Diagnostics reference

Every code Telo can emit, with what triggers it and what to do. Look a code up here — the message text contains your resource names, but the code is stable.

Telo reports problems in two places:

• Static diagnostics come from the analyzer — telo check, the VS Code extension, and the load pass of telo run. They carry an UPPER_SNAKE_CASE code, a file, and a line. Nothing has run yet.
• Runtime errors come from the kernel while loading, initializing, or dispatching. They carry an ERR_* code.

telo check exits 1 if any error is present; warnings alone do not fail it.

For the workflow around all this — what the analyzer checks, what it cannot, how to read a failure, and the debugging flags — see Catching errors before they run.

Static diagnostics

Kinds and definitions

Code	What it means and what to do
UNDEFINED_KIND	No Telo.Definition for this kind:. Check the alias prefix matches an imports: entry, and that the spelling matches the module's exported kind. A Telo.Builtins document — the published built-in vocabulary of a release, which telo builtins prints — is read and never declared or run: as an entry the whole file is refused with this one diagnostic.
KIND_NOT_EXPORTED	The alias resolves, but the target library does not list that kind in exports.kinds. It is private to that module — you cannot construct it.
ABSTRACT_KIND_INSTANTIATED	The kind: names a Telo.Abstract — a contract for x-telo-ref slots, with no controller to construct. The kernel refuses it at create(). Write one of the implementations the message lists. Applies to an inline { kind, …config } at a reference slot too.
MISSING_KIND_OR_NAME	Every resource doc needs kind: and metadata.name.
DUPLICATE_RESOURCE_NAME	Two declarations in one module scope share a name; the kernel would fail with ERR_DUPLICATE_RESOURCE. Rename one. The namespace covers everything a module declares, not just its resources: an import alias, a Telo.Definition / Telo.Abstract / Telo.NeedType name, a need, and the module's own metadata.name all live in it — so an application named after one of its own imports (metadata.name: Scheduler beside Scheduler: oci://…/scheduler) is a collision, and the two lines do not look like one name written twice. Two imports sharing an alias is reported as DUPLICATE_IMPORT_ALIAS instead.
INVALID_NAME	A name is not ^[A-Za-z_][A-Za-z0-9_]*$, or is a CEL keyword — so it cannot be referenced. A - is read by CEL as subtraction (and where a bare name is in scope, silently evaluates instead of failing); a . is what !ref splits alias from name on. Applies to resources, kinds, modules, import aliases, step names and variables: / secrets: / ports: keys.
INVALID_TYPE_NAME	A type-level name (module, kind, import alias, or a Telo.Type resource) does not start with an uppercase letter. The alias-qualified <Alias>.<Kind> grammar accepts only PascalCase, so nothing could extends: it.
NAME_CASE_CONVENTION ⚠️	A value-level name (resource instance, step, variables: / secrets: / ports: key, CEL binding) does not start with a lowercase letter. camelCase names a value, PascalCase names a type — see the style guide.
EXTENDS_MALFORMED	extends: must be the string form <Alias>.<Kind> (use Self.<Kind> for a kind in the same library).
EXTENDS_UNKNOWN_TARGET	The extends: target is not an exported kind of that alias.
EXTENDS_CAPABILITY_MISMATCH	A child declares a different capability: than its ancestor. Capability is inherited and immutable — omit it, or restate it identically.
CAPABILITY_UNKNOWN	capability: names no lifecycle role. The roles are a closed set — Telo.Callable, Telo.Invocable, Telo.Mount, Telo.Provider, Telo.Runnable, Telo.Service, Telo.Sink, Telo.Type — and the message names the nearest one for a misspelling (Telo.Invokable, Invocable). A built-in kind that is no role (Telo.LogSink) is specialized with extends:, and a module's kind named here beside a declared extends: has nowhere to go: a definition has one parent. Reported for a dependency's definition too, at the entry's imports: entry through which the dependency is first reached, however deep, since the kernel refuses it (ERR_CAPABILITY_UNKNOWN), and for a kind document declared as a with: scope member — at the member, or at that imports: entry when a dependency declares it.
CAPABILITY_NOT_DECLARABLE	capability: names an entry of the roster no author may declare — Telo.Executable, the slot constraint over Telo.Invocable and Telo.Runnable, or Telo.Template, the role of the built-in document kinds. The message quotes what the entry is and lists the roles to declare. Reported for a dependency's definition and a scope member too, like CAPABILITY_UNKNOWN.
CAPABILITY_SHADOWS_EXTENDS ⚠️	The legacy spelling capability: <Alias>.<Kind>, naming a module's kind: the capability-as-extends migration rewrites it to extends: at load, so the kind is checked as that kind's child — its schema, contract and throws: ceiling apply. Run telo migrate to write it to the file.
PROVIDER_MISSING_IMPLEMENTATION	A Telo.Provider definition needs either controllers: or a provide: body.
SCOPE_ENTRY_NOT_INLINE	Entries in an x-telo-scope block must be inline declarations (kind: + metadata.name), not references.
SCOPE_SLOT_MISPLACED	A kind's schema declares x-telo-scope somewhere other than a named top-level property — nested under an object, on an array item, under additionalProperties, inside a recursive shape or below an x-telo-schema-from. Move it onto a property of the schema root (or of a root anyOf / oneOf / allOf branch), written directly or through a local $ref.
SCOPED_NAME_OUT_OF_REACH	An inline declaration written beside a with: block — a step's invoke: { kind: … } — names a resource that block declares, by !ref or as resources.<name> in CEL. The declaration is created where its sequence is, outside the scope, so the name does not reach it. Declare it under with: with a name of its own and invoke it with !ref.
EXTENDS_CLOSED_PARENT_ADDS_FIELD	A child without base: declares a field its parent does not have, but the parent closes its schema (additionalProperties: false). Without base: the child's whole config is forwarded as the parent's, so the field is rejected at creation. Add a base: mapping, or drop the field.
TEMPLATE_DISPATCH_UNKNOWN	A templated definition's invoke: / run: / provide: / mount: is a !ref naming no entry in its own resources:. The message lists the entries that exist.
DEPRECATED_TEMPLATE_ENTRY_NAME ⚠️	A resources: entry is named by an expression. Every instance of a template owns its children, so a per-instance suffix is not needed — and a !ref is looked up verbatim, so nothing can name such an entry. Write a literal. Still runs: published artifacts carry this spelling, so the kernel reads it. While one is present the dispatch-target checks are switched off for that kind.
DEPRECATED_TEMPLATE_DISPATCH_FORM ⚠️	A dispatch slot written as a bare string or { kind, name } rather than !ref <entry>. Still runs, for the same reason.
TEMPLATE_REF_UNKNOWN	A !ref inside a template body's entry names neither a sibling entry nor a resource of the declaring module.
REF_SLOT_COMPUTED	An expression sits at, or above, a reference slot and is not a bare self.<path>. CEL values are data, so a reference cannot come out of one. Reported in four positions: inside a template body's entry, where the repair is to forward the whole value with !cel "self.<path>" already shaped as the slot expects, or write the slot as !ref; at a resource field the kind evaluates at creation (a Telo.Provider's whole root, a base: child's own fields); at a resource field the kind marks x-telo-eval: runtime, which its controller evaluates per call; and at a resource field a CEL region covers with no x-telo-eval of its own (x-telo-context, x-telo-error-context, a step context) — a route's handler, a container above a route's returns[].content.*.encoder — which its controller evaluates per request. In the last three the only repair is to write the slot as !ref. Any tag that evaluates expressions counts (!cel, !interpolate, !sql). An expression at the slot itself is reported as this alone, never also as INVALID_REFERENCE. A value below or beside a slot stays computable.
TEMPLATE_FORWARD_INCOMPATIBLE	A templated definition forwards self.<path> into an entry field, but the schema it declares for that path is not assignable to the entry kind's field: a type conflict, or a field the entry requires that the declaration does not have. A consumer's forwarded value is checked against the entry's field (its diagnostics land on the consumer's own line, under their usual codes), so a disagreeing declaration only describes values the entry refuses. Align the declaration with the entry's field.
BASE_WITH_TEMPLATE_BODY	A definition declares base: alongside resources: / controllers: / a dispatch slot. base: is read only on the inherited-controller path, which a body switches off — so it would never be evaluated. Drop one or the other.
EXPORT_KIND_UNKNOWN	A Telo.Library's exports.kinds entry names no kind the library declares. A bare name that is an IMPORTED kind is called out separately: re-export it as Alias.Kind, or declare a local kind that extends it.
EXPORT_RESOURCE_UNKNOWN	A Telo.Library's exports.resources entry names no resource the library declares, or an instance the aliased import does not export.

References

Code	What it means and what to do
UNRESOLVED_REFERENCE	A !ref names a resource that does not exist in scope. Check spelling, and that a scoped name is used inside its scope.
REFERENCE_KIND_MISMATCH	The referenced resource's kind is not accepted by that slot. The slot's x-telo-ref constraint names what it takes; a child of that kind is also accepted. A slot constrained to a callable abstract also accepts a function whose signature stands in for it — results covariant, parameters contravariant by position and by name, and deterministic where the abstract requires it — so for a function the message names the parameter that differs, or the chain of calls to the non-deterministic leaf.
INVALID_REFERENCE_FORM	A reference was written as a bare string or { kind, name }. Write !ref Name or !ref Alias.Name.
INVALID_REFERENCE	An object at a reference slot is neither a !ref, an inline declaration ({ kind: …, … }), nor a value the slot's own schema accepts. The message names what the slot takes: each value it accepts, by title and type, a !ref <name> to a resource of the slot's kinds, and an inline declaration of one of them, kinds spelled through the reading module's imports.
DEPENDENCY_CYCLE	Resources depend on each other in a loop, so no boot order can construct them. The message traces the loop; one diagnostic per loop, anchored on a resource in it. Remove one of the references in the loop. A module call is a dependency too, so a function whose body calls itself — directly or through another function — is a cycle: recursion is refused, not deferred. Fails at runtime as ERR_CIRCULAR_DEPENDENCY.
X_TELO_REF_UNRESOLVED	A kind's own x-telo-ref constraint names nothing resolvable — a module-authoring bug, in the module that declares the slot.
X_TELO_REF_LEGACY_IDENTITY ⚠️	The module uses the deprecated "<namespace>/<module>#<Kind>" ref form. Still resolves; the module should migrate to the alias form.
X_TELO_REF_INVALID_USE	A structured x-telo-ref carries an unrecognized use token (a typo would otherwise silently degrade to the legacy no-use reading), or a use case map whose by is not a JSON Pointer. Valid uses: schema, dependency, call, detached, trigger.inbound, trigger.consumer.
X_TELO_REF_MISSING_USE	The structured x-telo-ref form declares no use. Say what the declaring resource does with the target; only the legacy bare-string spelling may omit it.
X_TELO_REF_INVALID_OBSERVES	An x-telo-ref observes: is not a non-empty list of version / features, sits on a slot whose kind is not a need type, names a constraint the need type does not declare (version: semver, a features: list), or is declared by a kind the kernel cannot hold to an observation — one whose capability is not Telo.Provider / Telo.Service / Telo.Runnable / Telo.Invocable, or whose instances the kernel's template controller serves. Hold a resource of a kind that opens the fulfilment and observes at its own slot. Refused at registration too, as ERR_X_TELO_REF_INVALID_OBSERVES. See A kind that consumes and verifies a need.
X_TELO_REF_MISSING_KIND	A structured x-telo-ref declares no kind, so the slot constrains nothing and the editor has nothing to pick against.
X_TELO_REF_USE_CONFLICT	anyOf branches of one slot declare disagreeing uses. use is a property of the slot — declare the acceptable kinds as one kind: list with one use.
X_TELO_REF_DYNAMIC_SELECTOR	A use case map's selector field is written in CEL, so which use holds cannot be resolved statically. Write the mode as a literal (or rely on the schema default), or split the wiring into one resource per mode.
X_TELO_REF_INVALID_OUTPUT_TYPE	A structured x-telo-ref declares an outputType that is not a JSON Schema object, so it would read as absent and the slot would accept a target returning anything.
MOUNT_ON_NON_MOUNT / MOUNT_DISPATCHER_CONFLICT	mount: used on a non-Mount definition, or alongside another dispatcher (invoke: / provide: / run:).
PROVIDE_ON_NON_PROVIDER / PROVIDE_DISPATCHER_CONFLICT	provide: on a definition that is not a Telo.Provider, or beside another dispatcher.

