hecks 6.0.0 → 7.0.0

data/lib/hecks/workflow_pagination.rb

@@ -0,0 +1,58 @@
+require_relative "workflow_pagination/statement"
+require_relative "workflow_pagination/judge"
+
+module Hecks
+  # Finds the GitHub list calls in a workflow that count or wait for items and read only the first
+  # page of them.
+  #
+  # The artifact wait of a CI run counted four named artifacts among a run's list, and went on
+  # waiting its full time once the run held 35, because the list pages at 30 and the fourth sat on
+  # the second page.
+  #
+  # @example
+  #   WorkflowPagination.check(root: ".")
+  module WorkflowPagination
+    # The files that hold workflow steps.
+    GLOBS = %w[.github/workflows/*.yml .github/workflows/*.yaml .github/actions/**/*.yml .github/actions/**/*.yaml].freeze
+
+    # The clean verdict.
+    CLEAN = "no workflow counts a GitHub list from its first page".freeze
+
+    # The words that start an API call in a step.
+    CALL = /gh api|api\.github\.com/
+
+    # Raised with every finding.
+    class Failure < StandardError; end
+
+    module_function
+
+    # @param root [String] the checkout
+    # @return [String] the clean verdict
+    # @raise [Failure] with a line for each call that reads one page
+    def check(root:)
+      found = findings(root)
+      raise Failure, found.join("\n") unless found.empty?
+
+      CLEAN
+    end
+
+    # @return [Array<String>] `file:line: fault` for each call that reads one page
+    def findings(root)
+      GLOBS.flat_map { |glob| Dir.glob(File.join(root, glob)) }.sort.flat_map do |file|
+        faults(file).map { |line, fault| "#{file.delete_prefix("#{root}/")}:#{line}: #{fault}" }
+      end
+    end
+
+    # @return [Array<Array(Integer, String)>] the line and the fault of each bad call in a file
+    def faults(file)
+      lines = File.readlines(file, encoding: "UTF-8")
+      lines.each_index.filter_map do |index|
+        next if lines[index].lstrip.start_with?("#") || !lines[index].match?(CALL)
+
+        call = Statement.new(lines, index)
+        fault = Judge.fault(call)
+        [call.line, fault] if fault
+      end
+    end
+  end
+end

data/lib/hecks.rb

@@ -4,6 +4,7 @@ require_relative "hecks/version"
 # them are read while a bluebook is still being parsed.
 require_relative "hecks/vocabulary"
 require_relative "hecks/rendering"
+require_relative "hecks/secrets"
 require_relative "hecks/naming"
 require_relative "hecks/text"
 require_relative "hecks/fqn"
@@ -31,6 +32,7 @@ require_relative "hecks/projections"
 # After `Projector`, which dispatches against the `:cli` projection.
 require_relative "hecks/adapters/driving/cli"
 require_relative "hecks/adapters/driving/usage_cache"
+require_relative "hecks/adapters/driving/usage_log"
 require_relative "hecks/adapters/driving/cli_runner"
 require_relative "hecks/storehouse"
 require_relative "hecks/mcp_stdio_guard"

