hecks 4.0.0 → 6.0.0

data/lib/hecks/hecks/custodian.bluebook

@@ -6,6 +6,9 @@ Hecks.bluebook "Hecks" do
   aggregate "Operation" do
     description "One thing an operator ran against a domain, and how it ended."
 
+    acknowledges :key_by_value, "any address an operator checks, not only the address of a recorded Host",
+                 of: :url
+
     attribute :run,          OperationKey
     attribute :subject,      Subject,    optional: true
     attribute :script,       Script,     optional: true
@@ -22,10 +25,21 @@ Hecks.bluebook "Hecks" do
     attribute :email,        Email,      optional: true
     attribute :name,         PersonName, optional: true
     attribute :role,         RoleName,   optional: true
+    attribute :claimed,      Switch,     optional: true
+    attribute :row,          RowId,      optional: true
     attribute :output,       Output,     optional: true
     attribute :refusal,      Output,     optional: true
     identified_by :run
 
+    value_object "Switch" do
+      attribute :value, Boolean
+    end
+
+    # The delivery id an outbox row carries, as the stalled-row warning at boot names it.
+    value_object "RowId" do
+      attribute :value, String, matches: :present
+    end
+
     value_object "OperationKey" do
       attribute :value, String, matches: :present
 
@@ -51,7 +65,7 @@ Hecks.bluebook "Hecks" do
     end
 
     value_object "Address" do
-      attribute :value, String, pattern: '^https?://'
+      attribute :value, String, matches: :http_scheme
     end
 
     value_object "RoutePath" do
@@ -78,7 +92,7 @@ Hecks.bluebook "Hecks" do
       attribute :value, String
     end
 
-    # Who the first administrator is: a person of the domain's membership chapter.
+    # Who the first administrator is: a person of the domain's membership bluebook.
     value_object "Email" do
       attribute :value, String, pattern: '^[^ \t\n\r@]+@[^ \t\n\r@]+$'
     end
@@ -95,6 +109,7 @@ Hecks.bluebook "Hecks" do
       mark :failure, "failed"
       transition "Succeed" => "succeeded", from: "requested"
       transition "Fail"    => "failed",    from: "requested"
+      mark :terminal, "failed", "succeeded"
     end
 
     # Runs one verb, or a JSON step list, against the domain: `hecks run [domain] script=steps.json`
@@ -104,21 +119,16 @@ Hecks.bluebook "Hecks" do
       role "Operator"
       goal "Dispatch a verb or a step list against a domain and keep what it reported"
 
-      attribute :run,     OperationKey
-      attribute :subject, Subject,       optional: true
-      attribute :script,  Script,        optional: true
-      attribute :verb,    Verb,          optional: true
-      attribute :arguments, list_of(Word), optional: true
+      attribute :run,     OperationKey, sets: true
+      attribute :subject, Subject,       optional: true, sets: true
+      attribute :script,  Script,        optional: true, sets: true
+      attribute :verb,    Verb,          optional: true, sets: true
+      attribute :arguments, list_of(Word), optional: true, sets: true
 
       given("exactly one of a script and a verb is named: pass script= or verb=, not both") do
         (script.set? && verb.unset?) || (script.unset? && verb.set?)
       end
 
-      sets :run
-      sets :subject
-      sets :script
-      sets :verb
-      sets :arguments
 
       emits RunRequested
     end
@@ -127,24 +137,58 @@ Hecks.bluebook "Hecks" do
       role "Operator"
       goal "Bring every read-model projection of a domain up to date now"
 
+      attribute :run,     OperationKey, sets: true
+      attribute :subject, Subject, sets: true
+
+
+      emits ProjectionsRefreshRequested
+    end
+
+    # Redelivers what a domain's outbox left behind. A row never claimed is always safe to redeliver. A
+    # row claimed before a crash and never settled may or may not have run its effect, so it is only
+    # named (on stderr, as at boot) unless `claimed.value=true` says the effect is known not to have run,
+    # for every claimed row, or `row.value=<delivery id>` says it for that one row alone.
+    command "RedriveOutbox" do
+      role "Operator"
+      goal "Redeliver the reactions a domain's outbox left undelivered, and name the claimed ones that stalled"
+
+      attribute :run,     OperationKey, sets: true
+      attribute :subject, Subject, sets: true
+      attribute :claimed, Switch, optional: true, sets: true
+      attribute :row,     RowId,  optional: true, sets: true
+
+      given("one claimed row is named, or all of them are: pass row= or claimed=, not both") do
+        row.unset? || claimed.unset?
+      end
+
+
+      emits OutboxRedriveRequested
+    end
+
+    # Settles one stalled claimed row as failed without running its effect, for a row whose effect is
+    # known to have landed or that nobody wants run. It never redelivers; `RedriveOutbox` does that.
+    command "AbandonOutboxRow" do
+      role "Operator"
+      goal "Settle one stalled outbox row as failed, naming it by its delivery id, without running it"
+
       attribute :run,     OperationKey
       attribute :subject, Subject
+      attribute :row,     RowId
 
