Error code reference

Generated file — do not edit by hand. Regenerate from the repo root with CGO_ENABLED=0 go run scripts/gen-errors-md.go.

Every typed error SHC can raise. Codes follow the pattern X<HTTP><SEQ><MNEMONIC> where HTTP is the HTTP status class (400 = client error, 500 = server error), SEQ is a 3-digit sequence, and MNEMONIC is a 6-or-more-letter hint.

Exit codes: usage and parse errors exit the CLI with 2; every runtime failure — any X-code — exits with 1. The HTTP class does not select the exit code; it travels to scripts as http_status in the -o json error envelope. See the output contract §7.

Total: 1241 error codes across 72 modules. Source of truth is the coded registry (core/coded), populated by each module’s errors.go init().

• (global) — 48 codes
• adapter — 13 codes
• app — 163 codes
• audit — 4 codes
• auth — 54 codes
• backup — 120 codes
• ca — 21 codes
• capabilities — 2 codes
• clone — 27 codes
• cluster — 51 codes
• collector — 2 codes
• completion — 2 codes
• config — 7 codes
• connections — 14 codes
• core/api — 11 codes
• core/collectorcfg — 1 code
• core/config — 1 code
• core/daemonclient — 4 codes
• core/db — 31 codes
• core/eegate — 1 code
• core/eestub — 1 code
• core/enginemarker — 1 code
• core/hostactivate — 2 codes
• core/jinja — 7 codes
• core/nic — 2 codes
• core/openstack — 3 codes
• core/rqlited — 21 codes
• core/validation — 2 codes
• core/volume — 22 codes
• ctx — 3 codes
• daemon — 41 codes
• dns — 29 codes
• docker — 11 codes
• doctor — 4 codes
• events — 6 codes
• export — 18 codes
• fabric — 20 codes
• forms — 2 codes
• forward — 8 codes
• health — 11 codes
• hud — 9 codes
• inspect — 2 codes
• internal_rpc — 6 codes
• internal_stacks — 6 codes
• job — 14 codes
• kv — 3 codes
• leader — 1 code
• license — 27 codes
• logs — 8 codes
• mcp — 4 codes
• metrics — 4 codes
• nebula — 9 codes
• network — 3 codes
• node — 19 codes
• notification — 13 codes
• portforward — 2 codes
• proxy — 7 codes
• quota — 16 codes
• repo — 14 codes
• retention — 2 codes
• schedule — 12 codes
• search — 3 codes
• shell — 7 codes
• stack — 6 codes
• storage — 90 codes
• subsystems — 77 codes
• supportbundle — 7 codes
• task — 11 codes
• tenant — 15 codes
• test — 10 codes
• user — 9 codes
• vault — 34 codes

Source: core/coded
Count: 48

Code	HTTP	Message template
X200002INVFMT	200	invalid {format_type} format {value}, {detail}
X200003OPFAIL	200	operation failed {operation}{error}{output}
X200008VLTREN	200	failed to rename vault secrets {error}
X200009RESFAL	200	{operation} failed for {resource} {name} {error}
X200013PRSFAL	200	failed to parse {file} for {purpose} {error}
X200129CFGCHG	200	collector config changed {changed_keys}, restart required
X200920SUBFAL	200	subsystem {name} {operation} failed {error}
X400000BADREQ	400	bad request {detail}
X400007VLTRES	400	failed to resolve vault reference, {reason}
X400008CTXREQ	400	context required to {operation}
X400011EMPMNT	400	empty mount specification
X400015NOTTYP	400	interactive confirmation required
X400051INVURI	400	invalid secret-ref uri {value}, {reason} {error}
X400116RLBKTO	400	must provide to or use interactive selection
X400124VLTREF	400	could not resolve vault ref {ref}
X400957INVDUR	400	invalid duration format {duration}
X403000FORBID	403	permission denied
X404000NOTFND	404	not found
X404023CLSNOF	404	cluster {name} not found in config, available {available}
X404101OPRNOF	404	operation {operation_id} not found or expired
X404128FILNOF	404	file not found {path}
X404912TNTNFD	404	tenant {tenant_name} not found
X408000REQTMO	408	operation timed out
X409000CONFLT	409	already exists
X429001RATLMT	429	rate limit exceeded, try again later
X499000REQCNL	499	request canceled
X500000UNKNOW	500	unknown error
X500002RNDDEC	500	render decode failed {detail}
X500005VARNLD	500	vars not loaded, call load first
X500051SVCNWR	500	{module} service not wired
X500052SVCNRS	500	{module} service returned nil result
X500095NOCRTS	500	missing cluster-CA certs in {certs_dir}, {reason}
X500104SUBCYC	500	circular or unresolvable subsystem dependency {stacks}
X500107TOKEXE	500	cluster tokenExec failed {detail}
X500901OPFAIL	500	{operation} failed {error}{output}
X500935INTUNH	500	internal server error {error}
X500938RSPENC	500	failed to encode {what} response {error}
X500939FSMKDR	500	mkdir failed {path} {error}
X500940FSWRTF	500	write_file failed {path} {error}
X500941FSREAD	500	read_file failed {path} {error}
X500942FSRMTF	500	rmtree failed {path} {error}
X500943FSCPYT	500	copytree failed {src} {dst} {error}
X500944FSLIST	500	listdir failed {path} {error}
X500947FSCHWN	500	chown failed {path} {uid} {gid} {error}
X503020ENTNRD	503	ent client not ready for {operation}
X503999RTENYI	503	{feature} not yet wired
X504000DLNEXC	504	operation timed out
X507000NOSPCE	507	no space left on device

Source: modules/adapter
Count: 13

Code	HTTP	Message template
X400948ADPRUN	400	cannot run migration for {subject}, {detail}
X400950ADPMAN	400	invalid foreign app manifest, {detail}
X400951ADPMIG	400	invalid migration file {path} {error}
X400953ADPREQ	400	invalid adapter request, {detail}
X400966ADPSRC	400	cannot extract migration source for {app}, {detail}
X404950ADPMNF	404	no migration path for adapter {adapter} app {app}
X500950ADPENU	500	failed to enumerate adapter {adapter} catalog {error}
X500951ADPTRN	500	failed to transpile foreign app {app} {error}
X500957ADPMAT	500	failed to materialize adapted package {name} {error}
X500958ADPGRP	500	failed to assemble migration group for {name} {error}
X500962ADPXFM	500	migration transform {job} failed {error}
X501000ADPSSH	501	box ssh transport to {host} failed {error}
X501001ADPPUL	501	failed to pull data volume {volume} from box {error}

