rigortype 0.3.6 → 0.3.7

data/docs/manual/plugins/rigor-activerecord.md

@@ -30,7 +30,8 @@ errors_demo.rb:24:1: error: `User.find` expects at least 1 argument, got 0 [plug
 | Recognised `Model.find` / `Model.find_by` / `Model.where` call | `:info` | `plugin.activerecord.model-call` |
 | `Model.find_by(unknown: ...)` / `Model.where(unknown: ...)` | `:error` | `plugin.activerecord.unknown-column` |
 | `Model.find` with 0 args | `:error` | `plugin.activerecord.wrong-arity` |
-| No schema source (`db/schema.rb` or `db/structure.sql`) readable | `:warning` | `plugin.activerecord.load-error` |
+| No schema source (`db/schema.rb` or `db/structure.sql`) present — reduced mode | `:info` | `plugin.activerecord.load-error` |
+| A schema source that exists but cannot be read or parsed | `:warning` | `plugin.activerecord.load-error` |
 
 Did-you-mean suggestions use `DidYouMean` fuzzy matching against
 the resolved table's column names.
@@ -75,18 +76,90 @@ Chained query methods keep the element type, and iteration
 scope invoked on a typed relation (`User.where(...).published`)
 never surfaces a false `call.undefined-method`.
 
+`User.table_name` types as `String`, and as the exact string
+only when your source says the name: a literal
+`self.table_name = "people"` on the class or on an STI ancestor,
+with nothing in that chain computing the name at runtime (a
+`def self.table_name`, a `class << self` version of it, or an
+interpolated assignment all count as computing it). Every other
+name — anything the plugin derived by pluralizing the class name —
+stays plain `String`.
+
+That includes names that look confirmed. A `users` table in your
+schema is not evidence that it is `User`'s table: with a
+`self.table_name_prefix` on the base class, `User` really reads
+`app_users`, and a `users` table belonging to some other model
+would "confirm" the wrong guess. A wrong exact string is worse
+than an honest `String` — code comparing `User.table_name` would
+quietly take the wrong branch — so the plugin pins only what you
+wrote down. `User.quoted_table_name` is always `String`; the
+quoting is up to the database adapter.
+
+A model declared inside a Ruby module or class (`Blog::Post`)
+resolves its table the way Rails does for the cases below: the
+namespace is dropped, not flattened into the name, so `Blog::Post`
+reads `posts`, not `blog_posts`. A `table_name_prefix` /
+`table_name_suffix` the enclosing namespace declares as a literal
+(`def self.table_name_prefix = "blog_"`, `class << self` with the
+same, or `mattr_accessor :table_name_prefix, default: "blog_"`) is
+applied on top, so the same model reads `blog_posts` once `Blog`
+sets that. `mattr_writer` does not count — it defines no reader, so
+Rails never actually reads the value back, and neither does the
+plugin.
+
+`Blog::Post.table_name` still reads as the plain demodulized name
+(`posts`) when `Blog`'s prefix/suffix is declared in a shape the
+plugin cannot read as a literal (a computed value, two disagreeing
+declarations) — but that string is informational only in this case.
+The plugin does not trust it enough to look up columns against it:
+guessing a bare name is the guess most likely to hit an unrelated
+REAL table in a namespaced app, and a wrong corroboration is worse
+than none, so `Blog::Post`'s column, alias and association checks
+stand down entirely rather than run against a table that might not
+be the real one.
+
 ## Limitations
 
