---
title: "ADR-046: Compensate failed final FlexForm copy links"
manual: "Secrets Vault"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-vault:adr-046-flexform-copy-link-compensation@main"
source: "Developer/Adr/ADR-046-FlexFormCopyLinkCompensation.rst"
rendered: "2026-10-31T22:32:37+00:00"
---

# ADR-046: Compensate failed final FlexForm copy links {#adr-046-flexform-copy-link-compensation}

## Status {#status}

Accepted

## Date {#date}

2026-10-10

## Context {#context}

ADR018 requires a failed copy to abandon its new secrets and clear references.
FlexForm cloning already handles a failed secret read/store. The final Core
XML serialization and record-link write run outside that boundary, however.
An actual eight-case native Unit counterexample stores a clone before either
final operation throws and proves that its compensation is skipped. A database
write can also take effect before its caller receives an exception.

## Decision {#decision}

Include final serialization and link persistence in the per-column clone
compensation boundary. On failure, abandon successfully stored clones and clear
all recognized source vault positions in that column while preserving other
FlexForm data. Keep plaintext zeroing and normal successful writes unchanged.

Always attempt the clearing update after a failed final link. Equality with
the initially read XML is insufficient: the failing write may already have
changed the record. Treat a failure to serialize or persist the cleared column
as uncertain record state. The existing correlation diagnostic states either
that the column was cleared or that the duplicate may still reference source
or abandoned cloned secrets and needs manual review. It never exposes the raw
failure cause to the editor.

## Consequences {#consequences}

Cleanup remains best-effort and uses existing authorized/audited Vault deletes.
Successful clearing with failed cleanup can leave an orphan. Failed clearing
can retain a reference to a clone whose deletion already took effect; therefore
neither record rollback nor an always-unreferenced orphan is promised.

This decision closes the final-link boundary of one FlexForm column. Coordination
across columns or plain TCA fields, a store that persists before throwing, and
failing diagnostic providers remain separate audit work. No public interface,
database schema or global availability rule changes.

## Related decisions {#related-decisions}

-   [ADR-018: FlexForm secret lifecycle management](https://docs.typo3.org/permalink/netresearch/nr-vault:adr-018-flexform-secret-lifecycle@main)
-   [ADR-036: Mutation and audit are all-or-nothing](https://docs.typo3.org/permalink/netresearch/nr-vault:adr-036-mutation-audit-atomicity@main)

## Current audit follow-up {#current-audit-follow-up}

ADR047 separately contains a failed PSR-3 diagnostic write so that existing
compensation can continue.
It does not establish successful log delivery or contain every diagnostic
collaborator, and it does not close the other residual boundaries above.