hecks 1.0.2 → 1.1.0

data/lib/hecks/literal.rb

@@ -37,19 +37,20 @@ module Hecks
     def to_s = "state(:#{name})"
   end
 
+  # The `render`/`read` pair the header above describes: `render` turns a
+  # Ruby value into its self-describing wire spelling, `read` is its exact
+  # inverse.
   module Literal
     module_function
 
     def render(value)
       case value
-      when nil            then "nil"
-      when StateRef       then value.to_s
-      when true, false    then value.to_s
-      when Symbol         then ":#{value}"
-      when Integer, Float then value.to_s
-      when String         then quote(value)
-      when Hash           then "{#{value.map { |key, held| "#{key}: #{render(held)}" }.join(', ')}}"
-      when Array          then "[#{value.map { |held| render(held) }.join(', ')}]"
+      when nil    then "nil"
+      when Symbol then ":#{value}"
+      when String then quote(value)
+      when StateRef, true, false, Integer, Float then value.to_s
+      when Hash   then "{#{value.map { |key, held| "#{key}: #{render(held)}" }.join(', ')}}"
+      when Array  then "[#{value.map { |held| render(held) }.join(', ')}]"
       else
         raise ArgumentError, "#{value.class} has no pinned literal spelling — teach Literal.render one " \
                              "rather than letting #to_s decide it"
@@ -59,6 +60,15 @@ module Hecks
     # Read one back. Tolerant of a bare word on purpose: the language stores a
     # closed set's members and a few hand-written fields as plain text that was
     # never rendered, and those must stay the strings they are.
+    #
+    # The exact inverse of `render`'s `case`, above — one ordered guard per
+    # spelling `render` can produce (plus the bare-word tolerance this
+    # comment already explains). Each guard is a single self-contained
+    # `return`; splitting them into named predicates would just rename
+    # each line without changing what it does, and would separate this
+    # method from the `render` it is the deliberate mirror of.
+    # rubocop:disable-next Metrics/CyclomaticComplexity
+    # rubocop:disable-next Metrics/PerceivedComplexity
     def read(text)
       raw = text.to_s.strip
       return nil if raw.empty? || raw == "nil"

data/lib/hecks/naming.rb

@@ -1,4 +1,9 @@
 module Hecks
+  # Every derived-name and identity-joining rule the language relies on —
+  # pluralisation/singularisation, snake/Pascal casing, dotted-path and verb
+  # splitting, and the command/event reference rewrites — collected here so
+  # two readers never invent two different spellings for the same
+  # derivation.
   module Naming
     # WHAT SEPARATES THE PARTS OF A DERIVED IDENTITY.
     #
@@ -71,9 +76,7 @@ module Hecks
       # is left actually ends in one of those five shapes is what
       # keeps an ordinary "-es" word (e.g. "Invoices" -> "Invoice")
       # from also losing a letter it never doubled.
-      if word.length > 3 && word.end_with?("es") && word[0..-3].match?(/(s|x|z|ch|sh)\z/)
-        return word[0..-3]
-      end
+      return word[0..-3] if word.length > 3 && word.end_with?("es") && word[0..-3].match?(/(s|x|z|ch|sh)\z/)
 
       return word[0..-2] if word.length > 1 && word.end_with?("s")
 

data/lib/hecks/ports/access_control.rb

@@ -19,7 +19,7 @@ module Hecks
     # a domain's adapter here calls that directly, rather than this
     # port re-deriving Governance-query logic another port already owns.
     module AccessControl
-      NAME = "access_control"
+      NAME = "access_control".freeze
 
       module_function
 

data/lib/hecks/ports/agent.rb

@@ -39,7 +39,7 @@ module Hecks
     # differently would mean the SAME malformed answer passing through
     # one and refusing through the other.
     module Agent
-      NAME = "agent"
+      NAME = "agent".freeze
 
       # The answer came back and could not be used — no JSON in it, a
       # category the language does not declare, a severity outside the
@@ -48,14 +48,16 @@ module Hecks
       # `Ports::Authentication::ValidationError` already is, so no
       # caller ever rescues a raw parser error leaking out of an
       # adapter.
-      ValidationError = Class.new(StandardError)
+      class ValidationError < StandardError
+      end
 
