concerns_on_rails 1.32.1 → 1.34.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e44cfe4621a22897c4d3f6e2ade5b1485d7c686f10dd72fb0dd582a50eadd73
-  data.tar.gz: 478bc126777b1627ffba7275f1f81421c0ce112b01e3348c30b4010a023af75c
+  metadata.gz: 9acfbd10f8e27c5a4535a3486fec52255d7d5e997e3b7654547e864802bdcf58
+  data.tar.gz: 31701400ec820ac47a7cd26e8b68579dab0fba3d43bd1d8cea87b63c60f244ce
 SHA512:
-  metadata.gz: bf067b1d2068e59ed7007bddfc41e2b70a287a57e6e3727e0fba8653ef4d4c1f892e158d6e012b96fbfb862eb1a2a8e48c17d60acc0891c2b85fc43f9c8bb17f
-  data.tar.gz: 71db79d7dd7e673b111d20a89a99d2ea7a95cd41c13ff3ededd017f27ef10a4351d7689b7aebcf04a2c8aedebbc0cee5bb8d8f57e1ac96bec1aaf5f838852171
+  metadata.gz: 0fc6561854bcdb26fbbae74b6f9b623bd9af28b240b313f56dcaa5c40da9c03726db39908e2b6ddb6af67d326fdd1f597c4ec81d31fc951711753320f44cf533
+  data.tar.gz: 4471742ad951b6b0dfd9998c93c43ba2e6627d44e5d6b94c0e48c366dcd5732f0c51b5df7886d3d88f0c6a71cf63a33f1a6695adfa1bf8292b8d51eb91d49609

data/CHANGELOG.md

@@ -1,5 +1,586 @@
 <!-- CHANGELOG.md -->
 
+## 1.34.0 (2026-10-29)
+
+A correctness release: it fixes the 43 bugs proven by the 2026-10-29 audit of 1.33.0. Some fixes change behaviour,
+and five configurations that used to be silently broken now raise at class load. Read **Upgrading** first.
+
+### Upgrading
+
+**Class-load (boot) raises for configurations that were silently broken.**
+
+- [ ] **CounterCacheable, composite keys:** `counter_cacheable_by` raises `ArgumentError` for a `belongs_to` with a
+  composite `foreign_key:` (`[:shop_id, :order_id]`), a composite association primary key or `query_constraints:`
+  (Rails 7.1+), as it does for a polymorphic one. It was accepted, never counted the children and made
+  `recount_counter_caches!` raise invalid SQL. Count on a single-column key instead. A model-level
+  `query_constraints` must be declared before `counter_cacheable_by`. (GRAPH-2)
+- [ ] **CursorPaginatable, `predicate: :row`:** `predicate: :row` with a mixed-direction `order:` or `order_presets:`
+  entry raises `ArgumentError` at class load (also when a later re-declaration combines with an inherited one), and a
+  per-call `cursor_paginated(order:)` with mixed directions raises before page 1. This includes a nullable ordering
+  column, which used to fall back to the OR-expansion silently. Switch to `predicate: :auto` (it falls back to the
+  OR-expansion for mixed directions) or make the directions uniform. (PARAMS-4)
+- [ ] **Stateable, event named `transition`:** a transition event whose (affixed) name is `transition` raises
+  `ArgumentError` at the macro. It generated a `transition!` that always raised from the generic
+  `before_/after_transition` hooks. Rename the event or use `prefix:`/`suffix:`. (STATE-6)
+- [ ] **Authorizable, `require_role`:** `require_role` with an empty list (`require_role []`, `[[]]`) or a nil/blank
+  role (`require_role ENV["ADMIN_ROLE"]&.to_sym` unset) raises `ArgumentError` at class load; a blank role used to
+  admit actors whose role is `""` or nil. (HTTP-2)
+- [ ] **Encryptable, per-field `key:`:** a DECLARED per-field `key:` that resolves to nil or `""` (a Proc over a
+  credential that is not there yet, an explicit `key: nil`, an eagerly nil `ENV["X"]` / credential) is a missing key:
+  it raises `MissingKeyError` naming the field on write, read and blind-index lookup (or leaves the value plaintext
+  under `on_missing_key: :passthrough`) instead of silently encrypting under the global key. Only an OMITTED `key:`
+  uses the gem-level key. `key:` must be a String or respond to `call`; `key: false`, `key: 123` or `key: :sym` raises
+  `ArgumentError` at the macro. Rows already written under the global key are NOT repaired by `reencrypt_all!`
+  (it skips per-field fields); they fail to decrypt under the field key. For each such row, decrypt the raw column
+  value with the global key (`ConcernsOnRails::Support::Encryptor.decrypt(raw, key: <global key material>,
+  salt: ConcernsOnRails.encryption.key_derivation_salt)`; read `raw` with `<field>_ciphertext`, since the model's
+  reader raises for such rows), then write the plaintext back through the model while the field key resolves, so it
+  is re-sealed under the field key.
+  Rows left plaintext under `:passthrough` only need a plain re-save once the key resolves. (DATA-2)
+
+**Behaviour changes.**
+
+- [ ] **Normalizable / Sanitizable / Taggable / Addressable:** Normalizable no longer re-normalizes a later transform's
+  output at `before_save`, so with Normalizable included BEFORE a Sanitizable/Taggable/Addressable rule on the same
+  column its rule no longer gets "the last word" (`squish` then `strip` on: :write stores `" a  b"` where it stored
+  `"a b"`). Include Normalizable AFTER the other transform to normalize its output. (TRANS-2)
+- [ ] **Taggable:** with a self-overlapping delimiter (`"--"`, `"||"`, `" | "`) a tag is trimmed of a trailing part
+  that is the start of the delimiter, and of a leading part that is the end of it: `"a-"` becomes `"a"` and `"-b"`
+  becomes `"b"` under `"--"`. Delimiters that do not overlap themselves are unaffected. Stored tags with a leading
+  straddling part are not migrated; `Model.normalize_tags!` repairs them. (TRANS-4)
+- [ ] **Paginatable / Includable:** re-declaring `paginate_by` or `includable` in a subclass changes only what it
+  passes; every omitted option now keeps its inherited value (before it reset to the gem default, for example a
+  parent `max_per_page: 20` became 200). A subclass that relied on the reset must pass the option explicitly.
