rigortype 0.4.6 → 0.4.8

data/lib/rigor/value_semantics.rb

@@ -46,16 +46,7 @@ module Rigor
         key = (["self.class"] + fields.map(&:to_s)).join(", ")
 
         # Codegen (not per-call reflection) so the generated `==` / `hash` read fields
-        # directly and run at hand-written speed on the inference hot path. For
-        # `value_fields :class_name, :type_args` the emitted source is:
-        #
-        #   def ==(other)
-        #     other.is_a?(self.class) && class_name == other.class_name && type_args == other.type_args
-        #   end
-        #   alias_method :eql?, :==
-        #   def hash
-        #     [self.class, class_name, type_args].hash
-        #   end
+        # directly and run at hand-written speed on the inference hot path.
         class_eval(<<~RUBY, __FILE__, __LINE__ + 1) # rubocop:disable Style/DocumentDynamicEvalDefinition
           def ==(other)
             other.is_a?(self.class)#{guard}

data/lib/rigor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rigor
-  VERSION = "0.4.6"
+  VERSION = "0.4.8"
 end

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable/channel_discoverer.rb

@@ -167,8 +167,8 @@ module Rigor
         end
 
         # Walks the channel body recursively (so `stream_from` / `stream_for` calls inside `subscribed`
-        # / helper methods are picked up). Returns `[Array<String>, bool]` — the literal stream names +
-        # whether any dynamic registration was seen.
+        # / helper methods are picked up). Returns the literal stream names and whether any dynamic
+        # registration was seen, as a pair.
         def collect_stream_registrations(node, names: [], dynamic: false)
           return [names, dynamic] if node.nil?
 

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable/channel_index.rb

@@ -11,8 +11,8 @@ module Rigor
       #   `subscription.perform("action_name", data)`.
       # - `stream_names` — the set of literal-string stream names registered via `stream_from "name"`
       #   calls inside the channel body. Dynamic registrations (`stream_from interpolated_string`) are
-      #   recorded separately as `dynamic_streams: true` so the analyzer can suppress unknown-stream
-      #   warnings on any channel that has at least one dynamic registration.
+      #   recorded separately as `dynamic_streams: true`; when any channel has one, the analyzer suppresses
+      #   unknown-stream warnings for the whole run.
       class ChannelIndex
         Entry = Data.define(:class_name, :file_path, :action_methods, :stream_names, :dynamic_streams) do
           def includes_action?(name)
@@ -59,7 +59,6 @@ module Rigor
           @by_name.keys
         end
 
-        # All literal stream names registered across every discovered channel.
         def all_stream_names
           @entries.flat_map { |e| e.stream_names.to_a }.to_set
         end

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable.rb

@@ -12,7 +12,7 @@ module Rigor
     # rigor-actioncable — validates ActionCable `<Channel>.broadcast_to(...)` and
     # `ActionCable.server.broadcast(stream_name, ...)` call sites against the discovered channel index.
     #
-    # Tier 3F of the [Rails plugins roadmap](../../../../docs/design/20260508-rails-plugins-roadmap.md).
+    # Tier 3F of the [Rails plugins roadmap](../../../../../docs/design/20260508-rails-plugins-roadmap.md).
     # Statically discovers channel classes by walking `channel_search_paths` and parsing each file with
     # Prism — no `actioncable` runtime dependency.
     #

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/mailer_discoverer.rb

@@ -19,9 +19,9 @@ module Rigor
       # - Reads the instance-side `def` nodes and records each one as an action method, capturing the
       #   arity envelope.
       # - For each (class, action) pair, attempts to read every candidate view template under
-      #   `app/views/<mailer_underscore>/<action>.{html,text}.erb`. Existing templates feed the
+      #   `app/views/<mailer_underscore>/<action>.{html,text}.{erb,haml,slim}`. Existing templates feed the
       #   IoBoundary's cache descriptor (so the cache invalidates when the template changes); missing
-      #   templates are recorded so the plugin can surface a diagnostic on the mailer class definition.
+      #   templates are recorded so the plugin can surface a diagnostic on the action's `def`.
       #
       # Limitations (intentional for v0.1.0):
       #
@@ -30,9 +30,6 @@ module Rigor
       # - Action methods are read from the syntactic instance-side `def` list. Methods built via
       #   `define_method`, `private`, or non-action helpers (e.g. methods starting with `_`) are out of
       #   scope. The discoverer filters obvious non-actions (`initialize`, names prefixed with `_`).
-      # - Adding a brand-new view file under `app/views/<mailer>/` will NOT invalidate the cached index
-      #   until something the mailer file touches changes. This is the standard read-tracking trade-off
-      #   — only files we successfully read get digested into the descriptor.
       class MailerDiscoverer
         DEFAULT_VIEWS_ROOT = "app/views"
         VIEW_FORMATS = %w[html text].freeze
@@ -56,22 +53,22 @@ module Rigor
           # Two-pass: first collect every module's defs (for the include-following step), then build
           # per-class entries that pull in actions from include'd modules. GitLab's `Notify` mailer
           # derives every action from `Emails::*` concerns under `app/mailers/emails/`.
-          module_actions = {} # module_fqn => Hash<Symbol, ActionEntry>
-          class_visits = []   # collected (class_name, path, def_nodes, includes)
+          module_actions = {} # fully-qualified module name => its action entries, keyed by method name
+          class_visits = []   # collected (class_name, path, def_nodes, includes, view_exempt)
 
