plutonium 0.61.0 → 0.62.0

data/lib/plutonium/resource/controllers/kanban_actions.rb

@@ -20,7 +20,7 @@ module Plutonium
       #   1. Authorizes via kanban_move? policy predicate.
       #   2. Validates the drop (accepts? + locked?).
       #   3. Enforces the destination WIP limit (cross-column drops only).
-      #   4. Applies the column's on_drop callback (Symbol or 1-arg Proc).
+      #   4. Applies the column's on_enter callback (Symbol or 1-arg Proc).
       #   5. Repositions within the destination column via position_config.
       #   6. Responds with Turbo Stream updates for the from + to column frames.
       #      On rejection responds 422 and re-renders the unchanged source frame
@@ -32,15 +32,35 @@ module Plutonium
       module KanbanActions
         extend ActiveSupport::Concern
 
+        # Tags board-bound redirects with kanban_reload=1 so the permanent board
+        # refreshes its cached column frames on arrival (see #kanban_reload_url).
+        # Wraps ALL three redirect helpers — create/update (after_submit), destroy
+        # (after_destroy), and interactive record/resource/bulk actions
+        # (after_action_on). PREPENDED, not a plain override: after_action_on
+        # lives in InteractiveActions, which is included AFTER this concern, so a
+        # normal override here would be shadowed. Prepending wins regardless of
+        # include order, and `super` still reaches the real implementation.
+        module ReloadRedirects
+          def redirect_url_after_submit
+            kanban_reload_url(super)
+          end
+
+          def redirect_url_after_destroy
+            kanban_reload_url(super)
+          end
+
+          def redirect_url_after_action_on(*)
+            kanban_reload_url(super)
+          end
+        end
+
         included do
+          prepend ReloadRedirects
+
           # Intercept index when view=kanban + column=<key> is present.
           # Runs BEFORE setup_index_action! so no wasteful pagination query.
           before_action :maybe_render_kanban_column, only: :index
 
-          # Pre-fill the new form with the column's seed attributes when the
-          # user clicks "+ Add" on a kanban column (kanban_column= query param).
-          before_action :apply_kanban_column_defaults!, only: :new
-
           # Exposed to views/partials so _resource_kanban.html.erb can call it.
           helper_method :build_kanban_board_shell
         end
@@ -57,10 +77,11 @@ module Plutonium
         def kanban_move
           # Find record within authorized scope (satisfies scope verifier).
           record = kanban_base_relation.find(params[:id])
-          # Check move permission (satisfies authorize verifier).
-          authorize_current! record, to: :kanban_move?
 
           unless current_definition.defined_kanban_block
+            # Not a kanban resource — a 404, not an authorized action; satisfy the
+            # authorize verifier explicitly since we skip the authorize below.
+            skip_verify_authorize_current!
             head :not_found
             return
           end
@@ -70,12 +91,33 @@ module Plutonium
           from = columns.find { |c| c.key.to_s == params[:from_column].to_s }
           to = columns.find { |c| c.key.to_s == params[:to_column].to_s }
 
-          # accepts_record? evaluates Proc accepts: against the actual record
-          # (returning the Proc's boolean result) while delegating to accepts?
-          # semantics for true/false/Array values.  This is the server-side
-          # authority; the client-side data-kanban-accepts attribute (which
-          # treats Proc as "all") is only a drop-hint.
-          unless from && to&.accepts_record?(record, from.key) && !from.locked?
+          # Single authorization point for the whole move (satisfies the authorize
+          # verifier). kanban_move? defaults to update?; the from/to columns are
+          # supplied via the authorization context so a policy can gate specific
+          # transitions (e.g. "only admins may enter :closed_won") without a
+          # per-column method. Hoisted above the accepts/WIP checks so a denied
+          # move is a clean 403 before any structural rejection. The enter
+          # interaction (if any) rides on THIS check — it has no policy of its own.
+          authorize_current! record, to: :kanban_move?,
+            context: {kanban_from: from, kanban_to: to}
+
+          # params[:from_column] is client-supplied and is passed to the policy as
+          # kanban_from. Verify the record ACTUALLY resides in the claimed source
+          # column before the move proceeds. This (a) makes kanban_from safe to
+          # authorize on — a spoofed from can't drive a move because the membership
+          # check rejects it — and (b) snaps back a stale-board drag whose card was
+          # moved out of `from` by someone else. Skipped when from is nil (the
+          # accepts check below handles an unknown source column).
+          if from && !record_in_kanban_column?(record, from)
+            return render_kanban_rejection(
+              params[:from_column],
+              reason: "This card is no longer in “#{from.label}”."
+            )
+          end
+
+          # accepts?/locked? are purely structural (source-column topology), the
+          # server-side authority behind the client-side data-kanban-accepts hint.
+          unless from && to&.accepts?(from.key) && !from.locked?
             reason =
               if from&.locked?
                 "Cards can't be moved out of “#{from.label}”."
@@ -92,7 +134,12 @@ module Plutonium
           # (cross-column, same-column reorder, record already in destination).
           dest_scoped = Plutonium::Kanban::Grouping.apply_scope(kanban_base_relation, to.scope)
           dest_cards = board.position_config.order(dest_scoped).where.not(id: record.id).to_a
-          to_index = params[:to_index].to_i
+          # to_index is client-supplied. Clamp to [0, dest_cards.size] so a negative
+          # value can't wrap via Ruby's negative array indexing (dest_cards[-1] would
+          # silently anchor the drop to the LAST card) and an over-large value simply
+          # appends. The real client only ever sends 0..dest_cards.size; this hardens
+          # the crafted-request path.
+          to_index = params[:to_index].to_i.clamp(0, dest_cards.size)
 
