rigortype 0.4.3 → 0.4.5

data/lib/rigor/analysis/runner.rb

@@ -26,6 +26,7 @@ require_relative "../effects/identity"
 require_relative "../effects/propagator"
 require_relative "../inference/parameter_inference_collector"
 require_relative "../inference/pre_eval_constants"
+require_relative "../inference/project_seed_tables"
 require_relative "../inference/scope_indexer"
 require_relative "../inference/synthetic_method_scanner"
 require_relative "../inference/project_patched_scanner"
@@ -98,6 +99,16 @@ module Rigor
         pooled.empty? ? @file_dependencies : @file_dependencies.merge(pooled)
       end
 
+      # Issue #1553 — the plugin reads ({Plugin::IoBoundary.attributing}) each file's analysis made this run,
+      # `{path => [row]}`, reconciled from the sequential and pooled halves exactly as {#file_dependencies} is.
+      # Empty unless `record_dependencies: true`; a file whose analysis read nothing has no key. The incremental
+      # session keeps them beside each file's cached rows so a later recheck re-analyses the file once one of
+      # them goes stale.
+      def analysis_reads
+        pooled = @pool_coordinator.collected_analysis_reads
+        pooled.empty? ? @analysis_reads : @analysis_reads.merge(pooled)
+      end
+
       # ADR-103 — the run's propagated effect graph, or {Effects::EffectTable.empty} when collection did
       # not run. Reconciled from the sequential and pooled halves exactly as {#file_dependencies} is, then
       # closed by the post-pool fixpoint in {#assemble_run_diagnostics}.
@@ -297,7 +308,8 @@ module Rigor
                      record_dependencies: false, record_self_calls: false, analyze_only: nil,
                      seed_bundles: nil, collect_seed_bundles: false, param_inferred_types: nil,
                      discovery_seed: nil, no_tolerated_effects: false,
-                     restored_run_level_rows: nil, served_per_file_diagnostics: nil, on_file_indexed: nil)
+                     restored_run_level_rows: nil, served_per_file_diagnostics: nil, served_effect_collections: nil,
+                     on_file_indexed: nil)
         @configuration = configuration
         # ADR-113 WD2 — `rigor lens` reads a target's seeded index here: called with `(path, parse_result, scope,
         # index)` for every file this process indexes, after its rules ran and inside the run window, so the reader
@@ -311,6 +323,10 @@ module Rigor
         # narrowed run does not analyse, spliced into this run's per-file stream by
         # {#interleave_served_diagnostics}. Empty on every other run.
         @served_per_file_diagnostics = served_per_file_diagnostics || {}
+        # Issue #1898 — `{path => FileCollection}` the {IncrementalSession} serves for the same unanalysed files, so the
+        # effect graph this run closes (and the envelope pass judges) spans the whole project, not just the closure.
+        # Never part of {#effect_collections_by_path}, which stays what THIS run collected. Empty on every other run.
+        @served_effect_collections = served_effect_collections || {}
         @explain = explain
         @cache_store = enforce_read_only_cache(cache_store, buffer)
         @plugin_requirer = plugin_requirer
@@ -459,6 +475,9 @@ module Rigor
         @project_struct_member_layouts = {}.freeze
         # Issue #684 — set per run by {#project_discovery_expansion}; nil on every path that does not widen.
         @project_discovery_expansion = nil
+        # Issue #1583 — whether this run widened its discovery to the configured paths, even when the widening
+        # added no file; {#discovery_glob_entries} lists the configured roots for every such run.
+        @discovery_widened = false
         # ADR-67 WD6a — the call-site parameter-inference table, populated by the opt-in pre-pass in
         # `assemble_run_diagnostics` when `parameter_inference:` is enabled, then seeded onto every per-file
         # scope (sequential + fork-worker) through `project_scope_seed_tables`. Empty by default, so the gate-off
@@ -513,6 +532,7 @@ module Rigor
 
         expansion = expand_paths(paths)
         @project_discovery_expansion = project_discovery_expansion(paths, expansion)
+        @discovery_widened = widen_discovery_to_project?(paths)
         @snapshots.reset_for_run
         # Per-run reset of the deferred-discovery memo (see `#ensure_project_discovery`).
         @project_discovery_done = false
@@ -594,6 +614,19 @@ module Rigor
         expand_paths(paths).fetch(:files)
       end
 
