hecks 3.10.0 → 3.11.0

data/rust/parser/src/parse/policy.rs

@@ -1,5 +1,5 @@
-//! The `Policy` construct: `on`/`trigger` fill `on_event`/`trigger_command`, `across` names the
-//! target domain.
+//! The `Policy` construct: `on`/`trigger` fill `on_event`/`trigger_command`, `ask` names a need
+//! the hecksagon maps to a port, `across` names the target domain.
 
 use crate::canonical;
 use crate::diag::{Diagnostic, ParseResult};
@@ -49,6 +49,17 @@ pub fn parse_body(
                 // Shares `dispatch`'s `with:` parser so the two cannot drift.
                 policy.with_spec = super::process_manager::parse_with_pairs_opt(&gated.args);
             }
+            // Same `with:` projection as `trigger`; which port answers is the hecksagon's to say.
+            "ask" => {
+                policy.ask = Some(super::positional_symbol(
+                    file,
+                    gated.line.number,
+                    "ask",
+                    &gated.args,
+                    1,
+                )?);
+                policy.with_spec = super::process_manager::parse_with_pairs_opt(&gated.args);
+            }
             "across" => {
                 policy.target_domain = Some(super::positional_text(
                     file,

data/rust/parser/src/parse/value_object.rs

@@ -64,17 +64,21 @@ fn try_reference_named_invariant(
     Ok(Some(resolved))
 }
 
+/// Parses one `value_object` body. Returns the value object and the closed sets its type-position
+/// `one_of(...)` attributes synthesized, which the owning aggregate installs right after it, as
+/// `AggregateBuilder#value_object` does with `builder.closed_sets`.
 pub fn parse_body(
     file: &str,
     lines: &[SourceLine],
     pos: &mut usize,
     name: &str,
     owner_value_objects: &[ir::ValueObject],
-) -> ParseResult<ir::ValueObject> {
+) -> ParseResult<(ir::ValueObject, Vec<ir::ValueObject>)> {
     let mut vo = ir::ValueObject {
         name: name.to_string(),
         ..Default::default()
     };
+    let mut synthesized: Vec<ir::ValueObject> = Vec::new();
 
     loop {
         if let Some(invariant) =
@@ -87,14 +91,15 @@ pub fn parse_body(
         let Some(gated) = super::next_line(file, lines, pos, "ValueObject")? else {
             // Mirrors `ValueObjectBuilder#build`: a non-empty `members` closes the set.
             vo.closed_set = vo.closed_set || !vo.members.is_empty();
-            return Ok(vo);
+            return Ok((vo, synthesized));
         };
 
         match gated.row.word {
-            // An inline type-position `one_of(...)` set is discarded (see build/closed_sets.rs);
-            // `ValueObject` has no nested-value-objects field. Use the `one_of:` keyword instead.
+            // An inline type-position `one_of(...)` set is returned beside the value object (see
+            // build/closed_sets.rs); `ValueObject` has no nested-value-objects field.
             "attribute" => {
-                let (attribute, one_of) = build_value_object_attribute(file, &gated.args)?;
+                let (attribute, one_of, closed_set) = build_value_object_attribute(file, &gated.args)?;
+                synthesized.extend(closed_set);
                 if let Some(values) = one_of {
                     let vo_name = vo.name.clone();
                     install_inline_closed_set(
@@ -135,8 +140,8 @@ pub fn parse_body(
 fn build_value_object_attribute(
     file: &str,
     args: &super::ArgumentGateResult,
-) -> ParseResult<(ir::Attribute, Option<Vec<String>>)> {
-    let (attribute, _) = super::build_attribute(file, 0, "attribute", args)?;
+) -> ParseResult<(ir::Attribute, Option<Vec<String>>, Option<ir::ValueObject>)> {
+    let (attribute, closed_set) = super::build_attribute(file, 0, "attribute", args)?;
     let one_of = super::named_raw(args, "one_of").map(|raw| {
         let trimmed = raw.trim();
         let inner = trimmed
@@ -148,7 +153,7 @@ fn build_value_object_attribute(
             .map(|segment| ruby_value::to_s(&ruby_value::read(segment.trim())))
             .collect()
     });
-    Ok((attribute, one_of))
+    Ok((attribute, one_of, closed_set))
 }
 
