What does Windows error code 739 (ERROR_ALERTED) mean?

ERROR_ALERTED

Thread returned in an alerted state

ERROR_ALERTED is Windows system result 739 (0x000002E3). The producing native subsystem must define what placed the thread in that state.

This result is an alerted-thread marker. It is distinct from an object becoming signaled and from a timeout expiring; the caller normally must examine cancellation, native status, and its original predicate before continuing.

Where this value belongs

• A low-level system service returns because the thread was alerted.
• A compatibility layer maps an alerted native wait result to code 739.
• Debugging output records a thread-state transition rather than an application error.

Public Win32 wait documentation does not make it a universal application return. Preserve the lower-level API and avoid inventing a generic recovery rule from the name.

Common interpretation mistakes

• It is mishandled when the caller dispatches a handle index even though no object was selected.
• It is mishandled when an alerted return is merged with timeout metrics.
• It is mishandled when the wait loop resumes without checking cancellation or shutdown.
• It is mishandled when the source that alerted the thread is omitted from traces.

Diagnostic sequence

1. Capture the raw native and translated results.
2. Identify the wait or system service and its alertable or processor mode.
3. Check cancellation, shutdown, and thread-control requests.
4. Verify that no wait object is falsely marked as selected.
5. Measure whether alerted returns repeat without progress.
6. Inspect the subsystem or debugger action that can alert the thread.

Evidence worth keeping

• preserve producing native API and status.
• preserve thread ID and wait reason.
• preserve cancellation and shutdown state.
• preserve alert source or controlling component.
• preserve predicate evaluation and progress after return.

An it event is actionable only when the trace explains why the thread was waiting and what condition it checked after returning.

Correct handling and recovery

Treat the result as an interruption of the low-level wait, process any documented alert action, and re-evaluate cancellation plus the original wait predicate.

A wait can resume when the operation remains valid and forward progress is possible. A tight loop of alerted returns requires investigation rather than indefinite retry.

Difference from nearby values

ERROR_USER_APC can accompany execution of a user callback, while it identifies an alerted return without proving such a callback ran. ERROR_TIMEOUT means the deadline expired.

Practical scenario

A native worker is alerted during shutdown coordination. It returns code 739, sees the shutdown flag, and exits cleanly; an old implementation instead redispatched the last remembered handle index.

Implementation guidance

Represent alerted, APC, timeout, signaled, and abandoned outcomes separately. Native wrappers should expose the original result domain and never reuse a stale index.

Record alerted_source, alerted_wait_api, alerted_cancel_state, alerted_predicate_after, and alerted_repeat_count.

References

• Microsoft: System Error Codes 500–999
• Microsoft Open Specifications: Win32 error values
• Microsoft: Wait functions

Looking for a different code? Search another status or error code.