Struct RefusalPayload 

pub struct RefusalPayload<'a> {
    pub kind: &'a str,
    pub reason: &'a str,
    pub reason_detail: &'a str,
    pub merchant_host: &'a str,
    pub requested_base_units: &'a str,
    pub permitted_base_units: &'a str,
    pub tool_call_id: &'a str,
    pub subject: &'a str,
    pub timestamp: &'a str,
}

The payment_refusal field set refusal_payload signs, named at the call site.

Mirrors ReceiptPayload’s reasoning (#2090, INV-W5): a positional argument list of same-typed &strs invites a silent field swap at the call site, so every field is named here instead.

Unlike a receipt, a refusal has exactly one schema version — this event kind ships new, with no prior persisted history to keep verifying, so there is no v1/v2 split to carry.

Fields

kind: &'a str

The event kind the payload is stored under (always polyc_proto::kinds::PAYMENT_REFUSAL). Signed so a payload cannot be re-filed under a different kind, mirroring ReceiptPayload::kind.

reason: &'a str

The stable, machine-readable reason tag (e.g. "over_spend_cap") — one of the tags crate’s callers mint via an exhaustive match over polyc_payments::proxy::RejectReason, or "unknown" for a reason this build has no tag for. Never the free-text Display rendering.

reason_detail: &'a str

A non-secret diagnostic detail for the reason — the wrapped error’s own Display text (e.g. the SSRF-guard host, the mandate failure). Never signer-key or credential material.

merchant_host: &'a str

The destination host the fetch would have paid, when the reject site had a host to name (empty otherwise).

requested_base_units: &'a str

The base-unit amount the call requested, as a decimal string, for a reason that carries one (over_spend_cap, over_budget); empty for every other reason.

permitted_base_units: &'a str

The base-unit amount the cap/budget actually permitted, as a decimal string, for a reason that carries one; empty for every other reason.

tool_call_id: &'a str

The paid_fetch tool-call id the refused attempt answered.

subject: &'a str

Opaque principal the refused attempt is attributed to — the same status ReceiptPayload::subject carries.

timestamp: &'a str

Decimal string of the unix-seconds clock value at the moment the reject site recorded the refusal — the payments sibling field to ReceiptPayload::timestamp, but unix-seconds rather than RFC3339: the recording seam already carries the turn’s dispatch-time now_unix (no fresh wall-clock read needed), so this reuses that value verbatim rather than reformatting it. Without this, a blocked row has no time field at all and cannot be placed on a ledger alongside settled receipts.

Trait Implementations

impl<'a> Clone for RefusalPayload<'a>

fn clone(&self) -> RefusalPayload<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Copy for RefusalPayload<'a>

impl<'a> Debug for RefusalPayload<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.