Decision records
Each record states the context, the decision and its consequences, and is amended rather than rewritten when a decision changes. The identifiers in parentheses (D2, D7, D10) are the decision numbers used in the stabilization reports.
| Record | Decision |
|---|---|
| ADR-001 | Cost and procurement prices are visible to managers and above (D2) |
| ADR-002 | A sole owner cannot delete their account (D7) |
| ADR-003 | Only owners may delete or transfer a workspace (D10) |
| ADR-004 | Deploys are gated by CI, not by branch protection |
| ADR-005 | The login cart merge is fixed with Stage 3 checkout |
| ADR-006 | The session cookie is shared across the root domain and subdomains |
| ADR-007 | PostgreSQL is the only supported database engine |
| ADR-008 | Confirmed means fully reserved; no pre-orders against unreceived stock |
| ADR-009 | No stem recovery after cancelling an assembled order, in the first release |
| ADR-010 | Orders freeze when assembly starts; pending and confirmed are amendable |
| ADR-011 | The inventory ledger is the only stock writer; batches are never hard-deleted |
| ADR-012 | Before launch, a stamped local run of every CI check may gate the deploy (DEPLOY_GATE=local) |
| ADR-013 | Storefronts are Astro themes on a public, versioned Storefront API; configuration is versioned and edited by settings and an internal agent |
| ADR-014 | Stage 3A checkout: guests send an order request the shop confirms; pickup, flat-fee delivery or a Uklon courier; offline payment recorded by staff; a private status link |
| ADR-015 | Uklon courier delivery: estimated at checkout, booked at dispatch within the shop’s tolerance, paid by bank transfer before dispatch, hidden until the shop connects its account |
| ADR-016 | A removable demo shop: loaded through the real services, every record marked, removed in one transaction as the only exception to the append-only rules; the storefront says demo, and its orders are marked test orders (amended 6 October 2026) |
| ADR-017 | Platform AI keys from the environment for shops without their own (the shop’s key wins); Freepik is now Magnific |
| ADR-018 | Finance: revenue on delivery in the shop’s timezone, net of refunds; the order page’s material cost; purchases are not an expense; a missing cost makes profit unknown; operating expenses recorded by managers and above |
| ADR-019 | Sign in with Google: Google-verified addresses only, found by Google id then linked by email, pre-hijacking closed, two-factor still applies; off until configured |
| ADR-020 | Onboarding reminders: one email per stalled step (confirm email, create shop, add flowers, turn on ordering), once, for accounts from the last 30 days, with a signed one-click opt-out |
| ADR-021 | Team invitations: managers invite, admins and the owner change roles and remove, only below their own role; hashed single-use links for 7 days that join only the invited address and confirm it |
| ADR-022 | Custom domains through Cloudflare for SaaS: the storefront only, one address per shop with a redirect from the other, “Full” encryption for foreign hosts, www recommended, owner-only, polled |
| ADR-023 | Dependency updates: advisories within two working days, in-range updates weekly through Dependabot, majors quarterly one framework at a time, production’s PHP and Node as the bound, nothing auto-merged |