---
title: Membership Design Examination
examined_at: 2026-10-23
examiner: codex
source_sha:
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
branch: agent/membership-memberships-desi-exam-1
provenance: observed
source:
  - services-membership:modules/memberships
  - services-membership:modules/applications
  - services-membership:modules/billing
  - services-membership:modules/commerce-participant
  - services-membership:modules/snapshots
  - services-membership:modules/events
  - services-membership:modules/history
  - services-membership:modules/data-jobs
  - services-membership:aws/membership.change-events.ts
  - services-membership:db/migrations/20261018025135_membership_unit_bound.sql
  - react-console:app/(console)/console/[tenantId]/membership
  - rhythm-v2-docs:specs/CONVENTIONS.md
  - rhythm-v2-docs:specs/membership/memberships/MODULE.md
  - rhythm-v2-docs:specs/membership/memberships/FINDINGS.md
  - rhythm-v2-docs:specs/membership/memberships/ID_REGISTRY.md
validation:
  dependency_install: npm ci
  conformance: npm run check
  conformance_errors: 0
  corpus_tests: npm test
  tests_passed: 4
  tests_failed: 0
---

# Membership Design Examination

The complete design layer and this module’s responsibilities have been independently examined and rewritten by Codex. The examination describes observed implementation and retains proposed design intent; it does not grant product approval. The approved planning layer was used to check scope and capability references and was not changed.

## Scope and method

Source files were read from the pinned service and console commits, including declarations, table definitions, registration, callers, durable execution, change-event infrastructure and cited tests. Every declared source and workflow anchor was reviewed for existence and support; corrections distinguish enforcement in services from enforcement in the database. This was a static design examination: the service integration tests, external systems and deployed failure recovery were not executed.

The authoring contract and all available design templates were read before changes. The requested design brief is absent, and the primary Platform standards and Membership architecture remain unavailable in the authorized repositories. Existing references to those standards remain indirect evidence; they do not confirm product intent.

| Artifact kind | Examined | Final text written |
| --- | ---: | ---: |
| Domain objects | 6 | 6 |
| State models | 13 | 13 |
| Workflows | 27 | 27 |
| Service contracts | 7 | 7 |
| Screen contracts | 1 | 1 |
| Decision records | 20 | 20 |
| Design total | 74 | 74 |
| Module responsibilities section | 1 | 1 |

The final wording audit compared 1,351 structured prose fields with the draft and found none unchanged. All artifact bodies were also rewritten. Technical identifiers, pins, provenance and intent were preserved except for the verified corrections recorded below; no artifact was marked approved.

## Coverage

| Surface | Examined coverage | Limit |
| --- | --- | --- |
| Business HTTP operations | 54 operations represented in seven contracts | Registration and route behavior checked statically. |
| Module health operations | 3 operations represented | Public health checks counted separately from product behavior. |
| Named internal and query entry points | 21 contract entries | Includes participants, jobs, datasets and infrastructure; these are not additional HTTP routes. |
| Physical table declarations | 42 tables represented by six objects | Version, ledger and join tables remain within their owning aggregate. |
| Registered module screen | 1 route represented by one screen contract | The implemented prototype uses synthetic records. |
| Explicit durable state machines | 3 builders covered by workflows | Billing, roster export and snapshot execution; external durable runtime behavior is not independently exercised. |
| Change-event queues | Work queue and dead-letter queue covered | Delivery failure, redelivery and missing-handler disposal are documented. |
| Charter execution and scheduling groups | 11 groups covered | Disabled switches and polling cadence are retained; cadence is not a delivery guarantee. |
| Workflow hops | 114 anchored hops | Anchors and their callers checked against the pinned source. |
| Domain invariants | 57 rows examined | Unknown assertions retain their findings rather than gaining invented enforcement. |
| Inference declarations | All 35 service, workflow and screen contracts carry the required array | No model invocation or inference task was found in the scoped implementation, so no inference operation was invented. |

The responsibilities exposure list now matches the contracts’ 78 operation entries and nine distinct produced event keys. Ownership remains with the six declared objects, while CRM, Structure, Commerce, Submissions and Platform retain their respective delegated responsibilities.

