@reventlessdev/reventless-core 3.0.0-alpha.236 → 3.0.0-alpha.238

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -422,13 +422,42 @@ function Make(DcbEventLogStorage) {
         ]);
       })).apply(pairs => Object.fromEntries(pairs));
       let dcbHandlerBase = DcbCommandTopic.makeFilteringHandler(dcbCommandTopic);
-      let dcbGenerateCommandOutput = Component$ReventlessCore.operations(dcbCommandTopic).apply(ops => CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(ops.publishJsons, ops.publishJsonsAndWait, name, S.json, "StateChangeSlice", false));
+      let byTag = {};
+      stateChangeSlices.forEach(S => {
+        let commandSchema = S.Spec.commandSchema;
+        if (!ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
+          Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).forEach(param => {
+            let tag = param[1];
+            let match = byTag[tag];
+            if (match !== undefined) {
+              return log.error("Dcb_Builder", undefined, `Two DCB slices in "` + name + `" both declare the command "` + tag + `". ` + "Owner stamping resolves a command by that name alone, so it cannot tell them apart. Rename one of the constructors.");
+            } else {
+              byTag[tag] = commandSchema;
+              return;
+            }
+          });
+          return;
+        }
+      });
+      let dcbGenerateCommandOutput = Component$ReventlessCore.operations(dcbCommandTopic).apply(ops => {
+        let make = commandSchema => CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(ops.publishJsons, ops.publishJsonsAndWait, name, commandSchema, "StateChangeSlice", false);
+        let byTag$1 = {};
+        Object.entries(byTag).forEach(param => {
+          byTag$1[param[0]] = make(param[1]);
+        });
+        return [
+          byTag$1,
+          make(S.json)
+        ];
+      });
       let dcbHandler = Pulumi.all([
         dcbHandlerBase,
         inboundReceiversOutput,
         dcbGenerateCommandOutput
       ]).apply(param => {
-        let generateCommand = param[2];
+        let match = param[2];
+        let generateFallback = match[1];
+        let generatorsByTag = match[0];
         let receivers = param[1];
         let baseHandler = param[0];
         return (event, ctx) => {
@@ -448,11 +477,18 @@ function Make(DcbEventLogStorage) {
           }
           let match$1 = event["command"];
           let match$2 = event["arguments"];
-          if (typeof match$1 === "string" && match$2 !== undefined) {
-            return Effect.map(generateCommand(event), msgId => msgId);
-          } else {
+          if (match$1 === undefined) {
+            return baseHandler(event, ctx);
+          }
+          if (typeof match$1 !== "string") {
+            return baseHandler(event, ctx);
+          }
+          if (match$2 === undefined) {
             return baseHandler(event, ctx);
           }
+          let g = generatorsByTag[event.command];
+          let generateCommand = g !== undefined ? g : (log.warn("Dcb_Builder", undefined, `No DCB slice in "` + name + `" declares the command "` + event.command + `", ` + "so it is dispatched without an owner stamp. Any field the command marks as its owner keeps the value the caller sent."), generateFallback);
+          return Effect.map(generateCommand(event), msgId => msgId);
         };
       });
       let dcbResources = Object.values(stateChangeSlicesOutputs).flatMap(outputs => outputs.resources).concat(Object.values(inboundTranslationSlicesOutputs).flatMap(outputs => outputs.resources.concat(outputs.queryDb.resources)));

package/src/components/EventLog/EventLog.res

@@ -25,7 +25,7 @@ type appendError =
 // staleness — consumers ignore a snapshot whose hash differs from their current
 // state schema and fall back to full replay. Snapshots are a read optimization
 // only; the OCC append remains the sole consistency primitive
-// (docs/plans/aggregate-snapshotting.md).
+// (docs/plans/done/aggregate-snapshotting.md).
 type snapshot = {seqNr: int, state: JSON.t, schemaHash: string}
 
 type append<'id, 'event> = (int, 'id, array<'event>) => promise<result<unit, appendError>>

package/src/plugin/component/Plugin_Structure.res

@@ -26,13 +26,13 @@ let rec isLabelShape = (t: SchemaType.schemaType): bool =>
   | _ => false
   }
 