CEL

Code	What it means and what to do
CEL_SYNTAX_ERROR	The expression does not parse.
CEL_UNKNOWN_IDENTIFIER	The expression's root name (variabels, step, req) is not in scope at this site. What is in scope depends on the field — see !ref and !cel.
CEL_UNKNOWN_FIELD	A property does not exist on the value's schema at that path.
CEL_TYPE_ERROR	The expression's result type does not match what the field or the call target's inputType declares (returns 'string' but the field expects 'int', … but consume's declared inputType expects 'integer'), or reads a value whose declared shape or value type does not fit, or the type-checker rejected the expression outright. A call target is whatever an argument map is written for: a step's inputs:, a boot target's inline step, a reference slot's inputs: map (a route, a tap, a schedule), and a templated definition's top-level inputs:. JSON types compare by containment — an integer (or a value type whose base is one, a port) fits a number; a number does not fit an integer. Also reported when the expression reads a value its producer declares nullable — directly or through a $ref — into a field or argument that takes no null: guard it (x != null ? x : <fallback>). A declared type behind a $ref is read as the shape it names — a document-local reference, or a named shape; a named shape referenced from inside another named shape is not read yet, so a value beneath it is not checked. A document-local reference (#, #/$defs/Row) names what it names from the root of the document that declares it — the kind's schema for a field, the target's inputType for an argument, the producing step's outputType for a value read from steps.<name>.result; one met in a value read from anything else (inputs, variables, a step that forwards part of another's result) is not followed, and what lies behind it is not checked. A member read through a union (anyOf / oneOf) is held to what the union's alternatives declare for it; an alternative that could hold the member but does not declare it leaves the value unchecked. One expression is reported once: a whole-map inputs: !cel is judged against the target's inputType, and against the field only when that passes. Cast (int(...), string(...)) or fix the field.
CEL_UNKNOWN_FUNCTION	The expression calls a function that does not exist. The message suggests the nearest name; telo cel functions lists them all.
CEL_WRONG_CALL_FORM	The function exists but is called the wrong way round — a method written as a global (size(x) vs x.size()), or vice versa. The message shows the correct spelling.
CEL_TYPE_ARGUMENT_MISMATCH	The expression reads a value of the same value type on both sides, the disagreement beneath a type argument: a Telo.Stream of Telo.Bytes into a field or call-target inputType slot declaring a Telo.Stream of strings, at any depth of the value. Any other misfit of a declared shape is CEL_TYPE_ERROR.
CEL_NULLABLE_ACCESS	Dereferencing a value whose schema admits null without a guard — or an !interpolate hole that is such a value, since a null has no text.
INTERPOLATION_HOLE_NOT_CONVERTIBLE	An !interpolate hole's type has no string() conversion (a list, a map). Convert it inside the hole, or write the whole value as !cel.
UNTAGGED_INTERPOLATION	A plain string holds ${{, which is never evaluated. Loading normally migrates it, so this means it was read without migrations or no hole can be read out of it ("${{ foo"). Run telo migrate, or tag the text !literal if it is literal. In an imported library it is reported at your import of it, since the library then fails to load; import a version that fixes it.
DEPRECATED_UNTAGGED_INTERPOLATION ⚠️	A plain string holding ${{ }} — the legacy spelling. It still runs, rewritten at load: a lone hole to !cel, text with holes to !interpolate. telo migrate writes the same rewrite to the file.
CEL_IN_NON_EVAL_FIELD	The field is never evaluated, so the expression would be read as a literal.
ACCESSOR_NOT_PLAIN_CHAIN	A field its kind marks x-telo-eval: accessor names a value for the resource's consumer to resolve and is never evaluated, so it holds either a literal or one !cel that is a plain chain — identifiers joined by dots (row.isDone) — rooted at a name the field's context declares. Reported for a call, an operator, an index, an !interpolate, any tag nested beneath the field, and a chain rooted at a global such as variables. Write the chain alone, or a literal. See Accessor fields.
MATCH_UNSATISFIABLE	A schema a kind matches against an accessor field (x-telo-match-for) can never hold for the value that field names — a const: 3 matched against a chain declared type: string, a closed object requiring a member the value never has. Judged by definite disjointness of the declared types only (type, const, enum, closed required, through properties, items, allOf and every branch of an anyOf), so an open or untyped value is never reported. Fix the schema or the accessor. telo run refuses the same manifest at load, as ERR_MANIFEST_VALIDATION_FAILED carrying this diagnostic. See Accessor fields.
MATCH_FOR_INVALID	A kind's x-telo-match-for names no accessor field to match against: it sits on something that is not a property of an object schema, its pointer names nothing or crosses an array, the field it names is not marked x-telo-eval: accessor, or it sits at or beneath an accessor field itself. A value that is no pointer string is a SCHEMA_VIOLATION. A module-authoring bug, reported where it is written. See Accessor fields.
CONTEXT_EVAL_MISPLACED ⚠️	x-telo-context-eval is written somewhere other than directly on a binding of an x-telo-context, so it marks nothing. Move it onto the binding. See Accessor fields.
ELEMENT_FROM_ITEM_INVALID	A kind's x-telo-context-element-from-item pointer names no collection to type the binding from: it climbs above the resource (or above the named shape it is written in), names a member the schema does not declare, lands at or beneath the field the region is declared on, or names a field that declares no x-telo-eval. Count the levels from the object holding the field the region sits on (0/rows, 2/rows). See Accessor fields.
CONTEXT_FROM_REFERRER_INVALID	A kind's x-telo-context-from-referrer is written off a binding, on a binding that exists at another eval mode than accessor alone, or beside another x-telo-context-from* annotation typing the same binding. Mark the binding x-telo-context-eval: accessor and keep one typing. See Accessor fields.
CONTEXT_ITEM_FILLS_INVALID	A kind's x-telo-context-item-fills is written off a binding, or on a binding of a region declared on a field that is no list. See Accessor fields.
CONTEXT_FILL_CYCLE	Entries of a list that each fill a member of a record read each other's members in a cycle — a form's field shown only once its own value is set, or two fields whose option sources filter by each other — so none could be entered first. Read a member no entry of the cycle fills. See Accessor fields.
DEPRECATED_ELEMENT_FROM_ITEM_FIELD ⚠️	x-telo-context-element-from-item holds a bare field name — the earlier spelling. It still works, rewritten at load to the pointer naming that field beside the region (rows → 0/rows). telo migrate writes the same rewrite to the file.
CEL_NONDETERMINISTIC_IN_COMPILE_FIELD ⚠️	now(), uuidv4() or another volatile call — or a module function that reaches one, named by its chain (Billing.isStale → now()) — sits in a field evaluated once at startup, so the value is baked in at load and never changes. Move it to a per-call field if it should vary.
ENGINE_DIAGNOSTIC	A templating tag other than !cel (for example !sql) reported a problem with its body. The message carries the engine's own text.
UNKNOWN_ENGINE	A !<tag> names a templating engine that is not registered.
UNUSED_DECLARATION ⚠️	A declared variables.* / secrets.* entry is referenced by no CEL expression. Usually a typo at the use site.
BINDING_CYCLE	A named binding (bindings: on Run.Value / Run.Choice) references itself, directly or through other bindings.
BINDING_NAME_RESERVED	A name that could never be read where it is written: a CEL keyword; a name already in scope at that site (inputs, steps, …), which always wins; or one of the module's own names — an imports: alias, Self, or its metadata.name — through which a call <name>.f(…) reaches that module's function instead. Covers a bindings: key, a comprehension variable and a cel.bind name.
IMPORT_ALIAS_SHADOWS_CONTEXT	An imports: alias is also the name of a CEL variable a kind this module uses puts in scope (x-telo-context), so a call <alias>.f(…) reaches the imported module and the variable cannot be reached through one. Reported at the imports: key; rename the alias.
BINDING_FIELD_AMBIGUOUS	A kind's schema points x-telo-bindings-from at more than one field — a module-authoring bug.

Functions

A function is a resource whose capability resolves to Telo.Callable — a Telo.Function with a CEL body, or an instance of a callable kind with a controller — called from CEL through a module name: Self.fn(x) or <ModuleName>.fn(x) for one the module declares, <Alias>.fn(x) for one an import lists in exports.resources. Every code here is reported for the entry's own modules; a dependency's is refused by the kernel when its caller is created. See CEL functions.

Code	What it means and what to do
FUNCTION_UNRESOLVED	A call through a module name reaches no resource: the module declares no resource of that name, or the receiver is not one of its imports. The message ends with the reason. Fails at runtime as ERR_FUNCTION_UNRESOLVED.
FUNCTION_NOT_EXPORTED	The imported library declares the resource but does not list it in exports.resources. Export it, or call something it does export. Fails at runtime as ERR_FUNCTION_NOT_EXPORTED.
FUNCTION_NOT_CALLABLE	The name reaches a resource whose capability does not resolve to Telo.Callable; the message names its kind. Only a function can be called. Fails at runtime as ERR_FUNCTION_NOT_CALLABLE.
FUNCTION_ARITY_MISMATCH	The call passes a number of arguments no parameter list of the function accepts — more than it declares, or fewer than its required parameters. Fails at runtime as ERR_FUNCTION_ARITY_MISMATCH.
FUNCTION_ARGUMENT_MISMATCH	An argument's CEL type — or, for an argument written as a plain chain, its declared shape — does not satisfy the parameter's schema.
FUNCTION_RETURN_MISMATCH	A Telo.Function's body yields a type its returns: does not admit.
FUNCTION_CALL_UNBOUND	A module call sits where the runtime binds no function: an Application's logging: block, resolved while the application loads, or a Telo.JsonSchema rule condition, evaluated against the value alone. Compute the value elsewhere.
CALLABLE_DEFINITION_INVALID	A callable kind or function breaks a rule of what a function is: a signature or deterministic: on a kind whose capability is not Telo.Callable; deterministic: on an instance (the claim belongs to the kind supplying the code — and a Telo.Function's determinism is derived, never declared); a kind extending Telo.Function; a status: block or a template body on a callable; a replaced signature on a kind that inherits its controller, which has no bridge to make it true. The message says which and what to do. Fails at registration as ERR_CALLABLE_DEFINITION_INVALID.
CALLABLE_REFERENCE_NOT_DATA	A native function's use: dependency slot hands its controller the referenced resource's configuration as frozen data, and that configuration is not data yet: it holds an expression evaluated after creation (a runtime-eval field, a CEL region, a step or function body), a scope, or a need — read a need's fields in a compile-eval field instead — or its references form a cycle. In a template body, a native function entry naming a resource of the defining module (bare or Self.<name>) is refused too: declare it in the body's resources:, or hand it in through a bare self.<field>. Reported at the function's slot; for a library's resource input at each import supplying it. Fails at creation as ERR_CALLABLE_REFERENCE_NOT_DATA.
FUNCTION_OPTIONAL_NOT_TRAILING	A required parameter follows an optional one. A call is positional, so an optional parameter can only be omitted from the end — move it last.
FUNCTION_TYPE_NAME_FORM	A signature schema: names a shape as a bare string (schema: Money). Reference it: schema: !ref Money — the diagnostic carries that repair.
X_TELO_REF_CALLABLE_UNTYPED	A kind's slot holds a function through a bare Telo.Callable constraint, which says nothing about the signature — a wrongly typed function would pass telo check and fail with ERR_INPUT_INVALID when called. Constrain the slot to a callable abstract that declares params / returns.

