hecks 6.0.0 → 7.0.0

data/lib/hecks/runtime/registry/world_names.rb

@@ -0,0 +1,99 @@
+require_relative "../errors"
+require_relative "../../deprecation"
+
+module Hecks
+  module Runtime
+    class Registry
+      # The names a world gives to what is stored: `stored_as Revision: "commit"` (the table or key
+      # an aggregate's rows sit under) at the world's top level, and `formerly "Old"` in a
+      # persistence block (the name a domain's history is held under until `era.rename_domain`).
+      # These are storage facts, so the world says them and the bluebook does not. The bluebook's
+      # `formerly_known_as` still works as a fallback; it warns once, naming the replacement,
+      # and must agree with the world when both are given.
+      module WorldNames
+        PERSISTENCE_VERB = "persisted_by".freeze
+
+        # Applies each domain's world names to its loaded bluebook, then records the names each
+        # renamed aggregate's rows may sit under. Safe to call again: the result is the same and
+        # the warning is not repeated.
+        #
+        # @return [Registry] self
+        # @raise [WiringError] naming the aggregate or domain when the world and the bluebook
+        #   disagree, or `stored_as` names an aggregate the domain does not declare
+        def apply_world_names!
+          bluebooks.each_value do |bluebook|
+            world = world(bluebook.name)
+            apply_stored_as!(bluebook, world)
+            apply_formerly!(bluebook, world)
+            bluebook.aggregates.each { |aggregate| record_prior_names(bluebook, aggregate) }
+          end
+          self
+        end
+
+        private
+
+        def apply_stored_as!(bluebook, world)
+          given = world ? world.for_verb("stored_as").except(:adapter) : {}
+          given.each { |name, table| adopt_stored_as!(bluebook, name.to_s, table.to_s) }
+        end
+
+        def adopt_stored_as!(bluebook, name, table)
+          aggregate = bluebook.aggregate(name) ||
+                      raise(WiringError, "stored_as names #{name}, but #{bluebook.name} declares no such aggregate")
+          former = aggregate.former_name
+          if former && Naming.snake(former) != Naming.snake(table)
+            raise WiringError, "#{bluebook.name} #{name} is stored_as #{table.inspect} in the world but " \
+                               "formerly_known_as #{former.inspect} in the bluebook: they name different tables. " \
+                               "Keep the world's line and remove the bluebook's."
+          end
+          aggregate.stored_as = table
+        end
+
+        def apply_formerly!(bluebook, world)
+          named = formerly_in(world)
+          return unless named
+
+          declared = bluebook.formerly_known_as
+          if declared && declared != named
+            raise WiringError, "#{bluebook.name} is formerly #{named.inspect} in the world but " \
+                               "formerly_known_as #{declared.inspect} in the bluebook: they name different domains. " \
+                               "Keep the world's line and remove the bluebook's."
+          end
+          bluebook.formerly_known_as = named
+        end
+
+        def formerly_in(world)
+          return nil unless world
+
+          persistence_settings(world).filter_map { |settings| settings[:formerly]&.to_s }.first
+        end
+
+        def persistence_settings(world)
+          world.settings.select { |key, _| key == PERSISTENCE_VERB || key.start_with?("#{PERSISTENCE_VERB}:") }.values
+        end
+
+        def record_prior_names(bluebook, aggregate)
+          aggregate.prior_storage_names = [aggregate.former_name, *renamed_from(bluebook, aggregate)].compact.uniq
+          warn_formerly_known_as(bluebook, aggregate)
+        end
+
+        def renamed_from(bluebook, aggregate)
+          edges = translations.select { |edge| edge.domain == bluebook.name }
+          edges.filter_map { |edge| edge.for_aggregate(aggregate.name)&.was }
+        end
+
+        def warn_formerly_known_as(bluebook, aggregate)
+          former = aggregate.former_name
+          return unless former
+
+          Deprecation.once([bluebook.name, aggregate.name], deprecation_text(bluebook, aggregate, former))
+        end
+
+        def deprecation_text(bluebook, aggregate, former)
+          "[hecks] #{bluebook.name} #{aggregate.name}: `formerly_known_as #{former.inspect}` is deprecated. " \
+            "Say it in the world: `stored_as #{aggregate.name}: #{Naming.snake(former).inspect}`."
+        end
+      end
+    end
+  end
+end

