hecks 3.9.1 → 3.11.0

data/lib/hecks/runtime/command_interpreter/mutation_applier.rb

@@ -46,8 +46,8 @@ module Hecks
         end
 
         def apply_set(instance, aggregate, mutation, args, pre)
-          from_state = mutation.source.is_a?(StateRef)
-          value = from_state ? pre[mutation.source.name] : @rules.resolve_source(mutation.source, args)
+          from_state = mutation.source.is_a?(StateRef) || mutation.source.is_a?(Computed)
+          value = set_source_value(mutation.source, args, pre)
           # A plain `sets` of a list takes the whole list; only `append:` and `remove:` take
           # one element.
           list_attribute = aggregate.attribute(mutation.target)
@@ -55,6 +55,16 @@ module Hecks
           instance[mutation.target] = Value.for(aggregate, mutation.target, value)
         end
 
+        # A `state(:field)` reads the pre-dispatch record; an expression is evaluated over the
+        # command's arguments, then that record; anything else resolves as an argument or literal.
+        def set_source_value(source, args, pre)
+          case source
+          when StateRef then pre[source.name]
+          when Computed then Bluebook::Expression::Resolver.resolve(source.text, pre, args)
+          else @rules.resolve_source(source, args)
+          end
+        end
+
         def apply_append(instance, aggregate, mutation, args, pre)
           instance[mutation.target] = appended(pre, aggregate, mutation, args)
         end

data/lib/hecks/runtime/command_interpreter.rb

@@ -65,7 +65,7 @@ module Hecks
       # @return [Array] the settled instance, events, plan, persistence outcome, and outbox rows
       # @raise [StandardError] a domain refusal (Runtime::DOMAIN_REFUSALS) when a rule refuses
       # @raise [Runtime::StaleWrite, Runtime::WiringError] every retry loses, or resolve fails
-      # rubocop:disable-next Metrics/ParameterLists -- the public dispatch signature every door calls
+      # rubocop:disable-next Metrics/ParameterLists -- the public dispatch signature every entry point calls
       def call(domain, aggregate, command, invocation, correlation = nil, dry_run: false)
         args     = invocation.to_args
         settings = { invocation: invocation, route: invocation.target, correlation: correlation, dry_run: dry_run }
@@ -181,7 +181,8 @@ module Hecks
 
       # `ctx.pending_delegation` is only ever set by `step_delegate_to_entity`, and only when this
       # command carries a `:delegate` mutation. The same dispatch, so the same correlation —
-      # without threading `ctx.correlation` through, a saga-driven door's events would lose their
+      # without threading `ctx.correlation` through, a saga-driven entry point's events would lose
+      # their
       # stamp here.
       def emit_events(ctx)
         command, args = ctx.pending_delegation || [ctx.command, ctx.args]

data/lib/hecks/runtime/command_rules/emission.rb

@@ -20,7 +20,7 @@ module Hecks
           stamp = { aggregate: "#{domain}::#{aggregate.hecks_name}", id: instance.id,
                     payload: args, correlation: correlation }
           command.emits.map do |event_name|
-            record_emitted(Event.new(name: event_name, occurred_at: Time.now.utc.iso8601, **stamp), repository)
+            record_emitted(Event.new(name: event_name, occurred_at: Event.stamp, **stamp), repository)
           end
         end
 

data/lib/hecks/runtime/dispatcher.rb

@@ -37,8 +37,8 @@ module Hecks
         @entities = EntityInterpreter.new(registry, rules: rules)
         @queries  = QueryInterpreter.new(registry)
         @read_models = ReadModelInterpreter.new(registry)
-        @policies = PolicyInterpreter.new(registry, door: self)
-        @sagas    = SagaInterpreter.new(registry, door: self)
+        @policies = PolicyInterpreter.new(registry, dispatcher: self)
+        @sagas    = SagaInterpreter.new(registry, dispatcher: self)
         # One relay per registry: interpreters enqueue through it inside the save transaction.
         @registry.outbox.attach(policies: @policies, sagas: @sagas)
       end
@@ -141,7 +141,7 @@ module Hecks
 
