rails-ai-context 5.21.3 → 5.25.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8afb263c0004a822a803eee097300e87dcb5a3a2de27d996a3cc5f11ea801051
-  data.tar.gz: 462a8ca8d7f4a66cd617af71322356908f513aa88ac7aec2046f32cf4279805f
+  metadata.gz: d80b8bd17147a84fb1f8ce3028b7e1291af63c0d639663704eec171069e8f1b7
+  data.tar.gz: 4ce32bd09b90f16b62f70621642d6db35258c3a47892196e1fdb6d329366b4ed
 SHA512:
-  metadata.gz: 2f48e61abb15f942c9a3b41eced790ce41618f091e337d84c1d598486e74e3a58e3331c9acf971ad2fea0d0a0bb8a909caef4c6b9fd3196fba51dbe318532e97
-  data.tar.gz: 07e4b2759758da12d51805c0861e8a101fcdefdff55cba0db7714c6464473e486842fbd93c55b6480c8ce7b87325138fa18eb0920c38e219f0df3556a1ec0b19
+  metadata.gz: 53ecb39c98209ddd59050431dca51b448c848e7f6e4d93fe092523ee87b014e6279aa25d97b283e57c66368eb0b315baaa4b75d0ea349d21bc6b0b1109ec0d2d
+  data.tar.gz: 25c7854ce8e4e4c1e16996e13a2031dc35d6cfee245d46515a48833c4fdcc48d35eb3a38b5365cfa4518847096340a104dc79dbfda2dfc314565a1508ea5dd7b

data/CHANGELOG.md

@@ -5,6 +5,599 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.25.0] - 2026-09-03
+
+### Added
+
+- **`sprockets-rails`, `sprockets`, `sorcery` and `clearance` join the notable
+  gem table**, so `rails_get_gems` lists them and the `rails_get_config` assets
+  and auth lines name them from the lockfile rather than from a loaded
+  constant.
+
+### Fixed
+
+Defects found by a second survey round over the whole surface, and the
+duplicated mechanisms behind them.
+
+- **`max_view_total_size` and `max_view_file_size` said they capped view
+  reads.** Only `doctor` reads either one, as the threshold for its view-size
+  warning; the config comments and the docs rows now say that.
+- **`excluded_concerns` hid a concern from a model's list but not from the
+  catalogue.** `rails_get_concern` and the `rails_get_active_support` concern
+  registry still listed and counted a concern the key names; all three now
+  apply the same predicate.
+- **An in-Gemfile app's `.rails-ai-context.yml` was inert.** The generated
+  initializer holds a `configure` block, and the YAML was skipped whenever one
+  had run, so a booted command took the defaults while `--no-boot` read the
+  file and the two disagreed (45 tools against 43 with `skip_tools` set).
+  Precedence is a merge: the file is applied once, before
+  `config/initializers`, so an initializer may assign a key or edit it in
+  place and both survive; a later call from the standalone binary or the
+  CLI's boot path is a no-op. A block wins the keys it assigns wherever it
+  lives, so one in `config/application.rb` or an environment file, which runs
+  before the load, keeps them too.
+- **The static tier named the app after its directory.** `onboard` and every
+  generated context file were headed "mastodon" for an app that declares
+  `module Mastodon`. The name now comes from the module enclosing
+  `class Application < Rails::Application` in `config/application.rb`, and
+  falls back to the directory only when that file names nothing.
+- **The static tier counted every class under `app/models` as a model.**
+  Namespace modules, form objects, filters and plain service classes were
+  listed and rendered as models of a table (Mastodon answered 195 models
+  against 117 booted). A static model is now a class whose superclass chain
+  reaches `ApplicationRecord`, a namespaced `*ApplicationRecord` or
+  `ActiveRecord::Base`, STI subclasses included.
+- **An unreadable `.rails-ai-context.yml` aborted the boot.** A directory or a
+  file the process cannot read at that path raised out of the engine
+  initializer; it now warns and keeps the defaults, the way broken YAML does.
+- **A model under a per-connection abstract base was missing from the static
+  list.** The multi-database shape - `class AnimalsRecord < ApplicationRecord;
+  self.abstract_class = true` in its own file, then `class Dog <
+  AnimalsRecord` - dropped every model on that connection from the static
+  list, the count and the schema listing. An abstract base is still walked so
+  chains resolve through it; it is left out of the result, as before.
