Documentation

How a refusal failed to attribute.

Whose refusal is being attributed: a refusal ROW's receipt IS the row outcome and is written; a refused CONTROL's outcome is run-log evidence under its own identity and must never overwrite the row's receipt.

What the traced replay of a refused transaction established: the reason it admitted for the attributed script, when every purpose of that script admitted the same one; the replay of each failing purpose; and the traced build those reasons rely on.

A refusal no traced replay recorded.

Attribute a node-submit refusal and, when the role's policy writes, record the refused receipt under the row's id. Returns the attribution mismatch for the caller to fail on loudly — this function never swallows a refusal that does not attribute, and a control here can never silently pass: acceptance and wrong-reason both fail the run upstream of this call. The receipt carries the trimmed reason (volume trimmed, never the script identities), the submitted transaction's id under rejected, and the node-submit venue.

Require reason to be a phase-2 script failure naming marker. marker is the applied refusing script's hash hex; reason is the node's refusal text verbatim. The marker must be AMONG the extracted failure script hashes (NOTE-071) — a hash appearing in unrelated diagnostic text must not satisfy the check.

Two vocabularies, one discipline. At submit the node speaks PlutusFailure (the li-refusals precedent). At build evaluation the story language reports the node's per-purpose failure, whose text speaks CekError: the CEK machine executed the script and it errored. Both are the node's word for script-execution failure, never for a phase-1 ledger refusal — and both must name the script.

Every ScriptHash "..." value in the reason, ledger order, first occurrence wins. A malformed transaction can trip two validators in one submission and the ledger's failure-list order is not stable, so attribution keeps them all: trim volume — the script binary, the cost model, the whole context — never the identities that attribute the refusal. Both shapes name hashes this way: the eval shape via pwcScriptHash, the node-submit shape in its failure headers. Unquoted ledger credentials never match this pattern.

The receipt policy per role. A control keeps its evidence in the run log and its failures loud — an accepted control fails the run as a FINDING and a refusal that does not attribute fails the run naming the mismatch — so writing nothing leaves it unable to pass silently, while the row's held verdict survives its own control.

Keep the parts that attribute a refusal and drop the rest. show on an evaluation context embeds the whole compiled validator (~30KB of base64) plus the cost model and script context; a receipt carrying that is unreadable. Kept: the failure class and redeemer pointer, the failed script hash, the CEK error. Everything else — plutusBinary, pwcCostModel, the full ScriptContext — comes out; every failed script hash in ledger order binds which scripts ran, and the receipt already carries the blueprint hashes.

The marker the wrong-reason control matches refusals against: by construction no node reason can contain it, so a matched reason can never close a row and the control must fail.