           ruby_files_under(@search_paths).each do |path|
             contents = read_safely(path)
             next if contents.nil?
 
             tree = Prism.parse(contents).value
-            walk_for_mailers(tree, []) do |class_name, def_nodes, includes|
-              class_visits << [class_name, path, def_nodes, includes]
+            walk_for_mailers(tree, []) do |class_name, def_nodes, includes, view_exempt|
+              class_visits << [class_name, path, def_nodes, includes, view_exempt]
             end
             collect_module_actions(tree, [], module_actions)
           end
 
-          entries = class_visits.map do |class_name, path, def_nodes, includes|
-            build_class_entry(class_name, path, def_nodes, includes, module_actions)
+          entries = class_visits.map do |class_name, path, def_nodes, includes, view_exempt|
+            build_class_entry(class_name, path, def_nodes, includes, module_actions, view_exempt)
           end
           MailerIndex.new(entries)
         end
@@ -112,9 +109,9 @@ module Rigor
           full_name = declared_constant_name(class_local_name, lexical_path)
           superclass = strip_root(constant_path_name(node.superclass)) if node.superclass
           if superclass && @base_classes.include?(superclass)
-            def_nodes = collect_action_defs(node.body)
+            def_nodes, view_exempt = collect_action_defs(node.body)
             includes = collect_includes(node.body)
-            yield full_name, def_nodes, includes
+            yield full_name, def_nodes, includes, view_exempt
           end
 
           walk_for_mailers(node.body, [full_name], &) if node.body
@@ -139,8 +136,7 @@ module Rigor
         end
 
         # Walks the AST collecting every module's instance-side def nodes by fully-qualified module
-        # name. The same `collect_action_defs` filter applies (private / `_`-prefixed / callback-target
-        # methods skipped).
+        # name. The same `collect_action_defs` filter applies (private / `_`-prefixed skipped).
         def collect_module_actions(node, lexical_path, accumulator)
           return if node.nil?
 
@@ -151,8 +147,7 @@ module Rigor
 
             full_name = declared_constant_name(local_name, lexical_path)
             if node.body
-              def_nodes = collect_action_defs(node.body)
-              entries = def_nodes.to_h { |def_node| [def_node.name, build_action_entry(def_node)] }
+              entries = collect_action_defs(node.body).first.to_h { |def_node| [def_node.name, build_action_entry(def_node)] }
               # UNIONed, never assigned: a concern module reopened in a second file adds actions rather
               # than replacing the ones the first declaration spelled (same rule as {MailerIndex}'s
               # per-class merge).
@@ -220,40 +215,44 @@ module Rigor
         #   `private` / `protected` (until a `public` switches back), named by `private :foo` /
         #   `protected :foo`, or defined inline (`private def foo`) — Rails builds `action_methods` from the
         #   public instance methods. `public :foo` after a `protected` section makes `foo` an action again.
-        # - methods named as a callback target (`before_action :name`, `after_action`, `around_action`)
+        # Methods named by a callback or `helper_method` macro (see {#collect_callback_names}) stay actions:
+        # Rails dispatches any public instance method, so `Mailer.target` still runs. They are returned as the
+        # view-exempt names, which exempt them from the missing-view check only.
         #
         # Pre-fix, Mastodon's `AdminMailer#process_params` / `set_instance` / `set_locale` /
         # `set_important_headers!` all surfaced as missing-view because the bare `private` keyword
         # wasn't honoured. ~19 false positives across Mastodon's mailers.
-        CALLBACK_DECLARATIONS = %i[before_action after_action around_action].freeze
-        private_constant :CALLBACK_DECLARATIONS
-
-        VISIBILITY_KEYWORDS = %i[public private protected].freeze
+        VISIBILITY_KEYWORDS = %i[public private protected module_function].freeze
         private_constant :VISIBILITY_KEYWORDS
 
