@fougere/core 0.10.0-alpha.0 → 0.12.0-alpha.0

package/src/boot/nesting.ts

@@ -0,0 +1,196 @@
+/**
+ * Who inherits code from whom, read off `FougereConfig.fronds` and judged before anything is
+ * built. It reads no disk and holds no container: the scopes it decides are built later, in
+ * `install.ts`, and everything here is a fact about names.
+ *
+ * Documented: [fronds](https://fougere.dev/docs/infra/fronds).
+ */
+import type { Diagnostic } from '../diagnostic.js';
+import type { FrondDescriptor } from '../descriptor/FrondDescriptor.js';
+import { Fronds } from '../descriptor/Fronds.js';
+import { statesModule, type FrondsStated } from '../FrondsStated.js';
+import { statedFronds } from '../StatedFrond.js';
+
+/** A frond that holds what a family shares serves nothing — which is what keeps it here. */
+function refuseServingParent(
+  parent: FrondDescriptor,
+  children: string[],
+  refused: Diagnostic[],
+): boolean {
+  if (parent.handlers.length === 0) return false;
+
+  const served = [...new Set(parent.handlers.map((handler) => handler.address))];
+  refused.push({
+    severity: 'blocking',
+    code: 'frond-parent-serves',
+    filePath: parent.handlers[0]!.filePath,
+    frond: parent.name,
+    subject: parent.name,
+    message: `'${parent.name}' has children (${children.join(', ')}) and answers at `
+      + `${served.join(', ')}. A frond its family inherits from holds the code they share and `
+      + 'nothing else — with no façade, nothing can call it and nothing can place it elsewhere. '
+      + 'Move its handlers into a child, or take the children out.',
+  });
+
+  return true;
+}
+
+/** Rows belong to a frond something can call — the family case is not traced, so it is refused. */
+function refuseParentEntities(
+  parent: FrondDescriptor,
+  children: string[],
+  refused: Diagnostic[],
+): void {
+  if (parent.entities.length === 0) return;
+
+  refused.push({
+    severity: 'blocking',
+    code: 'frond-parent-entities',
+    filePath: parent.entities[0]!.filePath,
+    frond: parent.name,
+    subject: parent.name,
+    message: `'${parent.name}' has children (${children.join(', ')}) and declares `
+      + `${parent.entities.map((entity) => entity.name).join(', ')}. A frond they inherit from `
+      + 'holds code, not rows. Declare the entity in a child and import it from there — '
+      + `\`import X from '@fronds/<child>/entities/X.js'\` reaches it from anywhere.`,
+  });
+}
+
+/** What the tree says, against what this process actually holds. */
+export function nestingOf(
+  stated: FrondsStated | undefined,
+  fronds: Fronds,
+  remotes: Record<string, string> | undefined,
+  /** This process carries a subset of the project — `only:`, so an absent name is expected. */
+  narrowed = false,
+): { under: Map<string, string>; refused: Diagnostic[] } {
+  const refused: Diagnostic[] = [];
+  const under = new Map<string, string>();
+  if (stated === undefined) return { under, refused };
+
+  const statements = statedFronds(stated);
+  const here = new Map(fronds.map((frond) => [frond.name, frond]));
+  const childrenOf = new Map<string, string[]>();
+  const inherits = new Set<string>();
+  for (const statement of statements) {
+    if (statement.extends === undefined) continue;
+
+    inherits.add(statement.key);
+    childrenOf.set(statement.extends, [...(childrenOf.get(statement.extends) ?? []), statement.key]);
+  }
+
+  for (const statement of statements) {
+    if (statement.extends === undefined || !inherits.has(statement.extends)) continue;
+
+    refused.push({
+      severity: 'blocking',
+      code: 'frond-extends-chain',
+      filePath: 'fougere.config.ts',
+      subject: statement.path,
+      message: `'${statement.key}' inherits from '${statement.extends}', which inherits from `
+        + `'${statedFronds(stated).find((one) => one.key === statement.extends)?.extends}'. `
+        + 'Inheriting goes one level: a scope hangs off the one above it, and a chain would make '
+        + 'a frond depend on code its own family never named. Move what they share into one '
+        + 'frond they both inherit from.',
+    });
+  }
+
+  // A frond a family inherits from needs no entry of its own — `extends` is said by the
