hecks 1.2.0 → 1.3.0

data/lib/hecks/fuzzing/properties/dispatch_and_mutations.rb

@@ -1,6 +1,39 @@
 module Hecks
   module Fuzzing
     module Properties
+      # A DRY RUN LEAVES NO TRACE — `Dispatcher#dry_run?`'s whole contract
+      # ("the command evaluated hypothetically, nothing saved or emitted,
+      # no reaction"), held to the store rather than trusted: `Replay`
+      # snapshots every instance and the event count on either side of
+      # each `{"dry_run": …}` step, in a SEPARATE `dry_run_traces` array
+      # (same order as `history[:dry_runs]`, never merged into it — that
+      # array stays the exact `{verb:, ok:, error?:}` shape the compiled
+      # Rust binary's own `dry_run` answers, so `spec/rust_conformance_
+      # spec.rb`'s direct comparison against it never sees a key Rust
+      # doesn't have), and this is the comparison. Refused or accepted
+      # makes no difference — a hypothetical that was refused had even
+      # less business writing anything. Entries without the snapshots (a
+      # hand-built history, an older corpus) are skipped, not failed: no
+      # claim, no finding.
+      module DryRuns
+        def dry_runs_leave_no_trace(history)
+          offenders = Array(history[:dry_run_traces]).filter_map do |entry|
+            before = entry[:before]
+            after  = entry[:after]
+            next unless before && after
+
+            traces = []
+            traces << "events #{before[:events]} -> #{after[:events]}" unless before[:events] == after[:events]
+            traces << "instances changed" unless before[:instances] == after[:instances]
+            next if traces.empty?
+
+            "dry run of #{entry[:verb]} (ok: #{entry[:ok]}) left a trace: #{traces.join(', ')}"
+          end
+
+          offenders.empty? || offenders.join("; ")
+        end
+      end
+
       # Dispatch-binding and mutation-recomputation properties: a saga/
       # policy dispatch is bound to the value its own with_spec names, and a
       # command's append/remove/multiply/clamp mutations land on the same
@@ -140,8 +173,14 @@ module Hecks
             command = command_for_verb(bluebooks, entry[:verb])
             next [] unless command
 
+            aggregate = aggregate_for_verb(bluebooks, entry[:verb])
+            next [] unless aggregate
+
+            owner = owner_for_verb(bluebooks, entry[:verb]) || aggregate
+
             command.mutations.select { |m| RECOMPUTABLE_MUTATION_OPS.include?(m.op) }.filter_map do |mutation|
-              expected = recompute_mutation(mutation, entry[:before][mutation.target], entry[:args], entry[:before])
+              expected = recompute_mutation(mutation, entry[:before][mutation.target], entry[:args], entry[:before],
+                                            aggregate, command, owner)
               next if expected == :unrecomputable
 
               actual = entry[:after][mutation.target]
@@ -155,31 +194,167 @@ module Hecks
           offenders.empty? || offenders.join("; ")
         end
 
