hecks 1.3.0 → 1.4.0

data/lib/hecks/ir.rb

@@ -1,19 +1,19 @@
 module Hecks
-  # WHAT A CONSTRUCT EMITS, DECLARED RATHER THAN WRITTEN OUT.
+  # What a construct emits, declared rather than written out.
   #
-  # `IR` is a thing this framework PRODUCES, not a thing its model IS.
+  # `IR` is a thing this framework produces, not a thing its model is.
   # The language self-hosts, and its own bluebook declares aggregates
   # named `Bluebook`, `Aggregate`, `Command`, `Entity`, `ValueObject`,
   # `Policy`, `ReadModel` — there is no `IR` aggregate anywhere in the
   # grammar. Where the grammar's own vision line does say IR it means the
-  # emission: "the IR it STORES must equal the IR the DSL builder
-  # PRODUCES". `IR_VERSION` says the same thing structurally — a version
+  # emission: "the IR it stores must equal the IR the DSL builder
+  # produces". `IR_VERSION` says the same thing structurally — a version
   # stamped on `to_h`'s output rather than on the object is a version of
-  # the EMISSION, which only makes sense if the two are different things.
+  # the emission, which only makes sense if the two are different things.
   #
-  # So emitting IR is a CAPABILITY a construct has, and this is that
+  # So emitting IR is a capability a construct has, and this is that
   # capability: `include Hecks::IR` and declare the shape once.
-  # The model it emits FROM is `Hecks::Bluebook` — a chapter class
+  # The model it emits from is `Hecks::Bluebook` — a chapter class
   # nesting everything a chapter declares. It is deliberately not named
   # after this, its own output.
   #
@@ -36,18 +36,18 @@ module Hecks
   #     canonical_form: -> { CanonicalForm.table } # anything else
   #   )
   #
-  # KEY ORDER IS THE DECLARATION ORDER, and that is load-bearing rather
+  # Key order is the declaration order, and that is load-bearing rather
   # than cosmetic: `spec/golden/ir/*.json` pins the emitted form exactly,
   # so a reordered declaration is a changed artifact and the golden specs
   # will say so.
   module IR
-    # THE TWO SHAPES A CONSTRUCT COMES IN, and why this module has two
+    # The two shapes a construct comes in, and why this module has two
     # doors instead of hiding the difference.
     #
     # `Bluebook`/`Aggregate`/`Policy`/`ReadModel` are ordinary objects —
     # metadata records, one instance per declaration. `Command`/`Entity`/
-    # `ValueObject` are anonymous CLASSES (`Class.new(self)`, see
-    # `Command.declare`), because those three are referenced as TYPES in
+    # `ValueObject` are anonymous classes (`Class.new(self)`, see
+    # `Command.declare`), because those three are referenced as types in
     # a bluebook (`attribute :price, Money`) and a type has to be a real
     # Ruby constant to be named.
     #
@@ -87,7 +87,7 @@ module Hecks
       def one(source)  = One.new(source)
 
       # Walks the superclass chain so a `Class.new(ValueObject)` — which
-      # is what every declared value object actually IS — inherits the
+      # is what every declared value object actually is — inherits the
       # shape its base declared, rather than each anonymous subclass
       # having to redeclare it.
       def ir_spec
@@ -112,7 +112,7 @@ module Hecks
       private
 
       # An instance reads its class's declaration; a class-shaped
-      # construct IS the declaration holder.
+      # construct is the declaration holder.
       def ir_spec_for(construct)
         return construct.ir_spec if construct.respond_to?(:ir_spec)
 

data/lib/hecks/language/bluebook/bluebook.bluebook

@@ -73,6 +73,26 @@ Hecks.bluebook "Bluebook", version: "1" do
     # chapters attach to nothing, and ABSENT IS NOT EMPTY, the same
     # reading `version`/`formerly_known_as` above give.
     attribute :attaches_to, list_of(AttachesToContext)
+    # A CAPABILITY THIS CHAPTER ANSWERS FOR OTHER DOMAINS — declared, so
+    # nothing downstream has to recognise the chapter BY NAME. One row
+    # per (capability, key, verb): `provides "authorization", grant:
+    # "RoleAssignment.Assign"` is the row (authorization, grant,
+    # RoleAssignment.Assign). The runtime's role check, boot's
+    # ungoverned-role refusal, the authorization adapter and the fuzzer
+    # all read the rows rather than the literal "Governance". Most
+    # chapters provide nothing, and ABSENT IS NOT EMPTY, the same reading
+    # `attaches_to` above gives.
+    attribute :provides, list_of(Provision)
+
+    value_object "Provision" do
+      attribute :capability, String
+      attribute :key,        String
+      attribute :verb,       String
+    end
+
+    value_object "ProvisionText" do
+      attribute :value, String
+    end
 
     value_object "RuleText" do
       # deliberately permissive : source_token and replacement are legitimately
@@ -159,6 +179,22 @@ Hecks.bluebook "Bluebook", version: "1" do
       emits ChapterAttached
     end
 
