activerecord-materialized 0.1.1 → 0.2.0

data/lib/activerecord/materialized/configuration.rb

@@ -1,4 +1,3 @@
-# typed: strict
 # frozen_string_literal: true
 
 module ActiveRecord
@@ -6,74 +5,150 @@ module ActiveRecord
     # Global, app-wide defaults, set via {Materialized.configure}. Individual
     # views can override most of these with the corresponding DSL macro.
     class Configuration
-      extend T::Sig
-
       # @return [String] name of the metadata table (default "ar_materialized_view_metadata")
-      sig { returns(String) }
       attr_accessor :metadata_table_name
 
       # @return [String] name of the per-partition freshness table
-      sig { returns(String) }
       attr_accessor :partition_table_name
 
+      # @return [String] name of the write-outbox table (the optional trigger/outbox change source)
+      attr_accessor :write_outbox_table_name
+
+      # @return [String] name of the CDC source-watermark table (per-partition applied-watermark tracking)
+      attr_accessor :source_watermark_table_name
+
       # @return [Numeric, ActiveSupport::Duration, nil] default {ViewRefreshPolicyClassMethods::ClassMethods#max_staleness max_staleness}
-      sig { returns(T.nilable(DebounceInterval)) }
       attr_accessor :default_max_staleness
 
       # @return [Integer, nil] optional per-refresh timeout in seconds
-      sig { returns(T.nilable(Integer)) }
       attr_accessor :refresh_timeout
 
       # @return [Boolean] whether a full refresh swaps a freshly built table in atomically
-      sig { returns(T::Boolean) }
       attr_accessor :atomic_swap_refresh
 
       # @return [Symbol] default refresh strategy: +:async+, +:immediate+, or +:manual+
-      sig { returns(Symbol) }
       attr_accessor :default_refresh_strategy
 
       # @return [Numeric] default debounce window (seconds) for coalescing async refreshes
-      sig { returns(DebounceInterval) }
       attr_accessor :default_refresh_debounce
 
-      # @return [Symbol] background dispatcher: +:async+ (in-process thread) or +:active_job+
-      sig { returns(Symbol) }
-      attr_accessor :refresh_dispatcher
+      # Background dispatcher: +:active_job+ or +:async+ (in-process thread). Unset, it resolves
+      # to +:active_job+ when ActiveJob is loaded and +:async+ otherwise; an explicit assignment
+      # always wins. The in-process +:async+ dispatcher does not coordinate across processes and
+      # its queue is lost on restart, so it is single-process-only — multi-process deployments
+      # should run +:active_job+.
+      #
+      # @return [Symbol]
+      attr_writer :refresh_dispatcher
+
+      def refresh_dispatcher
+        @refresh_dispatcher || (active_job_available? ? :active_job : :async)
+      end
 
       # @return [Symbol] ActiveJob queue name used when +refresh_dispatcher+ is +:active_job+
-      sig { returns(Symbol) }
       attr_accessor :refresh_queue_name
 
+      # ActiveJob queue for {ReconcileJob} (the reconcile fan-out); falls back to
+      # +refresh_queue_name+ when unset so both maintenance jobs share a queue by default.
+      #
+      # @return [Symbol]
+      attr_writer :reconcile_queue_name
+
+      def reconcile_queue_name
+        @reconcile_queue_name || refresh_queue_name
+      end
+
+      # Rails multi-database role that maintenance writes (refresh/reconcile/rebuild) run under, so
+      # they target the primary in a writer/replica topology. +nil+ (default) yields on the current
+      # connection — no routing. Requires the host app to have declared the role via +connects_to+.
+      #
+      # @return [Symbol, nil]
+      attr_accessor :maintenance_role
+
+      # Rails multi-database role that {DataVerifier} reads run under, so the (expensive) drift
+      # verification can be offloaded to a replica — the verify-on-replica / repair-on-primary split.
+      # +nil+ (default) yields on the current connection.
+      #
+      # @return [Symbol, nil]
+      attr_accessor :verification_role
+
+      # Replication lag budget folded into time-based staleness: a view read from a replica is
+      # effectively `view staleness + replication lag` stale, so this tightens the effective
+      # +max_staleness+ (a view goes stale this much sooner) to keep replica reads within budget.
+      # Keep it well below your smallest +max_staleness+ — a value at or above it drives the effective
+      # window to zero, making that view perpetually stale (reconciled every tick). Defaults to 0 (no
+      # adjustment); a static estimate of a dynamic quantity — see the distributed-deployment guide.
+      #
+      # @return [Numeric, ActiveSupport::Duration]
+      attr_accessor :replica_lag
+
       # Cold-read behavior: :read_through (serve from source), :serve_stale
       # (serve the cache as-is), or :raise.
-      sig { returns(Symbol) }
       attr_accessor :default_cold_read_strategy
 
