i18n_proofreading 0.10.5 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92f93f3b80d87b86e0ec3b0ce33dc7c89cdd5ba9c2e7fc8b40bcb26b92a1a224
-  data.tar.gz: f994d6b60277c364a23eb299e344ab0af2f1fcdaa567966d07bd97352ac7f2fe
+  metadata.gz: 3b4d3167c04697942a2b695b1f4b81554a4f12daabc6a8d730b0d4374bb31292
+  data.tar.gz: 95f184235ea7319ebdd254592924c25f8503ac0fee7943282cd939478d037a54
 SHA512:
-  metadata.gz: d99a83e338ef612aa9a519eb115cb55f55a35978c514171070848e4dca9ea470dbb9055d29f04e5b950107611181a8719d8eff9d976272d7f4c67f8694186ff3
-  data.tar.gz: 3a296e3305dcce5f55b22d01843f5a885a34d805f30f4dcfa794a08138948f06125a438d550c03e142409d1a3e60e6ebf32259dd470f930b42c945b0e892340b
+  metadata.gz: 564ff0282d7ba45a0ef399c82ff6b287dfe54108512aa91356769a6e652fa66875bb3a04c195aed57bce3507eabf50a0d7505ec386ebbe34ed0186e7c8ff065f
+  data.tar.gz: de5b07512272838e8f15483978cb536d0f4ae55e33fe6c5f17d1d3d7b4b5430badf6bfc54c96a01f37802976565afc287c78f5ccc3d40924e41f7e54137fae7e

data/AGENTS.md

@@ -0,0 +1,149 @@
+# AGENTS.md
+
+Instructions for coding agents. Two audiences:
+
+- **[Installing i18n_proofreading into a Rails app](#installing-into-a-rails-app)** — you are working in a host app and were asked to add in-context translation review or a way for someone to suggest better wording.
+- **[Working on the gem itself](#working-on-the-gem-itself)** — you are working in this repository.
+
+Requirements: Ruby >= 3.2, Rails >= 7.1. The widget needs the CSRF token from `csrf_meta_tags`, which a standard Rails layout already has.
+
+**Read this first: the gem never writes to your locale files, and it is not a production tool.** Both are deliberate, and both are covered below.
+
+If you are in a host app and this file is not in front of you, it ships inside the gem: `cat "$(bundle show i18n_proofreading)/AGENTS.md"`.
+
+---
+
+## Installing into a Rails app
+
+### 1. Install
+
+```bash
+bundle add i18n_proofreading
+bin/rails generate i18n_proofreading:install
+bin/rails db:migrate
+```
+
+The generator writes `config/initializers/i18n_proofreading.rb`, one migration (`i18n_proofreading_suggestions`), and mounts the engine. Read the initializer it wrote — every option is documented there in comments, and it is the source of truth over any summary of it, including this file.
+
+### 2. There is no step 2 — do not edit the layout
+
+The widget injects itself into HTML responses through a Rack middleware, so **no layout change is needed**. Boot the app in development and look for the **"Suggest edits"** pill bottom-left. Click it, then click any text; `Esc` exits.
+
+Only if the host prefers to place it explicitly:
+
+```ruby
+config.auto_inject = false
+```
+
+```erb
+<%= i18n_proofreading_tag %>
+```
+
+Do not do both. And do not go looking for a missing `<%= … %>` when the pill does not appear — auto-injection is the default, so the cause is almost always the environment gate below.
+
+### 3. Before deploying: understand the two gates
+
+**a. Environments.** The tool is active only in `config.enabled_environments`, which defaults to `%w[development staging]`. In every other environment it does nothing at all: no key markers, no endpoint, and the I18n backend patch that marks keys is never even prepended. **Do not add `production` to that list to "let the client review the live site."** Marking every translated string in production is a user-visible change to every page, and the review endpoint is not built to be public.
+
+**b. The dashboard.** `/i18n_proofreading` defaults to **development only** and is independent of the widget gates, so a maintainer can triage from production while the widget stays off. It fails closed:
+
+```ruby
+config.authorize_admin = ->(request) { request.env["warden"]&.user&.admin? }
+```
+
+> **`enabled`, `authorize_admin` and `current_user` receive the raw `request`, not a controller.** Writing `->(request) { current_user }` is the most common mistake here — that method does not exist in this scope. Resolve the user *from the request*: Warden env, a signed cookie, `Current.user` if middleware already set it. `author_label` is the exception: it receives whatever `current_user` returned.