       # Runs one port operation named by its parts, then the reactions its events owe.
       #
-      # The door for an adapter outside the bluebook; no wire spelling packs a port verb.
+      # The dispatcher for an adapter outside the bluebook; no wire spelling packs a port verb.
       #
       # @param to [String, Hash, nil] the receiver; when nil it is read from the facts
       # @param with [Hash, nil] the operation's facts, keyed by argument name
@@ -150,7 +150,7 @@ module Hecks
       # @raise [Runtime::UnknownVerb] if the domain, aggregate, port or operation is undeclared
       # @raise [Runtime::TypeMismatch] if no receiving identity is found, or `to:`/`with:` is bad
       # @raise [Runtime::NotFound] if the receiving record does not exist
-      # rubocop:disable-next Metrics/ParameterLists -- the public door's parts, one argument per verb segment
+      # rubocop:disable-next Metrics/ParameterLists -- the public dispatcher's parts, one argument per verb segment
       def dispatch_port(domain, aggregate_name, port_name, operation_name, to: nil, with: nil, flat: {})
         verb = "#{domain}::#{aggregate_name}.#{port_name}.#{operation_name}"
         aggregate = resolve_aggregate(domain, aggregate_name, verb)

data/lib/hecks/runtime/entity_element/location.rb

@@ -17,7 +17,7 @@ module Hecks
         # Walks `chain` one hop at a time and returns the located element (or `instance`
         # itself when `chain` is empty). `route`, when given, offers each hop's identity
         # before falling back to `args`.
-        # rubocop:disable-next Metrics/ParameterLists -- the positional door EntityInterpreter and delegation call
+        # rubocop:disable-next Metrics/ParameterLists -- the positional entry point EntityInterpreter and delegation call
         def locate_chain(root_aggregate, chain, instance, args, command_name, route = nil)
           container = instance
           owner     = root_aggregate

data/lib/hecks/runtime/event.rb

@@ -5,6 +5,11 @@ module Hecks
     # An emitted domain event. `correlation` (saga head -> value) is runtime bookkeeping
     # and deliberately absent from `to_h`.
     Event = Struct.new(:name, :aggregate, :id, :payload, :occurred_at, :correlation, keyword_init: true) do
+      # The one place the runtime reads the wall clock, so every event is stamped the same way.
+      #
+      # @return [String] the current UTC time as ISO 8601
+      def self.stamp = Time.now.utc.iso8601
+
       # Freezes the event deep, payload and correlation included.
       #
       # @return [void]

data/lib/hecks/runtime/identity.rb

@@ -1,4 +1,5 @@
 require_relative "../naming"
+require_relative "best_effort"
 require_relative "value"
 
 module Hecks
@@ -82,12 +83,12 @@ module Hecks
       # Resolves a best-effort identity for `construct` to use as a lock key; never raises.
       # Returns nil when nothing resolves, and the caller then locks by aggregate type alone.
       def best_effort(construct, args, route = nil, reference_key: nil)
-        route&.aggregate ||
-          of(construct, args) ||
-          from(construct, args, :id) ||
-          (reference_key && from(construct, args, reference_key))
-      rescue StandardError
-        nil
+        BestEffort.call(nil) do
+          route&.aggregate ||
+            of(construct, args) ||
+            from(construct, args, :id) ||
+            (reference_key && from(construct, args, reference_key))
+        end
       end
     end
   end

data/lib/hecks/runtime/interpreting.rb

@@ -32,7 +32,8 @@ module Hecks
 
       # Gives each argument the caller left out the default its attribute declares
       # (`attribute :runs, Count, default: 30`), so a declared default holds on every way in and
-      # not only where a door spells it out. An argument the caller passed is kept, whatever it is.
+      # not only where an entry point spells it out. An argument the caller passed is kept, whatever
+      # it is.
       #
       # @param command [Class] the command being dispatched
       # @param args [Hash{Symbol => Object}] the arguments the caller passed

