rigortype 0.4.6 → 0.4.7

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -20,7 +20,7 @@ module Rigor
     # fact published by `rigor-rails-routes` (ADR-9 cross-plugin API) and validates every implicit-self
     # `*_path` / `*_url` call inside files under `controller_search_paths` (default `app/controllers`).
     #
-    # Tier 2 of the [Rails plugins roadmap](../../../../docs/design/20260508-rails-plugins-roadmap.md).
+    # Tier 2 of the [Rails plugins roadmap](../../../../../docs/design/20260508-rails-plugins-roadmap.md).
     # Phase 1 (strong-parameters → AR column validation), Phase 2 (filter chains), and Phase 3 (render
     # targets) ship as separate slices; each phase composes additively under the same plugin id.
     #
@@ -37,14 +37,10 @@ module Rigor
     #
     # ## What it checks
     #
-    # - **Helper existence** — every `*_path` / `*_url` call inside a controller file is looked up in
-    #   the helper table. Missing entries emit `unknown-helper` with a `DidYouMean` suggestion drawn
-    #   from the table.
-    # - **Helper arity** — the call's positional-argument count is matched against the helper's
-    #   recorded arity (a trailing `KeywordHashNode` like `users_path(format: :json)` is excluded; same
-    #   convention `rigor-rails-routes` uses). Mismatches emit `wrong-helper-arity`.
-    # - **Trace** — recognised helpers also emit a `helper-call` info diagnostic naming the action and
-    #   path, mirroring the trace shape of the upstream plugin.
+    # - **Trace** — recognised `*_path` / `*_url` helpers emit a `helper-call` info diagnostic naming
+    #   the action and path. Unknown helpers (`unknown-helper`) and arity mismatches (`wrong-arity`)
+    #   are reported by `rigor-rails-routes`, which owns the helper table, so this plugin does not
+    #   repeat them.
     #
     # ## Limitations
     #
@@ -88,7 +84,9 @@ module Rigor
         # the engine reads as "a template exists here and has no unit". The bump is belt-and-braces: what
         # actually invalidates is the claim itself, through the glob row in `TemplateUnits#digest` and the
         # `claimed_globs` equality the carry checks. A manifest version is in no cache key of its own.
-        version: "1.5.0",
+        # Bumped 2026-10-27 (#2430) — `params[...]` answers the gradual `Dynamic[Parameters | nil]` rather than
+        # the bare union, so a cached 1.5.0 run carries the non-gradual answer at every `params[:k]` argument.
+        version: "1.6.0",
         description: "Validates Action Pack route-helper calls and filter chains inside controllers, and types the request-context readers (`params` / `session` / `request` / `flash`) and their chains.",
         config_schema: {
           "controller_search_paths" => { kind: :array, default: ["app/controllers"] },
@@ -475,7 +473,7 @@ module Rigor
       # `ActionController::Parameters` (above), but the chained `params.require(:user).permit(:name)` /
       # `params.permit(...)` calls returned `Dynamic` at the first hop (Parameters ships no bundled RBS,
       # so a call on it resolves lenient-to-Dynamic), leaking every downstream site (`.permit`, `.to_h`,
-      # `.each`) to unprotected. These three methods return another `Parameters`, so gate on a
+      # `.each`) to unprotected. These methods return another `Parameters`, so gate on a
       # `Parameters` receiver and re-type the result as the same lenient nominal — the chain stays a
       # concrete receiver end-to-end and `coverage --protection` counts the sites as protected.
       #
@@ -497,9 +495,9 @@ module Rigor
       # entry FP-safe, because the RBS-less nominal buys leniency on the *method surface* only:
       #
       # - Method-surface rules DO decline on it. `call.undefined-method` bails at
-      #   `Rigor::Reflection.rbs_class_known?` (lib/rigor/analysis/check_rules.rb:720) because Rigor
-      #   ships no RBS for Parameters, and the argument / arity rules gate on the same predicate
-      #   (:1151, :2126). So `params.slice(:a).whatever_rails_adds` never fires, and a scalar-shaped
+      #   `Rigor::Reflection.rbs_class_known?` (lib/rigor/analysis/check_rules.rb) because Rigor
+      #   ships no RBS for Parameters, and the argument / arity rules gate on the same predicate. So
+      #   `params.slice(:a).whatever_rails_adds` never fires, and a scalar-shaped
       #   use of a Parameters-typed value (`.to_i`, `.strip`, string interpolation) resolves lenient
       #   -to-Dynamic rather than to a diagnostic.
       # - **Flow rules do NOT.** Truthiness folding, ternary arm selection and `.nil?` folding key on
@@ -542,7 +540,7 @@ module Rigor
       #   and still carries the chain — `params[:user][:name]` types `Parameters?` and
       #   `params[:user].permit(:name)` types `Parameters`, because the dispatcher strips the nil arm
       #   for the receiver gate. Idiomatic *chained* reads stay silent too: `call.possible-nil-receiver`
-      #   restricts itself to `Prism::LocalVariableReadNode` receivers (`CheckRules#nil_receiver_diagnostic`'s local-read restriction), so
+      #   restricts itself to `Prism::LocalVariableReadNode` receivers (`CheckRules#nil_receiver_diagnostic`), so
       #   `params[:q].strip` cannot fire. What it does fire on is the assigned form — `q = params[:q];
       #   q.strip` — at **error** severity, once per unguarded use. Guarded forms (`return if q.nil?`,
       #   `if q`, `q&.strip`, `|| ""`) all narrow correctly and stay silent, so this is not a broken
@@ -564,7 +562,8 @@ module Rigor
       # The control specs stay, and they still bite: they pin the HAZARD (no truthiness fold, no `bot`
       # branch, no possible-nil firing), not the Dynamic answer, so they go red if either typing's
       # hazard ever returns — and they now carry a positive assertion that `params[:k]` types
-      # `Parameters?`, so a silent regression to `Dynamic` or to the non-nil nominal fails them too.
+      # `Dynamic[ActionController::Parameters?]` (#2430), so a silent regression to bare `Dynamic[top]`
+      # or to the non-nil nominal fails them too.
       STRONG_PARAMS_CHAIN_METHODS = %i[
         require permit permit! expect slice
         except without extract! slice!
@@ -578,6 +577,16 @@ module Rigor
         Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params])
       end
 
