index|
+            if refusals_by_slice.key?(index)
+              merge_trust_refusals(refusals_by_slice[index])
+            else
+              slice.each { |path| merge_trust_refusals(refusals_by_path[path]) }
+            end
+          end
+        end
+
         # Child-process body for {#analyze_files_in_fork_pool}. Analyses the slice with the
         # copy-on-write-inherited session and writes the Marshal'd payload to `out_path`. `exit!` skips
         # `at_exit` / stdio flush — the payload is already durable on disk by then.
@@ -840,7 +907,8 @@ module Rigor
           results = slice.to_h { |path| [path, session.analyze(path)] }
           payload = { results: results, reporters: session.drain_reporters,
                       dependencies: session.drain_dependencies,
-                      disclosures: session.drain_run_disclosures }
+                      disclosures: session.drain_run_disclosures,
+                      refusals: session.drain_trust_refusals }
           # ADR-103 WD13 — the effects slot exists only on a collecting run, so a normal `--workers N` run
           # marshals exactly the payload it marshalled before the feature existed.
           payload[:effects] = session.drain_effects if @record_effects
@@ -864,7 +932,9 @@ module Rigor
 
         # Waits for every forked child, merges each successful payload into `results_by_path`, and returns
         # the file paths whose worker exited abnormally (for in-process degrade).
-        def collect_fork_results(children, results_by_path)
+        # @param refusals_by_slice — issue #1900 — receives each successful payload's trust-refusal drain
+        #   under the child's slice index, for the caller to merge in file order; nil merges it at once.
+        def collect_fork_results(children, results_by_path, refusals_by_slice: nil)
           degraded = []
           children.each do |child|
             _, status = Process.waitpid2(child[:pid])
@@ -873,6 +943,8 @@ module Rigor
               results_by_path.merge!(payload.fetch(:results))
               merge_worker_reporters(payload.fetch(:reporters))
               merge_run_disclosures(payload.fetch(:disclosures, []))
+              refusals = payload.fetch(:refusals, [])
+              refusals_by_slice ? refusals_by_slice[child[:index]] = refusals : merge_trust_refusals(refusals)
               @collected_dependencies.merge!(payload.fetch(:dependencies, {})) if @record_dependencies
               @collected_effects.merge!(payload.fetch(:effects, {})) if @record_effects
             else
@@ -957,7 +1029,15 @@ module Rigor
         # @param source_files — issue #793 — the whole project, so this path's environment
         #   carries the same plugin-synthesized RBS the pool workers' would. It used to build over `[]`,
         #   i.e. with no synthesized RBS at all, even on a full run.
+        #
+        # Issue #1900 — it also runs `#prepare` on the coordinator-side registry it analyses with, BEFORE the
+        # environment build as the sequential pre-pass does. A pooled run's pre-pass skips `#prepare` (the
+        # workers run it), and this path has no workers, so every plugin used to analyse unprepared and its
+        # prepare rows and prepare-time trust refusals were lost. The rows head the stream, where the pool
+        # backends put their workers' prepare rows; the refusals land on the coordinator's own
+        # {Plugin::IoBoundary}s, which {DiagnosticAggregator#plugin_trust_refusal_diagnostics} reads.
         def analyze_files_sequentially_fallback(files, reason:, source_files: files)
+          prepare_rows = prepare_coordinator_plugins_once
           environment = build_runner_environment(source_files: source_files)
           # Same set, same ORDER as `#analyze_files_sequentially`. The signature state used to be hand-copied
           # here slot by slot, which dropped `synthesized-namespace` and every conformance row. The conformance
@@ -965,7 +1045,7 @@ module Rigor
           # BEFORE the definition-build failures are read below, or a failure only that scan reaches is lost.
           snapshot_project_signature_state(environment)
           snapshot_effect_annotation_carrier(environment.rbs_loader)
-          diagnostics = files.flat_map { |path| @analyze_file.call(path, environment) }
+          diagnostics = prepare_rows + files.flat_map { |path| @analyze_file.call(path, environment) }
           loader = environment.rbs_loader
           # Issue #696 — this path analyses on the coordinator, so its loader IS the one that reached the
           # failing build, and it must snapshot the same slot the two real paths do. Reached whenever
@@ -987,6 +1067,15 @@ module Rigor
           )
         end
 