data/lib/hecks/runtime/invocation_builder.rb

@@ -18,7 +18,7 @@ module Hecks
       # :entity, :port). Each checks its own parts in a fixed order, because
       # a malformed call's refusal depends on that order; `declaring` is
       # called exactly once, at that shape's point in the order below.
-      # rubocop:disable-next Metrics/ParameterLists -- the public keyword door every dispatch calls
+      # rubocop:disable-next Metrics/ParameterLists -- the public keyword entry point every dispatch calls
       def from_call(verb, to:, with:, flat:, receiver: :aggregate, entity_depth: 0, aggregate: nil, &declaring)
         call = Call.new(verb, to, with, flat, entity_depth, aggregate, declaring)
         case receiver

data/lib/hecks/runtime/loader/boot_steps.rb

@@ -15,20 +15,23 @@ module Hecks
         # the domain never attached Privacy at all.
         def seed_privacy_markings!(dispatcher, registry)
           return if registry.pending_privacy_markings.empty?
-          return unless registry.bluebook("Privacy")
 
-          already_marked = already_marked_by_domain(dispatcher, registry)
+          provider = registry.provider_of(Bluebook::Capabilities::PRIVACY)
+          return unless provider
+
+          already_marked = already_marked_by_domain(dispatcher, registry, provider)
           registry.pending_privacy_markings.each do |marking|
             next if already_marked[marking[:domain]].include?(marking[:attribute_path])
 
-            dispatcher.dispatch_flat("Privacy::Marking.Mark", marking)
+            dispatcher.dispatch_flat(provider.provided_verb(Bluebook::Capabilities::PRIVACY, :mark_sensitive), marking)
           end
         end
 
         # Each domain with a pending marking, with the attribute paths Privacy already marks for it.
-        def already_marked_by_domain(dispatcher, registry)
+        def already_marked_by_domain(dispatcher, registry, provider)
+          verb = provider.provided_verb(Bluebook::Capabilities::PRIVACY, :markings_for)
           registry.pending_privacy_markings.map { |marking| marking[:domain] }.uniq.to_h do |domain|
-            [domain, dispatcher.query("Privacy::Marking.ForDomain", domain: domain).map { |row| row[:attribute_path][:value] }]
+            [domain, dispatcher.query(verb, domain: domain).map { |row| row[:attribute_path][:value] }]
           end
         end
 

data/lib/hecks/runtime/loader.rb

@@ -1,4 +1,4 @@
-require_relative "../doors/ruby_door"
+require_relative "../adapters/driving/ruby"
 require_relative "../ports/loading"
 require_relative "../ports/persistence"
 require_relative "dispatcher"
@@ -21,7 +21,7 @@ module Hecks
 
       # Boots `path`: loads its bluebook directory into a fresh Registry, runs
       # every registered boot gate, and returns the bound dispatcher. Pass
-      # `install_doors: false` to skip the `Widget::Item.Add(...)` global
+      # `install_driving: false` to skip the `Widget::Item.Add(...)` global
       # facade sugar (only a caller dispatching by FQN string needs to).
       #
       # @param path [String] a domain directory to boot
@@ -31,25 +31,25 @@ module Hecks
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the booted dispatcher
       # @raise [Errno::ENOENT] if `path` names no domain directory
       # @raise [Runtime::WiringError] if a boot gate finds a wiring problem
-      def self.boot(path, shared: nil, install_doors: true, environment: FROM_ENV)
+      def self.boot(path, shared: nil, install_driving: true, environment: FROM_ENV)
         described = describe(path, shared: shared, environment: environment)
-        boot_described(described, install_doors: install_doors)
+        boot_described(described, install_driving: install_driving)
       end
 
       # Finishes a boot from declarations `describe` already loaded: runs every boot gate and binds
       # the dispatcher, without reading the domain's files again.
       #
       # @param described [Described] what `describe` answered for the domain to boot
-      # @param install_doors [Boolean] install the `Widget::Item.Add(...)` global facade sugar
+      # @param install_driving [Boolean] install the `Widget::Item.Add(...)` global facade sugar
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the booted dispatcher
       # @raise [Runtime::WiringError] if a boot gate finds a wiring problem
-      def self.boot_described(described, install_doors: true)
+      def self.boot_described(described, install_driving: true)
         registry = described.registry
         run_boot_gates!(registry, described.directory)
         dispatcher = dispatcher_for(registry)
         redrive_outbox!(dispatcher)
         seed_privacy_markings!(dispatcher, registry)
-        install_doors ? bind_runtime(dispatcher) : dispatcher
+        install_driving ? bind_runtime(dispatcher) : dispatcher
       end
 
