hecks 3.10.0 → 3.11.0

data/lib/hecks/bluebook/model_check.rb

@@ -4,6 +4,8 @@ require_relative "model_check/client_profile"
 require_relative "model_check/lifecycle_checks"
 require_relative "model_check/saga_checks"
 require_relative "model_check/policy_checks"
+require_relative "model_check/ask_checks"
+require_relative "model_check/reference_checks"
 require_relative "model_check/verbs"
 
 module Hecks
@@ -32,6 +34,8 @@ module Hecks
       extend LifecycleChecks
       extend SagaChecks
       extend PolicyChecks
+      extend AskChecks
+      extend ReferenceChecks
       extend Verbs
 
       module_function
@@ -59,15 +63,17 @@ module Hecks
         findings
       end
 
-      # Lifecycles, sagas and policies: what the model says about itself.
+      # Lifecycles, sagas, policies and references: what the model says about itself.
       def modelled_findings(bluebook, options)
         [
           *bluebook.aggregates.flat_map { |aggregate| aggregate_lifecycle_findings(aggregate) },
+          *key_by_value_findings(bluebook),
           *bluebook.process_managers.flat_map { |process_manager| saga_findings(bluebook, process_manager) },
           *bluebook.policies.flat_map do |policy|
             policy_findings(bluebook, policy, options[:hecksagon], options[:known_domains],
                             options[:global_emitted_events])
-          end
+          end,
+          *unused_ask_findings(bluebook)
         ]
       end
 

data/lib/hecks/bluebook/policy.rb

@@ -13,6 +13,7 @@ module Hecks
         name:               :name,
         on_event:           :on_event,
         trigger_command:    :trigger_command,
+        ask:                :ask,
         target_domain:      :target_domain,
         expect_undelivered: :expect_undelivered,
         where:              :where,
@@ -21,17 +22,18 @@ module Hecks
         where_ast:          -> { where_ast }
       )
 
-      attr_reader :name, :on_event, :trigger_command, :target_domain, :expect_undelivered, :where, :for_each, :with_spec
+      attr_reader :name, :on_event, :trigger_command, :ask, :target_domain, :expect_undelivered, :where, :for_each, :with_spec
 
       # Aggregate, declared and deliberately off the wire
       # the wire format is a pinned contract, and it does not carry
       # where a policy was written before the builder hoisted it
       attr_accessor :aggregate
 
-      def initialize(name:, on_event: nil, trigger_command: nil, target_domain: nil, expect_undelivered: false, where: nil, for_each: nil, with_spec: [], aggregate: nil)
+      def initialize(name:, on_event: nil, trigger_command: nil, ask: nil, target_domain: nil, expect_undelivered: false, where: nil, for_each: nil, with_spec: [], aggregate: nil)
         @name = name.to_s
         @on_event = on_event
         @trigger_command = trigger_command
+        @ask = ask
         @target_domain = target_domain
         @expect_undelivered = expect_undelivered.to_s == "true"
         @where = where

data/lib/hecks/bluebook/smoke_test.rb

@@ -27,7 +27,7 @@ module Hecks
       def call(dir)
         Dir.mktmpdir("hecks-smoke-") do |scratch|
           isolate!(dir, scratch)
-          dispatcher = Hecks.boot(scratch, install_doors: false)
+          dispatcher = Hecks.boot(scratch, install_driving: false)
           domain     = dispatcher.registry.bluebooks.keys.first
           next [] unless domain
 

data/lib/hecks/bluebook/synthesizer.rb

@@ -1,3 +1,5 @@
+require_relative "attribute"
+
 module Hecks
   module Bluebook
     # Synthesizes one argument per declared attribute from the IR: fixed markers for scalars,

data/lib/hecks/bluebook.rb

@@ -25,6 +25,7 @@ require_relative "bluebook/read_model"
 require_relative "bluebook/entity"
 require_relative "bluebook/domain_port"
 require_relative "bluebook/policy"
+require_relative "bluebook/ask_resolution"
 require_relative "bluebook/process_manager"
 require_relative "bluebook/aggregate"
 require_relative "bluebook/hecksagon"

