hecks 5.0.0 → 6.0.0

data/lib/hecks/fuzzing/mutation/checks.rb

@@ -1,6 +1,7 @@
 require_relative "../../cli/run"
 require_relative "../../behaviors"
 require_relative "observation"
+require_relative "../../text"
 
 module Hecks
   module Fuzzing
@@ -35,7 +36,7 @@ module Hecks
           Replay.call(copy, [])
           nil
         rescue StandardError, ScriptError => e
-          "#{e.class}: #{e.message.lines.first.to_s.strip}"
+          "#{e.class}: #{Hecks::Text.first_line(e.message)}"
         end
 
         # @return [String, nil] the first property a history breaks, as `property: <name>`

data/lib/hecks/fuzzing/mutation/finders.rb

@@ -22,6 +22,12 @@ module Hecks
           PATTERN = /,\s*pattern:\s*'[^']*'/
           CLOSED_SET = /,\s*one_of:\s*\[[^\]]*\]/
           BOUND = /\A\s*where\(.*\b(lt|gt):/
+          # The braced body of a `given`/`invariant`, outer braces included.
+          BRACED_BODY = /\{.*\}/
+          # A line declaring an attribute.
+          ATTRIBUTE_LINE = /\A\s*attribute\b/
+          # A query bound's `lt:` or `gt:` key, capturing which.
+          BOUND_KEY = /\b(lt|gt):/
 
           module_function
 
@@ -39,13 +45,13 @@ module Hecks
 
           # The first comparison inside the line's braces, moved one step.
           def flip_comparison(line)
-            body = line[/\{.*\}/]
+            body = line[BRACED_BODY]
             operator = COMPARISONS.keys.find { |candidate| body.include?(candidate) }
             operator && line.sub(body, body.sub(operator, COMPARISONS.fetch(operator)))
           end
 
           def attribute(line)
-            return [] unless line.match?(/\A\s*attribute\b/)
+            return [] unless line.match?(ATTRIBUTE_LINE)
 
             [[:drop_pattern, PATTERN], [:drop_one_of, CLOSED_SET]].filter_map do |operator, shape|
               (found = line[shape]) && Change.rewrite(operator, line.sub(found, ""))
@@ -55,13 +61,17 @@ module Hecks
           def query_bound(line)
             return [] unless line.match?(BOUND)
 
-            [Change.rewrite(:flip_query_bound, line.sub(/\b(lt|gt):/) { Regexp.last_match(1) == "lt" ? "gt:" : "lt:" })]
+            [Change.rewrite(:flip_query_bound, line.sub(BOUND_KEY) { Regexp.last_match(1) == "lt" ? "gt:" : "lt:" })]
           end
         end
 
         # The shape of the domain: `from:` guards, `sets`, lifecycle targets, emitted events.
         module Structure
           GUARD = /,\s*from:\s*"[^"]*"/
+          # A bare `sets :field` line.
+          SETS_LINE = /\A\s*sets\s+:\w+\s*\z/
+          # A line opening a `command` block.
+          COMMAND_OPENER = /\A\s*command\b.*\bdo\s*\z/
 
           module_function
 
@@ -72,12 +82,12 @@ module Hecks
           end
 
           def sets(line, scope)
-            line.match?(/\A\s*sets\s+:\w+\s*\z/) && scope == "command" ? [Change.removal(:drop_sets)] : []
+            line.match?(SETS_LINE) && scope == "command" ? [Change.removal(:drop_sets)] : []
           end
 
           def command_guard(line)
             guard = line[GUARD]
-            guard && line.match?(/\A\s*command\b.*\bdo\s*\z/) ? [Change.rewrite(:drop_from_guard, line.sub(guard, ""))] : []
+            guard && line.match?(COMMAND_OPENER) ? [Change.rewrite(:drop_from_guard, line.sub(guard, ""))] : []
           end
 
           def transition(map, line, scope)
@@ -106,6 +116,13 @@ module Hecks
 
         # Reactions: whole policies, and what a process manager does on each of its transitions.
         module Reactions
+          # A line opening a `policy "Name"` block.
+          POLICY_OPENER = /\A\s*policy\s+"/
+          # A line opening a process manager's `transition ... do` block.
+          TRANSITION_OPENER = /\A\s*transition\b.*\bdo\s*\z/
+          # A `dispatch` line naming what it dispatches.
+          DISPATCH_LINE = /\A\s*dispatch\s+\S/
+
           module_function
 
