hecks 3.14.0 → 4.0.0

data/rust/src/kernel/dispatch.rs

@@ -1,10 +1,12 @@
 //! Generic dispatch loops over the declared `AggregateStep`/`EntityStep` order.
 //! Argument gates run in `decode_*_arguments`, before the router resolves identity.
 
-use super::expr::{interpret, EvalContext, Expr, Field, Fielded, NoFields, StateFirst, Value, WithOld, WithParent};
+use super::expr::{
+    interpret, EvalContext, Expr, Field, Fielded, NoFields, StateFirst, Value, WithOld, WithParent,
+};
 use super::refusal_wording::{
-    AlreadyExistsCreatingDuplicateArgs, LifecycleRefusedTransitionBlockedArgs, NotFoundCreatingNoIdentityArgs, NotFoundEntityElementMissingArgs,
-    NotFoundRecordMissingArgs,
+    AlreadyExistsCreatingDuplicateArgs, LifecycleRefusedTransitionBlockedArgs,
+    NotFoundCreatingNoIdentityArgs, NotFoundEntityElementMissingArgs, NotFoundRecordMissingArgs,
 };
 use super::vocab::{AggregateStep, EntityStep};
 use super::{Event, Json, MutationRecord, Refusal, Repository, SetProjectedField, ToJson};
@@ -34,7 +36,7 @@ pub struct EntityInvariants {
     pub name: &'static str,
     pub list_field: &'static str,
     pub specs: Vec<InvariantSpec>,
-    pub nested: Vec<EntityInvariants>,
+    pub nested: Vec<Self>,
 }
 
 pub struct InvariantSet {
@@ -42,11 +44,21 @@ pub struct InvariantSet {
     pub entities: Vec<EntityInvariants>,
 }
 
-pub fn enforce_invariants(record: &dyn Fielded, aggregate_name: &str, set: &InvariantSet) -> Result<(), Refusal> {
+pub fn enforce_invariants(
+    record: &dyn Fielded,
+    aggregate_name: &str,
+    set: &InvariantSet,
+) -> Result<(), Refusal> {
     for rule in &set.aggregate {
-        let ctx = EvalContext { args: &NoFields, instance: record };
+        let ctx = EvalContext {
+            args: &NoFields,
+            instance: record,
+        };
         if !interpret(&rule.expr, &ctx)?.truthy() {
-            return Err(Refusal::InvariantViolation(format!("{aggregate_name} refused — {}", rule.description)));
+            return Err(Refusal::InvariantViolation(format!(
+                "{aggregate_name} refused — {}",
+                rule.description
+            )));
         }
     }
     for entity in &set.entities {
@@ -55,15 +67,31 @@ pub fn enforce_invariants(record: &dyn Fielded, aggregate_name: &str, set: &Inva
     Ok(())
 }
 
-fn enforce_entity_invariants(owner: &dyn Fielded, entity: &EntityInvariants) -> Result<(), Refusal> {
-    let Some(elements) = owner.items(entity.list_field) else { return Ok(()) };
+fn enforce_entity_invariants(
+    owner: &dyn Fielded,
+    entity: &EntityInvariants,
+) -> Result<(), Refusal> {
+    let Some(elements) = owner.items(entity.list_field) else {
+        return Ok(());
+    };
     for element in elements {
-        let Field::Nested(element) = element else { continue };
-        let with_parent = WithParent { args: &NoFields, parent: owner };
+        let Field::Nested(element) = element else {
+            continue;
+        };
+        let with_parent = WithParent {
+            args: &NoFields,
+            parent: owner,
+        };
         for rule in &entity.specs {
-            let ctx = EvalContext { args: &with_parent, instance: element };
+            let ctx = EvalContext {
+                args: &with_parent,
+                instance: element,
+            };
             if !interpret(&rule.expr, &ctx)?.truthy() {
-                return Err(Refusal::InvariantViolation(format!("{} refused — {}", entity.name, rule.description)));
+                return Err(Refusal::InvariantViolation(format!(
+                    "{} refused — {}",
+                    entity.name, rule.description
+                )));
             }
         }
         for nested in &entity.nested {
@@ -91,12 +119,17 @@ pub enum Hydrate<'a, T> {
     ///
     /// `state_independent` defers the `AlreadyExists` check to just before `repo.save`, for
     /// commands whose givens, ensures and mutations never read the aggregate's own state.
-    Create { id: String, build: Box<dyn FnOnce() -> T + 'a>, state_independent: bool },
+    Create {
+        id: String,
+        build: Box<dyn FnOnce() -> T + 'a>,
+        state_independent: bool,
+    },
     /// An acting command: the identity already names a record.
     Act { id: String },
 }
 
