hecks 2.8.0 → 3.0.0

data/lib/hecks/runtime/adapter_lookup.rb

@@ -0,0 +1,124 @@
+require_relative "errors"
+
+module Hecks
+  module Runtime
+    # Finds the one adapter this boot loaded for a port name.
+    #
+    # Shared by the port-operation interpreter (an aggregate asking out) and the query interpreter
+    # (a query answered by a port), so both refuse the same way when nothing, or too much,
+    # implements the port.
+    module AdapterLookup
+      @stand_in = nil
+
+      module_function
+
+      # Modules whose instance methods every object inherits; a method they own answers no query.
+      INHERITED_OWNERS = [Object, Kernel, BasicObject].freeze
+
+      # Answers every port with a stand-in instead of its adapter while the block runs, for a
+      # caller that must not reach what the adapters reach (the fuzzer replays a domain whose
+      # adapters run shells and write files). Boot still checks the real adapters' classes; only
+      # what `call` hands out changes.
+      #
+      # @param stand_in [#call] answers `(port_name, asked)` with the object to ask instead
+      # @yield the work to run with the stand-in in place
+      # @return [Object] what the block answers
+      def standing_in(stand_in)
+        previous = @stand_in
+        @stand_in = stand_in
+        yield
+      ensure
+        @stand_in = previous
+      end
+
+      # @param registry [Runtime::Registry] the booted registry whose adapters are searched
+      # @param port_name [String] the port's name as an adapter declares it
+      # @param asked [String] what is being asked, worded into a refusal
+      # @return [Object] a new instance of the port's only adapter, or the stand-in for it
+      # @raise [Runtime::WiringError] if no adapter, or more than one, implements the port
+      def call(registry, port_name, asked:)
+        adapter_class(registry, port_name, asked: asked)
+        return @stand_in.call(port_name, asked) if @stand_in
+
+        adapter_class(registry, port_name, asked: asked).new
+      end
+
+      # Finds the class of the one adapter this boot loaded for a port name, without building it,
+      # so boot can check what the adapter answers before anything asks it.
+      #
+      # @param registry [Runtime::Registry] the booted registry whose adapters are searched
+      # @param port_name [String] the port's name as an adapter declares it
+      # @param asked [String] what is being asked, worded into a refusal
+      # @return [Class] the port's only adapter
+      # @raise [Runtime::WiringError] if no adapter, or more than one, implements the port
+      def adapter_class(registry, port_name, asked:)
+        implementations = registry.adapters.values.select { |adapter| adapter.port == port_name }
+
+        case implementations.size
+        when 1 then Adapters.const_get(implementations.first.name)
+        when 0 then raise WiringError, "no adapter implements the #{port_name} port — nothing can answer #{asked}"
+        else raise WiringError,
+                   "#{implementations.size} adapters implement the #{port_name} port " \
+                   "(#{implementations.map(&:name).sort.join(', ')}) — the runtime will not choose for you"
+        end
+      end
+
+      # Checks that an adapter class can be built with a bare `.new` and answers a query: it
+      # defines the method itself (not inherited from Object or Kernel, so a query named `hash` or
+      # `display` is not answered by them) and takes exactly the query's arguments as keywords.
+      #
+      # @param klass [Class] the adapter class {adapter_class} found
+      # @param port_name [String] the port's name, worded into a refusal
+      # @param method [String] the snake-cased query name the adapter is asked by
+      # @param query [Bluebook::Query] the declared query whose arguments the method must take
+      # @param asked [String] what is being asked, worded into a refusal
+      # @return [void]
+      # @raise [Runtime::WiringError] if the constructor needs arguments, the method is missing or
+      #   inherited, or its keywords do not match the query's arguments
+      def check_answers!(klass, port_name, method, query, asked:)
+        required = klass.instance_method(:initialize).parameters.filter_map { |kind, name| name if %i[req keyreq].include?(kind) }
+        unless required.empty?
+          raise WiringError, "#{klass} implements the #{port_name} port but its constructor requires " \
+                             "#{required.join(', ')} — it is built with no arguments"
+        end
+
+        unless klass.public_method_defined?(method) &&
+               !INHERITED_OWNERS.include?(klass.public_instance_method(method).owner)
+          raise WiringError, "#{klass} implements the #{port_name} port but not ##{method}, " \
+                             "which answers #{asked}"
+        end
+
+        check_keywords!(klass, method, query, asked)
+      end
+
+      # @raise [Runtime::WiringError] if the method takes a positional argument, requires a keyword
+      #   the query does not require, or accepts none of a declared argument
+      def check_keywords!(klass, method, query, asked)
+        parameters = klass.public_instance_method(method).parameters
+        wanted     = query.attributes.map { |attribute| attribute.name.to_sym }
+        required   = query.attributes.reject(&:optional?).map { |attribute| attribute.name.to_sym }
+        problems   = keyword_problems(parameters, wanted, required)
+        return if problems.empty?
+
+        raise WiringError, "#{klass}##{method} answers #{asked} but #{problems.join(' and ')} — it is asked " \
+                           "with keywords for the query's arguments (#{wanted.empty? ? 'none' : wanted.join(', ')})"
+      end
+
+      # @return [Array<String>] how `parameters` fails to take exactly the `wanted` keywords
+      def keyword_problems(parameters, wanted, required)
+        kinds   = parameters.map(&:first)
+        taken   = parameters.select { |kind, _| kind.to_s.start_with?("key") && kind != :keyrest }.map(&:last)
+        missing = kinds.include?(:keyrest) ? [] : wanted - taken
+        extra   = parameters.select { |kind, name| kind == :keyreq && !required.include?(name) }.map(&:last)
+        [("takes positional arguments" if kinds.intersect?(%i[req opt rest])),
+         keyword_problem("does not take", missing),
+         keyword_problem("requires", extra, ", which the query does not")].compact
+      end
+
+      # @return [String, nil] a phrase naming `names` as keywords, or nil when there are none
+      def keyword_problem(verb, names, suffix = "")
+        "#{verb} #{names.map { |name| "#{name}:" }.join(', ')}#{suffix}" unless names.empty?
+      end
+    end
+  end
+end

