concerns_on_rails 1.32.0 → 1.33.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5638a56a20ce9b346dd013448af31656fe6925eaefbf8bd87ee8906c17825b4
-  data.tar.gz: b3feeb0feaab7f14bf5d03ea46a9e7a1a69f0d087173cf2fb0baa1efb2c86daa
+  metadata.gz: 0dd550c226626fbbe5d8c542b5e139296be95977722dd1e78560f81ed91c63b1
+  data.tar.gz: f8770b8fe33e57b5323a76a469e8cd2cac66401a6e20a3b12a800b99776c80f4
 SHA512:
-  metadata.gz: 25623c6d25c7fafc8e8c4dfd5f16350df059a5f0bb2999c0d457b986cfcff1c55365f8e072ab5dd01cb9ae48e6226ff335a546f02c1521ca0c3934898e92c296
-  data.tar.gz: ad5dd6aa2c310c9d711fd9513e01488e79f164df54aa2accdbca8ab9a46f3c2fe296c0733c6b0c404c0df09147c28160f7c5177e0938b6637eb3037d71f1e363
+  metadata.gz: aeec3000adc45a218468a6be90ed35ed8022f9319f3c41a222dcdeb0e048eb95f634c5e9d4a4613ad0cbdde7558d9e24d94f132c6c664622fd48393e26ff78ad
+  data.tar.gz: eca60a294934ecb578df643c92108a0b86ed62c1f0bd5f63c376ae12691d51ce3e6e7bce37438c896f9872c228de077950982a9c3ae53f674f83a4b10fa1ba22

data/CHANGELOG.md

@@ -1,5 +1,422 @@
 <!-- CHANGELOG.md -->
 
+## 1.33.0 (2026-10-18)
+
+A correctness release: it fixes the 66 bugs proven by the 2026-10 audit of 1.32.1. Some fixes change
+behaviour, and several configurations that used to be silently broken now raise at class load. Read
+**Upgrading** first.
+
+### Upgrading
+
+**Class-load (boot) raises for configurations that were silently broken.** Each of these raised nothing
+before and misbehaved at run time; an app that boots today may fail to boot after upgrading.
+
+- [ ] **Encryptable, uniqueness:** a uniqueness validation over an encrypted field (or an encrypted `scope:`
+  column) raises `ArgumentError`. It always passed and saved duplicates. Use `where_<field>` with a unique
+  index, or `blind_index: true`. (#187)
+- [ ] **Encryptable, `serialize`/`normalizes`:** declared on the field before `encryptable` raises
+  (`serialize` on Rails 6.1+, `normalizes` on 7.1+). Declare `encryptable` first. (#188)
+- [ ] **Encryptable, DB default:** a non-empty database default on an encrypted column raises. Drop it with the
+  `change_column_default` named in the message (only `NULL` or `""` are allowed). (#136)
+- [ ] **Encryptable, scope columns:** an `encryptable` column as a Sequenceable `scope:`, a Sluggable/friendly_id
+  scope column or a Sortable `scope:` raises, in either order. Scope by an unencrypted column (a foreign key, a
+  plaintext copy). (#189)
+- [ ] **Monetizable, marks:** `separator:` equal to `delimiter:` (the usual slip is `separator: ","` alone, since
+  the default delimiter is also `","`), or empty with `precision:` above 0, raises, at the macro and for
+  per-call `formatted_` overrides. A `precision: 0` field with `delimiter: "."` (IDR / VND / CLP) now raises
+  too: pass `separator: ","`. (#158)
+- [ ] **Addressable, `default_country:`:** a value that resolves to no ISO country raises; a valid name or alpha-3
+  is stored as its alpha-2 code. Fix typos and unknown values. (#174)
+- [ ] **Shared affixed names:** two concerns that generate the same affixed predicate or scope name (for example
+  `prefix: :term` on Expirable and Activatable) raise at the macro. Give them distinct affixes. (#184)
+- [ ] **Sortable (controller):** `direction:` other than `asc`/`desc` (any case) raises (`:dsc`, `nil`). `"DESC"`
+  used to sort ascending. (#165)
+- [ ] **Sequenceable, `period_column:`:** the macro refuses a missing, non-date or `:updated_at` column. Under `reset:` it also refuses a subclass that restates its parent's visible format with a different `period_column:`, because the two series would print the same numbers. Declare the option on the declaring class, or in an `assign:`-only re-declaration. (#191)
+
+**Behaviour changes.**
+
+- [ ] **SoftDeletable `destroy_all`:** on a relation or association it is now a contextual soft delete
+  (`where(...).destroy_all`, `destroy_by`, `in_batches.destroy_all`, `post.comments.destroy_all`); only the
+  bare class form did before, and the scoped forms hard-deleted. Live rows are soft-deleted through
+  `soft_delete!`. Already-trashed rows are purged for real only when reached through that model's own trash
+  scopes (`only_deleted`, `soft_deleted`, `with_deleted`, `deleted_within`), fixed at call start; every other
+  relation leaves the trash alone. A purge also purges the record's trashed `cascade:` children, of any stamp,
+  ignoring the association's limit; a vetoed child skips its parent on a relation but raises on an