-        def recompute_mutation(mutation, current, args, before_scope)
+        # `command_for_verb`'s own root-aggregate half (Guards) —
+        # re-derived independently rather than read off `entry[:domain]`/
+        # `entry[:aggregate]` (present on a REAL `build_mutation_trace`
+        # entry, but not on every hand-built fixture this property is
+        # tested against) so this works from `entry[:verb]` alone, the
+        # one field every entry always carries. BUG#5's fix needs the
+        # ROOT aggregate specifically — `Value.for_attribute` resolves a
+        # value-object TYPE against the root's own namespace only, the
+        # same reason `EntityElement#locate_chain` threads `root_aggregate`
+        # through every hop separately from each hop's own `owner`.
+        def aggregate_for_verb(bluebooks, verb)
+          domain_name, aggregate_name, = Naming.split_verb(verb)
+          return nil unless domain_name
+
+          bluebooks[domain_name]&.aggregate(aggregate_name)
+        end
+
+        # `mutation.target`'s own DECLARING construct — the root
+        # aggregate for an aggregate-owned command (`AddSlot`'s own
+        # `:slots`), or the entity a dot-shaped command belongs to
+        # (`Board.AddCard`'s own `:cards`, declared on `Board`, not on
+        # `Workspace`) — needed only by BUG#12's own recompute-side fix
+        # (`recompute_append`, below): `entity.attribute(mutation.target)`
+        # has to be asked of whichever construct actually declares it,
+        # never the root aggregate unconditionally, the same distinction
+        # `EntityElement#locate_chain` draws between `root_aggregate` and
+        # each hop's own `owner`. Re-derived independently from
+        # `entry[:verb]` alone, the same reasoning `aggregate_for_verb`'s
+        # own comment gives.
+        def owner_for_verb(bluebooks, verb)
+          domain_name, aggregate_name, command_path = Naming.split_verb(verb)
+          return nil unless command_path
+
+          aggregate = bluebooks[domain_name]&.aggregate(aggregate_name)
+          return nil unless aggregate
+          return aggregate unless command_path.include?(".")
+
+          entity_name, = command_path.split(".", 2)
+          aggregate.entities.find { |candidate| candidate.hecks_name == entity_name }
+        end
+
+        def recompute_mutation(mutation, current, args, before_scope, aggregate, command, owner = aggregate)
           case mutation.op
-          when :append   then recompute_append(current, mutation.source, before_scope, args)
+          when :append
+            recompute_append(current, mutation.source, before_scope, args, aggregate, command, owner, mutation.target)
           when :remove   then recompute_remove(current, mutation.source, args)
           when :multiply then recompute_multiply(current, resolve_mutation_source(mutation.source, args))
           when :clamp    then recompute_clamp(current, mutation.source)
           end
         end
 
-        # `MutationApplier#appended`'s own value-object branch (never the
-        # entity_element branch — see #build_mutation_trace's own comment
-        # on why an entity-dispatched command's own mutations never reach
-        # it), reproduced: the field map resolved the SAME two-tier way
+        # `EntityElement#appended_to_element`'s own field-mapping half,
+        # reproduced: the field map resolved the SAME two-tier way
         # (`MutationApplier#resolve_append_source` — a caller-supplied
-        # arg, or the entity's own current field), then appended.
-        def recompute_append(current, source_map, before_scope, args)
-          fields = source_map.transform_values { |source| resolve_mutation_append_field(source, before_scope, args) }
+        # arg, or the entity's own current field), then appended. (An
+        # entity-dispatched command's own mutations DO reach here —
+        # `#build_mutation_trace`'s own comment describing them as never
+        # reaching "the entity_element branch" means `MutationApplier#
+        # appended`'s own AGGREGATE-level entity_element fallback
+        # specifically, which really is unreached from here; entity-owned
+        # append dispatches go through `EntityElement#appended_to_element`
+        # instead, and DO reach this method.)
+        #
+        # BUG#5 — an entity-owned `:append` whose target field is itself
+        # value-object-typed (`Board.AddCard`'s own `sets :cards, append:
+        # { sequence: :sequence }`, `CardSequence`-typed). A caller-
+        # supplied arg reaches the REAL applier (`EntityElement#
+        # appended_to_element`) already coerced: `Interpreting#
+        # coerce_declared_arguments` runs `Value.for_attribute` over
+        # EVERY arg the acting command itself declares, BEFORE dispatch
+        # ever reaches a mutation applier at all — independent of, and
+        # earlier than, anything `appended_to_element`'s own value_object
+        # check does. `before_scope[source]` (the entity's OWN current
+        # field) needs no such re-coercion here: it's already the
+        # MATERIALIZED shape `build_mutation_trace` snapshotted it in
+        # (`Value.materialize`, same as `entry[:after]`), not a raw value
+        # sitting behind a live `Value`.
+        #
+        # BUG#12 — `owner`/`target` (new here) let this ALSO reproduce
+        # `EntityElement#fill_declared_defaults`'s own entity-nested-in-
+        # entity fallback (`appended_to_element`'s `else` branch, when
+        # the appended element is itself an entity — `Card`, nested
+        # inside `Board` — not a value object): `owner.attribute(target)
+        # &.type` names the appended element's own type; when that names
+        # an entity of `aggregate` rather than a value object, every one
+        # of ITS OWN declared attributes `fields` doesn't already hold
+        # gets `Instance.default_for`'s own default — reused, not
+        # reimplemented, for the identical "never agree with itself"
+        # reason BUG#5's own coercion re-derivation above already gives:
+        # `Instance.default_for` is pre-existing, independently-tested
+        # machinery (an ordinary aggregate's own creation already runs
+        # through it via `Instance.defaults`), not the NEW glue
+        # (`fill_declared_defaults` itself) this property exists to
+        # catch a drift in.
+        def recompute_append(current, source_map, before_scope, args, aggregate, command, owner = aggregate, target = nil)
+          fields = source_map.transform_values do |source|
+            resolve_mutation_append_field(source, before_scope, args, aggregate, command)
+          end
+          fill_recompute_declared_defaults(aggregate, owner, target, fields)
           Array(current) + [symbolize_deep(fields)]
         end
 
