StoreUnknownTablestore.lay-out.unknown-tableA table name absent from every schema.json raises StoreUnknownTable rather than returning an empty result. | A table name resolves to no schema.json in the tree. | store.lay-out.unknown-tablestore.lay-out.unknown-tableA table name absent from every schema.json raises StoreUnknownTable rather than returning an empty result. |
StoreRunConflictstore.lay-out.run-conflictAny other landing under a run id committed on its node or folded under its run key raises StoreRunConflict, naming the run, and changes nothing; a folded row without batch_digest predates digests and always conflicts. | A run id already committed on its node, or folded under its run key, lands again as other than its replay. | store.lay-out.run-conflictstore.lay-out.run-conflictAny other landing under a run id committed on its node or folded under its run key raises StoreRunConflict, naming the run, and changes nothing; a folded row without batch_digest predates digests and always conflicts. |
StoreManifestFormatNewerstore.lay-out.format-newerA run or snapshot manifest of a newer format_version major raises StoreManifestFormatNewer, naming the file and both versions, and the table refuses reads until a newer build reads it. | A run or snapshot manifest carries a format_version major newer than the build reads. | store.lay-out.format-newerstore.lay-out.format-newerA run or snapshot manifest of a newer format_version major raises StoreManifestFormatNewer, naming the file and both versions, and the table refuses reads until a newer build reads it. |
StoreManifestUnreadablestore.lay-out.manifest-unreadableA run manifest or reachable snapshot manifest failing to parse raises StoreManifestUnreadable, naming the table and file; the table refuses reads until it parses. | A run manifest or reachable snapshot manifest fails to parse. | store.lay-out.manifest-unreadablestore.lay-out.manifest-unreadableA run manifest or reachable snapshot manifest failing to parse raises StoreManifestUnreadable, naming the table and file; the table refuses reads until it parses. |
StoreNodeIdInvalidstore.lay-out.node-id-shapeA node id over 64 chars or outside ^[A-Za-z0-9._-]+$ raises StoreNodeIdInvalid at process start, before any path, key or lease carries it. | A resolved node id is too long or outside the path-safe pattern. | store.lay-out.node-id-shapestore.lay-out.node-id-shapeA node id over 64 chars or outside ^[A-Za-z0-9._-]+$ raises StoreNodeIdInvalid at process start, before any path, key or lease carries it. |
StoreNodeIdSharedstore.lay-out.node-id-sharedA [node] block in a manifest, control-plane snapshots included, raises StoreNodeIdShared before top-level-block, naming the file and the store root's config.toml as the node id's home. | A node id is declared in a control-plane configuration applied to many machines. | store.lay-out.node-id-sharedstore.lay-out.node-id-sharedA [node] block in a manifest, control-plane snapshots included, raises StoreNodeIdShared before top-level-block, naming the file and the store root's config.toml as the node id's home. |
StoreIdentityInvalidstore.init.identity-invalidA malformed store-id, or an owner mint naming no initialized store root, raises StoreIdentityInvalid. | A store UUID is malformed or owner mint names no initialized root. | store.init.identity-invalidstore.init.identity-invalidA malformed store-id, or an owner mint naming no initialized store root, raises StoreIdentityInvalid. |
StoreProjectConflictstore.init.name-conflictA project name other than /-separated [A-Za-z0-9._-] segments, or with a . or .. segment, raises StoreProjectNameInvalid before file access; a contextful.toml naming another project or no string name raises StoreProjectConflict, writing nothing. | An init meets a contextful.toml declaring another project, or a project with no name. | store.init.name-conflictstore.init.name-conflictA project name other than /-separated [A-Za-z0-9._-] segments, or with a . or .. segment, raises StoreProjectNameInvalid before file access; a contextful.toml naming another project or no string name raises StoreProjectConflict, writing nothing. |
StoreProjectNameInvalidstore.init.name-conflictA project name other than /-separated [A-Za-z0-9._-] segments, or with a . or .. segment, raises StoreProjectNameInvalid before file access; a contextful.toml naming another project or no string name raises StoreProjectConflict, writing nothing. | A project name is not path-safe /-separated segments. | store.init.name-conflictstore.init.name-conflictA project name other than /-separated [A-Za-z0-9._-] segments, or with a . or .. segment, raises StoreProjectNameInvalid before file access; a contextful.toml naming another project or no string name raises StoreProjectConflict, writing nothing. |