       # Nothing answered at all — the binary is missing, the subprocess
       # died, the call timed out. Separate from ValidationError on
       # purpose: unavailable means retry or fall back to asking the
       # human directly; malformed means the PROMPT is wrong, not the
       # transport, and retrying identically will not fix it.
-      Unavailable = Class.new(StandardError)
+      class Unavailable < StandardError
+      end
 
       # ── what the four operations hand back ──────────────────────────
       #

data/lib/hecks/ports/authentication.rb

@@ -17,9 +17,10 @@ module Hecks
     # purely to resolve which adapter answers it, same as every port
     # here already does).
     module Authentication
-      NAME = "authentication"
+      NAME = "authentication".freeze
 
-      ValidationError = Class.new(StandardError)
+      class ValidationError < StandardError
+      end
 
       module_function
 

data/lib/hecks/ports/authorization.rb

@@ -27,7 +27,7 @@ module Hecks
     # not in the same boot as the caller; this port is the same
     # questions asked through one adapter when it is.
     module Authorization
-      NAME = "authorization"
+      NAME = "authorization".freeze
 
       module_function
 

data/lib/hecks/ports/clock.rb

@@ -33,7 +33,7 @@ module Hecks
     # runs of exactly that shape. So the filling happens at the door, where a
     # human or an agent is typing, and never on the dispatch path a replay uses.
     module Clock
-      NAME = "clock"
+      NAME = "clock".freeze
 
       module_function
 

data/lib/hecks/ports/extraction.rb

@@ -2,8 +2,12 @@ require_relative "../runtime/registry"
 
 module Hecks
   module Ports
+    # The `extraction` port: resolves whichever adapter can recover a
+    # predicate's own source (`canonical`). Reads `Hecks.current_registry`
+    # directly rather than taking a registry argument, since extraction only
+    # ever happens while a bluebook is loading, never after boot.
     module Extraction
-      NAME = "extraction"
+      NAME = "extraction".freeze
 
       module_function
 

data/lib/hecks/ports/identity_assignment.rb

@@ -18,7 +18,7 @@ module Hecks
     # it, the same "one adapter registry-wide, refuse if zero or many"
     # resolution every other port here already uses.
     module IdentityAssignment
-      NAME = "identity_assignment"
+      NAME = "identity_assignment".freeze
 
       module_function
 

data/lib/hecks/ports/identity_generation.rb

@@ -24,7 +24,7 @@ module Hecks
     # the identical way: it fires on every dispatch, replay included,
     # and comparison simply excludes it.
     module IdentityGeneration
-      NAME = "identity_generation"
+      NAME = "identity_generation".freeze
 
       module_function
 

data/lib/hecks/ports/identity_resolution.rb

@@ -13,7 +13,7 @@ module Hecks
     # way `Authorization#holds_role?` answering `false` decides nothing
     # on its own.
     module IdentityResolution
-      NAME = "identity_resolution"
+      NAME = "identity_resolution".freeze
 
       module_function
 

data/lib/hecks/ports/loading.rb

@@ -2,8 +2,11 @@ require_relative "../adapters/driven/folder"
 
 module Hecks
   module Ports
+    # The `loading` port: `bootstrap` hands back the Folder adapter that
+    # reads bluebook files off disk to build the very first registry, before
+    # any other port has a registry to resolve against.
     module Loading
-      NAME = "loading"
+      NAME = "loading".freeze
 
       module_function
 

data/lib/hecks/ports/persistence/append_only.rb

@@ -23,12 +23,14 @@ module Hecks
           @adapter = adapter
           required = %i[append project entries]
           missing = required.reject { |method| adapter.respond_to?(method) }
-          raise Runtime::WiringError,
-                "#{adapter.class} does not implement append-only persistence: #{missing.join(', ')}" unless missing.empty?
+          unless missing.empty?
+            raise Runtime::WiringError,
+                  "#{adapter.class} does not implement append-only persistence: #{missing.join(', ')}"
+          end
         end
 
         def find(id) = @adapter.find(id)
-        def all(**opts) = @adapter.all(**opts)
+        def all(**) = @adapter.all(**)
         def count = @adapter.count
         def entries = @adapter.entries
 
