hecks 2.8.0 → 3.0.0

data/lib/hecks/adapters/driven/in_memory_ordering.rb

@@ -6,32 +6,20 @@ require_relative "../../runtime/errors"
 
 module Hecks
   module Adapters
-    # Shared by every adapter that holds decoded Ruby records rather than
-    # running real SQL (Memory, Lambda, Heki) — the identical dotted-path
-    # value-object member-picking Postgres/Sqlite/D1's own
-    # order_expression does (numeric member wins, else the one-field
-    # convention "value"), just walked in Ruby instead of compiled to a
-    # JSONB/json_extract path, because there is no query engine
-    # underneath any of these three to hide that walk inside.
+    # Ordering for adapters that hold decoded Ruby records (Memory, Lambda, Heki),
+    # mirroring the SQL adapters' value-object member picking.
     module InMemoryOrdering
       module_function
 
-      # Orders decoded records by a declared attribute, then by id as the total-order
-      # tiebreaker.
+      # Orders decoded records by a declared attribute, then by id as the tiebreaker.
       #
-      # order_by is a runtime value (an HTTP query param, in the
-      # console's case), not framework-authored bluebook source — see
-      # postgres.rb's own all for the full reasoning. Whitelisted the
-      # identical way before FieldPath.dig ever runs.
+      # `order_by` may come from an HTTP query param, so it is checked before `FieldPath.dig`.
       #
       # @param records [Array<Runtime::Instance>] the records to order
-      # @param aggregate [Bluebook::Aggregate] the aggregate `records` belong to, checked for
-      #   `order_by`'s attribute
-      # @param order_by [String, Symbol, nil] a dotted attribute path to sort by; nil returns
-      #   `records` unchanged
+      # @param aggregate [Bluebook::Aggregate] the aggregate `records` belong to
+      # @param order_by [String, Symbol, nil] a dotted attribute path; nil returns `records` as-is
       # @param direction [Symbol] `:asc` or `:desc`
-      # @return [Array<Runtime::Instance>] `records`, ordered by `order_by` then id; unchanged
-      #   when `order_by` is nil
+      # @return [Array<Runtime::Instance>] `records`, ordered by `order_by` then id
       # @raise [Runtime::WiringError] if `order_by` names no attribute of `aggregate` and is
       #   not its lifecycle field
       def ordered(records, aggregate:, order_by:, direction:)
@@ -68,13 +56,8 @@ module Hecks
         vo = aggregate.value_object(attribute.type)
         return field.to_s unless vo
 
-        # Numeric member first, then the sole attribute whatever it is
-        # named (single-attribute value objects strictly answer `.value`
-        # — the same generalization `SqlQueryBuilder#query_expression`
-        # makes for the column side, kept in lockstep so Memory and SQL
-        # order the identical rows identically), and only then the bare
-        # `value` convention — now purely a backstop for the multi-field
-        # non-numeric shape neither rule can honestly pick a field for.
+        # Numeric member, else the sole attribute, else `value`; kept in lockstep with
+        # `SqlQueryBuilder#query_expression` so Memory and SQL order rows identically.
         member = vo.attributes.find { |a| %w[Integer Float].include?(a.type) }&.name ||
                  vo.sole_attribute&.name || "value"
         "#{name}.#{member}"

data/lib/hecks/adapters/driven/in_process_key_vault.rb

@@ -2,20 +2,8 @@ require "securerandom"
 
 module Hecks
   module Adapters
-    # The real `key_vault` fulfillment for a single running process — a
-    # table of key material, keyed by an opaque reference never exposed to
-    # a bluebook or an event. Cryptoshredding only works if the key
-    # genuinely leaves memory when destroyed: `destroy` deletes the Hash
-    # entry outright, not merely a flag, so a `fetch` afterward has
-    # nothing left to decrypt with.
-    #
-    # **Not crash-durable** — a process restart loses every key this
-    # adapter ever issued, along with every ciphertext under it. A
-    # deployment that needs destruction to survive a restart (or to leave
-    # a physical-destruction audit trail) backs this port with a real
-    # `KMS` or `HSM` instead; this default asks for nothing external to
-    # run, the same tradeoff `SecureRandomIdentity` already makes for
-    # identity minting.
+    # In-process `key_vault` fulfillment: key material held under opaque references.
+    # Not crash-durable; use a KMS or HSM when destruction must survive a restart.
     module InProcessKeyVault
       module_function
 

