hecks 3.14.0 → 5.0.0

data/rust/host/src/journal.rs

@@ -94,7 +94,14 @@ pub async fn record_dead_letter<C: GenericClient>(
             "INSERT INTO hecks_cross_domain_dead_letters \
              (policy, target_domain, target_verb, payload, error, attempts) \
              VALUES ($1, $2, $3, $4, $5, $6)",
-            &[&policy, &target_domain, &target_verb, payload, &error, &attempts],
+            &[
+                &policy,
+                &target_domain,
+                &target_verb,
+                payload,
+                &error,
+                &attempts,
+            ],
         )
         .await?;
     Ok(())
@@ -122,7 +129,10 @@ pub async fn load_steps<C: GenericClient>(client: &C) -> anyhow::Result<Vec<serd
 
 /// Steps recorded after `ordinal` — what remains to replay on top of a
 /// snapshot taken as of that ordinal (normally empty).
-pub async fn load_steps_after<C: GenericClient>(client: &C, ordinal: i64) -> anyhow::Result<Vec<serde_json::Value>> {
+pub async fn load_steps_after<C: GenericClient>(
+    client: &C,
+    ordinal: i64,
+) -> anyhow::Result<Vec<serde_json::Value>> {
     let rows = client
         .query(
             "SELECT verb, args FROM hecks_lambda_journal WHERE ordinal > $1 ORDER BY ordinal",
@@ -154,9 +164,16 @@ pub struct Snapshot {
 /// before the first accepted command, when there's nothing to seed from yet.
 pub async fn load_snapshot<C: GenericClient>(client: &C) -> anyhow::Result<Option<Snapshot>> {
     let rows = client
-        .query("SELECT ordinal, seed, sagas_backfilled FROM hecks_lambda_snapshot", &[])
+        .query(
+            "SELECT ordinal, seed, sagas_backfilled FROM hecks_lambda_snapshot",
+            &[],
+        )
         .await?;
-    Ok(rows.first().map(|row| Snapshot { ordinal: row.get(0), seed: row.get(1), sagas_backfilled: row.get(2) }))
+    Ok(rows.first().map(|row| Snapshot {
+        ordinal: row.get(0),
+        seed: row.get(1),
+        sagas_backfilled: row.get(2),
+    }))
 }
 
 /// Returns the new journal row's ordinal, for `save_snapshot` to pair with it.
@@ -177,7 +194,11 @@ pub async fn append<C: GenericClient>(
 /// Upserts the one-row snapshot cache at `ordinal`. Always sets
 /// `sagas_backfilled = true`; only a row written before that column
 /// existed can ever read back `false`.
-pub async fn save_snapshot<C: GenericClient>(client: &C, ordinal: i64, seed: &serde_json::Value) -> anyhow::Result<()> {
+pub async fn save_snapshot<C: GenericClient>(
+    client: &C,
+    ordinal: i64,
+    seed: &serde_json::Value,
+) -> anyhow::Result<()> {
     client
         .execute(
             "INSERT INTO hecks_lambda_snapshot (id, ordinal, seed, sagas_backfilled) VALUES (true, $1, $2, true) \
@@ -269,66 +290,23 @@ impl LineageConfig {
     /// Whether `qualified_aggregate` is mirrored into the era-shaped head
     /// snapshots.
     pub fn mirrors(&self, qualified_aggregate: &str) -> bool {
-        match &self.mirrored {
-            None => true,
-            Some(capable) => capable.contains(qualified_aggregate),
-        }
-    }
-}
-
-/// Ports `Naming.snake` (lib/hecks/naming.rb) verbatim — must match Ruby
-/// exactly so both runtimes derive the same storage names.
-pub fn snake(name: &str) -> String {
-    word_boundary(&acronym_boundary(name)).to_ascii_lowercase()
-}
-
-fn acronym_boundary(s: &str) -> String {
-    let chars: Vec<char> = s.chars().collect();
-    let mut out = String::new();
-    let mut i = 0;
-    while i < chars.len() {
-        if chars[i].is_ascii_uppercase() {
-            let mut j = i;
-            while j < chars.len() && chars[j].is_ascii_uppercase() {
-                j += 1;
-            }
-            let run_len = j - i;
-            if run_len >= 2 && j < chars.len() && chars[j].is_ascii_lowercase() {
-                out.extend(&chars[i..j - 1]);
-                out.push('_');
-                out.push(chars[j - 1]);
-                i = j;
-                continue;
-            }
-            out.extend(&chars[i..j]);
-            i = j;
-            continue;
-        }
-        out.push(chars[i]);
-        i += 1;
+        self.mirrored
+            .as_ref()
+            .is_none_or(|capable| capable.contains(qualified_aggregate))
     }
-    out
 }
 