data/lib/hecks/cli/command_table.rb

@@ -62,7 +62,7 @@ module Hecks
         ->(argv, program, _name) { ProjectCli.call(argv, program: program, root: Dir.pwd, remove_stale_bin: false) }
       ),
       "mcp"              => Command.new(
-        "Serve the MCP door over stdio (no authentication; stdio only).",
+        "Serve the MCP server over stdio (no authentication; stdio only).",
         "hecks mcp [--stdio]",
         "cli/mcp",
         ->(argv, _program, _name) { Mcp.call(argv) }

data/lib/hecks/cli/console.rb

@@ -7,7 +7,8 @@ require_relative "../ports/persistence/plugins/era"
 module Hecks
   module CLI
     # The command behind `hecks console` and Custodian's `Operation.OpenConsole`: boots a domain
-    # (pizzas on Memory by default) and drops into IRB with its door installed, for dispatching a
+    # (pizzas on Memory by default) and drops into IRB with its Ruby adapter installed, for
+    # dispatching a
     # real command by hand. No argument needs no database (ADR 0073); a domain directory boots as
     # it is wired, which may bind PostgresEra (examples/directory does).
     module Console

data/lib/hecks/cli/document.rb

@@ -44,7 +44,7 @@ module Hecks
       # @api private
       def boot_bluebook(path)
         begin
-          runtime = Hecks.boot(path, install_doors: false)
+          runtime = Hecks.boot(path, install_driving: false)
         rescue StandardError => e
           abort "cannot read #{path}: #{e.message.lines.first.strip}"
         end

data/lib/hecks/cli/launcher_words.rb

@@ -57,7 +57,7 @@ module Hecks
       def launcher_words(name, rest)
         return [rest, nil] if UNTOUCHED.include?(name)
 
-        require_relative "../doors/cli_door"
+        require_relative "../adapters/driving/cli"
         words = strip_generic(rest)
         form  = LAUNCHER_FORMS[name]
         return [words, nil] unless form && words.any? { |word| word.match?(NAME_VALUE) }
@@ -133,7 +133,7 @@ module Hecks
 
       # @api private
       def add_flag(key, value, extra)
-        extra << "--#{key.tr("_", "-")}" if Doors::CliDoor.boolean(value)
+        extra << "--#{key.tr("_", "-")}" if Adapters::Driving::Cli.boolean(value)
         nil
       end
 
@@ -153,7 +153,7 @@ module Hecks
           flag, value = word.split("=", 2)
           next kept << word unless GENERIC_FLAGS.include?(flag)
 
-          Doors::CliDoor.boolean(value || generic_value(queue))
+          Adapters::Driving::Cli.boolean(value || generic_value(queue))
         end
         kept
       end
@@ -161,7 +161,7 @@ module Hecks
       # The Boolean word that follows a generic flag, or "true" when none does.
       # @api private
       def generic_value(queue)
-        Doors::CliDoor::BOOLEAN_WORDS.key?(queue.first.to_s.downcase) ? queue.shift : "true"
+        Adapters::Driving::Cli::BOOLEAN_WORDS.key?(queue.first.to_s.downcase) ? queue.shift : "true"
       end
     end
   end

data/lib/hecks/cli/mcp.rb

@@ -2,14 +2,14 @@ require_relative "../mcp_stdio_guard"
 
 module Hecks
   module CLI
-    # The command behind `hecks mcp`: the MCP door onto the
+    # The command behind `hecks mcp`: the MCP server onto the
     # storehouse bus, over stdio only.
     #
     # This file loads nothing but `McpStdioGuard`, so the transport check runs
     # before the framework does.
     module Mcp
       # The server name the guard's refusals and warnings carry.
-      SERVER = "hecks-mcp-door".freeze
+      SERVER = "hecks-mcp".freeze
 
       module_function
 
@@ -23,8 +23,8 @@ module Hecks
       #   set up for stdio
       def call(argv)
         McpStdioGuard.enforce_stdio!(server: SERVER, argv: argv)
-        require_relative "../doors/mcp_door"
-        Doors::McpDoor.serve
+        require_relative "../adapters/driving/mcp"
+        Adapters::Driving::Mcp.serve
       end
     end
   end

