hecks 3.5.0 → 3.7.0

data/lib/hecks/runtime/registry/saga_persistence.rb

@@ -14,16 +14,15 @@ module Hecks
           end
         end
 
-        def saga_domains = @hecksagons.keys | @bluebooks.keys.select { |domain| default_adapter_for(domain) }
+        def saga_domains = @declared.hecksagons.keys | @declared.bluebooks.keys.select { |domain| default_adapter_for(domain) }
 
         # Boot-time-only (Loader.run_boot_gates!, before dispatch exists); no concurrent
         # writer to race here, unlike saga_interpreter.rb's writes under @saga_mutex.
-        # rubocop:disable-next Hecks/ThreadSharedIvarMutation
         def rehydrate_sagas!
           saga_domains.each do |domain|
             saga_persistence(domain).each_saga do |process_manager, correlation, state, memory, completed_compensations = []|
               pending = memory.delete(SAGA_PENDING_DISPATCH_KEY)
-              @saga_instances[process_manager][correlation] =
+              @state.saga_instances[process_manager][correlation] =
                 { state: state, memory: memory, completed_compensations: completed_compensations || [] }
               warn_stalled_saga(domain, process_manager, correlation, state, pending) if pending
             end
@@ -46,22 +45,27 @@ module Hecks
                "#{dispatches} (on #{pending[:on].inspect}, #{pending[:from].inspect} -> #{pending[:to].inspect}) " \
                "may or may not have actually run. hecks does not auto-redrive a pending saga dispatch (that " \
                "needs idempotent delivery, which this pipeline doesn't have yet); reconcile this instance by hand."
-          @saga_log << { process_manager: process_manager, instance: correlation, rehydrated_stalled: true,
-                         state: state, pending: pending }
+          @state.saga_log << { process_manager: process_manager, instance: correlation, rehydrated_stalled: true,
+                               state: state, pending: pending }
         end
 
         def resolve_saga_persistence(domain)
           anchor = hecksagon(domain) && bluebook(domain)&.aggregates&.first
           return Ports::Persistence::NULL_SAGA_STORE unless anchor
 
+          persisting_adapter(domain, anchor)
+        rescue WiringError
+          # An unwired domain degrades to no saga persistence rather than raising mid-dispatch.
+          Ports::Persistence::NULL_SAGA_STORE
+        end
+
+        # The anchor aggregate's own adapter when it can checkpoint sagas, else the null store.
+        def persisting_adapter(domain, anchor)
           bind = Ports::Persistence::BindingPolicy.resolve(self, domain, anchor)
           return Ports::Persistence::NULL_SAGA_STORE if adapter_class(bind.adapter) <= Ports::Persistence::RemoteRuntime
 
           adapter = repository(domain, anchor).adapter
           adapter.respond_to?(:save_saga) ? adapter : Ports::Persistence::NULL_SAGA_STORE
-        rescue WiringError
-          # An unwired domain degrades to no saga persistence rather than raising mid-dispatch.
-          Ports::Persistence::NULL_SAGA_STORE
         end
       end
     end

data/lib/hecks/runtime/registry/verification.rb

@@ -1,4 +1,8 @@
-require_relative "../../bluebook/hexagon"
+require_relative "../../bluebook/hecksagon"
+require_relative "hecksagon_rules"
+require_relative "query_verification"
+require_relative "chapter_verification"
+require_relative "durability_warnings"
 
 module Hecks
   module Runtime
@@ -6,7 +10,12 @@ module Hecks
       # The wiring gate: every bind names a declared aggregate, every adapter satisfies its
       # port's verb, and every world default is usable. `verify!` runs it all at boot.
       module Verification
-        # Runs every wiring check against this registry's loaded bluebooks, hexagons, ports
+        include HecksagonRules
+        include QueryVerification
+        include ChapterVerification
+        include DurabilityWarnings
+
+        # Runs every wiring check against this registry's loaded bluebooks, hecksagons, ports
         # and adapters.
         def verify!
           verify_default_adapter!
@@ -18,31 +27,7 @@ module Hecks
           refuse_unresolved_port_operations!
           refuse_unanswerable_queries!
 
