AI Deliberation Transcript

Topic: A user registers for a small B2B platform. The form collects their name, work email, phone, company, and a password. They click "Create Account." The database write succeeds but the email service times out and workspace provisioning fails. They never receive a welcome email. When they try to log in: "Account not found." When they try to register again: "Email already in use."

Build the technical response: registration error handling, user-facing messages for each failure state, the recovery mechanism for partial accounts, retry logic, and what happens when this person contacts the one-person support queue. Write it in Python as working code with comments. Structure the response however you think best serves the problem.

Date: 2026-03-30 18:28

Rounds: 1

Mode: Conversation

Active Models: codex

Context Mode: clean

Methodology

Models

• codex: gpt-5.4

System Prompt (per model)

You are codex, alongside a human facilitator.
Speak honestly and in your own voice. No format requirements or word limits.

Context Preamble (sent with first turn)

No preamble — clean context mode

Transcript

[HUMAN] 2026-03-30 18:27:28 A user registers for a small B2B platform. The form collects their name, work email, phone, company, and a password. They click "Create Account." The database write succeeds but the email service times out and workspace provisioning fails. They never receive a welcome email. When they try to log in: "Account not found." When they try to register again: "Email already in use."

Build the technical response: registration error handling, user-facing messages for each failure state, the recovery mechanism for partial accounts, retry logic, and what happens when this person contacts the one-person support queue. Write it in Python as working code with comments. Structure the response however you think best serves the problem.

[GPT-5.4] 2026-03-30 18:28:53

"""
A small, working Python example for robust registration handling in a B2B platform.

Problem being solved
--------------------
A user submits registration:
- DB write succeeds
- welcome email times out
- workspace provisioning fails

Bad current behavior:
- login says "Account not found"
- re-registration says "Email already in use"

Desired behavior:
- preserve account state explicitly
- distinguish "exists but not fully activated" from "not found"
- support recovery of partial accounts
- retry transient failures
- provide clear user-facing messages
- define support behavior for a one-person support queue

This file demonstrates:
1. A user/account state model
2. Registration orchestration
3. Retry / recovery mechanism
4. Login behavior for partial accounts
5. Re-registration behavior for partial accounts
6. Support queue handling
7. Example scenario matching the prompt

Notes:
- Uses sqlite3 for persistence
- Uses only standard library
- Intentionally keeps security practical but simple for demo purposes
- In production, use stronger password hashing (argon2/bcrypt), real job queues, idempotency keys,
  audit logging, metrics, email verification tokens, and authenticated support tools
"""

from __future__ import annotations

import hashlib
import hmac
import os
import sqlite3
import time
import uuid
from dataclasses import dataclass
from datetime import datetime, timedelta
from enum import Enum
from typing import Optional, Tuple, Dict, Any


# =========================
# Domain model and statuses
# =========================

class AccountStatus(str, Enum):
    # Registration accepted, but setup still in progress.
    PENDING_SETUP = "pending_setup"

    # Workspace provisioning failed or email delivery failed and needs recovery.
    ACTION_REQUIRED = "action_required"

    # Fully provisioned and can log in.
    ACTIVE = "active"

    # Support can mark this if they determine registration should be restarted manually.
    RECOVERABLE = "recoverable"

    # Not used much in this demo, but practical for real systems.
    DISABLED = "disabled"


class ProvisioningStatus(str, Enum):
    NOT_STARTED = "not_started"
    IN_PROGRESS = "in_progress"
    SUCCEEDED = "succeeded"
    FAILED_RETRYABLE = "failed_retryable"
    FAILED_FINAL = "failed_final"


class EmailStatus(str, Enum):
    NOT_STARTED = "not_started"
    SENT = "sent"
    FAILED_RETRYABLE = "failed_retryable"
    FAILED_FINAL = "failed_final"


@dataclass
class PublicResponse:
    ok: bool
    code: str
    message: str
    next_action: Optional[str] = None
    account_id: Optional[str] = None