data/lib/hecks/cli/project_cli/launcher_source.rb

@@ -126,8 +126,8 @@ module Hecks
         # @api private
         # @return [String] the opted-in launcher's middle
         def described_entry(name, boot, shown, quiet: false)
-          started = "Hecks.boot_described(described, install_doors: false)"
-          started = "Hecks::Doors::LauncherOptions.quietly(hold: #{RUNS_ON_MEMORY}) { #{started} }" if quiet
+          started = "Hecks.boot_described(described, install_driving: false)"
+          started = "Hecks::Adapters::Driving::LauncherOptions.quietly(hold: #{RUNS_ON_MEMORY}) { #{started} }" if quiet
           render(DESCRIBED_ENTRY, boot: boot, shown: shown, name: name, started: started).chomp
         end
 

data/lib/hecks/cli/project_cli/templates.rb

@@ -38,7 +38,7 @@ module Hecks
             abort "cannot open {{name}}: #{e.message.lines.first.strip}"
           end
 
-          text, status, reason = Hecks::Doors::CliRunner.usage(
+          text, status, reason = Hecks::Adapters::Driving::CliRunner.usage(
             runtime: described, argv: ARGV, program: program
           )
           unless text
@@ -48,9 +48,9 @@ module Hecks
               abort "cannot open {{name}}: #{e.message.lines.first.strip}"
             end
             # A question the world lists under `streams`, given `--stream`, tails until interrupted.
-            streamed = Hecks::Doors::CliRunner.stream(runtime: runtime, argv: ARGV, program: program)
+            streamed = Hecks::Adapters::Driving::CliRunner.stream(runtime: runtime, argv: ARGV, program: program)
             exit streamed unless streamed.nil?
-            text, status, reason = Hecks::Doors::CliRunner.call(
+            text, status, reason = Hecks::Adapters::Driving::CliRunner.call(
               runtime: runtime, argv: ARGV, program: program
             )
           end
@@ -59,12 +59,12 @@ module Hecks
         # The middle every launcher had before opted-in ones answered usage alone.
         PLAIN_ENTRY = <<~'RUBY'.freeze
           runtime = begin
-            Hecks.boot({{boot}}, install_doors: false)
+            Hecks.boot({{boot}}, install_driving: false)
           rescue StandardError => e
             abort "cannot open {{name}}: #{e.message.lines.first.strip}"
           end
 
-          text, status = Hecks::Doors::CliRunner.call(
+          text, status = Hecks::Adapters::Driving::CliRunner.call(
             runtime: runtime, argv: ARGV, program: "{{shown}}"
           )
         RUBY

data/lib/hecks/cli/project_cli.rb

@@ -9,12 +9,15 @@ module Hecks
     # `Hecks.bluebook "QualityControl"` in `qa/` becomes `qa/quality_control`.
     #
     # Each launcher is a dozen lines pinning one directory and handing over to
-    # `Doors::CliRunner`; the surface itself is projected at the moment it runs,
+    # `Adapters::Driving::CliRunner`; the surface itself is projected at the moment it runs,
     # so editing a chapter changes behaviour without regenerating anything.
     #
     # A chapter whose world's `launcher` setting names an `executable` gets its launcher
     # there instead: the Hecks chapter's is the gem's `exe/hecks`.
     module ProjectCli
+      # Raised when the project loads no bluebook.
+      class Error < RuntimeError; end
+
       # Build output and other trees under a root that hold no domain a caller means.
       IGNORED = %r{\A(rust|deploy|tmp|coverage)/}
 
