rigortype 0.4.5 → 0.4.7

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/mailer_discoverer.rb

@@ -19,9 +19,9 @@ module Rigor
       # - Reads the instance-side `def` nodes and records each one as an action method, capturing the
       #   arity envelope.
       # - For each (class, action) pair, attempts to read every candidate view template under
-      #   `app/views/<mailer_underscore>/<action>.{html,text}.erb`. Existing templates feed the
+      #   `app/views/<mailer_underscore>/<action>.{html,text}.{erb,haml,slim}`. Existing templates feed the
       #   IoBoundary's cache descriptor (so the cache invalidates when the template changes); missing
-      #   templates are recorded so the plugin can surface a diagnostic on the mailer class definition.
+      #   templates are recorded so the plugin can surface a diagnostic on the action's `def`.
       #
       # Limitations (intentional for v0.1.0):
       #
@@ -30,9 +30,6 @@ module Rigor
       # - Action methods are read from the syntactic instance-side `def` list. Methods built via
       #   `define_method`, `private`, or non-action helpers (e.g. methods starting with `_`) are out of
       #   scope. The discoverer filters obvious non-actions (`initialize`, names prefixed with `_`).
-      # - Adding a brand-new view file under `app/views/<mailer>/` will NOT invalidate the cached index
-      #   until something the mailer file touches changes. This is the standard read-tracking trade-off
-      #   — only files we successfully read get digested into the descriptor.
       class MailerDiscoverer
         DEFAULT_VIEWS_ROOT = "app/views"
         VIEW_FORMATS = %w[html text].freeze
@@ -56,22 +53,22 @@ module Rigor
           # Two-pass: first collect every module's defs (for the include-following step), then build
           # per-class entries that pull in actions from include'd modules. GitLab's `Notify` mailer
           # derives every action from `Emails::*` concerns under `app/mailers/emails/`.
-          module_actions = {} # module_fqn => Hash<Symbol, ActionEntry>
-          class_visits = []   # collected (class_name, path, def_nodes, includes)
+          module_actions = {} # fully-qualified module name => its action entries, keyed by method name
+          class_visits = []   # collected (class_name, path, def_nodes, includes, view_exempt)
 
           ruby_files_under(@search_paths).each do |path|
             contents = read_safely(path)
             next if contents.nil?
 
             tree = Prism.parse(contents).value
-            walk_for_mailers(tree, []) do |class_name, def_nodes, includes|
-              class_visits << [class_name, path, def_nodes, includes]
+            walk_for_mailers(tree, []) do |class_name, def_nodes, includes, view_exempt|
+              class_visits << [class_name, path, def_nodes, includes, view_exempt]
             end
             collect_module_actions(tree, [], module_actions)
           end
 
-          entries = class_visits.map do |class_name, path, def_nodes, includes|
-            build_class_entry(class_name, path, def_nodes, includes, module_actions)
+          entries = class_visits.map do |class_name, path, def_nodes, includes, view_exempt|
+            build_class_entry(class_name, path, def_nodes, includes, module_actions, view_exempt)
           end
           MailerIndex.new(entries)
         end
@@ -112,9 +109,9 @@ module Rigor
           full_name = declared_constant_name(class_local_name, lexical_path)
           superclass = strip_root(constant_path_name(node.superclass)) if node.superclass
           if superclass && @base_classes.include?(superclass)
-            def_nodes = collect_action_defs(node.body)
+            def_nodes, view_exempt = collect_action_defs(node.body)
             includes = collect_includes(node.body)
-            yield full_name, def_nodes, includes
+            yield full_name, def_nodes, includes, view_exempt
           end
 
           walk_for_mailers(node.body, [full_name], &) if node.body
@@ -139,8 +136,7 @@ module Rigor
         end
 
         # Walks the AST collecting every module's instance-side def nodes by fully-qualified module
-        # name. The same `collect_action_defs` filter applies (private / `_`-prefixed / callback-target
-        # methods skipped).
+        # name. The same `collect_action_defs` filter applies (private / `_`-prefixed skipped).
         def collect_module_actions(node, lexical_path, accumulator)
           return if node.nil?
 
