hecks 1.2.0 → 1.4.0

data/lib/hecks/fuzzing/sequence_generator.rb

@@ -7,6 +7,7 @@ require_relative "sequence_generator/catalog"
 require_relative "sequence_generator/picker"
 require_relative "sequence_generator/step_builder"
 require_relative "sequence_generator/outcome_tracker"
+require_relative "sequence_generator/adversary"
 
 module Hecks
   module Fuzzing
@@ -14,13 +15,13 @@ module Hecks
     # `{name, note, steps}` shape `spec/corpus/*.json` already uses — so a
     # generated sequence replays as a corpus member, completely unchanged.
     # Boots a throwaway copy of
-    # the domain and DISPATCHES each candidate step for real as it builds the
+    # the domain and dispatches each candidate step for real as it builds the
     # sequence (not just synthesizing plausible-looking JSON) : the only way to
     # know whether a step actually reached a new state, or which id an
     # auto-minted entity landed on, is to run it and watch what happened.
     #
     # Single-call fuzzing mostly misses the bugs this project has actually
-    # found — they needed STATE first (a saga leg acting on a transfer that
+    # found — they needed state first (a saga leg acting on a transfer that
     # already exists, a reference pointing at a customer already registered).
     # So this tracks what it has created as it goes, the same way
     # spec/banking_state_machine_spec.rb's hand-written generator does, and
@@ -28,13 +29,16 @@ module Hecks
     #
     # One concern per file beside this one: what the domain offers
     # (sequence_generator/catalog.rb), which step to try next (picker.rb),
-    # how a step is built and dispatched (step_builder.rb), and what a
-    # success taught us (outcome_tracker.rb).
+    # how a step is built and dispatched (step_builder.rb), what a
+    # success taught us (outcome_tracker.rb), and — opt-in, `adversarial:`
+    # — the argument shapes real Ruby/Rust divergences were found through
+    # (adversary.rb).
     class SequenceGenerator
       include Catalog
       include Picker
       include StepBuilder
       include OutcomeTracker
+      include Adversary
 
       # Creating commands are always eligible ; weighting them heavier (not
       # exclusively — a domain with only one or two aggregates would starve
@@ -43,18 +47,18 @@ module Hecks
       CREATING_WEIGHT = 2
 
       # How often a payload is deliberately the wrong shape. Low, because a
-      # refused step reaches no new state and a sequence of them is SILENT.
+      # refused step reaches no new state and a sequence of them is silent.
       MALFORMED_ARGUMENT_PROBABILITY = 0.12
 
-      # HOW OFTEN AN OPTIONAL ARGUMENT IS SIMPLY NOT GIVEN — a fair coin,
+      # How often an optional argument is simply not given — a fair coin,
       # because that is exactly what `optional:` means: present or absent,
       # both legal, neither the interesting case.
       #
-      # This is NOT a malformation and must not be filed as one. `malform`
-      # drops an argument too, but a dropped REQUIRED argument is refused,
-      # a refusal writes no record, and bin/fuzz counts it SILENT — so the
+      # This is not a malformation and must not be filed as one. `malform`
+      # drops an argument too, but a dropped required argument is refused,
+      # a refusal writes no record, and bin/fuzz counts it silent — so the
       # one outcome worth reaching (a stored record carrying a null, then
-      # QUERIED) was unreachable from that path by construction. Until
+      # queried) was unreachable from that path by construction. Until
       # this existed no generated history contained a null at all, which
       # meant `query_answers_match_reference` — the differential that
       # diffs every native adapter against the reference interpreter — had
@@ -68,62 +72,179 @@ module Hecks
       # How strongly an unexercised verb is preferred over one this sequence has
       # already dispatched. Random picking revisits the same handful of verbs and
       # leaves whole commands untouched for a whole run — which is the same
-      # "reached no interesting state" problem the SILENT count reports, seen from
+      # "reached no interesting state" problem the silent count reports, seen from
       # the generating end rather than the scoring end.
       UNEXERCISED_WEIGHT = 4
 
