ruact 0.0.5 → 0.0.6

data/spec/ruact/client_manifest_spec.rb

@@ -123,6 +123,42 @@ module Ruact
       end
     end
 
+    describe "#contract_for (Story 13.5)", :story_13_5 do
+      let(:contract) { { "props" => { "postId" => "required" } } }
+
+      it "returns the optional contract Hash when present" do
+        manifest = described_class.from_hash(
+          "LikeButton" => manifest_data["LikeButton"].merge("contract" => contract)
+        )
+        expect(manifest.contract_for("LikeButton")).to eq(contract)
+      end
+
+      it "returns nil when the component declares no contract (back-compat)" do
+        manifest = described_class.from_hash(manifest_data)
+        expect(manifest.contract_for("LikeButton")).to be_nil
+      end
+
+      it "returns nil for an unknown component (never raises — fail open)" do
+        manifest = described_class.from_hash(manifest_data)
+        expect(manifest.contract_for("Nope")).to be_nil
+      end
+
+      it "honors the co-located/shared resolve_key precedence" do
+        data = dual_manifest_data.dup
+        data["posts/_like_button"] = data["posts/_like_button"].merge("contract" => contract)
+        manifest = described_class.from_hash(data)
+        expect(manifest.contract_for("LikeButton", controller_path: "posts")).to eq(contract)
+        expect(manifest.contract_for("LikeButton")).to be_nil
+      end
+
+      it "reads cleanly from a frozen manifest" do
+        manifest = described_class.from_hash(
+          "LikeButton" => manifest_data["LikeButton"].merge("contract" => contract)
+        ).freeze
+        expect(manifest.contract_for("LikeButton")).to eq(contract)
+      end
+    end
+
     describe "#reference_for closest-match suggestion (Story 7.4)" do
       let(:shared_only_manifest) { described_class.from_hash(manifest_data) }
       let(:dual_manifest)        { described_class.from_hash(dual_manifest_data) }