       # Loads `path`'s declarations into a fresh Registry and stops: no boot gate runs, no
@@ -118,7 +118,7 @@ module Hecks
       #   defaults to `HECKS_ENVIRONMENT`, and an explicit nil loads none
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the booted dispatcher
       # @raise [Runtime::WiringError] if a boot gate finds a wiring problem
-      def self.boot_files(paths, shared: nil, install_doors: true, environment: FROM_ENV)
+      def self.boot_files(paths, shared: nil, install_driving: true, environment: FROM_ENV)
         loading   = Ports::Loading.bootstrap
         files     = Array(paths).map { |path| File.expand_path(path) }
         directory = File.dirname(files.first)
@@ -126,7 +126,7 @@ module Hecks
 
         run_boot_gates!(registry, directory)
         dispatcher = dispatcher_for(registry)
-        install_doors ? bind_runtime(dispatcher) : dispatcher
+        install_driving ? bind_runtime(dispatcher) : dispatcher
       end
 
       # Loads exactly `files` into a fresh Registry rooted beside their directory, answering it.
@@ -160,7 +160,7 @@ module Hecks
       # `dispatcher`. The binding lives in the facade's own modules, not a
       # class-level global, so two boots in one process don't share one name.
       def self.bind_runtime(dispatcher)
-        Doors::RubyDoor.install(dispatcher)
+        Adapters::Driving::Ruby.install(dispatcher)
         dispatcher
       end
     end

data/lib/hecks/runtime/policy_interpreter/arguments.rb

@@ -4,7 +4,7 @@ module Hecks
   module Runtime
     class PolicyInterpreter
       # What a policy's trigger is given: the event payload or its `with:` projection, the
-      # emitting record's identity, and the invocation the door re-enters with. Mixed into
+      # emitting record's identity, and the invocation the entry point re-enters with. Mixed into
       # {PolicyInterpreter}.
       module Arguments
         private
@@ -12,12 +12,15 @@ module Hecks
         # What the trigger is given: the whole event payload verbatim when no `with:` is
         # declared, otherwise the projection (a Symbol names a payload field, anything else
         # is a literal). `extra` is a fan-out's row key, merged into the source before the
-        # projection so a `with:` can name the row it acts on.
-        def trigger_args(policy, event, extra = {})
+        # projection so a `with:` can name the row it acts on. `row` is the fan-out row itself:
+        # its fields are offered to a projection only, below the emitter identity and the
+        # payload, and never reach an unprojected payload.
+        def trigger_args(policy, event, extra = {}, row = {})
           payload = event.payload.transform_keys(&:to_sym).merge(extra)
           return payload unless ReactionInvocation.projection_declared?(policy)
 
-          projected_args(policy, event, emitter_identity(event).merge(payload))
+          source = row.transform_keys(&:to_sym).merge(emitter_identity(event)).merge(payload)
+          projected_args(policy, event, source)
         end
 
         def projected_args(policy, event, payload)

data/lib/hecks/runtime/policy_interpreter/fan_out.rb

@@ -20,7 +20,7 @@ module Hecks
 
           rows, reference_key = for_each_rows(policy, event, domain, target)
           Array(rows).map do |row|
-            args = trigger_args(policy, event, reference_key => row[:id])
+            args = trigger_args(policy, event, { reference_key => row[:id] }, row)
             deliver_for_each_row(target, record.merge(for_row: row[:id]), args, policy, event)
           end
         rescue *DOMAIN_REFUSALS => e
@@ -74,10 +74,10 @@ module Hecks
         end
 
         def deliver_for_each_row(target, row_record, args, policy, event)
-          return depth_refusal(row_record) if @door.reaction_depth_reached?
+          return depth_refusal(row_record) if @dispatcher.reaction_depth_reached?
 