+- **`rails_get_api` stated a filesystem finding for a section nobody had
+  read.** In the static tier the whole section but the mode was declared
+  unavailable, and nothing read that declaration, so an app with
+  `app/controllers/api/v1/` was told "not detected (no app/controllers/api/v*
+  directories)". Every detection in that section is a file read, so the
+  static tier now answers all of them, and a key a section does name as
+  unanswered renders as `[UNAVAILABLE: ...]` rather than as a negative
+  finding.
+- **An existing `.ai-context.json` holding anything but a JSON object
+  aborted the whole generation run.** The skip check reads it as a file to
+  replace.
+- **`rails_get_schema`'s table heading named every model on the table**, so
+  an STI table with thirty subclasses filled the cheap summary with one
+  heading. It names five and counts the rest, the way the file's other lists
+  do.
+- **`rails_get_test_info` blamed the app root for a name it refused as
+  sensitive.** The refusal names what the check covers: the name leaves the
+  app root or names a sensitive file.
+- **`rails_onboard`'s Getting Started block told the reader to `cd` into the
+  app's class name underscored**, which is not the directory the clone lands
+  in. It names the app directory.
+- **`init` refused a tree with app source but no `config/environment.rb`
+  after it had already written the config files**, leaving it half set up
+  with no `CLAUDE.md`. Every command that can serve the static tier now
+  reads such a tree, the way `--no-boot` already did.
+- **A tree with app source but no `config/environment.rb` printed a boot
+  failure before falling back to static analysis.** No boot can succeed
+  without that file, so the static tier now takes over at once and its banner
+  names the missing file; `doctor` refuses the same tree with that reason.
+  The banner calls that tree static mode rather than a boot failure, since
+  no boot ran.
+- **`rails_runtime_info` and `rails_query` told a tree with no
+  `config/environment.rb` to fix a boot failure or drop `--no-boot`**, neither
+  of which had happened. Such a tree now reads "This tree has no
+  `config/environment.rb`; add one (or run from the app root) for runtime
+  data."
+- **A source path was contained without a separator and against an
+  unresolved root.** The frontend framework introspector's own containment
+  check let `/app-old` pass for `/app`. The pre-v5.8.1 bug, still in one
+  place.
+- **`rails_get_env` printed Dockerfile `ENV` and `ARG` values verbatim at
+  detail full.** Every default now leaves through the redaction gate, and a
+  surrounding quote pair is stripped, so `ENV FOO="bar"` prints `bar`.
+- **`rails_read_logs` matched the `search` term before redacting**, so a
+  hidden value could be probed a character at a time. The search runs on the
+  redacted text now.
+- **The middleware introspector fabricated an empty stack in the static
+  tier.** It declares an alternate source and answers only its file facts,
+  rather than reporting an app with no middleware.
+- **`rails_get_config` and `rails-ai-context facts` read gem keys no
+  introspector emits**, so the Auth line and the Key Dependencies section
+  never rendered at all.
+- **Jobs and mailers carry `file:`.** `rails_get_job_pattern` reads the
+  carried file instead of camelizing a basename, and its listing comes from
+  the payload, so a job in a pack lists.
+- **The auth introspector keyed Devise models by basename**, so
+  `app/models/admin/user.rb` overwrote `User`.
+- **An out-of-order migration merge was reported as none pending** by the
+  migrations section while the schema section counted it. Both derive from
+  one applied set now, and an unknown applied set answers no pending key
+  rather than "everything" or "nothing".
+- **Substring lockfile scans reported `bugsnag-capistrano` as Bugsnag** and
+  `database_cleaner-redis` as database_cleaner. One lockfile reader with
+  exact names answers every gem question, across the GEM, GIT and PATH
+  sections.
+- **The hydrators warned about a model they had just resolved in another
+  spelling**, and emitted one hint block twice.
+- **The channel and mailer eager loads had no per-constant recovery**, so a
+  single unloadable file emptied the list.
+- **`YAML.safe_load` refused the `&default` anchors** every stock webpacker
+  or shakapacker config carries, so the source path fell back to the
+  convention.
+- **VFS: `controllers/admin/posts` fell into the action handler** and
+  `routes/PostsController` returned zero routes.
+- **`Payload.section` accepted a refused (`unavailable`) section**, so a
+  static-tier context file rendered a bare heading.
+- **Every generated file counts the same controller set.**
+  `config.excluded_controllers` is honoured everywhere, not only by
+  `rails_get_controllers`.
+- **The doctor counted models and controllers under `app/` only.** Packs and
+  engines count, and the freshness check reads the one watch scope.
+- **The watcher stopped noticing `config/routes.rb` and `db/schema.rb`.** The
+  fingerprint, the watcher and the doctor share one scope covering `config`
+  and `db` whole, and the fingerprint mark is taken before the read it
+  protects.
