ruact 0.0.4 → 0.0.6

data/spec/ruact/controller_spec.rb

@@ -30,10 +30,12 @@ module Ruact
       end
     end
 
-    # Minimal test double — `headers` + `format` needed for the methods under test.
-    # `format` must be a public struct member (not Kernel#format) so that
-    # verify_partial_doubles can stub it in #default_render tests.
-    let(:fake_request) { Struct.new(:headers, :format).new({}, nil) }
+    # Minimal test double — `headers`, `format`, and `accepts` needed for the
+    # methods under test. `format` must be a public struct member (not
+    # Kernel#format) so that verify_partial_doubles can stub it. Story 10.0:
+    # `#default_render` now keys off `request.accepts` (HTML acceptability), so
+    # `accepts` is a settable member too.
+    let(:fake_request) { Struct.new(:headers, :format, :accepts).new({}, nil, []) }
     let(:controller)   { test_class.new(fake_request) }
 
     describe "#ruact_manifest" do
@@ -71,30 +73,41 @@ module Ruact
     end
 
     describe "#default_render" do
-      let(:html_format) { Class.new { def html? = true }.new }
-      let(:json_format) { Class.new { def html? = false }.new }
-
+      # Story 10.0 — the activation predicate keys off HTML *acceptability*
+      # (`request.accepts`), not `request.format.html?`. `request.format.html?`
+      # is false for a `*/*` wildcard, which 500'd those requests pre-10.0.
       before do
         allow(controller).to receive(:ruact_template_exists?).and_return(true)
         allow(controller).to receive(:ruact_render)
       end
 
-      it "calls ruact_render when format is HTML and template exists (AC#1)" do
-        allow(fake_request).to receive(:format).and_return(html_format)
+      it "calls ruact_render when the client accepts text/html and template exists (AC#1)" do
+        fake_request.accepts = [Mime[:html]]
+        controller.send(:default_render)
+        expect(controller).to have_received(:ruact_render)
+      end
+
+      it "calls ruact_render for a */* wildcard Accept — Mime::ALL (Story 10.0 AC#1)" do
+        fake_request.accepts = [Mime::ALL]
+        controller.send(:default_render)
+        expect(controller).to have_received(:ruact_render)
+      end
+
+      it "calls ruact_render when Accept is blank (defaults to HTML) (Story 10.0 AC#1)" do
+        fake_request.accepts = []
         controller.send(:default_render)
         expect(controller).to have_received(:ruact_render)
       end
 
-      it "calls ruact_render for RSC requests (text/x-component) even without html? (AC#1)" do
-        allow(fake_request).to receive(:format).and_return(json_format)
+      it "calls ruact_render for RSC requests (text/x-component) even when HTML is unacceptable (AC#1)" do
+        fake_request.accepts = [Mime[:json]]
         fake_request.headers["Ruact-Request"] = "1"
         controller.send(:default_render)
         expect(controller).to have_received(:ruact_render)
       end
 
-      it "does NOT call ruact_render when format is not HTML and not RSC (AC#5, AC#6 — FR26)" do
-        allow(fake_request).to receive(:format).and_return(json_format)
-        allow(controller).to receive(:ruact_render)
+      it "does NOT call ruact_render for a concrete non-HTML Accept that is not RSC (AC#4 — FR26)" do
+        fake_request.accepts = [Mime[:json]]
         begin
           controller.send(:default_render)
         rescue StandardError
@@ -105,7 +118,7 @@ module Ruact
 
       it "does NOT call ruact_render when no template exists" do
         allow(controller).to receive(:ruact_template_exists?).and_return(false)
-        allow(fake_request).to receive(:format).and_return(html_format)
+        fake_request.accepts = [Mime[:html]]
         begin
           controller.send(:default_render)
         rescue StandardError
@@ -191,8 +204,11 @@ module Ruact
     end
 
     describe "#ruact_html_shell" do
-      # vite_tags requires Rails.env — stub it so we can test the shell structure.
-      before { allow(controller).to receive(:vite_tags).and_return("") }
+      # Story 14.2 — the entry `<script>` tags are emitted by the mixed-in
+      # ViewHelper#ruact_vite_tags (which needs Rails.env / a live Vite probe).
+      # Stub it to "" so we test the shell structure + the __FLIGHT_DATA script
+      # (still emitted by ruact_js_assets) in isolation.
+      before { allow(controller).to receive(:ruact_vite_tags).and_return("") }
 
       let(:payload) { "0:[\"$\",\"div\",null,{}]\n" }
 
@@ -243,6 +259,12 @@ module Ruact
         end
         let(:csrf_controller) { csrf_test_class.new(fake_request) }
 
