rigortype 0.3.6 → 0.3.7

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/model_index.rb

@@ -12,8 +12,18 @@ module Rigor
       #    children plus transitive STI subclasses) and yields a row per model.
       # 2. The plugin combines those rows with the parsed {SchemaTable} to produce this index.
       #
-      # `table_name_override` is non-nil when the source contained `self.table_name = "..."`. When nil,
-      # the table name derives from {Inflector.tableize}.
+      # Phase 2's schema is OPTIONAL. A project that ships raw migrations only — the DB-agnostic Rails
+      # pattern, where `db/schema.rb` is gitignored (Redmine) — has no schema to combine, and `schema_table:
+      # nil` then yields the REDUCED index: every {Entry} carries its resolved table name, associations,
+      # enums, scopes, validations, callbacks and aliases, and an EMPTY column set. Only the column-keyed
+      # surface stands down; the schema was never an input to any of the rest. {#columns_known?} tells the
+      # two modes apart — an empty column set means "the schema is unknown", not "this model has no
+      # columns", and consumers that would fire on an unrecognised column must not read the two the same
+      # way.
+      #
+      # `table_name_override` is non-nil when the source contained `self.table_name = "..."`. When nil, the
+      # table name derives from {.inflected_table_name} — demodulize, then {Inflector.tableize}, then a
+      # `table_name_prefix` / `table_name_suffix` the enclosing module declares and the discoverer can fold.
       #
       # Single-table-inheritance subclasses (`class Admin < User`) carry an `sti_parent:` pointer; their
       # {Entry} resolves its table from the root model and inherits the chain's declared associations /
@@ -29,9 +39,18 @@ module Rigor
         # - `nullable` — Boolean; whether a `:singular` accessor can return `nil`. `has_one` → `true`;
         #              `belongs_to` → `false` (required by default since Rails 5) unless `optional: true`
         #              / `required: false`. Meaningless for `:collection` rows.
-        Entry = Struct.new(:class_name, :table_name, :columns, :associations,
+        #
+        # `table_name_exact` records whether `table_name` is the name the application actually uses, or a
+        # derivation that merely looks right. It is true ONLY when the source declared the name as a String
+        # literal — `self.table_name = "…"` on this class or, walking leaf → root, on an STI ancestor — and
+        # no class in that chain also computes the name at runtime. An {Inflector.tableize} guess is never
+        # exact. Only a true reading licenses pinning the name to a value; see
+        # `Activerecord#table_name_return_type` for why the schema is not admitted as corroboration.
+        Entry = Struct.new(:class_name, :table_name, :table_name_exact, :columns, :associations,
                            :enums, :scopes, :validations, :callbacks, :aliases,
                            keyword_init: true) do
+          def table_name_exact? = table_name_exact == true
+
           def column(name)
             columns.find { |c| c.name == name.to_s }
           end
@@ -75,19 +94,35 @@ module Rigor
 
         attr_reader :entries
 
-        def initialize(entries)
+        def initialize(entries, columns_known: true)
           @entries = entries.freeze
+          @columns_known = columns_known
           freeze
         end
 
+        # Whether a schema was parsed into this index. `false` in the reduced mode (no `db/schema.rb` and no
+        # `db/structure.sql`), where every entry's column set is empty because the columns are UNKNOWN.
+        def columns_known? = @columns_known == true
+
+        # Entries are keyed by the de-rooted constant path (`"User"`, `"Admin::User"` — never `"::User"`;
+        # see {ModelDiscoverer}), while a QUERY may legitimately arrive rooted: `::User.find(1)` renders its
+        # receiver as `"::User"`. The root marker is dropped here, once, so every lookup accepts both
+        # spellings and no caller needs a `find(name) || find("::#{name}")` retry (#583).
         def find(class_name)
-          entries[class_name.to_s]
+          entries[strip_leading_namespace(class_name.to_s)]
         end
 
-        def model?(class_name) = entries.key?(class_name.to_s)
+        def model?(class_name) = entries.key?(strip_leading_namespace(class_name.to_s))
         def class_names = entries.keys
         def empty? = entries.empty?
 
