hecks 3.9.1 → 3.11.0

data/lib/hecks/bluebook/model_check.rb

@@ -4,6 +4,8 @@ require_relative "model_check/client_profile"
 require_relative "model_check/lifecycle_checks"
 require_relative "model_check/saga_checks"
 require_relative "model_check/policy_checks"
+require_relative "model_check/ask_checks"
+require_relative "model_check/reference_checks"
 require_relative "model_check/verbs"
 
 module Hecks
@@ -32,6 +34,8 @@ module Hecks
       extend LifecycleChecks
       extend SagaChecks
       extend PolicyChecks
+      extend AskChecks
+      extend ReferenceChecks
       extend Verbs
 
       module_function
@@ -59,15 +63,17 @@ module Hecks
         findings
       end
 
-      # Lifecycles, sagas and policies: what the model says about itself.
+      # Lifecycles, sagas, policies and references: what the model says about itself.
       def modelled_findings(bluebook, options)
         [
           *bluebook.aggregates.flat_map { |aggregate| aggregate_lifecycle_findings(aggregate) },
+          *key_by_value_findings(bluebook),
           *bluebook.process_managers.flat_map { |process_manager| saga_findings(bluebook, process_manager) },
           *bluebook.policies.flat_map do |policy|
             policy_findings(bluebook, policy, options[:hecksagon], options[:known_domains],
                             options[:global_emitted_events])
-          end
+          end,
+          *unused_ask_findings(bluebook)
         ]
       end
 

data/lib/hecks/bluebook/policy.rb

@@ -13,6 +13,7 @@ module Hecks
         name:               :name,
         on_event:           :on_event,
         trigger_command:    :trigger_command,
+        ask:                :ask,
         target_domain:      :target_domain,
         expect_undelivered: :expect_undelivered,
         where:              :where,
@@ -21,17 +22,18 @@ module Hecks
         where_ast:          -> { where_ast }
       )
 
-      attr_reader :name, :on_event, :trigger_command, :target_domain, :expect_undelivered, :where, :for_each, :with_spec
+      attr_reader :name, :on_event, :trigger_command, :ask, :target_domain, :expect_undelivered, :where, :for_each, :with_spec
 
       # Aggregate, declared and deliberately off the wire
       # the wire format is a pinned contract, and it does not carry
       # where a policy was written before the builder hoisted it
       attr_accessor :aggregate
 
-      def initialize(name:, on_event: nil, trigger_command: nil, target_domain: nil, expect_undelivered: false, where: nil, for_each: nil, with_spec: [], aggregate: nil)
+      def initialize(name:, on_event: nil, trigger_command: nil, ask: nil, target_domain: nil, expect_undelivered: false, where: nil, for_each: nil, with_spec: [], aggregate: nil)
         @name = name.to_s
         @on_event = on_event
         @trigger_command = trigger_command
+        @ask = ask
         @target_domain = target_domain
         @expect_undelivered = expect_undelivered.to_s == "true"
         @where = where

data/lib/hecks/bluebook/smoke_test.rb

@@ -27,7 +27,7 @@ module Hecks
       def call(dir)
         Dir.mktmpdir("hecks-smoke-") do |scratch|
           isolate!(dir, scratch)
-          dispatcher = Hecks.boot(scratch, install_doors: false)
+          dispatcher = Hecks.boot(scratch, install_driving: false)
           domain     = dispatcher.registry.bluebooks.keys.first
           next [] unless domain
 

data/lib/hecks/bluebook/synthesizer.rb

@@ -1,3 +1,5 @@
+require_relative "attribute"
+
 module Hecks
   module Bluebook
     # Synthesizes one argument per declared attribute from the IR: fixed markers for scalars,

data/lib/hecks/bluebook.rb

@@ -25,6 +25,7 @@ require_relative "bluebook/read_model"
 require_relative "bluebook/entity"
 require_relative "bluebook/domain_port"
 require_relative "bluebook/policy"
+require_relative "bluebook/ask_resolution"
 require_relative "bluebook/process_manager"
 require_relative "bluebook/aggregate"
 require_relative "bluebook/hecksagon"