+
+### 4. Verify
+
+```bash
+bin/rails routes | grep i18n_proofreading    # engine mounted
+bin/rails i18n_proofreading:seed_demo        # optional sample suggestions, idempotent
+```
+
+Then in development: load a page, confirm the pill appears bottom-left, suggest a change to any string, and read it back at `/i18n_proofreading`.
+
+### The gem does not apply suggestions, and that is the point
+
+A suggestion is a row: the i18n key, the old value, the proposal, an optional comment, a locale, and a status (`pending` / `applied` / `rejected`). Nothing in the gem edits `config/locales/*.yml`, and **the dashboard is read-only — `index` and `show`, with no update or destroy action.** Applying a wording change means a human (or your own tooling) editing the YAML and committing it.
+
+So: **do not ask this gem to rewrite locale files, and do not build a "click to apply" button expecting an endpoint to exist.** If the app wants status bookkeeping, do it deliberately from your own code or the console — the enum is prefixed:
+
+```ruby
+I18nProofreading::Suggestion.status_pending.find(id).status_applied!
+```
+
+If you are asked to automate applying suggestions, that is host-app work: read the rows, write the YAML, review the diff in a pull request. Treat the suggestion table as an inbox, not as the source of truth for translations.
+
+### Turning suggest mode on from your own UI
+
+The pill is one way; a link is another, and the choice is remembered in a cookie so the rest of the app stays in suggest mode:
+
+```
+?i18n_proofreading=true    # on
+?i18n_proofreading=false   # off
+```
+
+`config.show_pill = false` hides the pill, `config.pill_label` overrides its text (nil = the localized `i18n_proofreading.pill` key), and `config.toggle_param` renames the parameter.
+
+### Do not
+
+- **Do not add `production` to `enabled_environments`** (see above).
+- **Do not copy the widget JavaScript into `app/javascript`, or add a `<script>` tag for it.** The middleware injects what is needed and the engine serves the code same-origin — which is what lets it run under a nonce-based CSP, including `strict-dynamic`, across Turbo body swaps.
+- **Do not edit the layout** for the default install — auto-injection is the default.
+- **Do not expect the gem to write YAML** (see above).
+- **Do not set config outside the initializer.** `rate_limit` in particular is read once when the controller class loads; assigning config per-request mutates it process-wide.
+
+### Configuration worth knowing
+
+Everything is optional; a fresh install works with zero config in development. Full list with comments is in the generated initializer.
+
+| Option | Default | Note |
+| --- | --- | --- |
+| `enabled_environments` | `%w[development staging]` | The hard gate. Never add production |
+| `enabled` | everyone | Per-request gate on top of the environment check |
+| `authorize_admin` | development only | **Who can read the dashboard.** Independent of the above |
+| `admin_layout` | `i18n_proofreading/application` | Render the dashboard in your admin shell |
+| `current_user` | `nil` | Receives the request |
+| `author_label` | email, else `to_s` | Receives the user |
+| `available_locales` | `I18n.available_locales` | Callable; validates what a suggestion may target |
+| `auto_inject` | `true` | `false` = place `i18n_proofreading_tag` yourself |
+| `show_pill`, `pill_label` | `true`, localized | Hide the pill and use `?i18n_proofreading=true` instead |
+| `toggle_param` | `"i18n_proofreading"` | Rename the query parameter |
+| `rate_limit` | `{ to: 30, within: 60 }` | Rails 7.2+; ignored on 7.1. `nil` disables |
+| `mount_path` | `"/i18n_proofreading"` | Keep in sync with the `mount` line |
+| `on_submit` | no-op | Runs inline after save — Slack, email, a ticket |
+
+The tool's own UI ships in 26 languages, RTL mirrored, and follows system light/dark.
