monkrb 0.17.0 → 0.19.0

data/lib/monk/scaffold.rb

@@ -10,18 +10,26 @@ module Monk
   class Scaffold
     TEMPLATES_DIR = File.expand_path("templates", __dir__)
 
+    # The role directories under app/, in config/load.rb's load order.
+    APP_ROLES = %w[models presenters helpers mailers broadcasts jobs].freeze
+
     BASE_FILES = {
       "Gemfile" => "base/Gemfile",
       "config.ru" => "base/config.ru",
       "config/settings.rb" => "base/config/settings.rb",
+      "config/load.rb" => "base/config/load.rb",
+      "app/app.rb" => "base/app/app.rb",
       ".ruby-version" => "base/.ruby-version",
       ".gitignore" => "base/.gitignore",
       ".dockerignore" => "base/.dockerignore",
       "Dockerfile" => "base/Dockerfile",
       "bin/server" => "base/bin/server",
       "bin/websocket_server" => "base/bin/websocket_server",
-      "views/layouts/app.erb" => "base/views/layouts/app.erb",
-      "views/index.erb" => "base/views/index.erb",
+      "app/views/layouts/app.erb" => "base/app/views/layouts/app.erb",
+      "app/views/index.erb" => "base/app/views/index.erb",
+      # Every role directory, whatever the flags (docs/adr/0015): the tree
+      # shows where each kind of code goes. Flags add files next to these.
+      **APP_ROLES.to_h { |role| ["app/#{role}/.keep", "base/app/#{role}/.keep"] },
       "public/css/app.css" => "base/public/css/app.css",
       "public/js/app.js" => "base/public/js/app.js",
     }.freeze
@@ -45,9 +53,11 @@ module Monk
       "config/auth.rb" => "auth/config/auth.rb",
       "db/migrate/00000000000001_create_auth_tables.up.sql" => "auth/db/migrate/00000000000001_create_auth_tables.up.sql",
       "db/migrate/00000000000001_create_auth_tables.down.sql" => "auth/db/migrate/00000000000001_create_auth_tables.down.sql",
-      # The magic link's HTML part -- config/auth.rb's AppMailer::DELIVER
-      # renders it and sends through Monk::Mail (MAIL_FILES, implied by --auth).
-      "views/mail/magic_link.erb" => "auth/views/mail/magic_link.erb",
+      # The magic link's sender, Monk::Auth's deliver: hook -- config/auth.rb
+      # requires it -- and the HTML part it renders and sends through
+      # Monk::Mail (MAIL_FILES, implied by --auth).
+      "app/mailers/app_mailer.rb" => "auth/app/mailers/app_mailer.rb",
+      "app/views/mail/magic_link.erb" => "auth/app/views/mail/magic_link.erb",
     }.freeze
 
     # --mail, or implied by --auth: Monk::Mail's config. Its Gemfile line
@@ -56,22 +66,57 @@ module Monk
       "config/mail.rb" => "mail/config/mail.rb",
     }.freeze
 
