hecks 3.14.0 → 5.0.0

data/rust/host/src/boot.rs

@@ -1,7 +1,11 @@
 //! Lambda custom-runtime entry point (or a long-lived server under
 //! HECKS_SERVE_MODE=1): boots Postgres/wasm state, then dispatches events.
 
-use crate::{approval, auth, extension, ir, journal, lambda_client, log, mint, rate_limit, secrets, server, storage_shape};
+use crate::host::Host;
+use crate::{
+    auth, extension, ir, journal, lambda_client, log, mint, rate_limit, secrets, server,
+    storage_shape,
+};
 
 use lambda_runtime::{service_fn, Error, LambdaEvent};
 use std::path::PathBuf;
@@ -37,8 +41,10 @@ pub async fn run() -> Result<(), Error> {
     let secret_fetcher = secrets::AwsSecretFetcher::from_env().await;
     let database_url = match std::env::var("DB_SECRET_ARN") {
         Ok(secret_arn) => {
-            let db_host = std::env::var("DB_HOST").map_err(|_| "DB_HOST is required when DB_SECRET_ARN is set")?;
-            let db_name = std::env::var("DB_NAME").map_err(|_| "DB_NAME is required when DB_SECRET_ARN is set")?;
+            let db_host = std::env::var("DB_HOST")
+                .map_err(|_| "DB_HOST is required when DB_SECRET_ARN is set")?;
+            let db_name = std::env::var("DB_NAME")
+                .map_err(|_| "DB_NAME is required when DB_SECRET_ARN is set")?;
             let secret_json = secret_fetcher
                 .fetch_secret_string(&secret_arn)
                 .await
@@ -56,10 +62,7 @@ pub async fn run() -> Result<(), Error> {
     // Secrets-Manager-at-cold-start approach as DB_SECRET_ARN above,
     // applied to auth.rs's GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET and
     // web.rs's SESSION_SECRET.
-    //
-    // Safety: this runs before any request is dispatched, so nothing
-    // else reads or writes the environment concurrently with these
-    // `set_var` calls.
+    // They go into `secrets::provide`, not the process environment.
     if let Ok(oauth_secret_id) = std::env::var("GOOGLE_OAUTH_SECRET_ID") {
         let secret_json = secret_fetcher
             .fetch_secret_string(&oauth_secret_id)
@@ -67,10 +70,8 @@ pub async fn run() -> Result<(), Error> {
             .map_err(|e| format!("fetching GOOGLE_OAUTH_SECRET_ID from Secrets Manager: {e:#}"))?;
         let client_id = secrets::extract_field(&secret_json, "client_id")?;
         let client_secret = secrets::extract_field(&secret_json, "client_secret")?;
-        unsafe {
-            std::env::set_var("GOOGLE_CLIENT_ID", client_id);
-            std::env::set_var("GOOGLE_CLIENT_SECRET", client_secret);
-        }
+        secrets::provide("GOOGLE_CLIENT_ID", client_id);
+        secrets::provide("GOOGLE_CLIENT_SECRET", client_secret);
     }
     if let Ok(session_secret_arn) = std::env::var("SESSION_SECRET_ARN") {
         let secret_json = secret_fetcher
@@ -78,9 +79,7 @@ pub async fn run() -> Result<(), Error> {
             .await
             .map_err(|e| format!("fetching SESSION_SECRET_ARN from Secrets Manager: {e:#}"))?;
         let session_secret = secrets::extract_field(&secret_json, "session_secret")?;
-        unsafe {
-            std::env::set_var("SESSION_SECRET", session_secret);
-        }
+        secrets::provide("SESSION_SECRET", session_secret);
     }
     for extension in extension::installed() {
