ExtractionFailure

One thing that went wrong during a run, said entirely in a closed vocabulary.

A failure record is evidence, and evidence about a failure is where source text leaks. A model provider routinely quotes the prompt back in its exception message, a decode error carries the fragment it choked on, and both used to reach a stored run header the moment someone wrote e.message into a text field. So this record has no text field, and there is no constructor, factory, or property here that will accept a String or a Throwable. Prompt content, personal data, credentials and protected material have no route into durable storage through this type, because there is nothing shaped to hold them.

It holds five things a dashboard can group by and a person can read: the code, the stage it happened in, the provider's own providerStatus, one measure answering "how much", and the invocation it belongs to. That last one already carries the call's ordinal in the plan, so "chunk 3 failed" is expressible without a sentence about chunk 3.

One measure per record, deliberately. A failure answers one "how much"; a host that wants the exceeded budget and the elapsed time is describing two facts, and the second one belongs with the rest of its detail.

Where the detail goes. A host that needs the exception message, the response body, or the fragment that failed to parse keeps that material itself, under its own retention and access rules. ProtectedContentRef is the specification for the reference such a host hands around; DICE writes nothing behind it and stores none of it.

EXPERIMENTAL. The shape may still change while extraction runs (DICE #67) land.