+
+### Common failure modes
+
+| Symptom | Cause |
+| --- | --- |
+| No pill, no outlines | The environment is not in `enabled_environments` (this is the usual one), or `config.enabled` returned false, or `show_pill = false` |
+| Pill appears but no strings are outlined | The I18n backend patch is only prepended in an enabled environment at boot — check you are actually in development/staging, and restart after changing the setting |
+| `/i18n_proofreading` returns a 403 | `authorize_admin` still at its development-only default |
+| Suggestions rejected with an invalid-token error | The layout is missing `csrf_meta_tags` |
+| A suggestion is rejected as an invalid locale | It must be in `config.available_locales` |
+| Nothing changes in the app after a suggestion is accepted | Expected. The gem never writes locale files — a human edits the YAML |
+| `undefined local variable current_user` in the initializer | A gate lambda treated its argument as a controller. It is a `request` |
+
+---
+
+## Working on the gem itself
+
+```bash
+bundle exec rake test            # minitest, dummy app under test/dummy
+bundle exec rubocop              # must be clean
+BUNDLE_GEMFILE=gemfiles/rails_7.1.gemfile bundle exec rake test   # 7.1, 7.2, 8.0, 8.1 in gemfiles/
+```
+
+Layout: `app/` controller, `Suggestion`, dashboard views · `lib/i18n_proofreading/` config, middleware, the I18n marking backend, widget JS, seeds, engine · `lib/generators/i18n_proofreading/install/` the one generator · `config/locales/` 26 locales · `test/` minitest with `test/dummy` as the host app.
+
+Conventions this codebase holds to — follow them rather than the first thing that works:
+
+- **Production carries none of it.** The marking backend is prepended in `after_initialize` only when `environment_enabled?`, so a production boot never even patches I18n. Anything new must keep that property: no markers, no endpoint, no patch outside the enabled environments.
+- **The tool never writes to the host's locale files.** That is why there is deliberately no update or destroy route, and why the dashboard is read-only. Do not add an "apply" action that edits YAML.
+- **The widget is injected by middleware and served same-origin**, which is what keeps it working under a nonce-based CSP with `strict-dynamic` across Turbo body swaps. Do not inline it.
+- **Key marking must degrade to plain strings.** A host that reads translations outside a request, or in an environment where the tool is off, has to get ordinary values back.
+- Every user-facing change bumps `lib/i18n_proofreading/version.rb` and adds a `CHANGELOG.md` entry (Keep a Changelog format) that says what it costs, not only what it adds.
+- Commit messages are prose that explains the tradeoff — read `git log` before writing one.

data/CHANGELOG.md

@@ -1,7 +1,47 @@
 # Changelog
 
+## 0.11.0
+
+- **`config.admin_layout` now works on its own.** The dashboard's stylesheet was
+  declared in the gem's layout, so replacing that layout dropped it and the
+  dashboard rendered unstyled. It moves into the views, so every layout gets it
+  with nothing asked of the host.
+- **The dashboard stylesheet no longer claims selectors it does not own.** It
+  styled bare `*`, `body` and `a`, and its `.container`, `.card` and `.tabs` are
+  names other frameworks use too. Component rules now nest inside an
+  `.ip-dashboard` wrapper the views render, and every custom property is `--ip-`
+  prefixed — that collision ran both ways, so a host defining `--bg` recoloured
+  the dashboard just as easily.
+- **Added `config.base_controller_class`.** Name the controller your own admin
+  inherits from and the dashboard adopts its layout, helpers, authentication and
+  request context. Default is unchanged.
+- **The widget's endpoints moved to `I18nProofreading::SubmissionsController`.**
+  One controller served both them and the triage dashboard, so
+  `base_controller_class` would have put staff authentication in front of every
+  proofreader. `POST /suggestions` and `GET /suggestions/context` now route
+  there; both URLs are unchanged, and the per-IP rate limiter moved with the
+  action. If you referenced `SuggestionsController#create` or `#context`, that is
+  the breaking change in this release.
+- **Migrations follow the host's `primary_key_type`,** the same
+  `Rails.configuration.generators` lookup Rails' own Active Storage migration
+  does, so a uuid-keyed host gets a uuid table.
+- A `BackboneTest` now fails the build on any of the above regressing.
+
 ## [Unreleased]
 
+## [0.10.6]
+
+- Added `AGENTS.md`: install and integration instructions written for coding
+  agents — that no layout change is needed because the widget is injected by
+  middleware, that the environment gate (never production) is the usual reason
+  the pill is missing, the request-shaped config lambdas, and above all that the
+  gem never writes to locale files, so there is no "apply" endpoint to build
+  against. It ships inside the gem, so
+  `cat "$(bundle show i18n_proofreading)/AGENTS.md"` works from a host app.
