hecks 4.0.0 → 6.0.0

data/rust/src/kernel/cli.rs

@@ -1,6 +1,9 @@
 //! The stdin/stdout JSON CLI shared by the native binary and the wasm32-wasip1 module.
-//! `run` reads `{"steps": [...]}` and hands each step to `kernel::orchestrate` (ADR 0012).
+//! `run` reads `{"steps": [...]}` and hands each step to `kernel::orchestrate` (ADR 0012), or
+//! `{"present": answer}` and answers that answer bare (`kernel::present`).
 
+use super::collecting::{self, Collected, Detail};
+use super::vocab::RefusalClass;
 use super::{
     named_query, orchestrate, query_comparators, read_model, repository, AggregateScan,
     CompletedCompensation, Event, Json, MutationRecord, PendingCrossDomainReaction, Refusal,
@@ -24,6 +27,18 @@ pub fn run(input: &str) -> String {
         Err(e) => return error_output(&format!("invalid JSON on stdin: {e}")),
     };
 
+    // `{"present": answer}`: a run's answer in the bare shape a caller reads (single-field value
+    // objects as their sole field); no step runs, and stored state stays wrapped.
+    // Parsed again keeping number text, so a Float the answer carries is written back unchanged.
+    if parsed.get("present").is_some() {
+        let answer = Json::parse_keeping_number_text(input)
+            .ok()
+            .and_then(|whole| whole.get("present").cloned())
+            .unwrap_or(Json::Null);
+        return super::present::present_answer(answer, crate::generated::active::present)
+            .to_json_string();
+    }
+
     // Optional `"needs"`: which commands need which outside facts (ADR 0081), passed by the host.
     super::needs::install(parsed.get("needs"));
     // Optional `"query_needs"`: which queries need which outside facts, filled the same way.
@@ -102,6 +117,8 @@ pub fn run(input: &str) -> String {
     let mut query_results: Vec<Json> = Vec::new();
     // One entry per `dry_run` step: the command run against a throwaway clone of the store.
     let mut dry_runs: Vec<Json> = Vec::new();
+    // One entry per `validate` step: every refusal a command would meet, as data.
+    let mut validations: Vec<Json> = Vec::new();
 
     for step in steps {
         // A query step's `args` sit at the sibling `"args"` key, as for a command step.
@@ -219,7 +236,7 @@ pub fn run(input: &str) -> String {
             let caller_role = step.get("role").and_then(Json::as_str);
             // See `actor_id` on the command step below.
             let caller_actor_id = step.get("actor_id").and_then(Json::as_str);
-            let command_input = dry_run_command_input(args);
+            let command_input = dry_run_input(step, args);
             dry_runs.push(dry_run(
                 &store,
                 verb,
@@ -233,8 +250,25 @@ pub fn run(input: &str) -> String {
             continue;
         }
 
+        if let Some(verb) = step.get("validate").and_then(Json::as_str) {
+            let caller_role = step.get("role").and_then(Json::as_str);
+            let caller_actor_id = step.get("actor_id").and_then(Json::as_str);
+            let command_input = dry_run_input(step, args);
+            validations.push(validation(
+                &store,
+                verb,
+                &command_input,
+                caller_role,
+                caller_actor_id,
+            ));
+            mutations_per_step.push(Vec::new());
+            cross_domain_per_step.push(Vec::new());
+            reactions_per_step.push(Json::Array(Vec::new()));
+            continue;
+        }
+
         let Some(verb) = step.get("verb").and_then(Json::as_str) else {
-            return error_output("step missing \"verb\", \"dry_run\", or \"query\"");
+            return error_output("step missing \"verb\", \"dry_run\", \"validate\", or \"query\"");
         };
 