+    # ONE ROW OF ONE CAPABILITY — `provides "authorization", assignments:
+    # ..., grant: ..., transitions: ...` offers three, one per key, in the
+    # order they were written.
+    command "Provide" do
+      role "Language"
+      goal "Declare one verb this chapter answers a capability with"
+
+      attribute :capability, ProvisionText
+      attribute :key,        ProvisionText
+      attribute :verb,       ProvisionText
+
+      sets :provides, append: { capability: :capability, key: :key, verb: :verb }
+
+      emits CapabilityProvided
+    end
+
     # THE WAY BACK.
     #
     # Until these existed the meta-domain was write-only: twelve categories, 34
@@ -214,6 +250,7 @@ Hecks.bluebook "Bluebook", version: "1" do
       member word: "vision", context: "Bluebook", body: "none", inner: "", opens: "", fills: "vision"
       member word: "formerly_known_as", context: "Bluebook", body: "none",   inner: "",               opens: "",               fills: "formerly_known_as"
       member word: "attaches_to",     context: "Bluebook", body: "none",     inner: "",               opens: "",               fills: "attaches_to", calls: "attaches_to_impl"
+      member word: "provides",        context: "Bluebook", body: "none",     inner: "",               opens: "",               fills: "provides", calls: "provides_impl"
       member word: "core",            context: "Bluebook", body: "none",     inner: "",               opens: "",               fills: "classification"
       member word: "supporting",      context: "Bluebook", body: "none",     inner: "",               opens: "",               fills: "classification"
       member word: "generic",         context: "Bluebook", body: "none",     inner: "",               opens: "",               fills: "classification"
@@ -246,6 +283,10 @@ Hecks.bluebook "Bluebook", version: "1" do
       member keyword: "vision",          context: "Bluebook", at: "1", named: "",        kind: "text",     required: "true",  fills: "vision", coerce: "false"
       member keyword: "formerly_known_as", context: "Bluebook", at: "1", named: "",      kind: "text",     required: "true",  fills: "formerly_known_as"
       member keyword: "attaches_to",     context: "Bluebook", at: "1", named: "",        kind: "text",     required: "true",  fills: "attaches_to", variadic: "true"
+      member keyword: "provides",        context: "Bluebook", at: "1", named: "",            kind: "text", required: "true",  fills: "provides"
+      member keyword: "provides",        context: "Bluebook", at: "",  named: "assignments", kind: "text", required: "false", fills: "provides"
+      member keyword: "provides",        context: "Bluebook", at: "",  named: "grant",       kind: "text", required: "false", fills: "provides"
+      member keyword: "provides",        context: "Bluebook", at: "",  named: "transitions", kind: "text", required: "false", fills: "provides"
       member keyword: "aggregate",       context: "Bluebook", at: "1", named: "",        kind: "text",     required: "true",  fills: "name"
       member keyword: "read_model", context: "Bluebook", at: "1", named: "", kind: "text", required: "true", fills: "name"
       member keyword: "policy",          context: "Bluebook", at: "1", named: "",        kind: "text",     required: "true",  fills: "name"

data/lib/hecks/language/bluebook/policy.bluebook

@@ -21,6 +21,13 @@ Hecks.bluebook "Bluebook" do
     attribute :on_event,        PolicyText
     attribute :trigger_command, PolicyText
     attribute :target_domain,   PolicyText
+    # AN `across` TARGET THIS DOMAIN EXPECTS NEVER TO REACH — declared on
+    # the policy that owns the expectation, not held in a core allowlist
+    # keyed by domain name. `ModelCheck` honours it both ways: the
+    # unknown-target and unacknowledged-relationship findings it would
+    # otherwise raise are expected, and a declaration whose target turns
+    # out to be known or acknowledged after all is STALE and fails.
+    attribute :expect_undelivered, PolicyText
     # THE GUARD, CARRIED AS TEXT — same discipline `Command.givens`
     # already holds: the block that wrote it is never called at
     # runtime, only its EXTRACTED SOURCE is (Ports::Extraction), so
@@ -92,6 +99,7 @@ Hecks.bluebook "Bluebook" do
       attribute :on_event,        PolicyText
       attribute :trigger_command, PolicyText
       attribute :target_domain,   PolicyText, optional: true
+      attribute :expect_undelivered, PolicyText, optional: true
       attribute :where,           PolicyText, optional: true
       attribute :for_each,        PolicyText, optional: true
 