+  // inheritor — so what it may not be is asked of the NAMES, not of the entries.
+  for (const [parent, children] of childrenOf) {
+    const frond = here.get(parent);
+    if (frond === undefined) continue;
+
+    const placed = stated[parent];
+    const address = typeof placed === 'string' ? placed : placed?.remote;
+    if (address !== undefined || (remotes && parent in remotes)) {
+      refused.push({
+        severity: 'blocking',
+        code: 'frond-parent-remote',
+        filePath: frond.source.path,
+        frond: frond.name,
+        subject: parent,
+        message: `'${parent}' is inherited from by ${children.join(', ')} and is placed at `
+          + `${address ?? remotes?.[parent]}. A frond they inherit from stands in every process `
+          + 'that holds one of them, so it has no address of its own. Give the address to one of '
+          + 'them, or have them inherit from somewhere else.',
+      });
+    }
+
+    if (!refuseServingParent(frond, children, refused)) refuseParentEntities(frond, children, refused);
+  }
+
+  for (const statement of statements) {
+    const frond = here.get(statement.key);
+
+    if (frond === undefined) {
+      // Three ways a stated name is absent from this process and says nothing wrong: a module
+      // key, which the host imports; an address, whose frond answers elsewhere by definition;
+      // and a frond `only:` left out, since the config describes the PROJECT and the flag one
+      // process. What is left is a name nothing carries — a typo, and the config is where it
+      // was made, so that is where the message points.
+      const elsewhere = statement.value !== undefined || (remotes && statement.key in remotes);
+      if (!statesModule(statement.key) && !elsewhere && here.size > 0 && !narrowed) {
+        refused.push({
+          severity: 'blocking',
+          code: 'frond-unknown',
+          filePath: 'fougere.config.ts',
+          subject: statement.path,
+          message: `'${statement.path}' names no frond this project holds. It has `
+            + `${[...here.keys()].join(', ') || 'none'}. Check the spelling, or drop the entry.`,
+        });
+      }
+      continue;
+    }
+
+    if (statement.extends !== undefined && !here.has(statement.extends)) {
+      refused.push({
+        severity: 'blocking',
+        code: 'frond-family-split',
+        filePath: frond.source.path,
+        frond: frond.name,
+        subject: statement.path,
+        message: `'${statement.key}' inherits from '${statement.extends}', which this process does `
+          + 'not carry. A frond cannot leave the code it resolves behind — carry the two '
+          + `together, or take '${statement.key}' out from under '${statement.extends}'.`,
+      });
+      continue;
+    }
+
+    if (statement.extends !== undefined) under.set(statement.key, statement.extends);
+  }
+
+  return { under, refused };
+}
+
+/**
+ * The same fronds, each parent before the ones inheriting from it — the order the boot installs
+ * them in, since a scope hangs off the one above it.
+ *
+ * A partition and not a sort: inheriting goes one level, so a frond that inherits has nothing
+ * under it and two passes are enough. Stable, and the same array when nothing inherits — which
+ * is what `orderSeeds` reads.
+ */
+export function parentsFirst(fronds: Fronds, under: Map<string, string>): Fronds {
+  if (under.size === 0) return fronds;
+
+  return Fronds.hosting([
+    ...fronds.filter((frond) => !under.has(frond.name)),
+    ...fronds.filter((frond) => under.has(frond.name)),
+  ]);
+}
+
+/**
+ * The same `under` a boot stamps, for a reader that does not boot — `fougere check` and
+ * `fougere explain` resolve the model off a scan, and a scan knows nothing of the tree.
+ * Without it they report every inherited dependency as a crossing.
+ */
+export function nested(fronds: Fronds, stated: FrondsStated | undefined): Fronds {
+  const { under } = nestingOf(stated, fronds, undefined, true);
+  for (const frond of fronds) {
+    const parent = under.get(frond.name);
+    if (parent !== undefined) frond.extends = parent;
+  }
+
+  return parentsFirst(fronds, under);
+}

