hecks 1.2.0 → 1.4.0

data/lib/hecks/fuzzing/sequence_generator/catalog.rb

@@ -26,20 +26,11 @@ module Hecks
                 queries << { verb: "#{domain_name}::#{aggregate.hecks_name}.#{query.name}",
                              query: query, aggregate: aggregate }
               end
-              aggregate.entities.each do |entity|
-                entity.commands.each do |command|
-                  entity_commands << { verb: "#{domain_name}::#{aggregate.hecks_name}.#{entity.hecks_name}.#{command.hecks_name}",
-                                       command: command, aggregate: aggregate, entity: entity }
-                end
-                entity.queries.each do |query|
-                  entity_queries << { verb: "#{domain_name}::#{aggregate.hecks_name}.#{entity.hecks_name}.#{query.name}",
-                                      query: query, aggregate: aggregate, entity: entity }
-                end
-              end
+              catalog_entities(domain_name, aggregate, entity_commands, entity_queries)
             end
 
-            # THE BARE DOMAIN FORM — "Domain.report_name", no "::" — the
-            # SAME shape `Dispatcher#query` itself branches on to route a
+            # **The bare domain form** — "Domain.report_name", no "::" — the
+            # same shape `Dispatcher#query` itself branches on to route a
             # read-model ask apart from an aggregate query. A report was
             # never in this catalog at all before: `aggregation_matches_
             # recompute` (count/median) has only ever been exercised by
@@ -56,41 +47,121 @@ module Hecks
           { creating: creating, instance: instance, entity_commands: entity_commands,
             queries: queries, entity_queries: entity_queries, read_models: read_models,
             populators: populators(runtime),
+            # Every `role "..."` any command in the boot declares — the
+            # "wrong hat" pool the caller draw's `mismatched` shape picks
+            # from (adversary.rb `other_role`).
+            roles: (creating + instance + entity_commands).filter_map { |e| e[:command].role }
+                                                          .map(&:to_s).reject(&:empty?).uniq.sort,
+            # The grant verb every loaded authorization provider declares
+            # (`provides "authorization", grant: ...`) — what the caller
+            # draw steers at a declared role and records as a real grant.
+            # Read off the declaration, never the literal Governance name.
+            grant_verbs: runtime.registry.authorization_providers
+                                .filter_map { |chapter| chapter.provided_verb(Bluebook::Capabilities::AUTHORIZATION, :grant) }
+                                .sort,
             # Which aggregates this corpus can actually make one of — the ones
             # `satisfiable?` is entitled to wait for.
             creatable: creating.to_set { |entry| entry[:aggregate].hecks_name } }
         end
 