+  For `includable` the association list still replaces the parent's, and an inherited `default:` path the new list no
+  longer contains is dropped with a stderr warning at class load. (PARAMS-2)
+- [ ] **Filterable, `_null`:** `?<field>_null=` and `?field[null]=` read only `true/false/1/0/t/f/yes/no`
+  (case-insensitive) or a real boolean; any other NON-BLANK value (`maybe`, `on`, `off`, `nope`) matches nothing
+  instead of being read as `IS NULL` (`off` used to be `IS NOT NULL`). A blank value is skipped as before, and
+  surrounding whitespace is ignored. (PARAMS-6)
+- [ ] **Filterable, encrypted columns:** on an `encryptable` column equality and `in` go through the blind index and every
+  other operator (`not`, `not_in`, `gt`, `gte`, `lt`, `lte`, `contains`, `starts_with`) fails closed (`none`); a field
+  without a blind index fails closed for every operator but `null`. Add `blind_index: true` to filter an encrypted
+  field by equality. (PARAMS-1)
+- [ ] **Filterable, `with:` lambdas:** a lambda declared with a `type:` receives no Array/Hash/Parameters value; such a
+  value fails the filter closed (`none`) for every `type:`. (PARAMS-S4)
+- [ ] **Filterable, float columns:** a decimal literal that a double does not read back as (more digits than a Float
+  keeps, e.g. `0.1000000000000000000001`) equals nothing and compares as the largest double at or below it. (PARAMS-8)
+- [ ] **Paginatable / CursorPaginatable, `page` / `per_page`:** read as exact whole numbers (`1e3` is 1000, `2e0` is 2);
+  a fractional (`2.9`), trailing-garbage (`10abc`) or unreadable value falls back to the default instead of its
+  leading digits, and a value beyond 100 digits falls back to the default instead of clamping. (PARAMS-7)
+- [ ] **CursorPaginatable, SQLite:** a hand-made cursor whose String boundary carries a NUL byte is accepted on SQLite
+  (it cannot be told from a minted one) instead of answering `InvalidCursor`. (PARAMS-5)
+- [ ] **Publishable:** `unpublish!` on a stored draft (blank saved column; false/NULL on a boolean) is a no-op like
+  `publish!`: it returns `true`, writes nothing and fires no `before/after_unpublish`. A scheduled row is still
+  cleared with the hooks. (STATE-5)
+- [ ] **SoftDeletable:** `soft_delete!`/`restore!` decide "already done" from the SAVED stamp. Assigning the stamp
+  without saving no longer makes the verb return `true` while writing nothing: it writes, fires the hooks and cascades.
+  A no-op verb now saves OTHER pending changes (previously dropped; a validation can make it return `false`). (STATE-12)
+- [ ] **Expirable:** `expire_in!(nil)` and `extend_expiry!(by: nil)` (anything but an `ActiveSupport::Duration` or a
+  `Numeric`) raise the concern's `ArgumentError` instead of a bare `TypeError`; an object that merely responds to
+  `to_i` is refused too. (STATE-10)
+- [ ] **Expirable, `date` columns:** `expire_in!(15.minutes)` on a `date` column writes today's date, so it now fires the
+  hooks, because the record is `expired?` (unchanged for UTC process zones). (STATE-2)
+- [ ] **Anonymizable:** `anonymize!` returns `false` (no `after_anonymize`) when its UPDATE reached no row, and
+  `anonymize_all!` no longer counts such a row. (STATE-9)
+- [ ] **Lockable:** `register_failed_attempt!` on a `readonly!` or destroyed record raises before incrementing, so
+  nothing is written; an already-locked record still just answers the count. (DATA-4)
+- [ ] **Monetizable:** the writer casts an amount the cents column cannot hold to `nil`, like other oversized input
+  (a 4-byte integer column overflows at about 21.4 million units). (TRANS-S3)
+- [ ] **Authorizable:** the default denial `message:` follows the status: 404 renders ErrorHandleable's exact
+  "Resource not found", 401 "Unauthorized", anything else "Forbidden". A `status: :not_found` / `:unauthorized` rule
+  without `message:` changes its body message and the `authorization_denied` payload's `message`; an explicit
+  `message:` still wins. (HTTP-1)
+- [ ] **Authorizable, `require_role`:** Array arguments are flattened, so `require_role %i[admin editor]` and
+  `require_role ADMIN_ROLES` work (they used to deny everyone). (HTTP-2)
+- [ ] **Timezoneable:** responses gain `Vary: Time-Zone` whenever the `Time-Zone` header source is on (default; no longer
+  only with `response_header:`) and `Vary: Cookie` whenever the cookie source is on. New `vary:` option (default
+  true; `vary: false` opts out). `response_header:` now controls only `X-Time-Zone`. (HTTP-3)
+- [ ] **ErrorHandleable:** the RecordNotDestroyed 422 renders "Resource could not be deleted" instead of Rails'
+  "Failed to destroy <Model> with id=<id>"; the record's `errors.full_messages` still ride as `details`. The
+  `message` of that 422 and of the `handled_error` payload changed. (HTTP-4)
+- [ ] **Respondable / ErrorEnvelope, status symbols:** on Rack >= 3.1 without Rails 8.1's own rewrite (Rails
+  7.1/7.2/8.0) the gem renders the renamed symbol (`:unprocessable_content`, ...), so `rendered[:status]` is Rack
+  dependent; specs asserting `:unprocessable_entity` should compare to `ErrorEnvelope.renderable_status(:unprocessable_entity)`.
+  An app's OWN `render_error` override still receives the raw `:unprocessable_entity`; one that calls `render` with
+  it logs Rack's deprecation on Rack >= 3.1. (HTTP-5)
+- [ ] **SecureHeadable, `:hsts`:** the `:hsts` preset is skipped when `Rails.application.config.force_ssl` is on (read
+  per request), so Rails' own HSTS (`config.ssl_options[:hsts]`) is no longer overridden by the preset's one-year
+  value. A custom `"Strict-Transport-Security"` pair with a different value is still sent. (HTTP-6)
+- [ ] **SecureHeadable, header names:** names compare case-insensitively: a lower-case custom
+  `"strict-transport-security"` is withheld over plain HTTP, and a lower-case pair beside a preset
+  (`"x-frame-options"` + `:deny_frame`) is ONE header (later value wins, first-registered spelling kept), written
+  under the spelling the response already carries. (HTTP-7)
+- [ ] **SoftDeletable:** after an association `destroy_all` the association cache is reset rather than marked
+  loaded-and-empty, so a `default_scope: false` / `-> { with_deleted }` association still shows its soft-deleted rows
+  on the next read (and `size`); one extra query on the next read. (STATE-4)
+- [ ] **Batch verbs, partial `select`:** every `*_all` verb and a SoftDeletable relation `destroy_all` over a relation
+  with a partial `select` load whole rows (`table.*` is added; computed aliases a HAVING/ORDER reads stay; joins and
+  wheres kept) instead of raising `MissingAttributeError`. Accepted limits: a joined-table column, a Rails 7.1+ Hash
+  select or a comma-joined String repeating a column beside the star can still repeat `id` in the DISTINCT key
+  subquery on PostgreSQL/MySQL; a direct `BatchOps.each_record` caller selecting without the primary key still
+  gets nil ids. (STATE-7)
+- [ ] **Stateable, `transition_all`:** a record failing validation raises `ActiveRecord::RecordNotSaved` (carrying the
+  record; batch rolled back as before) instead of `RecordInvalid`; rescue `RecordNotSaved`. Another record's failed
+  `save!` inside a hook still propagates as `RecordInvalid`. The single `<event>!` still raises `RecordInvalid`.