@@ -102,6 +110,7 @@ Hecks.bluebook "Bluebook" do
       sets :on_event
       sets :trigger_command
       sets :target_domain
+      sets :expect_undelivered
       sets :where
       sets :for_each
       sets :position
@@ -153,7 +162,7 @@ Hecks.bluebook "Bluebook" do
 
       member word: "on",              context: "Policy",    body: "none", inner: "", opens: "",       fills: "on_event", calls: "on_impl"
       member word: "trigger",         context: "Policy",    body: "none", inner: "", opens: "",       fills: "trigger_command", calls: "trigger_impl"
-      member word: "across",          context: "Policy",    body: "none", inner: "", opens: "",       fills: "target_domain"
+      member word: "across",          context: "Policy",    body: "none", inner: "", opens: "",       fills: "target_domain", calls: "across_impl"
       member word: "where",           context: "Policy",    body: "source", inner: "", opens: "", fills: "where"
       member word: "for_each",        context: "Policy",    body: "none", inner: "", opens: "", fills: "for_each"
 
@@ -181,6 +190,7 @@ Hecks.bluebook "Bluebook" do
       member keyword: "trigger",         context: "Policy", at: "1", named: "", kind: "constant", required: "true", fills: "trigger_command"
       member keyword: "trigger",         context: "Policy", at: "1", named: "", kind: "text",     required: "true", fills: "trigger_command"
       member keyword: "across",          context: "Policy", at: "1", named: "", kind: "text", required: "true", fills: "target_domain"
+      member keyword: "across",          context: "Policy", at: "", named: "expect_undelivered", kind: "flag", required: "false", fills: "expect_undelivered"
       member keyword: "for_each",        context: "Policy", at: "1", named: "", kind: "text", required: "true", fills: "for_each"
       member keyword: "trigger", context: "Policy", at: "", named: "with", kind: "pairs", required: "false", fills: "with_spec", pairs_shape: "verbatim"
 

data/lib/hecks/language/bluebook/vocabulary.bluebook

@@ -2,8 +2,11 @@ Hecks.bluebook "Bluebook" do
   aggregate "Vocabulary" do
     # These are DECLARATIONS, not runtime state — a language's admitted sets are
     # fixed when the language is defined, which is what one_of means. They carry
-    # no commands on purpose : nothing dispatches a vocabulary, the conformance
-    # check READS them from the IR and holds the runtime's hand-typed tables to them.
+    # no commands on purpose : nothing dispatches a vocabulary. They are READ
+    # from the IR and projected — bin/project_vocabulary writes the Ruby tables
+    # (lib/hecks/vocabulary.rb) the runtime's constants read, and
+    # bin/project_rust_vocabulary writes rust/src/kernel/vocab/ — so the
+    # runtimes carry no hand-typed copies to drift.
     #
     # Every one of these is a set the runtime must agree with, and every one has
     # already drifted or leaked at least once :
@@ -171,9 +174,17 @@ Hecks.bluebook "Bluebook" do
     # fires for a creating command, advance_lifecycle only when a transition
     # applies — so this is the order a command that does both follows,
     # confirmed by tracing a real dispatch, not read off the source.
+    #
+    # decode_arguments leads both dispatch orders: turning the caller's raw
+    # facts into a command's declared arguments, before any argument gate
+    # judges them. A no-op in Ruby today (routing already hands the
+    # interpreter a decoded hash) and in the Rust kernel's dispatch loop
+    # (generated `from_json` still decodes and gates in one pass) — declared
+    # now so the Rust kernel's step enum has a place for a generated decoder
+    # to move into, rather than the order being implied by generated code.
     value_object "AggregateDispatchOrder" do
       attribute :step, String,
-                one_of: ["refuse_unknown_arguments", "refuse_absent_arguments", "normalize_args",
+                one_of: ["decode_arguments", "refuse_unknown_arguments", "refuse_absent_arguments", "normalize_args",
                          "refuse_role_mismatch", "resolve_references", "hydrate", "enforce_givens",
                          "admissible_transition", "assign_creation_attributes", "apply_mutations",
                          "advance_lifecycle", "delegate_to_entity", "enforce_ensures", "enforce_invariants",
@@ -197,7 +208,7 @@ Hecks.bluebook "Bluebook" do
     # both interpreters), even though nothing in the real corpus does yet.
     value_object "EntityDispatchOrder" do
       attribute :step, String,
-                one_of: ["refuse_unknown_arguments", "refuse_absent_arguments", "normalize_args",
+                one_of: ["decode_arguments", "refuse_unknown_arguments", "refuse_absent_arguments", "normalize_args",
                          "refuse_role_mismatch", "resolve_references", "hydrate_parent",
                          "locate_element", "enforce_givens", "admissible_transition", "apply_mutations",
                          "advance_lifecycle", "enforce_ensures", "enforce_invariants", "save", "emit"]
@@ -219,11 +230,10 @@ Hecks.bluebook "Bluebook" do
     # declared them. Everything here is different in kind: a LANGUAGE-LEVEL
     # refusal, the same wording for every domain, not authored per-bluebook —
     # closer to Comparison/SignTest beside it than to a given. So it follows
-    # THEIR pattern, not given's: declared here for a human to read and a
-    # conformance spec to hold equal, and a hand-typed table
-    # (RefusalWording) is what a dispatch
-    # actually reads — the same reason Evaluator::SIGN_TEST_OPERATORS is
-    # hand-typed rather than read live off this very chapter at every call.
+    # THEIR pattern, not given's: declared here, and projected into the
+    # generated tables a dispatch actually reads (Runtime::RefusalWording in
+    # Ruby, kernel::vocab::RefusalSite in Rust) rather than read live off
+    # this very chapter at every call.
     #
     # `{name}` markers are placeholders — plain text substitution, not
     # expression syntax ; a template is read, never evaluated. Two call
@@ -351,6 +361,303 @@ Hecks.bluebook "Bluebook" do
                        "or read {reference}.{remote_field} directly if this rule cannot wait"
     end
 