-        # Which command, on which aggregate, appends to which entity list — so a
-        # successful dispatch can predict the identity the element it just added
-        # landed on. Entity#identified_by is filled by `Array(current).size + 1`
+        # Every entity, at every depth — `Card` nested inside `Board`
+        # inside `Workspace` (qa/stress_domains/nested_pieces) walks in
+        # as `chain: [Board, Card]`, the exact hop list
+        # `EntityInterpreter::Resolution.of` resolves the dotted verb
+        # back into. Before this walk existed the catalog only ever read
+        # `aggregate.entities` one level down, so a two-hop entity
+        # command (BUG#11's whole class) could never be generated at all
+        # — the one shape the differential harness most needed to reach
+        # was structurally absent from every sequence it ever produced.
+        # `entity:` stays the last hop (what every existing reader means
+        # by "the entity"); `chain:` is the whole path.
+        #
+        # Entity queries stay one hop deep, exactly as before — a nested
+        # entity's query has no established wire spelling this generator
+        # can vouch for, and nothing in the corpus declares one.
+        def catalog_entities(domain_name, aggregate, entity_commands, entity_queries)
+          each_entity_chain(aggregate) do |chain|
+            entity = chain.last
+            path   = chain.map(&:hecks_name).join(".")
+            entity.commands.each do |command|
+              entity_commands << { verb: "#{domain_name}::#{aggregate.hecks_name}.#{path}.#{command.hecks_name}",
+                                   command: command, aggregate: aggregate, entity: entity, chain: chain }
+            end
+            next unless chain.size == 1
+
+            entity.queries.each do |query|
+              entity_queries << { verb: "#{domain_name}::#{aggregate.hecks_name}.#{path}.#{query.name}",
+                                  query: query, aggregate: aggregate, entity: entity }
+            end
+          end
+        end
+
+        # Depth-first, parents before children, in declaration order — so
+        # the depth-1 entries land in `entity_commands` in exactly the
+        # order they always did (a pinned seed's picker pool is the same
+        # pool it was), and a nested entity's own entries follow its
+        # parent's.
+        def each_entity_chain(owner, chain = [], &block)
+          owner.entities.each do |entity|
+            path = chain + [entity]
+            yield path
+            each_entity_chain(entity, path, &block)
+          end
+        end
+
+        # Which command, on which owner, appends to which entity list — so a
+        # successful dispatch can predict the identity the element it just
+        # added landed on. Entity#identified_by is filled by `Array(current).size + 1`
         # (CommandInterpreter#entity_element) when the append's own field
         # mapping doesn't already assign it — the common case, predicted here.
         # A domain whose append explicitly assigns identity through a mapped
-        # argument is covered too, without guessing: whatever value THIS
-        # generator supplied for that argument at dispatch time IS the
+        # argument is covered too, without guessing: whatever value this
+        # generator supplied for that argument at dispatch time is the
         # identity, and gets recorded directly (see `record_outcome`).
+        #
+        # `owner_chain:` — `[]` for an aggregate-level append (`Board.AddList`,
+        # `Folder.AddSlip`), the entity path for an entity-level one
+        # (`Board.AddCard` appending into `Board.cards`, owner_chain
+        # `[Board]`) — so `record_outcome` can key the appended element
+        # under the exact parent-plus-hops it landed beneath.
+        # `identity_arguments:` — every identity head the mapping sources
+        # from a command argument (a composite entity identity has several),
+        # what the adversarial duplicate-identity mutation replays;
+        # `identity_argument:` stays the single-head reading the existing
+        # auto-mint prediction already keys on.
         def populators(runtime)
           runtime.registry.bluebooks.each_value.flat_map do |bluebook|
             bluebook.aggregates.flat_map do |aggregate|
-              aggregate.commands.filter_map do |command|
-                append = command.mutations.find { |mutation| mutation.op == :append }
-                next unless append
-
-                list_attribute = aggregate.attribute(append.target)
-                next unless list_attribute&.list?
-
-                entity = aggregate.entities.find { |candidate| candidate.hecks_name == list_attribute.type.to_s }
-                next unless entity
+              owners = [[aggregate, []]]
+              each_entity_chain(aggregate) { |chain| owners << [chain.last, chain] }
 
-                identity_field = entity.identified_by
-                mapped = identity_field && append.source[identity_field]
-                { command: command, aggregate: aggregate, entity: entity,
-                  identity_field: identity_field, identity_argument: mapped.is_a?(Symbol) ? mapped : nil }
+              owners.flat_map do |owner, chain|
+                owner.commands.filter_map { |command| populator_for(aggregate, owner, chain, command) }
               end
             end
           end
         end
+
+        def populator_for(aggregate, owner, chain, command)
+          append = command.mutations.find { |mutation| mutation.op == :append }
+          return unless append
+
+          list_attribute = owner.attribute(append.target)
+          return unless list_attribute&.list?
+
+          entity = owner.entities.find { |candidate| candidate.hecks_name == list_attribute.type.to_s }
+          return unless entity
+
+          identity_field = entity.identified_by
+          mapped = identity_field && append.source[identity_field]
+          identity_arguments = entity.identity_heads.filter_map do |head|
+            source = append.source[head]
+            source if source.is_a?(Symbol)
+          end
+          { command: command, aggregate: aggregate, owner: owner, owner_chain: chain, entity: entity,
+            identity_field: identity_field, identity_argument: mapped.is_a?(Symbol) ? mapped : nil,
+            identity_arguments: identity_arguments }
+        end
       end
     end
   end

data/lib/hecks/fuzzing/sequence_generator/outcome_tracker.rb

@@ -15,11 +15,12 @@ module Hecks
           parent_scalar = identity_scalar_of(aggregate, args)
 
