rails-ai-context 5.28.0 → 5.30.0

data/CHANGELOG.md

@@ -5,6 +5,1449 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.30.0] - 2026-09-28
+
+A pass over the whole tree for code that did not need to exist, with one base
+class for the introspectors and one for the serializers, and one reader where
+several files each kept a copy. Then four real-app QA passes in every tier
+(Mastodon, Discourse, OpenProject, Canvas, Forem, Whitehall, Consul,
+OpenFoodNetwork, Huginn, Errbit, Diaspora, Plots2 and a private API app) and
+five review rounds found the wrong answers below. Their fixes grew `lib/` by
+about 8,500 lines, most of it reading what the gem used to guess.
+
+### Added
+
+- **`rails_get_engines` and the generated files name the app's own in-repo
+  engines, plugins and modules**: an "In-Repo Engines" section with each
+  one's path and the models the model scan found under it (unavailable, not
+  zero, when the model scan failed), and
+  in the compact files one Stack line, `- In-repo engines: 4 (catalog,
+  dfc_provider, order_management, web)`, capped at five names.
+
+### Changed
+
+- **`.github/copilot-instructions.md` is built the way CLAUDE.md is.** It was
+  the one root file off the shared compact renderer. It now carries the same
+  sections (Async, Migrations, Commands, Rules), per-model counts, "Key models
+  (N total)" with 15 models where it listed 25, and the `Generated by
+  rails-ai-context` line; "Conventions" becomes "Rules". Its tool reference is
+  the compact list plus the roster of every tool name, where it had a
+  Copilot-only table with one described row per tool and a "detail parameter -
+  ALWAYS start with summary" section. The file is capped by `claude_max_lines`
+  and ends with the trim note when it runs over. Its docs promised a 500-line
+  cap that nothing enforced.
+- **`claude_max_lines` counts content lines, the `BEGIN`/`END` markers
+  included, and must be positive.** Blank lines between sections do not spend
+  the budget, so a file that fit before still fits and still ends with the
+  full MCP tools guide. A file over the budget keeps its Commands, Warnings,
+  Rules and MCP tools sections whole and trims the data sections above them,
+  with the trim note at the cut and no heading left without its body; it
+  trimmed from the end, so the tool list and the last rules were what went. A
+  budget too small for those sections alone still trims from the end. Zero or
+  a negative number raises `ArgumentError` when set in Ruby, the way
+  `cache_ttl` and `max_tool_response_chars` already do; in
+  `.rails-ai-context.yml` it warns and keeps the default of 150.
+- **The four compact files print their sections in one order**: Stack, Key
+  models, Gems, Architecture, Commands, Warnings, Rules, Tools. AGENTS.md moves
+  its MCP tools guide from the middle to the end and its Warnings block above
+  Rules, which is where CLAUDE.md already had them.
+- **`views.layout_mapping` is gone from `.ai-context.json`.** It globbed the
+  layouts a second time to hold the names `views.layouts` already carries.
+- **`rails_read_logs` and `rails_runtime_info` print sizes through
+  ActiveSupport**: binary units and three significant digits, so read_logs
+  says "2.29 MB" where it said "2.4 MB", runtime_info says "1 GB" where it said
+  "1.0 GB", and a count under a kilobyte reads "512 Bytes" where it read
+  "512 B". Both print in English whatever the app's `I18n.locale` is, and in
+  the app's own locale only when it offers no English at all. The two tools
+  used to disagree on what a megabyte was.
+- **`rails-ai-context tool --list` trims each description at a word boundary
+  to at most 79 characters, ellipsis included**, and a cut that lands on
+  trailing punctuation drops it before the ellipsis.
+- **`tools/list` is sorted by MCP tool name, and `rails-ai-context tool --list`
+  prints its short names in that order.** That is the order v5.29.0 happened
+  to print; it no longer depends on which tools a process loaded first.
+- **A failed section is recorded in one place.** The introspection loop turns
+  a failed section into its `{ error: }` entry and prints a warning, so a
+  section that used to fail without a warning now shows one, and `doctor`
+  names the exception class ("database_stats: StandardError: Database not
+  found"). The entry itself is unchanged. Only `credentials` still records its
+  own failure, to keep the exception message out of the output.
+- **`init` and `version` answer an unexpected error like every other
+  command**: `Error: <message>` on stderr and exit 1. One rescue around
+  Thor's command invocation replaced eight copies; Thor's own refusals keep
+  their wording. With `DEBUG` set, the first 15 backtrace frames follow the
+  `Error:` line.
+- **The doctor's view-size hint names only `config.max_view_total_size`**, the
+  setting its check compares against, and the generated initializer's comment
+  for `max_view_file_size` says no check reads it. The option is still
+  accepted.
+- **The gem requires `thor >= 1.2`.** Thor 1.0 and 1.1 raise `NameError` on
+  require under every Ruby this gem supports.
+- **The packaged gem leaves out `demo/`**, 525KB of GIFs the README loads from
+  GitHub, `gemfiles/`, the CI's own Gemfiles, and `docs/social-preview.html`, a
+  one-off screenshot page. The .gem drops from about 1.29MB to about 780KB.
+- **The security policy says only the latest 5.x release gets fixes**, in
+  place of a version table that stopped at 5.7.x.
+- **The release runs the same Ruby and Rails matrix as CI**, from one shared
+  workflow whose test legs get read-only repository access. It used to skip
+  Ruby 3.2 with Rails 8.0 and 8.1, which CI already ran green.
+- **Introspection reads each source once where it used to read it again**:
+  auth, Active Storage, turbo views, seeds, conventions, job channels, the
+  Gemfile, ActiveRecord and Mongoid models, each migration the schema replays,
+  `db/migrate`, and the doctor's view count. Where one walk now answers several
+  lists (Active Storage's attachments, validations and variants), a walk that
+  fails leaves those lists empty together.
+- **With `DEBUG` set, a skipped scan prints `<label> failed: <message>`**, the
+  shape every other debug line in the gem already had.
+
+- **A static route count says how many in-repo engine route files it did not
+  read**, everywhere a route count is printed: `rails_get_routes`, CLAUDE.md,
+  the rule files, `rails_onboard` and the rake summary. An engine draws its
+  routes into its own table and the app mounts it at boot, so the static tier
+  cannot place those paths.
+- **`rails_get_i18n` and the generated files say what the in-repo engines'
+  own locale directories hold that they did not read**: the tool and the
+  full file count the files, and the compact files' I18n line ends
+  `; 29 in-repo engine locale dirs not read`.
+- **The component catalog reads every `app/components`**, packs and in-repo
+  engines included, and its header counts what it could not place, as in `998
+  components (862 ViewComponent, 0 Phlex, 136 of no known base class)` on
+  OpenProject, which read 559 from its root tree alone, with a base that other
+  components inherit from (Consul's two `BaseComponent`s) named on a bases
+  line and not counted; the generated files print the same line from the same
+  numbers. `component:` takes a name with or without its namespace or
+  `Component` suffix, and a short name several components share lists them and
+  asks for the full one.
+- **`rails_get_active_support` lists validator classes apart from concerns**,
+  so its concern total matches `rails_get_concern`, and a concerns directory
+  holding only validators says so.
+- **A condition prints the line the file holds.** A callback, concern
+  callback, validation or controller filter whose condition is a lambda, a
+  proc or a method call prints that source on one line where it printed
+  `[INFERRED]`, and a symbol prints as a symbol (`if: :published?` and
+  `on: :create`, where they read `if: published?` and `on: create`), in a
+  list as well (`if: [:a?, :b?]`). A
+  callback with `if:` or `unless:` now names the condition in
+  `rails_get_model_details` and `rails_get_callbacks`, each declaration its
+  own when one method is declared twice, and a filter that runs names its
+  own condition in every surface that lists filters, where only a skip's
+  printed. The same
+  goes for any validation option that is not a literal (a regexp, a
+  constant) and for an option nested in another one, as in
+  `inclusion: { in: proc { ... } }`.
+- **`rails_dependency_graph` draws no node for an association whose
+  `class_name` is computed at runtime**, where it drew one named `_INFERRED_`,
+  leaves them out of its association count, and names up to ten of them in
+  a note that says how many the count leaves out. The same goes for an
+  association it cannot name. Its footer says how many edges the page drew
+  beside the associations they came from, so the numbers reconcile with the
+  diagram.
+- **An association whose name is computed is marked `(computed)` wherever it
+  prints** (`` `owner_name` (computed) ``, and
+  `` `:"#{name.underscore}_search_data"` (computed) ``), where it printed
+  `[INFERRED]` (six times in Discourse's CLAUDE.md). No tool reads it as a
+  literal: `rails_dependency_graph` draws no node for it,
+  `rails_generate_test` writes no matcher for it, where it wrote a spec that
+  did not pass, and the related-model and N+1 checks name no model for it. A
+  computed `class_name` or `through:` prints its source too.
+- **A `class_name` written with a leading `::` names the class it names**
+  (`class_name: "::Token::API"`), in every tool and generated file.
+- **The generated files rank "Key models" by association count**, most
+  connected first and then by name, through the same function `rails_onboard`
+  uses, and the heading says so. A subclass ranks by the associations it adds
+  to its parent, so one that only repeats them sinks and one with many of its
+  own (OpenProject's `User`) stays: Huginn's list was `Agent` and 14 of its
+  subclasses, with no `User`, `Event` or `Scenario`, and Discourse's was
+  headed by `Chat::NullUser`. They listed the first 15 by name, and
+  `rails_onboard` broke ties in file order.
+- **The controller count beside a route count reads "routed controllers"** in
+  CLAUDE.md, AGENTS.md, `rails_onboard` and `rake ai:inspect`, since it counts
+  the controllers the routes name, not the controller files.
+- **A Stimulus controller is named by its Stimulus identifier**, from its path
+  under the `controllers` directory (`users--tools--ajax`), and a lookup takes
+  the identifier, the file path with slashes or underscores, or the file name
+  (`ajax_controller.js`), a file name several controllers share listing them
+  all. Its "Used in" list reads the same files that confirm a name, views
+  first. Outside the rails-new `app/javascript/controllers` home the app's own
+  loader decides the name, so a name the app registers in its JavaScript
+  (`application.register("x", Klass)`, `preregister('x', Klass)`, literal
+  strings, the class as the whole argument, a module imported through the
+  app's alias table in tsconfig or jsconfig `compilerOptions.paths`, read
+  through `extends`, or a literal vite, webpack or rspack `resolve.alias`
+  (matched as the bundlers match, an exact key exact), test files not counted)
+  is used, and otherwise a derived name is checked against the identifiers the
+  app writes in any template or Ruby file under its code roots and `lib`
+  (`data-controller`, a target, an action, a `content_controller`-style
+  helper, a `data: { controller: }` hash in a component, form object or model)
+  and takes the one they use; one nothing confirms carries a note that it is
+  inferred. No two controllers share an identifier across code roots: an
+  in-repo plugin's `foo_controller.js` beside the app's reads `chat--foo`,
+  marked inferred. A controller the app registers from an installed package
+  (Errbit's `reveal` from `@stimulus-components/reveal`) is listed as
+  registered from that package, where `rails_get_stimulus` said none while
+  `rails_get_view` showed it. OpenProject's 161 read the names its code writes
+  (`admin--custom-fields`, not the path's `dynamic--admin--custom-fields`),
+  and the few nothing confirms are marked inferred, named by their directory's
+  rule when the app shows one (a loader importing the directory by a derived
+  path, or confirmed neighbours that all drop its segment), so OpenProject's 8
+  read `generic-dialog-close`, not `dynamic--generic-dialog-close`. The empty
+  answer names the directories searched, and `rails_get_conventions` labels
+  the pattern `Stimulus controllers` with no directory after it.