StoreProjectUndiscoveredstore.init.undiscoveredWithout --project, a command raises StoreProjectUndiscovered, naming the starting directory, when no contextful.toml sits at or above it or the nearest lacks [project] name. | A command given no --project finds no contextful.toml naming a project from its working directory up. | store.init.undiscoveredstore.init.undiscoveredWithout --project, a command raises StoreProjectUndiscovered, naming the starting directory, when no contextful.toml sits at or above it or the nearest lacks [project] name. |
StoreRetentionColumnInvalidstore.declare.retain-rowsretain_rows = { column = "<name>", age = "<n>d" } takes _ingested_at or a declared Timestamp column; another column or a null value raises StoreRetentionColumnInvalid before landing, and a malformed age refuses the declaration. | A row-retention column or age is invalid, or a landed value is null. | store.declare.retain-rowsstore.declare.retain-rowsretain_rows = { column = "<name>", age = "<n>d" } takes _ingested_at or a declared Timestamp column; another column or a null value raises StoreRetentionColumnInvalid before landing, and a malformed age refuses the declaration. |
StoreKeyUnknownColumnstore.declare.key-unknownA primary_key or order_by naming a column neither declared nor injected raises StoreKeyUnknownColumn or StoreOrderByUnknownColumn, and a struct, list or map column in a key, ordering, clustering, partition or valid-time role raises StoreNestedKeyColumn, at validation. | A primary_key names a column neither declared nor injected. | store.declare.key-unknownstore.declare.key-unknownA primary_key or order_by naming a column neither declared nor injected raises StoreKeyUnknownColumn or StoreOrderByUnknownColumn, and a struct, list or map column in a key, ordering, clustering, partition or valid-time role raises StoreNestedKeyColumn, at validation. |
StoreNestedKeyColumnstore.declare.key-unknownA primary_key or order_by naming a column neither declared nor injected raises StoreKeyUnknownColumn or StoreOrderByUnknownColumn, and a struct, list or map column in a key, ordering, clustering, partition or valid-time role raises StoreNestedKeyColumn, at validation. | A struct, list or map column takes a key, ordering, clustering, partition or valid-time role. | store.declare.key-unknownstore.declare.key-unknownA primary_key or order_by naming a column neither declared nor injected raises StoreKeyUnknownColumn or StoreOrderByUnknownColumn, and a struct, list or map column in a key, ordering, clustering, partition or valid-time role raises StoreNestedKeyColumn, at validation. |
StoreOrderByUnknownColumnstore.declare.key-unknownA primary_key or order_by naming a column neither declared nor injected raises StoreKeyUnknownColumn or StoreOrderByUnknownColumn, and a struct, list or map column in a key, ordering, clustering, partition or valid-time role raises StoreNestedKeyColumn, at validation. | An order_by names a column neither declared nor injected. | store.declare.key-unknownstore.declare.key-unknownA primary_key or order_by naming a column neither declared nor injected raises StoreKeyUnknownColumn or StoreOrderByUnknownColumn, and a struct, list or map column in a key, ordering, clustering, partition or valid-time role raises StoreNestedKeyColumn, at validation. |
StoreReservedColumnNamestore.reserve.column-nameA producer column inside the _ namespace and outside the optional set raises StoreReservedColumnName at reconciliation, before any Parquet. | A producer column is spelled inside the reserved namespace and outside the optional set. | store.reserve.column-namestore.reserve.column-nameA producer column inside the _ namespace and outside the optional set raises StoreReservedColumnName at reconciliation, before any Parquet. |
StoreReservedTableNamestore.reserve.table-nameManifest assembly raises StoreReservedTableName for a pipeline table inside a reserved namespace, naming the reservation. | A declared table collides with a reserved table namespace. | store.reserve.table-namestore.reserve.table-nameManifest assembly raises StoreReservedTableName for a pipeline table inside a reserved namespace, naming the reservation. |
StoreCommitLockTimeoutstore.reserve.commit-waitA commit waits at most 30 s for its table's commit lock or for a lower value's publication, then raises StoreCommitLockTimeout, a transient failure. | A commit outwaited its table’s commit lock or a lower value’s publication. | store.reserve.commit-waitstore.reserve.commit-waitA commit waits at most 30 s for its table's commit lock or for a lower value's publication, then raises StoreCommitLockTimeout, a transient failure. |