           # WIP limit only applies to cross-column drops (reordering within the
           # same column does not change its cardinality). This is a
@@ -108,25 +155,104 @@ module Plutonium
           prev_record = (to_index > 0) ? dest_cards[to_index - 1] : nil
           next_record = dest_cards[to_index]
 
+          # Holds the enter_interaction outcome (when the destination declares
+          # one) so the post-transaction branch can distinguish a rolled-back
+          # failure from a successful atomic commit.
+          outcome = nil
+
+          # A same-column reorder (from.key == to.key) changes only rank, not
+          # membership, so it runs ONLY the positioning code — no on_enter, no
+          # enter_interaction. Both on_enter (the membership write) and
+          # enter_interaction (the transition) represent ENTERING a column; neither
+          # should fire when the card is already in it. Task 6 (client) must mirror
+          # this: a same-column drop posts a plain reposition and opens no modal.
+          cross_column = from.key != to.key
+          run_enter_interaction = to.enter_interaction? && cross_column
+
+          # A dynamic board (`columns do…end`) can't register its enter_interaction
+          # as an action at class-load time (its columns only exist per-request), so
+          # defined_actions has no entry for the column-scoped key and the interactive
+          # machinery below (build_interactive_record_action_interaction) would blow
+          # up. Reject gracefully with a clear log instead of a 500 morphing onto the
+          # board. (Static boards always register — see Definition::IndexViews.)
+          if run_enter_interaction && current_definition.defined_actions[to.enter_interaction_key].nil?
+            Rails.logger.warn { "[plutonium] kanban enter_interaction on column `#{to.key}` is not registered — enter_interaction is unsupported on dynamic (`columns do…end`) boards; rejecting the drop." }
+            return render_kanban_rejection(params[:from_column], reason: "This drop can’t be completed.")
+          end
+
+          # An input-less drop interaction is `immediate` — the client commits it
+          # via a DIRECT POST (no modal), so the response must be a Turbo Stream,
+          # not modal-form HTML (see the failure branch below).
+          drop_immediate = run_enter_interaction &&
+            !!current_definition.defined_actions[to.enter_interaction_key]&.immediate
+
+          # Bind the enter_interaction's auto-registered hidden record action (so
+          # interaction_params / build_interactive_record_action_interaction
+          # resolve it) and reuse the already-loaded record as resource_record!
+          # (param-extraction subject + form URL) — no re-query, no divergent copy.
+          # No authorize here: the move was already authorized by kanban_move?
+          # above, and the interaction has no policy method of its own.
+          if run_enter_interaction
+            params[:interactive_action] = to.enter_interaction_key
+            @resource_record = record
+          end
+
           ActiveRecord::Base.transaction do
-            # Apply on_drop:
+            # (1) Apply on_exit (SOURCE column) then on_enter (DESTINATION column),
+            # CROSS-column moves only. A same-column reorder skips both (see
+            # cross_column above) and only repositions; on_exit/on_enter represent
+            # LEAVING and ENTERING a column, which a reorder does not do.
+            #
+            # on_exit runs FIRST, so it sees the pre-move state (still "in" from) —
+            # the counterpart hook for source-tied side effects (stop a timer,
+            # release a slot) that the destination's on_enter can't own.
+            #
             #   Symbol → record.public_send(sym) (named method on the record)
             #   Proc   → evaluated with self = kanban_context (delegates to
             #            view_context so `current_user` etc. work as bare calls)
             #            and the record as the single block arg, matching the
-            #            public 1-arg DSL form: on_drop: ->(task) { task.status = … }
-            if to.on_drop.is_a?(Symbol)
-              record.public_send(to.on_drop)
-            elsif to.on_drop
-              kanban_context.instance_exec(record, &to.on_drop)
+            #            public 1-arg DSL form: on_enter: ->(task) { task.status = … }
+            if cross_column
+              if from.on_exit.is_a?(Symbol)
+                record.public_send(from.on_exit)
+              elsif from.on_exit
+                kanban_context.instance_exec(record, &from.on_exit)
+              end
+
+              if to.on_enter.is_a?(Symbol)
+                record.public_send(to.on_enter)
+              elsif to.on_enter
+                kanban_context.instance_exec(record, &to.on_enter)
+              end
+
+              # Persist any in-memory attribute changes from on_exit/on_enter
+              # (blocks that call update! directly are already saved; this is a
+              # safety net for blocks that only assign attributes).
+              record.save! if record.changed?
             end
 