data/spec/ruact/component_contract_spec.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+module Ruact
+  RSpec.describe ComponentContract, :story_13_5 do
+    def validate(prop_names, contract)
+      described_class.validate(
+        component_name: "LikeButton", prop_names: prop_names, contract: contract,
+        at: { file: "app/views/posts/show.html.erb", line: 7, snippet: "<LikeButton ... />" }
+      )
+    end
+
+    describe "fail open" do
+      it "is a no-op when the contract is nil (opt-in)" do
+        expect { validate(%w[anything goes], nil) }.not_to raise_error
+      end
+    end
+
+    describe "missing required prop (AC#1, AC#3)" do
+      let(:contract) { { "props" => { "postId" => "required", "size" => "optional" } } }
+
+      it "raises ComponentContractError naming the component, file:line, prop, and a fix" do
+        expect { validate(["size"], contract) }.to raise_error(ComponentContractError) do |e|
+          expect(e.message).to include("LikeButton")
+          expect(e.message).to include("app/views/posts/show.html.erb:7")
+          expect(e.message).to include("postId")
+          expect(e.message).to include("add the required prop")
+        end
+      end
+
+      it "is a PreprocessorError (NFR30 overlay lineage)" do
+        expect { validate([], contract) }.to raise_error(PreprocessorError)
+      end
+
+      it "passes when the required prop is present" do
+        expect { validate(%w[postId size], contract) }.not_to raise_error
+      end
+    end
+
+    describe "unknown prop with did-you-mean (AC#1, AC#3)" do
+      let(:contract) { { "props" => { "postId" => "required", "initialCount" => "optional" } } }
+
+      it "raises with a Damerau-Levenshtein closest-match suggestion for a near typo" do
+        expect { validate(%w[postId postID], contract) }.to raise_error(ComponentContractError) do |e|
+          expect(e.message).to include("unknown prop")
+          expect(e.message).to include("postID")
+          expect(e.message).to include('did you mean "postId"?')
+        end
+      end
+
+      it "raises without a suggestion when nothing is close" do
+        expect { validate(%w[postId zzzzzzzz], contract) }.to raise_error(ComponentContractError) do |e|
+          expect(e.message).to include("zzzzzzzz")
+          expect(e.message).not_to include("did you mean")
+        end
+      end
+
+      it "allows undeclared props when passthrough is true" do
+        open = contract.merge("passthrough" => true)
+        expect { validate(%w[postId whatever], open) }.not_to raise_error
+      end
+
+      # Codex review (Patch 1) — a typo OF a required prop (the required name is
+      # therefore "missing") must surface the did-you-mean, not the less-helpful
+      # "missing required" message. FR100's canonical postID/postId case.
+      it "prefers the did-you-mean when the only prop is a typo of a missing required prop" do
+        expect { validate(%w[postID], contract) }.to raise_error(ComponentContractError) do |e|
+          expect(e.message).to include("unknown prop")
+          expect(e.message).to include('did you mean "postId"?')
+          expect(e.message).not_to include("missing required")
+        end
+      end
+
+      it "still reports the missing required prop when the unknown prop is NOT a near typo" do
+        expect { validate(%w[zzzzzzzz], contract) }.to raise_error(ComponentContractError) do |e|
+          expect(e.message).to include("missing required prop")
+          expect(e.message).to include("postId")
+        end
+      end
+    end
+
+    describe "slots (AC#5)" do
+      let(:contract) do
+        { "props" => { "title" => "required" }, "slots" => { "header" => "required", "footer" => "optional" } }
+      end
+
+      it "raises when a required slot is omitted" do
+        expect { validate(%w[title], contract) }.to raise_error(ComponentContractError) do |e|
+          expect(e.message).to include("missing required slot")
+          expect(e.message).to include("header")
+        end
+      end
+
+      it "treats a declared slot name as a valid attribute (not unknown)" do
+        expect { validate(%w[title header], contract) }.not_to raise_error
+      end
+
+      it "accepts the array form (all optional) and is a no-op when slots are absent" do
+        arr = { "props" => { "title" => "required" }, "slots" => %w[header footer] }
+        expect { validate(%w[title], arr) }.not_to raise_error
+      end
+
+      it "does nothing when the contract declares no slots" do
+        expect { validate(%w[title], { "props" => { "title" => "required" } }) }.not_to raise_error
+      end
+    end
+
+    describe "location formatting" do
+      it "degrades gracefully when file/line are absent" do
+        expect do
+          described_class.validate(
+            component_name: "X", prop_names: [], contract: { "props" => { "a" => "required" } }
+          )
+        end.to raise_error(ComponentContractError, /unknown location/)
+      end
+    end
+  end
+end

data/spec/ruact/configuration_spec.rb

@@ -267,7 +267,6 @@ module Ruact
         expect(config.strict_serialization).to be(false)
         expect(config.suspense_timeout).to eq(5.0)
         expect(config.vite_dev_server).to eq("http://localhost:5173")
-        expect(config.current_user_resolver).to be_nil
       end
 
       it "rejects post-boot mutation against the default-frozen instance (AC5)" do
@@ -276,39 +275,6 @@ module Ruact
       end
     end
 
