How delivery works
GoHighLevel gets busy, goes down, refuses data and expires tokens. None of that may cost a lead. Here is what Fernway does in each case, and the test that proves it, run on every change before it ships.
GHL
GHL limits how fast an app may call it, and answers 429 when the calls come too fast.
Fernway
Fernway's queue sends at most 40 requests every 10 seconds, whatever arrives at once. If GHL still answers 429, the lead waits for its next try on the retry clock (case 02). It is never dropped.
GHL
GHL answers 408, 429 or a 5xx error, or says nothing at all for 10 seconds.
Fernway
Those pass on their own, so the lead is tried again on the retry clock: 8 tries over about 24 hours. After the eighth it is returned with every answer kept, and one press sends it again.
Proven by
delivery.test.ts:9spreads them over about 24 hoursengine.test.ts:193tries 8 times over 24 h on the promised schedule, then returns the waybillqueue.test.ts:33retries through the queue on its own until GHL takes the leadbreakit.test.ts:61no answer, and an expired token: each retried once, then deliveredGHL
GHL refuses the data itself, like a phone number without its country code (any other 4xx).
Fernway
Trying again would only repeat the refusal, so the lead is held at once, with GHL's reason in words on its receipt. Once the data is fixed, a resend starts it on a fresh set of tries. A lead GHL could never match (no email and no phone) is refused at the door, before a waybill is made.
Proven by
engine.test.ts:167holds a lead GHL refuses for its data, at once, with the reasontrack.test.ts:76shows GHL's refusal as words, not JSONengine.test.ts:244resends a held waybill with a fresh set of tries, on the receiptqueue.test.ts:72runs a resend through the real queue, though its first try's job already ranengine.test.ts:72refuses a lead GHL couldn't match, with a reason the sender can act onGHL
GHL's access tokens expire, and each refresh token can be spent only once.
Fernway
Tokens are refreshed 5 minutes before they expire, under a lock, so two workers that need a token at the same moment spend the refresh token once. If GHL answers 401 anyway, Fernway refreshes and tries again. If GHL refuses the refresh, the connection is marked for reconnecting and leads are held with that reason, never lost.
Proven by
oauth.test.ts:180refreshes an expired token once, form-encoded, and keeps the new refresh tokenoauth.test.ts:196spends the single-use refresh token once even when two workers need a token at the same momentengine.test.ts:181refreshes the token after a 401 and tries againoauth.test.ts:208marks the connection for reconnecting when GHL refuses the refresh, and holds leads with that reasonGHL
A website sends a form again after a timeout, or GHL takes a contact but its answer never arrives.
Fernway
Each lead carries an idempotency key, so the same lead sent twice is one waybill. Fernway keeps every id GHL gives back (contact, note, meeting, opportunity), so a retry carries on where the last try stopped and never makes a second. Contacts go through GHL's upsert, matched by email, then phone.
Proven by
engine.test.ts:60makes one shipment of the same lead sent twiceengine.test.ts:144never makes a second contact: a try after a failed stage reuses the contact GHL already gaveengine.test.ts:156never makes a second contact when GHL took the lead but its answer was lostengine.test.ts:270adds the message once, between the contact and the opportunity, and never again on a retrybooking.test.ts:46books the meeting between the contact and the opportunity, once, even when a later step is retriedWhat goes wrong
Not GHL this time: the worker restarts, or the queue loses a job.
Fernway
Every scan is written in the same database transaction that moves the lead on, and the app's own database role can add scans but never change or remove one. Every minute a sweep puts back on the queue any lead whose try is more than 2 minutes late. A try that already ran, or isn't due yet, does nothing, so a job that arrives twice is harmless.
Every test above runs against a real database and queue, with a fake GHL that fails on demand, on every push. Nothing deploys unless they pass.