-            # Persist any in-memory attribute changes from on_drop (on_drop
-            # blocks that call update! directly are already saved; this is a
-            # safety net for blocks that only assign attributes).
-            record.save! if record.changed?
+            # (2) Drop interaction — runs against the SAME record instance,
+            # atomic with the move. Only fires on a CROSS-column move (entering a
+            # new column is the transition the interaction represents); a
+            # same-column reorder skips it (see run_enter_interaction above). The
+            # interactive_action binding + @resource_record + authorize were
+            # hoisted out above the transaction.
+            if run_enter_interaction
+              # build_interactive_record_action_interaction renders the action
+              # form to EXTRACT its params (structured inputs / choices). It runs
+              # INSIDE the transaction on purpose: so a `choices:` proc (or any
+              # form logic) sees the post-on_enter record state. Do NOT hoist this
+              # out — doing so would change the record state the form is built
+              # against and silently alter param-extraction semantics.
+              build_interactive_record_action_interaction
+              outcome = @interaction.call
+              # Interaction validation failed → undo the on_enter write (and any
+              # partial execute) so nothing persists. The re-render happens
+              # after the transaction so the rollback is fully applied first.
+              raise ActiveRecord::Rollback if outcome.failure?
+            end
 
-            # Reposition within the destination column.
+            # (3) Reposition within the destination column.
             # Mode A delegates to record.reposition! (calls update! for position).
             # Mode B calls the user-supplied block.
             # Mode C is a no-op (no ordering; position unchanged).
@@ -138,36 +264,212 @@ module Plutonium
               index: to_index
             )
 
-            # Final save covers Mode C where reposition! is a no-op but on_drop
+            # Final save covers Mode C where reposition! is a no-op but on_enter
             # only assigned in memory, or any other unsaved attribute changes.
             record.save! if record.changed?
           end
 
+          # Interaction failed → the transaction rolled back. Re-render the SAME
+          # modal (422) with the validation errors + the submitted hidden move
+          # fields, so the user can correct the input and resubmit the move.
+          if run_enter_interaction && outcome&.failure?
+            # Immediate interactions were committed via a direct POST (no modal
+            # open), so the client is processing a Turbo Stream response — render a
+            # snap-back rejection toast rather than modal-form HTML, which the
+            # stream-expecting fetch would silently drop. Input-collecting
+            # interactions re-render their modal with the errors so the user can
+            # fix the input and resubmit.
+            if drop_immediate
+              reason = @interaction.errors.full_messages.to_sentence.presence ||
+                "“#{to.label}” could not be applied."
+              return render_kanban_rejection(from.key, reason:)
+            end
+            return render :kanban_move_form, formats: [:html], **modal_render_options, status: :unprocessable_content
+          end
+
           respond_to do |format|
             format.turbo_stream do
-              streams = [turbo_stream.update("kanban-col-#{from.key}", render_kanban_column_html(from))]
-              streams << turbo_stream.update("kanban-col-#{to.key}", render_kanban_column_html(to)) if from.key != to.key
+              # The column-frame updates are what other viewers need to see — this
+              # is the shared, broadcastable payload.
+              column_streams = [turbo_stream.update("kanban-col-#{from.key}", render_kanban_column_html(from))]
+              column_streams << turbo_stream.update("kanban-col-#{to.key}", render_kanban_column_html(to)) if from.key != to.key
 