package/src/boot/ownership.ts

@@ -84,6 +84,83 @@ function builtOn(ctor: unknown): string[] {
 }
 
 /** `Storage<E>` is not a word of the user's vocabulary — `<E>Repository` is the one way in. */
+/**
+ * A provider named `<Entity>Storage` takes the key of that entity's own storage — and the storage
+ * is registered second, so the provider is never resolved. The name is already wrong by two other
+ * rules, which is why nothing hits it; it is said rather than left silent.
+ */
+function refuseStorageKeyAsProvider(
+  provider: ProviderEntry,
+  frond: string,
+  known: (entity: string) => boolean,
+  refused: Diagnostic[],
+): void {
+  // The key the boot registers it under, which a bundler may have renamed — the same reading
+  // `ProviderEntry.name` exists for.
+  const registered = nameOf(provider);
+  const held = entityOfStorageKey(registered, known);
+  if (!held) return;
+
+  refused.push({
+    severity: 'blocking',
+    code: 'storage-key-is-provider',
+    filePath: provider.filePath,
+    frond,
+    subject: registered,
+    message: `${registered} is a provider, and it is the container key of ${held}'s own storage `
+      + '— the storage is registered second, so the provider is never resolved. Name it for '
+      + 'what it holds; `<Entity>Storage` belongs to the entity.',
+  });
+}
+
+/**
+ * Storage is reached through a repository, and an OWNED entity's not even that way: an aggregate's
+ * members are reached through it and nowhere else. The ownership question is asked first, so a
+ * member says who owns it rather than being told to write a repository it may not have.
+ */
+function refuseStorageReached(
+  decl: { ctor: { name: string }; deps: string[]; filePath: string; kind: string },
+  frond: string,
+  owners: Map<string, string>,
+  known: (entity: string) => boolean,
+  refused: Diagnostic[],
+): void {
+  const allowed = decl.kind === 'provider' ? builtOn(decl.ctor) : [];
+
+  for (const dep of decl.deps) {
+    const entity = entityOfStorageKey(dep, known);
+    if (!entity) continue;
+
+    const owner = owners.get(entity);
+    if (owner && owner !== decl.ctor.name) {
+      refused.push({
+        severity: 'blocking',
+        code: 'aggregate-storage-reached',
+        filePath: decl.filePath,
+        frond,
+        subject: `${decl.ctor.name}(${dep})`,
+        message: `${decl.ctor.name} asks for ${dep}, and ${owner} owns ${entity}. Nothing else `
+          + `reaches an owned entity's storage — name the operation on ${owner} and ask for it: `
+          + `constructor(private ${entity}: ${owner}) {}`,
+      });
+      continue;
+    }
+    if (allowed.includes(entity)) continue;
+
+    refused.push({
+      severity: 'blocking',
+      code: 'storage-outside-repository',
+      filePath: decl.filePath,
+      frond,
+      subject: `${decl.ctor.name}(${dep})`,
+      message: `${decl.ctor.name} asks for ${dep}. Storage is reached through a repository, never `
+        + `through the port: constructor(private ${entity}: ${repositoryKeyOf(entity)}) {}. It `
+        + `answers every gesture ${dep} does, whether or not anyone wrote the file — and the day `
+        + `${entity} belongs to an aggregate, this line does not move.`,
+    });
+  }
+}
+
 export function storageInUserCode(
   frond: FrondDescriptor,
   owners: Map<string, string>,
@@ -97,59 +174,10 @@ export function storageInUserCode(
   ];
   const holders = frond.providers.map((p) => ({ ...p, kind: 'provider' as const }));
 
-  for (const provider of holders) {
-    // The key the boot registers it under, which a bundler may have renamed — the same
-    // reading `ProviderEntry.name` exists for.
-    const registered = nameOf(provider);
-    const held = entityOfStorageKey(registered, known);
-    if (!held) continue;
-
-    refused.push({
-      severity: 'blocking',
-      code: 'storage-key-is-provider',
-      filePath: provider.filePath,
-      frond: frond.name,
-      subject: registered,
-      message: `${registered} is a provider, and it is the container key of ${held}'s own storage `
-        + '— the storage is registered second, so the provider is never resolved. Name it for '
-        + 'what it holds; `<Entity>Storage` belongs to the entity.',
-    });
-  }
+  for (const provider of holders) refuseStorageKeyAsProvider(provider, frond.name, known, refused);
 