data/lib/hecks/runtime/registry.rb

@@ -7,6 +7,7 @@ require_relative "registry/read_repository"
 require_relative "registry/verification"
 require_relative "registry/saga_persistence"
 require_relative "registry/world_defaults"
+require_relative "registry/world_names"
 require_relative "registry/context_maps"
 require_relative "registry/adapter_capabilities"
 require_relative "outbox"
@@ -26,6 +27,7 @@ module Hecks
       include Verification
       include SagaPersistence
       include WorldDefaults
+      include WorldNames
       include AdapterCapabilities
       include Providers
       include Merging
@@ -35,6 +37,11 @@ module Hecks
       # The thread-local key under which open reaction collections are kept.
       REACTION_SINKS = :hecks_reaction_sinks
 
+      # Guards every registry's reaction log and its outcome index, which dispatching threads all
+      # append to. One lock serves every registry: each hold is a single append, so the contention
+      # is negligible.
+      REACTION_LOCK = Mutex.new
+
       attr_reader :root, :saga_mutex
 
       # What a boot gathers, and what a dispatch produces; each is held by `Declarations` or
@@ -51,7 +58,8 @@ module Hecks
         @root         = root
         # Recorded at hecksagon-build time (AggregateModule#mark_sensitive), Loader.boot's
         # post-dispatch step turns each pending privacy marking into a real Privacy::Marking.Mark,
-        # idempotently. `resolved_eras` and `superseded_eras` are eager, not lazy, so no two
+        # idempotently. `resolved_eras`, `superseded_eras` and `unminted_eras` are eager, not lazy,
+        # so no two
         # dispatching threads race to create them; all writes still happen at boot,
         # single-threaded (EraResolver.check!).
         @declared     = Declarations.empty
@@ -62,6 +70,7 @@ module Hecks
         @saga_mutex   = Mutex.new
         @repositories = {}
         @projection_repositories = {}
+        @saga_persistence = {}
         # Eager: CapabilityGraph.new only stores the registry reference, and eager
         # construction avoids the same first-access race as `resolved_eras` while
         # keeping one instance per registry.
@@ -69,7 +78,6 @@ module Hecks
         # Guards only the lazy per-domain resolution inside @saga_persistence. Must not reuse
         # @saga_mutex: checkpoint calls saga_persistence(domain) from inside
         # @saga_mutex.synchronize, and Mutex is not reentrant.
-        @saga_persistence = {}
         @saga_persistence_mutex = Mutex.new
         @outbox = Outbox::Relay.new(self)
       end
@@ -95,12 +103,11 @@ module Hecks
       # Boot-time-only, single-threaded: every add_* below runs from Hecks.collect while a
       # .bluebook/.hecksagon/.world file is being Kernel.loaded, strictly during Loader.boot,
       # before dispatcher_for hands this registry to a live, multi-threaded caller.
-      # rubocop:disable Hecks/ThreadSharedIvarMutation
       # Registers a loaded bluebook, keyed by its own declared name.
       #
       # @param item [Bluebook::Declaration] the loaded, judged bluebook
       # @return [Bluebook::Declaration] `item`, unchanged
-      def add_bluebook(item) = @declared.bluebooks[item.name] = item
+      def add_bluebook(item) = @declared.store(:bluebooks, item.name, item)
 
       # Drops a bluebook and the open builder and source record that accumulated it, so the
       # bluebook can be loaded again from nothing.
@@ -108,9 +115,9 @@ module Hecks
       # @param name [String, Symbol] the bluebook name to forget
       # @return [void]
       def forget_bluebook(name)
-        @declared.bluebooks.delete(name.to_s)
-        @declared.bluebook_builders.delete(name.to_s)
-        @declared.bluebook_sources.delete(name.to_s)
+        @declared.remove(:bluebooks, name.to_s)
+        @declared.remove(:bluebook_builders, name.to_s)
+        @declared.remove(:bluebook_sources, name.to_s)
       end
 
       # Tracks which .bluebook file(s) contributed to a bluebook name (a boot-time loading
@@ -121,7 +128,7 @@ module Hecks
       # @param path [String] the `.bluebook` file that declared it
       # @return [Array<String>] every path recorded for that bluebook, `path` last
       def record_bluebook_source(name, path)
-        (@declared.bluebook_sources[name.to_s] ||= []) << path
+        @declared.record_source(name.to_s, path)
       end
 