-// Whether a field can hold a lifecycle status: a closed set of values, or an
-// optional one. A free-text `status: string` is not a lifecycle — filtering a
-// command menu against `allowedStates` needs states to compare with.
-let rec isStatusShape = (t: SchemaType.schemaType): bool =>
+// Whether a field can hold a lifecycle: a closed set of values, or an optional
+// one. A free-text `lifecycle: string` is not a lifecycle — filtering a command
+// menu against `allowedStates` needs states to compare with.
+let rec isLifecycleShape = (t: SchemaType.schemaType): bool =>
   switch t {
   | Enum(_, _) => true
-  | Nullable(inner) => isStatusShape(inner)
+  | Nullable(inner) => isLifecycleShape(inner)
   | _ => false
   }
 
@@ -44,18 +44,25 @@ let conventionalLabelNames = ["name", "title", "label", "displayname"]
 let shapeOfItem = (~entityName: string, item: S.item): SchemaType.schemaType =>
   SchemaType.fromSury(~parentName=entityName, ~fieldName=item.location, item.schema)
 
-// Resolve the field that holds the entity's lifecycle status, used to filter a
-// per-row command menu against each command's `allowedStates`. Resolution order:
-//   1. Field annotated `@status` (PPX-emitted; see StateAnnotations).
-//   2. Field literally named `"status"` whose IR shape is an enum (convention;
+// Resolve the field that holds the entity's lifecycle, used to filter a per-row
+// command menu against each command's `allowedStates`. Resolution order:
+//   1. Field annotated `@lifecycle` (PPX-emitted; see StateAnnotations).
+//   2. Field literally named `"lifecycle"` whose IR shape is an enum (convention;
 //      mirrors how labelField falls back to a conventionally-named field).
 //   3. None — filter is inert for this read model.
-let statusFieldFromStateSchema = (
+//
+// The convention rung is keyed on `lifecycle` rather than `status` deliberately:
+// `status` is a promiscuous name — geocoding progress, todo-queue progress and
+// translation audit outcome all wear it — so a convention keyed on it guesses,
+// and guesses often. `lifecycle` is a word nobody types by accident, so matching
+// it is closer to a declaration written in the field name. A record whose field
+// is honestly called something else annotates instead.
+let lifecycleFieldFromStateSchema = (
   ~entityName: string,
   stateSchema: S.t<unknown>,
 ): option<string> => {
   let annotated = switch Reventless.StateAnnotations.getSpec(stateSchema) {
-  | Some(spec) => spec.status
+  | Some(spec) => spec.lifecycle
   | None => None
   }
   switch annotated {
@@ -65,7 +72,7 @@ let statusFieldFromStateSchema = (
     | Object({items}) =>
       items
       ->Array.find(item =>
-        item.location == "status" && isStatusShape(shapeOfItem(~entityName, item))
+        item.location == "lifecycle" && isLifecycleShape(shapeOfItem(~entityName, item))
       )
       ->Option.map(item => item.location)
     | _ => None
@@ -73,6 +80,326 @@ let statusFieldFromStateSchema = (
   }
 }
 
