rigortype 0.4.4 → 0.4.6

data/lib/rigor/sig_gen/write_reporter.rb

@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "classification"
+
+module Rigor
+  module SigGen
+    # Reports a `rigor sig-gen --write` run (the per-target {WriteResult}s) and the `--check` verdict. Split out of
+    # {Renderer}, which formats candidates; this formats what the writer did with them.
+    class WriteReporter
+      def initialize(out:)
+        @out = out
+      end
+
+      # Renders the per-source-file outcomes of a `--write` run. Distinct from {Renderer#render} because the write
+      # path's reporting surface is action-oriented (created / updated / skipped) rather than candidate-oriented.
+      # @param refused — methods refused as `sig.skipped.inline-differs`; the JSON payload names them under
+      #   `refused` (absent when there are none, so an ordinary payload is unchanged), and text mode leaves them
+      #   to the command's stderr `REFUSED` lines.
+      def render_write(results:, format:, refused: [])
+        case format
+        when "json" then render_write_json(results, refused)
+        when "text" then render_write_text(results)
+        else raise ArgumentError, "unsupported format: #{format}"
+        end
+      end
+
+      # ADR-112 WD4 — `sig-gen --check`: the results of a dry-run `--write`. Only the targets `--write` would
+      # change (or refuse) are shown, each with the lines it would add; the verdict is the exit status, which
+      # the command derives from the same results ({.out_of_date}).
+      #
+      # @param refused — the methods the generator refused to reconcile (`sig.skipped.inline-differs`):
+      #   `sig/` is not up to date while one stands, and `--write` cannot fix it.
+      def render_check(results:, format:, refused: [])
+        stale = self.class.out_of_date(results)
+        case format
+        when "json"
+          @out.puts(JSON.pretty_generate({ up_to_date: stale.empty? && refused.empty?,
+                                           results: stale.map { |r| check_entry(r) },
+                                           refused: refused.map(&:to_h) }))
+        when "text" then render_check_text(stale, refused)
+        else raise ArgumentError, "unsupported format: #{format}"
+        end
+      end
+
+      # One line per method sig-gen refused to reconcile with its `sig/` copy. Shared by `--write` (on stderr,
+      # next to the write report) and `--check`.
+      def self.refusal_lines(refused)
+        refused.map do |candidate|
+          separator = candidate.kind == :singleton ? "." : "#"
+          "REFUSED #{candidate.path}: #{candidate.class_name}#{separator}#{candidate.method_name} — its inline " \
+            "declaration and its sig/ declaration disagree, so neither was changed " \
+            "(#{Classification::SKIP_DIAGNOSTIC_IDS.fetch(candidate.skip_reason)}). Make them agree, or pass " \
+            "--overwrite to replace the sig/ member with the inline declaration; `rigor explain " \
+            "#{Classification::SKIP_DIAGNOSTIC_IDS.fetch(candidate.skip_reason)}` says when that is not enough."
+        end
+      end
+
+      # The results that make a `--check` fail: a target `--write` would create or change, and one it would
+      # refuse, since a write that cannot happen is not an up-to-date `sig/` either.
+      def self.out_of_date(results)
+        results.reject { |result| %i[noop skipped_outside_sig_root].include?(result.action) }
+      end
+
+      # Nothing was written, so the entry must not read like one that was: `created` / `updated` become
+      # `would_create` / `would_update`. A refusal keeps its action — `--write` would refuse the same way.
+      CHECK_ACTIONS = { created: "would_create", updated: "would_update" }.freeze
+      private_constant :CHECK_ACTIONS
+
+      private
+
+      def check_entry(result)
+        entry = result.to_h
+        entry[:action] = CHECK_ACTIONS.fetch(result.action, entry[:action])
+        entry
+      end
+
+      def render_check_text(stale, refused)
+        if stale.empty? && refused.empty?
+          @out.puts("sig/ is up to date")
+          return
+        end
+
+        self.class.refusal_lines(refused).each { |line| @out.puts(line) }
+
+        stale.each do |result|
+          case result.action
+          when :created, :updated then render_check_change(result)
+          when :skipped_invalid_rbs then render_write_invalid(result)
+          when :skipped_invalid_encoding then render_write_invalid_encoding(result)
+          end
+        end
+      end
+
+      def render_check_change(result)
+        counts = result.action == :created ? "#{result.applied.size} method(s)" : applied_counts(result)
+        verb = result.action == :created ? "would create" : "would update"
+        @out.puts("#{verb} #{result.target_path} (#{counts})")
+        result.applied.each do |candidate|
+          @out.puts("  - #{candidate.declared_rbs}") if candidate.declared_rbs