data/lib/hecks/adapters/driven/lambda/client.rb

@@ -3,48 +3,13 @@ require "json"
 module Hecks
   module Adapters
     class Lambda
-      # **The thin AWS client** — shared by this adapter's own read methods
-      # (Lambda#find/#all/#count/#query) and Runtime::RemoteDispatcher's
-      # write methods. One Lambda invoke, one JSON round trip, nothing
-      # domain-specific: neither caller needs to know an AWS SDK is
-      # involved at all.
+      # The thin AWS client shared by this adapter's read methods and
+      # Runtime::RemoteDispatcher's writes: one Lambda invoke, one JSON round trip.
       #
-      # ## Resolving the function name
-      #
-      # Function name is computed unless it is named — `"hecks-#{domain}"`,
-      # lowercased, matches bin/project_deploy's own `stack_name`
-      # exactly (bin/project_deploy: `stack_name = "hecks-#{domain_name}"`,
-      # `domain_name = File.basename(domain)`). `domain` here is the
-      # bluebook's own declared name (`Embryonaut`, not the directory);
-      # today's real corpus has directory name == declared name
-      # lowercased for every domain that deploys, so `.downcase` alone
-      # reproduces the same string bin/project_deploy computes from the
-      # directory.
-      #
-      # ## When the assumption breaks
-      #
-      # That assumption is not always true, and when it breaks nothing
-      # about it is recoverable from here. `bin/project_deploy` honours
-      # a `.world`'s own `stack_prefix`/`stack_name` — settings that
-      # exist precisely so a domain whose AWS identity predates a rename
-      # keeps targeting the stack that is actually live rather than
-      # standing up a second, empty one beside it. A real one:
-      # a client site deploys under a fixed stack name, and no
-      # value of `domain` (or of `DOMAIN_NAME`, the deployed-Lambda
-      # override callers already pass) can make this computation produce
-      # a name with no dash after "hecks". Every Ruby-side read and
-      # dispatch for that app has therefore been invoking a function
-      # that does not exist — found live, and visible in the deployed
-      # journal having never received a single row.
-      #
-      # ## Naming it explicitly
-      #
-      # So the name can be named, in the one place the rest of this
-      # deployment is already described: the `.world`'s own
-      # `persisted_by("Lambda")`/`dispatched_by("Lambda")` block, beside
-      # `region`. Given, it wins outright; absent, the computation above
-      # is unchanged, which is every domain whose stack name was never
-      # pinned.
+      # The function name defaults to `"hecks-#{domain.downcase}"`, matching
+      # `hecks deploy project`'s `stack_name` computation. A domain whose stack
+      # name doesn't follow that pattern must pass `function` explicitly, via
+      # a `.world`'s `persisted_by("Lambda")`/`dispatched_by("Lambda")` block.
       class Client
         # @param domain [String, Symbol] the bluebook's own declared domain name; computes
         #   the function name when `function` is not given
@@ -58,20 +23,14 @@ module Hecks
           @client = Aws::Lambda::Client.new(region: region)
         end
 
-        # The function this client actually invokes — read by
-        # `Runtime::WiringError` messages and worth asserting on
-        # directly, since "which function did we call" is otherwise
-        # unanswerable from outside.
+        # The function this client actually invokes; used in `Runtime::WiringError`
+        # messages and worth asserting on directly in tests.
         attr_reader :function_name
 
