hecks 3.10.0 → 3.12.0

data/lib/hecks/quality_control/adapters/github_issues.rb

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
 require "open3"
+require_relative "../../indifferent_key"
 
 module Hecks
   module Adapters
     # The `IssueTracker` port's adapter: files a `QualityControl::Ticket` as a GitHub issue.
     # Raises when `gh` refuses, which the runtime records as the ticket's refusal.
     class GithubIssues
+      # Raised when `gh` cannot file the issue.
+      class Error < RuntimeError; end
+
       # @param aggregate [Object, nil] unused
       # @param settings [Hash] unused
       # @param root [String, nil] unused
@@ -18,7 +22,7 @@ module Hecks
       #   value objects (`{value: ...}`) or bare strings, and `pull_request` names a proposed fix
       # @return [Hash{Symbol => Hash}] `number:` and `url:` of the issue, in the shape the
       #   ticket's `Filed` command takes
-      # @raise [RuntimeError] when `gh` exits non-zero or prints no issue URL
+      # @raise [Error] when `gh` exits non-zero or prints no issue URL
       def file(**held)
         out = create_issue(plain(held[:repository]), plain(held[:title]).to_s, issue_body(held))
         url, number = issue_url_and_number(out)
@@ -37,7 +41,7 @@ module Hecks
       def issue_url_and_number(out)
         url = out.strip.lines.last.to_s.strip
         number = url[%r{/issues/(\d+)\z}, 1]
-        raise "gh issue create printed no issue URL: #{out.strip.inspect}" unless number
+        raise Error, "gh issue create printed no issue URL: #{out.strip.inspect}" unless number
 
         [url, number]
       end
@@ -45,7 +49,7 @@ module Hecks
       def create_issue(repository, title, body)
         out, err, status = Open3.capture3("gh", "issue", "create", "--repo", repository,
                                           "--title", title, "--body", body)
-        raise "gh issue create failed — #{err.strip.empty? ? out.strip : err.strip}" unless status.success?
+        raise Error, "gh issue create failed — #{err.strip.empty? ? out.strip : err.strip}" unless status.success?
 
         out
       end
@@ -54,7 +58,7 @@ module Hecks
       def plain(field)
         return field unless field.is_a?(Hash)
 
-        field.key?(:value) ? field[:value] : field["value"]
+        IndifferentKey.read(field, :value)
       end
     end
   end

data/lib/hecks/quality_control/cli/qa_open_pr.rb

@@ -11,8 +11,8 @@ require_relative "qa_open_pr/recording"
 module Hecks
   module QualityControlCli
     # The command behind `hecks quality_control patch.open`: opens a PR and records it in the
-    # QualityControl ledger in one step. It is the only door into `QualityControl::Patch.Open` and
-    # `QualityControl::Improvement.Open`.
+    # QualityControl ledger in one step. It is the only entry point into
+    # `QualityControl::Patch.Open` and `QualityControl::Improvement.Open`.
     #
     # It refuses (exit 1, nothing opened or recorded) unless the ledger's own `Open` command would
     # take the record and the `GitPr` adapter agrees. The command's `given`s are the rules, asked

data/lib/hecks/quality_control/cli/qa_sweep/checks/shrinking.rb

@@ -10,7 +10,7 @@ module Hecks
           private
 
           # Re-runs only the comparison that surprised; `seat` matters only for `self_consistency`,
-          # which reads the Rust binary's rehydration door under a differential seat.
+          # which reads the Rust binary's rehydration entry point under a differential seat.
           def candidate_divergences(check_mode, seat, steps)
             case check_mode
             when :differential

data/lib/hecks/quality_control/cli/qa_sweep/finding_report.rb

@@ -37,7 +37,7 @@ module Hecks
 
         def print_finding_instructions
           puts "No Bug was logged (that needs a real failing-test demonstration, which"
-          puts "needs judgment this script does not have — hecks quality_control log is the door)"
+          puts "needs judgment this script does not have — hecks quality_control log is the entry point)"
           puts "and the sweep was not concluded. The ledger's own SuspendOnSurprise"
           puts "policy took the target out of the rotation; it stays out until a PERSON"
           puts "runs: hecks quality_control ask run target=#{@target_reference} " \