Source: modules/app
Count: 163

Code	HTTP	Message template
X200066DCKTHR	200	registry pull rate limit for stack {project}, retrying in {delay}
X200900KCISUR	200	system Keycloak issuer origin changing {old} -> {new}, live SSO sessions invalidate and consumers must re-render, reconcile is converging, this is not a hard failure
X200901SHDNSZ	200	system host dns resolved zero target specs, nothing registered, retries on the next ingress endpoint change
X200902SHDNSF	200	system host dns record sync for {hostname} failed{error}, retries on the next ingress endpoint change
X200903DNSLFT	200	managed dns records for host {hostname} were not released ({reason}), they may still be live in the zone
X200907TRFHUP	200	reloading system Traefik after a dynamic config change failed{error}, routes and certs stay as traefik last read them until the next sweep re-signals
X200910CONOVR	200	integration plug {plug} requested {field} {requested} but the connection mint provisioned {minted}, using {minted}, the platform names this resource and scopes its credential to that name
X200911RBKPIU	200	rollback of failed install for stack {stack} did not sweep its deployment dir{error}, the pre-image could not be read so the added-entry set is unknown, the deployment dir is left intact rather than risk deleting pre-existing data
X200913PROMIR	200	protection flag for {tenant}/{stack} written to the cluster config only, this node holds no deployment sidecar to mirror it onto, a daemonless uninstall on the placement node will not see it
X200915PRJCOL	200	deployment {tenant}/{stack}/{environment} already shares compose project {project} with {other_tenant}/{other_stack}/{other_environment}, a teardown of either destroys the other, rename one of them
X200926KCPWBG	200	system keycloak admin password rotation starting for app {app}, trigger {trigger}, steps live reset then record update then redeploy
X200927KCPWDN	200	system keycloak admin password rotation complete for app {app} admin user {username}, trigger {trigger}, live reset done, record updated, stack redeployed
X200949VAPRET	200	vapp {stack} retained, {jobs} cleanup job(s) skipped, {reason}, the resources they would destroy are left in place
X200950APPUGW	200	app {stack} published open with no built-in auth, self_auth is false, anyone reaching it is unauthenticated
X200951VAPUNG	200	vapp {stack} cleanup job {job} refused, its command is destructive ({verb}) but the vsocket declares no cleanup@boolean guard, the resource is left in place, declare cleanup@boolean in schema.plug to make destruction opt-in
X200952SCHSYN	200	app crons for stack {stack} not reconciled into schedule rows{error}, app-declared crons may not fire until the next successful install or update
X200953LEAFRC	200	ingress served leaf for {host} not recorded {op}{error}, renewal subsystem will not track it until re-served
X200954HMINTN	200	ingress host_mapping intent for {host} not persisted{error}, multi-node reconcile will not materialize this route until recorded
X200955INGMAT	200	ingress reconcile could not materialize {tenant}/{stack}{error}, skipped this sweep retries next tick
X200956LEAFRN	200	ingress renewal could not re-sign leaf {tenant}/{host}{error}, skipped this sweep retries next tick
X200957TRFRCR	200	traefik dns-01 reconcile recreate of system Traefik failed{error}, skipped this sweep retries next tick
X200958KCBPRC	200	keycloak basePath reconcile recreate of system Keycloak failed deployed {deployed} desired {desired}{error}, skipped this sweep retries next tick
X200959OOBPRC	200	openobserve basePath reconcile recreate of system OpenObserve failed deployed {deployed} desired {desired}{error}, skipped this sweep retries next tick
X200960NETPRE	200	shared network {network} pre-create did not complete{error}, installs will join it once it exists
X200962NETACT	200	overlay {network} not yet activated on this node, retrying compose-up attempt {attempt}
X200969INTDRP	200	persisted integration edge {edge} on {tenant}/{stack} could not be resolved to a consumer plug ({reason}) and was dropped from this deploy, every other edge is unaffected, re-add it with -i plug=provider if it is still wanted
X200970RMVNOP	200	{flag} removal {token} matched nothing on this deployment and was ignored, live entries are {live}
X200980DNSDEF	200	exposure=internet but the system ingress has no public endpoint for stack {stack}, dns record deferred until a traefik-node public address via shc node update —public-address or dns.public_address exists
X200981DNSAMB	200	system ingress web listeners span connections {conns}, dns for stack {stack} deferred until 80/443 ride one connection
X200982ACMWAI	200	traefik still has no ACME certificate for {hosts} after {attempts} restarts, next re-arm in {wait}
X200985VOLRMT	200	mount {mount} bound on remote node {node}, node-side provisioner confirmed the mount at {path}, local prep skipped
X200986ACMSTL	200	traefik has no ACME certificate for {hosts}, restarting traefik to re-arm the order (attempt {attempt})
X200987ACMSTK	200	traefik still has no ACME certificate for {hosts} after {attempts} restarts, re-arming again now and every {retry} until it issues, check DNS-01 credentials, zone delegation, :80 reachability and CA rate limits
X200988ACMRST	200	restarting system Traefik to re-arm stalled ACME orders failed{error}, skipped this sweep retries next tick
X200989ACMPRV	200	ingress host {host} can never be issued a public certificate ({reason}), serving an SHC-signed leaf instead of requesting ACME
X200989DEPPRG	200	deployment lifecycle config for stack {stack} not purged after uninstall{error}, a reinstall may inherit a stale lease or protection flag
X200990LSESTM	200	lease stamp for stack {stack} failed after successful deploy{error}, the deployment has no enforced ttl until re-stamped with shc lease renew
X200991PROSTM	200	protection flag for stack {stack} failed to persist after successful deploy{error}, protection unchanged until re-applied
X200992LSERTY	200	lease reap for stack {stack} failed, attempt {attempt}/{max_attempts}, retrying in {delay_seconds}s, {detail}
X200993PMTANC	200	platform trust bundle not confirmed on peer nodes {nodes}, swarm tasks scheduled there keep their image’s built-in roots
X200994PMTJVM	200	jvm truststore {stores} not confirmed on peer nodes {nodes}, dropping the swarm truststore stamp rather than risk a jvm that trusts nothing
X200995PMTFIL	200	swarm stack {stack} declares file bind mounts {mounts} that exist only on the render node, a task scheduled elsewhere is rejected with bind source path does not exist, pin the stack with —node or bake the content into the image
X200996HSTDRP	200	persisted route {route} on {tenant}/{stack} is not expressible in the current —host grammar and was dropped from this render, the deployment and its remaining routes are unaffected, re-add it under a path with no exclamation mark if it is still wanted
X400004INSTNM	400	vapp flag is required when installing vapp {app_name}
X400005PARNOF	400	host stack_name {parent_app} must be installed before vapp {vapp_name}
X400010APPYML	400	app.yaml parse failed for app {name} {error}
X400016TYPMIS	400	socket type mismatch, plug expects {expected} but socket provides {actual}
X400018FLDREQ	400	field {field_name} is required but got null
X400019APPNAM	400	app name is required
X400031PRTMAP	400	invalid —port mapping {value}, expected external or external-service or external-service-container, with optional conn@ prefix and /udp suffix
X400038NMEREQ	400	name query parameter required
X400039CMDREQ	400	command is required
X400048PRSVRN	400	preset version error, {detail}
X400069INVNME	400	invalid stack name {name}
X400322VOLSWM	400	volume mount {mount} bound on swarm could not resolve an attachment node, single-writer placement cannot be guaranteed
X400324VOLSWMNB	400	volume mount {mount} uses x-shc-volumes on swarm but no volume backend is configured, an rwo block volume cannot be provisioned
X400325VOLSWMND	400	service {service} requested node {requested} but its rwo volume is attached to {attached}, refusing to place a single-writer service away from its device
X400901INVREP	400	replica count must be 0-100
X400903INVAPP	400	invalid app definition with {detail}{error}
X400914TMPFAL	400	template rendering failed for {name}{error}
X400936HSTNOP	400	no ingress candidate matches selectors {selectors}, specify —host with service and container port before @hostname
X400937HSTAMB	400	multiple ingress candidates match {candidates}, specify —host with service and container port before @hostname
X400952STKREQ	400	stack name required
X400954XNDSCK	400	integration with local-only socket {socket_name} cannot span nodes, provider on {provider_node}
X400955RTMPIN	400	cannot deploy {requested_runtime} stack on node {node_id}, runtime is {node_runtime}, pick a {requested_runtime}-runtime node or change this node’s runtime
X400960CONDTY	400	app {app} connection declaration {name} has unknown type {type}, declare a type the connections registry knows
X400961CONBND	400	app {app} declares no connection named {name}, declared {declared}, bind with -c name=connection
X400965CONAMB	400	bare -c {connection} needs exactly one declared connection in app {app}, declared {declared}, use -c name=connection
X400968VARBOL	400	app {app} declares boolean vars that hold non-boolean values, {vars}, use true or false
X400971INTNOF	400	integration removal {token} matches no integration on this deployment, wired integrations are {live}, remove the token or name one of them
X400972INTAMB	400	integration removal {token} addresses more than one persisted row ({matches}), which share one identity and so cannot be told apart by any token, nothing was removed, this deployment’s integration state is inconsistent and a plain shc update normalises it
X400973INTPLG	400	integration {provider} cannot be resolved to one consumer plug, the provider offers {sockets} and this app declares {plugs}, name the plug explicitly with -i plug={provider}
X400974HSTIDN	400	—host removal {token} names a service or container port selector, a route is removed by its identity {identity} only
X400975STKNAM	400	stack name {name}, {reason}
X400976ENVNAM	400	environment name {name}, {reason}
X400978VARREQ	400	app {app} required vars not set, {vars}, supply them via —var, a preset, or an integration
X400984PRTNOP	400	no service exposes container port {container_port}{service}, cannot resolve —port target
X400985PRTAMB	400	multiple services expose container port {container_port}, {services}, specify —port external-service-container
X400986PRTCON	400	connection {conn} of type {type} has no proxy capability, —port {mapping} needs a proxy-capable connection
X400987PRTUDP	400	proxy connection {conn} backend {impl} is tcp-only, —port {mapping} cannot forward udp
X400988PRTDUP	400	port {external} on shared-vip connection {conn} is already claimed by deployment {stack} environment {environment}
X400989PRTALO	400	no free node port in {min}-{max} for —port {mapping}
X400990PRTFIX	400	connection {conn} backend forwards without port remap, —port {mapping} needs node port {external} which is already published
X400991PRTIDN	400	—port removal {spec} names a service or container port, a mapping is removed by its identity {identity} only
X400992HSTEXP	400	persisted route {route} cannot be expressed in the current —host grammar, no —host spelling can name it, run shc update on the stack once to drop it from the deployment state and then re-add the route under a path with no exclamation mark
X400993HSTFMT	400	invalid —host declaration {value}, expected optional service and container port selector before @hostname and optional path
X400994PLGREQ	400	app {app} required plugs not connected, {plugs}, connect each with -i plug=provider or point its vars at an external service via —var
X400995HSTTGT	400	host {host} uses the removed =target override {target}, drop the suffix, dns follows the system ingress endpoint
X400996LSEPRT	400	lease operation on stack {stack} refused, environment {environment} is protected, pass —force to override
X400997LSETTL	400	invalid ttl {ttl}{error}, expected a duration like 72h or 30m
X400998TPLUND	400	app {app} compose references undefined values, {refs}, guard each with a default filter or supply the value
X400999CONREQ	400	app {app} required connections not bound, {connections}, bind each with -c name=connection or point its vars at direct credentials via —var
X403974IMGEEO	403	system app {app} image {var} is set to {override} but SHC ships {shipped}, substituting an image that carries SHC’s own enforcement code requires an SHC Enterprise licence (the custom_images entitlement), to serve that SAME image from your own registry keep the @sha256 digest and change only the host or path, mirroring is free on every tier
X403976ENVEEO	403	named environment {name} requires a paid SHC licence, community edition deploys everything into the default environment
X403977SWMEEO	403	runtime swarm requires SHC EE, community edition runtimes are compose and podman
X403978SYSTNT	403	app {app} cannot deploy into the {tenant} tenant, {tenant} is reserved for SHC’s own platform stacks, install it into a tenant of your own with -t
X403979SYSSRC	403	platform stack {app} cannot be installed into the master tenant from {origin}, SHC’s own tenant deploys SHC’s own packaging, install your build into a tenant of your own with -t
X403980SYSENV	403	platform stack {app} cannot deploy into environment {environment} of the master tenant, SHC’s own tenant runs in the default environment only, drop -e or install into a tenant of your own with -t
X404002APPNOF	404	application {name} not found
X404006SOKNOF	404	socket {socket_name} not found in {stack_name}
X404007PLGNOF	404	plug {plug_name} not found in {stack_name}
X404010PRSNFD	404	preset {preset_name} not found, available presets, {available}
X404011PRSEMP	404	no presets defined in {location}
X404012APPDIR	404	app {name} not found, looked under {candidates}
X404013APPDPF	404	app dir not found, {path}
X404014MANNOF	404	no deployment manifest found at {dir}
X404064SRCNFD	404	source path not found {path}
X404903SVCNFD	404	service {service_name} not found in stack {stack_name}
X404906STKNOF	404	stack {name} not found in tenant {tenant} environment {environment}
X409001DEPROT	409	deployment {tenant}/{stack} is protected, unprotect it before destroy
X409002DEPUNK	409	protection state of deployment {tenant}/{stack} could not be determined{error}, refusing destroy
X409003STKEXS	409	stack {name} already exists in environment {environment}
X409004PRJCOL	409	deployment {tenant}/{stack}/{environment} would share compose project {project} with existing deployment {other_tenant}/{other_stack}/{other_environment}, tearing down either one would destroy the other, choose a name that does not fold onto it
X409039APPAMB	409	app {name} exists in more than one repo, found in {repos}
X409045KCPWDS	409	system keycloak admin password desync for {username}{error}, the recorded credential no longer authenticates against the live keycloak database, nothing was changed, run shc update keycloak -t master to realign the live password to the recorded seed (offline self-heal, short downtime) and retry
X500009INTJOB	500	integration job {job_name} failed during {phase} with {error}
X500011JSNENC	500	json encode failed for {context}, {error}
X500012JSNDEC	500	json decode failed for {context}, {error}
X500013AGNPRS	500	failed to parse autogen store {path}, {error}
X500014AGNMAR	500	failed to marshal autogen store, {error}
X500015INTNET	500	attach integration networks failed, {error}
X500016SOKALI	500	alias socket hostname failed, {error}
X500018VOLDEC	500	auto-declare volumes failed, {error}
X500030VOLPRP	500	resolve and prep volumes failed, {error}
X500031NETDEC	500	auto-declare networks failed, {error}
X500035BNDCPY	500	copy bind {rel} failed, {error}
X500039LDVARS	500	load vars failed, {error}
X500045VLTRSV	500	resolve vault autogen failed for stack {stack}{error}
X500047CMPRND	500	render compose failed, {error}
X500048CMPPRS	500	parse compose failed, {error}
X500049SCLFAL	500	scaling {service} did not complete {error}
X500051INGRSS	500	traefik ingress enrichment for stack {stack} failed, {op}{error}
X500058SOKPRS	500	parse socket {path} failed, {error}
X500059DCKCMP	500	docker {subcommand} failed, {error}, output {output}
X500067APPSSE	500	sse stream closed without terminal frame
X500068SCHCYC	500	system-app deploy scheduler dependency cycle among {stacks}
X500069SCHBLK	500	system-app {stack} not deployed, a dependency failed fail-closed
X500093CMPMAR	500	compose re-marshal produced unparseable yaml {error}
X500907STKFAL	500	stack operation failed with {error}
X500908HKFAIL	500	hook {hook_type} failed with {detail}{error}
X500909HKHTTP	500	webhook hook returned HTTP {status} {body}
X500925KCPWRS	500	system keycloak admin password reset failed at {step}{error}
X500945PROMIV	500	deployment sidecar {path} holds an unreadable protection flag, {reason}, protection state is indeterminate
X500946PROCLR	500	stack {stack} deployed but its protection flag could not be cleared{error}, the deployment is still protected and will refuse destroy
X500947VAPCLA	500	vapp {stack} uninstalled but its cleanup jobs {jobs} failed{error}, reclaim what they owned by hand, the instance record is gone
X500948VAPCLN	500	vapp {stack} cleanup job {job} failed{error}, the resource it destroys may still exist
X500953APPYRD	500	app.yaml read failed for app {name} {error}
X500960SWMDPL	500	swarm deploy failed for {project}, {reason}{output}
X500961NETPRF	500	shared network {network} could not be created{error}
X500961SWMSVC	500	swarm services query failed for {project}, {reason}{output}
X500963NETUNR	500	provider network {network} not reachable for the integration job
X500963TRFHST	500	traefik-host detection query failed, {reason}{target}
X500964JOBYML	500	hook job {name} yaml {op} failed{error}
X500965NETOVL	500	attachable overlay {name} create failed, {reason}{output}
X500966PODNET	500	podman shared network {name} create failed{output}
X500969DEPSTU	500	deployment state for {tenant}/{stack} exists but could not be read{error}, refusing, an unreadable manifest is not an absent one
X500976PROPTH	500	deployment sidecar could not be located, {reason}
X500977PROARM	500	stack {stack} deployed but its protection flag could not be armed on this node{error}, the deployment is NOT protected
X500979DNSRMV	500	managed dns records for host {hostname} could not be removed on uninstall{error}
X500980PROVAL	500	config {key} holds a non-boolean value, protection state is indeterminate
X500993LSEGUP	500	lease reap for {tenant}/{stack}/{environment} ABANDONED after {attempts} failed attempts, {detail}; the deployment is left in place with an expired lease — fix the failure and shc lease renew, or uninstall it by hand
X503018SWMLIV	503	swarm capacity query failed, {detail}
X503910CONMSK	503	connection mint seam not wired for connection {connection}

Source: modules/audit
Count: 4

Code	HTTP	Message template
X400900INVDAT	400	invalid date format {value}
X400901AUDLMT	400	invalid —limit value {value}
X403905TNTREQ	403	tenant scope required, set tenant_name or all_tenants=true
X404100AUDNOF	404	audit record {id} not found

Source: modules/auth
Count: 54

Code	HTTP	Message template
X400131JWKCFG	400	jwks missing kcURL or realm
X400910DEVCFG	400	auth login configuration invalid {detail}
X400911TLSCFG	400	auth login tls configuration invalid {detail}
X400912CAPINF	400	ca fingerprint invalid {detail}
X400923SVCCLN	400	service client request invalid {detail}
X400939CCLCFG	400	client credentials login configuration invalid {detail}
X401004JWTMAL	401	malformed JWT
X401005JWKKID	401	jwks token missing kid
X401006JWKKNS	401	jwks kid {kid} not in keyset
X401058OIDCSIDE	401	forward-auth sidecar credential required
X401214KCPWST	401	keycloak rejected the recorded admin credential for {username}, the recorded admin password no longer matches the live keycloak database
X401900NOAUTH	401	not authenticated, run shc auth login
X401901TOKINV	401	invalid or expired token, run shc auth login to re-authenticate
X401910DEVAUTH	401	device authorization failed {status} {body}
X401911DEVDEN	401	auth login was denied at the browser consent screen
X401912CCAUTH	401	client credentials grant rejected {status} {body}
X403000AUTHZF	403	authorization failed, no context available
X403900NOPERM	403	permission denied for {scope} on {resource}
X403903NOUSER	403	authorization failed, no authenticated user
X403904NOTENT	403	authenticated user is not authorized for tenant {tenant_name}
X404916AUTRLM	404	realm {realm} does not exist in keycloak yet
X408910DEVEXP	408	auth login timed out, the device code expired before login completed
X409910CAPINM	409	cluster ca fingerprint mismatch expected={expected} got={got}
X409911CAPINC	409	pinned cluster ca changed got={got}, refusing to silently re-pin, re-pin explicitly
X500001KYCCON	500	cannot connect to keycloak {error}
X500050KCRLMP	500	realm provisioning failed for tenant {tenant} exit={exit_code} stderr={stderr}
X500051KCRLMD	500	realm deprovisioning failed for tenant {tenant} exit={exit_code} stderr={stderr}
X500052KCROLC	500	role create failed for tenant {tenant} role {role} exit={exit_code} stderr={stderr}
X500053KCROLD	500	role delete failed for tenant {tenant} role {role} exit={exit_code} stderr={stderr}
X500057FWDSEC	500	forward-auth login client secret unresolved {reason}
X500200JWKDEC	500	jwks decode failed, {error}
X500201JWKEMP	500	jwks fetch empty keyset
X500202JWKNUS	500	jwks fetch no usable signing keys
X500203JWKRSN	500	jwks rsa {param} decode failed, {error}
X500204JWKECC	500	jwks ec unsupported curve {curve}
X500205JWKECP	500	jwks ec {param} decode failed, {error}
X500206JWKKTY	500	jwks unsupported kty {kty}
X500207JWKCLM	500	jwks claims are not a JSON object
X500209AUNTRN	500	auth no http transport wired
X500210KCADMF	500	kcadm {operation} failed in {tenant} for {subject} stderr={stderr}
X500211KCADPS	500	parse kcadm output for {operation} in {tenant} failed {error}
X500906KYCLKC	500	keycloak not configured
X500910DEVNET	500	auth login request to {endpoint} failed {error}
X500911OIDPRS	500	auth login parse {stage} response failed {error}
X500913CAPINF	500	ca pin fetch failed {detail}
X500914SVCCLP	500	service client provisioning failed for {name} {detail}
X502001KYCERR	502	keycloak error {status_code}
X502002JWKSTC	502	jwks fetch status {status_code}
X502912OIDDISC	502	oidc discovery failed {detail}
X503005KYCUNA	503	keycloak unavailable {error}
X503900SVCKCN	503	system keycloak unavailable, cannot provision the service client
X503913CARTNW	503	ca root provider not wired
X503914CARTNA	503	global root ca not available {detail}
X503915OIDPUB	503	keycloak public url not resolved {detail}

