Programmatic-contract violation thrown by StuffApi.destruct() when
a target's canDestruct() witness vetoes the destruction. Mirrors
the shape of ContainmentError — separately named so callers can
catch destruct-specific failures without overlapping the
containment surface.
forceDestruct() does not raise this even when canDestruct()
returns { ok: false } — the witness still fires for observability,
but force-bypass intentionally ignores the veto.
Programmatic-contract violation thrown by
StuffApi.destruct()when a target'scanDestruct()witness vetoes the destruction. Mirrors the shape ofContainmentError— separately named so callers can catch destruct-specific failures without overlapping the containment surface.forceDestruct()does not raise this even whencanDestruct()returns{ ok: false }— the witness still fires for observability, but force-bypass intentionally ignores the veto.