hecks 1.2.0 → 1.4.0

data/lib/hecks/fuzzing/properties/guards.rb

@@ -12,18 +12,18 @@ module Hecks
       # verb-to-declaration lookups (#command_for_verb,
       # #effective_guard_descriptions) each resolves a refusal against.
       module Guards
-        # `Query#options`' OTHER HALF — TenantScope.apply's own contract
+        # `Query#options`' other half — TenantScope.apply's own contract
         # (tenant_scope.rb), independently restated as a property rather
         # than exercised only through whatever the generator happens to
-        # try. NOT closed by the generator here on purpose: SafeDepositBox.
+        # try. Not closed by the generator here on purpose: SafeDepositBox.
         # Rented — the only real corpus query declaring `authorize` at
-        # all — declares ZERO attributes of its own, so StepBuilder#args_for
+        # all — declares zero attributes of its own, so StepBuilder#args_for
         # always hands it `{}` and TenantScope.apply refuses every
         # generated attempt, unconditionally (confirmed: no successful ask
         # against an authorize-bearing query reaches this property via the
         # standard battery today). Extending the generator to invent a
         # `tenant:` value ran into a separate, real finding along the way —
-        # SafeDepositBox is COMPOSITE-identified (`identified_by` is nil
+        # SafeDepositBox is composite-identified (`identified_by` is nil
         # for it — Runtime::Identified#derive_identity), so the generator's
         # existing `known_ids` pool (keyed by `aggregate.identified_by ||
         # "id"`) tracks a stray, never-real scalar for it rather than its
@@ -37,10 +37,10 @@ module Hecks
         # where a `tenant:` arg came from.
         #
         # Two claims, matching TenantScope.apply's own two branches: every
-        # SUCCESSFUL answer's own tenant field agrees with the tenant arg
+        # successful answer's own tenant field agrees with the tenant arg
         # given (the WhereClause TenantScope injects is a Symbol reference
-        # into args, resolved dynamically — this checks the OUTCOME, not
-        # re-deriving that resolution) ; every ask MISSING a required
+        # into args, resolved dynamically — this checks the outcome, not
+        # re-deriving that resolution) ; every ask missing a required
         # tenant: refuses with the declared wording, never succeeds. A
         # refusal for an unrelated reason with the tenant arg present is
         # not this property's claim either way — skipped, not graded.
@@ -92,14 +92,14 @@ module Hecks
           offenders.empty? || offenders.join("; ")
         end
 
-        # EVERY GIVEN/ENSURES REFUSAL A RUN ACTUALLY RAISED NAMES A RULE
-        # THE COMMAND ACTUALLY DECLARES. `GivenNotMet`/`EnsuresNotMet` both
+        # Every given/ensures refusal a run actually raised names a rule
+        # the command actually declares. `GivenNotMet`/`EnsuresNotMet` both
         # quote their guard's own `description` verbatim
         # (command_rules/admissibility.rb: `"#{command.hecks_name} refused
-        # — #{given.description}"`) — the SAME text `behavior.bluebook`'s
+        # — #{given.description}"`) — the same text `behavior.bluebook`'s
         # own `Rule`/Command.Ensure hold as `Rule#description`, so a
         # refusal whose quoted text is not among the refusing command's
-        # OWN `guard_descriptions` (Behaviour::Command, both givens and
+        # own `guard_descriptions` (Behaviour::Command, both givens and
         # ensures) is either a stale message surviving a renamed rule, a
         # rule firing against the wrong command's own guard set, or the
         # wording drifting out from under the declaration it is supposed
@@ -107,7 +107,7 @@ module Hecks
         # guards, some through a cross-aggregate dereference) are exactly
         # the surface this exists to hold to its word.
         #
-        # `kind:` is what tells a guard refusal apart from the FOUR other
+        # `kind:` is what tells a guard refusal apart from the four other
         # `RefusalWording` templates sharing the identical "X refused — Y"
         # shape (LifecycleRefused/transition_blocked, both TypeMismatch
         # object-reference templates, Unauthorized/role_mismatch) — see
@@ -138,16 +138,119 @@ module Hecks
           offenders.empty? || offenders.join("; ")
         end
 
