# ADR-001: Durable job queue via PostgreSQL job_audit

## Status

Accepted (2026-07)

## Context

`jobs.Registry` is in-process. ARCH-04 notes workers do not share memory across API replicas. Jobs were already audited to `job_audit`, but orphans after restart were not reclaimed.

## Decision

Keep in-process execution for latency; add durable reclaim:

1. Persist lifecycle via existing `SetPersistHooks` → `job_audit`.
2. Periodically `ReclaimStaleRunning` + `ClaimQueued` with `FOR UPDATE SKIP LOCKED`.
3. `Registry.Adopt` injects claimed rows into the local worker pool.
4. Claim grace (`EVOBGP_JOB_CLAIM_GRACE`, default 30s) avoids double-run of fresh local enqueues.

NATS JetStream remains optional (`EVOBGP_BROKER_URL` logged only).

## Consequences

Two `evobgp-api` processes can reclaim orphaned work. Fresh jobs still run on the enqueueing process. Full broker-based fan-out is out of scope for this ADR.