 /// Installs `attribute :name, String, one_of: [...]`; refused unless it is the value object's

data/rust/parser/src/ruby_value.rs

@@ -41,7 +41,7 @@ pub fn render(value: &Value) -> String {
 }
 
 /// Ruby's `Float#to_s` always keeps a digit after the point (`1.0`); Rust prints `1`.
-fn format_ruby_float(value: f64) -> String {
+pub(crate) fn format_ruby_float(value: f64) -> String {
     let text = format!("{value}");
     if text.contains('.') || text.contains('e') || text.contains("inf") || text.contains("NaN") {
         text

data/rust/src/exemplar/commands.rs

@@ -68,7 +68,7 @@ impl crate::kernel::ToJson for TmplRecord {
     }
 }
 impl crate::kernel::SetProjectedField for TmplRecord {
-    fn set_projected_field(&mut self, name: &'static str, value: Option<String>) {
+    fn set_projected_field(&mut self, name: &'static str, value: Option<crate::kernel::Value>) {
         let _ = (name, value);
     }
 }
@@ -94,7 +94,7 @@ fn tmpl_hydrate_placeholder() -> crate::kernel::Hydrate<'static, TmplRecord> {
 
 fn tmpl_mutation_lines_placeholder(record: &mut TmplRecord) {}
 
-fn tmpl_seed_projections_placeholder() -> Vec<(&'static str, Option<String>)> {
+fn tmpl_seed_projections_placeholder() -> Vec<(&'static str, Option<crate::kernel::Value>)> {
     Vec::new()
 }
 
@@ -160,9 +160,9 @@ fn tmpl_emit_placeholder() -> &'static str {
     ""
 }
 
-// `delegates_to "Entity.Command"`: the door runs `apply_entity_command` inside its closure.
+// `delegates_to "Entity.Command"`: the entry point runs `apply_entity_command` inside its closure.
 // `delegate_prelude` fills the prelude slot; `delegate_apply` fills the mutation slot.
-// The inner `|record|` deliberately shadows the door's: entity `sets` only reach the element.
+// The inner `|record|` deliberately shadows the entry point's: entity `sets` only reach the element.
 fn tmpl_aliases_placeholder() -> (&'static str, &'static str) {
     ("", "")
 }

data/rust/src/exemplar/constraints.rs

@@ -12,7 +12,7 @@ fn tmpl_admits_check_host(tmpl_scalar: String) -> Result<(), crate::kernel::Refu
 
 fn tmpl_pattern_check_host(tmpl_scalar: String) -> Result<(), crate::kernel::Refusal> {
     // TMPL:pattern_check BEGIN
-    if !crate::kernel::pattern::matches("tmpl_pattern_text", &tmpl_scalar) { return Err(crate::kernel::Refusal::TypeMismatch(crate::kernel::refusal_wording::TypeMismatchPatternMismatchArgs { r#type: "tmpl_pattern_owner", field: "tmpl_pattern_field", pattern: "tmpl_pattern_text", offered: format!("{:?}", tmpl_scalar).as_str() }.render_args())); }
+    if !crate::kernel::pattern::matches_whole("tmpl_pattern_text", &tmpl_scalar) { return Err(crate::kernel::Refusal::TypeMismatch(crate::kernel::refusal_wording::TypeMismatchPatternMismatchArgs { r#type: "tmpl_pattern_owner", field: "tmpl_pattern_field", pattern: "tmpl_pattern_text", offered: format!("{:?}", tmpl_scalar).as_str() }.render_args())); }
     // TMPL:pattern_check END
     Ok(())
 }

data/rust/src/exemplar/json.rs

@@ -17,6 +17,20 @@ impl TmplKind {
     }
 
     pub fn from_json(v: &crate::kernel::Json) -> Result<Self, crate::kernel::Refusal> {
+        // A name the set does not declare refuses first, as `Value::FieldChecks#check_unknown_fields`
+        // does in `validate!`: before a missing field, and before membership.
+        let unknown = v.unknown_keys(&["tmpl_field_name"]);
+        if !unknown.is_empty() {
+            let unknown: Vec<&str> = unknown.iter().map(|key| key.as_str()).collect();
+            return Err(crate::kernel::Refusal::UnknownArgument(
+                crate::kernel::refusal_wording::UnknownArgumentUnknownArgsArgs {
+                    command: "tmpl_closed_set_type",
+                    unknown: &unknown,
+                    declared: &["tmpl_field_name"],
+                }
+                .render_args(),
+            ));
+        }
         // A `one_of` closed set is admission-checked on the raw offered
         // value, no shape check first — `Value::Admission#admit_member`
         // runs on whatever `Value::Coercion#fields_for` auto-wrapped into
@@ -93,6 +107,10 @@ struct TmplTableRow {
 }
 
