hecks 5.0.0 → 7.0.0

data/rust/src/kernel/dispatch.rs

@@ -1,6 +1,7 @@
 //! Generic dispatch loops over the declared `AggregateStep`/`EntityStep` order.
 //! Argument gates run in `decode_*_arguments`, before the router resolves identity.
 
+use super::collecting::{self, Detail};
 use super::expr::{
     interpret, EvalContext, Expr, Field, Fielded, NoFields, StateFirst, Value, WithOld, WithParent,
 };
@@ -49,22 +50,26 @@ pub fn enforce_invariants(
     aggregate_name: &str,
     set: &InvariantSet,
 ) -> Result<(), Refusal> {
+    let stage = collecting::mark();
     for rule in &set.aggregate {
         let ctx = EvalContext {
             args: &NoFields,
             instance: record,
         };
         if !interpret(&rule.expr, &ctx)?.truthy() {
-            return Err(Refusal::InvariantViolation(format!(
-                "{aggregate_name} refused — {}",
-                rule.description
-            )));
+            collecting::refuse_with(
+                Refusal::InvariantViolation(format!(
+                    "{aggregate_name} refused — {}",
+                    rule.description
+                )),
+                Detail::rule(rule.description),
+            )?;
         }
     }
     for entity in &set.entities {
         enforce_entity_invariants(record, entity)?;
     }
-    Ok(())
+    collecting::settle(stage)
 }
 
 fn enforce_entity_invariants(
@@ -88,10 +93,13 @@ fn enforce_entity_invariants(
                 instance: element,
             };
             if !interpret(&rule.expr, &ctx)?.truthy() {
-                return Err(Refusal::InvariantViolation(format!(
-                    "{} refused — {}",
-                    entity.name, rule.description
-                )));
+                collecting::refuse_with(
+                    Refusal::InvariantViolation(format!(
+                        "{} refused — {}",
+                        entity.name, rule.description
+                    )),
+                    Detail::rule(rule.description),
+                )?;
             }
         }
         for nested in &entity.nested {
@@ -152,8 +160,10 @@ pub fn dispatch<'a, T, R>(
     mutations: &mut Vec<MutationRecord>,
     // The synchronous half of `projects`, applied right before `repo.save`.
     seed_projections: Vec<(&'static str, Option<Value>)>,
-    // The write-side tenant boundary. The router computes it (it needs every aggregate's repo)
-    // but it is applied here, first in `Save`, before `seed_projections`.
+    // The settled-state checks: references a command set through a plain value object, then the
+    // write-side tenant boundary. The router computes it (it needs every aggregate's repo)
+    // but it is applied here, first in `Save`, before `seed_projections`, as Ruby's
+    // `resolve_state_references` runs at `save`.
     tenant_boundary_check: Result<(), Refusal>,
 ) -> Result<(T, Vec<Event>), Refusal>
 where
@@ -348,6 +358,7 @@ fn enforce_givens(
     aggregate_qualified_name: &str,
     id: &str,
 ) -> Result<(), Refusal> {
+    let stage = collecting::mark();
     for given in givens {
         let ctx = EvalContext {
             args,
@@ -357,17 +368,21 @@ fn enforce_givens(
             // The `corrects` wording interpolates the record id, so it is built here.
             if let Some(event_name) = given.corrects_event {
                 // `NothingToCorrect`, not `GivenNotMet`: the conformance corpus compares kinds.
-                return Err(Refusal::NothingToCorrect(format!(
-                    "{command_name} refused — corrects {event_name}, but {aggregate_qualified_name} #{id} has never emitted it"
-                )));
+                collecting::refuse_with(
+                    Refusal::NothingToCorrect(format!(
+                        "{command_name} refused — corrects {event_name}, but {aggregate_qualified_name} #{id} has never emitted it"
+                    )),
+                    Detail::rule(given.description),
+                )?;
+                continue;
             }
-            return Err(Refusal::GivenNotMet(format!(
-                "{command_name} refused — {}",
-                given.description
-            )));
+            collecting::refuse_with(
+                Refusal::GivenNotMet(format!("{command_name} refused — {}", given.description)),
+                Detail::rule(given.description),
+            )?;
         }
     }
-    Ok(())
+    collecting::settle(stage)
 }
 
