rigortype 0.4.4 → 0.4.6

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/render_locals.rb

@@ -159,13 +159,18 @@ module Rigor
 
           # Project-relative paths, the spelling `#template_units_for_file` is handed and the spelling the
           # compiled cache is keyed by.
+          #
+          # #1803 — listed through the boundary's `#glob`, which records each root's membership: a helper
+          # added under `app/helpers`, or a template under a `view_search_paths:` root the template globs do
+          # not claim, is analysed by nobody, and without the row the run-result caches kept serving the
+          # index built before it appeared.
           def self.source_files(io_boundary, roots, pattern)
             root_prefix = "#{Dir.pwd}#{File::SEPARATOR}"
             roots.flat_map do |root|
               absolute = File.expand_path(root)
               next [] unless io_boundary.directory?(absolute)
 
-              Dir.glob(File.join(absolute, "**", pattern)).map { |path| path.delete_prefix(root_prefix) }
+              io_boundary.glob(absolute, "**/#{pattern}").map { |path| path.delete_prefix(root_prefix) }
             end
           end
 

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/view_assigns.rb

@@ -116,7 +116,7 @@ module Rigor
               absolute = File.expand_path(root)
               next [] unless @io_boundary.directory?(absolute)
 
-              Dir.glob(File.join(absolute, "**", "*.rb"))
+              @io_boundary.glob(absolute, "**/*.rb")
             end
           end
 

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -146,6 +146,19 @@ module Rigor
           # `sig/action_view.rbs` so the name resolves, open so the helper surface stays lenient.
           "ActionView::Base"
         ],
+        # ADR-125 (#575) — Rails instantiates a fresh controller per request and runs exactly one action on
+        # it, so ivar writes in two different public actions are never live together and
+        # `def.ivar-write-mismatch` stops comparing them. Neither root has a signature (see `sig/action_controller.rbs`
+        # for why); the rule matches an undeclared superclass by its written name.
+        per_invocation_classes: ["ActionController::Base", "ActionController::API"],
+        # A public method these macros name is a callback or a view helper, not an action: it runs inside
+        # whichever action triggers it, so its writes stay compared with every action's (#575's A1 decision).
+        per_invocation_non_action_macros: %i[
+          before_action prepend_before_action append_before_action skip_before_action
+          after_action prepend_after_action append_after_action skip_after_action
+          around_action prepend_around_action append_around_action skip_around_action
+          helper_method
+        ],
         # ADR-103 WD10 / WD14 (#387) — see {Effects} for what each row is and why.
         effect_root: "rails",
         effect_labels: %w[

data/plugins/rigor-active-model-serializers/lib/rigor/plugin/active_model_serializers/serializer_discoverer.rb

@@ -127,7 +127,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
 

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/effects.rb

@@ -146,11 +146,12 @@ module Rigor
 
         # ADR-45 WD1b (#613) — `config/application.rb` is probed at a fixed path, so its ABSENCE is what
         # shapes "no adapter" on a project that has none yet; the probe goes through the boundary to record
-        # that. The globbed `config/environments/*.rb` entries exist by enumeration and only pick up the
-        # (immediately superseded) presence row.
+        # that. The `config/environments/*.rb` listing goes through `#glob` (#1803), whose row records the
+        # directory's membership; each listed entry only picks up the (immediately superseded) presence row.
         def config_files(io_boundary, root)
           application = File.join(root, CONFIG_PATHS.first)
-          environments = Dir.glob(File.join(root, CONFIG_PATHS.last, "*.rb"))
+          environments_dir = File.join(root, CONFIG_PATHS.last)
+          environments = io_boundary.glob(environments_dir, "*.rb")
           ([application] + environments).select { |path| io_boundary.file?(path) }
         rescue StandardError
           []