         // Per-step `role:` stands in for Ruby's ambient `Hecks.as_caller`; passed to the top-level
@@ -332,6 +366,7 @@ pub fn run(input: &str) -> String {
         ("events".to_string(), events_json),
         ("refusals".to_string(), refusals_json),
         ("dry_runs".to_string(), Json::Array(dry_runs)),
+        ("validations".to_string(), Json::Array(validations)),
         ("mutations".to_string(), mutations_json),
         ("queries".to_string(), Json::Array(query_results)),
         ("cross_domain_reactions".to_string(), cross_domain_json),
@@ -358,27 +393,112 @@ fn dry_run(
     caller_role: Option<&str>,
     caller_actor_id: Option<&str>,
 ) -> Json {
-    let mut scratch = store.clone();
-    match dispatch_by_name(
-        &mut scratch,
-        verb,
-        command_input,
-        caller_role,
-        caller_actor_id,
-        &mut Vec::new(),
-    ) {
-        Ok(_) => Json::obj(vec![
+    let (outcome, collected) = preview(store, verb, command_input, caller_role, caller_actor_id);
+    match outcome {
+        Ok(()) => Json::obj(vec![
             ("verb", Json::str(verb.to_string())),
             ("ok", Json::Bool(true)),
         ]),
-        Err(refusal) => Json::obj(vec![
-            ("verb", Json::str(verb.to_string())),
-            ("ok", Json::Bool(false)),
-            ("error", Json::str(refusal.to_string())),
-        ]),
+        Err(refusal) => refused_dry_run(verb, &refusal, &collected),
     }
 }
 
+/// Every reason a command would be refused, as data: `{verb, ok, refusals}` with each refusal's
+/// class, kind, stage, attribute, path, rule and message. The step `validate` answers with.
+fn validation(
+    store: &Store,
+    verb: &str,
+    command_input: &Json,
+    caller_role: Option<&str>,
+    caller_actor_id: Option<&str>,
+) -> Json {
+    let (outcome, collected) = preview(store, verb, command_input, caller_role, caller_actor_id);
+    let refusals: Vec<Json> = match outcome {
+        Ok(()) => Vec::new(),
+        Err(refusal) if collected.is_empty() => vec![refusal_entry(&refusal, &Detail::default())],
+        Err(_) => collected
+            .iter()
+            .map(|kept| refusal_entry(&kept.refusal, &kept.detail))
+            .collect(),
+    };
+    Json::obj(vec![
+        ("verb", Json::str(verb.to_string())),
+        ("ok", Json::Bool(refusals.is_empty())),
+        ("refusals", Json::Array(refusals)),
+    ])
+}
+
+/// The command run against a throwaway copy of the store with a collector bound: what it raised,
+/// and every refusal its failing stage kept.
+fn preview(
+    store: &Store,
+    verb: &str,
+    command_input: &Json,
+    caller_role: Option<&str>,
+    caller_actor_id: Option<&str>,
+) -> (Result<(), Refusal>, Vec<Collected>) {
+    let mut scratch = store.clone();
+    let (outcome, collected) = collecting::collecting(|| {
+        dispatch_by_name(
+            &mut scratch,
+            verb,
+            command_input,
+            caller_role,
+            caller_actor_id,
+            &mut Vec::new(),
+        )
+    });
+    (outcome.map(|_| ()), collected)
+}
+
+/// A refused dry run: the refusal's text, its class name, and the `kind` and `stage` the language's
+/// `RefusalClass` table gives that class. A refusal the table does not class (`Fault`) is a plain
+/// refusal in the `state` stage, as `Hecks::Refused` classes one in Ruby.
+///
+/// `reasons` holds every refusal the failing stage collected; `refusals` lists them all, or just
+/// `refusal` when the stage raised without collecting (a role, argument or lifecycle refusal).
+fn refused_dry_run(verb: &str, refusal: &Refusal, reasons: &[Collected]) -> Json {
+    let all: Vec<Json> = if reasons.is_empty() {
+        vec![refusal_entry(refusal, &Detail::default())]
+    } else {
+        reasons
+            .iter()
+            .map(|kept| refusal_entry(&kept.refusal, &kept.detail))
+            .collect()
+    };
+    let (kind, stage) = refusal_class(refusal);
+    Json::obj(vec![
+        ("verb", Json::str(verb.to_string())),
+        ("ok", Json::Bool(false)),
+        ("error", Json::str(refusal.to_string())),
+        ("refusal", Json::str(refusal.kind().to_string())),
+        ("kind", Json::str(kind.to_string())),
+        ("stage", Json::str(stage.to_string())),
+        ("refusals", Json::Array(all)),
+    ])
+}
+
+fn refusal_class(refusal: &Refusal) -> (&'static str, &'static str) {
+    RefusalClass::from_name(refusal.kind())
+        .map_or(("refused", "state"), |class| (class.kind(), class.stage()))
+}
+
+/// One refusal as a client reads it: the class, kind and stage, the message, and what it is about
+/// (`attribute` and `path` for an argument, `rule` for a given, ensure or invariant), null otherwise.
+fn refusal_entry(refusal: &Refusal, detail: &Detail) -> Json {
+    let (kind, stage) = refusal_class(refusal);
+    let text = |value: &Option<String>| value.clone().map_or(Json::Null, Json::Str);
+    Json::obj(vec![
+        ("kind", Json::str(kind.to_string())),
+        ("stage", Json::str(stage.to_string())),
+        ("refusal", Json::str(refusal.kind().to_string())),
+        ("attribute", text(&detail.attribute)),
+        ("path", text(&detail.path)),
+        ("rule", text(&detail.rule)),
+        ("message", Json::str(refusal.to_string())),
+    ])
+}
+
 fn tables() -> Tables<'static> {
     Tables {
         policies: POLICIES,
@@ -577,6 +697,16 @@ fn command_input<'a>(step: &'a Json, legacy_args: &'a Json) -> &'a Json {
     }
 }
 
