rails-ai-context 5.30.2 → 5.31.0

data/lib/rails_ai_context/introspectors/model_introspector.rb

@@ -501,9 +501,10 @@ module RailsAiContext
         # and the superclasses are merged here too, or the static tier
         # out-answers this one.
         bases = booted_declaring_bases(model)
-        calls = class_calls([ model_source_path(model), *bases.map(&:last) ])
+        calls = singleton_lookup([ [ model.name, model_source_path(model) ], *bases ])
         source_data, unread, bases_unread, hidden =
-          merge_class_and_bases(own_source, model.name, calls, bases, file: model_source_path(model))
+          merge_class_and_bases(own_source, model.name, calls, bases, file: model_source_path(model),
+                                commits_in_order: booted_commits_in_order)
 
         class_methods = extract_class_methods_from_ast(model, source_data)
         instance_methods = extract_instance_methods_from_ast(model, source_data)
@@ -659,8 +660,7 @@ module RailsAiContext
           AstWalk.each(AstCache.parse_string(source).value) do |node|
             next unless node.is_a?(Prism::CallNode) && node.receiver.is_a?(Prism::SelfNode)
 
-            setting = required_default_literal(node)
-            return setting unless setting.nil?
+            return setting_value(node) if node.name == :belongs_to_required_by_default=
           end
         end
         nil
@@ -708,67 +708,79 @@ module RailsAiContext
         validator.kind == :presence && validator.options[:message] == :required
       end
 
-      # Rails' rule: an explicit optional: wins, then required:, then the app's
-      # default. An option the source cannot evaluate makes it conditional.
+      # Rails' rule: a required: key sets optional: to its negation, then a nil
+      # optional: means the app's default. An unevaluable option makes it conditional.
       def static_required_belongs_to(associations, default = belongs_to_required_by_default?)
         Array(associations).select { |a| a.is_a?(Hash) && a[:type].to_s == "belongs_to" }.filter_map do |a|
           name = a[:name].to_s
-          optional_value = a.key?(:optional) ? a[:optional] : a.dig(:options, :optional)
-          required_value = a.dig(:options, :required)
-          optional = literal_boolean(optional_value)
-          required = literal_boolean(required_value)
-          if !optional.nil? then (name unless optional)
-          elsif !optional_value.nil? then [ name, "optional: #{optional_value} is false" ]
-          elsif !required.nil? then (name if required)
-          elsif !required_value.nil? then [ name, "required: #{required_value} is true" ]
+          options = a[:options] || {}
+          optional_value = a.key?(:optional) ? a[:optional] : options[:optional]
+          if options.key?(:required)
+            required = literal_boolean(options[:required])
+            required.nil? ? [ name, "required: #{options[:required]} is true" ] : (name if required)
+          elsif !optional_value.nil?
+            optional = literal_boolean(optional_value)
+            optional.nil? ? [ name, "optional: #{optional_value} is false" ] : (name unless optional)
+          elsif default.is_a?(String) then [ name, default ]
           elsif default then name
           end
         end
       end
 
       def literal_boolean(value)
-        { true => true, false => false, "true" => true, "false" => false }[value]
+        { true => true, false => false, nil => false, "true" => true, "false" => false }[value]
       end
 
