hecks 2.3.0 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 07b56eefa1dd5cd2cc6308fa35aab4b8aba8af59da9418283d98a1235268e3c4
-  data.tar.gz: cc996a57a43dc3652a062c6af748545ec5846d50c08a43d372224e402c60fbf7
+  metadata.gz: 97edfb74e99fd94bc3ffa0d9b4b9d9a6b1fafb257431fbe1bb128fdecb4bbf33
+  data.tar.gz: 2e4741a23695049fd2639d484f9ca6476c6a89195f0c1be0c8cb5e2434a50f6f
 SHA512:
-  metadata.gz: aab93180168cb073c8f65b05697cfe8c94f68d43a0516e2f8540d0c457d2ff238173fc223006f72e1681b870dcdd86b1ae65d1883d7d5375f62207b2b4a08b6d
-  data.tar.gz: 941f1214a2f1f7a144c57e8c0fc780d5444133973170afbc1d5dd6e646c0456feaaf73ac58da9382fc0b229af37a929e15eb8b77dd0dc36216187fd2341d8e04
+  metadata.gz: 2c016c201f4217462adc98d860308cce1ed47485abae6012d3a7220e4604bc83533ad8e2c302d94aeff9b476da59eb0f9bce431a9ca36ad9be259fe6a753690c
+  data.tar.gz: a85c4aac72e327792fd65b7027fe0e07a8440ac952031351caece519952b25bd25d256722c415a3552e41869eed4eb807e9827d4a28e78de1112bb63b39d4af1

data/lib/hecks/adapters/driven/postgres.rb

@@ -580,7 +580,7 @@ module Hecks
       def numeric_field?(field)
         name, *path = field.to_s.split(".")
         QuerySpecification::FieldPath.numeric?(@aggregate.attribute(name), path) do |type|
-          @aggregate.value_object(type)
+          Runtime::Value.value_object_for(@aggregate, type)
         end
       end
 

data/lib/hecks/adapters/driven/sql_query_builder.rb

@@ -187,7 +187,7 @@ module Hecks
                    numeric ? numeric.first : nil
                  end
         member ||= if path.empty? && attribute && value_object?(attribute)
-                     object = @aggregate.value_object(attribute.type)
+                     object = Runtime::Value.value_object_for(@aggregate, attribute.type)
                      # A sole attribute is the fallback when no member is
                      # numeric — a single-attribute value object is its one
                      # field whatever that field is named (`Behaviour::
@@ -230,7 +230,7 @@ module Hecks
       end
 
       def value_object?(attr)
-        !attr.list? && !@aggregate.value_object(attr.type).nil?
+        !attr.list? && !Runtime::Value.value_object_for(@aggregate, attr.type).nil?
       end
 
       # `contains` on a `list_of` field means real element membership, not
@@ -250,7 +250,7 @@ module Hecks
         attribute = @aggregate.attribute(field.to_s)
         return nil unless attribute&.list?
 
-        object = @aggregate.value_object(attribute.type)
+        object = Runtime::Value.value_object_for(@aggregate, attribute.type)
         return "" unless object
         return object.sole_attribute.name.to_s if object.sole_attribute
 

data/lib/hecks/bluebook/dsl/policy_builder.rb

@@ -136,7 +136,8 @@ module Hecks
         #   `Runtime::PolicyInterpreter` against the triggering event's payload; never called here
         # @return [void]
         # @raise [Bluebook::DSL::Malformed] if the block's source could not be extracted, or if it
-        #   references a pattern `Expression::AstJson.refuse_unshared_patterns!` does not share
+        #   references a pattern `Expression::AstJson.refuse_unshared_patterns!` does not share, or
+        #   calls a method the expression language does not have
         def where(&predicate)
           canonical = Ports::Extraction.canonical(predicate)
 
@@ -147,8 +148,9 @@ module Hecks
           end
 
           # C3.6 — the same PatternSubset check every rule site gets.
-          Expression::AstJson.refuse_unshared_patterns!(Expression::AstJson.emit_predicate(canonical),
-                                                        owner: @name, word: "where")
+          ast = Expression::AstJson.emit_predicate(canonical)
+          Expression::AstJson.refuse_unshared_patterns!(ast, owner: @name, word: "where")
+          Expression::AstJson.refuse_unresolvable_lookups!(ast, owner: @name, word: "where")
           @where = canonical
         end
 

data/lib/hecks/bluebook/dsl/rule_reference.rb

@@ -71,7 +71,8 @@ module Hecks
         # @return [Bluebook::Given, Bluebook::Invariant] the built rule struct, an instance of
         #   `struct_class`
         # @raise [Bluebook::DSL::Malformed] if `predicate`'s source could not be extracted, or
-        #   it matches against a pattern construct `Expression::AstJson::PatternSubset` refuses
+        #   it matches against a pattern construct `Expression::AstJson::PatternSubset` refuses, or
+        #   it calls a method the expression language does not have
         def build_rule(struct_class, description, predicate, owner_name:, word:, extraction_failure:)
           canonical = Ports::Extraction.canonical(predicate)
 
@@ -81,8 +82,10 @@ module Hecks
                   "extraction — #{extraction_failure}"
           end
 
-          ast = Expression::AstJson.refuse_unshared_patterns!(Expression::AstJson.emit_predicate(canonical),
-                                                              owner: owner_name, word: "#{word} #{description.inspect}")
+          rule_word = "#{word} #{description.inspect}"
+          ast = Expression::AstJson.emit_predicate(canonical)
+          Expression::AstJson.refuse_unshared_patterns!(ast, owner: owner_name, word: rule_word)
+          Expression::AstJson.refuse_unresolvable_lookups!(ast, owner: owner_name, word: rule_word)
           struct_class.new(description: description, canonical: canonical, predicate: predicate, ast: ast)
         end
 