         # Reads the whole domain's current state and event log from the remote function.
         #
-        # **The whole domain, every time** — matches dispatch::read's own
-        # rehydrate-the-full-journal design (Phase 1, rust/host). No
-        # caching here, deliberately: memoizing this across calls once
-        # silently served stale reads for a warm web process's whole
-        # lifetime after a write happened elsewhere — see Lambda#instances's
-        # own comment on the real, live bug that caught it.
+        # No caching here, deliberately: a memoized read would go stale the
+        # moment a write happens elsewhere in a long-lived process.
         #
         # @return [Hash{String => Object}] the parsed JSON response; the deployed function's
         #   own top-level keys (`"instances"`, `"events"`, …)

data/lib/hecks/adapters/driven/lambda.rb

@@ -6,24 +6,8 @@ require_relative "../../runtime/instance"
 
 module Hecks
   module Adapters
-    # **The read-side half of lambda routing** — `persisted_by("Lambda")`'s
-    # own adapter, resolved through the same `Ports::Persistence`
-    # machinery `persisted_by("Postgres")`/`persisted_by("Memory")`
-    # already use (`Runtime::Registry#repository`, `RepositoryFactory
-    # .build`) — no new framework plumbing, just a new adapter class at
-    # the name the existing lookup already expects. See
-    # `Runtime::RemoteDispatcher` for the write-side half; the two
-    # compose through one shared `Client` per domain rather than each
-    # inventing its own AWS wiring.
-    #
-    # **Read-only, deliberately** — `append`/`project` raise rather than
-    # silently no-op. A write reaching this class would mean
-    # `Runtime::CommandInterpreter` ran locally against a Lambda-routed
-    # domain, which is exactly the bypass `Runtime::RemoteDispatcher`
-    # exists to prevent (business-rule validation must happen in Rust
-    # for these domains, not be pre-computed here against an
-    # incomplete local view). A loud failure here is the correct
-    # outcome, not a bug to route around.
+    # Read-side adapter for `persisted_by("Lambda")`; writes go through Runtime::RemoteDispatcher.
+    # Read-only: `append`/`project` raise, since a local write would bypass remote validation.
     class Lambda
       include Ports::Persistence::RemoteRuntime
 
@@ -50,41 +34,11 @@ module Hecks
             aggregate.name
           end
         region = setting(settings, :region, "us-east-1")
-        # Named, when this deployment's function isn't `hecks-<domain>`
-        # — `Client`'s own comment has the real case that needs it.
-        # Absent (every domain whose stack name was never pinned), the
-        # computation below is exactly as it was.
+        # Explicit function name, for deployments whose function is not `hecks-<domain>`.
         function = setting(settings, :function, nil)
-        # Two different "domain"s, deliberately not conflated: `domain`
-        # (this aggregate's own bluebook name — "Identity", "Governance")
-        # only ever prefixes the instances lookup, since that's how
-        # rust/host's own `Store::instances()` keys every record
-        # (`registry.rb`'s own `"#{a[:domain_name]}::#{a[:name]}#"`
-        # dump format, unchanged by which chapter attached it). The
-        # function to actually call is a different question: Governance
-        # and Identity aggregates are compiled into the attaching
-        # domain's own Lambda (one merged `Store` per target — Phase 0's
-        # framework-bluebook work), never a function of their own, so
-        # `settings[:domain]` is the wrong signal for `Client.new`.
-        # `root` is the boot's own directory (`Registry#root`, shared by
-        # every bluebook in one registry regardless of which one
-        # attached it) — `File.basename(root)` reproduces the exact
-        # same string `bin/project_deploy`'s own `stack_name` computes
-        # from the domain path, so the two can never name two
-        # different functions for the same deploy... on a local boot,
-        # where `root` is a real project directory. Inside the deployed
-        # Lambda itself `root` is always `/var/task` (every Lambda's own
-        # fixed code root, regardless of domain) — `File.basename` gives
-        # "task", not the domain name, and invokes the wrong function
-        # entirely. A real, live AccessDeniedException on
-        # "hecks-task" caught this: invisible through every earlier
-        # phase's own verify step, all run from a local boot, until
-        # WebFunction became the first Ruby process to ever make this
-        # exact call from inside a deployed Lambda. `DOMAIN_NAME` (set
-        # by bin/project_deploy's own WebFunction Environment) is the
-        # real, unambiguous signal in that specific context; the
-        # root-basename heuristic stays as the local-boot fallback,
-        # unchanged.
+        # `domain` only prefixes the instances lookup; the function to call is named by
+        # DOMAIN_NAME (set in a deployed Lambda, where root is always /var/task), else by
+        # root's basename, which matches hecks deploy project's stack name on a local boot.
         function_domain = ENV["DOMAIN_NAME"] || (root ? File.basename(root) : domain)
         @client = Client.new(domain: function_domain, region: region, function: function)
         @prefix = "#{domain}::#{aggregate.hecks_name}#"
@@ -128,21 +82,9 @@ module Hecks
         Ports::Query::InMemory.execute(instances.values, specification, args)
       end
 