data/lib/rubocop/cop/hecks/bare_event_and_query_names.rb

@@ -0,0 +1,58 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # Flags a quoted event or query name where its constant belongs: `starts_on "Message.Sent"`,
+      # `on "Sent"`, `trigger`, `for_each`, or a transition key `"Churn" => "churned"`. The constant
+      # fails when the bluebook loads; the string fails only at run time.
+      #
+      # Quoted state names stay quoted: a transition target and a `from:` name a state.
+      #
+      # @example
+      #   starts_on "Message.Sent"                          # bad
+      #   starts_on Message::Sent                           # good
+      #   transition "Churn" => "churned", from: "active"   # bad: the key names a command
+      #   transition Churn => "churned", from: "active"     # good
+      class BareEventAndQueryNames < Base
+        MSG = "`\"%<name>s\"` names an event or query by its string. Name it by its constant, " \
+              "`%<const>s`, so a misspelling fails at load.".freeze
+
+        STRING_NAMED_CALLS = %i[starts_on on trigger for_each].freeze
+        # `Message.Sent` (Aggregate.Name) or a bare `Sent`: a capitalised event or query name.
+        EVENT_NAME = /\A(?:[A-Z]\w*\.)?[A-Z]\w*\z/
+
+        # Flags a quoted event or query name passed to a call that takes one, or as a key.
+        #
+        # @param node [RuboCop::AST::SendNode] the call being visited
+        # @return [void]
+        def on_send(node)
+          return unless node.receiver.nil?
+
+          if STRING_NAMED_CALLS.include?(node.method_name)
+            flag_string_arguments(node)
+          elsif node.method_name == :transition
+            flag_transition_keys(node)
+          end
+        end
+
+        private
+
+        def flag_string_arguments(node)
+          node.arguments.each { |argument| flag_name(argument) if argument.str_type? }
+        end
+
+        def flag_transition_keys(node)
+          node.arguments.select(&:hash_type?).each do |hash|
+            hash.pairs.each { |pair| flag_name(pair.key) if pair.key.str_type? }
+          end
+        end
+
+        def flag_name(node)
+          name = node.value
+          return unless EVENT_NAME.match?(name)
+
+          add_offense(node, message: format(MSG, name: name, const: name.split(".").join("::")))
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hecks/correlates_by_aggregate.rb

@@ -0,0 +1,39 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # Flags `correlates_by "Message.id"` (or `:"Message.id"`) where the bare aggregate name
+      # `correlates_by Message` says the same thing. A bare name correlates by the aggregate's
+      # identity, so the dotted path only repeats it.
+      #
+      # A dotted path into a field (`:"widget.id"`, a lowercase head) is a field path, not an
+      # aggregate's identity, and is left alone.
+      #
+      # @example
+      #   correlates_by "Message.id"    # bad
+      #   correlates_by Message         # good
+      #   correlates_by :"widget.id"    # good: a field path
+      class CorrelatesByAggregate < Base
+        MSG = "`correlates_by \"%<key>s\"` names the aggregate's id by a dotted path. A bare aggregate " \
+              "name correlates by its identity, so write `correlates_by %<name>s`.".freeze
+
+        AGGREGATE_ID = /\A([A-Z]\w*)\.id\z/
+
+        # Flags an aggregate's id named by a dotted path when the bare aggregate name would do.
+        #
+        # @param node [RuboCop::AST::SendNode] the `correlates_by` call being visited
+        # @return [void]
+        def on_send(node)
+          return unless node.receiver.nil? && node.method_name == :correlates_by
+
+          key = node.first_argument
+          return unless key && (key.str_type? || key.sym_type?)
+
+          match = AGGREGATE_ID.match(key.value.to_s)
+          return unless match
+
+          add_offense(key, message: format(MSG, key: key.value, name: match[1]))
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hecks/creating_command_sets.rb

@@ -0,0 +1,75 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # Flags a creating command's attribute that no `sets` copies onto the aggregate. A command
+      # with no `reference_to` to its own aggregate creates one, so each attribute must be set.
+      #
+      # @example
+      #   command "Print" do
+      #     attribute :ref, StickerRef     # bad unless `sets :ref`
+      #   end
+      class CreatingCommandSets < Base
+        MSG = "Command `%<command>s` creates its aggregate, so its attribute `%<name>s` must be set " \
+              "onto it. Add `sets :%<name>s`.".freeze
+
+        # Flags each attribute of a creating command with no matching `sets`.
+        #
+        # @param node [RuboCop::AST::BlockNode] the command block being visited
+        # @return [void]
+        def on_block(node)
+          return unless node.send_node.receiver.nil? && node.method_name == :command
+
+          aggregate = owner_aggregate(node)
+          return unless aggregate
+          return if references_own_aggregate?(node, aggregate.send_node.first_argument.value)
+
+          unset_attributes(node).each { |statement, name| flag(statement, node, name) }
+        end
+
+        private
+
+        def owner_aggregate(node)
+          node.each_ancestor(:block).find { |block| block.method_name == :aggregate }
+        end
+
+        def flag(statement, node, name)
+          command = node.send_node.first_argument.value
+          add_offense(statement, message: format(MSG, command: command, name: name))
+        end
+
+        # Each `attribute :x` of the command whose `sets :x` is missing, with its name.
+        def unset_attributes(node)
+          statements = direct_statements(node)
+          sets = statements.filter_map { |statement| symbol_argument(statement, :sets) }
+          statements.filter_map do |statement|
+            name = symbol_argument(statement, :attribute)
+            [statement, name] if name && !sets.include?(name)
+          end
+        end
+
+        def references_own_aggregate?(node, aggregate_name)
+          direct_statements(node).any? do |statement|
+            statement.send_type? && statement.method_name == :reference_to &&
+              statement.first_argument&.const_type? &&
+              statement.first_argument.const_name == aggregate_name
+          end
+        end
+
+        # The symbol a one-argument call names, as in `sets :ref` or `attribute :ref, Type`.
+        def symbol_argument(statement, method)
+          return unless statement.send_type? && statement.method_name == method
+          return unless statement.first_argument&.sym_type?
+
+          statement.first_argument.value
+        end
+
+        def direct_statements(block)
+          body = block.body
+          return [] unless body
+
+          body.begin_type? ? body.children : [body]
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hecks/invariant_expression_language.rb

