hecks 5.0.0 → 6.0.0

data/rust/src/kernel/mod.rs

@@ -1,16 +1,15 @@
 //! Hand-written, domain-agnostic floor that every generated per-command function calls into.
 
-pub mod attribute_shapes;
 pub mod cli;
+pub mod collecting;
 pub mod dispatch;
-pub mod expr;
-pub mod expression_operators;
 pub mod json;
 pub mod named_query;
 pub mod needs;
 pub mod orchestrate;
 pub mod pattern;
 pub mod present;
+pub mod query_cursor;
 pub mod query_ordering;
 pub mod vocab;
 // Kept at its old path so existing `refusal_wording::RefusalSite` call sites still resolve.
@@ -20,7 +19,6 @@ pub mod read_model;
 pub mod reference_lookup;
 pub mod repository;
 pub mod routing;
-pub mod ruby_float;
 
 pub use dispatch::{
     aggregate_step_site, apply_entity_command, decode_aggregate_arguments, decode_entity_arguments,
@@ -32,6 +30,9 @@ pub use expr::{
     StripSide, Value, WithParent,
 };
 pub use json::Json;
+// The expression evaluator, its operators and the refusal type are their own crate, shared with
+// the host; the kernel re-exports them so every `crate::kernel::expr::…` path keeps working.
+pub use hecks_expr::{attribute_shapes, expr, expression_operators, ruby_float, Refusal};
 pub use named_query::{QueryCondition, QueryConditionValue, QueryDef};
 pub use orchestrate::{
     orchestrate, CompletedCompensation, CrossDomainPolicyRule, DispatchSpec, Handler,
@@ -45,8 +46,8 @@ pub use reference_lookup::{
 };
 pub use refusal_wording::RefusalSite;
 pub use repository::{
-    check_reference, check_role_via, filter_entries, holds_role_via, row_json, AggregateScan,
-    InMemoryRepository, Repository,
+    check_reference, check_role_via, check_roles_via, filter_entries, holds_role_via, row_json,
+    AggregateScan, InMemoryRepository, Repository,
 };
 pub use routing::{CommandInvocation, RoutingEnvelope};
 
@@ -67,67 +68,6 @@ pub struct Event {
     pub correlation: Option<std::collections::HashMap<String, String>>,
 }
 
-/// Why a command dispatch was refused; each variant carries the refusal message.
-///
-/// Ruby's `UnknownVerb` has no variant: routing an unknown command name happens before dispatch.
-/// `AbsentArgument` and `UnknownArgument` are raised only at the JSON boundary (`from_json`),
-/// where the input has no static shape; typed args structs make them unconstructible afterwards.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Refusal {
-    GivenNotMet(String),
-    EnsuresNotMet(String),
-    InvariantViolation(String),
-    LifecycleRefused(String),
-    AlreadyExists(String),
-    NotFound(String),
-    TypeMismatch(String),
-    AbsentArgument(String),
-    UnknownArgument(String),
-    Unauthorized(String),
-    Fault(String),
-    /// `corrects` against a record that never emitted the corrected event.
-    NothingToCorrect(String),
-}
-
-impl Refusal {
-    /// The refusal class name, spelled as Ruby raises it; the semantics corpus compares it.
-    pub const fn kind(&self) -> &'static str {
-        match self {
-            Self::GivenNotMet(_) => "GivenNotMet",
-            Self::EnsuresNotMet(_) => "EnsuresNotMet",
-            Self::InvariantViolation(_) => "InvariantViolation",
-            Self::LifecycleRefused(_) => "LifecycleRefused",
-            Self::AlreadyExists(_) => "AlreadyExists",
-            Self::NotFound(_) => "NotFound",
-            Self::TypeMismatch(_) => "TypeMismatch",
-            Self::AbsentArgument(_) => "AbsentArgument",
-            Self::UnknownArgument(_) => "UnknownArgument",
-            Self::Unauthorized(_) => "Unauthorized",
-            Self::Fault(_) => "Fault",
-            Self::NothingToCorrect(_) => "NothingToCorrect",
-        }
-    }
-}
-
-impl std::fmt::Display for Refusal {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::GivenNotMet(msg)
-            | Self::EnsuresNotMet(msg)
-            | Self::InvariantViolation(msg)
-            | Self::LifecycleRefused(msg)
-            | Self::AlreadyExists(msg)
-            | Self::NotFound(msg)
-            | Self::TypeMismatch(msg)
-            | Self::AbsentArgument(msg)
-            | Self::UnknownArgument(msg)
-            | Self::Unauthorized(msg)
-            | Self::Fault(msg)
-            | Self::NothingToCorrect(msg) => write!(f, "{msg}"),
-        }
-    }
-}
-
 /// The saved record plus the events it raised, or a refusal that leaves state untouched.
 pub type DispatchResult<T> = Result<(T, Vec<Event>), Refusal>;
 