@@ -94,7 +96,8 @@ module Hecks
 
         def atomic_put(instance, insert_only: false)
           unless capabilities.include?(:atomic_put) && @adapter.respond_to?(:atomic_put)
-            raise Runtime::WiringError, "#{@adapter.class} advertises no atomic_put persistence capability"
+            raise Runtime::WiringError,
+                  "#{@adapter.class} advertises no atomic_put persistence capability"
           end
 
           entry = Entry.new(operation: "save", id: instance.id.to_s, state: instance.state.dup)
@@ -127,6 +130,39 @@ module Hecks
           @adapter.record_event(event) if @adapter.respond_to?(:record_event)
         end
 
+        # ONE COMMIT BOUNDARY FOR SAVE + EMIT + OUTBOX — `Interpreting#
+        # run_dispatch_order` runs the `save` and `emit` steps inside
+        # this block, so an adapter that owns a real transaction
+        # (Sqlite, Postgres) commits the aggregate row, its journal
+        # entry, and the outbox rows together or not at all. An adapter
+        # without one just yields: Memory has nothing to roll back, and
+        # a file adapter's own `with_lock` already serialises its pair
+        # of writes. Nested calls are the adapter's problem to make
+        # re-entrant (both SQL adapters check for an open transaction
+        # first) — a reaction dispatched from inside a drain never nests
+        # here anyway, because draining happens after this block returns.
+        def transaction(&)
+          return @adapter.transaction(&) if @adapter.respond_to?(:transaction)
+
+          yield
+        end
+
+        # THE OUTBOX CONTRACT — four optional adapter methods, probed
+        # together the way `save_saga`/`delete_saga`/`each_saga` are
+        # (`Registry::SagaPersistence`): an adapter either has an outbox
+        # or it doesn't, never half of one. See `Runtime::Outbox`.
+        OUTBOX_METHODS = %i[outbox_enqueue outbox_claim outbox_settle outbox_rows].freeze
+
+        def outbox?
+          @outbox = OUTBOX_METHODS.all? { |method| @adapter.respond_to?(method) } if @outbox.nil?
+          @outbox
+        end
+
+        def outbox_enqueue(rows) = @adapter.outbox_enqueue(rows)
+        def outbox_claim(id) = @adapter.outbox_claim(id)
+        def outbox_settle(id, status:, error: nil) = @adapter.outbox_settle(id, status: status, error: error)
+        def outbox_rows(status: nil) = @adapter.outbox_rows(status: status)
+
         def query_read_model(domain, model, args, bluebook = nil)
           return unless @adapter.respond_to?(:query_read_model)
 

data/lib/hecks/ports/persistence/binding_policy.rb

@@ -46,7 +46,7 @@ module Hecks
 
         def unsupported_roles(domain, aggregate, bindings)
           Runtime::WiringError.new(
-            "#{domain}::#{aggregate.hecks_name} uses persistence role#{bindings.size == 1 ? '' : 's'} " \
+            "#{domain}::#{aggregate.hecks_name} uses persistence role#{'s' unless bindings.size == 1} " \
             "#{bindings.map(&:role).map(&:inspect).join(', ')}. Only persisted_by is supported."
           )
         end

data/lib/hecks/ports/persistence/plugin.rb

@@ -1,5 +1,8 @@
 module Hecks
   module Ports
+    # Reopened to hold the persistence-plugin registry (`Plugin`, below) and
+    # its call surface (`register_plugin`/`plugin?`/`each_plugin`) — see ADR
+    # 0033 and `Plugin`'s own header for the seam this fills.
     module Persistence
       # A tiny, real seam — ADR 0033. Core never names a persistence plugin;
       # a plugin makes itself known as a side effect of being `require`d, the

data/lib/hecks/ports/persistence/plugins/era/era_check.rb

@@ -105,7 +105,9 @@ module Hecks
       def source_text_for(bluebook, directory)
         domain_files = Dir[File.join(directory, "*.bluebook")]
         own = domain_files.select do |path|
-          File.foreach(path, encoding: "UTF-8").any? { |line| line.match?(/\A\s*Hecks\.bluebook\s+#{Regexp.escape(bluebook.name.inspect)}/) }
+          File.foreach(path, encoding: "UTF-8").any? do |line|
+            line.match?(/\A\s*Hecks\.bluebook\s+#{Regexp.escape(bluebook.name.inspect)}/)
+          end
         end
         own = domain_files if own.empty? && domain_files.size == 1 && !Framework.members.key?(bluebook.name)
         own = [Framework.members[bluebook.name]].compact if own.empty?

