Integration troubleshooting

Local authorization is busy

Token refresh stops after 15 seconds, preserving stored credentials and staged tokens and releasing the lock. Other credential operations wait up to 30 seconds for a running writer. A timed-out refresh does not prevent logout.

If credential saving fails with a filesystem write or flush error, keep the credential store intact and retry after resolving the filesystem error. Remote setup cannot apply until staging has flushed its file and directory. A failed directory flush may leave staged recovery tokens in the store, so deleting it can prevent recovery. Windows and network filesystem durability remain unqualified for this alpha.

Upgrade the Seamward CLI and setup MCP together. Current versions serialize their shared credential-store writes so refresh cannot overwrite staged setup tokens. Let another running command finish, then retry.

If a Seamward process was interrupted, stop all Seamward processes using the store. Confirm the PID in credentials.json.lock is no longer running before removing only that lock. Keep credentials.json intact; it may contain the only recoverable copy of a token from a completed remote setup. Never remove a live process's lock.

If login succeeds but setup consistently reports unauthorized, contact support to review duplicate consent records. Seamward refuses an ambiguous legacy grant; a refreshed token does not resolve duplicate persisted consents.

Local runtime CLI handoff

If an agent attempts credential saving or runtime execution through MCP, it may receive an unknown-tool error. These actions belong in the CLI, not agent MCP; this is not an authentication failure. Do not retry through native approval or edit environment files in chat. After integration apply, run this in the project root:

seamward setup credentials

After saving, the CLI checks every saved connection. To repeat that read-only check:

seamward setup verify

connection_credentials_rejected means the API rejected the pair or signature; check revocation and your system clock. connection_scope_mismatch means the pair belongs to a different Integration or environment. connection_unavailable means the check could not complete, not that credentials are invalid. connection_check_not_supported means the API deployment lacks this endpoint. Resolve the reported cause and repeat the check. No failed check changes the file.

Additional connection-check references:

Agent status saved_unchecked means the CLI recorded a save but this status call has not inspected the environment file. seamward setup verify checks the current file; an agent receipt alone is not proof of current configuration or startup. The credentials command finds supported .env and .env.local files even when Git ignores them. No file is written until you approve the destination and key names. Keep secrets off screen. Saving needs no startup script. You are responsible for loading the selected file when starting the app. Merely creating a file does not load it.

Cancelling does not write credentials. After a successful save, exit 0 requires all connection checks to pass. If checking fails, the command exits 1 but keeps the saved credentials. Neither outcome verifies startup. Start the app normally with the selected file loaded and check actual observations.

Explicit application diagnostic failures

Only if you specifically request an automated startup test and have reviewed synthetic traffic scripts, use this diagnostic. It is not required for onboarding:

seamward setup verify-app

This alpha requires a supported explicit Node loader and recollects the exact startup script, loopback readiness URL, test-control option and synthetic check mapping each time. Inspect all resolved commands before approval. It does not guess script purpose or carry approval between commands.

An occupied port returns runtime_port_unavailable. Choose a free port and keep the readiness URL, application and subsequent traffic commands aligned; do not stop another service. A failed traffic attempt is not evidence of recovery. Check the reported phase before repeating potentially non-idempotent scenarios.

runtime_credentials_unavailable means a retained local ingest token is missing. Do not delete the Integration or recreate it. Ask the agent to run review_setup selecting the existing Integration. If the retained token is unavailable, review the proposed credentialAction: rotate. Separately approve apply_setup only if replacement is intended, then run seamward setup credentials again. Tokens must not be pasted into agent chat.

local_environment_unsafe includes tracked/unignored files, linked paths, and matching credential files with group/world permissions. Correct these locally with explicit approval, then review again. Backups of changed files are private under ~/.seamward-runtime-backups; inspect privately before restoring because old tokens may be revoked. Never remove a save lock until its PID is confirmed inactive. A cancelled or interrupted workflow never grants future approval.

seamward setup --status returns exit 0 when local setup is current and every required Integration has an active (or not-applicable) contract and an accepted observation. Optional application testing is not required. A connected Integration or a saved file alone is not completion, and observations do not prove ongoing health.

Automatic setup does not complete

If you receive setup_metadata_unsafe, review .seamward paths and its .gitignore. Setup will not replace your existing ignore file. Required rules are private/, runtime-validation.json, **/setup-state.json and **/*.lock, without negation rules. Preserve your other rules. Check staged files separately: ignore rules do not remove already tracked state. Retry review after correcting the metadata configuration.