-fn word_boundary(s: &str) -> String {
-    let chars: Vec<char> = s.chars().collect();
-    let mut out = String::new();
-    for (idx, &c) in chars.iter().enumerate() {
-        if idx > 0 && c.is_ascii_uppercase() {
-            let prev = chars[idx - 1];
-            if prev.is_ascii_lowercase() || prev.is_ascii_digit() {
-                out.push('_');
-            }
-        }
-        out.push(c);
-    }
-    out
-}
+// `Naming.snake` is the one shared port (rust/codegen/src/hecks_naming.rs); the host reaches it
+// through here so both runtimes derive the same storage names.
+pub use crate::hecks_naming::snake;
 
 /// `aggregate.storage_name` ported from ir/aggregate.rb — demodulizes a
 /// qualified name like `"Banking::Customer"` to `"Customer"` before snaking it.
 fn storage_name(qualified_aggregate: &str) -> String {
-    let short = qualified_aggregate.rsplit("::").next().unwrap_or(qualified_aggregate);
+    let short = qualified_aggregate
+        .rsplit("::")
+        .next()
+        .unwrap_or(qualified_aggregate);
     snake(short)
 }
 
@@ -348,7 +326,7 @@ fn journal_table(domain: &str) -> String {
 const POSTGRES_IDENTIFIER_LIMIT: usize = 63;
 
 /// Same algorithm as `Lineage#qualified_name` (lineage.rb): 63-byte limit,
-/// SHA256 suffix, domain-qualified so two domains' storage names can't
+/// SHA256 suffix over the full name, a cut that never splits a character, domain-qualified so two domains' storage names can't
 /// collide (ADR 0059).
 pub(crate) fn qualified_name(domain: &str, suffix: &str) -> String {
     let full = format!("{}_{}", snake(domain), suffix);
@@ -358,12 +336,23 @@ pub(crate) fn qualified_name(domain: &str, suffix: &str) -> String {
 
     let digest = format!("{:x}", Sha256::digest(full.as_bytes()));
     let digest = &digest[0..8];
-    let keep = POSTGRES_IDENTIFIER_LIMIT - digest.len() - 1;
+    let mut keep = POSTGRES_IDENTIFIER_LIMIT - digest.len() - 1;
+    // Cut at the longest prefix of whole characters that fits, as the Ruby side does.
+    while !full.is_char_boundary(keep) {
+        keep -= 1;
+    }
     format!("{}_{}", &full[0..keep], digest)
 }
 
 fn head_snapshot_table(domain: &str, qualified_aggregate: &str, era: i32) -> String {
-    qualified_name(domain, &format!("{}_head_snapshot_{}", storage_name(qualified_aggregate), era))
+    qualified_name(
+        domain,
+        &format!(
+            "{}_head_snapshot_{}",
+            storage_name(qualified_aggregate),
+            era
+        ),
+    )
 }
 
 /// The highest era ordinal on file for `domain`, not a bare existence
@@ -428,10 +417,21 @@ pub async fn append_lineage_mutation<C: GenericClient>(
                  VALUES ($1, $2, $3, $4, $5) RETURNING ordinal",
                 quote_ident(&journal)
             ),
-            &[&era, &storage, &mutation.id, &mutation.operation, &mutation.state],
+            &[
+                &era,
+                &storage,
+                &mutation.id,
+                &mutation.operation,
+                &mutation.state,
+            ],
         )
         .await
-        .with_context(|| format!("journalling {} #{} into {journal} at era {era}", mutation.aggregate, mutation.id))?;
+        .with_context(|| {
+            format!(
+                "journalling {} #{} into {journal} at era {era}",
+                mutation.aggregate, mutation.id
+            )
+        })?;
     let ordinal: i64 = row.get(0);
 