+        # Story 14.2 — csrf_controller is a separate instance from `controller`,
+        # so the outer `before` stub does not reach it. Stub its entry-tag
+        # emission too (the real path would hit Rails.root in a non-booted env),
+        # keeping these CSRF tests order-independent.
+        before { allow(csrf_controller).to receive(:ruact_vite_tags).and_return("") }
+
         it "embeds <meta name=\"csrf-token\" content=\"...\"> when the host exposes form_authenticity_token" do
           allow(csrf_controller).to receive(:form_authenticity_token).and_return("test-csrf-token-value")
           html = csrf_controller.send(:ruact_html_shell, payload)
@@ -279,322 +301,37 @@ module Ruact
       end
     end
 
-    describe "ruact_action DSL macro (Story 8.1)", :story_8_1 do
-      # The macro is class-level. Each example builds a fresh anonymous
-      # controller class so registry state is per-example. The registry
-      # itself is reset at the top of every example via Ruact.action_registry.clear!
-      # to avoid leakage across spec runs.
-      before { Ruact.action_registry.clear! }
-
-      it "registers an action in Ruact.action_registry with the correct kind, controller, and block" do
-        klass = Class.new do
-          def self.name = "ExampleController"
-          include Ruact::Controller
-
-          ruact_action(:create_post) { |params| "created #{params[:title]}" }
-        end
-
-        entry = Ruact.action_registry.entries[:create_post]
-        expect(entry).not_to be_nil
-        expect(entry.ruby_symbol).to eq(:create_post)
-        expect(entry.js_identifier).to eq("createPost")
-        expect(entry.kind).to eq(:action)
-        expect(entry.controller).to be(klass)
-        expect(entry.block).to be_a(Proc)
-      end
-
-      it "defines the action symbol as a PUBLIC method (Rails action dispatch requires public) " \
-         "with a thread-local guard that rejects non-endpoint invocations (review-batch 1 2026-05-14)" do
-        klass = Class.new do
-          def self.name = "ExampleController"
-          include Ruact::Controller
-
-          ruact_action(:create_post) { |params| "echo #{params[:title]}" }
-        end
-
-        instance = klass.allocate
-        # Public (so ActionController#process can dispatch it through the
-        # before_action chain when scoped `only: :create_post`).
-        expect(instance.respond_to?(:create_post)).to be(true)
-        # Direct call without the thread-local sentinel raises — closes the
-        # wildcard-route exposure where a host's `get ":controller/:action"`
-        # could otherwise reach the action via GET.
-        expect { instance.send(:create_post) }.to raise_error(Ruact::Error, /can only be invoked through POST/)
-      end
-
-      it "raises ArgumentError when no block is given" do
-        expect do
-          Class.new do
-            def self.name = "BadController"
-            include Ruact::Controller
-
-            ruact_action(:create_post)
-          end
-        end.to raise_error(ArgumentError, /requires a block/)
-      end
-
-      it "raises Ruact::ConfigurationError with the AC7 prefix on invalid symbol shape" do
-        expect do
-          Class.new do
-            def self.name = "BadController"
-            include Ruact::Controller
-
-            ruact_action(:CreatePost) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError, /invalid server-function symbol :CreatePost in BadController/)
-      end
-
-      it "raises Ruact::ConfigurationError with the AC7 collision wording on within-registry duplicate js_identifier" do
-        expect do
-          Class.new do
-            def self.name = "CollidingController"
-            include Ruact::Controller
-
-            ruact_action(:foo_bar)  { |_p| nil }
-            ruact_action(:foo__bar) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError, /server-function naming collision.*"fooBar"/m)
-      end
-
-      it "raises Ruact::ConfigurationError when the symbol maps to a reserved JS word" do
-        expect do
-          Class.new do
-            def self.name = "BadController"
-            include Ruact::Controller
-
-            ruact_action(:delete) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError, /reserved/)
-      end
-
-      it "raises Ruact::ConfigurationError when the symbol clobbers a framework method " \
-         "(review-batch 1 2026-05-14)" do
-        # `:params` is defined on ActionController::Base via Metal — declaring
-        # `ruact_action :params` would override the request-params accessor.
-        expect do
-          Class.new do
-            def self.name = "BadController"
-            include Ruact::Controller
-
-            ruact_action(:params) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError, /would clobber a framework method/)
-      end
-
-      it "raises ArgumentError on a zero-arity block (review-batch 1 2026-05-14)" do
-        expect do
-          Class.new do
-            def self.name = "ExampleController"
-            include Ruact::Controller