+        # `schema_table` may be nil — see the reduced mode described on the class. Every other input is
+        # source-derived, so the entries are identical in both modes apart from `columns`.
+        #
+        # `model_rows` is expected UNIQUE by `class_name`: the entry Hash is keyed by that name, so a second
+        # row for a model would replace the first outright. {ModelDiscoverer#merge_redeclarations} is the
+        # single home of that guarantee — a reopened class arrives as one merged row, never as two — and the
+        # de-duplication is deliberately not repeated here, where a second copy could only drift from it.
         def self.build(model_rows:, schema_table:, type_override_columns: nil)
           rows_by_name = model_rows.to_h { |row| [row.fetch(:class_name), row] }
           overrides = type_override_columns || []
@@ -96,8 +131,22 @@ module Rigor
             class_name = row.fetch(:class_name)
             # The STI ancestry chain, root → self. For a plain (non-STI) model this is just `[row]`.
             chain = sti_chain(row, rows_by_name)
-            table_name = sti_table_name(chain)
-            columns = apply_type_overrides(schema_table.columns_for(table_name) || [], overrides)
+            declared = declared_table_name(chain)
+            table_name = declared || inflected_table_name(chain)
+            # An UNRELIABLE inflected name (see {.inflected_table_name_unreliable?}) is never looked up in
+            # the schema at all — `table_name` is still the best-effort demodulized guess for DISPLAY
+            # (`model-call`'s "table: ..." info diagnostic), but its COLUMNS are the empty set on purpose,
+            # the same stand-down path `Analyzer#validate_column_hash_call` already gives a view-backed
+            # model with no schema-side columns. Looking the guess up anyway risks the corroboration
+            # `table_name_exact?` above already refuses for a MUCH narrower reason: a real, unrelated table
+            # can share the bare demodulized name, and column-checking against it is worse than not
+            # checking at all — a wrong `unknown-column` (or a wrong silence) on correct code either way.
+            columns =
+              if declared.nil? && inflected_table_name_unreliable?(chain)
+                []
+              else
+                apply_type_overrides(schema_table&.columns_for(table_name) || [], overrides)
+              end
 
             # STI children inherit their ancestors' declared associations / enums / aliases / scopes /
             # validations / callbacks. Without the merge a `where(<parent-association>: ...)` on the
@@ -105,6 +154,7 @@ module Rigor
             acc[class_name] = Entry.new(
               class_name: class_name,
               table_name: table_name,
+              table_name_exact: table_name_exact?(chain, declared),
               columns: columns.freeze,
               associations: merge_named_rows(chain.flat_map { |r| Array(r[:associations]) }),
               enums: merge_enums(chain),
@@ -114,7 +164,7 @@ module Rigor
               aliases: merge_aliases(chain)
             ).freeze
           end
-          new(entries.freeze)
+          new(entries.freeze, columns_known: !schema_table.nil?)
         end
 
