DomainDefinition.ADD installs a service named for the capability, plus another that has that name with "initial" appended. But DomainDefinition.REMOVE only removes the former. The result is if you do a remove of the domain with allow-resource-service-restart=true, it fails because the 'initial' service is left behind with missing dependencies. Rollback also fails because the 'initial' service is already present so can't be restored.