Review or approval stops

The default setup flow asks for your decision in conversation, not a required native popup. Read the complete proposal, then approve, describe changes, or reject. The agent carries the exact fingerprint and action internally. A stale review requires a fresh proposal; silence never approves it. Explicit native mode remains available for compatible clients, but a failed dialog must not trigger retries.

For generated_file_conflict, preserve your edited file and restore matching ownership metadata, or ask for a different filename for a new binding. The agent can use local.bindingNames for a new named binding. Existing assigned paths are not silently renamed. Manual replacement requires resolving your edits first; --force does not bypass ownership checks.

If source moves cannot be matched, tell the agent which existing boundary the moved code belongs to. It can carry a reviewed local.bindingAssignments mapping. Do not delete integrations to resolve an identity ambiguity.

After an MCP restart, review again. The setup-session receipt records the last phase but does not preserve approval. Saved bindings and remote operations are reconciled; completed work is not treated as permission for new changes.

Status reports localCredentialsStatus separately from localStartupStatus. configured means the previously saved file still matches the reviewed loader and current credentials. It does not prove a fresh process loaded them. Start the application with the reviewed command and rerun healthy traffic before recording a successful local-startup claim. The guided follow-up uses runtime review with credentialMode: "saved", followed by your approval. localStartupStatus: "verified" requires that run's fresh observations and unchanged evidence. stale means re-review the current startup; do not reuse an old success claim. runtime_port_unavailable means choose and review another loopback port without stopping unrelated services. Changed scripts, test-control flags and expired previews always require a fresh decision.

A compatible package upgrade preserves binding identity but invalidates old verification evidence. Request a new setup review; do not delete .seamward state or patch node_modules as a recovery step. An incompatible state remains a reported conflict instead of silently losing ownership or Integration IDs.

Local runtime credentials are missing

CLI login authorizes setup tools; it does not load credentials into a separately started application. Ephemeral validation also does not persist credentials. Use the optional local saving flow, then restart with the reviewed environment-loading script. Verify a healthy response and a fresh observation. A saved file is not proof that the server loaded it.

If saving succeeded but the application fails, check exported environment values and stop the old server before restarting the intended application. Do not delete integrations just to retry local saving. Backups and credential files must stay off screen during recording.

Ask the coding agent to check Seamward setup status. The read-only result reports whether local changes are required, the remote connection is ready, traffic is pending, setup is connected, verified source became stale, or remote state conflicts with the review.

• Authorization is required again: setup could not refresh its short-lived access token because the grant was revoked, your membership changed, or the approved workspace environment no longer exists. Setup exits before changing the project and tells you to run seamward login. Login again, then rerun setup or retry the coding-agent operation.
• The browser did not open during login: use the authorization URL already printed in the terminal. Non-interactive terminals print the URL without launching a browser.
• Login request unavailable: the device request may be expired, already completed, or invalid. An older setup package that does not bind the requested environment can also cause this page. You do not need to sign out of your browser account. Once the compatible alpha release is available, update with npm install --global @seamward/cli@alpha, then start a fresh seamward login and use only its new URL. Keep that terminal running, check the workspace and environment before approving, and wait for terminal confirmation. If a fresh request still fails, report the CLI version and time of the attempt to support, without sharing device codes, authorization URLs, or credentials.
• The browser shows the login success screen: authorization is complete. The waiting login command continues automatically, so return to the terminal and run seamward setup.
• The browser shows a localhost callback address: this is not the current device authorization flow. Update @seamward/cli to the latest alpha, run seamward logout, and start seamward login again. Current login leaves the browser on the hosted Seamward completion screen.
• pnpm reports a stale public-hoist-pattern layout or ERR_PNPM_UNEXPECTED_STORE: the installer recreates the dependency layout from the frozen lockfile and retries once before writing MCP configuration. It does not change your global store configuration. If that repair or retry fails, the command stops without writing the project configuration. Run the repository's normal pnpm install --frozen-lockfile successfully, then rerun the installer.
• Authorization was denied or timed out: no credential is stored and no project change is applied. Run seamward login again when you are ready to approve a fresh request.
• local_changes_required: review the proposed source diff and approve the single local apply. Seamward runs the project's verification scripts and restores its changes when verification fails.
• ready_to_connect: review the exact contract effect and approve the remote connection once. Do not send traffic until that review succeeds.
• waiting_for_traffic: start or deploy the instrumented service with its runtime Connection key and ingest token, then send representative safe traffic.
• stale: a verified implementation file changed. Run the same setup prompt so Seamward can analyze the current source and propose only the stale boundary.
• conflict: local setup state, the selected contract, or the active remote version changed after review. Prepare and review the current state instead of reusing an old approval.

