hecks 4.0.0 → 6.0.0

data/lib/hecks/fuzzing/properties/dispatch_and_mutations.rb

@@ -17,6 +17,43 @@ module Hecks
           offenders.empty? || offenders.join("; ")
         end
 
+        # Checks that `validate` and `dry_run?` agree about every dry-run step: both accept it or
+        # both refuse it, and the first refusal `validate` reports is the one `dry_run?` raised. A
+        # caller who lacks the role is told only that by `validate` (the role is checked first), so
+        # a first refusal in the role stage is not held to what `dry_run?` raised. A refusal naming
+        # several offenders is one refusal each under `validate`, so its first is held to the same
+        # class and first offender, not to the same text.
+        #
+        # @param history [Hash] a replayed history, as returned by `Fuzzing::Replay.call`
+        # @return [true, String] true if they agree on every dry run; otherwise a semicolon-joined
+        #   message naming each disagreement
+        def validation_agrees_with_dry_run(history)
+          offenders = Array(history[:dry_run_traces]).filter_map { |entry| validation_disagreement(entry) }
+          offenders.empty? || offenders.join("; ")
+        end
+
+        # The message for one dry run `validate` answers differently, or nil.
+        def validation_disagreement(entry)
+          validation = entry[:validation]
+          return unless validation
+          return "#{entry[:verb]}: dry_run? ok=#{entry[:ok]}, validate ok=#{validation[:ok]}" if entry[:ok] != validation[:ok]
+
+          validation_first_refusal_differs(entry, validation)
+        end
+
+        # The message when both refused but `validate`'s first refusal is not `dry_run?`'s.
+        def validation_first_refusal_differs(entry, validation)
+          return if entry[:ok] || validation[:first_stage] == :role || same_first_refusal?(entry, validation)
+
+          "#{entry[:verb]}: dry_run? raised #{entry[:error].inspect}, validate's first was #{validation[:first_message].inspect}"
+        end
+
+        # Whether `validate`'s first refusal is what `dry_run?` raised, or the first of its split.
+        def same_first_refusal?(entry, validation)
+          entry[:error] == validation[:first_message] ||
+            (!entry[:raised].nil? && entry[:raised] == validation[:first_offender])
+        end
+
         # The message for one dry run that left a trace, or nil.
         def dry_run_offender(entry)
           before = entry[:before]
@@ -135,7 +172,8 @@ module Hecks
           context = mutation_context(bluebooks, entry)
           return [] unless context
 
-          recomputable = context.command.mutations.select { |m| RECOMPUTABLE_MUTATION_OPS.include?(m.op) }
+          command = context.command
+          recomputable = command.mutations.select { |m| RECOMPUTABLE_MUTATION_OPS.include?(m.op) }
           recomputable.filter_map { |mutation| mutation_offender(mutation, entry, context) }
         end
 

data/lib/hecks/fuzzing/properties/group_by_recompute.rb

@@ -6,10 +6,13 @@ module Hecks
       module GroupByRecompute
         # Judges one `group_by` ask against the rows it was eligible to see:
         # refused exactly when two of them share a checked key path, and
-        # otherwise nested exactly as `nest_rows` nests them.
+        # otherwise nested exactly as `nest_rows` nests them. A grouped reduction
+        # has no collision to refuse; each leaf is checked as a reduction (ADR 0126).
         def group_by_offense(bluebook, asked, model, grouped_head)
           rows = eligible_rows(bluebook, asked.fetch(:instances_at), model, grouped_head, asked[:args] || {})
           materialized = rows.map { |state| Runtime::Value.materialize_unwrapped(state) }
+          return grouped_reduction_offense(asked, model, grouped_head, materialized) if model.reducing?
+
           shared = shared_key_paths(materialized, model.group_by_fields)
           return nesting_offense(asked, model, grouped_head, materialized) if shared.empty?
 
