ADR-0003: Instant Membership Revocation, Bounded by an Entitlement Lease
Status
Accepted
Context
Two requirements pull in opposite directions: a member's playback access should be cut off the moment their mosque membership changes (no grace period, so a departed or removed member stops receiving azaan promptly), while a device should keep playing scheduled azaan through a transient broker outage rather than going silent on every network hiccup. Handling both by delaying revocation would weaken the first requirement; handling both by never expiring offline playback would defeat the second — a stolen unit must eventually stop working even if it's kept off the network on purpose.
Decision
Membership changes propagate instantly with no grace period. Separately, a playback entitlement lease (default 7 days) bounds how long a device may keep playing from cached authorization while unable to reach the backend. The stolen-hardware risk is handled by the lease expiring, not by delaying membership revocation.
Alternatives Considered
Not recorded in source material.
Consequences
- A legitimate member's access changes take effect immediately — no window where a removed member still receives azaan.
- A device can survive a real broker/network outage without going silent, up to the lease duration — but a stolen or deliberately-offline unit stops playing once the lease expires, without requiring the backend to ever reach it again.
- The exact lease length is a live trade-off, not settled by this decision: shorter tightens the bound on a stolen unit but risks silencing legitimate units during a longer outage or holiday closure. The proposed 7-day default was still open for confirmation at time of writing — see the transmitter roadmap — and must be tied to actual broker recovery time, not chosen as a standalone number.