@@ -0,0 +1,47 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # Flags a call the bluebook expression language cannot evaluate, inside an `invariant` or
+      # `given` block. The language refuses these with "the expression language cannot evaluate",
+      # so the bluebook fails at boot, not where the check was written.
+      #
+      # The language compares with `==`, `!=` and `>=`, joined by `||` and `&&`.
+      #
+      # @example
+      #   invariant("a flag is yes or no") { value.include?("yes") }    # bad
+      #   invariant("a flag is yes or no") { value == "yes" || value == "no" }   # good
+      #   invariant("a name is present") { name.empty? }                # bad
+      #   invariant("a name is present") { name != "" }                 # good
+      class InvariantExpressionLanguage < Base
+        MSG = "`%<source>s` is outside the expression language, which cannot evaluate it. Spell the " \
+              "test out: `==` joined by `||` for a set of values, or `!= \"\"` for a non-empty test.".freeze
+
+        CHECKED_BLOCKS = %i[invariant given].freeze
+        UNSUPPORTED_CALLS = %i[include? length to_s empty? between?].freeze
+
+        # Flags an unsupported call or a `%w[...]` list in an `invariant` or `given` block.
+        #
+        # @param node [RuboCop::AST::BlockNode] the block being visited
+        # @return [void]
+        def on_block(node)
+          return unless node.send_node.receiver.nil? && CHECKED_BLOCKS.include?(node.method_name)
+          return unless node.body
+
+          node.body.each_node(:send, :array) do |child|
+            next unless unsupported?(child)
+
+            add_offense(child, message: format(MSG, source: child.source))
+          end
+        end
+
+        private
+
+        def unsupported?(node)
+          return node.source.start_with?("%w") if node.array_type?
+
+          node.send_type? && UNSUPPORTED_CALLS.include?(node.method_name)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hecks/lifecycle_needs_attribute.rb

@@ -0,0 +1,58 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # Flags a `lifecycle :x` whose owner (the nearest `aggregate` or `entity`) declares no
+      # `attribute :x`. A lifecycle moves a value that its owner must hold.
+      #
+      # @example
+      #   lifecycle :status, default: "open" do   # bad unless `attribute :status`
+      #   end
+      class LifecycleNeedsAttribute < Base
+        MSG = "`lifecycle :%<name>s` has no state to hold: `%<owner>s` declares no " \
+              "`attribute :%<name>s`. Declare the attribute the lifecycle tracks.".freeze
+        OWNERS = %i[aggregate entity].freeze
+
+        # Flags a lifecycle whose owner declares no attribute of the same name.
+        #
+        # @param node [RuboCop::AST::SendNode] the `lifecycle` call being visited
+        # @return [void]
+        def on_send(node)
+          return unless node.receiver.nil? && node.method_name == :lifecycle
+          return unless node.first_argument&.sym_type?
+
+          owner = owner_block(node)
+          return unless owner
+
+          name = node.first_argument.value
+          return if attribute_names(owner).include?(name)
+
+          add_offense(node, message: format(MSG, name: name, owner: owner.send_node.first_argument.value))
+        end
+
+        private
+
+        def owner_block(node)
+          node.each_ancestor(:block).find do |block|
+            OWNERS.include?(block.method_name) && block.send_node.receiver.nil?
+          end
+        end
+
+        def attribute_names(owner)
+          direct_statements(owner).filter_map do |statement|
+            next unless statement.send_type? && statement.method_name == :attribute
+            next unless statement.first_argument&.sym_type?
+
+            statement.first_argument.value
+          end
+        end
+
+        def direct_statements(block)
+          body = block.body
+          return [] unless body
+
+          body.begin_type? ? body.children : [body]
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hecks/no_id_string_attribute.rb