+      # Issue #2430 — the chain on a `params[...]` carrier (`params[:user].permit(:name)`). The result stays
+      # a `Dynamic` of the same nominal, so it crosses a declared boundary as the carrier does.
+      dynamic_return methods: STRONG_PARAMS_CHAIN_METHODS do |call_node, scope|
+        next nil unless call_node.is_a?(Prism::CallNode) && call_node.receiver
+        next nil unless controller_scope?(scope)
+        next nil unless params_carrier_facet?(scope.type_of(call_node.receiver))
+
+        Rigor::Type::Combinator.dynamic(Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]))
+      end
+
       # Issue #534 item 1, reopened by #574. `#[]` is the single largest named-receiver pair on both survey
       # apps (redmine 581, mastodon ~475). The honest contract is `Parameters | nil` — a missing key really
       # returns nil — and the block comment above records why that typing was REJECTED in 2026-09-01: it put
@@ -593,15 +602,53 @@ module Rigor
       #
       # The non-nil `-> Parameters` typing stays rejected on its own merits, unchanged: it makes every
       # `params[:k]` condition always-truthy and folds a ternary over one to its true arm.
+      #
+      # Issue #2430 — the answer is a GRADUAL carrier, `Dynamic[Parameters | nil]`, not the bare union.
+      # A declared boundary (a `String` parameter, a `-> String` return) rejects the bare union, because
+      # `Acceptance` passes only a `Dynamic` through every boundary, and a scalar param is a `String` at
+      # runtime. The static facet keeps the strong-params chain typed: the carrier-gated rules below
+      # dispatch on the facet, so `params[:user][:name]` and `params[:user].permit(:name)` keep resolving.
+      # The control hazards (no truthiness fold, no `bot`, no possible-nil on `q = params[:q]`) are
+      # unchanged, because the facet is the same `Parameters | nil` union.
       dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: %i[[]] do |call_node, _scope|
         next nil unless call_node.is_a?(Prism::CallNode)
 
-        Rigor::Type::Combinator.union(
-          Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]),
-          Rigor::Type::Combinator.constant_of(nil)
+        params_read_type
+      end
+
+      # Issue #2430 — `Dynamic` is not a `Nominal`, so the receiver-gated rules never see a carrier
+      # receiver. These two rules gate on the carrier's facet instead, and only inside a controller: a
+      # carrier is minted by the `params` reader, which is controller-only, so no other scope can hold one.
+      dynamic_return methods: %i[[]] do |call_node, scope|
+        next nil unless call_node.is_a?(Prism::CallNode) && call_node.receiver
+        next nil unless controller_scope?(scope)
+        next nil unless params_carrier_facet?(scope.type_of(call_node.receiver))
+
+        params_read_type
+      end
+
+      # The `params` carrier's static facet as a `Dynamic`: `Parameters | nil`, gradual at every boundary.
+      def params_read_type
+        Rigor::Type::Combinator.dynamic(
+          Rigor::Type::Combinator.union(
+            Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]),
+            Rigor::Type::Combinator.constant_of(nil)
+          )
         )
       end
 
