sf-fflib-operations

Create a custom metadata type with Disabled and CustomPermission fields, then read it through a single BypassService class using getInstance and FeatureManagement.checkPermission with a static transaction cache. Check the switch once at the top of each domain override, never inside a record loop.

Keep the async class as a thin shell that calls the service, and commit one Unit of Work per chunk or Queueable execution since each is its own transaction. Never pass a UoW or domain instance into a Queueable, and attach a System.Finalizer for failure handling and retry.

Apex forbids callouts after uncommitted DML, and commitWork is DML, so a callout in the same transaction throws uncommitted work pending. Perform the callout first, then register and commit, or move the callout into a Queueable or Finalizer running in a separate transaction.

Deploy fflib-apex-mocks first, then fflib-apex-common, then application code, since the dependency order is fixed. Vendored fflib test classes inflate the org coverage denominator, so exclude them from the package directory or account for them in the coverage gate.

Code Analyzer misfires predictably on fflib: ApexCRUDViolation on selectors enforcing access through fflib_SObjectSelector, FLS violations on writes routed through a custom IDML, and sharing violations on inherited sharing domains. Scope suppressions to the framework path only, never the whole workspace.

Bypassing fflib is legitimate only when the job is pure data movement with no business rules. Document the decision in the job class header, keep the bypass narrow, and run a reconciliation job afterward for any automation side effects that were skipped.