case.status = "ESCALATED"

CaseRegistered
EvidenceSubmitted
RiskScoreCalculated
SupervisorReviewRequested
CaseEscalated

Use event sourcing when losing the sequence of decisions would destroy business meaning.
Do not use it merely because the architecture is event-driven.

Something changed. Go ask the owner if you need details.

{
  "eventType": "CaseEscalated",
  "caseId": "CASE-2026-00091"
}

Something changed, and here is enough state for consumers to update their local read model.

{
  "eventType": "CaseEscalated",
  "caseId": "CASE-2026-00091",
  "newStatus": "ESCALATED",
  "escalationLevel": "REGIONAL_SUPERVISOR",
  "occurredAt": "2026-07-05T10:15:30Z"
}

Record who did what for evidence, security, compliance, and diagnostics.

The authoritative write model is the event stream.
State is derived from events.

If nobody in the business asks "how did this state come to exist?", event sourcing is probably overkill.

{
  "commandId": "cmd-721",
  "commandType": "EscalateCase",
  "caseId": "CASE-2026-00091",
  "requestedBy": "user-117",
  "reason": "Evidence indicates systemic violation",
  "expectedVersion": 14
}

{
  "eventId": "evt-991",
  "eventType": "CaseEscalated",
  "aggregateId": "CASE-2026-00091",
  "aggregateType": "Case",
  "streamVersion": 15,
  "occurredAt": "2026-07-05T10:15:30Z",
  "actorId": "user-117",
  "causationId": "cmd-721",
  "correlationId": "corr-882",
  "payload": {
    "fromStatus": "UNDER_REVIEW",
    "toStatus": "ESCALATED",
    "escalationLevel": "REGIONAL_SUPERVISOR",
    "reasonCode": "SYSTEMIC_RISK"
  }
}

case_id              status       escalation_level        last_updated_at
CASE-2026-00091      ESCALATED    REGIONAL_SUPERVISOR     2026-07-05T10:15:30Z

case-CASE-2026-00091
investigation-INV-2026-00311
enforcement-decision-DEC-2026-00077
party-PARTY-991

case-title-CASE-1
case-status-CASE-1
case-assignee-CASE-1
case-priority-CASE-1

case-CASE-1

tenant-TENANT-1-all-events

CaseAndPartyAndInvoiceUpdated

CaseEscalated
PartyRiskFlagRaised
InvoiceReviewRequested

public final class CaseAggregate {
    private CaseId id;
    private CaseStatus status;
    private long version;
    private boolean supervisorReviewOpen;
    private final List<DomainEvent> changes = new ArrayList<>();

    public static CaseAggregate rehydrate(List<StoredEvent> history) {
        CaseAggregate aggregate = new CaseAggregate();
        for (StoredEvent event : history) {
            aggregate.apply(event.toDomainEvent());
            aggregate.version = event.streamVersion();
        }
        return aggregate;
    }

    public void escalate(EscalateCase command) {
        if (status != CaseStatus.UNDER_REVIEW) {
            throw new DomainRuleViolation("Only under-review cases can be escalated");
        }
        if (supervisorReviewOpen) {
            throw new DomainRuleViolation("Cannot escalate while supervisor review is open");
        }

        recordThat(new CaseEscalated(
            command.caseId(),
            command.reasonCode(),
            command.requestedBy(),
            command.occurredAt()
        ));
    }

    private void recordThat(DomainEvent event) {
        apply(event);
        changes.add(event);
    }

    private void apply(DomainEvent event) {
        switch (event) {
            case CaseRegistered e -> {
                this.id = e.caseId();
                this.status = CaseStatus.REGISTERED;
            }
            case CaseMovedToReview e -> this.status = CaseStatus.UNDER_REVIEW;
            case SupervisorReviewRequested e -> this.supervisorReviewOpen = true;
            case SupervisorReviewCompleted e -> this.supervisorReviewOpen = false;
            case CaseEscalated e -> this.status = CaseStatus.ESCALATED;
            default -> throw new IllegalArgumentException("Unsupported event " + event.getClass());
        }
    }

    public List<DomainEvent> changes() {
        return List.copyOf(changes);
    }

    public long version() {
        return version;
    }
}

apply(event) mutates state from fact.
handle(command) validates intent and records new fact.

public void escalate(EscalateCase command) {
    riskClient.recalculate(...); // wrong boundary
    emailClient.send(...);       // wrong boundary
    recordThat(new CaseEscalated(...));
}

Aggregate emits CaseEscalated.
Application service appends event.
Projector/process manager reacts.
External side effects are handled through outbox/consumer/inbox.

public final class EscalateCaseHandler {
    private final EventStore eventStore;
    private final EventMetadataFactory metadataFactory;

    public EscalateCaseResult handle(EscalateCase command) {
        StreamName stream = StreamName.of("case-" + command.caseId().value());