Embedded files

Code	What it means and what to do
INCLUDE_PATH_INVALID	An !include-text / !include-bytes path is empty, a URL, or a glob. An embed names exactly one file that ships inside the module; to read a file at runtime from elsewhere, use Fs.File.
INCLUDE_PATH_ESCAPES_MODULE	The path is absolute, or climbs above the module root. Paths are relative to the directory holding telo.yaml, and only a file inside the module can be carried by its artifact.
INCLUDE_FILE_NOT_FOUND	An !include-text / !include-bytes names a file that is not there. Checked in the entry module and every module it imports by a filesystem path (source: ./lib) — a registry module's files were verified when it was published. telo run and telo install refuse the load on it; telo check reports it. A path the module's sources: block stages counts as present. The message names the absolute path checked and, when one entry of that directory is a plausible typo of the name, offers it as a quick fix; when the directory itself is missing it says so.
INCLUDE_OUTSIDE_RESOURCE	An embed is written on a doc that is never instantiated (Telo.Application, Telo.Library, Telo.Import), so nothing would ever read it. Move it onto the resource that needs the file.
MODULE_PATH_INVALID	A !module-path is empty, a URL, a glob, or the module root itself. It names one file or directory that ships inside the module.
MODULE_PATH_ESCAPES_MODULE	The !module-path is absolute, or climbs above the module root. Paths are relative to the directory holding telo.yaml, not to the file the tag is written in.
MODULE_PATH_OUTSIDE_RESOURCE	A !module-path is written on a doc that is never instantiated, so nothing would ever read it. Move it onto the resource that needs the path.
MODULE_PATH_NOT_FOUND	A !module-path names nothing on disk, in the entry module or a module it imports by a filesystem path. Reported by every host that loads from a filesystem, refused at load by telo run / telo install, and by telo publish / telo package. A path the module's sources: block stages counts as present.
MODULE_PATH_EMPTY	telo publish / telo package only: a !module-path names a directory holding no files, which an artifact layer cannot carry. Add the files it should ship, or remove the tag.
HOST_PATH_RELATIVE	A relative path is written where a Telo.HostPath is declared — a literal, a relative default: in a kind's schema or a Library variable, or a relative literal passed through an import's variables:. A host path is absolute on the machine running the app. For a file that ships with the module, write !module-path <path>; for a location on the host, read it from an Application variable declared x-telo-type: Telo.HostPath, whose value the kernel resolves against the working directory.
HOST_PATH_UNTYPED_SOURCE	An expression feeds a Telo.HostPath slot from a source not declared as one — !cel "variables.dir" where dir is a plain string, or a string built with +. Declare the source x-telo-type: Telo.HostPath, and extend it with .joinPath('sub/dir'), which keeps it a host path.

Invocation contracts

Code	What it means and what to do
CONTRACT_INPUTS_MISMATCH	The inputs: at a call site do not satisfy the target's declared inputType. It judges the values written there, not expressions: a !cel argument is judged by its type instead (CEL_TYPE_ERROR), and a tag with a fixed produced type (!interpolate, an !include-* embed, !module-path) only for that type — a string into an integer member is refused, while its text is held to minLength, pattern or format when it is produced, at dispatch (ERR_INPUT_INVALID). The same expression written twice in a uniqueItems list is a written duplicate: tags: [!cel "variables.word", !cel "variables.word"] is refused naming the two items, where two different expressions — or one that differs per evaluation, such as uuidv4() — are left to dispatch. A literal a value type declaring its own refusal code refuses (Telo.Url) reports under that code (URL_INVALID), with this site's wording; every other finding here keeps this code.
REFERENCE_OUTPUT_MISMATCH	A reference slot declares, through x-telo-ref outputType:, what its target must return, and the referenced resource's output contract definitely cannot be that shape — a required field missing from a closed contract, or a field of another type. Point the slot at a target returning that shape, or declare the target's outputType / outputs: to produce it.
CONTRACT_MISSING_MAPPING	A child that inherits a controller declared its own inputType/outputType but no inputs:/result: bridge, so the inherited controller would never see the mapped shape.
CONTRACT_INPUTS_SCHEMA_FORM	inputs: was written as a JSON-Schema property map. inputs/outputs are always values; inputType/outputType are always schemas.
CONTRACT_TYPE_NOT_FOUND	A !ref names a type that does not resolve — in a kind's or resource's inputType / outputType, or in a signature's params[].schema / returns.schema, at the root or nested.
CONTRACT_NOT_SUBSTITUTABLE	A contract or signature that replaces an abstract ancestor's cannot stand in for it: an outputType or returns the ancestor's readers cannot read (covariant), an inputType or parameter its callers cannot send (contravariant), a parameter renamed (a holder calls with the ancestor's names), a different number of parameters, or a non-deterministic implementation of an abstract that requires determinism.
TEMPLATE_TARGET_MISMATCH	A templated definition's body does not satisfy the target kind's contract. It judges the values written there: a !cel in the definition's top-level inputs: is judged by its type instead (CEL_TYPE_ERROR).
UNCOVERED_THROW_CODE	The handler declares an error code that no catches: entry covers.
UNDECLARED_THROW_CODE	A catches: entry names a code the handler never throws — usually a typo.
THROWS_ON_NON_DISPATCH_CAPABILITY	A Telo.Definition declares throws: with a capability other than Telo.Invocable or Telo.Runnable. A throw union describes what a caller can catch, and no caller awaits any other capability's entry point, so a thrown error there is a boot failure with nothing to render it. The kernel refuses the definition, so it is reported for a dependency's definition too. Drop throws:, or declare it on the kind that is dispatched.
UNBOUNDED_UNION_NEEDS_CATCHALL / CATCHALL_NOT_LAST	The throw union could not be enumerated, so catches: needs a catch-all; and a catch-all must come last.
INHERIT_WITHOUT_STEP_CONTEXT	A definition declares throws: { inherit: true } but dispatches nothing a failure can come back through: its schema has no step body and no reference slot whose use includes call or trigger.consumer (for a use case map, in any case; a slot declaring no use counts as call). detached and trigger.inbound targets run where no caller awaits them, and dependency / schema slots dispatch nothing. Add such a slot, or drop inherit and declare throws.codes.
LIVE_VALUE_RETRIED	A step passes a live value (a Telo.Stream) into a target, and either the step or the target declares a retry. A stream is consumed once; a re-attempt would pass an exhausted one. Drop the retry, or collect the stream into a plain value first.
SPAN_ATTRIBUTE_INVALID	An x-telo-span-attribute value is not an attribute name — write dot-separated lowercase segments of letters, digits and underscores (telo.check.exit_code) — or names one the runtime sets on every span itself (error.type, telo.cancellation.reason, telo.resource.kind, telo.resource.name). Reported at the mark. See Tracing.
SPAN_ATTRIBUTE_MISPLACED	An x-telo-span-attribute mark the runtime cannot read. The kernel reads a mark wherever a contract (inputType / outputType) reaches it through properties, following $ref into $defs entries and named shapes. At the mark: the marked node is not a scalar, or sits beside x-telo-sensitive: true. At the property that reaches it: the contract reaches the mark through an array item or a map value, which holds any number of values per dispatch (at the contract itself when the mark is on its root). At the mark again: no contract reaches it at all — a kind's schema: / status:, a $defs entry nothing references, a named shape no contract uses and its library does not export.

Execution zones and durable regions

Code	What it means and what to do
ZONE_REQUIREMENT_UNSATISFIED	A resource requires being reached through another's body (a Sql.Command through a Sql.Transaction on the same connection) and no path in the call graph provides it. Wrap the call, or drop the requirement.
ZONE_REQUIREMENT_DEFERRED ⚠️	The requirement might be met at runtime but the analyzer cannot prove it — the edge is trigger.consumer, or its use selector is not statically resolvable.
ZONE_EXPORT_UNSATISFIABLE	A library exports a resource that carries an open zone requirement on something the library does not export, so no importer can ever satisfy it. Export the correlated resource too, or export something that goes through the provider.
ZONE_PROVIDER_UNRESOLVED	An x-telo-requires-zone names a kind that does not resolve in the declaring module — a module-authoring bug.
ZONE_ANNOTATION_INVALID	An x-telo-provides-zone / x-telo-requires-zone annotation is malformed — a correlation key that is not a JSON Pointer, an object missing zone, and so on.
ZONE_ATTRIBUTE_UNKNOWN	A providing slot declares an attribute outside the closed vocabulary (atomic, idempotent, noSuspend, replayed). The message suggests the nearest name.
ZONE_ATTRIBUTE_INCOMPLETE	A zone attribute is declared without its dependency (atomic requires noSuspend), or without the prose reason that is its value.
ZONE_ATTRIBUTE_VIOLATED	Something inside a region cannot honour what the region promises — a Durable.Sleep inside a noSuspend transaction, a retry whose backoff is long enough to park. The message prints both the region's reason and the rebuttal. Move it outside the region, or use a region that does not make that promise.
DURABLE_NONDETERMINISM	A volatile call (uuidv4(), now()) — or a module function reaching one, named by its chain, or a native function whose kind does not declare deterministic: true — sits inside a region declared idempotent. That region re-runs on a resume with its earlier effects intact, so a value that differs per pass makes the re-run something other than a no-op. Pin it once with Durable.Value.
DURABLE_DETACH_FORBIDDEN	A detached dispatch inside a durable region. Progress is recorded when a step completes, so detached work would be recorded as done while still running. Start a nested durable run instead.
DURABLE_UNJOURNALABLE_RESULT	A step inside a durable region invokes a target whose declared output is a live value. A stream cannot be recorded and replayed; collect what you need into a plain value inside the step. Fails at runtime as ERR_DURABLE_UNJOURNALABLE_VALUE.

Resource rules and referrer rules

Code	What it means and what to do
RESOURCE_RULE_VIOLATED	A rule the kind declares (x-telo-resource-rules) does not hold for this resource — an index naming a column its table does not declare, for instance. The author's own code is in data.rule; the message is theirs.
RESOURCE_RULE_SKIPPED ℹ️	A rule could not be evaluated because a value it reads is a !cel expression only known at runtime. Reported, never silently dropped.
RESOURCE_RULE_UNEXERCISED ℹ️	A rule's in: collection was empty on every resource of the kind, so the rule never ran. Usually fine; worth a look if you expected it to fire.
RESOURCE_RULE_INVALID	The rule itself is defective — it calls a host-backed or non-deterministic function, names a collection the kind does not declare, does not parse, or threw while evaluating. A module function is judged by what it reaches: a Telo.Function whose body calls only deterministic, host-free functions is admitted and evaluated, one reaching now() is refused naming the chain, and a native function is always host-backed. A malformed declaration is an error on the declaring definition. An EVALUATION failure — it threw, or it exhausted its budget — is one diagnostic per rule for the whole analysis: a warning anchored at the imports: entry that brought the kind in, since a consumer cannot change a dependency's rule, and an error at the rule's own declaration for a kind of this workspace, where the reader is the author and a rule that cannot run is checking nothing. A rule whose read reaches a slot carrying REFERENCE_KIND_MISMATCH is not evaluated and reports nothing.
REFERRER_RULE_VIOLATED	A kind's requirement on whoever references it (x-telo-referrer-rules) does not hold — a server mounting Http.Reference with no openapi: block. Reported on the referrer, at the slot, naming the kind that declared the rule.
REFERRER_RULE_SKIPPED ℹ️ / REFERRER_RULE_UNEXERCISED ℹ️ / REFERRER_RULE_INVALID	As for resource rules. UNEXERCISED matters more here: nothing matching the referrer: filter ever referencing the kind is what a typo in the filter looks like from outside.