data/lib/hecks/ports/persistence/plugins/era/era_guard/shape_diff.rb

@@ -7,9 +7,9 @@ module Hecks
       # call it too.
       module ShapeDiff
         def shape(aggregate)
-          aggregate.attributes.map { |attribute|
+          aggregate.attributes.map do |attribute|
             [attribute.name, attribute_signature(aggregate, attribute.type)]
-          }.sort_by(&:first)
+          end.sort_by(&:first)
         end
 
         # A plain type name for a primitive; `[type_name, member_signatures]`
@@ -20,9 +20,9 @@ module Hecks
           container = nested_type(aggregate, type_name)
           return type_name if container.nil? || seen.include?(type_name)
 
-          members = container.attributes.map { |member|
+          members = container.attributes.map do |member|
             [member.name, attribute_signature(aggregate, member.type, seen + [type_name])]
-          }.sort_by(&:first)
+          end.sort_by(&:first)
           [type_name, members]
         end
 
@@ -64,7 +64,7 @@ module Hecks
           return false if attribute.list?
 
           value_object = aggregate.value_object(attribute.type)
-          return false if value_object && value_object.attributes.all? { |field| !field.default.nil? }
+          return false if value_object&.attributes&.all? { |field| !field.default.nil? }
 
           true
         end

data/lib/hecks/ports/persistence/plugins/era/lineage.rb

@@ -117,6 +117,15 @@ module Hecks
         # outright (nothing to be a prefix of on the held side), unlike
         # every rule above it, which explains a path that existed and
         # moved, converted, or vanished.
+        #
+        # One `||` chain over a closed, fixed set of rule kinds (renames,
+        # moves, converts, drops, computes, backfills) — the same six this
+        # file's other methods enumerate. Splitting each disjunct into its
+        # own predicate would scatter one question ("does ANY rule explain
+        # this path") across six same-shaped methods with nothing else to
+        # do.
+        # rubocop:disable-next Metrics/CyclomaticComplexity
+        # rubocop:disable-next Metrics/PerceivedComplexity
         def explains?(path)
           path = path.to_s
           top = path.split(".").first
@@ -202,12 +211,12 @@ module Hecks
         def apply_renames(state, renames)
           snapshot = renames.filter_map { |old_name, new_name| [old_name, new_name, state[old_name]] if state.key?(old_name) }
           snapshot.each { |old_name, _new_name, _value| state.delete(old_name) }
-          # rubocop:disable Style/CombinableLoops -- NOT combinable: a swap
-          # (:a<->:b) needs every delete done before any write, or the first
-          # rename's write becomes the second rename's delete target — see
-          # this method's own comment above.
+          # NOT combinable (Style/CombinableLoops is disabled repo-wide, see
+          # .rubocop.yml, for exactly this reason): a swap (:a<->:b) needs
+          # every delete done before any write, or the first rename's write
+          # becomes the second rename's delete target — see this method's
+          # own comment above.
           snapshot.each { |_old_name, new_name, value| state[new_name] = value }
-          # rubocop:enable Style/CombinableLoops
         end
 
         def apply_drop(state, name)

data/lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/era_store.rb

@@ -6,6 +6,10 @@ module Hecks
   module Adapters
     class PostgresEra
       class Lineage
+        # CRUD over `hecks_eras`/`hecks_era_texts`/`hecks_approvals`: reading
+        # and tamper-verifying held era text, archiving every frozen text
+        # version, recording a Layer-3 approval, and minting an era's name
+        # once (never recomputed after).
         module EraStore
           # Every held text is verified against its raw-byte digest on the
           # way out — an edited storage fact refuses rather than silently

data/lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/field_cache.rb

@@ -89,7 +89,7 @@ module Hecks
               source_sql: lambda do |cursor|
                 <<~SQL
                   SELECT id, ordinal, value FROM (#{field_cache_source_sql(storage_name, era, value_expression)}) reduced
-                  #{cursor ? "WHERE id > #{text_literal(cursor)}" : ''}
+                  #{"WHERE id > #{text_literal(cursor)}" if cursor}
                   ORDER BY id LIMIT #{ResumableBackfill::CHUNK_SIZE}
                 SQL
               end,

