hecks 3.14.0 → 4.0.0

data/rust/src/kernel/orchestrate.rs

@@ -60,7 +60,7 @@ pub struct DispatchSpec {
     pub with: &'static [(&'static str, WithValue)],
     /// The command that undoes this dispatch, if any. A reference so the const table can nest it;
     /// a compensation is never itself compensable.
-    pub compensates: Option<&'static DispatchSpec>,
+    pub compensates: Option<&'static Self>,
 }
 
 /// One leg of a process manager: on `event_type` from `from_state`, move to `to_state` and
@@ -105,7 +105,9 @@ pub struct CompletedCompensation {
 
 // Build refuses two legs on one (event, state) pair, so the first match is the only one.
 fn select_leg<'a>(pm: &'a ProcessManagerDef, event: &str, state: &str) -> Option<&'a Handler> {
-    pm.handlers.iter().find(|h| h.event_type == event && h.from_state == state)
+    pm.handlers
+        .iter()
+        .find(|h| h.event_type == event && h.from_state == state)
 }
 
 fn leg_mismatch(pm: &ProcessManagerDef, event: &str, state: &str) -> String {
@@ -124,7 +126,11 @@ fn correlation_head(correlates_by: &str) -> &str {
 }
 
 // An empty correlation counts as absent, so callers need only one check.
-fn correlation_of(pm: &ProcessManagerDef, event: &Event, reference_key_fn: fn(&str) -> Option<&'static str>) -> Option<String> {
+fn correlation_of(
+    pm: &ProcessManagerDef,
+    event: &Event,
+    reference_key_fn: fn(&str) -> Option<&'static str>,
+) -> Option<String> {
     // Tier 1: a dotted path into the event's payload.
     if let Some(v) = event.payload.dig(pm.correlates_by) {
         if let Ok(id) = v.to_id_component() {
@@ -153,7 +159,13 @@ fn correlation_of(pm: &ProcessManagerDef, event: &Event, reference_key_fn: fn(&s
     }
 }
 
-fn resolve_with(pm: &ProcessManagerDef, value: &WithValue, event: &Event, correlation: &str, memory: &Json) -> Json {
+fn resolve_with(
+    pm: &ProcessManagerDef,
+    value: &WithValue,
+    event: &Event,
+    correlation: &str,
+    memory: &Json,
+) -> Json {
     match value {
         WithValue::Literal(build) => build(),
         WithValue::Ref(name) => {
@@ -178,12 +190,30 @@ fn qualify_saga_command_name(domain_name: &str, command_name: &str) -> String {
     format!("{domain_name}::{}", command_name.replacen("::", ".", 1))
 }
 
-fn build_dispatch_args(pm: &ProcessManagerDef, spec: &DispatchSpec, event: &Event, correlation: &str, memory: &Json, domain_name: &str, tables: &Tables) -> Json {
-    let projected = Json::Object(spec.with.iter().map(|(key, value)| (key.to_string(), resolve_with(pm, value, event, correlation, memory))).collect());
+fn build_dispatch_args(
+    pm: &ProcessManagerDef,
+    spec: &DispatchSpec,
+    event: &Event,
+    correlation: &str,
+    memory: &Json,
+    domain_name: &str,
+    tables: &Tables,
+) -> Json {
+    let projected = Json::Object(
+        spec.with
+            .iter()
+            .map(|(key, value)| {
+                (
+                    key.to_string(),
+                    resolve_with(pm, value, event, correlation, memory),
+                )
+            })
+            .collect(),
+    );
     // A saga leg's `with:` is always an explicit projection. The verb is qualified before the
     // lookup because the tables are keyed by the qualified verb.
     let qualified = qualify_saga_command_name(domain_name, spec.command_name);
-    route_dispatch_args(projected, &qualified, tables, event)
+    route_dispatch_args(&projected, &qualified, tables, event)
 }
 
 #[derive(Clone, Copy)]
@@ -201,14 +231,65 @@ pub struct Tables<'a> {
     pub entity_identity_head_fn: fn(&str) -> Option<&'static str>,
 }
 
+/// The shape of the generated `dispatch` an orchestration step calls into: the store, the verb,
+/// its arguments, the caller's role and actor, and the mutation log it appends to.
+type DispatchFn<S> = fn(
+    &mut S,
+    &str,
+    &Json,
+    Option<&str>,
+    Option<&str>,
+    &mut Vec<MutationRecord>,
+) -> Result<Vec<Event>, Refusal>;
+
+/// What one cascade threads through every reaction it triggers: the store it dispatches against
+/// and the logs it appends to. `depth` is an argument, not state, because it grows with each
+/// re-entry.
+struct Cascade<'a, S: AggregateScan> {
+    store: &'a mut S,
+    dispatch_fn: DispatchFn<S>,
+    tables: Tables<'static>,
+    sagas: &'a mut HashMap<(String, String), SagaInstance>,
+    // One host-supplied moment for the whole cascade.
+    occurred_at: Option<&'a str>,
+    all_events: &'a mut Vec<Event>,
+    mutations: &'a mut Vec<MutationRecord>,
+    cross_domain: &'a mut Vec<PendingCrossDomainReaction>,
+    reaction_log: &'a mut Vec<Json>,
+    saga_log: &'a mut Vec<Json>,
+}
+
+/// One process-manager instance's leg of a cascade: which manager, which conversation, and the
+/// domain its commands are qualified with.
+struct SagaLeg<'a> {
+    pm: &'a ProcessManagerDef,
+    correlation: &'a str,
+    domain_name: &'a str,
+}
+
+impl SagaLeg<'_> {
+    fn key(&self) -> (String, String) {
+        (self.pm.name.to_string(), self.correlation.to_string())
+    }
+
+    /// The correlation every event this leg's dispatches produce is stamped with.
+    fn stamp(&self) -> HashMap<String, String> {
+        HashMap::from([(
+            correlation_head(self.pm.correlates_by).to_string(),
+            self.correlation.to_string(),
+        )])
+    }
+}
+
 /// Dispatches `verb`, then recursively runs the policies and saga legs its events trigger.
 /// Only a refusal of the top-level `verb` is returned; reaction refusals are logged and swallowed.
 ///
 /// `saga_correlation` stamps every event this call produces; only saga-leg dispatches pass it.
-#[allow(clippy::too_many_arguments)]
+// reason: every caller, here and in the generated code, holds default-hasher maps.
+#[allow(clippy::too_many_arguments, clippy::implicit_hasher)]
 pub fn orchestrate<S: AggregateScan>(
     store: &mut S,
-    dispatch_fn: fn(&mut S, &str, &Json, Option<&str>, Option<&str>, &mut Vec<MutationRecord>) -> Result<Vec<Event>, Refusal>,
+    dispatch_fn: DispatchFn<S>,
     tables: Tables<'static>,
     sagas: &mut HashMap<(String, String), SagaInstance>,
     verb: &str,
@@ -226,41 +307,84 @@ pub fn orchestrate<S: AggregateScan>(
     reaction_log: &mut Vec<Json>,
     saga_log: &mut Vec<Json>,
 ) -> Result<(), Refusal> {
-    // A fact the command `needs` is answered ahead of every gate (ADR 0081), for a reaction's
-    // dispatch as for the outermost one.
-    let enriched = super::needs::enrich(verb, args, occurred_at);
-    let args = enriched.as_ref().unwrap_or(args);
-    let mut events = dispatch_fn(store, verb, args, caller_role, caller_actor_id, mutations)?;
+    Cascade {
+        store,
+        dispatch_fn,
+        tables,
+        sagas,
+        occurred_at,
+        all_events,
+        mutations,
+        cross_domain,
+        reaction_log,
+        saga_log,
+    }
+    .run(
+        verb,
+        args,
+        caller_role,
+        caller_actor_id,
+        saga_correlation,
+        depth,
+    )
+}
 
-    if let Some(stamp) = saga_correlation {
-        for event in &mut events {
-            event.correlation.get_or_insert_with(HashMap::new).extend(stamp.iter().map(|(k, v)| (k.clone(), v.clone())));
+impl<S: AggregateScan> Cascade<'_, S> {
+    fn run(
+        &mut self,
+        verb: &str,
+        args: &Json,
+        caller_role: Option<&str>,
+        caller_actor_id: Option<&str>,
+        saga_correlation: Option<&HashMap<String, String>>,
+        depth: usize,
+    ) -> Result<(), Refusal> {
+        // A fact the command `needs` is answered ahead of every gate (ADR 0081), for a reaction's
+        // dispatch as for the outermost one.
+        let enriched = super::needs::enrich(verb, args, self.occurred_at);
+        let args = enriched.as_ref().unwrap_or(args);
+        let mut events = (self.dispatch_fn)(
+            self.store,
+            verb,
+            args,
+            caller_role,
+            caller_actor_id,
+            self.mutations,
+        )?;
+
+        if let Some(stamp) = saga_correlation {
+            for event in &mut events {
+                event
+                    .correlation
+                    .get_or_insert_with(HashMap::new)
+                    .extend(stamp.iter().map(|(k, v)| (k.clone(), v.clone())));
+            }
         }
-    }
 
-    if let Some(ts) = occurred_at {
-        for event in &mut events {
-            event.occurred_at = Some(ts.to_string());
+        if let Some(ts) = self.occurred_at {
+            for event in &mut events {
+                event.occurred_at = Some(ts.to_string());
+            }
         }
-    }
 
-    // Log the whole batch before any reaction runs, so a later event never logs after an
-    // earlier event's reactions.
-    for event in &events {
-        all_events.push(event.clone());
-    }
+        // Log the whole batch before any reaction runs, so a later event never logs after an
+        // earlier event's reactions.
+        for event in &events {
+            self.all_events.push(event.clone());
+        }
 
-    // Then per event in `emits` order: its policies, then its sagas.
-    for event in events {
-        // Saga begin/advance/end run for every event regardless of depth; only the re-entry is
-        // depth-gated, inside `react_policies` and `deliver_saga_dispatch`.
-        react_policies(store, dispatch_fn, tables, sagas, &event, occurred_at, depth, all_events, mutations, cross_domain, reaction_log, saga_log);
-        begin_saga(tables, sagas, &event, saga_log);
-        advance_saga(store, dispatch_fn, tables, sagas, &event, occurred_at, depth, all_events, mutations, cross_domain, reaction_log, saga_log);
-        end_saga(tables, sagas, &event, saga_log);
-    }
+        // Then per event in `emits` order: its policies, then its sagas.
+        for event in events {
+            // Saga begin/advance/end run for every event regardless of depth; only the re-entry is
+            // depth-gated, inside `react_policies` and `deliver_saga_dispatch`.
+            self.react_policies(&event, depth);
+            self.begin_saga(&event);
+            self.advance_saga(&event, depth);
+            self.end_saga(&event);
+        }
 