+- Corrected the `authorize_admin` comment in the configuration: it described the
+  dashboard as changing status and deleting, but the dashboard has been
+  read-only (`index` and `show` only) for as long as that route file has said so.
+
 ## [0.10.5]
 
 - Added `config.admin_layout`, letting host apps render the proofreading

data/README.md

@@ -26,6 +26,16 @@ bin/rails generate i18n_proofreading:install
 bin/rails db:migrate
 ```
 
+Optional demo data:
+
+```bash
+bin/rails i18n_proofreading:seed_demo
+```
+
+It creates three idempotent sample suggestions across pending, applied, and
+rejected states. Running the task again refreshes those records instead of
+duplicating them.
+
 Boot the app in development and look for the **"Suggest edits"** pill in the
 bottom-left. Click it, then click any text. `Esc` exits.
 
@@ -39,6 +49,12 @@ No layout change needed — the widget injects itself into HTML responses.
 Ruby >= 3.2 · Rails >= 7.1 · CSRF token comes from `csrf_meta_tags`, already in
 a standard Rails layout.
 
+Installing with a coding agent? Point it at [AGENTS.md](AGENTS.md) — the same
+steps in the order an agent needs them, the gates it tends to get wrong, and the
+things it should not do (starting with: this gem never writes your locale files).
+It ships inside the gem, so `cat "$(bundle show i18n_proofreading)/AGENTS.md"`
+works from any app that bundles it.
+
 ## What you get
 
 |                |                                                                     |
@@ -89,6 +105,7 @@ Everything is optional — the defaults work out of the box in development. In
 | `enabled_environments` | `%w[development staging]` | Environments the tool is active in |
 | `enabled` | everyone | Extra per-request gate. `false` hides the tool |
 | `authorize_admin` | development only | **Who can open the review board.** Independent of the gates above |
+| `base_controller_class` | `ActionController::Base` | Controller the dashboard inherits — name your admin's and it adopts its layout, helpers and auth |
 | `current_user` | `nil` | Attribute a suggestion to a user. Receives the request |
 | `author_label` | the user's `email` | Label shown for the author |
 | `available_locales` | `I18n.available_locales` | Which locales a suggestion may target |

data/app/controllers/concerns/i18n_proofreading/request_context.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module I18nProofreading
+  # Who is asking, and the gates that answer it.
+  #
+  # A concern rather than inherited behaviour because the engine has two
+  # controller roots: the public endpoints hang off ActionController::Base, and
+  # the dashboard hangs off whatever the host set as `base_controller_class`.
+  module RequestContext
+    extend ActiveSupport::Concern
+
+    private
+
+    def i18n_proofreading_admin_layout
+      I18nProofreading.config.admin_layout
+    end
+
+    # Gate for the widget's public API (submit a suggestion, read prior context).
+    # The client can set the cookie, but it can never reach the endpoints unless
+    # the app itself says the tool is available for this request.
+    def require_available
+      head :forbidden unless I18nProofreading.available?(request)
+    end
+
+    # Gate for the triage dashboard. Independent of #require_available (see
+    # I18nProofreading.admin?). Renders a plain 403 with a hint rather than a bare
+    # head, since a human is usually looking at it.
+    def require_admin
+      return if I18nProofreading.admin?(request)
+
+      render plain: 'Forbidden. Set I18nProofreading.config.authorize_admin to grant access.',
+             status: :forbidden
+    end
+
+    def current_author
+      return @current_author if defined?(@current_author)
+
+      @current_author = I18nProofreading.config.current_user.call(request)
+    end
+  end
+end

data/app/controllers/i18n_proofreading/application_controller.rb

@@ -1,36 +1,16 @@
 # frozen_string_literal: true
 
 module I18nProofreading
+  # Root of the engine's PUBLIC surface: widget.js, the context lookup and the
+  # suggestion endpoint. These stay on a plain ActionController::Base
+  # deliberately — a proofreader suggesting a translation must not be routed
+  # through a host's admin controller, which would demand a staff session.
+  #
+  # The dashboard's root is DashboardController, and that is where
+  # `config.base_controller_class` applies.
   class ApplicationController < ActionController::Base
-    protect_from_forgery with: :exception
-
-    private
-
-    def i18n_proofreading_admin_layout
-      I18nProofreading.config.admin_layout
-    end
-
-    # Gate for the widget's public API (submit a suggestion, read prior context).