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/job_discoverer.rb

@@ -92,7 +92,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
 

data/plugins/rigor-activejob/lib/rigor/plugin/activejob.rb

@@ -97,8 +97,10 @@ module Rigor
 
       # Cached separately from `:job_index` because the two invalidate on different files: editing a
       # schedule changes which jobs are reached without touching `app/jobs` at all. The `watch:` roots the
-      # glob at the working directory so that CREATING a schedule file — not just editing one — is seen.
-      producer :recurring_jobs, watch: -> { [[".", *@recurring_paths]] } do |_params|
+      # glob at the working directory so that CREATING a schedule file — not just editing one — is seen. Each
+      # configured path is escaped to a literal name, so `recurring[1].yml` is watched as that file.
+      producer :recurring_jobs,
+               watch: -> { [[".", *@recurring_paths.map { |path| Rigor::RootedGlob.literal(path) }]] } do |_params|
         RecurringScan.new(
           io_boundary: io_boundary,
           recurring_paths: @recurring_paths

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/model_discoverer.rb

@@ -375,7 +375,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
 

data/plugins/rigor-activestorage/lib/rigor/plugin/activestorage/attachment_discoverer.rb

@@ -69,7 +69,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
 

data/plugins/rigor-alba/lib/rigor/plugin/alba/resource_discoverer.rb

@@ -65,7 +65,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
       end

data/plugins/rigor-devise/lib/rigor/plugin/devise.rb

@@ -33,9 +33,11 @@ module Rigor
     # - `:authenticatable` — always-included base module
     #
     # The substrate's pre-pass scanner consults each module's RBS via `Environment::RbsLoader#instance_definition`
-    # to enumerate method names. A user project providing real Devise via Bundler will see methods like
-    # `valid_password?`, `send_reset_password_instructions`, etc. resolve through the synthetic-method
-    # tier without `call.undefined-method`.
+    # to enumerate method names, so it names only what the project's RBS declares. The `devise` gem ships no
+    # RBS and Rigor bundles none for `Devise::Models::*`: a project supplies those signatures (`signature_paths:`
+    # or an `rbs collection`), and only then do `valid_password?`, `send_reset_password_instructions`, etc.
+    # resolve through the synthetic-method tier. A name the model defines itself, or a project module it
+    # includes or prepends defines, is left to the project's definition.
     #
     # ## Precision tier
     #

data/plugins/rigor-dry-types/lib/rigor/plugin/dry_types.rb

@@ -109,7 +109,7 @@ module Rigor
       def scannable_paths
         @scannable_paths ||= services.configuration.paths.flat_map do |entry|
           if io_boundary.directory?(entry)
-            Dir.glob(File.join(entry, "**", "*.rb"), sort: true)
+            Dir.glob("**/*.rb", base: entry).map { |path| File.join(entry, path) }
           elsif io_boundary.file?(entry) && entry.end_with?(".rb")
             [entry]
           else
@@ -120,16 +120,17 @@ module Rigor
 
       # The `watch:` glob tuples covering the scan's entire input — one `[root, pattern]` per project `paths:`
       # entry. A directory entry watches its whole `**/*.rb` subtree; a single-file `.rb` entry watches
-      # exactly that file (`[dir, basename]`). Roots are expanded to absolute paths by
-      # `Plugin::Base#watch_glob_entries`, so a relative CLI path (`app/models`) re-validates against the same
-      # tree from the project root on the next run. Co-extensive with {#scannable_paths}: every `.rb` the scan
-      # would read is watched, so any edit / addition / removal under those paths invalidates the cache.
+      # exactly that file (`[dir, basename]`, with the basename escaped so `[`, `{`, `*` or `?` match literally).
+      # Roots are expanded to absolute paths by `Plugin::Base#watch_glob_entries`, so a relative CLI path
+      # (`app/models`) re-validates against the same tree from the project root on the next run. Co-extensive
+      # with {#scannable_paths}: every `.rb` the scan would read is watched, so any edit / addition / removal
+      # under those paths invalidates the cache.
       def alias_watch_globs
         services.configuration.paths.filter_map do |entry|
           if io_boundary.directory?(entry)
             [entry, "**/*.rb"]
           elsif io_boundary.file?(entry) && entry.end_with?(".rb")
-            [File.dirname(entry), File.basename(entry)]
+            [File.dirname(entry), Rigor::RootedGlob.literal(File.basename(entry))]
           end
         end
       end