Modules, imports, and exports

Code	What it means and what to do
DUPLICATE_IMPORT_ALIAS	An alias is declared twice in one module scope. Aliases never shadow — rename one.
INVALID_IMPORT_SOURCE	An imports: source is not a module reference at all — not an oci:// ref, an http(s):// URL or a relative path (the removed bare <namespace>/<name>@<version> form included). Reported at the imports: entry; rewrite the source. The runtime half is ERR_INVALID_IMPORT_SOURCE.
IMPORT_UNRESOLVED	A well-formed imports: source could not be obtained — the file is missing, the registry unreachable, the pin does not match. Reported at the imports: entry with the loader's reason. The runtime half is ERR_IMPORT_UNRESOLVED.
INVALID_IMPORT_TARGET	An imports: source was obtained and is not an importable library: a Telo.Application, the built-in vocabulary archive, a file with no Telo.Library document, or a library declaring no metadata.name. Reported at the imports: entry; point it at a library — the fix is often in the target, not the ref. The runtime half is ERR_INVALID_IMPORT_TARGET.
KIND_PREFIX_RESERVED	Telo and Self are the runtime's kind prefixes — Telo.<Kind> a built-in, Self.<Kind> the declaring module's own — so a module may not be named either, an import may not be aliased either, and a library named either cannot be imported (reported at the imports: entry reaching it). Rename the module or choose another alias. The runtime half is ERR_KIND_PREFIX_RESERVED.
MODULE_VERSION_CONFLICT	One module is imported at incompatible major versions. Align the pins.
MODULE_VERSION_HOISTED ⚠️	One identity imported from two sources whose contents differ; one won. Align them to be sure which.
INVALID_EXPORT	exports.resources entries are plain name strings (Name or Alias.Name) — not !ref.
LIBRARY_ENV_KEY_REJECTED	env: is only valid on a Telo.Application. A library receives values from its importer — and a library's need is read from its derived name when it reaches the root unsupplied; to choose the name, the application declares a need of its own with env: and supplies it at the import. Raised at load for a dependency as ERR_LIBRARY_ENV_KEY_REJECTED when on a need.
LIBRARY_ARG_KEY_REJECTED	arg: is only valid on a Telo.Application: only the application being run reads the command line. A library receives values from its importer.
ARG_BINDING_INVALID	An Application entry's arg: cannot be parsed against: a variable bound by arg: alone with no default: (a runner session could not supply it), a flag spelled no-… or help, a type the command line cannot carry (only scalars and arrays of scalars), two entries sharing a flag, short or position, a gap between positions, or an array before the last position. See Application arguments.
ARG_BINDING_ON_SECRET	A secrets: entry carries arg:. A command line is readable in the process table and in shell history — bind the secret with env:.
MANIFEST_PARSE_FAILED	The YAML itself did not parse.
MODULE_REQUIRES_NEWER_RUNTIME	The module declares requires: telo: ">=X" (or a host: axis) and this runtime is older. The module is fine; the runtime is too old. Every other diagnostic from that module is suppressed, since they are consequences of the same skew. Upgrade telo, or pin the module to a version whose range accepts yours. See Upgrades & version skew.
REQUIRES_INVALID	A requires: block is malformed: ^ / ~ / a bare version / || / a wildcard, or an unknown axis. Each bound must be testable — write >=0.80.0. Reported only for the entry's own modules.
METADATA_UNKNOWN_FIELD ⚠️	A metadata: key is a near-miss of a known one (licence → license). Nothing reads an unrecognised key, so it declares nothing.
METADATA_INVALID_TYPE ⚠️	A known metadata: field has the wrong type (categories must be a list of strings, deprecated an object).
LIBRARY_CANDIDATE_INVALID / LIBRARY_CANDIDATE_DUPLICATE	An exports.code: entry is malformed, or two entries declare the same format/platform selector. A module has one entry point per selector.

Sharing across libraries

Code	What it means and what to do
RESOURCE_INPUT_MISSING	The imported library declares a resources: input the import does not supply. Add resources: { <name>: !ref <instance> } to the import's object form.
RESOURCE_INPUT_UNKNOWN	The import supplies a resource input the library does not declare. The message lists the declared ones.
RESOURCE_INPUT_UNRESOLVED	The supplied value is not a !ref, or names a resource this module does not declare.
RESOURCE_INPUT_KIND_MISMATCH	The supplied instance's kind does not satisfy the input's declared constraint (a child of the constrained kind is accepted).
RESOURCE_INPUT_KIND_UNRESOLVED	In the declaring library, an input's kind: does not resolve — write it alias-qualified (<Alias>.<Kind>, Self.<Kind>, Telo.<Kind>).
RESOURCE_INPUT_EXPORTED	A library lists one of its own inputs in exports.resources. An input is something the importer supplies, so there is nothing to export.
SHARED_LIBRARY_CONFLICT	Two imports reach one lifecycle: shared library with different variables / secrets / resources / needs values. A shared library is one instantiation for the whole application, so every import must agree. Reported at both imports, naming the key — never a secret's or a need's value.
SHARED_LIBRARY_OVERRIDE	An import of a lifecycle: shared library declares a per-import logging: or runtime: override, which cannot apply to an instantiation it does not own.

Needs

Each of these is also refused by the kernel at load, before any resource initializes, under the ERR_-prefixed code — for a dependency as much as for the entry's own modules. See Declaring a need, Providing needs and Writing a need type.

Code	What it means and what to do
NEED_TYPE_UNRESOLVED	A needs: entry's kind: names no need type in the module's scope. Write it alias-qualified — <Alias>.<Kind> for a Telo.NeedType an import exports, Self.<Kind> for one the module declares.
NEED_PARAMETERS_INVALID	A need's parameters: do not satisfy its type's parameters schema, or the type declares none; or its version: is stated on a type that is not versioned, is not a range of explicit comparators (>=15.0.0), or admits no version; or its features: names one the type does not list. For a public address need (Telo.PublicUrl, Telo.PublicHostPattern): a library's states any parameter, a root one names no port, a key ports: does not hold or a udp port, more than one Telo.PublicUrl is primary: true, or more than one on a port sets customDomains: true.
NEED_CONSTRAINT_UNVERIFIED	A need's version: / features: reaches no reference slot that observes it — through the module's own resources taking the need whole (inline declarations and its templated kinds' resources: body entries included), or any need it is forwarded to whole at an import, recursively. Field reads and field-by-field supply do not verify. Reference the need whole at a slot that observes it, or drop the constraint; a provisioning request belongs in parameters:.
NEED_OPTIONAL_REFERENCED	A !ref to an optional: true need at a kind's reference slot. Read an optional need by guarded field reads, forward it to a need that is itself optional, or make it required.
NEED_FIELD_UNDECLARED	A key the need type does not declare: in a fulfilment's fields:, in an import's field-by-field supply, in an application need's env: map, or in a Telo.NeedType's own required: list. The message lists the type's fields.
NEED_SLOT_MISMATCH	A fulfilment's fields:, or a field-by-field supply, does not yield every field the type requires — or a supply is neither a !ref nor a map of fields — or an application need's env: map leaves a required field unbound.
NEED_UNDECLARED	An import's needs: supplies a key the imported library does not declare. The message lists the declared needs.
NEED_FORWARD_INCOMPATIBLE	A need is supplied whole by a !ref to an optional: true need of the importer, while the target need is required; or to a need stating no version, or a range not within the target's; or to a need not asking for every feature the target does. The narrower outer need is the one enforced, so it must state at least what it supplies.
NEED_ROOT_SUPPLY_REQUIRED	A need of a supply: root type — Telo.PublicUrl, Telo.PublicHostPattern — supplied other than through a root need forwarded whole: a fulfilment of the type the module writes itself (referenced from a hostnames entry, say), a field-by-field supply at an import, or a library's need of the type that reaches the root unforwarded. The message names which. Declare the address on the application, naming a port, and forward it whole at each import.
RESOURCE_INPUT_NEED_TYPE	A library's resources: entry is constrained to a need type. A resource input is a live instance the importer must hand over; declare the entry under needs: instead.
NEED_ENV_NAME_COLLISION	Two need fields reaching the root read one environment variable — bound or derived, as two aliases one word boundary apart do (HttpServer and HTTPServer both derive HTTP_SERVER) — or a need field reads a name a variables: / secrets: / ports: entry already binds. Each name supplies one value: rename an alias or a need, or bind another name with env:. Decided over the whole import tree, a collision two imports deep included.

A need-table defect in an imported library is reported in the importer's check too, once, at the imports: entry through which the library is reached, prefixed Imported library '<name>' — the repair is the library's, and the kernel refuses the importer at load all the same.

A whole supply naming a need or fulfilment of another type is REFERENCE_KIND_MISMATCH; one naming nothing the importer declares is UNRESOLVED_REFERENCE; a need named like another declaration of its module is DUPLICATE_RESOURCE_NAME. A field read the type does not declare is CEL_UNKNOWN_FIELD, and an optional need read unguarded CEL_NULLABLE_ACCESS.