StoreSchemaIncompatiblestore.reconcile.incompatibleAny other pair of types observed for one column raises StoreSchemaIncompatible at the write, naming the column, stored type and arriving type. | Two observed types for one column have no supertype in the lattice. | store.reconcile.incompatiblestore.reconcile.incompatibleAny other pair of types observed for one column raises StoreSchemaIncompatible at the write, naming the column, stored type and arriving type. |
StoreKeyWidenedstore.reconcile.key-wideningPrimary-key columns take no Float64 promotion: a widening batch raises StoreKeyWidened before any Parquet, and so does a fold meeting a key already reconciled to Float64. | A primary-key column takes the float promotion. | store.reconcile.key-wideningstore.reconcile.key-wideningPrimary-key columns take no Float64 promotion: a widening batch raises StoreKeyWidened before any Parquet, and so does a fold meeting a key already reconciled to Float64. |
FoldInputsExceedCachestore.fold.cached-inputsUnder lazy-parts, a fold fetches input parts through part-cache; inputs exceeding the cache raise FoldInputsExceedCache, naming both byte counts, and publish nothing. | A fold’s input parts exceed the part cache bound. | store.fold.cached-inputsstore.fold.cached-inputsUnder lazy-parts, a fold fetches input parts through part-cache; inputs exceeding the cache raise FoldInputsExceedCache, naming both byte counts, and publish nothing. |
StorePartialSnapshotstore.fold.partial-snapshotA reader observes a snapshot and every declared sidecar together or neither; a commit exposing one without the other raises StorePartialSnapshot. | A commit would expose snapshot data without its declared sidecars, or the reverse. | store.fold.partial-snapshotstore.fold.partial-snapshotA reader observes a snapshot and every declared sidecar together or neither; a commit exposing one without the other raises StorePartialSnapshot. |
StoreIndexIdColumnUnresolvedstore.index.id-column-unresolvedManifest validation raises StoreIndexIdColumnUnresolved when id_column is missing without a single-column primary key or with valid_time, names a valid-time table's single key, or differs across sidecars. | A table’s sidecars resolve no single id_column. | store.index.id-column-unresolvedstore.index.id-column-unresolvedManifest validation raises StoreIndexIdColumnUnresolved when id_column is missing without a single-column primary key or with valid_time, names a valid-time table's single key, or differs across sidecars. |
StoreIndexIdNotUniquestore.index.id-uniqueTwo staged snapshot rows sharing an id_column value make fold raise StoreIndexIdNotUnique, naming the table, column and value, and publish nothing. | One id_column value names two rows of a staged snapshot. | store.index.id-uniquestore.index.id-uniqueTwo staged snapshot rows sharing an id_column value make fold raise StoreIndexIdNotUnique, naming the table, column and value, and publish nothing. |
StoreIndexPathCollisionstore.index.path-collisionTwo sidecar declarations of one table resolving to one path under paths raise StoreIndexPathCollision, naming both, at manifest validation before either builds. | Two sidecar declarations of one table resolve to one path. | store.index.path-collisionstore.index.path-collisionTwo sidecar declarations of one table resolving to one path under paths raise StoreIndexPathCollision, naming both, at manifest validation before either builds. |
StoreIndexColumnAbsentstore.index.column-absentA reconciled schema lacking an index's column or id_column makes fold raise StoreIndexColumnAbsent before staging that build. | An index is declared over a column the reconciled schema lacks. | store.index.column-absentstore.index.column-absentA reconciled schema lacking an index's column or id_column makes fold raise StoreIndexColumnAbsent before staging that build. |
StoreIndexColumnTypestore.index.column-typeStoreIndexColumnType refuses an id_column other than text or integer, a vector-sidecar column other than vectors of dim, and a fulltext column other than text, at manifest validation when columns types them, otherwise before landing rows. | An indexed column or id_column carries a type the sidecar does not read. | store.index.column-typestore.index.column-typeStoreIndexColumnType refuses an id_column other than text or integer, a vector-sidecar column other than vectors of dim, and a fulltext column other than text, at manifest validation when columns types them, otherwise before landing rows. |
