janela 0.4.1 → 0.6.0

data/docs/decisions/029-a-panes-frame-is-identified-by-who-it-is.md

@@ -0,0 +1,112 @@
+---
+Date: 2026-09-18
+Status: Accepted
+Related: ADR 003, ADR 005, ADR 012, ADR 014, ADR 024
+Superseded in part by: ADR 030
+Triggers:
+  - changing how a pane's turbo frame is identified
+  - adding a parameter to a pane URL
+  - a host wanting a control over a pane's own settings
+  - a frame that does not update when it should
+Topics: cross-filtering, panes, urls, host-integration
+---
+
+# ADR 029: A Pane's Frame Is Identified by Who It Is, Not by What It Shows
+
+## Context
+
+Issue #42 found that pointing a pane's turbo frame at a URL differing only
+in `limit`, `granularity` or `as` makes Turbo fetch the response and then
+silently do nothing: no render, no `frame-missing`, no console error, the
+frame left showing the old numbers forever. Measured in a browser, not
+inferred.
+
+The cause is that `Query.turbo_frame_id` builds the id out of the query
+itself, renderer, granularity and limit included, so the response comes
+back wearing a different id from the frame that asked for it. Turbo has
+nothing to reconcile and gives up quietly.
+
+**The project has already solved this once, in the half that does not have
+the bug.** A pane that is a record uses `Pane#turbo_frame_id`, which is
+`janela_pane_#{id}`, and the comment on it says exactly why:
+
+> The DOM id is the row, not the query it runs: two rows in one frame may
+> show the same measure by the same dimension, and a fingerprint of the
+> query would give them the same turbo frame for Turbo to replace.
+
+That is ADR 014's reasoning, and it is right. A record-backed pane can
+change its renderer, its granularity and its limit all day and its frame
+id never moves, because the id says who the pane is rather than what it
+is currently showing.
+
+The helper path has no row to point at, so it fingerprints the query
+instead. The fingerprint is not arbitrary: without it, two `janela_pane`
+calls for the same measure by the same dimension would collide, and one
+would replace the other. So the fingerprint solves a real problem and
+creates this one.
+
+The reason this has not bitten the library itself is worth stating: a
+click changes filters, and filters are deliberately not in the id, so
+every navigation Janela performs keeps the id stable. It is only a host
+reaching for the URL's other documented parameters that falls in, and
+what it gets is stale numbers with no error, which is the worst failure
+this library has (ADR 003).
+
+## Decision
+
+**`janela_pane` accepts an `id:`, and a pane given one is identified by
+it rather than by a fingerprint of its query.**
+
+1. The fingerprint stays the default. It is correct for the common case,
+   a page of unlike panes with no controls over them, and it is what
+   keeps two alike panes apart.
+2. A host that wants to change a pane's settings in place names that
+   frame itself. The id is then stable by construction, because it comes
+   from the host rather than from the query, and Turbo reconciles
+   normally. This is the same move ADR 012 made for a record-backed pane,
+   made available to a pane that is not a record.
+3. The response wears the id the frame asked for rather than one derived
+   again from the query. This needs no new surface at all: Turbo already
+   sends the requesting frame's id in the `Turbo-Frame` header, and
+   turbo-rails exposes it as `turbo_frame_request_id`. So a pane rendered
+   into a frame request answers to the frame that asked, and a pane
+   rendered any other way keeps deriving its own id as it does now. The
+   pane URL does not grow a parameter, which was the first thing this
+   decision reached for and did not need.
+4. The failure is documented rather than left to be discovered. A host
+   that changes a pane's URL without naming its frame gets the silent
+   staleness described above, and the README says so where it describes
+   the pane URL's parameters.
+
+## What this turns down
+
+**Taking renderer, granularity and limit out of the fingerprint.** It
+would fix #42 and reintroduce the collision ADR 014 avoided: the gallery
+renders the same measure by the same dimension as a bar and as a line on
+one page, and those two must not share a frame. The fingerprint is doing
+real work.
+
+**Leaving it to every host to fetch and swap the frame themselves**, which
+is what the demo's gallery does today and what proved the diagnosis. It
+works, and it asks each host to write the same Stimulus controller and to
+know a thing about Turbo's id matching that nothing told them. ADR 001
+says ship the load-bearing 5%: a frame that updates when its URL changes
+is inside that, and a host reimplementing frame reconciliation is not.
+(Superseded in part by ADR 030: a frame does not update when its URL
+changes, because `src` is not a channel a host can speak through. What is
+inside the 5% is a pane that goes where it is asked to, which is the same
+thing said correctly.)
+
+## Consequences
+
+`janela_pane` grows one optional keyword argument, and a host that never
+passes it sees no change at all. The demo's gallery control becomes
+smaller, since the frame can be navigated rather than swapped by hand,
+and that is the check on whether this decision is right: if the control
+does not get simpler, the decision was wrong.
+
+Two alike panes given the same `id` by a host would collide, which the
+fingerprint prevented automatically. That is the cost of letting a host
+name things, it is the same cost a host already carries for every DOM id
+it writes, and the doctor is the place to notice it if it turns out to
+happen.

