hecks 7.0.0 → 7.1.0

data/lib/hecks/release/approval.rb

@@ -58,8 +58,10 @@ module Hecks
 
       # Reads the decision's inputs from the environment `release.yml` gives it.
       #
-      # @param env [#[]] `COMMIT_MESSAGE`, or `COMMIT` (the first-parent commit that set the version,
-      #   whose message is read as {VersionCommit} reads it), `TAG_EXISTS` (true/false), `APPROVED_BY`
+      # @param env [#[]] `COMMIT_MESSAGE`, or `COMMIT` (the first-parent commit that set the
+      #   version,
+      #   whose message is read as {VersionCommit} reads it), `TAG_EXISTS` (true/false),
+      #   `APPROVED_BY`
       # @param out [#puts] where the words go
       # @return [Integer] the exit status: 0 to go ahead, 1 to refuse
       def check(env: ENV, out: $stdout)

data/lib/hecks/runtime/event_log.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Hecks
+  module Runtime
+    # The registry's list of emitted events. It is an Array in every respect; the addition is two
+    # observers, told of each event as it is appended and of each policy reaction as it is logged,
+    # which is how an opt-in tap sees what the runtime dispatched.
+    class EventLog < Array
+      # @return [#call, nil] told of each event appended; nil when nothing watches
+      attr_accessor :observer
+
+      # @return [#call, nil] told of each policy reaction with its record and the identity of the
+      #   event it answered; nil when nothing watches
+      attr_accessor :reaction_observer
+
+      # Appends an event and tells the observer of it.
+      #
+      # @param event [Runtime::Event] the emitted event
+      # @return [EventLog] self
+      def <<(event)
+        super
+        observer&.call(event)
+        self
+      end
+    end
+  end
+end

data/lib/hecks/runtime/event_tap.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+require "time"
+require_relative "event"
+
+module Hecks
+  module Runtime
+    # An opt-in, append-only local log of what the runtime dispatched: one JSON line per event and
+    # one per policy delivery. It exists for the domains that persist nothing (Memory keeps no
+    # journal), so a reader such as the PipelineBoard can still see them.
+    #
+    # It is off unless a world declares it: `event_log "EventTap", path: "...", max_bytes: N`. A
+    # client's world declares nothing, so a client writes no file. The boot may hand in an
+    # override for a process no hecks command runs (a spec run, and the children it starts): a
+    # path replaces the world's, and an empty value switches the tap off, so a spec never writes
+    # the owner's log. The log holds names, identities and outcomes, never payloads. A write
+    # that fails is dropped: logging never refuses a command.
+    class EventTap
+      # The world verb that switches the tap on.
+      VERB = "event_log"
+
+      # Bytes after which the log moves to `<path>.1` and starts again.
+      DEFAULT_MAX_BYTES = 5_000_000
+
+      # Switches the tap on for a registry whose Hecks world declares it.
+      #
+      # @param registry [Runtime::Registry] the registry whose events and reactions are tapped
+      # @param override [String, nil] a path in place of the world's; empty switches the tap off
+      # @return [EventTap, nil] the tap, nil when no world asks for one
+      def self.install(registry, override: nil)
+        settings = registry.world("Hecks")&.for_verb(VERB).to_h
+        path = path_for(settings, override)
+        return nil unless path
+
+        tap = new(path: path, max_bytes: settings.fetch(:max_bytes, DEFAULT_MAX_BYTES))
+        registry.event_log.observer = tap.method(:event)
+        registry.event_log.reaction_observer = tap.method(:reaction)
+        tap
+      end
+
+      # Where a world's tap writes: the override when one is given, else the world's path.
+      #
+      # @param settings [Hash] the Hecks world's `event_log` settings
+      # @param override [String, nil] a path in place of the world's; empty switches the tap off
+      # @return [String, nil] the log file; nil for no declared tap or an empty override
+      def self.path_for(settings, override = nil)
+        return nil if settings.to_h[:path].to_s.empty?
+
+        path = override.nil? ? settings[:path] : override
+        path.to_s.empty? ? nil : path
+      end
+
+      # @param path [String] the log file; `~` is the home directory
+      # @param max_bytes [Integer] the size at which the log rotates
+      def initialize(path:, max_bytes: DEFAULT_MAX_BYTES)
+        @path = File.expand_path(path.to_s)
+        @max_bytes = max_bytes.to_i
+        @lock = Mutex.new
+      end
+
+      # Appends one line for an emitted event.
+      #
+      # @param event [Runtime::Event] the event
+      # @return [void]
+      def event(event)
+        write("kind" => "event", "at" => event.occurred_at, "aggregate" => event.aggregate,
+              "id" => event.id.to_s, "event" => event.name)
+      end
+
+      # Appends one line for a policy delivery: which policy reacted to which event, the command it
+      # reached and what became of the delivery.
+      #
+      # @param record [Hash{Symbol => Object}] the reaction's outcome
+      # @param identity [String, Integer, nil] the identity of the event instance it answered
+      # @return [void]
+      def reaction(record, identity)
+        write("kind" => "reaction", "at" => Event.stamp, "id" => identity.to_s, "event" => record[:on].to_s,
+              "policy" => record[:policy].to_s, "command" => record[:trigger].to_s, "outcome" => outcome(record))
+      end
+
+      private
+
+      def outcome(record)
+        return "delivered" if record[:delivered]
+
+        "refused: #{record[:reason].to_s.slice(0, 160)}"
+      end
+
+      def write(line)
+        @lock.synchronize do
+          FileUtils.mkdir_p(File.dirname(@path))
+          rotate
+          File.open(@path, "a") { |file| file.puts(JSON.generate(line)) }
+        end
+      rescue SystemCallError, IOError
+        nil
+      end
+
+      def rotate
+        File.rename(@path, "#{@path}.1") if File.exist?(@path) && File.size(@path) >= @max_bytes
+      end
+    end
+  end
+end