-    describe "Story 8.3 — current_user_resolver attribute", :story_8_3 do
-      it "defaults to nil so apps without standalone actions never get a phantom resolver" do
-        expect(Ruact.config.current_user_resolver).to be_nil
-      end
-
-      it "accepts a lambda inside Ruact.configure and exposes it after publication" do
-        resolver = ->(env) { env["warden"]&.user }
-        Ruact.configure { |c| c.current_user_resolver = resolver }
-        expect(Ruact.config.current_user_resolver).to be(resolver)
-      end
-
-      it "is sealed by the standard freeze contract — direct mutation raises ConfigurationError" do
-        Ruact.configure { |c| c.current_user_resolver = ->(_env) {} }
-        expect { Ruact.config.current_user_resolver = ->(_env) { "other" } }
-          .to raise_error(Ruact::ConfigurationError, /Ruact::Configuration#current_user_resolver/)
-      end
-
-      it "is carried across atomic re-configuration (template clone)" do
-        first = ->(_env) { :first }
-        Ruact.configure { |c| c.current_user_resolver = first }
-        Ruact.configure { |c| c.suspense_timeout = 6.0 } # untouched
-        expect(Ruact.config.current_user_resolver).to be(first)
-      end
-
-      it "deep-freezes the resolver lambda at publication time (Story 8.3 review R6) — " \
-         "identity is preserved AND `frozen?` reports true" do
-        resolver = ->(_env) {}
-        Ruact.configure { |c| c.current_user_resolver = resolver }
-        expect(Ruact.config.current_user_resolver).to be(resolver)
-        expect(Ruact.config.current_user_resolver).to be_frozen
-      end
-    end
-
     describe "Story 8.5 — max_upload_bytes attribute", :story_8_5 do
       it "defaults to 10 MB (10 * 1024 * 1024 bytes)" do
         expect(Ruact.config.max_upload_bytes).to eq(10 * 1024 * 1024)
@@ -482,6 +448,57 @@ module Ruact
       end
     end
 
+    describe "Story 10.5 — shadcn_compatible_versions attribute", :story_10_5 do
+      it "defaults to [1, 2]" do
+        expect(Ruact.config.shadcn_compatible_versions).to eq([1, 2])
+      end
+
+      it "accepts a custom list inside Ruact.configure" do
+        Ruact.configure { |c| c.shadcn_compatible_versions = [1, 2, 3] }
+        expect(Ruact.config.shadcn_compatible_versions).to eq([1, 2, 3])
+      end
+
+      it "is sealed by the standard freeze contract — direct mutation raises ConfigurationError" do
+        Ruact.configure { |c| c.shadcn_compatible_versions = [2] }
+        expect { Ruact.config.shadcn_compatible_versions = [3] }
+          .to raise_error(Ruact::ConfigurationError, /Ruact::Configuration#shadcn_compatible_versions/)
+      end
+
+      it "deep-freezes the Array value so in-place mutation cannot bypass the writer guard" do
+        Ruact.configure { |c| c.shadcn_compatible_versions = [2] }
+        expect(Ruact.config.shadcn_compatible_versions).to be_frozen
+        expect { Ruact.config.shadcn_compatible_versions << 3 }.to raise_error(FrozenError)
+      end
+
+      it "is carried across atomic re-configuration (template clone)" do
+        Ruact.configure { |c| c.shadcn_compatible_versions = [2, 3] }
+        Ruact.configure { |c| c.suspense_timeout = 6.0 }
+        expect(Ruact.config.shadcn_compatible_versions).to eq([2, 3])
+      end
+
+      describe "writer-time validation" do
+        it "rejects a non-Array with ConfigurationError naming the offending value + class" do
+          expect { Ruact.configure { |c| c.shadcn_compatible_versions = 2 } }
+            .to raise_error(Ruact::ConfigurationError, /got 2 \(Integer\)/)
+        end
+
+        it "rejects an empty Array" do
+          expect { Ruact.configure { |c| c.shadcn_compatible_versions = [] } }
+            .to raise_error(Ruact::ConfigurationError, /non-empty Array/)
+        end
+
+        it "rejects an Array with non-Integer elements" do
+          expect { Ruact.configure { |c| c.shadcn_compatible_versions = ["2"] } }
+            .to raise_error(Ruact::ConfigurationError, /only Integer/)
+        end
+
+        it "rejects nil" do
+          expect { Ruact.configure { |c| c.shadcn_compatible_versions = nil } }
+            .to raise_error(Ruact::ConfigurationError, /non-empty Array/)
+        end
+      end
+    end
+
     describe "error message includes caller location" do
       it "names the file:line of the offending mutation (AC2.2)" do
         Ruact.configure { |c| c.suspense_timeout = 5.0 }

data/spec/ruact/controller_request_spec.rb

@@ -19,6 +19,8 @@ require "spec_helper"
 require "rack/test"
 require "tmpdir"
 require "fileutils"
+require "pathname"
+require "active_model"
 