-          @hecksagons.each_value do |hexagon|
-            refuse_ungoverned_roles!(hexagon)
-            refuse_unwired_attachments!(hexagon)
-            refuse_bounded_without_acl!(hexagon)
-
-            hexagon.binds.each do |bind|
-              # A domain-level default (§0) names no aggregate of its own; still validate its
-              # adapter/verb shape. Real aggregates resolving through it are covered by their
-              # own dispatch-time `BindingPolicy.resolve`, not required to be exhaustive here.
-              if bind.aggregate.nil?
-                check_verb(bind)
-                next
-              end
-
-              aggregate = bluebook(hexagon.domain)&.aggregate(bind.aggregate_name)
-              raise WiringError, "#{bind.aggregate} is bound but not declared in the bluebook" unless aggregate
-
-              check_verb(bind)
-
-              repository(hexagon.domain, aggregate)
-            end
-
-            warn_undurable_sagas!(hexagon)
-            warn_undurable_outbox!(hexagon)
-          end
+          @declared.hecksagons.each_value { |hecksagon| verify_hecksagon!(hecksagon) }
           self
         end
 
@@ -50,13 +35,7 @@ module Hecks
         def verify_default_adapter!
           name = Ports::Persistence::DEFAULT_ADAPTER
 
-          check_verb(
-            Bluebook::Bind.new(
-              aggregate: "(default)",
-              verb:      Ports::Persistence::VERB,
-              adapter:   name
-            )
-          )
+          check_verb(Bluebook::Bind.new(aggregate: "(default)", verb: Ports::Persistence::VERB, adapter: name))
           adapter_class(name)
           self
         rescue WiringError => e
@@ -88,40 +67,32 @@ module Hecks
 
           raise WiringError,
                 "#{adapter_name} declares the #{port.name} port but does not respond to " \
-                "#{missing.map(&:inspect).join(', ')} — #{port.name}.port declares answers " \
-                "#{answers.map(&:inspect).join(', ')}"
+                "#{missing.map(&:inspect).join(", ")} — #{port.name}.port declares answers " \
+                "#{answers.map(&:inspect).join(", ")}"
         end
 
         # persistence/projection/loading are per-aggregate bound and already checked via
         # each bind above; a singleton port is never bound to an aggregate at all.
         PER_AGGREGATE_PORTS = %w[persistence projection loading].freeze
 
-        # The directory holding the gem's own Hecks chapter, the only place a chapter named
-        # `Hecks` may be declared from.
-        GEM_CHAPTER_DIR = File.expand_path("../../hecks", __dir__).freeze
-
-        # The chapter names only the gem itself may declare (ADR 0080, section 9).
-        RESERVED_CHAPTER_NAMES = %w[Hecks].freeze
-
         # Checks every singleton port with exactly one wired adapter against its own
         # declared `answers` methods.
         def verify_singleton_port_answers!
-          @ports.each_value do |port|
-            next if PER_AGGREGATE_PORTS.include?(port.name)
-            next if Array(port.answers).empty?
+          @declared.ports.each_value { |port| check_singleton_port!(port) }
+          self
+        end
 
-            implementations = @adapters.values.select { |a| a.port == port.name }
-            next unless implementations.size == 1
+        def check_singleton_port!(port)
+          return if PER_AGGREGATE_PORTS.include?(port.name) || Array(port.answers).empty?
 
-            check_answers(port, implementations.first.name)
-          end
-          self
+          implementations = @declared.adapters.values.select { |a| a.port == port.name }
+          check_answers(port, implementations.first.name) if implementations.size == 1
         end
 
         # Checks that every setting `settings` declares (besides `:adapter`) is a field
         # `bind`'s adapter actually admits.
         def check_settings(bind, settings)
-          adapter = @adapters[bind.adapter]
+          adapter = @declared.adapters[bind.adapter]
           return unless adapter
 
           declared = settings.keys - [:adapter]
@@ -129,16 +100,16 @@ module Hecks
           return if unknown.empty?
 
