VisibilityUnboundTabledisclosure.mirror.unbound-tableOn an organization-wide face, a table with no visibility block raises VisibilityUnboundTable from diagnose and from the serving guardrail at start, naming the table. | A table on an organization-wide face carries no visibility block. | disclosure.mirror.unbound-tabledisclosure.mirror.unbound-tableOn an organization-wide face, a table with no visibility block raises VisibilityUnboundTable from diagnose and from the serving guardrail at start, naming the table. |
VisibilityBindingIncompletedisclosure.mirror.incomplete-bindingA binding at a servable level lacking a declared sweep for its source or a max_acl_staleness raises VisibilityBindingIncomplete. | A servable binding lacks a declared sweep or a staleness budget. | disclosure.mirror.incomplete-bindingdisclosure.mirror.incomplete-bindingA binding at a servable level lacking a declared sweep for its source or a max_acl_staleness raises VisibilityBindingIncomplete. |
VisibilityWatermarkUncovereddisclosure.sweep.coverage-watermarkA sweep run that failed or skipped any governed resource of its source and advances watermark_at raises VisibilityWatermarkUncovered, and the watermark stays where it stood. | A sweep run that missed a governed resource advanced the watermark. | disclosure.sweep.coverage-watermarkdisclosure.sweep.coverage-watermarkA sweep run that failed or skipped any governed resource of its source and advances watermark_at raises VisibilityWatermarkUncovered, and the watermark stays where it stood. |
VisibilityUngappedStreamdisclosure.sweep.ungapped-streamAdvancing watermark_at from an event stream the mapping has not declared gap-detectable raises VisibilityUngappedStream. | The watermark advanced from an event stream not declared gap-detectable. | disclosure.sweep.ungapped-streamdisclosure.sweep.ungapped-streamAdvancing watermark_at from an event stream the mapping has not declared gap-detectable raises VisibilityUngappedStream. |
VisibilityOrphanGrantdisclosure.sweep.orphan-grantA grant landing with no resource row, or on a resource of the unknown class, raises VisibilityOrphanGrant at commit and joins no reachable set. | A grant landed with no resource row, or on an unknown-class resource. | disclosure.sweep.orphan-grantdisclosure.sweep.orphan-grantA grant landing with no resource row, or on a resource of the unknown class, raises VisibilityOrphanGrant at commit and joins no reachable set. |
VisibilityClosureDepthdisclosure.reach.closure-overflowA closure reaching its depth or node bound raises VisibilityClosureDepth with the non-retryable HTTP status 422 and returns no set. | The group closure reached its depth or node bound; no set is returned. | disclosure.reach.closure-overflowdisclosure.reach.closure-overflowA closure reaching its depth or node bound raises VisibilityClosureDepth with the non-retryable HTTP status 422 and returns no set. |
VisibilityDegradedCacheddisclosure.reach.degraded-uncachedRetaining a reachable set or result produced past a budget, or under the narrowing posture, raises VisibilityDegradedCached. | A result produced past a budget or under the narrowing posture was retained. | disclosure.reach.degraded-uncacheddisclosure.reach.degraded-uncachedRetaining a reachable set or result produced past a budget, or under the narrowing posture, raises VisibilityDegradedCached. |
VisibilityBudgetMalformeddisclosure.bound-staleness.budget-grammarmax_acl_staleness is a positive integer with one suffix from s, m, h, d. A compound form, a bare number or another suffix raises VisibilityBudgetMalformed, naming the table and the text read. | A staleness budget is compound, bare, or carries an unknown suffix. | disclosure.bound-staleness.budget-grammardisclosure.bound-staleness.budget-grammarmax_acl_staleness is a positive integer with one suffix from s, m, h, d. A compound form, a bare number or another suffix raises VisibilityBudgetMalformed, naming the table and the text read. |
VisibilityAccessStaledisclosure.bound-staleness.access-staleA read raises VisibilityAccessStale (HTTP 503, carrying source, lag, budget and last observation) when a touched table's source lag exceeds its budget, the source has no completed full run, or the public-status watermark is past budget. | Source lag exceeds a touched table’s budget, or the source was never fully swept. | disclosure.bound-staleness.access-staledisclosure.bound-staleness.access-staleA read raises VisibilityAccessStale (HTTP 503, carrying source, lag, budget and last observation) when a touched table's source lag exceeds its budget, the source has no completed full run, or the public-status watermark is past budget. |