       sets :run
       sets :subject
+      sets :row
 
-      emits ProjectionsRefreshRequested
+      emits OutboxRowAbandonRequested
     end
 
     command "RunBehaviors" do
       role "Operator"
       goal "Run a domain's behavior tests and keep the verdict"
 
-      attribute :run,     OperationKey
-      attribute :subject, Subject
+      attribute :run,     OperationKey, sets: true
+      attribute :subject, Subject, sets: true
 
-      sets :run
-      sets :subject
 
       emits BehaviorsRequested
     end
@@ -153,11 +197,9 @@ Hecks.bluebook "Hecks" do
       role "Operator"
       goal "Open an interactive console on a domain"
 
-      attribute :run,     OperationKey
-      attribute :subject, Subject, optional: true
+      attribute :run,     OperationKey, sets: true
+      attribute :subject, Subject, optional: true, sets: true
 
-      sets :run
-      sets :subject
 
       emits ConsoleRequested
     end
@@ -166,11 +208,9 @@ Hecks.bluebook "Hecks" do
       role "Operator"
       goal "Dispatch one synthesized call per command and report of a wired domain"
 
-      attribute :run,     OperationKey
-      attribute :subject, Subject, optional: true
+      attribute :run,     OperationKey, sets: true
+      attribute :subject, Subject, optional: true, sets: true
 
-      sets :run
-      sets :subject
 
       emits SmokeTestRequested
     end
@@ -179,31 +219,22 @@ Hecks.bluebook "Hecks" do
       role "Operator"
       goal "Check that a running service refuses bad signatures and accepts a good one"
 
-      attribute :run,          OperationKey
-      attribute :url,          Address,     optional: true
-      attribute :path,         RoutePath
-      attribute :header,       HeaderName,  optional: true
-      attribute :scheme,       Scheme,      optional: true
-      attribute :payload,      Payload,     optional: true
-      attribute :payload_file, PayloadFile, optional: true
-      attribute :health_path,  RoutePath,   optional: true
-      attribute :state_path,   RoutePath,   optional: true
+      attribute :run,          OperationKey, sets: true
+      attribute :url,          Address,     optional: true, sets: true
+      attribute :path,         RoutePath, sets: true
+      attribute :header,       HeaderName,  optional: true, sets: true
+      attribute :scheme,       Scheme,      optional: true, sets: true
+      attribute :payload,      Payload,     optional: true, sets: true
+      attribute :payload_file, PayloadFile, optional: true, sets: true
+      attribute :health_path,  RoutePath,   optional: true, sets: true
+      attribute :state_path,   RoutePath,   optional: true, sets: true
 
-      sets :run
-      sets :url
-      sets :path
-      sets :header
-      sets :scheme
-      sets :payload
-      sets :payload_file
-      sets :health_path
-      sets :state_path
 
       emits SmokeHttpRequested
     end
 
     # `hecks operation.bootstrap_admin <domain> email=<email> [name=<name>] [role=<role>]`. A
-    # domain whose chapter `provides "membership"` has nobody who may grant access until someone is
+    # domain whose bluebook `provides "membership"` has nobody who may grant access until someone is
     # granted it. This admits the person and grants them the role the grant command is gated to
     # (or `role`), as a caller that names that role and binds no `actor_id`: Governance checks that
     # caller by the role it states, which is how the first grant gets made (ADR 0025). It is
@@ -211,19 +242,14 @@ Hecks.bluebook "Hecks" do
     # persistence must be the one the service runs on (`DATABASE_URL`), not Memory.
     command "BootstrapAdmin" do
       role "Operator"
-      goal "Admit the first administrator of a domain's membership chapter and grant them access"
+      goal "Admit the first administrator of a domain's membership bluebook and grant them access"
 
-      attribute :run,     OperationKey
-      attribute :subject, Subject
-      attribute :email,   Email
-      attribute :name,    PersonName, optional: true
-      attribute :role,    RoleName,   optional: true
+      attribute :run,     OperationKey, sets: true
+      attribute :subject, Subject, sets: true
+      attribute :email,   Email, sets: true
+      attribute :name,    PersonName, optional: true, sets: true
+      attribute :role,    RoleName,   optional: true, sets: true
 