+        # Issue #1900 — `#prepare` on the coordinator-side registry, at most once per run: a second call would
+        # re-publish every cross-plugin fact into the shared fact store.
+        def prepare_coordinator_plugins_once
+          return [] if @coordinator_plugins_prepared
+
+          @coordinator_plugins_prepared = true
+          Array(@prepare_coordinator_plugins.call)
+        end
+
         def merge_worker_reporters(drained)
           merge_rbs_extended_reporter(drained.fetch(:rbs_extended))
           drained.fetch(:boundary_cross).each do |entry|
@@ -1081,8 +1170,14 @@ module Rigor
         def record_definition_build_failures(failures)
           return if failures.nil? || failures.empty?
 
+          # Issue #1902 — one tuple per class, chosen by {Environment::RbsLoader.definition_build_detail_order}
+          # rather than by arrival: a fresh record and a replayed one (or two workers' records) for the same
+          # class can name different failures, and the earlier one used to win.
           @snapshots.definition_build_failures =
-            (@snapshots.definition_build_failures + failures).uniq(&:first).freeze
+            (@snapshots.definition_build_failures + failures)
+            .group_by(&:first)
+            .map { |_, candidates| candidates.min_by { |c| Environment::RbsLoader.definition_build_detail_order(c) } }
+            .freeze
         end
 
         # Issue #784 — first-wins, unlike {#record_definition_build_failures}'s accumulate-and-dedup. That

data/lib/rigor/analysis/runner/project_pre_passes.rb

@@ -8,6 +8,7 @@ require_relative "../../inference/synthetic_method_scanner"
 require_relative "../../inference/project_patched_scanner"
 require_relative "../dependency_source_inference"
 require_relative "../project_scan"
+require_relative "../worker_session"
 require_relative "../template_units"
 require_relative "../template_unit_collector"
 
@@ -256,11 +257,15 @@ module Rigor
         # Issue #1541 — what a pooled run's workers would have produced from `#prepare`, for the coordinator's
         # empty-closure branch, which dispatches none: the `#prepare` error rows and the run-scoped
         # registrations (`#disclose_once` / `#emit_once`) made there. It runs on a THROWAWAY registry, so
-        # nothing `#prepare` records on a plugin instance (a trust refusal, say) reaches the coordinator-side
-        # instances {DiagnosticAggregator} reads — a pooled cold run never shows those either.
-        # Returns the rows first, then the disclosure records.
+        # nothing `#prepare` records on a plugin instance reaches the coordinator-side instances
+        # {DiagnosticAggregator} reads; issue #1900 — the trust refusals are therefore handed back too, in
+        # the shape {Analysis::WorkerSession#drain_trust_refusals} gives a pooled cold run's.
+        # Returns the rows first, then the disclosure records, then the refusals.
         def prepare_throwaway_registry
           registry = load_plugins
+          # Issue #1900 — `#init` already ran (in `load_plugins`) and its refusals are the coordinator-side
+          # registry's to report, so only what `#prepare` refuses from here on is handed back.
+          baseline = WorkerSession.refusal_counts(registry)
           rows = plugin_prepare_diagnostics(registry)
           records = registry.plugins.flat_map do |plugin|
             plugin_id = safe_plugin_id(plugin)
@@ -268,7 +273,14 @@ module Rigor
           rescue StandardError
             []
           end
-          [rows, records]
+          [rows, records, trust_refusals(registry, baseline)]
+        end
+
+        # Issue #1900 — `#prepare` on `plugin_registry` itself, returning its error rows. For the pool
+        # coordinator's sequential fallback, which analyses on the coordinator-side registry that {#run}
+        # left unprepared because the run is in pool mode.
+        def prepare_registry(plugin_registry)
+          plugin_prepare_diagnostics(plugin_registry)
         end
 