        EventStream history = eventStore.load(stream);
        CaseAggregate aggregate = CaseAggregate.rehydrate(history.events());

        aggregate.escalate(command);

        List<NewEvent> newEvents = aggregate.changes().stream()
            .map(event -> NewEvent.from(event, metadataFactory.from(command)))
            .toList();

        AppendResult result = eventStore.append(
            stream,
            ExpectedVersion.exact(history.version()),
            newEvents
        );

        return new EscalateCaseResult(command.caseId(), result.nextVersion());
    }
}

I made this decision based on version 14.
Append only if stream is still version 14.

try {
    eventStore.append(stream, ExpectedVersion.exact(command.expectedVersion()), events);
} catch (WrongExpectedVersionException conflict) {
    throw new ConcurrentModification("Case changed before escalation was committed", conflict);
}

CREATE TABLE event_store (
    global_position      BIGSERIAL PRIMARY KEY,
    stream_name          TEXT NOT NULL,
    stream_version       BIGINT NOT NULL,
    event_id             UUID NOT NULL UNIQUE,
    event_type           TEXT NOT NULL,
    event_schema_version INTEGER NOT NULL,
    occurred_at          TIMESTAMPTZ NOT NULL,
    recorded_at          TIMESTAMPTZ NOT NULL DEFAULT now(),
    actor_id             TEXT,
    tenant_id            TEXT,
    correlation_id        TEXT,
    causation_id          TEXT,
    payload              JSONB NOT NULL,
    metadata             JSONB NOT NULL DEFAULT '{}'::jsonb,
    UNIQUE(stream_name, stream_version)
);

CREATE INDEX idx_event_store_stream
    ON event_store(stream_name, stream_version);

CREATE INDEX idx_event_store_global_position
    ON event_store(global_position);

CREATE INDEX idx_event_store_type_position
    ON event_store(event_type, global_position);

public AppendResult append(StreamName stream,
                           ExpectedVersion expectedVersion,
                           List<NewEvent> newEvents) {
    return transaction.execute(() -> {
        long currentVersion = lockAndGetCurrentVersion(stream);
        expectedVersion.verify(currentVersion);

        long next = currentVersion;
        for (NewEvent event : newEvents) {
            next++;
            insertEvent(stream, next, event);
        }
        return new AppendResult(stream, next);
    });
}

CaseRegistered
CaseAcceptedForReview
EvidenceSubmitted
SupervisorReviewRequested
SupervisorReviewCompleted
CaseEscalated
CaseClosed

CaseUpdated
StatusChanged
DBRowModified
SaveCaseCalled
CaseEvent

CaseMovedToReview
CaseEscalated
CaseResolvedWithoutAction
CaseReopenedDueToAppeal

{
  "caseId": "CASE-2026-00091",
  "fromStatus": "UNDER_REVIEW",
  "toStatus": "ESCALATED",
  "escalationLevel": "REGIONAL_SUPERVISOR",
  "reasonCode": "SYSTEMIC_RISK",
  "policyVersion": "ENF-POLICY-2026.04",
  "decisionSnapshot": {
    "riskBand": "HIGH",
    "evidenceCount": 14
  }
}

Can I understand and rebuild the business state from this event 3 years later?

{
  "eventId": "evt-991",
  "eventType": "CaseEscalated",
  "streamName": "case-CASE-2026-00091",
  "streamVersion": 15,
  "eventSchemaVersion": 2,
  "metadata": {
    "tenantId": "tenant-a",
    "actorId": "user-117",
    "actorType": "HUMAN_USER",
    "correlationId": "corr-882",
    "causationId": "cmd-721",
    "requestId": "req-551",
    "sourceService": "case-command-service",
    "sourceVersion": "2026.07.05-1421",
    "traceparent": "00-..."
  },
  "payload": {
    "caseId": "CASE-2026-00091",
    "reasonCode": "SYSTEMIC_RISK"
  }
}

CREATE TABLE case_list_view (
    case_id              TEXT PRIMARY KEY,
    status               TEXT NOT NULL,
    priority             TEXT NOT NULL,
    assigned_team_id      TEXT,
    last_event_position   BIGINT NOT NULL,
    last_event_id         UUID NOT NULL,
    last_updated_at       TIMESTAMPTZ NOT NULL
);

public final class CaseListProjector {
    private final CaseListViewRepository repository;
    private final ProjectionCheckpointStore checkpointStore;

    public void handle(StoredEvent stored) {
        if (checkpointStore.alreadyProcessed("case-list", stored.globalPosition())) {
            return;
        }