+        # Returns `[action_def_nodes, view_exempt_names]`. The view-exempt names are the callback and
+        # `helper_method` targets of the body: they remain actions, and only the missing-view check skips them.
         def collect_action_defs(body)
-          return [] if body.nil?
+          return [[], Set[]] if body.nil?
 
           callback_names = collect_callback_names(body)
           def_nodes, final_visibility = scan_visibility(body)
 
-          def_nodes.select do |node|
+          actions = def_nodes.select do |node|
             next false if node.receiver.is_a?(Prism::SelfNode)
             next false if node.name == :initialize
             next false if node.name.to_s.start_with?("_")
-            next false if callback_names.include?(node.name)
 
             # Rails builds `action_methods` from the PUBLIC instance methods, so only a method whose final
             # visibility is public is an action.
             final_visibility[node.name] == :public
           end
+          [actions, callback_names]
         end
 
-        # Symbol arguments to callback declarations (`before_action :setup`, etc.).
+        # Symbol arguments to the macros the manifest's `per_invocation_non_action_macros` lists (`before_action
+        # :setup`, `after_deliver :record`, `helper_method :fmt`). The `skip_*` forms are left out, since
+        # `skip_before_action :x` names a callback a parent defined and does not exempt `x` from anything (#2319).
         def collect_callback_names(body)
+          macros = Actionmailer.manifest.per_invocation_non_action_macros.reject { |macro| macro.start_with?("skip_") }
           names = []
           body.rigor_each_child do |node|
-            next unless node.is_a?(Prism::CallNode) && node.receiver.nil? && CALLBACK_DECLARATIONS.include?(node.name)
+            next unless node.is_a?(Prism::CallNode) && node.receiver.nil? && macros.include?(node.name)
 
             (node.arguments&.arguments || []).each do |arg|
               symbol = Rigor::Source::Literals.symbol(arg)
@@ -265,8 +264,8 @@ module Rigor
 
         # Walks the class body in source order and returns `[def_nodes, final_visibility]`: every `def` the body
         # spells (a direct statement or the inline argument of a visibility call, `private def x`), and the
-        # visibility each method name ends with. A bare `public` / `private` / `protected` sets the default for
-        # the defs after it; `private :x` / `public :x` / `protected def x` set that one method, whichever side of
+        # visibility each method name ends with. A bare `public` / `private` / `protected` / `module_function` sets
+        # the default for the defs after it; `private :x` / `public :x` / `protected def x` set that one method, whichever side of
         # its `def` they fall on in the source, and the last statement to name a method wins.
         def scan_visibility(body)
           def_nodes = []
@@ -286,7 +285,8 @@ module Rigor
           [def_nodes, final_visibility]
         end
 
-        # Applies one receiverless `public` / `private` / `protected` call and returns the (possibly new) default.
+        # Applies one receiverless `public` / `private` / `protected` / `module_function` call and returns the
+        # (possibly new) default.
         def apply_visibility_call(node, default, def_nodes, final_visibility)
           return default unless node.receiver.nil? && VISIBILITY_KEYWORDS.include?(node.name)
 
@@ -304,9 +304,9 @@ module Rigor
           default
         end
 
-        def build_class_entry(class_name, file_path, def_nodes, includes = [], module_actions = {})
+        def build_class_entry(class_name, file_path, def_nodes, includes = [], module_actions = {}, view_exempt = Set[])
           actions = def_nodes.to_h do |def_node|
-            entry = build_action_entry(def_node)
+            entry = build_action_entry(def_node, view_exempt: view_exempt.include?(def_node.name))
             [entry.method_name, entry]
           end
 
@@ -326,7 +326,7 @@ module Rigor
             end
           end
 
-          missing_views = actions.keys.reject { |action| view_exists?(class_name, action) }
+          missing_views = actions.reject { |_, entry| entry.view_exempt }.keys.reject { |action| view_exists?(class_name, action) }
 
           MailerIndex::ClassEntry.new(
             class_name: class_name,
@@ -337,7 +337,7 @@ module Rigor
           )
         end
 
-        def build_action_entry(def_node)
+        def build_action_entry(def_node, view_exempt: false)
           parameters = def_node.parameters
           location = def_node.name_loc
 
@@ -346,7 +346,8 @@ module Rigor
               method_name: def_node.name,
               min_arity: 0, max_arity: 0,
               def_line: location.start_line,
-              def_column: location.start_column + 1
+              def_column: location.start_column + 1,
+              view_exempt: view_exempt
             )
           end
 