           def at(map, index)
@@ -115,17 +132,17 @@ module Hecks
           end
 
           def policy(map, index, line)
-            length = line.match?(/\A\s*policy\s+"/) && map.block_length(index)
+            length = line.match?(POLICY_OPENER) && map.block_length(index)
             length ? [Change.removal(:drop_policy, length)] : []
           end
 
           def saga_transition(map, index, line, scope)
-            length = scope == "process_manager" && line.match?(/\A\s*transition\b.*\bdo\s*\z/) && map.block_length(index)
+            length = scope == "process_manager" && line.match?(TRANSITION_OPENER) && map.block_length(index)
             length ? [Change.removal(:drop_saga_transition, length)] : []
           end
 
           def saga_dispatch(line, scope)
-            scope == "transition" && line.match?(/\A\s*dispatch\s+\S/) ? [Change.removal(:drop_saga_dispatch)] : []
+            scope == "transition" && line.match?(DISPATCH_LINE) ? [Change.removal(:drop_saga_dispatch)] : []
           end
         end
 

data/lib/hecks/fuzzing/mutation/observation.rb

@@ -8,6 +8,8 @@ module Hecks
       module Observation
         PARTS = %i[instances events refusals reactions sagas queries].freeze
         PLAIN = [String, Numeric, true, false, nil].freeze
+        # An object address in an `inspect`/`to_s` text, as `0x000123ab`.
+        ADDRESS = /0x\h+/
 
         module_function
 
@@ -30,7 +32,7 @@ module Hecks
         # An object that is not plain data: its own hash form when it has one, else its text with
         # the address that would differ between runs taken out.
         def opaque(value)
-          value.respond_to?(:to_h) ? plain(value.to_h) : value.to_s.gsub(/0x\h+/, "0x")
+          value.respond_to?(:to_h) ? plain(value.to_h) : value.to_s.gsub(ADDRESS, "0x")
         end
       end
     end

data/lib/hecks/fuzzing/mutation/source_map.rb

@@ -9,6 +9,8 @@ module Hecks
         OPENER = /\A(\s*)(\w+)\b.*\bdo\s*(\|[^|]*\|)?\s*\z/
         TRANSITION = /\A(\s*)transition\s+"(\w+)"\s*=>\s*"([^"]+)"(.*?)\s*\z/
         EMITS = /\A(\s*)emits\s+(\w+)\s*\z/
+        # A line's leading whitespace.
+        INDENT = /\A\s*/
 
         attr_reader :file, :lines
 
@@ -37,7 +39,7 @@ module Hecks
         # @param index [Integer] the position of the line that opens a block
         # @return [Integer, nil] the lines from it to its `end`, nil when the block never closes
         def block_length(index)
-          indent = lines[index][/\A\s*/]
+          indent = lines[index][INDENT]
           close = ((index + 1)...lines.length).find { |at| lines[at].match?(/\A#{indent}end\b/) }
           close && ((close - index) + 1)
         end

data/lib/hecks/fuzzing/nondeterministic.rb

@@ -7,7 +7,10 @@ module Hecks
         query_row:  {
           instances_at: "a full state snapshot taken for the query oracle's own use " \
                         "(Properties::Querying); the same state is already compared as `instances`, " \
-                        "so keeping it would re-report one instances divergence under every query step"
+                        "so keeping it would re-report one instances divergence under every query step",
+          pages:        "the walks of a cursor query's pages, taken for the oracle's own use " \
+                        "(Properties::Querying#cursor_walk_yields_the_unpaged_rows); the compiled " \
+                        "kernel answers one ask a time and has no walk to compare it with"
         }.freeze,
         outbox_row: {
           event_uid:   "`Runtime::Outbox::Fanout#rows_for`'s own SecureRandom.uuid, minted fresh per " \
@@ -20,9 +23,12 @@ module Hecks
                        "runs (Replay's own projected `:events` leave it off for the same reason)"
         }.freeze,
         history:    {
-          bluebook:  "a live IR object (the first-loaded bluebook) handed to properties — an object " \
-                     "identity, not a value, so two boots never compare equal on it",
-          bluebooks: "the full live IR map, keyed by domain — object identities, same as `bluebook`"
+          bluebook:       "a live IR object (the first-loaded bluebook) handed to properties — an object " \
+                          "identity, not a value, so two boots never compare equal on it",
+          bluebooks:      "the full live IR map, keyed by domain — object identities, same as `bluebook`",
+          refusal_traces: "the before and after snapshots Properties::Refusals reads, holding outbox " \
+                          "delivery ids that inherit event_uid's per-enqueue uuid; the refusals " \
+                          "themselves are already compared as `refusals`"
         }.freeze
       }.freeze
 