@@ -46,7 +49,8 @@ module Hecks
         # Every full `group_by` key path more than one row reaches, found by
         # tallying each row's tuple of grouped values, with no nesting at all.
         def shared_key_paths(rows, fields)
-          rows.map { |row| fields.map { |field| row[field] } }.tally.select { |_, count| count > 1 }.keys
+          key_paths = rows.map { |row| fields.map { |field| row[field] } }
+          key_paths.tally.select { |_, count| count > 1 }.keys
         end
 
         # One level of nesting per `group_by` field in declared order; the leaf

data/lib/hecks/fuzzing/properties/grouped_reduction_recompute.rb

@@ -0,0 +1,88 @@
+require_relative "../../vocabulary"
+
+module Hecks
+  module Fuzzing
+    module Properties
+      # Independent checks of a read model that groups and reduces (ADR 0126), for
+      # `InvariantsAndAggregation`: each leaf against the reduction recomputed over its own rows,
+      # and the leaves folded by the reducer's declared `combine` against the ungrouped whole.
+      module GroupedReductionRecompute
+        # Each reducer's declared row of the Vocabulary's `Reducer` table, by name.
+        REDUCERS = Hecks::Vocabulary.rows("Reducer").to_h { |row| [row["name"], row] }.freeze
+
+        # How two partial answers fold, for each `combine` that is not `collect`. `nil` is a
+        # group with no value, which every fold passes over, as the ungrouped reduction does.
+        COMBINES = {
+          "add" => ->(a, b) { a + b },
+          "min" => ->(a, b) { [a, b].min },
+          "max" => ->(a, b) { [a, b].max },
+          "or"  => ->(a, b) { a || b },
+          "and" => ->(a, b) { a && b }
+        }.freeze
+
+        # Judges a grouped reduction's answer: every leaf must equal the reduction recomputed
+        # over that leaf's rows.
+        #
+        # @return [String, nil] the offense, or nil when the answer agrees
+        def grouped_reduction_offense(asked, model, grouped_head, materialized)
+          return nil if asked[:error]
+
+          expected = nest_reduced_rows(model, materialized, model.group_by_fields)
+          actual = answered(asked, grouped_head)
+          return nil if actual == expected
+
+          "#{asked[:query]} #{asked[:args].inspect} answered #{actual.inspect} for #{grouped_head[:as]}, but " \
+            "reducing each group of #{materialized.length} eligible row(s) independently gives #{expected.inspect}"
+        end
+
+        # Judges whether a grouped answer's leaves, folded by the reducer's `combine`, add up to
+        # the ungrouped reduction of the same rows; reducers that `collect` do not fold.
+        #
+        # @return [String, nil] the offense, or nil when they agree or the reducer does not fold
+        def grouped_fold_offense(asked, model, reduced_head, rows)
+          reducer = REDUCERS.fetch(reducer_name(model))
+          return nil unless COMBINES.key?(reducer["combine"])
+
+          folded = fold_leaves(answered(asked, reduced_head), reducer)
+          whole = recompute_reduction(model, rows)
+          return nil if folded == whole
+
+          "#{asked[:query]} #{asked[:args].inspect}'s groups fold by #{reducer["combine"]} to #{folded.inspect}, " \
+            "but reducing all #{rows.length} eligible row(s) at once gives #{whole.inspect}"
+        end
+
+        private
+
+        def answered(asked, head) = asked[:rows]&.first&.dig(head[:as])
+
+        # One level of nesting per field, each leaf the reduction of that leaf's rows.
+        def nest_reduced_rows(model, rows, fields)
+          field, *rest = fields
+          rows.group_by { |row| row[field] }.transform_values do |group|
+            stripped = group.map { |row| row.reject { |key, _| key == field } }
+            rest.empty? ? recompute_reduction(model, stripped) : nest_reduced_rows(model, stripped, rest)
+          end
+        end
+
+        # Every leaf of a nested answer, folded by the reducer's `combine`; no leaves answer
+        # the reducer's identity.
+        def fold_leaves(answer, reducer)
+          leaves = leaf_values(answer).compact
+          return JSON.parse(reducer["identity"]) if leaves.empty?
+
+          leaves.reduce(&COMBINES.fetch(reducer["combine"]))
+        end
+
+        def leaf_values(answer)
+          answer.is_a?(Hash) ? answer.values.flat_map { |value| leaf_values(value) } : [answer]
+        end
+
+        # The `Reducer` row name of the one reduction `model` declares.
+        def reducer_name(model)
+          ivar = Bluebook::Behaviour::ReadModel::REDUCTION_FIELDS.each_key.find { |name| model.public_send(name) }
+          Bluebook::Behaviour::ReadModel::REDUCTION_FIELDS.fetch(ivar)
+        end
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/properties/guards.rb