 # Ruact::Controller is normally loaded by the Railtie's `ruact.load_controller`
 # initializer at app boot. This spec instantiates a Rails::Application but does
@@ -36,6 +38,27 @@ module ControllerRequestSpecSupport
       @app_class ||= build_app_class
     end
 
+    # Story 10.0 — a writable on-disk app root so an implicit-`default_render`
+    # controller's conventional template (`Rails.root/app/views/<ctrl>/<action>`)
+    # exists. Unlike the `append_view_path` demo controllers (which call
+    # `ruact_render` directly), the implicit path is what `ruact_template_exists?`
+    # probes — the bug under test lives in `default_render`, never reached when a
+    # template is only on an appended path. Memoized so `config.root` and every
+    # `write_view` call share one directory.
+    def app_root
+      @app_root ||= Pathname.new(Dir.mktmpdir("ruact-story-10-0-root"))
+    end
+
+    # Story 10.0 — write a conventional template under the app root so Rails'
+    # default view path picks it up and `ruact_template_exists?` returns true.
+    # Called at file-load time (before `initialize!`) so the `app/views` dir
+    # exists when Rails computes `paths["app/views"].existent`.
+    def write_view(controller_path, action, erb)
+      view_dir = File.join(app_root, "app", "views", controller_path)
+      FileUtils.mkdir_p(view_dir)
+      File.write(File.join(view_dir, "#{action}.html.erb"), erb)
+    end
+
     def boot!
       return if @booted
 
@@ -68,7 +91,11 @@ module ControllerRequestSpecSupport
     private
 
     def build_app_class
+      app_root_path = app_root
       Class.new(Rails::Application) do
+        # Story 10.0 — a real on-disk root so the implicit-render controller's
+        # conventional `app/views` template is discoverable by `default_render`.
+        config.root                              = app_root_path
         config.eager_load                        = false
         config.consider_all_requests_local       = true
         config.action_controller.perform_caching = false
@@ -80,11 +107,60 @@ module ControllerRequestSpecSupport
 
         routes.append do
           get "/demo/show", to: "controller_request_spec_support/demo#show"
+          # Story 10.0 — implicit-`default_render` page action (empty body), backed
+          # by a conventional `Rails.root/app/views` template, for the non-HTML
+          # Accept graceful-degradation matrix.
+          get "/implicit-demo/show", to: "controller_request_spec_support/implicit_demo#show"
+          # Story 13.3 (FR98) — Bucket-1 redirect-back round-trip routes.
+          get  "/errors-demo/new",          to: "controller_request_spec_support/errors_demo#new"
+          post "/errors-demo/create",       to: "controller_request_spec_support/errors_demo#create"
+          post "/errors-demo/create_valid", to: "controller_request_spec_support/errors_demo#create_valid"
         end
       end
     end
   end
 