data/lib/hecks/cli/command_table.rb

@@ -62,7 +62,7 @@ module Hecks
         ->(argv, program, _name) { ProjectCli.call(argv, program: program, root: Dir.pwd, remove_stale_bin: false) }
       ),
       "mcp"              => Command.new(
-        "Serve the MCP door over stdio (no authentication; stdio only).",
+        "Serve the MCP server over stdio (no authentication; stdio only).",
         "hecks mcp [--stdio]",
         "cli/mcp",
         ->(argv, _program, _name) { Mcp.call(argv) }

data/lib/hecks/cli/console.rb

@@ -7,7 +7,8 @@ require_relative "../ports/persistence/plugins/era"
 module Hecks
   module CLI
     # The command behind `hecks console` and Custodian's `Operation.OpenConsole`: boots a domain
-    # (pizzas on Memory by default) and drops into IRB with its door installed, for dispatching a
+    # (pizzas on Memory by default) and drops into IRB with its Ruby adapter installed, for
+    # dispatching a
     # real command by hand. No argument needs no database (ADR 0073); a domain directory boots as
     # it is wired, which may bind PostgresEra (examples/directory does).
     module Console

data/lib/hecks/cli/document.rb

@@ -44,7 +44,7 @@ module Hecks
       # @api private
       def boot_bluebook(path)
         begin
-          runtime = Hecks.boot(path, install_doors: false)
+          runtime = Hecks.boot(path, install_driving: false)
         rescue StandardError => e
           abort "cannot read #{path}: #{e.message.lines.first.strip}"
         end

data/lib/hecks/cli/launcher_words.rb

@@ -57,7 +57,7 @@ module Hecks
       def launcher_words(name, rest)
         return [rest, nil] if UNTOUCHED.include?(name)
 
-        require_relative "../doors/cli_door"
+        require_relative "../adapters/driving/cli"
         words = strip_generic(rest)
         form  = LAUNCHER_FORMS[name]
         return [words, nil] unless form && words.any? { |word| word.match?(NAME_VALUE) }
@@ -133,7 +133,7 @@ module Hecks
 
       # @api private
       def add_flag(key, value, extra)
-        extra << "--#{key.tr("_", "-")}" if Doors::CliDoor.boolean(value)
+        extra << "--#{key.tr("_", "-")}" if Adapters::Driving::Cli.boolean(value)
         nil
       end
 
@@ -153,7 +153,7 @@ module Hecks
           flag, value = word.split("=", 2)
           next kept << word unless GENERIC_FLAGS.include?(flag)
 
-          Doors::CliDoor.boolean(value || generic_value(queue))
+          Adapters::Driving::Cli.boolean(value || generic_value(queue))
         end
         kept
       end
@@ -161,7 +161,7 @@ module Hecks
       # The Boolean word that follows a generic flag, or "true" when none does.
       # @api private
       def generic_value(queue)
-        Doors::CliDoor::BOOLEAN_WORDS.key?(queue.first.to_s.downcase) ? queue.shift : "true"
+        Adapters::Driving::Cli::BOOLEAN_WORDS.key?(queue.first.to_s.downcase) ? queue.shift : "true"
       end
     end
   end

data/lib/hecks/cli/mcp.rb

@@ -2,14 +2,14 @@ require_relative "../mcp_stdio_guard"
 
 module Hecks
   module CLI
-    # The command behind `hecks mcp`: the MCP door onto the
+    # The command behind `hecks mcp`: the MCP server onto the
     # storehouse bus, over stdio only.
     #
     # This file loads nothing but `McpStdioGuard`, so the transport check runs
     # before the framework does.
     module Mcp
       # The server name the guard's refusals and warnings carry.
-      SERVER = "hecks-mcp-door".freeze
+      SERVER = "hecks-mcp".freeze
 