         # Returns the per-run shared `Plugin::FactStore` instance. All loaded plugins share this store
@@ -282,6 +294,19 @@ module Rigor
 
         private
 
+        def trust_refusals(registry, baseline)
+          registry.plugins.filter_map do |plugin|
+            summary = plugin.io_boundary.refusal_summary
+            next nil if summary.nil?
+
+            plugin_id = safe_plugin_id(plugin)
+            delta = summary[:count] - baseline.fetch(plugin_id, 0)
+            summary.merge(count: delta, plugin_id: plugin_id) if delta.positive?
+          rescue StandardError
+            nil
+          end
+        end
+
         def pool_mode?
           @pool_mode_reader.call
         end

data/lib/rigor/analysis/runner.rb

@@ -297,7 +297,8 @@ module Rigor
                      record_dependencies: false, record_self_calls: false, analyze_only: nil,
                      seed_bundles: nil, collect_seed_bundles: false, param_inferred_types: nil,
                      discovery_seed: nil, no_tolerated_effects: false,
-                     restored_run_level_rows: nil, served_per_file_diagnostics: nil, on_file_indexed: nil)
+                     restored_run_level_rows: nil, served_per_file_diagnostics: nil, served_effect_collections: nil,
+                     on_file_indexed: nil)
         @configuration = configuration
         # ADR-113 WD2 — `rigor lens` reads a target's seeded index here: called with `(path, parse_result, scope,
         # index)` for every file this process indexes, after its rules ran and inside the run window, so the reader
@@ -311,6 +312,10 @@ module Rigor
         # narrowed run does not analyse, spliced into this run's per-file stream by
         # {#interleave_served_diagnostics}. Empty on every other run.
         @served_per_file_diagnostics = served_per_file_diagnostics || {}
+        # Issue #1898 — `{path => FileCollection}` the {IncrementalSession} serves for the same unanalysed files, so the
+        # effect graph this run closes (and the envelope pass judges) spans the whole project, not just the closure.
+        # Never part of {#effect_collections_by_path}, which stays what THIS run collected. Empty on every other run.
+        @served_effect_collections = served_effect_collections || {}
         @explain = explain
         @cache_store = enforce_read_only_cache(cache_store, buffer)
         @plugin_requirer = plugin_requirer
@@ -851,7 +856,8 @@ module Rigor
         analysis = serve_effect_collections(expansion, environment, key_descriptor, rbs_descriptor)
         computed = false
         diagnostics = @cache_store.fetch_or_validate(
-          producer_id: RunCacheKey::RUN_DIAGNOSTICS_PRODUCER_ID, key_descriptor: key_descriptor,
+          producer_id: RunCacheKey::RUN_DIAGNOSTICS_PRODUCER_ID,
+          key_descriptor: RunCacheKey.with_roots(key_descriptor, expansion.fetch(:roots)),
           generation_cap: RunCacheKey::GENERATION_CAP
         ) do
           computed = true
@@ -1380,7 +1386,8 @@ module Rigor
 
       def build_run_dependency_descriptor(expansion, rbs_descriptor)
         entries = analyzed_file_entries(expansion) + discovery_file_entries(expansion) +
-                  pre_eval_file_entries + template_unit_file_entries + rbs_descriptor.files
+                  pre_eval_file_entries + template_unit_file_entries + rbs_descriptor.files +
+                  root_presence_entries(expansion)
         # #979 — the signature ROOTS' listings, one glob row each. `rbs_descriptor.files` covers only the
         # `.rbs` files that existed while the run read them, so without these a signature file written after
         # the run left the slot validating fresh and the warm run answered without it.
@@ -1391,6 +1398,20 @@ module Rigor
         Cache::Descriptor.new(files: entries, globs: globs.uniq)
       end
 