Source: modules/backup/commands, modules/backup
Count: 120

Code	HTTP	Message template
X200043CNVFAL	200	converter {converter} did not complete for {stack_name}, {detail}
X200045PRPFAL	200	preparation did not complete for {stack_name}, {detail}
X200060RCVFBK	200	packaged-app extract did not succeed for {stack_name}, falling back to catalog, {detail}
X200061VLTRSK	200	vault secrets not restored for {tenant}/{stack_name}/{environment}, no candidate password decrypted the bundle, {detail}
X200062VLTXSK	200	vault secrets export skipped for {tenant}/{stack_name}/{environment}, {detail}
X200063BKPQSC	200	backup quiesce degraded for {stack_name}, {op} {error}
X200064CFGCAP	200	deployment config capture skipped for {tenant}/{stack_name}/{environment}, {detail}
X200065MAPRPL	200	mapping replay did not complete for {stack_name}, {detail}
X200066RSTPRM	200	restore could not reapply captured permissions on {mount}, {detail}
X200068HBDSKP	200	host bind {path} skipped from backup capture, {reason}
X200069SWMVSK	200	named volume {volume} skipped from backup capture, {reason}
X200070DPLREG	200	deployment re-registration did not complete for {stack_name}, {detail}
X200071BKPARC	200	backup {backup_id} master archive build failed, {detail}
X200072BKPFGT	200	backup {backup_id} row deleted but its backing data at {location} could not be removed, {detail}
X200073MFSKIP	200	manifest dump skipped for backup {backup_id}, {detail}
X200075MANSKP	200	manifest inventory check skipped for backup {backup_id}, {detail}
X200076BKPLSE	200	reclaimed stale backup lease for {tenant}/{stack_name}, backup {backup_id} had not heartbeated for {stale_seconds}s and was blocking backup/uninstall
X200077RSTJSK	200	restore job {job} skipped, its converter input(s) {converters} are not carried by this archive, {reason}
X200078BKPLIV	200	backup {backup_id} was not captured as a consistent point-in-time ({state}), restoring anyway
X400048RCVINP	400	invalid recover input {op} {error}
X400049RCVMAN	400	failed to load manifest from {path}, {op} {error}
X400402BKPRUN	400	backup already running for stack {stack_name}, held by {holder}
X400403BKPFAL	400	backup failed {op} {error}
X400404RSTRFL	400	restore failed {op} {error}
X400405BKPINV	400	backup {backup_id} is invalid {op} {error}
X400407BKPIDR	400	at least one backup_id is required
X400415IMPFAL	400	import failed {op} {error}
X400430BKPMUT	400	exactly one of —id, —file, or —before is required
X400431BKPCDP	400	cannot use both —all-connected and —with-dependants
X400432BKPMOD	400	cannot use both —stop and —fail
X400433BKPGRF	400	cannot use —file with graph flags
X400434BKPIDS	400	at least one —backup id or -b is required
X400435BKPMTI	400	one of —id or —file is required
X400437BKPSTK	400	—stack required
X400438BKPSTH	400	SHC_STATE_HOME not set
X400440RCVPRT	400	recover plan port conflict {detail}
X400441BKPSGO	400	cannot combine -s/—stack with —with-connected/—with-dependants, a group restore targets each member’s own recorded stack
X400800BKNOMN	400	invalid backup archive, missing manifest.json {error}
X400801BKINVJ	400	corrupt manifest {error}
X400802BKGCNF	400	consistency id mismatch, expected {expected}, found {mismatched}
X400803BKGINV	400	invalid .bkg file {op} {error}
X400804BKGEMT	400	.bkg file contains no backups
X400805EXPFAL	400	export from restic failed {reason}
X400806IMPFAL	400	import to restic failed {reason}
X400817MTSNWR	400	mount session {session_id} is not writable
X400818MTSPTH	400	invalid path {path} in mount session {error}
X400822MTSSRC	400	invalid mount source {source} {detail}
X400830MTSPRC	400	restic mount subprocess failed to start {detail}
X400850BKMARH	400	invalid AR archive header
X400851BKMARS	400	invalid AR header size {size}
X400852BKMART	400	invalid AR header terminator
X400854BKMIDX	400	empty backup index
X400860VLMREQ	400	invalid volume mount request {detail}
X400862PDMREQ	400	pod mount request requires a container id
X400865VOLSOV	400	restore storage override {storage} cannot be honored {reason}
X400867RSTEMPT	400	restore verification failed for mount {mount}, backup had data but the restored volume is empty, replay did not land
X400868RSTJOBM	400	restore verification failed for job {job} target mount {mount}, the converter snapshot had data but the target is empty, restore job did not land it
X400869RSTMISM	400	restore verification failed for backup {backup_id}, {detail}
X400870CNVIMG	400	backup job {name} image template {template} rendered empty, the deployment vars context could not resolve it, refusing to invoke docker
X400972INVCRN	400	invalid cron expression {detail}
X400973RLBKTM	400	invalid time format {time}
X404050OPRNOF	404	operation {operation_id} not found
X404400BKPNOF	404	backup {backup_id} not found
X404401STKNOF	404	stack {stack_name} not found
X404403BKFNOF	404	backup file not found {path}
X404410BKPCST	404	no backups found with consistency_id {consistency_id}
X404413RSTNOF	404	restic snapshot {snapshot_id} not found
X404415REPONF	404	repository not found {repo}
X404439BKPNOB	404	no backups found
X404800RLBKNF	404	no backup found for stack {stack_name} before {before}
X404816MTSNOF	404	mount session {session_id} not found
X404819MTSFNF	404	file {path} not found in mount session
X404831MTSNOH	404	no active mount handle for {handle}
X408419RSTTMO	408	restic operation timed out after {timeout} seconds
X408821MTSEXP	408	mount session {session_id} has expired
X409409BKPCST	409	backups have different consistency ids and cannot be grouped
X409866HBDCON	409	host bind restore conflict for {path}, {detail}
X409867HBDATT	409	host bind restore refused to wipe {path} for stack {stack}, {detail}
X500042RCVFAL	500	recovery failed for {stack_name}, {op} {error}
X500045RCVCYC	500	recover deploy scheduler dependency cycle among {stacks}
X500047RSTJOB	500	restore {phase} job failed {error}
X500051SSEFAL	500	sse stream failed {detail}
X500065BKPQAB	500	backup capture aborted for {stack_name}, consistency-expected pause failed {error}
X500410RSTERR	500	restic command failed {detail}
X500411EXPFIL	500	export failed {op} {error}
X500412RSTLCK	500	restic repository is locked {detail}
X500414RSTPAS	500	restic authentication failed {detail}
X500415RSTBKN	500	failed to connect to restic backend {detail}
X500417RSTPRN	500	restic prune failed {detail}
X500418RSTRST	500	restic restore failed {detail}
X500420CACHSY	500	failed to sync backup cache {detail}
X500430BKPCMR	500	read compose failed {error}
X500431BKPMKD	500	mkdir backup dir failed {error}
X500432BKPSNV	500	snapshot volumes failed {op} {error}
X500433BKPUNT	500	untar failed {error}
X500434BKPCUP	500	post-restore docker compose up failed {error}
X500435BKPSNS	500	snapshot {volume} failed {error}
X500437BKPVRS	500	restore {volume} failed {error}
X500439BKPNDR	500	no backups dir for stack {error}
X500440BKPDKR	500	docker {args} failed {error} {output}
X500440BKPSDR	500	docker sidecar operation failed {error} {stderr}
X500441BKPRSC	500	restic exited {error}
X500442BKPSQL	500	{operation} failed {error}
X500443BKPEXP	500	backup export {op} {error}
X500444BKPDCL	500	backup daemon client {op} failed {error}
X500446BKPDHT	500	backup daemon response status {http_status} {error}
X500447SWMVCP	500	named volume capture failed for {volume} {reason}
X500450SWMQSC	500	swarm stack quiesce failed for {project} {reason}
X500820MTSOPF	500	mount operation failed {op} {error}
X500823MTSCMT	500	mount commit failed {op} {error}
X500833MTSUMT	500	umount failed for {path} {detail}
X500861VLMRMT	500	remote volume on node {node} could not be exposed {error}
X500862VOLCAP	500	volume backed capture failed for {mount} on node {node} {reason}
X500863PDMSNP	500	container filesystem snapshot failed {detail} {error}
X500863VOLINL	500	volume backed capture too large to inline for {mount} {size_bytes}
X500864VOLPRV	500	provision before restore failed for {mount} provider {provider} {reason}
X500934RLBKPR	500	failed to create pre-rollback backup {error}
X500935RLBKRS	500	rollback failed during restore of {stack_name} {error}
X501400UNGFIL	501	ungroup endpoint requires file upload
X501832MTSPLT	501	fuse mount unsupported on platform {platform}

Source: modules/ca/caapi, modules/ca
Count: 21

Code	HTTP	Message template
X200106CAESCD	200	best-effort delete of pfSense-side CA copy failed for tenant {tenant} ref {ref}, remove it manually
X200107CAKEYT	200	keyType is advisory for key-escrow and was ignored for tenant {tenant} so the backend chose the algorithm
X200109CAINTX	200	tenant CA {tenant} intermediate nears expiry on signer connection {conn}, reprovision before it lapses
X200110CARPRV	200	tenant {tenant} CA re-provisioned, clients trusting the old root must install the new one
X200114GRTRMT	200	global root re-minted to recover a keyless trust anchor, clients trusting the old root must install the new one
X400101CATENT	400	certificate authority requires a non-empty tenant
X400102CAMANL	400	manual CA import invalid {op} {error}
X400111CARPSR	400	invalid reprovision source {detail}
X400113CARSVD	400	tenant ca name {name} is reserved for a system ca
X404112CACRTN	404	no certificate found for name {name}
X500096CAGENM	500	failed to mint CA material {op} {error}
X500097CALEAF	500	failed to sign leaf certificate {op} {error}
X500098CASTOR	500	failed to store CA for tenant {tenant} {op} {error}
X500099CALOAD	500	failed to load CA for tenant {tenant} {op} {error}
X500100CAVLTU	500	vault is not available so CA private keys cannot be stored or read
X500103CASGNU	500	ca-signer backend not available for tenant {tenant} connection {conn}
X500104CASIGN	500	failed to csr-sign intermediate for tenant {tenant} {op} {error}
X500105CAESCR	500	key-escrow CA operation failed {op} {error}
X500108CAWEDG	500	tenant CA {tenant} is wedged with keys absent for provenance {provenance}, run shc ca reprovision
X503090GRTNRD	503	global root not ready {op} {error}
X503113CANDNI	503	per-node leaf enrichment is not yet wired, the node.pem summaries live per-node on disk and need a cluster-membership cert-summary seam

Source: modules/capabilities
Count: 2

Code	HTTP	Message template
X500211CAPFTC	500	capabilities no fetcher provided
X503940CAPDIS	503	{command} requires the ‘{feature}’ feature, which is not available on this SHC instance. Deploy the backing system app (e.g. shc install keycloak for user-management features) and try again.

