hecks 1.0.2 → 1.1.0

data/lib/hecks/fuzzing/properties.rb

@@ -4,6 +4,11 @@ require_relative "../bluebook/meta_validator"
 require_relative "../ports/query/in_memory"
 require_relative "../query_specification/field_path"
 require_relative "../runtime/value"
+require_relative "properties/lifecycle_and_replay"
+require_relative "properties/querying"
+require_relative "properties/guards"
+require_relative "properties/dispatch_and_mutations"
+require_relative "properties/invariants_and_aggregation"
 
 module Hecks
   module Fuzzing
@@ -36,6 +41,22 @@ module Hecks
     # discipline) or an explicit, reasoned exemption in that same
     # spec — never silence.
     module Properties
+      # Grouped by responsibility across properties/*.rb (lifecycle_and_
+      # replay, querying, guards, dispatch_and_mutations, invariants_and_
+      # aggregation) — `extend`ed here rather than `include`d, matching
+      # `module_function` below: every property is reachable as
+      # `Properties.foo(history)`, a module-level call with no instance in
+      # play, the same relationship AggregateBuilder::Sealing's `include`
+      # has to instance methods and BluebookBuilder::Validation's `extend`
+      # has to `self.` methods — the same "one namespace, its methods,
+      # filed across files by responsibility" pattern, `module_function`
+      # already made this module's own particular shape.
+      extend LifecycleAndReplay
+      extend Querying
+      extend Guards
+      extend DispatchAndMutations
+      extend InvariantsAndAggregation
+
       module_function
 
       # WHICH LANGUAGE FEATURE EACH PROPERTY IS ANSWERABLE FOR. Not
@@ -117,30 +138,34 @@ module Hecks
       # confirmed live before the fix (SafeDepositBox's Visit/KeyIssuance —
       # see spec/runtime/safe_deposit_box_spec.rb).
       GUARANTEED_BY_CONSTRUCTION = {
-        "Aggregate#attributes"    => "every field's pattern/closed-set/type passes through Value.build's one coercion door " \
-                                     "(value/coercion.rb#check_patterns, value/admission.rb) before it can exist — a stored value that violated " \
-                                     "its own declared shape was never producible to begin with",
+        "Aggregate#attributes"    => "every field's pattern/closed-set/type passes through Value.build's one coercion " \
+                                     "door (value/coercion.rb#check_patterns, value/admission.rb) before it can exist " \
+                                     "— a stored value that violated its own declared shape was never producible to " \
+                                     "begin with",
         "Aggregate#value_objects" => "the shape being coerced above — same door, same guarantee",
         # S17, ADR 0026 — the list `saga_advances_follow_declared_handlers`
         # (below) already walks to find each handler's own event_type/
         # from_state/to_state (the three it claims) — a property cannot
         # check a handler's own fields without iterating the list that
         # holds them, so the list itself is exercised by the same door.
-        "ProcessManager#handlers" => "saga_advances_follow_declared_handlers already walks this list to find event_type/from_state/to_state — same door, same guarantee",
+        "ProcessManager#handlers" => "saga_advances_follow_declared_handlers already walks this list to find " \
+                                     "event_type/from_state/to_state — same door, same guarantee",
         "Aggregate#identified_by" => "CommandInterpreter's data-driven dispatch order refuses AlreadyExists " \
-                                     "(command_interpreter.rb, command.creates?) for every creating command uniformly, before a duplicate id " \
-                                     "can ever be stored — collision is refused at the door, not produced and later caught",
+                                     "(command_interpreter.rb, command.creates?) for every creating command uniformly, " \
+                                     "before a duplicate id can ever be stored — collision is refused at the door, not " \
+                                     "produced and later caught",
         "Entity#identified_by"    => "MutationApplier#check_entity_collision (command_interpreter/mutation_applier.rb) " \
-                                     "checks Array(current) against every part of the entity's own identity before an append can land, on " \
-                                     "both branches identity arrives by (caller-supplied, or composite) — the same AlreadyExists refusal " \
-                                     "Aggregate#identified_by gets above, one level down. Auto-minted entities never reach the check " \
-                                     "(current.size + 1 can't repeat unless something remove:s from the list between mints, which no real " \
-                                     "domain does today — see the comment on #entity_element itself)",
+                                     "checks Array(current) against every part of the entity's own identity before an " \
+                                     "append can land, on both branches identity arrives by (caller-supplied, or " \
+                                     "composite) — the same AlreadyExists refusal Aggregate#identified_by gets above, " \
+                                     "one level down. Auto-minted entities never reach the check (current.size + 1 " \
+                                     "can't repeat unless something remove:s from the list between mints, which no " \
+                                     "real domain does today — see the comment on #entity_element itself)",
         "Command#attributes"      => "command arguments are coerced through the SAME Value.build door as any other " \
                                      "attribute — an accepted dispatch's own args already passed pattern/admits/invariant checks",
-        "Command#emits"           => "CommandRules::Emission#emit iterates command.emits ITSELF to construct every announced " \
-                                     "Event (command_rules/emission.rb) — there is no other path to emit, so a command can never announce a " \
-                                     "name its own declaration doesn't list",
+        "Command#emits"           => "CommandRules::Emission#emit iterates command.emits ITSELF to construct every " \
+                                     "announced Event (command_rules/emission.rb) — there is no other path to emit, so " \
+                                     "a command can never announce a name its own declaration doesn't list",
         "Query#attributes"        => "query arguments are coerced through the same Value.build door — same guarantee as " \
                                      "Command#attributes",
         "Entity#attributes"       => "same coercion door, one level in — an entity's own attributes are Value-typed exactly " \
@@ -148,7 +173,8 @@ module Hecks
         "ValueObject#attributes"  => "the shape Value.build enforces IS this declaration — the guarantee and the " \
                                      "feature are the same fact seen from two sides",
         "ValueObject#invariants"  => "run inside the SAME coercion call (coercion.rb, before construction returns) " \
-                                     "that pattern-checks a VO's fields — a VO whose invariant did not hold could not finish being built",
+                                     "that pattern-checks a VO's fields — a VO whose invariant did not hold could not " \
+                                     "finish being built",
         "ValueObject#rows"        => "closed-set membership is checked in value/admission.rb, the second half of the same " \
                                      "one construction door",
         # S17, ADR 0026 — Member is a genuine entity now (nested under
@@ -163,1056 +189,6 @@ module Hecks
         "Member#pairs"            => "one level into ValueObject#rows — same door"
       }.freeze
 
-      # Every lifecycle field a replay leaves an instance holding is one
-      # of the aggregate's OWN declared states — the full set, not just
-      # `Lifecycle#states`' default+targets (see ModelCheck.full_states'
-      # own comment on that hole). The tie to M2 is direct: the model
-      # checker proves which states a domain's OWN declarations can ever
-      # produce ; this proves a REAL RUN never produced anything else —
-      # a coercion bug, a stale string surviving a rename, a default
-      # that drifted from the declared set, would all show up here as a
-      # value nothing upstream would have predicted.
-      def lifecycle_values_are_declared(history)
-        bluebook = history.fetch(:bluebook)
-        declared = {}
-        bluebook.aggregates.each do |aggregate|
-          declared[aggregate.hecks_name] = Bluebook::ModelCheck.full_states(aggregate.lifecycle) if aggregate.lifecycle
-        end
-        return true if declared.empty?
