Records of accepted decisions and their history. Each ADR captures the context, the decision, and its consequences, so the reasoning survives past the commit that carried the code.
Status distinguishes current decisions from superseded rules. A superseded record remains available and links to its replacement.
| ADR | Title | Status |
|---|---|---|
| 0001 | Reserved-header trust model and out-of-band signaling | accepted |
| 0002 | Credential rotation: build-first, commit-after-success | accepted |
| 0003 | MQTT persistent-session subscription hygiene | accepted |
| 0004 | Single-use runtime lifecycle and terminal wedge | accepted |
| 0005 | Outbox partition design: claim selection, fence rows, seq allocation | accepted |
| 0006 | DLQ redrive at-most-once | superseded by 0015 |
| 0007 | Cluster worker seeding: AdoptValid default | rollout superseded by 0012; startup replaced by strict initialization |
| 0008 | Cross-hop bridge-to-bridge identity lift | accepted |
| 0009 | Durable outbound MQTT session state: in-memory store, route-layer durability | accepted |
| 0010 | MQTT bridge-to-bridge loop-prevention contract | accepted |
| 0011 | Cluster client-ID uniqueness enforcement | accepted |
| 0012 | Cluster config changes require whole-cohort replacement | superseded by 0013 (live-safe deltas) |
| 0013 | Coordinated cluster config rollout for live-safe deltas | accepted |
| 0014 | Confirm window: provisional commit with deadman revert | accepted |
| 0015 | DLQ redrive inject-then-delete (at-least-once) | accepted |
ADRs are numbered sequentially from 0001. Filenames are NNNN-<slug>.md. A
superseded ADR keeps its number and gains a Superseded by NNNN line; it is
never deleted or renumbered.