         extension.boot_secrets(&secret_fetcher).await;
@@ -125,7 +124,8 @@ pub async fn run() -> Result<(), Error> {
     }
     // NoTlsStream and RustlsStream can't unify in one branch, so the
     // two paths are spawned separately.
-    let connect_phase = log::phase_with("db_connect", serde_json::json!({ "tls": !local_postgres }));
+    let connect_phase =
+        log::phase_with("db_connect", serde_json::json!({ "tls": !local_postgres }));
     let client = if local_postgres {
         let (client, connection) = config
             .connect(tokio_postgres::NoTls)
@@ -164,11 +164,17 @@ pub async fn run() -> Result<(), Error> {
     // existing schema is the ordinary case on every boot after the first.
     if let Some(schema) = &schema {
         client
-            .batch_execute(&format!("CREATE SCHEMA IF NOT EXISTS {}", journal::quote_ident(schema)))
+            .batch_execute(&format!(
+                "CREATE SCHEMA IF NOT EXISTS {}",
+                journal::quote_ident(schema)
+            ))
             .await
             .map_err(|e| format!("creating schema {schema:?}: {e:#}"))?;
         client
-            .batch_execute(&format!("SET search_path TO {}", journal::quote_ident(schema)))
+            .batch_execute(&format!(
+                "SET search_path TO {}",
+                journal::quote_ident(schema)
+            ))
             .await
             .map_err(|e| format!("setting search_path to {schema:?}: {e:#}"))?;
     }
@@ -187,7 +193,11 @@ pub async fn run() -> Result<(), Error> {
     let mut aggregates: Vec<mint::Aggregate> = ir::lineage_capable_aggregates(ir)
         .into_iter()
         .map(|(qualified, storage_name)| {
-            let name = qualified.rsplit("::").next().unwrap_or(&qualified).to_string();
+            let name = qualified
+                .rsplit("::")
+                .next()
+                .unwrap_or(&qualified)
+                .to_string();
             mint::Aggregate { name, storage_name }
         })
         .collect();
@@ -195,7 +205,12 @@ pub async fn run() -> Result<(), Error> {
     // aggregate can be vendored, so it may be missing from this domain's
     // lineage-capable list. Mint its head anyway for Google-auth to read.
     if let Some(membership) = ir::membership_provider(ir) {
-        let name = membership.aggregate.rsplit("::").next().unwrap_or(&membership.aggregate).to_string();
+        let name = membership
+            .aggregate
+            .rsplit("::")
+            .next()
+            .unwrap_or(&membership.aggregate)
+            .to_string();
         let storage_name = journal::snake(&name);
         if !aggregates.iter().any(|a| a.storage_name == storage_name) {
             aggregates.push(mint::Aggregate { name, storage_name });
@@ -205,14 +220,16 @@ pub async fn run() -> Result<(), Error> {
     // The era-partitioned lineage subsystem is provisioned only when
     // something needs it: a lineage-capable aggregate, or Google auth
     // configured (ADR 0034 requires it for Member sessions either way).
-    let needs_lineage = !aggregates.is_empty() || std::env::var("GOOGLE_CLIENT_ID").is_ok();
+    let needs_lineage = !aggregates.is_empty() || secrets::var("GOOGLE_CLIENT_ID").is_ok();
 