-    Ok(())
+        Ok(())
+    }
 }
 
 // Decodes a rendered `with:` literal. Wire text keeps its quote marks, so passing it through
@@ -321,13 +445,22 @@ fn offer_row_fields(source: &mut Vec<(String, Json)>, row_id: &str, record: &Jso
 
 fn where_holds(where_expr: Option<fn() -> Expr>, event: &Event) -> bool {
     let Some(build) = where_expr else { return true };
-    let ctx = EvalContext { args: &event.payload, instance: &NoFields };
+    let ctx = EvalContext {
+        args: &event.payload,
+        instance: &NoFields,
+    };
     matches!(interpret(&build(), &ctx), Ok(v) if v.truthy())
 }
 
 // An empty `with_spec` forwards the whole payload. `extra` (a fan-out's row key) is merged into
 // the source before projection, not onto its result.
-fn trigger_args(policy: &PolicyRule, event: &Event, extra: Option<(&str, String)>, target_verb: &str, tables: &Tables) -> Json {
+fn trigger_args(
+    policy: &PolicyRule,
+    event: &Event,
+    extra: Option<(&str, &str)>,
+    target_verb: &str,
+    tables: &Tables,
+) -> Json {
     trigger_args_with_row(policy, event, extra, None, target_verb, tables)
 }
 
@@ -342,7 +475,11 @@ fn for_each_query_args(def: &named_query::QueryDef, event: &Event, tables: &Tabl
         Json::Object(pairs) => pairs.clone(),
         _ => Vec::new(),
     };
-    let reads = |head: &str| def.conditions.iter().any(|c| matches!(c.value, named_query::QueryConditionValue::Arg(name) if name == head));
+    let reads = |head: &str| {
+        def.conditions
+            .iter()
+            .any(|c| matches!(c.value, named_query::QueryConditionValue::Arg(name) if name == head))
+    };
     if let Some(head) = (tables.identity_head_fn)(&event.aggregate) {
         if !event.id.is_empty() && reads(head) && !args.iter().any(|(name, _)| name == head) {
             args.push((head.to_string(), Json::str(event.id.clone())));
@@ -352,7 +489,12 @@ fn for_each_query_args(def: &named_query::QueryDef, event: &Event, tables: &Tabl
 }
 
 fn trigger_args_with_row(
-    policy: &PolicyRule, event: &Event, extra: Option<(&str, String)>, row: Option<(&str, &Json)>, target_verb: &str, tables: &Tables,
+    policy: &PolicyRule,
+    event: &Event,
+    extra: Option<(&str, &str)>,
+    row: Option<(&str, &Json)>,
+    target_verb: &str,
+    tables: &Tables,
 ) -> Json {
     let mut source: Vec<(String, Json)> = match &event.payload {
         Json::Object(pairs) => pairs.clone(),
@@ -360,7 +502,7 @@ fn trigger_args_with_row(
     };
     if let Some((key, id)) = &extra {
         source.retain(|(name, _)| name != key);
-        source.push(((*key).to_string(), Json::str(id.clone())));
+        source.push(((*key).to_string(), Json::str((*id).to_string())));
     }
 
     if policy.with_spec.is_empty() {
@@ -373,7 +515,10 @@ fn trigger_args_with_row(
                     // The lifted receiver replaces any `to` the payload carried; that fact never
                     // reaches the target.
                     source.retain(|(name, _)| name != "to");
-                    return Json::obj(vec![("to", Json::str(event.id.clone())), ("with", Json::Object(source))]);
+                    return Json::obj(vec![
+                        ("to", Json::str(event.id.clone())),
+                        ("with", Json::Object(source)),
+                    ]);
                 }
             }
         }
@@ -396,14 +541,15 @@ fn trigger_args_with_row(
         .with_spec
         .iter()
         .map(|(name, binding)| {
-            let value = match binding.strip_prefix(':') {
-                Some(field) => source
-                    .iter()
-                    .find(|(held, _)| held == field)
-                    .map(|(_, held)| held.clone())
-                    .unwrap_or(Json::Null),
-                None => read_literal_wire(binding),
-            };
+            let value = binding.strip_prefix(':').map_or_else(
+                || read_literal_wire(binding),
+                |field| {
+                    source
+                        .iter()
+                        .find(|(held, _)| held == field)
+                        .map_or(Json::Null, |(_, held)| held.clone())
+                },
+            );
             ((*name).to_string(), value)
         })
         .collect();
@@ -413,11 +559,15 @@ fn trigger_args_with_row(
     // non-creating target on the same aggregate. Projected facts, even a `to`, stay facts.
     if extra.is_none() && !(tables.command_creates_fn)(target_verb) {
         if let Json::Object(pairs) = &routed {
-            let already_routed = pairs.iter().any(|(k, _)| k == "to") && pairs.iter().any(|(k, _)| k == "with");
+            let already_routed =
+                pairs.iter().any(|(k, _)| k == "to") && pairs.iter().any(|(k, _)| k == "with");
             if !already_routed {
                 if let Some(aggregate_name) = target_verb.rsplit_once('.').map(|(agg, _)| agg) {
                     if aggregate_name == event.aggregate {
-                        return Json::obj(vec![("to", Json::str(event.id.clone())), ("with", routed)]);
+                        return Json::obj(vec![
+                            ("to", Json::str(event.id.clone())),
+                            ("with", routed),
+                        ]);
                     }
                 }
             }
@@ -430,9 +580,15 @@ fn trigger_args_with_row(
 // identity. Composite identities and targets the tables know nothing about stay flat: unknown
 // means don't route. `facts` slices the original pairs to the command's declared attributes.
 fn split_routed_args(projected: Json, target_verb: &str, tables: &Tables) -> Json {
-    let Json::Object(pairs) = projected else { return projected };
+    let Json::Object(pairs) = projected else {
+        return projected;
+    };
     let declared = (tables.command_attributes_fn)(target_verb);
-    let facts: Vec<(String, Json)> = pairs.iter().filter(|(k, _)| declared.contains(&k.as_str())).cloned().collect();
+    let facts: Vec<(String, Json)> = pairs
+        .iter()
+        .filter(|(k, _)| declared.contains(&k.as_str()))
+        .cloned()
+        .collect();
 
     if (tables.command_creates_fn)(target_verb) {
         return Json::Object(facts);
@@ -442,12 +598,17 @@ fn split_routed_args(projected: Json, target_verb: &str, tables: &Tables) -> Jso
         return Json::Object(facts);
     };
 
-    let candidates = [(tables.identity_head_fn)(aggregate_name), (tables.reference_key_fn)(aggregate_name)];
+    let candidates = [
+        (tables.identity_head_fn)(aggregate_name),
+        (tables.reference_key_fn)(aggregate_name),
+    ];
     for key in candidates.into_iter().flatten() {
         if let Some((_, raw_id)) = pairs.iter().find(|(k, _)| k == key) {
             // A value-object identity arrives as `{"value": ...}`; `resolved_id_component`
             // unwraps it.
-            let Some(id) = resolved_id_component(raw_id) else { continue };
+            let Some(id) = resolved_id_component(raw_id) else {
+                continue;
+            };
             return Json::obj(vec![("to", Json::str(id)), ("with", Json::Object(facts))]);
         }
     }
@@ -467,543 +628,591 @@ fn entity_command_paths(target_verb: &str) -> Option<(&str, String)> {
 
 // A value-object field is stored as `{"value": ...}`: try the value as-is, then its `value` once.
 fn resolved_id_component(v: &Json) -> Option<String> {
-    v.to_id_component().ok().or_else(|| v.get("value").and_then(|inner| inner.to_id_component().ok())).filter(|id| !id.is_empty())
+    v.to_id_component()
+        .ok()
+        .or_else(|| {
+            v.get("value")
+                .and_then(|inner| inner.to_id_component().ok())
+        })
+        .filter(|id| !id.is_empty())
 }
 
 // Routes a one-level entity command that `split_routed_args` cannot: the parent aggregate's
 // identity comes from the triggering event, not from the `with:` facts. Every other shape falls
 // through to `split_routed_args`'s answer.
-fn route_dispatch_args(projected: Json, target_verb: &str, tables: &Tables, event: &Event) -> Json {
+fn route_dispatch_args(
+    projected: &Json,
+    target_verb: &str,
+    tables: &Tables,
+    event: &Event,
+) -> Json {
     let routed = split_routed_args(projected.clone(), target_verb, tables);
     if matches!(&routed, Json::Object(fields) if fields.iter().any(|(k, _)| k == "to")) {
         return routed;
     }
 
-    let Some((aggregate_name, entity_qualified)) = entity_command_paths(target_verb) else { return routed };
-    let Json::Object(pairs) = &projected else { return routed };
+    let Some((aggregate_name, entity_qualified)) = entity_command_paths(target_verb) else {
+        return routed;
+    };
+    let Json::Object(pairs) = projected else {
+        return routed;
+    };
 
     // Entity identity: its identity attribute, present in the `with:` facts by that name.
-    let Some(entity_head) = (tables.entity_identity_head_fn)(&entity_qualified) else { return routed };
-    let Some(entity_id) = pairs.iter().find(|(k, _)| k == entity_head).and_then(|(_, v)| resolved_id_component(v)) else {
+    let Some(entity_head) = (tables.entity_identity_head_fn)(&entity_qualified) else {
+        return routed;
+    };
+    let Some(entity_id) = pairs
+        .iter()
+        .find(|(k, _)| k == entity_head)
+        .and_then(|(_, v)| resolved_id_component(v))
+    else {
         return routed;
     };
 
     // Aggregate identity: a projected identity/reference key, else the triggering event's own id
     // when it is the same aggregate.
-    let candidates = [(tables.identity_head_fn)(aggregate_name), (tables.reference_key_fn)(aggregate_name)];
+    let candidates = [
+        (tables.identity_head_fn)(aggregate_name),
+        (tables.reference_key_fn)(aggregate_name),
+    ];
     let aggregate_id = candidates
         .into_iter()
         .flatten()
-        .find_map(|key| pairs.iter().find(|(k, _)| k == key).and_then(|(_, v)| resolved_id_component(v)))
-        .or_else(|| (event.aggregate == aggregate_name && !event.id.is_empty()).then(|| event.id.clone()));
-    let Some(aggregate_id) = aggregate_id else { return routed };
+        .find_map(|key| {
+            pairs
+                .iter()
+                .find(|(k, _)| k == key)
+                .and_then(|(_, v)| resolved_id_component(v))
+        })
+        .or_else(|| {
+            (event.aggregate == aggregate_name && !event.id.is_empty()).then(|| event.id.clone())
+        });
+    let Some(aggregate_id) = aggregate_id else {
+        return routed;
+    };
 
     let declared = (tables.command_attributes_fn)(target_verb);
-    let facts: Vec<(String, Json)> = pairs.iter().filter(|(k, _)| declared.contains(&k.as_str())).cloned().collect();
+    let facts: Vec<(String, Json)> = pairs
+        .iter()
+        .filter(|(k, _)| declared.contains(&k.as_str()))
+        .cloned()
+        .collect();
     Json::obj(vec![
-        ("to", Json::obj(vec![("aggregate", Json::str(aggregate_id)), ("entities", Json::Array(vec![Json::str(entity_id)]))])),
+        (
+            "to",
+            Json::obj(vec![
+                ("aggregate", Json::str(aggregate_id)),
+                ("entities", Json::Array(vec![Json::str(entity_id)])),
+            ]),
+        ),
         ("with", Json::Object(facts)),
     ])
 }
 
