hecks 1.0.2 → 1.1.0

data/lib/hecks/runtime/value/coercion.rb

@@ -49,8 +49,21 @@ module Hecks
         # recursively via `build`) with `scalar` as what's left once
         # neither of those applies (the raw value, passed through
         # unchanged).
-        def for_attribute(aggregate, attribute, value)
-          return value if attribute.nil? || value.nil? # :optional
+        # `boundary: false` is the QUERY door (`QueryInterpreter#normalize_args`):
+        # a query attribute's declared type names the argument for callers and
+        # generators, never a runtime shape — comparison unwraps both sides
+        # itself, so a `reference: {value: ...}` offered against a `String`
+        # query field is the documented allowance (see banking's own
+        # `Account.OpenForCustomer`), not a C3.8 mismatch.
+        # `argument: true` is the CALLER'S door only (`Interpreting#normalize_
+        # args`, every command/entity/port dispatch): the one place a nil
+        # for a non-optional attribute is the caller leaving a required
+        # argument empty (C3.7). Every other caller — `sets` copying an
+        # optional argument into state, hydration, entity elements,
+        # identity, defaults — is state assembly, where nil is a legitimate
+        # "absent is not empty" value the aggregate's own attribute may hold.
+        def for_attribute(aggregate, attribute, value, boundary: true, argument: false)
+          return nil_or_missing(aggregate, attribute, value, argument) if attribute.nil? || value.nil?
           return reference_list(attribute, value) if attribute.list? && attribute.reference?
           return reference_identity(attribute, value) if attribute.reference?
           return hydrate_entity_list(aggregate, attribute, value) if attribute.list? # :list
@@ -64,21 +77,65 @@ module Hecks
           # AFTER coercion, not before: a scalar arrives wrapped in whatever holder
           # its type names (`{value: "append"}` for an OpName), and checking the
           # raw payload would be checking the envelope.
-          coerced = value_object_for(aggregate, attribute.type)
-                    .then do |value_object|
-                      if value.is_a?(self) && value.type_name == value_object&.hecks_name
-                        value
-                      elsif value_object
-                        build(value_object, fields_for(value_object, attribute.name, value), aggregate)
-                      else
-                        value
-                      end
+          value_object = value_object_for(aggregate, attribute.type)
+          return bare_primitive(aggregate, attribute, value, boundary) if value_object.nil?
+
+          coerced = if value.is_a?(self) && value.type_name == value_object.hecks_name
+                      value
+                    else
+                      build(value_object, fields_for(value_object, attribute.name, value), aggregate)
                     end
 
           admit_declared_set(aggregate, attribute, coerced)
           coerced
         end
 