data/lib/hecks/bluebook/expression/ast_json.rb

@@ -131,6 +131,49 @@ module Hecks
           ast
         end
 
+        # What a `lookup` path can never contain: a call's parentheses, or an argument list's
+        # commas and spaces. Attribute names carry none of these, so a path that does is a method
+        # call with arguments that the grammar has no node for.
+        #
+        # A bare `?` is deliberately not in the set. `x.nil?` also parses as a lookup, but it loads
+        # and, on a String, Boolean or `nil` value, evaluates without raising; real bluebooks
+        # declare it, so refusing it would stop them loading.
+        UNRESOLVABLE_PATH = /[(),\s]/
+        private_constant :UNRESOLVABLE_PATH
+
+        # Refuses a rule that calls a method the expression grammar does not have.
+        #
+        # An unrecognised call such as `value.between?(100, 599)` parses as a `lookup` whose path
+        # names an attribute that can never exist, so it loads and then fails on the first
+        # dispatch. Refusing it here moves the failure to build time, where the author is looking.
+        # The supported spellings (comparisons joined with `&&`/`||`, `.positive?`, `.empty?`,
+        # `.include?`, ...) are the rows of `projection.json`.
+        #
+        # @param ast [Hash] a JSON AST node, as emitted by `emit_predicate` or `emit_bool`
+        # @param owner [String] the declaring bluebook's name, for the refusal message
+        # @param word [String] the rule's own kind and description (such as
+        #   `"invariant \"a status code\""`), for the refusal message
+        # @return [Hash] `ast`, unchanged
+        # @raise [Bluebook::DSL::Malformed] if any `lookup` node's path contains a parenthesis,
+        #   comma or whitespace
+        def refuse_unresolvable_lookups!(ast, owner:, word:)
+          return ast if Hecks::Bluebook::MetaValidator.shadow_parsing? # frozen era text is history
+
+          each_node(ast) do |node|
+            next unless node["op"] == "lookup" && node["path"].is_a?(::Array)
+
+            expression = node["path"].join(".")
+            next unless expression.match?(UNRESOLVABLE_PATH)
+
+            raise DSL::Malformed,
+                  "#{owner}'s #{word} uses #{expression.inspect}, which the expression language " \
+                  "cannot evaluate — it is not an attribute, and it is not a method the language " \
+                  "supports. Spell the test with comparisons and `&&`/`||` instead, such as " \
+                  "`value >= 100 && value <= 599` in place of `value.between?(100, 599)`"
+          end
+          ast
+        end
+
         # Every name a rule resolves at its root — the first segment of
         # each `lookup` path, unique, in first-seen order.
         #

data/lib/hecks/bluebook/meta_validator/shapes.rb

@@ -27,7 +27,7 @@ module Hecks
 
           {
             name:         text(field[:name])&.to_sym,
-            type:         owned_type(type, aggregate_id) || reference_type(type),
+            type:         owned_type(type, aggregate_id) || sibling_type(type) || reference_type(type),
             list:         text(field[:list]).to_s == "true",
             default:      decode_literal(text(field[:default])),
             # Read back the same way `list` is — both are booleans about the
@@ -60,6 +60,22 @@ module Hecks
           type.delete_prefix(prefix)
         end
 
+        # A type another aggregate of the same chapter declares, read back as its name.
+        #
+        # An attribute typed with a sibling aggregate's value object or entity is offered
+        # as that declaration's id (chapter, owning aggregate, name), three segments. A
+        # `Reference<X>` is offered as the target head's id, two segments. The extra segment
+        # is what tells a type name from a reference, so a three-segment id is the bare
+        # declaration name and only a two-segment id is a reference.
+        #
+        # @param type [String] the attribute's own dispatched `type` cell
+        # @return [String, nil] the declaration's bare name when `type` is a three-segment id;
+        #   `nil` for a head's two-segment id
+        def sibling_type(type)
+          segments = type.split(Naming::IDENTITY_JOIN)
+          segments.last if segments.size == 3
+        end
+
         # One part of an identity, read back as the path it went in as. The inverse
         # of `Marks#identity_path`, and named the same so the two directions read
         # as one table.

data/lib/hecks/corpus.rb

@@ -260,117 +260,31 @@ module Hecks
     RustDomain = Struct.new(:feature, :dir, :kind)
 
     # `check: :named_in` — `destination` must name `names`.
-    # `check: :external` — no in-repo domain directory may carry the name;
-    #                      the day one does, it belongs in rust_domains.
     Elsewhere = Struct.new(:check, :destination, :names, :why)
 
     RUST_ELSEWHERE = {
-      "meta"        => Elsewhere.new(:named_in, "spec/codegen_parity_spec.rb", "bluebook_language",
-                                     "the self-hosted grammar (lib/hecks/language), not a domain directory — every " \
-                                     "bin/project_rust run rewrites it (so the drift check diffs it), codegen parity " \
-                                     "checks it as bluebook_language, and there is no directory to fuzz"),
-      "embryonaut"  => Elsewhere.new(:external, "~/Projects/embryonautfoundersapp", "embryonaut",
-                                     "an external product's domain — its bluebook, regeneration and parity are owed " \
-                                     "by its own repo; here bin/rust_coverage checks only the committed snapshot"),
-      # Lifeadelics — same external-product shape as "embryonaut" above,
-      # first generated 2026-09-19 fixing a live era-shape-drift outage.
-      # Its directory used to be named "domain" (a generic, collision-
-      # prone Cargo feature/module name — the chapter name is, and
-      # always was, "Lifeadelics"), so the generated module and Cargo
-      # feature were "domain" too, read off `metadata.rs`'s own stamp
-      # the same way `generated_source` reads any other module's. Fixed
-      # 2026-09-20 by renaming the directory itself
-      # (~/Projects/lifeadelics/domain -> ~/Projects/lifeadelics/
-      # lifeadelics) — the generated module and Cargo feature are
-      # "lifeadelics" now, matching every other domain's own convention.
-      #
-      # Lifeadelics also attaches `newsletter`/`payments`/`membership`
-      # (its own vendored embryonaut_bluebooks packages, see
-      # RUST_EXTERNAL_VENDORED_CHAPTERS below) and `Privacy` (an in-repo
-      # framework chapter, lib/hecks/framework/bluebook/privacy.bluebook,
-      # generated into Rust for the first time by any domain here).
-      # `rust_side_chapters` only ever looks for the attaching domain
-      # among `rust_domains` — an in-repo directory — so it can attribute
-      # neither module to lifeadelics on its own; `rust_attachment_
-      # hecksagon_text`, below, reads every `:external` domain's own
-      # hecksagon files too, the same way it reads an in-repo domain's,
-      # so `Privacy`'s own bucket membership (already correct — it is a
-      # real in-repo framework member with no merged.rs) can still be
-      # proven attached.
-      "lifeadelics" => Elsewhere.new(:external, "~/Projects/lifeadelics", "lifeadelics",
-                                     "an external product's domain — its bluebook, regeneration and parity are owed " \
-                                     "by its own repo; here bin/rust_coverage checks only the committed snapshot")
+      "meta" => Elsewhere.new(:named_in, "spec/codegen_parity_spec.rb", "bluebook_language",
+                              "the self-hosted grammar (lib/hecks/language), not a domain directory — every " \
+                              "bin/project_rust run rewrites it (so the drift check diffs it), codegen parity " \
+                              "checks it as bluebook_language, and there is no directory to fuzz")
     }.freeze
 