-#[allow(clippy::too_many_arguments)]
-fn react_policies<S: AggregateScan>(
-    store: &mut S,
-    dispatch_fn: fn(&mut S, &str, &Json, Option<&str>, Option<&str>, &mut Vec<MutationRecord>) -> Result<Vec<Event>, Refusal>,
-    tables: Tables<'static>,
-    sagas: &mut HashMap<(String, String), SagaInstance>,
-    event: &Event,
-    occurred_at: Option<&str>,
-    depth: usize,
-    all_events: &mut Vec<Event>,
-    mutations: &mut Vec<MutationRecord>,
-    cross_domain: &mut Vec<PendingCrossDomainReaction>,
-    reaction_log: &mut Vec<Json>,
-    saga_log: &mut Vec<Json>,
-) {
-    let emitting = event.aggregate.rsplit("::").next().unwrap_or(event.aggregate.as_str());
-
-    for policy in tables.policies {
-        if policy.event_name != event.name {
-            continue;
-        }
-        if let Some(qualifier) = policy.event_qualifier {
-            if qualifier != emitting {
+impl<S: AggregateScan> Cascade<'_, S> {
+    fn react_policies(&mut self, event: &Event, depth: usize) {
+        let tables = self.tables;
+        let emitting = event
+            .aggregate
+            .rsplit("::")
+            .next()
+            .unwrap_or(event.aggregate.as_str());
+
+        for policy in tables.policies {
+            if policy.event_name != event.name {
+                continue;
+            }
+            if let Some(qualifier) = policy.event_qualifier {
+                if qualifier != emitting {
+                    continue;
+                }
+            }
+            if !where_holds(policy.where_expr, event) {
                 continue;
             }
-        }
-        if !where_holds(policy.where_expr, event) {
-            continue;
-        }
-
-        let record = |extra: Vec<(&str, Json)>| -> Json {
-            let mut fields = vec![
-                ("policy", Json::str(policy.policy_name.to_string())),
-                ("on", Json::str(event.name.clone())),
-                ("trigger", Json::str(policy.target_verb.to_string())),
-            ];
-            fields.extend(extra.into_iter().map(|(k, v)| (k, v)));
-            Json::obj(fields)
-        };
 
-        if depth + 1 >= MAX_REACTION_DEPTH {
-            reaction_log.push(record(vec![
-                ("delivered", Json::Bool(false)),
-                ("reason", Json::str(format!("reaction depth {MAX_REACTION_DEPTH} reached"))),
-            ]));
-            continue;
-        }
+            let record = |extra: Vec<(&str, Json)>| -> Json {
+                let mut fields = vec![
+                    ("policy", Json::str(policy.policy_name.to_string())),
+                    ("on", Json::str(event.name.clone())),
+                    ("trigger", Json::str(policy.target_verb.to_string())),
+                ];
+                fields.extend(extra);
+                Json::obj(fields)
+            };
 
-        // A fan-out dispatches once per row its query answers; the row id is merged into the
-        // source a `with:` projection reads from.
-        if let Some(for_each) = policy.for_each {
-            let Some(def) = named_query::find(tables.queries, for_each) else {
-                reaction_log.push(record(vec![
+            if depth + 1 >= MAX_REACTION_DEPTH {
+                self.reaction_log.push(record(vec![
                     ("delivered", Json::Bool(false)),
-                    ("reason", Json::str(format!("no query {for_each}"))),
+                    (
+                        "reason",
+                        Json::str(format!("reaction depth {MAX_REACTION_DEPTH} reached")),
+                    ),
                 ]));
                 continue;
-            };
-            // The query reads the event, not the projection, with the emitting record's identity
-            // lent under its head. No caller role: the policy is system-triggered.
-            let query_args = for_each_query_args(def, event, &tables);
-            let rows = match named_query::run(store, def, &query_args, None) {
-                Ok(rows) => rows,
-                Err(refusal) => {
-                    reaction_log.push(record(vec![
+            }
+
+            // A fan-out dispatches once per row its query answers; the row id is merged into the
+            // source a `with:` projection reads from.
+            if let Some(for_each) = policy.for_each {
+                let Some(def) = named_query::find(tables.queries, for_each) else {
+                    self.reaction_log.push(record(vec![
                         ("delivered", Json::Bool(false)),
-                        ("reason", Json::str(refusal.to_string())),
+                        ("reason", Json::str(format!("no query {for_each}"))),
                     ]));
                     continue;
-                }
-            };
-            for (row_id, row) in rows {
-                let row_record = |extra: Vec<(&str, Json)>| -> Json {
-                    let mut fields = vec![("for_row", Json::str(row_id.clone()))];
-                    fields.extend(extra.into_iter());
-                    let base = record(vec![]);
-                    match base {
-                        Json::Object(mut pairs) => {
-                            pairs.extend(fields.into_iter().map(|(k, v)| (k.to_string(), v)));
-                            Json::Object(pairs)
-                        }
-                        other => other,
+                };
+                // The query reads the event, not the projection, with the emitting record's
+                // identity lent under its head. No caller role: the policy is system-triggered.
+                let query_args = for_each_query_args(def, event, &tables);
+                let rows = match named_query::run(self.store, def, &query_args, None) {
+                    Ok(rows) => rows,
+                    Err(refusal) => {
+                        self.reaction_log.push(record(vec![
+                            ("delivered", Json::Bool(false)),
+                            ("reason", Json::str(refusal.to_string())),
+                        ]));
+                        continue;
                     }
                 };
-                let extra = policy.for_each_key.map(|key| (key, row_id.clone()));
-                let args = trigger_args_with_row(policy, event, extra, Some((row_id.as_str(), &row)), policy.target_verb, &tables);
-                let outcome = orchestrate(
-                    store, dispatch_fn, tables, sagas, policy.target_verb, &args, None, None, None, occurred_at, depth + 1,
-                    all_events, mutations, cross_domain, reaction_log, saga_log,
-                );
-                match outcome {
-                    Ok(()) => reaction_log.push(row_record(vec![("delivered", Json::Bool(true))])),
-                    Err(refusal) => reaction_log.push(row_record(vec![
-                        ("delivered", Json::Bool(false)),
-                        ("reason", Json::str(refusal.to_string())),
-                    ])),
+                for (row_id, row) in rows {
+                    let row_record = |extra: Vec<(&str, Json)>| -> Json {
+                        let mut fields = vec![("for_row", Json::str(row_id.clone()))];
+                        fields.extend(extra);
+                        let base = record(vec![]);
+                        match base {
+                            Json::Object(mut pairs) => {
+                                pairs.extend(fields.into_iter().map(|(k, v)| (k.to_string(), v)));
+                                Json::Object(pairs)
+                            }
+                            other => other,
+                        }
+                    };
+                    let extra = policy.for_each_key.map(|key| (key, row_id.as_str()));
+                    let args = trigger_args_with_row(
+                        policy,
+                        event,
+                        extra,
+                        Some((row_id.as_str(), &row)),
+                        policy.target_verb,
+                        &tables,
+                    );
+                    let outcome = self.run(policy.target_verb, &args, None, None, None, depth + 1);
+                    match outcome {
+                        Ok(()) => self
+                            .reaction_log
+                            .push(row_record(vec![("delivered", Json::Bool(true))])),
+                        Err(refusal) => self.reaction_log.push(row_record(vec![
+                            ("delivered", Json::Bool(false)),
+                            ("reason", Json::str(refusal.to_string())),
+                        ])),
+                    }
                 }
+                continue;
             }
-            continue;
-        }
 
-        // No `with:`: the whole payload forwards verbatim. Reactions are system-triggered, so no
-        // caller role, and only saga legs stamp a correlation.
-        let args = trigger_args(policy, event, None, policy.target_verb, &tables);
-        let outcome = orchestrate(
-            store, dispatch_fn, tables, sagas, policy.target_verb, &args, None, None, None, occurred_at, depth + 1,
-            all_events, mutations, cross_domain, reaction_log, saga_log,
-        );
-        match outcome {
-            Ok(()) => reaction_log.push(record(vec![("delivered", Json::Bool(true))])),
-            // A refusal is recorded, not fatal to the emitting command. A panic is not caught, on
-            // purpose.
-            Err(refusal) => reaction_log.push(record(vec![
-                ("delivered", Json::Bool(false)),
-                ("reason", Json::str(refusal.to_string())),
-            ])),
+            // No `with:`: the whole payload forwards verbatim. Reactions are system-triggered, so
+            // no caller role, and only saga legs stamp a correlation.
+            let args = trigger_args(policy, event, None, policy.target_verb, &tables);
+            let outcome = self.run(policy.target_verb, &args, None, None, None, depth + 1);
+            match outcome {
+                Ok(()) => self
+                    .reaction_log
+                    .push(record(vec![("delivered", Json::Bool(true))])),
+                // A refusal is recorded, not fatal to the emitting command. A panic is not
+                // caught, on purpose.
+                Err(refusal) => self.reaction_log.push(record(vec![
+                    ("delivered", Json::Bool(false)),
+                    ("reason", Json::str(refusal.to_string())),
+                ])),
+            }
         }
-    }
 
-    // Cross-domain matches are recorded for the host to deliver, never dispatched or logged here:
-    // the delivery outcome does not exist yet.
-    for policy in tables.cross_domain_policies {
-        if policy.event_name != event.name {
-            continue;
-        }
-        if let Some(qualifier) = policy.event_qualifier {
-            if qualifier != emitting {
+        // Cross-domain matches are recorded for the host to deliver, never dispatched or logged
+        // here: the delivery outcome does not exist yet.
+        for policy in tables.cross_domain_policies {
+            if policy.event_name != event.name {
                 continue;
             }
+            if let Some(qualifier) = policy.event_qualifier {
+                if qualifier != emitting {
+                    continue;
+                }
+            }
+            if !where_holds(policy.where_expr, event) {
+                continue;
+            }
+            self.cross_domain.push(PendingCrossDomainReaction {
+                policy_name: policy.policy_name.to_string(),
+                event_name: event.name.clone(),
+                target_domain: policy.target_domain.to_string(),
+                target_verb: policy.target_verb.to_string(),
+                payload: event.payload.clone(),
+            });
         }
-        if !where_holds(policy.where_expr, event) {
-            continue;
-        }
-        cross_domain.push(PendingCrossDomainReaction {
-            policy_name: policy.policy_name.to_string(),
-            event_name: event.name.clone(),
-            target_domain: policy.target_domain.to_string(),
-            target_verb: policy.target_verb.to_string(),
-            payload: event.payload.clone(),
-        });
     }
 }
 
