hecks 2.8.0 → 3.0.0

data/lib/hecks/facade/surface/aggregate_door.rb

@@ -1,222 +0,0 @@
-require_relative "../../bluebook/dsl/hecksagon_builder"
-require_relative "../../bluebook/dsl/domain_port_builder"
-require_relative "../../bluebook/dsl/const_shim"
-require_relative "../../bluebook/dsl/binding_proxy"
-require_relative "../../bluebook/hexagon"
-require_relative "../handle"
-require_relative "../../naming"
-
-module Hecks
-  module Facade
-    module Surface
-      # One aggregate's door: creating verbs as module methods returning
-      # the record in hand, CRUD delegation to the repository, the
-      # `persisted_by`-style binding collector a `.hecksagon` lands on, and
-      # the aggregate-scoped `port` a `.hecksagon` lands on beside it.
-      module AggregateDoor
-        # Builds the anonymous module that is one aggregate's door: a `name!` method per
-        # creating command, a bare method per query, `find`/`all`/`count`/`events`,
-        # `project`/`docs`/`narrate`, and the `.hecksagon` binding hooks.
-        #
-        # Warns once for each attribute whose name is in `RESERVED`.
-        #
-        # One method building one `door` module's ~20 singleton methods
-        # looks like it splits along each `define_singleton_method` call,
-        # but three of those blocks (`:port`, `:method_missing`,
-        # `:const_missing`) are a single cross-referencing essay on the
-        # stale-facade-across-boots hazard — each one's comment explicitly
-        # points at "below"/"above" as part of the same method. Splitting
-        # into helper methods wouldn't break anything at runtime (no
-        # shared mutable state beyond the closed-over args, which just
-        # become parameters), but it would sever that narrative across
-        # method boundaries for no functional gain.
-        #
-        # @param dispatcher [Runtime::Dispatcher, Runtime::RemoteDispatcher] the booted
-        #   dispatcher the door's methods dispatch, query and read repositories through
-        # @param domain [String] the owning chapter's name, the first half of the
-        #   aggregate's FQN (`"Pizzas"` in `"Pizzas::Pizza"`)
-        # @param aggregate [Bluebook::Aggregate] the aggregate to build a door for
-        # @return [Module] a fresh, unnamed module carrying the door's singleton methods
-        # @raise [Bluebook::DSL::Malformed] never while building; the returned door's
-        #   `port` raises it when called with no boot in progress
-        # rubocop:disable-next Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
-        def aggregate_module(dispatcher, domain, aggregate)
-          fqn  = "#{domain}::#{aggregate.hecks_name}"
-          door = Module.new
-
-          aggregate.attributes.each do |attribute|
-            next unless RESERVED.include?(attribute.name.to_sym)
-
-            warn "[hecks] #{aggregate.hecks_name}##{attribute.name} shadows a built-in — no reader defined"
-          end
-
-          # A creating verb is a module method returning the new record in hand ;
-          # a verb that reaches an existing record lives on the Handle. `!` —
-          # a command does something (mutates, may refuse), Ruby's own
-          # convention for that ; `Naming.snake` alone would leave a
-          # creating command's bare name claiming the exact spelling a
-          # query of the same business name also wants (`Account`'s own
-          # "Open" — the creating command and a query listing open
-          # accounts, a real same-aggregate collision this corpus already
-          # has) — the suffix is what makes both nameable at all, not
-          # merely a style choice.
-          aggregate.commands.select(&:creates?).each do |command|
-            door.define_singleton_method("#{Naming.snake(command.hecks_name)}!") do |**args|
-              Handle.new(dispatcher: dispatcher, domain: domain, aggregate: aggregate,
-                         instance: dispatcher.dispatch("#{fqn}.#{command.hecks_name}", with: args).instance)
-            end
-          end
-
-          # A query is a module method too — same level as a creating
-          # command, since neither needs an existing record in hand — but
-          # bare: a query reads and returns, nothing to warn a caller
-          # about the way `!` does for a command. Answers the raw row
-          # array `dispatcher.query` itself answers, the same shape
-          # `runtime.query("#{fqn}.Name")` already gave.