     client
@@ -445,7 +445,12 @@ pub async fn append_lineage_mutation<C: GenericClient>(
             &[&mutation.id, &ordinal, &mutation.state],
         )
         .await
-        .with_context(|| format!("upserting {} #{} into {snapshot}", mutation.aggregate, mutation.id))?;
+        .with_context(|| {
+            format!(
+                "upserting {} #{} into {snapshot}",
+                mutation.aggregate, mutation.id
+            )
+        })?;
 
     Ok(())
 }
@@ -464,9 +469,18 @@ pub async fn read_lineage_head_all<C: GenericClient>(
     storage_name: &str,
 ) -> anyhow::Result<Vec<(String, serde_json::Value)>> {
     let rows = client
-        .query(&format!("SELECT id, state FROM {}", quote_ident(&head_view(domain, storage_name))), &[])
+        .query(
+            &format!(
+                "SELECT id, state FROM {}",
+                quote_ident(&head_view(domain, storage_name))
+            ),
+            &[],
+        )
         .await?;
-    Ok(rows.into_iter().map(|row| (row.get(0), row.get(1))).collect())
+    Ok(rows
+        .into_iter()
+        .map(|row| (row.get(0), row.get(1)))
+        .collect())
 }
 
 /// One row by id, already translated to its current shape.
@@ -478,7 +492,10 @@ pub async fn read_lineage_head_by_id<C: GenericClient>(
 ) -> anyhow::Result<Option<serde_json::Value>> {
     let row = client
         .query_opt(
-            &format!("SELECT state FROM {} WHERE id = $1", quote_ident(&head_view(domain, storage_name))),
+            &format!(
+                "SELECT state FROM {} WHERE id = $1",
+                quote_ident(&head_view(domain, storage_name))
+            ),
             &[&id],
         )
         .await?;
@@ -534,57 +551,17 @@ pub async fn held_eras<C: GenericClient>(client: &C, domain: &str) -> anyhow::Re
         .collect()
 }
 
-/// A Layer-3 approval, as recorded — mirrors era_store.rb's `approval_for`.
-#[derive(Debug, Clone)]
-pub struct Approval {
-    pub edge_digest: String,
-    pub reviewed_ordinal: i64,
-}
-
-/// The latest approval for one shape-pair edge, if any (latest wins).
-pub async fn approval_for<C: GenericClient>(
-    client: &C,
-    domain: &str,
-    from_label: &str,
-    to_label: &str,
-) -> anyhow::Result<Option<Approval>> {
-    let row = client
-        .query_opt(
-            "SELECT edge_digest, reviewed_ordinal FROM hecks_approvals \
-             WHERE domain = $1 AND from_label = $2 AND to_label = $3 \
-             ORDER BY approved_at DESC, reviewed_ordinal DESC LIMIT 1",
-            &[&domain, &from_label, &to_label],
-        )
-        .await?;
-
-    Ok(row.map(|row| Approval { edge_digest: row.get("edge_digest"), reviewed_ordinal: row.get("reviewed_ordinal") }))
-}
-
-/// Writes an approval into the journal, bound to the journal's tip as it stands, as
-/// `LineageStore#record_approval!` does; how a committed approval joins the single history.
-pub async fn record_approval<C: GenericClient>(
-    client: &C,
-    domain: &str,
-    from_label: &str,
-    to_label: &str,
-    edge_digest: &str,
-) -> anyhow::Result<()> {
-    let tip = last_ordinal(client, domain).await?;
-    client
-        .execute(
-            "INSERT INTO hecks_approvals (domain, from_label, to_label, edge_digest, reviewed_ordinal) \
-             VALUES ($1, $2, $3, $4, $5)",
-            &[&domain, &from_label, &to_label, &edge_digest, &tip],
-        )
-        .await?;
-    Ok(())
-}
-
-/// The journal's high-water ordinal — what a fresh approval binds to and
-/// what a mint transaction captures as the new era's watermark.
+/// The journal's high-water ordinal — what a mint transaction captures as the
+/// new era's watermark.
 pub async fn last_ordinal<C: GenericClient>(client: &C, domain: &str) -> anyhow::Result<i64> {
     let row = client
-        .query_one(&format!("SELECT COALESCE(max(ordinal), 0) AS o FROM {}", quote_ident(&journal_table(domain))), &[])
+        .query_one(
+            &format!(
+                "SELECT COALESCE(max(ordinal), 0) AS o FROM {}",
+                quote_ident(&journal_table(domain))
+            ),
+            &[],
+        )
         .await?;
     Ok(row.get("o"))
 }
@@ -603,7 +580,8 @@ mod lineage_tests {
         let owner_role = "rust_host_rls_owner";
         let app_role = "rust_host_rls_app";
 
