Skip to main content
Sanning’s errors fall into three groups, and telling them apart saves the most time.
  • Not yet. The plane is settling. Wait and retry.
  • Wrong shape. Your call or your key is wrong. Change something and retry.
  • Refused. Sanning is declining on purpose. Read the reason.

​
Not yet

These resolve on their own. Retry rather than debugging.
The interval containing your records has not been sealed and published yet. It means not yet, never you have no evidence.Wait for the interval to close and run the command again. See The witness.
A record anchored seconds ago is not readable through the read routes yet. Placement settles after the write returns.Wait and retry. Building a pack immediately after a run races your own newest record.

​
Wrong shape

Your key can anchor and cannot read. Building a pack reads your own records back, so it needs anchor:read as well as anchor:write.A key with only anchor:write anchors correctly for weeks and then fails the first time you try to hand anything over. Mint a key with both. See Keys and scopes.
--logs is required in practice. The command reads your record objects to work out which events belong to this producer, because a minimum-disclosure envelope does not carry that name.Point it at your store root, the directory holding content/ and records/.
The pack command reads a local store root. If your store is an object bucket, synchronise it locally first and point --logs at the copy.
The pack covers a period and you must name it. --agent, --from, --to and --out are all required.A date-only bound names a whole day. Pass a full timestamp such as 2026-09-01T09:00:00Z for a narrower window.
The window you asked for includes records whose bytes are not in the store you pointed at. Usually the window is wider than you meant.The command refuses rather than quietly dropping them, because a pack that silently omits records an auditor asked for is worse than no pack.
You handed the kernel a zip. PK is the archive’s own signature.Extract it and point at bundle.json inside. See Verify at the command line.

​
Refused

The plane accepts records only from keys the organisation knows, so that every record has an identity behind it.Both SDKs enrol automatically before the first anchor. If you see this, the key reaching the plane is not the one that enrolled, or the credential lacks producer:enroll.
That producer name was revoked. Revoking is deliberate and a revoked name cannot be re-enrolled by anyone, including whoever holds the old key.Recovering means re-keying the producer through the console, which keeps the lineage.
The SDK writes your bytes to your log store before anchoring, and a store failure stops the anchor. There is no best-effort mode on this path.Anchoring a commitment to bytes you cannot produce is the one state that cannot be repaired afterwards. See Keep your log store.

​
Verdicts are not errors

partial and undetermined are answers, not failures. A check that could not run is reported as not run. See What a verdict means.