rigortype 0.3.8 → 0.4.0

data/plugins/rigor-active-model-serializers/lib/rigor/plugin/active_model_serializers/serializer_index.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Plugin
+    class ActiveModelSerializers < Rigor::Plugin::Base
+      # The serializer classes {SerializerDiscoverer} found under the configured search paths, keyed by
+      # the class's fully-qualified name as the source spells it (`"REST::AccountSerializer"`).
+      #
+      # Each entry carries the declared superclass (so the discoverer can close the ancestry chain) and
+      # the three name sets that let a candidate model be CHECKED rather than guessed:
+      #
+      # - `declared_names` — the names the serializer will read off the resource at render time: the
+      #   symbols of `attributes` / `attribute` / `has_many` / `has_one` / `belongs_to`, minus the ones
+      #   the serializer defines itself (AMS calls the serializer's own method when it has one, and only
+      #   falls through to `object.<name>` when it does not).
+      # - `object_reads` — every `object.<name>` the body writes, minus the methods every Object has.
+      # - `own_method_names` — the serializer's own instance `def`s, which is both what subtracts from
+      #   `declared_names` and how an explicit `def object` is detected.
+      class SerializerIndex
+        Entry = Data.define(:class_name, :superclass_name, :file_path, :declared_names, :object_reads,
+                            :own_method_names) do
+          # The declarations AMS will render by calling the name on the resource — unless an ancestor of
+          # this serializer defines it, which only the engine's ancestor walk can say, so that half is
+          # left to the caller.
+          def unhandled_declarations = declared_names - own_method_names
+
+          # Reads of the resource itself. Unlike a declaration, one of these is a read of the resource
+          # whatever the serializer or its ancestors define.
+          def resource_reads = object_reads
+
+          def defines_object? = own_method_names.include?("object")
+        end
+
+        attr_reader :entries
+
+        def initialize(entries)
+          @entries = entries.freeze
+          @by_name = entries.to_h { |entry| [entry.class_name, entry] }.freeze
+          freeze
+        end
+
+        def find(class_name) = @by_name[derooted(class_name)]
+        def known?(class_name) = @by_name.key?(derooted(class_name))
+        def empty? = @entries.empty?
+        def size = @entries.size
+        def names = @by_name.keys
+
+        private
+
+        # A query may arrive rooted (`::REST::AccountSerializer`) while entries are keyed by the
+        # de-rooted spelling, the same normalisation `rigor-activerecord`'s ModelIndex settled on in #583.
+        def derooted(class_name) = class_name.to_s.delete_prefix("::")
+      end
+    end
+  end
+end

data/plugins/rigor-active-model-serializers/lib/rigor/plugin/active_model_serializers.rb