-        def resolve_mutation_append_field(source, before_scope, args)
+        # BUG#12's own recompute-side half — see `#recompute_append`'s
+        # own comment above for why this exists and why it reuses
+        # `Instance.default_for` rather than calling `EntityElement#
+        # fill_declared_defaults` again. A no-op whenever `target` names
+        # no attribute at all (every RECOMPUTABLE_MUTATION_OPS caller but
+        # `:append` passes no `target`) or `target`'s own declared type
+        # isn't an entity nested directly under `owner` (a value object,
+        # or nothing declared at all — `owner.attribute` answering `nil`
+        # for a target the DSL itself would already have refused at
+        # build time). `owner.entities`, NOT `aggregate.entities` — a
+        # piece nested inside a piece is a child of the OWNING entity
+        # (`Card` is `Board.entities`, never `Workspace.entities`), the
+        # same distinction `EntityElement#appended_to_element`'s own fix
+        # draws.
+        def fill_recompute_declared_defaults(aggregate, owner, target, fields)
+          return fields unless target
+
+          element_type = owner&.attribute(target)&.type
+          entity = element_type && owner.entities.find { |piece| piece.hecks_name == element_type.to_s }
+          return fields unless entity
+
+          entity.attributes.each do |attribute|
+            next if fields.key?(attribute.name)
+
+            fields[attribute.name] = attribute.list? ? [] : Runtime::Instance.default_for(aggregate, attribute)
+          end
+          fields
+        end
+
+        def resolve_mutation_append_field(source, before_scope, args, aggregate, command)
           return source unless source.is_a?(Symbol)
-          return args[source] if args.key?(source)
+          return before_scope[source] unless args.key?(source)
+
+          coerce_recompute_append_arg(aggregate, command, source, args[source])
+        end
+
+        # `Interpreting#coerce_declared_arguments`'s own coercion,
+        # reproduced independently (never calling it again, the same
+        # "never agree with itself" rule this whole module's header
+        # comment gives) — a raw arg is coerced ONLY when its own name
+        # (`source`) is one of the ACTING COMMAND's own declared
+        # attributes, exactly the condition that method checks before a
+        # real dispatch ever coerces it either. `command.attribute(source)`
+        # answering `nil` (a source that names no declared attribute —
+        # never possible for `coerce_declared_arguments` to have touched
+        # it in the real dispatch either) leaves `raw` exactly as it
+        # arrived, the same as every bare-scalar append this already
+        # handled correctly before BUG#5's fix.
+        #
+        # `Value.materialize`d immediately after coercing — matching the
+        # plain-data shape `entry[:before]`/`entry[:after]` already carry
+        # throughout this whole property, so the eventual `symbolize_deep`
+        # comparison is always materialized-against-materialized, never a
+        # live `Value` against a Hash.
+        def coerce_recompute_append_arg(aggregate, command, source, raw)
+          attribute = command.attribute(source)
+          return raw unless attribute
 