           raise WiringError,
-                "#{bind.adapter} does not declare #{unknown.map(&:inspect).join(', ')} — " \
-                "it declares #{adapter.all_fields.map(&:inspect).join(', ')}. " \
+                "#{bind.adapter} does not declare #{unknown.map(&:inspect).join(", ")} — " \
+                "it declares #{adapter.all_fields.map(&:inspect).join(", ")}. " \
                 "Add the field to the adapter, or remove it from the world."
         end
 
         def port_for(bind)
-          adapter = @adapters[bind.adapter]
+          adapter = @declared.adapters[bind.adapter]
           raise WiringError, "unknown adapter #{bind.adapter.inspect}" unless adapter
 
-          @ports[adapter.port] ||
+          @declared.ports[adapter.port] ||
             raise(WiringError, "adapter #{bind.adapter} declares unknown port #{adapter.port.inspect}")
         end
 
@@ -151,344 +122,29 @@ module Hecks
 
         private
 
-        # Checked once against the merged hecksagon so a domain split across multiple
-        # hecksagon files sees every `attaches` declaration first. A role is real
-        # access control only once an authorization provider exists to check it against
-        # (ADR 0025); a provider is recognized by declaring authorization, not by name.
-        def refuse_ungoverned_roles!(hexagon)
-          return if authorization_provider_for(hexagon.domain)
-
-          bluebook_ir = bluebook(hexagon.domain)
-          return unless bluebook_ir
-
-          offender = commands_in(bluebook_ir).find { |command| !command.role.to_s.empty? }
-          return unless offender
-
-          raise WiringError,
-                "#{offender.hecks_fqn} declares role #{offender.role.inspect}, but " \
-                "#{hexagon.domain}'s hecksagon never #{authorization_attachment_hint} — role is only " \
-                "real access control once an authorization provider is attached to check it against; " \
-                "without that it is silent decoration, the exact defect this refusal exists to catch"
-        end
-
-        # `attaches` loads a bounded context; the consumer must declare the sibling hecksagon
-        # that is its ACL (Governance/Identity/Privacy already do). A vendored package only
-        # loads its `.bluebook` files, so persistence, Governance and the `translates` ACL live
-        # on that sibling too, or cross-context field mapping has nowhere to be written.
-        def refuse_unwired_attachments!(hexagon)
-          hexagon.attachments.each do |attachment|
-            chapter_name = attachment.chapter_name
-            next if hecksagon(chapter_name)
-
-            what = attachment.vendor? ? "vendored bluebook #{attachment.name.inspect}" : chapter_name.inspect
-            raise WiringError,
-                  "#{hexagon.domain} attaches #{what} " \
-                  "(bounded context #{chapter_name}) but never declared " \
-                  "Hecks.hecksagon #{chapter_name.inspect} — put that sibling " \
-                  "(and any `translates` ACL) in context_map.hecksagon; " \
-                  "same-name blocks merge, order-independent."
-          end
-        end
-
-        # An explicit `bounded` mark on a consumer chapter always needs an ACL. `attaches`
-        # marks the attached chapter bounded and requires the sibling
-        # hecksagon above; they don't require a `translates` on it unless the consumer also
-        # wrote `bounded`.
-        # rust/host Google sign-in reads ir.json's membership/identity keys, never a deploy-time
-        # env var; Membership without Identity means provision cannot Register/Link an identity.
-        def refuse_membership_without_identity!
-          return unless @bluebooks.values.any? { |chapter| chapter.provides?(Bluebook::Capabilities::MEMBERSHIP) }
-          return if @bluebooks.values.any? { |chapter| chapter.provides?(Bluebook::Capabilities::IDENTITY) }
-
-          raise WiringError,
-                "a chapter that provides \"membership\" is loaded, but none provides " \
-                "\"identity\" — rust/host Google sign-in cannot register or link an " \
-                "identity from the hecksagon/world. Attach Identity (`attaches " \
-                "\"Identity\"` plus a sibling Hecks.hecksagon \"Identity\") so the " \
-                "identity verbs are exported onto ir.json, not guessed at deploy."
-        end
-
-        # A hecksagon attaches after its chapter builds, so this is the first point a
-        # declared `:port_operation` capability can be checked against it.
