hecks 6.0.0 → 7.0.0

data/lib/hecks/adapters/driven/postgres_era/lineage_manager/merge_coordinator.rb

@@ -35,7 +35,7 @@ module Hecks
           def merge_chain(registry, bluebook, held)
             raise Runtime::WiringError, "nothing to merge — #{bluebook.name} stands at era 1" if held.size < 2
 
-            edge_chain(registry, bluebook, held[0..-2], held.last[:label])
+            edge_chain(registry, bluebook, held[0..-2], held.last[:label], target: held.last)
           end
 
           # The audit the merge runs over the merged heads, answering every violation found.

data/lib/hecks/adapters/driven/postgres_era/lineage_manager/mint_decision.rb

@@ -0,0 +1,163 @@
+require_relative "../../../../ports/persistence/plugins/era/translation/implicit_edge"
+require_relative "../../../../ports/persistence/plugins/era/translation/scaffold"
+require_relative "../../../../ports/persistence/plugins/era/storage_shape"
+require_relative "../../../../shape_ledger"
+
+module Hecks
+  module Adapters
+    class PostgresEra
+      module LineageManager
+        # The decision a mint and a rehearsal both make: which translation edge leads the held era
+        # to the current shape, and whether a mint would go ahead on it. It reads only what its
+        # caller hands it and writes nothing, so the same inputs reach the same verdict on either
+        # path.
+        module MintDecision
+          # The implicit moves the framework keeps beside its shape ledger. A bluebook the framework
+          # holds, such as QualityControl, has its moves recorded here, not beside its own files.
+          FRAMEWORK_MOVES = File.join(File.expand_path("../../../../hecks", __dir__),
+                                      ShapeLedger::IMPLICIT_FILE).freeze
+
+          # What a decision concludes. `verdict` is `would_mint`, `needs_edge` (the change needs
+          # a rule) or `refused`; `reason` names why it is not `would_mint`; `edge` is the edge a
+          # mint would use and is nil unless `would_mint`; `source` is `file` or `implicit`; `edges`
+          # lists the edges that lead the held era to the current shape; `diff` is the shape diff;
+          # `watermark` is the one decided at.
+          Verdict = Data.define(:verdict, :reason, :edge, :edges, :source, :diff, :watermark)
+
+          module_function
+
+          # @param held [Array<Hash>] the held eras, oldest first; the last is the era a mint
+          #   leaves.
+          #   Each carries `label` and `declaration`, the storage shape it holds as a bluebook view
+          #   (see `held_for_decision`)
+          # @param bluebook [Bluebook::Declaration] the current bluebook
+          # @param edge_source [Hash] `translations`, the loaded edges, and `recorded`, the recorded
+          #   implicit moves as `[from, to]` pairs (see `recorded_moves`)
+          # @param watermark [Integer] the ledger watermark the decision reads
+          # @param rows [Array<String>] the refusals an audit ran over the decided edge; empty when
+          #   none, or when no audit has run yet
+          # @return [Verdict]
+          def decide(held:, bluebook:, edge_source:, watermark:, rows:)
+            latest = held.last
+            edges = leading(edge_source[:translations], bluebook, latest[:label])
+            found = if edges.empty?
+                      implicit(latest, bluebook, edge_source[:recorded], watermark)
+                    else
+                      written(edges, latest, bluebook, watermark)
+                    end
+            rows.empty? ? found : audit_refusal(found)
+          end
+
+          # The decision for the era a mint would leave, reading the held era's stored shape here,
+          # so a caller holding only the era's record reaches the same verdict as a mint does.
+          #
+          # @param latest [Hash] the held era, as `Lineage#eras` answers it
+          # @param bluebook [Bluebook::Declaration] the current bluebook
+          # @param translations [Array<Object>] the edges the registry loaded
+          # @param directory [String, nil] the domain's bluebook directory
+          # @param watermark [Integer] the ledger watermark the decision reads
+          # @return [Verdict]
+          def decide_latest(latest, bluebook:, translations:, directory:, watermark:)
+            decide(held: [held_for_decision(latest)], bluebook: bluebook, watermark: watermark, rows: [],
+                   edge_source: { translations: translations, recorded: recorded_moves(bluebook.name, directory) })
+          end
+
+          # A held era as the decision reads it: with `declaration`, the storage shape it holds as a
+          # bluebook view (LineageManager::HeldEra). Its held text is not read.
+          #
+          # @param era [Hash] an era as `Lineage#eras` answers it
+          # @return [Hash] the era with `declaration`, a `Runtime::ProjectedBluebook`
+          # @raise [Runtime::WiringError] naming the era, when its shape cannot be known
+          def held_for_decision(era) = era.merge(declaration: LineageManager.held_bluebook(era))
+
+          # The implicit moves a domain has recorded: beside its own bluebooks, when a directory is
