rule

Which rule refused a request: the error's data.rule, present exactly when its code is rejected. Each rule has one recovery.

Value	Meaning
`out_of_scope`	No grant the participant holds covers this path or operation.
`grant_ended`	The grant that covered the request has expired or was revoked.
`quota_spent`	The participant has used up the number of changes its grant allows.
`protected_path`	The path is protected: a change to it reaches others only after checks pass and a holder of the approve capability approves it.
`unattested`	The version the request names has not passed the project's checks yet.
`policy_unknown`	The project's rules for this path are not known yet on this daemon, because its grants have not synced.
`workspace_refused`	The workspace can't take the request: this daemon doesn't run it, or its base refused the merge-back.
`not_synced`	The path is never shared: a control document under `.lvcs/`, a path the project never syncs (a `.gitignore` or `.lvcsignore` ignores it, or it is never-sync), a link or special file on the path, or a path outside every mirrored directory.
`not_author`	Only the participant whose change is held may do this.
`mirror_author`	The mirrored directory writes as another participant, so this participant may not write through it.
`not_a_repository`	The project directory is not a git repository, so there is nothing to write a checkpoint into.
`outcome_unknown`	An earlier request with the same `request` id is still running or its answer was lost, so whether it applied is unknown. Read the document again and redo the change from what it holds now.
`no_action`	`run` names no gated action: no approved `[[actions]]` entry in `lvcs.toml` with `on = "manual"` or `on = { channel = ... }` has that name (a change action runs on every merge into main, never by `run`). Run an action the approved `lvcs.toml` gates, or add one and have its `lvcs.toml` change approved first.
`not_eligible`	The frontier `run` names can't be run on by this action yet: its `after` channel doesn't hold it, and the action's channel holds no passed run of it; or no frontier was named and the `after` channel holds none, or several. Read the `after` channel to see which frontiers it holds, then wait for this one or name one it holds.
`superseded`	The frontier `run` names is behind the action's channel: the channel's value is a newer frontier that holds all of it, and the channel never passed a run of it, so running it would move the channel backward. Read the channel and run the action on its value or a newer frontier; a rollback names a frontier the channel passed before.
`git_rewrite`	A mapped git branch was rewritten outside LVCS (a force-push or a reset): its head doesn't descend from the last commit LVCS knew there, so nothing is imported and LVCS moves the branch no more until it does. Restore the branch with the `git update-ref` the refusal's next names, or merge the rewrite onto that commit.
`action_refused`	The approval would put in force a set of actions that is refused: two declarations of one action, a GitHub workflow job LVCS can't run, or an `lvcs.toml` whose channel triggers name an unknown channel or form a cycle, which the reason names (`reason` names the `action_refusal` value). Fix the file, or list the job in `lvcs.toml`'s `[workflows] skip`, as the reason says, and approve again.
`stale_overlap`	A mirror save or an edit was made from an older version of the file than the one it now holds, and the lines it changes overlap lines another participant changed since that version. It was not taken, and the file now holds the current version: read it again and redo the change from what it holds now. The reason names the overlapping lines and who changed them.
`device_scope`	A paired device may not do this: a read device only reads, a write device also coordinates (asks, answers, holds, says, runs gated actions), and no device edits files or workspaces. Pair a device with the scope it needs (`lvcs auth login --write`), or do it from an agent or the CLI.

Cardinality: 19.