@@ -151,8 +147,7 @@ module Rigor
 
             full_name = declared_constant_name(local_name, lexical_path)
             if node.body
-              def_nodes = collect_action_defs(node.body)
-              entries = def_nodes.to_h { |def_node| [def_node.name, build_action_entry(def_node)] }
+              entries = collect_action_defs(node.body).first.to_h { |def_node| [def_node.name, build_action_entry(def_node)] }
               # UNIONed, never assigned: a concern module reopened in a second file adds actions rather
               # than replacing the ones the first declaration spelled (same rule as {MailerIndex}'s
               # per-class merge).
@@ -216,80 +211,102 @@ module Rigor
         # - `initialize`
         # - methods starting with `_` (Ruby convention for private/internal)
         # - `def self.<name>` (singleton-side)
-        # - methods after a bare `private` (or `public` → `private` transition) — these are internal
-        #   helpers, not actions
-        # - methods named as a `private :foo` argument
-        # - methods named as a callback target (`before_action :name`, `after_action`, `around_action`)
+        # - methods that are not public at the end of the class body, read in source order: after a bare
+        #   `private` / `protected` (until a `public` switches back), named by `private :foo` /
+        #   `protected :foo`, or defined inline (`private def foo`) — Rails builds `action_methods` from the
+        #   public instance methods. `public :foo` after a `protected` section makes `foo` an action again.
+        # Methods named by a callback or `helper_method` macro (see {#collect_callback_names}) stay actions:
+        # Rails dispatches any public instance method, so `Mailer.target` still runs. They are returned as the
+        # view-exempt names, which exempt them from the missing-view check only.
         #
         # Pre-fix, Mastodon's `AdminMailer#process_params` / `set_instance` / `set_locale` /
         # `set_important_headers!` all surfaced as missing-view because the bare `private` keyword
         # wasn't honoured. ~19 false positives across Mastodon's mailers.
-        CALLBACK_DECLARATIONS = %i[before_action after_action around_action].freeze
-        private_constant :CALLBACK_DECLARATIONS
+        VISIBILITY_KEYWORDS = %i[public private protected module_function].freeze
+        private_constant :VISIBILITY_KEYWORDS
 
+        # Returns `[action_def_nodes, view_exempt_names]`. The view-exempt names are the callback and
+        # `helper_method` targets of the body: they remain actions, and only the missing-view check skips them.
         def collect_action_defs(body)
-          return [] if body.nil?
+          return [[], Set[]] if body.nil?
 
-          private_names, callback_names = collect_visibility_and_callbacks(body)
-          visibility = :public
+          callback_names = collect_callback_names(body)
+          def_nodes, final_visibility = scan_visibility(body)
 
-          body.compact_child_nodes.flat_map do |node|
-            visibility = next_visibility(node, visibility)
-            next [] unless node.is_a?(Prism::DefNode)
-            next [] if node.receiver.is_a?(Prism::SelfNode)
-            next [] if node.name == :initialize
-            next [] if node.name.to_s.start_with?("_")
-            next [] if visibility == :private
-            next [] if private_names.include?(node.name)
-            next [] if callback_names.include?(node.name)
+          actions = def_nodes.select do |node|
+            next false if node.receiver.is_a?(Prism::SelfNode)
+            next false if node.name == :initialize
+            next false if node.name.to_s.start_with?("_")
 
-            [node]
+            # Rails builds `action_methods` from the PUBLIC instance methods, so only a method whose final
+            # visibility is public is an action.
+            final_visibility[node.name] == :public
           end
+          [actions, callback_names]
         end
 
-        # First pass over the class body: collect (a) names passed to `private :foo` / `protected :foo`
-        # (explicit visibility-on-existing-method form), and (b) Symbol arguments to callback
-        # declarations (`before_action :setup`, etc.).
-        def collect_visibility_and_callbacks(body)
-          private_names = []
-          callback_names = []
-
+        # Symbol arguments to the macros the manifest's `per_invocation_non_action_macros` lists (`before_action
+        # :setup`, `after_deliver :record`, `helper_method :fmt`). The `skip_*` forms are left out, since
+        # `skip_before_action :x` names a callback a parent defined and does not exempt `x` from anything (#2319).
+        def collect_callback_names(body)
+          macros = Actionmailer.manifest.per_invocation_non_action_macros.reject { |macro| macro.start_with?("skip_") }
+          names = []
           body.rigor_each_child do |node|
-            next unless node.is_a?(Prism::CallNode) && node.receiver.nil?
+            next unless node.is_a?(Prism::CallNode) && node.receiver.nil? && macros.include?(node.name)
 
-            args = (node.arguments&.arguments || []).filter_map do |arg|
-              Rigor::Source::Literals.symbol(arg)
+            (node.arguments&.arguments || []).each do |arg|
+              symbol = Rigor::Source::Literals.symbol(arg)
+              names << symbol if symbol
             end
-            next if args.empty?
+          end
+          names.to_set
+        end
 