       # Merges into any wiring already registered for the domain rather than replacing it,
@@ -131,7 +138,7 @@ module Hecks
       # @return [void]
       def add_hecksagon(item)
         existing = @declared.hecksagons[item.domain]
-        @declared.hecksagons[item.domain] = existing ? merge_hecksagons(existing, item) : item
+        @declared.store(:hecksagons, item.domain, existing ? merge_hecksagons(existing, item) : item)
         mark_bounded(item.domain) if item.bounded?
       end
 
@@ -143,7 +150,7 @@ module Hecks
       # @param name [String, Symbol] the bluebook name to mark bounded
       # @return [void]
       def mark_bounded(name)
-        @declared.bounded_bluebooks[name.to_s] = true
+        @declared.store(:bounded_bluebooks, name.to_s, true)
       end
 
       # Says whether `name` is a bounded context — attached via `attaches`, or a consumer
@@ -157,13 +164,13 @@ module Hecks
       #
       # @param item [Bluebook::Port, Bluebook::DomainPort] the loaded port
       # @return [Bluebook::Port, Bluebook::DomainPort] `item`, unchanged
-      def add_port(item) = @declared.ports[item.name] = item
+      def add_port(item) = @declared.store(:ports, item.name, item)
 
       # Registers a loaded adapter, keyed by its own declared name.
       #
       # @param item [Bluebook::Adapter] the loaded, judged adapter
       # @return [Bluebook::Adapter] `item`, unchanged
-      def add_adapter(item) = @declared.adapters[item.name] = item
+      def add_adapter(item) = @declared.store(:adapters, item.name, item)
 
       # Finds the plugin adapters that say they answer a query.
       #
@@ -182,7 +189,7 @@ module Hecks
       # @return [void]
       def add_world(item)
         existing = @declared.worlds[item.domain]
-        @declared.worlds[item.domain] = existing ? merge_worlds(existing, item) : item
+        @declared.store(:worlds, item.domain, existing ? merge_worlds(existing, item) : item)
       end
 
       # Registers a loaded translation.
@@ -190,7 +197,7 @@ module Hecks
       # @param item [Bluebook::Translation] the loaded, judged translation
       # @return [Array<Bluebook::Translation>] every translation registered so far,
       #   `item` last
-      def add_translation(item) = @declared.translations << item
+      def add_translation(item) = @declared.append(:translations, item)
 
       # Declares one attribute of a domain's aggregate sensitive, called from a terminal
       # has_<category>(readable_by:). Recorded, not dispatched: Loader.boot's
@@ -205,15 +212,17 @@ module Hecks
       # @param readable_by [String] the Governance role a read must hold, unredacted
       # @return [void]
       def add_pending_privacy_marking(domain:, attribute_path:, category:, readable_by:)
-        @declared.pending_privacy_markings << { domain: domain, attribute_path: attribute_path,
-                                                category: category, readable_by: readable_by }
+        @declared.append(:pending_privacy_markings, { domain: domain, attribute_path: attribute_path,
+                                                      category: category, readable_by: readable_by })
       end
-      # rubocop:enable Hecks/ThreadSharedIvarMutation
 
       # `resolved_eras` is {domain name => era ordinal} resolved by the boot-time era gate;
       # `superseded_eras` is the domain name -> the ordinal that superseded this boot's own era,
-      # for an old checkout only. Stood up eagerly; plain readers, not memoizers.
-      def_delegators :@declared, :resolved_eras, :superseded_eras
+      # for an old checkout only. `unminted_eras` is the domain name -> the latest held ordinal, set
+      # when this boot's shape matches no held era and no mint was requested: the copy reads and
+      # refuses writes. `behind_eras` is the same, for a shape a recorded move or edge leads to from
+      # the latest held era. Stood up eagerly; plain readers, not memoizers.
+      def_delegators :@declared, :resolved_eras, :superseded_eras, :unminted_eras, :behind_eras
 