-        def refuse_unresolved_port_operations!
-          @bluebooks.each_value do |chapter|
-            chapter.provides.each do |row|
-              next unless Bluebook::Capabilities::CONTRACTS.dig(row.capability, row.key.to_sym) == :port_operation
-              next if port_operation_declared?(chapter, row.verb)
-
-              raise WiringError,
-                    "#{chapter.name} provides #{row.capability.inspect} #{row.key}: #{row.verb.inspect}, " \
-                    "but its hecksagon declares no such port operation — declare it with " \
-                    "`#{chapter.name}::Aggregate.port \"Port\" do operation \"Operation\" ... end`."
-            end
-          end
-        end
-
-        # A query has exactly one answer path. It is derivable when the bluebook says which of the
-        # aggregate's own records it wants (a where, order_by, limit or offset, or no arguments at
-        # all: the plain list) and returns no value object of its own; it is bound when it
-        # `returns` a value object and the hecksagon names the port whose adapter answers it. None
-        # of the two is "no answer path"; both is "two answer paths". A bound query also needs an
-        # adapter behind its port that implements it, found here so it fails at boot rather than
-        # on the first ask.
-        def refuse_unanswerable_queries!
-          @bluebooks.each_value do |chapter|
-            chapter.aggregates.each do |aggregate|
-              refuse_misbound_queries!(chapter, aggregate)
-
-              aggregate.queries.each { |query| refuse_answer_paths!(chapter, aggregate, query) }
-              aggregate.entities.each do |entity|
-                entity.queries.each { |query| refuse_entity_answer_path!(chapter, aggregate, entity, query) }
-              end
-            end
-          end
-        end
-
-        # Counts the query's answer paths (the bindings, plus the derived answer when it exists)
-        # and refuses any count but one, then checks a bound query's shape and adapter.
-        def refuse_answer_paths!(chapter, aggregate, query)
-          where  = "#{chapter.name}::#{aggregate.hecks_name}.#{query.hecks_name}"
-          ports  = aggregate.query_bindings(query.hecks_name)
-          paths  = ports.size + (derivable?(query) ? 1 : 0)
-
-          if paths > 1
-            raise WiringError, "#{where} has two answer paths: #{answer_path_names(query, ports)} — " \
-                               "a query is answered from records or from outside, not both"
-          end
-          return check_bound_query!(chapter, aggregate, query, ports.first) if ports.any?
-          return if paths == 1
-
-          raise WiringError, no_answer_path_message(chapter, aggregate, query, where)
-        end
-
-        # A query that returns nothing and says something about which records it wants, or wants
-        # all of them. One that takes arguments but filters, orders and bounds nothing reads none
-        # of them, so it derives no answer.
-        def derivable?(query)
-          return false if query.returns
-
-          filters_records?(query) || query.attributes.empty?
-        end
-
-        def answer_path_names(query, ports)
-          names = ports.map { |port| "the #{port.name} port" }
-          names.unshift("its records") if derivable?(query)
-          names.join(" and ")
-        end
-
-        def no_answer_path_message(chapter, aggregate, query, where)
-          if query.returns
-            "#{where} has no answer path: it returns #{query.returns}, which only an adapter can " \
-              "answer, and no hecksagon port binds it. Bind it: `#{chapter.name}::#{aggregate.hecks_name}" \
-              ".port \"Port\" do answers_query \"#{query.hecks_name}\" end`."
-          else
-            "#{where} has no answer path: it declares no where and returns nothing, and no hecksagon " \
-              "binds it — its arguments (#{query.attributes.map(&:name).join(', ')}) select nothing. " \
-              "Add a where, or declare what it returns and bind it in the hecksagon."
-          end
+        # One hecksagon's checks: its roles, attachments and ACL, every bind, and the durability
+        # warnings for its chapter.
+        def verify_hecksagon!(hecksagon)
+          refuse_ungoverned_roles!(hecksagon)
+          refuse_unwired_attachments!(hecksagon)
+          refuse_bounded_without_acl!(hecksagon)
+          hecksagon.binds.each { |bind| verify_bind!(hecksagon, bind) }
+          warn_undurable_sagas!(hecksagon)
+          warn_undurable_outbox!(hecksagon)
         end
 