-      sets :run
-      sets :subject
-      sets :email
-      sets :name
-      sets :role
 
       emits AdminBootstrapRequested
     end
@@ -233,9 +259,8 @@ Hecks.bluebook "Hecks" do
       goal "Record that the operation ended well, and what it reported"
 
       reference_to Operation
-      attribute :output, Output
+      attribute :output, Output, sets: true
 
-      sets :output
 
       emits OperationSucceeded
     end
@@ -245,9 +270,8 @@ Hecks.bluebook "Hecks" do
       goal "Record that the operation was refused or found a problem, and what it said"
 
       reference_to Operation
-      attribute :refusal, Output
+      attribute :refusal, Output, sets: true
 
-      sets :refusal
 
       emits OperationFailed
     end
@@ -300,37 +324,47 @@ Hecks.bluebook "Hecks" do
 
   policy "RunWhenRequested" do
     on      "Operation.RunRequested"
-    trigger Operation::DomainRuntime::Execute, with: { run: :run }
+    ask     :execute, with: { run: :run }
   end
 
   policy "RefreshWhenRequested" do
     on      "Operation.ProjectionsRefreshRequested"
-    trigger Operation::DomainRuntime::Refresh, with: { run: :run }
+    ask     :refresh, with: { run: :run }
+  end
+
+  policy "RedriveWhenRequested" do
+    on      "Operation.OutboxRedriveRequested"
+    ask     :redrive, with: { run: :run }
+  end
+
+  policy "AbandonWhenRequested" do
+    on      "Operation.OutboxRowAbandonRequested"
+    ask     :abandon, with: { run: :run }
   end
 
   policy "VerifyWhenRequested" do
     on      "Operation.BehaviorsRequested"
-    trigger Operation::DomainRuntime::Verify, with: { run: :run }
+    ask     :verify, with: { run: :run }
   end
 
   policy "SmokeWhenRequested" do
     on      "Operation.SmokeTestRequested"
-    trigger Operation::DomainRuntime::Smoke, with: { run: :run }
+    ask     :smoke, with: { run: :run }
   end
 
   policy "BootstrapWhenRequested" do
     on      "Operation.AdminBootstrapRequested"
-    trigger Operation::DomainRuntime::Bootstrap, with: { run: :run }
+    ask     :bootstrap, with: { run: :run }
   end
 
   policy "OpenWhenRequested" do
     on      "Operation.ConsoleRequested"
-    trigger Operation::Terminal::Open, with: { run: :run }
+    ask     :open, with: { run: :run }
   end
 
   policy "ProbeWhenRequested" do
     on      "Operation.SmokeHttpRequested"
-    trigger Operation::HostHttp::Probe, with: { run: :run }
+    ask     :probe, with: { run: :run }
   end
 
   policy "RecordTheOutput" do
@@ -356,7 +390,7 @@ Hecks.bluebook "Hecks" do
     identified_by :host
 
     value_object "Address" do
-      attribute :value, String, pattern: '^https?://'
+      attribute :value, String, matches: :http_scheme
     end
 
     # The file listing the eras that should be running, one per line.
@@ -402,11 +436,10 @@ command "CheckEra" do
       role "Operator"
       goal "Ask a running host which era it reports, and keep whether it is one that should be running"
 
-      attribute :host,     Address
+      attribute :host,     Address, sets: true
       attribute :expected, ExpectedFile
       attribute :timeout,  Seconds, default: 10
 
-      sets :host
       sets :expected
       sets :timeout
 
@@ -433,13 +466,10 @@ end
       goal "Record the version and era a running host reported"
 
       reference_to Host
-      attribute :era,     EraId
-      attribute :version, VersionText
-      attribute :report,  Report
+      attribute :era,     EraId, sets: true
+      attribute :version, VersionText, sets: true
+      attribute :report,  Report, sets: true
 
-      sets :era
-      sets :version
-      sets :report
 
       emits EraObserved
     end
@@ -450,13 +480,10 @@ end
       goal "Record that a running host reports an era that should not be running"
 
       reference_to Host
-      attribute :era,     EraId
-      attribute :version, VersionText
-      attribute :report,  Report
+      attribute :era,     EraId, sets: true
+      attribute :version, VersionText, sets: true
+      attribute :report,  Report, sets: true
 
-      sets :era
-      sets :version
-      sets :report
 
       emits EraDrifted
     end
@@ -466,9 +493,8 @@ end
       goal "Record that the host could not be reached, or answered no era, and what was said"
 
       reference_to Host
-      attribute :refusal, Report
+      attribute :refusal, Report, sets: true
 
