---
id: ADR-MBR-MEM-009
title: Review Plans Before Durable Renewal Execution
product_area: membership
module: memberships
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Billing stores reviewed actions and term versions, uses durable execution and
  stable order keys, and separates external placement from local action
  settlement.
constrains:
  - DOM-MBR-MEM-005
  - STATE-MBR-MEM-007
  - STATE-MBR-MEM-008
  - WF-MBR-MEM-017
  - WF-MBR-MEM-018
  - SVC-MBR-MEM-billing
origin: >-
  The membership architecture's commerce and finance chapter (billing runs,
  1.0's stale-term guard), as the billing run records it
alternatives:
  - option: Act directly when a run is created
    why_not: Immediate execution at creation would remove the review boundary.
  - option: Execute in one long transaction
    why_not: >-
      One long execution transaction would hold broad locks and discard the
      batch on interruption.
consequences:
  - Settled actions survive interruption and are skipped by later execution.
  - >-
    The failure consequence can return a run to planned, but unstarted jobs have
    no deployed recovery.
  - >-
    Placed pending coverage supplies the billed fact without a pre-placement
    flag.
supersedes: []
evidence:
  - >-
    services-membership at 5994c270: modules/billing/services/**;
    aws/logic/billing-run.step-function.ts
---

# Review Plans Before Durable Renewal Execution

## Context

Renewal work can be large and member facts can change between review and execution. Planning stores a candidate version so execution can detect that change.

## Decision

Billing stores reviewed actions and term versions, uses durable execution and stable order keys, and separates external placement from local action settlement.

## Alternatives Considered

Act directly when a run is created: Immediate execution at creation would remove the review boundary.

Execute in one long transaction: One long execution transaction would hold broad locks and discard the batch on interruption.

## Consequences

Settled actions survive interruption and are skipped by later execution. The failure consequence can return a run to planned, but unstarted jobs have no deployed recovery. Placed pending coverage supplies the billed fact without a pre-placement flag.