-#[allow(clippy::too_many_arguments)]
+// reason: the generated callers own `transition`/`payload` and pass them by value.
+#[allow(clippy::too_many_arguments, clippy::needless_pass_by_value)]
 pub fn dispatch<'a, T, R>(
     repo: &mut R,
     hydrate: Hydrate<'a, T>,
@@ -152,7 +185,7 @@ where
             | AggregateStep::RefuseRoleMismatch
             | AggregateStep::ResolveReferences => {}
             AggregateStep::Hydrate => {
-                let hydrate = hydrate.take().expect(ONCE);
+                let hydrate = ordered(hydrate.take(), ONCE)?;
                 hydrated = Some(hydrate_record(
                     repo,
                     hydrate,
@@ -163,21 +196,32 @@ where
                 )?);
             }
             AggregateStep::EnforceGivens => {
-                let (id, record) = hydrated.as_ref().expect(HYDRATED);
-                enforce_givens(record, args, givens, command_name, aggregate_qualified_name, id)?;
+                let (id, record) = ordered(hydrated.as_ref(), HYDRATED)?;
+                enforce_givens(
+                    record,
+                    args,
+                    givens,
+                    command_name,
+                    aggregate_qualified_name,
+                    id,
+                )?;
             }
             AggregateStep::AdmissibleTransition => {
-                let (_, record) = hydrated.as_ref().expect(HYDRATED);
+                let (_, record) = ordered(hydrated.as_ref(), HYDRATED)?;
                 admissible_transition(record, transition.as_ref(), command_name)?;
             }
             // Folded into `Hydrate::Create.build`: givens already saw the built record.
             AggregateStep::AssignCreationAttributes => {}
             AggregateStep::ApplyMutations => {
-                let (_, record) = hydrated.as_mut().expect(HYDRATED);
+                let (_, record) = ordered(hydrated.as_mut(), HYDRATED)?;
                 // The state as the givens saw it — `old` inside an `ensures`,
                 // `old` for `ensures`: the state before the mutation, cloned only if needed.
-                old_snapshot = if ensures.is_empty() { None } else { Some(record.clone()) };
-                (apply_mutations.take().expect(ONCE))(record)?;
+                old_snapshot = if ensures.is_empty() {
+                    None
+                } else {
+                    Some(record.clone())
+                };
+                (ordered(apply_mutations.take(), ONCE)?)(record)?;
             }
             // Written by the generated `apply_mutations` closure as its last line.
             AggregateStep::AdvanceLifecycle => {}
@@ -185,21 +229,21 @@ where
             // `apply_entity_command` on the record in hand.
             AggregateStep::DelegateToEntity => {}
             AggregateStep::EnforceEnsures => {
-                let (_, record) = hydrated.as_ref().expect(HYDRATED);
+                let (_, record) = ordered(hydrated.as_ref(), HYDRATED)?;
                 if let Some(old) = &old_snapshot {
                     enforce_ensures(record, old, args, ensures, command_name)?;
                 }
             }
             AggregateStep::EnforceInvariants => {
-                let (_, record) = hydrated.as_ref().expect(HYDRATED);
+                let (_, record) = ordered(hydrated.as_ref(), HYDRATED)?;
                 enforce_invariants(record, aggregate_name, invariants)?;
             }
             AggregateStep::Save => {
-                let (id, record) = hydrated.as_mut().expect(HYDRATED);
+                let (id, record) = ordered(hydrated.as_mut(), HYDRATED)?;
                 // Tenant boundary first: it precedes `seed_projections` and the write.
-                tenant_boundary_check.take().expect(ONCE)?;
+                ordered(tenant_boundary_check.take(), ONCE)??;
 
-                for (field, value) in seed_projections.take().expect(ONCE) {
+                for (field, value) in ordered(seed_projections.take(), ONCE)? {
                     record.set_projected_field(field, value);
                 }
 
@@ -220,13 +264,13 @@ where
                 persist(repo, id, record, aggregate_qualified_name, mutations);
             }
             AggregateStep::Emit => {
-                let (id, _) = hydrated.as_ref().expect(HYDRATED);
+                let (id, _) = ordered(hydrated.as_ref(), HYDRATED)?;
                 events = emitted(emits, aggregate_qualified_name, id, &payload);
             }
         }
     }
 
-    let (_, record) = hydrated.expect(HYDRATED);
+    let (_, record) = ordered(hydrated, HYDRATED)?;
     Ok((record, events))
 }
 