       # Finds a loaded bluebook by name.
       #
@@ -278,10 +287,8 @@ module Hecks
       # @param record [Hash{Symbol => Object}] the reaction's outcome
       # @param event [String, Integer, nil] identity of the event instance the reaction answered
       # @return [void]
-      # rubocop:disable-next Hecks/ThreadSharedIvarMutation
       def log_reaction(record, event: nil)
-        @state.reaction_log << record
-        @state.reaction_events[record] = event if event
+        REACTION_LOCK.synchronize { @state.log_reaction(record, event) }
         Array(Thread.current[REACTION_SINKS]).each { |sink| sink << record }
       end
 
@@ -310,16 +317,15 @@ module Hecks
       # what booting the files produced (bluebooks, hecksagons, ports, adapters, worlds,
       # resolved eras) untouched.
       #
-      # Repositories are dropped, not emptied, so a fresh Memory adapter starts empty while
-      # a durable one still sees what it persisted. Single-threaded caller only
+      # Repositories are dropped from the registry's maps, so a fresh Memory adapter starts empty
+      # while a durable one still sees what it persisted. Single-threaded caller only
       # (Behaviors::Expectations.run_one runs one test at a time).
       #
       # @return [Runtime::Registry] self
-      # rubocop:disable-next Hecks/ThreadSharedIvarMutation
       def reset_runtime_state!
         @state.clear
-        @repositories = {}
-        @projection_repositories = {}
+        @repositories.clear
+        @projection_repositories.clear
         @outbox.clear_log
         rehydrate_sagas!
         self

data/lib/hecks/runtime/saga_interpreter/compensation.rb

@@ -62,6 +62,8 @@ module Hecks
         # One try. Answers nil once the compensation has settled (delivered or refused), or the
         # crash that stopped it.
         def compensate_once(leg, entry, record)
+          return refuse_compensation_at_depth_ceiling(record) if @dispatcher.reaction_depth_reached?
+
           reenter_command(leg, entry[:command_name], entry[:args], explicit: true, source_receiver: nil)
           @registry.saga_log << record.merge(delivered: true, compensation: true)
           nil
@@ -73,6 +75,14 @@ module Hecks
           e
         end
 
+        # A compensation is a reaction like any other: past the cascade limit it is recorded
+        # undelivered, never run.
+        def refuse_compensation_at_depth_ceiling(record)
+          @registry.saga_log << record.merge(delivered: false, compensation: true, compensation_failed: true,
+                                             reason: "reaction depth #{@dispatcher.max_reaction_depth} reached")
+          nil
+        end
+
         def log_compensation_retry(record, error, attempt)
           @registry.saga_log << record.merge(delivered: false, reason: error.message, compensation: true,
                                              defect: true, error_class: error.class.name,

data/lib/hecks/runtime/saga_interpreter/correlation.rb

@@ -29,10 +29,19 @@ module Hecks
         # Strings respond to `[]`, so test for Hash/Value explicitly rather than
         # `respond_to?(:[])`.
         def payload_correlation(process_manager, event)
-          path = process_manager.correlates_by.to_s.split(".")
-          path.reduce(event.payload) do |held, segment|
-            held.is_a?(Hash) || held.is_a?(Value) ? held[segment.to_sym] : held
+          path = own_correlation_path(process_manager, event)
+          held = path.reduce(event.payload) do |current, segment|
+            current.is_a?(Hash) || current.is_a?(Value) ? current[segment.to_sym] : current
           end
+          sole_field_scalar(held)
+        end
+
+        # A path ending at a single-field value object reads that object's one field, so a bare
+        # `Thing.id` keys by the same scalar `Thing.id.value` does.
+        def sole_field_scalar(held)
+          return held unless held.is_a?(Value)
+
+          Value.materialize_unwrapped(held)
         end
 
         # The stamp `deliver_saga_dispatch` puts on its own event, for legs whose command
@@ -42,6 +51,19 @@ module Hecks
           event.correlation && event.correlation[process_manager.correlation_head.to_s]
         end
 
+        # `Message.id` (what a bare `correlates_by Message` resolves to) names the emitting
+        # aggregate's own id: the path is walked without its leading aggregate name.
+        def own_correlation_path(process_manager, event)
+          path = process_manager.correlates_by.to_s.split(".")
+          path.size > 1 && path.first == emitting_aggregate_name(event) ? path.drop(1) : path
+        end
+
+        # The emitting aggregate's bare name, without its domain module.
+        def emitting_aggregate_name(event)
+          _domain, bare_name = event.aggregate.to_s.split("::", 2)
+          bare_name
+        end
+
         def self_identified?(process_manager, event)
           domain, bare_name = event.aggregate.to_s.split("::", 2)
           return false unless bare_name
@@ -49,6 +71,10 @@ module Hecks
           construct = @registry.bluebook(domain)&.aggregate(bare_name)
           return false unless construct
 
