262 Commits

Include renames

Author	SHA1	Message	Date
Pedro Coutinho	f82a43d3e2	feat(i18n): Support Portuguese European language and locale (pt-PT) (#3265) ... * Register new language - Portuguese European * Adding pt-PT locales and translations files * Adding pt-PT locales and translations files * Changing translations to pt-PT * Changing translations to pt-PT * Refining pt-PT translations * Adding pt-PT translations files * Refining pt-PT translations * Refining pt-PT translations * Refining pt-PT translations * Fixing locale issues * Fixed missing keys * Fixed missing keys and fine-grained some translations * Fixed missing keys and fine-grained some translations	2026-09-03 05:52:34 +02:00
Aland BabanandAland Baban	0cdab9a0bc	Add first-class Trade Republic support (#3168) ... * Add Trade Republic provider integration Introduce authenticated web and QR login, resilient account synchronization, deterministic financial imports, account discovery, and provider diagnostics. Keep login state encrypted, PINs transient, and incomplete provider responses non-destructive. * Address Trade Republic review findings Keep QR-authenticated sessions syncable, preserve historical holding snapshots, correct dividend direction, handle unpriced positions safely, localize repair feedback, and align provider controls with the design system. * Add Trade Republic translations for supported locales * Restore German Trade Republic account labels * Resolve remaining Trade Republic review findings * Resolve remaining Trade Republic review findings * Address latest Trade Republic review feedback * Refactor Trade Republic panel buttons to use DS::Button component and add integration tests * Fix 100x money inflation and missing positions locale key in TR views Money.new takes major units, so multiplying by 100 displayed EUR 12.34 as EUR 1234 in the holdings category cards and expense summary. Also add the pluralized holdings.index.positions key that t(".positions") resolves to (previously only defined at the unused holdings.positions root level), across all 18 locales. * fix(db): repair merge artifacts in schema and migrations - Remove duplicated icon/progress_basis columns on goals in schema.rb - Renumber Trade Republic migrations to unique versions (clashed with main's 20260824120000_add_lifecycle_to_goals) - Bump schema version to match latest migration * Address remaining Trade Republic review feedback * fix(trade-republic): address open PR #3168 review findings\n\n- Reject authenticated sessions without a securities account number so a\n blank account does not mark the item connected on a broken session.\n- Derive a missing trade amount from |quantity| x price, and a missing\n price from the resolved amount, without changing the signed import amount.\n- Regenerate db/schema.rb so the Trade Republic item/account tables and\n indexes are present; a fresh test database was otherwise missing the\n tables even though the migrations were marked up.\n * fix(trade-republic): localize activity labels in ActivitiesProcessor (i18n) * fix(trade-republic): localize activity labels in ActivitiesProcessor (i18n) * fix(trade-republic): add activity labels i18n keys to all locale files * Fix Trade Republic PR review follow-ups * fix(trade-republic): i18n-aware category guard and ignore generated graphify cache - Category matcher skipped core deposit/withdrawal labels; guard now compares against translated values so German etc skip correctly - Remove committed graphify-out cache and ignore dir * Protect holdings from malformed snapshots * Consolidate Trade Republic migrations * Address final Trade Republic review comments * Address final Trade Republic review comments - Remove hard-coded category matcher (merchant keyword taxonomy) and leave Trade Republic transactions uncategorized when no structured category exists; rely on Sure rules/AI - Revert shared ProviderImportAdapter# import_trade extra: param; handle Trade Republic trade metadata locally in ActivitiesProcessor via post-import Trade extra merge (preserve existing extra, deep_merge) - Preserve Trade Republic product distinctions (cash, brokerage/private_markets/interest_products/crypto_wallet via portfolio categories) without collapsing account kinds --------- Co-authored-by: Aland Baban <snow@iBananaMac.fritz.box>	2026-09-03 00:24:49 +02:00
Brandon	fe0d27471d	feat(bills): the bills pages, calendar feed and in-page AI helpers (#3202) ... * feat(bills): the bills pages, calendar feed and in-page AI helpers Second of three chunks carved out of #3083, stacked on the schema and domain core. This is everything a user sees and clicks. The whole surface sits behind the preview flag, so it is unreachable until someone opts in. Pages, all under one nav entry: - the pay run, a month calendar, the full bills table, and the paycheck planner - a detail drawer per bill, with payment history, price changes and cost analytics - create and edit flows for bills, subscriptions, installment plans and income The overview marks pay periods inside the month, so a weekly paycheck no longer reads as one undifferentiated month of bills. Markers appear only when income actually subdivides the month, which means monthly and undeclared income render exactly as before and there is no new setting to configure. Navigation and design system: - one preview-gated nav item shared by the desktop rail and the mobile bar - DS::Sparkline for payment-history charts, replacing raw SVG in views - status badges render through DS::Pill rather than hand-rolled spans - the suggestions panel is a disclosure that remembers being collapsed, per device, the way privacy mode and the sidebar width already do - every surface reflows to phone widths without horizontal scroll Calendar feed: a signed ICS feed per family, served sessionless by token, with a reset that revokes previously shared URLs. In-page AI helpers: smart fill on the bill form and a smart configuration proposal on an existing bill, each reading a bounded slice of charge history. Provider-side prompt assembly sits behind the existing LlmConcept interface, with an implementation for each of the two providers. These belong here rather than with the assistant tools because they are buttons on these pages and lean on the provider suggester, not on the tool registry. Suite 7,776 runs green apart from the pre-existing passkey-session flake, which passes standalone. Rubocop clean, eager loading verified. The hosting guide for the feature ships here rather than with the schema, since its instructions walk pages this PR introduces. * Render the suggested strip through DS::Disclosure The hand-rolled details pair predates the component. The card_inset variant is the same shape, so the strip now inherits the design system chrome, and the persisted-disclosure controller rides along unchanged. * Route the remaining hand-rolled chips through the design system The subscription-state chips, rule-match chips and match-reason chips become DS::Pill, with the state chips extracted to one shared partial so the drawer and the summary tab stop carrying copy-pasted markup. The AI prompt chips become DS::Button and the bills-index filter becomes DS::SearchInput, both of which this PR already uses elsewhere for the same shapes. * Fix erb_lint whitespace offenses in bills views * Address the post-ready review round * Require a writable destination account and gate the feed on preview * Reject an unresolvable declared account out loud	2026-09-02 02:08:58 +02:00
Justin McBrideandClaude Opus 5	aba8a8eb3c	Show exact share count in the holding drawer (#3305) ... * Show exact share count in the holding drawer Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014YrdY9jvCUtG3GhgZ5Skx1 * Test that the holding drawer does not round the share count Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014YrdY9jvCUtG3GhgZ5Skx1 --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-09-01 09:04:27 +02:00
buzzromainandClaude Opus 5	7176b4b521	fix(goals): stop the first goal being told about earmarks it has none of (#3216) ... * fix(goals): stop the first goal being told about earmarks it has none of Linking an account and leaving the amount blank shows "This account will fund whatever is left after the other earmarks". On a first goal there are no other earmarks — so the sentence points at something absent, and it is where a user meets the word for the first time. The row already carries `data-earmarked-by-others`, and it is zero in that case. With the account to itself the hint now says so plainly, and "earmark" appears only where earmarks actually exist — which lets the context do the explaining instead of the vocabulary needing it. Pinned server-side rather than in JS. The branch is a ternary; the failure that matters is the form not handing over the second string, which does not raise — the value reads as undefined and the line renders empty. There is also a test that the two hints stay different, since identical copy would leave the branch doing nothing and the first-time reader back where they started. Nothing runs `test/javascript` — no npm script, no CI step — so a test there would have guarded nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): tell an account claimed in full from one claimed by nobody Review on #3216. The new "this account is yours alone" hint keyed off `earmarked_by_other_goals`, which sums `allocated_amount` — and a whole-account link carries nil, so it contributes zero. An account another goal already claims in full therefore looked exactly like an unclaimed one. The form promised the whole balance, and `whole_account_link_must_be_exclusive` refused the blank allocation on submit. That is worse than the sentence this PR set out to fix: it does not merely describe something absent, it describes something the save then contradicts. The row carries both readings now, because neither can be derived from the other. `whole_account_claimed_by_other_goals?` asks the question the sum cannot answer, and the two share the same row filter so the goal being edited is excluded from both. The two tests added here also move above the first `private`, same as on `define_method`, which is public regardless — but they read as a mistake sitting among the helpers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-28 07:52:00 +02:00
3 people	b6029c1e28	feat(goals): show what each account still has room to earmark (#3166) ... * feat(goals): show what each account still has room to earmark `Account#free_to_earmark` has existed, unused, since earmarks shipped — its own comment said the UI was a follow-up. This is that follow-up, and the wording is the substance of it. It does not say "over-allocated". `free_to_earmark` is negative for as long as the saving is unfinished, which is the normal condition of anyone with goals in progress: a 6,000 account backing two goals of 5,000 gives −4,000 and is a perfectly correct setup. A warning phrased as a fault would fire permanently and teach people to ignore it. The message states the consequence instead — the goals come to X for a balance of Y, so they progress pro rata — and is never styled as an error. The trap is the goal being edited. `goal_earmarked_total` counts every goal including that one, so reopening a goal that earmarks 5,000 on a 6,000 account shows 1,000 of headroom, and re-entering the same 5,000 trips a message about a setup the user has not touched. `earmarked_by_other_goals` excludes it, and only when it is persisted — a goal being created has nothing to exclude. The pool is read once per render and passed down, never per account: the form lists every fundable account the user can see. A test counts the query and fails at two. The Stimulus controller is its own, with 3 targets. goal_form_controller is at 10 against the 7 the project guidelines suggest, needs none of this state, and is untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DJ1npaGEHr6t2HW1rYZdt4 * fix(goals): read the typed amount strictly, and format it in the app's locale Addresses review feedback on #3166. `Number.parseFloat` accepts prefixes, so "500abc" became 500, and the bare comma-to-dot swap turned a thousands-separated "1,500" into 1.5. Either way the preview described an amount the user had not typed — and the second case is a habit from another locale, not a typo, so it would have gone unnoticed. The value now has to match a complete number before anything is computed. `Intl.NumberFormat(undefined, ...)` let the BROWSER pick the locale, so a French user on an English-locale browser read separators and symbol placement matching nothing else on the page. The amounts cannot be formatted server-side — they change with every keystroke — so the server passes `I18n.locale` and the client applies it. That puts the decision where the rest of the app's formatting already lives. bin/rails test: 6954 runs, 0 failures. RuboCop, erb_lint and biome clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): let the assistant create a second goal on a claimed account Review on #3166. The function always built whole-account links and had no way to express an earmark, so once exclusivity landed, asking for a second goal on an account another goal already claimed came back as a bare `validation_failed` — while the account list still advertised the account as available. A common request became an unexplained refusal. Three changes, and the list is the important one: it now says what is left on each account and which are claimed in full, because the assistant reasons from that list and had no way to know otherwise. `earmarks` is an optional map of account name to amount, so the assistant can reserve a slice rather than the whole balance. Accounts left out keep the previous behaviour and take whatever is spare. The refusal is named before the save — `account_claimed_in_full`, with the account names — so the assistant gets a reason it can act on and ask about, rather than a validation message it can only relay. Checked after the currency check, which is the more fundamental of the two. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * test(goals): move the spend tests back out of the private section The merge of `main` into this branch landed #3176's tests between `count_pool_queries` and the helpers below it, inside the `private` section and at the wrong indentation. `ci / lint` has been failing on `Layout/IndentationConsistency` since. They still ran — `test` is a class method, so `private` does not hide them — which is why the unit job stayed green while lint went red. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>	2026-08-26 21:12:06 +02:00
buzzromainandClaude Opus 5	90203139bf	feat(goals): tell the user when a reserve has dropped below its level (#3175) ... * feat(goals): reserves you maintain, not goals you finish An emergency fund is not a goal you reach and close — it is a level you hold, and every withdrawal is a shortfall to make good. Sure treated it like anything else: at 100% it offered to close it, which would release the very money being set aside; a withdrawal dropped the bar with no sign that anything was owed. `kind` (added by the lifecycle lot without behavior) now means something. A maintained goal is `funded` or `depleted`, never `reached` — sitting at its floor is a steady state, not an achievement to file away. `complete` is refused by an AASM guard rather than merely hidden, so no path can release a reserve's earmark. Two ordering traps, both of which would have made a drained reserve invisible: `ACTIVE_DISPLAY_STATUS_RANK` falls back to 4 for any status it does not know, so an unranked `:depleted` would sort a drained emergency fund below everything else — the exact opposite of what it means. It ranks alongside `:behind` now, and `:funded` sorts near the end with the goals that need nothing. `behind_pace?` excludes reserves. `monthly_target_amount` and `pace` both derive from `target_date`, which a reserve does not have, so "save X/month to catch up" would be advice about a deadline that does not exist. The form leads with the choice, since it changes what the rest of it means, and hides the target date for a reserve rather than disabling it — a hidden field cannot submit a stale value that would then drive a pace. The card states the shortfall, which is exactly `remaining_amount`. The panel that offers a one-off its closing action tells a reserve it is intact and offers nothing, because there is nothing to do. Scope: fixed targets only. Targets expressed in months of expenses, the monthly refresh job, and the depletion insight are the next two PRs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DJ1npaGEHr6t2HW1rYZdt4 * fix(goals): let a reserve behave like one everywhere it is shown Addresses review feedback on #3167. The kind selector never hid the target date. `data-controller="goal-kind"` sat on the selector div while its `dateField` target is a sibling, so `dateFieldTargets` came back empty and picking "Reserve to maintain" left the deadline on screen and submittable. The controller moves to the form wrapper, which encloses both. Hiding a field is not enforcement, so the model now clears `target_date` for a maintained goal. Normalising rather than rejecting: the field is hidden, and an error about something the user cannot see is not actionable. A date could only arrive through a conversion or a crafted request, and either way a stored deadline would drive a pace the reserve does not have. A completed goal could be switched to `maintained` from the edit form. It then sat in a released state — one that has handed its earmark back — while the show page promised its money stays reserved, and `complete` for reserves is refused precisely to prevent that state. `kind` is now locked while released: reopen first. Reserves counted against the "goals on track" tile. Their statuses are `funded`/`depleted`, which match none of the exclusions in `tracked_total`, so they could never reach the numerator and a family with one reserve read "0 of 1 on track" for a goal working exactly as intended. Two more places still spoke of pace to something that has none. `pace_line` is suppressed for reserves on the card, and a depleted reserve gets its own panel before the projection card — the projection's summary, catch-up line and colour are all built from a deadline. What a drained reserve needs is the number the projection cannot show: how much is missing from the floor. The French celebration copy read "Votre réserve est à son niveau", which never says which level. Each guard was confirmed load-bearing by removing it and watching its test fail. bin/rails test: 6962 runs, 28003 assertions, 0 failures. RuboCop, erb_lint and Brakeman clean. Left open deliberately: extracting the show page's lifecycle panel into a ViewComponent. The guideline behind it is right, but the refactor is wider than this round of fixes and belongs on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): finish teaching the status consumers about reserves Second round of review feedback on #3167: two consumers still had no branch for the reserve statuses. `ProgressRingComponent#percent_text_class` styled only `:reached` as success, so a funded reserve — a floor the user is holding exactly as intended — fell back to the neutral colour and read as unfinished. `status_callout_context` had no `:depleted` branch, so a drained reserve showed no callout at all: the one status that most deserves a line of explanation was the only one saying nothing. It now names the shortfall. `:funded` deliberately keeps no callout — a reserve at its level has nothing to report, and the celebration panel already says so. A test pins that, so the silence reads as a decision rather than another missing branch. bin/rails test: 6964 runs, 28008 assertions, 0 failures. RuboCop and Brakeman clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): lock the kind on the state the goal is actually in Addresses review feedback on #3167, on the guard that landed in c1c7f4f7. `kind_locked_while_released` read the in-memory `state`, so a single write setting `state: "active"` alongside the new kind saw the goal as already reopened and waved it through. The end state looks legitimate — active and maintained — which is why the hole is easy to miss. It is not: the direct write skipped the `reopen` transition, and with it `thaw_completed_amount!`. `completed_amount` survived, so `current_balance` returned that frozen snapshot forever on a live reserve. Reopening has to be its own gesture, because it is the gesture that thaws. Now reads `state_in_database`, with a regression test on the combined write asserting both that it is refused and that the frozen amount is untouched. Confirmed load-bearing by reading the attribute again and watching it fail. bin/rails test: 6969 runs, 28019 assertions, 0 failures. RuboCop and Brakeman clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): send an empty reserve to the shortfall panel, not the empty state Addresses the last review thread on #3167. The `maintained?` branch sat after the zero-balance/zero-pace one, so a brand-new reserve matched the generic "make your first transfer" card. I had put it there on purpose, thinking a reserve with nothing in it wanted the first-transfer nudge. The review is right that it does not: it is still a reserve short of its floor, and the shortfall panel says so with the saved, target and missing amounts, where the generic card says none of them. Ordering it after also meant evaluating `pace` on a goal that has no pace to evaluate. bin/rails test: 6965 runs, 0 failures. RuboCop and erb_lint clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): stop a paused goal outranking a reserve that is whole Review on #3175. `:funded` and paused both ranked 3 in `active_display_sort`, so the tie broke on name and a paused goal called "Alpha" sat above a reserve called "Zeta" that was fully funded — the list saying the paused one wanted attention more. Paused now ranks behind every status, which is what the comment above the table already claimed. The seven panels on the goal page were hand-rolled repetitions of `DS::Card`'s exact shell, two of them adjacent and identical. They render through the primitive now, so their surface styling cannot drift apart. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * refactor(goals): move the lifecycle panel decision out of the template Review on #3167 and #3180. Which panel a goal gets is a lifecycle question with five answers, and the template worked it out inline from `completed?`, `maintained?`, `one_off?`, `status` and `may_complete?` — five predicates deep in ERB where the ordering between them was load-bearing and nothing said so. `Goals::LifecyclePanelComponent` answers it in Ruby and the template renders the answer. The markup moves across unchanged, keys made absolute because a relative `t(".x")` in a component resolves against the component's own path rather than the page these strings belong to. The order is now stated once, where it can be read and tested: `:reserve_shortfall` before `:empty`, because a brand-new reserve sits at zero balance and zero pace and the generic "make your first transfer" card would otherwise swallow it. Closing from the panel now confirms, as the header menu already did. Completing releases the goal's earmarked money, and the panel offered that in one click. Both go through `goal_complete_confirm` rather than building the wording twice — two copies drifting apart is how one ends up describing the wrong consequence. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): refresh the pace suggestion when the deadline is cleared Assigning `input.value = ""` fires no event, so `goal-form#suggestedChanged` never ran: selecting "Reserve to maintain" cleared the date but left the monthly pace suggestion on screen, derived from a deadline the goal no longer has. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): let a depleted reserve look as urgent as it is Review on #3179 and #3180. `Goal#needs_attention?` names the pair of statuses that mean "this one wants looking at" — a goal off its pace and a reserve below its floor. Three places were spelling that out and the Plan hub's progress bar had fallen behind, so a depleted reserve got a neutral bar an inch from its own amber status pill: the same goal reported as needing attention and not. `projection_summary` told a funded reserve it had "hit the target, no projection needed". A reserve holds a level; there is no finish line to project toward and no target to have hit. It does not reach that panel today — the shortfall and celebration panels catch it first — but the method reads as the single source of truth for that subtitle and should not hand a caller a one-off's wording. The legend swatches are bordered spans now rather than inline SVG, and the label takes `text-xs` instead of an arbitrary 11px. The projection swatch keeps the chart's own colour variables in an inline style rather than `border-success` / `border-warning`: the chart hard-codes green-600 and yellow-600, and a legend whose colour does not match the line it describes is worse than the markup it would save. The Plan-card test counts warning bars rather than matching one. A fixture goal is already off its pace, so the markup is on the page either way and a presence check passed without the fix. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * feat(goals): tell the user when a reserve has dropped below its level A maintained reserve exists to hold a floor. Nothing said when it stopped holding it: the goal page shows the shortfall, but only to someone who thought to look, and a reserve is precisely the thing you stop looking at once it is full. That silence is the gap this closes. High priority, unlike most of this feed. `IdleCashGenerator` is a nudge about money doing nothing; this is the opposite — a floor the user deliberately set is no longer there. It is also the one signal a reserve can produce that a one-off goal cannot, which is what makes it worth a generator of its own. Three deliberate limits: - **Active reserves only.** A paused one is shelved on purpose, and `behind_pace?` already excludes paused goals for the same reason. Nagging about a goal someone put down is noise. - **The dedup key rotates monthly.** A reserve can sit short for weeks while it is rebuilt, and re-raising the same shortfall every night trains people to dismiss the feed. - **Two at a time, worst shortfall first.** A family running four drained reserves has one problem, not four. Loaded through `Goal.prepared_for` so the family-wide pooled allocations are read once: asking each reserve for its status reaches `current_balance`, and without that injection every one of them would re-read the whole pool. bin/rails test: 7079 runs, 28491 assertions, 0 failures. RuboCop and Brakeman clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(insights): stop an insight naming something that has been renamed Review on #3175: renaming a depleted reserve leaves the stored title naming the old one for the rest of the month, because the name is not part of the metadata that drives a refresh. Rather than making the name material, the same-signal branch now refreshes the title alongside the facts. The title is built from I18n and the generator's own data — the model writes the body, not this — so keeping it current costs nothing, and a rename is not a reason to resurface an insight the user has already read. The body still says the old name until the numbers move. Forcing an LLM rewrite on every rename is the wrong trade, and making the name material would do that *and* re-nag the user. This is generic to every generator whose title embeds a name, not only the reserve one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(insights): refresh the title on reactivation too A gap in the previous commit: the expired-and-returned branch resurfaces an insight without touching its title, so a subject renamed while the insight was expired came back naming the old one. Same reasoning as the same-signal branch — the title is I18n plus the generator's own data, not the model's prose, so keeping it current costs nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-26 08:26:43 +02:00
buzzromainandClaude Opus 5	6d7ca3584c	feat(goals): reserves you maintain, not goals you finish (#3167) ... * feat(goals): reserves you maintain, not goals you finish An emergency fund is not a goal you reach and close — it is a level you hold, and every withdrawal is a shortfall to make good. Sure treated it like anything else: at 100% it offered to close it, which would release the very money being set aside; a withdrawal dropped the bar with no sign that anything was owed. `kind` (added by the lifecycle lot without behavior) now means something. A maintained goal is `funded` or `depleted`, never `reached` — sitting at its floor is a steady state, not an achievement to file away. `complete` is refused by an AASM guard rather than merely hidden, so no path can release a reserve's earmark. Two ordering traps, both of which would have made a drained reserve invisible: `ACTIVE_DISPLAY_STATUS_RANK` falls back to 4 for any status it does not know, so an unranked `:depleted` would sort a drained emergency fund below everything else — the exact opposite of what it means. It ranks alongside `:behind` now, and `:funded` sorts near the end with the goals that need nothing. `behind_pace?` excludes reserves. `monthly_target_amount` and `pace` both derive from `target_date`, which a reserve does not have, so "save X/month to catch up" would be advice about a deadline that does not exist. The form leads with the choice, since it changes what the rest of it means, and hides the target date for a reserve rather than disabling it — a hidden field cannot submit a stale value that would then drive a pace. The card states the shortfall, which is exactly `remaining_amount`. The panel that offers a one-off its closing action tells a reserve it is intact and offers nothing, because there is nothing to do. Scope: fixed targets only. Targets expressed in months of expenses, the monthly refresh job, and the depletion insight are the next two PRs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DJ1npaGEHr6t2HW1rYZdt4 * fix(goals): let a reserve behave like one everywhere it is shown Addresses review feedback on #3167. The kind selector never hid the target date. `data-controller="goal-kind"` sat on the selector div while its `dateField` target is a sibling, so `dateFieldTargets` came back empty and picking "Reserve to maintain" left the deadline on screen and submittable. The controller moves to the form wrapper, which encloses both. Hiding a field is not enforcement, so the model now clears `target_date` for a maintained goal. Normalising rather than rejecting: the field is hidden, and an error about something the user cannot see is not actionable. A date could only arrive through a conversion or a crafted request, and either way a stored deadline would drive a pace the reserve does not have. A completed goal could be switched to `maintained` from the edit form. It then sat in a released state — one that has handed its earmark back — while the show page promised its money stays reserved, and `complete` for reserves is refused precisely to prevent that state. `kind` is now locked while released: reopen first. Reserves counted against the "goals on track" tile. Their statuses are `funded`/`depleted`, which match none of the exclusions in `tracked_total`, so they could never reach the numerator and a family with one reserve read "0 of 1 on track" for a goal working exactly as intended. Two more places still spoke of pace to something that has none. `pace_line` is suppressed for reserves on the card, and a depleted reserve gets its own panel before the projection card — the projection's summary, catch-up line and colour are all built from a deadline. What a drained reserve needs is the number the projection cannot show: how much is missing from the floor. The French celebration copy read "Votre réserve est à son niveau", which never says which level. Each guard was confirmed load-bearing by removing it and watching its test fail. bin/rails test: 6962 runs, 28003 assertions, 0 failures. RuboCop, erb_lint and Brakeman clean. Left open deliberately: extracting the show page's lifecycle panel into a ViewComponent. The guideline behind it is right, but the refactor is wider than this round of fixes and belongs on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): finish teaching the status consumers about reserves Second round of review feedback on #3167: two consumers still had no branch for the reserve statuses. `ProgressRingComponent#percent_text_class` styled only `:reached` as success, so a funded reserve — a floor the user is holding exactly as intended — fell back to the neutral colour and read as unfinished. `status_callout_context` had no `:depleted` branch, so a drained reserve showed no callout at all: the one status that most deserves a line of explanation was the only one saying nothing. It now names the shortfall. `:funded` deliberately keeps no callout — a reserve at its level has nothing to report, and the celebration panel already says so. A test pins that, so the silence reads as a decision rather than another missing branch. bin/rails test: 6964 runs, 28008 assertions, 0 failures. RuboCop and Brakeman clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): lock the kind on the state the goal is actually in Addresses review feedback on #3167, on the guard that landed in c1c7f4f7. `kind_locked_while_released` read the in-memory `state`, so a single write setting `state: "active"` alongside the new kind saw the goal as already reopened and waved it through. The end state looks legitimate — active and maintained — which is why the hole is easy to miss. It is not: the direct write skipped the `reopen` transition, and with it `thaw_completed_amount!`. `completed_amount` survived, so `current_balance` returned that frozen snapshot forever on a live reserve. Reopening has to be its own gesture, because it is the gesture that thaws. Now reads `state_in_database`, with a regression test on the combined write asserting both that it is refused and that the frozen amount is untouched. Confirmed load-bearing by reading the attribute again and watching it fail. bin/rails test: 6969 runs, 28019 assertions, 0 failures. RuboCop and Brakeman clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): send an empty reserve to the shortfall panel, not the empty state Addresses the last review thread on #3167. The `maintained?` branch sat after the zero-balance/zero-pace one, so a brand-new reserve matched the generic "make your first transfer" card. I had put it there on purpose, thinking a reserve with nothing in it wanted the first-transfer nudge. The review is right that it does not: it is still a reserve short of its floor, and the shortfall panel says so with the saved, target and missing amounts, where the generic card says none of them. Ordering it after also meant evaluating `pace` on a goal that has no pace to evaluate. bin/rails test: 6965 runs, 0 failures. RuboCop and erb_lint clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): stop a paused goal outranking a reserve that is whole Review on #3175. `:funded` and paused both ranked 3 in `active_display_sort`, so the tie broke on name and a paused goal called "Alpha" sat above a reserve called "Zeta" that was fully funded — the list saying the paused one wanted attention more. Paused now ranks behind every status, which is what the comment above the table already claimed. The seven panels on the goal page were hand-rolled repetitions of `DS::Card`'s exact shell, two of them adjacent and identical. They render through the primitive now, so their surface styling cannot drift apart. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * refactor(goals): move the lifecycle panel decision out of the template Review on #3167 and #3180. Which panel a goal gets is a lifecycle question with five answers, and the template worked it out inline from `completed?`, `maintained?`, `one_off?`, `status` and `may_complete?` — five predicates deep in ERB where the ordering between them was load-bearing and nothing said so. `Goals::LifecyclePanelComponent` answers it in Ruby and the template renders the answer. The markup moves across unchanged, keys made absolute because a relative `t(".x")` in a component resolves against the component's own path rather than the page these strings belong to. The order is now stated once, where it can be read and tested: `:reserve_shortfall` before `:empty`, because a brand-new reserve sits at zero balance and zero pace and the generic "make your first transfer" card would otherwise swallow it. Closing from the panel now confirms, as the header menu already did. Completing releases the goal's earmarked money, and the panel offered that in one click. Both go through `goal_complete_confirm` rather than building the wording twice — two copies drifting apart is how one ends up describing the wrong consequence. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): refresh the pace suggestion when the deadline is cleared Assigning `input.value = ""` fires no event, so `goal-form#suggestedChanged` never ran: selecting "Reserve to maintain" cleared the date but left the monthly pace suggestion on screen, derived from a deadline the goal no longer has. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye * fix(goals): let a depleted reserve look as urgent as it is Review on #3179 and #3180. `Goal#needs_attention?` names the pair of statuses that mean "this one wants looking at" — a goal off its pace and a reserve below its floor. Three places were spelling that out and the Plan hub's progress bar had fallen behind, so a depleted reserve got a neutral bar an inch from its own amber status pill: the same goal reported as needing attention and not. `projection_summary` told a funded reserve it had "hit the target, no projection needed". A reserve holds a level; there is no finish line to project toward and no target to have hit. It does not reach that panel today — the shortfall and celebration panels catch it first — but the method reads as the single source of truth for that subtitle and should not hand a caller a one-off's wording. The legend swatches are bordered spans now rather than inline SVG, and the label takes `text-xs` instead of an arbitrary 11px. The projection swatch keeps the chart's own colour variables in an inline style rather than `border-success` / `border-warning`: the chart hard-codes green-600 and yellow-600, and a legend whose colour does not match the line it describes is worse than the markup it would save. The Plan-card test counts warning bars rather than matching one. A fixture goal is already off its pace, so the markup is on the page either way and a presence check passed without the fix. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016GTNba5qE5NwzaHzbp27ye --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-26 08:20:43 +02:00
4 people	eb498cfa0c	Feature/category hierarchy and account search (#2845) ... * Add parent/child category hierarchy to all category selects; add search to account select Category selection consistency: - DS::Select (shared component powering the main transaction form, transaction edit, bulk-update, and transfer category pickers) now indents subcategories with a corner-down-right icon, matching the existing transaction-row category dropdown. - Feed DS::Select-based category pickers with Category.alphabetically_by_hierarchy (parent name, then parent-before-children, then own name) so children render directly under their parent. - Added Category::Group.select_options, a shared helper producing parent-then-child ordered options (with an indent marker) for plain HTML <select> elements. Used by: - Rule builder category condition/action selects - Bulk 'categorize transactions' select - CSV/QIF import category mapping select - Grouped the splits category combobox and the transaction search category filter checklist the same way, both with the corner-down-right indent icon used elsewhere. Account selection: - Added searchable: true to the account select in the new/edit transaction form, matching the category and merchant selects next to it. * Fix SyntaxError: 'for' is a Ruby reserved keyword Category::Group.select_options called for(categories) as a bare method call, but Ruby parses a bare 'for' as the start of a for..in loop statement, not a method invocation. Qualify it as self.for(categories) to call the class method explicitly. Verified with 'ruby -c' on all touched .rb files and ERB.new(...).src on all touched .erb files. * Add test coverage for category hierarchy and account search Model-level: - Category::GroupTest (new): for() grouping and the new select_options helper (order + indent labels). - CategoryTest: alphabetically_by_hierarchy scope ordering. - Rule::ConditionFilter::TransactionCategoryTest (new) - Rule::ActionExecutor::SetTransactionCategoryTest (new) - Import::CategoryMappingTest (new): grouping + 'Add as new category' still prepends correctly. Controller/integration-level (asserting actual rendered HTML order): - SplitsControllerTest: category combobox data-value ordering. - Transactions::CategorizesControllerTest: bulk-categorize <select> option ordering. - TransactionsControllerTest: - search filter checkbox ordering (q[categories][]) - new-transaction DS::Select category ordering (via trigger id + ancestor traversal) - new-transaction account select renders a search box All new/modified test files verified with 'ruby -c' (syntax) and cross-checked fixture names, family scoping, route helpers, and field names against the actual fixtures/routes/views. Ruby/Bundler network access to rubygems.org is unavailable in this sandbox, so the suite itself has not been executed — run 'bin/rails test' before merging. * Align with design-sure conventions: keep domain logic in component, not template Per .cursor/rules/view_conventions.mdc ('keep domain logic out of the views'), the parent/child hierarchy check for DS::Select items belongs in the component class, not inline in the ERB template. DS::Select already has this exact pattern for other per-item derived properties (color_for, icon_for, logo_for) — added child? alongside them and updated the template to call it instead of computing it inline. Added test/components/DS/select_test.rb (ViewComponent::TestCase, no rendering needed) covering child? directly: subcategory objects, root-category objects, non-hierarchical objects (merchants), and the include_blank placeholder item. Also did a broader pass against the design-sure .cursor/rules to confirm the rest of this branch's changes already comply: - Uses Current.family (never current_family) throughout - Uses the icon() helper exclusively, never lucide_icon directly - No new/hardcoded colors; only existing semantic Tailwind tokens already used elsewhere in these same files - No changes to sure-design-system.css / application.css - Extended existing components/partials rather than creating new ones where one already existed (view_conventions.mdc component-vs-partial guidance) - Test additions stay in Minitest + fixtures, avoid system tests, and test query-method output directly (testing.mdc) * Address CodeRabbit review: sort category groups, tighten test assertion, move grouping out of view * Address review: fix arrow leak in rule summaries, filter panel alignment, simplify splits ordering * fix(pages): set breadcrumbs for changelog and feedback pages (#2889) * fix(app): set breadcrumbs for changelog and feedback pages * feat(test): add test to assert breadcrumbs * fix(test): remove changes * feat(app): update breadcrumbs to use semantic nav element * feat(test): add breadcrumb assertions to changelog and feedback pages * fix(app): replace breadcrumb nav element with div containing data-breadcrumbs attribute * fix ci failures * resolved failures * Regenerate schema.rb from migrations * Fix test * Remove schema dump noise --------- Signed-off-by: Shibu M <23173570+DataEnginr@users.noreply.github.com> Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: Kenrick Tandrian <60643640+KenTandrian@users.noreply.github.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>	2026-08-26 07:59:00 +02:00
Juan José MataandClaude Opus 5	d6462f5fc9	feat(snaptrade): add device-flow OAuth alongside the browser redirect (#3126) ... * feat(snaptrade): add device-flow OAuth alongside the browser redirect SnapTrade could only be connected through the authorization-code + PKCE flow, which needs a confidential OAuth client: SNAPTRADE_OAUTH_CLIENT_SECRET and a redirect URI registered on the OAuth app. A deployment that cannot register one had no path at all. Add the device grant (RFC 8628) as a second way to obtain the same token, so people can pick the flow that suits their deployment. Both grants end at SnaptradeItem#apply_oauth_tokens!, so a device-authorized item is indistinguishable from a redirect-authorized one from there on -- same Bearer data calls, refresh, revocation and sync. Nothing about existing authorized items changes: no schema change, no migration, and the PKCE path is untouched. - Provider::Snaptrade gains start_device_authorization and poll_device_token, with endpoints read from SnapTrade's OAuth metadata document (cached). - oauth_configured? now means "some flow is available" (public client id), which is what gates syncing and the provider panel; the new authorization_code_configured? gates the redirect flow specifically. - Token and revocation requests authenticate as a public client when no secret is configured -- client_id in the body instead of HTTP Basic. Without this a device-authorized item would authorize fine and then fail at its first token rotation. - The settings panel offers both when both are available; every other entry point picks one through SnaptradeItemsHelper#snaptrade_authorize_path. - The device page carries a failed attempt's code back into the form, so "not confirmed yet" is a retry rather than a restart. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3f2UyefTKJrgvNjPnhMRk * fix(snaptrade): keep the provider panel's setup-step keys and cover both flows Two test_unit failures from the panel change. The setup steps were reordered and their keys renamed, which orphaned the translations twelve locales already had for them and broke the test asserting `oauth_setup_step_3`. The rename bought nothing: reword the steps in place instead, leaving the callback URL on step 2 where the interpolation lives. The panel tests stubbed `oauth_configured?`, which no longer decides which buttons render -- that is now `authorization_code_configured?`. Stub both, so the "configured" cases test the deployment they name, and add the device-only case that was previously unreachable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3f2UyefTKJrgvNjPnhMRk * fix(snaptrade): address device-flow review findings Two real bugs from the bot reviews, plus consistency work. The completion form posts into the `drawer` frame so errors re-render in place, but a successful redirect was then followed as a frame navigation. Both destinations carry the layout's empty `drawer` frame, so Turbo swapped that in and merely closed the dialog: the notice was lost and `return_to=setup_accounts` never advanced. Success now breaks out with a redirect stream action, the same mechanism holdings and categorizes already use, while errors keep rendering in the drawer. RFC 8628 §3.1 requires a confidential client to authenticate its device authorization request, and the panel offers the device code on deployments that configured a secret. That request now carries the same client authentication as the token request. Token endpoint resolution is now shared by all three grants, since whatever issued a token has to be what refreshes it. It reads the discovery document only when already cached and never fetches it, so the browser flow keeps working off the constant it has always used -- no new network call on refresh and no new way for an existing authorized item to fail. Also: the drawer no longer asks the provider whether it is configured, the controller tells it; and the test helpers restore the previous OAuth config rather than clearing it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3f2UyefTKJrgvNjPnhMRk * fix(snaptrade): reject a device authorization response that cannot drive the flow A 2xx missing device_code, user_code or a verification URI was passed straight to the drawer, which then rendered a blank code and a link to nowhere -- a dead end the user could only abandon. Every one of those fields is load-bearing, and a response without them is partial or schema-changed, so fail with a message instead. Same reasoning as the results-array check in get_positions. verification_uri_complete substitutes for verification_uri when present, since the drawer prefers it for the link anyway. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3f2UyefTKJrgvNjPnhMRk * fix(snaptrade): filter device-flow codes from request logs complete_oauth_device_flow receives the device code as a request parameter, and none of the existing filter_parameters patterns is a substring of "device_code" -- ParameterFilter matches on substrings, and "token", "_key", "secret", "code_verifier" and "code_challenge" all miss it. So Rails' default "Processing by ... Parameters: {...}" line was writing it in plaintext. That matters more here than ordinary log hygiene: the device code is the only capability check on redemption. Unlike the redirect flow's state, nothing binds a device code to the family that requested it, so anyone who can read the logs could redeem another family's in-flight authorization into their own item and pick up a token for that family's brokerage data. Adds :device_code, :user_code and :verification_uri_complete (which embeds the user code) to the filter list, with a regression test in the style of the existing Sophtron credential-filtering test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3f2UyefTKJrgvNjPnhMRk * fix(snaptrade): bind a pending device authorization to its session The device code was posted back from the drawer as a form field, so the request body was the only thing deciding which item a pending authorization redeemed into. Nothing tied a code to the family that asked for it -- the guarantee `state` gives the redirect flow -- so a code recovered from anywhere could be redeemed into an item belonging to someone else, handing them a token for the victim's brokerage data. Hold the pending authorization in the session instead, where oauth_callback already keeps its code_verifier and state: - start_oauth_device_flow records the code, what the page displays, the family, the item and the return_to context under :snaptrade_device_flow. - complete_oauth_device_flow reads the code from there and refuses unless the flow was started by this session for this family and this item. A device_code parameter is no longer read at all, so there is no longer a way to inject one. - return_to and accountable_type come from the session too, so completion needs nothing from the form to find its way back. The code now never reaches the browser, which also makes the previous commit's log filtering a second line of defence rather than the only one. A failed attempt keeps the code only while it is still redeemable: expired_token and access_denied clear it so the page offers a fresh start, while a transient failure leaves it in place to retry. expires_in and interval are no longer carried anywhere, since nothing ever read them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3f2UyefTKJrgvNjPnhMRk * fix(snaptrade): use one token endpoint for every grant poll_device_token resolved the token endpoint from the cached discovery document while exchange_code and refresh_tokens used TOKEN_URL, so which URL a device-issued token was refreshed at depended on whether the 12h metadata cache was still warm. If the discovered endpoint ever differed from the constant, a device-authorized item would work until the cache lapsed and then fail its first rotation -- and fail invisibly, since a refresh failure marks the connection requires_update. Resolve it by removing the choice rather than by making refresh depend on discovery. RFC 8628 §3.4 redeems a device code at the authorization server's token endpoint, the same one the authorization code grant uses: there is one token endpoint, not one per grant, and nothing to keep in sync between issuing a token and refreshing it. TOKEN_URL is also the endpoint the browser flow has been using in production, so it is the one with evidence behind it. Discovery is still consulted, but only for device_authorization_endpoint, which has no hardcoded equivalent. This also keeps refresh free of any network dependency it did not already have: reintroducing discovery there would have put a fetch, with retries and backoff, in front of every token rotation on items that never needed one. Also restore the previous OAuth configuration in the missing-client-id test instead of leaving the client id nil, which made it order-dependent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3f2UyefTKJrgvNjPnhMRk --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-25 04:28:25 +02:00