-
-            ruact_action(:no_args) { "pong" }
-          end
-        end.to raise_error(ArgumentError, /must accept exactly one positional parameter/)
-      end
-
-      it "rejects a block with required keyword arguments (re-run-4 #4 — " \
-         "block.parameters guard catches `do |p, required:|`)" do
-        expect do
-          Class.new do
-            def self.name = "ExampleController"
-            include Ruact::Controller
-
-            ruact_action(:bad_kwargs) { |_params, required:| required }
-          end
-        end.to raise_error(ArgumentError, /no required keyword arguments/)
-      end
-
-      it "accepts optional keyword args alongside the positional (re-run-4 #4 — " \
-         "`do |params, opt: nil|` is fine)" do
-        expect do
-          Class.new do
-            def self.name = "ExampleController"
-            include Ruact::Controller
-
-            ruact_action(:opt_kwargs) { |_params, opt: nil| opt }
-          end
-        end.not_to raise_error
-      end
-
-      it "accepts a splat-arity block (do |*args|) since it tolerates one positional arg" do
-        expect do
-          Class.new do
-            def self.name = "ExampleController"
-            include Ruact::Controller
-
-            ruact_action(:splat_args) { |*args| args.first }
-          end
-        end.not_to raise_error
-      end
-
-      it "rejects a String argument (re-run-2 #4 — String key would 404 on dispatch)" do
-        expect do
-          Class.new do
-            def self.name = "BadController"
-            include Ruact::Controller
-
-            ruact_action("create_post") { |_p| nil }
-          end
-        end.to raise_error(ArgumentError, /requires a Symbol/)
-      end
-
-      it "rejects clobber of a method already defined on the host class itself " \
-         "(re-run-2 #3 — guard extended from framework methods to host methods)" do
-        expect do
-          Class.new do
-            def self.name = "BadController"
-            include Ruact::Controller
-
-            def index; end
-            ruact_action(:index) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError, /would clobber an existing method/)
-      end
-
-      it "rejects clobber of an INHERITED app helper like :current_user " \
-         "(re-run-3 #2 — guard extended from own-class to inherited app methods)" do
-        # Stand-in for `ApplicationController` defining `current_user` and
-        # subclasses inheriting it; declaring `ruact_action :current_user`
-        # would silently override the auth helper.
-        app_controller = Class.new(ActionController::Base) do
-          def current_user; end
-          def authenticate_user!; end
-        end
-        expect do
-          Class.new(app_controller) do
-            def self.name = "BadController"
-            include Ruact::Controller
-
-            ruact_action(:current_user) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError, /would clobber an inherited helper/)
-      end
-
-      it "rejects clobber of CSRF callback :verify_authenticity_token " \
-         "(re-run-5 #2 — added to FRAMEWORK_RESERVED_METHODS)" do
-        expect do
-          Class.new do
-            def self.name = "BadController"
-            include Ruact::Controller
-
-            ruact_action(:verify_authenticity_token) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError, /would clobber a framework method/)
-      end
-
-      it "rejects a block with MULTIPLE required positional parameters " \
-         "(re-run-5 #3 — `do |a, b|` silently received nil for `b`)" do
-        expect do
-          Class.new do
-            def self.name = "ExampleController"
-            include Ruact::Controller
-
-            ruact_action(:two_positional) { |_a, _b| nil }
-          end
-        end.to raise_error(ArgumentError, /must accept exactly one positional/)
-      end
-
-      it "rejects clobber of Kernel#send / Kernel#public_send " \
-         "(re-run-3 #2 — added to FRAMEWORK_RESERVED_METHODS)" do
-        expect do
-          Class.new do
-            def self.name = "BadController"
-            include Ruact::Controller
-
-            ruact_action(:send) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError, /would clobber a framework method/)
-      end
-
-      it "rejects clobber of an INHERITED ActionController::Base method like :status " \
-         "(re-run-6 #2 — denylist widened from hardcoded set to all framework methods - Object methods)" do
-        expect do
-          Class.new do
-            def self.name = "BadController"
-
-            include Ruact::Controller
+    # Story 14.2 (FR104) — the controller's HTML shell delegates its JS asset
+    # markup (entry tags + __FLIGHT_DATA) to the single
+    # Ruact::ViewHelper#ruact_js_assets implementation. No duplicated tag logic;
+    # controller output == a view helper's output (parity guards against drift).
+    describe "ruact_js_assets delegation + parity", :story_14_2 do
+      let(:payload) { "0:[\"$\",\"div\",null,{}]\n" }
 