-      # The last `belongs_to_required_by_default =` Rails would run, from
-      # config/application.rb then each initializer in load order, on any
-      # receiver (`config.active_record`, `ActiveRecord::Base`); without one,
-      # Rails turns it on from `load_defaults 5.0`.
+      # Without a `belongs_to_required_by_default =` of its own, Rails turns it
+      # on from `load_defaults 5.0`. True, false, or the condition it holds under.
       def belongs_to_required_by_default?
-        return @belongs_to_required if defined?(@belongs_to_required)
-
-        root = app.root.to_s
-        paths = [ File.join(root, "config", "application.rb"),
-                  *Dir.glob(File.join(root, "config", "initializers", "**", "*.rb")).sort ]
-        setting = nil
-        version = nil
-        paths.each do |path|
-          source = SafeFile.read(path) or next
-          AstWalk.each(AstCache.parse_string(source).value) do |node|
-            next unless node.is_a?(Prism::CallNode)
-
-            if node.name == :belongs_to_required_by_default= && node.receiver
-              literal = required_default_literal(node)
-              setting = literal unless literal.nil?
-            elsif node.name == :load_defaults && path.end_with?("application.rb") && node.receiver&.slice.to_s == "config"
-              version = defaults_version(node.arguments&.arguments&.first)
+        setting = framework_setting(:belongs_to_required_by_default=, since: 5.0)
+        setting.assigned ? setting.value : setting.version.to_f >= 5.0
+      end
+
+      # `value` is the deciding assignment's setting_value when `assigned`;
+      # else `load_defaults`' `version` decides.
+      FrameworkSetting = Struct.new(:assigned, :value, :version, :read, keyword_init: true)
+
+      # Application.rb then the initializers, as Rails runs them; a `load_defaults`
+      # of version `since` or later assigns the setting too, and the last line wins.
+      def framework_setting(setter, since:)
+        @framework_settings ||= {}
+        @framework_settings[setter] ||= begin
+          root = app.root.to_s
+          application = File.join(root, "config", "application.rb")
+          setting = FrameworkSetting.new(assigned: false, read: false)
+          [ application, *Dir.glob(File.join(root, "config", "initializers", "**", "*.rb")).sort ].each do |path|
+            source = SafeFile.read(path) or next
+            setting.read ||= path == application
+            AstWalk.each(AstCache.parse_string(source).value) do |node|
+              next unless node.is_a?(Prism::CallNode)
+
+              if node.name == setter && node.receiver
+                setting.assigned = true
+                setting.value = setting_value(node)
+              elsif node.name == :load_defaults && path == application && node.receiver&.slice.to_s == "config"
+                setting.version = defaults_version(node.arguments&.arguments&.first)
+                setting.assigned = false if setting.version.to_f >= since
+              end
             end
           end
+          setting
         end
-        @belongs_to_required = setting.nil? ? version.to_f >= 5.0 : setting
       end
 
-      # The true or false a `belongs_to_required_by_default =` call assigns;
-      # nil for another call or a value the source cannot evaluate.
-      def required_default_literal(node)
-        return nil unless node.name == :belongs_to_required_by_default=
-
+      # A literal true, false or nil (false, as Rails tests for truth) as itself;
+      # any other value reads as the condition "<setting> = <expression> is true".
+      def setting_value(node)
         value = node.arguments&.arguments&.first
-        { Prism::TrueNode => true, Prism::FalseNode => false }[value.class]
+        literal = { Prism::TrueNode => true, Prism::FalseNode => false, Prism::NilNode => false }[value.class]
+        return literal unless literal.nil? && value
+
+        "#{node.name.to_s.delete_suffix('=')} = #{value.slice} is true"
       end
 
-      # A literal version as written; anything else (`Rails::VERSION::STRING.to_f`)
-      # is the running Rails, which is past 5.0.
+      # A literal version as written; anything else (`Rails::VERSION::STRING.to_f`) is the
+      # running Rails, Float::INFINITY: on for belongs_to, unknown for the commit order.
       def defaults_version(arg)
         case arg
         when Prism::FloatNode, Prism::IntegerNode then arg.value.to_f
@@ -979,15 +991,15 @@ module RailsAiContext
 
       CONDITION_KEYS = %i[if unless].freeze
 
-      # One conditions entry per callback occurrence, in step with the name list: a model can
-      # declare one method twice under different conditions.
+      # One conditions entry per callback, in step with the name list: one method can sit under
+      # two types with different conditions.
       def callback_conditions(callbacks)
         Array(callbacks).each_with_object({}) do |cb, hash|
           next unless cb.is_a?(Hash) && cb[:type]
 
