LineageFailurePolicy

What happens when a run's lineage cannot be written.

A host asks for attribution by giving an extraction a run. This says how much that ask is worth: whether an extraction whose lineage could not be recorded is a failure, or a success with a gap in the audit.

STRICT is the default, and the reason is that silence is the wrong answer here. Lineage is an audit record. An operator who turns it on and gets no error believes every stored claim can be traced to the run that produced it, and the one moment that belief is worth something — after an incident, reconstructing what a run wrote — is the moment a silent gap makes it worthless. A warning in a log is not a control: nobody reads it in time, and the extraction that dropped the record reported success. Asking for attribution and getting none should be loud.

LENIENT exists for the host that has decided the claims matter more than their attribution and is willing to say so in configuration. It is a deliberate downgrade, chosen once, in the open.

EXPERIMENTAL. The shape may still change while extraction runs (DICE #67) land.