hecks 1.5.1 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29c54ce86e36189a63578e970929e42c213d5812282c5cf5ca6e56820eb02938
-  data.tar.gz: 1d564ee387fb38c619fbdfef209bcc757570a492e70dac16f1d5fb80889c37e8
+  metadata.gz: b7e80387e679bdc08c6a48b9c1eabefee28d7f9fd0e28a41f203e1fd9b207c34
+  data.tar.gz: 455038d69b310e2fc9ae72b30d811623c8c1a85a4a5da118b842b8af7fd082b0
 SHA512:
-  metadata.gz: 24794f4aaa4f5d2268f27e063b79a23b61c7dffe7b4a87b4b58f83db73188d57716fd734d695082bdf11d78d3101fc41640a45f76510fe7cc45fd9c3cd9347a8
-  data.tar.gz: 9ce51558bbe7c55e9dc451140a21d7c83b7073b8a692304579f15c76db3c56371cb90c7cac07b6c02e6eb64ddd73c27572e786ab941659d2a76e649de5d2a699
+  metadata.gz: 7738a1869d51907dce7b981d7f0d3d1977f73a8baae57d947d2667155830495f9e19163a4c1fe5785e79fa262a7733c6d1d31086b6bc0ed85191bd31d6ad829b
+  data.tar.gz: f3506ffdc5133c083030ac87f0056a1373de5802520116956b0e30c00ea3d473e1e55f9fa62e813048e98c063aa05446a44e61ff49540dcc266e74546d6da7fa

data/lib/hecks/adapters/driven/identity_registry.rb

@@ -24,8 +24,14 @@ module Hecks
       # @param subject [String] the OIDC subject the issuer vouches for, compared as a String
       # @return [String, nil] the linked identity's id, or nil if nothing has linked this pair
       def resolve(registry, issuer:, subject:)
+        # The resolve verb this registry's declared identity provider names
+        # (`provides "identity", resolve:`), never a hard-coded chapter —
+        # same declared-not-named shape GovernanceAuthorization already holds.
+        provider = registry.bluebooks.values.find { |chapter| chapter.provides?(::Hecks::Bluebook::Capabilities::IDENTITY) }
+        verb = provider&.provided_verb(::Hecks::Bluebook::Capabilities::IDENTITY, :resolve) ||
+               "Identity::ExternalIdentifier.ResolvedBy"
         rows = Runtime::Dispatcher.new(registry).query(
-          "Identity::ExternalIdentifier.ResolvedBy",
+          verb,
           issuer: { value: issuer.to_s }, subject: { value: subject.to_s }
         )
 

data/lib/hecks/bluebook/capabilities.rb

@@ -8,9 +8,30 @@ module Hecks
     # complete and point at real verbs. `BluebookBuilder::Validation
     # #validate_provisions!` holds every `provides` to this table.
     #
-    #   key => :command | :query   the kind of verb that key must name
+    #   key => :command | :query | :port_operation   the kind of verb that key must name
+    #
+    # A `:port_operation` verb is spelled `"Aggregate.Port.Operation"` and names
+    # an operation the chapter's hecksagon declares on one of its aggregates.
+    # The hecksagon attaches after the chapter is built, so the chapter itself
+    # only checks the spelling; `Registry#verify!` checks the operation exists.
     module Capabilities
       AUTHORIZATION = "authorization".freeze
+      # Who may sign in, and with what role — rust/host's Google-OAuth
+      # provision/member_rows resolve this instead of an env var naming
+      # the aggregate (HECKS_MEMBERSHIP_AGGREGATE). Same declared-
+      # not-named shape AUTHORIZATION already is for Governance.
+      MEMBERSHIP = "membership".freeze
+      # A stable organizational identity, independent of how it was
+      # authenticated — recognised by declaration, not the literal name
+      # "Identity". Same declared-not-named shape AUTHORIZATION already
+      # is. rust/host does not build this chapter's payloads; any field
+      # mapping lives on the consuming hecksagon's `translates` ACL.
+      IDENTITY = "identity".freeze
+      # Guest-facing newsletter signup: who subscribed, confirmed, or left —
+      # recognised by declaration, not the literal chapter name
+      # "Newsletter". rust/host's newsletter routes dispatch these verbs
+      # and read the subscribing aggregate's instances off `subscribe`.
+      NEWSLETTER = "newsletter".freeze
 