-
-        offenders = history.fetch(:instances).filter_map do |key, state|
-          aggregate_name = key.split("::").last.split("#").first
-          states = declared[aggregate_name]
-          next unless states
-
-          lifecycle = bluebook.aggregate(aggregate_name).lifecycle
-          value = state[lifecycle.field]
-          next if value.nil? || states.include?(value.to_s)
-
-          "#{key} holds #{lifecycle.field}=#{value.inspect}, which #{aggregate_name} never declares as a state"
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # Every saga advance a replay actually logged moved along an edge
-      # the process manager DECLARED — `(from, to)` pairs that appear in
-      # `saga_log` with `advanced: true` must be a `(handler.from_state,
-      # handler.to_state)` pair some handler on that PM declares
-      # (compensation edges included ; a REFUSED-triggered advance is a
-      # handler like any other). A saga that advanced along a pair no
-      # handler names would mean the runtime moved state the language
-      # never authorized — the same trust ModelCheck's static reachability
-      # rests on, checked here against what a run actually did.
-      def saga_advances_follow_declared_handlers(history)
-        bluebook = history.fetch(:bluebook)
-        edges = Hash.new { |h, k| h[k] = [] }
-        bluebook.process_managers.each do |pm|
-          pm.handlers.each { |handler| edges[pm.name] << [handler.from_state, handler.to_state] }
-        end
-        return true if edges.empty?
-
-        offenders = history.fetch(:sagas).filter_map do |entry|
-          next unless entry[:advanced]
-
-          pair = [entry[:from], entry[:to]]
-          next if edges[entry[:process_manager]].include?(pair)
-
-          "#{entry[:process_manager]} advanced #{pair.inspect}, which no declared handler names"
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # THE FOUNDATIONAL ONE. `Hecks::Runtime` mints nothing — every
-      # identity is declared and derived, never invented (see
-      # command_interpreter.rb's own "NOTHING IS MINTED" — a random hex,
-      # a counter, anything not reproducible from the payload, was
-      # refused out of the runtime specifically because it broke this).
-      # So the SAME steps, replayed against a FRESH boot, must produce
-      # BYTE-IDENTICAL events, refusals, and instances — any drift here
-      # is nondeterminism the runtime promised not to have: a wall-clock
-      # read that leaked into compared state, a Hash iteration order a
-      # comparison depended on, anything. Two independent replays, not a
-      # cached one compared to itself, so a bug that corrupts the FIRST
-      # run's own bookkeeping cannot pass by agreeing with itself.
-      def replay_is_deterministic(domain_path, steps, adapter: :memory)
-        first  = Replay.call(domain_path, steps, adapter: adapter)
-        second = Replay.call(domain_path, steps, adapter: adapter)
-
-        comparable = ->(history) { history.reject { |key, _| key == :bluebook || key == :bluebooks } }
-        return true if comparable.call(first) == comparable.call(second)
-
-        "two replays of the same #{steps.length} steps produced different histories"
-      end
-
-      # THE QUERY ORACLE — differential testing within the one runtime,
-      # the shape the retired cross-runtime harness should always have
-      # been. Every generated ask was answered twice at the same instant
-      # (Replay records both): once through whatever the aggregate is
-      # actually bound to (Memory's native hook is Ports::Query::InMemory;
-      # a SQL binding would compile it), once through the reference
-      # interpreter's own evaluation. The two are separate, live
-      # implementations of the same comparator vocabulary, and they have
-      # drifted before — an adapter that ACCEPTS what the reference says
-      # matches nothing, or orders what it refuses to order, shows up
-      # here as a finding no self-referential adapter spec could see.
-      # M23 — `Replay` now runs the native and reference engines
-      # INDEPENDENTLY (each in its own begin/rescue — see that file's own
-      # comment at the capture site), so this property can tell apart what
-      # used to be indistinguishable: "both engines refused" (fine — the
-      # ask was genuinely bad, nothing to compare) from "one refused and
-      # the other did not" (a real divergence — the two engines disagree
-      # about whether the ask was even VALID, never mind what it answers).
-      # `native_refused`/`reference_refused` are read by KEY PRESENCE, not
-      # truthiness — `Replay` only ever adds `:error`/`:reference_error`
-      # to an entry when that side actually raised, so an absent key is an
-      # unambiguous "this side answered." A read-model ask (no reference
-      # twin attempted at all, `asked[:query]` without "::") is skipped
-      # entirely, same as always — there is no second engine to disagree
-      # with.
-      def query_answers_match_reference(history)
-        offenders = history.fetch(:queries).filter_map do |asked|
-          next unless asked[:query].is_a?(String) && asked[:query].include?("::")
-
-          native_refused    = asked.key?(:error)
-          reference_refused = asked.key?(:reference_error)
-
-          if native_refused != reference_refused
-            next "#{asked[:query]} #{asked[:args].inspect} — native #{native_refused ? "refused (#{asked[:error]})" : 'answered'}, " \
-                 "but the reference interpreter #{reference_refused ? "refused (#{asked[:reference_error]})" : 'answered'} — " \
-                 "a refusal-shaped divergence, not just a differing row set"
-          end
-
-          next if native_refused
-          next if asked[:rows] == asked[:reference_rows]
-
-          "#{asked[:query]} #{asked[:args].inspect} answered #{asked[:rows].inspect} " \
-            "natively but #{asked[:reference_rows].inspect} through the reference interpreter"
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # THE SAME "TWO ENGINES, COMPARED" SHAPE query_answers_match_reference
-      # already uses, aimed squarely at Query#options' offset/limit pair —
-      # but recomputed from history[:instances] directly, a THIRD,
-      # independent computation, rather than comparing QueryInterpreter's
-      # own native and reference paths against each other (which could
-      # share the identical bug neither implementation happened to hit —
-      # see #4's own fix, which touched BOTH #interpret and
-      # #reference_interpret at once). `order_by` declared alongside
-      # `offset` or `limit` names a genuinely paged query. Ports::Query::
-      # Ordering.apply is the SAME engine QueryInterpreter#ordered calls,
-      # reused here rather than re-derived, so this oracle cannot drift
-      # from what "in order" means without the interpreter drifting the
-      # identical way — only the offset-then-limit .drop/.first slice
-      # (#4's own fix) is independently reproduced, in plain Ruby.
-      #
-      # Real target: ATMCard.ByFee (`limit 3; offset 1`).