+  association. A restored row is re-checked before its purge. Rails' own `has_many :through` maintenance stays
+  a hard delete. Escape hatches: `really_destroy_all` to hard-delete on purpose, or `soft_deletable_by ...,
+  relation_destroy_all: :hard` for the old behaviour of the scoped forms. Destroy callbacks no longer run for
+  live rows (`before/after_soft_delete` run instead), and `touch: true` runs validations and update callbacks;
+  a failing row raises `RecordNotSaved` and rolls the batch back. (#169)
+- [ ] **Batch verbs on STI tables** (`publish_all`/`unpublish_all`, `soft_delete_all`/`restore_all`, `expire_all`,
+  `activate_all`/`deactivate_all`, `unlock_expired`) always stream per record, so subclass hooks and validations
+  run; slower on large tables. `self.inheritance_column = nil` keeps the single `UPDATE`. (#185)
+- [ ] **Batch verbs with sibling bookkeeping:** on a model with a CounterCacheable rule using `if:`, or Auditable
+  tracking a column the verb writes, they take the per-record path instead of the single `UPDATE`. (#154)
+- [ ] **Publishable/Activatable:** `publish!` on a published record, `activate!` on an active one and
+  `deactivate!` on an inactive one are no-ops (return `true`, no stamp, no hooks). Use `publish_at!` to re-stamp. (#146)
+- [ ] **Expirable:** `expire!`/`expire_all` never push an expiry later. Use `expire_in!` or `extend_expiry!` to set a
+  later one. (#141)
+- [ ] **Authorizable:** the denial envelope `code` follows `status:`: `"unauthorized"` for 401, `"not_found"` for
+  404, `"forbidden"` otherwise. Clients matching on `forbidden` need updating. (#145)
+- [ ] **Respondable:** a `Vary` in `headers:` is appended to the existing `Vary` instead of replacing it; a
+  caller's `Vary: *` still replaces. (#160)
+- [ ] **ErrorHandleable:** a malformed query string renders the JSON 400 `bad_request` envelope instead of Rails'
+  HTML 400 page. `handle_errors except: :bad_request` restores propagation. (#155)
+- [ ] **Encryptable/Auditable:** the blind index and the audit trail are captured at the write boundary, after
+  every `before_*` callback, so your own callbacks see them as loaded; the new values are in place from
+  `after_save`. (#172)
+- [ ] **Anonymizable:** `Model.anonymize_all!` also erases SoftDeletable's trash and Publishable's unpublished rows
+  under `default_scope: true`. Call it on a relation to limit it. (#171)
+- [ ] **Storable:** a key with `type:` reads its `default:` cast through that type (uncastable reads `nil`); keys
+  without `type:` and `:json` defaults return the default as written. (#130)
+- [ ] **Filterable:** enum comparisons use labels (#163) and an unknown enum label matches nothing (#168);
+  `type: :datetime` reads a zone-less operand in `Time.zone` or `ActiveRecord.default_timezone`, no longer the
+  server's system zone (#170); an operand with a NUL byte matches nothing (#152).
+- [ ] **Searchable:** `ranked:` search on a `DISTINCT` relation is returned unranked; order it yourself. (#135)
+- [ ] **Sluggable:** clearing the slug source keeps the existing slug instead of a uuid. (#151)
+- [ ] **Monetizable:** with `precision:` omitted and a power-of-ten `subunit_to_unit:` of 1000 or more, output
+  prints more decimals (3 for `1000`, 4 for `10_000`). Pass `precision:` to pin it. (#180)
+- [ ] **Normalizable:** `:url` turns `//HOST/path` into `https://host/path`, and a host-less `/path` is returned
+  stripped as `/path`. (#177)
+- [ ] **Timezoneable:** `Time.zone` is always restored after the action, also for the current zone. (#192)
+- [ ] **Duplicable:** a copy of a Sortable record takes a fresh list position instead of the original's. (#166)
+- [ ] **Sanitizable `on: :write`:** a persisted field the save does not change is no longer re-sanitized;
+  `sanitize_all!` remains the repair tool. (#148)
+- [ ] **CursorPaginatable:** a numeric cursor boundary the column cannot hold is an `InvalidCursor` 400, not an
+  empty page (#182); a cursor minted for a `time` column is now the stored time of day, old cursors still
+  decode on Rails 7.0+ (#183); binary boundaries travel as Base64 (#162). Cursors minted before the upgrade
+  are not all safe: on Rails 6.0/6.1 an old `time` cursor repeats its boundary row once (#183), and an old
+  cursor on an ASCII-only binary column may be reinterpreted once (#162). The next cursor is in the new form.
