---
id: ADR-PFM-NOT-005
title: A Submission Is Validated Whole and Travels Complete
product_area: platform
module: notifications
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: Submission doors validate complete envelopes before writes, while processing validates content
  against the current definition or purpose.
constrains:
- DOM-PFM-NOT-003
- DOM-PFM-NOT-005
- SVC-PFM-NOT-notifications
- SVC-PFM-NOT-communications
- WF-PFM-NOT-002
- WF-PFM-NOT-010
- WF-PFM-NOT-011
origin: 'Partly confirmed: the pointer-and-object shape is the queued-work standard (Andrew 2026-10-10),
  services-platform:docs/queued-work.md#5. A large or personal payload lives in S3 and the queue carries
  a pointer; validating the whole envelope at every door is an observed implementation choice.'
alternatives:
- option: Accept partial submissions and patch them later
  why_not: Partial queued submissions require later producer coordination and cannot be processed independently.
- option: Validate everything at the door, including templates and recipients
  why_not: Resolving recipients and templates at intake would couple the transaction to mutable delivery
    configuration.
consequences:
- Envelope refusal leaves the repeat key unused.
- Processing refusal produces an inspectable invalid outcome when processing reaches its record write.
- Notifications bounds its payload; Communications transports a pointer to stored personal content.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/notifications/services/requests/submit-notification-request.ts;
  modules/communications/services/requests/submit-request.ts (header); docs/queued-work.md §5.'
---
# A Submission Is Validated Whole and Travels Complete

## Context

Transported requests must carry enough information to process independently of their producer.

## Decision

Submission doors validate complete envelopes before writes, while processing validates content against the current definition or purpose.

## Alternatives Considered

Partial queued submissions require later producer coordination and cannot be processed independently. Resolving recipients and templates at intake would couple the transaction to mutable delivery configuration.

## Consequences

Envelope refusal leaves the repeat key unused. Processing refusal produces an inspectable invalid outcome when processing reaches its record write. Notifications bounds its payload; Communications transports a pointer to stored personal content.