         # Remaps every type-overridden column's `ruby_type` to `"Object"` so instance-side column narrowing
@@ -150,11 +200,100 @@ module Rigor
         # The effective table name for an STI chain: the nearest explicit `self.table_name =` override
         # walking leaf → root, else the name inflected from the root class.
         def self.sti_table_name(chain)
+          declared_table_name(chain) || inflected_table_name(chain)
+        end
+
+        # Whether `table_name` is the name the application actually uses — the condition that licenses
+        # pinning it to a value. DECLARED-ONLY: a String literal `self.table_name =` on this class or an STI
+        # ancestor, and no class in the chain computing the name at runtime (`def self.table_name`, the
+        # `class << self` spelling, a non-literal assignment) — a computed override anywhere beats an
+        # ancestor's literal, because it is what actually answers.
+        #
+        # An inflected name is NEVER exact, not even when the parsed schema has a table by that name.
+        # Existence in the schema is not corroboration: the table can belong to a different model. Under an
+        # `ApplicationRecord` that sets `self.table_name_prefix = "app_"`, `User` really reads `app_users`
+        # while a schema carrying both `users` (another model's, declared) and `app_users` would "confirm"
+        # the inflected `users` — and `User.table_name == "app_users"`, true at runtime, would then fold
+        # always-falsey. Prefix / suffix / namespace derivation is not reachably airtight, so the lane is
+        # dropped rather than patched.
+        def self.table_name_exact?(chain, declared)
+          return false if chain.any? { |row| row[:table_name_computed] }
+
+          !declared.nil?
+        end
+
+        # The nearest explicit `self.table_name = "..."` walking leaf → root, or nil when the chain declared
+        # none. Split out from {sti_table_name} because "was it declared?" is the question
+        # `table_name_exact` answers, and re-deriving it from the resolved name is not possible.
+        def self.declared_table_name(chain)
           chain.reverse_each do |row|
             override = row[:table_name_override]
             return override if override
           end
-          Rigor::Plugin::Inflector.tableize(strip_leading_namespace(chain.first.fetch(:class_name)))
+          nil
+        end
+
+        # The name inflected from the ROOT class of the chain — an STI child shares its root's table. Rails
+        # derives a namespaced model's table from its DEMODULIZED class name — `Blog::Post` → `posts`, the
+        # `Blog::` dropped entirely — and prepends/appends `table_name_prefix` / `table_name_suffix` only
+        # when the ENCLOSING module actually declares one
+        # (`ActiveRecord::ModelSchema::ClassMethods#undecorated_table_name` /
+        # `#full_table_name_prefix`); it never flattens the namespace into the table name the way a naive
+        # `tableize("Blog::Post")` would (`"blog_posts"`, silently wrong for every namespaced model — #623).
+        # The row's `class_name` is already de-rooted ({ModelDiscoverer#declared_constant_name}), so it
+        # feeds the demodulize/inflect/decorate steps as is.
+        def self.inflected_table_name(chain)
+          root = chain.first
+          base = Rigor::Plugin::Inflector.tableize(demodulize(root.fetch(:class_name)))
+          prefix = decorator_literal(root[:table_name_prefix])
+          suffix = decorator_literal(root[:table_name_suffix])
+          "#{prefix}#{base}#{suffix}"
+        end
+
+        # `"Blog::Post"` → `"Post"`; a name without a namespace is returned unchanged. Matches
+        # `ActiveSupport::Inflector#demodulize` for a well-formed constant path — a plain String split, no
+        # gem call needed (unlike {Inflector}'s allow-listed methods, there is no real-vs-approximated
+        # divergence risk here to guard against).
+        def self.demodulize(class_name)
+          class_name.to_s.split("::").last
+        end
+
+        # Reads a `table_name_prefix:` / `table_name_suffix:` decorator ({ModelDiscoverer}'s resolved
+        # `:table_name_prefix` / `:table_name_suffix` row field, always present on a discovered row): the
+        # folded literal when the discoverer could read one off the enclosing namespace, or `""` — both when
+        # no enclosing namespace declares the name AND when one does but in a shape the discoverer cannot
+        # fold. The second case is deliberately NOT a guess at what the real prefix/suffix string is
+        # (#623) — synthesising a default like `"<namespace>_"` would risk corroborating the WRONG table.
+        # What THIS empty string does not by itself do is make the resulting name safe to trust for column
+        # lookup: see {.inflected_table_name_unreliable?}, which is what actually stands the columns down
+        # for this case — the string returned here still feeds `table_name`'s informational display value.
+        def self.decorator_literal(decorator)
+          (decorator || {}).fetch(:literal, "")
+        end
+
+        # Whether the chain's INFLECTED name (only reached when nothing was `declared_table_name`) is
+        # trustworthy enough to look up in the schema. `false` when either the root's `table_name_prefix` or
+        # `table_name_suffix` decorator is `{ computed: true }` (declared by an enclosing namespace, but not
+        # in a shape the discoverer could fold — see {ModelDiscoverer}'s class doc), or when the root is
+        # nested inside another discovered model class (`table_name_nested_in_model`, a wholly different
+        # Rails naming rule this walker does not attempt — same file).
+        #
+        # A namespace whose decorator this discoverer never even SAW cannot be flagged here at all — it
+        # reads as "nothing declared," not "declared but unreadable." {ModelDiscoverer}'s class doc names
+        # three such gaps: a prefix declared outside `model_search_paths` entirely (a `def
+        # self.table_name_prefix` in `lib/blog.rb`, a `Rails::Engine.isolate_namespace` call), a model
+        # declaring `table_name_prefix` on ITSELF, and a base-class-level `table_name_prefix`. The last two
+        # are pre-existing — unpatched code guesses wrong identically. The first is a live, documented gap
+        # this fix does not close (a namespace this discoverer never reads a file for is indistinguishable
+        # from one that genuinely declares nothing), tracked for a follow-up rather than guessed shut.
+        def self.inflected_table_name_unreliable?(chain)
+          root = chain.first
+          decorator_unreliable?(root[:table_name_prefix]) || decorator_unreliable?(root[:table_name_suffix]) ||
+            root[:table_name_nested_in_model] == true
+        end
+
+        def self.decorator_unreliable?(decorator)
+          !decorator.nil? && decorator[:computed] == true
         end
 