@@ -0,0 +1,263 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+require_relative "active_model_serializers/serializer_index"
+require_relative "active_model_serializers/serializer_discoverer"
+
+module Rigor
+  module Plugin
+    # rigor-active-model-serializers — types the implicit-self `object` reader inside a serializer as the
+    # model the serializer serializes.
+    #
+    # It emits no diagnostic. What it contributes is one return type and the gem's own framework
+    # constants, and both exist for the same measurement: the 2026-09-01 corpus opacity sweep (#534
+    # item 6) found `object` to be Mastodon's single largest unresolved implicit-self send — 751 sites in
+    # `app/serializers` alone — with no plugin owning ActiveModelSerializers at all. Every
+    # `object.account.username` chain below one of those sites was dispatching on `Dynamic[top]`.
+    #
+    #     plugins:
+    #       - gem: rigor-active-model-serializers
+    #         config:
+    #           serializer_search_paths: ["app/serializers", "app/lib"]  # default; optional
+    #           serializer_base_classes: ["ActiveModel::Serializer"]     # default; optional
+    #           model_overrides: {}                                      # default; optional
+    #
+    # ## What `object` types to, and when it declines
+    #
+    # AMS's `object` is `ActiveModel::Serializer#object`, the resource the serializer was constructed
+    # with. Nothing in a serializer's source STATES that resource's class — AMS binds it at `new` time —
+    # so the type is only ever derived, and two independent things have to agree before it is:
+    #
+    # 1. The `<Model>Serializer` naming convention resolves to exactly one model `rigor-activerecord`
+    #    discovered (`REST::AccountSerializer` → `Account`), and
+    # 2. that model ANSWERS the serializer: every name the serializer will read off its resource — the
+    #    `attributes` / `has_many` / `has_one` declarations it does not define itself, plus every
+    #    `object.<name>` in its body — is a column, association, enum, alias or scope of that model, or a
+    #    method the project defines on it.
+    #
+    # A `model_overrides` entry short-circuits both: the project asserted the answer. Anything else
+    # DECLINES, and `object` keeps whatever the engine would have given it (`Dynamic`).
+    #
+    # ## Why the name alone is not enough
+    #
+    # The name is a guess and the model index only proves the guessed class EXISTS, never that this
+    # serializer serializes it. Mastodon has three serializers where the guess is wrong and the class is
+    # real: `REST::ConversationSerializer` serializes an `AccountConversation` (its `unread`,
+    # `participant_accounts` and `last_status` are all absent from `Conversation`), and both
+    # `REST::InstanceSerializer` and `REST::V1::InstanceSerializer` serialize an `InstancePresenter`
+    # (`object.contact`, `object.thumbnail`). A corpus diff cannot see the damage, because an Active
+    # Record model's surface is open and a wrong-but-real model absorbs every read in silence — so the
+    # check has to be a positive one, made before the answer is contributed.
+    #
+    # Requiring EVERY name to be answered, rather than most of them, is the same choice: a serializer
+    # whose resource is a decorator around the model shares most of the model's surface, and it is
+    # exactly the one or two extra names that say so.
+    #
+    # ## Scope
+    #
+    # - **SimpleForm inputs are NOT handled.** The sweep's 875-site `object` count mixes AMS serializers
+    #   with `SimpleForm::Inputs::Base#object`, a different gem with a different resource story
+    #   (`object` there is the form's record, named by the `simple_form_for` call site, not by the input
+    #   class). That belongs in a `rigor-simple-form` plugin and is deliberately left out.
+    # - **`serializer:` / `each_serializer:` options are not read.** `has_many :emojis, serializer:
+    #   REST::CustomEmojiSerializer` states which serializer renders an association, never which model a
+    #   serializer serializes, so it cannot ground `object`.
+    # - **A serializer with no declarations and no `object` reads gets no answer.** There is nothing to
+    #   check the name against, and the name alone is what this refuses to trust.
+    class ActiveModelSerializers < Rigor::Plugin::Base
+      manifest(
+        id: "active-model-serializers",
+        target_gems: ["active_model_serializers"],
+        version: "0.1.0",
+        description: "Types the implicit-self `object` reader inside ActiveModel::Serializer subclasses " \
+                     "as the serializer's model, and declares the gem's framework constants.",
+        config_schema: {
+          # `app/lib` is in the default set because a project base serializer routinely lives outside
+          # `app/serializers` — Mastodon's `ActivityPub::Serializer`, the parent of 60 of its 153
+          # serializers, is at `app/lib/activitypub/serializer.rb`. Without it the ancestry closure stops
+          # at the base class and two fifths of the project's serializers are simply not serializers as
+          # far as this plugin is concerned. A directory the project does not have costs one probe.
