oath-model: open design threads from grilling session (payloads, deferred seams, ADRs)

[NotAProfDev]

Context

Captured from a /grill-with-docs session on oath-model (2026-06-28). The session
pinned the representation discipline for the model crate and corrected several
CONTEXT.md overclaims; field-level payloads and a set of deferred seams remain open.
This issue tracks what's left so "revisit later" has a home.

As of #51, oath-model already carries the exact-domain numerics — Price,
Quantity, Side, ArithmeticError — and the manifest is cleaned (rust_decimal,
uuid, time dropped; proptest added for tests). The identity and wire types
below are not yet built.

Decisions below are provisional — "agreed for now, will revisit the model later."

Settled this session — representation discipline

• Every canonical message is zero-copy POD (zerocopy, explicit zeroed _pad,
  fixed-size [u8;N] ids/strings). Sum types travel as per-class flat messages on
  distinct topics — never a wire enum; the in-memory enum is reassembled from the
  topic. SBE-codec alternative considered and rejected (its ergonomics need a
  per-message allocation on the hot path; it loses the one-layout = struct = bus = log
  property and adds a decode step to Event-Log replay).
• Instrument = one type, in-memory enum, distributed as logged
  registration/change messages into a (InstrumentId, Source) blackboard Core folds
  on. Symbol = [u8;16].
• Source [u8;16] (connection-independent), Account { source, id[48] } = 64B,
  StrategyId [u8;16].
• Order-id family all in oath-model: OrderId / OrderInstructionId =
  { env[16], gen u64, counter u64 } (32B), BrokerOrderId [u8;48].
• Signal = { strategy, instrument, TargetSign(Flat/Long/Short)+Quantity, as_of, revision }, LatestValue-keyed (strategy, instrument).
• CONTEXT.md corrected: Source, Order Id, Instrument — the "never on the
  wire" overclaims are gone.

Open — payload fields

• T6 — Position fields: avg-price stored-on-wire vs derived;
  realized/unrealized P&L; signed-exposure field; key (Account, InstrumentId).
• T7 — Instrument fields: quote-currency type ([u8;4] ISO-4217 vs enum);
  asset-class enum; tick/lot/multiplier fixed-point types; the per-class tail structs.

Open — deferred seams (confirm-park)

• Position / PositionView split (deferred — ADR-0028)
• self-describing in-process Price { raw, precision } (deferred — ADR-0023)
• schema_version machinery (deferred — ADR-0027)
• bnum-class bigint choice for the 256-bit money intermediate (ADR-0023)
• Duration / offset type (i64 nanos — ADR-0027)
• rounding helpers (banker's internal; direction-aware at emission — ADR-0023)
• glossary: add StrategyId, TargetSign once firmed

Open — documentation follow-ups

• New ADR refining 0027 — POD-everywhere + per-class-messages (not wire enums)
  • Instrument-as-logged-blackboard + SBE-considered-rejected. Biggest conceptual
    output of the session; worth writing before it's lost.
• ADR-0028 — placement row for the three order ids (published-identity vs
  internal-reasoning rule that separates them from Decision).
• ADR-0025 — Source connection-independent semantics; Account / Source /
  StrategyId / BrokerOrderId representations; fix the §2-vs-§5 "Instrument off-wire"
  contradiction.

Next concrete step (settled, not provisional)

• Manifest cleanup: drop rust_decimal + uuid + time — done in feat(model): numeric primitives (Price, Quantity, Side, ArithmeticError) #51.
• Add zerocopy + a bnum-class bigint to crates/model/Cargo.toml when the
  wire types land (ADR-0027 / ADR-0023).
• Implement the identity + wire types per the representation decisions above —
  InstrumentId, Symbol, Account, Source, StrategyId, the order-id family — as
  fixed-size POD newtypes with zerocopy derives + compile-time size_of/no-padding
  asserts. This is the real next build step now that the numerics (feat(model): numeric primitives (Price, Quantity, Side, ArithmeticError) #51) have landed.

---

_{Captured from a /grill-with-docs session. Individual items spawn their own
issue + PR when picked up (one-issue-one-PR).}