concerns_on_rails 1.29.0 → 1.31.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f00644495f4a20c3265cfa9289708136b4bb086aebeeb16026ebd2c9e12f7991
-  data.tar.gz: 01162f76ade27fb2b42aa93c3317819fb4db96c761717fdc20cafeedd213046f
+  metadata.gz: 493ce0d913905625ffaabf033052a0ccc631aa22fe3c9a06a04c776ad4a80f67
+  data.tar.gz: 022bb7a0230e1c9c8ebc210c43245cf458c9248f3810f24f02c731695c0c046d
 SHA512:
-  metadata.gz: fad1b9c385054e869d5dcd4012f1e06182b3597c63a500d6513521fbefd758480ffcaf85922c0d805a2d1b07430f03a3d0a3fb1184f510450adfabd311155630
-  data.tar.gz: e7a299357dc9f389a4e9e99241af15c783806a96dc4b9037fe5283d1737038b63f53224a3c6e77e5f5b0a926e3d341df435c8c7b0d319a73258b33a489a15614
+  metadata.gz: 55cd86cfb3b04af3972060c2d4455dca7fe2ee7abfdccfa029c75ee6a9caee4b6700eeb128dd3f15aec5c52460af7ca5936935185593788d02df9c050044e3fa
+  data.tar.gz: 750dda120eb24d9e3d121a8e4ec1828e2d26303677f5758bc415f138fa4497845e1b67219203dc593ad5fe55a1a406e77d544b292f1639d4aa56546bb855010a

data/CHANGELOG.md

@@ -1,5 +1,475 @@
 <!-- CHANGELOG.md -->
 
+## 1.31.0 (2026-10-05)
+
+The fixes from two audits, each fix put through adversarial review rounds until a reviewer
+signed it off: the 2026-09-25 audit of 1.30.0 (#116–#120) and the 2026-09-30 audit of this
+release's own candidate (#123–#125: values generated in `before_create`, optimistic locking
+around the gem's raw writes, and time values), plus dependency refreshes (#121, #126). It is a
+minor release because Sequenceable gains an option and a reader, and several fixes change
+observable behaviour or raise where the gem used to silently misbehave. Read **Changed** before
+upgrading: blind indexes of generated encrypted values, and of `:datetime` fields, want a
+one-off backfill. No new concerns and no migrations. Every fix ships with a regression spec.
+2723 examples, 0 failures (2694 on Rails 6.0), green on PostgreSQL and MySQL.
+
+### Changed
+- **Sequenceable: `reset:` periods are cut in one fixed zone**, not the per-request
+  `Time.zone`. The `MAX` range and the period token both use the new `time_zone:` (default:
+  `config.time_zone`, resolved at use time, else UTC). Before, two requests in different zones
+  (Timezoneable, `Time.use_zone`) could issue the **same number**, and `formatted_<field>`
+  without `into:` rendered a different date for readers in different zones. Apps that keep
+  `Time.zone == config.time_zone` see no change. With `into:` and `reset:` (no `template:`) the
+  next number also accounts for rows whose stored value already carries the period's `prefix +
+  token + separator`, so a number stamped under a request zone before the upgrade is continued,
+  never reissued; without `into:`, add a unique index before upgrading. (#116)
+- **Sequenceable: re-declaration.** A call passing **only `assign:` and/or `time_zone:`** keeps
+  the rest of the field's current config, so `sequenceable_by :sequence, assign: :manual` on a
+  `Draft` subclass keeps the parent's `into:`/`prefix:`/`reset:`/`template:`. Every other
+  re-declaration, a bare one included, restates the format from the defaults as before. A
+  re-declaration whose full format tuple is identical to an inherited owner's now shares that
+  owner's counter, instead of numbering a subclass-only series that could reissue its numbers
+  (Procs compare by identity, so a draft subclass should re-declare only `assign:`).
+  **Upgrading:** a subclass declared the `assign:`-only way used to number its own
+  default-format series; its rows without an `into:` value now render in the parent's format,
+  so backfill `into:` first. (#116)
+- **Sequenceable: classes sharing a counter under `reset:` must cut the same periods.** Both
+  `time_zone:` omitted, or both explicit and the same zone (compared by canonical TZInfo
+  identifier, then by UTC offsets 1970–2100, so `"Kolkata"`/`"Asia/Calcutta"` match), else
+  `ArgumentError` at class load. Declare `time_zone:` on the class that first declares a
+  format, and declare an owner fully before its subclasses. (#116)
+- **CursorPaginatable: nullable ordering columns paginate, NULLs last** in both directions on
+  every adapter (PostgreSQL `NULLS LAST`, a `CASE` sort key elsewhere; the keyset WHERE uses
+  the OR-expansion). NULL-ordered rows used to be silently dropped, and NULLs sorted first
+  under PostgreSQL DESC and SQLite/MySQL ASC. NOT NULL columns keep the same SQL. An ordering
+  column the relation did not select raises `ActiveModel::MissingAttributeError`, a stored
+  non-NULL value that casts to nil raises `ArgumentError`, and ordering columns must be
+  selected unaliased. (#117)
+- **CursorPaginatable**: re-declaring `cursor_paginate_by` (e.g. in a subclass) changes only
+  the options passed and inherits the rest, so a subclass setting only `order:` no longer
+  silently disables the parent's `signed:`. (#117)
+- **Paginatable**: a `DISTINCT` relation with its own `SELECT` list
+  (`select(:group_id).distinct`) is counted as a subquery of the relation's own SQL, so
+  `X-Total-Count` / `X-Total-Pages` count the distinct rows returned, not every underlying row.