+          "serializer_search_paths" => { kind: :array, default: ["app/serializers", "app/lib"] },
+          "serializer_base_classes" => { kind: :array, default: ["ActiveModel::Serializer"] },
+          # Serializer class name => model class name, for the resources the derivation cannot reach: a
+          # serializer whose resource is a presenter or a decorator, or one named for a JSON shape rather
+          # than a model. An override is the project's own assertion and is NOT re-checked — a project
+          # that names a class Rigor has no RBS for gets a lenient nominal.
+          "model_overrides" => { kind: :hash, default: {} }
+        },
+        # Optional on purpose: without `rigor-activerecord` there is no model set to check a name
+        # against, and every non-overridden serializer declines. That is the designed degradation — the
+        # plugin contributes less, never something wrong.
+        consumes: [{ plugin_id: "activerecord", name: :model_index, optional: true }],
+        # ADR-25 (#534 item 7, same admission rule as `rigor-activerecord`'s `sig/active_record/
+        # framework.rbs`) — the gem's own constants, declared so they resolve and asserting nothing else.
+        signature_paths: ["sig"],
+        # ADR-26 — every class and module the bundled signature names is open, so that declaring it buys
+        # constant resolution and asserts nothing about a member. `ActiveModel::Serializer` is the row
+        # that matters most (a project's serializers inherit from it, and its whole instance surface —
+        # `object`, `scope`, `read_attribute_for_serialization`, the `_attributes` class state — is
+        # unenumerated), and `ActiveModelSerializers` / `::Adapter` are the ones the canonical
+        # initializer dispatches on: `ActiveModelSerializers.config.adapter = :json_api` and
+        # `ActiveModelSerializers::Adapter.register(...)` are what an AMS `config/initializers` file says.
+        open_receivers: [
+          "ActiveModel::Serializer",
+          "ActiveModel::Serializer::CollectionSerializer",
+          "ActiveModelSerializers",
+          "ActiveModelSerializers::Adapter",
+          "ActiveModelSerializers::Model",
+          "ActiveModelSerializers::SerializableResource"
+        ]
+      )
+
+      producer :serializer_index, watch: -> { [[@serializer_search_paths, "**/*.rb"]] } do |_params|
+        SerializerDiscoverer.new(
+          io_boundary: io_boundary,
+          search_paths: @serializer_search_paths,
+          base_classes: @serializer_base_classes
+        ).discover
+      end
+
+      def init(_services)
+        @serializer_search_paths = Array(config.fetch("serializer_search_paths")).map(&:to_s)
+        @serializer_base_classes = Array(config.fetch("serializer_base_classes")).map(&:to_s)
+        @model_overrides = config.fetch("model_overrides").to_h { |k, v| [k.to_s.delete_prefix("::"), v.to_s] }
+        @derivations = {}
+      end
+
+      # The `methods:` gate keeps this off every dispatch whose name is not `object`; the receiver and
+      # argument checks keep it off `foo.object` and `object(x)`, neither of which is the AMS reader.
+      dynamic_return methods: [:object] do |call_node, scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+        next nil unless call_node.receiver.nil?
+        next nil unless call_node.arguments.nil?
+
+        entry = serializer_entry(scope)
+        next nil if entry.nil?
+        # An explicit `def object`, here or on an ancestor, is the definition that runs. Answering over
+        # it would replace a type the engine derived from real source with a guess, and silence whatever
+        # that source proves.
+        next nil if entry.defines_object? || project_defines_object?(entry.class_name, scope)
+
+        model_name = model_class_name_for(entry, scope)
+        next nil if model_name.nil?
+
+        Rigor::Type::Combinator.nominal_of(model_name)
+      end
+
+      private
+
+      # The discovered serializer whose body `self` is in, or nil. Membership of the index is the only
+      # gate: a `*Serializer` name is not evidence of anything, since `object` is an ordinary method name
+      # that a `Json::ConversationSerializer` or an `Oj::AccountSerializer` may define for itself.
+      def serializer_entry(scope)
+        self_type = scope&.self_type
+        return nil unless self_type.respond_to?(:class_name)
+
+        name = self_type.class_name
+        return nil if name.nil? || name.empty?
+
+        producer_value(:serializer_index)&.find(name)
+      end
+
+      def project_defines_object?(serializer_name, scope)
+        return false unless scope.respond_to?(:user_def_through_ancestors)
+
+        !scope.user_def_through_ancestors(serializer_name, :object).first.nil?
+      end
+
+      # The model a serializer serializes, or nil where nothing corroborates it. Memoised per serializer
+      # class INCLUDING the nil answer: the ancestor walks behind `project_defines?` are run once per
+      # name per serializer, and `object` is read hundreds of times across a real `app/serializers`.
+      def model_class_name_for(entry, scope)