           # The row key is already merged by `trigger_args`, so a projection can name it.
-          @door.reenter(target, **reaction_invocation(target, args, policy, event))
+          @dispatcher.reenter(target, **reaction_invocation(target, args, policy, event))
           row_record.merge(delivered: true)
         rescue *DOMAIN_REFUSALS => e
           row_record.merge(delivered: false, reason: e.message)

data/lib/hecks/runtime/policy_interpreter.rb

@@ -20,11 +20,11 @@ module Hecks
 
       # @param registry [Runtime::Registry] the booted registry whose loaded
       #   bluebooks are scanned for candidate policies
-      # @param door [Runtime::Dispatcher] the dispatcher reactions re-enter through,
+      # @param dispatcher [Runtime::Dispatcher] the dispatcher reactions re-enter through,
       #   and whose reaction-depth guard is checked before each delivery
-      def initialize(registry, door:)
+      def initialize(registry, dispatcher:)
         @registry = registry
-        @door     = door
+        @dispatcher = dispatcher
       end
 
       # Fires every declared policy `event` triggers, recording each outcome on
@@ -96,15 +96,15 @@ module Hecks
       # may go.
       def fire(policy, event, target, record)
         return nil unless where_holds?(policy, event)
-        return depth_refusal(record) if @door.reaction_depth_reached?
+        return depth_refusal(record) if @dispatcher.reaction_depth_reached?
 
         args = trigger_args(policy, event)
-        @door.reenter(target, **reaction_invocation(target, args, policy, event))
+        @dispatcher.reenter(target, **reaction_invocation(target, args, policy, event))
         record.merge(delivered: true)
       end
 
       def depth_refusal(record)
-        record.merge(delivered: false, reason: "reaction depth #{@door.max_reaction_depth} reached")
+        record.merge(delivered: false, reason: "reaction depth #{@dispatcher.max_reaction_depth} reached")
       end
 
       # A defect, not a refusal: recorded with `defect: true` and warned, never

data/lib/hecks/runtime/port_operation_interpreter.rb

@@ -157,7 +157,7 @@ module Hecks
           aggregate:   "#{ctx.domain}::#{ctx.aggregate.hecks_name}",
           id:          ctx.route.aggregate,
           payload:     payload,
-          occurred_at: Time.now.utc.iso8601
+          occurred_at: Event.stamp
         )
       end
     end

data/lib/hecks/runtime/reaction_invocation.rb

@@ -90,7 +90,7 @@ module Hecks
       # @raise [Runtime::UnknownVerb] if `verb` does not resolve (only when `explicit`)
       # @raise [Runtime::TypeMismatch] if no receiver identity resolves for an explicit target
       # @raise [Runtime::UnknownArgument] if an explicit projection has an undeclared fact
-      # rubocop:disable-next Metrics/ParameterLists -- the keyword door both interpreters call
+      # rubocop:disable-next Metrics/ParameterLists -- the keyword entry point both interpreters call
       def build(registry:, verb:, projected:, explicit:, passthrough: [], source_receiver: nil)
         args = projected.transform_keys(&:to_sym)
         return forwarded(registry, verb, args, source_receiver) unless explicit

data/lib/hecks/runtime/rebuild_sweep.rb

@@ -49,7 +49,17 @@ module Hecks
         return nil if id.nil?
 