3 people	735b62d9c7	Track self-custody wallets natively: Bitcoin, EVM and Solana (#3081) ... * feat(onchain-wallets): foundation for self-custody wallet tracking Adds the schema, models and the normalised contract every chain will produce, with no chain implemented yet. The central constraint of a multi-chain integration is that `case chain` must not spread through the importer, processor, controller and views. So a chain adapter's only job is to turn an address into an Onchain::Snapshot — a list of Onchain::Assets and Onchain::Movements — and Onchain::Chains is the single source of truth for which chains exist, how their addresses are validated, what their native asset is, and which adapter to instantiate. Everything downstream is written once. Two tables: - onchain_wallet_items: the family-level connection. Keyless by default; the only credential is an optional Etherscan key, encrypted via `encrypts`. - onchain_wallet_accounts: one row per asset, per address, per chain. Uniqueness uses three partial unique indexes, one per asset kind, because the identity of an asset depends on its kind: a native coin is identified by its address alone while a token is identified by its contract/mint. A single index over all columns would treat two native rows with a NULL contract_address as distinct and let duplicates through — the model test proves the rejection comes from the database by saving with `validate: false`. The schema also leaves room for extended-key (xpub) wallets later: an HD wallet is a set of derived addresses under one item, which the current uniqueness key already allows, so adding it needs no destructive change. db/schema.rb is hand-edited to add only the two new tables: regenerating it with the Rails version now in the Gemfile reorders every column in the file, which is out of scope for this change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): chain-agnostic importer, processor and syncer The whole pipeline is written once here and never branches on chain: it consumes Onchain::Snapshots, so a chain is only ever a registry key and an adapter. Importer: refreshes every tracked address and records a digest of what it saw (quantity plus movements, no timestamps) on each row. It deliberately never creates rows — real wallets are full of spam airdrops, so a newly seen token becomes trackable only when the user ticks it. An asset that disappears from a wallet goes to zero rather than going stale. Syncer: reprocesses only the rows whose digest changed. Two consecutive syncs of an idle wallet write nothing at all — no row updates, no holdings, no entries, and no queued account syncs. Both the importer and syncer tests for that were checked against the pre-fix behaviour: with the content_hash guard removed they fail. Processor: writes the holding, the account balance and the movements. Movements materialise two ways. When that day's price is known, a signed trade (positive = Buy, negative = Sell) so cost basis and the value chart reconstruct back to acquisition. Otherwise a display-only entry with amount 0 and excluded: true, raw movement preserved in `extra` — visible, but not inventing a value that would distort the account's history. Prices are matched on the exact day for trades, because valuing a two-year-old transfer at today's price would fabricate a cost basis. Onchain::SecurityResolver binds a "CRYPTO:<SYMBOL>" ticker straight to the crypto price provider instead of going through provider search, where "USDC" can come back as a EUR-quoted pair and then need FX to repair. It reuses an existing Security for the ticker whatever its MIC, so one asset never splits into two records. Symbol normalisation for bridged stablecoins and the price backfill follow in the next commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): canonical asset symbols and price backfill Two things stood between a linked wallet and a correct valuation. Bridged and wrapped variants. The same dollar is USDC on Ethereum, USDC.e on Arbitrum and USDbC on Base; the same ether is ETH natively and WETH once wrapped. Left alone each variant becomes its own Security, so one gets priced and the others sit at zero, and the same asset held on two chains reports two different values. Onchain::AssetSymbol maps the variants that are redeemable 1:1 onto the canonical asset, so pricing them as that asset is exact rather than approximate. Missing price history. A Security created at link time has none, so on the first sync every movement would fall back to a display-only entry and the cost basis would never reconstruct — the feature would look broken exactly when the user first looks at it. The processor now backfills the window in one batched provider call rather than one call per movement date, includes today so a wallet whose movements all predate the sync window still gets a current valuation, and treats a provider failure as a logged warning: the holding and the quantity are still written. All of it is a no-op when no crypto price provider is enabled, which is the case the settings panel has to warn about before linking. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): Bitcoin adapter Bitcoin has no account balances: an address owns unspent outputs, so the balance is everything ever paid to it minus everything spent from it, and mempool totals count — a broadcast-but-unconfirmed spend has already left the wallet as far as its owner is concerned. Movements are the net effect of each transaction on the address, so a self-transfer nets to zero and produces no entry. All three address formats are accepted (Base58 P2PKH/P2SH, bech32 segwit, bech32m taproot) with the character-set exclusions each encoding actually has, and a malformed address is rejected before any request is made — the test relies on WebMock failing the run if a request escapes. Single address, not extended keys. A Bitcoin wallet is normally an HD wallet: one xpub derives thousands of addresses and change goes to derived ones, so tracking a single address under-reports such a wallet. Extended keys would need BIP32 derivation (a dependency this codebase does not want) or a descriptor-indexing backend. The limitation is stated in the adapter, will be stated in the linking UI, and an xpub is rejected as an address rather than silently treated as one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): EVM adapter for six networks, two backends One adapter class serves every EVM network: a network's identity — label, native coin, explorer URL, whether a family-supplied Etherscan key applies — is data in the chain registry, so adding a network is an entry there rather than a branch here. The unit tracked is the (chain, address) couple, carried by the unique index. A 0x address is valid on all six networks and holds different balances on each, so detection asks each candidate network whether the address is worth tracking there. That probe is exactly one request and never reads paginated history: Blockscout's address summary carries the coin balance and the token/transfer flags together, which is also why a wallet holding only ERC-20 tokens with zero native balance is still found. An explorer being down means "not detected here", not an error the user has to interpret — a dead indexer must not break linking. Two interchangeable backends behind Provider::EvmExplorer: keyless Blockscout by default for every network, and Etherscan when the family configured a key on a network the registry enables it for (today Ethereum only), where a key buys nothing but a higher rate limit. Etherscan deliberately does not implement the activity probe: its one-request answer is the native balance, which reports "nothing here" for a token-only wallet, so detection stays on the indexer that can answer correctly. Zero-balance token rows are dropped — real wallets are full of spam dust — while the native asset is always reported, even at zero, because a wallet that spent everything still has a history worth keeping. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): Solana adapter A Solana wallet does not hold its tokens. Each SPL token sits in its own token account, owned by the wallet but addressed separately, so balances come from enumerating those accounts across both token programs rather than from reading the wallet address — and because one wallet can own several accounts for the same mint, they are summed into one position. Emptied token accounts are left behind on chain by design and are dropped. RPC gives mints, not metadata. Well-known mints get their real symbol; anything else is labelled with its mint in a form that deliberately cannot pass for a ticker, so security resolution declines it and the asset is tracked by quantity rather than priced as some unrelated coin that happens to share a name. Activity is one request. Bitcoin's Base58 addresses fall inside Solana's address shape, so the two are told apart by asking the node: it rejects a non-32-byte key, which reads as "not here" rather than an error. The Snapshot it returns has the same shape as Bitcoin's and the EVM adapter's — asserted in the test — so nothing downstream changed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): settings panel and linking flow Linking is three steps: paste an address, confirm which network, choose what to track. The network step exists because address formats are not unique to a chain. Candidates come from the address shape, and when there is more than one each is asked whether the address is worth tracking there — one bounded request each. When several answer yes, or none does, the user picks from a list that marks which ones showed activity. Silently keeping the first match would link the wrong network and surface later as a sync bug. The token step imports nothing that was not ticked. Assets whose symbol a price provider can quote are pre-checked; spam airdrops, whose "symbol" is usually an advertisement, are listed unticked and can still be tracked by quantity. Quantities and metadata are re-read from the chain when the selection is applied, so a tampered selection can only change which assets are tracked, never what they claim to hold. Previewing an address creates no connection record, so an abandoned flow leaves nothing behind. The panel and both modal steps carry a price-provider warning: with no crypto market data enabled every wallet is valued at zero, which users report as a broken sync rather than a missing setting, so it is said before linking and links to where to fix it. The Bitcoin single-address limit and "never enter a seed phrase" are stated in the linking UI too. Errors are separated by kind. A rate limit or an unreachable explorer gets its own localized message. Anything else is a bug: the user sees a generic message and the class and message go to DebugLogEntry, never into the response — asserted in the tests, which also check the exception text does not appear in the body. Adapters now translate their data source's errors into Onchain::Chains errors, so the controller rescues two chain-agnostic types instead of carrying a list of every explorer's error classes — which would have put per-chain knowledge back into the controller. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): manage, review tokens, change address, disconnect Four actions, because two would make the token choice irrevocable. Review tokens reopens the selection screen with the address left alone — deliberately without an address field. Without it the only way to untick a token would be to change the address, which is a different operation entirely. Assets the chain no longer reports stay listed and ticked, so they can be dropped once they are gone. Disconnect one asset is a per-row action with a button next to every asset. A destroy route no view calls is dead code: the feature does not exist until it has a button, so the test asserts one form per asset rather than one per wallet. Change address updates the existing rows instead of recreating them, so the accounts, holdings, entries and balance history all survive — verified by asserting a pre-existing balance is still there afterwards, and checked against the recreate-instead-of-update behaviour, which fails it. The content digest is cleared so the next sync reprocesses even if the new address happens to hold the same amount, and an account still carrying its generated name is renamed to match. Disconnect wallet drops every asset at one address and leaves other addresses alone. Disconnecting never destroys an account: the provider link goes, holdings are detached, and what the user can see stays as a manual account that stops updating — the same contract every other provider's unlink has here. The duplicate-address guard covers initial linking as well as address changes. Without it, re-linking an already-tracked address would become the unofficial way to add a token, quietly creating a second set of rows for the same wallet; both guards are checked against that pre-fix behaviour. Every lookup and mutation is scoped through Current.family, including the per-row disconnect, which cannot reach a row belonging to another connection. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(onchain-wallets): hosting guide for self-custody wallet tracking docs/hosting/onchain-wallets.md covers what the feature reads, which endpoint serves each network and how to point it at your own instance, the optional Etherscan key and why it is optional, the per-sync request cost and where history is capped, and the management actions. Two things get stated plainly because they generate the support traffic: prices come from a separate market data setting, so with no crypto-capable provider enabled every wallet is tracked by quantity and valued at zero; and Bitcoin is one address at a time, which under-reports an HD wallet whose funds are spread across derived addresses. Every locale key the feature uses is checked to resolve, including the pluralised ones. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): keep EVM balances on the keyless indexer when a key is set Configuring an Etherscan key moved every read onto Etherscan, including balances. That was wrong: Etherscan has no free endpoint that enumerates an address's tokens, so its token balances are summed from transfer history — which cannot see a rebasing token's current balance, and silently under-reports any wallet whose history exceeds the page cap. A user adding a key to fix a rate limit would have quietly traded it for wrong balances. The two reads are now separated by what each backend can actually answer. Balances and activity detection always go to the keyless indexer, whose address summary answers both in one request — so adding a key buys nothing there and cannot cost anything either. History, the paginated and rate-limited half, is where a key helps and is the only thing it changes. Provider::Etherscan drops its balance methods and refuses token_balances with the reason, rather than offering an approximation that reads as a fact. The chain-agnostic error mapping now accepts several error families per role, since one snapshot can involve both backends. Checked against the pre-fix behaviour: with balances routed through the keyed backend, the new test reports 1 USDC held instead of the 7 the indexer sees, and Etherscan raises on the balance call. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): name verified SPL tokens so they can be priced Solana RPC returns mints, not names, so every SPL token outside the hard-coded handful showed up as "SPL:abcd…wxyz" — which security resolution correctly declines, leaving the asset tracked by quantity and valued at zero. For a wallet holding anything beyond USDC that was most of its value. Names now come from Jupiter's keyless token search, asked once per snapshot for every mint at once, cached 24 hours per mint. Only mints the list reports as *verified* are trusted. Anyone can mint a token calling itself USDC; naming an unverified one would hand it the real dollar's price and value dust at thousands. Unverified and unknown mints keep the placeholder, and the test for that asserts the spam token is not named USDC. Misses are cached as well, because spam wallets hold many mints that will still be unvouched-for tomorrow. Metadata is a naming nicety, not the wallet: a list that is down or rate limiting degrades to placeholders instead of failing the snapshot, and the hard-coded mints stay as an offline floor. Assets and movements resolve from the same lookup, so a token cannot be called two different things within one snapshot. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): enable crypto pricing in one click, and log zero valuations The warning said what was wrong and where to fix it, but still made the user navigate to another settings page and pick the right provider out of a list. On a self-hosted instance an admin can now fix it from the warning itself: the crypto provider is appended to the enabled securities providers, leaving the others alone — enabling crypto prices must not turn off whatever prices the user's equities, and the test fails if it does. On a managed instance the providers are the operator's setting, so the button is not offered and the action refuses. The other half is diagnosis. Until now a holding valued at zero for this reason looked exactly like a holding whose price simply had not been fetched yet: nothing recorded it, so support had to infer it from a screenshot. The processor now records it via DebugLogEntry — but only for this cause, since a price merely missing for today is ordinary and already covered by the backfill. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): upgrade display-only movements once their price is known A wallet linked before market data covered its history got the worst of both worlds: its transfers landed as zero-amount excluded entries, and nothing ever brought them back. The syncer only reprocesses assets whose on-chain state changed, and a two-year-old transfer never changes — so the cost basis stayed broken for exactly the wallets that were linked earliest. perform_post_sync now runs a repair over every linked asset, not just the ones that moved: what changed is the price history, which no chain read can report. It reads prices from the database only, makes no network call, and does nothing when there is nothing to upgrade. An upgraded entry keeps its external_id, so it is the same transfer rather than a duplicate. The entry is destroyed and rewritten because an Entry cannot change entryable type in place and import_trade refuses an id already held by a Transaction. Entries from other providers are never touched — matched by source and by this asset's own id prefix. Checked against the pre-fix behaviour: with perform_post_sync empty again, the syncer test fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(onchain-wallets): make history truncation visible and its depth configurable History was capped silently. A wallet with more transfers than one sync reads looked exactly like a wallet whose history was fully imported — the only trace was a Rails log line on Bitcoin, and nothing at all on the EVM and Solana paths. A user reconciling their cost basis had no way to tell the difference between "this is all there was" and "we stopped reading". Each source now reports whether it stopped on the budget or on the end of the history. That travels on the Snapshot, so it stays chain-agnostic; the flag is recorded on the affected rows, the manage screen says the history is incomplete for that address, and the importer records it once per address per sync — only when something changed, so an idle wallet with deep history does not log the same line every night. The message also states what is not affected: balances come from an address summary, never from history. The depth itself is a hosting decision, not a property of a chain, so it moves out of the providers into Onchain::HistoryBudget and is settable with ONCHAIN_HISTORY_MAX_PAGES (default 10, clamped to 200). Adapters inject it, so the providers stay unaware of the policy and the budget is testable without touching the environment. What this does not do is resume where it stopped. Reading older history across syncs needs a per-wallet cursor and changes what the content digest means — which is what guarantees an idle wallet writes nothing — so it is a change of its own rather than a rider on this one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): read Blockscout token balances the way the API accepts Verified against the live API: /api/v2/addresses/{address}/token-balances rejects a `type` filter with HTTP 422 — the filter exists on token-transfers, not here. Every EVM snapshot was therefore failing in production and surfacing as "the explorer could not be reached", while the tests passed because the stub encoded the same wrong assumption. No unit test can catch a mistaken API contract; only asking the API can. Without the filter the endpoint answers with every token standard the address holds — ERC-20, ERC-721, ERC-1155, ERC-404 — so ERC-20 is now selected client-side. An NFT row carries value "1" and no decimals, so it would have been imported as a fungible balance of one token, priced by whatever its symbol happened to resemble. The tests now stub the endpoint the way it really answers and assert we ask without a query, so re-adding the filter fails the run. Each token's market-cap signal is carried through for the next commit, which has to decide what to do about an address holding thousands of tokens. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): bound how many tokens one address can surface Probing the live APIs turned up the other thing the stubs were hiding: real addresses are airdrop dumping grounds. A well-known Ethereum address returns 7,924 ERC-20 balances (3.2 MB), and a comparable Solana one 2,801 token accounts. Nothing bounded either. That meant a review screen with thousands of rows nobody can use, and on Solana — where names are looked up in batches of 50 — around 56 extra requests per sync just to label an airdrop dump. One read now surfaces at most 200 tokens per address (ONCHAIN_MAX_TOKENS_PER_ADDRESS, clamped to 5,000). The native coin is never affected, and anything already tracked keeps syncing regardless of the cap. What survives the cap has to be both sensible and stable. On EVM the tokens are ranked by the market cap the indexer already reports, so real assets stay and airdrops fall off the end. Solana RPC gives no such signal, so the order is the mint address: arbitrary, but identical between two reads of an unchanged address — an unstable order would reshuffle the wallet, change the content digest, and rewrite holdings every night. There is a test for that on both chains. On Solana the cap is applied before metadata lookup, so it bounds the requests as well as the rows. The cap is not silent: it is recorded on the affected rows, stated in the token review screen and in Manage wallets, and reported alongside history truncation in the debug log with the limit that applied. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(onchain-wallets): walk the linking and management flow in a browser The linking flow stacks three Turbo frame navigations — the provider drawer, the linking modal on top of it, then the token review in that same modal — and no controller test exercises any of that. Driving it in a real browser found two things worth keeping: The panel is reached two different ways. With nothing linked yet it is a card under "Available" that opens the drawer; once a wallet exists the provider moves to "Your connections", where the panel renders inline inside a disclosure and there is no link to click at all. Only the first path had ever been exercised. Both paths now are, along with the parts of the flow that only exist in a browser: assets arriving pre-ticked or not according to whether they can be priced, review tokens reopening the selection with no address field present, and disconnecting one asset leaving its account behind. One test per flow — the branching cases stay in the controller test, where they cost a fraction of the time. Verified visually at each step: the warning banner, the Bitcoin single-address note, the three-asset review with the spam token unticked, the four management actions, and the accounts landing under Crypto with the wallet subtype. Full system suite green the documented way (DISABLE_PARALLELIZATION=true): 94 runs, 385 assertions, 0 failures. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): report a timed-out data source as unreachable Reading a real Solana wallet turned up the hole: the public RPC timed out, Net::ReadTimeout escaped every layer untranslated, and the user was told something had gone wrong with Sure — the generic message reserved for our own bugs — with a DebugLogEntry filed as if it were one. A public endpoint being slow is the most ordinary failure this feature has. All five clients now translate transport failures into their own ApiError: timeouts, refused or reset connections, unreachable hosts, TLS errors, and a response that is not JSON. The adapters already map a provider's own errors onto Onchain::Chains::UnreachableError, so a timeout now reads as "the public explorer could not be reached", the message that tells the user to retry, while genuine bugs keep the generic one. During chain detection it goes back to meaning "not detected here", so a slow explorer still cannot break linking. The translated message carries only the error class, never the original message, because a transport error's message contains the full URL and these get logged. Checked against the pre-fix behaviour on Bitcoin: with the translation removed, the timeout test fails with the raw exception instead of the chain error. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): name on-chain trades after the asset, not "shares" Running a real Bitcoin address through the app showed every imported transfer as "Buy 0.000003 shares of CRYPTO:BTC". That name comes from the shared trade helper, which is written for equities; a wallet does not hold shares, and the internal ticker is not what the user calls the coin. Trades are now named "Buy 0.000003 BTC", through i18n like the display-only entries already were. Also drops the sync status_text calls. Sync has no such attribute in this schema, so every one of them was a guarded no-op and the four locale strings they referenced could never render — dead weight copied from another provider's syncer. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): keep balances when a source refuses history Reading real wallets on the free Solana endpoint exposed two problems, one of which I introduced. The budget. Making history depth configurable scaled Solana's transaction cap from 25 to 250, and on Solana one transaction is one RPC call rather than one page — so the same nominal depth became an order of magnitude more expensive and a sync went from seconds to minutes. The per-transaction budget is now its own constant, scaled proportionally off the page knob so one setting still moves both, with a test that pins it far below the paginated row count. The bigger one: a failure while reading history threw away the balances too. A balance is one bounded request and is what a wallet fundamentally is; history is paginated, far more expensive, and the first thing a throttled endpoint refuses. On the free Solana endpoint, which routinely throttles getTransaction, that meant a wallet showed nothing at all rather than showing what it holds — permanently, not transiently. History is now best effort: when the data source refuses it, the balances are still recorded and the history is marked incomplete, which the manage screen already surfaces. Anything that is not the data source failing still raises, so a bug here cannot be swallowed. Verified live: the same Solana wallet that failed entirely now reports 52.06 SOL and its SPL tokens with the history flagged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): pre-tick what is worth something, not what parses as a ticker Linking a real airdropped address showed 200 of its 201 assets arriving pre-ticked, one click away from 200 accounts — the opposite of what reviewing tokens before import is for. The pre-tick rule was "the symbol looks like a ticker", and airdrops use perfectly plausible short symbols (0XBTC, 4CHAN), so it selected nearly everything. Assets now carry whether the data source treats them as notable, and only those are pre-ticked. Two attempts at that signal, decided by measuring the real address rather than guessing: - Blockscout's `reputation` is "ok" for all 6,669 tokens it holds. Useless. - Market-cap presence looks strong on the full list (365 of 6,669) but is useless after the cap, which already ranks by market cap — hence every surfaced token having one. - Holding value discriminates: of the 365 priced tokens, 112 are worth more than a dollar. So on EVM networks a token is notable when the indexer can price it and the holding is worth more than a dollar; on Solana when the verified token list vouches for the mint; the native coin always. Pre-ticked count on that address drops from 200 to 72, and everything else stays one click away. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): warn when nothing can convert USD prices into the family currency A family whose currency is not USD needs two settings, not one, and only the first was covered. The single provider that prices bare crypto symbols quotes in USD, so valuing a wallet in EUR needs an exchange rate on top — and Sure's default exchange rate provider requires an API key, so a self-hosted install without one has no FX at all. Tested against a real address in a EUR family: every wallet came out at zero, with 275 transfers recorded as unpriced, and nothing anywhere said why. That is the same support ticket the crypto-provider banner exists to prevent, arriving through the other door. Onchain::Pricing answers "can an on-chain asset be valued in this currency, and if not, why" with the two reasons separately. The linking UI states whichever applies — naming the currency for the FX one, and pointing at Frankfurter, which needs no key — and a USD family never sees that warning because it needs no conversion. The processor records the reasons when a holding lands at zero, so support sees "exchange_rate" rather than guessing. Verified live afterwards: with EXCHANGE_RATE_PROVIDER=frankfurter, the same EUR family values the wallet at 416,198,342.25 EUR at 0.86363 USD/EUR, with all 275 transfers priced in EUR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): let a movement become a trade after being display-only Syncing a real wallet twice — once before its prices were reachable, once after — raised ArgumentError from the shared importer: an Entry cannot change entryable type in place, and the display-only Transaction already held the external_id the trade needed. That is the ordinary case, not an edge one. A wallet linked before market data covers its history gets display-only entries on the first sync, and the first sync that can price them dies. Worse, it dies inside perform_sync, so the repair pass that exists precisely to upgrade those entries — and which runs in perform_post_sync, afterwards — was never reached. The account stayed stuck. Both paths now go through one writer that discards a stale display-only entry before the trade takes over its identity, so the entry keeps being the same transfer rather than becoming a duplicate. Checked against the pre-fix behaviour: without the discard, the new test raises the original ArgumentError. Found by running a EUR family through two syncs on real data, which is the only way the two price states occur in order. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): write a trade and drop its display-only entry atomically Replacing a display-only entry with the trade it became is one change, but it was two writes outside a transaction. A failure between them left the account with neither: the transfer disappeared until some later sync happened to rewrite it, which for an idle wallet could be never. The repair pass already wrapped this; the sync path did not, and that is the one that runs first. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): tell apart two transfers of one token in one transaction A token transfer was identified by its transaction hash and contract, which are not unique together: a swap router or a batch payout routinely emits several transfers of the same token involving the same address within one transaction. The second overwrote the first, so a transfer disappeared from the account without a trace. Both EVM backends report the log index — the field that makes an event unique inside a transaction — and neither was using it. It is now part of the identifier, with the contract kept only as a fallback for an instance that does not report one. Reported by review on #3081; confirmed against the live Blockscout payload, which carries log_index. The test fails against the previous identifier. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): canonicalise an address per chain before anything keys off it Addresses were only stripped, never canonicalised, and what counts as the same address differs by chain — so the duplicate guard could be walked straight past and one Bitcoin case was worse than a duplicate. On EVM, hex is hex: 0xABC… and 0xabc… are one wallet, but they linked as two, each with its own accounts and holdings for the same balance. On Bitcoin, bech32 is case-insensitive and canonically lowercase, and the API reports outputs that way. An uppercase bech32 address passed validation, gave a correct balance from the address summary, and matched no output at all — so the wallet silently had zero movements and no cost basis, with nothing anywhere saying why. Canonicalisation is now the adapter's answer, since only the chain knows whether case carries identity: EVM and bech32 fold, Base58 and Solana are left exactly as given. The controller applies it as soon as the chain is known and before the duplicate check, and on an address change too. Reported by review on #3081. Both tests fail without the folding. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): stop folding the case of Solana mints Contract identifiers were downcased everywhere on the assumption that a contract address is hex. That holds for ERC-20 but not for an SPL mint, which is a Base58 public key where case is part of the value: the stored mint was an unusable copy of the real one, and two distinct mints could collide once folded into the same string — one wallet's balance landing on the other's row. Whether case carries identity is a property of the token kind, so it is now answered in one place and applied consistently: by the asset's identity key, by the column, and by the two comparisons in Onchain::Snapshot. A Movement no longer folds anything on its own, because a movement does not know its asset's kind. That also removes the duplication review flagged: the asset key was derived in three places and only one of them folded, so the review screen and the linker could disagree about what identifies an asset. There is one definition now, OnchainWalletAccount#asset_key. Reported by review on #3081. The test fails with the unconditional fold. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): isolate a failing address, and let a late symbol land Two problems in the importer, both reported by review on #3081. One unreachable address took the whole connection down with it: the loop over a family's addresses had no rescue, so a Bitcoin explorer being throttled left an untouched Ethereum wallet unsynced as well. Each address is now recorded and skipped on its own — a row we failed to read keeps its previous quantity rather than being zeroed, since we did not learn that it holds nothing — and only a connection whose every address failed is reported as a failed sync rather than a quiet success. The content digest covered quantity and movements but not the metadata written alongside them, so a Solana mint that later gained a real symbol from the token list produced the same digest as before: the row was never rewritten and its placeholder label became permanent. That silently undid the token-naming work. The digest now covers everything the update writes. Both tests fail against the previous behaviour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(onchain-wallets): use DS::Button for the wallet actions Five hand-built button_to controls carried their own utility-class strings for what DS::Button already does — sync, disconnect a connection, stop tracking one asset, disconnect a wallet, enable crypto prices. They drifted from the design system on size, hover and destructive treatment, and the confirm prompts were wired by hand. The browser test walks the two that matter, so the behaviour is unchanged; this is the styling and the confirm handling moving to the component that owns them. Reported by review on #3081, along with the raw `bg-amber-600` on the provider badge — left as it is, deliberately: all 23 other providers set a raw palette class for their badge, there is no functional token for a brand colour, and changing one entry would make it the only different one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): four smaller findings from the review on #3081 **A failed read no longer leaves an empty connection.** `link_wallet` created the family's connection before fetching the address, so an explorer being down left a connection with no wallets showing in the panel as connected. Reading needs no saved connection — which is exactly why previewing uses an unsaved one — so it is now created only once the read succeeds. **Assets that could not be tracked are named instead of blamed on the user.** `success?` is `created.positive?`, and the only failure message was "pick at least one asset to track" — so a user who ticked three assets and hit three failed creates was told to tick something, sending them back to tick the same three. The linker already collected which assets failed; the message now says so, and a partial failure is reported alongside what did get tracked instead of being dropped silently. Same fix in the token revision action, which had the same shape. **A malformed stored amount costs its movement, not the asset.** `BigDecimal()` on a stored payload raises, and one unparseable row would fail the whole asset's processing — including the repair pass. These payloads are written by this code, so it takes a row that survived a format change, but the containment is two lines. **No dead-end link.** The warning offered "open market data settings" to everyone, while that page is gated to self-hosted admins — the same gate the enable button already had. Both controls are now behind it, and the warning text stands on its own for everyone else. Each has a test that fails against the previous behaviour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): reject non-finite amounts and quantities The guard added an hour ago for malformed stored amounts was incomplete for the very case it was written for: BigDecimal parses "NaN", "Infinity" and "-Infinity", and none of them is zero, so all three sailed through `parse_amount` into trade materialisation. Verified rather than assumed — the test fails without the check with PG::NumericValueOutOfRange, so the infinity reached the insert. Fixed at both layers that write numbers. Movements: a non-finite amount skips its movement, like any other unparseable one. Quantities: `normalize` treats non-finite as unknown and writes zero, because Postgres numeric stores NaN happily and one NaN quantity would turn every total that reads it into NaN. Reported by review on #3081. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): derive the content digest from what actually gets written Third time the digest missed a field it was supposed to cover: first the symbol, so a Solana placeholder that gained a real name was never rewritten; now the truncation flags, so a wallet whose history became complete — or started being capped — kept showing the old completeness in the UI, since the early return fires before `extra` is touched. Rather than add a third field to a hand-picked list, the digest is now taken from exactly the attribute hash that is about to be written. The two cannot drift apart, which is what kept going wrong. That needs two things to hold. Movements are sorted before the payload is built, so the order a source happened to list them in is not mistaken for a change. And the hash is canonicalised before hashing, because jsonb does not preserve key order: `extra` written as {history, assets} comes back as {assets, history}, and hashing that raw made an idle wallet's digest flip every other sync — the tests caught it, and it is now covered by one asserting that reordered movements are not a change. Reported by review on #3081. Both halves checked against the pre-fix behaviour: without the flags two tests fail, without the canonicalisation three. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(onchain-wallets): state the pricing coverage limit, and that DeFi is unseen The hosting guide explained how to configure prices but never said what the crypto provider actually covers. It quotes by symbol, and a symbol is not a token's identity — measured on a real Ethereum address, two of its ten largest token positions were quoted and the other eight, including holdings worth roughly $406k, $141k and $74k, showed zero with their quantities tracked correctly. That reads as a broken sync unless it is written down, so it is now the first limitation in the list, with the practical rule a user needs: a zero next to a token you know is worth something means the provider does not list it, not that the balance is wrong. Troubleshooting gains the matching entry, separating it from the two configuration causes that produce a zero across every wallet. Also records that DeFi positions — staked ETH, LP tokens, lending, Solana stake accounts — are invisible, which was missing from the list entirely. A wallet holding most of its value in a staking protocol reports a fraction of it. Docs only; no code touched, so the suite was not re-run — the last run on this tree was green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): do not zero an asset the token cap never reached A tracked asset missing from a snapshot was always read as "the wallet no longer holds it" and set to zero. That is right for a complete read, and wrong for a capped one: at most 200 tokens per address are surfaced, so a tracked token can be absent simply because the read stopped before reaching it. Its balance was then wiped — a real holding removed from the user's net worth, with a holding of zero written and the account balance reduced to match. It is reachable: on Solana the surfaced set is ordered by mint address, which is arbitrary, so a genuinely held USDC position on an airdropped wallet can fall outside the cap and be zeroed on the next sync. Absence of evidence is not evidence of absence — the same distinction this code already makes for an address it could not read, where the row keeps its previous quantity. When the snapshot is capped and the asset is not in it, the row now keeps what was last known and only its completeness flags are refreshed. Reported by review on #3081. The test fails against the previous behaviour, and the "an asset that disappeared is set to zero" case still passes: a complete read that no longer lists an asset still zeroes it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * refactor(onchain-wallets): rename the local `token` variables the secret scan trips on Pipelock failed the PR with eleven "Credential in URL (high)" findings, all on the same shape: a local variable named `token` being assigned. `token = ...` is what a leaked credential looks like to a scanner, and the rule is a reasonable one to keep. Renamed rather than excluded. Excluding paths or adding `# pipelock:ignore` would have kept the pattern and blunted the check for everyone; the new names are at least as clear — `token_data` for the raw hash from an indexer, `metadata` for the resolved symbol/name pair, `token_asset` for an Onchain::Asset in tests. Verified with the scanner itself rather than by inference: the same pipelock 2.8.0 the workflow pins, run locally over the branch diff, now reports "No secrets found in diff". It also caught one site the CI log had truncated away (the system test), which is why the local run was worth setting up. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): bound detection latency, and three review findings Detection runs on the request thread but asked each candidate chain with a sync's patience: a 30s timeout, three retries and exponential backoff, per chain. A 0x address is a candidate on six networks, so one rate-limited explorer could hold the page for minutes. Detection now reads with its own budget - one short attempt, no retry, ONCHAIN_DETECTION_TIMEOUT to raise it - while syncs keep the patient one. A chain that cannot answer in time is reported as "no activity", which is the screen an ambiguous answer already produces. Also from review: - A full page of Solana signatures is now reported as incomplete history. The adapter passes no cursor, so a page that fills means the read stopped short of the address's history; counting only against the transaction budget called that complete. - A reused CRYPTO: security with no price provider is bound to the crypto one. A blank provider falls back to whichever is enabled first, and only the crypto provider quotes a bare coin symbol, so the holding valued at zero and read as a broken sync. A provider another integration chose is left alone: the CRYPTO: prefix is shared with the exchange integrations. - The chain select's label reached the form builder as an HTML attribute instead of a label option, so no <label> was associated with the field. Each regression test was checked against the pre-fix code: the two detection tests fail with four requests instead of one, and the truncation test fails by reporting complete history. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): let the table refuse a token row with no contract The partial unique indexes key a token on its contract address, and NULLs are distinct to Postgres, so a token row that reached the table without one would slip past its index and duplicate freely. The model already refuses it, but a direct write does not go through the model, and this repo puts simple guarantees like this in the database. Added to the existing migration rather than a new one: the table is created by this branch, so the constraint belongs with it, and this leaves the schema version untouched. The regression test writes with validate: false, which is how the sibling tests prove a guarantee comes from the table rather than from the model above it. Without the constraint it fails with "expected but nothing was raised". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): detect a token-only Solana wallet, and pin asset_kind Two findings from the review of the previous commits. Detection read only the wallet's lamports, so a wallet emptied of SOL but still holding SPL tokens answered "nothing here". Each token account carries its own rent, so an empty wallet address is not an empty wallet. The token accounts are asked only once the balance comes back zero, so the ordinary case still costs the one request this probe is meant to be, and accounts left behind empty do not count as activity. The narrow blast radius is worth stating: has_activity? only runs when an address matches more than one chain, and when no candidate answers the user is asked to choose rather than turned away. So this was a worse screen, not a rejected wallet. Separately, the check constraint accepted any asset_kind that carried a contract address. Each partial unique index names its kind, so a row with any other one is keyed by nothing and duplicates freely. Adding a token kind already means adding its index here, so pinning the three in the table adds no coupling that the indexes did not already have. Both regression tests fail on the previous code. The third test - emptied token accounts are not activity - passes either way by design: it guards the new branch rather than testing it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * test(onchain-wallets): cover the asset_kind constraint that shipped without it The constraint landed in b3dae571 but its regression test did not: the `git add` named the test/models/onchain directory, and this file sits beside it rather than inside it. Committing the test the constraint was written for. Without the constraint it fails with "expected but nothing was raised". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(onchain-wallets): stop a slow explorer from reading as an empty wallet Regression from the detection budget added two commits ago, caught by probing the real endpoints rather than the stubs. The 5s budget sat directly on base.blockscout.com's median latency (p50 4.79s, slowest successful probe 9.5s), so roughly a fifth of probes timed out. The timeout was swallowed into false, which detection cannot tell apart from "this address is not here" — and when one other chain answers yes, a single yes settles it. A Base wallet could therefore be linked as Ethereum-only, silently and permanently. Three changes, and they are one fix: - A probe that cannot answer now returns nil rather than false, and a nil sends the user to the chain chooser instead of letting a lone yes settle it. Being slow and having nothing to report are different answers. - Probes run concurrently under one absolute deadline. The client timeout could never bound the page anyway: HTTParty applies it per socket operation, so a "5s" probe was measured at 10.1s. The deadline is wall clock and covers the whole detection, whatever the client is doing. - The timeout is 10s, with the reason for the number written down. Measured against the live explorers, before and after: base false negatives 4/18 -> 0/10, and detection of a 0x address across six chains 9.4-10.7s -> 4.3-4.8s, because the cost is now the slowest chain rather than their sum. The detector had no test of its own; it has four now, three of which fail on the previous code, including the concurrency one by reporting "three 0.3s probes took 0.9s, so they ran in sequence". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>	2026-08-22 21:27:38 +02:00