   for (const decl of [...facades, ...holders]) {
-    const allowed = decl.kind === 'provider' ? builtOn(decl.ctor) : [];
-    for (const dep of decl.deps) {
-      const entity = entityOfStorageKey(dep, known);
-      if (!entity) continue;
-
-      const owner = owners.get(entity);
-      if (owner && owner !== decl.ctor.name) {
-        refused.push({
-          severity: 'blocking',
-          code: 'aggregate-storage-reached',
-          filePath: decl.filePath,
-          frond: frond.name,
-          subject: `${decl.ctor.name}(${dep})`,
-          message: `${decl.ctor.name} asks for ${dep}, and ${owner} owns ${entity}. Nothing else `
-            + `reaches an owned entity's storage — name the operation on ${owner} and ask for it: `
-            + `constructor(private ${entity}: ${owner}) {}`,
-        });
-        continue;
-      }
-      if (allowed.includes(entity)) continue;
-
-      refused.push({
-        severity: 'blocking',
-        code: 'storage-outside-repository',
-        filePath: decl.filePath,
-        frond: frond.name,
-        subject: `${decl.ctor.name}(${dep})`,
-        message: `${decl.ctor.name} asks for ${dep}. Storage is reached through a repository, never `
-          + `through the port: constructor(private ${entity}: ${repositoryKeyOf(entity)}) {}. It `
-          + `answers every gesture ${dep} does, whether or not anyone wrote the file — and the day `
-          + `${entity} belongs to an aggregate, this line does not move.`,
-      });
-    }
+    refuseStorageReached(decl, frond.name, owners, known, refused);
   }
 }
 

package/src/boot/peerOver.ts

@@ -0,0 +1,17 @@
+/** The two readings core serves everywhere, asked of one process over one transport. */
+import { Invocation } from '../wire/Invocation.js';
+import { RPC_ENTITY } from '../wire/RpcAnswer.js';
+import type { Transport } from '../wire/Transport.js';
+import type { Peer } from './Peer.js';
+
+export function peerOver(transport: Transport): Peer {
+  const ask = (op: string, params: Record<string, unknown>) =>
+    transport({ entity: RPC_ENTITY, op }, { ...Invocation.empty, params: params as never });
+
+  return {
+    missing: async (entity, keys) =>
+      ((await ask('holds', { entity, keys })) as { missing: readonly unknown[] }).missing,
+    dependents: (entity) => ask('dependents', { entity }),
+    release: async (entity, key, visited) => { await ask('release', { entity, key, visited }); },
+  };
+}

package/src/boot/ports.ts

@@ -111,35 +111,54 @@ function chain(
   stated: string | readonly string[] | undefined,
   refused: Diagnostic[],
 ): ProviderEntry[] {
-  // The whole chain, outside in — a string is a chain of one, and the last name is what
-  // actually answers. What a deployment wraps its realization with is the same kind of
-  // decision as which realization it uses, so it is the same key.
-  if (stated !== undefined) {
-    const order = typeof stated === 'string' ? [stated] : stated;
-    const all = [...wrappers, ...impls];
-
-    return order.flatMap((name) => {
-      const pick = all.find((one) => nameOf(one) === name);
-      if (!pick) {
-        refused.push({
-          severity: 'blocking',
-          code: 'port-not-extended',
-          filePath: all[0]?.filePath ?? 'fougere.config.ts',
-          subject: `ports: { ${port}: '${name}' }`,
-          message: `${port}: '${name}' does not extend it. What does: ${all.map(nameOf).join(', ')}.`,
-        });
-
-        return [];
-      }
-
-      return [pick];
+  if (stated !== undefined) return statedChain(port, [...wrappers, ...impls], stated, refused);
+
+  refuseUndecided(port, impls, wrappers, refused);
+
+  return [...wrappers, ...impls];
+}
+
+/**
+ * The whole chain, outside in — a string is a chain of one, and the last name is what actually
+ * answers. What a deployment wraps its realization with is the same kind of decision as which
+ * realization it uses, so it is the same key.
+ */
+function statedChain(
+  port: string,
+  all: ProviderEntry[],
+  stated: string | readonly string[],
+  refused: Diagnostic[],
+): ProviderEntry[] {
+  const order = typeof stated === 'string' ? [stated] : stated;
+
+  return order.flatMap((name) => {
+    const pick = all.find((one) => nameOf(one) === name);
+    if (pick) return [pick];
+
+    refused.push({
+      severity: 'blocking',
+      code: 'port-not-extended',
+      filePath: all[0]?.filePath ?? 'fougere.config.ts',
+      subject: `ports: { ${port}: '${name}' }`,
+      message: `${port}: '${name}' does not extend it. What does: ${all.map(nameOf).join(', ')}.`,
     });
-  }
 