+      # Issue #1583 — the project files a run over `paths` would DISCOVER without analysing them (#684's
+      # widening), by globbing only. Empty whenever the run would not widen, which includes every run over
+      # the configured `paths:`. {IncrementalSession} digests them, because an edit to one moves the
+      # diagnostics of the files it does analyse.
+      def discovery_only_file_set(paths = @configuration.paths)
+        expansion = expand_paths(paths)
+        widened = project_discovery_expansion(paths, expansion)
+        return [] if widened.nil?
+
+        analysed = expansion.fetch(:files).to_set
+        widened.fetch(:files).reject { |path| analysed.include?(path) }
+      end
+
       # ADR-46 §2 — inverts {#file_dependencies} into the reverse edge the incremental step walks:
       # `dependents[X] = { A : A read a declaration / body from X }`. On an edit to X, the body tier
       # (slice 2) re-analyses `{X} ∪ dependents[X]` and serves every other file from the per-file cache.
@@ -786,6 +819,7 @@ module Rigor
         @project_discovery_done = false
         # This entry point supplies its own expansion; it never widens (see {#project_discovery_expansion}).
         @project_discovery_expansion = nil
+        @discovery_widened = false
         @run_generation = Object.new.freeze
         run_project_pre_passes(expansion: expansion)
         ensure_project_discovery(expansion)
@@ -851,7 +885,8 @@ module Rigor
         analysis = serve_effect_collections(expansion, environment, key_descriptor, rbs_descriptor)
         computed = false
         diagnostics = @cache_store.fetch_or_validate(
-          producer_id: RunCacheKey::RUN_DIAGNOSTICS_PRODUCER_ID, key_descriptor: key_descriptor,
+          producer_id: RunCacheKey::RUN_DIAGNOSTICS_PRODUCER_ID,
+          key_descriptor: RunCacheKey.with_roots(key_descriptor, expansion.fetch(:roots)),
           generation_cap: RunCacheKey::GENERATION_CAP
         ) do
           computed = true
@@ -1380,17 +1415,32 @@ module Rigor
 
       def build_run_dependency_descriptor(expansion, rbs_descriptor)
         entries = analyzed_file_entries(expansion) + discovery_file_entries(expansion) +
-                  pre_eval_file_entries + template_unit_file_entries + rbs_descriptor.files
+                  pre_eval_file_entries + template_unit_file_entries + rbs_descriptor.files +
+                  root_presence_entries(expansion)
         # #979 — the signature ROOTS' listings, one glob row each. `rbs_descriptor.files` covers only the
         # `.rbs` files that existed while the run read them, so without these a signature file written after
         # the run left the slot validating fresh and the warm run answered without it.
-        globs = rbs_descriptor.globs + template_unit_glob_entries
+        globs = rbs_descriptor.globs + template_unit_glob_entries + discovery_glob_entries
         boundary = plugin_boundary_rows
         entries.concat(boundary.files)
         globs.concat(boundary.globs).concat(producer_watch_glob_entries)
         Cache::Descriptor.new(files: entries, globs: globs.uniq)
       end
 