data/rust/src/kernel/named_query.rs

@@ -3,7 +3,8 @@
 
 use super::refusal_wording::UnauthorizedTenantRequiredArgs;
 use super::{
-    query_comparators::QueryComparator, query_ordering, repository, AggregateScan, Json, Refusal,
+    query_comparators::QueryComparator, query_cursor, query_ordering, repository, AggregateScan,
+    Json, Refusal,
 };
 
 /// One declared query, compiled.
@@ -20,6 +21,8 @@ pub struct QueryDef {
     pub order_by: Option<query_ordering::OrderBy>,
     pub offset: Option<query_ordering::Offset>,
     pub limit: Option<query_ordering::Limit>,
+    /// `cursor` is declared: `limit` is the page size and the call's `after` names the position.
+    pub cursor: bool,
     /// `None` when no `authorize` is declared, or it declares no `tenant:`.
     pub authorization: Option<TenantAuth>,
 }
@@ -58,6 +61,21 @@ pub enum QueryConditionValue {
     /// A caller-bound attribute name, read from the call's `args`; a missing key reads as
     /// `Json::Null`, as Ruby's `resolve_query_value` does.
     Arg(&'static str),
+    /// `where(field: nil)`: resolves to `Json::Null`, which a field that is unset or null equals,
+    /// as `nil == nil` holds in Ruby. Emitted for an `eq`/`ne` against nil.
+    Null,
+}
+
+impl QueryConditionValue {
+    /// The operand this condition compares a row's field against, before `comparable` reduces it.
+    pub fn resolve(self, args: &Json) -> Json {
+        match self {
+            Self::Literal(text) => Json::Str(text.to_string()),
+            Self::NumericLiteral(n) => Json::Num(n, None),
+            Self::Arg(name) => args.get(name).cloned().unwrap_or(Json::Null),
+            Self::Null => Json::Null,
+        }
+    }
 }
 
 /// Runs a declared query: chained `filter_entries` per condition (keeping id order), then
@@ -98,11 +116,7 @@ pub fn run_cross_domain(
         .conditions
         .iter()
         .map(|condition| {
-            let want = match condition.value {
-                QueryConditionValue::Literal(text) => Json::Str(text.to_string()),
-                QueryConditionValue::NumericLiteral(n) => Json::Num(n, None),
-                QueryConditionValue::Arg(name) => args.get(name).cloned().unwrap_or(Json::Null),
-            };
+            let want = condition.value.resolve(args);
             (condition, super::query_comparators::comparable(&want))
         })
         .collect();
@@ -133,6 +147,10 @@ pub fn run_cross_domain(
         store,
     )?;
 
+    if def.cursor {
+        return cursor_rows(entries, def, args);
+    }
+
     Ok(query_ordering::apply(
         entries,
         def.order_by.as_ref(),
@@ -142,6 +160,49 @@ pub fn run_cross_domain(
     ))
 }
 
+/// The ordered rows after the call's `after`, capped at the page size.
+fn cursor_rows(
+    entries: Vec<(String, Json)>,
+    def: &QueryDef,
+    args: &Json,
+) -> Result<Vec<(String, Json)>, Refusal> {
+    let ordered = query_ordering::apply(entries, def.order_by.as_ref(), None, None, args);
+    let after = args.get("after").and_then(Json::as_str);
+    let mut rows = query_cursor::rows_after(ordered, def.order_by.as_ref(), after)?;
+    if let Some(limit) = def.limit.as_ref() {
+        rows.truncate(query_ordering::resolve_limit(limit, args));
+    }
+    Ok(rows)
+}
+
+/// One page of a cursor query: its rows, and the token of the page after them.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Page {
+    pub rows: Vec<(String, Json)>,
+    /// `None` on the last page.
+    pub after: Option<String>,
+}
+
+/// `run`, asked for one row past the page: that row proves a next page exists and is not answered.
+pub fn run_page(
+    store: &impl AggregateScan,
+    def: &QueryDef,
+    args: &Json,
+    caller_role: Option<&str>,
+) -> Result<Page, Refusal> {
+    let size = def
+        .limit
+        .as_ref()
+        .map_or(0, |limit| query_ordering::resolve_limit(limit, args));
+    let widened = QueryDef {
+        limit: Some(query_ordering::Limit::Literal(size as i64 + 1)),
+        ..*def
+    };
+    let rows = run(store, &widened, args, caller_role)?;
+    let (rows, after) = query_cursor::split_page(rows, def.order_by.as_ref(), size);
+    Ok(Page { rows, after })
+}
+
 /// Finds a query by verb; a linear scan is enough for the small generated `QUERIES` table.
 pub fn find<'a>(table: &'a [QueryDef], verb: &str) -> Option<&'a QueryDef> {
     table.iter().find(|def| def.verb == verb)
@@ -193,11 +254,7 @@ pub fn run_entity(
     }
 