data/lib/hecks/quality_control/cli/qa_sweep.rb

@@ -130,7 +130,7 @@ module Hecks
         @trace_last = now
       end
 
-      # Default `install_doors` so `QualityControl::Target` and friends are top-level constants.
+      # Default `install_driving` so `QualityControl::Target` and friends are top-level constants.
       def boot_ledger
         Hecks.boot(@domain_dir)
       rescue StandardError => e

data/lib/hecks/quality_control/quality_control.bluebook

@@ -164,7 +164,7 @@ Hecks.bluebook "QualityControl" do
       role "QA engineer"
       goal "Hand a chapter back to the rotation, stamped with when, what this pass was worth, and how the clean streak moves"
 
-      # `now` is the argument and `last_swept` the field, so the door can fill the clock.
+      # `now` is the argument and `last_swept` the field, so the entry point can fill the clock.
       #
       # `next_streak` is the caller's to compute (`clean_streak + 1` if every check held and none
       # was ever surprised, else 0): `Target` cannot read `Sweep` state and no policy payload can
@@ -530,6 +530,7 @@ Hecks.bluebook "QualityControl" do
     end
 
     lifecycle :status, default: "sweeping" do
+      mark :failure, "abandoned"
       transition "Check"    => "sweeping",  from: "sweeping"
       transition "Waive"    => "sweeping",  from: "sweeping"
       transition "Conclude" => "concluded", from: "sweeping"
@@ -778,7 +779,7 @@ Hecks.bluebook "QualityControl" do
       invariant("a bug sequence is positive") { value.positive? }
     end
 
-    # Prefixed on purpose: `Doors::RubyDoor.install` puts every aggregate name on Object, so a
+    # Prefixed on purpose: `Adapters::Driving::Ruby.install` puts every aggregate name on Object, so a
     # value object sharing a word with any aggregate resolves to that class once the other domain
     # boots.
     value_object "BugTitle" do
@@ -1456,6 +1457,7 @@ Hecks.bluebook "QualityControl" do
     # filing. `Submit` is non-creating, so `TicketSubmitted` carries `{ id: ... }`, which a
     # reference slot takes.
     lifecycle :status, default: "raised" do
+      mark :failure, "refused", "abandoned"
       transition "Submit"  => "submitting", from: ["raised", "refused"]
       transition "Filed"   => "filed",      from: "submitting"
       transition "Refused" => "refused",    from: "submitting"
@@ -1866,6 +1868,7 @@ Hecks.bluebook "QualityControl" do
     # proof-only PR can be closed while still "opened" (`retire_if_settled?` hit
     # `LifecycleRefused`).
     lifecycle :status, default: "opened" do
+      mark :failure, "needs_fix"
       transition "Land"    => "landed",   from: ["opened", "needs_fix"]
       transition "Regress" => "needs_fix", from: "landed"
       transition "Merge"   => "merged",   from: ["opened", "landed", "needs_fix"]
@@ -1983,6 +1986,7 @@ Hecks.bluebook "QualityControl" do
     end
 
     lifecycle :status, default: "running" do
+      mark :failure, "red"
       transition "Passed" => "green", from: "running"
       transition "Failed" => "red",   from: "running"
     end