@@ -0,0 +1,49 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # Flags a plain-string attribute that holds another record's id, such as
+      # `attribute :teacher_id, String`. Declare `reference_to` so the domain holds the record.
+      # A query's argument is exempt: `attribute :author_id, String` names a caller's value.
+      #
+      # @example
+      #   attribute :teacher_id, String          # bad
+      #   reference_to Person, as: :teacher      # good
+      #
+      #   query "ByAuthor" do
+      #     attribute :author_id, String         # good: a caller's argument
+      #     where author: :author_id
+      #   end
+      class NoIdStringAttribute < Base
+        MSG = "`%<name>s` stores another record's id as a string. Declare `reference_to %<target>s, as: :%<role>s` " \
+              "so the domain holds the reference, and let the adapter map the school's ids.".freeze
+
+        # @!method id_string_attribute?(node)
+        def_node_matcher :id_string_attribute?, <<~PATTERN
+          (send nil? :attribute $(sym _) (const nil? :String))
+        PATTERN
+
+        # Flags an `attribute :x_id, String` declared outside a `query`.
+        #
+        # @param node [RuboCop::AST::SendNode] the call being visited
+        # @return [void]
+        def on_send(node)
+          id_string_attribute?(node) do |name_node|
+            name = name_node.value.to_s
+            return unless name.end_with?("_id")
+            return if inside_query?(node)
+
+            role = name.delete_suffix("_id")
+            add_offense(node, message: format(MSG, name: name, target: role.capitalize, role: role))
+          end
+        end
+
+        private
+
+        # True when the attribute sits in a `query` block, at any depth.
+        def inside_query?(node)
+          node.each_ancestor(:block).any? { |block| block.method_name == :query }
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hecks/one_terminal_mark_per_lifecycle.rb

@@ -0,0 +1,47 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # Flags a second `mark :terminal` line in one lifecycle. A lifecycle names its terminal states
+      # once, on one line, so the set reads in one place and a state cannot be left out of it.
+      #
+      # @example
+      #   lifecycle :status, default: "open" do
+      #     mark :terminal, "closed"
+      #     mark :terminal, "void"                  # bad
+      #   end
+      #
+      #   lifecycle :status, default: "open" do
+      #     mark :terminal, "closed", "void"        # good
+      #   end
+      class OneTerminalMarkPerLifecycle < Base
+        MSG = "A lifecycle takes one `mark :terminal` line. Name every terminal state on that line, as " \
+              "`mark :terminal, \"a\", \"b\"`.".freeze
+
+        # Flags every `mark :terminal` after the first in a lifecycle block.
+        #
+        # @param node [RuboCop::AST::BlockNode] the lifecycle block being visited
+        # @return [void]
+        def on_block(node)
+          return unless node.send_node.receiver.nil? && node.method_name == :lifecycle
+
+          marks = direct_statements(node).select { |statement| terminal_mark?(statement) }
+          marks.drop(1).each { |mark| add_offense(mark, message: MSG) }
+        end
+
+        private
+
+        def terminal_mark?(node)
+          node.send_type? && node.method_name == :mark &&
+            node.first_argument&.sym_type? && node.first_argument.value == :terminal
+        end
+
+        def direct_statements(block)
+          body = block.body
+          return [] unless body
+
+          body.begin_type? ? body.children : [body]
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/hecks/value_object_shorthand.rb

@@ -0,0 +1,56 @@
+module RuboCop
+  module Cop
+    module Hecks
+      # Flags a value object block that only wraps one `value` attribute with no invariant.
+      # The shorthand says the same thing in one line: `value_object "Name", Type`.
+      #
+      # A block with an invariant, or with any other attribute, is left alone: the block is the
+      # only place an invariant can go.
+      #
+      # @example
+      #   value_object "EmailAddress" do            # bad
+      #     attribute :value, String
+      #   end
+      #
+      #   value_object "EmailAddress", String       # good
+      class ValueObjectShorthand < Base
+        MSG = "`value_object \"%<name>s\"` holds one value with no invariant, so declare it as " \
+              "`value_object \"%<name>s\", %<type>s`.".freeze
+
+        # Flags a `value_object` block whose whole body is `attribute :value, Type`.
+        #
+        # @param node [RuboCop::AST::BlockNode] the block being visited
+        # @return [void]
+        def on_block(node)
+          return unless value_object_block?(node)
+          return unless single_value_attribute?(node.body)
+
+          send = node.send_node
+          add_offense(send, message: offense_message(send, node.body))
+        end
+
+        private
+
+        # A `value_object "Name"` call with no receiver and a string name.
+        def value_object_block?(node)
+          send = node.send_node
+          send.receiver.nil? && send.method_name == :value_object && send.first_argument&.str_type?
+        end
+
+        def offense_message(send, body)
+          type = body.arguments.last.const_name || body.arguments.last.source
+          format(MSG, name: send.first_argument.value, type: type)
+        end
+
+        # The body is exactly one `attribute :value, Type` call.
+        def single_value_attribute?(body)
+          return false unless body&.send_type?
+          return false unless body.method_name == :attribute && body.arguments.size == 2
+
+          name, type = body.arguments
+          name.sym_type? && name.value == :value && type.const_type?
+        end
+      end
+    end
+  end
+end

data/qa/settings.yml

@@ -61,6 +61,29 @@ generated_domains_per_tick: 2
 generated_domains_rust: true
 generated_domain_seeds: 5
 
+# The quick gate on local main, the tick's last finding step: each red check becomes a bug, and a
+# self-contained one is fixed, gated, landed and pushed.
+red_main_check: true
+
+# The event pump, the tick's last step: each attached domain's policies react to the events past their
+# cursors. `hecks quality_control event_pump.pump!` runs it by hand whatever this says.
+event_pump: true
+
+# The push check, once per tick: a push of local main that is due beyond the QualityControl world's
+# `push_nudge` thresholds is one `push-due` Work row, revised while due and finished when not. It reads
+# refs git already holds and pushes nothing.
+push_nudge: true
+
+# A quiet tick for a mint window: true makes every step print `quiesced: skipped <step>` and the tick exit 0.
+# A running tick also stops at the marker `hecks qa_quiesce.hold!` writes (a stale one is ignored), so prefer that
+# for a window; this dial is for a standing pause.
+quiesced: false
+
+# The main-maintenance chain after the red-main step: the quick gate on main, the reconcile plan, and the push
+# through the train when origin is behind. `maintenance_confirm` lets the reconcile write; false keeps it a dry run.
+main_maintenance: true
+maintenance_confirm: false
+
 # The Rust kernel's mutation test, run by each tick after the generated domains (about 8 minutes).
 # The two equivalents compare positions where `<` and `<=` cannot differ.
 mutation_files:

data/rust/.gitignore

@@ -1,8 +1,2 @@
 /target
 /dist
-
-# Generated from the bluebooks by `hecks regeneration_run.regenerate_corpus --confirm`; mod.rs and the
-# Cargo features stay tracked. pizzas stays committed: its translations carry SQL only the Ruby
-# toolchain compiles, so hecks-build cannot reproduce it.
-/src/generated/*/
-!/src/generated/pizzas/

data/rust/Cargo.toml

@@ -45,6 +45,7 @@ roster = []
 meta = []
 pizzas = []
 banking = []
+echo = []
 
 [package]
 name = "rust"
@@ -72,7 +73,7 @@ path = "src/main.rs"
 debug = 0
 
 # Clippy beyond its defaults: pedantic and nursery, plus the restriction lints that keep a panic
-# out of library code. `hecks gate_run.gate stage=ci only=rust_clippy` makes each of these an error.
+# out of library code. `hecks gate_run.gate! stage=ci only=rust_clippy` makes each of these an error.
 # The same table is in every crate's Cargo.toml; change them together.
 [lints.clippy]
 pedantic = { level = "warn", priority = -1 }

data/rust/build/Cargo.toml

@@ -19,7 +19,7 @@ path = "src/main.rs"
 debug = 0
 
 # Clippy beyond its defaults: pedantic and nursery, plus the restriction lints that keep a panic
-# out of library code. `hecks gate_run.gate stage=ci only=rust_clippy` makes each of these an error.
+# out of library code. `hecks gate_run.gate! stage=ci only=rust_clippy` makes each of these an error.
 # The same table is in every crate's Cargo.toml; change them together.
 [lints.clippy]
 pedantic = { level = "warn", priority = -1 }

data/rust/build/src/binding_pass.rs

@@ -77,7 +77,7 @@ fn persistence(
             let text = read(path)?;
             (
                 lineage_pass::persistence_binds(&text),
-                domain_default(&text, declaration),
+                domain_default(&text, declaration)?,
             )
         }
         None => (HashMap::new(), None),
@@ -115,7 +115,11 @@ fn persistence(
 
 // The bare `persisted_by "X"` line of the bluebook's own `Hecks.hecksagon` block: every aggregate
 // without a bind of its own inherits it. The last one in the block wins.
-fn domain_default(text: &str, declaration: &str) -> Option<String> {
+//
+// The line is read as text, not evaluated, so anything after the adapter's name (a guard such as
+// `if ENV[...]`, or an option) cannot be honored here. Such a line is refused rather than read as
+// an unconditional bind, because the build and the Ruby loader would then disagree on the adapter.
+fn domain_default(text: &str, declaration: &str) -> Result<Option<String>, String> {
     let mut in_bluebook = false;
     let mut found = None;
     for line in text.lines() {
@@ -130,11 +134,60 @@ fn domain_default(text: &str, declaration: &str) -> Option<String> {
             continue;
         };
         let quoted = &rest[open + 1..];
-        found = quoted.find('"').map(|close| quoted[..close].to_string());
+        let Some(close) = quoted.find('"') else {
+            found = None;
+            continue;
+        };
+        let after = quoted[close + 1..].trim();
+        if !after.is_empty() && !after.starts_with('#') {
+            return Err(format!(
+                "{declaration}'s hecksagon has `persisted_by` with `{after}` after the adapter; \
+                 the build cannot evaluate that, so the bind is refused. Remove the condition, \
+                 or wire the adapter in a hecksagon that applies to it."
+            ));
+        }
+        found = Some(quoted[..close].to_string());
     }
-    found
+    Ok(found)
 }
 
 fn read(path: &Path) -> Result<String, String> {
     std::fs::read_to_string(path).map_err(|e| format!("reading {}: {e}", path.display()))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::domain_default;
+
+    #[test]
+    fn a_bare_bind_names_the_domain_default() {
+        let text = "Hecks.hecksagon \"Miette\" do\n  persisted_by \"PostgresEra\"\nend\n";
+        assert_eq!(
+            domain_default(text, "Miette"),
+            Ok(Some("PostgresEra".to_string()))
+        );
+    }
+
+    #[test]
+    fn a_trailing_comment_is_not_a_condition() {
+        let text = "Hecks.hecksagon \"Miette\" do\n  persisted_by \"Memory\" # in-memory by default\nend\n";
+        assert_eq!(
+            domain_default(text, "Miette"),
+            Ok(Some("Memory".to_string()))
+        );
+    }
+
+    #[test]
+    fn a_guarded_bind_is_refused_not_read_as_unconditional() {
+        let text = "Hecks.hecksagon \"Miette\" do\n  persisted_by \"PostgresEra\" if ENV[\"MIETTE_LOCAL\"]\nend\n";
+        let err = domain_default(text, "Miette").unwrap_err();
+        assert!(err.contains("`if ENV[\"MIETTE_LOCAL\"]`"), "{err}");
+    }
+
+    #[test]
+    fn a_bind_in_another_bluebook_is_ignored() {
+        let text =
+            "Hecks.hecksagon \"Other\" do\n  persisted_by \"PostgresEra\" if ENV[\"X\"]\nend\n";
+        assert_eq!(domain_default(text, "Miette"), Ok(None));
+    }
+}