data/lib/hecks/fuzzing/outside_world.rb

@@ -6,7 +6,7 @@ module Hecks
   module Fuzzing
     # What a replay asks in place of a port's adapter: an object that refuses every question.
     #
-    # A domain's adapters reach outside the process, and the chapters of this repository that
+    # A domain's adapters reach outside the process, and the bluebooks of this repository that
     # drive tools (the shell, git, child processes, the file system) would run them for real from
     # a generated sequence. A replay checks the domain's own rules, so the adapter never runs:
     # the operation is refused, which a port operation records as its `refuses` event and a query

data/lib/hecks/fuzzing/projection_agreement/binding.rb

@@ -0,0 +1,63 @@
+module Hecks
+  module Fuzzing
+    module ProjectionAgreement
+      # Binds every bluebook of a copied, Memory-bound domain `projected_by` one projection
+      # adapter, by writing a hecksagon and a world beside each directory's own, which the
+      # registry merges into them.
+      module Binding
+        # The files written into each directory that holds a hecksagon.
+        HECKSAGON_FILE = "hecks_fuzz_projection.hecksagon".freeze
+        WORLD_FILE = "hecks_fuzz_projection.world".freeze
+
+        module_function
+
+        # @param copy [String] the copied domain's root, already rebound to Memory
+        # @param projection [Symbol] a key of `ProjectionAgreement::ADAPTERS`
+        # @param scratch [Hash] the Postgres projection's `database:` and `schema:`
+        # @return [void]
+        # @raise [ArgumentError] if `projection` names no projection adapter
+        def bind!(copy, projection, **scratch)
+          adapter = ADAPTERS.fetch(projection) do
+            raise ArgumentError, "no projection for #{projection.inspect} — :sqlite or :postgres"
+          end
+          settings = settings_for(copy, projection, **scratch)
+          IsolatedBoot.hecksagon_names_by_dir(copy).each do |dir, names|
+            write!(dir, names.uniq, adapter, settings) unless names.empty?
+          end
+        end
+
+        def write!(dir, names, adapter, settings)
+          File.write(File.join(dir, HECKSAGON_FILE), names.map { |name| hecksagon(name, adapter) }.join("\n"))
+          File.write(File.join(dir, WORLD_FILE), names.map { |name| world(name, adapter, settings) }.join("\n"))
+        end
+
+        def hecksagon(name, adapter) = %(Hecks.hecksagon "#{name}" do\n  projected_by "#{adapter}"\nend\n)
+
+        def world(name, adapter, settings)
+          lines = settings.map { |key, value| %(    #{key} "#{value}"\n) }.join
+          %(Hecks.world "#{name}" do\n  projected_by("#{adapter}") do\n#{lines}  end\nend\n)
+        end
+
+        # SQLite projects into one file inside the copy; Postgres into a scratch schema of its
+        # own, dropped and recreated here so one boot starts from an empty read store.
+        def settings_for(copy, projection, database: nil, schema: nil)
+          return { database: File.join(copy, "data", "hecks_fuzz_projection.sqlite3") } if projection == :sqlite
+
+          require "pg"
+          database ||= IsolatedBoot::FUZZ_POSTGRES_DATABASE
+          schema ||= scratch_schema(database)
+          IsolatedBoot.ensure_fuzz_schema!(database, schema)
+          { database: database, schema: schema }
+        end
+
+        # Beside the process's own scratch schema, and dropped when the process exits, as its
+        # persistence schema is.
+        def scratch_schema(database)
+          schema = "#{IsolatedBoot.scratch_schema(database)}_projection"
+          IsolatedBoot.drop_at_exit(database, schema)
+          schema
+        end
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/projection_agreement/comparison.rb