+        # NIL IS NOT A VALUE FOR A NON-OPTIONAL ARGUMENT (C3.7/C3.8). An
+        # `optional:` attribute and a load from the store pass nil through
+        # as they always did; a command argument offered as null for a
+        # required attribute is
+        # refused as the field the caller left empty — a value object is
+        # BUILT from no fields, so its first required field refuses with
+        # exactly the wording the Rust side's `from_json` gives it
+        # ("Money.cents expects Integer, got nil"), and a bare scalar
+        # refuses through `check_bare_primitive`'s own wording. Lists and
+        # references keep their nil passthrough (their absence is an empty
+        # relationship, `validate_relationship_cardinality`'s business).
+        # The `attribute.nil?`/`value.nil?` branch of `for_attribute`,
+        # pulled out on its own — an unknown attribute has no shape left
+        # to branch on, and a nil VALUE is either an ordinary absence
+        # (state assembly, hydration, a query ask) or, at the argument
+        # door only, `nil_argument`'s own C3.7 refusal.
+        private def nil_or_missing(aggregate, attribute, value, argument)
+          return value if attribute.nil? || !value.nil?
+
+          argument ? nil_argument(aggregate, attribute) : value
+        end
+
+        private def nil_argument(aggregate, attribute)
+          return nil if attribute.optional? || trusting_stored_state?
+          return nil if attribute.list? || attribute.reference?
+
+          value_object = aggregate.respond_to?(:value_object) ? value_object_for(aggregate, attribute.type) : nil
+          return build(value_object, {}, aggregate) if value_object
+
+          raise TypeMismatch,
+                RefusalWording.render("TypeMismatch", "numeric_field",
+                                      type: aggregate.hecks_name, field: attribute.name,
+                                      expected: attribute.type, offered: "nil")
+        end
+
+        # A BARE PRIMITIVE IS TYPE-CHECKED AT THE BOUNDARY TOO (C3.8,
+        # docs/semantics/bluebook-semantics.md) — the same two predicates a
+        # value object's own fields get, so wrong-typed caller input is a
+        # TypeMismatch refusal here, never an evaluation fault later. Its
+        # `admits:` set is still checked, exactly as a value object's is.
+        private def bare_primitive(aggregate, attribute, value, boundary)
+          check_bare_primitive(aggregate, attribute, value) if boundary
+          admit_declared_set(aggregate, attribute, value)
+          value
+        end
+
         # Aggregate-local value objects remain authoritative, which permits
         # intentional duplication. An ordinary fact may also name an identity
         # value object declared on another aggregate; that shape is borrowed
@@ -112,29 +169,43 @@ module Hecks
           paths = target.identity_paths
           return value if paths.empty?
 
-          direct_head = if value.is_a?(self) && target.identity_heads.one?
-                          head = target.identity_heads.first
-                          target.attribute(head)&.type.to_s == value.type_name ? head.to_s : nil
-                        end
-
-          parts = paths.map do |path|
-            segments = path.to_s.split(".")
-            segments.shift if direct_head && segments.first == direct_head
-            segments.reduce(materialized) do |held, segment|
-              next nil unless held.is_a?(Hash)
-
-              # `key?` decides which spelling answers, never `||` — a
-              # genuinely-held `false` must not fall through to the
-              # other spelling (usually absent) and read as `nil`.
-              sym = segment.to_sym
-              held.key?(sym) ? held[sym] : held[segment]
-            end
-          end
+          direct_head = direct_identity_head(value, target)
+          parts = paths.map { |path| identity_part(materialized, path, direct_head) }
           return value if parts.any? { |part| part.nil? || (part.respond_to?(:empty?) && part.empty?) }
 
           Naming.identity(parts)
         end
 
+        # Whether `value` is itself the target's own (single) identity
+        # value object — pure, self-contained: reads only `value` and
+        # `target`, decides nothing about any particular path.
+        def direct_identity_head(value, target)
+          return nil unless value.is_a?(self) && target.identity_heads.one?
+
+          head = target.identity_heads.first
+          target.attribute(head)&.type.to_s == value.type_name ? head.to_s : nil
+        end
+
+        # One identity path's own value out of the materialized hash —
+        # stripping a leading segment already covered by
+        # `direct_identity_head`, then walking the rest. Pure given its
+        # three inputs; extracted from `reference_identity` alongside
+        # `direct_identity_head` above purely to keep that method to its
+        # own guard-clause shape.
+        def identity_part(materialized, path, direct_head)
+          segments = path.to_s.split(".")
+          segments.shift if direct_head && segments.first == direct_head
+          segments.reduce(materialized) do |held, segment|
+            next nil unless held.is_a?(Hash)
+
+            # `key?` decides which spelling answers, never `||` — a
+            # genuinely-held `false` must not fall through to the
+            # other spelling (usually absent) and read as `nil`.
+            sym = segment.to_sym
+            held.key?(sym) ? held[sym] : held[segment]
+          end
+        end
+
         def reference_list(attribute, value)
           unless value.is_a?(Array)
             raise TypeMismatch,
@@ -170,9 +241,7 @@ module Hecks
           # refuse below, unchanged -- only the genuinely unambiguous
           # single-field case auto-wraps, matching from_identifier's own
           # precedent exactly.
-          if value_object.attributes.size == 1
-            return { value_object.attributes.first.name => value }
-          end
+          return { value_object.attributes.first.name => value } if value_object.attributes.size == 1
 