-      def paging_offset_partitions_correctly(history)
-        bluebooks = history.fetch(:bluebooks)
-
-        offenders = history.fetch(:queries).filter_map do |asked|
-          next if asked[:error] || !asked[:query].is_a?(String) || !asked[:query].include?("::")
-
-          declared = query_for_verb(bluebooks, asked[:query])
-          next unless declared && declared.order_by && (declared.offset || declared.limit)
-
-          domain, aggregate_name, = Naming.split_verb(asked[:query])
-          args = asked[:args] || {}
-          rows = query_eligible_rows(asked.fetch(:instances_at), domain, aggregate_name, declared.wheres, args,
-                                     bluebooks: bluebooks)
-          ordered = Ports::Query::Ordering.apply(
-            rows, declared.order_by, declared.null_semantics, identity: ->(row) { row[:id].to_s }
-          ) { |row| Ports::Query::InMemory.comparable(QuerySpecification::FieldPath.dig(row, declared.order_by.field)) }
-
-          skipped  = declared.offset ? ordered.drop(resolve_paging_value(declared.offset.value, args).to_i) : ordered
-          expected = declared.limit ? skipped.first(resolve_paging_value(declared.limit.value, args).to_i) : skipped
-          actual   = asked[:rows]
-          next if actual == expected
-
-          "#{asked[:query]} #{args.inspect} answered #{actual.inspect}, but independently recomputing " \
-            "order/offset/limit from #{rows.length} eligible row(s) gives #{expected.inspect}"
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # THE DECLARED Query ITSELF, resolved from a replayed verb — the
-      # same shape #command_for_verb resolves a command by, one
-      # construct over. Entity-level queries (a dotted query_path) are
-      # out of scope here — paging on an entity's own list has no real
-      # corpus site yet, and the "one many-side head, one aggregate,
-      # no FK-join" shape #query_eligible_rows assumes doesn't hold for
-      # one.
-      def query_for_verb(bluebooks, verb)
-        domain, aggregate_name, query_path = Naming.split_verb(verb)
-        return nil unless query_path && !query_path.include?(".")
-
-        bluebook  = bluebooks[domain]
-        aggregate = bluebook&.aggregate(aggregate_name)
-        aggregate&.query(query_path)
-      end
-
-      # A QUERY'S OWN ROWS — unlike #eligible_rows (a ReadModel's
-      # reduced/grouped many-side head, possibly FK-joined against a
-      # root), a Query always asks about its OWN owning aggregate
-      # directly ; no join, no reference_target. `id:` merged in the
-      # same way #eligible_rows' own rows are, since a stable sort
-      # (Ordering.apply's own `identity:`) and the real answer's own
-      # `record.state.merge(id: record.id)` both need it.
-      # `bluebooks:` — needed ONLY to recognise and resolve a `/` HOP
-      # clause (`engagement/client/status`, hop_chain.bluebook's own
-      # PricedAboveViaEngagement): a hop's head names one of the OWNING
-      # aggregate's declared references, and only the declaration graph
-      # can say which attribute that is and which aggregate it targets.
-      # A local clause never consults it. Latent gap this closed, found
-      # by the fuzzer itself the first time a generated sequence ever
-      # built a full hop chain AND had its paged query answer a row
-      # (seed 1, the moment scalar_value_objects.bluebook joined the
-      # fixtures corpus and shifted every seeded draw): the recompute
-      # dug `engagement/client/status` as a LOCAL dotted path, found
-      # nil, and declared every genuinely-eligible row ineligible — a
-      # false property violation against a correct runtime answer,
-      # reproducible on an untouched main with this same 4-step script.
-      def query_eligible_rows(instances, domain, aggregate_name, wheres, args, bluebooks: {})
-        aggregate = bluebooks[domain]&.aggregate(aggregate_name)
-        prefix = "#{domain}::#{aggregate_name}#"
-        instances.filter_map do |key, state|
-          next unless key.start_with?(prefix)
-
-          row = state.merge(id: key.split("#").last)
-          next unless wheres.all? do |clause|
-            resolved = resolve_hop_clause(instances, domain, aggregate, clause, args, bluebooks)
-            held = Ports::Query::InMemory.comparable(QuerySpecification::FieldPath.dig(row, resolved.field))
-            Ports::Query::InMemory.holds?(resolved, held, args)
-          end
-
-          row
-        end
-      end
-
-      # `Runtime::ReferenceHop#fold`, independently restated over the
-      # replay's own `:instances_at` snapshot instead of live
-      # repositories — the same shape every other recompute in this
-      # file takes (never the runtime's own code path, or the property
-      # would be checking the runtime against itself). One hop peels
-      # off the head (`HopPath.next_hop`, the identical one-step
-      # primitive the live fold uses), the inner clause recurses
-      # through `query_eligible_rows` against the TARGET's own
-      # snapshot rows (so a multi-hop tail resolves hop by hop, exactly
-      # as the live path's own recursion does), and the ids that
-      # answered fold back as the same local `in` membership clause the
-      # live fold builds. A clause with no `/`, or one whose head this
-      # aggregate's declarations cannot resolve, passes through
-      # untouched and evaluates locally as it always did.
-      def resolve_hop_clause(instances, domain, aggregate, clause, args, bluebooks)
-        return clause unless aggregate && QuerySpecification::HopPath.hop_head?(clause.field, aggregate.attributes)
-
-        hop, rest = QuerySpecification::HopPath.next_hop(clause.field, aggregate.attributes)
-        target = hop.target
-        return clause unless target
-
-        inner = QuerySpecification::Common::WhereClause.new(field: rest, op: clause.op, value: clause.value)
-        ids   = query_eligible_rows(instances, domain, target.hecks_name, [inner], args, bluebooks: bluebooks)
-                .map { |row| row[:id].to_s }.uniq
-
-        QuerySpecification::Common::WhereClause.new(field: hop.attribute.name, op: "in", value: ids)
-      end
-
-      # `QueryInterpreter#resolve_query_value`, reproduced: a declared
-      # limit/offset is either a literal or a Symbol naming an argument
-      # the caller supplied.
-      def resolve_paging_value(value, args)
-        value.is_a?(Symbol) ? args[value] : value
-      end
-
-      # `Query#options`' OTHER HALF — TenantScope.apply's own contract
-      # (tenant_scope.rb), independently restated as a property rather
-      # than exercised only through whatever the generator happens to
-      # try. NOT closed by the generator here on purpose: SafeDepositBox.
-      # Rented — the only real corpus query declaring `authorize` at
-      # all — declares ZERO attributes of its own, so StepBuilder#args_for
-      # always hands it `{}` and TenantScope.apply refuses every
-      # generated attempt, unconditionally (confirmed: no successful ask
-      # against an authorize-bearing query reaches this property via the
-      # standard battery today). Extending the generator to invent a
-      # `tenant:` value ran into a separate, real finding along the way —
-      # SafeDepositBox is COMPOSITE-identified (`identified_by` is nil
-      # for it — Runtime::Identified#derive_identity), so the generator's
-      # existing `known_ids` pool (keyed by `aggregate.identified_by ||
-      # "id"`) tracks a stray, never-real scalar for it rather than its
-      # true `branch_code`+`box_number` pair — a second, narrower
-      # generator gap this property does not attempt to fix, since fixing
-      # it well enough to trust a generated `tenant:` value would be the
-      # heavier, "benefits every future property" path the plan itself
-      # names as the alternative. Hand-built fixtures close the real
-      # claim directly instead: faster, narrower, and correct either way,
-      # since TenantScope.apply's contract is identical regardless of
-      # where a `tenant:` arg came from.
-      #
-      # Two claims, matching TenantScope.apply's own two branches: every
-      # SUCCESSFUL answer's own tenant field agrees with the tenant arg
-      # given (the WhereClause TenantScope injects is a Symbol reference
-      # into args, resolved dynamically — this checks the OUTCOME, not
-      # re-deriving that resolution) ; every ask MISSING a required
-      # tenant: refuses with the declared wording, never succeeds. A
-      # refusal for an unrelated reason with the tenant arg present is
-      # not this property's claim either way — skipped, not graded.
