Payment Checkout & Ledger Service  ·  View 24 of 24  ·  Assurance

Failure Classes — What Is Assumed To Fail

Nine classes, each with an assumed rate, a named detector, a restoration path, and what a human is allowed to experience.

Editable source SVG draw.io All views
Assumed rate Detected by Immediate handling Where truth is restored Buyer / merchant sees Provider unknown outcome few per 1,000 8 s deadline hold in processing inquiry, then file honest pending Provider down hours / year each approval + latency circuit break, reroute no truth lost method degraded Duplicate / late callback routine event id seen dedupe, legality check no state change nothing Merchant endpoint down days at a time 5xx / timeout per-merchant queue 72 h retry + replay catch-up on return Ledger shard unavailable rare post lag alarm buffer in event log drain on recovery balance lags, no loss HSM / vault unavailable rare tokenise errors fail closed on card A2A unaffected card method hidden File late / restated monthly arrival SLA re-runnable ingest corrections, not edits payout may hold Reconciliation break ~40 / day matcher break account dual-control fix nothing, unless aged Data centre loss once in years health + quorum declared failover RPO 0 on ledger ≤ 120 s of declines Failure Classes — What Is Assumed To Fail Nine classes, each with a named detector and a named restoration path. The last column is the contract: what a human is allowed to experience. v 1.0 · owner Payments Platform Architecture · date 2026-10

The stance

  • Fail closed on money movement. Where the choice is between declining a legitimate payment and risking a double charge, the platform declines (ADR-04).
  • The last column is the contract. Every class resolves to something a buyer or merchant can be told honestly — a pending state, a hidden payment method, a lagging balance — rather than a lie or a silence.

The two that matter most

  • Unknown provider outcome: assumed at a few per thousand attempts, which makes it routine rather than exceptional, and is why it has its own view.
  • Ledger shard unavailable: authorization continues, posting buffers in the event log and drains on recovery, and nothing is reported as settled until it is posted. That is the critical design decision working as intended.

Assumptions

  • Every rate in the first column is a stated assumption: a few per thousand unknowns, hours per year per provider, ~40 breaks a day, a data centre lost once in several years.
  • A reviewer who changes one of these can follow it to the decision that depends on it; several of the ADRs flip on these numbers.
◀  Identity and Access — Who May Move Money All views
Solution Architecture v1.0 · open source, self-hosted on Kubernetes across two in-country data centres · Payments Platform Architecture · 2026-10 · 24 views · 18 architecture decision records24-failure-classes