-          # A plain after_commit carries the events its one declaration names.
-          keys = cb[:type].to_s == "after_commit" ? CONDITION_KEYS + [ :on ] : CONDITION_KEYS
-          conditions = (cb[:options] || {}).slice(*keys)
+          options = cb[:options] || {}
+          conditions = options.select { |key, _| CONDITION_KEYS.include?(key) }
+          conditions = { on: options[:on] }.merge(conditions) if options.key?(:on) && !Listeners::CallbacksListener.names_event?(cb[:type])
           (hash[cb[:type].to_s] ||= []) << (conditions.empty? ? nil : conditions)
         end.reject { |_, list| list.none? }
       end
@@ -1340,8 +1352,9 @@ module RailsAiContext
       def static_model_details(path, class_name, file: relative_to_root(path), table_name: nil, inherited_from: [],
                                sti: nil, parent_model: nil)
         own = own_body(source_walk(path), class_name)
-        calls = class_calls([ path, *Array(inherited_from).map(&:last) ])
-        data, unread, bases_unread, hidden = merge_class_and_bases(own, class_name, calls, inherited_from, file: path)
+        calls = singleton_lookup([ [ class_name, path ], *Array(inherited_from) ])
+        data, unread, bases_unread, hidden = merge_class_and_bases(own, class_name, calls, inherited_from, file: path,
+                                                                   commits_in_order: static_commits_in_order)
         own_methods = ActionResolver.own_methods(own[:methods], class_name)
         scope_names = Array(data[:scopes]).filter_map { |scope| scope[:name]&.to_s }.to_set
         static_instance_methods = own_methods.select { |m| m[:scope] == :instance && m[:visibility] == :public }.map { |m| m[:name].to_s }
@@ -1372,6 +1385,7 @@ module RailsAiContext
           concern_callbacks: concern_callbacks(data[:callbacks]),
           concerns_unread: (unread if unread.any?),
           bases_unread: (bases_unread if bases_unread.any?),
+          commit_order_unread: commit_order_unread(data[:callbacks]),
           conditional_declarations: declarations(data[:conditional]),
           foreign_declarations: declarations(data[:foreign]),
           macros: data[:macros],
@@ -1408,36 +1422,68 @@ module RailsAiContext
       # so on the booted tier an unread concern costs the other keys only.
       REFLECTED_CONCERN_KEYS = %i[associations validations enums].freeze
 
-      # The mixin names are in the same walk and their files are on disk, so
-      # the class's own declarations and its concerns' answer as one. Methods
-      # and mixins stay the model's own: those are its interface, not the
-      # sum of what it included.
-      # The modules mixed into every model from outside, and the app modules
-      # the class extends itself with: a macro method one of them defines is
-      # read where the class calls it. An extended module whose file is not the
-      # app's is a gem's, and a gem's macro methods are not read.
-      def class_extras(own, class_name)
-        extended = Array(own[:mixins]).filter_map do |mixin|
-          next unless mixin[:macro] == :extend && !mixin[:receiver]
-          next unless ConcernMembership.candidate?(mixin[:name])
-
-          path = ConcernPaths.find_file(app.root.to_s, mixin[:name], prefer: "model", within: class_name)
-          BaseMixins::Mixin.new(mixin[:name], path, :extend) if path
-        end
-        BaseMixins.models(app.root.to_s) + extended
+      # The walk only collects: where a declaration lands waits for every class's walk.
+      Walk = Struct.new(:own, :collected, :unread, :hidden, :skipped, :rank) do
+        def self.empty(own) = new(own, {}, [], [], Set.new, 0)
       end
 
-      def merge_concern_macros(own, class_name, calls = nil, extra: [], file: nil)
-        collected, unread, hidden, included, _placement, skipped = ConcernMacros.collect(
+      def walk_class(own, class_name, calls, extra: [], file: nil, rank: 0)
+        collected, unread, hidden, included, placement, skipped, blocks, mixed = ConcernMacros.collect(
           app.root.to_s, own[:mixins] || [],
           keys: [ *WALKED_KEYS, :expanded ], prefer: "model", within: class_name,
           cache: @source_cache, calls: calls, extra: extra, file: file
         )
-        ConcernMacros::Run.merge_calls(calls.included, included) if calls.respond_to?(:included)
-        own = without_expanded_calls(own, collected.delete(:expanded))
-        return [ own, unread, hidden, skipped ] if collected.empty?
+        included_at = included_at(own, placement)
+        every = extra.map(&:name).to_set
+        bodies = method_bodies(own)
+        mixins = mixed.map do |label, macro, defs, in_module|
+          line, order = included_at.call(label)
+          added, line = in_module || [ ConcernMacros::SingletonLookup.added_in(rank, line, bodies), line ]
+          ConcernMacros::SingletonLookup::Mixin.new(label, macro, defs, added, [ line, order ], every.include?(placement.dig(label, 0)))
+        end
+        calls.add(rank, included, blocks, mixins)
+        Walk.new(own, collected, unread, hidden, skipped, rank)
+      end
+
+      # Where a concern the walk read joins the class's chain: at the line
+      # including it, after the concerns that include brought in before it.
+      def included_at(own, placement)
+        line_of = Array(own[:mixins]).reverse.to_h { |mixin| [ mixin[:name], mixin[:location].to_i ] }
+        lambda do |name|
+          top, order = placement[name]
+          top ? [ line_of[top].to_i, order.to_i ] : [ 0, 0 ]
+        end
+      end
 