 const TMPL_TABLE: &[TmplTableRow] = &[];
+const TMPL_DECLARED_NAMES: [&str; 0] = [];
+const TMPL_ADMITTED: [&str; 0] = [];
+
+fn tmpl_absent_field_checks() {}
 
 // Function-call placeholders; the marker sits flush left because plain `render` never reindents.
 fn tmpl_to_json_fields_block() -> (String, crate::kernel::Json) {
@@ -112,12 +130,36 @@ tmpl_to_json_fields_block()
     }
 
     pub fn from_json(v: &crate::kernel::Json) -> Result<Self, crate::kernel::Refusal> {
+        // `validate!`'s order: a name the set does not declare, then a field left out, then
+        // membership of the whole row.
+        let unknown = v.unknown_keys(&TMPL_DECLARED_NAMES);
+        if !unknown.is_empty() {
+            let unknown: Vec<&str> = unknown.iter().map(|key| key.as_str()).collect();
+            return Err(crate::kernel::Refusal::UnknownArgument(
+                crate::kernel::refusal_wording::UnknownArgumentUnknownArgsArgs {
+                    command: "tmpl_table_type",
+                    unknown: &unknown,
+                    declared: &TMPL_DECLARED_NAMES,
+                }
+                .render_args(),
+            ));
+        }
+tmpl_absent_field_checks();
         for row in TMPL_TABLE {
             if tmpl_from_json_conditions() {
                 return Ok(row.clone());
             }
         }
-        Err(crate::kernel::Refusal::TypeMismatch(format!("TmplTableRow: no member matches {:?}", v)))
+        // The refusal quotes the first column only, as Ruby's `refuse_non_member!` does.
+        let offered = v.get("tmpl_first_field").map(|offered| offered.inspect()).unwrap_or_else(|| "nil".to_string());
+        Err(crate::kernel::Refusal::InvariantViolation(
+            crate::kernel::refusal_wording::InvariantViolationClosedSetMemberArgs {
+                r#type: "tmpl_table_type",
+                admitted: &TMPL_ADMITTED,
+                offered: offered.as_str(),
+            }
+            .render_args(),
+        ))
     }
 }
 // TMPL:closed_set_table_codec END

data/rust/src/kernel/cli.rs

@@ -162,15 +162,17 @@ pub fn run(input: &str) -> String {
                             refusals.push((question.clone(), refusal));
                         }
                     },
+                    // Only a query the generator did not emit reaches here; the codegen manifest lists
+                    // each one it skipped, with the reason.
                     None => refusals.push((
                         question.clone(),
                         Refusal::TypeMismatch(format!(
                             "named/declared query {question:?} is not generated for this domain — either unknown, or a \
-                             real declared query whose shape this generator's codegen doesn't cover yet (order_by/limit/\
-                             cursor/consistency/freshness/authorization/null_semantics/inspection/index_hints, a where \
-                             clause hopping through a reference, or a literal comparator value whose true JSON type \
-                             can't be recovered from the exported IR — rust/codegen/src/queries.rs's own header has the \
-                             full argument); the wheres-only, single-aggregate field-comparator subset and the ad hoc \
+                             real declared query whose shape this generator's codegen doesn't cover yet (cursor/\
+                             consistency/freshness/inspection/index_hints, a where clause on a field the aggregate \
+                             does not declare, or a literal comparator value whose true JSON type can't be \
+                             recovered from the exported IR — hecks-codegen's manifest names which); a declared \
+                             query with or without a where, ordered and bounded as declared, and the ad hoc \
                              filter shape ({{\"aggregate\",\"field\",\"op\",\"value\"}}) both execute for real"
                         )),
                     )),

