hecks 5.0.0 → 6.0.0

data/rust/host/src/{dispatch.rs → dispatch_tests.rs}

@@ -1,745 +1,10 @@
-//! Ties the journal and the sandbox together: replays history, then the
-//! new step, persisting it only if the module accepts it.
-
-use crate::host::Host;
-use crate::journal;
-use crate::lambda_client::{self};
-use crate::wasm_runner;
-use std::path::Path;
-use tokio::sync::Mutex;
-use tokio_postgres::Client;
-
-pub struct Outcome {
-    pub result: serde_json::Value,
-    pub accepted: bool,
-}
-
-/// Who a command is dispatched for: the role they state and, when the host knows who they are, the
-/// actor Governance holds assignments for. Both absent is an unidentified caller.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub struct Caller<'a> {
-    pub role: Option<&'a str>,
-    pub actor_id: Option<&'a str>,
-}
-
-/// The role an unidentified caller is dispatched under when roles are enforced: no command declares
-/// it, so a command that declares any role refuses it.
-pub const ANONYMOUS_ROLE: &str = "Anonymous";
-
-/// What the host does about the role a command declares (`HECKS_ROLE_ENFORCEMENT`).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Enforcement {
-    /// A caller with no role is unchecked, as before.
-    Off,
-    /// An unidentified or unassigned caller is let through and logged as `would_refuse_role`; a
-    /// caller that states a role is checked exactly as under `Enforce`, so shadow never accepts
-    /// what `Off` would not.
-    Shadow,
-    /// An unidentified or unassigned caller is refused.
-    Enforce,
-}
-
-impl Enforcement {
-    /// Reads `off` (the default), `shadow` or `enforce`; anything else is `Off`.
-    pub fn parse(value: Option<&str>) -> Self {
-        match value.map(|v| v.trim().to_ascii_lowercase()).as_deref() {
-            Some("shadow") => Self::Shadow,
-            Some("enforce") => Self::Enforce,
-            _ => Self::Off,
-        }
-    }
-
-    pub fn from_env() -> Self {
-        static MODE: std::sync::OnceLock<Enforcement> = std::sync::OnceLock::new();
-        *MODE.get_or_init(|| Self::parse(std::env::var("HECKS_ROLE_ENFORCEMENT").ok().as_deref()))
-    }
-
-    /// The caller the kernel is asked to check: an unidentified caller becomes the anonymous role
-    /// unless enforcement is off.
-    pub fn effective(self, caller: Caller<'_>) -> Caller<'_> {
-        if self != Self::Off && caller.role.is_none() && caller.actor_id.is_none() {
-            return Caller {
-                role: Some(ANONYMOUS_ROLE),
-                actor_id: None,
-            };
-        }
-        caller
-    }
-}
-
-/// Where a dispatch comes from. A host-internal dispatch is the host acting on its own behalf (a
-/// signup, a provisioning step, a presentation write); it names no caller and is never subject to
-/// `HECKS_ROLE_ENFORCEMENT`, which guards what callers outside the host may do.
-#[derive(Clone, Copy, Debug, PartialEq)]
-enum Origin {
-    External,
-    HostInternal,
-}
-
-/// Whether the kernel refused the command for the caller's role.
-fn refused_for_role(result: &serde_json::Value) -> bool {
-    result
-        .get("refusals")
-        .and_then(|r| r.as_array())
-        .is_some_and(|all| {
-            all.iter()
-                .any(|r| r.get("kind").and_then(|k| k.as_str()) == Some("Unauthorized"))
-        })
-}
-
-// Distinguishes a module refusal from a kernel failure to run at all.
-#[derive(Debug, PartialEq)]
-enum KernelAnswer {
-    Accepted,
-    Refused,
-    Failed(String),
-}
-
-// A run that never started has no `refusals` array at all, so absence of
-// refusals doesn't by itself mean the run succeeded.
-fn classify(result: &serde_json::Value) -> KernelAnswer {
-    if let Some(error) = result.get("error") {
-        return KernelAnswer::Failed(
-            error
-                .as_str()
-                .map_or_else(|| error.to_string(), str::to_string),
-        );
-    }
-    let refused = result
-        .get("refusals")
-        .and_then(|r| r.as_array())
-        .is_some_and(|r| !r.is_empty());
-    if refused {
-        KernelAnswer::Refused
-    } else {
-        KernelAnswer::Accepted
-    }
-}
-
-// A kernel failure becomes `Err`, not a result with no instances read as
-// an empty world.
-fn parse_kernel_output(output: &str) -> anyhow::Result<serde_json::Value> {
-    let result: serde_json::Value = serde_json::from_str(output)?;
-    match classify(&result) {
-        KernelAnswer::Failed(message) => {
-            anyhow::bail!("the kernel failed before it could run the command: {message}")
-        }
-        KernelAnswer::Accepted | KernelAnswer::Refused => Ok(result),
-    }
-}
-
-// Kept as one opaque object under the journal's `args` column; the kernel
-// unwraps `to`/`with` itself, so this needs no journal schema migration.
-pub fn routed_invocation(
-    to: serde_json::Value,
-    facts: serde_json::Value,
-) -> anyhow::Result<serde_json::Value> {
-    if !facts.is_object() {
-        anyhow::bail!("with must be an object of command facts");
-    }
-    let mut invocation = serde_json::Map::new();
-    invocation.insert("to".to_string(), to);
-    invocation.insert("with".to_string(), facts);
-    Ok(serde_json::Value::Object(invocation))
-}
-
-// No `to` route: used only when a command creates a new aggregate, so
-// there is no receiver yet to route to.
-pub fn facts_invocation(facts: serde_json::Value) -> anyhow::Result<serde_json::Value> {
-    if !facts.is_object() {
-        anyhow::bail!("with must be an object of command facts");
-    }
-    let mut invocation = serde_json::Map::new();
-    invocation.insert("with".to_string(), facts);
-    Ok(serde_json::Value::Object(invocation))
-}
-
-// Route-aware entry point; `handle` below stays the compatibility path
-// for callers still sending the older mixed args shape.
-pub async fn handle_routed(
-    host: Host<'_>,
-    verb: &str,
-    to: serde_json::Value,
-    facts: serde_json::Value,
-    role: Option<&str>,
-) -> anyhow::Result<Outcome> {
-    handle(host, verb, routed_invocation(to, facts)?, role).await
-}
-
-/// `handle_routed` for a caller the host can name.
-pub async fn handle_routed_as(
-    host: Host<'_>,
-    verb: &str,
-    to: serde_json::Value,
-    facts: serde_json::Value,
-    caller: Caller<'_>,
-) -> anyhow::Result<Outcome> {
-    handle_as(host, verb, routed_invocation(to, facts)?, caller).await
-}
-
-// Facts-only counterpart to `handle_routed`.
-pub async fn handle_facts(
-    host: Host<'_>,
-    verb: &str,
-    facts: serde_json::Value,
-    role: Option<&str>,
-) -> anyhow::Result<Outcome> {
-    handle(host, verb, facts_invocation(facts)?, role).await
-}
-
-/// `handle_facts` for a caller the host can name.
-pub async fn handle_facts_as(
-    host: Host<'_>,
-    verb: &str,
-    facts: serde_json::Value,
-    caller: Caller<'_>,
-) -> anyhow::Result<Outcome> {
-    handle_as(host, verb, facts_invocation(facts)?, caller).await
-}
-
-// A Mutex, not a bare Arc<Client>: `handle` needs `Client::transaction`,
-// which takes `&mut Client`. Locking also means concurrent callers on
-// this connection can't interleave statements.
-//
-// `config` is required, not optional: `main.rs` already refused to boot
-// unless the configured domain/era is provisioned and current, so by the
-// time `handle` runs that schema is guaranteed to exist.
-//
-// `role` is optional, matching `Adapters::Lambda::Client#dispatch`'s own
-// `role: nil` default: a step with no role looks the same on the wire
-// whether or not a caller is bound.
-//
-// This entry point and `handle_facts`/`handle_routed` are the host's own: a call with no role is a
-// host-internal dispatch and is unchecked in every enforcement mode. A call that names a role is
-// still checked against it. Callers outside the host go through the `_as` entry points.
-pub async fn handle(
-    host: Host<'_>,
-    verb: &str,
-    args: serde_json::Value,
-    role: Option<&str>,
-) -> anyhow::Result<Outcome> {
-    let origin = if role.is_none() {
-        Origin::HostInternal
-    } else {
-        Origin::External
-    };
-    dispatch_in(
-        Enforcement::from_env(),
-        origin,
-        host,
-        verb,
-        args,
-        Caller {
-            role,
-            actor_id: None,
-        },
-    )
-    .await
-}
-
-/// Dispatches for a caller, applying `HECKS_ROLE_ENFORCEMENT`: unidentified callers are refused (or,
-/// in shadow, logged as would-be refusals and let through).
-pub async fn handle_as(
-    host: Host<'_>,
-    verb: &str,
-    args: serde_json::Value,
-    caller: Caller<'_>,
-) -> anyhow::Result<Outcome> {
-    dispatch_in(
-        Enforcement::from_env(),
-        Origin::External,
-        host,
-        verb,
-        args,
-        caller,
-    )
-    .await
-}
-
-async fn dispatch_in(
-    mode: Enforcement,
-    origin: Origin,
-    host: Host<'_>,
-    verb: &str,
-    args: serde_json::Value,
-    caller: Caller<'_>,
-) -> anyhow::Result<Outcome> {
-    let checked = if origin == Origin::HostInternal {
-        caller
-    } else {
-        mode.effective(caller)
-    };
-    let outcome = run(host, verb, args.clone(), checked).await?;
-    // Only a caller that stated no role (unidentified, or an actor Governance holds no grant for)
-    // is let through; a stated role that does not match stays refused, as it is under `Off`.
-    if mode == Enforcement::Shadow
-        && caller.role.is_none()
-        && !outcome.accepted
-        && refused_for_role(&outcome.result)
-    {
-        crate::log::error(
-            "would_refuse_role",
-            serde_json::json!({
-                "verb": verb, "role": checked.role, "actor_id": checked.actor_id,
-                "refusals": outcome.result.get("refusals"),
-            }),
-        );
-        return run(host, verb, args, Caller::default()).await;
-    }
-    Ok(outcome)
-}
-
-async fn run(
-    host: Host<'_>,
-    verb: &str,
-    args: serde_json::Value,
-    caller: Caller<'_>,
-) -> anyhow::Result<Outcome> {
-    let Host {
-        client,
-        wasm_path,
-        config,
-        invoker,
-        ..
-    } = host;
-    let role = caller.role;
-    let mut guard = client.lock().await;
-    let txn = guard.transaction().await?;
-
-    // Locks the whole read-then-append sequence, not just the INSERT:
-    // two concurrent invocations could otherwise both rehydrate against
-    // the same prior steps and both pass a uniqueness check the domain
-    // thinks it's enforcing. Domain-scoped so unrelated domains sharing
-    // one Postgres instance don't serialize against each other.
-    txn.execute(
-        "SELECT pg_advisory_xact_lock(hashtext('hecks_lambda_journal.' || $1::text))",
-        &[&config.domain],
-    )
-    .await?;
-
-    // Reads the last snapshot plus only the journal rows after it,
-    // instead of replaying the whole history every time. `None` covers
-    // a brand-new domain and one with pre-snapshot history alike; both
-    // fall back to one full replay, which then leaves a snapshot behind.
-    let snapshot = journal::load_snapshot(&txn).await?;
-    // `sagas_backfilled` is a latch, not a live check of whether
-    // `hecks_lambda_sagas` is empty (empty is the ordinary state, not a
-    // signal). Only matters for a domain with real history predating
-    // saga durability, where the snapshot cache would otherwise never
-    // re-derive sagas from the journal.
-    let needs_saga_backfill = snapshot.as_ref().is_some_and(|s| !s.sagas_backfilled);
-    let mut steps = match &snapshot {
-        Some(s) if !needs_saga_backfill => journal::load_steps_after(&txn, s.ordinal).await?,
-        _ => journal::load_steps(&txn).await?,
-    };
-    // Role goes only on this outermost step; replayed history already
-    // carries whatever role it was dispatched with. Built as a mutable
-    // step, not inlined into the `json!` literal, so a roleless call
-    // still omits the `"role"` key entirely rather than sending null.
-    // A fact the command `needs` is answered here, before the kernel's gates read the arguments and
-    // before the step is journaled, so a replay re-dispatches the recorded answer (ADR 0081).
-    let mut args = args;
-    if let Some(domain_ir) = crate::ir::ir() {