@@ -0,0 +1,104 @@
+require "json"
+require "delegate"
+require_relative "../../ports/projection"
+require_relative "../../runtime/read_model_interpreter"
+
+module Hecks
+  module Fuzzing
+    module ProjectionAgreement
+      # Compares, for one booted registry, each rooted read model's answer through the
+      # projection with the in-process loop's answer over the authoritative records alone.
+      class Comparison
+        # What one comparison found: each disagreement, and how many asks were answered both ways.
+        Outcome = Struct.new(:offenders, :compared)
+
+        # The registry as the loop sees it with every projection unbound: each read goes to the
+        # authoritative repository, so no adapter's own read-model path is taken.
+        class Authoritative < SimpleDelegator
+          # @param domain [String, Symbol] the aggregate's domain
+          # @param aggregate [Bluebook::Aggregate] the aggregate to read
+          # @return [Ports::Persistence::AppendOnly] the authoritative repository
+          def read_repository(domain, aggregate) = __getobj__.repository(domain, aggregate)
+        end
+
+        # @param registry [Runtime::Registry] a booted registry with its projections bound
+        def initialize(registry)
+          @registry = registry
+          @through_projection = Runtime::ReadModelInterpreter.new(registry)
+          @through_loop = Runtime::ReadModelInterpreter.new(Authoritative.new(registry))
+          @compared = 0
+        end
+
+        # Catches every projection up, then lists each answer the two paths disagree on.
+        #
+        # @return [Outcome] `offenders`, one message per disagreement or per projection still
+        #   stale after catch-up (empty when every rooted read model agrees), and `compared`
+        def outcome
+          catch_up!
+          offenders = rooted_models.flat_map { |domain, model| model_offenders(domain, model) }
+          Outcome.new(offenders, @compared)
+        end
+
+        private
+
+        def catch_up!
+          projected_aggregates.each do |domain, aggregate|
+            Ports::Projection.worker(@registry, domain, aggregate, policy: :strict).catch_up!
+          end
+        end
+
+        def projected_aggregates
+          @registry.bluebooks.flat_map do |domain, bluebook|
+            bluebook.aggregates.filter_map { |aggregate| [domain, aggregate] if projected?(domain, aggregate) }
+          end
+        end
+
+        def projected?(domain, aggregate) = Ports::Projection.binds_for(@registry, domain, aggregate).any?
+
+        # Every rooted read model whose root aggregate is projected, with its domain.
+        def rooted_models
+          @registry.bluebooks.flat_map do |domain, bluebook|
+            bluebook.read_models.filter_map do |model|
+              root = model.reference_target && bluebook.aggregate(model.reference_target)
+              [domain, model] if root && projected?(domain, root)
+            end
+          end
+        end
+
+        # A stale projection is a finding of its own: comparing it would test the loop against
+        # itself, since `read_repository` falls back to the authoritative store.
+        def model_offenders(domain, model)
+          root = @registry.bluebook(domain).aggregate(model.reference_target)
+          if stale?(domain, root)
+            return ["#{domain}.#{model.query_name}: #{root.name}'s projection is not current after catch-up"]
+          end
+
+          @registry.repository(domain, root).all.filter_map { |record| disagreement(domain, model, record.id.to_s) }
+        end
+
+        def stale?(domain, aggregate)
+          @registry.read_repository(domain, aggregate).equal?(@registry.repository(domain, aggregate))
+        end
+
+        def disagreement(domain, model, id)
+          @compared += 1
+          args = { model.reference_name => id }
+          projected = answer { @through_projection.call(domain, model, args) }
+          looped = answer { @through_loop.call(domain, model, args) }
+          return if projected == looped
+
+          "#{domain}.#{model.query_name}(#{id}): the projection answered #{JSON.generate(projected)}, " \
+            "the loop answered #{JSON.generate(looped)}"
+        end
+
+        # The answer as plain data, or the refusal it raised, so a path that refuses where the
+        # other answers is a disagreement too.
+        def answer
+          JSON.parse(JSON.generate(yield))
+        rescue StandardError => e
+          { "refused" => "#{e.class}: #{e.message}" }
+        end
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/projection_agreement.rb