3 people	e5750a6c09	feat(budgets): add per-user personal budgets with strict isolation (#2891) ... * feat(budgets): add per-user personal budgets with strict isolation Families can now opt into personal budgets (toggleable via family settings): each family member gets their own budget for a given period instead of sharing a single family-wide budget. - Add families.personal_budgets flag and budgets.user_id, with partial unique indexes so shared budgets (user_id IS NULL) and personal budgets (user_id IS NOT NULL) can't collide. - Budget.find_or_bootstrap scopes lookup/creation by user when the family has personal_budgets enabled. - Scope most_recent_initialized_budget (used to seed a new budget from the prior period) by user_id so one user's copy-forward never bleeds into another user's budget. - budgets.user_id cascades on user deletion so personal budgets don't outlive their owner. * feat(budgets): enforce user-specific budget ownership and cascade deletion * feat(budgets): display user name for personal budgets in budget card on the plan section * feat(budgets): enhance personal budgets display for admins with preview feature indication * feat(budgets): enforce user-specific budget and category visibility for personal budgets * feat(budgets): create budget section titles and add translations notice in preferences * feat(budgets): let household and personal budgets coexist with sharing Previously enabling personal_budgets made the shared household budget unreachable. Budget.find_or_bootstrap now takes an explicit household: flag so both can be resolved independently for the same period, with a new household_budget_enabled family setting to opt out of the household side and keep personal budgets only. Adds a BudgetShare model (read_only/read_write) so a member can grant another family member access to their personal budget, enforced via Budget#viewable_by?/editable_by? across BudgetsController, BudgetCategoriesController, PlansController, and the read-only API. Preferences gains a Budget sharing card (gated on preview access like the rest of the personal budgets UI) and an owner switcher pill ( Household / mine / shared-with-me) appears on the budget page and the Plan hub card. Also fixes personal budgets showing the same "actual spending" as the household budget: actual spending/income now scope to the budget owner's own accounts instead of the viewer's full accessible set, via a new accounts: override on IncomeStatement. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * feat(budgets): enhance budget switcher with icons and improved styling * feat(budgets): remove user name display from budget card and header * feat(budgets): remove unique index on taggable_type and taggable_id in taggings * feat(budgets): enhance budget sharing functionality and improve UI elements * Collapse personal budget migrations --------- Signed-off-by: JulienGourmet <69808509+jubbakka@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: sure-admin <sure-admin@splashblot.com>	2026-08-18 08:36:46 +02:00
Guillem Arias FausteandJuan José Mata	acf4cb2010	fix(goals): allow deleting a goal without archiving it first (#2963) ... * fix(goals): allow deleting a goal without archiving it first Goals could only be deleted after being archived. `GoalsController#destroy` redirected with "Archive the goal before deleting it." unless the goal was already archived, and the Delete item in the show-page kebab was wrapped in `if @goal.archived?`. Nothing in the archive confirm copy hinted that archiving was the prerequisite, so in practice an active goal had no delete affordance anywhere in the UI. The gate bought no safety. Destroying a goal cascades only to its own `goal_accounts` and `goal_pledges`, and `GoalPledge#clear_matched_transaction_extra` unstamps `extra["goal"]["pledge_id"]` from any transaction a matched pledge claimed. No account, balance, entry or transaction is touched. Every other resource in Sure (accounts, categories, rules, family merchants) deletes in one step. Drop the gate, render Delete unconditionally, and shorten the label from "Delete permanently" to "Delete" now that it no longer needs to contrast with an archive-first step. The confirm copy moves to `Goal#deletion_confirm` and spells out what survives. The generic `CustomConfirm.for_resource_deletion` only says "This is not reversible", which overstates it for a goal. Index cards deliberately keep no actions — the card stays a single click target, and the show-page kebab is one click away. * fix(goals): escape the goal name in the delete confirmation `confirm_dialog_controller` assigns the confirm `body` to `innerHTML` — bodies such as the accounts' `confirm_body_html` legitimately carry markup — so a goal named "<img src=x onerror=…>" ran as soon as a family member opened the delete confirmation. Verified in a browser: parsing the rendered `data-turbo-confirm` and assigning its body produced a live `<img>` element with a working `onerror` handler. Escape the interpolated name. Only `body` needs it; the dialog sets its title and button label with `textContent`. `CustomConfirm.for_resource_deletion` interpolates a record name into the same HTML-rendered body and was already reachable from accounts, categories, rules and family merchants, so it is escaped here too rather than left as a known hole next to the fixed one. Also add the three `confirm_delete_*` keys to every locale that ships goal translations. Fallbacks meant these silently rendered English rather than breaking, so this is untranslated copy rather than a fault — ru is included, which the review list omitted. * i18n(confirm): move the resource-deletion copy to locale keys `for_resource_deletion` built its title, body and button label as English string interpolation, against the project's rule that user-facing strings go through `t()`. It backs ~39 call sites — accounts, rules, tags, chats, every provider item — so all of them were English-only. Moved to `shared.custom_confirm.resource_deletion_*`, alongside the `default_*` keys the same class already used. `titleize` / `downcase` stay applied to the record name so the English output is byte-identical to what the hardcoded strings produced; a locale needing different casing can absorb it in its own string. Pinned by a test, along with the escaping of the one field the dialog renders as HTML. * i18n(confirm): translate the resource-deletion copy The keys added when this copy moved out of hardcoded English only landed in en.yml, leaving ~40 call sites falling back to English in every other locale. Added to the eight other shared locale files that already carry the sibling `custom_confirm.default_*` strings: ca, fr, hu, it, ru, tr, vi, zh-CN. Each body reuses that locale's own "this is not reversible" sentence, so the generic and resource-specific confirmations read the same, and each follows the register its `default_title` already set (vous / siz / Вы, tu for ca). The remaining shared locale files (de, es, nb, nl, pl, pt-BR, ro, zh-TW) have no `custom_confirm` block at all, so they are left alone — adding one would invent structure they have not adopted, and fallbacks already cover them. The test derives its locale list from which files define the sibling key rather than hardcoding it, so it follows that set as it grows. * test(goals): restore the active-goal destroy test lost in the merge Merging main into this branch hit a conflict in `test/controllers/goals_controller_test.rb`: main had added two tests immediately above the destroy block, and the resolution took main's side wholesale for that hunk. That resurrected `destroy on non-archived is rejected` — the test this PR replaces — and dropped its replacement. The resurrected test failed against the new controller, since destroy no longer gates on `archived?`: GoalsControllerTest#test_destroy_on_non-archived_is_rejected `Goal.count` didn't change by 0, but by -1. Swap it back for `destroy deletes an active goal and cascades to its links and pledges`. Main's two new tests stay. * i18n(goals): finish the delete copy in de and zh-TW Nine locales ship goals translations, not seven. `de.yml` and `zh-TW.yml` were left behind: both still carried the dead `goals.destroy.archive_first` key, still labelled the kebab item "Delete permanently" (Endgültig löschen / 永久刪除) after it was shortened elsewhere, and had none of the `confirm_delete_*` keys, so a German or Traditional Chinese family saw the new delete dialog in English. Add the three confirm keys using each file's existing vocabulary — Zusagen for pledges in German (informal du, matching the rest of the file), 投入 in Traditional Chinese — drop `archive_first`, and shorten the label. `confirm_delete copy resolves in every locale that ships goal translations` could not have caught this. It hardcoded the seven locales, and its assertions went through plain `I18n.t`: the backend has I18n::Backend::Fallbacks mixed in, so a missing German key resolved to the English string and `.present?` passed anyway. Verified — deleting `confirm_delete_title` from `de.yml` left the test green. Derive the locale list from the goals YAMLs and look the keys up with `fallback: false, default: nil`. The same deletion now fails with "de is missing goals.show.confirm_delete_title". --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>	2026-08-16 08:12:45 +02:00
Dima Degtyar @d_degtyarandDmytro Degtyar	bbd2e2760b	Add Ukrainian (uk) locale support (#2993) ... * Add Ukrainian (uk) locale support * Fix critical i18n bugs: interpolation mismatches, wrong mailer keys, duplicate YAML key --------- Co-authored-by: Dmytro Degtyar <d.degtyar@users.noreply.github.com>	2026-08-13 07:31:32 +02:00
Guillem Arias Fauste	6245b9cbd0	fix(pagination): stop the pager wrapping on narrow screens (#2967) ... * fix(pagination): stop the pager wrapping on narrow screens The page-number strip put the last page on a second line on a phone. The container was a plain block, so the inline-flex links flowed as inline content and wrapped like words. Measured on a 760-page list: the strip needs ~198px, and a 360px viewport leaves ~158px once the chevrons and the per-page select are taken out. The failure was not even consistent — at 402px the row wrapped, at 360px the same markup overflowed its parent instead, because a block box inside a flex item resolves its width differently at each size. Make the strip a nowrap flex row, and drop the pages that aren't useful on a phone. Small screens keep the first page, the last page, the current page and the gaps ("1 … 5 … 760", ~148px); the full series returns from `sm` up. Short series are left alone — Pagy only emits those when the collection has that few pages, so hiding there would render a 3-page pager as "1 3". `sm:` is a viewport breakpoint and the pager also lives in narrow columns on wide screens (the account activity feed with both sidebars open), so the row keeps `overflow-x-auto` as a backstop. At 320px, where even the reduced set is wider than the space, it scrolls rather than wrapping. Shared by twelve call sites, so this covers transactions, imports, rules, account activity, statements, merchants, exports and the debug log. * fix(pagination): mark the pages the mobile pager drops Hiding the middle page links without saying so made the survivors read as adjacent. On a 760-page collection sitting on page 3, Pagy emits [1, 2, "3", 4, 5, :gap, 760] and a phone rendered "1 3 … 760" — page 2 gone with nothing to show for it. A gapless 6-page series was worse: "1 6". Each collapsed run now renders its own mobile-only ellipsis, unless Pagy already put a gap beside that run, which would otherwise read as "… …". [1, 2, "3", 4, 5, :gap, 760] -> 1 … 3 … 760 ["1", 2, 3, 4, 5, 6] -> 1 … 6 ["1", 2, 3, 4, 5, :gap, 760] -> 1 … 760 (Pagy's gap already covers it) [1, :gap, 3, 4, "5", 6, 7, …] -> 1 … 5 … 760 The helper now returns a per-slot plan rather than a class, since the view needs to know where a run starts, not just whether a slot is hidden. Tests carry a property check — no two page numbers may survive side by side unless they are consecutive — with a guard that fails if every pair happens to be separated by an ellipsis, which would make the property vacuous. It was, on the first pass.	2026-08-13 06:41:01 +02:00
Guillem Arias Fauste	440e04b942	fix(insights): blur amounts in insight prose under privacy mode (#2865) ... Insight titles and bodies are stored as finished prose with the amounts already interpolated (by the i18n template or the LLM writer), so the dashboard feed and insight cards rendered raw figures even when the hide-numbers toggle was active — only the right-aligned key figure was tagged privacy-sensitive. Add InsightsHelper#insight_privacy_text, which wraps each numeric fragment (currency amounts, percentages, bare counts, including suffix-currency and no-break-space locale formats) in a privacy-sensitive span at render time, and use it for the title and body in both the dashboard insights feed and the insight card. The sentence stays readable while privacy mode blurs the numbers. The helper splits the raw text before escaping and reassembles it with safe_join, so HTML in stored prose is still escaped and digit-bearing entities like &#39; are never mangled by the number regex.	2026-08-09 02:07:08 +02:00
Guillem Arias Fauste	9d3879a859	feat(plan): unify Budgets and Goals under a single Plan tab (#2687) ... * feat(plan): unify Budgets and Goals under a single Plan tab Preview users get one "Plan" nav entry (compass icon) in place of the separate Budgets and preview-gated Goals items. It fronts a new /plan hub with two summary cards — this month's budget (spent vs budgeted, days left, top categories) and active goals (total saved vs targets, behind/pending counts, per-goal rows) — each drilling into the existing /budgets and /goals pages, whose breadcrumbs now start Home > Plan. The two features share a home, not a model: no schema changes, no URL changes. Users without preview features keep exactly the pre-Plan nav (Budgets entry, Goals hidden), and /plan falls through to /budgets for them. Supporting changes: - Goal.active_prepared_for: index-style sorted active goals with the family-wide pooled-allocations + market-flows injection reused - Goal::FUNDABLE_ACCOUNT_TYPES and Goal::ACTIVE_DISPLAY_STATUS_RANK extracted from GoalsController - Budget#days_remaining (same day math as suggested_daily_spending) - Breadcrumbable#plan_breadcrumb_prefix for the conditional Plan crumb - New BudgetsController web tests (previously untested) + Plans tests * fix(plan): address review feedback on the Plan hub - Keep the "All goals" footer link rendered when the family has only completed/archived goals — the hub is a preview user's only route to the goals index now that the Goals nav entry is gone (Codex P2) - Replace the two hand-rolled footer button-links with DS::Link (variant secondary, full_width, right icon) per DS Drift Patrol - Fix DS::Link template comparing icon_position against the string "right" — the initializer symbolizes it, so right-positioned icons never rendered on links (DS::Button already compared symbols); existing callers passing icon_position now get the layout they asked for - Clamp progress-bar percentages to 0..100 instead of capping only the upper bound (CodeRabbit) * refactor(plan): single source of truth for goal loading, sorting, and counts Addresses jjmata's draft review notes: - GoalsController#index now builds on the shared Goal loaders instead of hand-rolling its own copy: Goal.prepared_for (preloads + family- wide backing-math injection, scope-able) and Goal.active_display_sort carry the algorithm once; active_prepared_for composes them for the hub. The controller-side constant alias is gone - One definition of "behind pace": Goal#behind_pace? (excludes paused — pausing stops the pace clock on purpose). Both the Plan hub summary and GoalsController#kpi_payload's behind/needs-this-month figures use it, so adjacent pages can't disagree. While there, the kpi on-track numerator also excludes paused goals — it was counted against a paused-excluding denominator, so the "X of Y" fraction could exceed its own total - BudgetCategory#suggested_daily_spending calls Budget#days_remaining instead of keeping an inline copy of the day math - Per the fat-model convention, the hub's aggregation moved off the controller: Budget#top_spending_categories(limit:) and Goal.summary_for(goals, currency:) * fix(plan): move Edit budget/New goal into their own cards Both actions lived in the hub's shared page header, unlinked to either card and, on mobile, wrapping above all content before any real data appeared. Each now lives in its own card's header instead: Edit budget as a compact icon-only control next to the status pill (only when a budget exists — the uninitialized state already has its own "Set up" CTA), New goal as a small outline button next to the goals count (only once there's a goal to sit beside; the empty state keeps its own CTA). Also swaps the edit icon from "pencil" to "square-pen" — at the sizes these header controls render, lucide's plain pencil is a thin diagonal stroke that reads noticeably smaller than a neighboring bold glyph like "plus", even in the same size box. square-pen carries more visual mass and reads clearly at the same footprint. * fix(plan): match established DS precedent for the card header actions Edit budget was a bare icon-only button; verified against the app's own precedent for this exact action (app/views/budgets/_budget_donut.html.erb, the budget card already shipped on /budgets) and it's a labeled secondary link with a trailing pencil, not icon-only and not a three-dot menu. Matched that: DS::Link, variant secondary, size sm, icon right. New goal gets the same treatment for consistency between the two cards' header actions, rather than the full-page-scoped "primary" weight goals/index.html.erb uses for its own create button — that's calibrated for a whole page's sole CTA, not a compact card. Adding a labeled button (wider than the bare icon this replaces) crowded the header row on mobile enough to wrap "This month" onto two lines and truncate the "· July 2026" meta away entirely. Header rows now wrap as a whole (flex-wrap) with the title pinned (shrink-0) so the action cluster drops to its own line instead of squeezing the title and meta text. Also drops the hub's footer note ("Budgets cap your spend; goals track what you're saving toward...") — redundant with the subtitle right above the cards. * fix(plan): lead the budget card header with status, not the edit action On Track/Over/Warning is what a glance at the card wants first; Edit budget is the secondary action. Swapped their order so status leads and the edit control trails, gap-2 unchanged. * fix(plan): put the status pill on the left, next to the title Meant the left side of the card, not just left of the edit button. On Track/Over/Warning now sits beside "This month · July 2026" in normal flow; ml-auto carries only the Edit budget link, alone on the right — matching the goals card's own left-meta/right-action split ("· 7 active" left, "New goal" right). * fix(plan): lead Edit budget with its icon, matching same-shape precedent Wrong axis on the earlier match: _budget_donut's trailing pencil labels the VALUE itself ("$12,850 ✎"), not a static action. Our button's label is a static "Edit budget", and that shape takes a leading icon everywhere else it appears — the categories "Edit" on budgets/show.html.erb (icon: settings-2) and "Edit split" in transactions/show.html.erb both lead with their icon. Drops icon_position: :right so it defaults to left, matching New goal's shape in the sibling card. * fix(plan): use the divider token for row separators, not border-primary Traced against the dashboard outflows list (pages/dashboard/_outflows_donut.html.erb), which renders its row separators via shared/_ruler → border-divider (border-tertiary: black/8%, white/10%). Our category and goal rows used border-b border-primary instead (black/15%, white/30%) — 2-3x heavier than the established row-separator weight elsewhere in the app. Swapped both to border-divider. * fix(plan): lift the duplicated card shell into DS::Card Codex P1: _budget_card.html.erb and _goals_card.html.erb hand-rolled the identical "bg-container rounded-xl shadow-border-xs p-5 flex flex-col" shell twice, with no DS:: card primitive to reach for instead. Extracted a minimal wrapper — content-only, no header/footer slots — matching what both cards actually need right now; the roadmap cards (envelopes #2153, retirement #2044) can adopt it too instead of copying the class string a third time. Verified pixel-identical in a browser: same classes, same DOM shape, just rendered through the component. * fix(plan): batch pace queries before sorting goals Codex P2: active_display_sort calls goal.status per goal to build the sort key; Goal#status reaches Goal#pace for any goal with a target_date, which fired its own Entry.sum(:amount) query per goal. The /plan hub renders only the first 5 of active_prepared_for's list, but paid the full O(N) query cost sorting all of them. Adds Goal.pace_for(family) (account_id => 90-day net inflow), grouped in one query and injected via inject_backing_math! alongside the existing pooled_allocations/market_flows pattern. #pace now sums from that shared map instead of firing its own query — same math, same 90-day window, same exclusions, just computed once per family instead of once per goal.	2026-08-01 08:51:08 +02:00
Guillem Arias Fauste	c40e7f4807	fix(insights): correct the budget card's figure, badge noise and toast a11y (#2799) ... * fix(insights): correct the budget card's figure, badge noise and toast a11y Four defects found while reviewing the insights surfaces for hierarchy. **The budget_at_risk card's focal figure argued against its own headline.** `insight_key_figure` returned `budget_spent_pct` for both budget cards, so "2 categories need attention in your budget" displayed "14% / of budget" — a reassuring number as the visual focus of a warning. It now leads with the flagged count ("2 / need attention"); budget_on_track keeps the percentage, where overall consumption genuinely is the subject. **The "New" pill carried no information.** Visiting /insights marks every insight read in one `update_all`, so at first paint the pill was on every row. On the page it becomes a dot — same signal, without an uppercase tracked chip stealing weight from the title beside it. In the dashboard widget it goes entirely: the well's header already counts unread ("New · 3") and, with three rows, the pill was usually on all of them. **The undo toast was silent to screen readers.** A card leaves the page via a Turbo `remove`, which announces nothing, and the toast that explains it had no live region — unlike its neighbour `_sync_toast`, which sets `role="status" aria-live="polite"`. **The undo toast could only be closed with a mouse.** Its close affordance was a bare `icon "x"` with a click action: not focusable, not named. Now a real `DS::Button`, matching `_sync_toast`. The controller test asserting a per-row badge is updated to assert the header count that replaces it, and to lock in the pill's removal. * feat(insights): acknowledge instead of dismiss, on both surfaces (#2800) Two complaints about the insight feed: the close (×) control felt wrong, and clearing an insight was only possible on /insights — not on the dashboard widget, which is the surface people actually look at. **The × was lying.** Dismissal has never been permanent. GenerateInsightsJob resurfaces a row whose bucketed metadata changes materially "even if the user had read or dismissed the stale version" (its own comment), and 6 of 8 generators scope dedup_key to a month token, so dismissing July's budget card says nothing about August's. A destructive-looking control was performing a non-destructive act. It is now "Got it", and the contract is statable: acknowledgement covers the numbers you saw; new numbers are a new insight. No migration. The DB value stays "dismissed" and dismissed_at keeps its name; only the enum key and the vocabulary the code speaks change, so existing rows stay hidden and become undoable under an honest label. **The action pyramid was inverted.** The escape hatch was a chromed icon button in the card's top-right — the strongest secondary scan position — while the card's actual purpose ("View budget") was a borderless ghost link under the body text. Both now sit in a footer strip: the subject action gets the chrome, acknowledging is quiet labelled text beside it, and the key figure gets the corner to itself instead of competing with a control. **The widget can clear its own rows.** Each row gains an acknowledge control, revealed on pointer hover, on keyboard focus, and shown unconditionally on touch where there is no hover. No gesture, so the section's drag-to-reorder handlers are untouched. The row becomes a stretched link plus a sibling button, because button_to renders a <form> and a form cannot nest in an <a>. The group is named (group/insight). The dashboard <section> is itself a `.group` for its header controls, and a bare group-hover: matches any ancestor group — hovering one row, or the section header, revealed every row's control. Acknowledging re-renders the well rather than removing a row, so the next insight is promoted into the freed slot; Insight::FEED_LIMIT is now shared between the two controllers that render it so they cannot drift. Undo restores the row on both surfaces, and carries autofocus so it is one keystroke away after the acknowledged card leaves the DOM. * fix(insights): guard unacknowledge! against non-acknowledged insights CodeRabbit, Major: an arbitrary/stale PATCH /unacknowledge (e.g. an old undo-toast link clicked after GenerateInsightsJob has since expired or resurrected the insight) could force it back to :read regardless of its actual current state — including pulling an :expired insight back into visible view. Guards the transition to only reverse an actual acknowledgement, per CodeRabbit's suggested fix. * test(insights): fix stale dismiss_insight_url route from main merge main's preview-gate test used the pre-rename dismiss/undismiss route names; this branch renamed those to acknowledge/unacknowledge earlier.	2026-08-01 08:39:04 +02:00
3 people	af3100c0a5	fix(insights): keep rolling period labels on month boundaries (#2880) ... * fix(ci): skip scheduled preview cleanup on forks Only run the hourly Cloudflare preview cleanup on we-promise/sure, where the required secrets exist. * fix(insights): pin meta-line forward-window test mid-month Date.current..Date.current+30 is a full calendar month on the 1st of 31-day months (e.g. Aug 1..31), so insight_period_label prefers the month name over "Next 30 days" and flakes CI. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix rolling insight period labels on month boundaries --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: sure-admin <sure-admin@splashblot.com>	2026-08-01 08:10:00 +02:00
Sure Admin (bot)	1e800e2f93	Include uncategorized spending in budget UI (#2877)	2026-08-01 07:50:09 +02:00
Oscar	c6a240a183	feat(redbark): add australian bank sync (redbark) (#2794) ... * add redbark provider integration - per family api key provider, built like the lunchflow integration - syncs accounts, balances and transactions from api.redbark.com - account setup flow, settings panel, locales and routes - tests and fixtures * harden redbark integration based on prior provider pr feedback - use DebugLogEntry.capture for sync/import/unlink failures - retry 429s and 5xxs with backoff, raise on page cap instead of truncating - keep raw response bodies out of logs and errors - not null constraints on account columns, migration base 7.2 - persist ignored flag for skipped accounts so they stop nagging setup - validate api key on every save, re-arm status on key rotation - destroy aborts if unlink fails, atomic account create and link - require_admin on mutating actions, see_other on error redirects - single grouped query for item account counts - i18n default connection name, blank password field value - controller and provider tests * fix issues found in second review sweep - add missing syncable scope, without it every family sync raises - kick off a sync on connection create and on key rotation - setup dialog fetches accounts inline for fresh connections and shows api errors - skip balance write when no balance has been fetched yet, never anchor a false zero - exclude stale and non banking accounts from the batched balances call, per account fallback if the batch is rejected - detect the server row ceiling and empty pages instead of silently truncating history - user sync start date only governs the initial backfill, incremental after that - fetch connections before the per account loop so auth errors propagate once - drop untemplated index/show/new/edit routes and dead preload/link_accounts actions - stable dom id on the settings panel so repeat turbo replaces keep working * skip brokerage connections, found in live testing - the transactions endpoint 400s for brokerage connections, they belong to /v1/trades - only import accounts from banking and documents connections - guard transaction fetches for any legacy linked non banking account * address review feedback - treat the truncation header as a pagination signal: split the date window and refetch instead of failing the account - prune stale pending rows from the snapshot so settled pendings cant come back as duplicates - block linking a sure account that already has another provider feed - count setup failures separately from skips and surface an error instead of "all skipped" - add not nulls on redbark_items name and api key - enqueue the destroy job after the flag commits, not inside the transaction - swap bg-gray-400 for bg-surface-inset, drop amounts from info logs, remove i18n default fallbacks - tests for window splitting, pending pruning and encrypted payload round trip * fix issues from convention review - benign skips (unlinked account, blank id, unparseable rows) no longer count as failures, tracked separately so a clean batch reports success - currency parsing goes through extract_currency so hash shaped payloads resolve instead of falling to the default - merchant ids use truncated sha256 instead of md5 - debug log entries for import failures and account sync scheduling failures * bound the raw transactions snapshot to the fetch window - trim raw_transactions_payload to the current fetch window on merge, same as brex - keep rows without a parseable date, drop settled pendings as before - surface skipped rows in the aggregate debug log entry with imported/skipped counts	2026-07-26 07:40:25 +02:00
Max BarbareandClaude Sonnet 5	51c93649da	feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow (#2747) ... * feat(snaptrade): replace device-flow OAuth with authorization-code + PKCE flow Squashed from 16 commits on snaptrade-oauth-apps for a clean rebase onto current upstream/main ahead of opening a PR. * fix(snaptrade): address PR #2747 review feedback on OAuth PKCE flow - Remove unreachable dead-code guard in import_latest_snaptrade_data - Guard apply_oauth_tokens! against a malformed payload missing access_token - Wrap token endpoint network errors in ApiError and retry like data calls - Remove unused Provider::Snaptrade#revoke_token! instance method - Preserve return_to/accountable_type through the SnapTrade portal callback so the account-linking flow no longer drops users back to accounts_path - Show the real absolute OAuth callback URL in self-hosted setup instructions - Refresh brakeman.ignore fingerprint for the connect redirect after the return_to/accountable_type params were added Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y8SCCmKX6RphB5E73WSUQQ * fix(snaptrade): don't retry non-idempotent OAuth/API requests CodeRabbit flagged that Provider::Snaptrade retried OAuth token exchanges/refreshes and all API POST/DELETE calls (get_connection_url, delete_connection) after timeouts/connection failures. If the response is lost after SnapTrade already consumed a single-use auth code, rotated the refresh token, or applied a POST/DELETE, replaying the request either fails with invalid_grant on a token that actually succeeded, or risks duplicate side effects. Retries are now limited to GET requests; OAuth token requests and non-GET API calls translate a network failure straight into an ApiError without replay. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL * fix(snaptrade): stop querying non-deterministically encrypted token via empty-string compare CodeRabbit flagged that the syncable scope's where.not(oauth_access_token: [nil, ""]) re-encrypts "" with a random IV on every query, so the "" comparison can never match a stored ciphertext and is a silent no-op. No code path ever persists oauth_access_token as "" (only nil or a real token via apply_oauth_tokens!), so the exclusion is unnecessary -- narrowed the scope to a plain NULL check, which encryption handles transparently since nil is never encrypted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrrGkgSBEqhjjBmmH1fcXL --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-24 22:45:44 +02:00
Camilo Agudelo	7657f2d08c	Improve Yahoo Finance reliability and Colombian listing support (#2738) ... * Prevent Yahoo crumb cache poisoning * Make Yahoo Finance health status rate-limit aware * Normalize Yahoo Colombian listings Map Yahoo's BVC code to XBOG so search results derive Colombia from canonical exchange metadata and price requests use the .CL suffix with a COP fallback. Spec: .scratch/normalize-yahoo-colombia-listings/spec.md * Move Yahoo health checks to background	2026-07-22 06:53:48 +02:00
Fabio Zorzetto	89b08ca6ea	Add Italian translations for various views and functionalities (#2625) ... * Add Italian translations for various views and functionalities - Introduced translations for splits, subscriptions, tag deletions, tags, trades, transactions, transfer matches, transfers, users, valuations, and vehicles. - Enhanced user experience by providing localized content in Italian for better accessibility and understanding. * Correzioni traduzioni italiano: API keys shared/index, super admin jobs, imports readback, snaptrade idiomatica, subscriptions progetto, valuations grammatica * Aggiornamenti delle traduzioni italiane: miglioramenti e aggiunte per vari moduli, inclusi conti, obiettivi, trasferimenti e integrazione con SnapTrade.	2026-07-17 07:25:08 +02:00
Sure Admin (bot)	7554463f93	fix(impersonation): guard Sidekiq jobs link (#2678) ... * fix(impersonation): guard Sidekiq jobs link * fix(impersonation): address PR review feedback	2026-07-14 02:41:29 +02:00
3 people	66cf9e7f0b	feat(insights): proactive financial intelligence feed (#2550) ... * feat(insights): proactive financial intelligence feed Adds a nightly job that analyzes each family's finances in pure Ruby and surfaces typed, stateful insights on the dashboard and a new /insights page. - Insight model (active/read/dismissed) with a per-family dedup_key unique index so nightly re-runs refresh rows instead of duplicating them - Seven generators (spending anomaly, cash-flow warning, net worth milestone, subscription audit, savings rate change, idle cash, budget health) built on IncomeStatement, BalanceSheet, RecurringTransaction, and BudgetCategory - LLM used as a writer, not a reasoner: Insight::BodyWriter narrates pre-computed facts via the configured provider, with an i18n template fallback so self-hosted installs without API keys work identically; bodies are only (re)written when an insight is new or its numbers changed - GenerateInsightsJob: cron fan-out per family, per-family advisory lock, metadata-diff upsert that preserves read/dismissed state for unchanged signals and reactivates on material change - Dashboard insights_feed section (top 3, collapsible/reorderable) and an /insights feed page with turbo-stream dismissal; viewing the feed marks insights read - Tests for the model, job upsert semantics, and controller flows Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6ZRA6cgCRM4UdFKct3wm4 * fix(insights): address Codex review — expiry, budget metadata, LLM usage - Expire visible insights whose condition cleared: generators declare the insight types they produce, the registry reports which generators ran to completion, and the job expires visible insights of those types whose dedup_key was not regenerated. A crashing generator can't wipe out its healthy insights, and an expired insight reactivates when its condition returns — unlike a user-dismissed one, which stays dismissed. - Include a bucketed budget-spent percent in budget_at_risk metadata so the body refreshes when overall usage moves >=10 points even if the same categories remain flagged. - Pass family to chat_response so LLM narration is recorded in llm_usages. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6ZRA6cgCRM4UdFKct3wm4 * fix(insights): address CodeRabbit review - Skip the mark-as-read write for Turbo hover-prefetch requests (X-Sec-Purpose) so unread badges don't clear before a real visit - Show the New pill on the dashboard feed (active = unread there; the feed never marks insights read) - Filter idle accounts in SQL instead of a per-account exists? loop - Eager-load merchants in the subscription audit query - Widen the advisory-lock key to the signed-bigint range and log when acquisition fails so a skipped nightly run is observable - Mirror the dedup_key unique index as a model validation - Assert the refresh action enqueues for the signed-in family Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6ZRA6cgCRM4UdFKct3wm4 * fix(insights): clear stale lifecycle timestamps on reactivation When an insight resurfaces, the row now leaves no contradictory state behind: the material-change path clears both read_at and dismissed_at, and the expired-recovery path clears read_at. Tests assert the contract, and the dashboard feed test now also locks in the unread "New" badge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6ZRA6cgCRM4UdFKct3wm4 * fix(insights): drop redundant standalone family_id index Every composite index on insights already leads with family_id, so the auto-created single-column index was pure write overhead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6ZRA6cgCRM4UdFKct3wm4 * fix(insights): stop nightly drift from resurrecting dismissed insights Three generators stored continuously drifting values (projected amounts, starting balance, current net worth) in metadata, and any metadata diff counts as a material change: the body is rewritten (an LLM call when a provider is configured) and read/dismissed state is cleared. Dismissing a cash-flow warning was undone at the next 6:00 run. Metadata now carries only the signal identity plus a coarse bucket, the same damping the budget generators already use; display values live in facts. Also orders the idle-cash pick by balance so the selected accounts don't flip between runs, and documents the dollar-scale threshold assumption on the relevant constants. * fix(ds): map DS::Button aria_label into the aria hash A bare aria_label: option reaches the tag helpers as a literal aria_label attribute (Rails only dasherizes the nested aria: hash), so the icon-only fallback overrode it and screen readers announced the insight dismiss button and the popover trigger as "X". * fix(insights): gate LLM narration behind AI consent The nightly job runs unprompted for every family, so narration now requires someone in the family to have AI enabled: consent to share financial facts with the provider, and a cost cap in managed mode. The template fallback keeps behavior identical otherwise. Narration failures are captured via DebugLogEntry so support can see them. Adds BodyWriter coverage, including a template-interpolation test for every generator template key. * feat(insights): rework the dashboard feed The feed rendered full insight cards inside the section shell — the only widget nesting card-on-card — and appended below the fold for every family with a saved section order. It now mirrors the outflows and balance-sheet list idiom (inset well with an uppercase mini-header, white row block, 28px sentiment-tinted icon circles via color-mix on the DS CSS variables, right-aligned key figures) and leads the dashboard for saved orders that predate it. Icon color comes from sentiment, not priority — a savings-rate improvement is high priority AND good news, and must not render red; red is reserved for a projected-negative balance. Rows have no hover wash (cursor plus a gentle icon scale, like the sibling widgets), links to /insights disable Turbo prefetch so the mark-as-read actually fires for mouse users, and the standard widget-size popover offers Half/Full. Full stays the default: the feed is far shorter than any other single-width widget, so a half default leaves a grid hole the masonry cannot backfill. * feat(insights): actionable cards, dismiss undo, live refresh Each row now persists its display facts (new jsonb column) alongside the change-detection metadata. Facts refresh every run without touching the body or user state, which is exactly why they are not part of the material-change comparison. The card gains what the stored data always supported: a type-and-period meta line replacing "x minutes ago", a right-aligned key figure (green only for good news), and a contextual link resolved from the subject ids in metadata — category, account, recurring transaction, budget month — omitted when the subject no longer exists. Dismiss is forgiving: a toast in the notification tray offers undo, and undismissing restores the row as read rather than re-badging it. Milestone insights can never regenerate once dismissed, so this closes a real loss path. Upsert failures are captured via DebugLogEntry. Manual refresh gets feedback: the button swaps to a disabled checking state, the page subscribes to a family-scoped stream, and the job broadcasts the refreshed list and the idle button when it finishes (also after a lock-skipped run, so the button cannot stay stuck). Savings copy is sign-aware: a negative rate reads "you spent more than you earned" with true minus signs. The empty state swaps Lucide sparkles for the brand assistant glyph (DS::EmptyState learns icon_custom:). * feat(insights): top-bar entry with unread count The dashboard feed hides at zero insights and nothing else linked to /insights, so the manual refresh (and the empty state) were unreachable for exactly the families who need them: fresh setups before the first 6:00 run. The sticky top bar travels to every screen and its right cluster had room, so insights get an icon entry there with a monochrome unread badge. Prefetch is disabled on the link for the same mark-as-read reason as the feed. --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Guillem Arias <accounts@gariasf.com>	2026-07-14 02:19:39 +02:00
Jestin PalamuttamandClaude Sonnet 4.6	5803023fa7	feat(provider): add native Questrade brokerage provider integration (#2534) ... * Add native Questrade brokerage provider integration Adds a per-family Questrade provider so users can sync their Questrade investment accounts (TFSA, FHSA, RRSP, margin, etc.) directly via Questrade's free personal API, with no paid aggregator. - OAuth2 refresh-token flow with single-use token rotation, persisted under a row lock. Tokens self-renew on each sync; the connected panel lets users paste a fresh token if a connection goes stale (no need to disconnect and re-link). - Imports accounts, balances, positions and activities; multi-currency holdings with per-currency cash holdings; Norbert's Gambit journals. - New-account and link-existing-account flows, settings card with desktop-only setup steps, and connect/update/disconnect. - Restricted to Investment account types. Registered in the provider connection-status registry with a syncable scope so it participates in nightly family sync. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: linting error * fix: refresh token encrypted The OAuth token exchange passed the single-use refresh token as a GET query parameter, so it could leak into URL-based logs (Sentry breadcrumbs, APM spans, debug output). Switch to POST with a form-encoded body (RFC 6749 3.2) so the credential stays out of URLs. Verified Questrade's token endpoint accepts POST (returns 400 for a bad token, not 405). Adds a test asserting the token travels in the body. * Address PR review: authz, data integrity, retries, logging Batch of fixes from the automated PR review: - Require admin for all mutating/linking Questrade actions, and gate existing-account linking through accessible_accounts + write permission (was only Current.family scoped). - Clear requires_update when a fresh token is accepted; use a real 302 redirect (not 422) on full-page failures. - Require refresh_token on all saves (not just create) unless the item is scheduled for deletion. - Migrations target Rails 7.2; questrade_items state columns are NOT NULL. - Background activity dedup keys on Questrade fields (matches the importer) so multiple activities no longer collapse to one. - Persist the normalized account payload; date-scope synthetic cash holdings so daily history is not overwritten. - Retry 429/5xx via a RetryableResponseError instead of hard-failing. - Route provider error bodies to DebugLogEntry instead of Rails.logger / exception messages, so payloads do not leak into application logs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address PR review: atomic linking, sync health, retry loop, USD cash - Wrap account creation + provider linking (+ sync_start_date) in a transaction in both link paths so a link failure rolls back the orphan account. - Surface per-account process/schedule failures in the item sync health instead of always reporting healthy. - Always stamp last_activities_sync once the background fetch completes, so legitimately empty accounts stop being re-queued every sync. - Treat only the account-currency (CAD) balance as primary cash; other currencies (e.g. USD) now surface as separate cash holdings instead of being hidden as primary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address PR review: serialize token exchange, real processor tests - Single-use token race: the SDK now wraps every token exchange (initial and 401 re-auth) in a model-supplied lock that reloads and spends the freshest persisted token (provided.rb#synchronize_exchange). Two concurrent syncs/jobs can no longer double-spend the same refresh token. Adds a test asserting the exchange runs inside the lock with the fresh token. - Replace the all-skipped QuestradeAccount processor test stubs with real fixture-backed tests covering balance anchoring, holdings import, and Buy-trade import (plus blank-symbol / blank-type guards). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Fix indentation of spliced Questrade schema blocks The manually added questrade_accounts/questrade_items create_table blocks sat at column 0 instead of the file 2-space indent, so rubocop flagged them as inconsistent. Re-indent to match the rest of the schema. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Include currency and type in the Questrade activity merge key Two activities that differ only by currency or type could collapse to a single row in merge_activities. Add both fields to activity_key in the importer and the background fetch job so multi-currency imports dedup correctly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Address review: infer account currency, Encryptable, safer flag clear From @jjmata's review: - Currency: QuestradeAccount#upsert_from_questrade! no longer hardcodes CAD for every account. upsert_balances! now infers the home currency from the per-currency balances (the currency holding the cash wins, ties broken by total equity, default CAD) so USD-denominated accounts are labelled USD and match the right combinedBalances anchor. Adds tests for USD and CAD cases. - QuestradeItem now includes the shared Encryptable concern instead of reimplementing encryption_ready? inline. - QuestradeActivitiesFetchJob#clear_pending_flag is now best-effort so it can never mask (and swallow) the original error in perform's rescue. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Fix review issues: safe_return_to_path, DebugLogEntry, financial reset, turbo_prefetch, N+1 counts - Add safe_return_to_path to QuestradeItemsController (blocks //evil.com protocol-relative open redirect; same 3-check guard as PR #2591 Wise provider) - Pass return_to through select_accounts and complete_account_setup so users land back on the account they were linking from - Replace Rails.logger.error/warn with DebugLogEntry.capture in controller and unlinking concern (surface errors in the app debug log UI) - Add questrade_items to Family::FinancialDataReset::PROVIDER_ITEM_ASSOCIATIONS so Reset Financial Data actually removes Questrade data - Add when "questrade" case to load_provider_items in providers_controller so the settings panel lazy-load refresh works - Fix turbo_prefetch: false on non-lunchflow provider links in _method_selector.html.erb and select_provider.html.erb (prevents prefetch-cache blank-modal bug for all generic sync providers) - Preload questrade_accounts: :account_provider and build @questrade_account_counts_map in AccountsController; read from map in partial instead of calling .count on associations (eliminates N+1) - Localize default connection name via I18n.t(questrade_items.default_name) - Add default_name key to questrade_items locale Patterns and bugs surfaced during review of PR #2591 (Wise provider). * Cross-apply Wise learnings to Questrade provider Encryption (matched convention from Wise/jjmata review): - Add deterministic: true to QuestradeItem#refresh_token - Add encrypts :raw_payload + :raw_institution_payload to QuestradeItem - Add Encryptable + encrypts :raw_payload, :raw_holdings_payload, :raw_activities_payload, :raw_balances_payload to QuestradeAccount (brokerage-specific columns; matches MercuryAccount/UpAccount pattern) Bug fix: - Add missing RetryableResponseError class to Provider::Questrade (used in with_retries rescue clause but never defined — would cause NameError on any rate-limited or 5xx response) Logging: - Replace Rails.logger.error with DebugLogEntry.capture in QuestradeItem#import_latest_questrade_data, #process_accounts, and #schedule_account_syncs to surface errors in the support UI Consistency: - Extract update_sync_status(sync, key, **i18n_options) helper in QuestradeItem::Syncer, replacing 5 inline sync.update! guard calls - Use blank? instead of ||= for default name fallback in create action Tests: - Add QuestradeItemsControllerTest (18 tests: CRUD, sync, account linking/setup flows, admin guard enforcement) - Add questrade fixtures: questrade_items.yml, questrade_accounts.yml - Add retry/backoff tests to Provider::QuestradeTest (network error, 429, 5xx — all verify MAX_RETRIES exhaustion raises Error) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Signed-off-by: Jestin Palamuttam <34907800+jestinjoshi@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-08 09:00:49 +02:00
