hecks 3.10.0 → 3.12.0

data/lib/hecks/bluebook/model_check/reference_checks.rb

@@ -0,0 +1,70 @@
+module Hecks
+  module Bluebook
+    module ModelCheck
+      # The checks over how aggregates relate: an attribute that copies another aggregate's
+      # identity by value, where `reference_to` would state the link and have it enforced.
+      module ReferenceChecks
+        # Types that name no aggregate's identity, however many aggregates declare one of them.
+        PRIMITIVE_TYPES = %w[String Integer Float Boolean Date DateTime Time Symbol JSON Hash Array].freeze
+
+        # Flags each scalar attribute whose type is the identity type of another aggregate in
+        # this domain and that is not itself a reference: the link exists only by convention.
+        #
+        # @param bluebook [Bluebook::Chapter] the assembled chapter to check
+        # @return [Array<Finding>] one :key_by_value warning per such attribute
+        def key_by_value_findings(bluebook)
+          owners = identity_type_owners(bluebook)
+          bluebook.aggregates.flat_map do |aggregate|
+            aggregate.attributes.filter_map { |attribute| key_by_value_finding(aggregate, attribute, owners) }
+          end
+        end
+
+        # @return [Hash{String => Array<String>}] each identity attribute's type, to the names
+        #   of the aggregates whose identity it is
+        def identity_type_owners(bluebook)
+          bluebook.aggregates.each_with_object(Hash.new { |hash, key| hash[key] = [] }) do |aggregate, owners|
+            identity_types(aggregate).each { |type| owners[type] << aggregate.hecks_name }
+          end
+        end
+
+        # A composite identity is several facts (a timestamp among them is no key to copy), so
+        # only a single-head identity counts.
+        #
+        # @return [Array<String>] the type of the aggregate's identity attribute, if it has
+        #   exactly one and it is neither a reference, a list nor a primitive
+        def identity_types(aggregate)
+          return [] unless aggregate.identity_heads.size == 1
+
+          attribute = aggregate.attribute(aggregate.identity_heads.first)
+          attribute && valued_attribute?(attribute) ? [attribute.type.to_s] : []
+        end
+
+        # @return [Boolean] whether the attribute is one scalar of a named, non-primitive type
+        def valued_attribute?(attribute)
+          return false if attribute.reference? || attribute.list?
+
+          !PRIMITIVE_TYPES.include?(attribute.type.to_s)
+        end
+
+        # An owner's single identity attribute is the key itself; being one head of a composite
+        # identity is not, since that aggregate still copies the key by value.
+        def own_identity?(aggregate, attribute)
+          aggregate.identity_heads == [attribute.name.to_sym]
+        end
+
+        def key_by_value_finding(aggregate, attribute, owners)
+          return unless valued_attribute?(attribute)
+          return if own_identity?(aggregate, attribute)
+
+          target = (owners.fetch(attribute.type.to_s, []) - [aggregate.hecks_name]).first
+          return unless target
+
+          Finding.new(kind: :key_by_value, severity: :warning,
+                      subject: "#{aggregate.hecks_name}.#{attribute.name}",
+                      message: "#{attribute.type} matches #{target}'s identity by value, " \
+                               "so nothing enforces the link; use reference_to #{target}")
+        end
+      end
+    end
+  end
+end

data/lib/hecks/bluebook/model_check.rb

@@ -4,6 +4,8 @@ require_relative "model_check/client_profile"
 require_relative "model_check/lifecycle_checks"
 require_relative "model_check/saga_checks"
 require_relative "model_check/policy_checks"
+require_relative "model_check/ask_checks"
+require_relative "model_check/reference_checks"
 require_relative "model_check/verbs"
 
 module Hecks
@@ -32,6 +34,8 @@ module Hecks
       extend LifecycleChecks
       extend SagaChecks
       extend PolicyChecks
+      extend AskChecks
+      extend ReferenceChecks
       extend Verbs
 