## Changes by artifact

Every row below includes a complete final-text rewrite. Rows that name a behavioral correction also changed the corresponding structured claim, evidence or enforcement metadata where necessary.

| Artifact | Examination result and change |
| --- | --- |
| `ADR-MBR-MEM-001` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-002` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-003` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-004` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-005` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-006` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-007` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-008` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-009` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-010` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-011` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-012` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-013` | Business events are stated with the write; delivery drains transport rather than writing history. |
| `ADR-MBR-MEM-014` | Revisions settle at commit without the invented delay; rationale and consequences rewritten. |
| `ADR-MBR-MEM-015` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-016` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-017` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-018` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-019` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `ADR-MBR-MEM-020` | Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten. |
| `DOM-MBR-MEM-001` | Holding identity, ownership, standing caches and registered custom fields checked; all descriptions rewritten. |
| `DOM-MBR-MEM-002` | Grant periods can exceed the source period under their own rule. A purchase claim is optional, with at most one per term. Invariant provenance and sources corrected. |
| `DOM-MBR-MEM-003` | Predecessor references are many-to-one. Unit counts are service-enforced; period bounds also have database enforcement. Cardinality, enforcement and evidence corrected. |
| `DOM-MBR-MEM-004` | Application storage and decision ownership checked; absent application custom-field registration retained as an open disagreement. |
| `DOM-MBR-MEM-005` | Billing actions, recurring runs, run ownership and durable execution checked; descriptions rewritten. |
| `DOM-MBR-MEM-006` | Snapshot settings, captured records, publication and run ownership checked; descriptions rewritten. |
| `SCR-MBR-MEM-001` | Synthetic data is generated on the server. Documented the bulk confirmation threshold, absent Add handler, intended authorization and deterministic command parser. |
| `STATE-MBR-MEM-001` | Standing is calculated from dated records. Cancellation, imports, conditional restoration and time boundaries corrected; pending cancellation now cites Commerce and names its caller. |
| `STATE-MBR-MEM-002` | States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten. |
| `STATE-MBR-MEM-003` | States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten. |
| `STATE-MBR-MEM-004` | States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten. |
| `STATE-MBR-MEM-005` | An effective affiliation can be withdrawn by the explicit end date, subject to continuation references. Added transition and corrected membership locking. |
| `STATE-MBR-MEM-006` | Decision outcomes accept every stored application status when decision identity checks pass. Expanded transitions and removed an unsupported refusal. |
| `STATE-MBR-MEM-007` | States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten. |
| `STATE-MBR-MEM-008` | Separated local action claiming, remote placement and local settlement; stale conflicts distinguished from operational failures. |
| `STATE-MBR-MEM-009` | Removed an unsupported refusal to pause an already paused recurrence; rescheduling conditions clarified. |
| `STATE-MBR-MEM-010` | Recorded notification and review enforcements can be restored without changing a holding. Added the missing transition. |
| `STATE-MBR-MEM-011` | States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten. |
| `STATE-MBR-MEM-012` | States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten. |
| `STATE-MBR-MEM-013` | Transport may be discarded without a handler; redelivery is possible. Corrected transitions, settlement meaning and timing. |
| `SVC-MBR-MEM-applications` | Exact permission keys and actual list filters corrected. Submissions publication checked against registration; missing intake remains visible. |
| `SVC-MBR-MEM-billing` | Operation declarations, access, permissions, capability references, publication, events and jobs checked; all explanatory text rewritten. |
| `SVC-MBR-MEM-commerce-participant` | Operation declarations, access, permissions, capability references, publication, events and jobs checked; all explanatory text rewritten. |
| `SVC-MBR-MEM-events` | Operation declarations, access, permissions, capability references, publication, events and jobs checked; all explanatory text rewritten. |
| `SVC-MBR-MEM-history` | Removed an invented history-settlement queue; commit-time capture distinguished from reading revisions. |
| `SVC-MBR-MEM-memberships` | Exact permission keys replace explanatory suffixes. Route access, operations, ownership and publication status checked; all intents rewritten. |
| `SVC-MBR-MEM-snapshots` | Operation declarations, access, permissions, capability references, publication, events and jobs checked; all explanatory text rewritten. |
| `WF-MBR-MEM-001` | Revision capture settles with the transaction; deferred delivery is business-event transport. Polling has no promised delivery deadline. The combined grant and cache hop now anchors the coordinating creation function. |
| `WF-MBR-MEM-002` | Addition, grant propagation, local atomicity and publication wording verified and rewritten. The combined grant and cache hop now anchors the coordinating addition function. |
| `WF-MBR-MEM-003` | The owning holding is locked while the supplied term version is checked; correction wording aligned. The event and dependent-period hop now anchors the coordinating correction function. |
| `WF-MBR-MEM-004` | Closure branches and scheduling cadence corrected; asynchronous observation has no guaranteed deadline. |
| `WF-MBR-MEM-005` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-006` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-007` | CRM reconciliation rolls back all parents for one event together, while other batch events retain independent outcomes. Role-derived dates remain a product question. |
| `WF-MBR-MEM-008` | Delivery cadence described as polling rather than a one-minute deadline. |
| `WF-MBR-MEM-009` | Corrected owning-holding locks, transfer date refusal and dues restrictions; failure and branch text rewritten. |
| `WF-MBR-MEM-010` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-011` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-012` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-013` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-014` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-015` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-016` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-017` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-018` | Corrected lock boundaries and stale, failed and remote-placement outcomes; no cross-service transaction claimed. |
| `WF-MBR-MEM-019` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-020` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-021` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-022` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-023` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| `WF-MBR-MEM-024` | Snapshot capture now anchors its coordinating generator, which writes all captured row types; failures, retries and publication checked and text rewritten. |
| `WF-MBR-MEM-025` | Polling, duplicate delivery, handler absence and acknowledgement failure described without a delivery deadline. |
| `WF-MBR-MEM-026` | Replaced a revision-conversion anchor with the registered history stream. Commit-time settlement is synchronous and rollback prevents partial revisions. |
| `WF-MBR-MEM-027` | Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten. |
| Module responsibilities | Replaced descriptive exposure labels with the exact contracted operation names and produced events; delegation explanations rewritten. |

