hecks 1.2.0 → 1.3.0

data/lib/hecks/query_specification/common/comparison.rb

@@ -165,7 +165,33 @@ module Hecks
           record = registry.repository(target_domain, target_ir).find(held)
           return true unless record
 
-          comparable(record.state[:state]) != state
+          # THE FIELD A STATE LIVES ON, READ FROM THE TARGET'S OWN
+          # DECLARATION — not assumed to be literally named `state`. Every
+          # `none_in_state` fixture this comparator originally shipped
+          # with (spec/query_none_in_state_*_spec.rb) happens to declare a
+          # plain `attribute :state, ...` rather than a real `lifecycle`,
+          # which is how the previous hardcoded `record.state[:state]`
+          # passed every one of them while being wrong for the shape this
+          # whole comparator exists to answer about: a real state MACHINE.
+          # `lifecycle :field, default: ... do ... end` stores its state
+          # under `field` (`Instance#assign_creation_attributes`'s own
+          # `state[aggregate.lifecycle.field.to_sym] = ...`), and this
+          # codebase's own convention overwhelmingly names that field
+          # `status`, not `state` (`QualityControl::Clearance`'s own
+          # `lifecycle :status` among many others) — so the hardcoded key
+          # silently read `nil` from every real lifecycle-backed target,
+          # comparable(nil) != state was true unconditionally, and
+          # `none_in_state` against ANY lifecycle aggregate answered
+          # "not excluded" for every row, always, no matter its actual
+          # state. Found chasing `QualityControl::Bug.AwaitingClearance`
+          # (qa/bluebook/quality_control.bluebook), which is exactly this
+          # shape: `Clearance:green`/`Clearance:red` against a `lifecycle
+          # :status` aggregate. Falls back to `:state` when the target
+          # declares no lifecycle at all, so every existing fixture (a
+          # plain attribute literally named `state`) keeps answering
+          # exactly as before.
+          field = target_ir.lifecycle&.field || :state
+          comparable(record.state[field]) != state
         end
 
         def find_aggregate_by_name(registry, name)

data/lib/hecks/runtime/command_interpreter/mutation_applier.rb

@@ -1,4 +1,5 @@
 require_relative "../value"
+require_relative "../entity_element"
 
 module Hecks
   module Runtime
@@ -174,17 +175,24 @@ module Hecks
         # Vendored addition, not (yet) upstream hecks (migration plan
         # task 4): the removal counterpart to #appended -- matches by
         # VALUE EQUALITY, element-wise, no read-modify-write (plan.
-        # bluebook's own words: "so a concurrent Add can never be lost").
-        # `mutation.source` is a single field reference (`:dependency`),
-        # unlike append's field-map -- resolved and Value-coerced the
-        # SAME way increment/decrement already coerce their own amount,
-        # so the comparison is against a like-shaped Value, not a raw
-        # scalar against a wrapped one.
+        # bluebook's own words: "so a concurrent Add can never be lost")
+        # -- UNLESS the target list is itself entity-typed (BUG#32,
+        # QualityControl ledger), in which case `EntityElement.
+        # list_element_match?` matches by the entity's own IDENTITY
+        # field instead -- see that method's own comment for the full
+        # "why identity, not whole-value equality" reasoning. `mutation.
+        # source` is a single field reference (`:dependency`), unlike
+        # append's field-map -- resolved and Value-coerced the SAME way
+        # increment/decrement already coerce their own amount, so the
+        # comparison is against a like-shaped Value, not a raw scalar
+        # against a wrapped one.
         def removed(instance, aggregate, mutation, args)
           value     = @rules.resolve_source(mutation.source, args)
           attribute = aggregate.attribute(mutation.target)
           value     = Value.for_attribute(aggregate, attribute, value) if attribute
-          Array(instance[mutation.target]).reject { |element| element == value }
+          Array(instance[mutation.target]).reject do |element|
+            EntityElement.list_element_match?(aggregate, attribute, element, value)
+          end
         end
 
