@fougere/core 0.9.3-alpha.0 → 0.11.0-alpha.0

package/src/dispatch/HandlerFacade.ts

@@ -1,51 +1,33 @@
 import type { Fields } from '@fougere/schema';
 import type { Container } from '@fougere/container';
-import {
-  runMiddlewares,
-  type AppMiddleware,
-  type OperationContext,
-} from '../wire/middleware.js';
-import type { CollectorResolver } from './ArgumentResolver.js';
+import { runMiddlewares } from '../wire/AppMiddleware.js';
+import { type OperationContext } from '../wire/OperationContext.js';
+import type { CollectorResolver } from './CollectorResolver.js';
 import { collectorKeyOf } from '../prefab/collector.js';
-import { inheritsCrud, subjectOf } from '../prefab/crud.js';
+import { inheritsCrud, subjectOf } from '../prefab/CrudConstructor.js';
 import { presenterKeyOf } from '../prefab/presenter.js';
-import { repositoryKeyOf } from '../prefab/repository.js';
-import type { OperationContract, OperationsMap } from '../wire/operation.js';
-import type { EffectiveOperation, EffectiveOperationsMap } from '../effective-operation.js';
+import { repositoryKeyOf } from '../prefab/RepositoryConstructor.js';
+import type { OperationContract } from '../wire/OperationContract.js';
+import type { OperationsMap } from '../wire/OperationsMap.js';
+import type { EffectiveOperation } from '../EffectiveOperation.js';
+import type { EffectiveOperationsMap } from '../EffectiveOperationsMap.js';
 import type { BindingPlan } from '../wire/binding.js';
-import { Invocation, type InvocationContext } from '../wire/Invocation.js';
-import type { HandlerEntry, PresenterEntry } from '../descriptor/frond.js';
+import { Invocation } from '../wire/Invocation.js';
+import { type InvocationContext } from '../wire/InvocationContext.js';
+import type { HandlerEntry } from '../descriptor/HandlerEntry.js';
+import type { PresenterEntry } from '../descriptor/PresenterEntry.js';
 import { ArgumentResolver } from './ArgumentResolver.js';
 import { OutputView } from './OutputView.js';
 import { PresenterExecutor } from './PresenterExecutor.js';
 import { presenterArguments, presenterPlans } from './presenterArguments.js';
 import { validateInput } from './validateInput.js';
+import type { Facade } from './Facade.js';
 
-/** What boot resolved around one handler, beyond the handler and the scope it resolves in. */
-export interface Door {
-  /** The container key this door answers under. */
-  key: string;
-  /** The frond this door belongs to — travels on every OperationContext. */
-  frond: string;
-  /** Handlers in the owning frond, used to realize a resolved implementation override. */
-  handlers: readonly HandlerEntry[];
-  /** The canonical operation table resolved before boot performs any side effect. */
-  operations: EffectiveOperationsMap;
-  /** Entity names this frond has a collector for. */
-  collectors: Set<string>;
-  /** The presenter over this handler's entity, when the frond declares one. */
-  presenter: PresenterEntry | undefined;
-  /** Presenters live in the frond's own scope, whatever sub-scope this door resolves in. */
-  presenterScope: Container;
-  /** The middlewares that apply to this address, read at call time and never at boot. */
-  middlewares: () => AppMiddleware[];
-}
-
-/** Adapts one handler door to executable operations. */
+/** Adapts one handler facade to executable operations. */
 export class HandlerFacade {
   /** Rich operation facts shared with check, explain and adapters. */
   readonly effectiveOperations: EffectiveOperationsMap;
-  /** Contracts served by this door. */
+  /** Contracts served by this facade. */
   readonly contracts: OperationsMap;
 
   private readonly cachedViews = new Map<string, OutputView>();
@@ -61,24 +43,24 @@ export class HandlerFacade {
   constructor(
     private readonly handler: HandlerEntry,
     private readonly scope: Container,
-    private readonly door: Door,
+    private readonly facade: Facade,
   ) {
     this.refuseCrudWithoutRepository(handler);
 
-    this.presenterPlans = door.presenter
-      ? presenterPlans(door.presenter, door.collectors)
+    this.presenterPlans = facade.presenter
+      ? presenterPlans(facade.presenter, facade.collectors)
       : new Map();
 
     scope.register(this.handlerKey, handler.ctor, { deps: this.depsOf(handler) });
 