-        [ merge_inherited(own, collected), unread, hidden, skipped ]
+      # A walk's declarations where Ruby runs them: one in a method body, the class's own or a
+      # module's, once per call running that body; a concern's where its code runs.
+      def settle(walk, calls, expanded = nil)
+        own, rank = walk.own, walk.rank
+        collected = walk.collected.to_h do |key, entries|
+          [ key, entries.flat_map { |entry| place(entry, rank, calls) }.then { |found| key == :callbacks ? found : found.map { |entry| entry.except(*CHAIN_KEYS) }.uniq } ]
+        end
+        own = without_expanded_calls(own, Array(collected.delete(:expanded)) + Array(expanded))
+        callbacks = Array(own[:callbacks]).flat_map do |cb|
+          method = own_method(own, cb[:location])
+          next [ cb.merge(rank: rank) ] unless method
+          next [] unless method[:scope] == :class
+
+          calls.placed(cb, [ rank, method[:location] ], [ cb[:location] ])
+        end
+        own = own.merge(callbacks: callbacks + Array(collected.delete(:callbacks)))
+        [ collected.empty? ? own : merge_inherited(own, collected), walk.unread, walk.hidden ]
+      end
+
+      def place(entry, rank, calls)
+        entry.is_a?(Hash) ? calls.mixed_in(entry, rank) : [ entry ]
+      end
+
+      def own_method(own, line)
+        ConcernMacros.enclosing(method_bodies(own), line)&.last
+      end
+
+      def method_bodies(own)
+        Array(own[:methods]).filter_map { |m| [ m[:location]..m[:end_location], m ] if m[:location] && m[:end_location] }
       end
 
       # A `validates_translation :title` call the listener read as a validation
@@ -1457,33 +1503,111 @@ module RailsAiContext
       #
       # Each side is walked again only when the other has since learned a call
       # that releases something it held back.
-      def merge_class_and_bases(own, class_name, calls, bases, file:)
-        extra = class_extras(own, class_name)
-        mine = merge_concern_macros(own, class_name, calls, extra: extra, file: file)
+      def merge_class_and_bases(own, class_name, calls, bases, file:, commits_in_order:)
+        extra = BaseMixins.models(app.root.to_s)
+        mine = walk_class(own, class_name, calls, extra: extra, file: file)
         walked = walk_bases(bases, calls)
         ConcernMacros::MAX_DEPTH.times do
-          known = Set.new(calls.call.keys)
-          break unless mine.last.intersect?(known)
+          known = Set.new(calls.sites_by_name.keys)
+          break unless mine.skipped.intersect?(known)
 