+    # THE ARGUMENTS EACH RefusalTemplate TAKES, AND HOW EACH ONE IS WRITTEN.
+    # A template says WHERE a value goes; this says WHICH values a site
+    # takes (in the order its placeholders first appear) and how each is
+    # rendered before it goes there — so a caller hands over the raw value
+    # (a list of names, a name) rather than a string it formatted itself.
+    # BUG#134 was exactly the hand-formatted kind: Ruby's `declared_reading`
+    # fell back to "none" for an empty list, the Rust generators joined
+    # the list themselves and never did.
+    #
+    # Read by Runtime::RefusalWording.render_site (a missing or extra
+    # argument refuses to render at all) and projected into
+    # rust/src/kernel/vocab/refusal_template.rs as one typed args struct
+    # per site (`render_args` — a missing argument does not compile).
+    #
+    #   shape      — "scalar" (one value) or "list" (a collection of them)
+    #   quoting    — "none" (the value's own text) or "inspect" (Ruby's
+    #                `#inspect`; Rust's `{:?}`), per value or per item
+    #   separator  — what a list's items are joined with
+    #   sorted     — "true" sorts a list's items first (before quoting)
+    #   when_empty — what an empty list renders as
+    #
+    # Recorded from what the Ruby call sites did when this table was
+    # introduced; no wording changed. A value whose rendering depends on
+    # its runtime type (`Rendering.describe`, `offered.inspect` of an
+    # arbitrary value) stays a caller-rendered "none" scalar, as do the
+    # identity readings (`identity`, `heads`, `wants`) the Rust side already
+    # joins once at codegen time or inside `extract_wants`.
+    value_object "RefusalSiteArgument" do
+      attribute :refusal,    String, admits: "Vocabulary::DomainRefusal"
+      attribute :site,       String
+      attribute :argument,   String
+      attribute :shape,      String
+      attribute :quoting,    String
+      attribute :separator,  String
+      attribute :sorted,     String
+      attribute :when_empty, String
+
+      member refusal: "NotFound", site: "creating_no_identity", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "creating_no_identity", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "creating_no_identity", argument: "identity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AlreadyExists", site: "creating_duplicate", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AlreadyExists", site: "creating_duplicate", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AlreadyExists", site: "creating_duplicate", argument: "identity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AlreadyExists", site: "creating_duplicate", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AlreadyExists", site: "entity_duplicate", argument: "entity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AlreadyExists", site: "entity_duplicate", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AlreadyExists", site: "entity_duplicate", argument: "identity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      # One described value per identity head (MutationApplier), or the
+      # one offered element identity (EntityListCoercion).
+      member refusal: "AlreadyExists", site: "entity_duplicate", argument: "offered",
+             shape: "list", quoting: "none", separator: ", ", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "acting_no_identity", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "acting_no_identity", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "acting_no_identity", argument: "identity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "record_missing", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "record_missing", argument: "identity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "record_missing", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_parent_no_identity", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_parent_no_identity", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_parent_no_identity", argument: "entity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_parent_no_identity", argument: "identity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "entity_unknown", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "entity_unknown", argument: "entity",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_element_no_identity", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_element_no_identity", argument: "entity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_element_no_identity", argument: "identity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_element_missing", argument: "entity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_element_missing", argument: "identity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_element_missing", argument: "wants",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_element_missing", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "entity_element_missing", argument: "parent_id",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "reference_target_missing", argument: "target",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "reference_target_missing", argument: "heads",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "reference_target_missing", argument: "key",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "read_model_reference_missing", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "NotFound", site: "read_model_reference_missing", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "read_model_object_reference", argument: "query",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "read_model_object_reference", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "no_query", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "no_query", argument: "query",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "entity_query_missing", argument: "entity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "entity_query_missing", argument: "query",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "entity_holds_no_list", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "entity_holds_no_list", argument: "entity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "entity_no_command", argument: "entity",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "entity_no_command", argument: "command",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "aggregate_no_command", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "aggregate_no_command", argument: "command",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "port_no_operation", argument: "port",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "port_no_operation", argument: "operation",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "no_domain", argument: "domain",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "no_domain", argument: "verb",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "no_read_model", argument: "domain",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "no_read_model", argument: "query",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "not_fully_qualified", argument: "verb",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "no_aggregate", argument: "domain",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownVerb", site: "no_aggregate", argument: "aggregate",
+             shape: "scalar", quoting: "inspect", separator: "", sorted: "false", when_empty: ""
+      member refusal: "LifecycleRefused", site: "transition_blocked", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "LifecycleRefused", site: "transition_blocked", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "LifecycleRefused", site: "transition_blocked", argument: "current",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "LifecycleRefused", site: "transition_blocked", argument: "allowed",
+             shape: "list", quoting: "inspect", separator: " or ", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "value_object_shape", argument: "name",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "value_object_shape", argument: "type",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "value_object_shape", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "reference_wrong_shape", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "reference_wrong_shape", argument: "attribute",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "reference_wrong_shape", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "reference_wrong_shape", argument: "known_by",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "multi_field_scalar", argument: "type",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "composite_identity", argument: "type",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "numeric_field", argument: "type",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "numeric_field", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "numeric_field", argument: "expected",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "numeric_field", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "non_finite_field", argument: "type",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "non_finite_field", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "non_finite_field", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "integer_range", argument: "type",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "integer_range", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "integer_range", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "pattern_mismatch", argument: "type",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "pattern_mismatch", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "pattern_mismatch", argument: "pattern",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "pattern_mismatch", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "arithmetic_amount", argument: "op",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "arithmetic_amount", argument: "target",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "arithmetic_amount", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "arithmetic_current", argument: "op",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "arithmetic_current", argument: "target",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "arithmetic_current", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "arithmetic_shared_field", argument: "op",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "TypeMismatch", site: "arithmetic_shared_field", argument: "target",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownArgument", site: "unknown_args", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "UnknownArgument", site: "unknown_args", argument: "unknown",
+             shape: "list", quoting: "none", separator: ", ", sorted: "true", when_empty: ""
+      member refusal: "UnknownArgument", site: "unknown_args", argument: "declared",
+             shape: "list", quoting: "none", separator: ", ", sorted: "false", when_empty: "none"
+      member refusal: "AbsentArgument", site: "absent_args", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AbsentArgument", site: "absent_args", argument: "absent",
+             shape: "list", quoting: "none", separator: ", ", sorted: "true", when_empty: ""
+      member refusal: "AbsentArgument", site: "absent_args", argument: "declared",
+             shape: "list", quoting: "none", separator: ", ", sorted: "false", when_empty: "none"
+      member refusal: "InvariantViolation", site: "closed_set_member", argument: "type",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "closed_set_member", argument: "admitted",