-          before_scope[source]
+          Runtime::Value.materialize(Runtime::Value.for_attribute(aggregate, attribute, raw, argument: true))
         end
 
         # `MutationApplier#removed`'s own value-equality match, reproduced.

data/lib/hecks/fuzzing/properties/guards.rb

@@ -138,6 +138,109 @@ module Hecks
           offenders.empty? || offenders.join("; ")
         end
 
+        # ANGLE-8's OWN WRITE-SIDE HALF. `authorize_scopes_or_refuses`
+        # (above) enforces `TenantScope.apply`'s boundary, and that
+        # boundary exists ONLY for queries/read models — `authorize
+        # policy, tenant: field` is a word `QuerySpecification::Common::
+        # DSL#authorize_impl` grants to `QueryBuilder`/`ReadModelBuilder`
+        # alone; `CommandBuilder` never includes that module, so no
+        # bluebook can declare it on a command at all (confirmed by
+        # reading the grammar directly, not inferred). A WRITE that
+        # carries a `reference_to` from one tenant-scoped record into
+        # another's is checked by NOTHING at dispatch time: `TenantScope`
+        # never runs for a command, and no runtime `given`/`ensures`
+        # anywhere in this corpus reads a cross-aggregate tenant field
+        # either. `qa/stress_domains/tenant_ledger` exists to give this
+        # property a real place to fire.
+        #
+        # THE RULE: an aggregate's own declared TENANT FIELD is whichever
+        # field one of ITS OWN queries names in `authorize policy, tenant:
+        # :field` — the exact same declaration `authorize_scopes_or_
+        # refuses` reads off a query above, reused here to name a field
+        # on the AGGREGATE ITSELF that stores the tenant it belongs to.
+        # For every STORED record (`history[:instances]` — a refused
+        # dispatch never writes one, so "a refusal is correct behaviour,
+        # not a finding" holds by construction, the same way `history
+        # [:instances]` already guarantees this for `stored_records_
+        # satisfy_declared_invariants`) whose own aggregate declares a
+        # tenant field, walk every `reference_to`-typed attribute it
+        # carries (`Bluebook::Reference` — "a reference IS the id",
+        # value/coercion.rb's own header, so the stored value is always a
+        # plain id, never a nested payload) pointing at ANOTHER aggregate
+        # that ALSO declares a tenant field: if the referenced record's
+        # own tenant value disagrees with the referencing record's own
+        # tenant value, the write crossed a tenant boundary and nothing
+        # refused it — a finding.
+        #
+        # A DANGLING/UNRESOLVABLE REFERENCE IS SKIPPED — a different,
+        # existence-shaped property's claim, not this one's (the same
+        # "inconclusive, not a claimed pass" restraint `lifecycle_guard_
+        # and_given_violations_are_refused` already documents for a
+        # differently-shaped case). Comparison goes through `Ports::
+        # Query::InMemory.comparable` (the SAME normalization `authorize_
+        # scopes_or_refuses` already applies to a query row's own tenant
+        # field, just above) rather than `Runtime::Value#==` directly —
+        # two single-attribute value objects with the SAME scalar but
+        # DIFFERENT declared names (`LedgerRegion`/`TransferRegion`, this
+        # domain's own pair — a value object is always declared inside
+        # the aggregate that owns it, so two independently tenant-scoped
+        # aggregates can never share one) compare UNEQUAL under `Value#==`
+        # (`type_name` is part of that equality) despite meaning the
+        # identical tenant, which would make every same-tenant write a
+        # false positive.
+        # rubocop:disable-next Metrics/CyclomaticComplexity
+        # rubocop:disable-next Metrics/PerceivedComplexity
+        def commands_respect_tenant_scope(history)
+          bluebooks = history.fetch(:bluebooks)
+          instances = history.fetch(:instances)
+
+          offenders = instances.flat_map do |key, state|
+            domain_name    = key.split("::").first
+            aggregate_name = key.split("::").last.split("#").first
+            aggregate      = bluebooks[domain_name]&.aggregate(aggregate_name)
+            next [] unless aggregate
+
+            own_tenant_field = tenant_field_for(aggregate)
+            next [] unless own_tenant_field && state.key?(own_tenant_field)
+
+            own_tenant = Ports::Query::InMemory.comparable(state[own_tenant_field])
+
+            aggregate.attributes.filter_map do |attribute|
+              next unless attribute.type.is_a?(Bluebook::Reference)
+
+              target = bluebooks[domain_name]&.aggregate(attribute.type.target_name)
+              target_tenant_field = target && tenant_field_for(target)
+              next unless target_tenant_field
+
+              target_id = state[attribute.name]
+              next unless target_id
+
+              target_state = instances["#{domain_name}::#{target.name}##{target_id}"]
+              next unless target_state&.key?(target_tenant_field)
+
+              target_tenant = Ports::Query::InMemory.comparable(target_state[target_tenant_field])
+              next if target_tenant == own_tenant
+
+              "#{key} (#{own_tenant_field}: #{own_tenant.inspect}) references #{attribute.name}: #{target_id.inspect}, " \
+                "but #{domain_name}::#{target.name}##{target_id} carries #{target_tenant_field}: " \
+                "#{target_tenant.inspect} — a cross-tenant write nothing refused"
+            end
+          end
+
+          offenders.empty? || offenders.join("; ")
+        end
+
+        # THE FIELD AN AGGREGATE'S OWN QUERY NAMES AS TENANT-SCOPING —
+        # shared by `commands_respect_tenant_scope` above for both sides
+        # of a `reference_to`. `nil` for an aggregate with no `authorize
+        # ..., tenant:` on any of its own queries — not every aggregate
+        # is tenant-scoped, and one that isn't has nothing for this
+        # property to check either side of.
+        def tenant_field_for(aggregate)
+          authorization = aggregate.queries.filter_map(&:authorization).find(&:tenant)
+          authorization&.tenant&.to_sym
+        end
+
         # A DECLARED PROCESS MANAGER'S OWN COMMAND — `command.hecks_name`,
         # or an entity's own if the verb's second component is itself
         # dotted (`Aggregate.Entity.Command`, the same two shapes