-          mine = merge_concern_macros(own, class_name, calls, extra: extra, file: file)
-          held = walked.flat_map { |_name, base_own, *rest| base_own ? Array(rest.last).to_a : [] }.to_set
-          grown = Set.new(calls.call.keys) - known
+          mine = walk_class(own, class_name, calls, extra: extra, file: file)
+          held = walked.flat_map { |_name, walk| walk ? walk.skipped.to_a : [] }.to_set
+          grown = Set.new(calls.sites_by_name.keys) - known
           walked = walk_bases(bases, calls) if held.intersect?(grown)
         end
-        data, unread, hidden = mine
-        merge_inherited_macros(data, unread, hidden, walked)
+        declared = base_declarations(calls, [ [ class_name, file ], *bases ])
+        expanded = Array(declared.delete(:expanded)).group_by { |call| call[:rank] }
+        data, unread, hidden = settle(mine, calls, expanded[0])
+        data = merge_inherited(data, declared)
+        settled = walked.map { |name, walk| walk ? [ name, walk.own, *settle(walk, calls, expanded[walk.rank]) ] : [ name, nil ] }
+        data, *rest = merge_inherited_macros(data, unread, hidden, settled)
+        [ data.merge(callbacks: chain_order(data[:callbacks], commits_in_order)), *rest ]
+      end
+
+      CHAIN_KEYS = %i[rank chain_at hook owner].freeze
+
+      # What the class methods the app's base bodies give the class declare, at each call reaching them,
+      # with the calls read that way (`:expanded`) by the rank they stand at.
+      def base_declarations(calls, classes)
+        found = Hash.new { |hash, key| hash[key] = [] }
+        base_defs(classes).each do |node, definition|
+          next unless node.is_a?(Prism::DefNode)
+
+          sites = Array(calls.sites_by_name[definition.name]).compact
+          expansion, = ConcernMacros.expand_calls(node, sites, [ *WALKED_KEYS, :expanded ], SourceIntrospector::LISTENER_MAP) do |entry, site|
+            calls.placed(entry, definition.key, [ entry[:location] ], site)
+          end
+          expansion.each do |key, entries|
+            found[key].concat(%i[callbacks expanded].include?(key) ? entries : entries.map { |entry| entry.except(*CHAIN_KEYS) }.uniq)
+          end
+        end
+        found.to_h
+      end
+
+      # Rails builds the chain from the outermost base in, each class in the
+      # order its body runs.
+      def chain_order(callbacks, commits_in_order)
+        sorted = Array(callbacks).each_with_index.sort_by do |cb, index|
+          [ -cb[:rank].to_i, cb[:chain_at] || [ cb[:location].to_i, -1 ], index ]
+        end
+        run_order(callback_chain(sorted.map(&:first)), commits_in_order).map { |cb| cb.except(*CHAIN_KEYS) }
+      end
+
+      # A prepended callback goes to the front and after callbacks run from the
+      # back; ActiveModel prepends every after_*, after_commit only on request.
+      def run_order(callbacks, commits_in_order)
+        ordered = callbacks.dup
+        callbacks.each_index.group_by { |i| Listeners::CallbacksListener.chain_key(callbacks[i][:type]) }.each_value do |slots|
+          chain = slots.each_with_object([]) do |i, list|
+            prepended?(callbacks[i], commits_in_order) ? list.unshift(callbacks[i]) : list.push(callbacks[i])
+          end
+          chain.reverse! if Listeners::CallbacksListener.after?(callbacks[slots.first][:type])
+          slots.zip(chain) { |i, cb| ordered[i] = cb }
+        end
+        ordered
+      end
+
+      # An unknown setting keeps the transaction callbacks in declaration order.
+      def prepended?(callback, commits_in_order)
+        declared = callback.dig(:options, :prepend).to_s == "true"
+        return declared unless Listeners::CallbacksListener.after?(callback[:type])
+        return true unless Listeners::CallbacksListener.transaction?(callback[:type])
+
+        declared || commits_in_order != false
+      end
+
+      # Rails 7.0 has no setting and always runs them last declared first.
+      def booted_commits_in_order
+        ActiveRecord.respond_to?(:run_after_transaction_callbacks_in_order_defined) &&
+          ActiveRecord.run_after_transaction_callbacks_in_order_defined == true
+      end
+
+      # nil when the config cannot say: no config/application.rb, a version or
+      # a value that is not a literal. A chain order has no way to carry a condition.
+      def static_commits_in_order
+        setting = framework_setting(:run_after_transaction_callbacks_in_order_defined=, since: 7.1)
+        return (setting.value unless setting.value.is_a?(String)) if setting.assigned
+        return nil if !setting.read || setting.version == Float::INFINITY
+
+        setting.version.to_f >= 7.1
+      end
+
+      # Only a chain with two of them can be out of order.
+      def commit_order_unread(callbacks)
+        return nil unless static_commits_in_order.nil?
+
+        chains = Array(callbacks).select { |cb| Listeners::CallbacksListener.transaction?(cb[:type]) }.map { |cb| Listeners::CallbacksListener.chain_key(cb[:type]) }
+        true if chains.tally.values.any? { |count| count > 1 }
       end
 