StorePartitionColumnTypestore.index.partition-typeA partition_by column typed binary or vector raises StorePartitionColumnType at validation, before any Parquet. | A partition_by column is typed binary or vector. | store.index.partition-typestore.index.partition-typeA partition_by column typed binary or vector raises StorePartitionColumnType at validation, before any Parquet. |
StoreEncryptionKeyUnboundstore.encrypt.key-unboundA key_source naming a binding the process lacks raises StoreEncryptionKeyUnbound at startup, with no cleartext fallback. | A declared key source names a binding the process lacks. | store.encrypt.key-unboundstore.encrypt.key-unboundA key_source naming a binding the process lacks raises StoreEncryptionKeyUnbound at startup, with no cleartext fallback. |
StoreIndexOverRedactedColumnstore.encrypt.redacted-indexAn index declared over a column redacted at write time raises StoreIndexOverRedactedColumn at manifest validation. | An index is declared over a column redacted at write time. | store.encrypt.redacted-indexstore.encrypt.redacted-indexAn index declared over a column redacted at write time raises StoreIndexOverRedactedColumn at manifest validation. |
SyncPrefixEscapestore.push.prefix-escapeA key resolving outside the prefix raises SyncPrefixEscape, naming the key and the prefix. | A key resolved outside the configured prefix. | store.push.prefix-escapestore.push.prefix-escapeA key resolving outside the prefix raises SyncPrefixEscape, naming the key and the prefix. |
SyncPrefixUnboundstore.push.prefix-unboundAn unset variable named by prefix_from raises SyncPrefixUnbound at startup, with no bucket-root fallback. | The variable named by prefix_from is unset at startup. | store.push.prefix-unboundstore.push.prefix-unboundAn unset variable named by prefix_from raises SyncPrefixUnbound at startup, with no bucket-root fallback. |
SyncPrefixOverspecifiedstore.push.prefix-overspecifiedDeclaring prefix and prefix_from together raises SyncPrefixOverspecified. | prefix and prefix_from are declared together. | store.push.prefix-overspecifiedstore.push.prefix-overspecifiedDeclaring prefix and prefix_from together raises SyncPrefixOverspecified. |
SyncPushInFlightstore.push.in-flightA push waits up to [sync] push_wait_secs, default 300 s, for another local push to release the store's push guard, then raises SyncPushInFlight, naming the holder. | A push of one store waited past its bound for the push guard another push on the machine holds. | store.push.in-flightstore.push.in-flightA push waits up to [sync] push_wait_secs, default 300 s, for another local push to release the store's push guard, then raises SyncPushInFlight, naming the holder. |
SyncManifestFormatUnsupportedstore.push.format-unsupportedA bucket or generation manifest with format above 2 raises SyncManifestFormatUnsupported, naming the key and format, before the push commit or any pull file write. | A bucket or generation manifest carries a format newer than the reader parses. | store.push.format-unsupportedstore.push.format-unsupportedA bucket or generation manifest with format above 2 raises SyncManifestFormatUnsupported, naming the key and format, before the push commit or any pull file write. |
SyncControlDivergedstore.push.control-divergedA push whose signed control head does not descend from the bucket head raises SyncControlDiverged, naming both heads, and leaves the bucket head unchanged. | A signed control head does not descend from the bucket’s head. | store.push.control-divergedstore.push.control-divergedA push whose signed control head does not descend from the bucket head raises SyncControlDiverged, naming both heads, and leaves the bucket head unchanged. |
SyncGenerationConflictstore.push.generation-conflictA push whose create of gen-<N>.json meets another commit's bytes raises SyncGenerationConflict, naming N, after its manifest commit applied. | A generation manifest already holds another commit’s bytes under the number a push committed. | store.push.generation-conflictstore.push.generation-conflictA push whose create of gen-<N>.json meets another commit's bytes raises SyncGenerationConflict, naming N, after its manifest commit applied. |
StoreValidTimeNotTimestampstore.bound-time.valid-time-typeA declared valid-time column whose type is not a timestamp raises StoreValidTimeNotTimestamp at declaration. | A declared valid-time column is not timestamp-typed. | store.bound-time.valid-time-typestore.bound-time.valid-time-typeA declared valid-time column whose type is not a timestamp raises StoreValidTimeNotTimestamp at declaration. |