-              # Broadcast the same frame updates to other connected viewers of this
+              # Broadcast the frame updates to other connected viewers of this
               # board, when realtime broadcasting is enabled. The mover will also
               # receive this broadcast (they are subscribed to the stream too) — but
               # re-rendering the same frames is idempotent, so the double update is
-              # harmless.
+              # harmless. The modal-close stream is deliberately EXCLUDED: only the
+              # mover has this modal open, so closing it for everyone would blow
+              # away an unrelated modal another viewer might have open.
               if board.realtime?
                 Plutonium::Kanban::Broadcaster.broadcast(
                   resource_class: resource_class,
                   scoped_entity: scoped_to_entity? ? current_scoped_entity : nil,
-                  content: streams.join
+                  content: column_streams.join
                 )
               end
 
+              streams = column_streams
+              # When the move arrived via the drop-interaction modal (cross-column
+              # only), close that modal by emptying the remote-modal frame AND
+              # surface the interaction's success message(s) as toast(s). Both are
+              # mover-only: only this viewer has the modal open, so they are
+              # deliberately EXCLUDED from the realtime broadcast above (appended
+              # to `streams`, never to `column_streams`). Plain moves and
+              # same-column reorders aren't in a modal, so nothing is appended.
+              if run_enter_interaction
+                streams += [turbo_stream.update(Plutonium::REMOTE_MODAL_FRAME, "")]
+                outcome.messages.each do |msg, type|
+                  streams += [turbo_stream.append("kanban-flash", partial: "plutonium/toast",
+                    locals: {type: ((type == :notice) ? :success : type), msg:})]
+                end
+              end
+
               render turbo_stream: streams
             end
           end
+        rescue ::ActionPolicy::Unauthorized
+          # NOTE: the leading :: is required — Plutonium::ActionPolicy exists
+          # (action_policy/sti_policy_lookup.rb), so a bare ActionPolicy would
+          # resolve to that namespace and never match the raised exception,
+          # letting it fall through to the global rescue_from (which re-raises for
+          # turbo_stream requests → the HTML error page morph this fix prevents).
+          #
+          # A denied transition — the kanban_move? gate (the single move
+          # authorization; the enter_interaction has no policy of its own). Snap
+          # the source column back with a toast at 403 instead of letting the HTML
+          # error page reach the client: the drag POST expects a Turbo Stream, so
+          # a raw error page would be morphed into the board (the "page turns red"
+          # bug). Rendering a stream here keeps rejection feedback consistent with
+          # the WIP / accepts snap-backs above.
+          #
+          # authorize_count only bumps AFTER a successful authorize, so a denial
+          # raised by the board-wide gate (before any successful check) leaves the
+          # verifier unsatisfied — we've handled authorization by rejecting, so
+          # skip it explicitly.
+          skip_verify_authorize_current!
+          render_kanban_rejection(
+            params[:from_column],
+            reason: "You are not authorized to move this card there.",
+            status: :forbidden
+          )
+        rescue ActiveRecord::RecordNotFound
+          # The card was destroyed (e.g. concurrently) between board render and
+          # drop, so `find` raised. Snap the source column back — re-rendering it
+          # drops the now-gone card — instead of letting Rails' 404 HTML page get
+          # morphed into the board (same class of bug as the ActionPolicy rescue).
+          # `find` raised before authorize_current!, so satisfy that verifier; the
+          # scope verifier is already satisfied by kanban_base_relation.
+          skip_verify_authorize_current!
+          render_kanban_rejection(params[:from_column], reason: "This card no longer exists.")
+        rescue ActiveRecord::RecordInvalid => e
+          # An on_exit/on_enter hook (or the interaction) left the record invalid,
+          # so save! raised and the transaction rolled back. Snap back with the
+          # validation reason rather than let a 500 HTML page morph into the board.
+          reason = e.record.errors.full_messages.to_sentence.presence ||
+            "This card could not be moved."
+          render_kanban_rejection(params[:from_column], reason:)
+        end
+
+        # GET <member>/kanban_move_form?from_column=&to_column=&to_index=
+        #
+        # Renders the drop-interaction modal for a card dropped into a column