+  (STATE-8)
+- [ ] **Sequenceable, `period_column:`:** a row numbered before a switch to a custom `period_column:` (NULL there)
+  formats (`formatted_<field>`, `sequenceable_period_time`) in its `created_at` period instead of today's. (GRAPH-1)
+- [ ] **Sluggable, `history: true` + `scope:`:** moving a record into a scope where another record's friendly_id history
+  holds its slug regenerates the slug (it raised `RecordNotUnique` or took over the old URL). (GRAPH-5)
+- [ ] **Duplicable:** a child or has_one target marked for destruction (`_destroy`, `mark_for_destruction`) is no longer
+  copied. (GRAPH-6)
+- [ ] **Legacy aliases:** a racing first reference to a top-level alias (`ConcernsOnRails::Sluggable`) no longer prints
+  "already initialized constant". (GRAPH-4)
+
+
+### Fixed
+
+- **Lockable**: `register_failed_attempt!`, `lock_access!`, `unlock_by_token`, the lapsed-lock clear and the lost-claim
+  adoption read no longer raise `ArgumentError` on a composite primary key (Rails 7.1+); every site addresses its row
+  through `Support::PrimaryKey`. (DATA-1)
+- **Tokenizable**: `consume_<field>` no longer raises `ArgumentError` on a composite primary key. (DATA-1)
+- **Lockable**: `register_failed_attempt!` on a `readonly!` (or destroyed) record raises `ReadOnlyRecord` /
+  `ActiveRecordError` before incrementing; it used to increment in SQL and then raise from `lock_access!`, leaving the
+  row at max attempts and unlocked. (DATA-4)
+- **Tokenizable / Lockable**: `authenticate_by_<field>` / `consume_<field>` and `unlock_by_token` answer `nil`, without
+  a query, for a token holding a NUL byte (`?token=%00`); on PostgreSQL they raised (the driver refuses NUL in a bound
+  parameter). Uses `Support::ScalarParam.nul_free?` like Filterable. (DATA-3)
+- **Encryptable**: a per-field `key:` that resolves to nil or `""` (a Proc over a missing credential, an explicit
+  `key: nil`, an eagerly nil `ENV[...]`) no longer falls back to the global key. It raises `MissingKeyError` naming
+  the field on write, read and blind-index lookup/refresh, or stays plaintext under `on_missing_key: :passthrough`;
+  `key:` must be a String or callable (`ArgumentError` otherwise). It used to seal a key_id-0 envelope under the
+  global key that the field key could not decrypt later. (DATA-2)
+- **Authorizable**: the default denial `message:` follows the status (404 "Resource not found", 401 "Unauthorized",
+  else "Forbidden"), so a 404 denial is no longer distinguishable from ErrorHandleable's own 404. (HTTP-1)
+- **Authorizable**: `require_role` flattens Array arguments (`require_role %i[admin editor]` used to deny everyone) and
+  refuses an empty list or a nil/blank role at class load. (HTTP-2)
+- **SecureHeadable**: the `:hsts` preset is skipped under `config.force_ssl`, so it no longer overrides Rails' own HSTS
+  header. (HTTP-6)
+- **SecureHeadable**: header names compare case-insensitively, so a lower-case custom pair beside a preset (or Rails'
+  default `X-Frame-Options` on Rails < 7.1) is one header, not two conflicting ones. (HTTP-7)
+- **SoftDeletable**: `really_delete!`, `is_really_deleted?` and the trashed-row purge guard no longer raise on a
+  composite primary key. (STATE-3)
+- **SoftDeletable**: `soft_delete!`/`restore!` read the SAVED stamp instead of the unsaved in-memory one; they used to
+  return `true` while writing nothing (no hooks, no cascade) after the stamp was assigned unsaved. `restore!` cascades
+  by the saved stamp. (STATE-12)
+- **Sortable**: `reposition!` works on a composite primary key (Rails 7.1+). Ids are `[shop_id, id]` tuples (a record
+  is accepted too), cast per column and written one UPDATE each inside the transaction; a malformed tuple raises
+  `ArgumentError` before any write. A simple key keeps the single CASE UPDATE. It raised `TypeError: can't quote
+  Array`. (GRAPH-3)
+- **CounterCacheable**: a composite-key `belongs_to` is refused at the macro (see Upgrading); it was accepted and never
+  counted. (GRAPH-2)
+- **Expirable**: `time_until_expiry` no longer raises `TypeError` on a `date` column with a future date. It agrees with
+  `expired?` (0 when expired, today counts, in `Time.zone`), otherwise measures to the start of the date in
+  `Time.zone`, and is clamped at 0. Also fixes today's date in a zone ahead of UTC answering a positive duration
+  while `expired?` was true. (STATE-1)
+- **Expirable**: `expire!` / `expire_in!` on a `date` column fire `before/after_expire` exactly when the written value
+  makes the record `expired?`, whatever the process TZ (`Date#to_time` used `ENV["TZ"]` and skipped the hooks for
+  hours a day). A blank time (`nil`, `""`, `false`) for `expire!`/`expire_all` is cast through the column like a given
+  time (today's `Date` on a `date` column; `expire_all(nil)` writes it). (STATE-2)
+- **Expirable**: `expire_in!(nil)` and `extend_expiry!(by: nil)` raise the concern's `ArgumentError`
+  (shared `expirable_check_duration!`). (STATE-10)
+- **Publishable**: `unpublish!` on a draft is idempotent like `publish!`; `unpublish_all` already skipped such rows, so
+  verb and batch now agree. (STATE-5)
+- **Anonymizable**: the erasing UPDATE's result is honoured; a row deleted (or unwritable under optimistic locking)
+  between load and UPDATE is not counted, and `anonymize!` returns `false` instead of raising from the reload.