+- **The diagnose tool's git probe ran outside a repository** and leaked its
+  stderr into the response.
+- **`rails_get_stimulus` re-read every controller file** to recompute a
+  lifecycle the payload already carried.
+- **MCP config removal wrote non-atomically**, the dead `AstCache.invalidate`
+  is gone, and the doctor checks that `.codex/config.toml` is gitignored.
+- **Composing tools decided whether a sub-tool answered by scraping its prose
+  for "not found".** A real answer whose body mentioned those words was
+  dropped. Responses carry an empty marker in MCP `meta` now.
+- **`rails_get_test_info` guarded a caller-supplied name with its own
+  containment.** It reads through the shared guard.
+- **The asset pipeline introspector's literal `none` was rendered as if it
+  named a pipeline**, so every generated context file carried
+  `- Assets: none`. The line shows only the parts that name something, and
+  disappears when there are none.
+- **`rails_get_view`'s ivar list counted an `@` inside an email address and a
+  `@@class_variable`.** Neither is an instance variable.
+- **A controller ivar compared, not assigned, was reported as set.** `return
+  unless @post == current_user` no longer names `@post`; `||=`, `+=`, `<<=` and
+  `>>=` still count.
+- **`rails_get_context` resolved an action name case-sensitively** while
+  `rails_get_controllers` did not, so `action: "Show"` skipped the ivar
+  cross-check.
+- **The ivar cross-check ran with no view templates section**, reporting every
+  controller ivar as unused in the view. It is skipped instead.
+- **`rails_get_turbo_map` printed a Turbo Stream response as a Ruby hash.**
+  It renders `PostsController#create`, the way the file's other sections name
+  a controller action.
+- **A second `context` run rewrote the generated files** for their timestamp
+  alone, so a repo that commits the context files saw a diff from a run that
+  found nothing new. One rule now covers them all: a file that differs only
+  in its `generated_at` key, or in the full-mode header's `> Generated:`
+  line, is skipped.
+- **The schema listing named one model per table.** A table an STI child or a
+  namespaced second model shares listed whichever came first in the payload,
+  which could be the emptier one. Every model on the table is listed now,
+  the one carrying the most detail first.
+- **Every static-tier context file carried `Rails [UNAVAILABLE: app not
+  booted]` mid-sentence.** The version comes from the lockfile, and the
+  marker is left for a tree whose lockfile does not carry rails.
+- **`rails-ai-context preset " FULL "` exited 1 with the listing.** A preset
+  name is matched whatever its case or padding.
+- **A `--no-boot` run that found no app printed the doctor hint**, which asks
+  for a boot error that never happened. `doctor` and `init` also accept a
+  tree that has app source but no `config/environment.rb`, and the refusal
+  names that file instead of telling the user to go to the app root they are
+  standing in.
+
+### Changed
+
+- **`RailsAiContext.generate_context(format: nil)` means the recorded AI-tool
+  selection**, and all of them when nothing is recorded. It was `:all`.
+- **Static-tier migration names are the class-style name** (`CreatePosts`),
+  matching what the booted tier reports.
+- **Names in the turbo, auth, attachments and multi-database sections carry
+  their namespace** (`Admin::User`, not `User`), and packs and in-repo
+  engines count everywhere the app's source is walked.
+- **The `.env.example` reader judges a value by its shape and length only.** A
+  default in Ruby source or a Dockerfile is condemned by a secret-shaped name
+  as well.
+- **Turbo wiring lives in the introspector payload with file and line** -
+  frames, model broadcasts, explicit broadcasts and stream subscriptions -
+  and `rails_get_turbo_map` renders it. A `turbo_frame_tag dom_id(@post,
+  :edit)` frame renders as that call, and a symbol `turbo_stream_from :posts`
+  now pairs with its broadcast. A subscription argument that carries its own
+  commas renders whole: `turbo_stream_from [current_user, :notifications]` and
+  `dom_id(@post, :x)` keep every character they were written with.
+- **The public-methods lists come from the parser.** `rails_get_concern`,
+  `rails_get_helper_methods`, `rails_get_model_details` and
+  `rails_get_controllers` read `private def` and `class_methods do`
+  correctly.
+- **The standalone binary boots through `CLI::EntryBoot`**, and presets run
+  through `Presets.run` in both the binary and the rake task.
+- **`rails_get_controllers` and the controller-action resource decide which
+  filters apply through one module, `ActionFilters`.** Every inherited filter
+  carries the `(from Parent)` annotation, after_action and
+  except-constrained ones included; a filter constrained with `except:` shows
+  that constraint; `skip_after_action` and `skip_around_action` count as
+  skips, and a skipped filter is struck through in the whole-controller view
+  as well as the per-action one.
