The layers every command reads through

Failure catalogues

Most commands meet the same few layers, and each declares its own causes once, raised by the one conversion every command's failure passes through, whichever command met it:

functionality	what it is	its causes
stado.store	the object store, whatever its backend	conflict, missing, path-escape, unauthorized, refused, rate-limited, down, timeout, held, document-malformed, configuration, protocol, local-denied, local-full, local-read-only
stado.vault	Skarbiec, as administrator or under a consumer's grant	url-invalid, consumer-unset, grant-file-unset, grant-file-unreadable, grant-file-exposed, grant-file-empty, unreachable, timeout, held, unauthorized, refused, missing, rate-limited, down, no-role-holder, deployment, identity, stored-envelope, no-item-version
stado.config.read	this machine's configuration file	selected, not-object, invalid, denied, directory, not-text, unreadable
stado.config.change	changing that file: read as it is now, validated, replaced whole (stado config set/unset/migrate, stado database, stado web plane)	no-file, rejected
stado.files	a file operation on this machine, named with what was done to which path	missing, denied, directory, not-directory, exists, full, read-only, not-text, link-loop, os-error
stado.registry.read	the fleet registry's read, by every command that reads it	registry-missing, registry-unreachable, registry-authority-refused, registry-timeout, registry-auth-refused, registry-invalid, registry-store-failed
stado.registry.write	the fleet registry's write, by every command that changes it	registry-moved, registry-write-refused, registry-write-unreachable, registry-write-timeout, registry-write-auth-refused, registry-write-failed, write-not-a-registry, write-deletes-keys, write-generation-backwards, write-generation-unchanged, write-empties-fleet, write-invalid, write-unit-rename, write-unconfirmed, write-directory-unadvanced, write-conflict
stado.services.resolve	where a service is reached from here	declaration, unknown-service, consumer-not-admitted, moving
stado.leases	leases of provider resources	conflict, value, corrupt
stado.profiles	the declared profiles	missing, invalid
stado.waits.register	the register of waits, its holdings and the measured waits	directory-unset, unlistable, misnamed, unreadable, writer-unknown, unremovable, uncreatable, unwritable, clock-before-epoch, record-malformed, id-invalid
stado.hosts	the host a command names, resolved in the canonical registry by name, hostname or SSH host	host-unregistered, host-not-local, host-no-destination, host-ambiguous
stado.clock	this host's clock, for every expiry, lifetime and signature date	clock-before-epoch
stado.machine	the machine API's answers about jobs, their logs and artifacts	not-found, log-reaped, no-artifacts, service-not-in-directory, unauthorized, forbidden, invalid-request, invalid-cursor, invalid-source-archive, idempotency-conflict, not-terminal, artifact-security, provider-disabled, service-endpoint-missing, request-in-progress, auth-unavailable, source-upload-failed, submit-failed, cancel-failed, hold-unavailable, hold-failed, service-directory-stale, internal-retryable, internal
stado.release.control	the registry's release control plane, one product's policy and the host it rolls out to	control-invalid, control-undeclared, target-ambiguous, product-untargeted, target-undeclared
stado.release.remote-file	one file, its head or its tail read from a registry host, and a host's rollout state	read-refused, answer-malformed, not-text, state-damaged
stado.actor	the account and host a durable record says acted (a schedule, a pause, a quarantine release, an adoption)	actor-unread
stado.gate	admitting an operation that compiles or publishes by the operator's rulings, then waiting for this host's swap to fall under host.swap_ceiling_pct	gate-refused, swap-unread
stado.process	an installed program (Oko, git, cargo) run to its end	program-absent, program-unstarted, program-failed
stado.release.loop	the delivery queue stado release newest and stado serve --release-loop-root run: Oko's recorded repairs, the version step, the workspace and the branch watch	executable-unnamed, checkout-unnamed, oko-unread, release-unread-by-oko, repairs-unnamed, version-unplanned, manifest-malformed, product-nonrelease, checkout-moved, checkout-dirty, version-unwritable, nothing-to-watch, watch-failed
