rigortype 0.4.3 → 0.4.5

data/lib/rigor/analysis/runner/pool_coordinator.rb

@@ -46,7 +46,8 @@ module Rigor
                        synthetic_method_index:, project_patched_methods:,
                        analyze_file:, project_scope_seed: -> { {} }, record_dependencies: false,
                        restored_run_level_rows: nil, template_units: -> { TemplateUnits.empty },
-                       feature_sources: -> { {} }, plugin_prepare: -> { [[], []] })
+                       feature_sources: -> { {} }, plugin_prepare: -> { [[], [], []] },
+                       prepare_coordinator_plugins: -> { [] })
           @configuration = configuration
           @cache_store = cache_store
           @explain = explain
@@ -66,6 +67,12 @@ module Rigor
           # The de-duplication has to happen here, on the parent, because each fork worker owns its own
           # plugin instances and therefore its own `@run_disclosures` table.
           @collected_run_disclosures = {}
+          # Issue #1900 — the trust-policy refusals ({Analysis::WorkerSession#drain_trust_refusals}) a pool run
+          # collected from the pre-fork parent session and every worker, keyed by plugin id and summed. The
+          # coordinator-side registry, which {DiagnosticAggregator#plugin_trust_refusal_diagnostics} also
+          # reads, runs neither `#prepare` nor per-file analysis on a pooled run, so without this table a
+          # refusal recorded in `--workers 0` vanished in `--workers N`.
+          @collected_trust_refusals = {}
           @collect_stats = collect_stats
           @buffer = buffer
           @feature_sources = feature_sources
@@ -84,10 +91,15 @@ module Rigor
           # inherits the same compiled bytes.
           @template_units_reader = template_units
           @analyze_file = analyze_file
-          # Issue #1541 — `() -> [rows, disclosure records]`, a `#prepare` run on a throwaway registry. Read
-          # only by {#serve_empty_closure}: a pooled run's `#prepare` happens inside its workers, and an
-          # empty closure dispatches none.
+          # Issue #1541 — `() -> [rows, disclosure records, trust refusals]`, a `#prepare` run on a throwaway
+          # registry. Read only by {#serve_empty_closure}: a pooled run's `#prepare` happens inside its
+          # workers, and an empty closure dispatches none.
           @plugin_prepare = plugin_prepare
+          # Issue #1900 — `() -> rows`, `#prepare` run on the coordinator-side registry itself. Read only by
+          # {#analyze_files_sequentially_fallback}, which analyses on that registry: the pre-pass skips
+          # `#prepare` whenever `pool_mode?`, so without this the fallback ran every plugin unprepared.
+          @prepare_coordinator_plugins = prepare_coordinator_plugins
+          @coordinator_plugins_prepared = false
           # Issues #796 / #794 — the previous full run's run-level rows, handed down by
           # {Analysis::IncrementalSession} on a NARROWED run only (a recheck's closure, a
           # `--verify-incremental` partition). A full run leaves this nil and derives everything itself.
@@ -99,6 +111,13 @@ module Rigor
         # so the incremental session's dependency graph is refreshed whether analysis ran sequential or pooled.
         attr_reader :collected_dependencies
 
+        # Issue #1553 — the per-file plugin reads the fork pool's workers recorded this run (empty unless
+        # `record_dependencies:` and a pool run occurred), folded into `Runner#analysis_reads`. Each worker's are
+        # marshalled back beside its dependency records.
+        def collected_analysis_reads
+          @collected_analysis_reads ||= {}
+        end
+
         # ADR-103 WD12 — the per-file {Effects::FileCollection}s the fork pool captured this run (empty
         # unless the configuration carries an `effects:` block and a pool run occurred). The runner merges
         # these with its own sequential records before the post-pool fixpoint.
@@ -123,6 +142,27 @@ module Rigor
           end
         end
 
