| Suffix | Status | Retry | Meaning |
|---|---|---|---|
| authentication-required | 401 | No | Bearer JWT missing, expired, or invalid. |
| authorization-denied | 403 | No | Valid JWT lacks the endpoint permission. |
| not-found | 404 | No | Missing resource or resource outside claim constraints; detail is identical. |
| validation | 400 | No | Request field, query, or header shape is invalid. |
| unsupported-parameter | 400 | No | An unknown query parameter or unsupported sort was rejected rather than ignored; fieldErrors identifies the parameter. |
| idempotency-conflict | 409 | No | One key was reused with a different canonical request. |
| source-version-conflict | 409 | Yes | Fresh-read retries could not converge authoritative source versions. |
| dependency-unavailable | 503 | Yes | A required upstream is unavailable or its release gate is closed. |
| dependency-incomplete | 503 | Yes | A required upstream lacks a settled fact required by the contract, including an attempt with no settled Results record. |
| internal-error | 500 | Yes | An unexpected boundary failure occurred; internals are not exposed. |
Envelope fields and endpoint mappings: data dictionary. Normative decisions: ITD-023 and ITD-035.