data/plugins/rigor-factorybot/lib/rigor/plugin/factorybot/factory_discoverer.rb

@@ -54,7 +54,7 @@ module Rigor
             if @io_boundary.file?(absolute)
               [absolute]
             elsif @io_boundary.directory?(absolute)
-              Dir.glob(File.join(absolute, "**", "*.rb"))
+              Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
             else
               []
             end

data/plugins/rigor-ffi/lib/rigor/plugin/ffi/discoverer.rb

@@ -11,6 +11,8 @@ module Rigor
       # carried no row at all and was served after any edit, an analysed file's included, until `--no-cache`.
       class Discoverer
         RUBY_GLOB = "**/*.rb"
+        RUBY_FILE = "*.rb"
+        SKIPPED_DIRECTORIES = %w[vendor .git].freeze
 
         def self.discover(root:, io:)
           new(root: root, io: io).discover
@@ -67,20 +69,47 @@ module Rigor
 
         private
 
+        # #1959 — one `:kinds` listing row over the root's top-level entries, then one `:names` `**/*.rb` row per
+        # real directory among them other than `vendor/`. A single `**/*.rb` row over the root re-walked an in-tree
+        # `vendor/bundle` on every warm validation and read stale on every `bundle install`. The listing carries
+        # each entry's kind and not just its name: the walk descends a directory but not a symlinked one (`**` never
+        # followed it), so a file `gen` that becomes a directory `gen/`, or a symlink that becomes a real
+        # directory, changes what it reads while every name stays put.
+        #
+        # The answer is `Dir.glob("**/*.rb")` minus the skipped paths and minus every match that is not a regular
+        # file (#2113), in its order: entry by entry, a top-level name matching `*.rb`, then that directory's
+        # matches. A directory so named is walked, never read. The boundary answers absolute paths; they are spelled
+        # back under `@root` as `Dir.glob` spells them.
         def ruby_files
           return [] unless @root && @io.directory?(@root.to_s)
 
-          boundary_glob.reject { |p| p.include?("/vendor/") || p.include?("/.git/") }
-        end
-
-        # One `:names` `**/*.rb` row over the root, `vendor/` included: a per-entry walk that skipped it recorded
-        # names only, so a top-level entry that changed kind under the same name went unseen. The boundary
-        # answers absolute paths; they are spelled back under `@root` as `Dir.glob` spells them, so the filter
-        # above sees the same strings it always did.
-        def boundary_glob
           root = @root.to_s
           prefix = "#{File.absolute_path(root)}/"
-          @io.glob(root, RUBY_GLOB).map { |path| File.join(root, path.delete_prefix(prefix)) }
+          @io.list_directory_kinds(root).flat_map do |path, kind|
+            name = path.delete_prefix(prefix)
+            own = File.fnmatch?(RUBY_FILE, name) && readable_file?(path, kind) ? [File.join(root, name)] : []
+            next own unless kind == :directory && !SKIPPED_DIRECTORIES.include?(name)
+
+            own + @io.glob(path, RUBY_GLOB).filter_map do |nested|
+              relative = nested.delete_prefix(prefix)
+              File.join(root, relative) if !skipped?(relative) && @io.file?(nested)
+            end
+          end
+        end
+
+        # #2113 — `*.rb` names a directory too, and a fifo, socket or device can carry the name. Only a regular file
+        # is read: `read_file` on a directory raises `EISDIR` and aborts the whole walk, and on a fifo it blocks
+        # until a writer appears. A top-level entry is judged by its `lstat` kind, and a symlink by what it
+        # resolves to; a nested match is judged by `file?` (which follows a symlink as `File.file?` does).
+        def readable_file?(path, kind)
+          kind == :file || (kind == :symlink && @io.file?(path))
+        end
+
+        # #1956 — the skip reads the path relative to the root, a `vendor` or `.git` directory segment at any
+        # depth under it. Matching `/vendor/` in the whole path also dropped every file of a project that itself
+        # lives under some `…/vendor/…` directory, and the catalog came out empty.
+        def skipped?(relative)
+          relative.split("/")[0...-1].intersect?(SKIPPED_DIRECTORIES)
         end
 
         # The glob's rows record which files match; this read's row carries an edit.

data/plugins/rigor-ffi/lib/rigor/plugin/ffi/target_detector.rb

@@ -26,7 +26,7 @@ module Rigor
         def extconf_uses_ffx?(root, io = nil)
           return false if root.nil?
 
