Error reference

Every message and gate reason you might see, in plain English, with the fix. Grouped by where it appears.

Domain-authorization gate refusals

Shown when live send refuses a recipient (see the gate).

Reason	Meaning	Fix
invalid recipient	The address has no parseable domain.	Correct the roster entry.
domain not authorized for this tenant	The recipient's domain isn't in this client's authorized list.	Verify the domain (DNS-TXT), then resend.
no allowlist token	No scoped token was supplied for the send.	Use live send from the Cloud tab so tokens are minted automatically.
token scoped to a different tenant	The token belongs to another client.	Switch to the correct active client and resend.
token scoped to a different domain	The token was issued for a different domain than the recipient's.	Resend so a fresh per-domain token is minted.
allowlist token expired	The token is older than its 24-hour lifetime.	Re-run live send to mint new tokens.
no notify transport (offline)	No live send channel — you're signed out or offline.	Sign in (with msp) and check connectivity.
send failed: …	The notification service errored for that recipient.	Retry — sends are idempotent per (campaign, recipient).

Domain-proof results

Message	Meaning	Fix
"Verified — [domain] added to authorized domains"	Success — the TXT record matched.	None; the domain now clears the gate.
"Not verified: TXT record not found or does not match"	No TXT record at the host, or its value doesn't equal the challenge.	Check host, exact value, record type, and propagation. See the checklist.
"Not verified: invalid challenge"	The challenge was missing or malformed.	Click "Get DNS-TXT challenge" again to mint a fresh one.
"Not verified: unknown tenant"	No active tenant context.	Make sure a client is active in the MSP console.
"Not verified: dns lookup failed: …"	The DNS-over-HTTPS lookup itself failed (transient/network).	Retry shortly.
"Enter a domain" / "Get a challenge first"	You clicked verify without a domain or without first getting a challenge.	Type the domain, click "Get DNS-TXT challenge", publish the record, then verify.

Live-send summaries

Message	Meaning
"Live send: N queued, M refused (domain gate)"	N recipients cleared the gate and were queued; M were refused (see the gate reasons above).
"No campaign to send — create one in the Simulator first"	There's no recent campaign for the active client. Run one in the Simulator.

Cloud, sync & entitlement notices

Message	Meaning	Fix
"Cloud sync is a Pro feature"	Your account lacks cloud_sync.	Upgrade, or use local CSV/JSON exports.
"Synced [org] to cloud (isolated per-tenant scope)"	Success — the active client's PII-free summary was pushed to its own scoped key.	None.
"Nothing in the cloud yet for this tenant — sync up first"	You pulled before anything was pushed for this client.	Click "Sync up" first.
"Cloud summary: X% courses complete, N campaign(s)"	Success — the pulled summary for the active client.	None.
"Published Awareness & Training evidence (…)"	Success — evidence object published; the ID follows.	None.
"Live send is an MSP-tier feature — upgrade to enable."	Your account lacks msp.	Upgrade to the MSP tier.
"Loading the optional cloud tier…" (stuck)	The cloud module isn't deployed or failed to load.	Expected on local-only runs; everything else works offline.
keystone-client: not signed in	A cloud action ran without a session.	Sign in first.
keystone-client: NNN … (e.g. 401/403/404)	The platform API returned an error (auth, entitlement, or missing record).	Sign out/in to refresh; confirm the right account/tenant and your plan.

App-level messages

Message	Meaning	Fix
"Couldn't load data"	The JSON datasets didn't load.	Serve over HTTP, not file://. See Troubleshooting.
"No recipients match that department + cohort selection"	Your audience filter excluded everyone.	Widen the departments or pick a less restrictive cohort.
"Complete the course first"	You tried to view a certificate for a course you haven't passed.	Pass the quiz, then view the certificate.
"[name] already has it open"	Idempotent assignment — that person already has an open assignment for that course.	None needed; no duplicate was created.
"Switched to [client] (isolated context)"	Success — the active client changed.	None.