Troubleshooting

Every entry is symptom → cause → fix, the symptom quoted as it appears in the log or on screen. Two rules explain most of them. Absent credentials are the live gate: a venue with no keys stays paper, silently, by design. And every misconfiguration splits two ways — refuse when a silent difference would leave you believing a protection is armed when it is not (a ceiling, an arming flag), degrade when "unconfigured" is a state you may have chosen (a venue connection, a feed, a credential set). vike-cli config check states that rule and applies it finding by finding, one exit code for the lot (crates/vike-cli/src/cmd/config_check.rs). Every refusal fires before any venue is mounted; a degrade may only reduce the program's authority, never redirect it.

Install

• version 'GLIBC_2.39' not found at exec (Linux). The release binaries are glibc-dynamic on the release runner, measured at 2.39, and an older host fails at exec rather than at build (deploy/docker/Dockerfile's base-image note). Fix: a host at 2.39 or newer, or the container.
• status=203/EXEC from systemd. The unit's ExecStartPre= runs bin/vike-cli config check, so the daemon needs that second binary beside it (deploy/vike-datahub.service).
• status=226 from systemd. The system manager refuses a unit whose ReadWritePaths= names a missing path — <project>/settings/state. A --user manager does not refuse, so a clean --user start proves nothing. Fix: create the directory.
• Container: every venue on paper, no error. Docker's default working directory is / and an unmounted /project is an empty directory, so the settings walk finds nothing; deploy/docker/entrypoint.sh refuses this and names the -v flag. From Git Bash on Windows, MSYS path conversion rewrites the container side of -v C:\vike-trader:/project to …:C:/Program Files/Git/project. Fix: PowerShell or WSL, or MSYS_NO_PATHCONV=1.
• Dukascopy: bridge jar not found, venue on paper. The sidecar jar is a release asset. crates/bridges/dukascopy/src/config.rs's resolve_dukascopy_tools looks at JFOREX_BRIDGE_JAR (blank is ignored), then <project>/bin/jforex/jforex-bridge.jar; the JVM is JAVA_HOME/bin/java when that file exists, else <project>/bin/jre/*/bin/java, else java from PATH. Fix: crates/bridges/dukascopy/scripts/provision-jforex.sh (provision-jforex.ps1 on Windows), which supplies both the runtime and the jar, or point JFOREX_BRIDGE_JAR at any copy. An instant login failed afterwards is a corrupted platform cache, not a credential problem — delete %LOCALAPPDATA%\JForex and retry.

