Stable, structured error returned by the ergonomic audit APIs.

Two audiences, two fields, and they are not interchangeable. reason is for code: a matchable term that callers pattern match on, and therefore API — changing one is a breaking change even though nothing in a type signature says so. message is for people, and is free to be reworded whenever it reads badly.

cause and stacktrace carry the original failure rather than replacing it. An error that flattens its cause into a sentence has destroyed the only thing that would have explained it, and the operator reading the log at three in the morning cannot get it back.

retryable? is a claim about the failure, not a suggestion about what to do. A signing key that cannot be resolved will not resolve itself on the second attempt; a lock timeout might.