data/lib/hecks/release/approval.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require "hecks/vocabulary"
+
+module Hecks
+  module Release
+    # Whether the commit that set the version carries the owner's approval of the release.
+    #
+    # Releases are the owner's decision. A bump on `main` reaches `stable` by itself, so the bump
+    # commit must say, in its message, that a release is wanted: a trailer line named by the
+    # `release_trailer` of the `Lane` row a release is cut from, `Release-Approved-By: <name>`. The
+    # decision is read from git history alone, so it can be made again on any later run. It reads
+    # only the Vocabulary table, so `release.yml` can run it with the runner's own Ruby.
+    module Approval
+      module_function
+
+      # @return [String] the trailer key, read from the `Lane` row that feeds a tag
+      # @raise [KeyError] when that row names no trailer
+      def trailer
+        row = Hecks::Vocabulary.rows("Lane").find { |lane| !lane["feeds"].to_s.empty? }
+        key = row && row["release_trailer"].to_s
+        raise KeyError, "the Lane row a release is cut from names no release_trailer" if key.nil? || key.empty?
+
+        key
+      end
+
+      # @param message [String] a commit message
+      # @return [String, nil] who approved, from the first trailer line with a name, or nil
+      def approver(message)
+        line = message.to_s.lines.map(&:strip).find { |text| text.match?(/\A#{Regexp.escape(trailer)}:\s*\S/) }
+        line&.sub(/\A[^:]*:\s*/, "")
+      end
+
+      # @param message [String] the message of the commit that set the version
+      # @param tag_exists [Boolean] whether the release's tag already stands on origin: a release
+      #   that was begun was approved when it began, so finishing it asks again for nothing
+      # @param explicit [String, nil] a name the owner passed to a by-hand run
+      # @return [Array(Boolean, String)] whether the release may go ahead, and the words to print
+      def verdict(message:, tag_exists: false, explicit: nil)
+        return [true, "approved by #{explicit.strip} (by-hand run)"] unless explicit.to_s.strip.empty?
+        return [true, "the tag already stands; finishing a release that was begun"] if tag_exists
+
+        who = approver(message)
+        return [true, "approved by #{who} (#{trailer} trailer)"] if who
+
+        [false, "the commit that set the version has no '#{trailer}: <name>' line in its message, so it " \
+                "is not a release the owner asked for. Nothing was tagged or pushed. To release it, " \
+                "re-run by hand with the approval: gh workflow run release.yml -f tag=vX.Y.Z -f approved_by=<name>"]
+      end
+
+      # Reads the decision's inputs from the environment `release.yml` gives it.
+      #
+      # @param env [#[]] `COMMIT_MESSAGE`, `TAG_EXISTS` (true/false), `APPROVED_BY`
+      # @param out [#puts] where the words go
+      # @return [Integer] the exit status: 0 to go ahead, 1 to refuse
+      def check(env: ENV, out: $stdout)
+        ok, words = verdict(message: env["COMMIT_MESSAGE"], tag_exists: env["TAG_EXISTS"] == "true",
+                            explicit: env["APPROVED_BY"])
+        out.puts(ok ? "release approval: #{words}" : "::error::#{words}")
+        ok ? 0 : 1
+      end
+    end
+  end
+end

data/lib/hecks/router/{door.rb → aggregate_reader.rb}

@@ -1,12 +1,13 @@
-require_relative "../doors/handle"
+require_relative "../adapters/driving/handle"
 
 module Hecks
   class Router
     class NamespaceInstaller
       # One aggregate's repository and event log, read through its dispatcher.
-      Door = Struct.new(:dispatcher, :domain, :aggregate) do
+      AggregateReader = Struct.new(:dispatcher, :domain, :aggregate) do
         # @param entry [Router::Entry] a router entry
-        # @return [Door, nil] the door for the entry's aggregate; nil for a query/command-only entry
+        # @return [AggregateReader, nil] the reader for the entry's aggregate; nil for a
+        #   query/command-only entry
         #   whose owner isn't a real aggregate root
         def self.for(entry)
           domain = entry.fqn.domain
@@ -29,7 +30,7 @@ module Hecks
         def all = repository.all.map { |instance| handle(instance) }
 
         def handle(instance)
-          Doors::Handle.new(dispatcher: dispatcher, domain: domain, aggregate: aggregate, instance: instance)
+          Adapters::Driving::Handle.new(dispatcher: dispatcher, domain: domain, aggregate: aggregate, instance: instance)
         end
       end
     end

data/lib/hecks/router/namespace_installer.rb

@@ -1,6 +1,6 @@
 require_relative "../fqn"
 require_relative "options_proxy"
-require_relative "door"
+require_relative "aggregate_reader"
 
 module Hecks
   class Router
@@ -12,11 +12,11 @@ module Hecks
       end
 
       # Installs every current-version route as a namespace constant/method, plus
-      # the aggregate CRUD door and short `Aggregate.verb` shortcuts.
+      # the aggregate CRUD module and short `Aggregate.verb` shortcuts.
       def install!
         current_entries.each { |entry| install_namespace_entry(entry) }
         install_shortcuts!
-        install_aggregate_doors!
+        install_aggregate_modules!
         self
       end
 