         remote = registry.repository(domain, target).find(id.to_s)
-        remote&.[](field.remote_field)
+        unwrap_single_field(target, field, remote&.[](field.remote_field))
+      end
+
+      # A remote field typed by a single-field value object is copied as its one scalar, so the
+      # projecting aggregate holds `123`, never `{ value: 123 }`. Any other value is copied as is.
+      def unwrap_single_field(target, field, value)
+        attribute = target.attribute(field.remote_field)
+        sole = attribute && target.value_object(attribute.type)&.sole_attribute
+        return value unless sole && !value.nil?
+
+        value.is_a?(Hash) ? value.fetch(sole.name) { value[sole.name.to_s] } : value[sole.name]
       end
     end
   end

data/lib/hecks/runtime/registry/ask_verification.rb

@@ -0,0 +1,35 @@
+require_relative "../../bluebook/ask_resolution"
+
+module Hecks
+  module Runtime
+    class Registry
+      # The boot gate for `ask`: every policy's ask must resolve to one declared port operation,
+      # so a name the hecksagon never declared stops the boot instead of firing at nothing.
+      # Mixed into {Verification}.
+      module AskVerification
+        private
+
+        # A port operation a chapter provides, and an ask a policy makes, each name a port
+        # operation the hecksagon declared.
+        def refuse_unresolved_ports!
+          refuse_unresolved_port_operations!
+          refuse_unresolved_asks!
+        end
+
+        # Binds each ask to the operation it resolves to, refusing the first that resolves to none.
+        #
+        # @raise [WiringError] naming the policy, the ask and what the hecksagon would need
+        def refuse_unresolved_asks!
+          @declared.bluebooks.each_value do |chapter|
+            chapter.policies.select(&:asks?).each do |policy|
+              outcome = Bluebook::AskResolution.call(chapter, policy)
+              raise WiringError, outcome.detail unless outcome.resolved?
+
+              policy.resolve_ask!(outcome.verb)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/runtime/registry/hecksagon_rules.rb

@@ -27,6 +27,16 @@ module Hecks
                 "without that it is silent decoration, the exact defect this refusal exists to catch"
         end
 
+        # `driven_by` names a driving adapter; a name none answers to would silently admit nothing.
+        def refuse_unknown_driving!(hecksagon)
+          unknown = hecksagon.driving - Bluebook::Hecksagon::DRIVING_ADAPTERS
+          return if unknown.empty?
+
+          raise WiringError,
+                "#{hecksagon.domain} is driven_by #{unknown.map(&:inspect).join(", ")}, which no driving " \
+                "adapter answers to — the adapters are #{Bluebook::Hecksagon::DRIVING_ADAPTERS.join(", ")}"
+        end
+
         # `attaches` loads a bounded context; the consumer must declare the sibling hecksagon
         # that is its ACL (Governance/Identity/Privacy already do). A vendored package only
         # loads its `.bluebook` files, so persistence, Governance and the `translates` ACL live

data/lib/hecks/runtime/registry/merging.rb

@@ -17,7 +17,7 @@ module Hecks
         def merge_hecksagons(base, overlay)
           # Order-independent: list facts uniq, so loading context_map before or after the
           # domain file yields the same merged hecksagon.
-          lists = %i[subscriptions attachments translates].to_h do |facet|
+          lists = %i[subscriptions attachments translates driving].to_h do |facet|
             [facet, (base.public_send(facet) + overlay.public_send(facet)).uniq]
           end
           Bluebook::Hecksagon.new(domain: base.domain, binds: base.binds + overlay.binds,

data/lib/hecks/runtime/registry/providers.rb

@@ -101,6 +101,16 @@ module Hecks
           vendored_provider_for(domain, Bluebook::Capabilities::PAYMENT_CONNECTION)
         end
 
+        # The chapter that owns the checkout boundary for `domain` — resolved by what it
+        # declares (`provides "checkout"`). Nil when none does.
+        #
+        # @param domain [String, Symbol] the domain whose checkout chapter is being resolved
+        # @return [Bluebook::Chapter, nil] the chapter that owns `domain`'s checkout windows,
+        #   or nil if none does
+        def checkout_provider_for(domain)
+          vendored_provider_for(domain, Bluebook::Capabilities::CHECKOUT)
+        end
+
         # The chapter that takes payments for `domain`: the domain's own chapter, a
         # framework member, or a vendored embryonaut bluebook it attaches, that
         # declares `provides "payments"`.
@@ -112,6 +122,12 @@ module Hecks
           vendored_provider_for(domain, Bluebook::Capabilities::PAYMENTS)
         end
 