       module_function
@@ -59,15 +63,17 @@ module Hecks
         findings
       end
 
-      # Lifecycles, sagas and policies: what the model says about itself.
+      # Lifecycles, sagas, policies and references: what the model says about itself.
       def modelled_findings(bluebook, options)
         [
           *bluebook.aggregates.flat_map { |aggregate| aggregate_lifecycle_findings(aggregate) },
+          *key_by_value_findings(bluebook),
           *bluebook.process_managers.flat_map { |process_manager| saga_findings(bluebook, process_manager) },
           *bluebook.policies.flat_map do |policy|
             policy_findings(bluebook, policy, options[:hecksagon], options[:known_domains],
                             options[:global_emitted_events])
-          end
+          end,
+          *unused_ask_findings(bluebook)
         ]
       end
 

data/lib/hecks/bluebook/policy.rb

@@ -13,6 +13,7 @@ module Hecks
         name:               :name,
         on_event:           :on_event,
         trigger_command:    :trigger_command,
+        ask:                :ask,
         target_domain:      :target_domain,
         expect_undelivered: :expect_undelivered,
         where:              :where,
@@ -21,17 +22,18 @@ module Hecks
         where_ast:          -> { where_ast }
       )
 
-      attr_reader :name, :on_event, :trigger_command, :target_domain, :expect_undelivered, :where, :for_each, :with_spec
+      attr_reader :name, :on_event, :trigger_command, :ask, :target_domain, :expect_undelivered, :where, :for_each, :with_spec
 
       # Aggregate, declared and deliberately off the wire
       # the wire format is a pinned contract, and it does not carry
       # where a policy was written before the builder hoisted it
       attr_accessor :aggregate
 
-      def initialize(name:, on_event: nil, trigger_command: nil, target_domain: nil, expect_undelivered: false, where: nil, for_each: nil, with_spec: [], aggregate: nil)
+      def initialize(name:, on_event: nil, trigger_command: nil, ask: nil, target_domain: nil, expect_undelivered: false, where: nil, for_each: nil, with_spec: [], aggregate: nil)
         @name = name.to_s
         @on_event = on_event
         @trigger_command = trigger_command
+        @ask = ask
         @target_domain = target_domain
         @expect_undelivered = expect_undelivered.to_s == "true"
         @where = where

data/lib/hecks/bluebook/smoke_test.rb

@@ -27,7 +27,7 @@ module Hecks
       def call(dir)
         Dir.mktmpdir("hecks-smoke-") do |scratch|
           isolate!(dir, scratch)
-          dispatcher = Hecks.boot(scratch, install_doors: false)
+          dispatcher = Hecks.boot(scratch, install_driving: false)
           domain     = dispatcher.registry.bluebooks.keys.first
           next [] unless domain
 

data/lib/hecks/bluebook/synthesizer.rb

@@ -1,3 +1,5 @@
+require_relative "attribute"
+
 module Hecks
   module Bluebook
     # Synthesizes one argument per declared attribute from the IR: fixed markers for scalars,

data/lib/hecks/bluebook.rb

@@ -25,6 +25,7 @@ require_relative "bluebook/read_model"
 require_relative "bluebook/entity"
 require_relative "bluebook/domain_port"
 require_relative "bluebook/policy"
+require_relative "bluebook/ask_resolution"
 require_relative "bluebook/process_manager"
 require_relative "bluebook/aggregate"
 require_relative "bluebook/hecksagon"
@@ -34,6 +35,7 @@ require_relative "bluebook/assembly/contract"
 require_relative "bluebook/assembly/contracts"
 require_relative "bluebook/assembly/specializer"
 require_relative "bluebook/assembly/build"
+require_relative "bluebook/assembly/scalars"
 require_relative "bluebook/assembly/marks"
 require_relative "bluebook/assembly/aggregate_assembly"
 require_relative "bluebook/assembly"

data/lib/hecks/cli/command_table.rb

@@ -62,7 +62,7 @@ module Hecks
         ->(argv, program, _name) { ProjectCli.call(argv, program: program, root: Dir.pwd, remove_stale_bin: false) }
       ),
       "mcp"              => Command.new(
-        "Serve the MCP door over stdio (no authentication; stdio only).",
+        "Serve the MCP server over stdio (no authentication; stdio only).",
         "hecks mcp [--stdio]",
         "cli/mcp",
         ->(argv, _program, _name) { Mcp.call(argv) }