-      def self.generate(domain_path, seed:, steps:, adapter: :memory)
-        new(domain_path, seed: seed, steps: steps, adapter: adapter).call
+      # `adversarial:` — the fraction of generated command steps (0.0..1.0)
+      # that get one deliberately adversarial argument mutation
+      # (adversary.rb — the shapes BUG#7–#16 were found through). `0.0`,
+      # the default, draws nothing extra from the seeded RNG, so a seed's
+      # output is byte-for-byte what it was before the option existed;
+      # any positive value is just as deterministic per seed, since every
+      # choice the mutation makes comes from the same `Random.new(seed)`.
+      #
+      # `role_draw:` / `dry_run:` — two more opt-in fractions with the
+      # identical contract (adversary.rb's `caller_draw!`, step_builder.rb's
+      # `dry_run_draw?`): `0.0` draws nothing, so every pinned seed is
+      # byte-for-byte what it was; `bin/qa_sweep` reads them from
+      # `QualityControlDials::ROLE_DRAW_PROBABILITY`/`DRY_RUN_FRACTION`.
+      #
+      # `prefix:` / `favor:` — the two levers `CoverageCampaign` pulls
+      # (coverage_campaign.rb has the why). `prefix:` is `{ "seed", "steps",
+      # "favor", "prefix" }`: re-generate that seed's first `steps` attempts
+      # (itself recursively prefixed) before this seed's own randomness
+      # starts, so a seed can begin from state an earlier seed reached.
+      # `favor:` names verbs the picker weights up. `nil`/`[]`, the
+      # defaults, draw nothing extra and change nothing: every pinned seed
+      # is byte-for-byte what it was.
+      def self.generate(domain_path, seed:, steps:, **)
+        new(domain_path, seed: seed, steps: steps, **).call
+      end
+
+      # The same generation, with what it reached — `coverage` is
+      # `[[attempt_index, tuple], ...]` (`coverage_tuple`), `verbs` every
+      # verb the booted catalog offered, so a campaign can tell a verb it
+      # never hit from one that does not exist.
+      Trace = Struct.new(:steps, :coverage, :verbs, keyword_init: true)
+
+      def self.trace(domain_path, seed:, steps:, **)
+        generator = new(domain_path, seed: seed, steps: steps, **)
+        Trace.new(steps: generator.call, coverage: generator.coverage, verbs: generator.verbs)
       end
 
-      # How many EVENTS the generated sequence actually produced — not
+      # How strongly a `favor:` verb is preferred when it is eligible —
+      # the same order of magnitude as an unexercised verb, so favor
+      # steers without drowning out what this sequence has not touched.
+      FAVOR_WEIGHT = 4
+
+      attr_reader :coverage, :verbs
+
+      # How many events the generated sequence actually produced — not
       # steps, not successful dispatches, but the sum of every Result#events
       # length across the run. This is the count bin/fuzz declares as the
       # script's own `expectations.events` claim: whatever was achieved
-      # DURING generation becomes the claim a fresh replay of the same
+      # during generation becomes the claim a fresh replay of the same
       # script is held to. Zero means the sequence never
       # reached an interesting state — a fuzzer-effectiveness fact, not a
       # replay one.
       attr_reader :event_count
 
-      def initialize(domain_path, seed:, steps:, adapter: :memory)
-        @domain_path      = domain_path
-        @seed             = seed
-        @step_count       = steps
-        @adapter          = adapter
-        @random           = Random.new(seed)
-        @known_ids        = Hash.new { |h, k| h[k] = [] }
-        @entity_known_ids = Hash.new { |h, k| h[k] = [] }
-        @exercised        = Set.new
-        @event_count      = 0
+      def initialize(domain_path, seed:, steps:, adapter: :memory, adversarial: 0.0, role_draw: 0.0, dry_run: 0.0,
+                     prefix: nil, favor: [])
+        { adversarial: adversarial, role_draw: role_draw, dry_run: dry_run }.each do |name, fraction|
+          next if fraction.is_a?(Numeric) && fraction.between?(0, 1)
+
+          raise ArgumentError, "#{name}: must be a fraction between 0.0 and 1.0, got #{fraction.inspect}"
+        end
+
+        @domain_path         = domain_path
+        @seed                = seed
+        @step_count          = steps
+        @adapter             = adapter
+        @adversarial         = adversarial.to_f
+        @role_draw           = role_draw.to_f
+        @dry_run             = dry_run.to_f
+        @random              = Random.new(seed)
+        @known_ids           = Hash.new { |h, k| h[k] = [] }
+        @entity_known_ids    = Hash.new { |h, k| h[k] = [] }
+        @appended_identities = Hash.new { |h, k| h[k] = [] }
+        # Role => [actor ids] this sequence's own successful
+        # `Governance::RoleAssignment.Assign` steps granted — what the
+        # `actor_known` caller shape draws from (adversary.rb).
+        @granted             = Hash.new { |h, k| h[k] = [] }
+        @precedence_caller   = nil
+        @exercised           = Set.new
+        @event_count         = 0
+        @prefix              = prefix
+        @favor               = Array(favor)
+        @own_favor           = @favor
+        @coverage            = []
+        @verbs               = []
+        @attempt             = 0
       end
 