       CONTRACTS = {
         AUTHORIZATION => {
@@ -20,6 +41,32 @@ module Hecks
           grant:       :command,
           # every grant of one role acting as another
           transitions: :query
+        }.freeze,
+        MEMBERSHIP    => {
+          # recognize a person who may eventually sign in
+          admit:  :command,
+          # grant an admitted person a role (the access-grant half)
+          grant:  :command,
+          # every admitted person, for the admin listing
+          people: :query
+        }.freeze,
+        IDENTITY      => {
+          # mint a stable identity, independent of how it authenticated
+          register: :command,
+          # associate an (issuer, subject) pair with that identity
+          link:     :command,
+          # look up the identity an authenticated pair resolves to
+          resolve:  :query
+        }.freeze,
+        NEWSLETTER    => {
+          # a guest signs up; the aggregate it names is the subscriber
+          subscribe:   :command,
+          # attach a display name to an existing subscriber
+          add_name:    :command,
+          # a subscriber confirms their address from the emailed link
+          confirm:     :command,
+          # a subscriber leaves from the emailed link
+          unsubscribe: :command
         }.freeze
       }.freeze
     end

data/lib/hecks/bluebook/dsl/bluebook_builder/validation.rb

@@ -113,12 +113,14 @@ module Hecks
           # @param capability [String] the capability the row belongs to, such as
           #   `"authorization"`
           # @param row [Bluebook::Chapter::Provision] the one declared row to check
-          # @param kind [Symbol] `:command` or `:query`, the kind of verb this row's key
-          #   must name (from `Capabilities::CONTRACTS`)
+          # @param kind [Symbol] `:command`, `:query` or `:port_operation`, the kind of
+          #   verb this row's key must name (from `Capabilities::CONTRACTS`)
           # @return [void]
           # @raise [Bluebook::DSL::Malformed] if `row.verb` does not split into a real
           #   aggregate and a member of the right kind that aggregate declares
           def validate_provided_verb!(bluebook, capability, row, kind)
+            return validate_provided_port_operation!(bluebook, capability, row) if kind == :port_operation
+
             aggregate_name, member = row.verb.split(".", 2)
             aggregate = bluebook.aggregate(aggregate_name)
             return if aggregate && member && provided_member_names(aggregate, kind).include?(member)
@@ -127,6 +129,26 @@ module Hecks
                              "which names no #{kind} this chapter declares (spelled \"Aggregate.#{kind.capitalize}\")"
           end
 
+          # Checks the spelling of a `provides` verb that names a hecksagon port
+          # operation. The port itself is declared in the hecksagon, which attaches
+          # after this chapter is built, so all that can be checked here is that the
+          # verb has the `"Aggregate.Port.Operation"` shape and its aggregate is
+          # this chapter's; `Registry#verify!` checks the operation exists.
+          #
+          # @param bluebook [Bluebook::Chapter] the chapter the row was declared on
+          # @param capability [String] the capability the row belongs to
+          # @param row [Bluebook::Chapter::Provision] the one declared row to check
+          # @return [void]
+          # @raise [Bluebook::DSL::Malformed] if the verb is not `"Aggregate.Port.Operation"`
+          #   or names an aggregate this chapter does not declare
+          def validate_provided_port_operation!(bluebook, capability, row)
+            aggregate_name, port, operation = row.verb.split(".", 3)
+            return if bluebook.aggregate(aggregate_name) && port && operation && !operation.include?(".")
+
+            raise Malformed, "#{bluebook.name} provides #{capability.inspect} #{row.key}: #{row.verb.inspect}, " \
+                             "which is not spelled \"Aggregate.Port.Operation\" over an aggregate this chapter declares"
+          end
+
           # Names of the members a `provides` verb of the given kind may address.
           #
           # @param aggregate [Bluebook::Aggregate] the aggregate the verb is scoped to

data/lib/hecks/bluebook/dsl/hecksagon_builder.rb

@@ -27,6 +27,20 @@ module Hecks
           @subscriptions      = []
           @framework_members  = []
           @vendored_bluebooks = []
+          @bounded            = false
+          @translates         = []
+        end
+
+        # Marks THIS chapter as a bounded context — a consumer-owned chapter
+        # that `uses_framework` / `uses_embryonaut_bluebook` will not load.
+        # Framework and vendored packages get the mark automatically from
+        # those words; they never write `bounded` in their own bluebooks.
+        # A bounded chapter wraps in its own module (no Object shortcut)
+        # and must declare at least one `translates` ACL or boot refuses.
+        #
+        # @return [Boolean] true
+        def bounded
+          @bounded = true
         end
 
