Decision log

Status language: ADOPTED = planning baseline within requested scope, not implemented; ASSUMPTION = usable provisional default with a verification gate; PENDING = must be resolved by the stated task before dependent behavior ships. Do not pause unrelated planning for an unresolved choice.

• D01 — Runtime versions (SELECTED during P01; evidence recorded). Initial alternatives were supported Go/PostgreSQL/PostGIS releases compatible with available images/tooling. Exact selections/pins now live in TOOLCHAIN, backend/go.mod and infra/compose.dev.yml; P01 evidence records their local validation. Why: repeatable builds and operational maintenance. Tradeoff: deliberate maintenance versus accidental upgrades. This workflow revision does not independently revalidate external support/security claims; dependency maintenance and release checks remain required.

• D02 — Deployment capacity (ASSUMPTION, P08-T07). Options: one 16 GB VPS, smaller measured pilot, managed database. Recommend 16 GB single-host starting hypothesis, verified by load/restore evidence. Tradeoff: simple operations versus shared failure/resource domain. Resolve before G09 capacity claim; no vendor purchase during planning.

• D03 — Mobile signatures (ASSUMPTION, P03-T01 and P10-T03). Options: P-256 Keystore, Ed25519 with proven support, bearer-only anonymous identity. Recommend P-256 and a narrow RFC 9421 profile for current Android reach. Tradeoff: challenge/protocol complexity; support/hardware quality varies. Freeze standard byte vectors before backend auth and verify real devices before app release.

• D04 — Price precision and naming (ADOPTED, P02-T01/T02). Options: cents/legacy PREMIUM; milli-BRL and explicit ADDITIVED/units. Recommend exact milli-BRL plus raw source decimal, explicit unit and compatibility fixture; no float. Tradeoff: requires adapter/Room review later. Unknown higher precision quarantined; fixtures before import.

• D05 — Geocoder (PENDING, P02-T07). Options: commercially permitted provider, licensed coordinate dataset, reviewed manual pilot catalog, own geocoder later. Recommend provider/dataset permitting pilot volume with cache/attribution/global quota; missing coordinates remain unknown. Tradeoff: cost/coverage/licensing versus operator burden. Public Nominatim is not assumed valid for national bulk lookup. Resolve provider terms before live use; fixtures permit independent development meanwhile.

• D06 — XLSX parser dependency (SELECTED stdlib, P02-T04). Options: bounded standard ZIP/XML reader or maintained streaming library. Choose standard archive/zip plus streaming encoding/xml with spec caps (30 MiB compressed, 250 MiB content, 100 sheets, 500k rows), traversal/bomb/DOCTYPE guards and no formula evaluation; zero new dependencies, zero license/security/build review surface. Tradeoff: ANP-subset-only reader maintained in-repo versus library breadth; layout drift handled by signature detection (A07), new constructs fail loudly instead of parsing wrong.

• D07 — Retention/legal purposes (PROPOSED, P07-T05). Options: conservative short periods versus longer reviewed cases. Recommend inventory in SECURITY_PRIVACY with 24 h precise payload cap, 14-day sanitized media and bounded audit/backup periods. Tradeoff: less forensic replay versus minimization/cost. Responsible operator/legal review closes lawful bases, rights deadlines and processor terms before pilot/G09.

• D08 — Consensus defaults (ASSUMPTION, P06-T04 and P10-T09). Options: exact groups with conservative quorum or fuzzy clustering. Recommend deterministic consensus-v1 and 48 h anchor expiry, no purchase signals. Tradeoff: more LOW/UNKNOWN and exact-value splitting in exchange for explainability. Synthetic golden calibration before G09; labelled pilot evaluation before tuning a new version.

• D09 — License and contribution terms (MIT ADOPTED; future PENDING). Options: keep MIT; Apache client/new code; AGPL backend. Recommend retain MIT throughout MVP; DCO before external backend contributions; ownership/dependency review before changes. Tradeoff: permissive reuse versus later hosted-copy competition. Any change requires explicit human decision; old MIT rights persist. No current task is blocked by keeping MIT.

• D10 — Brand selected; paid offering pending. The maintainer selected abastevo and supplied the blue/green A logo on 2026-10-01. This resolves project naming and supersedes the earlier provisional-name option. README artwork is awaiting visual approval; name/domain clearance is not claimed. Hosted offerings still require pilot/demand evidence. Preserve com.anpfuel, upstream attribution and MIT; no app/package/repository rename or release follows this documentation choice. See brand identity.

• D11 — Recovery objectives (ASSUMPTION, P08-T04). Options: daily encrypted dumps with RPO24h/RTO4h versus WAL/PITR. Recommend first, if pilot operator accepts measured loss/downtime tolerance. Tradeoff: possible up-to-day write loss versus lower complexity. Restore proof and explicit objective acceptance before G09; stronger claims require new tested design.

• D12 — First pilot and API support window (PENDING, P09-T03/P10-T09). Options: one municipality/small cohort versus broad launch. Recommend one adequately geocoded city/cohort and admission caps; choose size/duration from capacity and moderation coverage. Tradeoff: limited geographic reach but measurable trust/cost. Record minimum v1 support/deprecation window before publishing Android clients; do not silently remove an API used by released apps.

• D13 — Phase delivery and CI cadence (ADOPTED and ACTIVE since G01-FLOW). Options: full suite/PR per microtask, phase delivery with focused local checks and quick CI, or defer all checks to release. Choose phase delivery per ADR-013: task issues/commits, phase branch/PR, wiki mirror per merged phase, full certification at P09/G09. Why: reduce repeated work while preserving immediate critical tests and guarded integration. Tradeoff: broad cross-system failures may surface at candidate certification; task acceptance and the explicit full matrix remain mandatory. Automation and protection migration completed in P01-T17; required check is Quick verification.

Operational owner is the project maintainer; future implementers record who resolved a pending decision, evidence, date and ADR/PR link. No provider/domain/brand/license approval is presumed merely because an option appears here.

• D14 — Functional app before real production (ADOPTED by user, 2026-09-30). ADR-014: G09 is deferred RELEASE after G18; G09-LOCAL integrated local backend opens app work. No security gate is waived.

• D15 — Free accounts and social feedback (ADOPTED). Email access code, Google and Apple; 280-character comments/replies. P13/P14/P17 own secure implementation. Proposed stars 1–5 and reply depth/size-memory budgets are frozen in owning tasks; no purchased trust.

• D16 — All-copy 24-hour photos and native GPS signals (ADOPTED target). Supersedes D07 sanitized 14-day recommendation for photos; P15 enforces new limits with deletion/restore proof. P16 denies known simulated proximity and handles unknown honestly.

• D17 — KMP with Swift native shell (ADOPTED target). ADR-015 and the dated audit drive P12 pins/Java portability; Alpha Swift export is not the production dependency. Actual iOS acceptance requires macOS and device evidence.

• D18 — Commercial Android community and iOS archival (ADOPTED direction, 2026-10-01). ADR-016: new P19–P24 community-first UX, ANP dated reference, historical G18 unaccepted; commercial Android gate G24 before scoped G09. iOS resumes only on a new explicit request. No real launch or future implementation is approved merely by the plan.