@@ -245,13 +289,21 @@ where
     R: Repository<T>,
 {
     match hydrate {
-        Hydrate::Create { id, build, state_independent } => {
+        Hydrate::Create {
+            id,
+            build,
+            state_independent,
+        } => {
             // A blank identity names nothing; refuse before any lookup rather than mint a
             // record keyed by "".
             if id.is_empty() {
                 return Err(Refusal::NotFound(
-                    NotFoundCreatingNoIdentityArgs { command: command_name, aggregate: aggregate_name, identity: identity_reading }
-                        .render_args(),
+                    NotFoundCreatingNoIdentityArgs {
+                        command: command_name,
+                        aggregate: aggregate_name,
+                        identity: identity_reading,
+                    }
+                    .render_args(),
                 ));
             }
             // State-independent creates defer this check to `Save`.
@@ -274,8 +326,12 @@ where
             // Shared with `dispatch_entity`'s parent lookup: both raise `record_missing`.
             let record = repo.find(&id).ok_or_else(|| {
                 Refusal::NotFound(
-                    NotFoundRecordMissingArgs { aggregate: aggregate_name, identity: identity_reading, offered: &format!("{id:?}") }
-                        .render_args(),
+                    NotFoundRecordMissingArgs {
+                        aggregate: aggregate_name,
+                        identity: identity_reading,
+                        offered: &format!("{id:?}"),
+                    }
+                    .render_args(),
                 )
             })?;
             Ok((id, record))
@@ -293,7 +349,10 @@ fn enforce_givens(
     id: &str,
 ) -> Result<(), Refusal> {
     for given in givens {
-        let ctx = EvalContext { args, instance: record };
+        let ctx = EvalContext {
+            args,
+            instance: record,
+        };
         if !interpret(&given.expr, &ctx)?.truthy() {
             // The `corrects` wording interpolates the record id, so it is built here.
             if let Some(event_name) = given.corrects_event {
@@ -302,7 +361,10 @@ fn enforce_givens(
                     "{command_name} refused — corrects {event_name}, but {aggregate_qualified_name} #{id} has never emitted it"
                 )));
             }
-            return Err(Refusal::GivenNotMet(format!("{command_name} refused — {}", given.description)));
+            return Err(Refusal::GivenNotMet(format!(
+                "{command_name} refused — {}",
+                given.description
+            )));
         }
     }
     Ok(())
@@ -310,8 +372,14 @@ fn enforce_givens(
 
 /// `admissible_transition` — shared by the aggregate record and an entity
 /// element, which check it identically.
-fn admissible_transition(instance: &dyn Fielded, transition: Option<&TransitionCheck>, command_name: &str) -> Result<(), Refusal> {
-    let Some(check) = transition else { return Ok(()) };
+fn admissible_transition(
+    instance: &dyn Fielded,
+    transition: Option<&TransitionCheck>,
+    command_name: &str,
+) -> Result<(), Refusal> {
+    let Some(check) = transition else {
+        return Ok(());
+    };
     match instance.field(check.field) {
         Some(Field::Value(Value::Str(current))) => {
             if !check.from_states.contains(&current.as_str()) {
@@ -348,19 +416,33 @@ fn enforce_ensures(
 ) -> Result<(), Refusal> {
     // C2.3 — the settled state first; see `StateFirst`.
     let state_first = StateFirst { args, settled };
-    let with_old = WithOld { args: &state_first, old };
+    let with_old = WithOld {
+        args: &state_first,
+        old,
+    };
     for rule in ensures {
-        let ctx = EvalContext { args: &with_old, instance: settled };
+        let ctx = EvalContext {
+            args: &with_old,
+            instance: settled,
+        };
         if !interpret(&rule.expr, &ctx)?.truthy() {
-            return Err(Refusal::EnsuresNotMet(format!("{command_name} refused — {}", rule.description)));
+            return Err(Refusal::EnsuresNotMet(format!(
+                "{command_name} refused — {}",
+                rule.description
+            )));
         }
     }
     Ok(())
 }
 
 /// The write half of `save`: the repository write and its mutation record.
-fn persist<T, R>(repo: &mut R, id: &str, record: &T, aggregate_qualified_name: &str, mutations: &mut Vec<MutationRecord>)
-where
+fn persist<T, R>(
+    repo: &mut R,
+    id: &str,
+    record: &T,
+    aggregate_qualified_name: &str,
+    mutations: &mut Vec<MutationRecord>,
+) where
     T: Clone + ToJson,
     R: Repository<T>,
 {
@@ -374,7 +456,12 @@ where
 }
 