+- **The frontend framework is picked by config files and component counts**, a
+  tsconfig read with its comments, trailing commas and `extends` (a `tsc
+  --init` file read `TypeScript: disabled`), and a second framework the app
+  also uses is named. An Angular app that also depends on React read as React,
+  and so did a Preact or Solid app that lists `react` for compatibility. Each
+  framework reports its own version, and a frontend root counts the components
+  its framework writes (OpenProject's `frontend` has 305 `*.component.ts`; it
+  read 3).
+- **`rails_get_test_info` names both frameworks** (`rspec, minitest`) when an
+  app runs both.
+- **The conventions' Locales line names the locales each file declares** (a
+  `validates_timeliness.en.yml` read as a locale named
+  `validates_timeliness`), a class named from the root scope (`class ::Foo`
+  inside a module) is the top-level constant, and an unread `database.yml`
+  default is never shown as another site's default.
+- **The generated files' Multi-Database section labels each adapter the way
+  every other surface does** (`PostgreSQL`, `MySQL by database.yml default`),
+  where it printed the raw adapter name, and prints `unknown` for one it
+  cannot read instead of nothing.
+- **`rails_get_partial_interface(partial:)` given a bare name that several
+  partials share lists them**, where it answered with the first by path, and a
+  call to a helper the app defines (in `app/helpers` of any code root, or a
+  module those helpers include from any autoload root; a module's class
+  methods are not helpers) is not one of a partial's locals: Discourse's
+  `layouts/head` listed `canonical_link_tag` and three more.
+- **A context run reads more of the app, for more time where there is more to
+  read.** Where a kind of code lives is resolved once per root, each file is
+  parsed once per run and answered from its stat after that, a mixin is walked
+  once for every model that includes it, and a CLI tool call loads only the
+  tool it names; none of it outlives a run, so a directory created while a
+  server runs is seen by the next one, and a file's stat stands in for reading
+  it only once the file is two seconds older than the read, so a same-size
+  edit right after a parse on a coarse Linux clock is read again. The CLI
+  picks between a built-in tool and a custom one of the same name as the MCP
+  server does: the built-in, unless `skip_tools` names it. On the static tier,
+  `context --format all` takes about the same CPU as 5.29.0 on Canvas (17.4s
+  against 18.1s), Mastodon (2.8s against 2.7s) and Errbit, a sixth more on
+  Huginn (1.1s against 1.0s), a quarter more on a private API app (3.1s
+  against 2.5s; booted 5.4s against 4.7s), where the `Services:` line reads
+  all its services, and half again on OpenProject (9.4s against 6.4s), whose
+  30 in-repo modules are now read for models, Stimulus identifiers, concerns,
+  mailers and model bases.
+- **The generated files' `Async:` line counts Sidekiq workers** beside jobs and
+  mailers, and `rails_get_job_pattern` names the directories it read under
+  every listing and also searches `app/sidekiq` for what enqueues a job. The
+  `Jobs:` line lists what the job scan found, jobs and workers alike, up to 12
+  names and a count of the rest, where it globbed `app/jobs/*.rb`.
+- **A worker entry says what a job entry says**: its line count, the
+  `retry_on` and `discard_on` it declares and what it calls. Where a base
+  class owns `perform` and the worker defines `execute`, as Discourse's jobs
+  do, `execute` is read instead.
+- **A class in a job directory that reaches neither ActiveJob nor Sidekiq but
+  defines `perform` is listed as `[unknown base]`**, as a Resque job is, and
+  counted under an `unknown` queue rather than the default one, in both tiers.
+- **A job's "Enqueued By" list names only the files that enqueue that job, and
+  every one of them.** It is read off the call nodes, with one enqueue rule
+  shared by the job and service side effects, the controller render map and
+  `rails_search_code`'s "Calls internally", so a call in a comment does not
+  count and Sidekiq's `perform_in`, `perform_at` and `perform_bulk` and
+  ActiveJob's `perform_all_later` do (a private API app listed 3 of the 6
+  files that enqueue one of its workers); a call through the app's own
+  `enqueue`, `enqueue_in` or `enqueue_at` helper counts, the job named by a
+  symbol, a string or the class (Discourse's `Jobs.enqueue(:process_post)`
+  lists `app/models/post.rb`, where Discourse jobs had no callers); all of
+  `app/` and `lib/` is searched, rake tasks, `bin/` and `script/` programs and
+  all of `db/` included, and a list capped at twenty says how many more there
+  are; a job named relative to the caller's namespace (`SyncJob` inside
+  `module Admin`, in a method or a class-body block such as a callback) is
+  credited to the job Ruby resolves it to, a compact `class A::B` nesting only
+  itself as Ruby does, not a top-level one of the same short name; and a job
+  nothing enqueues says so in one line where the section was left out. A call
+  on another job whose name ends the same way (`Admin::SyncJob.perform_async`
+  for `SyncJob`) counted, and the job's own file was left out by a substring
+  of its name, which dropped any file whose name contained it and kept the
+  job's own file under a folder spelled with an acronym; the file is now left
+  out by the constant it declares.
+- **A job shows the queue and Sidekiq options it inherits from the app's own
+  base classes**, its own settings winning key by key, each inherited one
+  named once with its base and its value when short. Diaspora's `Mail::*`
+  workers showed no queue where `Mail::NotifierBaseWorker` sets `queue: low`,
+  Mastodon's `Fasp::*` workers none where their base sets `fasp`, and
+  Whitehall's `PublishingApi*Job`s none where theirs sets `publishing_api`.
+- **A job queue computed by a block or an expression says so, with its
+  source**: `queue_as -> { ... }` read `dynamic` in the booted tier and showed
+  no queue without boot.
+- **A class is a job base only when its own chain reaches ActiveJob or a
+  Sidekiq mixin.** OpenProject's `Meetings::PDF::Common::Styles::Base`, a PDF
+  style class under `app/workers`, was listed as a job base.
+- **A mailer kept in `app/services` is a mailer and not also a service**, and
+  a service not found is offered the constants the files declare
+  (`ActivityPub::...`, where it offered `Activitypub::...`).
+- **A module other classes in the app include, extend or prepend is not a
+  service object**, unless it has an entry point of its own (a class method
+  other than the `included`, `extended` or `prepended` hook,
+  `module_function`, `extend self`). Whitehall's `AssetManager::ServiceHelper`
+  was listed as a service, as were 11 mixins in a private API app and 11 in
+  OpenProject; the generated `Services:` line follows.
+- **`rails_get_service_pattern` and `rails_get_helper_methods` find a service
+  or helper by the name the app writes when its path uses a registered
+  acronym.** Mastodon's 20 `ActivityPub::...` services, in `activitypub/`,
+  answered not found and suggested `Activitypub::...`.
+- **The generated files' `Services:` line reads the same scan
+  `rails_get_service_pattern` lists from**, so a service in a subdirectory, a
+  pack or an engine appears; it globbed `app/services/*.rb`, which gave a
+  private API app, whose services are all namespaced, no line at all. It and
+  the `Jobs:` line show 12 names and say how many more there are, in every
+  tier: the static tier dropped both with the conventions it cannot read.
+- **A blank name given to a by-name lookup is answered as blank**, naming what
+  the tool looks up ("The concern name is blank"), in the helper, service,
+  job, mailer, component and concern tools: Discourse's
+  `rails_get_helper_methods(helper: "")` crashed on a file named `helper.rb`.
+  A string passed on the command line or in a direct call where a tool takes a
+  list (`files`, `include`, `checks`) is a one-item list, or a list when
+  comma-separated, where it failed with `undefined method 'any?'`; over MCP
+  the schema asks for the list itself.
+- **The generated Commands section and `rails_onboard`'s Getting Started name
+  only commands the app has**, from one decision: `bin/dev` where it exists,
+  otherwise `bin/rails server`, and `bin/rails db:migrate` where the app has
+  `bin/rails` and `db/migrate`, and Getting Started builds the database from
+  the app's schema or migrations, never with `db:setup`, which also runs the
+  seeds. A private API app was told to run `bin/dev`, which it does not have.
+- **The booted schema names a bigint column `bigint`**, as `db/schema.rb`
+  does; a private API app's `filesize` column read `integer`. A PostgreSQL
+  array column keeps its array flag in both tiers and in schema hints, its
+  default read as `[]` where the booted tier printed `{}`, a booted expression
+  index reads as a key list, as the dumps give it (`rails_migration_advisor`
+  crashed on any table that has one), and schema hints print a structure.sql
+  app's primary key as `id` (a composite one as `a, b`), where Discourse's
+  read ``(pk: `["id"]`)``.
+- **Static routes read the route files `config.paths["config/routes.rb"]`
+  registers**, in order (an assignment, `<<`, `concat`, `Rails.root.join`, a
+  literal `Dir[...]` glob, kept inside the app), and name a mounted app built
+  by a call (`Flipper::UI.app`). OpenFoodNetwork read 69 of its 340 app
+  routes, and its Rswag, DfcProvider, Flipper UI and Sidekiq mounts were
+  missing. A file pulled in by `draw` is read inside the scope its `draw` sits
+  in, and again under each scope that draws it: Forem's `draw :api` inside
+  `namespace :api` put `/articles/search` under the web `articles` controller
+  without `/api`, and its v0 routes were dropped. `match ... via:` is one
+  route answering each verb it names (`GET|POST`, `ANY` for `via: :all`, a
+  `via:` from an enclosing scope too), where static routes dropped it. Routes
+  take the controller from `scope(controller:)` or their own `controller:`
+  (Canvas read 297 made-up controllers such as `accounts/:account_id`), routes
+  drawn through an app class (`ApiRouteSet::V1.draw(self)`) take the path and
+  name prefixes it returns (Canvas's 971 `/api/v1` routes), a path under an
+  optional scope is written as Rails normalizes it, and a route name another
+  file already took is left off, as Rails does; a singular `resource` names
+  its show route and a root route takes its `as:` as Rails does, an engine
+  lists what it could not expand and every path it is mounted at, a controller
+  filter lists engine rows like the app's own, and every route count says how
+  many more routes sit in engine tables.
+- **The auth section's CORS flag is the api section's decision** (a
+  commented-out `cors.rb` is not configured in either), so `.ai-context.json`
+  no longer says OpenProject has no CORS beside its `rack-cors.rb`.
+- **The locale note counts every in-repo gem, engine or plugin with
+  `config/locales`**, those without `app/` too (Discourse: 46 directories,
+  where it said 28).
+- **The booted database and connection-pool sections list replicas**
+  (`configs_for` with `include_hidden: true`), as the static tier does.
+- **`rails_security_scan` and `doctor` read the app's `Gemfile.lock` before
+  saying its bundle lacks brakeman.** `doctor` checks every file the tools
+  refuse, names each one it finds, fails on one never committed on purpose
+  that is not ignored and warns on the rest.
+- **`rails_validate` and `rails_generate_test` decide whether a controller has
+  an action with one reader**, over its ancestors, included modules,
+  `define_method` names and templates at every ancestor's view prefix; the
+  route-to-action check calls an action missing only when the app's source
+  holds every ancestor and mixin, and otherwise names the unread gem or
+  ancestor and says the action is unverified; a namespaced controller is
+  checked at all, and a route to a method ending in `?` or `!` finds it
+  (Mastodon's `requests#merged?` was flagged).
