Refusal rules

Every reason this service will decline to write to one of your systems. Each rule has a code, a scope and a stated reason, so a refusal is a result you can branch on rather than a line in a log.

Refusal engine version 1.

Rules that stop the whole run

Code	What it protects you from	Can be switched off
`source_empty` A source returned no records	Every record on the other side looks missing. Far more often a bad minute at an API than a real decision to delete everything you sell.	always on
`source_population_collapsed` A source returned far fewer records than last time	A partial response, a filter that silently applied, or a paginated read that stopped early. The records that vanished are not gone; they were simply not returned.	optional
`source_stale` A source reported data older than it should be	Acting on a stale snapshot means correcting the present to match the past, which can be worse than leaving the disagreement alone.	optional
`duplicate_identifiers` A source returned the same identifier twice	Records cannot be matched reliably, so every conclusion drawn from the match is unsound.	always on
`too_few_records` Too few records to conclude anything	Small samples make ordinary variation look like systemic disagreement.	optional
`divergence_too_wide` More of the data disagrees than the check allows	Wide disagreement usually means a source changed shape or failed, not that the world moved. Repairing on that basis multiplies the damage.	optional
`too_many_repairs` More repairs than the per-run limit	A ceiling on how much can change in one pass, whatever the reason.	optional
`no_repairs_configured` This check only watches	Nothing is repaired because nothing was configured to be repaired.	always on

Rules that stop one write

Code	What it protects you from	Can be switched off
`destructive_not_permitted` A destructive repair without explicit permission	Deleting is the one repair that cannot be undone by repeating it differently. It requires saying so on the check, not merely on the action.	always on
`target_changed_since_read` The target changed between reading and writing	Somebody or something else has touched the record since we compared it. Writing now would overwrite a change we never saw.	optional
`non_idempotent_retry` A retry of a repair that is not safe to repeat	A timeout is ambiguous: the write may well have landed. Repeating a non-idempotent repair could apply it twice.	always on

The rules marked no cannot be switched off on any check, at any price. A service that will empty your catalogue if you ask it nicely enough is not meaningfully safer than the cron script it replaces. Turning off one configurable rule does not weaken the others: the next guard along still refuses, with its own code.

The same list, for machines

GET /api/v1/rules returns this registry as JSON, unauthenticated. It is the source this page renders, so the two cannot disagree.

curl https://YOUR-HOST/api/v1/rules