       module_function
 
@@ -23,8 +23,8 @@ module Hecks
       #   set up for stdio
       def call(argv)
         McpStdioGuard.enforce_stdio!(server: SERVER, argv: argv)
-        require_relative "../doors/mcp_door"
-        Doors::McpDoor.serve
+        require_relative "../adapters/driving/mcp"
+        Adapters::Driving::Mcp.serve
       end
     end
   end

data/lib/hecks/cli/project_cli/launcher_source.rb

@@ -126,8 +126,8 @@ module Hecks
         # @api private
         # @return [String] the opted-in launcher's middle
         def described_entry(name, boot, shown, quiet: false)
-          started = "Hecks.boot_described(described, install_doors: false)"
-          started = "Hecks::Doors::LauncherOptions.quietly(hold: #{RUNS_ON_MEMORY}) { #{started} }" if quiet
+          started = "Hecks.boot_described(described, install_driving: false)"
+          started = "Hecks::Adapters::Driving::LauncherOptions.quietly(hold: #{RUNS_ON_MEMORY}) { #{started} }" if quiet
           render(DESCRIBED_ENTRY, boot: boot, shown: shown, name: name, started: started).chomp
         end
 

data/lib/hecks/cli/project_cli/templates.rb

@@ -38,7 +38,7 @@ module Hecks
             abort "cannot open {{name}}: #{e.message.lines.first.strip}"
           end
 
-          text, status, reason = Hecks::Doors::CliRunner.usage(
+          text, status, reason = Hecks::Adapters::Driving::CliRunner.usage(
             runtime: described, argv: ARGV, program: program
           )
           unless text
@@ -48,9 +48,9 @@ module Hecks
               abort "cannot open {{name}}: #{e.message.lines.first.strip}"
             end
             # A question the world lists under `streams`, given `--stream`, tails until interrupted.
-            streamed = Hecks::Doors::CliRunner.stream(runtime: runtime, argv: ARGV, program: program)
+            streamed = Hecks::Adapters::Driving::CliRunner.stream(runtime: runtime, argv: ARGV, program: program)
             exit streamed unless streamed.nil?
-            text, status, reason = Hecks::Doors::CliRunner.call(
+            text, status, reason = Hecks::Adapters::Driving::CliRunner.call(
               runtime: runtime, argv: ARGV, program: program
             )
           end
@@ -59,12 +59,12 @@ module Hecks
         # The middle every launcher had before opted-in ones answered usage alone.
         PLAIN_ENTRY = <<~'RUBY'.freeze
           runtime = begin
-            Hecks.boot({{boot}}, install_doors: false)
+            Hecks.boot({{boot}}, install_driving: false)
           rescue StandardError => e
             abort "cannot open {{name}}: #{e.message.lines.first.strip}"
           end
 
-          text, status = Hecks::Doors::CliRunner.call(
+          text, status = Hecks::Adapters::Driving::CliRunner.call(
             runtime: runtime, argv: ARGV, program: "{{shown}}"
           )
         RUBY

data/lib/hecks/cli/project_cli.rb

@@ -9,12 +9,15 @@ module Hecks
     # `Hecks.bluebook "QualityControl"` in `qa/` becomes `qa/quality_control`.
     #
     # Each launcher is a dozen lines pinning one directory and handing over to
-    # `Doors::CliRunner`; the surface itself is projected at the moment it runs,
+    # `Adapters::Driving::CliRunner`; the surface itself is projected at the moment it runs,
     # so editing a chapter changes behaviour without regenerating anything.
     #
     # A chapter whose world's `launcher` setting names an `executable` gets its launcher
     # there instead: the Hecks chapter's is the gem's `exe/hecks`.
     module ProjectCli
+      # Raised when the project loads no bluebook.
+      class Error < RuntimeError; end
+
       # Build output and other trees under a root that hold no domain a caller means.
       IGNORED = %r{\A(rust|deploy|tmp|coverage)/}
 
