hecks 3.0.5 → 3.1.0

data/lib/hecks/quality_control/cli/qa_postgres_role.rb

@@ -4,12 +4,12 @@ require "pg"
 
 module Hecks
   module QualityControlCli
-    # The command behind `hecks quality_control create_ledger_role`: creates the ordinary Postgres
-    # role the QA ledger connects as and makes it own the database. It is idempotent, and refuses a
-    # superuser or `BYPASSRLS` role, which the era write-fence cannot bind.
+    # The command behind `hecks quality_control sweep.create_ledger_role`: creates the ordinary
+    # Postgres role the QA ledger connects as and makes it own the database. It is idempotent, and
+    # refuses a superuser or `BYPASSRLS` role, which the era write-fence cannot bind.
     #
-    #   hecks quality_control create_ledger_role <database> [--role <role>]   # role defaults to
-    # hecks_qa
+    #   hecks quality_control sweep.create_ledger_role <database> [--role <role>]   # role defaults
+    # to hecks_qa
     class QaPostgresRole
       USAGE = "usage: hecks quality_control create_ledger_role <database> [--role <role>]"
 

data/lib/hecks/quality_control/cli/qa_pr_check.rb

@@ -7,9 +7,9 @@ require_relative "../adapters/git_pr"
 
 module Hecks
   module QualityControlCli
-    # The command behind `hecks quality_control check_pull_requests`: checks CI for every PR the
-    # QualityControl ledger tracks as open (`Patch` and `Improvement`). It starts a `Clearance` per
-    # unsettled head commit and lets the CI port's policies record the verdict.
+    # The command behind `hecks quality_control clearance.check_pull_requests`: checks CI for every
+    # PR the QualityControl ledger tracks as open (`Patch` and `Improvement`). It starts a
+    # `Clearance` per unsettled head commit and lets the CI port's policies record the verdict.
     #
     # Exit codes: 0 nothing to act on; 1 operational error (`gh`, bad sha, ledger boot);
     # 2 a newly red PR, with the details on stdout. A commit's `Clearance` is minted once and never

data/lib/hecks/quality_control/cli/qa_sweep/all_mode.rb

@@ -76,9 +76,9 @@ module Hecks
           query("Target.Held").select { |row| row[:claimed_at][:value] + row[:window][:value] <= now }
         end
 
-        # Spawns `hecks quality_control ask run target=<target>` as a fresh process, not a fork.
-        # Seeds/steps forward only when given, so each child derives its own depth from its own
-        # streak.
+        # Spawns `hecks quality_control query sweep.run target=<target>` as a fresh process, not a
+        # fork. Seeds/steps forward only when given, so each child derives its own depth from its
+        # own streak.
         def spawn_sweep_child(target_reference, seeds_override, steps_override, self_consistency,
                               modes:, parity: false)
           # Unlinked at once: the open fd stays readable, nothing is left on disk, and no fixed path

data/lib/hecks/quality_control/cli/qa_sweep/checks.rb

@@ -304,8 +304,8 @@ module Hecks
 
         # Coverage-guided generation's corpus, one JSON file per (target, mode): `--all`'s waves can
         # run a target's primary sweep and its persistence-parity/concurrency variants as separate
-        # `hecks quality_control ask run` processes within the same tick, and each explores a
-        # conceptually independent axis of the same domain, so each keeps its own file rather than
+        # `hecks quality_control query sweep.run` processes within the same tick, and each explores
+        # a conceptually independent axis of the same domain, so each keeps its own file rather than
         # sharing one that nothing here locks.
         def coverage_corpus_path(target_reference, mode)
           File.join(@coverage_corpus_dir, "#{filesystem_safe_component(target_reference)}-#{mode}.json")

data/lib/hecks/quality_control/cli/qa_sweep.rb

@@ -22,10 +22,10 @@ require_relative "qa_sweep/finding_report"
 
 module Hecks
   module QualityControlCli
-    # The command behind `hecks quality_control ask run`: runs one claim, sweep, conclude and
-    # release cycle against a `QualityControl` target (`USAGE` lists the forms, from a bare sweep
-    # of the least recently swept target to `--all` and `--release`). It stops with a report and
-    # exit 2 on the first surprised check, and never logs a `Bug` itself.
+    # The command behind `hecks quality_control query sweep.run`: runs one claim, sweep, conclude
+    # and release cycle against a `QualityControl` target (`USAGE` lists the forms, from a bare
+    # sweep of the least recently swept target to `--all` and `--release`). It stops with a report
+    # and exit 2 on the first surprised check, and never logs a `Bug` itself.
     #
     # Exit codes: 0 clean; 1 operational error; 2 found something (the sweep stays open and the
     # target is suspended by the ledger's `SuspendOnSurprise` policy until `--release`).
@@ -136,11 +136,12 @@ module Hecks
         path.start_with?("/") ? File.expand_path(path) : File.expand_path(path, @root)
       end
 