If the repository contains several plausible boundaries or contracts, choose from the plain-language options returned by the agent. Each deployable service and Integration is set up independently. Unsupported source shapes stop with a manual path and leave no partial instrumentation.

Workspace API key errors apply only to the advanced headless and CI workflow. The normal automatic setup uses browser authorization and does not require users to create or copy an API key. See automatic setup for the complete lifecycle.

An integration link shows “Integration not found”

Use Return to integrations to view connections in the current workspace and environment. If the integration belongs to another environment, select that environment and open it from the integration list. A saved link can also stop working after the integration is deleted.

Workspace not found means the workspace is unavailable to your current account. Open your workspace list and choose a workspace you can access.

Composer installation fails

Laravel automatic setup requires PHP 8.3 or later and Laravel 12 or 13. During the approved local apply, Seamward runs Composer non-interactively with exact 0.1.0-alpha.1 versions of both collectors. It verifies both packages in the production section of composer.lock before changing source.

• collector_not_installed: this is returned by an older setup alpha that required a preinstalled package. Update @seamward/cli and rerun seamward setup; the current flow proposes the Composer dependency change for review.
• collector_incompatible: the project explicitly requires or locks a collector version outside the supported setup contract. Seamward does not downgrade or replace it automatically. Review the declared constraints, then either use manual instrumentation or deliberately align both collectors before preparing setup again.
• Unsupported PHP or Laravel version: automatic rewriting stops before any dependency or source write. Upgrade to PHP 8.3 or later and Laravel 12 or 13, or follow the manual Laravel guide.
• Composer reports a minimum-stability error: requiring the Laravel adapter alone does not make its transitive PHP alpha eligible. Require both packages explicitly:

composer require seamward/php-collector:^0.1@alpha seamward/laravel-collector:^0.1@alpha

• The approved install or project verification fails: setup restores composer.json, composer.lock, generated configuration, setup state, and reviewed source files. Confirm those files match the pre-apply state, run the project's normal Composer install or verification command successfully, then prepare a new review.

To verify a manual installation, run composer show --locked 'seamward/*'. Both production packages must resolve to 0.1.0-alpha.1 for this setup alpha.

Integration deletion does not complete

• Delete scope is missing: run seamward login again. Authorizations issued before Integration deletion was added cannot delete.
• The preview expired or became stale: start deletion again and review the current counts. Seamward never executes an outdated approval.
• The exact name is rejected: copy the case-sensitive Integration name from the current preview. Unattended deletion, piped input, --yes, and --force are intentionally unsupported.
• The remote Integration was deleted but source remains: this is expected. Remote deletion does not silently edit source or environment files. Remove obsolete Seamward instrumentation and deployed runtime variables in a separate reviewed change.

For combined setup, a stale or expired proposal requires review_setup again before apply_setup. After a restart or partial remote failure, review and approve the reconciled proposal. Successful local verification alone is not remote completion; a connection alone is not proof of observations. Verified local work and matching Integrations are reused rather than blindly recreated.

For output independent of a coding agent's wording, run seamward setup --status --json. To apply directly, use seamward setup --guided in an interactive Sandbox terminal. Non-interactive apply and --yes are intentionally rejected. Use seamward setup --guided --dry-run --json for a proposal without applying it.

Work from the symptom you see. Start with the collector stats, which return seven counters (enqueued, shipped, rejected, dropped, failedBatches, queueLength, buildErrors) and never log observations or tokens:

• Node.js: seamward.stats()
• Laravel: app(SeamwardManager::class)->stats('connection_name')
• Framework-neutral PHP: $collector->stats()

No observation appears

The integration still shows No observation received yet after test traffic:

1. enqueued is 0: the wrapped path never ran. Confirm the request actually hit the instrumented handler, and that the collector was created in the running backend (not the browser, not a different service).
2. enqueued rose but buildErrors rose too: the observation failed envelope validation and was discarded. The usual causes are an empty routeTemplate, an eventType outside [A-Za-z0-9._:-], or an out-of-range status code passed to record().
3. enqueued rose, shipped stayed 0, failedBatches rose: a retryable delivery failure occurred; confirm the endpoint URL (default https://api.seamward.com/ingest, or your SEAMWARD_INGEST_URL) and network egress.
4. rejected rose: ingest permanently rejected one or more envelopes. Check credentials for 401 or the per-item issues from 207; rejected envelopes leave the queue and are not retried automatically.
5. Everything rose but nothing shows: the values point somewhere unexpected. Copy the Connection key again from the Integration's Collector setup tab, then confirm the ingest token belongs to that same Integration.
6. During a controlled test, flush explicitly. Use await seamward.flush() in Node.js, app(SeamwardManager::class)->flush('connection_name') in Laravel, or $collector->flush() in framework-neutral PHP.

Authentication failures (401)

A 401 {"error":"unauthenticated"} from the ingest endpoint, seen directly or as rising rejected:

• No reason field: a header is missing or malformed, a key fails its format check, or the token was revoked. Recheck all three headers and rotate the token if in doubt.
• "reason":"malformed": the signature header must match t=<seconds>,v1=<64 lowercase hex> exactly.
• "reason":"stale": the timestamp is more than 300 seconds from server time. Sign immediately before sending and check clock synchronization.
• "reason":"mismatch": the digest is wrong. Either the signing secret is not the ingest token the server expects, or the signed string differs from the sent body byte-for-byte (the classic cause is re-serializing JSON after signing).

The collector does not retry a permanently rejected batch. Fix or rotate the credential, then trigger new safe test traffic. Retryable network, 409, intermediary 429, and 5xx failures remain queued for the next automatic or explicit flush.

Rejected envelopes (207)

A 207 response means some items were rejected; each carries an issues array:

• integration is not available: the integration exists but its recorded direction, protocol, or environment disagrees with what you sent. Check the integration's configuration against your envelope.
• Schema messages (one per violation): the envelope failed validation; compare against the observation envelope.

The collector removes the whole processed batch, increments shipped for accepted items and rejected for rejected items, and does not resend either. Fix the invalid observation before triggering new traffic.

Observation shows transport_error with status 0

A status of 0 means the outbound attempt received no HTTP response. It is not an HTTP status code and does not mean that Seamward rejected the envelope. The valid envelope is accepted, persisted, and classified as transport_error so you can distinguish connection failures from provider responses.

1. Check the application error raised by the original fetch call. The collector rethrows it unchanged after recording the attempt.
2. Verify DNS, network policy, TLS, proxy, and provider availability from the application runtime.
3. Confirm routeTemplate identifies the intended operation and attempt reflects the retry that failed.
4. Retry through your application's existing policy. The collector observes that retry; it does not initiate one.

Verification: the next provider response records its real status from 100 through 599. Values from 1 through 99 are invalid and increment buildErrors if passed to record().

Request-side observation has a null payload shape

observeFetch({ payloadLocation: "request" }) can inspect a JSON string in init.body or a cloned Request. Form data, streams, buffers, multipart, protobuf, and other non-JSON bodies are not parsed. The collector still records transport evidence, but the schema fingerprint represents null because no structural JSON value was available.

Provide a local JSON representation when the request contract matters:

const providerFetch = seamward.observeFetch({  routeTemplate: "/v1/documents",  eventType: "document.upload",  payloadLocation: "request",  requestPayload: {    documentId: "shape-only-local-value",    contentType: "application/pdf",  },});

requestPayload stays inside your process; the collector sends only its field names, types, and fingerprint. Do not add headers, secrets, binary content, or unbounded values to operation metadata.

Collector delivery queue health

• queueLength grows and stays high: the collector's in-memory delivery queue cannot reach ingestion, or flushes are too rare for your traffic. Fix delivery first; then tune Node.js flushIntervalMs or the runtime's batch size. Framework-neutral PHP needs an explicit flush() boundary; Laravel flushes on application, command, and queue-job lifecycle events, while long-running loops should flush explicitly.
• dropped rises: the bounded queue (default 1,000) overflowed and the oldest observations were discarded. This protects your process's memory by design. Restore delivery, or raise maxQueueSize if outage tolerance matters more than memory.
• Counters healthy, evidence delayed: Node.js batches for up to five seconds by default. PHP delivery waits for the next explicit or Laravel lifecycle flush. Analysis then runs within seconds of ingestion.

Contract operation does not match

If a version is active but traffic remains in an observed-baseline group, the observation did not match one declared operation. Compare direction and protocol first, then method, normalized route template, event type, payload location, and response status selector.