+          # given, and in the framework's record. This is the only read the decision's inputs need.
+          #
+          # @param domain [String] the bluebook name the moves are recorded under
+          # @param directory [String, nil] the domain's bluebook directory
+          # @return [Array<Array(String, String)>] each recorded move as `[from, to]`
+          def recorded_moves(domain, directory)
+            paths = [directory && File.join(directory, ShapeLedger::IMPLICIT_FILE), FRAMEWORK_MOVES].compact
+            paths.flat_map { |path| ShapeLedger.pairs_of(ShapeLedger.implicit_moves(path).fetch(domain, [])) }
+          end
+
+          # Whether the move from the held era is breaking and nothing covers it: the decision needs
+          # an edge, and the change is not provably additive. A move a mint would go ahead on, or a
+          # decision already refused for another reason, is not this. An edge from the held shape
+          # covers it even when the held era has not been named yet.
+          #
+          # @return [Boolean]
+          def breaking?(latest, bluebook, verdict, translations)
+            return false unless verdict.verdict == "needs_edge"
+            return false unless leading(translations, bluebook, held_label_of(latest)).empty?
+
+            !additive?(verdict.diff, held_for_decision(latest), bluebook)
+          end
+
+          # @return [String] the stored label of a held era, or the one its shape would be named
+          def held_label_of(era)
+            era[:label] || LineageManager.held_hash(era)[0, Runtime::StorageShape::LABEL_LENGTH]
+          end
+
+          # The shape label a storage shape of this bluebook carries.
+          #
+          # @return [String]
+          def label_of(bluebook) = Runtime::StorageShape.mint_hash(bluebook)[0, Runtime::StorageShape::LABEL_LENGTH]
+
+          # The edges the domain loads that lead the held era straight to the current shape. An edge
+          # from the held era to any other shape plays no part: the translation is from the held
+          # shape to the current one, so other edges neither fork the decision nor make it stale.
+          #
+          # @return [Array<Object>] the edges from `from` to the bluebook's current label
+          def leading(translations, bluebook, from)
+            to = label_of(bluebook)
+            translations.select { |edge| edge.domain == bluebook.name && edge.from == from && edge.to == to }
+          end
+
+          # The implicit empty edge: the recorded moves must reach the shape from the held label,
+          # and the change must qualify as additive by `Translation::ImplicitEdge.qualifies?`.
+          def implicit(latest, bluebook, recorded, watermark)
+            diff = diff_of(latest, bluebook)
+            to = label_of(bluebook)
+            return verdict_of("needs_edge", diff, watermark, reason: :unrecorded) unless reachable?(latest, to, recorded)
+            return verdict_of("needs_edge", diff, watermark, reason: :non_qualifying) unless additive?(diff, latest, bluebook)
+
+            edge = Translation::ImplicitEdge.new(domain: bluebook.name, from: latest[:label], to: to)
+            verdict_of("would_mint", diff, watermark, edge: edge, edges: [], source: "implicit")
+          end
+
+          # @return [Hash] the scaffold's diff of the held era against the current bluebook
+          def diff_of(latest, bluebook) = Translation::Scaffold.diff(latest[:declaration], bluebook)
+
+          # @return [Boolean] whether the recorded moves chain from the held label to `to`
+          def reachable?(latest, to, recorded) = ShapeLedger.reachable?(latest[:label], to, recorded)
+
+          # @return [Boolean] whether the change qualifies as additive by the implicit edge's rule
+          def additive?(diff, latest, bluebook) = Translation::ImplicitEdge.qualifies?(diff, latest[:declaration], bluebook)
+
+          # A written edge from the held shape to the current one leads on. Two files declaring that
+          # same pair disagree about one translation, so neither is taken.
+          def written(edges, latest, bluebook, watermark)
+            diff = diff_of(latest, bluebook)
+            return verdict_of("refused", diff, watermark, reason: :duplicate_edge, edges: edges) if edges.size > 1
+
+            verdict_of("would_mint", diff, watermark, edge: edges.first, edges: edges, source: "file")
+          end
+
+          # An audit's refusals turn a would_mint into a refusal that names the audit.
+          def audit_refusal(found)
+            return found unless found.verdict == "would_mint"
+
+            verdict_of("refused", found.diff, found.watermark, reason: :audit, edges: found.edges)
+          end
+
+          # @return [Verdict] a verdict of `kind`, with the fields it carries and none it does not
+          def verdict_of(kind, diff, watermark, **attributes)
+            Verdict.new(verdict: kind, reason: nil, edge: nil, edges: [], source: nil, diff: diff,
+                        watermark: watermark, **attributes)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/adapters/driven/postgres_era/lineage_manager/mint_request.rb

