DEVICE — the keys a phone proves the operator with

Raised where the companion app registers a phone’s hardware key, asks for a challenge, or mints a key with that key’s signature in place of the operator password. A device key lives in the phone’s secure hardware and proves the operator for one mint at a time; registering one needs the platform’s attestation that it does, from an app this stack trusts. See the commands.

Code	Severity	Exit	What it means	What to do
DEVICE-1	error	1	That word cannot name a device key. A device key's name travels in an address, an alert and the journal, so it is lower-case letters, digits, dots, dashes and underscores, beginning with a letter or a digit, and at most 64 characters.	Name it after the phone that holds it, as in pixel-8.
DEVICE-2	error	1	A device key by that name is already registered, or was and has been revoked. A name identifies one device key for good, so an alert or a journal entry naming it means the same key.	Register it under another name.
DEVICE-3	error	1	That public half is already registered, under the name the message gives. A revoked device key is never made good again, so its public half is not registered a second time.	Make a new key pair on the phone and register that.
DEVICE-4	error	1	That public half is not a P-256 key. A device key is the public half of a P-256 key pair, as its SubjectPublicKeyInfo in base64url.	Make the key pair on the P-256 curve, and send its SubjectPublicKeyInfo.
DEVICE-5	error	1	A device key was registered with no attestation. A key nothing vouches for is treated as one held in software, which a device key may not be.	Send the platform's attestation of where the key lives with it.
DEVICE-6	error	1	The attestation does not verify against the platform roots this build ships, or it does not cover the public half that was sent, so nothing vouches for where the key lives.	Make a new key pair on the phone and register it with the attestation the platform gives for it.
DEVICE-7	error	1	The attestation places the key in software, or says it was made outside the hardware and taken in. A device key has to be made and kept in the phone's hardware, StrongBox, the Secure Enclave or the trusted environment, where the operating system cannot read it.	Make the key on a phone that holds keys in hardware, or mint the key at the stack's terminal.
DEVICE-8	error	1	The attestation names an app this stack does not trust. A device key is registered only from the official companion or from a build the operator has added to LEMONFIBER_DEVICE_KEY_APPS.	Add the build's identity with lemonfiber settings set LEMONFIBER_DEVICE_KEY_APPS, if it is a build you made.
DEVICE-9	error	1	No active device key goes by that name: none was registered under it, or it was revoked.	Register the phone's key again, which asks for the password once.
DEVICE-10	warning	1	That challenge proves nothing: it was never issued, it was used already, its minute has passed, or it was issued to another session or device key. Which of these is not said.	Ask for a new challenge and sign the mint within a minute.
DEVICE-11	error	1	The signature does not verify against the device key's public half over that challenge and that mint. It counts against the limit wrong passwords meet.	Sign the challenge with the mint's name, scope, purpose and kind exactly as sent, in the form the contract publishes.
DEVICE-12	error	1	lemonfiber could not make a challenge. A challenge is unpredictable bytes this machine supplies, and it would not supply them.	Try again. If it happens twice, the operating system's own random source is at fault.
DEVICE-13	error	1	A certificate in the chain vouching for the key is one Google lists as revoked or suspended, in the snapshot of its attestation status list this build carries. A key it vouches for cannot be told from one made outside a phone's hardware.	Mint the key at the stack's terminal instead.

What each severity and each exit means is on every error by code, beside every other family.