+        # Issue #1900 — the trust refusals a pool run collected, one `{plugin_id:, count:, first_path:,
+        # nearest_root:}` per plugin, in first-merge order. Empty on a sequential run, where the runner's own
+        # registry made every read.
+        def collected_trust_refusals
+          @collected_trust_refusals.values
+        end
+
+        # Issue #1900 — folds one session's / one worker payload's refusal drain in: counts add, and the
+        # first path stays the one merged first. Callers merge in the order `--workers 0` would have made the
+        # reads — the parent's (or one worker's) `#prepare`, then the files in analysis order — so the summed
+        # row names the same first path the sequential run does, except where a drain's own first path is
+        # not this merge's to choose (see {DiagnosticAggregator#plugin_trust_refusal_diagnostics}).
+        def merge_trust_refusals(records)
+          Array(records).each do |record|
+            plugin_id = record[:plugin_id]
+            existing = @collected_trust_refusals[plugin_id]
+            @collected_trust_refusals[plugin_id] =
+              existing ? existing.merge(count: existing[:count] + record[:count]) : record
+          end
+        end
+
         # ADR-15 Phase 4b — pool mode is enabled when `@workers > 0`. Editor mode (`buffer:` non-nil)
         # silently overrides pool mode to sequential: per design § "Ractor pool mode", the pool's warm-up
         # cost dominates one-file wall time, so the pool gains nothing on a per-buffer invocation. The
@@ -164,13 +204,17 @@ module Rigor
             if pool_mode?
               dispatch_pool(files, source_files: source_files)
             else
-              analyze_files_sequentially(
-                files, environment || resolve_sequential_environment(source_files: source_files)
-              )
+              environment ||= resolve_sequential_environment(source_files: source_files)
+              analyze_files_sequentially(files, environment)
             end
           # Issues #796 / #794 — a narrowed run's own demand set is a SUBSET of the full run's, so the two
-          # rows below are folded in after it, whichever backend produced the per-file stream.
-          replayed_restored_run_level_rows?(closure: files)
+          # rows below are folded in after it, whichever backend produced the per-file stream. Issue #1929 —
+          # the sequential run's environment re-derives a stale replayed failure; a pool run has none on
+          # this side and resolves one only when a stale failure needs it.
+          redemand_env = lambda do
+            environment ||= resolve_sequential_environment(source_files: source_files)
+          end
+          replayed_restored_run_level_rows?(closure: files, redemand_env: redemand_env)
           result
         end
 
@@ -228,15 +272,18 @@ module Rigor
           # `env` rather than `resolve.call`: read the demand the snapshots above just made when they built
           # an environment, and force nothing when they did not.
           record_definition_build_failures(env&.rbs_loader&.definition_build_failures)
-          record_hkt_scan_failure(hkt_scan_outcome(resolve.call)) unless replayed_restored_run_level_rows?
+          # An empty closure analyses no file, so only a deleted file's buffer can make a tuple stale here.
+          replayed = replayed_restored_run_level_rows?(closure: [], redemand_env: resolve)
+          record_hkt_scan_failure(hkt_scan_outcome(resolve.call)) unless replayed
           prepare_rows
         end
 
         # Issue #1541 — the pooled empty closure's `#prepare`: the rows go to the caller, the run-scoped
         # registrations into the table the workers' payloads would have filled.
         def pooled_prepare_rows
-          rows, records = @plugin_prepare.call
+          rows, records, refusals = @plugin_prepare.call
           merge_run_disclosures(records)
+          merge_trust_refusals(refusals)
           Array(rows)
         end
 
@@ -285,18 +332,46 @@ module Rigor
         # of its own — and so no environment.
         #
         # @param closure — the files this run analyses; see {#stale_replayed_failure?}.
-        def replayed_restored_run_level_rows?(closure: nil)
+        # @param redemand_env — resolves the environment {#redemand_stale_failures} re-derives a stale
+        #   failure in; nil (the empty closure, which has no stale failure) re-derives nothing.
+        def replayed_restored_run_level_rows?(closure: nil, redemand_env: nil)
           rows = @restored_run_level_rows
           return false if rows.nil?
 
-          replayable = Array(rows.definition_build_failures).reject do |failure|
+          stale, replayable = Array(rows.definition_build_failures).partition do |failure|
             stale_replayed_failure?(failure, closure)
           end
           record_definition_build_failures(replayable)
+          redemand_stale_failures(stale, redemand_env)
           record_hkt_scan_failure(rows.hkt_scan_failure)
           true
         end
 