+      # #1962 / #1555 — a kind row per path the run's answer depends on the presence and kind of, not only its
+      # bytes. An analysis root: its path errors (`no such file or directory`, `not a Ruby file`) answer to whether
+      # it exists and whether it is a directory or a file, while what a directory root holds is the analysed-file
+      # set the key carries. A `pre_eval:` entry: `pre-eval.file-not-found` answers to whether it is a file (one
+      # that is has its `:stat` row from {#pre_eval_file_entries}). A project signature root, configured or the
+      # auto-detected `sig`: the loader reads a directory and a file differently, and #979's listing rows cover a
+      # file appearing under a root that existed, not the root appearing. A kind row rather than an existence row,
+      # because a directory replaced by a file of the same name leaves an existence row fresh. The `--incremental`
+      # slot records existence rows for the same paths ({#incremental_slot_rows}, {#baseline_dependency_rows}).
+      def root_presence_entries(expansion)
+        (expansion.fetch(:roots) + @configuration.pre_eval + signature_root_candidates)
+          .uniq.map { |path| Cache::Descriptor::FileEntry.kind(path: path) }
+      end
+
       # Every file a plugin read or probed through its `IoBoundary` (#577 / #613), and every directory it listed
       # (#954), as the boundaries stand when asked.
       def plugin_boundary_rows
@@ -1580,7 +1601,7 @@ module Rigor
           end
         end
       end
-      private :plugin_boundary_rows, :producer_watch_glob_entries, :existence_entries,
+      private :plugin_boundary_rows, :producer_watch_glob_entries, :existence_entries, :root_presence_entries,
               :analysis_reads_attributed?, :signature_root_candidates, :discovery_glob_entries,
               :unanalysed_pre_eval_entries, :signature_rows, :within?
 
@@ -1907,8 +1928,10 @@ module Rigor
       # The run's per-file effect collections in sorted path order — the sequential half merged with the
       # pool's, exactly as {#file_dependencies} reconciles its two halves. Sorted, because the fold below
       # it must not depend on pool-completion order.
+      # Issue #1898 — a narrowed incremental run adds the collections its session served for the files it did not
+      # analyse, under this run's own for any path both name.
       def effect_collections
-        effect_collections_by_path.sort_by { |path, _| path.to_s }.map(&:last)
+        @served_effect_collections.merge(effect_collections_by_path).sort_by { |path, _| path.to_s }.map(&:last)
       end
 
       # Editor mode § "Scope choice — option A". Under `buffer:` non-nil the per-file analysis emits
@@ -2024,7 +2047,8 @@ module Rigor
           analyze_file: ->(path, environment) { analyze_file(path, environment) },
           restored_run_level_rows: @restored_run_level_rows,
           feature_sources: -> { required_feature_sources },
-          plugin_prepare: -> { @pre_passes.prepare_throwaway_registry }
+          plugin_prepare: -> { @pre_passes.prepare_throwaway_registry },
+          prepare_coordinator_plugins: -> { @pre_passes.prepare_registry(@plugin_registry) }
         )
         @diagnostic_aggregator = DiagnosticAggregator.new(
           configuration: @configuration,
@@ -2044,7 +2068,8 @@ module Rigor
           definition_build_failures_snapshot: -> { @snapshots.definition_build_failures },
           hkt_scan_failure_snapshot: -> { @snapshots.hkt_scan_failure },
           conformance_results_snapshot: -> { @snapshots.conformance_results },
-          pooled_run_disclosures: -> { @pool_coordinator.collected_run_disclosures }
+          pooled_run_disclosures: -> { @pool_coordinator.collected_run_disclosures },
+          pooled_trust_refusals: -> { @pool_coordinator.collected_trust_refusals }
         )
       end
 