@@ -359,7 +360,8 @@ module Rigor
             min_arity: required_count,
             max_arity: rest_present ? Float::INFINITY : required_count + optional_count,
             def_line: location.start_line,
-            def_column: location.start_column + 1
+            def_column: location.start_column + 1,
+            view_exempt: view_exempt
           )
         end
 

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/mailer_index.rb

@@ -11,7 +11,9 @@ module Rigor
       #   the mailer file)
       # - the list of `(action, location)` pairs whose view templates are missing from `app/views/`
       class MailerIndex
-        ActionEntry = Data.define(:method_name, :min_arity, :max_arity, :def_line, :def_column) do
+        # `view_exempt` marks a callback or `helper_method` target: still an action (Rails dispatches it), but
+        # left out of the missing-view check.
+        ActionEntry = Data.define(:method_name, :min_arity, :max_arity, :def_line, :def_column, :view_exempt) do
           def arity_label
             return "#{min_arity}+" if max_arity == Float::INFINITY
             return min_arity.to_s if min_arity == max_arity
@@ -67,7 +69,7 @@ module Rigor
         end
 
         # @param file_path — absolute path of a mailer file (canonicalised — see plugin entry's
-        #   `harvest`)
+        #   `canonical_path`)
         def find_by_file(file_path)
           @entries.find { |entry| entry.file_path == file_path }
         end

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer.rb

@@ -11,7 +11,7 @@ module Rigor
   module Plugin
     # rigor-actionmailer — validates `Mailer.action(args)` call sites and detects missing view templates.
     #
-    # Tier 1C of the [Rails plugins roadmap](../../../../docs/design/20260508-rails-plugins-roadmap.md).
+    # Tier 1C of the [Rails plugins roadmap](../../../../../docs/design/20260508-rails-plugins-roadmap.md).
     # Statically discovers mailer classes by walking `mailer_search_paths` and parsing each file with
     # Prism — no `action_mailer` runtime dependency.
     #
@@ -38,8 +38,6 @@ module Rigor
     # - Direct-superclass match only.
     # - Action methods are read from the syntactic instance-side `def` list. `define_method` actions are
     #   out of scope.
-    # - Adding a brand-new view file does not invalidate the cache until something the mailer file
-    #   touches changes.
     class Actionmailer < Rigor::Plugin::Base
       manifest(
         id: "actionmailer",
@@ -55,7 +53,11 @@ module Rigor
         #
         # Bumped 2026-10-23 (#2308) — a method after a bare `protected` is no longer an action, so a cached 0.5.0
         # index can list protected helpers as actions (and as missing-view candidates).
-        version: "0.5.1",
+        #
+        # Bumped 2026-10-26 (#2319) — a method named by a callback or `helper_method` macro (`prepend_before_action`,
+        # `after_deliver`, `helper_method`, ...) no longer draws a missing-view row, and a method defined after a bare
+        # `module_function` is no longer an action, so a cached 0.5.1 index can carry those rows and actions.
+        version: "0.5.2",
         description: "Validates ActionMailer call shape and view template existence.",
         config_schema: {
           "mailer_search_paths" => { kind: :array, default: ["app/mailers"] },

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/analyzer.rb

@@ -102,7 +102,7 @@ module Rigor
 
         # Phase 2 — filter-chain validation for ONE filter-DSL call (`before_action :name`, …). The
         # enclosing controller is read from the node-rule `NodeContext` ancestors, looked up in the
-        # controller index to get the effective method set (including one level of inheritance), and
+        # controller index to get the effective method set (including inherited methods), and
         # each filter name reference is validated against it. Calls outside a known controller
         # contribute nothing.
         #

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_index.rb

@@ -6,8 +6,7 @@ module Rigor
       # Per-run frozen index of discovered controllers AND concerns (modules) in
       # `controller_search_paths`. Phase 2 (filter-chain validation) consults the index at every call
       # site to check that `before_action :name` references a method that actually exists on the
-      # controller, its parent (one level of inheritance), or any module the controller or its ancestor
-      # chain transitively `include`s.
+      # controller, any ancestor, or any module the controller or an ancestor transitively `include`s.
       #
       # Real-world example (Mastodon):
       #   AccountsController < ApplicationController
@@ -169,9 +168,6 @@ module Rigor
         # and returning the first candidate that has an entry in the index. When nothing resolves,
         # return the original name unchanged — the caller treats unresolved entries as "gem-shipped
         # concerns we cannot see" (the `unresolved_include?` predicate).
-        #
-        # `name` may already be qualified (`Foo::Bar`); we only try lexical prefixing when the
-        # unqualified first segment doesn't match a top-level entry.
         def resolve_constant_lexically(name, enclosing)
           return nil if name.nil?
 

