Refusals

What the store says no to, by name — and the principle that decides which mistakes get a refusal instead of an answer.

A refusal names itself, and the message carries the span in your script, so the place is part of the answer rather than something to go looking for.

The names below are stable. Most of them are also the vocabulary the store's own conformance corpus asserts against; the rest are raised outside it — by backup, sign-in, tenancy and the cluster peers — and are named here on the same terms. They are not on the wire. What reaches a client is the message: over HTTP a body of {"error": "…"}, over the wire protocol the store's own text carried through verbatim. A client that must branch on a refusal branches on the HTTP status — see The HTTP surface — or on the protocol's error class, and reads the message for the rest.

The principle

Not every unexpected thing is a refusal. The store draws one line, in one place, and every row below follows from it:

An absence narrows a read. A mistake in the statement refuses it.

A record that lacks the field a call reads simply is not in the answer — because refusing there would let one record missing one field fail an entire read, and data is allowed to be incomplete. But a value that is present and of the wrong type, an argument count that cannot be right, a name that does not exist: those are bugs in the statement, and a store that guessed past them would return a confident wrong answer.

Reading and writing

name	means
`NoNamespaceSelected`	a statement before `USE NAMESPACE` — the first refusal most people meet
`NoDatabaseSelected`	the same, for `USE DATABASE`; guessing which database a write belongs to is the one mistake reading the result cannot undo
`RecordExists`	`CREATE` on a record that is there — say `UPDATE` to replace it
`NoSuchRecord`	`UPDATE` on a record that is not — class `conflict` (`409`) from `0.33.4-beta`, because it disagrees with the store's state rather than being a malformed statement
`ParamExists`	`DEFINE PARAM` for a name the database already holds — say `OR REPLACE` or `IF NOT EXISTS`
`CountNotAWholeNumber`	`LIMIT $n`, `START $n` or `CLAIM $n` bound to something that is not a whole number at or above its floor
`Unknown`	a table, user, role or namespace that does not exist
`NoRecordInScope`	a path read where there is no record to read it from
`ArithmeticFailed`	an operator with no answer for the values it was given
`NoSuchRouteToAssign`	assigning to a route the record does not have
`EdgePropertiesNotAnObject`	an edge's properties written as something other than an object
`ConditionNotBoolean`	a `WHERE` that does not answer true or false
`UniqueViolation`	a write that would put two records in one unique entry
`SchemaViolation`	a value that does not match its field's declared type
`MissingRequiredField`	a required field with no value, on write or on declaration
`AssertionViolation`	a value its field's `ASSERT` does not accept
`UndeclaredField`	a field a table does not declare — the message carries the `DEFINE FIELD` that would accept it, parsed before it is offered, so it can be pasted rather than adapted
`RecordsRefused`	more than one record refused by one statement — it carries every refusal, not the first, because the row is the unit you go back and fix
`InsertRowArity`	an `INSERT` row holding a different number of values than its field list — refused at parse, so nothing before it is written
`IdentityUnavailable`	a table minting uuid identities could not produce one: the operating system's randomness source could not be read, or the clock reads a time before 1970. There is no fallback, because an identity that is not random is one two writers can collide on. A table left at the default per-table counter never meets this
`MergeIsNotAnObject`	`MERGE` folds an object in, and this was something else
`Unbounded`	a read standing as a source passed its ceiling without a bound of its own — give it a `LIMIT` saying how many records the question is about
`UnboundedCollection`	the same, for a fold: collecting over an unbounded source is refused rather than answered from a prefix
`NotAlone`	`ONLY` says one record answers and more than one did — narrow it, or drop the word and take the list
`TimedOut`	the read passed its `TIMEOUT` — refused rather than answered in part, because a short list with no mark on it is the failure the clause exists to prevent
`EmptyTimeout`	a timeout of zero can only ever refuse; a ceiling is a positive duration
`ConditionNotMet`	a `WHERE` on an `UPDATE` the record does not satisfy — the condition is a compare-and-set, so nothing was written

Reading the script

These come from the parser, before anything runs. Every one of them carries the span in your script, so the position is part of the answer rather than something to go looking for.

name	means
`UnexpectedToken`	the parser met something it cannot read there
`UnexpectedCharacter`	a character that begins no token
`UnexpectedEnd`	the script ended where something was still expected
`UnterminatedString`	a string literal that reached the end of the script without closing
`DuplicateField`	one object writing the same field twice
`Unsupported`	a feature the language reserves and this milestone does not have
`Unrenderable`	a statement this milestone does not write back out
`BoundTwice`	the same name is bound twice in one script — which of the two a later statement meant is not a question the store should answer
`BindingCollidesWithParameter`	a name the caller supplied is also bound by the script; one of them would silently win
`BindingIsNotAValue`	a binding must produce exactly one value, so a read that answers with many cannot stand behind `LET`
`ReturnedTwice`	a script answers with one value, and this one has two `RETURN`s

