Membership Design Examination

The complete design layer and this module’s responsibilities have been independently examined and rewritten by Codex. The examination describes observed implementation and retains proposed design intent; it does not grant product approval. The approved planning layer was used to check scope and capability references and was not changed.

Scope and method

Source files were read from the pinned service and console commits, including declarations, table definitions, registration, callers, durable execution, change-event infrastructure and cited tests. Every declared source and workflow anchor was reviewed for existence and support; corrections distinguish enforcement in services from enforcement in the database. This was a static design examination: the service integration tests, external systems and deployed failure recovery were not executed.

The authoring contract and all available design templates were read before changes. The requested design brief is absent, and the primary Platform standards and Membership architecture remain unavailable in the authorized repositories. Existing references to those standards remain indirect evidence; they do not confirm product intent.

Artifact kind	Examined	Final text written
Domain objects	6	6
State models	13	13
Workflows	27	27
Service contracts	7	7
Screen contracts	1	1
Decision records	20	20
Design total	74	74
Module responsibilities section	1	1

The final wording audit compared 1,351 structured prose fields with the draft and found none unchanged. All artifact bodies were also rewritten. Technical identifiers, pins, provenance and intent were preserved except for the verified corrections recorded below; no artifact was marked approved.

Coverage

Surface	Examined coverage	Limit
Business HTTP operations	54 operations represented in seven contracts	Registration and route behavior checked statically.
Module health operations	3 operations represented	Public health checks counted separately from product behavior.
Named internal and query entry points	21 contract entries	Includes participants, jobs, datasets and infrastructure; these are not additional HTTP routes.
Physical table declarations	42 tables represented by six objects	Version, ledger and join tables remain within their owning aggregate.
Registered module screen	1 route represented by one screen contract	The implemented prototype uses synthetic records.
Explicit durable state machines	3 builders covered by workflows	Billing, roster export and snapshot execution; external durable runtime behavior is not independently exercised.
Change-event queues	Work queue and dead-letter queue covered	Delivery failure, redelivery and missing-handler disposal are documented.
Charter execution and scheduling groups	11 groups covered	Disabled switches and polling cadence are retained; cadence is not a delivery guarantee.
Workflow hops	114 anchored hops	Anchors and their callers checked against the pinned source.
Domain invariants	57 rows examined	Unknown assertions retain their findings rather than gaining invented enforcement.
Inference declarations	All 35 service, workflow and screen contracts carry the required array	No model invocation or inference task was found in the scoped implementation, so no inference operation was invented.

The responsibilities exposure list now matches the contracts’ 78 operation entries and nine distinct produced event keys. Ownership remains with the six declared objects, while CRM, Structure, Commerce, Submissions and Platform retain their respective delegated responsibilities.

Changes by artifact

Every row below includes a complete final-text rewrite. Rows that name a behavioral correction also changed the corresponding structured claim, evidence or enforcement metadata where necessary.