@@ -48,26 +48,26 @@ module Hecks
       end
 
       # `.find`/`.all`/`.count`/`.events`/`.repository`, matching `Hecks.boot`'s
-      # door; grouped by (realm, domain, aggregate) since the five don't vary by verb.
-      def install_aggregate_doors!
+      # module; grouped by (realm, domain, aggregate) since the five don't vary by verb.
+      def install_aggregate_modules!
         current_entries.reject { |entry| entry.fqn.aggregate.nil? }
                        .group_by { |entry| [entry.fqn.realm, entry.fqn.domain, entry.fqn.aggregate] }
-                       .each_value { |entries| install_aggregate_door(entries.first) }
+                       .each_value { |entries| install_aggregate_module(entries.first) }
       end
 
-      def install_aggregate_door(entry)
-        door = Door.for(entry)
-        return unless door
+      def install_aggregate_module(entry)
+        reader = AggregateReader.for(entry)
+        return unless reader
 
-        define_door_methods(namespace_for(entry.fqn.realm, entry.fqn.domain, entry.fqn.aggregate), door)
+        define_module_methods(namespace_for(entry.fqn.realm, entry.fqn.domain, entry.fqn.aggregate), reader)
       end
 
-      def define_door_methods(target, door)
-        target.define_singleton_method(:repository) { door.repository }
-        target.define_singleton_method(:count)      { door.repository.count }
-        target.define_singleton_method(:events)     { door.events }
-        target.define_singleton_method(:find)       { |id| door.find(id) }
-        target.define_singleton_method(:all)        { door.all }
+      def define_module_methods(target, reader)
+        target.define_singleton_method(:repository) { reader.repository }
+        target.define_singleton_method(:count)      { reader.repository.count }
+        target.define_singleton_method(:events)     { reader.events }
+        target.define_singleton_method(:find)       { |id| reader.find(id) }
+        target.define_singleton_method(:all)        { reader.all }
       end
 
       def install_shortcuts!

data/lib/hecks/router.rb

@@ -1,5 +1,5 @@
 module Hecks
-  # The public, project-wide dispatch door. It owns address resolution only;
+  # The public, project-wide dispatch entry point. It owns address resolution only;
   # each discovered Bluebook keeps its own runtime and persistence bindings.
   class Router
     class UnknownAddress < StandardError; end

data/lib/hecks/runtime/best_effort.rb

@@ -0,0 +1,22 @@
+module Hecks
+  module Runtime
+    # The one place the runtime answers a default when a read raises, so a deliberate guard is
+    # named at its call site and `Hecks/SwallowedRescue` can refuse every other silent swallow.
+    #
+    # BestEffort.call(false) { adapter_class.tenant_capable? }  # => false when the lookup raises
+    module BestEffort
+      module_function
+
+      # Runs the block and answers its value, or `default` when it raises a StandardError.
+      #
+      # @param default [Object] what to answer when the block raises
+      # @yield the read that may raise
+      # @return [Object] the block's value, or `default`
+      def call(default)
+        yield
+      rescue StandardError
+        default
+      end
+    end
+  end
+end

data/lib/hecks/runtime/command_interpreter/mutation_applier.rb

@@ -46,8 +46,8 @@ module Hecks
         end
 
         def apply_set(instance, aggregate, mutation, args, pre)
-          from_state = mutation.source.is_a?(StateRef)
-          value = from_state ? pre[mutation.source.name] : @rules.resolve_source(mutation.source, args)
+          from_state = mutation.source.is_a?(StateRef) || mutation.source.is_a?(Computed)
+          value = set_source_value(mutation.source, args, pre)
           # A plain `sets` of a list takes the whole list; only `append:` and `remove:` take
           # one element.
           list_attribute = aggregate.attribute(mutation.target)
@@ -55,6 +55,16 @@ module Hecks
           instance[mutation.target] = Value.for(aggregate, mutation.target, value)
         end
 