Writing a value

A literal that cannot be read is refused where it is written, rather than stored as text and found to be wrong later.

| name | means |

`NestedTooDeep`	a value written, or a statement, nests containers or expressions past the depth limit — the message names which and the limit
`InvalidNumber`	not a number this store can hold
`InvalidDecimal`	not a decimal it can hold exactly
`InvalidDatetime`	not an instant — RFC 3339 is expected, as in `1970-01-01T00:00:00Z`
`InvalidDuration`	not a duration this store can hold
`InvalidUuid`	not a uuid
`InvalidBytes`	a byte literal that could not be read
`InvalidEscape`	an escape sequence the string reader does not know
`InvalidRecordId`	an id that is not an integer, text, a uuid or bytes
`NotARecordIdentity`	a parameter holding something a record cannot be identified by

Projections and folds

name	means
`UnnamedProjection`	a projected expression with no `AS`
`DuplicateProjection`	two projections that would arrive under one name
`UngroupedProjection`	a grouped read projecting something that is not a key or a fold
`FoldInsideAFold`	`mean(sum(n))` — the inner one leaves nothing to fold
`FoldInAFilter`	a fold in a `WHERE` or an `ORDER BY`, which see one record at a time
`FoldOutsideAGroup`	a fold where there is nothing to fold over
`NotSummable`	folding something that is not a number
`StarIsOnlyForCount`	`sum(*)` — only `count` can fold the records themselves

Routes and several values

name	means
`SeveralOutsideAComparison`	`tags[*]` nested inside a call, where several has no rule
`SeveralInAUniqueIndex`	unique across elements, or unique per record? — say which
`SeveralInAnAnalysedIndex`	a search or spatial index decides its own multiplicity
`SeveralRoutesInOneIndex`	the cross product of two arrays is nobody's intention

Joins

name	means
`NotASideOfTheJoin`	an `ON` naming something that is neither side
`OneSidedJoin`	both sides of an `ON` naming the same one — a join needs a route into each
`JoinKeyIsNotAField`	a join key that names a position rather than a field
`JoinKeysDiffer`	the two sides were matched on keys whose kinds do not overlap, so the join could only ever answer no rows — refused instead of returning the empty answer a correct query also returns

Definitions

name	means
`NameTaken`	a name already in use — add `IF NOT EXISTS` if that is fine
`TableWithoutColumns`	`DEFINE TABLE t` with no columns at all — there is nothing for it to be strict about, and the refusal names both of the things its author might have meant: `DEFINE COLLECTION t`, or `DEFINE TABLE t SCHEMALESS`
`DefaultDoesNotMatch`	a `DEFAULT` that is not of the field's type
`AssertionNotAConstraint`	an `ASSERT` that is a call, a parameter other than `$value`, or a route reaching several values — a name in the same record is allowed
`NoSearchIndex`	`search::score` over a field with no search index
`NotAnEdgeTable`	`RELATE` or a traversal over a table not declared `EDGE`
`NoSuchDistance`	a vector index declared with a distance the store does not know
`UnknownIdentityKind`	`IDENTITY` naming something other than `int` or `uuid` — the refusal names both and says what each gives you
`StillDepended`	the definition is still depended on by something else, and the refusal names the first of them
`DuplicateMapping`	a consumer maps one message field more than once, so which mapping wins would be undefined
`EmptyIndex`	an index declared over no fields
`NoSuchParent`	a definition naming a namespace, database or table that is not there
`ReplicationUnstated`	a namespace that does not say how many copies to keep, on a store that declares peers which could hold one — say `REPLICATION NONE` for a single copy, or name the number
`ExpiryNotOnThisKind`	`EXPIRE` declared on a kind whose records cannot carry a lifetime of their own — only a table or a collection can; a space and a topic keep their own `EXPIRE` and `RETAIN`, and a series has its floor
`TableDoesNotExpire`	a write saying `EXPIRE <when>` on a table that does not declare expiry, or whose declaration was dropped — `ALTER TABLE t SET EXPIRE` first; `EXPIRE NONE` and `PERSIST` stay allowed

Graphs and walks

`PathWeight`	`WEIGHT f` met an edge whose `f` is text or negative; a step's cost is a number of zero or more
`EndpointsNotDeclared`	a `RELATE` between a pair the edge table does not join — it was declared with `EDGE FROM … TO …`, and a link into a table the graph was never told about leaves the structure you thought you had, with nothing downstream in an error state
`EndpointOutsideGraph`	an edge kind whose far side is a table that does not belong to the graph — belonging is what bounds a walk, and a kind reaching outside it would answer with records the graph does not contain
`TableBelongsToGraph`	`DROP TABLE` on a graph's own node collection — `DROP GRAPH` is the statement that removes it, and the refusal says so. A table you attached with `IN` is one you wrote and may withdraw, and still drops freely
`DepthBelowOne`	`DEPTH` counts steps, so it starts at one — refused rather than answered with an empty set, because a caller who computed that bound and got zero has a bug an empty answer would hide
`DepthNeedsOneHopToATable`	`DEPTH` repeats one step, so it needs a walk of exactly one hop that names the table it lands on — a property of the statement, refused when it is read