-          aggregate.queries.each do |query|
-            door.define_singleton_method(Naming.snake(query.hecks_name)) do |**args|
-              dispatcher.query("#{fqn}.#{query.hecks_name}", **args)
-            end
-          end
-
-          door.define_singleton_method(:fqn)        { fqn }
-          door.define_singleton_method(:ir)         { aggregate }
-
-          # The same verb the chapter answers, one level down. Every
-          # construct emits its own IR (Hecks::IR), so an aggregate
-          # is a legitimate thing to project — `Pizzas::Order.project(
-          # Projections::IR)` is this aggregate's IR, not the chapter's.
-          #
-          # A chapter-scoped target refuses here rather than inventing an
-          # answer: `Projector.admits!` is what tells `Projections::IR`
-          # (`from: :any`) apart from `Projections::Shape`
-          # (`from: :chapter`), which would otherwise answer a confidently
-          # empty `{"aggregates" => []}` for an aggregate.
-          door.define_singleton_method(:project) do |target, out: nil, **options|
-            key      = Projector.key_for(target)
-            artifact = Projector.call(key, bluebook: aggregate, options: options)
-            return artifact unless out
-
-            Projector.write(artifact, out, as: Projector.emits_for(key))
-          end
-          door.define_singleton_method(:repository) { dispatcher.registry.repository(domain, aggregate) }
-          door.define_singleton_method(:commands) do
-            aggregate.commands.map { |c| "#{Naming.snake(c.hecks_name)}!" }.sort
-          end
-          door.define_singleton_method(:queries) { aggregate.queries.map { |q| Naming.snake(q.hecks_name) }.sort }
-          # **One aggregate's usage document** — the same projection the chapter
-          # answers with, narrowed to this head. `commands` above already
-          # answers "what can I call"; this answers "and what does each one
-          # want, refuse, and guarantee", which is the rest of the question.
-          door.define_singleton_method(:docs) do |**options|
-            Projector.call(:docs, bluebook: dispatcher.registry.bluebook(domain),
-                                  options:  options.merge(aggregate: aggregate.hecks_name))
-          end
-          # **One aggregate, read back in english** — the same narrowing `:docs`
-          # takes, aimed at `:narrate` instead.
-          door.define_singleton_method(:narrate) do |**options|
-            Projector.call(:narrate, bluebook: dispatcher.registry.bluebook(domain),
-                                     options:  options.merge(aggregate: aggregate.hecks_name))
-          end
-          door.define_singleton_method(:count)      { dispatcher.registry.repository(domain, aggregate).count }
-          door.define_singleton_method(:events)     { dispatcher.events.select { |event| event.aggregate == fqn } }
-
-          door.define_singleton_method(:find) do |id|
-            found = dispatcher.registry.repository(domain, aggregate).find(id)
-            found && Handle.new(dispatcher: dispatcher, domain: domain, aggregate: aggregate, instance: found)
-          end
-
-          door.define_singleton_method(:all) do |**opts|
-            dispatcher.registry.repository(domain, aggregate).all(**opts).map do |instance|
-              Handle.new(dispatcher: dispatcher, domain: domain, aggregate: aggregate, instance: instance)
-            end
-          end
-
-          # The same reason `method_missing` below exists at all — a facade
-          # left over from a previous boot in this process shadows the fresh
-          # `BindingProxy` a `.hecksagon` would otherwise reach through
-          # `ConstShim`/`const_missing`, so `Pizzas::Pizza.port(...)` lands
-          # here instead once any boot has run before.
-          #
-          # Re-resolved, not the closed-over `aggregate` — this door can be a
-          # stale one, built by a boot from earlier in this same process,
-          # sitting on the `Pizzas`/`Pizza` constants only because nothing
-          # has re-installed them since. Attaching to this door's own
-          # `aggregate` would attach the port to a discarded aggregate from
-          # that old boot, invisible to the current one actually being
-          # loaded — silently, the exact way `method_missing` below already
-          # has to avoid it for a plain bind, via `HecksagonBuilder.collector`
-          # rather than anything this door closes over. `Hecks.current_registry`
-          # is the same "whichever boot is actually in progress" indirection,
-          # and `BindingProxy#port` already re-resolves through it the same
-          # way — this is that door's fallback twin, not a shortcut past it.