+
+### Added
+- **Sequenceable**: `period_column:` (default `:created_at`) names the datetime column a `reset:` period is cut
+  from. With `assign: :manual`, `period_column: :finalized_at` numbers a draft in the period it is finalized in
+  instead of the one it was drafted in; `assign_<field>!` stamps the column when blank. The MAX range, the
+  period token and `sequenceable_period_time` all read it. (#191)
+- **SoftDeletable**: `soft_deletable_by ..., relation_destroy_all: :hard` restores ActiveRecord's own hard
+  delete for the relation and association forms of `destroy_all`. (#169)
+
+### Changed
+- **Addressable**: `default_country:` is canonicalized like a country value (name, alpha-3 or alpha-2) and
+  stored as its alpha-2 code. A value that resolves to no ISO country raises `ArgumentError` when the macro
+  runs; `default_country: "USA"` or `"Canada"` used to silently disable postal, state and fingerprint matching
+  for every blank-country record. (#174)
+- **Authorizable**: the denial's envelope `code` follows its `status:`: `"unauthorized"` for 401, `"not_found"`
+  for 404, `"forbidden"` for 403 and anything else (it was always `"forbidden"`). A `status: :not_found`
+  concealment rule now renders exactly what ErrorHandleable's missing-record 404 renders. The
+  `authorization_denied(status:, message:)` override signature is unchanged. (#145)
+- **Anonymizable**: `Model.anonymize_all!` called on the model itself also erases the rows the gem's own default
+  scopes hide: SoftDeletable's trash and Publishable's unpublished rows under `default_scope: true`. The
+  application's own default scopes (a tenant, a discriminator) still apply. Called on a relation, an
+  association or inside `scoping`, it still erases exactly that relation. (#171)
+- **Batch verbs (Publishable / SoftDeletable / Expirable / Activatable / Lockable)**: on an STI table (a
+  present `inheritance_column` that is a real column) `publish_all`/`unpublish_all`,
+  `soft_delete_all`/`restore_all`, `expire_all`, `activate_all`/`deactivate_all` and `unlock_expired` always
+  stream per record instead of one `UPDATE`, so a subclass's overridden hooks, validations and re-declared
+  options apply. A model with `self.inheritance_column = nil` keeps the single `UPDATE`. (#185)
+- **Concerns sharing affixed names**: declaring two concerns that generate the same affixed predicate or scope
+  name (for example `prefix: :term` on Expirable and Activatable) raises `ArgumentError` at the macro. Before,
+  the second silently replaced the first's `term_active?` and `.term_active`. Unaffixed concerns that share plain
+  names are unchanged. (#184)
+- **Encryptable**: a non-empty database default on an encrypted column is refused (`ArgumentError` at
+  declaration, with the `change_column_default` that drops it). Any default other than `NULL` or `""` is
+  plaintext that can never decrypt, so every `Model.new` raised `DecryptionError`. Skipped while the schema is
+  unreachable. (#136)
+- **Encryptable**: a uniqueness validation over an encrypted field (or an encrypted `scope:` column), declared
+  before or after `encryptable`, raises `ArgumentError` at class load. Before, it always passed and duplicates
+  were saved. Uniqueness on plain columns is unchanged. (#187)
+- **Encryptable**: `serialize` or `normalizes` declared on the same field before `encryptable` raises
+  `ArgumentError` at class load (Rails 6.1+ for `serialize`, 7.1+ for `normalizes`). Declare `encryptable` first.
+  Before, `encryptable` silently dropped the earlier decoration. Rails 6.0 serialize-first declarations are
+  unchanged. (#188)
+- **Encryptable / Sequenceable / Sluggable / Sortable**: an `encryptable` column can no longer be a Sequenceable
+  `scope:`, a Sluggable/friendly_id scope column (an association's foreign key and multi-column scopes
+  included) or a Sortable (acts_as_list) `scope:`; declaring one raises `ArgumentError` from either order.
+  Scoped queries compared ciphertext and matched no row. Scope by an unencrypted column instead. (#189)
+- **CursorPaginatable**: a numeric cursor boundary the column cannot hold (beyond its precision or range, finer
+  than its scale, non-numeric or not valid UTF-8, over 100 characters, or with an exponent beyond +-1000) is an
+  `InvalidCursor`, which renders the documented 400. Before, it silently ended the walk with an empty 200. (#182)
+- **Expirable**: expiring never pushes an existing expiry later. `expire_all(time)` writes only rows whose expiry
+  is unset or later than `time`, and the count is the rows actually written. `expire!(time)` on a record whose
+  saved expiry is already at or before `time` returns `true`, writes nothing and fires no hook. To set a later
+  expiry, use `expire_in!` or `extend_expiry!`. (#141)
+- **Filterable**: `type: :datetime` reads a zone-less operand exactly as the target column would: in `Time.zone`
+  on a zone-aware column, in `ActiveRecord.default_timezone` otherwise. A `with:` lambda under `type: :datetime`
+  receives the value in `Time.zone` while `time_zone_aware_attributes` is on, else in `default_timezone`.