data/lib/hecks/fuzzing/properties/lifecycle_and_replay.rb

@@ -88,7 +88,40 @@ module Hecks
           first  = Replay.call(domain_path, steps, adapter: adapter)
           second = Replay.call(domain_path, steps, adapter: adapter)
 
-          comparable = ->(history) { history.except(:bluebook, :bluebooks) }
+          # `:event_uid`/`:delivery_id` — `Runtime::Outbox::Fanout#rows_for`'s
+          # OWN `SecureRandom.uuid`, minted fresh per enqueue specifically so
+          # it stays OFF `Event#to_h` (that file's own comment: the domain's
+          # own events stay mintless; this is Ruby-only relay bookkeeping,
+          # never part of what a replay claims the DOMAIN produced) — so two
+          # otherwise-identical replays legitimately carry two different
+          # uuids here, the same reason `:bluebook`/`:bluebooks` (live
+          # object identities, not values) are excluded below.
+          #
+          # `row[:event][:occurred_at]` — the outbox row's own `event:` field
+          # is `Outbox.serialize_event`'s `event.to_h.merge(correlation:...)`,
+          # the FULL `Event#to_h`, unlike `history[:events]` (this file's own
+          # `events = runtime.events.map { {name:, aggregate:, id:, payload:}
+          # }`, above) which has ALWAYS deliberately left `occurred_at` OFF
+          # the compared surface for exactly this reason: a wall-clock read,
+          # never reproducible byte-for-byte between two independent
+          # replaying processes a second apart. Stripped here the same way,
+          # for the one place it newly reappears.
+          #
+          # Both stripped from each `outbox_traces` row before comparing
+          # rather than dropping `outbox_traces` wholesale: everything else
+          # on a row (status, consumer, kind, the event's own name/
+          # aggregate/id/payload) IS reproducible from the steps alone and
+          # stays checked.
+          strip_outbox_nondeterminism = lambda do |history|
+            traces = Array(history[:outbox_traces]).map do |trace|
+              trace.merge(rows: trace[:rows].map do |row|
+                row.except(:event_uid, :delivery_id).merge(event: row[:event].except(:occurred_at))
+              end)
+            end
+            history.merge(outbox_traces: traces)
+          end
+
+          comparable = ->(history) { strip_outbox_nondeterminism.call(history).except(:bluebook, :bluebooks) }
           return true if comparable.call(first) == comparable.call(second)
 