         # Subscribes this hecksagon to an event it takes from outside the domain's own bluebook.
@@ -54,6 +68,11 @@ module Hecks
         def uses_framework(name)
           @framework_members << name.to_s
           Hecks::Framework.load!(name)
+          # Automatic bounded mark — the framework member is a bounded
+          # context; the consumer's sibling `Hecks.hecksagon "Name"` is
+          # the anti-corruption layer. Not written in the framework
+          # bluebook itself.
+          Hecks.current_registry&.mark_bounded(name.to_s)
         end
 
         # Attaches a vendored embryonaut bluebook to this domain and loads its files into the
@@ -83,6 +102,10 @@ module Hecks
         def uses_embryonaut_bluebook(name)
           @vendored_bluebooks << name.to_s
           Hecks::EmbryonautBluebook.load!(name)
+          # Automatic bounded mark — same as `uses_framework`. The
+          # package's directory name Pascal-cases to the chapter
+          # (`"membership"` → `Membership`).
+          Hecks.current_registry&.mark_bounded(Hecks::Naming.pascal(name.to_s))
         end
 
         # Declares a port at the hecksagon's root and attaches it to the registered bluebook.
@@ -173,6 +196,7 @@ module Hecks
           resolver = ->(const) { ConstShim::ScopedConstant.for(const) }
           built = ConstShim.with(resolver) { PolicyBuilder.build(name, &block) }
 
+          @translates << name.to_s
           bluebook_ir.add_policy(built)
         end
 
@@ -197,7 +221,8 @@ module Hecks
         #   with any other block declared for the same domain
         def build
           Hecksagon.new(domain: @domain, binds: @binds, subscriptions: @subscriptions,
-                        framework_members: @framework_members, vendored_bluebooks: @vendored_bluebooks)
+                        framework_members: @framework_members, vendored_bluebooks: @vendored_bluebooks,
+                        bounded: @bounded, translates: @translates)
         end
 
         # Records any verb the grammar does not own as a domain-wide bind to the named adapter.

data/lib/hecks/bluebook/hexagon.rb

@@ -51,10 +51,13 @@ module Hecks
         binds:              many(:binds),
         subscriptions:      -> { subscriptions.map(&:to_s) },
         framework_members:  -> { framework_members.map(&:to_s) },
-        vendored_bluebooks: -> { vendored_bluebooks.map(&:to_s) }
+        vendored_bluebooks: -> { vendored_bluebooks.map(&:to_s) },
+        bounded:            :bounded,
+        translates:         -> { translates.map(&:to_s) }
       )
 
-      attr_reader :domain, :binds, :subscriptions, :framework_members, :vendored_bluebooks
+      attr_reader :domain, :binds, :subscriptions, :framework_members, :vendored_bluebooks,
+                  :translates
 
       # @param domain [String, Symbol] the domain this hecksagon wires
       # @param binds [Array<Bluebook::Bind>] the declared adapter binds
@@ -64,13 +67,25 @@ module Hecks
       #   (`Governance`, `Identity`, ...) this domain attaches
       # @param vendored_bluebooks [Array<String, Symbol>] the vendored embryonaut
       #   bluebook package names this domain attaches
-      def initialize(domain:, binds: [], subscriptions: [], framework_members: [], vendored_bluebooks: [])
+      # @param bounded [Boolean] whether this chapter is an explicit bounded context
+      #   (consumer-owned; `uses_framework` / `uses_embryonaut_bluebook` mark
+      #   attached chapters bounded on the registry instead)
+      # @param translates [Array<String>] names of `translates` ACL blocks declared here
+      def initialize(domain:, binds: [], subscriptions: [], framework_members: [],
+                     vendored_bluebooks: [], bounded: false, translates: [])
         @domain             = domain.to_s
         @binds              = binds
         @subscriptions      = subscriptions
         @framework_members  = framework_members
         @vendored_bluebooks = vendored_bluebooks
+        @bounded            = bounded ? true : false
+        @translates         = Array(translates).map(&:to_s)
       end
+
+      # Says whether this hecksagon marked its own chapter `bounded`.
+      #
+      # @return [Boolean] whether `bounded` was declared on this block
+      def bounded? = @bounded
     end
 