+    return [];
+  });
+}
+
+/**
+ * Two realizations, or two wrappers, and nothing saying which — refused rather than settled by
+ * scan order, the same reason `remotes` refuses two owners of one entity: whichever won would
+ * depend on the order files were read, and the handler would charge the wrong provider silently.
+ */
+function refuseUndecided(
+  port: string,
+  impls: ProviderEntry[],
+  wrappers: ProviderEntry[],
+  refused: Diagnostic[],
+): void {
   if (impls.length > 1) {
-    // Refusing rather than keeping one, for the reason `remotes` refuses two owners
-    // of an entity: whichever won would depend on scan order, and the handler would
-    // charge the wrong provider without a word.
     refused.push({
       severity: 'blocking',
       code: 'port-implemented-twice',
@@ -149,12 +168,9 @@ function chain(
         + 'answers it. Which realization a deployment uses is not a fact about the code — state it: '
         + `ports: { ${port}: '${nameOf(impls[0]!)}' } in fougere.config.ts.`,
     });
-
-    return [...wrappers, ...impls];
   }
 
   if (wrappers.length > 1) {
-    // Same refusal one layer out: two wrappers are an ORDER, and scan order is not one.
     refused.push({
       severity: 'blocking',
       code: 'port-wrapped-twice',
@@ -166,6 +182,4 @@ function chain(
         + 'in fougere.config.ts.',
     });
   }
-
-  return [...wrappers, ...impls];
 }