Schemas and types

Code	What it means and what to do
SCHEMA_VIOLATION	The resource does not match its kind's schema — usually an unknown or misspelled field, since kind schemas are closed. A required field the kind's parent declares names that parent and points at base:: a child that extends without a base: mapping is authored against merge(parent, own), so the parent's required fields stay on the child's surface and a kind written to supply one still demands it from the consumer. Adding base: sets them internally and narrows the surface to the child's own schema. A value outside a Telo format's grammar (format: css-selector) names where the checker stopped and what it expected. Also an import's variables: / secrets: literal that does not satisfy the entry the imported library declares (pool: x for an integer), read after its type's plain encoding decodes it; the kernel refuses the same supply when the import initializes (ERR_RESOURCE_SCHEMA_VALIDATION_FAILED).
SCHEMA_COMPILE_ERROR	A definition's schema: is not valid JSON Schema.
DUPLICATE_SCHEMA_ID	A type name collides with a kind name in the same module.
SCHEMA_TYPE_REF_UNKNOWN_ALIAS / SCHEMA_TYPE_REF_UNRESOLVED	A schema $ref names an unknown alias, or a module that does not declare that type.
INVALID_SCHEMA_FROM / SCHEMA_FROM_MISSING_PATH	An x-telo-schema-from annotation is malformed or points at an unresolvable anchor.
DEPENDENT_SCHEMA_MISMATCH	A value does not match the schema derived from a sibling reference. A literal a value type declaring its own refusal code refuses (Telo.Url) reports under that code (URL_INVALID) instead.
BASE_UNKNOWN_FIELD / BASE_MISSING_REQUIRED / BASE_SCHEMA_MISMATCH	A base: construction mapping sets a field the parent kind does not have, omits one it requires, or supplies the wrong shape.
X_TELO_TYPE_UNKNOWN	x-telo-type names something that is not a built-in value type (Telo.Bytes, Telo.Duration, Telo.HostPath, Telo.Stream, Telo.TcpPort, Telo.Timestamp, Telo.UdpPort, Telo.Uint64, Telo.Url). A named shape is written as !ref to a Telo.JsonSchema, not here. Checked in kind schemas, contracts and a module's own variables: / secrets: entries. Suggests the nearest name.
X_TELO_TYPE_ARGUMENT_UNKNOWN	The object form supplies a type argument the value type does not declare (Telo.Stream takes only of, Telo.Url only scheme).
URL_INVALID	A literal at a Telo.Url slot is not one: its text does not read as an absolute URL (no scheme, a fragment, a character a component must percent-encode, a port outside 1–65535, a repeated query key), an object of its members holds an unknown member or one that cannot stand (port: 70000, a password with no user, a user with no host), or its scheme is not one the slot's scheme argument admits — the message lists them. Reported under this code wherever the literal is written, each message keeping its site's wording and anchor: a resource's own field (a member written as an expression beside literal ones included), an import's field-by-field need supply, an import's variables: / secrets:, a call's inputs: (a step, a reference slot's inputs:, a template's top-level inputs:, a boot target), a slot typed by another field or kind (x-telo-value-schema-from, x-telo-schema-from) and a variables: / secrets: default: — the one rule being the type's acceptsText.code, so a finding that is not about the URL keeps its site's code. The message names the field and what is wrong, never the value, since a URL may carry a password. A computed value is refused at creation or at an import as ERR_URL_INVALID, and at a call's dispatch as ERR_INPUT_INVALID / ERR_OUTPUT_INVALID carrying it.
X_TELO_TYPE_BASE_MISMATCH	A node declares a type: its value type's base contradicts — type: integer beside x-telo-type: Telo.HostPath, a string — so no value satisfies both. Declare the base type.
DEFAULT_INVALID	A variables: / secrets: entry's default: does not satisfy the entry's own declaration (its type:, its value type's encoding, its other keywords). A default a value type declaring its own refusal code refuses (Telo.Url) reports under that code (URL_INVALID) instead. The kernel refuses the same default at boot with ERR_MANIFEST_VALIDATION_FAILED. A relative Telo.HostPath default on an Application binding is fine — it is resolved against the working directory.
SCHEMA_PROJECTION_INVALID	A kind's x-telo-schema-projection / x-telo-schema-map is malformed, carries a key the annotation does not declare, names a nested field that is not a collection of the same entries, or is written under schema: instead of beside it; or an x-telo-schema-projection-from object form carries an unknown key or a malformed from / pick / omit, or sits on a kind document beside x-telo-schema-projection or with pick; or an entry modifier's default: is declared in more than one place (on the field and in an if's then / else, or in two conditionals), or decided by an if that does not compile — a module-authoring bug. See Schema projections.
SCHEMA_PROJECTION_FROM_UNRESOLVED	A slot declares x-telo-schema-projection-from, but the derived declaration cannot be projected — a hop does not resolve to one declaration (none in the holding declaration's module scope, several, or a path its kind does not declare as a reference), a hop reaches a declaration whose kind resolves to no definition, the target declares no projection, kind-level derivations form a cycle, a pick / omit selector names an entry the projection lacks or lands on an expression, or an entry contains itself through nested. Fails at runtime as ERR_SCHEMA_PROJECTION_UNRESOLVED.
SENSITIVE_ANNOTATION_MISPLACED	x-telo-sensitive was written where no declared contract (inputType / outputType) reaches it — the kernel reads it wherever a contract does, following $ref into $defs entries and named shapes — so nothing reads it (a function's signature included, whose arguments ride no trace payload) and the value would ride the debug wire in clear. See Marking a contract field sensitive.
SENSITIVE_ANNOTATION_INVALID	x-telo-sensitive must be exactly true. It is a marker, not a level. On a need type's field it also requires a field holding text — a string, or a value type written as its text (Telo.Url): a sensitive value is redacted by its text — either refused for an imported library too, at the import that reaches it, and by the kernel at load (ERR_SENSITIVE_ANNOTATION_INVALID).
VALUE_SCHEMA_FROM_INVALID	A kind's x-telo-value-schema-from names a location its schema cannot hold a value at — a segment before the first reference slot naming no declared property, or * on a node that is no list — or its { from, member } form names no member: # on a node reached by an index rather than a key, or a pointer to a node that is not a string. Written in the kind's schema:, inputType or outputType, or in a named shape one of them names. A module-authoring bug, refused when the kernel registers the kind (ERR_VALUE_SCHEMA_FROM_INVALID).

Texts and translations

Text shown to a person is typed Text (a message, or a message with a context), Message or TextCatalog, and is written in its module's lang:. telo check judges the entry's own modules where each text is written; the kernel refuses the same mistakes as ERR_<code> — when the resource is created, when a call binds or dispatches, or when a controller evaluates a field holding a text (there carried as the cause of ERR_EXECUTION_FAILED) — and so for a dependency's own texts too. See Reading a Text.

Code	What it means and what to do
MESSAGE_SYNTAX_INVALID	A message does not parse: a } in text not written \}, a placeholder not written {$name} or left unclosed, an escape other than \{, \}, \\. In a manifest a malformed plural selection or an empty context is a SCHEMA_VIOLATION instead; this code also covers those faults in data that reaches the message core without a schema. Raised at runtime as ERR_MESSAGE_SYNTAX_INVALID.
MESSAGE_PLURAL_CATEGORY_INVALID	A plural selection names a case its language does not have — few in an en text. A source text is judged against its writer's lang:, a translation against its catalog's lang. Use the categories that language has, or an =N case. Raised at runtime as ERR_MESSAGE_PLURAL_CATEGORY_INVALID.
MESSAGE_SOURCE_LANGUAGE_MISSING	A text selects a plural case and the module that wrote it declares no lang:, so no plural rule can choose a case. Declare lang: on the module's Telo.Application / Telo.Library document. Raised at runtime as ERR_MESSAGE_SOURCE_LANGUAGE_MISSING.
MESSAGE_PLACEHOLDER_UNKNOWN	A catalog's translation reads a placeholder (or selects over a name) its source text does not have, so nothing would ever fill it. Use only the source's placeholders. Raised at runtime as ERR_MESSAGE_PLACEHOLDER_UNKNOWN.
MESSAGE_PLACEHOLDER_VALUE_UNSUPPORTED	A value a text is formatted with is neither a string nor a number, or a plural selection selects over a value that is not a number. Pass the value as a string or a number. Values written as literals are checked before the app runs; values an expression computes are refused when produced, as ERR_MESSAGE_PLACEHOLDER_VALUE_UNSUPPORTED.
MESSAGE_ENTRY_COMPUTED	A catalog is computed: an expression inside one, at its slot, or above it (a list of catalogs computed whole). A catalog is always written, so each translation can be checked and looked up by its source. A bare self.<path> a template body or a base: mapping forwards is not computed. Raised at runtime as ERR_MESSAGE_ENTRY_COMPUTED, for a catalog a template or a base: mapping computed too.
MESSAGE_ENTRY_DUPLICATE	One text and context is translated twice in one language — inside one catalog, or across the catalogs of one catalog set (a kind's x-telo-text-catalog-set). A nested plural source and the plain pattern its other cases lead to are one text, { $n } and {$n} one placeholder, pl and PL one language. Reported at the reference (or the inline catalog) bringing in the later one, naming both. Remove one. A dependency's own duplicate is refused when its resource is created, as ERR_MESSAGE_ENTRY_DUPLICATE.
MESSAGE_TEXT_UNUSED ⚠️	A catalog entry translates a text no module the catalog's module imports shows, directly or through others, so the translation is never used. Correct the text and context to match the source exactly, or import the module whose texts the catalog translates.
MESSAGE_PLACEHOLDER_UNBOUND	A text reads a placeholder nothing fills: the values paired with it lack the name, or its field declares the values whoever shows it formats it with (x-telo-text-values) and the name is not one of them — a Ui node text written with a placeholder and no values, say. Write only the placeholders the message names, or give the text its values (a Ui.BoundText takes { text, values }). A text or values an expression computes are refused when produced, as ERR_MESSAGE_PLACEHOLDER_UNBOUND. See Reading a Text.
TEXT_ARGUMENT_COMPUTED	A function parameter typed Text is given an expression. A text argument is written at the call, so it can be judged and translated; compute the values it is formatted with instead. Refused when the caller is created, as ERR_TEXT_ARGUMENT_COMPUTED.
TEXT_VALUES_FOR_INVALID	A schema's x-telo-text-values-for pairs nothing: its pointer names nothing, names no Text, sits on a node that holds no object, or names a Text another node already pairs. Point it, from the object holding the values, at the one Text they fill. Raised when the resource holding the schema is created, as ERR_TEXT_VALUES_FOR_INVALID.
TEXT_VALUES_INVALID	A kind's x-telo-text-values sits on a node that is no Text / Message, declares a value whose schema is not string, integer or number, or sits on a text a sibling already binds through x-telo-text-values-for — a module-authoring bug. Reported at the kind, and for a dependency's kind at the imports: entry reaching it, since the kernel refuses it at registration (ERR_TEXT_VALUES_INVALID). See Reading a Text.
TEXT_SLOT_ACCESSOR	A kind types a text at or beneath a field it marks x-telo-eval: accessor, directly, through a $ref or inside a named shape. Such a field reaches the controller as a binding, which cannot be judged or handed over as a text. Give the text a field of its own, and name its values by accessor (x-telo-text-values-for). Reported at the kind, and for a dependency's kind at the imports: entry reaching it, since the kernel refuses it at registration (ERR_TEXT_SLOT_ACCESSOR).
TEXT_CATALOG_SET_INVALID	A kind's x-telo-text-catalog-set marks a node that reaches no catalog and no reference slot, or sits inside another marked node. A value other than true is a SCHEMA_VIOLATION. Reported at the kind, and for a dependency's kind at the imports: entry reaching it, since the kernel refuses it at registration (ERR_TEXT_CATALOG_SET_INVALID).
TEXT_CONTEXT_MISPLACED ⚠️	x-telo-text-context is written outside a data schema — in a kind's own schema:, a module's variables: / secrets:, or anywhere else nothing reads it. It is read only on a data schema — a named shape, a status: block, a contract, a function's parameters and result, or a schema written at a use: schema slot. Move it onto the data schema node whose title, description and enum labels it gives a context.

Observed state

Code	What it means and what to do
OBSERVED_STATE_IN_STARTUP_FIELD	resources.<n>.status.* was read in a field that resolves before anything runs. Observed state exists only once the resource has started.
OBSERVED_STATE_NEVER_RUN	The producer of that status can never start — it is in no targets: and named by no step's invoke:.
OBSERVED_STATE_REQUIRED_FORBIDDEN	required: is not allowed inside status: — every declared field is mandatory once running; a sometimes-absent one is declared nullable.