Vectors

name	means
`VectorWidthBelowOne`	`vector<0>` — a vector holds at least one component, and a type nothing useful satisfies is a mistake rather than a constraint
`VectorWidthAboveTheCeiling`	a width above what the catalog can hold, refused where the number was written rather than discovered later by a reader
`EffortBelowOne`	a walk keeps at least one candidate; zero would answer empty, and an empty answer cannot be told apart from a store that holds nothing

Full-text search

| name | means |

`NgramFilter`	an analyzer naming an n-gram filter — a word's beginning, a piece of it and a misspelling are `MATCHES PREFIX`, `MATCHES INFIX` and `MATCHES FUZZY`
`PrefixTooShort`	a `MATCHES PREFIX` shorter than three characters — two reach a large fraction of an English vocabulary, so the cost is paid in full for an answer nobody can use. Raised before an access path is chosen, so adding an index cannot change whether the statement runs
`NegationWithoutTerm`	a query that excludes without requiring, as in `NOT babbage` — that names the complement of a posting list, which is every record in the table and the one thing an index cannot enumerate. Add a word to match and the exclusion applies to it
`MalformedSlop`	a tail after a phrase's closing quote that is not `~` and a whole number — reading it as an exact phrase would answer a question the caller did not ask, and the empty answer would look exactly like "nothing matched"
`NotFused`	`search::ranks()` outside the projection of a read ordered by `FUSE (…)` — a place is the fusion's, not the record's. A fused order that is malformed (one branch, a weight of zero, `DEPTH 0`, another key beside it, `GROUP BY`, `AFTER`) is refused while the statement is read
`IndexReadsOneField`	a `SEARCH`, `SPATIAL` or `VECTOR` index naming more than one field — declare one index per field; before `0.20.0-beta` the declaration was accepted and indexed the first field alone
`SearchExists`	`DEFINE SEARCH` with a name already taken in the database (One search over several tables)
`SearchNamesTableTwice`	a search naming one table under two `ON` clauses — list its fields once, after one `ON`
`SearchNamesFieldTwice`	a search naming one field of a table twice
`WeightOutOfRange`	a field's `WEIGHT` at or below zero, above 1000, or with more than three decimal places
`NotOneWord`	a synonym or stop word that is not one word — a phrase as an alternative would make a quoted phrase a different length depending on which word was typed
`SearchNeedsText`	`FROM SEARCH … MATCHES` given something other than text to search for
`SearchIsItsOwnOrder`	an `ORDER BY` over an ungrouped `FROM SEARCH` — a search answers in the order it ranks; rank by `search::score()` or order a grouped read
`NotSearched`	`search::score()`, `search::table_name()` or `search::snippet()` in a read that is not a `FROM SEARCH` — each answers about a record a search ranked

Calls

name	means
`NoSuchFunction`	no function of that name
`WrongArity`	the wrong number of arguments — caught before anything runs
`WrongArgument`	an argument of the wrong type
`CallFailed`	the call could not produce an answer
`NotArithmetic`	arithmetic on something that is not a number
`NotCastable`	a cast was asked to read a value as a type it cannot be read as

Geometry

name	means
`MalformedGeometry`	not one of the seven types, or a coordinate that is not a pair
`GeometryRefused`	a shape the sphere does not admit — an unclosed ring, overlapping members, a coordinate off the world, or a polygon whose way round is not stated
`ComputedGeometry`	a shape built from an expression rather than written out

Files

name	means
`NotABucket`	`PUT` on an ordinary table
`FileNeedsAPath`	a file identified by something other than a path
`FileIsNotBytes`	a file written from a value that is not bytes
`NotWrittenByHand`	`CREATE` on a bucket — the store fills the metadata in
`WriteWouldLeaveAHole`	a ranged write starting past the end of the file
`FileAboveBucketCeiling`	a write that would take the file past the bucket's `MAX` — the message names the size the whole file would reach, not the size of the piece being spliced in, because a ranged write reaches the ceiling by splicing
`FileIsIncomplete`	a file whose chunks do not cover it

Vaults

A vault seals its fields, so most of its refusals are about a key, a recipient, or an attempt to reach a value the store itself cannot read.

| name | means | | NoVaultRoot | a vault statement before the store has a passphrase — the first UNSEAL VAULT sets it | | PassphraseThrottled | the node is not taking a passphrase right now: too many recent wrong ones for this store, or as many checks running as it allows; wait and try again |