 - **Direct-superclass match only.** `class Admin < User` where
   `User < ApplicationRecord` is not discovered. Either add `User`
   to `model_base_classes`, or list every concrete model
   explicitly.
+- **A model nested inside ANOTHER non-abstract model class stands down rather
+  than guesses.** `Post::Comment` where `Post < ApplicationRecord` and `Post`
+  is not abstract hits a different Rails naming rule entirely — the parent's own
+  table name is spliced into the middle of the child's, not a
+  prefix/suffix — so the plugin recognises the shape and stands
+  `Comment`'s column / alias / association checks down instead of
+  computing (or guessing at) the real name. (A model nested inside
+  an *abstract* parent class, such as `Base::Comment` where `Base` declares
+  `self.abstract_class = true` or `primary_abstract_class`, correctly resolves
+  its plain demodulized table name with full column checks.)
+- **External `table_name_prefix` / `table_name_suffix` declarations and
+  engines.** Declarations outside `model_search_paths` (e.g. in `lib/` or an
+  engine's `isolate_namespace`) are detected across the project and cause
+  affected models to safely stand down with an empty column set, rather than
+  guessing an incorrect table name. Within `model_search_paths`, model-level
+  and base-class `table_name_prefix` declarations (literal or computed) are
+  resolved directly.
 - **PostgreSQL `db/structure.sql` fallback.** When `db/schema.rb` is
   absent, the plugin parses `db/structure.sql` (the `schema_format =
   :sql` dump) for the same column/type table. It reads PostgreSQL DDL
   only; a column whose SQL type has no Ruby mapping (a custom enum,
   `tsvector`, `ltree`) degrades to `Object` (never dropped), and
   non-`public`-schema partition tables are skipped.
+- **No committed schema — reduced mode.** A project that ships raw
+  migrations and gitignores `db/schema.rb` (the DB-agnostic Rails
+  pattern) still gets table names, finders, scopes and associations:
+  those are read from your model source, not from the schema. Only
+  the column-dependent half stands down — column readers stay
+  untyped and `where(col:)` keys are not validated, exactly as they
+  are for a table the schema does not describe. The plugin says so
+  once per run at `:info`. Committing a schema dump (or pointing
+  `schema_file` / `structure_sql_file` at one) turns the column half
+  back on from the next cold run — a warm cache keeps serving the
+  reduced index until it is invalidated, so use `rigor check
+  --no-cache` (or `make cache-clean`) if you want to see the change
+  immediately.
 - **Column reads, not setters.** The plugin types instance-side
   column *reads* (`user.name`, `user.admin?`) and singular
   associations, but not the `name=` setter or the dirty-tracking