+        return @derivations[entry.class_name] if @derivations.key?(entry.class_name)
+
+        @derivations[entry.class_name] = derive_model_class_name(entry, scope)
+      end
+
+      def derive_model_class_name(entry, scope)
+        override = @model_overrides[entry.class_name]
+        return override unless override.nil? || override.empty?
+
+        # The published `:model_index` fact is a Hash keyed by the model's DE-ROOTED constant path
+        # (#583). `rigor-activerecord` withholds it entirely in reduced mode (no `db/schema.rb` /
+        # `db/structure.sql`), so a schema-less project declines here rather than typing `object` off a
+        # name alone.
+        index = read_fact(plugin_id: "activerecord", name: :model_index)
+        return nil if index.nil? || index.empty?
+
+        resolved = convention_candidates(entry.class_name).select { |candidate| index.key?(candidate) }
+        # Two readings that both name a real model (`Admin::AccountSerializer` where `Admin::Account` and
+        # `Account` both exist) is an ambiguity, not a first-hit: nothing here ranks one above the other.
+        return nil unless resolved.size == 1
+
+        model = resolved.first
+        answers?(entry, index.fetch(model), model, scope) ? model : nil
+      end
+
+      # Whether the model ANSWERS the serializer — see the class comment for why this is required and why
+      # it is required of every name rather than most of them. A serializer that declares nothing and
+      # reads nothing states nothing to check, and is declined for that reason rather than admitted for
+      # it.
+      def answers?(entry, row, model_name, scope)
+        declarations = entry.unhandled_declarations
+        reads = entry.resource_reads
+        return false if declarations.empty? && reads.empty?
+
+        members = model_members(row)
+        # A declaration the serializer itself renders is not a read of the resource at all. The entry
+        # subtracts the serializer's OWN methods; a base serializer's `def formatted` is only visible to
+        # the engine's ancestor walk, and a declaration it handles says nothing about the model.
+        declarations.all? do |name|
+          project_defines?(entry.class_name, name, scope) ||
+            members.include?(name) || project_defines?(model_name, name, scope)
+        end && reads.all? { |name| members.include?(name) || project_defines?(model_name, name, scope) }
+      end
+
+      # Every name the model answers that its `:model_index` row states. The `?` forms are Active
+      # Record's own per-column predicates, which a serializer reads as readily as the column.
+      #
+      # `macro_methods` (#1049) is the row's name-only set: `delegate`'s methods, the Paperclip / Active
+      # Storage attachment readers, and an `enum`'s per-value predicates, from the model body and from every
+      # concern the model includes. It is what lets `REST::AccountSerializer`'s `followers_count` / `user` /
+      # `avatar` reads resolve; an older producer that does not publish the key reads as the empty set here,
+      # which declines exactly as before rather than erroring.
+      def model_members(row)
+        columns = Array(row[:columns]).map(&:to_s)
+        associations = Array(row[:associations]).map { |a| a[:name].to_s }
+        enums = row[:enums].is_a?(Hash) ? row[:enums].keys.map(&:to_s) : []
+        aliases = row[:aliases].is_a?(Hash) ? row[:aliases].keys.map(&:to_s) : []
+        scopes = Array(row[:scopes]).map(&:to_s)
+        macros = Array(row[:macro_methods]).map(&:to_s)
+        (columns + columns.map { |c| "#{c}?" } + associations + enums + aliases + scopes + macros).to_set
+      end
+
+      # A method the project writes in Ruby on `class_name` or an ancestor of it. On the model side that
+      # is `Account#local?` or a concern's reader — the model index cannot see these, and without them
+      # the check would decline nearly every real serializer. On the serializer side it is a base
+      # serializer's own rendering method, which is not a read of the resource at all.
+      def project_defines?(class_name, method_name, scope)
+        return false unless scope.respond_to?(:user_def_through_ancestors)
+
+        !scope.user_def_through_ancestors(class_name, method_name.to_sym).first.nil?
+      end
+
+      # `REST::AccountSerializer` offers two readings — the namespaced `REST::Account` and the
+      # demodulized `Account` — and Rails apps use both (`Admin::AccountSerializer` for `Admin::Account`
+      # is as real as Mastodon's `REST::AccountSerializer` for `Account`). Both are offered to the model
+      # index, and exactly one of them has to land.
+      def convention_candidates(serializer_name)
+        return [] unless serializer_name.end_with?("Serializer")
+        # A class named exactly `Serializer` is a namespace's base serializer, never a model's.
+        return [] if serializer_name.split("::").last == "Serializer"
+
+        stripped = serializer_name.delete_suffix("Serializer").delete_suffix("::")
+        return [] if stripped.empty?
+
+        [stripped, stripped.split("::").last].uniq.reject(&:empty?)
+      end
+    end
+
+    Rigor::Plugin.register(ActiveModelSerializers)
+  end
+end