 /// `emit` — the declared events, in declared order.
-fn emitted(emits: &[&'static str], aggregate_qualified_name: &str, id: &str, payload: &Json) -> Vec<Event> {
+fn emitted(
+    emits: &[&'static str],
+    aggregate_qualified_name: &str,
+    id: &str,
+    payload: &Json,
+) -> Vec<Event> {
     emits
         .iter()
         .map(|name| Event {
@@ -475,7 +562,8 @@ struct ElementHalf<'a, 's, T, E, GetList, GetListMut, Matches, Apply> {
     old_snapshot: Option<E>,
 }
 
-impl<'a, 's, T, E, GetList, GetListMut, Matches, Apply> ElementHalf<'a, 's, T, E, GetList, GetListMut, Matches, Apply>
+impl<T, E, GetList, GetListMut, Matches, Apply>
+    ElementHalf<'_, '_, T, E, GetList, GetListMut, Matches, Apply>
 where
     T: Fielded + Clone,
     E: Fielded + Clone,
@@ -497,12 +585,17 @@ where
             | EntityStep::ResolveReferences => Ok(()),
             // The parent half: `dispatch_entity`'s own arms, or the delegating aggregate's
             // `dispatch`.
-            EntityStep::HydrateParent | EntityStep::EnforceInvariants | EntityStep::Save | EntityStep::Emit => Ok(()),
+            EntityStep::HydrateParent
+            | EntityStep::EnforceInvariants
+            | EntityStep::Save
+            | EntityStep::Emit => Ok(()),
             EntityStep::LocateElement => self.locate_element(record),
             EntityStep::EnforceGivens => self.enforce_givens(),
-            EntityStep::AdmissibleTransition => {
-                admissible_transition(self.element.as_ref().expect(LOCATED), self.transition.as_ref(), self.command_name)
-            }
+            EntityStep::AdmissibleTransition => admissible_transition(
+                ordered(self.element.as_ref(), LOCATED)?,
+                self.transition.as_ref(),
+                self.command_name,
+            ),
             EntityStep::ApplyMutations => self.apply_mutations(record),
             // Written by the generated `apply_mutations` closure (the entity's own lifecycle).
             EntityStep::AdvanceLifecycle => Ok(()),
@@ -511,18 +604,21 @@ where
     }
 
     fn locate_element(&mut self, record: &T) -> Result<(), Refusal> {
-        let position = (self.get_list)(record).iter().position(|el| (self.matches)(el)).ok_or_else(|| {
-            Refusal::NotFound(
-                NotFoundEntityElementMissingArgs {
-                    entity: self.entity_name,
-                    identity: self.entity_identity_reading,
-                    wants: self.wants,
-                    aggregate: self.aggregate_name,
-                    parent_id: &format!("{:?}", self.parent_id),
-                }
-                .render_args(),
-            )
-        })?;
+        let position = (self.get_list)(record)
+            .iter()
+            .position(|el| (self.matches)(el))
+            .ok_or_else(|| {
+                Refusal::NotFound(
+                    NotFoundEntityElementMissingArgs {
+                        entity: self.entity_name,
+                        identity: self.entity_identity_reading,
+                        wants: self.wants,
+                        aggregate: self.aggregate_name,
+                        parent_id: &format!("{:?}", self.parent_id),
+                    }
+                    .render_args(),
+                )
+            })?;
         self.element = Some((self.get_list)(record)[position].clone());
         self.position = Some(position);
         self.parent_before = Some(record.clone());
@@ -530,15 +626,20 @@ where
     }
 
     fn enforce_givens(&self) -> Result<(), Refusal> {
-        let parent_before = self.parent_before.as_ref().expect(LOCATED);
-        let element = self.element.as_ref().expect(LOCATED);
+        let parent_before = ordered(self.parent_before.as_ref(), LOCATED)?;
+        let element = ordered(self.element.as_ref(), LOCATED)?;
 
         // Entity-level `corrects` is asked of the parent record and root aggregate, since an
         // entity has no event stream. It runs after the element lookup, before declared givens,
         // and proves the parent emitted the event, not that this element did.
         for given in self.givens {
-            let Some(event_name) = given.corrects_event else { continue };
-            let ctx = EvalContext { args: self.args, instance: parent_before };
+            let Some(event_name) = given.corrects_event else {
+                continue;
+            };
+            let ctx = EvalContext {
+                args: self.args,
+                instance: parent_before,
+            };
             if !interpret(&given.expr, &ctx)?.truthy() {
                 return Err(Refusal::NothingToCorrect(format!(
                     "{} refused — corrects {event_name}, but {} #{} has never emitted it",
@@ -547,42 +648,69 @@ where
             }
         }
 