         # Dedups association-style rows by `:name`, keeping the LAST occurrence so a child redeclaration
@@ -180,11 +319,15 @@ module Rigor
           end.freeze
         end
 
-        # `::User` → `User`. The discoverer might prefix with `::` for top-level constants depending on
-        # how it resolved the path; the table-name derivation uses the short form regardless.
+        # `::User` → `User`. The query-side half of the key contract: entries never carry the root marker,
+        # so a rooted lookup name is normalised to the spelling the entries use ({#find} / {#model?}).
         def self.strip_leading_namespace(name)
-          name.start_with?("::") ? name[2..] : name
+          name.delete_prefix("::")
         end
+
+        private
+
+        def strip_leading_namespace(name) = self.class.strip_leading_namespace(name)
       end
     end
   end

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord.rb

@@ -34,6 +34,17 @@ module Rigor
     # The per-file `#diagnostics_for_file` hook delegates to {Analyzer}, which walks Prism and emits
     # diagnostics for `Model.find` / `Model.find_by` / `Model.where` calls against the index.
     #
+    # ## Reduced mode (no schema file)
+    #
+    # The schema gates the COLUMN surface and nothing else. When neither file is present — the DB-agnostic
+    # Rails pattern of shipping raw migrations and gitignoring `db/schema.rb`, as Redmine does — the plugin
+    # builds a columns-less {ModelIndex} from {ModelDiscoverer} output alone and keeps typing table names,
+    # finders, scopes and associations off it. Column readers and column-keyed checks then decline exactly
+    # as an unrecognised column does: `Analyzer` already treats an empty column set as "cannot check"
+    # (view-backed models hit the same path on a schema-PRESENT project), and `#column_return_type` finds
+    # no column and contributes nothing. The `:model_index` fact is deliberately NOT published in this mode
+    # — see `#prepare`.
+    #
     # ## Configuration
     #
     #     plugins:
@@ -52,11 +63,31 @@ module Rigor
     class Activerecord < Rigor::Plugin::Base
       manifest(
         id: "activerecord",
-        # Bumped 2026-05-28 — implicit-self class-side AR call resolution: `select(:uri).group(:uri)` inside
+        # 0.8.0, 2026-09-02 — a model declared `class ::User` is keyed by its de-rooted name (`"User"`) in
+        # the {ModelIndex} and the published `:model_index` fact (#583). The version is part of the
+        # producer cache KEY: a cached 0.7.0 index still keys such a model `"::User"`, and `ModelIndex#find`
+        # now normalises every query to the de-rooted spelling, so serving that payload warm would miss the
+        # model on every lookup until an unrelated model edit happened to invalidate the entry. The same
+        # bump covers the second half of the change — a model reopened in a second file is now ONE merged
+        # entry rather than the last declaration's, so a cached 0.7.0 entry can also be missing the DSL
+        # surface the merge restores.
+        #
+        # 0.7.0, 2026-09-01 — `table_name` / `quoted_table_name` join the recognised class-side surface, and
+        # `ModelIndex::Entry` gains the `table_name_exact` member that gates value-pinning. A Struct member
+        # addition is not Marshal-compatible with the cached 0.6.0 payload, so the bump (part of the
+        # producer cache key) is what keeps a warm run from loading it.
+        #
+        # 0.6.0, 2026-09-01 — reduced mode: a missing `db/schema.rb` / `db/structure.sql` degrades to a
+        # columns-less {ModelIndex} instead of disabling the plugin. The version is part of the producer
+        # cache KEY, so the bump is what stops a warm run from serving the pre-change payload (which,
+        # having no `columns_known` ivar, would read as reduced mode on a schema-PRESENT project and
+        # withhold the `:model_index` fact).
+        #
+        # 0.5.0, 2026-05-28 — implicit-self class-side AR call resolution: `select(:uri).group(:uri)` inside
         # a scope lambda body / class-method body now contributes `Relation[Model]` via `scope.self_type`
         # instead of falling through to `Kernel#select` (the IO multiplexer, `Array[String]` return). Plus
         # `:select` added to the relation-entry-point list.
-        version: "0.5.0",
+        version: "0.8.0",
         description: "Types ActiveRecord finders against the project's db/schema.rb and AR models.",
         config_schema: {
           "schema_file" => { kind: :string, default: "db/schema.rb" },
@@ -102,9 +133,13 @@ module Rigor
       end
 