-      sets :refusal
 
       emits HostLost
     end
@@ -489,12 +515,12 @@ end
 
   policy "FetchWhenChecked" do
     on      "Host.EraCheckRequested"
-    trigger Host::HostHttp::Fetch, with: { host: :host }
+    ask     :fetch, with: { host: :host }
   end
 
 policy "FetchWhenRechecked" do
   on      "Host.EraRecheckRequested"
-  trigger Host::HostHttp::Fetch, with: { host: :host }
+  ask     :fetch, with: { host: :host }
 end
 
 policy "RecordTheEra" do
@@ -514,9 +540,405 @@ policy "RecordTheEra" do
     trigger Host::Lose, with: { refusal: :refusal }
   end
 
+  # Many agents finish together and each would push, running every pre-push check at once. A
+  # boarding waits its turn behind the push in flight from the same repository, then pushes the
+  # local branch with whatever else has landed on it, or finds an earlier push already carried it.
+  aggregate "PushTrain" do
+    description "One push of a checkout's branch, taken in turn: carried by an earlier push, pushed, or refused."
+
+    attribute :run,      RunKey
+    attribute :branch,   Word,   optional: true
+    attribute :remote,   Word,   optional: true
+    attribute :checkout, Word,   optional: true
+    attribute :full_gate, Switch, optional: true
+    attribute :boarded,  Word,   optional: true
+    attribute :pushed,   Word,   optional: true
+    attribute :report,   Report, optional: true
+    attribute :refusal,  Report, optional: true
+    identified_by :run
+
+    value_object "RunKey" do
+      attribute :value, String, matches: :present
+    end
+
+    # A branch, a remote, a directory or a commit.
+    value_object "Word" do
+      attribute :value, String, matches: :present
+    end
+
+    value_object "Report" do
+      attribute :value, String
+    end
+
+    value_object "Switch" do
+      attribute :value, Boolean
+    end
+
+    lifecycle :status, default: "requested" do
+      mark :failure, "faulted"
+      transition "Push"  => "pushed",  from: "requested"
+      transition "Ride"  => "carried", from: "requested"
+      transition "Fault" => "faulted", from: "requested"
+      transition "Summarize" => "surveyed", from: "requested"
+      mark :terminal, "carried", "faulted", "pushed", "surveyed"
+    end
+
+    command "Board" do
+      role "Operator"
+      goal "Push this checkout's branch once the push ahead of it lands, unless that push already carried it"
+
+      attribute :run,       RunKey, sets: true
+      attribute :branch,    Word, default: "main", sets: true
+      attribute :remote,    Word, default: "origin", sets: true
+      attribute :checkout,  Word, optional: true, sets: true
+      # Run the whole `pre_push` stage, the suite included, which also writes the CI attestation
+      # note; without it the push runs only the `unguarded_push` stage.
+      attribute :full_gate, Switch, optional: true, sets: true
+
+
+      emits BoardingRequested
+    end
+
+    # A survey pushes nothing: it lists every checkout under a directory (`checkout`) whose branch
+    # has commits its remote does not, so what waits to board is known before anything boards.
+    command "Survey" do
+      role "Operator"
+      goal "List every checkout under a directory whose branch has commits its remote does not"
+
+      attribute :run,      RunKey, sets: true
+      attribute :remote,   Word, default: "origin", sets: true
+      attribute :checkout, Word, optional: true, sets: true
+
+
+      emits SurveyRequested
+    end
+
+    command "Summarize" do
+      role "System"
+      goal "Record what a survey found waiting to push"
+
+      reference_to PushTrain
+      attribute :report, Report, sets: true
+
+
+      emits CheckoutsSurveyed
+    end
+
+    # The branch was pushed: every commit on it reached the remote, what this boarding carried and
+    # whatever landed on it while it waited.
+    command "Push" do
+      role "System"
+      goal "Record the commit a boarding pushed"
+
+      reference_to PushTrain
+      attribute :checkout, Word, sets: true
+      attribute :boarded,  Word, sets: true
+      attribute :pushed,   Word, sets: true
+      attribute :report,   Report, sets: true
+
+
+      emits BranchPushed
+    end
+
+    # An earlier push already took the boarded commit to the remote, so this one pushed nothing.
+    command "Ride" do
+      role "System"
+      goal "Record that an earlier push already carried the boarded commit"
+
+      reference_to PushTrain
+      attribute :checkout, Word, sets: true
+      attribute :boarded,  Word, sets: true