data/rust/src/kernel/dispatch.rs

@@ -118,7 +118,7 @@ pub fn dispatch<'a, T, R>(
     payload: Json,
     mutations: &mut Vec<MutationRecord>,
     // The synchronous half of `projects`, applied right before `repo.save`.
-    seed_projections: Vec<(&'static str, Option<String>)>,
+    seed_projections: Vec<(&'static str, Option<Value>)>,
     // The write-side tenant boundary. The router computes it (it needs every aggregate's repo)
     // but it is applied here, first in `Save`, before `seed_projections`.
     tenant_boundary_check: Result<(), Refusal>,
@@ -606,7 +606,7 @@ pub fn dispatch_entity<'a, T, E, R>(
     payload: Json,
     mutations: &mut Vec<MutationRecord>,
     // As in `dispatch`: an entity command still ends in a parent aggregate save.
-    seed_projections: Vec<(&'static str, Option<String>)>,
+    seed_projections: Vec<(&'static str, Option<Value>)>,
 ) -> Result<(T, Vec<Event>), Refusal>
 where
     T: Fielded + Clone + ToJson + SetProjectedField,

data/rust/src/kernel/dispatch_guard_tests.rs

@@ -60,7 +60,7 @@ impl ToJson for Acct {
 }
 
 impl SetProjectedField for Acct {
-    fn set_projected_field(&mut self, _name: &'static str, _value: Option<String>) {}
+    fn set_projected_field(&mut self, _name: &'static str, _value: Option<Value>) {}
 }
 
 fn rule(description: &'static str, field: &'static str) -> InvariantSpec {

data/rust/src/kernel/expr.rs

@@ -27,6 +27,39 @@ impl Value {
     pub fn truthy(&self) -> bool {
         !matches!(self, Value::Nil | Value::Bool(false))
     }
+
+    /// The text of a `Str`, else `None`; a generated `SetProjectedField` arm narrows a
+    /// projected scalar to its field's type with one of the `into_*` readers.
+    pub fn into_string(self) -> Option<String> {
+        match self {
+            Value::Str(s) => Some(s),
+            _ => None,
+        }
+    }
+
+    /// The integer of an `Int`, else `None`.
+    pub fn into_i64(self) -> Option<i64> {
+        match self {
+            Value::Int(n) => Some(n),
+            _ => None,
+        }
+    }
+
+    /// The float of a `Float`, else `None`.
+    pub fn into_f64(self) -> Option<f64> {
+        match self {
+            Value::Float(f) => Some(f),
+            _ => None,
+        }
+    }
+
+    /// The boolean of a `Bool`, else `None`.
+    pub fn into_bool(self) -> Option<bool> {
+        match self {
+            Value::Bool(b) => Some(b),
+            _ => None,
+        }
+    }
 }
 
 pub enum Field<'a> {
@@ -203,6 +236,10 @@ pub enum Expr {
     Bool(bool),
     Nil,
     Add(Box<Expr>, Box<Expr>),
+    Sub(Box<Expr>, Box<Expr>),
+    Mul(Box<Expr>, Box<Expr>),
+    /// Floor division on integers; a zero divisor is an evaluation fault.
+    Div(Box<Expr>, Box<Expr>),
     SignTest { op: Comparison, receiver: Box<Expr> },
     Empty(Box<Expr>),
     ToS(Box<Expr>),
@@ -232,6 +269,9 @@ pub enum Expr {
     /// `receiver.split("SEP")` — `Resolver::Split`. Produces a real
     /// `Value::Array`, not `Value::List` — see that variant's own header.
     Split { receiver: Box<Expr>, separator: String },
+    /// `receiver.strip` / `.lstrip` / `.rstrip` — `Resolver::Strip`. Trims Ruby's own whitespace
+    /// set (see `StripSide::trim`), not Unicode spaces.
+    Strip { receiver: Box<Expr>, side: StripSide },
     /// `receiver.start_with?("prefix")` — `Resolver::StartsWith`.
     StartsWith { receiver: Box<Expr>, substring: String },
     /// `receiver.end_with?("suffix")` — `Resolver::EndsWith`.
@@ -242,6 +282,29 @@ pub enum Expr {
     Last(Box<Expr>),
 }
 