+// A dry run that names its receiver, with top-level `to`/`with` as a real step does (the host
+// previews this way), is routed as that step would be. Otherwise `args` are flat facts.
+fn dry_run_input(step: &Json, args: &Json) -> Json {
+    if step.get("to").is_some() || step.get("with").is_some() {
+        step.clone()
+    } else {
+        dry_run_command_input(args)
+    }
+}
+
 // Not `command_input()`: Ruby's `dry_run?` forwards every arg key, `to`/`with` included, as flat
 // facts. Wrapping under `with` keeps a fact named `to` from being read as a routing envelope.
 fn dry_run_command_input(args: &Json) -> Json {
@@ -605,10 +735,15 @@ fn cross_domain_reaction_to_json(reaction: &PendingCrossDomainReaction) -> Json
 }
 
 /// The live `sagas` map as a JSON array, in the shape the `"sagas"` input key parses.
+///
+/// In key order: a `HashMap` iterates in an order seeded per process, so the same run would answer
+/// differently each time and two stores fed the same sagas would disagree on order alone.
 fn saga_snapshot_json(sagas: &HashMap<(String, String), SagaInstance>) -> Json {
+    let mut keyed: Vec<_> = sagas.iter().collect();
+    keyed.sort_by(|a, b| a.0.cmp(b.0));
     Json::Array(
-        sagas
-            .iter()
+        keyed
+            .into_iter()
             .map(|((process_manager, correlation), instance)| {
                 Json::obj(vec![
                     ("process_manager", Json::str(process_manager.clone())),
@@ -717,3 +852,81 @@ mod routing_tests {
         );
     }
 }
+
+#[cfg(test)]
+mod refused_dry_run_tests {
+    use super::*;
+
+    fn answer(refusal: &Refusal) -> String {
+        refused_dry_run("A::B.C", refusal, &[]).to_json_string()
+    }
+
+    #[test]
+    fn a_stage_that_collected_lists_every_refusal_and_one_that_did_not_lists_its_own() {
+        let first = Refusal::GivenNotMet("C refused — one".to_string());
+        let second = Refusal::GivenNotMet("C refused — two".to_string());
+
+        let kept = |refusal: Refusal, rule: &str| Collected {
+            refusal,
+            detail: Detail::rule(rule),
+        };
+        let collected = refused_dry_run(
+            "A::B.C",
+            &first,
+            &[kept(first.clone(), "one"), kept(second, "two")],
+        )
+        .to_json_string();
+        let alone = answer(&first);
+        assert!(
+            collected.contains(r#""rule":"one""#) && collected.contains(r#""rule":"two""#),
+            "{collected}"
+        );
+        assert!(alone.contains(r#""rule":null"#), "{alone}");
+
+        assert!(
+            collected.contains("C refused — one") && collected.contains("C refused — two"),
+            "{collected}"
+        );
+        assert_eq!(
+            alone.matches(r#""refusal":"GivenNotMet""#).count(),
+            2,
+            "{alone}"
+        );
+        assert!(!alone.contains("two"), "{alone}");
+    }
+
+    #[test]
+    fn a_refused_dry_run_names_the_class_kind_and_stage_the_language_gives_it() {
+        let json = answer(&Refusal::GivenNotMet(
+            "C refused — the balance is zero".to_string(),
+        ));
+        assert!(json.contains(r#""ok":false"#), "{json}");
+        assert!(json.contains(r#""refusal":"GivenNotMet""#), "{json}");
+        assert!(json.contains(r#""kind":"refused""#), "{json}");
+        assert!(json.contains(r#""stage":"givens""#), "{json}");
+    }
+
+    #[test]
+    fn a_missing_record_is_kind_not_found() {
+        let json = answer(&Refusal::NotFound("no Account a1".to_string()));
+        assert!(json.contains(r#""kind":"not_found""#), "{json}");
+    }
+
+    #[test]
+    fn a_role_the_caller_lacks_is_kind_unauthorized_in_the_role_stage() {
+        let json = answer(&Refusal::Unauthorized("role".to_string()));
+        assert!(
+            json.contains(r#""kind":"unauthorized""#) && json.contains(r#""stage":"role""#),
+            "{json}"
+        );
+    }
+
+    #[test]
+    fn a_refusal_the_language_does_not_class_is_a_plain_refusal_in_the_state_stage() {
+        let json = answer(&Refusal::Fault("boom".to_string()));
+        assert!(
+            json.contains(r#""kind":"refused""#) && json.contains(r#""stage":"state""#),
+            "{json}"
+        );
+    }
+}