10 people	7fb6df71f2	Russian language support added (#2005) ... * Add russian localization * Update localization files from upstream * Add russian to supported languages * Add CHANGELOG.ru.md * Changes in CHANGELOG.ru.md * Fix some errors after PR * Remove duplicated 'merge_duplicate' key in the same mapping in locales/views/transactions/ru.yml * Fixed a translation error into Russian about creating a new account by invitation. * Clarification of financial terms in Russian translation * Add russian localization * Update localization files from upstream * Add russian to supported languages * Add CHANGELOG.ru.md * Changes in CHANGELOG.ru.md * Fix some errors after PR * Remove duplicated 'merge_duplicate' key in the same mapping in locales/views/transactions/ru.yml * Fixed a translation error into Russian about creating a new account by invitation. * Clarification of financial terms in Russian translation * Improve Russian i18n translations * Improve Russian i18n translations * Improve Russian i18n translations * Improve Russian i18n translations * Improve Russian i18n translations * Improve tests for Russian i18n translations * Improve Russian i18n translations * Improve Russian i18n translations * Minimalistic SECURITY.md Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> * ci(preview): render Cloudflare config from trusted template (#2207) * Fix SSO provider settings updates (#2210) * fix(goals): UI polish — submit validation, container-responsive cards, picker & filter fixes (#2160) * fix(ds): disabled buttons use not-allowed cursor Tailwind v4 preflight sets cursor:pointer on every <button>, including disabled ones. Add disabled:cursor-not-allowed to the DS button base so disabled buttons read as non-interactive. * fix(goals): disable new-goal submit until required fields valid The submit button was always enabled, and the funding-accounts checkbox group has no native 'required', so a goal with no linked account could be submitted and only fail server-side (422). Disable the submit until name, a positive target amount, and >=1 account are present, and add a submit-time guard that surfaces inline errors and focuses the first offending field as a backstop. * fix(goals): keep color/icon picker from shifting the form DS::Disclosure wraps its body in an mt-2 div that sits in normal flow, so opening the absolutely-positioned picker popover nudged the form down ~8px. Use a raw <details> for the picker so the popover overlays without reflowing the content beneath it. * fix(goals): container-responsive cards, meta-line status, scrollable tabs - Card grids + KPI strip switch from viewport breakpoints to container queries (@container), so columns track the actual content width when the account/AI sidebars are open instead of crushing three columns into a narrow center. - Move the status pill from the title row to the meta line; the title now gets the full header width (no more 'Hou...' truncation at 3-up). Drop the secondary line when the pill already states it (completed / open). - Card internals harden for narrow widths (ring shrink-0, footer wrap, shorter 'N days left' secondary). - Filter tabs scroll horizontally instead of wrapping 'On track' mid-label or forcing the row wider than the viewport. * fix(goals): only require a funding account on the create form GoalsController#edit renders account checkboxes from visible accounts only, so a goal backed solely by a now-hidden (disabled / pending_deletion) account renders none checked. The submit-validation then wedged the edit form — a name/notes change couldn't be saved even though #update preserves existing links when account_ids is omitted. Gate the account requirement on a require-account Stimulus value that is true only for the create form. * fix(goals): give the color/icon picker trigger an accessible name The hand-rolled <summary> is icon-only (pen), so screen readers announced an unlabeled control. Add a localized aria-label. * fix(goals): render form validation errors inline on server re-render The client-side controller already surfaces name / amount / account errors inline and disables submit, but a server 422 (JS disabled, or a race that lets an invalid submit through) fell back to the top run-on banner ("X must be filled and Y and Z."). Make the existing inline error hints server-aware so a failed submit shows the same per-field red text the client path does, and drop the base-error banner — base only ever carries the account requirement, which now renders beside the funding-accounts list. * fix(goals): blur projection chart under privacy mode The projection chart's SVG axis labels and annotations (target, "$X short", $200K/$400K ticks) rendered in cleartext while privacy mode blurred every other number on the page. Tag the chart container `privacy-sensitive`, the same wrapper-level treatment the net-worth and cashflow-sankey charts already use, so it blurs with the rest. * fix(goals): stop target-date input stretching when amount error shows The target-amount / target-date row is a two-column grid. The amount column carries its inline error <p> underneath, so when that error appears the column grows and the default `items-stretch` makes the sibling date input stretch to match — the date box visibly grew taller than the amount box. Anchor the row with `items-start` so each input keeps its natural height and the error just extends below its own column. * fix(goals): make invalid submit announce errors instead of dead-ending Review follow-ups: - Swap the submit gate from the disabled attribute to aria-disabled: a truly disabled default submit also blocks Enter-key implicit submission, so an invalid form was a dead button with every inline error still hidden. The button now stays clickable and lets validateOnSubmit surface the errors; DS buttonish styles the aria-disabled state (cursor-not-allowed + opacity-50). Side effect: loading_button_controller submits also dim while busy, which reads as an upgrade. - Focus the first funding-account checkbox when accounts are the only missing field (focus previously went nowhere). - Drop the now-orphaned goals.goal_card.days_left_by locale key. * fix(ds): canonical transaction-row — stop category pills truncating (#2147) * fix(ds): canonical transaction-row — stop category pills truncating (#2137) The desktop transaction grid gave the name column col-span-8 (67%, usually half-empty) and the category column only col-span-2 (17%), so the category pill's name area was clamped to ~44px and ellipsized nearly every value ("Misc...", "Shop...", "Rest...") despite the empty space the audit flagged. - Rebalance the lg:grid-cols-12 row: name col-span-8 -> 7, category 2 -> 3 (amount unchanged; still 12). Category gains 50% width from the over-wide name column. - categories/_badge: the pill was `flex w-full` (stretched to fill the column); make it `inline-flex max-w-full` so it hugs its content and short names render fully, capping + truncating only when genuinely too long. Verified on /transactions: visible-row category truncation dropped 7/7 -> 2/7 even in the compressed (AI-panel-open) view; Payment / Shopping / Restaurants now render in full. Fixes both the interactive categories/menu and the static transfer categories/badge (menu reuses the badge partial). * feat(ds): lift categories/_badge onto DS::Pill Addresses the Drift Patrol finding (and jjmata's request) properly instead of patching the bespoke span: the badge becomes a DS::Pill in badge mode. The pill primitive grows the three capabilities the badge needed and the bot's one-liner glossed over: - truncate: pills that may shrink inside min-w-0 columns drop their shrink-0/whitespace-nowrap and ellipsize the label instead of overflowing (the transaction-row category cell this PR fixes). - label_testid: stamps data-testid on the label span; five test files target [data-testid='category-name']. - icon_size: passthrough to the icon helper (badge keeps its established sm glyph; default stays xs). custom_color was already the sanctioned escape hatch for user-chosen hues. Owned visual deltas from pill standardization: px-1.5/py-1 -> px-2/py-0.5, gap-1 -> gap-1.5, border mix 10% -> 20%; bg mix, hex text, radius, text scale, icon size, truncation and testid are parity. Label wrapper only renders when truncate/label_testid ask for it, so existing pill DOM (and the find("span", text:) assertions on it) is unchanged. Four new pill tests + a Lookbook case cover the recipe. * feat(merchants): add raw data import (csv) for merchants (#1992) * feat(merchants): add csv import endpoint for merchants * docs: update endpoint docs * fix(merchant): recommended ai fixes * chore(ci): finish Node 24 GitHub Actions migration (#2221) * chore(ci): finish Node 24 GitHub Actions migration * chore(ci): update preview security check for github-script v8 * fix(mobile): redact sensitive diagnostic logs (#2199) * fix(mobile): redact sensitive diagnostic logs * fix(mobile): tighten diagnostic log redaction * fix(mobile): harden sanitized diagnostics * fix(mobile): clarify offline fallback diagnostics * fix(mobile): refine diagnostic log redaction * fix(mobile): tighten diagnostic log redaction * fix(mobile): harden auth diagnostic failures * feat(ds): DS::SegmentedControl — fix invisible dark selected pill (#2145) * feat(ds): DS::SegmentedControl; fix invisible dark selected pill (#2137) Ships DS::SegmentedControl — a single-select pill group (filters, mode switches) — plus a Lookbook preview, tests, and an exemplar migration of the budget filter tabs. The audit flagged the dark selected pill as invisible: the bespoke controls paired a container-inset track (gray-800) with a gray-700 active pill, barely a step apart. The primitive uses the DS tab-token values (tab-bg-group -> a near-black alpha-black-700 track in dark), against which the gray-700 active pill clearly reads. Values are inlined with @variant theme-dark because @apply-ing the custom tab utilities drops their dark override. - app/components/DS/segmented_control.rb: slot-based with_segment(label, active:, href:, **opts); link or button; full_width: for equal footprint; selected style isolated in .segmented-control__segment--active so a controller can toggle it as one class. - .segmented-control recipe in components.css. - Migrate budgets/_budget_tabs; budget_filter_controller now toggles the single --active class instead of five raw utility classes. Verified in-browser: dark active pill reads (gray-700 on near-black track); filter toggle still works. Tests + rubocop clean. Deferred (follow-up): auth sign-in/up switch, transaction-type tabs, and other bespoke segmented controls — same primitive, one migration each. * fix(a11y): expose segmented-control selection + derive active from filter param - DS::SegmentedControl: set aria-current (links) / aria-pressed (buttons) from the segment's active state so screen readers announce the selection. - budget_filter_controller: mirror aria-pressed when it toggles the active class. - _budget_tabs: compute each segment's initial active: from params[:filter] so a ?filter=over_budget request server-renders the correct pill (no flash before Stimulus runs). Addresses CodeRabbit reviews on #2145. * fix(ds): close unterminated segmented-control CSS rule The --active rule swallowed the table-scroll block's comment opener and never closed, so the Tailwind build died with 'Missing closing } at @layer components' and both test jobs failed at boot. Restore the closing brace and the /* opener. Also add the budgets.show.filter.aria_label locale key the budget tabs view referenced only through its inline default. --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com> * fix(ds): one height rail for icon and text buttons (#2202) * fix(ds): put icon buttons on the text-button height rail Icon-only DS::Button containers were 32/44/48px squares while text buttons of the same nominal size render ~28/36/48px tall, so every mixed header row (icon menu trigger next to text buttons — the transactions index, account pages, the app header) sat misaligned. - buttonish SIZES: icon containers now share the text rail (sm w-7, md w-9, lg w-12 unchanged). - DS::Popover's hand-rolled w-11 trigger joins the rail at w-9. - The layout's hand-rolled privacy toggle (mobile + desktop) matches the md icon-button chrome: w-9, rounded-lg, container-inset hover — it sat at w-8 with a different hover next to a DS icon button. - DS::Select's panel adopts shadow-border-lg, the elevation Menu and Popover already use, replacing the weaker shadow-lg+border-xs combo. Measured on the transactions header after the change: 36/38/36px. * fix(ds): keep the 44px touch target on coarse pointers The height rail trades icon-button size for row alignment, which is a pointer-precision tradeoff: WCAG 2.5.5's 44x44 minimum is about fingers, not mice. sm/md icon containers (and the two off-rail consumers: the popover trigger and the layout privacy toggles) gain pointer-coarse:w-11/h-11, so touch devices keep the full target while fine-pointer layouts get the aligned 36px row. Measured via Playwright: desktop 36x36, iPhone emulation 44x44 on both the menu trigger and the privacy toggle. * fix(sync-toast): morph refresh, defer behind modals, DS conformance (#2105) * fix(sync-toast): morph refresh, defer behind modals, DS conformance Follow-up to #1964 (addresses #2071). - Refresh via Turbo morph visit instead of window.location.reload, so scroll position and data-turbo-permanent elements (the AI chat panel) survive and there is no white flash. - Defer the toast while a <dialog> is open and reveal it on close. A refresh mid-modal closes the dialog and discards its in-progress input, which is the exact data loss this toast exists to prevent. Handles stacked modals. - Refresh CTA and close button now use DS::Button (secondary / icon). The close is always visible, inside the card, focusable, and has an aria-label; the old hover-only corner chip was unreachable on touch and not keyboard-focusable. - Add role="status" / aria-live="polite" to the toast. - Fix icon color: "inverse" is not a key in the icon helper color map, so it silently rendered no color class (dark icon on bg-info). Use "white", which maps to the functional text-inverse token. - Tighten copy: "New data available" / "Refresh". - Sync the broadcast comment with the actual replace/morph behavior. * fix(sync-toast): detach deferred dialog listener on disconnect A toast replaced by a newer broadcast_replace_to while a <dialog> was open kept its 'close' listener attached, so the detached controller fired #reveal()/#arm() when the dialog closed — a spurious auto-refresh from a stale toast (and repeated syncs could queue several). Store the dialog + handler refs and remove the listener in disconnect(). Flagged by codex + coderabbit on #2105. * fix(sync-toast): re-check interaction and dialogs at refresh-fire time The interaction check ran once at arm time but the refresh fired two seconds later. The post-dialog reveal made that window matter: the user closes a dialog sitting on a form, resumes typing, and the timer morphs the page — wiping non-turbo-permanent input, the exact data-loss class this toast exists to prevent. A dialog opened during the window had the mirror problem (the refresh would close it). Bail inside the callback instead, leaving the toast visible for a manual refresh, matching the mid-form behavior. Also documents the dialog-removed-without-close edge on the deferred listener. * perf(transactions): preload new form options (#2189) * perf(transactions): preload new form options * refactor(transactions): reuse new form account scope * perf(reports): collapse investment flow aggregates (#2190) * perf(reports): collapse investment flow aggregates * fix(reports): avoid shared-account flow duplication * fix: Savings Goal Marked Reached While Still Short (#2180) * fix: saving goal is marke while several states * feat(enable_banking): support MFA/decoupled banks and harden session handling (#2174) Decoupled/MFA banks (e.g. VR Bank in Holstein) were hard-blocked because the authorize flow aborted whenever auth_methods[0] was DECOUPLED. Enable Banking's hosted /auth page actually coordinates decoupled SCA and redirects back with a code, so route these banks through it instead: - Provider#start_authorization accepts and forwards an auth_method param - EnableBankingItem#select_auth_method picks the best method (REDIRECT > DECOUPLED > EMBEDDED), filtering by psu_type and skipping hidden methods - Shared begin_authorization! re-fetches ASPSP metadata on each authorize and reauthorize, so the method is always re-derived (no persistence required) - Remove the DECOUPLED block in the controller Also stop the integration from constantly reporting "session expired": - Only a session-level GET /sessions 401/404 flips the connection to requires_update; per-account 401/404 are retried and no longer kill the whole connection - Reconcile session_expires_at from the API's access.valid_until on every sync - Treat an expired session as a graceful requires_update state instead of raising a bare error No schema changes. Adds covering tests. * fix: request change reach --------- Co-authored-by: Tobias Rahloff <rahloff@gmail.com> * Improve Russian i18n translations * Improve Russian i18n translations * Improve Russian i18n translations * Improve Russian i18n translations * No need for language-specific CHANGELOG.md file --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: tea <john.fx@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: ghost <49853598+JSONbored@users.noreply.github.com> Co-authored-by: Guillem Arias Fauste <accounts@gariasf.com> Co-authored-by: Blaž Dular <22869613+xBlaz3kx@users.noreply.github.com> Co-authored-by: Sure Admin (bot) <sure-admin@splashblot.com> Co-authored-by: Jonathan Chang <55106972+jonathanchang31@users.noreply.github.com> Co-authored-by: Tobias Rahloff <rahloff@gmail.com> Co-authored-by: Juan José Mata <jjmata@jjmata.com>	2026-07-08 08:10:18 +02:00
Juan José Mata	b3f70c8951	feat:Add SnapTrade OAuth device flow (#2523) ... * Add SnapTrade OAuth connection flow * Restore SnapTrade brokerage portal links * Guard SnapTrade OAuth setup completion * Move SnapTrade OAuth start to POST * Use one SnapTrade item in provider panel * Fix SnapTrade OAuth controller tests * Fix SnapTrade OAuth drawer completion redirect * Update SnapTrade limits message. * Restrict SnapTrade OAuth scopes	2026-06-29 00:30:03 +02:00
Will WilsonandJuan José Mata	9487e6cbfb	Allow multiple active API keys per user (#2077) ... * feat(api): allow multiple active API keys per user Previously a user could hold only one active API key; creating a new one silently revoked the existing key, breaking any app using it. Allow multiple named active keys instead. - Drop the one-active-key-per-source validation; add name uniqueness among the user's active visible keys (revoked names are reusable, same name allowed across users). - Rewrite Settings::ApiKeysController as a RESTful collection (index/show/new/create/destroy); create no longer revokes existing keys, and key lookup is scoped to the current user's active keys. - resource :api_key -> resources :api_keys. - Add an API keys list view with per-key revoke and an empty state; rewrite the show page for a single key. - Update i18n (remove single-key copy, pluralise nav label) and tests. * refactor(api): address review on multiple API keys - Remove unreachable destroy branches (cannot_revoke is guarded by the .visible 404; revoke! raises rather than returning false) and document that .visible is the demo-key revocation guard. - Delete the orphaned created.html.erb / created.turbo_stream.erb templates (no action renders them) and their unused locale keys. - Extract shared partials (_scope_badges, _status_indicator, _key_meta, _key_reveal, _usage) to de-duplicate the index and show views; unify the active-status indicator on the standard dot. - Carry forward the @container / @lg:flex-row / min-w-0 responsive fixes from #2079 into the shared key-reveal partial. * test(api): cover newly-created API key confirmation render * refactor(api): harden demo-key guard and address review nits - Document the demo-key revocation guard on ApiKey's `visible` scope (the authoritative spot) and add a model test locking the invariant that `.visible` excludes the demo monitoring key. - _scope_badges: use an i18n lookup with a humanize fallback instead of bypassing translation for unknown scopes. - _key_reveal: drop the hard-coded `id` from the shared partial; the system test now locates the key via its data-clipboard-target. * refactor(api-keys): migrate hand-rolled badges to DS::Pill Replace raw span elements in scope badges and status indicator with DS::Pill to align with the design system migration convention. * fix(loans): opening anchor now uses current balance, not original principal When creating a loan manually, the opening anchor valuation was being set to `initial_balance` (the original loan principal) instead of `account.balance` (the current outstanding balance). After the sync job ran, `account.balance` was overwritten to match the anchor, making every manually-created loan show its original principal as the current balance. Fix by always using `account.balance` for the opening anchor in `create_and_sync`, and reading `Loan#original_balance` from the `loans.initial_balance` column directly (with a fallback to `first_valuation_amount` for provider-synced loans that may not have the column populated). * fix(api-keys): strip accidental loan changes; rescue revoke! failures The fix(loans) commit was accidentally committed into this branch. Remove the loan-related changes from account.rb, loan.rb, and both test files, restoring them to their pre-loan-commit state. Also fix the destroy action: revoke! uses update! internally which raises ActiveRecord::RecordInvalid on failure rather than returning false. Add rescue for RecordInvalid and RecordNotDestroyed so failures produce a flash alert instead of a 500. Re-adds the revoke_failed locale key that was dropped from settings.api_keys.destroy. --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>	2026-06-26 06:47:38 +02:00
JakeandClaude Opus 4.8	dc2a565b6a	feat(up): add Up Bank (AU) provider integration (#2391) ... * feat(up): add Up Bank (AU) provider integration Adds Up Bank as a per-family, token-based bank sync provider, modelled on the existing Akahu integration. Up uses a JSON:API REST API with a personal access token (Bearer), cursor pagination via links.next, and returns both HELD (pending) and SETTLED transactions from one endpoint. New: - Provider::Up client (JSON:API unwrap, links.next pagination, retries, typed errors, /util/ping) + Provider::UpAdapter (Factory-registered, Depository + Loan). - UpItem / UpAccount models with Provided, Unlinking, Syncer, SyncCompleteEvent, Importer, Processor, Transactions::Processor, and UpEntry::Processor (amount sign flip, HELD->pending, foreignAmount FX, merchant from description, stale-pending pruning). - Family::UpConnectable, UpItemsController, routes, settings panel + connect flow views, accounts index wiring, initializer, en locale, and model tests. Core wiring: - "up" added to Transaction::PENDING_PROVIDERS, the three pending-match SQL blocks in Account::ProviderImportAdapter, Provider::Metadata::REGISTRY, ProviderMerchant/DataEnrichment source enums, ProviderConnectionStatus, settings provider panels, and financial data reset. Migration create_up_items_and_accounts must be run before use. No external API endpoints added (no OpenAPI changes). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(up): dump up tables to schema and make since filter TZ-safe The feature commit added the up_items/up_accounts migration but never re-dumped db/schema.rb, leaving the schema version and tables stale. Add the two table definitions and foreign keys and bump the schema version so a fresh DB load matches the migration. Also format a bare Date `since` as UTC midnight instead of the server's local zone, so `filter[since]` is deterministic regardless of where the app runs (previously shifted by the local UTC offset). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(up): address code review feedback Behavior/correctness: - Persist skipped accounts via a new up_accounts.ignored flag and a needs_setup scope, so skipped accounts stop resurfacing as "needs setup" on every sync. Linking clears the flag. - destroy now checks unlink_all! per-account results and aborts deletion (alert) if any unlink failed, instead of swallowing failures. - render_provider_panel_error redirect uses :see_other (was an invalid 4xx redirect status). - Up provider adapter falls back to item institution name/url when institution_metadata is absent (early return previously blocked it). Resilience/security: - fetch_all_resources guards against an API repeating the same links.next cursor (Set#add?), preventing infinite pagination. - HTTP client validates absolute URLs (from links.next) against Up's HTTPS host before sending the bearer token, preventing credential leakage to untrusted hosts. Diagnostics: - Route provider sync/import failures through DebugLogEntry.capture (controller, UpItem, syncer, unlinking) with family/account context. Low-level HTTP client and currency-normalization warnings keep Rails.logger to match existing provider conventions. Data integrity: - up_accounts.name and currency are NOT NULL (align with model presence validations); account_id stays nullable (allow_nil uniqueness). Forms: - select_existing_account radio is required; controller guards a blank/ unknown up_account_id with a friendly alert instead of RecordNotFound. Tests: - Add UpAccount needs_setup scope test, pagination loop guard test, untrusted-host rejection test; tighten filter[since] assertion to the exact UTC timestamp. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(up): address second-round review feedback - Capture sync/import failures via DebugLogEntry so swallowed errors in account/transaction fetching and transaction processing surface in /settings/debug instead of only Rails.logger. - Gate UP_DEBUG_RAW raw payload dump to local envs to avoid leaking PII (merchant names, amounts, account IDs) in managed/production logs. - Collapse linked/unlinked/total account counts into one memoized query instead of 3 separate COUNTs per rendered item. - Rename "Set Up Up Accounts" locale title to "Link Up Accounts". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(up): add method docstrings and align failed_result keys Add docstrings to all Up provider source files (controller, models, providers, concerns) to satisfy the 80% docstring coverage threshold. Third-round review: failed_result now mirrors import's result shape (accounts_updated/created/failed, transactions_imported/failed) instead of the stale accounts_imported key, so failure results stay consistent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-20 20:33:09 +02:00
ghost	6ea931f3fe	feat(imports): add YNAB CSV import (#2361) ... Adds YnabImport (mirroring ActualImport) for YNAB "Export budget" register CSVs: - Amount — combines the split Outflow/Inflow columns into a single signed amount (inflow - |outflow|), stripping currency symbols and thousands separators. A single signed Amount column takes precedence when present. - Category — resolves across export shapes: the combined "Category Group/Category" column, the split "Category Group" + "Category", or legacy YNAB 4 "Master Category" + "Sub Category". - Names — falls back from a blank Payee to the Memo, then the default row name. - Validation — requires at least one amount source (Outflow/Inflow or Amount); a file exposing none leaves rows un-clean instead of importing zero-dollar entries. Enables the previously-disabled YNAB option on the imports screen (using the YNAB logo, like Mint) with its configuration partial, and removes the now-dead imports.new.coming_soon locale key. Documents the type in the API import-type enums (rswag request spec + swagger_helper + generated openapi.yaml). Closes #1255.	2026-06-16 08:32:17 +02:00
ghost	88343002d1	chore(deps): upgrade Rails 7.2 → 8.1 (#2301) ... * chore(deps): upgrade Rails 7.2 → 8.1 Rails 7.2 reaches end of life on 2026-08-09. Bump the framework to the current 8.1.x line. - Gemfile: rails "~> 8.0" (resolves 8.1.3); bundle update rails pulls the Rails 8 framework gems plus the bumps it requires — ViewComponent 3.23 → 4.x (Rails 8 support), rails-i18n 7 → 8, rswag, and transitive deps. - app/models/transfer.rb: make Transfer#date nil-safe (inflow_transaction&.entry&.date). Rails 8's date_field evaluates the field default on a new/unpersisted Transfer (the new-transfer form), where the association is nil; without this, TransfersController#new raises "undefined method 'entry' for nil". Matches the &. pattern already used in Transfer#sync_account_later. Framework behavioral defaults are unchanged (config.load_defaults stays as-is). Validated on Rails 8.1.3: zeitwerk:check passes, full suite green (4904 runs, 0 failures, 0 errors), rubocop and brakeman clean. * fix(rails8): style textarea + deterministic property edit system test The Rails 8 gem bump kept config.load_defaults at 7.2, but Rails 8 renamed two ActionView::Helpers::FormBuilder field helpers regardless of defaults: :text_area → :textarea and :check_box → :checkbox. StyledFormBuilder builds its styled helpers from `field_helpers`, so `form.text_area` (e.g. the account "Notes" field) silently fell through to the unstyled base helper and rendered without a label — failing 8 system tests with `Unable to find field "Notes"`. - app/helpers/styled_form_builder.rb: exclude both spellings of the non-text helpers (:check_box and :checkbox) and alias the legacy `text_area` to the Rails 8 `textarea` so existing call sites stay styled. Harmless on Rails 7.2 (old names present instead). - test/system/property_test.rb: open the property edit dialog via the account menu with a retry. The account page issues a Turbo morph refresh shortly after load (turbo_refreshes_with :morph + a family-stream broadcast); opening the modal while that refresh is in flight let the morph re-render the page and wipe the just-loaded #modal turbo-frame. Rails 8 timing made the race deterministic. Retrying once the refresh has settled makes the test stable (confirmed via Turbo frame-load vs full-page morph event traces; 3x green in isolation). - config/brakeman.ignore: the added comment block shifted the pre-existing (already-ignored, Weak) class_eval Dangerous Eval warning from line 5 -> 10, changing its fingerprint. Re-point the existing suppression to the new fingerprint/line so scan_ruby stays green. Validated on Rails 8.1.3: full system suite green (92 runs, 355 assertions, 0 failures, 0 errors), rubocop clean, brakeman 0 warnings, CodeRabbit no findings. * chore(deps): pin rails to the 8.1 minor line (~> 8.1.0) Tighten the constraint from `~> 8.0` to `~> 8.1.0` (>= 8.1.0, < 8.2) so a future `bundle update rails` tracks the 8.1.x line rather than silently jumping to 8.2 when it ships. Matches the upgrade plan's stated intent (target 8.1.x for the EOL runway) and a review note on #2301. No resolved-version changes: bundle install keeps rails at 8.1.3 and every other locked gem unchanged — only the Gemfile.lock DEPENDENCIES constraint line moves. zeitwerk:check still passes; the already-green unit/system suites ran on this exact resolved tree. * chore(rails8): adopt Rails 8.1 framework defaults (config.load_defaults 8.1) The gem bump above kept config.load_defaults at 7.2 so the change set could be reasoned about in stages; this finalizes the upgrade by adopting the modern framework defaults now that the suite is green on Rails 8.1. Rails 8.0 added no new framework defaults (there is no new_framework_defaults_8_0 template), so 7.2 -> 8.1 is the single meaningful step. No incremental new_framework_defaults_8_1.rb opt-in file is needed: the full suites pass with all 8.1 defaults enabled at once. The 8.1 defaults this turns on include action_on_path_relative_redirect=:raise (open-redirect hardening), raise_on_missing_required_finder_order_columns, escape_json_responses=false / escape_js_separators_in_json=false (JSON perf), and Ruby-parser template-dependency tracking. Validated with no application code changes: bin/rails test 4904/0/0, bin/rails test:system 92/0/0, rubocop + brakeman clean. * chore(ci): restore brakeman CheckEOLRails now that the app is on Rails 8.1 config/brakeman.yml existed only to skip brakeman's CheckEOLRails. That check fires on the calendar (it warns 60 days before a framework's EOL and escalates as the date nears), so Rails 7.2's 2026-08-09 EOL turned `bin/brakeman` red (exit 3) on every branch and on main regardless of the diff. The skip carried a TODO to remove it once Sure upgraded off 7.2. This PR puts the app on Rails 8.1 (EOL well in the future), so the skip is obsolete; remove the file (its sole content was the skip) in the same change that makes it unnecessary -- no stale-config window. brakeman auto-loads the file when present and falls back to defaults when absent, and nothing references it explicitly. CheckEOLRuby was already enabled and is unchanged; config/brakeman.ignore is untouched. Validated on Rails 8.1: bin/brakeman runs EOLRails + EOLRuby, 0 warnings, 0 errors, exit 0.	2026-06-14 21:48:14 +02:00
Guillem Arias Fauste	8736c7c27e	refactor(settings): consistency pass — header-less settings_section + guides (#2279) ... * refactor(settings): header-less settings_section variant + migrate guides Add a title:nil branch to settings_section so a page can route through the one canonical surface recipe (bg-container shadow-border-xs rounded-xl p-4 space-y-4) without a section header. No visual change to existing titled callers. Migrate the guides page onto it: replace the hand-rolled card + hardcoded 'Guides' page title with settings_section + t('.page_title') (new locale key). First step of the settings design-consistency pass. * refactor(family-exports): un-nest exports list The exports list rendered 'Exports' three times (page h1 + settings_section title + inset count header) inside three stacked surfaces (section card > bg-container-inset > inner bg-container table card). Flatten it: - settings_section header-less (drop the duplicate title; the page h1 + the inset count header already label it), - drop the redundant inner space-y-4 wrapper, - table sits directly in the inset (remove the inner bg-container card). Now: one title, one card, one inset. * refactor(settings): payments + appearances consistency - payments: subscription summary row was bg-container inside the section's bg-container (container-on-container) -> bg-container-inset + p-4. - appearances: toggle-row labels used <h4> (heading-level break inside a settings_section) -> <p font-medium>. * refactor(settings): preferences consistency - month_start_day warning: text-warning bg-warning/10 colored-body-text box -> DS::Alert(:warning) (neutral-text recipe). - preview-features block: hand-rolled <section bg-container shadow-border-xs rounded-xl p-4> -> header-less settings_section (canonical surface). - toggle-row <h4> -> <p font-medium>; text-[11px] base-currency badge -> text-xs. * refactor(settings): profiles consistency - unconfirmed-email notice was hardcoded English -> i18n (unconfirmed_email_notice_html + resend_confirmation_link keys). - role + pending chips: bespoke 'rounded-md bg-surface px-1.5 py-0.5 uppercase' pills -> DS::Pill (tone: gray, badge mode). - pending-invitation row border: border-alpha-black-25 -> shadow-border-xs (match the member-row token).	2026-06-11 15:48:53 +02:00
Guillem Arias Fauste	b2b89437b0	fix(ds): route remaining literal yellow warning surfaces onto --color-warning (#2250) ... * fix(ds): route remaining literal yellow warning surfaces onto --color-warning Completes the #2198 warning consolidation for view-level surfaces: - rules/index recent-runs status badges → DS::Pill (warning / success / error). - accounts/_account_sidebar_tabs missing-data notice: bg-yellow-tint-10 / text-yellow-600 → bg-warning/10 / text-warning. - import/confirms/_mappings unassigned-account notice → bg-warning/10 / border-warning/20 (also fixes a missing dark variant — it was light-yellow in dark mode). - simplefin/_replacement_prompt card → bg-warning/10 / border-warning/20, dropping the now-redundant theme-dark: companions (the token is theme-aware). rules' blue/purple execution-type badges and the red failed-row highlight are left as-is (not warning surfaces). Part of #2198. * fix(ds): neutral text in sidebar missing-data notice (match DS::Alert recipe) Warning surfaces follow the DS::Alert recipe — warning tint + warning-colored icon, but neutral body text (text-primary / text-secondary). The sidebar missing-data notice was the lone holdout still painting its text (and link) with text-warning. Switch to neutral text; keep the bg-warning/10 tint and the warning-colored triangle/chevron as the accent. More readable (color-on-tint text is low-contrast) and consistent with the DS::Alert migrations. * fix(ds): missing-data sidebar notice → static DS::Alert (drop disclosure) The notice was a raw collapsible <details> styled as a warning — a hybrid that hid its own primary action (the "Configure providers" link) and its explanation behind a chevron click. A warning's job is to surface a problem and its fix; a disclosure's job is to hide secondary detail. The two fought each other (triangle-alert "act on this" vs chevron "optional, expand"). Replace with a static DS::Alert(:warning): icon + title + body + the Configure link, always visible. Fixes the affordance, surfaces the action, canonicalizes the last warning-styled raw <details>, and matches the other DS::Alert notices. * fix(ds): grey body text in missing-data alert for title/body hierarchy DS::Alert renders its body in text-primary (same dark as the title). For this notice, drop the description to text-secondary so the title (primary, semibold) reads above the supporting body (grey) — clearer hierarchy. Still neutral (no colored text); the Configure link stays primary + underline so the action remains the prominent element. * fix(ds): bump account_sidebar_tabs cache version v1→v2 Flush stale <details>-markup fragments on deploy. The sidebar missing-data notice migrated from <details> to a static DS::Alert, but the fragment is cached with a 12h TTL — without a key change, old markup renders until expiry (and inconsistently across staggered multi-server cache warmups). Bumping the version string changes the cache-key namespace so every cached fragment is bypassed immediately.	2026-06-11 15:30:08 +02:00
Blaž Dular	94422955f8	feat(merchants): add raw data import (csv) for merchants (#1992) ... * feat(merchants): add csv import endpoint for merchants * docs: update endpoint docs * fix(merchant): recommended ai fixes	2026-06-06 16:33:32 +02:00
4 people	1b8b21760b	feat(provider): Akahu integration (#1921) ... * First pass of Akahu * fix up sync all * conflicts * fix db migration issue? - fix auto selection of akahu account type * Address Akahu PR feedback * Complete provider metadata * Fix PR 1921 CI tests * PR feedback * PR feedback * post merge --------- Co-authored-by: failing <failing@users.noreply.github.com> Co-authored-by: Juan José Mata <jjmata@jjmata.com> Co-authored-by: sure-admin <sure-admin@splashblot.com>	2026-06-02 21:44:57 +02:00
3 people	3508f70582	feat(goals): balance-derived + pledges (#1798) ... * feat(savings): add savings goals Adds a standalone Savings goals feature: a piggy-bank style tracker that lets a family set a target, link one or more Depository accounts as funding sources, and log manual contributions over time. Supersedes #1569 (closed) — same intent, redesigned per reviewer + Discord feedback. What this adds: - New `/savings_goals` sidebar entry (piggy-bank icon) with index, show, state-filtered tabs (all/active/paused/completed/archived), and a 2-step modal stepper for creation (Identity → Review). - Multi-account funding via a `SavingsGoalAccount` join: a goal requires ≥1 linked Depository account (checking/savings/HSA/CD/money-market), and all linked accounts must share the goal's currency. - Tracker balance model: goal balance = SUM(contributions.amount). No auto-flow from account balances. Contributions are pure logical records and don't move money between accounts. - Manual contributions modal scoped to the goal's linked accounts. Initial contributions seeded at creation can't be deleted; manual ones can. - AASM lifecycle: active / paused / completed / archived. Hard-delete only after archive. - Status pills (On track / Behind / Reached / No date) derived from pace vs target_date. - AI Assistant tool `create_savings_goal` lets the sidebar chat create a goal end-to-end from a natural-language prompt; soft errors carry the available-accounts list back to the LLM (mirrors the existing `import_bank_statement` pattern). - Family-scoped throughout (`Current.family`-only access, account family-scoping enforced both in controllers and the AI tool). - Demo data seed wires up 4 sample goals across the Depository accounts. Intentionally out of scope (separate PRs / v1.1): - Auto-fund from budget surplus + Sidekiq cron + budget-show card. - Dashboard "Savings goals" widget. - "Behind pace" projection chart on the detail page. - `evaluate_savings_goal_feasibility` LLM tool (level-setting before create_savings_goal). - Spend-less goals inside Budgets. - Family-member-private goals (deferred investigation). * fix(savings): DS conformance pass on stepper, ring, card, status pill - StatusPill: use functional `text-success` / `text-warning` tokens with matching icon colors and `px-2 py-1`, mirroring `app/views/budget_categories/_budget_category.html.erb:29-43`. - ProgressRing: rework center text to match `_budget_donut.html.erb` (small "Saved" label, `text-3xl font-medium` headline, "of $X" underline). Stroke color now derives from goal.status (yellow when behind, blue on track, green reached, gray for no-date). - GoalCard bar: track height + transition match budget category bar (`h-1.5`, `transition-all duration-500`, `inline-size`). - Index/show layouts: render page header inline (`<h1>` + actions). The default application layout doesn't yield `:page_actions`, so the CTA + kebab menu wouldn't appear when emitted via `content_for`. - Stepper review summary: target the actual form inputs by `name` rather than relying on the `data-target` Stimulus attribute, since `money_field` puts the attribute on the wrapper. Step 1 validation scoped to the step 1 panel. - Demo generator: filter Depository accounts via `where(accountable_type: "Depository")` — Rails delegated_type generates the `depository?` predicate, not a `.depository` scope. * feat(savings): rebuild UI to match Claude Design + adopt shared donut-chart Previous savings goals UI looked nothing like the Claude Design output (see sure-design-context/design/savings-goals/project/goals/*.jsx) and the hand-rolled ring did not match the segmented D3 donut used at app/views/budgets/_budget_donut.html.erb. This rewires the surface end to end. Donut chart: - SavingsGoal#to_donut_segments_json returns the same segment shape as Budget#to_donut_segments_json: filled portion in goal color, unused remainder as `var(--budget-unallocated-fill)`. Visual identity is now the same: segmented arc with cornerRadius and gap, courtesy of the shared `donut-chart` Stimulus controller and D3. - ProgressRingComponent renders a `data-controller="donut-chart"` div with the same default-content/inner-text pattern as `_budget_donut`. Index page (matches GoalsIndex.jsx): - Page header: title + "Save toward what matters." subtitle + "New goal" primary CTA right-aligned. - Summary strip card: total saved / target, overall bar, active goals, on-track ratio, behind count. - State filter rendered as DS::Tabs-style pill nav (`bg-surface-inset p-1 rounded-lg`, white-pill active state). - Cards rebuilt: avatar (44px, rounded-xl, white initial on goal color) + name + secondary line ("N days left · by date" / "No target date" / "Completed" / "Past due"), status pill with leading dot, big $current/$target line + percent, bar in status colour, AccountStack (overlapping initials) + "N accounts" + "to go". Goal detail (matches GoalDetail.jsx): - Header: 64px avatar + h1 name + status pill + "Target $X by date · N days left" subline + Edit (outline) + Add contribution (primary) + kebab (DS::Menu for AASM transitions). - Donut-chart ring card with stats overlay. - 4-col stat row (Avg monthly, Total contributions, Target date, Started) with mono numerals and "Needs $X/mo" / "Above target pace" sub-captions where relevant. - Two-col bottom: contributions list (avatar + account · date · source · green +$amount) and funding accounts breakdown (stacked bar + per-account row with $ and % of saved). New components: Savings::AccountStackComponent (overlapping account initials with ring-2 ring-container). StatusPillComponent now uses a leading colored dot instead of an icon. GoalAvatarComponent radii match Claude Design (rounded-md/lg/xl/2xl) and white initial. Locale: new keys under savings_goals.{index.subtitle, index.summary.*, goal_card.{accounts,days_left,completed,past_due,no_target_date}, show.header.*, show.ring.{of,to_go}, show.stats.