         # Vendored fix, not (yet) upstream hecks (migration plan
@@ -246,7 +254,17 @@ module Hecks
             check_entity_collision(aggregate, entity, current, fields)
           end
           fields[entity.lifecycle.field] ||= entity.lifecycle.default if entity.lifecycle
-          fields
+          # BUG#12 — every one of THIS entity's own declared attributes
+          # the append mapping (and the identity/lifecycle filling just
+          # above) didn't already touch gets its own default, the same
+          # way a fresh aggregate's own attributes already do
+          # (`Instance.defaults`) — see `EntityElement#
+          # fill_declared_defaults`'s own comment for the full reasoning;
+          # shared rather than reimplemented so this aggregate-level
+          # entity creation and `EntityElement#appended_to_element`'s
+          # entity-nested-in-entity one can never drift on what "the
+          # default" means.
+          EntityElement.fill_declared_defaults(aggregate, entity, fields)
         end
 
         # THE MINTED IDENTITY IS ONE PAST THE HIGHEST HELD (C4.5) — not

data/lib/hecks/runtime/command_rules/references.rb

@@ -1,6 +1,8 @@
 require_relative "../errors"
 require_relative "../refusal_wording"
 require_relative "../value"
+require_relative "../../rendering"
+require_relative "../../ports/query/in_memory"
 
 module Hecks
   module Runtime
@@ -40,6 +42,8 @@ module Hecks
         # This is what makes a `has_many` declared on an aggregate honest even
         # when a command supplies its list through an ordinary typed argument.
         def resolve_state_references(domain, construct, state)
+          own_tenant_field = tenant_field_for(construct)
+
           construct.attributes.each do |attribute|
             next unless attribute.reference?
 
@@ -51,6 +55,7 @@ module Hecks
             next unless target
 
             validate_reference_values(domain, target, held, list: attribute.list?)
+            enforce_tenant_boundary(domain, construct, attribute, target, held, state, own_tenant_field)
           end
 
           Array(construct.entities).each do |entity|
@@ -102,6 +107,76 @@ module Hecks
           end
         end
 
+        # ANGLE-8's OWN WRITE-SIDE HALF of `TenantScope.apply` (runtime/
+        # tenant_scope.rb) — the QUERY-side mechanism this mirrors. That
+        # module turns a declared `authorize policy, tenant: :field` into a
+        # synthetic where-clause checked against the CALLER's own supplied
+        # tenant argument; there is no caller-identity/session system this
+        # runtime has to check a WRITE's caller against (TenantScope's own
+        # header names that as a separate, still-open gap), so this checks
+        # the one thing that IS available without one: whether the record
+        # being written and the record it references agree about which
+        # tenant they belong to. `lib/hecks/fuzzing/properties/guards.rb`'s
+        # `commands_respect_tenant_scope` states the identical claim,
+        # read off `history[:instances]` after the fact — this is what
+        # makes that claim hold BY CONSTRUCTION (a refused write is never
+        # stored) rather than merely checked for regression.
+        #
+        # Hooked into `resolve_state_references` rather than a new
+        # DISPATCH_ORDER step deliberately: that method already walks
+        # every `reference_to`-typed attribute against the SETTLED,
+        # post-mutation state (the same moment `commands_respect_tenant_
+        # scope` itself inspects), already resolves the referenced record
+        # through the repository right above, and already runs from BOTH
+        # `CommandInterpreter#step_save` and `EntityInterpreter#step_save`
+        # — one change, both interpreters covered, no new vocabulary step
+        # to keep in sync with `Vocabulary::AggregateDispatchOrder`/
+        # `EntityDispatchOrder`.
+        def enforce_tenant_boundary(domain, construct, attribute, target, held, state, own_tenant_field)
+          return unless own_tenant_field && state.key?(own_tenant_field)
+
+          target_tenant_field = tenant_field_for(target)
+          return unless target_tenant_field
+
+          own_tenant = Ports::Query::InMemory.comparable(state[own_tenant_field])
+
+          values = attribute.list? ? Array(held) : [held]
+          values.each do |value|
+            key = reference_key(value)
+            next if key.empty?
+
+            record = @registry.repository(domain, target).find(key)
+            next unless record&.state&.key?(target_tenant_field)
+
+            target_tenant = Ports::Query::InMemory.comparable(record.state[target_tenant_field])
+            next if target_tenant == own_tenant
+
+            raise Unauthorized,
+                  RefusalWording.render("Unauthorized", "cross_tenant_reference",
+                                        aggregate: construct.hecks_name, field: own_tenant_field,
+                                        tenant: Rendering.describe(state[own_tenant_field]),
+                                        attribute: attribute.name, target: target.name,
+                                        target_field: target_tenant_field,
+                                        other: Rendering.describe(record.state[target_tenant_field]))
+          end
+        end
+
+        # THE FIELD AN AGGREGATE'S OWN QUERY NAMES AS TENANT-SCOPING — the
+        # exact same lookup `Fuzzing::Properties::Guards#tenant_field_for`
+        # already established for the property that found this gap, reused
+        # here rather than reinvented: an aggregate's own declared tenant
+        # field is whichever field ONE OF ITS OWN queries names in
+        # `authorize policy, tenant: :field`. `nil` for a construct that
+        # declares no such query — not every aggregate is tenant-scoped,
+        # and an entity never declares a query of its own at all today
+        # (`Entity.queries` is always empty in the real corpus), so this
+        # answers `nil` for every entity without needing to special-case
+        # one.
+        def tenant_field_for(construct)
+          authorization = construct.queries.filter_map(&:authorization).find(&:tenant)
+          authorization&.tenant&.to_sym
+        end
+
         # `value` is the referenced record's own id, EXACTLY as `Identity.of`
         # would build it for that record — a bare scalar for a single-field
         # identity (the overwhelming common case; Banking's own plain