       def call
         # Real leftover data from ordinary use (bin/console, whatever) lives
         # under the example's data/ — a generator that boots against it
         # starts from state its own known_ids tracking doesn't know about.
-        # IsolatedBoot resets that AND rebinds persistence to Memory, since
+        # IsolatedBoot resets that and rebinds persistence to Memory, since
         # a Postgres-bound domain's real store lives outside the copied
         # directory entirely and `rm_rf`ing data/ alone cannot reach it —
         # see isolated_boot.rb's own header.
         IsolatedBoot.call(@domain_path, adapter: @adapter) do |copy|
           runtime = Hecks.boot(copy)
           catalog = build_catalog(runtime)
-          Array.new(@step_count) { attempt_step(runtime, catalog) }.compact
+          @verbs  = catalog.values_at(:creating, :instance, :entity_commands, :queries, :entity_queries, :read_models)
+                           .flatten.map { |entry| entry[:verb] }.uniq
+
+          steps = []
+          if @prefix
+            realize_prefix(runtime, catalog, @prefix, prefix_limit(@prefix), steps)
+            @random = Random.new(@seed)
+            @favor  = @own_favor
+          end
+          @step_count.times { steps << attempt_step(runtime, catalog) }
+          steps.compact
         end
       end
 
       private
 
+      # A prefix is the first `limit` attempts of another seed's generation,
+      # re-run for real: its own nested prefix first (capped the same way it
+      # was capped when that seed was generated), then that seed's own
+      # `Random.new(seed)` and favor for the rest. Same inputs, same
+      # catalog, same draws — the same steps, and the same known ids and
+      # exercised verbs carried forward into this seed.
+      #
+      # The prefix is on top of this seed's own budget, not out of it. A
+      # spliced seed still makes all `steps` attempts of its own after the
+      # prefix; a prefix is capped at `steps` attempts, so a spliced
+      # sequence is at most twice as long as an unspliced one. Taking the
+      # prefix out of the budget (the first version of this) left a spliced
+      # seed replaying state already seen with almost nothing left to
+      # explore from it — measured: fewer distinct tuples than unguided.
+      def realize_prefix(runtime, catalog, spec, limit, steps)
+        return 0 unless limit.positive?
+
+        inner = spec["prefix"]
+        used  = inner ? realize_prefix(runtime, catalog, inner, [prefix_limit(inner), limit].min, steps) : 0
+        @random = Random.new(Integer(spec.fetch("seed")))
+        @favor  = Array(spec["favor"])
+        (limit - used).times { steps << attempt_step(runtime, catalog) }
+        limit
+      end
+
+      def prefix_limit(spec) = Integer(spec.fetch("steps")).clamp(0, @step_count)
+
       def attempt_step(runtime, catalog)
+        index = @attempt
+        @attempt += 1
         entry = pick(catalog)
         return nil unless entry
 
         @exercised << entry[:verb]
-        if entry[:query]      then build_query_step(runtime, entry)
-        elsif entry[:model]   then build_read_model_step(runtime, entry)
-        else                       build_command_step(runtime, catalog, entry)
-        end
+        @state_before = "-"
+        step =
+          if entry[:query]    then build_query_step(runtime, entry)
+          elsif entry[:model] then build_read_model_step(runtime, entry)
+          else                     build_command_step(runtime, catalog, entry)
+          end
+        @coverage << [index, coverage_tuple(entry, step)]
+        step
+      end
+
+      # `verb | kind | state before | mutation | outcome` — see
+      # CoverageCampaign's header for why the unit is this and not the
+      # verb. `state` is the addressed aggregate's lifecycle value (or
+      # `exists`/`absent` for one without a lifecycle) read just before
+      # dispatch; `mutation` names every adversarial mutation and its shape;
+      # `outcome` is `ok` or the refusal class `safe_call` rescued.
+      def coverage_tuple(entry, step)
+        kind     = %w[verb query dry_run].find { |key| step.key?(key) }
+        mutation = Array(step["adversarial"]).map { |m| [m["mutation"], m["shape"]].compact.join(":") }.join("+")
+        [entry[:verb], kind, @state_before, mutation.empty? ? "-" : mutation, @last_outcome].join(" | ")
       end
     end
   end