Verification commits precede the principal artifact rewrites. Additional targeted verification commits correct the screen’s data source, responsibilities exposure, workflow timing and branch details, pending cancellation attribution and per-event CRM rollback and compound-hop caller anchors. The final workflow wording pass incorporates those results. No source repository, planning rule, reader or deployment was changed.

The material metadata changes are term-invariant provenance and supporting sources, affiliation cardinality and enforcement locations, exact operation permission keys, the history workflow’s anchor and synchronous seam, coordinating caller anchors for compound creation, addition, correction and snapshot hops, removal of its fictional job, additional supported state transitions and removal of unsupported invalid transitions, and the screen’s data-source evidence. The pending-cancellation transition now cites the Commerce cancellation implementation and names Commerce as its caller. All source pins remain unchanged.

## Open disagreements and limits

| Reference | Still unresolved |
| --- | --- |
| `FND-MBR-MEM-030` | Placement attributes a write to a source that history rejects, causing the transaction to roll back. The design describes the defect rather than treating fulfilment as proven usable. |
| `FND-MBR-MEM-073`, `FND-MBR-MEM-075` | Earlier planning examination and compound scenario proof remain incomplete; this design pass does not close them. |
| `FND-MBR-MEM-077`, `OQ-MBR-MEM-007` | Configuration uses both merge and replacement update semantics; product consistency is undecided. |
| `FND-MBR-MEM-078`, `OQ-MBR-MEM-008` | Planning names application custom fields but implementation does not register or store them; intake remains incomplete. |
| `FND-MBR-MEM-079` | The renewal fence is declared but no owner sets it. |
| `FND-MBR-MEM-080` | Primary architectural standards remain inaccessible; indirect citations cannot establish approval. |
| `FND-MBR-MEM-081`, `OQ-MBR-MEM-009` | Child coverage withdrawal dates depend on handling time rather than the underlying CRM change date. |
| `FND-MBR-MEM-082` | Newly recorded: the requested design brief is absent from the examination baseline. |
| `OQ-MBR-MEM-001`, `OQ-MBR-MEM-002` | Multiple primary affiliations and the primary affiliation after a merge require product decisions. |
| `OQ-MBR-MEM-003`, `OQ-MBR-MEM-004` | Organizational renewal recipients and officer access to history remain undecided. |
| `OQ-MBR-MEM-005`, `OQ-MBR-MEM-006` | Event catalogue and retention policy, and CRM identity-merge handling, remain undecided. |

All existing findings remain available; this table highlights implementation preparation risks rather than replacing the findings register. The synthetic screen’s finding now correctly identifies server generation. No planning disagreement was silently resolved by changing a planning artifact, and no new product answer was inferred from code.

## Validation

Dependency installation and the full corpus conformance command passed with zero errors. All four corpus tests passed. These results validate document structure and checker behavior; they do not prove successful service execution, Commerce integration, asynchronous recovery or the prototype’s intended production authorization.

## Verdict for Andrew

The revised design is a faithful static account of observable behavior at the pinned commits, including defects and incomplete integration seams. Its weakest support is executable end-to-end proof and direct access to the governing architecture, compounded by incomplete planning examination. Before implementation preparation starts, decide the retained product questions and resolve placement attribution, intake, integration ports and recovery expectations without treating this examination as approval.