Let a State Carry What It Knows

Ari's identity check succeeds. The next stage needs the verified subject and the actual workshop that performed the check. A label saying “verified” is not enough if the caller can supply someone else afterward.

Design	What It Retains	What Can Go Wrong
A marker plus a later subject argument	Only a stage label	The later argument can replace the verified subject.
A private state carrying subject and workshop	This verified work and its resource	Progression can use the retained data without asking the caller to repeat it.

A state carrier is a value that holds the data and relationships needed by a stage. A zero-sized type holds no data. Both can be useful; their size is not the doctrine's goal.

Engineering Depth

An unsafe shape can leave the subject outside the verified state:

// Sketch of a weak contract: the caller supplies the subject again.
trait RecordWithCallerSubject {
    fn record(self, subject: String) -> Registered;
}

The reference instead retains the subject inside its protected carrier:

pub struct Verified<'a, P, E> {
    workshop: &'a mut Workshop<Google<P>, WithoutPassword, E>,
    subject: String,
}

The fields are private. The exclusive workshop borrow also prevents local code from swapping its resource while the stage exists. Admission and recording consume stages that retain those bindings.

Now compare a valid use of a data-free marker:

pub struct WithoutPassword;

It selects “do not collect a registration password.” It does not claim to carry a verified person's identity, a stored approval or current permission. Making this policy marker public does not make it an authorization proof.

Your Reflection

Can a later step accept any new argument, or must every method be argument-free?

Worked Discussion

New input is legitimate when the continuation needs it—for example, a source observation about the already-bound operation. It must not silently retarget the work. The guarantee concerns the relationship, not an argument-count rule.