+- **A config value longer than 40 characters is filtered on every path.** The
+  Ruby-source and Dockerfile readers capped at 30 before; `.env.example` was
+  already 40.
+- **`schema[:pending_migrations]`, reachable through the `rails://schema`
+  resource, is a list of `{ version:, name: }` entries** rather than version
+  strings.
+- **`rails-ai-context://routes/{controller}` prefers an exact route-key
+  match**, so `routes/posts` no longer also returns `admin/posts`.
+- **`unavailable_sections`, where a section carries it, is a list of
+  section keys**, not a reason string. The middleware section's static
+  answer is the one that still emits it.
+- **The models resource template advertises
+  `rails-ai-context://models/{name}`**, and every scheme resolves through the
+  VFS rather than an exact-match legacy reader. `rails://models/{name}` is
+  still accepted.
+- **`controllers[:controllers]` can carry `{ error: "unreadable" }` entries**
+  for a file over the size cap or otherwise unreadable, and the listing and
+  the count include them.
+
+### Removed
+
+- **`SourceLine`, the hand-rolled Ruby lexer.** Every source read goes through
+  Prism.
+- **`Fingerprinter.reset_gem_lib_fingerprint!` and `AstCache.invalidate`** -
+  no callers.
+- **Support for the mcp gem below 0.13.** The gemspec floor is `>= 0.13`, the
+  first release whose tool responses carry `meta`.
+- **`Presets.names` and `Presets.fetch`** - the listing and the run read
+  `DEFINITIONS` directly.
+- **`SchemaHintBuilder.build_many`** - no callers.
+- **`Fingerprinter.changed?`** - no callers; `stale?` answers the question.
+- **The public constant `ChangeWatch::WATCH_DIRS`.**
+- **`RailsAiContext.configured_via_block?`** - no callers once the config file
+  applies once per configuration and a block wins its keys by name.
+
+## [5.24.0] - 2026-08-17
+
+### Fixed
+
+Defects found by a QA round against GitLab, OpenProject, Canvas LMS,
+Discourse and Mastodon. Every one of them exits 0.
+
+- **The commands that read the app degrade the way `tool` does.** `context`,
+  `inspect`, `facts`, `preset`, `watch` and `init` called a bare boot guard,
+  so on a repo you have just cloned - the case an agent most needs a
+  `CLAUDE.md` for, and the case least likely to boot - every tool answered
+  and the command that writes the files exited 1 having written nothing.
+  `init` was worse: it writes its config files first, so a boot failure left
+  the app half set up and called that a failure. They allow the static tier
+  now and each takes `--no-boot`; `doctor` still fails, because diagnosing
+  the boot is its job. Writing under `--no-boot` then exposed its own bug -
+  the context writer asked `Rails.application` for the output directory,
+  which raises `NameError` on the path where Rails is never loaded at all.
+- **`tool --list` reads the app's config when the app cannot boot.** Boot is
+  what normally loads `.rails-ai-context.yml`, so the listing fell back to
+  the gem's defaults: on Mastodon it advertised 45 tools while the MCP server
+  offered 43 and the CLI itself answered `Unknown tool 'query'` for one it
+  had just listed.
+- **`search_extensions` is documented as the fallback's list, which is what
+  it is.** Making ripgrep honour it did make the two backends agree, and it
+  cost the reach that makes the tool useful: on Mastodon `gem 'devise'` went
+  from 5 results to none, because a Gemfile carries no listed extension - and
+  the same for a Rakefile, a `.md`, a `.sql`. The docs, the attr comment and
+  the line the install generator writes now say plainly that the list is the
+  Ruby fallback's and that ripgrep searches every file.
+- **A table the replay cannot name is not reported.** Canvas has a migration
+  that calls `create_table table_name do |t|` with a local computed at run
+  time; the replay kept the entry under a nil key, and the first serializer
+  to sort the table names took the whole context run down. Reachable only
+  once `context` could enter the static tier at all.
+- **Coverage says nothing when there is nothing to measure against.** With a
+  `default_locale` the app configures but ships no file for, every locale
+  scored zero and all of them were named as untranslated.
+- **A mixin in a nested concerns directory is not a model.** The skip only saw
+  the top-level `concerns/` that Rails autoloads, so OpenProject's
+  `app/models/queries/operators/concerns` contributed four mixins to a model
+  count of 978 where the app has 974. A nested `concerns/` is an ordinary
+  namespace, though, so the directory name alone does not decide it: a file
+  there that declares a class is a model like any other.