-      # A target reference may itself contain `/` (`hecks quality_control discover_external_domains`
-      # suggests `repo/entity`-shaped references for an external domain), but every reference also
-      # gets folded into a single filename component: a log prefix, a shrunk-repro filename, a
-      # coverage-corpus filename. Left raw, an embedded `/` is read as an extra path segment that
-      # nothing creates, breaking the write. This never changes what is stored as the
+      # A target reference may itself contain `/` (`hecks quality_control
+      # target.discover_external_domains` suggests `repo/entity`-shaped references for an external
+      # domain), but every reference also gets folded into a single filename component: a log
+      # prefix, a shrunk-repro filename, a coverage-corpus filename. Left raw, an embedded `/` is
+      # read as an extra path segment that nothing creates, breaking the write. This never changes
+      # what is stored as the
       # `Target`/`Sweep` reference itself.
       def filesystem_safe_component(reference)
         reference.gsub(/[^A-Za-z0-9_.-]/, "-")

data/lib/hecks/quality_control/cli/qa_tick.rb

@@ -9,9 +9,9 @@ require_relative "child"
 
 module Hecks
   module QualityControlCli
-    # The command behind `hecks quality_control tick`: one QA tick. It needs a clean tree, rebases
-    # on `origin/main`, then runs `QaPrCheck`, `QaSweep --all` and `QaGeneratedDomains --from-dials`
-    # and prints one report.
+    # The command behind `hecks quality_control sweep.tick`: one QA tick. It needs a clean tree,
+    # rebases on `origin/main`, then runs `QaPrCheck`, `QaSweep --all` and `QaGeneratedDomains
+    # --from-dials` and prints one report.
     #
     # It exits 2 if any step found something, 1 if none did but a step errored or it refused, 0 if
     # all are clean. The step order is enforced here, not in prose. `QA_REPO_DIR` picks the

data/lib/hecks/quality_control/quality_control.bluebook

@@ -22,7 +22,7 @@ unless defined?(QualityControlDials)
     # `SweepDepth.for_streak`. The last row (`upto: Float::INFINITY`) is the ceiling.
     WIDENING_TIERS = settings.widening_tiers
 
-    # How many `hecks quality_control ask run <target>` children `--all` keeps running at once.
+    # How many `hecks quality_control query sweep.run <target>` children `--all` keeps running at once.
     SWEEP_MAX_PARALLEL = settings.sweep_max_parallel
 
     # How long the `/loop hecks_qa` caller waits for a tick's report before assuming it stalled.
@@ -53,11 +53,11 @@ unless defined?(QualityControlDials)
     # How many of the least-hit verbs the next seed weights up; 0 turns the lever off.
     FAVOR_RARE_VERBS = settings.favor_rare_verbs
 
-    # Whether `hecks quality_control ask run` also runs the self-consistency pass (cold rehydration, replay
+    # Whether `hecks quality_control query sweep.run` also runs the self-consistency pass (cold rehydration, replay
     # idempotency, value-object JSON round trip) on the same generated sequence.
     SELF_CONSISTENCY_CHECKS = settings.self_consistency_checks
 
-    # Candidate replays `hecks quality_control ask run` may spend shrinking one surprised check; 0 turns shrinking
+    # Candidate replays `hecks quality_control query sweep.run` may spend shrinking one surprised check; 0 turns shrinking
     # off. `concurrency` is never shrunk: a race does not reproduce on demand.
     SHRINK_BUDGET = settings.shrink_budget
 
@@ -74,7 +74,7 @@ unless defined?(QualityControlDials)
     ROTATION_STALE_FLOOR_SECONDS = settings.rotation_stale_floor_seconds
 