+  `type: :date` / `:time` use ActiveRecord's own types. Results used to depend on the server's `ENV["TZ"]`. (#170)
+- **Monetizable**: raises `ArgumentError` when `separator:` equals `delimiter:` or is empty while `precision:` is
+  above 0, at the macro and for per-call `formatted_` overrides. `formatted_price` used to print `"EUR1,234,56"`,
+  which the writer read back as `nil`. This includes `precision: 0` fields whose marks are equal (IDR / VND /
+  CLP with `delimiter: "."`); pass `separator: ","`. (#158)
+- **Monetizable**: with `precision:` omitted it follows a power-of-ten `subunit_to_unit:`, with at least 2
+  decimals: 3 for `1000` (KWD, BHD, OMR, TND, JOD), 4 for `10_000`, so `formatted_price` round-trips. Output for
+  `100`, `10`, `1` and non-power-of-ten subunits is unchanged, an explicit `precision:` is used as given, and a
+  per-call `subunit_to_unit:` override gets its own default. (#180)
+- **Publishable / Activatable**: `publish!` on a published record, `activate!` on an active one and
+  `deactivate!` on an inactive one are no-ops: they return `true`, stamp nothing and fire no hook. "Already"
+  means the saved state of a stored record with no unsaved change to the column; a no-op that finds other
+  pending changes saves them. `publish_at!` still re-stamps, `deactivate!` still writes `false` over `NULL`, and
+  `toggle_active!` is unchanged. (#146)
+- **Sanitizable** `on: :write` no longer re-runs the writer on a persisted record's field that the save does
+  not change, so a non-idempotent `Proc` writer no longer compounds on every save. An unrelated save no longer
+  "repairs" a row written around the callbacks; `sanitize_all!` remains the repair tool. (#148)
+- **Searchable**: `ranked:` search on a `DISTINCT` relation is returned unranked, like a grouped relation,
+  instead of ordering by a rank expression outside the SELECT list (rejected by PostgreSQL and MySQL 5.7.5+).
+  The relation's own ORDER BY is kept. (#135)
+- **Sluggable**: clearing the slug source (`nil`, a blank string, or a value that normalizes to nothing such as
+  `"!!!"`) keeps the existing slug instead of replacing it with friendly_id's uuid fallback. The fallback still
+  applies to a record with no slug yet. (#151)
+- **SoftDeletable**: `destroy_all` is a contextual soft delete on a relation and on an association too, as
+  documented (`Model.where(...).destroy_all`, `Model.destroy_by(...)`, `in_batches.destroy_all`,
+  `post.comments.destroy_all`). The scoped forms used to reach ActiveRecord's own `destroy_all` and hard-delete.
+  A live record is soft-deleted through `soft_delete!` (hooks and `cascade:` run; `RecordNotSaved` and rollback
+  on failure). A record already soft-deleted is purged only when reached through that model's own trash scopes
+  (`only_deleted` / `soft_deleted` / `with_deleted` / `deleted_within`), fixed at call start; any other
+  relation leaves the trash alone. A purge also purges the record's trashed `cascade:` children, of any stamp,
+  ignoring the association's limit. A vetoed child skips its parent on a relation but raises on an association
+  (`RecordNotDestroyed`). A restored row is re-checked before its purge. Rails' `has_many :through`
+  maintenance stays a hard delete, as do `dependent: :destroy`, `assoc.destroy(c)`, `replace` and nested
+  `_destroy`; instance `destroy` is unchanged. The relation and association forms return the records acted on
+  (the class form still returns the count). The `relation_destroy_all: :hard` option restores the old behaviour.