data/lib/hecks/runtime/aggregate_lock.rb

@@ -1,29 +1,10 @@
 module Hecks
   module Runtime
-    # **A process-wide, striped mutex registry** — the concurrency-control
-    # mechanism for every adapter that does not declare
-    # `:optimistic_concurrency` (Heki, Memory today; see
-    # `CommandInterpreter#call`/`EntityInterpreter#call`, which choose
-    # between this and Postgres's CAS+retry purely off
-    # `repository.capabilities`).
+    # A process-wide, striped mutex registry, keyed by `[domain, aggregate, id]`.
+    # Serializes hydrate-through-save for adapters without `:optimistic_concurrency`.
     #
-    # Why a lock suffices here and CAS is not needed: both adapters hold
-    # process-local data. `Adapters::Memory.tenant_capable?`'s own comment
-    # states the confirmed fact this relies on — two `Runtime.boot` calls
-    # get two entirely separate adapter instances; there is never a second
-    # process writing the same Heki file or the same Memory Hash, only
-    # possibly other threads within this one process. A `Mutex` held for
-    # the full hydrate-through-save critical section closes the identical
-    # lost-update gap CAS closes for Postgres, with no schema, no version
-    # column, and no retry loop — the second thread simply doesn't start
-    # its own hydrate until the first thread's save has landed.
-    #
-    # **Striped, not one global lock**: keyed by `[domain, aggregate.hecks_name,
-    # id]`, so two dispatches against two different records never block
-    # each other. The registry Hash itself is guarded by its own top-level
-    # Mutex only for the moment a new per-key Mutex is created — two
-    # threads locking different keys for the first time never wait on one
-    # another beyond that brief creation window.
+    # A lock suffices because those adapters (Heki, Memory) hold process-local data:
+    # only threads of this process can write the same record.
     module AggregateLock
       @registry_lock = Mutex.new
       @locks = {}
@@ -31,19 +12,13 @@ module Hecks
       class << self
         # Returns the Mutex striped to one record, creating it on first use.
         #
-        # `AggregateLock.for(domain, aggregate, id).synchronize { ... }`
-        # `id: nil` — identity could not be resolved yet (see
-        # `Identity.best_effort`) — locks by aggregate type alone, coarser
-        # (every record of this aggregate serializes against every other)
-        # but still correct: it can only ever make dispatch more
-        # conservative than a resolved id would.
+        #   AggregateLock.for(domain, aggregate, id).synchronize { ... }
         #
         # @param domain [String] the domain the aggregate belongs to
         # @param aggregate [Bluebook::Aggregate] the aggregate being dispatched
-        # @param id [String, nil] the resolved record id, or nil to stripe by aggregate type
-        #   alone
-        # @return [Mutex] the mutex for this `[domain, aggregate, id]` key, held for the full
-        #   hydrate-through-save critical section
+        # @param id [String, nil] the record id; nil locks by aggregate type alone, which
+        #   is coarser but still correct
+        # @return [Mutex] the mutex for this `[domain, aggregate, id]` key
         def for(domain, aggregate, id = nil)
           key = id.nil? ? [domain.to_s, aggregate.hecks_name] : [domain.to_s, aggregate.hecks_name, id.to_s]
           @registry_lock.synchronize { @locks[key] ||= Mutex.new }

