---
id: ADR-PFM-DJE-002
title: Frozen input and transactional receipts
product_area: platform
module: data-job-engine
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
decision: >-
  Submission fixes the input, and each committed item receives a receipt in the
  same transaction as its domain change.
constrains:
  - DOM-PFM-DJE-001
  - STATE-PFM-DJE-002
  - WF-PFM-DJE-001
  - WF-PFM-DJE-002
  - SVC-PFM-DJE-engine
origin: >-
  services-platform:docs/proposals/rhythm-data-job-engine-plan.md §6.4 frozen
  target sets and §9.5 receipts (approved 2026-10-12)
alternatives:
  - option: Read the selection again during execution
    why_not: A later selection can differ from the previewed input.
  - option: Depend on exactly-once queue delivery
    why_not: >-
      Delivery can repeat; duplicate protection must be committed with the
      change.
consequences:
  - An existing receipt prevents reapplying that item within the same job.
  - Rollback planning relies on receipts and domain history.
  - Evidence retention is decided but its general purge is not implemented.
supersedes: []
evidence:
  - >-
    macroservice-libraries at 54536a44: src/run-data-job-batch.ts (module
    comment); README.md#What the engine is, in one paragraph
---

# Frozen Input And Transactional Receipts

## Context

Repeated delivery must be safe without changing the set of records approved for processing.

## Decision and Origin

Submission fixes the input, and each committed item receives a receipt in the same transaction as its domain change. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

## Alternative Comparison

Read the selection again during execution: A later selection can differ from the previewed input.

Depend on exactly-once queue delivery: Delivery can repeat; duplicate protection must be committed with the change.

## Consequences

An existing receipt prevents reapplying that item within the same job.

Rollback planning relies on receipts and domain history.

Evidence retention is decided but its general purge is not implemented.