-    # Vendored embryonaut_bluebooks packages attached only by an external
-    # RUST_ELSEWHERE domain — `members(:vendored)` can't find them
-    # itself; that glob only reaches `examples/*/vendor/
-    # embryonaut_bluebooks/*`, never an external checkout. Declared once,
-    # by hand, the same manual-commit contract "embryonaut" itself
-    # already carries: stem => the RUST_ELSEWHERE feature that attaches
-    # it. spec/corpus_rust_spec.rb checks each is really attached, the
-    # same as an in-repo vendored chapter (see
-    # `rust_external_vendored_domain_dir`, below).
-    RUST_EXTERNAL_VENDORED_CHAPTERS = {
-      "newsletter" => "lifeadelics",
-      "payments"   => "lifeadelics",
-      "membership" => "lifeadelics"
-    }.freeze
-
-    # Every external vendored chapter's own stem.
-    #
-    # @return [Array<String>] stems declared in RUST_EXTERNAL_VENDORED_CHAPTERS
-    def rust_external_vendored_chapters
-      RUST_EXTERNAL_VENDORED_CHAPTERS.keys
-    end
-
-    # Where an external vendored chapter's own bluebook lives — somewhere
-    # under `<destination>/**/vendor/embryonaut_bluebooks/<stem>`, the
-    # same layout `EmbryonautBluebook.load!` resolves for an in-repo
-    # vendored member, one level further out. Globbed rather than joined
-    # directly: `RUST_ELSEWHERE`'s own `destination` names the external
-    # product's checkout root, not necessarily the exact directory its
-    # own bluebook lives under (confirmed live against lifeadelics's own
-    # checkout: `~/Projects/lifeadelics/lifeadelics/vendor/
-    # embryonaut_bluebooks/accounts/bluebook`, one level below
-    # `~/Projects/lifeadelics` itself).
-    #
-    # @param stem [String] an external vendored chapter's stem
-    # @return [String, nil] the vendored member's own directory, or nil when none is found
-    def rust_external_vendored_domain_dir(stem)
-      feature = RUST_EXTERNAL_VENDORED_CHAPTERS.fetch(stem)
-      destination = File.expand_path(RUST_ELSEWHERE.fetch(feature).destination)
-      Dir.glob(File.join(destination, "**", "vendor", "embryonaut_bluebooks", stem)).first
-    end
-
     # Every place a Rust-facing domain's own `uses_framework`/
     # `uses_embryonaut_bluebook` attachment could be declared — every
-    # in-repo Rust domain's own hecksagon files, plus each `:external`
-    # RUST_ELSEWHERE domain's own (its `destination`, expanded, is a
-    # real checkout on this machine, read the same way an in-repo
-    # domain's own hecksagon files already are).
+    # in-repo Rust domain's own hecksagon files.
     #
     # @param root [String] repository root to search under
     # @return [String] every reachable hecksagon file's own text, joined by newlines
     def rust_attachment_hecksagon_text(root: ROOT)
-      in_repo = rust_domains(root: root).flat_map { |domain| Dir.glob(File.join(domain.dir, "**", "*.hecksagon")) }
-      external = RUST_ELSEWHERE.values.select { |route| route.check == :external }
-                               .flat_map { |route| Dir.glob(File.join(File.expand_path(route.destination), "**", "*.hecksagon")) }
-      (in_repo + external).map { |path| File.read(path) }.join("\n")
+      rust_domains(root: root).flat_map { |domain| Dir.glob(File.join(domain.dir, "**", "*.hecksagon")) }
+                              .map { |path| File.read(path) }.join("\n")
     end
 
     # **Shrink-only**. A generated module `bin/rust_coverage` still reports a
     # gap for. `bin/corpus --rust-coverage` requires each of these to
     # still fail, so an entry that starts passing breaks the build until
     # it is deleted here.
-    RUST_COVERAGE_PENDING = {
-      "newsletter"  => "query Listing declares no where clause at all, on all 3 of its own Listing queries " \
-                       "(Delivery/Issue/Subscriber) — rust/project/queries.rb's own no_wheres skip refuses " \
-                       "to generate an unfiltered per_instance Listing (\"nothing for filter_entries to " \
-                       "bake in\"); a structural Rust codegen limitation, not a bug in this vendored package",
-      "lifeadelics" => "same no_wheres gap as newsletter, on Registration.Listing — see newsletter's entry above",
-      "membership"  => "same no_wheres gap as newsletter, on Person.All — see newsletter's entry above"
-    }.freeze
+    RUST_COVERAGE_PENDING = {}.freeze
 
     # The Cargo `[features]` table's raw text.
     #
@@ -518,6 +432,22 @@ module Hecks
       rust_side_chapters(:vendored, root: root)
     end
 
+    # Chapters an in-repo Rust domain carries beside its own bluebook (a
+    # sibling `.bluebook` in the domain's directory) that `bin/project_rust`
+    # writes a module for as a side effect — a module, no merged.rs of its
+    # own. Today: `payments`, beside spec/fixtures/rust_host/checkout_fixture.
+    #
+    # @param root [String] repository root to search under
+    # @return [Array<String>] generated module names with no merged.rs of their own
+    def rust_sibling_chapters(root: ROOT)
+      modules = generated_modules(root: root)
+      rust_domains(root: root)
+        .flat_map { |domain| Dir.glob(File.join(domain.dir, "bluebook", "*.bluebook")) }
+        .map { |path| Naming.pascal(File.basename(path, ".bluebook")).downcase }
+        .uniq
+        .select { |name| modules.include?(name) && !generated?(name, root: root) }
+    end
+
     # THE REGENERATION ORDER the drift check runs. Sorted by path, so
     # which domain runs last — and so wins Cargo's `default`, mod.rs's cfg
     # comments and the shared framework modules' attribution stamp — is a

data/lib/hecks/fuzzing/isolated_boot.rb

@@ -130,10 +130,23 @@ module Hecks
       # rebind! rewrites files in it and must not reach back through a
       # link into the real tree.
       #
+      # The vendored bluebook packages the domain's hecksagons name with
+      # `uses_embryonaut_bluebook` are carried too — see `carry_vendored_bluebooks!`.
+      #
       # @param source [String] the real domain directory to copy
       # @param destination [String] the tmpdir path to copy it into; created if missing
       # @return [void]
       def copy_dereferencing(source, destination)
+        copy_files(source, destination)
+        carry_vendored_bluebooks!(source, destination)
+      end
+
+      # Copies every file under `source` into `destination`, following symlinks.
+      #
+      # @param source [String] the directory to copy
+      # @param destination [String] the path to copy it into; created if missing
+      # @return [void]
+      def copy_files(source, destination)
         FileUtils.mkdir_p(destination)
         Dir.glob(File.join(source, "**", "*"), File::FNM_DOTMATCH).each do |path|
           next if [".", ".."].include?(File.basename(path))
@@ -156,6 +169,33 @@ module Hecks
         end
       end
 
