Troubleshooting

Every scenario is INCONCLUSIVE

The positive control failed: the owner could not find its own fixture. Typical causes:

• Your store indexes asynchronously and the polling window is too short. Increase execution.consistency.attempts or interval_ms.
• Search does not match the marker as a substring. Make sure your adapter's search can find exact tokens; semantic-only search may need a custom adapter that also supports exact lookup.
• The adapter ignores the context on writes, so records land somewhere the owner cannot read.

A scenario is SKIPPED

The adapter does not declare a capability the scenario requires. memtru doctor lists declared capabilities; memtru scenarios lists requirements. For http adapters, check what GET /capabilities returns, or set adapter.capabilities explicitly.

ERROR with provider_unavailable

The provider returned 429/502/503/504 or the connection failed, and retries were exhausted. Increase execution.retries (max 3) or the adapter's max_retries, or check the service.

ERROR with timeout

A scenario did not finish within execution.timeout_seconds. Its result is ERROR. The engine blocks subsequent scenario calls and attempts exact-id compensation if an in-flight write returns later. Cleanup remains marked partial because the response might never return; remaining: [] does not prove absence of unknown late writes. New namespaces use the full run UUID, mt-<run-id>; older reports retain their original namespace format.

Quarantine the sandbox, preserve the report/run id and review provider request logs for that namespace. Stop the isolated CLI worker if it is stuck, then reconcile completed synthetic writes after the provider's request timeout. Delete only verified synthetic ids owned by that run, never a broad user or tenant collection. Custom adapters must set finite transport timeouts; a thread deadline cannot kill arbitrary I/O or custom adapter internals. Hung per-record cleanup and teardown are bounded too; late cleanup failures emit a sanitized JSON diagnostic with run id and exception type. Cancellation is cooperative, not process isolation.

Cleanup partial or failed

Some synthetic records could not be deleted. The result lists their ids. They belong to the run namespace and to synthetic principals mt-<run-id prefix>-…; delete them with your provider's tools by those ids. Memtru never performs a broader wipe.

unsafe_target errors

The http adapter refused the URL. Loopback needs allow_loopback: true, private ranges need allow_private_network: true, remote targets need authorization_confirmed: true, and link-local or metadata addresses are always refused.

Upload fails with 401

The token is wrong, expired, revoked, its creator no longer belongs to the organization, or its project is archived. Removal permanently revokes creator tokens in that organization; rejoining does not restore them. Create a new token in project settings and run memtru auth login again (or update MEMTRU_TOKEN).

Upload fails with 422 contains_secret

The server found a string that looks like a credential. The error includes its JSON path. Remove the secret from your adapter's error messages or metadata and re-run; never relax the check.

Upload fails with 422 inconsistent_report

The report was edited by hand so its summary no longer matches its results. Re-run memtru test instead of editing reports.

The dashboard says "Not found" for a project I can see in the URL

You are not a member of that project's organization, or it was deleted. Memtru does not distinguish these cases, so it reveals nothing about other organizations.

Node prints "SQLite is an experimental feature"

The web app uses Node's built-in node:sqlite. The warning is expected on Node 22 and 24 and does not affect behaviour.