+  (STATE-9)
+- **HookedWrite** (every hooked verb: `publish!`, `activate!`, `expire!`, `soft_delete!`, Stateable `<event>!`, ...): a
+  veto on a NEW record inside a caller's transaction left it `persisted?` with no id; the next `save` ran
+  `UPDATE ... WHERE id IS NULL`, returned `true` and wrote no row (`StaleObjectError` with `lock_version`). The
+  identity (`new_record?`, `destroyed?`, `previously_new_record?`, id) is now snapshotted and restored for new records
+  too. Rails 6.0 never showed the bug; 6.1 through 8.1 did. (STATE-11)
+- **Storable / Auditable**: a PostgreSQL `jsonb` column and an `attribute :x, :json` override over a text column are
+  handed the Hash/Array instead of a JSON string scalar, so `where_<key>(v)` matches and `where_<key>(nil)` no longer
+  matches every row. One shared `Support::NativeJson.column?` backs both. (TRANS-1)
+- **Normalizable**: no longer re-normalizes a later transform's output at `before_save`: `normalizable :title, with:
+  :titleize` plus `sanitizable :title, with: :strip, on: :write` stored `"A &Lt; B"` for a validated `"A &lt; B"`, and
+  an entity-decoding rule could store live markup in a `:strip` column. Every transform records what it wrote
+  (`Support::TransformBackstop.wrote`) and the settle step skips a field still holding it. (TRANS-2)
+- **Normalizable / Sanitizable**: a save halted by a later `before_save` (or rolled back by `RecordNotUnique`), then
+  retried on the same record, no longer re-runs a non-idempotent rule on its own output (`"a!"` no longer becomes
+  `"a!!"`, `"Tom &amp; Jerry"` no longer `"Tom &amp;amp; Jerry"`), `update_attribute` saves included. The per-save
+  records are dropped after a successful save, kept across a rollback, and dup/clone no longer share them. (TRANS-3)
+- **Taggable**: a tag ending with the start of a self-overlapping delimiter, or starting with its end (`["a-", "b"]`
+  under `"--"` read back as `["a", "-b"]`), is trimmed when cleaned; `tag_list=`/`add_tags` clean an Array item by item instead of joining and
+  re-splitting. (TRANS-4)
+- **Monetizable**: `price = "1e18"` on an integer cents column casts to `nil` (checked against the column type's own
+  range) instead of a value whose save raised `ActiveModel::RangeError`. (TRANS-S3)
+- **Paginatable / Includable**: `paginate_by` and `includable` re-declared in a subclass keep every omitted option
+  (an UNSET sentinel, as `cursor_paginate_by`); `paginate_by style:` re-derives both param paths, explicit
+  `page_param:`/`per_page_param:` still win; `includable` `fields:`/`default:`/`strategy:` inherit when omitted
+  (`default: nil` / `fields: {}` clear them). (PARAMS-2)
+- **Paginatable**: a grouped relation with a `HAVING` on a select alias no longer raises `StatementInvalid`
+  (SQLite/MySQL); it is counted as a subquery that keeps its select list. A grouped relation with no `HAVING` or no
+  select list keeps the plain `COUNT ... GROUP BY`. (PARAMS-3)
+- **CursorPaginatable**: `predicate: :row` with mixed directions is refused at the macro (see Upgrading); page 1
+  minted a cursor and every page-2 request answered 500. (PARAMS-4)
+- **CursorPaginatable**: on SQLite a row whose String ordering value holds a NUL byte no longer ends the walk with a
+  400 on its own cursor; the boundary goes into the keyset WHERE as `CAST(X'<hex>' AS TEXT)`, which assumes a UTF-8
+  SQLite database (Rails' default). MySQL already accepted it; PostgreSQL still answers `InvalidCursor`. (PARAMS-5)
+- **Paginatable / CursorPaginatable**: `page` / `per_page` are read as exact whole numbers through
+  `Support::NumericOperand` instead of `String#to_i` (`?per_page=1e3` was 1, `?per_page=10abc` was 10); a non-whole
+  JSON Float falls back too. (PARAMS-7)
+- **Filterable**: `?<field>_null=` reads only an explicit true/false spelling; any other non-blank value matches
+  nothing (see Upgrading). (PARAMS-6)
+- **Filterable**: Encryptable-aware (`Support::EncryptedLookup.rule`), `alias_attribute` followed: equality and `in` use
+  the blind index, `not`/`not_in`/`gt`/`gte`/`lt`/`lte`/`contains`/`starts_with` fail closed. `?ssn_not=123` used to
+  return the excluded row and `=`/`in`/`contains` silently matched nothing. `null` keeps working on an encrypted
+  column. A nil member of an Array operand is dropped. (PARAMS-1)
+- **Filterable**: a Float-column operand is no longer rounded to the nearest double and treated as exact;
+  `?score_gt=0.1000000000000000000001` keeps a stored 0.1. A literal the double keeps (`0.1`) stays exact. (PARAMS-8)
+- **Filterable**: a `with:` lambda declared with a `type:` fails closed on an Array/Hash/Parameters value instead of
+  receiving a cast one (`?flag[]=0` was `true`). (PARAMS-S4)
+- **Authorizable**: the default `message:` follows the denial status (404 "Resource not found", the shared
+  `Support::ErrorEnvelope::NOT_FOUND_MESSAGE`; 401 "Unauthorized"; else "Forbidden"), stored resolved at declaration so
+  the instrumentation payload carries it. `require_role` flattens its arguments and raises on an empty, nil or blank
+  role. (HTTP-1, HTTP-2)
+- **ErrorHandleable**: the RecordNotDestroyed 422 no longer leaks the model class name and primary key. (HTTP-4)
+- **Timezoneable**: `Vary: Time-Zone` / `Vary: Cookie` are appended (via `Support::VaryHeader`; `Vary: *` left alone)
+  even when the request carries no `Time-Zone` header; `vary: false` opts out. (HTTP-3)
+- **Respondable / ErrorEnvelope**: the envelope and inline branches no longer log "Status code :unprocessable_entity is
+  deprecated" on Rack >= 3.1; `ErrorEnvelope.renderable_status` renames only when the running Rack dropped the old
+  name (Rack < 3.1 keeps it). (HTTP-5)
+- **SecureHeadable**: `:hsts` yields to `force_ssl`; header names merge case-insensitively through
+  `SecureHeadable.merge_headers` (no more two conflicting `X-Frame-Options` lines on Rails < 7.1). (HTTP-6, HTTP-7)
+- **SoftDeletable**: association `destroy_all` resets the association cache instead of `loaded!`-empty. (STATE-4)
+- **BatchOps / SoftDeletable**: `BatchOps.full_rows(relation)` (used by `BatchOps.run` and the relation `destroy_all`)
+  adds the model's own star to a partial select; `limited_keys` keeps the own-table star first and drops only plain
+  own-table columns from a DISTINCT key subquery. (STATE-7)
+- **Stateable**: an event named `transition` is refused at the macro (STATE-6); `transition_all` raises
+  `RecordNotSaved` for its own invalid record and propagates another record's `RecordInvalid` (STATE-8).
+- **Sequenceable**: legacy rows (NULL custom `period_column:`) format in their `created_at` period; `period_time` /
+  `base_time` take the field. (GRAPH-1)
+- **Sluggable**: a `history: true` + `scope:` move treats another record's history slug in the new scope as taken.
+  (GRAPH-5)
+- **Duplicable**: records marked for destruction are skipped, loaded or not, has_one included. (GRAPH-6)
+- **Legacy aliases**: `const_missing` resolution is serialized by a reentrant Monitor. (GRAPH-4)
+
+
+### Known issues (not fixed in this release)
+- CounterCacheable: a parent destroyed inside the same rolled-back transaction keeps the
+  mirrored counter/lock_version in memory.
+- Aliasable: eager-loading an alias together with its source in one query loads each child twice.
+- Encryptable: on the pre-7.1 Marshal format, a record whose field has a per-field Proc `key:`
+  cannot be `Marshal.dump`ed (`Rails.cache`).
+- CursorPaginatable: on PostgreSQL, a page ending on a timestamp stored as `'infinity'` now mints
+  its cursor (it used to be a 500), but the next page answers 400 — the walk cannot step past it.
+- Normalizable / Sanitizable: on an unvalidated (`update_attribute`) save that is halted and retried, with TWO
+  transforms on one column where the SECOND (not Normalizable) rewrites the first's output, Sanitizable's own record
+  holds only the first's output, so a validated retry re-sanitizes.
+- Sluggable `history: true` + `scope:`: friendly_id's history finder ignores scope, so after a record moves scope its
+  stale history slug can still match `Model.where(scope).friendly.find(old_slug)`. This is stock friendly_id
+  behaviour; the gem does not change it. (GRAPH-5)
+
+
+## 1.33.0 (2026-10-18)
+
+A correctness release: it fixes the 66 bugs proven by the 2026-10 audit of 1.32.1. Some fixes change
+behaviour, and several configurations that used to be silently broken now raise at class load. Read
+**Upgrading** first.