+          candidate.rbs_lines.each { |line| @out.puts("  + #{line}") }
+        end
+      end
+
+      def render_write_text(results)
+        if results.all? { |r| r.action == :noop && r.skipped.empty? }
+          @out.puts("No changes")
+          return
+        end
+
+        results.each do |result|
+          case result.action
+          when :created then render_write_created(result)
+          when :updated then render_write_updated(result)
+          when :noop then render_write_unchanged(result)
+          when :skipped_outside_sig_root then render_write_skipped(result)
+          when :skipped_invalid_rbs then render_write_invalid(result)
+          when :skipped_invalid_encoding then render_write_invalid_encoding(result)
+          end
+        end
+      end
+
+      # `+N` counts added lines; an existing line replaced (`--overwrite`, or an inline update) is counted apart,
+      # because "added 2" when one of them rewrote a line the project already had would understate the change.
+      def applied_counts(result)
+        added = "+#{result.applied.size - result.replaced.size}"
+        result.replaced.empty? ? added : "#{added}, replaced #{result.replaced.size}"
+      end
+
+      def render_write_created(result)
+        @out.puts("created #{result.target_path} (#{result.applied.size} method(s))")
+      end
+
+      def render_write_updated(result)
+        @out.puts("updated #{result.target_path} (#{applied_counts(result)}, " \
+                  "skipped #{result.skipped.size} user-authored)")
+        render_write_skips(result)
+        render_left_unreadable(result)
+      end
+
+      # A target the writer opened and changed nothing in, because every proposal for it was a member the
+      # project already declares (#1975). Without this line the run read as "No changes" or said nothing about it.
+      def render_write_unchanged(result)
+        return if result.skipped.empty?
+
+        @out.puts("unchanged #{result.target_path} (skipped #{result.skipped.size} user-authored)")
+        render_write_skips(result)
+      end
+
+      # One line per proposal the writer declined, so a change `--diff` or `--print` showed is never dropped
+      # without a reason. The same entries are the `skipped` rows of the `--format=json` payload.
+      def render_write_skips(result)
+        result.skipped.each do |candidate, reason|
+          separator = candidate.kind == :singleton ? "." : "#"
+          label = "#{candidate.class_name}#{separator}#{candidate.method_name}"
+          @out.puts("  skipped #{label} (#{reason.to_s.tr('_', '-')}): #{candidate.rbs_lines.join(' ')}")
+        end
+      end
+
+      # ADR-103 WD9 — the declarations whose annotation region the writer refused to rewrite. Named per
+      # method rather than counted: the fix is a human reading one existing annotation and deciding what
+      # it should say, and there is no count of those a reader could act on.
+      def render_left_unreadable(result)
+        return if result.left_unreadable.empty?
+
+        @out.puts("  left #{result.left_unreadable.size} existing annotation(s) byte-untouched " \
+                  "(sig.effect.left-unreadable):")
+        result.left_unreadable.each do |candidate|
+          @out.puts("    #{candidate.class_name}##{candidate.method_name} — " \
+                    "would have emitted #{candidate.annotations.join(' ')}")
+        end
+      end
+
+      def render_write_skipped(result)
+        @out.puts("skipped #{result.source_path} -> #{result.target_path} (outside sig root)")
+        render_write_skips(result)
+      end
+
+      # The assembled file does not parse, so it was NOT written. Writing it would poison the sig tree — the
+      # consumer quarantines an unparseable `.rbs` whole, taking every other type in that file down with it,
+      # including the user's own hand-written ones.
+      def render_write_invalid(result)
+        @out.puts("REFUSED #{result.target_path} — the generated RBS does not parse, so it was not written")
+        @out.puts("  #{result.error}")
+        @out.puts("  This is a bug in Rigor's RBS rendering, not in your code — please report it.")
+      end
+
+      # The EXISTING target file is not valid UTF-8, so the writer will not merge into it — the opposite
+      # attribution from {#render_write_invalid}: this one is the file's problem, and the fix is the user's.
+      def render_write_invalid_encoding(result)
+        @out.puts("REFUSED #{result.target_path} — the existing file is not valid UTF-8, so it was not updated")
+        @out.puts("  Re-save the file as UTF-8 and re-run; sig-gen never modifies a file it cannot read faithfully.")
+      end
+
+      def render_write_json(results, refused)
+        payload = { results: results.map(&:to_h) }
+        payload[:refused] = refused.map(&:to_h) unless refused.empty?
+        @out.puts(JSON.pretty_generate(payload))
+      end
+    end
+  end
+end