+- **An engine's root, an initializer's source and an autoload directory in the
+  context are app-relative, or the gem and version**, the gem's own
+  initializers and autoload directories are left out, and is left out rather
+  than written as an absolute path from the generating machine.
+- **Routes an app draws into an engine (`Spree::Core::Engine.routes.draw`) are
+  listed with that engine**, under the path the app mounts it at and named
+  through its route proxy (`spree.admin_orders_path`, after the mount's `as:`
+  or the engine's `engine_name`), and are not in the app's route count on
+  either tier. Booted, the listing is each mounted engine's whole table, read
+  under its mount the way `bin/rails routes` prints it; statically, it is what
+  the app's route files draw into the engine. Controller actions, route-helper
+  validation and generated tests read these routes too.
+  `rails_get_routes(controller: "spree/admin/orders")` answers with OFN's 15
+  such routes, a short name such as `orders` lists them beside the app's own
+  matches, and the listing names the 219 it draws into Spree apart, PATCH and
+  PUT merged as in the app count.
+- **A mounted app is listed once per app and path, with its path** (the
+  compact `Mounted:` line names each app once, with its path count, before its
+  five-name cap), when the mount sits in a `scope path: nil` or in both
+  branches of an `if`: Discourse's "Mounted Apps (4)" listed `Sidekiq::Web`
+  and `Logster::Web` twice each with no path.
+- **`rails_get_env` and the context file's `env` section read ENV names from
+  one scan**, and a default is redacted by the source rule, so an empty one,
+  an address, a URL or a hostname prints as written where it read
+  `[FILTERED]`, which includes the ERB in `config/database.yml` and every
+  other `config/**/*.yml`, skipping `<%#` comments. Config YAML on
+  `sensitive_patterns` is read for the names in its ERB tags only, never a
+  value or a default; credentials and keys are still never opened.
+  `rails_get_env` gains 19 names on a private API app, 13 on Mastodon
+  and 9 on Huginn (its `DATABASE_HOST`, `DATABASE_PORT`, `DATABASE_SOCKET`).
+- **A connected app with no tables yet is described as connected**, where the
+  schema note said "no DB connection, no schema.rb".
+- **`rails_security_scan` reports brakeman's error message**, where it quoted
+  the last backtrace frame.
+- **A commented-out Gemfile line is not a gem** wherever the Gemfile is read:
+  `rails_get_env`'s services, `rails_get_helper_methods` and the Mongoid check
+  read it through one AST reader.
+- **A loaded engine's model count counts models**, by the rule the models
+  section uses, where it counted every `.rb` under the engine's `app/models`:
+  Active Storage read 15 and has 3, Solid Queue read 26 and has 11.
+
+### Fixed
+
+- **The static tier lists the filters a controller's concerns declare.** An
+  `include` adds its concern's `before_action`s where the line stands, and
+  each prints the concern it came from (`_(from Localized via
+  ApplicationController)_`), in `rails_get_controllers`,
+  `rails_analyze_feature` and the generated "Global before_actions".
+  Mastodon's `AboutController` listed none of `WebAppControllerConcern`'s
+  four filters or the `set_locale` its parent's `Localized` wraps every
+  action in, and `FollowerAccountsController` had no `set_account`. An
+  included module whose file is not in the app is named as not read.
+- **An included module is found in any `app/*` directory**, as Rails autoloads
+  it, for a model as for a controller: Consul's `Budget::Investment` carries
+  the `after_save` its `Budget::Reclassification` declares, OpenProject's
+  `WorkPackage`, which read 0 validations and 17 unread concerns, reads its
+  `app/models/work_package/validations.rb`, and a model that includes a helper
+  from `app/helpers` no longer reports it as not read.
+- **A partial index prints its WHERE clause.** The static tier carries the
+  `where:` of a schema.rb index, the WHERE of a structure.sql `CREATE INDEX`
+  and the `where:` a replayed migration passes, and `rails_get_schema` and
+  `.claude/rules` print it: Forem's `canonical_url` reads `[unique where
+  (published IS TRUE)]` and Discourse's `unique_index_categories_on_slug` ends
+  `where ((slug)::text <> ''::text)`, where both read as unique over the whole
+  table; a column two partial unique indexes cover shows each condition.
+- **"Missing FK Indexes" reports a column only when an association or a
+  foreign key uses it.** Any `*_id` column whose type matched some table's
+  primary key counted, so an app with one string key reported every external
+  id: a private API app listed 111, among them `users.stripe_customer_id` and
+  integer ids other services assign. A column now counts when an association
+  names it (a `belongs_to`, a `has_many` or `has_one` from the other side, or
+  a `has_and_belongs_to_many` join table, named the way Rails names it), when
+  an `add_foreign_key` names it in schema.rb, structure.sql or the migrations,
+  or when `acts_as_tree`, `acts_as_nested_set` or `has_closure_tree` declares
+  it as the parent key. The associations are the ones the models section
+  lists, so a model's concerns and inherited bases count, and so do models
+  that subclass `ActiveRecord::Base`. Against 5.29.0: a private API app lists
+  6 where it listed 111, all six real; Mastodon 16 where it listed 20;
+  Diaspora 15 where it listed 13; OpenProject 43 where it listed 36; Discourse
+  166 where it listed 2, because its models subclass `ActiveRecord::Base` and
+  none were read before. `rails_performance_check` and the "Performance: N
+  issues detected" line in the generated files follow (135 to 30 on a private
+  API app). A `has_and_belongs_to_many` record in the models section now
+  carries a declared `join_table` and `association_foreign_key` on both tiers,
+  so a custom join table is read by name booted as well as static.
+- **The gem's own warnings never reach the JSON-RPC stream.** While the stdio
+  transport owns stdout, including while live reload starts, a warning goes to
+  stderr rather than `Rails.logger`, which an app may have pointed at stdout.
+- **CLAUDE.md, AGENTS.md and .cursorrules keep the blank lines between
+  sections.** The line cap split every line on newlines, and
+  `"".split("\n", -1)` is `[]`, so each blank separator vanished.
+- **`rails_validate` no longer pins the whole app's missing foreign-key
+  indexes on one file.** At `level: "rails"`, a model file it could not map to
+  a model matched every finding of a check that filtered on a key the
+  performance introspector never emits, so that check is gone; it never fired
+  for a mapped model. The check that reports a model's own missing
+  foreign-key index is unchanged.
+- **`rails_get_stimulus` lists HAML and Slim views under "Used in views".** It
+  only ever globbed ERB.
+- **`multi_database.replicas` lists the `replica: true` entries of
+  `config/database.yml` when the app is not booted**, where it was always
+  empty.
+- **A partial is a template.** `views.partials` listed any file or directory
+  under `app/views` whose name began with an underscore (an image named
+  `_logo.png` was a partial), and `rails_get_partial_interface` offered the
+  same names as available partials.
+- **A custom middleware reports the class its file is named for.** A helper
+  class nested in it or declared beside it could answer `has_call_method` and
+  `initializes_app` in its place.
+- **An escaped symbol reads as the characters it names.** A symbol written
+  `:"first\tname"` was reported as its raw source text, backslash and all:
+  column, index and table names, enum names, `attribute` names and types,
+  callback, association and scope names, keyword option keys and values,
+  `params.require` keys, permitted strong-params keys, `action_name ==` filter
+  conditions, CORS origins and resources, model constant arrays, route
+  `namespace` and `scope` segments, and rake task names and their arguments.
+- **`config/database.yml` is read as YAML in the static tier.** It was scanned
+  line by line, and the scan disagreed with the file format on every shape
+  that is not the generated one: an entry sharing its adapter through `<<:
+  *default` came back with only its name, a database called `replica` (as
+  Mastodon names its read replica) was read as a config key of the one before
+  it, so the primary was labelled the replica and the app read as
+  single-database, and an env given only a `url:` listed no database at all.
+  The file is now parsed by `YAML` with aliases on, after its ERB tags are
+  replaced without being run, and the databases come out of the env hash by
+  the same rule Rails applies: every value a Hash means one database per key,
+  anything else is a single primary. An adapter the file computes in ERB is
+  reported as the literal the ERB falls back to, labelled so (`MySQL by
+  database.yml default`), or as unknown when there is none; it is never picked
+  from the Gemfile when the app bundles more than one adapter gem, as Huginn
+  does. Without a committed `config/database.yml`, the adapter is read from
+  the schema first, a structure.sql dialect and then column types only one
+  database has (`jsonb`, arrays, `hstore`; `mediumtext`), then from the app's
+  `database.yml.*` example files, then the Gemfile, so Canvas reads PostgreSQL
+  where it read `PostgreSQL or SQLite`; `postgis` reads as PostgreSQL, and
+  when nothing decides, the reason names only the files the app has. With
+  nothing to decide between them, the answer names the candidates (`MySQL or
+  SQLite`, and in `rails_get_schema` `MySQL or SQLite, database.yml does not
+  say which`). A file that is not valid YAML reports no databases instead of a
+  misreading. A boot that fails part way now falls back to the file for the
+  database and replica lists, where it reported none. By the same rule, an env
+  that mixes plain keys with a nested `secondary:` hash is one database, as
+  Rails reads it, so that nested entry is no longer reported as a replica.
+- **An association reads the options of a `with_options` block around it.**
+  The static tier ignored the block, so `rails_get_model_details`,
+  `rails_dependency_graph` and `.ai-context.json` named classes the app does
+  not have (Mastodon's `EmailDomainBlock` parent and child read as `Parent`
+  and `Child`, `Appeal`'s reviewers as `ApprovedByAccount`), and
+  `rails_validate` reported a `has_many` inside `with_options dependent:
+  :destroy` as missing `:dependent`; Mastodon's `Account` drew 42 such
+  warnings. It follows ActiveSupport: a block without a parameter passes its
+  options to the associations inside it, a block with one (`do |assoc|
+  assoc.has_many ... end`) passes them only to the calls on that parameter,
+  and the association's own options still win over the block's.
+- **`rails_validate` compares an escaped symbol by its real characters.** A
+  `validates`, `permit` or callback symbol written with an escape no longer
+  reads as a missing column.
+- **`rails_get_gems` names a config file only when the app has one**, and
+  finds an initializer with a load-order prefix
+  (`config/initializers/3_omniauth.rb`, `009-omniauth.rb`). It printed
+  `config/initializers/omniauth.rb`, `config/initializers/redis.rb` and
+  `config/storage.yml` whether or not they existed.
+- **`rails_get_service_pattern` leaves concerns out.** A module under a
+  `concerns` directory at any depth of a services root, or one that extends
+  `ActiveSupport::Concern`, was counted and listed as a service object,
+  while `rails_get_concern` already listed it as a concern; the generated
+  `Services:` line follows.
+- **When no services directory is found, the answer names every place the scan
+  reads**, in-repo engines, plugins, modules and `extra_app_paths` included;
+  it named only `app/services`, packs and engines.
+- **`rails_search_code` hides a generated file the same way on both
+  backends.** Without ripgrep, the Ruby fallback matched only the exact paths
+  the installer writes, so a nested `AGENTS.md`, `CLAUDE.md`, `.cursorrules`,
+  `opencode.json` or `.ai-context.json` that ripgrep hid showed up in results.
+- **A HAML or Ruby-hash `data-controller` names its controllers.** A view
+  written `%div{ "data-controller" => "hello" }` carried no Stimulus
+  controller in `rails_get_view` or in the cross-controller composition list,
+  while the `data-controller="hello"` spelling did.
+- **A view symlinked out of `app/views` stays out of the turbo payload.** The
+  frame and stream scans already skipped one; `permanent_elements`,
+  `turbo_drive_settings` and the Turbo Native conditionals counted it.