+    # --jobs: Monk::Jobs. The migration is the canonical one under
+    # templates/jobs/db/migrate -- the same file Monk's own tests apply --
+    # numbered after auth's so the two sort in order when both are present.
+    JOBS_FILES = {
+      "config/jobs.rb" => "jobs/config/jobs.rb",
+      "app/jobs/hello_job.rb" => "jobs/app/jobs/hello_job.rb",
+      "bin/jobs" => "jobs/bin/jobs",
+      "db/migrate/00000000000002_create_jobs_tables.up.sql" => "jobs/db/migrate/00000000000002_create_jobs_tables.up.sql",
+      "db/migrate/00000000000002_create_jobs_tables.down.sql" =>
+        "jobs/db/migrate/00000000000002_create_jobs_tables.down.sql",
+    }.freeze
+
+    # --auth --jobs: the magic link is created and sent inside a job, so the
+    # raw token is never stored (docs/adr/0014).
+    JOBS_AUTH_FILES = {
+      "app/jobs/send_login_link.rb" => "jobs/app/jobs/send_login_link.rb",
+    }.freeze
+
+    # --mail --jobs (or --auth --jobs): Monk::Mail.deliver_later, loaded in
+    # config/jobs.rb right after Monk::Jobs itself.
+    JOBS_REQUIRE_ANCHOR = %(require "monk/jobs"\n).freeze
+    JOBS_MAIL_REQUIRE = %(require "monk/mail/later"\n).freeze
+
+    # --jobs's demo route, added right after this line in app/app.rb (the
+    # base and the --live one both end their routes with it), so the
+    # round trip -- enqueue from a request, run in bin/jobs -- works out of
+    # the box.
+    JOBS_ROUTE_ANCHOR = %(  get("/api/hello") { json(message: "hello from monk") }\n).freeze
+    JOBS_ROUTE = <<~RUBY.gsub(/^(?!$)/, "  ").freeze
+
+      # Enqueues the demo job (app/jobs/hello_job.rb) for bin/jobs to run:
+      #   curl -X POST "http://localhost:9292/jobs/hello?name=Ann"
+      post("/jobs/hello") { json(enqueued: HelloJob.enqueue(params[:name] || "world")) }
+    RUBY
+
     # --live: Monk::Live's demo (a counter whose open tabs update when
     # another request changes it). These replace three base files outright
-    # rather than patching them -- a live config.ru and index are different
-    # files, not one line of diff -- and add two. config.ru's first line stays
-    # the settings require, so --postgres/--auth wiring still finds it.
+    # rather than patching them -- a live app and index are different
+    # files, not one line of diff -- and add two. config.ru stays the base
+    # one: config/load.rb is where --live's config gets wired in.
     LIVE_OVERRIDES = {
-      "config.ru" => "live/config.ru",
+      "app/app.rb" => "live/app/app.rb",
       "bin/websocket_server" => "live/bin/websocket_server",
-      "views/index.erb" => "live/views/index.erb",
+      "app/views/index.erb" => "live/app/views/index.erb",
     }.freeze
 
     # config/live.rb itself isn't here -- #write_live! picks between
     # LIVE_CONFIG_TEMPLATES[@live_transport] instead, since which one gets
     # written depends on --redis vs --postgres, not a fixed mapping.
     LIVE_FILES = {
-      "views/live/_hits.erb" => "live/views/live/_hits.erb",
+      "app/views/live/_hits.erb" => "live/app/views/live/_hits.erb",
     }.freeze
 
     LIVE_CONFIG_TEMPLATES = {
@@ -89,7 +134,7 @@ module Monk
       <script type="module" src="<%= asset_path "/js/monk_live/monk_live.js" %>"></script>
     HTML
 
-    EXECUTABLE_FILES = %w[bin/server bin/websocket_server bin/console bin/setup_db bin/migrate].freeze
+    EXECUTABLE_FILES = %w[bin/server bin/websocket_server bin/console bin/setup_db bin/migrate bin/jobs].freeze
 
     # auth: implies postgres -- Monk::Auth is Postgres-only (lib/monk/auth.rb
     # subclasses Monk::Persistence::Pg::Model), so there's no combination
@@ -119,10 +164,15 @@ module Monk
     #
     # mail: Monk::Mail on its own, no Postgres needed. auth: implies it, the
     # same way it implies postgres: a magic link has to reach someone.
-    def initialize(dir, postgres: false, auth: false, redis: false, live: false, mail: false)
+    #
+    # jobs: implies postgres, since the queue lives there, and nothing else.
+    def initialize(dir, postgres: false, auth: false, redis: false, live: false, mail: false, jobs: false)
       @dir = dir
+      # As passed, before anything is implied -- #summary reports the difference.
+      @requested = { postgres: postgres, auth: auth, mail: mail, jobs: jobs, redis: redis, live: live }
       @auth = auth
-      @postgres = postgres || auth
+      @jobs = jobs
+      @postgres = postgres || auth || jobs
       @mail = mail || auth
       @live = live
 