@@ -0,0 +1,68 @@
+require_relative "isolated_boot"
+require_relative "replay"
+require_relative "projection_agreement/binding"
+require_relative "projection_agreement/comparison"
+
+module Hecks
+  module Fuzzing
+    # Whether a projection answers a rooted read model the way the in-process loop answers it
+    # from the authoritative records (ADR 0122): the `client_native_read_model` agreement.
+    module ProjectionAgreement
+      # The name a finding is reported under, beside the standard battery's.
+      PROPERTY = :projected_read_models_agree_with_loop
+
+      # Each fuzz adapter that has a projection, and the projection adapter it checks.
+      ADAPTERS = { sqlite: "SqliteProjection", postgres: "PostgresProjection" }.freeze
+
+      module_function
+
+      # Boots a copy of the domain on Memory with every bluebook `projected_by` the projection
+      # `projection` names, replays the steps, catches every projection up, and compares the
+      # two answers to every rooted read model for every record its reference can name.
+      #
+      # @param domain_path [String] the domain directory
+      # @param steps [Array<Hash>] the sequence to replay
+      # @param projection [Symbol] `:sqlite` (`SqliteProjection`) or `:postgres`
+      #   (`PostgresProjection`, needing a reachable local Postgres)
+      # @param scratch [Hash] `database:` and `schema:` of the Postgres projection; default the
+      #   fuzz database and a schema of its own beside the process's scratch schema
+      # @return [Array<String>] one message per disagreement; empty when every answer agrees
+      # @raise [ArgumentError] if `projection` is not `:sqlite` or `:postgres`
+      def check(domain_path, steps, projection: :sqlite, **scratch)
+        run(domain_path, steps, projection: projection, **scratch).offenders
+      end
+
+      # The same comparison as `check`, answering how many asks it compared beside what
+      # disagreed, so a caller can tell an agreement from a run with nothing to compare.
+      #
+      # @param (see #check)
+      # @return [Comparison::Outcome] `offenders` and `compared`, the asks answered both ways
+      # @raise (see #check)
+      def run(domain_path, steps, projection: :sqlite, **scratch)
+        IsolatedBoot.call(domain_path, adapter: :memory) do |copy|
+          Binding.bind!(copy, projection, **scratch)
+          runtime = Hecks.boot(copy, environment: nil)
+          Replay::Session.new(runtime).play(steps)
+          Comparison.new(runtime.registry).outcome
+        end
+      end
+
+      # Whether a fuzz sweep on `adapter` runs this check.
+      #
+      # @param adapter [Symbol] the sweep's persistence adapter
+      # @return [Boolean] true for `:sqlite` and `:postgres`
+      def checks?(adapter) = ADAPTERS.key?(adapter)
+
+      # The check as a sweep reports a property: true, or the disagreements joined.
+      #
+      # @param domain_path [String] the domain directory
+      # @param steps [Array<Hash>] the sequence to replay
+      # @param adapter [Symbol] the sweep's persistence adapter, `:sqlite` or `:postgres`
+      # @return [true, String] true when every answer agrees, else each disagreement
+      def property(domain_path, steps, adapter)
+        offenders = check(domain_path, steps, projection: adapter)
+        offenders.empty? || offenders.join("; ")
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/properties/aggregation_recompute.rb

@@ -106,7 +106,7 @@ module Hecks
         # The names of `aggregate`'s attributes referencing the read model's root.
         def foreign_key_fields(aggregate, model)
           aggregate.attributes.select do |attribute|
-            attribute.reference? && attribute.type.target_name == model.reference_target.to_s
+            attribute.reference? && attribute.target_name == model.reference_target.to_s
           end.map(&:name)
         end
 