+/// Which ends of a string `Expr::Strip` trims: `.strip` both, `.lstrip` the start, `.rstrip` the end.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum StripSide {
+    Both,
+    Left,
+    Right,
+}
+
+impl StripSide {
+    /// Ruby's `String#strip` family: trims null, tab, line feed, vertical tab, form feed, carriage
+    /// return and space, never a Unicode space. Rust's own `trim` would also drop U+00A0 and the
+    /// rest, so the set is spelled out.
+    pub fn trim(self, text: &str) -> String {
+        let is_stripped = |c: char| matches!(c, '\0' | '\t' | '\n' | '\u{b}' | '\u{c}' | '\r' | ' ');
+        match self {
+            StripSide::Both => text.trim_matches(is_stripped),
+            StripSide::Left => text.trim_start_matches(is_stripped),
+            StripSide::Right => text.trim_end_matches(is_stripped),
+        }
+        .to_string()
+    }
+}
+
 /// `args`/`instance` from `Evaluator.call` — `args` is checked first for
 /// every `Lookup`, matching `Resolver#fetch`. Pass `&NoFields` for `{}`.
 pub struct EvalContext<'a> {
@@ -274,14 +337,14 @@ fn category_of(expr: &Expr) -> OperatorCategory {
         Or(..) | And(..) | Not(..) => OperatorCategory::Logical,
         Include { .. } => OperatorCategory::Membership,
         Compare { .. } => OperatorCategory::Comparison,
-        Add(..) | Modulo { .. } => OperatorCategory::Arithmetic,
+        Add(..) | Sub(..) | Mul(..) | Div(..) | Modulo { .. } => OperatorCategory::Arithmetic,
         SignTest { .. } => OperatorCategory::SignTest,
         Empty(..) | Size(..) => OperatorCategory::Sized,
         ToS(..) => OperatorCategory::ToString,
         BlockPredicate { .. } | Find { .. } => OperatorCategory::Enumeration,
         MatchesRegex { .. } => OperatorCategory::PatternMatch,
         Presence { .. } | Assignment { .. } => OperatorCategory::Presence,
-        Split { .. } | StartsWith { .. } | EndsWith { .. } => OperatorCategory::Text,
+        Split { .. } | Strip { .. } | StartsWith { .. } | EndsWith { .. } => OperatorCategory::Text,
         First(..) | Last(..) => OperatorCategory::Positional,
         Int(..) | Float(..) | Str(..) | Bool(..) | Nil | Lookup(..) | Array(..) => {
             unreachable!("interpret's own leaf arms handle these before category_of is ever called")
@@ -300,7 +363,7 @@ fn dispatch_operator(category: OperatorCategory, expr: &Expr, ctx: &EvalContext)
         OperatorCategory::Membership => membership::interpret(expr, ctx),
         OperatorCategory::Comparison => comparison::interpret(expr, ctx),
         OperatorCategory::Arithmetic => match expr {
-            Expr::Add(..) => arithmetic::add(expr, ctx),
+            Expr::Add(..) | Expr::Sub(..) | Expr::Mul(..) | Expr::Div(..) => arithmetic::binary(expr, ctx),
             Expr::Modulo { .. } => arithmetic::modulo(expr, ctx),
             _ => Err(Refusal::TypeMismatch(format!("dispatch_operator(Arithmetic, ..) called with {expr:?} — a router bug"))),
         },

data/rust/src/kernel/expression_operators/arithmetic.rs

@@ -1,15 +1,64 @@
-//! `+` and `.modulo` (`Resolver::Addition`/`Modulo`); both require numeric operands.
+//! `+`, `-`, `*`, `/` and `.modulo` (`Resolver::Addition`/`Subtraction`/`Multiplication`/`Division`/
+//! `Modulo`); all require numeric operands.
 
 use crate::kernel::attribute_shapes::scalar;
 use crate::kernel::expr::{eval_error, interpret as eval, EvalContext, Expr, Value};
 use crate::kernel::Refusal;
 
