ADR-0007: record approved GraphQL DataLoader architecture

[ja573]

Task identity

• Programme: Shared Thoth GraphQL / Backend Architecture
• Task ID: THOTH-GQL-ADR-0007-RECORD-01
• Risk: HIGH — cross-programme architecture control, documentation-only
• Exact base: develop at 2bec75e6698232f7643862120e5437452fcfa252 (verified unmoved at task start)
• Branch: docs/shared-architecture/adr-0007-dataloader
• PR target: develop

Authority

The CTO explicitly approved the exact ADR-0007 architecture on 2026-08-11, following the independently reviewed THOTH-GQL-DATALOADER-SPIKE-02 outcome (APPROVED - B0 FEASIBLE).

Approved source artifact: ADR-0007-conventional-request-scoped-graphql-dataloader.md
Approved source SHA-256 (verified before use, exact match):
05978f9c8aa556ba7fb1d2cc6522ea075bd50c9770f9fc48cdab3a9bda0fcde7

The repository copy differs from the approved PROPOSED artifact only in mechanical approval-state metadata: header Status: APPROVED + Approved by: CTO / Approval date: 2026-08-11; the header Supersedes: conditional clause resolved to ADR-0006; and the section 14 approval-state block updated to APPROVED with the same metadata and tense. No architectural decision, invariant, option, rollout, rollback, evidence interpretation or implementation boundary changed (full delta shown in the review diff).

This PR records the approved decision. It does not itself constitute independent approval or merge authorization.

Scope — the four authorized documentation surfaces

1. docs/engineering/decisions/ADR-0007-conventional-request-scoped-graphql-dataloader.md — added (exact approved content + approval-state metadata).
2. docs/engineering/decisions/ADR-0006-request-scoped-graphql-batching.md — status metadata only: Status: SUPERSEDED, Superseded by: ADR-0007, plus a minimal factual supersession notice. Historical body preserved unchanged.
3. docs/engineering/decisions/decision-register.md — ADR-0007 row added (APPROVED, programmes, CTO approval date, supersedes ADR-0006, authority condition, approval ≠ implementation authorization, no production activation); ADR-0006 row set to SUPERSEDED with its historical approval record preserved; a supersession pointer before the historical ADR-0006 narrative; ADR-0007 narrative appended.
4. CHANGELOG.md — one ### Changed entry under ## [Unreleased].

Non-goals

• No B0 implementation (no Rust/Cargo/Context/loader/execution changes).
• No production-field adoption.
• No mutation-guard activation or removal; OFF remains the state; duplicate-mutation execution remains a separately controlled concern.
• No OPS-01/02/03/04 continuation; PR THOTH-GQL-OPS-03: add effective-mode fleet verification #799 untouched and frozen.
• No BE-02 implementation; no Metrics implementation.
• No migrations, no GraphQL schema/SDL change, no runtime effect.

Database migration: NONE · Data migration: NONE · GraphQL schema migration: NONE
Runtime behaviour change: NONE · Production activation: NONE · Authorization behaviour change: NONE · GraphQL request acceptance change: NONE · Deployment: NONE

Evidence

• Approved-source hash verification: exact SHA-256 match (above) before use; in-repo copy re-verified identical before metadata edits.
• Base: origin/develop = 2bec75e6698232f7643862120e5437452fcfa252 at task start (unmoved from the authorized reference base; no reconciliation needed). Exact PR head reviewed: e5dbd8a641c70c7ba266dde6cf609a0c7dfebfb1.
• Changed files: exactly the four surfaces listed above; no Rust/runtime/config/migration/schema/SDL file changed.
• git diff --check: clean.
• Consistency checks: ADR-0007 Supersedes: ADR-0006 ↔ ADR-0006 Superseded by: ADR-0007 ↔ register statuses (APPROVED/SUPERSEDED) agree; ADR numbering has no collision (ADR-0007 was unoccupied); all relative links in the changed documents resolve; the register's historical ADR-0006 narrative is explicitly marked historical.
• CI: reported on this PR by GitHub checks as they run; not asserted here.

Rollout / rollback

Documentation-only control lifecycle: draft PR → fresh independent exact-head review → explicit CTO merge authorization (HIGH-risk cross-programme decision) → merge to develop; only then does ADR-0007 become repository-authoritative. Before merge: close PR/delete branch if rejected. After merge: no history rewrite; material reversal requires a superseding ADR; factual defects use the normal bounded correction workflow.

Review gate

Fresh independent exact-head review required.
Separate explicit CTO merge authorization required.