+      # #1962 / #1555 — a kind row per path the run's answer depends on the presence and kind of, not only its
+      # bytes. An analysis root: its path errors (`no such file or directory`, `not a Ruby file`) answer to whether
+      # it exists and whether it is a directory or a file, while what a directory root holds is the analysed-file
+      # set the key carries. A `pre_eval:` entry: `pre-eval.file-not-found` answers to whether it is a file (one
+      # that is has its `:stat` row from {#pre_eval_file_entries}). A project signature root, configured or the
+      # auto-detected `sig`: the loader reads a directory and a file differently, and #979's listing rows cover a
+      # file appearing under a root that existed, not the root appearing. A kind row rather than an existence row,
+      # because a directory replaced by a file of the same name leaves an existence row fresh. The `--incremental`
+      # slot records kind rows for the same paths ({#incremental_slot_rows}, {#baseline_dependency_rows}, #1977).
+      def root_presence_entries(expansion)
+        (expansion.fetch(:roots) + @configuration.pre_eval + signature_root_candidates)
+          .uniq.map { |path| Cache::Descriptor::FileEntry.kind(path: path) }
+      end
+
       # Every file a plugin read or probed through its `IoBoundary` (#577 / #613), and every directory it listed
       # (#954), as the boundaries stand when asked.
       def plugin_boundary_rows
@@ -1431,11 +1481,11 @@ module Rigor
       #   globs, which a producer replays into its boundary whether it computed or was served (#1558). A save
       #   after the read leaves the row stale, so no guard is needed.
       # - `derived` — rows taken when the run ENDS: the template files and their claimed globs (#392, re-analysed
-      #   every run), and one existence row per analysis root and per `pre_eval:` entry. A run's path errors (`no
-      #   such file or directory`, `pre-eval.file-not-found`) answer to those last rows; the plain slot records
-      #   neither, and the incremental path regenerates the errors every run, so a slot that served one past the
-      #   edit that retracts it would print what no run of that tree prints. Existence rows carry ADR-45 WD1b's
-      #   bound: a directory replaced by a file of the same name stays fresh.
+      #   every run), and one `:kind` row per analysis root and per `pre_eval:` entry. A run's path errors (`no
+      #   such file or directory`, `not a Ruby file`, `pre-eval.file-not-found`) answer to those last rows, and the
+      #   incremental path regenerates the errors every run, so a slot that served one past the edit that retracts
+      #   it would print what no run of that tree prints. A kind row rather than an existence row (#1977): an
+      #   existence row reads a directory replaced by a file of the same name as fresh, ADR-45 WD1b's bound.
       # - `by_file` — `{path => Descriptor}`, the plugin reads each file's analysis made
       #   ({Plugin::IoBoundary.attributing}). A narrowed run analyses only its closure, so the session carries the
       #   other files' reads forward from the previous slot.
@@ -1459,7 +1509,7 @@ module Rigor
         IncrementalSlotRows.new(
           observed: plugin_boundary_rows,
           derived: Cache::Descriptor.new(
-            files: template_unit_file_entries + existence_entries(Array(roots) + @configuration.pre_eval),
+            files: template_unit_file_entries + kind_entries(Array(roots) + @configuration.pre_eval),
             globs: template_unit_glob_entries
           ),
           by_file: @analysis_reads.transform_values do |reads|
@@ -1486,13 +1536,14 @@ module Rigor
       # which the session therefore carries unchanged from the full run that recorded them to every later slot:
       #
       # - the signature tree the plain slot records (`RbsDescriptor.file_entries` / `.glob_entries` over the loader
-      #   roots this run's analysis resolved), and an existence row per signature root, configured or the
-      #   auto-detected `sig` — a recheck rebuilds no environment unless its closure is non-empty, and the snapshot
-      #   fingerprint digests the same roots (configured, or the auto-detected `sig`), so a change to one drops the
-      #   snapshot and forces a full run rather than reaching a recheck;
+      #   roots this run's analysis resolved), and a `:kind` row per signature root, configured or the
+      #   auto-detected `sig` — a recheck rebuilds no environment unless its closure is non-empty. The snapshot
+      #   fingerprint digests the same roots, so a change to one makes the next full-path run a full run rather
+      #   than a recheck, but the engine-free slot probe serves before any fingerprint is consulted: a root that
+      #   turns from a file into a directory (or back) is declined there by this `:kind` row alone (#1977);
       # - the discovered-not-analysed files (#684) and a listing row per discovery root — a narrowed recheck does
       #   not widen discovery at all;
-      # - every `pre_eval:` file outside `files` (a stat row, or an absence row) — the session tracks only analysed
+      # - every `pre_eval:` file outside `files` (a stat row, or a kind row) — the session tracks only analysed
       #   files, and one that is analysed is guarded by its own row.
       #
       # Recomputing any of these on a recheck would vouch for the tree the recheck saw while its answer still
@@ -1516,7 +1567,7 @@ module Rigor
         own, pinned = signature_rows
         BaselineRows.new(
           owned: Cache::Descriptor.new(
-            files: own.files + existence_entries(signature_root_candidates) +
+            files: own.files + kind_entries(signature_root_candidates) +
                    discovery_file_entries({ files: files }) + unanalysed_pre_eval_entries(files),
             globs: (own.globs + discovery_glob_entries).uniq
           ),
@@ -1542,16 +1593,18 @@ module Rigor
 