data/rust/src/kernel/collecting.rs

@@ -0,0 +1,174 @@
+//! Collecting refusals within a stage, for a dry run that answers every reason a command would be
+//! refused. A real dispatch has no collector bound, so `refuse` raises the first refusal at once,
+//! exactly as before.
+
+use super::Refusal;
+use std::cell::RefCell;
+
+/// What a refusal is about, beyond its text: the attribute and the JSON Pointer to the offending
+/// value (an argument refusal), or the description of the rule that did not hold.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Detail {
+    pub attribute: Option<String>,
+    pub path: Option<String>,
+    pub rule: Option<String>,
+}
+
+impl Detail {
+    /// A refusal about the argument `name`, located at `/name`.
+    pub fn attribute(name: &str) -> Self {
+        Self {
+            attribute: Some(name.to_string()),
+            path: Some(format!("/{name}")),
+            rule: None,
+        }
+    }
+
+    /// A refusal because the rule described by `description` did not hold.
+    pub fn rule(description: &str) -> Self {
+        Self {
+            rule: Some(description.to_string()),
+            ..Self::default()
+        }
+    }
+}
+
+/// A refusal kept by a collector, with what it is about.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Collected {
+    pub refusal: Refusal,
+    pub detail: Detail,
+}
+
+thread_local! {
+    static COLLECTED: RefCell<Option<Vec<Collected>>> = const { RefCell::new(None) };
+}
+
+/// Runs `body` with a collector bound and returns its result with everything `refuse` collected.
+pub fn collecting<T>(body: impl FnOnce() -> T) -> (T, Vec<Collected>) {
+    COLLECTED.with(|slot| *slot.borrow_mut() = Some(Vec::new()));
+    let result = body();
+    let collected = COLLECTED.with(|slot| slot.borrow_mut().take().unwrap_or_default());
+    (result, collected)
+}
+
+/// Raises `refusal`, or, when a collector is bound, keeps it and lets the stage go on to the next rule.
+pub fn refuse(refusal: Refusal) -> Result<(), Refusal> {
+    refuse_with(refusal, Detail::default())
+}
+
+/// `refuse`, naming what the refusal is about.
+pub fn refuse_with(refusal: Refusal, detail: Detail) -> Result<(), Refusal> {
+    COLLECTED.with(|slot| match slot.borrow_mut().as_mut() {
+        Some(collected) => {
+            collected.push(Collected { refusal, detail });
+            Ok(())
+        }
+        None => Err(refusal),
+    })
+}
+
+/// Refuses every name in `names`. With a collector bound that is one refusal per name, each about
+/// its own argument, and the stage is left to `settle`; with none, one refusal naming them all,
+/// raised at once, as a real dispatch words it.
+pub fn refuse_each(names: &[&str], make: impl Fn(&[&str]) -> Refusal) -> Result<(), Refusal> {
+    let bound = COLLECTED.with(|slot| slot.borrow().is_some());
+    if !bound {
+        return Err(make(names));
+    }
+    for name in names {
+        refuse_with(make(&[name]), Detail::attribute(name))?;