@@ -71,6 +71,9 @@ module Hecks
         # the other "X refused — Y" wordings.
         GUARD_REFUSAL_KINDS = %w[Hecks::Runtime::GivenNotMet Hecks::Runtime::EnsuresNotMet].freeze
 
+        # A guard refusal's message, `"<verb> refused — <description>"`, capturing both parts.
+        GUARD_REFUSAL_MESSAGE = /\A(.+) refused — (.+)\z/
+
         # Checks that every given/ensures refusal quotes a description its command declares.
         def guard_refusals_are_declared(history)
           bluebooks = history.fetch(:bluebooks)
@@ -82,7 +85,7 @@ module Hecks
         def guard_refusal_offense(bluebooks, refusal)
           return unless GUARD_REFUSAL_KINDS.include?(refusal[:kind])
 
-          match = refusal[:error].to_s.match(/\A(.+) refused — (.+)\z/)
+          match = refusal[:error].to_s.match(GUARD_REFUSAL_MESSAGE)
           return "#{refusal[:verb]} raised #{refusal[:kind]} with unparseable message #{refusal[:error].inspect}" unless match
 
           command = command_for_verb(bluebooks, refusal[:verb])

data/lib/hecks/fuzzing/properties/invariants_and_aggregation.rb

@@ -1,6 +1,7 @@
 require "json"
 require_relative "aggregation_recompute"
 require_relative "group_by_recompute"
+require_relative "grouped_reduction_recompute"
 require_relative "piece_invariants"
 
 module Hecks
@@ -11,6 +12,7 @@ module Hecks
       module InvariantsAndAggregation
         include AggregationRecompute
         include GroupByRecompute
+        include GroupedReductionRecompute
         include PieceInvariants
 
         # Every stored record — and every entity nested inside it — still
@@ -103,11 +105,19 @@ module Hecks
           return unless model&.reducing?
 
           reduced_head = many_head(model)
-          reduced_head && reduction_offense(bluebook, asked, model, reduced_head)
+          reduced_head && reducing_offense(bluebook, asked, model, reduced_head)
         end
 
-        def reduction_offense(bluebook, asked, model, reduced_head)
+        # A grouped reduction's leaves must fold by the reducer's `combine` to the ungrouped
+        # answer (ADR 0126); `group_by_matches_recompute` checks each leaf.
+        def reducing_offense(bluebook, asked, model, reduced_head)
           rows = eligible_rows(bluebook, asked.fetch(:instances_at), model, reduced_head, asked[:args] || {})
+          return grouped_fold_offense(asked, model, reduced_head, rows) if model.group_by.any?
+
+          reduction_offense(asked, model, reduced_head, rows)
+        end
+
+        def reduction_offense(asked, model, reduced_head, rows)
           expected = recompute_reduction(model, rows)
           actual = asked[:rows]&.first&.dig(reduced_head[:as])
           return if actual == expected

data/lib/hecks/fuzzing/properties/lifecycle_and_replay.rb

@@ -27,7 +27,8 @@ module Hecks
 
         # The message for one stored record holding an undeclared lifecycle state, or nil.
         def undeclared_state_offense(bluebook, declared, key, state)
-          aggregate_name = key.split("::").last.split("#").first
+          record = key.split("::").last
+          aggregate_name = record.split("#").first
           states = declared[aggregate_name]
           return unless states
 