@@ -34,7 +37,7 @@ module Hecks
       # @param argv [Array<String>] domain paths under `root`, and optionally `--check`
       # @param program [String] how the caller was invoked, named in a launcher's header
       # @param root [String] the directory launchers are written under
-      # @param remove_stale_bin [Boolean] delete `root/bin/<name>`, a second front door
+      # @param remove_stale_bin [Boolean] delete `root/bin/<name>`, a second entry point
       # @return [void]
       # @raise [SystemExit] with status 1 for a launcher out of date, an unreadable domain, a
       #   path outside `root` or an unknown flag
@@ -88,9 +91,9 @@ module Hecks
       #   when `check` found it out of date, `:failed` when the domain could not be read or its
       #   launcher could not be made
       def one(root, path, program, check, remove_stale_bin)
-        runtime = Hecks.boot(File.join(root, path), install_doors: false)
-        name    = runtime.registry.bluebooks.keys.first or raise "it loads no bluebook"
-        setting = Doors::LauncherOptions.settings(runtime, name) || {}
+        runtime = Hecks.boot(File.join(root, path), install_driving: false)
+        name    = runtime.registry.bluebooks.keys.first or raise Error, "it loads no bluebook"
+        setting = Adapters::Driving::LauncherOptions.settings(runtime, name) || {}
         settle(launcher_target(name, path, setting, root, program), path, root, check, remove_stale_bin)
       rescue StandardError, LoadError => e
         refuse(path, "cannot boot — #{e.message.lines.first.to_s.strip}")
@@ -122,7 +125,7 @@ module Hecks
         Target.new(name, label, File.join(root, label), text, snake, executable)
       end
 
-      # Writes the launcher, makes it executable, and removes the second front door in `bin/`.
+      # Writes the launcher, makes it executable, and removes the second entry point in `bin/`.
       #
       # @api private
       def write_launcher(target, root, remove_stale_bin)

data/lib/hecks/cli/run.rb

@@ -68,8 +68,8 @@ module Hecks
       # near miss deserves the runner's "did you mean" rather than the step-list
       # form's "no such script".
       def cli_form(domain, argv, program)
-        runtime = Hecks.boot(domain, install_doors: false)
-        text, status = Doors::CliRunner.call(runtime: runtime, argv: argv, program: program)
+        runtime = Hecks.boot(domain, install_driving: false)
+        text, status = Adapters::Driving::CliRunner.call(runtime: runtime, argv: argv, program: program)
         status.zero? ? puts(text) : abort(text)
         exit 0
       end

data/lib/hecks/cli/smoke_http/checks.rb

@@ -46,7 +46,10 @@ module Hecks
             before = state
             expect_success(post(payload, signed_headers))
             after = state
-            raise "the state changed on a repeated delivery:\n    before #{before}\n    after  #{after}" unless before == after
+            unless before == after
+              raise Failure,
+                    "the state changed on a repeated delivery:\n    before #{before}\n    after  #{after}"
+            end
           end
         end
 

data/lib/hecks/cli/smoke_http/transport.rb

@@ -29,15 +29,15 @@ module Hecks
         end
 
         def expect_status(res, code)
-          raise "expected #{code}, got #{res.code}" unless res.code.to_i == code
+          raise Failure, "expected #{code}, got #{res.code}" unless res.code.to_i == code
         end
 
         def expect_success(res)
-          raise "expected 2xx, got #{res.code}: #{res.body.to_s[0, 200]}" unless res.code.to_i.between?(200, 299)
+          raise Failure, "expected 2xx, got #{res.code}: #{res.body.to_s[0, 200]}" unless res.code.to_i.between?(200, 299)
         end
 
         def expect_refused(res)
-          raise "expected a 4xx refusal, got #{res.code}" unless res.code.to_i.between?(400, 499)
+          raise Failure, "expected a 4xx refusal, got #{res.code}" unless res.code.to_i.between?(400, 499)
         end
       end
     end

data/lib/hecks/cli/smoke_http.rb

@@ -12,6 +12,9 @@ module Hecks
   module CLI
     # One run of the checks against one service.
     class SmokeHttp
+      # Raised when a smoke check's request gets an answer other than the one it expects.
+      class Failure < RuntimeError; end
+
       include Checks
       include Transport
       extend Settings

data/lib/hecks/codemod.rb

@@ -6,6 +6,9 @@ module Hecks
   # Shared machinery for a codemod that migrates real `.bluebook` source: boot,
   # find candidates, edit, then verify by diffing the re-booted IR before keeping it.
   module Codemod
+    # Raised when a shadow cannot be built from the construct.
+    class Error < RuntimeError; end
+
     ROOT = File.expand_path("../..", __dir__)
 
