{
  "id": "ADR-001",
  "title": "Keep rate refreshes on the database queue",
  "status": "active",
  "date": "2026-01-12",
  "owner_role": "pricing-platform-owner",
  "question": "How should accepted rate refresh jobs leave the request without adding an unowned broker?",
  "context": "The synthetic pricing module commits refresh requests beside the order revision and one team operates the application and PostgreSQL database.",
  "constraints": [
    "the request and queued job must commit atomically",
    "steady arrival remains below 18 jobs per second",
    "the team operates PostgreSQL but no message broker",
    "a refresh may wait two seconds without violating the reader contract"
  ],
  "alternatives": [
    {
      "name": "synchronous refresh",
      "current_state": true,
      "disposition": "rejected",
      "reason": "provider latency would remain inside the request and exceed the response budget"
    },
    {
      "name": "database queue",
      "disposition": "selected",
      "reason": "it preserves the transaction boundary and uses the owned operating surface at the measured arrival rate"
    },
    {
      "name": "external broker",
      "disposition": "deferred",
      "reason": "it adds independent publication and operation before throughput or ownership requires that boundary"
    }
  ],
  "evidence": [
    {
      "id": "queue-baseline",
      "observed_at": "2026-01-11T12:00:00Z",
      "source": "metrics/queue-active.json",
      "facts": {
        "arrival_per_second": 14,
        "p95_age_seconds_30m": 1.2,
        "database_io_percent_30m": 12
      },
      "uncertainty": "synthetic half-hour snapshot; not a capacity forecast"
    }
  ],
  "decision": "Use the existing PostgreSQL queue for rate refreshes while every declared reversal condition remains false.",
  "consequences": {
    "positive": [
      "enqueue and order revision share one transaction",
      "the current team owns the complete operating surface"
    ],
    "negative": [
      "queue work competes with application queries for database IO",
      "database failure pauses both requests and refresh work"
    ],
    "obligations": [
      "measure queue age and database IO over the declared window",
      "retain a bounded recovery procedure"
    ]
  },
  "links": [
    {
      "kind": "configuration",
      "path": "system/queue/config.json",
      "anchor": "rate-refresh"
    },
    {
      "kind": "capacity-check",
      "path": "system/queue/capacity-check.mjs",
      "anchor": "evaluateQueueCapacity"
    },
    {
      "kind": "runbook",
      "path": "system/runbooks/queue-recovery.md",
      "anchor": "Rate refresh queue"
    }
  ],
  "reversal_conditions": [
    {
      "metric": "p95_age_seconds_30m",
      "operator": ">",
      "threshold": 2,
      "window": "30m",
      "source": "metrics/queue-active.json",
      "owner_role": "pricing-platform-owner"
    },
    {
      "metric": "database_io_percent_30m",
      "operator": ">",
      "threshold": 20,
      "window": "30m",
      "source": "metrics/queue-active.json",
      "owner_role": "pricing-platform-owner"
    }
  ],
  "status_events": [
    {
      "status": "active",
      "at": "2026-01-12T09:00:00Z",
      "reason": "accepted from queue-baseline evidence",
      "owner_role": "pricing-platform-owner"
    }
  ],
  "provenance": "synthetic fixture; no Brian-supplied experience"
}