Enum RejectKind 

pub enum RejectKind {
    UnknownCommitment,
    Transient,
    Protocol,
}

Why a responder rejected an audit challenge, in a form the auditor can act on without string-matching.

The distinction matters for accounting: a responder that no longer RETAINS the pinned commitment may simply have rotated past it legitimately — the auditor can pin a root it gossiped a while ago, or one whose newer replacements the auditor never observed (retention is capped at the last two gossiped roots, so a peer that rotated several times within the answerability window can honestly drop an older one). That is NOT provable misbehaviour, so it is GRACED like a timeout. Every other rejection is a genuine protocol fault the auditor confirms.

Self-grace is bounded and does not preserve stale credit. A Byzantine peer can deliberately claim UnknownCommitment/Transient to dodge the confirmed-failure trust penalty. But the auditor still REVOKES the holder credit for the PINNED commitment on any graced rejection (it answered and could not prove possession now — see the credit revocation in storage_commitment_audit’s rejection handling). The revocation is scoped to the pinned commitment hash, so it strips exactly the credit for the root the peer would not prove without touching credit it legitimately re-earned for a newer commitment. Lying therefore does not let a deleter keep “proven holder” status for that root until the credit TTL — the loophole a plain timeout would leave. It also accumulates a timeout strike, so a peer that self-graces on every audit still crosses the strike threshold once timeout-eviction is enabled. An honest peer that genuinely rotated simply re-earns credit on the next audit of its current commitment, so the grace strips no peer that is actually holding its responsible data. The grace removes only the false TRUST PENALTY for the genuinely-ambiguous rotated/transient case; it does not remove the possession requirement.

Variants

UnknownCommitment

The responder does not retain the pinned commitment (rotated past it). GRACED — indistinguishable from legitimate rotation the auditor missed.

Transient

A transient, recoverable condition on the responder (e.g. a storage read error) that is NOT evidence of missing data. GRACED like a timeout so a flaky disk never manufactures a confirmed possession failure.

Protocol

Any other rejection (wrong target peer, no commitment state, malformed proof plan, oversized byte challenge, …). CONFIRMED failure.

Implementations

impl RejectKind

pub fn is_graced(self) -> bool

Whether the auditor should GRACE this rejection (treat like a timeout — no confirmed penalty, no holder-credit revocation) rather than confirm it. Only genuine protocol faults are confirmed; rotation/transient conditions are graced because they are not provable misbehaviour.

Trait Implementations

impl Clone for RejectKind

fn clone(&self) -> RejectKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for RejectKind

impl Debug for RejectKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RejectKind

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for RejectKind

impl PartialEq for RejectKind

fn eq(&self, other: &RejectKind) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for RejectKind

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RejectKind