*, show.funding_balance, show.of_saved, show.notes}. * feat(savings): match Claude Design — projection chart, target-icon modal, grouped funding accounts Brings the savings goals UI closer to the Claude Design reference shared by the user. Changes: - Sidebar nav label: "Savings goals" → "Savings". - Status pill copy: "Behind" → "Behind pace" (matches Pill component from GoalsCommon.jsx). - Empty state rewritten with a large target icon, "No goals yet" heading, and the descriptive body copy from the design. Goal detail page (matches GoalDetail.jsx): - New "← All goals" back link above the header. - 2-column hero: ring card on the left (320px column), Projection card on the right. - Projection card uses a new D3 Stimulus controller (`savings-goal-projection-chart`) that draws: · saved area + line from goal creation → today (solid, primary) · dashed projection segment from today → target date (yellow when behind, green when on track) · horizontal dashed target line with label · today marker (vertical dashed line + dot) Data shape comes from `SavingsGoal#projection_payload`. - Card subtitle generates a contextual sentence ("At $X/mo you'll fall short. Bump to $Y/mo to hit it on time." / "At your current pace you'll reach this goal around Month YYYY." / "Goal reached. Nice work.") with a strong tag highlighting the actionable figure. - Stat row now shows Linked balance (sum across linked accounts) + "N accounts" sub-caption instead of duplicate "Target date" stat. New goal modal (matches the design images 2 + 3): - DS::Dialog custom header: DS::FilledIcon target glyph + title + step subtitle ("Step 1 of 2 · Goal details" / "Step 2 of 2 · Review & start") that updates as the user advances. - Connected stepper at top of body: numbered circles connected by a bar, step-1 circle flips to ✓ when complete. - Step 1 heading "What are you saving for?" + supporting copy. - Name field paired with a target glyph affordance on its left. - Target amount + Target date in a 2-col grid. - Funding accounts list now grouped by account subtype with uppercase section headers (CHECKING / SAVINGS / HSA / CD / MONEY MARKET / OTHER), each row showing avatar + name + subtype + balance. - Step 2 heading "Looks good?" + Review card (goal target + funding accounts summary + suggested monthly = target/months_remaining), and a disclosure for the optional initial contribution. - Footer: "Cancel" left text-button (closes modal) / "Back" left text when on step 2; "Continue →" or "Create goal →" right arrow button. Demo generator: Depository accounts now set `subtype` ("checking" / "savings") on the accountable so they group correctly in the modal. Tests: all green, 35 runs in the savings suite, 92 assertions. * feat(savings): rebuild index to match Claude Design - Page header: title "Savings" + "Your savings accounts and the goals you're working toward." Removed the top-right New goal button (moves into the Goals section). - Hero card: "Total in savings" with sum-of-savings-subtype balance, 30-day delta vs last 30 days (Family#savings_balance_30d_delta), 3-stat sub-row (Accounts / Active goals / Saved toward goals), and a D3 sparkline area chart on the right (new `savings-sparkline` Stimulus controller, sourced from Family#savings_balance_series). - Accounts section: lists Depository accounts with subtype = "savings" as cards (blue avatar, name, subtype, balance, "Funds N goals"). New Savings::AccountCardComponent. - Goals section header: "Goals" + "Save toward what matters." + "New goal" button right-aligned to the section (not the page header). - Removed state-filter pill nav. Active goals render in the main grid; Completed goals get a "Completed · N" divider w/ check-circle icon and their own grid below. - Goal card layout reworked: horizontal bar replaced with a 64px donut ring on the right side of the card header (ring colour tracks goal.status — yellow=behind, primary=on-track, green=reached). Pill is inline with the goal name. - Status pill copy: "Behind pace" → "Behind". - Filter bar (copied from settings/providers): search input + status chips (All / On track / Behind / No date). Hidden when ≤ 6 active goals. Powered by `savings-goals-filter` Stimulus controller — toggles `.hidden` on cards by goal name + status. - Family#savings_subtype_accounts, total_savings_balance, savings_balance_series, savings_balance_30d_delta helpers; controller computes hero payload + account-goal counts for the cards. * fix(savings): refine hero spacing, goal/account card padding, sparkline negative range - Sparkline (`savings-sparkline` controller): dropped the `Math.max(0, yMin)` clamp on the y-axis domain so negative balances (or any series that dips into negative territory) render fully instead of being cropped off the canvas. - Hero card: padding `p-6` → `p-7`, column ratio `[minmax(0,1fr)_minmax(0,1.6fr)]` so the chart breathes, min height bumped to 220px, sparkline container `h-full min-h-[200px]` so it fills the card vertically. Stats row now sits at the bottom of the text column via `mt-auto pt-6`; labels promoted to `text-xs`, values to `text-lg`. - Section vertical rhythm: outer `space-y-6` → `space-y-8`. - Goal card: padding `p-[18px]` → `p-6`. Internal gap from header row to amount line `mt-3.5` → `mt-5`. Account-row gap `mt-3` → `mt-4`. - Account card: padding `p-5` → `p-6`. - Status pill "Behind" dot: `bg-yellow-500` → `bg-yellow-600` for a warmer/ambery tone matching the Claude Design reference. - Goal card donut "behind" stroke: `var(--color-yellow-500)` → `var(--color-yellow-600)` to match the pill. * fix(savings): add bottom padding so last card clears the mobile fixed bottom-nav * feat(savings): add "ONGOING · N" + "COMPLETED · N" section dividers Same pattern as the bank-providers page's `AVAILABLE · 3` header (see `app/views/settings/providers/_search_filters.html.erb` references): small uppercase tracking-wide secondary label, separator dot, tabular count. Replaces the prior "Completed · 1" inline label with a more consistent treatment and adds an "Ongoing · N" header above the active goals grid. Name choice: "Ongoing" rather than "Active" because the grid includes both `active` and `paused` AASM states; "ongoing" reads as still-in- progress for both. Parallel to the existing "Completed" sibling. * fix(savings): bump space between ONGOING/COMPLETED header and goal grid * fix(savings): rebalance spacing — moves the gap onto the grid, not the header Previous attempt put `mb-5` on the section header so the goal grid sat ~20px below it, but that also pushed the "No goals match" empty card down because it shares the same header. Margin collapse meant the empty card's own `mt-3` was getting added to the new big header `mb`. Rework: header back to `mb-2.5`, grid gets `mt-3` of its own. Empty card keeps its `mt-3`. Both children collapse to ~12px below the header now, which matches the breathing room the empty card had before this thread of edits. * fix(savings_goals): equalize ONGOING/COMPLETED header spacing across cards and empty state Move section gap from per-child mt-3 to a single mb-4 on the header, and toggle the grid wrapper hidden when no cards are visible. The previous markup gave inconsistent ONGOING-tag-to-content distance because the empty card sat below a 0-height grid, stacking margins differently than the cards layout. * fix(savings_goals): update ONGOING count when filtering by status or search The "ONGOING · N" badge was server-rendered with @active_goals.size and never re-synced when the Stimulus filter hid cards. Add a count target and update it alongside the existing empty/grid toggles. * feat(savings_goals): replace hero card with KPI strip + differentiate empty states P1: drop the sparkline + the single mixed hero. Hero became 3 separate KPI cards (Contributed last 30d, Needs this month, Goals on track), matching the Transactions page pattern. Each KPI answers a question the user opens the page asking — saving rate, this-month action, overall health. P3: empty state copy + CTA now reflect the reason it is empty. Search returns 0 → "No goals match X" + Clear search. Chip set to non-all → "No goals match this filter" + Show all. Both → both reasons + both buttons. Drop: total_savings_balance, savings_balance_series, savings_balance_30d_delta on Family (no other consumers). Add: Family#contribution_velocity(range:). * feat(savings_goals): status pill icons + paused variant, attention-first sort, paused chip, rename "No date" to "Open-ended" P4: status pills now carry an icon alongside the colored tint (circle-check / triangle-alert / star / infinity / pause), so color is no longer the sole signal. Drop the redundant dot. P4: default sort on the active goals list becomes attention-first — behind → on_track → no_target_date → paused, alphabetical within bucket. The user opens the page and lands on the goals that need them. P5: add a Paused filter chip + render paused goal cards with opacity-75 so they read as inactive at a glance. Rename "No date" chip to "Open-ended" — clearer to non-jargon readers. * feat(savings_goals): goal card pace + status-driven footer Each card now answers "what's my next move" without clicking into the detail page. Under the amount/target row, a pace line shows actual avg contributions vs the monthly target. The footer (previously "$X left") switches by status: - behind → "Save $Y/mo to catch up" - on_track → "Last contribution Nd ago" (or "today" / "No contributions yet") - reached / completed → "Goal reached" - no_target_date → "No deadline set" - paused → "Paused" Add SavingsGoal#last_contribution_at and #last_contribution_days_ago. Both these methods and average_monthly_contribution now respect a loaded :savings_contributions association so the index page doesn't N+1. Controller eager-loads :savings_contributions + :linked_accounts. * feat(savings_goals): drop Accounts section from index The Accounts grid duplicated the sidebar account list. Removing it gives the Goals section more breathing room and the page a tighter narrative: header → KPIs → Goals. Delete Savings::AccountCardComponent, Family#savings_subtype_accounts, the @savings_accounts / @account_goal_counts controller refs, and the related locale keys. Sidebar still shows the savings-subtype Depository accounts under "Cash" — no information is lost. * feat(savings_goals/new): drop required asterisks, hide currency, collapse notes, clean footer P1 of modal refactor — visual fidelity baseline against the Claude Design reference and refactoring-ui rules. Drop required: true on name + target_amount (suppresses both the red `*` indicator and the browser-default HTML5 validation tooltip). Client-side validation moves into the Stimulus stepper in a follow-up commit. Pass hide_currency: true on the money_field so single-currency families don't see a redundant inline currency dropdown. Wrap the Notes textarea in a <details> disclosure ("Add notes (optional)" summary) so step 1 isn't padded with rarely-used fields. Drop the footer top border-subdued divider so the action row floats against the dialog's existing padding boundary. Drop the view-layer SavingsGoal::COLORS.sample fallback on hidden color field — the controller already seeds @savings_goal.color. * feat(savings_goals/new): live previewable name avatar + ghost cancel + circular header icon Replace the big square DS::FilledIcon next to the name input with a small Savings::GoalAvatarComponent that previews the goal's avatar (seeded color + first character of the typed name, updates live via new stepper#nameChanged action). Switch the modal header's target avatar from FilledIcon(size: lg, rounded: false) → (size: md, rounded: true) — matches the goal-avatar shape used elsewhere on the page. Replace the hand-rolled <button> for Cancel/Back with DS::Button variant: "ghost". Stepper now drills into the button's inner span to swap the label, same pattern already used for the Continue/Create button on the right. Drop the now-unused footerLeftLabel target. * feat(savings_goals/new): deterministic account avatar color via name hash Replace the hardcoded var(--color-blue-500) on every funding-account row's avatar with a deterministic pick from Category::COLORS based on the account name's hash. Rows now read at a glance instead of melting into one blue column. * feat(savings_goals/new): inline per-field error state in stepper Drop the top-of-form server-error banner (kept only when model.errors on :base, which is rare) and stop relying on input.reportValidity() browser-default tooltips. Stepper validates step 1 manually when Continue is clicked: - name empty → red ring on input + "Please give your goal a name." below - target_amount ≤ 0 → red ring + "Set a target amount greater than zero." - no funding account checked → "Select at least one funding account." Each error clears as soon as the user fixes the field — typing in the name field clears the name error, entering an amount > 0 clears the amount error, checking any account clears the accounts error. Drop the now-unused flashLinkedAccountsRequired() shake; replaced by the per-field error pattern. * feat(savings_goals/new): checkbox styling, visible stepper, DS::Disclosure for notes, drop redundant cancel Use Sure's .checkbox checkbox--light classes on the funding-account check_box_tag — matches transactions / entries / settings pages. Stepper line: 2px tall bg-secondary in resting state (was 1px bg-subdued which disappeared in dark mode). Step 2 inactive circle: border-secondary outline instead of bg-container-inset fill — visible in both themes. Notes collapse switches from raw <details> to DS::Disclosure for consistency with the rest of Sure's DS. Drop the footer Cancel button — the close X in the modal header already handles that, and double cancel was redundant. The footer-left slot now only renders Back (with arrow-left icon) and only on step 2. * fix(savings_goals): status pill icons inherit pill's semantic color Pass color: "current" to the icon helper so triangle-alert / circle-check / star / infinity / pause render in the same color as the pill's text (text-success / text-warning / text-secondary). The icon helper defaults to text-secondary, which made all icons grey regardless of pill variant. * fix(savings_goals/new): name field uses .form-field wrapper for floating label Drop the outer <label>Name</label> heading + label: false on the text_field, and pass label: t(...) + container_class: "flex-1" so styled_form_builder wraps the name input in Sure's standard .form-field component. Label now sits inside the input box, matching the new transaction modal pattern (and every other styled_form_with form across Sure). The avatar still sits as a sibling outside the box, flex-aligned center. * fix(savings_goals/new): stepper line uses border-secondary token bg-secondary is not a registered Sure utility, so the previous h-0.5 bg-secondary div rendered with no background — the line was just a transparent slot, barely visible in either theme. Replace with border-t-2 border-secondary on the connector div, and toggle border-inverse / border-secondary on step transition. Both classes are real Sure tokens with proper light/dark variants (alpha-black-200 / alpha-white-300 for border-secondary). * fix(savings_goals/new): notes textarea uses .form-field wrapper Passing label: false to f.text_area stripped the .form-field container, leaving a naked textarea with no border or visible label inside the DS::Disclosure. Pass a real label ("Notes (optional)") so styled_form_with wraps it like every other textarea in Sure (transactions/_form.html.erb, trades/show.html.erb, etc.). Bump rows to 3. * fix(savings_goals/new): step 2 back button inline + form-field wrappers on initial-contribution inputs DS::Button treats "hidden" as a display override class — adding class: "hidden" stripped the base inline-flex display, so when Stimulus later removed the hidden class the icon and text stacked vertically. Wrap the Back button in a hidden <div> and toggle the wrapper instead; the button keeps its inline-flex base. The Amount + From-account inputs in step 2 used label_tag + number_field_tag / select_tag directly with no .form-field wrapper, so they rendered as bare inputs (same issue Name had in step 1). Wrap each in .form-field > .form-field__body with form-field__label and form-field__input classes — matches the styled_form_with pattern used by Target amount / Target date in step 1. * feat(savings_goals/new): step 2 initial-contribution amount uses money_field Add virtual attr_accessors for initial_contribution_amount and initial_contribution_account_id on SavingsGoal so the form builder can bind to them without the model needing real columns. Replace the raw number_field_tag with f.money_field hide_currency: true so the field shows the currency symbol prefix and step-aware precision, matching the Target amount field in step 1. * feat(savings_goals/show): cleanup — drop misleading stats, hide add-contrib when reached, last-contribution recency D1 — Drop the "Linked balance" stat. It summed the linked accounts' total balances (e.g. $204K) rather than the amount saved toward the goal ($1K), so it overstated progress by ~200x. Replace with a "Target pace" card showing required $/mo. D2 — Drop the redundant "← All goals" link. The breadcrumb nav above the header already shows Home › Savings Goals. D3 — Hide the Add-contribution button on reached / completed goals. Logically you don't keep contributing after the goal is done. D5 — Add last-contribution recency to the header sub ("Last contribution 3d ago"), matching the goal card footer pattern from the index refactor. D11 — Stat row now 3 cards instead of 4 (avg monthly, total contributions, target pace). Drop the "Started" card — low-signal for new users. * feat(savings_goals/show): catch-up callout for behind goals For behind (non-paused) goals with a target_date, render a DS::Alert warning under the header surfacing the actionable insight from the index card: "Save $X/mo to catch up · Bump your monthly contribution to stay on track for <date> · [+ Add $X]". The CTA prefills the contribution flow with the target monthly amount in the button label so the user sees exactly what to commit to. Mirrors the goal-card footer pattern shipped during the index refactor — the detail page now carries the pace narrative forward instead of hiding it inside the projection paragraph. * feat(savings_goals/show): status-specific hero card + paused/archived banners D6 — Paused goals render a top info banner ("This goal is paused" + [Resume goal]) before the hero. Archived goals get the same treatment with a Restore CTA when applicable. D8 — No-target-date goals replace the empty projection chart with a focused prompt card: calendar-plus icon, "Add a target date" heading, short copy, and a "Set target date" CTA that opens the edit modal. Stops wasting the right half of the hero on an unrenderable chart. D9 — Reached / completed goals replace the projection chart with a celebration card: party-popper green icon, "Goal reached. Nice work." heading, target-hit confirmation copy, and an "Archive goal" CTA when the state machine allows it. The original projection chart still renders for behind / on_track goals with a real target_date — that's the only case where it adds value. * feat(savings_goals/show): combo monthly-pace stat card D7 — Merge the separate Avg-monthly and Target-pace cards into one wider "Monthly pace" card spanning 2/3 of the stat row. Shows actual $/mo + target $/mo inline, with a delta line below: - behind → "Behind by $X/mo" (text-warning) - on/ahead → "Above target pace" (text-success) - no target_date → "No required pace" Total contributions stays as a separate, smaller card at 1/3 width. The action pyramid finally points at the actionable stat — pace is visually primary, raw count secondary. * feat(savings_goals/show): scrollable contributions list + hide pace card for reached goals D10 — Drop the silent .limit(50) on the contributions query and put the list in a max-h-[480px] scrollable container. Goals with many contributions now show all of them without truncation, but the page stays compact via the inner scroll. Polish — reached / completed goals no longer render the combo monthly- pace card. After the goal is hit, comparing actual vs required pace is moot (and target $0/mo · Above target pace was awkward filler). Only the Total contributions card remains in the stat row. D12 (clickable contribution rows) deferred — adding a dedicated contribution detail/edit route adds enough scope to warrant its own ticket. The per-row delete X already covers the only mutation people need from this view. * fix(savings_goals/show): chart contrast, breadcrumbs, contributions list polish Chart — Sure's "text-X" / "border-X" tokens are Tailwind utility classes, not CSS custom properties, so var(--text-secondary) etc. resolved to empty inside SVG attributes. Read data-theme on draw and pass real hex colors (textPrimary, textSecondary, borderSubdued, containerBg) into d3 fills/strokes. "Target · $X" label and axis tick labels now have proper contrast in both themes. Breadcrumbs — set @breadcrumbs in the show action so the layout renders Home › Savings › <goal name> with the middle entry clickable back to the index. Matches the convention used by imports / reports / family exports. Contributions list — drop the broken divide-y divide-subdued (Tailwind divide- utilities don't pick up Sure's semantic border tokens). Switch to space-y-3 rows matching the funding-accounts breakdown component. Drop the border-b separator under the heading; the card now reads as one continuous panel. Move the delete X to hover-revealed and reserve an inert spacer for non-manual rows so the right column stays aligned. * feat(savings_goals): demo variety, breadcrumb naming, ring token, list pattern, header split, tone down behind noise Demo — extend generate_savings_goals! with three more goals to exercise status-specific UX: Wedding fund (on_track w/ 6 months of contributions matching required pace), Sabbatical (paused), Old laptop fund (archived). House downpayment gains 12 contributions so the scrollable list has real density. Total now 7 demo goals covering behind / on_track / no_date / paused / archived / reached. Breadcrumbs — set @breadcrumbs on index too (it was relying on the Rails-derived "Savings goals" label). Both views now read "Home → Savings → ..." consistently, matching the sidebar nav text and H1. Ring token — goal-card ring stroke switched from var(--color-gray-200) (a hard light color identical in both themes) to var(--budget-unallocated-fill) which is gray-50 light / gray-700 dark, matching the detail page's progress ring. Contributions list — replace the inline hover-revealed delete-X with DS::Menu kebab, matching tags/_tag.html.erb and categories/_category. Each row also gets hover:bg-surface-hover with a px-3 -mx-3 negative margin to extend the hover area across the card padding. Non-manual contributions render a 9x9 spacer so the right column stays aligned. Header sub split — drop the long "·" chain into two lines: primary fact (target / days left) in text-secondary, recency note in text-subdued underneath. Less wall-of-text. Behind noise — pill, ring, catch-up alert and projection chart already signal "behind". The Monthly-pace combo card's "Behind by $X/mo" delta no longer renders in text-warning — it switches to text-subdued so the warning palette doesn't repeat across the page. The catch-up alert stays loud because it's the primary action; the rest stays informational. CustomConfirm wired with destructive: true on the contribution delete so the confirm button gets the outline-destructive treatment. * fix(savings_goals): ring on_track color, contributions horizontal scroll, modal restored on back, chart saved fill Ring on on_track / no_target_date goal cards rendered with no progress arc — ring_color returned var(--text-primary) / var(--text-subdued) which aren't real CSS custom properties (Sure's text tokens are Tailwind utilities). Switch to var(--color-green-500) / var(--color-gray-400) which ARE CSS vars from the Tailwind palette and resolve at SVG fill time. Contributions list had a horizontal scrollbar because the rows used -mx-3 px-3 to extend the hover background, which pushed content beyond the card padding. Drop the negative-margin trick and add overflow-x-hidden to the scroll container. Rows still hover-highlight inside the card bounds. Modal cache restoration — Turbo cached pages with open <dialog> elements inside <turbo-frame id="modal">. After dismissing the new-goal modal and navigating to a goal detail page, browser back restored the cached index page WITH the dialog still in the modal frame; the dialog's Stimulus controller then ran auto-open and reopened it. Now the dialog close handler empties the parent modal turbo-frame so the cache snapshot is clean. Chart saved-fill — bump area gradient stop-opacity 0.10 → 0.22 so the contribution history is more visible against the dark canvas. Chart was rendering correctly but the white-at-10%-opacity gradient was too faint to read on top of the dashed projection. * fix(savings_goals/show): chart axis includes backdated contributions, legend uses real colors projection_payload's start_date was created_at, but demo seeds (and manual imports) can have contributions backdated before created_at — those points were getting clipped/pushed left of the chart's x-domain and the saved-series line couldn't render. Use min(created_at, earliest contribution date) so the axis spans the full history. Legend "saved" line stroke was var(--text-primary) which doesn't resolve (Tailwind utility, not CSS var) → invisible swatch. Wrap in text-primary span + stroke="currentColor". Legend "projection" line was hardcoded yellow — chart paints green for on_track goals → mismatch. Pick legend color based on goal status so it matches what the chart actually draws. * fix(savings_goals): neutral ring percent, chart start vertical-line, contribution select wrapper, deterministic account colors Ring percentage no longer takes the warning yellow tint when behind — the colored ring stroke + status pill + catch-up alert already signal the state, doubling it on the percent number was noise. Reached stays green (celebratory), everything else uses text-primary (white/dark). Chart vertical line at the left edge was the (start_date, $0) point the controller prepended to the saved series. When start_date equals the first contribution date (now common after the earlier earliest- contribution fix), this drew a vertical jump from $0 to first contribution at x=start. Skip the prepend when there's no temporal gap so the line starts at the first real point. Add Contribution modal — wrap the source-account select in the styled form-field via f.select instead of label_tag + bare select_tag. Match the rest of Sure's form controls. Also pass hide_currency on the amount field so single-currency families don't see a redundant USD dropdown. Account avatar colors — replace Ruby String#hash (randomized per process by Ruby for DoS protection) with a deterministic MD5-based pick from Savings::GoalAvatarComponent::PALETTE. Same account name now resolves to the same color across processes and across components. Apply via a new Savings::GoalAvatarComponent.color_for helper used by both the form stepper account list and the goal-card AccountStackComponent (which was hardcoding blue-500 for every avatar in the stack, hence Chase + Ally looking identical on the wedding card). * fix(savings_goals/show): contributions list + funding accounts breakdown use per-account deterministic color Both used goal.color for every account avatar, so every linked account ended up the same color as the goal. Sure's convention elsewhere (accounts/_logo.html.erb) is accountable.color (type color: Depository → purple) — but savings goals only link Depository accounts, so that would still collapse to one color. Reuse the deterministic Savings::GoalAvatarComponent.color_for(name) helper from the index card stack instead. Same account always resolves to the same color across processes, and multiple accounts on the same goal read as distinct. Funding-accounts breakdown bar at the top now also colors each segment by account so the proportions are visibly typed (not a single goal- color block). * fix(savings_goals): projection chart redraws when container resizes (Turbo navigation) After submitting a new contribution, Turbo's redirect-replace stream swaps the page; the chart's data-controller reconnects but the container's clientWidth can momentarily be 0 (parent grid hasn't laid out yet). The early-bail in _draw left the SVG empty and nothing triggered another draw, so the chart stayed blank. Add a ResizeObserver to the controller. The observer fires once the container settles into a real size and re-runs _draw, which now paints the chart correctly after the post-submit navigation. * perf(savings_goals/show): preload + memoize cut show from 17 to 5 queries - set_savings_goal: with_current_balance + includes(savings_contributions: :account, linked_accounts: []) so contributions / accounts / current balance don't re-query inside helpers and view partials - SavingsGoal#status + #average_monthly_contribution: defined?(@ivar) memoization so the 5+ callsites per show (header banner, projection_summary, donut, goal-card pace, stats_for) don't recompute the exists?/MIN/SUM triplet each time - SavingsGoal#projection_payload: sort loaded contributions in Ruby instead of running a fresh ORDER BY - SavingsGoalsController#show: replace .chronological re-query with in-memory sort over the preloaded association - funding_breakdown_for: group_by + transform_values off the loaded collection instead of an extra GROUP BY SQL - stats_for: contributions_count uses .size to read the loaded cache instead of issuing COUNT(*) * a11y(savings_goals): ARIA semantics + unique IDs + h2 hierarchy - Projection chart SVG: role=img + <title> + <desc> wired through new ariaLabelValue / ariaDescriptionValue Stimulus values. Show.html.erb passes a localized chart label and a strip_tags'd projection summary. - Progress ring container: role=progressbar + aria-valuenow/min/max + aria-label so screen readers announce "Goal 27% complete. $13,250 of $50,000 saved." instead of four disjoint spans. - Funding-account checkboxes (stepper step 1): explicit per-account id ("savings_goal_account_ids_<id>") so each row has a unique DOM id; duplicate-id HTML violation gone. - show.html.erb: <h3> -> <h2> at six section headings (celebration, no-target-date, projection, contributions, funding accounts, notes) so the heading hierarchy is h1 -> h2, not h1 -> h3. - goal_avatar + account_stack components: aria-hidden=true on the decorative wrappers; the textual goal/account name beside them is always read separately so the SR no longer prefixes every entry with the avatar initial. - New locale keys: savings_goals.show.ring.aria_label and savings_goals.show.projection.aria_label. * fix(savings_goals/new): trap Enter on step 1; add funding-accounts hint - Pressing Enter inside a step-1 input (Name, Target amount, Target date) used to fire the form-implicit-submission against the sr-only submit button, jumping straight to POST /savings_goals and skipping step 2 entirely (no initial contribution, no review). - New blockEnter action on the form re-routes Enter to next() when currentStep === 1, mirroring the Continue button. Notes textarea is exempt so newlines work. - Add an inline hint under the funding-accounts label so users know up front what the field controls; previously the only feedback was a tiny "must pick one" error after Continue. * feat(savings_goals/chart): theme-follow palette, axis format, Today + ETA labels - MutationObserver on <html>[data-theme] re-runs _draw() when the user toggles theme so the chart's hex-resolved-at-draw-time colors follow the surrounding dark/light card surface (previously stuck on initial palette until a full page reload). - Axis tick format: "%b %y" → "%b '%y" (Jan '26) to disambiguate from a day-of-month; tick divisor 110 → 80 so 375-wide mobile gets enough ticks; post-process to drop adjacent equal labels for short windows. - Today vertical line: small "Today" label above it on widths >= 320. - Projection segment: end dot in the projection color + a short-format label ("$42K" or "Short $7.9K"). Labels suppressed at < 320 width to avoid colliding with the Target line label. - New _fmtMoneyShort helper: K/M shorthand. Plain prefix; full i18n / Intl.NumberFormat tracked as a long-term follow-up. * chore(savings_goals/stepper): use Number.parseFloat / Number.NaN per Biome biome lint --write picked these up while auditing the chart changes. Pure rename, no behaviour change. * fix(savings_goals/show): dedupe ring labels, DS::Button banners, status-pill contrast - progress_ring_component: drop the in-ring "$saved / of $target" lines. The same money pair already renders directly below the ring in show.html.erb (now the single source). Inside the ring keeps only "Saved" + percent. - show.html.erb: replace 3 hand-rolled button_to CTAs (Paused banner "Resume goal", Archived banner "Restore goal", celebration card "Archive goal") with DS::Button so focus/hover/disabled match the rest of the app. variant: primary/outline, size: sm, method: :patch. - status_pill_component: swap text-success / text-warning / text-secondary to text-green-700 / text-yellow-700 / text-gray-700 so all 5 light-mode pill variants pass WCAG 4.5:1. Local override pending the upstream DS token fix tracked at we-promise/sure#1736. * fix(savings_goals/empty_state): pass return_to so user lands back on /savings_goals after adding an account The "Add an account" CTA on the no-depository-accounts empty state now appends ?return_to=/savings_goals. StoreLocation already stashes the param into session via the global before_action; the consuming side (subtype #create actions) honouring it is tracked at we-promise/sure#1766. * fix(savings_goals): use display_status for inactive goals; hide pace + projection - SavingsGoal#display_status returns :archived / :paused before falling through to the visualization status. Memoized like #status. The plain #status method keeps its meaning (visualization vs. target/pace) so callers that genuinely want "is this on track" — KPI sort, goal-card ring color, projection_payload — keep working unchanged. - Savings::StatusPillComponent: status_key uses display_status; new :archived variant (bg-surface-inset / text-gray-700 / archive icon). Previously an archived goal showed "Behind" on the detail page while the archived banner said the goal was archived — conflicting signal. - show.html.erb: paused/archived goals render a static recap card (current saved vs target) instead of the projection chart. Pace stat (avg vs required monthly) is also hidden — extrapolating "Behind by $X/mo" against a goal that isn't accepting contributions is misleading. - New locale keys: savings_goals.status.archived, savings_goals.show.inactive.{heading_paused, heading_archived, body}. - Tests cover display_status for archived / paused / active goals. * fix(savings_goals/show): stack header on mobile so long names + actions don't collide - header: flex-col on <sm (stacks title block + action group), flex-row from sm up. Action group keeps its row on desktop, wraps below the title block on phones. - Title row: flex-wrap so the status pill drops to a second line on narrow widths instead of squeezing the h1. - h1: drop truncate, use break-words + min-w-0 inside the flex chain so long names like "Investment property downpayment" wrap legibly instead of clipping to "House …" on 375px. - Action group: flex-wrap + sm:shrink-0 keeps Edit / Add contribution / kebab readable when they have to share a line with the title block at the sm breakpoint. * fix(savings_goals/show): drop row hover so the kebab's own hover registers Both the row and the kebab carried hover backgrounds (bg-surface-hover on the row, bg-container-inset-hover on the icon button). The two are near-identical shades, so the button's hover state was visually invisible on top of the row's. Removing the row hover lets the kebab be the sole affordance. * feat(savings_goals/index): collapsed Archived section + archived-aware card - Controller: @archived_goals exposes state=archived rows already pulled by the all_goals load. No extra query (sliced from the existing array). - Index template: <details> disclosure under "Completed" so archived goals are reachable from the list without cluttering the active / completed sections. Collapsed by default. - GoalCardComponent: uses display_status for the data attribute (so the card on the index reads as Archived instead of Behind), opacity-75 applies to archived too, footer_line short-circuits to "Archived" and pace_line returns nil. Matches the show-page archived semantics shipped earlier. - Locale: new savings_goals.index.archived_section.heading and savings_goals.goal_card.footer_archived. * refactor: rename Savings Goals feature to Goals User-facing rename + structural rename. Feature is now called just "Goals" everywhere — page title, sidebar nav, modal headings, flash messages, AI assistant tool. Code identifiers follow: - Models: SavingsGoal → Goal, SavingsContribution → GoalContribution, SavingsGoalAccount → GoalAccount. - Tables: savings_goals → goals, savings_contributions → goal_contributions, savings_goal_accounts → goal_accounts. FK columns savings_goal_id → goal_id. New migration db/migrate/20260511100003_rename_savings_to_goals.rb uses rename_table + rename_column; PG handles index renaming and FK redirection automatically. - Controllers: SavingsGoalsController → GoalsController, SavingsContributionsController → GoalContributionsController. - Routes: /savings_goals → /goals, nested /goals/:id/contributions (resource name shifts; old route name aliases dropped). - ViewComponent namespace: Savings::* → Goals::*. Component class names drop their redundant "Goal" prefix where the namespace already carries it: Savings::GoalCardComponent → Goals::CardComponent, Savings::GoalAvatarComponent → Goals::AvatarComponent. Others keep their names (Goals::ProgressRingComponent, Goals::StatusPillComponent, Goals::AccountStackComponent, Goals::FundingAccountsBreakdownComponent). - Stimulus controllers: savings_goal_* → goal_*, savings_goals_filter → goals_filter. Stimulus identifiers in data-controller / data-* attributes follow. - Locale keys: savings_goals: → goals: (top level), savings_contributions: → goal_contributions: (top level). All t() callers updated. - AI assistant tool: Assistant::Function::CreateSavingsGoal → Assistant::Function::CreateGoal, tool name "create_savings_goal" → "create_goal", description / response text updated. - Sidebar nav label "Savings" → "Goals". Goals/show + index page title "Savings" → "Goals". Empty goals_section heading/subtitle dropped (duplicated the page title post-rename). Original migrations create_savings_goals / create_savings_goal_accounts / create_savings_contributions remain untouched so historical replay still works; the rename migration runs on top. * perf+ux(goals): grouped state-count + friendly 404 for stale/cross-family deep links - index: STATE_FILTERS count loop replaced with single Current.family.goals.group(:state).count + per-state lookup. 5 SQL queries -> 1. - GoalsController + GoalContributionsController: rescue_from ActiveRecord::RecordNotFound -> redirect_to goals_path with a flash. Affects stale deep links AND cross-family access (previously bare 404 -> Chrome error page). Test for cross-family access updated to assert the redirect + flash key. - New locale key goals.errors.not_found. * ux(goals): unify "Open" for no-target-date status across all surfaces One status, four phrasings before this commit: - status pill: "No date" - filter chip: "Open-ended" - goal-card secondary line: "No target date" - goal-card footer: "No deadline set" Plus KPI strip sub-count: "open-ended". Pick "Open" everywhere so the status reads identically wherever it surfaces. * ux(goals/show): catch-up consolidation + confirm dialogs on archive / mark complete A — Catch-up math triple-encoding. The catch-up amount (e.g. $1,531/mo) was rendered verbatim in three places: the banner title, the projection card subtitle, and the pace stat ("target $X/mo"). Only new information anywhere was the buried "Behind by $Y/mo" delta in pace-card subtext. - Banner body now carries the delta: "...currently $Y/mo behind." - Projection sentence drops the "Bump to %{required}/mo" restatement; reduces to "At %{current}/mo you'll miss your target date." Chart aria-description benefits from the simpler phrasing too. - Pace stat drops the "· target $X/mo" sub-line. Pair becomes "$avg/mo" + "Behind by $delta/mo" — same delta now in the banner, surfaced twice intentionally (alert vs at-a-glance stat). K — Destructive transition confirms. Pause / Resume stay no-confirm (recoverable). Mark complete (irreversible via UI; no may_uncomplete? event exists) and Archive (goal disappears from active list) now wear CustomConfirm. New locale keys: goals.show.confirm_{complete,archive}_ {title,body,cta}. Locale catch_up body strings now interpolate %{delta} alongside %{date}; projection.behind drops %{required}. Controller#projection_summary still passes both keys — extras are ignored by I18n. * a11y(goals/card): scope link accessible name to title + status summary Whole card was wrapped in <%= link_to ... %>, so screen readers concatenated every nested text node into one accessible name (~60 words on a typical card: avatar initial + name + status pill + percent + balance + target + pace + accounts + footer). - Outer wrapper now <div> carrying the filter-target + goal-name + goal-status data attrs. - Inner <a> wraps only the goal name. aria-label = "<name>, <status>, <percent>% of <target>" — concise SR sentence. - `before:absolute before:inset-0` makes the inner link's hit area span the whole card so sighted users keep the existing click affordance. - Ring SVG + percent overlay marked aria-hidden (decorative — same info already in the aria-label). - New locale key goals.goal_card.aria_progress. * feat(goal_contributions/new): live impact preview below amount field Add-contribution modal previously offered zero feedback on what the typed amount would do to goal progress. Now renders "Currently X% saved (Y of Z)." at rest and updates on each keystroke to "Will bring you to X% saved (Y of Z)." or "Will reach your Z target." when the contribution would close the gap. - New goal_contribution_preview_controller.js consumes current balance + target + currency + three localized template strings as Stimulus values. Intl.NumberFormat for currency formatting (locale-correct out of the box; fallback to currencyValue prefix on environments that don't support it). - ERB form-level data-controller wires the values; amount input uses amount_data: to thread the Stimulus target / action through the money_field helper. - Locale: goal_contributions.new.preview_{zero,nonzero,reached} with {percent}, {current}, {newTotal}, {target} placeholders. * feat(goals/edit): funding-accounts editor in the edit modal Previously a user who linked the wrong account at creation had to delete + recreate the goal. Now the edit modal carries the same funding-accounts checkbox group as Step 1 of the stepper, pre-checked with the goal's current links. - GoalsController#edit loads @linkable_accounts + @currently_linked_account_ids. - #update accepts account_ids; when supplied, runs the create / update inside a Goal.transaction and syncs linked accounts via sync_linked_accounts! (set-diff: destroy_all unselected goal_accounts, create the new ones). Validates at least one account before touching goal_accounts so the user gets a clean re-render. - Removing an account preserves the goal's existing contributions — GoalContribution#account_must_be_linked_to_goal only fires on save, so historical rows stay valid. - _form_edit partial accepts new locals; edit.html.erb threads them through. - 3 new controller tests: identity-only patch leaves links intact; account_ids patch replaces the link set; empty account_ids re-renders with error. * fix(goal_contributions/preview): rename templateNonZero -> templateNonzero so Stimulus matches the data attribute Stimulus converts the JS value name templateNonZero to a kebab-cased attribute by splitting on each capital letter, giving data-...-template-non-zero-value. Rails' dataset helper converts the Ruby key :goal_contribution_preview_template_nonzero_value to data-...-template-nonzero-value (no hyphen between non and zero). Result: the Stimulus controller resolved templateNonzeroValue to "" and the preview pane went blank as soon as the user typed an amount. Renaming the JS value to templateNonzero closes the conversion gap. Verified live via Playwright: at $500 the preview reads "Will bring you to 28% saved ($13,750 of $50,000)."; at $40,000 it flips to "Will reach your $50,000 target." * feat(goals/chart): y-axis labels + horizontal gridlines Chart had no value anchor on the y-axis; users had to read the target line label to know what amount the saved line represented. Add 3 right-aligned y-ticks ($0, $25K, $50K-style K/M shorthand) plus faint borderSubdued gridlines at the same y values. Left margin widens to 44 when room allows. Mobile (<320px chart inner-width) keeps the original tight 16px left margin and skips the y-axis entirely so the short-window readout stays uncluttered. Verified live: desktop reads $0/$20K/$40K + Target $50,000; 375px viewport drops the y-axis text + keeps target line + x-ticks only. * feat(goals/show): status-aware chart variants for empty + no-target-date Empty state (goal with zero contributions) was rendering a flat-at-$0 saved series and a flat-at-$0 projection that looked broken to anyone opening a freshly created goal. Now show.html.erb branches on @goal.goal_contributions.empty? and renders a piggy-bank + "Add a contribution" CTA card before the chart card. Brand-new goals get a clean inline call-to-action instead of a misleading line at zero. No-target-date goals (target_amount set, target_date null) used to render a standalone "Set a target date" prompt card and hide history entirely. Now they render the chart with the saved history + the target horizontal line (no projection segment, no projection legend item), plus a secondary "Set target date" callout below the chart linking into the edit modal. History is informative even without a deadline. Locale: new goals.show.empty.{heading,body,cta}. * feat(goals/chart): hover crosshair + dot + tooltip Chart had no way to read the value at a specific date — users had to infer Saved amounts from line position relative to the y-axis labels added in the previous commit. - Transparent <rect> overlay covers the plot area + catches pointer. - pointermove uses d3.bisector to snap to the nearest saved series point, draws a dashed crosshair + a saved-line dot + a projection-line dot (linearly interpolated between today and target). - HTML tooltip lives inside the chart root (cleared on next _draw) showing "date / Saved: $X / Projected: $Y". Clamps to viewport so it doesn't overflow the card. - pointerleave hides everything. Pointer events unify mouse + touch — single handler covers both desktop hover and mobile tap-and-drag. No keyboard nav yet; tracked as follow-up (Stimulus controller is the right home but won't ship in this round). * feat(goals/stepper+chart): Step 2 derived projection + JS i18n + Intl.NumberFormat B — Step 2 of the create stepper used to echo Step 1 fields back at the user in three labelled rows (Funding accounts: 2 · $123,456 balance; Suggested monthly: $1,003/mo over 12 months). Replaces those rows with a single derived sentence: "Save $1,003/mo across 2 accounts to hit it on time." If no target date is set: "Set a target date to project a finish line." The previous "Suggested monthly" + "Funding accounts" rows are dropped; review block shows only Name, "$12,000 by May 11 2027", and the derived insight sentence. L — All hard-coded English templates + currency symbols in the JS controllers go through Stimulus values now: - goal_stepper_controller: new {currency, summaryWithDate, summaryNoDate, accountCountOne, accountCountOther, suggestedWithDate, suggestedNoDate} values. Money formatted via Intl.NumberFormat(undefined, { style: "currency", currency: this.currencyValue, maximumFractionDigits: 0 }). - goal_projection_chart_controller: _fmtMoney upgraded to Intl.NumberFormat (was $/€/£ ternary fallback that lost JPY/INR/CHF/...). Locale: new goals.form_stepper.step2.review.{summary_*,account_count, suggested_*}. Old funding_accounts / suggested_monthly keys retained (unused by the new ERB) so any translator paths in flight don't break. Verified live via Playwright: step-2 review reads "Save $1,003/mo across 2 accounts to hit it on time." for a $12,000 / 12-month / 2- account goal. * feat(goals/new): standalone page render when not in a Turbo frame Direct nav to /goals/new used to render the index page with an empty modal frame because the entire template was wrapped in DS::Dialog. The URL was effectively un-shareable. Branch on turbo_frame_request? — Turbo Frame requests still render the DS::Dialog wrapper (the existing in-modal flow on the index page keeps working). Non-frame requests render a standalone page-level header (h1 + subtitle + icon) followed by the form_stepper partial. Same Stimulus controller, same data-goal-stepper-modal-subtitle selector, so the stepper's subtitle update path works identically. Controller sets @breadcrumbs so the standalone variant gets the Home > Goals > New goal trail. Verified both paths via Playwright: direct GET renders standalone form with h1 "New goal" + no dialog; click-from-index opens the DS::Dialog with the stepper inside. * fix(goals/chart): drop title-tooltip, step projection cursor, dot follows projection line, collision-aware y-ticks, clean tooltip Four chart fixes in one pass. 1) Browser was rendering the <title> child as a native hover tooltip that fought with the custom crosshair tooltip. Drop <title>; use aria-label on the <svg role="img"> instead — same SR accessible name, no native tooltip side-effect. 2/3) The hover crosshair clamped at today: bisector ran the saved series, which ends at today, so future hovers stuck the dot at the last saved point. Now the controller forks: - Past hover: snap to nearest contribution via bisector. - Future hover: snap to whole-week intervals along the projection segment ([today, target_date]) and place the dot at the interpolated y on the dashed line. Movement steps cleanly week by week instead of pixel-by-pixel jitter. 4) Tooltip drops the redundant line: - Past: "<date> · Saved: $X" (no Projected — there isn't one). - Future: "<date> · Projected: $X" (no Saved — it's the future). 5) Y-axis tick label suppressed when its value falls within 5% of the target line so "$2.5K" and "Target · $2,400" stop overlapping near the right edge. Gridline stays; only the y-axis label drops. Verified live via Playwright on House downpayment goal: <title> absent, aria-label populated, past tooltip "Feb 10, 2026 · Saved: $11,750", future tooltip "Nov 29, 2027 · Projected: $32,235", neighbouring future x snaps to "Dec 13, 2027 · $32,704" (2-week jump across the snapping boundary). * ux(goals): catch-up rework, dark-mode pill contrast, color disclosure, stepper continue-right - catch_up alert: title now leads with the new info (delta) and body states the required rate. Was "Save $1,000/mo to catch up" + "Currently $750/mo behind" — confusingly double-stated. Now "Behind by $750/mo" + "Save $1,000/mo to stay on track for {date}." Locale keys swap the %{amount}/%{delta} placement. - Goals::StatusPillComponent: each variant carries a theme-dark: text override so the dark-700 text doesn't disappear against the dark-mode tinted surface. Verified in dark mode: Paused pill text is now rgb(231,231,231) (gray-200) instead of rgb(54,54,54) (gray-700). Pre-existing token contrast fix tracked at we-promise/sure#1736 stays the long-term path; this is the local workaround that doesn't drop 4.5:1 in either theme. - New goals/_color_picker.html.erb partial: <details> disclosure with current-color preview in the summary + swatch grid in the popover. Mirrors the categories form's pen-icon-overlay pattern in spirit (collapsed by default; user clicks to expand). Both _form_edit and _form_stepper render the partial; the stepper's hidden color field is replaced by the visible disclosure. - Stepper footer: change `justify-between` to `flex items-center` plus `ml-auto` on the Continue wrapper. Continue now sits right-aligned in step 1 (where Back is hidden) and stays right in step 2 with Back taking the left edge. * ux(goals/show): catch-up alert anchors all three numbers + scoped scrollbar on contributions list Alert previous pass led with delta ("Behind by $750/mo") but the user still had to reconcile that with the $1,000/mo CTA — the relationship between current pace, gap, and required rate was implicit. Make every number visible in the sentence: - Title: "Save $1,000/mo to stay on track" — leads with the action + required rate. Reduces decision load: the headline is what to do. - Body: "You're saving $250/mo today — $750/mo short of the pace to finish by September 11, 2026." — current pace + gap + deadline. User can now mentally verify: $250 + $750 = $1,000. The catch-up amount in title + body + CTA is no longer disconnected from the current pace number; the body is the bridge. Adds `scrollbar` utility (defined in app/assets/tailwind/application.css as 4px gray-300 thumb) to the contributions list container. Browser- default scrollbar was rendering as a thick dark bar in light mode on some OSes; the in-house utility renders a thin gray thumb consistently across themes. * ux(goals): color picker uses Sure's inline-disclosure pattern; drop em-dash in catch-up body Found the actual Sure pattern in app/views/accounts/_form.html.erb:27-47 ("Additional details" section in the account-creation flow): <details class="group"> <summary class="cursor-pointer text-sm text-secondary hover:text-primary flex items-center gap-1 py-2"> <%= icon "chevron-right", class: "group-open:rotate-90 transition-transform" %> ... </summary> <div class="space-y-2 mt-2 pl-4 border-l border-primary">...