-// Silent when `event.name != pm.starts_on` or the instance already exists.
-fn begin_saga(tables: Tables<'static>, sagas: &mut HashMap<(String, String), SagaInstance>, event: &Event, saga_log: &mut Vec<Json>) {
-    for pm in tables.process_managers {
-        if event.name != pm.starts_on {
-            continue;
-        }
+impl<S: AggregateScan> Cascade<'_, S> {
+    // Silent when `event.name != pm.starts_on` or the instance already exists.
+    fn begin_saga(&mut self, event: &Event) {
+        let tables = self.tables;
+        for pm in tables.process_managers {
+            if event.name != pm.starts_on {
+                continue;
+            }
+
+            let Some(correlation) = correlation_of(pm, event, tables.reference_key_fn) else {
+                self.saga_log.push(Json::obj(vec![
+                    ("process_manager", Json::str(pm.name.to_string())),
+                    ("on", Json::str(event.name.clone())),
+                    ("born", Json::Bool(false)),
+                    (
+                        "reason",
+                        Json::str(format!("no {} in the payload", pm.correlates_by)),
+                    ),
+                ]));
+                continue;
+            };
 
-        let Some(correlation) = correlation_of(pm, event, tables.reference_key_fn) else {
-            saga_log.push(Json::obj(vec![
+            let key = (pm.name.to_string(), correlation.clone());
+            if self.sagas.contains_key(&key) {
+                continue;
+            }
+
+            self.sagas.insert(
+                key,
+                SagaInstance {
+                    state: pm.initial_state.to_string(),
+                    memory: event.payload.clone(),
+                    completed_compensations: Vec::new(),
+                },
+            );
+            self.saga_log.push(Json::obj(vec![
                 ("process_manager", Json::str(pm.name.to_string())),
                 ("on", Json::str(event.name.clone())),
-                ("born", Json::Bool(false)),
-                ("reason", Json::str(format!("no {} in the payload", pm.correlates_by))),
+                ("instance", Json::str(correlation)),
+                ("born", Json::Bool(true)),
+                ("state", Json::str(pm.initial_state.to_string())),
             ]));
-            continue;
-        };
-
-        let key = (pm.name.to_string(), correlation.clone());
-        if sagas.contains_key(&key) {
-            continue;
         }
-
-        sagas.insert(key, SagaInstance { state: pm.initial_state.to_string(), memory: event.payload.clone(), completed_compensations: Vec::new() });
-        saga_log.push(Json::obj(vec![
-            ("process_manager", Json::str(pm.name.to_string())),
-            ("on", Json::str(event.name.clone())),
-            ("instance", Json::str(correlation)),
-            ("born", Json::Bool(true)),
-            ("state", Json::str(pm.initial_state.to_string())),
-        ]));
     }
-}
 
-// Silent when no handler answers the event or correlation resolves to nothing.
-#[allow(clippy::too_many_arguments)]
-fn advance_saga<S: AggregateScan>(
-    store: &mut S,
-    dispatch_fn: fn(&mut S, &str, &Json, Option<&str>, Option<&str>, &mut Vec<MutationRecord>) -> Result<Vec<Event>, Refusal>,
-    tables: Tables<'static>,
-    sagas: &mut HashMap<(String, String), SagaInstance>,
-    event: &Event,
-    occurred_at: Option<&str>,
-    depth: usize,
-    all_events: &mut Vec<Event>,
-    mutations: &mut Vec<MutationRecord>,
-    cross_domain: &mut Vec<PendingCrossDomainReaction>,
-    reaction_log: &mut Vec<Json>,
-    saga_log: &mut Vec<Json>,
-) {
-    for pm in tables.process_managers {
-        if !pm.handlers.iter().any(|h| h.event_type == event.name) {
-            continue;
+    // Silent when no handler answers the event or correlation resolves to nothing.
+    fn advance_saga(&mut self, event: &Event, depth: usize) {
+        let tables = self.tables;
+        for pm in tables.process_managers {
+            if !pm.handlers.iter().any(|h| h.event_type == event.name) {
+                continue;
+            }
+            let Some(correlation) = correlation_of(pm, event, tables.reference_key_fn) else {
+                continue;
+            };
+
+            let key = (pm.name.to_string(), correlation.clone());
+            let record = |extra: Vec<(&str, Json)>| -> Json {
+                let mut fields = vec![
+                    ("process_manager", Json::str(pm.name.to_string())),
+                    ("on", Json::str(event.name.clone())),
+                    ("instance", Json::str(correlation.clone())),
+                ];
+                fields.extend(extra);
+                Json::obj(fields)
+            };
+
+            let Some(state) = self.sagas.get(&key).map(|instance| instance.state.clone()) else {
+                self.saga_log.push(record(vec![
+                    ("advanced", Json::Bool(false)),
+                    (
+                        "reason",
+                        Json::str(format!("no conversation remembers {correlation:?}")),
+                    ),
+                ]));
+                continue;
+            };
+            // The leg is chosen by (event, current state); build refuses two on one pair.
+            let Some(handler) = select_leg(pm, &event.name, &state) else {
+                self.saga_log.push(record(vec![
+                    ("advanced", Json::Bool(false)),
+                    ("reason", Json::str(leg_mismatch(pm, &event.name, &state))),
+                ]));
+                continue;
+            };
+
+            if let Some(slot) = self.sagas.get_mut(&key) {
+                slot.state = handler.to_state.to_string();
+            }
+            self.saga_log.push(record(vec![
+                ("advanced", Json::Bool(true)),
+                ("from", Json::str(handler.from_state.to_string())),
+                ("to", Json::str(handler.to_state.to_string())),
+            ]));
+
+            let memory = self
+                .sagas
+                .get(&key)
+                .map_or(Json::Null, |instance| instance.memory.clone());
+            // `event.aggregate` is `{domain}::{aggregate}`, so the domain is read from it.
+            let domain_name = event
+                .aggregate
+                .split("::")
+                .next()
+                .unwrap_or(&event.aggregate);
+            let leg = SagaLeg {
+                pm,
+                correlation: &correlation,
+                domain_name,
+            };
+            let mut refused = false;
+            for spec in handler.dispatches {
+                let args = build_dispatch_args(
+                    pm,
+                    spec,
+                    event,
+                    &correlation,
+                    &memory,
+                    domain_name,
+                    &tables,
+                );
+                // Resolved before the forward dispatch: the ledger entry is pushed speculatively.
+                let compensation_args = spec.compensates.map(|r| {
+                    build_dispatch_args(pm, r, event, &correlation, &memory, domain_name, &tables)
+                });
+                let delivered =
+                    self.deliver_saga_dispatch(&leg, spec, &args, depth, compensation_args);
+                if delivered == Some(false) {
+                    refused = true;
+                }
+            }
+
+            if refused {
+                self.compensate(&leg, event, &memory, depth);
+            }
         }
-        let Some(correlation) = correlation_of(pm, event, tables.reference_key_fn) else { continue };
+    }
 
-        let key = (pm.name.to_string(), correlation.clone());
+    // Returns `Some(delivered)`, or `None` when the depth ceiling stopped the leg before it tried.
+    // The compensation is pushed before the forward dispatch runs: a nested refusal re-entering
+    // this saga must already see it. It is popped again if this leg's own attempt refuses.
+    fn deliver_saga_dispatch(
+        &mut self,
+        leg: &SagaLeg,
+        spec: &DispatchSpec,
+        args: &Json,
+        depth: usize,
+        compensation_args: Option<Json>,
+    ) -> Option<bool> {
+        // Ruby logs the unqualified name and qualifies only at dispatch; this mirrors that split.
         let record = |extra: Vec<(&str, Json)>| -> Json {
             let mut fields = vec![
-                ("process_manager", Json::str(pm.name.to_string())),
-                ("on", Json::str(event.name.clone())),
-                ("instance", Json::str(correlation.clone())),
+                ("process_manager", Json::str(leg.pm.name.to_string())),
+                ("instance", Json::str(leg.correlation.to_string())),
+                ("dispatch", Json::str(spec.command_name.to_string())),
             ];
-            fields.extend(extra.into_iter().map(|(k, v)| (k, v)));
+            fields.extend(extra);
             Json::obj(fields)
         };
 
-        let Some(state) = sagas.get(&key).map(|instance| instance.state.clone()) else {
-            saga_log.push(record(vec![
-                ("advanced", Json::Bool(false)),
-                ("reason", Json::str(format!("no conversation remembers {correlation:?}"))),
-            ]));
-            continue;
-        };
-        // The leg is chosen by (event, current state); build refuses two on one pair.
-        let Some(handler) = select_leg(pm, &event.name, &state) else {
-            saga_log.push(record(vec![
-                ("advanced", Json::Bool(false)),
-                ("reason", Json::str(leg_mismatch(pm, &event.name, &state))),
+        if depth + 1 >= MAX_REACTION_DEPTH {
+            self.saga_log.push(record(vec![
+                ("delivered", Json::Bool(false)),
+                (
+                    "reason",
+                    Json::str(format!("reaction depth {MAX_REACTION_DEPTH} reached")),
+                ),
             ]));
-            continue;
-        };
-
-        if let Some(slot) = sagas.get_mut(&key) {
-            slot.state = handler.to_state.to_string();
+            return None;
         }
-        saga_log.push(record(vec![
-            ("advanced", Json::Bool(true)),
-            ("from", Json::str(handler.from_state.to_string())),
-            ("to", Json::str(handler.to_state.to_string())),
-        ]));
 
-        let memory = sagas.get(&key).map(|instance| instance.memory.clone()).unwrap_or(Json::Null);
-        // `event.aggregate` is `{domain}::{aggregate}`, so the domain is read from it.
-        let domain_name = event.aggregate.split("::").next().unwrap_or(&event.aggregate);
-        let mut refused = false;
-        for spec in handler.dispatches {
-            let args = build_dispatch_args(pm, spec, event, &correlation, &memory, domain_name, &tables);
-            // Resolved before the forward dispatch: the ledger entry is pushed speculatively.
-            let compensation_args = spec.compensates.map(|r| build_dispatch_args(pm, r, event, &correlation, &memory, domain_name, &tables));
-            let stamp: HashMap<String, String> = [(correlation_head(pm.correlates_by).to_string(), correlation.clone())].into_iter().collect();
-            let delivered = deliver_saga_dispatch(
-                store, dispatch_fn, tables, sagas, pm, spec, domain_name, &args, &correlation, occurred_at, depth, all_events, mutations, cross_domain, reaction_log, saga_log, &stamp, compensation_args,
-            );
-            if delivered == Some(false) {
-                refused = true;
+        // `spec.command_name` is bare on the wire, so it is qualified before `dispatch_by_name`.
+        let qualified = qualify_saga_command_name(leg.domain_name, spec.command_name);
+
+        let key = leg.key();
+        let mut compensation_recorded = false;
+        if let (Some(compensates_spec), Some(r_args)) = (spec.compensates, compensation_args) {
+            if let Some(slot) = self.sagas.get_mut(&key) {
+                slot.completed_compensations.push(CompletedCompensation {
+                    command_name: compensates_spec.command_name.to_string(),
+                    args: r_args,
+                });
+                compensation_recorded = true;
             }
         }
 