@@ -0,0 +1,24 @@
+module Hecks
+  module Adapters
+    class PostgresEra
+      module LineageManager
+        # The request a mint carries into the era check: whether the mint was confirmed, the verdict
+        # the rehearsal of that same era reached, and the ledger watermark the rehearsal read. Only the
+        # Maintenance mint path builds one; a boot has none, so a boot that would mint refuses.
+        MintRequest = Data.define(:confirm, :verdict, :watermark) do
+          # Reads the request out of a settings hash, spelled with symbol or string keys.
+          #
+          # @param settings [Hash] the settings the era check was booted with
+          # @return [MintRequest, nil] the request, or nil when the settings carry none
+          def self.from(settings)
+            raw = PostgresEra.setting(settings, :mint_request)
+            return nil if raw.nil?
+
+            raw = raw.transform_keys(&:to_sym)
+            new(confirm: raw[:confirm] == true, verdict: raw[:verdict].to_s, watermark: raw[:watermark].to_i)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/adapters/driven/postgres_era/lineage_manager/minter.rb

@@ -4,6 +4,8 @@ require_relative "../../../../ports/persistence/plugins/era/translation/audit"
 require_relative "../../../../ports/persistence/plugins/era/translation/scaffold"
 require_relative "context"
 require_relative "refusals"
+require_relative "mint_decision"
+require_relative "era_resolution"
 
 module Hecks
   module Adapters
@@ -19,25 +21,30 @@ module Hecks
           # @param context [Context] the era check so far; `latest` is the latest held era, named
           #   here if it has no name yet
           # @return [Integer] the ordinal of the era minted
-          # @raise [Runtime::WiringError] if the edge, its coverage or its audit refuses
+          # @raise [Runtime::WiringError] if a held era already holds the shape, or the edge, its
+          #   coverage or its audit refuses
           def mint!(context)
+            refuse_held_shape!(context)
+            refuse_unrehearsed_mint!(context)
             ensure_named!(context.lineage, context.latest)
             context = context.with(latest: context.held_eras.last)
+            decided_at = context.watermark
             edge = verified_edge!(context)
             refuse_unpermitted_mint!(context) unless context.mint_permitted
             chain = audited_chain!(context, edge)
-            commit_era!(context, chain)
+            refuse_moved_watermark!(context, decided_at)
+            commit_era!(context, chain, edge)
           end
 