-            case node.name
-            when :private, :protected then private_names.concat(args)
-            when *CALLBACK_DECLARATIONS then callback_names.concat(args)
+        # Walks the class body in source order and returns `[def_nodes, final_visibility]`: every `def` the body
+        # spells (a direct statement or the inline argument of a visibility call, `private def x`), and the
+        # visibility each method name ends with. A bare `public` / `private` / `protected` / `module_function` sets
+        # the default for the defs after it; `private :x` / `public :x` / `protected def x` set that one method, whichever side of
+        # its `def` they fall on in the source, and the last statement to name a method wins.
+        def scan_visibility(body)
+          def_nodes = []
+          final_visibility = {}
+          default = :public
+
+          body.compact_child_nodes.each do |node|
+            case node
+            when Prism::DefNode
+              def_nodes << node
+              final_visibility[node.name] = default
+            when Prism::CallNode
+              default = apply_visibility_call(node, default, def_nodes, final_visibility)
             end
           end
 
-          [private_names.to_set, callback_names.to_set]
+          [def_nodes, final_visibility]
         end
 
-        # Returns the new visibility scope state after observing `node`. Bare `private` / `protected` /
-        # `public` switch state; the `private :foo` arg-bearing form does NOT (already handled by
-        # `collect_visibility_and_callbacks`).
-        def next_visibility(node, current)
-          return current unless node.is_a?(Prism::CallNode)
-          return current unless node.receiver.nil?
-          return current unless (args = node.arguments&.arguments).nil? || args.empty?
-
-          case node.name
-          when :private then :private
-          when :protected then :protected
-          when :public then :public
-          else current
+        # Applies one receiverless `public` / `private` / `protected` / `module_function` call and returns the
+        # (possibly new) default.
+        def apply_visibility_call(node, default, def_nodes, final_visibility)
+          return default unless node.receiver.nil? && VISIBILITY_KEYWORDS.include?(node.name)
+
+          args = node.arguments&.arguments || []
+          return node.name if args.empty?
+
+          args.flat_map { |arg| arg.is_a?(Prism::ArrayNode) ? arg.elements : [arg] }.each do |arg|
+            if arg.is_a?(Prism::DefNode)
+              def_nodes << arg
+              final_visibility[arg.name] = node.name
+            elsif (name = Rigor::Source::Literals.symbol_or_string(arg))
+              final_visibility[name] = node.name
+            end
           end
+          default
         end
 
-        def build_class_entry(class_name, file_path, def_nodes, includes = [], module_actions = {})
+        def build_class_entry(class_name, file_path, def_nodes, includes = [], module_actions = {}, view_exempt = Set[])
           actions = def_nodes.to_h do |def_node|
-            entry = build_action_entry(def_node)
+            entry = build_action_entry(def_node, view_exempt: view_exempt.include?(def_node.name))
             [entry.method_name, entry]
           end
 
@@ -309,7 +326,7 @@ module Rigor
             end
           end
 
-          missing_views = actions.keys.reject { |action| view_exists?(class_name, action) }
+          missing_views = actions.reject { |_, entry| entry.view_exempt }.keys.reject { |action| view_exists?(class_name, action) }
 
           MailerIndex::ClassEntry.new(
             class_name: class_name,
@@ -320,7 +337,7 @@ module Rigor
           )
         end
 
-        def build_action_entry(def_node)
+        def build_action_entry(def_node, view_exempt: false)
           parameters = def_node.parameters
           location = def_node.name_loc
 
@@ -329,7 +346,8 @@ module Rigor
               method_name: def_node.name,
               min_arity: 0, max_arity: 0,
               def_line: location.start_line,
-              def_column: location.start_column + 1
+              def_column: location.start_column + 1,
+              view_exempt: view_exempt
             )
           end
 
@@ -342,7 +360,8 @@ module Rigor
             min_arity: required_count,
             max_arity: rest_present ? Float::INFINITY : required_count + optional_count,
             def_line: location.start_line,
-            def_column: location.start_column + 1
+            def_column: location.start_column + 1,
+            view_exempt: view_exempt
           )
         end
 