+  # Story 13.3 (FR98) — an ActiveModel record with a presence validation for the
+  # redirect-back round-trip demo controller below.
+  class ErrorsDemoPost
+    include ActiveModel::Model
+    include ActiveModel::Attributes
+
+    attribute :title, :string
+
+    validates :title, presence: true
+
+    def self.name = "ErrorsDemoPost"
+  end
+
+  # Story 13.3 (FR98) — the Bucket-1 (native form / navigation) Inertia-style
+  # redirect-back demo: `create` registers errors via `ruact_errors` then
+  # `redirect_to`s the form; the errors survive the Flight redirect in `flash`
+  # and arrive as an `errors` prop on the re-rendered `new` page.
+  class ErrorsDemoController < ActionController::Base
+    include Ruact::Controller
+
+    append_view_path File.expand_path("../fixtures/story_7_9_views", __dir__)
+
+    def new
+      ruact_render
+    end
+
+    def create
+      post = ErrorsDemoPost.new(title: nil)
+      post.valid? # false → populates errors
+      ruact_errors(post)
+      redirect_to "/errors-demo/new"
+    end
+
+    def create_valid
+      post = ErrorsDemoPost.new(title: "Hi")
+      post.valid? # true → no errors
+      ruact_errors(post)
+      redirect_to "/errors-demo/new"
+    end
+  end
+
   # Demo controller for the spec. Uses an inline `append_view_path` instead of
   # relying on Rails.root/app/views, so Controller#ruact_render is invoked
   # directly from #show rather than via default_render (which short-circuits
@@ -98,8 +174,31 @@ module ControllerRequestSpecSupport
       ruact_render
     end
   end
+
+  # Story 10.0 — an implicit-`default_render` page controller: an EMPTY GET
+  # action (no `render`/`respond_to`), backed by a CONVENTIONAL template at
+  # `Rails.root/app/views/.../show.html.erb` (written via `write_view` below).
+  # This is the exact scaffold shape (ivar-only GET) whose `*/*` request 500'd
+  # pre-10.0. No `append_view_path` — the template must live on the default path
+  # that `ruact_template_exists?` probes for the bug to be reachable.
+  class ImplicitDemoController < ActionController::Base
+    include Ruact::Controller
+
+    def show; end
+  end
 end
 