     let era: Option<i32> = if needs_lineage {
         // Idempotent (gated by `provisioner?`); must run before the
         // first `journal::held_eras` call, since `hecks_eras` doesn't
         // exist yet on a truly fresh Postgres instance.
         let phase = log::phase("ensure_base");
-        mint::ensure_base(&client, &domain).await.map_err(|e| format!("provisioning hecks_eras for {domain}: {e:#}"))?;
+        mint::ensure_base(&client, &domain)
+            .await
+            .map_err(|e| format!("provisioning hecks_eras for {domain}: {e:#}"))?;
         phase.end();
 
         // Compares this binary's own shape hash (`storage_shape`, over
@@ -222,20 +239,26 @@ pub async fn run() -> Result<(), Error> {
         // `hecks scaffold_translation` (no edge covers it) or
         // `hecks audit_translation --approve` (needs review) otherwise.
         let era_phase = log::phase("era_resolve");
-        let held = journal::held_eras(&client, &domain).await.map_err(|e| format!("checking hecks_eras for {domain}: {e:#}"))?;
+        let held = journal::held_eras(&client, &domain)
+            .await
+            .map_err(|e| format!("checking hecks_eras for {domain}: {e:#}"))?;
 
         // The decision itself is a pure, unit-tested function
         // (`mint::decide_boot_action`); everything below just carries
         // out whichever of its four outcomes came back.
         let decision = mint::decide_boot_action(&held, &my_label);
-        era_phase.end_with(serde_json::json!({ "held_eras": held.len(), "decision": decision.name() }));
+        era_phase
+            .end_with(serde_json::json!({ "held_eras": held.len(), "decision": decision.name() }));
         let ordinal: i32 = match decision {
             // Adopting an existing era still provisions what this binary
             // is about to write into, the same as minting does --
             // skipping it would let a matched-era host write into
             // head-snapshot tables that were never created.
             mint::BootDecision::UseExisting { ordinal } => {
-                let phase = log::phase_with("adopt_head_snapshots", serde_json::json!({ "era": ordinal }));
+                let phase = log::phase_with(
+                    "adopt_head_snapshots",
+                    serde_json::json!({ "era": ordinal }),
+                );
                 mint::adopt_head_snapshots(&client, &domain, &aggregates, ordinal)
                     .await
                     .map_err(|e| format!("adopting era {ordinal} of {domain}: {e:#}"))?;
@@ -243,10 +266,14 @@ pub async fn run() -> Result<(), Error> {
                 ordinal
             }
             mint::BootDecision::HoldFirst => {
-                let source_text =
-                    ir.get("source_text").and_then(serde_json::Value::as_str).ok_or("ir.json is missing source_text — regenerate with hecks project_rust")?;
+                let source_text = ir
+                    .get("source_text")
+                    .and_then(serde_json::Value::as_str)
+                    .ok_or("ir.json is missing source_text — regenerate with hecks project_rust")?;
                 let phase = log::phase_with("hold_first", serde_json::json!({ "era": 1 }));
-                mint::hold_first(&client, &domain, source_text, ir, &aggregates, None).await.map_err(|e| format!("minting era 1 of {domain}: {e:#}"))?;
+                mint::hold_first(&client, &domain, source_text, ir, &aggregates, None)
+                    .await
+                    .map_err(|e| format!("minting era 1 of {domain}: {e:#}"))?;
                 phase.end();
                 1
             }
@@ -258,8 +285,15 @@ pub async fn run() -> Result<(), Error> {
                 )
                 .into());
             }
-            mint::BootDecision::Mint { ordinal, from_ordinal, from_label } => {
-                let mut labels: Vec<String> = held.iter().map(|held_era| held_era.label.clone().unwrap_or_default()).collect();
+            mint::BootDecision::Mint {
+                ordinal,
+                from_ordinal,
+                from_label,
+            } => {
+                let mut labels: Vec<String> = held
+                    .iter()
+                    .map(|held_era| held_era.label.clone().unwrap_or_default())
+                    .collect();
                 labels.push(my_label.clone());
                 let edges = mint::parse_edges(ir, &domain);
                 let chain = mint::edge_chain(&edges, &labels).map_err(|e| {
@@ -270,40 +304,60 @@ pub async fn run() -> Result<(), Error> {
                     )
                 })?;
 