-    this.effectiveOperations = door.operations;
+    this.effectiveOperations = facade.operations;
     this.contracts = new Map(
-      [...door.operations].map(([name, operation]) => [name, operation as OperationContract] as const),
+      [...facade.operations].map(([name, operation]) => [name, operation as OperationContract] as const),
     );
     handler.operations = this.contracts;
 
     // Register model-selected implementations in the same execution scope.
-    for (const [name, operation] of door.operations) {
+    for (const [name, operation] of facade.operations) {
       if (this.isBaseImplementation(operation)) continue;
       const implementation = this.implementationHandler(name);
       this.refuseCrudWithoutRepository(implementation);
@@ -104,14 +86,14 @@ export class HandlerFacade {
     const invocation = Invocation.from(input);
     const context: OperationContext = {
       entity,
-      frond: this.door.frond,
+      frond: this.facade.frond,
       operation: op,
       args: [],
       state: invocation.state,
       invocation,
     };
 
-    return runMiddlewares(this.door.middlewares(), context, async () => {
+    return runMiddlewares(this.facade.middlewares(), context, async () => {
       const validated = validateInput(contract.input, invocation, entity, op);
       context.invocation = validated;
 
@@ -122,7 +104,7 @@ export class HandlerFacade {
       const view = this.viewOf(op);
       const output = view.project(await instance[method](...args));
 
-      const { presenter } = this.door;
+      const { presenter } = this.facade;
       return view.closed || !presenter ? output : this.present(op, presenter, output, validated);
     });
   }
@@ -136,7 +118,7 @@ export class HandlerFacade {
   ): Promise<unknown> {
     const entity = this.handler.address;
     const executor = new PresenterExecutor(
-      this.door.presenterScope.resolve(presenterKeyOf(entity)),
+      this.facade.presenterScope.resolve(presenterKeyOf(entity)),
       presenter.fields,
       entity,
       op,
@@ -147,7 +129,7 @@ export class HandlerFacade {
   }
 
   private get handlerKey(): string {
-    return `_handler:${this.door.key}`;
+    return `_handler:${this.facade.key}`;
   }
 
   private depsOf(handler: HandlerEntry): string[] {
@@ -206,7 +188,7 @@ export class HandlerFacade {
   /** The exact handler entry the pure model selected; no name-only retry or fallback. */
   private implementationHandler(operationName: string): HandlerEntry {
     const operation = this.effectiveOperations.get(operationName)!;
-    const matches = this.door.handlers.filter((handler) =>
+    const matches = this.facade.handlers.filter((handler) =>
       handler.ctor.name === operation.implementation.className
       && handler.address === operation.implementation.address
       && handler.filePath === operation.implementation.filePath);

package/src/dispatch/InFlight.ts

@@ -1,4 +1,5 @@
-import { FougereError, ErrorCode } from '../wire/errors.js';
+import { ErrorCode } from '../wire/ErrorCode.js';
+import { FougereError } from '../wire/FougereError.js';
 
 /** Controls dispatch admission and signals when every accepted call has settled. */
 export class InFlight {

package/src/dispatch/Journal.ts

@@ -0,0 +1,26 @@
+import type { Call } from '../wire/Call.js';
+
+/**
+ * What writes a release down while it happens, when a package provides one.
+ *
+ * Core does the same hops in the same order either way — children before their parent, so an
+ * interruption leaves fewer children and never an orphan. What a journal adds is that somebody
+ * can finish what a stopped process started: the row says a release began, and a sweep redoes
+ * it. Redoing is safe because every hop already is — a row taken out twice is taken out once.
+ *
+ * What writes a release down writes none of its own: the boot leaves out the entities of the
+ * fronds an extension BROUGHT, so keeping the row that says a release began does not begin one.
+ * Read from what was brought rather than written down, the way `CARRIES_LINE` is.
+ *
+ * Documented: [entities](https://fougere.dev/docs/schema/entities).
+ */
+export interface Journal {
+  /** Hold this call until `runAt`, so a sweep dispatches it then and nobody waits for it now. */
+  keep(call: Call, runAt: number): Promise<void>;
+  /** Take this release on, or say another process is already driving it. */
+  open(entity: string, key: string): Promise<'taken' | 'busy'>;
+  close(entity: string, key: string): Promise<void>;
+}
+
+/** The container key a package registers its journal under. */
+export const JOURNAL = 'Journal';