-    # The client can set the cookie, but it can never reach the endpoints unless
-    # the app itself says the tool is available for this request.
-    def require_available
-      head :forbidden unless I18nProofreading.available?(request)
-    end
+    include RequestContext
 
-    # Gate for the triage dashboard. Independent of #require_available (see
-    # I18nProofreading.admin?). Renders a plain 403 with a hint rather than a bare
-    # head, since a human is usually looking at it.
-    def require_admin
-      return if I18nProofreading.admin?(request)
-
-      render plain: 'Forbidden. Set I18nProofreading.config.authorize_admin to grant access.',
-             status: :forbidden
-    end
-
-    def current_author
-      return @current_author if defined?(@current_author)
-
-      @current_author = I18nProofreading.config.current_user.call(request)
-    end
+    protect_from_forgery with: :exception
   end
 end

data/app/controllers/i18n_proofreading/dashboard_controller.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module I18nProofreading
+  # Root of the STAFF surface: the suggestion triage dashboard.
+  #
+  # Inherits from `config.base_controller_class` — by default a plain
+  # ActionController::Base, which is why `authorize_admin` exists. Point it at
+  # the controller your own admin already inherits from and the dashboard picks
+  # up that stack wholesale: your layout, your helpers, your authentication, and
+  # whatever request context your before_actions establish.
+  #
+  # Only the dashboard hangs off it. The widget's endpoints stay on
+  # ApplicationController, so wiring an admin base controller here can never
+  # demand a staff session from someone suggesting a translation.
+  class DashboardController < I18nProofreading.base_controller
+    include RequestContext
+
+    # A host base controller brings its own layout, and declaring one here would
+    # override it. So the gem only claims the layout when it owns the decision:
+    # no host base controller, or a host that named an `admin_layout` explicitly.
+    layout :i18n_proofreading_admin_layout unless superclass != ActionController::Base &&
+                                                  I18nProofreading.config.admin_layout == Configuration::DEFAULT_ADMIN_LAYOUT
+
+    before_action :require_admin
+
+    # A host base controller has configured CSRF already; declaring it twice
+    # would run the check twice.
+    protect_from_forgery with: :exception if superclass == ActionController::Base
+  end
+end

data/app/controllers/i18n_proofreading/submissions_controller.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module I18nProofreading
+  # The widget's public API: the context lookup it reads and the suggestion it
+  # posts.
+  #
+  # Public, so it stays on ApplicationController and never inherits a host's
+  # admin base controller — a proofreader must not be asked for a staff session.
+  # The triage actions live in SuggestionsController, which does inherit it.
+  class SubmissionsController < ApplicationController
+    before_action :require_available
+
+    # Throttle the public submission endpoint per IP so one user or bot can't
+    # flood the table. Uses the rate limiter built into Rails 7.2+ (backed by
+    # Rails.cache); a no-op on Rails 7.1. Tune or disable via config.rate_limit —
+    # read once at boot, after the host's initializer.
+    if respond_to?(:rate_limit) && I18nProofreading.config.rate_limit
+      rate_limit(**I18nProofreading.config.rate_limit,
+                 only: :create,
+                 with: lambda {
+                   render json: { errors: ['Too many suggestions. Please slow down and try again.'] },
+                          status: :too_many_requests
+                 })
+    end
+
+    # Pending suggestions for one key/locale, shown as read-only context when the
+    # proofreader reopens the popover for a string someone already flagged.