       # Each base read with its concerns; a base's concern macro that sits in a
       # class method runs for the class that calls it, the child as often as
       # the base.
       def walk_bases(bases, calls)
-        Array(bases).map do |name, path|
+        Array(bases).each_with_index.map do |(name, path), index|
           own = sti_base_source(path)
-          next [ name, nil ] if own.nil?
-
-          own = own_body(own, name)
-          [ name, own, *merge_concern_macros(own, name, calls, file: path) ]
+          [ name, own && walk_class(own_body(own, name), name, calls, file: path, rank: index + 1) ]
         end
       end
 
@@ -1560,14 +1684,7 @@ module RailsAiContext
         # declaration: the line it was read at differs between two files, and
         # the concern tag differs between two ways of reaching one file.
         merged[:macros] = dedup(merged[:macros]) { |m| m.except(:from_concern, :location) }
-        # Rails keeps one entry for a symbol callback declared on a base and
-        # again on the child, and two validators for a validation declared
-        # twice, so these two are not deduped alike. Two blocks are two
-        # callbacks unless they are one line of one file read twice.
-        merged[:callbacks] = dedup(merged[:callbacks]) do |c|
-          block = c[:method].to_s == Listeners::CallbacksListener::INLINE_BLOCK
-          [ c[:type], c[:method].to_s, (block ? [ c[:from_concern], c[:location] ] : nil) ]
-        end
+        merged[:callbacks] = Array(inherited[:callbacks]) + Array(mine[:callbacks])
         # One source line read twice is still one declaration: a concern the
         # model and one of its bases both include is walked once per class, and
         # `included do` runs once. Two validations really written twice differ
@@ -1576,6 +1693,16 @@ module RailsAiContext
         merged
       end
 
+      SYMBOL_TARGET = /\A[a-z_]\w*[?!]?\z/
+
+      # Rails keeps the later of a symbol declared twice; two blocks stay two.
+      def callback_chain(callbacks)
+        keys = callbacks.each_with_index.map do |c, i|
+          c[:method].to_s.match?(SYMBOL_TARGET) ? [ Listeners::CallbacksListener.chain_key(c[:type]), c[:method].to_s ] : i
+        end
+        keys.zip(callbacks).reverse.uniq(&:first).reverse.map(&:last)
+      end
+
       # The model's own declaration wins: it is the one whose options the
       # class actually runs with.
       def dedup(entries)
@@ -1636,7 +1763,7 @@ module RailsAiContext
           next unless models.include?(class_name)
 
           result[class_name] = if entry[:source].include?("Mongoid::Document")
-            mongoid_model_details(entry[:source]).merge(file: relative_to_root(entry[:path]))
+            mongoid_model_details(entry[:source], class_name, entry[:path]).merge(file: relative_to_root(entry[:path]))
           else
             # This walk keeps no candidate hash, so an AR model in a
             # hybrid app gets the table it assigns itself and the derived
@@ -1704,7 +1831,8 @@ module RailsAiContext
       # A path the read could not answer falls through to the path walk, which raises. A class
       # nested in the model's file includes for itself, not for the model.
       def own_body(data, class_name)
-        data.merge(mixins: ConcernMembership.own_mixins(data[:mixins], class_name))
+        data.merge(mixins: ConcernMembership.owned_by(data[:mixins], class_name),
+                   callbacks: ConcernMembership.owned_by(data[:callbacks], class_name))
       end
 
       def source_walk(path)
@@ -1712,36 +1840,62 @@ module RailsAiContext
         source ? SourceIntrospector.walk_source(source) : SourceIntrospector.call(path)
       end
 