-      # `entries`/`append`/`project` — the append-only contract
-      # `Ports::Persistence::AppendOnly` requires of every adapter
-      # (raises at construction if any are missing). Answered by
-      # `Ports::Persistence::RemoteRuntime`, included above: `entries` is
-      # `[]` unconditionally (Lambda's own Postgres is already the
-      # durable store — rust/host's rehydrate-and-replay journal, Phase
-      # 1 — there is no local write-ahead log for `recover!` to replay),
-      # `append`/`project` raise rather than silently no-op.
-
       # Reads a world setting under either a Symbol or a String key, with a fallback.
       #
-      # A `.world` block's settings arrive symbol-keyed from the DSL and
-      # string-keyed from a round-tripped export, so every read has to
-      # accept both — one helper rather than the same five lines per
-      # key.
+      # Settings arrive symbol-keyed from the DSL and string-keyed from a round-tripped export.
       #
       # @param settings [Hash] the world settings Hash to read from
       # @param key [Symbol] the setting name, tried as itself and as `key.to_s`
@@ -157,21 +99,8 @@ module Hecks
 
       private
 
-      # Re-fetched every call, deliberately not memoized across them —
-      # this adapter itself is long-lived (one instance per aggregate,
-      # held by the registry `RUNTIME = Hecks.boot(...)` builds once
-      # per Lambda web process — WebFunction's own top-level constant,
-      # reused warm across every HTTP request that process serves, not
-      # rebuilt per request the way memoizing here would wrongly assume).
-      # A real, live bug caught this: a mutation
-      # dispatched fine (RemoteDispatcher always calls the dispatch
-      # Lambda fresh) and the very next `.all` on the same warm
-      # container kept returning the state from before that mutation,
-      # forever, until the container cold-started — memoizing here
-      # made every write invisible to every read on a warm container.
-      # Keyed by bare id (the part after "Domain::Aggregate#"), not the
-      # full "Domain::Aggregate#id" string — callers already know which
-      # aggregate they're asking this instance about.
+      # Never memoized: the adapter outlives requests on a warm container, so a cached read
+      # would hide every later write. Keyed by the bare id after "Domain::Aggregate#".
       def instances
         @client.read.fetch("instances", {}).filter_map do |key, state|
           next unless key.start_with?(@prefix)
@@ -180,10 +109,7 @@ module Hecks
         end.to_h
       end
 
-      # Lambda's own JSON response is already Ruby-decoded with string
-      # keys (plain `JSON.parse`, no `symbolize_names:`) — decoded through
-      # the state codec (PR A3), the same IR-driven spelling every other
-      # adapter's read produces.
+      # The response is string-keyed JSON; the state codec decodes it as every adapter's read does.
       def build_instance(id, state)
         Runtime::Instance.new(aggregate: @aggregate, id: id, state: Ports::Persistence::StateCodec.decode(@aggregate, state))
       end

data/lib/hecks/adapters/driven/local_storage.rb

@@ -5,36 +5,10 @@ require_relative "../../runtime/instance"
 