data/lib/rigor/sig_gen/write_result.rb

@@ -16,7 +16,9 @@ module Rigor
     # - `replaced` — the subset of `applied` that replaced an existing declaration rather than adding one
     #   (`--overwrite`'s tighter returns, and inline updates).
     # - `skipped` — the {MethodCandidate}s the writer declined (e.g. tighter-return without `--overwrite`). Each
-    #   entry pairs the candidate with a skip reason keyword (`:user_authored`).
+    #   entry pairs the candidate with a skip reason keyword: `:user_authored` (the target already declares the
+    #   member, and the writer does not replace it) or `:outside_sig_root` (the member routes to a file outside
+    #   the writer's sig root, so nothing was attempted).
     # - `left_unreadable` — the {MethodCandidate}s whose effect annotation was NOT written because the
     #   target declaration already carries annotations, so its bytes were left alone
     #   (`sig.effect.left-unreadable`; see {Writer#splice_annotations}). The signature line itself was

data/lib/rigor/sig_gen/writer.rb

@@ -98,7 +98,8 @@ module Rigor
         source_path ||= candidates.first&.path
         unless inside_sig_root?(target)
           return WriteResult.new(source_path: source_path, target_path: target,
-                                 action: :skipped_outside_sig_root)
+                                 action: :skipped_outside_sig_root,
+                                 skipped: candidates.map { |c| [c, :outside_sig_root] })
         end
 
         target.exist? ? update_existing(source_path, target, candidates) : create_new(source_path, target, candidates)
@@ -636,7 +637,8 @@ module Rigor
       end
 
       # Returns a list of `[method_name (Symbol), kind (Symbol)]` pairs for every method-like member in the
-      # declaration ({LayoutIndex.member_keys}). ADR-14 slice 4 recognises the three `attr_*` declaration kinds
+      # declaration ({LayoutIndex.member_keys}); an `alias` declares its new name (#1975). ADR-14 slice 4
+      # recognises the three `attr_*` declaration kinds
       # so a source-side `attr_reader :name` and an RBS-side `attr_reader name: T` are treated as the same member
       # (i.e. user-authored); a `def self?.f` counts as both an instance and a singleton `f` (#1488).
       def collect_member_pairs(decl)
@@ -754,7 +756,7 @@ module Rigor
 
       def find_attr_member(decl, method_name, kind)
         decl.members.find do |m|
-          next false if m.is_a?(RBS::AST::Members::MethodDefinition)
+          next false if m.is_a?(RBS::AST::Members::MethodDefinition) || m.is_a?(RBS::AST::Members::Alias)
 
           LayoutIndex.member_keys(m).include?([method_name, kind])
         end

data/lib/rigor/signature_path_audit.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "rooted_glob"
+
 module Rigor
   # Classifies each configured `signature_paths:` entry by what it actually contributes to
   # the RBS environment, so a caller can warn when a configured path resolves to nothing.
@@ -90,7 +92,7 @@ module Rigor
       return Entry.new(path: path, status: :missing, rbs_file_count: 0) unless File.exist?(path)
       return Entry.new(path: path, status: :not_directory, rbs_file_count: 0) unless File.directory?(path)
 
-      count = Dir.glob(File.join(path, "**", "*.rbs")).size
+      count = RootedGlob.glob(path, "**/*.rbs").size
       Entry.new(path: path, status: count.zero? ? :empty : :ok, rbs_file_count: count)
     end
 
@@ -204,7 +206,7 @@ module Rigor
     private_class_method :listed?
 