       # The project's own signature roots, whether or not they exist: the configured `signature_paths:`, or the
       # `sig` directory `Environment.default_signature_paths` auto-detects when none are configured. The
-      # signature rows' listing rows cover a file appearing under a root that existed; only an existence row
-      # covers the root itself appearing.
+      # signature rows' listing rows cover a file appearing under a root that existed; only a row for the root
+      # itself covers it appearing.
       def signature_root_candidates
         @configuration.signature_paths || ["sig"]
       end
 
       # One names-mode listing row per directory the discovery widening globbed, so a file appearing there is seen
-      # as well as an edit to one that existed.
+      # as well as an edit to one that existed. Issue #1583 — keyed on the widening decision, not on what it
+      # added: a run over `lib/b.rb` alone in `lib` widens to nothing, and a `lib/a.rb` created afterwards must
+      # still move the answer of the run-result cache and the `--incremental` slot.
       def discovery_glob_entries
-        return [] if @project_discovery_expansion.nil?
+        return [] unless @discovery_widened
 
         @configuration.paths.select { |root| File.directory?(root) }.map do |root|
           Cache::Descriptor::GlobEntry.compute(root: root, pattern: PathExpansion::RUBY_GLOB, mode: :names)
@@ -1565,22 +1618,18 @@ module Rigor
           if File.file?(path)
             Cache::Descriptor::FileEntry.stat(path: path, digest: Cache::FileDigest.hexdigest(path))
           else
-            existence_entries([path]).first
+            kind_entries([path]).first
           end
         end
       end
 
-      def existence_entries(paths)
+      # #1977 — one `:kind` row per path, the row {#root_presence_entries} records in the plain slot.
+      def kind_entries(paths)
         paths.uniq.map do |path|
-          physical = @buffer ? @buffer.resolve(path) : path
-          if File.exist?(physical)
-            Cache::Descriptor::FileEntry.present(path: physical)
-          else
-            Cache::Descriptor::FileEntry.absent(path: physical)
-          end
+          Cache::Descriptor::FileEntry.kind(path: @buffer ? @buffer.resolve(path) : path)
         end
       end
-      private :plugin_boundary_rows, :producer_watch_glob_entries, :existence_entries,
+      private :plugin_boundary_rows, :producer_watch_glob_entries, :kind_entries, :root_presence_entries,
               :analysis_reads_attributed?, :signature_root_candidates, :discovery_glob_entries,
               :unanalysed_pre_eval_entries, :signature_rows, :within?
 
@@ -1804,8 +1853,14 @@ module Rigor
       # on what else was on the command line.
       #
       # Excluded, each because its expansion is already the one it means: the LSP `prebuilt:` path (which
-      # seeds discovery from a snapshot), editor `buffer:` mode, `run_source`'s in-memory single file, and
-      # ADR-46's `analyze_only` subset mode (which already passes the full expansion and filters later).
+      # seeds discovery from a snapshot), editor `buffer:` mode, and `run_source`'s in-memory single file.
+      #
+      # Issue #1583 — ADR-46's `analyze_only` subset mode widens like a full run. It was excluded on the
+      # reading that it "already passes the full expansion", which holds only when the incremental session
+      # runs over the configured `paths:`. `rigor check --incremental lib/b.rb` passes the argument's
+      # expansion, so its rechecks (and `--verify-incremental`'s partitions) discovered the argument alone
+      # while its baseline discovered the project, and `lib/b.rb`'s report on a sibling's constant came and
+      # went with the run kind.
       #
       # Issue #1556 — the widened set holds each FILE once. `.rigor.yml`'s `paths:` load as absolute paths and a
       # path argument usually does not, so `rigor check lib` widened discovery over both spellings of every file:
@@ -1843,8 +1898,7 @@ module Rigor
       end
 
       def widen_discovery_to_project?(paths)
-        @prebuilt.nil? && @buffer.nil? && @in_memory_sources.nil? && @analyze_only.nil? &&
-          paths != @configuration.paths
+        @prebuilt.nil? && @buffer.nil? && @in_memory_sources.nil? && paths != @configuration.paths
       end
 
