---
id: ADR-PFM-DJE-003
title: Fingerprint approval and counted delete confirmation
product_area: platform
module: data-job-engine
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Interactive approval must echo the saved impact fingerprint within its 24-hour
  window; deleting also requires the returned count-based phrase.
constrains:
  - DOM-PFM-DJE-001
  - STATE-PFM-DJE-001
  - WF-PFM-DJE-003
  - WF-PFM-DJE-019
  - SCR-PFM-DJE-006
  - SCR-PFM-DJE-007
origin: >-
  services-platform:docs/proposals/rhythm-data-job-engine-plan.md §6.6 and §13.2
  (approved 2026-10-12); PLAT-M19 CRM-Q10
alternatives:
  - option: Approve using only the job identity
    why_not: The request would not identify the preview being approved.
  - option: Confirm deletion with a checkbox
    why_not: A checkbox does not confirm the counted deletion phrase.
  - option: Expire previews with a scheduled sweep
    why_not: >-
      The present implementation checks expiry when an action is attempted
      rather than sweeping previews.
consequences:
  - >-
    Approval validates the recorded fingerprint; execution rechecks individual
    record versions and domain rules without recomputing a whole-job preview.
  - CRM file submissions bypass the interactive preview.
  - >-
    An expired preview can remain displayed as validated until a control action
    checks it.
supersedes: []
evidence:
  - >-
    macroservice-libraries at 54536a44: src/job-control.ts:applyValidatedJob,
    hard-delete.ts
  - >-
    react-console at baf6dae3:
    components/data-management/data-jobs/new/confirm-apply-dialog.tsx
---

# Fingerprint Approval And Counted Delete Confirmation

## Context

Approval can arrive from an old page, and hard deletion has no compensating rollback.

## Decision and Origin

Interactive approval must echo the saved impact fingerprint within its 24-hour window; deleting also requires the returned count-based phrase. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

## Alternative Comparison

Approve using only the job identity: The request would not identify the preview being approved.

Confirm deletion with a checkbox: A checkbox does not confirm the counted deletion phrase.

Expire previews with a scheduled sweep: The present implementation checks expiry when an action is attempted rather than sweeping previews.

## Consequences

Approval validates the recorded fingerprint; execution rechecks individual record versions and domain rules without recomputing a whole-job preview.

CRM file submissions bypass the interactive preview.

An expired preview can remain displayed as validated until a control action checks it.