     EXAMPLE_ROOTS = Corpus.members(:example, root: ROOT).map(&:path)
@@ -155,8 +158,8 @@ module Hecks
 
       matches = element_candidates(construct).select { |c| c.hecks_name.to_s == list_attr.type.to_s }
       if matches.size > 1
-        raise "#{construct.hecks_name}##{list_field} names #{list_attr.type}, held by both a value " \
-              "object and an entity — ambiguous, cannot resolve which one the list holds"
+        raise Error, "#{construct.hecks_name}##{list_field} names #{list_attr.type}, held by both a value " \
+                     "object and an entity — ambiguous, cannot resolve which one the list holds"
       end
 
       matches.first

data/lib/hecks/corpus/routes.rb

@@ -24,9 +24,16 @@ module Hecks
                 "its filename declares (bump_* / same_*)"),
       Route.new(%r{\Aspec/fixtures/model_check/}, :named_in, "spec/model_check_spec.rb", :each_file,
                 "domains broken on purpose; each must produce exactly the finding kinds it is built to trigger"),
+      Route.new(%r{\Aspec/fixtures/site/editor_chapters/domain/}, :named_in, "spec/site_cms_editor_chapters_spec.rb",
+                "site/editor_chapters",
+                "two chapters that both declare a Category, so the editor must tell them apart; one SQLite " \
+                "file keeps tables by bare aggregate name, which cannot hold both, so the sweep cannot boot it"),
       # hecks fuzz sweeps it too, once Fuzzing::Replay coerces value-object args
       # before recomputing givens — today it doesn't, so this given reads as
       # wrongly admitted.
+      Route.new(%r{\Aspec/corpus/asks/}, :named_in, "spec/policy_ask_spec.rb", "spec/corpus/asks",
+                "a corpus-owned domain whose ports have no adapter, so an ask is refused; its frozen " \
+                "targets are held to the Ruby runtime there and to the Rust policy table in rust/codegen"),
       Route.new(%r{\Aspec/fixtures/rust_host/}, :named_in, "rust/host/src/web/commerce.rs", "checkout_fixture",
                 "the Rust host's checkout fixture, pinned by its web and /api tests")
     ].freeze

data/lib/hecks/corpus/rust.rb

@@ -184,9 +184,10 @@ module Hecks
       # domain wins Cargo's `default` is derived, not hand-picked.
       #
       # @param root [String] repository root to search under
-      # @return [Array<RustDomain>] already-generated Rust domains, in regeneration order
+      # @return [Array<RustDomain>] every Rust domain with a Cargo feature, in regeneration order:
+      #   a fresh checkout has no generated output, so the sources, not the output, name them
       def rust_regen_order(root: ROOT)
-        rust_domains(root: root).select { |domain| generated?(domain.feature, root: root) }
+        rust_domains(root: root)
       end
     end
   end

data/lib/hecks/deploy/bluebook/deploy.bluebook

@@ -445,6 +445,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "refused"
       transition "Reprovision" => "requested",   from: %w[provisioned refused]
       transition "Complete"    => "provisioned", from: "requested"
       transition "Abandon"     => "refused",     from: "requested"
@@ -602,6 +603,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
       transition "Complete" => "projected", from: "requested"
       transition "Fault"    => "faulted",   from: "requested"
     end
@@ -714,6 +716,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
       transition "Complete" => "cleared", from: "requested"
       transition "Fault"    => "faulted", from: "requested"
     end
@@ -811,6 +814,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Pass" => "clean",   from: "requested"
       transition "Flag" => "flagged", from: "requested"
     end
@@ -914,6 +918,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Pass" => "within_budget", from: "requested"
       transition "Flag" => "flagged",       from: "requested"
     end
@@ -1031,6 +1036,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Pass" => "passed", from: "requested"
       transition "Flag" => "flagged", from: "requested"
     end
@@ -1179,6 +1185,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Complete" => "rolled", from: "requested"
       transition "Flag" => "flagged", from: "requested"
       transition "Verify" => "verified", from: "rolled"
@@ -1361,6 +1368,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Complete" => "rolled", from: "requested"
       transition "Flag" => "flagged", from: "requested"
       transition "Verify" => "verified", from: "rolled"
@@ -1372,10 +1380,11 @@ Hecks.bluebook "Deploy" do
     # Runs the project's generated `deploy-box.sh`: render the Compose files, push them to the box over
     # SSM, start the containers and check them. A policy then requests a `SmokeRun`, unless
     # `skip_smoke=true`. Exit 1 when flagged, with the script's status (40 no instance, 41 the roll
-    # failed, 42 the box unhealthy).
+    # failed, 42 the box unhealthy, 43 no restore anchor). Before the roll the script names the point the
+    # database can be restored to, so the report always carries the way back from a minted era.
 