+    }
+    Ok(())
+}
+
+/// How many refusals the collector holds; the mark a stage settles against.
+pub fn mark() -> usize {
+    COLLECTED.with(|slot| slot.borrow().as_ref().map_or(0, Vec::len))
+}
+
+/// Ends a stage: raises the first refusal it collected since `mark`, so the stage still fails
+/// after every one of its rules has been read.
+pub fn settle(mark: usize) -> Result<(), Refusal> {
+    COLLECTED.with(|slot| {
+        let collected = slot.borrow();
+        let first = collected.as_ref().and_then(|all| all.get(mark));
+        first.map_or(Ok(()), |kept| Err(kept.refusal.clone()))
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn given(text: &str) -> Refusal {
+        Refusal::GivenNotMet(text.into())
+    }
+
+    fn refusals(collected: &[Collected]) -> Vec<Refusal> {
+        collected.iter().map(|kept| kept.refusal.clone()).collect()
+    }
+
+    #[test]
+    fn without_a_collector_a_refusal_is_raised_at_once() {
+        assert_eq!(refuse(given("a")), Err(given("a")));
+        assert_eq!(settle(0), Ok(()));
+    }
+
+    #[test]
+    fn with_a_collector_a_stage_keeps_every_refusal_then_fails_on_the_first() {
+        let (stage, collected) = collecting(|| {
+            let start = mark();
+            refuse(given("a"))?;
+            refuse(given("b"))?;
+            settle(start)
+        });
+
+        assert_eq!(stage, Err(given("a")));
+        assert_eq!(refusals(&collected), vec![given("a"), given("b")]);
+    }
+
+    #[test]
+    fn a_collector_is_unbound_once_collecting_returns() {
+        collecting(|| ());
+
+        assert_eq!(
+            refuse(Refusal::Fault("x".into())),
+            Err(Refusal::Fault("x".into()))
+        );
+    }
+
+    #[test]
+    fn a_refusal_keeps_the_rule_or_attribute_it_was_about() {
+        let ((), collected) = collecting(|| {
+            let _ = refuse_with(given("a"), Detail::rule("the flow is positive"));
+            let _ = refuse_with(given("b"), Detail::attribute("amount"));
+        });
+
+        assert_eq!(
+            collected[0].detail.rule.as_deref(),
+            Some("the flow is positive")
+        );
+        assert_eq!(collected[1].detail.path.as_deref(), Some("/amount"));
+    }
+
+    #[test]
+    fn refusing_each_name_is_one_refusal_per_name_when_collecting_and_one_for_all_when_not() {
+        let make = |names: &[&str]| Refusal::AbsentArgument(names.join(","));
+
+        assert_eq!(
+            refuse_each(&["a", "b"], make),
+            Err(Refusal::AbsentArgument("a,b".into()))
+        );
+        let (outcome, collected) = collecting(|| refuse_each(&["a", "b"], make));
+        assert_eq!(outcome, Ok(()));
+        assert_eq!(
+            refusals(&collected),
+            vec![
+                Refusal::AbsentArgument("a".into()),
+                Refusal::AbsentArgument("b".into())
+            ]
+        );
+        assert_eq!(collected[1].detail.attribute.as_deref(), Some("b"));
+    }
+}

