OnError is out-of-band (at least to some extent), so it might take over already processed messages. I don't think there is any particular delivery guarantee here, if someone wants to have in-band error signals he has to use recovery via onTermination and generate an element representing the error.