`VaultUsesStorePassphrase`	a vault statement naming a vault that opens with the store's passphrase — use the form without a name
`NotReadBySelect`	`SELECT` on a vault — a vault is read with `REVEAL … FROM`, which is the statement that asks for the value to be opened
`SecretNeedsVault`	`SECRET` on a table that is not a vault
`NotASecret`	a field that is not one of the vault's secret fields
`NotIndexable`	an index over a secret field — the store holds it sealed, so there is nothing to order or match on
`VaultIsStrict`	a vault made schemaless: a field nobody declared is a field nothing seals
`VaultNotAnObject`	a record written to a vault as something other than an object
`VaultReservedField`	a field named the same as the place a vault keeps its wrapped keys
`VaultEditComputesFromTheRecord`	an edit that computes from the record it is editing — the old value is sealed, so write the value or replace the record with `UPDATE … = { … }`
`RecipientIsNotAName`	a recipient given as something other than text
`VaultNoRecipient`	a recipient that is not one of this record's
`VaultRecipientExists`	a recipient this record already has
`VaultReservedRecipient`	the vault's own entry, offered as a recipient
`VaultNoKey`	no key for this vault in the keyring — the record is there and cannot be opened
`VaultUnavailable`	the keyring is unavailable in this process
`AuditUnavailable`	a read of a vault that could not be recorded, and so is not served

Views

| name | means | | MaterializedShape | a materialized view whose read cannot be kept current from one table's changes — it reads more than one table, FETCHes, names a VERSION, a node, a TIMEOUT, an AFTER, or is approximate or fused; the message names which |

`MaterializedFromHidden`	a materialized view read by a user who may read its table only in part — its rows were computed already and cannot be redacted; read the table instead
`ViewIsNotATable`	a write to a view — a view holds no records of its own, so it can only be read from
`ViewUnreadable`	the read a view stores no longer parses; the message carries what broke
`ViewsTooDeep`	views nested past the depth limit — the message names the chain

Events

name	means
`EventExists`	`DEFINE EVENT` with a name the table already carries — `IF NOT EXISTS` makes it a no-op
`EventOnKind`	an event on a vault, topic, queue, view, space, bucket, series or vector or geo store — only tables, collections and edge tables carry events
`EventBody`	an event body holding a statement it may not run — it writes, `LET`s and `THROW`s, inside the writer's transaction and its table's database
`EventFailed`	an event's body refused, so the write that ran it is refused; the message carries the event, the table and the inner refusal unchanged, and from `0.33.4-beta` its class is the inner refusal's class
`EventDepth`	events triggering events past 16 deep — a chain that writes back into itself; give the body a `WHEN` that excludes its own change

Queues and time series

`NoConsumerDeclared`	`RELEASE ALL` before `USE CONSUMER` and without a named consumer
`NotAQueue`	`CLAIM` or `RELEASE` on a table that is not one — declare it with `DEFINE QUEUE`
`ClaimAboveCeiling`	a claim asking for more records than the queue's ceiling
`NoDelayField`	`RELEASE … NOT BEFORE` on a queue that declares no `NOT BEFORE` field
`NotAnInstant`	`RELEASE … NOT BEFORE` given something that is neither a datetime nor a duration
`DeduplicationKey`	a message for a deduplicating topic whose key field holds something no identity can be made of
`ClaimDeadlineUnreachable`	a claim whose timeout lands past the end of representable time
`QueueFieldIsTheEngines`	a write to a field the store owns on a queue — `CLAIM` and `RELEASE` set it
`EmptyRetention`	a retention that leaves nothing to answer with; a floor is a positive duration
`SeriesTimeMissing`	a record written to a `TIME` series without its time field, or with one that is not a datetime
`SeriesTimeOutOfRange`	an event time a series cannot order — before 1970, or past the range its identity carries
`BelowSeriesFloor`	an event whose time is already past the series' retention — it would be written and never read
`SeriesIdentityDerived`	an identity named by hand on a `TIME` series — the store mints it from the time field
`SeriesTimeFixed`	a change to a record's time field on a `TIME` series — delete it and write it again
`FillNeedsWindow`	`FILL` without exactly one `time::bucket` key of a constant width
`FillNeedsRange`	`FILL … FROM … TO …` whose ends are not both datetimes
`FillTooWide`	a `FILL` that would answer more than a million windows
`LatestNeedsSeries`	`LATEST BY` on a table that is not a series
`LatestBesideGroup`	`LATEST BY` and `GROUP BY` in one read — say one
`AsofNeedsTime`	`ASOF JOIN` with a side that is not a series declared with `TIME`
`RollupNeedsSeries`	`DEFINE ROLLUP` over a table that is not a `TIME` series
`RollupFold`	a rollup `COMPUTE` other than `count`, `sum`, `min` and `max`, each once
`RollupWindow`	a rollup window that is not a whole number of seconds
`RollupIsDerived`	a write to a rollup's own table — write the series instead
`RollupInTransaction`	`DEFINE ROLLUP` inside `BEGIN … COMMIT`
`RollupKeyCollision`	two keys of one window whose rows would share an identity
`RollupsDependOn`	`DROP SERIES` while rollups are kept of it