+// The field whose truth withdraws a row from ordinary reads. Annotation-only:
+// there is no convention rung here, and its absence is the point. `lifecycleField`
+// may fall back to a field literally named "lifecycle" because guessing wrong makes
+// a command menu filter oddly; guessing wrong here makes rows vanish for every
+// caller who is not elevated, so a boolean named `archived` that nobody annotated
+// stays exactly as visible as it was.
+let retiredFromStateSchema = (
+  stateSchema: S.t<unknown>,
+): option<Reventless.StateAnnotations.retiredSpec> =>
+  switch Reventless.StateAnnotations.getSpec(stateSchema) {
+  | Some(spec) => spec.retired
+  | None => None
+  }
+
+let retiredFieldFromStateSchema = (stateSchema: S.t<unknown>): option<string> =>
+  retiredFromStateSchema(stateSchema)->Option.map(r => r.field)
+
+// The states a row is retired *in*, for the enum form. `None` is the boolean
+// form, where the value is always `true` and naming it would be a parameter that
+// can only hold one thing. A set, because a lifecycle may be withdrawn by more
+// than one state, and a one-member set is the ordinary case.
+//
+// Published beside `retiredField` rather than left for a consumer to dig out of
+// the schema: a client that has the def in hand has the whole predicate, and two
+// places deriving one comparison is how they come to disagree about it.
+let retiredValuesFromStateSchema = (stateSchema: S.t<unknown>): option<array<string>> =>
+  retiredFromStateSchema(stateSchema)->Option.flatMap(r => r.values)
+
+// The check the PPX cannot make, in the one place that can: the payload is a
+// constructor reference the PPX only ever sees as a name, and whether that name
+// is a case of the field's enum needs the schema.
+//
+// Two rules, and the second is the one the form exists for. A `value` on a field
+// that is not the record's lifecycle would keep the read narrowing while silently
+// losing the command filtering that motivates it — `@transition` is written in
+// terms of the lifecycle field, so a retirement state anywhere else is a state no
+// command can name.
+let checkRetiredValue = (~entityName: string, stateSchema: S.t<unknown>): unit =>
+  switch retiredFromStateSchema(stateSchema) {
+  | Some({field, values: Some(values)}) =>
+    let named = values->Array.join(", ")
+    let lifecycle = lifecycleFieldFromStateSchema(~entityName, stateSchema)
+    if lifecycle != Some(field) {
+      log.warn(
+        ~comp="Plugin_Structure",
+        `${entityName}: @retired(${named}) is on "${field}", which is not this record's lifecycle field${lifecycle
+          ->Option.map(f => ` (that is "${f}")`)
+          ->Option.getOr(
+            " (it declares none)",
+          )}. A retirement state no command's @transition can name loses the command filtering the state form exists for.`,
+      )
+    }
+    let declared = switch stateSchema {
+    | Object({items}) =>
+      items
+      ->Array.find(item => item.location == field)
+      ->Option.map(item =>
+        switch shapeOfItem(~entityName, item) {
+        | Enum(_, values) => values
+        | Nullable(Enum(_, values)) => values
+        | _ => []
+        }
+      )
+      ->Option.getOr([])
+    | _ => []
+    }
+    // Reported per state rather than as a set: one wrong entry among three still
+    // narrows something, so the symptom is a subset of rows leaking rather than
+    // all of them — which is harder to spot than the single-value case was.
+    if Array.length(declared) > 0 {
+      values
+      ->Array.filter(v => !(declared->Array.includes(v)))
+      ->Array.forEach(v =>
+        log.warn(
+          ~comp="Plugin_Structure",
+          `${entityName}: @retired(${v}) names a state "${field}" does not declare — known values: ${declared->Array.join(
+              ", ",
+            )}.`,
+        )
+      )
+    }
+  | _ => ()
+  }
+
+// The states a record's lifecycle field can hold. The same extraction
+// `checkRetiredValue` does, keyed on the declared lifecycle field rather than the
+// retired one — which is the field a command's `@transition` is written in terms
+// of. `None` means the record declares no lifecycle at all; `Some([])` means it
+// declares one whose shape carries no cases to compare against.
+let lifecycleStatesFromStateSchema = (
+  ~entityName: string,
+  stateSchema: S.t<unknown>,
+): option<array<string>> =>
+  lifecycleFieldFromStateSchema(~entityName, stateSchema)->Option.flatMap(field =>
+    switch stateSchema {
+    | Object({items}) =>
+      items
+      ->Array.find(item => item.location == field)
+      ->Option.map(item =>
+        switch shapeOfItem(~entityName, item) {
+        | Enum(_, values) => values
+        | Nullable(Enum(_, values)) => values
+        | _ => []
+        }
+      )
+    | _ => None
+    }
+  )
+
+// The other check the PPX cannot make, and the reason `@transition` is worth
+// more than a rename.
+//
+// A command declares the states it may run from and the state it lands in, but
+// those states belong to ANOTHER component's lifecycle enum. The PPX only ever
+// sees them as names — it strips the attribute before the typechecker, and a
+// synthetic reference to the constructor does not survive ReScript's pre-PPX
+// dependency walk. So a misspelled state compiles clean, ships, and produces a
+// command that is legal in a state no row is ever in: a menu entry that never