 module Hecks
   module Adapters
-    # **A browser-hosted domain's own declared intent** — not a second Memory
-    # wearing a different name. Ruby has no way to reach a real browser's
-    # `window.localStorage` at all (it is per-tab, per-origin, JS-only,
-    # unreachable over any network the way D1's own REST API is) — so
-    # this Ruby-side adapter is honestly a stand-in: in-process, ephemeral,
-    # mechanically identical to Memory. What earns it a name of its own
-    # is what it declares, not what it happens to do in Ruby: `persisted_by
-    # "LocalStorage"` says "this domain expects real, durable, single-
-    # device storage the moment it's actually running where it's meant to
-    # run" — the same distinction Heki (real local durability) already
-    # draws against Memory (deliberately ephemeral, test/example-only),
-    # one adapter over. `bin/console`, the fuzzer, `spec/`, `bin/
-    # model_check` all get a domain that boots and behaves correctly
-    # against this adapter; only a real browser gets the real durability.
-    #
-    # The real browser half lives outside this file entirely: `rust/web`'s
-    # `dispatch(json)` (docs/implemented/decisions/0015) takes an optional
-    # `"seed"` (the exact `"instances"` shape it also answers with) plus
-    # `"steps"` — a host rehydrates from a prior snapshot and replays only
-    # the new command(s), rather than the whole history every call. A
-    # page bound to this adapter is expected to hold that snapshot in
-    # `window.localStorage` itself (get on load, set after every
-    # `dispatch`) — the seed/instances round trip is the adapter, once
-    # you're in the one runtime that can actually reach the storage this
-    # name promises.
+    # Declares browser-local storage; in Ruby it behaves like Memory (in-process, ephemeral).
+    # Only a real browser page, holding the rust/web `dispatch` snapshot, gets durability.
     class LocalStorage
-      # Tenant-capable trivially, same reasoning as Memory's own — a
-      # browser tab is exactly one origin, exactly one user; there is no
-      # second tenant this in-process Hash could ever confuse a first
-      # one with.
+      # Trivially tenant-capable, as Memory is: a browser tab is one origin and one user.
       #
       # @return [Boolean] true, always
       def self.tenant_capable? = true
@@ -79,10 +53,7 @@ module Hecks
 
       # Answers a declared query specification against the projected records.
       #
-      # The decision the guide asks for, made explicitly: no compiled
-      # dialect of its own, same as Heki/Memory — a personal-scale local
-      # store answering by walking `all` is correct on day one, and
-      # nothing about a browser tab's own data volume asks for pushdown.
+      # No compiled dialect, as with Heki and Memory: walking `all` suffices at tab-sized volumes.
       #
       # @param specification [QuerySpecification::Common::Options,
       #   Bluebook::Behaviour::ReadModel::FilteredOptions] the declared query specification
@@ -181,13 +152,7 @@ module Hecks
 
       def copy(state) = Ports::Persistence::StateCodec.copy(@aggregate, state)
 
-      # Not lineage_capable? — deliberately absent, the same trade Heki
-      # makes and states plainly (writing-an-adapter.md's own section on
-      # it): a domain bound here has no edge for its own shape to travel
-      # across if it ever changes; that must be hand-migrated, or the
-      # shape must not change. A browser-local personal store is exactly
-      # the small-adapter case that guide names as a fine place to make
-      # that trade.
+      # Deliberately not lineage_capable?, as with Heki: a shape change must be hand-migrated.
     end
   end
 end

data/lib/hecks/adapters/driven/memory.rb

@@ -5,22 +5,13 @@ require_relative "../../runtime/instance"
 