-        if refused {
-            compensate(store, dispatch_fn, tables, sagas, pm, &key, event, &correlation, &memory, occurred_at, depth, all_events, mutations, cross_domain, reaction_log, saga_log);
+        // System-triggered, so no caller role; `Some(stamp)` stamps every event this dispatch
+        // produces.
+        let outcome = self.run(&qualified, args, None, None, Some(&leg.stamp()), depth + 1);
+        match outcome {
+            Ok(()) => {
+                self.saga_log
+                    .push(record(vec![("delivered", Json::Bool(true))]));
+                Some(true)
+            }
+            Err(refusal) => {
+                // This leg failed, so its speculative entry was never earned. `pop` is safe: any
+                // entry pushed after it by a nested call was already drained by `compensate`.
+                if compensation_recorded {
+                    if let Some(slot) = self.sagas.get_mut(&key) {
+                        slot.completed_compensations.pop();
+                    }
+                }
+                self.saga_log.push(record(vec![
+                    ("delivered", Json::Bool(false)),
+                    ("reason", Json::str(refusal.to_string())),
+                ]));
+                Some(false)
+            }
         }
     }
-}
 
-// Returns `Some(delivered)`, or `None` when the depth ceiling stopped the leg before it tried.
-// The compensation is pushed before the forward dispatch runs: a nested refusal re-entering this
-// saga must already see it. It is popped again if this leg's own attempt refuses.
-#[allow(clippy::too_many_arguments)]
-fn deliver_saga_dispatch<S: AggregateScan>(
-    store: &mut S,
-    dispatch_fn: fn(&mut S, &str, &Json, Option<&str>, Option<&str>, &mut Vec<MutationRecord>) -> Result<Vec<Event>, Refusal>,
-    tables: Tables<'static>,
-    sagas: &mut HashMap<(String, String), SagaInstance>,
-    pm: &ProcessManagerDef,
-    spec: &DispatchSpec,
-    domain_name: &str,
-    args: &Json,
-    correlation: &str,
-    occurred_at: Option<&str>,
-    depth: usize,
-    all_events: &mut Vec<Event>,
-    mutations: &mut Vec<MutationRecord>,
-    cross_domain: &mut Vec<PendingCrossDomainReaction>,
-    reaction_log: &mut Vec<Json>,
-    saga_log: &mut Vec<Json>,
-    stamp: &HashMap<String, String>,
-    compensation_args: Option<Json>,
-) -> Option<bool> {
-    // Ruby logs the unqualified name and qualifies only at dispatch; this mirrors that split.
-    let record = |extra: Vec<(&str, Json)>| -> Json {
-        let mut fields = vec![
-            ("process_manager", Json::str(pm.name.to_string())),
-            ("instance", Json::str(correlation.to_string())),
-            ("dispatch", Json::str(spec.command_name.to_string())),
-        ];
-        fields.extend(extra.into_iter().map(|(k, v)| (k, v)));
-        Json::obj(fields)
-    };
-
-    if depth + 1 >= MAX_REACTION_DEPTH {
-        saga_log.push(record(vec![
-            ("delivered", Json::Bool(false)),
-            ("reason", Json::str(format!("reaction depth {MAX_REACTION_DEPTH} reached"))),
-        ]));
-        return None;
-    }
-
-    // `spec.command_name` is bare on the wire, so it is qualified before `dispatch_by_name`.
-    let qualified = qualify_saga_command_name(domain_name, spec.command_name);
-
-    let key = (pm.name.to_string(), correlation.to_string());
-    let mut compensation_recorded = false;
-    if let (Some(compensates_spec), Some(r_args)) = (spec.compensates, compensation_args) {
-        if let Some(slot) = sagas.get_mut(&key) {
-            slot.completed_compensations.push(CompletedCompensation { command_name: compensates_spec.command_name.to_string(), args: r_args });
-            compensation_recorded = true;
-        }
-    }
+    // Fires one ledger entry, newest-first. Args are pre-resolved, so `build_dispatch_args` is
+    // skipped. A compensation that itself refuses is logged with `compensation_failed` and never
+    // re-triggers `compensate`.
+    fn deliver_derived_compensation(
+        &mut self,
+        leg: &SagaLeg,
+        entry: &CompletedCompensation,
+        depth: usize,
+    ) {
+        let record = |extra: Vec<(&str, Json)>| -> Json {
+            let mut fields = vec![
+                ("process_manager", Json::str(leg.pm.name.to_string())),
+                ("instance", Json::str(leg.correlation.to_string())),
+                ("dispatch", Json::str(entry.command_name.clone())),
+            ];
+            fields.extend(extra);
+            Json::obj(fields)
+        };
 
-    // System-triggered, so no caller role; `Some(stamp)` stamps every event this dispatch
-    // produces.
-    let outcome = orchestrate(
-        store, dispatch_fn, tables, sagas, &qualified, args, None, None, Some(stamp), occurred_at, depth + 1,
-        all_events, mutations, cross_domain, reaction_log, saga_log,
-    );
-    match outcome {
-        Ok(()) => {
-            saga_log.push(record(vec![("delivered", Json::Bool(true))]));
-            Some(true)
-        }
-        Err(refusal) => {
-            // This leg failed, so its speculative entry was never earned. `pop` is safe: any
-            // entry pushed after it by a nested call was already drained by `compensate`.
-            if compensation_recorded {
-                if let Some(slot) = sagas.get_mut(&key) {
-                    slot.completed_compensations.pop();
-                }
-            }
-            saga_log.push(record(vec![
+        if depth + 1 >= MAX_REACTION_DEPTH {
+            self.saga_log.push(record(vec![
                 ("delivered", Json::Bool(false)),
-                ("reason", Json::str(refusal.to_string())),
+                (
+                    "reason",
+                    Json::str(format!("reaction depth {MAX_REACTION_DEPTH} reached")),
+                ),
+                ("compensation", Json::Bool(true)),
+                ("compensation_failed", Json::Bool(true)),
             ]));
-            Some(false)
+            return;
         }
-    }
-}
 
-// Fires one ledger entry, newest-first. Args are pre-resolved, so `build_dispatch_args` is
-// skipped. A compensation that itself refuses is logged with `compensation_failed` and never
-// re-triggers `compensate`.
-#[allow(clippy::too_many_arguments)]
-fn deliver_derived_compensation<S: AggregateScan>(
-    store: &mut S,
-    dispatch_fn: fn(&mut S, &str, &Json, Option<&str>, Option<&str>, &mut Vec<MutationRecord>) -> Result<Vec<Event>, Refusal>,
-    tables: Tables<'static>,
-    sagas: &mut HashMap<(String, String), SagaInstance>,
-    pm: &ProcessManagerDef,
-    entry: &CompletedCompensation,
-    domain_name: &str,
-    correlation: &str,
-    occurred_at: Option<&str>,
-    depth: usize,
-    all_events: &mut Vec<Event>,
-    mutations: &mut Vec<MutationRecord>,
-    cross_domain: &mut Vec<PendingCrossDomainReaction>,
-    reaction_log: &mut Vec<Json>,
-    saga_log: &mut Vec<Json>,
-) {
-    let record = |extra: Vec<(&str, Json)>| -> Json {
-        let mut fields = vec![
-            ("process_manager", Json::str(pm.name.to_string())),
-            ("instance", Json::str(correlation.to_string())),
-            ("dispatch", Json::str(entry.command_name.to_string())),
-        ];
-        fields.extend(extra.into_iter().map(|(k, v)| (k, v)));
-        Json::obj(fields)
-    };
+        // A compensation's `command_name` is bare on the wire, like a forward dispatch's.
+        let qualified = qualify_saga_command_name(leg.domain_name, &entry.command_name);
 
-    if depth + 1 >= MAX_REACTION_DEPTH {
-        saga_log.push(record(vec![
-            ("delivered", Json::Bool(false)),
-            ("reason", Json::str(format!("reaction depth {MAX_REACTION_DEPTH} reached"))),
-            ("compensation", Json::Bool(true)),
-            ("compensation_failed", Json::Bool(true)),
-        ]));
-        return;
+        let outcome = self.run(
+            &qualified,
+            &entry.args,
+            None,
+            None,
+            Some(&leg.stamp()),
+            depth + 1,
+        );
+        match outcome {
+            Ok(()) => self.saga_log.push(record(vec![
+                ("delivered", Json::Bool(true)),
+                ("compensation", Json::Bool(true)),
+            ])),
+            Err(refusal) => self.saga_log.push(record(vec![
+                ("delivered", Json::Bool(false)),
+                ("reason", Json::str(refusal.to_string())),
+                ("compensation", Json::Bool(true)),
+                ("compensation_failed", Json::Bool(true)),
+            ])),
+        }
     }
 
-    // A compensation's `command_name` is bare on the wire, like a forward dispatch's.
-    let qualified = qualify_saga_command_name(domain_name, &entry.command_name);
-
-    let stamp: HashMap<String, String> = [(correlation_head(pm.correlates_by).to_string(), correlation.to_string())].into_iter().collect();
+    // Silent when `event.name != pm.ends_on`, correlation is absent, or no instance existed.
+    fn end_saga(&mut self, event: &Event) {
+        let tables = self.tables;
+        for pm in tables.process_managers {
+            if event.name != pm.ends_on {
+                continue;
+            }
+            let Some(correlation) = correlation_of(pm, event, tables.reference_key_fn) else {
+                continue;
+            };
+            let key = (pm.name.to_string(), correlation.clone());
+            if self.sagas.remove(&key).is_none() {
+                continue;
+            }
 
-    let outcome = orchestrate(
-        store, dispatch_fn, tables, sagas, &qualified, &entry.args, None, None, Some(&stamp), occurred_at, depth + 1,
-        all_events, mutations, cross_domain, reaction_log, saga_log,
-    );
-    match outcome {
-        Ok(()) => saga_log.push(record(vec![("delivered", Json::Bool(true)), ("compensation", Json::Bool(true))])),
-        Err(refusal) => saga_log.push(record(vec![
-            ("delivered", Json::Bool(false)),
-            ("reason", Json::str(refusal.to_string())),
-            ("compensation", Json::Bool(true)),
-            ("compensation_failed", Json::Bool(true)),
-        ])),
+            self.saga_log.push(Json::obj(vec![
+                ("process_manager", Json::str(pm.name.to_string())),
+                ("on", Json::str(event.name.clone())),
+                ("instance", Json::str(correlation)),
+                ("ended", Json::Bool(true)),
+            ]));
+        }
     }
-}
 