+  Only MySQL, which rejects repeated output names in a derived table (error 1060, recognised by
+  driver code), retries with the select list re-aliased, and falls back to the previous
+  over-count if that fails too. (#117)
+- **Stateable: name collisions raise.** `stateable_by` raises `ArgumentError` when a generated
+  `<state>?`/`<state>!`/`<event>!`/`may_<event>?` method or `.<state>` scope would override a
+  method the class already has from ActiveRecord or another concern — an event `lock`
+  overriding AR's `lock!` (which broke `with_lock` and `lock: true`), an event `restore` next
+  to SoftDeletable, a state `active` next to Activatable. Use `prefix:`/`suffix:`. The reverse
+  order raises too. One exemption: a state may take a scope that is still SoftDeletable's,
+  Publishable's or Schedulable's untouched include-time default on the same class, so that
+  concern's own macro can rename it — include that concern before `stateable_by`; only its
+  affixing macro may come after. An unrenamed collision raises when the shared scope is called.
+  (#120)
+- **Stateable**: a re-declaration retires the methods and scopes the earlier declaration
+  generated and the new one no longer lists (a subclass with `states: %i[open closed]` no
+  longer answers its parent's `archive!` or `.draft`). Only methods Stateable itself defined
+  are retired; a user's own method under such a name is left alone. The attribute default no
+  longer forces a `:string` type onto the state column (a PG enum/citext or host-declared
+  `attribute` type is kept, per declaring class), and a re-declaration without `default:` keeps
+  the earlier default only while it is still a declared state. (#120)
+- **Publishable**: `default_scope:` is a flag read by one lazily registered default scope,
+  added only the first time a class passes `default_scope: true`, so a model that never asks
+  for it keeps Rails' statement cache. An explicit `default_scope: false` on a later call or an
+  STI subclass turns it off; omitting the option keeps the inherited setting. (#120)
+- **Encryptable**: an encrypted field used as a friendly_id slug source raises `ArgumentError`
+  — the `sluggable_by` field, a `candidates:` entry, an `alias_attribute` of the field (chains
+  followed) or a bare friendly_id base — at declaration where it can, otherwise at save, before
+  the row is written. The slug used to store the field's plaintext. **Upgrading:** regenerate
+  those slugs from a safe field and delete the stale `friendly_id_slugs` rows (see the
+  Encryptable docs). (#118)
+- **SoftDeletable `cascade:` / Duplicable** now reach children hidden by Publishable's
+  `default_scope: true` (drafts). Only the gem's own hiding predicates on the child's own table
+  are removed; every other default-scope predicate still applies, as for Rails' `dependent:` —
+  a tenant scope, a discriminator on a shared table, a joined table's same-named column. A
+  `has_one` cascades to / copies the child its reader returns. Duplicable never copies a
+  SoftDeletable child's soft-deleted rows into a `has_many`/`has_one` copy, whatever its
+  `default_scope:` (with it off, the copy used to get them back as live rows). (#119)
+- **Normalizable**: saves that skip validation (`update_attribute`, `save(validate: false)`)
+  are normalized by a prepended `before_save` backstop, so Encryptable's blind index, Auditable
+  and Addressable see the normalized value whatever the include order. (#120)
+- **CounterCacheable**: re-declaring the same association + `count:` column replaces the
+  earlier rule (it double-counted); an STI subclass can narrow an inherited counter with `if:`;
+  on an STI table `recount_counter_caches!` tallies every class's rows under its own rule,
+  resolving each stored type without building a record (an unknown type counts under the base
+  rule instead of raising). (#120)
+
+- **Upgrading (Encryptable + Tokenizable/Hashable/Sequenceable):** rows created before this
+  release with a generated, blind-indexed encrypted value (a token, code or number) were stored
+  with a **NULL** blind index. They stay unfindable by `find_by_<field>` / `where_<field>` /
+  `authenticate_by_<field>` / `consume_<field>` until backfilled. `reencrypt_all!` does not
+  reach them, because they are already under the current key. Run once per field:
+  `Model.unscoped.where(<field>_bidx: nil).where.not(<field>: nil).find_each { |r|
+  r.update_columns(<field>_bidx: Model.<field>_fingerprint(r.<field>)) }` (no callbacks, any
+  key). See `docs/concerns/encryptable.md#upgrading-blind-indexes-of-generated-values`. (#123)
+- **Searchable:** `searchable_by` over an `encryptable` column (or `encryptable` over a searched
+  one) raises `ArgumentError` at declaration. Before, `search` ran `LIKE` against ciphertext and
+  silently returned nothing. (#123)
+- **Taggable:** `taggable_by` over an `encryptable` column (or `encryptable` over the tag
+  column) raises `ArgumentError` at declaration. A model that includes Taggable without