@@ -144,6 +194,29 @@ module Monk
       end
     end
 
+    # The flags as resolved, for `monk new` to print: which flags were
+    # given, which ones they implied and why, and which combinations change
+    # what gets generated. The rule behind it, stated in `monk --help`: a
+    # flag is implied when there's only one right answer (--auth can only
+    # use Postgres), and required when there's a real choice (--live's
+    # transport).
+    def summary
+      given = FLAG_ORDER.select { |flag| @requested[flag] }
+      return ["Flags: none (the base skeleton)."] if given.empty?
+
+      implied = implied_flags
+      flags = given.map { |flag| "--#{flag}" }.join(" ")
+      lines = implied.empty? ? ["Flags: #{flags}."] : ["Flags: #{flags}, which also turned on:"]
+      implied.each do |flag, sources|
+        lines << "  #{"--#{flag}".ljust(12)}(needed by #{sources.map { |source| "--#{source}" }.join(", ")})"
+      end
+
+      together = combinations
+      lines << "Together they also generate:" unless together.empty?
+      width = together.map { |pair, _| pair.length }.max
+      lines.concat(together.map { |pair, what| "  #{pair.ljust(width)}  #{what}" })
+    end
+
     def write!
       raise Monk::ScaffoldExistsError, "#{@dir} already exists" if File.exist?(@dir)
 
@@ -165,7 +238,14 @@ module Monk
         append_gemfile_extra("mail/Gemfile.extra")
       end
 
-      wire_config_ru! if @postgres || @mail
+      if @jobs
+        JOBS_FILES.each { |relative, template| write_file(relative, template, executable: EXECUTABLE_FILES.include?(relative)) }
+        JOBS_AUTH_FILES.each { |relative, template| write_file(relative, template) } if @auth
+        add_jobs_route!
+        add_deliver_later! if @mail
+      end
+
+      wire_load! if @postgres || @mail || @live
       append_gemfile_extra("redis/Gemfile.extra") if @redis
 
       # --postgres, --redis and --mail are the flags with anything worth
@@ -184,8 +264,42 @@ module Monk
       write_setup_md!
     end
 
+    FLAG_ORDER = %i[postgres auth mail jobs redis live].freeze
+
+    # Only these two imply anything, and only one flag each can need.
+    IMPLIED_BY = { postgres: %i[auth jobs], mail: %i[auth] }.freeze
+
     private
 
+    def implied_flags
+      resolved = { postgres: @postgres, mail: @mail }
+      IMPLIED_BY.filter_map do |flag, sources|
+        next if @requested[flag] || !resolved[flag]
+
+        [flag, sources.select { |source| @requested[source] }]
+      end
+    end
+
+    def combinations
+      pairs = []
+      pairs << ["--auth + --jobs", "app/jobs/send_login_link.rb: login links are sent from a job"] if @auth && @jobs
+      if @mail && @jobs
+        pairs << ["--mail + --jobs",
+                  "config/jobs.rb loads Monk::Mail.deliver_later; JOBS_QUEUES serves mailers first",]
+      end
+      pairs << live_combination if @live
+      pairs
+    end
+
+    def live_combination
+      if @live_transport == :redis
+        both = @postgres ? "; --redis wins over --postgres" : ""
+        ["--live + --redis", "config/live.rb fans out over Redis (Monk::WebSocket::RedisFanout#{both})"]
+      else
+        ["--live + --postgres", "config/live.rb fans out over Postgres (Monk::WebSocket::PgFanout)"]
+      end
+    end
+
     def write_live!
       write_file("config/live.rb", LIVE_CONFIG_TEMPLATES.fetch(@live_transport))
       LIVE_FILES.each { |relative, template| write_file(relative, template) }
@@ -203,7 +317,7 @@ module Monk
     end
 
     def add_live_to_layout!
-      path = File.join(@dir, "views/layouts/app.erb")
+      path = File.join(@dir, "app/views/layouts/app.erb")
       content = File.read(path)
       raise "layout wiring failed: </head> not found" unless content.include?("  </head>\n")
 
