ADR-0029: The prototype has no accounts, no sync and no favourites

Status: Accepted — amends ADR-0007 Date: 2026-09-02

Decisions

D-60 Accounts are out of prototype scope

No login surface, no cross-device synchronisation, no saved favourites. History and preferences are device-local, which is where D-09 already placed them.

D-61 D-09's anonymous-first ruling stands in full and is strengthened

No safety capability requires an account — now trivially true, because there are no accounts. Home remains the landing route.

Context

D-09 said an account buys exactly two things: cross-device sync and saved favourites. That was written when the effort had no server, so it described a hypothetical. D-40 has since put a server in scope and the work-permit stack carries an authentication library, which turned it into a live decision rather than a deferred one.

What an account would buy a prototype user is nothing: nothing is gated, history is device-local, and the Corpus is identical for every user. Sync and favourites serve someone using two devices, while the user D-09 was protecting is the one who will not log in during an emergency.

Against that sits real backend scope — auth, sessions, a sync protocol, conflict resolution — in an effort where Curation alone is weeks (D-58) and the Corpus is a hard external dependency that is not yet secured (D-14).

Rejected options

• Build accounts and sync as D-09 describes — honours the wording and the stack supports it, rejected as substantial scope for two conveniences no safety capability depends on.
• Ship a login surface that syncs nothing — makes the future path visible in a demo, rejected because a login that buys the user nothing is worse than no login.
• Device-local favourites without accounts — delivers half the value with none of the backend, rejected as scope that still has to be designed and tested for a convenience nobody asked for. Cheap to add later if a user study asks for it.

This ruling may not be re-decided

If a change contradicts this ADR: stop and raise it. Do not implement over it. Do not add a login because the stack makes it easy.

Consequences

Declared gap for the report. The honest framing is the stronger one: the prototype demonstrates that no safety capability needs an account, which is a better finding than an account system nobody in the case study would use.

Coverage

Amends an existing ruling; no new upstream finding lands here.

Upstream	Landed in	Evidence	Note