+        # Issue #1929 — a stale replayed failure is RE-DERIVED, not dropped. Dropping it was right for the
+        # class whose collision the edit removed, and wrong for every class the edit left failing: the file
+        # that demanded such a class usually sits outside the recheck's closure (the edited file only
+        # contributes a conflicting buffer, such as a missing superclass every subclass inherits), so
+        # nothing in the recheck asks for it again, and the row lost classes a cold run reports. The class
+        # is asked for again in this run's environment ({Environment::RbsLoader#redemand_definition}), so
+        # it is reported exactly when it still fails, with the tuple the current signatures give it.
+        #
+        # A class this run's own analysis already reported is skipped; its tuple is current. The residue:
+        # a class whose only demand was in an edited file that no longer makes it, and which still fails,
+        # stays reported until a full run. The failure itself is real, unlike the dropped-collision case
+        # this replaced.
+        def redemand_stale_failures(stale, redemand_env)
+          return if stale.empty? || redemand_env.nil?
+
+          reported = @snapshots.definition_build_failures.to_set(&:first)
+          pending = stale.map(&:first).reject { |name| reported.include?(name) }
+          return if pending.empty?
+
+          loader = redemand_env.call&.rbs_loader
+          return if loader.nil?
+
+          record_definition_build_failures(pending.filter_map { |name| loader.redemand_definition(name) })
+        end
+
         # A replayed definition-build failure the snapshot's own fingerprint cannot vouch for. The
         # fingerprint digests the three signature sources it can read WITHOUT an environment — `sig:`,
         # `Gemfile.lock` / `rbs_collection.lock.yaml`, and the configuration — but NOT the virtual RBS a
@@ -306,11 +381,11 @@ module Rigor
         # closure, its analysis demands nothing that would re-derive the row, and the run reports a
         # collision between files that no longer collide.
         #
-        # The narrowed run cannot re-derive the row either (#696 forbids Rigor demanding a definition the
-        # analysis did not), so the honest answer is to DROP it and under-report rather than assert a
-        # diagnostic on a program that may now be correct — false positives outrank worst-case reading. The
-        # cost is bounded to the row's own conflicting buffers: a collision between two files neither of
-        # which this run touches still replays.
+        # Such a failure is not replayed as it stands; {#redemand_stale_failures} re-derives it instead
+        # (#1929), so the row asserts no collision the current signatures do not have. A failure whose
+        # buffers name no file this run touches still replays. A buffer whose file no longer exists is stale
+        # too: deleting an inline source a tuple names would otherwise replay the deleted declaration's
+        # failure, where a full run reports what the remaining signatures give.
         def stale_replayed_failure?(failure, closure)
           return false if closure.nil?
 
@@ -320,7 +395,10 @@ module Rigor
           closure_paths = closure.to_set { |path| File.absolute_path(path.to_s) }
           Array(buffers).any? do |name|
             path = virtual_buffer_path(name)
-            !path.nil? && closure_paths.include?(File.absolute_path(path))
+            next false if path.nil?
+
+            absolute = File.absolute_path(path)
+            closure_paths.include?(absolute) || !File.exist?(absolute)
           end
         end
 
@@ -639,13 +717,15 @@ module Rigor
                 required_features: features
               )
               main = Ractor.main
-              main.send([:prepare, session.prepare_diagnostics])
+              # Issue #1900 — each message carries the refusals made since the previous one, so the coordinator
+              # can count ONE worker's `#prepare` (every worker repeats it) and sum the files in file order.
+              main.send([:prepare, session.prepare_diagnostics, session.drain_trust_refusals])
 
               loop do
                 msg = Ractor.receive
                 break if msg.nil?
 
-                main.send([:file, msg, session.analyze(msg)])
+                main.send([:file, msg, session.analyze(msg), session.drain_trust_refusals])
               end
 
               # Issue #1051 — sent with `:done`, not with `:prepare`: this backend builds no parent session,
@@ -664,6 +744,8 @@ module Rigor
           pool.each { |worker| worker.send(nil) }
 
           prepare_diagnostics = nil
+          prepare_refusals = nil
+          refusals_by_path = {}
           results_by_path = {}
           terminated = 0
 
@@ -681,9 +763,11 @@ module Rigor
 
             case message.first
             when :prepare
-              prepare_diagnostics ||= message.last
+              prepare_diagnostics ||= message[1]
+              prepare_refusals ||= message[2]
             when :file
               results_by_path[message[1]] = message[2]
+              refusals_by_path[message[1]] = message[3]
             when :done
               merge_worker_reporters(message[1])
               merge_run_disclosures(message[2])
@@ -702,6 +786,8 @@ module Rigor
           # it did. Re-analysed in process, exactly as the fork backend re-analyses a dead child's slice.
           degraded = files.reject { |path| results_by_path.key?(path) }
           reanalyze_degraded_in_process(degraded, results_by_path, source_files: source_files)
+          merge_trust_refusals(prepare_refusals)
+          files.each { |path| merge_trust_refusals(refusals_by_path[path]) }
 