-        let script = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/mint_stale_era.rb");
+        let script = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("tests/fixtures/mint_stale_era.rb");
         let status = std::process::Command::new("ruby")
             .arg(&script)
             .arg(db)
@@ -611,12 +589,15 @@ mod lineage_tests {
             .arg(app_role)
             .status()
             .expect("run mint_stale_era.rb -- is `ruby` on PATH?");
-        assert!(status.success(), "mint_stale_era.rb failed -- see its own stderr above");
+        assert!(
+            status.success(),
+            "mint_stale_era.rb failed -- see its own stderr above"
+        );
 
         // The fenced app role — the same connection shape a real deployed
         // rust/host uses (never the table-owning role, which bypasses RLS).
         let (client, connection) =
-            tokio_postgres::connect(&crate::test_pg::conninfo_as(&db, &app_role), NoTls)
+            tokio_postgres::connect(&crate::test_pg::conninfo_as(db, app_role), NoTls)
                 .await
                 .expect("connect as the app role");
         tokio::spawn(async move {
@@ -626,24 +607,48 @@ mod lineage_tests {
         let state = serde_json::json!({ "cents": 100 });
 
         // The era this checkout speaks -- allowed.
-        let current_era = LineageConfig { domain: "Ledger".to_string(), era: Some(2), mirrored: None };
+        let current_era = LineageConfig {
+            domain: "Ledger".to_string(),
+            era: Some(2),
+            mirrored: None,
+        };
         let accepted = append_lineage_mutation(
             &client,
             &current_era,
-            &Mutation { aggregate: "Account", id: "current-era", operation: "save", state: &state },
+            &Mutation {
+                aggregate: "Account",
+                id: "current-era",
+                operation: "save",
+                state: &state,
+            },
         )
         .await;
-        assert!(accepted.is_ok(), "writing under the CURRENT era should succeed: {accepted:?}");
+        assert!(
+            accepted.is_ok(),
+            "writing under the CURRENT era should succeed: {accepted:?}"
+        );
 
         // The superseded era -- refused by Postgres's own RLS policy.
-        let stale_era = LineageConfig { domain: "Ledger".to_string(), era: Some(1), mirrored: None };
+        let stale_era = LineageConfig {
+            domain: "Ledger".to_string(),
+            era: Some(1),
+            mirrored: None,
+        };
         let refused = append_lineage_mutation(
             &client,
             &stale_era,
-            &Mutation { aggregate: "Account", id: "stale-era", operation: "save", state: &state },
+            &Mutation {
+                aggregate: "Account",
+                id: "stale-era",
+                operation: "save",
+                state: &state,
+            },
         )
         .await;
-        assert!(refused.is_err(), "writing under a SUPERSEDED era should be refused");
+        assert!(
+            refused.is_err(),
+            "writing under a SUPERSEDED era should be refused"
+        );
         let message = format!("{:#}", refused.unwrap_err()).to_lowercase();
         assert!(
             message.contains("row-level security") || message.contains("row level security"),
@@ -651,60 +656,59 @@ mod lineage_tests {
         );
     }
 