data/docs/decisions/030-a-panes-src-belongs-to-turbo.md

@@ -0,0 +1,93 @@
+---
+Date: 2026-09-18
+Status: Accepted
+Related: ADR 003, ADR 005, ADR 024, ADR 029
+Supersedes: part of ADR 029
+Triggers:
+  - a host changing what a pane shows from JavaScript
+  - writing to a turbo frame's src from anything but Turbo
+  - adding a data attribute the frame controller reads
+  - anything that would reintroduce reading intent out of the DOM
+Topics: cross-filtering, panes, host-integration, javascript
+---
+
+# ADR 030: A Pane's src Belongs to Turbo, So a Host Talks to the Frame
+
+## Context
+
+ADR 029 gave a host a way to name a pane's frame so it could be
+reconfigured in place, and said that "a frame that updates when its URL
+changes is inside" the load-bearing core. Building it showed that is not
+true, and the reason is a decision this project already made.
+
+#33 established that a frame's `src` does not describe what that frame
+is showing. Turbo writes `src` back onto a frame when a response lands,
+including a late one for a request that has since been superseded. So
+`janela--frame` keeps its own record of what was asked for and reverts
+anything that does not match it:
+
+> The request for what Janela last asked for wins, and any other is
+> reverted. What was asked for is the only honest rule (#33).
+
+That rule is right, and its consequence was not drawn at the time: if
+the controller's own record is the only trustworthy statement of intent,
+then `src` is no longer a channel a host can speak through. A host that
+follows ADR 029, names a pane and writes `frame.src`, has its request
+aborted and the frame put back, with no error and the old numbers still
+on screen. That is the failure #42 was about, reached by following the
+instructions written to fix #42.
+
+There is no way to tell a host's `src` write from Turbo's. Any attempt,
+a mutation observer, a flag, a heuristic on the attribute, re-infers
+intent from the DOM, which is exactly what #33 removed because it
+produced wrong numbers.
+
+And the record is not one attribute. A pane also carries the base URL
+the controller rebuilds from on the next click, so a host writing the
+record by hand has to write two attributes in the right order, and
+reapply the frame's current filters itself. Only the frame controller
+knows those filters. The demo's own gallery control got that wrong:
+reconfigure a pane while a filter is active and it refetches unfiltered
+while every pane beside it stays filtered (#43).
+
+## Decision
+
+**A host changes what a pane shows by asking `janela--frame`, and never
+by writing `src` or a data attribute.**
+
+The controller already does this for itself when the frame's filters
+change. Making that reachable is extraction rather than new surface: one
+way to ask a pane to go to a different query, which records what was
+asked, reapplies the frame's filters and sets `src` in the order the
+guard expects.
+
+Three things follow.
+
+1. **The data attributes are private.** `janelaAsked` and `janelaSrc` are
+   how the controller remembers, not an interface. A host that writes
+   them is relying on something that may change.
+2. **A reconfigured pane stays cross-filtered.** Reapplying the frame's
+   current filters is part of repointing, not something a caller
+   remembers, because forgetting it shows numbers for the wrong filter
+   state and says nothing (ADR 003).
+3. **`id:` is still necessary.** ADR 029 stands: without a stable frame
+   id there is nothing to repoint. It is necessary and it was not
+   sufficient, which is what this records.
+
+## Consequences
+
+ADR 029's claim that a frame updates when its URL changes is untrue as
+written, and this supersedes that sentence rather than the decision. The
+`id:` keyword and answering a frame request with the id Turbo sent are
+both correct and stay.
+
+A host reconfiguring a pane writes one call instead of three writes it
+was never told about, and gets the filter behaviour right by default
+rather than by knowing to. The demo's gallery control is the check, the
+same way it was for ADR 029: it should get smaller again, and its filter
+bug should disappear rather than be fixed separately.
+
+The cost is one public method on a Stimulus controller, which is a
+surface this project did not have before. It earns itself by removing a
+class of silent wrongness rather than by adding capability, which is the
+kind of addition ADR 001 leaves room for.