+
+### Upgrading
+
+**Class-load (boot) raises for configurations that were silently broken.** Each of these raised nothing
+before and misbehaved at run time; an app that boots today may fail to boot after upgrading.
+
+- [ ] **Encryptable, uniqueness:** a uniqueness validation over an encrypted field (or an encrypted `scope:`
+  column) raises `ArgumentError`. It always passed and saved duplicates. Use `where_<field>` with a unique
+  index, or `blind_index: true`. (#187)
+- [ ] **Encryptable, `serialize`/`normalizes`:** declared on the field before `encryptable` raises
+  (`serialize` on Rails 6.1+, `normalizes` on 7.1+). Declare `encryptable` first. (#188)
+- [ ] **Encryptable, DB default:** a non-empty database default on an encrypted column raises. Drop it with the
+  `change_column_default` named in the message (only `NULL` or `""` are allowed). (#136)
+- [ ] **Encryptable, scope columns:** an `encryptable` column as a Sequenceable `scope:`, a Sluggable/friendly_id
+  scope column or a Sortable `scope:` raises, in either order. Scope by an unencrypted column (a foreign key, a
+  plaintext copy). (#189)
+- [ ] **Monetizable, marks:** `separator:` equal to `delimiter:` (the usual slip is `separator: ","` alone, since
+  the default delimiter is also `","`), or empty with `precision:` above 0, raises, at the macro and for
+  per-call `formatted_` overrides. A `precision: 0` field with `delimiter: "."` (IDR / VND / CLP) now raises
+  too: pass `separator: ","`. (#158)
+- [ ] **Addressable, `default_country:`:** a value that resolves to no ISO country raises; a valid name or alpha-3
+  is stored as its alpha-2 code. Fix typos and unknown values. (#174)
+- [ ] **Shared affixed names:** two concerns that generate the same affixed predicate or scope name (for example
+  `prefix: :term` on Expirable and Activatable) raise at the macro. Give them distinct affixes. (#184)
+- [ ] **Sortable (controller):** `direction:` other than `asc`/`desc` (any case) raises (`:dsc`, `nil`). `"DESC"`
+  used to sort ascending. (#165)
+- [ ] **Sequenceable, `period_column:`:** the macro refuses a missing, non-date or `:updated_at` column. Under `reset:` it also refuses a subclass that restates its parent's visible format with a different `period_column:`, because the two series would print the same numbers. Declare the option on the declaring class, or in an `assign:`-only re-declaration. (#191)
+
+**Behaviour changes.**
+
+- [ ] **SoftDeletable `destroy_all`:** on a relation or association it is now a contextual soft delete
+  (`where(...).destroy_all`, `destroy_by`, `in_batches.destroy_all`, `post.comments.destroy_all`); only the
+  bare class form did before, and the scoped forms hard-deleted. Live rows are soft-deleted through
+  `soft_delete!`. Already-trashed rows are purged for real only when reached through that model's own trash
+  scopes (`only_deleted`, `soft_deleted`, `with_deleted`, `deleted_within`), fixed at call start; every other
+  relation leaves the trash alone. A purge also purges the record's trashed `cascade:` children, of any stamp,
+  ignoring the association's limit; a vetoed child skips its parent on a relation but raises on an
+  association. A restored row is re-checked before its purge. Rails' own `has_many :through` maintenance stays
+  a hard delete. Escape hatches: `really_destroy_all` to hard-delete on purpose, or `soft_deletable_by ...,
+  relation_destroy_all: :hard` for the old behaviour of the scoped forms. Destroy callbacks no longer run for
+  live rows (`before/after_soft_delete` run instead), and `touch: true` runs validations and update callbacks;
+  a failing row raises `RecordNotSaved` and rolls the batch back. (#169)
+- [ ] **Batch verbs on STI tables** (`publish_all`/`unpublish_all`, `soft_delete_all`/`restore_all`, `expire_all`,
+  `activate_all`/`deactivate_all`, `unlock_expired`) always stream per record, so subclass hooks and validations
+  run; slower on large tables. `self.inheritance_column = nil` keeps the single `UPDATE`. (#185)
+- [ ] **Batch verbs with sibling bookkeeping:** on a model with a CounterCacheable rule using `if:`, or Auditable
+  tracking a column the verb writes, they take the per-record path instead of the single `UPDATE`. (#154)
+- [ ] **Publishable/Activatable:** `publish!` on a published record, `activate!` on an active one and
+  `deactivate!` on an inactive one are no-ops (return `true`, no stamp, no hooks). Use `publish_at!` to re-stamp. (#146)
+- [ ] **Expirable:** `expire!`/`expire_all` never push an expiry later. Use `expire_in!` or `extend_expiry!` to set a
+  later one. (#141)
+- [ ] **Authorizable:** the denial envelope `code` follows `status:`: `"unauthorized"` for 401, `"not_found"` for
+  404, `"forbidden"` otherwise. Clients matching on `forbidden` need updating. (#145)
+- [ ] **Respondable:** a `Vary` in `headers:` is appended to the existing `Vary` instead of replacing it; a
+  caller's `Vary: *` still replaces. (#160)
+- [ ] **ErrorHandleable:** a malformed query string renders the JSON 400 `bad_request` envelope instead of Rails'
+  HTML 400 page. `handle_errors except: :bad_request` restores propagation. (#155)
+- [ ] **Encryptable/Auditable:** the blind index and the audit trail are captured at the write boundary, after
+  every `before_*` callback, so your own callbacks see them as loaded; the new values are in place from
+  `after_save`. (#172)
+- [ ] **Anonymizable:** `Model.anonymize_all!` also erases SoftDeletable's trash and Publishable's unpublished rows
+  under `default_scope: true`. Call it on a relation to limit it. (#171)
+- [ ] **Storable:** a key with `type:` reads its `default:` cast through that type (uncastable reads `nil`); keys
+  without `type:` and `:json` defaults return the default as written. (#130)
+- [ ] **Filterable:** enum comparisons use labels (#163) and an unknown enum label matches nothing (#168);
+  `type: :datetime` reads a zone-less operand in `Time.zone` or `ActiveRecord.default_timezone`, no longer the
+  server's system zone (#170); an operand with a NUL byte matches nothing (#152).
+- [ ] **Searchable:** `ranked:` search on a `DISTINCT` relation is returned unranked; order it yourself. (#135)
+- [ ] **Sluggable:** clearing the slug source keeps the existing slug instead of a uuid. (#151)
+- [ ] **Monetizable:** with `precision:` omitted and a power-of-ten `subunit_to_unit:` of 1000 or more, output
+  prints more decimals (3 for `1000`, 4 for `10_000`). Pass `precision:` to pin it. (#180)
+- [ ] **Normalizable:** `:url` turns `//HOST/path` into `https://host/path`, and a host-less `/path` is returned
+  stripped as `/path`. (#177)
+- [ ] **Timezoneable:** `Time.zone` is always restored after the action, also for the current zone. (#192)
+- [ ] **Duplicable:** a copy of a Sortable record takes a fresh list position instead of the original's. (#166)
+- [ ] **Sanitizable `on: :write`:** a persisted field the save does not change is no longer re-sanitized;
+  `sanitize_all!` remains the repair tool. (#148)
+- [ ] **CursorPaginatable:** a numeric cursor boundary the column cannot hold is an `InvalidCursor` 400, not an
+  empty page (#182); a cursor minted for a `time` column is now the stored time of day, old cursors still
+  decode on Rails 7.0+ (#183); binary boundaries travel as Base64 (#162). Cursors minted before the upgrade
+  are not all safe: on Rails 6.0/6.1 an old `time` cursor repeats its boundary row once (#183), and an old
+  cursor on an ASCII-only binary column may be reinterpreted once (#162). The next cursor is in the new form.