-          extconfs = io ? io.glob(root.to_s, EXTCONF_GLOB) : Dir.glob(File.join(root.to_s, EXTCONF_GLOB))
+          extconfs = io ? io.glob(root.to_s, EXTCONF_GLOB) : Dir.glob(EXTCONF_GLOB, base: root.to_s).map { |path| File.join(root.to_s, path) }
           extconfs.any? do |extconf|
             read_text(extconf, io).include?("FFX.create_makefile")
           rescue SystemCallError

data/plugins/rigor-pundit/lib/rigor/plugin/pundit/authorization_scan.rb

@@ -72,7 +72,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
 

data/plugins/rigor-pundit/lib/rigor/plugin/pundit/policy_discoverer.rb

@@ -60,7 +60,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
 

data/plugins/rigor-rails-i18n/lib/rigor/plugin/rails_i18n/locale_index.rb

@@ -34,12 +34,17 @@ module Rigor
           end
         end
 
-        attr_reader :entries, :locales
+        attr_reader :entries, :locales, :load_errors
 
         # @param locales — all locale names that contributed at least one key.
-        def initialize(entries, locales:)
+        # @param load_errors — the {LocaleLoader::LoadError}s of the files that did not parse (#1954). They
+        #   ride in the index, not beside it, because the index is the cached producer value: a warm run
+        #   serves it without re-reading a single locale file, so an error kept anywhere else is lost exactly
+        #   when the cache hits.
+        def initialize(entries, locales:, load_errors: [])
           @entries = entries.freeze
           @locales = locales.dup.freeze
+          @load_errors = load_errors.map(&:freeze).freeze
           @by_key = entries.to_h { |e| [e.dotted_key, e] }.freeze
           freeze
         end

data/plugins/rigor-rails-i18n/lib/rigor/plugin/rails_i18n/locale_loader.rb

@@ -15,9 +15,9 @@ module Rigor
       # flattened into dotted keys (`users.welcome`, `errors.messages.blank`, …). For each leaf string,
       # `%{var}` placeholders are extracted via a simple regex.
       #
-      # Files that fail to parse are skipped with a load-error diagnostic surfaced through the plugin's
-      # error channel. Non-Hash YAML roots (e.g. a top-level sequence) are also skipped — the format is
-      # locale-keyed by convention.
+      # Files that fail to parse are skipped and recorded in the returned index's `load_errors`, which the
+      # plugin discloses as a run-scoped load-error row. Non-Hash YAML roots (e.g. a top-level sequence) are
+      # also skipped — the format is locale-keyed by convention.
       class LocaleLoader
         PLACEHOLDER_RE = /%\{(?<name>[^}]+)\}/
 
@@ -66,7 +66,7 @@ module Rigor
               value_kinds: per_key_kinds[dotted_key].freeze
             )
           end
-          LocaleIndex.new(entries, locales: locales.to_a.sort)
+          LocaleIndex.new(entries, locales: locales.to_a.sort, load_errors: @load_errors)
         end
 
         private
@@ -90,7 +90,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.{yml,yaml}"))
+            Dir.glob("**/*.{yml,yaml}", base: absolute).map { |path| File.join(absolute, path) }
           end.sort
         end
 