-        # A DECLARED PROCESS MANAGER'S OWN COMMAND — `command.hecks_name`,
+        # Angle-8's own write-side half. `authorize_scopes_or_refuses`
+        # (above) enforces `TenantScope.apply`'s boundary, and that
+        # boundary exists only for queries/read models — `authorize
+        # policy, tenant: field` is a word `QuerySpecification::Common::
+        # DSL#authorize_impl` grants to `QueryBuilder`/`ReadModelBuilder`
+        # alone; `CommandBuilder` never includes that module, so no
+        # bluebook can declare it on a command at all (confirmed by
+        # reading the grammar directly, not inferred). A write that
+        # carries a `reference_to` from one tenant-scoped record into
+        # another's is checked by nothing at dispatch time: `TenantScope`
+        # never runs for a command, and no runtime `given`/`ensures`
+        # anywhere in this corpus reads a cross-aggregate tenant field
+        # either. `qa/stress_domains/tenant_ledger` exists to give this
+        # property a real place to fire.
+        #
+        # The rule: an aggregate's own declared tenant field is whichever
+        # field one of its own queries names in `authorize policy, tenant:
+        # :field` — the exact same declaration `authorize_scopes_or_
+        # refuses` reads off a query above, reused here to name a field
+        # on the aggregate itself that stores the tenant it belongs to.
+        # For every stored record (`history[:instances]` — a refused
+        # dispatch never writes one, so "a refusal is correct behaviour,
+        # not a finding" holds by construction, the same way `history
+        # [:instances]` already guarantees this for `stored_records_
+        # satisfy_declared_invariants`) whose own aggregate declares a
+        # tenant field, walk every `reference_to`-typed attribute it
+        # carries (`Bluebook::Reference` — "a reference IS the id",
+        # value/coercion.rb's own header, so the stored value is always a
+        # plain id, never a nested payload) pointing at another aggregate
+        # that also declares a tenant field: if the referenced record's
+        # own tenant value disagrees with the referencing record's own
+        # tenant value, the write crossed a tenant boundary and nothing
+        # refused it — a finding.
+        #
+        # A dangling/unresolvable reference is skipped — a different,
+        # existence-shaped property's claim, not this one's (the same
+        # "inconclusive, not a claimed pass" restraint `lifecycle_guard_
+        # and_given_violations_are_refused` already documents for a
+        # differently-shaped case). Comparison goes through `Ports::
+        # Query::InMemory.comparable` (the same normalization `authorize_
+        # scopes_or_refuses` already applies to a query row's own tenant
+        # field, just above) rather than `Runtime::Value#==` directly —
+        # two single-attribute value objects with the same scalar but
+        # different declared names (`LedgerRegion`/`TransferRegion`, this
+        # domain's own pair — a value object is always declared inside
+        # the aggregate that owns it, so two independently tenant-scoped
+        # aggregates can never share one) compare unequal under `Value#==`
+        # (`type_name` is part of that equality) despite meaning the
+        # identical tenant, which would make every same-tenant write a
+        # false positive.
+        # rubocop:disable-next Metrics/CyclomaticComplexity
+        # rubocop:disable-next Metrics/PerceivedComplexity
+        def commands_respect_tenant_scope(history)
+          bluebooks = history.fetch(:bluebooks)
+          instances = history.fetch(:instances)
+
+          offenders = instances.flat_map do |key, state|
+            domain_name    = key.split("::").first
+            aggregate_name = key.split("::").last.split("#").first
+            aggregate      = bluebooks[domain_name]&.aggregate(aggregate_name)
+            next [] unless aggregate
+
+            own_tenant_field = tenant_field_for(aggregate)
+            next [] unless own_tenant_field && state.key?(own_tenant_field)
+
+            own_tenant = Ports::Query::InMemory.comparable(state[own_tenant_field])
+
+            aggregate.attributes.filter_map do |attribute|
+              next unless attribute.type.is_a?(Bluebook::Reference)
+
+              target = bluebooks[domain_name]&.aggregate(attribute.type.target_name)
+              target_tenant_field = target && tenant_field_for(target)
+              next unless target_tenant_field
+
+              target_id = state[attribute.name]
+              next unless target_id
+
+              target_state = instances["#{domain_name}::#{target.name}##{target_id}"]
+              next unless target_state&.key?(target_tenant_field)
+
+              target_tenant = Ports::Query::InMemory.comparable(target_state[target_tenant_field])
+              next if target_tenant == own_tenant
+
+              "#{key} (#{own_tenant_field}: #{own_tenant.inspect}) references #{attribute.name}: #{target_id.inspect}, " \
+                "but #{domain_name}::#{target.name}##{target_id} carries #{target_tenant_field}: " \
+                "#{target_tenant.inspect} — a cross-tenant write nothing refused"
+            end
+          end
+
+          offenders.empty? || offenders.join("; ")
+        end
+
+        # The field an aggregate's own query names as tenant-scoping —
+        # shared by `commands_respect_tenant_scope` above for both sides
+        # of a `reference_to`. `nil` for an aggregate with no `authorize
+        # ..., tenant:` on any of its own queries — not every aggregate
+        # is tenant-scoped, and one that isn't has nothing for this
+        # property to check either side of.
+        def tenant_field_for(aggregate)
+          authorization = aggregate.queries.filter_map(&:authorization).find(&:tenant)
+          authorization&.tenant&.to_sym
+        end
+
+        # A declared process manager's own command — `command.hecks_name`,
         # or an entity's own if the verb's second component is itself
         # dotted (`Aggregate.Entity.Command`, the same two shapes
         # `Dispatcher#dispatch` itself branches on). Shared by the guard
         # property above and available for anything else that needs to go
         # from a replayed verb back to its declaration.
         #
-        # RESOLVED AGAINST `bluebooks` (the FULL map, `history[:bluebooks]`
+        # Resolved against `bluebooks` (the full map, `history[:bluebooks]`
         # — every loaded domain, keyed by name), never a single assumed
-        # bluebook: a verb names its OWN domain (`Naming.split_verb`'s
+        # bluebook: a verb names its own domain (`Naming.split_verb`'s
         # first element), and that domain is not always the one Replay
         # happens to expose as `history[:bluebook]`. A fuzz run against
         # `lib/hecks/grammar` (Expression + Translation, in load
@@ -155,14 +258,14 @@ module Hecks
         # refusal read as "no declared command resolves that verb" purely
         # because `history[:bluebook]` was Expression, not Translation; the
         # refusal was real, this property's own domain resolution was not.
-        # A DELEGATING DOOR REFUSES WITH ITS TARGET'S OWN WORDS. `delegates_to`
+        # A delegating door refuses with its target's own words. `delegates_to`
         # (CommandBuilder#delegates_to_impl) hands the whole dispatch to one
         # entity command, and that command's given is what refuses — raised
         # back through the door, in the door's name (chess: `Game.MoveKnight
         # refused — "it is that color's turn"`, a given Knight.Move declares
         # and MoveKnight, a pure passthrough, never could). Read the door's
         # own guards first, then every delegation target's; an offence is
-        # only a description NEITHER declares. Found live mining chess's
+        # only a description neither declares. Found live mining chess's
         # history: every refused move through a door read as undeclared.
         def effective_guard_descriptions(bluebooks, verb, command)
           own = command.guard_descriptions
@@ -193,9 +296,9 @@ module Hecks
           end
         end
 