        switch (stored.event()) {
            case CaseRegistered e -> repository.insert(new CaseListRow(
                e.caseId(), "REGISTERED", e.priority(), null, stored.globalPosition()
            ));
            case CaseMovedToReview e -> repository.updateStatus(
                e.caseId(), "UNDER_REVIEW", stored.globalPosition()
            );
            case CaseAssigned e -> repository.updateAssignee(
                e.caseId(), e.teamId(), stored.globalPosition()
            );
            case CaseEscalated e -> repository.updateStatusAndPriority(
                e.caseId(), "ESCALATED", "HIGH", stored.globalPosition()
            );
            default -> { /* irrelevant event */ }
        }

        checkpointStore.markProcessed("case-list", stored.globalPosition());
    }
}

{
  "caseId": "CASE-2026-00091",
  "acceptedVersion": 15
}

{
  "caseId": "CASE-2026-00091",
  "acceptedVersion": 15,
  "readModelCatchupToken": "case-list@global-position-802711"
}

Append event.
Wait up to 300ms for projection >= event position.
Return fresh view if ready, otherwise return 202 with catch-up token.

User escalates a case.
System says success.
List still shows UNDER_REVIEW.
User clicks again.
Duplicate command happens.

System says escalation accepted.
Screen marks row as pending refresh until projection catches up.
Duplicate command is idempotently ignored.

CREATE TABLE aggregate_snapshot (
    stream_name       TEXT PRIMARY KEY,
    stream_version    BIGINT NOT NULL,
    aggregate_type    TEXT NOT NULL,
    schema_version    INTEGER NOT NULL,
    payload           JSONB NOT NULL,
    created_at        TIMESTAMPTZ NOT NULL DEFAULT now()
);

{
  "eventType": "CaseEscalated",
  "schemaVersion": 2,
  "payload": {
    "caseId": "CASE-1",
    "reasonCode": "SYSTEMIC_RISK",
    "policyVersion": "ENF-POLICY-2026.04"
  }
}

public final class CaseEscalatedUpcaster implements EventUpcaster {
    public boolean supports(StoredEvent event) {
        return event.type().equals("CaseEscalated") && event.schemaVersion() == 1;
    }

    public StoredEvent upcast(StoredEvent old) {
        JsonNode payload = old.payload();
        ObjectNode upgraded = payload.deepCopy();
        upgraded.put("policyVersion", "UNKNOWN_PRE_2026");
        return old.withPayload(upgraded).withSchemaVersion(2);
    }
}

CaseEscalated
CaseEscalationReasonCorrected

CaseRiskBandRecomputed

CaseRiskProfileChanged

Your event store is not automatically your integration event bus.

One global enterprise event store where every service appends every event to shared streams.

Case Service owns case streams.
Evidence Service owns evidence streams.
Decision Service owns decision streams.
Workflow Service owns process instance streams.
Each publishes integration events intentionally.

CaseAggregate calls EvidenceService, DecisionService, NotificationService.

CaseAggregate emits CaseEscalated.
Workflow consumes it and issues commands to other boundaries.
Each boundary owns its local stream and invariants.

{
  "eventType": "PartyRegistered",
  "payload": {
    "fullName": "...",
    "passportNumber": "...",
    "homeAddress": "..."
  }
}

{
  "eventType": "PartyRegistered",
  "payload": {
    "partyId": "PARTY-991",
    "identityProfileRef": "profile-abc"
  }
}

PartyPersonalDataRedacted

Event: EvidenceSubmitted(evidenceId, evidenceType, submittedBy)
Sensitive content: evidence vault keyed by evidenceId

Which event fields are personal data?
Which fields are special-category or highly sensitive?
Can replay work after redaction?
Can audit work after redaction?
Who can access raw events?
Are DLQ/search/logs duplicating sensitive event payloads?

hash(v15) = SHA256(hash(v14) + eventId + streamName + streamVersion + payloadHash + metadataHash)

POST /cases/{id}/escalations
  load_stream case-CASE-1
  rehydrate CaseAggregate
  handle EscalateCase
  append_events case-CASE-1 expected=14 actual=14
  publish_outbox CaseEscalated

Can the projector process historical versions?
Are upcasters tested?
Can rebuild run without exhausting DB/broker?
Can rebuild be paused/resumed?
Is projection swap atomic?
Are users protected from partial rebuild results?
Can sensitive data redaction still apply during replay?