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/controller_scan.rb

@@ -83,7 +83,6 @@ module Rigor
           end.to_h
         end
 
-        # Every implicit-self `render` call node under `node`, at any depth.
         def each_render(node, &)
           return unless node.is_a?(Prism::Node)
 

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/erb_compiler.rb

@@ -229,7 +229,8 @@ module Rigor
         # been measured. Resolved ONCE per process: a failed resolution is as memoised as a successful
         # one, so a project without Erubi does not pay a `$LOAD_PATH` walk per template.
         #
-        # `Isolation.require_with_target_bundle` is [ADR-90](../../../../../../docs/adr/90-target-library-resolution-from-project-bundle.md)'s
+        # `Isolation.require_with_target_bundle` is
+        # [ADR-90](../../../../../../docs/adr/90-target-library-resolution-from-project-bundle.md)'s
         # path — Rigor's own gem env first, then the analysed project's bundle, `$LOAD_PATH` appended and
         # only on a failed require. Erubi is not a Rigor dependency and is never added to one. Any load
         # failure is equally "no Erubi here"; stdlib `ERB` answers the same question, so nothing is

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/view_assigns.rb

@@ -18,11 +18,11 @@ module Rigor
       # ## The inference is deliberately narrow
       #
       # Only `@user = Model.find(...)`-shaped assignments contribute, and only for a closed set of
-      # constructors and finders that **cannot return nil** — `find`, `find_by!`, `sole`, `first!`,
+      # constructors and finders that **cannot return nil** — `find`, `find_by!`, `find_sole_by`, `sole`, `first!`,
       # `last!`, `new`, `create`, `create!`. A seeded type is a claim the engine acts on, and a wrong one
       # is worse than none: seeding `@user` from `find_by` (which returns nil at runtime) would hand the
       # flow rules a non-nil nominal and license folds that draw diagnostics on correct templates — the
-      # trap `Actionpack::STRONG_PARAMS_CHAIN_METHODS` documents at length for `Parameters#[]`. Anything
+      # trap `Actionpack::PARAMS_ONLY_CHAIN_METHODS` documents at length for `Parameters#[]`. Anything
       # else assigns nothing, the ivar stays unseeded, and the template reads it as `Dynamic`, which
       # taints honestly (ADR-5). A call on that list that returns, or may return, SEVERAL records —
       # `find(a, b)`, `find([1, 2])`, `create([{…}, {…}])` — is excluded by the same rule; see
@@ -228,7 +228,7 @@ module Rigor
           # `case`, a `rescue`, a loop, or a block that may not run — does not contribute, because a seed
           # is a claim about what the template will FIND, and `@user = User.find(1) if params[:pick]`
           # leaves `@user` nil on the other path. A non-nil nominal standing in for a runtime nil is the
-          # `Parameters#[]` trap (`Actionpack::STRONG_PARAMS_CHAIN_METHODS`): the flow rules act on it and
+          # `Parameters#[]` trap (`Actionpack::PARAMS_ONLY_CHAIN_METHODS`): the flow rules act on it and
           # report live branches, which is exactly what a reader of a template would see with
           # `view_type_checks:` on. The unseeded ivar reads `Dynamic` instead and taints honestly (ADR-5).
           #