+      # True when `type` is a `Dynamic` whose facet is `Parameters` or `Parameters | nil`: the carrier a
+      # `params[...]` read answers, and the value a chained `[]` / strong-params call receives.
+      def params_carrier_facet?(type)
+        return false unless type.is_a?(Rigor::Type::Dynamic)
+
+        facet = type.static_facet
+        members = facet.is_a?(Rigor::Type::Union) ? facet.members : [facet]
+        non_nil = members.reject { |member| member.is_a?(Rigor::Type::Constant) && member.value.nil? }
+        non_nil.size == 1 && non_nil.first.is_a?(Rigor::Type::Nominal) &&
+          non_nil.first.class_name == REQUEST_CONTEXT_READER_TYPES[:params]
+      end
+
       # Phase 5c (2026-09-02, issue #534 "same lane") — the rest of the request-context surface the
       # corpus sweep measured after the #578 / #585 batch: `request.post?` 28 and `request.xhr?` 27 on
       # the two apps, `flash.now` inside the redmine 147 / mastodon 29 flash cluster. Each is typed from

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/effects.rb

@@ -35,7 +35,7 @@ module Rigor
 
         # Where a Rails app declares its adapter. Per-environment files are read too, because an app that
         # sets the adapter only in `config/environments/production.rb` is common; agreement across every
-        # file that names one is what licenses the narrowing (see {.transport_for}).
+        # file that names one is what licenses the narrowing (see {.detect_adapter}).
         CONFIG_PATHS = ["config/application.rb", "config/environments"].freeze
 
         SETTING = /queue_adapter\s*=\s*[:"']([a-z_]+)["']?/

data/plugins/rigor-activejob/lib/rigor/plugin/activejob.rb

@@ -13,7 +13,7 @@ module Rigor
     # rigor-activejob — validates `Job.perform_later(...)` / `.perform_now(...)` / `.perform(...)`
     # argument arity against the discovered `#perform` definitions.
     #
-    # Tier 1D of the [Rails plugins roadmap](../../../../docs/design/20260508-rails-plugins-roadmap.md).
+    # Tier 1D of the [Rails plugins roadmap](../../../../../docs/design/20260508-rails-plugins-roadmap.md).
     # Statically discovers ActiveJob subclasses by walking the configured `job_search_paths` and
     # parsing each file with Prism — no `active_job` runtime dependency.
     #
@@ -98,9 +98,10 @@ module Rigor
       # Cached separately from `:job_index` because the two invalidate on different files: editing a
       # schedule changes which jobs are reached without touching `app/jobs` at all. The `watch:` roots the
       # glob at the working directory so that CREATING a schedule file — not just editing one — is seen. Each
-      # configured path is escaped to a literal name, so `recurring[1].yml` is watched as that file.
+      # configured path is escaped to a literal name, so `recurring[1].yml` is watched as that file, and an
+      # absolute path is watched under its own directory (`RootedGlob.split_file`, #2222).
       producer :recurring_jobs,
-               watch: -> { [[".", *@recurring_paths.map { |path| Rigor::RootedGlob.literal(path) }]] } do |_params|
+               watch: -> { @recurring_paths.map { |path| Rigor::RootedGlob.split_file(path) } } do |_params|
         RecurringScan.new(
           io_boundary: io_boundary,
           recurring_paths: @recurring_paths

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/association_roots.rb

@@ -20,8 +20,9 @@ module Rigor
       #
       # Declined — no root, never a guess: a polymorphic association (no single target), a non-literal
       # `class_name:` / `**opts`, `anonymous_class:`, a `with_options` group with non-literal options, and a
-      # `through:` association without a literal `class_name:` / `source_type:`. Without them a `through:` target is the SOURCE association's class on the through model, and
-      # that association (declared there, hence in this same index) roots it itself.
+      # `through:` association without a literal `class_name:` / `source_type:`. Without them a `through:`
+      # target is the SOURCE association's class on the through model, and that association (declared
+      # there, hence in this same index) roots it itself.
       #
       # A computed name equal to the owner's own demodulized name declines too (Rails 7.2+ tries `::Name`
       # first; the target is then the owner itself or a top-level class).