     # Ceiling on `--seeds` for `--persistence-parity`, which pays for real Postgres per dispatch.
-    # `hecks quality_control ask run` clamps down, never up, and prints a note.
+    # `hecks quality_control query sweep.run` clamps down, never up, and prints a note.
     PERSISTENCE_PARITY_SEED_CAP = settings.persistence_parity_seed_cap
 
     # Ceiling on `--seeds` for the concurrency mode, which needs two disposable schemas per seed.
@@ -85,11 +85,11 @@ unless defined?(QualityControlDials)
     # disposable database.
     ADAPTER_PARITY_PAIRS = settings.adapter_parity_pairs
 
-    # Which comparison modes `hecks quality_control ask run` may run: the enabled ones intersected with what
+    # Which comparison modes `hecks quality_control query sweep.run` may run: the enabled ones intersected with what
     # `TargetCapabilities.infer(path)` finds in the target. `--modes a,b,c` overrides for one run.
     #
     # `wasm_front` and `adapter_parity_postgres` are off because nothing runs them; the others are
-    # built and off because their I/O cost across the rotation is unmeasured. `hecks quality_control ask run`
+    # built and off because their I/O cost across the rotation is unmeasured. `hecks quality_control query sweep.run`
     # refuses to start when a mode outside `TargetCapabilities::RUNNABLE_MODES` is enabled.
     MODES = settings.modes
 
@@ -101,7 +101,7 @@ unless defined?(QualityControlDials)
     # off. Kept low: a dry run creates no state for later steps to act on.
     DRY_RUN_FRACTION = settings.dry_run_fraction
 
-    # How many generated domains one `hecks quality_control tick` checks after the rotation sweep; 0 skips the
+    # How many generated domains one `hecks quality_control sweep.tick` checks after the rotation sweep; 0 skips the
     # step.
     GENERATED_DOMAINS_PER_TICK = settings.generated_domains_per_tick
 
@@ -140,7 +140,7 @@ Hecks.bluebook "QualityControl" do
     attribute :last_swept, SweptIn
     # Recency-decayed count of how often this chapter was worth sweeping; see `YieldScore`.
     attribute :yield_score, YieldScore
-    # Consecutive `Release`s that came back clean; `hecks quality_control ask run` reads it to choose sweep depth.
+    # Consecutive `Release`s that came back clean; `hecks quality_control query sweep.run` reads it to choose sweep depth.
     # Zero means no streak yet, shared on purpose by a never-swept target and a just-surprised one.
     attribute :clean_streak, CleanStreak
     # Comma-joined mode names recorded at release from what the runner inferred. Stored so
@@ -367,7 +367,7 @@ Hecks.bluebook "QualityControl" do
     end
 
     query "Suspended" do
-      description "Chapters a check surprised, waiting for a person — each with the reason the policy wrote. Nothing automatic touches these; hecks quality_control ask run <target> --release --notes is how one comes back."
+      description "Chapters a check surprised, waiting for a person — each with the reason the policy wrote. Nothing automatic touches these; hecks quality_control query sweep.run <target> --release --notes is how one comes back."
       where(status: "suspended")
       order_by :reference
     end
@@ -854,7 +854,7 @@ Hecks.bluebook "QualityControl" do
     # `default:` keeps rows already on file hydrating as `undecided`.
     attribute :disposition,   one_of("undecided", "self_contained", "bigger"), default: { value: "undecided" }
     # `default: yes` is true of every bug on file, since `Log` always required a failing
-    # demonstration. `no` is the escape hatch for a real but flaky finding (`hecks quality_control log
+    # demonstration. `no` is the escape hatch for a real but flaky finding (`hecks quality_control bug.log
     # --reproduced no`).
     attribute :reproduced,    one_of("yes", "no"), default: { value: "yes" }
     # Bugs are claimed like chapters so two agents do not fix the same one. A `given` rather than a
@@ -1023,7 +1023,7 @@ Hecks.bluebook "QualityControl" do
       # Optional; `Name` covers bugs logged without one. No `sets`: on a creation command an
       # argument sharing the aggregate field's name lands there directly.
       attribute :name,          BugName, optional: true
-      # Optional; omitted, the aggregate's default `yes` applies. `hecks quality_control log --reproduced no`
+      # Optional; omitted, the aggregate's default `yes` applies. `hecks quality_control bug.log --reproduced no`
       # uses it to skip its must-fail check for a finding with no reliable pass/fail signal.
       attribute :reproduced,    one_of("yes", "no"), optional: true
 