-        let with_parent = WithParent { args: self.args, parent: parent_before };
-        let given_args: &dyn Fielded = if self.parent_in_args { &with_parent } else { self.args };
+        let with_parent = WithParent {
+            args: self.args,
+            parent: parent_before,
+        };
+        let given_args: &dyn Fielded = if self.parent_in_args {
+            &with_parent
+        } else {
+            self.args
+        };
         for given in self.givens {
             // Handled above; the `corrects` flag field lives on the parent, not the element.
             if given.corrects_event.is_some() {
                 continue;
             }
-            let ctx = EvalContext { args: given_args, instance: element };
+            let ctx = EvalContext {
+                args: given_args,
+                instance: element,
+            };
             if !interpret(&given.expr, &ctx)?.truthy() {
-                return Err(Refusal::GivenNotMet(format!("{} refused — {}", self.command_name, given.description)));
+                return Err(Refusal::GivenNotMet(format!(
+                    "{} refused — {}",
+                    self.command_name, given.description
+                )));
             }
         }
         Ok(())
     }
 
     fn apply_mutations(&mut self, record: &mut T) -> Result<(), Refusal> {
-        let position = self.position.expect(LOCATED);
-        let mut element = self.element.take().expect(LOCATED);
-        self.old_snapshot = if self.ensures.is_empty() { None } else { Some(element.clone()) };
-        (self.apply_mutations.take().expect(ONCE))(&mut element)?;
-        (self.get_list_mut.take().expect(ONCE))(record)[position] = element;
+        let position = ordered(self.position, LOCATED)?;
+        let mut element = ordered(self.element.take(), LOCATED)?;
+        self.old_snapshot = if self.ensures.is_empty() {
+            None
+        } else {
+            Some(element.clone())
+        };
+        (ordered(self.apply_mutations.take(), ONCE)?)(&mut element)?;
+        (ordered(self.get_list_mut.take(), ONCE)?)(record)[position] = element;
         Ok(())
     }
 
     fn enforce_ensures(&self, record: &T) -> Result<(), Refusal> {
-        let Some(old) = &self.old_snapshot else { return Ok(()) };
-        let position = self.position.expect(LOCATED);
+        let Some(old) = &self.old_snapshot else {
+            return Ok(());
+        };
+        let position = ordered(self.position, LOCATED)?;
         let parent_after = record.clone();
-        let with_parent = WithParent { args: self.args, parent: &parent_after };
-        let ensures_args: &dyn Fielded = if self.parent_in_args { &with_parent } else { self.args };
+        let with_parent = WithParent {
+            args: self.args,
+            parent: &parent_after,
+        };
+        let ensures_args: &dyn Fielded = if self.parent_in_args {
+            &with_parent
+        } else {
+            self.args
+        };
         let settled = &(self.get_list)(record)[position];
         enforce_ensures(settled, old, ensures_args, self.ensures, self.command_name)
     }
 }
 
-#[allow(clippy::too_many_arguments)]
+// reason: the generated callers own `payload` and pass it by value.
+#[allow(clippy::too_many_arguments, clippy::needless_pass_by_value)]
 pub fn dispatch_entity<'a, T, E, R>(
     repo: &mut R,
     parent_id: &str,
@@ -670,14 +798,18 @@ where
             | EntityStep::ApplyMutations
             | EntityStep::AdvanceLifecycle
             | EntityStep::EnforceEnsures => {
-                element.run(step, hydrated.as_mut().expect(HYDRATED))?;
+                element.run(step, ordered(hydrated.as_mut(), HYDRATED)?)?;
             }
             EntityStep::EnforceInvariants => {
-                enforce_invariants(hydrated.as_ref().expect(HYDRATED), aggregate_name, invariants)?;
+                enforce_invariants(
+                    ordered(hydrated.as_ref(), HYDRATED)?,
+                    aggregate_name,
+                    invariants,
+                )?;
             }
             EntityStep::Save => {
-                let record = hydrated.as_mut().expect(HYDRATED);
-                for (field, value) in seed_projections.take().expect(ONCE) {
+                let record = ordered(hydrated.as_mut(), HYDRATED)?;
+                for (field, value) in ordered(seed_projections.take(), ONCE)? {
                     record.set_projected_field(field, value);
                 }
                 persist(repo, parent_id, record, aggregate_qualified_name, mutations);
@@ -688,7 +820,13 @@ where
         }
     }
 