+        # The first loaded chapter that declares `capability`, whichever domain asks.
+        #
+        # @param capability [String] a `Bluebook::Capabilities` name
+        # @return [Bluebook::Chapter, nil] the providing chapter, or nil if none loaded does
+        def provider_of(capability) = bluebooks.values.find { |chapter| chapter.provides?(capability) }
+
         # The chapter that provides `capability` for `domain`: the domain's own chapter,
         # a framework member its hecksagon attaches, or a vendored embryonaut bluebook
         # it attaches, that declares it.

data/lib/hecks/runtime/registry/read_repository.rb

@@ -1,3 +1,5 @@
+require_relative "../best_effort"
+
 module Hecks
   module Runtime
     class Registry
@@ -37,10 +39,10 @@ module Hecks
         #   `authoritative`, in the same order; false on any mismatch, or if comparing
         #   them raises
         def projection_current?(projection, authoritative)
-          entries_match?(projection.entries, authoritative.entries) &&
-            sorted_rows(projection) == sorted_rows(authoritative)
-        rescue StandardError
-          false
+          BestEffort.call(false) do
+            entries_match?(projection.entries, authoritative.entries) &&
+              sorted_rows(projection) == sorted_rows(authoritative)
+          end
         end
 
         private

data/lib/hecks/runtime/registry/verification.rb

@@ -1,5 +1,6 @@
 require_relative "../../bluebook/hecksagon"
 require_relative "hecksagon_rules"
+require_relative "ask_verification"
 require_relative "query_verification"
 require_relative "chapter_verification"
 require_relative "durability_warnings"
@@ -11,6 +12,7 @@ module Hecks
       # port's verb, and every world default is usable. `verify!` runs it all at boot.
       module Verification
         include HecksagonRules
+        include AskVerification
         include QueryVerification
         include ChapterVerification
         include DurabilityWarnings
@@ -24,7 +26,7 @@ module Hecks
           refuse_cross_package_bluebook_merge!
           refuse_reserved_chapter_names!
           refuse_membership_without_identity!
-          refuse_unresolved_port_operations!
+          refuse_unresolved_ports!
           refuse_unanswerable_queries!
 
           @declared.hecksagons.each_value { |hecksagon| verify_hecksagon!(hecksagon) }
@@ -126,6 +128,7 @@ module Hecks
         # warnings for its chapter.
         def verify_hecksagon!(hecksagon)
           refuse_ungoverned_roles!(hecksagon)
+          refuse_unknown_driving!(hecksagon)
           refuse_unwired_attachments!(hecksagon)
           refuse_bounded_without_acl!(hecksagon)
           hecksagon.binds.each { |bind| verify_bind!(hecksagon, bind) }

data/lib/hecks/runtime/registry/world_defaults.rb

@@ -28,8 +28,37 @@ module Hecks
           self
         end
 
+        # The defaults an adapter's `.adapter` declares for its fields, with each `{name}` or
+        # `{storage_name}` in a string filled from `aggregate`. A world's own setting always wins.
+        #
+        # @param adapter [String, Symbol] the adapter's name
+        # @param aggregate [Bluebook::Aggregate] the aggregate the adapter is built for
+        # @return [Hash{Symbol => Object}] the defaults, empty when the adapter declares none
+        def adapter_defaults(adapter, aggregate)
+          declared = @declared.adapters[adapter.to_s]&.declared_defaults || {}
+          declared.transform_values { |value| fill_placeholders(value, aggregate) }
+        end
+
+        # `settings` laid over the adapter's declared defaults. A field a world gives as `:default`
+        # asks for the declared default, so it is left out and the default shows through.
+        #
+        # @param adapter [String, Symbol] the adapter's name
+        # @param aggregate [Bluebook::Aggregate] the aggregate the adapter is built for
+        # @param settings [Hash{Symbol => Object}] the settings the world gave
+        # @return [Hash{Symbol => Object}] the defaults, overridden by the settings given
+        def with_adapter_defaults(adapter, aggregate, settings)
+          adapter_defaults(adapter, aggregate).merge(settings.reject { |_, value| value == :default })
+        end
+
         private
 