-// Silent when `event.name != pm.ends_on`, correlation is absent, or no instance existed.
-fn end_saga(tables: Tables<'static>, sagas: &mut HashMap<(String, String), SagaInstance>, event: &Event, saga_log: &mut Vec<Json>) {
-    for pm in tables.process_managers {
-        if event.name != pm.ends_on {
-            continue;
-        }
-        let Some(correlation) = correlation_of(pm, event, tables.reference_key_fn) else { continue };
-        let key = (pm.name.to_string(), correlation.clone());
-        if sagas.remove(&key).is_none() {
-            continue;
+    // The `on :refused` leg, run once against the post-transition state. Its own dispatches never
+    // compensate on failure.
+    fn compensate(&mut self, leg: &SagaLeg, event: &Event, memory: &Json, depth: usize) {
+        let (pm, correlation, domain_name) = (leg.pm, leg.correlation, leg.domain_name);
+        let key = leg.key();
+        let Some(current_state) = self.sagas.get(&key).map(|instance| instance.state.clone())
+        else {
+            return;
+        };
+        // A process manager with no compensating leg is silent; a state no leg answers from is
+        // logged as `advanced: false`.
+        if !pm.handlers.iter().any(|h| h.event_type == REFUSED) {
+            return;
         }
 
-        saga_log.push(Json::obj(vec![
-            ("process_manager", Json::str(pm.name.to_string())),
-            ("on", Json::str(event.name.clone())),
-            ("instance", Json::str(correlation)),
-            ("ended", Json::Bool(true)),
-        ]));
-    }
-}
+        let record = |extra: Vec<(&str, Json)>| -> Json {
+            let mut fields = vec![
+                ("process_manager", Json::str(pm.name.to_string())),
+                ("on", Json::str(REFUSED.to_string())),
+                ("instance", Json::str(correlation.to_string())),
+            ];
+            fields.extend(extra);
+            Json::obj(fields)
+        };
 
-// The `on :refused` leg, run once against the post-transition state. Its own dispatches never
-// compensate on failure.
-#[allow(clippy::too_many_arguments)]
-fn compensate<S: AggregateScan>(
-    store: &mut S,
-    dispatch_fn: fn(&mut S, &str, &Json, Option<&str>, Option<&str>, &mut Vec<MutationRecord>) -> Result<Vec<Event>, Refusal>,
-    tables: Tables<'static>,
-    sagas: &mut HashMap<(String, String), SagaInstance>,
-    pm: &ProcessManagerDef,
-    key: &(String, String),
-    event: &Event,
-    correlation: &str,
-    memory: &Json,
-    occurred_at: Option<&str>,
-    depth: usize,
-    all_events: &mut Vec<Event>,
-    mutations: &mut Vec<MutationRecord>,
-    cross_domain: &mut Vec<PendingCrossDomainReaction>,
-    reaction_log: &mut Vec<Json>,
-    saga_log: &mut Vec<Json>,
-) {
-    let Some(current_state) = sagas.get(key).map(|instance| instance.state.clone()) else { return };
-    // A process manager with no compensating leg is silent; a state no leg answers from is logged
-    // as `advanced: false`.
-    if !pm.handlers.iter().any(|h| h.event_type == REFUSED) {
-        return;
-    }
-
-    let record = |extra: Vec<(&str, Json)>| -> Json {
-        let mut fields = vec![
-            ("process_manager", Json::str(pm.name.to_string())),
-            ("on", Json::str(REFUSED.to_string())),
-            ("instance", Json::str(correlation.to_string())),
-        ];
-        fields.extend(extra.into_iter().map(|(k, v)| (k, v)));
-        Json::obj(fields)
-    };
+        let Some(compensation) = select_leg(pm, REFUSED, &current_state) else {
+            self.saga_log.push(record(vec![
+                ("advanced", Json::Bool(false)),
+                (
+                    "reason",
+                    Json::str(leg_mismatch(pm, REFUSED, &current_state)),
+                ),
+            ]));
+            return;
+        };
 
-    let Some(compensation) = select_leg(pm, REFUSED, &current_state) else {
-        saga_log.push(record(vec![
-            ("advanced", Json::Bool(false)),
-            ("reason", Json::str(leg_mismatch(pm, REFUSED, &current_state))),
+        if let Some(slot) = self.sagas.get_mut(&key) {
+            slot.state = compensation.to_state.to_string();
+        }
+        self.saga_log.push(record(vec![
+            ("advanced", Json::Bool(true)),
+            ("from", Json::str(compensation.from_state.to_string())),
+            ("to", Json::str(compensation.to_state.to_string())),
         ]));
-        return;
-    };
-
-    if let Some(slot) = sagas.get_mut(key) {
-        slot.state = compensation.to_state.to_string();
-    }
-    saga_log.push(record(vec![
-        ("advanced", Json::Bool(true)),
-        ("from", Json::str(compensation.from_state.to_string())),
-        ("to", Json::str(compensation.to_state.to_string())),
-    ]));
-
-    let domain_name = event.aggregate.split("::").next().unwrap_or(&event.aggregate);
 
-    // Derived compensations first, newest-first. The ledger is re-fetched each iteration, not
-    // snapshotted: a nested reaction may push onto it mid-drain. If one removes the instance
-    // mid-drain, the loop stops early.
-    loop {
-        let entry = match sagas.get_mut(key) {
-            Some(instance) => instance.completed_compensations.pop(),
-            None => None,
-        };
-        let Some(entry) = entry else { break };
-        deliver_derived_compensation(store, dispatch_fn, tables, sagas, pm, &entry, domain_name, correlation, occurred_at, depth, all_events, mutations, cross_domain, reaction_log, saga_log);
-    }
+        // Derived compensations first, newest-first. The ledger is re-fetched each iteration, not
+        // snapshotted: a nested reaction may push onto it mid-drain. If one removes the instance
+        // mid-drain, the loop stops early.
+        loop {
+            let entry = match self.sagas.get_mut(&key) {
+                Some(instance) => instance.completed_compensations.pop(),
+                None => None,
+            };
+            let Some(entry) = entry else { break };
+            self.deliver_derived_compensation(leg, &entry, depth);
+        }
 
-    for spec in compensation.dispatches {
-        let args = build_dispatch_args(pm, spec, event, correlation, memory, domain_name, &tables);
-        let compensation_args = spec.compensates.map(|r| build_dispatch_args(pm, r, event, correlation, memory, domain_name, &tables));
-        let stamp: HashMap<String, String> = [(correlation_head(pm.correlates_by).to_string(), correlation.to_string())].into_iter().collect();
-        deliver_saga_dispatch(
-            store, dispatch_fn, tables, sagas, pm, spec, domain_name, &args, correlation, occurred_at, depth, all_events, mutations, cross_domain, reaction_log, saga_log, &stamp, compensation_args,
-        );
+        let tables = self.tables;
+        for spec in compensation.dispatches {
+            let args =
+                build_dispatch_args(pm, spec, event, correlation, memory, domain_name, &tables);
+            let compensation_args = spec.compensates.map(|r| {
+                build_dispatch_args(pm, r, event, correlation, memory, domain_name, &tables)
+            });
+            self.deliver_saga_dispatch(leg, spec, &args, depth, compensation_args);
+        }
     }
 }
 
@@ -1067,10 +1276,16 @@ mod tests {
             id: "thing-1".to_string(),
             payload: Json::Object(vec![]),
             occurred_at: None,
-            correlation: Some([("reference".to_string(), "xfer-1".to_string())].into_iter().collect()),
+            correlation: Some(HashMap::from([(
+                "reference".to_string(),
+                "xfer-1".to_string(),
+            )])),
         };
 
-        assert_eq!(correlation_of(&pm, &event, no_reference_key), Some("xfer-1".to_string()));
+        assert_eq!(
+            correlation_of(&pm, &event, no_reference_key),
+            Some("xfer-1".to_string())
+        );
     }
 
     #[test]
@@ -1080,12 +1295,24 @@ mod tests {
             name: "SomeEvent".to_string(),
             aggregate: "Domain::Thing".to_string(),
             id: "thing-1".to_string(),
-            payload: Json::Object(vec![("reference".to_string(), Json::Object(vec![("value".to_string(), Json::Str("from-payload".to_string()))]))]),
+            payload: Json::Object(vec![(
+                "reference".to_string(),
+                Json::Object(vec![(
+                    "value".to_string(),
+                    Json::Str("from-payload".to_string()),
+                )]),
+            )]),
             occurred_at: None,
-            correlation: Some([("reference".to_string(), "from-stamp".to_string())].into_iter().collect()),
+            correlation: Some(HashMap::from([(
+                "reference".to_string(),
+                "from-stamp".to_string(),
+            )])),
         };
 
-        assert_eq!(correlation_of(&pm, &event, no_reference_key), Some("from-payload".to_string()));
+        assert_eq!(
+            correlation_of(&pm, &event, no_reference_key),
+            Some("from-payload".to_string())
+        );
     }
 
     #[test]
@@ -1097,7 +1324,7 @@ mod tests {
             id: "thing-1".to_string(),
             payload: Json::Object(vec![]),
             occurred_at: None,
-            correlation: Some([("reference".to_string(), String::new())].into_iter().collect()),
+            correlation: Some(HashMap::from([("reference".to_string(), String::new())])),
         };
 
         assert_eq!(correlation_of(&pm, &event, no_reference_key), None);
@@ -1106,19 +1333,21 @@ mod tests {
     // The stamping step of `orchestrate`, exercised without a real `dispatch_fn`.
     #[test]
     fn stamping_merges_into_an_existing_correlation_map_rather_than_replacing_it() {
-        let mut events = vec![
-            Event {
-                name: "E".to_string(),
-                aggregate: "Domain::Thing".to_string(),
-                id: "thing-1".to_string(),
-                payload: Json::Null,
-                occurred_at: None,
-                correlation: Some([("already".to_string(), "here".to_string())].into_iter().collect()),
-            },
-        ];
-        let stamp: HashMap<String, String> = [("reference".to_string(), "xfer-1".to_string())].into_iter().collect();
+        let mut events = vec![Event {
+            name: "E".to_string(),
+            aggregate: "Domain::Thing".to_string(),
+            id: "thing-1".to_string(),
+            payload: Json::Null,
+            occurred_at: None,
+            correlation: Some(HashMap::from([("already".to_string(), "here".to_string())])),
+        }];
+        let stamp: HashMap<String, String> =
+            HashMap::from([("reference".to_string(), "xfer-1".to_string())]);
         for event in &mut events {
-            event.correlation.get_or_insert_with(HashMap::new).extend(stamp.iter().map(|(k, v)| (k.clone(), v.clone())));
+            event
+                .correlation
+                .get_or_insert_with(HashMap::new)
+                .extend(stamp.iter().map(|(k, v)| (k.clone(), v.clone())));
         }
 
         let correlation = events[0].correlation.as_ref().unwrap();
@@ -1130,8 +1359,22 @@ mod tests {
     #[test]
     fn occurred_at_stamps_every_event_the_same_host_supplied_moment() {
         let mut events = vec![
-            Event { name: "A".to_string(), aggregate: "Domain::Thing".to_string(), id: "t1".to_string(), payload: Json::Null, occurred_at: None, correlation: None },
-            Event { name: "B".to_string(), aggregate: "Domain::Thing".to_string(), id: "t2".to_string(), payload: Json::Null, occurred_at: None, correlation: None },
+            Event {
+                name: "A".to_string(),
+                aggregate: "Domain::Thing".to_string(),
+                id: "t1".to_string(),
+                payload: Json::Null,
+                occurred_at: None,
+                correlation: None,
+            },
+            Event {
+                name: "B".to_string(),
+                aggregate: "Domain::Thing".to_string(),
+                id: "t2".to_string(),
+                payload: Json::Null,
+                occurred_at: None,
+                correlation: None,
+            },
         ];
         let occurred_at = Some("2026-08-28T00:00:00Z");
 