     def self.canonical_rbs_files(dir)
-      Dir.glob(File.join(dir, "**", "*.rbs")).filter_map { |file| canonical_path(file) }
+      RootedGlob.glob(dir, "**/*.rbs").filter_map { |file| canonical_path(file) }
     end
     private_class_method :canonical_rbs_files
 

data/lib/rigor/type/combinator.rb

@@ -1040,9 +1040,10 @@ module Rigor
         # No type carrier has a method that changes it once built (a built type is frozen; one `Marshal.load`
         # restores is not, but nothing mutates it either), so a memoised key cannot go stale. The memo is weak
         # in both key and value: it keeps neither the type nor the string alive, and an entry whose string
-        # nothing else holds is dropped at the next GC. It is keyed by identity on purpose: `Constant[0.0]` and
-        # `Constant[-0.0]` are equal and hash alike, but render differently. A non-main Ractor may not read the
-        # module's ivar, so a pool worker renders the key every time, as every run did before.
+        # nothing else holds is dropped at the next GC. It is keyed by identity on purpose: two equal members
+        # need not render alike (`Constant[1..2]` and `Constant[1..2.0]`), so equality is not a safe key. A
+        # non-main Ractor may not read the module's ivar, so a pool worker renders the key every time, as every
+        # run did before.
         def sort_key(member)
           return member.describe(:short) unless Ractor.main?
 

data/lib/rigor/type/constant.rb

@@ -78,7 +78,11 @@ module Rigor
       # `RbsTypeTranslator#translate_literal` already maps the parsed RBS Literal back to `Constant`.
       # Scalar carriers without RBS Literal support (Float, Range, Rational, Complex, Regexp, Pathname)
       # keep their pre-existing widen-to-class-name behaviour because RBS rejects their literal spellings
-      # as syntax errors.
+      # as syntax errors. `Range` is generic (`Range[out E]`), and a bare `Range` fails `rbs validate`, so
+      # it carries the class of its endpoints, or `untyped` when both are nil (#1891). `Set[unchecked out A]` is
+      # generic too, and a set is mutable: the constant's elements are only what it held when it was built, and
+      # `x << "a"` adds a member they do not name. It erases to `Set[untyped]`, as an Array or Hash literal's
+      # element type is widened rather than pinned (#2177).
       def erase_to_rbs
         case value
         when true then "true"
@@ -86,6 +90,8 @@ module Rigor
         when nil then "nil"
         when Integer then value.to_s
         when Symbol, String then value.inspect
+        when Range then "Range[#{range_element_rbs}]"
+        when ::Set then "Set[untyped]"
         else value.class.name
         end
       end
@@ -94,18 +100,63 @@ module Rigor
 
       include Rigor::Type::AcceptanceRouter
 
+      # Two carriers are equal when they pin the same value, which for a Float is stricter than Ruby's `==`
+      # (#1513): `0.0` and `-0.0` are distinct values (`1.0 / x` tells them apart), so `0.0 | -0.0` keeps both
+      # members, and a NaN equals another NaN, so `==` stays reflexive and a union never collects one NaN member
+      # per occurrence. A Complex compares its parts the same way.
       def ==(other)
-        other.is_a?(Constant) && value.class == other.value.class && value == other.value
+        other.is_a?(Constant) && value.class == other.value.class && Constant.same_value?(value, other.value)
       end
       alias eql? ==
 
       def hash
-        [Constant, value.class, value].hash
+        [Constant, value.class, Constant.value_key(value)].hash
+      end
+
+      # True when `left` and `right` (of one class) are the same value in the sense of {#==}.
+      def self.same_value?(left, right)
+        case left
+        when Float then same_float?(left, right)
+        when Complex then same_float?(left.real, right.real) && same_float?(left.imaginary, right.imaginary)
+        else left == right
+        end
+      end
+
+      def self.same_float?(left, right)
+        return left == right unless left.is_a?(Float) && right.is_a?(Float)
+        return right.nan? if left.nan?
+
+        left.eql?(right) && (!left.zero? || (1.0 / left).positive? == (1.0 / right).positive?)
+      end
+
+      # A key whose `eql?` / `hash` agree with {.same_value?}: `uniq { |v| Constant.value_key(v) }` keeps
+      # `0.0` and `-0.0` apart and folds every NaN into one. Any other value is its own key, so plain `uniq`
+      # semantics are unchanged for it.
+      def self.value_key(value)
+        case value
+        when Float then float_key(value)
+        when Complex then [Complex, float_key(value.real), float_key(value.imaginary)]
+        else value
+        end
+      end
+
+      def self.float_key(value)
+        return value unless value.is_a?(Float)
+        return :nan if value.nan?
+
+        value.zero? ? [Float, (1.0 / value)] : value
       end
 