 /// `admissible_transition` — shared by the aggregate record and an entity
@@ -420,19 +435,20 @@ fn enforce_ensures(
         args: &state_first,
         old,
     };
+    let stage = collecting::mark();
     for rule in ensures {
         let ctx = EvalContext {
             args: &with_old,
             instance: settled,
         };
         if !interpret(&rule.expr, &ctx)?.truthy() {
-            return Err(Refusal::EnsuresNotMet(format!(
-                "{command_name} refused — {}",
-                rule.description
-            )));
+            collecting::refuse_with(
+                Refusal::EnsuresNotMet(format!("{command_name} refused — {}", rule.description)),
+                Detail::rule(rule.description),
+            )?;
         }
     }
-    Ok(())
+    collecting::settle(stage)
 }
 
 /// The write half of `save`: the repository write and its mutation record.
@@ -657,6 +673,7 @@ where
         } else {
             self.args
         };
+        let stage = collecting::mark();
         for given in self.givens {
             // Handled above; the `corrects` flag field lives on the parent, not the element.
             if given.corrects_event.is_some() {
@@ -667,13 +684,16 @@ where
                 instance: element,
             };
             if !interpret(&given.expr, &ctx)?.truthy() {
-                return Err(Refusal::GivenNotMet(format!(
-                    "{} refused — {}",
-                    self.command_name, given.description
-                )));
+                collecting::refuse_with(
+                    Refusal::GivenNotMet(format!(
+                        "{} refused — {}",
+                        self.command_name, given.description
+                    )),
+                    Detail::rule(given.description),
+                )?;
             }
         }
-        Ok(())
+        collecting::settle(stage)
     }
 
     fn apply_mutations(&mut self, record: &mut T) -> Result<(), Refusal> {
@@ -885,6 +905,7 @@ pub fn decode_aggregate_arguments<A>(
     gates: &ArgumentGates<'_, A>,
 ) -> Result<A, Refusal> {
     let mut args = None;
+    let stage = collecting::mark();
     for step in AggregateStep::ORDER {
         #[deny(clippy::wildcard_enum_match_arm)]
         let gate = match step {
@@ -907,6 +928,10 @@ pub fn decode_aggregate_arguments<A>(
             | AggregateStep::Emit => continue,
         };
         gates.run(gate, facts, &mut args)?;
+        // A dry run keeps every unknown and absent argument, then stops here; a real one raised.
+        if matches!(gate, ArgumentGate::RefuseAbsentArguments) {
+            collecting::settle(stage)?;
+        }
     }
     ordered(args, NORMALIZED)
 }
@@ -918,6 +943,7 @@ pub fn decode_entity_arguments<A>(
     gates: &ArgumentGates<'_, A>,
 ) -> Result<A, Refusal> {
     let mut args = None;
+    let stage = collecting::mark();
     for step in EntityStep::ORDER {
         #[deny(clippy::wildcard_enum_match_arm)]
         let gate = match step {
@@ -939,6 +965,10 @@ pub fn decode_entity_arguments<A>(
             | EntityStep::Emit => continue,
         };
         gates.run(gate, facts, &mut args)?;
+        // A dry run keeps every unknown and absent argument, then stops here; a real one raised.
+        if matches!(gate, ArgumentGate::RefuseAbsentArguments) {
+            collecting::settle(stage)?;
+        }
     }
     ordered(args, NORMALIZED)
 }