+  `taggable_by` and encrypts its default `:tags` is refused when `tagged_with` is called. New
+  `taggable_declared` class attribute. (#123)
+- **Tokenizable:** on an `encryptable :<field>, blind_index: true` token,
+  `authenticate_by_<field>` / `consume_<field>` look the token up through the blind index (still
+  `secure_compare`d), and `consume_<field>` clears the index along with the token. Encrypted
+  without a blind index, they raise `ArgumentError` when called; before, they returned `nil` for
+  every token. Generating, storing and rotating an encrypted token work as before. (#123)
+- **Anonymizable:** with `lock_version`, `anonymize!` / `anonymize_all!` write their single
+  UPDATE through `update_all`, bumping `lock_version` in SQL (the row's value + 1). An edit form
+  loaded before the erasure now raises `StaleObjectError` instead of writing the personal data
+  back. A stale anonymizing instance now erases; on Rails 7.0+ its constrained `update_columns`
+  used to erase nothing while returning `true`. `update_columns`' refusals (destroyed,
+  `readonly!`, `attr_readonly`) are kept. (#124)
+- **Expirable:** `extend_expiry!` extends the **stored** expiry, read under a row lock, so
+  concurrent extensions compound (two `+30.days` renewals give +60, not +30). An expiry assigned
+  but not yet saved, and a new record, still extend from the instance's value. With optimistic
+  locking, a stale instance raises `StaleObjectError` rather than losing a renewal. (#124)
+- **Encryptable:** `type: :datetime` behaves like a datetime column on the same model. Under
+  `time_zone_aware_attributes`, a zone-less String (a `datetime-local` form value) and a
+  `datetime_select` value are wall-clock time in `Time.zone`, a `Date` is midnight there, and
+  the field reads back as an `ActiveSupport::TimeWithZone`. Otherwise it follows
+  `ActiveRecord.default_timezone`. It is exactly the handling Rails gives `attribute :name,
+  :datetime` (ActiveRecord wraps the type in its own `TimeZoneConverter`), so `normalizes` and a
+  parent's re-declaration are inherited by subclasses.
+  `skip_time_zone_conversion_for_attributes` (Symbols) is honored when set before the
+  `encryptable` line; on Rails 6.0–7.1 wherever it is set. From Rails 7.2, where Rails decides
+  at declaration, a skip list set later or on a subclass raises `ArgumentError` when the model
+  is first used, unless the field is re-declared right after it. The plaintext stays UTC
+  ISO8601, so existing rows read as the same instant. A stored plaintext without `Z` or an
+  offset is read in `default_timezone`, never the server's zone. (#125)
+- **Encryptable:** a blind index fingerprints the field's canonical plaintext (the value cast
+  through its `type:`, a `:datetime` as UTC ISO8601) on write and on lookup. `find_by_<field>` /
+  `where_<field>` on a `:datetime` field find the record by any rendering of the instant,
+  whatever `Time.zone` the writer, the reader or `reencrypt!` ran in, and a String finds a typed
+  field (`find_by_age("042")`). `expression:` receives the cast value (a `:datetime` as a UTC
+  `Time`). Lookups also try the digest the index used before, so existing rows stay findable by
+  the lookup that found them. `:datetime` fields should be reindexed once (recipe in
+  `docs/concerns/encryptable.md#blind-index-of-a-typed-field`, which skips rows it cannot
+  decrypt); every other type's digest is unchanged. A non-numeric String on an `:integer` field
+  finds nothing, as an integer column's `where`, and a value that does not cast
+  (`Float::INFINITY`) is stored as `NULL` with no digest. (#125)
+- **Storable:** `:datetime` keys behave like a datetime column on the same model, with the same
+  `Time.zone` / `default_timezone` rules as Encryptable. The reader returns an
+  `ActiveSupport::TimeWithZone` under `time_zone_aware_attributes`, `where_<key>` parses its
+  argument the same way as the writer, a `datetime_select` value is wall-clock time in
+  `Time.zone`, and a `default:` (a String, a `Time` or a Proc) reads back as the same value
+  stored would. List the accessor in `skip_time_zone_conversion_for_attributes` to opt a key
+  out. The stored UTC ISO8601 form is unchanged. (#125)
+- **Publishable / SoftDeletable / Schedulable / Expirable:** `publish_at!`, `soft_delete!(at:)`,
+  `start!`, `finish!`, `reschedule!`, `expire!` and `expire_all` raise `ArgumentError` before
+  any hook runs when given a value that is not a time: a String must read as a date the way
+  `Time.zone.parse` will read it: a four-digit year, no ordinal day, every part in range, years
+  0001–9999, and only date words or a time zone (ISO 8601, RFC 2822 with its comments, HTTP
+  dates, JavaScript `Date#toString`, Go and RFC 9557 forms, `"Oct 1 2026"`, `"2026-10-01 10:30
+  EST"` and `"10:30 p.m."` all pass; `"junk"`, `"Monday"`, `"10:30"`, `"junk 2026"`, `"Oct 1
+  26"`, `"15th of October 2026"` and `"7:30p"` do not, although `Time.zone.parse` reads them as
+  June 1st, today, year 26 AD, October 1st or military zone P), and `42` or `1.hour` never cast.