+
+### Added
+- **Sequenceable**: `period_column:` (default `:created_at`) names the datetime column a `reset:` period is cut
+  from. With `assign: :manual`, `period_column: :finalized_at` numbers a draft in the period it is finalized in
+  instead of the one it was drafted in; `assign_<field>!` stamps the column when blank. The MAX range, the
+  period token and `sequenceable_period_time` all read it. (#191)
+- **SoftDeletable**: `soft_deletable_by ..., relation_destroy_all: :hard` restores ActiveRecord's own hard
+  delete for the relation and association forms of `destroy_all`. (#169)
+
+### Changed
+- **Addressable**: `default_country:` is canonicalized like a country value (name, alpha-3 or alpha-2) and
+  stored as its alpha-2 code. A value that resolves to no ISO country raises `ArgumentError` when the macro
+  runs; `default_country: "USA"` or `"Canada"` used to silently disable postal, state and fingerprint matching
+  for every blank-country record. (#174)
+- **Authorizable**: the denial's envelope `code` follows its `status:`: `"unauthorized"` for 401, `"not_found"`
+  for 404, `"forbidden"` for 403 and anything else (it was always `"forbidden"`). A `status: :not_found`
+  concealment rule now renders exactly what ErrorHandleable's missing-record 404 renders. The
+  `authorization_denied(status:, message:)` override signature is unchanged. (#145)
+- **Anonymizable**: `Model.anonymize_all!` called on the model itself also erases the rows the gem's own default
+  scopes hide: SoftDeletable's trash and Publishable's unpublished rows under `default_scope: true`. The
+  application's own default scopes (a tenant, a discriminator) still apply. Called on a relation, an
+  association or inside `scoping`, it still erases exactly that relation. (#171)
+- **Batch verbs (Publishable / SoftDeletable / Expirable / Activatable / Lockable)**: on an STI table (a
+  present `inheritance_column` that is a real column) `publish_all`/`unpublish_all`,
+  `soft_delete_all`/`restore_all`, `expire_all`, `activate_all`/`deactivate_all` and `unlock_expired` always
+  stream per record instead of one `UPDATE`, so a subclass's overridden hooks, validations and re-declared
+  options apply. A model with `self.inheritance_column = nil` keeps the single `UPDATE`. (#185)
+- **Concerns sharing affixed names**: declaring two concerns that generate the same affixed predicate or scope
+  name (for example `prefix: :term` on Expirable and Activatable) raises `ArgumentError` at the macro. Before,
+  the second silently replaced the first's `term_active?` and `.term_active`. Unaffixed concerns that share plain
+  names are unchanged. (#184)
+- **Encryptable**: a non-empty database default on an encrypted column is refused (`ArgumentError` at
+  declaration, with the `change_column_default` that drops it). Any default other than `NULL` or `""` is
+  plaintext that can never decrypt, so every `Model.new` raised `DecryptionError`. Skipped while the schema is
+  unreachable. (#136)
+- **Encryptable**: a uniqueness validation over an encrypted field (or an encrypted `scope:` column), declared
+  before or after `encryptable`, raises `ArgumentError` at class load. Before, it always passed and duplicates
+  were saved. Uniqueness on plain columns is unchanged. (#187)
+- **Encryptable**: `serialize` or `normalizes` declared on the same field before `encryptable` raises
+  `ArgumentError` at class load (Rails 6.1+ for `serialize`, 7.1+ for `normalizes`). Declare `encryptable` first.
+  Before, `encryptable` silently dropped the earlier decoration. Rails 6.0 serialize-first declarations are
+  unchanged. (#188)
+- **Encryptable / Sequenceable / Sluggable / Sortable**: an `encryptable` column can no longer be a Sequenceable
+  `scope:`, a Sluggable/friendly_id scope column (an association's foreign key and multi-column scopes
+  included) or a Sortable (acts_as_list) `scope:`; declaring one raises `ArgumentError` from either order.
+  Scoped queries compared ciphertext and matched no row. Scope by an unencrypted column instead. (#189)
+- **CursorPaginatable**: a numeric cursor boundary the column cannot hold (beyond its precision or range, finer
+  than its scale, non-numeric or not valid UTF-8, over 100 characters, or with an exponent beyond +-1000) is an
+  `InvalidCursor`, which renders the documented 400. Before, it silently ended the walk with an empty 200. (#182)
+- **Expirable**: expiring never pushes an existing expiry later. `expire_all(time)` writes only rows whose expiry
+  is unset or later than `time`, and the count is the rows actually written. `expire!(time)` on a record whose
+  saved expiry is already at or before `time` returns `true`, writes nothing and fires no hook. To set a later
+  expiry, use `expire_in!` or `extend_expiry!`. (#141)
+- **Filterable**: `type: :datetime` reads a zone-less operand exactly as the target column would: in `Time.zone`
+  on a zone-aware column, in `ActiveRecord.default_timezone` otherwise. A `with:` lambda under `type: :datetime`
+  receives the value in `Time.zone` while `time_zone_aware_attributes` is on, else in `default_timezone`.
+  `type: :date` / `:time` use ActiveRecord's own types. Results used to depend on the server's `ENV["TZ"]`. (#170)
+- **Monetizable**: raises `ArgumentError` when `separator:` equals `delimiter:` or is empty while `precision:` is
+  above 0, at the macro and for per-call `formatted_` overrides. `formatted_price` used to print `"EUR1,234,56"`,
+  which the writer read back as `nil`. This includes `precision: 0` fields whose marks are equal (IDR / VND /
+  CLP with `delimiter: "."`); pass `separator: ","`. (#158)
+- **Monetizable**: with `precision:` omitted it follows a power-of-ten `subunit_to_unit:`, with at least 2
+  decimals: 3 for `1000` (KWD, BHD, OMR, TND, JOD), 4 for `10_000`, so `formatted_price` round-trips. Output for
+  `100`, `10`, `1` and non-power-of-ten subunits is unchanged, an explicit `precision:` is used as given, and a
+  per-call `subunit_to_unit:` override gets its own default. (#180)
+- **Publishable / Activatable**: `publish!` on a published record, `activate!` on an active one and
+  `deactivate!` on an inactive one are no-ops: they return `true`, stamp nothing and fire no hook. "Already"
+  means the saved state of a stored record with no unsaved change to the column; a no-op that finds other
+  pending changes saves them. `publish_at!` still re-stamps, `deactivate!` still writes `false` over `NULL`, and
+  `toggle_active!` is unchanged. (#146)
+- **Sanitizable** `on: :write` no longer re-runs the writer on a persisted record's field that the save does
+  not change, so a non-idempotent `Proc` writer no longer compounds on every save. An unrelated save no longer
+  "repairs" a row written around the callbacks; `sanitize_all!` remains the repair tool. (#148)
+- **Searchable**: `ranked:` search on a `DISTINCT` relation is returned unranked, like a grouped relation,
+  instead of ordering by a rank expression outside the SELECT list (rejected by PostgreSQL and MySQL 5.7.5+).