+- **`docs/COMPATIBILITY.md` describes the static tier the gem actually has.**
+  It said 6 introspectors answer without a booted app and "the other 34 have
+  no static path", naming eight examples - all of which answer. The real
+  split is 23 files-only, 9 alternate-source and 8 runtime-only: 32 of 40.
+  A guard spec derives all three lists from `INTROSPECTOR_MAP`.
+
+- **A controller is named by the constant its source declares.** Zeitwerk
+  resolves a path through the app's own inflector, which the static tier
+  never loads, so camelizing the path invented `Activitypub::` for the 12
+  controllers Mastodon declares as `ActivityPub::` and `Oauth::` for the 4
+  it declares as `OAuth::` - names that appear nowhere in an app that
+  registers those acronyms, and a `NameError` for anyone who uses one. The
+  path stays the answer where the source does not carry the whole name
+  (`application_cable/channel.rb`) and where the declared name does not name
+  that file, since Prism recovers a syntax error into a partial tree.
+- **An interceptor is told from a mailer by its framework hook.**
+  `app/mailers` is also where ActionMailer interceptors live, and every `.rb`
+  under it counted: OpenProject's `Interceptors::DefaultHeaders` arrived as a
+  mailer with `delivering_email` - a hook the framework calls - listed as an
+  email an agent could send, 2 of its 11 entries. What an interceptor has and
+  a mailer does not is one of `delivering_email`, `previewing_email` or
+  `delivered_email`; requiring a class instead would have dropped GitLab's 20
+  `Emails::*` modules, which hold every notification it sends.
+- **Migration replay reads what a migration does, not what it undoes.** A
+  `def down` says how to reverse the change, so replaying it alongside `up`
+  cancelled the migration out. On a migrations-only app the ordinary
+  up-creates/down-drops pair erased two tables OpenProject really has (35
+  to 37), and the reverse pair would have invented one it dropped. The same
+  now holds for the block spellings, `reversible { |dir| dir.down { ... } }`
+  and `revert`, and for the `t.timestamps` inside them - those were found by
+  a separate walk over the whole file, so a down body's timestamps landed on
+  the last table created on the way up.
+- **i18n coverage groups the locales below its own rounding floor instead of
+  listing them.** A language-name lookup table under `config/locales`
+  contributes a top-level key per language, and Rails does load each as an
+  available locale. Scoring them produced a row each saying every key was
+  missing: on Discourse, 138 of 186 coverage rows described a translation
+  effort nobody had started. Those 138 are now summarised in one line, with a
+  shared key count stated once. The rows still exist - asking for one by name
+  answers with its numbers, so a translation genuinely started below the floor
+  is not written off as untranslated. The available list still matches a
+  booted Rails, and a locale's keys are read from its own file and any shared
+  file together, so one that lives outside the naming convention is scored.
+- **A recorded tool selection no longer switches off `.ai-context.json`.**
+  The install generator always records one, and every later `rails
+  ai:context` passed that list to the serializer. The machine artifact is
+  not an AI tool and no install menu offers it, so it silently stopped being
+  written on the one install path the docs describe - while the generator
+  went on adding it to `.gitignore`.
+- **`skip_tools` accepts the symbol spelling its neighbours use.** Every
+  other key in the generated initializer takes symbols, and `%i[]` here
+  skipped nothing at all: both readers compare against a tool name, which is
+  a String.
+
+- **A controller carries the file it was read from.** Reading the name from
+  the source fixed the name and broke every path derived from it:
+  `ActivityPub::CollectionsController`.underscore is `activity_pub/...` and
+  the file is under `activitypub/`, so `rails_get_context` answered "Could
+  not extract source code" for a file that exists and asked the routes for a
+  controller key Rails does not use. Both tiers emit `file:` - the booted one
+  asks Ruby where the class was defined - and the consumers read it through
+  `Payload`.
+- **The locale files are indexed once, not once per locale.** Asking every
+  file about every locale is O(locales x files): on Discourse, 187 over 108,
+  it took the i18n answer from 4.6 seconds to four and a half minutes. Each
+  entry also records the locales it serves, so asking for one by name finds
+  its files even when the filename spells the gem rather than the locale.