data/lib/hecks/runtime/boot_gates.rb

@@ -1,24 +1,9 @@
 module Hecks
   module Runtime
-    # A boot's own small set of phase-tagged, conditionally-present gates —
-    # ADR 0031. Registration is instance-scoped, one per `Loader.boot`
-    # call, never a module-level singleton: a process that boots more than
-    # one registry in its lifetime (every spec suite does) must never let
-    # one boot's capability profile leak into the next boot's gate list.
+    # A boot's own set of phase-tagged, conditionally-present gates (ADR 0031).
+    # A gate is anything responding to `.call(registry, directory)`; run in registration order.
     #
-    # A gate is anything `.call(registry, directory)`-able — an existing
-    # module method handed over as a `Method` object (`EraCheck.method
-    # (:check_lineage!)`) needs no wrapper; a bare block does. Phases run
-    # in the order `run!` is called, gates within a phase in registration
-    # order — today exactly one gate per phase, so ordering among
-    # same-phase gates has never been exercised.
-    #
-    # This is deliberately not the same registry `Hecks::Projector` uses
-    # (ADR 0027) — that one is a process-wide, static IR-in/artifact-out
-    # registry with no bindings and no live-state mutation; this one is
-    # per-boot and gates real I/O (a Postgres mint, a saga-store read).
-    # Sharing a primitive between them is deferred until a third consumer
-    # actually wants it (0031's own Rejected Alternatives).
+    # Instance-scoped, one per `Loader.boot`, so one boot's gates never leak into the next.
     class BootGates
       # @return [void]
       def initialize

data/lib/hecks/runtime/caller.rb

@@ -1,38 +1,14 @@
 module Hecks
   module Runtime
-    # Who is dispatching, bound for the duration of a block — the ambient
-    # counterpart to `Runtime.with_registry`, but `Thread.current`-backed
-    # rather than a plain module ivar: registry-binding happens at boot
-    # time (single-threaded by construction), this happens at dispatch
-    # time, which a future per-request caller (docs/rails-integration.md's
-    # still-unbuilt `WebDoor`) needs to bind safely under concurrency.
-    #
-    # A child `Thread.new` spawned mid-block does not inherit this — plain
-    # Ruby thread-local semantics — but nothing in this codebase spawns a
-    # worker thread mid-dispatch today, so this is a fact worth naming
-    # rather than a gap worth solving.
+    # Who is dispatching, bound for the duration of a block.
+    # `Thread.current`-backed, so per-request callers bind safely under concurrency;
+    # a child thread spawned mid-block does not inherit it.
     module Caller
-      # `actor_id` is optional, on top of the role that has always been
-      # here — a caller that states only a role (every caller before this)
-      # is checked the way it always was, string equality against the
-      # command's own `role`. A caller that also names who it is lets
-      # `CommandRules::Authorization` check a real Governance
-      # `RoleAssignment` instead, once the command's domain has Governance
-      # attached — see that module's own header for the full split.
+      # The bound caller: a role, plus optional `actor_id`, `as_of` and `scope`.
       #
-      # `as_of` and `scope` are both optional too, and both self-asserted
-      # by the caller rather than derived from the command — deliberately:
-      # `as_of` is filled at the door from `Ports::Clock.now`, never
-      # inside the interpreter (see `Ports::Clock`'s own header), so
-      # there is no other place to source it from. `scope` stays here
-      # rather than becoming a command-level DSL construct on purpose —
-      # a scope check that lived in the bluebook would put an
-      # authorization concern inside the domain declaration itself; this
-      # keeps it an application-boundary fact instead, the same shape
-      # `role`/`actor_id` already are. The tradeoff: a caller states what
-      # scope it is acting in, and `holds_role?` verifies a live grant
-      # exists for that scope — it does not independently confirm the
-      # scope matches whatever the command's own target data belongs to.
+      # All but `role` are self-asserted by the caller, not derived from the command;
+      # `scope` is deliberately not a DSL construct, and `holds_role?` checks only that a grant
+      # exists for it, not that it matches the command's target data.
       Current = Struct.new(:role, :actor_id, :as_of, :scope, keyword_init: true)
 
