rigortype 0.3.8 → 0.4.0

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/effects.rb

@@ -38,32 +38,55 @@ module Rigor
 
         READ = ["io.db.read"].freeze
         WRITE = ["io.db.write"].freeze
+        READ_WRITE = ["io.db.read", "io.db.write"].freeze
         TRANSACTION = ["io.db.transaction"].freeze
         SCHEMA_WRITE = ["io.db.write", "rails.schema.write"].freeze
 
         # Class-side finders. Every one issues a `SELECT` the moment it is called — that is what separates
-        # them from `where`, which returns a relation and issues nothing.
+        # them from `where`, which returns a relation and issues nothing. An `async_*` calculation schedules
+        # it on the async executor, or runs it at once when there is none. `first_or_initialize` is
+        # `first || new`, and `extract_associated` loads the association it preloads.
         SINGLETON_READS = %w[
           find find_by find_by! first first! last last! take take! sole find_sole_by
-          second third fourth fifth forty_two second_to_last third_to_last
+          second second! third third! fourth fourth! fifth fifth! forty_two forty_two!
+          second_to_last second_to_last! third_to_last third_to_last!
           exists? any? none? one? many? empty? count sum average minimum maximum calculate
           pluck pick ids find_each find_in_batches in_batches find_by_sql count_by_sql
-          find_or_initialize_by
+          find_or_initialize_by first_or_initialize extract_associated
+          async_ids async_count async_average async_minimum async_maximum async_sum async_pluck async_pick
         ].freeze
 
-        # Class-side writers.
+        # Class-side writers that issue their statement and query nothing of their own: `create` is
+        # `new(…).save`, the bulk writers compile one `INSERT`, and the counter writers are an `update_all` on
+        # `unscoped`, which cannot eager-load.
         SINGLETON_WRITES = %w[
           create create! insert insert! insert_all insert_all! upsert upsert_all
-          update update! update_all delete delete_all delete_by destroy destroy_all destroy_by
-          find_or_create_by find_or_create_by! create_or_find_by create_or_find_by! touch_all
+          update_counters increment_counter decrement_counter
+        ].freeze
+
+        # Class-side writers that query as well, checked against activerecord 8.1.3.1. Most are in
+        # `Querying::QUERYING_METHODS`, which Rails delegates to `all`, so each is the Relation method of the
+        # same name and the row carries the read that `relation.rbs` gives it: a lookup before the write, a
+        # `find_by!` after a failed insert, the records `destroy_all` loads, or the `SELECT` of distinct
+        # primary keys an eager-loading, limited scope runs before its UPDATE / DELETE. `all` adds the default
+        # scope, which can eager-load. `delete` is `where(id:).delete_all`, and `destroy` calls `find`. Three
+        # are not delegated and read on their own: `update(!)` calls `find` or walks `all.each`, and
+        # `reset_counters` counts the association before it writes the column.
+        SINGLETON_READ_WRITES = %w[
+          update update! update_all delete delete_all delete_by destroy destroy_all destroy_by touch_all
+          find_or_create_by find_or_create_by! create_or_find_by create_or_find_by!
+          first_or_create first_or_create! reset_counters
         ].freeze
 
         # Instance-side readers. `reload` re-issues the `SELECT` and replaces the record's attributes,
         # which is a receiver mutation as well as a read.
         INSTANCE_READS = %w[valid? invalid? reload].freeze
 
-        # Instance-side writers. Each is a statement issued now; `save`'s callbacks and validators are the
-        # `effect_edges:` half, and arrive as edges rather than labels.
+        # Instance-side writers. Each is a statement issued now, and none queries on its own: `update` is
+        # `assign_attributes` plus `save`, and `increment!` / `update_columns` compile one UPDATE. What `save`
+        # or `destroy` reads beyond that comes from the model's callbacks and validators. The callback edge
+        # carries the ones it reads: symbol-argument callback macros and a uniqueness validator. Nothing
+        # carries the reads a required `belongs_to`, a `touch:` option or a `dependent:` option registers.
         INSTANCE_WRITES = %w[
           save save! update update! update_attribute update_attributes update_attributes!
           update_column update_columns destroy destroy! delete touch increment! decrement!
@@ -80,6 +103,26 @@ module Rigor
           all? any? none? one? include? member? first count sum
         ].freeze
 