           @known_ids[aggregate.hecks_name] << parent_scalar if entry[:entity].nil? && entry[:command].creates?
+          record_grant(args) if catalog[:grant_verbs].include?(entry[:verb])
 
-          populator = catalog[:populators].find { |p| p[:command].equal?(entry[:command]) && p[:aggregate].equal?(aggregate) }
+          populator = populator_for_entry(catalog, entry)
           return unless populator
 
-          key = "#{aggregate.hecks_name}.#{populator[:entity].hecks_name}##{parent_scalar}"
+          key = append_pool_key(populator, args)
 
           # The auto-minted case (CommandInterpreter#entity_element): the
           # element just landed at count-so-far + 1. The explicit case: this
@@ -33,20 +34,66 @@ module Hecks
               (@entity_known_ids[key].size + 1).to_s
             end
           @entity_known_ids[key] << new_id
+
+          # The caller-supplied identity tuple, kept whole — every mapped
+          # identity argument and the exact value this step offered for it
+          # — so the adversarial duplicate-identity mutation (BUG#13's own
+          # shape, `Folder.AddSlip` twice under the same `reference`) can
+          # offer it again later against the same parent, composite
+          # identities included (BUG#13's fix explicitly did not cover
+          # those; this is how a sequence gets to ask).
+          return if populator[:identity_arguments].empty?
+
+          @appended_identities[key] << populator[:identity_arguments].to_h { |name| [name.to_s, args[name.to_s]] }
+        end
+
+        # A grant this sequence made for real — the authorization provider's
+        # declared `grant:` verb (`Governance::RoleAssignment.Assign` in
+        # every boot today) succeeded with these exact args, so `actor_id` now holds
+        # `role_name` in this boot's own store, on both replay sides. The
+        # `actor_known` caller shape (adversary.rb) replays that identity
+        # against a command gated on the same role: the one way a
+        # generated step reaches `holds_role?`'s authorized branch rather
+        # than only its refusing one.
+        def record_grant(args)
+          role  = ValueGenerator.scalar_of(args["role_name"]).to_s
+          actor = ValueGenerator.scalar_of(args["actor_id"]).to_s
+          @granted[role] << actor unless role.empty? || actor.empty?
+        end
+
+        # The pool an appended element lands in — the aggregate's own
+        # identity, then one scalar per owning hop (an aggregate-level
+        # append has none; `Board.AddCard` has `Board`'s own `number`,
+        # read straight back off the args this step addressed it by).
+        def append_pool_key(populator, args)
+          parent_scalar = identity_scalar_of(populator[:aggregate], args)
+          owner_scalars = populator[:owner_chain].map do |piece|
+            ValueGenerator.scalar_of(args[(piece.identified_by || :id).to_s])
+          end
+          entity_pool_key(populator[:aggregate].hecks_name,
+                          populator[:owner_chain].map(&:hecks_name) + [populator[:entity].hecks_name],
+                          [parent_scalar] + owner_scalars)
+        end
+
+        # `"Agg.Board#w1"` for a depth-1 pool — byte-identical to the key
+        # this always used, so nothing a pinned seed draws from moves —
+        # and `"Agg.Board.Card#w1/1"` one hop deeper.
+        def entity_pool_key(aggregate_name, chain_names, scalars)
+          "#{aggregate_name}.#{chain_names.join('.')}##{scalars.join('/')}"
         end
 