# =========================
# Utility functions
# =========================

def now_iso() -> str:
    return datetime.utcnow().isoformat(timespec="seconds") + "Z"


def hash_password(password: str) -> str:
    """
    Demo-only PBKDF2 hashing. Fine for example code; in production use argon2id or bcrypt.
    """
    salt = os.urandom(16)
    digest = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, 100_000)
    return salt.hex() + ":" + digest.hex()


def verify_password(password: str, stored: str) -> bool:
    salt_hex, digest_hex = stored.split(":")
    salt = bytes.fromhex(salt_hex)
    expected = bytes.fromhex(digest_hex)
    actual = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, 100_000)
    return hmac.compare_digest(actual, expected)


# =========================
# Simulated external systems
# =========================

class TimeoutError(Exception):
    pass


class ExternalServiceError(Exception):
    pass


class EmailService:
    """
    Simulated email service. Configurable to fail for a given address.
    """
    def __init__(self):
        self.fail_mode_by_email: Dict[str, str] = {}

    def set_fail_mode(self, email: str, mode: str):
        # mode: "timeout", "error", "ok"
        self.fail_mode_by_email[email.lower()] = mode

    def send_welcome_email(self, email: str, name: str, recovery_link: str) -> None:
        mode = self.fail_mode_by_email.get(email.lower(), "ok")
        if mode == "timeout":
            raise TimeoutError("Email service timed out")
        if mode == "error":
            raise ExternalServiceError("Email provider rejected request")
        print(f"[EmailService] Welcome email sent to {email}. recovery_link={recovery_link}")


class WorkspaceProvisioner:
    """
    Simulated workspace provisioner. Configurable to fail for a given email.
    """
    def __init__(self):
        self.fail_mode_by_email: Dict[str, str] = {}

    def set_fail_mode(self, email: str, mode: str):
        # mode: "timeout", "error", "ok"
        self.fail_mode_by_email[email.lower()] = mode

    def provision(self, account_id: str, company: str) -> str:
        mode = self.fail_mode_by_email.get(company.lower(), "ok")
        if mode == "timeout":
            raise TimeoutError("Provisioning timed out")
        if mode == "error":
            raise ExternalServiceError("Provisioning failed")
        workspace_id = f"ws_{uuid.uuid4().hex[:10]}"
        print(f"[WorkspaceProvisioner] Provisioned workspace {workspace_id} for company={company}")
        return workspace_id


# =========================
# Data access layer
# =========================

class DB:
    def __init__(self, path=":memory:"):
        self.conn = sqlite3.connect(path)
        self.conn.row_factory = sqlite3.Row
        self.init_schema()

    def init_schema(self):
        cur = self.conn.cursor()

        cur.execute("""
        CREATE TABLE IF NOT EXISTS accounts (
            id TEXT PRIMARY KEY,
            name TEXT NOT NULL,
            email TEXT NOT NULL UNIQUE,
            phone TEXT,
            company TEXT NOT NULL,
            password_hash TEXT NOT NULL,

            account_status TEXT NOT NULL,
            provisioning_status TEXT NOT NULL,
            email_status TEXT NOT NULL,

            workspace_id TEXT,
            recovery_token TEXT,
            recovery_token_expires_at TEXT,

            provisioning_attempts INTEGER NOT NULL DEFAULT 0,
            email_attempts INTEGER NOT NULL DEFAULT 0,

            last_error_code TEXT,
            last_error_detail TEXT,

            created_at TEXT NOT NULL,
            updated_at TEXT NOT NULL
        )
        """)

        cur.execute("""
        CREATE TABLE IF NOT EXISTS support_tickets (
            id TEXT PRIMARY KEY,
            email TEXT NOT NULL,
            account_id TEXT,
            subject TEXT NOT NULL,
            body TEXT NOT NULL,
            status TEXT NOT NULL,
            created_at TEXT NOT NULL,
            updated_at TEXT NOT NULL
        )
        """)

        self.conn.commit()