@@ -34,7 +37,7 @@ module Hecks
       # @param argv [Array<String>] domain paths under `root`, and optionally `--check`
       # @param program [String] how the caller was invoked, named in a launcher's header
       # @param root [String] the directory launchers are written under
-      # @param remove_stale_bin [Boolean] delete `root/bin/<name>`, a second front door
+      # @param remove_stale_bin [Boolean] delete `root/bin/<name>`, a second entry point
       # @return [void]
       # @raise [SystemExit] with status 1 for a launcher out of date, an unreadable domain, a
       #   path outside `root` or an unknown flag
@@ -88,9 +91,9 @@ module Hecks
       #   when `check` found it out of date, `:failed` when the domain could not be read or its
       #   launcher could not be made
       def one(root, path, program, check, remove_stale_bin)
-        runtime = Hecks.boot(File.join(root, path), install_doors: false)
-        name    = runtime.registry.bluebooks.keys.first or raise "it loads no bluebook"
-        setting = Doors::LauncherOptions.settings(runtime, name) || {}
+        runtime = Hecks.boot(File.join(root, path), install_driving: false)
+        name    = runtime.registry.bluebooks.keys.first or raise Error, "it loads no bluebook"
+        setting = Adapters::Driving::LauncherOptions.settings(runtime, name) || {}
         settle(launcher_target(name, path, setting, root, program), path, root, check, remove_stale_bin)
       rescue StandardError, LoadError => e
         refuse(path, "cannot boot — #{e.message.lines.first.to_s.strip}")
@@ -122,7 +125,7 @@ module Hecks
         Target.new(name, label, File.join(root, label), text, snake, executable)
       end
 
-      # Writes the launcher, makes it executable, and removes the second front door in `bin/`.
+      # Writes the launcher, makes it executable, and removes the second entry point in `bin/`.
       #
       # @api private
       def write_launcher(target, root, remove_stale_bin)

data/lib/hecks/cli/run.rb

@@ -68,8 +68,8 @@ module Hecks
       # near miss deserves the runner's "did you mean" rather than the step-list
       # form's "no such script".
       def cli_form(domain, argv, program)
-        runtime = Hecks.boot(domain, install_doors: false)
-        text, status = Doors::CliRunner.call(runtime: runtime, argv: argv, program: program)
+        runtime = Hecks.boot(domain, install_driving: false)
+        text, status = Adapters::Driving::CliRunner.call(runtime: runtime, argv: argv, program: program)
         status.zero? ? puts(text) : abort(text)
         exit 0
       end

data/lib/hecks/cli/smoke_http/checks.rb

@@ -46,7 +46,10 @@ module Hecks
             before = state
             expect_success(post(payload, signed_headers))
             after = state
-            raise "the state changed on a repeated delivery:\n    before #{before}\n    after  #{after}" unless before == after
+            unless before == after
+              raise Failure,
+                    "the state changed on a repeated delivery:\n    before #{before}\n    after  #{after}"
+            end
           end
         end
 

data/lib/hecks/cli/smoke_http/transport.rb

@@ -29,15 +29,15 @@ module Hecks
         end
 
         def expect_status(res, code)
-          raise "expected #{code}, got #{res.code}" unless res.code.to_i == code
+          raise Failure, "expected #{code}, got #{res.code}" unless res.code.to_i == code
         end
 
         def expect_success(res)
-          raise "expected 2xx, got #{res.code}: #{res.body.to_s[0, 200]}" unless res.code.to_i.between?(200, 299)
+          raise Failure, "expected 2xx, got #{res.code}: #{res.body.to_s[0, 200]}" unless res.code.to_i.between?(200, 299)
         end
 
         def expect_refused(res)
-          raise "expected a 4xx refusal, got #{res.code}" unless res.code.to_i.between?(400, 499)
+          raise Failure, "expected a 4xx refusal, got #{res.code}" unless res.code.to_i.between?(400, 499)
         end
       end
     end