+             shape: "list", quoting: "inspect", separator: ", ", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "closed_set_member", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "value_object_invariant", argument: "name",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "value_object_invariant", argument: "description",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "value_object_invariant", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "admits_declared_set", argument: "name",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "admits_declared_set", argument: "admits",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "admits_declared_set", argument: "admitted",
+             shape: "list", quoting: "inspect", separator: ", ", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "admits_declared_set", argument: "offered",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "undeclared_set", argument: "name",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "InvariantViolation", site: "undeclared_set", argument: "admits",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "tenant_required", argument: "query",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "tenant_required", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "role_mismatch", argument: "command",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "role_mismatch", argument: "role",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "role_mismatch", argument: "caller_role",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "cross_tenant_reference", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "cross_tenant_reference", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "cross_tenant_reference", argument: "tenant",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "cross_tenant_reference", argument: "attribute",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "cross_tenant_reference", argument: "target",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "cross_tenant_reference", argument: "target_field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "Unauthorized", site: "cross_tenant_reference", argument: "other",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AttributeAbsent", site: "absent_read", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "AttributeAbsent", site: "absent_read", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "ProjectionAbsent", site: "absent_read", argument: "aggregate",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "ProjectionAbsent", site: "absent_read", argument: "field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "ProjectionAbsent", site: "absent_read", argument: "reference",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+      member refusal: "ProjectionAbsent", site: "absent_read", argument: "remote_field",
+             shape: "scalar", quoting: "none", separator: "", sorted: "false", when_empty: ""
+    end
+
     # SagaInterpreter::REFUSED.
     #
     # A leg answers an EVENT — `on "AccountDebited"` — or it answers one of these,
@@ -373,10 +680,9 @@ Hecks.bluebook "Bluebook" do
     # rendering convention, the same guess for every domain, not
     # authored per-bluebook — closer to Comparison/SignTest than to a
     # given. `pattern` is the regex SOURCE, no delimiters or flags
-    # (Ruby's own `Regexp#source`) — spec/field_hint_conformance_spec.rb
-    # holds FieldShape's four hand-typed constants equal to this, both
-    # directions, the same conformance shape refusal_wording_
-    # conformance_spec.rb already holds RefusalTemplate to.
+    # (Ruby's own `Regexp#source`) — FieldShape builds its four constants
+    # off these rows, and bin/project_field_hints writes the Rust host's
+    # copy from them, so neither side is typed by hand.
     #
     # `resolves_to` names WHICH Field attribute a match sets — `html_type`
     # for email/url/tel (three candidates, only one wins, checked in that
@@ -392,5 +698,34 @@ Hecks.bluebook "Bluebook" do
       member name: "tel",      pattern: 'phone|\btel(ephone)?\b',                                 resolves_to: "html_type"
       member name: "textarea", pattern: '\b(text|body|note|notes|description|message|comment)\b', resolves_to: "kind"
     end
+
+    # The Rust keywords (strict + reserved) a generated identifier must not
+    # collide with — RustProjection::Projector::RUST_KEYWORDS (rust/project/
+    # naming.rb) reads this, and bin/project_reserved_names projects it into
+    # rust/codegen/src/reserved_names.rs, so the Ruby and Rust generators
+    # escape (a field: `r#type`) or refuse (a module name) the SAME words.
+    # Declared once here because the two hand-typed copies were held equal
+    # by nothing but a comment.
+    value_object "RustReservedWord" do
+      attribute :word, String,
+                one_of: ["as", "break", "const", "continue", "crate", "dyn", "else", "enum", "extern", "false",
+                         "fn", "for", "if", "impl", "in", "let", "loop", "match", "mod", "move", "mut", "pub",
+                         "ref", "return", "self", "Self", "static", "struct", "super", "trait", "true", "type",
+                         "unsafe", "use", "where", "while", "abstract", "become", "box", "do", "final", "macro",
+                         "override", "priv", "typeof", "unsized", "virtual", "yield", "try"]
+    end
+
+    # The keys a domain's own name must not take, because that name doubles
+    # as a Cargo `[features]` key: every key rust/Cargo.toml already uses
+    # outside `[features]` (`[package]`, `[lib]`, `[[bin]]`) plus `default`,
+    # which Cargo reserves for the auto-enabled feature set. Read by
+    # RustProjection::Projector::CARGO_RESERVED_DOMAIN_NAMES and projected by
+    # bin/project_reserved_names, same as RustReservedWord above.
+    value_object "CargoReservedName" do
+      attribute :name, String,
+                one_of: ["name", "version", "edition", "path", "authors", "license", "description", "default",
+                         "features", "package", "lib", "bin", "dependencies", "dev-dependencies",
+                         "build-dependencies", "workspace"]
+    end
   end
 end