data/rust/src/kernel/dispatch.rs

@@ -1,6 +1,7 @@
 //! Generic dispatch loops over the declared `AggregateStep`/`EntityStep` order.
 //! Argument gates run in `decode_*_arguments`, before the router resolves identity.
 
+use super::collecting::{self, Detail};
 use super::expr::{
     interpret, EvalContext, Expr, Field, Fielded, NoFields, StateFirst, Value, WithOld, WithParent,
 };
@@ -49,22 +50,26 @@ pub fn enforce_invariants(
     aggregate_name: &str,
     set: &InvariantSet,
 ) -> Result<(), Refusal> {
+    let stage = collecting::mark();
     for rule in &set.aggregate {
         let ctx = EvalContext {
             args: &NoFields,
             instance: record,
         };
         if !interpret(&rule.expr, &ctx)?.truthy() {
-            return Err(Refusal::InvariantViolation(format!(
-                "{aggregate_name} refused — {}",
-                rule.description
-            )));
+            collecting::refuse_with(
+                Refusal::InvariantViolation(format!(
+                    "{aggregate_name} refused — {}",
+                    rule.description
+                )),
+                Detail::rule(rule.description),
+            )?;
         }
     }
     for entity in &set.entities {
         enforce_entity_invariants(record, entity)?;
     }
-    Ok(())
+    collecting::settle(stage)
 }
 
 fn enforce_entity_invariants(
@@ -88,10 +93,13 @@ fn enforce_entity_invariants(
                 instance: element,
             };
             if !interpret(&rule.expr, &ctx)?.truthy() {
-                return Err(Refusal::InvariantViolation(format!(
-                    "{} refused — {}",
-                    entity.name, rule.description
-                )));
+                collecting::refuse_with(
+                    Refusal::InvariantViolation(format!(
+                        "{} refused — {}",
+                        entity.name, rule.description
+                    )),
+                    Detail::rule(rule.description),
+                )?;
             }
         }
         for nested in &entity.nested {
@@ -348,6 +356,7 @@ fn enforce_givens(
     aggregate_qualified_name: &str,
     id: &str,
 ) -> Result<(), Refusal> {
+    let stage = collecting::mark();
     for given in givens {
         let ctx = EvalContext {
             args,
@@ -357,17 +366,21 @@ fn enforce_givens(
             // The `corrects` wording interpolates the record id, so it is built here.
             if let Some(event_name) = given.corrects_event {
                 // `NothingToCorrect`, not `GivenNotMet`: the conformance corpus compares kinds.
-                return Err(Refusal::NothingToCorrect(format!(
-                    "{command_name} refused — corrects {event_name}, but {aggregate_qualified_name} #{id} has never emitted it"
-                )));
+                collecting::refuse_with(
+                    Refusal::NothingToCorrect(format!(
+                        "{command_name} refused — corrects {event_name}, but {aggregate_qualified_name} #{id} has never emitted it"
+                    )),
+                    Detail::rule(given.description),
+                )?;
+                continue;
             }
-            return Err(Refusal::GivenNotMet(format!(
-                "{command_name} refused — {}",
-                given.description
-            )));
+            collecting::refuse_with(
+                Refusal::GivenNotMet(format!("{command_name} refused — {}", given.description)),
+                Detail::rule(given.description),
+            )?;
         }
     }
-    Ok(())
+    collecting::settle(stage)
 }
 