-        # `guard_refusals_are_declared`'s OWN OPPOSITE DIRECTION. That
+        # `guard_refusals_are_declared`'s own opposite direction. That
         # property is passive and one-directional — for a refusal that
-        # ALREADY HAPPENED, is the quoted text real declared text? It says
+        # already happened, is the quoted text real declared text? It says
         # nothing about a guard that should have refused and silently did
         # not — a call site that stopped calling enforce_givens/enforce_
         # lifecycle_guard would never appear in history[:refusals] at all,
@@ -203,7 +306,7 @@ module Hecks
         #
         # This one calls Admissibility#enforce_givens (which itself folds
         # in #enforce_lifecycle_guard whenever `declaring:` is passed)
-        # DIRECTLY, against Replay's own pre-dispatch snapshot
+        # directly, against Replay's own pre-dispatch snapshot
         # (history[:guard_checks], one bounded, additive extension — see
         # that file's own comment at the capture site) — an independent
         # recomputation, not grading production against itself, the same
@@ -213,27 +316,27 @@ module Hecks
         # could mutate anything a cross-aggregate given dereferences) is
         # compared against `actual_refused` (GivenNotMet/LifecycleRefused
         # specifically — Replay's own comment on GUARD_REFUSAL_CLASSES
-        # explains why ANY other refusal class, or an outright success,
+        # explains why any other refusal class, or an outright success,
         # both count as "the guard did not fire," since enforce_givens
-        # runs FIRST in DISPATCH_ORDER).
+        # runs first in DISPATCH_ORDER).
         #
         # Aggregate#preconditions closes for free alongside this — a
         # no-block `given` reference (CommandBuilder#given) pushes the
-        # SAME Given struct object `enforce_givens` already iterates
+        # same Given struct object `enforce_givens` already iterates
         # command.givens for, so there is no separate runtime path a
         # property could exercise beyond what this already reaches.
         # Entity#preconditions closes the identical way, one level down
         # (ADR 0028) — a piece's own bare `given` reference pushes the
-        # SAME Given struct onto ITS OWN referencing command's givens,
+        # same Given struct onto its own referencing command's givens,
         # so LedgerEntry's own Amend/Reverse (banking) already exercise
         # this through the exact mechanism above, no separate path.
         #
         # Real targets: Account.Debit/CloseAccount (`from:` guards),
         # Credit/Debit (the named-once `given("customer is active")`
         # precondition) — FreezeAccount deliberately references the
-        # DIFFERENT named precondition `"customer is not closed"` instead
+        # different named precondition `"customer is not closed"` instead
         # (a suspended customer must still be freezable), so it is not a
-        # `"customer is active"` example, just the same MECHANISM.
+        # `"customer is active"` example, just the same mechanism.
         def lifecycle_guard_and_given_violations_are_refused(history)
           offenders = history.fetch(:guard_checks).filter_map do |check|
             next if check[:recomputed_refused] == check[:actual_refused]