     # The built form of a `.world` file, produced by `DSL::WorldBuilder` —

data/lib/hecks/corpus.rb

@@ -265,20 +265,112 @@ module Hecks
     Elsewhere = Struct.new(:check, :destination, :names, :why)
 
     RUST_ELSEWHERE = {
-      "meta"       => Elsewhere.new(:named_in, "spec/codegen_parity_spec.rb", "bluebook_language",
-                                    "the self-hosted grammar (lib/hecks/language), not a domain directory — every " \
-                                    "bin/project_rust run rewrites it (so the drift check diffs it), codegen parity " \
-                                    "checks it as bluebook_language, and there is no directory to fuzz"),
-      "embryonaut" => Elsewhere.new(:external, "~/Projects/embryonautfoundersapp", "embryonaut",
-                                    "an external product's domain — its bluebook, regeneration and parity are owed " \
-                                    "by its own repo; here bin/rust_coverage checks only the committed snapshot")
+      "meta"        => Elsewhere.new(:named_in, "spec/codegen_parity_spec.rb", "bluebook_language",
+                                     "the self-hosted grammar (lib/hecks/language), not a domain directory — every " \
+                                     "bin/project_rust run rewrites it (so the drift check diffs it), codegen parity " \
+                                     "checks it as bluebook_language, and there is no directory to fuzz"),
+      "embryonaut"  => Elsewhere.new(:external, "~/Projects/embryonautfoundersapp", "embryonaut",
+                                     "an external product's domain — its bluebook, regeneration and parity are owed " \
+                                     "by its own repo; here bin/rust_coverage checks only the committed snapshot"),
+      # Lifeadelics — same external-product shape as "embryonaut" above,
+      # first generated 2026-09-19 fixing a live era-shape-drift outage.
+      # Its directory used to be named "domain" (a generic, collision-
+      # prone Cargo feature/module name — the chapter name is, and
+      # always was, "Lifeadelics"), so the generated module and Cargo
+      # feature were "domain" too, read off `metadata.rs`'s own stamp
+      # the same way `generated_source` reads any other module's. Fixed
+      # 2026-09-20 by renaming the directory itself
+      # (~/Projects/lifeadelics/domain -> ~/Projects/lifeadelics/
+      # lifeadelics) — the generated module and Cargo feature are
+      # "lifeadelics" now, matching every other domain's own convention.
+      #
+      # Lifeadelics also attaches `newsletter`/`payments`/`membership`
+      # (its own vendored embryonaut_bluebooks packages, see
+      # RUST_EXTERNAL_VENDORED_CHAPTERS below) and `Privacy` (an in-repo
+      # framework chapter, lib/hecks/framework/bluebook/privacy.bluebook,
+      # generated into Rust for the first time by any domain here).
+      # `rust_side_chapters` only ever looks for the attaching domain
+      # among `rust_domains` — an in-repo directory — so it can attribute
+      # neither module to lifeadelics on its own; `rust_attachment_
+      # hecksagon_text`, below, reads every `:external` domain's own
+      # hecksagon files too, the same way it reads an in-repo domain's,
+      # so `Privacy`'s own bucket membership (already correct — it is a
+      # real in-repo framework member with no merged.rs) can still be
+      # proven attached.
+      "lifeadelics" => Elsewhere.new(:external, "~/Projects/lifeadelics", "lifeadelics",
+                                     "an external product's domain — its bluebook, regeneration and parity are owed " \
+                                     "by its own repo; here bin/rust_coverage checks only the committed snapshot")
     }.freeze
 