+        # A `state(:field)` reads the pre-dispatch record; an expression is evaluated over the
+        # command's arguments, then that record; anything else resolves as an argument or literal.
+        def set_source_value(source, args, pre)
+          case source
+          when StateRef then pre[source.name]
+          when Computed then Bluebook::Expression::Resolver.resolve(source.text, pre, args)
+          else @rules.resolve_source(source, args)
+          end
+        end
+
         def apply_append(instance, aggregate, mutation, args, pre)
           instance[mutation.target] = appended(pre, aggregate, mutation, args)
         end

data/lib/hecks/runtime/command_interpreter.rb

@@ -65,7 +65,7 @@ module Hecks
       # @return [Array] the settled instance, events, plan, persistence outcome, and outbox rows
       # @raise [StandardError] a domain refusal (Runtime::DOMAIN_REFUSALS) when a rule refuses
       # @raise [Runtime::StaleWrite, Runtime::WiringError] every retry loses, or resolve fails
-      # rubocop:disable-next Metrics/ParameterLists -- the public dispatch signature every door calls
+      # rubocop:disable-next Metrics/ParameterLists -- the public dispatch signature every entry point calls
       def call(domain, aggregate, command, invocation, correlation = nil, dry_run: false)
         args     = invocation.to_args
         settings = { invocation: invocation, route: invocation.target, correlation: correlation, dry_run: dry_run }
@@ -181,7 +181,8 @@ module Hecks
 
       # `ctx.pending_delegation` is only ever set by `step_delegate_to_entity`, and only when this
       # command carries a `:delegate` mutation. The same dispatch, so the same correlation —
-      # without threading `ctx.correlation` through, a saga-driven door's events would lose their
+      # without threading `ctx.correlation` through, a saga-driven entry point's events would lose
+      # their
       # stamp here.
       def emit_events(ctx)
         command, args = ctx.pending_delegation || [ctx.command, ctx.args]

data/lib/hecks/runtime/command_rules/emission.rb

@@ -20,7 +20,7 @@ module Hecks
           stamp = { aggregate: "#{domain}::#{aggregate.hecks_name}", id: instance.id,
                     payload: args, correlation: correlation }
           command.emits.map do |event_name|
-            record_emitted(Event.new(name: event_name, occurred_at: Time.now.utc.iso8601, **stamp), repository)
+            record_emitted(Event.new(name: event_name, occurred_at: Event.stamp, **stamp), repository)
           end
         end
 

data/lib/hecks/runtime/dispatcher.rb

@@ -37,8 +37,8 @@ module Hecks
         @entities = EntityInterpreter.new(registry, rules: rules)
         @queries  = QueryInterpreter.new(registry)
         @read_models = ReadModelInterpreter.new(registry)
-        @policies = PolicyInterpreter.new(registry, door: self)
-        @sagas    = SagaInterpreter.new(registry, door: self)
+        @policies = PolicyInterpreter.new(registry, dispatcher: self)
+        @sagas    = SagaInterpreter.new(registry, dispatcher: self)
         # One relay per registry: interpreters enqueue through it inside the save transaction.
         @registry.outbox.attach(policies: @policies, sagas: @sagas)
       end
@@ -141,7 +141,7 @@ module Hecks
 