       def inspect
         "#<Rigor::Type::Constant #{describe(:short)}>"
       end
+
+      private
+
+      def range_element_rbs
+        classes = [value.begin, value.end].compact.map { |endpoint| endpoint.class.name }.uniq.sort
+        classes.empty? ? "untyped" : classes.join(" | ")
+      end
     end
   end
 end

data/lib/rigor/type/hash_shape.rb

@@ -29,7 +29,7 @@ module Rigor
       EXTRA_KEY_POLICIES = %i[open closed].freeze
       POLICY_KEYWORDS = %i[required_keys optional_keys read_only_keys extra_keys].freeze
       # A Symbol whose text matches renders as a bare RBS record key (`lang:`) in {#erase_to_rbs};
-      # anything else must be quoted with a fat arrow (`"data-contrast" =>`). See {#erase_key_prefix}.
+      # anything else is a quoted Symbol with a fat arrow (`:"data-contrast" =>`). See {#erase_key_prefix}.
       BARE_RECORD_KEY = /\A[A-Za-z_][A-Za-z0-9_]*[?!]?\z/
 
       attr_reader :pairs, :required_keys, :optional_keys, :read_only_keys, :extra_keys
@@ -72,7 +72,7 @@ module Rigor
       def erase_to_rbs
         return "{}" if pairs.empty? && closed?
         return hash_erasure unless closed?
-        return hash_erasure if pairs.each_key.any? { |k| !k.is_a?(Symbol) }
+        return hash_erasure if pairs.each_key.any? { |k| !k.is_a?(Symbol) || !record_key_spellable?(k) }
 
         rendered = pairs.map { |k, v| "#{erase_key_prefix(k)} #{v.erase_to_rbs}" }
         "{ #{rendered.join(', ')} }"
@@ -221,21 +221,26 @@ module Rigor
 
       # An RBS record entry's key + separator, for the {#erase_to_rbs} path (which only ever sees
       # Symbol keys — string-keyed shapes degrade to `Hash[...]` before reaching here). A Symbol whose
-      # text is a plain identifier is a bare key with a colon (`lang:`); a hyphenated / punctuated
-      # Symbol MUST use the quoted `"data-contrast" =>` form, because RBS rejects both a bare
-      # non-identifier (`data-contrast:`) and a quoted key with a colon (`"data-contrast":`). Getting
-      # this wrong made sig-gen emit an unparseable Mastodon `html_attributes` shape that crashed the
-      # whole RBS env build. Valid identifier keys (incl. Ruby keywords like `class`) keep the colon
-      # form, so only genuinely non-identifier keys change. Optional keys carry a leading `?`.
+      # text is a plain identifier is a bare key with a colon (`lang:`, Ruby keywords like `class`
+      # included). Any other Symbol is a quoted Symbol literal with a fat arrow (`:"data-contrast" =>`):
+      # RBS rejects a bare non-identifier (`data-contrast:`) and a quoted key with a colon
+      # (`"data-contrast":`), and reads `"data-contrast" =>` as the String key, so the written record
+      # declared a key the body never has (#2176). Optional keys carry a leading `?`.
       def erase_key_prefix(key)
         optional = optional_key?(key) ? "?" : ""
         if BARE_RECORD_KEY.match?(key.to_s)
           "#{optional}#{key}:"
         else
-          "#{optional}#{key.to_s.inspect} =>"
+          "#{optional}:#{key.to_s.inspect} =>"
         end
       end
 
+      # `String#inspect` escapes `#{`, `#$` and `#@` as `\#`, which RBS's parser does not read back as
+      # `#`. A key spelled that way would name a different Symbol, so the shape erases to `Hash[...]`.
+      def record_key_spellable?(key)
+        !key.to_s.inspect.include?("\\#")
+      end
+
       def hash_erasure
         return "Hash[top, top]" if open?
         return "Hash" if pairs.empty?

data/lib/rigor/type/struct_instance.rb

@@ -63,10 +63,11 @@ module Rigor
       end
 
       # Erases to the tagging class nominal (conservative: the structural members are not RBS-expressible
-      # as a class instance). The anonymous case erases to the `Struct` supertype.
+      # as a class instance). The anonymous case erases to the `Struct` supertype with an `untyped`
+      # element: `Struct[Elem]` is generic, and a bare `Struct` fails `rbs validate` (#2177).
       def erase_to_rbs
         name = class_name
-        return "Struct" if name.nil?
+        return "Struct[untyped]" if name.nil?
 