+      # Copies the vendored bluebook packages the copy's hecksagons name into
+      # the place a boot of the copy looks for them.
+      #
+      # `Hecks.boot` roots a registry at the parent of the directory it boots,
+      # and `uses_embryonaut_bluebook "<name>"` loads from
+      # `<root>/vendor/embryonaut_bluebooks/<name>/bluebook` (see
+      # `EmbryonautBluebook.load!`). The copy holds only the domain directory,
+      # so without this a target that vendors a package crashed the boot with
+      # "no vendored embryonaut bluebook named ...". Only the packages a
+      # hecksagon names are copied, never the rest of `vendor/`. A package the
+      # source root does not have is skipped, so the boot's own error stands.
+      #
+      # @param source [String] the real domain directory
+      # @param destination [String] the copy's directory; its parent is the copy's root
+      # @return [void]
+      def carry_vendored_bluebooks!(source, destination)
+        names = Dir.glob(File.join(destination, "**", "*.hecksagon")).flat_map do |path|
+          File.read(path).scan(/uses_embryonaut_bluebook\s*\(?\s*"([\w-]+)"/).flatten
+        end
+        names.uniq.each do |name|
+          package = File.join(File.dirname(source), "vendor", "embryonaut_bluebooks", name)
+          next unless File.directory?(package)
+
+          copy_files(package, File.join(File.dirname(destination), "vendor", "embryonaut_bluebooks", name))
+        end
+      end
+
       # Rewrites every `.hecksagon` in the copy to bind through Memory and drops its
       # `.world` files, so the boot needs no settings at all.
       #
@@ -531,7 +571,8 @@ module Hecks
       end
 
       # Rewrites every `persisted_by` bind — aggregate-scoped or bare at the
-      # hecksagon's own root — in the copy's `.hecksagon` files to name `adapter_name`,
+      # hecksagon's own root, naming its adapter as a literal or through a local
+      # variable — in the copy's `.hecksagon` files to name `adapter_name`,
       # and drops every `projected_by` bind outright.
       #
       # @param copy [String] the isolated copy's root directory
@@ -541,7 +582,8 @@ module Hecks
       def rewrite_bindings!(copy, adapter_name)
         Dir.glob(File.join(copy, "**", "*.hecksagon")).each do |path|
           lines = File.readlines(path).grep_v(/\bprojected_by\s*\(?\s*"/)
-          File.write(path, lines.join.gsub(/persisted_by\s*\(?\s*"[^"]+"\s*\)?/, "persisted_by(\"#{adapter_name}\")"))
+          bind = /persisted_by\s*\(?\s*(?:"[^"]+"|[a-z_]\w*)\s*\)?/
+          File.write(path, lines.join.gsub(bind, "persisted_by(\"#{adapter_name}\")"))
         end
       end
     end

data/lib/hecks/fuzzing/sequence_generator/catalog.rb

@@ -47,6 +47,9 @@ module Hecks
           { creating: creating, instance: instance, entity_commands: entity_commands,
             queries: queries, entity_queries: entity_queries, read_models: read_models,
             populators: populators(runtime),
+            # The aggregates a query filters on, and the fields it compares
+            # (query_binding.rb).
+            query_bindings: build_query_bindings(runtime),
             # Every `role "..."` any command in the boot declares — the
             # "wrong hat" pool the caller draw's `mismatched` shape picks
             # from (adversary.rb `other_role`).

data/lib/hecks/fuzzing/sequence_generator/query_binding.rb

@@ -0,0 +1,138 @@
+require_relative "../../query_specification/field_path"
+require_relative "../../runtime/value"
+
+module Hecks
+  module Fuzzing
+    class SequenceGenerator
+      # Query arguments drawn from what the sequence has already written.
+      #
+      # A query is only a real test of an adapter when its argument names a row
+      # that exists. A `where(site_reference: :site_reference)` asked with a
+      # freshly generated word matches nothing on every adapter, so an adapter
+      # that compiles the comparison wrongly (and so also matches nothing) is
+      # indistinguishable from a correct one. Every argument `args_for` draws
+      # is independent of the store, and the chance that one lands on a stored
+      # value is small enough that a whole persistence-parity sweep can pass
+      # without a single query returning a row.
+      #
+      # ## What is written, and what is bound
+      #
+      # After each command that took effect, every aggregate a query filters
+      # on is read back from the repository, and the values of exactly the
+      # fields those queries compare (`bound_fields`) are remembered as one
+      # row per record. A row is what the store holds, not what a command was
+      # given, so a value a `sets` mapping renamed, a policy wrote in another
+      # aggregate, or a lifecycle transition assigned is covered too. A later
+      # query step usually takes its arguments from one remembered row, so
+      # several parameters filter the same record. The rest of the time it
+      # keeps the generated argument, which is what reaches the empty answer.
+      #
+      # ## Why a separate random stream
+      #
+      # The choice draws from its own `Random`, seeded from the sequence's
+      # seed and restarted wherever `@random` is (`restart_random`). Drawing
+      # from `@random` would shift every later step of every seed. This way
+      # each seed generates the same commands, in the same order, with the
+      # same arguments as before, and only the arguments of a query step
+      # change. A query changes no state, so nothing downstream moves.
+      module QueryBinding
+        # How often a query step whose aggregate has written rows takes its
+        # arguments from one of them. High, because a query that misses a
+        # stored row tests nothing, and the miss is still drawn the other
+        # quarter of the time.
+        BOUND_QUERY_PROBABILITY = 0.75
+
+        # Comparators whose argument is one scalar or value, so a stored value
+        # is a legitimate operand. `in` takes a list and `none_in_state` an
+        # `"Aggregate:state"` string; a stored value is neither.
+        BINDABLE_OPERATORS = %i[eq ne lt lte gt gte].freeze
+
+        # Keeps the binding stream apart from `@random`'s, which is seeded
+        # with the bare seed.
+        BINDING_SEED_OFFSET = 0x9e3779b1
+
+        private
+
+        # `{"Domain::Aggregate" => {domain:, aggregate:, fields: [String]}}`
+        # for every aggregate some query filters on, where `fields` is the
+        # union of the stored fields those queries compare.
+        def build_query_bindings(runtime)
+          runtime.registry.bluebooks.each_with_object({}) do |(domain_name, bluebook), bindings|
+            bluebook.aggregates.each do |aggregate|
+              fields = aggregate.queries.flat_map { |query| bound_fields(query).values }.uniq
+              next if fields.empty?
+
+              bindings["#{domain_name}::#{aggregate.hecks_name}"] =
+                { domain: domain_name, aggregate: aggregate, fields: fields }
+            end
+          end
+        end
+
+        # `{parameter name => stored field}` for each `where` clause whose
+        # operand is one of the query's own parameters. A clause on a literal,
+        # or aimed at another aggregate's field (`target`), binds nothing.
+        def bound_fields(query)
+          query.wheres.each_with_object({}) do |clause, fields|
+            next unless clause.value.is_a?(Symbol) && clause.target.nil?
+            next unless BINDABLE_OPERATORS.include?(clause.op.to_sym)
+
+            fields[clause.value.to_s] ||= clause.field.to_s
+          end
+        end
+
+        # Remembers the compared fields of every stored record of every
+        # aggregate a query filters on, as one row per distinct record shape.
+        def harvest_written_rows(runtime, catalog)
+          catalog[:query_bindings].each do |key, binding|
+            repository = runtime.registry.repository(binding[:domain], binding[:aggregate])
+            repository.all.each do |record|
+              row = binding[:fields].to_h { |field| [field, written_value(field_of(record, field))] }.compact
+              @written_rows[key] << row unless row.empty? || @written_rows[key].include?(row)
+            end
+          end
+        end
+
+        def field_of(record, field) = QuerySpecification::FieldPath.dig(record.state, field)
+
+        # A stored value as the JSON-shaped argument a step carries: string
+        # keys, nested values opened. `nil` for anything a query argument
+        # cannot be (a missing value, a list, a timestamp object).
+        def written_value(value)
+          case value
+          when Runtime::Value then written_value(value.to_h)
+          when Hash           then value.to_h { |key, inner| [key.to_s, written_value(inner)] }
+          when String, Integer, Float, true, false then value
+          end
+        end
+
+        # Replaces the generated arguments of a query step with a remembered
+        # row's, most of the time. Only a parameter the step already carries
+        # is replaced, so an optional argument left out, or a required one a
+        # malformation dropped, stays that way.
+        def bind_to_written_row!(args, entry)
+          return if entry[:entity]
+
+          rows   = @written_rows[entry[:verb].split(".").first]
+          params = bound_fields(entry[:query]).select { |param, _| args.key?(param) }
+          return if rows.empty? || params.empty?
+          return unless @binding_random.rand < BOUND_QUERY_PROBABILITY
+
+          row = rows.select { |candidate| params.values.any? { |field| candidate.key?(field) } }
+                    .sample(random: @binding_random)
+          params.each do |param, field|
+            args[param] = shaped_like(args[param], row[field]) if row&.key?(field)
+          end
+        end
+
+        # A single-field value object is written `{"value" => x}` but may be
+        # asked with the bare `x`; keeps whichever spelling the generator
+        # already chose for this argument.
+        def shaped_like(current, written)
+          return written unless written.is_a?(Hash) && written.size == 1 && !current.is_a?(Hash)
+
+          written.values.first
+        end
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/sequence_generator/step_builder.rb