data/lib/hecks/cli/console.rb

@@ -7,7 +7,8 @@ require_relative "../ports/persistence/plugins/era"
 module Hecks
   module CLI
     # The command behind `hecks console` and Custodian's `Operation.OpenConsole`: boots a domain
-    # (pizzas on Memory by default) and drops into IRB with its door installed, for dispatching a
+    # (pizzas on Memory by default) and drops into IRB with its Ruby adapter installed, for
+    # dispatching a
     # real command by hand. No argument needs no database (ADR 0073); a domain directory boots as
     # it is wired, which may bind PostgresEra (examples/directory does).
     module Console

data/lib/hecks/cli/document.rb

@@ -44,7 +44,7 @@ module Hecks
       # @api private
       def boot_bluebook(path)
         begin
-          runtime = Hecks.boot(path, install_doors: false)
+          runtime = Hecks.boot(path, install_driving: false)
         rescue StandardError => e
           abort "cannot read #{path}: #{e.message.lines.first.strip}"
         end

data/lib/hecks/cli/launcher_words.rb

@@ -57,7 +57,7 @@ module Hecks
       def launcher_words(name, rest)
         return [rest, nil] if UNTOUCHED.include?(name)
 
-        require_relative "../doors/cli_door"
+        require_relative "../adapters/driving/cli"
         words = strip_generic(rest)
         form  = LAUNCHER_FORMS[name]
         return [words, nil] unless form && words.any? { |word| word.match?(NAME_VALUE) }
@@ -133,7 +133,7 @@ module Hecks
 
       # @api private
       def add_flag(key, value, extra)
-        extra << "--#{key.tr("_", "-")}" if Doors::CliDoor.boolean(value)
+        extra << "--#{key.tr("_", "-")}" if Adapters::Driving::Cli.boolean(value)
         nil
       end
 
@@ -153,7 +153,7 @@ module Hecks
           flag, value = word.split("=", 2)
           next kept << word unless GENERIC_FLAGS.include?(flag)
 
-          Doors::CliDoor.boolean(value || generic_value(queue))
+          Adapters::Driving::Cli.boolean(value || generic_value(queue))
         end
         kept
       end
@@ -161,7 +161,7 @@ module Hecks
       # The Boolean word that follows a generic flag, or "true" when none does.
       # @api private
       def generic_value(queue)
-        Doors::CliDoor::BOOLEAN_WORDS.key?(queue.first.to_s.downcase) ? queue.shift : "true"
+        Adapters::Driving::Cli::BOOLEAN_WORDS.key?(queue.first.to_s.downcase) ? queue.shift : "true"
       end
     end
   end

data/lib/hecks/cli/mcp.rb

@@ -2,14 +2,14 @@ require_relative "../mcp_stdio_guard"
 
 module Hecks
   module CLI
-    # The command behind `hecks mcp`: the MCP door onto the
+    # The command behind `hecks mcp`: the MCP server onto the
     # storehouse bus, over stdio only.
     #
     # This file loads nothing but `McpStdioGuard`, so the transport check runs
     # before the framework does.
     module Mcp
       # The server name the guard's refusals and warnings carry.
-      SERVER = "hecks-mcp-door".freeze
+      SERVER = "hecks-mcp".freeze
 
       module_function
 
@@ -23,8 +23,8 @@ module Hecks
       #   set up for stdio
       def call(argv)
         McpStdioGuard.enforce_stdio!(server: SERVER, argv: argv)
-        require_relative "../doors/mcp_door"
-        Doors::McpDoor.serve
+        require_relative "../adapters/driving/mcp"
+        Adapters::Driving::Mcp.serve
       end
     end
   end

data/lib/hecks/cli/project_cli/launcher_source.rb

@@ -126,8 +126,8 @@ module Hecks
         # @api private
         # @return [String] the opted-in launcher's middle
         def described_entry(name, boot, shown, quiet: false)
-          started = "Hecks.boot_described(described, install_doors: false)"
-          started = "Hecks::Doors::LauncherOptions.quietly(hold: #{RUNS_ON_MEMORY}) { #{started} }" if quiet
+          started = "Hecks.boot_described(described, install_driving: false)"
+          started = "Hecks::Adapters::Driving::LauncherOptions.quietly(hold: #{RUNS_ON_MEMORY}) { #{started} }" if quiet
           render(DESCRIBED_ENTRY, boot: boot, shown: shown, name: name, started: started).chomp
         end
 

data/lib/hecks/cli/project_cli/templates.rb

@@ -38,7 +38,7 @@ module Hecks
             abort "cannot open {{name}}: #{e.message.lines.first.strip}"
           end
 