VisibilityBudgetUnreachabledisclosure.bound-staleness.budget-below-cadenceA budget tighter than the sweep cadence its source sustains raises VisibilityBudgetUnreachable at diagnose, naming both figures. | A budget is tighter than the sweep cadence its source sustains. | disclosure.bound-staleness.budget-below-cadencedisclosure.bound-staleness.budget-below-cadenceA budget tighter than the sweep cadence its source sustains raises VisibilityBudgetUnreachable at diagnose, naming both figures. |
VisibilityFamilyBounddisclosure.declare-fidelity.family-boundA person-container table at a servable level, or a directory table above excluded, raises VisibilityFamilyBound, and the manifest declaring it does not load. | A table declared a level its source family does not permit. | disclosure.declare-fidelity.family-bounddisclosure.declare-fidelity.family-boundA person-container table at a servable level, or a directory table above excluded, raises VisibilityFamilyBound, and the manifest declaring it does not load. |
VisibilityFamilyUndeclareddisclosure.declare-fidelity.family-undeclaredA mapping landing a table without naming its family raises VisibilityFamilyUndeclared. | A mapping landed a table without naming its family. | disclosure.declare-fidelity.family-undeclareddisclosure.declare-fidelity.family-undeclaredA mapping landing a table without naming its family raises VisibilityFamilyUndeclared. |
VisibilityFederatedRegistereddisclosure.declare-fidelity.federated-registeredRegistering a federated table on a read face raises VisibilityFederatedRegistered. | A federated table was registered on a read face. | disclosure.declare-fidelity.federated-registereddisclosure.declare-fidelity.federated-registeredRegistering a federated table on a read face raises VisibilityFederatedRegistered. |
VisibilityMappingAbsentdisclosure.pack.mapping-absentA pack landing a table with neither an access mapping nor excluded raises VisibilityMappingAbsent at diagnose, naming the pack and the table. | A pack landed a table with neither a mapping nor an exclusion. | disclosure.pack.mapping-absentdisclosure.pack.mapping-absentA pack landing a table with neither an access mapping nor excluded raises VisibilityMappingAbsent at diagnose, naming the pack and the table. |
VisibilityPackAssertsAccessdisclosure.pack.asserts-accessAn access-shaped key the mapping schema does not define raises VisibilityPackAssertsAccess by name. Fields outside the mapping are fetch inputs and reach no authorization decision. | A pack carries an access-shaped key the mapping schema lacks. | disclosure.pack.asserts-accessdisclosure.pack.asserts-accessAn access-shaped key the mapping schema does not define raises VisibilityPackAssertsAccess by name. Fields outside the mapping are fetch inputs and reach no authorization decision. |
VisibilityAllowlistAnyOfdisclosure.pack.any-of-allowlistAn allowlist evaluated as any-of raises VisibilityAllowlistAnyOf at load. | A container allowlist is evaluated as any-of. | disclosure.pack.any-of-allowlistdisclosure.pack.any-of-allowlistAn allowlist evaluated as any-of raises VisibilityAllowlistAnyOf at load. |
VisibilityUnsupportedCoarsedisclosure.pack.unsupported-coarseDeclaring coarse where the source emits no container or workspace signal raises VisibilityUnsupportedCoarse. | A table declared coarse where its source emits no container signal. | disclosure.pack.unsupported-coarsedisclosure.pack.unsupported-coarseDeclaring coarse where the source emits no container or workspace signal raises VisibilityUnsupportedCoarse. |
DisclosurePolicyAbsentdisclosure.set-mode.policy-absentA published model matching aggregate-shape and carrying neither a disclosure policy nor a recorded opt-out fails the diagnostic with DisclosurePolicyAbsent. | A published aggregate-shaped model carries no policy and no opt-out. | disclosure.set-mode.policy-absentdisclosure.set-mode.policy-absentA published model matching aggregate-shape and carrying neither a disclosure policy nor a recorded opt-out fails the diagnostic with DisclosurePolicyAbsent. |
DisclosureModelUnreadabledisclosure.set-mode.model-unreadableA published model whose sql_file under statement-source does not read raises DisclosureModelUnreadable. | A published model’s statement text does not read. | disclosure.set-mode.model-unreadabledisclosure.set-mode.model-unreadableA published model whose sql_file under statement-source does not read raises DisclosureModelUnreadable. |