@@ -2197,7 +2222,7 @@ module Rigor
             bad << [path, "no such file or directory"]
           end
         end
-        { files: files, errors: path_expansion_errors(bad, any_files: files.any?) }
+        { files: files, roots: Array(paths).map(&:to_s), errors: path_expansion_errors(bad, any_files: files.any?) }
       end
 
       # A bad path *among valid ones* is a warn-and-skip — the run still does useful work, so `rigor check
@@ -2654,7 +2679,8 @@ module Rigor
           node_collectors: node_collectors,
           stated_runtime_ruby: @configuration.stated_runtime_ruby
         )
-        diagnostics + plugin_emitted_diagnostics(path, root, scope, node_results)
+        plugin_rows = plugin_emitted_diagnostics(path, root, scope, node_results)
+        diagnostics + CheckRules.filter_plugin_suppressed(plugin_rows, path: path, comments: parse_result.comments)
       end
 
       # ADR-24 slice 4a — runs `block` (the typing pass) with the self-call recorder active when either

data/lib/rigor/analysis/severity_stamp.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "check_rules/rule_ids"
 require_relative "diagnostic"
 require_relative "../configuration/severity_profile"
 
@@ -9,14 +10,46 @@ module Rigor
     # overrides and drops any diagnostic resolving to `:off`. Rules emit with their authored severity; the
     # profile is the final filter.
     #
+    # Issue #1895 — the `.rigor.yml` `disable:` list is applied here too, ahead of the profile, with the same
+    # token expansion and match per-file analysis uses ({CheckRules.config_disabled?}), but only to a built-in
+    # check-rule row (see {.check_rule_row?}): the rows the diagnostic policy already says `disable:` reaches. Most
+    # are filtered where they were produced; this catches the ones that are not (the `effect.annotations-unchecked`
+    # residual under `disable: [all]`) on every run shape (sequential, pool, `--incremental`, a warm cache hit).
+    # Issue #1953 — a plugin's `plugin.<id>.*` row answers here to its qualified id (`plugin.<id>.<rule>`) or to
+    # `plugin.<id>`, never to a bare id or `all`. The run-level rows outside the check-rule catalogue
+    # (`rbs.coverage.*`, `dynamic.dependency-source.*`, the plugin loader, `plugin_trust.*`, `pool-degraded`) keep
+    # answering to `severity_overrides:` only, by any spelling.
+    #
     # Extracted (ADR-87 WD4) so the miss path ({Runner::DiagnosticAggregator}) and the boot-slimming hit path
     # ({RunCacheProbe}, which never loads the aggregator) apply the IDENTICAL final filter — a warm HIT's
     # served diagnostics are byte-identical to what a full run would print.
     module SeverityStamp
       module_function
 
+      CHECK_RULES = CheckRules::ALL_RULES.to_set.freeze
+      private_constant :CHECK_RULES
+
       def apply(diagnostics, configuration)
-        diagnostics.filter_map { |diagnostic| stamp(diagnostic, configuration) }
+        disabled = CheckRules.expand_rule_tokens(configuration.disabled_rules)
+        diagnostics.filter_map do |diagnostic|
+          next nil if config_disabled_row?(diagnostic, disabled)
+
+          stamp(diagnostic, configuration)
+        end
+      end
+
+      # A built-in check-rule row answers to the expanded list by its id or `all`; a plugin's `plugin.<id>.*` row
+      # by its qualified id or `plugin.<id>` only ({CheckRules.plugin_row_disabled?}, issue #1953). Every other
+      # row is out of the list's reach.
+      def config_disabled_row?(diagnostic, disabled)
+        return CheckRules.config_disabled?(diagnostic.rule, disabled) if check_rule_row?(diagnostic)
+
+        CheckRules.plugin_row_disabled?(diagnostic, disabled)
+      end
+
+      # A built-in check-rule row: its id is in the CheckRules catalogue and no plugin emitted it.
+      def check_rule_row?(diagnostic)
+        diagnostic.source_family == Diagnostic::DEFAULT_SOURCE_FAMILY && CHECK_RULES.include?(diagnostic.rule)
       end
 