+    # Vendored embryonaut_bluebooks packages attached only by an external
+    # RUST_ELSEWHERE domain — `members(:vendored)` can't find them
+    # itself; that glob only reaches `examples/*/vendor/
+    # embryonaut_bluebooks/*`, never an external checkout. Declared once,
+    # by hand, the same manual-commit contract "embryonaut" itself
+    # already carries: stem => the RUST_ELSEWHERE feature that attaches
+    # it. spec/corpus_rust_spec.rb checks each is really attached, the
+    # same as an in-repo vendored chapter (see
+    # `rust_external_vendored_domain_dir`, below).
+    RUST_EXTERNAL_VENDORED_CHAPTERS = {
+      "newsletter" => "lifeadelics",
+      "payments"   => "lifeadelics",
+      "membership" => "lifeadelics"
+    }.freeze
+
+    # Every external vendored chapter's own stem.
+    #
+    # @return [Array<String>] stems declared in RUST_EXTERNAL_VENDORED_CHAPTERS
+    def rust_external_vendored_chapters
+      RUST_EXTERNAL_VENDORED_CHAPTERS.keys
+    end
+
+    # Where an external vendored chapter's own bluebook lives — somewhere
+    # under `<destination>/**/vendor/embryonaut_bluebooks/<stem>`, the
+    # same layout `EmbryonautBluebook.load!` resolves for an in-repo
+    # vendored member, one level further out. Globbed rather than joined
+    # directly: `RUST_ELSEWHERE`'s own `destination` names the external
+    # product's checkout root, not necessarily the exact directory its
+    # own bluebook lives under (confirmed live against lifeadelics's own
+    # checkout: `~/Projects/lifeadelics/lifeadelics/vendor/
+    # embryonaut_bluebooks/accounts/bluebook`, one level below
+    # `~/Projects/lifeadelics` itself).
+    #
+    # @param stem [String] an external vendored chapter's stem
+    # @return [String, nil] the vendored member's own directory, or nil when none is found
+    def rust_external_vendored_domain_dir(stem)
+      feature = RUST_EXTERNAL_VENDORED_CHAPTERS.fetch(stem)
+      destination = File.expand_path(RUST_ELSEWHERE.fetch(feature).destination)
+      Dir.glob(File.join(destination, "**", "vendor", "embryonaut_bluebooks", stem)).first
+    end
+
+    # Every place a Rust-facing domain's own `uses_framework`/
+    # `uses_embryonaut_bluebook` attachment could be declared — every
+    # in-repo Rust domain's own hecksagon files, plus each `:external`
+    # RUST_ELSEWHERE domain's own (its `destination`, expanded, is a
+    # real checkout on this machine, read the same way an in-repo
+    # domain's own hecksagon files already are).
+    #
+    # @param root [String] repository root to search under
+    # @return [String] every reachable hecksagon file's own text, joined by newlines
+    def rust_attachment_hecksagon_text(root: ROOT)
+      in_repo = rust_domains(root: root).flat_map { |domain| Dir.glob(File.join(domain.dir, "**", "*.hecksagon")) }
+      external = RUST_ELSEWHERE.values.select { |route| route.check == :external }
+                               .flat_map { |route| Dir.glob(File.join(File.expand_path(route.destination), "**", "*.hecksagon")) }
+      (in_repo + external).map { |path| File.read(path) }.join("\n")
+    end
+
     # **Shrink-only**. A generated module `bin/rust_coverage` still reports a
     # gap for. `bin/corpus --rust-coverage` requires each of these to
     # still fail, so an entry that starts passing breaks the build until
     # it is deleted here.
-    RUST_COVERAGE_PENDING = {}.freeze
+    RUST_COVERAGE_PENDING = {
+      "newsletter"  => "query Listing declares no where clause at all, on all 3 of its own Listing queries " \
+                       "(Delivery/Issue/Subscriber) — rust/project/queries.rb's own no_wheres skip refuses " \
+                       "to generate an unfiltered per_instance Listing (\"nothing for filter_entries to " \
+                       "bake in\"); a structural Rust codegen limitation, not a bug in this vendored package",
+      "lifeadelics" => "same no_wheres gap as newsletter, on Registration.Listing — see newsletter's entry above",
+      "membership"  => "same no_wheres gap as newsletter, on Person.All — see newsletter's entry above"
+    }.freeze
 