data/docs/decisions/031-a-subclass-inherits-the-dashboard.md

@@ -0,0 +1,110 @@
+---
+Date: 2026-09-19
+Status: Accepted
+Related: ADR 002, ADR 013, ADR 014, ADR 025, ADR 028
+Triggers:
+  - subclassing a model that declares a janela block
+  - changing what is addressable over HTTP
+  - changing how the registry is populated
+  - adding to the Ransack allowlist a model gets from Janela
+Topics: configuration, urls, security, scope
+---
+
+# ADR 031: A Subclass Inherits the Dashboard Its Parent Declared
+
+## Context
+
+`janela` stores its definition in a plain class instance variable, so a
+subclass of a model that declares one gets `nil` from `.janela` and is
+not in the registry (#11).
+
+Reproducing it found something the issue did not say. The subclass does
+inherit the Ransack allowlist, because
+`define_janela_ransack_allowlist` defines singleton methods on the
+parent and singleton methods inherit down the singleton class chain:
+
+```
+subclass .janela:      nil
+subclass ransackable:  ["status", "channel", "placed_on"]
+```
+
+So a subclass is already half declared: filterable on the parent's
+dimensions, with no definition behind it saying what those dimensions
+are. Neither half was decided. One was written and the other happened.
+
+The instinct is to walk the ancestors in `janela`, which fixes `.janela`
+and does not fix the bug. What a host wants from an STI subclass is a
+dashboard of it, and that needs the subclass registered:
+
+```ruby
+janela_pane PaidOrder, :revenue   # src is /paid_orders/revenue
+```
+
+An inherited definition with no registration renders that pane and then
+404s it. That is worse than today, because today the failure is loud at
+the call site and that one is a dead pane on a page.
+
+So the question is not whether the definition inherits. It is whether
+being a subclass makes a model addressable, and `lib/janela.rb` states
+the current answer plainly:
+
+> Only models that declare a janela block are addressable over HTTP
+
+## Decision
+
+**A subclass inherits its parent's definition and is addressable on its
+own route key. Declaring is what a family of classes does once.**
+
+The argument that settles it is about data rather than URLs. An STI
+subclass is a subset of its parent's rows. If the parent is addressable,
+the subclass reveals no row the parent does not already total, and it is
+read through the same host scope as everything else (ADR 014). So this
+adds URL surface and no data surface, which is a much smaller thing than
+the rule above makes it sound.
+
+Three things follow.
+
+1. **The halves agree.** The definition inherits, the registration
+   inherits, and the Ransack allowlist keeps inheriting as it already
+   does. A subclass is either a Janela model or it is not, rather than
+   being one in the part nobody chose.
+2. **STI scoping is ActiveRecord's, not Janela's.** A definition whose
+   model is the subclass runs its query on that class and ActiveRecord
+   adds the `type` condition itself. Janela learns nothing about STI,
+   which is the right amount for it to know.
+3. **A subclass may still declare its own block**, and then it has its
+   own definition rather than its parent's, which is how a subclass says
+   its dashboard is different.
+
+Registration cannot happen where declaration happens, because the
+subclass does not exist when the parent declares. It happens when the
+subclass is created.
+
+## What this turns down
+
+**Inheriting nothing, and documenting that each subclass declares its
+own.** It is the most conservative reading and it asks a host with five
+STI types to retype the same measures and dimensions five times. ADR 002
+spent Ransack's familiarity on the host deliberately; spending their
+typing on a class hierarchy Rails already models is a worse trade.
+
+**Inheriting the definition without registering.** Rejected above: a
+helper that renders a pane which cannot load.
+
+## Consequences
+
+The honest cost is not security, it is noise. `Janela.definitions` feeds
+the form that offers a choice of model when an analyst adds a pane
+(ADR 012), and a host with a dozen STI types will see a dozen entries
+where it expected one. That is a real cost and it is the thing to watch:
+if it becomes the complaint, the answer is a way for a family to say
+which of its classes are worth offering, and that is a later decision
+rather than a setting invented now.
+
+The check on whether this decision is right is what a host writes. If
+adding a dashboard for an STI subclass still takes anything beyond
+creating the class, the decision did not deliver.
+
+The demo has no STI model, so proving this takes one: a `type` column on
+a table and a subclass in the dummy. That is a fixture, and adding it is
+part of the work rather than a reason to avoid it.

