EnrollmentCancelled takes (enrolment, reason, actor). The service dispatched
(enrolment, actor), so PHP put the User where the string reason was expected and
found no third argument. dispatch() constructs the event before the dispatcher
ever sees it, so this threw an ArgumentCountError on the line itself — inside
the service's own DB::transaction, which then rolled the whole cancellation
back.

Every cancellation on every tenant failed this way. The row stayed active, the
group count stayed high, and the nightly renewal run kept billing an enrolment
the desk believed it had ended. The only symptom was an error page, and being
ShouldDispatchAfterCommit made no difference — the object is built at dispatch,
not at commit.

Found while removing three test participants from a live tenant: the cleanup
could not cancel their enrolments.

Pinned by a test that cancels a real enrolment against a restored tenant and
asserts it reaches 'cancelled' — which is the whole proof, since a wrong
argument list cannot get that far. Event::fake is deliberately not used: it
would assert nothing here, because the event is correctly withheld until a
commit the test rolls back. A second test pins the event's parameter names so
the contract is caught even with no tenant to run against.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>