hecks 0.3.0 → 1.0.1

data/lib/hecks.rb

@@ -20,7 +20,6 @@ require_relative "hecks/bluebook"
 require_relative "hecks/router"
 
 require_relative "hecks/runtime"
-require_relative "hecks/translation"
 require_relative "hecks/adapters"
 require_relative "hecks/projector"
 # AFTER the projector registry and its `Target` mixin are both real —
@@ -31,6 +30,7 @@ require_relative "hecks/projections"
 # `Ports::Clock` (fills a staleness rule's `now` at the door) both exist.
 require_relative "hecks/facade/cli_door"
 require_relative "hecks/facade/cli_runner"
+require_relative "hecks/storehouse"
 require_relative "hecks/framework"
 require_relative "hecks/embryonaut_bluebook"
 
@@ -88,14 +88,39 @@ module Hecks
     # against a real Governance `RoleAssignment` instead, once the
     # command's domain has Governance attached — see
     # `CommandRules::Authorization`'s own header.
-    def as_caller(role:, actor_id: nil, &block) = Runtime.as_caller(role: role, actor_id: actor_id, &block)
+    #
+    # `as_of` and `scope` are OPTIONAL too, same shape — see
+    # `Runtime.as_caller`'s own header for what each does.
+    def as_caller(role:, actor_id: nil, as_of: nil, scope: nil, &block)
+      Runtime.as_caller(role: role, actor_id: actor_id, as_of: as_of, scope: scope, &block)
+    end
 
     def bluebook(name, version: nil, &block)
       collect(:add_bluebook, Bluebook::DSL::BluebookBuilder.build(name, version: version, &block))
     end
 
     def hecksagon(name, &block) = collect(:add_hecksagon, Bluebook::DSL::HecksagonBuilder.build(name, &block))
-    def port(name, &block) = collect(:add_port, Bluebook::DSL::PortBuilder.build(name, &block))
+    # REPOINTED TO DomainPortBuilder — the migration DomainPort's own
+    # class comment names as its goal, now landed for the top-level
+    # `.port` file callers too (the aggregate-scoped `Thing.port(...)`,
+    # binding_proxy.rb, already went through this builder). Every real
+    # `.port` file only ever spells `verb`/`signal` (no `.port` file
+    # declares operations — that's DomainPort's own newer shape), and
+    # DomainPortBuilder's own bare-verb branch produces the exact same
+    # `Port` object PortBuilder itself did (dsl_spec.rb's own byte-
+    # identity check) — a pure repoint, no behavior change for any
+    # existing caller reading `.verb`/`.signal` off what comes back.
+    #
+    # `legacy_bare_port: true` — the ONE real semantic gap this repoint
+    # would otherwise open: `PortBuilder#build` never refused a
+    # completely empty build (no verb, no signal even), a real shape
+    # dsl_spec.rb's own "a port" tests exercise (`signal`-only, no
+    # `verb`). `DomainPortBuilder`'s own "declares no verb and no
+    # operations" refusal is real and correct for its OTHER two callers
+    # (`BindingProxy#port`, `HecksagonBuilder#port_impl`) — only this,
+    # the literal top-level `.port` file entry point, keeps the older,
+    # looser rule (see `DomainPortBuilder#initialize`'s own comment).
+    def port(name, &block) = collect(:add_port, Bluebook::DSL::DomainPortBuilder.build(name, legacy_bare_port: true, &block))
     def adapter(name, &block)   = collect(:add_adapter, Bluebook::DSL::AdapterBuilder.build(name, &block))
     def world(name, &block)     = collect(:add_world, Bluebook::DSL::WorldBuilder.build(name, &block))
 

data/lib/rubocop/cop/hecks/fallback_hash_lookup.rb

@@ -0,0 +1,90 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # FLAGS THE EXACT SHAPE behind 8+ real bugs already fixed one at a
+      # time across this codebase (Tiers 1-5): `holder[a] || holder[b]` —
+      # the SAME receiver looked up by two different keys, falling back to
+      # the second lookup whenever the first is falsy. `||` cannot tell a
+      # genuinely STORED `false` from a MISSING key — both are falsy in
+      # Ruby — so a real `false` sitting at `holder[a]` is silently
+      # discarded and `holder[b]` (usually absent, so `nil`) is returned
+      # instead. Every one of those 8+ instances was the identical
+      # AST shape with a different pair of keys (most commonly
+      # `h[k.to_sym] || h[k]`, reading a value that could arrive keyed
+      # either by symbol or by string off the wire).
