LogsF-2311

Invalid state transitions — reactivation without payment

P3 · SUB-P1

SLA breached by5040m 00sof 1440m 00s

Invalid state transitions

1,240

from 0 · new

Affected users

1,240

Vela Fintech AR · subscription lifecycle

Cancels at risk

—

Not a churn-bearing finding

Detected

4d 12h ago

24 Aug 02:20 UTC

Attributable to

AWG

Commercial integrity. Entitlement, payment, subscription lifecycle, invoicing.

Past acknowledgement target — 1440m, raised 4d 12h ago, recorded against AWG — billing

Routing & discussion

not routed

Not routed yet. Nobody outside this tool knows about this finding.

Destination

No agreed intakeNo agreed intake. Tickets go to a named individual and are not tracked by AWG. The ticket will be recorded here with no external reference to quote back.

SubjectBody

Evidence attached

Transitions not permitted by the lifecycle (3 rows)

Editable before send

Description

1,240 Vela Fintech AR subscriptions moved from CANCELED to ACTIVE with no payment event recorded between the two states. A further 88 show a double-billing pattern: two settled payments inside one cycle against a single subscription. Neither sequence should be possible under the documented lifecycle. The volume clusters in the four days following the August acquirer change, which is the same window as the resolved payment-failure finding — so the likeliest reading is a replay or retry artefact in the recovery rather than a standing defect.

Suggested action

Ask AWG billing whether the acquirer recovery replayed state events. If it did, this closes as an artefact; if it did not, 1,240 users are active without paying.

Related logs

2 signals · expand a row for the event data

2026-08-24T02:20:00.000ZS-8930 THRESHOLD RULE CANCELED → ACTIVE without payment — observed 1,240, expected 0new

Detected: 24 Aug 02:20 UTC4d 12h ago
Detector: Threshold rule
Slice: Vela Fintech AR
Confidence: 97%
Affected users: 1,240
Observed: 1,240
Expected: 0
Deviation: new

Event dataREDSHFTPOST /redshift-data/v1/statement200160mss-8930-00a78

{
  "timestamp": "2026-08-24T02:20:00.000Z",
  "endpoint": "POST /redshift-data/v1/statement",
  "requestId": "s-8930-00a78",
  "status": 200,
  "latencyMs": 160,
  "request": {
    "metric": "CANCELED → ACTIVE without payment",
    "slice": "Vela Fintech AR",
    "detector": "rule",
    "window": "6h"
  },
  "response": {
    "observed": "1,240",
    "expected": "0",
    "deviation": "new",
    "confidence": 0.97,
    "affected_users": 1240,
    "columns": [
      "from",
      "to",
      "count",
      "with payment"
    ],
    "rows": [
      [
        "CANCELED",
        "ACTIVE",
        "1,240",
        "0"
      ],
      [
        "EXPIRED",
        "ACTIVE",
        "312",
        "0"
      ],
      [
        "ACTIVE",
        "ACTIVE",
        "88",
        "88 (double)"
      ]
    ]
  }
}

Query

SELECT from_status, to_status, count(*) AS transitions, sum(has_payment::int) AS with_payment
FROM recon.invalid_transitions WHERE tenant_id = 'vela-ar'
  AND occurred_at >= now() - interval '30 days'
GROUP BY from_status, to_status ORDER BY transitions DESC

2026-08-24T02:20:00.000ZS-8933 THRESHOLD RULE Double billing inside one cycle — observed 88, expected 0new

Detected: 24 Aug 02:20 UTC4d 12h ago
Detector: Threshold rule
Slice: Vela Fintech AR
Confidence: 99%
Affected users: 88
Observed: 88
Expected: 0
Deviation: new

Event dataREDSHFTPOST /redshift-data/v1/statement200163mss-8933-00a7b

{
  "timestamp": "2026-08-24T02:20:00.000Z",
  "endpoint": "POST /redshift-data/v1/statement",
  "requestId": "s-8933-00a7b",
  "status": 200,
  "latencyMs": 163,
  "request": {
    "metric": "Double billing inside one cycle",
    "slice": "Vela Fintech AR",
    "detector": "rule",
    "window": "6h"
  },
  "response": {
    "observed": "88",
    "expected": "0",
    "deviation": "new",
    "confidence": 0.99,
    "affected_users": 88,
    "columns": [
      "from",
      "to",
      "count",
      "with payment"
    ],
    "rows": [
      [
        "CANCELED",
        "ACTIVE",
        "1,240",
        "0"
      ],
      [
        "EXPIRED",
        "ACTIVE",
        "312",
        "0"
      ],
      [
        "ACTIVE",
        "ACTIVE",
        "88",
        "88 (double)"
      ]
    ]
  }
}

Query

SELECT from_status, to_status, count(*) AS transitions, sum(has_payment::int) AS with_payment
FROM recon.invalid_transitions WHERE tenant_id = 'vela-ar'
  AND occurred_at >= now() - interval '30 days'
GROUP BY from_status, to_status ORDER BY transitions DESC

Clustered support tickets

0 matched

No tickets matched.

Sample affected users

7b91c05e