Isolate Record Refusals And Retain Successful Changes

Context

A large input can contain both valid and invalid records.

Decision and Origin

Record refusals are recorded individually, database refusals are isolated by splitting commit units, and systemic failures or the refusal-rate guard stop further work. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

Alternative Comparison

Commit the entire job atomically: One invalid row would prevent every otherwise valid change.

Load database rows without the domain save path: Direct loading would bypass domain validation, history and derived behavior.

Consequences

Successful changes remain committed when other records are refused.

Refusal evidence uses safe messages, codes and field paths rather than exposing input values.

The guard pauses after more than half of 100–999 attempts are refused, or more than one fifth from 1,000 attempts.