hecks 3.5.0 → 3.6.0

data/lib/hecks/runtime/identity.rb

@@ -50,18 +50,24 @@ module Hecks
         head = head.to_sym
         return nil unless args.key?(head)
 
-        unless rest.empty?
-          held = args[head]
-          held = held.to_h if held.respond_to?(:to_h)
-          # An ID is always a scalar: a caller may pass the carrying field's value directly.
-          return held.to_s unless held.is_a?(Hash)
+        return dotted_scalar(args[head], rest) unless rest.empty?
 
-          return rest.reduce(held) { |h, f| h.is_a?(Hash) ? hash_lookup(h, f) : nil }&.to_s
-        end
+        bare_head(construct, head, args[head], value_owner)
+      end
+
+      # The scalar a dotted path names inside the held value object (or its hash).
+      def dotted_scalar(held, rest)
+        held = held.to_h if held.respond_to?(:to_h)
+        # An ID is always a scalar: a caller may pass the carrying field's value directly.
+        return held.to_s unless held.is_a?(Hash)
+
+        rest.reduce(held) { |h, f| h.is_a?(Hash) ? hash_lookup(h, f) : nil }&.to_s
+      end
 
-        # Coerce only when the caller named the attribute; a saga's key is already resolved.
+      # A bare head's value, coerced only when the caller named the attribute; a saga's key is
+      # already resolved.
+      def bare_head(construct, head, raw, value_owner)
         attribute = construct.identity_heads.include?(head) ? construct.attribute(head) : nil
-        raw       = args[head]
         return raw unless attribute
 
         # Unwrap the coerced value object so `to_s` never leaks an object address into an id.

data/lib/hecks/runtime/instance.rb

@@ -19,18 +19,13 @@ module Hecks
       # `hydrate_with:` replaces the default hydration with a callable that takes the given
       # state and answers the hydrated one (defaults filled), for an adapter that can reuse
       # work across saves.
+      # rubocop:disable-next Metrics/ParameterLists -- the public keyword constructor every caller spells out
       def initialize(aggregate:, id:, state: nil, args: nil, hydrate: true, hydrate_with: nil)
         @aggregate = aggregate
         @id        = id
         # Inside a persistence adapter call this refuses undecoded stored state.
         Ports::Persistence::CodecBoundary.check_state!(aggregate, state) if state
-        @state = if !hydrate
-                   state || self.class.defaults(aggregate)
-                 elsif state
-                   hydrate_with ? hydrate_with.call(state) : self.class.hydrate_with_defaults(aggregate, state)
-                 else
-                   self.class.defaults(aggregate)
-                 end
+        @state   = starting_state(state, hydrate, hydrate_with)
         @version = nil
         materialize_identity!(args)
       end
@@ -104,6 +99,15 @@ module Hecks
 
       private
 
+      # The state this record starts from: the given one (hydrated unless `hydrate` is false) or
+      # the aggregate's defaults.
+      def starting_state(state, hydrate, hydrate_with)
+        return state || self.class.defaults(@aggregate) unless hydrate
+        return self.class.defaults(@aggregate) unless state
+
+        hydrate_with ? hydrate_with.call(state) : self.class.hydrate_with_defaults(@aggregate, state)
+      end
+
       # A composite identity has no single head, so each head is filled from `args`.
       # Never split `@id`: it is a display key and a part's text can contain the separator.
       def materialize_identity!(args = nil)

data/lib/hecks/runtime/interpreting.rb

@@ -38,14 +38,17 @@ module Hecks
       # @param args [Hash{Symbol => Object}] the arguments the caller passed
       # @return [Hash{Symbol => Object}] `args`, with each absent defaulted argument filled
       def fill_defaults(command, args)
-        absent = command.attributes.reject do |attribute|
-          attribute.default.nil? || args.key?(attribute.name.to_sym) || args.key?(attribute.name.to_s)
-        end
+        absent = command.attributes.reject { |attribute| attribute.default.nil? || passed?(args, attribute) }
         return args if absent.empty?
 