-          text, status, reason = Hecks::Doors::CliRunner.usage(
+          text, status, reason = Hecks::Adapters::Driving::CliRunner.usage(
             runtime: described, argv: ARGV, program: program
           )
           unless text
@@ -48,9 +48,9 @@ module Hecks
               abort "cannot open {{name}}: #{e.message.lines.first.strip}"
             end
             # A question the world lists under `streams`, given `--stream`, tails until interrupted.
-            streamed = Hecks::Doors::CliRunner.stream(runtime: runtime, argv: ARGV, program: program)
+            streamed = Hecks::Adapters::Driving::CliRunner.stream(runtime: runtime, argv: ARGV, program: program)
             exit streamed unless streamed.nil?
-            text, status, reason = Hecks::Doors::CliRunner.call(
+            text, status, reason = Hecks::Adapters::Driving::CliRunner.call(
               runtime: runtime, argv: ARGV, program: program
             )
           end
@@ -59,12 +59,12 @@ module Hecks
         # The middle every launcher had before opted-in ones answered usage alone.
         PLAIN_ENTRY = <<~'RUBY'.freeze
           runtime = begin
-            Hecks.boot({{boot}}, install_doors: false)
+            Hecks.boot({{boot}}, install_driving: false)
           rescue StandardError => e
             abort "cannot open {{name}}: #{e.message.lines.first.strip}"
           end
 
-          text, status = Hecks::Doors::CliRunner.call(
+          text, status = Hecks::Adapters::Driving::CliRunner.call(
             runtime: runtime, argv: ARGV, program: "{{shown}}"
           )
         RUBY

data/lib/hecks/cli/project_cli.rb

@@ -9,12 +9,15 @@ module Hecks
     # `Hecks.bluebook "QualityControl"` in `qa/` becomes `qa/quality_control`.
     #
     # Each launcher is a dozen lines pinning one directory and handing over to
-    # `Doors::CliRunner`; the surface itself is projected at the moment it runs,
+    # `Adapters::Driving::CliRunner`; the surface itself is projected at the moment it runs,
     # so editing a chapter changes behaviour without regenerating anything.
     #
     # A chapter whose world's `launcher` setting names an `executable` gets its launcher
     # there instead: the Hecks chapter's is the gem's `exe/hecks`.
     module ProjectCli
+      # Raised when the project loads no bluebook.
+      class Error < RuntimeError; end
+
       # Build output and other trees under a root that hold no domain a caller means.
       IGNORED = %r{\A(rust|deploy|tmp|coverage)/}
 
@@ -34,7 +37,7 @@ module Hecks
       # @param argv [Array<String>] domain paths under `root`, and optionally `--check`
       # @param program [String] how the caller was invoked, named in a launcher's header
       # @param root [String] the directory launchers are written under
-      # @param remove_stale_bin [Boolean] delete `root/bin/<name>`, a second front door
+      # @param remove_stale_bin [Boolean] delete `root/bin/<name>`, a second entry point
       # @return [void]
       # @raise [SystemExit] with status 1 for a launcher out of date, an unreadable domain, a
       #   path outside `root` or an unknown flag
@@ -88,9 +91,9 @@ module Hecks
       #   when `check` found it out of date, `:failed` when the domain could not be read or its
       #   launcher could not be made
       def one(root, path, program, check, remove_stale_bin)
-        runtime = Hecks.boot(File.join(root, path), install_doors: false)
-        name    = runtime.registry.bluebooks.keys.first or raise "it loads no bluebook"
-        setting = Doors::LauncherOptions.settings(runtime, name) || {}
+        runtime = Hecks.boot(File.join(root, path), install_driving: false)
+        name    = runtime.registry.bluebooks.keys.first or raise Error, "it loads no bluebook"
+        setting = Adapters::Driving::LauncherOptions.settings(runtime, name) || {}
         settle(launcher_target(name, path, setting, root, program), path, root, check, remove_stale_bin)
       rescue StandardError, LoadError => e
         refuse(path, "cannot boot — #{e.message.lines.first.to_s.strip}")
@@ -122,7 +125,7 @@ module Hecks
         Target.new(name, label, File.join(root, label), text, snake, executable)
       end
 