+  The relation's own ORDER BY is kept. (#135)
+- **Sluggable**: clearing the slug source (`nil`, a blank string, or a value that normalizes to nothing such as
+  `"!!!"`) keeps the existing slug instead of replacing it with friendly_id's uuid fallback. The fallback still
+  applies to a record with no slug yet. (#151)
+- **SoftDeletable**: `destroy_all` is a contextual soft delete on a relation and on an association too, as
+  documented (`Model.where(...).destroy_all`, `Model.destroy_by(...)`, `in_batches.destroy_all`,
+  `post.comments.destroy_all`). The scoped forms used to reach ActiveRecord's own `destroy_all` and hard-delete.
+  A live record is soft-deleted through `soft_delete!` (hooks and `cascade:` run; `RecordNotSaved` and rollback
+  on failure). A record already soft-deleted is purged only when reached through that model's own trash scopes
+  (`only_deleted` / `soft_deleted` / `with_deleted` / `deleted_within`), fixed at call start; any other
+  relation leaves the trash alone. A purge also purges the record's trashed `cascade:` children, of any stamp,
+  ignoring the association's limit. A vetoed child skips its parent on a relation but raises on an association
+  (`RecordNotDestroyed`). A restored row is re-checked before its purge. Rails' `has_many :through`
+  maintenance stays a hard delete, as do `dependent: :destroy`, `assoc.destroy(c)`, `replace` and nested
+  `_destroy`; instance `destroy` is unchanged. The relation and association forms return the records acted on
+  (the class form still returns the count). The `relation_destroy_all: :hard` option restores the old behaviour.
+  See **Upgrading**. (#169)
+- **Sortable** (controller): `sortable_by`'s `direction:` is case-insensitive, and any other value (`:dsc`, `nil`)
+  raises `ArgumentError` at class load, as CursorPaginatable does. It used to be silently coerced to `:asc`. (#165)
+
+### Fixed
+- **Addressable**: `normalize_country:` recognizes `"UK"`, `"Great Britain"`, `"United States of America"`, ISO's
+  official short names (`"Viet Nam"`, `"Russian Federation"`, `"Republic of Korea"`), former names (`"Czech
+  Republic"`) and accent-free spellings; `default_country:` (see Changed) uses the same lookup. (#174, #175)
+- **Addressable**: stamps the `fingerprint:` column in a prepended `validate` callback (after every
+  `before_validation`, ahead of the app's own validations) as well as in `before_save`, so a uniqueness
+  validation on the column no longer accepts duplicates or judges an update against the old address. (#173)
+- **Addressable**: `same_address_as?` accepts a digest String as well as a record, matching `with_address`. (#181)
+- **Auditable** (with **Encryptable**): changes are captured at the write boundary, after every `before_*`
+  callback, so the trail records the values actually written; a field set or rewritten by a later callback is no
+  longer missing or stale, and a change a callback reverted no longer leaves a phantom entry. An audited
+  blind-index column records the refreshed digest. (#172)
+- **Batch verbs** (`expire_all`, `activate_all`, `deactivate_all`, `unpublish_all`, SoftDeletable's): select their
+  rows by their own predicates, so a sibling concern owning the public `.active` or `.published` name can no
+  longer make `expire_all` overwrite long-expired rows and skip live ones. (#184)
+- **Batch verbs** (Publishable / Expirable / Activatable): take their per-record path on a model with a
+  CounterCacheable rule using `if:`, or Auditable tracking a column the verb writes; the single-`UPDATE` fast
+  path used to leave the counter and the audit trail behind. Plain models keep the single `UPDATE`. (#154)
+- **Cacheable**: `stale_resource?` on an Array (or other non-relation collection) no longer answers 500 on Rails
+  7.0+ when a member has no `updated_at` or a nil one. Only an `ActiveRecord::Relation` takes the SQL-aggregate
+  branch; other collections use their newest non-nil member timestamp (none: ETag only). (#132)
+- **CounterCacheable**: a parent with optimistic locking whose counted child hangs off a `has_one ...,
+  dependent: :destroy` can be destroyed again; the child's decrement no longer bumps the parent's
+  `lock_version`. A has_one replacement still gets its count. (#149)
+- **CursorPaginatable**: a cursor whose String boundary is not valid UTF-8, or carries a NUL byte, is the
+  documented `InvalidCursor` 400 instead of a 500. MySQL adapters, which store a NUL, still accept it. (#144)
+- **CursorPaginatable**: paginates tables with a binary primary key or a binary ordering column; a binary
+  boundary travels in the cursor as strict Base64 (invalid Base64 is an `InvalidCursor` 400). `JSON.generate`
+  used to raise on every page with a next page. (#162)
+- **CursorPaginatable**: a `time` ordering column with fractional seconds no longer loops forever on Rails
+  6.0/6.1. A `time` boundary is now its stored time of day (`"10:30:15.500000"`, in `default_timezone`); cursors
+  minted in the old form still decode on Rails 7.0+. (#183)
+- **Duplicable**: `duplicate!` re-reads `lock_version` with the counter columns, for the copy and every nested
+  Duplicable copy, so the returned copy of an optimistically locked record saves again. (#143)
+- **Duplicable**: a top-level copy of a Sortable (acts_as_list) record takes a fresh list position, placed per
+  `add_new_at:`, instead of the original's. A deep-copied child keeps its position only when its list is scoped
+  by the copied association's foreign key; a child in a shared list is blanked and appended. `use_acts_as_list:
+  false` keeps the copied position. (#166)
+- **Encryptable / Anonymizable / Stateable / Activatable**: composite primary keys (Rails 7.1+) work in
+  `reencrypt!` / `reencrypt_all!`, in `anonymize!` under optimistic locking, and in the row lock behind Stateable
+  `lock: true` and Activatable `toggle_active!`. (#138)
+- **Encryptable**: `<field>_ciphertext`, `<field>_encrypted?`, `<field>_key_id` and `reencrypt!` read the envelope
+  the record loaded or wrote, also after an assignment that leaves the value unchanged. (#150)
+- **Encryptable**: an in-place edit of a decrypted String (`<<`, `gsub!`, `squish!`) is a change and is saved;
+  dirty checks decrypt the stored value to compare plaintext, so an unchanged re-save is still not re-encrypted. (#156)
+- **Encryptable**: the blind index is refreshed at the write boundary, after every `before_save` /
+  `before_create` / `before_update` callback, so it is the digest of the value actually stored and `find_by_<field>`
+  no longer misses a row whose field a later callback rewrote. (#172)
+- **ErrorHandleable**: a malformed query string (bad %-escape, invalid UTF-8) renders the documented 400
+  `bad_request` envelope (or problem document) instead of Rails' HTML 400 page. A private `process_action` hands
+  that one exception to the handler chain. (#155)
+- **ErrorHandleable**: `handled_error.concerns_on_rails` and `on_handled_error` report the exception the handler
+  was matched on (the wrapper's `#cause`), not the wrapper's class. (#193)