DisclosureCleanRoomPreconditionUnmetdisclosure.set-mode.clean-room-preconditionsA cross-owner store carries per-owner signed manifest subtrees, per-owner write prefixes enforced by the object store's access policy, and per-owner signing keys; one missing, checked before any cross-prefix write, raises DisclosureCleanRoomPreconditionUnmet. | A shared store lacks a clean-room requirement. | disclosure.set-mode.clean-room-preconditionsdisclosure.set-mode.clean-room-preconditionsA cross-owner store carries per-owner signed manifest subtrees, per-owner write prefixes enforced by the object store's access policy, and per-owner signing keys; one missing, checked before any cross-prefix write, raises DisclosureCleanRoomPreconditionUnmet. |
DisclosureStaticPepperdisclosure.set-mode.hashed-joinTwo owners match on a key each hashes at write time under a per-pair pepper re-randomized per join; matched rows leave as an aggregate under a group-size floor. A static pepper raises DisclosureStaticPepper. | A cross-owner hashed join is keyed on a static pepper. | disclosure.set-mode.hashed-joindisclosure.set-mode.hashed-joinTwo owners match on a key each hashes at write time under a per-pair pepper re-randomized per join; matched rows leave as an aggregate under a group-size floor. A static pepper raises DisclosureStaticPepper. |
DisclosureReleaseRequireddisclosure.release.governed-buildA build of a model declaring [model.disclosure] outside release-verb raises DisclosureReleaseRequired and publishes nothing. | A model declaring a disclosure policy is built outside a release. | disclosure.release.governed-builddisclosure.release.governed-buildA build of a model declaring [model.disclosure] outside release-verb raises DisclosureReleaseRequired and publishes nothing. |
DisclosureUnitBudgetExhausteddisclosure.release.budget-reservationBefore computing, a release reserves each contributing unit's declared per-run spend against its lifetime cap in one catalog transaction. A failed reservation raises DisclosureUnitBudgetExhausted, and the release publishes nothing. | A contributing unit’s budget reservation failed; nothing is published. | disclosure.release.budget-reservationdisclosure.release.budget-reservationBefore computing, a release reserves each contributing unit's declared per-run spend against its lifetime cap in one catalog transaction. A failed reservation raises DisclosureUnitBudgetExhausted, and the release publishes nothing. |
DisclosureMetricBoundsAbsentdisclosure.release.metric-boundsA noised sum folds each contributor to one value, clips that total to declared finite bounds and rounds it to a positive quantum; absent bounds or quantum raise DisclosureMetricBoundsAbsent. | A noised sum has no finite contributor bounds or positive quantum. | disclosure.release.metric-boundsdisclosure.release.metric-boundsA noised sum folds each contributor to one value, clips that total to declared finite bounds and rounds it to a positive quantum; absent bounds or quantum raise DisclosureMetricBoundsAbsent. |
DisclosureLookalikeUnsupporteddisclosure.release.lookalike-refusalA release requesting an activation handle or lookalike segment, as --output activation-handle or --output lookalike-segment, raises DisclosureLookalikeUnsupported and publishes nothing. | A release requests an activation handle or lookalike segment. | disclosure.release.lookalike-refusaldisclosure.release.lookalike-refusalA release requesting an activation handle or lookalike segment, as --output activation-handle or --output lookalike-segment, raises DisclosureLookalikeUnsupported and publishes nothing. |
DisclosureSpendUndeclareddisclosure.release.spend-declaration[model.disclosure] declares per_run_spend, the positive epsilon one release reserves from each contributing unit; a release whose policy declares none raises DisclosureSpendUndeclared and publishes nothing. | A released model’s policy declares no positive per-run spend. | disclosure.release.spend-declarationdisclosure.release.spend-declaration[model.disclosure] declares per_run_spend, the positive epsilon one release reserves from each contributing unit; a release whose policy declares none raises DisclosureSpendUndeclared and publishes nothing. |
DisclosureDuplicateGraindisclosure.release.duplicate-grainA non-numeric, non-grain column rides the grouping, and one not constant within its group raises DisclosureDuplicateGrain. | A carried non-grain column is not constant within its group. | disclosure.release.duplicate-graindisclosure.release.duplicate-grainA non-numeric, non-grain column rides the grouping, and one not constant within its group raises DisclosureDuplicateGrain. |