-          door.define_singleton_method(:port) do |name, &block|
-            current = Hecks.current_registry&.bluebook(domain)&.aggregate(aggregate.hecks_name) or
-              raise Bluebook::DSL::Malformed, "#{fqn}.port(#{name.inspect}) called outside a boot"
-
-            domain_port = Bluebook::DSL::ConstShim.with(->(const) { const }) do
-              Bluebook::DSL::DomainPortBuilder.build(name, owner: current.hecks_name, &block)
-            end
-            domain_port.operations.each do |operation|
-              operation.attributes.select(&:reference?).each { |attribute| attribute.type.declared_in = current }
-            end
-            current.add_port(domain_port)
-            self
-          end
-
-          door.define_singleton_method(:method_missing) do |verb, *args, **kwargs, &block|
-            # A bare call starts a Privacy marking chain — see
-            # `Bluebook::DSL::BindingProxy#method_missing`'s own header;
-            # this is the same mechanism, reached when the constant is
-            # already a real, installed door (a second boot in-process)
-            # rather than a `.hecksagon`-parse-time `BindingProxy`.
-            return Bluebook::DSL::AttributePath.new(fqn, [verb.to_s]) if args.empty? && kwargs.empty? && !block
-
-            collector = Bluebook::DSL::HecksagonBuilder.collector
-            return super(verb, *args, **kwargs, &block) unless collector
-
-            collector << Bluebook::Bind.new(
-              aggregate: fqn,
-              verb:      verb.to_s,
-              adapter:   args.first.to_s,
-              role:      kwargs[:role]&.to_s
-            )
-            block&.call
-            self
-          end
-
-          door.define_singleton_method(:respond_to_missing?) do |name, include_private = false|
-            !Bluebook::DSL::HecksagonBuilder.collector.nil? || super(name, include_private)
-          end
-
-          # The same stale-facade hazard `method_missing`/`port` above already
-          # document, one door lower — `Surface.install` installs an aggregate's
-          # own name as a bare top-level constant too (`Namespace.install(Object,
-          # aggregate.hecks_name, ...)`, surface.rb's own `install`), not only
-          # nested under its chapter. So once any domain has booted once in this
-          # process, `Account::Debit` written while declaring some other
-          # bluebook — same domain or a different one — reaches this door's
-          # const_missing directly, never `Object.const_missing`/`ConstShim::
-          # Hook` at all: real modules resolve without ever calling that.
-          #
-          # `aggregate.hecks_name`, not the qualified `fqn` — a scoped
-          # reference has to read the same either way, whether or not a stale
-          # door happens to be sitting on this process from an earlier boot;
-          # qualifying it here would make `Account::Debit`'s own meaning
-          # depend on incidental process history, which is the exact
-          # instability S0b exists to remove (docs/dsl-work-slices.md — "two
-          # domains in one registry" is this file's own reason for being
-          # owned by that slice).
-          door.define_singleton_method(:const_missing) do |name|
-            resolver = Bluebook::DSL::ConstShim.resolver
-            return resolver.call("#{aggregate.hecks_name}::#{name}") if resolver
-
-            super(name)
-          end
-
-          door
-        end
-      end
-    end
-  end
-end

data/lib/hecks/facade/surface/chapter.rb

@@ -1,116 +0,0 @@
-require_relative "../../bluebook/dsl/binding_proxy"
-require_relative "../../bluebook/dsl/const_shim"
-require_relative "../../bluebook/dsl/hecksagon_builder"
-
-module Hecks
-  module Facade
-    module Surface
-      # One chapter's module: vision and aggregate roll-call on the
-      # singleton, one aggregate door per declared head, and the
-      # declaration hook for names the door does not carry.
-      module Chapter
-        # Builds the anonymous module that stands for one booted chapter: `vision`,
-        # `aggregates`, `docs`, `narrate` and `project` as singleton methods, plus one
-        # nested constant per aggregate holding that aggregate's door.