data/lib/hecks/runtime/entity_element.rb

@@ -4,6 +4,7 @@ require_relative "value"
 require_relative "refusal_wording"
 require_relative "errors"
 require_relative "identity"
+require_relative "instance"
 
 module Hecks
   module Runtime
@@ -24,6 +25,14 @@ module Hecks
     module EntityElement
       module_function
 
+      # BUG#3 — an addressing value that can never match a stored element,
+      # returned from `element_of`'s own `wants` coercion in place of a real
+      # `Value` (below). A unique object, never `nil`: a stored, OPTIONAL
+      # element field really can hold `nil`, and comparing THAT against a
+      # bare `nil` sentinel would accidentally "match" it.
+      UNMATCHABLE = Object.new.freeze
+      private_constant :UNMATCHABLE
+
       # ONE HOP PER CHAIN ENTRY. `container` starts as `instance` (the root
       # aggregate record) and becomes each just-located element in turn —
       # Dispatch's own element is found INSIDE the Handler element
@@ -71,6 +80,7 @@ module Hecks
       # rubocop:disable-next Metrics/AbcSize
       # rubocop:disable-next Metrics/CyclomaticComplexity
       # rubocop:disable-next Metrics/PerceivedComplexity
+      # rubocop:disable-next Metrics/MethodLength
       def element_of(root_aggregate, owner, entity, command_name, container, args, routed_identity = nil)
         entity_name = entity.hecks_name
         list_attr = owner.attributes.find { |a| a.list? && a.type.to_s == entity_name } ||
@@ -85,7 +95,35 @@ module Hecks
                                                                  command: command_name, entity: entity_name,
                                                                  identity: Identity.reading(entity)))
 
-                    [head, path, Value.for_attribute(root_aggregate, entity.attribute(head), raw)]
+                    # AN IDENTITY OFFERED FOR ADDRESSING, NOT FOR STORAGE
+                    # (BUG#3, found live by `bin/qa_sweep` — banking fuzz seed
+                    # 23, `LedgerEntry.Amend sequence: { value: 0 }` against an
+                    # entry-less ledger). Coercing it all the way to a typed
+                    # `Value` here ran that type's own invariant BEFORE this
+                    # method ever checks whether any element matches — a
+                    # `sequence: 0` against `LedgerSequence`'s own "a ledger
+                    # sequence is positive" invariant raised InvariantViolation,
+                    # not NotFound, even when (as here) nothing was ever posted
+                    # at all. Every element actually IN the list already
+                    # satisfied its own type's invariant the moment it was
+                    # created, so a value that fails it can never equal one —
+                    # degrading to `UNMATCHABLE` here, instead of propagating,
+                    # is exactly as safe as the ordinary "no match found" case
+                    # below, and lines this addressing path up with the two
+                    # conventions it already disagreed with: Rust's own
+                    # `extract_id`/`extract_wants` (a raw scalar read, never a
+                    # typed rebuild — rust/src/generated/*/*.rs) and
+                    # `Identity.from`'s own raw-comparison convention for a
+                    # ROOT aggregate's identity (this file's sibling,
+                    # `identity.rb`). `raw` rides alongside `want` so the
+                    # eventual NotFound below can still quote what was offered.
+                    want = begin
+                      Value.for_attribute(root_aggregate, entity.attribute(head), raw)
+                    rescue InvariantViolation
+                      UNMATCHABLE
+                    end
+
+                    [head, path, want, raw]
                   end
                 end
 