       # Cached: model index. Walks every model file, then composes the rows with the cached schema table.
-      # `watch:` (ADR-60 WD3) covers model-file additions; the discoverer's in-block reads are captured
-      # into the record-and-validate dependency descriptor after the block runs.
-      producer :model_index, watch: -> { [[@model_search_paths, "**/*.rb"]] } do |_params|
+      # `watch:` (ADR-60 WD3) covers model-file additions and outside declarations; the discoverer's in-block
+      # reads are captured into the record-and-validate dependency descriptor after the block runs.
+      producer :model_index,
+               watch: lambda {
+                 outside = ModelDiscoverer::OUTSIDE_SEARCH_DIRECTORIES.map { |dir| [dir, "**/*.rb"] }
+                 [[@model_search_paths, "**/*.rb"], *outside]
+               } do |_params|
         discoverer = ModelDiscoverer.new(
           io_boundary: io_boundary,
           search_paths: @model_search_paths,
@@ -143,11 +178,20 @@ module Rigor
       #     }
       #
       # Consumers do `services.fact_store.read(plugin_id: "activerecord", name: :model_index)` and look up
-      # by class name. Discovery failures (missing schema, unparseable models) leave the fact unpublished —
-      # the consumer's own degrade path runs (typically a no-op).
+      # by class name — the DE-ROOTED constant path (`"User"`, `"Admin::User"`), never `"::User"`, however
+      # the model was declared (#583; see {ModelDiscoverer}). Discovery failures (missing schema,
+      # unparseable models) leave the fact unpublished — the consumer's own degrade path runs (typically a
+      # no-op).
       def prepare(services)
         index = model_index
         return if index.nil? || index.empty?
+        # Reduced mode stays UNPUBLISHED. Every consumer reads `columns:` as authoritative and fires on a
+        # key missing from it — rigor-actionpack's `permit(:title)` check and rigor-shoulda-matchers'
+        # `have_db_column(:title)` / `validate_presence_of(:title)` matchers both do — so publishing the
+        # reduced index's empty column set would convert this precision win into a false positive on every
+        # strong-parameter key and every column matcher in the project. Withholding it leaves those
+        # consumers exactly where they are today on a schema-less target: silent.
+        return unless index.columns_known?
 
         services.fact_store.publish(
           plugin_id: manifest.id,
@@ -158,20 +202,13 @@ module Rigor
 
       def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
         index = model_index
-        if index.nil?
-          # Project-global error (missing `db/schema.rb`, parse failure, etc.) — emit once per run rather
-          # than once per analyzed file. On a Redmine-shape project that uses migrations only (no
-          # `schema.rb`), the old path produced 346 identical load-errors; on a Solidus monorepo (no
-          # top-level `schema.rb`), 999.
-          return [] if @load_errors_emitted
-
-          @load_errors_emitted = true
-          return load_error_diagnostics(path)
-        end
-        return [] if index.empty?
-        return [] if migration_path?(path)
+        # The schema-load disclosure is independent of whether an index was built: reduced mode still
+        # produces one (and still analyzes), while a genuine index failure produces one and nothing else.
+        diagnostics = consume_load_error_diagnostics(path)
+        return diagnostics if index.nil? || index.empty?
+        return diagnostics if migration_path?(path)
 
-        Analyzer.new(path: path, model_index: index).analyze(root).diagnostics
+        diagnostics.concat(Analyzer.new(path: path, model_index: index).analyze(root).diagnostics)
       end
 
       # Rails migration files (`db/migrate/<timestamp>_*.rb`) and post-migration files
@@ -195,7 +232,10 @@ module Rigor
       # The class-side finder / relation entry-point names `finder_return_type` recognises. Static half of
       # the `dynamic_return` name gate; the run-time half comes from the model index (scopes,
       # associations, columns).
-      FINDER_METHOD_NAMES = %i[find find_by! find_by where all order limit none select].freeze
+      FINDER_METHOD_NAMES = %i[
+        find find_by! find_by where all order limit none select
+        table_name quoted_table_name
+      ].freeze
       private_constant :FINDER_METHOD_NAMES
 
       # Return-type contribution via the run-time `methods:` name gate (ADR-52 slice 5b). `Model.find(id)`
@@ -259,7 +299,8 @@ module Rigor
         model_name = constant_receiver_name(call_node.receiver)
         return nil if model_name.nil?
 