+  See **Upgrading**. (#169)
+- **Sortable** (controller): `sortable_by`'s `direction:` is case-insensitive, and any other value (`:dsc`, `nil`)
+  raises `ArgumentError` at class load, as CursorPaginatable does. It used to be silently coerced to `:asc`. (#165)
+
+### Fixed
+- **Addressable**: `normalize_country:` recognizes `"UK"`, `"Great Britain"`, `"United States of America"`, ISO's
+  official short names (`"Viet Nam"`, `"Russian Federation"`, `"Republic of Korea"`), former names (`"Czech
+  Republic"`) and accent-free spellings; `default_country:` (see Changed) uses the same lookup. (#174, #175)
+- **Addressable**: stamps the `fingerprint:` column in a prepended `validate` callback (after every
+  `before_validation`, ahead of the app's own validations) as well as in `before_save`, so a uniqueness
+  validation on the column no longer accepts duplicates or judges an update against the old address. (#173)
+- **Addressable**: `same_address_as?` accepts a digest String as well as a record, matching `with_address`. (#181)
+- **Auditable** (with **Encryptable**): changes are captured at the write boundary, after every `before_*`
+  callback, so the trail records the values actually written; a field set or rewritten by a later callback is no
+  longer missing or stale, and a change a callback reverted no longer leaves a phantom entry. An audited
+  blind-index column records the refreshed digest. (#172)
+- **Batch verbs** (`expire_all`, `activate_all`, `deactivate_all`, `unpublish_all`, SoftDeletable's): select their
+  rows by their own predicates, so a sibling concern owning the public `.active` or `.published` name can no
+  longer make `expire_all` overwrite long-expired rows and skip live ones. (#184)
+- **Batch verbs** (Publishable / Expirable / Activatable): take their per-record path on a model with a
+  CounterCacheable rule using `if:`, or Auditable tracking a column the verb writes; the single-`UPDATE` fast
+  path used to leave the counter and the audit trail behind. Plain models keep the single `UPDATE`. (#154)
+- **Cacheable**: `stale_resource?` on an Array (or other non-relation collection) no longer answers 500 on Rails
+  7.0+ when a member has no `updated_at` or a nil one. Only an `ActiveRecord::Relation` takes the SQL-aggregate
+  branch; other collections use their newest non-nil member timestamp (none: ETag only). (#132)
+- **CounterCacheable**: a parent with optimistic locking whose counted child hangs off a `has_one ...,
+  dependent: :destroy` can be destroyed again; the child's decrement no longer bumps the parent's
+  `lock_version`. A has_one replacement still gets its count. (#149)
+- **CursorPaginatable**: a cursor whose String boundary is not valid UTF-8, or carries a NUL byte, is the
+  documented `InvalidCursor` 400 instead of a 500. MySQL adapters, which store a NUL, still accept it. (#144)
+- **CursorPaginatable**: paginates tables with a binary primary key or a binary ordering column; a binary
+  boundary travels in the cursor as strict Base64 (invalid Base64 is an `InvalidCursor` 400). `JSON.generate`
+  used to raise on every page with a next page. (#162)
+- **CursorPaginatable**: a `time` ordering column with fractional seconds no longer loops forever on Rails
+  6.0/6.1. A `time` boundary is now its stored time of day (`"10:30:15.500000"`, in `default_timezone`); cursors
+  minted in the old form still decode on Rails 7.0+. (#183)
+- **Duplicable**: `duplicate!` re-reads `lock_version` with the counter columns, for the copy and every nested
+  Duplicable copy, so the returned copy of an optimistically locked record saves again. (#143)
+- **Duplicable**: a top-level copy of a Sortable (acts_as_list) record takes a fresh list position, placed per
+  `add_new_at:`, instead of the original's. A deep-copied child keeps its position only when its list is scoped
+  by the copied association's foreign key; a child in a shared list is blanked and appended. `use_acts_as_list:
+  false` keeps the copied position. (#166)
+- **Encryptable / Anonymizable / Stateable / Activatable**: composite primary keys (Rails 7.1+) work in
+  `reencrypt!` / `reencrypt_all!`, in `anonymize!` under optimistic locking, and in the row lock behind Stateable
+  `lock: true` and Activatable `toggle_active!`. (#138)
+- **Encryptable**: `<field>_ciphertext`, `<field>_encrypted?`, `<field>_key_id` and `reencrypt!` read the envelope
+  the record loaded or wrote, also after an assignment that leaves the value unchanged. (#150)
+- **Encryptable**: an in-place edit of a decrypted String (`<<`, `gsub!`, `squish!`) is a change and is saved;
+  dirty checks decrypt the stored value to compare plaintext, so an unchanged re-save is still not re-encrypted. (#156)
+- **Encryptable**: the blind index is refreshed at the write boundary, after every `before_save` /
+  `before_create` / `before_update` callback, so it is the digest of the value actually stored and `find_by_<field>`
+  no longer misses a row whose field a later callback rewrote. (#172)
+- **ErrorHandleable**: a malformed query string (bad %-escape, invalid UTF-8) renders the documented 400
+  `bad_request` envelope (or problem document) instead of Rails' HTML 400 page. A private `process_action` hands
+  that one exception to the handler chain. (#155)
+- **ErrorHandleable**: `handled_error.concerns_on_rails` and `on_handled_error` report the exception the handler