@@ -233,31 +347,49 @@ module Monk
       File.write(path, content.sub(DOTENV_COMMENTED_LINE, DOTENV_LINE))
     end
 
-    # config.ru ships in BASE_FILES unconditionally (it has to -- it's the
-    # only rackup entrypoint), so --postgres/--auth can't gate whether it
-    # exists, only what it requires. Unlike BASE_FILES/POSTGRES_FILES/
+    # config/load.rb ships in BASE_FILES unconditionally (config.ru and the
+    # tests require it), so the flags can't gate whether it exists, only
+    # which module configs it requires. Unlike BASE_FILES/POSTGRES_FILES/
     # AUTH_FILES, this is a post-write edit rather than a verbatim copy --
-    # the alternative (a second, fuller config.ru template per flag
-    # combination) would duplicate the whole file for one line of diff.
-    def wire_config_ru!
-      path = File.join(@dir, "config.ru")
-      settings_require = %(require_relative "config/settings"\n)
+    # the alternative (a second, fuller load.rb template per flag
+    # combination) would duplicate the whole file for a few lines of diff.
+    def wire_load!
+      path = File.join(@dir, "config/load.rb")
+      settings_require = %(require_relative "settings"\n)
       requires = +""
       if @postgres
-        target = @auth ? "config/auth" : "config/persistence" # config/auth.rb itself require_relative "persistence"
+        target = @auth ? "auth" : "persistence" # config/auth.rb itself require_relative "persistence"
         requires << "require_relative \"#{target}\"\n"
       end
-      # config/mail.rb from config.ru only, never from config/auth.rb:
+      # config/mail.rb from config/load.rb only, never from config/auth.rb:
       # bin/websocket_server loads config/auth.rb too and never sends mail,
       # so it shouldn't need MAIL_URL to boot.
-      requires << "require_relative \"config/mail\"\n" if @mail
+      requires << "require_relative \"mail\"\n" if @mail
+      requires << "require_relative \"jobs\"\n" if @jobs
+      requires << "require_relative \"live\"\n" if @live
 
       content = File.read(path)
-      raise "config.ru wiring failed: #{settings_require.inspect} not found" unless content.include?(settings_require)
+      raise "config/load.rb wiring failed: #{settings_require.inspect} not found" unless content.include?(settings_require)
 
       File.write(path, content.sub(settings_require, "#{settings_require}#{requires}"))
     end
 
+    def add_jobs_route!
+      path = File.join(@dir, "app/app.rb")
+      content = File.read(path)
+      raise "app/app.rb wiring failed: #{JOBS_ROUTE_ANCHOR.inspect} not found" unless content.include?(JOBS_ROUTE_ANCHOR)
+
+      File.write(path, content.sub(JOBS_ROUTE_ANCHOR, "#{JOBS_ROUTE_ANCHOR}#{JOBS_ROUTE}"))
+    end
+
+    def add_deliver_later!
+      path = File.join(@dir, "config/jobs.rb")
+      content = File.read(path)
+      raise "config/jobs.rb wiring failed: #{JOBS_REQUIRE_ANCHOR.inspect} not found" unless content.include?(JOBS_REQUIRE_ANCHOR)
+
+      File.write(path, content.sub(JOBS_REQUIRE_ANCHOR, "#{JOBS_REQUIRE_ANCHOR}#{JOBS_MAIL_REQUIRE}"))
+    end
+
     # .env/.env.test/.env.example are the other deliberate exception to
     # "templates are static files, copied verbatim" (see the class comment
     # above): DB_NAME needs this app's own directory name in it -- the one
@@ -289,12 +421,25 @@ module Monk
         example << %(MAIL_FROM="#{app_name} <no-reply@example.com>")
       end
 