DisclosureGroupKeyNotPermitteddisclosure.release.group-keyA group key not a subset of the permitted grouping columns raises DisclosureGroupKeyNotPermitted. | A group key is not a subset of the permitted grouping columns. | disclosure.release.group-keydisclosure.release.group-keyA group key not a subset of the permitted grouping columns raises DisclosureGroupKeyNotPermitted. |
DisclosureContributorKeyAbsentdisclosure.release.contributor-keyA governed statement omitting the contributor key raises DisclosureContributorKeyAbsent. | A governed statement omits the contributor key. | disclosure.release.contributor-keydisclosure.release.contributor-keyA governed statement omitting the contributor key raises DisclosureContributorKeyAbsent. |
DisclosureForbiddenColumnPublisheddisclosure.release.forbidden-columnA contract declaring a forbidden column, or a materialization producing one, raises DisclosureForbiddenColumnPublished. The check runs after the contributor key leaves the published columns. | A contract declares, or a materialization produces, a forbidden column. | disclosure.release.forbidden-columndisclosure.release.forbidden-columnA contract declaring a forbidden column, or a materialization producing one, raises DisclosureForbiddenColumnPublished. The check runs after the contributor key leaves the published columns. |
DisclosureMinGroupSizeBelowFloordisclosure.suppress.min-group-sizemin_group_size counts distinct contributors and is at least 2 subjects. A group whose noised distinct-contributor count falls under it is suppressed, and a smaller declared value raises DisclosureMinGroupSizeBelowFloor. | A declared min_group_size is below the floor. | disclosure.suppress.min-group-sizedisclosure.suppress.min-group-sizemin_group_size counts distinct contributors and is at least 2 subjects. A group whose noised distinct-contributor count falls under it is suppressed, and a smaller declared value raises DisclosureMinGroupSizeBelowFloor. |
DisclosureShareOutOfRangedisclosure.suppress.contributor-sharemax_contributor_share lies above 0 percent and at most 100 percent of a group's sign-insensitive metric mass; a value outside raises DisclosureShareOutOfRange. | A declared max_contributor_share lies outside (0, 1]. | disclosure.suppress.contributor-sharedisclosure.suppress.contributor-sharemax_contributor_share lies above 0 percent and at most 100 percent of a group's sign-insensitive metric mass; a value outside raises DisclosureShareOutOfRange. |
DisclosureDominanceUnverifiabledisclosure.suppress.dominance-unverifiableA group under a share constraint whose per-contributor masses are unavailable raises DisclosureDominanceUnverifiable and is suppressed. | Per-contributor masses are unavailable where a share constraint applies. | disclosure.suppress.dominance-unverifiabledisclosure.suppress.dominance-unverifiableA group under a share constraint whose per-contributor masses are unavailable raises DisclosureDominanceUnverifiable and is suppressed. |
DisclosurePolicySuppressesNothingdisclosure.suppress.empty-policyA policy setting neither threshold, or only a share ceiling at a whole group's mass, raises DisclosurePolicySuppressesNothing. | A policy sets neither threshold. | disclosure.suppress.empty-policydisclosure.suppress.empty-policyA policy setting neither threshold, or only a share ceiling at a whole group's mass, raises DisclosurePolicySuppressesNothing. |
DisclosureGroupingAllowlistEmptydisclosure.suppress.grouping-allowlistAn empty permitted-grouping list, or a permitted name that is not column-shaped, raises DisclosureGroupingAllowlistEmpty. | A grouping allowlist is empty or names a non-column. | disclosure.suppress.grouping-allowlistdisclosure.suppress.grouping-allowlistAn empty permitted-grouping list, or a permitted name that is not column-shaped, raises DisclosureGroupingAllowlistEmpty. |
DisclosureTemplateMultiStatementdisclosure.template.single-statementA declaration holding more than one statement raises DisclosureTemplateMultiStatement. | A template declaration holds more than one statement. | disclosure.template.single-statementdisclosure.template.single-statementA declaration holding more than one statement raises DisclosureTemplateMultiStatement. |
DisclosureCohortWideningdisclosure.bound-cohort.cohort-wideningA template or statement read grouping a cohort model's published table by a strict subset of the group key its release records raises DisclosureCohortWidening; grouping by the whole key or a superset of it reads. | A read grouped a cohort table by a strict subset of its group key. | disclosure.bound-cohort.cohort-wideningdisclosure.bound-cohort.cohort-wideningA template or statement read grouping a cohort model's published table by a strict subset of the group key its release records raises DisclosureCohortWidening; grouping by the whole key or a superset of it reads. |