data/lib/hecks/runtime/loader/boot_steps.rb

@@ -49,7 +49,7 @@ module Hecks
           registry.verify!
 
           gates.register(:saga_rehydration, ->(reg, _dir) { reg.rehydrate_sagas! }, phase: :post_verify) if
-            registry.saga_domains.any? { |domain| registry.saga_persistence(domain) != Ports::Persistence::NULL_SAGA_STORE }
+            registry.saga_domains.any? { |domain| registry.saga_durable?(domain) }
           gates.run!(:post_verify, registry, directory)
           gates
         end

data/lib/hecks/runtime/loader.rb

@@ -2,6 +2,7 @@ require_relative "../ports/loading"
 require_relative "../ports/persistence"
 require_relative "../ports/dispatch"
 require_relative "dispatcher"
+require_relative "event_tap"
 require_relative "boot_gates"
 require_relative "registry"
 require_relative "loader/boot_steps"
@@ -23,23 +24,26 @@ module Hecks
       # @param path [String] a domain directory to boot
       # @param shared [String, nil] shared ports/adapters root; nil walks up from `path`
       # @param environment [String, nil] environment overlay loaded after the domain; nil loads none
+      # @param event_tap [String, nil] a path in place of the Hecks world's event tap; empty
+      #   switches the tap off, nil leaves the world's where it is
       # @return [Runtime::Dispatcher, Adapters::Lambda::RemoteDispatcher] the booted dispatcher
       # @raise [Errno::ENOENT] if `path` names no domain directory
       # @raise [Runtime::WiringError] if a boot gate finds a wiring problem
-      def self.boot(path, shared: nil, environment: nil)
-        boot_described(describe(path, shared: shared, environment: environment))
+      def self.boot(path, shared: nil, environment: nil, event_tap: nil)
+        boot_described(describe(path, shared: shared, environment: environment), event_tap: event_tap)
       end
 
       # Finishes a boot from declarations `describe` already loaded: runs every boot gate and builds
       # the dispatcher, without reading the domain's files again.
       #
       # @param described [Described] what `describe` answered for the domain to boot
+      # @param event_tap [String, nil] a path in place of the Hecks world's event tap; see `boot`
       # @return [Runtime::Dispatcher, Adapters::Lambda::RemoteDispatcher] the booted dispatcher
       # @raise [Runtime::WiringError] if a boot gate finds a wiring problem
-      def self.boot_described(described)
+      def self.boot_described(described, event_tap: nil)
         registry = described.registry
         run_boot_gates!(registry, described.directory)
-        dispatcher = dispatcher_for(registry)
+        dispatcher = dispatcher_for(registry, event_tap)
         redrive_outbox!(dispatcher)
         redrive_sagas!(dispatcher)
         seed_privacy_markings!(dispatcher, registry)
@@ -95,39 +99,41 @@ module Hecks
         dispatcher.redrive_sagas!
       end
 