Credentials and arming

• Every venue on paper; the log sits beside the executable; the store line says rung=user-dir. No project marker above the working directory. The walk (crates/vike-model/src/state_path.rs's project_settings_dir) takes the outermost Cargo.toml declaring [workspace], else the nearest Cargo.toml or settings/ directory; the probe is is_dir, so creating <project>/settings/ is the whole fix. VIKE_SETTINGS_DIR names it outright and beats the walk.
• credential store could not be opened, continuing with NO credentials (every venue stays paper). The store exists and is unreadable — an error, where an absent store is the ordinary silent state (crates/vike-secrets/src/store.rs's resolve). Fix: the file's permissions; vike-cli secrets path prints the one location consulted.
• … holds live venue credentials in PLAINTEXT and is readable beyond its owner (mode 0644). A finding, not a refusal; the credentials load anyway. Fix: the chmod 600 the line prints.
• <project>/.env is present but the credential store <project>/settings/secrets.env is NOT. Nothing reads a project-root .env since credentials moved into the settings directory (LegacyStoreWarning). Fix: copy the venue keys into the store.
• "I have credentials and the venue is still paper." The ceiling refused: ARMING CEILING: <venue> has live credentials, and this deployment's ceiling for it is paper → staying PAPER (crates/vike-mount/src/paper_fallback.rs's report_capped_to_paper). Credentials and no [venues] table gets one ARMING CEILING NOW IN FORCE block per process listing every affected venue; writing the table at all silences it, and a ceiling can only refuse — live does not put a venue live. See Risk and arming and policy.toml.
• The Data Manager's Venues rows name a block. A row is one venue account — a box with no [accounts] table gets exactly one per roster venue, the default account's — and its ArmingBlock names its own fix. Disarmed (the ceiling), NoCredentials (the Connections tab), LiveCredentialsAbsent (the store holds demo-tier keys only), MainnetSwitchUnset (a live ceiling still resolves demo without {VENUE}_MAINNET), FeatureAbsent (this binary has no arm for ibkr/polymarket/fxcm), SdkAbsent (FXCM, below), ExecFlagUnset (POLY_EXEC=1), NoMountInThisBuild (the desktop, which mounts no venue), NoLiveArm (dukascopy, whose exec factory is mounted in no build, so it can only ever be paper), DemoOnlyArm / LiveOnlyArm (the arm has no such tier — a demo ceiling over polymarket resolves paper), and, on a labelled second account, AccountNotNamed (no policy.accounts.<venue>.<LABEL> line of its own) or NoAccountSupport (that venue's arm cannot address a second account at all). ArmingBlock::ALL (crates/vike-config/src/venue_arming.rs) is the whole vocabulary.
• vike-desktop exits with code 2 before a window appears; the daemon prints the same message and stops. Three refusals, in vike_boot::boot's order: a removed variable is set (VIKE_MAX_ORDER_NOTIONAL or VIKE_TRADEHUB_MAX_ORDER_NOTIONAL → max_notional_per_order in policy.toml; VIKE_SECRETS_PASSPHRASE, which nothing consumes — crates/vike-config/src/removed.rs's REMOVED_ENV; an empty value does not count); a {VENUE}_MAINNET=1 line inside secrets.env (crates/vike-config/src/arming.rs — move it to the process environment); or a settings file that exists and is broken. See Environment variables.
• refusing LIVE mount: no project settings dir resolved. A live-armed venue with no project has nowhere to keep its live-account sentinel, so crates/vike-desktop/src/main.rs refuses rather than mounting unguarded. Fix: VIKE_SETTINGS_DIR, or run inside the project.
• tradehub observe auth denied: bad mac on a loop. The client had no key and signed with an empty one; crates/vike-app-core/src/backend_conn.rs now logs no observe key: VIKE_TRADEHUB_OBSERVE_KEY is absent from the credentials map first. The key comes from the store; an environment value fills it only when the store has none (backend_registry.rs's fill_node_keys_from_env) and the control key is never filled. It must match the daemon's byte for byte. Daemon side, observe server NOT started names its cause: no observe key in the store, or a non-loopback tradehub_addr — keep it on 127.0.0.1 behind an SSH tunnel, or set tradehub_allow_public_bind = true in flags.toml (crates/vike-tradehub/src/tradehub_cli.rs). See Observe mode.

Feeds

• The chart stays empty after picking a symbol. The node carries live clients for six venues while the picker searches a twelve-venue catalog, so an alpaca, oanda, dukascopy, fxcm or ctrader instrument lands on a venue with no bar feed (crates/vike-app-core/src/feed_lifecycle.rs). Fix: the same instrument on a venue with a feed.
• The picker shows only the built-in quick-picks. The catalog has not loaded or the fetch failed; crates/vike-desktop/src/chart_window.rs falls back to SYMS, Binance symbols, and choosing one resets the venue to Binance.
• reconcile leg suppressed: venue health probe reports Degraded. That venue's feed is mid-gap or the network is down; its reconcile leg is deferred and other venues are unaffected (crates/vike-core/src/recon_manager.rs's should_reconcile). Nothing to fix.
• Polymarket dials fail at the SOCKS connect. The proxy is on by default at socks5h://127.0.0.1:1080 (crates/bridges/polymarket/src/egress.rs's proxy_url). Fix: POLY_PROXY_ENABLED=false if you are not geo-blocked, POLY_PROXY_HOST/POLY_PROXY_PORT, or a full POLY_SOCKS_PROXY; keep socks5h, since plain socks5 resolves DNS locally and hits the block. The venue geo-blocks order placement only — a submit is the one call that returns 403 — and the live mount probes that first and refuses on a positive answer (crates/bridges/polymarket/src/egress.rs's check_order_placement_geo, decided by crates/bridges/polymarket/src/mount.rs's geoblock_action).