+      #
+      # THE FIX THIS CODEBASE ALREADY CONVERGED ON — see
+      # `lib/hecks/query_specification/field_path.rb#read`, the shared
+      # digger this whole bug class got consolidated behind: check
+      # `key?` FIRST, never fall back through `||`.
+      #
+      #   sym = segment.to_sym
+      #   return current.key?(sym) ? current[sym] : current[segment]
+      #
+      # That method's own comment says it plainly: "`key?` first, never
+      # `||`, because `||` falls through a genuinely-stored `false` to
+      # the OTHER spelling (usually absent) and returns `nil` instead."
+      # This cop exists so the NEXT `holder[a] || holder[b]` gets caught
+      # mechanically, before it becomes bug #9, rather than found by
+      # hand again in a future audit.
+      #
+      # SCOPED TO THE `[]`/`[]` SHAPE ONLY, deliberately — a receiver
+      # method-call is compared by AST structure (`==`, which ignores
+      # source location), so `hash[a] || hash[b]` is flagged whether
+      # `hash` is a local variable, a method call, or a constant, but
+      # `a[k] || b[k]` (DIFFERENT receivers) and `value || default`
+      # (an ordinary default, not a second lookup at all) are both left
+      # alone — neither one can silently drop a stored `false` the way
+      # a same-receiver double-lookup can.
+      #
+      # @example
+      #   # bad — a stored `false` at hash[:active] is discarded
+      #   hash[:active] || hash["active"]
+      #
+      #   # good
+      #   hash.key?(:active) ? hash[:active] : hash["active"]
+      #
+      #   # good — or the shared digger this codebase already has
+      #   Hecks::QuerySpecification::FieldPath.dig(hash, "active")
+      class FallbackHashLookup < Base
+        MSG = "`%<receiver>s[...] || %<receiver>s[...]` falls back to the second lookup " \
+              "whenever the first is falsy — but `||` cannot tell a genuinely stored `false` " \
+              "apart from a missing key, so a real `false` at `%<receiver>s[%<lhs_key>s]` is " \
+              "silently discarded in favor of `%<receiver>s[%<rhs_key>s]` instead of being " \
+              "returned. Use `%<receiver>s.key?(%<lhs_key>s) ? %<receiver>s[%<lhs_key>s] : " \
+              "%<receiver>s[%<rhs_key>s]`, or a shared digger (see `key?` in " \
+              "`Hecks::QuerySpecification::FieldPath#read`), instead."
+
+        # @!method bracket_lookup(node)
+        def_node_matcher :bracket_lookup, "(send $_receiver :[] $_key)"
+
+        def on_or(node)
+          lhs_receiver, lhs_key = bracket_lookup(node.lhs)
+          return unless lhs_receiver
+
+          rhs_receiver, rhs_key = bracket_lookup(node.rhs)
+          return unless rhs_receiver
+
+          # THE STRUCTURAL EQUALITY CHECK — `==` on an AST node (from the
+          # `ast` gem `Node` this compiles down to) compares `type` and
+          # `children` recursively and ignores source location, so
+          # `hash[a] || hash[b]` matches even though the two `hash`
+          # sub-nodes are two distinct node OBJECTS parsed from two
+          # different source ranges. A different receiver on each side
+          # (`a[k] || b[k]`) fails this check and is correctly left alone.
+          return unless lhs_receiver == rhs_receiver
+
+          add_offense(
+            node,
+            message: format(
+              MSG,
+              receiver: lhs_receiver.source,
+              lhs_key:  lhs_key.source,
+              rhs_key:  rhs_key.source
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hecks/sequential_hash_rename_in_loop.rb

@@ -0,0 +1,128 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # FLAGS `hash[new] = hash.delete(old)` INSIDE A LOOP — a method that
+      # both READS and WRITES the same hash across a loop's iterations,
+      # in the specific rename/permutation shape this codebase has
+      # already lost real data to once.