data/lib/hecks/cli/smoke_http.rb

@@ -12,6 +12,9 @@ module Hecks
   module CLI
     # One run of the checks against one service.
     class SmokeHttp
+      # Raised when a smoke check's request gets an answer other than the one it expects.
+      class Failure < RuntimeError; end
+
       include Checks
       include Transport
       extend Settings

data/lib/hecks/codemod.rb

@@ -6,6 +6,9 @@ module Hecks
   # Shared machinery for a codemod that migrates real `.bluebook` source: boot,
   # find candidates, edit, then verify by diffing the re-booted IR before keeping it.
   module Codemod
+    # Raised when a shadow cannot be built from the construct.
+    class Error < RuntimeError; end
+
     ROOT = File.expand_path("../..", __dir__)
 
     EXAMPLE_ROOTS = Corpus.members(:example, root: ROOT).map(&:path)
@@ -155,8 +158,8 @@ module Hecks
 
       matches = element_candidates(construct).select { |c| c.hecks_name.to_s == list_attr.type.to_s }
       if matches.size > 1
-        raise "#{construct.hecks_name}##{list_field} names #{list_attr.type}, held by both a value " \
-              "object and an entity — ambiguous, cannot resolve which one the list holds"
+        raise Error, "#{construct.hecks_name}##{list_field} names #{list_attr.type}, held by both a value " \
+                     "object and an entity — ambiguous, cannot resolve which one the list holds"
       end
 
       matches.first

data/lib/hecks/corpus/routes.rb

@@ -24,9 +24,16 @@ module Hecks
                 "its filename declares (bump_* / same_*)"),
       Route.new(%r{\Aspec/fixtures/model_check/}, :named_in, "spec/model_check_spec.rb", :each_file,
                 "domains broken on purpose; each must produce exactly the finding kinds it is built to trigger"),
+      Route.new(%r{\Aspec/fixtures/site/editor_chapters/domain/}, :named_in, "spec/site_cms_editor_chapters_spec.rb",
+                "site/editor_chapters",
+                "two chapters that both declare a Category, so the editor must tell them apart; one SQLite " \
+                "file keeps tables by bare aggregate name, which cannot hold both, so the sweep cannot boot it"),
       # hecks fuzz sweeps it too, once Fuzzing::Replay coerces value-object args
       # before recomputing givens — today it doesn't, so this given reads as
       # wrongly admitted.
+      Route.new(%r{\Aspec/corpus/asks/}, :named_in, "spec/policy_ask_spec.rb", "spec/corpus/asks",
+                "a corpus-owned domain whose ports have no adapter, so an ask is refused; its frozen " \
+                "targets are held to the Ruby runtime there and to the Rust policy table in rust/codegen"),
       Route.new(%r{\Aspec/fixtures/rust_host/}, :named_in, "rust/host/src/web/commerce.rs", "checkout_fixture",
                 "the Rust host's checkout fixture, pinned by its web and /api tests")
     ].freeze

data/lib/hecks/corpus/rust.rb

@@ -184,9 +184,10 @@ module Hecks
       # domain wins Cargo's `default` is derived, not hand-picked.
       #
       # @param root [String] repository root to search under
-      # @return [Array<RustDomain>] already-generated Rust domains, in regeneration order
+      # @return [Array<RustDomain>] every Rust domain with a Cargo feature, in regeneration order:
+      #   a fresh checkout has no generated output, so the sources, not the output, name them
       def rust_regen_order(root: ROOT)
-        rust_domains(root: root).select { |domain| generated?(domain.feature, root: root) }
+        rust_domains(root: root)
       end
     end
   end

data/lib/hecks/deploy/bluebook/deploy.bluebook

@@ -445,6 +445,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "refused"
       transition "Reprovision" => "requested",   from: %w[provisioned refused]
       transition "Complete"    => "provisioned", from: "requested"
       transition "Abandon"     => "refused",     from: "requested"
@@ -602,6 +603,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
       transition "Complete" => "projected", from: "requested"
       transition "Fault"    => "faulted",   from: "requested"
     end
@@ -680,6 +682,113 @@ Hecks.bluebook "Deploy" do
     trigger Recipe::Fault, with: { refusal: :refusal }
   end
 