       def stamp(diagnostic, configuration)

data/lib/rigor/analysis/worker_session.rb

@@ -241,7 +241,8 @@ module Rigor
           node_collectors: node_collectors,
           stated_runtime_ruby: @configuration.stated_runtime_ruby
         )
-        diagnostics += plugin_emitted_diagnostics(path, root, scope, node_results)
+        plugin_rows = plugin_emitted_diagnostics(path, root, scope, node_results)
+        diagnostics += CheckRules.filter_plugin_suppressed(plugin_rows, path: path, comments: parse_result.comments)
         diagnostics + explain_diagnostics(path, parse_result.value, scope)
       rescue Errno::ENOENT => e
         [analyzer_error(path, e.message)]
@@ -336,6 +337,45 @@ module Rigor
         end
       end
 
+      # Issue #1900 — `{plugin id => refused-read count}` over `registry`'s boundaries right now: the baseline
+      # a later drain subtracts, so it reports only the refusals made after the baseline was taken.
+      def self.refusal_counts(registry)
+        registry.plugins.to_h do |plugin|
+          summary = begin
+            plugin.io_boundary.refusal_summary
+          rescue StandardError
+            nil
+          end
+          [safe_plugin_id(plugin), summary ? summary[:count] : 0]
+        end
+      end
+
+      def self.safe_plugin_id(plugin)
+        plugin.manifest.id
+      rescue StandardError
+        plugin.class.to_s
+      end
+
+      # Issue #1900 — the {Plugin::IoBoundary} trust-policy refusals this session's plugin instances made
+      # since the previous drain, one `{plugin_id:, count:, first_path:, nearest_root:}` per plugin that hit
+      # any, in registry order. Unlike {#drain_run_disclosures} each drain reports only what is new — the
+      # boundary keeps its running total and this session remembers how much of it was already reported —
+      # because the coordinator SUMS the drains: a fork child inherits the parent's `#prepare` refusals,
+      # and reporting them again would count them once per worker. `first_path` is the boundary's first
+      # refusal overall, which is the delta's own first path whenever nothing was reported before it, and
+      # the coordinator keeps the first-merged path otherwise. It is not baselined after `#init`, so a plugin
+      # whose `#init` refuses differently here than on the coordinator registry can have this session's
+      # `#init` path named. Marshal-clean and Ractor-copyable.
+      def drain_trust_refusals
+        return [] if @plugin_registry.empty?
+
+        @plugin_registry.plugins.filter_map do |plugin|
+          trust_refusal_delta(plugin)
+        rescue StandardError
+          nil
+        end
+      end
+
       private
 
       # Mirrors {Runner#seed_project_scope}: applies the cross-file pre-pass discovery tables the
@@ -402,6 +442,10 @@ module Rigor
       def run_plugin_prepare
         return [] if @plugin_registry.empty?
 
+        # Issue #1900 — per plugin id, how much of its boundary's count is already reported. Starts at what
+        # `#init` refused while the registry was materialised: `#init` runs on the coordinator-side registry
+        # too, which reports those reads itself, so counting them here as well would double them.
+        @reported_refusal_counts = self.class.refusal_counts(@plugin_registry)
         @plugin_registry.plugins.flat_map do |plugin|
           plugin.prepare(plugin.services)
           []
@@ -490,6 +534,18 @@ module Rigor
         )
       end
 
+      def trust_refusal_delta(plugin)
+        summary = plugin.io_boundary.refusal_summary
+        return nil if summary.nil?
+
+        plugin_id = safe_plugin_id(plugin)
+        delta = summary[:count] - @reported_refusal_counts.fetch(plugin_id, 0)
+        return nil unless delta.positive?
+
+        @reported_refusal_counts[plugin_id] = summary[:count]
+        summary.merge(count: delta, plugin_id: plugin_id)
+      end
+
       def safe_plugin_id(plugin)
         plugin.manifest.id
       rescue StandardError