@@ -1059,7 +1059,7 @@ Hecks.bluebook "QualityControl" do
     end
 
     # Not a lifecycle move (the `Rank` shape); `undecided` is only ever the birth value.
-    # `hecks quality_control log --triage` dispatches this right after `Log`.
+    # `hecks quality_control bug.log --triage` dispatches this right after `Log`.
     command "Triage" do
       role "QA engineer"
       goal "Write down whether this can be fixed on the spot or needs a bigger judgment"
@@ -1712,7 +1712,7 @@ Hecks.bluebook "QualityControl" do
     end
   end
 
-  # A PR opened for a Bug's own fix, recorded at open so `hecks quality_control check_pull_requests` looks it up by number.
+  # A PR opened for a Bug's own fix, recorded at open so `hecks quality_control clearance.check_pull_requests` looks it up by number.
   # Not named `PullRequest`: `Ticket::PullRequest` exists and aggregate names install on Object.
   aggregate "Patch" do
     description "One pull request opened for a Bug's own fix — number, branch, and the exact commit that makes checking its CI status a lookup instead of a guess."
@@ -1814,9 +1814,9 @@ Hecks.bluebook "QualityControl" do
       emits "PatchClosed"
     end
 
-    # The worklist for `hecks quality_control check_pull_requests`: ask `gh` about each row's exact number, never search.
+    # The worklist for `hecks quality_control clearance.check_pull_requests`: ask `gh` about each row's exact number, never search.
     query "Open" do
-      description "Every PR we've opened that's still open, by number — hecks quality_control check_pull_requests's own worklist. For each of these, ask gh for exactly this number's CI status; nothing here is a guess."
+      description "Every PR we've opened that's still open, by number — hecks quality_control clearance.check_pull_requests's own worklist. For each of these, ask gh for exactly this number's CI status; nothing here is a guess."
       where(status: "opened")
       order_by :number
     end
@@ -1979,7 +1979,7 @@ Hecks.bluebook "QualityControl" do
     end
 
     query "Open" do
-      description "Every PR we've landed for deliberate, non-bugfix work that's still open, by number — hecks quality_control check_pull_requests's own second worklist, the same shape Patch.Open already gives for a bug's own fix. For each of these, ask gh for exactly this number's CI status; nothing here is a guess."
+      description "Every PR we've landed for deliberate, non-bugfix work that's still open, by number — hecks quality_control clearance.check_pull_requests's own second worklist, the same shape Patch.Open already gives for a bug's own fix. For each of these, ask gh for exactly this number's CI status; nothing here is a guess."
       where(status: { in: "opened,landed,needs_fix" })
       order_by :number
     end
@@ -2217,14 +2217,14 @@ Hecks.bluebook "QualityControl" do
   # Nothing reacts to `TicketRaised` on purpose: a ticket waits until somebody submits it.
 
   # The rotation's one automatic reaction. Releasing on `SweepConcluded` cannot work: that event
-  # carries no target id, `next_streak` or yield score, so `hecks quality_control ask run` still releases.
+  # carries no target id, `next_streak` or yield score, so `hecks quality_control query sweep.run` still releases.
   # `on Sweep::CheckSurprised`, not `Sweep::Check::...`: an entity command's event is stamped with
   # its parent aggregate. `Check.Surprised` restates `target` so the id rides in.
   policy "SuspendOnSurprise" do
     on      Sweep::CheckSurprised
     trigger Target::Suspend, with: {
       target: :target,
-      reason: { value: "a check surprised — a person releases with hecks quality_control ask run <target> --release --notes" }
+      reason: { value: "a check surprised — a person releases with hecks quality_control query sweep.run <target> --release --notes" }
     }
   end
 end

data/lib/hecks/quality_control/quality_control.hecksagon

@@ -3,7 +3,7 @@
 # Hecks chapter binds it through its world's `default_adapter`; the ports every one of them shares
 # are in quality_control.ports.hecksagon.
 Hecks.hecksagon "QualityControl" do
-  uses_framework "Governance"
+  attaches "Governance"
   persisted_by "Memory"
 end
 

data/lib/hecks/runtime/registry/verification.rb

@@ -20,8 +20,7 @@ module Hecks
 
           @hecksagons.each_value do |hexagon|
             refuse_ungoverned_roles!(hexagon)
-            refuse_unwired_framework_members!(hexagon)
-            refuse_unwired_vendored_bluebooks!(hexagon)
+            refuse_unwired_attachments!(hexagon)
             refuse_bounded_without_acl!(hexagon)
 