-        # THE SCALAR THIS STEP'S OWN AGGREGATE IDENTITY RESOLVES TO, from the
+        # The scalar this step's own aggregate identity resolves to, from the
         # args a creating (or entity-populating) command actually
-        # dispatched — a SINGLE declared head (or the untyped default
+        # dispatched — a single declared head (or the untyped default
         # `:id`) reads straight off its own top-level arg the way this
         # always has (`ValueGenerator.scalar_of`, opening the identity value
-        # object). A genuinely COMPOSITE identity (`composite_identity?`,
+        # object). A genuinely composite identity (`composite_identity?`,
         # shared with StepBuilder#add_identity! — see its own comment) has
         # no such top-level arg at all: `add_identity!` deliberately leaves
         # a composite creating command's own individually-declared fields
         # alone rather than forcing a synthetic `id` neither the bluebook
         # nor the command ever declared, so this joins those fields itself,
-        # in the SAME declaration order `Runtime::Identity.of` joins them
+        # in the same declaration order `Runtime::Identity.of` joins them
         # at dispatch (`Naming.identity`, `Naming::IDENTITY_JOIN`) — which
         # is exactly what makes the result usable later as the bare `id:`
         # a composite Revoke/act-again command expects (`Identity.from`'s
@@ -68,8 +115,8 @@ module Hecks
           pool.sample(random: @random)
         end
 
-        def pick_entity_known(aggregate_name, entity_name, parent_id)
-          pool = @entity_known_ids["#{aggregate_name}.#{entity_name}##{parent_id}"]
+        def pick_entity_known(key)
+          pool = @entity_known_ids[key]
           return ValueGenerator.random_id(@random) if pool.empty? || @random.rand < ValueGenerator::INVALID_REFERENCE_PROBABILITY
 
           pool.sample(random: @random)

data/lib/hecks/fuzzing/sequence_generator/picker.rb

@@ -1,8 +1,8 @@
 module Hecks
   module Fuzzing
     class SequenceGenerator
-      # Which step to try next: eligibility (what is POSSIBLE from the
-      # state so far) and weighting (what is LIKELY to reach somewhere
+      # Which step to try next: eligibility (what is possible from the
+      # state so far) and weighting (what is likely to reach somewhere
       # new).
       module Picker
         private
@@ -16,15 +16,26 @@ module Hecks
 
           makers = catalog[:creating].select { |entry| satisfiable?(catalog, entry) }
           pool   = rest + makers.flat_map { |entry| [entry] * creating_weight(rest.size) }
+          pool  += deep_entity_bias(rest) if adversarial?
 
           steer(pool).sample(random: @random)
         end
 
-        # WHILE THERE IS NOTHING TO FIND, MAKING SOMETHING IS THE ONLY USEFUL MOVE.
+        # BUG#11's own preference (adversary.rb) — an entity command two
+        # or more hops deep is weighted up the same way an unexercised
+        # verb is, only in adversarial mode: the eligibility rules above
+        # still decide what is possible, and a default-mode pool is
+        # exactly the pool it always was.
+        def deep_entity_bias(rest)
+          deep = rest.select { |entry| (entry[:chain] || []).size >= Adversary::DEEP_ENTITY_DEPTH }
+          deep * Adversary::DEEP_ENTITY_WEIGHT
+        end
+
+        # While there is nothing to find, making something is the only useful move.
         #
         # A flat weight is right once the domain has records in it, and badly
         # wrong before: banking declares ten queries, and from an empty store
-        # exactly ONE creating command is satisfiable — Customer.Register, the
+        # exactly one creating command is satisfiable — Customer.Register, the
         # verb the whole cascade waits on. Two entries against ten left runs
         # spending their entire budget querying a store nothing had been written
         # to ; one seed answered ten empty queries in a row and emitted nothing
@@ -43,9 +54,9 @@ module Hecks
           @known_ids[entry[:aggregate].hecks_name].any? && satisfiable?(catalog, entry)
         end
 
-        # A ROOTLESS report (no `reference_to` at all) has nothing to wait
+        # A rootless report (no `reference_to` at all) has nothing to wait
         # for — it reads whole tables, the same "always eligible" position
-        # `catalog[:queries]` itself takes. A ROOTED one needs a real
+        # `catalog[:queries]` itself takes. A rooted one needs a real
         # instance of its own `reference_target` to ask about first, same
         # rule `actionable?` already gives an instance command — asking
         # `Banking.disputed_payment_count` before any Account exists would
@@ -55,7 +66,7 @@ module Hecks
           entry[:model].reference_target.nil? || @known_ids[entry[:model].reference_target].any?
         end
 