+        # The writers an association's `CollectionProxy` defines, plus its `delete` / `destroy`, which
+        # override a plain Relation's own `delete(id_or_array)` / `destroy(id)`. Those are
+        # `where(id:).delete_all` and `find(id).destroy`, both inside this row's labels. Each adds records
+        # to the association's in-memory target or removes them from it. Depending on whether the owner is
+        # saved and on the association's `dependent:` option, it may also read, write, and open a
+        # transaction, so the row names all three rather than the parent `io.db`, which
+        # `--label io.db.write` would not match.
+        #
+        # The mutation is spelt from the call site, as every row here is, and bare `mutate` is the label
+        # for a receiver that is not the caller's `self`: the proxy is an object the caller holds, like the
+        # session in rigor-actionpack's `SESSION_WRITE`. The RBS envelopes on `build` / `reset` are written
+        # from the callee's side instead, and say `mutate.self`.
+        #
+        # A saved owner's `<<` saves the record, which runs the model's `before_save` / `after_commit`
+        # callbacks. No edge carries those to the caller, which is the same gap `Relation#create` has: the
+        # call site's receiver is `Relation[Post]`, and the edge that would reach `Post#save` needs the type
+        # argument, which the collector does not record (#1313).
+        PROXY_WRITERS = %w[<< push append concat replace delete destroy clear].freeze
+        PROXY_WRITE = ["io.db.read", "io.db.write", "io.db.transaction", "mutate"].freeze
+
         # Raw SQL, narrowed by the statement's own leading verb ({Rigor::Effects::Narrowing} `sql_verb`).
         ADAPTER_SQL = %w[execute exec_query exec_insert exec_update exec_delete select_all select_one
                          select_value select_values select_rows query query_value query_values].freeze
@@ -103,6 +146,12 @@ module Rigor
         # Ambient AR calls that are neither a read nor a write of rows.
         TRANSACTIONAL = %w[transaction with_lock lock!].freeze
 
+        # The instance-side locks re-read the row: `lock!` is `reload(lock:)`, a `SELECT … FOR UPDATE`, and
+        # `with_lock` runs it inside a transaction. `lock!` opens no transaction of its own, so on it the
+        # transaction label names the one whose end releases the lock, and over-states a `lock!` outside one.
+        INSTANCE_LOCKS = %w[with_lock lock!].freeze
+        LOCK = ["io.db.read", "io.db.transaction"].freeze
+
         module_function
 
         def attributions
@@ -114,7 +163,11 @@ module Rigor
                                             why: "issues the SELECT at the call — this is the materializing " \
                                                  "half of the builder/materializer split") +
             rows(BASE, SINGLETON_WRITES, WRITE, singleton: true,
-                                                why: "issues an INSERT / UPDATE / DELETE at the call") +
+                                                why: "issues an INSERT at the call and queries nothing first") +
+            rows(BASE, SINGLETON_READ_WRITES, READ_WRITE,
+                 singleton: true,
+                 why: "issues an UPDATE / DELETE / INSERT at the call, and a SELECT before it or after " \
+                      "a failed insert") +
             rows(BASE, TRANSACTIONAL, TRANSACTION, singleton: true,
                                                    why: "opens a transaction; the block's own origins join " \
                                                         "by containment, so the row states only the BEGIN")
@@ -125,14 +178,21 @@ module Rigor
                why: "re-reads the row (`reload`) or runs the validators, whose uniqueness checks query") +
             rows(BASE, INSTANCE_WRITES, WRITE,
                  why: "persists the record — the write a `db: none` envelope is written to catch") +
-            rows(BASE, TRANSACTIONAL, TRANSACTION,
-                 why: "opens a transaction / takes a row lock around the block")
+            rows(BASE, TRANSACTIONAL - INSTANCE_LOCKS, TRANSACTION, why: "opens a transaction around the block") +
+            rows(BASE, INSTANCE_LOCKS, LOCK,
+                 why: "re-reads the row with `SELECT … FOR UPDATE`; `with_lock` does it inside a transaction")
         end
 
         def relation_rows
           rows(RELATION, RELATION_MATERIALIZERS, READ,
                why: "an Enumerable delegation on a Relation: it calls `each`, which runs the query. Not " \
-                    "declared in the bundled RBS because declaring it would change how it types")
+                    "declared in the bundled RBS because declaring it would change how it types") +
+            rows(RELATION, PROXY_WRITERS, PROXY_WRITE,
+                 why: "a CollectionProxy writer: it changes the association's target and, for a saved " \
+                      "owner, the rows behind it. Keyed on Relation because that is the type the plugin " \
+                      "gives an association reader. A plain Relation either has no such method or, through " \
+                      "its own `delete` / `destroy`, deletes by id or finds and destroys, which stays inside " \
+                      "the bound. The model's save callbacks are not edged")
         end
 