         name
       end

data/lib/rigor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rigor
-  VERSION = "0.4.4"
+  VERSION = "0.4.6"
 end

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable/channel_discoverer.rb

@@ -99,7 +99,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
 

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/mailer_discoverer.rb

@@ -90,7 +90,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
 
@@ -216,9 +216,10 @@ module Rigor
         # - `initialize`
         # - methods starting with `_` (Ruby convention for private/internal)
         # - `def self.<name>` (singleton-side)
-        # - methods after a bare `private` (or `public` → `private` transition) — these are internal
-        #   helpers, not actions
-        # - methods named as a `private :foo` argument
+        # - methods that are not public at the end of the class body, read in source order: after a bare
+        #   `private` / `protected` (until a `public` switches back), named by `private :foo` /
+        #   `protected :foo`, or defined inline (`private def foo`) — Rails builds `action_methods` from the
+        #   public instance methods. `public :foo` after a `protected` section makes `foo` an action again.
         # - methods named as a callback target (`before_action :name`, `after_action`, `around_action`)
         #
         # Pre-fix, Mastodon's `AdminMailer#process_params` / `set_instance` / `set_locale` /
@@ -227,64 +228,80 @@ module Rigor
         CALLBACK_DECLARATIONS = %i[before_action after_action around_action].freeze
         private_constant :CALLBACK_DECLARATIONS
 
+        VISIBILITY_KEYWORDS = %i[public private protected].freeze
+        private_constant :VISIBILITY_KEYWORDS
+
         def collect_action_defs(body)
           return [] if body.nil?
 
-          private_names, callback_names = collect_visibility_and_callbacks(body)
-          visibility = :public
+          callback_names = collect_callback_names(body)
+          def_nodes, final_visibility = scan_visibility(body)
 
-          body.compact_child_nodes.flat_map do |node|
-            visibility = next_visibility(node, visibility)
-            next [] unless node.is_a?(Prism::DefNode)
-            next [] if node.receiver.is_a?(Prism::SelfNode)
-            next [] if node.name == :initialize
-            next [] if node.name.to_s.start_with?("_")
-            next [] if visibility == :private
-            next [] if private_names.include?(node.name)
-            next [] if callback_names.include?(node.name)
+          def_nodes.select do |node|
+            next false if node.receiver.is_a?(Prism::SelfNode)
+            next false if node.name == :initialize
+            next false if node.name.to_s.start_with?("_")
+            next false if callback_names.include?(node.name)
 
-            [node]
+            # Rails builds `action_methods` from the PUBLIC instance methods, so only a method whose final
+            # visibility is public is an action.
+            final_visibility[node.name] == :public
           end
         end
 
-        # First pass over the class body: collect (a) names passed to `private :foo` / `protected :foo`
-        # (explicit visibility-on-existing-method form), and (b) Symbol arguments to callback
-        # declarations (`before_action :setup`, etc.).
-        def collect_visibility_and_callbacks(body)
-          private_names = []
-          callback_names = []
-
+        # Symbol arguments to callback declarations (`before_action :setup`, etc.).
+        def collect_callback_names(body)
+          names = []
           body.rigor_each_child do |node|
-            next unless node.is_a?(Prism::CallNode) && node.receiver.nil?
+            next unless node.is_a?(Prism::CallNode) && node.receiver.nil? && CALLBACK_DECLARATIONS.include?(node.name)
 
-            args = (node.arguments&.arguments || []).filter_map do |arg|
-              Rigor::Source::Literals.symbol(arg)
+            (node.arguments&.arguments || []).each do |arg|
+              symbol = Rigor::Source::Literals.symbol(arg)
+              names << symbol if symbol
             end
-            next if args.empty?
+          end
+          names.to_set
+        end
 