+
+- **Every consumer that turns a controller name back into a path reads the
+  file it was read from.** Carrying `file:` fixed six of them and left five
+  answering a confident negative, which is the answer an agent acts on
+  without checking. On Mastodon's 18 inflected controllers: `rails_test_info`
+  reported 16 specs that exist as missing, `rails_get_routes` reported 4
+  routes that exist as absent, `rails_get_view` 2 views, and
+  `rails_generate_test` wrote a spec whose body was `skip "no routes found"`
+  for a controller with a route. `rails_analyze_feature` listed them as
+  untested. `Payload.controller_route_key` is the one derivation now, and a
+  spec drives all five tools with an inflected name.
+- **The install path's files require their own stdlib.** `init` loads six
+  files before Rails and before the entry file, on purpose - so the entry
+  file's `require "set"` never runs for them. `legacy_cleanup`'s `[...].to_set`
+  raised `NoMethodError` on Ruby 3.1, where `Set` is not autoloaded, and 3.2+
+  hid it: only the CI matrix ever saw it.
+- **`rails_runtime_info` reports cache numbers, not the cache object.** The
+  MemoryStore branch passed `cache.inspect` straight through, so the answer
+  carried `#<ActiveSupport::Cache::MemoryStore entries=0, size=0, options={...}>`
+  - the shape this gem has shipped as a defect before. Entries and size are
+  now facts, and a store that answers `#stats` gets its hash rendered as pairs
+  rather than a Ruby literal.
+- **A model's table comes from its file, not from its name.** Naming a model by
+  the constant its source declares made `underscore` stop being the way back:
+  `OAuthClientConfig` underscores to `o_auth_client_config`, and the file is
+  `oauth_client_config.rb`. `rails_model_details` reported the table as
+  `o_auth_client_configs`, which no app has, so the columns section vanished
+  and the schema hint pointed at nothing - on Canvas that hit
+  `OAuthClientConfig`, `OAuthRequest`, `AuthenticationProvider::OAuth` and
+  `OAuth2`, on OpenProject `OAuthClient` and `OAuthClientToken`. The file's own
+  name already carries the inflection, because Zeitwerk resolved the constant
+  from it. `rails_generate_test`, `rails_get_callbacks`, `rails_test_info` and
+  the five `rails_validate` checks that key models by path read it too.
+- **An abstract base class is not a model in the static tier either.** A
+  booted Rails rejects `abstract_class?`, and a namespaced base class is one:
+  GitLab's `Ci::ApplicationRecord`, `PackageMetadata::ApplicationRecord` and
+  `SecApplicationRecord` were counted, so the same app answered 895 models
+  without a boot and 888 with one. OpenProject: 974 against 971.
+- **A model carries its file too, and is named by the constant its source
+  declares.** `rails_model_details` rebuilt `app/models/<underscored>.rb` from
+  the name in four places, so for a model in a pack or an engine the custom
+  validations, the source-defined methods, the method signatures and the class
+  structure all went quietly missing from an answer that otherwise looked
+  complete. The static tier also camelized the path into the name, so an app
+  registering an inflection got a constant it does not have - and one the
+  booted tier, which reads the real class, would never agree with.
+- **`rails_validate_semantics` checks the views under an inflected directory.**
+  A view directory names the route key, so camelizing `app/views/oauth/` back
+  gave a constant the app never declares and the undefined-ivar check stopped
+  running for that whole tree without saying so.
+- **A test-gap claim is not made from a scan that stopped early.**
+  `rails_analyze_feature` scans the first 500 files per glob; Discourse has
+  1,672 specs, so the scan never reached the ones covering the feature and
+  every controller in it was reported as having no test. The Tests section
+  disclosed the cap, the gaps section asserted through it.
+- **"Global before_actions" in the generated files means global.** The scan
+  matched `skip_before_action` too, and ignored `only:` / `except:` / `if:`.
+  Mastodon's `CLAUDE.md` listed five, of which three were false - including
+  `verify_authenticity_token`, which that controller skips.
+
+### Added
+
+- **`--no-boot` on `context`, `inspect`, `facts`, `preset`, `watch` and
+  `init`.** The static tier was reachable from `tool` and `serve` only.
+- **`--no-boot` reads a repo that has source but no `config/`.** An engine
+  keeps its dummy app under `spec/dummy`, so the guard against describing an
+  empty directory has to measure source, not boot files.
+
+### Changed
+
+- **The generated initializer has one indent from top to bottom.** The AI
+  Tools section was written at the configure body's indent and every section
+  after it flush, so the file an app commits changed indent two lines in and
+  stayed there.
+
+## [5.23.0] - 2026-08-16
+
+### Fixed
+
+- **`AstCache.parse_string` caches, as its name always said.** Keyed by
+  content digest, sharing the store and its eviction; oversize sources
+  bypass instead of raising. A controller was parsed up to ten times per
+  static run because every extractor received the text and re-parsed it.