Mounts

• cTrader or IBKR on paper after a startup outage. Their handshakes are blocking and fallible at mount, and a failure demotes the venue to paper for the whole session with no in-thread reconnect (crates/vike-mount/src/lib.rs's ("ctrader", _) and ("ibkr", _) arms). Fix: restart once the gateway answers. A cold-start CH_ACCESS_TOKEN_INVALID with a valid-looking pair on disk means a rotated refresh token was never written back to the store.
• FXCM mounts paper whatever the store says. vike_fxcm::sdk_linked() is cfg!(fcsdk), set only when build.rs found the ForexConnect SDK; no CI build has ever linked it. spawn is infallible, so there is no connect result to demote on: a bad password, an unreachable gateway and a stub build are indistinguishable from outside. The stub is the only one this arm can catch — it refuses out loud and lands on paper. A live-but-failing login mounts "live" and trades nothing, and reconcile is what notices.
• polymarket: POLY_RECONCILE=1 without a live exec mount → RECONCILE-ONLY (exec is PAPER).

• New orders come back rejected; cancels and reduce-only exits still work. The HALT sentinel exists: a risk-OPENING submit is refused with a synthesized terminal OrderRejected while under the default policy a reduce_only one is admitted (and logged), a modify is dropped, and cancel is never gated (crates/vike-bridge-core/src/exec_actor.rs, crates/vike-exec/src/halt.rs's halt_admits_submit). The path is VIKE_HALT_FILE, else <project>/settings/state/HALT, else <exe_dir>/HALT as a reported last resort (crates/vike-bridge-core/src/halt.rs). See Halt and Stop, liquidate, restart.
• BUY/SELL greyed out; the status line reads CORE FAULT: <fault>. A handler panicked. The core neither dies nor keeps trading: it enters safe-state — trading state Halted, working orders get a best-effort cancel, and the engine is never traded on again until the process restarts (crates/vike-core/src/runtime/mod.rs). The fault is what the GUI reads: crates/vike-app-core/src/core_sync.rs writes the status line from snap.fault, the trade tool's header repeats it as ⚠ <fault>, and the buttons arm on snap.fault.is_none() (crates/vike-app-core/src/tool_views/trade.rs) — not on the trading state. Fix: restart, then read the fault.

The store and the logs

• A run reports zero rows; "my tape is empty". The store resolved on a different rung than you assumed. Precedence (crates/vike-model/src/store_path.rs): --store / a profile's store =, then VIKE_HIST_STORE — which also overrides config.toml's store_root — then the project VIKE_SETTINGS_DIR declares, then the source checkout that built the binary, then the discovered project, then the per-user directory. The startup line carries rung= and a sentence saying why. See The history store.
• The JSON log grows without bound. The file layer defaults to trace and RUST_LOG / VIKE_LOG filter the console only; one hour of a backfill measured 6.4 GB. Fix: VIKE_LOG_FILE_LEVEL=warn or off (crates/vike-log/src/lib.rs's file_level_directive). Retention keeps DEFAULT_MAX_LOG_FILES daily files, three, and cannot help when one day is the file — a desktop client measured 5.8 GB in 4h10m before the per-frame wgpu_core, wgpu_hal, naga and eframe::native targets were pinned to info.
• The log lands beside the executable. resolve_log_dir is VIKE_LOG_DIR, then config.log_dir, then <project>/settings/state/logs, then <exe_dir>/logs — the last resort means no project resolved, the same cause as the paper-everywhere entry above.

The GUI

• Empty boxes where the window controls should be (Linux, the container). egui's bundled face has none of ✕ ─ □ ❐ ●; the shell loads a symbol face from crates/vike-app-core/src/fonts.rs's SYMBOLS candidates — Segoe UI Symbol, Noto Sans Symbols 2, DejaVu Sans — and a missing file is a silent false. Fix: install DejaVu or Noto Sans Symbols 2.
• The saved layout did not come back. crates/vike-app-core/src/startup.rs's restored_workspace returns None under VIKE_SHOT, which needs the default windows; otherwise the last named layout wins, then workspace.json under <project>/settings/state.
• VIKE_SHOT=1 wrote a file named 1. The variable takes the output path, drops a <path>.dbg beside it, and captures at frame VIKE_SHOT_FRAME (default 180) on a visible frame, so the window asks to be always-on-top and focused (crates/vike-desktop/src/main.rs).

Each install page's Troubleshooting block — Windows, Linux, Docker — points at the entries above that apply to it. A failure not listed here is worth a report with the startup disclosure attached.