data/lib/hecks/fuzzing/properties/mutation_recompute.rb

@@ -60,10 +60,11 @@ module Hecks
         # VO-declared `default:` field is left out of the recomputed element entirely,
         # disagreeing with real dispatch's fully-defaulted one.
         def fill_recompute_declared_defaults(context, target, fields)
-          element_type = target && context.owner&.attribute(target)&.type
+          owner = context.owner
+          element_type = target && owner&.attribute(target)&.type
           return fields unless element_type
 
-          entity = context.owner.entities.find { |piece| piece.hecks_name == element_type.to_s }
+          entity = owner.entities.find { |piece| piece.hecks_name == element_type.to_s }
           return fill_entity_defaults(context.aggregate, entity, fields) if entity
 
           fill_value_object_defaults(context.aggregate, element_type, fields)

data/lib/hecks/fuzzing/properties/piece_invariants.rb

@@ -6,8 +6,9 @@ module Hecks
       module PieceInvariants
         # The message for one stored record that violates an invariant, or nil.
         def stored_record_offense(bluebooks, key, state)
-          domain_name    = key.split("::").first
-          aggregate_name = key.split("::").last.split("#").first
+          key_parts      = key.split("::")
+          domain_name    = key_parts.first
+          aggregate_name = key_parts.last.split("#").first
           aggregate      = bluebooks[domain_name]&.aggregate(aggregate_name)
           return unless aggregate
 

data/lib/hecks/fuzzing/properties/query_rows.rb

@@ -56,10 +56,12 @@ module Hecks
 
         # The `in` clause over the ids of the hop target's rows that satisfy the rest of the path.
         def hop_in_clause(snapshot, hop, rest, clause, args)
-          inner = QuerySpecification::Common::WhereClause.new(field: rest, op: clause.op, value: clause.value)
-          ids   = query_eligible_rows(snapshot, hop.target.hecks_name, [inner], args).map { |row| row[:id].to_s }.uniq
+          inner     = QuerySpecification::Common::WhereClause.new(field: rest, op: clause.op, value: clause.value)
+          target    = hop.target
+          attribute = hop.attribute
+          ids       = query_eligible_rows(snapshot, target.hecks_name, [inner], args).map { |row| row[:id].to_s }.uniq
 
-          QuerySpecification::Common::WhereClause.new(field: hop.attribute.name, op: "in", value: ids)
+          QuerySpecification::Common::WhereClause.new(field: attribute.name, op: "in", value: ids)
         end
       end
     end

data/lib/hecks/fuzzing/properties/querying.rb

@@ -1,4 +1,5 @@
 require_relative "query_rows"
+require_relative "cursor_walks"
 
 module Hecks
   module Fuzzing
@@ -6,6 +7,7 @@ module Hecks
       # Properties that check a query's answer against an independent recomputation.
       module Querying
         include QueryRows
+        include CursorWalks
 
         # Differential oracle: each replayed ask is answered natively and by the reference
         # interpreter, and the two must agree.
@@ -103,9 +105,10 @@ module Hecks
         end
 
         def ordered_rows(rows, declared)
+          order_by = declared.order_by
           Ports::Query::Ordering.apply(
-            rows, declared.order_by, declared.null_semantics, identity: ->(row) { row[:id].to_s }
-          ) { |row| Ports::Query::InMemory.comparable(QuerySpecification::FieldPath.dig(row, declared.order_by.field)) }
+            rows, order_by, declared.null_semantics, identity: ->(row) { row[:id].to_s }
+          ) { |row| Ports::Query::InMemory.comparable(QuerySpecification::FieldPath.dig(row, order_by&.field)) }
         end
 