+
+- **A `retry_on` or `discard_on` prints as one entry with its options**, in
+  the same words wherever a job or worker is listed, asked for by name, or
+  read from `.ai-context.json`, even when it is written across lines. The
+  payload's job and worker records carry one `retries` list in place of
+  `retry_on` and `discard_on`.
+- **`config/sidekiq.yml` is read as YAML**, so a path named in a comment and
+  an environment key are no longer listed as queues (OpenFoodNetwork read
+  `default, mailers, config`), and a weighted queue (`[critical, 8]`) is
+  named by its queue.
+- **A page past the end of a list says only that.** `rails_get_i18n` and
+  `rails_get_mailers` asked for such a page said the app had no locale files
+  or no mailers, beside the count that proved otherwise.
+- **`rails-ai-context tool env_config --environment production` shows that
+  environment.** The binary took the flag as `RAILS_ENV` only, so the tool
+  named it as current and listed every environment. After the name of a tool
+  that declares an `environment` parameter, the flag is now that tool's filter
+  and leaves `RAILS_ENV` alone, so a booted app is not booted into an
+  environment it has no database for (`--environment prod` exited 1 with "The
+  `prod` database is not configured" and now answers "Did you mean
+  'production'?"); `RAILS_ENV` stays settable through the variable, or with
+  `--environment` before the command name.
+- **The route total agrees across surfaces.** `.ai-context.json` and the
+  generated files counted one route twice where two controllers answer on
+  the same path and action (Forem's two API versions), so they read 769
+  beside `rails_get_routes`' 765 plus 3 framework routes.
+- **A share short of the whole never prints as 100%.** Translation coverage,
+  the doctor readiness score, connection-pool use and the cache hit rate are
+  floored, so a locale missing one key reads `99.9%` where it read `100.0%`
+  beside the line naming the missing key.
+- **An authorization library is named only when the app bundles it.** A
+  bare `app/policies` directory reads "policies in app/policies" with the
+  policy classes listed, and an `Ability` class without cancancan is named
+  as that file, where OpenProject, which bundles neither, read
+  `Auth: Pundit`.
+- **A Brakeman finding from `rails_validate` prints under the file it
+  belongs to**, where every finding landed under the last file listed.
+- **The ActiveStorage stack line counts models and attachments apart** (`14
+  models with 26 attachments` on a private API app, which read `26 models with
+  attachments`).
+- **`doctor` finds the brakeman `rails_security_scan` runs**, including one
+  installed outside the app's bundle, where it said brakeman was missing
+  beside a scan that ran.
+- **`rails_get_config`'s middleware section splits the app's own classes
+  from what it adds to the stack**, the way the generated files do, where it
+  listed every gem middleware as custom.
+- **The static schema reads the migrations it was missing.** The replay
+  follows the files a migration requires under its own `db/`, an in-repo
+  engine's included (`require`, `require_relative`, `Dir[...]`, with
+  `__dir__`, `File.join`, `File.expand_path` and `Rails.root` read as literal
+  paths, never outside a `db/` directory) and replays every `db/migrate` the
+  repository owns, its in-repo engines' included. A `create_table` that names
+  its table through its class takes the file's name when a class declared
+  there agrees (an acronym the app inflects, such as `OAuth`, included), a
+  call to a `create_table` wrapper the migrations define is read as one, and
+  an index the migration leaves unnamed takes the name Rails gives it. A
+  reference (`t.references`, `t.belongs_to`, `add_reference`) gets the index
+  Rails gives it and a polymorphic one its type column, a column declared with
+  `index:` gets its index, an explicit `type:` gives the reference its type,
+  and `rename_column` and `rename_table` rename the indexes Rails named for
+  them. A reference's index follows the Rails version its migration names (a
+  polymorphic pair's name changed in 6.1; a 4.2 migration adds none unless
+  asked), and a column whose name is computed is left out and counted. The
+  replay reads `remove_reference`, `remove_index`, `remove_foreign_key` and
+  `remove_columns` by Rails' own lookup (a dropped column takes its indexes
+  and foreign key), applies `change_table` to the table it names, where a
+  column it added could land on the last table the file created, replays a
+  migration's private methods where `up` or `change` calls them, reads
+  `db/post_migrate`, and replays a helper from an included module when its
+  body is one schema statement, counting any other helper call (and a class
+  method on the app's own constants, such as a column dropper) in the note. A
+  positional `change_column_default :t, :col, value` is read as well as the
+  `from:`/`to:` form. `create_join_table` called on the migration object a
+  table file is given is replayed; `t.timestamps` and `add_timestamps` keep
+  `null:` and `default:`, a `create_table` block's `t.timestamps index: true`
+  gives Rails' two indexes, and timestamps allow NULL in a migration older
+  than 5.0; a proc default reads as its source, as schema.rb and structure.sql
+  give it. `rails_get_schema` prints where the answer came from at every
+  detail level, including how many names were read from files and how many
+  `create_table` calls stayed unnamed. OpenProject goes from 37 tables and 39
+  indexes to 208 and 556, and `rails_get_schema(table: "work_packages")`
+  answers where it said the table did not exist.
+- **A route target with a leading slash is absolute**, as Rails reads it:
+  OpenProject's `controller: "/admin/settings/..."` inside its admin
+  namespaces read `admin/settings/admin/settings/...`.
+- **`app/concerns` is read as a concerns directory**, in the root tree, packs
+  and in-repo engines, as Rails autoloads it. Huginn keeps its model concerns
+  there and read 1 concern where it has 28, and `rails_get_model_details`
+  called 8 of `Agent`'s concerns unread; `rails_get_concern(type: "other")`
+  lists them. `type:` takes every type the listing prints, in either spelling
+  (`service`, `LibStatic`), and only types that hold a concern are listed, and
+  a type the app lacks is answered with the ones it has, where the CLI dropped
+  such a value and listed every concern. A module a concern declares inside
+  itself and mixes in (`DryRunnable::Wrapper`) is looked up from the enclosing
+  namespace outward, and a mixin in an autoload root the app declares
+  (`autoload_lib`, `autoload_paths`) is read like any concern, so Discourse's
+  `RateLimiter::OnCreateRecord` adds its callbacks to `Post` and `Topic`. A
+  macro, callback or mixin inside a method of such a module applies only to
+  the classes that call that method, in their own body or through a concern's
+  `included do` block, as at runtime: every OpenProject model that includes
+  the module holding `acts_as_watchable` would otherwise show `watchers` and
+  `favorites`. The macros are read with the call's literal arguments (a
+  parameter the method reassigns or a block shadows keeps its own value),
+  taking the `if`, `unless` or `case` branch they decide (a private API app's
+  own macro called with `:picture, has_one: true` gives `has_one :picture`,
+  not a `name` pair); a declaration only a condition the literals cannot
+  decide holds is not listed or counted, and is named with its condition under
+  "Only under a condition the source does not decide" (OpenProject's
+  `WorkPackage` showed a `has_many custom_comments` it does not have). A
+  called method the reader cannot read costs only itself, named as unread; a
+  literal hash argument binds as keywords (`validates_translation :summary,
+  presence: true`) and is read through `merge`, `slice`, `except` and
+  `reject`, so Consul's translated validations read as `presence` and `length`
+  under their condition, an unused `options = {}` no longer swallows the next
+  declaration, a parameter reassigned in a block keeps its own value, and what
+  a macro method declares inside a block it evaluates on another receiver
+  (`translation_class.instance_eval { validates ... }`) is named under
+  "Declared on another class" with the condition it runs under, and not
+  counted as the model's (Consul's `Proposal` read 20 validation lines, 10 of
+  them its translation class's). What a mixin hook declares (`def
+  self.included(base)` and the like, in `class_eval`, as `base.has_many`,
+  `base.scope` or `base.delegate`, or through a helper it calls) applies to
+  every includer, each hook only for its own way of mixing in (`included` on
+  include, `prepended` on prepend, `extended` on extend). A module the app
+  mixes into `ActiveRecord::Base` or `ApplicationRecord` from an initializer,
+  `lib`, `lib_static` or a plugin's `init.rb` (a reopened class,
+  `send(:include)`, an `on_load` hook, a required file) is every model's
+  mixin, read again on each run so `watch` and the MCP server see one added
+  later, a model's own `extend` of an app module is read the same way
+  (Canvas's `resolves_root_account` gives `belongs_to :root_account`), a
+  module the model's own file declares is not reported unread (OpenProject's
+  `WorkPackage` gains `journals`, `attachments` and `custom_values`), a mixin
+  in a path gem inside the repo is read like the app's own code (Canvas's
+  `gems/broadcast_policy` and `gems/workflow`), and one from a gem installed
+  outside the repo is named as unread. One rule answers which classes mix in a
+  module, for concerns, services and join tables alike, and a subclass
+  inherits what its parent's concerns call into (OpenProject's
+  `WorkPackage::InexistentWorkPackage` lacked the `journals` its parent has).
+- **Index hints follow how an index is used**, their clauses parted by
+  semicolons so a clause listing several columns reads as one, each clause
+  printed once. A column is `[indexed]` only when it leads an index and
+  `[unique]` only when a unique index covers it alone; one that trails another
+  key reads `[in index after x]` and one in a composite unique index `[unique
+  with <partners>]`, each partner set once. Each column of a composite unique
+  index read `[unique]` and every column of a composite index `[indexed]`.
+  `rails_performance_check` uses the same rule `rails_validate` does, so a
+  foreign key that only trails another column is reported as unindexed and a
+  polymorphic pair must lead an index together, and `rails_migration_advisor`
+  warns of a duplicate index only when the name `add_index` would generate
+  exists.
+- **The `structure.sql` reader keeps an expression index key whole** and the
+  keys after it, and no longer reads `DESC`, `NULLS LAST` or an operator
+  class as a column: Discourse's `(COALESCE(parent_category_id,
+  '-1'::integer), name)` read as four columns with `name` lost. It also
+  reads each column's default, the way the `schema.rb` reader reports one
+  (a literal as its value, a cast string as the string, json and arrays as
+  Rails dumps them, an expression as `-> { "CURRENT_TIMESTAMP" }`, a serial
+  key's `nextval` as none): Discourse's schema had no default hints at all
+  and now has 583.
+- **Both search backends return the same lines.** The Ruby fallback matched
+  case-insensitively, searched only a list of extensions and read
+  `excluded_paths` as path prefixes, so on a private API app one model name
+  gave 6653 lines with ripgrep and 50113 without it. It now searches every
+  non-hidden, non-binary file, case-sensitively, and reads `excluded_paths` as
+  gitignore patterns; `search_extensions` defaults to unset and, when set,
+  still narrows the fallback.
+- **The Ruby search fallback reads what ripgrep reads, and fast.** It reads
+  the ignore files of every directory above the app (the git ones as far as
+  the nearest `.git`, a worktree's or submodule's `.git` file included),
+  matches ignore patterns case-sensitively, leaves symlinks alone, walks the
+  tree once without entering an ignored directory, and decides a binary file
+  from its first 64 KiB: 14.5 s to 2.5 s on a private API app and 27.5 s to
+  8.6 s on Canvas, with the same lines ripgrep returns. A ripgrep match in a
+  file that is not UTF-8 is reported as a match, where it came back as one
+  fake `error:0: invalid byte sequence` row.
+- **`rails_search_code` never answers "No matches" while matches exist.** A
+  `limit` smaller than one match and its context lines held only context, so
+  the page came back empty; it now starts at the next match and says so.