-        # A COMMAND THAT REFERENCES NOTHING THAT EXISTS CANNOT SUCCEED, so it is
+        # A command that references nothing that exists cannot succeed, so it is
         # not offered until something does.
         #
         # `ValueGenerator.reference_value` has no real id to hand over when its
@@ -67,7 +78,7 @@ module Hecks
         # spent its whole budget being refused.
         #
         # This is the rule instance commands already follow — `known_ids.any?` —
-        # applied to what a command REFERENCES rather than to what it acts on.
+        # applied to what a command references rather than to what it acts on.
         # A target no creating command in this corpus can make (a cross-domain
         # reference, which `CommandRules#resolve_references` skips anyway) is
         # exempt, or the whole domain would starve waiting for it.
@@ -81,14 +92,23 @@ module Hecks
         # Coverage-guided rather than uniformly random : a verb this sequence has
         # not dispatched yet is weighted up, so a run spends its budget on the
         # commands it has not reached instead of re-rolling the ones it has. The
-        # eligibility rules above still decide what is POSSIBLE — this only decides
+        # eligibility rules above still decide what is possible — this only decides
         # what is likely, so a verb gated behind state it does not have yet stays
         # out of the pool entirely rather than being preferred forever.
         def steer(pool)
           fresh = pool.reject { |entry| @exercised.include?(entry[:verb]) }
-          return pool if fresh.empty?
+          steered = fresh.empty? ? pool : pool + (fresh * UNEXERCISED_WEIGHT)
+          favor(steered)
+        end
+
+        # `favor:` (CoverageCampaign's rare verbs) — weighted up when
+        # eligible, never made eligible. An empty favor list returns the
+        # pool untouched, so an unguided seed draws exactly what it did.
+        def favor(pool)
+          return pool if @favor.empty?
 
-          pool + (fresh * UNEXERCISED_WEIGHT)
+          favored = pool.uniq.select { |entry| @favor.include?(entry[:verb]) }
+          pool + (favored * SequenceGenerator::FAVOR_WEIGHT)
         end
       end
     end

data/lib/hecks/fuzzing/sequence_generator/step_builder.rb

@@ -20,17 +20,17 @@ module Hecks
           { "query" => entry[:verb], "args" => args }
         end
 
-        # A REPORT ASK — the bare domain form `entry[:verb]` already carries
+        # A report ask — the bare domain form `entry[:verb]` already carries
         # ("Domain.report_name", no "::"), so `Dispatcher#query` routes it
         # to the read model rather than an aggregate query. A `ReadModel`
         # has no declared `.attributes` the way a `Query` does — its own
-        # argument surface is exactly ONE key, `reference_name`, and ONLY
+        # argument surface is exactly one key, `reference_name`, and only
         # for a rooted model (`read_model_actionable?` already gated a
         # rootless one straight into eligibility with nothing to supply).
-        # A BARE scalar, not `identity_shaped` — `ReadModelInterpreter#
-        # refuse_object_reference` explicitly REJECTS a Hash/Value offered
+        # A bare scalar, not `identity_shaped` — `ReadModelInterpreter#
+        # refuse_object_reference` explicitly rejects a Hash/Value offered
         # here (this is the one place in the whole generator where the
-        # subject's own identity must NOT be wrapped the way a command
+        # subject's own identity must not be wrapped the way a command
         # argument's would be).
         def build_read_model_step(runtime, entry)
           model = entry[:model]
@@ -40,21 +40,72 @@ module Hecks
           { "query" => entry[:verb], "args" => args }
         end
 
