Documents and contracts
Refusals about signed instructions, their registrations, and the schema versions two parties must agree on.
10 classes. 2 explained, 8 named only.
A signed instruction in this product passes one indivisible check. Everything below has to hold at once: the signature chain is sound, a registration exists, the registered commit still yields the recorded digest, and the registration is currently active. A failure of any part is a refusal, and the class tells you which part.
⚠ Verification prints only authenticated fields. What it shows you is what the signature covers, not what the file happens to say.
The signature is written and no commit carries these bytes
Class: order-uncommitted.
What it means. You signed the document, but no landed commit carries these exact bytes. The registration binds a signature to committed content, so an uncommitted document has nothing to be bound to.
What to do. Commit the document and re-run. ⚠ The signature sidecar stays on disk — it is correct, and re-running simply rewrites it. There is nothing to clean up first.
The signature is valid and there is no registration
Class: order-unregistered.
What it means. A valid signature is not enough on its own: the document must also be registered. This class fires when the signature verifies and the registration is missing.
What to do. Register the document. ⚠ Two different commands emit this same class for a missing registration, deliberately, so that automation never has to translate between two names for one condition — if you are matching on the class, one match is enough.
⛔ A registration without a signature sidecar is a different failure and refuses with a different message naming the missing sidecar. Read which of the two you have before acting.
Two refusals you will meet alongside these
Registration records into a workspace and is signed by that workspace's key, so two identity refusals show up here rather than in a document. Both are covered in full on Identity and actors:
owner-key-absent— the registration row is signed by the workspace key and this session has none. Run from the workspace that owns the record, or mint that workspace's key. Nothing was written.no-workspace— nothing resolved a workspace to record into. Re-run naming it explicitly.
What "current" means for a registration
A registration's currency is one of exactly four words: active, superseded, revoked, expired. It is computed from an append-only log of acts, never stored as a field anything overwrites. Withdrawal is a new act, not an edit — which is why the record can still answer what did this instruction say at the moment that work was dispatched?
Three of the four words have a refusal class of their own, listed below.
Named, not yet explained
These classes are real, deliberate and named. This section does not yet carry their resolution.
| class | what its name indicates |
|---|---|
order-bytes-truncated | The document's bytes are shorter than what was signed for. |
order-digest-mismatch | The registered commit no longer yields the recorded digest — the content and the signature have parted company. ⚠ Worth knowing on sight: this is what a changed document looks like, not a missing one. |
order-expired | The registration is no longer current because its own term ran out. |
order-ref-ambiguous | The reference you gave matched more than one thing. ⚠ A full 64-character digest is accepted and is the unambiguous form. |
order-revoked | The registration was deliberately withdrawn by a later act. It was not deleted; the withdrawal is itself recorded. |
order-superseded | A later registration replaced this one. |
schema-ahead | The store is at a newer schema version than this build understands. ⚠ Worth knowing: where these two disagree, the question the check would have asked was never asked — treat the answer as unmeasured, never as a pass. |
schema-behind | The store is at an older schema version than this build expects. The same caution applies. |