Losses and refusals

The loss ledger records each known deviation from faithful output. Severities: substituted, degraded and dropped. An empty ledger claims full fidelity within the operation's declared scope.

result.ok === true means the operation completed under its options. It does not mean the result can be released. The default is lossPolicy: "collect", so ok: true can come with a non-empty loss ledger.

Caller options decide locally:

• collect returns the completed result and its losses;
• failOnDropped fails a result with a dropped loss;
• failOnAny fails a result with any loss.

A managed delivery policy sets its own release limit. Set maximumLossSeverity to:

• none to reject every loss;
• substituted to allow only substitution;
• degraded to allow substitution and degradation;
• dropped to allow every declared severity.

The worker applies the frozen managed policy after the operation completes. A caller cannot weaken that ceiling by sending a more permissive lossPolicy.

Refuse delivery when:

• the source is unsupported, corrupt, encrypted, stale, or ambiguous;
• a requested change is absent after reopening;
• protected content changed;
• a required verification stage is not pass;
• evidence belongs to different output bytes;
• a loss exceeds the bound policy;
• a target application or renderer was required but not run.

A refusal or not_checked result means the release requirement was not met. Do not infer release from ok alone.