@@ -16,6 +16,7 @@ module Hecks
 
         def build_query_step(runtime, entry)
           args = args_for(entry[:query].attributes, entry[:aggregate])
+          bind_to_written_row!(args, entry)
           safe_call { runtime.query(entry[:verb], **symbolize(args)) }
           { "query" => entry[:verb], "args" => args }
         end
@@ -80,6 +81,7 @@ module Hecks
               outcome = safe_call { as_caller(caller) { runtime.dispatch_flat(entry[:verb], symbolize(args)) } }
               if outcome
                 record_outcome(catalog, entry, args)
+                harvest_written_rows(runtime, catalog)
                 @event_count += outcome.events.length
               end
               { "verb" => entry[:verb], "args" => args }

data/lib/hecks/fuzzing/sequence_generator.rb

@@ -7,6 +7,7 @@ require_relative "sequence_generator/catalog"
 require_relative "sequence_generator/picker"
 require_relative "sequence_generator/step_builder"
 require_relative "sequence_generator/outcome_tracker"
+require_relative "sequence_generator/query_binding"
 require_relative "sequence_generator/adversary"
 
 module Hecks
@@ -30,14 +31,16 @@ module Hecks
     # One concern per file beside this one: what the domain offers
     # (sequence_generator/catalog.rb), which step to try next (picker.rb),
     # how a step is built and dispatched (step_builder.rb), what a
-    # success taught us (outcome_tracker.rb), and — opt-in, `adversarial:`
-    # — the argument shapes real Ruby/Rust divergences were found through
+    # success taught us (outcome_tracker.rb), which stored values a query is
+    # asked about (query_binding.rb), and — opt-in, `adversarial:` — the
+    # argument shapes real Ruby/Rust divergences were found through
     # (adversary.rb).
     class SequenceGenerator
       include Catalog
       include Picker
       include StepBuilder
       include OutcomeTracker
+      include QueryBinding
       include Adversary
 
       # Creating commands are always eligible ; weighting them heavier (not
@@ -187,10 +190,13 @@ module Hecks
         @adversarial         = adversarial.to_f
         @role_draw           = role_draw.to_f
         @dry_run             = dry_run.to_f
-        @random              = Random.new(seed)
+        restart_random(seed)
         @known_ids           = Hash.new { |h, k| h[k] = [] }
         @entity_known_ids    = Hash.new { |h, k| h[k] = [] }
         @appended_identities = Hash.new { |h, k| h[k] = [] }
+        # "Domain::Aggregate" => the rows this sequence has stored that a
+        # query filters on (query_binding.rb).
+        @written_rows        = Hash.new { |h, k| h[k] = [] }
         # Role => [actor ids] this sequence's own successful
         # `Governance::RoleAssignment.Assign` steps granted — what the
         # `actor_known` caller shape draws from (adversary.rb).
@@ -228,8 +234,8 @@ module Hecks
           steps = []
           if @prefix
             realize_prefix(runtime, catalog, @prefix, prefix_limit(@prefix), steps)
-            @random = Random.new(@seed)
-            @favor  = @own_favor
+            restart_random(@seed)
+            @favor = @own_favor
           end
           @step_count.times { steps << attempt_step(runtime, catalog) }
           steps.compact
@@ -257,12 +263,19 @@ module Hecks
 
         inner = spec["prefix"]
         used  = inner ? realize_prefix(runtime, catalog, inner, [prefix_limit(inner), limit].min, steps) : 0
-        @random = Random.new(Integer(spec.fetch("seed")))
-        @favor  = Array(spec["favor"])
+        restart_random(Integer(spec.fetch("seed")))
+        @favor = Array(spec["favor"])
         (limit - used).times { steps << attempt_step(runtime, catalog) }
         limit
       end
 