-          # Finds the one translation edge leaving the held era and targeting the current
-          # shape's label; a second edge from the same source is a wiring mistake, not a
-          # merge to resolve automatically.
+          # The edge a mint leaves the held era by, as `MintDecision` decides it. A refusal the
+          # decision names is raised by name; a change that needs a rule refuses toward the
+          # scaffold.
           def resolve_edge!(context)
-            edges = edges_leaving(context)
-            refuse_toward_the_scaffold!(context) if edges.empty?
-            refuse_forked_eras!(context, edges) if edges.size > 1
-            refuse_stale_edge!(context, edges.first)
-            edges.first
+            verdict = decide!(context)
+            return verdict.edge if verdict.verdict == "would_mint"
+            return refuse_toward_the_scaffold!(context) if verdict.verdict == "needs_edge"
+
+            refuse_refused_verdict!(context, verdict)
           end
 
           # Diffs the held era against the current shape and writes the edge file —
@@ -46,7 +53,7 @@ module Hecks
             ensure_named!(lineage, latest)
             latest = lineage.eras.last
             label = Runtime::StorageShape.mint_hash(bluebook)[0, Runtime::StorageShape::LABEL_LENGTH]
-            diffed = Translation::Scaffold.diff(shadow(latest[:held_text]), bluebook)
+            diffed = Translation::Scaffold.diff(held_bluebook(latest), bluebook)
             edge = Translation::Scaffold::Edge.new(
               domain: bluebook.name, from: latest[:label], to: label, ordinal: latest[:ordinal] + 1,
               label: label, aggregates: diffed[:aggregates], retired: diffed[:retired]
@@ -60,23 +67,40 @@ module Hecks
           def ensure_named!(lineage, era)
             return if era[:hash]
 
-            held_bluebook = shadow(era[:held_text])
-            hash = Runtime::StorageShape.mint_hash(held_bluebook)
+            hash = held_hash(era)
             lineage.mint_name!(era[:ordinal], hash, hash[0, Runtime::StorageShape::LABEL_LENGTH])
           end
 
           private
 
-          def edges_leaving(context)
+          # Refuses a mint of a shape a held era already holds, by the match the boot resolves with.
+          def refuse_held_shape!(context)
+            held = EraResolution.matching_era(context.held_eras, context.bluebook) or return
+
+            raise Runtime::WiringError,
+                  "cannot mint #{context.domain_name}: era #{held[:ordinal]} already holds the current shape"
+          end
+
+          # The verdict `MintDecision` reaches for the held era the mint leaves, read at the
+          # watermark the context holds now.
+          def decide!(context)
+            MintDecision.decide(held: [MintDecision.held_for_decision(context.latest)], bluebook: context.bluebook,
+                                edge_source: edge_source_of(context), watermark: context.watermark, rows: [])
+          end
+
+          def edge_source_of(context)
             registry = context.registry
-            registry.translations.select do |t|
-              t.domain == context.domain_name && t.from == context.latest[:label]
-            end
+            { translations: registry.translations,
+              recorded:     MintDecision.recorded_moves(context.domain_name, context.directory) }
           end
 
+          # The refusal a decided edge stands for: two files declaring the one translation.
+          def refuse_refused_verdict!(context, verdict) = refuse_duplicate_edges!(context, verdict.edges)
+
           # The edge chain to the current shape, after its audit passes.
           def audited_chain!(context, edge)
-            chain = edge_chain(context.registry, context.bluebook, context.held_eras, context.label)
+            chain = edge_chain(context.registry, context.bluebook, context.held_eras, context.label,
+                               target: minted_record(edge))
             audit!(context.bluebook, context.lineage, chain, context.ordinal, edge)
             chain
           end
@@ -84,17 +108,31 @@ module Hecks
           # The edge leaving the held era, once resolved and found to cover the diff.
           def verified_edge!(context)
             edge = resolve_edge!(context)
-            check_coverage!(context.registry, context.bluebook, shadow(context.latest[:held_text]), edge)
+            check_coverage!(context.registry, context.bluebook, held_bluebook(context.latest), edge)
             edge
           end
 