           raise TypeMismatch,
                 RefusalWording.render("TypeMismatch", "value_object_shape",
@@ -218,7 +287,7 @@ module Hecks
         # `build`, so a nested field's own default is filled in before its
         # own invariants read it.
         def normalize_composite_fields(aggregate, value_object, fields)
-          return fields unless aggregate&.respond_to?(:value_object)
+          return fields unless aggregate.respond_to?(:value_object)
 
           value_object.attributes.each do |attribute|
             next if attribute.list? || !fields.key?(attribute.name)
@@ -250,13 +319,22 @@ module Hecks
         # the same way, with exactly the same wording, as the identical type
         # declared directly on a command.
         def validate!(value_object, fields)
+          # C6.3 (docs/semantics/bluebook-semantics.md) — a value object is
+          # validated on CONSTRUCTION FROM INPUT only; state read back from
+          # the store is trusted as it was written, so tightening an
+          # invariant never makes an old record unreadable (migration is
+          # the era system's job). `hydrate` — the one load door — sets
+          # the flag; every input door leaves it unset.
+          return if trusting_stored_state?
+
+          check_required_fields(value_object, fields)
           admit_member(value_object, fields)
           check_admitted(value_object, fields)
           check_numeric_fields(value_object, fields)
           check_scalar_shapes(value_object, fields)
           check_patterns(value_object, fields)
           value_object.invariants.each do |invariant|
-            next if Bluebook::Expression::Evaluator.call(invariant.canonical, fields)
+            next if Bluebook::Expression::Evaluator.call_rule(invariant, fields)
 
             raise InvariantViolation,
                   RefusalWording.render("InvariantViolation", "value_object_invariant",
@@ -273,13 +351,27 @@ module Hecks
         end
 
         def hydrate(aggregate, state)
-          state.each_with_object({}) do |(name, value), hydrated|
-            key       = name.to_sym
-            attribute = aggregate.attribute(key)
-            hydrated[key] = attribute ? for_attribute(aggregate, attribute, value) : value
+          trusting_stored_state do
+            state.each_with_object({}) do |(name, value), hydrated|
+              key       = name.to_sym
+              attribute = aggregate.attribute(key)
+              hydrated[key] = attribute ? for_attribute(aggregate, attribute, value) : value
+            end
           end
         end
 
+        TRUSTED_LOAD_KEY = :hecks_trusting_stored_state
+
+        def trusting_stored_state
+          previous = Thread.current[TRUSTED_LOAD_KEY]
+          Thread.current[TRUSTED_LOAD_KEY] = true
+          yield
+        ensure
+          Thread.current[TRUSTED_LOAD_KEY] = previous
+        end
+
+        def trusting_stored_state? = Thread.current[TRUSTED_LOAD_KEY] == true
+
         # S17, ADR 0026 — SEARCHES THE WHOLE ENTITY TREE, not only the
         # root's own direct children. `aggregate` here is always the
         # ROOT aggregate — `for_attribute`'s own `aggregate` argument is
@@ -307,16 +399,16 @@ module Hecks
           entity = find_entity(aggregate, attribute.type.to_s)
           return value unless entity
 
-          Array(value).map do |element|
+          hydrated = Array(value).map do |element|
             next element unless element.is_a?(Hash)
 
-            element.each_with_object({}) do |(name, field_value), hydrated|
+            element.each_with_object({}) do |(name, field_value), acc|
               key = name.to_sym
               field = entity.attribute(key)
-              hydrated[key] = field ? for_attribute(aggregate, field, field_value) : field_value
+              acc[key] = field ? for_attribute(aggregate, field, field_value) : field_value
             end
           end
-                      .then { |hydrated| Freezer.deep(hydrated) }
+          Freezer.deep(hydrated)
         end
 