data/lib/hecks/fuzzing/properties/invariants_and_aggregation.rb

@@ -14,11 +14,11 @@ module Hecks
       # (#check_piece_invariants, #eligible_rows, #nest_rows,
       # #recompute_median) each leans on.
       module InvariantsAndAggregation
-        # EVERY STORED RECORD STILL SATISFIES ITS OWN AGGREGATE'S DECLARED
-        # INVARIANTS — Admissibility#enforce_invariants (command_rules/
-        # admissibility.rb) checks these AFTER every command's mutations,
-        # BEFORE save, the same point `ensures` is checked. Nothing until
-        # now re-checked a record AFTER a whole replay finished, independent
+        # Every stored record still satisfies its own aggregate's declared
+        # invariants — Admissibility#enforce_invariants (command_rules/
+        # admissibility.rb) checks these after every command's mutations,
+        # before save, the same point `ensures` is checked. Nothing until
+        # now re-checked a record after a whole replay finished, independent
         # of whichever call site was supposed to have refused a violation
         # in the first place — a record failing its own declared invariant
         # here is proof a violating write landed anyway: the call site
@@ -27,9 +27,9 @@ module Hecks
         #
         # `history[:instances]` entries are already plain, symbol-keyed
         # state Hashes (Replay.call's own `record.state`) — called against
-        # Evaluator.call the SAME way ValueObject::Builder#build already
+        # Evaluator.call the same way ValueObject::Builder#build already
         # does for a VO's own invariants (value/coercion.rb), no GuardState
-        # wrapper needed the way enforce_invariants' own LIVE call uses one
+        # wrapper needed the way enforce_invariants' own live call uses one
         # (GuardState exists for `parent.`/projected-field dereferencing
         # mid-dispatch; a stored record's own scalar fields need none of
         # that to re-check a same-aggregate invariant against itself).
@@ -39,8 +39,8 @@ module Hecks
         #
         # Entity#invariants (round 7) closes here too, not for free —
         # `stored_records_satisfy_declared_invariants` only ever checked
-        # the AGGREGATE's own flat state; a piece's own invariant is
-        # checked against every ELEMENT of a `list_of` field, a genuinely
+        # the aggregate's own flat state; a piece's own invariant is
+        # checked against every element of a `list_of` field, a genuinely
         # different walk `check_piece_invariants` below makes,
         # independently of `Admissibility#check_entity_invariants` (the
         # live enforcement path this property exists to catch drifting
@@ -70,11 +70,11 @@ module Hecks
           offenders.empty? || offenders.join("; ")
         end
 