data/docs/decisions/INDEX.md

@@ -27,18 +27,18 @@ them when in doubt: `grep -l "Triggers:.*fork" docs/decisions/*.md`.
 | **Authorisation** | 002, 003, 004, 009, 017, 019, 022 |
 | **Performance & storage** | 007, 017, 025 |
 | **Cross-filtering & Hotwire** | 003, 004, 005, 008, 024, 025 |
-| **Layouts & views** | 011, 012, 016, 018, 020 |
-| **CSS & styling** | 016, 018, 023 |
-| **Frames, panes & persistence** | 012, 013, 014, 019 |
+| **Layouts & views** | 011, 012, 016, 018, 020, 027 |
+| **CSS & styling** | 016, 018, 023, 026, 027 |
+| **Frames, panes & persistence** | 012, 013, 014, 019, 029, 030 |
 | **Naming rule** | 014, 023 |
-| **JavaScript delivery & charts** | 004, 006 |
+| **JavaScript delivery & charts** | 004, 006, 026 |
 | **Time dimensions** | 006, 025 |
 | **Routes, URLs & naming** | 005, 007, 008, 009, 011, 013, 022, 024, 025 |
-| **Snapshots & publishing** | 009, 020 |
+| **Snapshots & publishing** | 009, 020, 028 |
 | **AI agents & guidance** | 010, 015, 021 |
 | **Releases & upgrades** | 015, 021 |
 | **Accessibility & keyboard** | 024 |
-| **Security** | 003, 025 |
+| **Security** | 003, 025, 028, 031 |
 | **Testing** | 003 |
 
 ## Chronological
@@ -70,7 +70,13 @@ them when in doubt: `grep -l "Triggers:.*fork" docs/decisions/*.md`.
 | 023 | Vitral Is a Theme, Not the Stylesheet | 2026-09-16 | Accepted |
 | 024 | Selecting More Than One Value | 2026-09-16 | Accepted |
 | 025 | Janela Bounds What a Filter Can Ask For | 2026-09-17 | Accepted |
+| 026 | A Renderer Is the Seam, and HTML Comes First | 2026-09-18 | Accepted |
+| 027 | The Gallery Is a Host Page, Built from the Gem's Helpers | 2026-09-18 | Accepted |
+| 028 | The Predicate List ADR 025 Named Was Not Quite Right | 2026-09-18 | Accepted |
+| 029 | A Pane's Frame Is Identified by Who It Is, Not by What It Shows | 2026-09-18 | Accepted |
+| 030 | A Pane's src Belongs to Turbo, So a Host Talks to the Frame | 2026-09-18 | Accepted |
+| 031 | A Subclass Inherits the Dashboard Its Parent Declared | 2026-09-19 | Accepted |
 