-      # Writes the launcher, makes it executable, and removes the second front door in `bin/`.
+      # Writes the launcher, makes it executable, and removes the second entry point in `bin/`.
       #
       # @api private
       def write_launcher(target, root, remove_stale_bin)

data/lib/hecks/cli/run.rb

@@ -68,8 +68,8 @@ module Hecks
       # near miss deserves the runner's "did you mean" rather than the step-list
       # form's "no such script".
       def cli_form(domain, argv, program)
-        runtime = Hecks.boot(domain, install_doors: false)
-        text, status = Doors::CliRunner.call(runtime: runtime, argv: argv, program: program)
+        runtime = Hecks.boot(domain, install_driving: false)
+        text, status = Adapters::Driving::CliRunner.call(runtime: runtime, argv: argv, program: program)
         status.zero? ? puts(text) : abort(text)
         exit 0
       end

data/lib/hecks/cli/smoke_http/checks.rb

@@ -46,7 +46,10 @@ module Hecks
             before = state
             expect_success(post(payload, signed_headers))
             after = state
-            raise "the state changed on a repeated delivery:\n    before #{before}\n    after  #{after}" unless before == after
+            unless before == after
+              raise Failure,
+                    "the state changed on a repeated delivery:\n    before #{before}\n    after  #{after}"
+            end
           end
         end
 

data/lib/hecks/cli/smoke_http/transport.rb

@@ -29,15 +29,15 @@ module Hecks
         end
 
         def expect_status(res, code)
-          raise "expected #{code}, got #{res.code}" unless res.code.to_i == code
+          raise Failure, "expected #{code}, got #{res.code}" unless res.code.to_i == code
         end
 
         def expect_success(res)
-          raise "expected 2xx, got #{res.code}: #{res.body.to_s[0, 200]}" unless res.code.to_i.between?(200, 299)
+          raise Failure, "expected 2xx, got #{res.code}: #{res.body.to_s[0, 200]}" unless res.code.to_i.between?(200, 299)
         end
 
         def expect_refused(res)
-          raise "expected a 4xx refusal, got #{res.code}" unless res.code.to_i.between?(400, 499)
+          raise Failure, "expected a 4xx refusal, got #{res.code}" unless res.code.to_i.between?(400, 499)
         end
       end
     end

data/lib/hecks/cli/smoke_http.rb

@@ -12,6 +12,9 @@ module Hecks
   module CLI
     # One run of the checks against one service.
     class SmokeHttp
+      # Raised when a smoke check's request gets an answer other than the one it expects.
+      class Failure < RuntimeError; end
+
       include Checks
       include Transport
       extend Settings

data/lib/hecks/codemod.rb

@@ -6,6 +6,9 @@ module Hecks
   # Shared machinery for a codemod that migrates real `.bluebook` source: boot,
   # find candidates, edit, then verify by diffing the re-booted IR before keeping it.
   module Codemod
+    # Raised when a shadow cannot be built from the construct.
+    class Error < RuntimeError; end
+
     ROOT = File.expand_path("../..", __dir__)
 
