Pre-dispatch rejection ledger

record_rejection (write) and receipt_query (read status of a rejection) are clearly distinct halves of a ledger, and differ_scan is a schema comparison operation that does not overlap either. The only ambiguity is that differ_scan feels like it belongs to a different service than the rejection ledger, so an agent may wonder why it is here.

All names are snake_case and readable, but the patterns are mixed: differ_scan and record_rejection are verb_noun while receipt_query is noun_noun. It is not chaotic, but there is no single predictable convention an agent can rely on when guessing new names.

Three tools is thin even for a narrow ledger domain, and one of them (differ_scan) appears to be a bolt-on from an adjacent concern rather than core ledger functionality. The set is not bloated, but it is borderline under-scoped.

The core write (record_rejection) and point read (receipt_query) exist, but there is no way to enumerate or list rejections/receipts, no lookup by constraint or hash, and no lifecycle operations such as expiry or deletion. An agent can complete a single record-then-check flow but hits dead ends for auditing or bulk inspection.