-pub fn add(expr: &Expr, ctx: &EvalContext) -> Result<Value, Refusal> {
-    let Expr::Add(l, r) = expr else {
-        return Err(Refusal::TypeMismatch(format!("arithmetic::add called with a non-addition node {expr:?} — a router bug")));
+/// `-`, `*`, `/` and `+`, each the counterpart of the Ruby `Resolver` operation of that name.
+pub fn binary(expr: &Expr, ctx: &EvalContext) -> Result<Value, Refusal> {
+    let (name, symbol, l, r) = match expr {
+        Expr::Add(l, r) => ("addition", "+", l, r),
+        Expr::Sub(l, r) => ("subtraction", "-", l, r),
+        Expr::Mul(l, r) => ("multiplication", "*", l, r),
+        Expr::Div(l, r) => ("division", "/", l, r),
+        _ => return Err(Refusal::TypeMismatch(format!("arithmetic::binary called with a non-binary node {expr:?} — a router bug"))),
     };
+    let (left, right) = (eval(l, ctx)?, eval(r, ctx)?);
+    match symbol {
+        "+" => sum(&left, &right),
+        "-" => checked(name, symbol, &left, &right, i64::checked_sub, |a, b| a - b),
+        "*" => checked(name, symbol, &left, &right, i64::checked_mul, |a, b| a * b),
+        _ => divide(&left, &right),
+    }
+}
+
+// Integer operands use the checked operation; anything else is a Float result that must stay
+// finite, as `add` does. Ruby promotes to Bignum; this kernel refuses instead.
+fn checked(name: &str, symbol: &str, lhs: &Value, rhs: &Value, int_op: fn(i64, i64) -> Option<i64>, float_op: fn(f64, f64) -> f64) -> Result<Value, Refusal> {
+    if let (Value::Int(l), Value::Int(r)) = (lhs, rhs) {
+        return int_op(*l, *r).map(Value::Int).ok_or_else(|| eval_error(format!("{name} overflowed: {l} {symbol} {r} does not fit in a 64-bit integer")));
+    }
+    let l = require_number(lhs, name)?;
+    let r = require_number(rhs, name)?;
+    finite(name, symbol, l, r, float_op(l, r))
+}
 
-    sum(&eval(l, ctx)?, &eval(r, ctx)?)
+fn finite(name: &str, symbol: &str, l: f64, r: f64, result: f64) -> Result<Value, Refusal> {
+    if result.is_finite() {
+        return Ok(Value::Float(result));
+    }
+    Err(eval_error(format!("{name} overflowed: {l} {symbol} {r} is not a finite number")))
+}
+
+// Integer division floors toward negative infinity, as Ruby's `Integer#/` does (Rust's `/`
+// truncates). A zero divisor is the same fault `.modulo` raises.
+fn divide(lhs: &Value, rhs: &Value) -> Result<Value, Refusal> {
+    let r = require_number(rhs, "division")?;
+    if r == 0.0 {
+        return Err(eval_error("divided by 0".to_string()));
+    }
+    if let (Value::Int(l), Value::Int(r)) = (lhs, rhs) {
+        return floored_div(*l, *r).map(Value::Int).ok_or_else(|| eval_error(format!("division overflowed: {l} / {r} does not fit in a 64-bit integer")));
+    }
+    let l = require_number(lhs, "division")?;
+    finite("division", "/", l, r, l / r)
+}
+
+// `None` only for `i64::MIN / -1`, the one quotient that does not fit.
+fn floored_div(l: i64, r: i64) -> Option<i64> {
+    let quotient = l.checked_div(r)?;
+    Some(if l % r != 0 && ((l < 0) != (r < 0)) { quotient - 1 } else { quotient })
 }
 
 pub fn modulo(expr: &Expr, ctx: &EvalContext) -> Result<Value, Refusal> {
@@ -35,6 +84,47 @@ fn floored_mod(r: i64, d: i64) -> i64 {
     if raw != 0 && (raw < 0) != (d < 0) { raw + d } else { raw }
 }
 