data/docs/manual/plugins/rigor-activesupport-core-ext.md

@@ -44,7 +44,9 @@ Roughly the top ~40 selectors plus their close neighbours, across:
   `#constantize`, `#pluralize`, …), filters (`#squish`, `#truncate`),
   `#html_safe`, `#starts_with?` / `#ends_with?`, conversions.
 - **Time / Date / DateTime** — `.current`, `.zone`, `#yesterday`,
-  `#tomorrow`, `#beginning_of_*` / `#end_of_*`, `#ago`, `#since`.
+  `#tomorrow`, `#beginning_of_*` / `#end_of_*`, `#ago`, `#since`. `Time`
+  additionally carries its **whole** Rails instance surface (see below);
+  `Date` and `DateTime` carry the same subset they always did.
 - **Array** — `.wrap`, `#to_sentence`, `#in_groups_of`, `#second` …
   `#fifth`, `#compact_blank`, `#exclude?`.
 - **Hash** — `#symbolize_keys` / `#stringify_keys` (+ deep / bang),
@@ -57,25 +59,125 @@ Roughly the top ~40 selectors plus their close neighbours, across:
 Time.current     # without the bundle: call.undefined-method Time.current
 ```
 
+## Durations are typed
+
+`1.day`, `5.minutes`, `2.5.hours` and every other multiplier type as
+`ActiveSupport::Duration`, and the arithmetic around them keeps its
+meaning:
+
+```ruby
+1.day                     # ActiveSupport::Duration
+Time.current - 30.minutes # Time
+2 * 1.day                 # ActiveSupport::Duration
+1.day + 1.hour            # ActiveSupport::Duration
+Date.today - 1.week       # Date | Time
+```
+
+`Date ± duration` is a union because that is what Rails does: a
+date-part duration gives you back a `Date`, a sub-day one gives you a
+`Time`.
+
+Rigor ships a **partial** signature for `ActiveSupport::Duration`: the
+reader surface — `#to_i` / `#in_seconds`, `#to_f`, `#in_minutes` /
+`#in_hours` / `#in_days` / `#in_weeks` / `#in_months` / `#in_years`,
+`#iso8601`, `#parts` — is typed, so `3.hours.in_minutes` is `Float` and
+`1.day.to_i * 2` is `Integer`. `#ago` / `#until` / `#before` / `#since`
+/ `#from_now` / `#after` are NOT part of that surface — they default
+to `Time.current`, and typing them was blocked on Rails' `Time`
+instance extensions being declared first, which the section below now
+does; the multipliers themselves are tracked separately. Every
+other member — the arithmetic operators above aside, `==`, and
+anything else Duration forwards through `method_missing` — resolves
+without a diagnostic too, while the site still counts as a concrete
+receiver for `rigor coverage --protection`. Naming
+`ActiveSupport::Duration` at all would normally be the wrong move — a
+partial signature on a class whose real surface forwards to
+`method_missing` turns every omitted member into a false
+`call.undefined-method` — so the plugin lists it under
+`open_receivers:`, the same exemption `rigor-activerecord` gives
+`ActiveRecord::Relation`.
+
+The multiplier only fires on a receiver Rigor has proven numeric, so
+`created_at.day`, `Date.today.year` and your own object's `#days` keep
+the answers they always had.
+
+## The Rails `Time` instance surface is declared, not sampled
+
+`Time` is a core Ruby class, so RBS knows it fully and it is **closed**:
+a name the signatures do not declare is reported
+`call.undefined-method`. That makes an omission on `Time` just as much
+of a false positive as a wrong return type, with no gradual middle, so
+this bundle declares the surface ActiveSupport adds by audit against the
+gem's own sources rather than by a "top selectors" sample.
+
+```ruby
+Time.current.to_fs(:db)             # String
+Time.current.formatted_offset       # String
+Time.current.past?                  # bool
+Time.current.at_beginning_of_hour   # Time
+Time.current.days_ago(3).all_week   # Range[Time]
+Time.current.in_time_zone("Hawaii") # untyped (ActiveSupport::TimeWithZone)
+Time.current.definitely_not_here    # still call.undefined-method
+```
+
+That is the predicates (`#past?`, `#future?`, `#today?`, `#on_weekend?`,
+…), the whole `#days_ago` / `#months_since` / `#next_occurring` family,
+the quarter and `at_`-prefixed spellings, the `#all_week` / `#all_month`
+/ `#all_quarter` / `#all_year` ranges, `#to_fs` / `#to_formatted_s` /
+`#formatted_offset` / `#rfc3339`, `#in_time_zone`, and the `Time.`
+singletons `.days_in_month`, `.days_in_year`, `.rfc3339`, `.use_zone`,
+`.find_zone` / `.find_zone!` and `.zone_default`.
+
+Where a return cannot honestly be named it is widened rather than
+guessed: `#in_time_zone` answers an `ActiveSupport::TimeWithZone`, which
+this bundle does not model, so it reads `untyped`.
+
+What is left out is twelve names, measured against a real