+        # The adversarial layer sits here, and only here — after the step's
+        # arguments and identity are fully built, before the one real
+        # dispatch this generator makes to learn what the step did, and
+        # before the step is returned as corpus data. That ordering is
+        # the whole contract: the mutated `args` are what this generator's
+        # own inline dispatch sees (so `known_ids` tracking reflects what
+        # actually happened), and they are the bytes `Fuzzing::Replay`
+        # later hands Ruby's runtime and the bytes `JSON.generate({steps:
+        # ...})` hands the compiled Rust binary — one step, one payload,
+        # both engines. Nothing downstream of this method can tell a
+        # mutated step from an ordinary one except by reading the
+        # `"adversarial"` metadata it carries (see adversary.rb).
+        #
+        # Two more draws sit right after the mutation, in a fixed order —
+        # a caller (`caller_draw!`, adversary.rb: `role:`/`actor_id:` on
+        # the step, bound around this one dispatch exactly the way
+        # `Fuzzing::Replay` and `kernel/cli.rs` will later bind it) and
+        # then the dry-run coin (`{"dry_run": verb}` instead of
+        # `{"verb": verb}` — `Dispatcher#dry_run?` here, the same door on
+        # both replay sides). Order matters for the seed contract: every
+        # draw comes from the one `Random.new(seed)`, so the sequence of
+        # draws per step is what makes a seed reproducible. Both are
+        # off by default and draw nothing when off.
         def build_command_step(runtime, catalog, entry)
           args = args_for(entry[:command].attributes, entry[:aggregate])
           add_identity!(args, entry)
+          steer_grant!(args, entry, catalog)
+          mutations = adversarial_mutations!(args, entry, catalog)
+          caller, caller_note = caller_draw!(entry, catalog)
+          mutations << caller_note if caller_note
+          @state_before = state_before(runtime, entry, args)
 
-          outcome = safe_call { runtime.dispatch(entry[:verb], **symbolize(args)) }
-          if outcome
-            record_outcome(catalog, entry, args)
-            @event_count += outcome.events.length
-          end
-          { "verb" => entry[:verb], "args" => args }
+          step =
+            if dry_run_draw?
+              safe_call { as_caller(caller) { runtime.dry_run?(entry[:verb], **symbolize(args)) } }
+              { "dry_run" => entry[:verb], "args" => args }
+            else
+              outcome = safe_call { as_caller(caller) { runtime.dispatch_flat(entry[:verb], symbolize(args)) } }
+              if outcome
+                record_outcome(catalog, entry, args)
+                @event_count += outcome.events.length
+              end
+              { "verb" => entry[:verb], "args" => args }
+            end
+          step.merge!(caller) if caller
+          step["adversarial"] = mutations unless mutations.empty?
+          step
+        end
+
+        # No RNG draw at all when the fraction is zero — the same "off is
+        # byte-identical" contract `adversarial?` keeps.
+        def dry_run_draw? = @dry_run.positive? && @random.rand < @dry_run
+
+        # `Hecks.as_caller` for exactly this block, or a bare yield — the
+        # same binding `Fuzzing::Replay` makes from the step's own keys
+        # later, so the generator's inline dispatch and both replays see
+        # one caller.
+        def as_caller(caller, &)
+          return yield unless caller
+
+          Hecks.as_caller(role: caller["role"], actor_id: caller["actor_id"], &)
         end
 
         def args_for(attributes, aggregate)
           args = attributes.each_with_object({}) do |attribute, built|
-            # AN OPTIONAL ARGUMENT IS SOMETIMES NOT GIVEN, and that is an
+            # An optional argument is sometimes not given, and that is an
             # ordinary payload rather than a damaged one — see
             # OPTIONAL_OMITTED_PROBABILITY for why this cannot live in
             # `malform` below and what it was costing while it did not
@@ -63,13 +114,13 @@ module Hecks
 
             if attribute.list?
               value = list_value_for(attribute, aggregate)
-              # A list-of-ENTITY command attribute has no real example
+              # A list-of-entity command attribute has no real example
               # anywhere in this repo's domains — every entity-owned list is
               # populated via a per-element append command instead, never a
               # whole-list command argument — so `list_value_for` (below)
               # answers `nil` for one rather than guessing at an entity's own
               # shape, and this step still skips it exactly as it always
-              # has. A list-of-VALUE-OBJECT attribute (`ConsoleSettings::
+              # has. A list-of-value-object attribute (`ConsoleSettings::
               # Collection.ReplaceColumns`' own `columns`, `list_of(Column)`)
               # is the real, previously-unfuzzable case this now covers —
               # `sets :columns` imports the owner aggregate's own declared
@@ -87,9 +138,9 @@ module Hecks
           malform(args, attributes, aggregate)
         end
 