-      # REDIS_URL is deliberately absent from .env.test -- only a test that
-      # actually exercises RedisFanout needs it, unlike DB_NAME/AUTH_SECRET
-      # which every test touching persistence/auth needs.
+      # bin/jobs's settings. Not in .env.test: tests run jobs with
+      # Monk::Jobs.drain!, never a job process.
+      # With mail, the mailers queue is served first, so a backlog of other
+      # work never delays a login email (docs/adr/0014).
+      if @jobs
+        queues = @mail ? "mailers,default" : "default"
+        [dev, example].each { |lines| lines.push("JOBS_WORKERS=2", "JOBS_QUEUES=#{queues}") }
+      end
+
+      # REDIS_URL is absent from .env.test for --redis alone -- only a test
+      # that actually exercises RedisFanout needs it. --live --redis is
+      # different: config/live.rb raises without it, and the test helper
+      # loads config/live.rb through config/load.rb. Building the fanout
+      # connects to nothing, so tests still need no Redis running unless
+      # one publishes.
       if @redis
         dev << "REDIS_URL=redis://localhost:6379/0"
         example << "REDIS_URL=redis://localhost:6379/0"
+        test << "REDIS_URL=redis://localhost:6379/0" if live_over_redis?
       end
 
       write_lines(".env", dev)
@@ -350,17 +495,21 @@ module Monk
 
         - `config/live.rb` -- the Redis wiring (`Monk::WebSocket::RedisFanout`)
           and the subscribe rules (nothing is allowed unless a rule says so).
-        - `config.ru` -- `POST /hit` changes state and calls `Monk::Live.patch`.
-        - `views/index.erb` -- `live_topic "hits"` marks what to subscribe to.
-        - `views/live/_hits.erb` -- the fragment that gets pushed. Partials
+        - `app/app.rb` -- `POST /hit` changes state and calls `Monk::Live.patch`.
+        - `app/views/index.erb` -- `live_topic "hits"` marks what to subscribe to.
+        - `app/views/live/_hits.erb` -- the fragment that gets pushed. Partials
           used this way see only their locals (`locals[:hits]`), never
           `params` or the session.
+        - `bin/websocket_server` -- calls `Monk::Live.listen!` at boot: the
+          only process that listens for updates. `bin/server`#{@jobs ? " and `bin/jobs`" : ""} only
+          publish.
         - `public/js/monk_live/` -- the browser runtime, copied from the gem.
           The layout points at it and at `LIVE_WS_URL` (default
           `ws://localhost:9293`; use `wss://` in production).
 
         `WS_ALLOWED_ORIGINS` (default `http://localhost:9292`) must list the
         origin your pages are served from, or the browser's socket is refused.
+        #{live_auth_setup_paragraph}
       MARKDOWN
     end
 
@@ -387,18 +536,21 @@ module Monk
 
         - `config/live.rb` -- the Postgres wiring (`Monk::WebSocket::PgFanout`)
           and the subscribe rules (nothing is allowed unless a rule says so).
-        - `config.ru` -- `POST /hit` changes state and calls `Monk::Live.patch`.
-        - `views/index.erb` -- `live_topic "hits"` marks what to subscribe to.
-        - `views/live/_hits.erb` -- the fragment that gets pushed. Partials
+        - `app/app.rb` -- `POST /hit` changes state and calls `Monk::Live.patch`.
+        - `app/views/index.erb` -- `live_topic "hits"` marks what to subscribe to.
+        - `app/views/live/_hits.erb` -- the fragment that gets pushed. Partials
           used this way see only their locals (`locals[:hits]`), never
           `params` or the session.
+        - `bin/websocket_server` -- calls `Monk::Live.listen!` at boot: the
+          only process that listens for updates. `bin/server`#{@jobs ? " and `bin/jobs`" : ""} only
+          publish.
         - `public/js/monk_live/` -- the browser runtime, copied from the gem.
           The layout points at it and at `LIVE_WS_URL` (default
           `ws://localhost:9293`; use `wss://` in production).
 