+- **`rails_validate` says which checks it skipped.** When the AST parse
+  fails, the three rules with no regex twin used to vanish silently and a
+  partially-checked file read as clean; the response now names them. The
+  tool also gains its first spec file.
+- **A downstream app exception is the app's again.** The middleware's
+  rescue used to convert any error from the app behind it - non-MCP
+  requests included - into an MCP error frame. `McpEdge.rack_call` now owns
+  the whole Rack-shaped request (path match, session scope, dispatch,
+  containment) for the middleware and the standalone server, and the
+  pass-through branch runs outside the rescue.
+
+### Changed
+
+- **The cache fingerprint watches what the resolvers read.** Packs,
+  engines, `extra_app_paths`, every concern home, the `Gemfile`,
+  `config/locales` and `config/environments` now feed the fingerprint, so
+  an edit there cannot serve a stale answer that looks fresh.
+- **One change-detection loop.** `ChangeWatch` owns the watch list, the
+  Listen wiring, the fingerprint gate and the code reload; `Watcher` and
+  `LiveReload` keep only their reactions (regenerate files; refresh caches
+  and notify clients) and their own missing-`listen` policy.
+- **The initializer guard and the `tool_mode` line each have one home.**
+  `Install::InitializerFile` holds the guard patterns the generator writes
+  and the doctor diagnoses; `SelectionRecord.write_tool_mode` replaces the
+  rake task's hand-rolled three-branch rewriter, and only rewrites an
+  uncommented line, so the generated commented-out default stays a comment.
+- **Split-rule targets derive from the `Install::AiTool` table.** The
+  rules serializers read `rules_dir` (and the AGENTS.md pair) from the
+  table doctor and cleanup already read, so a moved path changes every
+  surface at once.
+- **The stack helper writes through `SafeFile.atomic_write`** instead of a
+  private copy of it, and its app-tree scans take a root, so they are
+  covered by specs for the first time.
+- **Every serializer is proven against a context real introspectors
+  produced** (`IntrospectedFixture`), so no serializer can read a shape
+  production does not make - the class of defect that kept the engines and
+  turbo sections dead while hand-built fixtures stayed green.
+
+## [5.22.0] - 2026-08-16
+
+### Fixed
+
+- **A class nested inside a controller, mailer, model or helper file no
+  longer contributes its methods to the host's interface.** "Which public
+  methods are this class's own" had five transcriptions with five filter
+  sets; they now share `ActionResolver`, which filters listener output by the
+  owner field the listener always emitted, walks app-owned ancestors, and
+  falls back to reflection with the #136 base subtraction. Mailers had kept
+  the pre-#136 reflection answer, so a public helper on a non-abstract
+  `ApplicationMailer` arrived as a deliverable action; they subtract now, and
+  static mailer actions apply the same underscore rule as controllers. (#149)
+
+- **Every generated context file states each fact through one renderer.**
+  `SectionFacts` owns the models line, the database line, the associations
+  list (eight copies, three of them in tools) and the warnings section -
+  which now renders in AGENTS.md and .github/copilot-instructions.md too, so
+  a half-failed run cannot look clean in two of four files. AGENTS.md stops
+  shadowing the shared architecture and footer renderers with poorer copies,
+  and its controller list goes through the shared renderer with named
+  actions as a depth choice rather than a fork. `Payload` is the reading
+  side of the introspection hash: list readers whose key pairs a spec pins
+  against the producing introspector's real output, so the next renamed key
+  fails a test instead of silently emptying a section. (#151)
+- **API-only apps are told "does not apply", not "not found".**
+  `rails_get_helper_methods` and `rails_get_frontend_stack` now consult the
+  api-only note like the other eleven call sites. The two hand-rolled
+  paginations (`rails_get_schema`, `rails_get_stimulus`) go through the
+  shared `paginate`, one offset/limit behavior across all fourteen paginated
+  surfaces. (#152)
+- **The interactive install is one program with three voices.** The
+  generator, the standalone binary and the rake task each held a full copy
+  of the prompts, the removed-tool cleanup, the gitignore append and the
+  MCP-config write - about 470 lines that had already drifted: two labels
+  for one mode, a menu with file lists in two entries and bare names in the
+  third, a byte-identical gitignore block three times. `Install::Program`
+  now owns the steps and the wording; each entry supplies its say/ask
+  surface and keeps only its closing instructions. The rake menu shows each
+  tool's files, and every entry uses one mode label.