+          head, *rest = process_manager.correlates_by.to_s.split(".")
+          # The emitting aggregate's own id, spelled with its name: `Message.id`.
+          return rest == ["id"] if head == bare_name
+
           construct.identity_heads.map(&:to_s).include?(process_manager.correlation_head.to_s)
         end
       end

data/lib/hecks/runtime/saga_interpreter/delivery.rb

@@ -17,7 +17,6 @@ module Hecks
         # Delivers one command a saga leg dispatches: resolves its arguments, logs the inputs they
         # were bound from, then runs the checkpoint/dispatch/compensation ledger protocol with the
         # retries a crash gets.
-        # rubocop:disable-next Metrics/ParameterLists -- spec/runtime/reaction_invocation_spec.rb calls it by name
         def deliver_saga_dispatch(process_manager, spec, event, instance, correlation, domain, dispatch_key: nil)
           leg = Leg.new(process_manager, event, domain, correlation, nil, instance)
           leg.dispatch_key = dispatch_key

data/lib/hecks/runtime/saga_interpreter/lifecycle.rb

@@ -38,7 +38,7 @@ module Hecks
         end
 
         def end_saga(process_manager, event, domain)
-          return unless event.name == process_manager.ends_on
+          return unless process_manager.ending_events.include?(event.name)
 
           correlation = saga_correlation(process_manager, event)
           return if correlation.to_s.empty?

data/lib/hecks/runtime/saga_interpreter.rb

@@ -27,6 +27,11 @@ module Hecks
       # The trigger lives on the declaration it triggers — see ProcessManager::REFUSED.
       REFUSED = Bluebook::ProcessManager::REFUSED
 
+      # The state a saga parks in when a stage faults, and the memory key that records the state it
+      # faulted from.
+      NEEDS_HUMAN = "needs_human".freeze
+      FAULTED_FROM_KEY = :__hecks_saga_faulted_from__
+
       # A crash gets this many retries before it's treated as something to
       # compensate for, instead of unwinding on the first failure.
       MAX_DEFECT_RETRIES = 3
@@ -54,14 +59,25 @@ module Hecks
         # @return [Array] the dispatches the taken handler declares
         def dispatches = handler.dispatches
 
-        # Moves the instance into the handler's state, remembering the state it left.
+        # Moves the instance into the handler's state, remembering the state it left. A move into
+        # `needs_human` also records that state in the instance's memory, so a resume knows the
+        # stage that faulted.
         #
         # @param leg_handler [Bluebook::ProcessManager::Handler] the leg being taken
         # @return [void]
         def take(leg_handler)
           self.handler   = leg_handler
           self.pre_state = instance[:state]
-          instance[:state] = leg_handler.to_state
+          to_state = leg_handler.to_state
+          instance[:state] = to_state
+          remember_fault_origin if to_state == NEEDS_HUMAN
+        end
+
+        # Records the state the instance faulted from, under the saga's memory.
+        #
+        # @return [void]
+        def remember_fault_origin
+          (instance[:memory] ||= {})[FAULTED_FROM_KEY] = pre_state
         end
 
         # The identity the leg stamps on the dispatch it is delivering.
@@ -114,8 +130,36 @@ module Hecks
         end
       end
 
+      # Puts a faulted saga instance back in the stage it faulted from, so the caller can dispatch
+      # that stage again with the arguments the saga started with. Dispatches nothing itself.
+      #
+      # @param domain [String, Symbol] the domain whose saga is resumed
+      # @param process_manager [String] the declared saga's name
+      # @param correlation [String] the instance's correlation key
+      # @return [Hash{Symbol => Object}] `:resumed` true with the `:stage` to dispatch and the
+      #   saved `:arguments`, or `:resumed` false with a `:reason`
+      def resume(domain, process_manager, correlation)
+        instance = @registry.saga_instances.dig(process_manager, correlation)
+        return { resumed: false, reason: "no saga #{process_manager} with #{correlation}" } unless instance
+        unless instance[:state] == NEEDS_HUMAN
+          return { resumed: false, reason: "saga is #{instance[:state]}, not #{NEEDS_HUMAN}" }
+        end
+
+        restore_faulted_stage(domain, process_manager, correlation, instance)
+      end
+
       private
 