-        # A PIECE'S OWN INVARIANT, checked against every element a
-        # `list_of` field holds — the SAME lookup `Admissibility#
+        # A piece's own invariant, checked against every element a
+        # `list_of` field holds — the same lookup `Admissibility#
         # check_entity_invariants` makes (`owner.attributes.find { |a|
         # a.list? && a.type.to_s == entity.hecks_name }`), independently
-        # reapplied here against a STORED record's own plain Hash state
+        # reapplied here against a stored record's own plain Hash state
         # rather than a live `Instance`.
         def check_piece_invariants(owner_construct, owner_state, key)
           owner_construct.entities.each do |entity|
@@ -99,23 +99,23 @@ module Hecks
           nil
         end
 
-        # A SAGA INSTANCE'S OWN CHECKPOINT SURVIVES BEING WRITTEN AND READ
-        # BACK — the durability contract `SagaInterpreter#checkpoint` makes
+        # A saga instance's own checkpoint survives being written and read
+        # back — the durability contract `SagaInterpreter#checkpoint` makes
         # (`state:` plus a `deep_copy`d `memory:`, handed to whatever
         # adapter answers `save_saga`) and `Registry#rehydrate_sagas!`
         # promises to restore on the next boot (`each_saga` yielding
         # `[pm, correlation, state, memory]` back into `saga_instances`).
-        # `Replay` captures the LIVE store already materialised the same
+        # `Replay` captures the live store already materialised the same
         # way `checkpoint` itself does (`Value.materialize`, not raw
         # `Runtime::Value`s — see its own comment); this property pushes
-        # that captured memory through the SAME `JSON.generate` then
+        # that captured memory through the same `JSON.generate` then
         # `JSON.parse(symbolize_names: true)` round-trip `checkpoint`'s own
         # `deep_copy` performs (mirrored here rather than called — a
         # private instance method with no registry to hand it) and checks
         # it comes back byte-identical. A memory holding anything that
         # round-trip cannot carry faithfully — a bare Symbol leaf, a
         # non-JSON type a future field introduces — is corruption the
-        # durable path would introduce on a REAL restart, caught here
+        # durable path would introduce on a real restart, caught here
         # without needing one.
         #
         # `declares_state?` (Behaviour::ProcessManager) is the other half:
@@ -150,11 +150,11 @@ module Hecks
           offenders.empty? || offenders.join("; ")
         end
 
-        # A `for_each` POLICY DISPATCHES EXACTLY ONCE PER ROW ITS DECLARED
-        # QUERY ANSWERS — never once for the triggering event regardless of
+        # A `for_each` policy dispatches exactly once per row its declared
+        # query answers — never once for the triggering event regardless of
         # row count, never skipping a matched row, never firing on a row a
-        # concurrent mutation only made match AFTER the fact. `Replay`
-        # computes the expected row-id set INDEPENDENTLY, at the same
+        # concurrent mutation only made match after the fact. `Replay`
+        # computes the expected row-id set independently, at the same
         # instant the real dispatch runs (`Replay.expected_fan_out_rows`,
         # the query oracle's own shape aimed at fan-out: two engines
         # compared, never one graded against itself), and records it
@@ -183,21 +183,21 @@ module Hecks
           offenders.empty? || offenders.join("; ")
         end
 