-          def commit_era!(context, chain)
+          # The journal record of the era a mint reaches, when the edge is implicit; nil when a
+          # written edge file leads there.
+          #
+          # @return [Hash, nil] the era record `edge_chain` reads as its last step
+          def minted_record(edge)
+            edge.is_a?(Translation::ImplicitEdge) ? edge.record : nil
+          end
+
+          # @return [Hash, nil] the `edge` column of the minted era: the implicit marker, or nil
+          def implicit_record(edge)
+            edge.is_a?(Translation::ImplicitEdge) ? Translation::ImplicitEdge::RECORD : nil
+          end
+
+          def commit_era!(context, chain, edge)
             hash = context.shape_hash
             bluebook = context.bluebook
             context.lineage.mint_era!(
               ordinal: context.ordinal, hash: hash, label: hash[0, Runtime::StorageShape::LABEL_LENGTH],
               held_text: context.current_text, aggregates: bluebook.aggregates, edges: chain,
-              role: context.role, projection: Runtime::StorageShape.project(context.bluebook)
+              role: context.role, projection: Runtime::StorageShape.project(context.bluebook),
+              edge: implicit_record(edge)
             )
             context.ordinal
           end

data/lib/hecks/adapters/driven/postgres_era/lineage_manager/refusals.rb

@@ -32,21 +32,34 @@ module Hecks
                                        "persisted_by block of its world", minting: false)
           end
 
-          private
+          # Refuses a mint that the rehearsal does not back: not confirmed, not a would_mint verdict, or a
+          # ledger watermark that moved since the rehearsal read it.
+          def refuse_unrehearsed_mint!(context)
+            request = context.mint_request
+            raise era_refusal(context, "the mint was not confirmed") unless request.confirm
+            unless request.verdict == "would_mint"
+              raise era_refusal(context, "the rehearsal's verdict was #{request.verdict}, not would_mint; " \
+                                         "rehearse again")
+            end
 
-          def refuse_forked_eras!(context, edges)
-            latest = context.latest
-            raise era_refusal(context, "#{edges.size} translation edges leave era #{latest[:ordinal]} " \
-                                       "(#{latest[:label]}) — eras fork mechanically; keep one edge per source shape",
-                              minting: false)
+            refuse_moved_watermark!(context, request.watermark)
           end
 
-          def refuse_stale_edge!(context, edge)
-            return if edge.to == context.label
+          private
+
+          def refuse_moved_watermark!(context, watermark)
+            current = context.watermark
+            return if current == watermark
+
+            raise era_refusal(context, "the ledger watermark moved from #{watermark} to #{current} since the " \
+                                       "rehearsal; rehearse again")
+          end
 
-            raise era_refusal(context, "the translation edge from #{context.latest[:label]} targets " \
-                                       "#{edge.to}, but the current shape is #{context.label} — the edge is stale; " \
-                                       "re-run hecks scaffold_translation", minting: false)
+          def refuse_duplicate_edges!(context, edges)
+            latest = context.latest
+            raise era_refusal(context, "#{edges.size} translation edges lead era #{latest[:ordinal]} " \
+                                       "(#{latest[:label]}) to the current shape #{context.label}; keep one",
+                              minting: false)
           end
 
           # Builds the refusal; a mint's own refusals say "cannot mint era N of X", the

data/lib/hecks/adapters/driven/postgres_era/lineage_manager.rb

@@ -4,6 +4,7 @@ require_relative "lineage_manager/era_resolver"
 require_relative "lineage_manager/minter"
 require_relative "lineage_manager/merge_coordinator"
 require_relative "lineage_manager/coverage_check"
+require_relative "lineage_manager/held_era"
 require_relative "../../../ports/persistence/plugins/era/era_guard"
 require_relative "../../../runtime/registry"
 