-        crate::needs::fill_needs(domain_ir, verb, &mut args, &crate::needs::ProcessClock);
-        // An argument with a declared default is filled the same way, so the journal holds it too.
-        crate::needs::fill_defaults(domain_ir, verb, &mut args);
-    }
-    let mut step = serde_json::json!({ "verb": verb, "args": args.clone() });
-    if let Some(role) = role {
-        step["role"] = serde_json::Value::String(role.to_string());
-    }
-    if let Some(actor_id) = caller.actor_id {
-        step["actor_id"] = serde_json::Value::String(actor_id.to_string());
-    }
-    // Stamped only on this live step; replayed history already carries
-    // its own real timestamp, and re-stamping today's time onto a
-    // replay would be wrong, not just redundant.
-    step["occurred_at"] = serde_json::Value::String(crate::auth::httpdate_now());
-    steps.push(step);
-    // Must match `steps`' own choice above: a full replay needs an empty
-    // seed, or the kernel replays into a world that already has every
-    // record being created again, refusing each as a false AlreadyExists.
-    let seed = if needs_saga_backfill {
-        serde_json::json!({})
-    } else {
-        snapshot
-            .as_ref()
-            .map_or_else(|| serde_json::json!({}), |s| s.seed.clone())
-    };
-
-    // Read inside the same advisory-locked transaction: the lock covers
-    // saga state too, not just the aggregate journal/snapshot.
-    let saga_rows = journal::load_sagas(&txn).await?;
-    let sagas_seed = serde_json::json!(saga_rows
-        .iter()
-        .map(|r| serde_json::json!({
-            "process_manager": r.process_manager,
-            "correlation": r.correlation,
-            "state": r.state,
-            "memory": r.memory,
-            "completed_compensations": r.completed_compensations,
-        }))
-        .collect::<Vec<_>>());
-
-    let mut input = serde_json::json!({ "seed": seed, "steps": steps, "sagas": sagas_seed });
-    // Lets the kernel answer a reaction's command that needs a fact the same way (ADR 0081).
-    if let Some(domain_ir) = crate::ir::ir() {
-        let table = crate::needs::table(domain_ir);
-        if table.as_object().is_some_and(|t| !t.is_empty()) {
-            input["needs"] = table;
-        }
-        let defaults = crate::needs::defaults_table(domain_ir);
-        if defaults.as_object().is_some_and(|t| !t.is_empty()) {
-            input["defaults"] = defaults;
-        }
-    }
-    let input = input.to_string();
-    // `wasm_runner::run` is sync, and wasmtime-wasi's sync bridge spins up
-    // its own tokio runtime internally — fatal on a thread already
-    // driving one. `spawn_blocking` moves it off this async runtime.
-    let owned_wasm_path = wasm_path.to_path_buf();
-    let output =
-        tokio::task::spawn_blocking(move || wasm_runner::run(&owned_wasm_path, &input)).await??;
-    // A kernel failure returns here, before anything is written: dropping `txn`
-    // rolls it back, so no journal row, snapshot, saga or mutation is saved.
-    let mut result = parse_kernel_output(&output)?;
-
-    // See journal.rs's own header: every prior step in this replay
-    // already succeeded once, deterministically, so the only step that
-    // can legitimately show up in `refusals` is the new one just
-    // appended last.
-    let accepted = classify(&result) == KernelAnswer::Accepted;
-
-    if accepted {
-        let ordinal = journal::append(&txn, verb, &args).await?;
-
-        // The kernel's "instances" output is already the exact seed
-        // shape, so nothing here re-derives or filters it.
-        let new_seed = result
-            .get("instances")
-            .cloned()
-            .unwrap_or_else(|| serde_json::json!({}));
-        journal::save_snapshot(&txn, ordinal, &new_seed).await?;
-
-        // Persisted in the same transaction, so a saga checkpoint can
-        // never commit independently of the command that produced it.
-        // Reconciled against `saga_rows` (pre-run state): present now
-        // is upserted, present before but absent now is deleted.
-        if let Some(saga_snapshot) = result.get("saga_snapshot").and_then(|v| v.as_array()) {
-            let mut still_present: std::collections::HashSet<(String, String)> =
-                std::collections::HashSet::new();
-            for entry in saga_snapshot {
-                let process_manager = entry
-                    .get("process_manager")
-                    .and_then(|v| v.as_str())
-                    .ok_or_else(|| {
-                        anyhow::anyhow!("saga_snapshot entry missing \"process_manager\": {entry}")
-                    })?;
-                let correlation = entry
-                    .get("correlation")
-                    .and_then(|v| v.as_str())
-                    .ok_or_else(|| {
-                        anyhow::anyhow!("saga_snapshot entry missing \"correlation\": {entry}")
-                    })?;
-                let state = entry.get("state").and_then(|v| v.as_str()).ok_or_else(|| {
-                    anyhow::anyhow!("saga_snapshot entry missing \"state\": {entry}")
-                })?;
-                let memory = entry
-                    .get("memory")
-                    .cloned()
-                    .unwrap_or_else(|| serde_json::json!({}));
-                let completed_compensations = entry
-                    .get("completed_compensations")
-                    .cloned()
-                    .unwrap_or_else(|| serde_json::json!([]));
-
-                journal::save_saga(
-                    &txn,
-                    process_manager,
-                    correlation,
-                    state,
-                    &memory,
-                    &completed_compensations,
-                )
-                .await?;
-                still_present.insert((process_manager.to_string(), correlation.to_string()));
-            }
-            for row in &saga_rows {
-                let key = (row.process_manager.clone(), row.correlation.clone());
-                if !still_present.contains(&key) {
-                    journal::delete_saga(&txn, &row.process_manager, &row.correlation).await?;
-                }
-            }
-        }
-
-        // One entry per step in `steps`, so the last entry is this
-        // call's own new step. Skipped when `config.era` is `None`: a
-        // domain with nothing lineage-capable bound never provisions a
-        // head-snapshot table to write into (ADR 0034).
-        let step_mutations = if config.era.is_some() {
-            result
-                .get("mutations")
-                .and_then(|m| m.as_array())
-                .and_then(|steps| steps.last())
-                .and_then(|last| last.as_array())
-                .cloned()
-                .unwrap_or_default()
-        } else {
-            Vec::new()
-        };
-
-        for mutation in &step_mutations {
-            let aggregate = mutation
-                .get("aggregate")
-                .and_then(|v| v.as_str())
-                .ok_or_else(|| {
-                    anyhow::anyhow!("mutation record missing \"aggregate\": {mutation}")
-                })?;
-            // `era.is_some()` means the lineage subsystem exists, not that
-            // this aggregate has a mirror: `mint` only provisions head
-            // snapshots for the capable set, so mirroring anything else
-            // would upsert into a relation nobody created.
-            if !config.mirrors(aggregate) {
-                continue;
-            }
-            let id = mutation
-                .get("id")
-                .and_then(|v| v.as_str())
-                .ok_or_else(|| anyhow::anyhow!("mutation record missing \"id\": {mutation}"))?;
-            let operation = mutation
-                .get("operation")
-                .and_then(|v| v.as_str())
-                .ok_or_else(|| {
-                    anyhow::anyhow!("mutation record missing \"operation\": {mutation}")
-                })?;
-            let state = mutation
-                .get("state")
-                .ok_or_else(|| anyhow::anyhow!("mutation record missing \"state\": {mutation}"))?;
-
-            journal::append_lineage_mutation(
-                &txn,
-                config,
-                &journal::Mutation {
-                    aggregate,
-                    id,
-                    operation,
-                    state,
-                },
-            )
-            .await?;
-        }
-    }
-
-    // Only this step's own matches, same reason as `step_mutations`
-    // above: replaying a prior step's reaction would re-invoke a sibling
-    // Lambda on every later replay. Captured before commit, delivered after.
-    let pending_cross_domain = result
-        .get("cross_domain_reactions")
-        .and_then(|r| r.as_array())
-        .and_then(|steps| steps.last())
-        .and_then(|last| last.as_array())
-        .cloned()
-        .unwrap_or_default();
-
-    // Commits (and releases the advisory lock) whether or not anything
-    // was appended — a refused command still needs the lock released
-    // for the next invocation to proceed.
-    txn.commit().await?;
-
-    // Delivered after commit, deliberately: the local command already
-    // succeeded and is durable, so a cross-Lambda notification is
-    // best-effort, not a precondition of it. A fault that survives every
-    // retry still fails this call via `?`, but never unwinds an
-    // already-committed transaction.
-    // Every reaction gets its own attempt even after an earlier fails:
-    // returning early would silently drop the rest, undelivered and
-    // never dead-lettered (`SafeDepositBox.Surrender` fires two from one
-    // command). `first_failure` remembers only the first error without
-    // cutting the loop short.
-    let mut cross_domain_deliveries = Vec::new();
-    let mut first_failure: Option<anyhow::Error> = None;
-    for reaction in &pending_cross_domain {
-        match lambda_client::deliver_with_retry(invoker, reaction).await {
-            Ok(record) => {
-                if let Some(response) = result.as_object_mut() {
-                    if let Some(reactions) =
-                        response.get_mut("reactions").and_then(|r| r.as_array_mut())
-                    {
-                        reactions.push(serde_json::json!({
-                            "policy": record.policy, "on": reaction.get("on").and_then(|v| v.as_str()).unwrap_or_default(),
-                            "trigger": record.target_verb, "delivered": record.delivered, "reason": record.reason,
-                        }));
-                    }
-                }
-                cross_domain_deliveries.push(record.to_json());
-            }
-            Err(failure) => {
-                let error_text = format!("{:#}", failure.error);
-                crate::log::error(
-                    "cross_domain_delivery_failed",
-                    serde_json::json!({
-                        "policy": failure.policy, "target_domain": failure.target_domain,
-                        "target_verb": failure.target_verb, "attempts": failure.attempts, "error": error_text,
-                    }),
-                );
-                journal::record_dead_letter(
-                    &*guard,
-                    &failure.policy,
-                    &failure.target_domain,
-                    &failure.target_verb,
-                    &failure.payload,
-                    &error_text,
-                    failure.attempts as i32,
-                )
-                .await?;
-                if first_failure.is_none() {
-                    first_failure = Some(failure.error);
-                }
-            }
-        }
-    }
-    if let Some(error) = first_failure {
-        return Err(error);
-    }
-    if let Some(response) = result.as_object_mut() {
-        response.insert(
-            "cross_domain_deliveries".to_string(),
-            serde_json::Value::Array(cross_domain_deliveries),
-        );
-    }
-
-    log_command(verb, role, accepted, &result);
-    Ok(Outcome { result, accepted })
-}
+//! The dispatch path against a real Postgres and the Memory store: what `rust_host_core`'s
+//! dispatch does is only observable through a backend, and the backends live here.
 