         # Two rows per selector, because raw SQL is written two ways and only one of them names a type.

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/model_discoverer.rb

@@ -77,9 +77,8 @@ module Rigor
       #   `ApplicationRecord`) setting `self.table_name_prefix` for every model under it — both already
       #   guess wrong identically on unpatched code.
       class ModelDiscoverer
-        # @param io_boundary [Rigor::Plugin::IoBoundary]
-        # @param search_paths [Array<String>] absolute or project-relative paths.
-        # @param base_classes [Array<String>] superclass names that identify a class as an AR model.
+        # @param search_paths — absolute or project-relative paths.
+        # @param base_classes — superclass names that identify a class as an AR model.
         # Declaration macros whose column's runtime value is a rich object, not the SQL scalar. Their column
         # must NOT be narrowed to the schema type (see {ModelIndex.build}'s type-override remap).
         TYPE_OVERRIDE_METHODS = %i[serialize mount_uploader mount_uploaders].freeze
@@ -109,11 +108,23 @@ module Rigor
           # name — {#resolve_table_name_decorator} keeps walking outward past it, exactly like Rails' own
           # `respond_to?(:table_name_prefix)` ancestor search.
           @namespace_table_name_decorators = {}
+          # `concern module name => { scopes:, associations:, macro_methods: }` — what a module contributes
+          # to every class that includes it (#534 item 5, #1049). Unlike {@type_override_columns} these are
+          # NOT global: a declaration reaches a model only along a real `include` edge ({@include_edges}),
+          # so a same-named `scope` / association / `delegate` in a concern the model does not include
+          # contributes nothing.
+          @concern_declarations = {}
+          # `constant name => [raw included module name]` — every `include Foo` / `include Foo::Bar` a class
+          # or module body spells, as written. Resolution against the walked module set happens after the
+          # whole tree is read ({#resolve_concern_name}), because the including file may be walked first.
+          @include_edges = {}
+          # Every module declaration walked, for resolving an `include`'s relative constant spelling.
+          @module_names = Set.new
         end
 
         attr_reader :type_override_columns
 
-        # @return [Array<Hash>] rows of { class_name:, table_name_override:, sti_parent:, ... }
+        # @return rows of { class_name:, table_name_override:, sti_parent:, ... }
         def discover
           candidates = []
           ruby_files_under(@search_paths).each do |path|
@@ -128,7 +139,8 @@ module Rigor
           # Every file is walked (and every module's `table_name_prefix` / `table_name_suffix` recorded)
           # before any row is resolved — a model's file may sort, and so be visited, before the file that
           # declares its enclosing module's decorator.
-          attach_table_name_decorators(resolve_models(candidates), superclass_map: superclass_map)
+          rows = fold_concern_declarations(resolve_models(candidates), superclass_map: superclass_map)
+          attach_table_name_decorators(rows, superclass_map: superclass_map)
         end
 
         private
@@ -218,7 +230,8 @@ module Rigor
             scopes: (Array(base[:scopes]) + Array(addition[:scopes])).uniq,
             validations: (Array(base[:validations]) + Array(addition[:validations])).uniq,
             callbacks: (Array(base[:callbacks]) + Array(addition[:callbacks])).uniq,
-            aliases: (base[:aliases] || {}).merge(addition[:aliases] || {})
+            aliases: (base[:aliases] || {}).merge(addition[:aliases] || {}),
+            macro_methods: (Array(base[:macro_methods]) + Array(addition[:macro_methods])).uniq
           )
         end
 
@@ -424,6 +437,7 @@ module Rigor
           superclass = strip_root(constant_path_name(node.superclass)) if node.superclass
 
           collect_type_overrides(node.body)
+          record_include_edges(full_name, node.body)
           # Rails' `full_table_name_prefix` walks `module_parents.detect { respond_to?(:table_name_prefix) }`
           # — lexical nesting, which does not care whether the namespace container was written `module Blog`
           # or `class Blog`. A `class` used purely as a namespace holder (or a model class that happens to
@@ -441,7 +455,8 @@ module Rigor
             scopes: lookup_scopes(node.body),
             validations: lookup_validations(node.body),
             callbacks: lookup_callbacks(node.body),
-            aliases: lookup_aliases(node.body)
+            aliases: lookup_aliases(node.body),
+            macro_methods: lookup_macro_methods(node.body)
           })
 
           # Recurse into the body in case nested classes exist.
@@ -458,6 +473,9 @@ module Rigor
 
           full_name = declared_constant_name(module_local_name, lexical_path)
           record_table_name_decorators(full_name, node.body, is_class: false)
+          @module_names << full_name
+          record_concern_declarations(full_name, node.body)
+          record_include_edges(full_name, node.body)
 
           inner_path = [full_name]
           walk_for_classes(node.body, inner_path, &) if node.body
@@ -520,6 +538,177 @@ module Rigor
           type_arg.is_a?(Prism::ConstantReadNode) || type_arg.is_a?(Prism::ConstantPathNode)
         end
 