-        entry = index.find(model_name) || index.find("::#{model_name}")
+        # A rooted receiver (`::User.find`) renders as `"::User"`; `ModelIndex#find` normalises it.
+        entry = index.find(model_name)
         return nil if entry.nil?
 
         finder_return_type(call_node, entry) ||
@@ -285,7 +326,7 @@ module Rigor
         self_type = scope.self_type
         return nil unless self_type.is_a?(Rigor::Type::Singleton)
 
-        entry = index.find(self_type.class_name) || index.find("::#{self_type.class_name}")
+        entry = index.find(self_type.class_name)
         return nil if entry.nil?
 
         finder_return_type(call_node, entry) ||
@@ -319,9 +360,41 @@ module Rigor
           # of the query DSL chains through the bundled `ActiveRecord::Relation` RBS once a relation is
           # open.
           relation_of(entry.class_name)
+        when :table_name
+          table_name_return_type(entry)
+        when :quoted_table_name
+          # Quoting is adapter-dependent — `"users"` on PostgreSQL, backticked on MySQL — so unlike
+          # `table_name` the exact string is not derivable from project source even when the bare name is.
+          Rigor::Type::Combinator.nominal_of("String")
         end
       end
 
+      # `Model.table_name` is a String either way; whether it is safe to VALUE-PIN turns on how the name was
+      # derived. `Entry#table_name_exact?` holds ONLY for a name the source declared as a String literal
+      # (`self.table_name = "…"`, inherited down an STI chain, and not overridden by a computed one). An
+      # inflected name is never pinned, however plausible: a `table_name_prefix` / `table_name_suffix` on
+      # the namespace, an abstract class (whose real answer is `nil`), and a project-custom inflection rule
+      # all silently change the real name, and `Constant["users"]` on any of them is a wrong precise type
+      # that value-dependent folding downstream acts on — `Model.table_name == <real name>` folds
+      # always-falsey, an error on working code.
+      #
+      # The schema is deliberately NOT admitted as corroboration for an inflected name. A table existing
+      # does not make it THIS model's table: with a `table_name_prefix = "app_"`, `User` reads `app_users`
+      # while a `users` table declared by another model would "confirm" the inflection. Prefix / suffix /
+      # namespace derivation is not reachably airtight, and a smaller set of pins beats a wrong one.
+      # Widening to `String` is monotone imprecision — and it still closes the opacity the call site had,
+      # which is the whole measured win.
+      #
+      # `String` rather than `String | nil` for the abstract-class case follows the same call as
+      # `#column_return_type`: under-reporting nil is a false negative, over-reporting it lights up
+      # `possible-nil-receiver` on the ordinary idiom, and this project ranks the latter as the worse
+      # failure.
+      def table_name_return_type(entry)
+        return Rigor::Type::Combinator.nominal_of("String") unless entry.table_name_exact?
+
+        Rigor::Type::Combinator.constant_of(entry.table_name)
+      end
+
       # `Post.published` / `Post.recent(5)` — a user-declared `scope` returns a relation of the model
       # regardless of the arguments it takes.
       def class_scope_return_type(call_node, entry)
@@ -358,7 +431,7 @@ module Rigor
         model_name = relation_element_class_name(scope.type_of(call_node.receiver))
         return nil if model_name.nil?
 