-      # Class methods the class and its bases call, read only when a concern asks: a macro
-      # inside `def acts_as_watchable` belongs to the models that call it.
-      #
-      # A concern's `included do` calls join the set too, so a base walked later sees them.
-      def class_calls(paths)
+      # The class files' side of the lookup, read only when a concern asks: their class-body
+      # calls and their own class methods, `alias_method` in `class << self` included.
+      def singleton_lookup(classes)
         reader = lambda do
-          paths.compact.select { |path| readable_source?(path) }.each_with_object({}) do |path, found|
+          ranks = {}
+          defs = []
+          readable = classes.each_with_index.select { |(_, path), _| path && readable_source?(path) }
+          found = readable.each_with_object({}) do |((name, path), rank), into|
             source = model_source(path)
-            tree = (source ? AstCache.parse_string(source) : AstCache.parse(path)).value
-            ConcernMacros::Run.merge_calls(found, SourceIntrospector.calls_outside_methods(tree))
+            scope = class_scope((source ? AstCache.parse_string(source) : AstCache.parse(path)).value, name)
+            own = scope.select { |node| node.is_a?(Prism::CallNode) && (node.receiver.nil? || node.receiver.is_a?(Prism::SelfNode)) }
+                       .group_by { |node| node.name.to_s }
+            own.each_value { |sites| sites.each { |site| ranks[site.__id__] = rank } }
+            defs.concat(ConcernMacros::SingletonLookup.own_defs(scope, rank))
+            ConcernMacros::Run.merge_calls(into, own)
           rescue StandardError, ScriptError => e
             # A file the walk cannot read calls nothing it can see.
             RailsAiContext.debug_fail(e, nil, label: "class calls of #{path}")
           end
+          defs.concat(base_defs(classes).map(&:last))
+          ConcernMacros::SingletonLookup::Read.new(found, ranks, defs, classes.size)
         end
-        ClassCalls.new(reader, {})
+        ConcernMacros::SingletonLookup.new(reader)
       end
 
-      # The class files' own calls are read once; the included-block calls
-      # grow as the walks read concerns.
-      ClassCalls = Struct.new(:reader, :included) do
-        def call = ConcernMacros::Run.merge_calls(ConcernMacros::Run.merge_calls({}, own), included)
+      # [node, definition] for each class method a base body outside app/models gives the class: one
+      # reopening ApplicationRecord at that base's rank, the rest at the outermost; each after its base's file.
+      def base_defs(classes)
+        application = classes.index { |name, _| name == "ApplicationRecord" }
+        BaseMixins.bodies(app.root.to_s).flat_map do |body|
+          rank = body.target == "ApplicationRecord" ? application : classes.size
+          next [] unless rank
 
-        def own
-          @own ||= reader.call
+          ConcernMacros::SingletonLookup.member_defs(body.statements, rank, body.order)
         end
       end
 
+      # The nodes the class body runs with the class as self: the node opening a
+      # method, nested class or `class << x` is there, its body is not.
+      def class_scope(tree, class_name)
+        short = class_name.to_s.split("::").last.to_s
+        roots = AstWalk.each(tree).select { |node| node.is_a?(Prism::ClassNode) && node.constant_path.slice.split("::").last.casecmp?(short) }
+        roots.empty? ? scope_nodes(tree) : roots.flat_map { |root| scope_nodes(root.body) }
+      end
+
+      def scope_nodes(node, found = [])
+        return found unless node
 
-      def mongoid_model_details(source)
+        found << node
+        case node
+        when Prism::DefNode, Prism::ClassNode, Prism::ModuleNode, Prism::SingletonClassNode then found
+        else node.child_nodes.compact.each_with_object(found) { |child, into| scope_nodes(child, into) }
+        end
+      end
+
+      def mongoid_model_details(source, class_name, path)
         data = SourceIntrospector.walk_source(source, {
           mongoid: -> { Listeners::GenericMacroListener.new(%i[field embeds_many embeds_one embedded_in store_in]) },
           associations: Listeners::AssociationsListener,
@@ -1751,6 +1905,11 @@ module RailsAiContext
           methods: Listeners::MethodsListener
         })
         macros = data[:mongoid] || []
+        calls = singleton_lookup([ [ class_name, path ] ])
+        calls.add(0, {}, {}, [])
+        own = own_body(data.merge(mixins: []), class_name)
+        # Mongoid sets after_commit without prepend, as Rails 7.0 does, so it runs last declared first.
+        callbacks = chain_order(settle(Walk.empty(own), calls).first[:callbacks], false)
         details = {
           confidence: Confidence::STATIC,
           mongoid: true,
@@ -1767,8 +1926,8 @@ module RailsAiContext
           # `callbacks.is_a?(Hash)` - so passing it through rendered "No models
           # with callbacks found" and then raised a TypeError on a Hash lookup
           # against an Array.
-          callbacks: group_callbacks_by_type(data[:callbacks]),
-          callback_conditions: callback_conditions(data[:callbacks]),
+          callbacks: group_callbacks_by_type(callbacks),
+          callback_conditions: callback_conditions(callbacks),
           methods: data[:methods]
         }
         collection = macros.find { |m| m[:macro] == :store_in }&.dig(:options, :collection)