Source: modules/clone
Count: 27

Code	HTTP	Message template
X400600CLNCON	400	stack {name} has connections
X400602CLNCAN	400	{operation} cancelled
X400608CLNRNT	400	invalid runtime {runtime}, expected one of compose, swarm, or podman
X400615CLNENT	400	cannot move entry-point deployment {name} to node {node}, every managed DNS record points at the ingress host and the move path performs no DNS re-point, reinstall it on the target instead with shc install {name} -t master —node {node} and the leader ingress reconcile re-points DNS
X400619CLNDLM	400	presumed-dead refused, deployment {name} has local-only persistent mounts [{mounts}] whose data lives only on the dead node, pass —discard-local to abandon them
X400620CLNDSC	400	presumed-dead move not supported, {reason}
X404600CLNSRC	404	stack {name} not found
X404607CLNNOD	404	node {node} not found
X409600CLNCOL	409	stack {name} already exists in {tenant_name}/{environment}
X409601CLNAUF	409	could not generate unique name for {stack_name} after 100 attempts
X409617CLNDND	409	presumed-dead refused, node {node} cluster_state is {state} not unreachable, if the node is up use a plain move
X409618CLNDPR	409	presumed-dead refused, node {node} answered a probe at {addr}, it is alive, use a plain move
X409621CLNDUR	409	presumed-dead refused, surviving volume for mount {mount} on provider {provider} cannot attach to target node {node}, pick a node that can reach it
X409623CLNPRO	409	move refused, deployment {tenant}/{stack} is protected, run shc unprotect {stack} first
X409624CLNPRU	409	move refused, cannot determine whether {tenant}/{stack} is protected ({reason}), refusing rather than risk destroying protected data
X500601CLNROL	500	rollback failed {reason} {error}
X500602CLNBKP	500	backup failed during clone/move {op} {error}
X500603CLNRCV	500	recovery failed during clone/move {op} {error}
X500604CLNUNI	500	uninstall failed during move {reason} {error}
X500605CLNRNM	500	rename failed {op} {error}
X500609CLNRND	500	clone random suffix failed {error}
X500610CLNFAL	500	{operation} failed {error}
X500612CLNREQ	500	{operation} request failed for {source}
X500613CLNRPF	500	{operation} reported failure
X500614CLNNWR	500	{operation} service not wired
X500616CLNMOV	500	deployment move step failed {op} {error}
X500622CLNDMV	500	presumed-dead move step failed {op} {error}

Source: modules/cluster
Count: 51

Code	HTTP	Message template
X200028SWMJNW	200	swarm join warning during mesh enrollment {op} {error}
X200029MSHRTW	200	mesh peer {host} {path} attempt {attempt} failed, retrying {error}
X200030JNSELF	200	enroll for {node} resolved the joiner’s own raft address {raft_addr} as its join address, dropping it, this node cannot see the cluster leader
X200044CRTCHK	200	cluster cert rotation check failed {op} {error}
X200948CRTRLD	200	internal api mtls leaf reload failed {error}
X400021ALRCLS	400	this node is already part of a cluster
X400022INVTKN	400	invalid or expired join token {reason} {error}
X400042VLTLKD	400	vault is locked, unlock with shc vault then re-run shc init
X400064VLTPWS	400	vault master password must be at least {min} characters
X400400CLSDRN	400	invalid drain request for node {node}
X401022TKNCNS	401	bootstrap token already consumed for node {node_name}
X401023TKNEXP	401	bootstrap token expired for node {node_name}
X401047CRTIDM	401	cert rotation rejected, caller identity does not match any registered node {reason} {node}
X403003LDRNLY	403	operation requires the cluster leader, current leader is {leader}
X403092ENRSIP	403	enrollment rejected, claimed physical_ip {claimed} does not match connection source {source}
X404020CLSNOF	404	cluster node {name} not found
X404028NODNOF	404	node {name} not found in cluster
X404201CLSNNF	404	cluster member {name} not found in raft membership
X408400CLSDRT	408	drain timed out waiting for deployments to clear
X409025LVDEPS	409	cannot leave, this node still hosts {count} deployments, drain or move them first with shc node drain <node> or re-run with —force to leave anyway
X409200CLSQUR	409	refusing to demote, {voters_after}/{required} voters would remain
X409201CLSRMQ	409	refusing to remove voter, {voters_after}/{required} voters would remain
X409202CLSRMR	409	refusing to remove voter, {reachable_after}/{required} reachable voters would remain
X409400CLSDRD	409	node {node} is already drained
X409400CLSREC	409	force-leader recovery already in progress
X500021CLSINT	500	cluster internal error {op} {error}
X500022CERGEN	500	failed to generate certificate {op} {error}
X500023JNFAIL	500	failed to join cluster {op} {error}
X500024LVFAIL	500	failed to leave cluster {reason} {error}
X500025NODREM	500	failed to remove node {op} {error}
X500026SWMLVE	500	failed to leave docker swarm {reason}
X500027RMLVFL	500	failed to request remote leave for node {name} {reason} {error}
X500028TKNGEN	500	failed to generate join token {op} {error}
X500046CRTCAU	500	cert rotation failed cluster ca unavailable {op} {error}
X500047CACSTR	500	cluster ca store {op} {error}
X500048CACUNP	500	cluster CA not provisioned {reason}
X500049CAROTF	500	cluster CA rotation {op} {error}
X500051GRROTF	500	global root rotation {op} {error}
X500201CLSREC	500	force-leader recovery failed {op} {error}
X500202CLSPRO	500	promote to voter failed {error}
X500203CLSDEM	500	demote from voter failed {error}
X500211RFTTLF	500	raft tls required by this cluster but node cert material is unavailable, re-run shc node join —force {error}
X500400CLSDRO	500	drain failed for node {node} {reason} {error}
X500911RNDFAL	500	os entropy source unavailable {error}
X500912CRTATM	500	atomic cert write {step} {error}
X503069MSHIPW	503	failed to persist mesh_ip for node {node_id} {error}
X503070RCNDMN	503	daemon not reachable {error}
X503076MSHRTY	503	mesh peer {host} did not answer {path} after {attempts} attempts over {budget} {error}
X503090CLSJNP	503	joiner {node} raft port {raft_addr} unreachable from leader, join cannot converge until reachable
X503091CCAJNW	503	joiner awaiting leader cluster CA {reason} {error}
X503200RFTTLW	503	raft tls enabled but cert material not yet on disk, starting raft in plaintext for this bring-up only, will pick up tls on next restart {error}

Source: modules/collector
Count: 2

Code	HTTP	Message template
X503120COLRCN	503	per-node collector reconcile failed at {step} — {reason} — retrying on the next sweep
X503121COLEXG	503	collector export is disabled by the license.offline policy — {posture}

Source: modules/completion
Count: 2

Code	HTTP	Message template
X400009INVSHL	400	unsupported shell {shell}
X500700FILWRT	500	completion cannot write {path}, {err}

Source: modules/config
Count: 7

Code	HTTP	Message template
X400002VALINP	400	invalid input {detail}
X400033CFGUNK	400	config key {path} is not a known configuration key, possible typo, value stored anyway
X400041INVSCP	400	invalid scope {scope}
X400050CFGSTP	400	config key {path} can only be set in yaml config files
X400905SCPREQ	400	{field} is required
X400949UNKSCP	400	unknown scope {scope}
X500952CFGOVL	500	config overlay {op} failed {error}

Source: modules/connections
Count: 14

Code	HTTP	Message template
X200909DNSZUNS	200	declared zone {zone} not manageable by provider, dropping it
X400901CONTYP	400	unknown connection type {type}
X400904CONCRD	400	connection type {type} requires credential {field}
X400906DNSZREQ	400	local DNS connection requires at least one —zone
X400908DNSCRED	400	dns connection {type} credentials failed to validate
X400916CONBND	400	grant boundary for connection {connection} is not valid json
X400921CONMNT	400	connection {connection} failed to mint capability {capability}
X403910CONGRT	403	connection {connection} not granted capability {capability} for tenant {tenant}
X404902CONNOF	404	connection {name} not found
X404911CONMCP	404	connection type {type} cannot mint capability {capability}
X404915CONGNF	404	no grant for connection {connection} capability {capability} tenant {tenant}
X409903CONUSE	409	connection {name} is in use by {where}
X409907DNSZTIE	409	zone {zone} already managed by connection {other}
X503905CONVLT	503	vault is not available, cannot store connection credentials

Source: core/api
Count: 11

Code	HTTP	Message template
X200067QRYTOK	200	query-string token used for auth on {path}, prefer the Authorization header
X401000UNAUTH	401	internal api requires a cluster-ca client certificate or the internal token
X403038LICLCK	403	estate changes are locked, {reason}, refusing {path}, running workloads keep serving and backups stay downloadable, run shc license status for what to do
X500040CMDFAL	500	command failed with exit {exit_code}, {command} {stderr}
X500079FSMKDR	500	mkdir failed at {path}, {detail}
X500083APILSN	500	listen {name} on {addr} failed, {error}
X500084APIUDS	500	listen unix {path} failed, {error}
X500085APICHM	500	chmod {path} failed, {error}
X500086APIEXT	500	{name} listener exited {error}
X503906VLTLCK	503	vault is locked, refusing {path}, run shc vault unlock
X503907QRMLST	503	raft quorum unavailable, refusing {path}, retry once the cluster is healthy

Source: core/collectorcfg
Count: 1

Code	HTTP	Message template
X500110COLCFG	500	collector config render failed {reason}

Source: core/config
Count: 1

Code	HTTP	Message template
X400035REFEMB	400	config key {key} contains an embedded secret-ref which is not resolved, only whole-value refs resolve

Source: core/daemonclient
Count: 4

Code	HTTP	Message template
X403933DMNACC	403	permission denied opening the shc daemon socket
X500932DMNRPC	500	daemon client {op} failed
X502932DMNRSP	502	daemon returned an error response {daemon_status}
X503931DMNDWN	503	the shc daemon is not reachable on this node{dial_clause}

Source: core/db/rqlitedriver, core/db
Count: 31

Code	HTTP	Message template
X500929DBSNAP	500	control-plane db snapshot failed {error}
X500959MIGNVF	500	migration integrity verification disabled by escape hatch
X500960DBOPEN	500	failed to open database handle {error}
X500961DBPING	500	failed to ping database handle {error}
X500963MIGRDF	500	failed to read migration {name} {error}
X500964MIGTBL	500	failed to create migrations table {error}
X500965MIGCHK	500	failed to check migration {name} {error}
X500967MIGAPL	500	failed to apply migration {name} {error}
X500968MIGREC	500	failed to record migration {name} {error}
X500970MIGSCN	500	failed to scan migrations rowset {error}
X500971MIGITR	500	failed to iterate migrations rowset {error}
X500972MIGWLK	500	failed to walk migrations fs {error}
X500973MIGSQH	500	migration {name} conflicts with an existing schema, this database predates a pre-1.0 migration flatten and cannot be upgraded in place, wipe the state directory and reinstall {error}
X500974DBTIMS	500	db.Time cannot scan {type} into time
X500975DBTIMP	500	db.Time cannot parse {value} with any known sqlite layout
X500981DBMAIN	500	db maintenance pool not initialised
X500982DBANLZ	500	db ANALYZE failed {error}
X500983DBVACM	500	db VACUUM failed {error}
X500984MIGSNS	500	migration {name} not listed in atlas.sum
X500985MIGLDG	500	applied migration {name} drifted, ledger checksum {want} but on-disk content is {got}
X500986MIGSUM	500	migrations atlas.sum missing or invalid {error}
X500987MIGSTL	500	atlas.sum entry {name} has no matching migration file
X500988MIGSHA	500	migration {name} checksum mismatch, atlas.sum records {want} but file hashes to {got}
X500989MIGALT	500	failed to extend migrations ledger {error}
X501004BATBGN	501	failed to begin atomic batch {error}
X501005BATSTM	501	atomic batch statement {index} failed {error}
X501006BATCMT	501	failed to commit atomic batch {error}
X501007RQLNTX	501	rqlite engine has no interactive transactions, {op} refused, use db.Pool.Batch for multi-statement atomicity
X501008RQLBAT	501	rqlite atomic batch request failed {error}
X501023RQLNPM	501	rqlite named parameters unsupported in statement {statement}
X501032RQLNAK	501	rqlite returned {returned} of {statements} statement results for {op} with error {error}, the outcome is unknown and the statements may not have committed

Source: core/eegate
Count: 1

Code	HTTP	Message template
X403026DMNEEO	403	{feature} requires the commercial shc daemon, the daemon at {endpoint} is the community daemon — point at a commercial shc cluster or install the commercial shc package on that node

Source: core/eestub
Count: 1

Code	HTTP	Message template
X403028CLIEEO	403	shc {command} requires SHC EE, this binary is the community edition

Source: core/enginemarker
Count: 1

Code	HTTP	Message template
X500020ENGMKR	500	engine marker read failed {reason}

Source: core/hostactivate
Count: 2

Code	HTTP	Message template
X403027CLIPRV	403	shc {verb} must run as root, re-run as sudo shc {verb} or set SHC_STATE_HOME for a rootless dev sandbox
X500978PODDRP	500	podman systemd drop-in setup failed at {step} {error}

Source: core/jinja
Count: 7

Code	HTTP	Message template
X400500JNJMAP	400	jinja path {path} traversal blocked, {key} is not a map
X400501JNJKEY	400	jinja path {path} traversal blocked, key {key} missing
X400502JNJLOAD	400	jinja template loading is disabled, refused {ref}
X400503JNJBIG	400	jinja render exceeded the {limit} byte output cap
X400504JNJTIME	400	jinja render exceeded the {limit} time budget
X400505JNJPANIC	400	jinja render panicked: {detail}
X400506JNJCAP	400	jinja strict-undefined inventory is partial, {dropped} of {examined} references were not examined

Source: core/nic
Count: 2

Code	HTTP	Message template
X400992NICNOF	400	interface {name} not found or has no IPv4 address
X500930NICDET	500	network interface detection failed {reason}

Source: core/openstack
Count: 3

Code	HTTP	Message template
X400335OSKCFG	400	openstack auth config invalid, {reason}
X404325OSKEPT	404	openstack service {service} endpoint not found in catalog for region {region} interface {interface}
X502335OSKAPI	502	openstack api call {op} failed http {status} {detail} {error}