     # The Cargo `[features]` table's raw text.
     #
@@ -396,7 +488,26 @@ module Hecks
     def rust_side_chapters(kind, root: ROOT)
       modules = generated_modules(root: root)
       members(kind, root: root).map(&:stem)
-                               .select { |stem| modules.include?(stem) && !generated?(stem, root: root) }
+                               .select do |stem|
+                                 module_name = Naming.pascal(stem).downcase
+                                 modules.include?(module_name) && !generated?(module_name, root: root)
+                               end
+    end
+
+    # The generated module name a `:framework`/`:vendored` stem writes
+    # under — `Naming.pascal(stem).downcase` (`bin/project_rust`'s own
+    # convention, see `rust_side_chapters`'s header); a chapter whose
+    # stem holds an underscore ("console_settings") writes to a
+    # different, underscore-free module name ("consolesettings"), so a
+    # bucket-membership check against `generated_modules` (a directory
+    # name) needs this mapping rather than the raw stem
+    # `rust_framework_chapters`/`rust_vendored_chapters` still return
+    # (every other caller wants the stem, to build a bluebook file path).
+    #
+    # @param stem [String] a `:framework`/`:vendored` corpus member's stem
+    # @return [String] the generated module's own directory name
+    def rust_side_module_name(stem)
+      Naming.pascal(stem).downcase
     end
 
     def rust_framework_chapters(root: ROOT)

data/lib/hecks/framework/bluebook/identity.bluebook

@@ -9,6 +9,17 @@ Hecks.bluebook "Identity" do
   # identity provider is.
   generic
 
+  # WHAT THIS CHAPTER ANSWERS FOR EVERY DOMAIN THAT ATTACHES IT. Same
+  # declared-not-named shape Governance's own `provides "authorization"`
+  # already is. rust/host does not build this chapter's payloads — any
+  # field mapping lives on the consuming hecksagon's `translates` ACL
+  # (any field; this chapter does not list which). Link's reference is
+  # `identity`, not `identity_id` and not `to:`.
+  provides "identity",
+           register: "Identity.Register",
+           link:     "ExternalIdentifier.Link",
+           resolve:  "ExternalIdentifier.ResolvedBy"
+
   aggregate "Identity" do
     description "A stable organizational identity, independent of how it was authenticated."
 

data/lib/hecks/fuzzing/concurrent_dispatch.rb

@@ -435,11 +435,18 @@ module Hecks
       # @param schema [String] the PostgresEra schema name to write into the `.world` file
       # @return [void]
       def write_postgres_era_world!(copy, database:, schema:)
+        # Same merge IsolatedBoot.rebind_to_postgres_era! now does — one
+        # world file per directory, every hecksagon name in that directory.
+        worlds_by_dir = Hash.new { |h, k| h[k] = [] }
         Dir.glob(File.join(copy, "**", "*.hecksagon")).each do |hecksagon_path|
-          names = File.read(hecksagon_path).scan(/Hecks\.hecksagon\s+"([^"]+)"/).flatten.uniq
+          names = File.read(hecksagon_path).scan(/Hecks\.hecksagon\s+"([^"]+)"/).flatten
+          worlds_by_dir[File.dirname(hecksagon_path)].concat(names)
+        end
+        worlds_by_dir.each do |dir, names|
+          names = names.uniq
           next if names.empty?
 
-          world_path = File.join(File.dirname(hecksagon_path), "hecks_fuzz_postgres_era.world")
+          world_path = File.join(dir, "hecks_fuzz_postgres_era.world")
           File.write(world_path, names.map do |name|
             <<~WORLD
               Hecks.world "#{name}" do

data/lib/hecks/fuzzing/isolated_boot.rb

@@ -404,11 +404,21 @@ module Hecks
         # database it is about to throw away; the one-line warning
         # PostgresEra prints per boot under the opt-in is the honest
         # price. Inert on a machine whose ambient user is ordinary.
+        # One world file per directory, every hecksagon name in that
+        # directory — not one write per *.hecksagon file. context_map.hecksagon
+        # sits beside the domain file; a second File.write to the same
+        # hecks_fuzz_postgres_era.world would drop the first file's names
+        # (found live: ConcurrentDispatchUnboundFixture + Governance).
+        worlds_by_dir = Hash.new { |h, k| h[k] = [] }
         Dir.glob(File.join(copy, "**", "*.hecksagon")).each do |hecksagon_path|
-          names = File.read(hecksagon_path).scan(/Hecks\.hecksagon\s+"([^"]+)"/).flatten.uniq
+          names = File.read(hecksagon_path).scan(/Hecks\.hecksagon\s+"([^"]+)"/).flatten
+          worlds_by_dir[File.dirname(hecksagon_path)].concat(names)
+        end
+        worlds_by_dir.each do |dir, names|
+          names = names.uniq
           next if names.empty?
 