-            ruact_action(:status) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError,
-                           /would clobber an inherited ActionController::Base method/)
+      it "delegates the JS block to ruact_js_assets (single implementation)" do
+        allow(controller).to receive(:ruact_js_assets).with(payload).and_return("<!--RUACT-JS-->".html_safe)
+        html = controller.send(:ruact_html_shell, payload)
+        expect(html).to include("<!--RUACT-JS-->")
+        expect(controller).to have_received(:ruact_js_assets).with(payload)
       end
 
-      it "rejects a LATER def that overrides a previously-registered " \
-         "ruact_action method in the same class body (re-run-6 #1 — method_added hook)" do
-        # The macro defines the action method; a later `def create_post; end`
-        # would silently shadow it, causing host_class.dispatch to skip the
-        # sentinel guard and run the user's later body. Detect at class-load
-        # time via method_added hook so the error is loud at boot.
-        expect do
-          Class.new do
-            def self.name = "BadController"
-
-            include Ruact::Controller
+      it "emits markup byte-identical to a standalone view helper (no drift)" do
+        allow(Rails).to receive(:env).and_return(ActiveSupport::StringInquirer.new("production"))
+        manifest_entry = { "file" => "bootstrap-xyz789.js" }
+        allow(controller).to receive(:vite_manifest_entry).and_return(manifest_entry)
 
-            ruact_action(:create_post) { |_p| "from macro" }
+        view = Object.new
+        view.extend(Ruact::ViewHelper)
+        allow(view).to receive(:vite_manifest_entry).and_return(manifest_entry)
 
-            def create_post
-              "from later def"
-            end
-          end
-        end.to raise_error(Ruact::ConfigurationError,
-                           /registered by `ruact_action :create_post` and then re-defined/)
+        expect(controller.send(:ruact_js_assets, payload)).to eq(view.ruact_js_assets(payload))
       end
 
-      it "preserves a pre-existing `method_added` hook on the host class " \
-         "(re-run-7 #1 — prepended Module instead of define_method clobber)" do
-        # Apps and concerns commonly install `method_added` for
-        # instrumentation, DSL bookkeeping (`attr_*` style helpers), or
-        # auditing. If the gem replaced the host's `method_added` instead
-        # of chaining through it, those concerns would stop firing as soon
-        # as the first `ruact_action` runs.
-        recorded = []
-        klass = Class.new do
-          def self.name = "ExampleController"
-
-          singleton_class.define_method(:method_added) do |meth|
-            recorded << meth
-            super(meth)
-          end
-
-          include Ruact::Controller
-
-          ruact_action(:create_post) { |_p| "from macro" }
-
-          def helper_method
-            :ok
-          end
-        end
-
-        # Both the macro-defined :create_post AND the later `def helper_method`
-        # should have been observed by the host's `method_added`.
-        expect(recorded).to include(:create_post, :helper_method)
-        # The action method is still registered and dispatch-guarded.
-        expect(klass.allocate.respond_to?(:create_post)).to be(true)
-      end
-    end
-
-    describe "ruact_action cross-controller collisions (Story 8.1 — re-run-3)" do
-      before { Ruact.action_registry.clear! }
-
-      it "raises Ruact::ConfigurationError when the SAME symbol is declared on TWO controllers " \
-         "(re-run-3 #1 — silent overwrite would route to whichever loaded last)" do
-        Class.new do
-          def self.name = "PostsController"
-          include Ruact::Controller
-
-          ruact_action(:create_post) { |_p| nil }
-        end
-
-        expect do
-          Class.new do
-            def self.name = "AdminPostsController"
-            include Ruact::Controller
-
-            ruact_action(:create_post) { |_p| nil }
-          end
-        end.to raise_error(Ruact::ConfigurationError, /declared in BOTH/)
+      it "exposes ruact_js_assets as PRIVATE on the controller (never a routable action)", :aggregate_failures do
+        expect(controller.class.public_method_defined?(:ruact_js_assets)).to be false
+        expect(controller.class.private_method_defined?(:ruact_js_assets)).to be true
+        # __ruact_component__ is likewise demoted so it is not exposed as an action.
+        expect(controller.class.public_method_defined?(:__ruact_component__)).to be false
       end
     end
   end