         # `Value.identifier` used to live here: hand it a one-field value object
@@ -451,6 +543,78 @@ module Hecks
         # where the domain should have said no, and the run contract recorded the
         # crash beside genuine refusals as though the domain had judged it.
         #
+        # C3.8 — the boundary check for an attribute whose type is a bare
+        # primitive rather than a value object: `Integer`/`Float` by exact
+        # numeric class (`NUMERIC`), `String`/booleans by rejecting a
+        # composite shape (`COMPOSITE_SHAPES`) — identical to what
+        # `check_numeric_fields`/`check_scalar_shapes` hold a value
+        # object's own fields to, worded by the same template with the
+        # owning construct as `type`. A `String` field still admits any
+        # other scalar (the self-hosted grammar's own bootstrap relies on
+        # it — see `check_scalar_shapes`' comment); the Rust boundary is
+        # stricter there, recorded in the clause.
+        private def check_bare_primitive(owner, attribute, value)
+          type = attribute.type.to_s
+          expected = NUMERIC[type]
+          mistyped = if expected
+                       !value.is_a?(expected)
+                     elsif NON_NUMERIC_SCALARS.include?(type)
+                       COMPOSITE_SHAPES.any? { |shape| value.is_a?(shape) }
+                     else
+                       false
+                     end
+          if mistyped
+            raise TypeMismatch,
+                  RefusalWording.render("TypeMismatch", "numeric_field",
+                                        type: owner.hecks_name, field: attribute.name,
+                                        expected: type, offered: Rendering.describe(value))
+          end
+
+          check_numeric_bounds(owner.hecks_name, attribute.name, value)
+        end
+
+        # C3.3/C3.4 — the value model's own bounds, held at every boundary:
+        # an Integer must fit in signed 64 bits, a Float must be finite.
+        # One check for value-object fields and bare-primitive arguments
+        # alike (`check_numeric_fields` and `check_bare_primitive`).
+        INT64_RANGE = (-(2**63))..((2**63) - 1)
+
+        private def check_numeric_bounds(type_name, field_name, given)
+          if given.is_a?(Integer) && !INT64_RANGE.cover?(given)
+            raise TypeMismatch,
+                  RefusalWording.render("TypeMismatch", "integer_range",
+                                        type: type_name, field: field_name, offered: Rendering.describe(given))
+          end
+          return unless given.is_a?(Float) && !given.finite?
+
+          raise TypeMismatch,
+                RefusalWording.render("TypeMismatch", "non_finite_field",
+                                      type: type_name, field: field_name, offered: Rendering.describe(given))
+        end
+
+        # C3.7 — A VALUE OBJECT IS A TYPED FIELD PRODUCT: every non-optional
+        # field arrives, or construction refuses. A missing field and a null
+        # one are the same absence (`fields[name]` reads nil for both), worded
+        # as the type mismatch it is — "{type}.{field} expects {expected}, got
+        # nil" — the identical string the Rust side's generated `from_json`
+        # gives the same input, so the corpus can pin it on both. Checked
+        # FIRST: an invariant reading a field that never arrived is exactly
+        # the thing that used to answer "invariant violated" (or nothing at
+        # all — `ToppingName`'s `{value: null}` used to be accepted and
+        # stored). A `default:` has already been filled in by `apply_defaults`;
+        # a list field's absence is an empty list, never a refusal.
+        private def check_required_fields(value_object, fields)
+          value_object.attributes.each do |attribute|
+            next if attribute.optional? || attribute.list?
+            next unless fields[attribute.name].nil?
+
+            raise TypeMismatch,
+                  RefusalWording.render("TypeMismatch", "numeric_field",
+                                        type: value_object.hecks_name, field: attribute.name,
+                                        expected: attribute.type, offered: "nil")
+          end
+        end
+
         # Checked BEFORE invariants, because an invariant reading a mistyped field
         # is exactly the thing that used to explode.
         NUMERIC = { "Integer" => Integer, "Float" => Numeric }.freeze
@@ -489,12 +653,7 @@ module Hecks
             # cleanly (confirmed empirically), and is a legitimate,
             # meaningful float value (a signed zero), not a corruption
             # risk — only NaN and +/-Infinity are.
-            if given.is_a?(Float) && !given.finite?
-              raise TypeMismatch,
-                    RefusalWording.render("TypeMismatch", "non_finite_field",
-                                          type: value_object.hecks_name, field: attribute.name,
-                                          offered: Rendering.describe(given))
-            end
+            check_numeric_bounds(value_object.hecks_name, attribute.name, given)
           end
         end
 