-        # A `list_of` ATTRIBUTE'S OWN VALUE — an array of independently
+        # A `list_of` attribute's own value — an array of independently
         # generated elements, each shaped exactly the way a bare (non-list)
-        # attribute of the SAME declared element type already is
+        # attribute of the same declared element type already is
         # (`ValueGenerator.value_for`), since `list_of(X)`'s own element
         # coercion is `X`'s ordinary shape repeated, not a different one
         # (`Attribute#type` is already unwrapped from `list_of(...)` at
@@ -107,12 +158,12 @@ module Hecks
           Array.new(@random.rand(0..3)) { ValueGenerator.value_for(attribute, aggregate, random: @random, known_ids: @known_ids) }
         end
 
-        # ONE MALFORMATION AT A TIME, and usually none. A step whose payload is
+        # One malformation at a time, and usually none. A step whose payload is
         # wrong in three ways only ever proves which check runs first ; wrong in
         # exactly one way names the check that fired. And the rate stays low on
         # purpose — a corrupted step is almost always refused, a sequence of
         # refusals reaches no state at all, and bin/fuzz already counts those as
-        # SILENT rather than scoring them.
+        # silent rather than scoring them.
         def malform(args, attributes, aggregate)
           return args if args.empty? || @random.rand >= MALFORMED_ARGUMENT_PROBABILITY
 
@@ -123,12 +174,12 @@ module Hecks
           end
         end
 
-        # NEVER THE IDENTITY. A creating command with no id auto-mints one, and
+        # Never the identity. A creating command with no id auto-mints one, and
         # a minted id is deliberately unreproducible — a random hex, never a
         # guessable counter — so dropping it manufactures a step whose outcome
         # cannot be replayed and says nothing about the runtime's behaviour.
         # Every step in the hand-written corpus
-        # supplies an id for the same reason. Whether an auto-minted id OUGHT to
+        # supplies an id for the same reason. Whether an auto-minted id ought to
         # be reproducible is a real question, but it is not one a payload fuzzer
         # can ask.
         def drop_one(args, aggregate)
@@ -154,23 +205,37 @@ module Hecks
           if entry[:entity]
             parent_scalar = pick_known(aggregate.hecks_name)
             args[parent_key] = identity_shaped(aggregate, aggregate.identified_by, parent_scalar, aggregate)
-            entity_key = (entry[:entity].identified_by || :id).to_s
-            entity_scalar = pick_entity_known(aggregate.hecks_name, entry[:entity].hecks_name, parent_scalar)
-            args[entity_key] = identity_shaped(entry[:entity], entry[:entity].identified_by, entity_scalar, aggregate)
+            # One identity per hop, each drawn from the pool its own
+            # parent-plus-hops landed elements in (`entity_pool_key`) —
+            # a depth-1 chain draws exactly what it always did; a
+            # `Board.Card` chain draws a Board under this Workspace, then
+            # a Card under that Board. Flat args, one head per hop, is
+            # the legacy addressing `EntityElement#locate_chain` reads
+            # (`args[head]` per identity path); the routed `to: {
+            # aggregate:, entities: [...] }` spelling is an adversarial
+            # shape layered on top (adversary.rb), never the default.
+            scalars = [parent_scalar]
+            names   = []
+            entry[:chain].each do |piece|
+              names << piece.hecks_name
+              scalar = pick_entity_known(entity_pool_key(aggregate.hecks_name, names, scalars))
+              args[(piece.identified_by || :id).to_s] = identity_shaped(piece, piece.identified_by, scalar, aggregate)
+              scalars << scalar
+            end
           elsif entry[:command].creates?
-            # A COMPOSITE IDENTITY (`identified_by` answering nil with MORE
-            # THAN ONE declared path — Behaviour::Identified's own "a
+            # A composite identity (`identified_by` answering nil with more
+            # than one declared path — Behaviour::Identified's own "a
             # composite has no single head" comment) supplies every one of
             # its parts as its own ordinary, individually-declared command
             # attribute already — `RoleAssignment::Assign` takes actor_id/
             # role_name/starts_at directly, `args_for` (above) already
             # generated all three. Forcing a synthetic top-level `id` here
-            # too — this codebase's own fallback for the SINGLE-key and the
+            # too — this codebase's own fallback for the single-key and the
             # genuinely untyped (`identity_paths.empty?`, no `identified_by`
             # declared at all) cases — hands a composite creating command
             # an argument it never declared at all, refused every time as
             # unknown before this check existed (a creating `Assign`/`Grant`
-            # step was never anything BUT refused). `identity_paths.empty?`
+            # step was never anything but refused). `identity_paths.empty?`
             # is the untyped default (falls all the way back to a minted
             # `:id` the runtime itself never declared as an attribute
             # either), which still needs exactly the old minting behavior.
@@ -184,9 +249,9 @@ module Hecks
           end
         end
 