+`require "active_support/all"`: ten instance and two singleton, every one
+an `alias_method` artefact of ActiveSupport's own `+` / `-` / `<=>` /
+`eql?` / `Time.at` overrides — the `plus_with{,out}_duration`,
+`minus_with{,out}_duration`, `minus_with{,out}_coercion`,
+`compare_with{,out}_coercion`, `eql_with{,out}_coercion` and
+`Time.at_with{,out}_coercion` pairs. They are public at runtime and
+`:nodoc:` in the source, and nothing outside ActiveSupport calls them;
+code that does will see them reported.
+
+`Date` and `DateTime` are extended by the same ActiveSupport modules and
+do **not** carry this yet — `Date.current.past?` still reports.
+
 ## No diagnostics, no config
 
-The plugin is RBS-only — it emits no diagnostics and has no
-configuration knobs. It contributes its signatures unconditionally when
-listed under `plugins:`.
+The plugin emits no diagnostics and has no configuration knobs. It
+contributes its signatures — and the Duration typing above —
+unconditionally when listed under `plugins:`.
 
 ## Limitations
 
-- **Conservative return types.** `Integer#days` really returns
-  `ActiveSupport::Duration`, but the bundle types it `untyped` because
-  the analysis environment usually lacks the Duration class — the goal
-  is to silence undefined-method, not to give precise returns. Likewise
-  `#html_safe` is typed `String` (not `SafeBuffer`) and `#try` / `#try!`
-  return `untyped`.
+- **Conservative return types.** `#html_safe` is typed `String` (not
+  `SafeBuffer`) and `#try` / `#try!` return `untyped` — the goal for
+  those is to silence undefined-method, not to give precise returns.
+  (The Duration multipliers are one exception: they are declared
+  `untyped` in the bundle and then typed by the plugin instead — not
+  because the bundle can't name `ActiveSupport::Duration` (it does,
+  described above), but because moving the multiplier return itself
+  into RBS to match hasn't happened yet. `ActiveSupport::Duration`'s
+  own reader surface is the other exception, described above.)
+- **`duration / x` is not typed.** `1.day / 2` is a Duration but
+  `1.day / 1.hour` is a plain `24`; the answer depends on the operand,
+  so Rigor declines rather than guessing.
+- **`duration + Time` is not typed either.** `30.minutes + Time.now`
+  raises at runtime — `Duration#+` cannot coerce a Time, and `-`, `*`,
+  and a `Date` or `DateTime` on the right fail the same way — so Rigor
+  claims nothing for it. `Time.now + 30.minutes` is the form that has a
+  value, and it is typed `Time`.
 - **Project-private monkey-patches are not covered** — only real
   ActiveSupport extensions. For your own core-class patches see the
   `pre_eval:` mechanism ([ADR-17](../../adr/17-monkey-patch-pre-evaluation.md)).
-- **Top ~40 selectors, not exhaustive.** ActiveSupport ships hundreds of
-  extensions; this covers the head of the real-world distribution.
+- **Top ~40 selectors, not exhaustive** — except on `Time`, where the
+  closed-core-class argument above makes a sample unsound and the audit
+  is exhaustive but for the twelve `:nodoc:` alias-chain artefacts named
+  there. Elsewhere ActiveSupport ships hundreds of extensions and this
+  covers the head of the real-world distribution.
 
 ## Plugin internals
 

data/docs/manual/plugins/rigor-sidekiq.md

@@ -42,6 +42,28 @@ arguments.
 | `plugin.sidekiq.missing-schedule` | error | `perform_in()` / `perform_at()` called with zero arguments (the schedule is required even when `#perform` takes none) |
 | `plugin.sidekiq.load-error` | warning | worker discovery failed (parse/read error) — once per file |
 
+## What it types
+
+`perform_async` / `perform_in` / `perform_at` on a **discovered**
+worker return the job id, so the value you assign is a `String`:
+
+```ruby
+jid = WelcomeEmailWorker.perform_async(123)
+jid.upcase                # String — resolved, and checked
+OtherThing.perform_async  # untouched: not a discovered worker
+```
+
+`perform_inline` is not typed — it runs the job in-process and returns
+whatever your `#perform` returns.
+
+The type is plain `String`, not `String?`, even though
+`Sidekiq::Client#push` returns nil when a client middleware halts the
+chain. That path needs a middleware in your own app that returns false
+from `#call` — rare, deliberate, and code that already knows to check —
+whereas typing it nullable puts a `call.possible-nil-receiver` error on
+the ordinary `jid = W.perform_async(id); jid.length`. Rigor takes the
+answer that is silent on the common code.
+
 ## Configuration
 