+  aggregate "Handover" do
+    description "One clearing of a domain's deployment settings: the body of every deployed_to block in its .world emptied, so a project handed to a client holds none of the host's own region, stacks, secrets or domain."
+
+    attribute :domain,  DomainPath
+    attribute :run,     RunKey
+    attribute :out,     Location, optional: true
+    attribute :output,  Report,   optional: true
+    attribute :refusal, Report,   optional: true
+    identified_by :run
+
+    value_object "RunKey" do
+      attribute :value, String, pattern: '[^ \t\n\r]'
+
+      invariant("a run is named") { !value.to_s.empty? }
+    end
+
+    # A domain directory, whose `bluebook/` holds the `.world` that declares `deployed_to`.
+    value_object "DomainPath" do
+      attribute :value, String, pattern: '[^\t\n\r]'
+
+      invariant("a domain is named by its path") { !value.to_s.empty? }
+    end
+
+    # A directory the cleared worlds are written to, at their paths below `bluebook/`, instead of
+    # over the originals.
+    value_object "Location" do
+      attribute :value, String, pattern: '[^\t\n\r]'
+    end
+
+    value_object "Report" do
+      attribute :value, String
+    end
+
+    lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
+      transition "Complete" => "cleared", from: "requested"
+      transition "Fault"    => "faulted", from: "requested"
+    end
+
+    # `hecks deploy handover.clear <domain> [out=]`. The rest of the file is left as it was, a world
+    # with nothing to clear is answered as cleared with nothing removed, and a domain with no
+    # `.world` file is faulted with the sentence saying so.
+    command "Clear" do
+      goal "Empty the body of every deployed_to block in a domain's .world, keeping the settings' names in a comment"
+
+      attribute :domain, DomainPath
+      attribute :run,    RunKey
+      attribute :out,    Location, optional: true
+
+      sets :domain
+      sets :run
+      sets :out
+
+      emits "ClearingRequested"
+    end
+
+    command "Complete" do
+      goal "Record that the deployment settings were cleared, from which file and which settings"
+
+      reference_to Handover
+      attribute :output, Report
+
+      sets :output
+
+      emits "DeploymentCleared"
+    end
+
+    command "Fault" do
+      goal "Record that the deployment settings could not be cleared, and why"
+
+      reference_to Handover
+      attribute :refusal, Report
+
+      sets :refusal
+
+      emits "ClearingFaulted"
+    end
+
+    query "Outcome" do
+      description "What one clearing did: its status, and the file and settings removed or the reason it stopped."
+      attribute :run, RunKey
+      where(run: :run)
+      order_by :run
+    end
+
+    query "Faulted" do
+      description "Every clearing that could not be done."
+      where(status: "faulted")
+      order_by :run
+    end
+  end
+
+  policy "ClearWhenRequested" do
+    on      "Handover.ClearingRequested"
+    trigger Handover::DeployToolchain::ClearDeployment, with: { run: :run }
+  end
+
+  policy "RecordTheClearing" do
+    on      "Handover.HandoverAnswered"
+    trigger Handover::Complete, with: { output: :output }
+  end
+
+  policy "RecordTheFaultedClearing" do
+    on      "Handover.HandoverRefused"
+    trigger Handover::Fault, with: { refusal: :refusal }
+  end
+
   aggregate "MakefileCheck" do
     description "One lint of generated deploy Makefiles for prod-touching recipes that hide failure."
 