Controllers, logging, artifacts

Code	What it means and what to do
CONTROLLER_INVALID_SELECTOR / CONTROLLER_UNKNOWN_QUALIFIER	A controller PURL's platform selector or qualifier is malformed.
CONTROLLER_DYLIB_ABI_MISSING	A pkg:telo/local/dylib candidate states no abi, or one outside the telo family. A dylib is built against one version of the Rust controller ABI; add abi=telo-<version> (e.g. abi=telo-3), or the Rust kernel downloads it on every host and refuses it only when opening it.
CONTROLLER_NAPI_ABI_FORBIDDEN / LIBRARY_NAPI_ABI_FORBIDDEN	A napi controller candidate or exports.code: entry states an abi. An N-API addon is ABI-stable across runtime releases; remove abi, which would keep it from loading anywhere else.
CONTROLLER_LIBC_OFF_LINUX / LIBRARY_LIBC_OFF_LINUX	A controller candidate or exports.code: entry states libc for an os other than linux, where libc is never determined, so it could never match a host. Remove libc.
NATIVE_*	A module doc's native: block: NATIVE_NODE_ABI_MISSING, NATIVE_NAPI_ABI_FORBIDDEN, NATIVE_LIBC_OFF_LINUX, NATIVE_ENTRY_DUPLICATE, NATIVE_PATH_SHARED, NATIVE_PATH_NESTED, NATIVE_PATH_CLAIMED, NATIVE_PATH_ESCAPES_MODULE, NATIVE_ENTRY_INVALID. Each is described in Native files.
SOURCE_*	A module doc's sources: block: SOURCE_INVALID, SOURCE_URL_PLACEHOLDER_UNKNOWN, SOURCE_URL_INSECURE, SOURCE_ENTRY_INVALID, SOURCE_ENTRY_DUPLICATE, SOURCE_ENTRY_NESTED, SOURCE_ENTRY_UNCLAIMED, SOURCE_ENTRY_UNPINNED, SOURCE_BUILD_UNPINNED, SOURCE_LINK_TARGET_UNRESOLVED, SOURCE_LINK_CYCLE. Each is described in Native files.
CONTROLLER_TOOL_MISSING	Every controllers: candidate of some kind you import needs a program this machine does not have — npm (or whatever TELO_PKG_MANAGER names) for an npm-delivered controller, cargo for a Rust one. A warning, not an error, and reported against the imports: entry that pulled the module in: the machine running telo check is often not the machine that will run the app, so this says nothing about whether the manifest is right. At run time the same absence is reported by the loader, from the spawn's own failure. A kind that also offers a bundled controller is never reported — the kernel takes that candidate and needs nothing.
BROWSER_ENTRY_INVALID	An exports.browser: entry on a module doc is malformed: not an object, an unknown key, no specifier or path, a list field that is not a list of strings, an abi not of the form <family>-<version>, a specifier declared twice, a path or source that is absolute or points above the module root, format / os / arch / libc stated (a browser entry is one ES module for every platform), or — in a module with no layers: index, a source checkout — no source to build it from. See Browser entries.
BROWSER_ENTRY_UNKNOWN	A field its kind marks x-telo-browser-export names an export of a browser entry, and the sibling field holding the entry's specifier names one the module declaring the resource does not list under exports.browser. Reported at the specifier; the message lists the declared ones. An entry another module ships under that name does not count.
BROWSER_EXPORT_UNKNOWN	The browser entry is declared, and the named export is not in its exports list. Reported at the export's field; add the name to the entry's exports, or name one it lists.
INVALID_LAYER_INDEX	The published layers: index is malformed.
INVALID_REDACTION_PATH	A logging.redact.paths entry does not parse. Bad paths are caught here rather than silently failing to redact at runtime.
LOG_SINK_ON_FULL_UNSUPPORTED	The sink does not support the requested on_full: policy.
SINK_UNATTACHED	A warning: a resource whose kind is a sink (capability Telo.Sink) that nothing references and its module does not export. The runtime attaches only the sinks the root Application lists in logging.sinks / tracing.sinks, so this one receives nothing. List it (- !ref <name>), or remove it.

Releasing modules (telo release)

These come from the release planner rather than from telo check. See Releasing modules.

Code	What it means and what to do
CHANGELOG_ENTRY_REQUESTED ⚠️	A module's own files changed but no fragment under .changes/pending/ names it, so its changelog will not mention this release. telo release add --module <path> --kind <Kind> --body "…".
FRAGMENT_UNKNOWN_MODULE	A fragment names a module key that is not in the workspace (release.modules in telo-workspace.yaml).
MAJOR_BUMP_REJECTED	A fragment declares a Changed / Removed kind, which induces a major bump. The repo is deliberately pre-1.0 and ships breaking changes as minors — use Added or Fixed.
LEDGER_VERSION_MISMATCH	A module's metadata.version disagrees with what .changes/ledger.yaml records as published. Reconcile with telo release verify.
LEDGER_REGISTRY_MISMATCH	A module's ledger digests were taken against a different registry base than this run built against, so nothing can be compared. Per module, because a workspace may publish its subtrees to different bases.
NO_DESTINATION_KNOWN	A module has never published, its release.modules entry declares no registry: and neither does the block. Declare one, pass --registry, or set TELO_OCI_REGISTRY.
DESTINATION_COLLISION	Two modules resolve to one ref, because a ref is the registry base plus the module's own directory name. Rename a directory, or give one subtree its own registry:.
IMPORT_DESTINATION_CONFLICT	A relative import between two workspace modules does not agree about where the target publishes. Publishing rewrites the import to the ref the importer's own path yields, so the artifact would name a module nobody pushes. Use a pinned remote import across a publish boundary.

The workspace marker (telo-workspace.yaml)

Reported by telo release, and by the editor as you type. See Workspaces.

Code	What it means and what to do
WORKSPACE_MODULES_MOVED	modules: is at the top level. It is release scope — indent it under release:.
WORKSPACE_UNKNOWN_KEY	A key nothing reads. A near-miss of a known one is an error, since its settings would go silently unapplied; an unrecognized top-level block is a warning, so a marker written for a newer telo still runs.
WORKSPACE_INVALID_VALUE	A wrong type, an entry that is neither a string nor a mapping carrying its key (path: for release.modules, name: for env.files), an env.files entry that is a path or a glob, or an empty release.modules.
WORKSPACE_ENTRY_MATCHES_NOTHING ⚠️	A release.modules pattern under which no directory holds a telo.yaml, or an env.roots pattern matching no directory — usually a typo in a subtree name.
WORKSPACE_ENTRY_SHADOWED ⚠️	Every module an entry matches is also matched by a later one, so last-match-wins leaves this entry's settings applying to nothing.
WORKSPACE_MARKER_SHADOWED ⚠️	Another marker sits above this one, so everything beneath it takes a different cache root, different module keys and a different release scope.

⚠️ = warning, ℹ️ = information; everything else is an error.

Runtime errors

Load and validation

Code	What it means and what to do
ERR_MANIFEST_VALIDATION_FAILED	A declared variables: / secrets: / ports: entry was given by neither the command line nor the environment and has no default, or its value failed coercion — or the command line holds an argument the application does not declare. All failures are aggregated before any controller initializes. A value that is not a Telo.Url where one is declared — a variable's, or a need field's environment variable — is an entry carrying ERR_URL_INVALID, naming the variable and the reason (the schemes the slot admits included), never the value.
ERR_KIND_PREFIX_RESERVED	A module named Telo or Self, an import aliased either, or an import reaching a library named either. The runtime half of KIND_PREFIX_RESERVED, raised by both kernels; for an import the Node kernel carries the static diagnostic.
ERR_INVALID_IMPORT_SOURCE / ERR_IMPORT_UNRESOLVED / ERR_INVALID_IMPORT_TARGET	The runtime halves of INVALID_IMPORT_SOURCE / IMPORT_UNRESOLVED / INVALID_IMPORT_TARGET, raised at load, before anything initializes, by the Node kernel carrying every failed import's static diagnostic — so telo run points at the imports: line telo check names. A loader error that carries a code of its own (a transport's refusal) keeps it. The Rust kernel raises ERR_INVALID_IMPORT_TARGET for an import of the built-in vocabulary archive.
ERR_RUNTIME_INVALID	An import's runtime: is neither a string nor an array of strings.
ERR_CIRCULAR_DEPENDENCY	A resource graph — the application's, or an imported library's — contains a cycle, a function calling itself included. The static form is DEPENDENCY_CYCLE.
ERR_CAPABILITY_UNKNOWN / ERR_CAPABILITY_NOT_DECLARABLE	A Telo.Definition / Telo.Abstract is refused at registration, before its schema is checked: its capability: names no lifecycle role, or a roster entry no author may declare. The runtime halves of CAPABILITY_UNKNOWN / CAPABILITY_NOT_DECLARABLE, worded identically by both kernels; the Rust kernel, which applies no migration, raises ERR_CAPABILITY_UNKNOWN for the legacy capability: <Alias>.<Kind> too.
ERR_CALLABLE_DEFINITION_INVALID	A callable kind, a function resource, or a kind holding a function through an untyped slot is refused at registration. The message lists each clause as <CODE> at <path>: <message>; the static forms are CALLABLE_DEFINITION_INVALID, X_TELO_REF_CALLABLE_UNTYPED, FUNCTION_OPTIONAL_NOT_TRAILING, FUNCTION_TYPE_NAME_FORM and CONTRACT_TYPE_NOT_FOUND.
ERR_VALUE_SCHEMA_FROM_INVALID	A kind — a dependency's included — declares an x-telo-value-schema-from its schema cannot hold, in its schema:, inputType, outputType or a named shape they name; the kernel refuses it when it registers the kind. The static form is VALUE_SCHEMA_FROM_INVALID.
ERR_UNSUPPORTED_MANIFEST_FEATURE	Rust kernel: the manifest uses something this kernel does not host yet — needs:, an import's needs:, a Telo.NeedType, a kind whose schema or parameters reach the Text fragment, or a kind marking a catalog set. Run it on the Node kernel.
ERR_INVALID_EXPORT / ERR_INVALID_REEXPORT	A library's exports.resources entry is malformed, or re-exports through an alias it never imported.
ERR_RUNTIME_EVAL_WITHOUT_INVOKE	A kind declares x-telo-eval: runtime but its resources have no invoke(). Runtime evaluation expands a call's inputs, and run() / provide() take none, so nothing would ever expand the field. Use x-telo-eval: compile for a value resolved once at creation, or give the kind an invocable controller.
ERR_RESOURCE_SCHEMA_VALIDATION_FAILED	A resource's config does not match its kind's schema at creation — a Telo.Definition / Telo.Abstract included, which is held to the same built-in schema telo check applies, so an undeclared key (controllrs:) is refused by both. Normally caught earlier by telo check as SCHEMA_VIOLATION; at runtime it means the kernel was run without a check, or a value only known at creation (an embedded file, a CEL result) is the wrong shape. Also raised when an import initializes and a variables: / secrets: value — or the library default: standing in for one — does not satisfy the entry the library declares, naming the import, the variable and the failed keyword, never the value.
ERR_SHARED_LIBRARY_CONFLICT / ERR_SHARED_LIBRARY_OVERRIDE	The runtime half of SHARED_LIBRARY_CONFLICT / SHARED_LIBRARY_OVERRIDE, authoritative because it holds resolved values: two imports of a lifecycle: shared library disagree, or one carries a per-import override.
ERR_NEED_UNMET	A required need reaches the root with nothing supplying it and none of its environment variables set. Raised at load, before any resource initializes, naming the need path (the need's name beneath each importer's alias — a lifecycle: shared library's needs sit beneath its own name), its type, the module that declares it and every environment variable to set. Set them, supply it at the import that reaches it, or mark it optional: true. See Providing needs.
ERR_NEED_UNMET (observed)	A consumer's observation through ctx.verifyNeed does not satisfy the outermost need of the whole-forward chain — a version outside its range, a feature missing. Raised to the consumer's entry point, naming the need path, its type, where its value came from (the environment variable, or the supplying declaration) and the required against the actual; data holds need, type, source (env / declaration / host), required and actual. Point the need at a fulfilment that meets it, or widen the range.
ERR_NEED_OBSERVATION_INVALID	A consumer at an observing slot reported nothing by the end of its startup (when init() returns for a provider, run() for a service, the first run() / invoke() otherwise), reported at a slot that does not observe, left an observed constraint out or reported one it does not observe, or reported a version that is not semver. Names the kind and the slot — a defect in the consuming kind's controller.
ERR_NEED_PARTIALLY_SUPPLIED	Some of a need's environment variables are set and a required one is not. Raised at load, naming the variables set and the required ones missing — never a value. Set every required one, or none.
ERR_NEED_HOST_VALUE_INVALID	A host value the kernel derives addresses from does not read: TELO_HOST_PUBLIC_URL_TEMPLATE / TELO_HOST_PUBLIC_URL_SECONDARY_TEMPLATE is not an http / https origin with nothing after the host or port, holds a placeholder other than {port} / {label}, the main template holds {label}, or the secondary holds none; or a need's derived first label is over 63 octets or starts or ends with -. Names the variable (and the need), never its value. Fix the host's value, rename the need, or set the need's own variable. See Providing needs.
ERR_NEED_PUBLIC_URL_COLLISION	Two public address needs no host could route apart: on one port, two URLs with the same host or two patterns with the same literal suffix in the same form; on two ports, the same host or pattern on the same effective port. Raised at load, naming both needs, their ports and the host. Give one of them another host.
ERR_NEED_TYPE_UNRESOLVED / ERR_NEED_PARAMETERS_INVALID / ERR_NEED_FIELD_UNDECLARED / ERR_NEED_SLOT_MISMATCH / ERR_NEED_UNDECLARED / ERR_NEED_FORWARD_INCOMPATIBLE / ERR_NEED_ENV_NAME_COLLISION / ERR_NEED_ROOT_SUPPLY_REQUIRED / ERR_LIBRARY_ENV_KEY_REJECTED / ERR_RESOURCE_INPUT_NEED_TYPE / ERR_REFERENCE_KIND_MISMATCH / ERR_SENSITIVE_ANNOTATION_INVALID	The load-time twins of the need diagnostics, raised for every module the application reaches, in one error with every other error the analysis found.
ERR_UNTAGGED_INTERPOLATION	A plain string holding ${{ reached the compiler — read without migrations, or no hole can be read out of it. The static form is UNTAGGED_INTERPOLATION.
ERR_SCHEMA_PROJECTION_UNRESOLVED	A slot that opted into a declaration-derived shape (x-telo-schema-projection-from) got none; raised when the resource is created. Refused rather than degraded, since a repository kind would otherwise accept arbitrary keys in a SQL identifier position.