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/effects.rb

@@ -28,8 +28,8 @@ module Rigor
       #
       # An `ActiveRecord::Base` row reaches `User.find` through the project's own
       # `User < ApplicationRecord < ActiveRecord::Base` lines, so one row covers every model in the app.
-      # That is the whole economy of the framework layer: thirty-odd rows here colour the several thousand
-      # database touches a Rails app performs, and none of them needed a line of application code.
+      # That is the whole economy of the framework layer: a fixed set of rows here colours the several
+      # thousand database touches a Rails app performs, and none of them needed a line of application code.
       module Effects
         BASE = "ActiveRecord::Base"
         RELATION = "ActiveRecord::Relation"

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/model_discoverer.rb

@@ -186,27 +186,20 @@ module Rigor
           merge_redeclarations(rows)
         end
 
-        # Collapses the rows that declare the SAME constant into one, so {ModelIndex.build} — which keys
-        # its entries by `class_name` — receives at most one row per model.
+        # Collapses the rows that declare the SAME constant into one, so {ModelIndex.build} (keyed by
+        # `class_name`) receives at most one row per model.
         #
-        # A model is routinely declared more than once: `app/models/user.rb` holds `class User <
-        # ApplicationRecord` and a second file reopens it (`class ::User`, `class User`, or a full
-        # `class User < ApplicationRecord` redeclaration) to add a method. Ruby's own semantics are
-        # ADDITIVE — a reopen contributes what it spells and leaves the rest of the class alone — so the
-        # rows are UNIONed here. Taking the last row instead dropped the real declaration's associations,
-        # scopes, enums, validations, callbacks and `alias_attribute`s whenever the reopen sorted later in
-        # the glob, and `where(<a declared alias>: …)` then surfaced a false `unknown-column` on correct
-        # code; taking the first dropped whatever the reopen added. Neither order loses anything now.
+        # A model is routinely declared more than once (`app/models/user.rb` plus a reopening file). Ruby's
+        # semantics are ADDITIVE, so the rows are UNIONed. Taking the last row dropped the real declaration's
+        # associations, scopes, enums, validations, callbacks and `alias_attribute`s whenever the reopen sorted
+        # later, producing false `unknown-column`s; taking the first dropped what the reopen added.
         #
-        # Merge is by field: the first non-nil `superclass_name` wins (a second declaration is the same
-        # thing, or invalid Ruby); `self.table_name =` is an ASSIGNMENT, so the LATER declaration's
-        # `table_name_override` wins as it does at load time, and when the two declarations disagree the
-        # resolved name is marked computed so no value is pinned — the glob order is not the load order for
-        # two full declarations, and a pinned wrong literal folds `Model.table_name == "…"` on correct code;
-        # `table_name_computed` is otherwise an OR (any computed name in the class makes the resolved one
-        # inexact); name-keyed rows (associations, enums, aliases) let the LAST declaration override an
-        # earlier same-name row exactly as {ModelIndex.merge_named_rows} does across an STI chain, and the
-        # plain lists union.
+        # Merge is by field: the first non-nil `superclass_name` wins. `self.table_name =` is an ASSIGNMENT, so
+        # the later `table_name_override` wins, but when two declarations disagree the name is marked computed
+        # so no value is pinned: glob order is not load order, and a pinned wrong literal would fold
+        # `Model.table_name == "…"` on correct code. `table_name_computed` is otherwise an OR. Name-keyed rows
+        # let the LAST declaration override an earlier same-name row, as {ModelIndex.merge_named_rows} does
+        # across an STI chain; plain lists union.
         def merge_redeclarations(rows)
           return rows if rows.length < 2
 
@@ -459,7 +452,6 @@ module Rigor
             macro_methods: lookup_macro_methods(node.body)
           })
 
-          # Recurse into the body in case nested classes exist.
           walk_for_classes(node.body, [full_name], &) if node.body
         end
 
@@ -869,8 +861,8 @@ module Rigor
 
         # Walks the namespace body's TOP-LEVEL statements only — a decorator declared inside a nested
         # `module`/`class` belongs to THAT namespace, not this one, and must not be attributed here.
-        # Returns `Hash<:prefix|:suffix => { literal: } | { computed: true }>`, only for the names this body
-        # actually mentions. A later statement overrides an earlier one within the SAME body — real Ruby
+        # Returns the decorators keyed by `:prefix` / `:suffix`, only for the names this body actually mentions.
+        # A later statement overrides an earlier one within the SAME body — real Ruby
         # assignment order, not a guess: `mattr_accessor :table_name_prefix` (no `default:`, so `computed:
         # true`) followed two lines down by a real `self.table_name_prefix = "blog_"` folds to the literal.
         #
@@ -1234,8 +1226,8 @@ module Rigor
         end
 
