Background work, job status and the audit record

What it is for

Some changes finish after you submit them: generating documents, sending notifications, recording the daily audit checkpoint. Each is a job with its own durable identity, retried automatically, and visible at its status link. Every change you make is also written to a tamper-evident audit record for your organization or the estate.

What you enter

Nothing extra. A form that starts background work shows a status link (also returned as jobUrl on command receipts). Submitting the same form twice replays the first result instead of acting twice.

What you get

Job status: pending, leased (running), completed, or dead (gave up after repeated failures and awaits an operator). Each attempt is listed with its outcome. The audit record lists events in order; each links to the previous one by hash.

Example

An owner changes a role. The receipt says applied, the Members table reloads with the new role, and History (from a later release) shows 'membership.role_changed' with who, when and under which authority.

Common problems and how to recover

A job shows status dead.

Nothing was repeated or lost: the work stopped after its attempt budget. An operator can requeue it from the dead-letter list after fixing the cause. Provider side effects are keyed so a requeue cannot duplicate an email or charge.

"This record changed since the page loaded."

Someone else changed the same record. Reload to see the current state, then apply your change again if it is still right. Nothing was changed by your submit.

The audit checkpoint says application-controlled.

That is the honest label today: the hash chain and its checkpoints are held by the same operator as the data. It detects tampering by anyone holding an earlier export, but it is not independent verification until an external anchor is configured.

Who can use it

Members of an organization can see the status of its jobs. Audit events for an estate are visible to everyone who can access that estate; organization-level events to members. Only operators can requeue dead letters.