-          world_path = File.join(File.dirname(hecksagon_path), "hecks_fuzz_postgres_era.world")
+          world_path = File.join(dir, "hecks_fuzz_postgres_era.world")
           File.write(world_path, names.map do |name|
             <<~WORLD
               Hecks.world "#{name}" do

data/lib/hecks/language/bluebook/bluebook.bluebook

@@ -181,7 +181,11 @@ Hecks.bluebook "Bluebook", version: "1" do
 
     # ONE ROW OF ONE CAPABILITY — `provides "authorization", assignments:
     # ..., grant: ..., transitions: ...` offers three, one per key, in the
-    # order they were written.
+    # order they were written. Membership (`admit`/`grant`/`people`) and
+    # identity (`register`/`link`/`resolve`) use the same word with their
+    # own named keys; the argument table admits every key any capability
+    # declares, and `Capabilities::CONTRACTS` holds which keys a given
+    # capability must name.
     command "Provide" do
       role "Language"
       goal "Declare one verb this chapter answers a capability with"
@@ -287,6 +291,11 @@ Hecks.bluebook "Bluebook", version: "1" do
       member keyword: "provides",        context: "Bluebook", at: "",  named: "assignments", kind: "text", required: "false", fills: "provides"
       member keyword: "provides",        context: "Bluebook", at: "",  named: "grant",       kind: "text", required: "false", fills: "provides"
       member keyword: "provides",        context: "Bluebook", at: "",  named: "transitions", kind: "text", required: "false", fills: "provides"
+      member keyword: "provides",        context: "Bluebook", at: "",  named: "admit",       kind: "text", required: "false", fills: "provides"
+      member keyword: "provides",        context: "Bluebook", at: "",  named: "people",      kind: "text", required: "false", fills: "provides"
+      member keyword: "provides",        context: "Bluebook", at: "",  named: "register",    kind: "text", required: "false", fills: "provides"
+      member keyword: "provides",        context: "Bluebook", at: "",  named: "link",        kind: "text", required: "false", fills: "provides"
+      member keyword: "provides",        context: "Bluebook", at: "",  named: "resolve",     kind: "text", required: "false", fills: "provides"
       member keyword: "aggregate",       context: "Bluebook", at: "1", named: "",        kind: "text",     required: "true",  fills: "name"
       member keyword: "read_model", context: "Bluebook", at: "1", named: "", kind: "text", required: "true", fills: "name"
       member keyword: "policy",          context: "Bluebook", at: "1", named: "",        kind: "text",     required: "true",  fills: "name"

data/lib/hecks/language/hecksagon/hecksagon.bluebook

@@ -110,6 +110,12 @@ Hecks.bluebook "Hecksagon" do
       # the same shape `subscribe`/`uses_framework` already are, reached
       # by Ruby's own method lookup before `word_gate` ever runs.
       member word: "translates",      context: "Hecksagon",     body: "keywords", inner: "Policy",        opens: "Policy",        fills: ""
+      # A CONSUMER-OWNED bounded context — framework/vendored packages
+      # get this mark automatically from uses_framework /
+      # uses_embryonaut_bluebook and never write it in their own files.
+      # No `calls:` — `HecksagonBuilder#bounded` is an ordinary method,
+      # same shape `subscribe` already is.
+      member word: "bounded",         context: "Hecksagon", body: "none", inner: "", opens: "", fills: ""
 
     end
 

data/lib/hecks/ports/persistence/plugins/era/lineage.rb

@@ -155,8 +155,13 @@ module Hecks
           @drops.each { |name| apply_drop(state, name) }
           # Last, and only where nothing already answered — a backfill
           # fills the gap a rename/move/convert left untouched, never
-          # overwrites a value that already made it across.
-          @backfills.each { |backfill| state[backfill.name] = backfill.default unless state.key?(backfill.name) }
+          # overwrites a value that already made it across. Dotted-path
+          # aware, same as `apply_drop` above (`apply_backfill`'s own
+          # header) — a bare name was the only shape this ever needed
+          # until a value object gained new required members with zero
+          # source data of their own (found live: lifeadelics' Attendee
+          # redesign, commit 4326dcd).
+          @backfills.each { |backfill| apply_backfill(state, backfill) }
           Entry.new(operation: entry.operation, id: entry.id, state: state, mirrors: entry.mirrors)
         end
 