@@ -93,13 +131,15 @@ module Hecks
         position = if routed_identity
                      original.find_index { |element| element_identity(entity, element).to_s == routed_identity.to_s }
                    else
-                     original.find_index { |el| wants.all? { |head, _path, want| el[head] == want } }
+                     original.find_index do |el|
+                       wants.all? { |head, _path, want, _raw| want != UNMATCHABLE && el[head] == want }
+                     end
                    end
         unless position
           raise NotFound, RefusalWording.render(
             "NotFound", "entity_element_missing",
             entity: entity_name, identity: Identity.reading(entity),
-            wants: wants&.map { |_h, path, want| Identity.scalar(path, want) }&.join(", "),
+            wants: wants&.map { |_h, path, _want, raw| Identity.scalar(path, raw) }&.join(", "),
             aggregate: owner.hecks_name,
             parent_id: container.respond_to?(:id) ? container.id.inspect : Rendering.describe(container)
           )
@@ -174,7 +214,7 @@ module Hecks
       # shape here without doing the same there would break that
       # intentional mirroring, which is what lets the two be diffed
       # against each other when one gets a fix the other needs too.
-      # rubocop:disable-next Metrics/AbcSize
+      # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity
       # `pre` — the element as it was before this command (C4.2): every
       # read below goes through it, every write lands on `element`.
       def apply_to_element(rules, aggregate, entity, element, mutation, args, pre = element)
@@ -203,6 +243,22 @@ module Hecks
           element[mutation.target] = rewrap_arithmetic_result(aggregate, attribute, current, result)
         when :clamp
           element[mutation.target] = rules.clamp(pre[mutation.target], mutation.source, mutation.target)
+        # `corrects` — BUG#30. `MutationApplier#apply`'s own aggregate-
+        # level `:corrects` branch's own comment gives the full reasoning;
+        # the same one applies here unchanged: this mutation targets no
+        # field on THIS element at all — its own event name, and whether
+        # the OWNING record has actually emitted it, was already checked
+        # once, up front, by `EntityInterpreter#step_enforce_givens`
+        # (`CommandRules::Admissibility#enforce_correction_target`, called
+        # there against the PARENT record/ROOT aggregate — see that
+        # step's own comment for exactly why). Whatever field a correction
+        # actually changes is an ORDINARY declared `sets`/`increment`/etc.
+        # mutation of its own, applied by one of the branches above like
+        # any other — `qa/stress_domains/corrections`' own `Entry.Amend`
+        # pairs `corrects "EntryRecorded", ...` with a separate `sets
+        # :amount`, exactly this shape.
+        when :corrects
+          nil
         else
           # The aggregate-level twin's own backstop
           # (MutationApplier#apply), for the same reason: applying
@@ -236,17 +292,26 @@ module Hecks
         element[source]
       end
 