data/lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/head_compiler.rb

@@ -5,6 +5,12 @@ module Hecks
   module Adapters
     class PostgresEra
       class Lineage
+        # The read side of lineage: builds and maintains, per aggregate per
+        # era, the head-snapshot table (`ensure_head_snapshot!`/
+        # `backfill_head_snapshot!`) and the compiled materialized
+        # view/plain view (`compile_head!`) that translate and reduce the
+        # append-only journal into the single current-era head a query
+        # actually reads.
         module HeadCompiler
           # ── head compilation ───────────────────────────────────────────
 
@@ -124,7 +130,7 @@ module Hecks
                     SELECT DISTINCT ON (aggregate_id) aggregate_id AS id, ordinal, operation, state
                     FROM #{quoted_journal}
                     WHERE era = #{era.to_i} AND aggregate = #{text_literal(storage_name)}
-                    #{cursor ? "AND aggregate_id > #{text_literal(cursor)}" : ''}
+                    #{"AND aggregate_id > #{text_literal(cursor)}" if cursor}
                     ORDER BY aggregate_id, ordinal DESC
                   ) latest WHERE operation = 'save' ORDER BY id LIMIT #{ResumableBackfill::CHUNK_SIZE}
                 SQL
@@ -160,8 +166,8 @@ module Hecks
           # re-raised) on failure, and either way the surrounding
           # transaction is never touched — no early COMMIT, no early
           # release of whatever advisory lock it holds.
-          def nested_transaction(name)
-            return @db.transaction { yield } if @db.transaction_status == PG::PQTRANS_IDLE
+          def nested_transaction(name, &)
+            return @db.transaction(&) if @db.transaction_status == PG::PQTRANS_IDLE
 
             @db.exec("SAVEPOINT #{name}")
             begin
@@ -252,8 +258,31 @@ module Hecks
           # written under — so the final edge applies uniformly, with no
           # per-era CASE. That equality is asserted, not argued: the spec
           # builds a third era both ways and diffs them.
+          # `edges.size != era - 1` — added alongside `head_body_sql`
+          # below, not merely a pre-existing guard: `names_by_era(aggregate,
+          # edges)` sizes `names[:storage]` to `edges.size + 1`, and the
+          # union above indexes it at `names[:storage][era - 2]` — CORRECT
+          # only when `edges` is the FULL chain reaching `era` (mint's own
+          # call, and the audit's own "after" reading, both are). A caller
+          # handed a SHORTER chain against the SAME `era` — exactly what
+          # the audit's own "before" reading is, `chain[0..-2]` against the
+          # unchanged target era — would index `names[:storage]` out of
+          # its real bounds instead of falling back to `chain_sql` the way
+          # every other mismatch here already does. Guarded structurally,
+          # not by trusting every future caller to know this invariant.
+          #
+          # The guard clauses above ARE the method: each rules out one way
+          # the layered shortcut cannot honestly apply (era too young, too
+          # few edges, a mismatched chain length, no prior era, no label,
+          # no materialized prior view) before the SQL-building tail runs.
+          # Splitting them out would separate each guard from the algebra
+          # comment it protects, and thread `held`/`prior`/`prior_view`
+          # back out as return values with no simpler shape than they
+          # already have.
+          # rubocop:disable-next Metrics/CyclomaticComplexity
+          # rubocop:disable-next Metrics/PerceivedComplexity
           def layered_chain_sql(aggregate, era, edges)
-            return nil if era < 3 || edges.size < 2
+            return nil if era < 3 || edges.size < 2 || edges.size != era - 1
 
             held = eras
             prior = held.find { |candidate| candidate[:ordinal] == era - 1 }
@@ -266,7 +295,12 @@ module Hecks
             cut = held.find { |candidate| candidate[:ordinal] == era }&.dig(:watermark)
             declared = edges.last[:translation].for_aggregate(names[:current][edges.size])
             expression = declared ? Translation::RuleCompiler.compile_rules(declared) : "state"
-            id_column = Translation::RuleCompiler.rekeyed?(declared) ? Translation::RuleCompiler.id_case("operation = 'save'", declared) : "aggregate_id"
+            id_column = if Translation::RuleCompiler.rekeyed?(declared)
+                          Translation::RuleCompiler.id_case("operation = 'save'",
+                                                            declared)
+                        else
+                          "aggregate_id"
+                        end
 