+      # Both random streams start over together, so a prefix replay draws the
+      # same query bindings the prefix seed's own generation did.
+      def restart_random(seed)
+        @random         = Random.new(seed)
+        @binding_random = Random.new(seed + QueryBinding::BINDING_SEED_OFFSET)
+      end
+
       def prefix_limit(spec) = Integer(spec.fetch("steps")).clamp(0, @step_count)
 
       def attempt_step(runtime, catalog)

data/lib/hecks/fuzzing/target_capabilities.rb

@@ -49,6 +49,11 @@ module Hecks
       # domain-level default (`persisted_by "PostgresEra"`).
       POSTGRES_ERA_BINDING = /persisted_by\s*\(?\s*"PostgresEra"/
 
+      # A local variable assigned the bare literal `"PostgresEra"` on a line of
+      # its own (`adapter = "PostgresEra"`). Only the whole-line literal counts:
+      # a ternary or any other right-hand side is not a PostgresEra binding.
+      POSTGRES_ERA_VARIABLE = /^\s*([a-z_]\w*)\s*=\s*"PostgresEra"\s*(?:#.*)?$/
+
       # `HecksagonBuilder#uses_framework "X"` — captures which member a
       # hecksagon attaches, whatever its name. Whether that member answers
       # a role check is then read off its own declaration (`provides
@@ -141,7 +146,7 @@ module Hecks
       def infer(domain_path, rust_dir: File.expand_path("../../../rust", __dir__))
         capabilities = %w[sqlite]
         capabilities << "rust" if rust_feature?(domain_path, rust_dir)
-        capabilities << "postgres_era" if any_file?(domain_path, "*.hecksagon", POSTGRES_ERA_BINDING)
+        capabilities << "postgres_era" if postgres_era_bound?(domain_path)
         capabilities << "translations" if Dir.glob(File.join(domain_path, "**", "translations", "*.bluebook")).any?
         capabilities << "governance" if authorization_attached?(domain_path)
         capabilities << "role_gated" if any_file?(domain_path, "*.bluebook", ROLE_GATED)
@@ -194,6 +199,29 @@ module Hecks
         features.match?(/^#{Regexp.escape(feature)}\s*=\s*\[\]/)
       end
 
+      # Answers whether any `.hecksagon` under `domain_path` binds PostgresEra,
+      # either with the literal name or through a local variable that the same
+      # file assigned `"PostgresEra"` and then passed to `persisted_by`.
+      #
+      # @param domain_path [String] filesystem path to the target domain's directory
+      # @return [Boolean] whether a PostgresEra `persisted_by` binding is found
+      def postgres_era_bound?(domain_path)
+        Dir.glob(File.join(domain_path, "**", "*.hecksagon")).any? do |path|
+          text = File.read(path)
+          text.match?(POSTGRES_ERA_BINDING) || postgres_era_variable_bound?(text)
+        end
+      end
+
+      # Answers whether `text` passes a variable assigned `"PostgresEra"` to `persisted_by`.
+      #
+      # @param text [String] the contents of one `.hecksagon` file
+      # @return [Boolean] whether some `persisted_by` call names such a variable
+      def postgres_era_variable_bound?(text)
+        text.scan(POSTGRES_ERA_VARIABLE).flatten.any? do |name|
+          text.match?(/persisted_by\s*\(?\s*#{Regexp.escape(name)}(?!\w)/)
+        end
+      end
+
       # Answers whether any `.hecksagon` under `domain_path` attaches a member
       # that provides authorization.
       #

data/lib/hecks/ports/persistence/plugins/era/postgres_era.rb

@@ -900,7 +900,7 @@ module Hecks
       def numeric_field?(field)
         name, *path = field.to_s.split(".")
         QuerySpecification::FieldPath.numeric?(@aggregate.attribute(name), path) do |type|
-          @aggregate.value_object(type)
+          Runtime::Value.value_object_for(@aggregate, type)
         end
       end
 

data/lib/hecks/projections/glossary/html.rb

@@ -269,7 +269,8 @@ module Hecks
           when :mermaid
             parts << figure(block, state.delete(:caption))
           when :list
-            parts << "<p class=\"caption\">#{escape(state[:caption])}</p>" if state.delete(:caption)
+            caption = state.delete(:caption)
+            parts << "<p class=\"caption\">#{escape(caption)}</p>" if caption
             parts << "<ul class=\"rules\">#{block.items.map { |item| "<li>#{inline(item)}</li>" }.join}</ul>"
           when :quote
             parts << "<p class=\"about\">#{inline(block.text)}</p>"

data/lib/hecks/projections/glossary/markdown.rb

@@ -1,4 +1,5 @@
 require_relative "sections"
+require_relative "sensitivity"
 require_relative "sentences"
 require_relative "mermaid"
 require_relative "../statements"
@@ -77,7 +78,12 @@ module Hecks
         # @return [String] the section's Markdown source
         def section_text(section, document)
           parts = ["## #{section.title}"]
-          parts += section.aggregate ? opening(section.aggregate, document.bluebook) : ["> #{STANDING[section.name]}"]
+          parts += if section.aggregate
+                     marked = Sensitivity.for_aggregate(document.markings, document.bluebook.name, section.aggregate)
+                     opening(section.aggregate, document.bluebook, marked)
+                   else
+                     ["> #{STANDING[section.name]}"]
+                   end
           parts += section.terms.map { |entry| term_text(entry, document.index) }
           parts.join("\n\n")
         end
@@ -88,9 +94,11 @@ module Hecks
         # @param aggregate [Bluebook::Aggregate] the aggregate to render an opening for
         # @param bluebook [Bluebook::Behaviour::Chapter] the chapter `aggregate` belongs
         #   to, for drawing its context diagram
+        # @param marked [Array<Hash{Symbol => String}>] the markings that flag
+        #   `aggregate`'s own fields sensitive, listed after its rules
         # @return [Array<String>] the opening's Markdown blocks, one per paragraph or
         #   diagram, not yet joined
-        def opening(aggregate, bluebook)
+        def opening(aggregate, bluebook, marked = [])
           parts = []
           parts << "> #{aggregate.description}" if aggregate.description
           parts << Sentences.lifecycle_sentence(aggregate.lifecycle) if aggregate.lifecycle
@@ -98,6 +106,10 @@ module Hecks
           parts << "**How it moves**" << fence(Mermaid.lifecycle(aggregate)) if aggregate.lifecycle
           statements = always_true(aggregate, bluebook)
           parts << "**Always true**" << statements.map { |statement| "- #{statement}" }.join("\n") unless statements.empty?
+          unless marked.empty?
+            lines = marked.map { |marking| "- #{Sensitivity.sentence(marking)}" }
+            parts << "**Handled as sensitive**" << lines.join("\n")
+          end
           parts
         end
 