data/plugins/rigor-rails-i18n/lib/rigor/plugin/rails_i18n.rb

@@ -57,7 +57,11 @@ module Rigor
         target_gems: ["i18n"],
         # Bumped 2026-06-23 — view template lazy-key scanning (`t('.key')` inside ERB / Haml / Slim under
         # `view_search_paths`).
-        version: "0.3.0",
+        # Bumped 2026-10-17 (#1954) — the cached `:locale_index` value now carries the YAML load errors. A
+        # belt-and-braces key change: a released build already drops pre-change entries with the cache ABI
+        # (`Rigor::VERSION`) and a checkout with its engine-source identity, and the read below tolerates
+        # an index without errors either way.
+        version: "0.3.1",
         description: "Validates I18n `t(key)` calls against `config/locales/*.yml`.",
         config_schema: {
           "locale_search_paths" => { kind: :array, default: ["config/locales"] },
@@ -72,17 +76,12 @@ module Rigor
       )
 
       # `watch:` covers every `.yml` / `.yaml` file under the locale search paths so the cache invalidates
-      # when locale files are added, removed, or edited (ADR-60 WD3). `@load_errors` is a producer-side
-      # capture: it is populated only when the block runs (a cache miss / a watched file changed), which is
-      # exactly when a malformed YAML must re-surface.
+      # when locale files are added, removed, or edited (ADR-60 WD3). The YAML load errors travel inside the
+      # returned index (`LocaleIndex#load_errors`), not in an instance variable the block sets (#1954): a
+      # warm producer-cache hit skips the block, so a block-side capture lost the load-error row on every
+      # run whose result was not itself served from the run-result cache.
       producer :locale_index, watch: -> { [[@locale_search_paths, "**/*.yml", "**/*.yaml"]] } do |_params|
-        loader = LocaleLoader.new(
-          io_boundary: io_boundary,
-          search_paths: @locale_search_paths
-        )
-        index = loader.load
-        @load_errors = loader.load_errors
-        index
+        LocaleLoader.new(io_boundary: io_boundary, search_paths: @locale_search_paths).load
       end
 
       # Scans view templates under `view_search_paths` for lazy `t('.key')` / `I18n.translate('.key')`
@@ -102,7 +101,6 @@ module Rigor
         @locale_search_paths = Array(config.fetch("locale_search_paths")).map(&:to_s)
         @view_search_paths = Array(config.fetch("view_search_paths")).map(&:to_s)
         @configured_locales = Array(config.fetch("configured_locales")).map(&:to_s)
-        @load_errors = []
       end
 
       # Returns no rows of its own: every file-level outcome here is run-scoped. The YAML load errors and the
@@ -114,8 +112,11 @@ module Rigor
       # are lazily loaded + memoised by `producer_value`, so the repeat registrations are no-ops.
       def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
         index = producer_value(:locale_index)
-        disclose_load_errors unless @load_errors.empty?
-        disclose_locale_runtime_error if index.nil? && producer_error(:locale_index)
+        if index
+          disclose_load_errors(Array(index.load_errors))
+        elsif producer_error(:locale_index)
+          disclose_locale_runtime_error
+        end
         view_diags = producer_value(:view_diagnostics) || []
         if (view_err = producer_error(:view_diagnostics))
           disclose_view_runtime_error(view_err)
@@ -175,7 +176,7 @@ module Rigor
           # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
           next [] unless io_boundary.directory?(absolute)
 
-          Dir.glob(File.join(absolute, "**", "*.{erb,haml,slim}"))
+          Dir.glob("**/*.{erb,haml,slim}", base: absolute).map { |path| File.join(absolute, path) }
         end.sort
       end
 
@@ -209,8 +210,8 @@ module Rigor
       # be pinned to the first analysed Ruby file — once per plugin INSTANCE, so once per fork-pool worker
       # (#1051). They go through the run-scoped channel instead: keyed by the locale path that failed, so a
       # project with two broken YAML files still discloses both, each exactly once, at `.rigor.yml:1:1`.
-      def disclose_load_errors
-        @load_errors.each do |err|
+      def disclose_load_errors(load_errors)
+        load_errors.each do |err|
           disclose_once(
             "locale-parse:#{err.path}",
             message: "rigor-rails-i18n: failed to parse `#{err.path}`: #{err.message}",