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -20,7 +20,7 @@ module Rigor
     # fact published by `rigor-rails-routes` (ADR-9 cross-plugin API) and validates every implicit-self
     # `*_path` / `*_url` call inside files under `controller_search_paths` (default `app/controllers`).
     #
-    # Tier 2 of the [Rails plugins roadmap](../../../../docs/design/20260508-rails-plugins-roadmap.md).
+    # Tier 2 of the [Rails plugins roadmap](../../../../../docs/design/20260508-rails-plugins-roadmap.md).
     # Phase 1 (strong-parameters → AR column validation), Phase 2 (filter chains), and Phase 3 (render
     # targets) ship as separate slices; each phase composes additively under the same plugin id.
     #
@@ -37,14 +37,10 @@ module Rigor
     #
     # ## What it checks
     #
-    # - **Helper existence** — every `*_path` / `*_url` call inside a controller file is looked up in
-    #   the helper table. Missing entries emit `unknown-helper` with a `DidYouMean` suggestion drawn
-    #   from the table.
-    # - **Helper arity** — the call's positional-argument count is matched against the helper's
-    #   recorded arity (a trailing `KeywordHashNode` like `users_path(format: :json)` is excluded; same
-    #   convention `rigor-rails-routes` uses). Mismatches emit `wrong-helper-arity`.
-    # - **Trace** — recognised helpers also emit a `helper-call` info diagnostic naming the action and
-    #   path, mirroring the trace shape of the upstream plugin.
+    # - **Trace** — recognised `*_path` / `*_url` helpers emit a `helper-call` info diagnostic naming
+    #   the action and path. Unknown helpers (`unknown-helper`) and arity mismatches (`wrong-arity`)
+    #   are reported by `rigor-rails-routes`, which owns the helper table, so this plugin does not
+    #   repeat them.
     #
     # ## Limitations
     #
@@ -88,7 +84,9 @@ module Rigor
         # the engine reads as "a template exists here and has no unit". The bump is belt-and-braces: what
         # actually invalidates is the claim itself, through the glob row in `TemplateUnits#digest` and the
         # `claimed_globs` equality the carry checks. A manifest version is in no cache key of its own.
-        version: "1.5.0",
+        # Bumped 2026-10-27 (#2430) — `params[...]` answers the gradual `Dynamic[Parameters | nil]` rather than
+        # the bare union, so a cached 1.5.0 run carries the non-gradual answer at every `params[:k]` argument.
+        version: "1.6.0",
         description: "Validates Action Pack route-helper calls and filter chains inside controllers, and types the request-context readers (`params` / `session` / `request` / `flash`) and their chains.",
         config_schema: {
           "controller_search_paths" => { kind: :array, default: ["app/controllers"] },
@@ -475,21 +473,21 @@ module Rigor
       # `ActionController::Parameters` (above), but the chained `params.require(:user).permit(:name)` /
       # `params.permit(...)` calls returned `Dynamic` at the first hop (Parameters ships no bundled RBS,
       # so a call on it resolves lenient-to-Dynamic), leaking every downstream site (`.permit`, `.to_h`,
-      # `.each`) to unprotected. These three methods return another `Parameters`, so gate on a
-      # `Parameters` receiver and re-type the result as the same lenient nominal — the chain stays a
-      # concrete receiver end-to-end and `coverage --protection` counts the sites as protected.
-      #
-      # `require` may return a scalar for a flat key at runtime (`params.require(:id) → String`), but
-      # typing it as the RBS-less `Parameters` is FP-safe by the same argument as the readers: every
-      # method on a Parameters value stays engine-lenient (no `undefined-method`), and this types the
-      # container only, never a caller's argument (ADR-5). The GitLab strong-params survey (108 leaked
-      # `.permit` sites) is the demand.
-      # Issue #534 — `expect` (Rails 8's require+permit) and `slice` joined 2026-09-01, from the corpus
-      # sweep's pair counts (63 and 38 sites on mastodon). Both share `require`'s safety shape: they
-      # never return nil (`expect` raises like `require`; `slice` always returns a Parameters), so the
-      # non-nil lenient nominal cannot fold a flow rule wrong.
-      #
-      # ## The admission rule for this table
+      # `.each`) to unprotected. The methods that return another `Parameters` (`PARAMS_ONLY_CHAIN_METHODS`)