data/lib/hecks/projections/glossary/sensitivity.rb

@@ -0,0 +1,67 @@
+require_relative "../../naming"
+
+module Hecks
+  module Projections
+    module Glossary
+      # **The sensitive fields a glossary flags** — read from the markings a
+      # deployment declares apart from the domain (`Privacy::Marking`, or a
+      # `has_phi(readable_by:)` chain in a `.hecksagon`) and handed in as
+      # `options[:markings]`. A marking names an aggregate by its qualified
+      # name (`"Lifeadelics::Registration"`) and a field by its dotted path
+      # (`"attendee.medications"`). Its category is spoken as the acronym it
+      # is, uppercased and never reworded, because the category vocabulary is
+      # the deployment's own and open-ended.
+      module Sensitivity
+        module_function
+
+        # The markings that name one aggregate of the chapter.
+        #
+        # @param markings [Array<Hash{Symbol => String}>] every marking handed in, each
+        #   with `:domain`, `:attribute_path`, `:category` and `:readable_by`
+        # @param chapter_name [String] the chapter's declared name
+        # @param aggregate [Bluebook::Aggregate] the aggregate to find markings for
+        # @return [Array<Hash{Symbol => String}>] the markings whose `:domain` is
+        #   `aggregate`'s qualified name, in the order they were declared
+        def for_aggregate(markings, chapter_name, aggregate)
+          qualified = "#{chapter_name}::#{aggregate.hecks_name}"
+          markings.select { |marking| marking[:domain].to_s == qualified }
+        end
+
+        # The marked fields inside one value object, reached through whichever of
+        # the aggregate's attributes holds that value object.
+        #
+        # @param marked [Array<Hash{Symbol => String}>] the aggregate's own markings
+        # @param aggregate [Bluebook::Aggregate] the aggregate holding the value object
+        # @param value_object [Bluebook::ValueObject] the value object to look inside
+        # @return [Hash{String => Hash{Symbol => String}}] each marked field's name,
+        #   mapped to its marking; empty when no marking reaches one of its fields
+        def for_value_object(marked, aggregate, value_object)
+          holders = aggregate.attributes.select { |attribute| attribute.type.to_s == value_object.hecks_name }
+          holder_names = holders.map { |attribute| attribute.name.to_s }
+          marked.each_with_object({}) do |marking, tagged|
+            head, field, *deeper = marking[:attribute_path].to_s.split(".")
+            tagged[field] = marking if field && deeper.empty? && holder_names.include?(head)
+          end
+        end
+
+        # The short tag a marked field carries beside its type.
+        #
+        # @param marking [Hash{Symbol => String}] one marking
+        # @return [String] the marking's category, uppercased
+        def tag(marking) = marking[:category].to_s.upcase
+
+        # One line of an aggregate's "Handled as sensitive" list: which field, what
+        # kind of sensitive, and who may read it unredacted.
+        #
+        # @param marking [Hash{Symbol => String}] one marking
+        # @return [String] the field's spoken path, its uppercased category, and the
+        #   role that reads it unredacted, as one sentence
+        def sentence(marking)
+          path = marking[:attribute_path].to_s.split(".").map { |part| Naming.words(part).downcase }.join(" ")
+          reader = Naming.words(marking[:readable_by]).downcase
+          "#{path.sub(/\A[[:lower:]]/, &:upcase)}: #{tag(marking)}, read unredacted only by the #{reader}."
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/glossary/sentences.rb

@@ -1,5 +1,6 @@
 require_relative "../../naming"
 require_relative "../statements"
+require_relative "sensitivity"
 
 module Hecks
   module Projections
@@ -39,7 +40,7 @@ module Hecks
           facts = entry.facts
           case entry.kind
           when :entity       then holder_paragraphs(facts[:entity])
-          when :value_object then value_object_paragraphs(facts[:value_object], index, entry.within)
+          when :value_object then value_object_paragraphs(facts[:value_object], index, entry.within, facts.fetch(:sensitive, {}))
           when :command      then [command_sentence(facts[:command])]
           when :query        then [facts[:query].description]
           when :event        then [event_sentence(facts, index)]
@@ -82,11 +83,13 @@ module Hecks
         # @param index [Glossary::Index] the document's link index
         # @param within [String, nil] the value object's own holder's name, for
         #   resolving a nested value object's own type link
+        # @param sensitive [Hash{String => Hash{Symbol => String}}] each marked field's
+        #   name, mapped to its marking (as `Sensitivity.for_value_object` builds)
         # @return [Array<String>] the value object's definition sentence, then its
         #   "Always true: …" rules line; the rules line is absent when it has none
-        def value_object_paragraphs(value_object, index, within)
+        def value_object_paragraphs(value_object, index, within, sensitive = {})
           rules = value_object.invariants.map { |invariant| Statements.invariant_statement(invariant) }
-          [value_object_sentence(value_object, index, within), rules_line(rules)].compact
+          [value_object_sentence(value_object, index, within, sensitive), rules_line(rules)].compact
         end
 
         # A one-field object whose field is just "value" is its type —
@@ -95,8 +98,10 @@ module Hecks
         # @param value_object [Bluebook::ValueObject] the value object to describe
         # @param index [Glossary::Index] the document's link index
         # @param within [String, nil] the value object's own holder's name
+        # @param sensitive [Hash{String => Hash{Symbol => String}}] each marked field's
+        #   name, mapped to its marking
         # @return [String] the value object's definition sentence
-        def value_object_sentence(value_object, index, within)
+        def value_object_sentence(value_object, index, within, sensitive = {})
           return closed_set_sentence(value_object.members) if value_object.closed_set?
           return "A marker with no details of its own." if value_object.attributes.empty?
 