+  The first five used to write `NULL` and still return `true`; Expirable accepted the yearless
+  words in time-zone-aware apps. Column assignment is unchanged. The check is the shared
+  `Support::TimeValue.cast_argument!`. (#125)
+- **SoftDeletable:** `soft_delete!(at: nil)` or a blank `at:` means now, as for `expire!`.
+  `soft_delete!(at: params[:at])` with the param absent used to write `NULL`, fire the hooks and
+  return `true` with nothing deleted. `publish_at!(nil)` (and blank) still writes `NULL` and
+  fires the publish hooks. (#125)
+
+### Added
+- **Sequenceable**: `time_zone:` (a zone name as a String or Symbol, or an
+  `ActiveSupport::TimeZone`; an unknown zone raises at class load) and
+  `sequenceable_period_time(field)`, the fixed-zone period instant for `template:` lambdas that
+  render a date. (#116)
+
+### Fixed
+- **Sequenceable**: re-declaring a field with `assign: :manual`, on the same class or an STI
+  subclass, really stops numbering at create. Each call used to add its own `before_create`
+  lambda, and the earlier `:create` one kept firing. Each field now has one symbol callback,
+  registered at its first `assign: :create` declaration, honouring the receiving class's
+  current declaration. (#116)
+- **Paginatable**: `paginated(Model)` / `pagination_meta(Model)` with a bare model class no
+  longer raises. A non-finite JSON-body `page`/`per_page` (`1e400`, NaN) falls back to the
+  default instead of a 500 (Paginatable and CursorPaginatable). (#117)
+- **CursorPaginatable**: boundary values are read from the stored column, so an overridden
+  attribute reader no longer makes the walk repeat pages forever, and a value changed in memory
+  (an `after_initialize` default) no longer keys the cursor on a value the row's sort position
+  does not have. (#117)
+- **Callable options**: Throttleable `by:`, WebhookVerifiable `secret:`, Deprecatable
+  `notify:`, CounterCacheable `if:` and Auditable `actor:` accept every callable the macro
+  validates. A lambda with no required parameter or a block is `instance_exec`'d as before; a
+  lambda with a required parameter or a symbol proc is called with the controller (the record
+  for `if:`/`actor:`); any other callable object gets it only when its `#call` requires an
+  argument, and is otherwise called bare. These used to raise `TypeError`/`ArgumentError` (for
+  `actor:`, on every save). Throttleable's `if:`/`unless:` keep their own dispatch. (#117)
+- **Anonymizable**: a callable-object `with:` strategy no longer raises `NoMethodError`
+  (`#arity`). (#117) A rewritten slug counts as an erased field for `clear_audit_trail:`,
+  `slug: :auto` sees a slug built from an `alias_attribute` of an erased column, erasing an
+  Addressable-mapped column clears its `fingerprint:` in the same UPDATE, and
+  `prefix:`/`suffix:` passed on a later call are honoured (old scope names retired safely).