+// appears, with nothing anywhere saying why.
+//
+// Here both sides are in hand. This runs at plugin-structure assembly, which
+// happens in the deploy program and at local-platform start — never inside a
+// deployed Lambda, which reads a persisted structure rather than building one.
+// So raising is a failed deploy, not a dead function.
+//
+// Two severities, and the split is deliberate:
+//   - a state the linked views do not declare  → RAISE. The author named
+//     something that does not exist.
+//   - no resolvable linked view, or none declaring a lifecycle → warn. The
+//     metadata gap is real but hard-failing on it would turn "this plugin's
+//     views could not be resolved" into a deploy outage, and that population is
+//     broad.
+//
+// Checked against the UNION of the linked views' lifecycles rather than a single
+// view: a command whose slice feeds two views is not claiming which one, and
+// failing on an ambiguity the author never expressed would be a false positive
+// on correct code.
+let checkDeclaredTransitions = (
+  ~pluginName: string,
+  ~writables: array<Reventless.Plugin.writableDef>,
+  ~lifecycleStatesByView: dict<array<string>>,
+): unit => {
+  let unvalidated = ref(0)
+  let failures = []
+
+  writables->Array.forEach(w =>
+    w.commands->Array.forEach(cmd => {
+      let declared = Array.concat(
+        cmd.allowedStates->Option.getOr([]),
+        switch cmd.targetState {
+        | Some(t) => [t]
+        | None => []
+        },
+      )
+      if Array.length(declared) > 0 {
+        let known =
+          w.linkedViews->Array.reduce([], (acc, view) =>
+            switch lifecycleStatesByView->Dict.get(view) {
+            | Some(states) => Array.concat(acc, states)
+            | None => acc
+            }
+          )
+        if Array.length(known) == 0 {
+          unvalidated := unvalidated.contents + 1
+        } else {
+          declared
+          ->Array.filter(state => !(known->Array.includes(state)))
+          ->Array.forEach(state =>
+            failures
+            ->Array.push(
+              `${w.name}.${cmd.name}: @transition names "${state}", which none of its ` ++
+              `linked views declare — ${w.linkedViews->Array.join(
+                  ", ",
+                )} know ${known->Array.join(", ")}.`,
+            )
+            ->ignore
+          )
+        }
+      }
+    })
+  )
+
+  // Reported rather than silent: a plugin nothing could be checked against looks
+  // exactly like a plugin that passed, and that population is the one most
+  // likely to be carrying a stale name.
+  if unvalidated.contents > 0 {
+    log.warn(
+      ~comp="Plugin_Structure",
+      `${pluginName}: ${unvalidated.contents->Int.toString} command(s) declare a @transition ` ++
+      `but no linked view declares a lifecycle to check it against.`,
+    )
+  }
+
+  if Array.length(failures) > 0 {
+    JsError.throwWithMessage(
+      `${pluginName}: @transition names states that do not exist.\n` ++
+      failures->Array.join("\n"),
+    )
+  }
+}
+
+// Beyond "does this state exist" — does the declared graph make sense?
+//
+// A separate pass from the name check on purpose. That one asks whether a name
+// is a case of an enum, which is a question about one annotation in isolation.
+// These ask whether the annotations AGREE with each other across an entity, and
+// a graph can be built entirely out of valid names and still be wrong: a state
+// nothing reaches, or one nothing can leave that was never marked as an ending.
+//
+// Reported as warnings rather than raised. The name check fails a build because
+// a state that does not exist is unambiguously a mistake — there is no domain in
+// which it is what the author meant. These are weaker signals: a state with no
+// way out may be a genuine dead end nobody has marked yet, or a legitimate
+// terminal the model reaches by a route this metadata cannot see (an automation,
+// an external system). Failing a deploy on a modelling smell would be the wrong
+// trade, and a smell that stops a deploy gets silenced rather than fixed.
+// Pure, and returns its findings rather than logging them, so the rule can be
+// tested without reading a log. `checkLifecycleTopology` below is the thin part
+// that reports them.
+let lifecycleTopologyFindings = (
+  ~writables: array<Reventless.Plugin.writableDef>,
+  ~lifecycleStatesByView: dict<array<string>>,
+): array<(string, string)> => {
+  let findings = []
+  lifecycleStatesByView
+  ->Dict.toArray
+  ->Array.forEach(((view, states)) => {
+    // Every edge any command declares into or out of this view's lifecycle.
+    let edges = writables->Array.reduce([], (acc, w) =>
+      w.linkedViews->Array.includes(view)
+        ? Array.concat(
+            acc,
+            w.commands->Array.reduce([], (inner, cmd) =>
+              switch (cmd.allowedStates, cmd.targetState) {
+              | (Some(froms), Some(to)) =>
+                Array.concat(inner, froms->Array.map(from => (from, to)))
+              | _ => inner
+              }
+            ),
+          )
+        : acc
+    )
+    if Array.length(edges) > 0 {
+      // Rows start in the first declared state — the same convention the
+      // lifecycle diagram uses — so nothing pointing at it is expected rather
+      // than suspicious.
+      let initial = states->Array.get(0)