             hexagon.binds.each do |bind|
@@ -153,7 +152,7 @@ module Hecks
         private
 
         # Checked once against the merged hecksagon so a domain split across multiple
-        # hecksagon files sees every uses_framework declaration first. A role is real
+        # hecksagon files sees every `attaches` declaration first. A role is real
         # access control only once an authorization provider exists to check it against
         # (ADR 0025); a provider is recognized by declaring authorization, not by name.
         def refuse_ungoverned_roles!(hexagon)
@@ -172,16 +171,18 @@ module Hecks
                 "without that it is silent decoration, the exact defect this refusal exists to catch"
         end
 
-        # `uses_embryonaut_bluebook` only loads a package's `.bluebook` files; persistence,
-        # Governance and the `translates` ACL live on a sibling hecksagon the consumer must
-        # declare, or cross-context field mapping has nowhere to be written.
-        def refuse_unwired_vendored_bluebooks!(hexagon)
-          Array(hexagon.vendored_bluebooks).each do |package|
-            chapter_name = Naming.pascal(package)
+        # `attaches` loads a bounded context; the consumer must declare the sibling hecksagon
+        # that is its ACL (Governance/Identity/Privacy already do). A vendored package only
+        # loads its `.bluebook` files, so persistence, Governance and the `translates` ACL live
+        # on that sibling too, or cross-context field mapping has nowhere to be written.
+        def refuse_unwired_attachments!(hexagon)
+          hexagon.attachments.each do |attachment|
+            chapter_name = attachment.chapter_name
             next if hecksagon(chapter_name)
 
+            what = attachment.vendor? ? "vendored bluebook #{attachment.name.inspect}" : chapter_name.inspect
             raise WiringError,
-                  "#{hexagon.domain} attaches vendored bluebook #{package.inspect} " \
+                  "#{hexagon.domain} attaches #{what} " \
                   "(bounded context #{chapter_name}) but never declared " \
                   "Hecks.hecksagon #{chapter_name.inspect} — put that sibling " \
                   "(and any `translates` ACL) in context_map.hecksagon; " \
@@ -189,23 +190,8 @@ module Hecks
           end
         end
 
-        # `uses_framework` and `attaches` load a bounded context; the consumer must declare the
-        # sibling hecksagon that is its ACL (Governance/Identity/Privacy already do).
-        def refuse_unwired_framework_members!(hexagon)
-          hexagon.member_chapters.each do |member|
-            next if hecksagon(member)
-
-            raise WiringError,
-                  "#{hexagon.domain} attaches #{member.inspect} " \
-                  "(bounded context) but never declared Hecks.hecksagon " \
-                  "#{member.inspect} — put that sibling (and any `translates` " \
-                  "ACL) in context_map.hecksagon; same-name blocks merge, " \
-                  "order-independent."
-          end
-        end
-
-        # An explicit `bounded` mark on a consumer chapter always needs an ACL. `uses_framework`
-        # / `uses_embryonaut_bluebook` mark the attached chapter bounded and require the sibling
+        # An explicit `bounded` mark on a consumer chapter always needs an ACL. `attaches`
+        # marks the attached chapter bounded and requires the sibling
         # hecksagon above; they don't require a `translates` on it unless the consumer also
         # wrote `bounded`.
         # rust/host Google sign-in reads ir.json's membership/identity keys, never a deploy-time
@@ -217,7 +203,7 @@ module Hecks
           raise WiringError,
                 "a chapter that provides \"membership\" is loaded, but none provides " \
                 "\"identity\" — rust/host Google sign-in cannot register or link an " \
-                "identity from the hecksagon/world. Attach Identity (`uses_framework " \
+                "identity from the hecksagon/world. Attach Identity (`attaches " \
                 "\"Identity\"` plus a sibling Hecks.hecksagon \"Identity\") so the " \
                 "identity verbs are exported onto ir.json, not guessed at deploy."
         end
@@ -387,7 +373,7 @@ module Hecks
           providers = Framework.providers_of(Bluebook::Capabilities::AUTHORIZATION)
           return "attaches a chapter that provides \"authorization\" (no framework member declares one)" if providers.empty?
 