stado.cloudflare.api	the Cloudflare API reached with Stado-held credentials, and every answer by its class	field-absent, token-malformed, accounts-differ, token-accounts, stored-id-unpathable, id-unpathable, name-not-dns, hostname-outside-zone, origin-invalid, origin-not-web, answer-unreadable, api-denied, api-missing, api-throttled, api-unavailable, api-refused, result-not-array, answer-field-missing, zone-absent, zone-ambiguous
stado.cloudflare.zone	a zone's records moved into Cloudflare by stado dns delegate, and read back by undelegate	zone-created-empty, nameservers-none, import-stopped-unavailable, import-stopped-refused, zone-not-held
stado.dns.registrar	the registrar credential's fields and one command sent to the registrar's API	credential-ungranted, credential-grant-unreachable, credential-field-missing, client-unbuilt, registrar-unreachable, registrar-denied, registrar-status, answer-unread, answer-not-document, request-refused, command-unanswered
stado.dns.zone	a zone name and a record name read against it	zone-invalid, zone-multi-level, name-unqualified, name-outside-zone, type-unwritable
stado.cloud.azure	the operator's Azure session read from Stado-held credentials, and every Azure Resource Manager answer by its class	role-unread, role-denied, session-field-missing, token-unread, exchange-denied, exchange-unavailable, exchange-refused, exchange-unreadable, arm-unreadable, arm-denied, arm-missing, arm-unavailable, arm-refused, arm-list-shapeless, principal-unnamed
stado.space.reclaim.local	one disk reclaim pass on this machine, or its preview, under the janitor's lock	workloads-uncounted
stado.change.git	git run in a submit queue candidate's checkout, and its answers	git-unrun, git-failed, remote-unnamed, fetch-failed, commit-unnamed, commit-absent, numstat-unread
stado.change.queue	the submit queue's candidates, review rounds and pass locks on this machine	record-unread, record-gone, candidate-unknown, candidate-ambiguous, state-unknown, round-session-invalid
stado.change.policy	a change classified by the submit policy its product's catalog record declares	catalog-unread, repository-unclaimed, policy-undeclared, manifest-mismatched, high-risk-unscoped
stado.credentials.launcher	the credential launcher a host names or carries, run to read a secret	launcher-named-absent, launcher-name-unread, launcher-absent, launcher-failed, launcher-unreadable
stado.market.vast	stado market --provider vast: an offer's terms, the host's isolation, Vast.ai's answers, the kept earnings and payouts, and every readiness verdict that cannot earn	price-disk-missing, contract-hours, host-unfit, vast-key, vast-denied, vast-unavailable, vast-refused, board-unoffered, record-unread, payout-form, serving-unmeasured, outside-price, sources-unreached, ready-vast-refused, ready-item-absent, ready-not-authorized, ready-no-channel, ready-unknown-down, ready-unknown, ready-not-isolated, ready-no-bandwidth
stado.market.peer	stado market --provider stado and stado market peer: lending idle hosts to another Stado fleet	peer-unnamed, vast-terms, peer-states-none, loop-terms, reading-unshaped, no-loop, no-offer, peer-declared, edit-nothing, peer-held, peer-answer, peer-absent, peer-request, peer-credential, peer-unreached, peer-local
stado.market.node	stado market node: a network's own node run on an idle fleet host	node-source-unknown, node-service-undeclared, node-deployment-unserved, node-declared, node-edit-nothing, node-running, node-loop-terms, node-target-undeclared, node-request, node-absent, node-refused
stado.market.handtohuman	stado market --provider handtohuman: GPU-hours or residential egress offered through HandToHuman's own CLI	handtohuman-resource-missing, handtohuman-resource-unsold, handtohuman-vast-terms, handtohuman-price, handtohuman-units, handtohuman-seller-undeclared, handtohuman-program-absent, handtohuman-program-failed, handtohuman-answer-unread, handtohuman-offer-unread, handtohuman-offered, handtohuman-not-offered, handtohuman-states-none
stado.credentials.host-vault	a registry host's own Skarbiec vault over the host channel, read by credentials vault provision and host gates	vault-refused, vault-shapeless, vault-owners, vault-unsealed, recipient-rekeyed
stado.workload.gui	the gui-automation runner: its plan and the host's status	gui-operation-unknown, gui-bundle-invalid, gui-password-undeclared, gui-status-failed