-// One line per dispatched command: what was asked (verb, role — never
-// the facts) and what the domain answered.
-fn log_command(verb: &str, role: Option<&str>, accepted: bool, result: &serde_json::Value) {
-    let fields = command_fields(verb, role, accepted, result);
-    if accepted {
-        crate::log::info("command", fields);
-    } else {
-        crate::log::error("command", fields);
-    }
-}
-
-fn command_fields(
-    verb: &str,
-    role: Option<&str>,
-    accepted: bool,
-    result: &serde_json::Value,
-) -> serde_json::Value {
-    let events: Vec<serde_json::Value> = result
-        .get("events")
-        .and_then(|v| v.as_array())
-        .map(|items| {
-            items
-                .iter()
-                .filter_map(|item| item.get("name").cloned())
-                .collect()
-        })
-        .unwrap_or_default();
-    serde_json::json!({
-        "verb": verb, "role": role, "accepted": accepted, "events": events,
-        "refusals": result.get("refusals").cloned().unwrap_or_else(|| serde_json::json!([])),
-    })
-}
-
-// Read-only: the same seed path `handle` uses, minus the new step and
-// any write. No advisory lock needed since nothing here writes.
-// Returns the whole kernel result verbatim, not just `instances`, so a
-// caller can tell an empty `refusals` from one that was never checked.
-pub async fn read(client: &Mutex<Client>, wasm_path: &Path) -> anyhow::Result<serde_json::Value> {
-    let guard = client.lock().await;
-    let snapshot = journal::load_snapshot(&*guard).await?;
-
-    if let Some(s) = &snapshot {
-        let steps_since = journal::load_steps_after(&*guard, s.ordinal).await?;
-        drop(guard);
-
-        if steps_since.is_empty() {
-            // No wasm invocation needed: the snapshot's seed already is
-            // this domain's current "instances" output. Empty
-            // events/refusals is correct too — a read reports current
-            // state, never event/refusal history.
-            return Ok(serde_json::json!({ "instances": s.seed, "events": [], "refusals": [] }));
-        }
-
-        // Self-healing: if steps ever go unaccounted for after the last
-        // snapshot, seeding from it and replaying just the gap is
-        // still correct and cheap.
-        let input = serde_json::json!({ "seed": &s.seed, "steps": steps_since }).to_string();
-        let owned_wasm_path = wasm_path.to_path_buf();
-        let output =
-            tokio::task::spawn_blocking(move || wasm_runner::run(&owned_wasm_path, &input))
-                .await??;
-        return parse_kernel_output(&output);
-    }
-
-    // No snapshot: either a brand-new domain, or one with history from
-    // before this snapshot cache existed — either way, one full replay
-    // catches it up.
-    let steps = journal::load_steps(&*guard).await?;
-    drop(guard);
-    let input = serde_json::json!({ "steps": steps }).to_string();
-    let owned_wasm_path = wasm_path.to_path_buf();
-    let output =
-        tokio::task::spawn_blocking(move || wasm_runner::run(&owned_wasm_path, &input)).await??;
-    parse_kernel_output(&output)
-}
-
-// A declared query, answered against current state. Seeds from `read`
-// rather than replaying history itself, so it sees exactly the state a
-// read would report and pays at most one wasm invocation.
-pub async fn query(
-    client: &Mutex<Client>,
-    wasm_path: &Path,
-    question: &str,
-    args: serde_json::Value,
-) -> anyhow::Result<serde_json::Value> {
-    // A fact the query `needs` is answered before the kernel checks its arguments (ADR 0081).
-    let mut args = args;
-    if let Some(domain_ir) = crate::ir::ir() {
-        crate::needs::fill_query_needs(domain_ir, question, &mut args, &crate::needs::ProcessClock);
-    }
-    let state = read(client, wasm_path).await?;
-    let seed = state
-        .get("instances")
-        .cloned()
-        .unwrap_or_else(|| serde_json::json!({}));
-    let input = serde_json::json!({ "seed": seed, "steps": [{ "query": question, "args": args }] })
-        .to_string();
-    let owned_wasm_path = wasm_path.to_path_buf();
-    let output =
-        tokio::task::spawn_blocking(move || wasm_runner::run(&owned_wasm_path, &input)).await??;
-    parse_kernel_output(&output)
-}
-
-/// Answers `answer` (a kernel answer already computed and persisted) in the bare shape a caller
-/// reads, by one more wasm run of the kernel's `{"present": answer}` input: each single-field
-/// value object as its sole field. Nothing is stored or replayed.
-pub async fn present(
-    wasm_path: &Path,
-    answer: serde_json::Value,
-) -> anyhow::Result<serde_json::Value> {
-    let owned_wasm_path = wasm_path.to_path_buf();
-    tokio::task::spawn_blocking(move || {
-        present_with(&answer, |input| wasm_runner::run(&owned_wasm_path, input))
-    })
-    .await?
-}
-
-/// Presents `answer` as `present` does, with `run` standing in for the kernel (text in, text out).
-pub(crate) fn present_with(
-    answer: &serde_json::Value,
-    run: impl FnOnce(&str) -> anyhow::Result<String>,
-) -> anyhow::Result<serde_json::Value> {
-    let input = serde_json::json!({ "present": answer }).to_string();
-    parse_kernel_output(&run(&input)?)
-}
+#![allow(unused_imports)]
 