         # Real dispatch normalizes a query's own declared arguments
@@ -132,7 +135,7 @@ module Hecks
         # Entity-level queries (dotted query path) return nil: they are not one aggregate's
         # own rows, which #query_eligible_rows assumes.
         #
-        # @param bluebooks [Hash{String => Bluebook::Chapter}] every loaded domain
+        # @param bluebooks [Hash{String => Bluebook::Declaration}] every loaded domain
         # @param verb [String] `"Domain::Aggregate.Query"`
         # @return [Bluebook::Query, nil]
         def query_for_verb(bluebooks, verb)

data/lib/hecks/fuzzing/properties/read_model_names.rb

@@ -3,8 +3,13 @@ module Hecks
     module Properties
       # Property: how each declared read model is addressed.
       module ReadModelNames
+        # An acronym run followed by a capitalised word, as `HTTPServer`, capturing both.
+        ACRONYM_BOUNDARY = /([A-Z]+)([A-Z][a-z])/
+        # A lowercase letter or digit followed by an uppercase one, capturing both.
+        CAMEL_BOUNDARY = /([a-z\d])([A-Z])/
+
         # Every read model resolves from either spelling of its name, to itself, and no two read
-        # models of one chapter share a `query_name`.
+        # models of one bluebook share a `query_name`.
         #
         # @param history [Hash] a replayed history, as returned by `Fuzzing::Replay.call`
         # @return [true, String] true, or a message naming each read model that drifts
@@ -42,7 +47,8 @@ module Hecks
 
         # Written out here rather than called, so a drift in `Naming.snake` is a finding.
         def snake_of(text)
-          text.to_s.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2').gsub(/([a-z\d])([A-Z])/, '\1_\2').downcase
+          acronyms_split = text.to_s.gsub(ACRONYM_BOUNDARY, '\1_\2')
+          acronyms_split.gsub(CAMEL_BOUNDARY, '\1_\2').downcase
         end
       end
     end

data/lib/hecks/fuzzing/properties/read_models.rb

@@ -48,7 +48,8 @@ module Hecks
         end
 
         def composable?(model)
-          !model.reducing? && model.group_by.empty? && !model.authorization&.tenant
+          authorization = model.authorization
+          !model.reducing? && model.group_by.empty? && !authorization&.tenant
         end
 
         def unexpected_heads(query, model, answer)

data/lib/hecks/fuzzing/properties/refusals.rb

@@ -0,0 +1,35 @@
+module Hecks
+  module Fuzzing
+    module Properties
+      # Property: a refused dispatch changes nothing. Its stored records, journal entries,
+      # events, reactions, saga advances and outbox rows read the same after the refusal as
+      # before the dispatch. Entries without both snapshots (hand-built histories) are skipped.
+      module Refusals
+        # The parts of a snapshot compared, each named as a finding reports it.
+        REFUSAL_TRACE_PARTS = %i[instances journal events reactions sagas outbox].freeze
+
+        # Checks that every refused dispatch left every part of the runtime as it found it.
+        #
+        # @param history [Hash] a replayed history, as returned by `Fuzzing::Replay.call`
+        # @return [true, String] true if no refusal changed anything; otherwise a
+        #   semicolon-joined message naming each refusal and what it changed
+        def refusals_leave_no_trace(history)
+          offenders = Array(history[:refusal_traces]).filter_map { |entry| refusal_offender(entry) }
+          offenders.empty? || offenders.join("; ")
+        end
+
+        # The message for one refusal that changed something, or nil.
+        def refusal_offender(entry)
+          before = entry[:before]
+          after  = entry[:after]
+          return unless before && after
+
+          changed = REFUSAL_TRACE_PARTS.reject { |part| before[part] == after[part] }
+          return if changed.empty?
+
+          "#{entry[:verb]} refused (#{entry[:kind]}) but changed #{changed.join(", ")}"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/properties/role_checks.rb