+  (#118)
+- **Idempotentable**: a replay carries the original's exact `Content-Type`, so
+  `application/problem+json` is no longer replayed with `; charset=utf-8`. (#117)
+- **Monetizable**: underscore-grouped amounts (`"5_5"`, `"1_000"`) are rejected (nil) like
+  other mis-grouped input. (#117)
+- **Filterable**: a nonzero float operand that underflows to 0.0 (`"1e-400"`) is treated as
+  inexact, so `=` matches nothing and `<`/`>` compare correctly. (#117)
+- **Maskable**: presets stringify non-String values before masking instead of returning them
+  raw (integer SSN/phone columns were shown unmasked); integral BigDecimal/Float values render
+  without `.0`. (#118)
+- **Lockable**: `lock_access!` is a conditional UPDATE — a concurrent stale instance adopts the
+  existing lock instead of re-minting the mailed unlock token and re-firing `after_lock`;
+  `before_lock` runs after the row is claimed. `register_failed_attempt!` clears a lapsed lock
+  the same way: a stale instance used to wipe a lock another request had just taken (a second
+  token and `after_lock`, or, below `max_attempts`, an account left unlocked). (#118)
+- **Loader**: every concern file works when required directly (`gem "concerns_on_rails",
+  require: false`). The gem-level singletons live in `concerns_on_rails/core`, and a directly
+  required file now also wires its sensitive fields into Rails' `filter_parameters` and
+  ActiveRecord's `filter_attributes` whether required before, during (eager load,
+  `config/initializers`) or after boot — unlock tokens used to be logged in clear and
+  `#inspect` showed decrypted values. Deprecatable/Timezoneable require the ActiveSupport time
+  extensions they use. (#118)
+- **Sluggable**: a re-declaration refused by the column check no longer leaves its field
+  assigned. **Duplicable**: sibling-concern detection no longer autoloads Sluggable/friendly_id
+  (or raises without the loader). (#118)
+- **Batch verbs** (`*_all`, `anonymize_all!`, `reencrypt_all!`, `recount_counter_caches!`, the
+  cascade) on their per-record path act on exactly the rows an ordered or limited relation
+  selects (`order(id: :desc).limit(2).publish_all` touched the two lowest ids), no longer raise
+  under `error_on_ignored_order`, and visit each record once over a `has_many` join (hooks ran
+  once per joined row); a limited joined slice instantiates one record per row. (#119)
+- **Duplicable**: identity columns (token, slug, sequence number, audit trail, lock state) are
+  reset on copies of children that do not include Duplicable; they used to share the original's
+  token or raise `RecordNotUnique`. (#119)
+- **Hooked writes** (`publish!`, a Stateable event, `soft_delete!`, `expire!`, `activate!`,
+  `anonymize!`): a veto or failure restores every in-memory attribute, including a nested
+  in-place edit of an already-read json value, never decrypting anything. (#119)
+- **Auditable**: works on a native `json`/`jsonb` trail column (declare it without a default —
+  MySQL rejects a literal JSON `DEFAULT`); earlier double-encoded trails still read, and
+  `audit_trail` entries are detached from the column value. (#119)
+- **Searchable**: `mode: :any` strips surrounding whitespace from the query. **Storable**:
+  every non-Proc `default:` is deep-duped per read. (#120)
+
+- **Encryptable:** a blind-indexed value that Tokenizable, Hashable or Sequenceable generates in
+  `before_create` is now fingerprinted when it is generated. Before, the row was stored with a
+  NULL blind index, so `find_by_<field>` never found a freshly created record. Works in either
+  include or declaration order. (#123)
+- **Sluggable:** a slug whose source is filled in `before_create` (Sequenceable's `into:`
+  number, a Hashable code) is now built in the same `INSERT`, not left `nil` until a later save.
+  friendly_id's rules still apply: an explicit slug is kept, a conflict gets the uuid suffix,
+  and `candidates:` are honored. The late slug is built after every
+  `before_validation`/`before_save`, so it gets what those would have done: a reserved word gets
+  the uuid suffix, and the slug column's own write-mode Sanitizable and Normalizable rules are
+  applied (`normalizable :slug, with: ->(v) { v.tr("-", "_") }` → `"inv_1"`). (#123)
+- **Sluggable:** a slug built earlier in the same save from a source that a later
+  `before_validation` then transformed (Sanitizable `on: :write`, Normalizable, your own
+  callback, included after Sluggable) is rebuilt from the final value at the start of
+  validation. Before, `"<b>Hello</b>"` got the slug `"b-hello-b"`. The rebuild runs before every
+  validator (`reserved_words:` included) and every sibling `before_save`, and never touches an
+  explicitly assigned slug. (#123)
+- **Auditable:** the creation entry now includes a tracked column generated in `before_create`
+  (a Sequenceable number, a Tokenizable/Hashable value, or a slug built from one), whatever the
+  include order. (#123)
+- **Hashable:** the report of a generated code to its siblings is a separate `before_create
+  :hashable_report_generated_value`, right after the unchanged `before_create
+  :assign_hashable_value`. Calling `assign_hashable_value` yourself, outside a save, only
+  assigns the value. (#123)
+- **Tokenizable / Hashable:** the uniqueness precheck on an encrypted field goes through the
+  blind index. It used to compare against ciphertext and could never detect a collision. (#123)
+- **Lockable:** with optimistic locking (`lock_version`), the raw writes —
+  `register_failed_attempt!`'s increment, the `lock_access!` claim, the quiet lapsed-lock reset,
+  and `unlock_by_token`'s token claim — bump `lock_version` in SQL, and the bump is now mirrored
+  into the instance exactly as Rails' `increment!` does. The same instance, and the record
+  `unlock_by_token` returns, save afterwards instead of raising `StaleObjectError`. On Rails
+  7.0+ this also fixes `unlock_by_token` leaving the account locked: the stale instance's
+  `update_columns` matched no row while the call reported success. A hook that aborts takes the
+  in-memory bump back. (#124)
+- **CounterCacheable:** with `lock_version` on the parent, the parent instance the child's
+  association holds (`post.comments.create!`'s `post`, the one passed as `post:`, the old parent
+  a foreign-key reassignment left loaded, the parent on destroy) gets the counter delta and the
+  `lock_version` bump mirrored in memory — the in-memory half of native `counter_cache`'s
+  `increment!`. `post.comments.create!(...); post.update!(...)` no longer raises
+  `StaleObjectError`. A counter you assigned and haven't saved is left exactly as assigned,
+  still pending (native `increment!` would add the delta to it), while `lock_version` is still
+  bumped. When the child's save is rolled back — your `ActiveRecord::Rollback`, a later callback
+  raising, a Stateable/HookedWrite hook vetoing, a rolled-back savepoint, a rolled-back
+  `transaction(joinable: false)` — the mirror is taken back off the parent instance, so it stays
+  saveable (native `counter_cache` leaves it stale). Only the adjustments that were actually
+  rolled back are undone, and a counter or `lock_version` you assigned after the mirror is left
+  as you assigned it. The undo holds the parent only weakly, once per parent and transaction, so
+  long batches keep nothing in memory, and the parent stays `Marshal`-dumpable. An
+  `attr_readonly` counter is not mirrored. Known limit: a parent destroyed later in the same
+  rolled-back transaction keeps its mirror (reload it). Without `lock_version`, nothing changes.