+        # that declares a `enter_interaction:`. The modal shows the interaction's
+        # normal form, but wired to POST to `kanban_move` (Task 4) carrying the
+        # move context as hidden fields so the interaction runs AND the card is
+        # repositioned in one atomic request.
+        def kanban_move_form
+          @resource_record = kanban_base_relation.find(params[:id])
+          record = @resource_record
+          from = kanban_column_for(params[:from_column])
+          to = kanban_column_for(params[:to_column])
+
+          # No interaction to open a form for (invalid drop), OR the interaction is
+          # unregistered because this is a dynamic (`columns do…end`) board — which
+          # can't register enter_interactions and so can't render the modal chrome
+          # (current_interactive_action would be nil). Either way the drop is not
+          # actionable on this path — satisfy the verifier and bail cleanly instead
+          # of 500-ing in the view.
+          unless to&.enter_interaction? && current_definition.defined_actions[to.enter_interaction_key]
+            skip_verify_authorize_current!
+            head :unprocessable_content
+            return
+          end
+
+          # Same single gate as kanban_move: authorize the move via kanban_move?
+          # with the from/to columns in context (the interaction has no policy of
+          # its own). Opening the form is authorizing the move it will commit.
+          authorize_current! record, to: :kanban_move?,
+            context: {kanban_from: from, kanban_to: to}
+
+          # Belt-and-suspenders structural gate, mirroring kanban_move (POST) in
+          # the same order (membership → accepts?/locked?). Don't open a modal for
+          # a drop the commit will inevitably reject: the user would fill in the
+          # interaction form only to eat a 422 snap-back on submit. The client's
+          # accepts hint normally blocks this before the modal opens, but a stale
+          # board or a crafted request can still reach here. On rejection we render
+          # the SAME turbo-stream snap-back the POST does (Turbo processes it from
+          # the frame.src navigation) instead of the doomed form. authorize already
+          # succeeded (counter bumped), so these returns need no skip_verify.
+          if from && !record_in_kanban_column?(record, from)
+            return render_kanban_rejection(
+              params[:from_column],
+              reason: "This card is no longer in “#{from.label}”."
+            )
+          end
+          unless from && to.accepts?(from.key) && !from.locked?
+            reason =
+              if from&.locked?
+                "Cards can't be moved out of “#{from.label}”."
+              else
+                "Cards can't be moved into “#{to.label}”."
+              end
+            return render_kanban_rejection(params[:from_column], reason:)
+          end
+
+          # Bind the enter_interaction's auto-registered record action as the
+          # current interactive action so the modal chrome (title, description,
+          # modal mode/size) resolves exactly like a standard record action.
+          params[:interactive_action] = to.enter_interaction_key
+
+          @interaction = to.enter_interaction.new(view_context:)
+          @interaction.resource = record
+
+          render :kanban_move_form, formats: [:html], **modal_render_options
+        rescue ::ActionPolicy::Unauthorized
+          # A denied transition into a enter_interaction column. Without this the
+          # exception reaches the global rescue_from, which RE-RAISES for html/
+          # turbo_stream (core/controller.rb) → a 403 HTML error page. The client
+          # opened this form via `frame.src`, so that error page lands in the
+          # remote-modal frame → a broken "content missing" modal. Render the same
+          # turbo-stream rejection the kanban_move POST does instead: the card was
+          # never moved (native DnD doesn't re-parent), so this just empties the
+          # modal frame, re-asserts the source column, and toasts the denial.
+          # authorize_current! raised before bumping its counter, so satisfy the
+          # verifier explicitly (mirrors the RecordNotFound branch below).
+          skip_verify_authorize_current!
+          render_kanban_rejection(
+            params[:from_column],
+            reason: "You are not authorized to move this card there.",
+            status: :forbidden
+          )
+        rescue ActiveRecord::RecordNotFound
+          # Card destroyed between board render and the modal-open request. `find`
+          # raised before authorize, so satisfy that verifier; return a plain 404
+          # (this GET only loads the modal frame — there is no board to morph).
+          skip_verify_authorize_current!
+          head :not_found
         end
 