@@ -4,7 +4,7 @@ module Hecks
       # Property: the role check at dispatch agrees with the grants the replay itself made.
       #
       # `CommandRules::Authorization` asks the authorization provider whether an identified caller
-      # holds a command's role, through the `assignments` verb the provider's chapter declares with
+      # holds a command's role, through the `assignments` verb the provider's bluebook declares with
       # `provides "authorization"`. Each `history[:role_checks]` entry carries the grants read back
       # through that same verb before the dispatch, so the answer is recomputed from them.
       module RoleChecks
@@ -33,7 +33,8 @@ module Hecks
         end
 
         def role_held?(check)
-          check[:grants].any? { |grant| grant[:role] == check[:role] && !grant[:ended] }
+          roles = check[:roles] || [check[:role]]
+          check[:grants].any? { |grant| roles.include?(grant[:role]) && !grant[:ended] }
         end
 
         def refused_message(check)

data/lib/hecks/fuzzing/properties/set_transform_parity.rb

@@ -0,0 +1,73 @@
+require_relative "../../bulk/sweep"
+require_relative "bulk_parity"
+
+module Hecks
+  module Fuzzing
+    module Properties
+      # Property: a bulk run carried out as one statement (ADR 0129) answers the same per-row
+      # outcomes, leaves the same records and emits the same events as the same run sent row by
+      # row. It boots twice itself, like {BulkParity}, and applies only to a SQL store.
+      module SetTransformParity
+        # The stores that answer a set transform.
+        ADAPTERS = %i[sqlite postgres].freeze
+
+        # Replays `steps` twice on `adapter`. After the first, every pair is swept letting the run
+        # compile to one statement; after the second, every pair is swept row by row. Each pair's
+        # outcomes, the events it emitted and the records left after it must agree.
+        #
+        # @param domain_path [String] the domain directory
+        # @param steps [Array<Hash>] a generated or recorded step list
+        # @param adapter [Symbol] the persistence both boots are bound to
+        # @return [true, String] true when they agree, or not applicable; otherwise the first pair
+        #   that differs
+        def set_transform_matches_row_by_row(domain_path, steps, adapter: :sqlite)
+          return true unless ADAPTERS.include?(adapter) && BulkParity.attaches_bulk?(domain_path)
+
+          compiled = SetTransformParity.played(domain_path, steps, adapter, set_transform: true)
+          by_row = SetTransformParity.played(domain_path, steps, adapter, set_transform: false)
+          SetTransformParity.verdict(compiled, by_row)
+        end
+
+        module_function
+
+        # Boots a copy, plays `steps`, then sweeps every pair in order.
+        #
+        # @return [Array<Array>] per pair: its label, outcomes, emitted events and records after it
+        def played(domain_path, steps, adapter, set_transform:)
+          IsolatedBoot.call(domain_path, adapter: adapter) do |copy|
+            runtime = Hecks.boot(copy, environment: nil)
+            Replay::Session.new(runtime).play(steps)
+            BulkParity.pairs(runtime).map { |pair| swept(runtime, pair, set_transform) }
+          end
+        end
+
+        def swept(runtime, pair, set_transform)
+          log = runtime.events
+          before = log.size
+          outcomes = sweep(runtime, pair, set_transform)
+          [pair.label, outcomes, log.drop(before).map { |event| event_facts(event) }, Replay.snapshot_instances(runtime)]
+        end
+
+        def sweep(runtime, pair, set_transform)
+          plan = Bulk::Plan.new(verb: pair.verb, over: pair.over, arguments: {})
+          Bulk::Sweep.new(runtime.registry, plan, set_transform: set_transform).outcomes
+        rescue StandardError => e
+          [:crashed, e.class.name]
+        end
+
+        def event_facts(event) = [event.name, event.aggregate, event.id.to_s, event.payload]
+
+        # The first pair the two runs disagree on, or true.
+        def verdict(compiled, by_row)
+          index = compiled.each_index.find { |at| compiled[at] != by_row[at] }
+          return true unless index
+
+          label, outcomes, events, = compiled[index]
+          _, row_outcomes, row_events, = by_row[index]
+          "#{label}: as one statement a bulk run answered #{outcomes.inspect} and emitted #{events.inspect}; " \
+            "row by row it answered #{row_outcomes.inspect} and emitted #{row_events.inspect}"
+        end
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/properties/tenant_scope.rb