 ```yaml

data/lib/rigor/analysis/check_rules/always_truthy_condition_collector.rb

@@ -5,6 +5,7 @@ require "prism"
 require_relative "../../source/node_children"
 require_relative "../../inference/optimistic_origin"
 require_relative "inferred_param_guard"
+require_relative "published_constant_guard"
 
 module Rigor
   module Analysis
@@ -119,6 +120,17 @@ module Rigor
           predicate_type = scope.type_of(predicate)
           return unless predicate_type.is_a?(Type::Constant)
 
+          # Issue #644 — a predicate whose constancy rests on a value constant declared in ANOTHER file is
+          # not a logic error the reader's author can see: `if MODE == :production` folds only because the
+          # project-wide table published `MODE`, and a configuration constant read in ten files would put
+          # this warning in all ten. The value stays published (dispatch and argument typing keep it); only
+          # the firing is withheld, which is the direction the carrier discipline allows.
+          #
+          # LAST of the gates on purpose. It is the only one that can resolve a def and walk its body, and a
+          # predicate that does not fold to a `Type::Constant` was never going to fire — so the fold check
+          # above is what keeps the hop off every ordinary `if` in a project that publishes anything at all.
+          return if PublishedConstantGuard.rooted?(predicate, scope)
+
           polarity = predicate_type.value.nil? || predicate_type.value == false ? :falsey : :truthy
           @results << Result.new(node: predicate, polarity: polarity)
         end

data/lib/rigor/analysis/check_rules/dead_version_guard_arms.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../inference/version_guard"
+require_relative "../../source/node_children"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # ADR-47 WD5 — drops the diagnostics that land inside the **dead arm of a decidable version guard**
+      # (issue #627).
+      #
+      # {Inference::StatementEvaluator} already skips evaluating that arm, so its writes never join into the
+      # post-`if` scope. Skipping the evaluation is not by itself enough to silence the arm, though: the
+      # rule walk visits every node of the file whether or not the evaluator typed it, so a call whose
+      # receiver is typeable on its own — a constant, a literal — still reports. `mail/lib/mail/yaml.rb`'s
+      #
+      #     ::YAML.safe_load(yaml, permitted_classes)   # the Psych < 3.1 positional form
+      #
+      # is exactly that shape: honest against the Ruby 4 Psych signature, and unreachable on the Ruby the
+      # user is checking with. This is the second half of the fix — the arm stops producing diagnostics.
+      #
+      # The dead arms are found by re-asking {Inference::VersionGuard}, which is a pure function of the AST,
+      # so this filter and the evaluator's arm elision cannot disagree about which arm is dead.
+      #
+      # Applied to the type / flow rules only, and BEFORE `suppression.*` joins the list: a malformed
+      # `# rigor:disable` marker inside a dead arm is still a real authoring error — the marker's own
+      # well-formedness does not depend on whether the code around it runs.
+      module DeadVersionGuardArms
+        module_function
+
+        # @param diagnostics [Array<Rigor::Analysis::Diagnostic>]
+        # @param root [Prism::Node]
+        # @return [Array<Rigor::Analysis::Diagnostic>]
+        def filter(diagnostics, root)
+          # The scan is a whole-file walk, so it is paid only when there is something to drop. A file with
+          # no diagnostics — the overwhelming majority — never walks.
+          return diagnostics if diagnostics.empty?
+
+          arms = scan(root)
+          return diagnostics if arms.empty?
+
+          diagnostics.reject { |diagnostic| arms.any? { |arm| covers?(arm, diagnostic) } }
+        end
+
+        # @param root [Prism::Node]
+        # @return [Array<Prism::Location>] the source ranges of every dead version-guard arm
+        def scan(root)
+          arms = []
+          collect(root, arms)
+          arms
+        end
+
+        def collect(node, arms)
+          return unless node.is_a?(Prism::Node)
+
+          dead = dead_arm(node)
+          arms << dead.location if dead
+          # Nothing inside a dead arm can produce a surviving diagnostic, so the walk does not descend into
+          # it — a nested guard there would only add a range already covered.
+          node.rigor_each_child { |child| collect(child, arms) unless dead && child.equal?(dead) }
+        end
+        private_class_method :collect
+
+        # The arm that cannot run, or nil when the guard is undecidable (both arms live — the pre-existing
+        # behaviour) or the dead arm is absent (`foo if RUBY_VERSION >= "3.1"` has no `else`).
+        def dead_arm(node)
+          case node
+          when Prism::IfNode
+            case Inference::VersionGuard.verdict(node.predicate)
+            when :truthy then node.subsequent
+            when :falsey then node.statements
+            end
+          when Prism::UnlessNode
+            # `unless` runs its body on the FALSEY edge, so the arms are swapped.
+            case Inference::VersionGuard.verdict(node.predicate)
+            when :truthy then node.statements
+            when :falsey then node.else_clause
+            end
+          end
+        end
+        private_class_method :dead_arm
+
+        # Prism columns are 0-based and `Diagnostic#column` is 1-based; the location's end is exclusive.
+        # Compared as `[line, column]` pairs rather than by line alone so a one-line guard
+        # (`RUBY_VERSION >= "3.1" ? a(1) : a(1, 2)`) drops only the dead half.
+        def covers?(location, diagnostic)
+          position = [diagnostic.line, diagnostic.column - 1]
+          return false if (position <=> [location.start_line, location.start_column]).negative?
+
+          (position <=> [location.end_line, location.end_column]).negative?
+        end
+        private_class_method :covers?
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/ivar_write_collector.rb