         private
 
+        # Resolves a kanban column by its key (String/Symbol). Compares keys as
+        # strings so arbitrary request input isn't interned into symbols.
+        def kanban_column_for(key)
+          columns = Plutonium::Kanban::Grouping.resolve_columns(current_kanban_board, kanban_context)
+          columns.find { |c| c.key.to_s == key.to_s }
+        end
+
         # Builds the kanban board shell component for the index page.
         #
         # Used by the _resource_kanban partial (Task 10). The shell renders one
@@ -180,7 +482,13 @@ module Plutonium
         def build_kanban_board_shell
           board = current_kanban_board
           columns = Plutonium::Kanban::Grouping.resolve_columns(board, kanban_context)
-          grouped_data = columns.map { |col| {column: col, cards: [], total: 0} }
+          # collapsed: the effective (cookie-resolved) state, so the lazy-frame
+          # placeholder renders in the SAME shape the loaded column will — a
+          # collapsed column shows a strip from the first paint instead of a full
+          # header that then snaps to a strip.
+          grouped_data = columns.map do |col|
+            {column: col, cards: [], total: 0, collapsed: kanban_effective_collapsed(col)}
+          end
           Plutonium::UI::Kanban::Resource.new(
             board:,
             grouped_data:,
@@ -289,7 +597,29 @@ module Plutonium
           end
 
           column_add_url = if column.add? && current_policy.allowed_to?(:create?)
-            resource_url_for(resource_class, action: :new, kanban_column: column.key)
+            resource_url_for(resource_class, action: :new, kanban_column: column.key,
+              return_to: kanban_board_url)
+          end
+
+          # Drop-interaction columns advertise the kanban_move_form member URL
+          # (with __ID__ for the dragged card's id) so the client opens the
+          # interaction modal on drop. Mirrors the board's move-url template
+          # (Kanban::Resource#kanban_move_url_template) — same collection path +
+          # __ID__ shape, only the trailing route segment differs (kanban_move_form
+          # vs kanban_move). Derived from resource_url_for (not request.path)
+          # because this method also runs under the kanban_move POST, whose
+          # request.path is the member move URL, not the collection path.
+          drop_form_url_template = nil
+          drop_immediate = false
+          drop_confirm = nil
+          if column.enter_interaction?
+            drop_form_url_template = "#{resource_url_for(resource_class).delete_suffix("/")}/__ID__/kanban_move_form"
+            # Look up the auto-registered drop action to honour its shape: an
+            # input-less interaction is `immediate` (commit directly, no modal),
+            # and carries an auto "<label>?" confirmation unless one was set.
+            registered_drop = current_definition.defined_actions[column.enter_interaction_key]
+            drop_immediate = registered_drop&.immediate || false
+            drop_confirm = registered_drop&.confirmation
           end
 
           component = Plutonium::UI::Kanban::Column.new(
@@ -301,12 +631,72 @@ module Plutonium
             resource_fields: permitted_attributes_for("index"),
             column_action_data:,
             column_add_url:,
+            board_url: kanban_board_url,
             card_fields: board.card_fields,
-            card_show_frame: kanban_card_show_frame(board)
+            card_show_frame: kanban_card_show_frame(board),
+            collapsed: kanban_effective_collapsed(column),
+            drop_form_url_template:,
+            drop_immediate:,
+            drop_confirm:
           )
           view_context.render(component).html_safe
         end
 
