rigortype 0.3.6 → 0.3.7

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -61,8 +61,15 @@ module Rigor
         # DomainBlocksController` resolves as `Admin::DomainBlocksController` (matching the
         # `ControllerDiscoverer`), so render paths and filter-chain validation on nested controllers are
         # correct.
-        version: "0.9.0",
-        description: "Validates Action Pack route-helper calls and filter chains inside controllers, and types the request-context readers (`params` / `session` / `request`).",
+        # Bumped 2026-09-02 (#534 "same lane") — the request predicates and the FlashHash chain join the
+        # typed surface. `0.9.0`'s successor is `1.0.0`, not `0.10.0`: AGENTS.md's single-digit rule binds
+        # recursively at every position, and it applies here because a manifest version is a cache key
+        # rather than a gem release (so the no-autonomous-bump rule does not).
+        # Bumped 2026-09-02 (#621) — a reopened controller's `def`s are UNIONed rather than clobbered by
+        # the later file in the glob, so a cached 1.0.0 index can be missing the filter targets the merge
+        # restores.
+        version: "1.1.0",
+        description: "Validates Action Pack route-helper calls and filter chains inside controllers, and types the request-context readers (`params` / `session` / `request` / `flash`) and their chains.",
         config_schema: {
           "controller_search_paths" => { kind: :array, default: ["app/controllers"] },
           "view_search_paths" => { kind: :array, default: ["app/views"] }
@@ -203,7 +210,93 @@ module Rigor
       # method on a Parameters value stays engine-lenient (no `undefined-method`), and this types the
       # container only, never a caller's argument (ADR-5). The GitLab strong-params survey (108 leaked
       # `.permit` sites) is the demand.
-      STRONG_PARAMS_CHAIN_METHODS = %i[require permit permit!].freeze
+      # Issue #534 — `expect` (Rails 8's require+permit) and `slice` joined 2026-09-01, from the corpus
+      # sweep's pair counts (63 and 38 sites on mastodon). Both share `require`'s safety shape: they
+      # never return nil (`expect` raises like `require`; `slice` always returns a Parameters), so the
+      # non-nil lenient nominal cannot fold a flow rule wrong.
+      #
+      # ## The admission rule for this table
+      #
+      # A method belongs here **iff its Rails implementation returns an `ActionController::Parameters`
+      # on every path** — either a fresh `new_instance_with_inherited_permitted_status(...)` or `self`.
+      # That is a stronger bar than "usually returns Parameters", and it is the bar that keeps the
+      # entry FP-safe, because the RBS-less nominal buys leniency on the *method surface* only:
+      #
+      # - Method-surface rules DO decline on it. `call.undefined-method` bails at
+      #   `Rigor::Reflection.rbs_class_known?` (lib/rigor/analysis/check_rules.rb:720) because Rigor
+      #   ships no RBS for Parameters, and the argument / arity rules gate on the same predicate
+      #   (:1151, :2126). So `params.slice(:a).whatever_rails_adds` never fires, and a scalar-shaped
+      #   use of a Parameters-typed value (`.to_i`, `.strip`, string interpolation) resolves lenient
+      #   -to-Dynamic rather than to a diagnostic.
+      # - **Flow rules do NOT.** Truthiness folding, ternary arm selection and `.nil?` folding key on
+      #   the type being *nil-free*, not on whether Rigor knows its methods. A non-nil nominal standing
+      #   in for a value that is nil at runtime is a wrong precise type, and the folds it licenses are
+      #   real diagnostics on correct code. This is why the table admits only never-nil methods, and
+      #   why `#[]` is excluded below.
+      #
+      # Return contracts verified against rails v8.1.0.beta1
+      # (`actionpack/lib/action_controller/metal/strong_parameters.rb`). Deliberately excluded even
+      # though they are Parameters-shaped: `compact!` (`self if @parameters.compact!` — returns nil
+      # when nothing changed, :1038); `select` / `reject` / `filter` / `transform_keys` /
+      # `transform_values` (`to_enum(...)` without a block, so the answer depends on the call's block
+      # argument, :1004/:1018/:934/:917); `select!` / `keep_if`, whose doc comment ("returns nil if no
+      # changes were made") contradicts its body (`self`, :1010) — a contradiction that could resolve
+      # either way on a future Rails, and the demand does not justify betting on it; `dig` / `fetch` /
+      # `to_h` / `to_unsafe_h`, which return a caller value, nil, or a HashWithIndifferentAccess.