@@ -1141,13 +1384,26 @@ mod tests {
             }
         }
 
-        assert_eq!(events[0].occurred_at, Some("2026-08-28T00:00:00Z".to_string()));
-        assert_eq!(events[1].occurred_at, Some("2026-08-28T00:00:00Z".to_string()));
+        assert_eq!(
+            events[0].occurred_at,
+            Some("2026-08-28T00:00:00Z".to_string())
+        );
+        assert_eq!(
+            events[1].occurred_at,
+            Some("2026-08-28T00:00:00Z".to_string())
+        );
     }
 
     #[test]
     fn occurred_at_leaves_events_unstamped_when_no_caller_supplied_one() {
-        let mut events = vec![Event { name: "A".to_string(), aggregate: "Domain::Thing".to_string(), id: "t1".to_string(), payload: Json::Null, occurred_at: None, correlation: None }];
+        let mut events = vec![Event {
+            name: "A".to_string(),
+            aggregate: "Domain::Thing".to_string(),
+            id: "t1".to_string(),
+            payload: Json::Null,
+            occurred_at: None,
+            correlation: None,
+        }];
         let occurred_at: Option<&str> = None;
 
         if let Some(ts) = occurred_at {
@@ -1215,32 +1471,58 @@ mod tests {
     }
 
     #[test]
-    fn multi_leg_reentrant_saga_fires_completed_compensations_newest_first_on_a_later_legs_refusal() {
+    fn multi_leg_reentrant_saga_fires_completed_compensations_newest_first_on_a_later_legs_refusal()
+    {
         // `DISPATCH_RA`/`RB` are named statics; the forward legs are inline literals because a
         // static's value cannot be moved into an array (`DispatchSpec` is not `Copy`).
-        static DISPATCH_RA: DispatchSpec = DispatchSpec { command_name: "RA", with: &[], compensates: None };
-        static DISPATCH_RB: DispatchSpec = DispatchSpec { command_name: "RB", with: &[], compensates: None };
+        static DISPATCH_RA: DispatchSpec = DispatchSpec {
+            command_name: "RA",
+            with: &[],
+            compensates: None,
+        };
+        static DISPATCH_RB: DispatchSpec = DispatchSpec {
+            command_name: "RB",
+            with: &[],
+            compensates: None,
+        };
 
         static HANDLERS: &[Handler] = &[
             Handler {
                 event_type: "Started",
                 from_state: "start",
                 to_state: "state1",
-                dispatches: &[DispatchSpec { command_name: "A", with: &[], compensates: Some(&DISPATCH_RA) }],
+                dispatches: &[DispatchSpec {
+                    command_name: "A",
+                    with: &[],
+                    compensates: Some(&DISPATCH_RA),
+                }],
             },
             Handler {
                 event_type: "AEvent",
                 from_state: "state1",
                 to_state: "state2",
-                dispatches: &[DispatchSpec { command_name: "B", with: &[], compensates: Some(&DISPATCH_RB) }],
+                dispatches: &[DispatchSpec {
+                    command_name: "B",
+                    with: &[],
+                    compensates: Some(&DISPATCH_RB),
+                }],
             },
             Handler {
                 event_type: "BEvent",
                 from_state: "state2",
                 to_state: "state3",
-                dispatches: &[DispatchSpec { command_name: "C", with: &[], compensates: None }],
+                dispatches: &[DispatchSpec {
+                    command_name: "C",
+                    with: &[],
+                    compensates: None,
+                }],
+            },
+            Handler {
+                event_type: REFUSED,
+                from_state: "state3",
+                to_state: "compensated",
+                dispatches: &[],
             },
-            Handler { event_type: REFUSED, from_state: "state3", to_state: "compensated", dispatches: &[] },
         ];
 
         static PROCESS_MANAGERS: &[ProcessManagerDef] = &[ProcessManagerDef {
@@ -1293,12 +1575,23 @@ mod tests {
             &mut reaction_log,
             &mut saga_log,
         );
-        assert!(outcome.is_ok(), "top-level Kickoff should not itself refuse: {outcome:?}");
+        assert!(
+            outcome.is_ok(),
+            "top-level Kickoff should not itself refuse: {outcome:?}"
+        );
 
         let key = ("TestMultiLeg".to_string(), "corr-1".to_string());
-        let instance = sagas.get(&key).expect("the saga instance should still exist (it never reaches ends_on)");
-        assert_eq!(instance.state, "compensated", "the saga should have unwound to the on-:refused leg's own to_state");
-        assert!(instance.completed_compensations.is_empty(), "the ledger should be fully drained after compensate runs");
+        let instance = sagas
+            .get(&key)
+            .expect("the saga instance should still exist (it never reaches ends_on)");
+        assert_eq!(
+            instance.state, "compensated",
+            "the saga should have unwound to the on-:refused leg's own to_state"
+        );
+        assert!(
+            instance.completed_compensations.is_empty(),
+            "the ledger should be fully drained after compensate runs"
+        );
 
         let dispatch_entries: Vec<(String, bool, bool)> = saga_log
             .iter()
@@ -1389,13 +1682,19 @@ mod tests {
     // gates see.
     #[test]
     fn a_needed_fact_is_answered_before_the_absent_argument_gate_and_a_supplied_one_is_kept() {
-        let table = Json::parse(r#"{"T::Slot.Lease": [{"fact": "now", "type": "Integer"}]}"#).unwrap();
+        let table =
+            Json::parse(r#"{"T::Slot.Lease": [{"fact": "now", "type": "Integer"}]}"#).unwrap();
         crate::kernel::needs::install(Some(&table));
         crate::kernel::needs::fix_clock(Some(77));
 
         let args = Json::obj(vec![("with", Json::obj(vec![("holder", Json::str("a"))]))]);
         assert!(run_strict_now("T::Slot.Lease", &args, None).is_ok());
-        SEEN.with(|s| assert_eq!(s.borrow().as_ref().unwrap().get("now"), Some(&Json::int(77))));
+        SEEN.with(|s| {
+            assert_eq!(
+                s.borrow().as_ref().unwrap().get("now"),
+                Some(&Json::int(77))
+            );
+        });
 
         let supplied = Json::obj(vec![("with", Json::obj(vec![("now", Json::int(5))]))]);
         assert!(run_strict_now("T::Slot.Lease", &supplied, None).is_ok());
@@ -1411,6 +1710,7 @@ mod tests {
     // Pins domain-qualifying a same-domain entity command (`Manifest::Slot.Fill`): its leftover
     // `::` looks cross-domain, and an unqualified name would fail as an unknown command. The fake
     // dispatch panics on any verb but the qualified, dot-joined form.
+    #[allow(clippy::unnecessary_wraps)] // reason: the signature is the `DispatchFn` type.
     fn entity_command_test_dispatch(
         _store: &mut MultiLegTestStore,
         verb: &str,
@@ -1438,21 +1738,25 @@ mod tests {
             }]),
             // The qualified, dot-joined shape a generated `registry.rs` arm uses.
             "Test::Manifest.Slot.Fill" => Ok(vec![plain_event("SlotFilled")]),
-            other => panic!("unexpected verb in entity-command qualification test (BUG#9): {other}"),
+            other => {
+                panic!("unexpected verb in entity-command qualification test (BUG#9): {other}")
+            }
         }
     }
 
     #[test]
     fn a_saga_leg_dispatching_a_same_domain_entity_command_is_domain_qualified_and_dot_folded() {
-        static HANDLERS: &[Handler] = &[
-            Handler {
-                event_type: "Started",
-                from_state: "start",
-                to_state: "filling",
-                // Bare on the wire, entity-nested.
-                dispatches: &[DispatchSpec { command_name: "Manifest::Slot.Fill", with: &[], compensates: None }],
-            },
-        ];
+        static HANDLERS: &[Handler] = &[Handler {
+            event_type: "Started",
+            from_state: "start",
+            to_state: "filling",
+            // Bare on the wire, entity-nested.
+            dispatches: &[DispatchSpec {
+                command_name: "Manifest::Slot.Fill",
+                with: &[],
+                compensates: None,
+            }],
+        }];
 
         static PROCESS_MANAGERS: &[ProcessManagerDef] = &[ProcessManagerDef {
             name: "TestPacking",
@@ -1504,7 +1808,10 @@ mod tests {
             &mut reaction_log,
             &mut saga_log,
         );
-        assert!(outcome.is_ok(), "top-level Kickoff should not itself refuse: {outcome:?}");
+        assert!(
+            outcome.is_ok(),
+            "top-level Kickoff should not itself refuse: {outcome:?}"
+        );
 
         let dispatch_entries: Vec<(String, bool)> = saga_log
             .iter()
@@ -1526,11 +1833,23 @@ mod tests {
 
     #[test]
     fn qualify_saga_command_name_folds_a_same_domain_entity_command_reference() {
-        assert_eq!(qualify_saga_command_name("Waybill", "Manifest::Slot.Fill"), "Waybill::Manifest.Slot.Fill");
-        assert_eq!(qualify_saga_command_name("Waybill", "Manifest::Slot.Clear"), "Waybill::Manifest.Slot.Clear");
+        assert_eq!(
+            qualify_saga_command_name("Waybill", "Manifest::Slot.Fill"),
+            "Waybill::Manifest.Slot.Fill"
+        );
+        assert_eq!(
+            qualify_saga_command_name("Waybill", "Manifest::Slot.Clear"),
+            "Waybill::Manifest.Slot.Clear"
+        );
         // A plain aggregate command is only domain-prefixed.
-        assert_eq!(qualify_saga_command_name("Waybill", "Manifest.Open"), "Waybill::Manifest.Open");
-        assert_eq!(qualify_saga_command_name("Waybill", "Manifest.AddSlot"), "Waybill::Manifest.AddSlot");
+        assert_eq!(
+            qualify_saga_command_name("Waybill", "Manifest.Open"),
+            "Waybill::Manifest.Open"
+        );
+        assert_eq!(
+            qualify_saga_command_name("Waybill", "Manifest.AddSlot"),
+            "Waybill::Manifest.AddSlot"
+        );
     }
 
     // Fixture: non-creating `Widgets::Ledger.Grant`, identity head `email`, declared attribute
@@ -1569,38 +1888,67 @@ mod tests {
     }
 
     fn routed_to_a_receiver(id: &str) -> Json {
-        Json::obj(vec![("to", Json::str(id)), ("with", Json::obj(vec![("role", Json::str("Admin"))]))])
+        Json::obj(vec![
+            ("to", Json::str(id)),
+            ("with", Json::obj(vec![("role", Json::str("Admin"))])),
+        ])
     }
 