+        # The board's own URL — the collection path with view=kanban and any
+        # active board query (search / filter / scope), minus the per-column
+        # frame param. Used as the quick-add return_to so creating a card returns
+        # the user to the board (at their scroll + filters) instead of the new
+        # record's show page. Built from resource_url_for rather than request.path
+        # because this also runs under the kanban_move POST, whose request path is
+        # the member move URL, not the collection path.
+        def kanban_board_url
+          board_params = request.query_parameters.except("column", "format").merge("view" => "kanban")
+          "#{resource_url_for(resource_class)}?#{board_params.to_query}"
+        end
+
+        # Tags a board-bound redirect with the one-shot kanban_reload marker (and
+        # normalizes it to the FULL board) so a write/action that returns to the
+        # permanent board doesn't show stale columns (a new card missing, a
+        # deleted/archived one lingering). The kanban Stimulus controller consumes
+        # the marker on connect, re-fetches the column frames, and strips it from
+        # the URL. No-op for non-kanban resources and for redirects that don't
+        # land on the board (a show page, the table index). Called from
+        # ReloadRedirects for all three redirect helpers.
+        #
+        # Also strips column= so the redirect targets the full board rather than
+        # the bare single-column frame endpoint (maybe_render_kanban_column
+        # intercepts view=kanban + column=<key>). A card's edit/delete button
+        # rendered inside a lazy column frame defaults its return_to to that
+        # frame's URL, which carries column=<key>; without this strip the write
+        # would redirect onto that fragment instead of the board.
+        def kanban_reload_url(url)
+          return url unless current_definition.defined_kanban_board
+          uri = URI.parse(url.to_s)
+          params = Rack::Utils.parse_query(uri.query)
+          return url unless params["view"] == "kanban"
+          params.delete("column")
+          params["kanban_reload"] = "1"
+          uri.query = params.to_query
+          uri.to_s
+        end
+
+        # The user's persisted collapse choice for this column, resolved against
+        # the column default. The cookie stores only columns flipped FROM their
+        # default (see Kanban::Resource.collapse_cookie_name), so a listed key
+        # means "the opposite of the default". Rendering this server-side is what
+        # keeps the board in the user's state across morph/stream/reload with no
+        # client re-apply — and therefore no flash.
+        def kanban_effective_collapsed(column)
+          flipped = kanban_collapse_flips.include?(column.key.to_s)
+          flipped ? !column.collapsed? : column.collapsed?
+        end
+
+        def kanban_collapse_flips
+          @kanban_collapse_flips ||= Plutonium::UI::Kanban::Resource.collapse_flips(
+            cookies[Plutonium::UI::Kanban::Resource.collapse_cookie_name(resource_class)]
+          )
+        end
+
         # Resolves the turbo-frame a card's show link targets, from the board's
         # effective show_in (the board's own value, or the definition's when the
         # board doesn't override it):
@@ -347,73 +737,58 @@ module Plutonium
           end
         end
 
-        # Injects the column's seed attributes into params so the new form
-        # pre-fills the grouping attribute (e.g. status="todo").
+        # Kanban quick-add, POST-create. The column "+ Add" link opens the normal
+        # New form carrying kanban_column (threaded to the create POST as a hidden
+        # field). After the record is created — with the model's DEFAULT grouping
+        # value, which the app author is responsible for setting — this applies the
+        # column's on_enter to the freshly-persisted record and positions it into
+        # the column. on_enter therefore runs against a REAL record exactly as it
+        # does for a drag; there is no dry-run / no stubbing.
         #
-        # Triggered by the kanban_column= query param that the "+ Add" link
-        # carries. The seed is extracted by running a DRY-RUN of on_drop against
-        # a sentinel record whose save/update! methods are intercepted to prevent
-        # any DB write. The resulting attribute changes are merged into the
-        # resource params so maybe_apply_submitted_resource_params! sees them and
-        # pre-populates @resource_record before the form renders.
-        def apply_kanban_column_defaults!
+        # Failure policy (see after_create_persisted rescue): the create is NEVER
+        # rolled back. If on_enter/positioning raises, the record is KEPT in its
+        # default column (validly positioned there by the model's before_create
+        # hook) and the failure is logged + toasted.
+        def after_create_persisted
+          super
           return unless params[:kanban_column].present?
           return unless current_definition.defined_kanban_block
 
-          board = current_kanban_board
-          columns = Plutonium::Kanban::Grouping.resolve_columns(board, kanban_context)
-          column = columns.find { |c| c.key.to_s == params[:kanban_column].to_s }
+          column = kanban_column_for(params[:kanban_column])
           return unless column&.add?
 
-          # A raising on_drop must not 500 the new form — degrade to an unseeded
-          # form so the user can still create the record (and set the grouping
-          # field manually).
-          seed_attrs = begin
-            kanban_column_on_drop_seed(column)
-          rescue => e
-            Rails.logger.warn { "kanban quick-add seed failed for column #{column.key}: #{e.message}" }
-            return
-          end
-          return if seed_attrs.blank?
-
-          # Inject into params (indifferent access — string key is fine).
-          # Use ||= so an explicit user-provided value in the URL is preserved.
-          params[resource_param_key] ||= ActionController::Parameters.new({})
-          seed_attrs.stringify_keys.each { |k, v| params[resource_param_key][k] ||= v }
+          apply_kanban_column_enter!(resource_record!, column)
+        rescue => e
+          Rails.logger.error { "[plutonium] kanban quick-add on_enter failed for column #{params[:kanban_column].inspect}: #{e.class}: #{e.message}\n#{e.backtrace&.join("\n")}" }
+          flash[:alert] = "Couldn’t place it in “#{column&.label || params[:kanban_column]}” — it stayed in its default column."
         end
 