-          providers.map { |name| "uses_framework #{name.inspect}" }.join(" or ")
+          providers.map { |name| "attaches #{name.inspect}" }.join(" or ")
         end
 
         # Every command this domain declares, an aggregate's own and every entity nested

data/lib/hecks/runtime/registry.rb

@@ -139,8 +139,7 @@ module Hecks
         mark_bounded(item.domain) if item.bounded?
       end
 
-      # Marks `name` as a bounded context — called automatically by
-      # `uses_framework` / `uses_embryonaut_bluebook`, and by
+      # Marks `name` as a bounded context — called automatically by `attaches`, and by
       # `add_hecksagon` when the block itself declared `bounded`.
       # A bounded chapter wraps in its own module (no Object shortcut)
       # and must have a `translates` ACL or boot refuses.
@@ -151,8 +150,7 @@ module Hecks
         @bounded_chapters[name.to_s] = true
       end
 
-      # Says whether `name` is a bounded context — attached via
-      # `uses_framework` / `uses_embryonaut_bluebook`, or a consumer
+      # Says whether `name` is a bounded context — attached via `attaches`, or a consumer
       # chapter that declared `bounded` on its own hecksagon.
       #
       # @param name [String, Symbol] the chapter name to check
@@ -242,7 +240,7 @@ module Hecks
       def verbs = @bluebooks.values.flat_map(&:verbs).sort
 
       # The chapter that answers a role check for `domain`: the domain's own chapter, or
-      # a framework member its hecksagon attaches, that declares `provides "authorization"`.
+      # a chapter its hecksagon attaches, that declares `provides "authorization"`.
       #
       # @param domain [String, Symbol] the domain whose role checks are being resolved
       # @return [Bluebook::Chapter, nil] the chapter that answers `domain`'s role
@@ -275,7 +273,7 @@ module Hecks
         return attached if attached
 
         # Falls back to any loaded chapter: a consuming domain often wires Identity as
-        # Hecks.hecksagon "Identity" rather than via uses_framework, so it's loaded but
+        # Hecks.hecksagon "Identity" rather than via `attaches`, so it's loaded but
         # not listed on the consumer's own hexagon.
         @bluebooks.values.find { |chapter| chapter.provides?(Bluebook::Capabilities::IDENTITY) }
       end
@@ -284,9 +282,8 @@ module Hecks
       # chapter, a framework member, or a vendored embryonaut bluebook it attaches,
       # that declares `provides "membership"`.
       #
-      # Vendored packages are included here (unlike `authorization_provider_for`)
-      # because membership ships as a vendored embryonaut_bluebooks chapter, not a
-      # framework member.
+      # Vendored packages are included, since membership ships as a vendored
+      # embryonaut_bluebooks chapter, not a framework member.
       #
       # @param domain [String, Symbol] the domain whose sign-in aggregate is being resolved
       # @return [Bluebook::Chapter, nil] the chapter that answers `domain`'s membership
@@ -356,7 +353,7 @@ module Hecks
       #
       # Falls back to any loaded chapter, since a consuming domain often wires a
       # vendored chapter as its own `Hecks.hecksagon "Name"` rather than via
-      # `uses_embryonaut_bluebook`, so it's loaded but not listed on the consumer's hexagon.
+      # `attaches ... from: :vendor`, so it's loaded but not listed on the consumer's hexagon.
       #
       # @param domain [String, Symbol] the domain the provider is resolved for
       # @param capability [String] the capability's name, such as
@@ -364,8 +361,7 @@ module Hecks
       # @return [Bluebook::Chapter, nil] the providing chapter, or nil if none loaded does
       def vendored_provider_for(domain, capability)
         hexagon = hecksagon(domain)
-        vendored = Array(hexagon&.vendored_bluebooks).map { |name| Naming.pascal(name) }
-        names = [domain.to_s, *Array(hexagon&.member_chapters), *vendored]
+        names = [domain.to_s, *Array(hexagon&.member_chapters)]
         attached = names.filter_map { |name| bluebook(name) }
                         .find { |chapter| chapter.provides?(capability) }
         return attached if attached
@@ -517,14 +513,12 @@ module Hecks
         # Order-independent: list facts uniq, so loading context_map before or after the
         # domain file yields the same merged hecksagon.
         Bluebook::Hecksagon.new(
-          domain:             base.domain,
-          binds:              base.binds + overlay.binds,
-          subscriptions:      (base.subscriptions + overlay.subscriptions).uniq,
-          framework_members:  (base.framework_members + overlay.framework_members).uniq,
-          vendored_bluebooks: (base.vendored_bluebooks + overlay.vendored_bluebooks).uniq,
-          attached_chapters:  (base.attached_chapters + overlay.attached_chapters).uniq,
-          bounded:            base.bounded? || overlay.bounded?,
-          translates:         (base.translates + overlay.translates).uniq
+          domain:        base.domain,
+          binds:         base.binds + overlay.binds,
+          subscriptions: (base.subscriptions + overlay.subscriptions).uniq,
+          attachments:   (base.attachments + overlay.attachments).uniq,
+          bounded:       base.bounded? || overlay.bounded?,
+          translates:    (base.translates + overlay.translates).uniq
         )
       end
 