+      # Default change source for views: +:callbacks+ (install ActiveRecord
+      # commit callbacks on +depends_on+ models) or +:none+ (install no
+      # callbacks; drive maintenance through the public ingestion API from an
+      # external adapter). A view can override this with +change_source+.
+      # Lazily defaulted (like +max_tracked_partitions+) so it stays out of
+      # +initialize+.
+      #
+      # @return [Symbol]
+      def default_change_source=(value)
+        @default_change_source = ChangeSource.cast(value)
+      end
+
+      def default_change_source
+        @default_change_source ||= ChangeSource::CALLBACKS
+      end
+
       # Cap on distinct partitions tracked in a view's pending maintenance before
       # it collapses to a single full recompute. Bounds the per-write cost of a
       # bulk write that spans many partitions. Defaults to 1000.
       #
       # @return [Integer]
-      sig { params(max_tracked_partitions: Integer).void }
       attr_writer :max_tracked_partitions
 
-      sig { returns(Integer) }
       def max_tracked_partitions
-        @max_tracked_partitions ||= T.let(1_000, T.nilable(Integer))
+        @max_tracked_partitions ||= 1_000
       end
 
-      sig { void }
+      # App-relative directories the Railtie eager-loads on boot (and on each dev reload) so every
+      # view class is loaded — and its +depends_on+ commit callbacks installed — even under Zeitwerk's
+      # lazy loading (`config.eager_load = false`, i.e. development and test). Without this, a view
+      # whose constant nothing has referenced yet has no callbacks, so writes to its dependencies
+      # silently don't schedule maintenance until something first touches the class. Defaults to
+      # +["app/models"]+ (where view classes conventionally live); set to +[]+ to disable, or list your
+      # own directories. Only existing directories that are Zeitwerk autoload roots are loaded — a path
+      # outside the autoloader (or a production app that already eager-loads) is a safe no-op.
+      #
+      # @return [Array<String>]
+      attr_accessor :view_load_paths
+
       def initialize
-        @metadata_table_name = T.let("ar_materialized_view_metadata", String)
-        @partition_table_name = T.let("ar_materialized_view_partitions", String)
-        @default_max_staleness = T.let(nil, T.nilable(DebounceInterval))
-        @refresh_timeout = T.let(nil, T.nilable(Integer))
-        @atomic_swap_refresh = T.let(true, T::Boolean)
-        @default_refresh_strategy = T.let(:async, Symbol)
-        @default_refresh_debounce = T.let(2, DebounceInterval)
-        @refresh_dispatcher = T.let(:async, Symbol)
-        @refresh_queue_name = T.let(:materialized_views, Symbol)
-        @default_cold_read_strategy = T.let(:read_through, Symbol)
+        @metadata_table_name = "ar_materialized_view_metadata"
+        @partition_table_name = "ar_materialized_view_partitions"
+        @write_outbox_table_name = "ar_materialized_view_write_outbox"
+        @source_watermark_table_name = "ar_materialized_view_source_watermarks"
+        @default_max_staleness = nil
+        @refresh_timeout = nil
+        @atomic_swap_refresh = true
+        @default_refresh_strategy = :async
+        @default_refresh_debounce = 2
+        # @refresh_dispatcher intentionally unset — lazily resolved from ActiveJob availability.
+        @refresh_queue_name = :materialized_views
+        @default_cold_read_strategy = :read_through
+        @replica_lag = 0
+        @view_load_paths = ["app/models"]
+      end
+
+      # Whether ActiveJob is loaded — the single source of truth for the dispatcher default and
+      # the module's dispatch/enqueue guards. Extracted (rather than an inline +defined?+) so it is
+      # testable regardless of whether the host app pulled in ActiveJob.
+      #
+      # @return [Boolean]
+      def active_job_available?
+        !defined?(ActiveJob::Base).nil?
       end
     end
   end