+        # Records what a concern module contributes to every class that includes it (#534 item 5, #1049;
+        # mastodon's `scope :without_suspended` in `Account::Suspensions`, `has_one :account_stat` and
+        # `delegate :statuses_count, …, to: :account_stat` in `Account::Counters`).
+        # ActiveSupport::Concern evaluates an `included do … end` block against the INCLUDING class, so
+        # whatever it declares is declared on every model that includes the module — and on no other model,
+        # which is why these are kept per-module here rather than globally the way {#collect_type_overrides}
+        # keeps column names.
+        #
+        # Concern-hood is recognised the way {#type_override_declaration_calls} already recognises it: by the
+        # `included do … end` block itself, not by an `extend ActiveSupport::Concern` line.
+        #
+        # The module's OWN top-level body contributes too, but only `delegate`: `delegate` is
+        # `Module#delegate`, so at a module's top level it defines ordinary INSTANCE methods on the module,
+        # which the including class then inherits through its ancestry — exactly the shape
+        # `Account::Counters` uses. A top-level `scope` / `has_one` / `has_attached_file` is by contrast a
+        # plain send to the module object (a runtime `NoMethodError`), never a class-level declaration on any
+        # model, so those are read from `included do … end` only.
+        def record_concern_declarations(module_name, body)
+          found = concern_declarations(body)
+          return if found.each_value.all?(&:empty?)
+
+          record = (@concern_declarations[module_name] ||= { scopes: [], associations: [], macro_methods: [] })
+          found.each { |key, values| record[key].concat(values) }
+        end
+
+        def concern_declarations(body)
+          record = { scopes: [], associations: [], macro_methods: [] }
+          return record if body.nil?
+
+          body.compact_child_nodes.each do |node|
+            next unless node.is_a?(Prism::CallNode) && node.receiver.nil?
+
+            if node.name == :included && node.block.is_a?(Prism::BlockNode)
+              block_body = node.block.body
+              record[:scopes].concat(lookup_scopes(block_body))
+              record[:associations].concat(lookup_associations(block_body))
+              record[:macro_methods].concat(lookup_macro_methods(block_body))
+            elsif node.name == :delegate
+              record[:macro_methods].concat(delegate_method_names(node))
+            end
+          end
+          record
+        end
+
+        # Records every `include Foo` / `include Foo::Bar` a class or module body spells, AS WRITTEN — the
+        # constant is resolved only once the whole tree has been walked ({#resolve_concern_name}), because the
+        # concern's file may well sort after the file that includes it. An `include` inside a concern's own
+        # `included do … end` block counts too: that block runs against the including class, so the module
+        # lands on the model exactly as a body-level `include` does. A non-constant argument
+        # (`include build_module`) renders as nil and declines.
+        def record_include_edges(constant_name, body)
+          names = include_call_targets(body)
+          return if names.empty?
+
+          (@include_edges[constant_name] ||= []).concat(names)
+        end
+
+        def include_call_targets(body)
+          return [] if body.nil?
+
+          body.compact_child_nodes.flat_map do |node|
+            next [] unless node.is_a?(Prism::CallNode) && node.receiver.nil?
+
+            if node.name == :included && node.block.is_a?(Prism::BlockNode)
+              include_call_targets(node.block.body)
+            elsif node.name == :include
+              Array(node.arguments&.arguments).filter_map { |arg| constant_path_name(arg) }
+            else
+              []
+            end
+          end
+        end
+
+        # Adds each model's concern-declared scopes, associations and macro methods to the ones its own body
+        # declares. Attribution is by real `include` edge: a concern nobody includes contributes nothing, and
+        # a same-named `scope` / `has_one` / `delegate` in an unrelated concern does not leak onto this model.
+        # A concern that includes another concern is followed transitively (Ruby's own semantics — the inner
+        # module ends up in the model's ancestry either way).
+        #
+        # The model's SUPERCLASS chain is walked too, because a concern is routinely included once in
+        # `ApplicationRecord` for every model to get. The chain is walked here rather than left to
+        # {ModelIndex.sti_chain}, which only links a model to another MODEL: a configured base class is not a
+        # discovered model, so `class Account < ApplicationRecord` has no `sti_parent` and the index's chain
+        # stops at `Account`. (A `scope` written directly in the base class's own body is still not