Exact response status takes precedence over a class such as 2XX, then default. Route templates using {id} and :id normalize to the same stable identity. Concrete paths such as /customers/123 do not represent the same reusable contract operation and should be replaced with a template.

If a new document was only registered, confirm that it is Active, not Draft. Registering a draft never changes analysis. Review Register contracts for the complete lifecycle and CI flow.

Node inspection skips or slow shutdown

If skippedInspections increases, check response content types and body sizes, then inspect pendingInspections for bursts. The collector keeps transport-only evidence for bounded-out bodies when capacity allows; it does not interpret the missing body as a schema change. A saturated inspection queue skips observations. If failedBatches rises during shutdown, the upload deadline may have expired. A final flush is best effort, so preserve the documented shutdown grace period. See resource limits.

Structural analysis paused

The Integration list shows a paused detector badge. Open the Integration detail for the reason, last successful analysis and recovery link. The notice is visible to viewers as well as workspace owners and admins.

A connection can report structuralAnalysis.status: paused_capacity and structural_analysis_capacity_exceeded. The current MVP allows at most 1,000 retained shape groups, 8 MiB of serialized summary rows, including fingerprints and evidence identifiers, and 5,000 structural findings in one pass. A group includes its fingerprint, operation identity and response status. Dynamic object keys, unnormalised routes and many response variants can increase the group count.

Seamward retains the observations and existing findings. It discards the whole new structural result when the finding limit is exceeded. Behavioral detection and expected-outcome reconciliation continue. A lack of new structural findings during a pause is not evidence of compatibility.

Use stable route templates and avoid dynamic keys in payload structures where your provider contract permits it. A new observation triggers another check. The daily retention run also schedules a check when it removes evidence from a paused connection. Successful structural analysis clears the pause and records a resumed notification. The pause produces at most one notification per connection per UTC day. lastSuccessAt records the most recent completed pass.

Unsupported historical structural evidence

Current ingest rejects malformed shape grammar. Older or manually imported records can still contain unsupported shapes. Structural analysis excludes those records and records integration.structural_evidence_invalid in workspace activity after inspecting a bounded set of summaries, without copying their contents or identifiers. Group and byte capacity checks happen first; a pause at that stage does not inspect individual shapes. Missing or null shape metadata remains uninspected evidence. Supported shapes use the documented shape grammar, at most 32 nested levels and 8,192 shape nodes.

lastSuccessAt means comparison completed over supported retained evidence. It does not certify the integrity of an unsupported historical record. Review the source of an invalid-evidence notification before relying on that record; observations and existing findings remain retained under the normal policy.

Behavioral analysis paused

behavioralAnalysis.status: paused_capacity with code behavioral_analysis_capacity_exceeded means the behavioral pass exceeded 1,000 distinct matching identities, 8 MiB of identity metadata, or 5,000 findings. The identity combines operation key, direction, protocol, status, method, route, payload location and event type within the comparison window. Dynamic routes or event names can increase this count. Use stable route templates and event names where the provider contract permits them. New observations, enabled reconciliation checks and retention schedule another pass; a successful pass clears the pause. Structural analysis and expected-outcome reconciliation continue independently. Existing findings and observations remain available. The whole new behavioral result is discarded on overflow, so a pause cannot leave a partial set of findings. The API and MCP expose the last completed pass, reason and capped counts. The console shows behavioral pauses separately from structural pauses and explains which other analysis remains enabled. Pause and resume events are recorded in workspace audit history, with at most one pause event per connection per UTC day.

Next steps

• Errors reference: every error identifier across the product.
• Verify redaction: confirm what your evidence contains while you test.

Connection deletion is refused

connection_work_in_progress means the selected connection still has pending or claimed work, active replay or repair generation, or a queued external delivery. Let that work finish and create a new deletion preview. Deletion does not cancel it. If work is stuck, ask your workspace owner to investigate its status instead of removing its evidence.

connection_references_in_use means another connection references data that would be removed. Have the owner resolve the reference, then preview again. The API refuses to alter another connection's history as a side effect.

deletion_preview_stale means authorization, configuration, shared identity, operational data, or the preserved connection set changed. Changes later restored can still invalidate review. deletion_preview_expired means its ten-minute review window ended. In either case, obtain and review a fresh preview; never resend an old fingerprint with a new confirmation.

confirmation_mismatch requires the exact returned challenge, including its Sandbox or Live suffix. idempotency_conflict requires the exact original request and key for recovery, or a new reviewed operation and new key for separate work. After a lost successful response, read the retained operation status. A completion receipt is historical and never deletes a recreated connection.