+    def context
+      suggestions = Suggestion
+                    .where(translation_key: params[:key], locale: params[:locale])
+                    .status_pending
+                    .newest_first
+                    .limit(20)
+
+      render json: suggestions.map { |suggestion| suggestion_json(suggestion) }
+    end
+
+    def create
+      suggestion = Suggestion.new(suggestion_params)
+      attribute_author(suggestion)
+
+      if suggestion.save
+        I18nProofreading.config.on_submit.call(suggestion)
+        head :created
+      else
+        render json: { errors: suggestion.errors.full_messages }, status: :unprocessable_entity
+      end
+    end
+
+    private
+
+    def attribute_author(suggestion)
+      author = current_author
+      return unless author
+
+      suggestion.author_id = author.id.to_s if author.respond_to?(:id)
+      suggestion.author_label = I18nProofreading.config.author_label.call(author)
+    end
+
+    def suggestion_json(suggestion)
+      {
+        proposed_value: suggestion.proposed_value,
+        author_label: suggestion.author_label,
+        created_at: suggestion.created_at.iso8601
+      }
+    end
+
+    def suggestion_params
+      params
+        .require(:suggestion)
+        .permit(:translation_key, :locale, :old_value, :proposed_value, :comment, :page_url)
+    end
+  end
+end

data/app/controllers/i18n_proofreading/suggestions_controller.rb

@@ -1,29 +1,12 @@
 # frozen_string_literal: true
 
 module I18nProofreading
-  class SuggestionsController < ApplicationController
+  class SuggestionsController < DashboardController
     PER_PAGE = 50
 
     # Public widget API is available-gated; the read-only dashboard is admin-gated.
-    before_action :require_available, only: %i[context create]
-    before_action :require_admin, only: %i[index show]
     before_action :set_suggestion, only: :show
 
-    layout :i18n_proofreading_admin_layout, only: %i[index show]
-
-    # Throttle the public submission endpoint per IP so one user or bot can't
-    # flood the table. Uses the rate limiter built into Rails 7.2+ (backed by
-    # Rails.cache); a no-op on Rails 7.1. Tune or disable via config.rate_limit —
-    # read once at boot, after the host's initializer.
-    if respond_to?(:rate_limit) && I18nProofreading.config.rate_limit
-      rate_limit(**I18nProofreading.config.rate_limit,
-                 only: :create,
-                 with: lambda {
-                   render json: { errors: ['Too many suggestions. Please slow down and try again.'] },
-                          status: :too_many_requests
-                 })
-    end
-
     # --- triage dashboard (admin) --------------------------------------------
 
     def index
@@ -46,56 +29,10 @@ module I18nProofreading
 
     # --- widget API (public) -------------------------------------------------
 
-    # Pending suggestions for one key/locale, shown as read-only context when the
-    # proofreader reopens the popover for a string someone already flagged.
-    def context
-      suggestions = Suggestion
-                    .where(translation_key: params[:key], locale: params[:locale])
-                    .status_pending
-                    .newest_first
-                    .limit(20)
-
-      render json: suggestions.map { |suggestion| suggestion_json(suggestion) }
-    end
-
-    def create
-      suggestion = Suggestion.new(suggestion_params)
-      attribute_author(suggestion)
-
-      if suggestion.save
-        I18nProofreading.config.on_submit.call(suggestion)
-        head :created
-      else
-        render json: { errors: suggestion.errors.full_messages }, status: :unprocessable_entity
-      end
-    end
-
     private
 
     def set_suggestion
       @suggestion = Suggestion.find(params[:id])
     end
-
-    def attribute_author(suggestion)
-      author = current_author
-      return unless author
-
-      suggestion.author_id = author.id.to_s if author.respond_to?(:id)
-      suggestion.author_label = I18nProofreading.config.author_label.call(author)
-    end
-
-    def suggestion_json(suggestion)
-      {
-        proposed_value: suggestion.proposed_value,
-        author_label: suggestion.author_label,
-        created_at: suggestion.created_at.iso8601
-      }
-    end
-
-    def suggestion_params
-      params
-        .require(:suggestion)
-        .permit(:translation_key, :locale, :old_value, :proposed_value, :comment, :page_url)
-    end
   end
 end

data/app/views/i18n_proofreading/shared/_dashboard.html.erb

@@ -0,0 +1,13 @@
+<%# The dashboard's own shell, rendered by the views rather than the layout.
+    That is deliberate: `config.admin_layout` and `config.base_controller_class`
+    both let a host replace the layout, and a stylesheet declared in a layout the
+    host replaces simply vanishes — the dashboard then renders unstyled.
+    Declaring it here means every layout works, host or gem.
+
+    The `ip-dashboard` wrapper is what scopes dashboard.css (see the comment at
+    the top of that file), so it has to enclose the content, not precede it. %>
+<%= stylesheet_link_tag "#{dashboard_stylesheet_path}?v=#{I18nProofreading::Widget.dashboard_stylesheet_fingerprint}",
+                        'data-turbo-track': 'reload' %>
+<div class="ip-dashboard">
+  <%= yield %>
+</div>