+      # `reject!` / `delete_if` / `compact_blank!` DO return `self` on every path (:1024/:1028/:1050)
+      # and are admissible under the same argument — deferred only to keep this change at the
+      # reviewed set; admit them with the next batch.
+      #
+      # ## `Parameters#[]`: rejected 2026-09-01, adopted 2026-09-05 (issue #534 item 1, #574)
+      #
+      # `#[]` is the single largest named-receiver pair on both survey apps (redmine 581, mastodon
+      # ~475), so it is the entry with by far the most to gain — and both typings of it were measured
+      # on a fixture controller of ordinary Rails idioms before being rejected:
+      #
+      # - **`#[] -> Parameters` (non-nil).** Types the whole chain (`params[:a][:b][:c]` resolves), but
+      #   the non-nil nominal is a *wrong* precise type at a missing key, and the flow rules act on it.
+      #   Every `params[:k]` condition becomes always-truthy, so a ternary over one folds to its true
+      #   arm: `mode = params[:full] ? :full : :short` types `mode` as `:full`, and the live guard
+      #   `return if mode == :short` draws `flow.always-truthy-condition` — a diagnostic on a branch
+      #   the program really takes. The same fold proves `if url.nil?` unreachable and types its body
+      #   `bot`. This reproduces the withdrawal measured on five working redmine/mastodon controllers.
+      #   (A shape like `x = params[:flag] ? nil : "a"; x.upcase` also changes answer, but it is a true
+      #   positive both before and after — `String | nil` genuinely can be nil — so it is evidence of
+      #   the fold, not of an FP. The two shapes above are the ones that are silent today and wrong
+      #   under this typing, which is why they are what the spec pins.)
+      # - **`#[] -> Parameters | nil`.** Fixes every fold above (no ternary collapse, no `bot` branch)
+      #   and still carries the chain — `params[:user][:name]` types `Parameters?` and
+      #   `params[:user].permit(:name)` types `Parameters`, because the dispatcher strips the nil arm
+      #   for the receiver gate. Idiomatic *chained* reads stay silent too: `call.possible-nil-receiver`
+      #   restricts itself to `Prism::LocalVariableReadNode` receivers (`CheckRules#nil_receiver_diagnostic`'s local-read restriction), so
+      #   `params[:q].strip` cannot fire. What it does fire on is the assigned form — `q = params[:q];
+      #   q.strip` — at **error** severity, once per unguarded use. Guarded forms (`return if q.nil?`,
+      #   `if q`, `q&.strip`, `|| ""`) all narrow correctly and stay silent, so this is not a broken
+      #   rule; it is the rule working, on a shape working Rails controllers use constantly. Adopting
+      #   it would put an error on correct code in exchange for a coverage metric.
+      #
+      # The first trade is still refused: `-> Parameters` buys protection-coverage with false positives,
+      # which inverts the project's ordering of those two goods (AGENTS.md: "false positives outrank
+      # worst-case static reading").
+      #
+      # The SECOND is no longer a trade. The `possible-nil-receiver` firing above was never this typing
+      # being wrong — it was the rules-level vacuity #574 describes, and the paragraph that stood here
+      # named the precondition exactly: "a receiver-position nullable the flow rules read as unknown
+      # rather than as nil". #574's witness gate is that change. `ActionController::Parameters` ships no
+      # RBS and has no project source, so the gate now reads it as UNKNOWN rather than as a full witness,
+      # the nil-arm has nothing confirming it, and the rule declines. `q = params[:q]; q.strip` is silent
+      # on the shape that rejected this typing, measured through the real CLI rather than argued.
+      #
+      # The control specs stay, and they still bite: they pin the HAZARD (no truthiness fold, no `bot`
+      # branch, no possible-nil firing), not the Dynamic answer, so they go red if either typing's
+      # hazard ever returns — and they now carry a positive assertion that `params[:k]` types
+      # `Parameters?`, so a silent regression to `Dynamic` or to the non-nil nominal fails them too.
+      STRONG_PARAMS_CHAIN_METHODS = %i[
+        require permit permit! expect slice
+        except without extract! slice!
+        merge merge! reverse_merge reverse_merge! with_defaults with_defaults!
+        compact compact_blank deep_dup
+      ].freeze
 
       dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: STRONG_PARAMS_CHAIN_METHODS do |call_node, _scope|
         next nil unless call_node.is_a?(Prism::CallNode)
@@ -211,6 +304,150 @@ module Rigor
         Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params])
       end
 