+      #
+      # THE BUG THIS IS THE MECHANICAL FOLLOW-UP TO (M27,
+      # docs/audits/2026-08-10-main-bug-audit.md,
+      # docs/audits/2026-08-11-bug-triage.md; fixed in
+      # `Hecks::Ports::Persistence::Lineage#apply_renames`,
+      # lib/hecks/ports/persistence/plugins/era/lineage.rb): a rename
+      # rule set applied one rule at a time, `state[new_name] =
+      # state.delete(old_name)` per rule, against the SAME hash it was
+      # reading from — so a swap (`rename :a, to: :b` alongside `rename
+      # :b, to: :a`) on `{a: 1, b: 2}` collapsed to `{a: 1}`. The first
+      # rule wrote `b: 1` (clobbering the real `b: 2`) before the second
+      # rule ever got a chance to read the value that was supposed to
+      # move to `:a` — sequential edits stepping on each other, not the
+      # simultaneous permutation a rename set actually means. The same
+      # shape loses data identically for ANY chain longer than one link
+      # (`a->b->c->a`), not just a two-element swap.
+      #
+      # THE FIX THIS COP POINTS AT — snapshot every old key's value
+      # FIRST, delete all old keys, THEN write all new keys, so no
+      # rename in the pass ever reads a key this same pass has already
+      # written:
+      #
+      #   snapshot = renames.filter_map { |old_name, new_name| [old_name, new_name, state[old_name]] if state.key?(old_name) }
+      #   snapshot.each { |old_name, _new_name, _value| state.delete(old_name) }
+      #   snapshot.each { |_old_name, new_name, value| state[new_name] = value }
+      #
+      # WHAT THIS COP DOES NOT ATTEMPT — the general checklist item is
+      # broader than any AST pattern can safely automate ("any method
+      # that both reads and writes the same collection across a loop"
+      # covers plenty of correct code too — accumulating into a result
+      # hash, memoizing into a cache). This cop stays narrow and
+      # precise: only the EXACT `recv[x] = recv.delete(y)` shape, same
+      # receiver both sides, inside something that iterates. A single
+      # rename outside any loop is not this bug (nothing else can have
+      # run first); `hash.store(...)` instead of `hash[...] =`, or
+      # `hash.delete(...)` whose result is not immediately written back
+      # into the SAME hash, are not this shape either and are left to
+      # the broader code-review checklist item, not this cop.
+      #
+      # @example
+      #   # bad — one rule at a time against the hash it reads from
+      #   renames.each do |old_name, new_name|
+      #     state[new_name] = state.delete(old_name)
+      #   end
+      #
+      #   # good — snapshot first, then delete, then write: one permutation
+      #   snapshot = renames.filter_map { |old_name, new_name| [old_name, new_name, state[old_name]] if state.key?(old_name) }
+      #   snapshot.each { |old_name, _new_name, _value| state.delete(old_name) }
+      #   snapshot.each { |_old_name, new_name, value| state[new_name] = value }
+      class SequentialHashRenameInLoop < Base
+        MSG = "`%<recv>s[new] = %<recv>s.delete(old)` inside a loop applies one rename at a time against the " \
+              "SAME hash it reads from — a swap (`{a: :b, b: :a}`) on `{a: 1, b: 2}` collapses to `{a: 1}` " \
+              "because the first rule's write clobbers the second rule's read target before it runs (the exact " \
+              "bug fixed for Lineage#apply_renames). Snapshot every old key's value FIRST, delete all old keys, " \
+              "then write all new keys, so the pass applies as one simultaneous permutation instead of a " \
+              "sequence of edits each stepping on the last."
+
+        RESTRICT_ON_SEND = [:[]=].freeze
+
+        LOOP_METHODS = %i[
+          each each_pair each_with_index each_with_object with_index
+          map collect flat_map each_entry each_key each_value
+          inject reduce each_slice each_cons
+        ].freeze
+
+        # `hash[new_name] = hash.delete(old_name)` parses as a `send`
+        # node (indexed assignment has no dedicated node type in Ruby's
+        # own grammar): `(send recv :[]= new_key (send recv2 :delete
+        # old_key))`. `$_recv`/`$_recv2` are captured (not merely
+        # matched) so `same_receiver?` below can compare them
+        # structurally — node-pattern has no built-in "same subtree
+        # twice" backreference, so the equality check is real Ruby, not
+        # the pattern itself.