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes.rb

@@ -168,7 +168,7 @@ module Rigor
           # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
           next unless io_boundary.directory?(absolute)
 
-          Dir.glob(File.join(absolute, "**", "*.rb")).each(&)
+          Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }.each(&)
         end
       end
 

data/plugins/rigor-rspec/lib/rigor/plugin/rspec/matcher_analyzer.rb

@@ -35,7 +35,8 @@ module Rigor
       #    LocalVariableReadNode. Composite receivers (`expect(foo.bar)`, `expect { ... }.to raise_error`)
       #    fall through.
       # 3. The matcher is one of the recognised forms above (`be_a` / `be_kind_of` / `be_instance_of` /
-      #    `be_an_instance_of` / `be_nil` / `eq(literal)` / `eql(literal)` / `match(/regex/)`).
+      #    `be_an_instance_of` / `be_nil` / `eq(literal)` / `eql(literal)` / `match(/regex/)`, the last a meet
+      #    with the local's members; see `regex_match_type`).
       #
       # ## Equality is the local's own method
       #
@@ -152,10 +153,7 @@ module Rigor
           when :eq, :eql
             equality_type_for_literal_arg(matcher, target_local, negative: negative, scope: scope)
           when :match
-            # `match(/regex/)` narrows x to String. `match("...")` or `match(arbitrary_object)` falls
-            # through — the broader matcher dispatch needs the receiver to be a String, but we can only
-            # assert that for a literal regex.
-            string_type_for_regex_arg(matcher)
+            regex_match_type(matcher, target_local, negative: negative, scope: scope)
           end
         end
 
@@ -293,15 +291,108 @@ module Rigor
           end
         end
 
-        def string_type_for_regex_arg(matcher)
+        # --- `match(/regex/)` (#2033) ---
+        #
+        # RSpec's `match` passes when `expected === actual`, when `actual == expected`, or when `actual` responds to
+        # `match` and `actual.match(expected)` is truthy. `Regexp#===` matches a Symbol by its name, so a Symbol
+        # passes too, and keeps being a Symbol. The positive fact is therefore a meet with the local's members, as
+        # `eq`'s is: a String or Symbol member is kept as it is, and a member of a core class that has no `match` or
+        # `to_str` and whose `==` never equals a Regexp (`nil`, `true`, `false`, the numerics) is dropped, unless the
+        # project defines one of those methods on it or a core ancestor. An `Object`, `BasicObject`, `Kernel` or
+        # `Comparable` member reads `String | Symbol` ({#module_match_member}); any other module means no fact. Any other member (a user class, `Dynamic`) may pass, and
+        # the analyzer emits no fact; so does a subject none of whose members can pass (a `nil` local stays `nil`). The negative form emits none either: a String that does not match passes
+        # `not_to match`, so nothing leaves the local.
+        REGEX_MATCH_KEPT_CLASSES = %w[String Symbol].freeze
+        REGEX_MATCH_METHODS = %i[match to_str].freeze
+        Ractor.make_shareable(REGEX_MATCH_KEPT_CLASSES)
+        Ractor.make_shareable(REGEX_MATCH_METHODS)
+        private_constant :REGEX_MATCH_KEPT_CLASSES, :REGEX_MATCH_METHODS
+
+        def regex_match_type(matcher, target_local, negative:, scope:)
+          return nil if negative || scope.nil?
+          return nil unless regex_literal_arg?(matcher)
+
+          current = scope.local(target_local)
+          return nil if current.nil?
+
+          members = current.is_a?(Rigor::Type::Union) ? current.members : [current]
+          kept = []
+          members.each do |member|
+            met = regex_match_member(member, scope)
+            return nil if met.equal?(UNDECIDED)
+
+            kept << met unless met.nil?
+          end
+          kept.empty? ? nil : Rigor::Type::Combinator.union(*kept)
+        end
+
+        def regex_literal_arg?(matcher)
           args = matcher.arguments&.arguments || []
-          return nil unless args.size == 1
+          args.size == 1 &&
+            (args.first.is_a?(Prism::RegularExpressionNode) || args.first.is_a?(Prism::InterpolatedRegularExpressionNode))
+        end
 
-          arg = args.first
-          return nil unless arg.is_a?(Prism::RegularExpressionNode) ||
-                            arg.is_a?(Prism::InterpolatedRegularExpressionNode)
+        # The member itself when it may pass, nil when it cannot, UNDECIDED when Rigor cannot tell.
+        def regex_match_member(member, scope)
+          module_member = module_match_member(member, scope)
+          return module_member unless module_member.nil?
 