data/lib/hecks/runtime/value.rb

@@ -108,7 +108,7 @@ module Hecks
       # forever, once per shape of "gone" any caller ever invents. The
       # caller filters and sorts the result; this only groups it.
       def self.latest_by(rows, key)
-        rows.each_with_object({}) { |row, latest| latest[row.public_send(key)] = row }.values
+        rows.to_h { |row| [row.public_send(key), row] }.values
       end
 
       def method_missing(name, *args)

data/lib/hecks/runtime.rb

@@ -34,6 +34,7 @@ require_relative "runtime/value"
 require_relative "runtime/identity"
 require_relative "runtime/instance"
 require_relative "runtime/registry"
+require_relative "runtime/outbox"
 require_relative "runtime/capability_graph"
 require_relative "runtime/errors"
 require_relative "runtime/refusal_wording"
@@ -54,6 +55,10 @@ require_relative "runtime/tenant_check"
 require_relative "runtime/loader"
 
 module Hecks
+  # See the file header above for what this module is and owns; nested
+  # here (rather than documented in place) only because the
+  # `require_relative` calls above must run before Ruby reopens the
+  # module they populate.
   module Runtime
     class << self
       # The registry declarations are currently landing in, or nil outside a
@@ -99,8 +104,8 @@ module Hecks
       # `RoleAssignment`'s own `scope`, not just its `role_name`. See
       # `Runtime::Caller::Current`'s own header for why this lives here
       # rather than as a command-level DSL construct.
-      def as_caller(role:, actor_id: nil, as_of: nil, scope: nil, &block)
-        Caller.as(role: role, actor_id: actor_id, as_of: as_of, scope: scope, &block)
+      def as_caller(role:, actor_id: nil, as_of: nil, scope: nil, &)
+        Caller.as(role: role, actor_id: actor_id, as_of: as_of, scope: scope, &)
       end
     end
   end

data/lib/hecks/storehouse.rb

@@ -592,14 +592,7 @@ module Hecks
       bluebook = bluebook_for(runtime)
       fqn      = aggregate ? "#{bluebook.name}::#{aggregate_ir!(bluebook, aggregate).hecks_name}" : nil
 
-      found = log_lines(bluebook.name).filter_map do |entry|
-        next unless entry[:tool] == "dispatch" && entry[:ok] && entry[:events]
-        next if fqn && !entry[:verb].to_s.start_with?("#{fqn}.")
-        next if id && entry[:id] != id
-
-        entry[:events].map { |event| event.merge(time: entry[:time], verb: entry[:verb], id: entry[:id]) }
-      end.flatten(1)
-
+      found = log_lines(bluebook.name).filter_map { |entry| entry_events(entry, fqn, id) }.flatten(1)
       found = found.last(limit.to_i) if limit
 
       ok(domain: bluebook.name, events: found)
@@ -607,6 +600,20 @@ module Hecks
       refused(e)
     end
 