StoreAsOfUnretainedstore.bound-time.as-of-unretainedAn as_of before the oldest snapshot retention kept, or selecting a snapshot collected-snapshot counts or whose successors fold a run absent here, raises StoreAsOfUnretained, naming the oldest answerable instant. | An as_of precedes the oldest retained snapshot of a table whose history was collected. | store.bound-time.as-of-unretainedstore.bound-time.as-of-unretainedAn as_of before the oldest snapshot retention kept, or selecting a snapshot collected-snapshot counts or whose successors fold a run absent here, raises StoreAsOfUnretained, naming the oldest answerable instant. |
StoreValidTimeUndeclaredstore.bound-time.valid-time-undeclaredA valid_as_of read against a table declaring no pair raises StoreValidTimeUndeclared, naming the table. | A valid-time-bounded read names a table declaring no pair. | store.bound-time.valid-time-undeclaredstore.bound-time.valid-time-undeclaredA valid_as_of read against a table declaring no pair raises StoreValidTimeUndeclared, naming the table. |
StoreAvailableTimeNullstore.available-time.undeclaredAn available_as_of read of a table declaring no available_time raises StoreAvailableTimeUndeclared, naming the table; a landing row resolving to a null instant raises StoreAvailableTimeNull, naming the table and run. | A landing row resolves to a null availability instant. | store.available-time.undeclaredstore.available-time.undeclaredAn available_as_of read of a table declaring no available_time raises StoreAvailableTimeUndeclared, naming the table; a landing row resolving to a null instant raises StoreAvailableTimeNull, naming the table and run. |
StoreAvailableTimeUndeclaredstore.available-time.undeclaredAn available_as_of read of a table declaring no available_time raises StoreAvailableTimeUndeclared, naming the table; a landing row resolving to a null instant raises StoreAvailableTimeNull, naming the table and run. | An availability-bounded read names a table declaring no availability time. | store.available-time.undeclaredstore.available-time.undeclaredAn available_as_of read of a table declaring no available_time raises StoreAvailableTimeUndeclared, naming the table; a landing row resolving to a null instant raises StoreAvailableTimeNull, naming the table and run. |
StoreVintageHashUndeclaredstore.available-time.vintage-validationA vintage table declaring no content_hash_column raises StoreVintageHashUndeclared, and one declaring retain-rows raises StoreVintageRetainRows, at validation, naming the table. | A vintage table declares no content_hash_column. | store.available-time.vintage-validationstore.available-time.vintage-validationA vintage table declaring no content_hash_column raises StoreVintageHashUndeclared, and one declaring retain-rows raises StoreVintageRetainRows, at validation, naming the table. |
StoreVintageRetainRowsstore.available-time.vintage-validationA vintage table declaring no content_hash_column raises StoreVintageHashUndeclared, and one declaring retain-rows raises StoreVintageRetainRows, at validation, naming the table. | A vintage table declares a row-age retention cutoff. | store.available-time.vintage-validationstore.available-time.vintage-validationA vintage table declaring no content_hash_column raises StoreVintageHashUndeclared, and one declaring retain-rows raises StoreVintageRetainRows, at validation, naming the table. |
ReplicaWriteRefusedstore.replicate.write-refusedA write verb against a replica raises ReplicaWriteRefused, naming the canonical store. | A write verb was invoked against a replica. | store.replicate.write-refusedstore.replicate.write-refusedA write verb against a replica raises ReplicaWriteRefused, naming the canonical store. |
ReplicaPartialParquetstore.replicate.partial-parquetA replica lacking any of a snapshot's Parquet files makes refresh raise ReplicaPartialParquet and leave that snapshot unpublished. | A replica holds a strict subset of a snapshot’s data files. | store.replicate.partial-parquetstore.replicate.partial-parquetA replica lacking any of a snapshot's Parquet files makes refresh raise ReplicaPartialParquet and leave that snapshot unpublished. |
ReplicaMissingIndexstore.replicate.missing-indexA query needing a sidecar or partition the replica lacks raises ReplicaMissingIndex, naming the refresh supplying it. | A query needs a sidecar or partition the replica lacks. | store.replicate.missing-indexstore.replicate.missing-indexA query needing a sidecar or partition the replica lacks raises ReplicaMissingIndex, naming the refresh supplying it. |
ReplicaSensitiveTablestore.replicate.sensitive-refusedA refresh requesting a replicate-off table raises ReplicaSensitiveTable. The consumer reads that table through the query proxy. | A refresh requested a replicate-off table. | store.replicate.sensitive-refusedstore.replicate.sensitive-refusedA refresh requesting a replicate-off table raises ReplicaSensitiveTable. The consumer reads that table through the query proxy. |