Keys

name	means
`InvalidKeyBound`	a range bound that could not be a key
`NotARange`	a range where one is required
`InvalidExpiry`	an expiry a key cannot take — a `SET … EXPIRE` not in the future, or a value that is neither a duration nor a datetime
`SpaceFull`	a write past a space's `MAX` when it is declared `EVICT NONE`, or one commit adding more keys than the limit

Topics

name	means
`NotATopic`	`READ FROM` or `INFO FOR TOPIC` on a table that is not one — declare it with `DEFINE TOPIC`
`TopicIsAppendOnly`	an `UPDATE`, `UPSERT` or `DELETE` of a message; a correction is a new message
`TopicMessageTooLarge`	a message larger than the topic's `MAX BYTES`
`TopicRateExceeded`	an anonymous append past the topic's `PUBLIC RATE` on this node; retriable after a wait
`TopicPositionsExhausted`	a topic that has given out every position a 64-bit counter holds
`InvalidPosition`	a position or a count on `READ FROM` that is not a whole number at or above zero
`GroupExists`	`DEFINE GROUP` under a name the topic already has a group for; `IF NOT EXISTS` accepts it as it stands
`NoSuchGroup`	`ALTER GROUP` or `DROP GROUP` naming a group the topic does not have
`NotAGroup`	`ACK` or `NACK` under a reader name with no group — nothing is held to settle
`AfterOnGroup`	`AFTER` on a group's read; a member cannot skip the group's work, and `ALTER GROUP … START AT n` moves the whole group
`DeadLetterIsTheTopic`	a group whose dead letter is its own topic, where a message given up on would be handed out again
`TopicConsumerSpansDatabases`	a topic consumer whose topic and table are in two databases — it reads and writes in one transaction, and a transaction is one database's
`QuarantineNeedsDeadLetter`	`ON FAILURE quarantine` over a group with no `DELIVERIES` or no `DEAD LETTER TO`, which would hand a bad message out forever
`WrongConsumerKind`	`DROP` or `INFO` of a topic consumer as a Kafka one, or the reverse; the refusal names the statement to use
`TopicRetainExceeded`	one commit appends more than the topic's `RETAIN BYTES` keeps — append in smaller commits

Transactions

name	means
`NestedTransaction`	a second `BEGIN` inside one
`TransactionVerbInAtomic`	an embedding program running a script inside a transaction it holds itself, when the script contains `BEGIN`, `COMMIT`, `CANCEL` or `VERIFY`
`NoOpenTransaction`	a `COMMIT`, `CANCEL` or `VERIFY` with nothing open
`UnclosedTransaction`	input ended with a transaction open; its work was discarded
`CommitContention`	this commit could not be serialised against another — retriable
`Thrown`	`THROW` raised the message you gave it, and nothing inside the transaction survives
`Conflict`	a write to a record another transaction committed after this one took its snapshot — both cannot be right, so the later one is refused instead of quietly overwriting
`AcknowledgeBelowNamespace`	a write or `COMMIT` asking for a weaker `ACKNOWLEDGE` than its namespace's, which does not say `OR WEAKER` (When a write is acknowledged)
`LocalMajorityWithoutRegion`	an `ACKNOWLEDGE LOCAL MAJORITY` write on a leader whose own member row names no `REGION` — nothing was written (When a write is acknowledged)
`MajorityUnreachable`	a `MAJORITY` write whose voters that subscribe to where it lands cannot make up a majority — nothing was written
`NotAcknowledgedInTime`	a `MAJORITY` write committed on this node, at the sequence named, that not enough voters confirmed within one failover round — it may not survive a failover; retry only a write that says the same thing twice
`AcrossDecided`	a change asked of a transaction across leaders that already has an outcome, which it would contradict
`AcrossReadTooOld`	a participant's log now starts after the position the transaction had read — retry from the start
`ConcurrentVersions`	on a `MULTI MASTER` range that refuses conflicts, the record holds two versions written without seeing each other; the message names both — read them and write what they mean

Access

`NotAtThatReach`	an authority that is held over the whole store or not at all, granted at a namespace or a database
`NotSignedIn`	a closed store, and no credential
`SignInRefused`	a credential the store does not accept
`SignInThrottled`	too many attempts against that name, too quickly
`RoleForbids`	the role does not permit this
`NotGranted`	the grants do not cover this table or field
`NoSuchVerb`	a grant naming something other than `read` or `write`
`LastGrant`	a `REVOKE` that would remove a user's last grant — which would widen them
`GrantedUserCannotBackUp`	`BACKUP` needs an owner; there is no table for a grant to name
`GrantedUserCannotDeclare`	declaring users is administering
`PasswordUnusable`	a password the store will not accept
`NoSuchRole`	a role this language does not have
`OutsideTenancy`	a name outside the user's own namespace and database — the refusal names the tenancy, not the record, because one that said whether the record exists would have answered the question it declined
`FieldsOnAWrite`	`FIELDS` on a `write` grant — narrowing what may be read while replacing whole records would let somebody destroy what they cannot see
`CannotHandOut`	you do not hold that authority at that reach yourself, so you cannot hand it out
`NoSuchAuthority`	no authority goes by that name; the refusal lists the kinds that do
`WiderThanYou`	the user would reach further than you do — name a tenancy inside your own
`NotYours`	the user is not in a tenancy you administer
`OutsideTheirTenancy`	the user is confined to a tenancy that does not contain that reach, so the authority could never be used
`NotTheWholeStore`	the user holds one database and the statement's subject is the whole store
`UnknownUser`	no user has that id
`PasswordEmpty`	a password cannot be empty
`CurrentPasswordRefused`	the current password does not match — changing your own requires it
`TicketStale`	this session's token is no longer current; sign in again