+        # propagated — that pre-existing gap is a different mechanism and is documented, not widened here.)
+        #
+        # The model's OWN association rows are kept LAST so {#dedup_named_rows}'s last-wins rule lets a class
+        # body redeclaration override the concern's, which is what Ruby does: the class's own
+        # `has_one :user, class_name: "…"` beats the one the included module installed.
+        def fold_concern_declarations(rows, superclass_map: {})
+          return rows if @concern_declarations.empty?
+
+          rows.map do |row|
+            inherited = ancestry_concern_declarations(row.fetch(:class_name), superclass_map)
+            next row if inherited.each_value.all?(&:empty?)
+
+            row.merge(
+              scopes: (Array(row[:scopes]) + inherited[:scopes]).uniq.freeze,
+              associations: dedup_named_rows(inherited[:associations] + Array(row[:associations])),
+              macro_methods: (Array(row[:macro_methods]) + inherited[:macro_methods]).uniq.freeze
+            )
+          end
+        end
+
+        # The concern declarations reaching `class_name` through its own includes and those of every
+        # superclass up the chain (`visited` stops a cycle a malformed source could spell).
+        def ancestry_concern_declarations(class_name, superclass_map)
+          found = { scopes: [], associations: [], macro_methods: [] }
+          curr = class_name
+          visited = Set.new
+
+          while curr && visited.add?(curr)
+            concern_declarations_for(curr).each { |key, values| found[key].concat(values) }
+            curr = superclass_map[curr]
+          end
+
+          found[:scopes].uniq!
+          found[:macro_methods].uniq!
+          found
+        end
+
+        # Breadth-first over the `include` edges reachable from `class_name`, unioning each visited concern's
+        # declarations. `visited` makes a mutually-including pair of concerns terminate rather than loop.
+        def concern_declarations_for(class_name)
+          found = { scopes: [], associations: [], macro_methods: [] }
+          queue = Array(@include_edges[class_name]).map { |raw| [raw, class_name] }
+          visited = Set.new([class_name])
+
+          until queue.empty?
+            raw, from_name = queue.shift
+            resolved = resolve_concern_name(raw, from_name)
+            next if visited.include?(resolved)
+
+            visited << resolved
+            (@concern_declarations[resolved] || {}).each { |key, values| found[key].concat(values) }
+            queue.concat(Array(@include_edges[resolved]).map { |inner| [inner, resolved] })
+          end
+
+          found
+        end
+
+        # Resolves an `include`'s constant spelling against the modules actually walked, mirroring Ruby's
+        # lexical lookup closely enough for the shapes concerns use: a rooted name (`include ::Suspendable`)
+        # names the top-level constant, a relative one is tried under the including constant and each of its
+        # enclosing namespaces first (`include Suspensions` inside `class Account` → `Account::Suspensions`,
+        # which is what Ruby resolves), and otherwise it is taken as written. A name no walked module answers
+        # to simply contributes nothing.
+        #
+        # Two known imprecisions, both cheap only to state:
+        #
+        # - The enclosing-namespace attempts are made for a COMPACT declaration too (`module A::B`'s own
+        #   `include C` tries `A::B::C` then `A::C`), where Ruby's cref would only see `A::B` and the top
+        #   level. Harmless: the extra candidates must match a module that was actually walked, and a
+        #   project with both `A::B::C` and a top-level `C` concern would have to want the latter.
+        # - The final bare-name fall-back attributes BY SPELLING. A nearer constant declared outside
+        #   `model_search_paths` — `Account::Suspensions` in `lib/`, say, while the concern roots hold a
+        #   top-level `Suspensions` — is invisible to this walker, so the wrong one can win. Reading
+        #   further than the model roots needs its own cache descriptor (see {#discover}'s `watch:` note),
+        #   so the spelling is trusted instead.
+        def resolve_concern_name(raw, from_name)
+          name = strip_root(raw)
+          return name if raw.start_with?("::")
+
+          ([from_name] + namespace_ancestors(from_name)).each do |prefix|
+            candidate = "#{prefix}::#{name}"
+            return candidate if @module_names.include?(candidate)
+          end
+
+          name
+        end
+
         # Renders a constant-path node (`Admin::User`, `::ApplicationRecord`) as a String, keeping the
         # leading `::` of a rooted path — {#declared_constant_name} reads it as "reset the lexical path"
         # before the marker is dropped. Returns nil for shapes the discoverer chooses not to handle.
@@ -1334,6 +1523,193 @@ module Rigor
           aliases.freeze
         end
 