-                // Checks every edge in the chain with a compute/rekey
-                // rule, not just the newest -- a chain can carry more
-                // than one, matched against the raw ir.json edge
-                // (digest-relevant shape) by the same from/to pair.
-                let raw_edges = ir.get("translations").and_then(serde_json::Value::as_array).cloned().unwrap_or_default();
-                let committed_approvals = approval::committed(ir);
-                let approval_phase = log::phase_with("approval_check", serde_json::json!({ "edges": chain.len(), "committed": committed_approvals.len() }));
-                for edge in &chain {
-                    let Some(raw_edge) = raw_edges.iter().find(|candidate| {
-                        candidate.get("domain").and_then(serde_json::Value::as_str) == Some(domain.as_str())
-                            && candidate.get("from").and_then(serde_json::Value::as_str) == Some(edge.from.as_str())
-                            && candidate.get("to").and_then(serde_json::Value::as_str) == Some(edge.to.as_str())
-                    }) else {
-                        return Err(format!("cannot boot: {domain}'s edge {} -> {} vanished between parsing and approval-checking it", edge.from, edge.to).into());
-                    };
-                    approval::check(&client, &domain, raw_edge, ordinal, &committed_approvals).await.map_err(|e| format!("{e:#}"))?;
-                }
-                approval_phase.end();
+                // The raw ir.json edges, matched to the chain by from/to pair for the audit.
+                let raw_edges = ir
+                    .get("translations")
+                    .and_then(serde_json::Value::as_array)
+                    .cloned()
+                    .unwrap_or_default();
 
                 // Runs before anything is minted, over the live compiled
                 // chain (plain SELECTs, never a persisted matview), so a
                 // refusal leaves no half-born era.
-                let watermarks: std::collections::HashMap<i32, Option<i64>> = held.iter().map(|held_era| (held_era.ordinal, held_era.watermark)).collect();
-                let audit_phase = log::phase_with("audit_before_mint", serde_json::json!({ "era": ordinal, "edges": chain.len() }));
-                mint::audit_before_mint(&client, &domain, ir, &aggregates, ordinal, &chain, &raw_edges, &watermarks)
-                    .await
-                    .map_err(|e| format!("{e:#}"))?;
+                let watermarks: std::collections::HashMap<i32, Option<i64>> = held
+                    .iter()
+                    .map(|held_era| (held_era.ordinal, held_era.watermark))
+                    .collect();
+                let audit_phase = log::phase_with(
+                    "audit_before_mint",
+                    serde_json::json!({ "era": ordinal, "edges": chain.len() }),
+                );
+                mint::audit_before_mint(
+                    &client,
+                    &domain,
+                    ir,
+                    &aggregates,
+                    ordinal,
+                    &chain,
+                    &raw_edges,
+                    &watermarks,
+                )
+                .await
+                .map_err(|e| format!("{e:#}"))?;
                 audit_phase.end();
 
-                let held_text = ir.get("source_text").and_then(serde_json::Value::as_str).ok_or("ir.json is missing source_text — regenerate with hecks project_rust")?;
-                let mint_phase = log::phase_with("mint_era", serde_json::json!({ "era": ordinal, "edges": chain.len() }));
-                mint::mint_era(&client, &domain, ordinal, &my_hash, &my_label, held_text, &aggregates, &chain, None, &mint::lifecycle_defaults(ir))
-                    .await
-                    .map_err(|e| format!("minting era {ordinal} of {domain}: {e:#}"))?;
+                let held_text = ir
+                    .get("source_text")
+                    .and_then(serde_json::Value::as_str)
+                    .ok_or("ir.json is missing source_text — regenerate with hecks project_rust")?;
+                let mint_phase = log::phase_with(
+                    "mint_era",
+                    serde_json::json!({ "era": ordinal, "edges": chain.len() }),
+                );
+                mint::mint_era(
+                    &client,
+                    &domain,
+                    ordinal,
+                    &my_hash,
+                    &my_label,
+                    held_text,
+                    &aggregates,
+                    &chain,
+                    None,
+                    &mint::lifecycle_defaults(ir),
+                )
+                .await
+                .map_err(|e| format!("minting era {ordinal} of {domain}: {e:#}"))?;
                 mint_phase.end();
                 ordinal
             }
@@ -317,7 +371,11 @@ pub async fn run() -> Result<(), Error> {
     // -- never "everything this kernel can mutate". A domain that binds
     // everything to plain `Postgres` mirrors nothing.
     let mirrored = ir::mirrored_aggregates(ir);
-    let lineage_config = Arc::new(journal::LineageConfig { domain, era, mirrored: Some(mirrored) });
+    let lineage_config = Arc::new(journal::LineageConfig {
+        domain,
+        era,
+        mirrored: Some(mirrored),
+    });
 