-      # `MutationApplier#appended`'s own entity-scoped twin. VALUE-
-      # OBJECT elements only — an entity's own list, appended to by an
+      # `MutationApplier#appended`'s own entity-scoped twin. Usually a
+      # VALUE OBJECT element — an entity's own list, appended to by an
       # entity-owned command, holds a value object (`Member.pairs`'
       # own `Pair`, `Dispatch.with_spec`'s own `Binding`) the same way
-      # every real corpus append does; entity-in-entity nesting (a
-      # list of ANOTHER entity, owned by this one) is out of scope —
-      # `MutationApplier#entity_element`'s own fallback is deliberately
-      # not mirrored here, since nothing in this language's own
-      # `EntityBuilder` can declare a nested entity to need it (see
-      # S17's own scoping note on why Dispatch flattens under
-      # ProcessManager instead of nesting under Handler).
+      # most real corpus appends do — but entity-in-entity nesting (a
+      # list of ANOTHER entity, owned by this one) is real now too:
+      # `qa/stress_domains/nested_pieces` (`Board.AddCard`, appending a
+      # `Card` onto `Board`'s own `cards`) is the first corpus member to
+      # do it, the comment this replaces having been written before that
+      # domain existed. `element_type` naming an entity rather than a
+      # value object falls through to `fields` unchanged, same as
+      # before — `MutationApplier#entity_element`'s own identity-minting/
+      # collision-checking fallback still isn't mirrored here (nothing
+      # in this corpus needs auto-minting at THIS depth — Card supplies
+      # its own identity in the append mapping — and collision-checking
+      # a nested entity is its own separate, unfixed question) — but
+      # BUG#12's fix (below) is: every declared attribute the append
+      # mapping doesn't name gets its own default the same way a fresh
+      # aggregate's own attributes already do (`Instance.defaults`),
+      # whichever branch built `fields`.
       def appended_to_element(aggregate, entity, element, mutation, args)
         fields       = mutation.source.transform_values { |source| resolve_element_append_source(source, element, args) }
         element_type = entity.attribute(mutation.target)&.type
@@ -254,18 +319,105 @@ module Hecks
         value_object&.attributes&.each do |attribute|
           fields[attribute.name] = Value.scalar(fields[attribute.name]) if fields[attribute.name].is_a?(Value)
         end
-        appended = value_object ? Value.build(value_object, fields, aggregate) : fields
+        appended =
+          if value_object
+            Value.build(value_object, fields, aggregate)
+          else
+            # `entity.entities`, NOT `aggregate.entities` — a piece
+            # nested inside a piece is a child of the OWNING entity
+            # (`Card` is `Board.entities`, never `Workspace.entities`;
+            # `Behaviour::Entity#entities` answers direct children only,
+            # by design — see its own comment), the same lexical-nesting
+            # rule `EntityBuilder#entity_impl` builds the tree with in
+            # the first place.
+            nested_entity = entity.entities.find { |piece| piece.hecks_name == element_type.to_s }
+            nested_entity ? fill_declared_defaults(aggregate, nested_entity, fields) : fields
+          end
         Freezer.deep(Array(element[mutation.target]) + [appended])
       end
 
