QWFIX implements full business logic validation in the order management API. We did our best trying to detect any potential problem in application's business logic implementation and take measures before the problem propagates to the counter-party.
For example, we a buy side application tries to send a single order with duplicated ClOrdID with QWFIX order management API, an exception will be thrown out and no message will be sent. A sell side trying to send an execution with duplicated ExecID will trigger an exception, too.
Nevertheless, usually we can't precent the counter-party from doing wrong things. For example, our application is a buy side application, the sell side sent us an execution report with duplicated ExecID, and "PossDup" and "PossResend" are not set. In this case, the message will be ignored and a warning alert will be written to system log. Another example, our application is a sell side application, it receives a "New Order Single" from counter-party with a duplicated ClOrdID. In this case the new order will be ignored and an "Execution Report" with "Reject" will be sent to the buy side.
Note: Those errors should have been identified and fixed during QA and testing process. They should not appear in the production environment normally.