         args.merge(absent.to_h { |attribute| [attribute.name.to_sym, attribute.default] })
       end
 
+      # Whether the caller passed `attribute`, under either spelling of its name.
+      def passed?(args, attribute)
+        args.key?(attribute.name.to_sym) || args.key?(attribute.name.to_s)
+      end
+
       # Logged after the step's work, so trace order is completion order.
       def step(name)
         result = yield
@@ -92,14 +95,19 @@ module Hecks
         command.attributes.each_with_object(args.dup) do |attribute, normalized|
           next unless normalized.key?(attribute.name)
 
-          Value.refuse_object_reference(command, attribute, normalized[attribute.name])
-          # A has_many argument mirrors the aggregate's reference list, which words its own refusal.
-          reference_list = aggregate.attribute(attribute.name)&.reference?
-          Value.refuse_scalar_list(command, attribute, normalized[attribute.name]) unless reference_list
-          normalized[attribute.name] = Value.for_attribute(aggregate, attribute, normalized[attribute.name], argument: true)
+          normalized[attribute.name] = coerce_argument(aggregate, command, attribute, normalized[attribute.name])
         end
       end
 
+      # One declared argument through the reference gate, the list gate, then coercion.
+      def coerce_argument(aggregate, command, attribute, value)
+        Value.refuse_object_reference(command, attribute, value)
+        # A has_many argument mirrors the aggregate's reference list, which words its own refusal.
+        reference_list = aggregate.attribute(attribute.name)&.reference?
+        Value.refuse_scalar_list(command, attribute, value) unless reference_list
+        Value.for_attribute(aggregate, attribute, value, argument: true)
+      end
+
       # Coercion only; the unknown/absent-argument refusals are separate dispatch steps.
       def normalize_args(aggregate, command, args)
         coerce_declared_arguments(aggregate, command, args)

data/lib/hecks/runtime/invocation.rb

@@ -1,6 +1,7 @@
 require_relative "errors"
 require_relative "refusal_wording"
 require_relative "routing"
+require_relative "invocation_builder"
 require_relative "../rendering"
 