-      # Boots the exact bluebook/hecksagon/world files in `paths`, in place —
-      # unlike `boot`, no directory globbing and no copying into a temp dir
-      # (a `persisted_by` path must resolve against the real project root,
-      # not a copy's).
+      # Boots the exact bluebook/hecksagon/world files in `paths`, in place: unlike `boot`, no
+      # directory globbing and no copying into a temp dir (a `persisted_by` path must resolve
+      # against the real project root, not a copy's).
       #
       # @param paths [Array<String>, String] the exact file paths to boot, in load order
       # @param shared [String, nil] shared ports/adapters root; nil walks up from the first path
-      # @param environment [String, nil] environment overlay loaded after the named files; nil
-      #   loads none
+      # @param environment [String, nil] overlay loaded after the named files; nil loads none
+      # @param adapters [Array<String>, nil] exactly the `.adapter` files to load, the project's own
+      #   left unloaded even when this is empty; nil leaves the choice to `load_files`
+      # @param event_tap [String, nil] a path in place of the Hecks world's event tap; see `boot`
       # @return [Runtime::Dispatcher, Adapters::Lambda::RemoteDispatcher] the booted dispatcher
       # @raise [Runtime::WiringError] if a boot gate finds a wiring problem
-      def self.boot_files(paths, shared: nil, environment: nil)
+      def self.boot_files(paths, shared: nil, environment: nil, adapters: nil, event_tap: nil)
         loading   = Ports::Loading.bootstrap
         files     = Array(paths).map { |path| File.expand_path(path) }
         directory = File.dirname(files.first)
-        registry  = load_files(loading, files, shared, environment)
+        registry  = load_files(loading, files + Array(adapters), shared, environment, chosen: !adapters.nil?)
 
         run_boot_gates!(registry, directory)
-        dispatcher_for(registry)
+        dispatcher_for(registry, event_tap)
       end
 
       # Loads exactly `files` into a fresh Registry rooted beside their directory, answering it. An
       # `.adapter` among them stands in for the shared root's adapters, which are then left
-      # unloaded, so a
-      # test can answer a port with its own adapter and never construct the domain's real one.
-      def self.load_files(loading, files, shared, overlay)
+      # unloaded, so a test can answer a port with its own adapter and never construct the domain's
+      # real one. `chosen` says the caller chose the adapters itself (a behaviors suite, ADR 0171),
+      # so the shared root's stay unloaded even when it chose none.
+      def self.load_files(loading, files, shared, overlay, chosen: false)
         directory = File.dirname(files.first)
         root      = loading.shared_root(shared, directory)
         registry  = Registry.new(root: File.dirname(directory))
 
         Hecks.with_registry(registry) do
           loading.load_library
-          loading.load_project(root, adapters: files.none? { |file| file.end_with?(".adapter") })
+          loading.load_project(root, adapters: !chosen && files.none? { |file| file.end_with?(".adapter") })
           loading.load_selected(files, environment: overlay)
         end
         registry
@@ -139,15 +145,25 @@ module Hecks
       # means a deploy target exists.
       #
       # @param registry [Runtime::Registry] the booted registry
+      # @param event_tap [String, nil] a path in place of the Hecks world's event tap; see `boot`
       # @return [Runtime::Dispatcher, Object] the dispatcher the boot hands back
       # @raise [Runtime::WiringError] if the bound adapter cannot build a dispatcher
-      def self.dispatcher_for(registry)
+      def self.dispatcher_for(registry, event_tap = nil)
         settings = registry.world(registry.bluebooks.keys.first)&.for_verb(Ports::Dispatch::VERB) || {}
-        return Dispatcher.new(registry) unless settings[:adapter]
+        return local_dispatcher(registry, event_tap) unless settings[:adapter]
 