+  was matched on (the wrapper's `#cause`), not the wrapper's class. (#193)
+- **Expirable / Schedulable / Publishable**: on a `date` column the instance predicates (`current?`,
+  `upcoming?`, `expired?`, `active_at?`, `overlaps?`, `active?`, `published?`, `scheduled?`) agree with their
+  scopes outside UTC, comparing against the date in `Time.zone`. Datetime columns are untouched. (#140)
+- **Filterable**: compares an `enum` column by label (`?status_gte=review` is `status >= 1`); on an integer-backed
+  enum any other operand is read as a number. Every label comparison used to come back empty, and a numeric
+  operand raised `ArgumentError` on Rails 6.0/6.1. An unknown label matches nothing. (#163)
+- **Filterable**: an unknown `enum` label in equality or `in` (`?status=drfat`) matches nothing instead of the
+  rows with no status (Rails 7.0+ emitted `IS NULL`). An explicit `nil` member keeps its `IS NULL` meaning. (#168)
+- **Filterable**: an operand containing a NUL byte matches nothing instead of a `StatementInvalid` 500 (SQLite,
+  PostgreSQL). Binary columns are exempt. (#152)
+- **Filterable / Sortable** (controller): `filtered` and `sorted` accept a bare model class (`filtered(Article)`),
+  as Paginatable and CursorPaginatable already did; a class used to raise `NoMethodError`. (#164)
+- **Localizable**: the `Accept-Language` lookup truncates each tag one subtag at a time (RFC 4647 section 3.4), so
+  `zh-Hant-TW` matches an available `zh-Hant` before `zh`, and `sr-Latn-RS` matches `:sr_Latn` before `:sr`. (#167)
+- **Maskable / Sanitizable**: `masked_attributes` / `sanitized_attributes` skip a declared field that a partial
+  `select` did not load instead of raising `ActiveModel::MissingAttributeError`. (#178)
+- **Monetizable**: no longer reads a leading `0` digit group as grouped thousands: `"0,500"` in a default
+  `","` field is `nil` rather than 500.00, and `"0.500"` reads as 0.5 in a `delimiter: "."` field. Formatted
+  output still round-trips. (#179)
+- **Normalizable / Sanitizable / Taggable / Addressable**: a rule no longer runs twice when `valid?` precedes
+  `save` (a non-idempotent Proc runs once per save, also when Normalizable and a Sanitizable `on: :write` rule share
+  a column), and `reload` forgets the earlier validation. The `before_save` backstops (saves that skip validation)
+  run in the same order as the `before_validation` passes through one shared prepended dispatcher, so two
+  transforms on one column store the same value on every save path. (#176)
+- **Normalizable**: `:url` canonicalizes a protocol-relative `//HOST/path` to `https://host/path`; a host-less
+  `/path` comes back stripped rather than as `https:///path`. (#177)
+- **Paginatable**: counts a relation whose select list is written with DISTINCT (`select("DISTINCT category")`,
+  `DISTINCT ON (...)`) as its distinct rows, fixing `X-Total-Count` / `X-Total-Pages` and `Link rel="last"`. (#161)
+- **Publishable**: `unpublish!` and `unpublish_all` write `false` into a boolean publish column instead of
+  `NULL`, which raised `NotNullViolation` on `null: false` columns. Timestamp columns are still cleared. (#139)
+- **Respondable**: a `Vary` passed in `render_success` / `render_created`'s `headers:` is appended to the existing
+  `Vary` (de-duplicated case-insensitively, `Vary: *` left alone) instead of replacing it, which dropped
+  Localizable's `Accept-Language` and Timezoneable's `Time-Zone`. A caller's `Vary: *` still replaces. (#160)
+- **Sanitizable**: no longer raises `NameError: uninitialized constant Rails::HTML4` on rails-html-sanitizer
+  older than 1.6. The sanitizer namespace is feature-detected: HTML5 when available, else HTML4, else the gem's
+  `Rails::Html` sanitizers. (#133)
+- **SecureHeadable**: `content_security_policy_for(report_only: false)` enforces over a parent controller's or
+  `config.content_security_policy_report_only`'s report-only flag. `report_only:` is now `true` / `false` /
+  `:inherit`; the default `:inherit` leaves the inherited flag as before, and anything else raises
+  `ArgumentError`. (#137)
+- **Sequenceable / Duplicable**: a duplicated record is numbered in its own `reset:` period (the copy used to
+  inherit the original's memoized "now"); Duplicable blanks a custom `period_column:`. (#191)
+- **Sequenceable / Tokenizable / Hashable / Sortable**: a number, token, code or list position generated on create
+  no longer survives a failed INSERT; a create that rolls back puts the generated columns back, so
+  `UniqueRetry.with_retries { record.save! }` draws a fresh value. Values you supplied are kept. (#190)
+- **Sluggable**: an explicitly assigned blank slug (`""` or `nil`) is built from the source in the same save
+  instead of stored as is; a non-blank assigned slug still wins. (#131)
+- **Sluggable**: `scope: [:account_id, :locale]` (friendly_id's multi-column scope) no longer raises
+  `NoMethodError` at class load; every scope column is validated and slugs are unique per combination. (#157)
+- **SoftDeletable**: `really_delete!` marks the instance destroyed (`destroyed?` true, `persisted?` false)
+  before freezing it. (#134)
+- **SoftDeletable / Publishable**: merging a soft-deletable model's relation into another model's no longer strips