+      # Moves a needs_human instance back to the stage it faulted from, forgets that record, and
+      # checkpoints the move.
+      def restore_faulted_stage(domain, process_manager, correlation, instance)
+        stage = instance[:memory].delete(FAULTED_FROM_KEY)
+        instance[:state] = stage
+        definition = @registry.bluebook(domain).process_managers.find { |pm| pm.name == process_manager }
+        checkpoint(definition, correlation, instance, domain)
+        { resumed: true, stage: stage, arguments: instance[:memory].dup }
+      end
+
       # Holds `saga_mutex` across both the in-memory mutation and the
       # persistence write, never just the mutation — otherwise two threads
       # racing the same (process_manager, correlation) key could interleave

data/lib/hecks/runtime/value/coercion.rb

@@ -37,21 +37,49 @@ module Hecks
         # Coerces `value` for a single, already-resolved `attribute`, branching on
         # its declared shape (list, reference, composite, or bare scalar).
         #
-        # `boundary: false` is the query entry point, where a declared type documents the
-        # argument for callers/generators rather than naming a shape to enforce.
         # `argument: true` is the command/entity/port dispatch entry point, where a nil for
         # a required attribute is a left-empty argument (C3.7), not ordinary state nil.
+        # A query's arguments are coerced here too, so a bare scalar of the wrong type refuses
+        # for a query exactly as it does for a command.
         #
         # @raise [Runtime::TypeMismatch] if `value` cannot be coerced, or a required
         #   reference/attribute is a wrong-shaped value
         # @raise [Runtime::UnknownArgument] if `value` is a Hash naming an undeclared field
         # @raise [Runtime::InvariantViolation] if a coerced value object breaks an invariant
-        def for_attribute(aggregate, attribute, value, boundary: true, argument: false)
+        def for_attribute(aggregate, attribute, value, argument: false)
           return nil_or_missing(aggregate, attribute, value, argument) if attribute.nil? || value.nil?
           return reference_or_list(aggregate, attribute, value) if attribute.list? || attribute.reference?
           return value unless aggregate.respond_to?(:value_object)
 
-          coerce_scalar(aggregate, attribute, value, boundary)
+          coerce_scalar(aggregate, attribute, value)
+        end
+
+        # Refuses a query argument whose bare value does not match its declared scalar type, with
+        # the refusal a command argument of that type gets. A nil, a list, a reference and a value
+        # object are left to `for_attribute`, which owns their shape.
+        #
+        # @param aggregate [Bluebook::Aggregate, Bluebook::Entity] the queried construct
+        # @param attribute [Bluebook::Attribute] the query's declared argument
+        # @param value [Object] the offered value
+        # @raise [Runtime::TypeMismatch] if `value` is not of the attribute's declared scalar type
+        def check_query_argument!(aggregate, attribute, value)
+          return if value.nil? || attribute.list? || attribute.reference?
+          return unless aggregate.respond_to?(:value_object) && value_object_for(aggregate, attribute.type).nil?
+
+          check_bare_primitive(aggregate, attribute, value)
+        end
+
+        # Shape-checks every declared argument of `declared` that `args` offers, before any store
+        # is read. The Postgres query builder calls it so its own path refuses what the query
+        # interpreter refuses.
+        #
+        # @param aggregate [Bluebook::Aggregate, Bluebook::Entity] the queried construct
+        # @param declared [Bluebook::Query] the declared query whose `attributes` are its arguments
+        # @param args [Hash{Symbol => Object}] the offered argument values
+        # @raise [Runtime::TypeMismatch] if an offered bare scalar does not match its declared type
+        def check_query_arguments!(aggregate, declared, args)
+          attributes = declared.respond_to?(:attributes) ? declared.attributes : []
+          attributes.each { |attribute| check_query_argument!(aggregate, attribute, args[attribute.name.to_sym]) }
         end
 