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/mailer_index.rb

@@ -11,7 +11,9 @@ module Rigor
       #   the mailer file)
       # - the list of `(action, location)` pairs whose view templates are missing from `app/views/`
       class MailerIndex
-        ActionEntry = Data.define(:method_name, :min_arity, :max_arity, :def_line, :def_column) do
+        # `view_exempt` marks a callback or `helper_method` target: still an action (Rails dispatches it), but
+        # left out of the missing-view check.
+        ActionEntry = Data.define(:method_name, :min_arity, :max_arity, :def_line, :def_column, :view_exempt) do
           def arity_label
             return "#{min_arity}+" if max_arity == Float::INFINITY
             return min_arity.to_s if min_arity == max_arity
@@ -67,7 +69,7 @@ module Rigor
         end
 
         # @param file_path — absolute path of a mailer file (canonicalised — see plugin entry's
-        #   `harvest`)
+        #   `canonical_path`)
         def find_by_file(file_path)
           @entries.find { |entry| entry.file_path == file_path }
         end

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer.rb

@@ -11,7 +11,7 @@ module Rigor
   module Plugin
     # rigor-actionmailer — validates `Mailer.action(args)` call sites and detects missing view templates.
     #
-    # Tier 1C of the [Rails plugins roadmap](../../../../docs/design/20260508-rails-plugins-roadmap.md).
+    # Tier 1C of the [Rails plugins roadmap](../../../../../docs/design/20260508-rails-plugins-roadmap.md).
     # Statically discovers mailer classes by walking `mailer_search_paths` and parsing each file with
     # Prism — no `action_mailer` runtime dependency.
     #
@@ -38,8 +38,6 @@ module Rigor
     # - Direct-superclass match only.
     # - Action methods are read from the syntactic instance-side `def` list. `define_method` actions are
     #   out of scope.
-    # - Adding a brand-new view file does not invalidate the cache until something the mailer file
-    #   touches changes.
     class Actionmailer < Rigor::Plugin::Base
       manifest(
         id: "actionmailer",
@@ -52,13 +50,36 @@ module Rigor
         # Bumped 2026-09-02 (#621) — mailer keys are de-rooted at the producer and a reopened class's
         # actions are UNIONed rather than clobbered, so a cached 0.4.0 index can be missing actions this
         # version knows about.
-        version: "0.5.0",
+        #
+        # Bumped 2026-10-23 (#2308) — a method after a bare `protected` is no longer an action, so a cached 0.5.0
+        # index can list protected helpers as actions (and as missing-view candidates).
+        #
+        # Bumped 2026-10-26 (#2319) — a method named by a callback or `helper_method` macro (`prepend_before_action`,
+        # `after_deliver`, `helper_method`, ...) no longer draws a missing-view row, and a method defined after a bare
+        # `module_function` is no longer an action, so a cached 0.5.1 index can carry those rows and actions.
+        version: "0.5.2",
         description: "Validates ActionMailer call shape and view template existence.",
         config_schema: {
           "mailer_search_paths" => { kind: :array, default: ["app/mailers"] },
           "mailer_base_classes" => { kind: :array, default: %w[ApplicationMailer ActionMailer::Base] },
           "views_root" => { kind: :string, default: "app/views" }
         },
+        # ADR-125 (#575, #2308) — a mailer instance serves exactly one action (`Mailer.welcome(...)` builds a
+        # fresh instance and runs that one method), so ivar writes in two different public actions are never live
+        # together and `def.ivar-write-mismatch` stops comparing them. `ActionMailer::Base` has no signature here;
+        # the rule matches an undeclared superclass by its written name.
+        per_invocation_classes: ["ActionMailer::Base"],
+        # A public method these macros name is a callback or a view helper, not an action: it runs inside
+        # whichever action triggers it (AbstractController::Callbacks / Helpers), so its writes stay compared with
+        # every action's. The actionpack list, plus the `*_deliver` callbacks (ActionMailer::Callbacks), which run
+        # on the action's own instance.
+        per_invocation_non_action_macros: %i[
+          before_action prepend_before_action append_before_action skip_before_action
+          after_action prepend_after_action append_after_action skip_after_action
+          around_action prepend_around_action append_around_action skip_around_action
+          before_deliver after_deliver around_deliver
+          helper_method
+        ],
         # ADR-103 WD10 (#387) — see {Effects} for what each row is and why.
         effect_root: "rails",
         effect_labels: ["rails.actionmailer.deliver"],