-    // Proven against a real compute-migrated era Ruby minted, not a
-    // synthetic fixture, so a real hecks_approvals row is guaranteed
-    // to exist by the time this test reads it back.
+    // Proven against a real two-era lineage Ruby minted, not a synthetic fixture.
     #[tokio::test]
-    async fn held_eras_and_approval_for_read_exactly_what_ruby_s_own_mint_wrote() {
+    async fn held_eras_read_exactly_what_ruby_s_own_mint_wrote() {
         let db = "rust_host_era_read_test";
         let owner_role = "rust_host_era_read_owner";
         let app_role = "rust_host_era_read_app";
 
-        let script = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/mint_and_seed_lineage_compute.rb");
+        let script = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("tests/fixtures/mint_and_seed_lineage.rb");
         let output = std::process::Command::new("ruby")
             .arg(&script)
             .arg(db)
             .arg(owner_role)
             .arg(app_role)
             .output()
-            .expect("run mint_and_seed_lineage_compute.rb -- is `ruby` on PATH?");
+            .expect("run mint_and_seed_lineage.rb -- is `ruby` on PATH?");
         assert!(
             output.status.success(),
-            "mint_and_seed_lineage_compute.rb failed:\n{}",
+            "mint_and_seed_lineage.rb failed:\n{}",
             String::from_utf8_lossy(&output.stderr)
         );
 
-        // Owner-authenticated: hecks_eras/hecks_approvals aren't grantable
-        // to the app role by design — only the mint path reads them, not
-        // the RLS-fenced data path the test above exists to prove.
-        let (client, connection) = tokio_postgres::connect(&crate::test_pg::conninfo_as(&db, &owner_role), NoTls)
-            .await
-            .expect("connect as owner");
+        // Owner-authenticated: hecks_eras isn't grantable to the app role by design -- only the
+        // mint path reads it, not the RLS-fenced data path the test above exists to prove.
+        let (client, connection) =
+            tokio_postgres::connect(&crate::test_pg::conninfo_as(db, owner_role), NoTls)
+                .await
+                .expect("connect as owner");
         tokio::spawn(async move {
             let _ = connection.await;
         });
 
-        let eras = held_eras(&client, "LedgerCompute").await.expect("held_eras");
-        assert_eq!(eras.len(), 2, "expected exactly the two eras mint_and_seed_lineage_compute.rb mints: {eras:?}");
+        let eras = held_eras(&client, "Ledger").await.expect("held_eras");
+        assert_eq!(
+            eras.len(),
+            2,
+            "expected exactly the two eras mint_and_seed_lineage.rb mints: {eras:?}"
+        );
         assert_eq!(eras[0].ordinal, 1);
         assert_eq!(eras[1].ordinal, 2);
         let from_label = eras[0].label.clone().expect("era 1 has a minted label");
         let to_label = eras[1].label.clone().expect("era 2 has a minted label");
-        assert_ne!(from_label, to_label, "a real compute edge names two DIFFERENT shapes");
+        assert_ne!(
+            from_label, to_label,
+            "a real edge names two DIFFERENT shapes"
+        );
 
-        let approval = approval_for(&client, "LedgerCompute", &from_label, &to_label)
-            .await
-            .expect("approval_for")
-            .expect("the real approval mint_and_seed_lineage_compute.rb recorded should still be readable");
-        assert!(!approval.edge_digest.is_empty());
-        // reviewed_ordinal binds to the journal's high-water mark at
-        // approval time; era 1's two prior writes mean it must be >= 2.
-        assert!(approval.reviewed_ordinal >= 2, "reviewed_ordinal should reflect era 1's real writes: {}", approval.reviewed_ordinal);
-
-        // last_ordinal must have advanced past the approval's own
-        // reviewed_ordinal by the one post-mint write.
-        let ordinal = last_ordinal(&client, "LedgerCompute").await.expect("last_ordinal");
-        assert!(ordinal > approval.reviewed_ordinal, "the journal should have advanced since the approval was reviewed: {ordinal} vs {}", approval.reviewed_ordinal);
+        // Era 1 took two writes and era 2 one, so the journal's high-water mark is past them.
+        let ordinal = last_ordinal(&client, "Ledger").await.expect("last_ordinal");
+        assert!(
+            ordinal >= 3,
+            "last_ordinal should reflect the real writes: {ordinal}"
+        );
     }
 