data/lib/activerecord/materialized/connection_routing.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Materialized
+    # Routes work to a Rails multi-database role when the app has configured one: maintenance writes
+    # to the primary, verification reads to a replica (the verify-on-replica / repair-on-primary
+    # split). A nil role — the default — yields on the current connection, so single-database apps
+    # and those relying on Rails' automatic role switching are unaffected.
+    #
+    # @api private
+    module ConnectionRouting
+      module_function
+
+      def maintenance(&block)
+        with_role(ActiveRecord::Materialized.configuration.maintenance_role, &block)
+      end
+
+      def verification(&block)
+        with_role(ActiveRecord::Materialized.configuration.verification_role, &block)
+      end
+
+      def with_role(role, &block)
+        return yield if role.nil?
+
+        ActiveRecord::Base.connected_to(role: role, &block)
+      end
+    end
+  end
+end

data/lib/activerecord/materialized/data_verification_result.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Materialized
+    # The outcome of a {DataVerifier} run: the partition keys whose materialized
+    # contents diverge from the source relation, plus how much was checked.
+    DataVerificationResult = Data.define(
+      :view_name,
+      :mode,
+      :total_partition_count,
+      :checked_partition_count,
+      # In the source relation but absent from the cache.
+      :missing_keys,
+      # In the cache but absent from the source relation.
+      :extra_keys,
+      # Present in both, but the partition's cache contents diverge. In +:full+ and
+      # +:checksum+ this means the value columns differ; in every mode (including
+      # +:row_count+) it also flags a partition the cache holds a different *number*
+      # of rows for than the source — a duplicated or lost row within the partition.
+      :mismatched_keys
+    ) do
+      # A clean result covering nothing — for a view that isn't materialized yet.
+      def self.empty(view_name:, mode:)
+        new(
+          view_name: view_name, mode: mode, total_partition_count: 0, checked_partition_count: 0,
+          missing_keys: [], extra_keys: [], mismatched_keys: []
+        )
+      end
+
+      def drifted?
+        missing_keys.any? || extra_keys.any? || mismatched_keys.any?
+      end
+
+      # Every diverging partition key, however it diverged — the set a reconciliation
+      # re-maintains (see {Reconciler}).
+      def divergent_keys
+        (missing_keys + extra_keys + mismatched_keys).uniq
+      end
+    end
+  end
+end