 module Hecks
@@ -11,6 +12,8 @@ module Hecks
 
     # Adds the fact wrappers and builders for an `Invocation`.
     class Invocation
+      extend InvocationBuilder
+
       # A fact the caller offered with a real (non-nil) value.
       Present = Data.define(:value) do
         def inspect = "#<Invocation::Present #{value.inspect}>"
@@ -68,161 +71,6 @@ module Hecks
           args[name] = found.equal?(Null) ? nil : found.value
         end
       end
-
-      class << self
-        # Builds an Invocation for one of three call shapes (:aggregate,
-        # :entity, :port). Each checks its own parts in a fixed order, because
-        # a malformed call's refusal depends on that order; `declaring` is
-        # called exactly once, at that shape's point in the order below.
-        def from_call(verb, to:, with:, flat:, receiver: :aggregate, entity_depth: 0, aggregate: nil, &declaring)
-          case receiver
-          when :aggregate
-            command = declaring.call
-            facts   = facts_for(command, with: with, flat: flat)
-            new(verb: verb, target: route(to), facts: facts)
-          when :entity
-            target  = route(to, entity_depth: entity_depth)
-            command = declaring.call
-            new(verb: verb, target: target, facts: facts_for(command, with: with, flat: flat))
-          when :port
-            port_call(verb, aggregate, declaring.call, to: to, with: with, flat: flat)
-          else
-            raise ArgumentError, "unknown receiver #{receiver.inspect}"
-          end
-        end
-
-        # `to` as a `Routing::Envelope`, or nil when no `to:` was given.
-        def route(to, entity_depth: 0)
-          return nil if to.nil?
-
-          aggregate, entities = to.is_a?(Hash) ? envelope_hash(to) : scalar_envelope(to)
-
-          raise TypeMismatch, "to: must name the receiving aggregate identity" if aggregate.nil? || aggregate.to_s.empty?
-          if entities.size != entity_depth
-            raise TypeMismatch,
-                  "to: for an entity command needs #{entity_depth} entity " \
-                  "#{entity_depth == 1 ? 'identity' : 'identities'} after the aggregate — got #{entities.size}"
-          end
-          raise TypeMismatch, "to: contains a blank entity identity" if entities.any? do |identity|
-            identity.nil? || identity.to_s.empty?
-          end
-
-          Routing::Envelope.new(aggregate: aggregate, entities: entities)
-        end
-
-        # Every candidate fact for `declaring`, as Absent/Null/Present: offered
-        # keys first in offered order, then remaining declared attributes as Absent.
-        def facts_for(declaring, with:, flat:)
-          offered = offered_facts(declaring, with: with, flat: flat)
-          facts = offered.each_with_object({}) do |(name, value), found|
-            found[name] = value.nil? ? Null : Present.new(value: value)
-          end
-          declaring.attributes.each do |attribute|
-            name = attribute.name.to_sym
-            facts[name] = Absent unless facts.key?(name)
-          end
-          facts
-        end
-
-        private
-
-        # A Reference-typed attribute naming the owning aggregate is routing,
-        # not a fact: lifted out of the flat facts into `to:` when no `to:`
-        # was given. Only `.first` of a composite identity is used — no
-        # domain in the corpus needs more for a port operation.
-        def port_call(verb, aggregate, operation, to:, with:, flat:)
-          flat = flat.dup
-          identity = operation.identity_attribute(aggregate.hecks_name)
-          if to.nil? && identity && flat.key?(identity.name)
-            to = flat.delete(identity.name)
-          elsif to.nil? && operation.to == aggregate.hecks_name
-            identity_name = Array(aggregate.identified_by).first
-            to = flat[identity_name] if identity_name && flat.key?(identity_name)
-          end
-
-          target = route(to)
-          raise TypeMismatch, "#{operation.hecks_name} requires its receiving aggregate in to:" unless target