data/lib/hecks/rust_build/append_optionals.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module Hecks
+  module RustBuild
+    # Makes an appended element's field `Option<T>` in the IR when any command sources it from an
+    # optional argument, since Ruby stores the omitted nil without complaint. `ir.json` records
+    # the marking, so it runs before the IR is written or generated from.
+    #
+    # `rust/build/src/optional_pass.rs` is the Ruby-free build's port of this; it looks only at an
+    # aggregate's own value objects, where this reads the domain-wide set.
+    module AppendOptionals
+      # Marks every aggregate in the IR, in place.
+      #
+      # @param tree [Hash] a domain's IR, symbol-keyed
+      # @return [Hash] the same IR
+      def self.mark(tree)
+        domain_wide = by_name(tree[:aggregates].flat_map { |aggregate| aggregate[:value_objects] })
+        tree[:aggregates].each do |aggregate|
+          mark_aggregate(aggregate, domain_wide.merge(by_name(aggregate[:value_objects])))
+        end
+        tree
+      end
+
+      # Resolves an `append` target to its entity or value object, or nil if it is neither. A
+      # local entity wins over a domain-wide value object of the same name: Syntax's local
+      # `Argument` entity shares a name with Command's `Argument` value object.
+      #
+      # @param aggregate [Hash] the aggregate owning the command
+      # @param target_type [String] the appended-to attribute's element type
+      # @param value_objects_by_name [Hash{String => Hash}] the value objects in scope
+      # @return [Hash, nil] the element, or nil
+      def self.element(aggregate, target_type, value_objects_by_name)
+        aggregate[:entities].find { |entity| entity[:name] == target_type } ||
+          value_objects_by_name[target_type]
+      end
+
+      # @param aggregate [Hash] one aggregate of the IR
+      # @param value_objects_by_name [Hash{String => Hash}] the value objects in scope
+      # @return [void]
+      def self.mark_aggregate(aggregate, value_objects_by_name)
+        aggregate[:attributes].each do |target_attr|
+          target = element(aggregate, target_attr[:type], value_objects_by_name)
+          next unless target
+
+          aggregate[:commands].each do |command|
+            appends = command[:mutations].select { |m| append_to?(m, target_attr) }
+            appends.each { |mutation| mark_fields(mutation, command, target) }
+          end
+        end
+      end
+
+      def self.append_to?(mutation, target_attr)
+        mutation[:op].to_s == "append" && mutation[:target].to_s == target_attr[:name].to_s
+      end
+      private_class_method :append_to?
+
+      # A Symbol is an argument name, and an optional one is what this pass wants; anything
+      # else is a literal.
+      def self.mark_fields(mutation, command, target)
+        mutation[:fields].each do |field_name, source|
+          parsed = Hecks::Bluebook::Assembly::Marks.read(source)
+          next unless parsed.is_a?(Symbol)
+
+          source_attr = command[:attributes].find { |attr| attr[:name].to_s == parsed.to_s }
+          next unless source_attr && source_attr[:optional]
+
+          field_attr = target[:attributes].find { |attr| attr[:name].to_s == field_name.to_s }
+          field_attr[:optional] = true if field_attr
+        end
+      end
+      private_class_method :mark_fields
+
+      def self.by_name(value_objects)
+        value_objects.to_h { |value_object| [value_object[:name], value_object] }
+      end
+      private_class_method :by_name
+    end
+  end
+end

data/lib/hecks/rust_build/conformance_fuzz.rb

@@ -6,6 +6,7 @@ require "tmpdir"
 require_relative "../cache_dir"
 require_relative "../rust_build"
 require_relative "conformance"
+require_relative "kernel_input"
 
 module Hecks
   module RustBuild
@@ -59,7 +60,7 @@ module Hecks
       def replay(domain, artifact, seed, seeds, steps, scratch)
         sequence = Hecks::Fuzzing::SequenceGenerator.generate(domain, seed: seed, steps: steps)
         path = File.join(scratch, "seed-#{seed}.json")
-        File.write(path, JSON.generate({ "steps" => sequence }))
+        File.write(path, KernelInput.json(domain, sequence))
         return if Conformance.call([domain, path, artifact]).zero?
 