+  the OUTER model's own `deleted_at IS NULL`. The default scope records no `unscope`, and the named scopes unscope
+  the column on their own table only (Rails 6.1+; on 6.0 a merged named scope still leaks). (#186)
+- **Stateable**: `transition_all` on a `lock: true` model checks each guard under its row lock, so a row another
+  process moved is skipped instead of aborting the whole batch with `InvalidTransition`. (#147)
+- **Stateable**: a base-class `transition_all` on an STI table judges each record by its own class's declaration:
+  subclass rows without the event are skipped (no `NoMethodError`) and rows a subclass's wider `from:` accepts
+  are transitioned. New public reader `stateable_transition_config(event)`. (#153)
+- **Storable**: a key that declares `type:` reads its `default:` back cast through that type (`default: "false"`
+  on a `:boolean` key used to read the truthy String). An uncastable default reads `nil`; `:json` defaults and
+  untyped keys return the default as written. (#130)
+- **Timezoneable**: `Time.zone` is restored after every action, also when the resolved zone is already the
+  current one; a `Time.zone = ...` made in the action no longer leaks to the next request. (#192)
+- **Tokenizable**: `authenticate_by_<field>` / `consume_<field>` answer `nil` for a value that is not a String or
+  Integer (a Hash from `?token[a]=b`, an Array) instead of raising `TypeError`. (#142)
+
+### Internal
+- Dev lock: permittable bumped to 0.11. (#159)
+- New `Support::TransformBackstop`: one shared prepended `before_save` dispatcher for Normalizable, Sanitizable,
+  Taggable and Addressable. (#176)
+- New `Support::ScalarParam.nul_free?` (NUL-byte operand check used by Filterable). (#152)
+
+## 1.32.1 (2026-10-08)
+
+A bug-fix release from a six-angle audit of 1.32.0 — data and encryption, state and counters,
+scopes and batch verbs, field transforms, request params, HTTP policy. Every finding was
+reproduced by a failing spec before it was fixed, and every fix ships with a regression spec;
+the batch then went through an adversarial review round. No new concerns, no new options and
+no migrations. A few fixes now raise where the gem used to misbehave silently — read
+**Changed** first. 2827 examples, 0 failures (2795 on Rails 6.0).
+
+### Changed
+- **Encryptable: Lockable's `unlock_token:` cannot be `encryptable`** (`ArgumentError` at
+  declaration, either order). The token is minted, claimed and cleared by callback-skipping
+  SQL keyed on the column value, so an encrypted token was never found: every unlock link was
+  dead. Keep it a plain column — it is random, single-use and cleared with the lock.
+- **Monetizable: an `encryptable` cents column is refused** (`ArgumentError`, either order):
+  `sum_`/`average_`/`minimum_`/`maximum_` ran SQL aggregates over ciphertext.
+- **Auditable: `audited_changes_since` reads its argument in `Time.zone`** — a `Date` is
+  midnight in `Time.zone`, a zone-less String is read in `Time.zone` (not the server's system
+  zone), and a String that names no time raises `ArgumentError` (`"junk"` used to mean June 1).
+- **Encryptable: blind indexes refresh in `before_create`/`before_update`**, after every
+  `before_save`, instead of in an include-time `before_save`. An app `before_save` that rewrites
+  the field (`self.email = email.downcase`) is now fingerprinted as stored, and a new row always
+  refreshes every indexed field, so a copy (`dup`, Duplicable's `reset:`) no longer keeps its
+  original's digest. Rows written by such a callback before this release keep a stale digest
+  until re-saved with a change.
+
+### Fixed
+- **Encryptable**: decrypted text reads back as UTF-8 (binary only when the bytes are not valid
+  UTF-8). Non-ASCII values compared unequal to what was written after a reload, were dirty on
+  every reassignment, and `reencrypt!` fingerprinted different bytes under a `downcase`
+  `expression:`, so rotated rows could no longer be found.
+- **Encryptable**: an empty-String column default (`text null: false, default: ""`) reads as
+  `""` instead of raising `DecryptionError` on every new record.
+- **Encryptable**: `find_by_<field>` / `where_<field>` / `<field>_fingerprint` run the lookup
+  value through the field's Normalizable rule and its Rails 7.1+ `normalizes`, as Rails' own
+  finders do.
+- **Storable**: a `:float` key given `"Infinity"`/`"NaN"` casts to nil instead of raising
+  `JSON::GeneratorError` (a 500 from a form field).
+- **SoftDeletable**: `without_deleted.really_destroy_all` (and any relation repeating the
+  default `deleted_at IS NULL`) no longer hard-deletes the trash, and `without_deleted.restore_all`
+  no longer restores it: only the default scope's own predicate is peeled off.
+- **`*_all` batch verbs** (`Support::BatchOps`) roll the whole batch back inside a caller's
+  transaction too: the batch runs in its own savepoint, so a caller rescuing the
+  `RecordNotSaved` no longer commits the records written before the failing one.
+- **Sluggable**: a record moved to another `scope:` value whose slug that scope already holds
+  rebuilds it against the new scope instead of duplicating it; a slug that is free there is kept.
+- **Sortable**: the position acts_as_list assigns in `before_create` is reported through
+  `Support::GeneratedValues`, so an Auditable model tracking it records it on create.