 #[cfg(test)]
-pub(crate) mod tests {
+pub mod tests {
 
     #[test]
     fn a_command_log_line_names_the_verb_events_and_refusals_but_never_the_facts() {
@@ -755,15 +20,22 @@ pub(crate) mod tests {
         assert_eq!(fields["refusals"][0]["kind"], "AlreadyExists");
         assert!(!fields.to_string().contains("a@b.c"));
     }
-    use super::*;
+    use crate::host::Host;
+    use crate::journal;
     use crate::journal::LineageConfig;
+    use crate::lambda_client;
     use crate::lambda_client::LambdaInvoker;
-    use tokio_postgres::NoTls;
+    use crate::store::journal_sql;
+    use crate::store::{Accepted, DeadLetter, LineageWrite, Store, StoreExt, StoreFixtures};
+    use crate::wasm_runner;
+    use rust_host_core::dispatch::*;
+    use std::path::Path;
+    use tokio_postgres::{Client, NoTls};
 
     // A throwaway Postgres database per test, uniquely named so
     // `cargo test`'s default parallelism doesn't race two tests against
     // the same journal table.
-    pub(crate) async fn scratch_db(name: &str) -> Mutex<Client> {
+    pub async fn scratch_db(name: &str) -> Store {
         let (admin, conn) = tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
             .await
             .expect("connect to postgres");
@@ -785,14 +57,29 @@ pub(crate) mod tests {
         tokio::spawn(async move {
             let _ = conn.await;
         });
-        journal::ensure_schema(&client).await.unwrap();
-        Mutex::new(client)
+        journal_sql::ensure_schema(&client).await.unwrap();
+        crate::store::postgres_store(client)
+    }
+
+    /// An empty in-memory store, for tests that need a journal and nothing Postgres-specific.
+    pub fn memory_store() -> Store {
+        Store::memory(crate::store::MemoryStore::new())
+    }
+
+    /// The config a memory-backed host runs under: no era, so nothing mirrors into lineage.
+    pub fn memory_config(domain: &str) -> LineageConfig {
+        LineageConfig {
+            domain: domain.to_string(),
+            era: None,
+            mirrored: None,
+            seal_every: None,
+        }
     }
 