     for condition in def.conditions {
-        let want = match condition.value {
-            QueryConditionValue::Literal(text) => Json::Str(text.to_string()),
-            QueryConditionValue::NumericLiteral(n) => Json::Num(n, None),
-            QueryConditionValue::Arg(name) => args.get(name).cloned().unwrap_or(Json::Null),
-        };
+        let want = condition.value.resolve(args);
         entries = repository::filter_entries(entries, condition.field, condition.comparator, &want);
     }
 
@@ -265,3 +322,160 @@ fn row_under_parent(parent_key: &str, parent_id: String, element: Json) -> Json
     }
     Json::Object(fields)
 }
+
+#[cfg(test)]
+mod cursor_tests {
+    use super::*;
+    use crate::kernel::query_ordering::{Limit, NullsMode, OrderBy};
+
+    struct Rows(Vec<(String, Json)>);
+
+    impl AggregateScan for Rows {
+        fn scan(&self, aggregate: &str) -> Option<Vec<(String, Json)>> {
+            (aggregate == "Shop::Item").then(|| self.0.clone())
+        }
+    }
+
+    fn item(id: &str, rank: i64) -> (String, Json) {
+        (id.to_string(), Json::obj(vec![("rank", Json::int(rank))]))
+    }
+
+    fn paged() -> QueryDef {
+        QueryDef {
+            verb: "Shop::Item.Paged",
+            aggregate: "Shop::Item",
+            conditions: &[],
+            reference_hop_conditions: &[],
+            order_by: Some(OrderBy {
+                field: "rank",
+                descending: false,
+                nulls: NullsMode::Native,
+            }),
+            offset: None,
+            limit: Some(Limit::Literal(2)),
+            cursor: true,
+            authorization: None,
+        }
+    }
+
+    fn walk(store: &Rows) -> Vec<Vec<String>> {
+        let (mut pages, mut after) = (Vec::new(), None::<String>);
+        loop {
+            let args = after.as_deref().map_or_else(
+                || Json::obj(vec![]),
+                |a| Json::obj(vec![("after", Json::str(a))]),
+            );
+            let page = run_page(store, &paged(), &args, None).unwrap();
+            pages.push(page.rows.iter().map(|(id, _)| id.clone()).collect());
+            match page.after {
+                Some(next) => after = Some(next),
+                None => return pages,
+            }
+        }
+    }
+
+    #[test]
+    fn walking_pages_yields_every_row_in_order_with_ties_by_identity() {
+        let store = Rows(vec![
+            item("b", 1),
+            item("a", 2),
+            item("d", 2),
+            item("c", 2),
+            item("e", 3),
+        ]);
+        assert_eq!(
+            walk(&store),
+            vec![vec!["b", "a"], vec!["c", "d"], vec!["e"]]
+        );
+    }
+
+    #[test]
+    fn a_page_after_the_last_row_is_empty_with_no_next_position() {