+# Story 10.0 — write the implicit-render template at file-load time (before the
+# app's `initialize!` in `boot!`) so the `app/views` dir exists when Rails
+# computes its view paths.
+ControllerRequestSpecSupport.write_view(
+  "controller_request_spec_support/implicit_demo", "show", <<~ERB
+    <div>
+      <DemoButton label={"hello"} />
+    </div>
+  ERB
+)
+
 # Reset Rails.application so this spec can boot its own minimal app even if a
 # prior spec ran a different Rails::Application subclass (the constant is
 # memoized in Rails::Application; we own the reset here).
@@ -123,6 +222,13 @@ module Ruact # rubocop:disable Style/OneClassPerFile
       # real logger that survives the example lifecycle.
       Rails.logger = Logger.new(IO::NULL)
       ControllerRequestSpecSupport.boot!
+      # Story 10.0 — pin Rails.root to the booted app root. The Rails.root stub
+      # (spec/support/rails_stub.rb) is a writable singleton ivar; doctor_spec
+      # sets `Rails.root = <its tmpdir>` and never clears it, so in full-suite
+      # ordering a leftover root would make `ruact_template_exists?` (which
+      # probes `Rails.root/app/views`) miss the implicit-render template → super
+      # → the very 500 this story closes. Re-pinning per example is order-proof.
+      Rails.root = ControllerRequestSpecSupport.app_root
       # Re-prime Ruact.config after spec_helper's per-example reset wiped it.
       Ruact.configure do |c|
         c.manifest_path = ControllerRequestSpecSupport.manifest_path
@@ -200,5 +306,163 @@ module Ruact # rubocop:disable Style/OneClassPerFile
         expect(controller.instance_variable_defined?(:@ruact_render_context)).to be(false)
       end
     end
+
+    # Story 13.3 (FR98) — the Bucket-1 (native form / navigation) half of the
+    # Inertia-style validation `errors` round-trip (AC4): errors survive a
+    # redirect-back in flash and arrive as an `errors` prop on the re-render.
+    describe "Story 13.3: redirect-back errors prop (FR98)", :story_13_3 do
+      let(:flight_headers) { { "HTTP_ACCEPT" => "text/x-component" } }
+
+      it "exposes errors={} on a plain page render with no prior redirect (always present)" do
+        get "/errors-demo/new", {}, flight_headers
+        expect(last_response.status).to eq(200)
+        expect(last_response.body).to include("DemoButton")
+        # The component receives a present-but-empty errors prop, never a message.
+        expect(last_response.body).not_to include("can't be blank")
+      end
+
+      it "survives a redirect-back and re-renders with the errors prop populated" do
+        # Writing request (Bucket 1, Flight): registers errors, then redirects.
+        post "/errors-demo/create", {}, flight_headers
+        expect(last_response.headers["Content-Type"]).to include("text/x-component")
+        expect(last_response.body).to include("redirectUrl")
+
+        # The router follows the redirect with a fresh Flight GET; rack-test
+        # carries the session cookie, so flash[:ruact_errors] is read back.
+        get "/errors-demo/new", {}, flight_headers
+        expect(last_response.status).to eq(200)
+        expect(last_response.body).to include("Title can't be blank")
+      end
+
+      it "registers errors={} for a successful save and does NOT leak a message across the redirect" do
+        post "/errors-demo/create_valid", {}, flight_headers
+        get "/errors-demo/new", {}, flight_headers
+        expect(last_response.status).to eq(200)
+        expect(last_response.body).not_to include("can't be blank")
+      end
+
+      it "is single-use: a second re-render after the flash is swept shows no errors" do
+        post "/errors-demo/create", {}, flight_headers
+        get "/errors-demo/new", {}, flight_headers
+        expect(last_response.body).to include("Title can't be blank")
+
+        # flash is swept after the first read; the next render is clean.
+        get "/errors-demo/new", {}, flight_headers
+        expect(last_response.body).not_to include("Title can't be blank")
+      end
+    end
+
+    # Story 10.0 — implicit `default_render` must degrade gracefully on non-HTML
+    # Accept. Exercised against an ivar-only GET page action (empty body) whose
+    # conventional template exists, so the request traverses `default_render`'s
+    # activation predicate (NOT a hand-written `ruact_render` like demo#show).
+    describe "Story 10.0: default_render graceful degradation on non-HTML Accept", :story_10_0 do
+      it "GET with Accept: */* renders the HTML shell (was a 500 pre-10.0) (AC1)" do
+        # RED pre-fix: `*/*` → format.html? false, ruact_request? false → super →
+        # Rails renders the .html.erb outside a ruact_render flow → raises
+        # "__ruact_component__ called outside a ruact_render flow".
+        get "/implicit-demo/show", {}, { "HTTP_ACCEPT" => "*/*" }
+        expect(last_response.status).to(eq(200),
+                                        "expected 200, got #{last_response.status} body=#{last_response.body[0, 400]}")
+        expect(last_response.headers["Content-Type"]).to include("text/html")
+        expect(last_response.body).to include("DemoButton")
+        expect(last_response.body).not_to include("__ruact_component__ called outside a ruact_render flow")