     // Not Ruby's real provisioning — just enough structure for
-    // `journal::current_era` and `append_lineage_mutation` to succeed,
+    // `journal_sql::current_era` and `append_lineage_mutation` to succeed,
     // without reproducing Ruby's full DDL.
-    pub(crate) async fn provision_lineage(
+    pub async fn provision_lineage(
         client: &Client,
         domain: &str,
         era: i32,
@@ -814,7 +101,7 @@ pub(crate) mod tests {
             .await
             .unwrap();
 
-        let journal_table = format!("hecks_journal_{}", journal::snake(domain));
+        let journal_table = format!("hecks_journal_{}", journal_sql::snake(domain));
         client
             .batch_execute(&format!(
                 "CREATE TABLE IF NOT EXISTS \"{journal_table}\" (
@@ -823,7 +110,8 @@ pub(crate) mod tests {
                     aggregate    text NOT NULL,
                     aggregate_id text NOT NULL,
                     operation    text NOT NULL,
-                    state        jsonb
+                    state        jsonb,
+                    mirrors      jsonb
                 )"
             ))
             .await
@@ -832,9 +120,9 @@ pub(crate) mod tests {
         for name in aggregate_storage_names {
             // Domain-qualified (ADR 0059), matching what a real write
             // targets.
-            let snapshot_table = journal::qualified_name(
+            let snapshot_table = journal_sql::qualified_name(
                 domain,
-                &format!("{}_head_snapshot_{era}", journal::snake(name)),
+                &format!("{}_head_snapshot_{era}", journal_sql::snake(name)),
             );
             client
                 .batch_execute(&format!(
@@ -877,6 +165,7 @@ pub(crate) mod tests {
             domain: "Banking".to_string(),
             era: Some(1),
             mirrored: None,
+            seal_every: None,
         };
         let refused = handle_facts(
             Host::new(&client, &wasm, &everything, &invoker),
@@ -908,6 +197,7 @@ pub(crate) mod tests {
             domain: "Banking".to_string(),
             era: Some(1),
             mirrored: Some(std::collections::BTreeSet::new()),
+            seal_every: None,
         };
         let outcome = handle_facts(
             Host::new(&client, &wasm, &declared, &invoker),
@@ -953,6 +243,7 @@ pub(crate) mod tests {
             domain: "Banking".to_string(),
             era: Some(1),
             mirrored: Some(std::iter::once("Banking::Customer".to_string()).collect()),
+            seal_every: None,
         };
 
         handle_facts(
@@ -978,11 +269,12 @@ pub(crate) mod tests {
         assert_eq!(mirrored, 1);
     }
 
-    fn test_config(domain: &str, era: i32) -> LineageConfig {
+    pub fn test_config(domain: &str, era: i32) -> LineageConfig {
         LineageConfig {
             domain: domain.to_string(),
             era: Some(era),
             mirrored: None,
+            seal_every: None,
         }
     }
 
@@ -1010,11 +302,11 @@ pub(crate) mod tests {
         assert!(failed.is_err());
     }
 
-    pub(crate) fn wasm_path() -> std::path::PathBuf {
+    pub fn wasm_path() -> std::path::PathBuf {
         std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../dist/banking.wasm")
     }
 
-    fn register(reference: &str) -> serde_json::Value {
+    pub fn register(reference: &str) -> serde_json::Value {
         serde_json::json!({
             "reference": { "value": reference },
             "name": { "given": "Ada", "family": "Lovelace" },
@@ -1026,9 +318,8 @@ pub(crate) mod tests {
     // query answered against whatever state the journal currently holds.
     #[tokio::test]
     async fn a_declared_query_answers_against_current_state() {
-        let client = scratch_db("rust_host_dispatch_test_query").await;
-        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
 
         handle(
             Host::new(&client, &wasm_path(), &config, &lambda_client::NeverInvoker),
@@ -1110,7 +401,7 @@ pub(crate) mod tests {
         assert!(outcome.accepted);
         assert_eq!(outcome.result["refusals"].as_array().unwrap().len(), 0);
         let guard = client.lock().await;
-        let steps = journal::load_steps(&*guard).await.unwrap();
+        let steps = journal_sql::load_steps(&*guard).await.unwrap();
         assert_eq!(steps.len(), 1);
 
         // The lineage write itself: a row landed in the era-tagged,
@@ -1152,20 +443,59 @@ pub(crate) mod tests {
         assert_eq!(id, "CUST-0001");
     }
 
+    // The seal is part of the commit, not a tool run afterwards: the second accepted command
+    // leaves a seal through the second lineage row, and the chain walks clean from it.
+    #[tokio::test]
+    async fn a_commit_seals_the_lineage_chain_every_so_many_rows() {
+        let client = scratch_db("rust_host_dispatch_seals").await;
+        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
+        let config = LineageConfig {
+            seal_every: Some(2),
+            ..test_config("Banking", 1)
+        };
+
+        for id in ["CUST-0001", "CUST-0002", "CUST-0003"] {
+            let outcome = handle(
+                Host::new(&client, &wasm_path(), &config, &lambda_client::NeverInvoker),
+                "Banking::Customer.Register",
+                register(id),
+                None,
+            )
+            .await
+            .unwrap();
+            assert!(outcome.accepted, "{id} should be accepted");
+        }
+
+        let guard = client.lock().await;
+        let seals = crate::ledger::anchors(&*guard, "Banking").await.unwrap();
+        assert_eq!(
+            seals.iter().map(|seal| seal.through).collect::<Vec<_>>(),
+            vec![2],
+            "one seal, taken by the commit that made two rows unsealed"
+        );
+        assert_eq!(
+            crate::ledger::verify(&*guard, "Banking").await.unwrap(),
+            crate::ledger::Finding::Verified(crate::ledger::Report {
+                seals: 1,
+                entries: 2,
+                unsealed: 1
+            })
+        );
+    }
+
     // Proves `occurred_at` end to end through the real wasm module: the
     // string this crate stamps and sends is the one that comes back out
     // in the returned event, not just what the in-kernel unit tests prove.
     #[tokio::test]
     async fn occurred_at_is_stamped_onto_every_returned_event_with_this_crate_s_own_real_clock() {
-        let client = scratch_db("rust_host_dispatch_test_occurred_at").await;
-        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
+        let client = crate::dispatch_tests::tests::memory_store();
 
-        let before = crate::auth::httpdate_now();
+        let before = crate::clock::iso8601_now();
         let outcome = handle(
             Host::new(
                 &client,
                 &wasm_path(),
-                &test_config("Banking", 1),
+                &crate::dispatch_tests::tests::memory_config("Banking"),
                 &lambda_client::NeverInvoker,
             ),
             "Banking::Customer.Register",
@@ -1174,7 +504,7 @@ pub(crate) mod tests {
         )
         .await
         .unwrap();
-        let after = crate::auth::httpdate_now();
+        let after = crate::clock::iso8601_now();
 
         assert!(outcome.accepted, "{:?}", outcome.result["refusals"]);
         let events = outcome.result["events"].as_array().unwrap();
@@ -1193,9 +523,8 @@ pub(crate) mod tests {
 