         raise Failure, "hecks fuzz_conformance: seed #{seed}/#{seeds} diverged against #{artifact} " \

data/lib/hecks/rust_build/domain_name.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require "hecks/vocabulary"
+require "hecks/bluebook/model_check"
+
+module Hecks
+  module RustBuild
+    # Whether a domain's directory name can double as a Rust module identifier and a Cargo
+    # feature name. The reserved-word half is `ModelCheck.rust_reserved_name_findings`, the one
+    # shared check.
+    module DomainName
+      # Every key `rust/Cargo.toml` uses outside `[features]`, plus `default`, which Cargo
+      # reserves for the auto-enabled feature set. Declared once as the `CargoReservedName`
+      # vocabulary.
+      CARGO_RESERVED = Hecks::Vocabulary.fetch("CargoReservedName")
+
+      # @param name [String] the domain's directory name
+      # @return [Boolean] whether it is a plain lowercase identifier and no reserved word
+      def self.valid?(name)
+        text = name.to_s
+        text.match?(/\A[a-z_][a-z0-9_]*\z/) &&
+          Hecks::Bluebook::ModelCheck.rust_reserved_name_findings(domain_name: text).empty?
+      end
+    end
+  end
+end

data/lib/hecks/rust_build/kernel_input.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "../rust_build"
+
+module Hecks
+  module RustBuild
+    # The stdin a compiled domain binary reads: the steps to run, plus the declared argument
+    # defaults the host would hand its kernel.
+    #
+    # The kernel has no IR of its own, so a command's declared defaults reach it as a top-level
+    # `"defaults"` table, `{ "Domain::Aggregate.Command" => { "attribute" => value } }`, the same
+    # one the Rust host builds from the domain's IR. A harness that sends only `"steps"` would
+    # leave the kernel refusing an argument Ruby fills, so every conformance caller builds its
+    # input here.
+    module KernelInput
+      module_function
+
+      # @param domain_path [String] the domain's directory; its basename names the generated module
+      # @param steps [Array<Hash>] the steps to run
+      # @return [Hash{String => Object}] the input; `"defaults"` is there only when one is declared
+      def build(domain_path, steps)
+        input = { "steps" => steps }
+        defaults = defaults_for(domain_path)
+        input["defaults"] = defaults unless defaults.empty?
+        input
+      end
+
+      # @param domain_path [String] the domain's directory
+      # @return [String] the input as JSON, ready for the binary's stdin
+      def json(domain_path, steps) = JSON.generate(build(domain_path, steps))
+
+      # Each command's declared defaults, read from the domain's generated IR.
+      #
+      # @param domain_path [String] the domain's directory
+      # @return [Hash{String => Hash{String => Object}}] empty when the IR is absent or has none
+      def defaults_for(domain_path)
+        ir = generated_ir(domain_path) or return {}
+        domain = ir["name"].to_s
+        Array(ir["aggregates"]).each_with_object({}) do |aggregate, table|
+          Array(aggregate["commands"]).each do |command|
+            held = Array(command["attributes"]).reject { |attribute| attribute["default"].nil? }
+                                               .to_h { |attribute| [attribute["name"], attribute["default"]] }
+            table["#{domain}::#{aggregate['name']}.#{command['name']}"] = held unless held.empty?
+          end
+        end
+      end
+
+      # @param domain_path [String] the domain's directory
+      # @return [Hash, nil] the parsed generated IR, or nil when the domain has none
+      def generated_ir(domain_path)
+        feature = File.basename(domain_path.to_s.chomp("/")).downcase
+        path = File.join(RustBuild.rust_dir, "src", "generated", feature, "ir.json")
+        File.file?(path) ? JSON.parse(File.read(path)) : nil
+      end
+    end
+  end
+end