+      attribute :report,   Report, sets: true
+
+
+      emits CarriedByEarlierPush
+    end
+
+    command "Fault" do
+      role "System"
+      goal "Record why a boarding could not push"
+
+      reference_to PushTrain
+      attribute :refusal, Report, sets: true
+
+
+      emits PushFaulted
+    end
+
+    query "Outcome" do
+      description "How one boarding ended: pushed, carried by an earlier push, or why it failed."
+      attribute :run, RunKey
+      where(run: :run)
+      order_by :run
+    end
+  end
+
+  policy "CarryWhenBoarded" do
+    on      "PushTrain.BoardingRequested"
+    ask     :carry, with: { run: :run }
+  end
+
+  policy "RecordThePush" do
+    on      "PushTrain.TrainAnswered"
+    where   { outcome.value == "pushed" }
+    trigger PushTrain::Push, with: { checkout: :checkout, boarded: :boarded, pushed: :pushed, report: :report }
+  end
+
+  policy "RecordTheRide" do
+    on      "PushTrain.TrainAnswered"
+    where   { outcome.value == "carried" }
+    trigger PushTrain::Ride, with: { checkout: :checkout, boarded: :boarded, report: :report }
+  end
+
+  policy "RecordTheRefusedPush" do
+    on      "PushTrain.TrainRefused"
+    trigger PushTrain::Fault, with: { refusal: :refusal }
+  end
+
+  policy "SurveyWhenAsked" do
+    on      "PushTrain.SurveyRequested"
+    ask     :tally, with: { run: :run }
+  end
+
+  policy "RecordTheSurvey" do
+    on      "PushTrain.SurveyAnswered"
+    trigger PushTrain::Summarize, with: { report: :report }
+  end
+
+  policy "RecordTheRefusedSurvey" do
+    on      "PushTrain.SurveyRefused"
+    trigger PushTrain::Fault, with: { refusal: :refusal }
+  end
+
+  # Deploys stay by hand: a push that reached the remote says a deploy is ready, and nothing more.
+  policy "AnnounceWhenPushed" do
+    on      "PushTrain.BranchPushed"
+    ask     :announce, with: { run: :run }
+  end
+
+  # A checkout's state, read and never written: nothing needs a raw `git status`, `git diff` or
+  # `git log`. The `Reading` port's adapter answers each query; the aggregate keeps no record.
+  aggregate "Checkout" do
+    description "A look at a checkout: its branch, what it changed and what it committed."
+
+    attribute :checkout, Place
+    identified_by :checkout
+
+    # A directory inside the repository; the current directory when a query names none.
+    value_object "Place" do
+      attribute :value, String, matches: :present
+    end
+
+    value_object "Word" do
+      attribute :value, String, matches: :present
+    end
+
+    value_object "Document" do
+      attribute :text, String
+    end
+
+    query "Status" do
+      description "The checkout's branch, whether it is a linked worktree, where it stands against main and origin/main, and what is changed or untracked."
+      attribute :checkout, Place, optional: true
+      returns Document
+    end
+
+    query "Changes" do
+      description "What the checkout changed since a ref (main by default): the diffstat, or the paths alone."
+      attribute :checkout,   Place,   optional: true
+      attribute :since,      Word,    optional: true
+      attribute :names_only, Boolean, optional: true
+      returns Document
+    end
+
+    query "Log" do
+      description "The commits in a range, newest first (the last 20 when none is named)."
+      attribute :checkout, Place, optional: true
+      attribute :range,    Word,  optional: true
+      returns Document
+    end
+
+    query "Settings" do
+      description "What this copy resolves for each setting that can come from a variable, its own world or a default, and which one supplied it."
+      attribute :domain, Place, optional: true
+      returns Document
+    end
+  end
+
+  # Agents merge straight to local main and clean up what they merged. A landing merges a worktree's
+  # branch onto main, fast-forward first and as a merge commit when main moved; a conflict is
+  # reported and never settled, and nothing is forced or pushed. A retirement removes the worktree
+  # and its branch once the branch is on main, and refuses while it holds uncommitted work or
+  # commits main lacks, so no unpushed work is deleted.
+  aggregate "Landing" do
+    description "One branch landed on local main, or one worktree retired: done, or refused with the reason."
+
+    attribute :run,      RunKey
+    attribute :checkout, Word,   optional: true
+    attribute :branch,   Word,   optional: true
+    attribute :onto,     Word,   optional: true
+    attribute :landed,   Word,   optional: true
+    attribute :report,   Report, optional: true