           diagnostics = Array(prepare_diagnostics) + files.flat_map { |path| results_by_path.fetch(path, []) }
           degraded.empty? ? diagnostics : diagnostics.unshift(pool_degraded_diagnostic(degraded.size, "ractor"))
@@ -795,37 +881,62 @@ module Rigor
           # `merge_run_disclosures` drops it as a duplicate; only a disclosure a worker registers while
           # analysing its own slice adds anything.
           merge_run_disclosures(session.drain_run_disclosures)
+          # Issue #1900 — the parent's `#prepare` refusals, drained BEFORE the fork: every child inherits the
+          # session's record of what it already reported and drains only its own slice's, so the prepare-time
+          # refusal is counted once, as `--workers 0` counts it, rather than once per worker.
+          merge_trust_refusals(session.drain_trust_refusals)
           snapshot_fork_pool_stats(session) if @collect_stats
 
           worker_count = [@workers, files.size].min
           slices = files.each_slice((files.size.to_f / worker_count).ceil).to_a
           results_by_path = {}
+          # Issue #1900 — each surviving child's refusal drain by slice index, and each re-analysed file's by
+          # path, merged below in file order so the first refused path is the one `--workers 0` names.
+          refusals_by_slice = {}
+          refusals_by_path = {}
 
           degraded = Dir.mktmpdir("rigor-fork-pool") do |tmpdir|
             children = slices.each_with_index.map do |slice, index|
               out_path = File.join(tmpdir, "worker-#{index}")
               { pid: fork { run_fork_worker(session, slice, out_path) },
-                slice: slice, out_path: out_path }
+                slice: slice, out_path: out_path, index: index }
             end
-            collect_fork_results(children, results_by_path)
+            collect_fork_results(children, results_by_path, refusals_by_slice: refusals_by_slice)
           end
 
           unless degraded.empty?
-            degraded.each { |path| results_by_path[path] = session.analyze(path) }
+            degraded.each do |path|
+              results_by_path[path] = session.analyze(path)
+              refusals_by_path[path] = session.drain_trust_refusals
+            end
             merge_worker_reporters(session.drain_reporters)
             # The degraded slice ran on the parent session, so a disclosure it registered lives there.
             merge_run_disclosures(session.drain_run_disclosures)
             # The degraded slice was re-analysed on the parent session, so its dependency records live there,
             # not in a child payload — fold them in alongside the successful children's.
-            @collected_dependencies.merge!(session.drain_dependencies) if @record_dependencies
+            collect_dependencies(session.drain_dependencies, session.drain_analysis_reads) if @record_dependencies
             @collected_effects.merge!(session.drain_effects) if @record_effects
           end
 
+          merge_slice_refusals(slices, refusals_by_slice, refusals_by_path)
           diagnostics = Array(session.prepare_diagnostics) +
                         files.flat_map { |path| results_by_path.fetch(path, []) }
           degraded.empty? ? diagnostics : diagnostics.unshift(pool_degraded_diagnostic(degraded.size, "fork"))
         end
 
+        # Issue #1900 — a surviving child's drain covers its whole slice; a degraded slice was re-analysed on
+        # the parent and drained file by file. Slices are contiguous runs of `files`, so walking them in index
+        # order merges every refusal in the order the sequential run made it.
+        def merge_slice_refusals(slices, refusals_by_slice, refusals_by_path)
+          slices.each_with_index do |slice, index|
+            if refusals_by_slice.key?(index)
+              merge_trust_refusals(refusals_by_slice[index])
+            else
+              slice.each { |path| merge_trust_refusals(refusals_by_path[path]) }
+            end
+          end
+        end
+
         # Child-process body for {#analyze_files_in_fork_pool}. Analyses the slice with the
         # copy-on-write-inherited session and writes the Marshal'd payload to `out_path`. `exit!` skips
         # `at_exit` / stdio flush — the payload is already durable on disk by then.
@@ -840,7 +951,9 @@ module Rigor
           results = slice.to_h { |path| [path, session.analyze(path)] }
           payload = { results: results, reporters: session.drain_reporters,
                       dependencies: session.drain_dependencies,
-                      disclosures: session.drain_run_disclosures }
+                      analysis_reads: session.drain_analysis_reads,
+                      disclosures: session.drain_run_disclosures,
+                      refusals: session.drain_trust_refusals }
           # ADR-103 WD13 — the effects slot exists only on a collecting run, so a normal `--workers N` run
           # marshals exactly the payload it marshalled before the feature existed.
           payload[:effects] = session.drain_effects if @record_effects
@@ -864,7 +977,9 @@ module Rigor
 