           "two replays of the same #{steps.length} steps produced different histories"

data/lib/hecks/fuzzing/properties/outbox.rb

@@ -0,0 +1,142 @@
+require_relative "../../bluebook/expression/evaluator"
+
+module Hecks
+  module Fuzzing
+    module Properties
+      # THE TRANSACTIONAL OUTBOX'S OWN CONTRACT (`Runtime::Outbox`, that
+      # file's own header), held to the history a replay actually produced
+      # rather than trusted. Two facts, each independently checkable from
+      # `history[:outbox_traces]` (`Replay#call`'s own before/after
+      # capture, one entry per step whose dispatch enqueued at least one
+      # row):
+      #
+      #   1. "DELIVERY IS INLINE BY DEFAULT" — a row THIS replay's own
+      #      dispatch enqueued must not still be `pending`/`claimed` once
+      #      that SAME call returns (nothing here ever simulates a
+      #      crash), and must not be `failed` either — `deliver_row`'s
+      #      own rescue only reaches `failed` for a genuine defect in the
+      #      RELAY's own consumer resolution (a row naming a policy/
+      #      process_manager `run_consumer`'s own independent registry
+      #      lookup cannot find — `WiringError`), never an ordinary
+      #      domain refusal (`PolicyInterpreter#deliver`/`SagaInterpreter#
+      #      advance` both rescue those THEMSELVES, recording `delivered:
+      #      false` on the reaction/saga log and letting `run_consumer`
+      #      return normally). Both checked for every row, `saga:` and
+      #      `policy:` alike.
+      #
+      #   2. A `policy:` ROW SPECIFICALLY — `PolicyInterpreter#deliver`
+      #      returns `nil` (no `reaction_log` entry appended at all)
+      #      EXACTLY when its own `where` (or, for a fan-out policy, the
+      #      SAME `where`, gating the whole `for_each`) does not hold;
+      #      every OTHER outcome (delivered, refused, a defect,
+      #      reaction-depth-reached) is still a non-nil record `#react`
+      #      appends. So a `delivered` policy row with NO matching
+      #      `reaction_log` entry is legitimate ONLY when that policy's
+      #      own `where`, independently RE-EVALUATED here against the
+      #      row's own recorded event, genuinely does not hold. A
+      #      `for_each` policy's own fan-out correctness (how MANY rows
+      #      it should have dispatched to) is `fanout_dispatches_once_
+      #      per_matching_row`'s job, not this one's.
+      #
+      # A `saga:` ROW HAS NO EQUIVALENT SECOND CHECK, DELIBERATELY — this
+      # was the first shape this property shipped with, and it was WRONG,
+      # caught live against `examples/banking` before this comment
+      # existed: `Fanout.sagas`' own `listens?` (starts_on/ends_on/
+      # handler_for matching the event NAME alone) says nothing about
+      # whether a CORRELATION resolves or a LIVE INSTANCE exists, and
+      # `begin_saga`/`end_saga` (saga_interpreter.rb) both have silent,
+      # perfectly ordinary no-op paths that append NOTHING to `saga_log`
+      # — `begin_saga` when an instance under that correlation already
+      # exists, `end_saga` when NO live instance exists to end (an
+      # `AccountOpened` fired by opening an account directly, bypassing
+      # the onboarding flow whose `ends_on` names that same event,
+      # reproduces this exactly: `Fanout.listens?` enqueues the row
+      # because the event NAME matches `ends_on`, `end_saga` finds
+      # nothing under that correlation to delete, and neither logs a
+      # word). A `saga:` row draining to `delivered` with zero matching
+      # `saga_log` entries is therefore NOT a finding — only check 1
+      # applies to it.
+      #
+      # NOT A GRAMMAR CONSTRUCT — `FEATURE_COVERAGE`'s own `dry_runs_
+      # leave_no_trace` precedent: the outbox is a runtime door
+      # (`Runtime::Outbox`), not a word a bluebook declares, so there is
+      # no feature string here to claim.
+      module Outbox
+        def outbox_rows_match_reactions(history)
