Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Finding families

Every graded finding carries a stable, dotted family.item code (charter koan 9, errors are lore). Clients and repair tools match on the code, which is stable across message wording. This page catalogues every code the system emits: its family (the check or tool that raises it), its severity, any structured repair it carries, and what it means.

These finding codes are disjoint from the wire error-code registry (the ErrorCode values in error-codes.md, per the dli-worker contract §3.2 / §9). The distinction is load-bearing: a wire error code says the call failed — it was malformed (schema), refused by principle (refused), or hit a server defect (internal); a finding code is a graded domain observation about the lore itself. A well-formed call over inconsistent lore returns findings, not an error. No code appears in both sets.

97 dotted codes across 13 families, plus 4 proof.resource-violation sub-codes. A family.item code names its check battery in the family and the specific violation in the item. Two codes can share a stem across families — the naming vet’s name.register-fit (a kernel error) and the authoring seam’s name.unvetted (an authoring warn) are different findings from different surfaces.

Severity belongs to the emitting check. Some findings include structured repair data; others explain the next step in their message. Error-severity findings block author.materialize, while warnings do not.

Ratify blocks

  • Emitted by: World check and corpus import
  • Owner: dli-world :: lib.rs
  • Severity: Errors identify a ruling that cannot safely affect a world claim or decision.
CodeSeverityRepairMeaning
ratify.world-hypothesis-unsupportederror—a ratify assignment cannot settle a world claim that assumes the hypothesis.
ratify.decision-as-hypothesiserror—a ratify assignment names a decision rather than a hypothesis.

Entity references

  • Emitted by: World check, CLI and authoring reads
  • Owner: dli-world :: check/entity.rs
  • Severity: Advisory; unknown references do not block a commit.
CodeSeverityRepairMeaning
entity.undeclaredwarncandidatesa likely entity reference names no declared entity.

Unchecked rules

  • Emitted by: World check, CLI and authoring reads
  • Owner: dli-world :: model.rs (LoadFinding)
  • Severity: Advisory; the declaration is retained but its constraint is not checked.
CodeSeverityRepairMeaning
rule.unchecked-domainwarnrulean order or season rule is retained but its constraint is not checked.

load — the loader’s fail-closed gate

  • Emitted by: the world loader, run by deloreis check / dli.check before any query
  • Owner: dli-world :: model.rs (LoadFinding)
  • Severity: All error: a load finding holds its declaration fail-closed — unassertable until fixed. Fail-closed provenance is the assertability gate.
CodeSeverityRepairMeaning
load.missing-provenanceerror—a declaration carries no ruling and no hypothesis, so it cannot be asserted.
load.malformed-provenanceerror—the provenance annotation cannot be read; held fail-closed until the annotation is fixed.
load.malformed-world-ruleerror—a bare top-level world rule is not valid Datalog and is refused instead of lowering no rule.
load.unbound-head-variableerror—a rule concludes about a variable that nothing in its premises names.
load.unknown-temporal-referenceerror—a typed temporal clause names an era or event the merged world does not declare.
load.duplicate-declarationerror—a name is declared twice as the same kind within one scope.
load.cross-pack-collisionerror—a name is declared in more than one scope/pack.
load.unstratifiableerror—the rules cannot be ordered for evaluation — a negative-dependency cycle (FRONT-1).
load.inert-declarationerror—a declaration is accepted by the grammar but names nothing evaluable, so it would lower to no fact (DL-0029); surfaced rather than silently dropped.

predicate-identity — declared property-identity validation

  • Emitted by: predicate-identity validation and policy projection in the world loader/check seam
  • Owner: dli-world :: model.rs (LoadFinding)
  • Severity: Mixed: an observed-shape mismatch is an error that blocks materialization; a union-policy promotion is a non-blocking warning.
CodeSeverityRepairMeaning
predicate-identity.arity-mismatcherror—a certain predicate-identity component contains incompatible observed positional arities; materialization is refused rather than performing a partial merge.