Mode connection setup is refused

connection_preview_expired means the ten-minute review ended, including while apply was running. No new connection, copied configuration, credential, or completion receipt is saved when apply is refused. Create and review a fresh preview. Checking status or retrying the old approval cannot extend it.

connection_preview_stale means the source, shared identity, destination, configuration selection, or authorization changed after review. Changes later restored can still invalidate approval. Review the current configuration again.

insufficient_scope means current management authority is missing. Browser setup requires an owner or admin with current membership. API setup and receipt recovery require the original active workspace key with integrations:manage. Ask a workspace owner to restore access, then create a fresh review for new setup. A different key or user cannot recover the original operation.

workspace_unavailable means the workspace is archived or no longer belongs to the authorization's organization. Restore the workspace through its owner, or choose an active workspace. A completed setup receipt remains historical and token-free; access to it still requires current authority.

Use the mode connection setup guide and HTTP setup reference for the exact review, apply, and status steps.

Connection credential change is refused

connection_configuration_changed means the connection revision or current authority changed during the operation. Permission changes later restored still invalidate it. The token change, receipt and audit roll back together. Read current credential status, review that state, and deliberately start a new operation with its revision. Never automatically substitute a new revision into an old request.

insufficient_scope means the original workspace key no longer has current integrations:manage authority, including expiry while a change was running. Ask the workspace owner for appropriate current authorization before starting a new reviewed operation. An archived workspace must be restored before credential management; workspace_unavailable can also mean its organization binding changed.

If a response was lost, retry the identical request with its original key and idempotency value. A successful receipt contains no token. When credentialRecoveryRequired:true, read current status and review a separate rotation if the token was not saved. historical:true records past work and cannot restore a deleted connection or its credential. Other keys cannot read that receipt. After rotation, verify the new credential and send safe test traffic to confirm the application loaded it.

workspace_authorization_changed during first-connection creation means your permissions changed while connecting, even if they were restored. No workflow, connection, credential or completion receipt commits. Refresh the page, review your current workspace access and deliberately start a new creation attempt. Creation receipt reads also require original current authority inside a transaction. Restore an archived workspace before reading its receipt.

Writes return mode_cutover_write_paused

The service is in temporary write maintenance. A 503 response includes Retry-After: 1. Keep the request, its idempotency key and observation IDs; wait at least the header delay and retry with bounded backoff. Generate a fresh ingest signature for each retry. The collector keeps retryable telemetry in its bounded queue while your application continues running. If a write had an unknown result, read the original retained operation status before making another change. See request authentication.

Existing connection copy is refused

Check the source and destination in the configuration copy review. They must belong to the same shared Integration and opposite canonical modes. Reduce selections above the snapshot bound. Resolve matching destination version or event/object definitions before reviewing again.

A stale or expired review cannot authorize a write. Recover status with the original key, then create a new review for current configuration. Preserve the original approval and idempotency key after an unknown outcome. A completed receipt never contains a runtime token.

Compensation is unavailable after any later destination configuration change or runtime reference. Restoring an enabled rule to disabled does not restore eligibility. Do not repeatedly retry the old review; inspect the retained copy receipt and review a separate change when needed.

Rule automation is refused

A rule read needs integrations:read; a mutation or retained receipt needs integrations:manage on a current workspace API key. Rule automation requires the exact reviewed connection revision. After connection_configuration_changed or rule_cursor_stale, restart the read and review current configuration before a new request.

An idempotency key belongs to one normalized exact request and original actor. Recover its original receipt after an unknown outcome. Do not reuse that key with a newer revision or another change. Rules with incident history cannot be detached; review explicit disabling instead. Neither disabling nor failed deletion removes incident evidence or changes another mode.

Rule changes require canonical migration

workspace_modes_unavailable means the workspace does not have its complete canonical Sandbox and Live pair. Existing legacy expected outcomes remain readable with management controls disabled. Ask your workspace owner about the reviewed migration, then reload the connection before reviewing a new change.

canonical_lifecycle_required from the retired unreviewed rule route requires switching to rule management. Read current state, retain the exact revision and request key, and use the scoped public create, update or delete route. Retrying the retired route cannot create a rule.