@@ -41,14 +41,15 @@ module Hecks
 
         # The aggregate a stored-record key `Domain::Aggregate#id` belongs to, or nil.
         def aggregate_for_key(bluebooks, key)
-          bluebooks[key.split("::").first]&.aggregate(key.split("::").last.split("#").first)
+          key_parts = key.split("::")
+          bluebooks[key_parts.first]&.aggregate(key_parts.last.split("#").first)
         end
 
         # The message for one reference whose target carries a different tenant, or nil.
         def cross_tenant_offense(record, attribute)
           return unless attribute.type.is_a?(Bluebook::Reference)
 
-          target = record.aggregate_named(attribute.type.target_name)
+          target = record.aggregate_named(attribute.target_name)
           target_id = record.state[attribute.name]
           return unless target && target_id
 

data/lib/hecks/fuzzing/properties.rb

@@ -5,6 +5,8 @@ require_relative "../ports/query/in_memory"
 require_relative "../query_specification/field_path"
 require_relative "../runtime/value"
 require_relative "properties/lifecycle_and_replay"
+require_relative "properties/bulk_parity"
+require_relative "properties/set_transform_parity"
 require_relative "properties/querying"
 require_relative "properties/guards"
 require_relative "properties/dispatch_and_mutations"
@@ -13,6 +15,7 @@ require_relative "properties/corrections"
 require_relative "properties/outbox"
 require_relative "properties/policy_wiring"
 require_relative "properties/references"
+require_relative "properties/refusals"
 require_relative "properties/role_checks"
 require_relative "properties/read_model_names"
 require_relative "properties/read_models"
@@ -27,6 +30,8 @@ module Hecks
       # Grouped by responsibility across properties/*.rb; `extend`ed so each
       # stays reachable as `Properties.foo(history)`, matching `module_function` below.
       extend LifecycleAndReplay
+      extend BulkParity
+      extend SetTransformParity
       extend Querying
       extend Guards
       extend DispatchAndMutations
@@ -36,6 +41,7 @@ module Hecks
       extend Outbox
       extend PolicyWiring
       extend References
+      extend Refusals
       extend RoleChecks
       extend ReadModelNames
       extend ReadModels

data/lib/hecks/fuzzing/qa_settings.rb

@@ -6,7 +6,7 @@ module Hecks
     # Loads and validates `qa/settings.yml`, the hecks_qa dials.
     #
     # Fails loud: a missing key, unknown key or wrong-typed value raises at load time.
-    # What each dial is and takes is declared as a `QaDial` row in the Vocabulary chapter.
+    # What each dial is and takes is declared as a `QaDial` row in the Vocabulary bluebook.
     class QaSettings
       # The classes a value of each `type` of a `QaDial` row must be an instance of. Booleans list
       # both TrueClass and FalseClass; Numeric admits `0` as well as `0.0`.
@@ -16,7 +16,7 @@ module Hecks
       }.freeze
 
       # Accessor name to the classes a valid value must be an instance of, one entry per `QaDial`
-      # row of the Vocabulary chapter, where each dial is declared with its type and its meaning.
+      # row of the Vocabulary bluebook, where each dial is declared with its type and its meaning.
       EXPECTED_TYPES = Hecks::Vocabulary.rows("QaDial").to_h do |dial|
         [dial.fetch("name").to_sym, TYPE_CLASSES.fetch(dial.fetch("type"))]
       end.freeze
@@ -24,7 +24,7 @@ module Hecks
       attr_reader(*EXPECTED_TYPES.keys)
 