         Ports::Dispatch.dispatcher(registry, settings)
       end
 
+      # The local `Dispatcher`, with the opt-in event log tapped when the Hecks world asks for it.
+      #
+      # @param registry [Runtime::Registry] the booted registry
+      # @param event_tap [String, nil] a path in place of the Hecks world's event tap; see `boot`
+      # @return [Runtime::Dispatcher]
+      def self.local_dispatcher(registry, event_tap = nil)
+        Dispatcher.new(registry).tap { EventTap.install(registry, override: event_tap) }
+      end
+
       # Installs the Ruby facade over a dispatcher built by hand. See `Hecks.bind_runtime`.
       #
       # @param dispatcher [Runtime::Dispatcher] a dispatcher over a verified registry

data/lib/hecks/runtime/registry/durability_warnings.rb

@@ -69,18 +69,25 @@ module Hecks
         # A warning, not a refusal: running sagas on a store with no `save_saga` is
         # legitimate on purpose in a fast in-memory test/dev boot.
         def warn_undurable_sagas!(hecksagon)
-          bluebook_ir = bluebook(hecksagon.domain)
-          return unless bluebook_ir
-          return if bluebook_ir.process_managers.empty?
-          return unless saga_persistence(hecksagon.domain).equal?(Ports::Persistence::NULL_SAGA_STORE)
+          undurable = undurable_process_managers(hecksagon.domain)
+          return if undurable.empty?
 
-          names = bluebook_ir.process_managers.map(&:name).join(", ")
+          names = undurable.map(&:name).join(", ")
           warn "[hecks] #{hecksagon.domain} declares process_manager(s) #{names} but its resolved " \
                "persistence adapter has no save_saga — saga state advances correctly in-process " \
                "and is LOST on restart (no checkpoint, no rehydration, no compensation replay). " \
                "Bind this domain to an adapter that implements save_saga if this process_manager " \
                "must survive a crash."
         end
+
+        # The process managers whose checkpoints no store keeps: each is held by its starting
+        # aggregate's store or by the domain's, and either may be the null store.
+        def undurable_process_managers(domain)
+          process_managers = bluebook(domain)&.process_managers || []
+          process_managers.select do |process_manager|
+            saga_persistence(domain, process_manager).equal?(Ports::Persistence::NULL_SAGA_STORE)
+          end
+        end
       end
     end
   end

data/lib/hecks/runtime/registry/runtime_state.rb

@@ -1,3 +1,5 @@
+require_relative "../event_log"
+
 module Hecks
   module Runtime
     class Registry
@@ -13,7 +15,7 @@ module Hecks
                                 :saga_dispatch_log, :policy_dispatch_log, :cross_domain_log, :saga_instances) do
         # @return [RuntimeState] every log empty and no saga instances
         def self.fresh
-          new([], [], {}.compare_by_identity, [], [], [], [], Hash.new { |hash, key| hash[key] = {} })
+          new(EventLog.new, [], {}.compare_by_identity, [], [], [], [], Hash.new { |hash, key| hash[key] = {} })
         end
 
         # Empties every log and drops every saga instance.
@@ -31,6 +33,7 @@ module Hecks
         def log_reaction(record, event)
           reaction_log << record
           reaction_events[record] = event if event
+          event_log.reaction_observer&.call(record, event)
         end
       end
     end

data/lib/hecks/runtime/registry/saga_anchor.rb

@@ -0,0 +1,54 @@
+module Hecks
+  module Runtime
+    class Registry
+      # Which aggregate's store holds a process manager's checkpoints: the one aggregate whose
+      # command emits the event the process manager starts on, when the domain's hecksagon binds
+      # that aggregate on its own. A process manager with no such aggregate is held by the
+      # domain's store. Mixed into {SagaPersistence}.
+      module SagaAnchor
+        # @param domain [String, Symbol] the domain declaring the process manager
+        # @param process_manager [Bluebook::ProcessManager, String] the process manager or its name
+        # @return [Bluebook::Aggregate, nil] the starting aggregate with a bind of its own, or nil
+        def saga_anchor(domain, process_manager)
+          declared = declared_process_manager(domain, process_manager) or return nil
+          starters = starting_aggregates(domain, declared.starts_on.to_s)
+          return nil unless starters.size == 1 && bound_on_its_own?(domain, starters.first)
+
+          starters.first
+        end
+
+        private
+
+        # Every process manager of the domain whose store is not the domain's own, by name.
+        def routed_sagas(domain)
+          home = saga_persistence(domain)
+          stores = process_managers_of(domain).to_h { |declared| [declared.name, saga_persistence(domain, declared)] }
+          stores.reject { |_name, store| store.equal?(home) }
+        end
+
+        def process_managers_of(domain) = bluebook(domain)&.process_managers || []
+
+        def declared_process_manager(domain, process_manager)
+          return process_manager if process_manager.respond_to?(:starts_on)
+
+          process_managers_of(domain).find { |declared| declared.name == process_manager.to_s }
+        end
+
+        def starting_aggregates(domain, event_name)
+          return [] if event_name.empty?
+
+          bluebook(domain).aggregates.select do |aggregate|
+            aggregate.commands.any? { |command| command.emits.map(&:to_s).include?(event_name) }
+          end
+        end
+
+        def bound_on_its_own?(domain, aggregate)
+          binds = hecksagon(domain)&.binds || []
+          binds.any? do |bind|
+            bind.aggregate_name.to_s == aggregate.hecks_name.to_s && bind.verb.to_s == Ports::Persistence::VERB
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/runtime/registry/saga_durability_rule.rb