         # Recognised single-instance and collection association DSL methods. The kind drives the eventual
-        # return-type contribution: singular associations narrow to `Nominal[Target] | nil`, plural ones
-        # narrow to `ActiveRecord::Relation[Target]`.
+        # return-type contribution: singular associations narrow to the target or nil, plural ones to a
+        # relation of the target.
         #
         # `composed_of` value-object aggregations and `delegated_type` roles are folded in here too — both
         # accept the association name as a `where` / `find_by` query key, so omitting them turns every
@@ -1336,7 +1328,7 @@ module Rigor
                         association_option(args, "polymorphic") == true
 
           # A polymorphic association has no single static target class — `target` is nil and the flow
-          # contribution declines to narrow rather than inventing a wrong `Nominal[<classified-name>]`.
+          # contribution declines to narrow rather than inventing a wrong class-name target.
           if polymorphic
             target = nil
           else
@@ -1460,8 +1452,7 @@ module Rigor
         end
 
         # `enum status: { active: 0, archived: 1 }` (Rails ≤6) and `enum :status, [:active, :archived]`
-        # (Rails 7+). Returns `Hash<column_name => Array<Symbol>>`. Non-literal forms decline rather than
-        # guess.
+        # (Rails 7+). Non-literal forms decline rather than guess.
         def lookup_enums(body)
           return {} if body.nil?
 
@@ -1516,7 +1507,7 @@ module Rigor
         end
 
         # `scope :active, -> { ... }`. Records the scope name only (the body is intentionally NOT
-        # introspected — the caller contributes `ActiveRecord::Relation[Model]` based on the name alone
+        # introspected — the caller contributes a relation of the model based on the name alone
         # via `class_scope_return_type`).
         def lookup_scopes(body)
           return [] if body.nil?
@@ -1585,8 +1576,7 @@ module Rigor
 
         # `alias_attribute :new_name, :old_name`. Records the mapping so the analyzer accepts the alias
         # as a query key — without it every `where(<alias>: ...)` / `find_by(<alias>: ...)` call surfaces
-        # as a false `unknown-column`. Returns `Hash<alias => target>`; non-Symbol-literal forms decline
-        # rather than guess.
+        # as a false `unknown-column`. Non-Symbol-literal forms decline rather than guess.
         def lookup_aliases(body)
           return {} if body.nil?
 
@@ -1626,7 +1616,7 @@ module Rigor
         # macro and `images`, `images=`, `images_attachments`, `images_blobs` for the collection one — the
         # `has_one_attached` / `has_many_attached` generated-methods surface, none of it column-backed.
         # This is name MEMBERSHIP only, and does not overlap `rigor-activestorage`, which contributes the
-        # accessor's TYPE (`ActiveStorage::Attached::One`) and publishes no fact: a consumer that reads
+        # accessor's type and publishes no fact: a consumer that reads
         # `:model_index` to ask "does this model answer `avatar`?" gets nothing from that plugin, and gets
         # nothing at all when the project does not load it.
         ATTACHMENT_MACROS = {

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/model_index.rb

@@ -29,14 +29,12 @@ module Rigor
       # {Entry} resolves its table from the root model and inherits the chain's declared associations /
       # enums / aliases / scopes / validations / callbacks / macro methods.
       class ModelIndex
-        # `associations` is a frozen `Array<Hash>` where each row carries `{ name:, kind:, target:,
-        # nullable: }`:
+        # `associations` is a frozen list of rows `{ name:, kind:, target:, nullable: }`:
         #
-        # - `name`   — String, the association method name as the user invokes it (`"posts"`).
+        # - `name`   — the association method name as the user invokes it (`"posts"`).
         # - `kind`   — `:singular` (`belongs_to` / `has_one`) or `:collection` (`has_many`).
-        # - `target` — String, the target class name resolved either from an explicit `class_name:`
-        #              option or via {Inflector.classify}.
-        # - `nullable` — Boolean; whether a `:singular` accessor can return `nil`. `has_one` → `true`;
+        # - `target` — the target class name, from an explicit `class_name:` option or via {Inflector.classify}.
+        # - `nullable` — whether a `:singular` accessor can return `nil`. `has_one` → `true`;
         #              `belongs_to` → `false` (required by default since Rails 5) unless `optional: true`
         #              / `required: false`. Meaningless for `:collection` rows.
         #
@@ -71,27 +69,23 @@ module Rigor
 
           def association_names = associations.map { |a| a[:name] }
 
-          # `enums` is `Hash<column_name => Array<value_name>>`.
+          # `enums` maps a column name to its value names.
           def enum?(name) = enums.key?(name.to_s)
           def enum_values(name) = enums.fetch(name.to_s, [])
 