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/analyzer.rb

@@ -102,7 +102,7 @@ module Rigor
 
         # Phase 2 — filter-chain validation for ONE filter-DSL call (`before_action :name`, …). The
         # enclosing controller is read from the node-rule `NodeContext` ancestors, looked up in the
-        # controller index to get the effective method set (including one level of inheritance), and
+        # controller index to get the effective method set (including inherited methods), and
         # each filter name reference is validated against it. Calls outside a known controller
         # contribute nothing.
         #

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_index.rb

@@ -6,8 +6,7 @@ module Rigor
       # Per-run frozen index of discovered controllers AND concerns (modules) in
       # `controller_search_paths`. Phase 2 (filter-chain validation) consults the index at every call
       # site to check that `before_action :name` references a method that actually exists on the
-      # controller, its parent (one level of inheritance), or any module the controller or its ancestor
-      # chain transitively `include`s.
+      # controller, any ancestor, or any module the controller or an ancestor transitively `include`s.
       #
       # Real-world example (Mastodon):
       #   AccountsController < ApplicationController
@@ -169,9 +168,6 @@ module Rigor
         # and returning the first candidate that has an entry in the index. When nothing resolves,
         # return the original name unchanged — the caller treats unresolved entries as "gem-shipped
         # concerns we cannot see" (the `unresolved_include?` predicate).
-        #
-        # `name` may already be qualified (`Foo::Bar`); we only try lexical prefixing when the
-        # unqualified first segment doesn't match a top-level entry.
         def resolve_constant_lexically(name, enclosing)
           return nil if name.nil?
 

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_scan.rb

@@ -83,7 +83,6 @@ module Rigor
           end.to_h
         end
 
-        # Every implicit-self `render` call node under `node`, at any depth.
         def each_render(node, &)
           return unless node.is_a?(Prism::Node)
 

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/erb_compiler.rb

@@ -229,7 +229,8 @@ module Rigor
         # been measured. Resolved ONCE per process: a failed resolution is as memoised as a successful
         # one, so a project without Erubi does not pay a `$LOAD_PATH` walk per template.
         #
-        # `Isolation.require_with_target_bundle` is [ADR-90](../../../../../../docs/adr/90-target-library-resolution-from-project-bundle.md)'s
+        # `Isolation.require_with_target_bundle` is
+        # [ADR-90](../../../../../../docs/adr/90-target-library-resolution-from-project-bundle.md)'s
         # path — Rigor's own gem env first, then the analysed project's bundle, `$LOAD_PATH` appended and
         # only on a failed require. Erubi is not a Rigor dependency and is never added to one. Any load
         # failure is equally "no Erubi here"; stdlib `ERB` answers the same question, so nothing is

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/view_assigns.rb

@@ -18,7 +18,7 @@ module Rigor
       # ## The inference is deliberately narrow
       #
       # Only `@user = Model.find(...)`-shaped assignments contribute, and only for a closed set of
-      # constructors and finders that **cannot return nil** — `find`, `find_by!`, `sole`, `first!`,
+      # constructors and finders that **cannot return nil** — `find`, `find_by!`, `find_sole_by`, `sole`, `first!`,
       # `last!`, `new`, `create`, `create!`. A seeded type is a claim the engine acts on, and a wrong one
       # is worse than none: seeding `@user` from `find_by` (which returns nil at runtime) would hand the
       # flow rules a non-nil nominal and license folds that draw diagnostics on correct templates — the