+        # The attachment macros whose reader names are folded, mapped to the reader SUFFIXES each one
+        # installs beside the bare accessor (#1049).
+        #
+        # Each key is the macro name of exactly one gem, and none of the three is a name another common
+        # library claims — `has_attached_file` is Paperclip's, `has_one_attached` / `has_many_attached` are
+        # Active Storage's — so the macro's presence in a model body IS the evidence that the project uses
+        # that gem. No lockfile probe is needed (and none would be sound for a vendored or path-sourced
+        # gem); a project that spells none of the three gets nothing folded.
+        #
+        # PAPERCLIP's set is deliberately minimal: `has_attached_file :file` installs `file`, `file=` and
+        # `file?`, and those are the names #1049's serializer table needs. The `file_file_name` /
+        # `file_content_type` / `file_file_size` / `file_updated_at` quartet is NOT listed because Paperclip
+        # backs it with four real schema columns, which the index already carries from `db/schema.rb`;
+        # synthesising them here would claim them on a model whose table lacks them.
+        #
+        # ACTIVE STORAGE's set is `avatar`, `avatar=`, `avatar_attachment`, `avatar_blob` for the singular
+        # macro and `images`, `images=`, `images_attachments`, `images_blobs` for the collection one — the
+        # `has_one_attached` / `has_many_attached` generated-methods surface, none of it column-backed.
+        # This is name MEMBERSHIP only, and does not overlap `rigor-activestorage`, which contributes the
+        # accessor's TYPE (`ActiveStorage::Attached::One`) and publishes no fact: a consumer that reads
+        # `:model_index` to ask "does this model answer `avatar`?" gets nothing from that plugin, and gets
+        # nothing at all when the project does not load it.
+        ATTACHMENT_MACROS = {
+          has_attached_file: ["", "=", "?"],
+          has_one_attached: ["", "=", "_attachment", "_blob"],
+          has_many_attached: ["", "=", "_attachments", "_blobs"]
+        }.freeze
+        Ractor.make_shareable(ATTACHMENT_MACROS)
+        private_constant :ATTACHMENT_MACROS
+
+        # Instance-method names a declaration macro installs that neither the schema nor the association /
+        # alias / scope lists already carry (#1049): `delegate`'s method names, the attachment macros'
+        # readers, and an `enum`'s per-value predicates. Names ONLY — what a delegate target returns is a
+        # separate question no consumer asks today.
+        #
+        # Every name here is spelled out by the declaration itself. A shape this walker cannot read off the
+        # source (a non-literal `prefix:`, a `to:` that is not a Symbol when `prefix: true` needs its
+        # spelling, a computed enum value list) contributes NOTHING rather than a guess: a consumer that
+        # fails closed on an unanswered name loses precision when a name is missing, but is answered WRONG
+        # when a name is invented.
+        def lookup_macro_methods(body)
+          return [] if body.nil?
+
+          names = []
+          declaration_calls(body).each do |node|
+            next if node.receiver
+
+            if node.name == :delegate
+              names.concat(delegate_method_names(node))
+            elsif ATTACHMENT_MACROS.key?(node.name)
+              names.concat(attachment_method_names(node))
+            elsif node.name == :enum
+              names.concat(enum_predicate_names(node))
+            end
+          end
+          names.uniq.freeze
+        end
+
+        # `delegate :a, :b, to: :x` → `["a", "b"]`; `prefix: true` prepends the `to:` target's own spelling
+        # (`delegate :can?, to: :user, prefix: true` → `"user_can?"`), and `prefix: :admin` prepends the
+        # given one. ActiveSupport builds the name by plain concatenation, so a `?` / `!` / `=` suffix rides
+        # along untouched.
+        #
+        # `allow_nil:` does not enter into it — it changes what the method RETURNS, never what it is called.
+        # `prefix: true` with a `to:` this walker cannot render as a name declines the whole call.
+        def delegate_method_names(node)
+          args = node.arguments&.arguments
+          return [] if args.nil? || args.empty?
+
+          names = args.filter_map { |arg| Rigor::Source::Literals.symbol_name(arg) }
+          return [] if names.empty?
+
+          prefix = delegate_prefix(args)
+          return [] if prefix == :unfoldable
+
+          names.map { |name| "#{prefix}#{name}" }
+        end
+
+        # The `"user_"`-style prefix a `delegate` call's `prefix:` option establishes: `""` when the option
+        # is absent or false, `:unfoldable` when it is present in a shape this walker cannot read.
+        def delegate_prefix(args)
+          value = keyword_option(args, "prefix")
+          # `prefix: nil` is what ActiveSupport's own default is, and it reads as "no prefix" there, not as
+          # an option the call spelled unreadably.
+          return "" if value.nil? || value.is_a?(Prism::FalseNode) || value.is_a?(Prism::NilNode)
+
+          return delegate_target_prefix(args) if value.is_a?(Prism::TrueNode)
+
+          literal = name_literal(value)
+          return :unfoldable if literal.nil? || literal.empty?
+
+          "#{literal}_"
+        end
+
+        # `prefix: true` names the prefix after the `to:` target, so the target has to render as a name.