SyncRunsUnpushedstore.drain.statuscontextful sync status prints JSON error, the counts open and lost of marked runs, and runs, each with pipeline, table, node, end instant and lost; any run not lost reports SyncRunsUnpushed, exiting 3. | A run opened on a disposable disk carries an unpushed mark no committed push has cleared. | store.drain.statusstore.drain.statuscontextful sync status prints JSON error, the counts open and lost of marked runs, and runs, each with pipeline, table, node, end instant and lost; any run not lost reports SyncRunsUnpushed, exiting 3. |
SyncStatusUnreadstore.drain.status-unreadA sync status failing to read the execution database prints runs as null and error as SyncStatusUnread with its cause, exiting 1. | A status check reached no answer from the execution database holding the unpushed marks. | store.drain.status-unreadstore.drain.status-unreadA sync status failing to read the execution database prints runs as null and error as SyncStatusUnread with its cause, exiting 1. |
SyncEndpointUnsupportedstore.endpoint.unsupported-schemeAny other scheme, or an S3 or R2 endpoint in a build without the s3-sync feature, raises SyncEndpointUnsupported, naming the endpoint. | An endpoint’s scheme names no bucket adapter this build links. | store.endpoint.unsupported-schemestore.endpoint.unsupported-schemeAny other scheme, or an S3 or R2 endpoint in a build without the s3-sync feature, raises SyncEndpointUnsupported, naming the endpoint. |
SyncEndpointInsecurestore.endpoint.plaintextAn http:// endpoint opens on a loopback host alone; any other host raises SyncEndpointInsecure, naming it. | A plain http:// endpoint names a host off loopback. | store.endpoint.plaintextstore.endpoint.plaintextAn http:// endpoint opens on a loopback host alone; any other host raises SyncEndpointInsecure, naming it. |
SyncCredentialUnboundstore.endpoint.credential-unboundAn S3 or R2 [sync] omitting access_key_id or secret_access_key, supplying a non-reference credential, or naming an unset variable raises SyncCredentialUnbound, naming the key. | An S3 or R2 endpoint’s [sync] binds a credential key to no reference, or to an unset variable. | store.endpoint.credential-unboundstore.endpoint.credential-unboundAn S3 or R2 [sync] omitting access_key_id or secret_access_key, supplying a non-reference credential, or naming an unset variable raises SyncCredentialUnbound, naming the key. |
SyncRoleUnavailablestore.endpoint.role-unavailableUnder role-credentials, a bucket open that no role source answers raises SyncRoleUnavailable, naming each source tried. | No workload-role source answers a bucket whose [sync] selects role credentials. | store.endpoint.role-unavailablestore.endpoint.role-unavailableUnder role-credentials, a bucket open that no role source answers raises SyncRoleUnavailable, naming each source tried. |
SyncCredentialConflictstore.endpoint.role-conflictcredentials = "role" beside a key credential credentials binds, or on an R2 endpoint, raises SyncCredentialConflict, naming the endpoint. | Role credentials beside a key, or on an R2 endpoint. | store.endpoint.role-conflictstore.endpoint.role-conflictcredentials = "role" beside a key credential credentials binds, or on an R2 endpoint, raises SyncCredentialConflict, naming the endpoint. |
SyncProbeInconclusivestore.probe.inconclusiveAn unsupported-method response, a forbidden response or a transport error raises SyncProbeInconclusive and counts as capability not demonstrated. | The conditional-write probe met an unsupported method, a forbidden response or a transport error. | store.probe.inconclusivestore.probe.inconclusiveAn unsupported-method response, a forbidden response or a transport error raises SyncProbeInconclusive and counts as capability not demonstrated. |
SyncCoordinationUnprovenstore.probe.unprovenDeclaring cas against a backend the probe did not demonstrate raises SyncCoordinationUnproven and stops the push. | cas is declared against a backend the probe did not demonstrate. | store.probe.unprovenstore.probe.unprovenDeclaring cas against a backend the probe did not demonstrate raises SyncCoordinationUnproven and stops the push. |
LeaseHeldstore.lease.heldIf a run finds an unexpired lease, the engine raises LeaseHeld, names the holder and expiry, and skips the run. The engine retries the run at the next reconciliation tick. | A run or pass found an unexpired lease another node holds. | store.lease.heldstore.lease.heldIf a run finds an unexpired lease, the engine raises LeaseHeld, names the holder and expiry, and skips the run. The engine retries the run at the next reconciliation tick. |