     // The boot-gate case the RLS test doesn't cover: this crate's own
@@ -713,9 +717,10 @@ mod lineage_tests {
     // a bare existence check can't.
     #[tokio::test]
     async fn current_era_tells_unminted_apart_from_stale_and_finds_the_live_ordinal() {
-        let (client, connection) = tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
-            .await
-            .expect("connect to postgres");
+        let (client, connection) =
+            tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
+                .await
+                .expect("connect to postgres");
         tokio::spawn(async move {
             let _ = connection.await;
         });
@@ -730,7 +735,10 @@ mod lineage_tests {
 
         // A domain hecks_eras has never heard of at all.
         let unminted = current_era(&client, "CurrentEraFixture").await.unwrap();
-        assert_eq!(unminted, None, "a domain with no hecks_eras rows at all has no current era");
+        assert_eq!(
+            unminted, None,
+            "a domain with no hecks_eras rows at all has no current era"
+        );
 
         // Era 1 minted, then era 2 supersedes it; hecks_eras is
         // append-only, so both rows remain on file.
@@ -768,16 +776,23 @@ mod lineage_tests {
     // reproducing Ruby's mint path; that correctness is lineage_spec.rb's job.
     #[tokio::test]
     async fn read_lineage_head_reads_any_aggregates_view_generically() {
-        let (client, connection) = tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
-            .await
-            .expect("connect to postgres");
+        let (client, connection) =
+            tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
+                .await
+                .expect("connect to postgres");
         tokio::spawn(async move {
             let _ = connection.await;
         });
 
         // Domain-qualified (ADR 0059); snake("Fixtures") == "fixtures".
-        client.batch_execute("DROP VIEW IF EXISTS fixtures_widget_head").await.unwrap();
-        client.batch_execute("DROP TABLE IF EXISTS fixtures_widget_head_snapshot_1").await.unwrap();
+        client
+            .batch_execute("DROP VIEW IF EXISTS fixtures_widget_head")
+            .await
+            .unwrap();
+        client
+            .batch_execute("DROP TABLE IF EXISTS fixtures_widget_head_snapshot_1")
+            .await
+            .unwrap();
         client
             .batch_execute(
                 "CREATE TABLE fixtures_widget_head_snapshot_1 (id text PRIMARY KEY, ordinal bigint NOT NULL, state jsonb NOT NULL)",
@@ -789,7 +804,11 @@ mod lineage_tests {
             .await
             .unwrap();
 
-        let config = LineageConfig { domain: "Fixtures".to_string(), era: Some(1), mirrored: None };
+        let config = LineageConfig {
+            domain: "Fixtures".to_string(),
+            era: Some(1),
+            mirrored: None,
+        };
         client
             .batch_execute("CREATE TABLE IF NOT EXISTS hecks_journal_fixtures (ordinal bigserial PRIMARY KEY, era int NOT NULL, aggregate text NOT NULL, aggregate_id text NOT NULL, operation text NOT NULL, state jsonb)")
             .await
@@ -797,45 +816,71 @@ mod lineage_tests {
         append_lineage_mutation(
             &client,
             &config,
-            &Mutation { aggregate: "Widget", id: "widget-1", operation: "save", state: &serde_json::json!({ "name": "Gadget" }) },
+            &Mutation {
+                aggregate: "Widget",
+                id: "widget-1",
+                operation: "save",
+                state: &serde_json::json!({ "name": "Gadget" }),
+            },
         )
         .await
         .unwrap();
         append_lineage_mutation(
             &client,
             &config,
-            &Mutation { aggregate: "Widget", id: "widget-2", operation: "save", state: &serde_json::json!({ "name": "Gizmo" }) },
+            &Mutation {
+                aggregate: "Widget",
+                id: "widget-2",
+                operation: "save",
+                state: &serde_json::json!({ "name": "Gizmo" }),
+            },
         )
         .await
         .unwrap();
 
-        let one = read_lineage_head_by_id(&client, "Fixtures", "widget", "widget-1").await.unwrap();
+        let one = read_lineage_head_by_id(&client, "Fixtures", "widget", "widget-1")
+            .await
+            .unwrap();
         assert_eq!(one, Some(serde_json::json!({ "name": "Gadget" })));
 