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -20,7 +20,7 @@ module Rigor
     # fact published by `rigor-rails-routes` (ADR-9 cross-plugin API) and validates every implicit-self
     # `*_path` / `*_url` call inside files under `controller_search_paths` (default `app/controllers`).
     #
-    # Tier 2 of the [Rails plugins roadmap](../../../../docs/design/20260508-rails-plugins-roadmap.md).
+    # Tier 2 of the [Rails plugins roadmap](../../../../../docs/design/20260508-rails-plugins-roadmap.md).
     # Phase 1 (strong-parameters → AR column validation), Phase 2 (filter chains), and Phase 3 (render
     # targets) ship as separate slices; each phase composes additively under the same plugin id.
     #
@@ -37,14 +37,10 @@ module Rigor
     #
     # ## What it checks
     #
-    # - **Helper existence** — every `*_path` / `*_url` call inside a controller file is looked up in
-    #   the helper table. Missing entries emit `unknown-helper` with a `DidYouMean` suggestion drawn
-    #   from the table.
-    # - **Helper arity** — the call's positional-argument count is matched against the helper's
-    #   recorded arity (a trailing `KeywordHashNode` like `users_path(format: :json)` is excluded; same
-    #   convention `rigor-rails-routes` uses). Mismatches emit `wrong-helper-arity`.
-    # - **Trace** — recognised helpers also emit a `helper-call` info diagnostic naming the action and
-    #   path, mirroring the trace shape of the upstream plugin.
+    # - **Trace** — recognised `*_path` / `*_url` helpers emit a `helper-call` info diagnostic naming
+    #   the action and path. Unknown helpers (`unknown-helper`) and arity mismatches (`wrong-arity`)
+    #   are reported by `rigor-rails-routes`, which owns the helper table, so this plugin does not
+    #   repeat them.
     #
     # ## Limitations
     #
@@ -88,7 +84,9 @@ module Rigor
         # the engine reads as "a template exists here and has no unit". The bump is belt-and-braces: what
         # actually invalidates is the claim itself, through the glob row in `TemplateUnits#digest` and the
         # `claimed_globs` equality the carry checks. A manifest version is in no cache key of its own.
-        version: "1.5.0",
+        # Bumped 2026-10-27 (#2430) — `params[...]` answers the gradual `Dynamic[Parameters | nil]` rather than
+        # the bare union, so a cached 1.5.0 run carries the non-gradual answer at every `params[:k]` argument.
+        version: "1.6.0",
         description: "Validates Action Pack route-helper calls and filter chains inside controllers, and types the request-context readers (`params` / `session` / `request` / `flash`) and their chains.",
         config_schema: {
           "controller_search_paths" => { kind: :array, default: ["app/controllers"] },
@@ -146,6 +144,19 @@ module Rigor
           # `sig/action_view.rbs` so the name resolves, open so the helper surface stays lenient.
           "ActionView::Base"
         ],
+        # ADR-125 (#575) — Rails instantiates a fresh controller per request and runs exactly one action on
+        # it, so ivar writes in two different public actions are never live together and
+        # `def.ivar-write-mismatch` stops comparing them. Neither root has a signature (see `sig/action_controller.rbs`
+        # for why); the rule matches an undeclared superclass by its written name.
+        per_invocation_classes: ["ActionController::Base", "ActionController::API"],
+        # A public method these macros name is a callback or a view helper, not an action: it runs inside
+        # whichever action triggers it, so its writes stay compared with every action's (#575's A1 decision).
+        per_invocation_non_action_macros: %i[
+          before_action prepend_before_action append_before_action skip_before_action
+          after_action prepend_after_action append_after_action skip_after_action
+          around_action prepend_around_action append_around_action skip_around_action
+          helper_method
+        ],
         # ADR-103 WD10 / WD14 (#387) — see {Effects} for what each row is and why.
         effect_root: "rails",
         effect_labels: %w[
@@ -462,7 +473,7 @@ module Rigor
       # `ActionController::Parameters` (above), but the chained `params.require(:user).permit(:name)` /
       # `params.permit(...)` calls returned `Dynamic` at the first hop (Parameters ships no bundled RBS,
       # so a call on it resolves lenient-to-Dynamic), leaking every downstream site (`.permit`, `.to_h`,
-      # `.each`) to unprotected. These three methods return another `Parameters`, so gate on a
+      # `.each`) to unprotected. These methods return another `Parameters`, so gate on a
       # `Parameters` receiver and re-type the result as the same lenient nominal — the chain stays a
       # concrete receiver end-to-end and `coverage --protection` counts the sites as protected.
       #
@@ -484,9 +495,9 @@ module Rigor
       # entry FP-safe, because the RBS-less nominal buys leniency on the *method surface* only:
       #
       # - Method-surface rules DO decline on it. `call.undefined-method` bails at
-      #   `Rigor::Reflection.rbs_class_known?` (lib/rigor/analysis/check_rules.rb:720) because Rigor
-      #   ships no RBS for Parameters, and the argument / arity rules gate on the same predicate
-      #   (:1151, :2126). So `params.slice(:a).whatever_rails_adds` never fires, and a scalar-shaped
+      #   `Rigor::Reflection.rbs_class_known?` (lib/rigor/analysis/check_rules.rb) because Rigor
+      #   ships no RBS for Parameters, and the argument / arity rules gate on the same predicate. So
+      #   `params.slice(:a).whatever_rails_adds` never fires, and a scalar-shaped
       #   use of a Parameters-typed value (`.to_i`, `.strip`, string interpolation) resolves lenient
       #   -to-Dynamic rather than to a diagnostic.
       # - **Flow rules do NOT.** Truthiness folding, ternary arm selection and `.nil?` folding key on
@@ -529,7 +540,7 @@ module Rigor
       #   and still carries the chain — `params[:user][:name]` types `Parameters?` and
       #   `params[:user].permit(:name)` types `Parameters`, because the dispatcher strips the nil arm
       #   for the receiver gate. Idiomatic *chained* reads stay silent too: `call.possible-nil-receiver`
-      #   restricts itself to `Prism::LocalVariableReadNode` receivers (`CheckRules#nil_receiver_diagnostic`'s local-read restriction), so
+      #   restricts itself to `Prism::LocalVariableReadNode` receivers (`CheckRules#nil_receiver_diagnostic`), so
       #   `params[:q].strip` cannot fire. What it does fire on is the assigned form — `q = params[:q];
       #   q.strip` — at **error** severity, once per unguarded use. Guarded forms (`return if q.nil?`,
       #   `if q`, `q&.strip`, `|| ""`) all narrow correctly and stay silent, so this is not a broken
@@ -551,7 +562,8 @@ module Rigor
       # The control specs stay, and they still bite: they pin the HAZARD (no truthiness fold, no `bot`
       # branch, no possible-nil firing), not the Dynamic answer, so they go red if either typing's
       # hazard ever returns — and they now carry a positive assertion that `params[:k]` types
-      # `Parameters?`, so a silent regression to `Dynamic` or to the non-nil nominal fails them too.
+      # `Dynamic[ActionController::Parameters?]` (#2430), so a silent regression to bare `Dynamic[top]`
+      # or to the non-nil nominal fails them too.
       STRONG_PARAMS_CHAIN_METHODS = %i[
         require permit permit! expect slice
         except without extract! slice!
@@ -565,6 +577,16 @@ module Rigor
         Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params])
       end
 