continuity — the world-consistency battery

  • Emitted by: world-internal and claim-relative continuity checks
  • Owner: dli-world :: check/continuity.rs (WorldFinding)
  • Severity: Errors block contradictions; warnings flag unresolved drafts or temporal gaps.
CodeSeverityRepairMeaning
continuity.stale-era-modelerror—an older compiled model lacks era declarations; recompile it from source or the lorestore before checking.
continuity.chronology-cycleerror—the before-graph closes a cycle; the timeline would have no consistent order.
continuity.prior-contradictionerror—a claim contradicts an established prior certain fact.
continuity.rejected-loreerror—a certain fact realizes a killed/rejected token.
continuity.unknown-entityerror—a claim references an entity that is not in scope.
continuity.proposed-as-facterror—a claim states shadow (proposed) lore as settled.
continuity.intra-episode-contradictionerror—a claim set fixes one slot two contradictory ways within an episode.
continuity.fluent-contradictionerror—a fluent slot holds two distinct values certainly at once over overlapping intervals (a state’s since/until spans collide).
continuity.pending-conflictwarn—a proposed value and another live value differ on a declared-functional non-fluent slot; the warning does not decide either account or block materialization.
continuity.fd-violationerror—canon’s own certain layer holds two distinct values for a subject on a predicate the author declared functional, breaking the functional dependency.
continuity.derived-fd-violationerror—the same functional-dependency break as continuity.fd-violation, but visible only once the world’s rules are saturated — a wire-authored rule (or an identity-closure copy) derives the second value rather than an author asserting it directly.
continuity.identity-temporal-unsupportederror—a same-as identity link names a declared era or event on either side — v1 refuses to unify time points (a defeasible merge over chronology indices would half-merge the timeline).
continuity.fluent-order-undeclaredwarn—a fluent slot holds two distinct certain-support values whose temporal cover is undeclared-order-indeterminate at some point — a before-fact between the named anchors would settle whether they actually clash. Non-blocking: the contradiction check itself never fires on undeclared order.
continuity.inertia-unanchoredwarn—a predicate declared inertial carries a value with no since anchor, so no forward-persistence interval can be derived — the declaration would silently do nothing. Non-blocking; names the slot so the missing anchor is a deliberate choice, not an accident (DL-0081, koan 4).

name — the naming-oracle kernel vet

  • Emitted by: the world-true half of the naming oracle, run by dli.name.check and the language layer of check
  • Owner: dli-world :: language/derivation.rs (LangFinding)
  • Severity: Mixed: structural, register, uniqueness, morphology, and banned-token violations are errors; aural clashes, set clashes, sayability, and confusables are warnings. (Distinct from the authoring-seam name.unvetted finding below.)
CodeSeverityRepairMeaning
name.slot-sequenceerror—the name’s slots match no name-kind pattern of its dialect.
name.role-membershiperror—a name-part is not declared in the dialect under the role it fills.
name.register-fiterror—the name does not fit its declared dialect/register.
name.phonotacticserror—the name violates the dialect’s phonotactics (vowels, endings, clusters, stress).
name.uniquenesserror—the name collides with an existing name in canon.
name.fixed-token-reuseerror—the name reuses a fixed token reserved elsewhere.
name.aural-clashwarn—the name is aurally too close to another across the whole name-space.
name.set-clashwarn—the name is not aurally distinct within its declared set.
name.gender-morphologyerror—the name’s morphology conflicts with its declared gender.
name.sayability-capwarn—the name exceeds the configured sayability-tier caps.
name.banned-in-nameerror—the name realizes banned diegetic vocabulary.
name.confusablewarn—the id mixes a Latin-looking form with a look-alike character from another script (a homoglyph).

attest — the attestation seam

  • Emitted by: the attestation lookup a check consumes, surfaced by dli.check and dli.attest.missing
  • Owner: dli-world :: attest.rs (storage seam); dli-serve :: contract.rs + handlers.rs (document verdict)
  • Severity: Missing, stale, and negative judgments are errors for the consuming check; a current affirmative judgment is a pass with no severity.
CodeSeverityRepairMeaning
attest.missingerror—the question has no attestation in the store; a sweep must pose it before a check can consume it.
attest.staleerror—the stored judgment no longer matches the current world fingerprint.
attest.pass——the current bounded model judgment affirms the configured proposition at grade attested.
attest.failerror—the current bounded model judgment rejects the configured proposition at grade attested.