 ## Next number
 
-Next ADR: 026
+Next ADR: 032

data/lib/janela/definition.rb

@@ -1,11 +1,25 @@
 module Janela
   class Definition
+    # ADR 007's existing ceiling on a limit, reused by ADR 025 as the default
+    # applied when a host asks for none, and as the bound on one filter's values.
+    MAXIMUM = 1000
+
     attr_reader :model, :measures, :dimensions
 
-    def initialize(model)
+    def initialize(model, &block)
       @model = model
       @measures = {}
       @dimensions = {}
+      @block = block
+      instance_eval(&block) if block
+    end
+
+    # The same declaration read against another model, which is how a subclass
+    # inherits a dashboard: its measures and dimensions are its parent's, and
+    # the queries they run are its own, because ActiveRecord adds the type
+    # condition to a relation on the subclass (ADR 031).
+    def for(model)
+      self.class.new(model, &@block)
     end
 
     def measure(name, **aggregate)
@@ -35,7 +49,7 @@ module Janela
         measure.apply(buckets).transform_keys { |bucket| dimension.label(bucket, granularity) }
       else
         grouped = relation.group(dimension.attribute).order(Arel.sql("#{measure.sql_alias} DESC"))
-        grouped = grouped.limit(limit!(limit)) if limit
+        grouped = grouped.limit(limit ? limit!(limit) : MAXIMUM)
         measure.apply(grouped).transform_keys { |value| value.nil? ? Dimension::NONE : value }
       end
     end
@@ -64,7 +78,7 @@ module Janela
 
     def limit!(value)
       limit = Integer(value, exception: false)
-      raise BadRequest, "limit must be a whole number from 1 to 1000, got #{value.inspect}" unless limit&.between?(1, 1000)
+      raise BadRequest, "limit must be a whole number from 1 to #{MAXIMUM}, got #{value.inspect}" unless limit&.between?(1, MAXIMUM)
       limit
     end
 
@@ -82,6 +96,8 @@ module Janela
 
         search = relation.ransack(params)
         reject_dropped_filters!(search, params)
+        reject_disallowed_predicates!(search)
+        reject_oversized_filters!(search)
         search.result
       end
 
@@ -95,5 +111,35 @@ module Janela
         raise BadRequest, "#{model} does not allow filtering on #{dropped.join(', ')}. " \
                      "Declare a janela dimension, or add it to ransackable_attributes."
       end
+
+      # An allowed attribute still reaches every predicate Ransack knows,
+      # including _matches, an arbitrary LIKE pattern (ADR 025). A dashboard
+      # asks in only the predicates its kind of dimension needs.
+      def reject_disallowed_predicates!(search)
+        by_ransack_name = dimensions.values.index_by(&:ransack_name)
+
+        search.conditions.each do |condition|
+          condition.attributes.each do |attribute|
+            dimension = by_ransack_name.fetch(attribute.name)
+            next if dimension.allowed_predicates.include?(condition.predicate_name)
+
+            allowed = dimension.allowed_predicates.map { |predicate| "#{attribute.name}_#{predicate}" }
+            raise BadRequest, "#{model} does not allow #{attribute.name}_#{condition.predicate_name}. " \
+                         "This dimension allows #{allowed.join(', ')}."
+          end
+        end
+      end
+
+      # A click writes _in (ADR 024), which takes an array Ransack does not
+      # otherwise bound. 5001 values answered rather than being refused.
+      def reject_oversized_filters!(search)
+        search.conditions.each do |condition|
+          next unless condition.predicate.wants_array
+          next if condition.values.size <= MAXIMUM
+
+          raise BadRequest, "#{model} does not allow a filter to carry more than #{MAXIMUM} values, " \
+                       "got #{condition.values.size} for #{condition.attributes.map(&:name).join(', ')}."
+        end
+      end
   end
 end

data/lib/janela/dimension.rb

@@ -2,6 +2,14 @@ module Janela
   class Dimension
     GRANULARITIES = %w[hour day week month quarter year].freeze
 