-          # `scopes` is `Array<scope_name>`.
           def scope?(name) = scopes.include?(name.to_s)
 
-          # `validations` is `Array<attribute_name>` covering both `validates :name, ...` and the
-          # `validates_*_of :name, ...` shorthand families.
+          # `validations` covers both `validates :name, ...` and the `validates_*_of :name, ...` shorthand families.
           def validation?(name) = validations.include?(name.to_s)
           def validated_attributes = validations
 
-          # `callbacks` is `Array<{ name:, callback: }>`.
           def callback_targets = callbacks.map { |c| c[:name] }
 
-          # `aliases` is `Hash<alias_name => target_attribute>` populated from `alias_attribute`
-          # declarations.
+          # `aliases` maps an alias name to its target attribute, from `alias_attribute` declarations.
           def alias?(name) = aliases.key?(name.to_s)
           def resolve_alias(name) = aliases[name.to_s]
 
-          # `macro_methods` is `Array<method_name>` — the instance methods a declaration macro installs that
+          # `macro_methods` lists the instance methods a declaration macro installs that
           # none of the sets above already carries (#1049): `delegate`'s names, the Paperclip / Active
           # Storage attachment readers, and an `enum`'s per-value predicates. Names only, with no type: a
           # consumer asks "does this model answer `followers_count`?", which is what a fail-closed check
@@ -312,7 +306,7 @@ module Rigor
           seen.values.map(&:freeze).freeze
         end
 
-        # `Hash<column => Array<value>>` merged across the STI chain; a child redeclaration of the same
+        # Enum value lists merged across the STI chain; a child redeclaration of the same
         # enum column overrides the ancestor's value list.
         def self.merge_enums(chain)
           chain.each_with_object({}) do |row, acc|
@@ -320,7 +314,7 @@ module Rigor
           end.freeze
         end
 
-        # `Hash<alias => target>` merged across the STI chain.
+        # Alias map merged across the STI chain.
         def self.merge_aliases(chain)
           chain.each_with_object({}) do |row, acc|
             (row[:aliases] || {}).each { |name, target| acc[name.to_s] = target.to_s }

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/schema_parser.rb

@@ -108,9 +108,8 @@ module Rigor
           false
         end
 
-        # Walks the block body collecting `t.<method>(...)` calls. Skips nested blocks (e.g. inside
-        # `if`-conditioned columns) only at the top level — for richer schema constructs the parser falls
-        # back silently.
+        # Walks the block body collecting `t.<method>(...)` calls. It descends through nested constructs
+        # (e.g. `if` branches) but does not recurse into a matched call.
         def collect_column_calls(node, &)
           return if node.nil?
 

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/schema_table.rb

@@ -21,7 +21,6 @@ module Rigor
           end
         end
 
-        # Map ActiveRecord column types → Ruby class names.
         RUBY_TYPE_MAPPING = {
           string: "String",
           text: "String",

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord.rb

@@ -59,8 +59,8 @@ module Rigor
     # capital R) is intentional — keeps the constant lookup distinct from `::ActiveRecord` even though the
     # gem name is hyphenated.
     #
-    # Note: this plugin is the seventh worked example. It does NOT require `active_record` at runtime — it
-    # only reads project source, the same way the other examples do. Rigor stays decoupled from Rails.
+    # Note: this plugin does NOT require `active_record` at runtime — it only reads project source, the
+    # same way the other examples do. Rigor stays decoupled from Rails.
     class Activerecord < Rigor::Plugin::Base
       manifest(
         id: "activerecord",
@@ -553,8 +553,9 @@ module Rigor
       end
 
       # Class-side finders + the class-side relation entry points. `find` returns the model, or an Array of
-      # them for two or more ids, or with a block the model or `nil`; `find_by!` returns the model; `find_by` adds the `nil` arm; `where` /
-      # `all` / `order` / `limit` / `none` open a relation. The relation then carries its element type
+      # them for two or more ids, or with a block the model or `nil`; `find_by!` returns the model;
+      # `find_by` adds the `nil` arm; `where` / `all` / `order` / `limit` / `none` open a relation. The
+      # relation then carries its element type
       # through any further chained query method via the bundled `ActiveRecord::Relation` RBS.
       def finder_return_type(call_node, entry, scope)
         case call_node.name

data/plugins/rigor-activestorage/lib/rigor/plugin/activestorage/attachment_discoverer.rb

@@ -105,10 +105,9 @@ module Rigor
           walk(node.body, inner_path, &) if node.body
         end
 