practice — practice well-formedness

  • Emitted by: the practice-block checker, run by deloreis check / dli.check when a practice is declared
  • Owner: dli-ledger :: practice.rs (PracticeFinding)
  • Severity: Error: a malformed practice cannot host a proof, so each finding blocks the practice.
CodeSeverityRepairMeaning
practice.error-refines-nothingerror—a declared error refines a token that is not one of the seven structural classes L1–L7.
practice.missing-discriminanterror—two errors share a structural class with no discriminant to tell them apart.
practice.resource-outside-algebraerror—a resource’s declared law is outside the closed resource algebra.
practice.unbound-sorterror—a role is typed by a sort the practice does not declare, that is not a primitive kind or an in-scope cycle.
practice.unresolved-cycleerror—a failure or law cites a cycle that is not in scope.
practice.error-resource-unknownerror—an L6 resource-violation error spends against a resource the practice does not declare.
practice.renamed-interior-formerror—a practice interior wrote a retired spelling (a killed form); refused with its successor named.

proof — the diegetic proof checker

  • Emitted by: the proof/ledger checker, run by deloreis check-proof / dli.check-proof
  • Owner: dli-ledger :: ledger_check.rs (ProofFinding)
  • Severity: Error: a proof finding means the diegetic proof is invalid; the L-class in the message (L1–L7) names which structural obligation broke.
CodeSeverityRepairMeaning
proof.unknown-formerror—the form is not declared by this practice (L1).
proof.premise-absenterror—a premise is not established in the scene — the casting fizzles (L2, absent).
proof.premise-contradictederror—a premise is denied by the certain projection — the casting rebounds (L2, contradicted).
proof.wrong-phaseerror—a step runs at the wrong cyclic phase (L3, timing).
proof.bad-instantiationerror—a form is instantiated with ill-typed arguments (L4).
proof.unknown-roleerror—the proof header binds a role the practice does not declare.
proof.invalid-chainerror—a chain step does not follow from its cited premises (L5).
proof.resource-violationerror—the ledger breaches a resource law (L6) — see the resource sub-codes below.
proof.close-mismatcherror—the close atom does not match what the steps derived (L7).
proof.expectation-unmeterror—the proof’s expected verdict was not met (the expected-verdict discipline).
proof.invalid-spenderror—a spend draws against a resource illegally.
proof.unknown-spokeerror—a step cites a spoke or label that the proof does not define.
proof.unknown-expectationerror—an expectation names something the practice does not define.
proof.missing-closeerror—the proof has no close step.
proof.practice-mismatcherror—the proof’s in <practice> clause does not match the practice being checked.
proof.invalid-header-layouterror—the direct proof AST header is not <role> <actor> in <practice>.
proof.malformed-bodyerror—captured proof clauses do not replay through the canonical parser.
proof.invalid-close-layouterror—the proof does not carry exactly one final close.

factcheck — payload claim standing

  • Emitted by: claim-relative certain-layer checks and the authoring seam
  • Owner: dli-world :: check/factcheck.rs; dli-serve :: author/reads.rs + author/tools.rs
  • Severity: All error: supported claims are silent; only contradicted and unsupported claims emit findings.
CodeSeverityRepairMeaning
factcheck.contradictederror—the claim conflicts with certain or explicitly rejected lore.

resource — the discriminants of proof.resource-violation

  • Emitted by: the resource-algebra accounting inside the proof checker; carried as the discriminant of proof.resource-violation
  • Owner: dli-ledger :: resource.rs (ResourceViolationCode)
  • Severity: Sub-codes, not standalone families: each names how a proof.resource-violation breached the closed algebra.
CodeSeverityRepairMeaning
overspenterror—a linear or affine balance fell below zero — a unit was spent that was never accounted.
over-capacityerror—an affine balance rose above its declared capacity.
not-conservederror—a linear conserved multiset did not net to zero at the close — a step minted or burned it.
wrong-directionerror—a graded-monotone grade moved against its one declared direction.