     #[test]
     fn split_routed_args_routes_a_value_object_identity_as_the_receiver() {
         // A value-object identity is `{"value": ...}` in an event payload and forwards as that
         // object.
-        let projected = Json::obj(vec![("email", Json::obj(vec![("value", Json::str("a@b.co"))])), ("role", Json::str("Admin"))]);
+        let projected = Json::obj(vec![
+            ("email", Json::obj(vec![("value", Json::str("a@b.co"))])),
+            ("role", Json::str("Admin")),
+        ]);
 
-        let routed = split_routed_args(projected, "Widgets::Ledger.Grant", &routed_fixture_tables());
+        let routed =
+            split_routed_args(projected, "Widgets::Ledger.Grant", &routed_fixture_tables());
 
-        assert_eq!(routed, routed_to_a_receiver("a@b.co"), "a VO identity should route as `to` — got {routed:?}");
+        assert_eq!(
+            routed,
+            routed_to_a_receiver("a@b.co"),
+            "a VO identity should route as `to` — got {routed:?}"
+        );
     }
 
     #[test]
     fn split_routed_args_still_routes_a_bare_scalar_identity() {
-        let projected = Json::obj(vec![("email", Json::str("a@b.co")), ("role", Json::str("Admin"))]);
+        let projected = Json::obj(vec![
+            ("email", Json::str("a@b.co")),
+            ("role", Json::str("Admin")),
+        ]);
 
-        let routed = split_routed_args(projected, "Widgets::Ledger.Grant", &routed_fixture_tables());
+        let routed =
+            split_routed_args(projected, "Widgets::Ledger.Grant", &routed_fixture_tables());
 
-        assert_eq!(routed, routed_to_a_receiver("a@b.co"), "a scalar identity should route as `to` — got {routed:?}");
+        assert_eq!(
+            routed,
+            routed_to_a_receiver("a@b.co"),
+            "a scalar identity should route as `to` — got {routed:?}"
+        );
     }
 
     #[test]
     fn split_routed_args_leaves_the_args_flat_when_the_identity_is_empty_or_not_a_value() {
         let flat = Json::obj(vec![("role", Json::str("Admin"))]);
-        let empty = Json::obj(vec![("email", Json::obj(vec![("value", Json::str(""))])), ("role", Json::str("Admin"))]);
-        let unrelated = Json::obj(vec![("email", Json::obj(vec![("other", Json::str("a@b.co"))])), ("role", Json::str("Admin"))]);
+        let empty = Json::obj(vec![
+            ("email", Json::obj(vec![("value", Json::str(""))])),
+            ("role", Json::str("Admin")),
+        ]);
+        let unrelated = Json::obj(vec![
+            ("email", Json::obj(vec![("other", Json::str("a@b.co"))])),
+            ("role", Json::str("Admin")),
+        ]);
 
         for projected in [empty, unrelated] {
-            let routed = split_routed_args(projected, "Widgets::Ledger.Grant", &routed_fixture_tables());
-            assert_eq!(routed, flat, "an unusable identity should leave only the declared facts — got {routed:?}");
+            let routed =
+                split_routed_args(projected, "Widgets::Ledger.Grant", &routed_fixture_tables());
+            assert_eq!(
+                routed, flat,
+                "an unusable identity should leave only the declared facts — got {routed:?}"
+            );
         }
     }
 
@@ -1612,7 +1960,10 @@ mod tests {
         );
         assert_eq!(entity_command_paths("Waybill::Manifest.AddSlot"), None);
         // A two-level entity command is deliberately not routed.
-        assert_eq!(entity_command_paths("Domain::Workspace.Board.Card.Annotate"), None);
+        assert_eq!(
+            entity_command_paths("Domain::Workspace.Board.Card.Annotate"),
+            None
+        );
     }
 
     // Fixture: one-level entity command `Widgets::Crate.Slot.Fill` whose `with:` carries the
@@ -1651,11 +2002,15 @@ mod tests {
     }
 
     #[test]
-    fn route_dispatch_args_threads_the_triggering_events_aggregate_identity_into_a_one_level_entity_commands_route() {
+    fn route_dispatch_args_threads_the_triggering_events_aggregate_identity_into_a_one_level_entity_commands_route(
+    ) {
         // `number` is VO-nested; the parent aggregate's identity comes only from the triggering
         // event.
         let tables = bug10_fixture_tables();
-        let projected = Json::obj(vec![("number", Json::obj(vec![("value", Json::int(7))])), ("item", Json::str("hello"))]);
+        let projected = Json::obj(vec![
+            ("number", Json::obj(vec![("value", Json::int(7))])),
+            ("item", Json::str("hello")),
+        ]);
         let event = Event {
             name: "SlotAdded".to_string(),
             aggregate: "Widgets::Crate".to_string(),
@@ -1665,7 +2020,7 @@ mod tests {
             correlation: None,
         };
 
-        let routed = route_dispatch_args(projected, "Widgets::Crate.Slot.Fill", &tables, &event);
+        let routed = route_dispatch_args(&projected, "Widgets::Crate.Slot.Fill", &tables, &event);
         assert_eq!(
             routed,
             Json::obj(vec![
@@ -1679,11 +2034,15 @@ mod tests {
     }
 
     #[test]
-    fn route_dispatch_args_falls_through_unchanged_when_the_triggering_event_is_a_different_aggregate() {
+    fn route_dispatch_args_falls_through_unchanged_when_the_triggering_event_is_a_different_aggregate(
+    ) {
         // The triggering event is a different aggregate, so no receiver may be invented: falls
         // through unrouted.
         let tables = bug10_fixture_tables();
-        let projected = Json::obj(vec![("number", Json::obj(vec![("value", Json::int(7))])), ("item", Json::str("hello"))]);
+        let projected = Json::obj(vec![
+            ("number", Json::obj(vec![("value", Json::int(7))])),
+            ("item", Json::str("hello")),
+        ]);
         let event = Event {
             name: "SomethingElseHappened".to_string(),
             aggregate: "Widgets::OtherThing".to_string(),
@@ -1693,7 +2052,7 @@ mod tests {
             correlation: None,
         };
 
-        let routed = route_dispatch_args(projected, "Widgets::Crate.Slot.Fill", &tables, &event);
+        let routed = route_dispatch_args(&projected, "Widgets::Crate.Slot.Fill", &tables, &event);
         assert_eq!(
             routed,
             Json::obj(vec![("item", Json::str("hello"))]),
@@ -1706,6 +2065,7 @@ mod tests {
 
     // Two legs on one event from different states, each reached exactly when its `from:` is
     // current.
+    #[allow(clippy::unnecessary_wraps)] // reason: the signature is the `DispatchFn` type.
     fn two_leg_test_dispatch(
         _store: &mut MultiLegTestStore,
         verb: &str,
@@ -1730,14 +2090,24 @@ mod tests {
     }
 
     #[test]
-    fn a_saga_leg_is_selected_by_event_and_current_state_so_two_legs_on_one_event_are_both_reachable() {
+    fn a_saga_leg_is_selected_by_event_and_current_state_so_two_legs_on_one_event_are_both_reachable(
+    ) {
         static HANDLERS: &[Handler] = &[
-            Handler { event_type: "Scanned", from_state: "posted", to_state: "picked_up", dispatches: &[] },
+            Handler {
+                event_type: "Scanned",
+                from_state: "posted",
+                to_state: "picked_up",
+                dispatches: &[],
+            },
             Handler {
                 event_type: "Scanned",
                 from_state: "picked_up",
                 to_state: "handed_over",
-                dispatches: &[DispatchSpec { command_name: "Deliver", with: &[], compensates: None }],
+                dispatches: &[DispatchSpec {
+                    command_name: "Deliver",
+                    with: &[],
+                    compensates: None,
+                }],
             },
         ];
         static PROCESS_MANAGERS: &[ProcessManagerDef] = &[ProcessManagerDef {
@@ -1799,8 +2169,16 @@ mod tests {
                     return None;
                 }
                 Some((
-                    entry.get("from").and_then(Json::as_str).unwrap_or("").to_string(),
-                    entry.get("to").and_then(Json::as_str).unwrap_or("").to_string(),
+                    entry
+                        .get("from")
+                        .and_then(Json::as_str)
+                        .unwrap_or("")
+                        .to_string(),
+                    entry
+                        .get("to")
+                        .and_then(Json::as_str)
+                        .unwrap_or("")
+                        .to_string(),
                 ))
             })
             .collect();
@@ -1821,6 +2199,7 @@ mod tests {
 
     // One dispatch announces two events: a saga leg answers the first, a policy the second. The
     // whole batch is logged before any reaction, then reactions run per event in emits order.
+    #[allow(clippy::unnecessary_wraps)] // reason: the signature is the `DispatchFn` type.
     fn two_event_test_dispatch(
         _store: &mut MultiLegTestStore,
         verb: &str,
@@ -1852,7 +2231,11 @@ mod tests {
             event_type: "Legged",
             from_state: "started",
             to_state: "logged",
-            dispatches: &[DispatchSpec { command_name: "Log", with: &[], compensates: None }],
+            dispatches: &[DispatchSpec {
+                command_name: "Log",
+                with: &[],
+                compensates: None,
+            }],
         }];
         static PROCESS_MANAGERS: &[ProcessManagerDef] = &[ProcessManagerDef {
             name: "Route",
@@ -1929,8 +2312,18 @@ mod tests {
     #[test]
     fn a_leg_miss_names_every_from_state_the_event_could_have_answered_from() {
         static HANDLERS: &[Handler] = &[
-            Handler { event_type: "Scanned", from_state: "posted", to_state: "picked_up", dispatches: &[] },
-            Handler { event_type: "Scanned", from_state: "picked_up", to_state: "handed_over", dispatches: &[] },
+            Handler {
+                event_type: "Scanned",
+                from_state: "posted",
+                to_state: "picked_up",
+                dispatches: &[],
+            },
+            Handler {
+                event_type: "Scanned",
+                from_state: "picked_up",
+                to_state: "handed_over",
+                dispatches: &[],
+            },
         ];
         let pm = ProcessManagerDef {
             name: "Delivery",
@@ -1940,8 +2333,14 @@ mod tests {
             initial_state: "posted",
             handlers: HANDLERS,
         };
-        assert_eq!(select_leg(&pm, "Scanned", "picked_up").map(|h| h.to_state), Some("handed_over"));
+        assert_eq!(
+            select_leg(&pm, "Scanned", "picked_up").map(|h| h.to_state),
+            Some("handed_over")
+        );
         assert!(select_leg(&pm, "Scanned", "handed_over").is_none());
-        assert_eq!(leg_mismatch(&pm, "Scanned", "handed_over"), "in \"handed_over\", not \"posted\" or \"picked_up\"");
+        assert_eq!(
+            leg_mismatch(&pm, "Scanned", "handed_over"),
+            "in \"handed_over\", not \"posted\" or \"picked_up\""
+        );
     }
 }