+        let store = Rows(vec![item("a", 1)]);
+        let token = query_cursor::encode(&Json::int(1), "a");
+        let page = run_page(
+            &store,
+            &paged(),
+            &Json::obj(vec![("after", Json::str(token))]),
+            None,
+        )
+        .unwrap();
+        assert_eq!(
+            page,
+            Page {
+                rows: vec![],
+                after: None
+            }
+        );
+    }
+}
+
+#[cfg(test)]
+mod null_condition_tests {
+    use super::{run, AggregateScan, QueryCondition, QueryConditionValue, QueryDef};
+    use crate::kernel::query_comparators::QueryComparator;
+    use crate::kernel::Json;
+
+    struct Rows(Vec<(String, Json)>);
+
+    impl AggregateScan for Rows {
+        fn scan(&self, aggregate: &str) -> Option<Vec<(String, Json)>> {
+            (aggregate == "Grant").then(|| self.0.clone())
+        }
+    }
+
+    const EQ_NULL: &[QueryCondition] = &[QueryCondition {
+        field: "ends_at",
+        comparator: QueryComparator::Eq,
+        value: QueryConditionValue::Null,
+    }];
+    const NE_NULL: &[QueryCondition] = &[QueryCondition {
+        field: "ends_at",
+        comparator: QueryComparator::Ne,
+        value: QueryConditionValue::Null,
+    }];
+
+    fn query(conditions: &'static [QueryCondition]) -> QueryDef {
+        QueryDef {
+            verb: "Grant.Live",
+            aggregate: "Grant",
+            conditions,
+            reference_hop_conditions: &[],
+            order_by: None,
+            offset: None,
+            limit: None,
+            cursor: false,
+            authorization: None,
+        }
+    }
+
+    fn rows() -> Rows {
+        let ended = Json::obj(vec![(
+            "ends_at",
+            Json::obj(vec![("value", Json::str("2026-01-01".to_string()))]),
+        )]);
+        let null = Json::obj(vec![("ends_at", Json::Null)]);
+        let absent = Json::obj(vec![("role", Json::str("Admin".to_string()))]);
+        Rows(vec![
+            ("ended".to_string(), ended),
+            ("null".to_string(), null),
+            ("absent".to_string(), absent),
+        ])
+    }
+
+    fn ids(conditions: &'static [QueryCondition]) -> Vec<String> {
+        let found = run(&rows(), &query(conditions), &Json::obj(vec![]), None).unwrap();
+        found.into_iter().map(|(id, _)| id).collect()
+    }
+
+    // `where(ends_at: nil)`: a field that is null or unset equals nil, as in Ruby.
+    #[test]
+    fn eq_null_keeps_the_rows_whose_field_is_null_or_unset() {
+        assert_eq!(ids(EQ_NULL), ["absent", "null"]);
+    }
+
+    #[test]
+    fn ne_null_keeps_the_rows_whose_field_is_set() {
+        assert_eq!(ids(NE_NULL), ["ended"]);
+    }
+}