LeaseFencedstore.lease.stale-fenceIf a commit-log create, pointer replacement or catalog UPDATE loses its condition to a higher commit fence, the operation raises LeaseFenced. The associated run or snapshot stays unreadable. | A commit, pointer replace or catalog update losing its condition to a higher fence. | store.lease.stale-fencestore.lease.stale-fenceIf a commit-log create, pointer replacement or catalog UPDATE loses its condition to a higher commit fence, the operation raises LeaseFenced. The associated run or snapshot stays unreadable. |
LeaseNotHeldstore.lease.not-heldReleasing a lease another node holds, or one a later acquisition of the same node fenced past, raises LeaseNotHeld and leaves the object untouched. | A release was attempted against a lease another node holds. | store.lease.not-heldstore.lease.not-heldReleasing a lease another node holds, or one a later acquisition of the same node fenced past, raises LeaseNotHeld and leaves the object untouched. |
LeaseCursorKindMismatchstore.lease.cursor-kindA cursor whose kind takes no lease reaching cursors/ raises LeaseCursorKindMismatch. | A cursor whose kind takes no lease reached cursors/. | store.lease.cursor-kindstore.lease.cursor-kindA cursor whose kind takes no lease reaching cursors/ raises LeaseCursorKindMismatch. |
LeaseNodeIdLocalstore.lease.local-nodeA bucket lease attempted under the node id local raises LeaseNodeIdLocal, logging the variable that sets a node id; that machine keeps the machine lease. | A bucket lease was attempted under the reserved node id local. | store.lease.local-nodestore.lease.local-nodeA bucket lease attempted under the node id local raises LeaseNodeIdLocal, logging the variable that sets a node id; that machine keeps the machine lease. |
SyncTombstoneForeignstore.merge.tombstone-ownerA tombstone whose owner differs from the owner of the entry it names raises SyncTombstoneForeign, and the merge keeps the entry. | A tombstone names an entry another node owns. | store.merge.tombstone-ownerstore.merge.tombstone-ownerA tombstone whose owner differs from the owner of the entry it names raises SyncTombstoneForeign, and the merge keeps the entry. |
SyncTombstoneUnverifiedstore.merge.tombstone-unverifiedUnsigned tombstones, invalid signatures, or keys absent from the key-set ledger's verifying set at deleted_at raise SyncTombstoneUnverified. Merge preserves the named entry; pull deletes nothing. | A tombstone is unsigned, fails its signature, or names a signer the key-set ledger does not verify. | store.merge.tombstone-unverifiedstore.merge.tombstone-unverifiedUnsigned tombstones, invalid signatures, or keys absent from the key-set ledger's verifying set at deleted_at raise SyncTombstoneUnverified. Merge preserves the named entry; pull deletes nothing. |
SyncManifestRebaseExhaustedstore.merge.exhaustedExhausting retries or round-ceiling raises SyncManifestRebaseExhausted, reports every uploaded object as in the bucket and asks for a re-run. | The bucket manifest commit lost its race past the retry bound or the round ceiling. | store.merge.exhaustedstore.merge.exhaustedExhausting retries or round-ceiling raises SyncManifestRebaseExhausted, reports every uploaded object as in the bucket and asks for a re-run. |
SyncCursorConflictstore.merge.cursor-recencyResolving a cursor by last-write time raises SyncCursorConflict. A cursor resolves through its commit. | A cursor was resolved by recency instead of through its commit. | store.merge.cursor-recencystore.merge.cursor-recencyResolving a cursor by last-write time raises SyncCursorConflict. A cursor resolves through its commit. |
SyncHeldRecordUnreadablestore.merge.held-unreadableAn unreadable .sync-held.json raises SyncHeldRecordUnreadable without granting deletion authority or replacing the record. | The local ownership record cannot be read or decoded. | store.merge.held-unreadablestore.merge.held-unreadableAn unreadable .sync-held.json raises SyncHeldRecordUnreadable without granting deletion authority or replacing the record. |
SyncObjectDigestMismatchstore.pull.digest-mismatchA downloaded object whose digest differs from its manifest entry is discarded and raises SyncObjectDigestMismatch; run states follow run-state-torn instead. | A downloaded object’s digest differs from its entry. | store.pull.digest-mismatchstore.pull.digest-mismatchA downloaded object whose digest differs from its manifest entry is discarded and raises SyncObjectDigestMismatch; run states follow run-state-torn instead. |
StoreIdentityConflictstore.pull.identity-conflictA pull into a store holding a different store-identity raises StoreIdentityConflict before downloading files. | A pull would replace one store UUID with another. | store.pull.identity-conflictstore.pull.identity-conflictA pull into a store holding a different store-identity raises StoreIdentityConflict before downloading files. |
