Documentation

A rule policy did not resolve (surfaced by loadConfig).

A configured mount's ecosystem has no adapter wired, so it cannot be served (a loud miss, never a silent drop). Carries the ecosystem.

A mount has no initialised mirror-write provider. The credential is derived from the mirror-target URL and realised for every active mount, so this is a total safety net rather than a reachable operator misconfiguration. Carries the ecosystem of the mount.

The queue URL names a backend (by its shape) that has no implementation compiled into this binary, so no queue can be built for it. Carries the provider's name. An honest refusal -- never a silent fall-through to a different backend.

An SQS endpoint override (AWS_ENDPOINT_URL_SQS) is set but no AWS_REGION was supplied: an emulator or VPC endpoint does not carry a region in its host, so the ambient region must scope it. A real SQS queue URL carries its own region and never raises this.

ECLUSE_QUEUE__URL is set but its shape names no backend this binary knows, so refusing is the only honest move (guessing a backend would send mirror jobs somewhere the operator did not point at). Carries the value.

The configured SQS endpoint override (AWS_ENDPOINT_URL_SQS) is not a parseable endpoint URL. Carries the offending value.

The eager boot-time CodeArtifact mint threw -- a transient AWS error (worth a retry) or a permanent one (a bad domain/region or missing permission, to be fixed). Carries the rendered exception so the cause is legible and aggregated.

A publication target was configured (ECLUSE_MOUNTS{ECOSYSTEM}PUBLICATION_TARGET) but no publish allow-list (ECLUSE_MOUNTS{ECOSYSTEM}PUBLISH_ALLOW) was supplied, so the anti-shadowing guard would have nothing to enforce. Refused at boot rather than defaulting to an empty allow-list (which would deny every publish) or an open one (which would let a client shadow any public name).

A static publish credential (ECLUSE_MOUNTS{ECOSYSTEM}PUBLICATION_TARGET_TOKEN) was configured without a verifiable inbound edge (ECLUSE_SERVER__AUTH_TOKEN). Écluse would otherwise substitute its own standing write credential for a publishing caller who forwards none, so an unauthenticated request could publish within the configured scopes under Écluse's own identity. Refused at boot so an internal publish credential paired with an open edge is unrepresentable -- the write-side counterpart of the fail-closed read identity.

An explicit memory override breaks the combined memory-plan invariant even after every computed tenant shed to its minimum (Ecluse.Composition.MemoryPlan). Carries the solver's per-violation diagnostics. A computed plan never raises this: it degrades gracefully and boots; an override is an operator claim, and a false one is refused.