-        # The full constant name a `class` / `module` declaration defines, given the rendered local name
-        # and the enclosing lexical path. A ROOTED local name (`class ::User`) names the top-level constant
-        # whatever the nesting, so the lexical path is dropped and the `::` with it; otherwise the name is
-        # appended to the path (`class User` inside `module Admin` → `Admin::User`).
+        # The full constant name a `class` / `module` declaration defines. A ROOTED local name (`class ::User`)
+        # names the top-level constant whatever the nesting, so the lexical path is dropped; otherwise the
+        # name is appended to it (`class User` inside `module Admin` → `Admin::User`).
         def declared_constant_name(local_name, lexical_path)
           return local_name.delete_prefix("::") if local_name.start_with?("::")
 

data/plugins/rigor-activestorage/lib/rigor/plugin/activestorage/attachment_index.rb

@@ -8,7 +8,7 @@ module Rigor
       #
       # Each row is `{ name:, kind: }`:
       #
-      # - `name` — String, the attachment method name as the user invokes it (`"avatar"`).
+      # - `name` — the attachment method name as the user invokes it (`"avatar"`).
       # - `kind` — `:singular` (`has_one_attached`) or `:collection` (`has_many_attached`).
       class AttachmentIndex
         attr_reader :entries

data/plugins/rigor-activestorage/lib/rigor/plugin/activestorage.rb

@@ -137,19 +137,14 @@ module Rigor
         nil
       end
 
-      # Issue #1056 — "the attachment index did not load" is a fact about the run's INPUTS, not about the
-      # file being analysed, so both outcomes are registered rather than returned: see
-      # {Plugin::Base#disclose_once} for the channel and the position. Returned from the per-file hook they
-      # carried no once-guard at all — the `.uniq` collapsed repeats within one instance's list, but the
-      # whole list was re-emitted on every analysed file.
+      # Issue #1056 — "the attachment index did not load" is a fact about the run's INPUTS, not the file
+      # being analysed, so it is registered via {Plugin::Base#disclose_once} rather than returned from the
+      # per-file hook (which had no once-guard and re-emitted the list on every file).
       #
-      # The `key`s carry an ordinal prefix because the engine emits a plugin's disclosures in KEY order
-      # (#1051), and a refused read must still precede a discovery failure the way `@load_errors` records
-      # them — `@load_errors` is now keyed by that same string, which also caps it: `#attachment_index`
-      # re-attempts the load per call site, and the old Array appended a fresh interpolated string every
-      # time (the unbounded-growth shape #569 measured at 4.2 M retained strings on Redmine). The key, not
-      # the message, is the identity: a second refusal naming a different path collapses into the first row
-      # rather than adding one — the notice is "the index did not load", said once.
+      # The `key`s carry an ordinal prefix because the engine emits disclosures in KEY order (#1051), and
+      # a refused read must precede a discovery failure. `@load_errors` is keyed by the same string, which
+      # caps it: `#attachment_index` re-attempts the load per call site (#569). The key, not the message,
+      # is the identity, so a second refusal collapses into the first row.
       def disclose_load_errors
         @load_errors.each do |key, message|
           disclose_once(key, message: message, severity: :warning, rule: "load-error")

data/plugins/rigor-activestorage/lib/rigor-activestorage.rb

@@ -3,4 +3,4 @@
 # Entry point matching the `rigor-<id>` gem-name convention. The Plugin::Loader's `require_gem!` step
 # calls `require "rigor-activestorage"`, and this file loads the plugin's actual implementation under
 # the `rigor/plugin/` namespace so the require / register pair fires.
-require "rigor/plugin/activestorage"
+require_relative "rigor/plugin/activestorage"

data/plugins/rigor-activesupport-core-ext/lib/rigor/plugin/activesupport_core_ext/effects.rb

@@ -12,7 +12,7 @@ module Rigor
       # the core_ext predicate surface — the single cheapest purity win in a Rails app, per WD10 — is issue
       # #388 and lands in this plugin's shipped RBS, not here (`try` was audited and skipped: it dispatches
       # to whatever method the caller names, so its purity is a fact about the call site, not about `try`).
-      # One row below (`in_time_zone_row`) is #388's own addition: `DateTime#in_time_zone` reads `Time.zone`
+      # The `in_time_zone_rows` group is #388's own addition: `DateTime#in_time_zone` reads `Time.zone`
       # through a default argument, a gap the RBS sweep found but can only fix here.
       #
       # ## The clock