-    Ok((hydrated.expect(HYDRATED), events))
+    Ok((ordered(hydrated, HYDRATED)?, events))
+}
+
+/// Turns a slot the declared step order guarantees filled into a value, or a `Fault` naming the
+/// order that was broken; the const assertions below make the `Err` unreachable.
+fn ordered<V>(slot: Option<V>, because: &str) -> Result<V, Refusal> {
+    slot.ok_or_else(|| Refusal::Fault(because.to_string()))
 }
 
 const HYDRATED: &str = "the declared order hydrates before any step that reads the record (const-asserted in this file)";
@@ -732,7 +870,9 @@ impl<A> ArgumentGates<'_, A> {
                 Ok(())
             }
             ArgumentGate::RefuseRoleMismatch => (self.refuse_role_mismatch)(),
-            ArgumentGate::ResolveReferences => (self.resolve_references)(args.as_ref().expect(NORMALIZED)),
+            ArgumentGate::ResolveReferences => {
+                (self.resolve_references)(ordered(args.as_ref(), NORMALIZED)?)
+            }
         }
     }
 }
@@ -740,7 +880,10 @@ impl<A> ArgumentGates<'_, A> {
 /// `AggregateStep::ORDER`'s argument gates over one aggregate command's facts:
 /// the normalized `<Args>`, or the first refusal in declared order. Every
 /// other step is `dispatch`'s, entered once the router has resolved identity.
-pub fn decode_aggregate_arguments<A>(facts: &Json, gates: &ArgumentGates<'_, A>) -> Result<A, Refusal> {
+pub fn decode_aggregate_arguments<A>(
+    facts: &Json,
+    gates: &ArgumentGates<'_, A>,
+) -> Result<A, Refusal> {
     let mut args = None;
     for step in AggregateStep::ORDER {
         #[deny(clippy::wildcard_enum_match_arm)]
@@ -765,12 +908,15 @@ pub fn decode_aggregate_arguments<A>(facts: &Json, gates: &ArgumentGates<'_, A>)
         };
         gates.run(gate, facts, &mut args)?;
     }
-    Ok(args.expect(NORMALIZED))
+    ordered(args, NORMALIZED)
 }
 
 /// `EntityStep::ORDER`'s argument gates over one entity command's facts — see
 /// `decode_aggregate_arguments`. Every other step is `dispatch_entity`'s.
-pub fn decode_entity_arguments<A>(facts: &Json, gates: &ArgumentGates<'_, A>) -> Result<A, Refusal> {
+pub fn decode_entity_arguments<A>(
+    facts: &Json,
+    gates: &ArgumentGates<'_, A>,
+) -> Result<A, Refusal> {
     let mut args = None;
     for step in EntityStep::ORDER {
         #[deny(clippy::wildcard_enum_match_arm)]
@@ -794,10 +940,11 @@ pub fn decode_entity_arguments<A>(facts: &Json, gates: &ArgumentGates<'_, A>) ->
         };
         gates.run(gate, facts, &mut args)?;
     }
-    Ok(args.expect(NORMALIZED))
+    ordered(args, NORMALIZED)
 }
 
 /// A step's index in `AggregateStep::ORDER`, usable in a const context.
+#[allow(clippy::panic)] // reason: evaluated at compile time; a missing step fails the build.
 const fn aggregate_position(step: AggregateStep) -> usize {
     let mut index = 0;
     while index < AggregateStep::ORDER.len() {
@@ -810,6 +957,7 @@ const fn aggregate_position(step: AggregateStep) -> usize {
 }
 
 /// A step's index in `EntityStep::ORDER`, usable in a const context.
+#[allow(clippy::panic)] // reason: evaluated at compile time; a missing step fails the build.
 const fn entity_position(step: EntityStep) -> usize {
     let mut index = 0;
     while index < EntityStep::ORDER.len() {
@@ -825,6 +973,7 @@ const fn entity_position(step: EntityStep) -> usize {
 // vocabulary.bluebook fails the build instead of panicking at dispatch time.
 const _: () = {
     use AggregateStep as A;
+    use EntityStep as E;
     let hydrate = aggregate_position(A::Hydrate);
     assert!(hydrate < aggregate_position(A::EnforceGivens));
     assert!(hydrate < aggregate_position(A::AdmissibleTransition));
@@ -847,7 +996,6 @@ const _: () = {
     assert!(aggregate_position(A::ResolveReferences) < hydrate);
     assert!(aggregate_position(A::NormalizeArgs) < aggregate_position(A::ResolveReferences));
 
