The console
Refusals from the browser surface: acts it will not fire, forms it will not accept, its certificate, and the bundle check that stops every command.
21 classes. 4 explained, 17 named only.
The console is a second hand, not a second set of rules. It runs the same validation and produces the same refusals as the terminal, and it will not accept an act the engine would reject. Most refusals here mean the browser page has fallen behind the record.
⚠ Not every console problem is a refusal class. If the browser shows that no console credential has been set, or the server will not start naming a credential file it cannot trust, those are covered by the console's own administration guide rather than by a class in this list — run the console status command on the host first, because those states look identical from the browser.
An act the queue is not offering
Class: console-act-not-offered.
What it means. The queue does not list that act right now — usually because the record moved since the page was drawn. Someone else acted, or a run finished.
What to do. Reload the queue page and act on what it now lists. ⛔ Do not retry the same submission: the page you are holding describes a record that no longer exists.
A decision that is not writable at that gate
Class: console-act-decision-not-offered.
What it means. The gate is real and the act is offered, but the particular decision you posted is not one that gate accepts.
What to do. Pick one the form offers.
The engine refused the row
If the console shows gate-integrity, the console did not refuse — the engine did, and the
console is showing you the engine's own answer. The page prints a numbered list: that list is the
engine's stop list, and it is what to fix; it also prints the next act the record projects. The
class itself is explained under The record and gates.
The form did not come from your session
Class: console-act-forgery. You will see it phrased as a request that carried a valid session cookie and no valid act token.
What it means. The form you posted did not come from a freshly loaded console page of your session.
What to do. Reload the queue page and act from there. ⚠ If you did not initiate that request, some other page did — that is a cross-site request forgery attempt against your logged-in session, and it is worth investigating rather than clicking through.
Every command stops with a bundle parity error
Class: ui-assets-parity.
What it means. The embedded interface bundle is validated once at the start of every process, before any command runs. A bundle that fails that check stops every command, whichever one you typed — not just the console.
What to do. This is a build-integrity fault, not a configuration one: the shipped bundle does not match what the interface expects. Report it with the exact line printed. ⚠ Do not confuse it with a missing string on one screen, which is a much narrower notice and does not stop anything; the product has a dedicated check that reports interface-asset findings on demand, and that is where a single unresolved screen key shows up.
What the console will not do, however you ask
It will not run a local merge or a teardown — those stay terminal acts. The one merge it performs is a pull-request merge on a configured Gitea forge, signed with your passkey and pinned to the head commit you saw (see Pull requests and forge integrations). It acts on several streams at once only through a batch, which must be previewed first and must account for every row. And it will not fire an act the queue did not list, whatever a crafted request asks for.
Named, not yet explained
These classes are real, deliberate and named. This section does not yet carry their resolution.
| class | what its name indicates |
|---|---|
console-act-no-session-actor | The session is authenticated to the console but carries no actor identity to record the decision under. ⚠ Related reading: an act must be written under an enrolled, active name — see Identity and actors. |
console-act-not-a-gate-write | The act posted was not a gate write, which is the only kind of write this surface makes. |
console-batch-duplicate-stream | A batch named the same stream more than once. |
console-batch-empty | A batch was submitted with nothing in it. |
console-batch-ground-absent | A batch was submitted without the ground it must be judged against. |
console-batch-no-preview | A batch was submitted without the preview step that must precede it. |
console-batch-unaccounted | A batch contained something the preview did not account for. |
console-seat-profile-dir-not-derived | A seat form posted a profile directory that differs from the one the product derives for that seat and backend. A seat's profile directory is derived, never typed, and the disagreement is refused rather than silently replaced. |
The console's certificate, and trusting it on a device
| class | what its name indicates |
|---|---|
console-certificate-absent | The console is configured without a certificate (gateway.tls_cert names nothing) — a supported plain-HTTP setup, not a broken install. The product mints no console certificate itself; the refusal names saphan trust server-cert, which does. |
console-certificate-unreadable | gateway.tls_cert names a file this account cannot read, or one holding no certificate. |
console-certificate-issuer-absent | The certificate is not self-signed and its issuer is not in the file, so there is no trust anchor to export. ⚠ It deliberately does not export the leaf instead: a profile pinned to one certificate breaks on every device at the next renewal. |
cert-format-ambiguous | saphan cert export was given both --ios and --pem, or neither. There is no default: the two produce different files for different device families. |
trust-host-required | saphan cert trust was run without --host. |
trust-host-unreachable | Nothing completed a TLS handshake at the host named. |
trust-fingerprint-mismatch | The fingerprint you confirmed is not the one the host presented, or no confirmation could be read. Either way, nothing was trusted. |
trust-not-macos | saphan cert trust writes to the macOS login keychain and this is not macOS. The refusal names the equivalent step for your platform. |
trust-keychain-refused | macOS refused the keychain write — most often because the authorisation prompt was dismissed. |