Decisions

One decision per file: what was decided, why, and the code, PR or CI job that proves it. See also the docs index for the full documentation map.

Entries are not edited into agreement with later thinking. A decision that no longer holds gets a new file that supersedes it, so the reason the old one looked right at the time survives.

Decision	Summary
Core must never reference a premium crate	The open-core split is a licence boundary, enforced by a cargo tree assertion
Locks are parking_lot, never std::sync	std locks poison on panic, turning one fault into permanent failure
Tests run single-threaded	The suites share filesystem state
Repository scripts are tested with stdlib unittest	The gate jobs use a bare setup-python; a skipped guard reads like a passing one
The context optimizer refuses high-risk restitution	An unrestorable compiled view is worse than a large one
The shared daemon is reached over native HTTP	The bridge does not recover from an idle-expired session
A repository edit requires a successful causal recall first	Bound to the exact session and checkout, written only after success
Tool results are replaced on one host only	Replacement needs an output contract; parity without one is a claim
Online memory migration is a daemon-owned dirty-state protocol	A durable pre-mutation journal turns a live base copy into a named cutover snapshot