DisclosurePerIndividualUngranteddisclosure.bound-cohort.per-individual-rowA query, template, retrieve, row, subscribe or recall read touching a per-individual table raises DisclosurePerIndividualUngranted unless a grant holds read-individual over that table; a derive task's input read is a row read. | A read touched a cohort model’s source table without read-individual. | disclosure.bound-cohort.per-individual-rowdisclosure.bound-cohort.per-individual-rowA query, template, retrieve, row, subscribe or recall read touching a per-individual table raises DisclosurePerIndividualUngranted unless a grant holds read-individual over that table; a derive task's input read is a row read. |
DisclosureSingletonCohortdisclosure.bound-cohort.singleton-cohortA cohort model whose permitted grouping columns or non-contributor grain columns name its contributor key or a forbidden column raises DisclosureSingletonCohort at declaration, before any row lands under it. | A cohort key’s grain resolves to one person. | disclosure.bound-cohort.singleton-cohortdisclosure.bound-cohort.singleton-cohortA cohort model whose permitted grouping columns or non-contributor grain columns name its contributor key or a forbidden column raises DisclosureSingletonCohort at declaration, before any row lands under it. |
DisclosureExactPerPersondisclosure.bound-cohort.exact-figuresA policy declaring figures = "exact" on a per-person table raises DisclosureExactPerPerson. figures defaults to "noised", and exact figures publish only from a cohort table. | A per-person table declares exact figures. | disclosure.bound-cohort.exact-figuresdisclosure.bound-cohort.exact-figuresA policy declaring figures = "exact" on a per-person table raises DisclosureExactPerPerson. figures defaults to "noised", and exact figures publish only from a cohort table. |
AuditHeaderUnsupporteddisclosure.record.header-unsupportedOpening or verifying a chain whose header names another format or digest, a segment size outside chain-header, or any field beyond ChainHeader raises AuditHeaderUnsupported. | A chain header names a format, digest or segment size this build does not verify. | disclosure.record.header-unsupporteddisclosure.record.header-unsupportedOpening or verifying a chain whose header names another format or digest, a segment size outside chain-header, or any field beyond ChainHeader raises AuditHeaderUnsupported. |
AuditAttributeInexactdisclosure.record.inexact-integerAppending a v1 entry whose attributes hold an integer beyond ±(2^53 − 1) raises AuditAttributeInexact and appends nothing; verifying a chain holding such an entry raises broken-chain. | A v1 entry’s attribute holds an integer the canonical form cannot write exactly. | disclosure.record.inexact-integerdisclosure.record.inexact-integerAppending a v1 entry whose attributes hold an integer beyond ±(2^53 − 1) raises AuditAttributeInexact and appends nothing; verifying a chain holding such an entry raises broken-chain. |
AuditEntryUnpersisteddisclosure.record.unpersisted-entryA read whose entry fails to reach local durable storage raises AuditEntryUnpersisted and returns no rows. | A read’s audit entry did not persist; no rows are returned. | disclosure.record.unpersisted-entrydisclosure.record.unpersisted-entryA read whose entry fails to reach local durable storage raises AuditEntryUnpersisted and returns no rows. |
AuditLogReadOnlydisclosure.record.read-onlyA read-only audit handle verifies the chain without the writer lock; an append through it raises AuditLogReadOnly. | An append through a read-only audit handle. | disclosure.record.read-onlydisclosure.record.read-onlyA read-only audit handle verifies the chain without the writer lock; an append through it raises AuditLogReadOnly. |
AuditLogAnchoreddisclosure.record.unanchored-over-signedAn unanchored handle links entries under an unsigned tip and writes no root; opening one over a signed tip, a signed root or the signed chain.held a held open writes raises AuditLogAnchored. | An unanchored handle opened over a chain holding a signed tip, a signed root or a held record. | disclosure.record.unanchored-over-signeddisclosure.record.unanchored-over-signedAn unanchored handle links entries under an unsigned tip and writes no root; opening one over a signed tip, a signed root or the signed chain.held a held open writes raises AuditLogAnchored. |
