Adds decision 7: the projection must be discardable and rebuildable from what
Forgejo holds, per repository and fleet-wide.
This is what makes the other decisions checkable. A read model that cannot be
rebuilt from its source is a database with a projection's reputation, and the
difference only surfaces when someone needs to rebuild it. ADR-010 already
asserts a cache may be reconstructed at any time; that claim has never been
executed.
Three properties keep it real: routine rather than emergency, scoped per
repository, and idempotent enough to verify against the forge — which derived
identifiers make possible.
Two refusals are explicit. Reset cannot restore the preliminary overlay, since
the forge does not hold it. And reset must refuse when records exist only in
the projection: on 2026-08-25 that was 111 work records, which a rebuild would
have erased while reporting success.
Also flags an unresolved boundary: hub-native records are not forge-derived and
must survive a rebuild of forge-derived state.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
9162f7e530