</div> </details> It's an inline expand (no absolute popup), chevron rotates 90° on open, body indented with a vertical primary-color rule. My previous partial was an absolute-positioned popover lifted from categories/_form.html.erb — not what Sure uses for collapsible form sections. Rewrite _color_picker.html.erb to match: chevron + color-preview disc + "Color" label in the summary; swatches in an inline indented body. Catch-up body also drops the em-dash. Was: "You're saving $X/mo today — $Y/mo short of the pace to finish by $date." Now two sentences: "Your current pace is $X/mo. You need an extra $Y/mo to finish by $date." Two short clauses, no compound separator, each conveys a single number. Frames the gap as "extra" rather than "short", which behavioral-econ research suggests reads as more attainable. * ux(goals/show): catch-up CTA pre-fills + secondary "Adjust your target" link The "Add $1,531.25" CTA used to open the contribution modal with an empty amount field — label was a hint, not a default. Now passes the catch-up amount via ?amount= and the contributions controller seeds @contribution.amount from params. One click brings the user to the modal already populated. Adds a secondary text link below the primary CTA: "Or adjust your target" → opens the edit modal (Turbo frame). Behavioural-econ choice architecture: gives the rebaseline path explicitly so users who can't realistically catch up don't feel forced into the contribution. Trade-off: lets the alert respect autonomy — commit or recalibrate, both fine. Action paralysis kept low by visual hierarchy (primary button vs muted text link). * ux(goals/show): balance-sheet-style funding widget; drop redundant stat row Lower half of the goal detail used to be: (stat row: monthly pace + total contributions) + (bottom row: contributions list + funding breakdown card). Two of those four pieces were redundant: - Total Contributions stat duplicated the count badge that already sits beside the Contributions heading below. - Monthly Pace stat repeated the same numbers the catch-up alert surfaces above and the chart subtitle reads. Adopt the dashboard Balance Sheet pattern (app/views/pages/dashboard/_ balance_sheet.html.erb) for the funding widget: inline header with total ("Funding accounts · $13,250"), thin gap-separated segment bar, color-dot legend with percent, and a bg-container-inset table with the shared `pages/dashboard/group_weight` 5-stick weight indicator + value column. New show.html.erb bottom: just two full-width sections — funding widget, then chronological contributions list. Both rendered only when the goal has contributions (matches the empty-state branch added earlier). Locale: goals.show.funding_table.{name, weight, value}. * feat(goals): extract shared color_icon_picker controller; add icon to goals; tinted avatar User requested replacing the in-house color disclosure with the categories color+icon popover. Done as a controller extraction so categories and goals share one Stimulus controller (user's option: "Extract a shared color_icon_picker_controller.js"). - `git mv` app/javascript/controllers/category_controller.js to color_icon_picker_controller.js. Categories form + color_avatar partial updated to use the new identifier (data-controller= "color-icon-picker", target/action selectors renamed). - Goal model gains an icon column (migration 20260511190000_add_icon_to_goals.rb) + ICONS = Category.icon_codes + inclusion validation. GoalsController permits :icon in goal_params + goal_update_params. - Goals::AvatarComponent now renders icon when present (falls back to first-letter initial), and adopts the Categories tinted-bg + colored -content style (bg = `color-mix(in oklab, COLOR 10%, transparent)`, text/icon = COLOR). Matches the picker's live preview so what the user sees during selection equals the saved state. - New goals/_color_picker.html.erb mirrors categories/_form's popover: avatar + pen overlay summary + popup with color row (+ rainbow custom-hex trigger) + icon grid. Pickr / contrast validation / auto- adjust all inherited from the shared controller. - Stepper step 1 layout: drop the inline letter-avatar (data-goal- stepper-target="avatarPreview") in favour of the picker avatar next to the name input. Step 1's tail no longer renders a separate color partial. Edit form passes icons local through. Verified live: new goal modal renders 11 color radios (10 presets + custom) + 141 icon radios + pen-summary; categories form still operational (no console errors) under the renamed controller. * chore: drop session-artefact audit-shots + audit markdown from branch These local-only audit screenshots + the report draft were staged inadvertently in the previous commit. They belong to the development session, not the feature branch. * ux(goals): picker stacked above name field (stepper + edit) Previously sat next to the name input via `flex items-start gap-3` so the picker avatar competed with the input for horizontal space. Move to its own row, centered (`flex justify-center`), positioned just before the name field. Mirrors the categories form layout where the avatar is the focal element above the name input. Same change applied to the edit form: picker comes first, then name. Stepper step 1 order is now: heading · picker · name · amount/date · funding accounts · notes. * fix(goals): theme-aware avatar text contrast; compact picker popup Avatar letter/icon now uses `--avatar-color` CSS variable + the new `.goal-avatar` class. Light mode darkens the text to 55% color + 45% black so pale palette entries (cyan-300, green-300) stay readable on the 10%-mix tint over white (~4.5:1). Dark mode reverts to the full brand color via [data-theme="dark"] .goal-avatar override so the text doesn't disappear against the near-black tinted surface. Verified live: #805dee renders as a darker oklab in light mode and full rgb(128,93,238) in dark mode. Picker popup compacted: - 80 (320px) wide, max-h-[60vh] overflow-y-auto so it never spills off-screen. - Anchored below the avatar + horizontally centered to it (top-full left-1/2 -translate-x-1/2) so it doesn't drift off to the right edge of the form on narrow modals. - Icon grid max-h-40 (160px, ~5 rows) with the in-house `scrollbar` utility for a thin gray thumb that works in both themes. - Section headers (Color / Icon) styled `uppercase tracking-wide` for visual hierarchy. Verified popup at 320x310px in edit modal, no vertical overflow. * fix(goals/avatar): icon helper clash crashed show after saving an icon Goals::AvatarComponent had `attr_reader :icon` which shadowed the global `icon` view helper. Template called `icon(icon, size:, color:)` which Ruby resolved against the attr-reader (zero-arity), throwing "wrong number of arguments (given 2, expected 0)" the moment a goal had a saved icon and the show page tried to render its avatar. - Drop `:icon` from attr_reader; expose as `icon_name` instead. - Template uses `helpers.icon(icon_name, ...)` matching the Goals::StatusPillComponent pattern (other Goals VCs already use `helpers.icon`). Reproduced + verified live via Playwright: edit modal → pick an icon → save → show page renders the new avatar with the SVG. Same for create flow (new modal → pick icon → step 2 → submit → show renders). * fix(goals/chart): suppress projection-end label when it collides with target Issue: an on-track goal whose projected end is just above the target showed two right-anchored labels stacked on top of each other — "Target · $2,400" and the projection-end short value "$2.4K". The projection dot already conveys "you'll hit the target on time"; the extra label adds noise. Now: when willHit AND |projDotY - y(targetAmount)| < 18px, skip the projection-end label entirely. The colored dot at the target_date keeps the visual cue. Also refactor the y-axis label collision check from value-based (within 5% of yMax) to pixel-based (within 18px of target's y), matching the projection-end logic. When a y-tick is close to target, the Target label drops into the y-axis column at that row (short format) instead of right-edge full format. Either way, no two labels ever stack within 18 vertical px. Verified live: Wedding fund (on_track, projection ≈ target) → just "Target · $2,400" + y-ticks, no "$2.4K". House downpayment (behind) → "Target · $50,000" + "Short $12.3K" both retained (well separated). * fix(goals/chart): redraw on turbo:render so the chart survives morph navigation Repro: index -> goal show (chart drawn) -> open edit modal in turbo frame -> pick a new icon -> submit. Server responds with turbo_stream.action(:redirect, goal_path). Turbo morphs the show page, wiping the chart container's children, but Stimulus' connect() isn't re-run on the morphed element so _draw never fires again. The ResizeObserver doesn't help — the container's box dimensions are unchanged. Listen for turbo:render and turbo:frame-load on document and re-draw when the container's SVG is missing. Cheap idempotent check (querySelector('svg')) — no-op if the chart is already there. Listeners cleaned up in disconnect(). Verified: same flow now lands on the show page with the chart fully rendered (23 SVG children). * docs(goals): add architecture decision discussion note Captures the open question on the data model behind Goals (account-linked vs free-form ledger vs tag-based) for community review before PR #1757 merges. * docs(goals): split architecture note into user-facing + mechanics The user-facing note focuses on how a Goal's balance gets computed and what changes for the user. The mechanics doc covers the schema, pro-rata math, pace window, and the operational details engineers need but most readers don't. * docs(goals): final architecture cut after 5-iteration expert review User-facing doc and mechanics companion converged on an account-linked model with a pledge layer. Surfaces the pledge-with-7-day-match mechanic, proportional-to-remaining-need split default, "Reserved beyond balance" framing, in-chart pending segment, two-clock rate limit, archive-in-place account handling, months-of-runway for open-ended goals, and the pre-launch user tests + day-one pledge instrumentation. * docs(goals): expand matrix coverage + ground mechanics in current code User-facing doc gains explicit 1xM (one goal, multiple accounts), N goals on shared accounts, and overlap (NxM) sections, plus the reallocation flow and "why is this goal behind?" diagnostic. Mechanics doc is rewritten against the actual code on the branch: file:line citations for current state, accurate corrections to the prior draft (Sure uses Account AASM status not archived_at, no Account#balance_at method, balance history via Balance::ChartSeriesBuilder CTE, Transaction::TRANSFER_KINDS for pace exclusion, advisory-lock pattern lifted from IdentifyRecurringTransactionsJob, partial-unique index precedent from entries[external_id, source]), concrete migration plan with seven steps, surface-by-surface STAY/CHANGE/DELETE verdict on every component, view, and Stimulus controller, day-one instrumentation events, and four pre-launch user tests. * feat(goals): v2 architecture — drop ledger, derive balance, add pledge Reshape the goals feature to live on top of linked-account balances. A goal's balance is now the live balance of every depository account linked to it — no parallel ledger, no "log a contribution" step. The "Add contribution" affordance is replaced by a 7-day GoalPledge (kind: transfer | manual_save). GoalPledge::Reconciler matches incoming Transactions (via Account::ProviderImportAdapter) and Valuations (via Account::ReconciliationManager) against open pledges within ±5 days, ±$0.50, or ±1% — single hook covers every provider (Plaid, SimpleFIN, Lunchflow, Enable Banking, Brex, IBKR, Kraken, SnapTrade) plus manual balance edits. A 15-minute Sidekiq cron sweeps expired pledges. Goal model: balance derived from linked_accounts.sum(&:balance), new pace (90-day net non-transfer inflow), months_of_runway, last_matched_pledge_*, pledge_action_label_key (the "I just transferred…" vs "I just saved…" verb switch). UI: - Index gets a 3-card KPI strip (Contributed last 30d / Needs this month / On track) plus a pending-pledges callout. - Show page swaps the "Add contribution" CTA for the pledge modal, replaces the contribution list with a pending-pledge banner, and rebuilds the funding widget into per-account rows with a 12-bucket weekly sparkline and last-30 inflow. - Projection chart adds a required-line (dashed light from today → target) and a translucent pending-pledge bump at today's X. Schema (3 migrations): 1. goal_pledges table with PG enums (goal_pledge_kind, goal_pledge_status), open-by-expiry index, and unique-when-not-null matched_transaction_id. 2. Drop goal_contributions. 3. Partial unique index on transactions ((extra -> 'goal' ->> 'pledge_id')) built CONCURRENTLY so it doesn't block prod. After pulling: run bin/rails db:migrate, then commit the schema.rb sync separately (or let CI regenerate). Deferred to v1.1: allocation columns, contention/archived banners, "why is this behind?" diagnostic, reallocate flow, refresh-sync + Plaid throttle, unallocated-cash chip, joint-account approval, goal_activities log, polymorphic matched_entry_id/type for manual pledge audit. * fix(goals): CI green — schema, brakeman, pledge modal, error class Regenerate schema.rb after the three v2 migrations so CI's db:schema:load picks up goal_pledges, the dropped goal_contributions, and the partial unique pledge_id index. Brakeman: - Drop :account_id and :kind from goal_pledge permit; look the account up via @goal.linked_accounts.find_by(id:) instead and set kind server-side from goal.any_connected_account?. - Rename goals.show.projection.on_track to .on_track_html so I18n marks the result html_safe automatically; drop the unconditional .html_safe call in show.html.erb. Pledge modal: rewrite app/views/goal_pledges/new.html.erb to use DS::Dialog (the Sure convention for create modals — matches categories/transfers). Error handling: replace `raise ActiveRecord::RecordInvalid, "string"` in GoalPledge#extend!/cancel! with a dedicated GoalPledge::NotOpenError; the controller rescues that specifically. Tests: rewrite the "pace is zero" test to create a fresh account with no entries (the fixture's depository accounts carry transaction history that produces a non-zero pace). All goal tests now green (73 runs, 157 assertions, 0 failures). * fix(goals/pledge): drop find_each-incompatible order in reconciler The explicit .order(created_at: :asc).find_each emitted an AR warning that broke the strict logger mock in BrexEntry::ProcessorTest. find_each forces its own primary-key order anyway. * ux(goals/index): restore prior-30d comparison + multi-part on-track subtitle The v2 rewrite dropped the velocity_delta_percent / velocity_direction keys that powered the 'Contributed last 30d' card's '↑ 27.2% vs. prior 30d' line and the 'Goals on track' multi-part subtitle ('1 behind · 1 paused'). Restore both, sourcing velocity from Family#savings_inflow_velocity with explicit current-window and prior-window ranges. * fix(goals): pledge lifecycle + connected-account detection Behavioural fixes touching Goal, GoalPledge, the reconciler and the goals controller. No schema change. B5 — connected-account detection covered only Plaid. SimpleFIN, Brex, Enable Banking, IBKR, Kraken, SnapTrade and Lunchflow users got "manual_save" pledges by default; their auto-synced Transactions then failed to match (reconciler matches Transactions to "transfer" pledges only). Pledges sat in the yellow banner until expiry. Switch the detection to !Account#manual?, which mirrors the existing `Account.manual` scope (no account_providers, no plaid_account_id, no simplefin_account_id). Add `Account#manual?` so the per-instance and per-query checks can't drift. B7 — `extend!` widens `expires_at` but `matches?` was anchored on `created_at ± 5d`, so an extension that pushed the expiry past day 5 didn't actually buy any match runway. Widen the upper bound to `max(created_at + 5d, expires_at)`. The lower bound stays at `created_at − 5d`. B8 — `Goal#open_pledges` returned `status: open` regardless of expiry. Between a pledge timing out (day 7) and the 15-min sweep job marking it `expired`, the show page rendered a ghost yellow banner with "0 days left" that the reconciler would no longer touch. Add `expires_at >= NOW` to the scope so the visible state matches the match-eligible state. B9 — Double-click on Record pledge produced two identical open pledges, which then stacked as two yellow banners. Add a create-time validation rejecting duplicates against (goal_id, account_id, amount, status=open, expires_at >= NOW). B10 — The reconciler used `transaction.with_lock` but didn't lock the pledge. Two concurrent reconcile attempts on different transactions could both target the same pledge; one would lose to the partial unique index on `transactions.extra->'goal'->>'pledge_id'` and the RecordNotUnique was caught by the outer StandardError rescue, which silently dropped the other transaction's match attempt entirely. Lock the pledge first, re-check `status_open?` inside the lock, and catch RecordNotUnique alongside RecordInvalid/NotOpenError in the reconciler — so on a lost race we fall through to the next candidate pledge instead of exiting the loop. Extract the Valuation-match path to `GoalPledge#resolve_with_valuation!` so it goes through the same locked status-recheck. B12 — When a goal is destroyed, `dependent: :destroy` reaped pledges but left `transactions.extra["goal"]["pledge_id"]` pointing at the now-deleted UUIDs. The partial unique index on that JSON path then indexed stale references. Add a `before_destroy` on GoalPledge that clears the matching transaction's `extra` if it still points back to the pledge. B6 — `last_matched_pledge_at` used `goal_pledges.maximum(:updated_at)` on matched rows. Any backfill or sync-resync that touches a matched pledge bumped `updated_at`, so a single resync set every goal's "Last saved N days ago" header back to "today". Switch to the entry's `date` via a join through `matched_transaction_id`, which reflects the date the money actually moved. B22 — `scope :chronological` ordered DESC, the opposite of what the name promises. Rename to `:reverse_chronological` and update the one caller in `goals#show`. (Other models' `chronological` scopes are unrelated and ordered correctly.) Also: preload `account_providers` on `linked_accounts` in the index and show controllers so `Account#manual?` walks the in-memory collection instead of triggering N queries. Tests: add fixture-backed coverage for extend-widens-match-window, post-extend rejection beyond expiry, and the duplicate-pledge validation. Existing assertions still hold against the new `matches?` window math. * fix(goals): pace counts transfers, family rollup currency-scoped Two semantic shifts in V2 that drove the worst on-screen confusion. B3/B4 — `Goal#pace` excluded `Transaction::TRANSFER_KINDS`. When a user tapped "I just transferred…" and the deposit landed, the linked account's balance went up but pace did not: pace ignored transfer- kind entries, so the goal stayed `:behind` against `monthly_target` and the catch-up callout kept demanding $X/mo even though the user had just moved the money in. Same root cause hit any long-time saver whose 90-day net was zero — pace=0, status=:behind, projection says "At $0.00/mo you'll miss your target date" while the ring sits at 80%. Drop the transfer-kind exclusion. Pace is now net inflow into linked accounts over 90 days. Transfers between linked accounts already net out (both legs land inside the same account set); transfers from outside (checking → linked savings) net positive, which is exactly the case the pledge flow records. B19 — `Family#savings_inflow_velocity` summed entry amounts across every depository account linked to any goal regardless of currency, then rendered the result in the family's primary currency. A family with one USD goal and one EUR goal saw `usd_inflow + eur_inflow` reported as USD with no FX conversion. Scope the account set to the family's primary currency until proper FX-conversion lands. Also let the result go negative (net outflow) — clamping to ≥0 lost signal; the controller decides how to render the sign. V20 (controller) — `velocity_30d_sign` was wired off the *delta* direction, so a $1,234 down-month rendered as "−$1,234 ↓ 27% vs prior 30d". The minus read as a loss but $1,234 was the (positive) contribution. Re-wire the headline sign off the headline value itself; the delta-direction stays on the subline as ↑/↓ N%. With the family-rollup change above, the headline can now legitimately be negative — UI now says "−$200 ↓ 50% vs prior 30d" when the family had net outflow. B21 — KPI tile `on_track_count` lumped `:reached` goals into "on track", inflating the numerator while the sort order placed reached goals at the bottom of the list. Split `reached_count` out and render it as its own segment in the on-track subline ("1 reached · 1 behind · 1 paused"). Test: rename the pace=zero test to match its new premise (no transactions vs. no non-transfer entries). The fixture still has no entries, so the assertion holds. * fix(goals/ds): replace hand-rolled yellow banners with DS::Alert The pending-pledge banner on goals#show and the pending-pledge callout on goals#index were inlined yellow divs: bg-yellow-50 dark:bg-yellow-950/30 border-yellow-200 \ dark:border-yellow-800 Raw color tokens violate the "functional tokens only" rule in CLAUDE.md ("`text-primary` not `text-white`, `bg-container` not `bg-white`"), drift from the DS warning palette (`bg-warning/10` + `border-warning/20`), and miss accessibility plumbing (aria role, sr-only variant label) that DS::Alert provides for free. Swap both surfaces for `DS::Alert.new(variant: "warning", live: :polite)`: - Index callout: a one-line message variant (no title). - Show banner: title + body + footer with DS::Button (outline Extend, ghost Cancel). Cancel button gets a CustomConfirm dialog — the V2 affordance destroyed the pledge on a single click with no second-chance prompt; one accidental click and the user lost the record. The Extend / Cancel buttons drop the hand-built `text-xs px-2.5 py-1 rounded-md shadow-border-xs bg-container` styling, picking up DS::Button's `outline` / `ghost` variants and `size: "sm"` instead. Locale: tighten the title from "Pending: $200 into Savings" + separate body line "… $0.50 or ±1%) · 6 days left." to "Watching for $200 into Savings · 6 days left" with a short body ("Auto-confirms when Sure spots a matching deposit on the next sync"). The old copy was ~130 chars and wrapped 2-3 lines inside the banner flexbox, pushing the catch-up callout below the fold on common viewports. Drop the hardcoded "$0.50" from the body (currency-aware copy lands in Commit I). Add `confirm_cancel_{title,body,cta}` strings for the CustomConfirm dialog. * fix(goals/funding-widget): restore DS-aligned per-account breakdown V2 rebuilt the funding widget around per-account rows + a custom SVG sparkline, but cut visible signal and DS adherence in the process. This rebuild restores the V1 affordances and folds in the V2 sparkline as an enhancement. - Heading regression: `text-lg font-medium` (with total in `text-lg`) → `text-sm font-medium` (total inheriting `text-sm`). The section heading collapsed to body-copy size and no longer matched the Projection heading beside it. Restore both to `text-lg`. - Avatar regression: V2 hand-rolled `w-10 h-10 rounded-full … style="color: white"`. That box (40px) matches no `Goals::AvatarComponent` size (sm=24px, md=36px, lg=44px), uses `rounded-full` where the DS uses `rounded-md/lg/xl/2xl`, and hardcodes white text instead of the `text-inverse` token. Render `Goals::AvatarComponent` directly at `size: "sm"`. - Privacy regression: `row[:balance_money]` subline ("Depository · $3,000") wasn't wrapped in `privacy-sensitive`. Blur mode no longer hid the balance, while heading total and last-30d value on the same row both had the class. Add `privacy-sensitive` to the subline. - Untranslated leak: `<%= account.accountable_type %>` printed the raw "Depository" / "Investment" / "Crypto" class string with no i18n. Add `accountable_label(account)` on the component that prefers the depository subtype ("Savings", "HSA"…) via `goals.form_stepper.step1.subtypes.*`, falling back through `accounts.types.*` and finally a `titleize`. - Lost weight signal: V1 had a stacked distribution bar across the top, colored legend dots, and a 5-bar weight pill per row. Users could see "Account A contributes 60% of balance" at a glance. V2 deleted all three. Restore the distribution bar + legend + the existing `pages/dashboard/group_weight` partial in a `weight` column (skipped when only one account is linked). - Lost container framing: V1 wrapped rows in `bg-container-inset rounded-xl p-1` with `shared/ruler` dividers between rows. V2 used `space-y-3` with no container and no dividers, leaving rows floating. Restore both. - Empty state regression: V2's fallback rendered the section heading as a body paragraph (`<p>Funding accounts</p>`) inside a `p-5 rounded-xl` card — looked like an unfinished widget. Replace with a real empty state via `goals.show.funding_accounts. empty.heading` + `body` ("Edit the goal to link the depository accounts you save into."). - Row order: V2 sorted by 30-day inflow (which can flatten to ties at $0 across rows). Sort by balance instead — the column the user is comparing against anyway. - Pace alignment: drop the transfer-kind exclusion from the component's `last_30_inflow_for` and `sparkline_for` so the widget reads the same flow as `Goal#pace` (commit B). Internal transfers between linked accounts net out per-account here too, external transfers count as inflow on the receiving account. The 12-bucket sparkline still runs 12 queries per account; that N+1 lands in a follow-up commit alongside the component-level query collapse. * fix(goals/pledge-modal): use StyledFormBuilder + restore live preview V2 rebuilt the pledge create modal but bypassed the DS form helpers inherited from `StyledFormBuilder`, lost the inline impact preview from V1's contribution form, and shipped a goal-level "transfer vs manual_save" toggle that broke on mixed-funding goals. - Manual `form-field/__body/__label/__input` div-wrapping for the account select → idiomatic `f.select :account_id, choices, { label: t(".account_label") }`. The builder applies the required marker, error state, and inline-label handling automatically; the hand-built version drifted from that path and applied `form-field__input` directly onto the select element, where the builder picks the correct input class per field type. - Hand-rolled `<div class="form-error">` + `<p>` loop for errors → `render "shared/form_errors", model: @pledge` (the shared partial with the destructive-icon prefix). Matches V1's contribution modal and the rest of the codebase. - Drop `class: "btn btn--primary"` on `f.submit` → bare `f.submit t(".submit")`. The builder's `submit` is wired to `DS::Button.new(text:, full_width: true)`; the explicit class was redundant. - Drop the duplicate "Cancel" button. DS::Dialog already renders an X in the header; the in-form ghost Cancel was a second close affordance with no analogue in the new-goal stepper or V1's contribution form. - Drop `data: { turbo_frame: "_top" }` on submit. Success already flows through the controller's `turbo_stream.action(:redirect, …)` and on 422 the modal frame is the right swap target; the explicit `_top` was at best redundant and at worst a future Turbo footgun. - Wire `data-controller="goal-pledge-preview"` on the form and add an inline preview `<p>` below the amount field. As the user types the amount, the line updates to "Reaches 75% — $3,750 of $5,000." or "Hits your $5,000 target — goal reached." Mirrors V1's contribution preview that V2 dropped on the floor. - Rename `goal_contribution_preview_controller.js` → `goal_pledge_preview_controller.js`. Pure rename; the controller was already domain-neutral. - Per-account pledge kind. The controller's `default_kind_for(goal)` picked `transfer` whenever the goal had ANY connected account — meaning a goal that linked a Plaid checking account AND a manual cash envelope routed every pledge as `transfer`, including those the user submitted against the manual account. The reconciler would then watch for a Transaction that never arrives. Replace with `kind_for_account(account)` that picks per-account: manual → `manual_save`, anything else → `transfer`. - `new` action now respects `?account_id=…` query params and preselects that account (helpful for the catch-up callout's inline "Save $X/mo" CTA, which can target a specific account). Locale: drop the hardcoded "(±5 days, ±$0.50 or ±1%)" tolerance copy from the helper text — that detail belongs in docs, not in a modal that fires on every pledge create. Currency-aware copy lands in commit I. Drop the now-unused `cancel:` key. Add the three preview templates (`preview_zero`, `preview_nonzero`, `preview_reached`) consumed by the Stimulus controller. * refactor(goals/show): move projection_summary + catch_up_delta to model The show template carried a 17-line `if/elsif` chain computing `projection_summary` inline, plus a `Money.new([…, 0].max, …)` expression building the catch-up delta on the fly. CLAUDE.md's "skinny controllers, fat models" convention pushes both onto Goal. - `Goal#projection_summary`: returns the localized, `html_safe`-aware string for the chart subtitle and the chart's `aria-description`. Memoized so the two callsites in show.html.erb share one computation. - `Goal#catch_up_delta_money`: clamped-at-zero monthly delta between pace and the required monthly target. Used by the catch-up callout body. Previously the view computed `Money.new([req - pace, 0].max, currency)` — same math, but duplicated inline. show.html.erb drops both blocks and reads `@goal.projection_summary` / `@goal.catch_up_delta_money` directly. Also: V15 — the celebration card used `bg-green-500/10` directly. Swap to `bg-success/10` (DS semantic token, same Tailwind-4 alpha syntax DS::Alert already uses) so the celebration palette tracks the rest of the success surface. * perf(goals/funding-widget): collapse N+1 sparkline + last-30 queries V2's funding widget ran (12 + 1) queries per linked account on the goals#show render: - one `last_30_inflow_for(account)` summed over a 30-day range, - twelve separate `sparkline_for(account)` sums, one per 8-day bucket inside a 90-day window. For 3 linked accounts, that's 39 SQL queries from this component alone before the projection chart's Balance::ChartSeriesBuilder runs. Replace with two grouped queries that scan once across all linked accounts: - `last_30_inflow_map`: a `GROUP BY account_id` over the 30-day window, returning a hash `{ account_id => clamped_inflow }`. One query, no matter how many accounts are linked. - `sparkline_map`: a `GROUP BY account_id, LEAST(GREATEST((CURRENT_DATE - entries.date) / bucket_days, 0), 11)` over the 90-day window. One query covers every account × every bucket. Each per-account array is filled in oldest → newest order so the SVG path reads left → right naturally. Net query count for the funding widget drops from 13 × N to 2. Both helpers fall through to safe defaults (`0`, all-zeros array) on missing keys so the row loop stays branch-free. * chore(goals): drop dead V1 hooks + surface chart errors Loose ends from the V1 → V2 refactor that the architecture commit didn't sweep. - Demo generator (B14): the `goal_spec[:contributions]` arrays + the `wedding_contribs` / `house_contribs` builders still shipped in the file, but the seeding loop that consumed them was deleted alongside `GoalContribution`. Dead data. Strip both the per-goal arrays and the two locals. Goal balance/pace in the demo family now derives from the linked depository accounts' own seeded entries elsewhere in the generator. - Goal stepper controller (B16): the `static targets` declaration still listed `initialContributionAmount` and `initialContributionAccountSelect`, and `refreshAccountSelect` + its two callsites still ran every time a linked-account checkbox flipped. The HTML targets disappeared with the V2 stepper rebuild, so `has*Target` guards short-circuited and the method was a no-op — but it was still dispatched on every change. Drop the targets, the method, and the two callsites. - Chart series rescue (B25): `Goal#balance_series_values` and `FundingAccountsBreakdownComponent#sparkline_map` both swallowed `StandardError` with a `Rails.logger.warn(…)`. The chart then degraded to "target line only" silently. Promote the log to `error` level and forward to Sentry when present (matching the pattern in `Account::Syncer`, `Sync`, `PlaidItem`). Fallback to empty result still preserved so the surface degrades instead of 500-ing. * fix(goals): header CTA + projection-chart required-line color V6 — three "Record pledge" affordances on goals#show (header, empty state, catch-up callout) all rendered as `t(@goal.pledge_action_ label_key)` + `icon: "arrow-up-right"`. That dropped the user into a button labelled "I just transferred…" or "I just saved…" with a trailing ellipsis — past-tense as a CTA reads as a status declaration, the ellipsis suggests an unresolved action, and `arrow-up-right` is the icon Sure reserves elsewhere for external-link affordances. Switch the on-page CTA to a single new locale key, `goals.show.record_pledge_cta: "Record pledge"`, with `icon: "plus"` matching the other "new resource" buttons across the app (new goal, new account, new rule). The modal title keeps using `pledge_action_label_key`, so the past-tense "I just transferred…" framing still anchors the dialog's confirm step. V8 — the projection chart's "required" dashed line was hardcoded to `var(--color-green-600)`. When the goal status is `:on_track` the projection line is also green-dashed, and the two stroked the same hue and dash pattern — they overlapped visually. Re-stroke the required line in `textSecondary` (the chart's neutral foreground) so it reads as a reference path independent of status. * fix(goals/show): add Required line to projection legend The dashed neutral line for "the rate needed to hit the target by the target date" was rendered on the chart but absent from the legend. Adds a third legend chip ("Required") that renders only when the line itself renders — i.e. when target_date is set, monthly_target_amount is positive, and there's still ground to cover (remaining_amount > 0). Stroke matches the JS: `text-secondary` currentColor, dasharray 2/4, 0.5 opacity. * fix(goals/funding-widget): switch sparkline to bars + shared scale The shared-scale fix alone wasn't enough — a single outlier bucket on one account compressed every other row to invisibility, and the interpolated line between sparse non-zero buckets painted fake "event triangles" between actual data points. Switch from a stroked path to per-bucket bars: - 12 rects per row, x = `i * 8 + 1`, width 6, 2px gap between. - Bar height = `(value / shared_max) * 24`, floored at 1 unit so a non-zero bucket is always visible even when an outlier elsewhere dominates the scale. - Empty buckets render nothing — no fake baseline, no interpolated trough. - Bars grounded at `y = 28` (bottom of viewBox), so "zero" is implicit and the eye reads upward from a stable floor. - Shared `spark_max` across every account's bars (the component method introduced for the line version stays — that part of the diagnosis was right, it just needed a chart type that handled the scale honestly). Net read: the column-chart-on-each-row layout matches "12 weeks of deposits into this account" much more directly than a sparkline ever did, and outlier-vs-modest-but-steady contributions are both legible at a glance. * fix(goals/pledge-modal): helper text reacts to selected account The helper paragraph above the amount field was painted off `@goal.any_connected_account?` — a goal-level decision that fires once at modal render and never updates. On a mixed-funding goal (one connected + one manual account linked), the helper read the "transfer" copy regardless of which account the user picked from the dropdown, even though the saved pledge's `kind` is decided per-account by `kind_for_account` in the controller. Stale UI vs. correct data. Render both helper paragraphs hidden, then toggle the right one visible via Stimulus on `change->goal-pledge-preview#accountChanged`. The select renders its `<option>` tags with `data-manual="true|false"` from `Account#manual?`; the controller reads that attribute off the currently-selected option and flips `hidden` on the two helper targets. `connect()` also calls `accountChanged()` so the initial paint matches the preselected account from `?account_id=…` (the catch-up callout's amount-specific deep link). Switch from `options_from_collection_for_select` to `options_for_select` with the `[label, value, { data: { manual: } }]` 3-tuple form — Rails supports per-option data attributes there but not on the collection helper. * fix(goals/funding-widget): per-account balance trajectory area chart Bars communicated "events," not "where the account level sits." A sparse-deposit account painted three thin bars at the bottom and looked dead. An account with a single big deposit dominated every other row's scale. Swap to the same visual language as the projection chart on goals#show — filled area below a stroked line — but one chart per linked account, rendering that account's actual balance trajectory over the last 90 days. Mechanics: - New `trajectory_map` on the component pulls every `balances` row for every linked account in one query (`Balance.where(account_id: account_ids, date: 90d..today)`). Result is grouped per account and resampled to 24 points by a single-pass forward walk that carry-forwards the most-recent balance at-or-before each anchor date. O(rows + samples), not O(rows × samples). - Per-row Y-scale: baseline 0 (when the account has ever held a positive balance), ceiling = max balance × 1.05. The chart reads as "how full was this account over time" rather than "how dramatic is the shape." Flat-at-$5k accounts paint near the top; growing $200 → $500 accounts climb from 40% to top. - Filled area at `opacity: 0.18` in the account color + stroked line at full opacity on top — same treatment as the projection chart's saved series. - Grid track for the chart column widened from `minmax(60px, 1fr)` to `minmax(80px, 1fr)` so the curve has enough horizontal room to read. Removed `shared_spark_max` + `sparkline_map` + the bucketed inflow sparkline machinery. Per-row scale is correct here — magnitude already lives in the weight pill on the left and the "$X last 30d" column on the right; the chart's job is shape. * fix(goals/funding-widget): chart shows cumulative inflow, not balance level Balance trajectory rendered every account as "near the top with a gentle wobble" — pink ($1830/30d), orange ($0/30d), blue ($300/30d) all looked nearly identical because each was a positive balance with mild growth, and per-row 0-baseline scaling pushed all lines toward the ceiling. The chart and the "$X last 30d" column on the right were telling completely different stories on the same row. Switch the metric the chart plots: - Data: 31 daily samples (today − 30 … today) of *cumulative inflow* per account, fetched in one `GROUP BY (account_id, date)` over the 30-day window. Each per-account array is a monotonic non-decreasing prefix sum starting at 0. - Scale: per-row, anchored at 0, ceiling = `max(values) × 1.05`. - The chart's rightmost point now equals the "$X last 30d" column value by construction — chart and column tell the same story. - `last_30_money` is read off the cumulative array's last element, no separate aggregation query. Visual shapes after the swap: - Steady-inflow account → smooth diagonal climb - Bumpy/episodic account → step pattern with flat plateaus - No-inflow account → flat line at the bottom, no filled area Removed `balances` query path entirely; trajectory_for is gone. * fix(goals/funding-widget): non-scaling-stroke for trajectory line `preserveAspectRatio="none"` stretched the viewBox's 100×28 to the container's natural width (≈600px) while leaving the Y axis at 1×. With anisotropic scaling, SVG strokes inherit the path's local scale — horizontal segments rendered ~6px wide, vertical segments ~1.5px wide, diagonals in between. The line read as visibly fatter on the flat top run than on the climbing/dropping segments. Add `vector-effect="non-scaling-stroke"` to the line path so the stroke width stays a constant 1.5 CSS px regardless of how the viewBox is scaled. Filled area is unaffected (no stroke). * fix(goals/funding-widget): replace chart with last 30d + last 90d totals The cumulative-inflow chart kept producing readings that didn't match user mental models — chart endpoint = 90-day cumulative, right-hand column = 30-day total, and the visual line didn't carry the "this is per-week deposit activity" intuition that a sparkline implies. After iterating through bars, balance trajectory, and filled-area cumulative, simplest is best. Drop the chart. Each row now shows two right-aligned totals stacked vertically: - Primary line: "$X last 30d" — text-sm, text-primary, the "this month so far" headline answer. - Secondary line: "$Y last 90d" — text-xs, text-secondary, the quarterly-trend reference. Tells the user whether this account contributes regularly without forcing them to read a chart. Both numbers compute in one query — pluck (account_id, date, amount) over 90 days, sum per account into two buckets based on whether the entry's date falls inside the 30-day cutoff. Grid shrinks from 5 columns (avatar / name / weight / chart / total) to 4 (avatar / name / weight / two-totals), with the two-totals column getting 120px so both numbers fit right-aligned with their labels. Drop `funding_accounts_subtitle` and the chart-window plumbing (`TRAJECTORY_SAMPLES`, `cumulative_inflow_map`, `column_total_from`, SVG markup, `vector-effect`, etc.). * fix(goals/show): strip redundancy + sharpen catch-up framing The show page repeated the same data multiple times across surfaces that should each say one thing once. Per-screen counts before this commit: - Account % distribution: 4 places (distribution bar + dot-legend strip + 5-bar weight pill + % column) - Current balance: 3 places (ring, funding heading total, ring "of $X" subline) - Target amount: 3 places (header, ring subline, catch-up body) - Target date: 3 places (header, catch-up body, chart axis) - Pace: 2 places (catch-up body, projection subtitle) - ".00" cents: every monetary string This pass: - Funding widget drops the dot-legend strip (color/name/% triplet redundant with the distribution bar's color + the per-row avatar color) and the 5-bar weight pill (rendered as "1-of-5 sliver" for low-weight accounts — read as a glitch; the % number next to it covered the same fact). Row grid shrinks from 5 to 4 columns. - Funding section heading drops `· $187,031` — the ring card already carries the total balance. - Catch-up alert reframes: Title was "Save $26,621/mo to stay on track" (the *full* required rate, with the misleading "stay on track" while the pill says "Behind"). Now "Save $20,002/mo more to catch up" using `catch_up_delta_money` — the user's actual delta over current pace. Body collapsed from two with-date / no-date variants to a single "Current pace $X/mo · required $Y/mo to hit your target." Drops the target date duplication since the header already says it. Pledge CTA pre-fills with the *delta*, not the full required — so accepting it once funds the gap instead of stacking the full required rate on top of existing pace. Secondary link "Or adjust your target" → "Adjust target instead" (less defeatist framing). - Projection chart subtitle "At $X/mo you'll miss your target date." drops the pace duplication (catch-up above already states pace). New: "Falling short at current pace." Diagnostic only. - All money on the show page uses `format(precision: 0)`. The ".00" cents added no information at goal-tracking scale. - Header `Record pledge` demotes to `outline` variant when status is `:behind` — the catch-up alert below owns the primary action. One primary action per surface. Also adjacent fixes: - Funding widget keys avatar / distribution color off `account.id`, not `account.name`. Renaming an account no longer recolors it retroactively; two accounts with name-hash collisions no longer share a color (Ruby idiom audit finding). - `Goals::StatusPillComponent`: add `:completed` variant with `circle-check-big` icon. `Goal#display_status` now returns `:completed` when `goal.completed?` so a manually-completed goal (e.g. user stopped at 80%) reads "Completed" rather than falling through to `:on_track`/`:behind` and lying on the index. Locale: drop `body_with_date` (folded into `body`), `projection.behind` no longer carries interpolation args (caller doesn't pass them either), `projection.no_pace` plain-language rewrite ("inflow" → "deposits"), add `status.completed: "Completed"`. * fix(goals): align card + banner copy/numbers with show-page changes Tail of the redundancy + clarity pass: - Goal card on the index drops ".00" cents from every Money.format call (now `format(precision: 0)`). The card uses the same visual rhythm as the show page; cents add zero info at this scale. - Card's "behind"-status footer now reads "Save $X/mo to catch up" with X = `catch_up_delta_money` (the delta the user must add), not the full `monthly_target_amount` (which read as a total monthly burn). Same fix as the show-page banner. - Pending-pledge banner title becomes pluralized: drops "0 days left" / "1 days left" grammatical bugs. New locale tree: title.zero → "Pending: $X into Y · expires today" title.one → "Pending: $X into Y · 1 day left" title.other → "Pending: $X into Y · N days left" Also drops the "Watching for" phrasing (system-talk) for "Pending:" (state-talk) and drops cents from the amount. - `confirm_cancel_body` likewise renders amount without cents. Cards and banner now read consistently with the show page; one voice across the surfaces. * fix(goals): exclude pending transactions from pace + mobile-stack funding rows Two audit fixes that pair well. PF audit B20: pace, family velocity, and the funding widget's 30/90-day totals all summed Entry amounts over the linked accounts *including provider-pending transactions*. A pending Plaid/SimpleFIN deposit inflated pace today; the next sync that reversed or dropped it silently shrunk pace tomorrow, with no signal to the user. Worse, the reconciler could match a pending transaction and flip the pledge to "matched" before the underlying entry vanished. `.merge(Transaction.excluding_pending)` on the three Entry queries (Goal#pace, Family#savings_inflow_velocity, the funding widget's `inflow_totals_map`) brings the existing `Transaction::PENDING_PROVIDERS`-aware scope into play. Single-line fix across the three call sites. UX audit: funding-account rows used `grid-cols-[24px_1fr_48px_120px]` at every breakpoint. On a 375pt iPhone viewport that left ~50px for the name column after `p-5` padding + container chrome — name truncated to "Ban…" and the per-row % column squeezed against the weight/totals stack. The percent number is also already encoded in the distribution bar above the rows; on mobile it can disappear without losing signal. Drop the % column at < sm: - mobile grid: `grid-cols-[24px_minmax(0,1fr)_auto]` (avatar / name / totals) - sm+: original 4-column layout with the per-row % - per-row balance subline + accountable label now also drops `.00` cents (consistency with the rest of the page). * fix(goals/show): past-due target reads "was due" not "by" Copy audit edge case. When `target_date < Date.current` and the goal isn't completed/reached, the header rendered "Target $X by Jan 1, 2024" — present-tense "by" framing a past deadline. The card already has `goal_card.past_due` for this; the show header had no equivalent. Add `header.target_by_past: "Target %{amount} · was due %{date}"` and switch the header when `days < 0`. Skips the trailing "N days left" subpart since it'd render negative or stale. * fix(goals/index): persist filter + search in URL across reloads UX audit finding. The filter chip state and search input lived only in Stimulus values — a Behind-filter selection survived turbo morphs but vanished on F5, browser back from a goal's show page, and any deeplink share. For a family with 10+ goals filtering by "behind", every navigation reset to "all". Hydrate on `connect()`: - read `?filter=behind` → statusValue - read `?q=…` → input target Sync on every `filter()` call via `history.replaceState`: - filter=all → drop key - q empty → drop key - else preserve both Uses `replaceState` (not `pushState`) so each keystroke / chip click doesn't bloat the back-history. The page URL becomes shareable for the filtered view. * fix(goals/show): ring subtitle drops the target restatement The ring card's secondary line read "of $400,000 · $212,969 to go" — the "of $400,000" half duplicates the header's "Target $400,000 by Jan 10, 2027". Same number, two places, ~80px apart vertically. Drop the "of $target" half. Subtitle now reads "$212,969 to go" — single new fact, complementary to the header. * fix(goals/copy): pluralization, casing, voice cleanup Copy audit quick wins. - `needs_this_month_sub` dropped "across" preposition that read grammatically wrong at count=1 ("across 1 goal behind pace"). New: "1 goal behind pace" / "N goals behind pace" — count + noun matches the working sibling subtitles. - `on_track_sub_parts.no_date` was "1 open" / "N open" — collided with the chip and status pill labels "Open" (titlecase) on the same screen. New: "1 without a deadline" / "N without a deadline" — descriptive, lowercase, unambiguous. - `pledge_just_transferred` / `pledge_just_saved` dropped the past-tense + trailing-ellipsis form ("I just transferred…"). Modal title is "Log a transfer you made" / "Log money you set aside" — present-tense, resolved, clear about what the dialog does. - `goals.show.empty.heading` "Nothing's flowed in yet" → "No deposits yet". "Flowed" was novel jargon nowhere else in the vocabulary; "deposits" matches the surrounding copy. - `form_stepper.errors.amount_required` / `accounts_required` added "Please" prefix to match `name_required` — three errors with one voice. * fix(goals): reconciler logs to Sentry + rename :extend route to :renew Two Ruby idiom audit fixes. The Reconciler's outer `rescue StandardError` was logging at error level and moving on. Pipeline-protective (we don't want a Goal reconcile failure to break the Plaid/SimpleFIN/etc importer it's hooked into) but invisible — real bugs hid behind a warn log forever. Add `Sentry.capture_exception(e) if defined?