data/lib/activerecord/materialized/data_verifier.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Materialized
+    # Detects DATA drift — the materialized cache diverging from what the source
+    # relation would produce right now — as opposed to {SchemaVerifier}'s schema
+    # drift. Stateless: it only reads and compares.
+    #
+    # Modes trade cost for depth:
+    # * +:row_count+ — which partitions exist (missing/extra); cheapest.
+    # * +:checksum+  — a per-partition digest of the value columns.
+    # * +:full+      — the value columns exactly.
+    #
+    # +sample:+ (Integer count / Float fraction) value-checks a random subset of
+    # partitions for large views; a sample covering every partition runs exhaustive.
+    #
+    # Covers grouped/aggregate views whose GROUP BY keys map to projected columns
+    # (the incremental-maintenance target). A non-grouped view, or one whose group
+    # key can't be matched to a projected column, is skipped (an empty result).
+    class DataVerifier
+      # Raised (by {Materialized.verify_data!}) when a view's contents have drifted.
+      class DataDriftError < StandardError; end
+
+      MODES = %i[row_count checksum full].freeze
+
+      def initialize(view_class, mode: :checksum, sample: nil)
+        raise ArgumentError, "unknown data-verification mode #{mode.inspect}" unless MODES.include?(mode)
+
+        @view_class = view_class
+        @mode = mode
+        @sample = sample
+      end
+
+      def verify
+        # verifiable? reads metadata/schema (and may provision the metadata table on first use), so it
+        # runs on the ambient/primary connection — never the read-only replica. Only the cache-vs-source
+        # comparison is routed to the verification role, inside one snapshot.
+        return empty_result unless verifiable?
+
+        ConnectionRouting.verification { in_consistent_snapshot { verify_within_snapshot } }
+      end
+
+      private
+
+      # Read the cache and the recomputed source inside one transaction, so both sides come from a
+      # single snapshot: a write landing mid-verify — or replication lag, when reads are pinned to a
+      # replica — can't make consistent data look like drift. SQLite has no explicit isolation levels
+      # (and its single-writer model already reads consistently), and an already-open transaction
+      # can't raise its level, so both fall back to a plain transaction.
+      def in_consistent_snapshot(&block)
+        @view_class.transaction(isolation: snapshot_isolation, &block)
+      end
+
+      def snapshot_isolation
+        connection = @view_class.connection
+        return nil if connection.open_transactions.positive? # can't raise isolation in a nested transaction
+        return nil if connection.adapter_name.match?(/sqlite/i) # /sqlite/i: SQLite has no explicit isolation levels
+
+        :repeatable_read
+      end
+
+      def verify_within_snapshot
+        return verify_exhaustive if @sample.nil?
+
+        keys = cache_partition_keys
+        size = sample_size(keys.size)
+        return verify_exhaustive if size >= keys.size # a sample covering everything is exhaustive
+        return empty_result if size.zero?             # sample: 0 => nothing checked
+
+        verify_sampled(Array(keys.sample(size)), keys.size)
+      end
+
+      # Compares every partition, so it detects missing, extra, and mismatched.
+      def verify_exhaustive
+        cache = snapshot(@view_class.unscoped)
+        source = snapshot(@view_class.resolved_source)
+        total = (cache.keys | source.keys).size # every partition on either side
+        build_result(cache, source, total: total, checked: total, exhaustive: true)
+      end
+
+      # A value-drift probe over a random subset of materialized partitions. It
+      # cannot detect missing (source-only) partitions — that needs a full source
+      # scan — so it never reports them.
+      def verify_sampled(checked, total)
+        cache = snapshot(view_definition.partition_scope_on(@view_class, checked))
+        source = snapshot(view_definition.partition_scope(checked))
+        build_result(cache, source, total: total, checked: checked.size, exhaustive: false)
+      end
+
+      def build_result(cache, source, total:, checked:, exhaustive:)
+        shared = cache.keys & source.keys
+        DataVerificationResult.new(
+          view_name: @view_class.view_key, mode: @mode,
+          total_partition_count: total, checked_partition_count: checked,
+          missing_keys: exhaustive ? source.keys - cache.keys : [],
+          extra_keys: cache.keys - source.keys,
+          # Signature tallies differ on value drift and on a duplicated cache row
+          # (row_count's tally is of row presence, so it catches duplicates too).
+          mismatched_keys: shared.reject { |key| cache[key] == source[key] }
+        )
+      end
+
+      def snapshot(relation)
+        PartitionSnapshot.new(@view_class, key_columns, projected_columns - key_columns, @mode).of(relation)
+      end
+
+      # Verifiable when the view is a materialized aggregate whose group keys map to
+      # projected columns and whose cache table actually has those columns (a
+      # schema-drifted cache is skipped — run `verify_schema!` for that).
+      def verifiable?
+        keys = view_definition.group_key_columns
+        @view_class.materialized? && keys.any? && key_columns.size == keys.size &&
+          (projected_columns - @view_class.column_names).empty?
+      end
+
+      # Distinct group-key tuples in the cache — the population a sample is drawn from.
+      # `distinct` dedups in the database, so only one row per partition crosses into
+      # Ruby; the random draw stays in Ruby because a DB-side random order is neither an
+      # ActiveRecord primitive nor portable across adapters. `pluck` returns scalars for
+      # a single key (wrapped to 1-tuples so a NULL key becomes [nil], not the [] that
+      # Array(nil) would give) and tuples for a composite key.
+      def cache_partition_keys
+        values = @view_class.unscoped.distinct.pluck(*key_columns)
+        key_columns.one? ? values.zip : values
+      end
+
+      # GROUP BY keys as their projected/cache column names (qualifier stripped), so a
+      # joined key like "authors.country" matches the projected "country".
+      def key_columns
+        @key_columns ||= view_definition.group_key_columns.filter_map { |column| projected_column_for(column) }
+      end
+
+      def projected_column_for(column)
+        return column if projected_columns.include?(column)
+
+        stripped = column.split(".").last
+        projected_columns.include?(stripped) ? stripped : nil
+      end
+
+      def projected_columns
+        @projected_columns ||= CacheTableSchema.column_definitions(@view_class.connection,
+                                                                   @view_class.resolved_source).map(&:name)
+      end
+
+      def view_definition
+        @view_definition ||= @view_class.view_definition
+      end
+
+      def sample_size(total)
+        sample = @sample
+        return total if sample.nil?
+
+        size = sample.is_a?(Float) ? (total * sample).ceil : sample.to_i
+        size.clamp(0, total)
+      end
+
+      def empty_result
+        DataVerificationResult.empty(view_name: @view_class.view_key, mode: @mode)
+      end
+    end
+  end
+end