Source: core/rqlited
Count: 21

Code	HTTP	Message template
X501009RQDBIN	501	rqlited binary not found, install the shc package or set SHC_RQLITED_BIN
X501010RQDSTR	501	rqlited exited during startup with code {code} {error}
X501011RQDTMO	501	rqlited not ready within {timeout}
X501012RQDCFG	501	rqlited manager misconfigured {reason}
X501013RQDSPN	501	failed to spawn rqlited {error}
X501014RQDBOO	501	rqlite /boot ingest of {path} failed {error}
X501015RQDBKP	501	rqlite backup to {path} failed {error}
X501016RQDLDR	501	rqlite leader/roster query failed {error}
X501020RQDCRA	501	rqlited exited unexpectedly with code {code}, relaunching
X501021RQDRLF	501	rqlited relaunch failed, retrying {error}
X501022RQDRNR	501	relaunched rqlited not ready {error}
X501024RQDPRB	501	rqlited readiness probe {url} returned HTTP {status}
X501025RQDGET	501	rqlite api GET {url} returned HTTP {status} {body}
X501026RQDMKR	501	engine flip marker {marker} not removed {error}
X501027RQDPRA	501	rqlite promote retry abandoned, cluster has {nodes} members and the ingest window is gone, continuing as a member on {sqlite}
X501028RQDDMF	501	cluster scaled back to one node, storage engine demoted to plain sqlite on {sqlite}, scheduling daemon restart to complete the flip
X501029RQDPMF	501	storage engine promoted to rqlite for the joining node, marker {marker} written, scheduling daemon restart to complete the flip
X501030RQDDGR	501	rqlite engine started degraded, rqlited not ready within startup budget, retrying bring-up in background {error}
X501031RQDNRD	501	rqlite engine not ready, background bring-up in progress
X501034RQDSLF	501	cluster join addresses named this node’s own raft address {addr}, dropping it, rqlited cannot join itself
X501035RQDNOJ	501	no raft join address left for the joining node in {state}, re-run shc node join against the cluster leader

Source: core/validation
Count: 2

Code	HTTP	Message template
X400982NAMINV	400	invalid {kind} name {name}, {reason}
X500982VLDINT	500	validation internal error {error}

Source: core/volume
Count: 22

Code	HTTP	Message template
X400310VOLCOL	400	invalid mount spec {spec}, too many colon-separated fields
X400311VOLAXS	400	invalid mount spec {spec}, malformed access field
X400312VOLEXT	400	invalid mount spec {spec}, unexpected field {field}
X400313VOLPRM	400	invalid mount spec {spec}, perm field {field} is not numeric
X400314VOLFLD	400	invalid mount spec {spec}, too many trailing fields
X400315VOLOWN	400	invalid mount spec {spec}, owner field mismatch uid {uid} gid {gid}
X400316VOLEMP	400	apply prep called with empty source
X400317VOLPMD	400	parse mode {mode} failed, {error}
X400318VOLMOD	400	empty mode string
X400319VOLUID	400	parse uid {uid} failed, {error}
X400321VOLGID	400	parse gid {gid} failed, {error}
X403322VOLSMT	403	absolute mount source {source} is not permitted for tenant {tenant}
X403323VOLESC	403	mount source {source} escapes the deployment sandbox
X403325VOLPMU	403	mount source {source} is not a platform mount, known: {known}
X403326VOLPMW	403	platform mount {source} must be mounted read-only (append :ro)
X409034VOLNMT	409	refusing volume prep, {path} is not a confirmed mountpoint, attach may have silently failed
X500310VOLCMD	500	{op} {path} failed {error}
X500311VOLOWR	500	resolve owner {owner} failed {error}
X500312VOLUSR	500	user lookup {user} failed, {error}
X500313VOLGRP	500	group lookup {group} failed, {error}
X500314VOLMDR	500	resolve data mount failed, MountsDir not set
X500316VOLMNT	500	mountpoint check for {path} failed, {error}

Source: modules/ctx
Count: 3

Code	HTTP	Message template
X404903CTXNAC	404	no active cluster, {detail}
X500900CTXIOF	500	contexts.yaml {op} failed {error}
X500901CTXFMT	500	context file format invalid {error}

Source: daemon
Count: 41

Code	HTTP	Message template
X400446AWSCRD	400	connection is missing the access_key or secret_key admin credential
X500445RSTSWM	500	swarm volume replay failed for {project} {reason}
X500448AWSMNT	500	aws s3 mint {step} failed {error}
X500449AWSIAM	500	aws iam mint {step} failed {error}
X500623CLNXFR	500	clone recover could not ship the deployment to target node {node}, {reason}, refusing to restore on the source node and report a move that did not happen
X500912KCTRPL	500	keycloak trust pool unavailable {reason}
X500913KCDIAL	500	keycloak backchannel refused dial to non-SHC_HOST address {addr}
X500914KCNOSH	500	managed keycloak requires SHC_HOST but it is unset
X500992DMLOCK	500	another shcd already holds the singleton lock {path}, refusing to start a second instance
X500994DMCNFG	500	daemon config load failed {error}
X500995DMDBOP	500	daemon db.Open failed {error}
X500996DMRALC	500	daemon subsystems.RegisterAll failed {error}
X500997DMRAPN	500	daemon panic during RegisterAll {detail}
X500998DMWIRE	500	daemon lifecycle.Wire failed {error}
X500999DMMKDR	500	daemon mkdir {path} failed {error}
X503054OTLINI	503	otel init failed, continuing without telemetry {error}
X503055SUBSTP	503	subsystem stop returned error {error}
X503056OTLSHD	503	otel shutdown error {error}
X503059DNSCFG	503	dns service skipped, nil config
X503060QTANPL	503	quota service skipped, nil db pool
X503061RPONPL	503	repo service skipped, nil db pool
X503062RETNPL	503	retention service skipped, nil db pool
X503063SRCNPL	503	search service skipped, nil db pool
X503064CLSNPL	503	cluster service wired without pool, node repo unavailable
X503065CENRSK	503	cluster enroll handler skipped, cert provider or node repo unavailable
X503066MSHNRG	503	mesh orchestrator skipped, node registry not wired
X503067MSHNPC	503	mesh orchestrator skipped, peer client not wired
X503068MSHCST	503	mesh orchestrator construct failed {error}
X503069VLTAUS	503	vault audit writer skipped, audit service not wired
X503070QTANPL	503	quota cron deps skipped, nil db pool
X503071STKMVS	503	stack move translator skipped, runtime state nil
X503073PEERHTT	503	internal-API peer call failed {host} {path} {op} {error}
X503074PEERCRT	503	internal-API peer client cert load failed {op} {error}
X503074SCLWIN	503	x-shc-scale window scaling service {service} failed {error}
X503075STKCTL	503	backup stack-controller {op} failed for {project} {error}
X503077CASRCR	503	ca-signer connection cred read hit a transient vault fault for tenant {tenant} connection {conn} field {field} {error}
X503078LDRNDL	503	leader internal-address resolve could not list the node table, falling back to the raft-host heuristic {error}
X503084OTLNOA	503	managed openobserve destination resolved with no auth header on this node, every export will 401 and be dropped until the vault unlocks here
X503085SHFSMT	503	shared-fs rebind of mount {mount} approved via provider link rows only, client mount for {provider} on target node {node} is unverified
X503086VOLORF	503	volume {volume} mount {mount} provider {provider} is orphaned after move, cloud volume not deleted, verify and clean up with shc volume rm {volume}
X503097USRNPL	503	user service skipped, nil db pool

Source: modules/dns/dnsapi
Count: 29

Code	HTTP	Message template
X200904DNSTDN	200	dns record write skipped for host {host}, cluster teardown release already ran
X200905DNSRLZ	200	cluster teardown release reached zero dns zones, {hosts} intended hostnames were not released
X400032DNSZON	400	dns zone not found for domain {domain}
X400034DNSTGT	400	cannot resolve target {target} to ip or hostname
X400036DNSMAN	400	no dns provider manages zone for {hostname}
X400110DNSZNC	400	zone_id must be set on record for create
X400111DNSZNU	400	zone_id must be set on record for update
X400112DNSZND	400	zone_id must be set on record for delete
X400113DNSZNO	400	zone_id must be set on record for create_or_update
X400114DNSSET	400	set_records requires at least one content, use delete to clear an rrset
X400922DNSUNK	400	unknown dns provider {provider}
X400926DNSREQ	400	{config_key} is required for {provider} dns provider
X403040DNSOWN	403	dns records for host {host} owned by {found_owner} not {owner}
X403041DNSUNO	403	no ownership txt for host {host}, refusing to delete unowned records
X403042DNSPRN	403	skipping prune of unowned {record_type} record {content} for host {host}
X403043DNSRPP	403	skipping reap of pinned host {host}
X403044DNSRPL	403	leaving legacy-owned host {host} alone, ownership cannot be proven for {owner}
X403045DNSLGD	403	releasing legacy-owned host {host} under owner {owner}
X403046DNSTKO	403	taking over dns records for host {host} from predecessor {found_owner} as {owner}
X404038DNSZNF	404	no dns zone manages host {host}
X404039DNSREC	404	no dns record found for host {host}
X503030DNSAPI	503	dns provider api error {detail} {error}
X503031DNSCFG	503	no dns provider configured
X503032DNSACT	503	dns provider async action {action_id} for {detail} still running after {budget}, the write is queued not lost, later zone writes and acme dns-01 challenges may be delayed behind it
X503033DNSUPD	503	rfc2136 dynamic update failed {detail} {error}
X503034DNSRPS	503	dns reap refused, no managed hostname source is wired
X503035DNSRPK	503	dns reap refused, managed hostname read failed {error}
X503036DNSRPZ	503	dns reap refused, managed hostname set is empty
X503037DNSRPB	503	dns reap refused, {orphans} of {total} owned hosts would be deleted, pass force to override

Source: modules/docker
Count: 11

Code	HTTP	Message template
X400060CTRINP	400	invalid docker request {reason}
X400067CTRFSP	400	invalid container fs request {reason}
X404060CTRNOF	404	container {container} not found
X404061CTRFSF	404	path {path} not found in container {container}
X500061DKRCFG	500	docker client configuration error {reason}
X500062DKRCLL	500	docker {operation} failed {reason}
X500063CMPFAL	500	docker compose {subcommand} exited {exit_code} {reason}
X500064EXCFAL	500	docker exec on {container} failed {reason}
X500065EVCNCT	500	docker events channel closed {reason}
X500066EVCMAX	500	docker events {attempts} consecutive reconnect failures
X500067CTRFSO	500	container fs {op} on {container} failed {reason}

Source: modules/doctor
Count: 4

Code	HTTP	Message template
X500917DCROPF	500	doctor {operation} failed
X500918DCRNWR	500	doctor diagnose dependency not wired {dep}
X503919DCRKCD	503	system keycloak not running, {check} skipped
X503920DCRNAV	503	doctor fixes require a running daemon

Source: modules/events
Count: 6

Code	HTTP	Message template
X403917EVTTNT	403	tenant scope required for event subscription
X500007EVTBUS	500	event bus not running, {reason}
X500015EVTBCS	500	event broadcaster {stage} failed {error}
X500016EVTHND	500	event handler panicked {reason} {error}
X500017EVTPRN	500	events_log prune failed {op} {error}
X503010QUEFUL	503	queue at capacity {depth}/{max_depth}, task {name} rejected

Source: modules/export
Count: 18

Code	HTTP	Message template
X400501EXPINV	400	invalid exporter configuration {detail} {error}
X400503IMPREQ	400	missing required import parameter {param}
X400504EXPREQ	400	missing required export parameter {param}
X400505IMPJOB	400	import job {job_name} failed {error}
X400507NOEJOB	400	exporter {exporter_name} has no exporter jobs defined
X400508NOIJOB	400	exporter {exporter_name} has no importer jobs defined
X400509ARERRO	400	ar archive error {op} {error}
X400515WRPSPC	400	wrap spec malformed {spec}
X400516EXPNDR	400	data dir {path} is not a directory
X400516WRPNOF	400	wrap input not found {path}
X404500EXPNFD	404	exporter {exporter_name} not found in stack {stack_name}
X500511EXPRUN	500	export run failed {reason} {error}
X500512IMPRUN	500	import run failed {reason} {error}
X500513EXPNST	500	export service not wired
X500514EXPSTR	500	export stream failed {reason} {error}
X500515EXPCKM	500	data checksum mismatch got {got} want {want}
X500517WRPSTG	500	wrap staging failed {reason} {error}
X500518EXPLST	500	export list failed {dir} {error}