package/src/dispatch/LocalRoutePolicy.ts

@@ -1,5 +1,6 @@
-import type { Call } from '../wire/call.js';
-import { ErrorCode, FougereError } from '../wire/errors.js';
+import type { Call } from '../wire/Call.js';
+import { ErrorCode } from '../wire/ErrorCode.js';
+import { FougereError } from '../wire/FougereError.js';
 import type { Route } from './Route.js';
 import type { RoutePolicy } from './RoutePolicy.js';
 import { routeNotFound, servedOperations } from './routeNotFound.js';

package/src/dispatch/OperationRoute.ts

@@ -1,8 +1,7 @@
-import type { Call } from '../wire/call.js';
+import type { Call } from '../wire/Call.js';
 import type { RouteAddress } from '../wire/RouteAddress.js';
 import type { Route } from './Route.js';
-
-export type RouteExecution = (call: Call) => unknown | Promise<unknown>;
+import type { RouteExecution } from './RouteExecution.js';
 
 /** One executable route, distinguished by its routing kind. */
 export class OperationRoute implements Route {

package/src/dispatch/PresenterArgs.ts

@@ -0,0 +1 @@
+export type PresenterArgs = Record<string, unknown[]>;

package/src/dispatch/PresenterExecutor.ts

@@ -1,7 +1,7 @@
-import { ErrorCode, FougereError } from '../wire/errors.js';
+import { ErrorCode } from '../wire/ErrorCode.js';
+import { FougereError } from '../wire/FougereError.js';
 import { preserveArrayProperties } from './ArrayResult.js';
-
-export type PresenterArgs = Record<string, unknown[]>;
+import type { PresenterArgs } from './PresenterArgs.js';
 
 /** Adds a presenter's computed fields after output projection. */
 export class PresenterExecutor {

package/src/dispatch/RelationCheck.ts

@@ -0,0 +1,21 @@
+/**
+ * A `ref()` whose target the source does not hold, so the guard reads it before the write.
+ *
+ * The pair decides, never the engine: SQL keeps a foreign key over rows it can see, and a
+ * target in another source gets a column and nothing else. The boot builds one of these for
+ * each reference that falls outside its own source, and none for the rest — a co-located
+ * relation costs nothing here, because the key already refuses the same row.
+ *
+ * Documented: [entities](https://fougere.dev/docs/schema/entities).
+ */
+export interface RelationCheck {
+  /** The field carrying the key — `authorId`. */
+  field: string;
+  /** What it points at, as the boot files it — `user`. */
+  target: string;
+  /**
+   * Which of these keys no row answers. Takes a set so a page costs one read, and so the
+   * single-row case is the same call with one member.
+   */
+  missing(keys: readonly unknown[]): Promise<readonly unknown[]>;
+}