    def create_account(
        self,
        name: str,
        email: str,
        phone: str,
        company: str,
        password_hash: str,
        status: AccountStatus,
        provisioning_status: ProvisioningStatus,
        email_status: EmailStatus,
        recovery_token: str,
        recovery_token_expires_at: str,
    ) -> str:
        account_id = f"acct_{uuid.uuid4().hex[:12]}"
        ts = now_iso()
        self.conn.execute("""
            INSERT INTO accounts (
                id, name, email, phone, company, password_hash,
                account_status, provisioning_status, email_status,
                workspace_id, recovery_token, recovery_token_expires_at,
                provisioning_attempts, email_attempts,
                last_error_code, last_error_detail,
                created_at, updated_at
            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 0, NULL, NULL, ?, ?)
        """, (
            account_id, name, email.lower(), phone, company, password_hash,
            status.value, provisioning_status.value, email_status.value,
            None, recovery_token, recovery_token_expires_at,
            ts, ts
        ))
        self.conn.commit()
        return account_id

    def get_account_by_email(self, email: str) -> Optional[sqlite3.Row]:
        cur = self.conn.execute("SELECT * FROM accounts WHERE email = ?", (email.lower(),))
        return cur.fetchone()

    def get_account_by_recovery_token(self, token: str) -> Optional[sqlite3.Row]:
        cur = self.conn.execute("SELECT * FROM accounts WHERE recovery_token = ?", (token,))
        return cur.fetchone()

    def update_account(self, account_id: str, **fields):
        if not fields:
            return
        fields["updated_at"] = now_iso()
        keys = list(fields.keys())
        values = [fields[k] for k in keys]
        assignments = ", ".join(f"{k} = ?" for k in keys)
        sql = f"UPDATE accounts SET {assignments} WHERE id = ?"
        self.conn.execute(sql, values + [account_id])
        self.conn.commit()

    def create_support_ticket(self, email: str, account_id: Optional[str], subject: str, body: str) -> str:
        ticket_id = f"sup_{uuid.uuid4().hex[:10]}"
        ts = now_iso()
        self.conn.execute("""
            INSERT INTO support_tickets (id, email, account_id, subject, body, status, created_at, updated_at)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
        """, (ticket_id, email.lower(), account_id, subject, body, "open", ts, ts))
        self.conn.commit()
        return ticket_id

    def list_open_support_tickets(self):
        cur = self.conn.execute("SELECT * FROM support_tickets WHERE status = 'open' ORDER BY created_at ASC")
        return cur.fetchall()

    def close_support_ticket(self, ticket_id: str):
        self.conn.execute(
            "UPDATE support_tickets SET status = 'closed', updated_at = ? WHERE id = ?",
            (now_iso(), ticket_id)
        )
        self.conn.commit()


# =========================
# Core registration service
# =========================

class RegistrationService:
    RECOVERY_TOKEN_HOURS = 24
    MAX_EMAIL_RETRIES = 3
    MAX_PROVISIONING_RETRIES = 5

    def __init__(self, db: DB, email_service: EmailService, provisioner: WorkspaceProvisioner):
        self.db = db
        self.email_service = email_service
        self.provisioner = provisioner

    def _new_recovery_token(self) -> Tuple[str, str]:
        token = uuid.uuid4().hex + uuid.uuid4().hex
        expires_at = (datetime.utcnow() + timedelta(hours=self.RECOVERY_TOKEN_HOURS)).isoformat(timespec="seconds") + "Z"
        return token, expires_at