+      # BUG#12 — an entity created via `sets :list, append: {...}` used
+      # to leave any of its OWN declared attributes the append mapping
+      # simply didn't name (an optional field a LATER, separate command
+      # sets — `Board.label`, `Card.note`) absent from the stored hash
+      # entirely, not even a `nil` placeholder, until that later command
+      # actually ran. `rust/project/json_codec.rb#emit_to_json_flat`'s
+      # own header comment documents the opposite as the intended
+      # contract for a persisted record: every declared field present,
+      # `null` when unset, "because Ruby's own `JSON.generate(state)`
+      # round-trip this mirrors does the same" — true for a freshly
+      # created AGGREGATE (`Instance.defaults` already fills one key per
+      # declared attribute, `default_for` per attribute), never true for
+      # an entity minted by an append. This closes that gap the same
+      # way: `Instance.default_for` is the SAME per-attribute default
+      # rule (nil with no declared `default:`, a fully-defaulted value
+      # object when every one of ITS OWN fields has one), reused rather
+      # than reimplemented so the two creation paths can never drift on
+      # what "the default" means. Additive only — a key `fields` already
+      # holds (the append mapping, an auto-minted identity, a lifecycle
+      # default) is never overwritten.
+      def fill_declared_defaults(aggregate, entity, fields)
+        entity.attributes.each do |attribute|
+          next if fields.key?(attribute.name)
+
+          fields[attribute.name] = attribute.list? ? Freezer.deep([]) : Instance.default_for(aggregate, attribute)
+        end
+        fields
+      end
+
       # `MutationApplier#removed`'s own entity-scoped twin — matches by
       # VALUE EQUALITY, element-wise, the same "so a concurrent Add can
-      # never be lost" reasoning that method's own comment gives.
+      # never be lost" reasoning that method's own comment gives, UNLESS
+      # the list this targets is itself entity-typed — see
+      # `list_element_match?`, below, which both this and
+      # `MutationApplier#removed` now share.
       def removed_from_element(rules, aggregate, entity, element, mutation, args)
         value     = rules.resolve_source(mutation.source, args)
         attribute = entity.attribute(mutation.target)
         value     = Value.for_attribute(aggregate, attribute, value) if attribute
-        Array(element[mutation.target]).reject { |candidate| candidate == value }
+        Array(element[mutation.target]).reject { |candidate| list_element_match?(aggregate, attribute, candidate, value) }
+      end
+
+      # BUG#32 (QualityControl ledger) — THE MATCH RULE `remove:` USES
+      # AGAINST ONE STORED LIST ELEMENT. VALUE EQUALITY for a
+      # VALUE-OBJECT-typed list stays exactly what it always was — an
+      # element and `value` are both real `Value`s there, so `==` already
+      # compares every field, the "concurrent Add can never be lost"
+      # shape `removed`/`removed_from_element`'s own headers describe.
+      # An ENTITY-typed list is different in kind, not just in type: a
+      # stored element is a plain Hash, never a `Value` (`Entity`'s own
+      # header — "an entity must never answer .value_object"), so there
+      # is no whole-value shape to compare against at all — only the
+      # entity's own IDENTITY field, the same field a caller already has
+      # to name to address that element any other way
+      # (`element_of`'s own `wants`, above). `value` arrives here already
+      # coerced against that identity field's declared type
+      # (`Coercion#hydrate_entity_identity`, run underneath
+      # `Value.for_attribute` before either caller above ever sees it),
+      # so this only has to know WHICH field to read off the stored
+      # element — `entity.identity_heads`'s own single head, when there
+      # is exactly one. A composite identity (more than one head, or
+      # none) has no single field a bare `remove:` target could mean —
+      # this returns `false` (never a match, the same documented no-op
+      # `hydrate_entity_identity`'s own header already commits to) rather
+      # than guessing which head, matching the narrow, honest boundary
+      # `MutationApplier#check_entity_collision`'s own header draws for
+      # entity identity elsewhere in this runtime.
+      #
+      # Shared by `MutationApplier#removed` (an aggregate's own list) and
+      # `#removed_from_element` (a list an ENTITY owns), so the two
+      # `remove:` call sites can never quietly disagree on what
+      # "matches" means — the same reasoning this file's own header
+      # gives for centralizing `locate_chain`/`element_of` once rather
+      # than twice.
+      def list_element_match?(aggregate, attribute, element, value)
+        entity = attribute&.list? ? Value.find_entity(aggregate, attribute.type.to_s) : nil
+        return element == value unless entity
+
+        head = entity.identity_heads.one? ? entity.identity_heads.first : nil
+        return false unless head
+
+        element.is_a?(Hash) && element[head] == value
       end
     end
   end

data/lib/hecks/runtime/entity_interpreter.rb

@@ -75,7 +75,8 @@ module Hecks
       # rubocop:disable-next Lint/StructNewOverride
       Context = Struct.new(:domain, :aggregate, :entity, :entity_name, :command, :command_name,
                            :args, :repository, :instance, :chain, :element, :view, :transition,
-                           :old_element, :result, :route, :plan, :persistence_outcome, :dry_run, :outbox_rows)
+                           :old_element, :result, :route, :plan, :persistence_outcome, :dry_run, :outbox_rows,
+                           :correction_bindings)
 
       def initialize(registry, rules:)
         @registry = registry
@@ -208,9 +209,66 @@ module Hecks
                                 state: ctx.element)
       end
 