+    # One log line's own contribution to `events`, above — nil unless it
+    # was a successful dispatch carrying events, matching `fqn` (when an
+    # aggregate narrowed the search) and `id` (when a record did). A
+    # self-contained per-entry check with nothing to share with its
+    # neighbors, extracted only to keep `events` itself to the query's
+    # own shape: build the filter, apply the limit, wrap the result.
+    def entry_events(entry, fqn, id)
+      return unless entry[:tool] == "dispatch" && entry[:ok] && entry[:events]
+      return if fqn && !entry[:verb].to_s.start_with?("#{fqn}.")
+      return if id && entry[:id] != id
+
+      entry[:events].map { |event| event.merge(time: entry[:time], verb: entry[:verb], id: entry[:id]) }
+    end
+
     # ── shared shape ────────────────────────────────────────────────────
 
     # `Runtime::WiringError` BELONGS HERE TOO, alongside the true domain

data/lib/hecks/version.rb

@@ -12,5 +12,5 @@ module Hecks
   # it there, or even in the consuming Gemfile, never closed the gap,
   # because gemspec evaluation happens before anything Bundler
   # resolves is actually loadable yet.
-  VERSION = "1.0.2"
+  VERSION = "1.1.0".freeze
 end

data/lib/hecks/vocabulary.rb

@@ -153,6 +153,7 @@ module Hecks
         {"refusal"=>"TypeMismatch", "site"=>"composite_identity", "template"=>"{type} is a composite identity — an identity must have exactly one field"}.freeze,
         {"refusal"=>"TypeMismatch", "site"=>"numeric_field", "template"=>"{type}.{field} expects {expected}, got {offered}"}.freeze,
         {"refusal"=>"TypeMismatch", "site"=>"non_finite_field", "template"=>"{type}.{field} must be a finite number, got {offered}"}.freeze,
+        {"refusal"=>"TypeMismatch", "site"=>"integer_range", "template"=>"{type}.{field} must fit in a 64-bit integer, got {offered}"}.freeze,
         {"refusal"=>"TypeMismatch", "site"=>"pattern_mismatch", "template"=>"{type}.{field} must match {pattern}, got {offered}"}.freeze,
         {"refusal"=>"TypeMismatch", "site"=>"arithmetic_amount", "template"=>"{op} of {target} needs an Integer, got {offered}"}.freeze,
         {"refusal"=>"TypeMismatch", "site"=>"arithmetic_current", "template"=>"{op} of {target} needs an Integer {target}, got {offered}"}.freeze,

data/lib/hecks.rb

@@ -34,12 +34,16 @@ require_relative "hecks/storehouse"
 require_relative "hecks/framework"
 require_relative "hecks/embryonaut_bluebook"
 
+# The root namespace and public facade of the whole DSL/runtime: `Hecks.boot`/
+# `.boot_files` assemble a running domain from `.bluebook`/`.hecksagon`/
+# `.world` files, and `.bluebook`/`.hecksagon`/`.port`/`.adapter`/`.world`/
+# `.data_translation` are the top-level declaration words every such file
+# opens with, each collecting its built construct into the currently booting
+# Registry (`#collect`, private below).
 module Hecks
   class LoadOutsideBoot < StandardError; end
 
   class << self
-    attr_reader :current_registry
-
     # The loading words below collect into the registry the RUNTIME is
     # holding open ; booting and that ambient state belong to the runtime
     # layer, so this module is their facade and Hecks::Runtime is where
@@ -73,7 +77,7 @@ module Hecks
       Runtime.boot_files(paths, shared: shared, install_facade: install_facade, environment: environment)
     end
 
-    def with_registry(registry, &block) = Runtime.with_registry(registry, &block)
+    def with_registry(registry, &) = Runtime.with_registry(registry, &)
 
     def current_registry = Runtime.current_registry
 
@@ -91,15 +95,15 @@ module Hecks
     #
     # `as_of` and `scope` are OPTIONAL too, same shape — see
     # `Runtime.as_caller`'s own header for what each does.
-    def as_caller(role:, actor_id: nil, as_of: nil, scope: nil, &block)
-      Runtime.as_caller(role: role, actor_id: actor_id, as_of: as_of, scope: scope, &block)
+    def as_caller(role:, actor_id: nil, as_of: nil, scope: nil, &)
+      Runtime.as_caller(role: role, actor_id: actor_id, as_of: as_of, scope: scope, &)
     end
 