data/lib/activerecord/materialized/debezium_envelope.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Materialized
+    # Maps a Debezium change envelope to an {Materialized.ingest_change} descriptor. Pure and
+    # dependency-free: no Kafka / Debezium / Kafka-Connect runtime — just a mapping over the decoded
+    # envelope hash a consumer already holds. It removes the boilerplate (and the easy-to-miss cases:
+    # snapshot reads, tombstones, the nested/unwrapped shapes) every consumer otherwise hand-writes.
+    #
+    # The envelope shape (a Debezium MySQL/Postgres connector event, whether or not the
+    # ExtractNewRecordState "unwrap" SMT has been applied — a nested +payload+ is unwrapped here):
+    #
+    #   { "op" => "u",
+    #     "before" => { "id" => 1, "category" => "books", ... },   # full row image (see below)
+    #     "after"  => { "id" => 1, "category" => "games", ... },
+    #     "ts_ms"  => 1710000000000,                               # connector processing time (unused)
+    #     "source" => { "table" => "line_items", "ts_ms" => 1710000000000, ... } }
+    #
+    # The +source.ts_ms+ (the DB commit time, monotonic within a source) is forwarded as the +source_ts+
+    # watermark, so a consumer relaying envelopes gets out-of-order suppression + freshness
+    # ({SourceWatermark}) for free. The top-level +ts_ms+ is a *different* clock (the connector's
+    # processing time), so it is not used as a fallback — mixing clocks would break monotonicity.
+    # Correct **partition-moving** updates require a full +before+ image (+binlog-row-image=FULL+ on
+    # MySQL, +REPLICA IDENTITY FULL+ on Postgres); with only the primary key in +before+, the old
+    # partition is under-maintained until reconciliation heals it. See +docs/out-of-band-writes.md+
+    # and the CDC section of the README. This adapter is Debezium-specific; a Maxwell/other envelope
+    # (no +op+) raises rather than being silently dropped.
+    module DebeziumEnvelope
+      # Debezium +op+ → the gem's operation. A snapshot read ("r") is a create; "d" is a destroy.
+      OPERATIONS = { "c" => :create, "r" => :create, "u" => :update, "d" => :destroy }.freeze
+      private_constant :OPERATIONS
+
+      # @param envelope [Hash, nil] a decoded Debezium change event (string or symbol keys), or +nil+
+      #   for a Kafka tombstone (the null-value message emitted after a delete for log compaction)
+      # @param table [String, Symbol, nil] target-table override; defaults to the envelope's +source.table+
+      # @return [Hash, nil] +{ table:, operation:, before:, after: }+ (plus +source_ts:+ when the
+      #   envelope carries a usable +ts_ms+) for {Materialized.ingest_change}, or +nil+ for a
+      #   tombstone (nothing to relay)
+      # @raise [ArgumentError] for a non-tombstone envelope with no +op+ (not a Debezium change event,
+      #   or not unwrapped), an unsupported +op+, or when the target table can't be determined
+      def self.to_change_descriptor(envelope, table = nil)
+        return nil if envelope.nil? # Kafka tombstone
+
+        change = unwrap(envelope)
+        op = fetch(change, "op")
+        raise ArgumentError, "not a Debezium change envelope (no op)" if op.nil?
+
+        descriptor = { table: resolve_table(table, change), operation: operation_for(op),
+                       before: fetch(change, "before"), after: fetch(change, "after") }
+        ts = source_ts(change)
+        ts ? descriptor.merge(source_ts: ts) : descriptor
+      end
+
+      # Debezium's default envelope nests the change under +payload+; the ExtractNewRecordState SMT
+      # unwraps it to the top level. Accept either by unwrapping a +payload+ that carries the +op+.
+      def self.unwrap(envelope)
+        payload = fetch(envelope, "payload")
+        payload.is_a?(Hash) && fetch(payload, "op") ? payload : envelope
+      end
+      private_class_method :unwrap
+
+      # Read a key from an envelope that may use string or symbol keys, without deep-copying the hash
+      # (before/after images can be wide, and are copied again downstream by WriteChange).
+      def self.fetch(hash, key)
+        return nil unless hash.is_a?(Hash)
+
+        hash.key?(key) ? hash[key] : hash[key.to_sym]
+      end
+      private_class_method :fetch
+
+      # A field from the envelope's +source+ metadata block (string/symbol keys), or nil if absent.
+      def self.source_field(change, key)
+        fetch(fetch(change, "source"), key)
+      end
+      private_class_method :source_field
+
+      def self.operation_for(op_code)
+        OPERATIONS.fetch(op_code.to_s) do
+          raise ArgumentError, "unsupported Debezium op #{op_code.inspect} (expected one of c, r, u, d)"
+        end
+      end
+      private_class_method :operation_for
+
+      def self.resolve_table(table, change)
+        resolved = table.presence || source_field(change, "table")
+        return resolved.to_s if resolved.present?
+
+        raise ArgumentError, "could not determine the table (pass table or include source.table in the envelope)"
+      end
+      private_class_method :resolve_table
+
+      # The per-partition source watermark for this change: Debezium's +source.ts_ms+ (the DB commit
+      # time, monotonic within a source). Only an Integer is forwarded — a missing or non-integer value
+      # yields no watermark, so the change is maintained exactly as before (see {SourceWatermark}). The
+      # top-level +ts_ms+ (the connector's *processing* wall-clock) is intentionally NOT a fallback: it
+      # is a different clock, so mixing the two per partition would break the monotonicity suppression
+      # relies on. A real Debezium change event always carries +source.ts_ms+.
+      def self.source_ts(change)
+        ts = source_field(change, "ts_ms")
+        ts if ts.is_a?(Integer)
+      end
+      private_class_method :source_ts
+    end
+  end
+end