Artifact	Examination result and change
ADR-MBR-MEM-001	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-002	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-003	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-004	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-005	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-006	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-007	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-008	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-009	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-010	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-011	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-012	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-013	Business events are stated with the write; delivery drains transport rather than writing history.
ADR-MBR-MEM-014	Revisions settle at commit without the invented delay; rationale and consequences rewritten.
ADR-MBR-MEM-015	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-016	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-017	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-018	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-019	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
ADR-MBR-MEM-020	Origin references and actual alternatives checked without creating a new product decision; title, rationale, consequences and body rewritten.
DOM-MBR-MEM-001	Holding identity, ownership, standing caches and registered custom fields checked; all descriptions rewritten.
DOM-MBR-MEM-002	Grant periods can exceed the source period under their own rule. A purchase claim is optional, with at most one per term. Invariant provenance and sources corrected.
DOM-MBR-MEM-003	Predecessor references are many-to-one. Unit counts are service-enforced; period bounds also have database enforcement. Cardinality, enforcement and evidence corrected.
DOM-MBR-MEM-004	Application storage and decision ownership checked; absent application custom-field registration retained as an open disagreement.
DOM-MBR-MEM-005	Billing actions, recurring runs, run ownership and durable execution checked; descriptions rewritten.
DOM-MBR-MEM-006	Snapshot settings, captured records, publication and run ownership checked; descriptions rewritten.
SCR-MBR-MEM-001	Synthetic data is generated on the server. Documented the bulk confirmation threshold, absent Add handler, intended authorization and deterministic command parser.
STATE-MBR-MEM-001	Standing is calculated from dated records. Cancellation, imports, conditional restoration and time boundaries corrected; pending cancellation now cites Commerce and names its caller.
STATE-MBR-MEM-002	States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten.
STATE-MBR-MEM-003	States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten.
STATE-MBR-MEM-004	States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten.
STATE-MBR-MEM-005	An effective affiliation can be withdrawn by the explicit end date, subject to continuation references. Added transition and corrected membership locking.
STATE-MBR-MEM-006	Decision outcomes accept every stored application status when decision identity checks pass. Expanded transitions and removed an unsupported refusal.
STATE-MBR-MEM-007	States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten.
STATE-MBR-MEM-008	Separated local action claiming, remote placement and local settlement; stale conflicts distinguished from operational failures.
STATE-MBR-MEM-009	Removed an unsupported refusal to pause an already paused recurrence; rescheduling conditions clarified.
STATE-MBR-MEM-010	Recorded notification and review enforcements can be restored without changing a holding. Added the missing transition.
STATE-MBR-MEM-011	States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten.
STATE-MBR-MEM-012	States, guards, effects, refusals and concurrency checked against the implementation; all explanatory text rewritten.
STATE-MBR-MEM-013	Transport may be discarded without a handler; redelivery is possible. Corrected transitions, settlement meaning and timing.
SVC-MBR-MEM-applications	Exact permission keys and actual list filters corrected. Submissions publication checked against registration; missing intake remains visible.
SVC-MBR-MEM-billing	Operation declarations, access, permissions, capability references, publication, events and jobs checked; all explanatory text rewritten.
SVC-MBR-MEM-commerce-participant	Operation declarations, access, permissions, capability references, publication, events and jobs checked; all explanatory text rewritten.
SVC-MBR-MEM-events	Operation declarations, access, permissions, capability references, publication, events and jobs checked; all explanatory text rewritten.
SVC-MBR-MEM-history	Removed an invented history-settlement queue; commit-time capture distinguished from reading revisions.
SVC-MBR-MEM-memberships	Exact permission keys replace explanatory suffixes. Route access, operations, ownership and publication status checked; all intents rewritten.
SVC-MBR-MEM-snapshots	Operation declarations, access, permissions, capability references, publication, events and jobs checked; all explanatory text rewritten.
WF-MBR-MEM-001	Revision capture settles with the transaction; deferred delivery is business-event transport. Polling has no promised delivery deadline. The combined grant and cache hop now anchors the coordinating creation function.
WF-MBR-MEM-002	Addition, grant propagation, local atomicity and publication wording verified and rewritten. The combined grant and cache hop now anchors the coordinating addition function.
WF-MBR-MEM-003	The owning holding is locked while the supplied term version is checked; correction wording aligned. The event and dependent-period hop now anchors the coordinating correction function.
WF-MBR-MEM-004	Closure branches and scheduling cadence corrected; asynchronous observation has no guaranteed deadline.
WF-MBR-MEM-005	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-006	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-007	CRM reconciliation rolls back all parents for one event together, while other batch events retain independent outcomes. Role-derived dates remain a product question.
WF-MBR-MEM-008	Delivery cadence described as polling rather than a one-minute deadline.
WF-MBR-MEM-009	Corrected owning-holding locks, transfer date refusal and dues restrictions; failure and branch text rewritten.
WF-MBR-MEM-010	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-011	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-012	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-013	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-014	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-015	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-016	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-017	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-018	Corrected lock boundaries and stale, failed and remote-placement outcomes; no cross-service transaction claimed.
WF-MBR-MEM-019	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-020	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-021	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-022	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-023	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
WF-MBR-MEM-024	Snapshot capture now anchors its coordinating generator, which writes all captured row types; failures, retries and publication checked and text rewritten.
WF-MBR-MEM-025	Polling, duplicate delivery, handler absence and acknowledgement failure described without a delivery deadline.
WF-MBR-MEM-026	Replaced a revision-conversion anchor with the registered history stream. Commit-time settlement is synchronous and rollback prevents partial revisions.
WF-MBR-MEM-027	Hop anchors, branch behavior, failures, retries, concurrency and defaults checked; all explanatory text rewritten.
Module responsibilities	Replaced descriptive exposure labels with the exact contracted operation names and produced events; delegation explanations rewritten.