     command "Run" do
-      goal "Roll the app box and record whether it came up healthy (exit 1 when flagged: 40 no instance, 41 roll failed, 42 box unhealthy)"
+      goal "Roll the app box and record whether it came up healthy (exit 1 when flagged: 40 no instance, 41 roll failed, 42 box unhealthy, 43 no restore anchor)"
 
       attribute :project,    Location
       attribute :script,     Location, optional: true
@@ -1554,6 +1563,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged", "drifted"
       transition "Complete" => "restored", from: "requested"
       transition "Plan" => "planned", from: "requested"
       transition "Flag" => "flagged", from: "requested"
@@ -1835,6 +1845,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "drifted", "flagged"
       transition "Match" => "verified", from: "requested"
       transition "Differ" => "drifted", from: "requested"
       transition "Flag" => "flagged", from: "requested"
@@ -1977,6 +1988,7 @@ Hecks.bluebook "Deploy" do
     # No outcome is a failure: a report that could not be made is `unavailable`, never `flagged`
     # (only a malformed request is), because the era check gates a deploy, not this report.
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Match" => "unchanged", from: "requested"
       transition "Differ" => "changed", from: "requested"
       transition "Withhold" => "unavailable", from: "requested"
@@ -2140,6 +2152,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "RecordName" => "named", from: "requested"
       transition "RecordUrl" => "located", from: "requested"
       transition "RecordList" => "listed", from: "requested"
@@ -2513,6 +2526,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Complete" => "rolled", from: "requested"
       transition "Plan" => "planned", from: "requested"
       transition "Flag" => "flagged", from: "requested"
@@ -2648,6 +2662,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "drifted", "refused"
       transition "Match"  => "matching", from: "requested"
       transition "Drift"  => "drifted",  from: "requested"
       transition "Refuse" => "refused",  from: "requested"
@@ -2771,6 +2786,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
       transition "Complete" => "projected", from: "requested"
       transition "Fault"    => "faulted",   from: "requested"
     end

data/lib/hecks/doc/reference/rendering.rb

@@ -4,6 +4,9 @@ module Hecks
       # Renders the pages themselves: a context's page word by word, and the index. Extended onto
       # `Reference`.
       module Rendering
+        # Raised when a page carries prose for a word the language does not declare.
+        class Error < RuntimeError; end
+
         # Renders one context's page, grouped by word (not per form) so a
         # two-form word doesn't repeat its heading and prose.
         def render_page(context, prose, path)
@@ -13,13 +16,13 @@ module Hecks
           page_markdown(context, prose[PREAMBLE].to_s.strip, sections)
         end
 
-        # @raise [RuntimeError] when a page carries prose for a word the language does not declare
+        # @raise [Error] when a page carries prose for a word the language does not declare
         def refuse_orphans!(prose, words, context, path)
           orphans = prose.keys - words.keys - [PREAMBLE]
           return if orphans.empty?
 