-        let missing = read_lineage_head_by_id(&client, "Fixtures", "widget", "widget-nonexistent").await.unwrap();
+        let missing = read_lineage_head_by_id(&client, "Fixtures", "widget", "widget-nonexistent")
+            .await
+            .unwrap();
         assert_eq!(missing, None);
 
-        let mut all = read_lineage_head_all(&client, "Fixtures", "widget").await.unwrap();
+        let mut all = read_lineage_head_all(&client, "Fixtures", "widget")
+            .await
+            .unwrap();
         all.sort_by(|a, b| a.0.cmp(&b.0));
         assert_eq!(
             all,
             vec![
-                ("widget-1".to_string(), serde_json::json!({ "name": "Gadget" })),
-                ("widget-2".to_string(), serde_json::json!({ "name": "Gizmo" })),
+                (
+                    "widget-1".to_string(),
+                    serde_json::json!({ "name": "Gadget" })
+                ),
+                (
+                    "widget-2".to_string(),
+                    serde_json::json!({ "name": "Gizmo" })
+                ),
             ]
         );
     }
 
     #[tokio::test]
     async fn record_dead_letter_writes_a_real_durable_row() {
-        let (client, connection) = tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
-            .await
-            .expect("connect to postgres");
+        let (client, connection) =
+            tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
+                .await
+                .expect("connect to postgres");
         tokio::spawn(async move {
             let _ = connection.await;
         });
         ensure_schema(&client).await.unwrap();
-        client.batch_execute("DELETE FROM hecks_cross_domain_dead_letters").await.unwrap();
+        client
+            .batch_execute("DELETE FROM hecks_cross_domain_dead_letters")
+            .await
+            .unwrap();
 
         record_dead_letter(
             &client,
@@ -867,8 +912,64 @@ mod lineage_tests {
         assert_eq!(policy, "ReviewOnFreeze");
         assert_eq!(target_domain, "Compliance");
         assert_eq!(target_verb, "Compliance::AccountFreezeReview.Open");
-        assert_eq!(payload, serde_json::json!({ "number": { "value": "acct-1" } }));
+        assert_eq!(
+            payload,
+            serde_json::json!({ "number": { "value": "acct-1" } })
+        );
         assert_eq!(error, "ResourceNotFoundException: function not found");
         assert_eq!(attempts, 3);
     }
 }
+
+#[cfg(test)]
+mod naming_vector_tests {
+    use super::*;
+    use serde_json::Value;
+
+    // spec/fixtures/naming_vectors.json is asserted by spec/naming_vectors_spec.rb against
+    // Naming.snake and Lineage#qualified_name, so a drift in either runtime fails a test.
+    fn vectors() -> Value {
+        serde_json::from_str(include_str!("../../../spec/fixtures/naming_vectors.json")).unwrap()
+    }
+
+    fn table(section: &str) -> Vec<Value> {
+        let rows = vectors()[section].as_array().unwrap().clone();
+        assert!(!rows.is_empty(), "{section} rows went missing");
+        rows
+    }
+
+    #[test]
+    fn snake_matches_every_shared_row() {
+        for row in table("snake") {
+            let input = row["input"].as_str().unwrap();
+            assert_eq!(snake(input), row["expected"].as_str().unwrap(), "{input:?}");
+        }
+    }
+
+    #[test]
+    fn storage_name_matches_every_shared_row() {
+        for row in table("storage_name") {
+            let input = row["input"].as_str().unwrap();
+            assert_eq!(
+                storage_name(input),
+                row["expected"].as_str().unwrap(),
+                "{input:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn qualified_name_matches_every_shared_row() {
+        for row in table("qualified_name") {
+            let domain = row["domain"].as_str().unwrap();
+            let suffix = row["suffix"].as_str().unwrap();
+            let got = qualified_name(domain, suffix);
+            assert_eq!(
+                got,
+                row["expected"].as_str().unwrap(),
+                "{domain:?} {suffix:?}"
+            );
+            assert!(got.len() <= POSTGRES_IDENTIFIER_LIMIT);
+        }
+    }
+}