+        # An instance-variable target (`to: :@user`, the spelling ActiveSupport accepts for delegating to an
+        # ivar) does NOT: Rails strips the `@` when it builds the method name, and reading it as written
+        # would invent `@user_email`.
+        def delegate_target_prefix(args)
+          name = name_literal(keyword_option(args, "to"))
+          return :unfoldable if name.nil? || name.empty? || name.start_with?("@")
+
+          "#{name}_"
+        end
+
+        # A Symbol or String literal rendered as a plain name, or nil for anything else. Rails accepts both
+        # spellings wherever it takes a method or prefix name.
+        def name_literal(node)
+          Rigor::Source::Literals.symbol_name(node) || (node.is_a?(Prism::StringNode) ? node.unescaped : nil)
+        end
+
+        # `has_attached_file :file` / `has_one_attached :avatar` / `has_many_attached :images` → the reader
+        # names {ATTACHMENT_MACROS} lists for that macro. A non-Symbol-literal name declines.
+        def attachment_method_names(node)
+          name = Rigor::Source::Literals.symbol_name(node.arguments&.arguments&.first)
+          return [] if name.nil? || name.empty?
+
+          ATTACHMENT_MACROS.fetch(node.name).map { |suffix| "#{name}#{suffix}" }
+        end
+
+        # An `enum`'s per-value predicates — `enum :visibility, { … limited: 4 }, suffix: :visibility` →
+        # `"limited_visibility?"` (mastodon's `Status::Visibility`). Rails composes the name as
+        # `"#{prefix}#{value}#{suffix}"`, where `prefix: true` / `suffix: true` use the enum's own column
+        # name and a Symbol / String uses that spelling; Rails 6's `_prefix:` / `_suffix:` keywords are read
+        # as the same option.
+        #
+        # Only the `?` predicate is folded. The bang (`limited_visibility!`) writes to the database and the
+        # same-named class-side scope is not an instance method at all; neither is a name a consumer of this
+        # fact asks about, and both would be invention beyond what the table needs.
+        #
+        # The enum's COLUMN and value list are deliberately not folded into the row's `enums:` from here —
+        # see {#concern_declarations}. This method contributes names, which every consumer of the fact
+        # WIDENS a known-name set with; `enums:` drives `Analyzer#validate_enum_value`, which FIRES.
+        #
+        # `instance_methods: false` (Rails 7.1+) declines the whole call: that option is how a model asks
+        # Rails NOT to define the per-value predicates, so folding them would claim methods the application
+        # does not have — the one way this family could answer a fail-closed consumer wrongly rather than
+        # just incompletely. A non-literal value for the option declines for the same reason.
+        def enum_predicate_names(node)
+          row = parse_enum_call(node)
+          return [] if row.nil? || row[:values].empty?
+
+          args = node.arguments&.arguments || []
+          instance_methods = keyword_option(args, "instance_methods")
+          return [] unless instance_methods.nil? || instance_methods.is_a?(Prism::TrueNode)
+
+          prefix = enum_affix(args, %w[prefix _prefix], row[:column]) { |literal| "#{literal}_" }
+          suffix = enum_affix(args, %w[suffix _suffix], row[:column]) { |literal| "_#{literal}" }
+          return [] if prefix == :unfoldable || suffix == :unfoldable
+
+          row[:values].map { |value| "#{prefix}#{value}#{suffix}?" }
+        end
+
+        # The rendered `prefix:` / `suffix:` affix of an `enum` call, `""` when the option is absent or
+        # false and `:unfoldable` when it is present in a shape this walker cannot read.
+        def enum_affix(args, keys, column_name)
+          value = keys.filter_map { |key| keyword_option(args, key) }.first
+          return "" if value.nil? || value.is_a?(Prism::FalseNode)
+          return yield(column_name) if value.is_a?(Prism::TrueNode)
+
+          literal = name_literal(value)
+          return :unfoldable if literal.nil? || literal.empty?
+
+          yield(literal)
+        end
+
+        # The VALUE node of a keyword argument, across every keyword hash in the call's argument list, or
+        # nil when the call does not spell that key. Unlike {#association_option} this hands back the node
+        # rather than a Boolean, because the callers need Symbol and String values too.
+        #
+        # A BRACED hash argument (`enum :visibility, { limited: 4 }, suffix: :visibility`) is a
+        # `Prism::HashNode` and is deliberately not scanned: there the braces hold the enum's own value map,
+        # and an enum value spelled `prefix:` would otherwise read as the call's `prefix:` option. Rails 6's
+        # `enum status: { … }, _prefix: true` puts both in ONE `KeywordHashNode`, which is scanned.
+        def keyword_option(args, key)
+          args.each do |arg|
+            next unless arg.is_a?(Prism::KeywordHashNode)
+
+            arg.elements.each do |pair|
+              next unless pair.is_a?(Prism::AssocNode) && Source::Literals.symbol_named?(pair.key, key)
+
+              return pair.value
+            end
+          end
+          nil
+        end
+
         # Collects every Symbol-literal positional argument from a CallNode. Used by both
         # `lookup_validations` and `lookup_callbacks` to extract the attribute / method name list.
         def symbol_args(node)