data/lib/rails_ai_context/introspectors/source_scan.rb

@@ -80,10 +80,12 @@ module RailsAiContext
         path.delete_prefix(root + File::SEPARATOR)
       end
 
-      # Whether either spelling of a path lands inside either spelling of the
-      # root. Only one of the two holds for a symlinked pack.
+      # Either spelling may land inside the root (only one does for a symlinked
+      # pack), but a spelled ".." can climb out through a symlink, so it needs the real one.
       def under_root?(path, real, root, real_root)
-        path.start_with?(root + File::SEPARATOR) || real.start_with?(real_root + File::SEPARATOR)
+        return true if real.start_with?(real_root + File::SEPARATOR)
+
+        !path.split(File::SEPARATOR).include?("..") && File.expand_path(path).start_with?(root + File::SEPARATOR)
       end
     end
   end

data/lib/rails_ai_context/introspectors/stimulus_introspector.rb

@@ -144,7 +144,7 @@ module RailsAiContext
         # the rails-new home an app's own loader can strip a segment the path keeps.
         def identifier_for(path, js_root)
           parts = path.sub("#{js_root}/", "").split("/")
-          index = parts.rindex("controllers")
+          index = parts.index("controllers")
           stem = (index ? parts[(index + 1)..] : parts).join("/")
                    .sub(/(?:_controller|\.controller)\.\w+\z/, "")
           [ stem.gsub("/", "--").tr("_", "-"), !default_home?(path, js_root) ]
@@ -159,7 +159,7 @@ module RailsAiContext
         # controller left without a free name is qualified by its code root and marked a guess.
         def resolve_names(paths, referenced, registered = {}, root: nil, loader_dirs: [])
           derived = paths.map { |path, js_root| [ path, js_root, identifier_for(path, js_root) ] }
-                         .sort_by { |path, js_root, _| [ js_root.count("/"), path ] }
+                         .sort_by { |path, js_root, (_name, guess)| [ code_root_of(js_root).count("/"), guess ? 1 : 0, path ] }
           claimed = derived.map { |_path, _js_root, (name, _guess)| name }.to_set
           taken = Set.new
           resolved = {}
@@ -238,7 +238,7 @@ module RailsAiContext
 
         def controllers_home(path, js_root)
           parts = path.delete_prefix("#{js_root}/").split("/")
-          index = parts.rindex("controllers") or return nil
+          index = parts.index("controllers") or return nil
           File.join(js_root, *parts.first(index + 1))
         end
 
@@ -255,11 +255,20 @@ module RailsAiContext
           end
         end
 
+        def js_dir_of(js_root)
+          JS_ROOTS.find { |dir| js_root == dir || js_root.end_with?("/#{dir}") }
+        end
+
+        # The code root a JS root belongs to: `frontend` and `app/javascript` share one.
+        def code_root_of(js_root)
+          js_root.delete_suffix(js_dir_of(js_root).to_s).chomp("/")
+        end
+
         # Names for a controller whose derived one is taken: prefixed by more and more
         # of its code root (`chat--foo`, `plugins--chat--foo`), then the whole path.
         def qualified_names(name, js_root, root)
           relative = root ? js_root.delete_prefix("#{root}/") : js_root
-          js_dir = JS_ROOTS.find { |dir| relative == dir || relative.end_with?("/#{dir}") }
+          js_dir = js_dir_of(relative)
           segments = (js_dir ? relative.delete_suffix(js_dir).chomp("/") : relative).split("/").reject(&:empty?)
           segments = [ js_dir.tr("/", "-") ] if segments.empty? && js_dir
           (1..segments.size).map { |n| "#{segments.last(n).join('--')}--#{name}" } +