-    use EntityStep as E;
     let hydrate_parent = entity_position(E::HydrateParent);
     assert!(hydrate_parent < entity_position(E::LocateElement));
     assert!(hydrate_parent < entity_position(E::EnforceInvariants));
@@ -914,12 +1062,18 @@ pub const fn aggregate_step_site(step: AggregateStep) -> StepSite {
         A::EnforceGivens => StepSite::Kernel,
         A::AdmissibleTransition => StepSite::Kernel,
         // `Hydrate::Create.build`.
-        A::AssignCreationAttributes => StepSite::FoldedInto(AggregateStepOrEntityStep::Aggregate(A::Hydrate)),
+        A::AssignCreationAttributes => {
+            StepSite::FoldedInto(AggregateStepOrEntityStep::Aggregate(A::Hydrate))
+        }
         A::ApplyMutations => StepSite::Kernel,
         // The generated `apply_mutations` closure's last line.
-        A::AdvanceLifecycle => StepSite::FoldedInto(AggregateStepOrEntityStep::Aggregate(A::ApplyMutations)),
+        A::AdvanceLifecycle => {
+            StepSite::FoldedInto(AggregateStepOrEntityStep::Aggregate(A::ApplyMutations))
+        }
         // The generated `apply_mutations` closure → `apply_entity_command`.
-        A::DelegateToEntity => StepSite::FoldedInto(AggregateStepOrEntityStep::Aggregate(A::ApplyMutations)),
+        A::DelegateToEntity => {
+            StepSite::FoldedInto(AggregateStepOrEntityStep::Aggregate(A::ApplyMutations))
+        }
         A::EnforceEnsures => StepSite::Kernel,
         A::EnforceInvariants => StepSite::Kernel,
         A::Save => StepSite::Kernel,
@@ -944,7 +1098,9 @@ pub const fn entity_step_site(step: EntityStep) -> StepSite {
         E::EnforceGivens => StepSite::Kernel,
         E::AdmissibleTransition => StepSite::Kernel,
         E::ApplyMutations => StepSite::Kernel,
-        E::AdvanceLifecycle => StepSite::FoldedInto(AggregateStepOrEntityStep::Entity(E::ApplyMutations)),
+        E::AdvanceLifecycle => {
+            StepSite::FoldedInto(AggregateStepOrEntityStep::Entity(E::ApplyMutations))
+        }
         E::EnforceEnsures => StepSite::Kernel,
         E::EnforceInvariants => StepSite::Kernel,
         E::Save => StepSite::Kernel,
@@ -980,18 +1136,33 @@ mod step_order_tests {
 
     #[test]
     fn the_kernel_performs_exactly_these_aggregate_steps() {
-        let kernel: Vec<&str> =
-            AggregateStep::ORDER.iter().filter(|s| aggregate_step_site(**s) == StepSite::Kernel).map(|s| s.step()).collect();
+        let kernel: Vec<&str> = AggregateStep::ORDER
+            .iter()
+            .filter(|s| aggregate_step_site(**s) == StepSite::Kernel)
+            .map(AggregateStep::step)
+            .collect();
         assert_eq!(
             kernel,
-            ["hydrate", "enforce_givens", "admissible_transition", "apply_mutations", "enforce_ensures", "enforce_invariants", "save", "emit"]
+            [
+                "hydrate",
+                "enforce_givens",
+                "admissible_transition",
+                "apply_mutations",
+                "enforce_ensures",
+                "enforce_invariants",
+                "save",
+                "emit"
+            ]
         );
     }
 
     #[test]
     fn the_kernel_performs_exactly_these_entity_steps() {
-        let kernel: Vec<&str> =
-            EntityStep::ORDER.iter().filter(|s| entity_step_site(**s) == StepSite::Kernel).map(|s| s.step()).collect();
+        let kernel: Vec<&str> = EntityStep::ORDER
+            .iter()
+            .filter(|s| entity_step_site(**s) == StepSite::Kernel)
+            .map(EntityStep::step)
+            .collect();
         assert_eq!(
             kernel,
             [
@@ -1012,16 +1183,30 @@ mod step_order_tests {
     fn argument_gates_all_precede_the_first_kernel_step() {
         // The router resolves identity between the two loops, so every
         // argument gate sits ahead of the first kernel step.
-        let first_kernel = AggregateStep::ORDER.iter().position(|s| aggregate_step_site(*s) == StepSite::Kernel).unwrap();
+        let first_kernel = AggregateStep::ORDER
+            .iter()
+            .position(|s| aggregate_step_site(*s) == StepSite::Kernel)
+            .unwrap();
         for step in AggregateStep::ORDER {
             if aggregate_step_site(step) == StepSite::ArgumentGate {
-                assert!(step.position() < first_kernel, "{} is an argument gate but is declared after hydrate", step.step());
+                assert!(
+                    step.position() < first_kernel,
+                    "{} is an argument gate but is declared after hydrate",
+                    step.step()
+                );
             }
         }
-        let first_kernel = EntityStep::ORDER.iter().position(|s| entity_step_site(*s) == StepSite::Kernel).unwrap();
+        let first_kernel = EntityStep::ORDER
+            .iter()
+            .position(|s| entity_step_site(*s) == StepSite::Kernel)
+            .unwrap();
         for step in EntityStep::ORDER {
             if entity_step_site(step) == StepSite::ArgumentGate {
-                assert!(step.position() < first_kernel, "{} is an argument gate but is declared after hydrate_parent", step.step());
+                assert!(
+                    step.position() < first_kernel,
+                    "{} is an argument gate but is declared after hydrate_parent",
+                    step.step()
+                );
             }
         }
     }
@@ -1029,7 +1214,10 @@ mod step_order_tests {
     use std::cell::RefCell;
 