+      # Issue #2430 — the chain on a `params[...]` carrier (`params[:user].permit(:name)`). The result stays
+      # a `Dynamic` of the same nominal, so it crosses a declared boundary as the carrier does.
+      dynamic_return methods: STRONG_PARAMS_CHAIN_METHODS do |call_node, scope|
+        next nil unless call_node.is_a?(Prism::CallNode) && call_node.receiver
+        next nil unless controller_scope?(scope)
+        next nil unless params_carrier_facet?(scope.type_of(call_node.receiver))
+
+        Rigor::Type::Combinator.dynamic(Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]))
+      end
+
       # Issue #534 item 1, reopened by #574. `#[]` is the single largest named-receiver pair on both survey
       # apps (redmine 581, mastodon ~475). The honest contract is `Parameters | nil` — a missing key really
       # returns nil — and the block comment above records why that typing was REJECTED in 2026-09-01: it put
@@ -580,15 +602,53 @@ module Rigor
       #
       # The non-nil `-> Parameters` typing stays rejected on its own merits, unchanged: it makes every
       # `params[:k]` condition always-truthy and folds a ternary over one to its true arm.
+      #
+      # Issue #2430 — the answer is a GRADUAL carrier, `Dynamic[Parameters | nil]`, not the bare union.
+      # A declared boundary (a `String` parameter, a `-> String` return) rejects the bare union, because
+      # `Acceptance` passes only a `Dynamic` through every boundary, and a scalar param is a `String` at
+      # runtime. The static facet keeps the strong-params chain typed: the carrier-gated rules below
+      # dispatch on the facet, so `params[:user][:name]` and `params[:user].permit(:name)` keep resolving.
+      # The control hazards (no truthiness fold, no `bot`, no possible-nil on `q = params[:q]`) are
+      # unchanged, because the facet is the same `Parameters | nil` union.
       dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: %i[[]] do |call_node, _scope|
         next nil unless call_node.is_a?(Prism::CallNode)
 
-        Rigor::Type::Combinator.union(
-          Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]),
-          Rigor::Type::Combinator.constant_of(nil)
+        params_read_type
+      end
+
+      # Issue #2430 — `Dynamic` is not a `Nominal`, so the receiver-gated rules never see a carrier
+      # receiver. These two rules gate on the carrier's facet instead, and only inside a controller: a
+      # carrier is minted by the `params` reader, which is controller-only, so no other scope can hold one.
+      dynamic_return methods: %i[[]] do |call_node, scope|
+        next nil unless call_node.is_a?(Prism::CallNode) && call_node.receiver
+        next nil unless controller_scope?(scope)
+        next nil unless params_carrier_facet?(scope.type_of(call_node.receiver))
+
+        params_read_type
+      end
+
+      # The `params` carrier's static facet as a `Dynamic`: `Parameters | nil`, gradual at every boundary.
+      def params_read_type
+        Rigor::Type::Combinator.dynamic(
+          Rigor::Type::Combinator.union(
+            Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]),
+            Rigor::Type::Combinator.constant_of(nil)
+          )
         )
       end
 
