AMBIT_EXCEEDED is the umbrella class these codes belong to. It is used here, in aggregate, and never on its own. A refusal that names only the class and not the rule is a defect. Every row below names the specific rule-level code.

Verdict split

allow

— passed the rules as configured. Not a judgement that the purchase is wise.

escalate

— sat above the threshold, where a human decides. The escalation writer is not wired in this phase.

block

— refused by a named rule, with zero movement.

How this could mislead

• These are counts from this process’s memory. Storage is not durable, so a restart resets them.
• A refusal count proves the engine refused those cases. It says nothing about attacks not represented here.
• A high refusal count is not a quality signal in either direction; it reflects what was proposed.