-        #
-        # @param dispatcher [Runtime::Dispatcher, Runtime::RemoteDispatcher] the booted
-        #   dispatcher each aggregate door closes over
-        # @param bluebook [Bluebook::Chapter] the chapter to project into a module
-        # @return [Module] a fresh, unnamed module; `Surface.install` gives it its
-        #   top-level name
-        # @raise [NameError] if an aggregate's name is not a valid constant name
-        def chapter_module(dispatcher, bluebook)
-          chapter = Module.new
-          chapter.define_singleton_method(:vision)     { bluebook.vision }
-          chapter.define_singleton_method(:aggregates) { bluebook.aggregates.map(&:name).sort }
-
-          # **The chapter, explaining itself**. `Projector::DocsProjector` reads
-          # nothing but this bluebook's own IR, so the document cannot drift
-          # from the domain — the same guarantee `bin/reference` gives the DSL
-          # reference by generating it from the Syntax chapter.
-          #
-          # A method rather than only a script because that is what gets it
-          # read: `QualityControl.docs` in a console, beside `vision` and
-          # `aggregates`, at the moment somebody is wondering what a verb
-          # wants. Projected on each call rather than memoised — it is a pure
-          # read of the IR, and a stale document is the entire thing this
-          # exists to prevent.
-          chapter.define_singleton_method(:docs) do |**options|
-            Projector.call(:docs, bluebook: bluebook, options: options)
-          end
-
-          # **The chapter, read back in english** — `Projector::NarrateProjector`
-          # beside `:docs`, for the reader who needs to confirm the domain is
-          # right rather than call it: `QualityControl.narrate` in a console.
-          chapter.define_singleton_method(:narrate) do |**options|
-            Projector.call(:narrate, bluebook: bluebook, options: options)
-          end
-
-          # **The domain's own IR, projected**. `Projector` has taken
-          # `call(name, bluebook:, options:)` since §30, but nothing could
-          # reach it from a booted domain — this module already closes
-          # over the one `Bluebook` every projector wants and simply
-          # never handed it out, so every bin/ projector rebuilt a
-          # Registry and reloaded the files to recover what was already
-          # sitting here.
-          #
-          #   Pizzas.project(Projections::OIDC)
-          #   Pizzas.project(Projections::Shape, out: "shape.json")
-          #
-          # No `to_ir` companion: `project(Projections::IR)` already
-          # answers with the canonical serialized form, and handing out
-          # the live graph as well would be a second way to say the same
-          # thing. Anything genuinely needing the graph is a projector,
-          # and a projector is given it.
-          #
-          # `out:` writes and everything else is passed through to the
-          # target — so `options` stays the projector's own vocabulary
-          # (`audience:` for OIDC) rather than a fixed set this method
-          # would have to know about.
-          chapter.define_singleton_method(:project) do |target, out: nil, **options|
-            key      = Projector.key_for(target)
-            artifact = Projector.call(key, bluebook: bluebook, options: options)
-            return artifact unless out
-
-            Projector.write(artifact, out, as: Projector.emits_for(key))
-          end
-
-          bluebook.aggregates.each do |aggregate|
-            chapter.const_set(aggregate.hecks_name, aggregate_module(dispatcher, bluebook.name, aggregate))
-          end
-
-          # Inside a hecksagon, a name is a declaration, not a lookup. A
-          # `.hecksagon` may name an aggregate this door does not carry — a stale
-          # door from an earlier boot resolving another registry's chapter, which
-          # can happen because the facade is installed once a boot finishes, not
-          # on every load. With a collector open, the name becomes a `BindingProxy`
-          # recording the same bind the aggregate module would ; without one, it
-          # is a genuine NameError.
-          #
-          # The other reader of a miss is S0b's own bridge (docs/dsl-work-
-          # slices.md, const_shim.rb's `ScopedConstant`): a bluebook still being
-          # declared that names `#{bluebook.name}::Something` — an event, a
-          # command reference, an `admits:` — reaches here, not
-          # `Object.const_missing`, the moment this chapter's own facade already
-          # exists (a previous boot in the same process, or this same chapter
-          # re-entering its own name). `ConstShim.active?` is exactly as true
-          # here as it is at the top level, mid-declaration, and consulting the
-          # same resolver is what makes a scoped reference resolve identically
-          # whether or not a facade happens to be built yet — a bridge consulted
-          # only at the top level works only before any facade exists.
