| hard_never: | |
| - id: NO_PII_OVERWRITE | |
| description: Columns tagged as PII cannot be modified unless the operator explicitly allows and confirms it. | |
| predicate: pii_overwrite | |
| override_flag: allow_pii | |
| confirm_flag: confirm_pii | |
| - id: NO_ROW_DELETE | |
| description: Candidate fixes may not delete rows; only cell updates are allowed. | |
| predicate: row_delete | |
| - id: NO_CONFLICTING_CELL_WRITES | |
| description: Multiple accepted fixes may not target the same cell with different replacement values. | |
| predicate: conflicting_cell_writes | |
| scope: batch | |
| soft_require_confirm: | |
| - id: NO_AGGREGATE_BREAK | |
| description: Candidate fixes to aggregate-sensitive source columns require confirmation. | |
| predicate: aggregate_sensitive | |
| confirm_flag: confirm_escalations | |
| soft_prefer: | |
| - id: MINIMAL_EDIT | |
| description: Prefer the smallest edit distance when multiple candidates are otherwise viable. | |
| scorer: minimal_edit_distance | |