       # Runs one port operation named by its parts, then the reactions its events owe.
       #
-      # The door for an adapter outside the bluebook; no wire spelling packs a port verb.
+      # The dispatcher for an adapter outside the bluebook; no wire spelling packs a port verb.
       #
       # @param to [String, Hash, nil] the receiver; when nil it is read from the facts
       # @param with [Hash, nil] the operation's facts, keyed by argument name
@@ -150,7 +150,7 @@ module Hecks
       # @raise [Runtime::UnknownVerb] if the domain, aggregate, port or operation is undeclared
       # @raise [Runtime::TypeMismatch] if no receiving identity is found, or `to:`/`with:` is bad
       # @raise [Runtime::NotFound] if the receiving record does not exist
-      # rubocop:disable-next Metrics/ParameterLists -- the public door's parts, one argument per verb segment
+      # rubocop:disable-next Metrics/ParameterLists -- the public dispatcher's parts, one argument per verb segment
       def dispatch_port(domain, aggregate_name, port_name, operation_name, to: nil, with: nil, flat: {})
         verb = "#{domain}::#{aggregate_name}.#{port_name}.#{operation_name}"
         aggregate = resolve_aggregate(domain, aggregate_name, verb)

data/lib/hecks/runtime/entity_element/location.rb

@@ -17,7 +17,7 @@ module Hecks
         # Walks `chain` one hop at a time and returns the located element (or `instance`
         # itself when `chain` is empty). `route`, when given, offers each hop's identity
         # before falling back to `args`.
-        # rubocop:disable-next Metrics/ParameterLists -- the positional door EntityInterpreter and delegation call
+        # rubocop:disable-next Metrics/ParameterLists -- the positional entry point EntityInterpreter and delegation call
         def locate_chain(root_aggregate, chain, instance, args, command_name, route = nil)
           container = instance
           owner     = root_aggregate

data/lib/hecks/runtime/event.rb

@@ -5,6 +5,11 @@ module Hecks
     # An emitted domain event. `correlation` (saga head -> value) is runtime bookkeeping
     # and deliberately absent from `to_h`.
     Event = Struct.new(:name, :aggregate, :id, :payload, :occurred_at, :correlation, keyword_init: true) do
+      # The one place the runtime reads the wall clock, so every event is stamped the same way.
+      #
+      # @return [String] the current UTC time as ISO 8601
+      def self.stamp = Time.now.utc.iso8601
+
       # Freezes the event deep, payload and correlation included.
       #
       # @return [void]

data/lib/hecks/runtime/identity.rb

@@ -1,4 +1,5 @@
 require_relative "../naming"
+require_relative "best_effort"
 require_relative "value"
 
 module Hecks
@@ -82,12 +83,12 @@ module Hecks
       # Resolves a best-effort identity for `construct` to use as a lock key; never raises.
       # Returns nil when nothing resolves, and the caller then locks by aggregate type alone.
       def best_effort(construct, args, route = nil, reference_key: nil)
-        route&.aggregate ||
-          of(construct, args) ||
-          from(construct, args, :id) ||
-          (reference_key && from(construct, args, reference_key))
-      rescue StandardError
-        nil
+        BestEffort.call(nil) do
+          route&.aggregate ||
+            of(construct, args) ||
+            from(construct, args, :id) ||
+            (reference_key && from(construct, args, reference_key))
+        end
       end
     end
   end

data/lib/hecks/runtime/interpreting.rb

@@ -32,7 +32,8 @@ module Hecks
 
       # Gives each argument the caller left out the default its attribute declares
       # (`attribute :runs, Count, default: 30`), so a declared default holds on every way in and
-      # not only where a door spells it out. An argument the caller passed is kept, whatever it is.
+      # not only where an entry point spells it out. An argument the caller passed is kept, whatever
+      # it is.
       #
       # @param command [Class] the command being dispatched
       # @param args [Hash{Symbol => Object}] the arguments the caller passed

data/lib/hecks/runtime/invocation_builder.rb

@@ -18,7 +18,7 @@ module Hecks
       # :entity, :port). Each checks its own parts in a fixed order, because
       # a malformed call's refusal depends on that order; `declaring` is
       # called exactly once, at that shape's point in the order below.
-      # rubocop:disable-next Metrics/ParameterLists -- the public keyword door every dispatch calls
+      # rubocop:disable-next Metrics/ParameterLists -- the public keyword entry point every dispatch calls
       def from_call(verb, to:, with:, flat:, receiver: :aggregate, entity_depth: 0, aggregate: nil, &declaring)
         call = Call.new(verb, to, with, flat, entity_depth, aggregate, declaring)
         case receiver

data/lib/hecks/runtime/loader/boot_steps.rb

@@ -15,20 +15,23 @@ module Hecks
         # the domain never attached Privacy at all.
         def seed_privacy_markings!(dispatcher, registry)
           return if registry.pending_privacy_markings.empty?
-          return unless registry.bluebook("Privacy")
 