         `WS_ALLOWED_ORIGINS` (default `http://localhost:9292`) must list the
         origin your pages are served from, or the browser's socket is refused.
-
+        #{live_auth_setup_paragraph}
         A single broadcast is capped at just under 8000 bytes
         (`Monk::WebSocket::PgFanout::MAX_NOTIFY_PAYLOAD_BYTES`, Postgres's own
         `NOTIFY` limit) -- far more than this demo ever sends, but worth
@@ -453,8 +605,7 @@ module Monk
 
         ENV["MONK_ENV"] ||= "test"
         #{base_test_dotenv_lines}
-        require "minitest/autorun"
-        require_relative "../config/settings"#{%(\nrequire_relative "../config/mail") if @mail}
+        #{test_helper_app_lines}
         ```
 
         **Rakefile**:
@@ -470,22 +621,7 @@ module Monk
         task default: :test
         ```
 
-        **test/settings_test.rb** -- `config.ru`'s `class App` lives inline in a
-        rackup file, not a plain `.rb` a test could `require_relative`, so this
-        starts with what's actually requirable standalone. Extract `App` into
-        its own file (`require_relative`d from both `config.ru` and
-        `test/test_helper.rb`) once there's real app behavior worth testing
-        against requests:
-
-        ```ruby
-        require_relative "test_helper"
-
-        class SettingsTest < Minitest::Test
-          def test_monk_env_reads_as_test
-            assert_equal "test", Monk::Settings[:monk_env]
-          end
-        end
-        ```
+        #{app_test_sample}
 
         Then:
 
@@ -526,8 +662,9 @@ module Monk
       <<~MARKDOWN
         # Setting up #{app_name} (dev, then test)
 