data/rust/src/kernel/json.rs

@@ -250,6 +250,39 @@ impl Json {
         }
     }
 
+    /// Refuses `TypeMismatch` when a bare scalar query argument is offered as a shape its declared
+    /// type cannot hold, worded as a command's numeric field is. Ruby's `Value::FieldChecks#mistyped?`
+    /// is the rule: an Integer must be a number, a Float a number, and a String (or boolean) must not
+    /// be a composite. A null is absent, so it passes. `owner` is the aggregate's bare name.
+    pub fn expect_scalar_shape(
+        &self,
+        owner: &str,
+        field: &str,
+        type_name: &str,
+    ) -> Result<(), Refusal> {
+        if matches!(self, Self::Null) || !self.mistyped_scalar(type_name) {
+            return Ok(());
+        }
+        Err(Refusal::TypeMismatch(
+            super::refusal_wording::TypeMismatchNumericFieldArgs {
+                r#type: owner,
+                field,
+                expected: type_name,
+                offered: &self.describe(),
+            }
+            .render_args(),
+        ))
+    }
+
+    fn mistyped_scalar(&self, type_name: &str) -> bool {
+        match type_name {
+            "Integer" => !matches!(self, Self::Num(n, _) if n.fract() == 0.0),
+            "Float" => !matches!(self, Self::Num(..)),
+            "String" => matches!(self, Self::Array(_) | Self::Object(_)),
+            _ => false,
+        }
+    }
+
     /// Refuses `TypeMismatch` when a multi-field value object is offered as a non-object.
     ///
     /// Runs at the `from_json` call site, since only the caller knows `name`.
@@ -919,3 +952,32 @@ impl Parser<'_> {
         Ok(Json::Num(value, raw))
     }
 }
+
+#[cfg(test)]
+mod scalar_shape_tests {
+    use super::*;
+
+    fn refused(value: &Json, type_name: &str) -> bool {
+        value
+            .expect_scalar_shape("Account", "reference", type_name)
+            .is_err()
+    }
+
+    #[test]
+    fn a_string_argument_refuses_a_composite_and_takes_a_scalar() {
+        assert!(refused(&Json::obj(vec![("cents", Json::int(0))]), "String"));
+        assert!(!refused(&Json::int(7), "String"));
+    }
+
+    #[test]
+    fn an_integer_argument_refuses_a_fraction_and_a_string() {
+        assert!(refused(&Json::Num(1.5, None), "Integer"));
+        assert!(refused(&Json::str("1"), "Integer"));
+        assert!(!refused(&Json::int(1), "Integer"));
+    }
+
+    #[test]
+    fn a_null_argument_is_absent_not_mistyped() {
+        assert!(!refused(&Json::Null, "String"));
+    }
+}

data/rust/src/kernel/mod.rs

@@ -1,16 +1,15 @@
 //! Hand-written, domain-agnostic floor that every generated per-command function calls into.
 
-pub mod attribute_shapes;
 pub mod cli;
+pub mod collecting;
 pub mod dispatch;
-pub mod expr;
-pub mod expression_operators;
 pub mod json;
 pub mod named_query;
 pub mod needs;
 pub mod orchestrate;
 pub mod pattern;
 pub mod present;
+pub mod query_cursor;
 pub mod query_ordering;
 pub mod vocab;
 // Kept at its old path so existing `refusal_wording::RefusalSite` call sites still resolve.
@@ -20,7 +19,6 @@ pub mod read_model;
 pub mod reference_lookup;
 pub mod repository;
 pub mod routing;
-pub mod ruby_float;
 
 pub use dispatch::{
     aggregate_step_site, apply_entity_command, decode_aggregate_arguments, decode_entity_arguments,
@@ -32,6 +30,9 @@ pub use expr::{
     StripSide, Value, WithParent,
 };
 pub use json::Json;
+// The expression evaluator, its operators and the refusal type are their own crate, shared with
+// the host; the kernel re-exports them so every `crate::kernel::expr::…` path keeps working.
+pub use hecks_expr::{attribute_shapes, expr, expression_operators, ruby_float, Refusal};
 pub use named_query::{QueryCondition, QueryConditionValue, QueryDef};
 pub use orchestrate::{
     orchestrate, CompletedCompensation, CrossDomainPolicyRule, DispatchSpec, Handler,
@@ -45,8 +46,8 @@ pub use reference_lookup::{
 };
 pub use refusal_wording::RefusalSite;
 pub use repository::{
-    check_reference, check_role_via, filter_entries, holds_role_via, row_json, AggregateScan,
-    InMemoryRepository, Repository,
+    check_reference, check_role_via, check_roles_via, filter_entries, holds_role_via, row_json,
+    AggregateScan, InMemoryRepository, Repository,
 };
 pub use routing::{CommandInvocation, RoutingEnvelope};
 
@@ -67,67 +68,6 @@ pub struct Event {
     pub correlation: Option<std::collections::HashMap<String, String>>,
 }
 