         # Resolves the value-object class `type` names: `aggregate`'s own
@@ -150,9 +178,9 @@ module Hecks
         # A bare scalar or a value object. `admits:` is checked here, where the attribute is
         # known — `build` only sees the value object. Checked after coercion: a scalar arrives
         # wrapped in its type's own holder, and checking the raw payload would be wrong.
-        def coerce_scalar(aggregate, attribute, value, boundary)
+        def coerce_scalar(aggregate, attribute, value)
           value_object = value_object_for(aggregate, attribute.type)
-          return bare_primitive(aggregate, attribute, value, boundary) if value_object.nil?
+          return bare_primitive(aggregate, attribute, value) if value_object.nil?
 
           coerced = if value.is_a?(self) && value.type_name == value_object.hecks_name
                       value
@@ -195,8 +223,8 @@ module Hecks
         # A bare primitive is boundary-checked too (C3.8) — wrong-typed input
         # refuses here as a TypeMismatch, never later as a broken predicate.
         # Its `admits:` set is still checked, exactly as a value object's is.
-        def bare_primitive(aggregate, attribute, value, boundary)
-          check_bare_primitive(aggregate, attribute, value) if boundary
+        def bare_primitive(aggregate, attribute, value)
+          check_bare_primitive(aggregate, attribute, value)
           admit_declared_set(aggregate, attribute, value)
           value
         end

data/lib/hecks/rust_build/conformance.rb

@@ -5,6 +5,7 @@ require "open3"
 require_relative "../rust_build"
 require_relative "native_build"
 require_relative "conformance/surface"
+require_relative "kernel_input"
 
 module Hecks
   module RustBuild
@@ -49,18 +50,28 @@ module Hecks
       # The artifact's JSON for the script: live from a binary, or read from a file.
       def artifact_output(domain, script, other)
         case other
-        when "native" then run_binary(native_binary || missing_native!, script)
-        when "build" then run_binary(built_binary(domain), script)
+        when "native" then run_binary(native_binary || missing_native!, kernel_input(domain, script))
+        when "build" then run_binary(built_binary(domain), kernel_input(domain, script))
         when WASM_MODULE then run_wasm(domain, script, other)
-        when method(:pinned_binary?) then run_binary(other, script)
+        when method(:pinned_binary?) then run_binary(other, kernel_input(domain, script))
         else File.read(other)
         end
       end
 
+      # The stdin a compiled artifact reads: the script's steps with the domain's `defaults`,
+      # `needs` and `query_needs` tables beside them, as every other conformance caller sends
+      # them (`KernelInput`). Without the tables the kernel never answers a fact the declaration
+      # `needs`, and a Ruby-filled argument refuses on the Rust side.
+      def kernel_input(domain, script)
+        input = JSON.parse(File.read(script))
+        KernelInput.tables_for(domain).each { |name, table| input[name] = table unless table.empty? }
+        JSON.generate(input)
+      end
+
       def run_wasm(domain, script, wasm)
         raise Failure, "#{wasm}: no such file — run hecks build_wasm #{domain} first" unless File.exist?(wasm)
 
-        run_process(["wasmtime", "run", wasm], File.read(script))
+        run_process(["wasmtime", "run", wasm], kernel_input(domain, script))
       end
 
       # A pinned per-domain binary, as named by a sweep's `replay:` line.
@@ -68,7 +79,7 @@ module Hecks
         !path.end_with?(".json") && File.file?(path) && File.executable?(path)
       end
 
-      def run_binary(binary, script) = run_process([binary], File.read(script))
+      def run_binary(binary, stdin) = run_process([binary], stdin)
 
       def run_process(command, stdin_data)
         stdout, status = Open3.capture2(*command, stdin_data: stdin_data)

data/lib/hecks/rust_build/parser.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require_relative "../rust_build"
+
+module Hecks
+  module RustBuild
+    # Builds the `hecks-parse` binary from `rust/parser`, the one the bluebook parser specs run, so
+    # they need no hand build to reach it.
+    #
+    #   Parser.call([])
+    #
+    # Writes `rust/parser/target/debug/hecks-parse`, the path those specs look for.
+    module Parser
+      module_function
+
+      # @param _argv [Array<String>] unused: the crate has one build
+      # @return [Integer] 0 once the binary is built
+      # @raise [Failure] when cargo cannot build it
+      def call(_argv)
+        RustBuild.command!("cargo", "build", chdir: File.join(RustBuild.rust_dir, "parser"))
+        0
+      end
+    end
+  end
+end