citation — lowering findings

  • Emitted by: the evaluator’s lowering pass, surfaced through check
  • Owner: dli-eval :: world.rs (LowerFinding)
  • Severity: Error for the affected claim: lowering keeps checking the rest of the world, but forged authority fails that claim closed.
CodeSeverityRepairMeaning
citation.unknown-decisionerror—a claim cites a decision the corpus never declares; the claim is failed closed.

author — authoring-seam findings

  • Emitted by: the author.* MCP tools (the authoring seam)
  • Owner: dli-serve :: author/tools.rs + author/reads.rs (Finding)
  • Severity: Per-code severity gates author.materialize: an error blocks it, a warn passes. These are the findings that carry structured machine repairs.
CodeSeverityRepairMeaning
render.provenance-unrepresentablewarn—the staged declaration has provenance the text renderer cannot preserve; its rendered line is omitted.
name.unvettedwarnrun-checka name has not passed the naming oracle; it enters proposed and unvetted.
entity.unknownerrorresolve-entityno entity of that id is in scope; the claim is staged but cannot materialize until it exists.
event.era-missingerror—an event has no era anchor; every event must occur during a declared era.
event.era-kinderror—an event’s era anchor names an entity that is not an era.
fact.contradictionerror—a claimed slot value contradicts a certain fact the base asserts.
order.cycleerror—a before fact would close a cycle against the existing orderings.
consequence.changedwarn—under a supposition the derived-consequence set may move; see author.diff.
hypothesis.not-in-forkerror—a hypothesis is legal only in a fork workspace.
hypothesis.bundle-limiterror—a proposal bundle carries at most one hypothesis; a second supposition is a second fork.
hypothesis.unknownerror—no hypothesis of that id is staged in this workspace to suppose.
question.unknownerror—no open question of that id exists in this workspace to add an option to.
field.control-charerrorremove-control-charsa free-text field carries a control/bidi/zero-width character that could forge or reorder a declaration in the review diff.
citation.unknown-decisionerrorresolve-citationa cited decision id does not resolve against the decisions the corpus declares. The engine records the attribution a caller supplies but verifies that what it cites exists: the unknown decision’s variable is left open, so the claim can never read certain, and materialize is barred until the id is repaired.
decision.duplicate-in-batcherror—one bulk decision-recording request repeats an exact decision id; the complete batch is refused atomically and the finding identifies both record positions.
identity.self-mergewarn—a same-as claim names the same id on both sides; it is a no-op merge.
predicate-identity.self-mergewarn—a predicate-identity claim names the same predicate on both sides; it is retained for provenance but has no semantic effect.
identity.temporal-unsupportederror—a same-as claim names an era or event endpoint; identity merging is not defined over the temporal spine (v1 boundary).
identity.sort-mismatchwarn—a same-as claim merges entities of different sorts (e.g. a person and a place); staged but flagged for review.
rule.empty-bodyerroradd-body-literala rule’s body has no literals; a body-less rule would derive its head unconditionally on the wire, but its render reparses via the .dli text path to a malformed rule the loader refuses (migration parity). Refused before staging.
rule.unbound-variableerrorbind-variablea rule’s head, or a negated body literal, names a variable no positive body atom binds — a range-restriction (datalog safety) violation. Refused before staging.
rule.duplicateerror—a rule of that name is already staged or already in the compiled base; rule names are unique so author.defeat can cite one unambiguously. Refused before staging.
rule.unstratifiableerror—staging this rule alongside everything already staged would leave the world unstratifiable (a negative-dependency cycle); the stratification pre-flight refuses it before it ever reaches the workspace, so no add can brick a later read.
state.anchor-kinderrorresolve-anchora state’s temporal anchor names a KNOWN entity of the wrong sort — since/until need an event, after/during need an era.
workspace.base-missingerror—the workspace’s project document base is no longer loaded.
world.uncompilableerror—the staged declarations do not compile into a checkable world.