@@ -69,9 +69,9 @@ module Rigor
 
           case node
           when Prism::ClassNode, Prism::ModuleNode
-            name = Source::ConstantPath.qualified_name(node.constant_path)
-            if name
-              walk(node.body, qualified_prefix + [name]) if node.body
+            child_prefix = Source::ConstantPath.declaration_prefix(qualified_prefix, node.constant_path)
+            if child_prefix
+              walk(node.body, child_prefix) if node.body
               return
             end
           when Prism::DefNode

data/lib/rigor/analysis/check_rules/published_constant_guard.rb

@@ -0,0 +1,199 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "../../source/constant_path"
+require_relative "../../source/node_children"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # Issue #644 — the shared "does this expression's constancy rest on a constant declared in ANOTHER
+      # file?" predicate, and the single question the truthiness rule family must ask.
+      #
+      # The cross-file value-constant table publishes `MODE = :production` project-wide so a reader can
+      # dispatch on it, type an argument with it, and see `MODE.upcase` fail. That is the precision the table
+      # exists for. What it must NOT do is let a rule *conclude* from the value: `if MODE == :production` in
+      # another file folds to `Constant[true]`, and reporting that as `flow.always-truthy-condition` fires on
+      # correct code — on the single Ruby idiom whose whole point is a project-wide constant that gets
+      # branched on, whose declaration the reader's author never opened. A configuration constant read in ten
+      # files would put a warning in all ten.
+      #
+      # This is [ADR-58](../../../../docs/adr/58-declaration-sourced-ivar-typing.md)'s discipline applied to a
+      # different carrier: "a consumer may only ever *withhold* a firing it would otherwise make, so the mark
+      # can lose precision but can never manufacture a false positive"
+      # (`docs/internal-spec/inference-engine.md` § "Carrier and discipline"). The carrier is deliberately NOT
+      # the ADR-58 `Set[[kind, name]]`: that set is flow state, keyed on a *binding* that rebinding drops, and
+      # it is already shared by two marks with opposite join policies (ADR-67 WD6b's `:inferred_param` unions
+      # where ADR-58's kinds intersect). "Which constants did the project publish, and which does this file
+      # declare itself" is ambient, never varies along a flow edge, and so belongs in the
+      # `Scope::DiscoveryIndex` — which is exactly ADR-53's membership criterion.
+      #
+      # `rooted?` is purely syntactic, in the shape of {InferredParamGuard}: it walks a predicate expression
+      # down to the roots its constancy could rest on and reports whether any is a published foreign
+      # constant. It covers
+      #
+      # - the bare predicate: `if PAGE_SIZE`, `unless AppConfig::LOG_LEVEL`
+      # - a comparison or any method chain on one: `MODE == :production`, `PAGE_SIZE > 100`, `VERSION >= 3`
+      # - a constant in ARGUMENT position: `%i[development test].include?(ENV_NAME)` — unlike
+      #   {InferredParamGuard}, arguments are walked, because a predicate's fold rests on its arguments just
+      #   as much as on its receiver
+      # - `&&` / `||` / parentheses / `rescue` composition, and `!`, which Prism spells as a `CallNode`
+      # - ONE interprocedural hop into a project predicate method whose body reads such a constant, whatever
+      #   spells its owner: `unless production?` (implicit self), `self.prod?`, `AppConfig.production?` (the
+      #   idiomatic shape — a configuration module exposing predicates), a lexically relative
+      #   `Inner.production?`, and a call chain `KlassConfig.new.production?`. The owner comes from the
+      #   receiver's inferred TYPE, so every spelling that names the same module lands on the same table. The
+      #   hop is bounded (one level, a node budget) and deliberately coarse: ANY published foreign constant
+      #   anywhere in the callee's body declines, rather than a proof that the return value derives from it.
+      #   Over-declining withholds a warning; under-declining would emit one. ADR-58's *Non-transitivity*
+      #   passage is the precedent for stopping at one hop rather than building a provenance channel through
+      #   the return memo.
+      #
+      # Deliberately NOT covered, and a separate change: a value copied into a local (`m = MODE; m == :x`),
+      # into an ivar (`@mode = MODE` in `initialize`), or through a same-file constant alias
+      # (`MODE2 = AppConfig::MODE`). Each needs flow provenance — ADR-58's `r = @x` stamping is the shape —
+      # rather than a syntactic root walk, and approximating it here is exactly the ad-hoc widening ADR-58's
+      # *Non-transitivity* passage forbids. Two hops (`live? -> prod? -> MODE`) also stay uncovered.
+      module PublishedConstantGuard
+        # A defensive depth cap against a pathological chain (the walk is otherwise linear in chain length).
+        MAX_DEPTH = 64
+
+        # A node cap on the one-hop callee-body scan, so a predicate calling a very large method cannot make
+        # rule collection quadratic. Exhausting it answers false — the firing direction, and the same
+        # conservative default the collector's other gates take when they cannot decide.
+        BODY_SCAN_BUDGET = 2000
+
+        module_function
+
+        # @return [Boolean] true when the rule MUST withhold its firing.
+        def rooted?(node, scope, depth = 0)
+          return false if node.nil? || depth > MAX_DEPTH || scope.nil?
+
+          case node
+          when Prism::ConstantReadNode then scope.published_constant?(node.name.to_s)
+          when Prism::ConstantPathNode then published_path?(node, scope)
+          when Prism::CallNode then rooted_call?(node, scope, depth)
+          else rooted_through_composition?(node, scope, depth)
+          end
+        end
+