package/src/dispatch/Release.ts

@@ -0,0 +1,156 @@
+/** What a delete does to the rows that name it, when no foreign key does it instead. */
+import { FieldSet, type SchemaView } from '@fougere/schema';
+import type { Dependent } from './Dependent.js';
+import type { Journal } from './Journal.js';
+import { ErrorCode } from '../wire/ErrorCode.js';
+import { FougereError } from '../wire/FougereError.js';
+
+/** The gestures a release reaches a dependent's rows through. */
+export interface Rows {
+  findAllByKeys(field: string, keys: readonly string[]): Promise<Map<string, Record<string, unknown>[]>>;
+  update(id: string, patch: Record<string, unknown>): Promise<unknown>;
+  delete(id: string): Promise<boolean>;
+}
+
+/** What the guard hands a release: who depends on an entity, and how to reach their rows. */
+export interface Releasing {
+  dependentsOf(entity: string): readonly Dependent[];
+  rowsOf(entity: string): Rows | undefined;
+  schemaOf(entity: string): SchemaView | undefined;
+  /** Written down while it happens, when a package provides one — absent is the plain walk. */
+  journal(entity: string): Journal | undefined;
+  /** Every declared remote — each one walks its own tree, and is alone able to. */
+  peers(): readonly { release(entity: string, key: unknown, visited: readonly string[]): Promise<void> }[];
+}
+
+/**
+ * The rows that name a key, taken out or emptied, deepest FIRST.
+ *
+ * Order is the whole guarantee: a child never outlives its parent, so an interruption leaves
+ * fewer children and never an orphan. That is what lets a release cross a process without a
+ * two-phase commit — and why nothing here needs to be undone, only finished.
+ *
+ * A row already visited is not visited again, which is what ends a cycle: `Category.parentId`
+ * pointing at its own entity walks down and stops when a key repeats.
+ *
+ * Documented: [entities](https://fougere.dev/docs/schema/entities).
+ */
+export async function release(
+  entity: string,
+  key: unknown,
+  world: Releasing,
+  visited: readonly string[] = [],
+  row?: () => Promise<unknown>,
+): Promise<void> {
+  const mark = `${entity}#${String(key)}`;
+  // Already on the trail means SOMEONE upstream is asking every process about this row, so
+  // asking again would be the bounce two processes declaring each other would never end. The
+  // local walk still runs: being asked is exactly the point, and only this process can do it.
+  const asked = visited.includes(mark);
+  const trail = asked ? visited : [...visited, mark];
+
+  // Written down before the first hop, so a process that stops mid-way leaves a row saying so.
+  // Absent, the hops are the same and nothing finishes them.
+  const journal = world.journal(entity);
+  if (journal && await journal.open(entity, String(key)) === 'busy') return;
+
+  // Every declared remote, and every one of them: a frond behind `remotes:` may have no sources
+  // here, so this process cannot see that its rows name ours — only that process can.
+  if (!asked) for (const peer of world.peers()) await peer.release(entity, key, trail);
+
+  try {
+    await walk(entity, [key], world, new Set([mark]), trail);
+  } catch (refusal) {
+    // A refusal is an outcome, not an interruption: the framework decided, and redoing it
+    // would only decide again — a run kept open for one would be swept forever. Anything
+    // else stopped us mid-tree, and THAT is what a run is for.
+    if (refusal instanceof FougereError) await journal?.close(entity, String(key));
+    throw refusal;
+  }
+
+  // The row itself, LAST — handed in by whoever owns the gesture, so a run covers the whole
+  // thing rather than stopping one statement short of it. Whatever the row answers, the
+  // release did its part: what depends on this one is dealt with, and nothing is left to redo.
+  try {
+    await row?.();
+  } finally {
+    await journal?.close(entity, String(key));
+  }
+}
+
+async function walk(
+  entity: string,
+  keys: readonly unknown[],
+  world: Releasing,
+  seen: Set<string>,
+  trail: readonly string[],
+): Promise<void> {
+  const dependents = world.dependentsOf(entity);
+  // Every refusal of this level BEFORE any of its rows move: two fields of one entity are two
+  // dependents, and declaration order would otherwise let a cascade beside a `restrict` win.
+  // Depth needs no such pass — a level acts only once the level below it came back.
+  for (const dependent of dependents.filter((one) => one.onDelete === 'restrict')) {
+    const rows = world.rowsOf(dependent.entity);
+    if (!rows) continue;
+    const found = [...(await rows.findAllByKeys(dependent.field, keys.map(String))).values()].flat();
+    if (found.length === 0) continue;
+
+    throw new FougereError({
+      code: ErrorCode.CONFLICT,
+      message: `${dependent.entity}.${dependent.field} holds ${found.length} row(s) naming this one, `
+        + `and states onDelete 'restrict' — take them out first, or declare what should happen.`,
+      entity,
+      operation: 'delete',
+    });
+  }
+
+  for (const dependent of dependents.filter((one) => one.onDelete !== 'restrict')) {
+    const rows = world.rowsOf(dependent.entity);
+    // Nothing here holds those rows. The process that does answers the same two readings core
+    // serves everywhere, so the ask crosses and the work happens on ITS side of the wire —
+    // which is what keeps the declaration identical whatever the topology.
+    // Nothing here holds those rows: every declared remote is asked about THIS level, and the
+    // one that holds them walks its own tree from there. The trail grows by one mark per level,
+    // so a deeper ask is never mistaken for the bounce of a shallower one.
+    if (!rows) {
+      for (const key of keys) {
+        // A level already on the trail is one somebody is asking every process about, so
+        // asking again is the bounce — the same reason `release` reads it before crossing.
+        if (trail.includes(`${entity}#${String(key)}`)) continue;
+        for (const peer of world.peers()) await peer.release(entity, key, trail);
+      }
+      continue;
+    }
+
+    const naming = await rows.findAllByKeys(dependent.field, keys.map(String));
+    const found = [...naming.values()].flat();
+    if (found.length === 0) continue;
+
+    if (dependent.onDelete === 'set null') {
+      const primary = keyOf(world, dependent.entity);
+      for (const row of found) await rows.update(String(row[primary]), { [dependent.field]: null });
+      continue;
+    }
+
+    const primary = keyOf(world, dependent.entity);
+    const below = found.map((row) => row[primary]).filter((id) => !taken(seen, dependent.entity, id));
+    // Deepest first: what names THESE rows goes before they do, all the way down.
+    await walk(dependent.entity, below, world, seen, trail);
+    for (const id of below) await rows.delete(String(id));
+  }
+}
+
+/** True once, and remembers — a key already on the path is what ends a cycle. */
+function taken(seen: Set<string>, entity: string, key: unknown): boolean {
+  const mark = `${entity}#${String(key)}`;
+  if (seen.has(mark)) return true;
+  seen.add(mark);
+
+  return false;
+}
+
+function keyOf(world: Releasing, entity: string): string {
+  const schema = world.schemaOf(entity);
+
+  return (schema && FieldSet.of(schema.getFields()).primary) ?? 'id';
+}