     EXAMPLE_ROOTS = Corpus.members(:example, root: ROOT).map(&:path)
@@ -155,8 +158,8 @@ module Hecks
 
       matches = element_candidates(construct).select { |c| c.hecks_name.to_s == list_attr.type.to_s }
       if matches.size > 1
-        raise "#{construct.hecks_name}##{list_field} names #{list_attr.type}, held by both a value " \
-              "object and an entity — ambiguous, cannot resolve which one the list holds"
+        raise Error, "#{construct.hecks_name}##{list_field} names #{list_attr.type}, held by both a value " \
+                     "object and an entity — ambiguous, cannot resolve which one the list holds"
       end
 
       matches.first

data/lib/hecks/corpus/routes.rb

@@ -24,9 +24,16 @@ module Hecks
                 "its filename declares (bump_* / same_*)"),
       Route.new(%r{\Aspec/fixtures/model_check/}, :named_in, "spec/model_check_spec.rb", :each_file,
                 "domains broken on purpose; each must produce exactly the finding kinds it is built to trigger"),
+      Route.new(%r{\Aspec/fixtures/site/editor_chapters/domain/}, :named_in, "spec/site_cms_editor_chapters_spec.rb",
+                "site/editor_chapters",
+                "two chapters that both declare a Category, so the editor must tell them apart; one SQLite " \
+                "file keeps tables by bare aggregate name, which cannot hold both, so the sweep cannot boot it"),
       # hecks fuzz sweeps it too, once Fuzzing::Replay coerces value-object args
       # before recomputing givens — today it doesn't, so this given reads as
       # wrongly admitted.
+      Route.new(%r{\Aspec/corpus/asks/}, :named_in, "spec/policy_ask_spec.rb", "spec/corpus/asks",
+                "a corpus-owned domain whose ports have no adapter, so an ask is refused; its frozen " \
+                "targets are held to the Ruby runtime there and to the Rust policy table in rust/codegen"),
       Route.new(%r{\Aspec/fixtures/rust_host/}, :named_in, "rust/host/src/web/commerce.rs", "checkout_fixture",
                 "the Rust host's checkout fixture, pinned by its web and /api tests")
     ].freeze

data/lib/hecks/corpus/rust.rb

@@ -184,9 +184,10 @@ module Hecks
       # domain wins Cargo's `default` is derived, not hand-picked.
       #
       # @param root [String] repository root to search under
-      # @return [Array<RustDomain>] already-generated Rust domains, in regeneration order
+      # @return [Array<RustDomain>] every Rust domain with a Cargo feature, in regeneration order:
+      #   a fresh checkout has no generated output, so the sources, not the output, name them
       def rust_regen_order(root: ROOT)
-        rust_domains(root: root).select { |domain| generated?(domain.feature, root: root) }
+        rust_domains(root: root)
       end
     end
   end

data/lib/hecks/deploy/bluebook/deploy.bluebook

@@ -212,6 +212,7 @@ Hecks.bluebook "Deploy" do
     attribute :volume_gb,      VolumeGb
     attribute :database_class, DatabaseClass
     attribute :storage_gb,     StorageGb
+    attribute :cdn_aliases,    list_of(CdnAlias), optional: true
 
     value_object "DomainName" do
       attribute :value, String
@@ -251,8 +252,19 @@ Hecks.bluebook "Deploy" do
       invariant("storage is at most 65536 GB") { value <= 65536 }
     end
 
-    # All six required for the same reason as `FargateTarget.Declare`; this validates a target
-    # already resolved by `hecks deploy project`'s defaults.
+    # A host name the CloudFront edge answers on, such as app.example.com. Lowercase labels only:
+    # CloudFront refuses a name its certificate does not cover at deploy, which this cannot see.
+    value_object "CdnAlias" do
+      attribute :value, String
+      invariant("a CDN alias is a lowercase host name such as app.example.com") do
+        value.to_s.match?(/\A([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]\z/)
+      end
+      invariant("a CDN alias is at most 253 characters") { value.to_s.length <= 253 }
+    end
+
+    # The first six are required for the same reason as `FargateTarget.Declare`; this validates a
+    # target already resolved by `hecks deploy project`'s defaults. `cdn_aliases` is the one
+    # optional setting: naming at least one asks for the CloudFront edge stack.
     command "Declare" do
       goal "Validate one domain's AwsBox deploy target before anything is generated from it"
 