+- **Expirable / Schedulable / Publishable**: on a `date` column the instance predicates (`current?`,
+  `upcoming?`, `expired?`, `active_at?`, `overlaps?`, `active?`, `published?`, `scheduled?`) agree with their
+  scopes outside UTC, comparing against the date in `Time.zone`. Datetime columns are untouched. (#140)
+- **Filterable**: compares an `enum` column by label (`?status_gte=review` is `status >= 1`); on an integer-backed
+  enum any other operand is read as a number. Every label comparison used to come back empty, and a numeric
+  operand raised `ArgumentError` on Rails 6.0/6.1. An unknown label matches nothing. (#163)
+- **Filterable**: an unknown `enum` label in equality or `in` (`?status=drfat`) matches nothing instead of the
+  rows with no status (Rails 7.0+ emitted `IS NULL`). An explicit `nil` member keeps its `IS NULL` meaning. (#168)
+- **Filterable**: an operand containing a NUL byte matches nothing instead of a `StatementInvalid` 500 (SQLite,
+  PostgreSQL). Binary columns are exempt. (#152)
+- **Filterable / Sortable** (controller): `filtered` and `sorted` accept a bare model class (`filtered(Article)`),
+  as Paginatable and CursorPaginatable already did; a class used to raise `NoMethodError`. (#164)
+- **Localizable**: the `Accept-Language` lookup truncates each tag one subtag at a time (RFC 4647 section 3.4), so
+  `zh-Hant-TW` matches an available `zh-Hant` before `zh`, and `sr-Latn-RS` matches `:sr_Latn` before `:sr`. (#167)
+- **Maskable / Sanitizable**: `masked_attributes` / `sanitized_attributes` skip a declared field that a partial
+  `select` did not load instead of raising `ActiveModel::MissingAttributeError`. (#178)
+- **Monetizable**: no longer reads a leading `0` digit group as grouped thousands: `"0,500"` in a default
+  `","` field is `nil` rather than 500.00, and `"0.500"` reads as 0.5 in a `delimiter: "."` field. Formatted
+  output still round-trips. (#179)
+- **Normalizable / Sanitizable / Taggable / Addressable**: a rule no longer runs twice when `valid?` precedes
+  `save` (a non-idempotent Proc runs once per save, also when Normalizable and a Sanitizable `on: :write` rule share
+  a column), and `reload` forgets the earlier validation. The `before_save` backstops (saves that skip validation)
+  run in the same order as the `before_validation` passes through one shared prepended dispatcher, so two
+  transforms on one column store the same value on every save path. (#176)
+- **Normalizable**: `:url` canonicalizes a protocol-relative `//HOST/path` to `https://host/path`; a host-less
+  `/path` comes back stripped rather than as `https:///path`. (#177)
+- **Paginatable**: counts a relation whose select list is written with DISTINCT (`select("DISTINCT category")`,
+  `DISTINCT ON (...)`) as its distinct rows, fixing `X-Total-Count` / `X-Total-Pages` and `Link rel="last"`. (#161)
+- **Publishable**: `unpublish!` and `unpublish_all` write `false` into a boolean publish column instead of
+  `NULL`, which raised `NotNullViolation` on `null: false` columns. Timestamp columns are still cleared. (#139)
+- **Respondable**: a `Vary` passed in `render_success` / `render_created`'s `headers:` is appended to the existing
+  `Vary` (de-duplicated case-insensitively, `Vary: *` left alone) instead of replacing it, which dropped
+  Localizable's `Accept-Language` and Timezoneable's `Time-Zone`. A caller's `Vary: *` still replaces. (#160)
+- **Sanitizable**: no longer raises `NameError: uninitialized constant Rails::HTML4` on rails-html-sanitizer
+  older than 1.6. The sanitizer namespace is feature-detected: HTML5 when available, else HTML4, else the gem's
+  `Rails::Html` sanitizers. (#133)
+- **SecureHeadable**: `content_security_policy_for(report_only: false)` enforces over a parent controller's or
+  `config.content_security_policy_report_only`'s report-only flag. `report_only:` is now `true` / `false` /
+  `:inherit`; the default `:inherit` leaves the inherited flag as before, and anything else raises
+  `ArgumentError`. (#137)
+- **Sequenceable / Duplicable**: a duplicated record is numbered in its own `reset:` period (the copy used to
+  inherit the original's memoized "now"); Duplicable blanks a custom `period_column:`. (#191)
+- **Sequenceable / Tokenizable / Hashable / Sortable**: a number, token, code or list position generated on create
+  no longer survives a failed INSERT; a create that rolls back puts the generated columns back, so
+  `UniqueRetry.with_retries { record.save! }` draws a fresh value. Values you supplied are kept. (#190)
+- **Sluggable**: an explicitly assigned blank slug (`""` or `nil`) is built from the source in the same save
+  instead of stored as is; a non-blank assigned slug still wins. (#131)
+- **Sluggable**: `scope: [:account_id, :locale]` (friendly_id's multi-column scope) no longer raises
+  `NoMethodError` at class load; every scope column is validated and slugs are unique per combination. (#157)
+- **SoftDeletable**: `really_delete!` marks the instance destroyed (`destroyed?` true, `persisted?` false)
+  before freezing it. (#134)
+- **SoftDeletable / Publishable**: merging a soft-deletable model's relation into another model's no longer strips
+  the OUTER model's own `deleted_at IS NULL`. The default scope records no `unscope`, and the named scopes unscope
+  the column on their own table only (Rails 6.1+; on 6.0 a merged named scope still leaks). (#186)
+- **Stateable**: `transition_all` on a `lock: true` model checks each guard under its row lock, so a row another
+  process moved is skipped instead of aborting the whole batch with `InvalidTransition`. (#147)
+- **Stateable**: a base-class `transition_all` on an STI table judges each record by its own class's declaration:
+  subclass rows without the event are skipped (no `NoMethodError`) and rows a subclass's wider `from:` accepts
+  are transitioned. New public reader `stateable_transition_config(event)`. (#153)
+- **Storable**: a key that declares `type:` reads its `default:` back cast through that type (`default: "false"`
+  on a `:boolean` key used to read the truthy String). An uncastable default reads `nil`; `:json` defaults and
+  untyped keys return the default as written. (#130)
+- **Timezoneable**: `Time.zone` is restored after every action, also when the resolved zone is already the
+  current one; a `Time.zone = ...` made in the action no longer leaks to the next request. (#192)
+- **Tokenizable**: `authenticate_by_<field>` / `consume_<field>` answer `nil` for a value that is not a String or
+  Integer (a Hash from `?token[a]=b`, an Array) instead of raising `TypeError`. (#142)
+
+### Internal
+- Dev lock: permittable bumped to 0.11. (#159)
+- New `Support::TransformBackstop`: one shared prepended `before_save` dispatcher for Normalizable, Sanitizable,
+  Taggable and Addressable. (#176)
+- New `Support::ScalarParam.nul_free?` (NUL-byte operand check used by Filterable). (#152)
+
 ## 1.32.1 (2026-10-08)
 
 A bug-fix release from a six-angle audit of 1.32.0 — data and encryption, state and counters,