data/rust/src/kernel/orchestrate.rs

@@ -36,9 +36,13 @@ pub struct CrossDomainPolicyRule {
     pub where_expr: Option<fn() -> Expr>,
     pub target_domain: &'static str,
     pub target_verb: &'static str,
+    /// `trigger ..., with:` as `(argument_name, binding)` pairs, read as a local policy's is;
+    /// empty forwards the payload unchanged.
+    pub with_spec: &'static [(&'static str, &'static str)],
 }
 
-/// A matched cross-domain reaction the host must deliver; the payload is forwarded unchanged.
+/// A matched cross-domain reaction the host must deliver. The payload is the event's payload
+/// unchanged, or the policy's `with:` projection of it.
 #[derive(Clone)]
 pub struct PendingCrossDomainReaction {
     pub policy_name: String,
@@ -443,6 +447,60 @@ fn offer_row_fields(source: &mut Vec<(String, Json)>, row_id: &str, record: &Jso
     }
 }
 
+// An explicit projection may read the emitting record's identity, offered under the aggregate's
+// identity head unless the payload already carries it.
+fn offer_emitter_head(source: &mut Vec<(String, Json)>, event: &Event, tables: &Tables) {
+    if let Some(head) = (tables.identity_head_fn)(&event.aggregate) {
+        if !event.id.is_empty() && !source.iter().any(|(name, _)| name == head) {
+            source.push((head.to_string(), Json::str(event.id.clone())));
+        }
+    }
+}
+
+// The emitting record's whole identity as `id`, unless the source already holds an `id`.
+fn offer_emitter_id(source: &mut Vec<(String, Json)>, event: &Event) {
+    if !event.id.is_empty() && !source.iter().any(|(name, _)| name == "id") {
+        source.push(("id".to_string(), Json::str(event.id.clone())));
+    }
+}
+
+// Reads a `with:` against a source: a binding starting with ":" names a source field (null when
+// absent), any other is a rendered literal.
+fn resolve_with_spec(with_spec: &[(&str, &str)], source: &[(String, Json)]) -> Vec<(String, Json)> {
+    with_spec
+        .iter()
+        .map(|(name, binding)| {
+            let value = binding.strip_prefix(':').map_or_else(
+                || read_literal_wire(binding),
+                |field| {
+                    source
+                        .iter()
+                        .find(|(held, _)| held == field)
+                        .map_or(Json::Null, |(_, held)| held.clone())
+                },
+            );
+            ((*name).to_string(), value)
+        })
+        .collect()
+}
+
+// What a cross-domain reaction is delivered with: the payload unchanged when the policy declares
+// no `with:`, otherwise the projection of it, read as a local trigger reads one. It is not sliced
+// to the target's attributes: the target's command lives in the other domain, whose tables this
+// one does not hold, and that domain refuses an argument its command does not take.
+fn cross_domain_payload(policy: &CrossDomainPolicyRule, event: &Event, tables: &Tables) -> Json {
+    if policy.with_spec.is_empty() {
+        return event.payload.clone();
+    }
+    let mut source: Vec<(String, Json)> = match &event.payload {
+        Json::Object(pairs) => pairs.clone(),
+        _ => Vec::new(),
+    };
+    offer_emitter_head(&mut source, event, tables);
+    offer_emitter_id(&mut source, event);
+    Json::Object(resolve_with_spec(policy.with_spec, &source))
+}
+
 fn where_holds(where_expr: Option<fn() -> Expr>, event: &Event) -> bool {
     let Some(build) = where_expr else { return true };
     let ctx = EvalContext {
@@ -525,34 +583,17 @@ fn trigger_args_with_row(
         return Json::Object(source);
     }
 
-    // An explicit projection may read the emitting record's identity, offered under the
-    // aggregate's identity head unless the payload already carries it.
-    if let Some(head) = (tables.identity_head_fn)(&event.aggregate) {
-        if !event.id.is_empty() && !source.iter().any(|(name, _)| name == head) {
-            source.push((head.to_string(), Json::str(event.id.clone())));
-        }
-    }
+    offer_emitter_head(&mut source, event, tables);
 
     if let Some((row_id, record)) = row {
         offer_row_fields(&mut source, row_id, record);
     }
 
-    let projected = policy
-        .with_spec
-        .iter()
-        .map(|(name, binding)| {
-            let value = binding.strip_prefix(':').map_or_else(
-                || read_literal_wire(binding),
-                |field| {
-                    source
-                        .iter()
-                        .find(|(held, _)| held == field)
-                        .map_or(Json::Null, |(_, held)| held.clone())
-                },
-            );
-            ((*name).to_string(), value)
-        })
-        .collect();
+    // Below a fan-out row's own `id` and a payload field of that name, as Ruby's `emitter_id`
+    // lends it.
+    offer_emitter_id(&mut source, event);
+
+    let projected = resolve_with_spec(policy.with_spec, &source);
     // Only an explicit `with:` is split; an undeclared projection forwards the payload unsplit.
     let routed = split_routed_args(Json::Object(projected), target_verb, tables);
     // Fallback when nothing named the target's identity: the source's own is the receiver for a
@@ -848,7 +889,7 @@ impl<S: AggregateScan> Cascade<'_, S> {
                 event_name: event.name.clone(),
                 target_domain: policy.target_domain.to_string(),
                 target_verb: policy.target_verb.to_string(),
-                payload: event.payload.clone(),
+                payload: cross_domain_payload(policy, event, &tables),
             });
         }
     }
@@ -1894,6 +1935,153 @@ mod tests {
         ])
     }
 