-          already_marked = already_marked_by_domain(dispatcher, registry)
+          provider = registry.provider_of(Bluebook::Capabilities::PRIVACY)
+          return unless provider
+
+          already_marked = already_marked_by_domain(dispatcher, registry, provider)
           registry.pending_privacy_markings.each do |marking|
             next if already_marked[marking[:domain]].include?(marking[:attribute_path])
 
-            dispatcher.dispatch_flat("Privacy::Marking.Mark", marking)
+            dispatcher.dispatch_flat(provider.provided_verb(Bluebook::Capabilities::PRIVACY, :mark_sensitive), marking)
           end
         end
 
         # Each domain with a pending marking, with the attribute paths Privacy already marks for it.
-        def already_marked_by_domain(dispatcher, registry)
+        def already_marked_by_domain(dispatcher, registry, provider)
+          verb = provider.provided_verb(Bluebook::Capabilities::PRIVACY, :markings_for)
           registry.pending_privacy_markings.map { |marking| marking[:domain] }.uniq.to_h do |domain|
-            [domain, dispatcher.query("Privacy::Marking.ForDomain", domain: domain).map { |row| row[:attribute_path][:value] }]
+            [domain, dispatcher.query(verb, domain: domain).map { |row| row[:attribute_path][:value] }]
           end
         end
 

data/lib/hecks/runtime/loader.rb

@@ -1,4 +1,4 @@
-require_relative "../doors/ruby_door"
+require_relative "../adapters/driving/ruby"
 require_relative "../ports/loading"
 require_relative "../ports/persistence"
 require_relative "dispatcher"
@@ -21,7 +21,7 @@ module Hecks
 
       # Boots `path`: loads its bluebook directory into a fresh Registry, runs
       # every registered boot gate, and returns the bound dispatcher. Pass
-      # `install_doors: false` to skip the `Widget::Item.Add(...)` global
+      # `install_driving: false` to skip the `Widget::Item.Add(...)` global
       # facade sugar (only a caller dispatching by FQN string needs to).
       #
       # @param path [String] a domain directory to boot
@@ -31,25 +31,25 @@ module Hecks
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the booted dispatcher
       # @raise [Errno::ENOENT] if `path` names no domain directory
       # @raise [Runtime::WiringError] if a boot gate finds a wiring problem
-      def self.boot(path, shared: nil, install_doors: true, environment: FROM_ENV)
+      def self.boot(path, shared: nil, install_driving: true, environment: FROM_ENV)
         described = describe(path, shared: shared, environment: environment)
-        boot_described(described, install_doors: install_doors)
+        boot_described(described, install_driving: install_driving)
       end
 
       # Finishes a boot from declarations `describe` already loaded: runs every boot gate and binds
       # the dispatcher, without reading the domain's files again.
       #
       # @param described [Described] what `describe` answered for the domain to boot
-      # @param install_doors [Boolean] install the `Widget::Item.Add(...)` global facade sugar
+      # @param install_driving [Boolean] install the `Widget::Item.Add(...)` global facade sugar
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the booted dispatcher
       # @raise [Runtime::WiringError] if a boot gate finds a wiring problem
-      def self.boot_described(described, install_doors: true)
+      def self.boot_described(described, install_driving: true)
         registry = described.registry
         run_boot_gates!(registry, described.directory)
         dispatcher = dispatcher_for(registry)
         redrive_outbox!(dispatcher)
         seed_privacy_markings!(dispatcher, registry)
-        install_doors ? bind_runtime(dispatcher) : dispatcher
+        install_driving ? bind_runtime(dispatcher) : dispatcher
       end
 