NotSignedIn and RoleForbids are the pair worth keeping apart in a client: the first means identify yourself, the second means you did, and the answer is no. Collapsing them makes a client retry credentials that will never work.

The node

| name | means | | BackupExists | BACKUP … TO a file that is already there — a backup never replaces one | | BackupNameRefused | BACKUP … TO or a read-back naming a folder, ., .., nothing, or a file the backup folder does not hold | | NoBackupFolder | BACKUP … TO on a node started without --backup-dir (TESSARIDB_BACKUP_DIR) | | RestoreTargetExists | RESTORE SCRIPT FROM into a namespace or database that already exists — a restore only creates | | RestoreRefused | RESTORE SCRIPT FROM refused for the reason the message gives — inside BEGIN … COMMIT, for one (a restore runs in a transaction of its own) | | ReadIsElsewhere | a bounded read (STALENESS, ANSWERED BY) this node cannot satisfy and a named peer can — read it there | | NoCopyWithinStaleness | a STALENESS bound no copy in reach meets — refused rather than sent to the leader | | StalenessBelowFloor | a STALENESS bound tighter than the cluster can know about itself; the message names the floor | | EmptyStaleness | STALENESS 0 or less — a tolerance is a positive duration |

`StalenessBesideAVersion`	`STALENESS` on a read that already names a `VERSION`
`NotWritable`	this node does not take writes — it is draining, or is not a writer
`ManyWritablePeers`	more than one is, and they cannot both be
`InvalidNodeEndpoint`	an endpoint that is not an address
`NotABackup`	`--verify` or `--restore` on a file that is not one
`LogGap`	an incremental backup that does not join onto what is there
`BackupFailed`	the backup could not be written — the log or the buffer, not the store refusing the work
`WouldReinterpret`	a node holding namespaces of its own tried to join a cluster. Nothing would be deleted — the definition at the address its records are filed under would be replaced — so it is refused before the dial. Remove them with `DROP NAMESPACE`, or join on an empty store (Adding a node)
`NoLeaderKnown`	`ANSWERED BY LEADER` on a node that does not lead and knows of no peer that does; declare one with `DEFINE REPLICA … ROLES writable`
`UnknownAnswerer`	`ANSWERED BY` naming anything but `ANY` or `LEADER` — the refusal echoes what was written rather than guessing, because the guess would fail in the unsafe direction
`FailoverRefused`	`DEFINE FAILOVER` missing a clause: the five periods are checked as a set, so a partial statement could only mix new values with old ones
`EmptyPeriod`	a failover period that is not a length of time
`FailoverPeriodTooShort`	a period below 50 milliseconds — a cadence that never waits is a spin, and a lease of zero is spent at the instant it is taken
`FailoverCampaignOutpaced`	`CAMPAIGN` above twice `ROUND` — the leader steps over the moment it should have stood, and nothing reports a failure because no round was attempted
`FailoverLeaseTooShort`	`LEASE` at or below the write fence plus two rounds — there would be no instant at which a holder is both writable and not yet campaigning
`FailoverCollectionAboveFloor`	`COLLECTION` at or above twice `AWARENESS` — it would advertise a staleness bound the node cannot meet even when everything is working
`SplitNeedsGeneratedUuid`	`SPLIT AT` on a table numbered by a counter — one shared counter would route every insert through one place; declare `IDENTITY uuid` (Splitting a table)
`SplitPointsOutOfOrder`	`SPLIT AT` points that do not ascend strictly, or a point written twice — refused rather than sorted
`SplitOnAKindThatIsNotRecords`	`SPLIT AT` on a `DEFINE TABLE` that is not a plain table of records — an edge table or a graph's node table; other kinds have no `SPLIT AT` in their grammar and are refused as an unexpected word
`SplitPointIsNotWritten`	a `SPLIT AT` point supplied as a parameter — a shard map is a reviewed declaration, so its points are written in the statement
`SpreadNeedsGeneratedUuid`	`IDENTITY uuid SPREAD` on a table that does not declare `IDENTITY uuid` — the bucket is taken from a generated uuid
`AutoSplitOnAnUnsplitTable`	`SPLIT AUTOMATICALLY` on a table declared without `SPLIT AT` — there is no shard to split
`AutoSplitWouldOscillate`	`SPLIT AUTOMATICALLY` whose `MERGE BELOW` is at least half its `ABOVE` — the halves of a split would merge straight back
`PartitionNeedsGeneratedUuid`	`PARTITION BY` on a table not declared `IDENTITY uuid` — the store names a partitioned record by its partition value and a uuid
`PartitionMismatch`	a partitioned record whose identity does not begin with its partition value and a `:`, or whose value is absent, not text, or holds a `:`; an `UPDATE` changing the value is refused the same way
`WriteIsElsewhere`	a write into a range another node leads, sent by a client older than redirects (protocol minor `0`) to a node with no peer link; it names the address, the node to expect and its epoch. A client of minor 1 or later is sent a `settled` redirect instead, an HTTP request a `307`, and a node with a peer link carries the request there (Where to go)