+      # Issue #534 item 1, reopened by #574. `#[]` is the single largest named-receiver pair on both survey
+      # apps (redmine 581, mastodon ~475). The honest contract is `Parameters | nil` — a missing key really
+      # returns nil — and the block comment above records why that typing was REJECTED in 2026-09-01: it put
+      # `call.possible-nil-receiver` at ERROR severity on `q = params[:q]; q.strip`, a shape working Rails
+      # controllers use constantly.
+      #
+      # That firing was a rules-level vacuity, not this typing being wrong, and #574 fixed it: the
+      # possible-nil witness gate counted a named-but-RBS-less arm as answerable, so a plugin-minted
+      # nominal with no RBS and no project source stood in as a full witness for a question nothing could
+      # answer. With the gate requiring a KNOWABLE arm, the nil-arm has no confirmed witness and the rule
+      # declines — which is the FP-first ordering, and what the comment above named as the precondition
+      # ("a receiver-position nullable the flow rules read as unknown rather than as nil").
+      #
+      # The non-nil `-> Parameters` typing stays rejected on its own merits, unchanged: it makes every
+      # `params[:k]` condition always-truthy and folds a ternary over one to its true arm.
+      dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: %i[[]] do |call_node, _scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+
+        Rigor::Type::Combinator.union(
+          Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]),
+          Rigor::Type::Combinator.constant_of(nil)
+        )
+      end
+
+      # Phase 5c (2026-09-02, issue #534 "same lane") — the rest of the request-context surface the
+      # corpus sweep measured after the #578 / #585 batch: `request.post?` 28 and `request.xhr?` 27 on
+      # the two apps, `flash.now` inside the redmine 147 / mastodon 29 flash cluster. Each is typed from
+      # its Rails/Rack source contract, verified at v8.0.2 / rack v3.1.8.
+      #
+      # ## The predicates return a real `bool`, and a real `bool` does not fold
+      #
+      # Every method in this table is a zero-argument predicate whose body is a genuine boolean
+      # expression — `request_method == POST` and its nine siblings in `Rack::Request::Helpers`,
+      # `/XMLHttpRequest/i.match?(...)` for `xhr?` / `xml_http_request?`, `scheme == "https" || scheme ==
+      # "wss"` for `ssl?`, two `LOCALHOST.match?` conjuncts for `local?`, and
+      # `FORM_DATA_MEDIA_TYPES.include?(media_type)` for `form_data?`. None can return a non-boolean, so
+      # `true | false` is the exact type rather than an approximation.
+      #
+      # `bool` is a UNION of the two constants, and that is what makes it FP-safe where a nominal would
+      # not be: `flow.always-truthy-condition` fires when the flow proves the condition folds to ONE
+      # constant, and a union of both never does. Measured on the shapes controllers actually write —
+      # `return unless request.post?`, `if request.xhr? … else … end`, `mode = request.get? ? :a : :b`
+      # followed by a live `mode == :a` guard, `request.post? && x`, `!request.get?` — the answer is zero
+      # diagnostics, unchanged from the `Dynamic[top]` baseline. This is the opposite of the
+      # `Parameters#[]` case (#578): there the candidate type was a non-nil *nominal* standing in for a
+      # value that is nil at runtime, and the fold it licensed was wrong.
+      #
+      # The distinction the predicates turn on is *inertness*, not truthfulness, and it is narrower than
+      # it looks: a two-constant union is inert because neither arm can be eliminated, while ANY nil-free
+      # type — nominal or union of nominals — is not. `request.format` was withdrawn from this batch on
+      # exactly that point (see below).
+      REQUEST_PREDICATE_METHODS = %i[
+        get? post? put? patch? delete? head? options? trace? link? unlink?
+        xhr? xml_http_request? ssl? local? form_data?
+      ].freeze
+
+      dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:request]], methods: REQUEST_PREDICATE_METHODS do |call_node, _scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+        next nil unless call_node.arguments.nil?
+        next nil unless call_node.block.nil?
+
+        Rigor::Type::Combinator.union(
+          Rigor::Type::Combinator.constant_of(true),
+          Rigor::Type::Combinator.constant_of(false)
+        )
+      end
+
+      # The FlashHash methods whose Rails body returns something this plugin can name on every path.
+      #
+      # - `now` is `@now ||= FlashNow.new(self)` — a memoised, never-nil `ActionDispatch::Flash::FlashNow`.
+      #   It is the carrier behind `flash.now[:alert] = "…"`, the second-most-written flash idiom.
+      # - `keep` and `discard` are `k ? self[k] : self`, so they are admissible ONLY in their