stado.workload.jeden	placing a Jeden or OMP session: the workspace and its origin, the hosts with capacity, the queued job and the session list	component-unsafe, origin-unread, task-missing, secret-unformed, no-host, no-host-fit, registry-stale, directory-unread, runtime-path, ssh-empty, session-signalled, job-none, store-unread
stado.workload.omp	what OMP sessions add: the harness a host is given and the results read back	workspace-home, harness-undeclared, harness-none, context-unread, harness-absent-here, harness-version-here, harness-host-version, builds-undeclared, version-unprefixed, asset-undeclared, http-client, checksums-unread, platform-unpublished, install-failed, install-unverified, results-not-session, registry-unread, results-host-gone, results-unread, results-file-unnamed
stado.workload.weles	the Weles worker workloads: a browser task and its plan, captures, image inspection, the activity read, runtimes and recordings	objective-unread, objective-empty, fills-both, sign-in-half, login-unallowed, sign-in-origin, url-invalid, url-not-web, login-item-invalid, login-action, replay-invalid, params-invalid, run-failed, runtime-unfit, mobile-undeclared, capture-plan, run-id-none, batch-empty, activity-unread, recordings-undeclared, recordings-relative, registry-unpublished, registry-shape, target-undeclared, launchd-unset
stado.resolver.serve	the resolver stado serve runs on this host: its start, its bind, the store it reads and the tasks it serves	startup-unloaded, signal-unheard, bind-invalid, bind-public, bind-taken, bind-changed, store-adapter-changed, lock-poisoned, task-ended, no-tasks
stado.placement.declarations	what every placement command reads the same way: the registry's shape, its placement profiles and transactions, the service catalog, a named profile and the host it is placed on	registry-shape, declarations-unread, catalog-unread, profile-unknown, profile-vanished, member-release-controlled, profile-split, destination-unsupported, unit-unnamed, placed-nowhere, placed-twice
stado.placement.transfer	a placement profile carried from one host to another: the preflight, the loopback health probe, the units asked on each host, the states copied through this machine, the directory's cutover and the commit	stores-uncarried, copy-running, unit-file-missing, state-missing, probe-unfit, probe-unhealthy, host-answer-unread, remote-failed, destination-unstaged, work-root-undeclared, destination-space-short, staging-space-short, home-unchanged, transaction-vanished
stado.placement.vault	a move of the profile carrying the fleet vault: the source's Skarbiec write fence and the source's read of the vault at its new place	answer-unread, fence-unsupported, unit-off-release, image-stale, probe-undeclared, read-at-unit, endpoint-undeclared, unreached
stado.placement.role	a role of the host Stado process moved or taken: its route, the destination's address, the registry authority it may carry and the fence on its store	role-undirected, not-host-role, already-served, route-moved, listen-port-unrecorded, host-process-undeclared, home-unread, last-good-missing, last-good-unread, here-unregistered, authority-elsewhere, authority-uncarried, authority-not-source, authority-unnamed, push-fence-unsupported, destination-store-silent, fence-answer-unread, store-fenced-elsewhere, not-authority, role-source-answers
stado.placement.evacuation	a host emptied as one run: every step checked first, each run as Stado's own command, its schedules repinned and the registry read back	hosts-same, nothing-placed, would-refuse, self-unnamed, step-failed, vault-move-refused, standby-unfinished, authority-silent-serves, authority-silent-check, still-placed, schedules-unread, repin-failed, repin-partial
stado.placement.authority	the registry authority role taken on the host that runs stado placement move --authority, handed over or promoted from its own copy	already-authority, none-named, promoted-invalid, own-path-unread, commit-unread, handover-partial
stado.placement.policy	a host's Weles placement policy built from its registry declaration and installed by stado route placement	weles-undeclared, target-unnamed, actions-refused, staged-path, apply-unreported