+    # What a click produces (ADR 024), plus not_null: excluding the null
+    # group is documented, tested behaviour ADR 025 did not measure and would
+    # otherwise silently break.
+    CATEGORICAL_PREDICATES = %w[eq in null not_null].freeze
+
+    # A time dimension additionally narrows a range (ADR 006).
+    TIME_PREDICATES = (CATEGORICAL_PREDICATES + %w[gteq gt lteq lt]).freeze
+
     # A group of rows whose dimension is null. Labelled rather than blank, and
     # filtered with Ransack's null predicate rather than an empty string.
     NONE = "(none)".freeze
@@ -41,6 +49,11 @@ module Janela
       !granularity.nil?
     end
 
+    # Which Ransack predicates a filter on this dimension may use (ADR 025).
+    def allowed_predicates
+      time? ? TIME_PREDICATES : CATEGORICAL_PREDICATES
+    end
+
     def attribute
       klass.arel_table[column]
     end

data/lib/janela/doctor.rb

@@ -11,7 +11,7 @@ module Janela
     # silences a check by that name (ADR 021).
     CHECKS = %i[stale_identifiers unmounted_engine unmigrated_tables unregistered_controllers
                 through_dimensions_without_an_allowlist frames_nobody_will_own
-                unauthenticated_endpoints].freeze
+                unauthenticated_endpoints hardcoded_disallowed_predicates].freeze
 
     # Identifiers a previous version of Janela used, and what replaced them.
     RENAMED = {
@@ -153,6 +153,34 @@ module Janela
         end
       end
 
+      # A filter read from a URL param is runtime state the doctor cannot see,
+      # but one written into the host's own Ruby is source like any other
+      # identifier this doctor already greps for (ADR 015, ADR 021, ADR 025).
+      def hardcoded_disallowed_predicates
+        janela_models.flat_map do |model|
+          model.janela.dimensions.values.flat_map { |dimension| disallowed_uses(model, dimension) }
+        end
+      end
+
+      def disallowed_uses(model, dimension)
+        pattern = /\b#{Regexp.escape(dimension.ransack_name)}(_\w+)/
+        source_files.flat_map do |file|
+          content = file.read
+          content.scan(pattern).flatten.uniq.filter_map do |candidate|
+            predicate = Ransack::Predicate.detect_from_string(candidate.dup)
+            next unless predicate
+            next if dimension.allowed_predicates.include?(predicate)
+
+            key = "#{dimension.ransack_name}_#{predicate}"
+            allowed = dimension.allowed_predicates.map { |p| "#{dimension.ransack_name}_#{p}" }
+            Finding.new(severity: :error,
+              summary: "#{model} does not allow #{key}",
+              detail: "  #{file.relative_path_from(@root)} filters #{model} on #{key}, which Janela now " \
+                      "refuses (ADR 025). Allowed here: #{allowed.join(', ')}.")
+          end
+        end
+      end
+
       # A host whose policy filters frames by owner, but which never tells
       # Janela what owns a new one, creates frames its own scope then hides.
       # The failure is silent, and a typo in the method name looks the same as

data/lib/janela/model.rb

@@ -1,25 +1,61 @@
 module Janela
   module Model
+    # Dimensions are the only things Janela filters on, so they are the
+    # Ransack allowlist. This asks for the definition when it is called rather
+    # than closing over one, so a subclass answers with the definition it
+    # reports, whether that is its parent's or one it declared itself. The two
+    # halves cannot then disagree, which is what they did before ADR 031: a
+    # subclass inherited this list and reported no definition behind it.
+    module RansackAllowlist
+      def ransackable_attributes(_auth_object = nil)
+        janela.ransackable_attributes
+      end
+
+      def ransackable_associations(_auth_object = nil)
+        janela.ransackable_associations
+      end
+    end
+
     def janela(&block)
-      return @janela_definition unless block
+      return @janela_definition ||= inherited_janela_definition unless block
 