       # ADR-46 — the dependency-recording and subset-analysis modes read the discovery tables OUTSIDE the
@@ -1907,8 +1961,10 @@ module Rigor
       # The run's per-file effect collections in sorted path order — the sequential half merged with the
       # pool's, exactly as {#file_dependencies} reconciles its two halves. Sorted, because the fold below
       # it must not depend on pool-completion order.
+      # Issue #1898 — a narrowed incremental run adds the collections its session served for the files it did not
+      # analyse, under this run's own for any path both name.
       def effect_collections
-        effect_collections_by_path.sort_by { |path, _| path.to_s }.map(&:last)
+        @served_effect_collections.merge(effect_collections_by_path).sort_by { |path, _| path.to_s }.map(&:last)
       end
 
       # Editor mode § "Scope choice — option A". Under `buffer:` non-nil the per-file analysis emits
@@ -2024,7 +2080,8 @@ module Rigor
           analyze_file: ->(path, environment) { analyze_file(path, environment) },
           restored_run_level_rows: @restored_run_level_rows,
           feature_sources: -> { required_feature_sources },
-          plugin_prepare: -> { @pre_passes.prepare_throwaway_registry }
+          plugin_prepare: -> { @pre_passes.prepare_throwaway_registry },
+          prepare_coordinator_plugins: -> { @pre_passes.prepare_registry(@plugin_registry) }
         )
         @diagnostic_aggregator = DiagnosticAggregator.new(
           configuration: @configuration,
@@ -2044,7 +2101,8 @@ module Rigor
           definition_build_failures_snapshot: -> { @snapshots.definition_build_failures },
           hkt_scan_failure_snapshot: -> { @snapshots.hkt_scan_failure },
           conformance_results_snapshot: -> { @snapshots.conformance_results },
-          pooled_run_disclosures: -> { @pool_coordinator.collected_run_disclosures }
+          pooled_run_disclosures: -> { @pool_coordinator.collected_run_disclosures },
+          pooled_trust_refusals: -> { @pool_coordinator.collected_trust_refusals }
         )
       end
 
@@ -2197,7 +2255,7 @@ module Rigor
             bad << [path, "no such file or directory"]
           end
         end
-        { files: files, errors: path_expansion_errors(bad, any_files: files.any?) }
+        { files: files, roots: Array(paths).map(&:to_s), errors: path_expansion_errors(bad, any_files: files.any?) }
       end
 
       # A bad path *among valid ones* is a warn-and-skip — the run still does useful work, so `rigor check
@@ -2400,50 +2458,21 @@ module Rigor
         tables[:published_constant_names] = names unless names.empty?
       end
 
-      # Issue #617 — the censused names that bind, grouped by last segment (`Scope#bound_constant_names`). A
-      # name some write other than a memo `||=` touches always binds. A memo-only name binds once memos of its
-      # segment span two files: either may load first and set the constant the other then reads, so only a
-      # memo no other file shares keeps the idiom's reading. Files are counted expanded, because discovery can
-      # walk one file under two spellings (`lib/b.rb`, `./lib/b.rb`).
+      # Issue #617 / #1290 — the binding and shadowing constant names, by last segment; derived by
+      # {Inference::ProjectSeedTables}, which the seed paths that run no `check` share.
       def constant_writer_index
-        @constant_writer_index ||= begin
-          memo_files = memo_files_by_segment
-          @project_constant_writes.each_with_object({}) do |(name, by_path), index|
-            segment = name.split("::").last
-            next if memo_only?(by_path) && memo_files.fetch(segment).size < 2
-
-            (index[segment] ||= []) << name
-          end.each_value(&:freeze).freeze
-        end
+        @constant_writer_index ||= Inference::ProjectSeedTables.constant_writers(@project_constant_writes)
       end
 