@@ -312,6 +317,31 @@ module Hecks
           end
         end
 
+        # Applies one backfill, dotted-path aware — `apply_drop`'s own
+        # mirror on the addition side. A bare name sets a plain top-level
+        # key, unchanged from before; a dotted name (`"attendee.
+        # first_name"`) reaches into an existing value-object member the
+        # same way `apply_drop`/`hecks_tr_insert` (rule_compiler.rb's own
+        # SQL-compiled twin, kept in step with this) already do — creating
+        # the container Hash if an old record somehow lacks it entirely,
+        # never overwriting a value already there at either level.
+        #
+        # @param state [Hash] the entry's own state Hash, mutated in place
+        # @param backfill [Bluebook::TranslationBackfill] the backfill rule to apply
+        # @return [void]
+        def apply_backfill(state, backfill)
+          name = backfill.name.to_s
+          top, member = name.split(".", 2)
+          top = top.to_sym
+
+          if member
+            nested = (state[top] ||= {})
+            nested[member] = backfill.default unless nested.key?(member)
+          else
+            state[top] = backfill.default unless state.key?(top)
+          end
+        end
+
         # A dotted path's first segment is a top-level (symbol) key; a
         # second segment reaches into a value-object member by its string
         # key — the spelling a raw stored row carries. Translation runs on

data/lib/hecks/ports/persistence/plugins/era/translation/rule_compiler.rb

@@ -54,6 +54,21 @@ module Hecks
         declared.computes.each do |compute|
           expression = compile_compute(expression, compute)
         end
+        # Backfills last, same order `Lineage#translate` already applies
+        # in-process (that method's own comment: "only where nothing
+        # already answered") — now compiled here too, closing the gap
+        # this rule kind otherwise leaves: `rust/host`'s boot-time mint
+        # audit reads this exact compiled expression, never
+        # `Lineage#translate`, so it cannot see a backfilled value unless
+        # backfills compile to SQL like every other rule kind here. A
+        # real, live gap for any new required value-object member with no
+        # source data at all — `compute` cannot fill it either, since its
+        # own guard requires a real, already-present field to consume
+        # (found live: lifeadelics' Attendee redesign, commit 4326dcd,
+        # needed exactly this and had nothing that worked).
+        declared.backfills.each do |backfill|
+          expression = compile_backfill(expression, backfill)
+        end
         expression
       end
 
@@ -124,6 +139,32 @@ module Hecks
           "LATERAL (SELECT (__s ->> #{text_literal(from)}) AS #{quote(from)}) __fields)"
       end
 
+      # A newly added, required attribute with no source at all — the
+      # addition-side sibling of `compile_compute`'s own header, but with
+      # no field to consume: `hecks_tr_extract`'s own `.present` flag
+      # (already installed for `hecks_tr_drop`/`hecks_tr_move`/
+      # `hecks_tr_convert` — no new database function needed) answers
+      # "is this path — bare or a dotted value-object member alike —
+      # already there," and `hecks_tr_insert` (already merge-safe: it
+      # creates a missing intermediate container without disturbing any
+      # sibling member already in it) fills it only when it is not, the
+      # exact "never overwrites a value already there" rule `Lineage#
+      # translate`'s own in-process backfill already holds itself to.
+      #
+      # @param expression [String] the SQL expression built so far by `compile_rules`, read as
+      #   `__s` inside this backfill's own check
+      # @param backfill [Bluebook::TranslationBackfill] the declared backfill rule
+      # @return [String] `expression` wrapped so the backfill's default lands at its declared
+      #   path when nothing is there yet, unchanged otherwise
+      def compile_backfill(expression, backfill)
+        name = backfill.name.to_s
+        default_json = JSON.generate(backfill.default)
+        "(SELECT CASE WHEN (hecks_tr_extract(__s, #{path_literal(name)})).present THEN __s " \
+          "ELSE hecks_tr_insert(__s, #{path_literal(name)}, #{text_literal(default_json)}::jsonb, " \
+          "#{text_literal("backfill #{name}")}) END " \
+          "FROM (SELECT (#{expression}) AS __s) __outer)"
+      end
+
       # `PG::Connection.quote_ident` needs the `pg` gem loaded, not
       # connected — required here, lazily, the same "a domain that
       # never wires PostgresEra should never need the gem" reasoning