package/src/dispatch/Route.ts

@@ -1,5 +1,6 @@
-import type { Call } from '../wire/call.js';
-import type { RouteAddress, RouteKind } from '../wire/RouteAddress.js';
+import type { Call } from '../wire/Call.js';
+import type { RouteAddress } from '../wire/RouteAddress.js';
+import type { RouteKind } from '../wire/RouteKind.js';
 
 /** Executable destination known by the dispatcher. */
 export interface Route {

package/src/dispatch/RouteExecution.ts

@@ -0,0 +1,3 @@
+import type { Call } from '../wire/Call.js';
+
+export type RouteExecution = (call: Call) => unknown | Promise<unknown>;

package/src/dispatch/RoutePolicy.ts

@@ -1,4 +1,4 @@
-import type { Call } from '../wire/call.js';
+import type { Call } from '../wire/Call.js';
 import type { Route } from './Route.js';
 
 /** Restricts which registered routes one dispatch capability may enter. */

package/src/dispatch/StorageGuard.ts

@@ -1,7 +1,11 @@
 import { FieldSet, FieldValueValidator, InputRefusal, type Fields } from '@fougere/schema';
-import { COMPARISONS, comparisonOf, unknownIn } from '../storage/criterion.js';
-import { assertListOptions } from '../storage/port.js';
-import { ErrorCode, FougereError } from '../wire/errors.js';
+import { COMPARISONS, comparisonOf, unknownIn } from '../storage/Comparison.js';
+import { assertListOptions } from '../storage/Storage.js';
+import { ErrorCode } from '../wire/ErrorCode.js';
+import { FougereError } from '../wire/FougereError.js';
+import type { GuardReport } from './GuardReport.js';
+import type { RelationCheck } from './RelationCheck.js';
+import { release, type Releasing } from './Release.js';
 
 /** The gestures this guard grafts onto. */
 interface Writer {
@@ -9,17 +13,10 @@ interface Writer {
   update(...args: [unknown, Record<string, unknown>, ...unknown[]]): Promise<unknown>;
   upsert?(...args: [Record<string, unknown>, ...unknown[]]): Promise<unknown>;
   upsertAll?(...args: [readonly Record<string, unknown>[], ...unknown[]]): Promise<unknown>;
+  delete?(id: string): Promise<boolean>;
   list?(...args: unknown[]): unknown;
 }
 