+      # BUG#30 — THE ENTITY-LEVEL HALF OF `CommandInterpreter#step_enforce_
+      # givens`'s own structural-before-declared ordering (see that
+      # method's comment for the shared reasoning): "does the fact this
+      # command's `corrects` names even exist" is checked here too, once,
+      # before the entity's own `given`s.
+      #
+      # ADMISSIBILITY IS CHECKED AGAINST THE PARENT/ROOT, NOT THE ENTITY —
+      # deliberately `ctx.instance`/`ctx.aggregate` (the PARENT aggregate
+      # record and the ROOT aggregate construct), never `ctx.view`/
+      # `ctx.entity` (the entity's own pre-mutation view/construct). This
+      # is not a simplification; it is the ONLY choice that lines up with
+      # how the event being corrected was actually recorded: an entity has
+      # no event stream of its own — `CommandRules::Emission#emit` (called
+      # from THIS class's own `step_emit`, and from `CommandInterpreter`'s
+      # `step_emit` for an aggregate-level command alike) always stamps an
+      # emitted event with the ROOT aggregate's own qualified name
+      # (`"#{domain}::#{aggregate.hecks_name}"`) and the PARENT record's
+      # own id (`ctx.instance.id`), regardless of which level dispatched
+      # it. `enforce_correction_target` (CommandRules::Admissibility)
+      # looks a correction target up by exactly those two fields plus the
+      # event name — asking it in terms of the entity instead would search
+      # for an event key/id that no emitted event could ever actually
+      # carry, and every entity-level correction would refuse
+      # (NothingToCorrect) even against a real, already-emitted event.
+      # `qa/stress_domains/corrections`' own `Entry.Amend` (corrects
+      # "EntryRecorded", which `Ledger.Record` — an AGGREGATE-level
+      # command — actually emits) is exactly this shape: the corrected
+      # event's `aggregate`/`id` are the LEDGER's, never the Entry's own
+      # (an Entry has no id an event could be filed under in the first
+      # place). `Fuzzing::Properties::Corrections#corrections_reference_
+      # an_emitted_event` independently encodes the identical rule
+      # (`aggregate_key` built off the OUTER aggregate for both the
+      # `corrects` target and the `emits` produced event, regardless of
+      # entity nesting depth) — this is that property's dispatch-time
+      # enforcement counterpart, not a new invention.
+      #
+      # One structural consequence, worth being explicit about for a
+      # Rust port: because the lookup is scoped to the PARENT record
+      # (not to any one entity element within it), an entity-level
+      # `corrects` only proves "this parent record has emitted the named
+      # event at some point" — it does NOT, and cannot, further narrow
+      # to "...specifically for THIS entity element" (a Ledger with three
+      # Entries all satisfy the same `EntryRecorded`-was-emitted check).
+      # That is not a gap this fix introduces: it is the SAME granularity
+      # the aggregate-level check already has (one record, one event
+      # history), just observed from one level down. A command wanting a
+      # tighter, element-specific correlation has to encode it itself, in
+      # its own `given`s, off `correction`-bound payload fields.
+      #
+      # `correction:` bindings computed here are threaded through to BOTH
+      # halves of the same command's admissibility, same as the
+      # aggregate-level path: `ctx.correction_bindings` is read again by
+      # `step_enforce_ensures`, below, so an `as:`-named binding is
+      # visible to a settled-record `ensures` exactly as freely as it is
+      # here, pre-mutation.
       def step_enforce_givens(ctx)
         step(:enforce_givens) do
-          @rules.enforce_givens(ctx.view, ctx.command, ctx.args, domain: ctx.domain, declaring: ctx.entity, parent: ctx.instance)
+          ctx.correction_bindings = @rules.enforce_correction_target(ctx.instance, ctx.aggregate, ctx.command, domain: ctx.domain)
+          @rules.enforce_givens(ctx.view, ctx.command, ctx.args, domain: ctx.domain, declaring: ctx.entity, parent: ctx.instance,
+                                correction: ctx.correction_bindings)
         end
       end
 
@@ -240,7 +298,14 @@ module Hecks
       def step_enforce_ensures(ctx)
         step(:enforce_ensures) do
           settled = Instance.new(aggregate: ctx.entity, id: ctx.view.id, state: ctx.element)
-          @rules.enforce_ensures(settled, ctx.command, ctx.args, old: ctx.old_element, domain: ctx.domain, parent: ctx.instance)
+          # `correction:` — same `as:`-bound corrected-event payload
+          # `step_enforce_givens` already located, above; `|| {}` covers
+          # a command with no `corrects` mutation at all, where
+          # `ctx.correction_bindings` is `{}` from that call already, or
+          # (belt-and-braces, matching `CommandInterpreter#step_enforce_
+          # ensures`'s own identical `|| {}`) never set.
+          @rules.enforce_ensures(settled, ctx.command, ctx.args, old: ctx.old_element, domain: ctx.domain, parent: ctx.instance,
+                                 correction: ctx.correction_bindings || {})
         end
       end
 

data/lib/hecks/runtime/query_interpreter.rb

@@ -274,15 +274,79 @@ module Hecks
         value.is_a?(Symbol) ? args[value] : value
       end
 