(Sentry)` alongside the log, matching the pattern in `Account::Syncer`, `Sync`, `PlaidItem`, and the chart-series rescues this branch already added. Keep the rescue's protective function. `member do patch :extend end` shadows `Module#extend` — the controller action name competes with Ruby's most-common mixin entry point. `before_action :foo, only: %i[extend destroy]` reads as "extend this controller with :foo, only: …" to a casual reader, and stack traces against `def extend` look misleading. Rename to `:renew` (matches the existing copy: the button says "Extend 7 days," but the API verb is "renew the watching window"): - config/routes.rb: `patch :renew` - GoalPledgesController#extend → #renew - locale `goal_pledges.extend` → `goal_pledges.renew` - banner `extend_goal_pledge_path` → `renew_goal_pledge_path` - test refs updated The user-facing button text is unchanged. * fix(goals): months_remaining uses day-precision PF audit edge case. Calendar-month math undercounted near the deadline: May 30 with a June 1 target returned `1` ("save $5k this month"), then June 1 morning returned `0` (falls through to `remaining_amount` charged as one-month-required). Users saw a $5k/mo required rate for a 2-day window, then $5k flat on deadline day — a cliff that doesn't match reality. Replace calendar-month delta with `(target_date - Date.current) / 30.0` so a 2-day-out deadline reports ~0.07 months and `monthly_target_amount` scales proportionally. `[..., 0.0].max` keeps the past-due case zero-clamped. * fix(goals/stepper): inactive connector line uses border-subdued RUI audit: form-stepper progress line used `border-secondary` for the inactive state — same weight as the active step's border, so the active-step circle didn't visually pop against the line connecting it to the inactive step. Recede passive states. Swap to `border-subdued` (the DS's quieter divider) for the inactive (step 1) line state. The active state stays `border-inverse`. JS toggle in `goal_stepper_controller.js#updateStepperState` follows. * fix(goals): clarify "last saved" + add pledge timestamp to banner UX audit pair. Header "Last saved N days ago" was rendered from `Goal#last_matched_pledge_at` — date of the most recent *pledge-matched* entry — but the funding column on the same page shows "$X last 30d" computed off *all* entries. A user who deposited cash without recording a pledge saw "Funding · last 30d: $200" while the header still read "Last saved 47 days ago." Two adjacent figures contradicted each other. Rename the locale strings (used on both the index card and the show header) to reflect the actual data source: - footer_no_pledges: "No matched pledges yet" - footer_last_today: "Last pledge matched today" - footer_last_days: "Last pledge matched N days ago" Two open pledges into the same account previously rendered as two near-identical yellow banners with no way to tell which one the Cancel button targeted. Add a relative-time line below the body — "Pledged 2 hours ago" / "Pledged about a minute ago" — using `time_ago_in_words(pledge.created_at)`. Discriminator without changing the title or the action surface. * fix(goals): catch-up subtracts pending pledges from the demand UX audit finding. The catch-up alert demanded $X/mo without accounting for pledges the user had already recorded. The user recorded a $20k pledge → catch-up still demanded a fresh $20k → double-counting → stacked yellow CTAs telling them to do the thing they'd just done. Goal#catch_up_delta_money now subtracts `open_pledges.sum(amount)` from the demand: delta = max(monthly_target − pace − sum(open_pledges), 0) Uses the in-memory preloaded `open_pledges` collection (controllers already eager-load it), so no extra query. The clamp at zero keeps "$0/mo more" from rendering when pending pledges fully cover the gap. Alert branch in show.html.erb now also gates on `@goal.catch_up_delta_money.amount.positive?` — when the demand zeroes out via pending pledges, suppress the alert entirely. Status pill stays `:behind` (because `pace < required`), but the action surface goes quiet because the user already took it. * fix(goals/chart): full money format on "Short" annotation + 4-digit year on x-axis Two screenshot-driven audit fixes. The chart's "Short $160.6K" annotation used `_fmtMoneyShort`'s K/M shorthand while the page's other monetary readouts ("$26,621 to catch up", "$187,031 saved", "$1,830 last 30d") were full `Intl.NumberFormat` output. Inconsistent units in the same viewport. Switch the annotation to `_fmtMoney` ("$160,634 short") + reword to put the money first ("$X short" reads more naturally than "Short $X"). Y-axis tick labels keep the K/M shorthand — that column is space-constrained and the same convention is already understood as "axis abbreviation." The x-axis terminal tick rendered `"Jan '27"` from the `"%b '%y"` time-format string. A glance read it as January 27th of the year, not January 2027 — and the target-date tick is the single one users navigate the chart for. Switch to `"%b %Y"` → "Jan 2027." Slightly wider per tick; the existing adjacent- duplicate-removal logic keeps the count sane. * fix(goals): Mark complete confirm warns at sub-100% progress Behavioural audit edge case. A user clicking "Mark complete" at 80% saw the same generic confirm body as at 105% ("It leaves the Ongoing list…"). Sunk-cost-fallacy inversion + premature closure: once labelled complete, the goal anchors success on the truncated amount; future similar goals get smaller targets (regression to the lower aspiration). When `progress_percent < 100`, swap the confirm body to a specific one — "You're at 80% — $X of $Y. Marking complete records this as your achievement instead of the original target. Continue, or close this and adjust the target instead?" Doesn't block the action (some "stop short" cases are healthy — CFP literature explicitly endorses changing your mind), but makes the trade-off visible. Keep the original copy for the ≥ 100% case. `confirm_complete_body_short` is a new locale key; the kebab-menu builder picks between it and `confirm_complete_body` per-render. * fix(goals/pledge): redirect non-turbo-frame GET to goal show UX audit: `app/views/goal_pledges/new.html.erb` unconditionally renders the form in a DS::Dialog wrapper — when the user lands on `/goals/:id/pledges/new` directly (F5, bookmark, stale deep-link), the dialog renders as a freestanding modal over an otherwise-empty page. Compare to `goals/new.html.erb` which has a `turbo_frame_request?` branch with a full-page fallback. Pledges aren't usefully standalone — the modal only makes sense in goal context. Redirect non-frame GETs back to the goal show page instead of rendering the broken-looking standalone dialog. If we want a deep-linkable "open the pledge modal" experience later, that lands as a `?open=pledge` query on the show page that auto-fires the modal — out of scope here. * fix(goals): current_balance guards against linked-account currency drift Ruby idiom audit edge case. `linked_accounts.sum { |a| a.balance.to_d }` trusted the model's validation that all linked accounts share the goal's currency. The invariant holds at write-time, but direct DB writes, an account-currency edit outside goal validation, or future code that bypasses the validation chain could drift it. The naive sum would silently add raw EUR + USD numbers and surface the result as goal.currency. Filter `linked_accounts.select { |a| a.currency == currency }` and log/report-to-Sentry when the filtered count differs. The sum stays correct (no FX, no mixing) and the operator gets visibility into the drift. Same pattern as `Family#savings_inflow_velocity` already uses for the family-level rollup. * fix(goals/new): avatar default icon + restore .goal-avatar color-mix Two interlocking bugs on the new-goal modal's color/icon preview. 1. Avatar fell back to a literal "?" when icon + name were both blank — `form.object.name.to_s.strip.first&.upcase || "?"`. User reported the avatar looked empty on a fresh modal because the "?" disappears against many palette tints. Categories handle this by always showing the category icon. Replace the "?" fallback chain with a default `target` icon (matches the goal creation header's iconography): • icon present → render that icon • icon blank, name → render first letter • icon blank, no name → render default "target" icon 2. Picking a color via the Pickr color picker called `updateAvatarColors(color)` which inlined `style.backgroundColor` + `style.color = color` — overriding the `.goal-avatar` class's `color-mix(in oklab, var(--avatar-color) 55%, black)` rule. The class handles theme-aware contrast (darken text in light mode, full color in dark mode); the inline override killed it and text rendered at the same lightness as the 10% tint background. Update only the `--avatar-color` CSS variable; let the class continue computing the resolved colors. Wire the avatar to the goal-stepper controller properly: `_color_picker.html.erb` gains `data-goal-stepper-target="avatarPreview"` on the span. `nameChanged` now updates the avatar directly (the previous selector queried `[data-testid="goal-avatar"]` which doesn't exist on the color_picker span) and: - swaps to the first letter as the user types, - restores the default-icon HTML (captured at connect) when the name is cleared, - bails when the user has explicitly checked an icon radio (don't undo their choice). * fix(goals): demote Behind pill to neutral surface + drop em-dashes Behavioural + RUI audit follow-ups. The yellow overload finding flagged three concurrent yellow surfaces on the show page: the "Behind" status pill, the catch-up alert, and the open-pledge banner(s). Demoting the alert to outline ownership of the primary CTA addressed one layer, but the pill kept fighting the alert for hue attention. "Behind" is a state, not a call to action; the alert owns the action signal. Switch the pill's classes from `bg-yellow-500/10 text-yellow-700` to `bg-surface-inset text-yellow-700` (with the same dark-mode override). Background goes neutral (matches paused/archived chips); the text keeps the warning hue and the triangle-alert icon stays. Signal preserved, weight reduced. The yellow alert below now reads as the primary nudge instead of one of three matching tones. Also: copy/em-dash sweep across goal surfaces. User-facing strings that contained em-dashes ("Reaches 70% — $X of $Y", "into your linked account — Sure will catch it", "You're at 80% — $X of $Y") read as a stylistic tic; replace with comma/period/period respectively. Form-stepper review placeholders "—" become "…" (ellipsis reads as "not yet set" without the typographic weight). Code comments + log messages also scrubbed for consistency; awkward sed artifacts (//. its...) restored to readable English. No locale-key shape changes; pure string-content edits + one component-style tweak. * fix(goals/copy): apply stylistic pass from copy expert Second pass on user-facing strings after the em-dash sweep and yellow-pill demotion. Voice/abbreviation/edge-value parity. Voice consistency: - `index.pending_pledges_callout` reframed from "Sure is watching your linked accounts" (system-as-watcher voice) to "You have pending pledges. Sure will confirm them on the next sync." (user-actor, system-action). Matches the surrounding user-centric voice on the KPI strip and the helper-text pattern ("Sure will look for…", "Sure will catch it") used elsewhere. - `goal_pledges.new.helper_manual` flipped pronoun "We'll record" to "Sure will record" so the modal's two helper lines share a single narrator. The transfer-helper already says "Sure will look for"; this matches. - `form_stepper.errors.*` dropped the apologetic "Please …" voice ("Please give your goal a name.") for the terse imperative the rest of the feature uses ("Give your goal a name." / "Set a target above zero." / "Pick at least one funding account."). Parallelism: - `kpi.velocity_delta_zero_base` was the only `velocity_delta_*` string spelling out "30 days" while siblings used `30d`. Switch to "First 30d of activity" so the sub-tile reads in one unit. - `Depository` titlecase in `at_least_one_linked_account_required`, `must_be_depository`, and `no_depository_accounts` collapsed to lowercase. Common noun, not a UI label. Matches the empty-state body in `funding_accounts.empty.body` which was already lowercase. Test fixture for `must_be_depository` updated. - `projection.reached` was the same string as `celebration.heading` ("Goal reached. Nice work."), making the celebration moment feel templated. The projection slot is the chart's empty state when there's nothing to project; rephrase to "You've hit the target. No projection needed." Celebration keeps the warm tone. Edge value: - `celebration.body` was "You hit your $X target." When the user marks a goal complete at sub-100% (a flow the new `confirm_complete_body_short` already warns about), this lied about the achievement. Rewrite to "Goal closed at %{saved} of %{target}. Keep it as a record, or archive it now." Interpolation now passes both `saved` and `target` from the show template, so the celebration card honors the actual saved amount whether the user hit, overshot, or stopped short. Notes deferred (verify-only, not string changes): - `goal_card.footer_catch_up` is interpolated with `catch_up_delta_money` in `CardComponent#footer_line`; the show- page guard `.amount.positive?` already lives there. No copy change needed. - `pending_pledge.title.zero` bucket fires only when `count: 0` reaches the I18n call; `GoalPledge#days_left` clamps at 0, so the friendlier "expires today" copy is reachable. - `paused_banner.title` / `inactive.heading_paused` duplicate strings noted but left in place; consolidation is a separate refactor. * fix(goals): scale up card/widget/chart text, fix chart continuity, ease ring focal point Five small audit follow-ups bundled because they were each one-line swaps and individually wouldn't earn their own commit. Card text scale (vs Sure house style — budget_category h3 ≈ text-base, budget _actuals_summary value text-xl, account row text-sm subtype): - goal card title text-sm → text-base - goal card balance text-lg → text-xl - goal card pace/footer/subtitle text-[11px] → text-xs - funding row subtype subtitle text-xs → text-sm - funding row "last 30d / last 90d" labels text-[10px] → text-xs Chart label scale (projection chart was an outlier at font-size: 10 while time_series_chart_controller uses 12): - every `font-size: 10` in goal_projection_chart_controller.js → 12 - tooltip cssText font-size: 11 → 12 Color-picker pen toggle on the new-goal avatar was w-6 h-6 (24px circle, ~55% of the lg 44px avatar). Shrink to w-5 h-5 + add a w-3 h-3 class on the inner icon so it scales down with it. Graph continuity bug: the saved-line endpoint and the projection-line start point could disagree by tens of $thousands. Saved came from `Balance::ChartSeriesBuilder` (daily snapshot in `balances`), projection started at `currentAmount = goal.current_balance.to_f` (live `linked_accounts.sum(:balance)`). When the snapshot lagged the live read, the chart showed a vertical gap at the "today" marker. Filter any same-day-or-later points out of the raw saved series, always extend the saved series to `(today, currentAmount)`. Saved line now closes at exactly the projection's start. The recent balance-drop story is still honestly shown (the line dips toward the live value rather than ending at the stale snapshot). Ring card focal-point (RUI audit): the left ring card on goals#show sat at the same `shadow-border-xs` elevation as the projection chart and funding card. "When every card is raised, nothing's primary." Drop the shadow + container background — the ring now reads as a status panel sitting on the page surface, not a content card competing with its neighbours. Paused/archived/celebration/empty right-slot variants keep elevation since they ARE content cards. Deferred: light-mode pink distribution-bar contrast. The fix needs a DS token decision (hairline outline vs darker step on the palette entries); rolling it into a polish PR risks dragging in DS changes unrelated to goals. Logged for a follow-up. * fix(goals): unified per-goal account color map + smaller pen toggle User flagged two regressions: account colors didn't match between the goal preview-card avatar stack on the index and the funding-widget rows on the show page, and the color-picker pen toggle on the new-goal modal still felt too big. Color matching: - `AccountStackComponent` (index card) used `Goals::AvatarComponent.color_for(account.name)` — MD5-of-name into the 10-color palette. - `FundingAccountsBreakdownComponent` (show page) recently switched to `color_for(account.id.to_s)` — MD5-of-id. - Same account, two surfaces, two different palette picks. Plus either hashing scheme can collide within a multi-account goal (palette has 10 colors). Move ownership to the Goal model: `Goal#account_color_map` returns `{ account_id => palette_hex }` for the goal's linked accounts. Sort by `id` for a stable order across reloads, then assign `palette[i % palette.size]`. Stable + collision-free up to 10 accounts in a single goal (a realistic upper bound — most goals link 1-3). Both consumers now read off the same source: - `AccountStackComponent.new(accounts:, color_map:)` accepts a hash and falls back to the name-hash if no map provided (kept for callers that don't have a goal in scope yet). - `FundingAccountsBreakdownComponent#color_for` reads `goal.account_color_map[account.id]`. - Goal card on index passes `goal.account_color_map` to the stack. Pen toggle: The new-goal color-picker pen sat in a `w-5 h-5` circle with a `border` ring + `text-secondary` icon. The border + secondary text weight kept it loud against the avatar even at 20px. Drop the border, drop the size another step (`w-4 h-4`), recolor the icon `text-subdued` + `hover:text-secondary` so the affordance recedes when not interacted with. Position shifts from `-bottom-1 -right-1` (8px overhang) to `-bottom-0.5 -right-0.5` (2px overhang) since the smaller circle doesn't need the larger float. Icon swaps "pen" for "pencil" (the more conventional edit indicator across Sure). * fix(goals/show): move Edit into kebab, match house style User clarification on the "too big edit icon" finding: the header Edit button itself (not its icon) is what felt wrong. Investigation showed the wider Sure pattern. Every other "Edit" affordance in Sure lives inside a DS::Menu kebab: - app/views/categories/_category.html.erb - app/views/rules/_rule.html.erb - app/views/family_merchants/_family_merchant.html.erb - app/views/chats/_chat_nav.html.erb - app/views/accounts/show/_menu.html.erb - app/views/transactions/show.html.erb Header rows reserve top-level buttons for primary actions (e.g. "New transaction", "Record pledge"). The goal show page was the outlier — Edit as an outline button next to Record pledge, which left two competing CTAs in the header. Move `menu.with_item(text: t(".edit"), icon: "pencil", ...)` to the top of the kebab list. Header now has a single primary CTA (Record pledge, demoted to outline when status is :behind) + the kebab. Matches every other Sure resource page; eliminates the "button-too-big" framing entirely without resorting to ad-hoc icon-size overrides (the `[&>svg]:w-4 [&>svg]:h-4` arbitrary selector hack would have been a one-off, nobody else uses it). Avatar pen toggle on the new-goal color picker stays reverted to its original w-6 h-6 + border-2 form, per the user. * feat(goals/demo): seed full state-coverage matrix + sample pledges User asked for demo seed variety so every goal state surfaces on at least one card. Previous seed only spanned 4 AASM states; the computed status (:reached / :on_track / :behind / :no_target_date) and the edge-state copy paths (past-due target_date, open pledge banner, "Last pledge matched") were absent. New seed coverage matrix: AASM states (column): active → Vacation in Italy, Wedding fund, Emergency fund, House downpayment, Coffee gear, Tax prep buffer paused → Sabbatical completed → Paid-off car archived → Old laptop fund Computed status (active goals): :behind → Vacation in Italy, House downpayment, Tax prep buffer :on_track-ish → Wedding fund (12-month timeline + small target) :no_target_date → Emergency fund :reached → Coffee gear (target 150 below any plausible account balance — progress hits 100% live) Edge surfaces: Past-due active → Tax prep buffer (target_date 2.months.ago, exercises "was due" header copy and the months_remaining = 0 branch in monthly_target_amount) Open pledge banner → Vacation in Italy + House downpayment each ship a single open pledge. The show-page banner renders; the index pending-pledges callout renders because @any_pending_pledge flips true. Matched pledge → Wedding fund: after the main seed loop, find_by(name: "Wedding fund") + locate the most recent non-claimed primary-account inflow Transaction (>= 30 days, amount < 0 per Sure's sign convention), create a matched-status pledge against it, stamp the Transaction's extra->goal->pledge_id per the partial-unique-index invariant. The show-header then renders "Last pledge matched N days ago" via Goal#last_matched_pledge_at. Implementation notes: - Pledges spec embeds inside each goal_spec as an optional `pledges:` array. The loop creates them after goal.save! using the goal's linked_accounts as the default account; the GoalPledge# account_must_be_linked_to_goal validation passes because every spec's account is one of the goal's linked accounts. - The matched-pledge seed is split into a dedicated helper (`seed_matched_pledge_demo_for_wedding!`) because it depends on Transactions seeded earlier in the demo flow. Both no-Wedding- goal and no-recent-inflow guards bail cleanly so older demo variants still work. - All seed targets are intentional. Goal#status reads the live linked-account balance + 90-day inflow at render time, so the demo statuses adapt to whatever the rest of the demo seeded. The targets are sized so the *intended* status is the most likely one for typical demo data. Local DB unaffected: this is the demo-family generator only, run via `Demo::Generator.new.generate_default_data!` against a fresh family. * chore(goals): drop architecture notes from the repo Pulls the two early design notes out of git tracking. They covered the V1 ledger-based design and the engineering mechanics that led to the V2 rewrite. With V2 shipped, the notes have served their purpose and the design-of-record now lives in the code + this PR. Files stay on disk locally (added to .git/info/exclude so future git status doesn't re-surface them as untracked). Anyone who wants the V1 reference can pull from the source branch where this work started. * fix(goals): test pledge new across both turbo-frame and full-page paths CI failure on the prior commit: `GoalPledgesControllerTest# test_new_renders_the_pledge_form` expected 200 but got a 302 to the goal show page. The recently-added non-frame guard on `GoalPledgesController#new` redirects direct GETs (F5, bookmark) back to the goal so the dialog doesn't render standalone, and the test wasn't sending the `Turbo-Frame` header that the modal flow uses in production. Split the test into the two paths the controller actually serves: - `new renders the pledge form inside a turbo frame` passes a `Turbo-Frame: modal` header and asserts 200 — the real modal flow. - `new redirects to the goal show page on a non-frame GET` asserts the 302 to `goal_path(@goal)` — the guard's intended branch. Together they cover the controller's actual contract. * docs(goals): add llm-guide reference for the goals feature Captures the architecture, key files, data model, status semantics, pledge match policy, connected-vs-manual account detection, color map convention, common tasks, and known gotchas. Matches the existing llm-guides pattern (architecture diagram + file inventory + task-oriented sections + reproducible commands). The doc is forward-looking: it covers how to add a new field to Goal, a new status branch, a new pledge kind, and how to safely touch the reconciler. The "Gotchas" section catalogues the known-incomplete-but-shipping items so a future audit doesn't re-derive them from scratch. Demo data regeneration command is included for anyone who needs to refresh the seed. * fix(goals/index): completed goals join the chip-filterable grid Completed goals previously lived in a dedicated section below the active grid that was always visible regardless of which chip the user selected. They were the only state without chip filter representation. Fold completed into the main grid in controller-side order: active goals first (sorted by status rank), completed after (alphabetical). Drop the separate "Completed" section. The `data-goal-status="completed"` on each card (from `Goal#display_status`) makes them filter naturally when the new `completed` chip is selected. Archived stays in its own collapsed-by-default `<details>` section below — the visual-hide-by-default is the point there and a chip wouldn't preserve that. `@active_goals` keeps its meaning (active-only) for the KPI strip, the pending-pledges callout, and the search-visibility check needs `@grid_goals` so search shows up at six combined cards. Section heading: "Ongoing" → "Goals". The heading now covers the combined active + completed list, and "Ongoing" misrepresented what's below it. * fix(goals): address AI review on PR #1798 (CodeRabbit + Codex) Correctness: - GoalPledge#matches? rejects outflows on transfer pledges so a +$200 purchase no longer satisfies a $200 deposit pledge after .abs - GoalsController#sync_linked_accounts! saves through the goal so currency/depository/family validations actually run on update - AlreadyClaimedError replaces empty RecordInvalid in resolve_with! and reconciler rescues the dedicated class - SweepExpiredGoalPledgesJob wraps each expire! in a per-record rescue - Assistant::Function::CreateGoal disambiguates duplicate account names and returns an absolute URL via mailer host config - Family#savings_inflow_velocity defensively scopes from the family's accounts (was Account.joins(:goal_accounts).where(goal_id: ...)) - GoalPledgesController#set_goal preloads linked_accounts + providers to drop the N+1 on any_connected_account? - Stepper subtitle update walks to the enclosing dialog before querySelector so two stepper instances don't fight over one header - categories/_form.html.erb data-action targets color-icon-picker, not the non-existent "category" controller UX / visual: - Projection chart drops preserveAspectRatio="none" and pins endDate at today for past-due goals so the today marker stays in-domain - _color_picker / categories form swap non-standard border-1 for border - Goals index search input uses ring-alpha-black-100 (was raw gray-500) Refactors: - Goal#header_summary extracts the multi-line ERB header block - Goal#catch_up_delta_money sums open_pledges in SQL - Goal#projection_summary uses I18n.l for the on-track month label - Account#default_pledge_kind moves the manual/transfer decision out of GoalPledgesController - GoalPledge::Reconciler iterates ordered (created_at, id) so first-claim wins is deterministic under non-sequential PKs - Goals::FundingAccountsBreakdownComponent + Goals::AccountStackComponent use clamp(0..) instead of Float::INFINITY / [x, 0].max - Goals::StatusPillComponent#label provides a titleize fallback - Goal projection chart skips the redundant initial _draw and reuses the snapped point in the past branch (no double-bisect) - Goal pledge preview drops maximumFractionDigits: 0 so USD/EUR show cents while JPY/KRW stay whole-unit - Demo generator captures the Wedding fund goal in the seed loop instead of looking it up by hardcoded name Tests: - GoalPledgeTest: outflow rejection - GoalsControllerTest: cross-currency attachment rejected on update - SweepExpiredGoalPledgesJobTest: cancelled coverage + per-record rescue - GoalTest: pledge_action_label_key flips to manual_save without an unconditional guard * fix(goals): address second AI review round on PR #1798 - Parse "YYYY-MM-DD" date-only strings as local midnight in the projection chart so users west of UTC stop seeing the today marker and hover dates land one calendar day back - Order the demo-generator depository pickup by (created_at, id) so primary/secondary roles stay stable across reseeds and the state matrix (behind / on_track / reached / no_target_date / past-due) surfaces the same goals every time - Drop the brittle " · "-split on goals.goal_card.days_left in Goal#header_summary (the translation has no separator suffix) - Goal#projection_payload ships pre-formatted strings for the static chart annotations (target_amount_label / short, projection_end_label, projection_shortfall_label, pending_pledge_label_short) and the controller now renders those instead of running Intl.NumberFormat on each draw. Y-axis tick labels stay JS-side because they depend on D3's dynamically-chosen tick values. * fix(goals): round-3 review polish on PR #1798 - Demo seed_matched_pledge tie-breaks `entries.date DESC` with `entries.id DESC` so dense-same-day inflows pick the same row on every reseed - projection_payload exposes the family-currency symbol via Money.new(0, currency).symbol; the chart's `_fmtMoneyShort` / fallback now reads it instead of the hardcoded $/€/£ map, so JPY/KRW/CHF goals get the correct glyph * fix(goals/chart): use optional chain for currency_symbol fallback Biome lint flagged `(this.dataValue && this.dataValue.x) || fallback` as `lint/complexity/useOptionalChain`. Same behaviour with `this.dataValue?.x || fallback`, lint clean. * ux(goals): polish detail page + unbreak render - Fix render-blocker: Money#symbol doesn't exist (use #currency.symbol). - Sanitize projection_summary so the _html locale renders <strong> markup instead of escaping it. - Switch donut + card ring track to --budget-unused-fill; --budget-unallocated-fill resolves to the same gray as bg-surface in light mode so the unfilled arc was invisible on the detail page. - Mobile detail: drop avatar, right-align action buttons, stack projection header (subtitle + legend) so the subtitle reads on one line; bump legend gap on mobile. - Nowrap the projected reach-date so e.g. "Jul 2026" stays together. * ux(goals): redesign show page — one CTA, calm banners Header collapses to title + kebab. The status pill and the `Record pledge` button leave the title row. Status moves into a one-line callout below the subtitle that doubles as the catch-up demand when behind, the reach-date when on track, or a prompt for a target date when missing. `Record pledge` is now the only pledge entry point on the page and lives under the ring. Behind goals pre-fill it with the catch-up delta. The standalone catch-up alert card is gone — its title is the callout, its pace breakdown moves into the projection chart's subtitle, and its CTA is the ring-adjacent button. The "Adjust target instead" link is absorbed into the kebab's existing Edit item. Pending-pledge banner switches from a warning Alert to a neutral container chip. It is informational state, not a warning. Title carries the relative pledged-at meta inline; verbose auto-confirms body stays but in subdued size. Projection chart drops the today-line pending stub (vertical line + dashed marker + "+ pending $X" text). That data already lives in the pending banner above the chart; the duplicate annotation clutters the today line, the small dashed circle reads as misaligned at small pending amounts, and the label overlaps the projection trajectory. Shortfall label gets a paint-order halo so it stays legible across the dashed projection line. * Pipelock noise * fix(goals): jjmata review — reconciler guard, chart i18n, pace test Three issues raised on PR #1798 review: - ProviderImportAdapter now memoizes account.goal_accounts.exists? per-account so a bulk historical import on an unlinked account short-circuits the reconciler instead of paying one SELECT per row. Linked accounts still hit the per-row reconciler with no change. - goal_projection_chart_controller.js reads Today / Projected / Saved labels via Stimulus values fed from goals.show.projection.* locale keys instead of inlining English. - goal_test.rb now covers Goal#pace with real inflows, asserting the 90-day window cutoff plus the Transaction.excluding_pending and entries.excluded = false filters. * fix(preview): replace PR preview cleanly on redeploy (#1819) * fix(preview): delete stale container app before redeploy (#1820) * fix(preview): run preview container in development (#1821) * ux(goals): fix "0 of N · N reached" KPI weirdness When every active goal already hit its target, the "Goals on track" tile read "0 of 2 · 2 reached" — logically correct but emotionally upside-down. Reached goals aren't being tracked toward pace anymore; they belong in the trophy column, not in the fraction. - New `tracked_total` excludes reached and paused goals from the denominator. Paused stops the pace clock on purpose; reached has already cleared it. - When `tracked_total` hits zero and at least one goal is reached, the tile swaps to a celebratory empty state ("All caught up · N reached") instead of trying to render a fraction with no denominator. - Drop "reached" from the subline when the fraction is calculable. The fraction is a needle, "N reached" is a trophy — surfacing them together muddied the message. Reached only appears in the all-caught- up empty state from here on. Active-first / reached-last grid order already drops out of the existing ACTIVE_STATUS_RANK sort (reached defaults to the lowest rank so it naturally lands after behind / on_track / no_target_date / paused). * feat(goals): gate Goals v2 behind beta features toggle Add require_beta_features! to GoalsController and GoalPledgesController, hide the Goals nav item for non-beta users, and tag index/show headers with the Beta pill marker. Update controller tests to enable the preference in setup and assert the redirect for users without access. * feat(goals): add Beta dot marker on sidebar nav rail Pass beta: true on gated nav items so the nav_item partial renders a violet dot-only pill in the top-right of the icon. The doc covers the dot_only usage; the nav itself was never wired up before merge. * fix(DS::Pill): readable contrast in light mode + drop pill from Goal detail - Bind CSS `color-scheme` to Sure's `data-theme` attribute so the pill's `light-dark()` resolves to the side that matches the active theme. In the dark theme it was previously falling back to the light branch. - Darken light-mode pill text 30% with black on top of the 700 stop so the 10–11px uppercase label reads against the violet-50 background. - Drop the Beta pill from the Goal detail page header. A single goal is not the feature; the pill belongs on the feature index, not on each record. * docs(beta-gating): document main-nav dot marker via beta: local The nav-item partial already supports a `beta: true` local that overlays the DS::Pill dot on the icon, but the gating guide didn't show how to wire a gated nav entry through it. Add a short "Gating the main nav" section with the compact-array pattern, and mention the flag in the GA removal checklist. * feat(beta-gating): beta_gated_nav_item helper auto-marks gated entries Wraps the conditional + dot wiring into a single call so adding a new beta nav entry doesn't require remembering to set `beta: true` by hand or duplicating the `beta_features_enabled?` check. Naming mirrors the existing `BetaGateable` concern. * refactor(css): move .goal-avatar rules out of application.css Goals-specific styling doesn't belong in the global stylesheet. Extract the avatar tint + theme-aware text color into a topical goals.css and @import it alongside the other feature CSS files. * fix(goals): validate color format + restore cascade on drop migration - Add hex-format validation on Goal#color so submissions can't smuggle arbitrary CSS into the style attribute on the avatar / picker preview. The picker accepts custom hexes, so format validation (not inclusion) is the right shape — anything not matching #RRGGBB is rejected at the model boundary. - Fix the on_delete in the down block of drop_goal_contributions to match the original cascade. Restoring with restrict was a schema drift that would have shifted referential behavior after a rollback. * fix(goals): clear state-dependent caches on AASM transition + harden sweep job - Goal: `display_status` and `projection_summary` memoize a value that depends on the AASM state column. Without resetting them after a transition the same instance keeps returning the pre-transition value. Hook `after_all_transitions :reset_state_dependent_caches!` undoes the memos so post-`archive!` / post-`pause!` reads see the new state. - SweepExpiredGoalPledgesJob: the inner rescue covered per-pledge failures but not cursor-phase failures (DB blip, OOM mid-batch). Add an outer rescue that reports + re-raises so Sentry sees the failure and Sidekiq retries the job. * i18n + a11y(goals): extract picker strings + drop redundant status-pill aria-label - Color picker had four hardcoded English strings ("Color", "Icon", "Poor contrast, choose darker color or", "auto-adjust."). Move them under `goals.color_picker.*` and call them through `t()`. CLAUDE.md requires every user-facing string go through i18n. - Status pill duplicated its visible label in `aria-label`, which makes screen readers ignore the visible text. Drop the override so the visible label is the accessible name. * fix(goals JS): listener cleanup on color/icon picker + debounce filter URL sync - color_icon_picker: listeners were attached in initialize() with inline arrows, so they had no removable reference and no disconnect() cleanup. Every Turbo navigation that re-rendered the picker stacked another listener on the same node and left the Pickr instance alive. Move attachment to connect(), store bound references, and clean up in disconnect() (including destroyAndRemove on the Pickr). - goals_filter: replaceState fired on every keystroke. Debounce the URL sync 200 ms so a typing burst collapses into a single update. The visible filtering stays real-time. Clear the timer in disconnect() so a pending sync doesn't fire on an unmounted controller. * fix(a11y): focus trap + returnFocus on DS::Dialog Native <dialog>.showModal() moves focus inside the dialog on open but doesn't trap Tab / Shift+Tab, and focus restoration on close is inconsistent across engines. Add three things to the dialog controller: - Capture document.activeElement before showModal() so the trigger is recoverable when the dialog closes (ESC, backdrop click, explicit close button, programmatic close all route through the native close event). - Wrap Tab inside the dialog so a keyboard user can't tab out into the scrim-covered page behind. - Restore focus to the captured trigger on the close event. If the trigger has been detached (Turbo morphed it out), skip silently rather than throw. Verified manually: opening the new-goal modal moves focus to the name input; ESC restores focus to the "New goal" link; Tab wraps from the last focusable back to the first. * perf + tests(goals): share account-ids across velocity windows + cover gaps - Family#savings_inflow_windows wraps the current/prior 30d sums in a single helper that memoizes the linked-account-id lookup. The KPI tile on the goals index used to run the join+pluck twice per request. - Replace two instance_variable_set pokes and one any_instance.stubs in the goal/controller tests. Refetching the goal exercises the real request lifecycle and stops the tests from leaning on implementation details. The 'All caught up' assertion now relies on a real reached state (target 1 vs the depository fixture's 5000 balance) rather than stubbing :status. - Add tests covering: hex format validation on Goal#color, AASM cache reset (display_status reads the new state on the same instance after pause!), negative pledge amount rejection, expire! no-op on already- expired pledge, cancel! NotOpenError on non-open pledge, sweep job idempotency on a second pass, and strong-params rejection of state / family_id on goal create. * fix(goals): apply CodeRabbit findings - Switch the goal_accounts → accounts FK from on_delete: :cascade to :restrict. `Goal#must_have_at_least_one_linked_account` is enforced at write time; the cascade let a raw DELETE silently orphan a Goal whose only link pointed at the deleted account. Normal Rails Account#destroy still cleans up via `dependent: :destroy`, but the restrict guarantees the DB rejects any path that bypasses the association. - projection_payload: required_monthly is now monthly_target_amount&.to_f so open-ended (no-target-date) goals serialize required_monthly: null instead of 0, matching the absence of a required pace. - index page + sidebar nav-rail dot now read the Beta label via t("shared.beta") (and a new shared.beta locale key) instead of the hardcoded "Beta" literal. - _status_callout uses the view-helper t(...) instead of I18n.t(...) for the status label so it follows the same convention as the rest of the goals views. - goal_projection_chart: read the computed style before stamping position: relative so a stylesheet-defined position (fixed/sticky/ absolute) isn't clobbered. - preview-deploy: add `set -euo pipefail` around the wrangler container lookup so a curl/jq failure fails the job instead of producing an empty CONTAINER_ID and silently skipping cleanup. * revert(goals): move .goal-avatar back into application.css Sure's convention for one-off custom classes (.combobox, .scrollbar, .windows, .prose variants, .table-divider, .turbo-progress-bar) is to define them directly in application.css. Topical files (privacy-mode, date-picker-dark-mode, print-report) are reserved for coherent feature namespaces with multiple rules. A single .goal-avatar rule belongs with the other custom classes. * fix(goals): goal status pill uses DS::Pill outline (consolidate + survive hover bg) The status pill on the goal card used a 10%-alpha fill (bg-warning/10, bg-green-500/10). On the card's hover state (bg-surface-hover) the fill blended into the new background and the pill lost its tint outline. Extend DS::Pill with a green tone and an optional icon: param (renders a Lucide icon in place of the dot) so the same primitive can carry both the beta marker and the goal status badges. Map Goals::StatusPillComponent to DS::Pill outline style — transparent fill + colored border + colored text + glyph — which is immune to any change in the surrounding card bg. One badge primitive, light-mode contrast already fixed (the color-mix 30% darkening on text), and the card hover state no longer washes out the status. * fix(goals): drop hover bg on card, use subtle shadow lift instead The card was the only place in Sure setting hover:bg-surface-hover on a bg-container card; every other static card (settings, recurring transactions, ai_prompts, etc.) stays still. The hover bg (gray-100) landed almost exactly on top of the ring track (gray-200) and washed out the pill fill, fighting the very signals the card was trying to show. Swap to hover:shadow-sm — the lift matches the transaction-tabs precedent already in Sure, the bg stays white, and ring track + status pill keep their contrast. * fix(goals): drop no-target-date goals from the on-track denominator The KPI tile reads 'X of Y on track'. Y was every active goal minus reached + paused, which included open-ended goals (no target_date). But an open-ended goal has no required monthly pace to compare against — by definition it can be neither on track nor behind. Counting it in the denominator dragged the ratio down and never improved as the user kept saving (the fraction stays stuck because the open-ended goal is never a hit). Exclude :no_target_date from tracked_total. Numerator unchanged. The subline still surfaces 'N without a deadline' as informational so the user knows those goals exist. * fix(goals): keep archived cards out of the filter loop entirely The earlier 'filter archived too' attempts kept toggling the archived section based on chip state, which produced more confusion than value (filter shows partial counts, archived hides on some chips, etc.). Step back: archived stays in its own collapsed-by-default section, always visible, never reacts to the chip / search filter. Render the cards with filterable: false so they don't add a filter target in the first place — no JS handling needed, and the active grid + chips behave exactly like they did before this whole thread. * feat(goals): pending-pledge dot on card avatar Goals with open + unexpired pledges now carry a small amber DS::Pill dot at the top-right of the avatar on the index card. Same primitive + position pattern as the beta gate dot on the sidebar nav, so the 'small marker' affordance reads consistently across the app. Pledges are preloaded via the existing .includes(:open_pledges, ...) on the index query, so the indicator is free at request time. * fix(goals): swap pending-pledge avatar dot for inline clock glyph The amber DS::Pill dot on the avatar collided visually with the amber 'Behind' status pill on the same card — two amber signals in the same eye-line. Move the indicator to a text-subdued clock icon between the goal name and the status pill: quieter, semantically clearer (clock = pending sync / time-bound), no tone collision with the status palette. Same accessibility hook (aria-label + title). * feat(goals): footer 'N pending' on cards + drop warning tone from top callout - Pending pledges surface in the card footer as '· N pending' tacked on after the existing footer line (text-subdued). Quiet, semantic, doesn't compete with the status pill or the avatar. - The top-of-page 'You have pending pledges' callout was using the amber DS::Alert warning variant. Pending isn't a warning — it's a passive 'we're waiting on a sync' state. Switch to the info variant so the visual weight matches the meaning. * fix(goals/demo): seed goals in generate_new_user_data_for! Cloudflare preview entrypoint, FamilyResetJob, and the Settings "Reset + load sample data" flow all go through generate_new_user_data_for!, which seeded categories/accounts/transactions/budget but not goals. Move generate_goals! inside this method (alongside the same call already in generate_default_data!) so every sample-data surface gets the full state-coverage matrix. * fix(goals): card hover uses bg-container-hover (gray-50) instead of shadow lift Mirror the affordance used in the accounts/select_provider screen and the bank-sync flows: a near-imperceptible gray-50 fill swap rather than a shadow. Lighter than the previous shadow lift, doesn't introduce elevation noise inside the grid, and the ring track (gray-200) + status pill outline still keep enough separation against the gray-50 hover bg that we don't reintroduce the original contrast issue. * fix(preview): surface demo data failure logs (#1865) * refactor(goals): use semantic color tokens for ring + status callout `Goals::CardComponent#ring_color` and `goals/_status_callout` reached into the Tailwind palette directly (`text-yellow-700`, `var(--color-green-600)`, etc.) for status-coded colors. The sure-design-system already exposes the matching semantic tokens (`text-warning`, `text-success`, `--color-success`, `--color-warning`), which theme-swap correctly in dark mode and survive palette renames without view edits. - `ring_color`: collapse `:reached` / `:on_track` to `--color-success` (the status pill already differentiates them via icon — completed star vs check) and `:behind` to `--color-warning`. The `:no_target_date` fallback keeps `--color-gray-400` for now since there's no semantic neutral token; that gets cleaned up alongside the DS::ProgressRing extraction. - `_status_callout`: drop `text-yellow-700 theme-dark:text-yellow-300` and `text-green-700 theme-dark:text-green-300` for the equivalent semantic `text-warning` / `text-success` utilities. No visual regression in light mode (success collapses two adjacent greens into one); dark mode now properly inverts via the design system's theme variants instead of hand-rolled overrides. The `stroke="var(--budget-unused-fill)"` track on the inline card ring stays for now — that's a token-rename refactor that touches budget code outside this PR's scope and lands cleanest with the DS::ProgressRing primitive that consolidates the three ring implementations. * fix(goals): replace ring-gray-500 with semantic ring-alpha-black-500 token The colour-picker swatches were using the raw Tailwind palette utility `peer-checked:ring-gray-500`. Swap for the design-system functional token `peer-checked:ring-alpha-black-500` so the focus ring inherits the same alpha-on-surface treatment used elsewhere in the system and respects dark mode. Flagged by sure-design's DS Drift Patrol on #1798. * refactor(goals): migrate index search field to DS::SearchInput #1853 just landed on `main` (`8e444ff9`), so the goals index search input can move off the hand-rolled markup and onto the new `DS::SearchInput` primitive. Behaviour unchanged — the `data-goals-filter-target="input"` and `data-action="input->goals-filter#filter"` hooks pass through via the component's `data:` option, and the wrapper's `flex-1 min-w-[200px]` carries through via the component's `class:` arg. Drops the broken `focus:ring-gray-500` lookalike (the hand-rolled class used `focus:ring-alpha-black-100` which is fine, but the new primitive uses the canonical `focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-gray-900` pattern from DS::Button — same focus contract everywhere). Addresses sure-design's DS Drift Patrol finding on #1798. * refactor(goals): migrate archived <details> to DS::Disclosure :inline #1858's :inline variant landed (commit 8de14ed2), so the goals index archived-section toggle can move off the raw <details> and onto the shared primitive. Behaviour and look unchanged — the custom summary content (chevron + uppercase heading + tabular count) passes through the `summary_content` slot; the `:inline` variant adds nothing on top besides the focus-visible ring shared with the other DS::Disclosure variants. Addresses the third sure-design DS Drift finding on #1798 (the other two — DS::SearchInput + ring-gray-500 — already landed earlier). * fix(goals): cover money displays with privacy-sensitive Audit-driven sweep. The class was already on the obvious surfaces (KPI strip, ring center, card balance, funding-accounts breakdown); these were the secondary surfaces missed in the initial PR — money interpolated into descriptive prose, account-picker balances, live previews, and the projection chart tooltip. - card_component: target divisor next to the masked balance, pace line, and behind-status footer (`footer_has_money?