---
id: ADR-PFM-MTD-008
title: Transactional capture with later delivery
product_area: platform
module: metadata
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: Supported record and link mutations commit their audit, history and event fact together; destination delivery
  follows asynchronously through the outbox and queue with at-least-once retries.
constrains:
- DOM-PFM-MTD-005
- DOM-PFM-MTD-006
- SVC-PFM-MTD-custom-objects
- SVC-PFM-MTD-associations
- WF-PFM-MTD-005
- WF-PFM-MTD-010
- WF-PFM-MTD-014
- STATE-PFM-MTD-008
origin: services-platform:docs/business-events.md (the shared events library's outbox contract; the loads and events
  milestone PLAT-M7 is proposed, so this decision is proposed); services-platform:docs/record-history.md (approved
  plan 2026-10-11)
alternatives:
- option: Sending queue messages during persistence
  why_not: Queue acceptance cannot roll back with a failed database transaction.
- option: Calling subscribers synchronously
  why_not: Slow or failing destinations would make ordinary record saving depend on external availability.
- option: Guaranteeing exactly-once delivery
  why_not: The queue contract permits repetition, so destinations must deduplicate event identities.
consequences:
- Supported event facts cannot outlive rollback of their originating mutation.
- Changes outside the declared event content produce no event.
- A missed nudge waits for a successful scheduled dispatch rather than imposing a hard deadline.
- No-destination work leaves delivery and its unreferenced fact can age out after ninety days.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: lib/events/platform-business-events.ts; modules/custom-objects/services/dispatch/business-events.ts;
  docs/business-events.md; docs/record-history.md'
---

# Transactional capture with later delivery

## Context

Committed changes can matter to downstream work, but subscriber availability must not block a save.

## Decision

Supported record and link mutations commit their audit, history and event fact together; destination delivery follows asynchronously through the outbox and queue with at-least-once retries.

## Alternatives Considered

Sending queue messages during persistence: Queue acceptance cannot roll back with a failed database transaction. Calling subscribers synchronously: Slow or failing destinations would make ordinary record saving depend on external availability. Guaranteeing exactly-once delivery: The queue contract permits repetition, so destinations must deduplicate event identities.

## Consequences

Supported event facts cannot outlive rollback of their originating mutation. Changes outside the declared event content produce no event. A missed nudge waits for a successful scheduled dispatch rather than imposing a hard deadline. No-destination work leaves delivery and its unreferenced fact can age out after ninety days.