             <<~SQL
               WITH layered AS (
@@ -274,7 +308,7 @@ module Hecks
                   SELECT ordinal, aggregate_id, operation, state FROM #{quote(prior_view)}
                   UNION ALL
                   SELECT ordinal, aggregate_id, operation, state FROM #{quoted_journal}
-                  WHERE era = #{era - 1} AND aggregate = #{text_literal(names[:storage][era - 2])}#{cut ? " AND ordinal <= #{cut}" : ''}
+                  WHERE era = #{era - 1} AND aggregate = #{text_literal(names[:storage][era - 2])}#{" AND ordinal <= #{cut}" if cut}
                 ) layers ORDER BY aggregate_id, ordinal DESC
               )
               SELECT ordinal, #{id_column}, operation,
@@ -290,7 +324,12 @@ module Hecks
               declared = edge[:translation].for_aggregate(names[:current][index + 1])
               expression = declared ? Translation::RuleCompiler.compile_rules(declared) : "state"
               guard = "era <= #{index + 1} AND operation = 'save'"
-              id_column = Translation::RuleCompiler.rekeyed?(declared) ? Translation::RuleCompiler.id_case(guard, declared) : "aggregate_id"
+              id_column = if Translation::RuleCompiler.rekeyed?(declared)
+                            Translation::RuleCompiler.id_case(guard,
+                                                              declared)
+                          else
+                            "aggregate_id"
+                          end
               "edge_#{index + 1} AS (SELECT ordinal, era, #{id_column}, operation, " \
                 "CASE WHEN #{guard} THEN #{expression} ELSE state END AS state " \
                 "FROM #{index.zero? ? 'tail' : "edge_#{index}"})"
@@ -305,9 +344,19 @@ module Hecks
 
           # The translated tail as it would stand in era `era`, latest
           # entry per id, saves only — what the audit holds up against the
-          # bluebook and the edge.
+          # bluebook and the edge. Reads through `head_body_sql`, the SAME
+          # layered-or-full choice `compile_head!` makes at real mint time
+          # (that method's own comment has the full reasoning) — so this
+          # is provably what the real mint will materialize, not a second
+          # implementation that could silently drift from it. Safe for
+          # BOTH real callers: the "after" reading (`edges` is the full
+          # chain reaching `era`) and the "before" reading (`edges` one
+          # shorter, same `era` — `audit.rb`'s own `samples_for`/`check`
+          # callers) — `layered_chain_sql`'s own `edges.size != era - 1`
+          # guard falls back to `chain_sql` exactly when the shorter
+          # chain can't honestly answer the layered question.
           def translated_latest(aggregate, era, edges)
-            latest_of(chain_sql(aggregate, era, edges))
+            latest_of(head_body_sql(aggregate, era, edges))
           end
 