data/plugins/rigor-activesupport-core-ext/lib/rigor/plugin/activesupport_core_ext/symbolize_keys.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require "rigor/type"
+
+module Rigor
+  module Plugin
+    class ActivesupportCoreExt < Rigor::Plugin::Base
+      # #2433 — the result type of `Hash#symbolize_keys` / `#to_options`.
+      #
+      # ActiveSupport implements them as `transform_keys { |key| key.to_sym rescue key }`, so a String or
+      # Symbol key becomes a Symbol and a key without `to_sym` (an Integer, a Float) survives unchanged. One
+      # RBS return type cannot say that: `Hash[Symbol, V]` reads an Integer key as a Symbol, and
+      # `Hash[Symbol | K, V]` makes a String-keyed hash fail a declared `Hash[Symbol, untyped]` parameter.
+      # So the RBS rows answer `Hash[untyped, V]` and this module maps each key member where it can.
+      #
+      # A key that is not a String or Symbol (an Integer, a project class) reads `Dynamic[top]`: no Rigor fact proves
+      # a class has no `to_sym` (a mixin, a `pre_eval` file or a reopening can add one), so a kept key could claim
+      # a type the program does not have. It declines (`nil`, the RBS row answers) when a receiver member is
+      # neither a `Hash[K, V]` nor `nil`. A `nil` member is dropped: `nil.symbolize_keys` raises, and the engine
+      # adds `nil` back for `&.`.
+      module SymbolizeKeys
+        HASH = "Hash"
+        SYMBOLIZED_CLASSES = %w[String Symbol].freeze
+
+        module_function
+
+        # Answers `Hash[K', V]` (the union of such over the receiver's Hash members), or nil to decline.
+        def result(receiver_type, scope)
+          members = receiver_type.is_a?(Rigor::Type::Union) ? receiver_type.members : [receiver_type]
+          answers = members.reject { |member| nil_member?(member) }.map { |member| member_answer(member, scope) }
+          return nil if answers.empty? || answers.any?(:decline)
+
+          hashes = answers.reject { |answer| answer == :empty }
+          hashes.empty? ? nil : Rigor::Type::Combinator.union(*hashes)
+        end
+
+        # An empty closed shape is `{}`: it adds no key, so it drops out of the union rather than declining it.
+        def member_answer(member, scope)
+          return :empty if member.is_a?(Rigor::Type::HashShape) && member.closed? && member.pairs.empty?
+
+          key_type, value_type = hash_arguments(member)
+          return :decline if key_type.nil?
+
+          Rigor::Type::Combinator.nominal_of(HASH, type_args: [map_key(key_type, scope), value_type])
+        end
+
+        def nil_member?(type)
+          (type.is_a?(Rigor::Type::Constant) && type.value.nil?) ||
+            (type.is_a?(Rigor::Type::Nominal) && type.class_name == "NilClass")
+        end
+
+        def hash_arguments(type)
+          case type
+          when Rigor::Type::Nominal
+            type.class_name == HASH && type.type_args.size == 2 ? type.type_args : nil
+          when Rigor::Type::Difference
+            hash_arguments(type.base)
+          when Rigor::Type::HashShape
+            shape_arguments(type)
+          end
+        end
+
+        # A closed, non-empty shape reads as `Hash[<its keys>, <union of its values>]`.
+        def shape_arguments(shape)
+          return nil if shape.open? || shape.pairs.empty?
+
+          keys = shape.pairs.keys.map { |key| Rigor::Type::Combinator.constant_of(key) }
+          [Rigor::Type::Combinator.union(*keys), Rigor::Type::Combinator.union(*shape.pairs.values)]
+        end
+
+        def map_key(type, scope)
+          members = type.is_a?(Rigor::Type::Union) ? type.members : [type]
+          Rigor::Type::Combinator.union(*members.map { |member| map_member(member, scope) })
+        end
+
+        def map_member(member, scope)
+          case member
+          when Rigor::Type::Constant
+            member.value.is_a?(String) || member.value.is_a?(Symbol) ? symbol : Rigor::Type::Combinator.untyped
+          when Rigor::Type::Nominal
+            symbolized_class?(member.class_name, scope) ? symbol : Rigor::Type::Combinator.untyped
+          else Rigor::Type::Combinator.untyped
+          end
+        end
+
+        def symbol
+          Rigor::Type::Combinator.nominal_of("Symbol")
+        end
+
+        # String, Symbol and their subclasses go through `to_sym`.
+        def symbolized_class?(name, scope)
+          SYMBOLIZED_CLASSES.include?(name) ||
+            SYMBOLIZED_CLASSES.any? { |base| %i[equal subclass].include?(ordering(name, base, scope)) }
+        end
+
+        def ordering(name, base, scope)
+          Rigor::Reflection.class_ordering(name, base, scope: scope)
+        end
+      end
+    end
+  end
+end