-        entry = index.find(model_name) || index.find("::#{model_name}")
+        entry = index.find(model_name)
         return nil if entry.nil?
         return nil unless entry.scope?(call_node.name)
 
@@ -392,8 +465,7 @@ module Rigor
         receiver_type = scope.type_of(call_node.receiver)
         return nil unless receiver_type.is_a?(Rigor::Type::Nominal)
 
-        entry = index.find(receiver_type.class_name) ||
-                index.find("::#{receiver_type.class_name}")
+        entry = index.find(receiver_type.class_name)
         return nil if entry.nil?
 
         association_return_type(entry, call_node.name) ||
@@ -492,8 +564,11 @@ module Rigor
       end
 
       # Marshal-clean Hash form for the cross-plugin fact store. Consumers (rigor-actionpack Phase 1,
-      # rigor-factorybot Phase 1 (c), ...) get a flat `class_name → { table:, columns: }` map without
-      # depending on this plugin's `ModelIndex` / `SchemaTable::Column` carrier classes.
+      # rigor-factorybot Phase 1 (c), rigor-shoulda-matchers, ...) get a flat `class_name → { table:,
+      # columns: }` map without depending on this plugin's `ModelIndex` / `SchemaTable::Column` carrier
+      # classes. The keys are the index's own — de-rooted constant paths — and the consumers key into the
+      # Hash directly with the plain rendering of the constant they anchor on, with no two-spelling retry
+      # (#583).
       def index_to_published_hash(index)
         index.entries.transform_values do |entry|
           {
@@ -512,15 +587,17 @@ module Rigor
       def model_index
         return @model_index if @model_index
 
-        table = schema_table_or_nil
-        return nil if table.nil?
-
+        # A missing schema no longer disables the plugin. `schema_table_or_nil` is still called here — not
+        # for its return value (the producer block calls it again, memoised), but because a cache HIT skips
+        # the producer block entirely and the reduced-mode disclosure would then never be recorded on a warm
+        # run.
+        schema_table_or_nil
         # ADR-60 WD3 record-and-validate: the producer's own in-block `ModelDiscoverer` reads are
         # captured into the dependency descriptor after the block runs, and the producer's `watch:` covers
         # model-file additions — so no priming walk is needed (it used to run the discover twice).
         @model_index = cache_for(:model_index, params: {}).call
       rescue StandardError => e
-        @load_errors << "model index build failed: #{e.class}: #{e.message}"
+        @load_errors << { message: "model index build failed: #{e.class}: #{e.message}", severity: :warning }
         nil
       end
 
@@ -539,25 +616,48 @@ module Rigor
         # here.
         @schema_table = cache_for(:schema_table, params: {}).call
       rescue Plugin::AccessDeniedError => e
-        @load_errors << "rigor-activerecord: #{e.message}"
+        @load_errors << { message: "rigor-activerecord: #{e.message}#{REDUCED_MODE_SUFFIX}",
+                          severity: :warning }
         nil
       rescue Errno::ENOENT
-        @load_errors << "rigor-activerecord: schema file `#{@schema_file}` (or `#{@structure_sql_file}`) " \
-                        "not found; AR call checks skipped"
+        # NOT an error: a project that commits raw migrations only and gitignores `db/schema.rb` is the
+        # DB-agnostic Rails pattern, not a misconfiguration. The plugin still types finders, scopes,
+        # associations and table names off the discovered models, so this is a disclosure of REDUCED
+        # capability rather than a failure — `:info`, the grade the plugins use for "here is what I
+        # recognised", not `:warning`, the grade they use for "I could not run".
+        @load_errors << { message: "rigor-activerecord: schema file `#{@schema_file}` (or " \
+                                   "`#{@structure_sql_file}`) not found#{REDUCED_MODE_SUFFIX}",
+                          severity: :info }
         nil
       rescue StandardError => e
-        @load_errors << "rigor-activerecord: failed to parse `#{@schema_file}`: #{e.class}: #{e.message}"
+        # A schema that EXISTS but does not parse is a real, actionable problem — the user meant it to be
+        # read. Reduced mode still applies, but the disclosure stays a warning.
+        @load_errors << { message: "rigor-activerecord: failed to parse `#{@schema_file}`: " \
+                                   "#{e.class}: #{e.message}#{REDUCED_MODE_SUFFIX}",
+                          severity: :warning }
         nil
       end
 