@@ -705,6 +814,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Pass" => "clean",   from: "requested"
       transition "Flag" => "flagged", from: "requested"
     end
@@ -808,6 +918,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Pass" => "within_budget", from: "requested"
       transition "Flag" => "flagged",       from: "requested"
     end
@@ -925,6 +1036,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Pass" => "passed", from: "requested"
       transition "Flag" => "flagged", from: "requested"
     end
@@ -1073,6 +1185,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Complete" => "rolled", from: "requested"
       transition "Flag" => "flagged", from: "requested"
       transition "Verify" => "verified", from: "rolled"
@@ -1255,6 +1368,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Complete" => "rolled", from: "requested"
       transition "Flag" => "flagged", from: "requested"
       transition "Verify" => "verified", from: "rolled"
@@ -1266,10 +1380,11 @@ Hecks.bluebook "Deploy" do
     # Runs the project's generated `deploy-box.sh`: render the Compose files, push them to the box over
     # SSM, start the containers and check them. A policy then requests a `SmokeRun`, unless
     # `skip_smoke=true`. Exit 1 when flagged, with the script's status (40 no instance, 41 the roll
-    # failed, 42 the box unhealthy).
+    # failed, 42 the box unhealthy, 43 no restore anchor). Before the roll the script names the point the
+    # database can be restored to, so the report always carries the way back from a minted era.
 
     command "Run" do
-      goal "Roll the app box and record whether it came up healthy (exit 1 when flagged: 40 no instance, 41 roll failed, 42 box unhealthy)"
+      goal "Roll the app box and record whether it came up healthy (exit 1 when flagged: 40 no instance, 41 roll failed, 42 box unhealthy, 43 no restore anchor)"
 
       attribute :project,    Location
       attribute :script,     Location, optional: true
@@ -1448,6 +1563,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged", "drifted"
       transition "Complete" => "restored", from: "requested"
       transition "Plan" => "planned", from: "requested"
       transition "Flag" => "flagged", from: "requested"
@@ -1729,6 +1845,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "drifted", "flagged"
       transition "Match" => "verified", from: "requested"
       transition "Differ" => "drifted", from: "requested"
       transition "Flag" => "flagged", from: "requested"
@@ -1871,6 +1988,7 @@ Hecks.bluebook "Deploy" do
     # No outcome is a failure: a report that could not be made is `unavailable`, never `flagged`
     # (only a malformed request is), because the era check gates a deploy, not this report.
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Match" => "unchanged", from: "requested"
       transition "Differ" => "changed", from: "requested"
       transition "Withhold" => "unavailable", from: "requested"
@@ -2034,6 +2152,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "RecordName" => "named", from: "requested"
       transition "RecordUrl" => "located", from: "requested"
       transition "RecordList" => "listed", from: "requested"
@@ -2407,6 +2526,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "flagged"
       transition "Complete" => "rolled", from: "requested"
       transition "Plan" => "planned", from: "requested"
       transition "Flag" => "flagged", from: "requested"
@@ -2542,6 +2662,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "drifted", "refused"
       transition "Match"  => "matching", from: "requested"
       transition "Drift"  => "drifted",  from: "requested"
       transition "Refuse" => "refused",  from: "requested"
@@ -2665,6 +2786,7 @@ Hecks.bluebook "Deploy" do
     end
 
     lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
       transition "Complete" => "projected", from: "requested"
       transition "Fault"    => "faulted",   from: "requested"
     end

data/lib/hecks/deploy/bluebook/deploy.hecksagon

@@ -27,6 +27,14 @@ Hecks.hecksagon "Deploy" do
     end
   end
 
+  Deploy::Handover.port "DeployToolchain" do
+    asks "ClearDeployment", to: Handover do
+      attribute :run, RunKey
+      answers "HandoverAnswered"
+      refuses "HandoverRefused"
+    end
+  end
+
   Deploy::MakefileCheck.port "DeployToolchain" do
     asks "Scan", to: MakefileCheck do
       attribute :run, RunKey