Function classify 

pub fn classify(site: Site, kind: ActionKind, cx: &CapCtx) -> Support

The single source of truth for what is executable.

Capabilities::supports and the engine’s executor are its only two callers, which is what keeps the published table and the engine from disagreeing. tests/action_matrix.rs asserts the table against observed behaviour on all thirteen drafts.

How the verdict is reached

In order, because the order is what makes ActionKind::ReplaceObject have exactly one reading:

1. ReplaceObject off Site::Object is NotAttemptable { KindNotDefinedAtThisSite, WrongSite { .. } }, and at Site::Object it is the same No(WrongSite { .. }) as Replace — one value for both rows, since one expression carries both.
2. A return-type mismatch is NotAttemptable { SiteReturns.., WrongSite { .. } }.
3. The object site behind a stream the framer cannot address is Support::Unreachable: the hook is never invoked there, so no refusal can be emitted and the run’s reportable fact is the bypass. One fact reaches this step: a draft this build did not compile (draft_is_compiled). A fetch stream used to bring a second, and no longer does — see fetch_group_order_is_needed for where that went.
4. The control site on a draft this build did not compile is Support::Unreachable too, for the same reason one decoder later: every frame is stepped over before the hook is offered one.
5. Otherwise the per-site rules apply.

What an unsupplied fact means

A None field is the caller did not say, which yields Support::Conditional naming the fact — never a guess. Two Nones are read structurally rather than conditionally, because a table caller supplies neither and the published cell must still be the right one:

• draft: None reads as no draft-specific restriction applies, so the elide guard is evaluated as though the draft had a first-object subgroup mode — the conservative side, since it yields Conditional rather than Yes.
• stream_kind: None reads as a subgroup stream, which is what Capabilities::supports publishes; Capabilities::supports_on is how a caller asks about fetch.