@@ -17,6 +18,7 @@ module Hecks
         extend Minter
         extend MergeCoordinator
         extend CoverageCheck
+        extend HeldEra
 
         module_function
 
@@ -27,25 +29,57 @@ module Hecks
         # @param bluebook [Bluebook::Declaration] the domain; only edges for its name count
         # @param eras [Array<Hash>] the ancestor eras in order, as `Lineage#eras` returns them
         # @param current_label [String] the shape label the last step must lead to
+        # @param target [Hash, nil] the era record the last step reaches when it is not in `eras`
+        #   (the held era of a settled chain, or the era a mint is about to write)
         # @return [Array<Hash>] one `{ translation: edge }` per step, in mint order
-        # @raise [Runtime::WiringError] if no loaded translation leads one label to the next
-        def edge_chain(registry, bluebook, eras, current_label)
+        # @raise [Runtime::WiringError] if no loaded translation or journal record leads a label
+        #   to the next one
+        def edge_chain(registry, bluebook, eras, current_label, target: nil)
           labels = eras.map { |era| era[:label] } + [current_label]
-          labels.each_cons(2).with_index.map do |(from, to), index|
-            step = edge_between(registry, bluebook, from, to)
+          labels.each_cons(2).with_index.filter_map do |(from, to), index|
+            next if same_shape?(from, to)
+
+            step = edge_between(registry, bluebook, from, to) ||
+                   recorded_edge(bluebook, from, to, eras[index + 1] || target)
             refuse_broken_chain!(bluebook, index, from, to) unless step
             { translation: step }
           end
         end
 
-        # Finds the loaded translation that leads one shape label to the next.
+        # Whether two shape labels name the same shape. A same-shape step is current, not a change,
+        # so it needs no edge and `edge_chain` skips it.
+        #
+        # @param from [String] the shape label the step leaves
+        # @param to [String] the shape label the step reaches
+        # @return [Boolean] true when both labels are the same shape
+        def same_shape?(from, to) = from == to
+
+        # The implicit edge a journal record names for the step that reached its era, or nil.
+        #
+        # @param bluebook [Bluebook::Declaration] the domain the edge belongs to
+        # @param from [String] the shape label the step leaves
+        # @param to [String] the shape label the step reaches
+        # @param record [Hash, nil] the era record the step reaches
+        # @return [Translation::ImplicitEdge, nil]
+        def recorded_edge(bluebook, from, to, record)
+          return unless record && record[:label] == to && record[:edge] == Translation::ImplicitEdge::RECORD
+
+          Translation::ImplicitEdge.new(domain: bluebook.name, from: from, to: to)
+        end
+
+        # Finds the loaded translation that leads one shape label to the next. A same-shape pair
+        # has no edge to find: it answers nil without searching, and `edge_chain` treats it as
+        # current.
         #
         # @param registry [Runtime::Registry] the registry whose `translations` are searched
         # @param bluebook [Bluebook::Declaration] the domain; only edges for its name count
         # @param from [String] the shape label the edge leaves
         # @param to [String] the shape label the edge reaches
-        # @return [Bluebook::Translation, nil] the edge, or nil when none is loaded
+        # @return [Bluebook::Translation, nil] the edge, or nil when none is loaded, or the shapes
+        #   match
         def edge_between(registry, bluebook, from, to)
+          return nil if same_shape?(from, to)
+
           registry.translations.find { |t| t.domain == bluebook.name && t.from == from && t.to == to }
         end
 

data/lib/hecks/adapters/driven/postgres_era/shared_tables.rb

@@ -0,0 +1,32 @@
+require_relative "events"
+require_relative "sagas"
+require_relative "../postgres/outbox"
+
+module Hecks
+  module Adapters
+    class PostgresEra
+      # The event, saga and outbox tables a database shares across its domains. Only the mint path
+      # creates them, through `Lineage#ensure_base!`; a boot reads them and never provisions them.
+      class SharedTables
+        include Events
+        include Sagas
+        include PostgresOutbox
+
+        # @param db [PG::Connection] the owner connection the mint path holds
+        def initialize(db)
+          @db = db
+        end
+
+        # Creates each shared table that is missing. Every statement is idempotent.
+        #
+        # @return [void]
+        # @raise [PG::Error] if Postgres refuses a statement
+        def provision!
+          create_event_table!
+          create_saga_table!
+          create_outbox_table!
+        end
+      end
+    end
+  end
+end