-      # Issue #1290 — the censused names some write other than a memo `||=` assigns, grouped by last segment
-      # (`Scope#shadowing_constant_names`): the ones that exist whether or not an outer constant of the name
-      # does, and so stop the lexical ladder above it. A memo-only name is left out however many files memoize
-      # it, unlike in {#constant_writer_index}: `X ||= v` resolves `X` through the very lookup whose lower rung
-      # the stop would replace, so wherever that rung answers, the memo finds it and never creates the name.
       def constant_shadower_index
-        @constant_shadower_index ||= @project_constant_writes.each_with_object({}) do |(name, by_path), index|
-          (index[name.split("::").last] ||= []) << name unless memo_only?(by_path)
-        end.each_value(&:freeze).freeze
+        @constant_shadower_index ||= Inference::ProjectSeedTables.constant_shadowers(@project_constant_writes)
       end
 
-      def memo_files_by_segment
-        @project_constant_writes.each_with_object({}) do |(name, by_path), files|
-          set = (files[name.split("::").last] ||= Set.new)
-          by_path.each { |path, descriptor| set << File.absolute_path(path) if memo_descriptor?(descriptor) }
-        end
-      end
-
-      def memo_only?(by_path) = by_path.each_value.all? { |descriptor| memo_descriptor?(descriptor) }
-      def memo_descriptor?(descriptor) = descriptor == Inference::ScopeIndexer::CONSTANT_MEMO
-
       # Issue #644 — the LAST SEGMENTS of the published table, the run-wide half of
       # `Scope#published_constant?`. Seeded on EVERY run (unlike `constant_sources`, which only a recording
       # run needs) because {CheckRules::PublishedConstantGuard} asks the question on every `if` / `unless`.
       def published_constant_name_set
-        @published_constant_name_set ||=
-          @project_constant_values.keys.to_set { |name| name.split("::").last }.freeze
+        @published_constant_name_set ||= Inference::ProjectSeedTables.published_constant_names(@project_constant_values)
       end
 
       # Issue #644 — the seeded `in_source_constants` table, joining the two cross-file constant producers.
@@ -2654,7 +2683,8 @@ module Rigor
           node_collectors: node_collectors,
           stated_runtime_ruby: @configuration.stated_runtime_ruby
         )
-        diagnostics + plugin_emitted_diagnostics(path, root, scope, node_results)
+        plugin_rows = plugin_emitted_diagnostics(path, root, scope, node_results)
+        diagnostics + CheckRules.filter_plugin_suppressed(plugin_rows, path: path, comments: parse_result.comments)
       end
 
       # ADR-24 slice 4a — runs `block` (the typing pass) with the self-call recorder active when either

data/lib/rigor/analysis/severity_stamp.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative "check_rules/rule_ids"
 require_relative "diagnostic"
 require_relative "../configuration/severity_profile"
 
@@ -9,14 +10,55 @@ module Rigor
     # overrides and drops any diagnostic resolving to `:off`. Rules emit with their authored severity; the
     # profile is the final filter.
     #
+    # Issue #1895 — the `.rigor.yml` `disable:` list is applied here too, ahead of the profile, with the same
+    # token expansion and match per-file analysis uses ({CheckRules.config_disabled?}), but only to a built-in
+    # check-rule row (see {.check_rule_row?}): the rows the diagnostic policy already says `disable:` reaches. Most
+    # are filtered where they were produced; this catches the ones that are not (the `effect.annotations-unchecked`
+    # residual under `disable: [all]`) on every run shape (sequential, pool, `--incremental`, a warm cache hit).
+    # Issue #1953 — a plugin's `plugin.<id>.*` row answers here to its qualified id (`plugin.<id>.<rule>`) or to
+    # `plugin.<id>`, never to a bare id or `all`. The run-level rows outside the check-rule catalogue
+    # (`rbs.coverage.*`, `dynamic.dependency-source.*`, the plugin loader, `plugin_trust.*`, `pool-degraded`) keep
+    # answering to `severity_overrides:` only, by any spelling.
+    # Issue #1985 — `severity_overrides:` follows the same rule: a plugin's row answers to its qualified id or
+    # `plugin.<id>`, never to its bare rule or a family wildcard; the plugin loader's rows answer to
+    # `plugin_loader.<rule>` first and to their bare `load-error` / `runtime-error` after it.
+    #
     # Extracted (ADR-87 WD4) so the miss path ({Runner::DiagnosticAggregator}) and the boot-slimming hit path
     # ({RunCacheProbe}, which never loads the aggregator) apply the IDENTICAL final filter — a warm HIT's
     # served diagnostics are byte-identical to what a full run would print.
     module SeverityStamp
       module_function
 