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/model_index.rb

@@ -15,7 +15,7 @@ module Rigor
       # Phase 2's schema is OPTIONAL. A project that ships raw migrations only — the DB-agnostic Rails
       # pattern, where `db/schema.rb` is gitignored (Redmine) — has no schema to combine, and `schema_table:
       # nil` then yields the REDUCED index: every {Entry} carries its resolved table name, associations,
-      # enums, scopes, validations, callbacks and aliases, and an EMPTY column set. Only the column-keyed
+      # enums, scopes, validations, callbacks, aliases and macro methods, and an EMPTY column set. Only the column-keyed
       # surface stands down; the schema was never an input to any of the rest. {#columns_known?} tells the
       # two modes apart — an empty column set means "the schema is unknown", not "this model has no
       # columns", and consumers that would fire on an unrecognised column must not read the two the same
@@ -27,7 +27,7 @@ module Rigor
       #
       # Single-table-inheritance subclasses (`class Admin < User`) carry an `sti_parent:` pointer; their
       # {Entry} resolves its table from the root model and inherits the chain's declared associations /
-      # enums / aliases / scopes / validations / callbacks.
+      # enums / aliases / scopes / validations / callbacks / macro methods.
       class ModelIndex
         # `associations` is a frozen `Array<Hash>` where each row carries `{ name:, kind:, target:,
         # nullable: }`:
@@ -47,7 +47,7 @@ module Rigor
         # exact. Only a true reading licenses pinning the name to a value; see
         # `Activerecord#table_name_return_type` for why the schema is not admitted as corroboration.
         Entry = Struct.new(:class_name, :table_name, :table_name_exact, :columns, :associations,
-                           :enums, :scopes, :validations, :callbacks, :aliases,
+                           :enums, :scopes, :validations, :callbacks, :aliases, :macro_methods,
                            keyword_init: true) do
           def table_name_exact? = table_name_exact == true
 
@@ -90,6 +90,13 @@ module Rigor
           # declarations.
           def alias?(name) = aliases.key?(name.to_s)
           def resolve_alias(name) = aliases[name.to_s]
+
+          # `macro_methods` is `Array<method_name>` — the instance methods a declaration macro installs that
+          # none of the sets above already carries (#1049): `delegate`'s names, the Paperclip / Active
+          # Storage attachment readers, and an `enum`'s per-value predicates. Names only, with no type: a
+          # consumer asks "does this model answer `followers_count`?", which is what a fail-closed check
+          # needs and all the declaration states.
+          def macro_method?(name) = macro_methods.include?(name.to_s)
         end
 
         attr_reader :entries
@@ -149,8 +156,8 @@ module Rigor
               end
 
             # STI children inherit their ancestors' declared associations / enums / aliases / scopes /
-            # validations / callbacks. Without the merge a `where(<parent-association>: ...)` on the
-            # child would surface as a false `unknown-column`.
+            # validations / callbacks / macro methods. Without the merge a `where(<parent-association>: ...)`
+            # on the child would surface as a false `unknown-column`.
             acc[class_name] = Entry.new(
               class_name: class_name,
               table_name: table_name,
@@ -161,7 +168,8 @@ module Rigor
               scopes: chain.flat_map { |r| Array(r[:scopes]) }.uniq.freeze,
               validations: chain.flat_map { |r| Array(r[:validations]) }.uniq.freeze,
               callbacks: chain.flat_map { |r| Array(r[:callbacks]) }.map(&:freeze).freeze,
-              aliases: merge_aliases(chain)
+              aliases: merge_aliases(chain),
+              macro_methods: chain.flat_map { |r| Array(r[:macro_methods]) }.uniq.freeze
             ).freeze
           end
           new(entries.freeze, columns_known: !schema_table.nil?)