data/lib/hecks/adapters/driven/postgres_era.adapter

@@ -5,6 +5,9 @@ Hecks.adapter "PostgresEra" do
   field :database
   field :role
   field :schema
+  # The name this domain's history is held under until `era.rename_domain` moves it: `formerly "Old"`.
+  # A storage fact, so the world says it and the bluebook's `formerly_known_as` is the fallback.
+  field :formerly
   # Opt-in to boot over a superuser or BYPASSRLS role, which the era write fence cannot
   # bite. Refused by default; see `Lineage#check_fence_applies!`.
   field :allow_superuser
@@ -12,6 +15,15 @@ Hecks.adapter "PostgresEra" do
   # next era through a translation edge. `false` refuses; unset follows
   # `LineageManager::EraResolver::MINT_BY_DEFAULT`; see `Refusals#refuse_unpermitted_mint!`.
   field :mint_eras
+  # Declares the store a disposable tooling ledger: a shape change needs no era, edge or mint, an
+  # additive one is applied in place, any other archives the aggregate's rows under a dated name
+  # and starts it empty, and a boot never refuses as unminted or superseded. Unset or `false`
+  # keeps the era guard; see `LineageManager::DisposableLedger`. Never for client data.
+  field :disposable_ledger
+  # The commands whose own record an unminted boot may write: `mints_era "Maintenance.MintEra"`, one
+  # `Aggregate.Command` name or a list. This is where the allowance is declared; a command's own
+  # `mints_era true` is a fallback that must agree. See `Ports::Persistence::MintDoor`.
+  field :mints_era
   # Rewrites every row of an aggregate in one statement, on the same SQL path as Postgres.
   provides "set_transform"
 end

data/lib/hecks/adapters/driven/postgres_era.rb

@@ -63,22 +63,22 @@ module Hecks
       def self.tenant_capable? = true
 
       # Joins the process's shared connection for the declared database and schema, so every
-      # aggregate of a domain runs on one connection, then provisions the journal, this
-      # aggregate's head and field caches, and the event, saga and outbox tables. Every step is
-      # idempotent.
+      # aggregate of a domain runs on one connection, then resolves the era it reads and the field
+      # caches that era holds. Reads only: the lineage, head and cache tables are provisioned by the
+      # mint path, and a database no mint has provisioned refuses by name.
       #
       # @param settings [Hash{Symbol, String => Object}] world settings plus what
       #   `RepositoryFactory.build` merges in: `domain`, `era` and `superseded_by`
-      # @raise [Runtime::WiringError] if `database` is missing or the connection is refused
+      # @raise [Runtime::WiringError] if `database` is missing, the connection is refused, or the
+      #   database holds no era
       def initialize(aggregate:, settings: {}, root: nil)
         @aggregate = aggregate
         @settings  = settings
-        @db = PostgresSharedConnection.for(aggregate.name, settings, connector: self.class)
+        @db = PostgresSharedConnection.for(aggregate.name, settings, connector: ReadConnector)
         @domain = journal_domain(aggregate, settings)
-        @lineage = Lineage.new(@db, @domain)
-        @lineage.ensure_base!
+        @lineage = Lineage.new(@db, @domain, reading: true)
         resolve_era!(settings)
-        provision!
+        @field_caches = existing_field_caches
       end
 
       # Names this aggregate in storage: the journal's `aggregate` value and the stem of its
@@ -87,6 +87,16 @@ module Hecks
       # @return [String] the aggregate's snake_case storage name
       def table = @aggregate.storage_name
 
