The decision records
An architecture decision record is written for any decision that is hard to reverse,
was genuinely contested, or where a plausible alternative was rejected. Routine choices
do not earn one. Each record carries Status, Context, Decision and Consequences, is
numbered sequentially, and is dated. Superseded records are kept and marked, never
deleted — the numbering continues across the version boundary rather than restarting,
so a record's number is a fixed address for the life of the project.
The records live in the repository, at docs/adr/. They are published here from there:
the direction of travel is out of the repository record and into the site, never the
other way, and nothing on this site is the master copy of a decision.
The status column is read out of each record, not retyped beside it. A record
amended by a later one says so in its own status line and therefore says so here. That
is the whole reason the table is generated: V1's index was hand-maintained, and the
first thing that went wrong with it was a status that had moved on in the record and
not in the list.
Records 0001 to 0026 belong to Version 1 and describe software that has been retired.
They are kept because the reasoning is the part worth keeping, and each carries a banner
saying what it is. 0027 is the reversal itself; the records from 0028 on are
Version 2's.
| # |
Decision |
Status |
| 0001 |
Binary access rather than tiered or per-field |
Accepted, amended by ADR-0020 |
| 0002 |
Decorrelation timescale is a field, authored per feature |
Accepted |
| 0003 |
Trajectory queries are served by a bespoke pygeoapi provider |
Accepted |
| 0004 |
SensorThings is served by a bespoke pygeoapi provider |
Accepted |
| 0005 |
Sound speed is derived at the point of use, not stored |
Accepted |
| 0006 |
Heartbeat cadence and liveness windows are real time |
Accepted |
| 0007 |
Host time may smooth the display between clock samples |
Accepted |
| 0008 |
Control messages reach the client by WebSocket upgrade at the proxy |
Accepted |
| 0009 |
The clock publishes on the control namespace, and gains a lockstep mode |
Accepted |
| 0010 |
Tooling for the published site |
Superseded by ADR-0031 |
| 0011 |
The current-run pointer is a text file, not a symlink |
Accepted |
| 0012 |
Sensors and the ingest client may read the clock, and nothing else on the control branch |
Accepted |
| 0013 |
A leakage statistic is scored per released variable, and the worst one is the answer |
Accepted |
| 0014 |
Quality flagging is the ingestion seam, not a field on an observation |
Accepted |
| 0015 |
A sensor may announce itself, because the alternative was a display that lied |
Accepted |
| 0016 |
No component could authenticate, and the credential path is now whole |
Accepted, and amended the same day — see "What changed a few hours later" |
| 0018 |
common.json is a root seed, and the defaults mechanism it describes does not exist |
Accepted |
| 0019 |
The planner's threshold stays absolute, and now has something to check it against |
Accepted |
| 0020 |
Clearance is binary for the released prefix and delegated for the control upgrade |
Accepted |
| 0021 |
The clock's HTTP interface answers the browser from any origin |
Accepted (by the owner, 28 August 2026, by structured interview) — to be superseded by ADR-0025 when the clock's control surface is routed through the boundary (wave 7, lane I); it records the running system's shape until then |
| 0022 |
The type chain's generators, and why the TypeScript half is ours |
Accepted |
| 0023 |
The observation store authenticates by trust, and models no database threat |
Accepted |
| 0024 |
The advisory store is a third schema, not a second engine |
Accepted |
| 0025 |
The operator plane sits behind the clearance, and the clock joins it there |
Accepted |
| 0026 |
The third wall-clock exemption is resource sampling, and the socket stops at the door |
Accepted |
| 0027 |
Version 2 is a client-side rewrite behind a wire-protocol seam |
Accepted, 29 August 2026, with the adoption of constitution 2.0.0. The |
| 0028 |
dockview hosts the shell |
Accepted; amended by ADR-0032 (addressability goes below the panel) |
| 0029 |
the HTTP seam is a fetch-level shim, not a Service Worker |
Accepted |
| 0030 |
components are scheduled modules on the main thread, wired by one composition root |
Accepted |
| 0031 |
The site is built in TypeScript, and the estate has two tenants |
Accepted, 29 August 2026. Supersedes ADR-0010 (V1 site tooling) |
| 0032 |
addressability goes below the panel |
Accepted |
| 0033 |
two presentations of one shell |
Accepted |
| 0034 |
ownship state is measured, not declared |
Accepted |
| 0035 |
the operator tab is a flow chart |
Accepted |
| 0036 |
the shell may derive, and says so |
Accepted |
| 0037 |
the help control belongs to the panel |
Accepted |
| 0038 |
measurements reach the field |
Accepted |
| 0039 |
a consumer may synthesise its own inputs; it may never synthesise drogna's |
Accepted |
| 0040 |
a run arrives by having run |
Accepted |
| 0041 |
seed data may be built ahead of time, under a gate |
Accepted, amended 3 September 2026 (feature 125: the forecast eras declared) |
| 0042 |
the forward step is a second kernel, and it becomes the default |
Accepted |
| 0043 |
a run costs simulation time, and the loop is not becalmed by it |
Accepted |