Initialization

Code	What it means and what to do
ERR_RESOURCE_INITIALIZATION_FAILED	The multi-pass init loop gave up. It reports by root cause, not by count: resources that never ran because a dependency failed are classified as derived and attributed to the entry that actually broke, so the resource in the headline is the one to fix. Failures inside an imported library nest under that import. See Resource lifecycle.
ERR_LOCAL_REF_PENDING / ERR_CROSS_MODULE_REF_PENDING	A deferral, not a failure: this resource never ran because a dependency (local, or in an import) was not ready. It is always attributed to a real root cause.
ERR_DUPLICATE_RESOURCE	Two resources registered under one name.
ERR_INCLUDE_FILE_NOT_FOUND / ERR_INCLUDE_UNREADABLE	An !include-* path is confined and well-formed but names nothing, or names something that is not a readable file. The path is relative to the module root, not to the file the tag was written in. The static form of the first is INCLUDE_FILE_NOT_FOUND, which refuses the load before the resource is created.
ERR_INCLUDE_FILE_TOO_LARGE	The embedded file is over 32 MB. An embed is retained for the life of the resource; read a large payload at runtime with Fs.File instead.
ERR_INCLUDE_PATH_INVALID	Confinement re-checked at runtime, because the kernel does not require that telo check ran.
ERR_MODULE_PATH_NOT_FOUND / ERR_MODULE_PATH_UNREADABLE	A !module-path names nothing inside the module, resolves to a location off this machine, or names something that cannot be read. The static form of the first is MODULE_PATH_NOT_FOUND, which refuses the load before the resource is created.
ERR_MODULE_PATH_INVALID	A !module-path's grammar and confinement re-checked at resource creation (MODULE_PATH_INVALID / MODULE_PATH_ESCAPES_MODULE statically).
ERR_URL_INVALID	A value at a Telo.Url slot is not one once it is known: text an expression produced does not read as a URL, an object of members holding an expression does not build one, or a URL's scheme is not one the slot's scheme argument admits. Raised as itself when the resource is created, or an import's field-by-field need supply or variables: / secrets: (a library default: standing in included) is read, naming the field or the import and variable, and what is wrong — never the value. Elsewhere it is CARRIED rather than raised: as an entry of ERR_INPUT_INVALID / ERR_OUTPUT_INVALID for a call's argument or result (data.issues[]: pointer, code, reason), and as an entry of ERR_MANIFEST_VALIDATION_FAILED for an environment value or a default:. The static form is URL_INVALID.
ERR_HOST_PATH_RELATIVE	A value computed at resource creation for a Telo.HostPath slot is relative. Build it from a host-path source (an Application variable declared Telo.HostPath, or !module-path) with .joinPath(...). The static form is HOST_PATH_RELATIVE.
ERR_REF_REQUIRED / ERR_REF_UNRESOLVED	A required reference slot is empty, or its !ref did not resolve to a live instance — or it names a need's fulfilment, which is read by field (resources.<need>.<field>) and never handed to a controller as an instance.
ERR_REF_SLOT_COMPUTED	An expression sits at, or above, a reference slot and is not a bare self.<path>. Raised at both sites the kernel owns — a template body's self-expansion, and every resource's create(), for a field the kind evaluates at creation, one it marks x-telo-eval: runtime and one a CEL region covers alike — BEFORE evaluating anything, from the same reader as REF_SLOT_COMPUTED. It names the resource (and, for a template child, the owning instance and the entry), the expression's path, the reference-slot pattern it holds, and the repair.
ERR_ACCESSOR_NOT_PLAIN_CHAIN	The runtime half of ACCESSOR_NOT_PLAIN_CHAIN: a field marked x-telo-eval: accessor holds something other than a literal or one plain !cel chain rooted at a declared name. Refused when the resource is created, before anything is evaluated.
ERR_MESSAGE_SYNTAX_INVALID / ERR_MESSAGE_PLURAL_CATEGORY_INVALID / ERR_MESSAGE_SOURCE_LANGUAGE_MISSING / ERR_MESSAGE_PLACEHOLDER_UNKNOWN / ERR_MESSAGE_PLACEHOLDER_UNBOUND / ERR_MESSAGE_PLACEHOLDER_VALUE_UNSUPPORTED / ERR_MESSAGE_ENTRY_COMPUTED / ERR_MESSAGE_ENTRY_DUPLICATE / ERR_TEXT_VALUES_FOR_INVALID / ERR_TEXT_ARGUMENT_COMPUTED	The runtime halves of the text diagnostics, judged in the language of the module that wrote each text: raised when a resource is created — for a dependency's own texts too, which telo check of the application does not judge — and for a text or values an expression computes when it is produced. A text argument is refused when its caller is created, and computed values at a call before the function runs. A text produced by a controller's own per-call evaluation is refused as the cause of ERR_EXECUTION_FAILED.
ERR_TEXT_SLOT_ACCESSOR / ERR_TEXT_VALUES_INVALID / ERR_TEXT_CATALOG_SET_INVALID	A kind — a dependency's included — types a text beneath an accessor field, misplaces x-telo-text-values, or misplaces x-telo-text-catalog-set; the kernel refuses it when it registers the kind. The static forms are TEXT_SLOT_ACCESSOR, TEXT_VALUES_INVALID and TEXT_CATALOG_SET_INVALID.
ERR_SCOPE_RESOURCE_NOT_FOUND	A cross-module !ref Alias.name did not resolve to an instance the library exports. Check exports.resources.
ERR_SCOPE_ENTRY_NOT_INLINE	A scope block entry is a reference rather than an inline declaration.
ERR_SCOPE_SLOT_MISPLACED	A definition — a dependency's included — declares x-telo-scope off a named top-level property; the kernel refuses it when it registers the kind. The runtime twin of SCOPE_SLOT_MISPLACED.
ERR_VISIBILITY_DENIED	A resource referenced boot context it was not granted.
ERR_KERNEL_STATE_INVALID	A kernel operation was called out of order (embedding the kernel directly).
ERR_RESOURCE_IDENTITY_UNBOUND	A controller reached ctx.self or the zone surface before create() returned. Identity is minted at creation; move the access to init() or later.
ERR_BINDING_CYCLE	The runtime half of BINDING_CYCLE: named bindings resolved to a cycle while being evaluated.
ERR_EFFECT_RECOVERY_FAILED	An inverse (what init() / run() returned to undo themselves) refused during teardown. The cascade continued; the failures are aggregated here.
ERR_EFFECT_NO_FRAME / ERR_EFFECT_NO_SCOPE / ERR_EFFECT_SCOPE_CLOSED / ERR_EFFECT_SCOPE_CLOSING	A controller called ctx.effect(...).perform() outside any lifecycle frame, or on a resource already torn down. An effect must be registered while the frame that owns it is open — see Authoring a module.

Dispatch

Code	What it means and what to do
ERR_RESOURCE_NOT_FOUND	Dispatch target does not exist. The message lists what is available — a scoped resource registered into the wrong context is the usual cause.
ERR_RESOURCE_NOT_INVOKABLE / ERR_RESOURCE_NOT_RUNNABLE	The target exists but has no invoke/run. Check the kind's capability against the slot.
ERR_INPUT_INVALID / ERR_OUTPUT_INVALID	The values passed to, or produced by, a call do not satisfy the declared inputType/outputType — or a native function's params / returns, or an HTTP request's text at a slot whose value type's encoding does not read it, or a call's argument or result at a Telo.Url slot that does not build one. A value type's own refusal is carried inside, never raised in place of these: data.issues holds one entry per such value — its pointer, the type's code (ERR_URL_INVALID), its reason, a dotted path and a message — and the text carries the same (/url: ERR_URL_INVALID: not a Telo.Url — …), never the value. Raised as structured errors, so they can be caught — but never declared by a kind, and never re-attempted by a retry policy.
ERR_CONTRACT_UNRESOLVABLE	A declared contract could not be resolved to a schema.
ERR_PREDICATE_NOT_BOOLEAN	A predicate — a step's when, if, elseif[].if or while, or a boot target's when — produced something other than a boolean. data carries site (where the predicate is written) and produced (the type it produced). A predicate is never read by truthiness: compare explicitly (variables.flag == 'true'). Ambient: try: and catches: can name it, no kind declares it, and a retry policy does not re-attempt it. Statically, CEL_TYPE_ERROR at the predicate when its expression is typed.
ERR_SPAN_ATTRIBUTE_INVALID	The runtime half of SPAN_ATTRIBUTE_INVALID / SPAN_ATTRIBUTE_MISPLACED: a contract whose reached x-telo-span-attribute marks break a rule is refused when it is first dispatched, naming each problem. telo check reports the same problems, but only for the entry's own modules, so a dependency's contract is reported here.
ERR_INTERPOLATION_HOLE_NOT_CONVERTIBLE	An !interpolate hole evaluated to null, a list or a map, which CEL's string() cannot turn into text. The message names the hole and the type found. Declare outputType on the resource producing the value so telo check sees its type, or guard it inside the hole.
ERR_INVOKE_CANCELLED	The invoke was cancelled — a shutdown signal, a disconnected client, or an elapsed deadline.
ERR_EXECUTION_FAILED	A dispatch failed; the underlying error is attached as its cause.
ERR_INVALID_VALUE	A resource reference string is not <Kind>.<Name>.
ERR_TYPE_NOT_FOUND / ERR_TYPE_VALIDATION_FAILED	A named type is not in the registry, or its rule evaluation threw.
ERR_NETWORK_UNREACHABLE	An outbound fetch could not reach its host.
ERR_FATAL	Unrecoverable — re-thrown immediately rather than retried by the init loop.
ERR_STEP_TIMEOUT	A step's timeout: elapsed before its target returned.
ERR_STEP_NAME_REQUIRED	A step reached a durable journal with no name:. The shared step schema requires one, so a manifest cannot trigger this; only code assembling steps programmatically can.
ERR_ZONE_REQUIRED	A resource that must be reached through another's body (a statement outside its transaction) was dispatched with no such zone on the ambient context. The message names the required zone and, where correlated, the instance it must be on. The static form is ZONE_REQUIREMENT_UNSATISFIED.
ERR_ZONE_ANNOTATION_MISSING / ERR_ZONE_UNRESOLVED	A controller opened or required a zone its schema does not declare, or the annotation's kind could not be resolved — the controller and its schema disagree, a module-authoring bug.
ERR_CAUSE_CYCLE / ERR_CAUSE_CHAIN_TRUNCATED	Not errors you can raise: markers the log encoder writes into a serialized error whose cause chain refers to itself, or exceeds the depth limit.
ERR_PLAIN_JSON_UNWRITABLE	A value cannot be written as plain JSON for a reader outside Telo (an HTTP body, a CLI document): a map two of whose keys share one text (1 and "1"), a map key that is no CEL map key, or a value containing itself.