+      # Whether this binding's `mints_era` names the command: its own record may be journaled
+      # through a boot whose shape no era holds yet.
+      #
+      # @param aggregate_name [String] the aggregate the command belongs to
+      # @param command_name [String] the command
+      # @return [Boolean]
+      def mints_era_declared?(aggregate_name, command_name)
+        Ports::Persistence::MintDoor.declared?(@settings, aggregate_name, command_name)
+      end
+
       # Reads one record's current state through the head view, translated to the current shape.
       #
       # @param id [String, Object] the record's identity, compared as `id.to_s`
@@ -151,7 +161,12 @@ module Hecks
       # @yield the dispatch order; an exception rolls the transaction back
       # @return [Object] the block's own value
       # @raise [PG::ConnectionBad] if the connection dropped; it reconnects, then re-raises
-      def with_write_lock(&) = transaction { lock_writes!; yield } # rubocop:disable Style/Semicolon
+      def with_write_lock(&)
+        transaction do
+          lock_writes!
+          yield
+        end
+      end
 
       # Builds the instance an entry describes, writing nothing; the head is derived, so
       # projecting is reading.
@@ -183,7 +198,7 @@ module Hecks
       # @param id [String, Object] the record's identity, journaled as `id.to_s`
       # @return [true] always
       # @raise [Runtime::WiringError] if this boot's era has been superseded by a mint
-      def delete(id) # rubocop:disable Naming/PredicateMethod -- the repository port's verb, not a question
+      def delete(id)
         entry = Ports::Persistence::Entry.new(operation: "delete", id: id.to_s, state: nil)
         append(entry)
         true

data/lib/hecks/adapters/driven/prism.rb

@@ -10,7 +10,6 @@ module Hecks
       # Not frozen — a real cache, keyed by file path and mutated by
       # #tree_for below (`TREES[file] ||= ...`) and #forget/#forget_all.
       # False positive for Style/MutableConstant.
-      # rubocop:disable-next Style/MutableConstant
       TREES = {}
 
       # The first block node starting on each line, per parsed tree (by identity), built by one

data/lib/hecks/adapters/driven/sql_query_builder.rb

@@ -40,6 +40,7 @@ module Hecks
       # @raise [ArgumentError] if a where clause uses an operator this builder cannot compile,
       #   or `contains` targets a list of a value object with more than one field
       def query(declared, args = {}, context: {})
+        Runtime::Value.check_query_arguments!(@aggregate, declared, args)
         return in_memory_answer(declared, args, context) if in_memory?(declared)
 
         sql = "SELECT #{select_list} FROM #{from_relation}"

data/lib/hecks/adapters/driven/sqlite/dispatch_claims.rb

@@ -17,7 +17,7 @@ module Hecks
         # @param key [String] the dispatch key a saga leg stamped on the command
         # @return [Boolean] true when the key was new and is now held; false when already held
         # @raise [SQLite3::Exception] if the insert fails
-        def dispatch_claim(key) # rubocop:disable Naming/PredicateMethod -- the claim port's verb
+        def dispatch_claim(key)
           @db.execute("INSERT OR IGNORE INTO hecks_dispatch_claims (claim_key, claimed_at) VALUES (?, ?)",
                       [key, Time.now.utc.iso8601])
           @db.changes.positive?

data/lib/hecks/adapters/driven/sqlite/name_guard.rb

@@ -0,0 +1,25 @@
+require_relative "../../../ports/persistence/stored_name_guard"
+
+module Hecks
+  module Adapters
+    class Sqlite
+      # Reads how many rows a table holds before any table is created, for the stored-name guard.
+      module NameGuard
+        private
+
+        def refuse_orphaned_rows!
+          Ports::Persistence::StoredNameGuard.check!(@aggregate, row_count: method(:rows_under))
+        end
+
+        def rows_under(name)
+          [name, "#{name}_entries"].sum { |table| table_rows(table) }
+        end
+
+        def table_rows(table)
+          exists = @db.get_first_value("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?", [table])
+          exists ? @db.get_first_value("SELECT COUNT(*) FROM #{quote_ident(table)}").to_i : 0
+        end
+      end
+    end
+  end
+end