https://epcis.dev/errors/write-class-refused
A capture payload named a `spine:writeClass` the caller may not set. The class lattice is MONOTONE DOWNWARD: `simulated` is a self-downgrade and is accepted from anyone, because it can only shrink what an event is admissible for. `witnessed` is the gateway's DEFAULT and is stamped, never accepted — a class a request can claim is not a class, and the day a tenant is pinned simulation-only an accepted assertion would be an escape hatch that had always worked and therefore looked correct. Any other value fails closed.
Omit `spine:writeClass` for the normal case — the gateway stamps `witnessed`. Declare `"simulated"` when the event is generated rather than observed. A tenant that must never emit witnessed events is pinned at its key, not at its payload.