-      def authorize_scopes_or_refuses(history)
-        bluebooks = history.fetch(:bluebooks)
-
-        offenders = history.fetch(:queries).filter_map do |asked|
-          next unless asked[:query].is_a?(String) && asked[:query].include?("::")
-
-          declared = query_for_verb(bluebooks, asked[:query])
-          tenant = declared&.authorization&.tenant&.to_sym
-          next unless tenant
-
-          args = asked[:args] || {}
-          tenant_given = args.key?(tenant)
-
-          if asked[:error]
-            next if tenant_given
-            next if asked[:error].to_s.include?("declares authorize with tenant: #{tenant}")
-
-            "#{asked[:query]} #{args.inspect} refused with no #{tenant}: given, but not with the declared " \
-              "tenant_required wording (#{asked[:error]})"
-          elsif !tenant_given
-            "#{asked[:query]} #{args.inspect} answered successfully with no #{tenant}: given, but #{declared.name} " \
-              "declares authorize with tenant: #{tenant}"
-          else
-            wanted = args[tenant].to_s
-            mismatched = asked[:rows].find do |row|
-              Ports::Query::InMemory.comparable(QuerySpecification::FieldPath.dig(row, tenant)).to_s != wanted
-            end
-            next unless mismatched
-
-            "#{asked[:query]} #{args.inspect} answered a row whose #{tenant} disagrees with the given " \
-              "#{wanted.inspect}: #{mismatched.inspect}"
-          end
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # EVERY GIVEN/ENSURES REFUSAL A RUN ACTUALLY RAISED NAMES A RULE
-      # THE COMMAND ACTUALLY DECLARES. `GivenNotMet`/`EnsuresNotMet` both
-      # quote their guard's own `description` verbatim
-      # (command_rules/admissibility.rb: `"#{command.hecks_name} refused
-      # — #{given.description}"`) — the SAME text `behavior.bluebook`'s
-      # own `Rule`/Command.Ensure hold as `Rule#description`, so a
-      # refusal whose quoted text is not among the refusing command's
-      # OWN `guard_descriptions` (Behaviour::Command, both givens and
-      # ensures) is either a stale message surviving a renamed rule, a
-      # rule firing against the wrong command's own guard set, or the
-      # wording drifting out from under the declaration it is supposed
-      # to quote — banking's own 128 status givens (customer/account
-      # guards, some through a cross-aggregate dereference) are exactly
-      # the surface this exists to hold to its word.
-      #
-      # `kind:` is what tells a guard refusal apart from the FOUR other
-      # `RefusalWording` templates sharing the identical "X refused — Y"
-      # shape (LifecycleRefused/transition_blocked, both TypeMismatch
-      # object-reference templates, Unauthorized/role_mismatch) — see
-      # Replay's own comment at the refusal rescue site. Pattern-matching
-      # the string alone would confuse a guard's own wording with any of
-      # those; the raised class does not.
-      GUARD_REFUSAL_KINDS = %w[Hecks::Runtime::GivenNotMet Hecks::Runtime::EnsuresNotMet].freeze
-
-      def guard_refusals_are_declared(history)
-        bluebooks = history.fetch(:bluebooks)
-
-        offenders = history.fetch(:refusals).filter_map do |refusal|
-          next unless GUARD_REFUSAL_KINDS.include?(refusal[:kind])
-
-          match = refusal[:error].to_s.match(/\A(.+) refused — (.+)\z/)
-          next "#{refusal[:verb]} raised #{refusal[:kind]} with unparseable message #{refusal[:error].inspect}" unless match
-
-          command = command_for_verb(bluebooks, refusal[:verb])
-          next "#{refusal[:verb]} raised #{refusal[:kind]}, but no declared command resolves that verb" unless command
-
-          declared = effective_guard_descriptions(bluebooks, refusal[:verb], command)
-          next if declared.include?(match[2])
-
-          "#{refusal[:verb]} refused — #{match[2].inspect} — but #{command.hecks_name} declares no given " \
-            "or ensures with that description (it declares #{declared.inspect})"
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # A DECLARED PROCESS MANAGER'S OWN COMMAND — `command.hecks_name`,
-      # or an entity's own if the verb's second component is itself
-      # dotted (`Aggregate.Entity.Command`, the same two shapes
-      # `Dispatcher#dispatch` itself branches on). Shared by the guard
-      # property above and available for anything else that needs to go
-      # from a replayed verb back to its declaration.
-      #
-      # RESOLVED AGAINST `bluebooks` (the FULL map, `history[:bluebooks]`
-      # — every loaded domain, keyed by name), never a single assumed
-      # bluebook: a verb names its OWN domain (`Naming.split_verb`'s
-      # first element), and that domain is not always the one Replay
-      # happens to expose as `history[:bluebook]`. A fuzz run against
-      # `lib/hecks/grammar` (Expression + Translation, in load
-      # order) found this the hard way — every `Translation::Map.Seal`
-      # refusal read as "no declared command resolves that verb" purely
-      # because `history[:bluebook]` was Expression, not Translation; the
-      # refusal was real, this property's own domain resolution was not.
-      # A DELEGATING DOOR REFUSES WITH ITS TARGET'S OWN WORDS. `delegates_to`
-      # (CommandBuilder#delegates_to_impl) hands the whole dispatch to one
-      # entity command, and that command's given is what refuses — raised
-      # back through the door, in the door's name (chess: `Game.MoveKnight
-      # refused — "it is that color's turn"`, a given Knight.Move declares
-      # and MoveKnight, a pure passthrough, never could). Read the door's
-      # own guards first, then every delegation target's; an offence is
-      # only a description NEITHER declares. Found live mining chess's
-      # history: every refused move through a door read as undeclared.
-      def effective_guard_descriptions(bluebooks, verb, command)
-        own = command.guard_descriptions
-        delegated = command.mutations.select { |m| m.op == :delegate }.flat_map do |delegation|
-          domain, aggregate_name, = Naming.split_verb(verb)
-          target = command_for_verb(bluebooks, "#{domain}::#{aggregate_name}.#{delegation.target}")
-          target ? target.guard_descriptions : []
-        end
-        own + delegated
-      end
-
-      def command_for_verb(bluebooks, verb)
-        domain, aggregate_name, command_path = Naming.split_verb(verb)
-        return nil unless command_path
-
-        bluebook = bluebooks[domain]
-        return nil unless bluebook
-
-        aggregate = bluebook.aggregate(aggregate_name)
-        return nil unless aggregate
-
-        if command_path.include?(".")
-          entity_name, sub = command_path.split(".", 2)
-          entity = aggregate.entities.find { |e| e.hecks_name == entity_name }
-          entity&.command(sub)
-        else
-          aggregate.command(command_path)
-        end
-      end
-
-      # `guard_refusals_are_declared`'s OWN OPPOSITE DIRECTION. That
-      # property is passive and one-directional — for a refusal that
-      # ALREADY HAPPENED, is the quoted text real declared text? It says
-      # nothing about a guard that should have refused and silently did
-      # not — a call site that stopped calling enforce_givens/enforce_
-      # lifecycle_guard would never appear in history[:refusals] at all,
-      # invisible to that property by construction.