       # Loads `path`'s declarations into a fresh Registry and stops: no boot gate runs, no
@@ -118,7 +118,7 @@ module Hecks
       #   defaults to `HECKS_ENVIRONMENT`, and an explicit nil loads none
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the booted dispatcher
       # @raise [Runtime::WiringError] if a boot gate finds a wiring problem
-      def self.boot_files(paths, shared: nil, install_doors: true, environment: FROM_ENV)
+      def self.boot_files(paths, shared: nil, install_driving: true, environment: FROM_ENV)
         loading   = Ports::Loading.bootstrap
         files     = Array(paths).map { |path| File.expand_path(path) }
         directory = File.dirname(files.first)
@@ -126,7 +126,7 @@ module Hecks
 
         run_boot_gates!(registry, directory)
         dispatcher = dispatcher_for(registry)
-        install_doors ? bind_runtime(dispatcher) : dispatcher
+        install_driving ? bind_runtime(dispatcher) : dispatcher
       end
 
       # Loads exactly `files` into a fresh Registry rooted beside their directory, answering it.
@@ -160,7 +160,7 @@ module Hecks
       # `dispatcher`. The binding lives in the facade's own modules, not a
       # class-level global, so two boots in one process don't share one name.
       def self.bind_runtime(dispatcher)
-        Doors::RubyDoor.install(dispatcher)
+        Adapters::Driving::Ruby.install(dispatcher)
         dispatcher
       end
     end

data/lib/hecks/runtime/policy_interpreter/arguments.rb

@@ -4,7 +4,7 @@ module Hecks
   module Runtime
     class PolicyInterpreter
       # What a policy's trigger is given: the event payload or its `with:` projection, the
-      # emitting record's identity, and the invocation the door re-enters with. Mixed into
+      # emitting record's identity, and the invocation the entry point re-enters with. Mixed into
       # {PolicyInterpreter}.
       module Arguments
         private
@@ -12,12 +12,15 @@ module Hecks
         # What the trigger is given: the whole event payload verbatim when no `with:` is
         # declared, otherwise the projection (a Symbol names a payload field, anything else
         # is a literal). `extra` is a fan-out's row key, merged into the source before the
-        # projection so a `with:` can name the row it acts on.
-        def trigger_args(policy, event, extra = {})
+        # projection so a `with:` can name the row it acts on. `row` is the fan-out row itself:
+        # its fields are offered to a projection only, below the emitter identity and the
+        # payload, and never reach an unprojected payload.
+        def trigger_args(policy, event, extra = {}, row = {})
           payload = event.payload.transform_keys(&:to_sym).merge(extra)
           return payload unless ReactionInvocation.projection_declared?(policy)
 
-          projected_args(policy, event, emitter_identity(event).merge(payload))
+          source = row.transform_keys(&:to_sym).merge(emitter_identity(event)).merge(payload)
+          projected_args(policy, event, source)
         end
 
         def projected_args(policy, event, payload)

data/lib/hecks/runtime/policy_interpreter/fan_out.rb

@@ -20,7 +20,7 @@ module Hecks
 
           rows, reference_key = for_each_rows(policy, event, domain, target)
           Array(rows).map do |row|
-            args = trigger_args(policy, event, reference_key => row[:id])
+            args = trigger_args(policy, event, { reference_key => row[:id] }, row)
             deliver_for_each_row(target, record.merge(for_row: row[:id]), args, policy, event)
           end
         rescue *DOMAIN_REFUSALS => e
@@ -74,10 +74,10 @@ module Hecks
         end
 
         def deliver_for_each_row(target, row_record, args, policy, event)
-          return depth_refusal(row_record) if @door.reaction_depth_reached?
+          return depth_refusal(row_record) if @dispatcher.reaction_depth_reached?
 
           # The row key is already merged by `trigger_args`, so a projection can name it.
-          @door.reenter(target, **reaction_invocation(target, args, policy, event))
+          @dispatcher.reenter(target, **reaction_invocation(target, args, policy, event))
           row_record.merge(delivered: true)
         rescue *DOMAIN_REFUSALS => e
           row_record.merge(delivered: false, reason: e.message)