+  (#124)
+- **Encryptable:** `reencrypt!` / `reencrypt_all!` no longer bump `lock_version`, since the
+  column is pinned to itself in the rotation UPDATE. A key rotation changes no value, so records
+  open in edit forms during the sweep no longer turn into `StaleObjectError`s. The ciphertext
+  guard is unchanged. (#124)
+- **Stateable:** `lock: true` works on records with unsaved changes (`ticket.note = "fixed";
+  ticket.resolve!` saves the note with the state, as `lock: false` does); `with_lock`'s reload
+  used to raise "Locking a record with unpersisted changes is not supported". For such a record
+  only the state column is read (`SELECT <state> ... FOR UPDATE`) and adopted, and the guard
+  decides from it (a disallowed event raises `InvalidTransition`). On a model with optimistic
+  locking, a record with unsaved changes whose row has changed since it was loaded raises
+  `StaleObjectError`: its changes were made against a stale copy. A deleted row raises
+  `RecordNotFound`. A record without unsaved changes is still reloaded under the lock, exactly
+  as before. (#124)
+- **Activatable:** `toggle_active!` works on records with unsaved changes. It used `with_lock`
+  too, and raised the same "unpersisted changes" error. Such a record now has only its flag read
+  under the lock; it flips the row's value, and its changes save with the flip. A record without
+  unsaved changes is still reloaded under the lock. (#124)
+- **Encryptable:** `type: :datetime` stores a frozen or non-UTC `Time` correctly and never
+  modifies it. `Time#utc` converted the caller's value in place, and a frozen `Time` was
+  silently saved as `NULL`. (#125)
+- **Auditable:** recording a tracked datetime no longer converts the record's (the caller's)
+  `Time` to UTC in place, and a frozen `Time` no longer makes the save raise `FrozenError`.
+  (#125)
+- **CursorPaginatable:** minting a cursor no longer converts the page-boundary record's
+  timestamp to UTC in place. (#125)
+- **CursorPaginatable:** a cursor carrying a timestamp outside years 0001..9999 is an
+  `InvalidCursor` (400). It used to reach the WHERE clause and raise `DatetimeFieldOverflow` on
+  PostgreSQL (a 500), and SQLite compared it as text. (#125)
+- **Filterable:** date/time comparison operands outside `0001-01-01`..`9999-12-31` (the portable
+  SQL range) never reach the database. They are answered per operator, like out-of-range
+  numbers: `?happened_at_lt=300000-01-01` is every non-NULL row, `_gt` none, and in equality /
+  `in` / `not` / `not_in` such a value equals nothing. They used to raise
+  `DatetimeFieldOverflow` on PostgreSQL (a 500), and SQLite answered year-10000 comparisons
+  backwards. (#125)
+
+### Internal
+- New support modules: `Support::Callable`, `Support::SlugSources`,
+  `Support::AssociationScope`; gem-level singletons moved to `lib/concerns_on_rails/core.rb`. A
+  real-Rails-app subprocess spec covers filter wiring for direct requires.
+- Dev dependencies: Rails 8.1.4, permittable 0.10.0; the permittable compatibility suite accepts
+  both the pre-0.9 and 0.9+ validation messages (the gemspec still allows `~> 0.1`). (#121, #126)
+- New support modules: `Support::Locking` (lock_version mirroring, row-locked reads),
+  `Support::TimeValue` (verb time arguments, virtual datetimes, the portable year range),
+  `Support::GeneratedValues` and `Support::EncryptedLookup` (values generated in
+  `before_create`, equality lookups over encrypted columns). (#123–#125)
+- Documented limits: see `docs/concerns/sequenceable.md` (zones across STI leaves under an
+  abstract declarer; re-declaring an owner after its subclasses) and
+  `docs/concerns/stateable.md` (a subclass stub outlives a later parent re-declaration).
