release: implement site registry v0.4 trust pipeline

docs/adr/0004-active-and-audit-views.md

@@ -0,0 +1,29 @@
+# ADR 0004: Separate active and audit views
+
+Status: Accepted, 2026-09-13.
+
+Normal export contains only selected, nonrejected facts. Audit export preserves
+active, superseded, and rejected facts with an explicit state and rejection
+reason. Neither export bypasses resolver policy.
+
+Operational consumers need an unambiguous current evidence view, while
+investigators and publishers need conflicting and superseded evidence. One
+ambiguous export could be mistaken for an approved route list.
+
+Version 0.4 keeps the complete audit history inside each generation so rollback,
+diff, and incident inspection remain self-contained. Separating a compact runtime
+projection from content-addressed cold audit bundles is deferred to v0.5 until
+size and latency measurements justify the extra recovery surface.
+
+## Rejected alternatives
+
+Deleting superseded facts loses conflict and replacement evidence. Shipping only
+the audit view makes accidental use as current state too easy. Splitting storage
+before authenticated bundle verification exists risks publishing a runtime index
+whose supporting evidence cannot be recovered.
+
+## Compatibility
+
+The normal JSONL envelope is v2 and contains active assertions only. Audit mode
+uses the same envelope version with explicit active, superseded, rejected, and
+tombstoned rows. V1 consumers must reject the new schema and migrate explicitly.