-        # A `count`/`median` REPORT'S REDUCED SCALAR MATCHES THE SAME
-        # REDUCTION DONE INDEPENDENTLY, over the SAME eligible rows —
+        # A `count`/`median` report's reduced scalar matches the same
+        # reduction done independently, over the same eligible rows —
         # `ReadModelInterpreter#project`'s own FK-join (root first, then
         # each many-side head matched against it) and `#median` (odd →
         # the true middle, even → the average of the two middles as a
         # Float, empty → `nil`; `count` is the filtered length, empty →
         # `0`), reproduced here in plain Ruby against `history[:instances]`
         # rather than a live registry — `FieldPath.dig` +
-        # `Ports::Query::InMemory.comparable`/`.holds?` are the SAME two
+        # `Ports::Query::InMemory.comparable`/`.holds?` are the same two
         # calls the interpreter itself makes to read a field and judge a
         # `where`, called here rather than re-derived, so this oracle
         # cannot drift from what "read a field" or "a clause holds" mean
         # without the interpreter drifting the identical way.
         #
-        # Only a report whose `:query` is answered by the SAME bluebook
+        # Only a report whose `:query` is answered by the same bluebook
         # `history[:bluebook]` carries (the bare `Domain.report_name`
         # form, `domain == bluebook.name`) is checked — the same "only
         # what we have the grammar for" scope `lifecycle_values_are_declared`
@@ -206,7 +206,7 @@ module Hecks
         # ("only a report answered by this bluebook, only a count/median
         # report, only one with a reduced many-side head") each gating the
         # next, ending in one independent recomputation compared against
-        # the live answer. The guards are what make this oracle SCOPED
+        # the live answer. The guards are what make this oracle scoped
         # correctly, not incidental complexity — narrower than "every
         # branch reads as its own precondition."
         # rubocop:disable-next Metrics/CyclomaticComplexity
@@ -239,14 +239,14 @@ module Hecks
         end
 
         # `aggregation_matches_recompute`'s own shape, extended from
-        # reducing a many-side head to a scalar (count/median) to NESTING
+        # reducing a many-side head to a scalar (count/median) to nesting
         # it — `ReadModelInterpreter#group_by_target`/`#nest`, reproduced
         # here in plain Ruby against `history[:instances]` the same way
         # `eligible_rows` already reproduces the FK-join and `where`
         # narrowing count/median share. `Value.materialize_unwrapped` is
-        # the SAME call `#project` makes before nesting (a single-field
+        # the same call `#project` makes before nesting (a single-field
         # value object recurses to its bare scalar — a real grouping key
-        # has to BE one) — called here rather than re-derived, so this
+        # has to be one) — called here rather than re-derived, so this
         # oracle cannot drift from what "the group key" means without the
         # interpreter drifting the identical way.
         #
@@ -298,17 +298,17 @@ module Hecks
           end
         end
 
-        # THE ELIGIBLE ROWS a `count`/`median` head reduces — every
+        # The eligible rows a `count`/`median` head reduces — every
         # instance of the reduced head's own aggregate, FK-matched against
         # the report's root reference (if it has one; a rootless report has
         # none to match) exactly the way `ReadModelInterpreter#reference_fields`
         # finds the matching attribute, then narrowed by the report's own
-        # `where` clauses via the SAME `InMemory.holds?` the interpreter's
+        # `where` clauses via the same `InMemory.holds?` the interpreter's
         # `execute` calls.
         def eligible_rows(bluebook, instances, domain, model, reduced_head, args)
           aggregate = bluebook.aggregate(reduced_head[:aggregate])
           prefix = "#{domain}::#{reduced_head[:aggregate]}#"
-          # `id:` MERGED IN, the same `record.to_h` (`@state.merge(id:
+          # `id:` merged in, the same `record.to_h` (`@state.merge(id:
           # @id)`) every live head row carries — count/median never read
           # it, but group_by_matches_recompute's own independent nesting
           # does, the same way ReadModelInterpreter#row(record) = record.