     // Mutex, not a bare Arc<Client> -- dispatch::handle needs
     // Client::transaction (&mut Client) to hold the advisory lock
@@ -338,9 +396,19 @@ pub async fn run() -> Result<(), Error> {
             "boot",
             serde_json::json!({ "mode": "serve", "domain": &lineage_config.domain, "era": &my_label, "boot_ms": boot_started.elapsed().as_millis() as u64 }),
         );
-        let version = server::version_body(&my_label, &my_hash, std::env::var("HECKS_BUILD").ok().as_deref());
+        let version = server::version_body(
+            &my_label,
+            &my_hash,
+            std::env::var("HECKS_BUILD").ok().as_deref(),
+        );
         let limits = Arc::new(rate_limit::RateLimits::from_env());
-        let state = server::ServerState { client, wasm_path, lineage_config, invoker, limits };
+        let state = server::ServerState {
+            client,
+            wasm_path,
+            lineage_config,
+            invoker,
+            limits,
+        };
         return server::serve(state, version).await;
     }
 
@@ -351,7 +419,11 @@ pub async fn run() -> Result<(), Error> {
         let invoker = Arc::clone(&invoker);
         async move {
             let (body, _context) = event.into_parts();
-            server::dispatch_body(body, &client, &wasm_path, &lineage_config, invoker.as_ref()).await
+            server::dispatch_body(
+                body,
+                Host::new(&client, &wasm_path, &lineage_config, invoker.as_ref()),
+            )
+            .await
         }
     }))
     .await
@@ -364,12 +436,17 @@ fn parse_database_url(url: &str) -> Result<tokio_postgres::Config, String> {
     let rest = url
         .strip_prefix("postgres://")
         .or_else(|| url.strip_prefix("postgresql://"))
-        .ok_or_else(|| format!("DATABASE_URL doesn't start with postgres:// or postgresql://"))?;
+        .ok_or_else(|| {
+            "DATABASE_URL doesn't start with postgres:// or postgresql://".to_string()
+        })?;
 
     let (authority, db_and_query) = rest
         .split_once('/')
         .ok_or_else(|| "DATABASE_URL has no '/' separating host from database name".to_string())?;
-    let dbname = db_and_query.split(['?', '#']).next().unwrap_or(db_and_query);
+    let dbname = db_and_query
+        .split(['?', '#'])
+        .next()
+        .unwrap_or(db_and_query);
 
     let (credentials, host_and_port) = match authority.rsplit_once('@') {
         Some((credentials, host_and_port)) => (Some(credentials), host_and_port),
@@ -404,7 +481,7 @@ fn database_url_is_local(config: &tokio_postgres::Config) -> bool {
     use tokio_postgres::config::Host;
     config.get_hosts().iter().any(|host| match host {
         Host::Tcp(name) => name == "localhost" || name == "127.0.0.1" || name == "::1",
-        _ => false,
+        Host::Unix(_) => false,
     })
 }
 
@@ -414,10 +491,9 @@ mod tests {
 
     #[test]
     fn parses_a_password_with_uri_reserved_characters() {
-        let config = parse_database_url(
-            "postgres://postgres:T3st$Pa?#ss*>Word@db.example.com:5432/pizzas",
-        )
-        .expect("should parse despite ?/# in the password");
+        let config =
+            parse_database_url("postgres://postgres:T3st$Pa?#ss*>Word@db.example.com:5432/pizzas")
+                .expect("should parse despite ?/# in the password");
         assert_eq!(config.get_hosts().len(), 1);
         assert_eq!(config.get_ports(), &[5432]);
         assert_eq!(config.get_user(), Some("postgres"));

data/rust/host/src/boundary_fuzz/api.rs

@@ -7,11 +7,20 @@ use super::*;
 use crate::fuzz_support::*;
 