-      def load_error_diagnostics(path)
-        @load_errors.uniq.map do |message|
+      # The half of every schema-load disclosure that says what the plugin still does. Kept as one string so
+      # the three paths above cannot drift on the description of the mode they all land in.
+      REDUCED_MODE_SUFFIX = "; typing models from source only — column checks " \
+                            "(`where(col:)`, column readers) are skipped"
+      private_constant :REDUCED_MODE_SUFFIX
+
+      # Project-global disclosures, emitted once per run on the first analyzed file rather than once per
+      # file. On a Redmine-shape project (migrations only, no `schema.rb`) the per-file form produced 346
+      # identical rows; on a Solidus monorepo, 999.
+      def consume_load_error_diagnostics(path)
+        return [] if @load_errors_emitted
+
+        @load_errors_emitted = true
+        @load_errors.uniq.map do |error|
           Rigor::Analysis::Diagnostic.new(
             path: path,
             line: 1,
             column: 1,
-            message: message,
-            severity: :warning,
+            message: error.fetch(:message),
+            severity: error.fetch(:severity),
             rule: "load-error"
           )
         end

data/plugins/rigor-activestorage/lib/rigor/plugin/activestorage/analyzer.rb

@@ -41,8 +41,8 @@ module Rigor
           return unless node.receiver.is_a?(Prism::ConstantReadNode)
 
           owner = node.receiver.name.to_s
-          attachments = @attachment_index.attachments_for(owner) ||
-                        @attachment_index.attachments_for("::#{owner}")
+          # `AttachmentIndex#attachments_for` de-roots the query itself (#621) — no retry arm here.
+          attachments = @attachment_index.attachments_for(owner)
           return if attachments.nil?
 
           # Only flag when the method matches a known attachment name (the `dynamic_return` rule provides

data/plugins/rigor-activestorage/lib/rigor/plugin/activestorage/attachment_discoverer.rb

@@ -26,7 +26,9 @@ module Rigor
       # - Only Symbol-literal attachment names are recognised. `has_one_attached(args)` or computed names
       #   decline.
       # - Modules (`class Admin::User`) are recognised; the resulting class name is the lexical path
-      #   (`Admin::User`).
+      #   (`Admin::User`). A ROOTED declaration (`class ::User`) names the top-level constant whatever its
+      #   nesting, so it yields `"User"` — the same spelling `class User` does, which is what every
+      #   consumer anchors on (#621).
       class AttachmentDiscoverer
         ATTACHMENT_METHODS = {
           has_one_attached: :singular,
@@ -64,7 +66,8 @@ module Rigor
         def ruby_files_under(roots)
           roots.flat_map do |root|
             absolute = File.expand_path(root)
-            next [] unless File.directory?(absolute)
+            # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
+            next [] unless @io_boundary.directory?(absolute)
 
             Dir.glob(File.join(absolute, "**", "*.rb"))
           end
@@ -87,22 +90,31 @@ module Rigor
           class_local_name = constant_path_name(node.constant_path)
           return if class_local_name.nil?
 
-          full_name = (lexical_path + [class_local_name]).join("::")
+          full_name = declared_constant_name(class_local_name, lexical_path)
           attachments = collect_attachments(node.body)
           yield full_name, attachments
 
-          inner_path = lexical_path + [class_local_name]
-          walk(node.body, inner_path, &) if node.body
+          walk(node.body, [full_name], &) if node.body
         end
 
         def visit_module(node, lexical_path, &)
           module_local_name = constant_path_name(node.constant_path)
           return if module_local_name.nil?
 
-          inner_path = lexical_path + [module_local_name]
+          inner_path = [declared_constant_name(module_local_name, lexical_path)]
           walk(node.body, inner_path, &) if node.body
         end
 
+        # The full constant name a `class` / `module` declaration defines, given the rendered local name
+        # and the enclosing lexical path. A ROOTED local name (`class ::User`) names the top-level constant
+        # whatever the nesting, so the lexical path is dropped and the `::` with it; otherwise the name is
+        # appended to the path (`class User` inside `module Admin` → `Admin::User`).
+        def declared_constant_name(local_name, lexical_path)
+          return local_name.delete_prefix("::") if local_name.start_with?("::")
+
+          (lexical_path + [local_name]).join("::")
+        end
+
         def collect_attachments(body)
           return [] if body.nil?
 
@@ -126,6 +138,8 @@ module Rigor
           Rigor::Source::Literals.symbol_name(node.arguments&.arguments&.first)
         end
 
+        # Renders a constant-path node as a String, KEEPING the leading `::` of a rooted path —
+        # {#declared_constant_name} reads it as "reset the lexical path" before the marker is dropped.
         def constant_path_name(node)
           return nil if node.nil?