---
id: ADR-PFM-DJE-004
title: Isolate record refusals and retain successful changes
product_area: platform
module: data-job-engine
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
decision: >-
  Record refusals are recorded individually, database refusals are isolated by
  splitting commit units, and systemic failures or the refusal-rate guard stop
  further work.
constrains:
  - DOM-PFM-DJE-001
  - WF-PFM-DJE-002
  - WF-PFM-DJE-008
  - SVC-PFM-DJE-engine
origin: >-
  services-platform:docs/proposals/rhythm-data-job-engine-plan.md §8 failure
  classification and §9.3 the batch algorithm (approved 2026-10-12)
alternatives:
  - option: Commit the entire job atomically
    why_not: One invalid row would prevent every otherwise valid change.
  - option: Load database rows without the domain save path
    why_not: >-
      Direct loading would bypass domain validation, history and derived
      behavior.
consequences:
  - Successful changes remain committed when other records are refused.
  - >-
    Refusal evidence uses safe messages, codes and field paths rather than
    exposing input values.
  - >-
    The guard pauses after more than half of 100–999 attempts are refused, or
    more than one fifth from 1,000 attempts.
supersedes: []
evidence:
  - >-
    macroservice-libraries at 54536a44: src/commit-split.ts, rejection-guard.ts,
    run-data-job-batch.ts
---

# Isolate Record Refusals And Retain Successful Changes

## Context

A large input can contain both valid and invalid records.

## Decision and Origin

Record refusals are recorded individually, database refusals are isolated by splitting commit units, and systemic failures or the refusal-rate guard stop further work. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

## Alternative Comparison

Commit the entire job atomically: One invalid row would prevent every otherwise valid change.

Load database rows without the domain save path: Direct loading would bypass domain validation, history and derived behavior.

## Consequences

Successful changes remain committed when other records are refused.

Refusal evidence uses safe messages, codes and field paths rather than exposing input values.

The guard pauses after more than half of 100–999 attempts are refused, or more than one fifth from 1,000 attempts.