@@ -105,19 +110,23 @@ module Hecks
             return "#{upper_first(type_words(only, index, within))}."
           end
 
-          fields = value_object.attributes.map { |field| field_phrase(field, index, within) }
+          fields = value_object.attributes.map { |field| field_phrase(field, index, within, sensitive[field.name.to_s]) }
           "Made up of #{Naming.to_sentence_list(fields)}."
         end
 
         # "amount (a whole number)" — the field as the author named it,
-        # then what kind of thing goes in it.
+        # then what kind of thing goes in it, then the tag of any marking
+        # that flags it sensitive: "medications (text, PHI)".
         #
         # @param field [Bluebook::Attribute] the field to describe
         # @param index [Glossary::Index] the document's link index
         # @param within [String, nil] the field's own holder's name
-        # @return [String] the field's name, spoken, with its type in parentheses
-        def field_phrase(field, index, within)
-          "#{Naming.words(field.name).downcase} (#{type_words(field, index, within)})"
+        # @param marking [Hash{Symbol => String}, nil] the marking that flags `field`
+        #   sensitive, if any
+        # @return [String] the field's name, spoken, with its type (and tag) in parentheses
+        def field_phrase(field, index, within, marking = nil)
+          detail = [type_words(field, index, within), (Sensitivity.tag(marking) if marking)].compact.join(", ")
+          "#{Naming.words(field.name).downcase} (#{detail})"
         end
 
         # Describes one field's type in plain words.

data/lib/hecks/projections/glossary.rb

@@ -2,6 +2,7 @@ require_relative "../projector"
 require_relative "../naming"
 require_relative "statements"
 require_relative "glossary/sections"
+require_relative "glossary/sensitivity"
 require_relative "glossary/sentences"
 require_relative "glossary/mermaid"
 require_relative "glossary/markdown"
@@ -59,7 +60,7 @@ module Hecks
       # the lede and diagrams) or one of the three trailing groups.
       Section = Struct.new(:name, :title, :aggregate, :terms, :slug, keyword_init: true)
 
-      Document = Struct.new(:bluebook, :sections, :index, keyword_init: true)
+      Document = Struct.new(:bluebook, :sections, :index, :markings, keyword_init: true)
 
       module_function
 
@@ -68,11 +69,15 @@ module Hecks
       #
       # @param bluebook [Bluebook::Behaviour::Chapter] the chapter to render a
       #   glossary for
-      # @param options [Hash] unused; accepted to satisfy the registry's call shape
+      # @param options [Hash] the registry's call shape
+      # @option options [Array<Hash{Symbol => String}>] :markings the sensitive fields a
+      #   deployment declares (`registry.pending_privacy_markings`' own shape); each
+      #   marked field is tagged with its category, and every marking is listed under
+      #   its aggregate. Absent, the glossary says nothing about sensitivity.
       # @return [Hash{String => String}] `"glossary.md"` and `"html/index.html"`,
       #   each mapped to its rendered content
       def call(bluebook:, options: {})
-        markdown = Markdown.render(document(bluebook))
+        markdown = Markdown.render(document(bluebook, Array(options[:markings])))
         { "glossary.md" => markdown, "html/index.html" => Html.render(markdown) }
       end
 
@@ -82,11 +87,13 @@ module Hecks
       # slugs, and builds the index links resolve through.
       #
       # @param bluebook [Bluebook::Behaviour::Chapter] the chapter to render
+      # @param markings [Array<Hash{Symbol => String}>] the sensitive fields declared for
+      #   the chapter's aggregates; empty when none are
       # @return [Document] the fully assembled document, ready for `Markdown.render`
-      def document(bluebook)
-        sections = sections(bluebook, entries(bluebook))
+      def document(bluebook, markings = [])
+        sections = sections(bluebook, entries(bluebook, markings))
         Slugs.assign!(bluebook, sections)
-        Document.new(bluebook: bluebook, sections: sections, index: Index.new(sections))
+        Document.new(bluebook: bluebook, sections: sections, index: Index.new(sections), markings: markings)
       end
 
       # Aggregates first, a to Z by their spoken name ("Account" before
@@ -197,16 +204,18 @@ module Hecks
       # Gathers every term the glossary carries, ungrouped and unordered.
       #
       # @param bluebook [Bluebook::Behaviour::Chapter] the chapter to gather terms from
+      # @param markings [Array<Hash{Symbol => String}>] the sensitive fields declared for
+      #   the chapter's aggregates
       # @return [Array<Entry>] one entry per entity, value object, command, query,
       #   event, policy, saga, role, and read model
-      def entries(bluebook)
+      def entries(bluebook, markings = [])
         homes   = holder_aggregate(bluebook)
         raisers = event_raisers(bluebook)
         home_of = ->(event) { raisers.key?(event) ? homes[raisers[event].first.first.hecks_name] : nil }
 
         entries = []
         entries += entity_entries(bluebook)
-        entries += value_object_entries(bluebook)
+        entries += value_object_entries(bluebook, markings)
         entries += verb_entries(bluebook, homes)
         entries += event_entries(bluebook, raisers, home_of)
         entries += policy_entries(bluebook, home_of)
@@ -234,13 +243,18 @@ module Hecks
       #
       # @param bluebook [Bluebook::Behaviour::Chapter] the chapter to gather value
       #   objects from
+      # @param markings [Array<Hash{Symbol => String}>] the sensitive fields declared for
+      #   the chapter's aggregates, each carried onto the value object it reaches into
       # @return [Array<Entry>] one `:value_object`-kind entry per aggregate-declared
       #   value object
-      def value_object_entries(bluebook)
+      def value_object_entries(bluebook, markings = [])
         bluebook.aggregates.flat_map do |aggregate|
+          marked = Sensitivity.for_aggregate(markings, bluebook.name, aggregate)
           aggregate.value_objects.map do |value_object|
+            sensitive = Sensitivity.for_value_object(marked, aggregate, value_object)
             Entry.new(name: value_object.hecks_name, kind: :value_object, within: aggregate.hecks_name,
-                      section: aggregate.hecks_name, facts: { value_object: value_object })
+                      section: aggregate.hecks_name,
+                      facts: { value_object: value_object, sensitive: sensitive })
           end
         end
       end

data/lib/hecks/version.rb

@@ -12,5 +12,5 @@ module Hecks
   # it there, or even in the consuming Gemfile, never closed the gap,
   # because gemspec evaluation happens before anything Bundler
   # resolves is actually loadable yet.
-  VERSION = "2.3.0".freeze
+  VERSION = "2.4.0".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.4.0
 platform: ruby
 authors:
 - Chris Young
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-25 00:00:00.000000000 Z
+date: 2026-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prism
@@ -262,6 +262,7 @@ files:
 - lib/hecks/fuzzing/sequence_generator/catalog.rb
 - lib/hecks/fuzzing/sequence_generator/outcome_tracker.rb
 - lib/hecks/fuzzing/sequence_generator/picker.rb
+- lib/hecks/fuzzing/sequence_generator/query_binding.rb
 - lib/hecks/fuzzing/sequence_generator/step_builder.rb
 - lib/hecks/fuzzing/shrinker.rb
 - lib/hecks/fuzzing/structural_skips.rb
@@ -389,6 +390,7 @@ files:
 - lib/hecks/projections/glossary/page.css
 - lib/hecks/projections/glossary/page.js
 - lib/hecks/projections/glossary/sections.rb
+- lib/hecks/projections/glossary/sensitivity.rb
 - lib/hecks/projections/glossary/sentences.rb
 - lib/hecks/projections/ir.rb
 - lib/hecks/projections/model.rb