data/lib/hecks/fuzzing/properties/bulk_parity.rb

@@ -0,0 +1,118 @@
+require_relative "../../bulk/sweep"
+require_relative "../../runtime/errors"
+
+module Hecks
+  module Fuzzing
+    module Properties
+      # Property: a bulk run's per-row outcomes, and the records it leaves, equal dispatching each
+      # row by hand (ADR 0125). Like `replay_is_deterministic` it boots twice itself, so it is not
+      # in the battery `check` runs over one history.
+      module BulkParity
+        # One command sent over one query: a non-creating command addressed by a row of the
+        # query's aggregate and needing no other argument, and a query that takes none.
+        Pair = Struct.new(:verb, :over, :key, keyword_init: true) do
+          # @return [String] how a finding names the pair
+          def label = "#{verb} over #{over}"
+        end
+
+        # Replays `steps` twice. After the first, every pair is swept as a bulk run; after the
+        # second, every row of every pair is dispatched by hand, in the order the query answers.
+        # Each pair's outcomes and the records left after it must agree.
+        #
+        # @param domain_path [String] the domain directory
+        # @param steps [Array<Hash>] a generated or recorded step list
+        # @param adapter [Symbol] the persistence both boots are bound to
+        # @return [true, String] true when they agree, or not applicable; otherwise the first pair
+        #   whose outcomes or records differ
+        def bulk_runs_match_hand_dispatch(domain_path, steps, adapter: :memory)
+          return true unless BulkParity.attaches_bulk?(domain_path)
+
+          swept   = BulkParity.played(domain_path, steps, adapter) { |runtime, pair| BulkParity.swept(runtime, pair) }
+          by_hand = BulkParity.played(domain_path, steps, adapter) { |runtime, pair| BulkParity.by_hand(runtime, pair) }
+          BulkParity.verdict(swept, by_hand)
+        end
+
+        module_function
+
+        # Whether a hecksagon of the domain attaches the Bulk bluebook: only such a domain can run
+        # a bulk run, so only its seeds pay for the two extra boots.
+        #
+        # @param domain_path [String] the domain directory
+        # @return [Boolean]
+        def attaches_bulk?(domain_path)
+          Dir.glob(File.join(domain_path, "**", "*.hecksagon")).any? { |path| File.read(path).include?('attaches "Bulk"') }
+        end
+
+        # Boots a copy, plays `steps`, then runs the block once per pair in order.
+        #
+        # @return [Array<Array>] per pair: its label, the block's outcomes, and the records after it
+        def played(domain_path, steps, adapter)
+          IsolatedBoot.call(domain_path, adapter: adapter) do |copy|
+            runtime = Hecks.boot(copy, environment: nil)
+            Replay::Session.new(runtime).play(steps)
+            pairs(runtime).map { |pair| [pair.label, yield(runtime, pair), Replay.snapshot_instances(runtime)] }
+          end
+        end
+
+        # The first pair the two runs disagree on, or true.
+        def verdict(swept, by_hand)
+          index = swept.each_index.find { |at| swept[at] != by_hand[at] }
+          return true unless index
+
+          label, outcomes, = swept[index]
+          "#{label}: a bulk run answered #{outcomes.inspect}, dispatching each row by hand " \
+            "#{by_hand[index][1].inspect}#{" and left different records" if outcomes == by_hand[index][1]}"
+        end
+
+        # Every pair the booted bluebooks declare, in declaration order.
+        #
+        # @param runtime [Runtime::Runtime] the booted domain
+        # @return [Array<Pair>]
+        def pairs(runtime)
+          runtime.bluebooks.flat_map do |domain, bluebook|
+            bluebook.aggregates.flat_map { |aggregate| aggregate_pairs("#{domain}::#{aggregate.hecks_name}", aggregate) }
+          end
+        end
+
+        def aggregate_pairs(fqn, aggregate)
+          queries = aggregate.queries.select { |query| query.attributes.empty? }
+          aggregate.commands.reject(&:creates?).flat_map do |command|
+            key = sole_key(command, aggregate)
+            next [] unless key
+
+            queries.map { |query| Pair.new(verb: "#{fqn}.#{command.hecks_name}", over: "#{fqn}.#{query.hecks_name}", key: key) }
+          end
+        end
+
+        # The key a row of `aggregate` addresses `command` by, when it needs no other argument.
+        def sole_key(command, aggregate)
+          key = command.addressing_key_for(aggregate.hecks_name)
+          key if key && command.attributes.all? { |attribute| attribute.optional? || attribute.name == key }
+        end
+
+        # The pair sent as a bulk run.
+        def swept(runtime, pair)
+          plan = Bulk::Plan.new(verb: pair.verb, over: pair.over, arguments: {})
+          Bulk::Sweep.new(runtime.registry, plan).outcomes
+        rescue StandardError => e
+          [:crashed, e.class.name]
+        end
+
+        # The pair's rows read once, then each dispatched by hand: the oracle, sharing nothing
+        # with the bulk run's row sweep.
+        def by_hand(runtime, pair)
+          runtime.query(pair.over).map { |row| hand_dispatch(runtime, pair, row[:id]) }
+        rescue StandardError => e
+          [:crashed, e.class.name]
+        end
+
+        def hand_dispatch(runtime, pair, id)
+          runtime.dispatch_flat(pair.verb, pair.key => id)
+          { row: id.to_s, delivered: true }
+        rescue *Runtime::DOMAIN_REFUSALS => e
+          { row: id.to_s, delivered: false, reason: e.message }
+        end
+      end
+    end
+  end
+end