data/spec/ruact/doctor_spec.rb

@@ -276,6 +276,207 @@ RSpec.describe Ruact::Doctor do
     end
   end
 
+  # --- check_serialize_only (Story 13.1, AC2 + AC4) ---
+
+  describe "#check_serialize_only", :story_13_1 do
+    subject(:doctor) { described_class.new(serialize_only_root: scan_root.to_s) }
+
+    # Injectable scan root → point the tripwire at a fixture tree.
+    let(:scan_root) { Pathname.new(Dir.mktmpdir) }
+
+    after { FileUtils.rm_rf(scan_root) }
+
+    def write_source(name, content)
+      path = scan_root.join(name)
+      FileUtils.mkdir_p(path.dirname)
+      File.write(path, content)
+    end
+
+    context "with a clean tree (no inbound deserializer)" do
+      before { write_source("clean.rb", "class Foo\n  def bar = 42\nend\n") }
+
+      it "returns :pass silently" do
+        status, msg = doctor.send(:check_serialize_only)
+        expect(status).to eq(:pass)
+        expect(msg).to include("Serialize-only invariant holds")
+      end
+    end
+
+    context "with an unguarded inbound Flight deserializer" do
+      before do
+        write_source("evil.rb", "class FlightDeserializer\n  def call(body)\n    parse_flight(body)\n  end\nend\n")
+      end
+
+      it "returns :fail" do
+        status, = doctor.send(:check_serialize_only)
+        expect(status).to eq(:fail)
+      end
+
+      it "names the offending file:line and points to the ADR invariant" do
+        _, msg = doctor.send(:check_serialize_only)
+        expect(msg).to include("evil.rb:1") # first offense = the *Deserializer constant
+        expect(msg).to include("CVE-2025-55182")
+        expect(msg).to include("server-functions-api.md")
+      end
+    end
+
+    context "with a deserializer carrying the allow annotation" do
+      before do
+        annotation = ["# ruact:allow", "flight", "deserialization"].join("-")
+        write_source("guarded.rb", "def parse_flight(body) #{annotation} reviewed legacy bridge\n  body\nend\n")
+      end
+
+      it "returns :pass (the escape hatch makes it a guard, not a ban)" do
+        status, = doctor.send(:check_serialize_only)
+        expect(status).to eq(:pass)
+      end
+    end
+
+    context "with a signal that lives in an excluded location" do
+      before do
+        # generators' client-side templates are out of scope (browser RSC)
+        write_source("lib/generators/ruact/install/templates/app.rb", "def parse_flight(b) = b\n")
+      end
+
+      it "returns :pass (templates are excluded from the scan)" do
+        status, = doctor.send(:check_serialize_only)
+        expect(status).to eq(:pass)
+      end
+    end
+
+    context "with a `decode_flight` inbound entry point (review finding R3)" do
+      before { write_source("decoder.rb", "def decode_flight(body)\n  body\nend\n") }
+
+      it "returns :fail (decode_flight is an inbound deserialization signal)" do
+        status, = doctor.send(:check_serialize_only)
+        expect(status).to eq(:fail)
+      end
+    end
+
+    context "with a deserializer in a differently-located file ALSO named doctor.rb (review finding R1)" do
+      # Only the gem's own lib/ruact/doctor.rb is excluded (by exact path), not
+      # every basename `doctor.rb` — a nested namesake must still be scanned.
+      before { write_source("ruact/flight/doctor.rb", "class FlightDeserializer; end\n") }
+
+      it "returns :fail (basename collision is not a free pass)" do
+        status, = doctor.send(:check_serialize_only)
+        expect(status).to eq(:fail)
+      end
+    end
+  end
+
+  # --- check_flight_middleware (Story 13.1, AC3 + AC4) ---
+
+  describe "#check_flight_middleware", :story_13_1 do
+    subject(:doctor) { described_class.new }
+
+    # Plain value objects (not doubles) modelling the iterable middleware stack
+    # the check reads — each entry exposes a `.name`, mirroring a real
+    # ActionDispatch::MiddlewareStack::Middleware.
+    def middleware_entry(name)
+      Struct.new(:name).new(name)
+    end
+
+    def stub_app(stack)
+      app = Struct.new(:middleware).new(stack)
+      allow(Rails).to receive(:application).and_return(app)
+    end
+