-        # Runs on_drop against a sentinel record that intercepts save/update!
-        # calls so no row is written to the DB. Returns the attribute changes
-        # the on_drop block would have applied (e.g. {"status" => "todo"}).
-        #
-        # NOTE: this only stubs save/save!/update/update! on the sentinel record.
-        # An on_drop that has external side effects (enqueuing jobs, API calls,
-        # touching OTHER records) would fire those side effects on every "+ Add"
-        # click, since they bypass the stubbed methods. This is acceptable for
-        # the common `attr = value` / `update!(attr: value)` pattern but is a
-        # footgun for exotic on_drop callbacks.
-        def kanban_column_on_drop_seed(column)
-          return {} unless column.on_drop
-
-          seed = resource_class.new
-          seed.define_singleton_method(:update!) { |attrs = {}|
-            assign_attributes(attrs)
-            self
-          }
-          seed.define_singleton_method(:update) { |attrs = {}|
-            assign_attributes(attrs)
-            true
-          }
-          seed.define_singleton_method(:save!) { |**| true }
-          seed.define_singleton_method(:save) { |**| true }
-
-          if column.on_drop.is_a?(Symbol)
-            seed.public_send(column.on_drop)
-          else
-            kanban_context.instance_exec(seed, &column.on_drop)
+        # Applies a column's on_enter to an already-persisted record, then appends
+        # it to the END of that column. Mirrors kanban_move's on_enter + reposition
+        # steps (Symbol → record.public_send; Proc → instance_exec in kanban_context),
+        # against the real record, so update!-style callbacks behave exactly as they
+        # do on a drag.
+        def apply_kanban_column_enter!(record, column)
+          if column.on_enter.is_a?(Symbol)
+            record.public_send(column.on_enter)
+          elsif column.on_enter
+            kanban_context.instance_exec(record, &column.on_enter)
           end
+          record.save! if record.changed?
 
-          seed.changes.transform_values { |(_, new_val)| new_val }
+          # Append to the end of the destination column (prev = last card, next =
+          # nil), via the board's position_config — the same path a drag-drop uses.
+          board = current_kanban_board
+          dest_scoped = Plutonium::Kanban::Grouping.apply_scope(kanban_base_relation, column.scope)
+          dest_cards = board.position_config.order(dest_scoped).where.not(id: record.id).to_a
+          board.position_config.reposition!(
+            record:,
+            column: column.key,
+            prev_record: dest_cards.last,
+            next_record: nil,
+            index: dest_cards.size
+          )
+          record.save! if record.changed?
         end
 
         # Renders a 422 turbo stream response that re-renders the source column
@@ -425,7 +800,7 @@ module Plutonium
         # so a stale, undisplayed flash from an earlier request can't leak into
         # the turbo_stream response — these move POSTs never render the layout
         # that would otherwise consume the flash.
-        def render_kanban_rejection(from_key, reason: nil)
+        def render_kanban_rejection(from_key, reason: nil, status: :unprocessable_content)
           streams = [
             turbo_stream.update(
               "kanban-col-#{from_key}",
@@ -441,7 +816,28 @@ module Plutonium
             )
           end
 
-          render turbo_stream: streams, status: :unprocessable_content
+          # Close the drop-interaction modal if one is open. A rejection can arrive
+          # AFTER an enter_interaction modal submit (a non-immediate column that also
+          # has accepts:/wip:, or an auth/validation failure), and the success and
+          # interaction-failure paths close the modal but the structural rejections
+          # did not — leaving it open behind the snap-back toast. Emptying the frame
+          # is idempotent for plain drags (no modal is open during a drag, so the
+          # remote-modal frame is already empty → no-op), so it is safe to always
+          # append here.
+          streams << turbo_stream.update(Plutonium::REMOTE_MODAL_FRAME, "")
+
+          render turbo_stream: streams, status:
+        end
+
+        # Whether `record` currently resides in `column`'s scope. Used to verify a
+        # client-claimed source column before trusting it for authorization / the
+        # move. A nil column or a scope-less column contains everything (true), so
+        # the caller's own nil/accepts handling takes over.
+        def record_in_kanban_column?(record, column)
+          return true if column.nil? || column.scope.nil?
+          Plutonium::Kanban::Grouping
+            .apply_scope(kanban_base_relation, column.scope)
+            .exists?(record.id)
         end
 
         # Evaluation context for dynamic `columns do…end` blocks — delegates to