HSX_E_LINK_PREFLIGHT_UNPROVEN

01 · Meaning

What this error means

A binding records `worker-secret-only` custody (the HSX_TOKEN_KEY exists only as the deployed Worker’s write-only secret), or the dashboard approved owners the preflight did not cover — so link fails closed rather than proceeding unproven. Link made no changes.

When this error stops a command, hs-x exits with code 10. With --json, the failure is reported as a structured error whose code field is HSX_E_LINK_PREFLIGHT_UNPROVEN — stable to match on in scripts and agents.

02 · Causes

Likely causes

• The binding was re-hydrated from the control plane on a machine that never held the token key
• The dashboard approved a different owner set than the preflight covered

03 · Fix

How to fix it

• Run hs-x link from the machine that created the deploy (its custody store holds the escrowed key)
• Restore the hs-x state directory (token-key-custody.json + .key) from a backup of that machine — see docs/token-key-custody.md

Still stuck? Re-run the command with --debug for the wire-level detail, or hs-x doctor to check accounts, link state, and connectivity in one pass.