-          chapter.define_singleton_method(:const_missing) do |name|
-            collector = Bluebook::DSL::HecksagonBuilder.collector
-            return Bluebook::DSL::BindingProxy.new("#{bluebook.name}::#{name}", collector) if collector
-
-            resolver = Bluebook::DSL::ConstShim.resolver
-            return resolver.call("#{bluebook.name}::#{name}") if resolver
-
-            super(name)
-          end
-
-          chapter
-        end
-      end
-    end
-  end
-end

data/lib/hecks/facade/surface.rb

@@ -1,61 +0,0 @@
-require_relative "surface/chapter"
-require_relative "surface/aggregate_door"
-
-module Hecks
-  module Facade
-    # **The door, without the classes**.
-    #
-    # `Pizzas::Pizza.create_pizza!(...)` is the public surface (handover rule 3),
-    # and this is what serves it now : anonymous per-boot modules whose
-    # singleton methods close over the dispatcher and dispatch by FQN — the
-    # same shape `Router::NamespaceInstaller` proved. Nothing here is a domain
-    # class ; the IR is the only graph, and the door is a projection of it,
-    # installed by `Loader.bind_runtime` and re-installed whole on the next
-    # boot. How a chapter's module is built is surface/chapter.rb; how one
-    # aggregate's door is built is surface/aggregate_door.rb.
-    #
-    # The hexagon-binding door rides along : `Pizzas::Pizza.persisted_by("Heki")`
-    # in a `.hecksagon` file lands on the module's `method_missing`, which
-    # records an `Bind` into whatever `HecksagonBuilder.collector` is open
-    # at call time — so even a facade left over from a previous boot records
-    # into the current builder, and a chapter with no constant at all falls
-    # through to `ConstShim` → `BindingProxy`, which mints byte-identical binds.
-    module Surface
-      # These would shadow the machinery a Handle runs on, so a field named one
-      # of them gets no reader and says so — the same warning the class door gave.
-      RESERVED = %i[id state events reload inspect to_h hash class].freeze
-
-      extend Chapter
-      extend AggregateDoor
-
-      module_function
-
-      # Installs one top-level module per booted chapter, and one per aggregate, each
-      # closing over `dispatcher`, so `Pizzas::Pizza` and the bare `Pizza` both open the
-      # door of the boot that ran last.
-      #
-      # An aggregate sharing its chapter's name gets no second constant: the chapter
-      # module already holds that name. A name that user code or the stdlib already owns
-      # is left alone with a warning (see `Namespace.install`).
-      #
-      # @param dispatcher [Runtime::Dispatcher, Runtime::RemoteDispatcher] the booted
-      #   dispatcher every installed door dispatches and queries through
-      # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the same `dispatcher`,
-      #   so a boot can return the call's result
-      # @raise [NameError] if a chapter or aggregate name is not a valid constant name
-      def install(dispatcher)
-        dispatcher.registry.bluebooks.each_value do |bluebook|
-          chapter = chapter_module(dispatcher, bluebook)
-          Namespace.install(Object, bluebook.name, chapter)
-
-          bluebook.aggregates.each do |aggregate|
-            next if aggregate.hecks_name == bluebook.name
-
-            Namespace.install(Object, aggregate.hecks_name, chapter.const_get(aggregate.hecks_name, false))
-          end
-        end
-        dispatcher
-      end
-    end
-  end
-end

data/lib/hecks/mcp_door_scope.rb

@@ -1,176 +0,0 @@
-require_relative "runtime/errors"
-
-module Hecks
-  # What one spawned `bin/hecks_mcp_door` may do: every tool against any domain under
-  # `Storehouse::BOOT_ROOT` (the default), or, in reader mode, only the reader tools
-  # against the domains its spawner named. ADR 0072, decision 2.
-  #
-  # ## Reach, not identity
-  #
-  # This is a capability allowlist, not authentication. It identifies no one and adds no
-  # secret: whoever can spawn the door chooses its mode, and whoever can write to its stdin
-  # gets whatever that mode allows. What it buys is a smaller surface per agent. A reader
-  # door cannot dispatch, cannot run `.behaviors` files, and cannot `Kernel.load` Ruby from
-  # a domain its spawner did not name.