`MayNotTravel`	a statement that changes users, grants, membership or the failover policy, takes or restores a backup, or unseals a vault, arriving through another node acting for its caller — send it to the node that leads, signed in there
`NodeTombstoned`	a `DEFINE REPLICA … NODE` naming a node the cluster removed with `DROP REPLICA` — it is never admitted again; wipe the machine and declare it under the identity it then has
`RowAlreadyBound`	`CREATE JOIN TOKEN` for a peer row that already names its node
`TokenUnavailable`	the store could not make a join token — there is no weaker source to fall back to, because a token from one is a credential somebody else can produce
`SpansLeaderships`	a transaction writing ranges that two different nodes lead, without asking to commit across them; it names both — say `COMMIT ACROSS LEADERS`, or write each leader's ranges separately (Transactions across leaders)
`AcrossAborted`	a transaction across leaders was not committed — a leader refused its part (quoted), or its record was aborted before the decision landed; nothing of it applies anywhere
`AcrossInDoubt`	a transaction across leaders whose outcome the node could not learn — an answer never came and the record could not be read; it is committed if every part landed and aborted if not, and its record settles it. Read the records; retry only a write that says the same thing twice
`AcrossNotHeldHere`	a transaction across leaders writing a range the node it runs on holds no copy of — half of the conflict check is made on that copy; run it on a node holding every range it writes
`AcrossUnavailable`	`COMMIT ACROSS LEADERS` on a node that knows no peers to carry the parts to
`AcrossKind`	a transaction across leaders writing a vault, bucket, space, topic, queue, series, or vector or geo store — each keeps something beside its records that a prepared write would bypass; only tables, collections and edges commit across leaders
`AcrossSettling`	a graph traversal over edges a transaction across leaders is still landing on this node; retriable a moment later
`PlacementCannotBeDropped`	`DROP REPLICA` on the last row placing a range, or `LEADS` moving it to another range: the range would have two writers until its leader heard of the change. From `0.24.0-beta` give the range back with `LEADS NONE`, which waits for that leader's lease (Who leads what), or place another row on the range first
`NotASplitTable`	`ALTER TABLE … SPLIT AT` or `MERGE SHARD` on a table declared without `SPLIT AT` — declare a split table and move the records into it
`SplitPointOnABoundary`	a split at a point where a shard already begins, which would mint a shard holding nothing
`ShardNotLive`	a merge naming a shard the table does not have, or one a split or merge already retired
`ShardsNotAdjacent`	a merge of two shards that do not touch, or of one shard twice
`ShardNamedByAReplica`	a split or merge of a shard a replica row names by `REPLICATES SHARD` or `LEADS SHARD` — change the row first
`ShardMapMoved`	a gathered read asking a node whose shard map differs from this one's; retriable (HTTP `409`) once the change has reached this node
`NotHeldHere`	a read needing shards this node lacks, where gathering does not apply — inside a transaction, under `VERSION`, a write's read (from `0.25.0-beta` a join side and a `FETCH` are gathered); it names the shards held elsewhere. From `0.20.0-beta`, when this node knows a node holding the whole table, a client of minor 1 or later is sent a `transient` redirect there instead
`NotGathered`	a gathered read where one shard's leader is unknown, unreachable or declines — the whole read is refused, never answered in part
`GatheredTooMuch`	a gathered read that would hold more than 100 000 records — or groups, for a read the shards' leaders fold; a `WHERE` or `LIMIT` that travelled to the leaders counts only what it kept
`FormatNotFinalized`	a declaration that needs a newer on-disk format than this store holds — `ALTER STORE FINALIZE FORMAT`, after which no older build opens the store
`FormatPeerTooOld`	the finalize was refused because a replica runs a build that cannot read the new format, or has not collected from this node yet
`NoLeadershipYet`	a clustered node holding no leadership does not accept writes; one that should lead needs the `coordinating` role
`LeadershipUnconfirmed`	this node leads the range but holds no entry of its own leadership there yet — asked again once a majority holds one
`LeaseSpent`	the lease this node writes under ran out, so it accepts no writes until it is renewed
`LogDivergence`	this store and the leader disagree about the log at a position: the message names both epochs
`NoEntropy`	the node cannot read a source of randomness, and a node identity must be unpredictable, so it does not open
`NoIdentity`	the store holds no node identity, so there is nothing to configure
`IdSpaceExhausted`	every identifier at one level of the catalog has been handed out — ids are never reused after a drop