+        # A string default with its placeholders filled from the aggregate; any other value as is.
+        def fill_placeholders(value, aggregate)
+          return value unless value.is_a?(String)
+
+          value.gsub(/\{(name|storage_name)\}/) { aggregate.public_send(Regexp.last_match(1)) }
+        end
+
         # The chapter's own world answers first; the project's world fills the gap.
         def world_default(domain, field)
           world(domain)&.public_send(field) || project_world&.public_send(field)

data/lib/hecks/runtime/registry.rb

@@ -45,7 +45,7 @@ module Hecks
       #   against; nil for a registry with no such root
       def initialize(root: nil)
         @root         = root
-        # Recorded at hecksagon-build time (AggregateDoor#mark_sensitive), Loader.boot's
+        # Recorded at hecksagon-build time (AggregateModule#mark_sensitive), Loader.boot's
         # post-dispatch step turns each pending privacy marking into a real Privacy::Marking.Mark,
         # idempotently. `resolved_eras` and `superseded_eras` are eager, not lazy, so no two
         # dispatching threads race to create them; all writes still happen at boot,

data/lib/hecks/runtime/saga_interpreter/compensation.rb

@@ -7,7 +7,7 @@ module Hecks
       module Compensation
         private
 
-        # Recorded before dispatching, not after `@door.reenter` returns —
+        # Recorded before dispatching, not after `@dispatcher.reenter` returns —
         # reenter can recursively re-enter this interpreter and refuse
         # before ever returning here, and recording only on success would
         # be too late for that nested refusal to see this leg's own

data/lib/hecks/runtime/saga_interpreter/delivery.rb

@@ -24,7 +24,7 @@ module Hecks
           record = { process_manager: process_manager.name, instance: correlation, dispatch: spec.command_name }
 
           log_dispatch_inputs(leg, spec, args) unless spec.with_spec.to_a.empty?
-          return refuse_at_depth_ceiling(leg, record) if @door.reaction_depth_reached?
+          return refuse_at_depth_ceiling(leg, record) if @dispatcher.reaction_depth_reached?
 
           attempt_dispatch(leg, spec, args, record)
         end
@@ -46,7 +46,7 @@ module Hecks
         # it unwinds like a refusal rather than stranding the instance.
         def refuse_at_depth_ceiling(leg, record)
           @registry.saga_log << record.merge(delivered: false,
-                                             reason:    "reaction depth #{@door.max_reaction_depth} reached")
+                                             reason:    "reaction depth #{@dispatcher.max_reaction_depth} reached")
           unwind(leg)
         end
 
@@ -95,14 +95,14 @@ module Hecks
           nil
         end
 
-        # Dispatches `command_name` through the door, stamped with this saga's correlation.
+        # Dispatches `command_name` through the dispatcher, stamped with this saga's correlation.
         def reenter_command(leg, command_name, projected, explicit:, source_receiver:)
           head = leg.process_manager.correlation_head
           verb = qualified(command_name, leg.domain)
           invocation = ReactionInvocation.build(registry: @registry, verb: verb, projected: projected,
                                                 explicit: explicit, passthrough: [head],
                                                 source_receiver: source_receiver)
-          @door.reenter(verb, saga_correlation: { head.to_s => leg.correlation }, **invocation)
+          @dispatcher.reenter(verb, saga_correlation: { head.to_s => leg.correlation }, **invocation)
         end
 
         # Unlike a refusal, a crash isn't a domain decision, so it

data/lib/hecks/runtime/saga_interpreter/transitions.rb

@@ -21,7 +21,7 @@ module Hecks
 
         # The mutex covers only the check-mutate-checkpoint step, never the
         # dispatch cascade that follows — `deliver_saga_dispatch`'s
-        # `@door.reenter` can recursively re-enter this interpreter on the
+        # `@dispatcher.reenter` can recursively re-enter this interpreter on the
         # same thread, and `Mutex` is not reentrant.
         def remembered_leg_taken?(leg)
           leg.instance = @registry.saga_instances[leg.process_manager.name][leg.correlation]