         # Waits for every forked child, merges each successful payload into `results_by_path`, and returns
         # the file paths whose worker exited abnormally (for in-process degrade).
-        def collect_fork_results(children, results_by_path)
+        # @param refusals_by_slice — issue #1900 — receives each successful payload's trust-refusal drain
+        #   under the child's slice index, for the caller to merge in file order; nil merges it at once.
+        def collect_fork_results(children, results_by_path, refusals_by_slice: nil)
           degraded = []
           children.each do |child|
             _, status = Process.waitpid2(child[:pid])
@@ -873,7 +988,11 @@ module Rigor
               results_by_path.merge!(payload.fetch(:results))
               merge_worker_reporters(payload.fetch(:reporters))
               merge_run_disclosures(payload.fetch(:disclosures, []))
-              @collected_dependencies.merge!(payload.fetch(:dependencies, {})) if @record_dependencies
+              refusals = payload.fetch(:refusals, [])
+              refusals_by_slice ? refusals_by_slice[child[:index]] = refusals : merge_trust_refusals(refusals)
+              if @record_dependencies
+                collect_dependencies(payload.fetch(:dependencies, {}), payload.fetch(:analysis_reads, {}))
+              end
               @collected_effects.merge!(payload.fetch(:effects, {})) if @record_effects
             else
               degraded.concat(child[:slice])
@@ -882,6 +1001,12 @@ module Rigor
           degraded
         end
 
+        # ADR-46 / issue #1553 — fold one worker's dependency records and per-file plugin reads.
+        def collect_dependencies(dependencies, analysis_reads)
+          @collected_dependencies.merge!(dependencies)
+          collected_analysis_reads.merge!(analysis_reads)
+        end
+
         # @return the child's `{results:, reporters:}` payload, or nil when the child exited
         #   abnormally or wrote no readable payload. `Marshal.load` is safe here: the blob was written by
         #   our own forked child to a temp file we created.
@@ -957,7 +1082,15 @@ module Rigor
         # @param source_files — issue #793 — the whole project, so this path's environment
         #   carries the same plugin-synthesized RBS the pool workers' would. It used to build over `[]`,
         #   i.e. with no synthesized RBS at all, even on a full run.
+        #
+        # Issue #1900 — it also runs `#prepare` on the coordinator-side registry it analyses with, BEFORE the
+        # environment build as the sequential pre-pass does. A pooled run's pre-pass skips `#prepare` (the
+        # workers run it), and this path has no workers, so every plugin used to analyse unprepared and its
+        # prepare rows and prepare-time trust refusals were lost. The rows head the stream, where the pool
+        # backends put their workers' prepare rows; the refusals land on the coordinator's own
+        # {Plugin::IoBoundary}s, which {DiagnosticAggregator#plugin_trust_refusal_diagnostics} reads.
         def analyze_files_sequentially_fallback(files, reason:, source_files: files)
+          prepare_rows = prepare_coordinator_plugins_once
           environment = build_runner_environment(source_files: source_files)
           # Same set, same ORDER as `#analyze_files_sequentially`. The signature state used to be hand-copied
           # here slot by slot, which dropped `synthesized-namespace` and every conformance row. The conformance
@@ -965,7 +1098,7 @@ module Rigor
           # BEFORE the definition-build failures are read below, or a failure only that scan reaches is lost.
           snapshot_project_signature_state(environment)
           snapshot_effect_annotation_carrier(environment.rbs_loader)
-          diagnostics = files.flat_map { |path| @analyze_file.call(path, environment) }
+          diagnostics = prepare_rows + files.flat_map { |path| @analyze_file.call(path, environment) }
           loader = environment.rbs_loader
           # Issue #696 — this path analyses on the coordinator, so its loader IS the one that reached the
           # failing build, and it must snapshot the same slot the two real paths do. Reached whenever
@@ -987,6 +1120,15 @@ module Rigor
           )
         end
 
+        # Issue #1900 — `#prepare` on the coordinator-side registry, at most once per run: a second call would
+        # re-publish every cross-plugin fact into the shared fact store.
+        def prepare_coordinator_plugins_once
+          return [] if @coordinator_plugins_prepared
+
+          @coordinator_plugins_prepared = true
+          Array(@prepare_coordinator_plugins.call)
+        end
+
         def merge_worker_reporters(drained)
           merge_rbs_extended_reporter(drained.fetch(:rbs_extended))
           drained.fetch(:boundary_cross).each do |entry|
@@ -1081,8 +1223,14 @@ module Rigor
         def record_definition_build_failures(failures)
           return if failures.nil? || failures.empty?
 