+        # `&&` / `||` / `rescue` combine two operands and a parenthesised or multi-statement body yields its
+        # last: the produced value is constant only if a rooted operand made it so, so declining on either
+        # side is the withholding direction.
+        def rooted_through_composition?(node, scope, depth)
+          case node
+          when Prism::AndNode, Prism::OrNode
+            rooted?(node.left, scope, depth + 1) || rooted?(node.right, scope, depth + 1)
+          when Prism::RescueModifierNode
+            rooted?(node.expression, scope, depth + 1) || rooted?(node.rescue_expression, scope, depth + 1)
+          when Prism::ParenthesesNode then rooted?(last_statement(node.body), scope, depth + 1)
+          when Prism::StatementsNode then rooted?(node.body.last, scope, depth + 1)
+          else false
+          end
+        end
+
+        # A call is rooted when its receiver is, when any argument is, or when the project method it names
+        # reads such a constant (the one interprocedural hop).
+        def rooted_call?(node, scope, depth)
+          return true if rooted?(node.receiver, scope, depth + 1)
+          return true if Array(node.arguments&.arguments).any? { |arg| rooted?(arg, scope, depth + 1) }
+
+          callee_reads_published_constant?(node, scope)
+        end
+
+        # The reference AS WRITTEN (`AppConfig::MODE`), so `Scope#published_constant?` can match its local
+        # exemption exactly rather than on the last segment. A path that renders no qualified name falls back
+        # to its own last segment, which is all there is to ask about.
+        def published_path?(node, scope)
+          rendered = Source::ConstantPath.qualified_name_or_nil(node) || node.name&.to_s
+          !rendered.nil? && scope.published_constant?(rendered)
+        end
+
+        # The one hop. Resolves the callee through the ordinary `Scope` accessors (so the ADR-46 recorder sees
+        # the read and the caller gains an edge to the callee — the conservative direction) and scans its
+        # body. Fails soft to false: a resolution this cannot make is not a reason to withhold.
+        def callee_reads_published_constant?(node, scope)
+          return false if scope.published_constant_names.empty?
+
+          def_node = resolve_callee(node, scope)
+          return false if def_node.nil?
+
+          body_reads_published_constant?(def_node.body, scope)
+        rescue StandardError
+          false
+        end
+
+        # `foo` / `self.foo` resolve against the enclosing self. Every other receiver resolves through its
+        # inferred TYPE, never through the name it was spelled with: `Inner.production?` inside `module Outer`
+        # is `Outer::Inner`, and keying the table on the bare `Inner` both misses that (a new warning on
+        # ordinary code) and, where a top-level `Inner` also exists, reads the WRONG module's methods. That is
+        # the defect family #635 fixed in `Narrowing`, so the engine's own resolver answers it rather than a
+        # walk reimplemented here. Going through the type also covers a call-chain receiver for free —
+        # `KlassConfig.new.production?` types `Nominal[KlassConfig]`, whose instance table is the one to read.
+        def resolve_callee(node, scope)
+          receiver = node.receiver
+          return resolve_self_call(node.name, scope) if receiver.nil? || receiver.is_a?(Prism::SelfNode)
+
+          resolve_typed_receiver_call(receiver, node.name, scope)
+        end
+
+        # A `Singleton[X]` receiver names the singleton table (`AppConfig.production?`, a module's own
+        # predicates); a `Nominal[X]` receiver names the instance one. Anything else — `Dynamic`, a constant
+        # that resolves to no project class — is not a hop this walk can make.
+        def resolve_typed_receiver_call(receiver, method_name, scope)
+          receiver_type = scope.type_of(receiver)
+          case receiver_type
+          when Type::Singleton then scope.singleton_def_for(receiver_type.class_name, method_name)
+          when Type::Nominal then scope.user_def_for(receiver_type.class_name, method_name)
+          end
+        end
+
+        # A `Singleton[X]` self (a `def self.…` body) names the singleton table; a `Nominal[X]` self names
+        # the instance one; no class at all is the top-level pseudo-class.
+        def resolve_self_call(method_name, scope)
+          self_type = scope.self_type
+          owner = self_type.respond_to?(:class_name) ? self_type.class_name : nil
+          return scope.top_level_def_for(method_name) if owner.nil?
+
+          if self_type.is_a?(Type::Singleton)
+            scope.singleton_def_for(owner, method_name)
+          else
+            scope.user_def_for(owner, method_name)
+          end
+        end
+
+        # An explicit worklist rather than recursion, so the node budget is one loop-carried local instead of
+        # a shared mutable cell (the engine value-pins a one-element Array counter and then self-flags the
+        # guard's own `negative?` as an always-falsey condition — this rule's own medicine).
+        def body_reads_published_constant?(root, scope)
+          stack = [root]
+          budget = BODY_SCAN_BUDGET
+          until stack.empty?
+            node = stack.pop
+            next unless node.is_a?(Prism::Node)
+
+            budget -= 1
+            return false if budget.negative?
+            return true if published_constant_node?(node, scope)
+
+            node.rigor_each_child { |child| stack << child }
+          end
+          false
+        end
+
+        def published_constant_node?(node, scope)
+          case node
+          when Prism::ConstantReadNode then scope.published_constant?(node.name.to_s)
+          when Prism::ConstantPathNode then published_path?(node, scope)
+          else false
+          end
+        end
+
+        def last_statement(body)
+          body.is_a?(Prism::StatementsNode) ? body.body.last : body
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/rule_walk.rb