+      let reachable = edges->Array.map(((_, to)) => to)
+
+      states->Array.forEach(state => {
+        if !(reachable->Array.includes(state)) && Some(state) != initial {
+          findings
+          ->Array.push((
+            view,
+            `no command declares a transition INTO "${state}" — it is unreachable ` ++
+            `unless something outside this plugin's declarations puts a row there.`,
+          ))
+          ->ignore
+        }
+        // NOT checked: a state with no way out.
+        //
+        // The obvious second rule — "a dead end that is not `@retired` is
+        // suspicious" — was written, run against the shipped examples, and
+        // removed, because it is wrong twice over.
+        //
+        // It fires on correct models: `Shipped` and `Refunded` are terminal in
+        // the aggregates shop, as terminal states are in most lifecycles, and
+        // there is nothing to fix about either.
+        //
+        // Worse, its suggested fix is harmful. `@retired` does not mean
+        // "terminal" — it means WITHDRAWN FROM ORDINARY READS. Marking a shipped
+        // order retired to silence a lint would hide every shipped order from
+        // every caller who cannot widen their read. An ending and a withdrawal
+        // are different facts, and nothing in the vocabulary currently
+        // distinguishes an intentional terminal from an accidental one, so the
+        // check cannot tell them apart and should not pretend to.
+      })
+    }
+  })
+  findings
+}
+
+let checkLifecycleTopology = (
+  ~pluginName: string,
+  ~writables: array<Reventless.Plugin.writableDef>,
+  ~lifecycleStatesByView: dict<array<string>>,
+): unit =>
+  lifecycleTopologyFindings(~writables, ~lifecycleStatesByView)->Array.forEach(((view, message)) =>
+    log.warn(~comp="Plugin_Structure", `${pluginName}/${view}: ${message}`)
+  )
+
+// NOT here: the event-consumption completeness check.
+//
+// The failure it would catch is real and has already happened: a command emitted
+// an event, the slice that owned the opposite command folded it, and the view
+// that renders the entity did not — so the row kept rendering the state it was
+// in before, with every annotation in the plugin correct. That is a class of bug
+// no declaration check can see, because nothing declared is wrong.
+//
+// It is not computable from this metadata, and the reason is worth recording so
+// the attempt is not repeated. Two narrowings were needed and only one was
+// available:
+//
+//   1. The event must belong to the view's own entity, not merely be something a
+//      slice looked up. Available: require it to be PRODUCED by a writable
+//      linked to the same view. Without this the check fires on ordinary DCB —
+//      `AddProduct` folds `CategoryAdded` to check a category exists, and the
+//      `Products` view is right to ignore it.
+//
+//   2. The slice must be known to fold the event. NOT available:
+//      `consumedEventTypes` is built from `eventVariantNames`, which drops
+//      payload-less variants — and a lifecycle-moving event is usually
+//      payload-less in the slice that folds it. Measured on the shipped example:
+//      both order slices publish `consumedEventTypes: ["Ordering.OrderPlaced"]`
+//      and nothing else, though each folds three more.
+//
+// So the exact events the rule is about are the ones the metadata does not
+// record. Making it work means publishing the payload-less consumed variants,
+// which is a platform change with its own consequences, not a lint.
+
 // Which rung of the ladder below produced the label. Published on `queryableDef`
 // as `labelFieldSource`, because the four rungs are not equally believable and a
 // consumer with a name rule of its own has to rank the declaration against it:
@@ -247,7 +574,7 @@ let make = (
   // spec name has no entry (or lives directly under a kind-folder) carries no chapter
   // and renders flat. Keyed by `Spec.name`, which equals the source filename stem for
   // every graph-node kind, so the generator can build this map from the discovered
-  // file paths. See `Codegen.chapterOf` and docs/plans/deployed-chapter-grouping.md.
+  // file paths. See `Codegen.chapterOf` and docs/plans/done/deployed-chapter-grouping.md.
   ~componentChapters: dict<string>=Dict.make(),
 ): Reventless.Plugin.pluginStructure => {
   let chapterOf = (compName: string): option<string> => componentChapters->Dict.get(compName)
@@ -363,9 +690,9 @@ let make = (
       // Per-variant `allowedStates` lives on the *parent* command schema
       // (the PPX attaches a single dict<variantName, [|states|]> via
       // markAllowedStates). Look it up by variant name; back-compat
-      // None when the variant lacks an @allowedStates annotation.
+      // None when the variant lacks a @transition annotation.
       let allowedStates = ApiAllowedStatesHelpers.getAllowedStates(parentSchema, ~variantName)
-      // Declared `@targetState` (the command's *to* status), read the same way
+      // The `@transition` target (the command's *to* status), read the same way
       // as allowedStates. None ⇒ AutoUI's board resolver falls back to its
       // name-stem heuristic.
       let targetState = ApiTargetStateHelpers.getTargetState(parentSchema, ~variantName)
@@ -733,6 +1060,17 @@ let make = (
     | Internal => Some("Internal")
     }
 