data/lib/hecks/fuzzing/shrinker.rb

@@ -0,0 +1,197 @@
+module Hecks
+  module Fuzzing
+    # A failing step list, made small enough to read.
+    #
+    # `bin/fuzz` always shrank its findings; `bin/qa_sweep` — the loop that
+    # actually finds the bugs — never did, so the ledger filled with
+    # demonstrations like "seed 25, 25 steps, step 16" and a human cut
+    # BUG#40 down to its four real steps by hand. This is `bin/fuzz`'s
+    # shrinker lifted out of that script so both callers share it, and
+    # made cheaper at the same time: a sweep's candidate check can cost a
+    # Rust subprocess (or a real Postgres round trip), where `bin/fuzz`'s
+    # only ever cost an in-process replay.
+    #
+    # The caller owns "same finding". `call` is handed a block that
+    # answers true when a candidate step list still reproduces what the
+    # original did — `bin/fuzz` compares its own verdict signature,
+    # `bin/qa_sweep` compares `Shrinker.signature` of one mode's
+    # divergences. This module never replays anything itself, so it has
+    # no idea which engine, adapter or comparison it is minimizing for.
+    #
+    # **Two passes, in order**:
+    #
+    #   1. Steps, chunks first. Removing one step at a time (what
+    #      `bin/fuzz` did) costs O(n²) candidate checks on a sequence
+    #      where most steps are irrelevant. Delta-debugging style: try
+    #      removing halves, then quarters, … then single steps, keeping
+    #      any removal that still reproduces; a single-step pass repeats
+    #      until it changes nothing, so the result is 1-minimal (no one
+    #      remaining step can be dropped).
+    #   2. Arguments, inside each surviving step. Unchanged from `bin/fuzz`
+    #      (spec/bin_fuzz_spec.rb pins its accumulation contract): drop
+    #      one key at a time from the step's current args, keep it dropped
+    #      only while the finding still reproduces.
+    #
+    # A budget, because a sweep has other targets waiting. `budget:` caps
+    # how many candidate checks one call may spend (nil = unbounded, the
+    # `bin/fuzz` behaviour). When it runs out the best candidate found so
+    # far is returned — every accepted candidate reproduced, so a partial
+    # shrink is still a correct, just less small, demonstration.
+    module Shrinker
+      Result = Struct.new(:steps, :attempts, :exhausted, keyword_init: true)
+
+      module_function
+
+      def call(steps, budget: nil, &reproduces)
+        raise ArgumentError, "Shrinker.call needs a block answering whether a candidate reproduces" unless reproduces
+
+        meter   = Meter.new(budget)
+        current = drop_steps(steps.dup, meter, &reproduces)
+        current = drop_arguments(current, meter, &reproduces)
+        Result.new(steps: current, attempts: meter.used, exhausted: meter.exhausted?)
+      end
+
+      def drop_steps(steps, meter, &reproduces)
+        current = steps
+        chunk = [current.length / 2, 1].max
+        loop do
+          changed = false
+          index = 0
+          while index < current.length
+            return current if meter.exhausted?
+
+            candidate = current[0...index] + (current[(index + chunk)..] || [])
+            if candidate.empty?
+              index += chunk
+              next
+            end
+
+            if meter.try { reproduces.call(candidate) }
+              current = candidate
+              changed = true
+            else
+              index += chunk
+            end
+          end
+
+          if chunk > 1
+            chunk = [chunk / 2, 1].max
+          elsif !changed
+            break
+          end
+        end
+        current
+      end
+
+      # See the module header's pass 2 — `args` is read by whichever
+      # spelling the step actually carries (`key?` first, never `||`,
+      # which cannot tell a stored `false` from an absent key).
+      def drop_arguments(steps, meter, &reproduces)
+        steps.each_index do |position|
+          original = args_of(steps[position])