stado.host.channel	the host channel every host command rides: the key from the owner key file or the credential store, the first declared SSH path that answers, the process carrying the command here, and the home, account home and file it reads back	held-unread, held-key-unread, key-item-missing, key-store-unreachable, key-file-relative, key-file-not-regular, key-file-exposed, key-file-empty, no-reachable-path, carrier-failed, ssh-failed, home-unstated, account-name, account-home-unstated, file-unread
stado.host.target	the registry target a host verb names (host user delete, host reboot, host gpu power), found among the canonical registry's targets	target-unknown, registry-absent, targets-shape
stado.host.names	a file name a host verb places under the host's home	name-out-of-form
stado.host.stado	the host's own installed Stado at ~/.stado/bin/stado, run with words this client sends	stado-missing, stado-failed
stado.host.configuration	one host's own Stado configuration read or written with its installed Stado, a publisher declaration refused before its item exists	key-out-of-form, publisher-not-json, vault-path-unread, vault-path-empty, publisher-unminted, command-refused, readback-failed, older-show-refused, older-show-not-json, older-show-shape
stado.credentials.custody	a host's own Skarbiec binary, vault file and GnuPG home, found from what the host declares and reports	config-not-json, vault-undeclared, gnupg-unread, gnupg-empty, registry-unread, active-unavailable, active-not-json, active-field-missing, active-identity, active-path
stado.host.report	the report a host answered with, judged by the one status that means it did what the command asked	report-not-ok
stado.host.delivery	one file or one secret delivered owner-only into a host account's home, checked by its checksum on the host before it takes its name	dir-unprepared, copy-unstarted, destination-out-of-form, copy-failed, unverified, uncountable, secret-size, secret-home, secret-uninstalled
stado.host.run.sync	a directory or one file copied between this machine and a host over the Stado SSH route, as placement transfer copies a state	remote-unclean, copy-failed
stado.host.run.area	a run directory made in a host's run area, every directory down to it owner-only and this account's, a tree copied into it, and the run removed again	run-unmade, run-unnamed, removal-unreported, removal-report-malformed
stado.host.run.attached	a delivered program run on a host with this process's input, output and error attached, and the signals this process receives passed on	channel-incomplete, output-lost, signal-undelivered
stado.host.run.build	a kompilator build or a declared quality gate of one committed revision, run on a host with room for it, and the binaries brought back	git-unstarted, git-failed, checkout-unfound, commit-absent, manifest-uncommitted, export-failed, volume-unmeasured, room-short, volume-full, artifact-unnamed, artifact-unread, gate-argv
stado.host.beacon.api	the scoped host-health API a beacon is published through, with the bearer from an owner-only file or from Skarbiec	setting-missing, setting-out-of-form, token-file-unsafe, role-item-missing, role-token-empty
stado.repair.release-state	the repair step that returns a host's drifted binaries to the versions its target declares	target-vanished, version-undeclared
stado.repair.skarbiec	the repair step that recovers a host's Skarbiec and, for a crypto repair, the bound it must stay within	payload-failed, bound-undeclared, bound-unread
stado.repair.link	the repair step that restores a host's link to the object API its beacon publishes through, proved by a fresh beacon	diagnosis-uncoded, diagnosis-unrepaired, authority-undeclared, beacon-stale
stado.repair.object-api	the repair step that recovers a host's object API with the fixed program its own Stado runs	object-api-unrecovered
stado.repair.release-store	the repair step that returns one release-catalog coordinate in a host's stores to its managed account, with the host's own Stado	product-out-of-form, store-unrepaired
stado.repair.agent-skarbiec	the repair step that points a host's agent at the Skarbiec the service directory places for it	broker-undeclared, agent-config-unread
stado.repair.verifier	the repair steps that reconcile the object, release or service verifier grant from the declarations this machine and the host hold alike	local-declaration-invalid, declaration-empty, host-declaration-unread, host-item-missing, declarations-differ