+  `unlock_access!`'s unconditional write is left for a follow-up. Also documented: a
+  CounterCacheable parent destroyed later in the same rolled-back transaction keeps its
+  in-memory mirror (reload it); Encryptable `find_by_<field>` does not apply the field's Rails
+  `normalizes`; on Rails 7.2+ an Encryptable `:datetime` skip list must precede the `encryptable`
+  line or be followed by a re-declaration (`docs/concerns/encryptable.md`).
+
+## 1.30.0 (2026-09-27)
+
+The fixes from the 2026-09-23 whole-gem audit of 1.29.0: 37 bugs (8 HIGH) across six PRs
+(#109–#114). It is a minor release, not a patch, because a few fixes add an option or a method,
+and several change observable behaviour. Read **Changed** before upgrading. No new
+concerns and no migrations. Every fix ships with a regression spec that fails on 1.29.0.
+2146 examples, 0 failures (2121 on Rails 6.0), green on PostgreSQL and MySQL.
+
+### Changed
+- **Throttleable: counters that use the default name reset once on upgrade.** The default
+  rule name changes from `"rule<n>"` to `"<DeclaringController>#rule<n>"`, so the cache key
+  changes, and so does the `rule` field of `rate_limited.concerns_on_rails`. Rules with an
+  explicit `name:` are not affected. (#109)
+- **WebhookVerifiable: rule lookup is by specificity.** A rule that names the action beats any
+  catch-all, whichever class declared either. The most-derived class wins, then declaration
+  order. Such actions no longer inherit a parent catch-all's `replay:`/`tolerance:`/scheme, so
+  declare those on the subclass rule if you still want them. A catch-all declared before
+  specific rules no longer shadows them. `commit_webhook_replay_claim` is now private. (#109)
+- **Cacheable**: POST/PUT/PATCH/DELETE responses, and statuses other than
+  200/203/204/206/304, no longer receive the rule's positive `Cache-Control`. `no_store` is
+  unchanged. `Vary` merging is now case-insensitive, leaves `Vary: *` alone, and keeps Rails'
+  own `Vary: Accept`. (#109)
+- **Idempotentable: an unreachable store returns 503 `idempotency_store_unavailable`**
+  (with `Retry-After`) instead of a permanent 409 `idempotency_conflict`. The action still
+  does not run. Unreachable means both claims failed and both reads returned nil. (#109)
+- **Filterable: numeric operands are exact, never truncated.** On an integer column,
+  `?stock=5.5` now matches nothing (it used to match 5), and `?stock=1e1` matches 10 (it used
+  to match 1). `?stock_lt=<huge>` returns every non-NULL row. One garbage member fails a whole
+  `in`/`not_in` list closed, and garbage fails `not` closed too. A JSON `true` or boolean
+  against a numeric column fails closed. `type: :integer` on a float/decimal column no longer
+  truncates. A numeric `type:` on a `with:` lambda pre-casts strictly, and fails closed
+  without calling the lambda. Operands over 100 characters are refused. (#113)
+- **Sequenceable (STI)**: declared on an STI **base** class, all subclasses now share one
+  table-wide counter. They used to each start at 1 and collide on a shared unique index.
+  **Upgrade note:** a subclass that *inherited* a base declaration and numbered per type now
+  jumps once to the table-wide MAX + 1. Declare `scope: :type` to keep per-type numbering, and
+  index `(type, <column>)`. `next_<field>` under `scope: :type` previews the receiving class's
+  sequence. (#111)
+- **Hooked verbs** (Publishable, SoftDeletable, Expirable, Activatable, Anonymizable,
+  Stateable): a hook's `ActiveRecord::Rollback` now vetoes the write for real. The verb
+  returns `false`, and the `*_all` verbs raise `RecordNotSaved`. The exception is
+  `anonymize_all!`, which skips the vetoed record and doesn't count it. After any aborted
+  write, the written attributes return to their pre-call in-memory values. (#114)
+- **Publishable**: with a boolean column, `Post.published.new` no longer pre-sets the flag.
+  The scope is now `("published" = TRUE)`, or `<> FALSE` on Rails 6.0. (#114)
+- **Expirable**: `expire!`/`expire_all` with nil or a blank time now mean "now" (they used to
+  mean "never expires"). An unparseable time raises `ArgumentError`. (#114)
+- **Expirable / Activatable / Schedulable**: `prefix:`/`suffix:` now also define affixed
+  predicates (`term_active?`, `window_expired?`, …). The macro raises if one would shadow a
+  different column's query method. (#114)
+- **Auditable**: new entries store `"at"` with microseconds. Second-precision entries still
+  parse. (#111)
+- **Hashable**: a `:custom` alphabet with duplicate characters is de-duplicated, with a
+  deprecation warning (it will raise in 2.0). Fewer than 2 distinct characters raises. (#111)
+
+### Added
+- **Idempotentable**: `on_store_unavailable:` (`:reject` default, or `:proceed` to run the
+  action without deduplication). (#109)
+- **Anonymizable**: `slug:` (`:auto` default, `true`, `false`). It rewrites a friendly_id slug
+  built from an anonymized column to a random slug, and deletes its history rows. (#110)
+- **Taggable**: `Model.normalize_tags!` rewrites rows written around the callbacks (e.g.