-/// Why a command dispatch was refused; each variant carries the refusal message.
-///
-/// Ruby's `UnknownVerb` has no variant: routing an unknown command name happens before dispatch.
-/// `AbsentArgument` and `UnknownArgument` are raised only at the JSON boundary (`from_json`),
-/// where the input has no static shape; typed args structs make them unconstructible afterwards.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum Refusal {
-    GivenNotMet(String),
-    EnsuresNotMet(String),
-    InvariantViolation(String),
-    LifecycleRefused(String),
-    AlreadyExists(String),
-    NotFound(String),
-    TypeMismatch(String),
-    AbsentArgument(String),
-    UnknownArgument(String),
-    Unauthorized(String),
-    Fault(String),
-    /// `corrects` against a record that never emitted the corrected event.
-    NothingToCorrect(String),
-}
-
-impl Refusal {
-    /// The refusal class name, spelled as Ruby raises it; the semantics corpus compares it.
-    pub const fn kind(&self) -> &'static str {
-        match self {
-            Self::GivenNotMet(_) => "GivenNotMet",
-            Self::EnsuresNotMet(_) => "EnsuresNotMet",
-            Self::InvariantViolation(_) => "InvariantViolation",
-            Self::LifecycleRefused(_) => "LifecycleRefused",
-            Self::AlreadyExists(_) => "AlreadyExists",
-            Self::NotFound(_) => "NotFound",
-            Self::TypeMismatch(_) => "TypeMismatch",
-            Self::AbsentArgument(_) => "AbsentArgument",
-            Self::UnknownArgument(_) => "UnknownArgument",
-            Self::Unauthorized(_) => "Unauthorized",
-            Self::Fault(_) => "Fault",
-            Self::NothingToCorrect(_) => "NothingToCorrect",
-        }
-    }
-}
-
-impl std::fmt::Display for Refusal {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::GivenNotMet(msg)
-            | Self::EnsuresNotMet(msg)
-            | Self::InvariantViolation(msg)
-            | Self::LifecycleRefused(msg)
-            | Self::AlreadyExists(msg)
-            | Self::NotFound(msg)
-            | Self::TypeMismatch(msg)
-            | Self::AbsentArgument(msg)
-            | Self::UnknownArgument(msg)
-            | Self::Unauthorized(msg)
-            | Self::Fault(msg)
-            | Self::NothingToCorrect(msg) => write!(f, "{msg}"),
-        }
-    }
-}
-
 /// The saved record plus the events it raised, or a refusal that leaves state untouched.
 pub type DispatchResult<T> = Result<(T, Vec<Event>), Refusal>;
 

data/rust/src/kernel/named_query.rs

@@ -3,7 +3,8 @@
 
 use super::refusal_wording::UnauthorizedTenantRequiredArgs;
 use super::{
-    query_comparators::QueryComparator, query_ordering, repository, AggregateScan, Json, Refusal,
+    query_comparators::QueryComparator, query_cursor, query_ordering, repository, AggregateScan,
+    Json, Refusal,
 };
 
 /// One declared query, compiled.
@@ -20,6 +21,8 @@ pub struct QueryDef {
     pub order_by: Option<query_ordering::OrderBy>,
     pub offset: Option<query_ordering::Offset>,
     pub limit: Option<query_ordering::Limit>,
+    /// `cursor` is declared: `limit` is the page size and the call's `after` names the position.
+    pub cursor: bool,
     /// `None` when no `authorize` is declared, or it declares no `tenant:`.
     pub authorization: Option<TenantAuth>,
 }
@@ -58,6 +61,21 @@ pub enum QueryConditionValue {
     /// A caller-bound attribute name, read from the call's `args`; a missing key reads as
     /// `Json::Null`, as Ruby's `resolve_query_value` does.
     Arg(&'static str),
+    /// `where(field: nil)`: resolves to `Json::Null`, which a field that is unset or null equals,
+    /// as `nil == nil` holds in Ruby. Emitted for an `eq`/`ne` against nil.
+    Null,
+}
+
+impl QueryConditionValue {
+    /// The operand this condition compares a row's field against, before `comparable` reduces it.
+    pub fn resolve(self, args: &Json) -> Json {
+        match self {
+            Self::Literal(text) => Json::Str(text.to_string()),
+            Self::NumericLiteral(n) => Json::Num(n, None),
+            Self::Arg(name) => args.get(name).cloned().unwrap_or(Json::Null),
+            Self::Null => Json::Null,
+        }
+    }
 }
 