+          next unless original.is_a?(Hash)
+
+          original.each_key do |key|
+            return steps if meter.exhausted?
+
+            step      = steps[position]
+            trimmed   = args_of(step).reject { |name, _| name == key }
+            candidate = steps.map(&:dup)
+            candidate[position] = step.merge("args" => trimmed)
+            steps = candidate if meter.try { reproduces.call(candidate) }
+          end
+        end
+        steps
+      end
+
+      def args_of(step)
+        step.key?("args") ? step["args"] : step[:args]
+      end
+
+      # Which finding this is, as a set of stable strings — the identity a
+      # shrink candidate has to keep. The `field` alone is too loose for
+      # the comparisons that carry lists: "refusals differ" on a 3-step
+      # candidate could be a different refusal split than the one the
+      # original seed found, and a shrinker that accepted it would hand
+      # back a demonstration of the wrong bug. So:
+      #
+      #   refusals/queries/dry_runs/reactions — the field plus every verb
+      #     (or query) named in the symmetric difference of the two sides;
+      #   instances — the field plus the aggregate of every top-level key
+      #     whose two sides disagree (the `#id` suffix dropped);
+      #   a crash/process finding — the field plus the exception class
+      #     leading its detail;
+      #   anything else (a property name, a self-consistency axis) — the
+      #     field, which already names the finding.
+      #
+      # `reproduces?` holds when a candidate's signature contains the
+      # original's: removing steps may add a second divergence, but it
+      # must never lose the one being demonstrated.
+      LIST_FIELDS = %w[refusals queries dry_runs reactions].freeze
+
+      CRASH_FIELDS = %w[crash process generator_crash].freeze
+
+      def signature(divergences)
+        divergences.each_with_object(Set.new) do |divergence, keys|
+          field = divergence[:field].to_s
+          keys << field
+          keys.merge(detail_keys(field, divergence))
+        end
+      end
+
+      def detail_keys(field, divergence)
+        left, right = divergence.except(:field, :detail).values.select { |v| v.is_a?(Array) || v.is_a?(Hash) }
+        if LIST_FIELDS.include?(field) then list_keys(field, left, right)
+        elsif field == "instances"     then instance_keys(left, right)
+        elsif CRASH_FIELDS.include?(field) && divergence[:detail]
+          ["#{field}:#{divergence[:detail].to_s[/\A\w+(?:::\w+)*/]}"]
+        else []
+        end
+      end
+
+      def list_keys(field, left, right)
+        return [] unless left.is_a?(Array) && right.is_a?(Array)
+
+        ((left - right) + (right - left)).map { |row| "#{field}:#{named(row)}" }
+      end
+
+      # Instance keys are `Aggregate#id` on the wire — the id is whatever
+      # the generator minted, so it names the record, not the finding;
+      # keeping it would pin every creating step.
+      def instance_keys(left, right)
+        return [] unless left.is_a?(Hash) && right.is_a?(Hash)
+
+        (left.keys | right.keys).reject { |key| left[key] == right[key] }
+                                .map { |key| "instances:#{key.to_s.split('#').first}" }
+      end
+
+      def reproduces?(original_signature, divergences)
+        !divergences.empty? && original_signature.subset?(signature(divergences))
+      end
+
+      def named(row)
+        return row.to_s unless row.is_a?(Hash)
+
+        key = [%w[verb query policy], %i[verb query policy]].flatten.find { |name| row.key?(name) }
+        (key ? row[key] : row).to_s
+      end
+
+      # Counts candidate checks against the budget.
+      class Meter
+        attr_reader :used
+
+        def initialize(budget)
+          @budget = budget
+          @used   = 0
+        end
+
+        def exhausted? = !@budget.nil? && @used >= @budget
+
+        def try
+          @used += 1
+          yield
+        end
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/structural_skips.rb