+      # `boundary: false` always (C3.8 — a query's declared argument types
+      # name the argument for callers and generators, never a runtime
+      # shape checked here). A null required VALUE-OBJECT-typed query
+      # argument, though, is NOT a runtime-shape question at all: C3.7
+      # says a named query's declared value-object arguments are checked
+      # the same way a command argument's own is, so a `nil` offered for
+      # a non-optional value-object-typed query attribute
+      # (Governance::RoleAssignment.AssignmentsForActor's `actor_id`, say)
+      # has to refuse — passing it through unchecked (as this used to)
+      # let it through as a silent, unfiltered query instead, a real
+      # Ruby/Rust divergence the fuzzer caught (QualityControl BUG#2).
+      #
+      # `checked_vo?` true is handled by `null_vo_argument!` DIRECTLY,
+      # never by routing through `Value.for_attribute(argument: true)`
+      # into the shared `Value::Coercion#nil_argument` the COMMAND door
+      # (`Interpreting#coerce_declared_arguments`) still uses — that
+      # method builds a null value object from ZERO fields, which
+      # SUCCEEDS (silently absorbing the null via the type's own field
+      # defaults) whenever every field happens to have one
+      # (`Lease.Expired`'s `now`, a `LeaseInstant` with a `default: 0`
+      # field; `Account.Overdrawn`/`HighBalance`/`StrictlyAbove`/
+      # `AtMost`'s `floor`/`cap`, a two-defaulted-field `Money`) and only
+      # refuses when a field has none (`Order.CostingLessThan`'s
+      # `ceiling`, a defaultless `Price`) — a real QUERY-side divergence
+      # from Rust, which always refuses `TypeMismatch` on an explicit
+      # null argument regardless of any default (QualityControl BUG#36).
+      # `null_vo_argument!` instead treats an explicit null exactly the
+      # way `Value.fields_for` already treats any other WRONG-SHAPED
+      # (non-Hash, non-Value) value offered for that same attribute — a
+      # single-field value object auto-wraps into `{field: nil}` (whose
+      # OWN `nil` is a PRESENT key, so `Value.build`'s `apply_defaults`
+      # never fills it, and `check_required_fields` refuses it exactly
+      # as any other missing required field would); a multi-field value
+      # object refuses immediately with the same `value_object_shape`
+      # wording an ordinary wrong-shaped scalar already gets. Command
+      # arguments are deliberately UNTOUCHED — this is a query-only
+      # door; `nil_argument`'s own default-absorbing fallback still
+      # governs a null command argument exactly as it always has.
+      #
+      # C3.8's own bare-scalar carve-out stays intact: `checked_vo?` is
+      # only true for a value-object-typed attribute, so a bare
+      # `String`/`Integer` query argument offered nil still passes
+      # through exactly as it always did.
       def normalize_args(aggregate, declared, args)
         declared.attributes.each_with_object(args.dup) do |attribute, normalized|
           next unless normalized.key?(attribute.name)
 
-          normalized[attribute.name] = Value.for_attribute(aggregate, attribute, normalized[attribute.name],
-                                                           boundary: false)
+          value = normalized[attribute.name]
+          normalized[attribute.name] = if checked_vo?(aggregate, attribute, value)
+                                         null_vo_argument!(aggregate, attribute)
+                                       else
+                                         Value.for_attribute(aggregate, attribute, value, boundary: false)
+                                       end
         end
       end
 
+      def checked_vo?(aggregate, attribute, value)
+        return false unless value.nil?
+        return false if attribute.optional? || attribute.list? || attribute.reference?
+        return false unless aggregate.respond_to?(:value_object)
+
+        !Value.value_object_for(aggregate, attribute.type).nil?
+      end
+
+      # Only ever reached when `checked_vo?` has already confirmed the
+      # attribute's type resolves to a real value object — see its own
+      # comment above for why this refuses unconditionally, never
+      # absorbing the null via the type's own field defaults.
+      def null_vo_argument!(aggregate, attribute)
+        value_object = Value.value_object_for(aggregate, attribute.type)
+        Value.build(value_object, Value.fields_for(value_object, attribute.name, nil), aggregate)
+      end
+
       def comparable(value) = QuerySpecification::Common::Comparison.comparable(value)
 
       # FieldPath.dig, not a raw `record[field]` — `record` is an Instance