 module Hecks
   module Adapters
-    # The default, no-external-dependency persistence/query adapter — a
-    # plain in-process Hash of `Runtime::Instance` records per aggregate,
-    # with an append-only `@entries`/`@events` log alongside it. Every
-    # behaviors suite must resolve to this one (see
-    # Behaviors::Expectations#guard_memory_only!) precisely because a fresh
-    # instance really is a fresh store, with nothing shared across tests or
-    # tenants.
+    # The default in-process adapter: a Hash of `Runtime::Instance` records
+    # per aggregate, plus an append-only `@entries`/`@events` log.
     class Memory
       # Reports that two tenant boots of this adapter never share state.
       #
-      # **Tenant-capable trivially** — see `Runtime::TenantCheck`'s own header
-      # for the full reasoning. `@records` is a plain instance variable;
-      # two `Runtime.boot` calls build two entirely separate Registry
-      # objects and, through them, two entirely separate Memory
-      # instances, so two tenant boots never share this adapter's state
-      # by construction — nothing here needs to know "tenant" exists.
+      # Trivially true: `@records` is a plain ivar, and each `Runtime.boot`
+      # builds a wholly separate Memory instance.
       #
       # @return [Boolean] always true
       def self.tenant_capable? = true
@@ -43,6 +34,7 @@ module Hecks
         @events    = []
         @entries   = []
         @outbox    = []
+        @outbox_deliveries = {}
       end
 
       # Looks up the current record for one aggregate identity.
@@ -81,11 +73,10 @@ module Hecks
 
       # Records one journal entry, holding a codec copy of its state.
       #
-      # Through the state codec, like every durable adapter (PR A3): the
-      # journal holds `StateCodec.copy` — exactly what an encode-to-JSON
-      # then decode would hand back — never the caller's own live state
-      # objects, so an entry read back here has the same deep-symbol,
-      # plain-Hash shape a Heki/Sqlite/Postgres entry has.
+      # Like every durable adapter, the journal holds `StateCodec.copy` —
+      # what an encode-to-JSON then decode would hand back — never the
+      # caller's own live state objects, so an entry read back here has
+      # the same deep-symbol, plain-Hash shape a Heki/Sqlite/Postgres entry has.
       #
       # @param entry [Ports::Persistence::Entry] the save or delete to journal
       # @return [Ports::Persistence::Entry] the caller's own `entry`, not the journalled copy
@@ -163,18 +154,8 @@ module Hecks
 
       # Empties the records, journal, event log and outbox, keeping the adapter itself.
       #
-      # Every other driven adapter (Postgres/PostgresEra/Sqlite/D1)
-      # implements this too — `Ports::Persistence::AppendOnly#reset!`
-      # forwards to it and only raises when the wrapped adapter doesn't
-      # respond to `reset!` at all, and nothing about "in memory" implies
-      # "cannot be cleared". Existing callers that fully re-`Hecks.boot`
-      # a domain per test case don't need this — they get a brand new
-      # `Memory` instance, with brand new empty `@records`/`@events`/
-      # `@entries`, for free. This is for the other case: a caller that
-      # deliberately keeps one booted runtime across many cases (to skip
-      # `load_domain`'s own per-boot parse/verify cost) and wants each
-      # case to start from the same clean slate `Hecks.boot` would have
-      # given it, without paying for a fresh boot to get there.
+      # Lets a caller that keeps one booted runtime across many cases reset
+      # to a clean slate without paying for a fresh boot.
       #
       # @return [Adapters::Memory] self, now empty
       def reset!
@@ -182,6 +163,7 @@ module Hecks
         @events  = []
         @entries = []
         @outbox  = []
+        @outbox_deliveries = {}
         self
       end
 
@@ -205,10 +187,11 @@ module Hecks
       #   was a duplicate
       def outbox_enqueue(rows)
         rows.filter_map do |row|
-          next nil if @outbox.any? { |held| held.delivery_id == row.delivery_id }
+          next nil if @outbox_deliveries.key?(row.delivery_id)
 
           row.id = @outbox.size + 1
           @outbox << row
+          @outbox_deliveries[row.delivery_id] = true
           row
         end
       end
@@ -219,7 +202,7 @@ module Hecks
       # @return [Boolean] true when the row was pending and is now claimed; false when it is
       #   unknown or not pending
       def outbox_claim(id) # rubocop:disable Naming/PredicateMethod
-        row = @outbox.find { |held| held.id == id }
+        row = outbox_row(id)
         return false unless row&.pending?
 