Source: modules/fabric/policy, modules/fabric
Count: 20

Code	HTTP	Message template
X200357FABNKY	200	node {name} enrolled without a fabric public key, no fabric /24 allocated, re-enroll with a fabric-capable cli to repair
X200361FABGLU	200	fabric host firewall glue not installed, cross-node container traffic may be dropped, {reason}
X200368FABASP	200	fabric anti-spoof guard not in force, a container can forge a co-located fabric address, {reason}
X200369FABCTN	200	fabric address claimed by more than one bridge port and left unpoliced, this is a runtime fault or a deliberate attempt to disable the anti-spoof guard, {reason}
X400350FABSEL	400	fabric {fabric} does not allow runtime {runtime}, {reason}
X400351FABCID	400	fabric cidr {cidr} is unusable, {reason}
X400355FABKEY	400	fabric wireguard key for {holder} is invalid, {reason}
X400356FABMOD	400	unknown fabric {fabric}, must be one of swarm|shc|none
X400364FABPOL	400	fabric policy input invalid, {reason}
X400365FABTEN	400	fabric policy tenant boundary violation, {reason}
X409358FABNON	409	node {name} cannot join, the cluster fabric is none which allows a single node only, re-init with —fabric swarm or shc for multi-node
X500352FABREP	500	fabric allocation repository error {op}{error}
X500353FABFUL	500	fabric cidr {cidr} has no free node /24 left, tombstoned subnets are never reused, re-init with a wider fabric cidr
X500354FABDEV	500	fabric wireguard device {op} failed{error}
X500359FABPIN	500	fabric service pin error {op}{error}
X500360FABBRG	500	fabric bridge {name} could not be ensured{error}
X500362FABPST	500	cluster fabric posture error {op}{error}
X500363FABPFL	500	node {node} has no free fabric service address left, all {capacity} are pinned, move stacks off this node or re-init with a wider fabric cidr
X500366FABVFY	500	fabric policy ruleset failed self-verification, {reason}
X500367FABPCY	500	fabric policy {op} failed{error}

Source: modules/forms
Count: 2

Code	HTTP	Message template
X400213HUDFAB	400	interactive form cancelled
X500214HUDFRN	500	interactive form failed, {error}

Source: modules/forward
Count: 8

Code	HTTP	Message template
X400084INVSRN	400	invalid service name {name}
X400086EMTFWD	400	empty forward specification
X400088FWDPRT	400	invalid port {port}
X400089FWDPRR	400	invalid port {port}, must be 1-65535
X400090FWDFMT	400	invalid forward specification format {spec}
X400091FWDINF	400	cannot infer port for service {service}, {detail}
X400910FWDREQ	400	forward requires {reason}
X500910FWDOPF	500	forward operation failed {reason}

Source: modules/health/reconcile, modules/health
Count: 11

Code	HTTP	Message template
X200506OTLPST	200	managed openobserve OTLP provider persisted to the boot config drop-in and global config, restart the daemon to attach the auth header and enable authenticated ingest
X200507OTLPDG	200	managed openobserve OTLP provider persisted to global config only, a restart will not attach the auth header, set otel.provider in config.yaml to enable authenticated ingest
X200508OTLPLV	200	managed openobserve OTLP auth attached to the running exporter, authenticated ingest active, no restart required
X400060HLTNDA	400	no dial address
X409903PRTCNF	409	port {port}/{protocol} is already allocated to another stack
X500507OTLDIW	500	failed to write managed OTLP config drop-in {path} at {stage} {error}
X503014NODNAV	503	node {node_id} unavailable
X503050HLTNID	503	node health probe identity mismatch, got {got_id}, want {want_id}
X503058SNPCFG	503	control-plane snapshot in cluster mode with no cluster-dump port wired
X503060HLTNCK	503	no health checker wired
X503061NODNVS	503	node {node_id} still unavailable, {suppressed} checks suppressed over {unavailable_for}

Source: modules/hud/server, modules/hud/snapshot, modules/hud
Count: 9

Code	HTTP	Message template
X400213HUDISO	400	empty ISO timestamp
X400214HUDISP	400	unparseable ISO timestamp {value}
X401212HUDARJ	401	hud websocket auth rejected
X404213HUDVOL	404	volume {leaf} not found in snapshot
X404215HUDPOD	404	pod {leaf} not found in snapshot
X500210HUDCMD	500	hud command failed {reason}
X503207HUDWSC	503	websocket connection failed, {error}
X503209HUDHTP	503	hud daemon api returned http {status} {body}
X503210HUDBLD	503	hud builder not wired, {reason}

Source: modules/inspect
Count: 2

Code	HTTP	Message template
X400910INSREQ	400	inspect requires a stack name
X500910INSDSP	500	inspect display failed {op}{error}

Source: modules/internal_rpc
Count: 6

Code	HTTP	Message template
X400977RPCJSN	400	malformed rpc request body {detail}
X400978RPCFNM	400	missing rpc function name
X400979RPCRDF	400	rpc body read failed {detail}
X403945RPCTRN	403	rpc {function} requires the internal mTLS listener, got transport {transport}
X403946RPCCAP	403	rpc {function} requires capability {capability}, which this caller was not granted
X413900RPCBIG	413	rpc body exceeds the {limit}-byte cap

Source: modules/internal_stacks
Count: 6

Code	HTTP	Message template
X400076PRJNAM	400	invalid project_name {project}
X500071DEPFAL	500	deploy failed at {op} {error}
X500072STPFAL	500	stop failed {detail} {error}
X500073LOGFAL	500	logs read failed {detail} {error}
X500074EXCSRV	500	exec failed {reason}
X500075PSFAIL	500	ps failed {detail} {error}

Source: modules/job
Count: 14

Code	HTTP	Message template
X200005JOBFAL	200	job {job_name} failed during {phase} {error}
X200074JOBTHR	200	registry pull rate limit for job {job_name}, retrying in {delay}
X400010INVJOB	400	invalid job definition with {detail}
X400011JOBMNG	400	job {job_name} is a {source} job and cannot be run directly
X400015JOBPRS	400	job template parse failed, {reason}{token}
X400027JOBREQ	400	{field} field is required for {context} context
X400065JRNTSK	400	job run {job_run_id} has no task yet with status {status}, nothing to cancel
X404001JOBNFD	404	job {job_name} not found in stack {stack_name}
X404904JRNFND	404	job run {job_run_id} not found
X409066JRNTRM	409	job run {job_run_id} already {status}, nothing to cancel
X409067JRNRUN	409	job run {job_run_id} is executing, cannot cancel
X409068JRNCLM	409	job run {job_run_id} was claimed for execution before the cancel landed
X500900JOBOPF	500	job {operation} failed{error}
X500901JOBNET	500	job docker network inspect failed for {network}{error}

Source: modules/kv
Count: 3

Code	HTTP	Message template
X400400KVINPT	400	kv invalid input {reason} {error}
X404400KVNOFD	404	kv entry {namespace}/{key} not found
X500401KVOPFL	500	kv {operation} failed

Source: modules/leader
Count: 1

Code	HTTP	Message template
X200923LDRCBK	200	leader {callback} callback failed {error}

Source: modules/license
Count: 27

Code	HTTP	Message template
X200961LICGOK	200	join-time capacity gate enforced for node {node} — {nodes} nodes and {cores} cores measured against {caps}
X200962LICPLC	200	could not determine which node hosts the system ingress — {reason} — attempting license activation on this node
X200998LICOFF	200	no broker ask was made — network license checks are disabled by the license.offline policy — install a vendor-signed file with shc license activate <file>
X400968LICMAL	400	license file malformed — {reason}
X400969LICSIG	400	license signature is invalid — not signed by the vendor key this binary trusts
X400970LICKEY	400	minting requires the vendor Ed25519 signing key via —key or SHC_LICENSE_SIGNING_KEY — mint is vendor-only
X400971LICNAF	400	license file not found at {path}
X400972LICREQ	400	vendor record request rejected — {reason} — fix the invoice and re-sync, this request will never succeed as sent
X400973LICCAP	400	purchased capacity {cores} cores exceeds the {ceiling}-core ceiling for tier {tier} — quote this as Enterprise, or raise the broker’s ceiling
X403029LICENT	403	{feature} is not included in this estate’s SHC license — activate or renew a license that includes it, see shc license status
X403030LICDOM	403	license is bound to domain {expected} but this estate serves {actual}
X403031LICLIM	403	license limit reached for {feature} — this estate holds {count} of {limit}, existing resources keep working, creating more needs a higher-tier license, see shc license status
X403032LICDNS	403	activation callback for {domain} failed the public-DNS leg — {reason}
X403034LICNCE	403	activation callback for {domain} failed the challenge-nonce leg — {reason}
X403035LICGRT	403	no license grant on record for domain {domain} — complete a purchase for this domain, then re-run activation
X403036LICOPT	403	{feature} is an SHC Enterprise feature — start the 30-day trial with shc license trial start, existing workloads are never affected when a trial ends
X403037LICOFF	403	{feature} is not covered by this estate’s license and network license checks are disabled by policy license.offline — obtain a new signed license file from the vendor and install it with shc license activate — the current license expires {expires}
X403039LICCAP	403	this estate is over its licensed capacity for {resource} — using {count} against a licensed {limit} — reduce below the limit to clear it immediately, or license the extra capacity
X403048LICVND	403	vendor mint refused — missing or invalid vendor token, POST /mint is vendor-only and requires the broker’s LB_VENDOR_TOKEN as a bearer token
X409049LICNOD	409	license activation must run on the estate’s ingress node — the broker callback for {domain} reaches the daemon behind the system Traefik, which runs on {node}, not this one — re-run shc license activate —broker on {node}
X500960LICSGN	500	license signing failed — {reason}
X500961LICSTO	500	license store operation failed — {reason}
X502960LICBRK	502	online license activation failed — {reason} — use the offline signed-file path for airgapped estates
X502961LICMNT	502	license mint failed after a verified activation callback — {reason} — retry activation, contact the vendor if it persists
X502962LICRFR	502	license re-fetch from the broker failed — {reason} — entitlements continue resolving from the locally held file
X502963LICREC	502	writing the purchased rights into Keygen failed — {reason} — this is a RETRY, not a decline, the purchase stands and the next sync attempt should land it
X503964LICGSK	503	join-time capacity gate skipped for node {node} — the node registry read failed {reason} — {limits} went unenforced for this join

Source: modules/logs
Count: 8

Code	HTTP	Message template
X400940LOGREQ	400	logs requires a stack name
X400941LOGDUR	400	invalid since value {since}
X400942LOGTAL	400	invalid tail value {tail}
X403943LOGTNT	403	tenant scope required for log retrieval
X403944LOGSCM	403	permission denied, missing stack {stack} read
X404940LOGNOF	404	no log target for project {project} service {service}
X500940LOGRUN	500	log retrieval failed {op}{error}
X500941LOGSTM	500	log stream failed {op}{error}

Source: modules/mcp
Count: 4

Code	HTTP	Message template
X400381MCPHDR	400	the mcp endpoint needs the token in the Authorization header — a query-string token cannot open a session
X500379MCPCTX	500	mcp tool call carried no per-call auth context — refusing to execute without the calling principal
X500380MCPPAN	500	mcp loopback dispatch panicked — {panic}
X503378MCPNRT	503	mcp daemon api router not ready — {reason}

Source: modules/metrics
Count: 4

Code	HTTP	Message template
X404920METNOF	404	metrics no definition for {name}{want}{error}
X500920METREG	500	metrics duplicate registration for {name}
X500921METINI	500	metrics failed to create {kind} instrument {name} {error}
X500922METCAR	500	metrics cardinality cap exceeded for {name}, {observed} > {cap}

Source: modules/nebula
Count: 9

Code	HTTP	Message template
X200916NEBCHK	200	nebula check failed, {operation} {reason}
X200917NEBSGH	200	nebula sighup failed {op} {error}
X404913NEBNOF	404	nebula ca not found in database
X500036NEBROT	500	certificate rotation failed for {node_id} {reason}
X500916NEBCAG	500	failed to generate nebula ca {op} {error}
X500918NEBSIG	500	failed to sign nebula certificate {op} {error}
X500920NEBBIN	500	nebula-cert binary not found at {path}
X500924NEBIPA	500	failed to allocate mesh ip {reason}
X500925NEBAPL	500	failed to apply rotated nebula cert at {step} {reason}

Source: modules/network
Count: 3

Code	HTTP	Message template
X200020NETTMO	200	timeout waiting for network {network}, ensure swarm manager is running
X200908NETMGR	200	leader only task requires swarm manager, current node is worker
X500900NOTWRD	500	network service is not wired with a database

Source: modules/node
Count: 19

Code	HTTP	Message template
X400017NODDEP	400	node {name} has {count} stacks, move them first or use force
X400061NODHDA	400	node health dial address empty
X400899NODARG	400	usage shc node {cmd} <{arg}>
X400907NODNSW	400	node {name} is not configured for swarm mode
X400909NODNSM	400	node {name} is not a swarm manager
X400911NODNOA	400	node {name} has no address configured
X400915NAMVAL	400	{field_name} validation failed {reason} {error}
X400932NODTTL	400	invalid ttl {value} {error}
X400933NODTTP	400	invalid ttl {value}, must be positive
X400934NODPRGS	400	node leave —purge is self-only, run it on the node you want to wipe without a [node] argument
X400935NODPRGF	400	node leave —purge permanently destroys all local SHC state and data, re-run with —force to confirm
X404003NODNOF	404	node {name} not found
X500019NODINI	500	local node not initialized, {path} missing, run shc init or shc node join first
X500025NODREPO	500	node repository error {reason}
X500923HTTPST	500	http {status} {body}
X500924UNMRSH	500	unmarshal response {error}
X503072NODHPF	503	node {addr} health probe failed {error}
X503073NODHCN	503	node health client not configured
X503998CMDNYI	503	not yet wired in Go port {operation}

Source: modules/notification/channels, modules/notification
Count: 13

Code	HTTP	Message template
X400115NTFPTN	400	at least one pattern is required
X400700NTFPTN	400	invalid pattern {pattern} {error}
X400701NTFCFG	400	invalid notification rule {context} {error}
X400703NTFCHC	400	notification channel field {field} is empty
X400711NTFTMP	400	notification template is invalid {issue} {detail}
X500701NTFSND	500	notification send failed {label} {error}
X500702NTFDRP	500	notification dropped for rule {rule}, dispatcher not running {events}
X500704NTFTPL	500	notification template {stage} failed {error}
X500705NTFHTP	500	notification webhook returned HTTP {status}
X500706NTFSND	500	unknown notification send failure
X503011QUEFUL	503	notification queue full, dropping rule {rule} {events}
X503012NTFRSK	503	notification rule {rule} skipped at dispatch {reason}
X503013NTFDSF	503	notification dispatch send for rule {rule} failed {error}