+        def_node_matcher :rename_write?, <<~PATTERN
+          (send $_recv :[]= _new_key (send $_recv2 :delete _old_key))
+        PATTERN
+
+        def on_send(node)
+          rename_write?(node) do |recv, recv2|
+            next unless same_receiver?(recv, recv2)
+            next unless in_loop?(node)
+
+            add_offense(node, message: format(MSG, recv: recv.source))
+          end
+        end
+
+        private
+
+        # Structural equality (type + children, recursively) — exactly
+        # what `Parser::AST::Node#==` already gives, ignoring source
+        # location, so `state` vs `state` (two separate `send(nil,
+        # :state)` reader calls) and `@state` vs `@state` both count as
+        # "the same collection", not just an identical local variable.
+        def same_receiver?(recv, recv2)
+          recv == recv2
+        end
+
+        # Walks every ancestor looking for something that iterates —
+        # not just the immediate parent, since the offending assignment
+        # may sit one or more non-loop nodes deep inside a loop's block
+        # (an `if` guarding it, say) and still carries the exact same
+        # hazard.
+        def in_loop?(node)
+          node.each_ancestor(:block, :numblock, :for, :while, :until, :while_post, :until_post).any? do |ancestor|
+            loop_ancestor?(ancestor)
+          end
+        end
+
+        def loop_ancestor?(ancestor)
+          case ancestor.type
+          when :for, :while, :until, :while_post, :until_post
+            true
+          when :block, :numblock
+            send_node = ancestor.send_node
+            send_node.send_type? && LOOP_METHODS.include?(send_node.method_name)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hecks/thread_shared_ivar_mutation.rb

@@ -0,0 +1,160 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # FLAGS PLAIN `@ivar` MUTATION inside a class this codebase already
+      # knows is a thread-shared singleton — one `Dispatcher`/`Registry`
+      # instance lives for the life of a boot and is dispatched through
+      # from every thread of a Puma worker pool (or any other multi-
+      # threaded host), so a plain instance variable on either class is
+      # shared, mutable state with no per-thread or mutex-guarded
+      # isolation at all.
+      #
+      # THIS IS THE MECHANICAL FOLLOW-UP to a real bug already fixed here
+      # (see `dispatcher.rb`'s own `#reenter` comment, and
+      # `spec/runtime/dispatcher_spec.rb`): `@reaction_depth` used to be a
+      # plain ivar on `Dispatcher`, so two threads' concurrent top-level
+      # dispatches corrupted each other's view of "how deep into a
+      # reaction cascade am I". The fix moved that one ivar to
+      # `Thread.current[:hecks_reaction_depth]`. This cop exists so the
+      # NEXT plain ivar someone adds to either class gets flagged before
+      # it becomes the next instance of the same bug, rather than after.
+      #
+      # SCOPED NARROWLY ON PURPOSE — by class name
+      # (`Hecks::Runtime::Dispatcher`/`Hecks::Runtime::Registry`), not by
+      # blanket-flagging every ivar mutation in the codebase. Most classes
+      # in this codebase are NOT shared across threads (a fresh value
+      # object per call, a builder used once at boot) and ivar mutation
+      # there is completely ordinary Ruby with no hazard behind it at
+      # all — flagging it everywhere would be noise nobody trusts, the
+      # same reasoning `.rubocop.yml`'s own header gives for every other
+      # cop in this repo.
+      #
+      # WHAT COUNTS AS "PLAIN": `@ivar = ...`, `@ivar ||= ...`, `@ivar +=
+      # ...`, `@ivar << ...`, `@ivar[k] = v`. `initialize` is exempt — an
+      # ivar being SET UP for the first time, before any other thread can
+      # possibly hold a reference to this object, is not the hazard (see
+      # `Registry#initialize`'s own `@saga_mutex = Mutex.new`, which this
+      # cop must not flag). `Thread.current[...]`-backed state and a
+      # `Mutex`-guarded critical section are exactly the two idioms this
+      # codebase has already established for this — see `Dispatcher
+      # #reenter` and `Registry#saga_mutex` respectively — so the message
+      # points at both rather than inventing a third.