-    def bluebook(name, version: nil, &block)
-      collect(:add_bluebook, Bluebook::DSL::BluebookBuilder.build(name, version: version, &block))
+    def bluebook(name, version: nil, &)
+      collect(:add_bluebook, Bluebook::DSL::BluebookBuilder.build(name, version: version, &))
     end
 
-    def hecksagon(name, &block) = collect(:add_hecksagon, Bluebook::DSL::HecksagonBuilder.build(name, &block))
+    def hecksagon(name, &) = collect(:add_hecksagon, Bluebook::DSL::HecksagonBuilder.build(name, &))
     # REPOINTED TO DomainPortBuilder — the migration DomainPort's own
     # class comment names as its goal, now landed for the top-level
     # `.port` file callers too (the aggregate-scoped `Thing.port(...)`,
@@ -120,12 +124,12 @@ module Hecks
     # (`BindingProxy#port`, `HecksagonBuilder#port_impl`) — only this,
     # the literal top-level `.port` file entry point, keeps the older,
     # looser rule (see `DomainPortBuilder#initialize`'s own comment).
-    def port(name, &block) = collect(:add_port, Bluebook::DSL::DomainPortBuilder.build(name, legacy_bare_port: true, &block))
-    def adapter(name, &block)   = collect(:add_adapter, Bluebook::DSL::AdapterBuilder.build(name, &block))
-    def world(name, &block)     = collect(:add_world, Bluebook::DSL::WorldBuilder.build(name, &block))
+    def port(name, &) = collect(:add_port, Bluebook::DSL::DomainPortBuilder.build(name, legacy_bare_port: true, &))
+    def adapter(name, &)   = collect(:add_adapter, Bluebook::DSL::AdapterBuilder.build(name, &))
+    def world(name, &)     = collect(:add_world, Bluebook::DSL::WorldBuilder.build(name, &))
 
-    def data_translation(name, from:, to:, &block)
-      collect(:add_translation, Bluebook::DSL::TranslationBuilder.build(name, from: from, to: to, &block))
+    def data_translation(name, from:, to:, &)
+      collect(:add_translation, Bluebook::DSL::TranslationBuilder.build(name, from: from, to: to, &))
     end
 
     private

data/lib/rubocop/cop/hecks/fallback_hash_lookup.rb

@@ -53,7 +53,7 @@ module RuboCop
               "silently discarded in favor of `%<receiver>s[%<rhs_key>s]` instead of being " \
               "returned. Use `%<receiver>s.key?(%<lhs_key>s) ? %<receiver>s[%<lhs_key>s] : " \
               "%<receiver>s[%<rhs_key>s]`, or a shared digger (see `key?` in " \
-              "`Hecks::QuerySpecification::FieldPath#read`), instead."
+              "`Hecks::QuerySpecification::FieldPath#read`), instead.".freeze
 
         # @!method bracket_lookup(node)
         def_node_matcher :bracket_lookup, "(send $_receiver :[] $_key)"

data/lib/rubocop/cop/hecks/sequential_hash_rename_in_loop.rb

@@ -60,7 +60,7 @@ module RuboCop
               "because the first rule's write clobbers the second rule's read target before it runs (the exact " \
               "bug fixed for Lineage#apply_renames). Snapshot every old key's value FIRST, delete all old keys, " \
               "then write all new keys, so the pass applies as one simultaneous permutation instead of a " \
-              "sequence of edits each stepping on the last."
+              "sequence of edits each stepping on the last.".freeze
 
         RESTRICT_ON_SEND = [:[]=].freeze
 

data/lib/rubocop/cop/hecks/thread_shared_ivar_mutation.rb

@@ -61,7 +61,7 @@ module RuboCop
               "other's view of it, the exact bug already fixed for `Dispatcher#reaction_depth` " \
               "(see dispatcher.rb's `#reenter`). Use `Thread.current[:...]` for per-thread " \
               "state, or a `Mutex`-guarded critical section (`Registry#saga_mutex`) if the " \
-              "state genuinely must be shared."
+              "state genuinely must be shared.".freeze
 