-            case node.name
-            when :private, :protected then private_names.concat(args)
-            when *CALLBACK_DECLARATIONS then callback_names.concat(args)
+        # Walks the class body in source order and returns `[def_nodes, final_visibility]`: every `def` the body
+        # spells (a direct statement or the inline argument of a visibility call, `private def x`), and the
+        # visibility each method name ends with. A bare `public` / `private` / `protected` sets the default for
+        # the defs after it; `private :x` / `public :x` / `protected def x` set that one method, whichever side of
+        # its `def` they fall on in the source, and the last statement to name a method wins.
+        def scan_visibility(body)
+          def_nodes = []
+          final_visibility = {}
+          default = :public
+
+          body.compact_child_nodes.each do |node|
+            case node
+            when Prism::DefNode
+              def_nodes << node
+              final_visibility[node.name] = default
+            when Prism::CallNode
+              default = apply_visibility_call(node, default, def_nodes, final_visibility)
             end
           end
 
-          [private_names.to_set, callback_names.to_set]
+          [def_nodes, final_visibility]
         end
 
-        # Returns the new visibility scope state after observing `node`. Bare `private` / `protected` /
-        # `public` switch state; the `private :foo` arg-bearing form does NOT (already handled by
-        # `collect_visibility_and_callbacks`).
-        def next_visibility(node, current)
-          return current unless node.is_a?(Prism::CallNode)
-          return current unless node.receiver.nil?
-          return current unless (args = node.arguments&.arguments).nil? || args.empty?
-
-          case node.name
-          when :private then :private
-          when :protected then :protected
-          when :public then :public
-          else current
+        # Applies one receiverless `public` / `private` / `protected` call and returns the (possibly new) default.
+        def apply_visibility_call(node, default, def_nodes, final_visibility)
+          return default unless node.receiver.nil? && VISIBILITY_KEYWORDS.include?(node.name)
+
+          args = node.arguments&.arguments || []
+          return node.name if args.empty?
+
+          args.flat_map { |arg| arg.is_a?(Prism::ArrayNode) ? arg.elements : [arg] }.each do |arg|
+            if arg.is_a?(Prism::DefNode)
+              def_nodes << arg
+              final_visibility[arg.name] = node.name
+            elsif (name = Rigor::Source::Literals.symbol_or_string(arg))
+              final_visibility[name] = node.name
+            end
           end
+          default
         end
 
         def build_class_entry(class_name, file_path, def_nodes, includes = [], module_actions = {})

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer.rb

@@ -52,13 +52,32 @@ module Rigor
         # Bumped 2026-09-02 (#621) — mailer keys are de-rooted at the producer and a reopened class's
         # actions are UNIONed rather than clobbered, so a cached 0.4.0 index can be missing actions this
         # version knows about.
-        version: "0.5.0",
+        #
+        # Bumped 2026-10-23 (#2308) — a method after a bare `protected` is no longer an action, so a cached 0.5.0
+        # index can list protected helpers as actions (and as missing-view candidates).
+        version: "0.5.1",
         description: "Validates ActionMailer call shape and view template existence.",
         config_schema: {
           "mailer_search_paths" => { kind: :array, default: ["app/mailers"] },
           "mailer_base_classes" => { kind: :array, default: %w[ApplicationMailer ActionMailer::Base] },
           "views_root" => { kind: :string, default: "app/views" }
         },
+        # ADR-125 (#575, #2308) — a mailer instance serves exactly one action (`Mailer.welcome(...)` builds a
+        # fresh instance and runs that one method), so ivar writes in two different public actions are never live
+        # together and `def.ivar-write-mismatch` stops comparing them. `ActionMailer::Base` has no signature here;
+        # the rule matches an undeclared superclass by its written name.
+        per_invocation_classes: ["ActionMailer::Base"],
+        # A public method these macros name is a callback or a view helper, not an action: it runs inside
+        # whichever action triggers it (AbstractController::Callbacks / Helpers), so its writes stay compared with
+        # every action's. The actionpack list, plus the `*_deliver` callbacks (ActionMailer::Callbacks), which run
+        # on the action's own instance.
+        per_invocation_non_action_macros: %i[
+          before_action prepend_before_action append_before_action skip_before_action
+          after_action prepend_after_action append_after_action skip_after_action
+          around_action prepend_around_action append_around_action skip_around_action
+          before_deliver after_deliver around_deliver
+          helper_method
+        ],
         # ADR-103 WD10 (#387) — see {Effects} for what each row is and why.
         effect_root: "rails",
         effect_labels: ["rails.actionmailer.deliver"],

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_discoverer.rb

@@ -58,7 +58,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end