data/plugins/rigor-active-model-serializers/lib/rigor-active-model-serializers.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# Gem entry point. Required by Rigor's plugin loader when `.rigor.yml` lists
+# `rigor-active-model-serializers` under `plugins:`. The loader expects this `require` to side-effect a
+# call to `Rigor::Plugin.register`, which the body of
+# `lib/rigor/plugin/active_model_serializers.rb` performs at load time.
+require_relative "rigor/plugin/active_model_serializers"

data/plugins/rigor-active-model-serializers/sig/active_model_serializers.rbs

@@ -0,0 +1,45 @@
+# The ActiveModelSerializers gem's own constants — issue #534 item 6.
+#
+# The 2026-09-01 corpus opacity sweep counted `ActiveModel::Serializer` 101 times on Mastodon,
+# `ActiveModelSerializers::Model` 29 and `ActiveModelSerializers::SerializableResource` 25, every
+# one of them resolving to `untyped` because nothing in the bundle named the constant. This file
+# names them, and nothing more.
+#
+# ## The admission rule
+#
+# The same rule `plugins/rigor-activerecord/sig/active_record/framework.rbs` states: declaring a
+# constant makes it RBS-KNOWN, and a known class with an incomplete signature turns every member the
+# signature omits into a false `call.undefined-method`. Every class here is therefore ALSO listed in
+# the manifest's `open_receivers:` (ADR-26), which is what keeps the members this file does not
+# enumerate lenient.
+#
+# That pairing is load-bearing rather than defensive here, because — unlike the Active Record
+# exception hierarchy, which is rescued and not dispatched on — `ActiveModel::Serializer` and
+# `ActiveModelSerializers::Model` are exactly the "class a project INHERITS from" shape the Active
+# Record file declines to declare. `class REST::AccountSerializer < ActiveModel::Serializer` is what
+# an AMS application looks like, and `object`, `scope`, `read_attribute_for_serialization`,
+# `attributes`, `has_many` and the rest of the AMS surface are not enumerated below. The Mastodon
+# before/after diff recorded in `docs/notes/20260917-ams-object-recognizer.md` is the evidence that
+# the pairing holds on a real application.
+#
+# `ActiveModel` is declared as a module by `rigor-activerecord` as well; RBS reopens a module across
+# files, so the two declarations compose rather than collide, and neither plugin depends on the
+# other being enabled.
+
+module ActiveModel
+  class Serializer
+    class CollectionSerializer
+    end
+  end
+end
+
+module ActiveModelSerializers
+  class Model
+  end
+
+  class SerializableResource
+  end
+
+  module Adapter
+  end
+end