    def register(self, name: str, email: str, phone: str, company: str, password: str) -> PublicResponse:
        """
        Registration behavior:
        - If no account exists: create one in PENDING_SETUP and attempt setup.
        - If account exists and is ACTIVE: tell user email already has an account.
        - If account exists but is partial/recoverable: do NOT dead-end them. Offer recovery.
        """
        existing = self.db.get_account_by_email(email)
        if existing:
            status = existing["account_status"]
            if status == AccountStatus.ACTIVE.value:
                return PublicResponse(
                    ok=False,
                    code="EMAIL_ALREADY_REGISTERED",
                    message="An account with this work email already exists. Please sign in or reset your password.",
                    next_action="Go to sign in or use password reset."
                )
            elif status in {
                AccountStatus.PENDING_SETUP.value,
                AccountStatus.ACTION_REQUIRED.value,
                AccountStatus.RECOVERABLE.value,
            }:
                # Key fix: don't say only "email already in use." Explain that setup was incomplete.
                return PublicResponse(
                    ok=False,
                    code="REGISTRATION_INCOMPLETE",
                    message=(
                        "We found a previous sign-up for this work email, but setup was not completed. "
                        "You can resume setup instead of creating a new account."
                    ),
                    next_action=f"Use account recovery with token: {existing['recovery_token']}",
                    account_id=existing["id"]
                )
            else:
                return PublicResponse(
                    ok=False,
                    code="ACCOUNT_UNAVAILABLE",
                    message="This account cannot be used right now. Please contact support.",
                    next_action="Contact support."
                )

        recovery_token, token_expiry = self._new_recovery_token()
        account_id = self.db.create_account(
            name=name,
            email=email,
            phone=phone,
            company=company,
            password_hash=hash_password(password),
            status=AccountStatus.PENDING_SETUP,
            provisioning_status=ProvisioningStatus.NOT_STARTED,
            email_status=EmailStatus.NOT_STARTED,
            recovery_token=recovery_token,
            recovery_token_expires_at=token_expiry,
        )

        # Try setup immediately after DB write.
        setup_result = self._attempt_setup(account_id)

        if setup_result["fully_active"]:
            return PublicResponse(
                ok=True,
                code="REGISTRATION_COMPLETE",
                message="Your account is ready. You can sign in now.",
                next_action="Sign in.",
                account_id=account_id
            )

        # Important: account exists, but user is not blocked in a confusing way.
        # We return a recovery-oriented message.
        return PublicResponse(
            ok=False,
            code="REGISTRATION_PARTIAL",
            message=(
                "We created your account, but we couldn't finish setup yet. "
                "Your information is محفوظ and you do not need to register again."
            ),
            next_action=f"Resume setup with recovery token: {recovery_token}",
            account_id=account_id
        )

    def _attempt_setup(self, account_id: str) -> Dict[str, Any]:
        """
        Try provisioning and welcome email.
        Failure rules:
        - Provisioning failure means account cannot become ACTIVE
        - Email failure alone should not prevent login if workspace exists, but account should show email issue
        Here we keep account ACTIVE only when provisioning succeeds.
        """
        account = self._get_account(account_id)
        fully_active = False

        # Step 1: Provision workspace
        try:
            self.db.update_account(
                account_id,
                provisioning_status=ProvisioningStatus.IN_PROGRESS.value
            )
            account = self._get_account(account_id)

            workspace_id = self.provisioner.provision(account_id, account["company"])
            self.db.update_account(
                account_id,
                workspace_id=workspace_id,
                provisioning_status=ProvisioningStatus.SUCCEEDED.value,
                last_error_code=None,
                last_error_detail=None,
            )
        except TimeoutError as e:
            attempts = account["provisioning_attempts"] + 1
            self.db.update_account(
                account_id,
                provisioning_attempts=attempts,
                provisioning_status=ProvisioningStatus.FAILED_RETRYABLE.value,
                account_status=AccountStatus.ACTION_REQUIRED.value,
                last_error_code="PROVISIONING_TIMEOUT",
                last_error_detail=str(e),
            )
            return {"fully_active": False}
        except ExternalServiceError as e:
            attempts = account["provisioning_attempts"] + 1
            self.db.update_account(
                account_id,
                provisioning_attempts=attempts,
                provisioning_status=ProvisioningStatus.FAILED_RETRYABLE.value,
                account_status=AccountStatus.ACTION_REQUIRED.value,
                last_error_code="PROVISIONING_FAILED",
                last_error_detail=str(e),
            )
            return {"fully_active": False}