-
-          new(verb: verb, target: target, facts: facts_for(operation, with: with, flat: flat))
-        end
-
-        # Must be a String, matching Rust's own parity check for `to:` — this
-        # keeps a same-named `to` attribute from being stolen as the
-        # aggregate identity by a flat-facts dispatch.
-        def scalar_envelope(to)
-          return [to, []] if to.is_a?(String)
-
-          raise TypeMismatch, "to: must be a string aggregate identity or an entity route, got #{Rendering.describe(to)}"
-        end
-
-        def envelope_hash(to)
-          hash = to.transform_keys(&:to_sym)
-          unknown = hash.keys - %i[aggregate entity entities]
-          raise TypeMismatch, "to: does not recognize #{unknown.sort.join(', ')}" unless unknown.empty?
-
-          [hash[:aggregate], entity_identities(hash)]
-        end
-
-        # An entity route naming no entity is refused here, unconditionally,
-        # before entity_depth is checked — otherwise a depth-0 (aggregate)
-        # command would let the degenerate `entities: []` Hash slip through.
-        def entity_identities(hash)
-          raise TypeMismatch, "to: takes entity: or entities:, not both" if hash.key?(:entities) && hash.key?(:entity)
-
-          identities = hash.key?(:entities) ? Array(hash[:entities]) : Array(hash[:entity])
-          raise TypeMismatch, "to: entity route requires at least one entity identity" if identities.empty?
-
-          identities
-        end
-
-        # `with:` is deliberately strict: a caller choosing the explicit
-        # envelope cannot smuggle receiver identity back into the payload,
-        # and may not mix it with a flat facts hash. Without `with:`, the
-        # flat facts are taken as-is, unread.
-        def offered_facts(declaring, with:, flat:)
-          if with && !flat.empty?
-            raise TypeMismatch,
-                  "dispatch takes command facts in with:, not both with: and a flat facts hash"
-          end
-
-          return flat unless with
-          raise TypeMismatch, "with: must be a hash of command facts" unless with.is_a?(Hash)
-
-          offered = with.transform_keys(&:to_sym)
-          declared = declaring.attributes.map { |attribute| attribute.name.to_sym }
-          refuse_unknown_facts!(declaring, offered, declared)
-          refuse_absent_facts!(declaring, offered, declared)
-          offered
-        end
-
-        # Unknown before absent — a `with:` that is both still refuses
-        # UnknownArgument first.
-        def refuse_unknown_facts!(declaring, offered, declared)
-          unknown = (offered.keys - declared).sort
-          return if unknown.empty?
-
-          raise UnknownArgument,
-                RefusalWording.render_site("UnknownArgument", "unknown_args",
-                                           command: declaring.hecks_name, unknown: unknown,
-                                           declared: declared)
-        end
-
-        # A fact the command `needs`, and an argument its attribute gives a default, are not absent:
-        # the interpreter fills them before any refusal reads the arguments.
-        def refuse_absent_facts!(declaring, offered, declared)
-          needed = declaring.respond_to?(:needs) ? declaring.needs.map(&:to_sym) : []
-          defaulted = declaring.attributes.select { |attribute| attribute.respond_to?(:default) && !attribute.default.nil? }
-                               .map { |attribute| attribute.name.to_sym }
-          absent = declaring.attributes.reject(&:optional?).map { |attribute| attribute.name.to_sym } -
-                   offered.keys - needed - defaulted
-          return if absent.empty?
-
-          raise AbsentArgument,
-                RefusalWording.render_site("AbsentArgument", "absent_args",
-                                           command: declaring.hecks_name, absent: absent,
-                                           declared: declared)
-        end
-      end
     end
   end
 end