+- **CounterCacheable**: a save that changes a row's STI type (`becomes!`, `update!(type:)`)
+  judges the old state under the old type's rule and the new state under the new type's, and
+  destroy uses the persisted type's rule — the live counter no longer drifts from
+  `recount_counter_caches!`.
+- **Stateable `lock: true` / Activatable `toggle_active!`**: the reload under the row lock keeps
+  a loaded `belongs_to` parent whose foreign key it didn't change, so CounterCacheable's mirror
+  reaches the caller's parent instead of leaving it to raise `StaleObjectError`.
+- **Stateable**: `transition_all` no longer skips rows already in the target state when the
+  event's `from:` lists that state (a declared self-transition).
+- **Lockable**: `attempts_remaining` returns the full `max_attempts` once a lock has lapsed
+  (`unlock_in`), instead of 0 on an unlocked account.
+- **Sanitizable** `on: :write`, **Taggable** and **Addressable** also normalize in a prepended
+  `before_save` backstop (Normalizable's pattern), so `update_attribute` / `save(validate: false)`
+  no longer store raw markup, un-normalized tags or un-normalized address parts. A validated
+  save stores exactly what it stored before (the backstop never re-runs a rule on a value
+  validation already accepted).
+- **Maskable / Sanitizable**: `as_json(masked: true)` / `as_json(sanitized: true)` carry the flag
+  through every nested `include:` level, so a grandchild reached through a model without the
+  concern is no longer serialized raw.
+- **Masker `:email`** fails closed (full mask) unless the value is exactly one address, so a
+  second address in a list is no longer revealed.
+- **Monetizable**: a `Rational` amount converts (`Rational(1999, 100)` → 1999 cents) instead of
+  being stored as nil.
+- **Searchable / Taggable**: queries and tags are trimmed (and `mode: :all` split) on Unicode
+  whitespace — a no-break or ideographic space no longer becomes part of the LIKE pattern or a
+  distinct tag.
+- **Filterable**: a nested-array param (`?name[][]=a&name[][]=b`) is ignored instead of raising
+  a `TypeError` 500; a JSON-body number on a date/datetime column — compared, in equality,
+  `in`/`not_in`, or handed to a `type: :date` lambda — matches nothing instead of being bound raw
+  (a 500 on PostgreSQL); a date/time operand longer than 128 characters no longer raises
+  `Date._parse`'s `ArgumentError` (a 500) on Rails 6.0–7.0 and is answered as 7.1+ answers it.
+- **Paginatable**: a number where a nested page Hash belongs (`{"page": 2}` under
+  `style: :jsonapi`) falls back to the defaults instead of a `TypeError` 500.
+- **CursorPaginatable**: a page ending on a stored ±Infinity/NaN float no longer raises
+  `JSON::GeneratorError` on every request — the boundary is minted as a string and walked
+  correctly on PostgreSQL and SQLite; a tampered number/boolean for a date/time boundary, or an
+  over-long date String on Rails 6.0–7.0, is an `InvalidCursor` (400), not a decoded position
+  or a 500.
+- **Paginatable / CursorPaginatable**: `Link` header URLs are percent-encoded inside `<…>`, so a
+  crafted request path can no longer inject extra Link entries.
+- **Throttleable**: the first-hit seed is written `raw: true` (to any store whose `write` takes
+  options), so a memcached `Rails.cache` on Rails 6.0–7.0 enforces the limit again (every later
+  `increment` returned nil and the 429 never fired).
+- **Timezoneable**: a `Time-Zone` header or `time_zone` cookie that is not valid UTF-8 is ignored
+  instead of raising a 500 (persistently, for the cookie); the `available:` allow-list matches by
+  zone, not spelling, so `America/New_York` matches an allow-listed `Eastern Time (US & Canada)`.
+- **Cacheable**: per-call `stale_resource?(r, extras: [...])` downgrades `Cache-Control` to
+  `private`, like a Vary-less `etag_with` source, so a CDN no longer serves one caller's
+  representation to the next.
+- **Localizable**: `Accept-Language: pt-BR` (and `?locale=pt-br`) selects an available `:pt_BR`;
+  `-` and `_` are one separator (an exact spelling still wins).
+
+### Known issues (not fixed in this release)
+- CounterCacheable: a parent destroyed inside the same rolled-back transaction keeps the
+  mirrored counter/lock_version in memory.
+- Aliasable: eager-loading an alias together with its source in one query loads each child twice.
+- Encryptable: on the pre-7.1 Marshal format, a record whose field has a per-field Proc `key:`
+  cannot be `Marshal.dump`ed (`Rails.cache`).
+- CursorPaginatable: on PostgreSQL, a page ending on a timestamp stored as `'infinity'` now mints
+  its cursor (it used to be a 500), but the next page answers 400 — the walk cannot step past it.
+
 ## 1.32.0 (2026-10-07)
 
 A dependency release (#127): the `permittable` floor rises to `>= 0.8`, and the Permittable docs