        # Step 2: Send welcome email
        account = self._get_account(account_id)
        recovery_link = f"https://example.com/recover?token={account['recovery_token']}"
        try:
            self.email_service.send_welcome_email(account["email"], account["name"], recovery_link)
            self.db.update_account(
                account_id,
                email_status=EmailStatus.SENT.value,
                account_status=AccountStatus.ACTIVE.value,
                last_error_code=None,
                last_error_detail=None,
            )
            fully_active = True
        except TimeoutError as e:
            attempts = account["email_attempts"] + 1
            # Email timeout should not strand the user.
            # Since provisioning succeeded, allow activation anyway.
            self.db.update_account(
                account_id,
                email_attempts=attempts,
                email_status=EmailStatus.FAILED_RETRYABLE.value,
                account_status=AccountStatus.ACTIVE.value,
                last_error_code="EMAIL_TIMEOUT",
                last_error_detail=str(e),
            )
            fully_active = True
        except ExternalServiceError as e:
            attempts = account["email_attempts"] + 1
            self.db.update_account(
                account_id,
                email_attempts=attempts,
                email_status=EmailStatus.FAILED_RETRYABLE.value,
                account_status=AccountStatus.ACTIVE.value,
                last_error_code="EMAIL_FAILED",
                last_error_detail=str(e),
            )
            fully_active = True

        return {"fully_active": fully_active}

    def retry_setup(self, recovery_token: str) -> PublicResponse:
        """
        User-facing recovery endpoint.
        This is what fixes the dead-end from the prompt.
        """
        account = self.db.get_account_by_recovery_token(recovery_token)
        if not account:
            return PublicResponse(
                ok=False,
                code="RECOVERY_TOKEN_INVALID",
                message="This recovery link is invalid.",
                next_action="Request a new recovery link or contact support."
            )

        expires_at = datetime.fromisoformat(account["recovery_token_expires_at"].replace("Z", ""))
        if datetime.utcnow() > expires_at:
            new_token, new_expiry = self._new_recovery_token()
            self.db.update_account(
                account["id"],
                recovery_token=new_token,
                recovery_token_expires_at=new_expiry,
                account_status=AccountStatus.RECOVERABLE.value
            )
            return PublicResponse(
                ok=False,
                code="RECOVERY_TOKEN_EXPIRED",
                message="Your recovery link expired.",
                next_action=f"Use the new recovery token: {new_token}"
            )

        # If already active, do not confuse the user.
        if account["account_status"] == AccountStatus.ACTIVE.value:
            return PublicResponse(
                ok=True,
                code="ALREADY_ACTIVE",
                message="Your account is already ready. You can sign in now.",
                next_action="Sign in.",
                account_id=account["id"]
            )

        result = self._attempt_setup(account["id"])
        refreshed = self._get_account(account["id"])

        if result["fully_active"]:
            return PublicResponse(
                ok=True,
                code="RECOVERY_COMPLETE",
                message="Your account setup is complete. You can sign in now.",
                next_action="Sign in.",
                account_id=refreshed["id"]
            )

        # If retries remain, encourage retry and support path.
        return PublicResponse(
            ok=False,
            code="RECOVERY_STILL_PENDING",
            message=(
                "We're still unable to complete your setup automatically. "
                "Your account exists, and support can finish this for you if needed."
            ),
            next_action="Retry later or contact support.",
            account_id=refreshed["id"]
        )

    def login(self, email: str, password: str) -> PublicResponse:
        account = self.db.get_account_by_email(email)
        if not account:
            return PublicResponse(
                ok=False,
                code="ACCOUNT_NOT_FOUND",
                message="We couldn't find an account for that work email.",
                next_action="Check the email entered or create an account."
            )

        status = account["account_status"]