+- **A standalone install lets the app's `Gemfile.lock` win.** An app locking
+  an older `json` than the one this gem's dependencies pulled in failed to
+  boot and fell back to the static tier. Every gem the binstub activated for
+  itself now leaves `$LOAD_PATH` before `Bundler.setup` and comes back behind
+  the app's gems but ahead of Ruby's own lib directories, so a gem with a
+  default-gem twin (prism, json) never loads half from each; after a boot that
+  fails before the app's bundle is set up, the load path goes back to its
+  pre-boot order, and after one that fails later, such as an initializer that
+  raises, the app's bundle stays in front, so ActiveSupport finishes loading
+  and mcp never loads from two versions (every tool and the MCP server
+  answered with a load error there). When the app locks one of this gem's
+  dependencies at a version outside its requirement, a warning names it. A
+  standalone install no longer points at commands it does not have: `doctor`'s
+  fixes, the "to regenerate" line of the full-mode context files and the
+  `session_context` note name `rails-ai-context context`, `init` and `tool`
+  there, and `rails ai:context`, the install generator and `rails ai:tool`
+  where the app bundles the gem. `tool --list` honours `--no-boot`, and the
+  CLI no longer warns `could not restore gemspec(s): json-schema` on every
+  run: it re-registers the gemspecs it activated for itself rather than a
+  hand-kept list.
+- **The test framework is read from the suite the app has**: Ruby spec and
+  test files, their helpers and `spec/factories`, not from whether a `spec/`
+  directory exists. With no tests anywhere, the answer says so and names the
+  framework the bundle holds (`no tests yet (rspec-rails in the bundle)`),
+  where it said the app ran rspec or minitest. Whitehall's and Plots2's
+  `spec/` hold only JavaScript tests, so minitest apps read as RSpec and
+  `rails_generate_test` wrote them an RSpec spec. `doctor` reads the same
+  answer (`minitest test suite found`, or `No test suite found` where it said
+  `No test directory found`), and an app that runs both is told to run `bundle
+  exec rspec` where it was told `rails test`.
+- **Tests are found and written where the app keeps them.**
+  `rails_get_test_info(model:)` and `(controller:)` look in the directories
+  the app's tests live in, so Whitehall's `test/functional` and
+  `test/unit/app/models` tests are found, where the tool said "No test file
+  found" for files its own no-argument answer counted, and
+  `rails_generate_test` writes into the directory most of the app's model or
+  controller tests share, under the file-name suffix most of them use, falling
+  back to the convention when there are none, and names the subject's existing
+  test rather than writing a second one. A controller's lookup also lists the
+  system, feature, request and integration tests named for it or reaching its
+  routes, each labelled by kind (Mastodon's `AboutController` said "No test
+  file found" beside `spec/system/about_spec.rb`). A model's tests are looked
+  for only where the app keeps model tests: a private API app's
+  `rails_get_test_info(model: "User")` answered with a serializer spec sharing
+  the basename, where its model spec is `spec/models/user_model_spec.rb`. A
+  generated controller test asserts what each action answers, `create`,
+  `update` and `destroy` included, `respond_with` read by format and verb as
+  the responder answers and an early bare `return` counted as an answer (an
+  API `create` rendering `status: :created` or a `head :no_content` destroy no
+  longer gets the scaffold's redirect), read from its body and its
+  `respond_to` block for the format the test sends, the branch valid params
+  take where a save splits it (a redirect as `:redirect` with its target when
+  the test can name it, `head` as its status, a JSON or plain render with its
+  media type, a conditional or unreadable action only as not a server error,
+  with a comment saying why), where it asserted `:success` for Plots2's
+  redirecting `verify_email`. A controller under a gem's controller (Devise)
+  keeps its routed actions, unverified; RSpec controller specs include
+  `Devise::Test::ControllerHelpers` (Devise setup in `spec/support` counts), a
+  test of a Devise controller sets `devise.mapping` from Devise's route names,
+  a `Post` model gets `let(:post_record)` so the `post` request method is not
+  shadowed, a destroy test builds its record before reading its id, a redirect
+  target is asserted only when it names a route, and `rails_generate_test`
+  looks for an existing test where `rails_get_test_info` does. A namespaced
+  model is built from the controller's namespace outward (OpenFoodNetwork's
+  `LineItemsController` got a skip), an `on:` validation is checked in its
+  context and a conditioned one is skipped with its condition named, and a
+  glob segment is passed. It covers only the actions the controller has (its
+  own and inherited public actions, template-backed ones, and names a
+  `define_method` or a concern may build), naming each routed action it leaves
+  out, so a `resources` route no longer gets a `show` test for a controller
+  with no `show`. It passes every required path segment and builds its record
+  under its route parent (Whitehall's contacts under organisations raised
+  `UrlGenerationError`), leaves optional segments out, fills a custom segment
+  from the column of the same name on the record or its parent (Plots2's
+  `graph/file/:uid/:id` gets `uid: @csvfile.uid`), and skips with the segment
+  named when it cannot fill one; one written among an app's controller specs
+  is a `type: :controller` spec. A generated minitest controller test uses the
+  test class and data style (factories or fixtures) most of the app's
+  controller tests use, each test's superclass read through Prism and followed
+  through an app base class in the test tree (`::ActionController::TestCase`
+  counts), and a model's fixtures are found under its pluralized class name or
+  its `set_fixture_class` mapping (read from the test and spec helpers and
+  support files), a namespaced model's under the names Rails gives them
+  (`admin_users(:one)`, where it wrote `admin/users(:one)`): Plots2's `Node`,
+  whose table is `node`, got a TODO beside a `nodes.yml`.
+- **`rails_get_test_info` counts the examples a test file runs, and lists
+  exactly those** (`it`, `specify`, `scenario`, `test`, `def test_*`,
+  one-liners too, never a `describe` or `context` line: a private API app's
+  `User` spec read 283 tests and runs 136), `rails_onboard` counts factory
+  definitions and the files they sit in ("203 factories in 134 files", a floor
+  marked "+" where a name is computed in a loop), and a fixtures directory
+  that also holds `file_fixture` files reads "1 YAML fixture set, 485 other
+  files" where it read "1 file".
+- **`rails_get_test_info` renders each factory file's traits as a list item**
+  (`- **users.rb:** admin, with_posts`), where it printed a Ruby array.
+- **The declared Ruby version falls back to `.ruby-version` and the `ruby`
+  line of `.tool-versions`** when neither the lockfile nor the Gemfile names
+  one, and the gems payload says which source answered
+  (`declared_ruby_version_source`).
+- **The Rails version is read from `railties`** when an app bundles it without
+  the `rails` gem, as Discourse does.
+- **`--no-boot` reads the `config/database.yml` section for `RAILS_ENV` or
+  `RACK_ENV`**, where it always read `development`.
+- **Code in an in-repo engine, plugin or module is read like `app/`**:
+  models, controllers, views, concerns, services, jobs, mailers, helpers and
+  serializers under `plugins/*`, `modules/*` and `gems/plugins/*`. A view
+  there reaches `rails_get_view`, `rails_get_partial_interface`,
+  `rails_get_turbo_map` and the view lookups, and can be read by path
+  (OpenProject: 318 to 492 templates). A directory
+  counts when it has its own `app/` with a Rails directory in it and a
+  gemspec, a `plugin.rb` or an `engine.rb` says Ruby loads it. Discourse goes
+  from 223 to 359 models and OpenProject from 169 to 274, and
+  `rails_get_schema` stops calling a plugin's table model-less and pointing at
+  the Gemfile.
+- **A model reads the table prefix its namespace gives it**, from a `def
+  self.table_name_prefix` on the namespace or an engine's `isolate_namespace`,
+  as Rails' `full_table_name_prefix` does; an explicit `self.table_name =`
+  still wins, read as the literal when its only interpolations are
+  `table_name_prefix` and `table_name_suffix` (the class's own, else
+  `config.active_record`'s), and a derived name takes
+  `config.active_record.table_name_prefix` and `_suffix` when nothing nearer
+  sets one. A class nested in a concrete model takes that model's singular
+  table as a prefix, as Rails' `compute_table_name` does: OpenProject's
+  `Project::Phase` reads `project_phases` where it read `phases`, and its
+  `Principal`, `User`, `Group` and four more read `users` where they read
+  `principals`. 51 of OpenFoodNetwork's models (its Spree models and their
+  calculators) read `orders` where the table is `spree_orders`, and
+  Discourse's `DiscourseRssPolling::RssFeed` read `rss_feeds`, so
+  `rails_get_schema` called their tables model-less.
+- **`rails_get_schema` names the gem that owns a table with no model file**,
+  one line per gem the lockfile or Gemfile has (good_job, doorkeeper,
+  friendly_id, closure_tree, paper_trail, acts-as-taggable-on, pghero, the
+  Solid gems, Active Storage, Action Text, Action Mailbox, noticed,
+  delayed_job), where it listed the table as model-less. Both lists, and the
+  warning for a table with no model file, cover the whole schema at every
+  detail level, where they covered only the current page of the standard view
+  (a private API app's standard view named only one table), and `format:"json"`
+  returns them in `tables_without_model_file` and `gem_owned_tables`. A
+  `has_and_belongs_to_many` `join_table:` built from the table name prefix and
+  suffix reads as the table it names, so a join table is not called model-less
+  either.
+- **A migration's literal `execute("DROP TABLE ...")` drops the table from the
+  replayed schema**, MySQL's backtick-quoted names included. OpenProject's
+  `meeting_contents` and `meeting_content_journals` were listed, and four
+  missing-index suggestions came with them.
+- **Jobs are read from `app/jobs`, `app/workers` and `app/sidekiq` alike.** An
+  app with its workers in the Sidekiq 7 generator directory, or its ActiveJob
+  classes in `app/workers`, answered "No jobs found" (Whitehall has 31,
+  OpenProject 103 with its modules). A class is a worker when a Sidekiq mixin
+  is anywhere up its chain and a job when its chain reaches ActiveJob,
+  wherever it lives, so a Sidekiq job under `app/jobs` shows the queue its
+  `sidekiq_options` names rather than the default. An abstract base, one
+  another job inherits from and whose name says it is a base (`Jobs::Base`,
+  `ApplicationWorker`), is no longer counted as a job, in either tier. A job
+  is named by the constant its file declares
+  when that names its own namespace: Discourse's read `Regular::AnonymizeUser`
+  for `Jobs::AnonymizeUser`.
+- **A mailer is listed wherever it lives and whatever it declares.** One
+  outside `app/mailers` is found by its parent chain anywhere under `app/`
+  (Canvas keeps `Mailer < ActionMailer::Base` in `app/models` and got "_No
+  mailers found._"), a chain is followed through the app's autoload roots to
+  `ActionMailer::Base` or a gem mailer, a class under `app/mailers` whose
+  chain reaches no mailer is not one (Diaspora listed twelve header builders
+  with `Actions: set_headers`), and one with no action of its own is listed
+  with the parent it takes its actions from and any class methods it has
+  (Whitehall's `MultiNotifications`, Consul's `DeviseMailer` and Diaspora's
+  `DiasporaDeviseMailer`). A mailer a gem defines is not listed as the app's,
+  and an ActionMailer setting such as `mailer_name` is not a mailer's
+  interface.
+- **A by-name lookup answers the name it was given, or says it has no such
+  thing** and suggests the closest, by Ruby's own spell checker over full
+  names and last segments, where it offered whatever shared the first three
+  characters. `rails_get_mailers(mailer:)`,
+  `rails_get_i18n(locale:)` and `rails_get_env_config(environment:)` matched
+  substrings and answered with another thing's data under the name asked for:
+  `Mailer` got `UserMailer`'s actions, `prod` got production, and `e` got the
+  first locale by name. `rails_get_routes(controller:)` answers the
+  controller whose trailing segments the name spells, where `users` swept in
+  `admin/users/roles`, and its miss message lists at most 20 controllers.