+      #
+      # @example
+      #   # bad
+      #   class Dispatcher
+      #     def reenter(verb)
+      #       @reaction_depth = @reaction_depth.to_i + 1
+      #     end
+      #   end
+      #
+      #   # good
+      #   class Dispatcher
+      #     def reenter(verb)
+      #       Thread.current[:hecks_reaction_depth] = Thread.current[:hecks_reaction_depth].to_i + 1
+      #     end
+      #   end
+      class ThreadSharedIvarMutation < Base
+        MSG = "`%<ivar>s` is a plain instance variable mutated outside `initialize` on " \
+              "%<klass>s, which is shared across every thread dispatching through it " \
+              "(a Puma worker pool, say) — two concurrent threads would corrupt each " \
+              "other's view of it, the exact bug already fixed for `Dispatcher#reaction_depth` " \
+              "(see dispatcher.rb's `#reenter`). Use `Thread.current[:...]` for per-thread " \
+              "state, or a `Mutex`-guarded critical section (`Registry#saga_mutex`) if the " \
+              "state genuinely must be shared."
+
+        THREAD_SHARED_CLASSES = ["Dispatcher", "Registry"].freeze
+
+        RESTRICT_ON_SEND = [:<<, :[]=].freeze
+
+        def on_ivasgn(node)
+          # A PLAIN `@x = 1` parses as `(ivasgn :@x (int 1))` — two
+          # children. The commissioner also visits the BARE `(ivasgn :@x)`
+          # node nested one level inside an `op_asgn`/`or_asgn` (`@x += 1`,
+          # `@x ||= 1`) as its own `ivasgn` node with only one child — that
+          # one is handled by `on_op_asgn`/`on_or_asgn` below instead, so
+          # it's skipped here to avoid double-reporting the same mutation.
+          return unless node.children.size == 2
+
+          check(node, node.children.first)
+        end
+
+        def on_op_asgn(node)
+          # `@x += 1` parses as `(op_asgn (ivasgn :@x) :+ (int 1))` — the
+          # target is an `ivasgn` node carrying JUST the name (no value
+          # child, unlike a plain `@x = 1`), not an `ivar` node.
+          ivar_node = node.children.first
+          return unless ivar_node.is_a?(RuboCop::AST::Node) && ivar_node.ivasgn_type?
+
+          check(node, ivar_node.children.first)
+        end
+
+        def on_or_asgn(node)
+          on_op_asgn(node)
+        end
+
+        def on_send(node)
+          return unless RESTRICT_ON_SEND.include?(node.method_name)
+
+          receiver = node.receiver
+          return unless receiver
+
+          # `@ivar << x` — the receiver IS the ivar.
+          # `@ivar[k] = v` — the receiver is a `send(@ivar, :[], k)`, whose
+          # own receiver is the ivar (`node.receiver.receiver`).
+          ivar_node = if receiver.ivar_type?
+                        receiver
+                      elsif receiver.send_type? && receiver.receiver&.ivar_type?
+                        receiver.receiver
+                      end
+          return unless ivar_node
+
+          check(node, ivar_node.children.first)
+        end
+
+        private
+
+        def check(node, ivar_name)
+          return unless inside_thread_shared_class?(node)
+          return if inside_initialize?(node)
+
+          add_offense(node, message: format(MSG, ivar: ivar_name, klass: enclosing_class_name(node)))
+        end
+
+        def inside_thread_shared_class?(node)
+          !!enclosing_class_name(node)&.then { |name| THREAD_SHARED_CLASSES.include?(name) }
+        end
+
+        # Walks outward to the nearest enclosing `class` node and returns
+        # its own short name (`Dispatcher`, not the fully-qualified
+        # `Hecks::Runtime::Dispatcher`) — good enough to match this repo's
+        # own one-class-per-file layout without needing full namespace
+        # resolution, and avoids a false negative on `class Dispatcher`
+        # bodies that reopen the class from inside the `Hecks::Runtime`
+        # module (this repo's actual style) as much as one written as
+        # `class Hecks::Runtime::Dispatcher`.
+        def enclosing_class_name(node)
+          klass = node.each_ancestor(:class).first
+          return nil unless klass
+
+          const_node = klass.identifier
+          const_node.const_name.to_s.split("::").last
+        end
+
+        # `initialize` is where an ivar is set up for the first time —
+        # before this object has been handed to a caller at all, so no
+        # other thread can hold a reference to mutate concurrently with
+        # it. Also exempts `initialize` methods defined on an object
+        # reopened via `class << self` or nested module — `each_ancestor`
+        # naturally stops at the nearest enclosing `def`, matching Ruby's
+        # own method-scoping.