+      #   zero-argument form, where the answer is `self` — a FlashHash. Given a key they return a leaf
+      #   value or nil, which is the hazard below. The rule reads the arity syntactically, so the two
+      #   spellings get different answers from the same table row.
+      #
+      # Both nominals are RBS-less, hence lenient, for the reason `REQUEST_CONTEXT_READER_TYPES`
+      # documents.
+      FLASH_CHAIN_TYPES = {
+        now: "ActionDispatch::Flash::FlashNow",
+        keep: REQUEST_CONTEXT_READER_TYPES[:flash],
+        discard: REQUEST_CONTEXT_READER_TYPES[:flash]
+      }.freeze
+
+      # `keep` / `discard` answer `self` only when called with no key.
+      FLASH_SELF_RETURNING_METHODS = %i[keep discard].freeze
+
+      dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:flash]], methods: FLASH_CHAIN_TYPES.keys do |call_node, _scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+        next nil unless call_node.arguments.nil?
+        next nil unless call_node.block.nil?
+
+        class_name = FLASH_CHAIN_TYPES[call_node.name]
+        next nil if class_name.nil?
+
+        Rigor::Type::Combinator.nominal_of(class_name)
+      end
+
+      # ## What deliberately does NOT land here (issue #534, adjudicated 2026-09-02)
+      #
+      # **`request.format` was withdrawn from this batch and is filed as its own issue.** It was written
+      # as `Mime::Type | Mime::NullType` — a union read straight off `formats.first ||
+      # Mime::NullType.instance` — and review found the reasoning behind it wrong on the point that
+      # matters. A two-class union of nominals is NOT flow-inert the way `true | false` is: neither Mime
+      # arm is falsey, so the whole union is nil-free, and `mode = request.format ? :f : :n; return "a" if
+      # mode == :n` draws `flow.always-truthy-condition`. That fold is truthful at runtime — `format`
+      # really never returns nil — but truthfulness is not the bar this plugin has been holding, and the
+      # fold was never adjudicated against the shapes controllers write.
+      #
+      # `Mime::NullType` is what makes it more than a paperwork problem. It is a nil-MASQUERADING object:
+      # `mime_type.rb` (v8.0.2) gives it an explicit `def nil?; true; end`, so a nil-free union is the
+      # wrong model of it, and mastodon's `account_controller_concern.rb` really does branch on
+      # `request.format.nil?`. Measured today, `.nil?` on the union does not fold — but that is a
+      # consequence of the arms being RBS-less, not of anything this table asserts, and nothing pinned it.
+      # Typing `format` needs a nil-aware answer and its own adjudication, not a row here.
+      #
+      # **`FlashHash#[]=` and `Session#[]=` need no rule, and adding one could only do harm.** Two
+      # independent measurements say so. First, Ruby's assignment-expression semantics make the value of
+      # `flash[:notice] = msg` the RHS whatever `[]=` returns, and Rigor already models that: on a
+      # controller fixture with no plugin rule at all, `flash[:notice] = "hi"` types `"hi"` and
+      # `session[:user_id] = 1` types `1`. Second, `coverage --protection` scores a fixture of five such
+      # writes at **6/6 (100%)** — the lens measures *receiver* concreteness, and `flash` / `session` are
+      # already concrete nominals, so there is no coverage to win either. The corpus's "`FlashHash#[]=`
+      # 127 / 29" is a *named-receiver pair* count (a dispatch whose method does not resolve), which no
+      # return-type contribution can move. A rule here could only agree with the answer already given, or
+      # contradict it.
+      #
+      # **`FlashHash#[]` and `Session#[]` stay untyped, and both candidate arms were run.** Both are leaf
+      # reads — `@flashes[k.to_s]` and the session delegate's `[]` — returning whatever was stored, or
+      # nil for a key that is not set, so this is `Parameters#[]` (#578) again and it measures the same:
+      #
+      # - **non-nil `String`**: `mode = flash[:notice] ? :flash : :plain` folds to `:flash`, and the live
+      #   `mode == :plain` guard draws `flow.always-truthy-condition` — a diagnostic on a branch the
+      #   program takes.
+      # - **`String | nil`**: no folds, but `note = flash[:notice]; note.upcase` fires
+      #   `call.possible-nil-receiver` at ERROR severity — the assigned-then-used shape controllers write
+      #   constantly. (`uid.to_i` is silent because `NilClass` has `to_i`, which makes the noise
+      #   unpredictable rather than absent.)
+      #
+      # One false positive each, on ordinary controller code, in exchange for a coverage number. Session
+      # is if anything worse than Parameters: `session[:user_id]` is *the* nil-checked read in Rails, so
+      # the fold lands on the guard that matters most. Reopening either needs the same rules-level change
+      # #574 tracks, not a plugin table row. The specs pin both arms as executable controls.
+
       private
 