Source: modules/portforward
Count: 2

Code	HTTP	Message template
X404921FWDCNT	404	port-forward target {container} not found or unreachable from host
X503922FWDSCT	503	socat is required to port-forward overlay and swarm containers but is not installed, run apt-get install -y socat on this node

Source: modules/proxy
Count: 7

Code	HTTP	Message template
X200940PRXNBK	200	no live backend nodes while {intents} deployments ride external load balancers, leaving every lb target set unchanged this tick
X200979PRXDUP	200	shared-vip proxy connection {conn} port {port} claimed by both {first} and {second} in tenant {tenant}, first claim wins this sweep
X400972PRXUNK	400	unknown proxy implementation {impl} for tenant {tenant}
X400973PRXCFG	400	proxy backend {impl} misconfigured, missing connection cred {field}, {remedy}
X400981PRXPPU	400	proxy.proxy_protocol_trusted_ips is set but proxy backend {impl} for tenant {tenant} connection {conn} cannot send the PROXY protocol header, refusing to reconcile, unset the config or move the port mappings to an aws connection
X500970PRXRCN	500	failed to reconcile proxy for tenant {tenant} connection {conn} {op} {error}
X503971PRXNWR	503	proxy backend not available for tenant {tenant} connection {conn}

Source: modules/quota
Count: 16

Code	HTTP	Message template
X400915QTAINP	400	invalid quota input {reason} {error}
X403001CPUEXC	403	cpu quota exceeded, requested {requested} millicores but only {available} of {limit} available
X403002MEMEXC	403	memory quota exceeded, requested {requested} bytes but only {available} of {limit} available
X403003DSKEXC	403	disk quota exceeded, using {used} bytes of {limit} bytes limit
X403004STKEXC	403	stack quota exceeded, {current} of {limit} stacks in {scope}
X403005ENVEXC	403	environment quota exceeded, {current} of {limit} environments in {scope}
X403006APPEXC	403	app quota exceeded, {current} of {limit} apps in {scope}
X403007VAPEXC	403	vapp instance quota exceeded, {current} of {limit} instances in {scope}
X403010NODCPU	403	node cpu capacity exceeded, requested {requested} millicores but node {node} only has {capacity} millicores total
X403011NODMEM	403	node memory capacity exceeded, requested {requested} bytes but node {node} only has {capacity} bytes total
X403012SWMPOL	403	swarm pool capacity exceeded, requires {requested_cpu} millicores and {requested_memory} bytes but pool has {pool_cpu} millicores and {pool_memory} bytes across {node_count} nodes
X403013SWMREP	403	no single swarm node can host one replica, requires {requested_cpu} millicores and {requested_memory} bytes but largest node has {max_cpu} millicores and {max_memory} bytes across {node_count} nodes
X404909USGNOF	404	usage record not found for scope {key} {value}
X500909DSKSCA	500	disk usage scan failed with {error}
X500913USGREC	500	usage reconciliation failed with {error}
X500914USGOPF	500	usage {operation} failed

Source: modules/repo
Count: 14

Code	HTTP	Message template
X400013INVURL	400	invalid repository url
X400927REPFIL	400	file-path repositories are no longer supported
X400928REPRSV	400	repository name {name} is reserved
X400931REPAPP	400	repo apps requires —rejected
X400943REPADP	400	unsupported adapter {adapter}
X400967REPSSR	400	repository url host {host} is not an allowed remote target
X403901REPSYS	403	cannot delete the system repository
X403902REPBLT	403	cannot remove the builtin repository
X404901REPNOF	404	repository {name} not found
X409901REPOEX	409	repository {name} already exists
X500902REPMAT	500	failed to materialize source for repository {name} {error}
X500903REPSYN	500	failed to sync repository {name} with {reason} {error}
X500904REPOPF	500	repository operation {operation} failed
X500905REPGIT	500	git {args} failed {error} {output}

Source: modules/retention
Count: 2

Code	HTTP	Message template
X400916RETINP	400	invalid retention input, {context}{error}
X500916RETOPF	500	retention {operation} failed

Source: modules/schedule
Count: 12

Code	HTTP	Message template
X400001CRNINV	400	invalid cron expression {cron}
X400932SCHSTK	400	—stack is required
X400934CRNEMT	400	empty cron expression
X400935CRNFMT	400	invalid cron {cron}
X400936CRNHMS	400	expected HH MM
X400937CRNCNN	400	non-numeric clock parts
X400938CRNOOR	400	out-of-range hour or minute
X404902SCHNFD	404	schedule not found {job}
X409900SCHDPL	409	schedule already exists for job {job}
X500954SCHCAC	500	count active schedules failed {error}
X500955SCHCPS	500	count paused schedules failed {error}
X500956SCHNRT	500	next-run lookup failed {error}

Source: modules/search
Count: 3

Code	HTTP	Message template
X400400SRINPT	400	search invalid input {reason}
X404400SRAPNF	404	app {name} not found
X500401SROPFL	500	search {operation} failed

Source: modules/shell
Count: 7

Code	HTTP	Message template
X400920SHLREQ	400	shell requires a stack name
X400922SHLCMD	400	exec requires a command
X404920SHLCNT	404	no running container for project {project} service {service}
X500920SHLWSF	500	shell websocket exec failed {op}{error}
X500921SHLEXC	500	shell exec failed {op}{error}
X500922SHLPTY	500	shell pty operation failed {reason}
X500923SHLRDR	500	shell reader done

Source: modules/stack
Count: 6

Code	HTTP	Message template
X400060STKREQ	400	stack name required
X400062CMDRQD	400	command required for exec
X400959SVCRQD	400	service name required for exec
X404908STKNFD	404	stack {stack_name} not found
X409069STKAMB	409	stack {stack_name} exists in more than one scope, found in {scopes}
X503010NDUNRC	503	cannot connect to node {node} {error}

Source: modules/storage/providers/awsebs, modules/storage/providers/azuredisk, modules/storage/providers/cephfs, modules/storage/providers/cloudstackvol, modules/storage/providers/dovolume, modules/storage/providers/gcepd, modules/storage/providers/linodevolume, modules/storage/providers/nfs, modules/storage/providers/vultrvolume, modules/storage/storageapi
Count: 90

Code	HTTP	Message template
X200036LNKSKP	200	storage link-table row not written for node {node} on {provider}, mount still attempted {error}
X200037MNTSKP	200	client mount did not succeed for node {node} on {provider} {error}
X200318VOLLRC	200	reconciled {count} stranded volume backup leases
X400040EXTNAM	400	shc-managed providers must use reserved names local, nfs, cephfs
X400053RSVTYP	400	provider type {provider_type} is reserved for the singleton {reserved_name}, custom name {name} not allowed
X400058MNGDEL	400	managed provider {name} cannot be removed via storage remove, use shc storage {provider_type} disable
X400060STGWRF	400	path {path} is not on a {expected} filesystem
X400320VOLDOC	400	digitalocean volume provider misconfigured, {reason}
X400323VOLHCT	400	hetzner volume provider misconfigured, {reason}
X400324VOLCFM	400	volume {volume_id} rebind requires confirmation old node detached without waiting for ack
X400325VOLCFG	400	no volume backend configured {reason}
X400326VOLCSU	400	volume connection {conn} for tenant {tenant} not resolvable to a volume provider
X400327VOLAMB	400	storage.volumes.provider is unset and multiple volume-capable connections exist, {candidates}, set storage.volumes.provider to the one to use
X400334AZDCFG	400	azure disk provider misconfigured, {reason}
X400336VOLCSC	400	cloudstack volume provider misconfigured {reason}
X400343EBSCFG	400	aws ebs volume provider misconfigured, {reason}
X400344GPDCFG	400	gce persistent disk volume provider misconfigured, {reason}
X400362VOLLCT	400	linode volume provider misconfigured, {reason}
X400929NODLNK	400	node {node} is not linked to storage provider {provider}
X400931INVCFG	400	invalid storage configuration {reason}
X400937QNOSUP	400	quotas not supported by storage provider {name}, filesystem {filesystem}
X400942SNOSUP	400	snapshots not supported by storage provider {name}, filesystem {filesystem}
X400944PRVTYP	400	unknown storage provider type {provider_type}
X400945SNPMTH	400	unknown snapshot method {method}
X400946QTAMTH	400	unknown quota method {method}
X400947RSVNAM	400	reserved name {name} can only be used for shc-managed providers
X403056CFSCBN	403	cephfs node handler refused, caller identity does not match target node {reason} caller={caller} target={target}
X403080NFSCBN	403	nfs node handler refused, caller identity does not match target node {reason} caller={caller} target={target}
X403081VOLCBN	403	volume node handler refused, {reason}, caller {caller} target {target}
X403324VOLEEO	403	volume {volume_id} rebind requires SHC EE, cross-node failover needs the multi-node fencing plane
X404031STFNOF	404	state folder {path} not found on storage provider {provider}
X404032SNPNOF	404	snapshot {snapshot_id} not found for {path}
X404033SRCNOF	404	source path does not exist {path}
X404103STGNFD	404	shared storage provider {name} not configured, run shc storage {name} enable first
X404320VOLNOF	404	volume not found by {selector} {value}
X404322VOLHNF	404	hetzner resource not found by {selector} {value}
X404324AZDNOF	404	azure resource not found by {selector} {value}
X404336VOLCSN	404	cloudstack resource not found by {selector} {value}
X404341VLTVNF	404	vultr resource not found by {selector} {value}
X404343EBSNOF	404	aws ebs resource not found by {selector} {value}
X404344GPDNOF	404	gce persistent disk resource not found by {selector} {value}
X404362VOLLNF	404	linode resource not found by {selector} {value}
X404914STGNOF	404	storage provider {name} not found
X409030STGEXS	409	storage provider {name} already exists
X409031STFEXS	409	state folder {path} already exists on storage provider {provider}
X409032VOLXTN	409	volume belongs to tenant {got} not {want}
X409033STGUSE	409	storage provider {name} is in use by {stacks} stacks {stack_names} and {volumes} volume rows, pass —force to delete anyway
X409034VOLREB	409	volume {volume_id} rebind refused current node {current_node} not expected {expected_node}
X409035VOLFNC	409	volume {volume_id} fence refused, request generation {req_gen} row generation {row_gen} {detail}
X409036VOLATT	409	volume {volume_id} still attached to {node} pass force to detach first
X409037VOLFRB	409	volume {volume_id} auto failover refused, no force-detach proof or no same-az candidate in zone {az}
X409038CEPFID	409	ceph cluster identity conflict, /etc/ceph carries fsid {found} but the pinned cluster fsid is {pinned}, run shc storage cephfs disable before enabling again
X409040VOLREL	409	volume {volume_id} provider {provider} cannot relocate from {prev_node}, its Attach does not self-detach a previous holder
X409056CEPFSD	409	refusing to re-bootstrap ceph, managed cluster fsid {fsid} exists but is unresponsive, repair the existing cluster or remove it via cephadm rm-cluster —fsid {fsid} and shc storage cephfs disable before re-enabling
X409324AZDREL	409	azure disk {handle} not freed from holder {holder} within detach-settle bound, last http {last}
X409343EBSDEV	409	aws ebs no free device slot on instance {instance}, /dev/sd[f-p] exhausted
X409864VOLLSE	409	volume {volume_id} already leased by {owner} until {until}
X409866VOLSFN	409	volume {volume_id} self fence in progress on {node}, not yet provably fenced
X500032CMDFLR	500	command failed {command} {error}
X500033EXPREL	500	failed to reload nfs exports, {reason}
X500035STGCMD	500	{tool} failed {stderr} {error}
X500050CEPMON	500	ceph mon bring-up via cephadm failed, check the daemon log and ceph -s on the leader
X500051CEPMDS	500	ceph mds placement via the orchestrator failed, check ceph orch ls and the daemon log
X500052CEPFSC	500	cephfs volume creation via ceph fs volume create failed, check ceph -s and the daemon log
X500053CEPENB	500	shc storage cephfs enable failed during the cephadm bring-up, check ceph -s/ceph orch host ls on the leader and the daemon log
X500054CEPENR	500	ceph enroll {op} {error}
X500054CFSCLI	500	cephfs client mount setup failed {op}{error}
X500055CEPHKY	500	cephadm host-key install on {host} failed {op} {error}
X500056CEPAUT	500	cephx client authorization failed {op} {error}
X500076NFSSRV	500	nfs server setup failed {op}{error}
X500077NFSCLI	500	nfs client setup failed {op}{error}
X500078NFSDIS	500	nfs disable failed {op}{error}
X500315VOLREP	500	volume repository error {op}{error}
X500317VOLNDP	500	node volume provisioner {op} on {node} failed {error}
X500318VOLSFU	500	node self-fence {op} on {node} failed {error}
X500327VOLCMD	500	node volume command failed {reason}
X500917QTAERR	500	quota operation failed for {path} {error}
X500919SNPERR	500	snapshot operation failed for {path} {op} {error}
X501330VOLSTN	501	no stonith provider configured, cannot confirm fence of node {node}
X502111LDRFWD	502	shared-storage operation {op} could not be relayed to the raft leader, {reason} {error}
X502320VOLDOA	502	digitalocean volume api call {op} failed, http {status} {error}
X502321VOLHAP	502	hetzner volume api call {op} failed, http {status} {error}
X502322VOLNDA	502	node volume dispatch to {node} {path} failed, {reason} {error}
X502324AZDAPI	502	azure disk api call {op} failed, http {status} {error}
X502326VOLCSA	502	cloudstack volume api call {op} failed http {status} {error}
X502331VLTVAP	502	vultr block storage api {op} failed http {status} {error}
X502343EBSAPI	502	aws ebs ec2 api call {op} failed {error}
X502344GPDAPI	502	gce persistent disk compute api call {op} failed {error}
X502362VOLLAP	502	linode volume api call {op} failed, http {status} {error}
X503110NOTLDR	503	shared-storage operation requires the raft leader, {reason} {error}

