---
id: ADR-CRM-ENT-008
title: Commit Compliance Notice Submissions with Status
product_area: crm
module: entities
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-crm: 7ea48a414c42eade10d60753b8bcc323b1dd726f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Compliance status and accepted notification submission pointers commit
  together; deduplication keys distinguish organization version and recipient
  batch; delivery remains Platform’s responsibility and can be blocked or fail
  after commit.
constrains:
  - WF-CRM-ENT-004
  - DOM-CRM-ENT-002
  - SVC-CRM-ENT-entities
  - STATE-CRM-ENT-003
origin: >-
  Andrew, 2026-10-09; services-platform docs/communications/architecture.md
  §16.8 and §18; docs/jobs.md §4 decision D3 (the bounded in-transaction object
  write)
alternatives:
  - option: Queue notice submission only after status commit.
    why_not: >-
      That introduces another handoff in which committed compliance can lack its
      intended submission. The adopted architecture couples the submission
      pointer to status.
  - option: Send directly before the business transaction commits.
    why_not: That can deliver a notice for a compliance change later rolled back.
consequences:
  - >-
    Each recipient batch performs a bounded storage request while the
    transaction is open, with a two-second request timeout and one allowed
    retry.
  - >-
    Rollback can leave a request object without a submission pointer until
    storage expiry after 30 days.
  - Template configuration and delivery failures do not reverse CRM compliance.
evidence:
  - >-
    services-crm at 7ea48a41:
    modules/entities/services/organizations/compliance/compliance-email.ts,
    organization-compliance.ts
---
# Commit Compliance Notice Submissions with Status

## Context

The approved architecture couples compliance changes with accepted submission pointers. Its bounded storage exception allows CRM to compose the request before committing those pointers.

## Decision

Compliance status and accepted notification submission pointers commit together; deduplication keys distinguish organization version and recipient batch; delivery remains Platform’s responsibility and can be blocked or fail after commit.

## Alternatives Considered

Queue notice submission only after status commit. That introduces another handoff in which committed compliance can lack its intended submission. The adopted architecture couples the submission pointer to status.

Send directly before the business transaction commits. That can deliver a notice for a compliance change later rolled back.

## Consequences

The implementation splits recipients into batches and deduplicates each batch. This provides transactional submission consistency, not exactly-once email delivery. Product wording about one notice per transition still needs a decision that distinguishes submissions and delivery.

Each recipient batch performs a bounded storage request while the transaction is open, with a two-second request timeout and one allowed retry. Rollback can leave a request object without a submission pointer until storage expiry after 30 days. Template configuration and delivery failures do not reverse CRM compliance.