---
id: ADR-PFM-DJE-005
title: Rollback through a guarded compensating job
product_area: platform
module: data-job-engine
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: >-
  Supported contact and organization updates can produce a validated
  compensating job from receipts and domain history, excluding records whose
  later changes prevent safe restoration.
constrains:
  - DOM-PFM-DJE-001
  - WF-PFM-DJE-005
  - SVC-PFM-DJE-crm-data-jobs
  - SVC-PFM-DJE-data-jobs
  - SCR-PFM-DJE-004
origin: >-
  services-platform:docs/proposals/rhythm-data-job-engine-plan.md §13.1
  compensating rollback (approved 2026-10-12); CRM-M7 D-39;
  services-platform:docs/standards/record-write-contracts.md#W4
alternatives:
  - option: Restore before-values without checking later edits
    why_not: Blanket restoration would replace subsequent work.
  - option: Snapshot every record as the recovery mechanism
    why_not: Snapshots still need version checks to avoid replacing later changes.
  - option: Use soft deletion to reverse hard deletes
    why_not: The examined record model uses hard deletion and counted approval.
consequences:
  - >-
    Rollback reports exclusions and can restore only part of the original
    change.
  - Changes to custom fields or collections can exclude the whole record.
  - Retry is refused after rollback has been applied.
  - >-
    Imports and unsupported record kinds use reset-and-reload where available,
    rather than this compensation.
supersedes: []
evidence:
  - >-
    macroservice-libraries at 54536a44: src/plan-data-job-rollback.ts;
    README.md#Rolling a job back
  - 'services-crm at a8d1364f: services/operations/record-rollback-plan.ts'
---

# Rollback Through A Guarded Compensating Job

## Context

Reversing a bulk update must account for edits made after the original job.

## Decision and Origin

Supported contact and organization updates can produce a validated compensating job from receipts and domain history, excluding records whose later changes prevent safe restoration. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

## Alternative Comparison

Restore before-values without checking later edits: Blanket restoration would replace subsequent work.

Snapshot every record as the recovery mechanism: Snapshots still need version checks to avoid replacing later changes.

Use soft deletion to reverse hard deletes: The examined record model uses hard deletion and counted approval.

## Consequences

Rollback reports exclusions and can restore only part of the original change.

Changes to custom fields or collections can exclude the whole record.

Retry is refused after rollback has been applied.

Imports and unsupported record kinds use reset-and-reload where available, rather than this compensation.