stado.repair.verifier-grant	one verifier's grant on a host: the items playing its declared roles, the shadows of authoritative items, every other read the grant holds kept	environment-unread, file-missing, grant-missing, grant-expiry-unread, grant-expired, vault-answer-unread, role-unplayed, source-absent, source-unmanaged, shadow-unverified, grant-unreconciled, metadata-unavailable
stado.service.managed	how every stado service verb finds what it acts on: the host it is given or a heuristic names, and the managed service the registry declares there; and a verb that ran on several hosts and failed on some	host-unnamed, heuristic-unmatched, unmanaged-there, unmanaged, hosts-failed
stado.service.lifecycle	a managed unit withdrawn by service retire or remove under the mutation lease the autonomy reconciler honours, and its directory routes handed over or withdrawn	lease-held, lease-taken, lease-unreleased, recovery-carried, stop-failed, routes-unread
stado.service.env	one key of a managed unit's environment, named by env show, set and unset, and the value the host holds after a write	key-out-of-form, value-uncounted
stado.service.secret.field	the one Skarbiec field secret sync, bearer sync and auth check deliver or check	field-empty
stado.service.grant.lifetime	the lifetime grant sync and grant mint give a minted grant	ttl-not-positive
stado.service.grant.declared	the grants a service's consumers declare in the service directory, read by grant show and grant mint	service-undeclared, consumer-undeclared, no-grants
stado.host.account.password	the host account password a privileged step reads, through the broker and then this machine's owner vault: every privileged service lifecycle step, retirement and GUI automation	password-unread
stado.release.source	the commit a release or build is made of, read out of its checkout by git, and its committed tree snapshotted as files: release submit, release changes, build	git-failed, git-answer-unread, source-dirty, commit-unnamed, source-not-files
stado.release.provenance	the released-surface baseline and published diff a source snapshot carries, checked against the tags origin serves	baseline-unread, tag-not-served, tag-unresolved, tag-moved, ancestry-unread, tag-commit-absent
stado.release.record	the durable records of builds and release runs, the run index and the immutable objects written once for them	state-raced, record-unread, immutable-differs, run-object-unread, index-unread
stado.release.run	a recorded release run driven through its build, publication, delivery and promotion, by release submit, release resume and the release agent	run-uncontinuable, build-gone, platform-failed, platform-unrecorded
stado.release.jobs	each platform's build job of a release or build: the saved worker request, the queue, the pinned inputs, the builder chosen and how the job ended	request-unread, queue-paused, input-unlike, no-job-returned, job-not-ended, receipt-unread, no-builder, builder-unnamed, secrets-unlisted, secrets-unheld, build-platform-gone, queue-record-unread
stado.release.publication	the signing key a release is published under, the rollback compatibility it declares, and each built platform written to its immutable coordinate	control-undeclared, signing-key-unread, signing-key-absent, signing-key-invalid, key-untrusted, rollback-undeclared, build-job-failed, job-output-unread, receipt-unlike, coordinate-unread, coordinate-foreign
stado.release.placement	where a release delivers, frozen the first time it delivers and read by every later pass and release redeliver, and the deliveries queued there	placement-altered, placement-lost, destinations-invalid, predecessor-unknown, platform-unplaced, destination-unused, delivery-name-ambiguous, delivery-not-queued, delivery-failed
stado.release.promotion	promoting a published release into the registry's desired state and reading where each rollout target stands	policy-gone, desired-other, run-incomplete, service-unplaced, status-unread, target-unreached, target-diverged, receipt-malformed

The layer's own sentence is what the refusal says it observed: a store failure names the object or file and the backend's or the operating system's answer, a registry that does not parse names the store it was read from. A failure no declaration covers yet is said as before, unclassified, and stado errors check keeps naming the functionality that still owes it. stado errors show <functionality> prints every cause with its fix and the test that provokes it.