docs(adr): compress to 10 records in the domain-modeling format (#128)

* docs(adr): compress to 10 records in the domain-modeling format

Drop 0001, 0010, 0011, 0017; merge 0009 into 0003, 0014 into 0006,
0008 into 0007; record the #118 manual-control decline in 0005. Each
record is now title plus one paragraph, without the Decision / rationale
/ Revisit-trigger sections. Numbers stay stable, with gaps.

* docs(adr): renumber the surviving records 0001-0010

Author: lesnik512

AGENTS.md

@@ -45,7 +45,9 @@ Every module under `src/httpware/` is named for what it does; read it. What a si
   `DecodeError`. A decoder's `can_decode` runs outside that wrap, so it must never raise.
 - `_internal/` is the cross-module private home; `_internal/observability.py:_emit_event` is the
   single fan-out to both a logging record and an OTel span event, and the event names it takes are
-  a public contract (see `CONTEXT.md`).
+  a public contract (see `CONTEXT.md`). Logic shared only by a sync/async sibling pair stays a
+  free function in the module that owns the behaviour; `_internal/` is for sharing across
+  otherwise unrelated modules.
 - `middleware/resilience/` keeps the shared logic objects (`_RetryPolicy`, `_CircuitBreakerState`,
   `RetryBudget`, `_backoff`, `_event_loop_guard`) written once and driven by both worlds. New
   resilience logic goes in a shared object, not into each world's shell.

docs/adr/0001-decoders-parse-in-a-single-pass.md

@@ -0,0 +1,7 @@
+# No OpenTelemetry tracing middleware
+
+httpware ships an `otel` extra but no span-creating middleware. `opentelemetry-instrumentation-httpx`
+already wraps the transport and sees redirects, connection reuse, and transport-level retries that a
+middleware cannot, and a second span layer would double the tree. httpware only adds `retry.*`,
+`bulkhead.*`, `circuit.*`, and `timeout.*` events to the active span, which is why the extra depends
+on `opentelemetry-api` and not the SDK.

docs/adr/0001-no-opentelemetry-middleware.md

@@ -0,0 +1,9 @@
+# Sync/async parity is hand-maintained, with one named exception
+
+`Client`/`AsyncClient` and each resilience middleware are two hand-written classes. Unasync-style
+codegen was rejected because it adds a build step and a generated file that is either committed and
+lying or absent from tracebacks, while the duplication that hurts is logic, which is extracted into
+shared objects such as `_RetryPolicy` and `_CircuitBreakerState` rather than transformed. The one
+deliberate break is `AsyncTimeout` without a sync sibling: sync Python cannot interrupt a blocking
+call mid-flight, so a sync `Timeout` would promise a deadline and deliver a suggestion, and `httpx2`'s
+per-call timeouts are the documented sync answer. `tests/test_client_parity.py` enforces both halves.

docs/adr/0002-no-opentelemetry-middleware.md

@@ -0,0 +1,7 @@
+# 4xx, including 429, counts as a circuit-breaker success
+
+The default failure set is 5xx only. A 429 means the backend is up and throttling, and a 404 or 422
+describes the request, so tripping on either turns a healthy service into an outage for every caller
+of a shared breaker. Exceptions other than `NetworkError`, httpware `TimeoutError`, and `StatusError`
+leave circuit state untouched, so the breaker cannot trip on load-shedding it caused itself.
+`failure_status_codes` is the per-deployment override, not a default worth flipping.

docs/adr/0002-sync-async-parity-is-hand-maintained.md

@@ -0,0 +1,11 @@
+# Circuit breaker scope: time-based window, no slow-call rate, no manual control
+
+Rate mode uses a rolling `window_seconds` gated by `minimum_calls`. A count-based "last N calls"
+window was rejected because on low traffic it reaches back past deploys and recoveries, and
+`minimum_calls` already supplies the sample-size guarantee. A slow-call rate is not added because
+`AsyncTimeout` already converts a slow call into a counted `TimeoutError`. `force_open()` /
+`force_closed()` in the style of Polly's `ManualControl` were declined in
+[#118](https://github.com/modern-python/httpware/issues/118): breaker state is per process, so
+pinning one replica sheds nothing fleet-wide, and the fixes that do work, a config flag read by every
+replica or state in Redis, reduce to a check the caller makes before sending or to I/O inside a
+transition.

docs/adr/0003-4xx-does-not-trip-the-circuit-breaker.md

@@ -0,0 +1,11 @@
+# Decoder dispatch is a frozen ordered list with broad claims
+
+`decoders=` is resolved once at `__init__` and walked in order by `_DecoderResolver.resolve`. There
+is no per-call override, which would be a second dispatch site the pre-flight `MissingDecoderError`
+check cannot see, and no stdlib `json` fallback, which would return a `dict` that type-checks as the
+model. Each decoder claims every model its library can parse, not only its native base class,
+because narrow claims reject `dict`, `list[Foo]`, dataclasses, and primitives; native types still
+route unambiguously since each library rejects the other's, and list order settles the
+library-agnostic middle. `can_decode` runs outside the `DecodeError` wrap and must return False
+rather than raise. A defensive wrap was rejected because it would turn a broken probe into a silent
+misroute.