+      # gate on a `Parameters` receiver and re-type the result as the same
+      # lenient nominal — the sites after them stay concrete receivers and `coverage --protection` counts
+      # them as protected. `require` / `expect` are the exception below: the receiver of the call right
+      # after one is the carrier, which is not a concrete receiver.
+      #
+      # `require` and `expect` may return a scalar at runtime (`params.require(:id) → String`), so the
+      # earlier "RBS-less nominal is FP-safe" reading of them (2026-07, #534) is withdrawn by #2947: it held
+      # only while Parameters shipped no RBS. Once the collection's declaration is loaded, a nominal answer
+      # reports a scalar's method as `call.undefined-method`. They answer the gradual carrier
+      # `Dynamic[Parameters]` (`SCALAR_CAPABLE_CHAIN_METHODS`), which keeps the chain resolvable and is quiet
+      # with or without the RBS. The GitLab strong-params survey (108 leaked `.permit` sites) is the demand.
+      # Issue #534 — `expect` and `slice` joined 2026-09-01 (63 and 38 sites on mastodon).
+      #
+      # ## The admission rule for the nominal table (`PARAMS_ONLY_CHAIN_METHODS`)
       #
       # A method belongs here **iff its Rails implementation returns an `ActionController::Parameters`
       # on every path** — either a fresh `new_instance_with_inherited_permitted_status(...)` or `self`.
@@ -497,9 +495,9 @@ module Rigor
       # entry FP-safe, because the RBS-less nominal buys leniency on the *method surface* only:
       #
       # - Method-surface rules DO decline on it. `call.undefined-method` bails at
-      #   `Rigor::Reflection.rbs_class_known?` (lib/rigor/analysis/check_rules.rb:720) because Rigor
-      #   ships no RBS for Parameters, and the argument / arity rules gate on the same predicate
-      #   (:1151, :2126). So `params.slice(:a).whatever_rails_adds` never fires, and a scalar-shaped
+      #   `Rigor::Reflection.rbs_class_known?` (lib/rigor/analysis/check_rules.rb) because Rigor
+      #   ships no RBS for Parameters, and the argument / arity rules gate on the same predicate. So
+      #   `params.slice(:a).whatever_rails_adds` never fires, and a scalar-shaped
       #   use of a Parameters-typed value (`.to_i`, `.strip`, string interpolation) resolves lenient
       #   -to-Dynamic rather than to a diagnostic.
       # - **Flow rules do NOT.** Truthiness folding, ternary arm selection and `.nil?` folding key on
@@ -542,7 +540,7 @@ module Rigor
       #   and still carries the chain — `params[:user][:name]` types `Parameters?` and
       #   `params[:user].permit(:name)` types `Parameters`, because the dispatcher strips the nil arm
       #   for the receiver gate. Idiomatic *chained* reads stay silent too: `call.possible-nil-receiver`
-      #   restricts itself to `Prism::LocalVariableReadNode` receivers (`CheckRules#nil_receiver_diagnostic`'s local-read restriction), so
+      #   restricts itself to `Prism::LocalVariableReadNode` receivers (`CheckRules#nil_receiver_diagnostic`), so
       #   `params[:q].strip` cannot fire. What it does fire on is the assigned form — `q = params[:q];
       #   q.strip` — at **error** severity, once per unguarded use. Guarded forms (`return if q.nil?`,
       #   `if q`, `q&.strip`, `|| ""`) all narrow correctly and stay silent, so this is not a broken
@@ -564,20 +562,60 @@ module Rigor
       # The control specs stay, and they still bite: they pin the HAZARD (no truthiness fold, no `bot`
       # branch, no possible-nil firing), not the Dynamic answer, so they go red if either typing's
       # hazard ever returns — and they now carry a positive assertion that `params[:k]` types
-      # `Parameters?`, so a silent regression to `Dynamic` or to the non-nil nominal fails them too.
-      STRONG_PARAMS_CHAIN_METHODS = %i[
-        require permit permit! expect slice
+      # `Dynamic[ActionController::Parameters?]` (#2430), so a silent regression to bare `Dynamic[top]`
+      # or to the non-nil nominal fails them too.
+      # The links that return an `ActionController::Parameters` on every path (checked against Rails 8.x
+      # `strong_parameters.rb`). Only these may be typed as the nominal.
+      PARAMS_ONLY_CHAIN_METHODS = %i[
+        permit permit! slice
         except without extract! slice!
         merge merge! reverse_merge reverse_merge! with_defaults with_defaults!
         compact compact_blank deep_dup
       ].freeze
 