 /// Runs a declared query: chained `filter_entries` per condition (keeping id order), then
@@ -98,11 +116,7 @@ pub fn run_cross_domain(
         .conditions
         .iter()
         .map(|condition| {
-            let want = match condition.value {
-                QueryConditionValue::Literal(text) => Json::Str(text.to_string()),
-                QueryConditionValue::NumericLiteral(n) => Json::Num(n, None),
-                QueryConditionValue::Arg(name) => args.get(name).cloned().unwrap_or(Json::Null),
-            };
+            let want = condition.value.resolve(args);
             (condition, super::query_comparators::comparable(&want))
         })
         .collect();
@@ -133,6 +147,10 @@ pub fn run_cross_domain(
         store,
     )?;
 
+    if def.cursor {
+        return cursor_rows(entries, def, args);
+    }
+
     Ok(query_ordering::apply(
         entries,
         def.order_by.as_ref(),
@@ -142,6 +160,49 @@ pub fn run_cross_domain(
     ))
 }
 
+/// The ordered rows after the call's `after`, capped at the page size.
+fn cursor_rows(
+    entries: Vec<(String, Json)>,
+    def: &QueryDef,
+    args: &Json,
+) -> Result<Vec<(String, Json)>, Refusal> {
+    let ordered = query_ordering::apply(entries, def.order_by.as_ref(), None, None, args);
+    let after = args.get("after").and_then(Json::as_str);
+    let mut rows = query_cursor::rows_after(ordered, def.order_by.as_ref(), after)?;
+    if let Some(limit) = def.limit.as_ref() {
+        rows.truncate(query_ordering::resolve_limit(limit, args));
+    }
+    Ok(rows)
+}
+
+/// One page of a cursor query: its rows, and the token of the page after them.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Page {
+    pub rows: Vec<(String, Json)>,
+    /// `None` on the last page.
+    pub after: Option<String>,
+}
+
+/// `run`, asked for one row past the page: that row proves a next page exists and is not answered.
+pub fn run_page(
+    store: &impl AggregateScan,
+    def: &QueryDef,
+    args: &Json,
+    caller_role: Option<&str>,
+) -> Result<Page, Refusal> {
+    let size = def
+        .limit
+        .as_ref()
+        .map_or(0, |limit| query_ordering::resolve_limit(limit, args));
+    let widened = QueryDef {
+        limit: Some(query_ordering::Limit::Literal(size as i64 + 1)),
+        ..*def
+    };
+    let rows = run(store, &widened, args, caller_role)?;
+    let (rows, after) = query_cursor::split_page(rows, def.order_by.as_ref(), size);
+    Ok(Page { rows, after })
+}
+
 /// Finds a query by verb; a linear scan is enough for the small generated `QUERIES` table.
 pub fn find<'a>(table: &'a [QueryDef], verb: &str) -> Option<&'a QueryDef> {
     table.iter().find(|def| def.verb == verb)
@@ -193,11 +254,7 @@ pub fn run_entity(
     }
 
     for condition in def.conditions {
-        let want = match condition.value {
-            QueryConditionValue::Literal(text) => Json::Str(text.to_string()),
-            QueryConditionValue::NumericLiteral(n) => Json::Num(n, None),
-            QueryConditionValue::Arg(name) => args.get(name).cloned().unwrap_or(Json::Null),
-        };
+        let want = condition.value.resolve(args);
         entries = repository::filter_entries(entries, condition.field, condition.comparator, &want);
     }
 