+  // View name -> the states its lifecycle field can hold, collected as the view
+  // defs are built so the transition check below has both sides in one place.
+  let lifecycleStatesByView: dict<array<string>> = Dict.make()
+  let recordLifecycle = (~entityName, stateSchema) => {
+    switch lifecycleStatesFromStateSchema(~entityName, stateSchema) {
+    | Some(states) if Array.length(states) > 0 =>
+      lifecycleStatesByView->Dict.set(entityName, states)
+    | _ => ()
+    }
+  }
+
   let readModelDefs =
     readModels
     ->Array.map((
@@ -752,6 +1090,8 @@ let make = (
       // edges for any event reaching the read model via a DCB-log-sourced mapping (a classic
       // aggregate→view link is also drawn from the producer's linkedViews, deduped downstream).
       let consumed = qualify(~prefix=name, R.consumedEventNames)
+      checkRetiredValue(~entityName=R.Spec.name, stateSchema)
+      recordLifecycle(~entityName=R.Spec.name, stateSchema)
       ({
         Reventless.Plugin.name: R.Spec.name,
         queryField: qf.listFieldName,
@@ -761,10 +1101,12 @@ let make = (
         labelField: label.field,
         searchableFields: label.searchableFields,
         labelFieldSource: Some(labelFieldSourceToString(label.source)),
-        statusField: statusFieldFromStateSchema(~entityName=R.Spec.name, stateSchema),
-        // Same schema `statusField` reads, so the two cannot disagree about which
+        lifecycleField: lifecycleFieldFromStateSchema(~entityName=R.Spec.name, stateSchema),
+        // Same schema `lifecycleField` reads, so the two cannot disagree about which
         // fields this view has.
         ownerField: Reventless.Owner.fieldNames(stateSchema)->Array.get(0),
+        retiredField: retiredFieldFromStateSchema(stateSchema),
+        retiredValues: retiredValuesFromStateSchema(stateSchema),
         visibility: visibilityTag(R.Spec.visibility),
         chapter: chapterOf(R.Spec.name),
         // Taken from the `qf` record, never re-derived: `Api_Naming` is the only
@@ -787,6 +1129,8 @@ let make = (
         ~entityName=SVS.Spec.name,
         stateSchema,
       )
+      checkRetiredValue(~entityName=SVS.Spec.name, stateSchema)
+      recordLifecycle(~entityName=SVS.Spec.name, stateSchema)
       ({
         Reventless.Plugin.name: SVS.Spec.name,
         queryField: qf.listFieldName,
@@ -796,8 +1140,10 @@ let make = (
         labelField: label.field,
         searchableFields: label.searchableFields,
         labelFieldSource: Some(labelFieldSourceToString(label.source)),
-        statusField: statusFieldFromStateSchema(~entityName=SVS.Spec.name, stateSchema),
+        lifecycleField: lifecycleFieldFromStateSchema(~entityName=SVS.Spec.name, stateSchema),
         ownerField: Reventless.Owner.fieldNames(stateSchema)->Array.get(0),
+        retiredField: retiredFieldFromStateSchema(stateSchema),
+        retiredValues: retiredValuesFromStateSchema(stateSchema),
         visibility: visibilityTag(SVS.Spec.visibility),
         chapter: chapterOf(SVS.Spec.name),
         singleQueryField: Some(qf.singleFieldName),
@@ -955,6 +1301,19 @@ let make = (
       commandTypes: Some(dedupe(cmds)),
     }: Reventless.Plugin.extensionPointDef))
 
+  // Second pass, on purpose: commands are built well before `linkedViews` is
+  // assembled, so the check cannot run inline where the defs are made.
+  checkDeclaredTransitions(
+    ~pluginName=name,
+    ~writables=Array.concat(stateChangeDefs, aggregateDefs),
+    ~lifecycleStatesByView,
+  )
+  checkLifecycleTopology(
+    ~pluginName=name,
+    ~writables=Array.concat(stateChangeDefs, aggregateDefs),
+    ~lifecycleStatesByView,
+  )
+
   {
     readModels: readModelDefs,
     stateViewSlices: stateViewDefs,