@@ -0,0 +1,39 @@
+module Hecks
+  module Fuzzing
+    # What each query verb the differential comparison skipped was hiding.
+    #
+    # `Differential.manifest_partition` drops a named query or read model
+    # from both sides of the Ruby/Rust comparison only when the binary's own
+    # manifest.json declares it `generated: false`. The drop is correct, but
+    # a sweep that dropped every `offset`/`cursor` ask would still read as
+    # "agreed across all steps". `bin/qa_sweep` therefore logs one Check per
+    # sweep naming every skipped verb and the construct family that caused
+    # it, and marks it Surprised when a family is outside
+    # `QualityControlDials::STRUCTURAL_REFUSAL_BOUNDARY`.
+    #
+    # The construct comes straight from the manifest entry, written by the
+    # generator branch that made the skip (`Projector::SkipReason`). This
+    # module used to guess it from the Ruby declaration's `to_h` keys, which
+    # was coarser than codegen's own decision and could drift from it.
+    module StructuralSkips
+      module_function
+
+      # One entry per skipped verb: `{ verb:, constructs: [...] }`, sorted by
+      # verb so the printed observation is stable across seeds and runs. A
+      # verb the manifest doesn't declare answers `unknown`, which no
+      # boundary admits.
+      def attribute(gaps, verbs)
+        verbs.sort.map do |verb|
+          entry = gaps.not_generated(verb)
+          { verb: verb, constructs: entry ? [entry.fetch("construct")] : %w[unknown] }
+        end
+      end
+
+      # Every skipped verb whose constructs are not all inside `boundary`.
+      def outside_boundary(attributed, boundary)
+        admitted = boundary.map(&:to_s)
+        attributed.select { |entry| entry[:constructs].empty? || (entry[:constructs] - admitted).any? }
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/sweep_depth.rb

@@ -0,0 +1,53 @@
+module Hecks
+  module Fuzzing
+    # How hard one sweep fuzzes, as a function of `Target.clean_streak`
+    # (qa/bluebook/quality_control.bluebook — that attribute's own comment
+    # says what the streak means). The sibling of `RotationPriority`: the
+    # ledger holds the number, `QualityControlDials::WIDENING_TIERS` holds
+    # the policy, and this module is where the two meet — a pure function
+    # of both, nothing else read.
+    #
+    # Why this is not in `bin/qa_sweep` any more. It was — `WIDENING_TIERS`
+    # and `widen_for_streak` lived at the top of that script, which meant
+    # policy data lived in a script (unlike every other dial, which lives
+    # in the bluebook a human edits and reviews) and duplicated itself as
+    # prose in SKILL.md. Now the table is a dial, this is the one reader,
+    # and `bin/qa_sweep` calls it the way it already calls
+    # `RotationPriority.pick`.
+    #
+    # **Pure, deliberately** — the same discipline `RotationPriority` keeps:
+    # same streak in, same `[seeds, steps]` out, every time, which is what
+    # lets a human predict what a given sweep is about to do before it
+    # runs one. `tiers:` defaults to the dial but is a plain argument, so
+    # a unit spec can pass its own table with no ledger boot at all and a
+    # `bin/qa_sweep` run against a ledger that declares no dials (an
+    # isolated spec's own fixture) can fall back the same way it already
+    # does for `ADVERSARIAL_FRACTION`.
+    module SweepDepth
+      module_function
+
+      # The fallback table, for a boot with no `QualityControlDials` at all
+      # — the same shape and the same three rows the dial ships with, so a
+      # dial-less ledger fuzzes exactly as a dialled one does by default.
+      # Never read when the dial exists; `bin/qa_sweep` passes the dial in.
+      DEFAULT_TIERS = [
+        { upto: 4,               seeds: 10, steps: 25 },
+        { upto: 19,              seeds: 25, steps: 50 },
+        { upto: Float::INFINITY, seeds: 50, steps: 100 }
+      ].freeze
+
+      # `[seeds, steps]` for one streak. The first row whose `upto` the
+      # streak does not exceed wins — rows are read in order, so the table
+      # must be ascending, and the last row's `Float::INFINITY` is what
+      # makes it the ceiling rather than a gap.
+      def for_streak(streak, tiers: DEFAULT_TIERS)
+        raise ArgumentError, "streak must not be negative" if streak.negative?
+
+        tier = tiers.find { |row| streak <= row[:upto] }
+        raise ArgumentError, "no tier covers a streak of #{streak} — the last row must be upto: Float::INFINITY" unless tier
+
+        [tier[:seeds], tier[:steps]]
+      end
+    end
+  end
+end