-        # Checks what a binding needs to be answerable: a returned value object the aggregate
-        # declares, and one adapter behind the port that implements the query's method.
-        def check_bound_query!(chapter, aggregate, query, port)
-          where = "#{chapter.name}::#{aggregate.hecks_name}.#{query.hecks_name}"
-          unless query.returns
-            raise WiringError, "#{where} is bound to the #{port.name} port but returns nothing — " \
-                               "declare the value object its answer takes with `returns`"
-          end
-          if filters_records?(query)
-            raise WiringError, "#{where} has two answer paths: it is bound to the #{port.name} port but " \
-                               "also declares where, order_by or limit over stored records"
-          end
-          if query.authorization
-            raise WiringError, "#{where} is bound to the #{port.name} port but declares authorize — " \
-                               "an outside answer is never tenant-scoped or authorized, so drop the " \
-                               "authorize or answer the query from records"
-          end
-          unless Value.value_object_for(aggregate, query.returns_name)
-            raise WiringError, "#{where} returns #{query.returns_name}, but #{aggregate.hecks_name} " \
-                               "declares no such value object"
-          end
+        def verify_bind!(hecksagon, bind)
+          # A domain-level default (§0) names no aggregate of its own; still validate its
+          # adapter/verb shape. Real aggregates resolving through it are covered by their
+          # own dispatch-time `BindingPolicy.resolve`, not required to be exhaustive here.
+          return check_verb(bind) if bind.aggregate.nil?
 