data/lib/hecks/runtime/invocation_builder.rb

@@ -0,0 +1,132 @@
+require_relative "errors"
+require_relative "routing"
+require_relative "invocation_facts"
+require_relative "../rendering"
+
+module Hecks
+  module Runtime
+    # Builds an Invocation from the shapes a caller can dispatch: the receiver, the offered
+    # facts, and the command or operation that declares them. Extended onto {Invocation}.
+    module InvocationBuilder
+      include InvocationFacts
+
+      # What one `from_call` was asked for, handed to the builder for its receiver shape.
+      Call = Struct.new(:verb, :to, :with, :flat, :entity_depth, :aggregate, :declaring)
+      private_constant :Call
+
+      # Builds an Invocation for one of three call shapes (:aggregate,
+      # :entity, :port). Each checks its own parts in a fixed order, because
+      # a malformed call's refusal depends on that order; `declaring` is
+      # called exactly once, at that shape's point in the order below.
+      # rubocop:disable-next Metrics/ParameterLists -- the public keyword door every dispatch calls
+      def from_call(verb, to:, with:, flat:, receiver: :aggregate, entity_depth: 0, aggregate: nil, &declaring)
+        call = Call.new(verb, to, with, flat, entity_depth, aggregate, declaring)
+        case receiver
+        when :aggregate then aggregate_call(call)
+        when :entity then entity_call(call)
+        when :port then port_call(call)
+        else
+          raise ArgumentError, "unknown receiver #{receiver.inspect}"
+        end
+      end
+
+      # `to` as a `Routing::Envelope`, or nil when no `to:` was given.
+      def route(to, entity_depth: 0)
+        return nil if to.nil?
+
+        aggregate, entities = to.is_a?(Hash) ? envelope_hash(to) : scalar_envelope(to)
+
+        refuse_malformed_route!(aggregate, entities, entity_depth)
+        Routing::Envelope.new(aggregate: aggregate, entities: entities)
+      end
+
+      private
+
+      def aggregate_call(call)
+        command = call.declaring.call
+        facts   = facts_for(command, with: call.with, flat: call.flat)
+        new(verb: call.verb, target: route(call.to), facts: facts)
+      end
+
+      def entity_call(call)
+        target  = route(call.to, entity_depth: call.entity_depth)
+        command = call.declaring.call
+        new(verb: call.verb, target: target, facts: facts_for(command, with: call.with, flat: call.flat))
+      end
+
+      def port_call(call)
+        operation = call.declaring.call
+        flat      = call.flat.dup
+        target    = route(port_receiver(operation, call.aggregate, call.to, flat))
+        raise TypeMismatch, "#{operation.hecks_name} requires its receiving aggregate in to:" unless target
+
+        new(verb: call.verb, target: target, facts: facts_for(operation, with: call.with, flat: flat))
+      end
+
+      # A Reference-typed attribute naming the owning aggregate is routing,
+      # not a fact: lifted out of the flat facts into `to:` when no `to:`
+      # was given. Only `.first` of a composite identity is used — no
+      # domain in the corpus needs more for a port operation.
+      def port_receiver(operation, aggregate, to, flat)
+        return to unless to.nil?
+
+        identity = operation.identity_attribute(aggregate.hecks_name)
+        return flat.delete(identity.name) if identity && flat.key?(identity.name)
+        return to unless operation.to == aggregate.hecks_name
+
+        head_identity(aggregate, flat)
+      end
+
+      def head_identity(aggregate, flat)
+        identity_name = Array(aggregate.identified_by).first
+        flat[identity_name] if identity_name && flat.key?(identity_name)
+      end
+
+      def refuse_malformed_route!(aggregate, entities, entity_depth)
+        raise TypeMismatch, "to: must name the receiving aggregate identity" if aggregate.nil? || aggregate.to_s.empty?
+
+        refuse_wrong_depth!(entities, entity_depth)
+        return unless entities.any? { |identity| identity.nil? || identity.to_s.empty? }
+
+        raise TypeMismatch, "to: contains a blank entity identity"
+      end
+
+      def refuse_wrong_depth!(entities, entity_depth)
+        return if entities.size == entity_depth
+
+        raise TypeMismatch,
+              "to: for an entity command needs #{entity_depth} entity " \
+              "#{entity_depth == 1 ? "identity" : "identities"} after the aggregate — got #{entities.size}"
+      end
+
+      # Must be a String, matching Rust's own parity check for `to:` — this
+      # keeps a same-named `to` attribute from being stolen as the
+      # aggregate identity by a flat-facts dispatch.
+      def scalar_envelope(to)
+        return [to, []] if to.is_a?(String)
+
+        raise TypeMismatch, "to: must be a string aggregate identity or an entity route, got #{Rendering.describe(to)}"
+      end
+
+      def envelope_hash(to)
+        hash = to.transform_keys(&:to_sym)
+        unknown = hash.keys - %i[aggregate entity entities]
+        raise TypeMismatch, "to: does not recognize #{unknown.sort.join(", ")}" unless unknown.empty?
+
+        [hash[:aggregate], entity_identities(hash)]
+      end
+
+      # An entity route naming no entity is refused here, unconditionally,
+      # before entity_depth is checked — otherwise a depth-0 (aggregate)
+      # command would let the degenerate `entities: []` Hash slip through.
+      def entity_identities(hash)
+        raise TypeMismatch, "to: takes entity: or entities:, not both" if hash.key?(:entities) && hash.key?(:entity)
+
+        identities = hash.key?(:entities) ? Array(hash[:entities]) : Array(hash[:entity])
+        raise TypeMismatch, "to: entity route requires at least one entity identity" if identities.empty?
+
+        identities
+      end
+    end
+  end
+end

