---
id: ADR-ACC-PRD-008
title: Owned Template Changes Cross the Product Transaction Boundary
product_area: accounting
module: products
revision: 3
status: proposed
design_intent: proposed
source_sha:
  services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: Accounting calls Platform to save or clear owned content before local product commit and attempts
  cleanup after deletion, logging failures without compensation.
constrains:
- SVC-ACC-PRD-products
- WF-ACC-PRD-001
- WF-ACC-PRD-003
- STATE-ACC-PRD-004
- DOM-ACC-PRD-001
origin: none
alternatives:
- option: Validate remotely before committing locally, then compensate a failed remote write.
  why_not: The code has no such orchestration, and compensation would still need defined recovery.
- option: Clear templates before committing deletion.
  why_not: Platform outages would then block otherwise permitted product removal.
consequences:
- A remote change may survive a lost answer, failed response read or failed local commit.
- Waiting for Platform holds the product row lock.
- Delete cleanup failure relies on operator attention to logs.
supersedes: []
evidence:
- 'services-accounting at f47cb263: modules/products/services/confirmation-emails/confirmation-email-templates.ts
  (header); tests/integration/services/persistence/products.features.integration.spec.js.'
---

# Owned Template Changes Cross the Product Transaction Boundary

## Context

Confirmation selection is local, but its owned content belongs to Platform. The implementation waits for Platform without making it part of Accounting's transaction.

## Decision

Accounting calls Platform to save or clear owned content before local product commit and attempts cleanup after deletion, logging failures without compensation.

## Alternatives Considered

Validate remotely before committing locally, then compensate a failed remote write. The code has no such orchestration, and compensation would still need defined recovery.

Clear templates before committing deletion. Platform outages would then block otherwise permitted product removal.

## Consequences

Recovery and durable reconciliation remain unresolved. The observed call order supplies no guarantee that remote and local records commit together.