        # Key fix: if setup is incomplete, do NOT say "account not found."
        if status in {
            AccountStatus.PENDING_SETUP.value,
            AccountStatus.ACTION_REQUIRED.value,
            AccountStatus.RECOVERABLE.value,
        }:
            return PublicResponse(
                ok=False,
                code="ACCOUNT_SETUP_INCOMPLETE",
                message=(
                    "Your account exists, but setup is not complete yet. "
                    "Please resume account setup."
                ),
                next_action=f"Resume setup with recovery token: {account['recovery_token']}",
                account_id=account["id"]
            )

        if status != AccountStatus.ACTIVE.value:
            return PublicResponse(
                ok=False,
                code="ACCOUNT_UNAVAILABLE",
                message="Your account is not available for sign-in right now.",
                next_action="Contact support."
            )

        if not verify_password(password, account["password_hash"]):
            return PublicResponse(
                ok=False,
                code="INVALID_CREDENTIALS",
                message="Incorrect email or password.",
                next_action="Try again or reset your password."
            )

        email_note = ""
        if account["email_status"] != EmailStatus.SENT.value:
            email_note = " We had trouble sending your welcome email, but your account is active."

        return PublicResponse(
            ok=True,
            code="LOGIN_SUCCESS",
            message="Signed in successfully." + email_note,
            next_action="Continue to dashboard.",
            account_id=account["id"]
        )

    def background_retry_failed_registrations(self):
        """
        Simulates a worker that retries failed setup.
        In real life this would be a queue worker / cron task.
        """
        cur = self.db.conn.execute("""
            SELECT * FROM accounts
            WHERE account_status IN (?, ?, ?)
        """, (
            AccountStatus.PENDING_SETUP.value,
            AccountStatus.ACTION_REQUIRED.value,
            AccountStatus.RECOVERABLE.value,
        ))
        accounts = cur.fetchall()

        for account in accounts:
            # Retry provisioning if retryable and attempts remain
            if (
                account["provisioning_status"] == ProvisioningStatus.FAILED_RETRYABLE.value
                and account["provisioning_attempts"] >= self.MAX_PROVISIONING_RETRIES
            ):
                self.db.update_account(
                    account["id"],
                    provisioning_status=ProvisioningStatus.FAILED_FINAL.value,
                    account_status=AccountStatus.RECOVERABLE.value,
                    last_error_code="PROVISIONING_FAILED_FINAL",
                    last_error_detail="Automatic retries exhausted; support required."
                )
                continue

            if (
                account["email_status"] == EmailStatus.FAILED_RETRYABLE.value
                and account["email_attempts"] >= self.MAX_EMAIL_RETRIES
            ):
                self.db.update_account(
                    account["id"],
                    email_status=EmailStatus.FAILED_FINAL.value,
                    # If workspace already succeeded, remain active.
                    account_status=account["account_status"],
                    last_error_code="EMAIL_FAILED_FINAL",
                    last_error_detail="Email retries exhausted; user can still log in."
                )
                continue

            self._attempt_setup(account["id"])

    def contact_support(self, email: str, issue_summary: str) -> PublicResponse:
        """
        One-person support queue behavior:
        - create a ticket
        - attach account if found
        - support later reviews and can trigger retry or mark for manual recovery
        """
        account = self.db.get_account_by_email(email)
        account_id = account["id"] if account else None

        body = issue_summary
        if account:
            body += (
                f"\n\nDetected account state:"
                f"\n- account_status={account['account_status']}"
                f"\n- provisioning_status={account['provisioning_status']}"
                f"\n- email_status={account['email_status']}"
                f"\n- last_error_code={account['last_error_code']}"
                f"\n- last_error_detail={account['last_error_detail']}"
            )

        ticket_id = self.db.create_support_ticket(
            email=email,
            account_id=account_id,
            subject="Registration / login issue",
            body=body
        )

        return PublicResponse(
            ok=True,
            code="SUPPORT_TICKET_CREATED",
            message=(
                "Your message has been added to the support queue. "
                "A human will review your account state and either complete setup or send you a recovery step."
            ),
            next_action=f"Support ticket created: {ticket_id}",
            account_id=account_id
        )

    def support_worker_process_queue(self):
        """
        Simulates the one-person support agent processing tickets.

