bxcore, brokerd, loopd: an invalid-arguments denial says why

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/brokerd/src/ledger/mod.rs

@@ -62,7 +62,8 @@ impl Call {
     }
 }
 
-/// How a call was decided.
+/// How a call was decided. A denial carries the policy's `Denial`, so an invalid call keeps its
+/// detail on the way to the answer.
 #[derive(Debug)]
 pub enum Decided {
     Allowed {
@@ -74,7 +75,7 @@ pub enum Decided {
         seq: u64,
         state: SessionState,
     },
-    Denied(DenyReason),
+    Denied(Denial),
 }
 
 /// The value a decided call carries past the record, or the denial reason when there is none.
@@ -210,7 +211,7 @@ impl Ledger {
         // 1. Lock fails → denied, nothing written.
         let mut guard = match self.lock() {
             Some(guard) => guard,
-            None => return Decided::Denied(DenyReason::AuditUnavailable),
+            None => return Decided::Denied(Denial::new(DenyReason::AuditUnavailable)),
         };
 
         // 2. Read the state, keeping the Result. The recorded state is "unknown" when unreadable.
@@ -281,16 +282,16 @@ impl Ledger {
         };
         match self.append(&mut guard, now, event) {
             Ok(seq) => match payload {
-                RecordPayload::Simple(reason) => Decided::Denied(reason),
+                RecordPayload::Simple(reason) => Decided::Denied(Denial::new(reason)),
                 RecordPayload::Allowed(decision) => Decided::Allowed { decision, seq },
                 RecordPayload::Ask(ask) => Decided::Ask {
                     ask,
                     seq,
                     state: recorded,
                 },
-                RecordPayload::Denial(denial) => Decided::Denied(denial.reason),
+                RecordPayload::Denial(denial) => Decided::Denied(denial),
             },
-            Err(()) => Decided::Denied(DenyReason::AuditUnavailable),
+            Err(()) => Decided::Denied(Denial::new(DenyReason::AuditUnavailable)),
         }
     }
 }