How should event sourcing handle retroactive corrections without breaking read model trust?

In an event-sourced system, some facts arrive late or are corrected after downstream read models have already triggered emails, billing, or risk decisions. Replaying from the start fixes state, but it can also rewrite history in ways users and auditors find misleading. What design patterns work well for handling retroactive corrections while preserving traceability and keeping projections operational? I’m especially interested in tradeoffs between compensating events, versioned projections, and immutable audit timelines.

Ellen

Use compensating events as the legal history, and keep a separate “effective time vs recorded time” timeline in projections.

BobaMilk