+      CHECK_RULES = CheckRules::ALL_RULES.to_set.freeze
+      private_constant :CHECK_RULES
+
       def apply(diagnostics, configuration)
-        diagnostics.filter_map { |diagnostic| stamp(diagnostic, configuration) }
+        disabled = CheckRules.expand_rule_tokens(configuration.disabled_rules)
+        diagnostics.filter_map do |diagnostic|
+          next nil if config_disabled_row?(diagnostic, disabled)
+
+          stamp(diagnostic, configuration)
+        end
+      end
+
+      # A built-in check-rule row answers to the expanded list by its id or `all`; a plugin's `plugin.<id>.*` row
+      # by its qualified id or `plugin.<id>` only ({CheckRules.plugin_row_disabled?}, issue #1953). Every other
+      # row is out of the list's reach.
+      def config_disabled_row?(diagnostic, disabled)
+        return CheckRules.config_disabled?(diagnostic.rule, disabled) if check_rule_row?(diagnostic)
+
+        CheckRules.plugin_row_disabled?(diagnostic, disabled)
+      end
+
+      # A built-in check-rule row: its id is in the CheckRules catalogue and no plugin emitted it.
+      def check_rule_row?(diagnostic)
+        diagnostic.source_family == Diagnostic::DEFAULT_SOURCE_FAMILY && CHECK_RULES.include?(diagnostic.rule)
+      end
+
+      # `plugin.<id>` for a row a plugin emitted, nil for every other row.
+      def plugin_family(diagnostic)
+        family = diagnostic.source_family.to_s
+        family if family.start_with?(CheckRules::PLUGIN_FAMILY_PREFIX)
       end
 
       def stamp(diagnostic, configuration)
@@ -24,6 +66,8 @@ module Rigor
 
         resolved = Configuration::SeverityProfile.resolve(
           rule: diagnostic.rule,
+          qualified_rule: diagnostic.qualified_rule,
+          plugin_family: plugin_family(diagnostic),
           authored_severity: diagnostic.severity,
           profile: configuration.severity_profile,
           overrides: configuration.severity_overrides,

data/lib/rigor/analysis/worker_session.rb

@@ -170,8 +170,13 @@ module Rigor
         return analyze_with_effects(path) unless @record_dependencies
 
         diagnostics = nil
-        record = DependencyRecorder.record_for(path) { diagnostics = analyze_with_effects(path) }
+        reads = []
+        record = Plugin::IoBoundary.attributing(reads) do
+          DependencyRecorder.record_for(path) { diagnostics = analyze_with_effects(path) }
+        end
         @file_dependencies[path] = record
+        # Issue #1553 — the plugin reads this file's analysis made, as `Runner#analyze_file` keeps them.
+        (@analysis_reads ||= {})[path] = reads unless reads.empty?
         diagnostics
       end
 
@@ -241,7 +246,8 @@ module Rigor
           node_collectors: node_collectors,
           stated_runtime_ruby: @configuration.stated_runtime_ruby
         )
-        diagnostics += plugin_emitted_diagnostics(path, root, scope, node_results)
+        plugin_rows = plugin_emitted_diagnostics(path, root, scope, node_results)
+        diagnostics += CheckRules.filter_plugin_suppressed(plugin_rows, path: path, comments: parse_result.comments)
         diagnostics + explain_diagnostics(path, parse_result.value, scope)
       rescue Errno::ENOENT => e
         [analyzer_error(path, e.message)]
@@ -308,6 +314,12 @@ module Rigor
         @file_dependencies
       end
 