Source: subsystems/impl, subsystems/lifecycle
Count: 77

Code	HTTP	Message template
X200963INGGAT	200	ingress reconcile traefik host check failed {error}
X200964INGSWP	200	ingress route materialize sweep failed {error}
X200965LEAFSW	200	certificate leaf renewal sweep failed {error}
X200966CAEXPS	200	certificate intermediate expiry scan failed {error}
X200967DNSRCN	200	traefik dns-01 credential reconcile failed {error}
X200968KCBRCN	200	keycloak base path reconcile failed {error}
X200969OOBRCN	200	openobserve base path reconcile failed {error}
X200971NETRCN	200	shared network reconcile failed {error}
X200973CTRSTL	200	container reconcile stale container list failed {error}
X200974CTRSRM	200	container reconcile stale container {container_id} remove failed {error}
X200975CTRDRL	200	container reconcile status drift list failed {error}
X200976CTRDRF	200	container reconcile status drift fix failed for deployment {deployment_id} {error}
X200977ACMWTC	200	ingress sweep had no stalled-acme watcher wired, allocated one in place, tls self-heal was inert until now
X200978INTTLS	200	internal api tls server error {detail}
X200979MNUSWP	200	apps menu materialize sweep failed {error}
X403044INTNMB	403	internal api peer certificate rejected, identity {identity} is not in the live node registry, node removed from the cluster or never enrolled
X500990INTAPCA	500	failed to parse internal-api CA {path} no PEM blocks
X500991INTAPKP	500	failed to load internal-api node cert and key {error}
X500992LCSTFL	500	lifecycle subsystem {subsystem} start failed {error}
X500993LCDPBL	500	lifecycle deps builder for {name} panicked {detail}
X501002DBREOP	501	failed to reopen rqlite pool {error}
X501003INTAPRD	501	failed to read internal-api CA {path} {error}
X501017RQDSTP	501	rqlited manager stop returned error {error}
X501018RQDDEM	501	scale-to-one demote failed, staying on the raft engine {error}
X503015LDRPOL	503	leader_hub poll-driven FlipLeader returned error {error}
X503016LDRMTS	503	leader_hub health monitor {phase} returned error {error}
X503022EVBNPL	503	event_bus no db pool wired, running without events.Service
X503023EVBSTR	503	event_bus events.Service.Start failed {error}
X503024EVBREC	503	event_bus pending-broadcast recovery sweep failed {error}
X503025EVBNOJ	503	event_bus job.Service not wired, V200900JOBRUN handler is a no-op
X503026QUENPL	503	queue no db pool wired, running without task.Service
X503027QUESTR	503	queue task.Worker.Start failed {error}
X503028HTPNAS	503	http subsystem no api.Server available, skipping TCP listener
X503029STKRWR	503	stack_reconcile reconcile.Wire returned error {error}
X503034VLTSKP	503	vault subsystem started without config, skipping
X503035DKRDWN	503	docker daemon unreachable, continuing {error}
X503036SSEBSK	503	sse_broker subsystem started without pool, skipping
X503037COLSKP	503	collectors subsystem started without config, skipping
X503038COLTKE	503	tick collector error {error}
X503039CFGSKP	503	config_loader subsystem started without pool, skipping
X503040DKEVEX	503	docker_events Subscribe exited {error}
X503041RTRWLK	503	router walk failed for module {module} {error}
X503042INTRWK	503	internal router walk failed for module {module} {error}
X503043INTAEX	503	internal_api listener exited {error}
X503045CCRTOP	503	cluster_cert_rotation {operation} rotation service returned error {error}
X503046BKMRCN	503	backup_mount reconcile failed {error}
X503046LCSTRB	503	lifecycle start failed in group {group}, rolling back {error}
X503047LCSTPE	503	lifecycle subsystem {subsystem} stop returned error {error}
X503048LCRBKE	503	lifecycle rollback Stop for {subsystem} returned error {error}
X503048USKVNS	503	unix_socket filesystem entry vanished, rebinding {path}
X503049LCFAHL	503	lifecycle subsystem {subsystem} reported fatal health error {error}
X503049USKRBD	503	unix_socket rebind failed {path} {error}
X503051LCSTDG	503	lifecycle subsystem {subsystem} started degraded, daemon staying up {error}
X503052LCDGRD	503	lifecycle subsystem {subsystem} degraded {error}
X503053LCONLD	503	lifecycle OnLeader callback failed for {subsystem} is_leader={is_leader} {error}
X503055NSRWRN	503	node_self_register {step} failed {error}
X503056COLPRT	503	collectors per-tenant alloc failed for {tenant} {error}
X503075SCHFRR	503	schedule_dispatcher per-row dispatch failed {schedule_id} {error}
X503076SCHSWP	503	schedule_dispatcher sweep returned error {error}
X503077SCHDQE	503	schedule_dispatcher enqueue to task queue failed at {op}{error}
X503078BKSCEX	503	backup_scheduler scope execute failed {scope_key} {error}
X503079MNTMKD	503	backup_mount default repo {repo} mkdir failed {error}
X503080MNTRIN	503	backup_mount restic init failed for {repo}, backup ops fail until configured {error}
X503081VLTAUF	503	vault auto-unlock from SHC_VAULT_PASSWORD failed {error}
X503083CFGRLD	503	config_loader DB-layer reload failed after {changed} changed paths {error}
X503084CCAGEN	503	cluster_ca_genesis provision returned error {error}
X503085CCAGSL	503	cluster_ca_genesis row committed but sealed vault key unreadable {error}
X503086CCAGLF	503	cluster_ca_genesis first-node local port 4003 leaf sign failed {error}
X503087CRNSKP	503	cron_runner skipped {module}.{cron}, previous run still in flight
X503088CRNBAD	503	cron_runner unparseable schedule for {module}.{cron} spec={spec} {error}
X503089CRNRUN	503	cron_runner {module}.{cron} Run returned error {error}
X503091GCAGEN	503	global_ca_genesis provision returned error {error}
X503093OPRREAP	503	operation_registry stale-operation reaper sweep returned error {error}
X503094OPRLST	503	operation_registry reaped lost operation {task_id}, worker heartbeat stale past {lease}s lease
X503105INTMBR	503	internal api membership gate registry refresh failed {error}
X503106BKSLOD	503	backup_scheduler schedule load failed {error}
X503108INTANB	503	internal_api nic {nic} did not resolve to an IPv4 {error}, retrying bind

Source: modules/supportbundle
Count: 7

Code	HTTP	Message template
X200373SPBSEC	200	support bundle section {section} degraded — {reason}
X200376SPBOMT	200	section {section} omitted — estate-scoped sections ride only a platform-admin bundle
X400374SPBREQ	400	invalid support bundle request — {reason}
X500371SPBSTR	500	support bundle download failed at {step} — {error}
X500372SPBHTT	500	support bundle request failed — daemon answered http {status} — {body}
X502377SPBSTQ	502	support bundle store query failed — http {status} — {body}
X503375SPBNWR	503	support bundle source {source} is not wired on this daemon

Source: modules/task
Count: 11

Code	HTTP	Message template
X200914TSKRTY	200	task {task_id} scheduled for retry {attempt}/{max_attempts} in {delay}s
X404404TSKNFD	404	task {task_id} not found
X409404TSKAMB	409	ambiguous task id {task_id} matches {count} tasks, pass a longer prefix
X500004HDLNFD	500	handler not found for task {task_name}
X500904TSKFAL	500	task {task_id} failed with {error}
X500905TSKINT	500	task {task_id} interrupted, server restarted while running
X500909TSKOPF	500	task {operation} failed
X500912TSKTMO	500	task {task_id} timed out after {max_runtime_seconds}s
X500913TSKWRK	500	task worker {stage} failed {error}
X500914TSKPNC	500	task {task_id} {name} handler panicked {panic}
X500915TSKLST	500	task lost-operation reaper {stage} failed

Source: modules/tenant
Count: 15

Code	HTTP	Message template
X400058TNTDEF	400	cannot remove the default tenant
X400059TNTHAS	400	tenant {name} has {count} stacks, use force to remove
X400062TNTREQ	400	tenant name is required
X400958TNTREQ	400	tenant {name} has {count} stacks, uninstall stacks first
X400974TNTNAM	400	tenant name {name}, {reason}
X403975TNTEEO	403	tenant {name} not created, creating additional tenants requires SHC EE
X404973TNTNXS	404	tenant {name} does not exist, {hint}
X409059TNTUNK	409	tenant {name} deployment count could not be determined, {reason}, refusing to delete a tenant whose stacks cannot be counted
X409974TNTTMB	409	tenant {name} was deleted and is not re-adopted automatically, {hint}
X500460TNTSQL	500	tenant sql operation {operation} failed {error}
X500461TNTFSO	500	tenant fs operation {operation} failed {error}
X500462TNTVLT	500	tenant admin credential vault store failed {reason}
X500463TNTKCP	500	detached keycloak provisioning failed {tenant} {op} {error}
X503464TNTCTX	503	active-tenant switching is not available on this host, {hint}
X503973TNTIND	503	tenant {name} existence could not be determined, {reason}

Source: modules/test
Count: 10

Code	HTTP	Message template
X404010APPNFD	404	app {app} not found
X404910TSTNFD	404	app {app} has no tests directory
X500010BATSNF	500	bats is not installed
X500011TSTNIL	500	apptest Runner has nil receiver
X500012TSTCMD	500	apptest bats command is empty
X500013TSTSTR	500	local test server already started
X500014TSTNST	500	local test server not started, call start first
X500015TSTDIE	500	shcd exited before reporting healthy
X500016TSTBLD	500	apptest daemon startup stage {stage} failed {error}
X500017TSTCLP	500	isolated server cleanup failed {reason}

Source: modules/user
Count: 9

Code	HTTP	Message template
X400913USRPWM	400	passwords do not match
X400930USRREQ	400	user request missing {field}
X400931USRTNT	400	platform admin must specify a tenant
X400932USRTNB	400	caller has no tenant binding
X403930USRPRM	403	requires tenant manage permission
X403931USRXTN	403	cannot operate on tenant {requested}, caller bound to {own}
X403935USRLMT	403	tenant {tenant} has {count} user accounts, the community edition seat limit is {limit}, more requires SHC EE
X503930USRKCN	503	system keycloak is not running
X503932USRRLM	503	keycloak realm for tenant {tenant} is not provisioned yet

Source: modules/vault
Count: 34

Code	HTTP	Message template
X200970VLTUBP	200	vault unlock broadcast peer {node} failed {error}
X200972VLTENA	200	vault envelope state adoption failed writes stay legacy {error}
X200997VLTUPD	200	vault unlock pull peer {node} accepted but no unlock landed within {wait}
X400025PRVAUT	400	{auth_method} authentication requires {requirement}
X400026PRVKTY	400	{provider} requires {required_key_type} key, got {got_key_type}
X400906INVSCP	400	invalid scope {scope} requires {required}
X400910VLTEXP	400	vault export failed with {reason} {error}
X400912VLTIMP	400	vault import failed with {reason} {error}
X400916PRVUNK	400	unknown vault provider {provider}
X400917PRVREQ	400	{config_key} is required for {provider} provider
X400918PRVSCP	400	{scope_type} required for {operation}
X400919PTHFMT	400	invalid path format {path} {error}
X400925PRVPIN	400	pinned vault provider not configured {provider} {path}
X400962VLTHOK	400	{hook} hook not wired
X400963VLTPWM	400	passwords do not match
X400964VLTRMS	400	invalid remap-scope pair {reason} {pair}
X400980VLTFMT	400	vault crypto format failure {reason} {error}
X400983AGNCHS	400	invalid autogen charset {charset} {reason}
X401012VLTINV	401	invalid vault password
X401013VLTNEW	401	invalid new vault password {reason} {error}
X401902VLTPWI	401	vault import password incorrect or data corrupted
X403905CAPRTC	403	protected ca section is not ref resolvable {key}
X403906CONPRT	403	protected connection credential is not accessible {key}
X404905SECREQ	404	required vault secret {key} unresolved for {tenant} {stack} {environment} with {reason}
X404907SECNOF	404	secret {key} not found
X409902SECEXS	409	secret {key} already exists at scope {scope}
X500101VLTKEK	500	vault kek salt failure {reason} {error}
X500806VLTRNS	500	vault scope rename failed with {reason} {error}
X500912VLTDBS	500	database session required for vault {operation}
X500960PRVEXE	500	vault provider {provider} cli failed {stderr} {error}
X500961VLTCRP	500	vault crypto failure {op} {error}
X503902VLTNAV	503	vault not available with {reason} {error}
X503903VLTPWM	503	vault password not configured
X503950PRVAPI	503	vault provider {provider} api returned {status} {body}