+      end
+
+      it "GET with an empty Accept header (defaults to HTML) renders the HTML shell (AC1)" do
+        # An empty Accept token parses to `[nil]` (not blank, not a concrete
+        # type) — it must degrade to the HTML shell, never raise NoMethodError.
+        get "/implicit-demo/show", {}, { "HTTP_ACCEPT" => "" }
+        expect(last_response.status).to eq(200)
+        expect(last_response.headers["Content-Type"]).to include("text/html")
+        expect(last_response.body).to include("DemoButton")
+      end
+
+      it "GET with Accept: text/html renders the same HTML shell as */* (AC2)" do
+        # AC2: the explicit text/html path is unchanged and the */* path now
+        # yields the SAME shell. Normalize the per-request CSRF token (the only
+        # request-varying bytes) before comparing.
+        strip_csrf = ->(body) { body.gsub(/content="[^"]+"/, 'content="CSRF"') }
+
+        get "/implicit-demo/show", {}, { "HTTP_ACCEPT" => "text/html" }
+        html_response = last_response.body
+        expect(last_response.status).to eq(200)
+        expect(last_response.headers["Content-Type"]).to include("text/html")
+        expect(html_response).to include("DemoButton")
+
+        get "/implicit-demo/show", {}, { "HTTP_ACCEPT" => "*/*" }
+        expect(strip_csrf.call(last_response.body)).to eq(strip_csrf.call(html_response))
+      end
+
+      it "GET with Accept: text/x-component returns a raw Flight payload (AC3)" do
+        get "/implicit-demo/show", {}, { "HTTP_ACCEPT" => "text/x-component" }
+        expect(last_response.status).to eq(200)
+        expect(last_response.headers["Content-Type"]).to include("text/x-component")
+        expect(last_response.body).to match(%r{\h+:I\[.*/DemoButton\.jsx})
+      end
+
+      it "GET with the Ruact-Request: 1 header returns a Flight payload (AC3)" do
+        get "/implicit-demo/show", {}, { "HTTP_RUACT_REQUEST" => "1" }
+        expect(last_response.status).to eq(200)
+        expect(last_response.headers["Content-Type"]).to include("text/x-component")
+      end
+
+      it "GET with concrete Accept: application/json bypasses RSC to super (AC4)" do
+        # The concrete non-HTML format carries no html/wildcard accept, so
+        # `default_render` must fall through to `super` (Rails default rendering).
+        # With no JSON template and no respond_to, Rails raises an UnknownFormat /
+        # MissingTemplate — NOT the ruact outside-flow 500. We only assert it is
+        # NOT the ruact bug; Rails' exact choice of error is its own concern.
+        error = nil
+        begin
+          get "/implicit-demo/show", {}, { "HTTP_ACCEPT" => "application/json" }
+        rescue StandardError => e
+          error = e
+        end
+        expect(error).not_to be_nil
+        expect(error.message).not_to include("__ruact_component__ called outside a ruact_render flow")
+        expect(error).to be_a(ActionController::ActionControllerError).or(be_a(ActionView::MissingTemplate))
+      end
+
+      it "GET with two concrete non-HTML types (application/json, application/xml) bypasses to super (AC4)" do
+        # AC4's literal example: NEITHER member is html nor the wildcard, so the
+        # predicate is false and the request must fall through to `super`.
+        error = nil
+        begin
+          get "/implicit-demo/show", {}, { "HTTP_ACCEPT" => "application/json, application/xml" }
+        rescue StandardError => e
+          error = e
+        end
+        expect(error).not_to be_nil
+        expect(error.message).not_to include("__ruact_component__ called outside a ruact_render flow")
+      end
+
+      it "GET with a mixed Accept that includes text/html (application/json, text/html) renders the shell" do
+        # HTML is acceptable (listed explicitly) → membership predicate activates
+        # the shell. default_render is only reached on an implicitly-rendered
+        # action (no JSON representation to prefer), so serving the accepted HTML
+        # is the sensible non-error outcome — and a 200, not the pre-10.0 500.
+        get "/implicit-demo/show", {}, { "HTTP_ACCEPT" => "application/json, text/html" }
+        expect(last_response.status).to eq(200)
+        expect(last_response.headers["Content-Type"]).to include("text/html")
+        expect(last_response.body).to include("DemoButton")
+      end
+
+      it "GET with a concrete-then-wildcard Accept (application/json, */*) renders the shell" do
+        get "/implicit-demo/show", {}, { "HTTP_ACCEPT" => "application/json, */*" }
+        expect(last_response.status).to eq(200)
+        expect(last_response.headers["Content-Type"]).to include("text/html")
+        expect(last_response.body).to include("DemoButton")
+      end
+
+      it "GET with a real browser Accept (text/html,...,*/*;q=0.8) renders the shell (AC2-adjacent)" do
+        get "/implicit-demo/show", {}, {
+          "HTTP_ACCEPT" => "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
+        }
+        expect(last_response.status).to eq(200)
+        expect(last_response.headers["Content-Type"]).to include("text/html")
+        expect(last_response.body).to include("DemoButton")
+      end
+    end
   end
 end