data/lib/hecks/fuzzing/properties/lifecycle_and_replay.rb

@@ -1,3 +1,5 @@
+require_relative "../nondeterministic"
+
 module Hecks
   module Fuzzing
     module Properties
@@ -12,11 +14,11 @@ module Hecks
       # trustworthy in the first place.
       module LifecycleAndReplay
         # Every lifecycle field a replay leaves an instance holding is one
-        # of the aggregate's OWN declared states — the full set, not just
+        # of the aggregate's own declared states — the full set, not just
         # `Lifecycle#states`' default+targets (see ModelCheck.full_states'
         # own comment on that hole). The tie to M2 is direct: the model
-        # checker proves which states a domain's OWN declarations can ever
-        # produce ; this proves a REAL RUN never produced anything else —
+        # checker proves which states a domain's own declarations can ever
+        # produce ; this proves a real run never produced anything else —
         # a coercion bug, a stale string surviving a rename, a default
         # that drifted from the declared set, would all show up here as a
         # value nothing upstream would have predicted.
@@ -44,10 +46,10 @@ module Hecks
         end
 
         # Every saga advance a replay actually logged moved along an edge
-        # the process manager DECLARED — `(from, to)` pairs that appear in
+        # the process manager declared — `(from, to)` pairs that appear in
         # `saga_log` with `advanced: true` must be a `(handler.from_state,
         # handler.to_state)` pair some handler on that PM declares
-        # (compensation edges included ; a REFUSED-triggered advance is a
+        # (compensation edges included ; a refused-triggered advance is a
         # handler like any other). A saga that advanced along a pair no
         # handler names would mean the runtime moved state the language
         # never authorized — the same trust ModelCheck's static reachability
@@ -72,23 +74,41 @@ module Hecks
           offenders.empty? || offenders.join("; ")
         end
 
-        # THE FOUNDATIONAL ONE. `Hecks::Runtime` mints nothing — every
+        # The foundational one. `Hecks::Runtime` mints nothing — every
         # identity is declared and derived, never invented (see
-        # command_interpreter.rb's own "NOTHING IS MINTED" — a random hex,
+        # command_interpreter.rb's own "nothing is minted" — a random hex,
         # a counter, anything not reproducible from the payload, was
         # refused out of the runtime specifically because it broke this).
-        # So the SAME steps, replayed against a FRESH boot, must produce
-        # BYTE-IDENTICAL events, refusals, and instances — any drift here
+        # So the same steps, replayed against a fresh boot, must produce
+        # byte-identical events, refusals, and instances — any drift here
         # is nondeterminism the runtime promised not to have: a wall-clock
         # read that leaked into compared state, a Hash iteration order a
         # comparison depended on, anything. Two independent replays, not a
-        # cached one compared to itself, so a bug that corrupts the FIRST
+        # cached one compared to itself, so a bug that corrupts the first
         # run's own bookkeeping cannot pass by agreeing with itself.
         def replay_is_deterministic(domain_path, steps, adapter: :memory)
           first  = Replay.call(domain_path, steps, adapter: adapter)
           second = Replay.call(domain_path, steps, adapter: adapter)
 
-          comparable = ->(history) { history.except(:bluebook, :bluebooks) }
+          # What leaves this comparison, and why, is declared once in
+          # `Nondeterministic::FIELDS`: the `outbox_row` group (per-enqueue
+          # uuids), the `event` group on each row's full `Event#to_h`
+          # (`occurred_at`, which `history[:events]` never carried), and the
+          # `history` group (live IR objects). Stripped per `outbox_traces`
+          # row rather than dropping `outbox_traces` wholesale: everything
+          # else on a row (status, consumer, kind, the event's own name/
+          # aggregate/id/payload) is reproducible from the steps alone and
+          # stays checked.
+          strip_outbox_nondeterminism = lambda do |history|
+            traces = Array(history[:outbox_traces]).map do |trace|
+              trace.merge(rows: trace[:rows].map do |row|
+                Nondeterministic.strip(row, :outbox_row).merge(event: Nondeterministic.strip(row[:event], :event))
+              end)
+            end
+            history.merge(outbox_traces: traces)
+          end
+
+          comparable = ->(history) { Nondeterministic.strip(strip_outbox_nondeterminism.call(history), :history) }
           return true if comparable.call(first) == comparable.call(second)
 
           "two replays of the same #{steps.length} steps produced different histories"