+  `rails_get_turbo_map(controller:)` matches whole path segments, so
+  `blog_posts/` views no longer count as `posts`, and
+  `rails_get_test_info(controller:)` no longer offers a top-level request spec
+  as a namespaced controller's test. A short name two namespaces share
+  (`ReportMailer` for `Admin::ReportMailer` and `Staff::ReportMailer`) names
+  both and asks for the full one.
+- **The booted tier leaves out a model a gem defines**, wherever the bundle is
+  installed (a private app counted `PaperTrail::Version`, 139 where the static
+  tier said 138), its Concerns list is what the model's source includes and
+  what a gem macro includes into that model alone, labelled by the macro
+  (`devise :a, :b` read statically as Devise's modules), without the modules
+  gems put into every model, a booted mailer lists only the actions a mailer
+  class defines, conventions claim model concerns only from a concerns file
+  that is a module, and `rails_onboard` names Mongoid for a Mongoid app, where
+  Errbit read "on unknown".
+- **Neither tier lists a mailer's or a controller's action callbacks,
+  predicates or bang methods as actions**, nor a controller method that needs
+  an argument, which Rails could not dispatch. The booted tier listed what
+  `action_methods` returns; a private API app's `BaseController` listed its own
+  `before_action` target and a predicate. A controller lists the actions it
+  inherits from every app base, whatever the base is called and however its
+  name is qualified (OpenProject's
+  `CustomFields::Hierarchy::ItemsBaseController`, written inside
+  `Admin::Settings`), in its actions and its filter chain; an inherited public
+  method that no route names for the controller is a shared helper and not an
+  action (paper_trail's `info_for_paper_trail` read as an action of every EF
+  api controller), and an unrouted base controller lists only the actions its
+  subclasses are routed for, a controller under `app/controllers` no route
+  names lists only what it defines itself, a controller lists the public
+  actions an included app concern offers (Whitehall's
+  `Admin::ContactTranslationsController` lacked `create`, `update` and
+  `destroy`), and the booted tier drops a method that needs an argument and
+  settles inherited actions by the routes, as the static tier does; a routed
+  action with a template and no method is an action (OpenFoodNetwork's
+  `Admin::OrderCyclesController` lacked `incoming`, `outgoing` and
+  `checkout_options`); and a file under `app/controllers` not named
+  `*_controller.rb` is a controller only when it subclasses one, so
+  OpenProject's Grape API classes stay out.
+- **A Stimulus controller outside `app/javascript/controllers` is found**:
+  under `app/webpacker`, `app/frontend`, `frontend`, `client`, component
+  sidecars in `app/components`, and the same homes in packs and in-repo
+  engines and plugins, named `*_controller` or `*.controller`, in JS or TS.
+  Outside the rails-new home a file counts only when it imports from
+  `@hotwired/stimulus` or `stimulus`, or extends a class that does (an app
+  file reached relatively or through the app's alias table, or an installed
+  Stimulus package), so an AngularJS `*.controller.js`, OpenProject's Angular
+  `activity-base.controller.ts` or a React `*_controller.tsx` does not. Forem
+  read 1 of its 23, OpenFoodNetwork 0 of 73, OpenProject 0 of 161.
+- **Editing a Stimulus controller outside `app/javascript/controllers`, or a
+  job in `app/workers` or `app/sidekiq`, invalidates the cached context**, so
+  tools stop answering from stale data.
+- **The app's architecture lists `stimulus` and `hotwire` wherever it keeps its
+  Stimulus controllers.** OpenFoodNetwork and OpenProject read as having none.
+  A React component named `*_controller.tsx` still does not count.
+- **`rails_get_stimulus` counts a view as a use only when its markup names the
+  controller** in a `data-controller` attribute, a target, an action or a
+  `content_controller`-style helper. An i18n key or a word in prose with the
+  same text counted.
+- **`rails_get_turbo_map` says how many Turbo Stream responses it showed of
+  how many**, and points at `detail:"full"` for the rest, where entries
+  dropped off after 15 with no sign; one declared in a controller concern is
+  named without the `Concerns::` segment the autoload root does not carry.
+- **The generated files promise Stimulus auto-registration only where
+  stimulus-loading does it**, for controllers in `app/javascript/controllers`;
+  anywhere else they say a new controller is registered the way the
+  existing ones are.
+- **A markup comment is not markup.** A HAML `-#` comment, with the lines
+  indented under it, and an ERB `<%# %>` comment are no longer read for
+  partials, instance variables, Stimulus identifiers, slots, fields or helper
+  calls: OpenFoodNetwork's `create_linked_variant.turbo_stream.haml` listed a
+  partial named `the`, from `-# Pre-render the form`.
+- **A `render` call's partial is read with or without parentheses**, wherever
+  its keyword sits: `render(partial: 'x')`, `render 'x'`, `render(template:
+  'x')`, `render collection: @items, partial: 'x'`, the `:partial =>` form and
+  calls over several lines, in ERB, HAML and Slim; a JavaScript `.render(...)`
+  in an inline script and a partial name built at runtime are not read. A
+  `partial:` inside `locals:` or a component's constructor is not the call's
+  partial, and an escaped quote in an earlier argument no longer hides it; a
+  turbo frame id or stream name holding a comma inside a string is read whole,
+  and a Stimulus `static values` default holding a brace, a paren or a regex
+  literal is read whole, in source order. OpenFoodNetwork's views gained 51
+  partial references and Consul's 23.
+- **A layout's yields are read in ERB, HAML and Slim**: the unnamed one as
+  `(main)`, `yield(:x)`, `(yield :x).presence` and `content_for?(:x)`, read
+  only where Ruby runs (ERB tags, HAML code lines and attribute hashes, Slim
+  code and attribute values), and a `content_for` that sets content, with a
+  block or a value, parenthesised or not, is not a yield. Canvas's six layouts
+  reported none.
+- **A Stimulus action descriptor is read with its options, event filters and
+  neighbours** (`click->x#open:prevent`, `keydown.enter->`, `resize@window->`,
+  several descriptors in one `data-action`), read only from an action value (a
+  `data-action` attribute, an `action:` in a data hash, an action-named key or
+  Ruby variable such as `confirm_actions:` or `hiddenFieldAction:`), so an
+  apostrophe in page text no longer hides the actions after it, and prose, a
+  Ruby comment or a Rails route list (`%w[posts#create]`) confirms nothing,
+  where OpenFoodNetwork's `bulk-form` and `modal` uses were missed.
+- **`url_for(controller: "x")` is not a Stimulus controller** in view answers.
+- **`data-turbo` counts read the HAML and Ruby-hash spellings**
+  (`"data-turbo": "false"`, `'data-turbo' => 'false'`), not only
+  `data-turbo="false"`.
+- **A model whose `inclusion: { in: [...] }` list mixes strings with `nil` no
+  longer fails** `rails_get_model_details` and `rails_context` with
+  `ArgumentError: comparison of String with nil failed`. Whitehall's `Edition`
+  and its 13 STI subclasses failed.
+- **A validation or callback inside `with_options` carries the block's
+  options**, so a validation scoped `on: :publish` no longer reads as always
+  required, and a macro sent to the block's parameter is kept.
+- **A scope written `scope :x, lambda { ... }` or with a `do ... end` block
+  shows its body** and is marked verified where it was empty and `[INFERRED]`.
+  Every scope body prints on one line, folded the way Ruby's lexer reads its
+  newlines, a string literal written across lines respelt as the same string
+  on one line: statements are separated by `;`, a call split at the dot joins
+  back, and a comment inside it is left out. A body carrying a heredoc prints
+  as the file wrote it.
+- **A Mongoid app counts `embeds_many` and `embeds_one` as associations
+  everywhere, and lists only documents as models.** `rails_dependency_graph`
+  draws their edges, and Errbit's `App` read "1 association" beside 5 edges; a
+  plain Ruby class under `app/models` (Errbit's `ErrorReport` and `Issue`) is
+  not a model.
+- **Both tiers list every declared validation the same way, with its
+  conditions**: `validates_with`, `validates_date`, `validates_translation`
+  and the rest, each with its `if:`, `unless:` and `on:`, and the presence
+  validation Rails adds for a required `belongs_to`, marked `_(implicit from
+  belongs_to)_` by `optional:`, `required:`, `belongs_to_required_by_default`
+  (read from `config/application.rb` and every initializer) and
+  `load_defaults`; an `optional:` written as an expression prints it and makes
+  the implicit presence conditional on it, and a hand-written presence rule on
+  the same name shows in its place. A validator no source line declares is
+  listed too: the booted tier adds each reflection validator no line covers,
+  marked by what added it (`has_secure_password`, `devise :validatable`, a gem
+  module), and the static tier reads `has_secure_password` and `devise
+  :validatable` as the validators they add, `has_secure_password`'s by the
+  Rails version `Gemfile.lock` names (`length` and `confirmation` before 7.1,
+  `confirmation` from 7.1, and an assumption named when the lockfile says
+  none), so a private API app's `User` shows its password `confirmation`. A
+  validation whose attribute is computed, as in a loop, says so, and a custom
+  `validate :method` prints its `on:`, `if:` or `unless:` condition in both
+  tiers. A private API app's booted `Document` dropped its `if:` conditions
+  and printed its `validates_with` line as `document on`, the static tier
+  left `validates_with` out (Plots2's `User` read 0 validations), and a
+  hand-written presence rule on a `belongs_to` name was labelled implicit.
+- **An inheritance column set to `nil`, `false` or `:_type_disabled` reads as
+  STI off**, where the conventions claimed STI. A validator option set to
+  `false` (`presence: false`) is no validation, in both tiers; a class's own
+  `belongs_to_required_by_default` beats the app's and passes to its
+  subclasses (OpenFoodNetwork's `Subscription` showed 7 implicit presence
+  lines); a computed enum prints its source marked computed, and a frozen
+  literal one its values; and one `after_commit` declared for several events
+  is one callback showing its events.
+- **`rails_validate` judges only the `has_many` associations the model's file
+  declares**, and treats encrypted attributes (`has_encrypted`, `encrypts`,
+  `attr_encrypted`) and store keys as attributes with no column of their own,
+  so it no longer asks for `dependent:` on paper_trail's `has_many :versions`.
+- **`rails_dependency_graph` resolves an association's class from the owner's
+  namespace outward, as Rails' `compute_type` does**, a leading `::` meaning
+  top level (kept as written in both tiers), and the missing FK index check,
+  both habtm join-table readers and the counter-cache check resolve it the
+  same way; every tool that derives a model from a name spells it as the app
+  does, acronyms included (`analyze_feature` named models that do not exist);
+  two associations of one kind to one class each get an arrow labelled by
+  name; and a through association that names no association of its model, or
+  whose name is computed at run time, draws no node and is named in a note
+  saying which: Consul's `Budget` pointed at a top-level `Investment`,
+  `Ballot`, `Group` and `Heading`, and OpenFoodNetwork's `Spree::Order` at
+  `Payment`, `Shipment` and `Adjustment`. It draws a through edge per join
+  model, where Mastodon's `Account` lost its through `Follow`, `Block` and
+  `Mute` edges behind the first one; a through association with `source_type:`
+  points at the class `source_type` names; and the "pass model:" hint is left
+  out when a model was passed.
+- **A block callback a concern declares is kept beside the model's own block
+  callback of the same kind**: Discourse's `Topic` lost the `after_create do`
+  of `RateLimiter::OnCreateRecord`.