+          bluebooks = history.fetch(:bluebooks, {})
+
+          offenders = Array(history[:outbox_traces]).flat_map do |trace|
+            trace[:rows].flat_map { |row| outbox_row_offenders(row, trace, bluebooks) }
+          end
+
+          offenders.empty? || offenders.join("; ")
+        end
+
+        def outbox_row_offenders(row, trace, bluebooks)
+          on = row.dig(:event, :name)
+
+          case row[:status]
+          when "pending", "claimed"
+            ["outbox row #{row[:delivery_id]} (#{row[:consumer]} on #{on}) never drained inline — status stayed " \
+             "#{row[:status].inspect} though delivery is inline by contract (Runtime::Outbox's own header)"]
+          when "failed"
+            ["outbox row #{row[:delivery_id]} (#{row[:consumer]} on #{on}) failed to deliver: #{row[:error]} — " \
+             "a domain refusal never reaches this far; a failed row names a defect in the relay's own consumer " \
+             "resolution"]
+          when "delivered"
+            outbox_delivered_policy_offenders(row, on, trace, bluebooks)
+          else
+            []
+          end
+        end
+
+        # See this file's own header for why a `saga:` row is exempt: its
+        # own `listens?` gives no such guarantee, unlike a policy's single,
+        # deterministic `where` gate.
+        def outbox_delivered_policy_offenders(row, on, trace, bluebooks)
+          kind, fqn = row[:consumer].to_s.split(":", 2)
+          return [] unless kind == "policy"
+
+          home, name = fqn.to_s.split("::", 2)
+          return [] if trace[:reactions].any? { |entry| entry[:policy] == name && entry[:on] == on }
+
+          policy = bluebooks[home]&.policies&.find { |candidate| candidate.name == name }
+          return [] unless policy # nothing declared under this name — inconclusive, not a claimed mismatch
+          return [] if policy.fans_out? # fan-out row count is fanout_dispatches_once_per_matching_row's job
+
+          held = independently_re_evaluate_policy_where(policy, row[:event])
+          return [] if held != true # false, or inconclusive (the where itself raised) — never a claimed mismatch
+
+          ["outbox row #{row[:delivery_id]} (#{row[:consumer]} on #{on}) drained as delivered, but no matching " \
+           "reaction_log entry exists and the policy's own where clause independently re-evaluates true — " \
+           "PolicyInterpreter#deliver only ever returns nil (no reaction_log entry) when where does not hold"]
+        end
+
+        # `PolicyInterpreter#where_holds?`'s own two branches, reproduced —
+        # never calling that method again, which would only ever agree
+        # with itself (the same rule `resolve_dispatch_binding`'s own
+        # comment states). `Evaluator.call` (the raw-string entry, parsed
+        # and cached — never `call_rule`, which needs the policy's own
+        # BUILD-TIME `where_rule` AST, an object this history has no
+        # reason to carry) is the exact same call `Replay#fan_out_finding`
+        # already makes for the identical fact one property over
+        # (`policy.where.to_s.empty? || Evaluator.call(policy.where, {},
+        # payload)`), reused rather than re-derived a second, slightly
+        # different way. `rescue`d to `nil`, not `false`: a where clause
+        # that cannot be re-evaluated from the row's own recorded payload
+        # alone is INCONCLUSIVE, not proof either way — the same "never a
+        # claimed pass or a claimed mismatch from a resolution this replay
+        # cannot actually reproduce" discipline `build_guard_check`'s own
+        # rescue clause already follows.
+        def independently_re_evaluate_policy_where(policy, event)
+          return true if policy.where.to_s.empty?
+
+          payload = (event[:payload] || {}).transform_keys(&:to_sym)
+          Bluebook::Expression::Evaluator.call(policy.where, {}, payload)
+        rescue StandardError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/properties.rb