data/lib/hecks/runtime/invocation_facts.rb

@@ -0,0 +1,87 @@
+require_relative "errors"
+require_relative "refusal_wording"
+
+module Hecks
+  module Runtime
+    # How an Invocation reads the facts a caller offered: through `with:` or a flat Hash, checked
+    # against what the command declares. Mixed into {InvocationBuilder}.
+    module InvocationFacts
+      # Every candidate fact for `declaring`, as Absent/Null/Present: offered
+      # keys first in offered order, then remaining declared attributes as Absent.
+      def facts_for(declaring, with:, flat:)
+        offered = offered_facts(declaring, with: with, flat: flat)
+        facts = offered.each_with_object({}) do |(name, value), found|
+          found[name] = value.nil? ? Invocation::Null : Invocation::Present.new(value: value)
+        end
+        declaring.attributes.each do |attribute|
+          name = attribute.name.to_sym
+          facts[name] = Invocation::Absent unless facts.key?(name)
+        end
+        facts
+      end
+
+      private
+
+      # `with:` is deliberately strict: a caller choosing the explicit
+      # envelope cannot smuggle receiver identity back into the payload,
+      # and may not mix it with a flat facts hash. Without `with:`, the
+      # flat facts are taken as-is, unread.
+      def offered_facts(declaring, with:, flat:)
+        refuse_mixed_facts!(with, flat)
+
+        return flat unless with
+        raise TypeMismatch, "with: must be a hash of command facts" unless with.is_a?(Hash)
+
+        offered = with.transform_keys(&:to_sym)
+        declared = declaring.attributes.map { |attribute| attribute.name.to_sym }
+        refuse_unknown_facts!(declaring, offered, declared)
+        refuse_absent_facts!(declaring, offered, declared)
+        offered
+      end
+
+      def refuse_mixed_facts!(with, flat)
+        return unless with && !flat.empty?
+
+        raise TypeMismatch,
+              "dispatch takes command facts in with:, not both with: and a flat facts hash"
+      end
+
+      # Unknown before absent — a `with:` that is both still refuses
+      # UnknownArgument first.
+      def refuse_unknown_facts!(declaring, offered, declared)
+        unknown = (offered.keys - declared).sort
+        return if unknown.empty?
+
+        raise UnknownArgument,
+              RefusalWording.render_site("UnknownArgument", "unknown_args",
+                                         command: declaring.hecks_name, unknown: unknown,
+                                         declared: declared)
+      end
+
+      # A fact the command `needs`, and an argument its attribute gives a default, are not absent:
+      # the interpreter fills them before any refusal reads the arguments.
+      def refuse_absent_facts!(declaring, offered, declared)
+        absent = required_fact_names(declaring) - offered.keys - filled_fact_names(declaring)
+        return if absent.empty?
+
+        raise AbsentArgument,
+              RefusalWording.render_site("AbsentArgument", "absent_args",
+                                         command: declaring.hecks_name, absent: absent,
+                                         declared: declared)
+      end
+
+      def required_fact_names(declaring)
+        declaring.attributes.reject(&:optional?).map { |attribute| attribute.name.to_sym }
+      end
+
+      # The facts the interpreter fills in itself: those the command `needs` and those whose
+      # attribute declares a default.
+      def filled_fact_names(declaring)
+        needed = declaring.respond_to?(:needs) ? declaring.needs.map(&:to_sym) : []
+        defaulted = declaring.attributes.select { |attribute| attribute.respond_to?(:default) && !attribute.default.nil? }
+                             .map { |attribute| attribute.name.to_sym }
+        needed + defaulted
+      end
+    end
+  end
+end

