Observability
The question an integration platform has to answer at three in the morning is “what happened to this message”. The vocabulary below is built for that answer, not for a handsome dashboard.
The measured unit is the delivery
Not the HTTP request — the delivery. One delivery leaves a receipt entry plus exactly one verdict: not zero, not two. Which door it came through is read from the channel column: a scheduled trigger emits the same pair as a synchronous call, with the channel telling them apart.
The practical consequence: deliveries can be counted without distinguishing the door, and the distribution across doors can be obtained without counting the same delivery twice.
The verdict has its own column
The delivery’s typed verdict — succeeded, handled by the fault sequence, failed — sits in a column of its own in the journal and can be filtered on. A delivery handled by a fault handler is not mistaken for one that succeeded outright.
What does not count as an error
Three kinds of refusal each have their own name, because each asks a different action of the operator: no access right, the platform at capacity, and a request that cannot be identified. None of them counts as a flow error — otherwise a port scanner would raise the error rate of flows it never touched.
One retention window
The journal has two sinks — rows in a database and files on disk. One retention window governs both, in a single pass, wired into the serving process. The uncleaned half would have been exactly the one holding message bodies in clear when the logging level is raised.
The edges differ deliberately: rows are compared against an instant, files against a whole day, so a file lives up to a day longer than the equivalent rows. That is the safe direction, and it is written down as such.
The management UI
The management UI ships with the platform. It has roles with an enforced boundary, and its reporting pages, the dashboard and statistics, render fully in English or in Romanian.
Boot and reconciliation
- A boot scan cannot stay silent: a registry that cannot be listed stops the boot rather than looking checked.
- A reconciliation report does not claim completeness while something went unscanned, and names what it could not read.
- A drained queue reclaims its bytes while the worker keeps consuming, and a dead letter discarded is really gone from disk.