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/analyzer.rb

@@ -25,10 +25,6 @@ module Rigor
 
         # The job-call violations for a single call node (0..2), or `[]` when the node is not a
         # `<Job>.perform_*` entry call on a known job. ADR-37: the engine owns the walk.
-        #
-        # @param call_node [Prism::Node]
-        # @param job_index [JobIndex]
-        # @return [Array<Violation>]
         def violations_for(call_node:, job_index:)
           return [] unless call_node.is_a?(Prism::CallNode) && entry_call?(call_node)
 

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/effects.rb

@@ -49,6 +49,7 @@ module Rigor
           "shoryuken" => ["io.net"], "backburner" => ["io.net"], "sucker_punch" => [],
           "async" => [], "inline" => [], "test" => []
         }.freeze
+        Ractor.make_shareable(TRANSPORTS)
 
         # The meaning half, which is adapter-independent and is what a policy actually names.
         MEANING = ["rails.activejob.enqueue", "job.enqueue"].freeze
@@ -61,7 +62,7 @@ module Rigor
 
         module_function
 
-        # @param adapter [String, nil] the adapter the project declares, or nil when it declares none
+        # @param adapter — the adapter the project declares, or nil when it declares none
         #   (or more than one, across environments)
         def attributions(adapter)
           labels = (TRANSPORTS[adapter] || ["io"]) + MEANING

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/job_discoverer.rb

@@ -32,7 +32,6 @@ module Rigor
           @base_classes = base_classes.to_set { |name| strip_root(name.to_s) }
         end
 
-        # @return [JobIndex]
         def discover
           candidates = []
           ruby_files_under(@search_paths).each do |path|

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/job_index.rb

@@ -42,8 +42,6 @@ module Rigor
         # `"::WelcomeJob"`; see {JobDiscoverer}), while a QUERY may legitimately arrive rooted:
         # `::WelcomeJob.perform_later(1)` renders its receiver as `"::WelcomeJob"`. The root marker is
         # dropped here, once, so no caller needs a `find(name) || find("::#{name}")` retry (#621).
-        #
-        # @return [Entry, nil]
         def find(class_name)
           @by_name[strip_leading_namespace(class_name.to_s)]
         end

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/recurring_scan.rb

@@ -51,7 +51,7 @@ module Rigor
           @recurring_paths = recurring_paths
         end
 
-        # @return [Array<String>] the class names named by a `class:` key in a recurring-task entry, sorted
+        # @return the class names named by a `class:` key in a recurring-task entry, sorted
         #   and unique. NOT yet intersected with the discovered jobs — the caller does that.
         def job_names
           names = Set.new

data/plugins/rigor-activejob/lib/rigor/plugin/activejob.rb

@@ -37,6 +37,7 @@ module Rigor
     class Activejob < Rigor::Plugin::Base
       manifest(
         id: "activejob",
+        target_gems: ["activejob"],
         # Bumped — publishes `:reachability_roots` for `rigor unused` (ADR-102 WD3): the jobs Solid Queue's
         # recurring schedule runs by name, which no `perform_later` call site writes down.
         #
@@ -128,12 +129,12 @@ module Rigor
         services.fact_store.publish(plugin_id: manifest.id, name: :reachability_roots, value: roots)
       end
 
-      # File-level only: the load-error emission. Per-call arity validation runs over the engine-owned
+      # File-level only: the load-error disclosure. Per-call arity validation runs over the engine-owned
       # walk via the node_rule below (ADR-37). The job index is lazily loaded + memoised by
       # `producer_value`, shared by both surfaces.
       def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
         index = producer_value(:job_index)
-        return [load_error_diagnostic(path)] if index.nil? && producer_error(:job_index)
+        disclose_load_error if index.nil? && producer_error(:job_index)
 
         []
       end
@@ -147,10 +148,14 @@ module Rigor
 
       private
 
-      def load_error_diagnostic(path)
+      # Issue #1056 — "the job index did not load" is a fact about the run's INPUTS, not about the file being
+      # analysed, so it is registered rather than returned: see {Plugin::Base#disclose_once} for the
+      # channel, the `(plugin id, key)` de-duplication and why the engine positions it at `.rigor.yml:1:1`.
+      # Returned from the per-file hook it carried no once-guard at all and repeated on every file.
+      def disclose_load_error
         error = producer_error(:job_index)
-        Rigor::Analysis::Diagnostic.new(
-          path: path, line: 1, column: 1,
+        disclose_once(
+          :job_index_load_failed,
           message: "rigor-activejob: failed to discover jobs: #{error.class}: #{error.message}",
           severity: :warning,
           rule: "load-error"