+    fn review_attributes(verb: &str) -> &'static [&'static str] {
+        if verb == "Other::Review.Open" {
+            &["subject_kind", "subject_key"]
+        } else {
+            &[]
+        }
+    }
+
+    fn id_fixture_tables() -> Tables<'static> {
+        Tables {
+            command_attributes_fn: review_attributes,
+            ..routed_fixture_tables()
+        }
+    }
+
+    fn id_policy() -> PolicyRule {
+        PolicyRule {
+            policy_name: "ReadsTheEmittersId",
+            event_name: "Surrendered",
+            event_qualifier: None,
+            target_verb: "Other::Review.Open",
+            where_expr: None,
+            for_each: None,
+            for_each_key: None,
+            with_spec: &[("subject_key", ":id"), ("subject_kind", "\"box\"")],
+        }
+    }
+
+    fn emitted(id: &str, payload: Json) -> Event {
+        Event {
+            name: "Surrendered".to_string(),
+            aggregate: "Widgets::Box".to_string(),
+            id: id.to_string(),
+            payload,
+            occurred_at: None,
+            correlation: None,
+        }
+    }
+
+    fn cross_policy(with_spec: &'static [(&'static str, &'static str)]) -> CrossDomainPolicyRule {
+        CrossDomainPolicyRule {
+            policy_name: "ReviewElsewhere",
+            event_name: "Surrendered",
+            event_qualifier: None,
+            where_expr: None,
+            target_domain: "Other",
+            target_verb: "Other::Review.Open",
+            with_spec,
+        }
+    }
+
+    #[test]
+    fn a_cross_domain_reaction_without_a_with_forwards_the_payload_unchanged() {
+        let payload = Json::obj(vec![("branch", Json::str("BR1"))]);
+        let event = emitted("BR1:42", payload.clone());
+
+        let sent = cross_domain_payload(&cross_policy(&[]), &event, &id_fixture_tables());
+
+        assert_eq!(sent, payload);
+    }
+
+    #[test]
+    fn a_cross_domain_reaction_delivers_its_with_projection_and_not_the_payload() {
+        let event = emitted("BR1:42", Json::obj(vec![("branch", Json::str("BR1"))]));
+        let with = &[
+            ("subject_kind", "\"box\""),
+            ("subject_key", ":id"),
+            ("branch", ":branch"),
+        ];
+
+        let sent = cross_domain_payload(&cross_policy(with), &event, &id_fixture_tables());
+
+        assert_eq!(
+            sent,
+            Json::obj(vec![
+                ("subject_kind", Json::str("box")),
+                ("subject_key", Json::str("BR1:42")),
+                ("branch", Json::str("BR1")),
+            ])
+        );
+    }
+
+    #[test]
+    fn a_projection_reads_the_emitting_records_whole_identity_as_id() {
+        let event = emitted("BR1:42", Json::obj(vec![("branch", Json::str("BR1"))]));
+
+        let args = trigger_args(
+            &id_policy(),
+            &event,
+            None,
+            "Other::Review.Open",
+            &id_fixture_tables(),
+        );
+
+        assert_eq!(
+            args,
+            Json::obj(vec![
+                ("subject_key", Json::str("BR1:42")),
+                ("subject_kind", Json::str("box"))
+            ])
+        );
+    }
+
+    #[test]
+    fn a_payload_field_named_id_wins_over_the_emitting_records_identity() {
+        let event = emitted("BR1:42", Json::obj(vec![("id", Json::str("from-payload"))]));
+
+        let args = trigger_args(
+            &id_policy(),
+            &event,
+            None,
+            "Other::Review.Open",
+            &id_fixture_tables(),
+        );
+
+        assert_eq!(
+            args,
+            Json::obj(vec![
+                ("subject_key", Json::str("from-payload")),
+                ("subject_kind", Json::str("box"))
+            ])
+        );
+    }
+
+    #[test]
+    fn a_fan_out_rows_own_id_wins_over_the_emitting_records_identity() {
+        let event = emitted("BR1:42", Json::obj(vec![]));
+        let record = Json::obj(vec![("status", Json::str("open"))]);
+
+        let args = trigger_args_with_row(
+            &id_policy(),
+            &event,
+            Some(("box", "row-7")),
+            Some(("row-7", &record)),
+            "Other::Review.Open",
+            &id_fixture_tables(),
+        );
+
+        assert_eq!(
+            args,
+            Json::obj(vec![
+                ("subject_key", Json::str("row-7")),
+                ("subject_kind", Json::str("box"))
+            ])
+        );
+    }
+
     #[test]
     fn split_routed_args_routes_a_value_object_identity_as_the_receiver() {
         // A value-object identity is `{"value": ...}` in an event payload and forwards as that

data/rust/src/kernel/orchestrate_guard_tests.rs

@@ -94,6 +94,7 @@ const fn cross(name: &'static str, event_name: &'static str) -> CrossDomainPolic
         where_expr: None,
         target_domain: "Other",
         target_verb: "Other::Do",
+        with_spec: &[],
     }
 }
 
@@ -155,6 +156,7 @@ static QUERIES: [crate::kernel::QueryDef; 1] = [crate::kernel::QueryDef {
     order_by: None,
     offset: None,
     limit: None,
+    cursor: false,
     authorization: None,
 }];
 
@@ -908,6 +910,7 @@ const READS_ORDER_ID: crate::kernel::QueryDef = crate::kernel::QueryDef {
     order_by: None,
     offset: None,
     limit: None,
+    cursor: false,
     authorization: None,
 };