X_POLICY_SURFACE_UNKNOWN

enforce() was handed a surface no adapter answers to

enforce(surface, policy, args) called with a value outside 'http' \| 'live' \| 'job' \| 'mcp' — a config-driven table, a surface name off the wire, or a JS host, none of which the type reached. Refused rather than dispatched because the adapter table is an object literal and so inherits Object.prototype: adapters['valueOf'] answered a FUNCTION, enforce('valueOf', …) called it with the table as its receiver, and the truthy return was the adapter table typed as a SurfaceDenial — an authz dispatch that failed CLOSED with a denial carrying no code and no reason

pass one of http, live, job, mcp — enforce('http', policy, args) — or add the adapter for the new surface in packages/policy/src/surfaces.ts, the one place a fifth may be declared