 fn envelope_is_structured(response: &Value) {
-    let status = response["statusCode"].as_u64().expect("a refusal carries its status");
-    assert!((400..600).contains(&status), "a refusal is a 4xx/5xx, got {status}");
+    let status = response["statusCode"]
+        .as_u64()
+        .expect("a refusal carries its status");
+    assert!(
+        (400..600).contains(&status),
+        "a refusal is a 4xx/5xx, got {status}"
+    );
     assert_eq!(response["headers"]["content-type"], "application/json");
-    let body: Value = serde_json::from_str(response["body"].as_str().expect("a JSON body")).expect("the body is JSON");
-    assert!(body["error"].is_string() && body["message"].is_string(), "the refusal names itself: {body}");
+    let body: Value = serde_json::from_str(response["body"].as_str().expect("a JSON body"))
+        .expect("the body is JSON");
+    assert!(
+        body["error"].is_string() && body["message"].is_string(),
+        "the refusal names itself: {body}"
+    );
 }
 
 fn client_aggregate() -> Value {
@@ -45,12 +54,22 @@ fn parsed_body_refuses_everything_that_is_not_an_object_with_a_structured_400()
                         mutate_text(&mut rng, &valid)
                     }
                     2 => random_value(&mut rng, 0).to_string(),
-                    _ => format!("{}{}", " \t\n".repeat(rng.below(3)), random_value(&mut rng, 1)),
+                    _ => format!(
+                        "{}{}",
+                        " \t\n".repeat(rng.below(3)),
+                        random_value(&mut rng, 1)
+                    ),
                 };
                 match parsed_body(&text) {
                     Ok(body) => {
-                        assert!(body.is_object(), "seed {seed}: {text:?} parsed to a non-object");
-                        assert!(text.trim().is_empty() || serde_json::from_str::<Value>(&text).is_ok(), "seed {seed}: {text:?} is not JSON yet was accepted");
+                        assert!(
+                            body.is_object(),
+                            "seed {seed}: {text:?} parsed to a non-object"
+                        );
+                        assert!(
+                            text.trim().is_empty() || serde_json::from_str::<Value>(&text).is_ok(),
+                            "seed {seed}: {text:?} is not JSON yet was accepted"
+                        );
                     }
                     Err(refusal) => {
                         assert_eq!(refusal["statusCode"], 400, "seed {seed}: {text:?}");
@@ -74,7 +93,19 @@ fn parsed_body_survives_depth_width_and_size() {
         ] {
             let _ = parsed_body(&text);
         }
-        for text in ["[]", "1", "\"s\"", "null", "true", "{", "{\"a\":1}{}", "{} {}", "\u{feff}{}", "{\"a\":NaN}", "{\"a\":1e999}"] {
+        for text in [
+            "[]",
+            "1",
+            "\"s\"",
+            "null",
+            "true",
+            "{",
+            "{\"a\":1}{}",
+            "{} {}",
+            "\u{feff}{}",
+            "{\"a\":NaN}",
+            "{\"a\":1e999}",
+        ] {
             if let Err(refusal) = parsed_body(text) {
                 assert_eq!(refusal["statusCode"], 400, "{text:?}");
             }
@@ -93,8 +124,15 @@ fn slugify_always_answers_a_clean_non_empty_slug() {
                 let text = random_text(&mut rng);
                 let slug = slugify(&text);
                 assert!(!slug.is_empty(), "seed {seed}: {text:?} slugged to nothing");
-                assert!(slug.chars().all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-'), "seed {seed}: {text:?} -> {slug:?}");
-                assert!(!slug.starts_with('-') && !slug.ends_with('-') && !slug.contains("--"), "seed {seed}: {text:?} -> {slug:?}");
+                assert!(
+                    slug.chars()
+                        .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-'),
+                    "seed {seed}: {text:?} -> {slug:?}"
+                );
+                assert!(
+                    !slug.starts_with('-') && !slug.ends_with('-') && !slug.contains("--"),
+                    "seed {seed}: {text:?} -> {slug:?}"
+                );
             }
         });
     }
@@ -113,26 +151,55 @@ fn identity_minting_survives_any_rule_and_leaves_args_alone_when_it_refuses() {
                         continue;
                     }
                     let value = match key {
-                        "field" if rng.chance(2) => json!(*rng.pick(&["reference", "name", "owner", "status", "missing", ""])),