-/** What a guard says about a filter it let through. The boot owns the voice. */
-export interface GuardReport {
-  /** The fields this door hands back, when it hands back fewer than the entity has. */
-  view?: Fields;
-  /** Said once per field — a filter is not a write, and a warning per call is noise. */
-  outOfView?: (message: string) => void;
-}
-
 /** Judges storage writes and list options without narrowing the storage interface. */
 export class StorageGuard {
   /** What has already been said, so a filter in a loop says it once. */
@@ -29,6 +26,8 @@ export class StorageGuard {
     private readonly fields: Fields,
     private readonly entity: string,
     private readonly report: GuardReport = {},
+    private readonly relations: readonly RelationCheck[] = [],
+    private readonly releasing?: Releasing,
   ) {}
 
   guard<T extends object>(storage: T): T {
@@ -38,13 +37,29 @@ export class StorageGuard {
     const validation = this;
     const guarded = Object.create(storage) as T & Writer;
 
+    const remove = writer.delete;
+    if (typeof remove === 'function' && validation.releasing) {
+      // What names this row goes first, and this row last: an interruption then leaves fewer
+      // children rather than an orphan. A key holds the rest, at the rows, in one statement.
+      guarded.delete = async function (id) {
+        let gone = false;
+        await release(validation.entity, id, validation.releasing!, [], async () => {
+          gone = await remove.call(this, id);
+        });
+
+        return gone;
+      };
+    }
+
     guarded.create = async function (...args) {
       args[0] = validation.validated(args[0], 'create');
+      await validation.targetsOf([args[0]], 'create');
       return writer.create.apply(this, args);
     };
 
     guarded.update = async function (...args) {
       args[1] = validation.validated(args[1], 'update');
+      await validation.targetsOf([args[1]], 'update');
       return writer.update.apply(this, args);
     };
 
@@ -52,6 +67,7 @@ export class StorageGuard {
     if (typeof upsert === 'function') {
       guarded.upsert = async function (...args) {
         args[0] = validation.validated(args[0], 'upsert');
+        await validation.targetsOf([args[0]], 'upsert');
         return upsert.apply(this, args);
       };
     }
@@ -62,6 +78,9 @@ export class StorageGuard {
       // the caller asked for as one, and the refusal is readable from the input alone.
       guarded.upsertAll = async function (...args) {
         args[0] = args[0].map((row, index) => validation.validated(row, 'upsertAll', index));
+        // The keys of the whole page in one read per relation, for the reason above: a page
+        // refused on its fourth row has already written three.
+        await validation.targetsOf(args[0], 'upsertAll');
         return upsertAll.apply(this, args);
       };
     }
@@ -81,7 +100,7 @@ export class StorageGuard {
   }
 
   /**
-   * The values this write carries, validated and handed on PARSED — the rule the client door
+   * The values this write carries, validated and handed on PARSED — the rule the client facade
    * already holds (`InputValidator`), applied to a write that never passed through it. What a
    * handler is allowed to write is not asked here: only the value is.
    */
@@ -92,11 +111,11 @@ export class StorageGuard {
   }
 
   /**
-   * What a read may ask for. The write door judges what LANDS in a row; this one judges
+   * What a read may ask for. The write facade judges what LANDS in a row; this one judges
    * what a caller says about one — and it was the single entrance to the port with no
    * judge at all, while `params.filter` from a browser reaches it verbatim.
    *
-   * A criterion may name a SET, which is the one thing the write door would refuse: an
+   * A criterion may name a SET, which is the one thing the write facade would refuse: an
    * array is judged member by member, since that is what `IN` binds.
    */
   private criteria(where: Record<string, unknown>): Record<string, unknown> {
@@ -110,7 +129,7 @@ export class StorageGuard {
         continue;
       }
       // A comparison names its own vocabulary, and a typo in it would otherwise be a
-      // criterion that filters nothing — the silent truncation this door exists to stop.
+      // criterion that filters nothing — the silent truncation this facade exists to stop.
       const comparison = comparisonOf(field, asked);
       if (comparison) {
         const unknown = unknownIn(comparison);
@@ -148,11 +167,11 @@ export class StorageGuard {
   }
 