@@ -262,6 +274,7 @@ Hecks.bluebook "Deploy" do
       attribute :volume_gb,      VolumeGb
       attribute :database_class, DatabaseClass
       attribute :storage_gb,     StorageGb
+      attribute :cdn_aliases,    list_of(CdnAlias), optional: true
 
       sets :domain
       sets :region
@@ -269,6 +282,7 @@ Hecks.bluebook "Deploy" do
       sets :volume_gb
       sets :database_class
       sets :storage_gb
+      sets :cdn_aliases
 
       emits "BoxTargetDeclared"
     end
@@ -445,6 +459,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "refused"
       transition "Reprovision" => "requested",   from: %w[provisioned refused]
       transition "Complete"    => "provisioned", from: "requested"
       transition "Abandon"     => "refused",     from: "requested"
@@ -602,6 +617,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
       transition "Complete" => "projected", from: "requested"
       transition "Fault"    => "faulted",   from: "requested"
     end
@@ -714,6 +730,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
       transition "Complete" => "cleared", from: "requested"
       transition "Fault"    => "faulted", from: "requested"
     end
@@ -811,6 +828,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Pass" => "clean",   from: "requested"
       transition "Flag" => "flagged", from: "requested"
     end
@@ -914,6 +932,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Pass" => "within_budget", from: "requested"
       transition "Flag" => "flagged",       from: "requested"
     end
@@ -1031,6 +1050,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Pass" => "passed", from: "requested"
       transition "Flag" => "flagged", from: "requested"
     end
@@ -1179,6 +1199,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Complete" => "rolled", from: "requested"
       transition "Flag" => "flagged", from: "requested"
       transition "Verify" => "verified", from: "rolled"
@@ -1361,6 +1382,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Complete" => "rolled", from: "requested"
       transition "Flag" => "flagged", from: "requested"
       transition "Verify" => "verified", from: "rolled"
@@ -1372,10 +1394,11 @@ Hecks.bluebook "Deploy" do
     # Runs the project's generated `deploy-box.sh`: render the Compose files, push them to the box over
     # SSM, start the containers and check them. A policy then requests a `SmokeRun`, unless
     # `skip_smoke=true`. Exit 1 when flagged, with the script's status (40 no instance, 41 the roll
-    # failed, 42 the box unhealthy).
+    # failed, 42 the box unhealthy, 43 no restore anchor). Before the roll the script names the point the
+    # database can be restored to, so the report always carries the way back from a minted era.
 
     command "Run" do
-      goal "Roll the app box and record whether it came up healthy (exit 1 when flagged: 40 no instance, 41 roll failed, 42 box unhealthy)"
+      goal "Roll the app box and record whether it came up healthy (exit 1 when flagged: 40 no instance, 41 roll failed, 42 box unhealthy, 43 no restore anchor)"
 
       attribute :project,    Location
       attribute :script,     Location, optional: true
@@ -1554,6 +1577,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged", "drifted"
       transition "Complete" => "restored", from: "requested"
       transition "Plan" => "planned", from: "requested"
       transition "Flag" => "flagged", from: "requested"
@@ -1835,6 +1859,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "drifted", "flagged"
       transition "Match" => "verified", from: "requested"
       transition "Differ" => "drifted", from: "requested"
       transition "Flag" => "flagged", from: "requested"
@@ -1977,6 +2002,7 @@ Hecks.bluebook "Deploy" do
     # No outcome is a failure: a report that could not be made is `unavailable`, never `flagged`
     # (only a malformed request is), because the era check gates a deploy, not this report.
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Match" => "unchanged", from: "requested"
       transition "Differ" => "changed", from: "requested"
       transition "Withhold" => "unavailable", from: "requested"
@@ -2140,6 +2166,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "RecordName" => "named", from: "requested"
       transition "RecordUrl" => "located", from: "requested"
       transition "RecordList" => "listed", from: "requested"
@@ -2513,6 +2540,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Complete" => "rolled", from: "requested"
       transition "Plan" => "planned", from: "requested"
       transition "Flag" => "flagged", from: "requested"
@@ -2648,6 +2676,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "drifted", "refused"
       transition "Match"  => "matching", from: "requested"
       transition "Drift"  => "drifted",  from: "requested"
       transition "Refuse" => "refused",  from: "requested"
@@ -2771,6 +2800,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
       transition "Complete" => "projected", from: "requested"
       transition "Fault"    => "faulted",   from: "requested"
     end