 /// `admissible_transition` — shared by the aggregate record and an entity
@@ -420,19 +433,20 @@ fn enforce_ensures(
         args: &state_first,
         old,
     };
+    let stage = collecting::mark();
     for rule in ensures {
         let ctx = EvalContext {
             args: &with_old,
             instance: settled,
         };
         if !interpret(&rule.expr, &ctx)?.truthy() {
-            return Err(Refusal::EnsuresNotMet(format!(
-                "{command_name} refused — {}",
-                rule.description
-            )));
+            collecting::refuse_with(
+                Refusal::EnsuresNotMet(format!("{command_name} refused — {}", rule.description)),
+                Detail::rule(rule.description),
+            )?;
         }
     }
-    Ok(())
+    collecting::settle(stage)
 }
 
 /// The write half of `save`: the repository write and its mutation record.
@@ -657,6 +671,7 @@ where
         } else {
             self.args
         };
+        let stage = collecting::mark();
         for given in self.givens {
             // Handled above; the `corrects` flag field lives on the parent, not the element.
             if given.corrects_event.is_some() {
@@ -667,13 +682,16 @@ where
                 instance: element,
             };
             if !interpret(&given.expr, &ctx)?.truthy() {
-                return Err(Refusal::GivenNotMet(format!(
-                    "{} refused — {}",
-                    self.command_name, given.description
-                )));
+                collecting::refuse_with(
+                    Refusal::GivenNotMet(format!(
+                        "{} refused — {}",
+                        self.command_name, given.description
+                    )),
+                    Detail::rule(given.description),
+                )?;
             }
         }
-        Ok(())
+        collecting::settle(stage)
     }
 
     fn apply_mutations(&mut self, record: &mut T) -> Result<(), Refusal> {
@@ -885,6 +903,7 @@ pub fn decode_aggregate_arguments<A>(
     gates: &ArgumentGates<'_, A>,
 ) -> Result<A, Refusal> {
     let mut args = None;
+    let stage = collecting::mark();
     for step in AggregateStep::ORDER {
         #[deny(clippy::wildcard_enum_match_arm)]
         let gate = match step {
@@ -907,6 +926,10 @@ pub fn decode_aggregate_arguments<A>(
             | AggregateStep::Emit => continue,
         };
         gates.run(gate, facts, &mut args)?;
+        // A dry run keeps every unknown and absent argument, then stops here; a real one raised.
+        if matches!(gate, ArgumentGate::RefuseAbsentArguments) {
+            collecting::settle(stage)?;
+        }
     }
     ordered(args, NORMALIZED)
 }
@@ -918,6 +941,7 @@ pub fn decode_entity_arguments<A>(
     gates: &ArgumentGates<'_, A>,
 ) -> Result<A, Refusal> {
     let mut args = None;
+    let stage = collecting::mark();
     for step in EntityStep::ORDER {
         #[deny(clippy::wildcard_enum_match_arm)]
         let gate = match step {
@@ -939,6 +963,10 @@ pub fn decode_entity_arguments<A>(
             | EntityStep::Emit => continue,
         };
         gates.run(gate, facts, &mut args)?;
+        // A dry run keeps every unknown and absent argument, then stops here; a real one raised.
+        if matches!(gate, ArgumentGate::RefuseAbsentArguments) {
+            collecting::settle(stage)?;
+        }
     }
     ordered(args, NORMALIZED)
 }