Error & degraded state
What every user sees when something fails: a correlation reference, safe recovery actions and honest degradation notices — never stack traces, hostnames or sensitive diagnostics.
The e-signature provider did not respond in time. Your document and data are safe; the release action was not committed and can be retried without creating a duplicate envelope.
- Correlation reference
ERR-2026-0717-0921-7C4D-55231- When
- 17 Jul 2026 · 09:21:44 (Asia/Dubai)
- What was affected
- Contract CT-2026-0412 · release step only
- Retry safety
- Idempotent — safe to retry
- Your draft
- Saved 09:21 · restored on return
| Users see | Users never see |
|---|---|
| Plain-language outcome and affected record | Stack traces, exception classes, SQL |
| Correlation reference for support | Internal hostnames, IPs, queue names |
| Retry safety and recovery path | Provider credentials or endpoint URLs |
| Draft-saved confirmation | Other users’ data in error context |
| Incident reference when one is open | Raw payloads or masked-field contents |
Engineers correlate the same reference to full traces in observability tooling; auditors via the Audit Explorer.
| Provider / capability | Status | Since | User impact | Fallback in effect | Queue |
|---|---|---|---|---|---|
E-signature provider Contract release & envelopes (WF-04) |
Outage | 08:55 · 29 min | Envelopes cannot be sent | Manual wet-sign fallback, evidence uploaded after | 6 queued |
WhatsApp BSP Outbound customer messaging |
Degraded · slow | 09:02 · 22 min | Delivery delayed ~8 min | Auto-retry with backoff; SMS fallback if consented | 41 queued |
Teams Phone (PSTN) Click-to-call, call logging |
Healthy | — | None | — | 0 |
Sanctions list source Screening & rescreen (WF-09) |
Healthy | — | None · list v2026-07-16 active | — | 0 |
OCR / document extraction KYC evidence, invoices (WF-05, WF-08) |
Healthy | — | None | — | 0 |
Property portal syndication — Bayut Listing publication (WF-03) |
Recovered 07:40 | — | Backlog cleared 08:10 | — | 0 |
Every queued action carries an idempotency key, so automatic and manual retries never duplicate leads, envelopes, journals or messages. After the final attempt the item moves to the dead-letter queue for authorized replay with a reason code.
| Attempt | Delay | On failure |
|---|---|---|
| 1 | Immediate | Schedule attempt 2 |
| 2 | + 30 s | Schedule attempt 3 |
| 3 | + 2 min | Schedule attempt 4 |
| 4 | + 10 min | Move to DLQ · notify owner |
| DLQ replay | Manual · reason required | Reconciliation report updated |
| State | Shown as | Safe recovery |
|---|---|---|
| 403 · Not permitted | Permission rechecked on command; no record details leaked | Request access via role owner |
| 409 · Edit conflict | Optimistic-lock notice with both versions’ timestamps | Review changes, merge, resubmit |
| 422 · Validation | Accessible error summary linked to each field | Fix fields; draft preserved |
| 429 · Throttled | Wait hint with retry-after time | Automatic retry queued |
| 503 · Degraded | This page, with correlation reference | Retry / queue / manual fallback |
| Session expired | Re-authentication prompt; work preserved | Sign in again · draft restored |
Support traces logs by reference — no screenshots of data needed.
Static render mockup — no live data. Source: ERP Modern Development Specification v2.0 · Covers: UX-32, NFR-10 (correlation reference, safe recovery, degraded-provider fallback, idempotent retry/DLQ; no sensitive diagnostics).