-        `config.ru`, `.env`, and `.env.test` are already wired up by `monk new`
-        -- `config.ru` requires `config/#{@auth ? "auth" : "persistence"}` before `class App`, and
+        `config/load.rb`, `.env`, and `.env.test` are already wired up by `monk new`
+        -- `config/load.rb` requires `config/#{@auth ? "auth" : "persistence"}` (and every other config
+        you enabled), then loads `app/`, and
         `.env`/`.env.test` are pre-filled with a database name derived from
         this project's directory (`#{app_name}_development` / `#{app_name}_test`), not the
         generic `app_development` fallback baked into `config/persistence.rb`
@@ -589,8 +726,8 @@ module Monk
         ```bash
         bin/server              # HTTP app on :9292
         bin/websocket_server    # WS chat process on :9293, in another terminal
-        ```
-        #{auth_or_redis_confirmation_note}#{mail_setup_note}
+        #{"bin/jobs                # background jobs (app/jobs/), in a third terminal\n" if @jobs}```
+        #{auth_or_redis_confirmation_note}#{mail_setup_note}#{jobs_setup_note}
         ## Test environment
 
         ### 1. Create the test database
@@ -625,7 +762,7 @@ module Monk
 
         **test/test_helper.rb** -- loads `.env.test` explicitly (not the default
         dotenv-in-`config/settings.rb` path, which only loads plain `.env`), then
-        wires up the app config the same way `config.ru` does:
+        loads and boots the app the same way `config.ru` does:
 
         ```ruby
         $LOAD_PATH.unshift(File.expand_path("..", __dir__))
@@ -635,9 +772,7 @@ module Monk
         require "dotenv"
         Dotenv.load(File.expand_path(".env.test", __dir__ + "/.."))
 
-        require "minitest/autorun"
-        require_relative "../config/settings"
-        require_relative "../config/#{@auth ? "auth" : "persistence"}"#{%(\nrequire_relative "../config/mail") if @mail}
+        #{test_helper_app_lines}
         ```
 
         **Rakefile**:
@@ -664,6 +799,8 @@ module Monk
         end
         ```
 
+        #{app_test_sample}
+        #{jobs_test_sample}
         Then:
 
         ```bash
@@ -681,6 +818,7 @@ module Monk
     end
 
     def auth_or_redis_confirmation_note
+      return live_auth_confirmation_note if @live
       return "" unless @auth || @redis
 
       flags = [("authenticate: true" if @auth), ("redis fan-out: on" if @redis)].compact.join(", ")
@@ -694,6 +832,34 @@ module Monk
         "#{visible} visible to it -- that confirms everything's actually wired up.\n"
     end
 
+    # Who gets which topics once there are users. Interpolated into a
+    # squiggly heredoc, so no indentation of its own.
+    def live_auth_setup_paragraph
+      return "" unless @auth
+
+      <<~MARKDOWN
+
+        **Visitors and logged-in users.** A logged-in user's socket carries
+        their identity (the session cookie reaches `:9293` too); a visitor's
+        comes in anonymous. Each topic's rule in `config/live.rb` decides:
+        `anonymous: true` opens it to visitors (the demo's `hits`), and a
+        rule without it is for logged-in users only, e.g. one topic per user.
+        `monk new` writes no login routes: see `docs/guides/auth.md` in the
+        monk repo, and `docs/guides/live.md`, "Who may subscribe".
+      MARKDOWN
+    end
+
+    # The --live bin/websocket_server prints only `authenticate:`, and with
+    # --auth it's :optional (a visitor's socket is anonymous, not refused).
+    def live_auth_confirmation_note
+      return "" unless @auth
+
+      "\n`bin/websocket_server`'s startup line should print `authenticate: optional` once " \
+        "`AUTH_SECRET` is visible to it: a logged-in user's socket carries their identity, and a " \
+        "visitor's comes in anonymous, so it gets only the topics `config/live.rb` opens with " \
+        "`anonymous: true`.\n"
+    end
+
     # Interpolated into a squiggly heredoc, so no leading indentation of
     # its own (interpolated text isn't dedented).
     def mail_setup_note
@@ -714,12 +880,107 @@ module Monk
       MARKDOWN
     end
 
+    # Interpolated into a squiggly heredoc, so no indentation of its own.
+    def jobs_setup_note
+      return "" unless @jobs
+
+      <<~MARKDOWN
+
+        ### Background jobs
+
+        `config/jobs.rb` configures `Monk::Jobs` on the app's own database --
+        its tables come from `db/migrate/00000000000002_create_jobs_tables`,
+        which `bin/setup_db` already applied. The job classes live in
+        `app/jobs/`, which `config/load.rb` loads. With `bin/server` and
+        `bin/jobs` both running, enqueue the demo job and watch it run:
+
+        ```bash
+        curl -X POST "http://localhost:9292/jobs/hello?name=Ann"
+        tail -f log/development.log   # ... INFO Hello, Ann, from a background job
+        ```
+
+        `JOBS_WORKERS` and `JOBS_QUEUES` (in `.env`) set how many worker Ractors
+        `bin/jobs` runs and which queues they take jobs from, in order. A job
+        may run more than once (its process was killed mid-job, say), so make
+        each one safe to repeat. `TERM` or Ctrl-C lets the jobs in hand finish