-      dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: STRONG_PARAMS_CHAIN_METHODS do |call_node, _scope|
+      # Issue #2947 — `require` and `expect` are NOT in the nominal table above. Rails returns the value itself:
+      # `require` is `self[key]` (a scalar, or an Array for an Array of keys) and `expect` is `values.first`
+      # for one key, else an Array. The "RBS-less nominal is lenient" argument holds only while Parameters
+      # ships no RBS; with the collection's declaration loaded, a nominal answer reports `.to_sym` on a
+      # scalar as `call.undefined-method`. They answer the gradual carrier `Dynamic[Parameters]` instead:
+      # quiet at every boundary, and the chain keeps resolving through the carrier-gated rule.
+      SCALAR_CAPABLE_CHAIN_METHODS = %i[require expect].freeze
+
+      STRONG_PARAMS_CHAIN_METHODS = (PARAMS_ONLY_CHAIN_METHODS + SCALAR_CAPABLE_CHAIN_METHODS).freeze
+
+      dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: PARAMS_ONLY_CHAIN_METHODS do |call_node, _scope|
         next nil unless call_node.is_a?(Prism::CallNode)
 
         Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params])
       end
 
+      dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: SCALAR_CAPABLE_CHAIN_METHODS do |call_node, _scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+
+        Rigor::Type::Combinator.dynamic(Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]))
+      end
+
+      # Issue #2430 / #2947 — the chain on a carrier receiver (`params[:user].permit(:name)`,
+      # `params.require(:user).permit(:name)`). A carrier often holds an Array or a String at runtime, and
+      # those define many of the chain names with other returns (`compact`, `slice`, `without`, `deep_dup`,
+      # `extract!`, ...), so only `permit` / `permit!` — which no core or ActiveSupport class defines — can
+      # answer the plain nominal there: such a call raises NoMethodError or returns a real Parameters, and
+      # the plain nominal keeps the sites after it concrete receivers for `coverage --protection`. Every
+      # other chain method stays the gradual carrier.
+      CARRIER_NOMINAL_CHAIN_METHODS = %i[permit permit!].freeze
+
+      dynamic_return methods: STRONG_PARAMS_CHAIN_METHODS do |call_node, scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+
+        receiver = call_node.receiver
+        next nil unless receiver
+        next nil unless controller_scope?(scope)
+        next nil unless params_carrier_facet?(scope.type_of(receiver))
+
+        nominal = Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params])
+        CARRIER_NOMINAL_CHAIN_METHODS.include?(call_node.name) ? nominal : Rigor::Type::Combinator.dynamic(nominal)
+      end
+
       # Issue #534 item 1, reopened by #574. `#[]` is the single largest named-receiver pair on both survey
       # apps (redmine 581, mastodon ~475). The honest contract is `Parameters | nil` — a missing key really
       # returns nil — and the block comment above records why that typing was REJECTED in 2026-09-01: it put
@@ -593,15 +631,56 @@ module Rigor
       #
       # The non-nil `-> Parameters` typing stays rejected on its own merits, unchanged: it makes every
       # `params[:k]` condition always-truthy and folds a ternary over one to its true arm.
+      #
+      # Issue #2430 — the answer is a GRADUAL carrier, `Dynamic[Parameters | nil]`, not the bare union.
+      # A declared boundary (a `String` parameter, a `-> String` return) rejects the bare union, because
+      # `Acceptance` passes only a `Dynamic` through every boundary, and a scalar param is a `String` at
+      # runtime. The static facet keeps the strong-params chain typed: the carrier-gated rules below
+      # dispatch on the facet, so `params[:user][:name]` and `params[:user].permit(:name)` keep resolving.
+      # The control hazards (no truthiness fold, no `bot`, no possible-nil on `q = params[:q]`) are
+      # unchanged, because the facet is the same `Parameters | nil` union.
       dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: %i[[]] do |call_node, _scope|
         next nil unless call_node.is_a?(Prism::CallNode)
 
-        Rigor::Type::Combinator.union(
-          Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]),
-          Rigor::Type::Combinator.constant_of(nil)
+        params_read_type
+      end
+
+      # Issue #2430 — `Dynamic` is not a `Nominal`, so the receiver-gated rules never see a carrier
+      # receiver. These two rules gate on the carrier's facet instead, and only inside a controller: a
+      # carrier is minted by the `params` reader, which is controller-only, so no other scope can hold one.
+      dynamic_return methods: %i[[]] do |call_node, scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+
+        receiver = call_node.receiver
+        next nil unless receiver
+        next nil unless controller_scope?(scope)
+        next nil unless params_carrier_facet?(scope.type_of(receiver))
+
+        params_read_type
+      end
+
+      # The `params` carrier's static facet as a `Dynamic`: `Parameters | nil`, gradual at every boundary.
+      def params_read_type
+        Rigor::Type::Combinator.dynamic(
+          Rigor::Type::Combinator.union(
+            Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params]),
+            Rigor::Type::Combinator.constant_of(nil)
+          )
         )
       end
 
+      # True when `type` is a `Dynamic` whose facet is `Parameters` or `Parameters | nil`: the carrier a
+      # `params[...]` read answers, and the value a chained `[]` / strong-params call receives.
+      def params_carrier_facet?(type)
+        return false unless type.is_a?(Rigor::Type::Dynamic)
+
+        facet = type.static_facet
+        members = facet.is_a?(Rigor::Type::Union) ? facet.members : [facet]
+        non_nil = members.reject { |member| member.is_a?(Rigor::Type::Constant) && member.value.nil? }
+        non_nil.size == 1 && non_nil.first.is_a?(Rigor::Type::Nominal) &&
+          non_nil.first.class_name == REQUEST_CONTEXT_READER_TYPES[:params]
+      end
+
       # Phase 5c (2026-09-02, issue #534 "same lane") — the rest of the request-context surface the
       # corpus sweep measured after the #578 / #585 batch: `request.post?` 28 and `request.xhr?` 27 on
       # the two apps, `flash.now` inside the redmine 147 / mastodon 29 flash cluster. Each is typed from