+      # Issue #1553 — the plugin reads ({Plugin::IoBoundary.attributing}) each `#analyze` call's file made (empty
+      # unless `record_dependencies:` was set). The rows are value objects of frozen Strings, so they marshal back.
+      def drain_analysis_reads
+        @analysis_reads || {}
+      end
+
       # ADR-103 WD12 — the per-file {Effects::FileCollection}s this session collected (empty unless the
       # configuration carries an `effects:` block). Marshal-clean by construction — frozen Hashes of
       # Strings, `LabelSet`s of frozen Arrays, and `Data` edges — so the fork pool ships them back to the
@@ -336,6 +348,45 @@ module Rigor
         end
       end
 
+      # Issue #1900 — `{plugin id => refused-read count}` over `registry`'s boundaries right now: the baseline
+      # a later drain subtracts, so it reports only the refusals made after the baseline was taken.
+      def self.refusal_counts(registry)
+        registry.plugins.to_h do |plugin|
+          summary = begin
+            plugin.io_boundary.refusal_summary
+          rescue StandardError
+            nil
+          end
+          [safe_plugin_id(plugin), summary ? summary[:count] : 0]
+        end
+      end
+
+      def self.safe_plugin_id(plugin)
+        plugin.manifest.id
+      rescue StandardError
+        plugin.class.to_s
+      end
+
+      # Issue #1900 — the {Plugin::IoBoundary} trust-policy refusals this session's plugin instances made
+      # since the previous drain, one `{plugin_id:, count:, first_path:, nearest_root:}` per plugin that hit
+      # any, in registry order. Unlike {#drain_run_disclosures} each drain reports only what is new — the
+      # boundary keeps its running total and this session remembers how much of it was already reported —
+      # because the coordinator SUMS the drains: a fork child inherits the parent's `#prepare` refusals,
+      # and reporting them again would count them once per worker. `first_path` is the boundary's first
+      # refusal overall, which is the delta's own first path whenever nothing was reported before it, and
+      # the coordinator keeps the first-merged path otherwise. It is not baselined after `#init`, so a plugin
+      # whose `#init` refuses differently here than on the coordinator registry can have this session's
+      # `#init` path named. Marshal-clean and Ractor-copyable.
+      def drain_trust_refusals
+        return [] if @plugin_registry.empty?
+
+        @plugin_registry.plugins.filter_map do |plugin|
+          trust_refusal_delta(plugin)
+        rescue StandardError
+          nil
+        end
+      end
+
       private
 
       # Mirrors {Runner#seed_project_scope}: applies the cross-file pre-pass discovery tables the
@@ -402,6 +453,10 @@ module Rigor
       def run_plugin_prepare
         return [] if @plugin_registry.empty?
 
+        # Issue #1900 — per plugin id, how much of its boundary's count is already reported. Starts at what
+        # `#init` refused while the registry was materialised: `#init` runs on the coordinator-side registry
+        # too, which reports those reads itself, so counting them here as well would double them.
+        @reported_refusal_counts = self.class.refusal_counts(@plugin_registry)
         @plugin_registry.plugins.flat_map do |plugin|
           plugin.prepare(plugin.services)
           []
@@ -490,6 +545,18 @@ module Rigor
         )
       end
 
+      def trust_refusal_delta(plugin)
+        summary = plugin.io_boundary.refusal_summary
+        return nil if summary.nil?
+
+        plugin_id = safe_plugin_id(plugin)
+        delta = summary[:count] - @reported_refusal_counts.fetch(plugin_id, 0)
+        return nil unless delta.positive?
+
+        @reported_refusal_counts[plugin_id] = summary[:count]
+        summary.merge(count: delta, plugin_id: plugin_id)
+      end
+
       def safe_plugin_id(plugin)
         plugin.manifest.id
       rescue StandardError