Detection needs the network, so the failure path is part of the contract.
onScanError
A malformed verdict is treated exactly like an unreachable control plane. Coercing a partly understood response into an allow would turn a block into a silent pass.
The refusal carries severity: "high" and a reason that is deliberately not a rule id, so an operator reading a log can tell a detection from an outage. One is a payload to investigate. The other is a dependency to restore.
Failing open means a control-plane outage disables the guard. Choose it only if availability matters more than enforcement.
Reporting never blocks
Telemetry and capture are fire-and-forget. A reporting failure goes to your onError callback and is never raised into the request path. The queues are bounded, so a stalled network cannot grow memory.
The semantic pass
The semantic classifier fails open, because it runs behind a static pass that already found nothing. See Detection.
Cloak
Cloak fails closed on its own account, whatever onScanError says. A request it could not check for personal data is refused with reason: "cloak_unavailable".
Shutdown
Flush on shutdown so the last batch is not lost.
