FWIW, some time ago I wanted to walk a HoneySQL (1.0) query to transform table names. I initially tried to identify all the "places" that could contain table names, but quickly found it intractable for the same reasons spec-ing the thing is hard. Instead I ended up using namespaced :table/foo keywords everywhere, so I could just postwalk and automatically know what's a table

of course that only worked because I controlled all the queries. If you're trying to operate on HoneySQL from another source, you don't have that option