@@ -0,0 +1,66 @@
+module Hecks
+  module Runtime
+    class Registry
+      # The refusal that keeps a saga as durable as the aggregates it moves (ADR 0170): a process
+      # manager whose checkpoints no store keeps may not dispatch to an aggregate a store keeps
+      # across a restart. All-Memory stays allowed and keeps its warning. Mixed into {Verification}.
+      module SagaDurabilityRule
+        private
+
+        # Reads every declared bluebook, not each hecksagon: a domain kept by its world's
+        # `default_adapter` or by an attaching chapter has process managers too.
+        def refuse_forgetful_sagas!
+          @declared.bluebooks.each_key do |domain|
+            process_managers_of(domain).each { |process_manager| refuse_forgetful_saga!(domain, process_manager) }
+          end
+        end
+
+        def refuse_forgetful_saga!(domain, process_manager)
+          return unless saga_persistence(domain, process_manager).equal?(Ports::Persistence::NULL_SAGA_STORE)
+
+          kept = dispatched_aggregates(domain, process_manager).find { |aggregate| kept_across_restart(domain, aggregate) }
+          return unless kept
+
+          raise WiringError, forgetful_saga_wording(domain, process_manager, kept)
+        end
+
+        # The domain's own aggregates a process manager's legs and compensations dispatch to.
+        def dispatched_aggregates(domain, process_manager)
+          names = dispatch_specs(process_manager).map { |spec| aggregate_of_command(spec.command_name) }
+          bluebook(domain).aggregates.select { |aggregate| names.include?(aggregate.name.to_s) }
+        end
+
+        def dispatch_specs(process_manager)
+          process_manager.handlers.flat_map(&:dispatches).flat_map { |spec| [spec, spec.compensates].compact }
+        end
+
+        # `"Drawer.Take"` or `"Wire::Drawer.Take"` names the aggregate `Drawer`.
+        def aggregate_of_command(command_name)
+          path = command_name.to_s.split(".", 2).first
+          path.to_s.split("::").last
+        end
+
+        # The adapter that keeps the aggregate across a restart, or nil. Memory keeps nothing, and
+        # a RemoteRuntime's far side keeps the saga as well as the record. An aggregate whose bind
+        # cannot be resolved is left to the refusal that resolution raises at dispatch.
+        def kept_across_restart(domain, aggregate)
+          bind = Ports::Persistence::BindingPolicy.resolve(self, domain, aggregate)
+          return nil if bind.adapter == Ports::Persistence::DEFAULT_ADAPTER
+          return nil if adapter_class(bind.adapter) <= Ports::Persistence::RemoteRuntime
+
+          bind.adapter
+        rescue WiringError
+          nil
+        end
+
+        def forgetful_saga_wording(domain, process_manager, aggregate)
+          "#{domain}'s process_manager #{process_manager.name} dispatches to #{aggregate.name}, which " \
+            "#{kept_across_restart(domain, aggregate)} keeps across a restart, but its own checkpoints are kept " \
+            "nowhere — after a restart the records stay moved and the saga that would finish or undo the move is " \
+            "gone. A forgotten decision: persist the aggregate it starts from (or the domain's first aggregate) " \
+            "with an adapter that keeps sagas, or keep the whole domain in Memory on purpose (ADR 0170)."
+        end
+      end
+    end
+  end
+end

data/lib/hecks/runtime/registry/saga_persistence.rb

@@ -1,37 +1,70 @@
 require_relative "../saga_pending_dispatch"
+require_relative "saga_anchor"
 