-      @janela_definition = Definition.new(self)
-      @janela_definition.instance_eval(&block)
+      @janela_definition = Definition.new(self, &block)
       define_janela_ransack_allowlist
       Janela.register(self)
       @janela_definition
     end
 
+    # A subclass cannot be registered where its parent declares, because it
+    # does not exist yet, so it registers as it is created (ADR 031). An
+    # anonymous class has no route key to be addressed by; naming it is the
+    # host's move and declaring on it is the host's other one.
+    def inherited(subclass)
+      super
+      Janela.register_subclass(subclass) if subclass.name && janela
+    end
+
     private
-      # Dimensions are the only things Janela filters on, so they are the
-      # Ransack allowlist. A model that already declares its own allowlist
-      # keeps it.
+      # What a subclass inherits is the declaration, not the definition
+      # object. A definition holds the model it queries, so a subclass handed
+      # its parent's would report the right dashboard and then total the
+      # parent's rows behind it.
+      def inherited_janela_definition
+        superclass.janela&.for(self) if superclass.respond_to?(:janela)
+      end
+
+      # A model that already answers for itself keeps its answer, whether it
+      # said so here or on a class above. Ransack's own default lives on
+      # ActiveRecord::Base, so anything nearer than that was somebody's
+      # decision and is not ours to replace.
       def define_janela_ransack_allowlist
-        return if singleton_class.method_defined?(:ransackable_attributes, false)
+        return if janela_ransack_allowlist_answered?
+
+        extend RansackAllowlist
+      end
 
-        definition = @janela_definition
-        define_singleton_method(:ransackable_attributes) { |_auth_object = nil| definition.ransackable_attributes }
-        define_singleton_method(:ransackable_associations) { |_auth_object = nil| definition.ransackable_associations }
+      def janela_ransack_allowlist_answered?
+        owner = singleton_class.instance_method(:ransackable_attributes).owner
+        !ActiveRecord::Base.singleton_class.ancestors.include?(owner)
       end
   end
 end

data/lib/janela/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Janela
-  VERSION = "0.4.1"
+  VERSION = "0.6.0"
 end

data/lib/janela.rb

@@ -37,9 +37,10 @@ module Janela
   # is for (ADR 021).
   mattr_accessor :silenced_checks, default: []
 
-  # Only models that declare a janela block are addressable over HTTP, keyed by
-  # the route key that appears in pane URLs (orders, sales_orders). Names are
-  # stored rather than classes so a reloaded model leaves nothing stale behind.
+  # A model that declares a janela block is addressable over HTTP, and so is a
+  # subclass of one, keyed by the route key that appears in pane URLs (orders,
+  # sales_orders). Names are stored rather than classes so a reloaded model
+  # leaves nothing stale behind.
   def self.registry
     @registry ||= {}
   end
@@ -48,6 +49,18 @@ module Janela
     registry[model.model_name.route_key] = model.name
   end
 
+  # A subclass registers itself as it is created (ADR 031), so unlike a
+  # declaration it is not a host writing a line of code. It never takes a
+  # route key another class already holds: a host that gives a subclass its
+  # parent's model_name, so the two share a route and a form, would otherwise
+  # find the parent's URL answering with a subset of its rows.
+  def self.register_subclass(model)
+    route_key = model.model_name.route_key
+    return if registry.key?(route_key) && registry[route_key] != model.name
+
+    register(model)
+  end
+
   # Every model that declares a janela block, for a form that offers a choice
   # of them. Eager loading first, because a model nobody has referenced yet has
   # not registered. A name that no longer resolves is left out rather than
@@ -66,4 +79,19 @@ module Janela
 
     class_name.constantize.janela
   end
+
+  # What Janela can draw, so a gallery asks rather than reaching into
+  # Janela::Query::RENDERERS, Janela::Dimension::GRANULARITIES or
+  # Janela::Pane::OFFERED_LIMITS itself (ADR 027, #39).
+  def self.renderers
+    Query::RENDERERS
+  end
+
+  def self.granularities
+    Dimension::GRANULARITIES
+  end
+
+  def self.offered_limits
+    Pane::OFFERED_LIMITS
+  end
 end