       module_function
@@ -43,27 +19,17 @@ module Hecks
       #   block is on the stack for this thread
       def current = Thread.current[:hecks_caller]
 
-      # Binds the ambient caller for the duration of the block, restoring whatever
-      # caller (if any) was bound before, even if the block raises.
+      # Binds the ambient caller for the duration of the block, restoring the previous
+      # one even if the block raises.
       #
-      # `actor_id`, `as_of` and `scope` are each optional, self-asserted facts about
-      # the caller rather than derived from the command — see `Current`'s own header
-      # above for why each stays here instead of becoming a command-level DSL
-      # construct.
-      #
-      # @param role [String] the role the caller states it holds, checked by string
-      #   equality against the command's declared `role`
-      # @param actor_id [String, nil] who the caller is; when given, lets
-      #   `CommandRules::Authorization` check a real Governance `RoleAssignment`
-      #   instead of the bare role-string comparison
-      # @param as_of [Integer, nil] Unix epoch seconds the caller asserts as "now",
-      #   filled at the door from `Ports::Clock.now`; nil leaves a `RoleAssignment`'s
-      #   `starts_at` unchecked
-      # @param scope [String, nil] the scope the caller states it is acting in,
-      #   checked against the matching `RoleAssignment`'s own `scope`; nil skips
-      #   that check
-      # @yield the code that should see `role`/`actor_id`/`as_of`/`scope` as the
-      #   ambient caller
+      # @param role [String] the role the caller holds, checked against the command's `role`
+      # @param actor_id [String, nil] who the caller is; when given, `CommandRules::Authorization`
+      #   checks a real Governance `RoleAssignment`
+      # @param as_of [Integer, nil] Unix epoch seconds taken as "now"; nil leaves a
+      #   `RoleAssignment`'s `starts_at` unchecked
+      # @param scope [String, nil] the scope acted in, checked against the `RoleAssignment`'s
+      #   `scope`; nil skips that check
+      # @yield the code that sees these values as the ambient caller
       # @return [Object] the block's result
       def as(role:, actor_id: nil, as_of: nil, scope: nil)
         previous = Thread.current[:hecks_caller]
@@ -75,14 +41,8 @@ module Hecks
         Thread.current[:hecks_caller] = previous
       end
 
-      # Clears the ambient caller for the duration of the block, restoring
-      # whatever caller (if any) was bound before, even if the block raises.
-      #
-      # A reaction is the system acting, not the caller who happened to be
-      # on the stack when the triggering command ran — `Dispatcher#reenter`
-      # clears the ambient caller around a reaction's own dispatch so a
-      # triggering caller's role can neither satisfy nor block a reaction
-      # command it has nothing to do with.
+      # Clears the ambient caller for the duration of the block, restoring the previous one.
+      # A reaction is the system acting, so `Dispatcher#reenter` clears the caller around it.
       #
       # @yield the code that should see no ambient caller bound
       # @return [Object] the block's result

data/lib/hecks/runtime/capability_graph.rb

@@ -1,18 +1,7 @@
 module Hecks
   module Runtime
-    # Which ports a boot can actually fulfill, read off the registry it already
-    # holds. `registry.ports` names every port a domain declared a dependency
-    # on ; `registry.adapters` names every adapter wired to implement one — the
-    # same `adapter.port == port.name` match `Ports::Extraction` and
-    # `Ports::IdentityGeneration` already make for themselves, one at a time,
-    # each time they resolve. This is that same question asked once, for
-    # every port at once, so a gap in the wiring is something a caller can ask
-    # about rather than something a live dispatch discovers by refusing.
-    #
-    # `cycles` answers `[]`, always, and honestly: nothing in this port model
-    # lets one port depend on another — a port names a verb and a signal, an
-    # adapter names the port it implements, and neither can point at a third
-    # port. There is no edge for a cycle to be made of.
+    # Which ports a boot can fulfill: each declared port matched to the adapters wired to it,
+    # so a wiring gap can be asked about before a dispatch refuses.
     class CapabilityGraph
       # @param registry [Runtime::Registry] the booted registry to read ports and adapters from
       # @return [void]
@@ -20,9 +9,7 @@ module Hecks
         @registry = registry
       end
 