-      #
-      # This one calls Admissibility#enforce_givens (which itself folds
-      # in #enforce_lifecycle_guard whenever `declaring:` is passed)
-      # DIRECTLY, against Replay's own pre-dispatch snapshot
-      # (history[:guard_checks], one bounded, additive extension — see
-      # that file's own comment at the capture site) — an independent
-      # recomputation, not grading production against itself, the same
-      # "two engines, compared" shape query_answers_match_reference and
-      # the fan-out oracle already establish. `recomputed_refused`
-      # (Replay's own call, made live, before this step's real dispatch
-      # could mutate anything a cross-aggregate given dereferences) is
-      # compared against `actual_refused` (GivenNotMet/LifecycleRefused
-      # specifically — Replay's own comment on GUARD_REFUSAL_CLASSES
-      # explains why ANY other refusal class, or an outright success,
-      # both count as "the guard did not fire," since enforce_givens
-      # runs FIRST in DISPATCH_ORDER).
-      #
-      # Aggregate#preconditions closes for free alongside this — a
-      # no-block `given` reference (CommandBuilder#given) pushes the
-      # SAME Given struct object `enforce_givens` already iterates
-      # command.givens for, so there is no separate runtime path a
-      # property could exercise beyond what this already reaches.
-      # Entity#preconditions closes the identical way, one level down
-      # (ADR 0028) — a piece's own bare `given` reference pushes the
-      # SAME Given struct onto ITS OWN referencing command's givens,
-      # so LedgerEntry's own Amend/Reverse (banking) already exercise
-      # this through the exact mechanism above, no separate path.
-      #
-      # Real targets: Account.Debit/CloseAccount (`from:` guards),
-      # Credit/Debit (the named-once `given("customer is active")`
-      # precondition) — FreezeAccount deliberately references the
-      # DIFFERENT named precondition `"customer is not closed"` instead
-      # (a suspended customer must still be freezable), so it is not a
-      # `"customer is active"` example, just the same MECHANISM.
-      def lifecycle_guard_and_given_violations_are_refused(history)
-        offenders = history.fetch(:guard_checks).filter_map do |check|
-          next if check[:recomputed_refused] == check[:actual_refused]
-
-          "#{check[:verb]} — independently recomputing enforce_givens/enforce_lifecycle_guard against the " \
-            "pre-dispatch state says #{check[:recomputed_refused] ? "refused (#{check[:recomputed_kind]})" : 'admitted'}, " \
-            "but the real dispatch #{check[:actual_refused] ? "refused (#{check[:actual_kind]})" : 'admitted it'}"
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # Closes Handler#dispatches and — the same shape, one construct
-      # over — Policy#with_spec (Dispatch#command_name/Dispatch#with_spec
-      # are not claimable feature strings at all — see FEATURE_COVERAGE's
-      # own comment on this entry). history[:saga_dispatches]/[:policy_dispatches]
-      # (Registry#saga_dispatch_log/#policy_dispatch_log — additive,
-      # Ruby-only, NEVER touching saga_log/reaction_log, the byte-for-
-      # byte shape spec/rust_conformance_spec.rb holds Rust to) each
-      # carry the RAW inputs a dispatch's own args were resolved from,
-      # captured live at the moment the resolution actually ran — a
-      # saga's own memory keeps changing across a run, so re-deriving
-      # from history[:saga_instances]'s FINAL memory (the only other
-      # place it would be visible) would grade the wrong moment,
-      # lifecycle_guard_and_given_violations_are_refused's own false
-      # positive one item earlier, in a different shape.
-      #
-      # #resolve_dispatch_binding/#resolve_trigger_binding are SEPARATE,
-      # independently-written re-derivations of SagaInterpreter#
-      # dispatch_args/PolicyInterpreter#trigger_args's own resolution —
-      # never calling either method again, which would only ever agree
-      # with itself. Exactly the class of bug this closes: "a wrong
-      # argument binding on a fan-out dispatch that produces a perfectly
-      # normal-looking log entry (`delivered: true`) and would only ever
-      # surface as a downstream assertion failure, if it surfaces at
-      # all" — PR #325's own defect class, one level over.
-      #
-      # Real targets: Settlement (mixed literal/correlation-head/event-
-      # payload/memory-fallback bindings across three legs, plus a
-      # compensation leg that deliberately omits `reference:`, a field
-      # the forward Credit leg carries), ExternalSettlement, Onboarding
-      # (no compensation leg, by design — nothing to check there beyond
-      # the forward leg's own event-payload binding).
-      def dispatch_binding_fidelity(history)
-        saga_offenders = history.fetch(:saga_dispatches, []).filter_map do |entry|
-          expected = resolve_dispatch_binding(entry)
-          next if expected == entry[:args]
-
-          "#{entry[:process_manager]}##{entry[:instance]} dispatching #{entry[:dispatch]} on #{entry[:on]} — " \
-            "bound #{entry[:args].inspect}, but independently re-deriving with_spec's own resolution gives " \
-            "#{expected.inspect}"
-        end
-
-        policy_offenders = history.fetch(:policy_dispatches, []).filter_map do |entry|
-          expected = resolve_trigger_binding(entry)
-          next if expected == entry[:args]
-
-          "#{entry[:policy]} on #{entry[:on]} — bound #{entry[:args].inspect}, but independently re-deriving " \
-            "with_spec's own resolution gives #{expected.inspect}"
-        end
-
-        offenders = saga_offenders + policy_offenders
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # SagaInterpreter#dispatch_args's own 4-branch resolution,
-      # reproduced independently: a literal, the correlation key itself,
-      # the CURRENT triggering event's own payload, or — the fallback —
-      # the saga's own carried memory (seeded from the STARTING event's
-      # payload, at begin_saga).
-      def resolve_dispatch_binding(entry)
-        entry[:with_spec].to_h do |key, value|
-          resolved = if !value.is_a?(Symbol) then value
-                     elsif value == entry[:correlation_head] then entry[:instance]
-                     elsif entry[:event_payload].key?(value) then entry[:event_payload][value]
-                     else entry[:memory][value]
-                     end
-          [key.to_sym, Runtime::Value.materialize(resolved)]
-        end
-      end
-
-      # PolicyInterpreter#trigger_args's own 2-branch resolution — a
-      # policy holds no correlation and no memory, so `payload` (the
-      # triggering event's own payload, already merged with a fan-out
-      # row's id when there is one) is the WHOLE source.
-      def resolve_trigger_binding(entry)
-        entry[:with_spec].to_h do |key, value|
-          resolved = value.is_a?(Symbol) ? entry[:payload][value] : value
-          [key.to_sym, Runtime::Value.materialize(resolved)]
-        end
-      end
-
-      # Closes Command#mutations — the last of the five, and the
-      # largest: no real corpus entity anywhere uses `append`/`remove`/
-      # `multiply`/`clamp` (every real aggregate-owned mutation is
-      # aggregate-scoped — Account.Credit's :ledger, LogVisit's
-      # :visits); the only entity-owned use of these four ops in the
-      # whole repository is spec/fixtures/entity_list_mutations, now a
-      # real, bootable, Memory-default domain (no .hecksagon needed at
-      # all — a domain with none boots every aggregate against Memory
-      # by construction, confirmed live) rather than the raw-Kernel.
-      # load-only fixture it was.
