Every step in our fulfillment engine writes down how to undo itself before it does anything.
Not pessimism.
Refunds.
If an order fails or gets cancelled, the engine walks backwards through everything it did. Deletes the files it generated. Unwinds the watermarked copies. Throws away the archives it built. Kills the share links it minted.
A refunded package that still downloads isn't a refund. It's a gift.That's the returns desk. The rest is safety rails.
Every step in a workflow gets:
→ a retry count, and a wait between attempts
→ continue-on-fail, for the steps that genuinely don't matter
→ its own timeout
→ a dedicated error branch, so failure has somewhere to go
→ an off switch that isn't the delete key
→ a notes field, for the person who opens this in eight months and is you
Then there's what the buyer sees when something stalls.
Not a spinner. A spinner is a shrug with a rotation.The line item says what it is actually waiting on: verifying files, watermarking, zipping. Three words instead of a support ticket.
For staff there's a generation log. Every step, timestamped, success or failure, carrying the real error message rather than a friendly euphemism about something going wrong. Exportable, so it can be pasted to somebody who can help.
There is a screen for that, and it is the drawing you built. Open a workflow and every run it has ever done is listed down the side — numbered, timed, newest first, fifteen to a page. Click one and your own diagram lights up: which boxes finished, which one it died in, how long each of them took, how many times it tried before it gave up, and what it handed on. Not a log of the process. The process, with one run played back over it. Which is the difference between "it failed somewhere" and somebody pointing at a box.
Last one, and it's my favorite.
Every run snapshots the version of the workflow it used. So when somebody edits a flow this morning, they have not quietly rewritten what happened last Tuesday.
The order that shipped on Tuesday still knows exactly which process shipped it.
Which matters, because sooner or later somebody's lawyer asks.
The difference between a demo and a product isn't what it does on a good day.Next: why nobody should have to build any of this from an empty screen.