Ahoy lifecycle tracking silently drops changes made with no Current actor

[maebeale]

🤖 From Claude:

AhoyTrackable (included in ApplicationRecord) tracks create/update/destroy for every model, but track_lifecycle_event opens with:

return unless Current.user || Current.source

Current.user is only set for a signed-in request (ApplicationController#set_current_user), and Current.source is set in exactly two places (public_forms_controller, events/public_registrations_controller). Everything else that writes without a signed-in user leaves no trace at all — no event, no error, no log line.

Verified

Calling scholarship.accept_agreement!(by: "recipient") with no actor set:

Actor	Buffered events
none	[]
Current.user set	update.scholarship, create.scholarship_agreement_response
Current.source set	update.scholarship, create.scholarship_agreement_response

Where this bites today

• Scholarship accept/decline on the public callout. Events::CalloutsController does skip_before_action :authenticate_user! and never sets Current.source, so a logged-out recipient accepting or declining their agreement produces no Ahoy event. The bespoke scholarship_agreement_responses log is currently the only record of it.
• Anything outside a request — jobs, rake tasks, console, webhooks (Stripe). These are dropped twice over: the actor guard, and Analytics::LifecycleBuffer only flushing in ApplicationController's after_action, so a buffered event outside a request is never written.

Recommendation

Close the request-shaped hole narrowly rather than removing the guard.

1. Default a source for every actorless request — one line in ApplicationController: set Current.source when there's no signed-in user, so any public flow (present or future) is covered without each controller having to remember. Named per controller where it matters, generic otherwise.
2. Opt non-request contexts in explicitly — jobs, webhooks, and rake tasks set their own Current.source ("stripe_webhook", "job:x"), and LifecycleBuffer needs a flush path that doesn't depend on a controller.
3. Don't just delete the guard. Seeds, imports, and the test suite would start emitting events in volume, which is presumably why it's there.

Acceptance

• A logged-out recipient accepting a scholarship agreement produces an Ahoy event attributed to a named source.
• A model write inside a job produces an event (or is a documented, deliberate exclusion).
• Specs cover both, so the guard can't silently re-open the hole.

[maebeale]

🤖 From Claude: Concrete cases found while auditing what else goes unrecorded — all the same root cause, so noting them here rather than opening duplicates.

Writes outside a request are dropped twice over. Even with an actor set, Analytics::LifecycleBuffer only flushes in ApplicationController's after_action, so anything buffered outside a request is never written. That silences:

• IssueMembershipInvoicesJob — renewal invoices appear with no origin
• ReconcileCheckoutPaymentsJob — flips payment_unresolved on registrations
• every rake task (import_stories, migrate_*, convert_age_ranges) and every console fix

Stripe is invisible. Pay::Engine is mounted at /pay, so webhooks run through the engine's controller, not ours — no Current, no flush. Charges and anything the webhook handlers touch leave no event, even though Pay::Charge does inherit our ApplicationRecord.

The public write paths, listed. Of the 27 controllers that skip_before_action :authenticate_user!, only public_forms and events/public_registrations set Current.source. In events/callouts_controller alone that loses: CE opt-in (line 153), attendance sign-in and sign-out (176, 195), scholarship accept/decline, and a registrant editing their own form answer (402) — i.e. the registrant's own actions, which is the part we have no other record of.

So the fix needs both halves: a source for actorless requests and a flush path that does not depend on a controller.