Verification commits precede the principal artifact rewrites. Additional targeted verification commits correct the screen’s data source, responsibilities exposure, workflow timing and branch details, pending cancellation attribution and per-event CRM rollback and compound-hop caller anchors. The final workflow wording pass incorporates those results. No source repository, planning rule, reader or deployment was changed.

The material metadata changes are term-invariant provenance and supporting sources, affiliation cardinality and enforcement locations, exact operation permission keys, the history workflow’s anchor and synchronous seam, coordinating caller anchors for compound creation, addition, correction and snapshot hops, removal of its fictional job, additional supported state transitions and removal of unsupported invalid transitions, and the screen’s data-source evidence. The pending-cancellation transition now cites the Commerce cancellation implementation and names Commerce as its caller. All source pins remain unchanged.

Open disagreements and limits

Reference	Still unresolved
FND-MBR-MEM-030	Placement attributes a write to a source that history rejects, causing the transaction to roll back. The design describes the defect rather than treating fulfilment as proven usable.
FND-MBR-MEM-073, FND-MBR-MEM-075	Earlier planning examination and compound scenario proof remain incomplete; this design pass does not close them.
FND-MBR-MEM-077, OQ-MBR-MEM-007	Configuration uses both merge and replacement update semantics; product consistency is undecided.
FND-MBR-MEM-078, OQ-MBR-MEM-008	Planning names application custom fields but implementation does not register or store them; intake remains incomplete.
FND-MBR-MEM-079	The renewal fence is declared but no owner sets it.
FND-MBR-MEM-080	Primary architectural standards remain inaccessible; indirect citations cannot establish approval.
FND-MBR-MEM-081, OQ-MBR-MEM-009	Child coverage withdrawal dates depend on handling time rather than the underlying CRM change date.
FND-MBR-MEM-082	Newly recorded: the requested design brief is absent from the examination baseline.
OQ-MBR-MEM-001, OQ-MBR-MEM-002	Multiple primary affiliations and the primary affiliation after a merge require product decisions.
OQ-MBR-MEM-003, OQ-MBR-MEM-004	Organizational renewal recipients and officer access to history remain undecided.
OQ-MBR-MEM-005, OQ-MBR-MEM-006	Event catalogue and retention policy, and CRM identity-merge handling, remain undecided.

All existing findings remain available; this table highlights implementation preparation risks rather than replacing the findings register. The synthetic screen’s finding now correctly identifies server generation. No planning disagreement was silently resolved by changing a planning artifact, and no new product answer was inferred from code.

Validation

Dependency installation and the full corpus conformance command passed with zero errors. All four corpus tests passed. These results validate document structure and checker behavior; they do not prove successful service execution, Commerce integration, asynchronous recovery or the prototype’s intended production authorization.

Verdict for Andrew

The revised design is a faithful static account of observable behavior at the pinned commits, including defects and incomplete integration seams. Its weakest support is executable end-to-end proof and direct access to the governing architecture, compounded by incomplete planning examination. Before implementation preparation starts, decide the retained product questions and resolve placement attribution, intake, integration ports and recovery expectations without treating this examination as approval.