Fixing it over a database console
Someone reports an export that never arrived, and the only way to look is a hand-written query at eleven at night. There is no single view of what actually needs a person right now.
The foundation under itDurable operations
Control center
One owner-only screen for whatever needs a person.
Stuck jobs, dead queue events, failed webhook deliveries, storage deletions that never settled and billing backlog all collect in one screen, grouped by the action each needs. Every fix is one button that runs the same guarded path the feature itself uses, and every fix is recorded.
- 1
- database step per fix
- 8
- items per lane, so it stays readable
- 0
- raw payloads shown on screen
10 of 22 in The foundation under it
Product example
See it working
This is the same visual component used by the authenticated app, rendered with deterministic sample data.
Scenario
viewport
surface theme
mode
Attention required
An open incident, a delayed job and a dead queue event, all scoped to one organization.
Inert sample data · no network access
Control center
Owner-only, tenant-scoped operational signals.
Operational alerts
1 activeTenant summary
Incident lifecycle
Stable fingerprints group recurring conditions; acknowledgements, resolutions, and linked recovery actions remain durable.
Recovery workbench
Bounded tenant records and safe failure classes only. Provider payloads, response bodies, object names, and raw errors stay hidden.
Settlement and seven-day trend
Recent commands show accepted work through terminal settlement. Trend buckets contain counts only, never identifiers or provider payloads.
Integration readiness
Configuration and runtime evidence are separate. “Not verified” never implies that credentials or the live provider are healthy.
Preview ready
The problem this solves
Without a shared foundation, every team rebuilds these edge cases, differently.
The fix that causes the next problem
Re-firing a delivery from a console or flipping a status column by hand skips every check and leaves no trail. It works until the day it makes a bigger mess than the one it cleaned up.
Failures scattered across tools
Dead jobs in one place, failed deliveries in another, stuck uploads in a third. Nothing connects a failure to the fix that handled it, so the same fire gets fought twice.
Highlights
Why it matters
One screen for trouble
Failed jobs, dead work, webhook errors, storage problems and billing backlog are grouped by the action each one needs.
Safe retries only
Every fix runs through the same protected command the feature uses. Clicking twice cannot run it twice.
A record of every fix
Each action stores who did what and when, and is tracked until it genuinely settles or fails.
How it works
The mechanism end to end, as implemented in the repository.
- 1
Owners only
The server resolves the active organization and checks who you are. Anyone who is not a current owner gets a 404, not a hint that the page exists.
- 2
Trouble is sorted into lanes
Failures are grouped by the action they need and capped at eight per lane. Details are reduced to safe summaries; raw payloads and provider errors never reach the screen.
- 3
Fixes reuse the safe path
Retry, requeue and replay call the same protected command the owning feature uses. The action, its receipt and its audit record commit together.
- 4
Every fix is watched to the end
A reconciler follows each action until it settles or fails, and the page labels how fresh its own data is rather than implying it is live.
Engineering guarantees
What this does and does not promise
Safety boundary
The screen is owner-only, scoped to one organization, and never shows raw payloads or provider errors. Health probes report only what they verified, so anything unconfigured or stale stays not verified rather than turning green.
Implementation evidence
The boundary above is code, not a claim. These files carry the contract:
src/modules/control-center/MODULE.mdsrc/modules/control-center/server.tssrc/modules/control-center/operations.server.ts
Questions
Frequently asked questions
Used alongside this
These capabilities share contracts and boundaries with this one.
What control center rests on
The docs describe the same contracts this page demonstrates.