        Suggested real support policy:
        1. Identify account by email
        2. If account is partial, do not ask user to re-register
        3. Trigger safe retry
        4. If retries exhausted, either:
           - manually provision workspace
           - reissue recovery link
           - or mark as recoverable and explain exact next step
        """
        tickets = self.db.list_open_support_tickets()
        for ticket in tickets:
            account = self.db.get_account_by_email(ticket["email"])
            print(f"\n[Support] Reviewing ticket {ticket['id']} for {ticket['email']}")

            if not account:
                print("[Support] No account found. Reply: please register again.")
                self.db.close_support_ticket(ticket["id"])
                continue

            status = account["account_status"]
            print(
                "[Support] Account state:",
                {
                    "account_status": account["account_status"],
                    "provisioning_status": account["provisioning_status"],
                    "email_status": account["email_status"],
                    "last_error_code": account["last_error_code"],
                }
            )

            if status in {
                AccountStatus.PENDING_SETUP.value,
                AccountStatus.ACTION_REQUIRED.value,
                AccountStatus.RECOVERABLE.value,
            }:
                # Support retries first.
                result = self._attempt_setup(account["id"])
                refreshed = self._get_account(account["id"])

                if result["fully_active"]:
                    print(
                        "[Support] Fixed by retry. Reply: your account is now active; sign in with your original email/password."
                    )
                else:
                    # Manual intervention path.
                    # For demo purposes: simulate manual workspace assignment.
                    if refreshed["provisioning_status"] != ProvisioningStatus.SUCCEEDED.value:
                        manual_workspace_id = f"ws_manual_{uuid.uuid4().hex[:8]}"
                        self.db.update_account(
                            refreshed["id"],
                            workspace_id=manual_workspace_id,
                            provisioning_status=ProvisioningStatus.SUCCEEDED.value,
                            account_status=AccountStatus.ACTIVE.value,
                            last_error_code="MANUAL_SUPPORT_RECOVERY",
                            last_error_detail="Support manually completed workspace setup."
                        )
                        print(
                            "[Support] Manually completed provisioning. "
                            "Reply: account recovered; welcome email may be delayed, but login now works."
                        )
                    else:
                        print(
                            "[Support] Provisioning already OK. Reply with fresh recovery link or ask user to sign in directly."
                        )

                self.db.close_support_ticket(ticket["id"])
            elif status == AccountStatus.ACTIVE.value:
                print("[Support] Account already active. Reply: sign in; offer password reset if needed.")
                self.db.close_support_ticket(ticket["id"])
            else:
                print("[Support] Escalate / investigate disabled account.")
                self.db.close_support_ticket(ticket["id"])

    def _get_account(self, account_id: str) -> sqlite3.Row:
        cur = self.db.conn.execute("SELECT * FROM accounts WHERE id = ?", (account_id,))
        row = cur.fetchone()
        if not row:
            raise ValueError(f"Account not found: {account_id}")
        return row


# =========================
# Example user-facing text
# =========================

USER_FACING_MESSAGES = {
    "registration_success": "Your account is ready. You can sign in now.",
    "registration_partial": (
        "We created your account, but couldn't finish setup yet. "
        "You do not need to register again. Resume setup from the recovery link."
    ),
    "email_already_registered_active": (
        "An account with this work email already exists. Please sign in or reset your password."
    ),
    "registration_incomplete_existing": (
        "We found an earlier sign-up for this email, but setup wasn't completed. "
        "Resume setup instead of creating a new account."
    ),
    "login_not_found": "We couldn't find an account for that work email.",
    "login_incomplete": (
        "Your account exists, but setup is not complete yet. Please resume account setup."
    ),
    "login_success_email_failed": (
        "Signed in successfully. We had trouble sending your welcome email, but your account is active."
    ),
    "recovery_invalid": "This recovery link is invalid.",
    "recovery_expired": "Your recovery link expired. We've issued a new one.",
    "recovery_complete": "Your account setup is complete. You can sign in now.",
    "support_created": (
        "Your message has been added to the support queue. A human will review and complete recovery if needed."
    ),
}