+    context "when a response-transforming middleware (Rack::Deflater) is mounted" do
+      before { stub_app([middleware_entry("Rack::Deflater")]) }
+
+      it "returns :warn (never :fail)" do
+        status, msg = doctor.send(:check_flight_middleware)
+        expect(status).to eq(:warn)
+        expect(msg).to include("Rack::Deflater").and include("text/x-component")
+      end
+    end
+
+    context "when no response-transforming middleware is mounted" do
+      before { stub_app([middleware_entry("Rack::Runtime")]) }
+
+      it "returns :pass" do
+        status, = doctor.send(:check_flight_middleware)
+        expect(status).to eq(:pass)
+      end
+    end
+
+    context "when no Rails application is present" do
+      before { allow(Rails).to receive(:application).and_return(nil) }
+
+      it "returns :pass (guarded edge context)" do
+        status, = doctor.send(:check_flight_middleware)
+        expect(status).to eq(:pass)
+      end
+    end
+
+    context "when the app is not yet booted (middleware is a non-enumerable proxy)" do
+      # Mirrors a pre-`initialize!` Rails::Configuration::MiddlewareStackProxy,
+      # which does NOT respond to :each — must be skipped, not crash on filter_map.
+      before do
+        proxy = Object.new # responds to neither :each nor :filter_map
+        app = Struct.new(:middleware).new(proxy)
+        allow(Rails).to receive(:application).and_return(app)
+      end
+
+      it "returns :pass without raising" do
+        expect { doctor.send(:check_flight_middleware) }.not_to raise_error
+        status, = doctor.send(:check_flight_middleware)
+        expect(status).to eq(:pass)
+      end
+    end
+  end
+
+  # --- :warn status semantics (Story 13.1, AC3) ---
+
+  describe "#format_result with :warn", :story_13_1 do
+    subject(:doctor) { described_class.new }
+
+    it "renders :warn with the ⚠ glyph (not ✗)" do
+      expect(doctor.send(:format_result, :warn, "heads up")).to eq("⚠ heads up")
+    end
+  end
+
+  describe "#run with an unexpected status (review finding R1)", :story_13_1 do
+    before do
+      make_manifest
+      make_controller(with_include: true)
+      make_layout(with_sentinel: true)
+      allow(TCPSocket).to receive(:new).and_return(instance_double(TCPSocket, close: nil))
+    end
+
+    it "fails the run when a check returns a status that is neither :pass nor :warn" do
+      doctor = described_class.new
+      # All other checks pass; a malformed status (rendered ✗) must NOT be
+      # silently treated as a pass — only :pass / :warn are success.
+      allow(doctor).to receive(:check_streaming).and_return([:error, "broken status"])
+      expect(doctor.run).to be false
+    end
+  end
+
+  describe ".run with a :warn present (Story 13.1, AC3)", :story_13_1 do
+    before do
+      make_manifest
+      make_controller(with_include: true)
+      make_layout(with_sentinel: true)
+      allow(TCPSocket).to receive(:new).and_return(instance_double(TCPSocket, close: nil))
+      app = Struct.new(:middleware).new([Struct.new(:name).new("Rack::Deflater")])
+      allow(Rails).to receive(:application).and_return(app)
+    end
+
+    it "still returns true — a :warn does not fail the run" do
+      expect(described_class.run).to be true
+    end
+
+    it "prints the warning glyph" do
+      expect { described_class.run }.to output(/⚠.*Rack::Deflater/).to_stdout
+    end
+
+    it "does not print the fix hint" do
+      expect { described_class.run }.not_to output(/rails generate/).to_stdout
+    end
+  end
+
   # --- run / .run ---
 
   describe ".run / #run (AC#1, #7)" do

data/spec/ruact/erb_preprocessor_hook_spec.rb

@@ -18,7 +18,10 @@ module Ruact
     end
 
     let(:handler) { handler_class.new }
-    let(:fake_template) { Object.new }
+    # Story 13.5 — the hook now forwards +template.identifier+ into the
+    # preprocessor (for contract-violation file:line), so the stand-in template
+    # must answer +identifier+.
+    let(:fake_template) { Struct.new(:identifier).new("app/views/posts/show.html.erb") }
 
     describe "#call" do
       it "applies ErbPreprocessor.transform to source before calling super" do