-          klass = AdapterLookup.adapter_class(self, port.name, asked: where)
-          AdapterLookup.check_answers!(klass, port.name, Naming.snake(query.hecks_name), query, asked: where)
-        end
-
-        # An entity's query reads the elements of its aggregate's list, and nothing outside can
-        # be bound to one, so declaring a value object to return leaves it no answer.
-        def refuse_entity_answer_path!(chapter, aggregate, entity, query)
-          where = "#{chapter.name}::#{aggregate.hecks_name}.#{entity.hecks_name}.#{query.hecks_name}"
-          if query.returns
-            raise WiringError, "#{where} has no answer path: it returns #{query.returns}, but " \
-                               "only an aggregate's queries can be bound to a port"
-          end
-          return if derivable?(query)
-
-          raise WiringError, "#{where} has no answer path: it declares no where and returns nothing — its " \
-                             "arguments (#{query.attributes.map(&:name).join(', ')}) select nothing"
-        end
-
-        # Refuses a binding that names a query its aggregate does not declare, or names one twice
-        # on a single port (the DSL already refuses that, so this guards a hand-built port).
-        def refuse_misbound_queries!(chapter, aggregate)
-          aggregate.ports.each do |port|
-            names = port.answered_queries.map(&:name)
-            names.each do |name|
-              where = "#{chapter.name}::#{aggregate.hecks_name}.#{name}"
-              unless aggregate.query(name)
-                raise WiringError, "the #{port.name} port binds #{where}, which the aggregate does not declare"
-              end
-              raise WiringError, "#{where} has two answer paths: the #{port.name} port twice" if names.count(name) > 1
-            end
-          end
-        end
-
-        # A query that says anything about which stored records it wants.
-        def filters_records?(query)
-          !(query.wheres.empty? && query.order_by.nil? && query.limit.nil? && query.offset.nil?)
-        end
-
-        def port_operation_declared?(chapter, verb)
-          aggregate_name, port_name, operation_name = verb.split(".", 3)
-          ports = chapter.aggregate(aggregate_name)&.ports || []
-          ports.any? { |port| port.name == port_name && port.operations.any? { |op| op.hecks_name == operation_name } }
-        end
-
-        def refuse_bounded_without_acl!(hexagon)
-          return unless hexagon.bounded?
-          return if hexagon.translates.any?
-
-          raise WiringError,
-                "#{hexagon.domain} is marked bounded but never declared a " \
-                "translates ACL — a bounded chapter wraps in its own module and " \
-                "cross-context field mapping lives on the hecksagon, not in " \
-                "rust/host and not as a field list on the bluebook. " \
-                "Add `translates \"Name\" do on Foreign::Event; trigger Local::Command, " \
-                "with: { ... } end` (any field) or drop `bounded`."
-        end
-
-        # Derived from whichever framework members actually declare `provides
-        # "authorization"` — never a hardcoded name.
-        def authorization_attachment_hint
-          providers = Framework.providers_of(Bluebook::Capabilities::AUTHORIZATION)
-          return "attaches a chapter that provides \"authorization\" (no framework member declares one)" if providers.empty?
-
-          providers.map { |name| "attaches #{name.inspect}" }.join(" or ")
-        end
-
-        # Every command this domain declares, an aggregate's own and every entity nested
-        # inside one — the same reach dispatch-time role checking needs.
-        def commands_in(bluebook_ir)
-          bluebook_ir.aggregates.flat_map { |aggregate| aggregate.commands + aggregate.entities.flat_map(&:commands) }
-        end
-
-        # Refuses a chapter whose name is reserved unless every file that declared it sits under
-        # the gem's own chapter directory. A rename is the only fix, so the message says so.
-        #
-        # @raise [WiringError] naming the reserved word and the offending file(s)
-        def refuse_reserved_chapter_names!
-          RESERVED_CHAPTER_NAMES.each do |reserved|
-            next unless @bluebooks.key?(reserved)
-
-            sources = Array(@bluebook_sources[reserved]).compact
-            foreign = sources.reject { |path| gem_chapter_source?(path) }
-            next if foreign.empty? && !sources.empty?
-
-            where = foreign.empty? ? "" : " (declared in #{foreign.join(', ')})"
-            raise WiringError,
-                  "a chapter named #{reserved.inspect} is refused: #{reserved.inspect} is a reserved " \
-                  "word, the name of the gem's own chapter, and only the gem may declare it#{where}. " \
-                  "Rename the chapter (for example to your app's name) in its " \
-                  "`Hecks.bluebook #{reserved.inspect}` line and in its hecksagon."
-          end
-        end
-
-        # Whether `path` is a file of the gem's own chapter directory.
-        def gem_chapter_source?(path)
-          File.expand_path(path.to_s).start_with?("#{GEM_CHAPTER_DIR}/")
-        end
-
-        # Two packages can share a chapter name by coincidence (a stale vendored
-        # fork of Governance/Identity/Deploy still on an app's load paths).
-        # Intentional accumulation (several files declaring the same chapter on
-        # purpose) is distinguished by package root, not file identity, and is left
-        # untouched here — checked once, after every file has loaded.
-        def refuse_cross_package_bluebook_merge!
-          @bluebook_sources.each do |name, paths|
-            roots = paths.map { |path| package_root_for(path) }.uniq
-            next if roots.size <= 1
-
-            raise WiringError,
-                  "#{name.inspect} is declared by more than one package: #{roots.join(' and ')} — " \
-                  "these are two unrelated sources sharing a chapter name by coincidence, not one " \
-                  "domain split across files, and merging their declarations into one chapter is " \
-                  "almost certainly a stale/vendored copy left on the load path (paths: " \
-                  "#{paths.join(', ')})"
-          end
-        end
-
-        # The nearest boundary a path belongs to: a real gemspec, or a bare `vendor/`
-        # component (vendored code is never "the same package" as what vendors it).
-        # Falls back to the path's own directory when neither is found.
-        def package_root_for(path)
-          return path.to_s if path.nil?
-
-          dir = File.dirname(File.expand_path(path))
-          loop do
-            return "vendor:#{dir}" if File.basename(dir) == "vendor"
-            return dir if Dir.glob(File.join(dir, "*.gemspec")).any?
-
-            parent = File.dirname(dir)
-            return dir if parent == dir
-
-            dir = parent
-          end
-        end
-
-        # A domain with policies/a process_manager but no outbox on its bound adapter
-        # (`AppendOnly#outbox?`) runs reactions inline — lost on a crash between a
-        # commit and its reaction. A warning, not a refusal: Memory has an in-process
-        # outbox, so dev/test stays quiet, but file/remote adapters need this to be loud.
-        def warn_undurable_outbox!(hexagon)
-          bluebook_ir = bluebook(hexagon.domain)
-          return unless bluebook_ir
-          return if bluebook_ir.process_managers.empty? && !any_policy_listens_to?(bluebook_ir)
-
-          anchor = bluebook_ir.aggregates.first or return
-          bind = Ports::Persistence::BindingPolicy.resolve(self, hexagon.domain, anchor)
-          return if adapter_class(bind.adapter) <= Ports::Persistence::RemoteRuntime
-          return if repository(hexagon.domain, anchor).outbox?
-
-          warn "[hecks] #{hexagon.domain} declares policies/process_managers but its persistence adapter " \
-               "(#{bind.adapter}) has no outbox — reactions run inline and a crash between a command's commit " \
-               "and its reactions loses them silently. Bind SqlitePersistence or Postgres for a durable outbox " \
-               "(see Runtime::Outbox), or accept in-process-only reactions on purpose."
-        rescue WiringError
-          nil
-        end
-
-        def any_policy_listens_to?(bluebook_ir)
-          emitted = bluebook_ir.aggregates.flat_map do |aggregate|
-            aggregate.commands.flat_map(&:emits) +
-              aggregate.ports.flat_map { |port| port.operations.flat_map { |op| [*op.emits, op.answers, op.refuses] } }
-          end.compact.map(&:to_s)
-          @bluebooks.each_value.any? { |candidate| candidate.policies.any? { |policy| emitted.include?(policy.event_name.to_s) } }
-        end
+          aggregate = bluebook(hecksagon.domain)&.aggregate(bind.aggregate_name)
+          raise WiringError, "#{bind.aggregate} is bound but not declared in the bluebook" unless aggregate
 