-      # { port name => [adapter name, ...] }, for every port the registry
-      # declares — including the ports nothing implements, so a caller can
-      # tell "declared, unfulfilled" from "never declared at all".
+      # Maps each declared port's name to the names of its adapters, unfulfilled ports included.
       #
       # @return [Hash{String => Array<String>}] each declared port's name mapped to the names
       #   of every adapter bound to it (empty when none are)
@@ -30,17 +17,14 @@ module Hecks
         @fulfillments ||= @registry.ports.each_key.to_h { |name| [name, adapters_for(name)] }
       end
 
-      # The ports with zero adapters bound — the gap `Runtime::WiringError`
-      # would otherwise only surface at the moment something tries to dispatch
-      # through one.
+      # The ports with zero adapters bound.
       #
       # @return [Array<String>] the names of every declared port with no adapter bound to it
       def unfulfilled
         fulfillments.select { |_, adapters| adapters.empty? }.keys
       end
 
-      # Reports the port-dependency cycles this registry has — always none; see the module
-      # header for why no port model here can express one.
+      # Reports the port-dependency cycles; always none, as a port cannot depend on another port.
       #
       # @return [Array] always empty
       def cycles = []

data/lib/hecks/runtime/command_interpreter/argument_gate.rb

@@ -5,37 +5,21 @@ require_relative "../refusal_wording"
 module Hecks
   module Runtime
     class CommandInterpreter
-      # The payload gate: a command takes the arguments it declares — all of
-      # them, and no others.
+      # The payload gate: a command takes the arguments it declares, all of them and no others.
       module ArgumentGate
         private
 
-        # Without this check, anything else would ride along in the payload
-        # untouched — normalize_args walks only the declared attributes, so
-        # a name the command never had is simply never looked at, and a
-        # misspelled argument would do nothing, in silence.
+        # Refuses any argument the command does not declare.
+        # Addressing keys (`id`, the aggregate's identity heads, the reference key)
+        # and saga correlation keys are allowed through.
         #
-        # The keys that are legitimately not attributes are the ones that address
-        # the aggregate rather than describe it : `id`, whatever the aggregate is
-        # identified by, and the reference key of the root a command reaches
-        # through. Refusing those would refuse every dispatch there is.
-        #
-        # `extra_identity_heads:` — EntityInterpreter's own callers only. An
-        # entity dispatch addresses not just the root aggregate but every
-        # entity along the chain it walks to reach the piece the command
-        # actually belongs to (`Handler.Dispatch.Bind` is two hops), and each
-        # hop's own `identity_heads` is addressing the same way the root's
-        # are — `element_of` (entity_element.rb) reads them straight out of
-        # `args` to find the element, never as a fact the command itself
-        # declares. `[]` for a plain aggregate/port-operation dispatch, which
-        # has no chain to add.
+        # `extra_identity_heads:` carries the identity heads of each entity hop an entity
+        # dispatch walks; `[]` for a plain aggregate or port-operation dispatch.
         def refuse_unknown_arguments(domain, aggregate, command, args, extra_identity_heads: [])
           addressing = [:id, *aggregate.identity_heads, *extra_identity_heads, reference_key(command)] +
                        correlation_keys(domain)
           known      = (command.attributes.map(&:name) + addressing).compact.map(&:to_sym)
-          # Sorted. Payload order is whatever the caller happened to write, and
-          # refusal wording is contract — pinned byte-for-byte by the corpus, so
-          # it cannot depend on hash iteration order.
+          # Sorted: refusal wording is pinned byte-for-byte, so it cannot follow payload order.
           unknown = (args.keys.map(&:to_sym) - known).sort
           return if unknown.empty?
 