+          # Issue #1902 — one tuple per class, chosen by {Environment::RbsLoader.definition_build_detail_order}
+          # rather than by arrival: a fresh record and a replayed one (or two workers' records) for the same
+          # class can name different failures, and the earlier one used to win.
           @snapshots.definition_build_failures =
-            (@snapshots.definition_build_failures + failures).uniq(&:first).freeze
+            (@snapshots.definition_build_failures + failures)
+            .group_by(&:first)
+            .map { |_, candidates| candidates.min_by { |c| Environment::RbsLoader.definition_build_detail_order(c) } }
+            .freeze
         end
 
         # Issue #784 — first-wins, unlike {#record_definition_build_failures}'s accumulate-and-dedup. That

data/lib/rigor/analysis/runner/project_pre_passes.rb

@@ -8,6 +8,7 @@ require_relative "../../inference/synthetic_method_scanner"
 require_relative "../../inference/project_patched_scanner"
 require_relative "../dependency_source_inference"
 require_relative "../project_scan"
+require_relative "../worker_session"
 require_relative "../template_units"
 require_relative "../template_unit_collector"
 
@@ -256,11 +257,15 @@ module Rigor
         # Issue #1541 — what a pooled run's workers would have produced from `#prepare`, for the coordinator's
         # empty-closure branch, which dispatches none: the `#prepare` error rows and the run-scoped
         # registrations (`#disclose_once` / `#emit_once`) made there. It runs on a THROWAWAY registry, so
-        # nothing `#prepare` records on a plugin instance (a trust refusal, say) reaches the coordinator-side
-        # instances {DiagnosticAggregator} reads — a pooled cold run never shows those either.
-        # Returns the rows first, then the disclosure records.
+        # nothing `#prepare` records on a plugin instance reaches the coordinator-side instances
+        # {DiagnosticAggregator} reads; issue #1900 — the trust refusals are therefore handed back too, in
+        # the shape {Analysis::WorkerSession#drain_trust_refusals} gives a pooled cold run's.
+        # Returns the rows first, then the disclosure records, then the refusals.
         def prepare_throwaway_registry
           registry = load_plugins
+          # Issue #1900 — `#init` already ran (in `load_plugins`) and its refusals are the coordinator-side
+          # registry's to report, so only what `#prepare` refuses from here on is handed back.
+          baseline = WorkerSession.refusal_counts(registry)
           rows = plugin_prepare_diagnostics(registry)
           records = registry.plugins.flat_map do |plugin|
             plugin_id = safe_plugin_id(plugin)
@@ -268,7 +273,14 @@ module Rigor
           rescue StandardError
             []
           end
-          [rows, records]
+          [rows, records, trust_refusals(registry, baseline)]
+        end
+
+        # Issue #1900 — `#prepare` on `plugin_registry` itself, returning its error rows. For the pool
+        # coordinator's sequential fallback, which analyses on the coordinator-side registry that {#run}
+        # left unprepared because the run is in pool mode.
+        def prepare_registry(plugin_registry)
+          plugin_prepare_diagnostics(plugin_registry)
         end
 
         # Returns the per-run shared `Plugin::FactStore` instance. All loaded plugins share this store
@@ -282,6 +294,19 @@ module Rigor
 
         private
 
+        def trust_refusals(registry, baseline)
+          registry.plugins.filter_map do |plugin|
+            summary = plugin.io_boundary.refusal_summary
+            next nil if summary.nil?
+
+            plugin_id = safe_plugin_id(plugin)
+            delta = summary[:count] - baseline.fetch(plugin_id, 0)
+            summary.merge(count: delta, plugin_id: plugin_id) if delta.positive?
+          rescue StandardError
+            nil
+          end
+        end
+
         def pool_mode?
           @pool_mode_reader.call
         end