-        # A warning, not a refusal: running sagas on a store with no `save_saga` is
-        # legitimate on purpose in a fast in-memory test/dev boot.
-        def warn_undurable_sagas!(hexagon)
-          bluebook_ir = bluebook(hexagon.domain)
-          return unless bluebook_ir
-          return if bluebook_ir.process_managers.empty?
-          return unless saga_persistence(hexagon.domain).equal?(Ports::Persistence::NULL_SAGA_STORE)
+          check_verb(bind)
 
-          names = bluebook_ir.process_managers.map(&:name).join(", ")
-          warn "[hecks] #{hexagon.domain} declares process_manager(s) #{names} but its resolved " \
-               "persistence adapter has no save_saga — saga state advances correctly in-process " \
-               "and is LOST on restart (no checkpoint, no rehydration, no compensation replay). " \
-               "Bind this domain to an adapter that implements save_saga if this process_manager " \
-               "must survive a crash."
+          repository(hecksagon.domain, aggregate)
         end
       end
     end

data/lib/hecks/runtime/registry/world_defaults.rb

@@ -19,7 +19,7 @@ module Hecks
         def default_database_for(domain) = world_default(domain, :default_database)
 
         def verify_world_defaults!
-          @worlds.each_value do |declared|
+          @declared.worlds.each_value do |declared|
             name = declared.default_adapter
             next unless name
 
@@ -37,10 +37,10 @@ module Hecks
 
         # The world of the first chapter this registry loaded — the target of a boot, ahead of
         # any framework member it attaches.
-        def project_world = world(@bluebooks.keys.first || @worlds.keys.first)
+        def project_world = world(@declared.bluebooks.keys.first || @declared.worlds.keys.first)
 
         def default_database_applies?(verb, adapter)
-          verb.to_s == Ports::Persistence::VERB && @adapters[adapter.to_s]&.declares?(:database)
+          verb.to_s == Ports::Persistence::VERB && @declared.adapters[adapter.to_s]&.declares?(:database)
         end
 
         def verify_default_adapter_named!(domain, name)