         row.status = "claimed"
@@ -235,7 +218,7 @@ module Hecks
       # @param error [String, nil] the failure description, or nil to clear it
       # @return [Boolean] true when the row exists and was updated; false when no row has `id`
       def outbox_settle(id, status:, error: nil) # rubocop:disable Naming/PredicateMethod
-        row = @outbox.find { |held| held.id == id } or return false
+        row = outbox_row(id) or return false
         row.status = status.to_s
         row.error  = error
         true
@@ -253,74 +236,23 @@ module Hecks
 
       private
 
-      # The language's own bootstrap saves its self-description quadratically
-      # otherwise. `MetaValidator::Judge` dispatches every declaration in the
-      # self-hosted grammar into a fresh, private, never-durable `Memory`
-      # store (meta_validator.rb's own header: "each bluebook is judged in a
-      # fresh in-memory store") — and every nested-entity dispatch (a
-      # `ValueObject::Member`, then one `ValueObject::Member::Pair` per
-      # key/value pair) re-saves the whole parent aggregate, because entities
-      # have no storage of their own (S17, ADR 0026). A table of N member
-      # rows costs O(N) dispatches, each paying twice for the aggregate's own
-      # size-N state: once in `StateCodec.copy` (`append`/`project`'s own
-      # encode-then-decode round trip) and again in `Instance#initialize`'s
-      # `hydrate_with_defaults`, which re-walks and re-validates every
-      # element of an entity list on every save regardless of how many of
-      # them were already valid as of the previous one
-      # (`Value::EntityListCoercion#hydrate_entity_list` has no "already
-      # hydrated" shortcut for entity elements — only a value-object list
-      # element gets one). Both are O(N) per save, so a table of N rows
-      # costs O(N^2) total — and it is paid by every rspec worker and every
-      # `bin/*` subprocess that boots the language at all (found live: PR
-      # #738's 128-row `RefusalSiteArgument` table alone tripled this one
-      # aggregate's own save time, 6.7s -> 18.2s).
+      # Finds a held outbox row by id in constant time.
       #
-      # `Runtime::Value.judge_bootstrapping?` (judge.rb's own `send_to`,
-      # wrapping every dispatch the judge makes) is already the flag that
-      # marks exactly this window and nothing else — "never for a real
-      # domain's own declared value objects... which Judge never dispatches
-      # commands against" (coercion.rb's own comment on the same flag). It
-      # is reused here rather than a new toggle for the same reason: one
-      # flag, one meaning, checked by two unrelated callers for two
-      # unrelated purposes (loosening a scalar-shape check there, skipping
-      # both round trips here) is simpler to reason about than two flags
-      # that would always be true or false together.
-      #
-      # Why skipping both is safe here, and only here: `entry.state` a save
-      # ever hands this adapter is always `instance.state.dup`
-      # (`AppendOnly#save`) — a shallow copy of an already-hydrated,
-      # already-validated live `Instance`'s own state, built by the very
-      # same `Value.for_attribute`/`hydrate_with_defaults` machinery
-      # `StateCodec.copy` and `Instance.new`'s default (`hydrate: true`)
-      # path would otherwise redo. Every value inside it — a `Runtime::
-      # Value` (frozen through, see value.rb's own header) or a `list_of`
-      # attribute's own array (`Freezer.deep`d the moment it was built,
-      # instance.rb's own header on `Instance#dup`) — is already immutable,
-      # so a bare top-level `.dup` is exactly as safe as `Instance#dup`
-      # already trusts it to be everywhere else in this codebase; nothing
-      # below the top level is ever mutated in place. Re-deriving the same
-      # answer through the codec and through re-hydration is therefore
-      # pure, avoidable cost for this one caller — never a correctness
-      # requirement.
-      #
-      # `bootstrap_fast_path?` is the guard, and it is deliberately cheap —
-      # O(this aggregate's own declared attribute count), never O(N) — so
-      # it cannot reintroduce the very cost it exists to avoid: `StateCodec.
-      # decoded?` (the obvious-looking alternative) recurses into every
-      # `list_of` element to check it, which is exactly the O(N) walk this
-      # whole change removes. A `Hash` with every top-level key already a
-      # `Symbol` is what `Instance#state` always looks like (`Value.hydrate`
-      # refuses anything else, coercion.rb's own header), so it is checked
-      # here instead — true for the actual shape every real save has,
-      # false (falling back to the always-correct slow path) for anything
-      # that somehow doesn't.
-      #
-      # Verified empirically before landing, not just argued: instrumenting
-      # every bootstrapping-time save across a full `grammar_registry` boot
-      # and comparing this fast path's own state, journal entry, and stored
-      # `Instance` against the unmodified `StateCodec.copy` + `Instance.new
-      # (hydrate: true)` pipeline's found them equal (`==`) for every one of
-      # 6,617 saves, zero mismatches.
+      # Ids are assigned as the 1-based position at enqueue and rows are never
+      # removed, so the id is the row's index plus one.
+      def outbox_row(id)
+        return nil unless id.is_a?(Integer) && id >= 1
+
+        @outbox[id - 1]
+      end
+
+      # Skips the codec copy and rehydration round trip while judging the
+      # self-hosted grammar (S17, ADR 0026), where re-validating already-valid
+      # entity state costs O(N) per save and O(N^2) across an N-row table.
+      # Safe only here: `entry.state` is already hydrated, validated, deep-
+      # frozen state from the same Value machinery the skipped paths rerun.
+      # The check itself must stay O(this aggregate's attribute count), not
+      # O(N), so it can't reintroduce the cost it exists to avoid.
       def bootstrap_fast_path?(state)
         Runtime::Value.judge_bootstrapping? && state.is_a?(Hash) && state.keys.all?(Symbol)
       end