-  #
-  # ## Why `HECKS_DOOR_*` and not `HECKS_MCP_*`
-  #
-  # `McpStdioGuard` refuses every `HECKS_MCP_*` variable except
-  # `HECKS_MCP_TRANSPORT=stdio`, and every argument except `--stdio`, so that no option can
-  # ask a server for another transport. Those refusals belong to ADR 0062. The settings
-  # here live under their own prefix so the guard stays exactly as that ADR describes it,
-  # and an unknown `HECKS_DOOR_*` name is refused here, the same fail-closed way.
-  #
-  # ## The settings
-  #
-  # - `HECKS_DOOR_TOOLS=readers` turns reader mode on. Unset means every tool, as before.
-  #   Any other value refuses to start.
-  # - `HECKS_DOOR_DOMAINS` lists the domains a reader door may name, separated by
-  #   `File::PATH_SEPARATOR` (`:` on Unix), each resolved against `Storehouse::BOOT_ROOT`.
-  #   Required in reader mode and refused without it.
-  #
-  # ## The allowed set is named, not loaded
-  #
-  # The door boots a domain afresh on every call and keeps nothing loaded between calls,
-  # so there is no set of already-loaded domains to check against. The allowed set is the
-  # list the spawner named, resolved to absolute paths at startup. A call's `domain:` is
-  # resolved the same way and compared before anything boots, so a path outside the set
-  # never reaches `Kernel.load`. The comparison is on resolved path text: a symlink under a
-  # named path is followed when that domain boots, as it is for every domain today.
-  class McpDoorScope
-    ENV_PREFIX       = "HECKS_DOOR_".freeze
-    TOOLS_VARIABLE   = "HECKS_DOOR_TOOLS".freeze
-    DOMAINS_VARIABLE = "HECKS_DOOR_DOMAINS".freeze
-    READERS          = "readers".freeze
-    EXIT_STATUS      = 2
-
-    # The tools a reader door serves. Each reads a domain or the door's own audit log and
-    # writes no domain state. `query` and `state` still append their call to that audit
-    # log. `validate` boots the domain it is given, so it is held to the allowed set like
-    # every other domain-scoped tool. `domains` lists directories and loads nothing.
-    READER_TOOLS = %w[query events state catalog describe validate domains history follow].freeze
-
-    # Reads the door's mode from its environment.
-    #
-    # @param env [Hash{String => String}] the process environment
-    # @return [McpDoorScope] an unrestricted scope when no `HECKS_DOOR_*` variable is set;
-    #   otherwise a reader scope over the named domains
-    # @raise [ArgumentError] with every problem found, one per line, when the settings are
-    #   not a mode this door knows
-    # @raise [Runtime::TypeMismatch] if a named domain resolves outside
-    #   `Storehouse::BOOT_ROOT`
-    def self.from_env(env = ENV)
-      problems = setting_problems(env)
-      raise ArgumentError, problems.join("\n") unless problems.empty?
-      return new(allowed_domains: nil) unless env[TOOLS_VARIABLE]
-
-      new(allowed_domains: env[DOMAINS_VARIABLE].split(File::PATH_SEPARATOR).reject(&:empty?))
-    end
-
-    # Reads the door's mode, or refuses to start on settings it does not know.
-    #
-    # Everything goes to `stderr`, because stdout carries the MCP protocol.
-    #
-    # @param server [String] the server's name, used as the line prefix
-    # @param env [Hash{String => String}] the process environment
-    # @param stderr [IO] where a refusal is written
-    # @return [McpDoorScope] the door's scope
-    # @raise [SystemExit] with status `EXIT_STATUS` when `from_env` refuses the settings
-    def self.start!(server:, env: ENV, stderr: $stderr)
-      from_env(env)
-    rescue ArgumentError, Runtime::TypeMismatch => e
-      e.message.each_line { |line| stderr.puts("#{server}: refusing to start: #{line.chomp}") }
-      exit(EXIT_STATUS)
-    end
-
-    # @api private
-    def self.setting_problems(env)
-      unknown = env.keys.select { |name| name.start_with?(ENV_PREFIX) } - [TOOLS_VARIABLE, DOMAINS_VARIABLE]
-      problems = unknown.map do |name|
-        "environment #{name} is not accepted; the door takes only #{TOOLS_VARIABLE} and #{DOMAINS_VARIABLE}"
-      end
-      problems + mode_problems(env[TOOLS_VARIABLE], env[DOMAINS_VARIABLE])
-    end
-
-    # @api private
-    def self.mode_problems(tools, domains)
-      if tools.nil?