Functions

Code	What it means and what to do
ERR_FUNCTION_UNRESOLVED / ERR_FUNCTION_NOT_EXPORTED / ERR_FUNCTION_NOT_CALLABLE	A module call a resource makes does not bind — raised when that resource is created, before any of its expressions evaluate, including a call in a branch that never runs. The static forms are FUNCTION_UNRESOLVED, FUNCTION_NOT_EXPORTED and FUNCTION_NOT_CALLABLE.
ERR_FUNCTION_ARITY_MISMATCH	A call passed a number of arguments the function's parameter list does not accept. A structured error a try: can catch; outside the ambient union.
ERR_CALLABLE_REFERENCE_NOT_DATA	A native function's data slot names a resource whose configuration is not frozen data once that resource is created — an expression still to evaluate, a scope, a need's fulfilment, an unresolved reference, a cycle — so the function is not created. Raised when the function is created, or when a template creates it as an entry of its body. The static form is CALLABLE_REFERENCE_NOT_DATA.
ERR_FUNCTION_CONFIG_INVALID	A Rust function's resource configuration, already accepted by its kind's schema, does not deserialize into the function's Config type, so the instance is not created. The kind's schema and the Rust type disagree; the message carries serde's reason.
ERR_FUNCTION_FAILED	A function failed while its expression evaluated. data carries function (the call as written), message and the thrown code when there was one — ERR_CONTROLLER_PANIC for a Rust function that panicked. Ambient: try: and catches: catch it and no kind declares it; a retry policy does not re-attempt it, since re-evaluating a synchronous call with the same arguments does not recover.
ERR_FUNCTION_ASYNC	A native function's call returned a promise. A function is evaluated inside a CEL expression, which cannot wait: make call synchronous and do asynchronous setup in create. A call declared async is refused when the instance is created, as ERR_CONTROLLER_INVALID.

Durable execution

Code	What it means and what to do
ERR_DURABLE_SUSPENDED	A signal, not a failure. A durable body parked (Durable.Sleep, Durable.Await, a long retry backoff) and unwinds to the workflow that owns the run. It passes through try: / catches: / retry untouched; if you see it as a caught error, something in the path swallowed it.
ERR_DURABLE_SUSPENSION_SWALLOWED	A body parked but the signal never reached the workflow — a script's catch, a custom composer. The run cannot be resumed correctly. Let the signal propagate.
ERR_DURABLE_SUSPEND_FORBIDDEN	A wait was reached inside a region that promises nothing inside it waits (noSuspend) — the runtime half of ZONE_ATTRIBUTE_VIOLATED, for paths the static check could not trace.
ERR_DURABLE_UNJOURNALABLE_VALUE	A value a durable run records — a step's result, a decision, a delivered payload, a scheduled run's inputs, the run's result — is outside the CEL value domain: a live stream, a class instance (including one offering toJSON, which would come back as a plain object), or a function. data.path names where it was recorded and data.valuePath the offending node inside it. Collect what you need into plain values inside the step. Static form, for streams only: DURABLE_UNJOURNALABLE_RESULT.
ERR_DURABLE_ENTRY_UNDECODABLE	A recorded value was written by a codec version this runtime does not read (data.version, beside data.reads). It is refused rather than read for the parts that look familiar. Continue the run on a runtime new enough to read its journal.
ERR_DURABLE_JOURNAL_CORRUPT	A recorded value declares the current codec version but is not a frame that codec reads — its text is not a string, or its frame does not decode (the decode failure is the cause). data.run and data.path name the record. Something outside the journal rewrote it.
ERR_DURABLE_TARGET_UNENCODABLE / ERR_DURABLE_TARGET_UNDECODABLE	A step target could not be written into, or read back from, the journal's wire form — a with:-scoped target whose scope cannot be identified, or a record from an incompatible version.
ERR_TYPED_FRAME_UNENCODABLE	A value handed to a typed frame — the form a journal entry and a native function's arguments and result cross in — is outside the CEL value domain: a class instance (including one offering toJSON), a function, undefined, a map with a key CEL cannot hold or two keys CEL reads as one, a list carrying a property beside its items, or a cycle. data.path is the JSON Pointer of the offending node.
ERR_TYPED_FRAME_UNDECODABLE	A typed frame is not valid JSON, names a tag outside the closed vocabulary, carries a payload not in its canonical form, a map key CEL cannot hold, a repeated key, or text that is not Unicode. data.path is the JSON Pointer inside the frame. A journal reports it for a corrupted entry.

Observed state

Code	What it means and what to do
ERR_OBSERVED_STATE_BEFORE_START	ctx.setStatus() was called before the resource started. init() performs no I/O, so nothing is observed there.
ERR_OBSERVED_STATE_UNDECLARED	The kind declares no status: block.
ERR_OBSERVED_STATE_INVALID	The reported value does not match the declared status: schema.
ERR_OBSERVED_STATE_KEY_COLLISION	A kind that declares status: also returned a flat status field.
ERR_OBSERVED_STATE_UNAVAILABLE	A read of status.<field> that cannot be answered — not started, still running, or run without reporting that field. The message says which.

Controllers and artifacts

Code	What it means and what to do
ERR_CONTROLLER_NOT_FOUND	No controller candidate could be loaded for the kind, on this host.
ERR_CONTROLLER_NOT_LOADED	A kind resolved but its controller was never registered.
ERR_CONTROLLER_INVALID	The controller bundle loaded but has no such export — a module packaging bug. For a callable kind the message names the function (Function '<kind>/<name>': …): its controller has no create, or create returned an instance with no synchronous call(args).
ERR_CONTROLLER_BUILD_FAILED	Building a controller from source failed (the build's own error follows).
ERR_MODULE_LAYER_INTEGRITY	A layer's contents do not hash to the digest the pinned manifest records. Treat as tampering or corruption; see Security.
ERR_MODULE_LAYER_INVALID / ERR_MODULE_FILES_UNAVAILABLE	A layer contains an illegal entry, or a module-relative file — a ctx.resolveModuleFile or ctx.resolveControllerFile path or an !include-* embed — could not be handed over: the module was fetched from a registry with no layer index (usually published before layered artifacts — republish it), or, in a source checkout, a module file (one an assets: pattern selects, or a notice) a sources: entry stages at or beneath the path is unpinned or could not be staged — the message says whether its archive could not be fetched, does not hold the pinned file, or staging failed otherwise (a lock, a write), and names the URL — or the module's sources: block does not read. Run telo release stage --pin for an unpinned entry and telo check for an unreadable block.
ERR_NATIVE_FILE_UNAVAILABLE	ctx.resolveNativeFile(name) found no file: the module declares no native file of that name, no entry matches this host (the message names the host tuple and every tuple shipped), the artifact ships no native layer for the matching entry, or — in a source checkout — the staged file is unpinned or could not be staged, the module's sources: block does not read, or a checked-in link leads outside the module. Run telo release stage --pin for an unpinned entry and telo check for an unreadable block; otherwise the module needs a release for this host. See Native files.
ERR_BROWSER_ENTRY_UNKNOWN / ERR_BROWSER_EXPORT_UNKNOWN	The runtime halves of BROWSER_ENTRY_UNKNOWN / BROWSER_EXPORT_UNKNOWN, raised when a resource naming a browser entry's export is created. ERR_BROWSER_ENTRY_UNKNOWN is also what ctx.resolveBrowserEntry / ctx.resolveControllerBrowserEntry reject with for a specifier the module they resolve against does not declare.
ERR_BROWSER_BUILD_FAILED	A browser entry could not be built from its source: the build's own error follows, or a declared exports name is one the built entry does not export, the entries built together do not share a .js / .mjs extension, the entry names no source and no built file is on disk, esbuild is not installed, or the kernel has no cache directory to build into. There is no prebuilt file to fall back to.
ERR_BROWSER_ENTRY_UNAVAILABLE	A declared browser entry cannot be served: the published artifact ships no browser layer for it, the module was fetched with no layer index, or the list of files the entry loads (<path>.siblings.json, written by its build) is missing, is not { "files": [ { "path": … } ] }, or names a path that is absolute, leaves the directory it is in or is not a regular file there. Nothing of the entry is served; republish the module. See Browser entries.
ERR_STAGED_FILE_INVALID	A prebuilt controller candidate in a source checkout — a pkg:telo/local/napi addon on the Node kernel, a pkg:telo/local/dylib library on the Rust kernel — is staged by a sources: entry, but the entry carries no pin, its archive does not hold the pinned file (the member is absent, or its bytes or execute bit differ from the pin), or the module's sources: block does not read. Run telo release stage --pin or telo check; the candidate is not skipped in favour of the next one. An archive that could not be fetched is not this error: that candidate falls through.
ERR_STAGING_FAILED	Staging a prebuilt controller candidate's file in a source checkout failed for a reason that is neither the network nor the pin: the per-archive lock under the module's .telo/staging/ could not be taken (another process held it past the wait limit), the file could not be written, or its path runs through a symbolic link on disk. The message carries the cause; the candidate is not skipped in favour of the next one.
ERR_MODULE_LAYER_FETCH_FAILED	Rust kernel: a layer blob could not be pulled from the registry, or is not a readable tar.gz. The message names the ref and blob; check the registry is reachable and the module was published completely.
ERR_MODULE_LAYER_EXTRACT_FAILED	Rust kernel: a verified layer could not be written into the module's cache directory (permissions, disk, a path already occupied by a directory). The message names the entry; fix the directory, or remove it and run again.
ERR_DIRECTORY_LOCK_FAILED	Rust kernel: the cache directory lock (<dir>/.lock, shared with the Node kernel) could not be created, reclaimed or waited for. The message names the lock file; remove it if no other Telo process is running.
ERR_LOG_SINK_ON_FULL_UNSUPPORTED	The runtime half of LOG_SINK_ON_FULL_UNSUPPORTED: a sink was configured with an on_full: policy it cannot honour (block on a sink that cannot block). Use drop_new or drop_old.
ERR_SINK_CONTRACT_MISSING	An entry of logging.sinks / tracing.sinks (named in the message, e.g. logging.sinks[0]) lists an instance that does not expose the sink contract — sinkId, write, flush, flushSync, close. A listed sink must be a kind with capability Telo.Sink whose instance is the sink itself.

Shutdown

Code	What it means and what to do
ERR_TEARDOWN_FAILED	One or more resources threw during teardown. The cascade still completed — failures are aggregated, not fatal to the rest.

See also

• Catching errors before they run — the workflow, the debugging flags, and what static analysis can and cannot find.
• Running in production — exit codes and signal handling.
• Resource lifecycle — init ordering and failure classification.
• Style guide — naming rules that prevent a whole class of these.