# ADR-003 — Do not extract microservices until measurement gates pass

## Status

Accepted (Phase 4 planning) — **modular monolith remains the default**

## Context

The production-readiness plan and diligence review both forbid a microservices rewrite for its own sake. Phase 1 already isolated the **notification/job worker process** inside the same deployable (`api-worker`). Phase 4 candidates (payments/webhooks, notification worker as a separate *service*, media processing) are optional extractions only after Phase 3 load/ownership evidence shows a real bottleneck or blast-radius problem.

## Decision

1. **Default:** keep one API codebase + dedicated worker process(es) sharing the same package and schema.
2. **Do not** create new deployable services for payments, webhooks, or media until **all** gates in `docs/ops/phase4-extraction-gates.md` are met for that candidate.
3. Prefer in-monolith hardening first: clearer module boundaries, queue isolation, separate worker replicas, object-storage media pipeline — without new network hops.
4. Any approved extraction must ship with: ownership, SLO, independent deploy/rollback, contract tests, and dual-run evidence before cutting over.

## Consequences

- Phase 4 work in-repo is **gates, measurement templates, and module-boundary notes** — not a service split.
- Claiming “we moved to microservices” without gate evidence is a non-goal (§11 of the readiness plan).