-                        "strategy" if rng.chance(2) => json!(*rng.pick(&["slug", "sequence", "port", "nope", ""])),
-                        "source" if rng.chance(2) => json!(*rng.pick(&["name", "reference", "owner", "missing", ""])),
-                        "pad" if rng.chance(2) => json!(*rng.pick(&[0u64, 1, 3, 64, 65, 1_000, 1_000_000, 1u64 << 40, 1u64 << 62, u64::MAX])),
+                        "field" if rng.chance(2) => json!(*rng.pick(&[
+                            "reference",
+                            "name",
+                            "owner",
+                            "status",
+                            "missing",
+                            ""
+                        ])),
+                        "strategy" if rng.chance(2) => {
+                            json!(*rng.pick(&["slug", "sequence", "port", "nope", ""]))
+                        }
+                        "source" if rng.chance(2) => {
+                            json!(*rng.pick(&["name", "reference", "owner", "missing", ""]))
+                        }
+                        "pad" if rng.chance(2) => json!(*rng.pick(&[
+                            0u64,
+                            1,
+                            3,
+                            64,
+                            65,
+                            1_000,
+                            1_000_000,
+                            1u64 << 40,
+                            1u64 << 62,
+                            u64::MAX
+                        ])),
                         _ => random_value(&mut rng, 2),
                     };
                     rule.insert(key.to_string(), value);
                 }
-                let presentation = json!({"collections": {"Client": {"identity": Value::Object(rule)}}});
-                let mut args = random_value(&mut rng, 0);
-                if rng.chance(2) {
-                    args = json!({"name": random_value(&mut rng, 2)});
-                }
+                let presentation =
+                    json!({"collections": {"Client": {"identity": Value::Object(rule)}}});
+                // Drawn before the coin flip, so a seed replays the same stream.
+                let drawn = random_value(&mut rng, 0);
+                let mut args = if rng.chance(2) {
+                    json!({"name": random_value(&mut rng, 2)})
+                } else {
+                    drawn
+                };
                 let before = args.clone();
                 let existing = *rng.pick(&[0usize, 1, 41, 999_999, usize::MAX - 1]);
                 match apply_identity(&presentation, &aggregate, &mut args, existing) {
                     Ok(()) => {}
                     Err(refusal) => {
                         envelope_is_structured(&refusal);
-                        assert_eq!(args, before, "seed {seed}: a refused identity must not have touched the args");
+                        assert_eq!(
+                            args, before,
+                            "seed {seed}: a refused identity must not have touched the args"
+                        );
                     }
                 }
             }
@@ -146,13 +213,19 @@ fn an_absurd_sequence_pad_is_refused_rather_than_allocating_it() {
     for pad in [65u64, 1_000_000, 1 << 40, u64::MAX] {
         let presentation = json!({"collections": {"Client": {"identity": {"field": "reference", "strategy": "sequence", "prefix": "C-", "pad": pad}}}});
         let mut args = json!({"name": {"value": "Acme"}});
-        let refusal = apply_identity(&presentation, &aggregate, &mut args, 1).expect_err("a pad this wide is refused");
+        let refusal = apply_identity(&presentation, &aggregate, &mut args, 1)
+            .expect_err("a pad this wide is refused");
         envelope_is_structured(&refusal);
-        assert_eq!(args, json!({"name": {"value": "Acme"}}), "pad {pad}: nothing was minted");
+        assert_eq!(
+            args,
+            json!({"name": {"value": "Acme"}}),
+            "pad {pad}: nothing was minted"
+        );
     }
     let presentation = json!({"collections": {"Client": {"identity": {"field": "reference", "strategy": "sequence", "prefix": "C-", "pad": 64}}}});
     let mut args = json!({});
-    apply_identity(&presentation, &aggregate, &mut args, 0).expect("the widest allowed pad still mints");
+    apply_identity(&presentation, &aggregate, &mut args, 0)
+        .expect("the widest allowed pad still mints");
     assert_eq!(args["reference"]["value"].as_str().unwrap().len(), 2 + 64);
 }
 
