Refusals
Every way this system says no, what it means, and what to do about it. A refusal that a reader cannot interpret is an outage as far as they are concerned, so each one below is stated in the words the system actually uses.
The contracts
These are reverts: the transaction is rolled back and nothing is recorded. A revert is a decision, and retrying it buys the same decision at the price of gas.
| Error | Raised when | What to do |
|---|---|---|
| BadSignature | The recovered signer is not the owner the payload names | Re-sign with the owner key. A relayer cannot alter a payload without causing this |
| NonceUsed | That owner nonce has already been spent | Read the next nonce and sign again. Registry and venue nonces are separate spaces |
| Expired | The deadline on the signature has passed | Sign again with a fresh deadline |
| AlreadyRegistered | A mandate with that digest exists | Nothing — the instrument is already in force |
| NotNarrower(field) | A child mandate widens the named bound of its parent | Narrow the field. A child may only restrict, and windowSeconds must be equal |
| TooDeep | The delegation chain is longer than the guard will walk | Delegate from a shallower parent |
| UnknownMandate | No mandate with that digest is registered here | Check the chain id and registry: a digest binds both |
| NotAuthoriser | The sender is not an authoriser the owner named | Clause 4.2. The owner appoints by signature; no agent can become one |
| NotHeld | That action is not in a held state | A hold resolves once. Re-resolving is refused rather than recorded twice |
| RationaleRequired | A release carries no rationale hash | Record a reason. A decision without one is not a decision |
| VenueCallFailed | The target reverted, or returned nothing | The whole action rolls back: transfer, approval and window together |
| Slippage(got, wanted) | Less came back than the agent's own floor | The agent set minAmountOut; the mandate does not bound price |
| BadClass | A venue classification outside 0, 1, 2 | Unknown, primary or secondary |
A held action is not in this table. It does not revert — it returns, records
IntentRecorded and ActionHeld, and leaves the window untouched. A
revert would roll back the events, and a hold that leaves no trace is not supervision.
The relayer
Refused before anything is spent, and written down rather than merely returned. All are HTTP 400 with a sentence.
| Message | Meaning |
|---|---|
| that mandate was not signed by the owner it names | Recovery disagrees with the payload. The relayer will not pay to be told the same by the contract |
| only the owner names an authoriser | An appointment signed by anyone else |
| this relayer forwards approvals to the guard and to nothing else | A permit naming a different spender. The relayer is not a general-purpose signer |
| a mandate whose tokenIn equals its tokenOut would strand funds | Refused here because the contract accepts it and the funds would be stuck |
| that action is not held | A resolution for an action with nothing to resolve |
| recording a reason is not optional | A resolution with no rationale |
| this address already has a funded agent | One session per visitor. The service is not a faucet |
| the relayer is at its hourly ceiling across all visitors | A global cap, not a personal one. Try again shortly |
| the relayer is below its reserve and is not forwarding | It stops rather than stranding somebody halfway through a first mandate |
The console API
| Status | Says | Meaning |
|---|---|---|
| 400 | mandate must be a 32-byte hex hash | Malformed query |
| 404 | no indexed incident | The chain has actions the indexer has not swept yet, or there are none |
| 404 | no assembled case | The hold exists; no case file has been drafted for it |
| 409 | no HoldResolved for action N in that transaction | A decision the chain does not show. The server files nothing it cannot see |
| 409 | the rationale does not hash to what was signed on chain | The text was changed after signing |
| 503 | no preview chain is running here | The simulated chain is down. Every other route is unaffected |
The preview
Bounds are refused before any chain work, because an unauthenticated endpoint's only protection is what it will not accept: at most 24 actions, a notional and an aggregate within modelled range, a window between 60 and 86,400 seconds, venues that are primary or secondary, and no per-action cap above the aggregate cap — that last one cannot bind, so modelling it would be a quiet lie about which clause did the work.
The supervisory crew
The crew needs a model credential; the arithmetic, the striking gate and every figure on the pages around it do not. When a deployment has no credential, case assembly says so plainly and nothing else on the page is affected — a claim that cannot cite a resolvable record is struck before it renders, whether or not a model was available.