       # The one real file, resolved from this file's `__dir__` rather than the bluebook's: the
-      # chapter ships in `lib/hecks/quality_control/`, the settings stay in `qa/`, and IsolatedBoot
+      # bluebook ships in `lib/hecks/quality_control/`, the settings stay in `qa/`, and IsolatedBoot
       # copies only `qa/bluebook`, so a bluebook-relative path would miss it.
       DEFAULT_PATH = File.expand_path("../../../qa/settings.yml", __dir__)
 
@@ -77,7 +77,7 @@ module Hecks
 
         raise ArgumentError,
               "#{path} declares unknown key(s) #{extra.sort.join(", ")} — " \
-              "no QaDial row of the Vocabulary chapter declares them"
+              "no QaDial row of the Vocabulary bluebook declares them"
       end
 
       def check_type!(path, key, expected, value)

data/lib/hecks/fuzzing/replay/fan_out.rb

@@ -15,8 +15,9 @@ module Hecks
           announced.each_with_object([]) do |event, findings|
             # `event.aggregate` is domain-qualified ("Banking::Account"); split the same
             # two ways `PolicyInterpreter#policies_for` does.
-            domain = event.aggregate.to_s.split("::").first
-            bluebook = runtime.registry.bluebook(domain)
+            emitter = event.aggregate.to_s
+            domain = emitter.split("::").first
+            bluebook = runtime.bluebook(domain)
             next unless bluebook
 
             fanning_policies(bluebook, event).each do |policy|
@@ -70,7 +71,7 @@ module Hecks
 
         # The declared query a `for_each` policy names, or nil.
         def for_each_query(runtime, query_domain, aggregate_name, query_name)
-          runtime.registry.bluebook(query_domain)&.aggregate(aggregate_name)&.query(query_name)
+          runtime.bluebook(query_domain)&.aggregate(aggregate_name)&.query(query_name)
         end
       end
     end

data/lib/hecks/fuzzing/replay/filters.rb

@@ -20,7 +20,7 @@ module Hecks
 
           domain_name, aggregate = filter_aggregate(runtime, filter["aggregate"].to_s)
           clause  = filter_clause(filter)
-          records = runtime.registry.repository(domain_name, aggregate).all
+          records = runtime.repository(domain_name, aggregate).all
 
           rows_by_id(records.select { |record| clause_holds?(clause, record, {}) })
         end
@@ -46,7 +46,7 @@ module Hecks
         # @raise [Bluebook::Expression::EvaluationError] if no such aggregate is loaded
         def filter_aggregate(runtime, aggregate_ref)
           domain_name, aggregate_name = aggregate_ref.split("::", 2)
-          aggregate = runtime.registry.bluebook(domain_name)&.aggregate(aggregate_name)
+          aggregate = runtime.bluebook(domain_name)&.aggregate(aggregate_name)
           raise Bluebook::Expression::EvaluationError, "unknown aggregate #{aggregate_ref.inspect}" unless aggregate
 
           [domain_name, aggregate]

data/lib/hecks/fuzzing/replay/guard_check.rb

@@ -17,7 +17,7 @@ module Hecks
           return nil unless target
 
           id = Replay.identity_for(target.aggregate, target.command, args)
-          record = id && runtime.registry.repository(target.domain, target.aggregate).find(id)
+          record = id && runtime.repository(target.domain, target.aggregate).find(id)
           return nil unless record
 
           { verb: verb, domain: target.domain, aggregate: target.aggregate_name, command: target.command_name,
@@ -31,7 +31,7 @@ module Hecks
           domain_name, aggregate_name, command_name = Naming.split_verb(verb)
           return nil unless command_name && !command_name.include?(".")
 
-          aggregate = runtime.registry.bluebook(domain_name)&.aggregate(aggregate_name)
+          aggregate = runtime.bluebook(domain_name)&.aggregate(aggregate_name)
           command   = aggregate&.command(command_name)
           return nil unless checkable?(aggregate, command)