   /**
-   * A filter on a field this door does not hand back.
+   * A filter on a field this facade does not hand back.
    *
    * `output(schema)` narrows what is RETURNED and has never narrowed what is asked, so a
    * caller can already sort a hidden column into existence one comparison at a time — and
-   * the admin door copies a browser's filter here verbatim. Said rather than refused: it
+   * the admin facade copies a browser's filter here verbatim. Said rather than refused: it
    * is legal today, GraphQL batches a relation on a key a view may not carry, and a
    * refusal would break that on the way to fixing this.
    */
@@ -161,7 +180,7 @@ export class StorageGuard {
     if (!view || view[field] || this.said.has(field)) return;
     this.said.add(field);
     this.report.outOfView?.(
-      `${this.entity}.list() filtered on '${field}', which this door does not hand back — `
+      `${this.entity}.list() filtered on '${field}', which this facade does not hand back — `
       + 'a filter on a hidden field answers questions about it one call at a time.',
     );
   }
@@ -182,7 +201,7 @@ export class StorageGuard {
     for (const [key, item] of Object.entries(value as Record<string, unknown>)) {
       const field = this.fields[key];
       // A key the entity does not declare has no column to land in and no judge to pass:
-      // on the client door it is a typo, and on this one it is a mapping that went stale.
+      // on the client facade it is a typo, and on this one it is a mapping that went stale.
       if (!field) {
         errors.push(`${where}${key}: ${InputRefusal.unknownField}`);
         continue;
@@ -208,6 +227,43 @@ export class StorageGuard {
 
     return parsed as T;
   }
+
+  /**
+   * The rows a `ref()` points at, read before the write lands.
+   *
+   * Only the references the boot could not leave to a foreign key reach here — a target in
+   * the same source is already refused by the key, at the rows, which this cannot be: the
+   * target may be deleted between the read and the write. It catches what a key catches in
+   * practice, which is a key that was never right: a row copied from another environment,
+   * an author deleted months ago, an id from a test.
+   *
+   * A patch that does not carry the field says nothing about it, so it is skipped rather
+   * than read as `null`.
+   */
+  private async targetsOf(rows: readonly Record<string, unknown>[], operation: string): Promise<void> {
+    if (this.relations.length === 0) return;
+
+    const refused = await Promise.all(this.relations.map(async (relation) => {
+      const keys = [...new Set(
+        rows.map((row) => row[relation.field]).filter((key) => key !== undefined && key !== null),
+      )];
+      if (keys.length === 0) return [];
+      const missing = await relation.missing(keys);
+
+      return missing.map((key) => `${relation.field} ${JSON.stringify(key)} — no ${relation.target} holds it`);
+    }));
+
+    const errors = refused.flat();
+    if (errors.length === 0) return;
+
+    throw new FougereError({
+      code: ErrorCode.VALIDATION_FAILED,
+      message: `Refused on the way out — ${errors.join(', ')}`,
+      entity: this.entity,
+      operation,
+      details: errors,
+    });
+  }
 }
 
 const unwrap = (one: { value: unknown } | { error: string }): unknown =>

package/src/dispatch/presenterArguments.ts

@@ -1,8 +1,8 @@
 import { computeBindingPlan, type BindingPlan } from '../wire/binding.js';
-import type { InvocationContext } from '../wire/Invocation.js';
-import type { PresenterEntry } from '../descriptor/frond.js';
+import type { InvocationContext } from '../wire/InvocationContext.js';
+import type { PresenterEntry } from '../descriptor/PresenterEntry.js';
 import type { ArgumentResolver } from './ArgumentResolver.js';
-import type { PresenterArgs } from './PresenterExecutor.js';
+import type { PresenterArgs } from './PresenterArgs.js';
 
 /**
  * Where each computed field's extra arguments come from — read off the declaration, so a

package/src/dispatch/routeNotFound.ts

@@ -1,5 +1,6 @@
-import type { Call } from '../wire/call.js';
-import { ErrorCode, FougereError } from '../wire/errors.js';
+import type { Call } from '../wire/Call.js';
+import { ErrorCode } from '../wire/ErrorCode.js';
+import { FougereError } from '../wire/FougereError.js';
 import type { Route } from './Route.js';
 import type { RoutePolicy } from './RoutePolicy.js';
 

package/src/dispatch/validateInput.ts

@@ -1,6 +1,7 @@
 import { InputValidator, dotted, type SchemaView } from '@fougere/schema';
-import type { InvocationContext } from '../wire/Invocation.js';
-import { ErrorCode, FougereError } from '../wire/errors.js';
+import type { InvocationContext } from '../wire/InvocationContext.js';
+import { ErrorCode } from '../wire/ErrorCode.js';
+import { FougereError } from '../wire/FougereError.js';
 
 /** Validates and decodes the input declared by one operation contract. */
 export function validateInput(