+- **A static route honours the action its `action:` option names** (`get
+  :delete, action: :deletion_dialog` read as `delete`).
+- **A component is typed by following its superclass chain through the app's
+  own base classes**, so one two or more steps from `ViewComponent::Base` or a
+  Phlex base is no longer "unknown", and a sidecar file that reopens its parent
+  namespace is named for the class the file is named for. A component nested
+  in a module is listed by its full constant (`Admin::RowComponent`, where
+  three different classes all read `RowComponent`), which renames most of
+  OpenProject's catalog.
+- **A concern that nests its own `ActiveModel::Validator` is a concern**, not
+  a validator, and every surface that lists concerns or helpers names each one
+  by the constant its file declares, in-repo plugins included (Discourse's
+  `DiscourseSubscriptions::Group` read `Group`, and
+  `rails_get_helper_methods(helper: "DiscourseChatIntegration::Helper")`
+  answered not found): `rails_get_active_support` read `Featurable` for
+  `Edition::Featurable`, and an inflected namespace (`SDG::TagList` in
+  `concerns/sdg/tag_list.rb`) is no longer spelled `Sdg::TagList`.
+- **A module that extends `ActiveSupport::Concern` is a concern wherever the
+  app autoloads it from**, and the default `excluded_concerns` patterns each
+  match a whole namespace, so an app module named only like a framework's
+  (Whitehall's `ActiveRecordLikeInterface`) is listed, not hidden; listed with
+  its path under a type naming its root (`Service Concerns`), in
+  `rails_get_concern` and `rails_get_active_support` alike: OpenProject read
+  82 concerns and has 329, Canvas 9 and 26, a private API app none and 2.
+- **A concern's includes and methods are its own body's**, not those of
+  classes nested in its file: Huginn's `LiquidDroppable` read `Includes:
+  Enumerable` and its nested `Drop` classes' `to_s`, `each` and `as_json`, and
+  `Agents::ImapFolderAgent` was credited with `Scrubbed`. A concern whose
+  methods are all private reads `0 public methods (N private)` and lists them,
+  where it read `0 methods`.
+- **A concern's "Included By" lists the classes whose `include` resolves to
+  it** from their own namespace, each once, named by its constant, searching
+  every autoload root and naming them when it finds none: Mastodon's
+  `Admin::ExportControllerConcern` listed 9 includers, 7 of them including
+  `Settings::ExportControllerConcern`, and Discourse listed
+  `SubscriptionsController` twice.
+- **Component previews are read from the directories the config sets**
+  (`view_component.previews.paths`, `preview_paths`, `preview_path`) as well
+  as the defaults, and a preview links to its component by path or by the one
+  component it renders: OpenProject read no component with a preview, and 39
+  have one.
+- **A boot error no longer repeats in full under every answer.** The footer
+  and each `[UNAVAILABLE]` note keep its first 140 characters, and the whole
+  error stays in the startup banner and `doctor`. On Discourse it was 61% of
+  the output.
+- **`rails_get_view` does not count a partial under `app/views/layouts` as a
+  layout.** Forem read 19 layouts where it has 4.
+- **An abstract base is not counted as a service, a job or a mailer.** A class
+  other classes inherit from and whose name says it is a base
+  (`ApplicationService`, `BaseService`, `Jobs::Base`, `ApplicationMailer`)
+  leaves `rails_get_service_pattern`, `rails_get_job_pattern`,
+  `rails_get_mailers` and the generated files by one rule in both tiers, and
+  one sentence above each listing names what it left out; a base answers when
+  asked for by name with what it hands down, printed without the comments
+  written inside a call and never counting a call inside a method as a
+  declaration: a job base its queue, options, retry policy, mixins, throttle
+  and callbacks, a mailer base its layout, helpers, defaults, callbacks and
+  mixins as the file writes them, and either one the methods it defines and
+  the classes that inherit it. Mastodon's generated files listed `BaseService`
+  as a service, and Consul's and OpenProject's `ApplicationMailer` helpers
+  read as emails.
+- **A class file is named by the constant it declares.** A model, job or
+  service whose file declares a namespaced constant at a path that does not
+  spell it is listed under that constant, where it was dropped or named from
+  the path: Discourse's `DiscourseGithubPlugin::GithubCommit` and six other
+  plugin models were missing, and `Jobs::DiscourseChatAddTypeField` read
+  `Onceoff::AddTypeField`.
+- **A bare superclass resolves from the enclosing namespace outward**, as
+  Ruby resolves it, so `module Bim::Bcf; class NonExistentComment < Comment`
+  inherits `Bim::Bcf::Comment`, and a class that shares a name with a model in
+  another namespace is no longer counted as a model.
+- **What a job or service hands work to is read from the call nodes**, so
+  `.run`, `.perform_now`, any bang method (`GithubBadges.grant!`), a receiver
+  written `::Fully::Qualified` and a call split across lines are listed under
+  its calls, and a call written in a comment or a string is not.
+- **`rails_get_api` reports a CORS initializer whose origins come from a block
+  or an expression**, where it said "not detected", and says when the block is
+  exactly the request `Origin` header echoed back, which allows any origin. A
+  `resource` path that is not a literal prints as its source. A CORS
+  initializer with no `allow` block is reported with the middleware it
+  inserts, or as a file whose `Rack::Cors` or `allow` block is commented out;
+  a file that only has `cors` in its name is not a CORS initializer. An `else`
+  branch reads "otherwise" and each `elsif` keeps its own condition, where a
+  private API app's second `allow` block read `* if else Rails.env.staging?`.
+- **CORS and Rack::Attack are found under the initializer name the app gave
+  them** (`rack-attack.rb`, `rack-cors.rb`, `008-rack-cors.rb`), where only
+  `cors.rb` and `rack_attack.rb` were read.
+- **A notable gem's note names a config file only when the app has it.** It
+  points at the file the app does have, or drops the clause naming the path
+  and keeps the description; it named `config/initializers/cors.rb`,
+  `app/assets/config/manifest.js` and `app/javascript/controllers/` on apps
+  without them.
+- **`rails_get_api` reads Grape versions under `app/api/v*` and `lib/api/v*`**
+  and names the directories each version came from.
+- **An ActiveRecord attribute coder in a `serializers/` directory is not
+  reported as the app's serialization layer.**
+- **GraphQL counts leave out base classes**, judged from the class the file
+  is named for rather than from a `base_` file name: a class that declares
+  `graphql_name` is concrete, and a base is one others inherit from, or one
+  named like a base that subclasses graphql-ruby and adds nothing to the
+  schema. The enums, inputs, scalars and connections that subclass
+  graphql-ruby directly still count (Canvas: 176 types, 102 mutations). An
+  app with no `queries/` directory is pointed at its query root file rather
+  than told "0 queries".
+- **Middleware changes are read wherever the app makes them**: through
+  `Rails.configuration.middleware`, `Rails.application.middleware` and
+  `app.middleware`, the app's own `MyApp::Application.config.middleware` and
+  `config.middleware` (an engine's own stack, `MyEngine.config.middleware`, is
+  left alone), with `insert`, `insert_before`, `insert_after`, `unshift`,
+  `swap`, `move_before`, `move_after` and `delete`, in `config/application.rb`
+  and `config/environments/*.rb` as well as the initializers. A class the app
+  owns is listed with its file, under the name its file declares, wherever the
+  app autoloads it from (`lib/middleware`, `app/lib/middlewares`) or wherever
+  its config or initializers declare it with a `call` method (Mastodon's
+  `TelemetryLoggingMiddleware`, Discourse's `Discourse::Cors`);
+  `config.exceptions_app` is named apart from the stack; one it does not own
+  is listed under "Stack changes from the app's config" as inserted, moved,
+  swapped in or removed, each with the file that does it. Discourse read no
+  custom middleware and 1 insertion; it has 16 classes and 27 stack changes
+  (19 inserted, 2 swapped in, 1 moved, 5 removed).
+- **The autoload roots include the ones `config/application.rb` adds**
+  (`autoload_paths`, `eager_load_paths`, `autoload_lib`, `config.paths.add`),
+  when they are written as literal paths inside the app, so a class there is
+  found as the app's own. OpenProject keeps middleware in `lib_static`.
+
+### Removed
+
+- **Internal helpers nothing in the gem called**: `DetailLevel.at_least?`,
+  `SchemaHint#verified?`, `#column_names` and `#association_names`,
+  `Fingerprinter.watched_files`, `Payload.mailer_file`,
+  `Payload.rails_engines` and `Payload.databases`, `SafePath::REFUSALS`,
+  `ViewFile::Result` (a view lookup returns `SafePath::Resolution`, which has
+  the same fields), `Introspectors::ListenerRegistration.register`,
+  `Listeners::MongoidFieldsListener` (the generic macro listener reads
+  Mongoid's macros), and `StackOverviewHelper#database_adapter_label`. None
+  was documented.
+
+### Security
+
+- **Secret files a Figaro, direnv or config-gem app keeps are refused like the
+  rest.** `config/application.yml`, `.envrc`, `config/settings.local.yml`,
+  `config/settings/*.local.yml`, `config/secrets*.yml`,
+  `config/secrets*.yml.enc`, `*.p8` and `*.env` (a compose `env_file:` such as
+  `docker/secrets.env`) join the sensitive-file list, and `rails_search_code`
+  refuses one given as its `path` (a file path is now taken, as ripgrep takes
+  it), so `rails_get_edit_context` and `rails_search_code` no longer return
+  the values in them. On a private API app both returned JWT signing secrets
+  from `config/application.yml`.
+- **The Ruby search fallback skips what ripgrep skips**: sensitive files, and
+  whatever `.ignore` and `.rgignore` files ignore, and inside a git repository
+  whatever the root and nested `.gitignore` files, `.git/info/exclude` and the
+  global excludes file ignore, with ripgrep's precedence: any `.rgignore` over
+  any `.ignore` over any `.gitignore`, then `.git/info/exclude`, then the
+  global excludes file, the deepest file deciding only within one type, and a
+  directory they ignore never entered. Without ripgrep on the PATH the
+  fallback returned lines from gitignored secret files; it now returns
+  ripgrep's rows, context lines and line cap, matching each line without its
+  newline.
+- **Every line `rails_search_code` and `rails_get_edit_context` return passes
+  through redaction, and redaction filters secrets, never code.** A string
+  literal of eight or more characters under a secret-named key (Ruby, YAML,
+  JSON written `"key":"value"`, or a setter on any receiver such as
+  `config.secret_key_base = '...'`), four or more under a password-type key
+  (`password`, `passwd`, `pass`, `pin`, `passphrase`), letters-only and
+  digits-only ones included, and the unquoted value of a secret-named
+  `NAME=value` in any file (shell, Dockerfile, compose, env or code; inside a
+  string or URL only the value is replaced, and a setter symbol, a regex
+  lookbehind or an interpolation is left alone), a value in an example file
+  (`*.example`, `*.sample`, `*.template`, and YAML ones like `*.yml.example`)
+  unless it is plainly a placeholder, a cipher key name (`cbc_key`,
+  `hmac_key`) counted as secret-named, a credential-looking value under any
+  other `*_KEY` name (a 16+ character run mixing letters and digits, or a
+  known token format, never a cache, i18n or storage key), a literal assigned
+  through `ENV["NAME"] =`, `||=` or another op-assign or held by an instance
+  variable or constant, a literal passed through a call or block that names a
+  secret (`ENV.fetch` default, `let(:api_key) { }`, `default:` under a secret
+  option), never a ternary's branches, a PGP private key block, Anthropic and
+  OpenAI keys, unless it is plainly not a credential (a message, URL, path,
+  placeholder, version, date, header, env or parameter name, or a
+  translation), and a value in a known credential format (AWS keys, JWTs,
+  vendor tokens) read `[FILTERED]` in any file; a PEM private key is filtered
+  whole, across lines too and with armor headers before its body, with the
+  line count kept, while a BEGIN marker named in a regex or string with no key
+  body after it is code. `rails_search_code` shows a match that falls only
+  inside a filtered value as the context row a wrong guess would show, so a
+  pattern cannot confirm a secret's prefix. Log lines read `NAME=value` with
+  the source pattern and decide each name and value pair once; they also
+  filter a connection URL's password and a PEM body on the lines after its
+  marker. Both tools redact the whole file before they cut a window or a row,
+  so a window or a context line inside a key still hides it. Code is returned
+  as written: a call that passes a token along (`issue(token:
+  TokenService.run(user: @user).result)`) or reads one (`password:
+  params[:password]`) is never rewritten. A `password_confirmation` literal is
+  filtered like the password, in logs and config too, and log redaction keeps
+  the quotes and the variable name around `[FILTERED]`.