-      #
-      # `history[:mutation_traces]` (Replay's own bounded, additive
-      # extension — see #build_mutation_trace's own comment) carries a
-      # per-step before/after snapshot of the ENTITY ELEMENT an
-      # entity-dispatched command's own mutations acted on, materialized
-      # to plain data, plus the step's own raw args — the delta
-      # `aggregation_matches_recompute` never had to ask for, because
-      # count/median are pure functions of FINAL state and a mutation
-      # is not (the same "captured live, not re-derived from final
-      # state" lesson item 8's own saga_dispatch_log already learned).
-      #
-      # #recompute_append/#recompute_remove/#recompute_multiply/
-      # #recompute_clamp are SEPARATE, independently-written
-      # reproductions of MutationApplier#appended/#removed and
-      # CommandRules::Arithmetic#multiply/#clamp — never calling either
-      # again, which would only ever agree with itself. `:set`/
-      # `:increment`/`:decrement` are out of scope on purpose (the four
-      # "vendored, not yet upstream" ops this item exists for); a
-      # command mixing them with a recomputable op still gets the
-      # recomputable one checked.
-      #
-      # `:unrecomputable` (never compared, never a finding) covers the
-      # generator's own deliberate arg-malforming (`StepBuilder#malform`)
-      # landing a non-Numeric amount/non-2-element bounds where
-      # multiply/clamp need one — the SAME shape `guard_check`'s own
-      # AbsentArgument false positive taught: a step whose raw material
-      # doesn't fit the op's own contract is inconclusive, not a claimed
-      # mismatch.
-      RECOMPUTABLE_MUTATION_OPS = %i[append remove multiply clamp].freeze
-
-      def mutations_match_recompute(history)
-        bluebooks = history.fetch(:bluebooks)
-
-        offenders = history.fetch(:mutation_traces, []).flat_map do |entry|
-          next [] unless entry[:after]
-
-          command = command_for_verb(bluebooks, entry[:verb])
-          next [] unless command
-
-          command.mutations.select { |m| RECOMPUTABLE_MUTATION_OPS.include?(m.op) }.filter_map do |mutation|
-            expected = recompute_mutation(mutation, entry[:before][mutation.target], entry[:args], entry[:before])
-            next if expected == :unrecomputable
-
-            actual = entry[:after][mutation.target]
-            next if symbolize_deep(expected) == symbolize_deep(actual)
-
-            "#{entry[:verb]} — #{mutation.op} on #{mutation.target} — recomputing independently gives " \
-              "#{expected.inspect}, but the real dispatch left #{actual.inspect}"
-          end
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      def recompute_mutation(mutation, current, args, before_scope)
-        case mutation.op
-        when :append   then recompute_append(current, mutation.source, before_scope, args)
-        when :remove   then recompute_remove(current, mutation.source, args)
-        when :multiply then recompute_multiply(current, resolve_mutation_source(mutation.source, args))
-        when :clamp    then recompute_clamp(current, mutation.source)
-        end
-      end
-
-      # `MutationApplier#appended`'s own value-object branch (never the
-      # entity_element branch — see #build_mutation_trace's own comment
-      # on why an entity-dispatched command's own mutations never reach
-      # it), reproduced: the field map resolved the SAME two-tier way
-      # (`MutationApplier#resolve_append_source` — a caller-supplied
-      # arg, or the entity's own current field), then appended.
-      def recompute_append(current, source_map, before_scope, args)
-        fields = source_map.transform_values { |source| resolve_mutation_append_field(source, before_scope, args) }
-        Array(current) + [symbolize_deep(fields)]
-      end
-
-      def resolve_mutation_append_field(source, before_scope, args)
-        return source unless source.is_a?(Symbol)
-        return args[source] if args.key?(source)
-
-        before_scope[source]
-      end
-
-      # `MutationApplier#removed`'s own value-equality match, reproduced.
-      def recompute_remove(current, source, args)
-        target = symbolize_deep(resolve_mutation_source(source, args))
-        Array(current).reject { |element| symbolize_deep(element) == target }
-      end
-
-      # `CommandRules::Arithmetic#multiply`'s own two branches,
-      # reproduced on plain materialized data instead of a real Value:
-      # a single-numeric-field Hash (the VO-typed case — ListCount, one
-      # Integer field) scales that field ; a bare Numeric scales itself.
-      # `current ||= 0` — the SAME phantom-field fallback #multiply
-      # itself already gives (unaffected by this session's #clamp fix,
-      # since #multiply never needed one).
-      def recompute_multiply(current, amount)
-        return :unrecomputable unless amount.is_a?(Numeric)
-
-        current ||= 0
-        if current.is_a?(Hash)
-          field = current.keys.find { |f| current[f].is_a?(Numeric) }
-          return :unrecomputable unless field
-
-          current.merge(field => current[field] * amount)
-        elsif current.is_a?(Numeric)
-          current * amount
-        else
-          :unrecomputable
-        end
-      end
-
-      # `CommandRules::Arithmetic#clamp`'s own two branches, reproduced
-      # the same way #recompute_multiply is — including THIS SESSION'S
-      # OWN `current ||= 0` fix (command_rules/arithmetic.rb), the one
-      # arithmetic op that didn't have it until now. `mutation.source`
-      # is always a literal `[min, max]`, never an argument reference
-      # (MutationApplier's own comment on why `resolve_source` is
-      # skipped for clamp) — so nothing here reads `args` for it at all.
-      def recompute_clamp(current, bounds)
-        return :unrecomputable unless bounds.is_a?(Array) && bounds.size == 2
-
-        min, max = bounds
-        current ||= 0
-        if current.is_a?(Hash)
-          field = current.keys.find { |f| current[f].is_a?(Numeric) }
-          return :unrecomputable unless field
-
-          current.merge(field => current[field].clamp(min, max))
-        elsif current.is_a?(Numeric)
-          current.clamp(min, max)
-        else
-          :unrecomputable
-        end
-      end
-
-      # `CommandRules::Arithmetic#resolve_source`, reproduced: a
-      # mutation's source is either the NAME OF AN ARGUMENT or a
-      # LITERAL, told apart by type.
-      def resolve_mutation_source(source, args)
-        source.is_a?(Symbol) ? args[source] : source
-      end
-
-      # A generated step's own `args` arrive with STRING keys on every
-      # nested Hash (the wire/JSON shape `spec/corpus/*.json` already
-      # uses) while `history[:mutation_traces]`' own materialized
-      # before/after state carries SYMBOL keys throughout (Runtime::
-      # Value.materialize's own convention) — two hashes holding the
-      # identical fact compare UNEQUAL by Ruby's own `Hash#==` unless
-      # both sides are normalized the same way first. Recursive, since
-      # an appended/removed element can itself nest a value object
-      # (RemoveTag's own `Tag` argument, `{"key"=>..., "value"=>...}`).
-      def symbolize_deep(value)
-        case value
-        when Hash  then value.to_h { |key, val| [key.to_sym, symbolize_deep(val)] }
-        when Array then value.map { |val| symbolize_deep(val) }
-        else value
-        end
-      end
-
-      # EVERY STORED RECORD STILL SATISFIES ITS OWN AGGREGATE'S DECLARED
-      # INVARIANTS — Admissibility#enforce_invariants (command_rules/
-      # admissibility.rb) checks these AFTER every command's mutations,
-      # BEFORE save, the same point `ensures` is checked. Nothing until
-      # now re-checked a record AFTER a whole replay finished, independent
-      # of whichever call site was supposed to have refused a violation
-      # in the first place — a record failing its own declared invariant
-      # here is proof a violating write landed anyway: the call site
-      # stopped calling enforce_invariants, or some other path (a
-      # translation, a backfill) wrote around it entirely.