AuditLogUnanchoreddisclosure.record.unsigned-tipA held open or signed check over a chain carrying no chain.held or signed root, whose tip is unsigned, raises AuditLogUnanchored; anchoring through the signing port signs that chain's missing roots and its tip. | A held open or signed check over a chain whose tip is unsigned, carrying no held record or signed root. | disclosure.record.unsigned-tipdisclosure.record.unsigned-tipA held open or signed check over a chain carrying no chain.held or signed root, whose tip is unsigned, raises AuditLogUnanchored; anchoring through the signing port signs that chain's missing roots and its tip. |
VisibilityDiagnosticRowdisclosure.explain.no-rowAn explanation returning a row, field value or excerpt from the resource it decides about, a replayed contextful.result. attribute beyond contextful.result.rows included, raises VisibilityDiagnosticRow. | An explanation returned content from the resource it decides about. | disclosure.explain.no-rowdisclosure.explain.no-rowAn explanation returning a row, field value or excerpt from the resource it decides about, a replayed contextful.result. attribute beyond contextful.result.rows included, raises VisibilityDiagnosticRow. |
VisibilityNoObservationsdisclosure.explain.empty-windowA window holding no observations raises VisibilityNoObservations and states that no claim is available. | A replay window holds no observations; no claim is available. | disclosure.explain.empty-windowdisclosure.explain.empty-windowA window holding no observations raises VisibilityNoObservations and states that no claim is available. |
VisibilityUnqualifiedAssurancedisclosure.explain.unqualified-assuranceA negative assurance answer emitted without its coverage block raises VisibilityUnqualifiedAssurance. | A negative assurance answer lacks its coverage block. | disclosure.explain.unqualified-assurancedisclosure.explain.unqualified-assuranceA negative assurance answer emitted without its coverage block raises VisibilityUnqualifiedAssurance. |
VisibilityIndividualNameddisclosure.explain.groups-not-membersA reader-facing explanation rendering the member identities of a group on the path raises VisibilityIndividualNamed. | An explanation rendered the members of a group on the path. | disclosure.explain.groups-not-membersdisclosure.explain.groups-not-membersA reader-facing explanation rendering the member identities of a group on the path raises VisibilityIndividualNamed. |
AuditChainBrokendisclosure.attest.broken-chainA disagreeing digest, entry format or Merkle root, a sequence gap, a failing signature, or, beside chain.tip, chain.held or a signed root, an absent chain or a missing or unsigned tip raises AuditChainBroken at the earliest failing index. | A digest, format or Merkle root mismatch, sequence gap or vanished chain, with the earliest failing index. | disclosure.attest.broken-chaindisclosure.attest.broken-chainA disagreeing digest, entry format or Merkle root, a sequence gap, a failing signature, or, beside chain.tip, chain.held or a signed root, an absent chain or a missing or unsigned tip raises AuditChainBroken at the earliest failing index. |
AuditProofInvaliddisclosure.attest.proof-invalidA proof whose entry, audit path, header, root or root signature disagrees raises AuditProofInvalid. | An inclusion proof’s entry, path, header, root or signature disagrees. | disclosure.attest.proof-invaliddisclosure.attest.proof-invalidA proof whose entry, audit path, header, root or root signature disagrees raises AuditProofInvalid. |
AuditProofUnavailabledisclosure.attest.proof-unavailableProving an entry of a v0 chain, of a segment carrying no signed root, or outside the chain raises AuditProofUnavailable. | No signed Merkle root covers the entry to prove. | disclosure.attest.proof-unavailabledisclosure.attest.proof-unavailableProving an entry of a v0 chain, of a segment carrying no signed root, or outside the chain raises AuditProofUnavailable. |
AuditRequiresOwnerdisclosure.attest.owner-onlyAn audit verb reading a chain, presented with a capability credential, raises AuditRequiresOwner before it reads an audit file. | An audit verb reading a chain was presented a capability credential. | disclosure.attest.owner-onlydisclosure.attest.owner-onlyAn audit verb reading a chain, presented with a capability credential, raises AuditRequiresOwner before it reads an audit file. |
ErasureUngranteddisclosure.erase.privilegeErasure sits outside the default grant set, and a caller without the forget grant raises ErasureUngranted. | A caller erased without the forget grant. | disclosure.erase.privilegedisclosure.erase.privilegeErasure sits outside the default grant set, and a caller without the forget grant raises ErasureUngranted. |
