---
id: ADR-PFM-MTD-015
title: Commit-time history capture that refuses incomplete writes
product_area: platform
module: metadata
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: Database triggers capture attributed record and link revisions in the mutation transaction and refuse
  commit when required history context is absent.
constrains:
- DOM-PFM-MTD-005
- DOM-PFM-MTD-006
- WF-PFM-MTD-014
- SVC-PFM-MTD-custom-objects
origin: Record change history plan (approved 2026-10-11) adopted for custom records and links under the custom objects
  architecture (approved 2026-10-18); services-platform:docs/record-history.md
alternatives:
- option: Relying on each application writer to add history
  why_not: Another writer, job or cross-service function could omit the revision.
- option: Building history from asynchronous events
  why_not: Capture would lag and unsupported event mutations could leave historical gaps.
consequences:
- Cross-service deletion and merge changes participate in database capture.
- Authorized reset and purge suppress capture for their removal work.
- The copied capture implementation needs coordinated extraction rather than independent divergence.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: docs/record-history.md; modules/custom-objects/db/record-revisions.table.ts'
---

# Commit-time history capture that refuses incomplete writes

## Context

History must include writes through jobs and other services as well as ordinary API saves.

## Decision

Database triggers capture attributed record and link revisions in the mutation transaction and refuse commit when required history context is absent.

## Alternatives Considered

Relying on each application writer to add history: Another writer, job or cross-service function could omit the revision. Building history from asynchronous events: Capture would lag and unsupported event mutations could leave historical gaps.

## Consequences

Cross-service deletion and merge changes participate in database capture. Authorized reset and purge suppress capture for their removal work. The copied capture implementation needs coordinated extraction rather than independent divergence.