 module Hecks
   module Runtime
     class Registry
       # A domain's sagas persist through whatever adapter its aggregates already use;
       # `save_saga`/`delete_saga`/`each_saga` are optional, `respond_to?`-checked capabilities.
+      # A process manager started by an aggregate the hecksagon binds on its own persists with
+      # that aggregate's records instead (see {SagaAnchor}), so a saga lives where the record
+      # that starts it lives.
       module SagaPersistence
-        # Memoized per domain via double-checked locking; never reuse @saga_mutex, see #initialize.
-        def saga_persistence(domain)
-          key = domain.to_s
+        include SagaAnchor
+
+        # The store one domain's sagas, or one of its process managers, checkpoint to. Memoized
+        # per store via double-checked locking; never reuse @saga_mutex, see #initialize.
+        #
+        # @param domain [String, Symbol] the domain whose sagas are checkpointed
+        # @param process_manager [Bluebook::ProcessManager, String, nil] one process manager,
+        #   whose starting aggregate may hold it; the domain's own store when nil
+        # @return [#save_saga] the adapter, or the null store when nothing can checkpoint
+        def saga_persistence(domain, process_manager = nil)
+          anchor = process_manager && saga_anchor(domain, process_manager)
+          key = anchor ? "#{domain}::#{anchor.hecks_name}" : domain.to_s
           @saga_persistence[key] || @saga_persistence_mutex.synchronize do
-            @saga_persistence[key] ||= resolve_saga_persistence(key)
+            @saga_persistence[key] ||= anchor ? anchored_saga_store(domain, anchor) : resolve_saga_persistence(key)
           end
         end
 
         def saga_domains = @declared.hecksagons.keys | @declared.bluebooks.keys.select { |domain| default_adapter_for(domain) }
 
+        # Whether any saga of the domain checkpoints somewhere that survives a restart.
+        #
+        # @param domain [String, Symbol] the domain whose sagas are asked about
+        # @return [Boolean]
+        def saga_durable?(domain)
+          stores = [saga_persistence(domain), *routed_sagas(domain).values]
+          stores.any? { |store| !store.equal?(Ports::Persistence::NULL_SAGA_STORE) }
+        end
+
         # Boot-time-only (Loader.run_boot_gates!, before dispatch exists); no concurrent
-        # writer to race here, unlike saga_interpreter.rb's writes under @saga_mutex.
+        # writer to race here, unlike saga_interpreter.rb's writes under @saga_mutex. Each store
+        # restores only the process managers that checkpoint to it; the domain's own store
+        # restores every other one, including any the bluebook does not declare.
         def rehydrate_sagas!
           saga_domains.each do |domain|
-            saga_persistence(domain).each_saga do |process_manager, correlation, state, memory, completed_compensations = []|
-              pending = memory.delete(SAGA_PENDING_DISPATCH_KEY)
-              @state.saga_instances[process_manager][correlation] =
-                { state: state, memory: memory, completed_compensations: completed_compensations || [] }
-              stall_saga(process_manager, correlation, pending) if pending
-            end
+            routed = routed_sagas(domain)
+            restore_sagas(saga_persistence(domain)) { |name| !routed.key?(name) }
+            routed.values.uniq.each { |store| restore_sagas(store) { |name| routed[name].equal?(store) } }
           end
           self
         end
 
         private
 
+        # Restores the instances a store holds whose process manager the block accepts.
+        def restore_sagas(store)
+          store.each_saga do |process_manager, correlation, state, memory, completed_compensations = []|
+            next unless yield(process_manager.to_s)
+
+            pending = memory.delete(SAGA_PENDING_DISPATCH_KEY)
+            @state.saga_instances[process_manager][correlation] =
+              { state: state, memory: memory, completed_compensations: completed_compensations || [] }
+            stall_saga(process_manager, correlation, pending) if pending
+          end
+        end
+
         # A pending marker left by a crash: state was checkpointed but the leg's dispatches did
         # not all settle. Held on the instance for `SagaInterpreter#redrive_stalled`, which runs
         # once the dispatcher exists; Heki's each_saga only symbolizes memory's top-level keys,
@@ -40,8 +73,10 @@ module Hecks
           @state.saga_instances[process_manager][correlation][:stalled] = pending.transform_keys(&:to_sym)
         end
 