ErasureScopeUnsupporteddisclosure.erase.unsupported-scopeAn empty target set or erasure admitted only by narrowed grants raises ErasureScopeUnsupported before store access; supported erasure admits every requested table explicitly. | The request has no targets or requires an unsupported narrowed Forget scope. | disclosure.erase.unsupported-scopedisclosure.erase.unsupported-scopeAn empty target set or erasure admitted only by narrowed grants raises ErasureScopeUnsupported before store access; supported erasure admits every requested table explicitly. |
ErasureSubjectUndeclareddisclosure.erase.subject-columnA table names its subject column as subject_id = "<column>" under [[pipeline.tables]]. A subject erasure against a table without one raises ErasureSubjectUndeclared, naming the table. | A subject erasure names a table with no subject column. | disclosure.erase.subject-columndisclosure.erase.subject-columnA table names its subject column as subject_id = "<column>" under [[pipeline.tables]]. A subject erasure against a table without one raises ErasureSubjectUndeclared, naming the table. |
ErasureTransactionIncompletedisclosure.erase.recoveryRecovery completes collection for a committed frontier and discards uncommitted replacements; an incomplete or disagreeing transaction record raises ErasureTransactionIncomplete before releasing store content. | An erasure transaction record cannot select a complete authenticated frontier. | disclosure.erase.recoverydisclosure.erase.recoveryRecovery completes collection for a committed frontier and discards uncommitted replacements; an incomplete or disagreeing transaction record raises ErasureTransactionIncomplete before releasing store content. |
ErasureCascadeUnboundeddisclosure.erase.cascade-unboundedA provenance chain deeper than the cascade bound raises ErasureCascadeUnbounded, and the erasure commits nothing. | A provenance chain exceeds the cascade bound; nothing commits. | disclosure.erase.cascade-unboundeddisclosure.erase.cascade-unboundedA provenance chain deeper than the cascade bound raises ErasureCascadeUnbounded, and the erasure commits nothing. |
PurgeTenantColumnTypedisclosure.erase.tenant-column-typeA tenant column of a non-string type raises PurgeTenantColumnType. | The tenant column is not a string type. | disclosure.erase.tenant-column-typedisclosure.erase.tenant-column-typeA tenant column of a non-string type raises PurgeTenantColumnType. |
PurgeTenantUndeclareddisclosure.erase.tenant-undeclaredA purge finding no model declaring an outermost partition key raises PurgeTenantUndeclared. | No model declares an outermost partition key. | disclosure.erase.tenant-undeclareddisclosure.erase.tenant-undeclaredA purge finding no model declaring an outermost partition key raises PurgeTenantUndeclared. |
PurgeRequiresOwnerdisclosure.erase.owner-onlyA purge presented with a capability token raises PurgeRequiresOwner, evaluated before anything reveals store contents. | A purge was presented with a capability token. | disclosure.erase.owner-onlydisclosure.erase.owner-onlyA purge presented with a capability token raises PurgeRequiresOwner, evaluated before anything reveals store contents. |
ReceiptIdentifierLeakdisclosure.receipt.pseudonymtenant_hash is SHA-256 over a random per-receipt salt and the tenant identifier. A receipt carrying the identifier in cleartext raises ReceiptIdentifierLeak before signing. | A receipt carries a tenant identifier in cleartext. | disclosure.receipt.pseudonymdisclosure.receipt.pseudonymtenant_hash is SHA-256 over a random per-receipt salt and the tenant identifier. A receipt carrying the identifier in cleartext raises ReceiptIdentifierLeak before signing. |
ReceiptClaimWideneddisclosure.receipt.widened-claimA coverage block naming a scope broader than its receipt_version declares raises ReceiptClaimWidened. | A coverage block exceeds its receipt version. | disclosure.receipt.widened-claimdisclosure.receipt.widened-claimA coverage block naming a scope broader than its receipt_version declares raises ReceiptClaimWidened. |
ReceiptReplayeddisclosure.receipt.replayedReturning the byte-identical earlier artifact in place of a freshly signed one raises ReceiptReplayed. | An earlier artifact was returned in place of a fresh signature. | disclosure.receipt.replayeddisclosure.receipt.replayedReturning the byte-identical earlier artifact in place of a freshly signed one raises ReceiptReplayed. |