-      #
-      # `history[:instances]` entries are already plain, symbol-keyed
-      # state Hashes (Replay.call's own `record.state`) — called against
-      # Evaluator.call the SAME way ValueObject::Builder#build already
-      # does for a VO's own invariants (value/coercion.rb), no GuardState
-      # wrapper needed the way enforce_invariants' own LIVE call uses one
-      # (GuardState exists for `parent.`/projected-field dereferencing
-      # mid-dispatch; a stored record's own scalar fields need none of
-      # that to re-check a same-aggregate invariant against itself).
-      #
-      # Real target: Account's own `invariant("the balance never goes
-      # negative") { balance.cents >= 0 }`.
-      #
-      # Entity#invariants (round 7) closes here too, not for free —
-      # `stored_records_satisfy_declared_invariants` only ever checked
-      # the AGGREGATE's own flat state; a piece's own invariant is
-      # checked against every ELEMENT of a `list_of` field, a genuinely
-      # different walk `check_piece_invariants` below makes,
-      # independently of `Admissibility#check_entity_invariants` (the
-      # live enforcement path this property exists to catch drifting
-      # from) — same reasoning `stored_records_satisfy_declared_
-      # invariants`' own top-level check already applies one level up.
-      #
-      # Real target: SafeDepositBox's own Visit — `invariant("a written
-      # note is not blank") { !note || !note.text.to_s.empty? }`.
-      def stored_records_satisfy_declared_invariants(history)
-        bluebooks = history.fetch(:bluebooks)
-
-        offenders = history.fetch(:instances).filter_map do |key, state|
-          domain_name    = key.split("::").first
-          aggregate_name = key.split("::").last.split("#").first
-          bluebook       = bluebooks[domain_name]
-          aggregate      = bluebook&.aggregate(aggregate_name)
-          next unless aggregate
-
-          violated = aggregate.invariants.find do |invariant|
-            !Bluebook::Expression::Evaluator.call(invariant.canonical, state)
-          end
-          next "#{key} violates #{aggregate_name}'s own declared invariant #{violated.description.inspect}" if violated
-
-          check_piece_invariants(aggregate, state, key)
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # A PIECE'S OWN INVARIANT, checked against every element a
-      # `list_of` field holds — the SAME lookup `Admissibility#
-      # check_entity_invariants` makes (`owner.attributes.find { |a|
-      # a.list? && a.type.to_s == entity.hecks_name }`), independently
-      # reapplied here against a STORED record's own plain Hash state
-      # rather than a live `Instance`.
-      def check_piece_invariants(owner_construct, owner_state, key)
-        owner_construct.entities.each do |entity|
-          next if entity.invariants.empty?
-
-          list_attr = owner_construct.attributes.find { |a| a.list? && a.type.to_s == entity.hecks_name }
-          next unless list_attr
-
-          Array(owner_state[list_attr.name]).each do |element|
-            violated = entity.invariants.find do |invariant|
-              !Bluebook::Expression::Evaluator.call(invariant.canonical, element)
-            end
-            return "#{key}'s own #{entity.hecks_name} violates its declared invariant #{violated.description.inspect}" if violated
-
-            nested = check_piece_invariants(entity, element, key)
-            return nested if nested
-          end
-        end
-        nil
-      end
-
-      # A SAGA INSTANCE'S OWN CHECKPOINT SURVIVES BEING WRITTEN AND READ
-      # BACK — the durability contract `SagaInterpreter#checkpoint` makes
-      # (`state:` plus a `deep_copy`d `memory:`, handed to whatever
-      # adapter answers `save_saga`) and `Registry#rehydrate_sagas!`
-      # promises to restore on the next boot (`each_saga` yielding
-      # `[pm, correlation, state, memory]` back into `saga_instances`).
-      # `Replay` captures the LIVE store already materialised the same
-      # way `checkpoint` itself does (`Value.materialize`, not raw
-      # `Runtime::Value`s — see its own comment); this property pushes
-      # that captured memory through the SAME `JSON.generate` then
-      # `JSON.parse(symbolize_names: true)` round-trip `checkpoint`'s own
-      # `deep_copy` performs (mirrored here rather than called — a
-      # private instance method with no registry to hand it) and checks
-      # it comes back byte-identical. A memory holding anything that
-      # round-trip cannot carry faithfully — a bare Symbol leaf, a
-      # non-JSON type a future field introduces — is corruption the
-      # durable path would introduce on a REAL restart, caught here
-      # without needing one.
-      #
-      # `declares_state?` (Behaviour::ProcessManager) is the other half:
-      # a live or rehydrated instance sitting in a state the procedure
-      # never declares is the saga-durability twin of
-      # `lifecycle_values_are_declared` above.
-      def sagas_rehydrate_cleanly(history)
-        bluebook = history.fetch(:bluebook)
-        process_managers = bluebook.process_managers.to_h { |pm| [pm.name, pm] }
-
-        offenders = history.fetch(:saga_instances).flat_map do |pm_name, conversations|
-          pm = process_managers[pm_name]
-
-          conversations.filter_map do |correlation, instance|
-            problems = []
-
-            problems << "holds state #{instance[:state].inspect}, which #{pm_name} never declares" if pm && !pm.declares_state?(instance[:state])
-
-            rehydrated = JSON.parse(JSON.generate(instance[:memory]), symbolize_names: true)
-            if rehydrated != instance[:memory]
-              problems << "memory does not survive its own checkpoint round-trip " \
-                          "(checkpointed #{instance[:memory].inspect}, rehydrated #{rehydrated.inspect})"
-            end
-
-            next if problems.empty?
-
-            "#{pm_name}##{correlation.inspect}: #{problems.join(' and ')}"
-          end
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # A `for_each` POLICY DISPATCHES EXACTLY ONCE PER ROW ITS DECLARED
-      # QUERY ANSWERS — never once for the triggering event regardless of
-      # row count, never skipping a matched row, never firing on a row a
-      # concurrent mutation only made match AFTER the fact. `Replay`
-      # computes the expected row-id set INDEPENDENTLY, at the same
-      # instant the real dispatch runs (`Replay.expected_fan_out_rows`,
-      # the query oracle's own shape aimed at fan-out: two engines
-      # compared, never one graded against itself), and records it
-      # beside what the reaction log actually shows. `expected_row_ids`
-      # is `nil`, not `[]`, when `policy.where` did not hold — no
-      # dispatch is the claim then, not "dispatched to zero rows," and a
-      # policy that dispatched anyway despite a failing guard is as real
-      # a finding as a row it skipped.
-      def fanout_dispatches_once_per_matching_row(history)
-        offenders = history.fetch(:fan_outs).filter_map do |finding|
-          expected = finding[:expected_row_ids]
-          actual   = finding[:actual_row_ids].sort
-
-          if expected.nil?
-            next if actual.empty?