@@ -170,8 +170,7 @@ module Rigor
           def extend_prefix(node, prefix)
             return prefix unless CLASS_OR_MODULE_NODE_CLASSES.any? { |klass| node.is_a?(klass) }
 
-            name = Source::ConstantPath.qualified_name(node.constant_path)
-            name ? prefix + [name] : prefix
+            Source::ConstantPath.declaration_prefix(prefix, node.constant_path) || prefix
           end
         end
       end

data/lib/rigor/analysis/check_rules/self_closedness_scanner.rb

@@ -44,12 +44,12 @@ module Rigor
           case node
           when Prism::ModuleNode
             name = Source::ConstantPath.qualified_name_or_nil(node.constant_path)
-            child_prefix = name ? prefix + [name] : prefix
+            child_prefix = Source::ConstantPath.declaration_prefix(prefix, node.constant_path) || prefix
             names << child_prefix.join("::") if name
             walk(node.body, child_prefix, names) if node.body
           when Prism::ClassNode
             name = Source::ConstantPath.qualified_name_or_nil(node.constant_path)
-            child_prefix = name ? prefix + [name] : prefix
+            child_prefix = Source::ConstantPath.declaration_prefix(prefix, node.constant_path) || prefix
             names << child_prefix.join("::") if name && class_surface_open?(node)
             walk(node.body, child_prefix, names) if node.body
           else