         THREAD_SHARED_CLASSES = ["Dispatcher", "Registry"].freeze
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - Chris Young
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-28 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prism
@@ -58,6 +58,8 @@ files:
 - lib/hecks/adapters/driven/lambda.adapter
 - lib/hecks/adapters/driven/lambda.rb
 - lib/hecks/adapters/driven/lambda/client.rb
+- lib/hecks/adapters/driven/local_storage.adapter
+- lib/hecks/adapters/driven/local_storage.rb
 - lib/hecks/adapters/driven/memory.adapter
 - lib/hecks/adapters/driven/memory.rb
 - lib/hecks/adapters/driven/mock_stripe_adapter.adapter
@@ -65,6 +67,7 @@ files:
 - lib/hecks/adapters/driven/postgres.adapter
 - lib/hecks/adapters/driven/postgres.rb
 - lib/hecks/adapters/driven/postgres/codec.rb
+- lib/hecks/adapters/driven/postgres/outbox.rb
 - lib/hecks/adapters/driven/postgres/schema_builder.rb
 - lib/hecks/adapters/driven/postgres_era.adapter
 - lib/hecks/adapters/driven/prism.adapter
@@ -115,9 +118,11 @@ files:
 - lib/hecks/bluebook/dsl.rb
 - lib/hecks/bluebook/dsl/adapter_builder.rb
 - lib/hecks/bluebook/dsl/aggregate_builder.rb
+- lib/hecks/bluebook/dsl/aggregate_builder/sealing.rb
 - lib/hecks/bluebook/dsl/attribute_collector.rb
 - lib/hecks/bluebook/dsl/binding_proxy.rb
 - lib/hecks/bluebook/dsl/bluebook_builder.rb
+- lib/hecks/bluebook/dsl/bluebook_builder/validation.rb
 - lib/hecks/bluebook/dsl/command_builder.rb
 - lib/hecks/bluebook/dsl/const_shim.rb
 - lib/hecks/bluebook/dsl/domain_port_builder.rb
@@ -141,6 +146,7 @@ files:
 - lib/hecks/bluebook/entity.rb
 - lib/hecks/bluebook/expression.rb
 - lib/hecks/bluebook/expression/ast_json.rb
+- lib/hecks/bluebook/expression/ast_reader.rb
 - lib/hecks/bluebook/expression/canonical_form.rb
 - lib/hecks/bluebook/expression/evaluator.rb
 - lib/hecks/bluebook/expression/projection.json
@@ -219,6 +225,11 @@ files:
 - lib/hecks/fuzzing/invalid_value_generator.rb
 - lib/hecks/fuzzing/isolated_boot.rb
 - lib/hecks/fuzzing/properties.rb
+- lib/hecks/fuzzing/properties/dispatch_and_mutations.rb
+- lib/hecks/fuzzing/properties/guards.rb
+- lib/hecks/fuzzing/properties/invariants_and_aggregation.rb
+- lib/hecks/fuzzing/properties/lifecycle_and_replay.rb
+- lib/hecks/fuzzing/properties/querying.rb
 - lib/hecks/fuzzing/replay.rb
 - lib/hecks/fuzzing/sequence_generator.rb
 - lib/hecks/fuzzing/sequence_generator/catalog.rb
@@ -394,6 +405,7 @@ files:
 - lib/hecks/runtime/instance.rb
 - lib/hecks/runtime/interpreting.rb
 - lib/hecks/runtime/loader.rb
+- lib/hecks/runtime/outbox.rb
 - lib/hecks/runtime/policy_interpreter.rb
 - lib/hecks/runtime/port_operation_interpreter.rb
 - lib/hecks/runtime/query_interpreter.rb