` helper keeps non-money branches unmasked so paused / archived / "Goal reached" copy stays readable in privacy mode). - show: header_summary (target + date subtitle), to_go remaining, inactive recap body, celebration body, catch_up body. - _status_callout: conditional on `goal.status == :behind` — only that branch carries an amount; on_track / no_target_date have date or static copy. - _form_edit + _form_stepper: account balance shown in the linked- account picker rows. - _form_stepper review section: reviewSummary + reviewSuggested ps (Stimulus injects target / suggested $X/mo into both). - _pending_pledge_banner: banner title span (amount + account + days). - goal_pledges/new: live preview p (Stimulus injects "Reaches X%, $A of $B" / "Hits your $B target"). - goal_projection_chart_controller: tooltip was inline-styled with hard-coded gray-900 + white (DS drift) and had no privacy class. Replaced cssText with className using bg-container + text-primary + border-secondary + rounded-lg + privacy-sensitive — mirrors the pattern in time_series_chart_controller and the post-#1996 sankey fix. Tooltip now respects theme and privacy mode. * fix(ds): DS::Disclosure summary_class override; migrate color picker Resolves sure-design DS drift patrol findings (raw <details> on goals/_color_picker and categories/_form). The color-icon-picker's <summary> is a 24/28px pencil button absolutely positioned next to the avatar — none of DS::Disclosure's existing variants (default / card / card_inset / inline) match that trigger shape, so the bot's suggested swap would regress the visual. - DS::Disclosure: add optional `summary_class:` kwarg. When set, the caller's class string replaces the variant's hard-coded summary chrome; otherwise the existing variant logic is preserved (verified against the 8 existing callsites — none pass summary_class, all fall through to current behavior). - goals/_color_picker + categories/_form: swap raw <details> for DS::Disclosure with summary_class carrying the pencil-button positioning. Stimulus data attributes (`color-icon-picker-target` and the outside-click handler) forwarded via **opts to tag.details so the controller still finds its target. The DS::Disclosure-rendered popover content now sits inside the component's `<div class="mt-2">` wrapper, but the popups themselves are `position: absolute` / `position: fixed`, so the wrapper is out-of-flow neutral. * fix(goals): drop new-goal stepper, unify create + edit form The 2-step stepper on the create modal carried a review step whose only real signal was a derived "Save $X/mo to hit it on time" hint. Name, amount, and date are all visible in step 1, so the review step was re-displaying form values the user just typed. Collapses both flows into a single panel: - `_form_stepper.html.erb` + `_form_edit.html.erb` → single `_form.html.erb` driven by `goal.persisted?` for URL / method / submit label. - `goal_stepper_controller.js` → `goal_form_controller.js`. Drops the step1Panel / step2Panel / step1Indicator / step2Indicator / step1Circle / step2Circle / stepperLine / reviewName / reviewSummary / reviewSuggested / footerLeftButton / footerRightButton / submitButton target plumbing and the next / back / blockEnter / updateStepperState / updateFooter / updateReview methods. Keeps name-validation, amount-validation, accounts-required validation, avatar-preview-from- name, and the suggested-pace computation — that one now writes into an inline `<p data-goal-form-target="suggested">` below the target_date field instead of the review card. - `new.html.erb`: drops the `Step 1 of 2 · Goal details` subtitle target. New `goals.new.subtitle` replaces the two step subtitles. - `edit.html.erb`: renders the same `form` partial. - `_color_picker.html.erb`: `data-goal-stepper-target="avatarPreview"` → `data-goal-form-target="avatarPreview"` (same Stimulus target, renamed for the new controller scope). - `funding_accounts_breakdown_component.rb`: i18n key path moves to `goals.form.subtypes.*` matching the locale restructure. - `en.yml`: `goals.form_stepper.step1.fields.*` → `goals.form.fields.*`. `step2.*` and the `back` / `continue` / `cancel` keys drop. New `goals.form.create` ("Create goal") + `goals.form.save` ("Save changes") drive the submit-button label. UX delta: the user no longer sees a "Step 1 of 2 / Step 2 of 2" beat. The form is short enough that everything fits in one panel; the only value-add from the old step 2 — the suggested-pace hint — now updates live inline as the amount / date / account-count changes. All 20 `test/controllers/goals_controller_test.rb` tests still pass. `bundle exec erb_lint` clean on the touched templates. * fix(ci): extract github.event refs into job env in preview-deploy Pulls `github.event.pull_request.number` and `github.event.pull_request.head.sha` out of every shell `run:` block and `actions/github-script` body into job-level env vars. The PR number is nominally an integer (no immediate injection risk), but the *pattern* of inlining a `github.event.*` expression into a privileged workflow's shell scripts is what the SAST finding wants to eliminate: - The workflow holds `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID`. - A future copy/paste of one of these step bodies onto a user- controlled string (branch name, PR title, commit message) would silently become an arbitrary command-injection path. Touches: - Job-level `env: { PR_NUMBER, HEAD_SHA }` so every step inherits. - "Configure preview files": `sed` substitution now reads `${PR_NUMBER}` from the shell env (the literal-placeholder side stays escaped as `\${PR_NUMBER}`). - "Delete existing preview container app" + "Delete existing preview Worker": shell var assignments use `${PR_NUMBER}`. - "Create GitHub Deployment" github-script: `process.env.PR_NUMBER` inside the JS template literal instead of GHA template interpolation. - "Deploy to Cloudflare Containers": `${PR_NUMBER}` in the shell; `CLOUDFLARE_WORKERS_SUBDOMAIN` also lifted into the step's `env:` block so the URL template uses `${CLOUDFLARE_WORKERS_SUBDOMAIN}`, not a templated secret expression in the shell command. - "Comment on PR" github-script: replaces the four `${{ github.event.pull_request.* }}` interpolations with `process.env.PR_NUMBER` / `process.env.HEAD_SHA` and lifts the preview URL via step env. `issue_number` is `Number(...)`-coerced since env values are strings. - "Store cleanup metadata" artifact name: uses `${{ env.PR_NUMBER }}` (template context, not shell). YAML still validates (`ruby -ryaml -e 'YAML.load_file(...)'`). The only remaining `github.event.pull_request.*` references are the job- gate `if:` condition and the env-extraction definitions themselves — both safe contexts. * fix(goals): Number.NaN over global NaN in goal_form_controller Biome's lint/style/useNumberNamespace rule. Same semantics — Number.NaN is the explicit namespace form post-ES2015. CI lint_js was failing on this line. * fix(ci): drop leftover preview pre-delete steps after isolation merge The preview isolation refactor (#2025) removed the "Delete existing preview container/Worker" steps. Merging main into this branch auto-kept this branch's copies, leaving two steps that run `npx wrangler` from `workers/preview` with Cloudflare secrets in scope. That trips bin/preview_deploy_security_check.rb (PR-controlled working-directory, npx wrangler, secrets outside the deploy step), failing scan_ruby and, in turn, the preview deploy gate. Removing them realigns the workflow with main's isolated model. * Update preview-deploy.yml Signed-off-by: Guillem Arias Fauste <accounts@gariasf.com> * refactor(goals): squash migrations into single create_goals Collapse the 9 churned goals migrations (create savings_* tables, rename to goals, add icon, add pledges + enums, drop contributions, restrict the goal_accounts->accounts FK) into one create_goals migration that builds the final schema directly. Schema is unchanged. The concurrent transactions pledge-id index stays a separate migration because CREATE INDEX CONCURRENTLY cannot run inside a transactional migration. * fix(goals): use functional ring token in color picker The custom-color swatch used a raw ring-blue-500 palette utility while the preset swatches use ring-alpha-black-500. Switch to the functional token for design-system consistency. --------- Signed-off-by: Guillem Arias Fauste <accounts@gariasf.com> Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Sure Admin (bot) <sure-admin@splashblot.com>	2026-06-02 14:00:16 +02:00
Tân Một Nắng	7ad287c4db	feat(i18n): add Vietnamese (vi) locale (#2043) ... * feat(i18n): add Vietnamese (vi) locale - Add "vi" to SUPPORTED_LOCALES in LanguagesHelper - Create 110 vi.yml translation files across all locale directories: breadcrumbs, models (27 files), views (75+ files), mailers, doorkeeper - All files validated as valid YAML with no interpolation mismatches - Fallback to English for any untranslated keys via existing fallbacks config * fix(i18n): apply CodeRabbit review fixes to Vietnamese locale - breadcrumbs: securities → Chứng khoán (was duplicate of security/Bảo mật) - period label_short: distinguish years from days (5Năm/10Năm/NĐN vs N for days) - imports: localize "Hover" → "Di chuột" in error hint - recurring_transactions: transfer_feature_disabled uses "Chuyển khoản" not "Giao dịch" - reports: YTD period labels "NNN %{year}" → "Từ đầu năm %{year}" - sso_identities: explicit unlink success message instead of generic "Thành công" - simplefin_items: standardize branding SimpleFin → SimpleFIN (4 occurrences) - transactions: rename duplicate YAML key merge_duplicate → merge_duplicate_button	2026-05-30 01:32:30 +02:00
Guillem Arias Fauste	e15349d57e	refactor(misc): migrate misc badges to DS::Pill (#1751 PR D) (#1919) ... * refactor(transactions): migrate 5 transaction badges to DS::Pill (#1751 PR B) Migrates the hand-rolled "Pending" / "Review recommended" / "Potential duplicate" / "Split" badges across the transaction views to the extended DS::Pill primitive from #1902. **Visual contract for badge mode** In #1902 the badge mode (`marker: false`) used `rounded-md` (chip shape) because the marker mode does. But every existing pill / status badge in the codebase uses `rounded-full` — see `settings/providers/_status_pill.html.erb`, `settings/providers/_maturity_badge.html.erb`, and the inline transaction badges this PR is migrating. To keep the visual contract consistent, this PR shifts `DS::Pill`'s badge mode to `rounded-full` (marker mode stays `rounded-md`, unchanged from #1829). The shape distinction now reads: markers are tags, badges are pills. **Callsites migrated** (5): - `app/views/transactions/_transaction.html.erb` — Pending, Review-recommended, Possible-duplicate, Split badges - `app/views/transactions/_header.html.erb` — Pending badge - `app/views/transactions/_split_parent_row.html.erb` — Split badge **Tone mapping** | Badge | Tone | Notes | |---|---|---| | Pending | `:neutral` | unchanged copy/icon, gains subtle DS-controlled bg | | Review recommended | `:neutral` | matches existing `bg-surface-inset` look | | Possible duplicate | `:warning` | DS semantic alias for the existing `text-warning` | | Split | `:neutral` | matches existing `bg-surface-inset` look | **Deferred to follow-up PRs** - `app/views/transactions/_transfer_match.html.erb` — uses two responsive-visibility variants (`hidden lg:inline-flex` for long copy, `inline-flex lg:hidden` for short). DS::Pill currently has no `class:` arg for caller-controlled wrapper classes; deferring until that lands. - `app/views/transactions/searches/filters/_badge.html.erb` — has a close button alongside the label (`button_to clear_filter_*`) and uses `rounded-3xl p-1.5` instead of a true pill. Closer to a removable filter chip — better fit for a separate `DS::FilterChip` primitive than for `DS::Pill`. Refs #1751. * refactor(misc): migrate misc badges to DS::Pill (#1751 PR D) Replaces five misc badge callsites with `DS::Pill` (badge mode: `marker: false`, `show_dot: false`) so the long-tail badges share the same shape, padding, and dark-mode tokens as the rest of the design system. No raw palette classes remain in the migrated files. Migrated: - app/views/shared/_badge.html.erb — converted to a thin shim that renders `DS::Pill`; preserves the block-content API and the `pulse: true` option (wraps the pill in `animate-pulse`). Maps `success`/`error`/`warning`/default → `:success`/`:error`/`:warning`/`:neutral`. - app/views/accounts/_tax_treatment_badge.html.erb — maps tax treatments to DS tones: `:tax_exempt → :green`, `:tax_deferred → :indigo` (was raw blue-500/10), `:tax_advantaged → :violet` (was raw purple-500/10), default → `:neutral`. - app/views/reports/_investment_performance.html.erb (line ~121, inline twin of the tax-treatment badge) — uses the same mapping via a new `tax_treatment_pill_tone` helper. - app/helpers/reports_helper.rb — replaces `tax_treatment_badge_classes` with `tax_treatment_pill_tone` (the old helper had no other callers). - app/views/import/qif_category_selections/show.html.erb (~line 86) — inline split badge → `tone: :warning`. - app/views/investment_activity/_badge.html.erb — fixed activity enum mapped to DS tones: Buy/Reinvestment → :indigo, Sell → :red, Dividend/Interest → :green, Contribution → :violet, Withdrawal → :amber, others → :gray. Skipped (true mismatches, not extendable without changing DS::Pill): - app/views/shared/_color_badge.html.erb — takes an arbitrary user-supplied color via `color-mix(in oklab, #{color} ...)`. DS::Pill only supports the fixed tone enum, so this would lose information. - app/views/categories/_badge.html.erb — same reason; renders `category.color` (arbitrary hex per record). - app/views/investment_activity/_quick_edit_badge.html.erb — interactive button with a Stimulus controller, click action, hover state, and dropdown anchor. DS::Pill renders a `<span>`; converting would destroy the interactive surface. Stack: based on `feat/ds-pill-transactions-1751-b` (PR #1917), which ships the `marker: false` → `rounded-full` badge shape this PR depends on. Refs #1751.	2026-05-23 08:55:39 +02:00
Guillem Arias Fauste	2ce8e858b6	refactor(providers): migrate provider badges to DS::Pill (#1751 PR C) (#1918) ... * refactor(transactions): migrate 5 transaction badges to DS::Pill (#1751 PR B) Migrates the hand-rolled "Pending" / "Review recommended" / "Potential duplicate" / "Split" badges across the transaction views to the extended DS::Pill primitive from #1902. **Visual contract for badge mode** In #1902 the badge mode (`marker: false`) used `rounded-md` (chip shape) because the marker mode does. But every existing pill / status badge in the codebase uses `rounded-full` — see `settings/providers/_status_pill.html.erb`, `settings/providers/_maturity_badge.html.erb`, and the inline transaction badges this PR is migrating. To keep the visual contract consistent, this PR shifts `DS::Pill`'s badge mode to `rounded-full` (marker mode stays `rounded-md`, unchanged from #1829). The shape distinction now reads: markers are tags, badges are pills. **Callsites migrated** (5): - `app/views/transactions/_transaction.html.erb` — Pending, Review-recommended, Possible-duplicate, Split badges - `app/views/transactions/_header.html.erb` — Pending badge - `app/views/transactions/_split_parent_row.html.erb` — Split badge **Tone mapping** | Badge | Tone | Notes | |---|---|---| | Pending | `:neutral` | unchanged copy/icon, gains subtle DS-controlled bg | | Review recommended | `:neutral` | matches existing `bg-surface-inset` look | | Possible duplicate | `:warning` | DS semantic alias for the existing `text-warning` | | Split | `:neutral` | matches existing `bg-surface-inset` look | **Deferred to follow-up PRs** - `app/views/transactions/_transfer_match.html.erb` — uses two responsive-visibility variants (`hidden lg:inline-flex` for long copy, `inline-flex lg:hidden` for short). DS::Pill currently has no `class:` arg for caller-controlled wrapper classes; deferring until that lands. - `app/views/transactions/searches/filters/_badge.html.erb` — has a close button alongside the label (`button_to clear_filter_*`) and uses `rounded-3xl p-1.5` instead of a true pill. Closer to a removable filter chip — better fit for a separate `DS::FilterChip` primitive than for `DS::Pill`. Refs #1751. * refactor(providers): migrate provider badges to DS::Pill (#1751 PR C) Migrates the provider-bucket pill/badge callsites to the extended DS::Pill primitive (badge mode, rounded-full) from #1917. Callsites migrated (3): - app/views/settings/providers/_status_pill.html.erb — provider connection status pill. Status → tone mapping: :ok → :success, :warn → :warning, :err → :error, else → :neutral. - app/views/settings/providers/_maturity_badge.html.erb — alpha/beta label. Tone :neutral, no dot. - app/views/sophtron_items/_sophtron_item.html.erb (line 27) — "manual sync" warning. Tone :warning, no dot. The settings/providers/_status_pill partial wraps DS::Pill rather than being deleted, since _connection_row still calls it via `render "settings/providers/status_pill", status: status` — keeping the partial preserves the seam without a wider refactor. Dead code removed: SettingsHelper#status_pill_classes (no remaining callers after the migration). Skipped: - app/views/simplefin_items/_activity_badge.html.erb — not actually a pill/badge. It renders <p> text with `text-warning` plus an inline icon below the heading; no rounded-full shape and no chip semantics. Migrating it would change the layout, not consolidate a pill pattern. Refs #1751. Stacks on #1917.	2026-05-23 08:52:04 +02:00
ghost	655895341d	feat(imports): verify Sure NDJSON import readback (#1869) ... * feat(imports): verify Sure NDJSON readback * fix(imports): tighten Sure readback verification * fix(imports): polish Sure verification review nits	2026-05-20 21:35:22 +02:00
Guillem Arias Fauste	e07d641ead	fix(design-system): DS::Button a11y audit — focus ring, touch target, type default, icon-only label (#1840) ... * fix(design-system): DS::Button a11y audit Closes #1738. Four concrete fixes surfaced by the savings-goals audit + #1737 universal checklist: 1. Focus ring (WCAG 2.4.7). `base.css` had `focus-visible:outline-gray-900` which is **1.07:1** against the primary button's gray-900 background — invisible. Widen to `outline-2 outline-offset-2`, place outline outside the button via offset, and add a dark-mode `outline-white` so the ring is always visible against the page chrome regardless of the button surface. 2. Touch target (WCAG 2.5.5). Icon-only buttons at the default `:md` size were `w-9 h-9` = 36×36, below the 44×44 enhanced target. Bump `md.icon_container_classes` to `w-11 h-11` and `lg.icon_container_classes` to `w-12 h-12` to keep the size scale intact. `sm` stays at 32×32 (already passes WCAG 2.5.8 AA's 24×24 minimum; intentional compact-density variant). 3. Default button type. `content_tag(:button, ...)` inherits the HTML default `type="submit"`, so a DS::Button rendered inside a form steals Enter-key submission from the first text input (reproducible in the form stepper). Default to `type="button"` in the non-`href` branch; existing form submitters pass `type: "submit"` explicitly and continue to work. The `button_to` (href) branch keeps the submit default because button_to wraps its own form. 4. Icon-only accessible name. Icon-only buttons render no text node, so AT users hear "button" with no name. Derive a humanized aria-label from the icon key (e.g. `icon: "more-horizontal"` → `aria-label="More horizontal"`); explicit `aria: { label: }` on the caller still wins. Soft fallback — callers should still pass meaningful labels for richer copy. Plus: replace the stale `fg-white` icon class on the destructive variant with `text-inverse` (the `fg-*` namespace was deprecated in #1626 so `fg-white` resolved to nothing; the icon was using its helper-default color rather than the white the design intended). Out of scope: - Menu avatar trigger (custom 36×36 button bypassing DS::Button) — belongs to #1743 DS::Menu audit. - DS::FilledIcon `lg` size container (decorative, not interactive) — belongs to #1742. * fix(design-system): force type=submit on StyledFormBuilder#submit The DS::Button default-type-button change in the previous commit broke every `form.submit "Log in"` callsite because `StyledFormBuilder#submit` (app/helpers/styled_form_builder.rb) renders a DS::Button under the hood with no explicit `type:`. After the default flip, those submit buttons rendered as `type="button"`, so submitting forms (login, password reset, every form using `form.submit`) silently no-ops. CI surfaced this via ~30 system tests failing in the `sign_in` helper, which couldn't get past the login page. Pin `type: "submit"` on the DS::Button rendered by `StyledFormBuilder#submit`. The 22 view-level `f.submit` / `render DS::Button.new(type: :submit, ...)` callers already pass type explicitly and are unaffected. * fix(review): href-branch type-button bug + focus-ring tokens + profile Save submit CodeRabbit P1+P2 review on #1840: 1. button.rb: `merged_opts.delete(:href)` always returned nil because Buttonish#initialize strips :href from opts into @href, so the `if href.blank?` guard was ALWAYS true. Every DS::Button rendered via button_to (the href branch) got `type="button"` on the inner button, breaking submission of those button_to-generated forms (e.g. imports/_ready.html.erb publish button, imports/_failure.html.erb try-again button). Drop the local `href = merged_opts.delete(:href)` so the guard now reads the @href reader, leaving the href branch's HTML default intact. 2. settings/profiles/show.html.erb: the Save button is rendered with `render DS::Button.new(...)` inside `styled_form_with` (not via form.submit), so the StyledFormBuilder#submit type-pin from 624e9794 doesn't cover it. Pass `type: :submit` explicitly so the profile form submits again under the default-type-button policy. 3. base.css: replace raw `outline-gray-900` / `outline-white` with the established alpha-ring focus pattern (focus-visible:ring-alpha-black-300 + theme-dark:ring-alpha-white-300) already used by app/components/settings/provider_card.html.erb and sure-design-system/components.css. Keeps a11y focus ring while using DS tokens. * fix(review): add type: :submit to DS::Button submitters inside forms CI test_system on #1840 surfaced 6 failures (confirm-dialog close, property create/edit, transaction filter apply) caused by the same gap that db563f3d started addressing: the default-type-button policy on DS::Button means every \`render DS::Button.new(...)\` inside a \`<form>\` (or \`styled_form_with\`) that relies on the HTML default to submit is now an inert \`type="button"\`. Audited every \`render DS::Button.new(\` callsite repo-wide for the combination (no \`type:\`, no \`href:\`, inside a form context) and pinned \`type: :submit\` explicitly on the 12 forms that need it: - layouts/shared/_confirm_dialog.html.erb: Confirm button inside the global \`<form method=\"dialog\">\` — fixes test_should_allow_revoking_API_key_with_confirmation. - properties/{new,edit,balances}.html.erb: Save/Next submitter inside \`styled_form_with\` — fixes test_can_create_property_account, test_can_persist_property_subtype. - transactions/searches/_menu.html.erb: Apply inside the filter form — fixes test_can_filter_uncategorized_transactions, test_all_filters_work_and_empty_state_shows_if_no_match, test_can_open_filters_and_apply_one_or_more. - transactions/bulk_updates/new.html.erb: Save in bulk-edit drawer. - account_sharings/show.html.erb: Save in account-sharing form. - category/deletions/new.html.erb, tag/deletions/new.html.erb: destructive + safe submit buttons in deletion dialog forms. - family_merchants/merge.html.erb: Submit in merge form. - subscriptions/upgrade.html.erb: contribute_and_support_sure submit. - rules/_category_rule_cta.html.erb: Dismiss inside the rule_prompts_disabled form. Cancel/close DS::Button instances inside these same forms intentionally keep the \`type=button\` default since they drive JS-only actions (\`DS--dialog#close\`, \`DS--menu#close\`). * fix(review): add type: :submit to 4 remaining form-context DS::Button callers Second sweep for the same default-type-button regression that 24c517eb fixed for 12 callsites. The latest CI run on this branch narrowed the failures from 6 to 2 (the property wizard's Address step still failed because that view was not in the first sweep). Audited via a wider 4000-char form-context window: - app/views/properties/address.html.erb: Save inside styled_form_with — fixes the remaining test_can_create_property_account + test_can_persist_property_subtype by letting Step 3 of the property wizard complete. - app/views/onboardings/goals.html.erb: Submit inside form_with so the onboarding goals step submits. - app/views/account_sharings/show.html.erb (owner-side form): Save button for the family-share permissions form (the non-owner Save was already fixed in 24c517eb). - app/views/transactions/_attachments.html.erb: Upload inside styled_form_with — kept the JS-driven hook (attachment_upload_target) but explicit type:submit covers the no-JS fallback. * fix(review): pin type=submit on the Save currencies button Codex P1 (third pass) caught one more in-form DS::Button I missed in the earlier sweeps: \`app/views/settings/preferences/show.html.erb:185\` renders the Save currencies submit deep inside a long \`styled_form_with\` block. The form-context scan I used had a finite look-back window which missed it because the matching \`styled_form_with\` opener sits ~80 lines / 4k+ characters above the button. Switched to a whole-file scan to confirm no further callsite remains.	2026-05-20 18:12:36 +02:00
Guillem Arias Fauste	1ddd8bd040	feat(i18n): complete Catalan translations + extract residual hardcoded strings (#1836) ... * feat(i18n): complete Catalan translations + extract residual hardcoded strings CA coverage - All view/model/breadcrumb/doorkeeper/mailer locale files for ca: 0 missing keys (was ~3,400). Translations follow informal "tu" register, sentence case, domain glossary (Compte/Saldo/Transacció/Posició/Operació/Pressupost/...). - Catalan pluralization test: ca uses one/other; mirrors test/lib/polish_pluralization_test.rb. - 8 LanguageTool-flagged grammar fixes applied (Connexió òrfena, Secret de l'API, comma-pero, apostrophe elisions, etc). Hardcoded string extraction (also fixes EN parity) - UI::Account::Chart#title + chart.html.erb view tabs -> UI.account.chart.* - UI::Account::BalanceReconciliation labels + tooltips -> UI.account.balance_reconciliation.{labels,tooltips}.* - transactions/_transfer_match.html.erb (Auto-matched, A/M, Confirm/Reject match, Payment/Transfer is confirmed) -> transactions.transfer_match.* - AccountOrder labels (Name/Balance asc/desc) -> account_order.* keys with fallback to existing hardcoded labels. - Depository::SUBTYPES surface in account list -> depositories.subtypes.*.* - User role badge -> users.roles.* (admin / member / super_admin). - 110+ country names -> countries.* (config/locales/countries.ca.yml). Breadcrumb locale fix - Breadcrumbable was a before_action that ran before Localize's around_action switched I18n.locale, so default crumbs rendered in EN even when locale=ca. - Convert to helper_method that defers translation to render-time (when I18n.locale is already correct). Add all missing breadcrumb keys to ca + en. - Layouts switched from @breadcrumbs to breadcrumbs helper. Locale-aware helpers / formatters - ApplicationHelper#localized_ordinal: ordinalize that respects ca (1r/2n/3r/4t/Nè). Wired into preferences month_start_day select. - Family#moniker_label / moniker_label_plural: translate the default "Family"/ "Group" monikers via shared.family_moniker.* with fallback to the family's custom override. - Budget#name: use I18n.l for month_year/short/long instead of strftime("%B %Y") so the budget header date follows the active locale. Tooling - script/lt_check_ca.rb: batched LanguageTool checker (premium endpoint when LT_USERNAME/LT_API_KEY are set, free fallback otherwise), picky mode, motherTongue=en for false-friend detection. - lib/tasks/i18n_screenshot.rake: dev-only rake to set user.locale=ca and role=super_admin on the demo user so the i18n surfaces can be walked. Out of scope (pre-existing, not introduced here) - Native browser file input "Choose Files / No file chosen" (browser locale). - D3.js client-side chart x-axis dates (JS-side Intl.DateTimeFormat needed). - Sankey/donut labels = seed category names (data, not i18n). - 2 rails-i18n datetime/errors interpolation warnings inherited from config/locales/defaults/ca.yml. * fix(i18n): apply idiomatic Catalan review (3-agent + native review) Three parallel review agents flagged 203 findings (31 high / 73 medium / 99 low) across all 111 ca.yml files. This commit applies the high-severity bugs plus a curated subset of medium-impact fixes. Grammar / agreement - provider_sync_summary.health.stale_pending: `(exclòs)` -> `(exclosa/excloses)` to agree with feminine `transacció(s)`. - accounts.confirm_unlink.warning_no_sync: added reflexive `es` - `el compte ja no es sincronitzarà`. - sophtron_setup_required.heading: `no configurats` -> `sense configurar` (avoids broken agreement across "ID" masc. + "clau" fem.). - admin.sso_providers.form.errors_title: split into one/other pluralization keys (en + ca); singular `ha impedit` was wrong for count > 1. Brand consistency - IndexaCapital -> Indexa Capital (37 occurrences across one file). - Lunchflow -> Lunch Flow in two remaining places. Anglicisms / domain mistranslations - kraken_items setup_accounts.instructions: `ompliments d'operacions` (lit. dental/food fillings) -> `execucions d'operacions`. - settings kraken_panel.read_only_title: `Sincronització d'intercanvi` (swap/trade) -> `Sincronització només de lectura amb l'exchange`. - transactions convert_to_trade.security_custom + security_not_listed_hint: `cotització` (price quote) -> `ticker` (the EN field IS a ticker symbol). - loans.form.rate_type: `Tipus d'interès` collided with sibling interest_rate -> `Modalitat del tipus`. - brex_items.provider_panel.sandbox_note_html: `L'staging` (broken contraction) -> `el staging`. Idiom traps - coinbase/binance/kraken wait_for_sync: `acabi de sincronitzar` is ambiguous in CA (`acabar de + inf` reads as "has just done X") -> `acabi la sincronització`. - chats.ai_greeting.there: `a tothom` -> `''` (the EN fallback "Hey there" is singular; literal CA `tothom` is plural and wrong for 1:1 chat). - transactions.split_parent_row.split_label: `Divideix` (imperative) is wrong as a status badge -> `Divisió` (noun). - transactions.keep_both (2 occurrences): infinitive `mantenir ambdues` -> imperative `mantén-les totes dues` to match the sibling Yes/No buttons. - rules.clear_ai_cache: `Reinicia` (restart) -> `Buida` (empty/clear), which matches the success notice (`s'està netejant`). Moniker gender breakage (cross-file) %{moniker} is interpolated downcased from family.moniker_label and may resolve to feminine `família`/`llar` or masculine `grup`. Strings that hard-code a gendered article ('al teu %{moniker}', 'aquesta %{moniker}', 'aquest/a %{moniker}') broke on at least one branch. Restructured the affected sentences to drop the gendered determiner: - account_sharings.show.no_members - merchants.family_empty / family_title / provider_empty - registrations.new.join_family_title - settings.preferences.show.currencies_subtitle / sharing_subtitle - simplefin_items.select_existing_account.no_accounts_found - invitations.new.subtitle - invitation_mailer.invite_email.subject (mailers/) + body (views/) - snaptrade_items.providers.snaptrade.free_tier_warning Terminology consistency - models/account_statement/ca.yml attributes aligned with view-side forms: `Saldo d'obertura`/`Saldo de tancament` -> `Saldo inicial`/`Saldo final`; `Suggeriment de...` -> `Pista de...`. - account_statements.coverage.status.not_expected: `No s'esperava` -> `No previst` (status label, not past action). - account_statements.index.empty_unmatched: aligned with the section's own label `Safata sense aparellar`. - imports.create.document_provider_not_configured + document_upload_failed: `arxiu vectorial` -> `magatzem vectorial` (correct TermCat term). - coinstats_items blockchain gender: `els blockchains` / `un blockchain` -> `les blockchains` / `una blockchain` (feminine per TermCat). - accounts.account.remove_default: `Treu el predeterminat` -> `Treu com a predeterminat` (pairs with sibling `Estableix com a predeterminat`). - accounts.tax_treatments.tax_deferred: `Diferit fiscalment` (lit. calque) -> `Tributació diferida` (standard CA tax-accounting term). - settings.payments.show.currently_on_plan: `Actualment al` -> `Actualment al pla:` (was a fragment). Out of scope (review flagged, not applied here) - LOW-severity stylistic preferences (Veure vs Mostra, etc). - `models/category/ca.yml` default category names — seeded at family creation, not via I18n at runtime, so changes wouldn't affect existing families. - `models/period/ca.yml` short labels mixing EN (MTD/YTD) and CA (STD/MA) — needs a one-convention decision separately. * fix(i18n,ca): drop gendered article in period_activity + tighten cash-flow terms - pages.dashboard.investment_summary.period_activity: 'Activitat del %{period}' contracted 'del' = 'de el' (masc.sg.). %{period} resolves to mixed forms ('Setmana en curs' fem, 'Últims 30 dies' pl., 'Any en curs' apostrophe), so hard-coded 'del' was wrong on most labels. Replaced with 'Activitat — %{period}' (em-dash) to skip the contraction entirely. - pages.dashboard.outflows_donut.title / total_outflows: switched from bare 'Sortides' / 'Total de sortides' to 'Sortides de caixa' / 'Total de sortides de caixa' to match TermCat's precise term ('sortida de caixa' = cash outflow). * fix(i18n,ca): rephrase transfer source/destination amount labels 'Import d'origen' / 'Import de destinació' were literal calques of 'Source amount' / 'Destination amount'. In a multi-currency transfer form (sender/receiver in different currencies) the natural CA pair is 'Import enviat' / 'Import rebut'. * fix(i18n,ca): 'Dades en brut' -> 'Dades sense processar' The literal calque of 'Raw data' read as too technical for personal- finance UI. 'Dades sense processar' is the more natural Catalan equivalent for raw/unprocessed data files. * fix(i18n): localize Import col_sep label + separator options The CSV upload form rendered 'Col sep' (the auto-humanized attribute name) plus hardcoded English 'Comma (,)' / 'Semicolon (;)' options from Import::SEPARATORS. - activerecord.attributes.import.col_sep added (en + ca: 'Column separator' / 'Separador de columnes'). - Import.separator_options class method returns translated tuples; view switched from Import::SEPARATORS to Import.separator_options. - activerecord.attributes.import.col_seps.{comma,semicolon} added so the option labels follow the active locale. * fix(i18n,ca): drop moniker apposition in sharing/currencies section titles - sharing_title 'Compartició de %{moniker}' rendered as 'Compartició de Família' (a noun-noun apposition that's odd in CA) -> 'Compartició de comptes'. - sharing_subtitle replaced '%{moniker}' with 'entre els membres' so the sentence reads naturally and doesn't depend on moniker gender. - currencies_title 'Divises de %{moniker}' had the same apposition -> 'Divises'. Subtitle no longer references moniker either. * fix(i18n,ca): keep 'Self Hosting' untranslated Reverted 'Autoallotjament' / 'autoallotjada' / 'autoallotjats' usages to the original English 'Self Hosting' (sidebar label, breadcrumbs, hostings page title, chat assistant settings hint, redis configuration subheading, LLM usages cost-estimates description). The brand-style term reads more naturally in EN for technical users configuring their own deployment. * fix(i18n,ca): lowercase 'self hosting' (sentence case in labels) * fix(i18n): extract budget_categories stepper + allocation_progress strings Hardcoded English strings on the budget category editor: - 'Setup' / 'Categories' stepper labels in budgets/_budget_nav.html.erb - 'X% set' / '> 100% set' / 'left to allocate' / 'Budget exceeded by ...' in budget_categories/_allocation_progress.erb - '/m avg' caption + 'Shared' placeholder + 'Leave empty to share parent's budget' tooltip in budget_categories/_budget_category_form and _uncategorized_budget_category_form Extracted to: - budgets.budget_nav.{setup,categories} - budget_categories.allocation_progress.{percent_set,over_set,left_to_allocate,budget_exceeded_html} - budget_categories.budget_category_form.{monthly_average,shared_placeholder,shared_title} CA translations added; EN keys mirror the prior literals. * chore(i18n): drop translation tooling from PR These were dev-only helpers used during the Catalan translation pass: - script/lt_check_ca.rb: LanguageTool API checker (premium/free endpoint, picky mode, batching). Useful for ongoing locale QA but shouldn't ship in this feature PR. - lib/tasks/i18n_screenshot.rake: rake task that flips user.locale and role on the demo user for walking the i18n surfaces locally. Both stay available locally; pulled out of the PR scope. * fix(i18n): apply PR review feedback (CodeRabbit + Codex) - balance_reconciliation crypto_items: use :end_balance_crypto tooltip (was :end_balance_investment). Added new UI.account.balance_reconciliation.tooltips.end_balance_crypto key in en + ca. - doorkeeper.ca.yml confidentiality.no: was YAML boolean false, now string 'No'. - views/categories: 'Poor contrast, choose darker color or' continued with hardcoded 'auto-adjust.' button text; extracted to categories.form.auto_adjust key (en + ca). - imports.create.document_upload_failed: 'a l'magatzem' was broken contraction -> 'al magatzem'. - invitation_mailer body + mailer subject: 'unir-se' -> 'unir-te' (was 3rd person, should be 2nd to match the rest of the copy). - 7 strings across mercury_items / sophtron_items / simplefin_items / lunchflow_items / brex_items / indexa_capital_items / other_assets: 'se sincronitzaran' -> 'es sincronitzaran', 'se segueixen' -> 'es segueixen' (correct reflexive pronoun before consonants). - settings.providers.status: key was 'false' (YAML-coerced), now 'off' to match settings/en.yml status.off used in view lookups. - sophtron_items.sophtron_setup_required.message: stripped trailing blank line from the quoted scalar. - settings/profiles/show.html.erb: switched 'family_moniker == "Group"' branch checks to 'Current.family&.moniker == "Group"'. After Family#moniker_label started returning translated values, callers using the display label for branching would render the household copy for group families in ca. Compare the stored sentinel instead. - Did not apply CodeRabbit's webauthn 'eliminada' -> 'desada' suggestion: the key is wired to the destroy action (verified at settings/webauthn_credentials_controller.rb:55), so 'eliminada' is correct.	2026-05-19 13:37:10 +02:00
Sure Admin (bot)	4fd460d551	Add Actual Budget CSV import flow (#1830) ... * Add Actual Budget CSV import flow * Address Actual import review feedback	2026-05-18 18:38:53 +02:00
Brendon ScheiberandKiloClaw	0c126b1674	feat(i18n): extract hardcoded English strings to locale files (#1806) ... * Extract hardcoded strings to i18n Replace numerous hardcoded English strings with I18n lookups (t / I18n.t) across controllers, views, helpers, and components, and convert model validation error messages to symbol keys. Added multiple locale files under config/locales for models and views. This centralizes user-facing notices/alerts, UI text, import/validation messages, and prepares the app for localization and easier translation maintenance. * Update en.yml * Update preview-cleanup.yml * Revert "Update preview-cleanup.yml" This reverts commit 1ba6d3c34c. * test: align i18n assertions with translated messages * Standardize balance error key and tweak locales Replace SophtronAccount's :requires_balance error key with :no_balance and update related locale strings for sophtron, plaid, and simplefin accounts to use the new key and clearer copy. Also switch the QIF upload redirect notice to use a relative translation key (t('.qif_uploaded')), remove an unused SSO providers help line, and fix a trailing-newline/whitespace issue in the subscriptions locale. These changes standardize validation keys and improve translation consistency and messaging. --------- Co-authored-by: KiloClaw <kiloclaw@openclaw.ai>	2026-05-17 09:52:49 +02:00
ghostandJuan José Mata	e59235fdc5	feat(statements): add account statement vault (#1753) ... * feat(statements): add account statement vault Add web-only statement uploads, account linking, duplicate detection, and per-account coverage/reconciliation checks without mutating transactions. Extend ActiveStorage authorization and targeted tests for family/account scoping. * fix(statements): return deleted account statements to inbox Preserve linked statement records when an account is deleted by moving them back to the unmatched inbox, then expand coverage for upload validation, sanitized parser metadata, unavailable reconciliation, and missing-month coverage. * fix(statements): harden vault upload review flows Address review and security findings in the statement vault by preserving sanitized parser metadata, failing closed on orphaned statement blobs, avoiding account_id mass assignment permits, and adding regression coverage for link/delete edge cases. * fix(statements): harden vault upload and access controls * fix(statements): address vault hardening review * fix(statements): address vault review feedback Prioritize SHA-256 duplicate detection while preserving MD5 fallback for legacy rows. Remove free-form account notes from statement matching, document direct account-destroy unlinking, and add year-selectable historical coverage with muted out-of-range months. * fix(statements): harden vault review follow-ups Clarify legacy MD5 checksum use, whitelist statement balance helper dispatch, and preserve sanitized parser metadata. Hide statement management controls from read-only viewers while keeping server-side authorization unchanged. * fix(statements): repair settings system coverage Allow the changelog provider lookup in the self-hosting settings system test, include Statement Vault in settings navigation coverage, and align the feature title casing. Update the devcontainer so ActiveStorage and parallel system tests can run in the documented environment. * fix(statements): move vault beside accounts Place Statement Vault with account settings instead of between Imports and Exports. Keep settings footer ordering and system navigation coverage aligned, including the non-admin visibility guard. * fix(statements): address vault review cleanup Resolve CodeRabbit review feedback for statement upload validation, duplicate race handling, account statement matching semantics, metadata detection, ActiveStorage authorization tests, and small UI/style cleanups. * fix(statements): address vault cleanup review * fix(statements): deduplicate vault style helpers * fix(statements): close vault review follow-ups * fix(statements): refresh schema after upstream rebase * fix(statements): process vault uploads sequentially * fix(statements): close vault review follow-ups * fix(statements): scope vault index to accessible accounts * fix(statements): harden statement vault readiness Squash the statement vault migration hardening into the feature migration, tighten Active Storage authorization edge cases, bound CSV metadata detection, and add real PDF fixture coverage for stored statements. Validation: targeted statement/auth/controller/provider tests, full Rails suite, system tests, RuboCop, Biome, Brakeman, Zeitwerk, importmap audit, npm audit, ERB lint, CodeRabbit, and Codex Security all passed locally. * fix(statements): close vault review follow-ups Move statement unlinking to after account destroy commit, keep Kraken account creation on the shared crypto helper, and add statement metadata length limits with DB checks. Validation: fresh devcontainer with fresh DB via db:prepare, focused account/statement/Kraken/Binance tests, RuboCop, Brakeman, Zeitwerk, git diff --check, CodeRabbit, and Codex Security passed before commit. * fix(statements): address vault scan follow-ups Move statement tab data setup out of the ERB partial, harden reconciliation labels and coverage initialization, and tighten statement schema constraints. Validation: CodeRabbit and Codex Security reviewed the current PR diff; Rails focused tests, full Rails tests, system tests, RuboCop, Brakeman, Zeitwerk, ERB lint, npm lint, importmap audit, npm audit, and git diff --check passed. * fix(statements): defer vault tab loading --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>	2026-05-13 21:05:11 +02:00
ghostandJuan José Mata	95f6451b39	feat(sync): add Brex provider connections (#1752) ... * feat(sync): add Brex provider schema Adds Brex item and account tables with per-family credentials, scoped upstream account uniqueness, encrypted token storage, and sanitized provider payload columns. * feat(sync): add Brex provider core Adds Brex item/account models, provider client and adapter support, family connection helpers, and provider enum registration for read-only Brex cash and card data. * feat(sync): add Brex import pipeline Adds Brex account discovery, linked-account sync, cash/card balance processors, transaction import, sanitized metadata handling, and idempotent provider entry processing. * feat(sync): add Brex connection flows Adds Mercury-style Brex connection management, explicit item-scoped account selection and linking, settings provider UI, account index visibility, localized copy, and per-item cache handling. * test(sync): cover Brex provider workflows Adds targeted coverage for Brex provider requests, adapter config, item/account guards, importer behavior, entry processing, and Mercury-style controller flows. * fix(sync): align Brex API edge cases Tightens Brex account fetching against the official card-account response shape, sends transaction start filters as RFC3339 date-times, and keeps provider error bodies out of user-facing messages while expanding provider client guard coverage. * fix(sync): harden Brex provider integration Restrict Brex API base URLs to official hosts, tighten account-selection UI behavior, and add tests for invalid credentials, cache scoping, and provider setup edge cases. * test(sync): avoid Brex secret-shaped fixtures * refactor(sync): extract Brex account flows * fix(sync): address Brex provider review feedback * fix(sync): address Brex review follow-ups Move remaining Brex review cleanup into focused model behavior, tighten link/setup edge cases, localize summaries, and add regression coverage from CodeRabbit feedback. Also records the security-review pass as no-findings after diff-scoped inspection and Brakeman validation. * refactor(sync): split Brex account flow controllers Route Brex account selection and setup actions through small namespaced controllers while keeping existing URLs and helpers stable. Business flow remains in BrexItem::AccountFlow; the main Brex item controller now only handles connection CRUD, provider-panel rendering, destroy, and sync. * fix(sync): address Brex CodeRabbit review * fix(sync): address Brex follow-up review * fix(sync): address Brex review follow-ups * fix(sync): address Brex sync review findings * fix(sync): polish Brex review copy and errors * fix(sync): register Brex provider health * fix(sync): polish Brex bank sync presentation * fix(sync): address Brex review follow-ups * fix(sync): tighten Brex setup params * test(api): stabilize usage rate-limit window * fix(sync): polish Brex setup flow nits * fix(sync): harden Brex setup params * fix(sync): finalize Brex review cleanup --------- Signed-off-by: Juan José Mata <juanjo.mata@gmail.com> Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>	2026-05-13 18:13:48 +02:00
Gian-Reto Tarnutzer	ce5d7dd736	Add Interactive Brokers Provider (#1722) ... * Display multi-currency holdings correctly * Implement IBKR provider * Fix: Use historical exchange rate for historical prices * Add brokerage exchange rate for trades * Sync historical balances from IBKR * Add logos in activity history * Fix privacy mode blur in account view * Improve IBKR XML Flex report parser errors	2026-05-12 23:45:19 +02:00
ghost	be598aecf0	feat(providers): add Kraken exchange sync (#1759) ... * feat(providers): add Kraken exchange sync Adds family-scoped Kraken API-key connections, read-only balance and trade import, account setup/linking flows, provider status wiring, and focused test coverage. Closes #1758 * test(providers): avoid Kraken sample secret false positive * fix(providers): address Kraken review findings * fix(providers): address Kraken review cleanup * test(imports): stabilize transaction import ordering	2026-05-12 00:22:37 +02:00