data/lib/activerecord/materialized/delta_maintainer.rb

@@ -1,4 +1,3 @@
-# typed: strict
 # frozen_string_literal: true
 
 module ActiveRecord
@@ -7,28 +6,22 @@ module ActiveRecord
     # re-reading base rows: new partitions inserted, existing ones incremented in
     # place (NULL-safe for SUM), and emptied partitions deleted.
     class DeltaMaintainer
-      extend T::Sig
-
-      sig { params(view_class: ViewClass).void }
       def initialize(view_class)
         @view_class = view_class
-        @analysis = T.let(AggregateAnalysis.new(view_class.resolved_source), AggregateAnalysis)
+        @analysis = AggregateAnalysis.new(view_class.resolved_source)
       end
 
-      sig { params(summary: SummaryDelta).returns(Integer) }
       def apply!(summary)
         summary.buckets.each { |key_tuple, column_deltas| apply_partition(key_tuple, column_deltas) }
-        T.unsafe(@view_class).unscoped.count
+        summary.buckets.size # partitions applied; row-count reporting is the caller's job, outside the lock
       end
 
       private
 
-      sig { returns(T::Array[String]) }
       def group_columns
         @view_class.maintenance_key_columns
       end
 
-      sig { params(key_tuple: SummaryDelta::KeyTuple, column_deltas: T::Hash[String, Numeric]).void }
       def apply_partition(key_tuple, column_deltas)
         existing = partition_scope(key_tuple).first
         if existing.nil?
@@ -40,28 +33,24 @@ module ActiveRecord
         end
       end
 
-      sig { params(key_tuple: SummaryDelta::KeyTuple).returns(::ActiveRecord::Relation) }
       def partition_scope(key_tuple)
-        T.unsafe(@view_class).unscoped.where(group_columns.zip(key_tuple).to_h)
+        @view_class.unscoped.where(group_columns.zip(key_tuple).to_h)
       end
 
-      sig { params(key_tuple: SummaryDelta::KeyTuple, column_deltas: T::Hash[String, Numeric]).void }
       def insert_partition(key_tuple, column_deltas)
         # A new partition's deltas are its absolute values; aggregates with no
         # delta default to 0, not NULL, since the partition has rows.
         defaults = @analysis.aggregate_columns.to_h { |column| [column.name, 0] }
         row = group_columns.zip(key_tuple).to_h.merge(defaults).merge(column_deltas)
-        T.unsafe(@view_class).create!(row)
+        @view_class.create!(row)
       end
 
       # Adds each delta to the current value, treating a NULL SUM as zero.
-      sig { params(existing: T.untyped, column_deltas: T::Hash[String, Numeric]).void }
       def add_deltas!(existing, column_deltas)
         new_values = column_deltas.to_h { |column, amount| [column, (existing[column] || 0) + amount] }
         existing.update!(new_values)
       end
 
-      sig { params(existing: T.untyped, column_deltas: T::Hash[String, Numeric]).returns(T::Boolean) }
       def emptied?(existing, column_deltas)
         column = @analysis.row_count_column
         return false if column.nil?