     #[tokio::test]
     async fn rehydrates_prior_history_before_evaluating_the_new_command() {
-        let client = scratch_db("rust_host_dispatch_test_2").await;
-        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
 
         let first = handle(
             Host::new(&client, &wasm_path(), &config, &lambda_client::NeverInvoker),
@@ -1228,7 +557,7 @@ pub(crate) mod tests {
             "duplicate registration should be refused, proving prior state was rehydrated: {:?}",
             second.result
         );
-        let steps = journal::load_steps(&*client.lock().await).await.unwrap();
+        let steps = client.journal_steps().await;
         assert_eq!(
             steps.len(),
             1,
@@ -1261,11 +590,11 @@ pub(crate) mod tests {
             );
 
             let guard = client.lock().await;
-            let snapshot = journal::load_snapshot(&*guard)
+            let snapshot = journal_sql::load_snapshot(&*guard)
                 .await
                 .unwrap()
                 .expect("a snapshot should exist after the first accepted command");
-            let tail = journal::load_steps_after(&*guard, snapshot.ordinal)
+            let tail = journal_sql::load_steps_after(&*guard, snapshot.ordinal)
                 .await
                 .unwrap();
             assert!(tail.is_empty(), "the snapshot should already reflect every accepted command, leaving nothing to replay");
@@ -1279,7 +608,7 @@ pub(crate) mod tests {
             );
         }
 
-        let final_snapshot = journal::load_snapshot(&*client.lock().await)
+        let final_snapshot = journal_sql::load_snapshot(&*client.lock().await)
             .await
             .unwrap()
             .unwrap();
@@ -1356,7 +685,7 @@ pub(crate) mod tests {
         .unwrap();
         assert!(first.accepted, "{:?}", first.result);
 
-        let whole_world = journal::load_snapshot(&*client.lock().await)
+        let whole_world = journal_sql::load_snapshot(&*client.lock().await)
             .await
             .unwrap()
             .unwrap()
@@ -1467,7 +796,7 @@ pub(crate) mod tests {
         .await
         .unwrap();
         assert!(second.accepted, "{:?}", second.result);
-        let after = journal::load_snapshot(&*client.lock().await)
+        let after = journal_sql::load_snapshot(&*client.lock().await)
             .await
             .unwrap()
             .unwrap()
@@ -1482,7 +811,7 @@ pub(crate) mod tests {
     }
 
     // The snapshot's ordinal and exact seed text, and how many commands are journaled.
-    async fn snapshot_and_journal(client: &Mutex<Client>) -> (i64, String, i64) {
+    async fn snapshot_and_journal(client: &Store) -> (i64, String, i64) {
         let guard = client.lock().await;
         let snapshot = guard
             .query_one("SELECT ordinal, seed::text FROM hecks_lambda_snapshot", &[])
@@ -1504,9 +833,8 @@ pub(crate) mod tests {
         // appended — silently violating the uniqueness the domain
         // itself enforces. With the lock serializing the whole
         // read-then-append sequence, exactly one must be accepted.
-        let client = scratch_db("rust_host_dispatch_test_3").await;
-        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
         let wasm_path = wasm_path();
 
         let (first, second) = tokio::join!(
@@ -1530,7 +858,7 @@ pub(crate) mod tests {
             "exactly one of two concurrent duplicate registrations should be accepted: {:?} / {:?}",
             first.result, second.result
         );
-        let steps = journal::load_steps(&*client.lock().await).await.unwrap();
+        let steps = client.journal_steps().await;
         assert_eq!(
             steps.len(),
             1,
@@ -1540,14 +868,13 @@ pub(crate) mod tests {
 
     #[tokio::test]
     async fn read_reflects_prior_dispatches_without_persisting_anything_new() {
-        let client = scratch_db("rust_host_dispatch_test_4").await;
-        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
+        let client = crate::dispatch_tests::tests::memory_store();
 
         handle(
             Host::new(
                 &client,
                 &wasm_path(),
-                &test_config("Banking", 1),
+                &crate::dispatch_tests::tests::memory_config("Banking"),
                 &lambda_client::NeverInvoker,
             ),
             "Banking::Customer.Register",
@@ -1574,19 +901,19 @@ pub(crate) mod tests {
 
         // The sharp proof a read never appends: the journal is exactly
         // as long after the read as it was before it.
-        let steps = journal::load_steps(&*client.lock().await).await.unwrap();
+        let steps = client.journal_steps().await;
         assert_eq!(steps.len(), 1, "a read must never persist a journal row");
     }
 
     // Records every call and answers with a canned "nothing refused"
     // body, proving a cross-domain policy reaches `lambda_client::deliver`
     // with the right name/payload end to end, short of a real AWS Lambda.
-    struct RecordingInvoker {
+    pub struct RecordingInvoker {
         calls: std::sync::Mutex<Vec<(String, String)>>,
     }
 
     impl RecordingInvoker {
-        fn new() -> Self {
+        pub fn new() -> Self {
             Self {
                 calls: std::sync::Mutex::new(Vec::new()),
             }
@@ -1613,15 +940,8 @@ pub(crate) mod tests {
 
     #[tokio::test]
     async fn a_cross_domain_policy_delivers_through_the_real_rehydrate_replay_path() {
-        let client = scratch_db("rust_host_dispatch_test_6").await;
-        provision_lineage(
-            &*client.lock().await,
-            "Banking",
-            1,
-            &["Customer", "Account"],
-        )
-        .await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
         let invoker = RecordingInvoker::new();
 
         handle(
@@ -1693,7 +1013,7 @@ pub(crate) mod tests {
             .find(|r| r["policy"] == "ReviewOnFreeze")
             .expect("ReviewOnFreeze should appear in \"reactions\" too");
         assert_eq!(merged["on"], "AccountFrozen");
-        assert_eq!(merged["trigger"], "Compliance::AccountFreezeReview.Open");
+        assert_eq!(merged["trigger"], "Compliance::Review.Open");
         assert_eq!(merged["delivered"], true);
 
         {
@@ -1704,9 +1024,10 @@ pub(crate) mod tests {
             let sent: serde_json::Value = serde_json::from_str(payload).unwrap();
             // Fully qualified, not the bare "Compliance.OpenReview":
             // generated match arms are always "Domain::Aggregate.Command",
-            // and Compliance's own aggregate is named `AccountFreezeReview`.
-            assert_eq!(sent["verb"], "Compliance::AccountFreezeReview.Open");
-            assert_eq!(sent["args"]["number"]["value"], "acct-freeze-me");
+            // and Compliance's own aggregate is named `Review`.
+            assert_eq!(sent["verb"], "Compliance::Review.Open");
+            assert_eq!(sent["args"]["subject_kind"], "account_freeze");
+            assert_eq!(sent["args"]["subject_key"], "acct-freeze-me");
         }
 
         // Never re-delivered on a later replay: `pending_cross_domain`
@@ -1734,9 +1055,8 @@ pub(crate) mod tests {
     // registry — real, corpus-declared.
     #[tokio::test]
     async fn a_role_gated_command_is_actually_checked_against_the_caller_role() {
-        let client = scratch_db("rust_host_dispatch_test_7").await;
-        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
 
         // The correct role succeeds, same as every other registration,
         // just now with a caller actually bound and matching.
@@ -1781,7 +1101,7 @@ pub(crate) mod tests {
 
         // And the refused command was never persisted — same discipline
         // every other refusal in this file is held to.
-        let steps = journal::load_steps(&*client.lock().await).await.unwrap();
+        let steps = client.journal_steps().await;
         assert_eq!(
             steps.len(),
             1,
@@ -1789,6 +1109,25 @@ pub(crate) mod tests {
         );
     }
 