       # True when the current `self` is a controller — the enclosing class is one the discoverer
@@ -225,7 +462,8 @@ module Rigor
         return false if name.nil?
 
         index = producer_value(:controller_index)
-        return true if index && (index.find(name) || index.find("::#{name}"))
+        # `ControllerIndex#find` de-roots the query itself (#621) — no retry arm here.
+        return true if index&.find(name)
 
         name.end_with?("Controller")
       end

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/analyzer.rb

@@ -35,7 +35,9 @@ module Rigor
           class_name = constant_receiver_name(call_node.receiver)
           return [] if class_name.nil?
 
-          entry = job_index.find(class_name) || job_index.find("::#{class_name}")
+          # `JobIndex#find` de-roots the query itself (#621) — a `::WelcomeJob.perform_later` receiver and a
+          # plain `WelcomeJob.perform_later` reach the same entry with no retry arm here.
+          entry = job_index.find(class_name)
           return [] if entry.nil?
 
           violations = [info_violation(call_node, entry)]

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/effects.rb

@@ -135,7 +135,7 @@ module Rigor
         # per-environment split has no single transport, and guessing one would be the wrong kind of
         # precision.
         def detect_adapter(io_boundary, root)
-          found = config_files(root).filter_map do |path|
+          found = config_files(io_boundary, root).filter_map do |path|
             io_boundary.read_file(path).force_encoding("UTF-8")[SETTING, 1]
           rescue StandardError
             nil
@@ -143,10 +143,14 @@ module Rigor
           found.length == 1 ? found.first : nil
         end
 
-        def config_files(root)
+        # ADR-45 WD1b (#613) — `config/application.rb` is probed at a fixed path, so its ABSENCE is what
+        # shapes "no adapter" on a project that has none yet; the probe goes through the boundary to record
+        # that. The globbed `config/environments/*.rb` entries exist by enumeration and only pick up the
+        # (immediately superseded) presence row.
+        def config_files(io_boundary, root)
           application = File.join(root, CONFIG_PATHS.first)
           environments = Dir.glob(File.join(root, CONFIG_PATHS.last, "*.rb"))
-          ([application] + environments).select { |path| File.file?(path) }
+          ([application] + environments).select { |path| io_boundary.file?(path) }
         rescue StandardError
           []
         end

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/job_discoverer.rb

@@ -26,26 +26,61 @@ module Rigor
         def initialize(io_boundary:, search_paths:, base_classes:)
           @io_boundary = io_boundary
           @search_paths = search_paths
-          @base_classes = base_classes.to_set
+          # De-rooted for the same reason superclass names are ({#visit_class}): the match is by exact
+          # spelling, so a configured `job_base_classes: ["::ApplicationJob"]` would otherwise never match
+          # anything a declaration can render.
+          @base_classes = base_classes.to_set { |name| strip_root(name.to_s) }
         end
 
         # @return [JobIndex]
         def discover
-          entries = []
+          candidates = []
           ruby_files_under(@search_paths).each do |path|
             contents = read_safely(path)
             next if contents.nil?
 