+    attribute :refusal,  Report, optional: true
+    identified_by :run
+
+    value_object "RunKey" do
+      attribute :value, String, matches: :present
+    end
+
+    # A branch, a directory or a commit.
+    value_object "Word" do
+      attribute :value, String, matches: :present
+    end
+
+    value_object "Report" do
+      attribute :value, String
+    end
+
+    value_object "Document" do
+      attribute :text, String
+    end
+
+    lifecycle :status, default: "requested" do
+      mark :failure, "refused"
+      transition "Record"  => "landed",  from: "requested"
+      transition "Clear"   => "retired", from: "requested"
+      transition "Refuse"  => "refused", from: "requested"
+      transition "Decline" => "refused", from: "requested"
+      mark :terminal, "landed", "refused", "retired"
+    end
+
+    command "Land" do
+      role "Operator"
+      goal "Merge a worktree's branch onto local main: fast-forward when it can be, a merge commit when main moved, never forced, never pushed"
+
+      attribute :run,      RunKey, sets: true
+      attribute :checkout, Word, optional: true, sets: true
+      attribute :branch,   Word, optional: true, sets: true
+      attribute :onto,     Word, default: "main", sets: true
+
+
+      emits LandingRequested
+    end
+
+    command "Record" do
+      role "System"
+      goal "Record the commit main names once the branch is on it"
+
+      reference_to Landing
+      attribute :branch, Word, sets: true
+      attribute :landed, Word, sets: true
+      attribute :report, Report, sets: true
+
+
+      emits BranchLanded
+    end
+
+    command "Refuse" do
+      role "System"
+      goal "Record why a branch could not be landed"
+
+      reference_to Landing
+      attribute :refusal, Report, sets: true
+
+
+      emits LandingRefused
+    end
+
+    command "Retire" do
+      role "Operator"
+      goal "Remove a merged worktree and delete its branch, unless it holds uncommitted work or commits main lacks"
+
+      attribute :run,      RunKey, sets: true
+      attribute :checkout, Word, optional: true, sets: true
+      attribute :branch,   Word, optional: true, sets: true
+      attribute :onto,     Word, default: "main", sets: true
+
+
+      emits RetirementRequested
+    end
+
+    command "Clear" do
+      role "System"
+      goal "Record that the worktree and its branch are gone"
+
+      reference_to Landing
+      attribute :branch, Word, sets: true
+      attribute :report, Report, sets: true
+
+
+      emits WorktreeRetired
+    end
+
+    command "Decline" do
+      role "System"
+      goal "Record why a worktree was kept"
+
+      reference_to Landing
+      attribute :refusal, Report, sets: true
+
+
+      emits RetirementDeclined
+    end
+
+    query "Outcome" do
+      description "How one landing or retirement ended: the commit main names, or why it was refused."
+      attribute :run, RunKey
+      where(run: :run)
+      order_by :run
+    end
+
+    query "Unlanded" do
+      description "Every branch with commits that are not on main, or with uncommitted work, and where its worktree is."
+      attribute :checkout, Word, optional: true
+      attribute :onto,     Word, optional: true
+      returns Document
+    end
+  end
+
+  policy "MergeWhenLanding" do
+    on      "Landing.LandingRequested"
+    ask     :merge, with: { run: :run }
+  end
+
+  policy "RecordTheLanding" do
+    on      "Landing.MergeAnswered"
+    trigger Landing::Record, with: { branch: :branch, landed: :landed, report: :report }
+  end
+
+  policy "RecordTheRefusedLanding" do
+    on      "Landing.MergeRefused"
+    trigger Landing::Refuse, with: { refusal: :refusal }
+  end
+
+  policy "RemoveWhenRetiring" do
+    on      "Landing.RetirementRequested"
+    ask     :remove, with: { run: :run }
+  end
+
+  policy "RecordTheRetirement" do
+    on      "Landing.RemovalAnswered"
+    trigger Landing::Clear, with: { branch: :branch, report: :report }
+  end
+
+  policy "RecordTheKeptWorktree" do
+    on      "Landing.RemovalRefused"
+    trigger Landing::Decline, with: { refusal: :refusal }
+  end
+
+  # The copy of Hecks that runs the train follows what it pushed, so the next boarding and the
+  # records it keeps run the code that landed, not the code that was there when it was set up.
+  policy "KeepTheLauncherCurrent" do
+    on      "PushTrain.BranchPushed"
+    ask     :refresh, with: { run: :run }
+  end
+
   aggregate "Era" do
     description "One change to a domain's journal of eras, and how it ended: a store's upkeep."
 