+        def inside_initialize?(node)
+          def_node = node.each_ancestor(:def, :defs).first
+          return false unless def_node
+
+          def_node.method?(:initialize)
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Chris Young
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-25 00:00:00.000000000 Z
+date: 2026-08-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prism
@@ -67,21 +67,6 @@ files:
 - lib/hecks/adapters/driven/postgres/codec.rb
 - lib/hecks/adapters/driven/postgres/schema_builder.rb
 - lib/hecks/adapters/driven/postgres_era.adapter
-- lib/hecks/adapters/driven/postgres_era.rb
-- lib/hecks/adapters/driven/postgres_era/lineage.rb
-- lib/hecks/adapters/driven/postgres_era/lineage/era_store.rb
-- lib/hecks/adapters/driven/postgres_era/lineage/field_cache.rb
-- lib/hecks/adapters/driven/postgres_era/lineage/head_compiler.rb
-- lib/hecks/adapters/driven/postgres_era/lineage/mint_transaction.rb
-- lib/hecks/adapters/driven/postgres_era/lineage/provisioning.rb
-- lib/hecks/adapters/driven/postgres_era/lineage/resumable_backfill.rb
-- lib/hecks/adapters/driven/postgres_era/lineage/tail_merge.rb
-- lib/hecks/adapters/driven/postgres_era/lineage/transform_installer.rb
-- lib/hecks/adapters/driven/postgres_era/lineage_manager.rb
-- lib/hecks/adapters/driven/postgres_era/lineage_manager/coverage_check.rb
-- lib/hecks/adapters/driven/postgres_era/lineage_manager/era_resolver.rb
-- lib/hecks/adapters/driven/postgres_era/lineage_manager/merge_coordinator.rb
-- lib/hecks/adapters/driven/postgres_era/lineage_manager/minter.rb
 - lib/hecks/adapters/driven/prism.adapter
 - lib/hecks/adapters/driven/prism.rb
 - lib/hecks/adapters/driven/secure_random_identity.adapter
@@ -155,6 +140,7 @@ files:
 - lib/hecks/bluebook/dsl/world_builder.rb
 - lib/hecks/bluebook/entity.rb
 - lib/hecks/bluebook/expression.rb
+- lib/hecks/bluebook/expression/ast_json.rb
 - lib/hecks/bluebook/expression/canonical_form.rb
 - lib/hecks/bluebook/expression/evaluator.rb
 - lib/hecks/bluebook/expression/projection.json
@@ -213,6 +199,7 @@ files:
 - lib/hecks/forms/index_renderer.rb
 - lib/hecks/forms/page.rb
 - lib/hecks/forms/params.rb
+- lib/hecks/forms/port_argument.rb
 - lib/hecks/forms/query_form_renderer.rb
 - lib/hecks/forms/record_renderer.rb
 - lib/hecks/forms/record_table.rb
@@ -228,6 +215,7 @@ files:
 - lib/hecks/framework/oidc.json
 - lib/hecks/freezer.rb
 - lib/hecks/fuzzing.rb
+- lib/hecks/fuzzing/bounded_exhaustive_expressions.rb
 - lib/hecks/fuzzing/invalid_value_generator.rb
 - lib/hecks/fuzzing/isolated_boot.rb
 - lib/hecks/fuzzing/properties.rb
@@ -299,8 +287,42 @@ files:
 - lib/hecks/ports/persistence/append_only.rb
 - lib/hecks/ports/persistence/binding_policy.rb
 - lib/hecks/ports/persistence/execution.rb
-- lib/hecks/ports/persistence/lineage.rb
 - lib/hecks/ports/persistence/null_saga_store.rb
+- lib/hecks/ports/persistence/plugin.rb
+- lib/hecks/ports/persistence/plugins/era.rb
+- lib/hecks/ports/persistence/plugins/era/era_check.rb
+- lib/hecks/ports/persistence/plugins/era/era_guard.rb
+- lib/hecks/ports/persistence/plugins/era/era_guard/shape_diff.rb
+- lib/hecks/ports/persistence/plugins/era/era_tamper.rb
+- lib/hecks/ports/persistence/plugins/era/lineage.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/era_store.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/field_cache.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/head_compiler.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/mint_transaction.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/provisioning.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/resumable_backfill.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/tail_merge.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/transform_installer.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage_manager.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage_manager/coverage_check.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage_manager/era_resolver.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage_manager/merge_coordinator.rb