-          Rigor::Type::Combinator.nominal_of("String")
+          class_name = member_class_name(member)
+          return UNDECIDED if class_name.nil?
+          return member if REGEX_MATCH_KEPT_CLASSES.include?(class_name)
+          return member if project_defines?(class_name, :==, scope)
+          return member if REGEX_MATCH_METHODS.any? { |name| project_defines_on_chain?(class_name, name, scope) }
+
+          nil
+        end
+
+        OPEN_SURFACE_CLASS_NAMES = %w[Object BasicObject].freeze
+        # The modules String's or Symbol's own ancestry includes (`Kernel`, `Comparable`), read from the running Ruby.
+        STRING_SYMBOL_MODULES = (String.ancestors + Symbol.ancestors).grep_v(Class).filter_map(&:name).uniq.freeze
+        Ractor.make_shareable(OPEN_SURFACE_CLASS_NAMES)
+        Ractor.make_shareable(STRING_SYMBOL_MODULES)
+        private_constant :OPEN_SURFACE_CLASS_NAMES, :STRING_SYMBOL_MODULES
+
+        # The meet for an `Object`, `BasicObject` or module member, or nil for any other member. Its instances may be
+        # anything, a `to_str` or `match` object included. A member that declares `match` or `to_str` itself (its
+        # signature, a core ancestor, or the project's source) is kept whole. `Object`, `BasicObject` and a module
+        # String or Symbol includes otherwise read `String | Symbol`, as the String they most often are, so a String
+        # method called after the matcher reports nothing. Any other module is UNDECIDED: a passing value may include
+        # it without being a String. (`approval-queue.d/regexp-match-open-surface-subject.md`, shared with #2256.)
+        def module_match_member(member, scope)
+          return nil unless member.is_a?(Rigor::Type::Nominal) && member.type_args.empty?
+
+          name = member.class_name
+          string_like = OPEN_SURFACE_CLASS_NAMES.include?(name) || STRING_SYMBOL_MODULES.include?(name)
+          return nil unless string_like || scope.environment&.rbs_module?(name)
+          return member if REGEX_MATCH_METHODS.any? { |method_name| declares_method?(name, method_name, scope) }
+          return UNDECIDED unless string_like
+
+          Rigor::Type::Combinator.union(Rigor::Type::Combinator.nominal_of("String"),
+                                        Rigor::Type::Combinator.nominal_of("Symbol"))
+        end
+
+        def declares_method?(name, method_name, scope)
+          project_defines_on_chain?(name, method_name, scope) ||
+            !Rigor::Reflection.instance_method_definition(name, method_name, scope: scope).nil?
+        end
+
+        # Each core class's (and `Object` / `BasicObject` / `Kernel`'s) runtime ancestor chain. The project's
+        # reopenings are looked up along it by name, since the scope's ancestry walk does not cross core classes:
+        # `class Numeric; def to_str` reaches a Float member, `module Kernel; def match` a nil one.
+        CORE_ANCESTOR_CHAINS = [*EQUALITY_CORE_CLASSES, Object, BasicObject, Kernel].to_h do |mod|
+          [mod.name, mod.ancestors.filter_map(&:name).freeze]
+        end.freeze
+        Ractor.make_shareable(CORE_ANCESTOR_CHAINS)
+        private_constant :CORE_ANCESTOR_CHAINS
+
+        # Whether the project's source defines `method_name` on `class_name` or an ancestor, core ones included: a
+        # `def`, an included module, or a `define_method`.
+        def project_defines_on_chain?(class_name, method_name, scope)
+          CORE_ANCESTOR_CHAINS.fetch(class_name, [class_name]).any? do |name|
+            !scope.user_def_through_ancestors(name, method_name).first.nil? ||
+              scope.discovered_method_through_ancestors?(name, method_name, :instance)
+          end
         end
 
         NO_LITERAL = Object.new.freeze

data/plugins/rigor-sidekiq/lib/rigor/plugin/sidekiq/worker_discoverer.rb

@@ -92,7 +92,7 @@ module Rigor
             # ADR-45 WD1b (#613) — boundary-probed: a root that appears later invalidates the warm run.
             next [] unless @io_boundary.directory?(absolute)
 
-            Dir.glob(File.join(absolute, "**", "*.rb"))
+            Dir.glob("**/*.rb", base: absolute).map { |path| File.join(absolute, path) }
           end
         end
 

data/plugins/rigor-sidekiq/lib/rigor/plugin/sidekiq.rb

@@ -97,8 +97,10 @@ module Rigor
 
       # Cached separately from `:worker_index` because the two invalidate on different files: editing a
       # schedule changes which workers are reached without touching `app/workers` at all. The `watch:` roots
-      # the glob at the working directory so that CREATING a schedule file — not just editing one — is seen.
-      producer :scheduled_workers, watch: -> { [[".", *@schedule_paths]] } do |_params|
+      # the glob at the working directory so that CREATING a schedule file — not just editing one — is seen. Each
+      # configured path is escaped to a literal name, so `sidekiq[1].yml` is watched as that file.
+      producer :scheduled_workers,
+               watch: -> { [[".", *@schedule_paths.map { |path| Rigor::RootedGlob.literal(path) }]] } do |_params|
         ScheduleScan.new(
           io_boundary: io_boundary,
           schedule_paths: @schedule_paths

data/plugins/rigor-sinatra/lib/rigor/plugin/sinatra.rb

@@ -29,7 +29,9 @@ module Rigor
     # ## Reach
     #
     # All nine class-level HTTP verb methods Sinatra exposes: `get`, `post`, `put`, `delete`, `head`,
-    # `options`, `patch`, `link`, `unlink` (`lib/sinatra/base.rb:1531-1553`). Both modular-style subclasses
+    # `options`, `patch`, `link`, `unlink` (`lib/sinatra/base.rb:1531-1553`), plus the `before` / `after`
+    # filters (`add_filter`) and the `error` / `not_found` handlers, whose blocks `compile!` turns into
+    # instance methods through the same `generate_method` (issue #1768). Both modular-style subclasses
     # of `Sinatra::Base` and `Sinatra::Application` (classic top-level style, when used via `class App <
     # Sinatra::Application`) match because the receiver constraint accepts every subclass.
     #
@@ -57,7 +59,7 @@ module Rigor
         block_as_methods: [
           Rigor::Plugin::Macro::BlockAsMethod.new(
             receiver_constraint: "Sinatra::Base",
-            method_names: %i[get post put delete head options patch link unlink]
+            method_names: %i[get post put delete head options patch link unlink before after error not_found]
           )
         ]
       )

data/plugins/rigor-sorbet/lib/rigor/plugin/sorbet.rb

@@ -504,8 +504,8 @@ module Rigor
             # must not vary by machine / run. `Dir.glob` sorts its results by default on Ruby 3.0+, so the fold
             # order is already stable (the slice-1 comment's "filesystem order" caveat predates that default);
             # this walk relies on it rather than re-sorting.
-            Dir.glob(File.join(absolute, "**", "*#{ext}")).each do |path|
-              harvest_file(canonicalize(path), catalog, sigil_by_path, parse_errors_by_path)
+            Dir.glob("**/*#{ext}", base: absolute).each do |relative|
+              harvest_file(canonicalize(File.join(absolute, relative)), catalog, sigil_by_path, parse_errors_by_path)
             end
           end
         elsif io_boundary.file?(absolute) && extensions.any? { |ext| absolute.end_with?(ext) }