@@ -45,46 +29,18 @@ module Hecks
                                            declared: declared_names(command))
         end
 
-        # And it takes all of them. The other half of the same sentence, missing
-        # until fuzz went looking : a name the command never declared was refused,
-        # while a name it did declare could simply be left out.
-        #
-        # Refusing `Customer.Register` for a missing `name` needs to be
-        # deliberate, not an accident with a lie for a message. Without this
-        # check, `then_set :name, to: :name` finds nothing to resolve, passes
-        # the literal symbol on, and coercion reports `name is a PersonName —
-        # pass its fields as an object`, which describes a mistake the caller
-        # did not make. The real mistake — an argument simply missing — is
-        # never the one named unless this refuses it on purpose.
-        #
-        # No command attribute anywhere in the corpus carries a default — checked,
-        # all eight chapters, zero — so there is no optional argument for this to
-        # step on. Every declared attribute is a fact the command needs.
+        # Refuses a declared, non-optional argument that is missing. Without it a missing
+        # argument surfaces later as a misleading coercion error about a mistake the caller
+        # did not make.
         #
-        # `aggregate:` — present only for a port operation. An aggregate
-        # command's own self-address never reaches this list at all
-        # (`CommandBuilder#reference_to`'s bare self-reference mints no
-        # attribute to be absent) — but `PortOperationBuilder#reference_to`
-        # always mints one (this file's own header on `PortOperation`: "no
-        # creates?/acts_on distinction to protect"), because an operation had
-        # no other way to say which record it addressed before `to:` existed.
-        # `to:` is that way now (`Dispatcher#port_invocation` promotes the
-        # identity attribute's own value out of the payload and into
-        # routing) — which leaves the attribute still declared, still
-        # non-optional, and never present in `args` at all: without this
-        # exemption, every operation with an identity attribute would refuse
-        # its own well-formed calls, dispatched exactly the way `to:`
-        # intends. Exempted here on the same terms an aggregate command's
-        # self-address always was — an address, not a fact the operation
-        # still needs handed back.
+        # `aggregate:` is set only for a port operation, whose identity attribute is
+        # promoted into routing by `to:` and so never appears in `args`; it is exempted.
         def refuse_absent_arguments(command, args, aggregate: nil)
           given    = args.keys.map(&:to_sym)
           exempt   = aggregate && command.respond_to?(:identity_attribute) &&
                      command.identity_attribute(aggregate.hecks_name)&.name
           required = command.attributes.reject(&:optional?).map { |attribute| attribute.name.to_sym } - [exempt]
-          # Sorted, for the same reason the unknown list is : refusal wording is
-          # contract, and a pinned wording cannot depend on the order a set
-          # difference happens to be computed in.
+          # Sorted, for the same reason as the unknown list.
           absent = (required - given).sort
           return if absent.empty?
 
@@ -94,29 +50,11 @@ module Hecks
                                            declared: declared_names(command))
         end
 
-        # A command that declares nothing still has to say so. `Account
-        # .Freeze` is `reference_to Account` and no attributes at all, so
-        # `{declared}` rendered empty and the sentence trailed off mid-
-        # clause : "Freeze does not declare standing — it takes ". Read
-        # against a real refusal that shape is worse than unhelpful — it
-        # looks like the message itself is broken, right where a caller
-        # is already trying to work out what went wrong.
-        #
-        # Only the empty case changes. Every command that declares even
-        # one attribute renders exactly as it did before, because refusal
-        # wording is contract and pinned byte-for-byte by the corpus (see
-        # `refuse_unknown_arguments`' own note on sorting for why).
+        # An empty list must still read as a sentence; only the empty case is worded differently.
         def declared_names(command) = command.attributes.map(&:name)
 
-        # What a process manager correlates by is routing, not description. A saga
-        # threads its correlation key through every leg it dispatches so the event
-        # each leg emits carries it and the next step can be correlated — so the key
-        # arrives on commands that never declare it, and legitimately.
-        #
-        # This is the weakest part of the gate. Correlation is the saga's business,
-        # and the better shape is for the saga to stamp its own key onto the event
-        # it caused rather than smuggle it through the command's payload. Until it
-        # does, refusing the key here would break every saga in the corpus.
+        # A saga threads its correlation key through every leg's payload, so the key arrives on
+        # commands that never declare it. Refusing it would break every saga.
         def correlation_keys(domain)
           Array(@registry.bluebook(domain)&.process_managers)
             .filter_map { |saga| saga.correlates_by && saga.correlation_head }