package/src/boot/relations.ts

@@ -0,0 +1,172 @@
+/** Who holds a `ref()`: the source it lives in, this process, or nobody. */
+import { lowerFirst, Role, Shapes, type SchemaView } from '@fougere/schema';
+import type { Dependent } from '../dispatch/Dependent.js';
+import type { RelationCheck } from '../dispatch/RelationCheck.js';
+import type { Hosting } from './Hosting.js';
+import type { Diagnostic } from '../diagnostic.js';
+import type { Releasing, Rows } from '../dispatch/Release.js';
+
+/**
+ * Does a foreign key hold this reference? Both sides in ONE source that keeps relations — two
+ * databases share no constraint, and a frond behind `remotes:` registers no storage here at
+ * all. So the PAIR decides, never the engine.
+ *
+ * And the pair is not enough: an engine's cascade does not pass through the guard, so a hop it
+ * owns above a hop it does not would take rows out with nothing left to release THEIR rows. One
+ * unkeyed hop anywhere below and the guard takes the whole tree — the engine's own cascade then
+ * finds nothing left to do, since the guard walks deepest first and the row goes last.
+ */
+function keyed(namer: string, target: string, hosting: Hosting, seen = new Set<string>()): boolean {
+  const pair = hosting.hostedHere(namer)
+    && hosting.hostedHere(target)
+    && hosting.sourceOf(namer) === hosting.sourceOf(target)
+    && hosting.enforces(hosting.sourceOf(namer), 'relation');
+  if (!pair || seen.has(namer)) return pair;
+  seen.add(namer);
+
+  return referencesTo(namer, hosting).every(({ entity }) => keyed(entity, namer, hosting, seen));
+}
+
+/** Every field of every entity that names `target` — read over the whole app, both ways need it. */
+function referencesTo(target: string, hosting: Hosting): { entity: string; field: string; role: Role }[] {
+  const found: { entity: string; field: string; role: Role }[] = [];
+
+  for (const [entity, schema] of hosting.entities()) {
+    for (const [field, declared] of Object.entries(schema.getFields())) {
+      const role = Role.of(declared);
+      if (role.isReference && role.target?.name && lowerFirst(role.target.name) === target) {
+        found.push({ entity, field, role });
+      }
+    }
+  }
+
+  return found;
+}
+
+/** What a target's storage has to answer for a key set to be judged in one read. */
+interface ByKeys {
+  findByKeys(keys: readonly string[]): Promise<Map<string, unknown>>;
+}
+
+/**
+ * The references a foreign key cannot hold, each as a read the guard makes before the write.
+ *
+ * Documented: [entities](https://fougere.dev/docs/schema/entities).
+ */
+export function heldBy(entity: SchemaView, name: string, hosting: Hosting): RelationCheck[] {
+  const checks: RelationCheck[] = [];
+
+  for (const [field, declared] of Object.entries(entity.getFields())) {
+    const role = Role.of(declared);
+    if (!role.isReference || !role.target?.name) continue;
+
+    const target = lowerFirst(role.target.name);
+    if (keyed(name, target, hosting)) continue;
+
+    checks.push({
+      field,
+      target,
+      missing: async (keys) => {
+        const storage = hosting.storageOf(target) as ByKeys | undefined;
+        // Nothing here holds those rows — the process that does answers the same reading,
+        // so the question crosses rather than being given up on.
+        if (!storage) return hosting.peerOf(target)?.missing(target, keys) ?? [];
+        const found = await storage.findByKeys(keys.map(String));
+
+        return keys.filter((key) => !found.has(String(key)));
+      },
+    });
+  }
+
+  return checks;
+}
+
+/**
+ * The rows that name this entity's, and what becomes of them — the dual of `heldBy`.
+ *
+ * Read over EVERY entity of the app, because a namer is declared wherever its own frond is,
+ * and the target learns of it from nowhere else. What a key already holds is left out: the
+ * engine answers it at the rows, inside the delete's own transaction.
+ *
+ * Documented: [entities](https://fougere.dev/docs/schema/entities).
+ */
+export function dependentsOf(target: string, hosting: Hosting): Dependent[] {
+  return referencesTo(target, hosting)
+    .filter(({ entity }) => !keyed(entity, target, hosting))
+    .map(({ entity, field, role }) => ({ entity, field, onDelete: role.onDelete ?? 'restrict' }));
+}
+
+/**
+ * `set null` on a field that may not hold one — refused where the FIELD is, not in `ref()`.
+ *
+ * `optional()` wraps a `ref()` and is applied after it, so only the field the entity ended up
+ * declaring knows whether null is admitted. Asked here rather than at the target, because the
+ * declaration is the namer's and so is the fix.
+ */
+export function refuseUnwritableNull(entity: SchemaView, name: string, filePath: string): Diagnostic[] {
+  const refused: Diagnostic[] = [];
+
+  for (const [field, declared] of Object.entries(entity.getFields())) {
+    if (Role.of(declared).onDelete !== 'set null' || Shapes.isNullable(declared.shape)) continue;
+    refused.push({
+      severity: 'blocking',
+      code: 'on-delete-null-refused',
+      filePath,
+      subject: `${name}.${field}`,
+      message: `${name}.${field} states onDelete 'set null', and the field admits no null — so the `
+        + 'row could neither be emptied nor kept. Wrap it in `optional()`, or state `cascade` '
+        + 'to take the row out with its target.',
+    });
+  }
+
+  return refused;
+}
+
+/** The checks nothing in this process can answer — asked once every frond has registered. */
+export function unheldAmong(checks: readonly RelationCheck[], hosting: Hosting): string[] {
+  return checks
+    .filter((check) => hosting.storageOf(check.target) === undefined)
+    .map((check) => `${check.field} → ${check.target}`);
+}
+
+/**
+ * What a release asks the boot, built once per app — the same `Hosting` the guard reads.
+ *
+ * `dependentsOf` is answered per call rather than cached: a frond installed after this one
+ * brings rows that name an entity already registered, and a table taken at boot would miss
+ * exactly the crossings this exists for.
+ */
+export function releasing(hosting: Hosting): Releasing {
+  return {
+    dependentsOf: (entity) => dependentsOf(entity, hosting),
+    rowsOf: (entity) => hosting.storageOf(entity) as Rows | undefined,
+    schemaOf: (entity) => hosting.entities().get(entity),
+    peers: () => hosting.peers(),
+    journal: (entity) => hosting.journal(entity),
+  };
+}
+
+/**
+ * A release this process can START and cannot FINISH.
+ *
+ * Read from what is HERE and never asked of anyone: an entity states `cascade` or `set null`,
+ * and nothing registered a journal — both facts are local, so the line is too. The same shape
+ * as `unique declared, and the source does not enforce it`, one rung up: what is declared, and
+ * what this process cannot keep.
+ *
+ * Silent when a key holds every hop: the engine carries those out in one statement, and there
+ * is no half-done state for anybody to finish.
+ */
+export function unfinishable(hosting: Hosting): string[] {
+  if (hosting.journal('') !== undefined) return [];
+
+  const found: string[] = [];
+  for (const [entity] of hosting.entities()) {
+    for (const dependent of dependentsOf(entity, hosting)) {
+      if (dependent.onDelete === 'restrict') continue;
+      found.push(`${dependent.entity}.${dependent.field} → ${entity} (${dependent.onDelete})`);
+    }
+  }
+
+  return found;
+}