+        before `bin/jobs` exits.#{jobs_mail_note}#{jobs_auth_note}
+      MARKDOWN
+    end
+
+    # Interpolated into a squiggly heredoc, so no indentation of its own.
+    def jobs_mail_note
+      return "" unless @mail
+
+      <<~MARKDOWN.chomp
+
+        To send an email from a job instead of the request, use
+        `Monk::Mail.deliver_later` -- the same arguments as `deliver` (render
+        HTML first with `Monk::Mail.render`), plus `wait:`/`at:`, or `conn:`
+        to enqueue inside your own transaction. It goes on the `mailers`
+        queue, which `JOBS_QUEUES` serves first. Temporary failures are
+        retried; a refusal the mail server made final is not.
+      MARKDOWN
+    end
+
+    # Interpolated into a squiggly heredoc, so no indentation of its own.
+    def jobs_auth_note
+      return "" unless @auth
+
+      <<~MARKDOWN.chomp
+
+        Magic links go through a job too, `app/jobs/send_login_link.rb`: it
+        creates the token and sends the link inside the job, so the raw
+        token is never stored, not even in the queue. Your login route,
+        after its own per-email rate limit, just enqueues it:
+
+        ```ruby
+        post("/auth/request") do
+          SendLoginLink.enqueue(params[:email])
+          json(sent: true)
+        end
+        ```
+
+        Don't point `config/auth.rb`'s `deliver:` at `deliver_later`: that
+        would store the link, token included, in the queue until it's sent.
+      MARKDOWN
+    end
+
+    # Interpolated into a squiggly heredoc, so no indentation of its own.
+    def jobs_test_sample
+      return "" unless @jobs
+
+      <<~MARKDOWN
+
+        **test/jobs_test.rb** -- `Monk::Jobs.drain!` runs every enqueued job
+        right in the test (each in its own Ractor, as `bin/jobs` would, so a
+        job that only works outside one fails here too), and
+        `Monk::Jobs.clear!` empties the queue between tests:
+
+        ```ruby
+        require_relative "test_helper"
+
+        class JobsTest < Minitest::Test
+          def teardown
+            Monk::Jobs.clear!
+          end
+
+          def test_the_demo_job_runs
+            HelloJob.enqueue("test")
+
+            assert_equal 1, Monk::Jobs.drain!
+          end
+        end
+        ```
+      MARKDOWN
+    end
+
     # The no-Postgres test helper normally has nothing to load from
-    # .env.test -- but with --mail it has MAIL_URL=log://, which tests need:
-    # they boot outside development, where an unset MAIL_URL raises.
+    # .env.test -- but with --mail it has MAIL_URL=log://, which tests need
+    # (they boot outside development, where an unset MAIL_URL raises), and
+    # with --live --redis it has REDIS_URL, which config/live.rb needs.
     # Interpolated into a squiggly heredoc, so no indentation of its own.
     def base_test_dotenv_lines
-      return "" unless @mail
+      return "" unless @mail || live_over_redis?
 
       %(\nrequire "dotenv"\nDotenv.load(File.expand_path(".env.test", __dir__ + "/.."))\n)
     end
@@ -727,8 +988,8 @@ module Monk
     def auth_mail_sentence
       return "" unless @auth
 
-      " `config/auth.rb`'s `AppMailer::DELIVER` sends each login link through it " \
-        "(HTML part: `views/mail/magic_link.erb`)."
+      " `AppMailer::MAGIC_LINK` (`app/mailers/app_mailer.rb`) sends each login link through it " \
+        "(HTML part: `app/views/mail/magic_link.erb`)."
     end
 
     def sample_test_body
@@ -745,13 +1006,51 @@ module Monk
         <<~RUBY.chomp.gsub(/^/, "  ")
           def test_connects_to_the_test_database
             Monk::Persistence::Pg.checkout(:primary) do |conn|
-              assert_equal "1", conn.exec("SELECT 1").getvalue(0, 0)
+              assert_equal 1, conn.exec("SELECT 1").getvalue(0, 0)
             end
           end
         RUBY
       end
     end
 
+    def live_over_redis? = @live && @live_transport == :redis
+
+    # The end of every SETUP.md test helper: the app loaded the way
+    # config.ru loads it (config/load.rb, then app/app.rb), booted once.
+    # Interpolated into a squiggly heredoc, so no indentation of its own.
+    def test_helper_app_lines
+      <<~RUBY.chomp
+        require "minitest/autorun"
+        require_relative "../config/load"
+        require_relative "../app/app"
+
+        # Booted once, as config.ru does: request tests call APP.
+        APP = Monk.boot(App)
+      RUBY
+    end
+
+    # A request through the booted app. Every generated app, --live's
+    # included, has GET /hello.
+    def app_test_sample
+      <<~MARKDOWN.chomp
+        **test/app_test.rb** -- a request through the booted app:
+
+        ```ruby
+        require_relative "test_helper"
+        require "rack/mock_request"
+
+        class AppTest < Minitest::Test
+          def test_hello
+            status, _headers, body = APP.call(Rack::MockRequest.env_for("/hello"))
+
+            assert_equal 200, status
+            assert_equal "hello from monk", body.join
+          end
+        end
+        ```
+      MARKDOWN
+    end
+
     def write_file(relative_path, template_path, executable: false)
       destination = File.join(@dir, relative_path)
       FileUtils.mkdir_p(File.dirname(destination))