Harden CI and switch release builds to tagged immutable images

docs/adr/0001-postgresql-btrfs-cow.md

@@ -0,0 +1,6 @@
+# ADR-0001: PostgreSQL on btrfs with CoW
+
+Status: Accepted
+
+PostgreSQL data remains on the mirrored exclusive btrfs cache with copy-on-write and PostgreSQL page checksums enabled. `chattr +C` is not used because it would remove btrfs data checksums and mirror self-healing for database files. Capacity, WAL growth, and fragmentation will be monitored when operations work is implemented.
+

docs/adr/0002-opaque-object-identities.md

@@ -0,0 +1,6 @@
+# ADR-0002: Opaque object IDs and same-directory promotion
+
+Status: Accepted
+
+Managed objects use opaque physical IDs. PostgreSQL maps SHA-256 content identities to physical objects. Partials and completed blobs share one shard directory so final promotion is a same-directory rename. Blob-manifest export is required because the filesystem alone is not self-describing.
+

docs/adr/0003-incomplete-transfer-posture.md

@@ -0,0 +1,6 @@
+# ADR-0003: Protect commits, not incomplete transfers
+
+Status: Accepted
+
+Committed content and metadata must recover consistently. Incomplete uploads may be failed or discarded after an unclean shutdown. Restart recovery reconciles partial length with the persisted offset and may recompute hashes instead of making incremental hash state crash-durable.
+

docs/adr/0004-single-application-service.md

@@ -0,0 +1,6 @@
+# ADR-0004: Single application service
+
+Status: Accepted
+
+Production runs HTTP handling and PostgreSQL-leased background workers in one Drive container beside PostgreSQL. This favors simple operation on one private Unraid host. Worker failures must be isolated and observable, and durable state must allow later separation without changing domain behavior.
+

docs/adr/0005-http-conflict-semantics.md

@@ -0,0 +1,6 @@
+# ADR-0005: HTTP precondition and conflict semantics
+
+Status: Accepted
+
+Failed `If-Match` or equivalent representation preconditions return `412 Precondition Failed`. Name collisions, invalid hierarchy operations, and other domain conflicts return `409 Conflict`. Both use RFC 9457 problem documents with stable codes and current state where useful.
+

docs/adr/0006-v1-product-scope.md

@@ -0,0 +1,6 @@
+# ADR-0006: Stable-v1 product scope
+
+Status: Accepted
+
+Stable v1 includes file management, resumable transfers, importer, sharing, OnlyOffice, core previews, PWA, backup/recovery foundations, and future-sync-ready file APIs. Desktop sync, Calendar, archive browsing, and 3D previews are deferred without speculative APIs. Other Google-suite categories require separate proposals.
+

docs/adr/0007-open-first-run-setup.md

@@ -0,0 +1,6 @@
+# ADR-0007: Open first-run setup
+
+Status: Accepted risk
+
+An uninitialized server exposes the owner-creation page without a bootstrap secret. Owner creation is an atomic single-winner transaction and setup becomes permanently unavailable afterward. Operations documentation requires completing setup before proxy exposure. The owner accepts the takeover risk if an uninitialized instance is exposed.
+

docs/adr/README.md

@@ -0,0 +1,14 @@
+# Architecture decision records
+
+ADRs are immutable after acceptance. Supersede an earlier decision with a new ADR rather than rewriting its history.
+
+| ADR | Decision | Status |
+| --- | --- | --- |
+| 0001 | PostgreSQL remains on btrfs with CoW | Accepted |
+| 0002 | Opaque object IDs and same-directory promotion | Accepted |
+| 0003 | Protect commits, not incomplete transfers | Accepted |
+| 0004 | Single application service | Accepted |
+| 0005 | HTTP precondition and conflict status codes | Accepted |
+| 0006 | Stable-v1 and deferred product scope | Accepted |
+| 0007 | Open first-run setup | Accepted risk |
+