+- lib/hecks/ports/persistence/plugins/era/postgres_era/lineage_manager/minter.rb
+- lib/hecks/ports/persistence/plugins/era/storage_shape.rb
+- lib/hecks/ports/persistence/plugins/era/translation.rb
+- lib/hecks/ports/persistence/plugins/era/translation/audit.rb
+- lib/hecks/ports/persistence/plugins/era/translation/audit/approval_digest.rb
+- lib/hecks/ports/persistence/plugins/era/translation/audit/layer_one.rb
+- lib/hecks/ports/persistence/plugins/era/translation/audit/layer_two.rb
+- lib/hecks/ports/persistence/plugins/era/translation/audit/unfed_report.rb
+- lib/hecks/ports/persistence/plugins/era/translation/reattest.rb
+- lib/hecks/ports/persistence/plugins/era/translation/rule_compiler.rb
+- lib/hecks/ports/persistence/plugins/era/translation/scaffold.rb
+- lib/hecks/ports/persistence/plugins/era/translation/scaffold/differ.rb
+- lib/hecks/ports/persistence/plugins/era/translation/scaffold/renderer.rb
+- lib/hecks/ports/persistence/plugins/era/translation/scaffold/writer.rb
 - lib/hecks/ports/persistence/remote_runtime.rb
 - lib/hecks/ports/persistence/repository_factory.rb
 - lib/hecks/ports/projection.port
@@ -349,6 +371,8 @@ files:
 - lib/hecks/router.rb
 - lib/hecks/router/namespace_installer.rb
 - lib/hecks/runtime.rb
+- lib/hecks/runtime/aggregate_lock.rb
+- lib/hecks/runtime/boot_gates.rb
 - lib/hecks/runtime/caller.rb
 - lib/hecks/runtime/capability_graph.rb
 - lib/hecks/runtime/command_interpreter.rb
@@ -364,10 +388,6 @@ files:
 - lib/hecks/runtime/dispatcher.rb
 - lib/hecks/runtime/entity_element.rb
 - lib/hecks/runtime/entity_interpreter.rb
-- lib/hecks/runtime/era_check.rb
-- lib/hecks/runtime/era_guard.rb
-- lib/hecks/runtime/era_guard/shape_diff.rb
-- lib/hecks/runtime/era_tamper.rb
 - lib/hecks/runtime/errors.rb
 - lib/hecks/runtime/event.rb
 - lib/hecks/runtime/identity.rb
@@ -389,33 +409,25 @@ files:
 - lib/hecks/runtime/routing.rb
 - lib/hecks/runtime/saga_interpreter.rb
 - lib/hecks/runtime/saga_interpreter/correlation.rb
-- lib/hecks/runtime/storage_shape.rb
+- lib/hecks/runtime/saga_pending_dispatch.rb
 - lib/hecks/runtime/tenant_check.rb
 - lib/hecks/runtime/tenant_scope.rb
 - lib/hecks/runtime/value.rb
 - lib/hecks/runtime/value/admission.rb
 - lib/hecks/runtime/value/coercion.rb
 - lib/hecks/runtime/value/invariant_violation.rb
-- lib/hecks/translation.rb
-- lib/hecks/translation/audit.rb
-- lib/hecks/translation/audit/approval_digest.rb
-- lib/hecks/translation/audit/layer_one.rb
-- lib/hecks/translation/audit/layer_two.rb
-- lib/hecks/translation/audit/unfed_report.rb
-- lib/hecks/translation/reattest.rb
-- lib/hecks/translation/rule_compiler.rb
-- lib/hecks/translation/scaffold.rb
-- lib/hecks/translation/scaffold/differ.rb
-- lib/hecks/translation/scaffold/renderer.rb
-- lib/hecks/translation/scaffold/writer.rb
+- lib/hecks/storehouse.rb
 - lib/hecks/version.rb
 - lib/hecks/vocabulary.rb
-homepage: https://github.com/chrisyoung/hecks
+- lib/rubocop/cop/hecks/fallback_hash_lookup.rb
+- lib/rubocop/cop/hecks/sequential_hash_rename_in_loop.rb
+- lib/rubocop/cop/hecks/thread_shared_ivar_mutation.rb
+homepage: https://github.com/heckslabs/hecks
 licenses:
 - Apache-2.0
 metadata:
   allowed_push_host: https://rubygems.org
-  source_code_uri: https://github.com/chrisyoung/hecks
+  source_code_uri: https://github.com/heckslabs/hecks
 post_install_message:
 rdoc_options: []
 require_paths: