hecks

Unbuilt

Status: snapshot, compiled 2026-08-18. Items may have shipped since. Read it as a list of what was unbuilt that day, not as the current backlog.

Every planned, proposed, and not-yet-built feature collected across hecks’s implementation plan, PRDs, work-slice plans, decision records, guides, and bug audits — with the shipped and the live left out.

Sources: 20+ docs across docs/, docs/prds/, docs/decisions/, docs/guides/, docs/audits/ (as of the 2026-08-18 docs/ split into docs/implemented/ vs. active work — see that split for what’s now shipped). Compiled: 2026-08-18

Top priorities

The clearest signal in the whole tree is the survey’s own closing pick — an explicit “if we build three.” Everything else here ranks by how concretely it’s scoped and how much else depends on it.

A universal dispatch MCP server — dispatch / query / state / catalog / describe / validate, every call carrying a required summary. hecks run and the Facade already exist to project it from.
follow + SourceTag — persist the dispatch stream already emitted (event log plus caller kind: process-manager / operator / hook / sidequest-agent / cascade / daemon), add a JSONL tail and a hecks follow.
Drivers — driving on interval | cron | clock in the hecksagon DSL, projected to a Makefile/Procfile target. An older, separate project that is also called hecks (see the editor’s note in the survey linked below) was blocked on this.

Highest-signal items from the rest of the corpus

~~Reaction-depth race (PRD 01)~~ — Fixed. reenter in dispatcher.rb reads/writes Thread.current[:hecks_reaction_depth], not a shared ivar; verified live 2026-08-27.
~~Fuzzer against real adapters (PRD 02)~~ — Fixed. IsolatedBoot/hecks fuzz support adapter=memory|sqlite|postgres (memory unchanged default). Sqlite runs at roughly Memory’s own cost with zero extra config; Postgres needs a real reachable local server (same reachability gate every other real-Postgres spec in this repo uses) and pays a real round trip per dispatch — noticeably slower, so reach for smaller --seeds/--steps than the Memory/Sqlite default rather than treating it as a like-for-like swap. Running it against examples/banking surfaced a real, previously-unreachable bug on first use (Postgres’s SchemaBuilder#index_field! mishandled a reference-hop query field — owner/field, the language’s own cross-aggregate query-path convention — as a plain identifier, producing invalid SQL and blocking boot entirely); fixed alongside this PRD, lib/hecks/adapters/driven/postgres/schema_builder.rb. Whether a hop-path field can be queried (not just indexed) against a SQL adapter is answered too, and it works: Runtime::ReferenceHop.apply folds a hop where-clause into a local in: clause before any adapter sees it, and order_by on a hop is refused at DSL-seal time on every adapter. spec/adapters/query_hop_agreement_spec.rb pins it against real Sqlite, Postgres and PostgresEra. CI runs the sweep on every PR: checks_fuzz (Memory, every domain, 20 seeds), checks_fuzz_sqlite (every domain, 6 seeds) and checks_fuzz_postgres (every domain, 3 seeds of 20 steps, one process against one Postgres).
~~Audit Tier 1, findings H3–H5~~ — Fixed, verified live/against real Postgres 2026-08-27 (era-migrated-delete tombstoning, rekey SQL folded into the approval digest, dotted-compute no longer exempting its whole parent attribute from the Layer-2 gate).
Drivers / Gates / mailboxes / OutboundEvent / derivability gauge — a coherent “operational surface around the bus” that hecks has built and hecks lacks entirely (survey items 3, 5, 6, 7, 8).
ADR 0025’s DSL cleanup — a fully sequenced 15-step plan; the single largest concretely-scoped item among the decision records.
Query-DSL aggregation — count / sum / avg / min / max plus group_by. Flagged as the sharpest, most requested gap in the query language. Partly shipped: read_model already has count, median and group_by (ADRs 0050, 0052); what is open is sum and a group_by that reduces, and group_by silently drops rows on a non-unique key. Design and recommendation (draft): ADR 0061.

Wishlist survey

docs/archive/hecks-survey-what-we-wish-we-had.md — a 2026-08-17 read of an older, separate project that is also called hecks, asking one question: what does it have — especially “Storehouse” — that hecks wishes it had.

Storehouse, ranked

Universal MCP server, three zoom levels. Ten tools (dispatch, query, state, catalog, describe_aggregate, list_aggregates, validate, macrophage_check, behaviors, conceive_behaviors), no per-command wrappers. hecks has only a 3-tool query-IR MCP.
follow. A live, cross-process tail of every dispatch, feeding both an MCP resource and a queryable StorehouseEntry domain. hecks has only after-the-fact hecks history.
Drivers. Inbound clocks (interval | cron | clock) declared in the hecksagon, projected to a Procfile — out-of-process by construction, so a dead clock stalls only its own task. hecks’s DSL has no inbound-scheduling concept at all.
SourceTag. A closed enum of dispatcher provenance. Cheap to add.
Gates. Inbound middleware as bluebook records — before/after phase, a check that can be any bluebook query run read-only as a veto, ordered, hydrated at boot. hecks’s authz today is one hardcoded file with no query-as-veto, ordering, or after-phase observers.
Actor mailboxes. poisoned as a first-class status, plus --json and a --fixture deterministic demo mode for inspection tooling.
A standing derivability gauge. A periodic driver that folds the full event log and records derivable | drifted, separating transient from persistent drift and tracking missing rows on their own. hecks has no continuous proof that the fold of its log equals its state.
OutboundEvent. A durable outbox (pending → claimed → delivered | failed) for effect-port edges with idempotent delivery ids and a shared adapter-host protocol. SHIPPED as Runtime::Outbox (ADR 0053): one row per (event, consumer) — every policy and process manager owed a reaction, kind: "effect" when the policy’s trigger is an outbound port operation — committed in the SAME adapter transaction as the aggregate save, drained inline by the dispatcher, pending rows redriven on the next boot, claimed rows surfaced and left for redrive!(claimed: true); Memory/Sqlite/Postgres/PostgresEra carry the hecks_outbox contract, verify! warns for adapters that don’t. Still open from the original item: a shared adapter-HOST protocol (discover → consume → act → dispatch → ack) and a standalone bin/outbox relay with a lease/timeout on claimed — today the relay is the dispatching thread plus boot-time reconciliation. SagaInterpreter’s own pending-dispatch marker (saga_pending_dispatch.rb) stays, complementary: it names a saga LEG mid-flight, the outbox names the EVENT owed to the saga.
Honest-refusal tools. Structured {ok:false, supported:false, error:"…"} instead of a crash, an ENOENT, or a silent no-op.
A two-tier bus design. A local, free, eventually-consistent bus alongside a durable, governed, paid one, chosen per bluebook with domain-level default and aggregate-level override. Would collapse repeated persisted_by lines to one.

Beyond Storehouse — worth stealing

A Session.RebuildContext plus a Stop-hook handoff gate that regenerates working context from durable state.
Inbox-card conventions: a value: field carrying the whole finding, a closed_note: recording what actually fixed it, mandatory “Where to look” and “Verification once fixed.”
An antibody + lines-of-code ratchet with signed, retirement-conditioned exemptions and longest-prefix classification.
ProducedField — the typed output half of an adapter contract; hecks’s .port files type inputs only.
Family-owned .world schema validation that rejects unknown or missing keys and infers a field’s source (direct | env | secret) from its declaration form.
Generated .behaviors tests from the IR, with a closed precondition taxonomy that fails loudly on any unhandled given. The authoring DSL exists on the hecks side; there’s no interpreter under it yet.
A morphology promotion loop — a static fast path plus a dynamic learning path, promoting a candidate word at three rejections.
A tool-cache built from transcript JSONL, catalogued at session start.
Decentralized, opt-in registries via dropped descriptor files.
A sidequest stop-rule: one verification pass, maximum; inconclusive is a stop, not a loop.

Implementation plan

docs/HECKS_IMPLEMENTATION_PLAN.md — the largest single source by far, 2,511 lines. Phase 1 hardening is still incomplete; phases 4 through 10 (ontology adoption, canonical-domain expansion, auth projections, history & analytics, persistence projection, standards & compliance, research tail) haven’t started.

Foundational architecture

Formalize the twelve-stage deterministic execution pipeline with per-stage docs covering replay, determinism, and failure semantics.
Keep three independent IRs — Authoring, Execution, Evidence — distinct.
Expose a runtime Capability Graph (Governance, Identity, UUID, Clock, Persistence, Email, Payments…) for deployment analysis, onboarding, and AI reasoning.
Expose a navigable Semantic Graph (Command→Role, Command→Event, Event→Policy…) so tooling stops parsing Ruby directly.
A Constraint Engine that models rules as constraints and can explain blocked work by walking the dependency chain.
Explainability — a rendered explanation tree for every runtime decision, adjustable by audience.
Extend hecks verify past reachability/consistency to dead-command/event/policy detection, cycle detection, impossible transitions, conflicting invariants, duplicate rules, unreachable states, unused roles and value objects.
Diagram generation straight from canonical IR, no hand-maintained diagrams.
An AI-assistant layer for ontology discovery, corpus evolution, role mapping, upgrade suggestions, and drift explanation.
Capture every architectural invariant as an ADR.

By section — all unbuilt or partial unless noted

§1 role uniqueness — enforce one-command-one-role at the builder level; a duplicate role currently silently overwrites instead of raising.
§2 act_as — facade sugar for cross-command role transitions.
§3 governance — wire act_as to a real Governance.authorize_transition!; add a port/query surface for other domains.
§4 identities — OIDC verification (feeds §11); retrofit Governance’s actor_id to reference Identity.
§5 UUID adapter — facade-level auto-enrichment of identity args, retrofitted across the existing corpus.
§6 report — a permanent SME-facing alias for read_model, with builder dispatch, vocabulary docs, and golden round-trip tests.
§8 Rust projection — WASM target; era-minting and shape-drift detection in Rust; SQL translation from Rust; era-partitioned read-back; a Rust LineageManager equivalent; refusal-wording parity; wiring hecks check_conformance into an automated gate.
§9 WASM embedded bluebook — era selection, a browser JS API (Hecks.load/dispatch/report), a host-adapter import boundary, and state externalization/hot-reload.
§10 SQL projection — generating Postgres/SQLite DDL from IR, and compiling command semantics into stored procs/triggers/views (research spike).
§11–§12 OIDC — a real client-facing flow (redirect, code exchange, JWKS verification) and, further out, a full OIDC provider (endpoints, key rotation, conformance testing).
§13 email OTP adapter — RequestLoginCode, code generation/send adapters, rate limiting.
§14 — split People/Customers/Users/Governance into a proposed corpus.
§15–§16 UL projection — a Hecks.ul_projection DSL, a ULProjector, and replayable mapping recipes for future canonical releases.
§17–§20 onboarding — an entire Onboarding domain (Adoption, MappingDecision, Conflict, Recommendation), a role-mapping review UI, existing-role discovery, and (lowest priority) AI-assisted mapping suggestions.
§21–§22 drift — semantic drift detection across Canonical↔Org, ISO↔Bluebook, Bluebook↔artifact, and Era N↔N+1; a three-way semantic-merge upgrade workflow.
§23–§24 standards — ISO traceability mapping and conformance-drift detection built on top of it.
§25–§27 history — querying and reporting by era, plus data-engineering projections from reports.
§28–§29 canonical corpus — reusable canonical bluebooks (Money, Identity, Governance, People, Payments, Inventory, Scheduling, Audit, Quality/CAPA…) and a pattern-discovery pipeline to help author them.
§30 projectors — retrofit the real :rust projector into the Projector framework; build the unbuilt :ul and :openid projectors.
§31 port fulfillment UI — the data exists; the UI doesn’t.
§34 missing ADRs — cross-domain authority, bluebooks-never-own-entropy, UL-preserves-ubiquitous-language, ports-not-packages.

Work-slice plans

Five smaller, more mechanical planning docs — each scoped to a concrete engineering slice rather than a product feature.

DSL work slices (`docs/dsl-work-slices.md`)

S12 — projects and the boundary rule (Wave 3): delete References#dereference, migrate 49 givens, build an adapter-agnostic rebuild path and a new ProjectionAbsent refusal from scratch.
S13 — coverage standard (Wave 3, depends on everything): corpus-use or a written exemption for 11 not-yet-adopted vocabulary words.
Open items still needing a home: the domain_port vs. port naming split; ambiguity in Domain::Aggregate.X.Y between an entity command and a port operation; an undocumented parent construct; the unresolved report vs. read_model disagreement between ADR 0008 and 0025; a flaky adapter-agreement gate that has blocked pushes roughly one push in six.

Fuzzer property expansion (`docs/fuzzer-property-expansion-plan.md`)

Fix and prove an entity-identity collision in MutationApplier#entity_element.
New property: stored records satisfy their declared invariants (catches invariant-violating writes that are never refused).
New property: group_by results match a from-scratch recompute.
Fix: the query interpreter never applies offset — then add a paging property to prove it once fixed.
New property: lifecycle guard and given violations are always refused (needs a new replay snapshot hook).
New property: scope authorization actually refuses (currently unreachable — the generator never supplies tenant: args).
New property: dispatch-binding fidelity, backed by an additive saga dispatch log.
New property (the largest item): mutations match an independent recompute — needs a real bootable entity-mutation domain and per-operation recompute functions.
Secondary fixes: an unenforced entity-identity/remove interaction; a lifecycle guard bypassing shared refusal wording; clamp missing the zero-fallback that multiply/increment already have.
Explicitly deferred, no properties yet: cursor, consistency, freshness, use_index.

Postgres-era adapter split (`docs/postgres-era-adapter-split-plan.md`)

An OracleEra adapter — deferred for now but flagged as a strong future candidate (clears every bar: incremental materialized views, online partitioning, transaction-scoped advisory locks).
Re-check CockroachDB advisory-lock support before treating its exclusion as permanent.
Two open gaps in the all()/save() migration path: saga/process-manager state needs its own explicit read-and-reinsert step, and the mirrors field on Entry hasn’t been fully traced.

Note: the rest of this plan is now marked done and verified; it moved to docs/implemented/ in the 2026-08-18 docs split, with the three items above being the only genuinely open threads.

Rust experiment & handwritten refactor

rust-handwritten-refactor-slices.md — Wave 0 creation slices (new module files: kernel.rs, parse/gates.rs, lex.rs, emit.rs, ruby_value.rs, auth.rs, web.rs, journal.rs); Wave 1 integration slices shrinking the old monoliths and rewiring 35+ call sites (I-PARSER, I-HOST, I-CODEGEN, I-BUILD). Named for possible later slices: extracting AwsLambdaInvoker; deduping triplicated puts_str/puts_blank helpers; a pub → pub(crate) visibility-hygiene pass.

PRDs

docs/prds/ — eight proposals, in the priority order the README itself gives.

~~01 · Reaction-depth race.~~ Done, differently than proposed: Thread.current[:hecks_reaction_depth] rather than a mutex — a reaction cascade re-enters reenter on the SAME thread, which a non-reentrant Mutex can’t guard (see that method’s own comment in dispatcher.rb), so per-thread ambient state (the same idiom Runtime::Caller already uses) fits better than the PRD’s original mutex proposal.
~~02 · Fuzzer against real adapters.~~ Done: hecks fuzz adapter=memory|sqlite|postgres (memory default, unchanged). Postgres is a real CLI flag with its own reachability check, rather than an RSpec io: true tag — hecks fuzz is a script, not a spec suite, so it has no tag mechanism to gate on; the flag is the equivalent decision (nothing runs Postgres mode without asking for it by name).
03 · Mutation application agreement. A differential gate across adapters for append/remove/multiply/clamp/increment/decrement/set, mirroring the query-agreement spec that already found four real bugs.
04 · Rust conformance fuzzing. Bridge randomized sequences into the existing Ruby-vs-Rust byte-for-byte conformance spec; run any divergence through the existing shrinker.
05 · Numeric boundary coverage. Widen integer and float edge cases (Int64/Bignum, NaN/Infinity/-0.0) and trace each through coercion, multiply, and clamp for silent corruption.
06 · Parser adversarial fuzzing. A cargo-fuzz target seeded from the real corpus, checking only “never panics, always a clean error.”
07 · Ruby mutation testing. Evaluate the mutant gem, scoped narrowly to command_interpreter.rb, mutation_applier.rb, and argument_gate.rb; triage every surviving mutant. Deliberately scheduled late.
08 · Coverage-guided fuzzing. Instrument hecks fuzz’s generation loop with real coverage feedback via Ruby’s coverage stdlib. Deliberately last — most valuable once 02 and 04 have landed.

Query DSL & policies

Query DSL (`docs/query-dsl.md`) — proposed additions, none implemented

Aggregation — count / sum / avg / min / max plus group_by. read_model already computes count, median and group_by (ADRs 0050, 0052); still open is sum, a group_by that reduces, and a fix for group_by dropping rows on a non-unique key. avg/min/max have no corpus use. See ADR 0061 (Proposed).
having — filtering on a computed value, paired with aggregation.
distinct — a common primitive with no equivalent today.
Explicit include optionality control — no lever today for “drop the row if the include is absent” vs. “keep it with an empty collection”; inner-vs-left-join behavior on a zero-match has never been traced.
Compiling a hop into a real SQL JOIN instead of two round trips — worth doing only if measured to matter.
Era/time-aware reads (“as of”) — the most speculative item; may already be solved elsewhere under a different name.

Event-storming policies (`docs/event-storming-policies.md`)

No “external system” concept — a policy can’t declare an effect reaching past the runtime boundary (email, webhook, third-party API) as a checkable fact, the way across does for cross-domain reach.

Decision records

Only the ADRs with genuine unbuilt content, per their own status marker — pure rationale-only or fully-shipped records moved to docs/implemented/decisions/ in the 2026-08-18 docs split and are left out here.

0010 — Ruby as reference implementation. Accepted, not implemented: a differential test harness that dispatches the same command sequences into Ruby and a second runtime, diffing outcomes, refusal wording, events, and state — the real gate for ever shipping a second runtime.
0022 — self-host the expression grammar. Proposed, not implemented: describe the expression-node grammar in the bluebook meta-language so Ruby’s evaluator and Rust’s kernel/expr.rs can be checked against one shared description. A prerequisite corpus audit hasn’t happened, and whether it’s worth building at all is still open.
0023 — Rust parses and compiles directly. The parsing half is implemented and verified; the codegen half shipped too: rust/codegen ported the Ruby generator, so cargo build needs no Ruby, and it is now the only generator (ADR 0086).
0025 — one idea, one way. Accepted, not implemented — a fully sequenced fifteen-step plan: collapse duplicate identified_by spellings; retire _id minting in favor of / traversal; delete has_many/has_one/belongs_to; require a single bare-constant attribute type; delete consistency/freshness/use_index; revert report back to read_model; rename then_set to sets (143 corpus uses already match); make role real RBAC or refuse it; make events and command references first-class; unify saga and lifecycle vocabulary; add an aggregate-level invariant; make lifecycle state a real command guard; add a projects construct with a ProjectionAbsent refusal; require EraGuard translation for newly-optional attributes.
0026 — the language uses everything it declares. Accepted, not implemented: a self-use gate that will fail on day one against the language’s own chapters; demoting limit/offset/cursor/nulls into a Paging sub-language; turning the language’s own Status field into a real lifecycle; promoting Member/Dispatch/Handler to real entities.

Guides & reference

docs/command-form-and-query-form-bluebook.md (status: prototype) — largest cluster of still-open guide-level work: graduate it from an ordinary Ruby DSL into real syntax validated through Hecks.*; give expose per-command and per-query override instead of whole-chapter only; add field-level refusal attribution to the sticky re-render (today it’s whole-banner only); wire up reports/read models (report_form.bluebook is a reserved name only so far); replace the one-JSON-object-per-line fallback for a multi-field list_of with a real repeatable add/remove fieldset; and eventually add styling, live sockets, and a real deploy target — all currently deferred to a wider web-framework idea, with hecks present staying dev-only until then.

docs/rails-integration.md — status: design only, nothing built. Explicitly open, not designed here: the read side beyond one load-bearing show route; authorization enforcement; per-attribute labels/help text; file uploads; real-time updates via ActionCable; which driven adapters should be Rails-native vs. agnostic.

docs/resolution-rules/cross-entity-given.md — the only one of the four resolution-rules docs not yet mirrored into the Rust parser (the other three moved to docs/implemented/resolution-rules/ in the docs split).

Bug audits

docs/audits/2026-08-10-main-bug-audit.md and docs/audits/2026-08-11-bug-triage.md — 75 findings total. Reconciled against current main 2026-08-27 — every H-numbered finding (all 14) plus S1–S3 is now fixed, several found already fixed by the time they were checked and two (H1, the fuzzer-adapter gap under Tier 5) requiring real work this session. See docs/audits/2026-08-26-issue-tracker-reconciliation-plan.md for the finding-by-finding evidence table. M1–M19, L1–L24, and the Rust-parity divergence list — re-verified 2026-08-28 (three independent, parallel investigations, each reading current file:line content and existing spec coverage, not the audit doc’s stale line numbers): 53 of 55 individually-tracked items are fixed or no longer applicable. Full finding-by-finding table: docs/audits/2026-08-28-m1-m19-l1-l24-rust-parity-reverify.md. Two items carry a real, honestly-tracked caveat rather than a clean close — M10’s chapter-level @ports round-trip gap (deliberately deferred, its own separate epic) and R2, whose specific mechanism is gone but whose underlying invariant (“Ruby and Rust refuse identically over the full corpus”) is still actively finding new violations, now tracked in docs/decisions/0037-generated-sequence-fuzz-bridge-found-real-gaps-two-fixed-three-catalogued.md (Findings 3–6, two pending: rspec examples — Finding 5, a real dangling-reference data-integrity gap, is the highest-priority one still open).

Tier 1 — data loss & migration integrity — ALL FIXED

H3 — era-migrated deletes now write a real tombstone row (operation='delete') instead of a bare DELETE; the head view reads operation, not a hardcoded 'save'. Live-verified against real Postgres 2026-08-27. Regression specs, real Postgres: spec/adapters/driven/postgres_era/lineage_spec.rb (one mint) and spec/adapters/driven/postgres_era/migration_data_safety_spec.rb (a delete made in era 2 survives the mint of era 3, and a delete made in era 3 of a record two eras old).
H4 — rekeys/backfills are now folded into the approval digest (lib/hecks/projector/exporter.rb); editing a rekey’s SQL post-approval now invalidates the approval, as it must. Verified 2026-08-27. spec/exporter_spec.rb pins the digest for rekeys and backfills with no database; migration_data_safety_spec.rb pins the mint itself against real Postgres: an edited rekey SQL or backfill default refuses the mint and mints no era, and the edge that was approved still mints.
H5 — strip_compute_paths (layer_two.rb) now deletes only the exact dotted member a compute touches, not its whole parent attribute. Verified 2026-08-27. Pinned in spec/ports/persistence/plugins/era/translation/audit/layer_two_spec.rb with hand-built rows, and in migration_data_safety_spec.rb with the rows a real compiled head produces: a dotted-destination compute mints with its sibling member intact, and a compiled edge that loses the sibling is refused. A compute whose source is a dotted member (compute "price.cents", to: ...), found never firing while writing that spec, is fixed: compile_compute reads the source as a path through hecks_tr_extract, and migration_data_safety_spec.rb mints one against real Postgres.

These run in CI: the rspec_postgres_io_parallel shards provision Postgres (.github/actions/postgres), PostgresProbe raises under CI instead of skipping an unreachable server, and hecks list_io_parallel_specs check=<file> fails a PR that adds an io: true spec without listing it in .github/postgres_io_spec_files.txt.

Tier 2–3 — systemic roots & security — ALL FIXED (spot-checked, not exhaustively re-run)

S1 — render_value now delegates to a real Literal.render, not value.to_s. Code-read-verified 2026-08-27, no dedicated repro re-run.
S2 — FieldPath#read now uses current.key?(sym) ? current[sym] : current[segment], not h[k.to_sym] || h[k] — a stored false survives. Code-read-verified 2026-08-27.
S3 — spot-checked the Ruby presentation layer’s escaping paths; consistent with the fix. Not independently re-run against a hostile identity value this session.
~~H10~~ — already marked fixed (2026-08-22) in the audit doc itself.
~~H11~~ — Rust session_secret() now refuses to boot on an empty/unset SESSION_SECRET (validate_session_secret, with its own unit test). Source-verified 2026-08-27; not run under cargo test in this session (local rustc 1.94.0 vs. aws-sdk crates requiring 1.94.1 — an environment issue, not a code one).
L12, L20 — not independently re-verified this session; the reconciliation plan’s table (docs/audits/2026-08-26-issue-tracker-reconciliation-plan.md) lists L20 fixed at b00e667d.

Tier 4 — wrong answers & broken routes — H6–H9, H12 FIXED

H6 — in_memory.rb now drops-then-firsts, matching SQL’s OFFSET-then-LIMIT. Live-verified 2026-08-27 (spec/query_paging_agreement_spec.rb).
H7 — query_interpreter.rb’s interpret/reference_interpret/entity_rows/ordered all respect offset and go through FieldPath.dig now. Live-verified 2026-08-27.
H8 — seal_defaults now builds its shape set from (@value_objects + closed_sets). Live-verified 2026-08-27 against the audit’s own exact repro.
H9 — the meta-validator cache key now incorporates wheres/order_by/limit/offset/cursor. Live-verified 2026-08-27.
~~H12~~ — split_format now matches only a literal trailing .html/.json; an id containing . (e.g. c.1) routes correctly. Live-verified 2026-08-27.
~~M1–M19~~ (of the original M1–M20; M20 is the reaction-depth race, fixed — see above) — 18/19 fixed, each with a matching code fix and (mostly) a dedicated regression spec, re-verified 2026-08-28. M10 is partial: formerly_known_as fixed, chapter-level @ports round-trip stays a deliberately deferred, separately-tracked gap. See docs/audits/2026-08-28-m1-m19-l1-l24-rust-parity-reverify.md.

Tier 5–7 — ops, harness, and low severity

~~H13~~ — Shared-mode mint-era no longer exits non-zero unconditionally after a successful deploy. Live-verified 2026-08-27.
~~H14~~ — scaffold-translation/translation-audit now refuse by default when they’d silently hit the local DB instead of the tunnel, requiring an explicit ALLOW_LOCAL_DB=1 override. Live-verified 2026-08-27.
~~Fuzzer only covers the Memory adapter~~ — see “Fuzzer against real adapters (PRD 02)” above. Fixed 2026-08-27, the same session that found the tracking-doc mislabel describing it as already fixed by an unrelated commit.
Test-harness blind spots (three half-unfuzzable framework aggregates; a vacuously-passing saga property; a fuzzer query oracle masking refusal-shaped divergence; shrink_arguments never accumulating drops; an absorbing-state contradiction in RoleTransition) — not re-verified this session; these are the M21–M25 findings a tracking doc previously (and wrongly) conflated with the fuzzer-adapter gap above, so their own status is still genuinely unknown pending a real check.
~~Rust-parity divergence list (R1–R5)~~ — R1, R3, R4, and both halves of R5 fixed and re-verified 2026-08-28, four with source comments explicitly citing the original finding ID. R2 is superseded, not simply fixed: its specific mechanism (37 placeholder refusals shifting indices) is gone, but the underlying invariant it named — Ruby and Rust must refuse identically over the FULL corpus, not just 3 pinned fixtures — is still actively finding new violations via a newer, more thorough tool (PRD 04’s generated-sequence fuzz bridge). See docs/decisions/0037-generated-sequence-fuzz-bridge-found-real-gaps-two-fixed-three-catalogued.md for the current, live successor list (Findings 3–6; Finding 5 — a real dangling-reference data-integrity gap — is the one to close first). This list (“an invariant that keeps finding new violations,” as this doc already said) is now superseded by that ADR going forward — check there, not here, for the current Rust-parity status.
~~24 low-severity findings (L1–L24)~~ — 23/24 fixed with matching spec/test coverage, re-verified 2026-08-28; L3 no longer applicable (buggy code path deleted under ADR 0032). See docs/audits/2026-08-28-m1-m19-l1-l24-rust-parity-reverify.md.

Still not independently re-checked

Marked fixed in the audit tracking above, but by code reading or by a partial run, not by a spec that fails without the fix. Each is a claim to re-verify before relying on it:

S1, S2 — code-read only; no dedicated repro was re-run.
S3 — the Ruby presentation layer’s escaping was spot-checked; not re-run against a hostile identity value.
H11 — Rust session_secret() refusing an empty SESSION_SECRET was source-verified with its unit test, but not run under cargo test in that pass.
L12 — not re-verified. L20 — the reconciliation plan lists it fixed at b00e667d; not re-run.
M21–M25 (the test-harness blind spots under Tier 5–7) — status unknown, except shrink_arguments accumulating drops, which spec/bin_fuzz_spec.rb now pins.

Also reviewed, nothing to add

docs/documentation-plan.md (describes already-completed work, landed 2026-08-04 — moved to docs/implemented/) and the ADRs now under docs/implemented/decisions/ — rationale-only or fully shipped, no unbuilt content remaining.

Compiled from ~/Projects/hecks/docs/ — worktree copies and build output excluded. Re-check open items against current state before acting; several of these plans are weeks old and docs/ was split into docs/implemented/ vs. active work on 2026-08-18, so file paths above may have moved.

This site is open source. Improve this page.