# =========================
# Demo scenario
# =========================

def print_response(title: str, response: PublicResponse):
    print(f"\n=== {title} ===")
    print("ok:", response.ok)
    print("code:", response.code)
    print("message:", response.message)
    print("next_action:", response.next_action)
    print("account_id:", response.account_id)


def run_demo():
    db = DB()
    email_service = EmailService()
    provisioner = WorkspaceProvisioner()
    service = RegistrationService(db, email_service, provisioner)

    # Simulate the exact problem:
    # - DB write succeeds
    # - email service times out
    # - workspace provisioning fails
    #
    # Provisioner fail mode in this demo is keyed by company name.
    test_email = "[email protected]"
    test_company = "BuyerCo"

    email_service.set_fail_mode(test_email, "timeout")
    provisioner.set_fail_mode(test_company, "error")

    # 1) User registers
    r1 = service.register(
        name="Alex Buyer",
        email=test_email,
        phone="+1-555-0100",
        company=test_company,
        password="correct horse battery staple"
    )
    print_response("Initial registration", r1)

    # 2) User tries to log in: should NOT say account not found
    r2 = service.login(test_email, "correct horse battery staple")
    print_response("Login after partial registration", r2)

    # 3) User tries to register again: should NOT just say email already in use
    r3 = service.register(
        name="Alex Buyer",
        email=test_email,
        phone="+1-555-0100",
        company=test_company,
        password="correct horse battery staple"
    )
    print_response("Second registration attempt", r3)

    # 4) Background retries happen, but provisioning still fails
    service.background_retry_failed_registrations()
    service.background_retry_failed_registrations()

    # 5) User uses recovery token
    partial_account = db.get_account_by_email(test_email)
    recovery_token = partial_account["recovery_token"]
    r4 = service.retry_setup(recovery_token)
    print_response("Recovery attempt while provisioning still failing", r4)

    # 6) User contacts support
    r5 = service.contact_support(
        email=test_email,
        issue_summary=(
            "I signed up, never got the welcome email, can't log in, "
            "and re-register says my email is already in use."
        )
    )
    print_response("Contact support", r5)

    # 7) Support processes queue
    service.support_worker_process_queue()

    # 8) Now login should work because support manually recovered provisioning
    r6 = service.login(test_email, "correct horse battery staple")
    print_response("Login after support recovery", r6)


if __name__ == "__main__":
    run_demo()

What this code does, in plain English

1. Registration error handling

It treats registration as a multi-step process, not a single boolean success/failure: - create account record - provision workspace - send welcome email

Each step has its own status in the database: - account_status - provisioning_status - email_status

That prevents the system from losing track of a partially created account.

2. User-facing messages for each failure state

The code returns explicit messages such as: - “We created your account, but we couldn't finish setup yet.” - “Your account exists, but setup is not complete yet.” - “We found a previous sign-up for this work email, but setup was not completed.”

This replaces the broken combination of: - “Account not found” - “Email already in use”

3. Recovery mechanism for partial accounts

Every account gets a recovery_token. If setup is incomplete, the user can resume setup with that token instead of trying to register again.

4. Retry logic

There are two retry paths: - immediate retry via retry_setup(...) - background retry via background_retry_failed_registrations()

The code distinguishes retryable vs final failures: - FAILED_RETRYABLE - FAILED_FINAL

5. Login behavior

If the account exists but is incomplete, login says: - account exists - setup incomplete - here is how to resume

It does not pretend the account doesn’t exist.

6. Re-registration behavior

If an email belongs to a partial account, registration says: - we found your previous sign-up - resume setup instead of starting over

It does not dead-end the user with only “email already in use.”

7. One-person support queue

When support is contacted: - a ticket is created - the ticket includes detected account state - the support worker retries setup - if that still fails, support can manually recover the account

In the demo, support manually assigns a workspace and activates the account.

Important design choices shown here

• Partial accounts are first-class states, not accidents.
• Email failure does not have to block login if provisioning succeeded.
• Provisioning failure does block activation, but the user gets a recovery path.
• Support should recover existing accounts, not tell users to “try again.”

If you want, I can also turn this into: 1. a small Flask API, 2. a FastAPI service with endpoints, 3. or a version using a real job queue pattern.