+#[cfg(test)]
+mod division_tests {
+    use super::{checked, divide, floored_div};
+    use crate::kernel::expr::Value;
+
+    #[test]
+    fn floors_toward_negative_infinity_across_every_sign_combination() {
+        // Real `ruby -e 'puts X / Y'` results.
+        assert_eq!(floored_div(7, 2), Some(3));
+        assert_eq!(floored_div(-7, 2), Some(-4));
+        assert_eq!(floored_div(7, -2), Some(-4));
+        assert_eq!(floored_div(-7, -2), Some(3));
+        assert_eq!(floored_div(-6, 2), Some(-3));
+        assert_eq!(floored_div(0, -5), Some(0));
+    }
+
+    #[test]
+    fn a_money_percentage_rounds_down() {
+        let product = checked("multiplication", "*", &Value::Int(10801), &Value::Int(50), i64::checked_mul, |a, b| a * b).unwrap();
+
+        assert_eq!(divide(&product, &Value::Int(100)).unwrap(), Value::Int(5400));
+    }
+
+    #[test]
+    fn a_zero_divisor_is_a_fault_not_a_crash() {
+        assert!(divide(&Value::Int(1), &Value::Int(0)).is_err());
+        assert!(divide(&Value::Float(1.0), &Value::Float(0.0)).is_err());
+    }
+
+    #[test]
+    fn the_one_unrepresentable_quotient_is_a_fault() {
+        assert!(divide(&Value::Int(i64::MIN), &Value::Int(-1)).is_err());
+    }
+
+    #[test]
+    fn overflowing_products_and_differences_are_faults() {
+        assert!(checked("multiplication", "*", &Value::Int(i64::MAX), &Value::Int(2), i64::checked_mul, |a, b| a * b).is_err());
+        assert!(checked("subtraction", "-", &Value::Int(i64::MIN), &Value::Int(1), i64::checked_sub, |a, b| a - b).is_err());
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::floored_mod;
@@ -126,3 +216,38 @@ fn sum(lhs: &Value, rhs: &Value) -> Result<Value, Refusal> {
 pub fn require_number(v: &Value, operation: &str) -> Result<f64, Refusal> {
     scalar::numeric(v).ok_or_else(|| eval_error(format!("{operation} expects a number, got {v:?}")))
 }
+
+#[cfg(test)]
+mod path_operand_tests {
+    use crate::kernel::expr::{interpret, EvalContext, Expr, Field, Fielded, NoFields, Value};
+
+    // Shaped like a generated multi-field value object: `Charge { cents, currency }`.
+    struct Charge(i64);
+    impl Fielded for Charge {
+        fn field(&self, name: &str) -> Option<Field<'_>> {
+            match name {
+                "cents" => Some(Field::Value(Value::Int(self.0))),
+                "currency" => Some(Field::Value(Value::Str("USD".to_string()))),
+                _ => None,
+            }
+        }
+    }
+
+    struct Record(Charge);
+    impl Fielded for Record {
+        fn field(&self, name: &str) -> Option<Field<'_>> {
+            (name == "charged").then(|| Field::Nested(&self.0))
+        }
+    }
+
+    fn percent_of(path: &'static str) -> Value {
+        let times = Expr::Mul(Box::new(Expr::Lookup(path)), Box::new(Expr::Int(50)));
+        let expr = Expr::Div(Box::new(times), Box::new(Expr::Int(100)));
+        interpret(&expr, &EvalContext { args: &NoFields, instance: &Record(Charge(10801)) }).expect("evaluates")
+    }
+
+    #[test]
+    fn an_operand_reads_a_field_inside_a_value_object_by_path() {
+        assert_eq!(percent_of("charged.cents"), Value::Int(5400));
+    }
+}

data/rust/src/kernel/expression_operators/text.rs

@@ -1,5 +1,5 @@
-//! The "text" expression-operator category: `.split`, `.start_with?`, `.end_with?`.
-//! String receivers only; `expr.rs` routes only these three nodes here.
+//! The "text" expression-operator category: `.split`, `.strip` (and `.lstrip`/`.rstrip`),
+//! `.start_with?`, `.end_with?`. String receivers only; `expr.rs` routes only these nodes here.
 
 use crate::kernel::expr::{eval_error, interpret as eval, EvalContext, Expr, Value};
 use crate::kernel::Refusal;
@@ -15,6 +15,10 @@ pub fn interpret(expr: &Expr, ctx: &EvalContext) -> Result<Value, Refusal> {
             }
             Ok(Value::Array(parts.into_iter().map(|p| Value::Str(p.to_string())).collect()))
         }
+        Expr::Strip { receiver, side } => {
+            let text = require_str(&eval(receiver, ctx)?, "strip")?;
+            Ok(Value::Str(side.trim(&text)))
+        }
         Expr::StartsWith { receiver, substring } => {
             let text = require_str(&eval(receiver, ctx)?, "start_with?")?;
             Ok(Value::Bool(text.starts_with(substring.as_str())))
@@ -63,6 +67,26 @@ mod tests {
         assert_eq!(run(phrase), Value::Array(vec![Value::Str("abc".to_string())]));
     }
 