+        # A domain with no hecksagon resolves the same way: its world's `default_adapter` may keep
+        # its records, and then it keeps its sagas too (ADR 0170).
         def resolve_saga_persistence(domain)
-          anchor = hecksagon(domain) && bluebook(domain)&.aggregates&.first
+          anchor = bluebook(domain)&.aggregates&.first
           return Ports::Persistence::NULL_SAGA_STORE unless anchor
 
           persisting_adapter(domain, anchor)
@@ -50,6 +85,17 @@ module Hecks
           Ports::Persistence::NULL_SAGA_STORE
         end
 
+        # The starting aggregate's store when it can checkpoint sagas, else the domain's own.
+        # Called under the resolution mutex, so the domain's store is memoized here directly.
+        def anchored_saga_store(domain, anchor)
+          store = persisting_adapter(domain, anchor)
+          store.equal?(Ports::Persistence::NULL_SAGA_STORE) ? domain_saga_store(domain) : store
+        rescue WiringError
+          domain_saga_store(domain)
+        end
+
+        def domain_saga_store(domain) = (@saga_persistence[domain.to_s] ||= resolve_saga_persistence(domain.to_s))
+
         # The anchor aggregate's own adapter when it can checkpoint sagas, else the null store.
         def persisting_adapter(domain, anchor)
           bind = Ports::Persistence::BindingPolicy.resolve(self, domain, anchor)

data/lib/hecks/runtime/registry/verification.rb

@@ -6,6 +6,7 @@ require_relative "query_verification"
 require_relative "plugin_query_verification"
 require_relative "bluebook_verification"
 require_relative "durability_warnings"
+require_relative "saga_durability_rule"
 
 module Hecks
   module Runtime
@@ -19,6 +20,7 @@ module Hecks
         include PluginQueryVerification
         include BluebookVerification
         include DurabilityWarnings
+        include SagaDurabilityRule
 
         # Runs every wiring check against this registry's loaded bluebooks, hecksagons, ports
         # and adapters.
@@ -31,9 +33,8 @@ module Hecks
           refuse_membership_without_identity!
           refuse_unresolved_ports!
           refuse_unanswerable_queries!
-
-          @declared.hecksagons.each_value { |hecksagon| verify_hecksagon!(hecksagon) }
-          self
+          refuse_forgetful_sagas!
+          verify_hecksagons!
         end
 
         # Checks that the framework-wide default persistence adapter is itself wired correctly.
@@ -127,6 +128,9 @@ module Hecks
 
         private
 
+        # Every loaded hecksagon's checks, answering the registry.
+        def verify_hecksagons! = tap { @declared.hecksagons.each_value { |hecksagon| verify_hecksagon!(hecksagon) } }
+
         # One hecksagon's checks: its roles, attachments and ACL, every bind, and the durability
         # warnings for its bluebook.
         def verify_hecksagon!(hecksagon)

data/lib/hecks/runtime/saga_interpreter/lifecycle.rb

@@ -53,7 +53,8 @@ module Hecks
           @registry.saga_mutex.synchronize do
             next false unless @registry.saga_instances[process_manager.name].delete(correlation)
 
-            @registry.saga_persistence(domain).delete_saga(process_manager: process_manager.name, correlation: correlation)
+            @registry.saga_persistence(domain, process_manager)
+                     .delete_saga(process_manager: process_manager.name, correlation: correlation)
             true
           end
         end

data/lib/hecks/runtime/saga_interpreter.rb

@@ -168,7 +168,7 @@ module Hecks
       def checkpoint(process_manager, correlation, instance, domain, pending: nil)
         memory = deep_copy(instance[:memory])
         memory[SAGA_PENDING_DISPATCH_KEY] = pending if pending
-        @registry.saga_persistence(domain).save_saga(
+        @registry.saga_persistence(domain, process_manager).save_saga(
           process_manager: process_manager.name, correlation: correlation,
           state: instance[:state], memory: memory,
           completed_compensations: deep_copy_array(instance[:completed_compensations])

data/lib/hecks/rust_format.rb

@@ -22,7 +22,8 @@ module Hecks
     # The most passes `call` makes; a text still changing after them keeps the last result.
     PASSES = 3
 
-    # Serializes the rustfmt children of this process. In a whole-suite run, worker threads capturing
+    # Serializes the rustfmt children of this process. In a whole-suite run, worker threads
+    # capturing
     # at once end with `Errno::EBADF` in `Open3.popen_run`, so each capture waits for this lock.
     SPAWN_LOCK = Mutex.new