---
id: ADR-PFM-ELG-017
title: Committed writes survive follow-up failures with partial scheduled repair
product_area: platform
module: eligibility
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Preserve committed writes after follow-up failures and describe repair
  separately for each path rather than promise universal recovery.
constrains:
  - SVC-PFM-ELG-eligibility
  - SVC-PFM-ELG-responsibilities
  - SVC-PFM-ELG-attention
  - WF-PFM-ELG-002
  - WF-PFM-ELG-004
  - WF-PFM-ELG-010
  - WF-PFM-ELG-012
  - WF-PFM-ELG-015
origin: >-
  none (pattern observed across the three modules; documented in their module
  records)
alternatives:
  - option: Hold the transaction open for every follow-up
    why_not: >-
      Remote caches and functions extend transaction duration and can still
      fail.
  - option: Undo the committed change after a follow-up failure
    why_not: >-
      Reversing a valid business change would introduce a second business
      failure.
consequences:
  - Repair depends on later successful processing.
  - Deferred display history has no repair path.
  - Retired-kind sweep repair applies only during seven days after retirement.
  - >-
    Logs expose failures but do not establish durable retry or a completion
    deadline.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: services/governance/publish.ts;
    services/evaluate/decision-recording.ts;
    modules/responsibilities/aws/api/responsibilities.routes.ts;
    modules/attention/services/evaluate/refresh-unassigned-attention.ts;
    docs/debt/eligibility-display-decision-outbox.md
---
# Committed writes survive follow-up failures with partial scheduled repair

## Context

A write can commit successfully even when its later cache or scheduling work fails.

## Decision

Preserve committed writes after follow-up failures and describe repair separately for each path rather than promise universal recovery.

## Alternatives Considered

Hold the transaction open for every follow-up: Remote caches and functions extend transaction duration and can still fail.

Undo the committed change after a follow-up failure: Reversing a valid business change would introduce a second business failure.

## Consequences

Repair depends on later successful processing. Deferred display history has no repair path. Retired-kind sweep repair applies only during seven days after retirement. Logs expose failures but do not establish durable retry or a completion deadline.