+- **Configuration loads the same way on every entry point.** The engine now
+  runs `auto_load!` at boot, so `.rails-ai-context.yml` works on the rake
+  tasks, the middleware and the engine controller the way the docs always
+  said - initializer first, the loader steps aside when a configure block
+  ran. `Configuration#ai_tools` answers from `SelectionRecord` when nothing
+  set it, so `rails ai:context` stops re-asking a question the record
+  already answers, and the recorded `tool_mode` reaches in-app surfaces
+  through the record's new reader. A bad YAML value now warns and keeps the
+  default the way bad syntax always did, instead of dying raw out of the
+  CLI. (#147, #148)
+- **The three static schema sources follow one set of conventions, and every
+  schema question can be asked of any of them.** `SchemaReader.for(root)`
+  chooses schema.rb, structure.sql or migration replay behind one
+  question-level seam, so introspectors asking "does this table carry this
+  column" now get answers on structure.sql and migrations-only apps instead
+  of nothing. The migration replay is repaired: a replayed `create_table`
+  seeds its implicit `id`, `change_column_null` applies in both directions
+  (the listener now captures the positional boolean), and `t.references` is
+  typed per adapter instead of hardcoded bigint. The conventions live in
+  `SchemaConventions`, shared by all three sources the way #140's
+  foreign-key fix pioneered; the SQL parser and the replay engine moved to
+  `StructureSqlReader` and `MigrationReplay`, and the schema introspector
+  halves in size, keeping only presentation. (#150)
+- **Every surface answers "which concerns count" and "how many routes" the
+  same way.** Five renderers carried five concern filter sets:
+  `rails_get_callbacks` hid every namespaced concern unless it started with
+  "App", `rails_analyze_feature` hid all of them, and two ignored the
+  `excluded_concerns` config. `ConcernMembership` now decides the payload
+  sense once, at the introspector seam, for both tiers - the static
+  controller answer goes through `MixinsListener`, so `prepend` counts and a
+  singleton-class `include` does not, exactly as booted. Route populations
+  (app vs framework split, PUT/PATCH dedup) moved beside the coverage suffix
+  into `RouteCoverage`, replacing four hand-kept computations, one of them a
+  wholesale copy. CLAUDE.md's per-model concern list now names the concerns
+  the app defines, namespaced ones included.
+- **Mounted engines render again in `rails_onboard` and the context files.**
+  `EngineIntrospector` emits `:mounted_engines`; the tool read `:engines` then
+  `:mounted`, and the stack line read `:mounted`, so both fell back to "none"
+  forever. Both now read the introspector's keys and the element's real
+  `engine:`/`path:` shape, and the spec fixtures use that shape instead of one
+  production never produced. (#144)
+- **The Hotwire stack line and `rails_onboard`'s Real-Time and Frontend
+  sections read turbo keys that exist.** `turbo[:frames]`, `[:streams]` and
+  `[:broadcasts]` were never emitted (`:turbo_frames`, `:turbo_streams` and
+  `:model_broadcasts` are), so the line was dead everywhere and Real-Time
+  always fell through to its view-scan fallback. (#145)
+- **`rails_get_context` no longer offers a Related Services section it could
+  never fill.** The `:services` key it read has no introspector behind it; the
+  dead branch is gone. (#146)
+- **`rails ai:context` stops re-prompting a YAML-configured app on every
+  run.** The rake path now loads `.rails-ai-context.yml` the way the
+  standalone binary always did; the initializer still wins when its configure
+  block ran. (#147)
+- **The standalone binary's `--format` help names opencode and codex.** A
+  guard spec pins the help text to `Install::AiTool`, which the Thor class
+  body cannot ask at definition time. (#153)
+- **`rails ai:serve` and `rails ai:serve_http` boot under the same timeout
+  and rescue as the binary.** A hanging initializer used to hang the task
+  forever where `rails-ai-context serve` gives up at 60s; both tasks now boot
+  through `BootManager.guard`, and `RAILS_AI_CONTEXT_BOOT_TIMEOUT` is parsed
+  in one place. (#154)
+- **doctor's tool list and `rails_search_code`'s exclusion list derive from
+  `Install::AiTool`.** Both were hand-typed restatements sitting below the
+  ownership spec's detection floor; the search exclusions now also cover the
+  generated `app/models/AGENTS.md` pair they previously missed. (#155)
+- **An e2e example asserts `call` and `static_call` answer the same keys.**
+  The declaration contract was already enforced (ADR-0002); the shape contract
+  was not, so a key added to the booted tier could silently vanish from the
+  static one. (#156)
+
 ## [5.21.3] - 2026-08-12
 
 ### Fixed