     /// Hooks that record which step ran, refusing at the steps named in `refuse`.
-    fn recorded<R>(refuse: &[&'static str], body: impl FnOnce(&ArgumentGates<'_, i64>) -> R) -> (R, Vec<&'static str>) {
+    fn recorded<R>(
+        refuse: &[&'static str],
+        body: impl FnOnce(&ArgumentGates<'_, i64>) -> R,
+    ) -> (R, Vec<&'static str>) {
         let ran = RefCell::new(Vec::new());
         let hit = |step: &'static str| -> Result<(), Refusal> {
             ran.borrow_mut().push(step);
@@ -1045,7 +1233,10 @@ mod step_order_tests {
         let normalize = |_: &Json| hit("normalize_args").map(|()| 7);
         let role = || hit("refuse_role_mismatch");
         let references = |args: &i64| {
-            assert_eq!(*args, 7, "resolve_references reads what normalize_args produced");
+            assert_eq!(
+                *args, 7,
+                "resolve_references reads what normalize_args produced"
+            );
             hit("resolve_references")
         };
         let gates = ArgumentGates {
@@ -1065,29 +1256,46 @@ mod step_order_tests {
         let facts = Json::Object(Vec::new());
         let (result, ran) = recorded(&[], |gates| decode_aggregate_arguments(&facts, gates));
         assert_eq!(result.unwrap(), 7);
-        let declared: Vec<&str> =
-            AggregateStep::ORDER.iter().filter(|s| aggregate_step_site(**s) == StepSite::ArgumentGate).map(|s| s.step()).collect();
+        let declared: Vec<&str> = AggregateStep::ORDER
+            .iter()
+            .filter(|s| aggregate_step_site(**s) == StepSite::ArgumentGate)
+            .map(AggregateStep::step)
+            .collect();
         assert_eq!(ran, declared);
 
         let (result, ran) = recorded(&[], |gates| decode_entity_arguments(&facts, gates));
         assert_eq!(result.unwrap(), 7);
-        let declared: Vec<&str> =
-            EntityStep::ORDER.iter().filter(|s| entity_step_site(**s) == StepSite::ArgumentGate).map(|s| s.step()).collect();
+        let declared: Vec<&str> = EntityStep::ORDER
+            .iter()
+            .filter(|s| entity_step_site(**s) == StepSite::ArgumentGate)
+            .map(EntityStep::step)
+            .collect();
         assert_eq!(ran, declared);
     }
 
     #[test]
     fn the_earliest_declared_violated_gate_wins_and_later_hooks_never_run() {
         let facts = Json::Object(Vec::new());
-        let gates: Vec<&'static str> =
-            AggregateStep::ORDER.iter().filter(|s| aggregate_step_site(**s) == StepSite::ArgumentGate).map(|s| s.step()).collect();
+        let gates: Vec<&'static str> = AggregateStep::ORDER
+            .iter()
+            .filter(|s| aggregate_step_site(**s) == StepSite::ArgumentGate)
+            .map(AggregateStep::step)
+            .collect();
         for (i, earlier) in gates.iter().enumerate() {
             for later in &gates[i + 1..] {
-                let (result, ran) = recorded(&[earlier, later], |g| decode_aggregate_arguments(&facts, g));
-                assert_eq!(result.unwrap_err().to_string(), Refusal::TypeMismatch(earlier.to_string()).to_string());
+                let (result, ran) =
+                    recorded(&[earlier, later], |g| decode_aggregate_arguments(&facts, g));
+                assert_eq!(
+                    result.unwrap_err().to_string(),
+                    Refusal::TypeMismatch(earlier.to_string()).to_string()
+                );
                 assert_eq!(ran.last(), Some(earlier));
-                let (result, _) = recorded(&[earlier, later], |g| decode_entity_arguments(&facts, g));
-                assert_eq!(result.unwrap_err().to_string(), Refusal::TypeMismatch(earlier.to_string()).to_string());
+                let (result, _) =
+                    recorded(&[earlier, later], |g| decode_entity_arguments(&facts, g));
+                assert_eq!(
+                    result.unwrap_err().to_string(),
+                    Refusal::TypeMismatch(earlier.to_string()).to_string()
+                );
             }
         }
     }