Reason codes

POLICY_DENIED — operation was rejected at the Admission Plane before any secret material was touched; never admitted into execution; not retryable without a policy change. PendingApproval — operation was admitted but is waiting for external confirmation (manual review, MFA, quorum approval); the caller should poll. STALE_EPOCH — the domain manifest epoch seen by the client does not match the current cluster epoch; refresh the manifest and retry. DISPLAY_BINDING_MISMATCH — the shown-and-approved digest does not match the request payload; terminal.

• POLICY_DENIED — Admission Plane rejection; no secret access; not retryable without policy change
• PendingApproval — admitted; awaiting external confirmation; poll for progress
• STALE_EPOCH — client epoch mismatch; refresh DomainManifest and retry
• DISPLAY_BINDING_MISMATCH — displayed intent does not match request digest; terminal

STEP_PERMIT_EXPIRED — the step permit was issued but the operation did not advance before the deadline; the session may be recoverable by re-entering from the last committed step via recover_step. STEP_PERMIT_REUSED — the same permit was presented twice, indicating a replay or crash-recovery anomaly; the session closes and this is monitored as a critical alert metric. KERNEL_CONTEXT_MISMATCH — the step permit does not match the active node, epoch, key, session, phase, or slot; the kernel refused before touching secret material.

• STEP_PERMIT_EXPIRED — permit timed out; recover_step may re-enter from last commit
• STEP_PERMIT_REUSED — replay or crash-recovery anomaly; session closes; critical alert metric
• KERNEL_CONTEXT_MISMATCH — permit context check failed; kernel refused before secret access
• KERNEL_POLICY_REFUSED — local kernel check failed independently of the Admission Plane

JOURNAL_CONFLICT — the outer runtime journal, the secret kernel journal, and the local session descriptors carry different hash descriptors for the same step key; the session closes to Poisoned with a PoisonedSessionWitness; terminal and not retryable. REMOTE_TIMEOUT — a required peer fact did not arrive before the deadline; the session closes to Aborted with timeout evidence naming the active site and missing dependencies.

EQUIVOCATION_DETECTED — a sender delivered conflicting messages for the same slot; the session closes to Aborted with equivocation evidence recording both message versions and the sender identity. INGRESS_REJECTED — an inbound peer message failed admission (binding, roster, replay, or signature check); it is dropped and does not become a DVM fact.

• JOURNAL_CONFLICT — hash divergence across journals; session Poisoned; PoisonedSessionWitness; terminal
• REMOTE_TIMEOUT — peer fact deadline exceeded; session Aborted with timeout evidence
• EQUIVOCATION_DETECTED — conflicting messages from same sender; Aborted with equivocation evidence
• INGRESS_REJECTED — admission gate failure; frame dropped; no DVM fact created

PUBLICATION_DENIED — the local_private result exists but PublishGate refused to disclose it. The computation succeeded; the disclosure policy did not permit release. This is a legitimate terminal state from the cryptographic perspective. The denial reason references a policy control (manual hold, compliance check, rate limit) rather than a protocol failure.

CUSTOMER_REVIEW_HOLD (user-defined) — a customer-defined hook or policy rule held the PublishGate call; the result is local_private and pending release. The hold can be cleared through the policy plane without repeating the MPC computation. EXTERNAL_EXPORT_REJECTED — ExternalExportGate refused a binding request due to an unknown receipt, context mismatch, or state regression.

• PUBLICATION_DENIED — gate refused disclosure; result stays local_private; policy-terminal
• CUSTOMER_REVIEW_HOLD — policy-set hold; computation done; pending policy release
• EXTERNAL_EXPORT_REJECTED — external gate refused (unknown receipt, context mismatch, state regression)

Terminal states are final: Aborted (peer timeout or equivocation), Poisoned (journal conflict), Failed (backend failure at a secret step). Non-terminal states allow idempotent replay via recover_step(k, d): PendingApproval, PendingRemote, Rotating, Degraded, Recovered. recover_step has three outcomes — committed effect returned when k is committed and d matches; step executed and committed when k is pending; session closed to Poisoned when k is committed but d conflicts.

The error-codes and recovery sections are complementary: this section maps codes to boundaries and retry eligibility; the recovery section explains how the secret kernel stores state across crashes and how recover_step re-enters the sequence after any restart.

• Aborted — terminal; timeout or equivocation; evidence always present
• Poisoned — terminal; journal conflict; PoisonedSessionWitness present
• Failed — terminal; backend failure at secret step; evidence present
• Recovered — non-terminal; operation resumed after partial failure; retry eligible