@@ -169,9 +242,19 @@ fn preconditions_survive_any_config_and_instances_shape() {
                 } else {
                     json!({"field": *rng.pick(&["owner", "name", "status", "missing"]), "state": random_value(&mut rng, 2), "message": random_value(&mut rng, 2)})
                 };
-                let args = if rng.chance(3) { random_value(&mut rng, 0) } else { json!({"owner": random_value(&mut rng, 2)}) };
-                let instances = if rng.chance(3) { random_value(&mut rng, 0) } else { json!({format!("{}::Member#m1", domain_name(&domain)): random_value(&mut rng, 2)}) };
-                if let Err(refusal) = check_precondition(&domain, &aggregate, &rule, &args, &instances) {
+                let args = if rng.chance(3) {
+                    random_value(&mut rng, 0)
+                } else {
+                    json!({"owner": random_value(&mut rng, 2)})
+                };
+                let instances = if rng.chance(3) {
+                    random_value(&mut rng, 0)
+                } else {
+                    json!({format!("{}::Member#m1", domain_name(&domain)): random_value(&mut rng, 2)})
+                };
+                if let Err(refusal) =
+                    check_precondition(&domain, &aggregate, &rule, &args, &instances)
+                {
                     envelope_is_structured(&refusal);
                 }
             }
@@ -203,9 +286,12 @@ fn sorting_records_of_mixed_types_never_panics_on_an_inconsistent_order() {
                     })
                     .collect();
                 for descending in [false, true] {
-                    let spec = Some(SortSpec { field: "col".to_string(), descending });
-                    sort_records(&mut records, &spec);
-                    sort_records(&mut records, &None);
+                    let spec = Some(SortSpec {
+                        field: "col".to_string(),
+                        descending,
+                    });
+                    sort_records(&mut records, spec.as_ref());
+                    sort_records(&mut records, None);
                 }
             }
         });
@@ -218,7 +304,7 @@ fn query_arguments_and_sort_params_survive_hostile_input() {
         guarded(&format!("seed {seed}"), move || {
             let mut rng = Rng::new(seed ^ 0x9A);
             let aggregate = client_aggregate();
-            let domain = json!({"name": "Crm", "aggregates": [aggregate.clone()]});
+            let domain = json!({"name": "Crm", "aggregates": [aggregate]});
             for _ in 0..30 {
                 let named = if rng.chance(3) {
                     random_value(&mut rng, 0)
@@ -235,10 +321,22 @@ fn query_arguments_and_sort_params_survive_hostile_input() {
                 params.insert("name".to_string(), random_text(&mut rng));
                 let _ = query_args_from_params(&aggregate, &named, &params);
 
-                let sort: HashMap<String, String> = [("sort", random_text(&mut rng)), ("direction", random_text(&mut rng))].into_iter().map(|(k, v)| (k.to_string(), v)).collect();
+                let sort: HashMap<String, String> = [
+                    ("sort", random_text(&mut rng)),
+                    ("direction", random_text(&mut rng)),
+                ]
+                .into_iter()
+                .map(|(k, v)| (k.to_string(), v))
+                .collect();
                 let config = random_value(&mut rng, 0);
                 let _ = resolve_sort(&domain, &config, "Client", &aggregate, &sort);
-                let _ = resolve_sort(&domain, &json!({}), "Client", &aggregate, &HashMap::from([("sort".to_string(), "__state__".to_string())]));
+                let _ = resolve_sort(
+                    &domain,
+                    &json!({}),
+                    "Client",
+                    &aggregate,
+                    &HashMap::from([("sort".to_string(), "__state__".to_string())]),
+                );
             }
         });
     }