-        domains.nil? ? [] : ["#{DOMAINS_VARIABLE} is set without #{TOOLS_VARIABLE}=#{READERS}; it only narrows a reader door"]
-      elsif tools != READERS
-        ["#{TOOLS_VARIABLE}=#{tools.inspect} is not accepted; the only value is #{READERS.inspect}"]
-      elsif domains.to_s.split(File::PATH_SEPARATOR).none? { |path| !path.empty? }
-        ["#{TOOLS_VARIABLE}=#{READERS} needs #{DOMAINS_VARIABLE}, the domains this door may read"]
-      else
-        []
-      end
-    end
-
-    # The named domains, resolved against `Storehouse::BOOT_ROOT`; nil when unrestricted.
-    #
-    # @return [Array<String>, nil]
-    attr_reader :allowed_domains
-
-    # @param allowed_domains [Array<String>, nil] the domains a reader door may name, as
-    #   given; nil for an unrestricted door
-    # @raise [Runtime::TypeMismatch] if a named domain resolves outside `Storehouse::BOOT_ROOT`
-    def initialize(allowed_domains:)
-      @allowed_domains = allowed_domains&.map { |path| Storehouse.confine!(path, DOMAINS_VARIABLE) }.freeze
-    end
-
-    # Tells whether this door runs in reader mode.
-    #
-    # @return [Boolean] true when the spawner set `HECKS_DOOR_TOOLS=readers`
-    def restricted?
-      !@allowed_domains.nil?
-    end
-
-    # Tells whether this door serves a tool.
-    #
-    # @param name [String] the tool name from a `tools/call` request
-    # @return [Boolean] true for every name on an unrestricted door; on a reader door, true
-    #   only for `READER_TOOLS`
-    def permits_tool?(name)
-      !restricted? || READER_TOOLS.include?(name)
-    end
-
-    # Builds the answer to a call for a tool this door does not serve.
-    #
-    # @param name [String] the tool name from a `tools/call` request
-    # @return [Hash{Symbol => Object}] `{ok: false, error:}`, the error naming the mode and
-    #   the tools it serves
-    def refusal(name)
-      { ok:    false,
-        error: "#{name.inspect} is refused: this door runs in reader mode (#{TOOLS_VARIABLE}=#{READERS}), " \
-               "which serves only #{READER_TOOLS.join(', ')}" }
-    end
-
-    # Checks a call's `domain:` against the allowed set, before anything boots.
-    #
-    # @param domain [String, nil] the caller's `domain:` argument
-    # @return [String, nil] `domain` unchanged, so an unrestricted door boots exactly what
-    #   it did before
-    # @raise [Runtime::TypeMismatch] on a reader door, if `domain` resolves outside
-    #   `Storehouse::BOOT_ROOT` or to a path its spawner did not name
-    def admit_domain!(domain)
-      return domain unless restricted?
-      return domain if @allowed_domains.include?(Storehouse.confine!(domain, "domain"))
-
-      raise Runtime::TypeMismatch,
-            "domain: #{domain.inspect} is refused: this door runs in reader mode (#{TOOLS_VARIABLE}=#{READERS}) " \
-            "and reads only #{DOMAINS_VARIABLE}: #{@allowed_domains.join(', ')}"
-    end
-
-    # The startup warning lines that describe this door's mode.
-    #
-    # @return [Array<String>] empty when unrestricted; on a reader door, what it serves,
-    #   what it refuses, the domains it reads, and that it identifies no one
-    def notes
-      return [] unless restricted?
-
-      ["Reader mode (#{TOOLS_VARIABLE}=#{READERS}): serves #{READER_TOOLS.join(', ')}; " \
-       "refuses dispatch (with dry_run and steps), behaviors and every other tool.",
-       "domain: boots only #{DOMAINS_VARIABLE}: #{@allowed_domains.join(', ')}.",
-       "Reader mode limits reach and identifies no one; it is not authentication."]
-    end
-  end
-end