+    // ADR 0081 keeps a needed fact the caller supplied, but only the host and its peers may: a
+    // request's `now` would move a time-window guard.
+    #[test]
+    fn only_a_request_from_outside_the_host_has_its_needed_facts_replaced() {
+        let ir = serde_json::json!({"name": "Lease", "aggregates": [{"name": "Slot", "commands": [
+            {"name": "Take", "attributes": [{"name": "now", "type": "Integer"}],
+             "needs": [{"fact": "now"}]}
+        ]}]});
+        let fill = |origin: Origin| {
+            let mut args = serde_json::json!({"with": {"now": 42}});
+            let clock = crate::needs::FixedClock(7);
+            fill_arguments(origin, &ir, "Lease::Slot.Take", &mut args, &clock);
+            args["with"]["now"].clone()
+        };
+        assert_eq!(fill(Origin::Request), serde_json::json!(7));
+        assert_eq!(fill(Origin::External), serde_json::json!(42));
+        assert_eq!(fill(Origin::HostInternal), serde_json::json!(42));
+    }
+
     #[test]
     fn enforcement_reads_off_shadow_and_enforce_and_treats_anything_else_as_off() {
         assert_eq!(Enforcement::parse(None), Enforcement::Off);
@@ -1825,9 +1164,8 @@ pub(crate) mod tests {
     #[tokio::test]
     async fn an_unidentified_caller_is_refused_when_enforced_and_let_through_when_off_or_shadowed()
     {
-        let client = scratch_db("rust_host_dispatch_test_enforce").await;
-        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
         let go = |mode: Enforcement, id: &'static str| {
             let client = &client;
             let config = &config;
@@ -1872,7 +1210,7 @@ pub(crate) mod tests {
             shadowed.result
         );
 
-        let steps = journal::load_steps(&*client.lock().await).await.unwrap();
+        let steps = client.journal_steps().await;
         assert_eq!(
             steps.len(),
             2,
@@ -1883,9 +1221,8 @@ pub(crate) mod tests {
     // Shadow may only let through what Off would: a caller that stated a wrong role is refused.
     #[tokio::test]
     async fn shadow_refuses_a_stated_wrong_role_and_still_lets_an_unidentified_caller_through() {
-        let client = scratch_db("rust_host_dispatch_test_shadow_stated").await;
-        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
         let go = |mode: Enforcement, origin: Origin, caller: Caller<'static>, id: &'static str| {
             let client = &client;
             let config = &config;
@@ -1938,7 +1275,7 @@ pub(crate) mod tests {
             nobody.result
         );
 
-        let steps = journal::load_steps(&*client.lock().await).await.unwrap();
+        let steps = client.journal_steps().await;
         assert_eq!(
             steps.len(),
             1,
@@ -1950,9 +1287,8 @@ pub(crate) mod tests {
     // unidentified caller is refused under enforce.
     #[tokio::test]
     async fn a_host_internal_dispatch_is_unchecked_under_enforce_but_an_external_one_is_refused() {
-        let client = scratch_db("rust_host_dispatch_test_internal").await;
-        provision_lineage(&*client.lock().await, "Banking", 1, &["Customer"]).await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
         let go = |mode: Enforcement, origin: Origin, id: &'static str| {
             let client = &client;
             let config = &config;
@@ -2263,15 +1599,8 @@ pub(crate) mod tests {
     #[tokio::test]
     async fn a_cross_domain_delivery_that_exhausts_every_retry_dead_letters_and_still_fails_the_invocation(
     ) {
-        let client = scratch_db("rust_host_dispatch_test_8").await;
-        provision_lineage(
-            &*client.lock().await,
-            "Banking",
-            1,
-            &["Customer", "Account"],
-        )
-        .await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
         let invoker = AlwaysFailingInvoker::new();
 
         handle(
@@ -2331,42 +1660,28 @@ pub(crate) mod tests {
         // The local command still committed: cross-domain delivery runs
         // strictly after commit, so a delivery failure never unwinds it.
         // The dead letter existing at all proves the match already ran.
-        let guard = client.lock().await;
-        let dead_letters = guard
-            .query("SELECT policy, target_domain, target_verb, attempts FROM hecks_cross_domain_dead_letters", &[])
-            .await
-            .unwrap();
+        let dead_letters = client.dead_letter_rows().await;
         assert_eq!(
             dead_letters.len(),
             1,
             "exactly one exhausted delivery should have been dead-lettered: {dead_letters:?}"
         );
-        let policy: String = dead_letters[0].get(0);
-        let target_domain: String = dead_letters[0].get(1);
-        let target_verb: String = dead_letters[0].get(2);
-        let attempts: i32 = dead_letters[0].get(3);
+        let (policy, target_domain, target_verb, attempts) = dead_letters[0].clone();
         assert_eq!(policy, "ReviewOnFreeze");
         assert_eq!(target_domain, "Compliance");
-        assert_eq!(target_verb, "Compliance::AccountFreezeReview.Open");
+        assert_eq!(target_verb, "Compliance::Review.Open");
         assert_eq!(attempts, lambda_client::MAX_DELIVERY_ATTEMPTS as i32);
     }
 
     // Pins a real drop: a second cross-domain reaction from the same
     // step must not go dark just because the first one's delivery
     // exhausted its retries. `SafeDepositBox.Surrender` emits both
-    // `BoxSurrendered` (-> Compliance) and `KeyReturnDue` (-> Notifications)
+    // `BoxSurrendered` (-> Compliance) and `KeyReturnRequested` (-> Notifications)
     // from one command.
     #[tokio::test]
     async fn a_failed_cross_domain_delivery_does_not_drop_a_sibling_reaction_from_the_same_step() {
-        let client = scratch_db("rust_host_dispatch_test_11").await;
-        provision_lineage(
-            &*client.lock().await,
-            "Banking",
-            1,
-            &["Customer", "SafeDepositBox"],
-        )
-        .await;
-        let config = test_config("Banking", 1);
+        let client = crate::dispatch_tests::tests::memory_store();
+        let config = crate::dispatch_tests::tests::memory_config("Banking");
         let invoker = AlwaysFailingInvoker::new();
 
         handle(
@@ -2422,19 +1737,224 @@ pub(crate) mod tests {
              the fix under test is exactly this: a fresh Vec would only ever show one policy's worth"
         );
 
