Typed errors are returned inside the encrypted response as
{ kind: 'error', code }. No private details belong in public HTTP errors or logs.
The SDK throws a redacted delivery/verification error when it cannot establish a valid response. A throw is not rejection. Some actions may already be durable or externally exposed. Reconnect and query original operations before economic retry.
For paging conflict restart from zero. For stream rejection/closure restart with fresh attestation and current epoch, then resnapshot. Never continue consuming a gapped stream as authoritative.