+
+## [5.29.0] - 2026-09-23
+
+Twenty-three QA reports against v5.27.0, each one a wrong answer a reader
+could act on, plus what eight review rounds found in the fixes themselves.
+
+### Added
+
+- **Model payloads carry method counts and the model's own methods
+  uncapped.** `instance_method_count`, `class_method_count` and
+  `source_instance_methods` sit beside the capped `instance_methods` and
+  `class_methods` lists, on both tiers, so a reader can tell a cut list from
+  a whole one.
+- **The schema payload carries `declared_tables`**, what `db/schema.rb`
+  declares, on both tiers: nil for an app whose tables come from
+  `structure.sql` or the migrations.
+
+### Changed
+
+- **"Mounted Engines" is "Mounted Apps" everywhere it is printed**: the
+  `engines`, `routes` and `onboard` tools, the generated context files, and
+  the MCP `rails://engines` resource name. The stack overview line reads
+  `Mounted:` rather than `Engines:`. Half of what the list holds are plain
+  Rack apps. The payload key stays `mounted_engines`.
+- **A mount whose path the source does not spell out carries `path: nil`**
+  rather than the string `"unknown"`, and is printed without a path.
+- **`routes` reads a blank `controller` as no filter**, and a name that
+  normalizes to nothing (`_controller`) as matching nothing, where the empty
+  string used to match every route key.
+
+### Fixed
+
+- **A Sidekiq worker answers to its own name, and the bracket carries the
+  limit that governs it.** `job:"Billing::Invoices::CreateWorker"` answered
+  "No jobs found" for a worker the same tool had just listed, because the
+  single-job lookup read the ActiveJob list only. It reads both lists now, and
+  a name in neither is a not-found that names what exists. The listing prints
+  its "workers the introspector did not see" caveat whenever it prints
+  workers, rather than only when `config/sidekiq.yml` happens to exist, and a
+  `sidekiq_throttle` prints under the worker it throttles - 438 of 522 workers
+  on one app declared one and none of them showed it.
+- **onboard's async section reads the workers out of the hash it already
+  had.** The section counted jobs, mailers and channels, so an app whose
+  background work is 522 Sidekiq workers read as "4 mailers." and the section
+  disappeared entirely when workers were the only async code. The "not
+  covered" line no longer prints next to a worker list it contradicts.
+- **What an ActiveInteraction declares is read in one place.** A filter
+  declared inside another filter's block (`string :title` inside `hash
+  :order_params do`) is a key of that hash, not an input of the class:
+  `service_pattern` showed four inputs where `.filters` has two, and
+  `generate_test` passed the other two to `.run`, which drops them silently. A
+  subclass of the app's own base interaction is an interaction too, with its
+  parent's filters first, so `generate_test` stops emitting `.call`, which
+  `ActiveInteraction::Base` does not define. `GenericMacroListener` records
+  each call's own offset and its enclosing call's, which is what both tools
+  pair filters by.
+- **generate_test names the constant the file declares.** A path camelizes
+  through Ruby's inflector, which has not read the app's
+  `config/initializers/inflections.rb` on the static tier, so
+  `ai_reports/build.rb` gave `AiReports::Build` where the app defines
+  `AIReports::Build` - a constant nothing defines, in a spec that dies on
+  load.
+- **service_pattern looks for callers where the app keeps code.** The scan
+  named six `app/` directories, so a caller in `app/tools` or under `lib/` was
+  invisible. It reads every `app/` and `lib/` tree, plus whatever else a
+  booted app autoloads from, and says when the twenty-entry cap or its own
+  file ceiling left the list partial.
+- **schema tells a missing migration from a typo.** Booted, a table declared
+  in `db/schema.rb` and absent from the connected database answered "Did you
+  mean 'comments'?". The payload carries the declared tables beside the live
+  ones, so the answer names the migration that has not run, and the listing
+  header says the two counts disagree instead of pairing a live table count
+  with the file's version stamp.
+- **A validator under app/models/concerns is not a concern.** The type came
+  from the directory alone, so 37 `ActiveModel::Validator` subclasses on one
+  app were listed as model concerns used by nothing. They are listed as
+  validators - following the app's own validator base class, not one level of
+  compare - and looked up by the `validates_with`, or the validation option,
+  that wires them, in a model or in a concern's `included` block. The keys
+  `validates` reads for itself (`on:`, `if:` and the like) name no
+  validator.
+- **dependency_graph counts both header numbers over the same models.** The
+  model count was app-wide and the association count covered the fifty nodes
+  that survived the cap. Both are app-wide now, and the truncation note says
+  how many of the associations the cut graph draws.
+- **get_context reads the views Rails would resolve.** It handed `GetView`
+  the last segment of the controller path, so `Api::V1::Admin::OrdersController`
+  picked up `app/views/orders`, a directory of templates a background service
+  renders. The answer names the directory its views came from, and a
+  flat-directory fallback is labelled as one.
+- **analyze_feature finds a test by its path.** A spec whose feature word is a
+  directory (`spec/services/billing/invoices/create_spec.rb`) was dropped,
+  while the gap checker beside it already matched on the path. The suite's
+  own words stay out of the match - the `spec/` root, the type directory it
+  files a test under (`models/`, `requests/`), and the `_spec` suffix - so
+  `--feature models` is not every model spec.
+- **routes answers an exact controller key with its own routes.** A substring
+  filter returned a nested sibling's routes too (`api/v1/admin/orders` swept
+  in `api/v1/admin/orders/ai_data`), and `get_context` inherited it. A short
+  name still matches every controller that carries it.
+- **A template at the root of app/views is listed.** Its filename became a
+  directory group that matched nothing, so the header counted a file the body
+  never printed, and the controller-miss hint suggested a directory that does
+  not exist.
+- **A word in a quoted string is not an instance variable.** `view` reported
+  a chat handle inside a Ruby string literal as a template's ivar; the reader
+  strips string literals and keeps interpolation, in ERB tags and in the
+  Ruby template handlers (Jbuilder, Builder, `.ruby`), and `get_view`'s
+  hydrator reads through the same method. Whichever quote opens first owns
+  the literal, so an apostrophe inside `"Don't"` does not swallow the ivar
+  beside it.
+- **env_config tells a re-assignment from a tuple.** Two unconditional
+  assignments of one key rendered as `:file, :test`, which reads exactly like
+  `:mem_cache_store, { pool_size: 5 }`. The winner is named, with what it
+  overrode.
+- **env keeps one default per call site.** One label for every site said a
+  variable was optional while one of its reads was `ENV.fetch` with no
+  default, which raises `KeyError`. A fetch whose fallback is an expression
+  says its default is computed at runtime rather than claiming it has none,
+  and an `ENV["X"]` read says it is nil when unset, apart from the fetch
+  that raises.
+- **A Rack app attached with `match ... to:` is found.** `mount` is that call
+  with a name derived, and the exact-path form is what an app writes when an
+  unanchored mount would swallow a sibling path. It reaches `engines` and
+  `routes`, which names the mounted apps it counts instead of calling them
+  engine mounts, and the booted tier lists every Rack endpoint rather than
+  `Rails::Engine` subclasses alone. A mount inside a `namespace` or `scope`
+  carries that prefix; one whose enclosing scope, or its `path:`, is an expression is listed
+  with no path rather than an unprefixed one, and every list prints it
+  without one. `engines` follows every file `config/routes.rb` draws,
+  through the walk the static `routes` answer uses, so on the static tier
+  the two name one set of mounted apps; booted, `routes` reads the live
+  route table. `engines`, `onboard`, the MCP resource and the
+  generated context files head the same list "Mounted Apps", because half of
+  what it holds are not engines. On the static tier a `match ... to: SomeApp`
+  is counted once, as the mount it is, rather than also as a construct the
+  walk could not expand, and so are `get "/status" => StatusApp` and
+  `mount ActionCable.server => "/cable"`, which the walk did not see at all.
+- **config calls a zero-byte initializer empty** rather than "all commented
+  out".
+- **Smaller corrections in the same pass.** `validate_semantics` asks the
+  loaded model class before calling a callback method missing, and on the
+  static tier makes no claim once the payload's method list was cut at its
+  cap, so an inherited method past the cap is no longer reported as missing.
+  `get_controllers` points
+  `rails_get_view` at the controller's full path rather than its last segment,
+  which is the directory Rails resolves. The stack overview's `Engines:` line
+  is `Mounted:`, because half of what it lists are plain Rack apps.
+- **diagnose stops reading a display cap as a model's whole interface.** A
+  method past the thirtieth was reported as not existing, in the same answer
+  whose Method Trace printed its definition. Booted, diagnose asks the loaded
+  model class, which knows a concern's methods and a gem's as well as the
+  model's own. Statically, the model's own methods travel uncapped beside the
+  capped display list, and where a concern or a parent could define the
+  method the answer declines rather than guesses. `model_details` says how
+  many of the model's methods it is showing.
+- **A CamelCase controller name resolves everywhere.** The needle was
+  downcased without being underscored, so "GiftCards" never equalled the
+  route key's own "gift_cards": `Payload.find_controller` missed it, and every
+  tool that resolves a controller through it missed it too. One normalization
+  now serves the payload, the routes tool and the MCP resource, and the
+  resource answers a name that resolves to nothing with an error naming what
+  exists rather than a zero-route success document.
+- **security_scan runs the brakeman the machine has.** The app's bundle
+  narrows the load path, so a machine with brakeman installed was told to add
+  it to the Gemfile while the other tier scanned the same app. When the
+  in-process require fails and the gem is installed, the scan runs it as its
+  own process outside the bundle - reading the report from a file of its own,
+  since a gem manager's binstub can print to stdout first - and renders the
+  result the same way, with a line saying which brakeman answered and from
+  where. When the outside run writes no report, the answer carries the last
+  line brakeman printed about why. With no brakeman anywhere, the message
+  says that instead of guessing, and the availability answer is keyed by
+  tier rather than decided once per process.
+- **An exact search with a space keeps its context lines on ripgrep 13.**
+  The literal was escaped with Ruby's `\ `, which ripgrep 13 (Ubuntu 22.04,
+  Debian 12) rejects, so the search fell back to the Ruby scan and dropped
+  context lines and files with no listed extension. The space goes through
+  unescaped now, which both engines read the same way.
+
 ## [5.28.0] - 2026-09-22
 
 Thirty-six changes an architecture survey of v5.27.0 asked for, nine of them