-        let guard = client.lock().await;
-        let dead_letters = guard
-            .query(
-                "SELECT policy FROM hecks_cross_domain_dead_letters ORDER BY policy",
-                &[],
-            )
+        let policies: Vec<String> = client
+            .dead_letter_rows()
             .await
-            .unwrap();
-        let policies: Vec<String> = dead_letters.iter().map(|row| row.get(0)).collect();
+            .into_iter()
+            .map(|row| row.0)
+            .collect();
         assert_eq!(
             policies,
             vec!["FlagKeyReturn".to_string(), "ReviewOnBoxSurrender".to_string()],
             "BOTH sibling reactions must be dead-lettered, not just whichever ran first: {policies:?}"
         );
     }
+    /// The wasm plugin fixture (spec/fixtures/rust_host/pluginned): its kernel and its IR, which
+    /// carries the doubler plugin that answers `Ledger.Doubled` and refuses `Ledger.Tripled`.
+    fn pluginned() -> (std::path::PathBuf, serde_json::Value) {
+        let dist = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../dist");
+        let ir = std::fs::read_to_string(dist.join("pluginned.ir.json"))
+            .expect("build the pluginned fixture");
+        (
+            dist.join("pluginned.wasm"),
+            serde_json::from_str(&ir).unwrap(),
+        )
+    }
+
+    async fn ask_pluginned(
+        client: &Store,
+        question: &str,
+        args: serde_json::Value,
+    ) -> serde_json::Value {
+        let (wasm, ir) = pluginned();
+        let asked = serde_json::json!({ "query": question, "args": args });
+        crate::query_step::answer(&asked, Some(&ir), "Pluginned", client, &wasm)
+            .await
+            .unwrap()
+    }
+
+    /// A query a wasm plugin answers, end to end: a command through the real kernel stores the
+    /// ledger, and the query step hands the plugin that record's state, read back from Postgres.
+    #[tokio::test]
+    async fn a_plugin_answers_with_the_referenced_record_as_stored() {
+        let client = scratch_db("rust_host_dispatch_test_plugin").await;
+        provision_lineage(&*client.lock().await, "Pluginned", 1, &["Ledger"]).await;
+        let (wasm, _) = pluginned();
+        let config = test_config("Pluginned", 1);
+        let opened = handle(
+            Host::new(&client, &wasm, &config, &lambda_client::NeverInvoker),
+            "Pluginned::Ledger.Open",
+            serde_json::json!({ "name": { "value": "house" }, "note": { "value": "rent" } }),
+            None,
+        )
+        .await
+        .unwrap();
+        assert!(
+            opened.accepted,
+            "opening the ledger: {}",
+            opened.result["refusals"]
+        );
+
+        let answer = ask_pluginned(
+            &client,
+            "Pluginned::Ledger.Doubled",
+            serde_json::json!({ "entry": "house", "amount": 21 }),
+        )
+        .await;
+
+        assert_eq!(
+            answer["queries"][0]["rows"],
+            serde_json::json!([{ "amount": 42, "note": "rent" }])
+        );
+    }
+
+    #[tokio::test]
+    async fn a_plugin_refusal_and_a_missing_record_come_back_as_refusals() {
+        let client = scratch_db("rust_host_dispatch_test_plugin_refusals").await;
+        provision_lineage(&*client.lock().await, "Pluginned", 1, &["Ledger"]).await;
+
+        let refused = ask_pluginned(
+            &client,
+            "Pluginned::Ledger.Tripled",
+            serde_json::json!({ "amount": 1 }),
+        )
+        .await;
+        let missing = ask_pluginned(
+            &client,
+            "Pluginned::Ledger.Doubled",
+            serde_json::json!({ "entry": "nowhere", "amount": 1 }),
+        )
+        .await;
+
+        assert_eq!(refused["refusals"][0]["kind"], "PluginRefusal");
+        let refusal = refused["refusals"][0]["error"].as_str().unwrap();
+        assert!(
+            refusal.contains("doubler does not answer Pluginned::Ledger.Tripled"),
+            "{refusal}"
+        );
+        assert_eq!(missing["refusals"][0]["kind"], "NotFound");
+        assert_eq!(
+            missing["refusals"][0]["error"],
+            "entry: no Ledger \"nowhere\""
+        );
+    }
+}
+
+#[cfg(test)]
+mod preview_tests {
+    use crate::dispatch_tests::tests::{memory_config, memory_store, register, wasm_path};
+    use crate::host::Host;
+    use crate::journal;
+    use crate::lambda_client;
+    use crate::store::{Accepted, DeadLetter, LineageWrite, Store, StoreExt, StoreFixtures};
+    use crate::wasm_runner;
+    use rust_host_core::dispatch::*;
+    use std::path::Path;
+
+    // The client envelope a preview of `verb` answers for `invocation`.
+    async fn preview_of(
+        client: &Store,
+        verb: &str,
+        invocation: serde_json::Value,
+    ) -> serde_json::Value {
+        let config = memory_config("Banking");
+        let wasm = wasm_path();
+        let host = Host::new(client, &wasm, &config, &lambda_client::NeverInvoker);
+        let outcome = preview_as(host, verb, invocation, Caller::default())
+            .await
+            .unwrap();
+        crate::validation::answer(&outcome.result)
+    }
+
+    async fn preview(client: &Store, facts: serde_json::Value) -> serde_json::Value {
+        preview_of(
+            client,
+            "Banking::Customer.Register",
+            facts_invocation(facts).unwrap(),
+        )
+        .await
+    }
+
+    async fn register_for_real(client: &Store, id: &str) -> Outcome {
+        let config = memory_config("Banking");
+        let wasm = wasm_path();
+        let host = Host::new(client, &wasm, &config, &lambda_client::NeverInvoker);
+        handle_facts(host, "Banking::Customer.Register", register(id), None)
+            .await
+            .unwrap()
+    }
+
+    #[tokio::test]
+    async fn a_preview_of_an_acceptable_command_answers_ok_and_keeps_nothing() {
+        let client = memory_store();
+        assert_eq!(
+            preview(&client, register("CUST-P1")).await,
+            serde_json::json!({ "ok": true, "refusals": [] })
+        );
+        assert!(
+            register_for_real(&client, "CUST-P1").await.accepted,
+            "the preview left a record behind, so the real registration was refused"
+        );
+    }
+
+    #[tokio::test]
+    async fn a_preview_of_a_refused_command_answers_why_with_its_kind_and_stage() {
+        let client = memory_store();
+        register_for_real(&client, "CUST-P2").await;
+        let answer = preview(&client, register("CUST-P2")).await;
+        assert_eq!(answer["ok"], false);
+        let refusal = &answer["refusals"][0];
+        assert_eq!(refusal["refusal"], "AlreadyExists");
+        assert_eq!(
+            (refusal["kind"].as_str(), refusal["stage"].as_str()),
+            (Some("refused"), Some("state"))
+        );
+    }
+
+    #[tokio::test]
+    async fn a_preview_names_an_unknown_argument_in_the_arguments_stage() {
+        let client = memory_store();
+        let mut facts = register("CUST-P3");
+        facts["bogus"] = serde_json::json!(1);
+        let answer = preview(&client, facts).await;
+        let refusal = &answer["refusals"][0];
+        assert_eq!(refusal["refusal"], "UnknownArgument");
+        assert_eq!(refusal["stage"], "arguments");
+    }
+
+    #[tokio::test]
+    async fn a_preview_against_an_existing_record_is_routed_to_it() {
+        let client = memory_store();
+        register_for_real(&client, "CUST-P4").await;
+        let close = routed_invocation(serde_json::json!("CUST-P4"), serde_json::json!({})).unwrap();
+        assert_eq!(
+            preview_of(&client, "Banking::Customer.Close", close).await,
+            serde_json::json!({ "ok": true, "refusals": [] })
+        );
+    }
+
+    #[tokio::test]
+    async fn a_preview_against_a_record_that_does_not_exist_is_kind_not_found() {
+        let client = memory_store();
+        let close = routed_invocation(serde_json::json!("NOBODY"), serde_json::json!({})).unwrap();
+        let answer = preview_of(&client, "Banking::Customer.Close", close).await;
+        assert_eq!(answer["ok"], false);
+        assert_eq!(answer["refusals"][0]["kind"], "not_found");
+    }
+
+    // The body protocol: `"dry_run": true` beside a command, answered as the client envelope even
+    // when the request also asks for `bare`.
+    #[tokio::test]
+    async fn the_body_protocol_answers_a_dry_run_as_the_client_envelope() {
+        let client = memory_store();
+        let config = memory_config("Banking");
+        let wasm = wasm_path();
+        let host = Host::new(&client, &wasm, &config, &lambda_client::NeverInvoker);
+        let body = serde_json::json!({
+            "verb": "Banking::Customer.Register", "with": register("CUST-P5"),
+            "dry_run": true, "bare": true,
+        });
+        let answer = crate::server::dispatch_body(body, host).await.unwrap();
+        assert_eq!(answer, serde_json::json!({ "ok": true, "refusals": [] }));
+    }
 }