+  `"ruby, rails"`) to the form `tagged_with` matches. It returns a count. (#112)
+- **Support::UniqueRetry**: `savepoint:` runs each attempt in its own savepoint, so a retry
+  works inside a caller's transaction on PostgreSQL. (#110, #111)
+
+### Fixed
+- **Encryptable**: `Model.needs_reencryption` / `reencrypt_all!` now cover the whole table.
+  Rows hidden by a `default_scope` used to be skipped, and became undecryptable once the old
+  key was dropped. On a relation, both cover exactly that relation. On Rails 6.0–7.0,
+  `<field>_ciphertext` returns the stored ciphertext after a save, and `reencrypt!` works
+  right after a save. (#110)
+- **Anonymizable**: erasure is never blocked by ciphertext that won't decrypt, and one bad
+  row no longer rolls back `anonymize_all!`. A slug built from erased PII is replaced in the
+  same UPDATE. (#110)
+- **Storable**: `where_<key>` on an `encryptable` column raises instead of silently matching
+  nothing (or every row). (#110)
+- **CounterCacheable**: a destroy decrements only when its DELETE removed a row, and reads
+  persisted values. `belongs_to primary_key:` is honoured. A child destroyed by its parent's
+  `dependent: :destroy` no longer decrements that parent, which also fixes
+  `StaleObjectError`. (#111)
+- **Duplicable**: counter-cache columns are zeroed on the copy, so a deep copy counts its
+  children once. `duplicate!` re-reads the counters. (#111)
+- **Sequenceable**: `assign_<field>!` restores the number when the save fails, so a retry
+  draws a fresh one. (#111)
+- **Hashable / Tokenizable**: uniqueness prechecks see sibling STI rows, and
+  `regenerate_<field>!` retries work inside a caller's transaction. (#111)
+- **Lockable / Addressable**: models load again when the schema is unreachable. (#111)
+- **Aliasable**: `accepts_nested_attributes_for :alias` now updates and destroys existing
+  children. It used to save only new ones. (#112)
+- **Sanitizable**: `with: :strip, on: :write` stores plain text (`"Tom & Jerry"`, not
+  `"Tom &amp; Jerry"`). It stays idempotent and linear-time, and `sanitize_all!` repairs
+  double-escaped rows. (#112)
+- **Addressable**: `if:`/`unless:` from later calls and subclasses are honoured. (#112)
+- **Monetizable**: the writer reads the concern's own formatted output (`"$1,234.50"`).
+  Garbage, NaN, Infinity and oversized input cast to nil instead of raising. (#112)
+- **Normalizable**: whitespace presets treat Unicode whitespace as whitespace. (#112)
+- **Maskable**: `:email`/`:phone` fail closed. A malformed value gets the full mask instead of
+  being returned raw. (#112)
+- **Taggable**: `taggable_by` raises on an empty `delimiter:`. (#112)
+- **CursorPaginatable**: `max_per_page: 0` no longer lets a huge `per_page` overflow `LIMIT`
+  (a 500). Both paginators share `Support::ScalarParam.per_page`, with a 1,000,000 ceiling. A
+  cursor whose values can't be bound is a 400 `invalid_cursor`. (#113)
+- **Filterable**: `1e99999999` on an unconstrained numeric column no longer costs ~1.3 s and
+  476 MB per request. `contains`/`starts_with` on non-string columns match nothing, instead of
+  a PostgreSQL 500. (#113)
+- **Localizable / Timezoneable**: `rescue_from` handlers render under the resolved
+  locale/zone. `Accept-Language` ties keep header order, and `q` is case-insensitive. (#113)
+- **Stateable**: the in-memory state and `<state>_at` are restored after a vetoed transition
+  or `RecordInvalid`. (#114)
+- **Rails 6.0**: a hooked write aborted inside a caller's transaction no longer makes a
+  record created earlier in it INSERT twice. (#114)
+
+### Internal
+- New `Support::HookedWrite` (the one before-hook → write → after-hook path) and
+  `Support::NumericOperand` (Filterable's exact numeric reader). (#113, #114)
+- Development dependencies: rubocop 1.91, simplecov 1.2, permittable 0.7 in the lockfile. (#106)
+- CLAUDE.md describes the new behaviour. (#115)
+
 ## 1.29.0 (2026-09-21)
 
 CI now runs **every Rails line the gemspec admits** — 6.0, 6.1, 7.0, 7.1, 7.2, 8.0 and 8.1 —