data/lib/hecks/adapters/driven/mock_stripe_adapter.rb

@@ -2,20 +2,8 @@
 
 module Hecks
   module Adapters
-    # A generic stand-in for a real Checkout-Session-style adapter — no
-    # network call, no real account, matching whatever real payment
-    # adapter a project pairs it with by shape alone
-    # (`create_session(event:, registration_id:, success_url:, cancel_url:)
-    # -> a URL string`), the same way `Memory` stands in for a real
-    # persistence adapter without knowing anything about the domain bound
-    # to it. Never reads `event`'s own fields — a real adapter needs the
-    # price/name inside it to build a session a payer actually sees;
-    # this only needs to look enough like one to swap in.
-    #
-    # The URL it returns carries the same `registration_id` a real
-    # webhook's metadata would, so a caller building its own signed
-    # webhook against it (a smoke test, CI) has something real to key
-    # off of — the real shape production has, minus the network hop.
+    # A network-free stand-in for a Checkout-Session-style payment adapter, matching it by
+    # method shape alone. The returned URL carries `registration_id`, as webhook metadata would.
     class MockStripeAdapter
       # Accepts and discards the shared adapter constructor arguments; this adapter holds no
       # state of its own.
@@ -29,14 +17,10 @@ module Hecks
       # Builds a fake checkout URL carrying `registration_id`, standing in for a real
       # Checkout-Session call.
       #
-      # @param event [Object] the record data a real adapter would read the price and name
-      #   from; adapter-defined shape (whatever the declaring bluebook's `checkout` port
-      #   operation supplies as `event`) and never read here
-      # @param registration_id [String] the registration id to key a signed webhook off of;
-      #   embedded in the returned URL, never read otherwise
+      # @param event [Object] the record data a real adapter would read; never read here
+      # @param registration_id [String] embedded in the returned URL, never read otherwise
       # @param success_url [String] the base URL to redirect a successful payer to
-      # @param cancel_url [String] accepted for the shared checkout-adapter call shape and
-      #   never read
+      # @param cancel_url [String] accepted for the shared call shape and never read
       # @return [String] `success_url` with `mock_checkout=1` and `mock_registration_id`
       #   query parameters appended
       def create_session(event:, registration_id:, success_url:, cancel_url:)