data/lib/hecks/runtime/loader/boot_steps.rb

@@ -0,0 +1,96 @@
+require_relative "../errors"
+require_relative "../boot_gates"
+require_relative "../../ports/persistence"
+
+module Hecks
+  module Runtime
+    class Loader
+      # The steps a boot takes between loading a domain's files and binding its dispatcher: the
+      # boot gates, the adapters a bind names, and the privacy markings to dispatch. Extended onto
+      # {Loader}, whose class methods these become.
+      module BootSteps
+        # Turns every `.hecksagon`-declared `mark_sensitive` fact into a real
+        # `Privacy::Marking.Mark`. Idempotent across reboots — a marking already
+        # present is never re-dispatched. A no-op when nothing declared one, or
+        # the domain never attached Privacy at all.
+        def seed_privacy_markings!(dispatcher, registry)
+          return if registry.pending_privacy_markings.empty?
+          return unless registry.bluebook("Privacy")
+
+          already_marked = already_marked_by_domain(dispatcher, registry)
+          registry.pending_privacy_markings.each do |marking|
+            next if already_marked[marking[:domain]].include?(marking[:attribute_path])
+
+            dispatcher.dispatch_flat("Privacy::Marking.Mark", marking)
+          end
+        end
+
+        # Each domain with a pending marking, with the attribute paths Privacy already marks for it.
+        def already_marked_by_domain(dispatcher, registry)
+          registry.pending_privacy_markings.map { |marking| marking[:domain] }.uniq.to_h do |domain|
+            [domain, dispatcher.query("Privacy::Marking.ForDomain", domain: domain).map { |row| row[:attribute_path][:value] }]
+          end
+        end
+
+        # Runs every registered boot gate against `registry`, in order:
+        # era-checking (if a plugin contributes one) before `verify!`, saga
+        # rehydration after. No era-specific class is named here — each loaded
+        # persistence plugin contributes its own gates generically (ADR 0031).
+        def run_boot_gates!(registry, directory)
+          gates = BootGates.new
+          load_bound_adapters!(registry)
+          Ports::Persistence.each_plugin { |plugin| plugin.contribute_boot_gates(registry, gates) }
+          check_compute_rules_backstop!(registry)
+
+          gates.run!(:pre_verify, registry, directory)
+          registry.verify!
+
+          gates.register(:saga_rehydration, ->(reg, _dir) { reg.rehydrate_sagas! }, phase: :post_verify) if
+            registry.saga_domains.any? { |domain| registry.saga_persistence(domain) != Ports::Persistence::NULL_SAGA_STORE }
+          gates.run!(:post_verify, registry, directory)
+          gates
+        end
+
+        # Resolves the Ruby implementation of every adapter a hecksagon binds, and of every
+        # `default_adapter` a world names (a chapter that binds nothing takes its world's).
+        # An adapter's implementation can register its own persistence plugin as
+        # a side effect of loading (e.g. `PostgresEra`) — resolving here, before
+        # gates are collected, is what registers those plugins' gates without
+        # the app requiring them itself. A bind with no implementation is left
+        # for `verify!` to refuse.
+        def load_bound_adapters!(registry)
+          bound   = registry.hecksagons.each_value.flat_map { |hecksagon| hecksagon.binds.map(&:adapter) }
+          default = registry.worlds.each_value.filter_map(&:default_adapter)
+          (bound + default).each { |name| load_adapter(registry, name) }
+        end
+
+        # A backstop only: fires when a translation declares a `computes`/
+        # `rekeys` rule but no persistence plugin is loaded to interpret it.
+        # Any loaded plugin's own compute-rules gate refuses earlier, by name,
+        # whenever one is loaded — this only runs when nothing was.
+        def check_compute_rules_backstop!(registry)
+          return if Ports::Persistence.plugins_loaded?
+
+          registry.translations.each do |translation|
+            translation.aggregates.each do |aggregate|
+              next if aggregate.computes.empty? && aggregate.rekeys.empty?
+
+              raise WiringError,
+                    "cannot boot #{translation.domain}::#{aggregate.name}: a compute/rekey rule is declared, but no " \
+                    "persistence plugin that can interpret it is loaded (e.g. require " \
+                    "\"hecks/ports/persistence/plugins/era\")"
+            end
+          end
+        end
+
+        private
+
+        def load_adapter(registry, name)
+          registry.adapter_class(name)
+        rescue WiringError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/hecks/runtime/loader/described.rb

@@ -0,0 +1,27 @@
+module Hecks
+  module Runtime
+    class Loader
+      # What `describe` answers: the loaded declarations and nothing bound to run them.
+      #
+      # The declarations load the first time `registry` is asked for, not when `describe` returns,
+      # so a caller that can answer from `directory` alone (a launcher with its help already
+      # remembered) never pays for the load. The directory is checked at once.
+      class Described
+        # @return [String] the domain directory that was described
+        attr_reader :directory
+
+        # @param directory [String] the domain directory
+        # @yield loads the declarations; answers the registry
+        def initialize(directory, &load)
+          @directory = directory
+          @load = load
+        end
+
+        # @return [Registry] the declarations, loaded on first use
+        def registry
+          @registry ||= @load.call
+        end
+      end
+    end
+  end
+end