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/analyzer.rb

@@ -13,13 +13,15 @@ module Rigor
       # | Method | Recognised arg shape | Validation |
       # | --- | --- | --- |
       # | `Model.find(id)` | any positional | arity check (1+ args) |
+      # | `Model.find { … }` | a block, no args | none (`Enumerable#find`) |
       # | `Model.find_by(col: v, ...)` | keyword args | each key must be a column |
       # | `Model.where(col: v, ...)` | keyword args | each key must be a column |
       # | `Model.where(string)` | String literal | parser-side; not validated |
       #
       # Successful matches surface as `:info` diagnostics naming the resolved table; unknown columns
       # surface as `:error`. Calls whose receiver is not a model in the index, and calls with
-      # non-keyword arguments to `where` / `find_by`, stay silent.
+      # non-keyword arguments to `where` / `find_by`, stay silent. A model's own `self.find` owns its arity,
+      # so the arity check and the notes for the forms the return-type tier leaves to it stay silent too.
       class Analyzer
         # Methods that take a column → value Hash and need each key validated against the receiver's
         # column set. The bang variants (`find_by!` raises instead of returning nil; `find_or_create_by!`
@@ -35,9 +37,13 @@ module Rigor
 
         attr_reader :diagnostics
 
-        def initialize(path:, model_index:)
+        # `scope` is the file's entry scope, which carries the project's discovered methods; it answers
+        # whether a model defines its own `self.find`. An editor run seeds none, so there the check misses
+        # even a same-file `self.find` the typer sees (#1329).
+        def initialize(path:, model_index:, scope:)
           @path = path
           @model_index = model_index
+          @scope = scope
           @diagnostics = []
         end
 
@@ -69,16 +75,42 @@ module Rigor
           end
         end
 
+        # A block turns `find` into `Enumerable#find` over `all` (see `Activerecord#block_find_return_type`),
+        # which takes no id, so the zero-argument check applies only to the block-less id lookup.
+        #
+        # The arity check and the notes describe Rails' `find`. A model's own `self.find` has its own arity,
+        # and the return-type tier (`Activerecord#finder_return_type`) leaves the multi-id and block forms to
+        # it, so a note there would claim a type the call does not get. One id still types as the model.
         def validate_find(node, entry)
+          return validate_block_find(node, entry) if node.block
+
           arity = call_argument_count(node)
           if arity.zero?
+            return if own_find?(entry)
+
             push_error(node, "wrong-arity",
                        "`#{entry.class_name}.find` expects at least 1 argument, got 0")
             return
           end
+          return if arity >= 2 && own_find?(entry)
 
+          returned = arity >= 2 ? "Array[#{entry.class_name}]" : entry.class_name
           push_info(node, "model-call",
-                    "`#{entry.class_name}.find` returns #{entry.class_name} (table: `#{entry.table_name}`)")
+                    "`#{entry.class_name}.find` returns #{returned} (table: `#{entry.table_name}`)")
+        end
+
+        def validate_block_find(node, entry)
+          return unless call_argument_count(node).zero?
+          return if own_find?(entry)
+
+          push_info(node, "model-call",
+                    "`#{entry.class_name}.find` returns #{entry.class_name} | nil (table: `#{entry.table_name}`)")
+        end
+
+        # The predicate `Activerecord#finder_return_type` declines on, so the note and the type agree in a
+        # CLI run. In an editor run this scope lacks the file's own methods (#1329).
+        def own_find?(entry)
+          @scope.discovered_method_through_ancestors?(entry.class_name, :find, :singleton)
         end
 
         def validate_column_hash_call(node, entry)