           # The UNtranslated ancestor tail, latest entry per id — the
@@ -363,15 +412,30 @@ module Hecks
           # write count; the ancestor side was already bounded that way
           # (the matview only ever holds the reduced tail, never raw
           # history — see latest_per_id's own comment).
+          # THE ONE PLACE THAT PICKS layered VS full — pulled out so the
+          # audit's own preview (`translated_latest`, below: both
+          # `bin/translation_audit`'s standalone run and the real
+          # mint-time gate in coverage_check.rb#audit!) reads through the
+          # IDENTICAL branch selection a real mint's own `compile_head!`
+          # will use, rather than a second, hand-kept-in-sync copy of this
+          # same "layered when eligible, else full" choice. Before this,
+          # `translated_latest` called `chain_sql` unconditionally — for
+          # any era >= 3, the real mint (this method, `full: false` by
+          # default) could materialize via the LAYERED path while the
+          # preview that approved it never exercised that branch at all.
+          # `full:` mirrors `compile_head!`'s own default; tail_merge's
+          # `full: true` rebuild is the one caller that ever needs the
+          # non-layered branch unconditionally.
+          def head_body_sql(aggregate, era, edges, full: false)
+            return chain_sql(aggregate, era, edges) if full
+
+            layered_chain_sql(aggregate, era, edges) || chain_sql(aggregate, era, edges)
+          end
+
           def compile_head!(aggregate, era, label, edges, full: false)
             storage_name = aggregate.storage_name
             view = matview(storage_name, era, label)
-            body =
-              if !full && (layered = layered_chain_sql(aggregate, era, edges))
-                layered
-              else
-                chain_sql(aggregate, era, edges)
-              end
+            body = head_body_sql(aggregate, era, edges, full: full)
             @db.exec(<<~SQL)
               CREATE MATERIALIZED VIEW #{quote(view)} AS
               #{body}
@@ -445,7 +509,7 @@ module Hecks
               cut = watermarks[ancestor + 1]
               "SELECT ordinal, era, aggregate, aggregate_id, operation, state FROM #{quoted_journal} " \
                 "WHERE era = #{ancestor} AND aggregate = #{text_literal(names[:storage][ancestor - 1])}" \
-                "#{cut ? " AND ordinal <= #{cut}" : ''}"
+                "#{" AND ordinal <= #{cut}" if cut}"
             end
             selects.join(" UNION ALL ")
           end

data/lib/hecks/ports/persistence/plugins/era/postgres_era/lineage/mint_transaction.rb

@@ -5,6 +5,11 @@ module Hecks
   module Adapters
     class PostgresEra
       class Lineage
+        # `mint_era!` itself: one transaction that writes the new era row,
+        # attaches its partition, recompiles every aggregate's head, grants
+        # an app role, and — last, right before commit — advances the
+        # current-era RLS fence (`advance_era!`) that drops write access to
+        # the old schema the instant it commits.
         module MintTransaction
           # ── the mint transaction ───────────────────────────────────────
           #
@@ -30,7 +35,8 @@ module Hecks
 
             watermark = last_ordinal
             @db.exec_params(
-              "INSERT INTO hecks_eras (domain, ordinal, hash, label, held_text, watermark, held_digest, held_projection, canon_form) " \
+              "INSERT INTO hecks_eras (domain, ordinal, hash, label, held_text, watermark, held_digest, " \
+              "held_projection, canon_form) " \
               "VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
               [@domain, ordinal, hash, label, held_text, watermark, Digest::SHA256.hexdigest(held_text),
                projection && JSON.generate(projection), Runtime::StorageShape::FORM_VERSION]
@@ -70,13 +76,21 @@ module Hecks
             @db.exec("COMMIT")
             true
           rescue PG::LockNotAvailable
-            @db.exec("ROLLBACK") rescue nil
+            begin
+              @db.exec("ROLLBACK")
+            rescue StandardError
+              nil
+            end
             raise Runtime::WiringError,
                   "cannot mint era #{ordinal} of #{@domain}: another mint holds the domain lock — " \
                   "waited 10s; try again shortly"
-          rescue PG::Error => error
-            @db.exec("ROLLBACK") rescue nil
-            raise Runtime::WiringError, "cannot mint era #{ordinal} of #{@domain}: #{error.message.strip}"
+          rescue PG::Error => e
+            begin
+              @db.exec("ROLLBACK")
+            rescue StandardError
+              nil
+            end
+            raise Runtime::WiringError, "cannot mint era #{ordinal} of #{@domain}: #{e.message.strip}"
           end
 
           # Base privileges for a deployment's app role — a NON-owner,
@@ -116,7 +130,10 @@ module Hecks
             aggregates.each do |aggregate|
               storage_name = aggregate.storage_name
               @db.exec("GRANT SELECT, INSERT, UPDATE, DELETE ON #{quote(head_snapshot(storage_name, era))} TO #{quoted_role}")
-              @db.exec("GRANT SELECT ON #{quote(head_view(storage_name))} TO #{quoted_role}") if view_exists?(head_view(storage_name))
+              if view_exists?(head_view(storage_name))
+                @db.exec("GRANT SELECT ON #{quote(head_view(storage_name))} " \
+                         "TO #{quoted_role}")
+              end
             end
           end