data/lib/hecks/fuzzing/properties/catalog.rb

@@ -19,6 +19,8 @@ module Hecks
         :dispatch_binding_fidelity,
         :mutations_match_recompute,
         :dry_runs_leave_no_trace,
+        :validation_agrees_with_dry_run,
+        :refusals_leave_no_trace,
         :corrections_reference_an_emitted_event,
         :outbox_rows_match_reactions,
         :policy_reactions_follow_declared_wiring,
@@ -59,6 +61,11 @@ module Hecks
         # a word a bluebook declares. Listed empty rather than omitted, so every
         # property still names what it is answerable for.
         dry_runs_leave_no_trace:                          [],
+        # `Dispatcher#validate` against `Dispatcher#dry_run?`: two runtime entry points, no grammar
+        # word.
+        validation_agrees_with_dry_run:                   [],
+        # Every refusal kind, whichever rule raised it, so no one construct answers for it.
+        refusals_leave_no_trace:                          [],
         # Another runtime entry point, not a grammar construct — same reasoning as
         # dry_runs_leave_no_trace above.
         outbox_rows_match_reactions:                      [],

data/lib/hecks/fuzzing/properties/cursor_walks.rb

@@ -0,0 +1,56 @@
+module Hecks
+  module Fuzzing
+    module Properties
+      # The property that holds a cursor query's pages to its unpaged answer (ADR 0130). Mixed into
+      # {Querying}, whose recomputation helpers it reads.
+      module CursorWalks
+        # Walks every cursor query's pages and holds the walk to the unpaged query: the same rows,
+        # in the same order, none twice, each page within the page size and every page but the
+        # last full.
+        #
+        # The unpaged answer is recomputed from `history[:instances]` through the shared ordering,
+        # so the property does not check the pages against the keyset rule they were cut by. The
+        # replay walked each query at its own page size and again one row at a time, on whichever
+        # adapter the replay booted, so the property holds on each of them.
+        #
+        # @param history [Hash] a replayed history as returned by `Replay.call`
+        # @return [true, String] true, or a message naming each walk that differs
+        def cursor_walk_yields_the_unpaged_rows(history)
+          bluebooks = history.fetch(:bluebooks)
+          offenders = history.fetch(:queries).flat_map { |asked| cursor_offenses(bluebooks, asked) }
+          offenders.empty? || offenders.join("; ")
+        end
+
+        # The messages for one cursor ask whose walks differ from the unpaged rows.
+        def cursor_offenses(bluebooks, asked)
+          return [] unless asked[:pages]
+
+          declared = query_for_verb(bluebooks, asked[:query])
+          args = normalized_args(bluebooks, asked, declared)
+          expected = ordered_rows(eligible_rows_for(bluebooks, asked, declared, args), declared)
+          asked[:pages].filter_map { |walk| walk_offense(asked, declared, args, walk, expected) }
+        end
+
+        def walk_offense(asked, declared, args, walk, expected)
+          pages = walk.fetch(:pages)
+          size = [resolve_paging_value(declared.limit.value, args).to_i, walk[:page_size] || Float::INFINITY].min
+          return if pages.flatten(1) == expected && pages_fit?(pages, size)
+
+          "#{asked[:query]} #{args.inspect} walked at page size #{size}: #{walk_summary(pages, expected)}"
+        end
+
+        def walk_summary(pages, expected)
+          "#{pages.map(&:length).inspect} rows a page, #{row_ids(pages.flatten(1)).inspect} in all, " \
+            "but the unpaged query is #{row_ids(expected).inspect}"
+        end
+
+        def row_ids(rows) = rows.map { |row| row[:id] }
+
+        # Every page holds at most `size` rows and every page but the last holds exactly that many.
+        def pages_fit?(pages, size)
+          pages.all? { |page| page.length <= size } && pages[0...-1].all? { |page| page.length == size }
+        end
+      end
+    end
+  end
+end