+    acknowledges :key_by_value, "the domain's path, and Introspection declares queries only, so it holds no records and a reference would be refused on every write",
+                 of: :domain
+
     attribute :run,                 RunKey
     attribute :domain,              DomainPath
     attribute :operation,           OperationName, optional: true
@@ -586,6 +1008,7 @@ policy "RecordTheEra" do
       transition "Permit"   => "admitted", from: "requested"
       transition "Settle"   => "settled",  from: "admitted"
       transition "Abandon"  => "refused",  from: %w[requested admitted]
+      mark :terminal, "refused", "settled"
     end
 
     # The seven requests. Each records what was asked and names its operation; the journal store
@@ -596,15 +1019,12 @@ policy "RecordTheEra" do
       role "Operator"
       goal "Hold the first era of a domain that holds none, as its first boot would"
 
-      attribute :domain,  DomainPath
-      attribute :run,     RunKey
-      attribute :confirm, Switch, optional: true
+      attribute :domain,  DomainPath, sets: true
+      attribute :run,     RunKey, sets: true
+      attribute :confirm, Switch, optional: true, sets: true
 
       given("holding the first era is confirmed") { confirm.value == true }
 
-      sets :domain
-      sets :run
-      sets :confirm
       sets :operation, to: "hold_first"
 
       emits FirstEraRequested
@@ -614,17 +1034,13 @@ policy "RecordTheEra" do
       role "Operator"
       goal "Interleave the old world's writes since the cut into the live head, by their ordinals"
 
-      attribute :domain,  DomainPath
-      attribute :run,     RunKey
-      attribute :winners, WinnerList, optional: true
-      attribute :confirm, Switch,     optional: true
+      attribute :domain,  DomainPath, sets: true
+      attribute :run,     RunKey, sets: true
+      attribute :winners, WinnerList, optional: true, sets: true
+      attribute :confirm, Switch,     optional: true, sets: true
 
       given("the merge is confirmed") { confirm.value == true }
 
-      sets :domain
-      sets :run
-      sets :winners
-      sets :confirm
       sets :operation, to: "merge_tail"
 
       emits TailMergeRequested
@@ -634,17 +1050,13 @@ policy "RecordTheEra" do
       role "Operator"
       goal "Freeze an era's held text as it now stands, after a person has read it"
 
-      attribute :domain,  DomainPath
-      attribute :era,     Ordinal
-      attribute :run,     RunKey
-      attribute :confirm, Switch, optional: true
+      attribute :domain,  DomainPath, sets: true
+      attribute :era,     Ordinal, sets: true
+      attribute :run,     RunKey, sets: true
+      attribute :confirm, Switch, optional: true, sets: true
 
       given("the text is accepted as the era's own") { confirm.value == true }
 
-      sets :domain
-      sets :era
-      sets :run
-      sets :confirm
       sets :operation, to: "reattest"
 
       emits ReattestRequested
@@ -654,11 +1066,9 @@ policy "RecordTheEra" do
       role "Operator"
       goal "Store the shape every held era froze with, for the eras that predate it"
 
-      attribute :domain, DomainPath
-      attribute :run,    RunKey
+      attribute :domain, DomainPath, sets: true
+      attribute :run,    RunKey, sets: true
 
-      sets :domain
-      sets :run
       sets :operation, to: "backfill_projections"
 
       emits BackfillRequested
@@ -668,17 +1078,13 @@ policy "RecordTheEra" do
       role "Operator"
       goal "Delete the journal entries a Postgres or Sqlite aggregate has already projected"
 
-      attribute :domain,     DomainPath
-      attribute :aggregates, AggregateList, optional: true
-      attribute :run,        RunKey
-      attribute :confirm,    Switch, optional: true
+      attribute :domain,     DomainPath, sets: true
+      attribute :aggregates, AggregateList, optional: true, sets: true
+      attribute :run,        RunKey, sets: true
+      attribute :confirm,    Switch, optional: true, sets: true
 
       given("the compaction is confirmed") { confirm.value == true }
 
-      sets :domain
-      sets :aggregates
-      sets :run
-      sets :confirm
       sets :operation, to: "compact"
 
       emits CompactionRequested
@@ -688,17 +1094,13 @@ policy "RecordTheEra" do
       role "Operator"
       goal "Empty a Heki aggregate's journal, keeping the snapshot"
 