-
-            next "#{finding[:policy]} on #{finding[:on]}: where did not hold, but dispatched to #{actual.inspect}"
-          end
-
-          next if actual == expected
-
-          "#{finding[:policy]} on #{finding[:on]}: for_each answered #{expected.inspect}, " \
-            "but the reaction log shows dispatches to #{actual.inspect}"
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # A `count`/`median` REPORT'S REDUCED SCALAR MATCHES THE SAME
-      # REDUCTION DONE INDEPENDENTLY, over the SAME eligible rows —
-      # `ReadModelInterpreter#project`'s own FK-join (root first, then
-      # each many-side head matched against it) and `#median` (odd →
-      # the true middle, even → the average of the two middles as a
-      # Float, empty → `nil`; `count` is the filtered length, empty →
-      # `0`), reproduced here in plain Ruby against `history[:instances]`
-      # rather than a live registry — `FieldPath.dig` +
-      # `Ports::Query::InMemory.comparable`/`.holds?` are the SAME two
-      # calls the interpreter itself makes to read a field and judge a
-      # `where`, called here rather than re-derived, so this oracle
-      # cannot drift from what "read a field" or "a clause holds" mean
-      # without the interpreter drifting the identical way.
-      #
-      # Only a report whose `:query` is answered by the SAME bluebook
-      # `history[:bluebook]` carries (the bare `Domain.report_name`
-      # form, `domain == bluebook.name`) is checked — the same "only
-      # what we have the grammar for" scope `lifecycle_values_are_declared`
-      # already takes for a multi-domain replay.
-      def aggregation_matches_recompute(history)
-        bluebook = history.fetch(:bluebook)
-
-        offenders = history.fetch(:queries).filter_map do |asked|
-          next if asked[:error]
-
-          domain, name = asked[:query].to_s.split(".", 2)
-          next unless name && domain == bluebook.name
-
-          model = bluebook.read_model(name)
-          next unless model && (model.count? || model.median_field)
-
-          reduced_head = model.aggregate_heads.find { |head| head[:many] }
-          next unless reduced_head
-
-          rows = eligible_rows(bluebook, asked.fetch(:instances_at), domain, model, reduced_head, asked[:args] || {})
-          expected = model.count? ? rows.length : recompute_median(rows, model.median_field)
-          actual = asked[:rows]&.first&.dig(reduced_head[:as])
-          next if actual == expected
-
-          "#{asked[:query]} #{asked[:args].inspect} answered #{actual.inspect} for #{reduced_head[:as]}, " \
-            "but recomputing independently from #{rows.length} eligible row(s) gives #{expected.inspect}"
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # `aggregation_matches_recompute`'s own shape, extended from
-      # reducing a many-side head to a scalar (count/median) to NESTING
-      # it — `ReadModelInterpreter#group_by_target`/`#nest`, reproduced
-      # here in plain Ruby against `history[:instances]` the same way
-      # `eligible_rows` already reproduces the FK-join and `where`
-      # narrowing count/median share. `Value.materialize_unwrapped` is
-      # the SAME call `#project` makes before nesting (a single-field
-      # value object recurses to its bare scalar — a real grouping key
-      # has to BE one) — called here rather than re-derived, so this
-      # oracle cannot drift from what "the group key" means without the
-      # interpreter drifting the identical way.
-      #
-      # Real target: AccountsByKind (`group_by :kind, :number`,
-      # rootless — always generator-eligible with `{}` args).
-      def group_by_matches_recompute(history)
-        bluebook = history.fetch(:bluebook)
-
-        offenders = history.fetch(:queries).filter_map do |asked|
-          next if asked[:error]
-
-          domain, name = asked[:query].to_s.split(".", 2)
-          next unless name && domain == bluebook.name
-
-          model = bluebook.read_model(name)
-          next unless model && model.group_by.any?
-
-          grouped_head = model.aggregate_heads.find { |head| head[:many] }
-          next unless grouped_head
-
-          rows = eligible_rows(bluebook, asked.fetch(:instances_at), domain, model, grouped_head, asked[:args] || {})
-          materialized = rows.map { |state| Runtime::Value.materialize_unwrapped(state) }
-          expected = nest_rows(materialized, model.group_by_fields)
-          actual = asked[:rows]&.first&.dig(grouped_head[:as])
-          next if actual == expected
-
-          "#{asked[:query]} #{asked[:args].inspect} answered a #{grouped_head[:as]} grouping that disagrees " \
-            "with independently nesting group_by #{model.group_by_fields.inspect} over #{rows.length} " \
-            "eligible row(s)"
-        end
-
-        offenders.empty? || offenders.join("; ")
-      end
-
-      # `ReadModelInterpreter#nest`, byte for byte: one level of nesting
-      # per `group_by` field in declared order, leaf is the row with
-      # every grouped field stripped (already spent, as the keys that
-      # reached it).
-      def nest_rows(rows, fields)
-        field, *rest = fields
-        rows.group_by { |row| row[field] }.transform_values do |group|
-          stripped = group.map { |row| row.reject { |key, _| key == field } }
-          rest.empty? ? stripped.first : nest_rows(stripped, rest)
-        end
-      end
-
-      # THE ELIGIBLE ROWS a `count`/`median` head reduces — every
-      # instance of the reduced head's own aggregate, FK-matched against
-      # the report's root reference (if it has one; a rootless report has
-      # none to match) exactly the way `ReadModelInterpreter#reference_fields`
-      # finds the matching attribute, then narrowed by the report's own
-      # `where` clauses via the SAME `InMemory.holds?` the interpreter's
-      # `execute` calls.
-      def eligible_rows(bluebook, instances, domain, model, reduced_head, args)
-        aggregate = bluebook.aggregate(reduced_head[:aggregate])
-        prefix = "#{domain}::#{reduced_head[:aggregate]}#"
-        # `id:` MERGED IN, the same `record.to_h` (`@state.merge(id:
-        # @id)`) every live head row carries — count/median never read
-        # it, but group_by_matches_recompute's own independent nesting
-        # does, the same way ReadModelInterpreter#row(record) = record.
-        # to_h does for the live path it's checking against.
-        rows = instances.filter_map { |key, state| state.merge(id: key.split("#").last) if key.start_with?(prefix) }
-
-        if model.reference_target
-          reference_id = args[model.reference_name].to_s
-          fk_fields = aggregate.attributes.select do |attribute|
-            attribute.reference? && attribute.type.target_name == model.reference_target.to_s
-          end.map(&:name)
-
-          rows = rows.select { |state| fk_fields.any? { |field| state[field].to_s == reference_id } }
-        end
-
-        rows.select do |state|
-          model.wheres.all? do |clause|
-            held = Ports::Query::InMemory.comparable(QuerySpecification::FieldPath.dig(state, clause.field))
-            Ports::Query::InMemory.holds?(clause, held, args)
-          end
-        end
-      end
-
-      # `ReadModelInterpreter#median`'s own definition, reproduced byte
-      # for byte: odd count → the true middle value, sorted; even count
-      # → the average of the two middle values, as a Float; empty → nil,
-      # never zero, so a caller cannot mistake "nothing to average" for
-      # "averaged to zero."
-      def recompute_median(rows, field)
-        values = rows.map { |state| Ports::Query::InMemory.comparable(QuerySpecification::FieldPath.dig(state, field)) }
-                     .compact.sort
-        return nil if values.empty?
-
-        middle = values.length / 2
-        values.length.odd? ? values[middle] : (values[middle - 1] + values[middle]) / 2.0
-      end
-
       # THE STANDARD BATTERY, run over one replayed history — everything
       # except determinism, which needs to replay TWICE itself and so
       # takes the steps directly rather than a single history.