-          raise "#{path} carries prose for #{orphans.join(", ")}, which the language no longer " \
-                "declares in #{context} — deleting writing is a human's decision, so decide"
+          raise Error, "#{path} carries prose for #{orphans.join(", ")}, which the language no longer " \
+                       "declares in #{context} — deleting writing is a human's decision, so decide"
         end
 
         # @return [String] the page: its heading, generated lede, the hand-written preamble and the

data/lib/hecks/forms/app/commands.rb

@@ -1,13 +1,14 @@
 require "json"
 require_relative "../command_form_renderer"
 require_relative "../params"
-require_relative "../../doors/command_request"
-require_relative "../../doors/json_door"
+require_relative "../../adapters/driving/command_request"
+require_relative "../../adapters/driving/json"
 
 module Hecks
   module Forms
     class App
-      # The command routes of `Forms::App`: the form, its submission, and the JSON door to the same
+      # The command routes of `Forms::App`: the form, its submission, and the JSON adapter to the
+      # same
       # dispatch.
       module Commands
         private
@@ -63,7 +64,7 @@ module Hecks
         def verb_name(domain, aggregate, verb) = "#{domain}::#{aggregate.hecks_name}.#{verb.hecks_name}"
 
         def command_envelope(command, args)
-          Doors::CommandRequest.normalize(args, receiver: command_receiver(command), legacy_receiver: :id)
+          Adapters::Driving::CommandRequest.normalize(args, receiver: command_receiver(command), legacy_receiver: :id)
         end
 
         def command_receiver(command) = command.creates? ? nil : :aggregate
@@ -78,9 +79,9 @@ module Hecks
         end
 
         def submitted_json(request, command)
-          raw = Doors::JsonDoor.parse(request.body.read)
-          envelope = Doors::JsonDoor.command_request(raw, receiver:        command_receiver(command),
-                                                          legacy_receiver: :id)
+          raw = Adapters::Driving::Json.parse(request.body.read)
+          envelope = Adapters::Driving::Json.command_request(raw, receiver:        command_receiver(command),
+                                                                  legacy_receiver: :id)
           [raw, envelope]
         end
 

data/lib/hecks/forms/app/queries.rb

@@ -6,7 +6,8 @@ require_relative "../query_form_renderer"
 module Hecks
   module Forms
     class App
-      # The query routes of `Forms::App`: the form with its results, and the JSON door to the same
+      # The query routes of `Forms::App`: the form with its results, and the JSON adapter to the
+      # same
       # query.
       module Queries
         private

data/lib/hecks/forms/app.rb

@@ -87,7 +87,7 @@ module Hecks
 
       def refuse_entity_command
         raise RouteNotFound,
-              "entity command routes are not supported by Forms; use a command door with " \
+              "entity command routes are not supported by Forms; use a command route with " \
               "to.aggregate and to.entity"
       end
 

data/lib/hecks/forms/record_renderer.rb

@@ -5,7 +5,7 @@ require_relative "record_table"
 module Hecks
   module Forms
     # The index and show pages every aggregate gets, whether or not it declares a query.
-    # They read the repository directly, like `AggregateDoor#all`/`#find`.
+    # They read the repository directly, like `AggregateModule#all`/`#find`.
     module RecordRenderer
       # Renders the page listing every record of one aggregate.
       def self.index(registry:, domain:, aggregate:)

data/lib/hecks/framework/bluebook/privacy.bluebook

@@ -2,6 +2,17 @@ Hecks.bluebook "Privacy" do
   vision "Which fields of a domain's own aggregates are sensitive is a fact about that domain, declared apart from it — the domain itself never spells out that one of its own attributes is PII or PHI."
   supporting
 
+  # What this chapter answers for every attaching domain: the boot that seeds `mark_sensitive`
+  # facts, the masking of a read and the cryptoshred read these verbs from here rather than
+  # recognising "Privacy" by name.
+  provides "privacy",
+           mark_sensitive: "Marking.Mark",
+           markings_for:   "Marking.ForDomain"
+
+  provides "subject_keys",
+           key_for: "SubjectKey.ForSubject",
+           shred:   "SubjectKey.Shred"
+
   # A domain never marks itself: `Mark` is a wiring-time command (role "Deployment").
   aggregate "Marking" do
     description "One attribute of one domain's own aggregate, flagged sensitive — and the role required to read it unredacted."