+    #[test]
+    fn strip_trims_rubys_whitespace_set_and_nothing_else() {
+        use crate::kernel::expr::StripSide;
+        let strip = |side, text: &str| run(Expr::Strip { receiver: Box::new(str(text)), side });
+        assert_eq!(strip(StripSide::Both, " \t\n a b \r\u{b}\u{c}\0"), Value::Str("a b".to_string()));
+        assert_eq!(strip(StripSide::Left, "\0  a "), Value::Str("a ".to_string()));
+        assert_eq!(strip(StripSide::Right, " a \0 "), Value::Str(" a".to_string()));
+        assert_eq!(strip(StripSide::Both, "   "), Value::Str(String::new()));
+        // A non-breaking space is not Ruby whitespace, so it stays.
+        assert_eq!(strip(StripSide::Both, "\u{a0}a\u{a0}"), Value::Str("\u{a0}a\u{a0}".to_string()));
+    }
+
+    #[test]
+    fn strip_on_a_non_string_refuses_with_the_operator_named() {
+        use crate::kernel::expr::StripSide;
+        let ctx = EvalContext { args: &NoFields, instance: &NoFields };
+        let err = eval(&Expr::Strip { receiver: Box::new(Expr::Int(1)), side: StripSide::Both }, &ctx).unwrap_err();
+        assert!(format!("{err:?}").contains("strip expects a string"), "{err:?}");
+    }
+
     #[test]
     fn start_and_end_with() {
         assert_eq!(run(Expr::StartsWith { receiver: Box::new(str("{}")), substring: "{".to_string() }), Value::Bool(true));

data/rust/src/kernel/json.rs

@@ -592,6 +592,18 @@ mod value_object_shape_tests {
     }
 }
 
+#[cfg(test)]
+mod escaped_string_tests {
+    use super::*;
+
+    #[test]
+    fn control_characters_are_written_the_way_rubys_json_generate_writes_them() {
+        let mut out = String::new();
+        write_escaped_string("\u{8}\u{c}\n\r\t\u{b}\0\u{1f}/\u{7f}", &mut out);
+        assert_eq!(out, "\"\\b\\f\\n\\r\\t\\u000b\\u0000\\u001f/\u{7f}\"");
+    }
+}
+
 fn write_escaped_string(s: &str, out: &mut String) {
     out.push('"');
     for c in s.chars() {
@@ -601,6 +613,9 @@ fn write_escaped_string(s: &str, out: &mut String) {
             '\n' => out.push_str("\\n"),
             '\t' => out.push_str("\\t"),
             '\r' => out.push_str("\\r"),
+            // Ruby's `JSON.generate` writes these two short, not as `\u0008` / `\u000c`.
+            '\u{8}' => out.push_str("\\b"),
+            '\u{c}' => out.push_str("\\f"),
             c if (c as u32) < 0x20 => out.push_str(&format!("\\u{:04x}", c as u32)),
             c => out.push(c),
         }

data/rust/src/kernel/mod.rs

@@ -21,7 +21,7 @@ pub mod repository;
 pub mod routing;
 
 pub use dispatch::{aggregate_step_site, apply_entity_command, decode_aggregate_arguments, decode_entity_arguments, dispatch, dispatch_entity, enforce_invariants, entity_step_site, ArgumentGates, EnsuresSpec, EntityInvariants, GivenSpec, Hydrate, InvariantSet, InvariantSpec, StepSite, TransitionCheck};
-pub use expr::{interpret, BlockMode, Bound, Comparison, EvalContext, Expr, Field, Fielded, NoFields, Value, WithParent};
+pub use expr::{interpret, BlockMode, Bound, Comparison, EvalContext, Expr, Field, Fielded, NoFields, StripSide, Value, WithParent};
 pub use json::Json;
 pub use named_query::{QueryCondition, QueryConditionValue, QueryDef};
 pub use orchestrate::{