             tree = Prism.parse(contents).value
             walk_for_jobs(tree, []) do |class_name, perform_def|
-              entries << build_entry(class_name, perform_def)
+              candidates << [class_name, perform_def]
             end
           end
-          JobIndex.new(entries)
+          JobIndex.new(merge_redeclarations(candidates))
         end
 
         private
 
+        # Collapses the candidates that declare the SAME constant into one entry, so {JobIndex} — which
+        # keys its rows by `class_name` — receives at most one per job.
+        #
+        # A job is routinely declared more than once: `app/jobs/welcome_job.rb` holds the real class and a
+        # second file reopens it (`class ::WelcomeJob`, `class WelcomeJob`) to add a method. Taking the last
+        # candidate dropped the real `#perform` envelope whenever the reopen sorted later in the glob — the
+        # reopen carries no `#perform`, so the job silently became any-arity and every `perform_later` went
+        # unchecked. The rows are merged instead:
+        #
+        # - The declarations that actually spell `def perform` decide the envelope; a reopen that does not
+        #   contributes nothing rather than erasing it.
+        # - When two declarations BOTH spell it with different shapes, the envelope WIDENS (min of the mins,
+        #   max of the maxes) and the required keywords intersect. The glob order is not the load order, so
+        #   pinning either shape would surface `wrong-arity` on a call the definition Ruby actually loads
+        #   accepts — ADR-5: a missed narrow case costs precision, a wrong one costs correct code.
+        def merge_redeclarations(candidates)
+          candidates.group_by(&:first).map do |class_name, rows|
+            declared = rows.filter_map { |(_, perform_def)| perform_def }
+            entries = declared.empty? ? [build_entry(class_name, nil)] : declared.map { |d| build_entry(class_name, d) }
+            entries.reduce { |base, addition| widen(base, addition) }
+          end
+        end
+
+        # The arity envelope that accepts every call either declaration accepts. See {#merge_redeclarations}.
+        def widen(base, addition)
+          base.with(
+            min_arity: [base.min_arity, addition.min_arity].min,
+            max_arity: [base.max_arity, addition.max_arity].max,
+            keyword_required: base.keyword_required & addition.keyword_required
+          )
+        end
+
         def read_safely(path)
           @io_boundary.read_file(path)
         rescue Plugin::AccessDeniedError, Errno::ENOENT
@@ -55,7 +90,8 @@ module Rigor
         def ruby_files_under(roots)
           roots.flat_map do |root|
             absolute = File.expand_path(root)
-            next [] unless File.directory?(absolute)
+            # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
+            next [] unless @io_boundary.directory?(absolute)
 
             Dir.glob(File.join(absolute, "**", "*.rb"))
           end
@@ -76,26 +112,41 @@ module Rigor
           class_local_name = constant_path_name(node.constant_path)
           return if class_local_name.nil?
 
-          full_name = (lexical_path + [class_local_name]).join("::")
-          superclass = constant_path_name(node.superclass) if node.superclass
+          full_name = declared_constant_name(class_local_name, lexical_path)
+          superclass = strip_root(constant_path_name(node.superclass)) if node.superclass
           if superclass && @base_classes.include?(superclass)
             perform_def = lookup_perform_def(node.body)
             yield full_name, perform_def
           end
 
-          inner_path = lexical_path + [class_local_name]
-          walk_for_jobs(node.body, inner_path, &) if node.body
+          walk_for_jobs(node.body, [full_name], &) if node.body
         end
 
         def visit_module(node, lexical_path, &)
           module_local_name = constant_path_name(node.constant_path)
           return if module_local_name.nil?
 