-        # TRUE ONLY FOR A GENUINE MULTI-FIELD IDENTITY — `identified_by`
+        # True only for a genuine multi-field identity — `identified_by`
         # returns nil both for a real composite (`identity_paths.size > 1`)
-        # and for the untyped default with NO identity declared at all
+        # and for the untyped default with no identity declared at all
         # (`identity_paths.size == 0`, Behaviour::Identified's own
         # `Array(@identified_by)` fallback) ; only the first of those two
         # has its own parts already sitting in `args` as real, individually-
@@ -230,7 +295,7 @@ module Hecks
 
         # A step the runtime declines is not a generator failure — it simply did
         # not take effect, so nothing is recorded and the sequence carries on. The
-        # step still goes into the corpus, because a REFUSAL IS AN ANSWER, and
+        # step still goes into the corpus, because a refusal is an answer, and
         # its wording is pinned by the corpus.
         #
         # EvaluationError sits alongside the declared refusals deliberately : a
@@ -241,10 +306,36 @@ module Hecks
         # generator built a step that breaks the interpreter for reasons that have
         # nothing to do with the domain declining a payload.
         def safe_call
-          yield
-        rescue *Hecks::Runtime::DOMAIN_REFUSALS, Hecks::Bluebook::Expression::EvaluationError
+          result = yield
+          @last_outcome = "ok"
+          result
+        rescue *Hecks::Runtime::DOMAIN_REFUSALS, Hecks::Bluebook::Expression::EvaluationError => e
+          @last_outcome = e.class.name.split("::").last
           nil
         end
+
+        # Where the addressed aggregate stood just before this dispatch — its
+        # lifecycle value, or `exists`/`absent` when it declares none. Read
+        # straight off the repository, never through dispatch, and draws
+        # nothing from the RNG, so it changes no generated byte. An identity
+        # an adversarial mutation mangled past resolving is `?`.
+        def state_before(runtime, entry, args)
+          aggregate = entry[:aggregate]
+          symbolic  = symbolize(args)
+          id = Runtime::Identity.of(aggregate, symbolic) || Runtime::Identity.from(aggregate, symbolic, :id)
+          return "absent" unless id
+
+          record = runtime.registry.repository(entry[:verb].split("::").first, aggregate).find(id)
+          return "absent" unless record
+
+          lifecycle = aggregate.lifecycle
+          return "exists" unless lifecycle
+
+          key = record.state.key?(lifecycle.field) ? lifecycle.field : lifecycle.field.to_s
+          record.state[key].to_s
+        rescue StandardError
+          "?"
+        end
       end
     end
   end