@@ -265,3 +322,160 @@ fn row_under_parent(parent_key: &str, parent_id: String, element: Json) -> Json
     }
     Json::Object(fields)
 }
+
+#[cfg(test)]
+mod cursor_tests {
+    use super::*;
+    use crate::kernel::query_ordering::{Limit, NullsMode, OrderBy};
+
+    struct Rows(Vec<(String, Json)>);
+
+    impl AggregateScan for Rows {
+        fn scan(&self, aggregate: &str) -> Option<Vec<(String, Json)>> {
+            (aggregate == "Shop::Item").then(|| self.0.clone())
+        }
+    }
+
+    fn item(id: &str, rank: i64) -> (String, Json) {
+        (id.to_string(), Json::obj(vec![("rank", Json::int(rank))]))
+    }
+
+    fn paged() -> QueryDef {
+        QueryDef {
+            verb: "Shop::Item.Paged",
+            aggregate: "Shop::Item",
+            conditions: &[],
+            reference_hop_conditions: &[],
+            order_by: Some(OrderBy {
+                field: "rank",
+                descending: false,
+                nulls: NullsMode::Native,
+            }),
+            offset: None,
+            limit: Some(Limit::Literal(2)),
+            cursor: true,
+            authorization: None,
+        }
+    }
+
+    fn walk(store: &Rows) -> Vec<Vec<String>> {
+        let (mut pages, mut after) = (Vec::new(), None::<String>);
+        loop {
+            let args = after.as_deref().map_or_else(
+                || Json::obj(vec![]),
+                |a| Json::obj(vec![("after", Json::str(a))]),
+            );
+            let page = run_page(store, &paged(), &args, None).unwrap();
+            pages.push(page.rows.iter().map(|(id, _)| id.clone()).collect());
+            match page.after {
+                Some(next) => after = Some(next),
+                None => return pages,
+            }
+        }
+    }
+
+    #[test]
+    fn walking_pages_yields_every_row_in_order_with_ties_by_identity() {
+        let store = Rows(vec![
+            item("b", 1),
+            item("a", 2),
+            item("d", 2),
+            item("c", 2),
+            item("e", 3),
+        ]);
+        assert_eq!(
+            walk(&store),
+            vec![vec!["b", "a"], vec!["c", "d"], vec!["e"]]
+        );
+    }
+
+    #[test]
+    fn a_page_after_the_last_row_is_empty_with_no_next_position() {
+        let store = Rows(vec![item("a", 1)]);
+        let token = query_cursor::encode(&Json::int(1), "a");
+        let page = run_page(
+            &store,
+            &paged(),
+            &Json::obj(vec![("after", Json::str(token))]),
+            None,
+        )
+        .unwrap();
+        assert_eq!(
+            page,
+            Page {
+                rows: vec![],
+                after: None
+            }
+        );
+    }
+}
+
+#[cfg(test)]
+mod null_condition_tests {
+    use super::{run, AggregateScan, QueryCondition, QueryConditionValue, QueryDef};
+    use crate::kernel::query_comparators::QueryComparator;
+    use crate::kernel::Json;
+
+    struct Rows(Vec<(String, Json)>);
+
+    impl AggregateScan for Rows {
+        fn scan(&self, aggregate: &str) -> Option<Vec<(String, Json)>> {
+            (aggregate == "Grant").then(|| self.0.clone())
+        }
+    }
+
+    const EQ_NULL: &[QueryCondition] = &[QueryCondition {
+        field: "ends_at",
+        comparator: QueryComparator::Eq,
+        value: QueryConditionValue::Null,
+    }];
+    const NE_NULL: &[QueryCondition] = &[QueryCondition {
+        field: "ends_at",
+        comparator: QueryComparator::Ne,
+        value: QueryConditionValue::Null,
+    }];
+
+    fn query(conditions: &'static [QueryCondition]) -> QueryDef {
+        QueryDef {
+            verb: "Grant.Live",
+            aggregate: "Grant",
+            conditions,
+            reference_hop_conditions: &[],
+            order_by: None,
+            offset: None,
+            limit: None,
+            cursor: false,
+            authorization: None,
+        }
+    }
+
+    fn rows() -> Rows {
+        let ended = Json::obj(vec![(
+            "ends_at",
+            Json::obj(vec![("value", Json::str("2026-01-01".to_string()))]),
+        )]);
+        let null = Json::obj(vec![("ends_at", Json::Null)]);
+        let absent = Json::obj(vec![("role", Json::str("Admin".to_string()))]);
+        Rows(vec![
+            ("ended".to_string(), ended),
+            ("null".to_string(), null),
+            ("absent".to_string(), absent),
+        ])
+    }
+
+    fn ids(conditions: &'static [QueryCondition]) -> Vec<String> {
+        let found = run(&rows(), &query(conditions), &Json::obj(vec![]), None).unwrap();
+        found.into_iter().map(|(id, _)| id).collect()
+    }
+
+    // `where(ends_at: nil)`: a field that is null or unset equals nil, as in Ruby.
+    #[test]
+    fn eq_null_keeps_the_rows_whose_field_is_null_or_unset() {
+        assert_eq!(ids(EQ_NULL), ["absent", "null"]);
+    }
+
+    #[test]
+    fn ne_null_keeps_the_rows_whose_field_is_set() {
+        assert_eq!(ids(NE_NULL), ["ended"]);
+    }
+}