fix production issues

docs/ADR-003-defer-service-extraction.md

@@ -0,0 +1,21 @@
+# ADR-003 — Do not extract microservices until measurement gates pass
+
+## Status
+
+Accepted (Phase 4 planning) — **modular monolith remains the default**
+
+## Context
+
+The production-readiness plan and diligence review both forbid a microservices rewrite for its own sake. Phase 1 already isolated the **notification/job worker process** inside the same deployable (`api-worker`). Phase 4 candidates (payments/webhooks, notification worker as a separate *service*, media processing) are optional extractions only after Phase 3 load/ownership evidence shows a real bottleneck or blast-radius problem.
+
+## Decision
+
+1. **Default:** keep one API codebase + dedicated worker process(es) sharing the same package and schema.
+2. **Do not** create new deployable services for payments, webhooks, or media until **all** gates in `docs/ops/phase4-extraction-gates.md` are met for that candidate.
+3. Prefer in-monolith hardening first: clearer module boundaries, queue isolation, separate worker replicas, object-storage media pipeline — without new network hops.
+4. Any approved extraction must ship with: ownership, SLO, independent deploy/rollback, contract tests, and dual-run evidence before cutting over.
+
+## Consequences
+
+- Phase 4 work in-repo is **gates, measurement templates, and module-boundary notes** — not a service split.
+- Claiming “we moved to microservices” without gate evidence is a non-goal (§11 of the readiness plan).