@@ -9,6 +9,8 @@ require_relative "properties/querying"
 require_relative "properties/guards"
 require_relative "properties/dispatch_and_mutations"
 require_relative "properties/invariants_and_aggregation"
+require_relative "properties/corrections"
+require_relative "properties/outbox"
 
 module Hecks
   module Fuzzing
@@ -55,7 +57,10 @@ module Hecks
       extend Querying
       extend Guards
       extend DispatchAndMutations
+      extend DryRuns
       extend InvariantsAndAggregation
+      extend Corrections
+      extend Outbox
 
       module_function
 
@@ -96,7 +101,19 @@ module Hecks
         fanout_dispatches_once_per_matching_row:          %w[Policy#for_each Policy#where],
         aggregation_matches_recompute:                    %w[ReadModel#count ReadModel#median_field],
         stored_records_satisfy_declared_invariants:       %w[Aggregate#invariants Entity#invariants],
-        group_by_matches_recompute:                       %w[ReadModel#group_by]
+        group_by_matches_recompute:                       %w[ReadModel#group_by],
+        # A RUNTIME DOOR, NOT A GRAMMAR CONSTRUCT — `Dispatcher#dry_run?`
+        # is something an application asks of a booted domain, not a
+        # word a bluebook can declare, so there is no feature string
+        # for it to claim. Listed (empty) rather than omitted so the
+        # discipline this table states — every property names what it
+        # is answerable for — has no silent exception.
+        dry_runs_leave_no_trace:                          [],
+        # ANOTHER RUNTIME DOOR, NOT A GRAMMAR CONSTRUCT — same reasoning
+        # as dry_runs_leave_no_trace right above: `Runtime::Outbox` is
+        # something a persistence adapter provides underneath a booted
+        # domain, never a word a bluebook declares.
+        outbox_rows_match_reactions:                      []
       }.freeze
 
       # FEATURES A REPLAY PROPERTY COULD NEVER CATCH VIOLATED, because the
@@ -205,8 +222,12 @@ module Hecks
           paging_offset_partitions_correctly:               paging_offset_partitions_correctly(history),
           lifecycle_guard_and_given_violations_are_refused: lifecycle_guard_and_given_violations_are_refused(history),
           authorize_scopes_or_refuses:                      authorize_scopes_or_refuses(history),
+          commands_respect_tenant_scope:                    commands_respect_tenant_scope(history),
           dispatch_binding_fidelity:                        dispatch_binding_fidelity(history),
-          mutations_match_recompute:                        mutations_match_recompute(history) }
+          mutations_match_recompute:                        mutations_match_recompute(history),
+          dry_runs_leave_no_trace:                          dry_runs_leave_no_trace(history),
+          corrections_reference_an_emitted_event:           corrections_reference_an_emitted_event(history),
+          outbox_rows_match_reactions:                      outbox_rows_match_reactions(history) }
       end
     end
   end