-      attribute :domain,     DomainPath
-      attribute :aggregates, AggregateList, optional: true
-      attribute :run,        RunKey
-      attribute :confirm,    Switch, optional: true
+      attribute :domain,     DomainPath, sets: true
+      attribute :aggregates, AggregateList, optional: true, sets: true
+      attribute :run,        RunKey, sets: true
+      attribute :confirm,    Switch, optional: true, sets: true
 
       given("the compaction is confirmed") { confirm.value == true }
 
-      sets :domain
-      sets :aggregates
-      sets :run
-      sets :confirm
       sets :operation, to: "compact_heki"
 
       emits HekiCompactionRequested
@@ -710,15 +1112,16 @@ policy "RecordTheEra" do
       goal "Let a change through only when what was found in the journal allows it"
 
       reference_to Era
-      attribute :capable,            Switch
-      attribute :held,               Count
-      attribute :forks,              Count
-      attribute :contested,          Count
-      attribute :bound,              Count
-      attribute :candidates,         Count
-      attribute :drifted,            Switch
-      attribute :loadable,           Switch
-      attribute :shape_kept,         Switch
+      attribute :capable,            Switch, sets: true
+      attribute :held,               Count, sets: true
+      attribute :forks,              Count, sets: true
+      attribute :contested,          Count, sets: true
+      attribute :bound,              Count, sets: true
+      attribute :candidates,         Count, sets: true
+      attribute :drifted,            Switch, sets: true
+      attribute :loadable,           Switch, sets: true
+      attribute :shape_kept,         Switch, sets: true
+      attribute :operation,          OperationName, sets: true
 
       given("the store keeps eras") do
         capable.value || operation.value == "compact" || operation.value == "compact_heki"
@@ -747,15 +1150,6 @@ policy "RecordTheEra" do
         operation.value != "reattest" || shape_kept.value
       end
 
-      sets :capable
-      sets :held
-      sets :forks
-      sets :contested
-      sets :bound
-      sets :candidates
-      sets :drifted
-      sets :loadable
-      sets :shape_kept
 
       emits EraPermitted
     end
@@ -765,9 +1159,8 @@ policy "RecordTheEra" do
       goal "Record that the admitted change was made, and what it did"
 
       reference_to Era
-      attribute :report, Report
+      attribute :report, Report, sets: true
 
-      sets :report
 
       emits EraSettled
     end
@@ -777,9 +1170,8 @@ policy "RecordTheEra" do
       goal "Record that the change was refused, or could not be made, and why"
 
       reference_to Era
-      attribute :refusal, Report
+      attribute :refusal, Report, sets: true
 
-      sets :refusal
 
       emits EraAbandoned
     end
@@ -833,32 +1225,32 @@ policy "RecordTheEra" do
 
   policy "ExamineWhenFirstEraRequested" do
     on      "Era.FirstEraRequested"
-    trigger Era::JournalStore::Examine, with: { run: :run }
+    ask     :examine, with: { run: :run }
   end
 
   policy "ExamineWhenTailMergeRequested" do
     on      "Era.TailMergeRequested"
-    trigger Era::JournalStore::Examine, with: { run: :run }
+    ask     :examine, with: { run: :run }
   end
 
   policy "ExamineWhenReattestRequested" do
     on      "Era.ReattestRequested"
-    trigger Era::JournalStore::Examine, with: { run: :run }
+    ask     :examine, with: { run: :run }
   end
 
   policy "ExamineWhenBackfillRequested" do
     on      "Era.BackfillRequested"
-    trigger Era::JournalStore::Examine, with: { run: :run }
+    ask     :examine, with: { run: :run }
   end
 
   policy "ExamineWhenCompactionRequested" do
     on      "Era.CompactionRequested"
-    trigger Era::JournalStore::Examine, with: { run: :run }
+    ask     :examine, with: { run: :run }
   end
 
   policy "ExamineWhenHekiCompactionRequested" do
     on      "Era.HekiCompactionRequested"
-    trigger Era::JournalStore::Examine, with: { run: :run }
+    ask     :examine, with: { run: :run }
   end
 
   policy "PermitWhenExamined" do
@@ -866,7 +1258,7 @@ policy "RecordTheEra" do
     trigger Era::Permit, with: {
       capable: :capable, held: :held, forks: :forks, contested: :contested,
       bound: :bound, candidates: :candidates,
-      drifted: :drifted, loadable: :loadable, shape_kept: :shape_kept
+      drifted: :drifted, loadable: :loadable, shape_kept: :shape_kept, operation: :operation
     }
   end
 
@@ -886,9 +1278,13 @@ policy "RecordTheEra" do
     trigger Era::Abandon, with: { refusal: "the journal's facts do not admit this change" }
   end
 
+  # A compaction waits for its seal (ledger.bluebook); every other change is applied at once.
   policy "ChangeWhenPermitted" do
     on      "Era.EraPermitted"
-    trigger Era::JournalStore::Apply, with: { run: :run }
+    where do
+      operation.value != "compact" && operation.value != "compact_heki"
+    end
+    ask     :apply, with: { run: :run }
   end
 
   policy "RecordTheChange" do