Following changes

Refused when a subscription opens, or when it ends while it runs: the subscriber resumes from the last change, or the last progress, it handled.

name	means
`TableNotGranted`	a table named to follow that this session was not granted to read
`NoSuchTable`	a table named to follow that does not exist
`TenancyGone`	the selected namespace and database are not both there
`SplitAfterStart`	a table the feed follows was split after it began — subscribe again from the last change handled
`CursorWithoutSplit`	a cursor sent to a feed over no split table, where the resume point is the sequence
`CursorUnreadable`	text that is not a cursor a change of this feed carried
`CursorFromAnotherDatabase`	a cursor from a feed over another database
`StrayLog`	a cursor counting a log this feed does not follow
`AnotherWriter`	a log the feed would follow holds another node's writes — follow it on the node that writes them
`ConditionWithoutTable`	a condition with no table: a condition is about one table's records
`ConditionReadsTheStore`	a condition that reads the store — a subquery, a fold, a record's lifetime — which no change carries
`FieldNotVisible`	a condition reading a field the subscriber may not see, at the start or after a grant takes it away — judged anyway, which records arrive would say what the field holds
`PreviousVersionGone`	a change that no longer matches had to be compared with the record before it, and that version has been reclaimed — subscribe again from the present

Parameters

name	means
`UnboundParameter`	a `$name` with no value bound to it
`ParameterHasNoValue`	a binding that carries nothing

Below the language

Corruption, Truncated, Io, Busy, Unavailable, Internal and their neighbours come from the storage and encoding layers rather than from anything you wrote. They are not in the tables above because no statement causes them; they mean the substrate is unwell, and the thing to read next is the node's own log rather than your script.

Two of them say more than unwell, from 0.27.0-beta. UnstampedStore is a store that holds data and no format version, refused when it is opened and left untouched — it was not written by this engine, or it has lost the key that says which format it is. Stopped is a store that has stopped taking writes because one it could not make durable failed; it answers as lifecycle, names the failure, keeps answering reads, and takes writes again once it is reopened and has recovered from its log. Neither is retried: the first is an operator decision, and the second is cleared only by the restart.

One is caused by what you asked, and comes from the wire rather than the store: AnswerTooLarge, from 0.34.0-beta, is an answer above the 16 MiB a wire frame carries. It is class invalid, names the size, and the connection answers the next request. Ask for less, or take a large snapshot with BACKUP STATE TO, GET /backup or a streamed --at … --backup (Backup and restore).

Paging and history

name	means
`CursorBesideAnOffset`	`START` and `AFTER` both say where the page begins — keep the cursor or the offset, not both
`CursorBesideAReshaping`	`AFTER` resumes after a record while the read answers with something other than records; page first and reshape after
`AnchorFromAnotherTable`	the anchor names a record in one table and the read is of another
`AnchorGone`	`AFTER` names a record the table no longer holds — resume from one that is there, or drop the `ORDER BY`
`NoHistoricalTraversal`	a graph traversal cannot be read at an earlier version, because edges are indexed at the present
`VersionInTheFuture`	`VERSION` naming a sequence ahead of the store's committed tail — refused rather than served the present, because the same query would answer one thing now and another later under the same version, and a historical read exists to be reproducible
`VersionInsideTransaction`	`VERSION` inside a transaction — a transaction is already one point in history, and a second one inside it would mean two answers that disagree about when they are
`VersionReclaimed`	a read at a sequence below the reclaim floor — the versions that answered there have been removed
`BelowLogStart`	a reader asking for a log position below where the log now begins — the records that answered there were pruned (Bounding the log). It is a refusal rather than a short answer because a short one cannot be told from a log that simply ends there, and that is the distinction deciding whether to retry or to re-bootstrap
`CatalogMalformed`	a catalog entry the store cannot read as what it should be — corruption, reported rather than guessed past
`AcrossMalformed`	a log record of a transaction across leaders that contradicts itself — corruption, reported rather than applied

Asserting the plan

name	means
`IndexNotUsed`	`USING INDEX` named an index the read did not use
`NoSuchAccessPath`	`USING` named no access path this store reports; the refusal lists the ones it does
`PathNotTaken`	`USING` named a path and the read took a different one

Over HTTP

Each of these arrives as a status and the store's own message; the name is not in the response. The status is the class — see The HTTP surface for which refusal becomes which of 400, 401, 403, 409 and 500.