+      # True when `type` is a `Dynamic` whose facet is `Parameters` or `Parameters | nil`: the carrier a
+      # `params[...]` read answers, and the value a chained `[]` / strong-params call receives.
+      def params_carrier_facet?(type)
+        return false unless type.is_a?(Rigor::Type::Dynamic)
+
+        facet = type.static_facet
+        members = facet.is_a?(Rigor::Type::Union) ? facet.members : [facet]
+        non_nil = members.reject { |member| member.is_a?(Rigor::Type::Constant) && member.value.nil? }
+        non_nil.size == 1 && non_nil.first.is_a?(Rigor::Type::Nominal) &&
+          non_nil.first.class_name == REQUEST_CONTEXT_READER_TYPES[:params]
+      end
+
       # Phase 5c (2026-09-02, issue #534 "same lane") — the rest of the request-context surface the
       # corpus sweep measured after the #578 / #585 batch: `request.post?` 28 and `request.xhr?` 27 on
       # the two apps, `flash.now` inside the redmine 147 / mastodon 29 flash cluster. Each is typed from

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/effects.rb

@@ -35,7 +35,7 @@ module Rigor
 
         # Where a Rails app declares its adapter. Per-environment files are read too, because an app that
         # sets the adapter only in `config/environments/production.rb` is common; agreement across every
-        # file that names one is what licenses the narrowing (see {.transport_for}).
+        # file that names one is what licenses the narrowing (see {.detect_adapter}).
         CONFIG_PATHS = ["config/application.rb", "config/environments"].freeze
 
         SETTING = /queue_adapter\s*=\s*[:"']([a-z_]+)["']?/

data/plugins/rigor-activejob/lib/rigor/plugin/activejob.rb

@@ -13,7 +13,7 @@ module Rigor
     # rigor-activejob — validates `Job.perform_later(...)` / `.perform_now(...)` / `.perform(...)`
     # argument arity against the discovered `#perform` definitions.
     #
-    # Tier 1D of the [Rails plugins roadmap](../../../../docs/design/20260508-rails-plugins-roadmap.md).
+    # Tier 1D of the [Rails plugins roadmap](../../../../../docs/design/20260508-rails-plugins-roadmap.md).
     # Statically discovers ActiveJob subclasses by walking the configured `job_search_paths` and
     # parsing each file with Prism — no `active_job` runtime dependency.
     #
@@ -97,8 +97,11 @@ module Rigor
 
       # Cached separately from `:job_index` because the two invalidate on different files: editing a
       # schedule changes which jobs are reached without touching `app/jobs` at all. The `watch:` roots the
-      # glob at the working directory so that CREATING a schedule file — not just editing one — is seen.
-      producer :recurring_jobs, watch: -> { [[".", *@recurring_paths]] } do |_params|
+      # glob at the working directory so that CREATING a schedule file — not just editing one — is seen. Each
+      # configured path is escaped to a literal name, so `recurring[1].yml` is watched as that file, and an
+      # absolute path is watched under its own directory (`RootedGlob.split_file`, #2222).
+      producer :recurring_jobs,
+               watch: -> { @recurring_paths.map { |path| Rigor::RootedGlob.split_file(path) } } do |_params|
         RecurringScan.new(
           io_boundary: io_boundary,
           recurring_paths: @recurring_paths

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/association_roots.rb

@@ -20,8 +20,9 @@ module Rigor
       #
       # Declined — no root, never a guess: a polymorphic association (no single target), a non-literal
       # `class_name:` / `**opts`, `anonymous_class:`, a `with_options` group with non-literal options, and a
-      # `through:` association without a literal `class_name:` / `source_type:`. Without them a `through:` target is the SOURCE association's class on the through model, and
-      # that association (declared there, hence in this same index) roots it itself.
+      # `through:` association without a literal `class_name:` / `source_type:`. Without them a `through:`
+      # target is the SOURCE association's class on the through model, and that association (declared
+      # there, hence in this same index) roots it itself.
       #
       # A computed name equal to the owner's own demodulized name declines too (Rails 7.2+ tries `::Name`
       # first; the target is then the owner itself or a top-level class).