SyncPullDidNotConvergestore.pull.unconvergedExhausting those retries raises SyncPullDidNotConverge, naming the key that kept moving, and writes no pointer. | A pull exhausted its retries against keys moving beneath it. | store.pull.unconvergedstore.pull.unconvergedExhausting those retries raises SyncPullDidNotConverge, naming the key that kept moving, and writes no pointer. |
SyncLocalFoldUnrecoverablestore.pull.local-fold-unrecoverableA branch back to the bucket's chain or a root that folds a run neither on disk, listed in the bucket nor folded on that chain, or meets an absent manifest, raises SyncLocalFoldUnrecoverable naming the runs, and the pointer stays. | A local pointer off the bucket’s chain folds runs neither the store nor the bucket holds. | store.pull.local-fold-unrecoverablestore.pull.local-fold-unrecoverableA branch back to the bucket's chain or a root that folds a run neither on disk, listed in the bucket nor folded on that chain, or meets an absent manifest, raises SyncLocalFoldUnrecoverable naming the runs, and the pointer stays. |
SyncPullTablesEmptystore.pull.tables-emptyA [sync] pull_tables holding no pattern raises SyncPullTablesEmpty when the config is read; [""] names every table. | A store’s [sync] pull_tables holds no pattern. | store.pull.tables-emptystore.pull.tables-emptyA [sync] pull_tables holding no pattern raises SyncPullTablesEmpty when the config is read; [""] names every table. |
SyncGenerationAbsentstore.pull.generation-absentA generation the bucket holds no gen-<N>.json for raises SyncGenerationAbsent, naming N and the newest generation, and writes nothing. | A pull names a generation the bucket holds no generation manifest for. | store.pull.generation-absentstore.pull.generation-absentA generation the bucket holds no gen-<N>.json for raises SyncGenerationAbsent, naming N and the newest generation, and writes nothing. |
SyncGenerationDivergedstore.pull.generation-divergedA local syncable file in scope that the generation omits makes generation pull raise SyncGenerationDiverged, naming the file, and write nothing. | A generation pull meets a local file the generation does not list. | store.pull.generation-divergedstore.pull.generation-divergedA local syncable file in scope that the generation omits makes generation pull raise SyncGenerationDiverged, naming the file, and write nothing. |
SyncFoldedRunsUnfetchedstore.pull.folded-runs-unreachableA store listing skipped manifests and opened without a part source raises SyncFoldedRunsUnfetched wherever folded-runs-fetched or husks-fetched fetches, naming the table and a manifest. | A store whose lazy pull skipped folded run manifests reads its runs without a part source. | store.pull.folded-runs-unreachablestore.pull.folded-runs-unreachableA store listing skipped manifests and opened without a part source raises SyncFoldedRunsUnfetched wherever folded-runs-fetched or husks-fetched fetches, naming the table and a manifest. |
SyncPartCollectedstore.pull.part-collectedA part lazy-parts needs and the bucket lacks raises SyncPartCollected, naming the part and snapshot; the next pull advances the pointer past that snapshot. | A part a lazy store needs is gone from the bucket. | store.pull.part-collectedstore.pull.part-collectedA part lazy-parts needs and the bucket lacks raises SyncPartCollected, naming the part and snapshot; the next pull advances the pointer past that snapshot. |
SyncRelandUnneededstore.pull.reland-unneededA reland of a table holding no local pointer, against a bucket naming no snapshot, of a pointer pointer-advance keeps or advances, or of a branch folding no unrecoverable run raises SyncRelandUnneeded, writing nothing. | A reland names a table whose local pointer the next pull keeps or replaces without a refusal. | store.pull.reland-unneededstore.pull.reland-unneededA reland of a table holding no local pointer, against a bucket naming no snapshot, of a pointer pointer-advance keeps or advances, or of a branch folding no unrecoverable run raises SyncRelandUnneeded, writing nothing. |
SyncRelandHeadAbsentstore.pull.reland-head-absentA reland while the bucket pointer's snapshot lacks its manifest on disk, or a Parquet part outside lazy-parts, raises SyncRelandHeadAbsent, naming the snapshot; the refused pull brings it home. | A reland finds the bucket pointer’s snapshot not whole on disk. | store.pull.reland-head-absentstore.pull.reland-head-absentA reland while the bucket pointer's snapshot lacks its manifest on disk, or a Parquet part outside lazy-parts, raises SyncRelandHeadAbsent, naming the snapshot; the refused pull brings it home. |