@Test
void escalatesUnderReviewCase() {
    given(
        new CaseRegistered(caseId, Priority.NORMAL),
        new CaseMovedToReview(caseId)
    ).when(
        new EscalateCase(caseId, ReasonCode.SYSTEMIC_RISK, officerId)
    ).then(
        new CaseEscalated(caseId, ReasonCode.SYSTEMIC_RISK, officerId)
    );
}

@Test
void canReplayHistoricalCaseStreams() {
    List<StoredEvent> sample = historicalSamples.load("case-streams-2025-q4.jsonl");
    for (StoredEvent event : sample) {
        CaseAggregate.rehydrate(List.of(event));
    }
}

@Test
void upcastsCaseEscalatedV1ToV2() {
    StoredEvent old = sample("CaseEscalated-v1.json");
    StoredEvent upgraded = upcaster.upcast(old);

    assertThat(upgraded.schemaVersion()).isEqualTo(2);
    assertThat(upgraded.payload().get("policyVersion").asText()).isEqualTo("UNKNOWN_PRE_2026");
}

@Test
void projectorCanHandleDuplicateEvent() {
    projector.handle(caseEscalatedV15);
    projector.handle(caseEscalatedV15);

    assertThat(viewRepository.find(caseId).status()).isEqualTo("ESCALATED");
    assertThat(viewRepository.find(caseId).lastEventPosition()).isEqualTo(802711L);
}

Build projection from fixture stream.
Compare expected read model.
Drop projection.
Rebuild again.
Compare same checksum.

0–3 high signals: avoid event sourcing.
4–6 high signals: consider local event sourcing for selected aggregates.
7–8 high signals: event sourcing may be a good fit, but still require ADR and operational plan.

# ADR: Use Event Sourcing for <Aggregate/Service>

## Context
- Domain lifecycle:
- Audit/reconstruction requirement:
- Query/read model requirement:
- Expected event volume:
- Retention/privacy requirement:

## Decision
We will / will not use event sourcing for ...

## Stream Boundary
- Aggregate stream:
- Expected max events per stream:
- Snapshot policy:

## Event Model
- Initial event types:
- Public vs private events:
- Integration event translation:

## Consistency Model
- Command concurrency:
- Projection lag contract:
- User-visible read-after-write behavior:

## Schema Evolution
- Event versioning:
- Upcasting:
- Historical sample tests:

## Privacy/Security
- Sensitive fields:
- Redaction/erasure approach:
- Raw event access control:

## Operations
- Projection rebuild:
- Monitoring:
- DLQ:
- Replay tooling:

## Alternatives Rejected
- Normal relational state + audit log:
- Outbox + projections only:
- CQRS without event sourcing:

## Consequences
- Benefits:
- Costs:
- New failure modes:

[ ] Stream boundary documented.
[ ] Event names are domain facts, not CRUD updates.
[ ] Append uses optimistic concurrency.
[ ] Event store append is atomic.
[ ] Event metadata includes actor/correlation/causation/tenant.
[ ] Projection lag is measured.
[ ] Projectors are idempotent.
[ ] Projection rebuild has been tested.
[ ] Historical event samples are stored for replay tests.
[ ] Event schema evolution strategy exists.
[ ] Upcasters are tested.
[ ] Sensitive fields are classified.
[ ] Privacy/redaction model is documented.
[ ] Raw event access is restricted.
[ ] Public integration events are separated from private stream events.
[ ] Replay tooling is safe and throttled.
[ ] Runbook covers projection failure and replay.

com.example.casecommand
  api
    CaseCommandController.java
    EscalateCaseRequest.java
    CaseCommandErrorMapper.java
  application
    EscalateCaseHandler.java
    RegisterCaseHandler.java
    CommandMetadataFactory.java
  domain
    CaseAggregate.java
    CaseStatus.java
    events
      CaseRegistered.java
      CaseMovedToReview.java
      CaseEscalated.java
    commands
      EscalateCase.java
    rules
      CaseEscalationPolicy.java
  infrastructure
    eventstore
      EventStore.java
      JdbcEventStore.java
      StoredEvent.java
      ExpectedVersion.java
      EventSerializer.java
      EventUpcasterChain.java
    projection
      CaseListProjector.java
      ProjectionCheckpointStore.java
    outbox
      IntegrationEventPublisher.java

domain does not depend on infrastructure.
application coordinates domain + ports.
infrastructure implements event store/projection/publishing.

v1  CaseRegistered
v2  EvidenceSubmitted
v3  EvidenceSubmitted
v4  CaseMovedToReview
v5  RiskScoreCalculated
v6  SupervisorReviewRequested
v7  SupervisorReviewCompleted
v8  CaseEscalated

{
  "caseId": "CASE-2026-00091",
  "status": "ESCALATED",
  "evidenceCount": 2,
  "riskBand": "HIGH",
  "supervisorReviewOpen": false
}

The case was escalated because the high-risk score was calculated after two evidence submissions, supervisor review completed, and escalation policy ENF-POLICY-2026.04 allowed regional supervisor escalation.

Can we implement event sourcing?

Is the business history valuable enough to pay for event sourcing forever?