-          inner_path = lexical_path + [module_local_name]
+          inner_path = [declared_constant_name(module_local_name, lexical_path)]
           walk_for_jobs(node.body, inner_path, &) if node.body
         end
 
-        # Renders `Foo::Bar` / `::Foo::Bar` as a String.
+        # The full constant name a `class` / `module` declaration defines, given the rendered local name
+        # and the enclosing lexical path. A ROOTED local name (`class ::WelcomeJob`) names the top-level
+        # constant whatever the nesting, so the lexical path is dropped and the `::` with it; otherwise the
+        # name is appended to the path (`class WelcomeJob` inside `module Admin` → `Admin::WelcomeJob`).
+        def declared_constant_name(local_name, lexical_path)
+          return strip_root(local_name) if local_name.start_with?("::")
+
+          (lexical_path + [local_name]).join("::")
+        end
+
+        # `::WelcomeJob` → `WelcomeJob`; a name without the root marker is returned unchanged (nil stays nil).
+        def strip_root(name)
+          name&.delete_prefix("::")
+        end
+
+        # Renders `Foo::Bar` / `::Foo::Bar` as a String, KEEPING the leading `::` of a rooted path —
+        # {#declared_constant_name} reads it as "reset the lexical path" before the marker is dropped.
         def constant_path_name(node)
           return nil if node.nil?
 

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/job_index.rb

@@ -29,19 +29,27 @@ module Rigor
 
         attr_reader :entries
 
+        # `entries` is expected UNIQUE by `class_name`: the by-name Hash is keyed by it, so a second row for
+        # a job would replace the first outright. {JobDiscoverer#merge_redeclarations} is the single home of
+        # that guarantee — a reopened class arrives as one merged row, never as two.
         def initialize(entries)
           @entries = entries.freeze
           @by_name = entries.to_h { |entry| [entry.class_name, entry] }.freeze
           freeze
         end
 
+        # Entries are keyed by the de-rooted constant path (`"WelcomeJob"`, `"Admin::WelcomeJob"` — never
+        # `"::WelcomeJob"`; see {JobDiscoverer}), while a QUERY may legitimately arrive rooted:
+        # `::WelcomeJob.perform_later(1)` renders its receiver as `"::WelcomeJob"`. The root marker is
+        # dropped here, once, so no caller needs a `find(name) || find("::#{name}")` retry (#621).
+        #
         # @return [Entry, nil]
         def find(class_name)
-          @by_name[class_name.to_s]
+          @by_name[strip_leading_namespace(class_name.to_s)]
         end
 
         def known?(class_name)
-          @by_name.key?(class_name.to_s)
+          @by_name.key?(strip_leading_namespace(class_name.to_s))
         end
 
         def empty?
@@ -55,6 +63,11 @@ module Rigor
         def names
           @by_name.keys
         end
+
+        private
+
+        # `::WelcomeJob` → `WelcomeJob`. The query-side half of the key contract — see {#find}.
+        def strip_leading_namespace(name) = name.delete_prefix("::")
       end
     end
   end

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/recurring_scan.rb

@@ -69,7 +69,9 @@ module Rigor
 
         def load_document(path)
           absolute = File.expand_path(path.to_s)
-          return nil unless File.file?(absolute)
+          # ADR-45 WD1b (#613) — probing through the boundary records the missing `config/recurring.yml`
+          # as a dependency, so adding one invalidates the warm run instead of being served past.
+          return nil unless @io_boundary.file?(absolute)
 
           contents = read_safely(absolute)
           contents && parse_safely(contents)

data/plugins/rigor-activejob/lib/rigor/plugin/activejob.rb

@@ -39,7 +39,11 @@ module Rigor
         id: "activejob",
         # Bumped — publishes `:reachability_roots` for `rigor unused` (ADR-102 WD3): the jobs Solid Queue's
         # recurring schedule runs by name, which no `perform_later` call site writes down.
-        version: "0.2.0",
+        #
+        # Bumped 2026-09-02 (#621) — job keys are de-rooted at the producer and a reopened class's
+        # `#perform` envelope is merged rather than clobbered, so a cached 0.2.0 index can carry the
+        # any-arity row the merge replaces (and miss a schedule's reachability root under a rooted name).
+        version: "0.3.0",
         description: "Validates ActiveJob `Job.perform_later` argument arity.",
         config_schema: {
           "job_search_paths" => { kind: :array, default: ["app/jobs"] },

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/analyzer.rb

@@ -59,8 +59,8 @@ module Rigor
           model_name = constant_receiver_name(node.receiver)
           return if model_name.nil?
 
-          entry = @model_index.find(model_name) ||
-                  @model_index.find("::#{model_name}")
+          # A rooted receiver (`::User.where(...)`) renders as `"::User"`; `ModelIndex#find` normalises it.
+          entry = @model_index.find(model_name)
           return if entry.nil?
 
           case node.name